Upgrade to file version 3.22.

Obtained from: ftp://ftp.deshaw.com/pub/file/file-3.22.tar.gz
1997-03-18 18:00:03 +00:00 · 1997-03-18 18:00:03 +00:00 · 718f6edeea
commit 718f6edeea
parent 749d99ac7a
52 changed files with 1709 additions and 326 deletions
--- a/usr.bin/file/Magdir/alpha
+++ b/usr.bin/file/Magdir/alpha
@ -0,0 +1,21 @@
+#------------------------------------------------------------------------------
+# alpha architecture description
+#
+
+0	leshort		0603		COFF format alpha
+>22	leshort&030000	!020000		executable
+>24	leshort		0410		pure
+>24	leshort		0413		paged
+>22	leshort&020000	!0		dynamically linked
+>16	lelong		!0		not stripped
+>16	lelong		0		stripped
+>22	leshort&030000	020000		shared library
+>24	leshort		0407		object
+>27	byte		x		- version %d
+>26	byte		x		.%d
+>28	byte		x		-%d
+
+# Basic recognition of OSF/1 core dumps - Mike Bremford <mike@opac.bl.uk>
+#
+0	string		Core\001	COFF format core dump (OSF/1)
+>24	string		>\0		generated by '%s'
--- a/usr.bin/file/Magdir/amanda
+++ b/usr.bin/file/Magdir/amanda
@ -0,0 +1,7 @@
+#------------------------------------------------------------------------------
+# amanda:  file(1) magic for amanda file format
+#
+0       string          AMANDA:\ TAPESTART\ DATE     AMANDA dump header file,
+>23     string          X
+>>25    string          >\                           Unused %s
+>23     string          >\                           DATE %s
--- a/usr.bin/file/Magdir/amigaos
+++ b/usr.bin/file/Magdir/amigaos
@ -0,0 +1,10 @@
+#------------------------------------------------------------------------------
+# amigaos:  file(1) magic for AmigaOS binary formats:
+
+#
+# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
+# Some formats are still missing: AmigaOS special IFF's, e.g.: FORM....CTLG
+# (the others should be seperate, anyway)
+#
+0	belong		0x000003f3	AmigaOS loadseg()ble executable/binary
+0	belong		0x000003e7	AmigaOS object/library data
--- a/usr.bin/file/Magdir/archive
+++ b/usr.bin/file/Magdir/archive
@ -45,8 +45,6 @@
 >19	string	B			and an EB hash table
 >22	string	X			-- out of date

-0	string		!<arch>		archive
->8	string		__.SYMDEF	random library
 0	string		-h-		Software Tools format archive text

 #
@ -56,11 +54,10 @@
 # 0	string		!<arch>		current ar archive
 # 0	long		0x213c6172	archive file
 #
-# and for SVR3.1 archives, we have:
+# and for SVR1 archives, we have:
 #
 # 0	string		\<ar>		System V Release 1 ar archive
 # 0	string		=<ar>		archive
-# 0	string		=<ar>		archive
 #
 # XXX - did Aegis really store shared libraries, breakpointed modules,
 # and absolute code program modules in the same format as new-style
@ -68,6 +65,8 @@
 #
 0	string		!<arch>		current ar archive
 >8	string		__.SYMDEF	random library
+>8	string		debian-split	part of multipart Debian package
+>8	string		debian-binary	Debian binary package
 >0	belong		=65538		- pre SR9.5
 >0	belong		=65539		- post SR9.5
 >0	beshort		2		- object archive
@ -96,14 +95,10 @@
 0	leshort		0177545		old PDP-11 archive
 >8	string		__.SYMDEF	random library
 #
-0	string		=<ar>		archive
-#
-# From "pdp":
+# From "pdp" (but why a 4-byte quantity?)
 #
 0	lelong		0x39bed		PDP-11 old archive
 0	lelong		0x39bee		PDP-11 4.0 archive
-#
-0	string		-h-		Software Tools format archive text

 # ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
 #
--- a/usr.bin/file/Magdir/asterix
+++ b/usr.bin/file/Magdir/asterix
@ -0,0 +1,17 @@
+
+#------------------------------------------------------------------------------
+# asterix:  file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
+# strings as "long" - we assume they're just strings:
+# From: guy@netapp.com (Guy Harris)
+#
+0	string		*STA		Aster*x
+>7	string		WORD			Words Document
+>7	string		GRAP			Graphic
+>7	string		SPRE			Spreadsheet
+>7	string		MACR			Macro
+0	string		2278		Aster*x Version 2
+>29	byte		0x36			Words Document
+>29	byte		0x35			Graphic
+>29	byte		0x32			Spreadsheet
+>29	byte		0x38			Macro
+
--- a/usr.bin/file/Magdir/audio
+++ b/usr.bin/file/Magdir/audio
@ -16,6 +16,10 @@
 >12	belong		6		32-bit IEEE floating point,
 >12	belong		7		64-bit IEEE floating point,
 >12	belong		23		8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding),
+>12	belong		24		compressed (8-bit G.722 ADPCM)
+>12	belong		25		compressed (3-bit G.723 ADPCM),
+>12	belong		26		compressed (5-bit G.723 ADPCM),
+>12	belong		27		8-bit A-law,
 >20	belong		1		mono,
 >20	belong		2		stereo,
 >20	belong		4		quad,
@ -54,14 +58,15 @@
 >4	belong		x		- version %ld

 # Microsoft WAVE format (*.wav)
-# [GRR 950115:  probably all of the shorts and longs should be leshort/lelong]
 0	string		RIFF		Microsoft RIFF
 >8	string		WAVE		\b, WAVE audio data
->34	short		>0		\b, %d bit
->22	short		=1		\b, mono
->22	short		=2		\b, stereo
->22	short		>2		\b, %d channels
->24	long		>0		%d Hz
+>>34	leshort		>0		\b, %d bit
+>>22	leshort		=1		\b, mono
+>>22	leshort		=2		\b, stereo
+>>22	leshort		>2		\b, %d channels
+>>24	lelong		>0		%d Hz
+# AVI == Audio Video Interleave
+>8      string          AVI\            \b, AVI data

 # Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
 # [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
@ -71,3 +76,15 @@
 >45	byte		x		%d instruments
 >83	byte		0		(module)
 >83	byte		1		(song)
+
+# Real Audio (Magic .ra\0375)
+0	belong		0x2e7261fd	realaudio sound file
+
+# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
+# Oct 31, 1995
+0	string		MTM		MultiTracker Module sound file
+0	string		if		Composer 669 Module sound data
+0	string		FAR		Module sound data
+0	string		MAS_U		ULT(imate) Module sound data
+0x2c	string		SCRM		ScreamTracker III Module sound data
+0	string		Extended Module	Extended Module sound data
--- a/usr.bin/file/Magdir/bsdi
+++ b/usr.bin/file/Magdir/bsdi
@ -1,2 +1,7 @@
-# BSDI BSD/386
-0	long	0314	BSD/386 demand paged (first page unmapped) pure executable
+
+#------------------------------------------------------------------------------
+# bsdi:  file(1) magic for BSD/OS (from BSDI) objects
+#
+0	lelong			000000314	BSD/OS i386 compact demand paged executable
+>16	lelong			>0		not stripped
+>32	byte			0x6a		(uses shared libs)
--- a/usr.bin/file/Magdir/compress
+++ b/usr.bin/file/Magdir/compress
@ -79,8 +79,14 @@
 #
 # This will cause very short GSM files to be declared as data and
 # mismatches to be declared as data too!
-#0	byte&0xF0	0xd0	data
+#0	byte&0xF0	0xd0		data
 #>33	byte&0xF0	0xd0
 #>66	byte&0xF0	0xd0
 #>99	byte&0xF0	0xd0
-#>132	byte&0xF0	0xd0	GSM 06.10 compressed audio
+#>132	byte&0xF0	0xd0		GSM 06.10 compressed audio
+
+# Bzip from ulmo@Q.Net
+0	string		BZ		bzip compressed	data,
+>2	byte		x		format v. %c,
+>3	byte		x		block size indicator %c
+
--- a/usr.bin/file/Magdir/convex
+++ b/usr.bin/file/Magdir/convex
@ -1,7 +1,69 @@
-
 #------------------------------------------------------------------------------
 # convex:  file(1) magic for Convex boxes
 #
 # Convexes are big-endian.
 #
-0	long		0513		Convex executable
+# /*\
+#  * Below are the magic numbers and tests added for Convex.
+#  * Added at beginning, because they are expected to be used most.
+# \*/
+0	belong	0507	Convex old-style object
+>16	belong	>0	not stripped
+0	belong	0513	Convex old-style demand paged executable
+>16	belong	>0	not stripped
+0	belong	0515	Convex old-style pre-paged executable
+>16	belong	>0	not stripped
+0	belong	0517	Convex old-style pre-paged, non-swapped executable
+>16	belong	>0	not stripped
+0	belong	0x011257	Core file
+#
+# The following are a series of dump format magic numbers.  Each one
+# corresponds to a drastically different dump format.  The first on is
+# the original dump format on a 4.1 BSD or earlier file system.  The
+# second marks the change between the 4.1 file system and the 4.2 file
+# system.  The Third marks the changing of the block size from 1K
+# to 2K to be compatible with an IDC file system.  The fourth indicates
+# a dump that is dependent on Convex Storage Manager, because data in
+# secondary storage is not physically contained within the dump.
+# The restore program uses these number to determine how the data is
+# to be extracted.
+#
+24	belong	=60011	dump format, 4.1 BSD or earlier
+24	belong	=60012	dump format, 4.2 or 4.3 BSD without IDC
+24	belong	=60013	dump format, 4.2 or 4.3 BSD (IDC compatible)
+24	belong	=60014	dump format, Convex Storage Manager by-reference dump
+#
+# what follows is a bunch of bit-mask checks on the flags field of the opthdr.
+# If there is no `=' sign, assume just checking for whether the bit is set?
+#
+0	belong	0601		Convex SOFF
+>88	belong&0x000f0000	=0x00000000	c1
+>88	belong			&0x00010000	c2
+>88	belong			&0x00020000	c2mp
+>88	belong			&0x00040000	parallel
+>88	belong			&0x00080000	intrinsic
+>88	belong			&0x00000001	demand paged
+>88	belong			&0x00000002	pre-paged
+>88	belong			&0x00000004	non-swapped
+>88	belong			&0x00000008	POSIX
+#
+>84	belong			&0x80000000	executable
+>84	belong			&0x40000000	object
+>84	belong&0x20000000	=0		not stripped
+>84	belong&0x18000000	=0x00000000	native fpmode
+>84	belong&0x18000000	=0x10000000	ieee fpmode
+>84	belong&0x18000000	=0x18000000	undefined fpmode
+#
+0	belong			0605		Convex SOFF core
+#
+0	belong			0607		Convex SOFF checkpoint
+>88	belong&0x000f0000	=0x00000000	c1
+>88	belong			&0x00010000	c2
+>88	belong			&0x00020000	c2mp
+>88	belong			&0x00040000	parallel
+>88	belong			&0x00080000	intrinsic
+>88	belong			&0x00000008	POSIX
+#
+>84	belong&0x18000000	=0x00000000	native fpmode
+>84	belong&0x18000000	=0x10000000	ieee fpmode
+>84	belong&0x18000000	=0x18000000	undefined fpmode
--- a/usr.bin/file/Magdir/database
+++ b/usr.bin/file/Magdir/database
@ -17,16 +17,18 @@
 >8	belong	1234		Little Endian,
 >8	belong	4321		Big Endian,
 >12	belong	x		Bucket Size %d,
->16	belong	x		Directory Size %d,
->20	belong	x		Segment Size %d,
->24	belong	x		Segment Shift %d,
->28	belong	x		Overflow Point %d,
->32	belong	x		Last Freed %d,
->36	belong	x		Max Bucket %d,
->40	belong	x		High Mask 0x%x,
->44	belong	x		Low Mask 0x%x,
->48	belong	x		Fill Factor %d,
->52	belong	x		Number of Keys %d)
+>16	belong	x		Bucket Shift %d,
+>20	belong	x		Directory Size %d,
+>24	belong	x		Segment Size %d,
+>28	belong	x		Segment Shift %d,
+>32	belong	x		Overflow Point %d,
+>36	belong	x		Last Freed %d,
+>40	belong	x		Max Bucket %d,
+>44	belong	x		High Mask 0x%x,
+>48	belong	x		Low Mask 0x%x,
+>52	belong	x		Fill Factor %d,
+>56	belong	x		Number of Keys %d)
+#
 #
 0	belong	0x053162	Berkeley DB Btree file
 >4	belong	>0		(Version %d,
--- a/usr.bin/file/Magdir/digital
+++ b/usr.bin/file/Magdir/digital
@ -0,0 +1,41 @@
+#  Digital UNIX - Info
+#
+0	string	^!<arch>\n_______64E	Alpha archive
+>22	string	X			-- out of date
+#
+# Alpha COFF Based Executables
+# The stripped stuff really needs to be an 8 byte (64 bit) compare,
+# but this works
+0	leshort		0x183		COFF format alpha
+>22	leshort&020000	&010000		sharable library,
+>22	leshort&020000	^010000		dynamically linked,
+>24	leshort		0410		pure
+>24	leshort		0413		demand paged
+>8	lelong		>0		executable or object module, not stripped
+>8	lelong		0
+>>12	lelong		0		executable or object module, stripped
+>>12	lelong		>0		executable or object module, not stripped
+>27     byte            >0              - version %d.
+>26     byte            >0              %d-
+>28     leshort         >0              %d
+#
+# The next is incomplete, we could tell more about this format,
+# but its not worth it.
+0	leshort		0x188	Alpha compressed COFF
+0	leshort		0x18f	Alpha u-code object
+#
+#
+# Some other interesting Digital formats,
+0	string	\377\377\177		ddis/ddif
+0	string	\377\377\174		ddis/dots archive
+0	string	\377\377\176		ddis/dtif table data
+0	string	\033c\033		LN03 output
+0	long	04553207		X image
+#
+0	string	!<PDF>!\n		profiling data file
+#
+# Locale data tables (MIPS and Alpha).
+#
+0	short		0x0501		locale data table
+>6	short		0x24		for MIPS
+>6	short		0x40		for Alpha
--- a/usr.bin/file/Magdir/dump
+++ b/usr.bin/file/Magdir/dump
@ -43,8 +43,8 @@
 >888	belong	>0		Flags %x

 24	lelong	60012		new-fs dump file (little endian),
->4	ledate	x		Previous dump %s,
->8	ledate	x		This dump %s,
+>4	ledate	x		This dump %s,
+>8	ledate	x		Previous dump %s,
 >12	lelong	>0		Volume %ld,
 >692	lelong	0		Level zero, type:
 >692	lelong	>0		Level %d, type:
--- a/usr.bin/file/Magdir/elf
+++ b/usr.bin/file/Magdir/elf
@ -5,8 +5,8 @@
 # We have to check the byte order flag to see what byte order all the
 # other stuff in the header is in.
 #
-# Byte order is probably big-endian for MIPS RS3000 and Amdahl.
 # MIPS RS3000 may also be for MIPS RS2000.
+# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
 #
 # updated by Daniel Quinlan (quinlan@yggdrasil.com)
 0	string		\177ELF		ELF
@ -19,7 +19,9 @@
 >>16	leshort		1		relocatable,
 >>16	leshort		2		executable,
 >>16	leshort		3		shared object,
->>16	leshort		4		core file,
+# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
+>>16	leshort		4		core file
+>>>400  lelong          >0              (signal %d),
 >>16	leshort		&0xff00		processor-specific,
 >>18	leshort		0		no machine,
 >>18	leshort		1		AT&T WE32100 - invalid byte order,
@ -29,8 +31,16 @@
 >>18	leshort		5		Motorola 88000 - invalid byte order,
 >>18	leshort		6		Intel 80486,
 >>18	leshort		7		Intel 80860,
->>18	leshort		8		MIPS RS3000,
->>18	leshort		9		Amdahl,
+>>18	leshort		8		MIPS RS3000_BE - invalid byte order,
+>>18	leshort		9		Amdahl - invalid byte order,
+>>18	leshort		10		MIPS RS3000_LE,
+>>18	leshort		11		RS6000 - invalid byte order,
+>>18	leshort		15		PA_RISC - invalid byte order,
+>>18	leshort		16		nCUBE,
+>>18	leshort		17		VPP500,
+>>18	leshort		18		SPARC32PLUS,
+>>18	leshort		20		PowerPC,
+>>18	leshort		0x9026		Alpha,
 >>20	lelong		0		invalid version
 >>20	lelong		1		version 1
 >>36	lelong		1		MathCoPro/FPU/MAU Required
@ -40,6 +50,7 @@
 >>16	beshort		2		executable,
 >>16	beshort		3		shared object,
 >>16	beshort		4		core file,
+>>>400	lelong		>0		(signal %d),
 >>16	beshort		&0xff00		processor-specific,
 >>18	beshort		0		no machine,
 >>18	beshort		1		AT&T WE32100,
@ -49,8 +60,16 @@
 >>18	beshort		5		Motorola 88000,
 >>18	beshort		6		Intel 80486 - invalid byte order,
 >>18	beshort		7		Intel 80860,
->>18	beshort		8		MIPS RS3000,
->>18	leshort		9		Amdahl,
+>>18	beshort		8		MIPS RS3000_BE,
+>>18	beshort		9		Amdahl,
+>>18	beshort		10		MIPS RS3000_LE - invalid byte order,
+>>18	beshort		11		RS6000,
+>>18	beshort		15		PA_RISC,
+>>18	beshort		16		nCUBE,
+>>18	beshort		17		VPP500,
+>>18	beshort		18		SPARC32PLUS,
+>>18	beshort		20		PowerPC,
+>>18	beshort		0x9026		Alpha,
 >>20	belong		0		invalid version
 >>20	belong		1		version 1
 >>36	belong		1		MathCoPro/FPU/MAU Required
--- a/usr.bin/file/Magdir/freebsd
+++ b/usr.bin/file/Magdir/freebsd
@ -1,16 +1,130 @@
-# the following are for 386BSD/FreeBSD

-0	lelong			0410		pure executable
-0	lelong			0413		demand paged executable
-0	lelong&077777777	041400314	FreeBSD/i386 demand paged
->3	byte			&0x80
->>20	lelong			<4096		shared library
->>20	lelong			=4096		dynamically linked executable
->>20	lelong			>4096		dynamically linked executable
->3	byte			^0x80		executable
+#------------------------------------------------------------------------------
+# freebsd:  file(1) magic for FreeBSD objects
+#
+# All new-style FreeBSD magic numbers are in host byte order (i.e.,
+# little-endian on x86).
+#
+# XXX - this comes from the file "freebsd" in a recent FreeBSD version of
+# "file"; it, and the NetBSD stuff in "netbsd", appear to use different
+# schemes for distinguishing between executable images, shared libraries,
+# and object files.
+#
+# FreeBSD says:
+#
+#    Regardless of whether it's pure, demand-paged, or none of the
+#    above:
+#
+#	if the entry point is < 4096, then it's a shared library if
+#	the "has run-time loader information" bit is set, and is
+#	position-independent if the "is position-independent" bit
+#	is set;
+#
+#	if the entry point is >= 4096 (or >4095, same thing), then it's
+#	an executable, and is dynamically-linked if the "has run-time
+#	loader information" bit is set.
+#
+# On x86, NetBSD says:
+#
+#    If it's neither pure nor demand-paged:
+#
+#	if it has the "has run-time loader information" bit set, it's
+#	a dynamically-linked executable;
+#
+#	if it doesn't have that bit set, then:
+#
+#	    if it has the "is position-independent" bit set, it's
+#	    position-independent;
+#
+#	    if the entry point is non-zero, it's an executable, otherwise
+#	    it's an object file.
+#
+#    If it's pure:
+#
+#	if it has the "has run-time loader information" bit set, it's
+#	a dynamically-linked executable, otherwise it's just an
+#	executable.
+#
+#    If it's demand-paged:
+#
+#	if it has the "has run-time loader information" bit set,
+#	then:
+#
+#	    if the entry point is < 4096, it's a shared library;
+#
+#	    if the entry point is = 4096 or > 4096 (i.e., >= 4096),
+#	    it's a dynamically-linked executable);
+#
+#	if it doesn't have the "has run-time loader information" bit
+#	set, then it's just an executable.
+#
+# (On non-x86, NetBSD does much the same thing, except that it uses
+# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
+# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
+# had 8K pages; dunno about MIPS.)
+#
+# I suspect the two will differ only in perverse and uninteresting cases
+# ("shared" libraries that aren't demand-paged and whose pages probably
+# won't actually be shared, executables with entry points <4096).
+#
+# I leave it to those more familiar with FreeBSD and NetBSD to figure out
+# what the right answer is (although using ">4095", FreeBSD-style, is
+# probably better than separately checking for "=4096" and ">4096",
+# NetBSD-style).  (The old "netbsd" file analyzed FreeBSD demand paged
+# executables using the NetBSD technique.)
+#
+0	lelong&0377777777	041400407	FreeBSD/i386
+>20	lelong			<4096
+>>3	byte&0xC0		&0x80		shared library
+>>3	byte&0xC0		0x40		PIC object
+>>3	byte&0xC0		0x00		object
+>20	lelong			>4095
+>>3	byte&0x80		0x80		dynamically linked executable
+>>3	byte&0x80		0x00		executable
 >16	lelong			>0		not stripped

-# This covers object files, and is better than "PDP-11 executable"
-0	lelong			000000407	impure format
+0	lelong&0377777777	041400410	FreeBSD/i386 pure
+>20	lelong			<4096
+>>3	byte&0xC0		&0x80		shared library
+>>3	byte&0xC0		0x40		PIC object
+>>3	byte&0xC0		0x00		object
+>20	lelong			>4095
+>>3	byte&0x80		0x80		dynamically linked executable
+>>3	byte&0x80		0x00		executable
 >16	lelong			>0		not stripped

+0	lelong&0377777777	041400413	FreeBSD/i386 demand paged
+>20	lelong			<4096
+>>3	byte&0xC0		&0x80		shared library
+>>3	byte&0xC0		0x40		PIC object
+>>3	byte&0xC0		0x00		object
+>20	lelong			>4095
+>>3	byte&0x80		0x80		dynamically linked executable
+>>3	byte&0x80		0x00		executable
+>16	lelong			>0		not stripped
+
+0	lelong&0377777777	041400314	FreeBSD/i386 compact demand paged
+>20	lelong			<4096
+>>3	byte&0xC0		&0x80		shared library
+>>3	byte&0xC0		0x40		PIC object
+>>3	byte&0xC0		0x00		object
+>20	lelong			>4095
+>>3	byte&0x80		0x80		dynamically linked executable
+>>3	byte&0x80		0x00		executable
+>16	lelong			>0		not stripped
+
+# XXX gross hack to identify core files
+# cores start with a struct tss; we take advantage of the following:
+# byte 7:     highest byte of the kernel stack pointer, always 0xfe
+#      8/9:   kernel (ring 0) ss value, always 0x0010
+#      10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
+#      28:    low order byte of the current PTD entry, always 0 since the
+#             PTD is page-aligned
+#
+7	string	\357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	FreeBSD/i386 a.out core file
+>1039	string	>\0	from '%s'
+
+# /var/run/ld.so.hints
+# What are you laughing about?
+0	lelong			011421044151	ld.so hints file
+>4	lelong			>0		(version %d)
--- a/usr.bin/file/Magdir/hp
+++ b/usr.bin/file/Magdir/hp
@ -6,12 +6,6 @@
 # applied to the "TML" stuff; I'm assuming the Apollo stuff is
 # big-endian as it was mostly 68K-based.
 #
-# HP-PA is big-endian, so it (and "800", which is *also* HP-PA-based; I
-# assume "HPPA-RISC1.1" really means "HP-PA Version 1.1", which first
-# showed up in the 700 series, although later 800 series machines are,
-# I think, based on the PA7100 which implements HP-PA 1.1) are flagged
-# as big-endian.
-#
 # I think the 500 series was the old stack-based machines, running a
 # UNIX environment atop the "SUN kernel"; dunno whether it was
 # big-endian or little-endian.
@ -21,10 +15,23 @@
 # HP magic is useful for reference, but using "long" magic is a better
 # practice in order to avoid collisions.
 #
+# Guy Harris (guy@netapp.com): some additions to this list came from
+# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
+# 1.2, and 2.0).  The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
+# "/etc/magic", though, except for the "archive file relocatable library"
+# stuff, and the 68030 and 68040 stuff isn't there at all - are they not
+# used in executables, or have they just not yet updated "/etc/magic"
+# completely?
+#
 # 0	beshort		200		hp200 (68010) BSD binary
 # 0	beshort		300		hp300 (68020+68881) BSD binary
 # 0	beshort		0x20c		hp200/300 HP-UX binary
-# 0	beshort		0x20b		hp800 HP-UX binary
+# 0	beshort		0x20d		hp400 (68030) HP-UX binary
+# 0	beshort		0x20e		hp400 (68040?) HP-UX binary
+# 0	beshort		0x20b		PA-RISC1.0 HP-UX binary
+# 0	beshort		0x210		PA-RISC1.1 HP-UX binary
+# 0	beshort		0x211		PA-RISC1.2 HP-UX binary
+# 0	beshort		0x214		PA-RISC2.0 HP-UX binary

 #
 # The "misc" stuff needs a byte order; the archives look suspiciously
@ -41,49 +48,58 @@
 0       long            01702407010     TML 1032 byte-order format
 0       long            01003405017     TML 2301 byte-order format
 0       long            01602007412     TML 3210 byte-order format
-#### HPPA
-0	belong 		0x02100106	HPPA-RISC1.1 relocatable object
-0	belong 		0x02100107	HPPA-RISC1.1 executable
+#### PA-RISC
+0	belong 		0x02100106	PA-RISC1.1 relocatable object
+0	belong 		0x02100107	PA-RISC1.1 executable
+>168	belong		&=0x00000004	dynamically linked
 >(144)	belong		0x054ef630	dynamically linked
 >96	belong		>0		- not stripped

-0	belong 		0x02100108	HPPA-RISC1.1 shared executable
+0	belong 		0x02100108	PA-RISC1.1 shared executable
+>168	belong&0x4	0x4		dynamically linked
 >(144)	belong		0x054ef630	dynamically linked
 >96	belong		>0		- not stripped

-0	belong 		0x0210010b	HPPA-RISC1.1 demand-load executable
+0	belong 		0x0210010b	PA-RISC1.1 demand-load executable
+>168	belong&0x4	0x4		dynamically linked
 >(144)	belong		0x054ef630	dynamically linked
 >96	belong		>0		- not stripped

-0	belong 		0x0210010e	HPPA-RISC1.1 shared library
+0	belong 		0x0210010e	PA-RISC1.1 shared library
 >96	belong		>0		- not stripped

-0	belong 		0x0210010d	HPPA-RISC1.1 dynamic load library
+0	belong 		0x0210010d	PA-RISC1.1 dynamic load library
 >96	belong		>0		- not stripped

 #### 800
-0	belong 		0x020b0106	HP s800 relocatable object
+0	belong 		0x020b0106	PA-RISC1.0 relocatable object

-0	belong 		0x020b0107	HP s800 executable
+0	belong 		0x020b0107	PA-RISC1.0 executable
+>168	belong&0x4	0x4		dynamically linked
 >(144)	belong		0x054ef630	dynamically linked
 >96	belong		>0		- not stripped

-0	belong 		0x020b0108	HP s800 shared executable
+0	belong 		0x020b0108	PA-RISC1.0 shared executable
+>168	belong&0x4	0x4		dynamically linked
 >(144)	belong		0x054ef630	dynamically linked
 >96	belong		>0		- not stripped

-0	belong 		0x020b010b	HP s800 demand-load executable
+0	belong 		0x020b010b	PA-RISC1.0 demand-load executable
+>168	belong&0x4	0x4		dynamically linked
 >(144)	belong		0x054ef630	dynamically linked
 >96	belong		>0		- not stripped

-0	belong 		0x020b010e	HP s800 shared library
+0	belong 		0x020b010e	PA-RISC1.0 shared library
 >96	belong		>0		- not stripped

-0	belong 		0x020b010d	HP s800 dynamic load library
+0	belong 		0x020b010d	PA-RISC1.0 dynamic load library
 >96	belong		>0		- not stripped

 0	belong		0x213c6172	archive file
->68	belong 		0x020b0619	- HP s800 relocatable library
+>68	belong 		0x020b0619	- PA-RISC1.0 relocatable library
+>68	belong	 	0x02100619	- PA-RISC1.1 relocatable library
+>68	belong 		0x02110619	- PA-RISC1.2 relocatable library
+>68	belong 		0x02140619	- PA-RISC2.0 relocatable library

 #### 500
 0	long		0x02080106	HP s500 relocatable executable
@ -156,7 +172,7 @@

 0	string		IMGfile	CIS 	compimg HP Bitmapfile
 # XXX - see "lif"
-0	short		0x8000		lif file
+#0	short		0x8000		lif file
 0	long		0x020c010c	compiled Lisp

 0	string		msgcat01	HP NLS message catalog,
--- a/usr.bin/file/Magdir/ibm370
+++ b/usr.bin/file/Magdir/ibm370
@ -4,7 +4,35 @@
 #
 # "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
 # What the heck *is* "USS/370"?
+# AIX 4.1's "/etc/magic" has
 #
+#	0	short		0535		370 sysV executable 
+#	>12	long		>0		not stripped
+#	>22	short		>0		- version %d
+#	>30	long		>0		- 5.2 format
+#	0	short		0530		370 sysV pure executable 
+#	>12	long		>0		not stripped
+#	>22	short		>0		- version %d
+#	>30	long		>0		- 5.2 format
+#
+# instead of the "USS/370" versions of the same magic numbers.
+#
+0	beshort		0537		370 XA sysV executable 
+>12	belong		>0		not stripped
+>22	beshort		>0		- version %d
+>30	belong		>0		- 5.2 format
+0	beshort		0532		370 XA sysV pure executable 
+>12	belong		>0		not stripped
+>22	beshort		>0		- version %d
+>30	belong		>0		- 5.2 format
+0	beshort		054001		370 sysV pure executable
+>12	belong		>0		not stripped
+0	beshort		055001		370 XA sysV pure executable
+>12	belong		>0		not stripped
+0	beshort		056401		370 sysV executable
+>12	belong		>0		not stripped
+0	beshort		057401		370 XA sysV executable
+>12	belong		>0		not stripped
 0       beshort		0531		SVR2 executable (Amdahl-UTS)
 >12	belong		>0		not stripped
 >24     belong		>0		- version %ld
--- a/usr.bin/file/Magdir/ibm6000
+++ b/usr.bin/file/Magdir/ibm6000
@ -12,5 +12,6 @@
 0	beshort		0x0104		shared library
 0	beshort		0x0105		ctab data
 0	beshort		0xfe04		structured file
-0	string		0xabcdef	message catalog
-#0	string		<aiaff>		archive
+0	string		0xabcdef	AIX message catalog
+0	belong		0x000001f9	AIX compiled message catalog
+0	string		\<aiaff>	archive
--- a/usr.bin/file/Magdir/images
+++ b/usr.bin/file/Magdir/images
@ -53,14 +53,14 @@
 >6	leshort		>0		%hd x
 >8	leshort		>0		%hd,
 #>10	byte		&0x80		color mapped,
->10	byte&0x07	=0x00		2 colors
->10	byte&0x07	=0x01		4 colors
->10	byte&0x07	=0x02		8 colors
->10	byte&0x07	=0x03		16 colors
->10	byte&0x07	=0x04		32 colors
->10	byte&0x07	=0x05		64 colors
->10	byte&0x07	=0x06		128 colors
->10	byte&0x07	=0x07		256 colors
+#>10	byte&0x07	=0x00		2 colors
+#>10	byte&0x07	=0x01		4 colors
+#>10	byte&0x07	=0x02		8 colors
+#>10	byte&0x07	=0x03		16 colors
+#>10	byte&0x07	=0x04		32 colors
+#>10	byte&0x07	=0x05		64 colors
+#>10	byte&0x07	=0x06		128 colors
+#>10	byte&0x07	=0x07		256 colors

 # ITC (CMU WM) raster files.  It is essentially a byte-reversed Sun raster,
 # 1 plane, no encoding.
@ -116,6 +116,13 @@
 >29	byte		1		\b, fine resolution (204x196 DPI)

 # JPEG images
+# SunOS 5.5.1 had
+#
+#	0	string		\377\330\377\340	JPEG file
+#	0	string		\377\330\377\356	JPG file
+#
+# both of which turn into "JPEG image data" here.
+#
 0	beshort		0xffd8		JPEG image data
 >6	string		JFIF		\b, JFIF standard
 # HSI is Handmade Software's proprietary JPEG encoding scheme
@ -222,3 +229,8 @@
 # other images
 0	string	This\ is\ a\ BitMap\ file	Lisp Machine bit-array-file
 0	string		!!		Bennet Yee's "face" format
+
+# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
+# stuff.
+#
+0	beshort		0x1010		PEX Binary Archive
--- a/usr.bin/file/Magdir/island
+++ b/usr.bin/file/Magdir/island
@ -0,0 +1,9 @@
+
+#------------------------------------------------------------------------------
+# island:  file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
+# "/etc/magic":
+# From: guy@netapp.com (Guy Harris)
+#
+4	string		pgscriptver	IslandWrite document
+13	string		DrawFile	IslandDraw document
+
--- a/usr.bin/file/Magdir/java
+++ b/usr.bin/file/Magdir/java
@ -1,8 +1,5 @@
-#------------------------------------------------------------------------------
-# java:  file(1) magic for java compiled classes
-#
-
-0	belong	0xCafeBabe		compiled java class data,
->4	beshort x			version %d.
->6	beshort x			\b%d
-
+#------------------------------------------------------------
+# Java ByteCode
+# From Larry Schwimmer (schwim@cs.stanford.edu)
+0	belong		0xcafebabe
+>4	belong		0x0003002d	Java bytecode
--- a/usr.bin/file/Magdir/linux
+++ b/usr.bin/file/Magdir/linux
@ -24,7 +24,7 @@
 0	string		\007\001\000	Linux/i386 object file
 >20	lelong		>0x1020		\b, DLL library
 # message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
-0	string		*nazgul*	compiled message catalog
+0	string		*nazgul*	Linux compiled message catalog
 >8	lelong		>0		\b, version %ld
 # core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
 216	lelong		0421		Linux/i386 core file
@ -49,7 +49,25 @@
 >3	byte		>0		8x%d
 # Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
 4086	string		SWAP-SPACE	Linux/i386 swap file
-# From: Erik Troan <ewt@redhat.com>
-0	leshort		0x00070183	ECOFF (Linux/OSF) Alpha binary
->10	leshort		0x0001		not stripped
->10	leshort		0x0000		stripped
+# ECOFF magic for OSF/1 and Linux (only tested under Linux though)
+#
+#	from Erik Troan (ewt@redhat.com) examining od dumps, so this
+#		could be wrong
+#      updated by David Mosberger (davidm@azstarnet.com) based on
+#      GNU BFD and MIPS info found below.
+#
+0	leshort		0x0183		ECOFF alpha
+>24	leshort		0407		executable
+>24	leshort		0410		pure
+>24	leshort		0413		demand paged
+>8	long		>0		not stripped
+>8	long		0		stripped
+>23	leshort		>0		- version %ld.
+# linux Kernel images version 1.3.80 - ?
+# from Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
+0       belong          0xb8c0078e      Linux/x86 kernel image,
+>0x048c byte            0x31
+>>0x048c string         x               version %s
+>0x0493 byte            0x31
+>>0x0493 string         x               version %s
+#
--- a/usr.bin/file/Magdir/mach
+++ b/usr.bin/file/Magdir/mach
@ -0,0 +1,38 @@
+#------------------------------------------------------------------------------
+# mach file description
+#
+0	belong		0xcafebabe	mach-o fat file
+>4	belong		1		with 1 architecture
+>4	belong		>1
+>>4	belong		x		with %ld architectures		
+#
+0	belong		0xfeedface	mach-o
+>12	belong		1		object
+>12	belong		2		executable
+>12	belong		3		shared library
+>12	belong		4		core
+>12	belong		5		preload executable
+>12	belong		>5
+>>12	belong		x		filetype=%ld
+>4	belong		<0
+>>4	belong		x		architecture=%ld
+>4	belong		1		vax
+>4	belong		2		romp
+>4	belong		3		architecture=3
+>4	belong		4		ns32032
+>4	belong		5		ns32332
+>4	belong		6		for m68k architecture
+>4	belong		7		i386
+>4	belong		8		mips
+>4	belong		9		ns32532
+>4	belong		10		architecture=10
+>4	belong		11		hp pa-risc
+>4	belong		12		acorn
+>4	belong		13		m88k
+>4	belong		14		sparc
+>4	belong		15		i860-big
+>4	belong		16		i860
+>4	belong		17		rs6000
+>4	belong		18		powerPC
+>4	belong		>18
+>>4	belong		x		architecture=%ld
--- a/usr.bin/file/Magdir/mail.news
+++ b/usr.bin/file/Magdir/mail.news
@ -16,3 +16,6 @@
 0	string		From:		news or mail text
 0	string		Article 	saved news text
 0	string		BABYL		Emacs RMAIL text
+0	string		Received:	RFC 822 mail text
+0	string		MIME-Version:	MIME entity text
+0	string		Content-	MIME entity text
--- a/usr.bin/file/Magdir/motorola
+++ b/usr.bin/file/Magdir/motorola
@ -27,3 +27,6 @@
 # Motorola/88Open BCS
 #
 0	beshort		0555		88K BCS executable
+#
+# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
+0   string      S0          Motorola S-Record; binary data in text format
--- a/usr.bin/file/Magdir/netbsd
+++ b/usr.bin/file/Magdir/netbsd
@ -4,12 +4,6 @@
 #
 # All new-style magic numbers are in network byte order.
 #
-0	lelong			000000413	386BSD demand paged executable
->16	lelong			>0		not stripped
-0	lelong			000000314	BSDI demand paged executable
->16	lelong			>0		not stripped
->32	byte			0x6a		(uses shared libs)
-

 0	lelong			000000407	NetBSD little-endian object file
 >16	lelong			>0		not stripped
@ -163,6 +157,15 @@
 0	belong&0377777777	043000507	NetBSD/vax core
 >12	string			>\0		from '%s'

+# NetBSD/alpha does not support (and has never supported) a.out objects,
+# so no rules are provided for them.  NetBSD/alpha ELF objects are 
+# dealt with in "elf".
+0	leshort		0x00070185		ECOFF NetBSD/alpha binary
+>10	leshort		0x0001			not stripped
+>10	leshort		0x0000			stripped
+0	belong&0377777777	043200507	NetBSD/alpha core
+>12	string			>\0		from '%s'
+
 0	belong&0377777777	043400413	NetBSD/mips demand paged
 >0	byte			&0x80		
 >>20	belong			<8192		shared library
@ -183,3 +186,24 @@
 >16	belong			>0		not stripped
 0	belong&0377777777	043400507	NetBSD/mips core
 >12	string			>\0		from '%s'
+
+0	belong&0377777777	043600413	NetBSD/arm32 demand paged
+>0	byte			&0x80
+>>20	lelong			<8192		shared library
+>>20	lelong			=8192		dynamically linked executable
+>>20	lelong			>8192		dynamically linked executable
+>0	byte			^0x80		executable
+>16	lelong			>0		not stripped
+0	belong&0377777777	043600410	NetBSD/arm32 pure
+>0	byte			&0x80		dynamically linked executable
+>0	byte			^0x80		executable
+>16	lelong			>0		not stripped
+0	belong&0377777777	043600407	NetBSD/arm32
+>0	byte			&0x80		dynamically linked executable
+>0	byte			^0x80
+>>0	byte			&0x40		position independent
+>>20	lelong			!0		executable
+>>20	lelong			=0		object file
+>16	lelong			>0		not stripped
+0	belong&0377777777	043600507	NetBSD/arm32 core
+>12	string			>\0		from '%s'
--- a/usr.bin/file/Magdir/osf1
+++ b/usr.bin/file/Magdir/osf1
@ -0,0 +1,10 @@
+#
+# Mach magic number info
+#
+0	long		0xefbe	OSF/Rose object
+# I386 magic number info
+#
+0	short		0565	i386 COFF object
+#
+0	string		Core	Alpha Digital UNIX core file
+>24	string		>\0	\b, generated from '%s'
--- a/usr.bin/file/Magdir/pdf
+++ b/usr.bin/file/Magdir/pdf
@ -1,7 +1,7 @@
-
 #------------------------------------------------------------------------------
 # pdf:  file(1) magic for Portable Document Format
 #

 0	string		%PDF-		PDF document
->5	string		x		\b, version %.3s
+>5	byte		x		\b, version %c
+>7	byte		x		\b.%c
--- a/usr.bin/file/Magdir/pgp
+++ b/usr.bin/file/Magdir/pgp
@ -5,6 +5,7 @@
 0       beshort         0x9900                  PGP key public ring
 0       beshort         0x9501                  PGP key security ring
 0       beshort         0x9500                  PGP key security ring
+0	beshort		0xa600			PGP encrypted data
 0       string          -----BEGIN\040PGP       PGP armored data
 >15     string          PUBLIC\040KEY\040BLOCK- public key block
 >15     string          MESSAGE-                message
--- a/usr.bin/file/Magdir/printer
+++ b/usr.bin/file/Magdir/printer
@ -21,7 +21,7 @@
 # HP Printer Job Language
 0	string		\033%-12345X@PJL	HP Printer Job Language data
 >15	string		\ ENTER\ LANGUAGE\ =
->31	string		PostScript		Postscript
+>31	string		PostScript		PostScript

 # HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
 0	string		\033E\033	HP PCL printer data
--- a/usr.bin/file/Magdir/rpm
+++ b/usr.bin/file/Magdir/rpm
@ -9,6 +9,9 @@
 >>6	beshort		1		src
 >>8	beshort		1		i386
 >>8	beshort		2		Alpha
->>8	beshort		3		PowerPC
->>8	beshort		4		Sparc
+>>8	beshort		3		Sparc
+>>8	beshort		4		MIPS
+>>8	beshort		5		PowerPC
+>>8	beshort		6		68000
+>>8     beshort         7               SGI
 >>10	string		x		%s
--- a/usr.bin/file/Magdir/sgi
+++ b/usr.bin/file/Magdir/sgi
@ -1,12 +1,16 @@

 #------------------------------------------------------------------------------
 # sgi:  file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.)
-#
+#                         Dec Ultrix (MIPS)
 # all of SGI's *current* machines and OSes run in big-endian mode on the
 # MIPS machines, as far as I know.
 #
 # XXX - what is the blank "-" line?
 #
+# kbd file definitions
+0	string	kbd!map		kbd map file
+>8	byte	>0		Ver %d:
+>10	short	>0		with %d table(s)
 0	belong	0407		old SGI 68020 executable
 0	belong	0410		old SGI 68020 pure executable
 0	beshort	0x8765		disk quotas file
@ -47,8 +51,8 @@
 >20	beshort	05401		(paged)
 >8	belong	>0		not stripped
 >8	belong	0		stripped
->22	byte	x		- version %d
->23	byte	x		.%ld
+>23	byte	x		- version %d
+>22	byte	x		.%ld
 #
 0	beshort	0x6201		MIPSEL-LE COFF executable
 >20	beshort	03401		(impure)
@ -56,8 +60,8 @@
 >20	beshort	05401		(paged)
 >8	belong	>0		not stripped
 >8	belong	0		stripped
->22	byte	x		- version %ld
->23	byte	x		.%ld
+>23	byte	x		- version %ld
+>22	byte	x		.%ld
 #
 # MIPS 2 additions
 #
@ -86,7 +90,7 @@
 >8	belong	>0		not stripped
 >8	belong	0		stripped
 >23	byte	x		- version %ld
->23	byte	x		.%ld
+>22	byte	x		.%ld
 #
 0	beshort	0x6601		MIPSEL-LE MIPS-II COFF executable
 >20	beshort	03401		(impure)
@ -95,7 +99,7 @@
 >8	belong	>0		not stripped
 >8	belong	0		stripped
 >23	byte	x		- version %ld
->23	byte	x		.%ld
+>22	byte	x		.%ld
 #
 # MIPS 3 additions
 #
@ -124,7 +128,7 @@
 >8	belong	>0		not stripped
 >8	belong	0		stripped
 >23	byte	x		- version %ld
->23	byte	x		.%ld
+>22	byte	x		.%ld
 #
 0	beshort	0x4201		MIPSEL-LE MIPS-III COFF executable
 >20	beshort	03401		(impure)
@ -133,7 +137,7 @@
 >8	belong	>0		not stripped
 >8	belong	0		stripped
 >23	byte	x		- version %ld
->23	byte	x		.%ld
+>22	byte	x		.%ld
 #
 0	beshort	0x180		MIPSEB Ucode
 0	beshort	0x182		MIPSEL Ucode
@ -157,7 +161,8 @@
 0	string	WNGZWZSS	Wingz spreadsheet
 0	string	WNGZWZHP	Wingz help file
 #
-0	string	\#Inventor V	IRIS Inventor file
+0	string	\#Inventor V	IRIS Inventor 1.0 file
+0	string	\#Inventor V2	Open Inventor 2.0 file
 # XXX - I don't know what next thing is!  It is likely to be an image
 # (or movie) format
 0	string	glfHeadMagic();		GLF_TEXT
--- a/usr.bin/file/Magdir/sniffer
+++ b/usr.bin/file/Magdir/sniffer
@ -0,0 +1,63 @@
+
+#------------------------------------------------------------------------------
+# sniffer:  file(1) magic for packet captured files
+#
+# From: guy@netapp.com (Guy Harris)
+#
+# Microsoft NetMon (packet capture/display program) capture files.
+#
+0	string		RTSS		NetMon capture file
+>4	byte		x		- version %d
+>5	byte		x		\b.%d
+#
+# Network General Sniffer capture files (the Sniffer software does,
+# after all, run under MS-DOS...).
+#
+0	string		TRSNIFF\ data\ \ \ \ \032	Sniffer capture file
+>23	leshort		x		- version %d
+>25	leshort		x		\b.%d
+>33	byte		x		(Format %d,
+>32	byte		0		Token ring)
+>32	byte		1		Ethernet)
+>32	byte		2		ARCnet)
+>32	byte		3		StarLAN)
+>32	byte		4		PC Network broadband)
+>32	byte		5		LocalTalk)
+>32	byte		6		Znet)
+#
+# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
+# the main program that uses that format, but there's also "tcpview",
+# and there may be others in the future.)
+#
+0	ubelong		0xa1b2c3d4	tcpdump capture file (big-endian)
+>4	beshort		x		- version %d
+>6	beshort		x		\b.%d
+>20	belong		0		(No link-layer encapsulation
+>20	belong		1		(Ethernet
+>20	belong		2		(3Mb Ethernet
+>20	belong		3		(AX.25
+>20	belong		4		(ProNet
+>20	belong		5		(Chaos
+>20	belong		6		(IEEE 802.x network
+>20	belong		7		(ARCnet
+>20	belong		8		(SLIP
+>20	belong		9		(PPP
+>20	belong		10		(FDDI
+>20	belong		11		(RFC 1483 ATM
+>16	belong		x		\b, capture length %d)
+0	ulelong		0xa1b2c3d4	tcpdump capture file (little-endian)
+>4	leshort		x		- version %d
+>6	leshort		x		\b.%d
+>20	lelong		0		(No link-layer encapsulation
+>20	lelong		1		(Ethernet
+>20	lelong		2		(3Mb Ethernet
+>20	lelong		3		(AX.25
+>20	lelong		4		(ProNet
+>20	lelong		5		(Chaos
+>20	lelong		6		(IEEE 802.x network
+>20	lelong		7		(ARCnet
+>20	lelong		8		(SLIP
+>20	lelong		9		(PPP
+>20	lelong		10		(FDDI
+>20	lelong		11		(RFC 1483 ATM
+>16	lelong		x		\b, capture length %d)
--- a/usr.bin/file/Magdir/sun
+++ b/usr.bin/file/Magdir/sun
@ -84,3 +84,27 @@
 >>128	string		>\0		from '%s'
 >4	belong		456		(SPARC 4.x BCP)
 >>152	string		>\0		from '%s'
+# Sun SunPC
+0	long		0xfa33c08e	SunPC 4.0 Hard Disk
+0	string		#SUNPC_CONFIG	SunPC 4.0 Properties Values
+# Sun snoop
+#
+# XXX - are numbers stored in big-endian format, or in host byte order?
+# They're the same on SPARC, but not the same on x86.
+#
+0	string		snoop		Snoop capture file
+>8	long		>0		- version %ld
+>12	long		0		(IEEE 802.3)
+>12	long		1		(IEEE 802.4)
+>12	long		2		(IEEE 802.5)
+>12	long		3		(IEEE 802.6)
+>12	long		4		(Ethernet)
+>12	long		5		(HDLC)
+>12	long		6		(Character synchronous)
+>12	long		7		(IBM channel-to-channel adapter)
+>12	long		8		(FDDI)
+>12	long		9		(Unknown)
+# Sun KCMS
+36	string		acsp		Kodak Color Management System, ICC Profile
+
+
--- a/usr.bin/file/Magdir/varied.out
+++ b/usr.bin/file/Magdir/varied.out
@ -13,3 +13,6 @@
 0	beshort		0160007		amd 29k coff archive
 # Cray
 6	beshort		0407		unicos (cray) executable
+# Ultrix 4.3
+596	string		\130\337\377\377	Ultrix core file
+>600	string		>\0	'%s'
--- a/usr.bin/file/Magdir/xenix
+++ b/usr.bin/file/Magdir/xenix
@ -0,0 +1,72 @@
+
+#------------------------------------------------------------------------------
+# xenix:  file(1) magic for Microsoft Xenix
+#
+# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
+# model" lifted from "magic.xenix", with comment "derived empirically;
+# treat as folklore until proven"
+#
+# "small model", "large model", "huge model" stuff lifted from XXX
+#
+# XXX - "x.out" collides with PDP-11 archives
+#
+0	string		core		core file (Xenix)
+0	byte		0x80		8086 relocatable (Microsoft)
+0	leshort		0xff65		x.out
+>2	string		__.SYMDEF	 randomized
+>0	byte		x		archive
+0	leshort		0x206		Microsoft a.out
+>8	leshort		1		Middle model
+>0x1e	leshort		&0x10		overlay
+>0x1e	leshort		&0x2		separate
+>0x1e	leshort		&0x4		pure
+>0x1e	leshort		&0x800		segmented
+>0x1e	leshort		&0x400		standalone
+>0x1e	leshort		&0x8		fixed-stack
+>0x1c	byte		&0x80		byte-swapped
+>0x1c	byte		&0x40		word-swapped
+>0x10	lelong		>0		not-stripped
+>0x1e	leshort		^0xc000		pre-SysV
+>0x1e	leshort		&0x4000		V2.3
+>0x1e	leshort		&0x8000		V3.0
+>0x1c	byte		&0x4		86
+>0x1c	byte		&0xb		186
+>0x1c	byte		&0x9		286
+>0x1c	byte		&0xa		386
+>0x1f	byte		<0x040		small model
+>0x1f	byte		=0x048		large model	
+>0x1f	byte		=0x049		huge model 
+>0x1e	leshort		&0x1		executable
+>0x1e	leshort		^0x1		object file
+>0x1e	leshort		&0x40		Large Text
+>0x1e	leshort		&0x20		Large Data
+>0x1e	leshort		&0x120		Huge Objects Enabled
+>0x10	lelong		>0		not stripped
+
+0	leshort		0x140		old Microsoft 8086 x.out
+>0x3	byte		&0x4		separate
+>0x3	byte		&0x2		pure
+>0	byte		&0x1		executable
+>0	byte		^0x1		relocatable
+>0x14	lelong		>0		not stripped
+
+0	lelong		0x206		b.out
+>0x1e	leshort		&0x10		overlay
+>0x1e	leshort		&0x2		separate
+>0x1e	leshort		&0x4		pure
+>0x1e	leshort		&0x800		segmented
+>0x1e	leshort		&0x400		standalone
+>0x1e	leshort		&0x1		executable
+>0x1e	leshort		^0x1		object file
+>0x1e	leshort		&0x4000		V2.3
+>0x1e	leshort		&0x8000		V3.0
+>0x1c	byte		&0x4		86
+>0x1c	byte		&0xb		186
+>0x1c	byte		&0x9		286
+>0x1c	byte		&0x29		286
+>0x1c	byte		&0xa		386
+>0x1e	leshort		&0x4		Large Text
+>0x1e	leshort		&0x2		Large Data
+>0x1e	leshort		&0x102		Huge Objects Enabled
+
+0	leshort		0x580		XENIX 8086 relocatable or 80286 small model
--- a/usr.bin/file/Makefile
+++ b/usr.bin/file/Makefile
@ -1,6 +1,6 @@
 # Makefile for file(1) cmd. 
 # Copyright (c) Ian F. Darwin 86/09/01 - see LEGAL.NOTICE.
-# @(#)$Id: Makefile,v 1.49 1995/10/27 23:12:33 christos Exp $
+# @(#)$Id: Makefile,v 1.55 1997/01/15 17:23:24 christos Exp $
 #
 # This software is not subject to any license of the American Telephone
 # and Telegraph Company or of the Regents of the University of California.
@ -21,11 +21,11 @@
 #    ever read sources, credits must appear in the documentation.
 #
 # 4. This notice may not be removed or altered.
-VERSION	= 3.19
+VERSION	= 3.22
 SHELL	= /bin/sh
 #MAGIC	= /etc/magic
 MAGIC	= /usr/local/etc/magic
-DEFS	= -DMAGIC='"$(MAGIC)"' # -Dvoid=int
+DEFS	= -DMAGIC='"$(MAGIC)"' -DBUILTIN_ELF # -Dvoid=int
 CC	= cc
 COPTS	= -O -g		# newer compilers allow both; else drop -O
 # For truly antique environments, use this for (dummy) include files:
@ -70,10 +70,10 @@ LOCALOBJS = # localsrc/getopt.o localsrc/strtol.o \
 LOCALINC = # localinc/*.h localinc/sys/*.h

 SRCS = file.c apprentice.c fsmagic.c softmagic.c ascmagic.c \
-	compress.c is_tar.c \
+	compress.c is_tar.c readelf.c internat.c \
 	print.c $(LOCALSRCS) $(LOCALINC)
 OBJS = file.o apprentice.o fsmagic.o softmagic.o ascmagic.o \
-	compress.o is_tar.o \
+	compress.o is_tar.o readelf.o internat.o \
 	print.o $(LOCALOBJS)

 ALLSRC = LEGAL.NOTICE README MAINT PORTING $(SRCS) *.h \
@ -121,12 +121,14 @@ magic.${MANFEXT} :	Makefile magic.man
 		@rm -f $@
 		sed -e s@__CSECTION__@${MANCEXT}@g \
 		    -e s@__FSECTION__@${MANFEXT}@g \
+		    -e s@__VERSION__@${VERSION}@g \
 		    -e s@__MAGIC__@${MAGIC}@g magic.man > $@

 file.${MANCEXT} :	Makefile file.man
 		@rm -f $@
 		sed -e s@__CSECTION__@${MANCEXT}@g \
 		    -e s@__FSECTION__@${MANFEXT}@g \
+		    -e s@__VERSION__@${VERSION}@g \
 		    -e s@__MAGIC__@${MAGIC}@g file.man > $@

 send:		dist
--- a/usr.bin/file/README
+++ b/usr.bin/file/README
@ -1,11 +1,9 @@
 ** README for file(1) Command **
-@(#) $Id: README,v 1.20 1993/09/23 21:47:01 christos Exp $
+@(#) $Id: README,v 1.21 1997/01/15 17:23:24 christos Exp $

 This is Release 3.x of Ian Darwin's (copyright but distributable)
-file(1) command.  Release 3.x is scheduled for inclusion in the
-4.4 BSD (Berkeley Software Distribution) of UNIX-like
-software, and is the standard "file" command for Linux, 386bsd,
-and other systems. (See "patchlevel.h" for the exact release number).
+file(1) command. This version is the standard "file" command for Linux,
+*BSD, and other systems. (See "patchlevel.h" for the exact release number).

 UNIX is a trademark of UNIX System Laboratories.

@ -58,15 +56,29 @@ magic.4 - man page for the magic file, courtesy Guy Harris.
 file.c - main program
 file.h - header file
 fsmagic.c - first set of tests the program runs, based on filesystem info
-is_tar.c - knows about tarchives (courtesy John Gilmore).
+is_tar.c, tar.h - knows about tarchives (courtesy John Gilmore).
 magdir - directory of /etc/magic pieces
 	magdir/Makefile - ADJUST THIS FOR YOUR CONFIGURATION
 names.h - header file for ascmagic.c
 softmagic.c - 2nd set of tests, based on /etc/magic
-strtok.c, getopt.c - in case you them (courtesy of Henry Spencer).
-strtol.c, strchr.c - in case you need them - public domain.
-tst - simple test suite, built from tst/Makefile
+readelf.[ch] - Standalone elf parsing code.
+compress.c - on-the-fly decompression.
+internat.c - recognize international `text' files.
+print.c - print results, errors, warnings.

+If your gzip sometimes fails to decompress things complaining about a short
+file, apply this patch [which is going to be in the next version of gzip]:
+*** -   Tue Oct 29 02:06:35 1996
+--- util.c      Sun Jul 21 21:51:38 1996
+*** 106,111 ****
+--- 108,114 ----
+  
+      if (insize == 0) {
+        if (eof_ok) return EOF;
+       flush_window();
+        read_error();
+      }
+      bytes_in += (ulg)insize;

 E-mail: christos@deshaw.com, moraes@deshaw.com

--- a/usr.bin/file/apprentice.c
+++ b/usr.bin/file/apprentice.c
@ -34,7 +34,7 @@

 #ifndef	lint
 static char *moduleid = 
-	"@(#)$Id: apprentice.c,v 1.23 1995/10/27 23:12:01 christos Exp $";
+	"@(#)$Id: apprentice.c,v 1.25 1997/01/15 17:23:24 christos Exp $";
 #endif	/* lint */

 #define	EATAB {while (isascii((unsigned char) *l) && \
@ -133,10 +133,10 @@ int check;			/* non-zero? checking-only run. */
 /*
 * extend the sign bit if the comparison is to be signed
 */
-unsigned long
+uint32
 signextend(m, v)
 struct magic *m;
-unsigned long v;
+uint32 v;
 {
 	if (!(m->flag & UNSIGNED))
 		switch(m->type) {
@ -159,7 +159,7 @@ unsigned long v;
 		case LONG:
 		case BELONG:
 		case LELONG:
-			v = (long) v;
+			v = (int32) v;
 			break;
 		case STRING:
 			break;
@ -210,6 +210,10 @@ int *ndx, check;
 		++l;		/* step over */
 		m->flag |= INDIR;
 	}
+	if (m->cont_level != 0 && *l == '&') {
+                ++l;            /* step over */
+                m->flag |= ADD;
+        }

 	/* get offset, then skip over it */
 	m->offset = (int) strtoul(l,&t,0);
@ -491,21 +495,16 @@ int	plen, *slen;
 				*p++ = (char)val;
 				break;

-			/* \x and up to 3 hex digits */
+			/* \x and up to 2 hex digits */
 			case 'x':
 				val = 'x';	/* Default if no digits */
 				c = hextoint(*s++);	/* Get next char */
 				if (c >= 0) {
 					val = c;
 					c = hextoint(*s++);
-					if (c >= 0) {
+					if (c >= 0)
 						val = (val << 4) + c;
-						c = hextoint(*s++);
-						if (c >= 0) {
-							val = (val << 4) + c;
-						} else
-							--s;
-					} else
+					else
 						--s;
 				} else
 					--s;
--- a/usr.bin/file/ascmagic.c
+++ b/usr.bin/file/ascmagic.c
@ -36,7 +36,7 @@

 #ifndef	lint
 static char *moduleid = 
-	"@(#)$Id: ascmagic.c,v 1.20 1995/05/20 22:09:21 christos Exp $";
+	"@(#)$Id: ascmagic.c,v 1.21 1997/01/15 17:23:24 christos Exp $";
 #endif	/* lint */

 			/* an optimisation over plain strcmp() */
@ -88,6 +88,13 @@ int nbytes;	/* size actually read */
 		return 1;
 	}

+
+	/* Make sure we are dealing with ascii text before looking for tokens */
+	for (i = 0; i < nbytes; i++) {
+		if (!isascii(buf[i]))
+			return 0;	/* not all ASCII */
+	}
+
 	/* look for tokens from names.h - this is expensive! */
 	/* make a copy of the buffer here because strtok() will destroy it */
 	s = (unsigned char*) memcpy(nbuf, buf, nbytes);
@ -106,12 +113,6 @@ int nbytes;	/* size actually read */
 		}
 	}

-
-	for (i = 0; i < nbytes; i++) {
-		if (!isascii(buf[i]))
-			return 0;	/* not all ASCII */
-	}
-
 	/* all else fails, but it is ASCII... */
 	ckfputs("ASCII text", stdout);
 	if (has_escapes) {
--- a/usr.bin/file/file.1
+++ b/usr.bin/file/file.1
@ -1,5 +1,5 @@
 .TH FILE __CSECTION__ "Copyright but distributable"
-.\" $Id: file.man,v 1.26 1995/10/27 23:12:01 christos Exp $
+.\" $Id: file.man,v 1.28 1997/01/15 17:23:24 christos Exp $
 .SH NAME
 file
 \- determine file type
@ -16,7 +16,10 @@ namefile ]
 magicfiles ]
 file ...
 .SH DESCRIPTION
-.I File
+This manual page documents version __VERSION__ of the
+.B file
+command.
+.B File
 tests each argument in an attempt to classify it.
 There are three sets of tests, performed in this order:
 filesystem tests, magic number tests, and language tests.
@ -26,8 +29,11 @@ test that succeeds causes the file type to be printed.
 .PP
 The type printed will usually contain one of the words
 .B text
-(the file contains only ASCII characters and is 
-probably safe to read on an ASCII terminal),
+(the file contains only
+.SM ASCII
+characters and is probably safe to read on an
+.SM ASCII
+terminal),
 .B executable
 (the file contains the result of compiling a program
 in a form understandable to some \s-1UNIX\s0 kernel or another),
@ -46,7 +52,7 @@ Don't do as Berkeley did \- change ``shell commands text''
 to ``shell script''.
 .PP
 The filesystem tests are based on examining the return from a
-.IR stat (2)
+.BR stat (2)
 system call.
 The program checks to see if the file is empty,
 or if it's some sort of special file.
@ -55,16 +61,16 @@ Any known file types appropriate to the system you are running on
 implement them)
 are intuited if they are defined in
 the system header file
-.BR sys/stat.h  .
+.IR sys/stat.h  .
 .PP
 The magic number tests are used to check for files with data in
 particular fixed formats.
 The canonical example of this is a binary executable (compiled program)
-.B a.out
+.I a.out
 file, whose format is defined in 
-.B a.out.h
+.I a.out.h
 and possibly
-.B exec.h
+.I exec.h
 in the standard include directory.
 These files have a `magic number' stored in a particular place
 near the beginning of the file that tells the \s-1UNIX\s0 operating system
@ -78,21 +84,23 @@ The information in these files is read from the magic file
 If an argument appears to be an
 .SM ASCII 
 file,
-.I file
+.B file
 attempts to guess its language.
-The language tests look for particular strings (cf \fInames.h\fP)
+The language tests look for particular strings (cf
+.IR names.h )
 that can appear anywhere in the first few blocks of a file.
 For example, the keyword
 .B .br
-indicates that the file is most likely a troff input file,
-just as the keyword 
+indicates that the file is most likely a
+.BR troff (1)
+input file, just as the keyword 
 .B struct
 indicates a C program.
 These tests are less reliable than the previous
 two groups, so they are performed last.
 The language test routines also test for some miscellany
 (such as 
-.I tar
+.BR tar (1)
 archives) and determine whether an unknown file should be
 labelled as `ascii text' or `data'. 
 .SH OPTIONS
@ -125,7 +133,7 @@ to test the standard input, use ``-'' as a filename argument.
 .TP 8
 .B \-L
 option causes symlinks to be followed, as the like-named option in
-.IR ls (1).
+.BR ls (1).
 (on systems that support symbolic links).
 .SH FILES
 .I __MAGIC__
@ -135,10 +143,10 @@ The environment variable
 .B MAGIC
 can be used to set the default magic number files.
 .SH SEE ALSO
-.IR magic (__FSECTION__)
+.BR magic (__FSECTION__)
 \- description of magic file format.
 .br
-.IR Strings (1), " od" (1)
+.BR strings (1), " od" (1)
 \- tools for examining non-textfiles.
 .SH STANDARDS CONFORMANCE
 This program is believed to exceed the System V Interface Definition
@ -171,7 +179,7 @@ in an existing magic file would have to be changed to
 .br
 .PP
 SunOS releases 3.2 and later from Sun Microsystems include a
-.IR file (1)
+.BR file (1)
 command derived from the System V one, but with some extensions.
 My version differs from Sun's only in minor ways.
 It includes the extension of the `&' operator, used as,
@ -190,15 +198,15 @@ The order of entries in the magic file is significant.
 Depending on what system you are using, the order that
 they are put together may be incorrect.
 If your old
-.I file
+.B file
 command uses a magic file,
 keep the old magic file around for comparison purposes
 (rename it to 
 .IR __MAGIC__.orig ).
 .SH HISTORY
 There has been a 
-.I file
-command in every UNIX since at least Research Version 6
+.B file
+command in every \s-1UNIX\s0 since at least Research Version 6
 (man page dated January, 1975).
 The System V version introduced one significant major change:
 the external list of magic number types.
@ -227,7 +235,7 @@ put the ``old-style'' `&'
 operator back the way it was, because 1) Rob McMahon's change broke the
 previous style of usage, 2) the SunOS ``new-style'' `&' operator,
 which this version of
-.I file
+.B file
 supports, also handles `x&y op z', and 3) Rob's change wasn't documented
 in any case;
 .PP
@ -236,11 +244,11 @@ put in multiple levels of `>';
 put in ``beshort'', ``leshort'', etc. keywords to look at numbers in the
 file in a specific byte order, rather than in the native byte order of
 the process running
-.IR file .
+.BR file .
 .RE
 .PP
 Changes by Ian Darwin and various authors including
-Christos Zoulas (christos@ee.cornell.edu), 1990-1992.
+Christos Zoulas (christos@deshaw.com), 1990-1992.
 .SH LEGAL NOTICE
 Copyright (c) Ian F. Darwin, Toronto, Canada,
 1986, 1987, 1988, 1989, 1990, 1991, 1992, 1993.
@ -284,33 +292,42 @@ The files
 and
 .I is_tar.c
 were written by John Gilmore from his public-domain
-.I tar
+.B tar
 program, and are not covered by the above restrictions.
 .SH BUGS
 There must be a better way to automate the construction of the Magic
 file from all the glop in Magdir. What is it?
 Better yet, the magic file should be compiled into binary (say,
-.IR ndbm (3)
-or, better yet, fixed-length ASCII strings 
-for use in heterogenous network environments) for faster startup.
+.BR ndbm (3)
+or, better yet, fixed-length
+.SM ASCII
+strings for use in heterogenous network environments) for faster startup.
 Then the program would run as fast as the Version 7 program of the same name,
 with the flexibility of the System V version.
 .PP
-.I File
+.B File
 uses several algorithms that favor speed over accuracy,
-thus it can be misled about the contents of ASCII files.
+thus it can be misled about the contents of
+.SM ASCII
+files.
 .PP
-The support for ASCII files (primarily for programming languages)
+The support for
+.SM ASCII
+files (primarily for programming languages)
 is simplistic, inefficient and requires recompilation to update.
 .PP
 There should be an ``else'' clause to follow a series of continuation lines.
 .PP
 The magic file and keywords should have regular expression support.
-Their use of ASCII TAB as a field delimiter is ugly and makes
+Their use of
+.SM "ASCII TAB"
+as a field delimiter is ugly and makes
 it hard to edit the files, but is entrenched.
 .PP
 It might be advisable to allow upper-case letters in keywords
-for e.g., troff commands vs man page macros.
+for e.g.,
+.BR troff (1)
+commands vs man page macros.
 Regular expression support would make this easy.
 .PP
 The program doesn't grok \s-2FORTRAN\s0.
@ -343,6 +360,6 @@ This manual page, and particularly this section, is too long.
 .SH AVAILABILITY
 You can obtain the original author's latest version by anonymous FTP
 on
-.B tesla.ee.cornell.edu
+.B ftp.deshaw.com
 in the directory
-.BR /pub/file-X.YY.tar.gz
+.I /pub/file/file-X.YY.tar.gz
--- a/usr.bin/file/file.c
+++ b/usr.bin/file/file.c
@ -26,7 +26,7 @@
 */
 #ifndef	lint
 static char *moduleid = 
-	"@(#)$Id: file.c,v 1.34 1995/10/27 23:12:01 christos Exp $";
+	"@(#)$Id: file.c,v 1.38 1997/01/15 19:28:35 christos Exp $";
 #endif	/* lint */

 #include <stdio.h>
@ -37,15 +37,17 @@ static char *moduleid =
 #include <sys/stat.h>
 #include <fcntl.h>	/* for open() */
 #if (__COHERENT__ >= 0x420)
-#include <sys/utime.h>
+# include <sys/utime.h>
 #else
-#include <utime.h>
+# ifdef USE_UTIMES
+#  include <sys/time.h>
+# else
+#  include <utime.h>
+# endif
 #endif
 #include <unistd.h>	/* for read() */

-#ifdef __ELF__
-#include <elf.h>
-#endif
+#include <netinet/in.h>		/* for byte swapping */

 #include "patchlevel.h"
 #include "file.h"
@ -76,7 +78,11 @@ char *progname;		/* used throughout 			*/
 int lineno;		/* line number in the magic file	*/


-static void unwrap	__P((char *fn));
+static void	unwrap		__P((char *fn));
+#if 0
+static int	byteconv4	__P((int, int, int));
+static short	byteconv2	__P((int, int, int));
+#endif

 /*
 * main - parse arguments and handle options
@ -180,18 +186,23 @@ char *fn;
 	FILE *f;
 	int wid = 0, cwid;

-	if ((f = fopen(fn, "r")) == NULL) {
-		error("Cannot open `%s' (%s).\n", fn, strerror(errno));
-		/*NOTREACHED*/
-	}
+	if (strcmp("-", fn) == 0) {
+		f = stdin;
+		wid = 1;
+	} else {
+		if ((f = fopen(fn, "r")) == NULL) {
+			error("Cannot open `%s' (%s).\n", fn, strerror(errno));
+			/*NOTREACHED*/
+		}

-	while (fgets(buf, MAXPATHLEN, f) != NULL) {
-		cwid = strlen(buf) - 1;
-		if (cwid > wid)
-			wid = cwid;
-	}
+		while (fgets(buf, MAXPATHLEN, f) != NULL) {
+			cwid = strlen(buf) - 1;
+			if (cwid > wid)
+				wid = cwid;
+		}

-	rewind(f);
+		rewind(f);
+	}

 	while (fgets(buf, MAXPATHLEN, f) != NULL) {
 		buf[strlen(buf)-1] = '\0';
@ -202,6 +213,71 @@ char *fn;
 }


+#if 0
+/*
+ * byteconv4
+ * Input:
+ *	from		4 byte quantity to convert
+ *	same		whether to perform byte swapping
+ *	big_endian	whether we are a big endian host
+ */
+static int
+byteconv4(from, same, big_endian)
+    int from;
+    int same;
+    int big_endian;
+{
+  if (same)
+    return from;
+  else if (big_endian)		/* lsb -> msb conversion on msb */
+  {
+    union {
+      int i;
+      char c[4];
+    } retval, tmpval;
+
+    tmpval.i = from;
+    retval.c[0] = tmpval.c[3];
+    retval.c[1] = tmpval.c[2];
+    retval.c[2] = tmpval.c[1];
+    retval.c[3] = tmpval.c[0];
+
+    return retval.i;
+  }
+  else
+    return ntohl(from);		/* msb -> lsb conversion on lsb */
+}
+
+/*
+ * byteconv2
+ * Same as byteconv4, but for shorts
+ */
+static short
+byteconv2(from, same, big_endian)
+	int from;
+	int same;
+	int big_endian;
+{
+  if (same)
+    return from;
+  else if (big_endian)		/* lsb -> msb conversion on msb */
+  {
+    union {
+      short s;
+      char c[2];
+    } retval, tmpval;
+
+    tmpval.s = (short) from;
+    retval.c[0] = tmpval.c[1];
+    retval.c[1] = tmpval.c[0];
+
+    return retval.s;
+  }
+  else
+    return ntohs(from);		/* msb -> lsb conversion on lsb */
+}
+#endif
+
 /*
 * process - process input file
 */
@ -213,7 +289,6 @@ int wid;
 	int	fd = 0;
 	static  const char stdname[] = "standard input";
 	unsigned char	buf[HOWMANY+1];	/* one extra for terminating '\0' */
-	struct utimbuf  utbuf;
 	struct stat	sb;
 	int nbytes = 0;	/* number of bytes read from a datafile */
 	char match = '\0';
@ -265,61 +340,31 @@ int wid;
 		buf[nbytes++] = '\0';	/* null-terminate it */
 		match = tryit(buf, nbytes, zflag);
 	}
-#ifdef __ELF__
-	/*
-	 * ELF executables have multiple section headers in arbitrary
-	 * file locations and thus file(1) cannot determine it from easily.
-	 * Instead we traverse thru all section headers until a symbol table
-	 * one is found or else the binary is stripped.
-	 * XXX: This will not work for binaries of a different byteorder.
-	 *	Should come up with a better fix.
-	 */

-	if (match == 's' && nbytes > sizeof (Elf32_Ehdr) &&
-	    buf[EI_MAG0] == ELFMAG0 &&
-	    buf[EI_MAG1] == ELFMAG1 &&
-	    buf[EI_MAG2] == ELFMAG2 &&
-	    buf[EI_MAG3] == ELFMAG3) {
-
-		union {
-			long l;
-			char c[sizeof (long)];
-		} u;
-		Elf32_Ehdr elfhdr;
-		int stripped = 1;
-
-		u.l = 1;
-		(void) memcpy(&elfhdr, buf, sizeof elfhdr);
-
-		/*
-		 * If the system byteorder does not equal the object byteorder
-		 * then don't test.
-		 */
-		if ((u.c[sizeof(long) - 1] + 1) == elfhdr.e_ident[5]) {
-		    if (lseek(fd, elfhdr.e_shoff, SEEK_SET)<0)
-			error("lseek failed (%s).\n", strerror(errno));
-
-		    for ( ; elfhdr.e_shnum ; elfhdr.e_shnum--) {
-			if (read(fd, buf, elfhdr.e_shentsize)<0)
-			    error("read failed (%s).\n", strerror(errno));
-			if (((Elf32_Shdr *)&buf)->sh_type == SHT_SYMTAB) {
-			    stripped = 0;
-			    break;
-			}
-		    }
-		    if (stripped)
-			(void) printf (", stripped");
-		}
-	}
+#ifdef BUILTIN_ELF
+	if (match == 's' && nbytes > 5)
+		tryelf(fd, buf, nbytes);
 #endif

 	if (inname != stdname) {
+#ifdef RESTORE_TIME
 		/*
 		 * Try to restore access, modification times if read it.
 		 */
+# ifdef USE_UTIMES
+		struct timeval  utsbuf[2];
+		utsbuf[0].tv_sec = sb.st_atime;
+		utsbuf[1].tv_sec = sb.st_mtime;
+
+		(void) utimes(inname, utsbuf); /* don't care if loses */
+# else
+		struct utimbuf  utbuf;
+
 		utbuf.actime = sb.st_atime;
 		utbuf.modtime = sb.st_mtime;
 		(void) utime(inname, &utbuf); /* don't care if loses */
+# endif
+#endif
 		(void) close(fd);
 	}
 	(void) putchar('\n');
@ -343,6 +388,10 @@ int nb, zflag;
 	if (ascmagic(buf, nb))
 		return 'a';

+	/* see if it's international language text */
+	if (internatmagic(buf, nb))
+		return 'i';
+
 	/* abandon hope, all ye who remain here */
 	ckfputs("data", stdout);
 		return '\0';
--- a/usr.bin/file/file.h
+++ b/usr.bin/file/file.h
@ -1,6 +1,6 @@
 /*
 * file.h - definitions for file(1) program
- * @(#)$Id: file.h,v 1.22 1995/05/20 22:09:21 christos Exp $
+ * @(#)$Id: file.h,v 1.25 1997/01/15 19:28:35 christos Exp $
 *
 * Copyright (c) Ian F. Darwin, 1987.
 * Written by Ian F. Darwin.
@ -26,6 +26,12 @@
 * 4. This notice may not be removed or altered.
 */

+#ifndef __file_h__
+#define __file_h__
+
+typedef int int32;
+typedef unsigned int uint32;
+
 #ifndef HOWMANY
 # define HOWMANY 8192		/* how much of the file to look at */
 #endif
@ -37,12 +43,13 @@ struct magic {
 	short flag;		
 #define INDIR	1		/* if '>(...)' appears,  */
 #define	UNSIGNED 2		/* comparison is unsigned */
+#define ADD	4		/* if '>&' appears,  */
 	short cont_level;	/* level of ">" */
 	struct {
 		char type;	/* byte short long */
-		long offset;	/* offset from indirection */
+		int32 offset;	/* offset from indirection */
 	} in;
-	long offset;		/* offset to magic number */
+	int32 offset;		/* offset to magic number */
 	unsigned char reln;	/* relation (0=eq, '>'=gt, etc) */
 	char type;		/* int, short, long or string. */
 	char vallen;		/* length of string value, if any */
@ -60,12 +67,12 @@ struct magic {
 	union VALUETYPE {
 		unsigned char b;
 		unsigned short h;
-		unsigned long l;
+		uint32 l;
 		char s[MAXstring];
 		unsigned char hs[2];	/* 2 bytes of a fixed-endian "short" */
 		unsigned char hl[4];	/* 2 bytes of a fixed-endian "long" */
 	} value;		/* either number or string */
-	unsigned long mask;	/* mask before comparison with value */
+	uint32 mask;	/* mask before comparison with value */
 	char nospflag;		/* supress space character */
 	char desc[MAXDESC];	/* description */
 };
@ -97,8 +104,9 @@ extern int   softmagic		__P((unsigned char *, int));
 extern int   tryit		__P((unsigned char *, int, int));
 extern int   zmagic		__P((unsigned char *, int));
 extern void  ckfprintf		__P((FILE *, const char *, ...));
-extern unsigned long signextend	__P((struct magic *, unsigned long));
-
+extern uint32 signextend	__P((struct magic *, unsigned int32));
+extern int internatmagic	__P((unsigned char *, int));
+extern void tryelf		__P((int, char *, int));


 extern int errno;		/* Some unixes don't define this..	*/
@ -118,7 +126,16 @@ extern int lflag;		/* follow symbolic links?		*/
 extern int optind;		/* From getopt(3)			*/
 extern char *optarg;

-#if !defined(__STDC__) || defined(sun) || defined(__sun__) || defined(__convex__)
+#if defined(sun) || defined(__sun__) || defined (__sun)
+# if defined(__svr4) || defined (__SVR4) || defined(__svr4__)
+#  define SOLARIS
+# else
+#  define SUNOS
+# endif
+#endif
+
+
+#if !defined(__STDC__) || defined(SUNOS) || defined(__convex__)
 extern int sys_nerr;
 extern char *sys_errlist[];
 #define strerror(e) \
@ -129,3 +146,5 @@ extern char *sys_errlist[];
 #ifndef MAXPATHLEN
 #define	MAXPATHLEN	512
 #endif
+
+#endif /* __file_h__ */
--- a/usr.bin/file/fsmagic.c
+++ b/usr.bin/file/fsmagic.c
@ -31,6 +31,11 @@
 #include <sys/stat.h>
 #include <unistd.h>
 #include <stdlib.h>
+#ifndef major
+# if defined(__SVR4) || defined(_SVR4_SOURCE)
+#  include <sys/mkdev.h>
+# endif
+#endif
 #ifndef	major			/* if `major' not defined in types.h, */
 #include <sys/sysmacros.h>	/* try this one. */
 #endif
@ -46,7 +51,7 @@

 #ifndef	lint
 static char *moduleid = 
-	"@(#)$Id: fsmagic.c,v 1.23 1995/01/21 21:03:35 christos Exp $";
+	"@(#)$Id: fsmagic.c,v 1.25 1997/01/15 19:28:35 christos Exp $";
 #endif	/* lint */

 int
@ -84,12 +89,12 @@ struct stat *sb;
 		ckfputs("directory", stdout);
 		return 1;
 	case S_IFCHR:
-		(void) printf("character special (%d/%d)",
-			major(sb->st_rdev), minor(sb->st_rdev));
+		(void) printf("character special (%ld/%ld)",
+			(long) major(sb->st_rdev), (long) minor(sb->st_rdev));
 		return 1;
 	case S_IFBLK:
-		(void) printf("block special (%d/%d)",
-			major(sb->st_rdev), minor(sb->st_rdev));
+		(void) printf("block special (%ld/%ld)",
+			(long) major(sb->st_rdev), (long) minor(sb->st_rdev));
 		return 1;
 	/* TODO add code to handle V7 MUX and Blit MUX files */
 #ifdef	S_IFIFO
--- a/usr.bin/file/internat.c
+++ b/usr.bin/file/internat.c
@ -0,0 +1,72 @@
+#include "file.h"
+
+#include <string.h>
+
+#define F 0
+#define T 1
+
+/*
+ * List of characters that look "reasonable" in international
+ * language texts.  That's almost all characters :), except a
+ * few in the control range of ASCII (all the known international
+ * charactersets share the bottom half with ASCII).
+ */
+static char maybe_internat[256] = {
+	F, F, F, F, F, F, F, F, T, T, T, T, T, T, F, F,  /* 0x0X */
+	F, F, F, F, F, F, F, F, F, F, F, T, F, F, F, F,  /* 0x1X */
+	T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T,  /* 0x2X */
+	T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T,  /* 0x3X */
+	T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T,  /* 0x4X */
+	T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T,  /* 0x5X */
+	T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T,  /* 0x6X */
+	T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, F,  /* 0x7X */
+	T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T,  /* 0x8X */
+	T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T,  /* 0x9X */
+	T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T,  /* 0xaX */
+	T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T,  /* 0xbX */
+	T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T,  /* 0xcX */
+	T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T,  /* 0xdX */
+	T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T,  /* 0xeX */
+	T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T   /* 0xfX */
+};
+
+/* Maximal length of a line we consider "reasonable". */
+#define MAXLINELEN 300
+
+int
+internatmagic(buf, nbytes)
+	unsigned char *buf;
+	int nbytes;
+{
+	int i;
+	unsigned char *cp;
+
+	nbytes--;
+
+	/* First, look whether there are "unreasonable" characters. */
+	for (i = 0, cp = buf; i < nbytes; i++, cp++)
+		if (!maybe_internat[*cp])
+			return 0;
+
+	/*
+	 * Now, look whether the file consists of lines of
+	 * "reasonable" length.
+	 */
+
+	for (i = 0; i < nbytes;) {
+		cp = memchr(buf, '\n', nbytes - i);
+		if (cp == NULL) {
+			/* Don't fail if we hit the end of buffer. */
+			if (i + MAXLINELEN >= nbytes)
+				break;
+			else
+				return 0;
+		}
+		if (cp - buf > MAXLINELEN)
+			return 0;
+		i += (cp - buf + 1);
+		buf = cp + 1;
+	}
+	ckfputs("International language text", stdout);
+	return 1;
+}
--- a/usr.bin/file/is_tar.c
+++ b/usr.bin/file/is_tar.c
@ -5,7 +5,7 @@
 * Pubic Domain version written 26 Aug 1985 John Gilmore (ihnp4!hoptoad!gnu).
 *
 * @(#)list.c 1.18 9/23/86 Public Domain - gnu
- * $Id: is_tar.c,v 1.8 1993/09/16 21:09:35 christos Exp $
+ * $Id: is_tar.c,v 1.9 1997/01/15 17:23:24 christos Exp $
 *
 * Comments changed and some code/comments reformatted
 * for file command by Ian Darwin.
@ -19,9 +19,9 @@
 #define	isodigit(c)	( ((c) >= '0') && ((c) <= '7') )

 #if	defined(__STDC__) || defined(__cplusplus)
-static long from_oct(int, char*);	/* Decode octal number */
+static int from_oct(int, char*);	/* Decode octal number */
 #else
-static long from_oct();
+static int from_oct();
 #endif

 /*
@ -37,7 +37,7 @@ int nbytes;
 {
 	register union record *header = (union record *)buf;
 	register int	i;
-	register long	sum, recsum;
+	register int	sum, recsum;
 	register char	*p;

 	if (nbytes < sizeof(union record))
@ -75,12 +75,12 @@ int nbytes;
 *
 * Result is -1 if the field is invalid (all blank, or nonoctal).
 */
-static long
+static int
 from_oct(digs, where)
 	register int	digs;
 	register char	*where;
 {
-	register long	value;
+	register int	value;

 	while (isspace(*where)) {		/* Skip spaces */
 		where++;
--- a/usr.bin/file/magic.5
+++ b/usr.bin/file/magic.5
@ -3,14 +3,17 @@
 .SH NAME
 magic \- file command's magic number file
 .SH DESCRIPTION
-The
-.IR file (__CSECTION__)
+This manual page documents the format of the magic file as
+used by the
+.BR file (__CSECTION__)
+command, version __VERSION__. The
+.B file
 command identifies the type of a file using,
 among other tests,
 a test for whether the file begins with a certain
 .IR "magic number" .
 The file
-.B __MAGIC__
+.I __MAGIC__
 specifies what magic numbers are to be tested for,
 what message to print if a particular magic number is found,
 and additional information to extract from the file.
@ -113,7 +116,7 @@ then presumably print that string, by doing
 .IP message
 The message to be printed if the comparison succeeds.  If the string
 contains a
-.IR printf (3S)
+.BR printf (3S)
 format specification, the value from the file (with any specified masking
 performed) is printed using the message as the format string.
 .PP
@ -156,6 +159,15 @@ type specifier. To that number the value of
 .I y
 is added and the result is used as an offset in the file. The default type
 if one is not specified is long.
+.PP
+Sometimes you do not know the exact offset as this depends on the length of
+preceding fields. You can specify an offset relative to the end of the
+last uplevel field (of course this may only be done for sublevel tests, i.e.
+test beginning with 
+.B >
+). Such a relative offset is specified using
+.B &
+as a prefix to the offset.
 .SH BUGS
 The formats 
 .IR long ,
@ -176,7 +188,7 @@ a system on which the lengths are invariant.
 There is (currently) no support for specified-endian data to be used in
 indirect offsets.
 .SH SEE ALSO
-.IR file (__CSECTION__)
+.BR file (__CSECTION__)
 \- the command that reads this file.
 .\"
 .\" From: guy@sun.uucp (Guy Harris)
@ -191,4 +203,4 @@ indirect offsets.
 .\" the changes I posted to the S5R2 version.
 .\"
 .\" Modified for Ian Darwin's version of the file command.
-.\" @(#)$Id: magic.man,v 1.12 1995/01/21 21:03:35 christos Exp $
+.\" @(#)$Id: magic.man,v 1.14 1996/06/22 22:05:07 christos Exp $
--- a/usr.bin/file/names.h
+++ b/usr.bin/file/names.h
@ -10,22 +10,24 @@
 *
 * See LEGAL.NOTICE
 *
- * $Id: names.h,v 1.12 1995/04/28 17:29:13 christos Exp $
+ * $Id: names.h,v 1.13 1997/01/15 17:23:24 christos Exp $
 */

 /* these types are used to index the table 'types': keep em in sync! */
 #define L_C	0		/* first and foremost on UNIX */
-#define	L_FORT	1		/* the oldest one */
-#define L_MAKE	2		/* Makefiles */
-#define L_PLI	3		/* PL/1 */
-#define L_MACH	4		/* some kinda assembler */
-#define L_ENG	5		/* English */
-#define	L_PAS	6		/* Pascal */
-#define	L_MAIL	7		/* Electronic mail */
-#define	L_NEWS	8		/* Usenet Netnews */
+#define L_CC	1		/* Bjarne's postincrement */
+#define	L_FORT	2		/* the oldest one */
+#define L_MAKE	3		/* Makefiles */
+#define L_PLI	4		/* PL/1 */
+#define L_MACH	5		/* some kinda assembler */
+#define L_ENG	6		/* English */
+#define	L_PAS	7		/* Pascal */
+#define	L_MAIL	8		/* Electronic mail */
+#define	L_NEWS	9		/* Usenet Netnews */

 static char *types[] = {
 	"C program text",
+	"C++ program text",
 	"FORTRAN program text",
 	"make commands text" ,
 	"PL/1 program text",
@ -43,6 +45,12 @@ static struct names {
 } names[] = {
 	/* These must be sorted by eye for optimal hit rate */
 	/* Add to this list only after substantial meditation */
+	{"//",		L_CC},
+	{"template",	L_CC},
+	{"virtual",	L_CC},
+	{"class",	L_CC},
+	{"public:",	L_CC},
+	{"private:",	L_CC},
 	{"/*",		L_C},	/* must precede "The", "the", etc. */
 	{"#include",	L_C},
 	{"char",	L_C},
--- a/usr.bin/file/patchlevel.h
+++ b/usr.bin/file/patchlevel.h
@ -1,11 +1,33 @@
 #define	FILE_VERSION_MAJOR	3
-#define	patchlevel		19
+#define	patchlevel		22

 /*
 * Patchlevel file for Ian Darwin's MAGIC command.
- * $Id: patchlevel.h,v 1.19 1995/10/27 23:14:46 christos Exp $
+ * $Id: patchlevel.h,v 1.22 1997/01/15 17:23:24 christos Exp $
 *
 * $Log: patchlevel.h,v $
+ * Revision 1.22  1997/01/15 17:23:24  christos
+ * - add support for elf core files: find the program name under SVR4 [Ken Pizzini]
+ * - print strings only up to the first carriage return [various]
+ * - freebsd international ascii support [J Wunsch]
+ * - magic fixes and additions [Guy Harris]
+ * - 64 bit fixes [Larry Schwimmer]
+ * - support for both utime and utimes, but don't restore file access times
+ *   by default [various]
+ * - \xXX only takes 2 hex digits, not 3.
+ * - re-implement support for core files [Guy Harris]
+ *
+ * Revision 1.21  1996/10/05 18:15:29  christos
+ * Segregate elf stuff and conditionally enable it with -DBUILTIN_ELF
+ * More magic fixes
+ *
+ * Revision 1.20  1996/06/22  22:15:52  christos
+ * - support relative offsets of the form >&
+ * - fix bug with truncating magic strings that contain \n
+ * - file -f - did not read from stdin as documented
+ * - support elf file parsing using our own elf support.
+ * - as always magdir fixes and additions.
+ *
 * Revision 1.19  1995/10/27  23:14:46  christos
 * Ability to parse colon separated list of magic files
 * New LEGAL.NOTICE
--- a/usr.bin/file/print.c
+++ b/usr.bin/file/print.c
@ -40,7 +40,7 @@

 #ifndef lint
 static char *moduleid =
-	"@(#)$Id: print.c,v 1.22 1995/05/20 22:09:21 christos Exp $";
+	"@(#)$Id: print.c,v 1.23 1997/01/15 19:28:35 christos Exp $";
 #endif  /* lint */

 #define SZOF(a)	(sizeof(a) / sizeof(a[0]))
@ -58,7 +58,7 @@ struct magic *m;
 		       m->offset);

 	if (m->flag & INDIR)
-		(void) fprintf(stderr, "(%s,%ld),",
+		(void) fprintf(stderr, "(%s,%d),",
 			       (m->in.type >= 0 && m->in.type < SZOF(typ)) ? 
 					typ[(unsigned char) m->in.type] :
 					"*bad*",
@ -69,7 +69,7 @@ struct magic *m;
 				typ[(unsigned char) m->type] : 
 				"*bad*");
 	if (m->mask != ~0L)
-		(void) fprintf(stderr, " & %.8lx", m->mask);
+		(void) fprintf(stderr, " & %.8x", m->mask);

 	(void) fprintf(stderr, ",%c", m->reln);

@ -82,7 +82,7 @@ struct magic *m;
 	    case LELONG:
 	    case BESHORT:
 	    case BELONG:
-		    (void) fprintf(stderr, "%ld", m->value.l);
+		    (void) fprintf(stderr, "%d", m->value.l);
 		    break;
 	    case STRING:
 		    showstr(stderr, m->value.s, -1);
--- a/usr.bin/file/readelf.c
+++ b/usr.bin/file/readelf.c
@ -0,0 +1,314 @@
+
+#ifdef BUILTIN_ELF
+#include <sys/types.h>
+#include <string.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <errno.h>
+
+#include "readelf.h"
+#include "file.h"
+
+static void
+doshn(fd, off, num, size, buf)
+	int fd;
+	off_t off;
+	int num;
+	size_t size;
+	char *buf;
+{
+	/*
+	 * This works for both 32-bit and 64-bit ELF formats,
+	 * because it looks only at the "sh_type" field, which is
+	 * always 32 bits, and is preceded only by the "sh_name"
+	 * field which is also always 32 bits, and because it uses
+	 * the shdr size from the ELF header rather than using
+	 * the size of an "Elf32_Shdr".
+	 */
+	Elf32_Shdr *sh = (Elf32_Shdr *) buf;
+
+	if (lseek(fd, off, SEEK_SET) == -1)
+		error("lseek failed (%s).\n", strerror(errno));
+
+	for ( ; num; num--) {
+		if (read(fd, buf, size) == -1)
+			error("read failed (%s).\n", strerror(errno));
+		if (sh->sh_type == SHT_SYMTAB) {
+			(void) printf (", not stripped");
+			return;
+		}
+	}
+	(void) printf (", stripped");
+}
+
+/*
+ * Look through the program headers of an executable image, searching
+ * for a PT_INTERP section; if one is found, it's dynamically linked,
+ * otherwise it's statically linked.
+ */
+static void
+dophn_exec(fd, off, num, size, buf)
+	int fd;
+	off_t off;
+	int num;
+	size_t size;
+	char *buf;
+{
+	/* I am not sure if this works for 64 bit elf formats */
+	Elf32_Phdr *ph = (Elf32_Phdr *) buf;
+
+	if (lseek(fd, off, SEEK_SET) == -1)
+		error("lseek failed (%s).\n", strerror(errno));
+
+  	for ( ; num; num--) {
+  		if (read(fd, buf, size) == -1)
+  			error("read failed (%s).\n", strerror(errno));
+		if (ph->p_type == PT_INTERP) {
+			/*
+			 * Has an interpreter - must be a dynamically-linked
+			 * executable.
+			 */
+			printf(", dynamically linked");
+			return;
+		}
+	}
+	printf(", statically linked");
+}
+
+size_t	prpsoffsets[] = {
+	100,		/* SunOS 5.x */
+	32,		/* Linux */
+};
+
+#define	NOFFSETS	(sizeof prpsoffsets / sizeof prpsoffsets[0])
+
+/*
+ * Look through the program headers of an executable image, searching
+ * for a PT_NOTE section of type NT_PRPSINFO, with a name "CORE"; if one
+ * is found, try looking in various places in its contents for a 16-character
+ * string containing only printable characters - if found, that string
+ * should be the name of the program that dropped core.
+ * Note: right after that 16-character string is, at least in SunOS 5.x
+ * (and possibly other SVR4-flavored systems) and Linux, a longer string
+ * (80 characters, in 5.x, probably other SVR4-flavored systems, and Linux)
+ * containing the start of the command line for that program.
+ */
+static void
+dophn_core(fd, off, num, size, buf)
+	int fd;
+	off_t off;
+	int num;
+	size_t size;
+	char *buf;
+{
+	/*
+	 * This doesn't work for 64-bit ELF, as the "p_offset" field is
+	 * 64 bits in 64-bit ELF.
+	 */
+	/*
+	 * This doesn't work for 64-bit ELF, as the "p_offset" field is
+	 * 64 bits in 64-bit ELF.
+	 */
+	Elf32_Phdr *ph = (Elf32_Phdr *) buf;
+	Elf32_Nhdr *nh;
+	size_t offset, noffset, reloffset;
+	unsigned char c;
+	int i, j;
+	char nbuf[BUFSIZ];
+	int bufsize;
+
+	for ( ; num; num--) {
+		if (lseek(fd, off, SEEK_SET) == -1)
+			error("lseek failed (%s).\n", strerror(errno));
+		if (read(fd, buf, size) == -1)
+			error("read failed (%s).\n", strerror(errno));
+		off += size;
+		if (ph->p_type != PT_NOTE)
+			continue;
+		if (lseek(fd, ph->p_offset, SEEK_SET) == -1)
+			error("lseek failed (%s).\n", strerror(errno));
+		bufsize = read(fd, nbuf, BUFSIZ);
+		if (bufsize == -1)
+			error("read failed (%s).\n", strerror(errno));
+		offset = 0;
+		for (;;) {
+			if (offset >= bufsize)
+				break;
+			nh = (Elf32_Nhdr *)&nbuf[offset];
+			offset += sizeof *nh;
+
+			/*
+			 * If this note isn't an NT_PRPSINFO note, it's
+			 * not what we're looking for.
+			 */
+			if (nh->n_type != NT_PRPSINFO) {
+				offset += nh->n_namesz;
+				offset = ((offset + 3)/4)*4;
+				offset += nh->n_descsz;
+				offset = ((offset + 3)/4)*4;
+				continue;
+			}
+
+			/*
+			 * Make sure this note has the name "CORE".
+			 */
+			if (offset + nh->n_namesz >= bufsize) {
+				/*
+				 * We're past the end of the buffer.
+				 */
+				break;
+			}
+			if (nh->n_namesz != 5
+			    || strcmp(&nbuf[offset], "CORE") != 0)
+				continue;
+			offset += nh->n_namesz;
+			offset = ((offset + 3)/4)*4;
+
+			/*
+			 * Extract the program name.  We assume it to be
+			 * 16 characters (that's what it is in SunOS 5.x
+			 * and Linux).
+			 *
+			 * Unfortunately, it's at a different offset in
+			 * SunOS 5.x and Linux, so try multiple offsets.
+			 * If the characters aren't all printable, reject
+			 * it.
+			 */
+			for (i = 0; i < NOFFSETS; i++) {
+				reloffset = prpsoffsets[i];
+				noffset = offset + reloffset;
+				for (j = 0; j < 16;
+				    j++, noffset++, reloffset++) {
+					/*
+					 * Make sure we're not past the end
+					 * of the buffer; if we are, just
+					 * give up.
+					 */
+					if (noffset >= bufsize)
+						return;
+
+					/*
+					 * Make sure we're not past the
+					 * end of the contents; if we
+					 * are, this obviously isn't
+					 * the right offset.
+					 */
+					if (reloffset >= nh->n_descsz)
+						goto tryanother;
+
+					c = nbuf[noffset];
+					if (c != '\0' && !isprint(c))
+						goto tryanother;
+				}
+
+				/*
+				 * Well, that worked.
+				 */
+				printf(", from '%.16s'",
+				    &nbuf[offset + prpsoffsets[i]]);
+				return;
+
+			tryanother:
+				;
+			}
+			offset += nh->n_descsz;
+			offset = ((offset + 3)/4)*4;
+		}
+	}
+}
+
+void
+tryelf(fd, buf, nbytes)
+	int fd;
+	char *buf;
+	int nbytes;
+{
+	union {
+		int32 l;
+		char c[sizeof (int32)];
+	} u;
+
+	/*
+	 * ELF executables have multiple section headers in arbitrary
+	 * file locations and thus file(1) cannot determine it from easily.
+	 * Instead we traverse thru all section headers until a symbol table
+	 * one is found or else the binary is stripped.
+	 */
+	if (buf[EI_MAG0] != ELFMAG0 || buf[EI_MAG1] != ELFMAG1
+	    || buf[EI_MAG2] != ELFMAG2 || buf[EI_MAG3] != ELFMAG3)
+	    return;
+
+
+	if (buf[4] == ELFCLASS32) {
+		Elf32_Ehdr elfhdr;
+		if (nbytes <= sizeof (Elf32_Ehdr))
+			return;
+
+
+		u.l = 1;
+		(void) memcpy(&elfhdr, buf, sizeof elfhdr);
+		/*
+		 * If the system byteorder does not equal the
+		 * object byteorder then don't test.
+		 * XXX - we could conceivably fix up the "dophn_XXX()" and
+		 * "doshn()" routines to extract stuff in the right
+		 * byte order....
+		 */
+		if ((u.c[sizeof(long) - 1] + 1) == elfhdr.e_ident[5]) {
+			if (elfhdr.e_type == ET_CORE) 
+				dophn_core(fd, elfhdr.e_phoff, elfhdr.e_phnum, 
+				      elfhdr.e_phentsize, buf);
+			else {
+				if (elfhdr.e_type == ET_EXEC) {
+					dophn_exec(fd, elfhdr.e_phoff,
+					    elfhdr.e_phnum, 
+					      elfhdr.e_phentsize, buf);
+				}
+				doshn(fd, elfhdr.e_shoff, elfhdr.e_shnum,
+				      elfhdr.e_shentsize, buf);
+			}
+		}
+		return;
+	}
+
+        if (buf[4] == ELFCLASS64) {
+		Elf64_Ehdr elfhdr;
+		if (nbytes <= sizeof (Elf64_Ehdr))
+			return;
+
+
+		u.l = 1;
+		(void) memcpy(&elfhdr, buf, sizeof elfhdr);
+
+		/*
+		 * If the system byteorder does not equal the
+		 * object byteorder then don't test.
+		 * XXX - we could conceivably fix up the "dophn_XXX()" and
+		 * "doshn()" routines to extract stuff in the right
+		 * byte order....
+		 */
+		if ((u.c[sizeof(long) - 1] + 1) == elfhdr.e_ident[5]) {
+#ifdef notyet
+			if (elfhdr.e_type == ET_CORE) 
+				dophn_core(fd, elfhdr.e_phoff, elfhdr.e_phnum, 
+				      elfhdr.e_phentsize, buf);
+			else
+#endif
+			{
+#ifdef notyet
+				if (elfhdr.e_type == ET_EXEC) {
+					dophn_exec(fd, elfhdr.e_phoff,
+					    elfhdr.e_phnum, 
+					      elfhdr.e_phentsize, buf);
+				}
+#endif
+				doshn(fd, elfhdr.e_shoff, elfhdr.e_shnum,
+				      elfhdr.e_shentsize, buf);
+			}
+		}
+		return;
+	}
+}
+#endif
--- a/usr.bin/file/readelf.h
+++ b/usr.bin/file/readelf.h
@ -0,0 +1,167 @@
+/*
+ * readelf.h 
+ * @(#)$Id: readelf.h,v 1.4 1997/01/15 17:23:24 christos Exp $
+ *
+ * Provide elf data structures for non-elf machines, allowing file
+ * non-elf hosts to determine if an elf binary is stripped.
+ * Note: cobbled from the linux header file, with modifications
+ */
+#ifndef __fake_elf_h__
+#define __fake_elf_h__
+
+typedef unsigned int	Elf32_Addr;
+typedef unsigned short	Elf32_Half;
+typedef unsigned int	Elf32_Off;
+typedef unsigned int	Elf32_Word;
+typedef unsigned char	Elf32_Char;
+
+/* XXX: We need 64 bit numbers here */
+typedef unsigned int	Elf64_Addr[2];
+typedef unsigned short	Elf64_Half;
+typedef unsigned int	Elf64_Off[2];
+typedef unsigned int	Elf64_Word;
+typedef unsigned char	Elf64_Char;
+
+#define EI_NIDENT	16
+
+typedef struct {
+    Elf32_Char	e_ident[EI_NIDENT];
+    Elf32_Half	e_type;
+    Elf32_Half	e_machine;
+    Elf32_Word	e_version;
+    Elf32_Addr	e_entry;  /* Entry point */
+    Elf32_Off	e_phoff;
+    Elf32_Off	e_shoff;
+    Elf32_Word	e_flags;
+    Elf32_Half	e_ehsize;
+    Elf32_Half	e_phentsize;
+    Elf32_Half	e_phnum;
+    Elf32_Half	e_shentsize;
+    Elf32_Half	e_shnum;
+    Elf32_Half	e_shstrndx;
+} Elf32_Ehdr;
+
+typedef struct {
+    Elf64_Char	e_ident[EI_NIDENT];
+    Elf64_Half	e_type;
+    Elf64_Half	e_machine;
+    Elf64_Word	e_version;
+    Elf64_Addr	e_entry;  /* Entry point */
+    Elf64_Off	e_phoff;
+    Elf64_Off	e_shoff;
+    Elf64_Word	e_flags;
+    Elf64_Half	e_ehsize;
+    Elf64_Half	e_phentsize;
+    Elf64_Half	e_phnum;
+    Elf64_Half	e_shentsize;
+    Elf64_Half	e_shnum;
+    Elf64_Half	e_shstrndx;
+} Elf64_Ehdr;
+
+/* e_type */
+#define ET_EXEC		2
+#define ET_CORE		4
+
+/* sh_type */
+#define SHT_SYMTAB	2
+#define SHT_NOTE	7
+
+/* elf type */
+#define ELFDATANONE	0		/* e_ident[EI_DATA] */
+#define ELFDATA2LSB	1
+#define ELFDATA2MSB	2
+
+/* elf class */
+#define ELFCLASSNONE	0
+#define ELFCLASS32	1
+#define ELFCLASS64	2
+
+/* magic number */
+#define	EI_MAG0		0		/* e_ident[] indexes */
+#define	EI_MAG1		1
+#define	EI_MAG2		2
+#define	EI_MAG3		3
+#define	EI_CLASS	4
+#define	EI_DATA		5
+#define	EI_VERSION	6
+#define	EI_PAD		7
+
+#define	ELFMAG0		0x7f		/* EI_MAG */
+#define	ELFMAG1		'E'
+#define	ELFMAG2		'L'
+#define	ELFMAG3		'F'
+#define	ELFMAG		"\177ELF"
+
+typedef struct {
+    Elf32_Word	p_type;
+    Elf32_Off	p_offset;
+    Elf32_Addr	p_vaddr;
+    Elf32_Addr	p_paddr;
+    Elf32_Word	p_filesz;
+    Elf32_Word	p_memsz;
+    Elf32_Word	p_flags;
+    Elf32_Word	p_align;
+} Elf32_Phdr;
+
+#define	PT_NULL		0		/* p_type */
+#define	PT_LOAD		1
+#define	PT_DYNAMIC	2
+#define	PT_INTERP	3
+#define	PT_NOTE		4
+#define	PT_SHLIB	5
+#define	PT_PHDR		6
+#define	PT_NUM		7
+
+typedef struct {
+    Elf32_Word	sh_name;
+    Elf32_Word	sh_type;
+    Elf32_Word	sh_flags;
+    Elf32_Addr	sh_addr;
+    Elf32_Off	sh_offset;
+    Elf32_Word	sh_size;
+    Elf32_Word	sh_link;
+    Elf32_Word	sh_info;
+    Elf32_Word	sh_addralign;
+    Elf32_Word	sh_entsize;
+} Elf32_Shdr;
+
+typedef struct {
+    Elf64_Word	sh_name;
+    Elf64_Word	sh_type;
+    Elf64_Off	sh_flags;
+    Elf64_Addr	sh_addr;
+    Elf64_Off	sh_offset;
+    Elf64_Off	sh_size;
+    Elf64_Word	sh_link;
+    Elf64_Word	sh_info;
+    Elf64_Off	sh_addralign;
+    Elf64_Off	sh_entsize;
+} Elf64_Shdr;
+
+/* Notes used in ET_CORE */
+#define NT_PRSTATUS	1
+#define NT_PRFPREG	2
+#define NT_PRPSINFO	3
+#define NT_TASKSTRUCT	4
+
+/* Note header in a PT_NOTE section */
+typedef struct elf_note {
+  Elf32_Word	n_namesz;	/* Name size */
+  Elf32_Word	n_descsz;	/* Content size */
+  Elf32_Word	n_type;		/* Content type */
+} Elf32_Nhdr;
+
+typedef struct {
+    Elf64_Word	n_namesz;
+    Elf64_Word	n_descsz;
+    Elf64_Word	n_type;
+} Elf64_Nhdr;
+
+#define	NT_PRSTATUS	1
+#define	NT_PRFPREG	2
+#define	NT_PRPSINFO	3
+#define	NT_PRXREG	4
+#define	NT_PLATFORM	5
+#define	NT_AUXV		6
+
+#endif
--- a/usr.bin/file/softmagic.c
+++ b/usr.bin/file/softmagic.c
@ -27,6 +27,7 @@

 #include <stdio.h>
 #include <string.h>
+#include <stdlib.h>
 #include <time.h>
 #include <sys/types.h>

@ -34,15 +35,15 @@

 #ifndef	lint
 static char *moduleid = 
-	"@(#)$Id: softmagic.c,v 1.30 1995/05/20 22:09:21 christos Exp $";
+	"@(#)$Id: softmagic.c,v 1.34 1997/01/15 19:28:35 christos Exp $";
 #endif	/* lint */

 static int match	__P((unsigned char *, int));
 static int mget		__P((union VALUETYPE *,
 			     unsigned char *, struct magic *, int));
 static int mcheck	__P((union VALUETYPE *, struct magic *));
-static void mprint	__P((union VALUETYPE *, struct magic *));
-static void mdebug	__P((long, char *, int));
+static int32 mprint	__P((union VALUETYPE *, struct magic *));
+static void mdebug	__P((int32, char *, int));
 static int mconvert	__P((union VALUETYPE *, struct magic *));

 /*
@ -98,6 +99,13 @@ int nbytes;
 	int cont_level = 0;
 	int need_separator = 0;
 	union VALUETYPE p;
+	static int32 *tmpoff = NULL;
+	static size_t tmplen = 0;
+	int32 oldoff = 0;
+
+	if (tmpoff == NULL)
+		if ((tmpoff = (int32 *) malloc(tmplen = 20)) == NULL)
+			error("out of memory\n");

 	for (magindex = 0; magindex < nmagic; magindex++) {
 		/* if main entry matches, print it... */
@ -113,7 +121,7 @@ int nbytes;
 			    continue;
 		}

-		mprint(&p, &magic[magindex]);
+		tmpoff[cont_level] = mprint(&p, &magic[magindex]);
 		/*
 		 * If we printed something, we'll need to print
 		 * a blank before we print something else.
@ -121,7 +129,10 @@ int nbytes;
 		if (magic[magindex].desc[0])
 			need_separator = 1;
 		/* and any continuations that match */
-		cont_level++;
+		if (++cont_level >= tmplen)
+			if ((tmpoff = (int32 *) realloc(tmpoff,
+						       tmplen += 20)) == NULL)
+				error("out of memory\n");
 		while (magic[magindex+1].cont_level != 0 && 
 		       ++magindex < nmagic) {
 			if (cont_level >= magic[magindex].cont_level) {
@ -132,6 +143,10 @@ int nbytes;
 					 */
 					cont_level = magic[magindex].cont_level;
 				}
+				if (magic[magindex].flag & ADD) {
+					oldoff=magic[magindex].offset;
+					magic[magindex].offset += tmpoff[cont_level-1];
+				}
 				if (mget(&p, s, &magic[magindex], nbytes) &&
 				    mcheck(&p, &magic[magindex])) {
 					/*
@ -149,7 +164,7 @@ int nbytes;
 						(void) putchar(' ');
 						need_separator = 0;
 					}
-					mprint(&p, &magic[magindex]);
+					tmpoff[cont_level] = mprint(&p, &magic[magindex]);
 					if (magic[magindex].desc[0])
 						need_separator = 1;

@ -158,7 +173,14 @@ int nbytes;
 					 * at a higher level,
 					 * process them.
 					 */
-					cont_level++;
+					if (++cont_level >= tmplen)
+						if ((tmpoff = 
+						    (int32 *) realloc(tmpoff,
+						    tmplen += 20)) == NULL)
+							error("out of memory\n");
+				}
+				if (magic[magindex].flag & ADD) {
+					 magic[magindex].offset = oldoff;
 				}
 			}
 		}
@ -167,13 +189,14 @@ int nbytes;
 	return 0;			/* no match at all */
 }

-static void
+static int32
 mprint(p, m)
 union VALUETYPE *p;
 struct magic *m;
 {
 	char *pp, *rt;
-	unsigned long v;
+	uint32 v;
+	int32 t=0 ;


  	switch (m->type) {
@ -181,6 +204,7 @@ struct magic *m;
 		v = p->b;
 		v = signextend(m, v) & m->mask;
 		(void) printf(m->desc, (unsigned char) v);
+		t = m->offset + sizeof(char);
 		break;

  	case SHORT:
@ -189,6 +213,7 @@ struct magic *m;
 		v = p->h;
 		v = signextend(m, v) & m->mask;
 		(void) printf(m->desc, (unsigned short) v);
+		t = m->offset + sizeof(short);
 		break;

  	case LONG:
@ -196,17 +221,25 @@ struct magic *m;
  	case LELONG:
 		v = p->l;
 		v = signextend(m, v) & m->mask;
-		(void) printf(m->desc, (unsigned long) v);
+		(void) printf(m->desc, (uint32) v);
+		t = m->offset + sizeof(int32);
  		break;

  	case STRING:
 		if (m->reln == '=') {
 			(void) printf(m->desc, m->value.s);
+			t = m->offset + strlen(m->value.s);
 		}
 		else {
+			if (*m->value.s == '\0') {
+				char *cp = strchr(p->s,'\n');
+				if (cp)
+					*cp = '\0';
+			}
 			(void) printf(m->desc, p->s);
+			t = m->offset + strlen(p->s);
 		}
-		return;
+		break;

 	case DATE:
 	case BEDATE:
@ -215,11 +248,14 @@ struct magic *m;
 		if ((rt = strchr(pp, '\n')) != NULL)
 			*rt = '\0';
 		(void) printf(m->desc, pp);
-		return;
+		t = m->offset + sizeof(time_t);
+		break;
+
 	default:
 		error("invalid m->type (%d) in mprint().\n", m->type);
 		/*NOTREACHED*/
 	}
+	return(t);
 }

 /*
@ -230,8 +266,6 @@ mconvert(p, m)
 union VALUETYPE *p;
 struct magic *m;
 {
-	char *rt;
-
 	switch (m->type) {
 	case BYTE:
 	case SHORT:
@ -239,17 +273,21 @@ struct magic *m;
 	case DATE:
 		return 1;
 	case STRING:
-		/* Null terminate and eat the return */
-		p->s[sizeof(p->s) - 1] = '\0';
-		if ((rt = strchr(p->s, '\n')) != NULL)
-			*rt = '\0';
-		return 1;
+		{
+			char *ptr;
+
+			/* Null terminate and eat the return */
+			p->s[sizeof(p->s) - 1] = '\0';
+			if ((ptr = strchr(p->s, '\n')) != NULL)
+				*ptr = '\0';
+			return 1;
+		}
 	case BESHORT:
 		p->h = (short)((p->hs[0]<<8)|(p->hs[1]));
 		return 1;
 	case BELONG:
 	case BEDATE:
-		p->l = (long)
+		p->l = (int32)
 		    ((p->hl[0]<<24)|(p->hl[1]<<16)|(p->hl[2]<<8)|(p->hl[3]));
 		return 1;
 	case LESHORT:
@ -257,7 +295,7 @@ struct magic *m;
 		return 1;
 	case LELONG:
 	case LEDATE:
-		p->l = (long)
+		p->l = (int32)
 		    ((p->hl[3]<<24)|(p->hl[2]<<16)|(p->hl[1]<<8)|(p->hl[0]));
 		return 1;
 	default:
@ -269,11 +307,11 @@ struct magic *m;

 static void
 mdebug(offset, str, len)
-long offset;
+int32 offset;
 char *str;
 int len;
 {
-	(void) fprintf(stderr, "mget @%ld: ", offset);
+	(void) fprintf(stderr, "mget @%d: ", offset);
 	showstr(stderr, (char *) str, len);
 	(void) fputc('\n', stderr);
 	(void) fputc('\n', stderr);
@ -286,7 +324,7 @@ unsigned char	*s;
 struct magic *m;
 int nbytes;
 {
-	long offset = m->offset;
+	int32 offset = m->offset;

 	if (offset + sizeof(union VALUETYPE) <= nbytes)
 		memcpy(p, s + offset, sizeof(union VALUETYPE));
@ -295,7 +333,7 @@ int nbytes;
 		 * the usefulness of padding with zeroes eludes me, it
 		 * might even cause problems
 		 */
-		long have = nbytes - offset;
+		int32 have = nbytes - offset;
 		memset(p, 0, sizeof(union VALUETYPE));
 		if (have > 0)
 			memcpy(p, s + offset, have);
@ -345,8 +383,8 @@ mcheck(p, m)
 union VALUETYPE* p;
 struct magic *m;
 {
-	register unsigned long l = m->value.l;
-	register unsigned long v;
+	register uint32 l = m->value.l;
+	register uint32 v;
 	int matched;

 	if ( (m->value.s[0] == 'x') && (m->value.s[1] == '\0') ) {
@ -389,7 +427,7 @@ struct magic *m;
 			register int len = m->vallen;

 			while (--len >= 0)
-				if ((v = *b++ - *a++) != 0)
+				if ((v = *b++ - *a++) != '\0')
 					break;
 		}
 		break;
@ -403,21 +441,21 @@ struct magic *m;
 	switch (m->reln) {
 	case 'x':
 		if (debug)
-			(void) fprintf(stderr, "%lu == *any* = 1\n", v);
+			(void) fprintf(stderr, "%u == *any* = 1\n", v);
 		matched = 1;
 		break;

 	case '!':
 		matched = v != l;
 		if (debug)
-			(void) fprintf(stderr, "%lu != %lu = %d\n",
+			(void) fprintf(stderr, "%u != %u = %d\n",
 				       v, l, matched);
 		break;

 	case '=':
 		matched = v == l;
 		if (debug)
-			(void) fprintf(stderr, "%lu == %lu = %d\n",
+			(void) fprintf(stderr, "%u == %u = %d\n",
 				       v, l, matched);
 		break;

@ -425,13 +463,13 @@ struct magic *m;
 		if (m->flag & UNSIGNED) {
 			matched = v > l;
 			if (debug)
-				(void) fprintf(stderr, "%lu > %lu = %d\n",
+				(void) fprintf(stderr, "%u > %u = %d\n",
 					       v, l, matched);
 		}
 		else {
-			matched = (long) v > (long) l;
+			matched = (int32) v > (int32) l;
 			if (debug)
-				(void) fprintf(stderr, "%ld > %ld = %d\n",
+				(void) fprintf(stderr, "%d > %d = %d\n",
 					       v, l, matched);
 		}
 		break;
@ -440,13 +478,13 @@ struct magic *m;
 		if (m->flag & UNSIGNED) {
 			matched = v < l;
 			if (debug)
-				(void) fprintf(stderr, "%lu < %lu = %d\n",
+				(void) fprintf(stderr, "%u < %u = %d\n",
 					       v, l, matched);
 		}
 		else {
-			matched = (long) v < (long) l;
+			matched = (int32) v < (int32) l;
 			if (debug)
-				(void) fprintf(stderr, "%ld < %ld = %d\n",
+				(void) fprintf(stderr, "%d < %d = %d\n",
 					       v, l, matched);
 		}
 		break;
@ -454,14 +492,14 @@ struct magic *m;
 	case '&':
 		matched = (v & l) == l;
 		if (debug)
-			(void) fprintf(stderr, "((%lx & %lx) == %lx) = %d\n",
+			(void) fprintf(stderr, "((%x & %x) == %x) = %d\n",
 				       v, l, l, matched);
 		break;

 	case '^':
 		matched = (v & l) != l;
 		if (debug)
-			(void) fprintf(stderr, "((%lx & %lx) != %lx) = %d\n",
+			(void) fprintf(stderr, "((%x & %x) != %x) = %d\n",
 				       v, l, l, matched);
 		break;