Update manpages for FILE 4.17.
This commit is contained in:
parent
f07b836981
commit
b43d227cab
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=162381
@ -1,6 +1,6 @@
|
|||||||
.\" $FreeBSD$
|
.\" $FreeBSD$
|
||||||
.\" $Id: file.man,v 1.54 2003/10/27 18:09:08 christos Exp $
|
.\" $Id: file.man,v 1.57 2005/08/18 15:18:22 christos Exp $
|
||||||
.Dd October 27, 2003
|
.Dd August 18, 2005
|
||||||
.Dt FILE 1 "Copyright but distributable"
|
.Dt FILE 1 "Copyright but distributable"
|
||||||
.Os
|
.Os
|
||||||
.Sh NAME
|
.Sh NAME
|
||||||
@ -8,7 +8,7 @@
|
|||||||
.Nd determine file type
|
.Nd determine file type
|
||||||
.Sh SYNOPSIS
|
.Sh SYNOPSIS
|
||||||
.Nm
|
.Nm
|
||||||
.Op Fl bcikLnNprsvz
|
.Op Fl bchikLnNprsvz
|
||||||
.Op Fl f Ar namefile
|
.Op Fl f Ar namefile
|
||||||
.Op Fl F Ar separator
|
.Op Fl F Ar separator
|
||||||
.Op Fl m Ar magicfiles
|
.Op Fl m Ar magicfiles
|
||||||
@ -17,7 +17,7 @@
|
|||||||
.Fl C
|
.Fl C
|
||||||
.Op Fl m Ar magicfile
|
.Op Fl m Ar magicfile
|
||||||
.Sh DESCRIPTION
|
.Sh DESCRIPTION
|
||||||
This manual page documents version 4.12 of the
|
This manual page documents version 4.17 of the
|
||||||
.Nm
|
.Nm
|
||||||
utility which tests each argument in an attempt to classify it.
|
utility which tests each argument in an attempt to classify it.
|
||||||
There are three sets of tests, performed in this order:
|
There are three sets of tests, performed in this order:
|
||||||
@ -103,6 +103,13 @@ magic file
|
|||||||
or
|
or
|
||||||
.Pa /usr/share/misc/magic
|
.Pa /usr/share/misc/magic
|
||||||
if the compile file does not exist.
|
if the compile file does not exist.
|
||||||
|
In addition
|
||||||
|
.Nm
|
||||||
|
will look in
|
||||||
|
.Pa $HOME/.magic.mgc ,
|
||||||
|
or
|
||||||
|
.Pa $HOME/.magic
|
||||||
|
for magic entries.
|
||||||
.Pp
|
.Pp
|
||||||
If a file does not match any of the entries in the magic file,
|
If a file does not match any of the entries in the magic file,
|
||||||
it is examined to see if it seems to be a text file.
|
it is examined to see if it seems to be a text file.
|
||||||
@ -187,6 +194,13 @@ Use the specified string as the separator between the filename and the
|
|||||||
file result returned.
|
file result returned.
|
||||||
Defaults to
|
Defaults to
|
||||||
.Ql \&: .
|
.Ql \&: .
|
||||||
|
.It Fl h , -no-dereference
|
||||||
|
Causes symlinks not to be followed
|
||||||
|
(on systems that support symbolic links).
|
||||||
|
This is the default if the
|
||||||
|
environment variable
|
||||||
|
.Ev POSIXLY_CORRECT
|
||||||
|
is not defined.
|
||||||
.It Fl i , -mime
|
.It Fl i , -mime
|
||||||
Causes the file command to output mime type strings rather than the more
|
Causes the file command to output mime type strings rather than the more
|
||||||
traditional human readable ones.
|
traditional human readable ones.
|
||||||
@ -206,8 +220,11 @@ section, below).
|
|||||||
Do not stop at the first match, keep going.
|
Do not stop at the first match, keep going.
|
||||||
.It Fl L , -dereference
|
.It Fl L , -dereference
|
||||||
option causes symlinks to be followed, as the like-named option in
|
option causes symlinks to be followed, as the like-named option in
|
||||||
.Xr ls 1 .
|
.Xr ls 1
|
||||||
(on systems that support symbolic links).
|
(on systems that support symbolic links).
|
||||||
|
This is the default if the environment variable
|
||||||
|
.Ev POSIXLY_CORRECT
|
||||||
|
is defined.
|
||||||
.It Fl m , -magic-file Ar list
|
.It Fl m , -magic-file Ar list
|
||||||
Specify an alternate list of files containing magic numbers.
|
Specify an alternate list of files containing magic numbers.
|
||||||
This can be a single file, or a colon-separated list of files.
|
This can be a single file, or a colon-separated list of files.
|
||||||
@ -281,19 +298,35 @@ option is specified.
|
|||||||
Default list of magic numbers, used to output mime types when the
|
Default list of magic numbers, used to output mime types when the
|
||||||
.Fl i
|
.Fl i
|
||||||
option is specified.
|
option is specified.
|
||||||
.It Pa /etc/magic
|
|
||||||
Local additions to magic wisdom.
|
|
||||||
.El
|
.El
|
||||||
.Sh ENVIRONMENT
|
.Sh ENVIRONMENT
|
||||||
The environment variable
|
The environment variable
|
||||||
.Ev MAGIC
|
.Ev MAGIC
|
||||||
can be used to set the default magic number file name.
|
can be used to set the default magic number file name.
|
||||||
|
If that variable is set, then
|
||||||
|
.Nm
|
||||||
|
will not attempt to open
|
||||||
|
.Pa $HOME/.magic .
|
||||||
.Nm
|
.Nm
|
||||||
adds
|
adds
|
||||||
.Pa .mime
|
.Pa .mime
|
||||||
and/or
|
and/or
|
||||||
.Pa .mgc
|
.Pa .mgc
|
||||||
to the value of this variable as appropriate.
|
to the value of this variable as appropriate.
|
||||||
|
The environment variable
|
||||||
|
.Ev POSIXLY_CORRECT
|
||||||
|
controls (on systems that support symbolic links), if
|
||||||
|
.Nm
|
||||||
|
will attempt to follow symlinks or not.
|
||||||
|
If set, then
|
||||||
|
.Nm
|
||||||
|
follows symlink, otherwise it does not.
|
||||||
|
This is also controlled
|
||||||
|
by the
|
||||||
|
.Fl L
|
||||||
|
and
|
||||||
|
.Fl h
|
||||||
|
options.
|
||||||
.Sh SEE ALSO
|
.Sh SEE ALSO
|
||||||
.Xr hexdump 1 ,
|
.Xr hexdump 1 ,
|
||||||
.Xr od 1 ,
|
.Xr od 1 ,
|
||||||
|
@ -3,7 +3,7 @@
|
|||||||
.\"
|
.\"
|
||||||
.\" install as magic.4 on USG, magic.5 on V7 or Berkeley systems.
|
.\" install as magic.4 on USG, magic.5 on V7 or Berkeley systems.
|
||||||
.\"
|
.\"
|
||||||
.Dd September 12, 2003
|
.Dd February 19, 2006
|
||||||
.Dt MAGIC 5 "Public Domain"
|
.Dt MAGIC 5 "Public Domain"
|
||||||
.Os
|
.Os
|
||||||
.Sh NAME
|
.Sh NAME
|
||||||
@ -13,7 +13,7 @@
|
|||||||
This manual page documents the format of the magic file as
|
This manual page documents the format of the magic file as
|
||||||
used by the
|
used by the
|
||||||
.Nm
|
.Nm
|
||||||
command, version 4.12.
|
command, version 4.17.
|
||||||
The
|
The
|
||||||
.Nm file
|
.Nm file
|
||||||
command identifies the type of a file using,
|
command identifies the type of a file using,
|
||||||
@ -68,6 +68,12 @@ flag, specifies case insensitive matching: lowercase characters
|
|||||||
in the magic match both lower and upper case characters in the
|
in the magic match both lower and upper case characters in the
|
||||||
targer, whereas upper case characters in the magic, only much
|
targer, whereas upper case characters in the magic, only much
|
||||||
uppercase characters in the target.
|
uppercase characters in the target.
|
||||||
|
.It pstring
|
||||||
|
A pascal style string where the first byte is interpreted as the an
|
||||||
|
unsigned length.
|
||||||
|
The string is not
|
||||||
|
.Dv NUL
|
||||||
|
terminated.
|
||||||
.It date
|
.It date
|
||||||
A four-byte value interpreted as a
|
A four-byte value interpreted as a
|
||||||
.Ux
|
.Ux
|
||||||
@ -86,6 +92,14 @@ A four-byte value (on most systems) in big-endian byte order,
|
|||||||
interpreted as a
|
interpreted as a
|
||||||
.Ux
|
.Ux
|
||||||
date.
|
date.
|
||||||
|
.It beldate
|
||||||
|
A four-byte value (on most systems) in big-endian byte order,
|
||||||
|
interpreted as a
|
||||||
|
.Ux Ns -style
|
||||||
|
date, but interpreted as local time rather
|
||||||
|
than UTC.
|
||||||
|
.It bestring16
|
||||||
|
A two-byte unicode (UCS16) string in big-endian byte order.
|
||||||
.It leshort
|
.It leshort
|
||||||
A two-byte value (on most systems) in little-endian byte order.
|
A two-byte value (on most systems) in little-endian byte order.
|
||||||
.It lelong
|
.It lelong
|
||||||
@ -101,6 +115,50 @@ interpreted as a
|
|||||||
.Ux Ns -style
|
.Ux Ns -style
|
||||||
date, but interpreted as local time rather
|
date, but interpreted as local time rather
|
||||||
than UTC.
|
than UTC.
|
||||||
|
.It lestring16
|
||||||
|
A two-byte unicode (UCS16) string in little-endian byte order.
|
||||||
|
.It melong
|
||||||
|
A four-byte value (on most systems) in middle-endian (PDP-11) byte order.
|
||||||
|
.It medate
|
||||||
|
A four-byte value (on most systems) in middle-endian (PDP-11) byte order,
|
||||||
|
interpreted as a
|
||||||
|
.Ux
|
||||||
|
date.
|
||||||
|
.It meldate
|
||||||
|
A four-byte value (on most systems) in middle-endian (PDP-11) byte order,
|
||||||
|
interpreted as a
|
||||||
|
.Ux Ns -style
|
||||||
|
date, but interpreted as local time rather
|
||||||
|
than UTC.
|
||||||
|
.It regex
|
||||||
|
A regular expression match in extended
|
||||||
|
.Tn POSIX
|
||||||
|
regular expression syntax
|
||||||
|
(much like egrep).
|
||||||
|
The type specification can be optionally followed by
|
||||||
|
.Ql /c
|
||||||
|
for case-insensitive matches.
|
||||||
|
The regular expression is always
|
||||||
|
tested against the first
|
||||||
|
.Ar N
|
||||||
|
lines, where
|
||||||
|
.Ar N
|
||||||
|
is the given offset, thus it
|
||||||
|
is only useful for (single-byte encoded) text.
|
||||||
|
.Ql ^
|
||||||
|
and
|
||||||
|
.Ql $
|
||||||
|
will match the beginning and end of individual lines, respectively,
|
||||||
|
not beginning and end of file.
|
||||||
|
.It search
|
||||||
|
A literal string search starting at the given offset.
|
||||||
|
It must be followed by
|
||||||
|
.Li / Ns Aq Ar number
|
||||||
|
which specifies how many matches shall be attempted (the range).
|
||||||
|
This is suitable for searching larger binary expressions with variable
|
||||||
|
offsets, using
|
||||||
|
.Ql \e
|
||||||
|
escapes for special characters.
|
||||||
.El
|
.El
|
||||||
.El
|
.El
|
||||||
.Pp
|
.Pp
|
||||||
@ -137,11 +195,22 @@ that are set in the specified value,
|
|||||||
.Em ^ ,
|
.Em ^ ,
|
||||||
to specify that the value from the file must have clear any of the bits
|
to specify that the value from the file must have clear any of the bits
|
||||||
that are set in the specified value, or
|
that are set in the specified value, or
|
||||||
|
.Em ~ ,
|
||||||
|
the value specified after is negated before tested, or
|
||||||
.Em x ,
|
.Em x ,
|
||||||
to specify that any value will match.
|
to specify that any value will match.
|
||||||
If the character is omitted,
|
If the character is omitted,
|
||||||
it is assumed to be
|
it is assumed to be
|
||||||
.Em = .
|
.Em = .
|
||||||
|
For all tests except
|
||||||
|
.Dq string
|
||||||
|
and
|
||||||
|
.Dq regex ,
|
||||||
|
operation
|
||||||
|
.Em !\&
|
||||||
|
specifies that the line matches if the test does
|
||||||
|
.Em not
|
||||||
|
succeed.
|
||||||
.It ""
|
.It ""
|
||||||
Numeric values are specified in C form; e.g.\&
|
Numeric values are specified in C form; e.g.\&
|
||||||
.Em 13
|
.Em 13
|
||||||
@ -177,29 +246,35 @@ performed) is printed using the message as the format string.
|
|||||||
.El
|
.El
|
||||||
.Pp
|
.Pp
|
||||||
Some file formats contain additional information which is to be printed
|
Some file formats contain additional information which is to be printed
|
||||||
along with the file type.
|
along with the file type or need additional tests to determine the true
|
||||||
A line which begins with the character
|
file type.
|
||||||
|
These additional tests are introduced by one or more
|
||||||
.Em >
|
.Em >
|
||||||
indicates additional tests and messages to be printed.
|
characters preceding the offset.
|
||||||
The number of
|
The number of
|
||||||
.Em >
|
.Em >
|
||||||
on the line indicates the level of the test; a line with no
|
on the line indicates the level of the test; a line with no
|
||||||
.Em >
|
.Em >
|
||||||
at the beginning is considered to be at level 0.
|
at the beginning is considered to be at level 0.
|
||||||
Each line at level
|
Tests are arranged in a tree-like hierarchy:
|
||||||
|
If a the test on a line at level
|
||||||
|
.Em n
|
||||||
|
succeeds, all following tests at level
|
||||||
.Em n+1
|
.Em n+1
|
||||||
is under the control of the line at level
|
are performed, and the messages printed if the tests succeed, until a line
|
||||||
|
with level
|
||||||
.Em n
|
.Em n
|
||||||
most closely preceding it in the magic file.
|
(or less) appears.
|
||||||
If the test on a line at level
|
For more complex files, one can use empty messages to get just the
|
||||||
.Em n
|
"if/then" effect, in the following way:
|
||||||
succeeds, the tests specified in all the subsequent lines at level
|
.Bd -literal -offset indent
|
||||||
.Em n+1
|
0 string MZ
|
||||||
are performed, and the messages printed if the tests succeed.
|
>0x18 leshort <0x40 MS-DOS executable
|
||||||
The next
|
>0x18 leshort >0x3f extended PC executable (e.g., MS Windows)
|
||||||
line at level
|
.Ed
|
||||||
.Em n
|
.Pp
|
||||||
terminates this.
|
Offsets do not need to be constant, but can also be read from the file
|
||||||
|
being examined.
|
||||||
If the first character following the last
|
If the first character following the last
|
||||||
.Em >
|
.Em >
|
||||||
is a
|
is a
|
||||||
@ -216,45 +291,133 @@ The value of
|
|||||||
is used as an offset in the file.
|
is used as an offset in the file.
|
||||||
A byte, short or long is read at that offset
|
A byte, short or long is read at that offset
|
||||||
depending on the
|
depending on the
|
||||||
.Em [bslBSL]
|
.Em [bslBSLm]
|
||||||
type specifier.
|
type specifier.
|
||||||
The capitalized types interpret the number as a big endian value, whereas
|
The capitalized types interpret the number as a big endian value, whereas
|
||||||
a small letter versions interpret the number as a little endian value.
|
a small letter versions interpret the number as a little endian value;
|
||||||
|
the
|
||||||
|
.Em m
|
||||||
|
type interprets the number as a middle endian (PDP-11) value.
|
||||||
To that number the value of
|
To that number the value of
|
||||||
.Em y
|
.Em y
|
||||||
is added and the result is used as an offset in the file.
|
is added and the result is used as an offset in the file.
|
||||||
The default type
|
The default type
|
||||||
if one is not specified is long.
|
if one is not specified is long.
|
||||||
.Pp
|
.Pp
|
||||||
Sometimes you do not know the exact offset as this depends on the length of
|
That way variable length structures can be examined:
|
||||||
preceding fields.
|
.Bd -literal -offset indent
|
||||||
You can specify an offset relative to the end of the
|
# MS Windows executables are also valid MS-DOS executables
|
||||||
last uplevel field (of course this may only be done for sublevel tests, i.e.\&
|
0 string MZ
|
||||||
test beginning with
|
>0x18 leshort <0x40 MZ executable (MS-DOS)
|
||||||
.Em > Ns ) .
|
# skip the whole block below if it is not an extended executable
|
||||||
Such a relative offset is specified using
|
>0x18 leshort >0x3f
|
||||||
|
>>(0x3c.l) string PE\e0\e0 PE executable (MS-Windows)
|
||||||
|
>>(0x3c.l) string LX\e0\e0 LX executable (OS/2)
|
||||||
|
.Ed
|
||||||
|
.Pp
|
||||||
|
This strategy of examining has one drawback: You must make sure that
|
||||||
|
you eventually print something, or users may get empty output (like, when
|
||||||
|
there is neither PE\e0\e0 nor LE\e0\e0 in the above example).
|
||||||
|
.Pp
|
||||||
|
If this indirect offset cannot be used as-is, there are simple calculations
|
||||||
|
possible: appending
|
||||||
|
.Em [+-*/%&|^]<number>
|
||||||
|
inside parentheses allows one to modify
|
||||||
|
the value read from the file before it is used as an offset:
|
||||||
|
.Bd -literal -offset indent
|
||||||
|
# MS Windows executables are also valid MS-DOS executables
|
||||||
|
0 string MZ
|
||||||
|
# sometimes, the value at 0x18 is less that 0x40 but there's still an
|
||||||
|
# extended executable, simply appended to the file
|
||||||
|
>0x18 leshort <0x40
|
||||||
|
>>(4.s*512) leshort 0x014c COFF executable (MS-DOS, DJGPP)
|
||||||
|
>>(4.s*512) leshort !0x014c MZ executable (MS-DOS)
|
||||||
|
.Ed
|
||||||
|
.Pp
|
||||||
|
Sometimes you do not know the exact offset as this depends on the length or
|
||||||
|
position (when indirection was used before) of preceding fields.
|
||||||
|
You can
|
||||||
|
specify an offset relative to the end of the last uplevel field using
|
||||||
.Em &
|
.Em &
|
||||||
as a prefix to the offset.
|
as a prefix to the offset:
|
||||||
|
.Bd -literal -offset indent
|
||||||
|
0 string MZ
|
||||||
|
>0x18 leshort >0x3f
|
||||||
|
>>(0x3c.l) string PE\e0\e0 PE executable (MS-Windows)
|
||||||
|
# immediately following the PE signature is the CPU type
|
||||||
|
>>>&0 leshort 0x14c for Intel 80386
|
||||||
|
>>>&0 leshort 0x184 for DEC Alpha
|
||||||
|
.Ed
|
||||||
|
.Pp
|
||||||
|
Indirect and relative offsets can be combined:
|
||||||
|
.Bd -literal -offset indent
|
||||||
|
0 string MZ
|
||||||
|
>0x18 leshort <0x40
|
||||||
|
>>(4.s*512) leshort !0x014c MZ executable (MS-DOS)
|
||||||
|
# if it's not COFF, go back 512 bytes and add the offset taken
|
||||||
|
# from byte 2/3, which is yet another way of finding the start
|
||||||
|
# of the extended executable
|
||||||
|
>>>&(2.s-514) string LE LE executable (MS Windows VxD driver)
|
||||||
|
.Ed
|
||||||
|
.Pp
|
||||||
|
Or the other way around:
|
||||||
|
.Bd -literal -offset indent
|
||||||
|
0 string MZ
|
||||||
|
>0x18 leshort >0x3f
|
||||||
|
>>(0x3c.l) string LE\e0\e0 LE executable (MS-Windows)
|
||||||
|
# at offset 0x80 (-4, since relative offsets start at the end
|
||||||
|
# of the uplevel match) inside the LE header, we find the absolute
|
||||||
|
# offset to the code area, where we look for a specific signature
|
||||||
|
>>>(&0x7c.l+0x26) string UPX \eb, UPX compressed
|
||||||
|
.Ed
|
||||||
|
.Pp
|
||||||
|
Or even both!
|
||||||
|
.Bd -literal -offset indent
|
||||||
|
0 string MZ
|
||||||
|
>0x18 leshort >0x3f
|
||||||
|
>>(0x3c.l) string LE\e0\e0 LE executable (MS-Windows)
|
||||||
|
# at offset 0x58 inside the LE header, we find the relative offset
|
||||||
|
# to a data area where we look for a specific signature
|
||||||
|
>>>&(&0x54.l-3) string UNACE \eb, ACE self-extracting archive
|
||||||
|
.Ed
|
||||||
|
.Pp
|
||||||
|
Finally, if you have to deal with offset/length pairs in your file, even the
|
||||||
|
second value in a parenthesed expression can be taken from the file itself,
|
||||||
|
using another set of parentheses.
|
||||||
|
Note that this additional indirect offset
|
||||||
|
is always relative to the start of the main indirect offset.
|
||||||
|
.Bd -literal -offset indent
|
||||||
|
0 string MZ
|
||||||
|
>0x18 leshort >0x3f
|
||||||
|
>>(0x3c.l) string PE\e0\e0 PE executable (MS-Windows)
|
||||||
|
# search for the PE section called ".idata"...
|
||||||
|
>>>&0xf4 search/0x140 .idata
|
||||||
|
# ...and go to the end of it, calculated from start+length;
|
||||||
|
# these are located 14 and 10 bytes after the section name
|
||||||
|
>>>>(&0xe.l+(-4)) string PK\e3\e4 \eb, ZIP self-extracting archive
|
||||||
|
.Ed
|
||||||
.Sh BUGS
|
.Sh BUGS
|
||||||
The formats
|
The formats
|
||||||
.Em long ,
|
.Em long ,
|
||||||
.Em belong ,
|
.Em belong ,
|
||||||
.Em lelong ,
|
.Em lelong ,
|
||||||
|
.Em melong ,
|
||||||
.Em short ,
|
.Em short ,
|
||||||
.Em beshort ,
|
.Em beshort ,
|
||||||
.Em leshort ,
|
.Em leshort ,
|
||||||
.Em date ,
|
.Em date ,
|
||||||
.Em bedate ,
|
.Em bedate ,
|
||||||
|
.Em medate ,
|
||||||
|
.Em ledate ,
|
||||||
|
.Em beldate ,
|
||||||
|
.Em leldate ,
|
||||||
and
|
and
|
||||||
.Em ledate
|
.Em meldate
|
||||||
are system-dependent; perhaps they should be specified as a number
|
are system-dependent; perhaps they should be specified as a number
|
||||||
of bytes (2B, 4B, etc),
|
of bytes (2B, 4B, etc),
|
||||||
since the files being recognized typically come from
|
since the files being recognized typically come from
|
||||||
a system on which the lengths are invariant.
|
a system on which the lengths are invariant.
|
||||||
.Pp
|
.Pp
|
||||||
There is (currently) no support for specified-endian data to be used in
|
|
||||||
indirect offsets.
|
|
||||||
.Pp
|
|
||||||
If
|
If
|
||||||
.Pa /usr/share/misc/magic
|
.Pa /usr/share/misc/magic
|
||||||
is newer than
|
is newer than
|
||||||
@ -264,7 +427,7 @@ Use the command:
|
|||||||
.Po
|
.Po
|
||||||
cd /usr/share/misc &&
|
cd /usr/share/misc &&
|
||||||
.Nm file
|
.Nm file
|
||||||
.Fl C
|
.Fl C
|
||||||
.Fl m Ar magic
|
.Fl m Ar magic
|
||||||
.Pc
|
.Pc
|
||||||
to rebuild.
|
to rebuild.
|
||||||
@ -283,4 +446,4 @@ to rebuild.
|
|||||||
.\" the changes I posted to the S5R2 version.
|
.\" the changes I posted to the S5R2 version.
|
||||||
.\"
|
.\"
|
||||||
.\" Modified for Ian Darwin's version of the file command.
|
.\" Modified for Ian Darwin's version of the file command.
|
||||||
.\" @(#)$Id: magic.man,v 1.27 2003/09/12 19:43:30 christos Exp $
|
.\" @(#)$Id: magic.man,v 1.30 2006/02/19 18:16:03 christos Exp $
|
||||||
|
Loading…
Reference in New Issue
Block a user