d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Vendor import of file 5.42.

Browse Source
This commit is contained in:
Xin LI 2022-07-03 17:05:11 -07:00
parent 048bd4094f
commit ba49e6371b
88 changed files with 5435 additions and 1972 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
ChangeLog
View File

@ -1,3 +1,40 @@
2022-06-10 9:40 Christos Zoulas <christos@zoulas.com>
* release 5.42
2022-05-31 14:50 Christos Zoulas <christos@zoulas.com>
* PR/348: add missing cases to prevent file from aborting on
random magic files.
2022-05-27 21:05 Christos Zoulas <christos@zoulas.com>
* PR/351: octalify filenames when not raw before printing.
2022-04-18 17:51 Christos Zoulas <christos@zoulas.com>
* fix regex cacheing bug (Dirk Mueller)
* merge file_regcomp and file_regerror() to simplify the code
and reduce memory requirements for storing regexes (Dirk Mueller)
2022-03-19 12:56 Christos Zoulas <christos@zoulas.com>
* cache regex (Dirk Mueller)
* detect filesystem full by flushing output (Dirk Mueller)
2021-11-19 12:36 Christos Zoulas <christos@zoulas.com>
* implement running decompressor programs using
posix_spawnp(2) instead of vfork(2)
2021-10-24 11:51 Christos Zoulas <christos@zoulas.com>
* Add support for msdos dates and times
2021-10-20 9:55 Christos Zoulas <christos@zoulas.com>
* use the system byte swapping functions if available (Werner Fink)
2021-10-18 11:57 Christos Zoulas <christos@zoulas.com>
* release 5.41

3
Makefile.am
View File

@ -1,6 +1,7 @@
ACLOCAL_AMFLAGS = -I m4
EXTRA_DIST = MAINT RELEASE-PROCEDURE README.DEVELOPER m4/visibility.m4
EXTRA_DIST = MAINT RELEASE-PROCEDURE README.DEVELOPER README.md \
m4/visibility.m4
SUBDIRS = src magic tests doc python

8
Makefile.in
View File

@ -192,8 +192,8 @@ CSCOPE = cscope
DIST_SUBDIRS = $(SUBDIRS)
am__DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/config.h.in \
$(srcdir)/libmagic.pc.in AUTHORS COPYING ChangeLog INSTALL \
NEWS TODO compile config.guess config.sub depcomp install-sh \
ltmain.sh missing
NEWS TODO compile config.guess config.sub install-sh ltmain.sh \
missing
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
distdir = $(PACKAGE)-$(VERSION)
top_distdir = $(distdir)
@ -358,7 +358,9 @@ top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
ACLOCAL_AMFLAGS = -I m4
EXTRA_DIST = MAINT RELEASE-PROCEDURE README.DEVELOPER m4/visibility.m4
EXTRA_DIST = MAINT RELEASE-PROCEDURE README.DEVELOPER README.md \
m4/visibility.m4
SUBDIRS = src magic tests doc python
# This variable must have 'exec' in its name, in order to be installed

155
README.md Normal file
View File

@ -0,0 +1,155 @@
## README for file(1) Command and the libmagic(3) library ##
@(#) $File: README.md,v 1.4 2021/10/21 01:51:31 christos Exp $
- Bug Tracker: <https://bugs.astron.com/>
- Build Status: <https://travis-ci.org/file/file>
- Download link: <ftp://ftp.astron.com/pub/file/>
- E-mail: <christos@astron.com>
- Fuzzing link: <https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:file>
- Home page: https://www.darwinsys.com/file/
- Mailing List archives: <https://mailman.astron.com/pipermail/file/>
- Mailing List: <file@astron.com>
- Public repo: <https://github.com/file/file>
- Test framework: <https://github.com/file/file-tests>
Phone: Do not even think of telephoning me about this program. Send
cash first!
This is Release 5.x of Ian Darwin's (copyright but distributable)
file(1) command, an implementation of the Unix File(1) command.
It knows the 'magic number' of several thousands of file types.
This version is the standard "file" command for Linux, *BSD, and
other systems. (See "patchlevel.h" for the exact release number).
The major changes for 5.x are CDF file parsing, indirect magic,
name/use (recursion) and overhaul in mime and ascii encoding
handling.
The major feature of 4.x is the refactoring of the code into a
library, and the re-write of the file command in terms of that
library. The library itself, libmagic can be used by 3rd party
programs that wish to identify file types without having to fork()
and exec() file. The prime contributor for 4.0 was Mans Rullgard.
UNIX is a trademark of UNIX System Laboratories.
The prime contributor to Release 3.8 was Guy Harris, who put in
megachanges including byte-order independence.
The prime contributor to Release 3.0 was Christos Zoulas, who put
in hundreds of lines of source code changes, including his own
ANSIfication of the code (I liked my own ANSIfication better, but
his (__P()) is the "Berkeley standard" way of doing it, and I wanted
UCB to include the code...), his HP-like "indirection" (a feature
of the HP file command, I think), and his mods that finally got
the uncompress (-z) mode finished and working.
This release has compiled in numerous environments; see PORTING
for a list and problems.
This fine freeware file(1) follows the USG (System V) model of the
file command, rather than the Research (V7) version or the V7-derived
4.[23] Berkeley one. That is, the file /etc/magic contains much of
the ritual information that is the source of this program's power.
My version knows a little more magic (including tar archives) than
System V; the /etc/magic parsing seems to be compatible with the
(poorly documented) System V /etc/magic format (with one exception;
see the man page).
In addition, the /etc/magic file is built from a subdirectory
for easier(?) maintenance. I will act as a clearinghouse for
magic numbers assigned to all sorts of data files that
are in reasonable circulation. Send your magic numbers,
in magic(5) format please, to the maintainer, Christos Zoulas.
COPYING - read this first.
* `README` - read this second (you are currently reading this file).
* `INSTALL` - read on how to install
* `src/apprentice.c` - parses /etc/magic to learn magic
* `src/apptype.c` - used for OS/2 specific application type magic
* `src/ascmagic.c` - third & last set of tests, based on hardwired assumptions.
* `src/asctime_r.c` - replacement for OS's that don't have it.
* `src/asprintf.c` - replacement for OS's that don't have it.
* `src/buffer.c` - buffer handling functions.
* `src/cdf.[ch]` - parser for Microsoft Compound Document Files
* `src/cdf_time.c` - time converter for CDF.
* `src/compress.c` - handles decompressing files to look inside.
* `src/ctime_r.c` - replacement for OS's that don't have it.
* `src/der.[ch]` - parser for Distinguished Encoding Rules
* `src/dprintf.c` - replacement for OS's that don't have it.
* `src/elfclass.h` - common code for elf 32/64.
* `src/encoding.c` - handles unicode encodings
* `src/file.c` - the main program
* `src/file.h` - header file
* `src/file_opts.h` - list of options
* `src/fmtcheck.c` - replacement for OS's that don't have it.
* `src/fsmagic.c` - first set of tests the program runs, based on filesystem info
* `src/funcs.c` - utilility functions
* `src/getline.c` - replacement for OS's that don't have it.
* `src/getopt_long.c` - replacement for OS's that don't have it.
* `src/gmtime_r.c` - replacement for OS's that don't have it.
* `src/is_csv.c` - knows about Comma Separated Value file format (RFC 4180).
* `src/is_json.c` - knows about JavaScript Object Notation format (RFC 8259).
* `src/is_tar.c, tar.h` - knows about Tape ARchive format (courtesy John Gilmore).
* `src/localtime_r.c` - replacement for OS's that don't have it.
* `src/magic.h.in` - source file for magic.h
* `src/mygetopt.h` - replacement for OS's that don't have it.
* `src/magic.c` - the libmagic api
* `src/names.h` - header file for ascmagic.c
* `src/pread.c` - replacement for OS's that don't have it.
* `src/print.c` - print results, errors, warnings.
* `src/readcdf.c` - CDF wrapper.
* `src/readelf.[ch]` - Stand-alone elf parsing code.
* `src/softmagic.c` - 2nd set of tests, based on /etc/magic
* `src/mygetopt.h` - replacement for OS's that don't have it.
* `src/strcasestr.c` - replacement for OS's that don't have it.
* `src/strlcat.c` - replacement for OS's that don't have it.
* `src/strlcpy.c` - replacement for OS's that don't have it.
* `src/strndup.c` - replacement for OS's that don't have it.
* `src/tar.h` - tar file definitions
* `src/vasprintf.c` - for systems that don't have it.
* `doc/file.man` - man page for the command
* `doc/magic.man` - man page for the magic file, courtesy Guy Harris.
Install as magic.4 on USG and magic.5 on V7 or Berkeley; cf Makefile.
Magdir - directory of /etc/magic pieces
------------------------------------------------------------------------------
If you submit a new magic entry please make sure you read the following
guidelines:
- Initial match is preferably at least 32 bits long, and is a _unique_ match
- If this is not feasible, use additional check
- Match of <= 16 bits are not accepted
- Delay printing string as much as possible, don't print output too early
- Avoid printf arbitrary byte as string, which can be a source of
crash and buffer overflow
- Provide complete information with entry:
* One line short summary
* Optional long description
* File extension, if applicable
* Full name and contact method (for discussion when entry has problem)
* Further reference, such as documentation of format
gpg for dummies:
------------------------------------------------------------------------------
```
$ gpg --verify file-X.YY.tar.gz.asc file-X.YY.tar.gz
gpg: assuming signed data in `file-X.YY.tar.gz'
gpg: Signature made WWW MMM DD HH:MM:SS YYYY ZZZ using DSA key ID KKKKKKKK
```
To download the key:
```
$ gpg --keyserver hkp://keys.gnupg.net --recv-keys KKKKKKKK
```
------------------------------------------------------------------------------
Parts of this software were developed at SoftQuad Inc., developers
of SGML/HTML/XML publishing software, in Toronto, Canada.
SoftQuad was swallowed up by Corel in 2002 and does not exist any longer.

15
config.h.in
View File

@ -18,6 +18,9 @@
/* Define to 1 if you have the `asprintf' function. */
#undef HAVE_ASPRINTF
/* Define to 1 if you have the <byteswap.h> header file. */
#undef HAVE_BYTESWAP_H
/* Define to 1 if you have the <bzlib.h> header file. */
#undef HAVE_BZLIB_H
@ -128,12 +131,18 @@
/* Define to 1 if you have the `pipe2' function. */
#undef HAVE_PIPE2
/* Define to 1 if you have the `posix_spawnp' function. */
#undef HAVE_POSIX_SPAWNP
/* Define to 1 if you have the `pread' function. */
#undef HAVE_PREAD
/* Have sig_t type */
#undef HAVE_SIG_T
/* Define to 1 if you have the <spawn.h> header file. */
#undef HAVE_SPAWN_H
/* Define to 1 if you have the <stdint.h> header file. */
#undef HAVE_STDINT_H
@ -173,6 +182,12 @@
/* Define to 1 if `tm_zone' is a member of `struct tm'. */
#undef HAVE_STRUCT_TM_TM_ZONE
/* Define to 1 if you have the <sys/bswap.h> header file. */
#undef HAVE_SYS_BSWAP_H
/* Define to 1 if you have the <sys/ioctl.h> header file. */
#undef HAVE_SYS_IOCTL_H
/* Define to 1 if you have the <sys/mman.h> header file. */
#undef HAVE_SYS_MMAN_H

28
configure vendored
View File

@ -1,6 +1,6 @@
#! /bin/sh
# Guess values for system-dependent variables and create Makefiles.
# Generated by GNU Autoconf 2.69 for file 5.41.
# Generated by GNU Autoconf 2.69 for file 5.42.
#
# Report bugs to <christos@astron.com>.
#
@ -590,8 +590,8 @@ MAKEFLAGS=
# Identity of this package.
PACKAGE_NAME='file'
PACKAGE_TARNAME='file'
PACKAGE_VERSION='5.41'
PACKAGE_STRING='file 5.41'
PACKAGE_VERSION='5.42'
PACKAGE_STRING='file 5.42'
PACKAGE_BUGREPORT='christos@astron.com'
PACKAGE_URL=''
@ -1334,7 +1334,7 @@ if test "$ac_init_help" = "long"; then
# Omit some internal or obsolete options to make the list less imposing.
# This message is too long to be a string in the A/UX 3.1 sh.
cat <<_ACEOF
\`configure' configures file 5.41 to adapt to many kinds of systems.
\`configure' configures file 5.42 to adapt to many kinds of systems.
Usage: $0 [OPTION]... [VAR=VALUE]...
@ -1404,7 +1404,7 @@ fi
if test -n "$ac_init_help"; then
case $ac_init_help in
short | recursive ) echo "Configuration of file 5.41:";;
short | recursive ) echo "Configuration of file 5.42:";;
esac
cat <<\_ACEOF
@ -1524,7 +1524,7 @@ fi
test -n "$ac_init_help" && exit $ac_status
if $ac_init_version; then
cat <<\_ACEOF
file configure 5.41
file configure 5.42
generated by GNU Autoconf 2.69
Copyright (C) 2012 Free Software Foundation, Inc.
@ -2180,7 +2180,7 @@ cat >config.log <<_ACEOF
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
It was created by file $as_me 5.41, which was
It was created by file $as_me 5.42, which was
generated by GNU Autoconf 2.69. Invocation command line was
$ $0 $@
@ -3046,7 +3046,7 @@ fi
# Define the identity of the package.
PACKAGE='file'
VERSION='5.41'
VERSION='5.42'
cat >>confdefs.h <<_ACEOF
@ -12900,7 +12900,7 @@ $as_echo "#define HAVE_SYS_WAIT_H 1" >>confdefs.h
fi
for ac_header in stdint.h fcntl.h inttypes.h unistd.h
for ac_header in stdint.h fcntl.h inttypes.h unistd.h byteswap.h
do :
as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
@ -12913,7 +12913,7 @@ fi
done
for ac_header in utime.h wchar.h wctype.h
for ac_header in spawn.h utime.h wchar.h wctype.h
do :
as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
@ -12939,7 +12939,7 @@ fi
done
for ac_header in sys/mman.h sys/stat.h sys/types.h sys/utime.h sys/time.h sys/sysmacros.h
for ac_header in sys/bswap.h sys/mman.h sys/stat.h sys/types.h sys/utime.h sys/time.h sys/sysmacros.h sys/ioctl.h
do :
as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
@ -14290,7 +14290,7 @@ fi
fi
for ac_func in strndup mkstemp mkostemp utimes utime wcwidth strtof newlocale uselocale freelocale memmem pipe2
for ac_func in strndup mkstemp mkostemp utimes utime wcwidth strtof newlocale uselocale freelocale memmem pipe2 posix_spawnp
do :
as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
@ -15310,7 +15310,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
# report actual input values of CONFIG_FILES etc. instead of their
# values after options handling.
ac_log="
This file was extended by file $as_me 5.41, which was
This file was extended by file $as_me 5.42, which was
generated by GNU Autoconf 2.69. Invocation command line was
CONFIG_FILES = $CONFIG_FILES
@ -15376,7 +15376,7 @@ _ACEOF
cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
ac_cs_version="\\
file config.status 5.41
file config.status 5.42
configured by $0, generated by GNU Autoconf 2.69,
with options \\"\$ac_cs_config\\"

10
configure.ac
View File

@ -1,5 +1,5 @@
dnl Process this file with autoconf to produce a configure script.
AC_INIT([file],[5.41],[christos@astron.com])
AC_INIT([file],[5.42],[christos@astron.com])
AM_INIT_AUTOMAKE([subdir-objects foreign])
m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
@ -99,10 +99,10 @@ gl_VISIBILITY
dnl Checks for headers
AC_HEADER_MAJOR
AC_HEADER_SYS_WAIT
AC_CHECK_HEADERS(stdint.h fcntl.h inttypes.h unistd.h)
AC_CHECK_HEADERS(utime.h wchar.h wctype.h)
AC_CHECK_HEADERS(stdint.h fcntl.h inttypes.h unistd.h byteswap.h)
AC_CHECK_HEADERS(spawn.h utime.h wchar.h wctype.h)
AC_CHECK_HEADERS(getopt.h err.h xlocale.h)
AC_CHECK_HEADERS(sys/mman.h sys/stat.h sys/types.h sys/utime.h sys/time.h sys/sysmacros.h)
AC_CHECK_HEADERS(sys/bswap.h sys/mman.h sys/stat.h sys/types.h sys/utime.h sys/time.h sys/sysmacros.h sys/ioctl.h)
if test "$enable_zlib" != "no"; then
AC_CHECK_HEADERS(zlib.h)
fi
@ -165,7 +165,7 @@ else
fi])
dnl Checks for functions
AC_CHECK_FUNCS(strndup mkstemp mkostemp utimes utime wcwidth strtof newlocale uselocale freelocale memmem pipe2)
AC_CHECK_FUNCS(strndup mkstemp mkostemp utimes utime wcwidth strtof newlocale uselocale freelocale memmem pipe2 posix_spawnp)
dnl Provide implementation of some required functions if necessary
AC_REPLACE_FUNCS(getopt_long asprintf vasprintf strlcpy strlcat getline ctime_r asctime_r localtime_r gmtime_r pread strcasestr fmtcheck dprintf)

3
magic/Magdir/animation
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: animation,v 1.87 2021/08/24 09:25:11 christos Exp $
# $File: animation,v 1.88 2022/05/14 22:06:04 christos Exp $
# animation: file(1) magic for animation/movie formats
#
# animation formats
@ -940,6 +940,7 @@
# DIF digital video file format <mpruett@sgi.com>
0 belong&0xffffff00 0x1f070000 DIF
!:mime video/x-dv
>4 byte &0x01 (DVCPRO) movie file
>4 byte ^0x01 (DV) movie file
>3 byte &0x80 (PAL)

315
magic/Magdir/archive
View File

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: archive,v 1.151 2021/08/16 10:19:56 christos Exp $
# $File: archive,v 1.162 2022/05/27 21:27:59 christos Exp $
# archive: file(1) magic for archive formats (see also "msdos" for self-
# extracting compressed archives)
#
@ -150,7 +150,7 @@
# Incremental snapshot gnu-tar format from:
# https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
0 string GNU\ tar- GNU tar incremental snapshot data
>&0 regex [0-9]\.[0-9]+-[0-9]+ version %s
>&0 regex [0-9]\\.[0-9]+-[0-9]+ version %s
# cpio archives
#
@ -518,46 +518,65 @@
#>-3 ubyte x \b, last 3 bytes 0x%2.2x
#>-2 ubeshort x \b%4.4x
# From: Joerg Jenderek
# URL: https://wiki.68kmla.org/DiskCopy_4.2_format_specification
# URL: https://en.wikipedia.org/wiki/Disk_Copy
# reference: http://nulib.com/library/FTN.e00005.htm
0x52 ubeshort 0x0100
# test for disk image size equal or above 400k
>0x40 ubelong >409599
# test also for disk image size equal or below 1440k to skip
# windows7en.mbr UNICODE.DAT
>>0x40 ubelong <1474561
# To skip Flags$StringJoiner.class with size 00106A61h test also for only 4 disk image sizes
# 00064000 for 400k GCR disks
# 000c8000 for 800k GCR disks
# 000b4000 for 720k MFM disks
# 00168000 for 1440k MFM disks
>>>0x40 ubelong&0xffE03fFF 0
>>>>0 use dc42-floppy
#>>0x40 ubelong <1474561
# test now for "low" disk image size equal or below 64 MiB to skip
# windows7en.mbr (B441BBAAh) UNICODE.DAT (0400AF05h)
>>0x40 ubelong <0x04000001
# To skip Flags$StringJoiner.class with size 00106A61h test also for valid disk image sizes
# 00064000 for 400k GCR disks dc42-400k-gcr.trid.xml
# 000c8000 for 800k GCR disks dc42-800k-gcr.trid.xml
# 000b4000 for 720k MFM disks dc42-720k-mfm.trid.xml
# 00168000 for 1440k MFM disks dc42-1440k-mfm.trid.xml
# https://lisaem.sunder.net/LisaProjectDocs.txt
# 00500000 05M available
# 00A00000 10M available
# 01800000 24M possible
# 02000000 32M uncertain
# 04000000 64M uncertain
>>>0x40 ubelong&0xf8003fFF 0
# skip samples with invalid disk name length like:
# 181 (biosmd80.rom) 202 (Flags$StringJoiner.class) 90 (UNICODE.DAT)
>>>>0x0 ubyte <64
>>>>>0 use dc42-floppy
# display information of Apple DiskCopy 4.2 floppy image
0 name dc42-floppy
# image pascal name padded with NULs like Microsoft Mail
# disk name length; maximal 63
#>0 ubyte x DISK NAME LENGTH %u
# ASCII image pascal (maximal 63 bytes) name padded with NULs like:
# "Microsoft Mail" "Disquette 2" "IIe Installer Disk"
# "-lisaem.sunder.net hd-" (dc42-lisaem.trid.xml) "-not a Macintosh disk" (dc42-nonmac.trid.xml)
>00 pstring/B x Apple DiskCopy 4.2 image %s
#!:mime application/octet-stream
!:mime application/x-dc42-floppy-image
!:apple dCpydImg
!:ext image/dc42
# data size in bytes like 409600
# probably also img like: "Utilitaires 2.img" "Installation 7.img"
!:ext image/dc42/img
# data size in bytes like: 409600 737280 819200 1474560
>0x40 ubelong x \b, %u bytes
# for debugging purpose size in hexadecimal
#>0x40 ubelong x (%#8.8x)
# tag size in bytes
# tag size in bytes like: 0 (often) 2580h (PUID fmt/625) 4B00h (Microsoft Mail.image)
>0x44 ubelong >0 \b, %#x tag size
# data checksum
#>0x48 ubelong x \b, %#x checksum
# tag checksum
#>0x4c ubelong x \b, %#x tag checksum
# disk encoding
# disk encoding like: 0 1 2 3 (PUID: fmt/625)
>0x50 ubyte 0 \b, GCR CLV ssdd (400k)
>0x50 ubyte 1 \b, GCR CLV dsdd (800k)
>0x50 ubyte 2 \b, MFM CAV dsdd (720k)
>0x50 ubyte 3 \b, MFM CAV dshd (1440k)
>0x50 ubyte >3 \b, %#x encoding
# format byte
# format byte like: 12h (Lisa 400K) 24h (400K Macintosh) 96h (800K Apple II disk)
# 2 (Mac 400k "Disquette Installation 13.image")
# 22h (double-sided MFM or Mac 800k "Disco 12.image" "IIe Installer Disk.image")
>0x51 ubyte x \b, %#x format
#>0x54 ubequad x \b, data %#16.16llx
# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
@ -670,7 +689,15 @@
# 2 bytes: length of data + mentioned bytes
#
# SZDD variant Haruhiko Okumura's LZSS or 7z type MsLZ
# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression
# Reference: http://www.cabextract.org.uk/libmspack/doc/szdd_kwaj_format.html
# http://mark0.net/download/triddefs_xml.7z/defs/s/szdd.trid.xml
# Note: called "Microsoft SZDD compressed (Haruhiko Okumura's LZSS)" by TrID
# verfied by 7-Zip `7z l -tMsLZ -slt *.??_` as MsLZ
# `deark -l -m lzss_oku -d2 setup-1-41.bin` as "LZSS.C by Haruhiko Okumura"
>0 string SZDD MS Compress archive data, SZDD variant
# 2nd part of signature
#>>4 ubelong 0x88F02733 \b, SIGNATURE OK
!:mime application/x-ms-compress-szdd
!:ext ??_
# The character missing from the end of the filename (0=unknown)
@ -679,6 +706,24 @@
# Compression mode: "A" (0x41) found but sometimes "B" in Windows 3.1 builds 026 and 034e
>>8 string !A \b, %-.1s method
>>10 ulelong >0 \b, original size: %u bytes
# Summary: InstallShield archive with SZDD compressed
# URL: https://community.flexera.com/t5/InstallShield-Knowledge-Base/InstallShield-Redistributable-Files/ta-p/5647
# From: Joerg Jenderek
1 search/48/bs SZDD\x88\xF0\x27\x33 InstallShield archive
#!:mime application/octet-stream
!:mime application/x-installshield-compress-szdd
!:ext ibt
# name of compressed archive member like: setup.dl_ _setup7int.dl_ _setup2k.dl_ _igdi.dl_ cabinet.dl_
>0 string x %s
# name of uncompressed archive member like: setup.dll _Setup.dll IGdi.dll CABINET.DLL
>>&1 string x (%s)
# probably version like: 9.0.0.333 9.1.0.429 11.50.0.42618
>>>&1 string x \b, version %s
# SZDD member length like: 168048 169333 181842
>>>>&1 string x \b, %s bytes
# MS Compress archive data
#>&0 string SZDD \b, SIGNATURE FOUND
>&0 indirect x
# QBasic SZDD variant
3 string \x88\xf0\x27
>0 string SZ\x20 MS Compress archive data, QBasic variant
@ -686,6 +731,17 @@
!:ext ??$
>>8 ulelong >0 \b, original size: %u bytes
# Summary: CAZIP compressed file
# From: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/CAZIP
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/caz.trid.xml
# Note: Format is distinct from CAZIPXP compressed
0 string \x0D\x0A\x1ACAZIP CAZIP compressed file
#!:mime application/octet-stream
!:mime application/x-compress-cazip
# like: BLINKER.WR_ CLIPDEFS._ CAOSETUP.EX_ CLIPPER.EX_ FILEIO.C_
!:ext ??_/?_/_
# Summary: FTCOMP compressed archive
# From: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/FTCOMP
@ -772,13 +828,43 @@
0 string NSK NaShrink archive data
# SAPCAR
0 string #\ CAR\ archive\ header SAPCAR archive data
0 string CAR\ 2.00RG SAPCAR archive data
0 string CAR\ 2.00 SAPCAR archive data
0 string CAR\ 2.01 SAPCAR archive data
#!:mime application/octet-stream
!:mime application/vnd.sar
!:ext sar
# Disintegrator
0 string DST Disintegrator archive data
# ASD
0 string ASD ASD archive data
# InstallShield CAB
0 string ISc( InstallShield CAB
# Update: Joerg Jenderek at Nov 2021
# URL: https://en.wikipedia.org/wiki/InstallShield
# Reference: https://github.com/twogood/unshield/blob/master/lib/cabfile.h
# Note: Not compatible with Microsoft CAB files
# http://mark0.net/download/triddefs_xml.7z/defs/a/ark-cab-ishield.trid.xml
# CAB_SIGNATURE 0x28635349
0 string ISc( InstallShield
#!:mime application/octet-stream
!:mime application/x-installshield
# http://mark0.net/download/triddefs_xml.7z/defs/a/ark-cab-ishield-hdr.trid.xml
>16 ulelong !0 setup header
# like: _SYS1.HDR _USER1.HDR data1.hdr
!:ext hdr
>16 ulelong =0 CAB
# like: _SYS1.CAB _USER1.CAB DATA1.CAB data2.cab
!:ext cab
# https://github.com/twogood/unshield/blob/master/lib/helper.c
# version like: 0x1005201 0x100600c 0x1007000 0x1009500
# 0x2000578 0x20005dc 0x2000640 0x40007d0 0x4000834
>4 ulelong x \b, version %#x
# volume_info like: 0
>8 ulelong !0 \b, volume_info %#x
# cab_descriptor_offset like: 0x200
>12 ulelong !0x200 \b, offset %#x
#>0x200 ubequad x \b, at 0x200 %#16.16llx
# cab_descriptor_size like: 0 (*.cab) BD5 C8B DA5 E2A E36 116C 251D 4DA9 56F0 5CC2 6E4B 777D 779E 1F7C2
>16 ulelong !0 \b, descriptor size %#x
# TOP4
0 string T4\x1a TOP4 archive data
# BatComp left out: sig looks like COM executable
@ -925,30 +1011,143 @@
>3 byte&0xf0 0x30
>>3 byte x (v%c)
# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/JAR_(ARJ_Software)
# reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-jar.trid.xml
# https://www.sac.sk/download/pack/jar102x.exe/TECHNOTE.DOC
# Note: called "JAR compressed archive" by TrID
0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data
#!:mime application/octet-stream
!:mime application/x-compress-j
>0 ulelong x \b, CRC32 %#x
# standard suffix is ".j"; for multi volumes following order j01 j02 ... j99 100 ... 990
!:ext j/j01/j02
# URL: http://fileformats.archiveteam.org/wiki/JARCS
# reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-jarcs.trid.xml
# Note: called "JARCS compressed archive" by TrID
0 string JARCS JAR (ARJ Software, Inc.) archive data
#!:mime application/octet-stream
!:mime application/x-compress-jar
!:ext jar
# ARJ archiver (jason@jarthur.Claremont.EDU)
0 leshort 0xea60 ARJ archive data
# URL: http://fileformats.archiveteam.org/wiki/ARJ
# reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-arj.trid.xml
# https://github.com/FarGroup/FarManager/
# blob/master/plugins/multiarc/arc.doc/arj.txt
# Note: called "ARJ compressed archive" by TrID and
# "ARJ File Format" by DROID via PUID fmt/610
# verified by `7z l -tarj PHRACK1.ARJ` and
# `arj.exe l TEST-hk9.ARJ`
0 leshort 0xea60
# skip DROID fmt-610-signature-id-946.arj by check for valid file type of main header
>0xA ubyte 2
>>0 use arj-archive
0 name arj-archive
>0 leshort x ARJ archive
!:mime application/x-arj
>5 byte x \b, v%d,
>8 byte &0x04 multi-volume,
>8 byte &0x10 slash-switched,
>8 byte &0x20 backup,
>34 string x original name: %s,
>7 byte 0 os: MS-DOS
>7 byte 1 os: PRIMOS
>7 byte 2 os: Unix
>7 byte 3 os: Amiga
>7 byte 4 os: Macintosh
>7 byte 5 os: OS/2
>7 byte 6 os: Apple ][ GS
>7 byte 7 os: Atari ST
>7 byte 8 os: NeXT
>7 byte 9 os: VAX/VMS
>3 byte >0 %d]
# look for terminating 0-character of filename
>0x26 search/1024 \0
# file name extension is normally .arj but not for parts of multi volume
#>>&-5 string x extension %.4s
>>&-5 string/c .arj data
!:ext arj
>>&-5 default x
# for multi volume first name is archive.arj then following parts archive.a01 archive.a02 ...
>>>8 byte &0x04 data
!:ext a01/a02
# for SFX first name is archive.exe then following parts archive.e01 archive.e02 ...
>>>8 byte ^0x04 data, SFX multi-volume
!:ext e01/e02
# basic header size like: 0x002b 0x002c 0x04e0 0x04e3 0x04e7
#>2 uleshort x basic header size %#4.4x
# next fragment content like: 0x0a200a003a8fc713 0x524a000010bb3471 0x524a0000c73c70f9
#>(2.s) ubequad x NEXT FRAGMENT CONTENT %#16.16llx
# first_hdr_size; seems to be same as basic header size
#>2 uleshort x 1st header size %#x
# archiver version number like: 3 4 6 11 102
>5 byte x \b, v%d
# minimum archiver version to extract like: 1
>6 ubyte !1 \b, minimum %u to extract
# FOR DEBUGGING
#>8 byte x \b, FLAGS %#x
# GARBLED_FLAG1; garble with password; g switch
>8 byte &0x01 \b, password-protected
# encryption version: 0~old 1~old 2~new 3~reserved 4~40 bit key GOST
>>0x20 ubyte x (v%u)
#>8 byte &0x02 \b, secured
# ANSIPAGE_FLAG; indicates ANSI codepage used by ARJ32; hy switch
>8 byte &0x02 \b, ANSI codepage
# VOLUME_FLAG indicates presence of succeeding volume; but apparently not for SFX
>8 byte &0x04 \b, multi-volume
#>8 byte &0x08 \b, file-offset
# ARJPROT_FLAG; build with data protection record; hk switch
>8 byte &0x08 \b, recoverable
# arj protection factor; maximal 10; switch hky -> factor=y+1
>>0x22 byte x (factor %u)
>8 byte &0x10 \b, slash-switched
# BACKUP_FLAG; obsolete
>8 byte &0x20 \b, backup
# SECURED_FLAG;
>8 byte &0x40 \b, secured,
# ALTNAME_FLAG; indicates dual-name archive
>8 byte &0x80 \b, dual-name
# security version; 0~old 2~current
>9 ubyte !0
>>9 ubyte !2 \b, security version %u
# file type; 2 in main header; 0~binary 1~7-bitText 2~comment 3~directory 4~VolumeLabel 5=ChapterLabel
>0xA ubyte !2 \b, file type %u
# date+time when original archive was created in MS-DOS format via ./msdos
>0xC ulelong x \b, created
>0xC use dos-date
# or date and time by new internal function
#>0xE lemsdosdate x %s
#>0xC lemsdostime x %s
# FOR DEBUGGING
#>0x12 uleshort x RAW DATE %#4.4x
#>0x10 uleshort x RAW TIME %#4.4x
# date+time when archive was last modified; sometimes nil or
# maybe wrong like in HP4DRVR.ARJ
#>0x10 ulelong >0 \b, modified
#>>0x10 use dos-date
# or date and time by new internal function
#>>0x12 lemsdosdate x %s
#>>0x10 lemsdostime x %s
# archive size (currently used only for secured archives); MAYBE?
#>0x14 ulelong !0 \b, file size %u
# security envelope file position; MAYBE?
#>0x18 ulelong !0 \b, at %#x security envelope
# filespec position in filename; WHAT IS THAT?
#>0x1C uleshort >0 \b, filespec position %#x
# length in bytes of security envelope data like: 2CAh 301h 364h 471h
>0x1E uleshort !0 \b, security envelope length %#x
# last chapter like: 0 1
>0x21 ubyte !0 \b, last chapter %u
# filename (null-terminated string); sometimes at 0x26 when 4 bytes for extra data
>34 byte x \b, original name:
# with extras data
>34 byte <0x0B
>>38 string x %s
# without extras data
>34 byte >0x0A
>>34 string x %s
# host OS: 0~MSDOS ... 11~WIN32
>7 byte 0 \b, os: MS-DOS
>7 byte 1 \b, os: PRIMOS
>7 byte 2 \b, os: Unix
>7 byte 3 \b, os: Amiga
>7 byte 4 \b, os: Macintosh
>7 byte 5 \b, os: OS/2
>7 byte 6 \b, os: Apple ][ GS
>7 byte 7 \b, os: Atari ST
>7 byte 8 \b, os: NeXT
>7 byte 9 \b, os: VAX/VMS
>7 byte 10 \b, os: WIN95
>7 byte 11 \b, os: WIN32
# [JW] idarc says this is also possible
2 leshort 0xea60 ARJ archive data
#2 leshort 0xea60
#>2 use arj-archive
# HA archiver (Greg Roelofs, newt@uchicago.edu)
# This is a really bad format. A file containing HAWAII will match this...
@ -1276,6 +1475,18 @@
!:mime application/vnd.sun.xml.base
!:ext sdb
# URL: https://wiki.openoffice.org/wiki/Documentation/DevGuide/Extensions/File_Format
# From: Joerg Jenderek
# Note: only few OXT samples are detected here by mimetype member
# is used by OpenOffice and LibreOffice and probably also NeoOffice
# verified by `unzip -Zv *.oxt` or `7z l -slt *.oxt`
>>50 string vnd.openofficeorg. OpenOffice
>>>68 string extension \b/LibreOffice Extension
# http://extension.nirsoft.net/oxt
!:mime application/vnd.openofficeorg.extension
# like: Gallery-Puzzle.2.1.0.1.oxt
!:ext oxt
# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
# URL: http://fileformats.archiveteam.org/wiki/OpenDocument
# https://lists.oasis-open.org/archives/office/200505/msg00006.html
@ -1522,12 +1733,30 @@
!:mime application/x-bittorrent
# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
0 beshort 0x0e0f Atari MSA archive data
>2 beshort x \b, %d sectors per track
>4 beshort 0 \b, 1 sided
>4 beshort 1 \b, 2 sided
>6 beshort x \b, starting track: %d
>8 beshort x \b, ending track: %d
# URL: http://fileformats.archiveteam.org/wiki/MSA_(Magic_Shadow_Archiver)
# Reference: http://info-coach.fr/atari/documents/_mydoc/FD_Image_File_Format.pdf
# http://mark0.net/download/triddefs_xml.7z/defs/m/msa.trid.xml
# Update: Joerg Jenderek
# Note: called by TrID "Atari MSA Disk Image" and verified by
# command like `deark -l -m msa -d2 PDATS578.msa` as " Atari ST floppy disk image"
# GRR: line below is too general as it matches setup.skin
0 beshort 0x0e0f
# skip foo setup.skin with unrealistic high number 52255 of sides by check for valid "low" value
>4 ubeshort <2 Atari MSA archive data
#!:mime application/octet-stream
!:mime application/x-atari-msa
!:ext msa
# sectors per track like: 9 10
>>2 beshort x \b, %d sectors per track
# sides (0 or 1; add 1 to this to get correct number of sides)
>>4 beshort 0 \b, 1 sided
>>4 beshort 1 \b, 2 sided
# starting track like: 0
>>6 beshort x \b, starting track: %d
# ending track like: 39 79 80 81
>>8 beshort x \b, ending track: %d
# tracks content
#>>10 ubequad x \b, track content %#16.16llx
# Alternate ZIP string (amc@arwen.cs.berkeley.edu)
0 string PK00PK\003\004 Zip archive data
@ -1537,6 +1766,8 @@
# ACE archive (from http://www.wotsit.org/download.asp?f=ace)
# by Stefan `Sec` Zehl <sec@42.org>
7 string **ACE** ACE archive data
!:mime application/x-ace-compressed
!:ext ace
>15 byte >0 version %d
>16 byte =0x00 \b, from MS-DOS
>16 byte =0x01 \b, from OS/2

38
magic/Magdir/aria Normal file
View File

@ -0,0 +1,38 @@
#------------------------------------------------------------------------------
# URL: https://de.wikipedia.org/wiki/Aria_(Software)
# Reference: https://github.com/aria2/aria2/blob/master/doc/manual-src/en/technical-notes.rst
# From: Joerg Jenderek
# Note: only version 1 suited
# check for valid version one
0 beshort 0x0001
# skip most uncompressed DEGAS med-res bitmap *.PI2 and GEM bitmap (v1) *.IMG
# by test for valid infoHashCheck extension
>2 ubelong&0xffFFffFE 0x00000000
# skip DEGAS med-res bitmap DIAGRAM1.PI2 by test for valid length of download
>>(6.L+14) ubequad >0
>>>0 use aria
0 name aria
# version; (0x0000) or (0x0001); for 0 all multi-byte are in host byte order. For 1 big endian
>0 beshort x aria2 control file, version %u
#!:mime application/octet-stream
!:mime application/x-aria
!:ext aria2
# EXTension; if EXT[3]&1 == 1 checks whether saved InfoHash and current downloading the same; infoHashCheck extension
>2 ubelong !0 \b, infoHashCheck %#x
# info hash length like: 0 14h
>6 ubelong !0 \b, %#x bytes info hash
# info hash; BitTorrent InfoHash
>>10 ubequad x %#16.16llx...
# piece length; the length of the piece like: 400h 100000h
>(6.L+10) ubelong x \b, piece length 0x%x
# total length; the total length of the download
>(6.L+14) ubequad x \b, total length %llu
#>(6.L+14) ubequad x \b, total length %#llx
# upload length; the uploaded length of download like: 0 400h
>(6.L+22) ubequad !0 \b, upload length %#llx
# bitfield length; the length of bitfield like: 4 6 Ah 10h 13h 167h
>(6.L+30) ubelong x \b, %#x bytes bitfield
# bitfield; bitfield which represents current download progress
>(6.L+34) ubequad !0 %#llx...

4
magic/Magdir/asf
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: asf,v 1.2 2021/04/26 15:56:00 christos Exp $
# $File: asf,v 1.3 2022/04/25 17:33:13 christos Exp $
# asf: file(1) magic for Microsoft Advanced Systems Format (ASF) files
# http://www.staroceans.org/e-book/ASF_Specification.pdf
@ -88,7 +88,7 @@
>0 guid 26F18B5D-4584-47EC-9F5F-0E651F0452C9 ASF_Compatibility_Object
>0 guid 43058533-6981-49E6-9B74-AD12CB86D58C ASF_Advanced_Content_Encryption_Object
>0 guid 59DACFC0-59E6-11D0-A3AC-00A0C90348F6 ASF_Command_Media
>0 guid B61BE100-5B4E-11CF-A8FD-00805F5C44 ASF_JFIF_Media
>0 guid B61BE100-5B4E-11CF-A8FD-00805F5C442B ASF_JFIF_Media
>0 guid 35907DE0-E415-11CF-A917-00805F5C442B ASF_Degradable_JPEG_Media
>0 guid 91BD222C-F21C-497A-8B6D-5AA86BFC0185 ASF_File_Transfer_Media
>0 guid 3AFB65E2-47EF-40F2-AC2C-70A90D71D343 ASF_Binary_Media

4
magic/Magdir/bytecode
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------
# $File: bytecode,v 1.2 2021/06/30 11:57:32 christos Exp $
# $File: bytecode,v 1.3 2022/03/24 15:48:58 christos Exp $
# magic for various bytecodes
# From: Mikhail Gusarov <dottedmag@dottedmag.net>
@ -27,4 +27,4 @@
>8 string BE \b, big endian
>11 string 4 \b, 32bit
>11 string 8 \b, 64bit
>13 regex .\.. \b, bytecode v%s
>13 regex .\\.. \b, bytecode v%s

141
magic/Magdir/c64
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: c64,v 1.9 2021/04/26 15:56:00 christos Exp $
# $File: c64,v 1.12 2022/05/14 20:03:39 christos Exp $
# c64: file(1) magic for various commodore 64 related files
#
# From: Dirk Jagdmann <doj@cubic.org>
@ -8,9 +8,146 @@
0x16500 belong 0x12014100 D64 Image
0x16500 belong 0x12014180 D71 Image
0x61800 belong 0x28034400 D81 Image
0 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image
0 belong 0x43154164 X64 Image
# C64 (and other CBM) cartridges
# Extended by David Korth <gerbilsoft@gerbilsoft.com>
# Reference: https://vice-emu.sourceforge.io/vice_17.html#SEC391
0 string C64\40CARTRIDGE Commodore 64 cartridge
>0x20 ubyte 0 \b,
>0x20 ubyte !0
>>0x20 string/T x \b: "%.32s",
>0x16 beshort 0
>>0x18 beshort 0x0000 16 KB game
>>0x18 beshort 0x0001 8 KB game
>>0x18 beshort 0x0100 UltiMax mode
>>0x18 beshort 0x0101 RAM/disabled
>0x16 beshort 1 Action Replay
>0x16 beshort 2 KCS Power Cartridge
>0x16 beshort 3 Final Cartridge III
>0x16 beshort 4 Simons' BASIC
>0x16 beshort 5 Ocean type 1
>0x16 beshort 6 Expert Cartridge
>0x16 beshort 7 Fun Play, Power Play
>0x16 beshort 8 Super Games
>0x16 beshort 9 Atomic Power
>0x16 beshort 10 Epyx Fastload
>0x16 beshort 11 Westermann Learning
>0x16 beshort 12 Rex Utility
>0x16 beshort 13 Final Cartridge I
>0x16 beshort 14 Magic Formel
>0x16 beshort 15 C64 Game System, System 3
>0x16 beshort 16 Warp Speed
>0x16 beshort 17 Dinamic
>0x16 beshort 18 Zaxxon / Super Zaxxon (Sega)
>0x16 beshort 19 Magic Desk, Domark, HES Australia
>0x16 beshort 20 Super Snapshot V5
>0x16 beshort 21 Comal-80
>0x16 beshort 22 Structured BASIC
>0x16 beshort 23 Ross
>0x16 beshort 24 Dela EP64
>0x16 beshort 25 Dela EP7x8
>0x16 beshort 26 Dela EP256
>0x16 beshort 27 Rex EP256
>0x16 beshort 28 Mikro Assembler
>0x16 beshort 29 Final Cartridge Plus
>0x16 beshort 30 Action Replay 4
>0x16 beshort 31 Stardos
>0x16 beshort 32 EasyFlash
>0x16 beshort 33 EasyFlash Xbank
>0x16 beshort 34 Capture
>0x16 beshort 35 Action Replay 3
>0x16 beshort 36
>>0x1A ubyte 1 Nordic Replay
>>0x1A ubyte !1 Retro Replay
>0x16 beshort 37 MMC64
>0x16 beshort 38 MMC Replay
>0x16 beshort 39 IDE64
>0x16 beshort 40 Super Snapshot V4
>0x16 beshort 41 IEEE-488
>0x16 beshort 42 Game Killer
>0x16 beshort 43 Prophet64
>0x16 beshort 44 EXOS
>0x16 beshort 45 Freeze Frame
>0x16 beshort 46 Freeze Machine
>0x16 beshort 47 Snapshot64
>0x16 beshort 48 Super Explode V5.0
>0x16 beshort 49 Magic Voice
>0x16 beshort 50 Action Replay 2
>0x16 beshort 51 MACH 5
>0x16 beshort 52 Diashow-Maker
>0x16 beshort 53 Pagefox
>0x16 beshort 54 Kingsoft
>0x16 beshort 55 Silverrock 128K Cartridge
>0x16 beshort 56 Formel 64
>0x16 beshort 57
>>0x1A ubyte 1 Hucky
>>0x1A ubyte !1 RGCD
>0x16 beshort 58 RR-Net MK3
>0x16 beshort 59 EasyCalc
>0x16 beshort 60 GMod2
>0x16 beshort 61 MAX Basic
>0x16 beshort 62 GMod3
>0x16 beshort 63 ZIPP-CODE 48
>0x16 beshort 64 Blackbox V8
>0x16 beshort 65 Blackbox V3
>0x16 beshort 66 Blackbox V4
>0x16 beshort 67 REX RAM-Floppy
>0x16 beshort 68 BIS-Plus
>0x16 beshort 69 SD-BOX
>0x16 beshort 70 MultiMAX
>0x16 beshort 71 Blackbox V9
>0x16 beshort 72 Lt. Kernal Host Adaptor
>0x16 beshort 73 RAMLink
>0x16 beshort 74 H.E.R.O.
>0x16 beshort 75 IEEE Flash! 64
>0x16 beshort 76 Turtle Graphics II
>0x16 beshort 77 Freeze Frame MK2
0 string C128\40CARTRIDGE Commodore 128 cartridge
>0x20 ubyte 0 \b,
>0x20 ubyte !0
>>0x20 string/T x \b: "%.32s",
>0x16 beshort 0 generic cartridge
>0x16 beshort 1 Warpspeed128
>>0x1A ubyte 1 \b, REU support
>>0x1A ubyte 2 \b, REU support, with I/O and ROM banking
0 string CBM2\40CARTRIDGE Commodore CBM-II cartridge
>0x20 ubyte !0
>>0x20 string/T x \b: "%.32s"
0 string VIC20\40CARTRIDGE Commodore VIC-20 cartridge
>0x20 ubyte 0 \b,
>0x20 ubyte !0
>>0x20 string/T x \b: "%.32s",
>0x16 beshort 0 generic cartridge
>0x16 beshort 1 Mega-Cart
>0x16 beshort 2 Behr Bonz
>0x16 beshort 3 Vic Flash Plugin
>0x16 beshort 4 UltiMem
>0x16 beshort 5 Final Expansion
0 string PLUS4\40CARTRIDGE Commodore 16/Plus4 cartridge
>0x20 ubyte !0
>>0x20 string/T x \b: "%.32s"
# DreamLoad archives see:
# https://www.lemon64.com/forum/viewtopic.php?t=37415\
# &sid=494dc2ca91289e05dadf80a7f8a968fe (at the bottom).
# https://www.c64-wiki.com/wiki/DreamLoad.
# Example HVSC Commodore 64 music collection:
# https://kohina.duckdns.org/HVSC/C64Music/10_Years_HVSC.dfi
0 byte 0
>1 string DREAMLOAD\40FILE\40ARCHIVE
>>0x17 byte 0 DFI Image
>>>0x1a leshort x version: %d.
>>>0x18 leshort x \b%d
>>>0x1c lelong x tracks: %d
0 string GCR-1541 GCR Image
>8 byte x version: %i
>9 byte x tracks: %i

4
magic/Magdir/cad
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: cad,v 1.28 2021/04/26 15:56:00 christos Exp $
# $File: cad,v 1.29 2021/12/06 19:33:27 christos Exp $
# autocad: file(1) magic for cad files
#
@ -287,6 +287,8 @@
>6 leshort 0x2
>>8 lelong 0xa
>>>16 leshort 0x3d3d 3D Studio model
# Beat sgi MMV
!:strength +20
!:mime image/x-3ds
!:ext 3ds

14
magic/Magdir/ccf Normal file
View File

@ -0,0 +1,14 @@
#------------------------------------------------------------------------------
# $File: ccf,v 1.1 2022/02/15 12:57:45 christos Exp $
# file(1) magic(5) data for Phillips remote controls
# Exchange format for Philips Pronto universal infrared remote controls
# A CCF file describes a learned/customized remote control,
# i.e. it contains button UI and infrared pulse code definitions
# (Georg Sauthoff)
# http://files.remotecentral.com/download/45/pan-air-csakr.zip.html
# https://github.com/gsauthof/pronto-ccf/blob/
8 string @\xa5Z@_CCF
>32 string CCF\x00 Philips Pronto IR remote control CCF

32
magic/Magdir/commands
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: commands,v 1.66 2021/07/03 13:50:29 christos Exp $
# $File: commands,v 1.69 2022/04/20 21:14:23 christos Exp $
# commands: file(1) magic for various shells and interpreters
#
#0 string/w : shell archive or script for antique kernel text
@ -35,7 +35,7 @@
!:mime text/x-shellscript
0 string/fwt #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable
!:mime text/x-shellscript
0 search/1 #!/usr/bin/env\ zsh Paul Falstad's zsh script text executable
0 string/fwt #!\ /usr/bin/env\ zsh Paul Falstad's zsh script text executable
!:mime text/x-shellscript
0 string/fwt #!\ /bin/ash Neil Brown's ash script text executable
@ -98,7 +98,7 @@
!:mime text/x-shellscript
0 string/wt #!\ a
>&-1 string x %s script text executable
>&-1 string/T x %s script text executable
0 search/1/fwt #!\ /usr/bin/tclsh Tcl/Tk script text executable
!:mime text/x-tcl
@ -153,6 +153,32 @@
0 string Zend\x00 PHP script Zend Optimizer data
# From: Anatol Belski <ab@php.net>
0 string OPCACHE
>7 ubyte 0 PHP opcache filecache data
0 search/64 --TEST--
>16 search/64 --FILE--
>24 search/8192 --EXPECT PHP core test
!:ext phpt
# https://www.php.net/manual/en/phar.fileformat.signature.php
-4 string GBMB PHP phar archive
>-8 ubyte 0x1 with MD5 signature
!:ext phar
>-8 ubyte 0x2 with SHA1 signature
!:ext phar
>-8 ubyte 0x3 with SHA256 signature
!:ext phar
>-8 ubyte 0x4 with SHA512 signature
!:ext phar
>-8 ubyte 0x10 with OpenSSL signature
!:ext phar
>-8 ubyte 0x11 with OpenSSL SHA256 signature
!:ext phar
>-8 ubyte 0x12 with OpenSSL SHA512 signature
!:ext phar
0 string/t $! DCL command file
# Type: Pdmenu

103
magic/Magdir/console
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: console,v 1.63 2021/04/26 15:56:00 christos Exp $
# $File: console,v 1.68 2022/05/14 20:04:43 christos Exp $
# Console game magic
# Toby Deshane <hac@shoelace.digivill.net>
@ -78,8 +78,8 @@
>23 byte !1 FMC-
>23 byte 1 FSC-
>16 string x \b%.3s
>15 byte x \b, mfr %02X
>20 byte x (Rev.%02u)
>15 ubyte x \b, mfr %02X
>20 ubyte x (Rev.%02u)
# Headered version.
0 string FDS\x1A
@ -228,21 +228,56 @@
>0x10 use sega-mega-drive-header
>0 byte x \b, 2352-byte sectors
# Sega Mega Drive, 32X, Pico, and Mega CD Boot ROM images.
# Sega Mega Drive: Identify the system ID.
0x100 string SEGA
>0x3C0 bequad 0x4D41525320434845 Sega 32X ROM image
>0x3C0 string MARS\ CHECK\ MODE Sega 32X ROM image
!:mime application/x-genesis-32x-rom
>>0 use sega-mega-drive-header
>0x3C0 bequad !0x4D41525320434845
>>0x105 belong 0x5049434F Sega Pico ROM image
>0x104 string \ PICO Sega Pico ROM image
!:mime application/x-sega-pico-rom
>>>0 use sega-mega-drive-header
>>0x105 belong !0x5049434F
>>>0x180 beshort 0x4252 Sega Mega CD Boot ROM image
>>0 use sega-mega-drive-header
>0x104 string TOYS\ PICO Sega Pico ROM image
!:mime application/x-sega-pico-rom
>>0 use sega-mega-drive-header
>0x104 string \ TOYS\ PICO Sega Pico ROM image
!:mime application/x-sega-pico-rom
>>0 use sega-mega-drive-header
>0x104 string \ IAC Sega Pico ROM image
!:mime application/x-sega-pico-rom
>>0 use sega-mega-drive-header
>0x104 string \ TERA68K Sega Teradrive (68K) ROM image
!:mime application/x-sega-teradrive-rom
>>0 use sega-mega-drive-header
>0x104 string \ TERA286 Sega Teradrive (286) ROM image
!:mime application/x-sega-teradrive-rom
>>0 use sega-mega-drive-header
>0x180 string BR Sega Mega CD Boot ROM image
!:mime application/x-genesis-rom
>>>0x180 beshort !0x4252 Sega Mega Drive / Genesis ROM image
>>0 use sega-mega-drive-header
>0x104 default x Sega Mega Drive / Genesis ROM image
!:mime application/x-genesis-rom
>>>0 use sega-mega-drive-header
>>0 use sega-mega-drive-header
# Sega Mega Drive: Some ROMs have "SEGA" at 0x101, not 0x100.
0x100 string \ SEGA Sega Mega Drive / Genesis ROM image
>0 use sega-mega-drive-header
# Sega Pico ROMs that don't start with "SEGA".
0x100 string SAMSUNG\ PICO Samsung Pico ROM image
!:mime application/x-sega-pico-rom
>0 use sega-mega-drive-header
0x100 string IMA\ IKUNOUJYUKU Samsung Pico ROM image
!:mime application/x-sega-pico-rom
>0 use sega-mega-drive-header
0x100 string IMA IKUNOJYUKU Samsung Pico ROM image
!:mime application/x-sega-pico-rom
>0 use sega-mega-drive-header
# Sega Picture Magic (modified 32X)
0x100 string Picture\ Magic
>0x3C0 string PICTURE MAGIC-01 Sega 32X ROM image
!:mime application/x-genesis-32x-rom
>>0 use sega-mega-drive-header
#------------------------------------------------------------------------------
# genesis: file(1) magic for the Super MegaDrive ROM dump format
@ -474,12 +509,13 @@
# - https://neogpc.googlecode.com/svn-history/r10/trunk/src/core/neogpc.cpp
# - https://www.devrs.com/ngp/files/ngpctech.txt
#
0x0A string BY\ SNK\ CORPORATION Neo Geo Pocket
0x0A string BY\ SNK\ CORPORATION Neo Geo Pocket
!:mime application/x-neo-geo-pocket-rom
>0x23 byte 0x10 Color
>0 byte x ROM image
>0x24 string >\0 \b: "%.12s"
>0x1F byte 0xFF (debug mode enabled)
>0x23 byte 0x10 Color
>0 byte x ROM image
>0x24 string >\0 \b: "%.12s"
>0x21 uleshort x \b, NEOP%04X
>0x1F ubyte 0xFF (debug mode enabled)
#------------------------------------------------------------------------------
# msx: file(1) magic for MSX game cartridge dumps
@ -639,17 +675,21 @@
>>0 use xbox-360-package
# Atari Lynx cartridge dump (EXE/BLL header)
# From: "Stefan A. Haubenthal" <polluks@web.de>
# From: "Stefan A. Haubenthal" <polluks@sdf.lonestar.org>
# Reference:
# https://raw.githubusercontent.com/cc65/cc65/master/libsrc/lynx/exehdr.s
# Double-check that the image type matches too, 0x8008 conflicts with
# 8 character OMF-86 object file headers.
0 beshort 0x8008
>6 string BS93 Lynx homebrew cartridge
!:mime application/x-atari-lynx-rom
>>2 beshort x \b, RAM start $%04x
>6 string LYNX Lynx cartridge
0 string LYNX Lynx cartridge
!:mime application/x-atari-lynx-rom
>>2 beshort x \b, RAM start $%04x
>4 leshort/4 >0 \b, bank 0 %dk
>6 leshort/4 >0 \b, bank 1 %dk
>10 string >\0 \b, "%.32s"
>42 string >\0 \b, "%.16s"
# Opera file system that is used on the 3DO console
# From: Serge van den Boom <svdb@stack.nl>
@ -898,6 +938,16 @@
!:mime application/x-gamecube-rom
>>>>0x8000 use nintendo-gcn-disc-common
# Type: Nintendo GameCube/Wii disc image (RVZ format)
0 string RVZ\001 Nintendo
>0x48 belong 1 GameCube
!:mime application/x-gamecube-rom
>0x48 belong 2 Wii
!:mime application/x-wii-rom
>0x48 default x GameCube/Wii
>0x48 belong x disc image (RVZ format):
>>0x58 use nintendo-gcn-disc-common
#------------------------------------------------------------------------------
# Nintendo 3DS file formats.
#
@ -1126,14 +1176,3 @@
>>0x34 ubyte 1 [FastROM]
>>0x35 ubyte 1 [SRAM]
>>0x35 ubyte 3 [Special]
# Type: Nintendo GameCube/Wii disc image (RVZ format)
0 string RVZ\001 Nintendo
>0x48 belong 1 GameCube
!:mime application/x-gamecube-rom
>0x48 belong 2 Wii
!:mime application/x-wii-rom
>0x48 default x GameCube/Wii
>0x48 belong x disc image (RVZ format):
>>0x58 use nintendo-gcn-disc-common

2
magic/Magdir/ctf
View File

@ -20,4 +20,4 @@
# CTF metadata (plain text)
0 string /*\x20CTF\x20 Common Trace Format (CTF) plain text metadata
!:strength + 5 # this is to make sure we beat C
>&0 regex [0-9]+\.[0-9]+ \b, v%s
>&0 regex [0-9]+\\.[0-9]+ \b, v%s

18
magic/Magdir/database
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: database,v 1.63 2021/10/04 00:44:30 christos Exp $
# $File: database,v 1.66 2022/02/26 17:42:21 christos Exp $
# database: file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
@ -151,6 +151,7 @@
# https://www.clicketyclick.dk/databases/xbase/format/dbf.html
# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
0 ubelong&0x0000FFFF <0x00000C20
!:strength +10
# skip Infocom game Z-machine
>2 ubyte >0
# skip Androids *.xml
@ -399,7 +400,9 @@
>>>>>>>>>>4 ushort 0
# check for valid FoxPro field type
>>>>>>>>>>>512 ubelong <3
>>>>>>>>>>>>0 use foxpro-memo-print
# skip LXMDCLN4.OUT LXMDCLN6.OUT LXMDALG6.OUT with invalid blocksize 170=AAh
>>>>>>>>>>>>6 ubeshort&0x002f 0
>>>>>>>>>>>>>0 use foxpro-memo-print
# dBASE III DBT , garbage
# skip WORD1XW.DOC with improbably high free block index
>>>>>>>>>0 ulelong <0x400000
@ -415,9 +418,11 @@
>>>>>>>>>>0 ulelong <0x400000
# skip AI070GEP.EPS by printable 1st character of 1st memo item
>>>>>>>>>>>512 ubyte >037
# skip some Microsoft Visual C, OMF library like: BZ2.LIB WATTCPWL.LIB ZLIB.LIB
>>>>>>>>>>>>512 ubyte <0200
# skip gluon-ffhat-1.0-tp-link-tl-wr1043n-nd-v2-sysupgrade.bin by printable 2nd character
>>>>>>>>>>>>513 ubyte >037
>>>>>>>>>>>>>0 use dbase3-memo-print
>>>>>>>>>>>>>513 ubyte >037
>>>>>>>>>>>>>>0 use dbase3-memo-print
# dBASE IV DBT with positive block size
>>>>>>>20 uleshort >0
# dBASE IV DBT with valid block length like 512, 1024
@ -440,7 +445,10 @@
#>20 uleshort =0 \b, block length %u
>20 uleshort !0 \b, block length %u
# dBase III memo field terminated by \032\032
# like: "WHAT IS XBASE" test.dbt "Borges, Malte" biblio.dbt "First memo\032\032" T2.DBT
>512 string >\0 \b, 1st item "%s"
# For DEBUGGING
#>512 ubelong x \b, 1ST item %#8.8x
# https://www.clicketyclick.dk/databases/xbase/format/dbt.html
# Print the information of dBase IV DBT memo file
0 name dbase4-memo-print
@ -486,7 +494,7 @@
>0 belong x FoxPro FPT
!:mime application/x-fpt
!:ext fpt
# Size of blocks for FoxPro ( 64,256 )
# Size of blocks for FoxPro ( 64,256 ); probably a multiple of two
>6 ubeshort x \b, blocks size %u
# next available block
#>0 belong =0 \b, next free block index %u

28
magic/Magdir/dataone
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: dataone,v 1.2 2019/04/19 00:42:27 christos Exp $
# $File: dataone,v 1.3 2022/04/18 21:38:10 christos Exp $
#
# DataONE- files from Dave Vieglais <dave.vieglais@gmail.com> &
# Pratik Shrivastava <pratikshrivastava23@gmail.com>
@ -9,39 +9,39 @@
#------------------------------------------------------------------------------
# EML (Ecological Metadata Language Format)
0 string <?xml
>&0 regex (eml)-[0-9].[0-9].[0-9]+ eml://ecoinformatics.org/%s
0 string \<?xml\ version=
>&0 regex/1024 eml-[0-9]\\.[0-9]\\.[0-9]+ eml://ecoinformatics.org/%s
# onedcx (DataONE Dublin Core Extended v1.0)
>&0 regex (onedcx/v)[0-9].[0-9]+ https://ns.dataone.org/metadata/schema/onedcx/v1.0
>&0 regex/1024 onedcx/v[0-9]\\.[0-9]+ https://ns.dataone.org/metadata/schema/onedcx/v1.0
# FGDC-STD-001-1998 (Content Standard for Digital Geospatial Metadata,
# version 001-1998)
>&0 regex fgdc FGDC-STD-001-1998
>&0 search/1024 fgdc FGDC-STD-001-1998
# Mercury (Oak Ridge National Lab Mercury Metadata version 1.0)
>&0 regex (mercury/terms/v)[0-9].[0-9] https://purl.org/ornl/schema/mercury/terms/v1.0
>&0 regex/1024 mercury/terms/v[0-9]\\.[0-9] https://purl.org/ornl/schema/mercury/terms/v1.0
# ISOTC211 (Geographic MetaData (GMD) Extensible Markup Language)
>&0 regex isotc211
>>&0 regex eng;USA https://www.isotc211.org/2005/gmd
>&0 search/1024 isotc211
>>&0 search/1024 eng;USA https://www.isotc211.org/2005/gmd
# ISOTC211 (NOAA Variant Geographic MetaData (GMD) Extensible Markup Language)
>>&0 regex gov.noaa.nodc:[0-9]+ https://www.isotc211.org/2005/gmd-noaa
>>&0 regex/1024 gov\\.noaa\\.nodc:[0-9]+ https://www.isotc211.org/2005/gmd-noaa
# ISOTC211 PANGAEA Variant Geographic MetaData (GMD) Extensible Markup Language
>>&0 regex pangaea.dataset[0-9][0-9][0-9][0-9][0-9][0-9]+ https://www.isotc211.org/2005/gmd-pangaea
>>&0 regex/1024 pangaea\\.dataset[0-9][0-9][0-9][0-9][0-9][0-9]+ https://www.isotc211.org/2005/gmd-pangaea
!:mime text/xml
# Object Reuse and Exchange Vocabulary
0 string <?xml
>&0 regex rdf
>>&0 regex openarchives https://www.openarchives.org/ore/terms
0 string \<?xml\ version=
>&0 search/1024 rdf
>>&0 search/1024 openarchives https://www.openarchives.org/ore/terms
!:mime application/rdf+xml
# Dryad Metadata Application Profile Version 3.1
0 string <DryadData
>&0 regex (dryad-bibo/v)[0-9].[0-9] https://datadryad.org/profile/v3.1
>&0 regex/1024 dryad-bibo/v[0-9]\\.[0-9] https://datadryad.org/profile/v3.1
!:mime text/xml

25
magic/Magdir/dsf Normal file
View File

@ -0,0 +1,25 @@
#------------------------------------------------------------
# $File: dsf,v 1.1 2022/01/08 16:29:18 christos Exp $
# dsf: file(1) magic for DSD Stream File
# URL: https://en.wikipedia.org/wiki/Direct_Stream_Digital
# Reference: https://dsd-guide.com/sites/default/files/white-papers/DSFFileFormatSpec_E.pdf
0 string DSD\x20 DSD Stream File,
>0x30 leshort 1 mono,
>0x30 leshort 2 stereo,
>0x30 leshort 3 three-channel,
>0x30 leshort 4 quad-channel,
>0x30 leshort 5 3.1 4-channel,
>0x30 leshort 6 five-channel,
>0x30 leshort 7 5.1 surround,
>0x30 default x
>>0x30 leshort x unknown channel format (%d),
>0x38 lelong 2822400 simple-rate,
>0x38 lelong 5644800 double-rate,
>0x38 default x
>>0x38 lelong x %d Hz,
>0x3c leshort 1 1 bit,
>0x3c leshort 8 8 bit,
>0x3c default x
>>0x3c leshort x %d bit,
>0x40 lelong x %d samples

165
magic/Magdir/filesystems
View File

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: filesystems,v 1.145 2021/09/07 18:57:50 christos Exp $
# $File: filesystems,v 1.149 2022/05/21 22:50:28 christos Exp $
# filesystems: file(1) magic for different filesystems
#
0 name partid
@ -2317,6 +2317,8 @@
>0x10070 lequad x \b%lld bytes used,
>0x10088 lequad x %lld devices
0 string btrfs-stream BTRFS stream file
# dvdisaster's .ecc
# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
0 string *dvdisaster* dvdisaster error correction file
@ -2399,12 +2401,167 @@
0 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk)
0 beshort 0xAA58 floppy image data (IBM SaveDskF, old)
0 beshort 0xAA59 floppy image data (IBM SaveDskF)
0 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed)
# URL: http://fileformats.archiveteam.org/wiki/LoadDskF/SaveDskF
# Update: Joerg Jenderek
# Note: called "IBM SKF disk image" by TrID
# verfied by 7-Zip `7z l -tFAT -slt *.dsk` and
# `deark -l -m loaddskf 06200D19.DSK`
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dsk-skf-old.trid.xml
0 beshort 0xAA58
>0 use SaveDskF
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dsk-skf.trid.xml
0 beshort 0xAA59
>0 use SaveDskF
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dsk-skf-comp.trid.xml
0 beshort 0xAA5A
# skip foo by additional check for unused upper byte of media type in SaveDskF header
#>3 ubyte =0
# skip bar by additional check for valid "low" number of heads in SaveDskF header
#>>26 uleshort <3
# skip foo by additional check for unused double word field in SaveDskF header
#>>>30 long =0
#>>>>0 use SaveDskF
>0 use SaveDskF
# display information about IBM SaveDskF floppy disk images
0 name SaveDskF
# SaveDskF magic
>0 beshort x floppy image data (IBM SaveDskF
#!:mime application/octet-stream
!:mime application/x-ibm-dsk
!:ext dsk
# also suffix with digit (1dk .2dk ...); NO example FOUND!
#!:ext dsk/1dk/2dk
>1 ubyte =0x58 \b, old)
>1 ubyte =0x59 \b)
>1 ubyte =0x5A \b, compressed)
# media type; the first byte of the FAT like: 0xF0 (usual floppy) 0xF9 0xFE
# https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system
>2 ubyte !0xF0 \b, Media descriptor %#x
# upper byte of media type is not used; so this seems to be nil
>3 ubyte !0 \b, upper byte of media type %#x
# sector size in bytes as in the BIOS parameter block like: 512 ; SAVEDSKF.EXE with other sizes produce garbage images
>4 uleshort !512 \b, Bytes/sector %u
# cluster mask; number of sectors per cluster, minus 1
>6 uleshort+1 >1 \b, sectors/cluster %u
#>6 uleshort+1 x \b, sectors/cluster %u
# cluster shift; log2(cluster size / sector size) like: 0~1=ClusterSize/SectorSize
>7 ubyte >0 \b, cluster shift %u
#>7 ubyte x \b, cluster shift %u
# reserved sectors; as in the BIOS parameter block like: 1 256 (2M256R-K.DSK)
>8 uleshort >1 \b, reserved sectors %u
#>8 uleshort x \b, reserved sectors %u
# FAT copies; as in the BIOS parameter block like: 2 (usual) 1 (2-NK.DSK)
>10 ubyte !2 \b, FAT
# plural s
>>10 ubyte >1 \bs
>>10 ubyte x %u
# root directory entries; as in the BIOS parameter block like: 224 (usual) 64 (H1-NK.DSK) 4096 (2-NK.DSK)
>11 uleshort !224 \b, root entries %u
# sector number of first cluster (count sectors used by boot sector, FATs and root directory) like: 7 10 29 33 288
>13 uleshort !33 \b, 1st cluster at sector %u
# number of clusters in image; empty clusters at the end are not saved and counted like: 2372 2848
>15 uleshort x \b, %u clusters
# sectors/FAT; as in the BIOS parameter block like: 1 (H1-NK.DSK) 7 9
>17 ubyte !9 \b, sectors/FAT %u
# sector number of root directory (ie, count of sectors used by boot sector and FATs) like: 3 (H1-NK.DSK) 9 10 15 19 274 (2M256R-K.DSK)
>18 uleshort !19 \b, root directory at sector %u
# checksum; sum of all bytes in the file
>20 ulelong x \b, checksum %#8.8x
# cylinders; number of cylinders like: 40 80
>24 uleshort !80 \b, %u cylinders
#>24 uleshort x \b, %u cylinders
# heads; number of heads as in the BIOS parameter block like: 1 (H1-NK.DSK) 2
>26 uleshort !2 \b, heads %u
#>26 uleshort x \b, heads %u
# sectors/track; number of sectors per track as in the BIOS parameter block like: 8 15 18 36
>28 uleshort !18 \b, sectors/track %u
#>28 uleshort x \b, sectors/track %u
# unused double word field seems to be always like: 0
>30 ulelong !0 \b, at 0x1E %#x
# number of sectors in images like: 1017 2786 2880
>34 uleshort x \b, sectors %u
# if string is "printable" it can be a real comment
>(36.s) ubyte !0x00
# if 1st sector is far enough away (> 0x29) then there is space for comment part
>>38 uleshort >41
# offset to comment string like: 28h=40
>>>36 uleshort x \b, at %#x
# comment string terminated with \r\n\0
>>>(36.s) string x "%s"
# offset to the first sector like: 0 (If this is 0, assume it is 0x200) 29h=41 (DISPLAY3.DSK) 31h 43h 45h 46h 48h 50h 200h=512
>38 uleshort !0 \b, 1st sector at %#x
# FOR DEBUGGING!
#>(38.s) ubelong x SECTOR CONTENT %x
# not compressed floppy image implies readable DOS boot sector inside image
>>1 ubyte !0x5A
# when not compressed it is readable as DOS boot sector via ./filesystems
#>>>(38.s) indirect x \b; contains
>38 uleshort =0 \b, 1st sector at 0x200 (0)
# maybe standard DOS boot sector; NO example FOUND HERE!
#>>0x200 indirect x \b; contains
0 string \074CPM_Disk\076 disk image data (YAZE)
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Central_Point_Software#cite_note-6
# Reference: https://www.robcraig.com/download/transcopy-5-x-file-format
# https://www.robcraig.com/download/transcopy-file-format-by-gene-thompson
# http://mark0.net/download/triddefs_xml.7z/defs/t/tc-transcopy.trid.xml
# TransCopy signature
0 beshort 0x5AA5
# skip Intel serial flash ROM with invalid 0 disk sides handled by ./intel
>0x103 ubyte !0
# skip Intel serial flash ROM with unlikely "high" start cylinder 100 handled by ./intel
#>>0x101 ubyte <100 VALID_START_CYLINDER
# skip Intel serial flash ROM with unlikely description handled by ./intel
#>>>2 beshort !0xF00f VALID_DESCRIPTION
# skip Intel serial flash ROM with invalid disk types 89h 88h handled by ./intel
#>>>>0x100 byte !0x89 VALID_DISK_TYPE
>>0 use tc-floppy
# display information of Central Point Software (CPS) Option Board TransCopy floppy image
0 name tc-floppy
>0 beshort x TransCopy disk image
#!:mime application/octet-stream
!:mime application/x-floppy-image-tc
# like: disk04.tc VOCALC2.TC WIZ5_A.tc WIZ2_720.IMG
!:ext tc/img
# 1st description (optional 0-terminated maximal 32) like:
# "Project Workbench 2.20" "Visi On Calc" "Wizardry V Disk 1 of 3"
>2 string >\0 %.32s
# 2nd desc. (optional 0-terminated maximal 32) like:
# "(1988)." "Advanced - Utility" 'Program Disk 2"
>0x22 string >\0 "%.32s"
# Looks like ascii (like MESSAGES) formatted with attribute bytes (190)?
# not needed for disk copy
#>>0x42 string x '%.190s'
#>>0x88 lestring16 x "%.8s"
# disktype: 2~MFM High Density 3~MFM Double Density 4~Apple II GCR 5~FM Single Density
# 6~Commodore GCR 7~MFM Double Density 8~Commodore Amiga Ch~Atari FM FFh~Unknown
>0x100 ubyte !0xFF \b, disk type %u
# StartingCylinder like: 0
>0x101 ubyte x \b, cylinder
>0x101 ubyte !0 start=%u
# EndingCylinder like: 40 (often) 41 79
>0x102 ubyte x end=%u
# NumberOfSides like: 2
>0x103 ubyte !2 \b, %u sides
# TrackIncrement like: 1
>0x104 ubyte !1 \b, track increment %u
# TrackPosTbl Track skew
#>0x105 ubequad x \b, Track skew %#16.16llx
# TrackOffsTbl
#>0x305 ubequad x \b, TrackOffsTbl %#16.16llx
# TrackLngthTbl
#>0x505 ubequad x \b, TrackLngthTbl %#16.16llx
# TrackTypeTable
#>0x705 ubequad x \b, TrackTypeTable %#16.16llx
# Address mark timing
#>0x905 ubequad x \b, Address mark timing %#16.16llx
# Track fragment
#>0x2905 ubequad !0 \b, Track fragment %#16.16llx
# Track data
#>0x4000 ubequad !0 \b, Track data %#16.16llx
# ReFS
# Richard W.M. Jones <rjones@redhat.com>
0 string \0\0\0ReFS\0 ReFS filesystem image

67
magic/Magdir/fonts
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: fonts,v 1.46 2021/04/26 15:56:00 christos Exp $
# $File: fonts,v 1.50 2022/03/21 21:28:13 christos Exp $
# fonts: file(1) magic for font data
#
0 search/1 FONT ASCII vfont text
@ -8,13 +8,56 @@
0 short 017001 byte-swapped Berkeley vfont data
# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
# Modified by: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/PostScript_fonts
# http://fileformats.archiveteam.org/wiki/Adobe_Type_1
# Reference: http://mark0.net/download/triddefs_xml.7z
# defs/p/pfb.trid.xml
# Note: PFB stands for Printer Font Binary
0 string %!PS-AdobeFont-1. PostScript Type 1 font text
#!:mime font/x-postscript-pfb
#!:ext pfb
>20 string >\0 (%s)
6 string %!PS-AdobeFont-1. PostScript Type 1 font program data
>26 string >\0 (%s)
# http://www.nationalarchives.gov.uk/pronom/fmt/525
6 string %!PS-AdobeFont-1.
# skip DROID fmt-525-signature-id-816.pfb by checking for content after header
>24 ubyte x PostScript Type 1 font program data
#!:mime application/octet-stream
!:mime font/x-postscript-pfb
!:ext pfb
# often followed by colon (3Ah) and space (20h) and font name like: DarkGardenMK LetterGothic
>>24 ubyte =0x3A
>>>26 string >\0 (%s)
# some times instead of colon %%CreationDate: and "font name" later
>>24 ubyte !0x3A
# font name directive followed by def like: c0633bt_.pfb
>>>25 search/1247 /FontName\040/
# show font name in parentheses like: Frankfurt Lithos CharterBT-BoldItalic Courier10PitchBT-Bold
>>>>&0 regex [A-Za-z0-9-]+ (%s)
# http://cd.textfiles.com/maxfonts/ATM/M/MIRROR__.PFB
6 string %PS-AdobeFont-1. PostScript Type 1 font program data
!:mime font/x-postscript-pfb
!:ext pfb
# font name like: Times-Mirror
>25 string >\0 (%s)
0 string %!FontType1 PostScript Type 1 font program data
#!:mime font/x-postscript-pfb
#!:ext pfb
6 string %!FontType1 PostScript Type 1 font program data
#!:mime application/octet-stream
!:mime font/x-postscript-pfb
!:ext pfb
# font name like: CaslonOpenFace FetteFraktur Kaufmann Linotext MesozoicGothic Old-Town
>23 string >\0 (%s)
# http://cd.textfiles.com/maxfonts/ATM/P/PLAYBI.PFB
230 string %!FontType1 PostScript Type 1 font program data
!:mime font/x-postscript-pfb
!:ext pfb
# font name like: Playbill
>247 string >\0 (%s)
0 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text
#!:mime font/x-postscript-pfb
#!:ext pfb
# Summary: PostScript Type 1 Printer Font Metrics
# URL: https://en.wikipedia.org/wiki/PostScript_fonts
@ -67,15 +110,23 @@
>>>90 ubyte 65 script proportional
# X11 font files in SNF (Server Natural Format) format
# updated by Joerg Jenderek at Feb 2013
# updated by Joerg Jenderek at Feb 2013 and Nov 2021
# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm
0 belong 00000004 X11 SNF font data, MSB first
#>104 belong 00000004 X11 SNF font data, MSB first
# URL: http://fileformats.archiveteam.org/wiki/SNF
# Reference: https://cgit.freedesktop.org/xorg/lib/libXfont/tree/src/bitmap/snfstr.h
0 belong 00000004
# version2 same as version1 in struct _snfFontInfo
>104 belong 00000004 X11 SNF font data, MSB first
# GRR: line above is too general as it catches also DEGAS low-res bitmap like:
# http://cd.textfiles.com/geminiatari/FILES/GRAPHICS/ANIMAT/SPID_PAT/BIGSPID.PI1
!:mime application/x-font-sfn
# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX
!:ext snf
# GRR: line below is too general as it catches also Xbase index file t3-CHAR.NDX
0 lelong 00000004
>104 lelong 00000004 X11 SNF font data, LSB first
!:mime application/x-font-sfn
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/snf-x11-lsb.trid.xml
!:ext snf
# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
0 search/1 STARTFONT\ X11 BDF font text
@ -384,11 +435,13 @@
# https://www.w3.org/TR/WOFF/
0 string wOFF Web Open Font Format
!:mime font/woff
>0 use woff
>20 beshort x \b, version %d
>22 beshort x \b.%d
# https://www.w3.org/TR/WOFF2/
0 string wOF2 Web Open Font Format (Version 2)
!:mime font/woff2
>0 use woff
#>20 belong x \b, totalCompressedSize %d
>24 beshort x \b, version %d

22
magic/Magdir/freebsd
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $
# $File: freebsd,v 1.9 2022/01/19 12:44:13 christos Exp $
# freebsd: file(1) magic for FreeBSD objects
#
# All new-style FreeBSD magic numbers are in host byte order (i.e.,
@ -142,3 +142,23 @@
>9 byte 2 %d bytes in header,
>>10 byte x %d chars wide by
>>11 byte x %d chars high
#
# FreeBSD kernel minidumps
#
0 string minidump\040FreeBSD/ FreeBSD kernel minidump
# powerpc uses 32-byte magic, followed by 32-byte mmu kind, then version
>17 string powerpc
>>17 string >\0 for %s,
>>>32 string >\0 %s,
>>>>64 byte 0 big endian,
>>>>>64 belong x version %d
>>>>64 default x little endian,
>>>>>64 lelong x version %d
# all other architectures use 24-byte magic, followed by version
>17 default x
>>17 string >\0 for %s,
>>>24 byte 0 big endian,
>>>>24 belong x version %d
>>>24 default x little endian,
>>>>24 lelong x version %d

34
magic/Magdir/games
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: games,v 1.24 2021/04/26 15:56:00 christos Exp $
# $File: games,v 1.25 2022/05/31 18:40:20 christos Exp $
# games: file(1) for games
# Fabio Bonelli <fabiobonelli@libero.it>
@ -496,25 +496,17 @@
>4 ulelong x version %d, used in GTA IV,
>>8 ulelong x %d items
0 uleshort 0x5250 RAGE Package Format (RPF),
>2 uleshort 0x4630 version 0, used in Rockstar Table Tennis,
>>4 ulelong x %d bytes,
>>>8 ulelong x %d entries
>2 uleshort 0x4632 version 2, used in GTA IV,
>>4 ulelong x %d bytes,
>>>8 ulelong x %d entries
>2 uleshort 0x4633 version 3, used in GTA IV Audio & Midnight Club: LA,
>>4 ulelong x %d bytes,
>>>8 ulelong x %d entries
>2 uleshort 0x4634 version 4, used in Max Payne 3,
>>4 ulelong x %d bytes,
>>>8 ulelong x %d entries
>2 uleshort 0x4636 version 6, used in RDR,
>>4 ulelong x %d bytes,
>>>8 ulelong x %d entries
>2 uleshort 0x4637 version 7, used in GTA V,
>>4 ulelong x %d bytes,
>>>8 ulelong x %d entries
>2 uleshort 0x4638 version 8, used in RDR 2,
# RPF[0-8]
0 ulelong&0xfffffff0 =0x52504630
>0 ulelong&0xf <9 RAGE Package Format (RPF), version %d, used in
>>0 ulelong&0xf =0 Rockstar Table Tennis,
>>0 ulelong&0xf =1 *unknown*
>>0 ulelong&0xf =2 GTA IV,
>>0 ulelong&0xf =3 GTA IV Audio & Midnight Club: LA,
>>0 ulelong&0xf =4 Max Payne 3,
>>0 ulelong&0xf =5 *unknown*
>>0 ulelong&0xf =6 RDR,
>>0 ulelong&0xf =7 GTA V,
>>0 ulelong&0xf =8 RDR 2,
>>4 ulelong x %d bytes,
>>>8 ulelong x %d entries

10
magic/Magdir/geo
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: geo,v 1.7 2019/04/19 00:42:27 christos Exp $
# $File: geo,v 1.8 2022/03/24 15:48:58 christos Exp $
# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu>
######################################################################
@ -28,8 +28,8 @@
# Knudsen subbottom chirp profiler - Binary File Format: B9
# KEB D409-03167 V1.75 Huffman
0 string KEB\ Knudsen seismic KEL binary (KEB) -
>4 regex [-A-Z0-9]* Software: %s
>>&1 regex V[0-9]*\.[0-9]* version %s
>4 regex [-A-Z0-9]+ Software: %s
>>&1 regex V[0-9]+\\.[0-9]+ version %s
######################################################################
#
@ -40,7 +40,7 @@
# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data
0 string HCA LADS Caris Ascii Format (CAF) bathymetric lidar
>4 regex [0-9]*\.[0-9]* version %s
>4 regex [0-9]+\\.[0-9]+ version %s
0 string HCB LADS Caris Binary Format (CBF) bathymetric lidar waveform data
>3 byte x version %d .
@ -69,7 +69,7 @@
# mb121 https://www.saic.com/maritime/gsf/
8 string GSF-v SAIC generic sensor format (GSF) sonar data,
>&0 regex [0-9]*\.[0-9]* version %s
>&0 regex [0-9]+\\.[0-9]+ version %s
# MGD77 - https://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm
# mb161

3
magic/Magdir/iff
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: iff,v 1.17 2021/02/23 01:07:32 christos Exp $
# $File: iff,v 1.18 2022/03/21 19:57:18 christos Exp $
# iff: file(1) magic for Interchange File Format (see also "audio" & "images")
#
# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
@ -45,6 +45,7 @@
>8 string ACBM \b, ACBM continuous image
>8 string FAXX \b, FAXX fax image
>8 string STFX \b, ST-Fax image
>8 string IMAGIHDR \b, CD-i image
# other formats
>8 string FTXT \b, FTXT formatted text
>8 string CTLG \b, CTLG message catalog

2933
magic/Magdir/images
View File

File diff suppressed because it is too large Load Diff

204
magic/Magdir/intel
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: intel,v 1.20 2021/04/26 15:56:00 christos Exp $
# $File: intel,v 1.22 2022/04/02 14:47:42 christos Exp $
# intel: file(1) magic for x86 Unix
#
# Various flavors of x86 UNIX executable/object (other than Xenix, which
@ -43,7 +43,16 @@
# no hint found, that at offset 22 is version
#>22 leshort >0 - version %d
0 leshort 0x0200
>0 use display-coff
# no F_EXEC flag bit implies Intel ia64 COFF object file without optional header
>18 leshort ^0x0002
# skip some DEGAS high-res uncompressed bitmap *.pi3 handled by ./images like
# GEMINI03.PI3 MODEM2.PI3 POWERFIX.PI3 sigirl1.pi3 vanna5.pi3
# by test for valid starting character (often point 0x2E) of 1st section name
>>20 ubyte >0x1F
>>>0 use display-coff
# F_EXEC flag bit implies Intel ia64 COFF executable
>18 leshort &0x0002
>>0 use display-coff
0 leshort 0x8664
>0 use display-coff
@ -52,16 +61,191 @@
# From: Alex Myczko <alex@aiei.ch>
# updated by Joerg Jenderek
# https://en.wikipedia.org/wiki/Option_ROM
0 beshort 0x55AA BIOS (ia32) ROM Ext.
!:mime application/octet-stream
# URL: http://fileformats.archiveteam.org/wiki/BIOS
# Reference: http://www.lejabeach.com/sisubb/BIOS_Disassembly_Ninjutsu_Uncovered.pdf
0 beshort 0x55AA
# skip misidentified raspberry pi pieeprom-*.bin by check for
# unlikely high ROM size (0xF0*512=240*512) and not observed start instruction 0x0F
>2 ubeshort !0xF00F
# skip 2 byte sized eof.bin with start magic
>>0 use rom-x86
0 name rom-x86
>0 beshort x BIOS (ia32) ROM Ext.
#!:mime application/octet-stream
!:mime application/x-ibm-rom
!:ext rom/bin
>5 string USB USB
>7 string LDR UNDI image
################################################################################
# not Plug aNd Play ($PnP) like 00000000 (ide_xtp.bin kvmvapic.bin V7VGA.ROM) 000000fc (MCT-VGA.bin)
# 55aaf00f (pieeprom-*.bin) 55aa40e9 (Trm3x5.bin) 24506f4f (sgabios-bin.rom)
# 55aa4be9 (vgabios-stdvga.rom vgabios-cirrus-bin.rom vgabios-vmware-bin.rom)
>(26.s) ubelong !0x24506e50
#>(26.s) ubelong !0x24506e50 NOT PNP=%8.8x
# also not PCI (PCIR) implies "old" ISA cards or foo like: 8a168404 (MCT-VGA.bin)
# 55aaf00f (pieeprom*.bin)
>>(24.s) ubelong !0x50434952
#>>(24.s) ubelong !0x50434952 ISA CARD=%8.8x
# "old" identification strings used in file version 5.41 and earlier
# probably an USB controller
>>>5 string USB USB
# probably https://en.wikipedia.org/wiki/Preboot_Execution_Environment
>>>7 string LDR UNDI image
# probably another Adaptec SCSI controller
>>>26 string Adaptec Adaptec
# http://minuszerodegrees.net/rom/bin/adaptec_aha1542cp_bios_908501-00.bin
# already done by PNP variant
#>>>28 string Adaptec Adaptec
# probably Promise SCSI controller
>>>42 string PROMISE Promise
# old test for IBM compatible Video cards; INTERNAL FACTS WHY IS THIS WORKING?
>30 string IBM IBM comp. Video
>26 string Adaptec Adaptec
>28 string Adaptec Adaptec
>42 string PROMISE Promise
>2 byte x (%d*512)
# display exact text for IBM compatible Video cards with longer text
>>33 ubyte !0
>>>30 string x "%s"
# http://minuszerodegrees.net/rom/bin/unknown/MCT-VGA-16%20-%20TDVGA%203588%20BIOS%20Version%20V1.04A.zip
# "IBM COMPATIBLETDVGA 3588 BIOS Version V1.04A2+" "MCT-VGA-16 - TDVGA 3588 BIOS Version V1.04A.bin"
# "IBM VGA Compatible\001" NVidia44.bin
# "IBM EGA ROM Video Seven BIOS Code, Version 1.04" V7VGA.ROM
# "IBM" vgabios-stdvga.rom
# "IBM" vgabios-vmware-bin.rom:
# "IBM" vgabios-cirrus-bin.rom
# "IBM" vgabios-virtio-bin.rom
################################################################################
# ROM size in 512B blocks must be interpreted as unsigned for ROM of network cards
# like: efi-eepro100.rom efi-rtl8139.rom pxe-e1000.rom
>2 ubyte x (%u*512)
# file name file size calculated size remark
# eof.bin 2 - with start magic nothing is shown here
# orchid.bin 188 0 =0*512 on window 95 CD in Drivers\audio\orchid3d
# multiboot.bin 1024 1024 =2*512 QEMU emulator
# loader1.bin 512 2048 =4*512
# ide_xtp.bin 8192 8192 =16*512
# kvmvapic.bin 9216 9216 =18*512
# V7VGA.ROM 18832 16384 =32*512
# adaptec1542.bin 32768 16384 =32*512
# MCT-VGA.bin 32768 24576 =48*512
# 2975BIOS.BIN 32768 32256 =63*512
# efi-e1000.rom 196608 64000 =125*512
# efi-rtl8139.rom 176640 66048 =129*512
# pieeprom*.bin 524288 122880 =240*512
################################################################################
# initialization vector with executable code; often near JuMP instruction E9 yy zz
>3 ubyte =0xE9 jmp
# jmp offset like: 008fh 0093h 009fh 00afh 0143h 3ad7h 5417h 54ech 594dh 895fh
>>4 uleshort x %#4.4x
# for initialization vector samples without 3 byte jump instruction
>3 ubyte !0xE9 instruction
# eb4b3734h NVidia44.bin
# 00003234h V7VGA.ROM
# 060e0731h kvmvapic.bin
# cb000000h linuxboot-bin.rom
# e80d0fcbh PXE-Intel.rom
# b8004875h orchid.bin
>>3 ubelong x %#8.8x
# For misidetified raspberry pi pieeprom-*.bin like: 0xf00f
#>2 ubeshort x \b, AT 2 %#4.4x
################################################################################
# new sections for BIOS (ia32) ROM Extension
# 4 bytes ASCII Signature "$PnP" for Plug aNd Play expansion header
>(26.s) string =$PnP \b;
#>(26.s) string =$PnP FOUND $PnP
# at 1Ah possible offset to expansion header structure; new for Plug aNd Play
>>26 uleshort x at %#x PNP
# Plug and Play vendor+device ID like: 0 0x000f1000 (2975BIOS.BIN) 0x31121095 (4243.bin) 0x04904215 (adaptec1542.bin)
#>>(26.s+0x0A) ulelong !0 NOT-nullID=%8.8x
>>(26.s+0x0A) uleshort !0
# show PnP Vendor identification in human readable text form instead of numeric
# For adaptec_ava1515_bios_585201-00.bin reverted endian! BUT IS THIS ALWAYS TRUE?
>>>(26.s+0x0C) use \^PCI-vendor
>>>(26.s+0x0A) ubeshort x device=%#4.4x
# 3 byte Device type code; probably the same meaning as in PCI section?
# OK for storage controller SCSI (2975BIOS.BIN adaptec1542.bin)
# and network controller ethernet (efi-e1000.rom efi-rtl8139.rom)
>>(26.s+0x12) use PCI-class
# structure revision like: 01h
>>(26.s+4) ubyte !1 \b, revision %u
# PnP Header structure length in multiple of 16 bytes like: 2
>>(26.s+5) uleshort !2 \b, length %u*16
# offset to next header; 0 if none
>>(26.s+7) uleshort !0 \b, at %#x next header
# reserved byte; seems to be zero
>>(26.s+8) ubyte !0 \b, reserved %#x
# 8-bit checksum for this header; calculated and patched by patch2pnprom
>>(26.s+9) ubyte !0 \b, CRC %#x
# pointer to optional manufacturer string; like: 0 (4243.bin) 59h 5ch 60h c7h 14eh 27ch 296h 324h 3662h
>>(26.s+0x0E) uleshort >0 \b, at %#x
>>>(26.s+0x0C) uleshort x
# manufacturer ASCII-Z string like "http://ipxe.org" "Plop - Elmar Hanlhofer www.plop.at" "QEMU"
>>>>(&0.s) string x "%s"
# pointer to optional product string; like: 0 (2975BIOS.BIN) 6ch 70h 7ch d9h 160h 281h 29bh 329h
>>(26.s+0x10) uleshort >0 \b, at %#x
>>>(26.s+0x0E) uleshort x
# often human readable product ASCII-Z string like "iPXE" "Plop Boot Manager"
# "multiboot loader" "Intel UNDI, PXE-2.0 (build 082)"
>>>>(&0.s) string x "%s"
# PnP Device indicators; contains bits that identify the device as being capable of bootable
#>>(26.s+0x15) ubyte x \b, INDICATORS %#x
# device is a display device
>>(26.s+0x15) ubyte &0x01 \b, display
# device is an input device
>>(26.s+0x15) ubyte &0x02 \b, input
# device is an IPL device
>>(26.s+0x15) ubyte &0x04 \b, IPL
#>>(26.s+0x15) ubyte &0x08 reserved
# ROM is only required if this device is selected as a boot device
>>(26.s+0x15) ubyte &0x10 \b, bootable
# indicates ROM is read cacheable
>>(26.s+0x15) ubyte &0x20 \b, cacheable
# ROM may be shadowed in RAM
>>(26.s+0x15) ubyte &0x40 \b, shadowable
# ROM supports the device driver initialization model
>>(26.s+0x15) ubyte &0x80 \b, InitialModel
# boot connection vector; an offset to a routine that hook into INT 9h, INT 10h, or INT 13h
# 0 means disabled 0x0429 (4650_sr5.bin) 0x0072 (adaptec1542.bin)
>>(26.s+0x16) uleshort !0 \b, boot vector offset %#x
# disconnect vector; offset to routine that do cleanup from an unsuccessful boot attempt
>>(26.s+0x18) uleshort !0 \b, disconnect offset %#x
# bootstrap entry point/vector (BEV); offset to a routine (like RPL) that hook into INT 19h
# 0 means disabled 0x3c (multiboot.bin) 0x358 (efi-rtl8139.rom) 0xae7 (PXE-Intel.rom)
>>(26.s+0x1A) uleshort !0 \b, bootstrap offset %#x
# 2nd reserved area; seems to be zero
>>(26.s+0x1C) uleshort !0 \b, 2nd reserved %#x
# static resource information vector; 0 means disabled
>>(26.s+0x1E) uleshort !0 \b, static offset %#4.4x
################################################################################
# 4 bytes ASCII Signature "PCIR" for PCI Data Structure
#>(24.s) string =PCIR FOUND PCIR
>(24.s) string =PCIR \b;
# pointer to PCI data structure like: 1Ch 38h 104h 8E44h
>>24 uleshort x at %#x PCI
# Vendor identification (ID) https://pci-ids.ucw.cz/v2.2/pci.ids
#>>(24.s+4) uleshort x ID=%4.4x
# show Vendor identification in human readable text form instead of numeric
>>(24.s+4) use PCI-vendor
# device identification (ID)
>>(24.s+6) uleshort x device=%#4.4x
# Base+sub class code https://wiki.osdev.org/PCI
>>(24.s+0x0D) use PCI-class
# pointer to vital product data (VPD); 0 indicates no VPD; WHAT EXACTLY iS VPD?
>>(24.s+8) uleshort !0 \b, at %#x VPD
# PCI data structure length like: 24h 28h
>>(24.s+0xA) uleshort >0x28 \b, length %u
# PCI data structure revision like: 0 3
>>(24.s+0xC) ubyte >0 \b, revison %u
# image length (hexadecimal) in multiple of 512 bytes like: 54 56 68 6a 76 78 7c 7d 7e 7f 80 81 83
# Apparently this gives the same information as given by byte at offset 2 but as 16-bit
#>>(24.s+0x10) uleshort x \b, length %u*512
# revision level of code/data like: 0 1 201h 502h
>>(24.s+0xC) ubyte >1 \b, code revison %#x
# code type: 0~Intel x86/PC-AT compatible 1~Open firmware standard for PCI42 FF~Reserved
>>(24.s+0x14) ubyte >0 \b, code type %#x
# last image indicator; bit 7 indicates "last image"; bits 0-6 are reserved
>>(24.s+0x15) ubyte >0
>>>(24.s+0x15) ubyte =0x80 \b, last ROM
# THIS SHOULD NOT HAPPEN!
>>>(24.s+0x15) ubyte !0x80 \b, indicator %x
# 3rd reserved area; seems to be zero in most cases but not for
# efi-e1000.rom efi-rtl8139.rom
>>(24.s+0x16) ubeshort !0 \b, 3rd reserved %#x
# Flash descriptors for Intel SPI flash roms.
# From Dr. Jesus <j@hug.gs>

14
magic/Magdir/javascript
View File

@ -1,19 +1,19 @@
#------------------------------------------------------------------------------
# $File: javascript,v 1.2 2019/08/05 10:34:26 christos Exp $
# $File: javascript,v 1.3 2021/12/08 13:42:00 christos Exp $
# javascript: magic for javascript and node.js scripts.
#
0 search/1/w #!/bin/node Node.js script text executable
0 string/w #!/bin/node Node.js script text executable
!:mime application/javascript
0 search/1/w #!/usr/bin/node Node.js script text executable
0 string/w #!/usr/bin/node Node.js script text executable
!:mime application/javascript
0 search/1/w #!/bin/nodejs Node.js script text executable
0 string/w #!/bin/nodejs Node.js script text executable
!:mime application/javascript
0 search/1/w #!/usr/bin/nodejs Node.js script text executable
0 string/w #!/usr/bin/nodejs Node.js script text executable
!:mime application/javascript
0 search/1 #!/usr/bin/env\ node Node.js script text executable
0 string #!/usr/bin/env\ node Node.js script text executable
!:mime application/javascript
0 search/1 #!/usr/bin/env\ nodejs Node.js script text executable
0 string #!/usr/bin/env\ nodejs Node.js script text executable
!:mime application/javascript
# Hermes by Facebook https://hermesengine.dev/
# https://github.com/facebook/hermes/blob/master/include/hermes/\

6
magic/Magdir/linux
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: linux,v 1.79 2021/04/26 15:56:00 christos Exp $
# $File: linux,v 1.80 2022/03/24 15:48:58 christos Exp $
# linux: file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
@ -532,6 +532,6 @@
# ansible vault (does not really belong here)
0 string $ANSIBLE_VAULT; Ansible Vault
>&0 regex [0-9]*\.[0-9]* \b, version %s
>&0 regex [0-9]+\\.[0-9]+ \b, version %s
>>&0 string ;
>>>&0 regex [A-Z0-9]* \b, encryption %s
>>>&0 regex [A-Z0-9]+ \b, encryption %s

29
magic/Magdir/make
View File

@ -1,36 +1,21 @@
#------------------------------------------------------------------------------
# $File: make,v 1.4 2018/05/29 17:26:02 christos Exp $
# $File: make,v 1.5 2022/03/12 15:09:47 christos Exp $
# make: file(1) magic for makefiles
#
# URL: https://en.wikipedia.org/wiki/Make_(software)
0 regex/100l \^CFLAGS makefile script text
!:mime text/x-makefile
0 regex/100l \^VPATH makefile script text
!:mime text/x-makefile
0 regex/100l \^LDFLAGS makefile script text
!:mime text/x-makefile
0 regex/100l \^all: makefile script text
!:mime text/x-makefile
0 regex/100l \^\\.PRECIOUS makefile script text
0 regex/100l \^(CFLAGS|VPATH|LDFLAGS|all:|\\.PRECIOUS) makefile script text
!:mime text/x-makefile
!:strength -15
# Update: Joerg Jenderek
# Reference: https://www.freebsd.org/cgi/man.cgi?make(1)
# exclude grub-core\lib\libgcrypt\mpi\Makefile.am with "#BEGIN_ASM_LIST"
# by additional escaping point character
0 regex/100l \^\\.BEGIN BSD makefile script text
!:mime text/x-makefile
!:ext /mk
!:strength +10
# exclude MS Windows help file CoNtenT with ":include FOOBAR.CNT"
# and NSIS script with "!include" by additional escaping point character
0 regex/100l \^\\.include BSD makefile script text
0 regex/100l \^\\.(BEGIN|endif|include) BSD makefile script text
!:mime text/x-makefile
!:ext /mk
!:strength +10
0 regex/100l \^\\.endif BSD makefile script text
!:strength -10
0 regex/100l \^SUBDIRS[[:space:]]+= automake makefile script text
!:mime text/x-makefile
!:ext /mk
!:strength +10
0 regex/100l \^SUBDIRS automake makefile script text
!:mime text/x-makefile
!:strength +10
!:strength -15

33
magic/Magdir/mathematica
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: mathematica,v 1.13 2021/07/14 09:06:24 christos Exp $
# $File: mathematica,v 1.14 2021/11/07 16:27:36 christos Exp $
# mathematica: file(1) magic for mathematica files
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Mathematica a multi-purpose math program
@ -117,16 +117,29 @@
13 ushort 0
# check for valid ASCII matrix name
>20 ubyte >0x1F
# skip PreviousEntries.dat with "invalid high" name \304P\344@\001
>>20 ubyte <0304
# skip some Netwfw*.dat and $I3KREPH.dat by checking for non zero number of rows
>>>4 ulong !0
# skip some CD-ROM filesystem like test-hfs.iso by looking for valid big endian type flag
>>0 ubelong&0xFFffFF00 0x00000300
>>>0 use matlab4
>>>>0 ubelong&0xFFffFF00 0x00000300
>>>>>0 use matlab4
# no example for 8-bit and 16-bit integers matrix
>>0 ubelong&0xFFffFF00 0x00000400
>>>0 use matlab4
>>0 ulelong x
>>>>0 ubelong&0xFFffFF00 0x00000400
>>>>>0 use matlab4
# branch for Little-Endian variant of Matlab MATrix version 4
# skip big endian variant by looking for valid low lttle endian type flag
>>0 ulelong <53
>>>0 use \^matlab4
>>>>0 ulelong <53
# skip tokens.dat and some Netwfw*.dat by check for valid imaginary flag value of MAT version 4
>>>>>12 ulelong <2
# no misidentfied little endian MATrix example with "short" matrix name
>>>>>>16 ulelong <3
>>>>>>>0 use \^matlab4
# little endian MATrix with "long" matrix name or some misidentified samples
>>>>>>16 ulelong >2
# skip TileCacheLogo-*.dat with invalid 2nd character \001 of matrix name with length 96
>>>>>>>21 ubyte >0x1F
>>>>>>>>0 use \^matlab4
# display information of Matlab v4 mat-file
0 name matlab4 Matlab v4 mat-file
#!:mime application/octet-stream
@ -145,8 +158,10 @@
>0 ubelong/1000 4 (Cray)
# namlen; the length of the matrix name
#>16 ubelong x \b, name length %u
#>(16.L+19) ubyte x \b, TERMINATING NAME CHARACTER=%#x
# nul terminated matrix name like: fit_params testmatrix testsparsecomplex teststringarray
#>20 string x \b, MATRIX NAME="%s"
#>21 ubyte x \b, MAYBE 2ND CHAR=%c
>16 pstring/L x %s
# T indicates the matrix type: 0~numeric 1~text 2~sparse
#>0 ubelong%10 x \b, T=%u
@ -158,5 +173,5 @@
# ncols; number of columns in the matrix like: 1 3 4 5 9 43
>8 ubelong x \b, columns %u
# imagf; imaginary flag; 1~matrix has an imaginary part 0~only real data
>12 ubelong !0 \b, imaginary
>12 ubelong !0 \b, imaginary (%u)
# real; Real part of the matrix consists of mrows * ncols numbers

16
magic/Magdir/mcrypt
View File

@ -1,14 +1,28 @@
#------------------------------------------------------------------------------
# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $
# $File: mcrypt,v 1.6 2022/02/08 18:51:45 christos Exp $
# Mavroyanopoulos Nikos <nmav@hellug.gr>
# mcrypt: file(1) magic for mcrypt 2.2.x;
# URL: https://en.wikipedia.org/wiki/Mcrypt
# http://fileformats.archiveteam.org/wiki/MCrypt
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/n/nc-mcrypt.trid.xml
# Update: Joerg Jenderek
# Note: called by TrID "mcrypt encrypted (v2.5)"
0 string \0m\3 mcrypt 2.5 encrypted data,
#!:mime application/octet-stream
!:mime application/x-crypt-nc
!:ext nc
>4 string >\0 algorithm: %s,
>>&1 leshort >0 keysize: %d bytes,
>>>&0 string >\0 mode: %s,
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/n/nc-mcrypt-22.trid.xml
# Note: called by TrID "mcrypt encrypted (v2.2)"
0 string \0m\2 mcrypt 2.2 encrypted data,
#!:mime application/octet-stream
!:mime application/x-crypt-nc
# no example
!:ext nc
>3 byte 0 algorithm: blowfish-448,
>3 byte 1 algorithm: DES,
>3 byte 2 algorithm: 3DES,

38
magic/Magdir/msdos
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: msdos,v 1.152 2021/10/12 18:26:10 christos Exp $
# $File: msdos,v 1.154 2022/03/21 21:25:50 christos Exp $
# msdos: file(1) magic for MS-DOS files
#
@ -1367,6 +1367,8 @@
# HtmlHelp files (.chm)
0 string/b ITSF\003\000\000\000\x60\000\000\000 MS Windows HtmlHelp Data
!:mime application/vnd.ms-htmlhelp
!:ext chm
# GFA-BASIC (Wolfram Kleff)
2 string/b GFA-BASIC3 GFA-BASIC 3 data
@ -1765,3 +1767,37 @@
# NB: The BACKUP.nnn files consist of the files backed up,
# concatenated.
# From: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_date/time
# Reference: https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-dosdatetimetofiletime
# Note: DOS date+time format is different from formats such as Unix epoch
# bit encoded; uses year values relative to 1980 and 2 second precision
0 name dos-date
# HHHHHMMMMMMSSSSS bit encoded Hour (0-23) Minute (0-59) SecondPart (*2)
#>0 uleshort x RAW TIME [%#4.4x]
# hour part
#>0 uleshort/2048 x hour [%u]
# YYYYYMMMMDDDDD bit encoded YearPart (+1980) Month (1-12) Day (1-31)
#>2 uleshort x RAW DATE [%#4.4x]
# day part
>2 uleshort&0x001F x %u
#>2 uleshort/16 x MONTH PART [%#x]
# GRR: not working
#>2 uleshort/16 &0x000F MONTH [%u]
#>2 uleshort&0x01E0 x MONTH PART [%#4.4x]
>2 uleshort&0x01E0 =0x0020 jan
>2 uleshort&0x01E0 =0x0040 feb
>2 uleshort&0x01E0 =0x0060 mar
>2 uleshort&0x01E0 =0x0080 apr
>2 uleshort&0x01E0 =0x00A0 may
>2 uleshort&0x01E0 =0x00C0 jun
>2 uleshort&0x01E0 =0x00E0 jul
>2 uleshort&0x01E0 =0x0100 aug
>2 uleshort&0x01E0 =0x0120 sep
>2 uleshort&0x01E0 =0x0140 oct
>2 uleshort&0x01E0 =0x0160 nov
>2 uleshort&0x01E0 =0x0180 dec
# year part
>2 uleshort/512 x 1980+%u
#

9
magic/Magdir/msooxml
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: msooxml,v 1.16 2021/08/16 10:06:55 christos Exp $
# $File: msooxml,v 1.17 2021/11/08 13:53:43 christos Exp $
# msooxml: file(1) magic for Microsoft Office XML
# From: Ralf Brown <ralf.brown@gmail.com>
@ -30,7 +30,7 @@
# make sure the first file is correct
>0x1E use msooxml
>0x1E default x
>>0x1E regex \\[Content_Types\\]\\.xml|_rels/\\.rels|docProps
>>0x1E regex \\[Content_Types\\]\\.xml|_rels/\\.rels|docProps|customXml
# skip to the second local file header
# since some documents include a 520-byte extra field following the file
# header, we need to scan for the next header
@ -46,5 +46,10 @@
# OpenOffice/Libreoffice orders ZIP entry differently, so check the 4th file
>>>>>>&26 search/6000 PK\003\004
>>>>>>>&26 use msooxml
# Some OOXML generators add an extra customXml directory. Check another file.
>>>>>>>&26 default x
>>>>>>>>&26 search/6000 PK\003\004
>>>>>>>>>&26 use msooxml
>>>>>>>>>&26 default x Microsoft OOXML
>>>>>>>&26 default x Microsoft OOXML
>>>>>&26 default x Microsoft OOXML

161
magic/Magdir/msvc
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: msvc,v 1.10 2018/10/01 19:14:03 christos Exp $
# $File: msvc,v 1.11 2022/01/17 17:17:30 christos Exp $
# msvc: file(1) magic for msvc
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Microsoft visual C
@ -20,9 +20,162 @@
0 string \377\003\000\377\001\000\060\020\350 MSVC .res
#.lib
0 string \360\015\000\000 Microsoft Visual C library
0 string \360\075\000\000 Microsoft Visual C library
0 string \360\175\000\000 Microsoft Visual C library
# URL: https://en.wikipedia.org/wiki/Microsoft_Visual_C%2B%2B
# http://fileformats.archiveteam.org/wiki/Microsoft_Library
# http://fileformats.archiveteam.org/wiki/OMF
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lib-msvc.trid.xml
# https://pierrelib.pagesperso-orange.fr/exec_formats/OMF_v1.1.pdf
# Update: Joerg Jenderek
#0 string \360\015\000\000 Microsoft Visual C library
#0 string \360\075\000\000 Microsoft Visual C library
#0 string \360\175\000\000 Microsoft Visual C library
# test for RecordType~LibraryHeaderRecord=0xF0 + RecordLength=???Dh + dictionary offset is multiple of 0x200
0 ubelong&0xFF0f80ff =0xF00d0000
# Microsoft Visual C library (strength=70) before MIDI SysEx messages (strength=50) handled by ./sysex
#!:strength +0
# test for valid 2nd RecordType~Translator Header Record=THEADR=80h or LHEADR=82h
>(1.s+3) ubyte&0xFD =0x80
>>0 use omf-lib
# display information about Microsoft Visual C/OMF library
0 name omf-lib
# RecordType~LibraryHeaderRecord=0xF0
#>0 byte 0xF0 Microsoft Visual C library
# the above description was used in file version 5.41
>0 byte 0xF0 Microsoft Visual C/OMF library
#>0 byte 0xF0 relocatable Object Module Format (OMF) libray
#!:mime application/octet-stream
!:mime application/x-omf-lib
!:ext lib
# 1st record data length like 13=0Dh 29=1Dh 61=3Dh 125=7Dh 509=01FDh ... 32765=7FFDh
#>1 uleshort x \b, 1st record data length %u
#>1 uleshort x \b, 1st record data length %#x
# 2**4=16 <= RecordLength+3 = PageSize = 2**n {16 32 512 no examples 64 128 256 1024 2048 ...32768} <= 2**15=32768
>1 uleshort+3 x \b, page size %u
# dictionary offset like: 400h 600h a00h c00h 1200h 1800h 2400h 5600h 12800h 19200h 28a00h
>3 ulelong x \b, at %#x dictionary
# dictionary block a 512 bytes; the first 37 bytes correspond to the 37 buckets
#>(3.l) ubequad x (%#16.16llx...)
# dictionary size; length in 512-byte blocks; a prime number? like:
# 1 2 3 4 5 6 7 9 11 13 15 16 18 21 22 23 24 25 31 50 53 89 101 117 277
>7 uleshort x with %u block
# plurals s
>7 uleshort >1 \bs
# If dictionary byte 38 (FFLAG) has the value 255, there is no space left
>(3.l+37) ubyte <0xFF (FFLAG=%#x)
>(3.l+37) ubyte =0xFF (FFLAG=full)
# dictionary entry; length byte of following symbol, the following text bytes of symbol, two bytes specifies the page number
# like: dbfntx1! DBFNTX.LIB zlibCompileFlags_ ZLIB.LIB atoi! mwlibc.lib
>(3.l+38) pstring x 1st entry %s
# like: 1 33 41 47 458 8783
>>&0 uleshort x in page %u
# library flags; 0 or 1, but WHAT IS 0x4d in MOUSE.LIB ?
>9 ubyte >1 \b, flags %#x
>9 ubyte =1 case sensitive
# In the library after header comes first object module with a Library Module Header Record (LHEADR=82h)
# but in examples Translator Header Record (THEADR=80h) which is handled identically
>(1.s+3) ubyte x \b, 2nd record
>(1.s+3) ubyte !0x80 (type %#x)
#>(1.s+4) uleshort x \b, 2nd record data length %u
# Module name often source name like "dos\crt0.asm" in mlibce.lib or "QB4UTIL.ASM" in QB4UTIL.LIB
# or "C:\Documents and Settings\Allan Campbell\My Documents\FDOSBoot\zlib\zutil.c" in ZLIB.LIB
# or title like "87INIT" in FP87.LIB or "ACOSASIN" in MATHC.LIB or "Copyright" in calc-bcc.lib
>(1.s+6) pstring x "%s"
# 2nd record checksum
#>>&0 ubyte x checksum %#x
# 3rd RecordType: 96h~LNAMES 88h~COMENT
>>&1 ubyte x \b, 3rd record
>>&1 ubyte !0x88
>>>&-1 ubyte !0x96
# 3rd unusual record type
>>>>&-1 ubyte x (type %#x)
# 3rd record is a List of Names Record (LNAMES=96h)
>>&1 ubyte =0x96 LNAMES
# LNAMES record length like: 2 15 19
#>>>&0 uleshort x \b, LNAMES record length %u
>>>&0 uleshort >2
# 1st LNAME string length; null is valid; maximal 255
#>>>>&0 ubyte x 1st LNAME length %u
>>>>&0 ubyte =0
# 2nd LNAME length like: 4 7 8 17 31
#>>>>>&0 ubyte x 2nd LNAME length %u
# name used for segment, class, group, overlay, etc like:
# CODE (mwlibc.lib) _TEXT32 (JMPPM32.LIB) _OVLCODE (WOVL.LIB)
>>>>>&0 pstring x %s
# 3rd LNAME length like: 4 5
#>>>>>>&0 ubyte x 3rd LNAME length %u
# like: DATA (mwlibc.lib) CODE (JMPPM32.LIB) _TEXT (EMU87.LIB)
>>>>>>&0 pstring x %s
# maybe 4th LNAME length like: 4 6
>>>>>>>&0 ubyte <44
# like: DATA (DEBUG.LIB) DGROUP (mwlibc.lib MOUSE.LIB)
>>>>>>>>&-1 pstring x %s
# 3rd record is a COMMENT (Including all comment class extensions)
>>&1 ubyte =0x88 COMMENT
# comment record length like: 3 FLIB7M.LIB 1Bh 1Eh 23h 27h 2Bh 30h freetype-bcc.lib
#>>>&0 uleshort x \b, record length %#x
# real comment length = record length - 1 (comment type) - 1 (comment Class) - 1 (checksum) -1 (char count)
# like: 2 LIBFL.LIB 4 "UUID" 5 "dscap" 6 "int386" 7 "qb4util" 8 "AMSGEXIT" 16 REXX.LIB 20 27 35 44 freetype-bcc.lib
#>>>>&-2 uleshort-4 >0 \b, comment length %u
# check that record contain at least comment type (1 byte), comment class (1 byte), checksum (1 byte)
# probably always true
>>>&0 uleshort >2
# comment type: 80h~NP~no purge bit 40h~NL~no list bit
#>>>>&0 ubyte !0 Type %#x
>>>>&0 ubyte &0x80 Preserved
# no example
>>>>&0 ubyte &0x40 NoList
# comment class like: 0~Translator A0~OMF extensions A3~LIBMOD A1~New OMF extensions AA~UNKNOWN
>>>>&1 ubyte x class=%#x
# check that comment record contains at least real content
>>>>&-2 uleshort >3
# Translator comment record (0); it may name the source language or translator
>>>>>&1 ubyte =0 Translator
#>>>>>>&0 ubyte x Translator length %u
# like: "TC86 Borland Turbo C 2.01 " (GEMS.LIB) "TC86 Borland Turbo C++ 3.00" (CATDB.LIB)
>>>>>>&0 pstring x "%s"
# OMF extensions comment record (A0); first byte of commentary string identifies subtype
>>>>>&1 ubyte =0xA0 OMF extensions
# A0 subtype like: 1~IMPDEF
>>>>>>&0 ubyte !1 subtype %#x
# Import Definition Record (Comment Class A0, Subtype 01~IMPDEF)
>>>>>>&0 ubyte 1 IMPDEF
# ordinal flag; determines form of Entry Ident field. If nonzero (seems to be 1) Entry is ordinal
>>>>>>>&0 ubyte !0 ordinal
# like: IMPORT.LIB DOSCALLS.LIB mlibw.lib mwinlibc.lib REXX.LIB
>>>>>>>>&-1 ubyte >1 %u
# Internal Name in count, char string format; module name for the imported symbol
# like: 7 "REXXSAA" 9 11 13 14 15 16 20 21 26 "_Z10_clip_linePdS_S_S_dddd"
#>>>>>>>&1 ubyte x internal name length %u
# internal module name like: _DllGetVersion DllGetVersion BezierTerminationTest Copyright
>>>>>>>&1 pstring x %s
# module name in count, char string format; DLL name that supplies a matching export symbol
# like: jpeg62.dll (jpeg-bcc.lib) unrar3.dll (unrar-bcc.lib) REXX (REXX.LIB)
>>>>>>>>&0 pstring x exported by %s
# Entry Ident; 16-bit if ordinal flag != 0 or imported name in count, char string format if ordinal flag = 0
# like: \0 (calc-bcc.lib) DllGetVersion (libtiff-bcc.lib) UTF8ToHtml (libxml2-bcc.lib) xslAddCall (libxslt-bcc.lib)
#>>>>>>>>>&0 pstring >\0 entry ident %s
# "New OMF" extensions comment (A1); indicate version of symbolic debug information
# like: LIBFL.LIB
>>>>>&1 ubyte =0xA1 New OMF extensions
# symbolic debug information version n
>>>>>>&0 ubyte x n=%u
# symbolic debug information style like: HL~IBM PM Debugger style (LIBFL.LIB) DX~AIX style CV~Microsoft symbol and type style
>>>>>>>&0 string HL IBM style
>>>>>>>&0 string DX AIX style
>>>>>>>&0 string CV Microsoft style
# LIBMOD comment record (A3) used only by the librarian
# Microsoft extension added for LIB version 3.07 in macro assembler (MASM 5.0)
>>>>>&1 ubyte =0xA3 LIBMOD
# The A3 LIBMOD record contains only the ASCII string of the module name in count char format
#>>>>>>&0 ubyte x LIBMOD length %u
# LIBMOD comment record module name without path and extension like:
# qb4util (QB4UTIL.LIB) affaldiv (libh.lib) crt0 (slibc.lib) clipper (DDDRAWS.LIB) dinpdev (DINPUTS.LIB) UUID (UUID.LIB)
>>>>>>&0 pstring x %s
# GRR: WHAT iS THAT? AA foo comment record
#>>>>>&1 ubyte =0xAA AA-comment
# like: OS220
#>>>>>>&0 string x what=%-5.5s
#
#.pch
0 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch

202
magic/Magdir/nifty Normal file
View File

@ -0,0 +1,202 @@
#------------------------------------------------------------------------------
# $File: nifty,v 1.1 2022/02/14 16:51:15 christos Exp $
# file(1) magic for the NIfTI file format
# Type: NIfTI, Neuroimaging file format
# URL: https://nifti.nimh.nih.gov/
# From: Yann Leprince <yann.leprince@cea.fr>, 2022
344 string n+1\0 NIfTI-1 neuroimaging data,
!:mime image/x.nifti
!:ext nii
>0 use nifti1
344 string ni1\0 NIfTI-1 neuroimaging data header,
!:mime image/x.nifti
!:ext hdr
>0 use nifti1
4 string n+2\0\r\n\032\n NIfTI-2 neuroimaging data,
!:mime image/x.nifti
!:ext nii
>0 use nifti2
4 string ni2\0\r\n\032\n NIfTI-2 neuroimaging data header,
!:mime image/x.nifti
!:ext hdr
>0 use nifti2
# Main subroutine for NIfTI-1
0 name nifti1
>0 clear x
>0 lelong =348 little endian
>>70 use nifti-datatype-le
>>112 lefloat !0 with scaling
>>0 use nifti1-dim-le
>>252 leshort >0 \b, with qform
>>>252 use xform-code-nifti1-le
>>254 leshort >0 \b, with sform
>>>254 use xform-code-nifti1-le
>>136 string >\0 \b, description: %s
>0 belong =348 big endian
>>70 use \^nifti-datatype-le
>>112 befloat !0 with scaling
>>0 use \^nifti1-dim-le
>>252 beshort >0 \b, with qform
>>>252 use \^xform-code-nifti1-le
>>254 beshort >0 \b, with sform
>>>254 use \^xform-code-nifti1-le
>>136 string >\0 \b, description: %s
>0 default x
>>0 long x invalid sizeof_hdr=%d
# Main subroutine for NIfTI-2
0 name nifti2
>0 clear x
>0 lelong =540 little endian
>>12 use nifti-datatype-le
>>176 lefloat !0 with scaling
>>0 use nifti2-dim-le
>>344 lelong >0 \b, with qform
>>>344 use xform-code-nifti2-le
>>348 lelong >0 \b, with sform
>>>348 use xform-code-nifti2-le
>>240 string >\0 \b, description: %s
>0 belong =540 big endian
>>12 use \^nifti-datatype-le
>>176 befloat !0 with scaling
>>0 use \^nifti2-dim-le
>>344 lelong >0 \b, with qform
>>>344 use \^xform-code-nifti2-le
>>348 lelong >0 \b, with sform
>>>348 use \^xform-code-nifti2-le
>>240 string >\0 \b, description: %s
>0 default x
>>0 long x invalid sizeof_hdr=%d
# Other subroutines for details of NIfTI files
0 name nifti-datatype-le
>0 clear x
>0 leshort =1 \b, binary datatype
>0 leshort =2 \b, uint8 datatype
>0 leshort =4 \b, int16 datatype
>0 leshort =8 \b, int32 datatype
>0 leshort =16 \b, float32 datatype
>0 leshort =32 \b, complex64 datatype
>0 leshort =64 \b, float64 datatype
>0 leshort =128 \b, RGB24 datatype
>0 leshort =256 \b, int8 datatype
>0 leshort =512 \b, uint16 datatype
>0 leshort =768 \b, uint32 datatype
>0 leshort =1024 \b, int64 datatype
>0 leshort =1280 \b, uint64 datatype
>0 leshort =1536 \b, float128 datatype
>0 leshort =1792 \b, complex128 datatype
>0 leshort =2048 \b, complex256 datatype
>0 leshort =2304 \b, RGBA32 datatype
>0 default x
>>0 leshort x \b, unknown datatype 0x%x
>>2 leshort x (%d bits/pixel)
0 name nifti1-dim-le
>0 clear x
>40 leshort <0 \b, INVALID dim[0]=%d
>40 leshort >7 \b, INVALID dim[0]=%d
>0 default x
>>40 leshort x \b, %d-dimensional (size
>>42 leshort x %d
>>40 leshort >1
>>>44 leshort x \bx%d
>>40 leshort >2
>>>46 leshort x \bx%d
>>40 leshort >3
>>>48 leshort x \bx%d
>>40 leshort >4
>>>50 leshort x \bx%d
>>40 leshort >5
>>>52 leshort x \bx%d
>>40 leshort >6
>>>54 leshort x \bx%d
>>80 lefloat x \b, voxel size %f
>>40 leshort >1
>>>84 lefloat x x %f
>>40 leshort >2
>>>88 lefloat x x %f
>>123 use nifti1-xyz-unit
>>40 leshort >3
>>>92 lefloat x x %f
>>>123 use nifti1-t-unit
>>40 leshort x \b)
0 name nifti2-dim-le
>0 clear x
>16 lequad <0 \b, INVALID dim[0]=%lld
>16 lequad >7 \b, INVALID dim[0]=%lld
>0 default x
>>16 lequad x \b, %lld-dimensional (size
>>24 lequad x %lld
>>16 lequad >1
>>>32 lequad x \bx%lld
>>16 lequad >2
>>>40 lequad x \bx%lld
>>16 lequad >3
>>>48 lequad x \bx%lld
>>16 lequad >4
>>>56 lequad x \bx%lld
>>16 lequad >5
>>>64 lequad x \bx%lld
>>16 lequad >6
>>>72 lequad x \bx%lld,
>>112 ledouble x \b, voxel size %f
>>16 lequad >1
>>>120 ledouble x x %f
>>16 lequad >2
>>>128 ledouble x x %f
>>500 use nifti2-xyz-unit
>>16 lequad >3
>>>136 ledouble x x %f
>>>500 use nifti2-t-unit
>>16 lequad x \b)
0 name xform-code-nifti1-le
>0 leshort =1 to scanner-based coordinates
>0 leshort =2 to aligned coordinates
>0 leshort =3 to Talairach coordinates
>0 leshort =4 to MNI152 coordinates
>0 leshort =5 to template coordinates
0 name xform-code-nifti2-le
>0 lelong =1 to scanner-based coordinates
>0 lelong =2 to aligned coordinates
>0 lelong =3 to Talairach coordinates
>0 lelong =4 to MNI152 coordinates
>0 lelong =5 to template coordinates
0 name nifti1-xyz-unit
>0 byte &0x01
>>0 byte ^0x02 m
>>0 byte &0x02 micron
>0 byte ^0x01
>>0 byte &0x02 mm
0 name nifti1-t-unit
>0 byte &0x08
>>0 byte ^0x10 s
>>0 byte &0x10 ms
>0 byte ^0x08
>>0 byte &0x10 microsecond
0 name nifti2-xyz-unit
>0 lelong &0x01
>>0 lelong ^0x02 m
>>0 lelong &0x02 micron
>0 lelong ^0x01
>>0 lelong &0x02 mm
0 name nifti2-t-unit
>0 lelong &0x08
>>0 lelong ^0x10 s
>>0 lelong &0x10 ms
>0 lelong ^0x08
>>0 lelong &0x10 microsecond

101
magic/Magdir/ole2compounddocs
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: ole2compounddocs,v 1.12 2021/09/04 16:00:38 christos Exp $
# $File: ole2compounddocs,v 1.18 2022/05/31 17:38:36 christos Exp $
# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
# Additional tests for OLE 2 Compound Documents should be under this recipe.
@ -200,6 +200,22 @@
!:mime application/x-ms-info
!:ext nfo
#
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Microsoft_Access
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mdz.trid.xml
# http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
# Note: only version foo tested and called "Microsoft Access Wizard template" by TrID
# Fourth directory entry name TemplateID
>>>>384 lestring16 TemplateID : Microsoft Access wizard template
# Second directory entry name like \005SummaryInformation and 3rd name like \005DocumentSummaryInformation
#!:mime application/x-ole-storage
#!:mime application/vnd.ms-office
#!:mime application/vnd.ms-access
#!:mime application/msaccess
!:mime application/x-ms-mdz
# http://extension.nirsoft.net/mdz
!:ext mdz
#
# URL: http://fileformats.archiveteam.org/wiki/Corel_Print_House
# Second directory entry name Thumbnail
>>>>128 lestring16 Thumbnail : Corel PrintHouse image
@ -258,6 +274,24 @@
!:ext prd/prv
# 2nd directory entry name Pictures
>>>>>>128 lestring16 Pictures with pictures
#
# URL: http://fileformats.archiveteam.org/wiki/PageMaker
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p
# pagemaker-generic.trid.xml
# pagemaker-pm6.trid.xml
# pagemaker-pm65.trid.xml
# pmd-pm7.trid.xml
# From: Joerg Jenderek
# Note: since version 6 embedd as stream with PageMaker name the "old" format handled by ./wordprocessors
# verified by Michal Mutl Structured Storage Viewer `SSView.exe brochus.pt6`
# Second directory entry name PageMaker
>>>>128 lestring16 PageMaker :
# look for magic of "old" PageMaker like in 02TEMPLT.T65
>>>>>0 search/0xa900/s \0\0\0\0\0\0\xff\x99
# GRR: jump to PageMaker stream and inspect it by sub routine PageMaker of ./wordprocessors failed with wrong version!
#>>>>>>&0 use PageMaker
# THIS WORKS PARTLY!
>>>>>>&0 indirect x
# remaining null clsid
>>>>128 default x : UNKNOWN
# second directory entry name like VisioDocument Control000
@ -267,6 +301,9 @@
# forth
>>>>>384 lestring16 x %.20s
!:mime application/x-ole-storage
# according to file version 5.41 with -e soft option
#!:mime application/CDFV2
#!:ext ???
# look for known clsid GUID
# - Visio documents
# URL: http://fileformats.archiveteam.org/wiki/Visio
@ -417,6 +454,28 @@
!:apple ????PPT3
# /autostart/template
!:ext ppt/pps/pot
# From: Joerg Jenderek
# URL: https://www.file-extensions.org/ppa-file-extension
# https://en.wikipedia.org/wiki/Microsoft_PowerPoint#cite_note-231
# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
>>88 ubequad 0x871800aa0060263b : Microsoft
# only version 8 (97) tested; PowerPoint 4.0 to 11.0 (2004) (Wikipedia); 97 to 2003 (file-extensions.org)
>>>80 ubequad 0xf04672810a72cf11 PowerPoint Addin or Wizard
# second, third and fourth directory entry name like VBA PROJECT PROJECTwm
# http://extension.nirsoft.net/pwz
!:mime application/vnd.ms-powerpoint
# like: BSHPPT97.PPA "AutoContent Wizard.pwz"
!:ext ppa/pwz
#
# From: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/AWD_(At_Work_Document)
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/awd-fax.trid.xml
# Note: called "Microsoft At Work Fax document" by TrID
>>88 ubequad 0xb29400dd010f2bf9 : Microsoft
>>>80 ubequad 0x801cb0023de01a10 At Work fax Document
#!:mime application/x-ole-storage
!:mime image/x-ms-awd
!:ext awd
#
# URL: https://en.wikipedia.org/wiki/Microsoft_Project
#??
@ -424,6 +483,20 @@
>>>80 ubequad 0x3a8fb774c8c8d111 Project
!:mime application/vnd.ms-project
!:ext mpp
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Microsoft_Office_shared_tools#Binder
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/o/obd.trid.xml
# http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
# Note: only version 8 tested and called "Office Binder Document" by TrID and
# "Microsoft Office Binder File for Windows" version 97-2000 by DROID fmt/240
>>88 ubequad 0xb21c00aa004ba90b : Microsoft
>>>80 ubequad 0x0004855964661b10 Office Binder Document, Template or wizard
# second directory entry name like Binder
# https://www.file-extensions.org/obd-file-extension
#!:mime application/vnd.ms-binder
!:mime application/x-msbinder
# obt for template; obz for Microsoft Office Binder wizard
!:ext obd/obt/obz
#
# URL: http://fileformats.archiveteam.org/wiki/WordPerfect
# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
@ -560,9 +633,29 @@
!:mime application/vnd.softmaker.planmaker
# pmv for template https://www.file-extensions.org/pmv-file-extension
!:ext pmd/pmv
# URL: http://fileformats.archiveteam.org/wiki/MAX_(3ds_Max)
# https://en.wikipedia.org/wiki/Autodesk_3ds_Max
# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
# Note: called "3D Studio Max Scene" by TrID and "3DS Max" by DROID and
# "3DSMax thumbnail" by XnView and verfied by `nconvert -info A380.max`
# applies only to "newer" versions (about 2008-2020)
>>88 ubequad 0x9fed04143144cc1e : Autodesk
>>>80 ubequad 0x7b8cdd1cc081a045 3ds Max
#!:mime application/x-ole-storage
!:mime model/x-autodesk-max
# like: https://static.free3d.com/models/dropbox/dropbox/sq/A380.7z/A380.max
!:ext max
# also chr for character file according to DROID https://www.nationalarchives.gov.uk/PRONOM/fmt/978
#!:ext max/chr
# remaining non null clsid
>>88 default x : UNKNOWN
>>88 default x
# GRR: check again for non null clsid because wrong when called by indirect directive
>>>88 ubequad !0 : UNKNOWN
# https://reposcope.com/mimetype/application/x-ole-storage
!:mime application/x-ole-storage
>>>80 ubequad !0 \b, clsid %#16.16llx
>>>88 ubequad x \b%16.16llx
# according to file version 5.41 with -e soft option
#!:mime application/CDFV2
#!:ext ???
>>>>80 ubequad !0 \b, clsid %#16.16llx
>>>>88 ubequad x \b%16.16llx

16
magic/Magdir/oric Normal file
View File

@ -0,0 +1,16 @@
#------------------------------------------------------------------------------
# $File: oric,v 1.2 2022/04/25 17:28:20 christos Exp $
# Oric tape files
# From: Stefan A. Haubenthal <polluks@sdf.lonestar.org>
# References:
# http://fileformats.archiveteam.org/wiki/TAP_(Oric)
# http://fileformats.archiveteam.org/wiki/DSK_(Oric)
0 string \x16\x16\x16\x24 Oric tape,
>6 byte =0x00 BASIC,
>6 byte =0x80 memory block,
>7 byte >0x00 autorun,
>13 string x "%.15s"
0 string ORICDISK Oric Image
0 string MFM_DISK Oric Image

4
magic/Magdir/os2
View File

@ -1,12 +1,14 @@
#------------------------------------------------------------------------------
# $File: os2,v 1.13 2021/04/26 15:56:00 christos Exp $
# $File: os2,v 1.14 2022/03/21 21:25:50 christos Exp $
# os2: file(1) magic for OS/2 files
#
# Provided 1998/08/22 by
# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
1 search/100 InternetShortcut MS Windows 95 Internet shortcut text
!:mime application/x-mswinurl
!:ext url
>17 search/100 URL= (URL=<
>>&0 string x \b%s>)

3
magic/Magdir/palm
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: palm,v 1.14 2019/04/19 00:42:27 christos Exp $
# $File: palm,v 1.15 2021/12/16 21:50:06 christos Exp $
# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
#
# Brian Lalor <blalor@hcirisc.cs.binghamton.edu>
@ -55,6 +55,7 @@
# Mobipocket (www.mobipocket.com), donated by Carl Witty
# expanded by Ralf Brown
60 string BOOKMOBI Mobipocket E-book
!:mime application/x-mobipocket-ebook
# MobiPocket stores a full title, pointed at by the belong at offset
# 0x54 in its header at (78.L), with length given by the belong at
# offset 0x58.

116
magic/Magdir/pci_ids Normal file
View File

@ -0,0 +1,116 @@
#------------------------------------------------------------------------------
# $File: pci_ids,v 1.1 2022/04/02 14:47:42 christos Exp $
# pci.ids: file(1) magic for PCI specific informations
#
# Vendor identification (ID) https://pci-ids.ucw.cz/v2.2/pci.ids
# show hexadecimal PCI vendor identification in human readable text form
0 name PCI-vendor
# ID vendor name
#>0 uleshort =0x0f00 fOO
>0 uleshort =0x1000 Broadcom
>0 uleshort =0x1002 AMD/ATI
>0 uleshort =0x1013 Cirrus Logic
>0 uleshort =0x1014 IBM
>0 uleshort =0x1022 AMD
>0 uleshort =0x1050 Winbond
>0 uleshort =0x105a Promise
>0 uleshort =0x1095 Silicon
>0 uleshort =0x10EC Realtek
>0 uleshort =0x10de NVIDIA
>0 uleshort =0x1106 VIA
# Woodward McCoach, Inc.
>0 uleshort =0x1231 Woodward
#
>0 uleshort =0x1234 Bochs
>0 uleshort =0x15ad VMware
>0 uleshort =0x1af4 Virtio
>0 uleshort =0x1b36 QEMU
>0 uleshort =0x1de1 Tekram
# maybe also Promise?
#>0 uleshort =0x4289 Promise
#>0 uleshort =0x66a1 FOO
>0 uleshort =0x8086 Intel
>0 uleshort =0x9004 Adaptec
# also Adaptec; but no example
>0 uleshort =0x9005 Adaptec
# for unknown/missing manufactors
>0 default x UNKNOWN
>>0 uleshort x (%#4.4x)
# https://blog.ladsai.com/pci-configuration-space-class-code.html
# Base class code https://wiki.osdev.org/PCI
# show hexadecimal PCI class+sub+ProgIF identification in human readable text form
0 name PCI-class
#>0 ubyte x CLASS=%x
>0 ubyte x
# Device was built prior definition of the class code field
>>0 ubyte 0x00 PRIOR
# Any device except for VGA-Compatible devices like: 2975BIOS.BIN Trm3x5.bin
# BUT also NVidia44.bin vgabios-stdvga-bin.rom
#>>>0 ubyte 0x00 NOT VGA
# VGA-Compatible Device; NO EXAMPLE found here!!
#>>>0 ubyte 0x01 VGA
# like 4243.bin
#>>>0 ubyte 0x04 SUB_CLASS_4
>>0 ubyte 0x01 storage controller
# device sub-type and its definition is dependent upon the base-type code
>>>1 ubyte 0x00 SCSI
>>>1 ubyte 0x01 IDE
>>>1 ubyte 0x02 Floppy
>>>1 ubyte 0x03 IPI
>>>0 ubyte 0x04 RAID
>>>1 ubyte 0x05 ATA
>>>1 ubyte 0x06 SATA
>>>1 ubyte 0x07 SAS
>>>1 ubyte 0x08 NVM
# 4650_sr5.bin "PROMISE" "FT TX4650 Ary X"
>>>1 ubyte 0x80 OTHER
>>0 ubyte 0x02 network controller
>>>1 ubyte 0x00 ethernet
>>>1 ubyte 0x01 token ring
>>>1 ubyte 0x02 FDDI
>>>1 ubyte 0x03 ATM
>>>1 ubyte 0x04 ISDN
>>>1 ubyte 0x05 WorldFip
# PICMG 2.14 Multi Computing
>>>1 ubyte 0x06 PICMG
>>>1 ubyte 0x80 OTHER
>>0 ubyte 0x03 display controller
>>0 ubyte 0x04 multimedia controller
>>0 ubyte 0x05 memory controller
>>0 ubyte 0x06 bridge device
# Simple Communication Controllers
>>0 ubyte 0x07 communication controller
# Base System Peripherals
>>0 ubyte 0x08 base peripheral
# Input Devices
>>0 ubyte 0x09 input device
# Docking Stations
>>0 ubyte 0x0A docking station
>>0 ubyte 0x0B processor
>>0 ubyte 0x0C serial bus controller
>>0 ubyte 0x0D wireless controller
# Intelligent I/O Controllers
>>0 ubyte 0x0E I/O controller
# Satellite Communication Controllers
>>0 ubyte 0x0F satellite controller
# Encryption/Decryption Controllers
>>0 ubyte 0x10 encryption controller
# Data Acquisition and Signal Processing Controllers
>>0 ubyte 0x11 signal controller
# Processing Accelerator
>>0 ubyte 0x12 processing accelerator
# Non-Essential Instrumentation
>>0 ubyte 0x13 non-essential
# reserved or unassigned
>>0 default x
# device does not fit any defined class; Unassigned Class (Vendor specific)
>>>0 ubyte 0xFF UNASSIGNED
# THIS SHOULD NOT HAPPEN! BUT CLASS=8f for Promise 4650_sr5.bin 8660_sr5.bin
>>>0 default x RESERVED
>>>>0 ubyte x (%#x)
# Prog IF of PCI class code?
# defines the specific device programming interface
>2 ubyte >0 \b, ProgIF=%u

47
magic/Magdir/python
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: python,v 1.43 2021/05/25 15:12:03 christos Exp $
# $File: python,v 1.44 2021/10/20 11:15:35 christos Exp $
# python: file(1) magic for python
#
# Outlook puts """ too for urgent messages
@ -8,6 +8,7 @@
# often the module starts with a multiline string
0 string/t """ Python script text executable
# MAGIC as specified in Python/import.c (1.0 to 3.7)
# and in Lib/importlib/_bootstrap_external.py (3.5+)
# two bytes of magic followed by "\r\n" in little endian order
0 belong 0x02099900 python 1.0 byte-compiled
!:mime application/x-bytecode.python
@ -215,6 +216,50 @@
!:mime application/x-bytecode.python
0 belong 0x610d0d0a python 3.9 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x660d0d0a python 3.10 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x670d0d0a python 3.10 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x680d0d0a python 3.10 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x690d0d0a python 3.10 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x6a0d0d0a python 3.10 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x6b0d0d0a python 3.10 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x6c0d0d0a python 3.10 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x6d0d0d0a python 3.10 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x6e0d0d0a python 3.10 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x6f0d0d0a python 3.10 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x7a0d0d0a python 3.11 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x7b0d0d0a python 3.11 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x7c0d0d0a python 3.11 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x7d0d0d0a python 3.11 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x7e0d0d0a python 3.11 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x7f0d0d0a python 3.11 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x800d0d0a python 3.11 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x810d0d0a python 3.11 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x820d0d0a python 3.11 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x830d0d0a python 3.11 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x840d0d0a python 3.11 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x850d0d0a python 3.11 byte-compiled
!:mime application/x-bytecode.python
0 search/1/w #!\040/usr/bin/python Python script text executable
!:strength + 15

66
magic/Magdir/riff
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: riff,v 1.43 2021/04/26 15:56:00 christos Exp $
# $File: riff,v 1.44 2022/05/14 19:42:47 christos Exp $
# riff: file(1) magic for RIFF format
# See
#
@ -161,6 +161,64 @@
#>0 string x we got %s
#>>&(4.l+4) use riff-walk
# RecorderGear TR500 call recorder digits (BCD)
0 name tr500-call-recorder-digits
>0 byte&0xF0 0x00 \b0
>0 byte&0xF0 0x10 \b1
>0 byte&0xF0 0x20 \b2
>0 byte&0xF0 0x30 \b3
>0 byte&0xF0 0x40 \b4
>0 byte&0xF0 0x50 \b5
>0 byte&0xF0 0x60 \b6
>0 byte&0xF0 0x70 \b7
>0 byte&0xF0 0x80 \b8
>0 byte&0xF0 0x90 \b9
>0 byte&0xF0 0xb0 \b*
>0 byte&0xF0 0xc0 \b#
>0 byte&0x0F 0 \b0
>0 byte&0x0F 1 \b1
>0 byte&0x0F 2 \b2
>0 byte&0x0F 3 \b3
>0 byte&0x0F 4 \b4
>0 byte&0x0F 5 \b5
>0 byte&0x0F 6 \b6
>0 byte&0x0F 7 \b7
>0 byte&0x0F 8 \b8
>0 byte&0x0F 9 \b9
>0 byte&0x0F 0xb \b*
>0 byte&0x0F 0xc \b#
# TR500 call recorder extended header
# From: David Korth <gerbilsoft@gerbilsoft.com>
# Contains dialed/incoming phone number and timestamp.
# TODO: Verify byte 15.
0 name tr500-call-recorder-header
>15 byte 2 (outgoing call:
>15 byte 4 (incoming call:
>1 byte 0xFF \bno number
>1 byte !0xFF
>>1 use tr500-call-recorder-digits
>>2 byte !0xFF
>>>2 use tr500-call-recorder-digits
>>3 byte !0xFF
>>>3 use tr500-call-recorder-digits
>>4 byte !0xFF
>>>4 use tr500-call-recorder-digits
>>5 byte !0xFF
>>>5 use tr500-call-recorder-digits
>>6 byte !0xFF
>>>6 use tr500-call-recorder-digits
>>7 byte !0xFF
>>>7 use tr500-call-recorder-digits
>>8 byte !0xFF
>>>8 use tr500-call-recorder-digits
>9 byte x \b, 20%02x
>10 byte x \b/%02x
>11 byte x \b/%02x
>12 byte x %02x
>13 byte x \b:%02x
>14 byte x \b:%02x)
# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi>
#
0 string RIFF RIFF (little-endian) data
@ -231,6 +289,11 @@
!:ext wav/wave
>>12 string >\0
>>>12 use riff-walk
# TR500 call recorder extended header
>>16 ulelong 0x1E4
>>>20 leshort 0x11
>>>>256 byte 4
>>>>>256 use tr500-call-recorder-header
# Update: Joerg Jenderek
# lower case for Corel Draw version 8 Bidi
>8 string/c cdr
@ -676,6 +739,7 @@
# for debugging purpose display 5th chunk like: LIST osfp
#>>(26.l+30) string x \b, 5th "%-4.4s"
>4 ulelong+8 x \b, %u bytes
#
# XXX - some of the below may only appear in little-endian form.
#

25
magic/Magdir/rpi
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: rpi,v 1.2 2019/10/02 02:07:30 christos Exp $
# $File: rpi,v 1.3 2022/04/02 14:39:34 christos Exp $
# rpi: file(1) magic for Raspberry Pi images
-44 lelong 0
>4 lelong 0
@ -27,3 +27,26 @@
>>>>>>>>>40 string DDTK8
>>>>>>>>>>48 lelong 4
>>>>>>>>>>>52 string RPTL Raspberry PI kernel image
# From: Joerg Jenderek
# URL: https://www.raspberrypi.com/documentation/computers/raspberry-pi.html
# #raspberry-pi-4-boot-eeprom
# Reference: https://github.com/raspberrypi/rpi-eeprom/blob/master/rpi-eeprom-config
# Note: start with same magic as for BIOS (ia32) ROM Extension handled by ./intel
# masked with MAGIC_MASK and then compared with MAGIC
0 belong&0xFFffF00F 0x55aaF00F Raspberry PI EEPROM
#!:mime application/octet-stream
!:mime application/x-raspberry-eeprom
# like: pieeprom-2020-09-03.bin
!:ext bin
# a 32 bit offset to the next section like: 000184d4 000184c8 00018534 ... 0000bb84 0000bbd4 0000bbd4
>4 ubelong x \b, offset %8.8x
#>(4.L) ubelong x NEXT=%8.8x
# self.length
>8 ubelong !0 \b, length %x
# self.filename
>12 string >0 \b, "%s"
# length is zero
>8 ubelong =0
# if length is zero then 2nd section magic here can be zero; this means sections parsing done
>>8 ubelong !0 \b, 2nd MAGIC=%8.8x

47
magic/Magdir/sgml
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: sgml,v 1.42 2020/12/12 20:01:47 christos Exp $
# $File: sgml,v 1.45 2022/03/21 21:36:55 christos Exp $
# Type: SVG Vectorial Graphics
# From: Noel Torres <tecnico@ejerciciosresueltos.com>
0 string \<?xml\ version=
@ -52,66 +52,66 @@
# https://www.w3.org/TR/SVG/single-page.html
0 search/4096/cWbt \<!doctype\ svg SVG XML document
!:mime image/svg+xml
!:strength + 5
!:strength + 15
0 search/4096/cwt \<head\> HTML document text
!:mime text/html
!:strength + 5
!:strength + 15
0 search/4096/cWt \<head\ HTML document text
!:mime text/html
!:strength + 5
!:strength + 15
0 search/4096/cwt \<title\> HTML document text
!:mime text/html
!:strength + 5
!:strength + 15
0 search/4096/cWt \<title\ HTML document text
!:mime text/html
!:strength + 5
!:strength + 15
0 search/4096/cwt \<html\> HTML document text
!:mime text/html
!:strength + 5
!:strength + 15
0 search/4096/cWt \<html\ HTML document text
!:mime text/html
!:strength + 5
!:strength + 15
0 search/4096/cwt \<script\> HTML document text
!:mime text/html
!:strength + 5
!:strength + 15
0 search/4096/cWt \<script\ HTML document text
!:mime text/html
!:strength + 5
!:strength + 15
0 search/4096/cwt \<style\> HTML document text
!:mime text/html
!:strength + 5
!:strength + 15
0 search/4096/cWt \<style\ HTML document text
!:mime text/html
!:strength + 5
!:strength + 15
0 search/4096/cwt \<table\> HTML document text
!:mime text/html
!:strength + 5
!:strength + 15
0 search/4096/cWt \<table\ HTML document text
!:mime text/html
!:strength + 5
!:strength + 15
0 search/4096/cwt \<a\ href= HTML document text
!:mime text/html
!:strength + 5
!:strength + 15
# Extensible markup language (XML), a subset of SGML
# from Marc Prud'hommeaux (marc@apocalypse.org)
0 search/1/cwt \<?xml XML document text
!:mime text/xml
!:strength + 5
!:strength + 15
0 string/t \<?xml\ version\ " XML
!:mime text/xml
!:strength + 5
!:strength + 15
0 string/t \<?xml\ version=" XML
!:mime text/xml
!:strength + 5
!:strength + 15
>15 string/t >\0 %.3s document text
>>23 search/1 \<xsl:stylesheet (XSL stylesheet)
>>24 search/1 \<xsl:stylesheet (XSL stylesheet)
0 string/t \<?xml\ version=' XML
!:mime text/xml
!:strength + 5
!:strength + 15
>15 string/t >\0 %.3s document text
>>23 search/1 \<xsl:stylesheet (XSL stylesheet)
>>24 search/1 \<xsl:stylesheet (XSL stylesheet)
@ -139,7 +139,10 @@
# http://files.pef-format.org/specifications/pef-2008-1/pef-specification.html
#
# Simon Aittamaa <simon.aittamaa@gmail.com>
0 string \<?xml\ version=
>14 regex ['"\ \t]*[0-9.]+['"\ \t]*
>>19 search/4096 \<pef Portable Embosser Format
0 string \<?xml\ version=
>14 regex ['"\ \t]*[0-9.]+['"\ \t]*
>>19 search/4096 \<pef Portable Embosser Format
!:mime application/x-pef+xml
# https://www.qgis.org/en/site/
0 string \<!DOCTYPE\040qgis QGIS XML document

51
magic/Magdir/sniffer
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: sniffer,v 1.30 2021/07/03 13:51:56 christos Exp $
# $File: sniffer,v 1.31 2022/03/20 22:45:43 christos Exp $
# sniffer: file(1) magic for packet capture files
#
# From: guy@alum.mit.edu (Guy Harris)
@ -362,4 +362,51 @@
#
# Files from Accellent Group's 5View products.
#
0 string \xaa\xaa\xaa\xaa 5View capture file
# URL: http://www.infovista.com
# Reference: http://mark0.net/download/triddefs_xml.7z
# defs/0/5vw.trid.xml
# https://2.na.dl.wireshark.org/src/wireshark-3.6.2.tar.xz
# wireshark-3.6.2/wiretap/5views.c
# Update: Joerg Jenderek
# Note: called "5View capture" by TrID and
# "Wireshark capture file" on Windows or
# "Packet Capture (Accellent/InfoVista 5view)" by shared MIME-info database
# verified/falsified by `wireshark *.5vw`
0 string \xaa\xaa\xaa\xaa
# skip misidentified boot/x86_64/loader/kroete.dat on Suse LEAP DVD
# by check for valid record version
>8 ulelong =0x00010000
>>0 use 5view-le
0 name 5view-le
# t_5VW_Info_Header.Signature = CST_5VW_INFO_HEADER_KEY = 0xAAAAAAAAU
>0 ulelong x 5View capture file
# https://reposcope.com/mimetype/application/x-5view
!:mime application/x-5view
!:ext 5vw
# size of header in bytes (included signature and reserved fields); probably always 20h
>4 ulelong !0x00000020 \b, header size %#x
# version of header record; apparently always CST_5VW_INFO_RECORD_VERSION=0x00010000U
>8 ulelong !0x00010000 \b, record version %#x
# DataSize; total size of data without header like: 18h
>12 ulelong x \b, record size %#x
# filetype; type of the capture file like: 18001000h
>16 ulelong x \b, file type %#8.8x
# Reserved[3]; reserved for future use; apparently zero
>20 quad !0 \b, Reserved %#llx
# look for record header key CST_5VW_RECORDS_HEADER_KEY of structure t_5VW_TimeStamped_Header
>0x20 search/0xB8/b \xEE\xEE\x33\x33 \b; record
# HeaderSize; actual size of this header in bytes like: 32 24h
>>&0 uleshort x size %#x
# HeaderType; exact type of this header; probably always 0x4000
>>&2 uleshort !0x4000 \b, header type %#x
# RecType; type of record like: 80000000h
>>&4 ulelong x \b, record type %#x
# RecSubType; subtype of record like: 0
>>&8 ulelong !0 \b, subtype %#x
# RecSize; Size of one record like: 5Ch
>>&12 ulelong x \b, RecSize %#x
# RecNb; Number of records like: 1
>>&16 ulelong >1 \b, %#x records
# Timestamp Utc
#>>&20 ulelong x \b, RAW TIME %#8.8x
>>&20 date x \b, Time-stamp %s

4
magic/Magdir/statistics
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: statistics,v 1.2 2020/10/08 17:51:53 christos Exp $
# $File: statistics,v 1.3 2022/03/24 15:48:58 christos Exp $
# statistics: file(1) magic for statistics related software
#
@ -42,4 +42,4 @@
# Example of those files can be found on Zenodo:
# https://zenodo.org/search?page=1&size=20&q=&file_type=dta
0 string \<stata_dta\>\<header\>\<release\> Stata Data File
>&0 regex [0-9]* (Release %s)
>&0 regex [0-9]+ (Release %s)

147
magic/Magdir/sysex
View File

@ -1,20 +1,42 @@
#------------------------------------------------------------------------
# $File: sysex,v 1.10 2019/04/19 00:42:27 christos Exp $
# $File: sysex,v 1.11 2022/01/17 17:16:51 christos Exp $
# sysex: file(1) magic for MIDI sysex files
#
# GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems
# where real SYStem EXclusive messages at offset 1 are limited to seven bits
# https://en.wikipedia.org/wiki/MIDI
0 ubeshort&0xFF80 0xF000 SysEx File -
# test for StartSysEx byte and upper unsed bit of vendor ID
0 ubeshort&0xFF80 0xF000
# MIDI System Exclusive (SysEx) messages (strength=50) after Microsoft Visual C library (strength=70)
#!:strength +0
# skip Microsoft Visual C library with page size 16 misidentifed as ADA and
# page size 32 misidentifed as Inventronics by looking for terminating End Of eXclusive byte (EOX)
>2 search/12 \xF7
>>0 use midi-sysex
# display information about MIDI System Exclusive (SysEx) messages
0 name midi-sysex
# https://fileinfo.com/extension/syx
>1 ubyte x MIDI audio System Exclusive (SysEx) message -
# Note: file (version 5.41) labeled the above entry as "SysEx File"
#!:mime application/octet-stream
!:mime audio/x-syx
# https://onsongapp.com/docs/features/formats/sysex
!:ext syx/sysex
# https://www.midi.org/specifications-old/item/manufacturer-id-numbers
# https://raw.githubusercontent.com/insolace/MIDI-Sysex-MFG-IDs/master/Sysex%20ID%20Tables/MIDI%20Sysex%20MFG%20IDs.csv
# SysEx manufacturer ID; originally one byte, but now 0 is used as an escapement to reach the next two
# North American Group
>1 byte 0x01 Sequential
#>1 byte 0x01 Sequential
>1 byte 0x01 Sequential Circuits
>1 byte 0x02 IDP
>1 byte 0x03 OctavePlateau
#>1 byte 0x03 OctavePlateau
>1 byte 0x03 Voyetra Turtle Beach
>1 byte 0x04 Moog
>1 byte 0x05 Passport
>1 byte 0x06 Lexicon
#>1 byte 0x05 Passport
>1 byte 0x05 Passport Designs
#>1 byte 0x06 Lexicon
>1 byte 0x06 Lexicon Inc.
>1 byte 0x07 Kurzweil/Future Retro
>>3 byte 0x77 777
>>4 byte 0x00 Bank
@ -38,12 +60,17 @@
>>5 byte 0x10 (ALL)
>>2 byte x \b, Channel %d
>1 byte 0x08 Fender
>1 byte 0x09 Gulbransen
>1 byte 0x0a AKG
#>1 byte 0x09 Gulbransen
>1 byte 0x09 MIDI9
#>1 byte 0x0a AKG
>1 byte 0x0a AKG Acoustics
>1 byte 0x0b Voyce
>1 byte 0x0c Waveframe
>1 byte 0x0d ADA
>1 byte 0x0e Garfield
# not ADA programming language
#>1 byte 0x0d ADA
>1 byte 0x0d ADA Signal Processors Inc.
#>1 byte 0x0e Garfield
>1 byte 0x0e Garfield Electronics
>1 byte 0x0f Ensoniq
>1 byte 0x10 Oberheim
>>2 byte 0x06 Matrix 6 series
@ -59,7 +86,8 @@
>1 byte 0x16 Lowrey
>1 byte 0x17 AdamsSmith
>1 byte 0x18 E-mu
>1 byte 0x19 Harmony
#>1 byte 0x19 Harmony
>1 byte 0x19 Harmony Systems
>1 byte 0x1a ART
>1 byte 0x1b Baldwin
>1 byte 0x1c Eventide
@ -67,23 +95,28 @@
>1 byte 0x1f Clarity
# European Group
>1 byte 0x21 SIEL
#>1 byte 0x21 SIEL
>1 byte 0x21 Proel Labs (SIEL)
>1 byte 0x22 Synthaxe
>1 byte 0x24 Hohner
>1 byte 0x25 Twister
>1 byte 0x26 Solton
#>1 byte 0x26 Solton
>1 byte 0x26 Ketron s.r.l.
>1 byte 0x27 Jellinghaus
>1 byte 0x28 Southworth
>1 byte 0x29 PPG
>1 byte 0x2a JEN
>1 byte 0x2b SSL
>1 byte 0x2c AudioVertrieb
#>1 byte 0x2b SSL
>1 byte 0x2b Solid State Logic Organ Systems
#>1 byte 0x2c AudioVertrieb
>1 byte 0x2c Audio Veritrieb-P. Struven
>1 byte 0x2f ELKA
>>3 byte 0x09 EK-44
>1 byte 0x30 Dynacord
>1 byte 0x31 Jomox
#>1 byte 0x31 Jomox
>1 byte 0x31 Viscount International Spa
>1 byte 0x33 Clavia
>1 byte 0x39 Soundcraft
# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs
@ -202,14 +235,16 @@
>1 byte 0x44 Casio
>1 byte 0x46 Kamiya
>1 byte 0x47 Akai
>1 byte 0x48 Victor
#>1 byte 0x48 Victor
>1 byte 0x48 Victor Company of Japan. Ltd.
>1 byte 0x49 Mesosha
>1 byte 0x4b Fujitsu
>1 byte 0x4c Sony
>1 byte 0x4e Teac
>1 byte 0x50 Matsushita
>1 byte 0x51 Fostex
>1 byte 0x52 Zoom
#>1 byte 0x52 Zoom
>1 byte 0x52 Zoom Corporation
>1 byte 0x54 Matsushita
>1 byte 0x57 Acoustic tech. lab.
# https://www.midi.org/techspecs/manid.php
@ -317,4 +352,78 @@
>1 belong&0xffffff00 0x00204700 Klavis Tech.
>1 belong&0xffffff00 0x00204800 Noteheads AB
# Update: Joerg Jenderek; January 2022
>1 byte 0x00 ID EXTENSIONS
>1 byte 0x13 Digidesign Inc.
>1 byte 0x1e Key Concepts
>1 byte 0x20 Passac
>1 byte 0x23 Stepp
>1 byte 0x2d Neve
>1 byte 0x2e Soundtracs Ltd.
>1 byte 0x32 Drawmer
>1 byte 0x34 Audio Architecture
>1 byte 0x35 Generalmusic Corp SpA
>1 byte 0x36 Cheetah Marketing
>1 byte 0x37 C.T.M.
>1 byte 0x38 Simmons UK
>1 byte 0x3a Steinberg
>1 byte 0x3b Wersi GmbH
>1 byte 0x3c AVAB Niethammer AB
>1 byte 0x3d Digigram
>1 byte 0x3f Quasimidi
#
>1 byte 0x40 Kawai Musical Instruments MFG. CO. Ltd
#>1 byte 0x45 foo
#>1 byte 0x4a foo
#>1 byte 0x4d foo
#>1 byte 0x4f foo
#>1 byte 0x53 foo
>1 byte 0x55 Suzuki Musical Instruments MFG. Co. Ltd.
>1 byte 0x56 Fuji Sound Corporation Ltd.
#>1 byte 0x58 foo
>1 byte 0x59 Faith. Inc.
>1 byte 0x5a Internet Corporation
#>1 byte 0x5b foo
>1 byte 0x5c Seekers Co. Ltd.
#>1 byte 0x5d foo
#>1 byte 0x5e foo
>1 byte 0x5f SD Card Association
# Reserved for other uses for 60H to 7FH
# URL: https://www.philscomputerlab.com/roland-midi-emulator-project-20.html
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/syx--midiemu.trid.xml
# Note: called by TrID "MIDI Emulator Project SysEx preset command"
>1 byte 0x66 MIDI Emulator
# https://electronicmusic.fandom.com/wiki/List_of_MIDI_Manufacturer_IDs
# Educational, prototyping, test, private use and experimentation
>1 byte 0x7D PROTOTYPING
# universal non-real-time (sample dump, tuning table, etc.)
>1 byte 0x7E UNIVERSAL
# universal real time (MIDI time code, MIDI Machine control, etc.)
>1 byte 0x7F universal real time
# display information about End Of eXclusive byte (EOX=F7)
#>2 ubyte 0xF7 \b, at 2 EOX
#>3 ubyte 0xF7 \b, at 3 EOX
# https://tttapa.github.io/Control-Surface-doc/new-input/Doxygen/d2/d93/SysEx-Send-Receive_8ino-example.html
>4 ubyte 0xF7 \b, at 4 EOX
# http://www.1manband.nl/tutorials2/sysex.htm
>5 ubyte 0xF7 \b, at 5 EOX
# http://www.somascape.org/midi/tech/mfile.html#sysex
>6 ubyte 0xF7 \b, at 6 EOX
#
>7 ubyte 0xF7 \b, at 7 EOX
# https://webmidijs.org/forum/discussion/34/how-to-send-or-receive-system-exclusive-messages
>8 ubyte 0xF7 \b, at 8 EOX
#
>9 ubyte 0xF7 \b, at 9 EOX
# https://www.chd-el.cz/wp-content/uploads/845010_syxcom.pdf
>10 ubyte 0xF7 \b, at 10 EOX
# https://stackoverflow.com/questions/52906076/handling-midi-the-input-of-multiple-system-exclusive-messages-in-vb
>11 ubyte 0xF7 \b, at 11 EOX
# https://www.2writers.com/eddie/TutSysEx.htm
>12 ubyte 0xF7 \b, at 12 EOX
>13 ubyte 0xF7 \b, at 13 EOX
# http://www.chromakinetics.com/handsonic/rolSysEx.htm
>14 ubyte 0xF7 \b, at 14 EOX
#>15 ubyte 0xF7 \b, at 15 EOX
0 string T707 Roland TR-707 Data

18
magic/Magdir/uuencode
View File

@ -1,16 +1,18 @@
#------------------------------------------------------------------------------
# $File: uuencode,v 1.8 2019/12/14 20:40:26 christos Exp $
# $File: uuencode,v 1.9 2021/11/13 17:48:10 christos Exp $
# uuencode: file(1) magic for ASCII-encoded files
#
# GRR: the first line of xxencoded files is identical to that in uuencoded
# files, but the first character in most subsequent lines is 'h' instead of
# 'M'. (xxencoding uses lowercase letters in place of most of uuencode's
# punctuation and survives BITNET gateways better.) If regular expressions
# were supported, this entry could possibly be split into two with
# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
0 search/1 begin\ uuencoded or xxencoded text
# The first line of xxencoded files is identical to that in uuencoded files,
# but the first character in most subsequent lines is 'h' instead of 'M'.
# (xxencoding uses lowercase letters in place of most of uuencode's
# punctuation and survives BITNET gateways better.)
0 regex/1024 \^begin\040[0-7]{3}\040
>&0 regex/256 [\012\015]+M[\040-\140]{60}[\012\015]+ uuencoded text
>&0 regex/256 [\012\015]+h[0-9A-Za-z\053\055]{60}[\012\015]+ xxencoded text
>&0 default x uuencoded or xxencoded text
>&0 string >\0 \b, file name "%s"
# btoa(1) is an alternative to uuencode that requires less space.
0 search/1 xbtoa\ Begin btoa'd text

8
magic/Magdir/virtual
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: virtual,v 1.14 2021/04/26 15:56:00 christos Exp $
# $File: virtual,v 1.16 2022/01/18 14:08:15 christos Exp $
# From: James Nobis <quel@quelrod.net>
# Microsoft hard disk images for:
# Virtual Server
@ -219,7 +219,8 @@
# Updated by Adam Buchbinder (adam.buchbinder@gmail.com)
# Made by reading sources, reading documentation, and doing trial and error
# on existing QCOW files
0 string/b QFI\xFB
0 string/b QFI\xFB QEMU QCOW Image
!:mime application/x-qemu-disk
# Uncomment the following line to display Magic (only used for debugging
# this magic number)
@ -227,8 +228,7 @@
# There are currently 2 Versions: "1" and "2".
# https://www.gnome.org/~markmc/qcow-image-format-version-1.html
>4 belong !1 QEMU QCOW2 Image
>4 belong 1 QEMU QCOW Image (v1)
>4 belong x (v%d)
# Using the existence of the Backing File Offset to determine whether
# to read Backing File Information

196
magic/Magdir/windows
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: windows,v 1.37 2021/04/26 15:56:00 christos Exp $
# $File: windows,v 1.44 2022/05/31 17:39:08 christos Exp $
# windows: file(1) magic for Microsoft Windows
#
# This file is mainly reserved for files where programs
@ -358,7 +358,7 @@
# skip space at beginning
>0 string \040
# name without extension and greater character or name with hlp extension
>>1 regex/c \^([^\xd>]*|.*\.hlp) MS Windows help file Content, based "%s"
>>1 regex/c \^([^\xd>]*|.*\\.hlp) MS Windows help file Content, based "%s"
!:mime text/plain
!:apple ????TEXT
!:ext cnt
@ -382,6 +382,8 @@
# Created by: unknown
# 'L' + GUUID
0 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut
!:mime application/x-ms-shortcut
!:ext lnk
>20 lelong&1 1 \b, Item id list present
>20 lelong&2 2 \b, Points to a file or directory
>20 lelong&4 4 \b, Has Description string
@ -495,10 +497,16 @@
# empty line CRLF
0 ubeshort 0x0D0A
>0 use ini-file
# comment line
# comment line starting with semicolon
0 string ;
>0 use ini-file
# section line
# look for phrase of Windows policy ADMinistrative template (with starting remark)
# like: WINDOW_95_CD/TOOLS/RESKIT/netadmin/poledit/conf.adm
>1 search/3548 END\040CATEGORY
# ADM with remark (by adm-rem.trid.xml) already done by generic ASCII variant
# if no Windows policy ADMinistrative template then Windows INItialization
>1 default x
>>0 use ini-file
# section line starting with left bracket
0 string [
>0 use ini-file
# check and then display Windows INItialization configuration
@ -510,7 +518,7 @@
# space after right bracket
# or AutoRun.Amd64 for 64 bit systems
# or only NL separator
>>&0 regex/c \^(autorun)
>>&0 regex/c \^autorun
# but sometimes total commander directory tree file "treeinfo.wc" with lines like
# [AUTORUN]
# [boot]
@ -535,11 +543,11 @@
# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm
# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx
# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent
>>&0 regex/c \^(\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] Windows desktop.ini
>>&0 regex/1024c \^(\\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] Windows desktop.ini
!:mime application/x-wine-extension-ini
#!:mime text/plain
# https://support.microsoft.com/kb/84709/
>>&0 regex/c \^(don't\ load)] Windows CONTROL.INI
>>&0 regex/c \^don't\ load] Windows CONTROL.INI
!:mime application/x-wine-extension-ini
!:ext ini
>>&0 regex/c \^(ndishlp\\$|protman\\$|NETBEUI\\$)] Windows PROTOCOL.INI
@ -555,34 +563,57 @@
!:mime application/x-wine-extension-ini
!:ext ini
# http://www.mdgx.com/newtip6.htm
>>&0 regex/c \^(SafeList)] Windows IOS.INI
>>&0 regex/c \^SafeList] Windows IOS.INI
!:mime application/x-wine-extension-ini
!:ext ini
# https://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information
>>&0 regex/c \^(boot\x20loader)] Windows boot.ini
>>&0 regex/c \^boot\x20loader] Windows boot.ini
!:mime application/x-wine-extension-ini
!:ext ini
# https://en.wikipedia.org/wiki/CONFIG.SYS
>>&0 regex/c \^(menu)] MS-DOS CONFIG.SYS
>>&0 regex/c \^menu] MS-DOS CONFIG.SYS
# @CONFIG.UI configuration file of previous DOS version saved by Caldera OPENDOS INSTALL.EXE
# CONFIG.PSS saved version of file CONFIG.SYS created by %WINDIR%\SYSTEM\MSCONFIG.EXE
# CONFIG.TSH renamed file CONFIG.SYS.BAT by %WINDIR%\SYSTEM\MSCONFIG.EXE
# dos and w40 used in dual booting scene
!:ext sys/dos/w40
# https://support.microsoft.com/kb/118579/
>>&0 regex/c \^(Paths)]\r\n MS-DOS MSDOS.SYS
>>&0 regex/c \^Paths]\r\n MS-DOS MSDOS.SYS
!:ext sys/dos
# http://chmspec.nongnu.org/latest/INI.html#HHP
>>&0 regex/c \^(options)]\r\n Microsoft HTML Help Project
>>&0 regex/c \^options]\r\n Microsoft HTML Help Project
!:mime text/plain
!:ext hhp
# From: Joerg Jenderek
# URL: https://documentation.basis.com/BASISHelp/WebHelp/b3odbc/obdcdriv_character_translation.htm
# URL: https://documentation.basis.com/BASISHelp/WebHelp/b3odbc/ODBC_Driver/obdcdriv_character_translation.htm
# Reference: https://www.garykessler.net/library/file_sigs.html
# http://mark0.net/download/triddefs_xml.7z/defs/c/cpx.trid.xml
# Note: stored in directory %WINDIR%\SysWOW64 or %WINDIR%\system
>>&0 regex/c \^(Windows\ Latin) Windows codepage translator
!:mime text/plain
# second word often Latin but sometimes Cyrillic like in 12510866.CPX
>>&0 regex/c \^Windows\ (Latin|Cyrillic) Windows codepage translator
#!:mime text/plain
!:mime text/x-ms-cpx
# like: 12510866.CPX
!:ext cpx
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/InstallShield
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lid-is.trid.xml
# Note: contain also 3 keywords like: count Default key0
>>&0 regex/c \^Languages] InstallShield Language Identifier
#!:mime text/plain
!:mime text/x-installshield-lid
# like: SETUP.LID
!:ext lid
# From: Joerg Jenderek
# URL: https://www.file-extensions.org/tag-file-extension
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/t/taginfo.trid.xml
# Note: contain also keywords like: Application Category Company Misc Version
>>&0 regex/c \^TagInfo] TagInfo
#!:mime text/plain
#!:mime text/prs.lines.tag
!:mime text/x-ms-tag
# like: DATA.TAG
!:ext tag
# unknown keyword after opening bracket
>>&0 default x
#>>>&0 string/c x UNKNOWN [%s
@ -603,27 +634,72 @@
!:mime application/x-wine-extension-ini
#!:mime text/plain
!:ext ini/inf
# UTF-16 BOM
0 ubeshort =0xFFFE
# look for phrase of Windows policy ADMinistrative template (UTF-16 by adm-uni.trid.xml)
# like: wuau.adm
>2 search/0x384A E\0N\0D\0\040\0C\0A\0T\0E\0G\0O\0R\0Y\0
>>0 use windows-adm
# if no Windows policy ADMinistrative template then Windows INFormation
>2 default x
# UTF-16 BOM followed by CR~0D00 , comment~semicolon~3B00 , section~bracket~5B00
0 ubelong&0xFFff89FF =0xFFFE0900
>>0 ubelong&0xFFff89FF =0xFFFE0900
# look for left bracket in section line
>2 search/8192 [
>>>2 search/8192 [
# keyword without 1st letter which is maybe up-/down-case
>>&3 lestring16 ersion] Windows setup INFormation
!:mime application/x-setupscript
!:ext inf
>>&3 lestring16 trings] Windows setup INFormation
!:mime application/x-setupscript
!:ext inf
>>&3 lestring16 ourceDisksNames] Windows setup INFormation
!:mime application/x-setupscript
!:ext inf
# netnwcli.inf start with ;---[ NetNWCli.INX ]
>>&3 default x
# look for NL followed by left bracket
>>>&0 search/8192 \x0A\x00\x5b
>>>>&3 lestring16 ersion] Windows setup INFormation
!:mime application/x-setupscript
# like: hdaudio.inf iscsi.inf spaceport.inf tpm.inf usbhub3.inf UVncVirtualDisplay.inf
!:ext inf
>>>>&3 lestring16 trings] Windows setup INFormation
!:mime application/x-setupscript
# like: arduino_gemma.inf iis.inf MSM8960.inf
!:ext inf
>>>>&3 lestring16 ourceDisksNames] Windows setup INFormation
!:mime application/x-setupscript
# like: atiixpag.inf mdmnokia.inf netefe32.inf rdpbus.inf
!:ext inf
# netnwcli.inf start with ;---[ NetNWCli.INX ]
>>>>&3 default x
# look for NL followed by left bracket
>>>>>&0 search/8192 \x0A\x00\x5b
# like: defltwk.inf netvwifibus.inf WSDPrint.inf
>>>>>>&3 lestring16 ersion] Windows setup INFormation
!:mime application/x-setupscript
!:ext inf
# Summary: Windows Policy ADMinistrative template
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Administrative_Template
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/adm.trid.xml
# Note: typically stored in directory like: %WINDIR%\system32\GroupPolicy\ADM
# worst case ASCII variant starting with remark line like: inetset.adm
0 search/0x4E CLASS\040
>&0 string MACHINE
>>0 use windows-adm
>&0 string USER
>>0 use windows-adm
# display information about Windows policy ADMinistrative template
0 name windows-adm Windows Policy Administrative Template
!:mime text/x-ms-adm
!:ext adm
# UTF-16 BOM implies UTF-16 encoded ADM (by adm-uni.trid.xml)
>0 ubeshort =0xFFFE
>>2 lestring16 x \b, 1st line "%s"
# look for UTF-16 encoded CarriageReturn LineFeed
>>>2 search/0x3A \r\0\n\0
>>>>&0 lestring16 x \b, 2nd line "%s"
# no UTF-16 BOM implies "ASCII" encoded ADM (by adm.trid.xml)
>0 ubeshort !0xFFFE
>>0 string x \b, 1st line "%s"
#>>>&0 ubequad x \b, 2ND %16.16llx
# 2nd line empty
>>>&2 beshort =0x0D0A
>>>>&0 beshort !0x0D0A \b, 3th line
>>>>>&-2 string x "%s"
# 2nd line with content
>>>&2 beshort !0x0D0A \b, 2nd line
>>>>&-2 string x "%s"
# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h
# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm
@ -1080,3 +1156,61 @@
0 string ID;P Microsoft SYLK program
>4 string >0 \b, created by %s
!:ext slk/sylk
# Summary: Windows Performance Monitor Alert
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Performance_Monitor
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pma.trid.xml
# Note: called "Windows Performance Monitor Alert" by TrID
0 ubelong =0xDC058340
>4 ubyte =0 Windows Performance Monitor Alert
#!:mime application/octet-stream
# https://www.thoughtco.com/mime-types-by-content-type-3469108
# https://filext.com/file-extension/PAM
!:mime application/x-perfmon
#!:mime application/x-ms-pma
!:ext pma
# metric type like: "BrowserMetrics" "CrashpadMetrics" "SetupMetrics"
>>80 string x \b, "%s"
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/InstallShield
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/i/ins.trid.xml
# Note: contain also keywords like: BATCH_INSTALL ISVERSION LOGHANDLE SRCDIR SRCDISK WINDIR WINSYSDISK
0 ubelong 0xB8C90C00 InstallShield Script
#!:mime application/octet-stream
!:mime application/x-installshield-ins
# like test.ins Setup.ins
!:ext ins
# UNKNOWN like: 160034121de07e00 1600341260befe00 16003412e0783700
# 5000010021083f00 50000100b0335600 50000100cbfdf800 50000100dfbc4700
#>4 ubequad x \b, at 4 %#16.16llx
# copyright text like: "Stirling Technologies, Inc. (c) 1990-1994"
# "InstallSHIELD Software Coporation (c) 1990-1997"
>13 pstring/h x "%s"
# look for specific ASCII variable names
>1 search/0x121/s SRCDIR \b, variable names:
# 1st like: SRCDIR
>>&-4 leshort x #%u
>>&-2 pstring/h x %s
# 2nd like: SRCDISK
>>>&0 leshort x #%u
>>>&2 pstring/h x %s
# 3rd like: TARGETDISK
>>>>&0 leshort x #%u
>>>>&2 pstring/h x %s
# 4th like: TARGETDIR
#>>>>>&0 leshort x #%u
#>>>>>&2 pstring/h x %s
# 5th like: WINDIR
#>>>>>>&0 leshort x #%u
#>>>>>>&2 pstring/h x %s
# 6th like: WINDISK
#>>>>>>>&0 leshort x #%u
#>>>>>>>&2 pstring/h x %s
# 7th like: WINSYSDIR
#>>>>>>>>&0 leshort x #%u
#>>>>>>>>&2 pstring/h x %s
# ... LOGHANDLE
>0 ubelong x ...
#

64
magic/Magdir/wordprocessors
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: wordprocessors,v 1.26 2021/08/21 12:45:34 christos Exp $
# $File: wordprocessors,v 1.27 2021/12/06 15:05:16 christos Exp $
# wordprocessors: file(1) magic fo word processors.
#
####### PWP file format used on Smith Corona Personal Word Processors:
@ -229,6 +229,68 @@
!:mime application/x-quark-xpress-3
2 string MMXPRa Motorola Quark Express Document (Korean)
# From: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/PageMaker
# https://en.wikipedia.org/wiki/Adobe_PageMaker
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p
# pm4-pagemaker.trid.xml
# pm5-pagemaker.trid.xml
# Note: since version 6 in 1995 called Adobe PageMaker and
# embedded in Compound Document handled by ./ole2compounddocs
# mainly tested little endian variant
4 ubelong =0x0000FF99
>0 use PageMaker
# big endian variant
4 ubelong =0x000099FF
>0 use \^PageMaker
# display information of Aldus/Adobe PageMaker document/publication
0 name PageMaker
>110 uleshort <0x0600 Aldus
>110 uleshort >0x05FF Adobe
>110 uleshort x PageMaker
# "MP" marker for newer version 4 and above according to TrID
#>108 string x \b, MARKER "%.2s"
# http://www.nationalarchives.gov.uk/pronom/fmt/876
!:mime application/vnd.pagemaker
#!:mime application/x-pagemaker
# different file name extensions are used depending on version
# older version like 3
>110 uleshort/256 =0 document
# https://www.macdisk.com/macsigen.php
!:apple ALB3ALD3
# PT3 for template and no example for PageMaker document/publiction with PM3 extension
!:ext pm3/pt3
>110 uleshort/256 =4 document
!:apple ALD4ALB4
# no example for PT4 template
!:ext pm4/pt4
>110 uleshort/256 =5 document
!:apple ALD5ALB5
# no example for PT5 template
!:ext pm5/pt5
>110 uleshort =0x0600 document
!:apple ALD6ALB6
# PT6 for template
!:ext pm6/pt6
# HOWTO to distinguish version 7 from 6.5 ?
>110 uleshort =0x0632 document
!:apple AD65AB65
# no example for T65 template
!:ext p65/t65/pmd/pmt
# version 7 with PMT extension for template
#!:ext pmd/pmt
#!:apple ????PUBF
# endian marker FF 99 for little endian
>6 ubyte =0xFF \b, little-endian
>6 ubyte =0x99 \b, big-endian
# newer numeric version like: 4 5 6 6.50
#>110 uleshort x \b, VERSION=%#x
>110 uleshort >0x03FF
>>110 uleshort/256 x \b, version %u
>>110 uleshort%256 >0 \b.%u
# older version like 3
>110 uleshort <0x0400 \b, maybe version 3
# adobe indesign (document, whatever...) from querkan
0 belong 0x0606edf5 Adobe InDesign
>16 string DOCUMENT Document

6
magic/Magdir/xwindows
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: xwindows,v 1.12 2021/08/24 08:31:10 christos Exp $
# $File: xwindows,v 1.13 2022/03/24 15:48:58 christos Exp $
# xwindows: file(1) magic for various X/Window system file formats.
# Compiled X Keymap
@ -37,7 +37,7 @@
# X bitmap https://en.wikipedia.org/wiki/X_BitMap
0 search/2048 #define\040
>&0 regex [a-zA-Z0-9]+_width\040 xbm image
>>&0 regex [0-9]* (%sx
>>&0 regex [0-9]+ (%sx
>>>&0 string \n#define\040
>>>>&0 regex [a-zA-Z0-9]+_height\040
>>>>>&0 regex [0-9]* \b%s)
>>>>>&0 regex [0-9]+ \b%s)

30
magic/Magdir/zip
View File

@ -1,20 +1,28 @@
#------------------------------------------------------------------------------
# $File: zip,v 1.7 2021/04/26 15:56:00 christos Exp $
# $File: zip,v 1.8 2021/10/24 15:53:56 christos Exp $
# zip: file(1) magic for zip files; this is not use
# Note the version of magic in archive is currently stronger, this is
# just an example until negative offsets are supported better
# Note: All fields unless otherwise noted are unsigned!
# Zip Central Directory record
0 name zipcd
>0 string PK\001\002 Zip archive data
!:mime application/zip
# no "made by" in local file header with PK\3\4 magic
>>4 leshort x \b, made by
>>4 use zipversion
>>4 use ziphost
# inside ./archive 1.151 called "at least" zipversion "to extract"
>>6 leshort x \b, extract using at least
>>6 use zipversion
>>12 ledate x \b, last modified %s
>>24 lelong >0 \b, uncompressed size %d
# This is DOS date like: ledate 21:00:48 19 Dec 2001 != DOS 00:00 1 Jan 2010 ~ 0000213C
>>12 ulelong x \b, last modified
>>14 lemsdosdate x \b, last modified %s
>>12 lemsdostime x %s
# uncompressed size of 1st entry; FFffFFff means real value stored in ZIP64 record
>>24 ulelong !0xFFffFFff \b, uncompressed size %u
# inside ./archive 1.151 called "compression method="zipcompression
>>10 leshort x \b, method=
>>10 use zipcompression
@ -102,11 +110,17 @@
#>1 ubyte >19 unused %#x
# Zip End Of Central Directory record
# GRR: wrong for ZIP with comment archive
-22 string PK\005\006
#>4 leshort >1 \b, %d disks
#>6 leshort >1 \b, central directory disk %d
#>8 leshort >1 \b, %d central directories on this disk
#>10 leshort >1 \b, %d central directories
#>12 lelong x \b, %d central directory bytes
#>4 uleshort !0xFFff \b, %u disks
#>6 uleshort !0xFFff \b, central directory disk %u
#>8 uleshort !0xFFff \b, %u central directories on this disk
#>10 uleshort !0xFFff \b, %u central directories
#>12 ulelong !0xFFffFFff \b, %u central directory bytes
# offset of central directory
#>16 ulelong x \b, central directory offset %#x
>(16.l) use zipcd
# archive comment length n
#>>20 uleshort >0 \b, comment length %u
# archive comment
>>20 pstring/l >0 \b, %s

8
magic/Makefile.am
View File

@ -1,5 +1,5 @@
#
# $File: Makefile.am,v 1.172 2021/10/07 15:41:22 christos Exp $
# $File: Makefile.am,v 1.178 2022/04/02 14:47:42 christos Exp $
#
MAGIC_FRAGMENT_BASE = Magdir
MAGIC_DIR = $(top_srcdir)/magic
@ -29,6 +29,7 @@ $(MAGIC_FRAGMENT_DIR)/application \
$(MAGIC_FRAGMENT_DIR)/applix \
$(MAGIC_FRAGMENT_DIR)/apt \
$(MAGIC_FRAGMENT_DIR)/archive \
$(MAGIC_FRAGMENT_DIR)/aria \
$(MAGIC_FRAGMENT_DIR)/arm \
$(MAGIC_FRAGMENT_DIR)/asf \
$(MAGIC_FRAGMENT_DIR)/assembler \
@ -58,6 +59,7 @@ $(MAGIC_FRAGMENT_DIR)/c64 \
$(MAGIC_FRAGMENT_DIR)/cad \
$(MAGIC_FRAGMENT_DIR)/cafebabe \
$(MAGIC_FRAGMENT_DIR)/cbor \
$(MAGIC_FRAGMENT_DIR)/ccf \
$(MAGIC_FRAGMENT_DIR)/cddb \
$(MAGIC_FRAGMENT_DIR)/chord \
$(MAGIC_FRAGMENT_DIR)/cisco \
@ -89,6 +91,7 @@ $(MAGIC_FRAGMENT_DIR)/dif \
$(MAGIC_FRAGMENT_DIR)/diff \
$(MAGIC_FRAGMENT_DIR)/digital \
$(MAGIC_FRAGMENT_DIR)/dolby \
$(MAGIC_FRAGMENT_DIR)/dsf \
$(MAGIC_FRAGMENT_DIR)/dump \
$(MAGIC_FRAGMENT_DIR)/dyadic \
$(MAGIC_FRAGMENT_DIR)/ebml \
@ -206,6 +209,7 @@ $(MAGIC_FRAGMENT_DIR)/netbsd \
$(MAGIC_FRAGMENT_DIR)/netscape \
$(MAGIC_FRAGMENT_DIR)/netware \
$(MAGIC_FRAGMENT_DIR)/news \
$(MAGIC_FRAGMENT_DIR)/nifty \
$(MAGIC_FRAGMENT_DIR)/nim-lang \
$(MAGIC_FRAGMENT_DIR)/nitpicker \
$(MAGIC_FRAGMENT_DIR)/numpy \
@ -216,6 +220,7 @@ $(MAGIC_FRAGMENT_DIR)/ole2compounddocs \
$(MAGIC_FRAGMENT_DIR)/olf \
$(MAGIC_FRAGMENT_DIR)/openfst \
$(MAGIC_FRAGMENT_DIR)/opentimestamps \
$(MAGIC_FRAGMENT_DIR)/oric \
$(MAGIC_FRAGMENT_DIR)/os2 \
$(MAGIC_FRAGMENT_DIR)/os400 \
$(MAGIC_FRAGMENT_DIR)/os9 \
@ -228,6 +233,7 @@ $(MAGIC_FRAGMENT_DIR)/pbf \
$(MAGIC_FRAGMENT_DIR)/pbm \
$(MAGIC_FRAGMENT_DIR)/pc88 \
$(MAGIC_FRAGMENT_DIR)/pc98 \
$(MAGIC_FRAGMENT_DIR)/pci_ids \
$(MAGIC_FRAGMENT_DIR)/pcjr \
$(MAGIC_FRAGMENT_DIR)/pdf \
$(MAGIC_FRAGMENT_DIR)/pdp \

8
magic/Makefile.in
View File

@ -275,7 +275,7 @@ top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
#
# $File: Makefile.am,v 1.172 2021/10/07 15:41:22 christos Exp $
# $File: Makefile.am,v 1.178 2022/04/02 14:47:42 christos Exp $
#
MAGIC_FRAGMENT_BASE = Magdir
MAGIC_DIR = $(top_srcdir)/magic
@ -303,6 +303,7 @@ $(MAGIC_FRAGMENT_DIR)/application \
$(MAGIC_FRAGMENT_DIR)/applix \
$(MAGIC_FRAGMENT_DIR)/apt \
$(MAGIC_FRAGMENT_DIR)/archive \
$(MAGIC_FRAGMENT_DIR)/aria \
$(MAGIC_FRAGMENT_DIR)/arm \
$(MAGIC_FRAGMENT_DIR)/asf \
$(MAGIC_FRAGMENT_DIR)/assembler \
@ -332,6 +333,7 @@ $(MAGIC_FRAGMENT_DIR)/c64 \
$(MAGIC_FRAGMENT_DIR)/cad \
$(MAGIC_FRAGMENT_DIR)/cafebabe \
$(MAGIC_FRAGMENT_DIR)/cbor \
$(MAGIC_FRAGMENT_DIR)/ccf \
$(MAGIC_FRAGMENT_DIR)/cddb \
$(MAGIC_FRAGMENT_DIR)/chord \
$(MAGIC_FRAGMENT_DIR)/cisco \
@ -363,6 +365,7 @@ $(MAGIC_FRAGMENT_DIR)/dif \
$(MAGIC_FRAGMENT_DIR)/diff \
$(MAGIC_FRAGMENT_DIR)/digital \
$(MAGIC_FRAGMENT_DIR)/dolby \
$(MAGIC_FRAGMENT_DIR)/dsf \
$(MAGIC_FRAGMENT_DIR)/dump \
$(MAGIC_FRAGMENT_DIR)/dyadic \
$(MAGIC_FRAGMENT_DIR)/ebml \
@ -480,6 +483,7 @@ $(MAGIC_FRAGMENT_DIR)/netbsd \
$(MAGIC_FRAGMENT_DIR)/netscape \
$(MAGIC_FRAGMENT_DIR)/netware \
$(MAGIC_FRAGMENT_DIR)/news \
$(MAGIC_FRAGMENT_DIR)/nifty \
$(MAGIC_FRAGMENT_DIR)/nim-lang \
$(MAGIC_FRAGMENT_DIR)/nitpicker \
$(MAGIC_FRAGMENT_DIR)/numpy \
@ -490,6 +494,7 @@ $(MAGIC_FRAGMENT_DIR)/ole2compounddocs \
$(MAGIC_FRAGMENT_DIR)/olf \
$(MAGIC_FRAGMENT_DIR)/openfst \
$(MAGIC_FRAGMENT_DIR)/opentimestamps \
$(MAGIC_FRAGMENT_DIR)/oric \
$(MAGIC_FRAGMENT_DIR)/os2 \
$(MAGIC_FRAGMENT_DIR)/os400 \
$(MAGIC_FRAGMENT_DIR)/os9 \
@ -502,6 +507,7 @@ $(MAGIC_FRAGMENT_DIR)/pbf \
$(MAGIC_FRAGMENT_DIR)/pbm \
$(MAGIC_FRAGMENT_DIR)/pc88 \
$(MAGIC_FRAGMENT_DIR)/pc98 \
$(MAGIC_FRAGMENT_DIR)/pci_ids \
$(MAGIC_FRAGMENT_DIR)/pcjr \
$(MAGIC_FRAGMENT_DIR)/pdf \
$(MAGIC_FRAGMENT_DIR)/pdp \

451
src/apprentice.c
View File

@ -32,7 +32,7 @@
#include "file.h"
#ifndef lint
FILE_RCSID("@(#)$File: apprentice.c,v 1.309 2021/09/24 13:59:19 christos Exp $")
FILE_RCSID("@(#)$File: apprentice.c,v 1.324 2022/05/31 18:54:25 christos Exp $")
#endif /* lint */
#include "magic.h"
@ -50,6 +50,12 @@ FILE_RCSID("@(#)$File: apprentice.c,v 1.309 2021/09/24 13:59:19 christos Exp $")
#endif
#include <dirent.h>
#include <limits.h>
#ifdef HAVE_BYTESWAP_H
#include <byteswap.h>
#endif
#ifdef HAVE_SYS_BSWAP_H
#include <sys/bswap.h>
#endif
#define EATAB {while (isascii(CAST(unsigned char, *l)) && \
@ -114,7 +120,8 @@ private int parse(struct magic_set *, struct magic_entry *, const char *,
size_t, int);
private void eatsize(const char **);
private int apprentice_1(struct magic_set *, const char *, int);
private size_t apprentice_magic_strength(const struct magic *);
private ssize_t apprentice_magic_strength_1(const struct magic *);
private size_t apprentice_magic_strength(const struct magic *, size_t);
private int apprentice_sort(const void *, const void *);
private void apprentice_list(struct mlist *, int );
private struct magic_map *apprentice_load(struct magic_set *,
@ -124,9 +131,21 @@ private void mlist_free_all(struct magic_set *);
private void mlist_free(struct mlist *);
private void byteswap(struct magic *, uint32_t);
private void bs1(struct magic *);
#if defined(HAVE_BYTESWAP_H)
#define swap2(x) bswap_16(x)
#define swap4(x) bswap_32(x)
#define swap8(x) bswap_64(x)
#elif defined(HAVE_SYS_BSWAP_H)
#define swap2(x) bswap16(x)
#define swap4(x) bswap32(x)
#define swap8(x) bswap64(x)
#else
private uint16_t swap2(uint16_t);
private uint32_t swap4(uint32_t);
private uint64_t swap8(uint64_t);
#endif
private char *mkdbname(struct magic_set *, const char *, int);
private struct magic_map *apprentice_buf(struct magic_set *, struct magic *,
size_t);
@ -270,6 +289,12 @@ static const struct type_tbl_s type_tbl[] = {
{ XX("offset"), FILE_OFFSET, FILE_FMT_QUAD },
{ XX("bevarint"), FILE_BEVARINT, FILE_FMT_STR },
{ XX("levarint"), FILE_LEVARINT, FILE_FMT_STR },
{ XX("msdosdate"), FILE_MSDOSDATE, FILE_FMT_STR },
{ XX("lemsdosdate"), FILE_LEMSDOSDATE, FILE_FMT_STR },
{ XX("bemsdosdate"), FILE_BEMSDOSDATE, FILE_FMT_STR },
{ XX("msdostime"), FILE_MSDOSTIME, FILE_FMT_STR },
{ XX("lemsdostime"), FILE_LEMSDOSTIME, FILE_FMT_STR },
{ XX("bemsdostime"), FILE_BEMSDOSTIME, FILE_FMT_STR },
{ XX_NULL, FILE_INVALID, FILE_FMT_NONE },
};
@ -425,7 +450,15 @@ add_mlist(struct mlist *mlp, struct magic_map *map, size_t idx)
ml->map = idx == 0 ? map : NULL;
ml->magic = map->magic[idx];
ml->nmagic = map->nmagic[idx];
if (ml->nmagic) {
ml->magic_rxcomp = CAST(file_regex_t **,
calloc(ml->nmagic, sizeof(*ml->magic_rxcomp)));
if (ml->magic_rxcomp == NULL) {
free(ml);
return -1;
}
} else
ml->magic_rxcomp = NULL;
mlp->prev->next = ml;
ml->prev = mlp->prev;
ml->next = mlp;
@ -507,6 +540,9 @@ file_ms_free(struct magic_set *ms)
free(ms->o.pbuf);
free(ms->o.buf);
free(ms->c.li);
#ifdef USE_C_LOCALE
freelocale(ms->c_lc_ctype);
#endif
free(ms);
}
@ -546,6 +582,10 @@ file_ms_alloc(int flags)
ms->regex_max = FILE_REGEX_MAX;
ms->bytes_max = FILE_BYTES_MAX;
ms->encoding_max = FILE_ENCODING_MAX;
#ifdef USE_C_LOCALE
ms->c_lc_ctype = newlocale(LC_CTYPE_MASK, "C", 0);
assert(ms->c_lc_ctype != NULL);
#endif
return ms;
free:
free(ms);
@ -580,6 +620,7 @@ apprentice_unmap(struct magic_map *map)
break;
#endif
default:
fprintf(stderr, "Bad map type %d", map->type);
abort();
}
free(map);
@ -610,8 +651,20 @@ mlist_free_all(struct magic_set *ms)
private void
mlist_free_one(struct mlist *ml)
{
size_t i;
if (ml->map)
apprentice_unmap(CAST(struct magic_map *, ml->map));
for (i = 0; i < ml->nmagic; ++i) {
if (ml->magic_rxcomp[i]) {
file_regfree(ml->magic_rxcomp[i]);
free(ml->magic_rxcomp[i]);
ml->magic_rxcomp[i] = NULL;
}
}
free(ml->magic_rxcomp);
ml->magic_rxcomp = NULL;
free(ml);
}
@ -711,7 +764,7 @@ file_apprentice(struct magic_set *ms, const char *fn, int action)
fn = mfn;
while (fn) {
p = strchr(fn, PATHSEP);
p = CCAST(char *, strchr(fn, PATHSEP));
if (p)
*p++ = '\0';
if (*fn == '\0')
@ -817,6 +870,12 @@ typesize(int type)
case FILE_SHORT:
case FILE_LESHORT:
case FILE_BESHORT:
case FILE_MSDOSDATE:
case FILE_BEMSDOSDATE:
case FILE_LEMSDOSDATE:
case FILE_MSDOSTIME:
case FILE_BEMSDOSTIME:
case FILE_LEMSDOSTIME:
return 2;
case FILE_LONG:
@ -836,6 +895,8 @@ typesize(int type)
case FILE_FLOAT:
case FILE_BEFLOAT:
case FILE_LEFLOAT:
case FILE_BEID3:
case FILE_LEID3:
return 4;
case FILE_QUAD:
@ -869,8 +930,8 @@ typesize(int type)
/*
* Get weight of this magic entry, for sorting purposes.
*/
private size_t
apprentice_magic_strength(const struct magic *m)
private ssize_t
apprentice_magic_strength_1(const struct magic *m)
{
#define MULT 10U
size_t ts, v;
@ -878,8 +939,10 @@ apprentice_magic_strength(const struct magic *m)
switch (m->type) {
case FILE_DEFAULT: /* make sure this sorts last */
if (m->factor_op != FILE_FACTOR_OP_NONE)
if (m->factor_op != FILE_FACTOR_OP_NONE) {
fprintf(stderr, "Bad factor_op %d", m->factor_op);
abort();
}
return 0;
case FILE_BYTE:
@ -919,10 +982,21 @@ apprentice_magic_strength(const struct magic *m)
case FILE_BEVARINT:
case FILE_LEVARINT:
case FILE_GUID:
case FILE_BEID3:
case FILE_LEID3:
case FILE_OFFSET:
case FILE_MSDOSDATE:
case FILE_BEMSDOSDATE:
case FILE_LEMSDOSDATE:
case FILE_MSDOSTIME:
case FILE_BEMSDOSTIME:
case FILE_LEMSDOSTIME:
ts = typesize(m->type);
if (ts == FILE_BADSIZE)
if (ts == FILE_BADSIZE) {
(void)fprintf(stderr, "Bad size for type %d\n",
m->type);
abort();
}
val += ts * MULT;
break;
@ -950,6 +1024,7 @@ apprentice_magic_strength(const struct magic *m)
case FILE_INDIRECT:
case FILE_NAME:
case FILE_USE:
case FILE_CLEAR:
break;
case FILE_DER:
@ -986,6 +1061,33 @@ apprentice_magic_strength(const struct magic *m)
abort();
}
return val;
}
private size_t
apprentice_magic_strength(const struct magic *m,
size_t nmagic __attribute__((__unused__)))
{
ssize_t val = apprentice_magic_strength_1(m);
#ifdef notyet
if (m->desc[0] == '\0') {
size_t i;
/*
* Magic entries with no description get their continuations
* added
*/
for (i = 1; m[i].cont_level != 0 && i < MIN(nmagic, 3); i++) {
ssize_t v = apprentice_magic_strength_1(&m[i]) >>
(i + 1);
val += v;
if (m[i].desc[0] != '\0')
break;
}
}
#endif
switch (m->factor_op) {
case FILE_FACTOR_OP_NONE:
break;
@ -1002,18 +1104,22 @@ apprentice_magic_strength(const struct magic *m)
val /= m->factor;
break;
default:
(void)fprintf(stderr, "Bad factor_op %u\n", m->factor_op);
abort();
}
if (val <= 0) /* ensure we only return 0 for FILE_DEFAULT */
val = 1;
#ifndef notyet
/*
* Magic entries with no description get a bonus because they depend
* on subsequent magic entries to print something.
*/
if (m->desc[0] == '\0')
val++;
#endif
return val;
}
@ -1025,8 +1131,8 @@ apprentice_sort(const void *a, const void *b)
{
const struct magic_entry *ma = CAST(const struct magic_entry *, a);
const struct magic_entry *mb = CAST(const struct magic_entry *, b);
size_t sa = apprentice_magic_strength(ma->mp);
size_t sb = apprentice_magic_strength(mb->mp);
size_t sa = apprentice_magic_strength(ma->mp, ma->cont_count);
size_t sb = apprentice_magic_strength(mb->mp, mb->cont_count);
if (sa == sb)
return 0;
else if (sa > sb)
@ -1041,7 +1147,7 @@ apprentice_sort(const void *a, const void *b)
private void
apprentice_list(struct mlist *mlist, int mode)
{
uint32_t magindex = 0;
uint32_t magindex, descindex, mimeindex, lineindex;
struct mlist *ml;
for (ml = mlist->next; ml != mlist; ml = ml->next) {
for (magindex = 0; magindex < ml->nmagic; magindex++) {
@ -1058,17 +1164,22 @@ apprentice_list(struct mlist *mlist, int mode)
* Try to iterate over the tree until we find item with
* description/mimetype.
*/
while (magindex + 1 < ml->nmagic &&
ml->magic[magindex + 1].cont_level != 0 &&
*ml->magic[magindex].desc == '\0' &&
*ml->magic[magindex].mimetype == '\0')
magindex++;
lineindex = descindex = mimeindex = magindex;
for (magindex++; magindex < ml->nmagic &&
ml->magic[magindex].cont_level != 0; magindex++) {
if (*ml->magic[descindex].desc == '\0'
&& *ml->magic[magindex].desc)
descindex = magindex;
if (*ml->magic[mimeindex].mimetype == '\0'
&& *ml->magic[magindex].mimetype)
mimeindex = magindex;
}
printf("Strength = %3" SIZE_T_FORMAT "u@%u: %s [%s]\n",
apprentice_magic_strength(m),
ml->magic[magindex].lineno,
ml->magic[magindex].desc,
ml->magic[magindex].mimetype);
apprentice_magic_strength(m, ml->nmagic - magindex),
ml->magic[lineindex].lineno,
ml->magic[descindex].desc,
ml->magic[mimeindex].mimetype);
}
}
}
@ -1116,6 +1227,12 @@ set_test_type(struct magic *mstart, struct magic *m)
case FILE_DER:
case FILE_GUID:
case FILE_OFFSET:
case FILE_MSDOSDATE:
case FILE_BEMSDOSDATE:
case FILE_LEMSDOSDATE:
case FILE_MSDOSTIME:
case FILE_BEMSDOSTIME:
case FILE_LEMSDOSTIME:
mstart->flag |= BINTEST;
break;
case FILE_STRING:
@ -1162,19 +1279,20 @@ addentry(struct magic_set *ms, struct magic_entry *me,
struct magic_entry_set *mset)
{
size_t i = me->mp->type == FILE_NAME ? 1 : 0;
if (mset[i].count == mset[i].max) {
if (mset[i].me == NULL || mset[i].count == mset[i].max) {
struct magic_entry *mp;
mset[i].max += ALLOC_INCR;
size_t incr = mset[i].max + ALLOC_INCR;
if ((mp = CAST(struct magic_entry *,
realloc(mset[i].me, sizeof(*mp) * mset[i].max))) ==
realloc(mset[i].me, sizeof(*mp) * incr))) ==
NULL) {
file_oomem(ms, sizeof(*mp) * mset[i].max);
file_oomem(ms, sizeof(*mp) * incr);
return -1;
}
(void)memset(&mp[mset[i].count], 0, sizeof(*mp) *
ALLOC_INCR);
mset[i].me = mp;
mset[i].max = incr;
}
mset[i].me[mset[i].count++] = *me;
memset(me, 0, sizeof(*me));
@ -1535,6 +1653,12 @@ file_signextend(struct magic_set *ms, struct magic *m, uint64_t v)
case FILE_FLOAT:
case FILE_BEFLOAT:
case FILE_LEFLOAT:
case FILE_MSDOSDATE:
case FILE_BEMSDOSDATE:
case FILE_LEMSDOSDATE:
case FILE_MSDOSTIME:
case FILE_BEMSDOSTIME:
case FILE_LEMSDOSTIME:
v = CAST(int32_t, v);
break;
case FILE_QUAD:
@ -2413,11 +2537,9 @@ private int
parse_apple(struct magic_set *ms, struct magic_entry *me, const char *line,
size_t len)
{
struct magic *m = &me->mp[0];
return parse_extra(ms, me, line, len,
CAST(off_t, offsetof(struct magic, apple)),
sizeof(m->apple), "APPLE", "!+-./?", 0);
sizeof(me->mp[0].apple), "APPLE", "!+-./?", 0);
}
/*
@ -2427,11 +2549,9 @@ private int
parse_ext(struct magic_set *ms, struct magic_entry *me, const char *line,
size_t len)
{
struct magic *m = &me->mp[0];
return parse_extra(ms, me, line, len,
CAST(off_t, offsetof(struct magic, ext)),
sizeof(m->ext), "EXTENSION", ",!+-/@?_$&", 0); /* & for b&w */
sizeof(me->mp[0].ext), "EXTENSION", ",!+-/@?_$&", 0); /* & for b&w */
}
/*
@ -2442,11 +2562,9 @@ private int
parse_mime(struct magic_set *ms, struct magic_entry *me, const char *line,
size_t len)
{
struct magic *m = &me->mp[0];
return parse_extra(ms, me, line, len,
CAST(off_t, offsetof(struct magic, mimetype)),
sizeof(m->mimetype), "MIME", "+-/.$?:{}", 1);
sizeof(me->mp[0].mimetype), "MIME", "+-/.$?:{}", 1);
}
private int
@ -2485,6 +2603,7 @@ check_format_type(const char *ptr, int type, const char **estr)
h = 0;
break;
default:
fprintf(stderr, "Bad number format %d", type);
abort();
}
} else
@ -2627,6 +2746,7 @@ check_format_type(const char *ptr, int type, const char **estr)
default:
/* internal error */
fprintf(stderr, "Bad file format %d", type);
abort();
}
invalid:
@ -2721,12 +2841,11 @@ getvalue(struct magic_set *ms, struct magic *m, const char **p, int action)
}
if (m->type == FILE_REGEX) {
file_regex_t rx;
int rc = file_regcomp(&rx, m->value.s, REG_EXTENDED);
if (rc) {
if (ms->flags & MAGIC_CHECK)
file_regerror(&rx, rc, ms);
int rc = file_regcomp(ms, &rx, m->value.s,
REG_EXTENDED);
if (rc == 0) {
file_regfree(&rx);
}
file_regfree(&rx);
return rc ? -1 : 0;
}
return 0;
@ -2796,6 +2915,7 @@ getvalue(struct magic_set *ms, struct magic *m, const char **p, int action)
x = 0;
break;
default:
fprintf(stderr, "Bad width %zu", ts);
abort();
}
if (x) {
@ -2828,6 +2948,7 @@ getstr(struct magic_set *ms, struct magic *m, const char *s, int warn)
char *pmax = p + plen - 1;
int c;
int val;
size_t bracket_nesting = 0;
while ((c = *s++) != '\0') {
if (isspace(CAST(unsigned char, c)))
@ -2836,135 +2957,149 @@ getstr(struct magic_set *ms, struct magic *m, const char *s, int warn)
file_error(ms, 0, "string too long: `%s'", origs);
return NULL;
}
if (c == '\\') {
switch(c = *s++) {
if (c != '\\') {
if (c == '[') {
bracket_nesting++;
}
if (c == ']' && bracket_nesting > 0) {
bracket_nesting--;
}
*p++ = CAST(char, c);
continue;
}
switch(c = *s++) {
case '\0':
if (warn)
file_magwarn(ms, "incomplete escape");
s--;
goto out;
case '\t':
if (warn) {
file_magwarn(ms,
"escaped tab found, use \\t instead");
warn = 0; /* already did */
}
/*FALLTHROUGH*/
default:
if (warn) {
if (isprint(CAST(unsigned char, c))) {
/* Allow escaping of
* ``relations'' */
if (strchr("<>&^=!", c) == NULL
&& (m->type != FILE_REGEX ||
strchr("[]().*?^$|{}", c)
== NULL)) {
file_magwarn(ms, "no "
"need to escape "
"`%c'", c);
}
} else {
file_magwarn(ms,
"unknown escape sequence: "
"\\%03o", c);
case '\0':
if (warn)
file_magwarn(ms, "incomplete escape");
s--;
goto out;
case '.':
if (m->type == FILE_REGEX &&
bracket_nesting == 0 && warn) {
file_magwarn(ms, "escaped dot ('.') found, "
"use \\\\. instead");
}
warn = 0; /* already did */
/*FALLTHROUGH*/
case '\t':
if (warn) {
file_magwarn(ms,
"escaped tab found, use \\\\t instead");
warn = 0; /* already did */
}
/*FALLTHROUGH*/
default:
if (warn) {
if (isprint(CAST(unsigned char, c))) {
/* Allow escaping of
* ``relations'' */
if (strchr("<>&^=!", c) == NULL
&& (m->type != FILE_REGEX ||
strchr("[]().*?^$|{}", c)
== NULL)) {
file_magwarn(ms, "no "
"need to escape "
"`%c'", c);
}
} else {
file_magwarn(ms,
"unknown escape sequence: "
"\\%03o", c);
}
/*FALLTHROUGH*/
/* space, perhaps force people to use \040? */
case ' ':
}
/*FALLTHROUGH*/
/* space, perhaps force people to use \040? */
case ' ':
#if 0
/*
* Other things people escape, but shouldn't need to,
* so we disallow them
*/
case '\'':
case '"':
case '?':
/*
* Other things people escape, but shouldn't need to,
* so we disallow them
*/
case '\'':
case '"':
case '?':
#endif
/* Relations */
case '>':
case '<':
case '&':
case '^':
case '=':
case '!':
/* and baskslash itself */
case '\\':
*p++ = CAST(char, c);
break;
/* Relations */
case '>':
case '<':
case '&':
case '^':
case '=':
case '!':
/* and backslash itself */
case '\\':
*p++ = CAST(char, c);
break;
case 'a':
*p++ = '\a';
break;
case 'a':
*p++ = '\a';
break;
case 'b':
*p++ = '\b';
break;
case 'b':
*p++ = '\b';
break;
case 'f':
*p++ = '\f';
break;
case 'f':
*p++ = '\f';
break;
case 'n':
*p++ = '\n';
break;
case 'n':
*p++ = '\n';
break;
case 'r':
*p++ = '\r';
break;
case 'r':
*p++ = '\r';
break;
case 't':
*p++ = '\t';
break;
case 't':
*p++ = '\t';
break;
case 'v':
*p++ = '\v';
break;
case 'v':
*p++ = '\v';
break;
/* \ and up to 3 octal digits */
case '0':
case '1':
case '2':
case '3':
case '4':
case '5':
case '6':
case '7':
val = c - '0';
c = *s++; /* try for 2 */
if (c >= '0' && c <= '7') {
val = (val << 3) | (c - '0');
c = *s++; /* try for 3 */
if (c >= '0' && c <= '7')
val = (val << 3) | (c-'0');
else
--s;
}
/* \ and up to 3 octal digits */
case '0':
case '1':
case '2':
case '3':
case '4':
case '5':
case '6':
case '7':
val = c - '0';
c = *s++; /* try for 2 */
if (c >= '0' && c <= '7') {
val = (val << 3) | (c - '0');
c = *s++; /* try for 3 */
if (c >= '0' && c <= '7')
val = (val << 3) | (c-'0');
else
--s;
*p++ = CAST(char, val);
break;
/* \x and up to 2 hex digits */
case 'x':
val = 'x'; /* Default if no digits */
c = hextoint(*s++); /* Get next char */
if (c >= 0) {
val = c;
c = hextoint(*s++);
if (c >= 0)
val = (val << 4) + c;
else
--s;
} else
--s;
*p++ = CAST(char, val);
break;
}
} else
*p++ = CAST(char, c);
else
--s;
*p++ = CAST(char, val);
break;
/* \x and up to 2 hex digits */
case 'x':
val = 'x'; /* Default if no digits */
c = hextoint(*s++); /* Get next char */
if (c >= 0) {
val = c;
c = hextoint(*s++);
if (c >= 0)
val = (val << 4) + c;
else
--s;
} else
--s;
*p++ = CAST(char, val);
break;
}
}
--s;
out:
@ -3355,6 +3490,7 @@ byteswap(struct magic *magic, uint32_t nmagic)
bs1(&magic[i]);
}
#if !defined(HAVE_BYTESWAP_H) && !defined(HAVE_SYS_BSWAP_H)
/*
* swap a short
*/
@ -3394,7 +3530,7 @@ swap8(uint64_t sv)
uint64_t rv;
uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
#if 0
# if 0
d[0] = s[3];
d[1] = s[2];
d[2] = s[1];
@ -3403,7 +3539,7 @@ swap8(uint64_t sv)
d[5] = s[6];
d[6] = s[5];
d[7] = s[4];
#else
# else
d[0] = s[7];
d[1] = s[6];
d[2] = s[5];
@ -3412,9 +3548,10 @@ swap8(uint64_t sv)
d[5] = s[2];
d[6] = s[1];
d[7] = s[0];
#endif
# endif
return rv;
}
#endif
protected uintmax_t
file_varint2uintmax_t(const unsigned char *us, int t, size_t *l)
@ -3548,13 +3685,13 @@ file_magicfind(struct magic_set *ms, const char *name, struct mlist *v)
for (ml = mlist->next; ml != mlist; ml = ml->next) {
struct magic *ma = ml->magic;
uint32_t nma = ml->nmagic;
for (i = 0; i < nma; i++) {
for (i = 0; i < ml->nmagic; i++) {
if (ma[i].type != FILE_NAME)
continue;
if (strcmp(ma[i].value.s, name) == 0) {
v->magic = &ma[i];
for (j = i + 1; j < nma; j++)
v->magic_rxcomp = &(ml->magic_rxcomp[i]);
for (j = i + 1; j < ml->nmagic; j++)
if (ma[j].cont_level == 0)
break;
v->nmagic = j - i;

6
src/ascmagic.c
View File

@ -35,7 +35,7 @@
#include "file.h"
#ifndef lint
FILE_RCSID("@(#)$File: ascmagic.c,v 1.109 2021/02/05 23:01:40 christos Exp $")
FILE_RCSID("@(#)$File: ascmagic.c,v 1.110 2021/12/06 15:33:00 christos Exp $")
#endif /* lint */
#include "magic.h"
@ -273,8 +273,8 @@ file_ascmagic_with_encoding(struct magic_set *ms, const struct buffer *b,
goto done;
if (has_long_lines)
if (file_printf(ms, ", with very long lines (%zu)",
has_long_lines) == -1)
if (file_printf(ms, ", with very long lines (%"
SIZE_T_FORMAT "u)", has_long_lines) == -1)
goto done;
/*

18
src/cdf.c
View File

@ -35,7 +35,7 @@
#include "file.h"
#ifndef lint
FILE_RCSID("@(#)$File: cdf.c,v 1.120 2021/09/24 13:59:19 christos Exp $")
FILE_RCSID("@(#)$File: cdf.c,v 1.121 2021/10/20 13:56:15 christos Exp $")
#endif
#include <assert.h>
@ -48,6 +48,12 @@ FILE_RCSID("@(#)$File: cdf.c,v 1.120 2021/09/24 13:59:19 christos Exp $")
#include <time.h>
#include <ctype.h>
#include <limits.h>
#ifdef HAVE_BYTESWAP_H
#include <byteswap.h>
#endif
#ifdef HAVE_SYS_BSWAP_H
#include <sys/bswap.h>
#endif
#ifndef EFTYPE
#define EFTYPE EINVAL
@ -124,6 +130,15 @@ cdf_calloc(const char *file __attribute__((__unused__)),
return calloc(n, u);
}
#if defined(HAVE_BYTESWAP_H)
# define _cdf_tole2(x) bswap_16(x)
# define _cdf_tole4(x) bswap_32(x)
# define _cdf_tole8(x) bswap_64(x)
#elif defined(HAVE_SYS_BSWAP_H)
# define _cdf_tole2(x) bswap16(x)
# define _cdf_tole4(x) bswap32(x)
# define _cdf_tole8(x) bswap64(x)
#else
/*
* swap a short
*/
@ -173,6 +188,7 @@ _cdf_tole8(uint64_t sv)
d[7] = s[0];
return rv;
}
#endif
/*
* grab a uint32_t from a possibly unaligned address, and return it in

7
src/cdf_time.c
View File

@ -27,7 +27,7 @@
#include "file.h"
#ifndef lint
FILE_RCSID("@(#)$File: cdf_time.c,v 1.19 2019/03/12 20:43:05 christos Exp $")
FILE_RCSID("@(#)$File: cdf_time.c,v 1.20 2021/12/06 15:33:00 christos Exp $")
#endif
#include <time.h>
@ -171,8 +171,13 @@ cdf_ctime(const time_t *sec, char *buf)
char *ptr = ctime_r(sec, buf);
if (ptr != NULL)
return buf;
#ifdef WIN32
(void)snprintf(buf, 26, "*Bad* 0x%16.16I64x\n",
CAST(long long, *sec));
#else
(void)snprintf(buf, 26, "*Bad* %#16.16" INT64_T_FORMAT "x\n",
CAST(long long, *sec));
#endif
return buf;
}

125
src/compress.c
View File

@ -35,7 +35,7 @@
#include "file.h"
#ifndef lint
FILE_RCSID("@(#)$File: compress.c,v 1.129 2020/12/08 21:26:00 christos Exp $")
FILE_RCSID("@(#)$File: compress.c,v 1.135 2022/04/11 18:14:41 christos Exp $")
#endif
#include "magic.h"
@ -43,6 +43,9 @@ FILE_RCSID("@(#)$File: compress.c,v 1.129 2020/12/08 21:26:00 christos Exp $")
#ifdef HAVE_UNISTD_H
#include <unistd.h>
#endif
#ifdef HAVE_SPAWN_H
#include <spawn.h>
#endif
#include <string.h>
#include <errno.h>
#include <ctype.h>
@ -51,7 +54,7 @@ FILE_RCSID("@(#)$File: compress.c,v 1.129 2020/12/08 21:26:00 christos Exp $")
#ifndef HAVE_SIG_T
typedef void (*sig_t)(int);
#endif /* HAVE_SIG_T */
#if !defined(__MINGW32__) && !defined(WIN32) && !defined(__MINGW64__)
#ifdef HAVE_SYS_IOCTL_H
#include <sys/ioctl.h>
#endif
#ifdef HAVE_SYS_WAIT_H
@ -449,7 +452,21 @@ file_pipe2file(struct magic_set *ms, int fd, const void *startbuf,
ssize_t r;
int tfd;
(void)strlcpy(buf, "/tmp/file.XXXXXX", sizeof buf);
#ifdef WIN32
const char *t;
buf[0] = '\0';
if ((t = getenv("TEMP")) != NULL)
(void)strlcpy(buf, t, sizeof(buf));
else if ((t = getenv("TMP")) != NULL)
(void)strlcpy(buf, t, sizeof(buf));
else if ((t = getenv("TMPDIR")) != NULL)
(void)strlcpy(buf, t, sizeof(buf));
if (buf[0] != '\0')
(void)strlcat(buf, "/", sizeof(buf));
(void)strlcat(buf, "file.XXXXXX", sizeof(buf));
#else
(void)strlcpy(buf, "/tmp/file.XXXXXX", sizeof(buf));
#endif
#ifndef HAVE_MKSTEMP
{
char *ptr = mktemp(buf);
@ -718,16 +735,61 @@ closep(int *fd)
closefd(fd, i);
}
static int
copydesc(int i, int fd)
static void
movedesc(void *v, int i, int fd)
{
if (fd == i)
return 0; /* "no dup was necessary" */
return; /* "no dup was necessary" */
#ifdef HAVE_POSIX_SPAWNP
posix_spawn_file_actions_t *fa = RCAST(posix_spawn_file_actions_t *, v);
posix_spawn_file_actions_adddup2(fa, fd, i);
posix_spawn_file_actions_addclose(fa, fd);
#else
if (dup2(fd, i) == -1) {
DPRINTF("dup(%d, %d) failed (%s)\n", fd, i, strerror(errno));
exit(1);
}
return 1;
close(v ? fd : fd);
#endif
}
static void
closedesc(void *v, int fd)
{
#ifdef HAVE_POSIX_SPAWNP
posix_spawn_file_actions_t *fa = RCAST(posix_spawn_file_actions_t *, v);
posix_spawn_file_actions_addclose(fa, fd);
#else
close(v ? fd : fd);
#endif
}
static void
handledesc(void *v, int fd, int fdp[3][2])
{
if (fd != -1) {
(void) lseek(fd, CAST(off_t, 0), SEEK_SET);
movedesc(v, STDIN_FILENO, fd);
} else {
movedesc(v, STDIN_FILENO, fdp[STDIN_FILENO][0]);
if (fdp[STDIN_FILENO][1] > 2)
closedesc(v, fdp[STDIN_FILENO][1]);
}
file_clear_closexec(STDIN_FILENO);
///FIXME: if one of the fdp[i][j] is 0 or 1, this can bomb spectacularly
movedesc(v, STDOUT_FILENO, fdp[STDOUT_FILENO][1]);
if (fdp[STDOUT_FILENO][0] > 2)
closedesc(v, fdp[STDOUT_FILENO][0]);
file_clear_closexec(STDOUT_FILENO);
movedesc(v, STDERR_FILENO, fdp[STDERR_FILENO][1]);
if (fdp[STDERR_FILENO][0] > 2)
closedesc(v, fdp[STDERR_FILENO][0]);
file_clear_closexec(STDERR_FILENO);
}
static pid_t
@ -817,6 +879,10 @@ uncompressbuf(int fd, size_t bytes_max, size_t method, const unsigned char *old,
pid_t writepid = -1;
size_t i;
ssize_t r;
char *const *args;
#ifdef HAVE_POSIX_SPAWNP
posix_spawn_file_actions_t fa;
#endif
switch (method) {
#ifdef BUILTIN_DECOMPRESS
@ -867,6 +933,22 @@ uncompressbuf(int fd, size_t bytes_max, size_t method, const unsigned char *old,
strerror(errno));
}
args = RCAST(char *const *, RCAST(intptr_t, compr[method].argv));
#ifdef HAVE_POSIX_SPAWNP
posix_spawn_file_actions_init(&fa);
handledesc(&fa, fd, fdp);
status = posix_spawnp(&pid, compr[method].argv[0], &fa, NULL,
args, NULL);
posix_spawn_file_actions_destroy(&fa);
if (status == -1) {
return makeerror(newch, n, "Cannot posix_spawn `%s', %s",
compr[method].argv[0], strerror(errno));
}
#else
/* For processes with large mapped virtual sizes, vfork
* may be _much_ faster (10-100 times) than fork.
*/
@ -881,37 +963,14 @@ uncompressbuf(int fd, size_t bytes_max, size_t method, const unsigned char *old,
* in a way which confuses parent. In particular,
* do not modify fdp[i][j].
*/
if (fd != -1) {
(void) lseek(fd, CAST(off_t, 0), SEEK_SET);
if (copydesc(STDIN_FILENO, fd))
(void) close(fd);
} else {
if (copydesc(STDIN_FILENO, fdp[STDIN_FILENO][0]))
(void) close(fdp[STDIN_FILENO][0]);
if (fdp[STDIN_FILENO][1] > 2)
(void) close(fdp[STDIN_FILENO][1]);
}
file_clear_closexec(STDIN_FILENO);
handledesc(NULL, fd, fdp);
///FIXME: if one of the fdp[i][j] is 0 or 1, this can bomb spectacularly
if (copydesc(STDOUT_FILENO, fdp[STDOUT_FILENO][1]))
(void) close(fdp[STDOUT_FILENO][1]);
if (fdp[STDOUT_FILENO][0] > 2)
(void) close(fdp[STDOUT_FILENO][0]);
file_clear_closexec(STDOUT_FILENO);
if (copydesc(STDERR_FILENO, fdp[STDERR_FILENO][1]))
(void) close(fdp[STDERR_FILENO][1]);
if (fdp[STDERR_FILENO][0] > 2)
(void) close(fdp[STDERR_FILENO][0]);
file_clear_closexec(STDERR_FILENO);
(void)execvp(compr[method].argv[0],
RCAST(char *const *, RCAST(intptr_t, compr[method].argv)));
(void)execvp(compr[method].argv[0], args);
dprintf(STDERR_FILENO, "exec `%s' failed, %s",
compr[method].argv[0], strerror(errno));
_exit(1); /* _exit(), not exit(), because of vfork */
}
#endif
/* parent */
/* Close write sides of child stdout/err pipes */
for (i = 1; i < __arraycount(fdp); i++)

8
src/der.c
View File

@ -35,7 +35,7 @@
#include "file.h"
#ifndef lint
FILE_RCSID("@(#)$File: der.c,v 1.21 2020/06/15 00:58:10 christos Exp $")
FILE_RCSID("@(#)$File: der.c,v 1.22 2022/01/10 14:15:08 christos Exp $")
#endif
#else
#define SIZE_T_FORMAT "z"
@ -235,6 +235,7 @@ der_tag(char *buf, size_t len, uint32_t tag)
static int
der_data(char *buf, size_t blen, uint32_t tag, const void *q, uint32_t len)
{
uint32_t i;
const uint8_t *d = CAST(const uint8_t *, q);
switch (tag) {
case DER_TAG_PRINTABLE_STRING:
@ -251,7 +252,7 @@ der_data(char *buf, size_t blen, uint32_t tag, const void *q, uint32_t len)
break;
}
for (uint32_t i = 0; i < len; i++) {
for (i = 0; i < len; i++) {
uint32_t z = i << 1;
if (z < blen - 2)
snprintf(buf + z, blen - z, "%.2x", d[i]);
@ -283,7 +284,8 @@ der_offs(struct magic_set *ms, struct magic *m, size_t nbytes)
offs += ms->offset + m->offset;
DPRINTF(("cont_level = %d\n", m->cont_level));
#ifdef DEBUG_DER
for (size_t i = 0; i < m->cont_level; i++)
size_t i;
for (i = 0; i < m->cont_level; i++)
printf("cont_level[%" SIZE_T_FORMAT "u] = %u\n", i,
ms->c.li[i].off);
#endif

58
src/encoding.c
View File

@ -35,7 +35,7 @@
#include "file.h"
#ifndef lint
FILE_RCSID("@(#)$File: encoding.c,v 1.32 2021/04/27 19:37:14 christos Exp $")
FILE_RCSID("@(#)$File: encoding.c,v 1.38 2022/06/10 13:40:17 christos Exp $")
#endif /* lint */
#include "magic.h"
@ -80,7 +80,6 @@ file_encoding(struct magic_set *ms, const struct buffer *b,
size_t nbytes = b->flen;
size_t mlen;
int rv = 1, ucs_type;
unsigned char *nbuf = NULL;
file_unichar_t *udefbuf;
size_t udeflen;
@ -103,13 +102,6 @@ file_encoding(struct magic_set *ms, const struct buffer *b,
file_oomem(ms, mlen);
goto done;
}
mlen = (nbytes + 1) * sizeof(nbuf[0]);
if ((nbuf = CAST(unsigned char *,
calloc(CAST(size_t, 1), mlen))) == NULL) {
file_oomem(ms, mlen);
goto done;
}
if (looks_ascii(buf, nbytes, *ubuf, ulen)) {
if (looks_utf7(buf, nbytes, *ubuf, ulen) > 0) {
DPRINTF(("utf-7 %" SIZE_T_FORMAT "u\n", *ulen));
@ -155,6 +147,13 @@ file_encoding(struct magic_set *ms, const struct buffer *b,
*code = "Non-ISO extended-ASCII";
*code_mime = "unknown-8bit";
} else {
unsigned char *nbuf;
mlen = (nbytes + 1) * sizeof(nbuf[0]);
if ((nbuf = CAST(unsigned char *, malloc(mlen))) == NULL) {
file_oomem(ms, mlen);
goto done;
}
from_ebcdic(buf, nbytes, nbuf);
if (looks_ascii(nbuf, nbytes, *ubuf, ulen)) {
@ -171,10 +170,10 @@ file_encoding(struct magic_set *ms, const struct buffer *b,
rv = 0;
*type = "binary";
}
free(nbuf);
}
done:
free(nbuf);
if (ubuf == &udefbuf)
free(udefbuf);
@ -458,11 +457,16 @@ looks_utf7(const unsigned char *buf, size_t nbytes, file_unichar_t *ubuf,
return -1;
}
#define UCS16_NOCHAR(c) ((c) >= 0xfdd0 && (c) <= 0xfdef)
#define UCS16_HISURR(c) ((c) >= 0xd800 && (c) <= 0xdbff)
#define UCS16_LOSURR(c) ((c) >= 0xdc00 && (c) <= 0xdfff)
private int
looks_ucs16(const unsigned char *bf, size_t nbytes, file_unichar_t *ubf,
size_t *ulen)
{
int bigend;
uint32_t hi;
size_t i;
if (nbytes < 2)
@ -476,21 +480,39 @@ looks_ucs16(const unsigned char *bf, size_t nbytes, file_unichar_t *ubf,
return 0;
*ulen = 0;
hi = 0;
for (i = 2; i + 1 < nbytes; i += 2) {
/* XXX fix to properly handle chars > 65536 */
uint32_t uc;
if (bigend)
ubf[(*ulen)++] = bf[i + 1]
| (CAST(file_unichar_t, bf[i]) << 8);
uc = bf[i + 1] | (CAST(file_unichar_t, bf[i]) << 8);
else
ubf[(*ulen)++] = bf[i]
| (CAST(file_unichar_t, bf[i + 1]) << 8);
uc = bf[i] | (CAST(file_unichar_t, bf[i + 1]) << 8);
if (ubf[*ulen - 1] == 0xfffe)
uc &= 0xffff;
switch (uc) {
case 0xfffe:
case 0xffff:
return 0;
if (ubf[*ulen - 1] < 128 &&
text_chars[CAST(size_t, ubf[*ulen - 1])] != T)
default:
if (UCS16_NOCHAR(uc))
return 0;
break;
}
if (hi) {
if (!UCS16_LOSURR(uc))
return 0;
uc = 0x10000 + 0x400 * (hi - 1) + (uc - 0xdc00);
hi = 0;
}
if (uc < 128 && text_chars[CAST(size_t, uc)] != T)
return 0;
ubf[(*ulen)++] = uc;
if (UCS16_HISURR(uc))
hi = uc - 0xd800 + 1;
if (UCS16_LOSURR(uc))
return 0;
}

98
src/file.c
View File

@ -32,7 +32,7 @@
#include "file.h"
#ifndef lint
FILE_RCSID("@(#)$File: file.c,v 1.190 2021/09/24 14:14:26 christos Exp $")
FILE_RCSID("@(#)$File: file.c,v 1.195 2022/06/02 15:45:43 christos Exp $")
#endif /* lint */
#include "magic.h"
@ -57,6 +57,9 @@ FILE_RCSID("@(#)$File: file.c,v 1.190 2021/09/24 14:14:26 christos Exp $")
#ifdef HAVE_WCHAR_H
#include <wchar.h>
#endif
#ifdef HAVE_WCTYPE_H
#include <wctype.h>
#endif
#if defined(HAVE_GETOPT_H) && defined(HAVE_STRUCT_OPTION)
# include <getopt.h>
@ -182,7 +185,7 @@ int
main(int argc, char *argv[])
{
int c;
size_t i;
size_t i, j, wid, nw;
int action = 0, didsomefiles = 0, errflg = 0;
int flags = 0, e = 0;
#ifdef HAVE_LIBSECCOMP
@ -408,27 +411,30 @@ main(int argc, char *argv[])
if (optind == argc) {
if (!didsomefiles)
usage();
}
else {
size_t j, wid, nw;
for (wid = 0, j = CAST(size_t, optind); j < CAST(size_t, argc);
j++) {
nw = file_mbswidth(argv[j]);
if (nw > wid)
wid = nw;
}
/*
* If bflag is only set twice, set it depending on
* number of files [this is undocumented, and subject to change]
*/
if (bflag == 2) {
bflag = optind >= argc - 1;
}
for (; optind < argc; optind++)
e |= process(magic, argv[optind], wid);
goto out;
}
for (wid = 0, j = CAST(size_t, optind); j < CAST(size_t, argc);
j++) {
nw = file_mbswidth(magic, argv[j]);
if (nw > wid)
wid = nw;
}
/*
* If bflag is only set twice, set it depending on
* number of files [this is undocumented, and subject to change]
*/
if (bflag == 2) {
bflag = optind >= argc - 1;
}
for (; optind < argc; optind++)
e |= process(magic, argv[optind], wid);
out:
if (!nobuffer)
e |= fflush(stdout) != 0;
if (magic)
magic_close(magic);
return e;
@ -453,7 +459,7 @@ setparam(const char *p)
size_t i;
char *s;
if ((s = strchr(p, '=')) == NULL)
if ((s = CCAST(char *, strchr(p, '='))) == NULL)
goto badparm;
for (i = 0; i < __arraycount(pm); i++) {
@ -513,7 +519,7 @@ unwrap(struct magic_set *ms, const char *fn)
while ((len = getline(&line, &llen, f)) > 0) {
if (line[len - 1] == '\n')
line[len - 1] = '\0';
cwid = file_mbswidth(line);
cwid = file_mbswidth(ms, line);
if (cwid > wid)
wid = cwid;
}
@ -540,35 +546,45 @@ process(struct magic_set *ms, const char *inname, int wid)
{
const char *type, c = nulsep > 1 ? '\0' : '\n';
int std_in = strcmp(inname, "-") == 0;
int haderror = 0;
size_t plen = 4 * wid + 1;
char *pbuf, *pname;
if ((pbuf = CAST(char *, malloc(plen))) == NULL)
file_err(EXIT_FAILURE, "Can't allocate %zu bytes", plen);
if (wid > 0 && !bflag) {
(void)printf("%s", std_in ? "/dev/stdin" : inname);
pname = file_printable(ms, pbuf, plen, inname, wid);
(void)printf("%s", std_in ? "/dev/stdin" : pname);
if (nulsep)
(void)putc('\0', stdout);
if (nulsep < 2) {
(void)printf("%s", separator);
(void)printf("%*s ", CAST(int, nopad ? 0
: (wid - file_mbswidth(inname))), "");
: (wid - file_mbswidth(ms, inname))), "");
}
}
type = magic_file(ms, std_in ? NULL : inname);
if (type == NULL) {
(void)printf("ERROR: %s%c", magic_error(ms), c);
haderror |= printf("ERROR: %s%c", magic_error(ms), c);
} else {
(void)printf("%s%c", type, c);
haderror |= printf("%s%c", type, c) < 0;
}
if (nobuffer)
(void)fflush(stdout);
return type == NULL;
haderror |= fflush(stdout) != 0;
free(pbuf);
return haderror || type == NULL;
}
protected size_t
file_mbswidth(const char *s)
file_mbswidth(struct magic_set *ms, const char *s)
{
#if defined(HAVE_WCHAR_H) && defined(HAVE_MBRTOWC) && defined(HAVE_WCWIDTH)
size_t bytesconsumed, old_n, n, width = 0;
size_t width = 0;
#if defined(HAVE_WCHAR_H) && defined(HAVE_MBRTOWC) && defined(HAVE_WCWIDTH) && \
defined(HAVE_WCTYPE_H)
size_t bytesconsumed, old_n, n;
mbstate_t state;
wchar_t nextchar;
(void)memset(&state, 0, sizeof(mbstate_t));
@ -581,22 +597,18 @@ file_mbswidth(const char *s)
/* Something went wrong, return something reasonable */
return old_n;
}
if (s[0] == '\n') {
/*
* do what strlen() would do, so that caller
* is always right
*/
width++;
} else {
int w = wcwidth(nextchar);
if (w > 0)
width += w;
}
width += ((ms->flags & MAGIC_RAW) != 0
|| iswprint(nextchar)) ? wcwidth(nextchar) : 4;
s += bytesconsumed, n -= bytesconsumed;
}
return width;
#else
while (*s) {
width += (ms->flags & MAGIC_RAW) != 0
|| isprint(CAST(unsigned char, *s)) ? 1 : 4;
}
return strlen(s);
#endif
}
@ -626,7 +638,7 @@ docprint(const char *opts, int def)
int comma, pad;
char *sp, *p;
p = strchr(opts, '%');
p = CCAST(char *, strchr(opts, '%'));
if (p == NULL) {
fprintf(stdout, "%s", opts);
defprint(def);

164
src/file.h
View File

@ -27,7 +27,7 @@
*/
/*
* file.h - definitions for file(1) program
* @(#)$File: file.h,v 1.227 2021/06/30 10:08:48 christos Exp $
* @(#)$File: file.h,v 1.234 2022/05/28 20:24:09 christos Exp $
*/
#ifndef __file_h__
@ -88,6 +88,10 @@
/* Do this here and now, because struct stat gets re-defined on solaris */
#include <sys/stat.h>
#include <stdarg.h>
#include <locale.h>
#if defined(HAVE_XLOCALE_H)
#include <xlocale.h>
#endif
#define ENABLE_CONDITIONALS
@ -157,7 +161,7 @@
#define MAXstring 128 /* max len of "string" types */
#define MAGICNO 0xF11E041C
#define VERSIONNO 16
#define VERSIONNO 17
#define FILE_MAGICSIZE 376
#define FILE_GUID_SIZE sizeof("XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX")
@ -167,6 +171,8 @@
#define FILE_COMPILE 2
#define FILE_LIST 3
typedef regex_t file_regex_t;
struct buffer {
int fd;
struct stat st;
@ -213,60 +219,66 @@ struct magic {
uint8_t vallen; /* length of string value, if any */
uint8_t type; /* comparison type (FILE_*) */
uint8_t in_type; /* type of indirection */
#define FILE_INVALID 0
#define FILE_BYTE 1
#define FILE_SHORT 2
#define FILE_DEFAULT 3
#define FILE_LONG 4
#define FILE_STRING 5
#define FILE_DATE 6
#define FILE_BESHORT 7
#define FILE_BELONG 8
#define FILE_BEDATE 9
#define FILE_LESHORT 10
#define FILE_LELONG 11
#define FILE_LEDATE 12
#define FILE_PSTRING 13
#define FILE_LDATE 14
#define FILE_BELDATE 15
#define FILE_LELDATE 16
#define FILE_REGEX 17
#define FILE_BESTRING16 18
#define FILE_LESTRING16 19
#define FILE_SEARCH 20
#define FILE_MEDATE 21
#define FILE_MELDATE 22
#define FILE_MELONG 23
#define FILE_QUAD 24
#define FILE_LEQUAD 25
#define FILE_BEQUAD 26
#define FILE_QDATE 27
#define FILE_LEQDATE 28
#define FILE_BEQDATE 29
#define FILE_QLDATE 30
#define FILE_LEQLDATE 31
#define FILE_BEQLDATE 32
#define FILE_FLOAT 33
#define FILE_BEFLOAT 34
#define FILE_LEFLOAT 35
#define FILE_DOUBLE 36
#define FILE_BEDOUBLE 37
#define FILE_LEDOUBLE 38
#define FILE_BEID3 39
#define FILE_LEID3 40
#define FILE_INDIRECT 41
#define FILE_QWDATE 42
#define FILE_LEQWDATE 43
#define FILE_BEQWDATE 44
#define FILE_NAME 45
#define FILE_USE 46
#define FILE_CLEAR 47
#define FILE_DER 48
#define FILE_GUID 49
#define FILE_OFFSET 50
#define FILE_BEVARINT 51
#define FILE_LEVARINT 52
#define FILE_NAMES_SIZE 53 /* size of array to contain all names */
#define FILE_INVALID 0
#define FILE_BYTE 1
#define FILE_SHORT 2
#define FILE_DEFAULT 3
#define FILE_LONG 4
#define FILE_STRING 5
#define FILE_DATE 6
#define FILE_BESHORT 7
#define FILE_BELONG 8
#define FILE_BEDATE 9
#define FILE_LESHORT 10
#define FILE_LELONG 11
#define FILE_LEDATE 12
#define FILE_PSTRING 13
#define FILE_LDATE 14
#define FILE_BELDATE 15
#define FILE_LELDATE 16
#define FILE_REGEX 17
#define FILE_BESTRING16 18
#define FILE_LESTRING16 19
#define FILE_SEARCH 20
#define FILE_MEDATE 21
#define FILE_MELDATE 22
#define FILE_MELONG 23
#define FILE_QUAD 24
#define FILE_LEQUAD 25
#define FILE_BEQUAD 26
#define FILE_QDATE 27
#define FILE_LEQDATE 28
#define FILE_BEQDATE 29
#define FILE_QLDATE 30
#define FILE_LEQLDATE 31
#define FILE_BEQLDATE 32
#define FILE_FLOAT 33
#define FILE_BEFLOAT 34
#define FILE_LEFLOAT 35
#define FILE_DOUBLE 36
#define FILE_BEDOUBLE 37
#define FILE_LEDOUBLE 38
#define FILE_BEID3 39
#define FILE_LEID3 40
#define FILE_INDIRECT 41
#define FILE_QWDATE 42
#define FILE_LEQWDATE 43
#define FILE_BEQWDATE 44
#define FILE_NAME 45
#define FILE_USE 46
#define FILE_CLEAR 47
#define FILE_DER 48
#define FILE_GUID 49
#define FILE_OFFSET 50
#define FILE_BEVARINT 51
#define FILE_LEVARINT 52
#define FILE_MSDOSDATE 53
#define FILE_LEMSDOSDATE 54
#define FILE_BEMSDOSDATE 55
#define FILE_MSDOSTIME 56
#define FILE_LEMSDOSTIME 57
#define FILE_BEMSDOSTIME 58
#define FILE_NAMES_SIZE 59 /* size of array to contain all names */
#define IS_STRING(t) \
((t) == FILE_STRING || \
@ -398,7 +410,8 @@ struct magic {
/* list of magic entries */
struct mlist {
struct magic *magic; /* array of magic entries */
uint32_t nmagic; /* number of entries in array */
file_regex_t **magic_rxcomp; /* array of compiled regexps */
size_t nmagic; /* number of entries in array */
void *map; /* internal resources used by entry */
struct mlist *next, *prev;
};
@ -477,6 +490,13 @@ struct magic_set {
#define FILE_NAME_MAX 50
#define FILE_REGEX_MAX 8192
#define FILE_ENCODING_MAX (64 * 1024)
#if defined(HAVE_NEWLOCALE) && defined(HAVE_USELOCALE) && defined(HAVE_FREELOCALE)
#define USE_C_LOCALE
locale_t c_lc_ctype;
#define file_locale_used
#else
#define file_locale_used __attribute__((__unused__))
#endif
};
/* Type for Unicode characters */
@ -485,7 +505,9 @@ typedef unsigned long file_unichar_t;
struct stat;
#define FILE_T_LOCAL 1
#define FILE_T_WINDOWS 2
protected const char *file_fmttime(char *, size_t, uint64_t, int);
protected const char *file_fmtdatetime(char *, size_t, uint64_t, int);
protected const char *file_fmtdate(char *, size_t, uint16_t);
protected const char *file_fmttime(char *, size_t, uint16_t);
protected const char *file_fmtvarint(const unsigned char *, int, char *,
size_t);
protected struct magic_set *file_ms_alloc(int);
@ -543,7 +565,7 @@ protected void file_magwarn(struct magic_set *, const char *, ...)
__attribute__((__format__(__printf__, 2, 3)));
protected void file_mdump(struct magic *);
protected void file_showstr(FILE *, const char *, size_t);
protected size_t file_mbswidth(const char *);
protected size_t file_mbswidth(struct magic_set *, const char *);
protected const char *file_getbuffer(struct magic_set *);
protected ssize_t sread(int, void *, size_t, int);
protected int file_check_mem(struct magic_set *, unsigned int);
@ -553,7 +575,7 @@ protected size_t file_pstring_length_size(struct magic_set *,
const struct magic *);
protected size_t file_pstring_get_length(struct magic_set *,
const struct magic *, const char *);
protected char * file_printable(struct magic_set *, char *, size_t,
public char * file_printable(struct magic_set *, char *, size_t,
const char *, size_t);
#ifdef __EMX__
protected int file_os2_apptype(struct magic_set *, const char *, const void *,
@ -568,29 +590,13 @@ protected void buffer_init(struct buffer *, int, const struct stat *,
protected void buffer_fini(struct buffer *);
protected int buffer_fill(const struct buffer *);
#include <locale.h>
#if defined(HAVE_XLOCALE_H)
#include <xlocale.h>
#endif
typedef struct {
const char *pat;
#if defined(HAVE_NEWLOCALE) && defined(HAVE_USELOCALE) && defined(HAVE_FREELOCALE)
#define USE_C_LOCALE
locale_t old_lc_ctype;
locale_t c_lc_ctype;
#else
char *old_lc_ctype;
#endif
int rc;
regex_t rx;
} file_regex_t;
protected int file_regcomp(file_regex_t *, const char *, int);
protected int file_regexec(file_regex_t *, const char *, size_t, regmatch_t *,
protected int file_regcomp(struct magic_set *, file_regex_t *, const char *,
int);
protected int file_regexec(struct magic_set *, file_regex_t *, const char *,
size_t, regmatch_t *, int);
protected void file_regfree(file_regex_t *);
protected void file_regerror(file_regex_t *, int, struct magic_set *);
typedef struct {
char *buf;

4
src/fsmagic.c
View File

@ -32,7 +32,7 @@
#include "file.h"
#ifndef lint
FILE_RCSID("@(#)$File: fsmagic.c,v 1.81 2019/07/16 13:30:32 christos Exp $")
FILE_RCSID("@(#)$File: fsmagic.c,v 1.82 2022/04/11 18:14:41 christos Exp $")
#endif /* lint */
#include "magic.h"
@ -327,7 +327,7 @@ file_fsmagic(struct magic_set *ms, const char *fn, struct stat *sb)
char *tmp;
char buf2[BUFSIZ+BUFSIZ+4];
if ((tmp = strrchr(fn, '/')) == NULL) {
if ((tmp = CCAST(char *, strrchr(fn, '/'))) == NULL) {
tmp = buf; /* in current directory anyway */
} else {
if (tmp - fn + 1 > BUFSIZ) {

130
src/funcs.c
View File

@ -27,7 +27,7 @@
#include "file.h"
#ifndef lint
FILE_RCSID("@(#)$File: funcs.c,v 1.122 2021/06/30 10:08:48 christos Exp $")
FILE_RCSID("@(#)$File: funcs.c,v 1.129 2022/05/28 20:24:09 christos Exp $")
#endif /* lint */
#include "magic.h"
@ -54,9 +54,12 @@ FILE_RCSID("@(#)$File: funcs.c,v 1.122 2021/06/30 10:08:48 christos Exp $")
protected char *
file_copystr(char *buf, size_t blen, size_t width, const char *str)
{
if (++width > blen)
width = blen;
strlcpy(buf, str, width);
if (blen == 0)
return buf;
if (width >= blen)
width = blen - 1;
memcpy(buf, str, width);
buf[width] = '\0';
return buf;
}
@ -90,7 +93,8 @@ file_checkfield(char *msg, size_t mlen, const char *what, const char **pp)
protected int
file_checkfmt(char *msg, size_t mlen, const char *fmt)
{
for (const char *p = fmt; *p; p++) {
const char *p;
for (p = fmt; *p; p++) {
if (*p != '%')
continue;
if (*++p == '%')
@ -146,8 +150,8 @@ file_vprintf(struct magic_set *ms, const char *fmt, va_list ap)
size_t blen = ms->o.blen;
free(buf);
file_clearbuf(ms);
file_error(ms, 0, "Output buffer space exceeded %d+%zu", len,
blen);
file_error(ms, 0, "Output buffer space exceeded %d+%"
SIZE_T_FORMAT "u", len, blen);
return -1;
}
@ -634,13 +638,11 @@ file_replace(struct magic_set *ms, const char *pat, const char *rep)
file_regex_t rx;
int rc, rv = -1;
rc = file_regcomp(&rx, pat, REG_EXTENDED);
if (rc) {
file_regerror(&rx, rc, ms);
} else {
rc = file_regcomp(ms, &rx, pat, REG_EXTENDED);
if (rc == 0) {
regmatch_t rm;
int nm = 0;
while (file_regexec(&rx, ms->o.buf, 1, &rm, 0) == 0) {
while (file_regexec(ms, &rx, ms->o.buf, 1, &rm, 0) == 0) {
ms->o.buf[rm.rm_so] = '\0';
if (file_printf(ms, "%s%s", rep,
rm.rm_eo != 0 ? ms->o.buf + rm.rm_eo : "") == -1)
@ -655,58 +657,64 @@ file_replace(struct magic_set *ms, const char *pat, const char *rep)
}
protected int
file_regcomp(file_regex_t *rx, const char *pat, int flags)
file_regcomp(struct magic_set *ms file_locale_used, file_regex_t *rx,
const char *pat, int flags)
{
#ifdef USE_C_LOCALE
rx->c_lc_ctype = newlocale(LC_CTYPE_MASK, "C", 0);
assert(rx->c_lc_ctype != NULL);
rx->old_lc_ctype = uselocale(rx->c_lc_ctype);
assert(rx->old_lc_ctype != NULL);
locale_t old = uselocale(ms->c_lc_ctype);
assert(old != NULL);
#else
rx->old_lc_ctype = setlocale(LC_CTYPE, NULL);
assert(rx->old_lc_ctype != NULL);
rx->old_lc_ctype = strdup(rx->old_lc_ctype);
assert(rx->old_lc_ctype != NULL);
char old[1024];
strlcpy(old, setlocale(LC_CTYPE, NULL), sizeof(old));
(void)setlocale(LC_CTYPE, "C");
#endif
rx->pat = pat;
int rc;
rc = regcomp(rx, pat, flags);
return rx->rc = regcomp(&rx->rx, pat, flags);
#ifdef USE_C_LOCALE
uselocale(old);
#else
(void)setlocale(LC_CTYPE, old);
#endif
if (rc > 0 && (ms->flags & MAGIC_CHECK)) {
char errmsg[512];
(void)regerror(rc, rx, errmsg, sizeof(errmsg));
file_magerror(ms, "regex error %d for `%s', (%s)", rc, pat,
errmsg);
}
return rc;
}
protected int
file_regexec(file_regex_t *rx, const char *str, size_t nmatch,
regmatch_t* pmatch, int eflags)
file_regexec(struct magic_set *ms file_locale_used, file_regex_t *rx,
const char *str, size_t nmatch, regmatch_t* pmatch, int eflags)
{
assert(rx->rc == 0);
#ifdef USE_C_LOCALE
locale_t old = uselocale(ms->c_lc_ctype);
assert(old != NULL);
#else
char old[1024];
strlcpy(old, setlocale(LC_CTYPE, NULL), sizeof(old));
(void)setlocale(LC_CTYPE, "C");
#endif
int rc;
/* XXX: force initialization because glibc does not always do this */
if (nmatch != 0)
memset(pmatch, 0, nmatch * sizeof(*pmatch));
return regexec(&rx->rx, str, nmatch, pmatch, eflags);
rc = regexec(rx, str, nmatch, pmatch, eflags);
#ifdef USE_C_LOCALE
uselocale(old);
#else
(void)setlocale(LC_CTYPE, old);
#endif
return rc;
}
protected void
file_regfree(file_regex_t *rx)
{
if (rx->rc == 0)
regfree(&rx->rx);
#ifdef USE_C_LOCALE
(void)uselocale(rx->old_lc_ctype);
freelocale(rx->c_lc_ctype);
#else
(void)setlocale(LC_CTYPE, rx->old_lc_ctype);
free(rx->old_lc_ctype);
#endif
}
protected void
file_regerror(file_regex_t *rx, int rc, struct magic_set *ms)
{
char errmsg[512];
(void)regerror(rc, &rx->rx, errmsg, sizeof(errmsg));
file_magerror(ms, "regex error %d for `%s', (%s)", rc, rx->pat,
errmsg);
regfree(rx);
}
protected file_pushbuf_t *
@ -755,7 +763,7 @@ file_pop_buffer(struct magic_set *ms, file_pushbuf_t *pb)
/*
* convert string to ascii printable format.
*/
protected char *
public char *
file_printable(struct magic_set *ms, char *buf, size_t bufsiz,
const char *str, size_t slen)
{
@ -790,11 +798,25 @@ protected int
file_parse_guid(const char *s, uint64_t *guid)
{
struct guid *g = CAST(struct guid *, CAST(void *, guid));
#ifndef WIN32
return sscanf(s,
"%8x-%4hx-%4hx-%2hhx%2hhx-%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx",
&g->data1, &g->data2, &g->data3, &g->data4[0], &g->data4[1],
&g->data4[2], &g->data4[3], &g->data4[4], &g->data4[5],
&g->data4[6], &g->data4[7]) == 11 ? 0 : -1;
#else
/* MS-Windows runtime doesn't support %hhx, except under
non-default __USE_MINGW_ANSI_STDIO. */
uint16_t data16[8];
int rv = sscanf(s, "%8x-%4hx-%4hx-%2hx%2hx-%2hx%2hx%2hx%2hx%2hx%2hx",
&g->data1, &g->data2, &g->data3, &data16[0], &data16[1],
&data16[2], &data16[3], &data16[4], &data16[5],
&data16[6], &data16[7]) == 11 ? 0 : -1;
int i;
for (i = 0; i < 8; i++)
g->data4[i] = data16[i];
return rv;
#endif
}
protected int
@ -803,11 +825,19 @@ file_print_guid(char *str, size_t len, const uint64_t *guid)
const struct guid *g = CAST(const struct guid *,
CAST(const void *, guid));
#ifndef WIN32
return snprintf(str, len, "%.8X-%.4hX-%.4hX-%.2hhX%.2hhX-"
"%.2hhX%.2hhX%.2hhX%.2hhX%.2hhX%.2hhX",
g->data1, g->data2, g->data3, g->data4[0], g->data4[1],
g->data4[2], g->data4[3], g->data4[4], g->data4[5],
g->data4[6], g->data4[7]);
#else
return snprintf(str, len, "%.8X-%.4hX-%.4hX-%.2hX%.2hX-"
"%.2hX%.2hX%.2hX%.2hX%.2hX%.2hX",
g->data1, g->data2, g->data3, g->data4[0], g->data4[1],
g->data4[2], g->data4[3], g->data4[4], g->data4[5],
g->data4[6], g->data4[7]);
#endif
}
protected int
@ -818,15 +848,21 @@ file_pipe_closexec(int *fds)
#else
if (pipe(fds) == -1)
return -1;
# ifdef F_SETFD
(void)fcntl(fds[0], F_SETFD, FD_CLOEXEC);
(void)fcntl(fds[1], F_SETFD, FD_CLOEXEC);
# endif
return 0;
#endif
}
protected int
file_clear_closexec(int fd) {
#ifdef F_SETFD
return fcntl(fd, F_SETFD, 0);
#else
return 0;
#endif
}
protected char *

4
src/is_csv.c
View File

@ -32,7 +32,7 @@
#include "file.h"
#ifndef lint
FILE_RCSID("@(#)$File: is_csv.c,v 1.6 2020/08/09 16:43:36 christos Exp $")
FILE_RCSID("@(#)$File: is_csv.c,v 1.7 2022/05/28 00:44:22 christos Exp $")
#endif
#include <string.h>
@ -184,7 +184,7 @@ main(int argc, char *argv[])
if (fstat(fd, &st) == -1)
err(EXIT_FAILURE, "Can't stat `%s'", argv[1]);
if ((p = malloc(st.st_size)) == NULL)
if ((p = CAST(char *, malloc(st.st_size))) == NULL)
err(EXIT_FAILURE, "Can't allocate %jd bytes",
(intmax_t)st.st_size);
if (read(fd, p, st.st_size) != st.st_size)

53
src/is_json.c
View File

@ -32,19 +32,25 @@
#include "file.h"
#ifndef lint
FILE_RCSID("@(#)$File: is_json.c,v 1.15 2020/06/07 19:05:47 christos Exp $")
FILE_RCSID("@(#)$File: is_json.c,v 1.20 2022/05/28 00:44:22 christos Exp $")
#endif
#include <string.h>
#include "magic.h"
#else
#include <stdio.h>
#include <stddef.h>
#endif
#include <string.h>
#ifdef DEBUG
#include <stdio.h>
#define DPRINTF(a, b, c) \
printf("%s [%.2x/%c] %.20s\n", (a), *(b), *(b), (const char *)(c))
printf("%*s%s [%.2x/%c] %.*s\n", (int)lvl, "", (a), *(b), *(b), \
(int)(b - c), (const char *)(c))
#define __file_debugused
#else
#define DPRINTF(a, b, c) do { } while (/*CONSTCOND*/0)
#define __file_debugused __attribute__((__unused__))
#endif
#define JSON_ARRAY 0
@ -117,7 +123,8 @@ json_skip_space(const unsigned char *uc, const unsigned char *ue)
}
static int
json_parse_string(const unsigned char **ucp, const unsigned char *ue)
json_parse_string(const unsigned char **ucp, const unsigned char *ue,
size_t lvl __file_debugused)
{
const unsigned char *uc = *ucp;
size_t i;
@ -155,8 +162,8 @@ json_parse_string(const unsigned char **ucp, const unsigned char *ue)
goto out;
}
case '"':
*ucp = uc;
DPRINTF("Good string: ", uc, *ucp);
*ucp = uc;
return 1;
default:
continue;
@ -189,8 +196,8 @@ json_parse_array(const unsigned char **ucp, const unsigned char *ue,
case ']':
done:
st[JSON_ARRAYN]++;
*ucp = uc + 1;
DPRINTF("Good array: ", uc, *ucp);
*ucp = uc + 1;
return 1;
default:
goto out;
@ -221,7 +228,7 @@ json_parse_object(const unsigned char **ucp, const unsigned char *ue,
goto out;
}
DPRINTF("next field", uc, *ucp);
if (!json_parse_string(&uc, ue)) {
if (!json_parse_string(&uc, ue, lvl)) {
DPRINTF("not string", uc, *ucp);
goto out;
}
@ -243,12 +250,12 @@ json_parse_object(const unsigned char **ucp, const unsigned char *ue,
continue;
case '}': /* { */
done:
*ucp = uc;
DPRINTF("Good object: ", uc, *ucp);
*ucp = uc;
return 1;
default:
*ucp = uc - 1;
DPRINTF("not more", uc, *ucp);
*ucp = uc - 1;
goto out;
}
}
@ -259,7 +266,8 @@ json_parse_object(const unsigned char **ucp, const unsigned char *ue,
}
static int
json_parse_number(const unsigned char **ucp, const unsigned char *ue)
json_parse_number(const unsigned char **ucp, const unsigned char *ue,
size_t lvl __file_debugused)
{
const unsigned char *uc = *ucp;
int got = 0;
@ -310,7 +318,7 @@ json_parse_number(const unsigned char **ucp, const unsigned char *ue)
static int
json_parse_const(const unsigned char **ucp, const unsigned char *ue,
const char *str, size_t len)
const char *str, size_t len, size_t lvl __file_debugused)
{
const unsigned char *uc = *ucp;
@ -338,8 +346,10 @@ json_parse(const unsigned char **ucp, const unsigned char *ue,
goto out;
// Avoid recursion
if (lvl > 20)
if (lvl > 500) {
DPRINTF("Too many levels", uc, *ucp);
return 0;
}
#if JSON_COUNT
/* bail quickly if not counting */
if (lvl > 1 && (st[JSON_OBJECT] || st[JSON_ARRAYN]))
@ -349,7 +359,7 @@ json_parse(const unsigned char **ucp, const unsigned char *ue,
DPRINTF("Parse general: ", uc, *ucp);
switch (*uc++) {
case '"':
rv = json_parse_string(&uc, ue);
rv = json_parse_string(&uc, ue, lvl + 1);
t = JSON_STRING;
break;
case '[':
@ -361,20 +371,21 @@ json_parse(const unsigned char **ucp, const unsigned char *ue,
t = JSON_OBJECT;
break;
case 't':
rv = json_parse_const(&uc, ue, "true", sizeof("true"));
rv = json_parse_const(&uc, ue, "true", sizeof("true"), lvl + 1);
t = JSON_CONSTANT;
break;
case 'f':
rv = json_parse_const(&uc, ue, "false", sizeof("false"));
rv = json_parse_const(&uc, ue, "false", sizeof("false"),
lvl + 1);
t = JSON_CONSTANT;
break;
case 'n':
rv = json_parse_const(&uc, ue, "null", sizeof("null"));
rv = json_parse_const(&uc, ue, "null", sizeof("null"), lvl + 1);
t = JSON_CONSTANT;
break;
default:
--uc;
rv = json_parse_number(&uc, ue);
rv = json_parse_number(&uc, ue, lvl + 1);
t = JSON_NUMBER;
break;
}
@ -382,10 +393,10 @@ json_parse(const unsigned char **ucp, const unsigned char *ue,
st[t]++;
uc = json_skip_space(uc, ue);
out:
*ucp = uc;
DPRINTF("End general: ", uc, *ucp);
*ucp = uc;
if (lvl == 0)
return rv && (st[JSON_ARRAYN] || st[JSON_OBJECT]);
return rv && uc == ue && (st[JSON_ARRAYN] || st[JSON_OBJECT]);
return rv;
}
@ -414,7 +425,7 @@ file_is_json(struct magic_set *ms, const struct buffer *b)
return -1;
return 1;
}
if (file_printf(ms, "JSON data") == -1)
if (file_printf(ms, "JSON text data") == -1)
return -1;
#if JSON_COUNT
#define P(n) st[n], st[n] > 1 ? "s" : ""
@ -455,7 +466,7 @@ main(int argc, char *argv[])
if (fstat(fd, &st) == -1)
err(EXIT_FAILURE, "Can't stat `%s'", argv[1]);
if ((p = malloc(st.st_size)) == NULL)
if ((p = CAST(char *, malloc(st.st_size))) == NULL)
err(EXIT_FAILURE, "Can't allocate %jd bytes",
(intmax_t)st.st_size);
if (read(fd, p, st.st_size) != st.st_size)

25
src/magic.c
View File

@ -33,7 +33,7 @@
#include "file.h"
#ifndef lint
FILE_RCSID("@(#)$File: magic.c,v 1.115 2021/09/20 17:45:41 christos Exp $")
FILE_RCSID("@(#)$File: magic.c,v 1.117 2021/12/06 15:33:00 christos Exp $")
#endif /* lint */
#include "magic.h"
@ -221,6 +221,10 @@ get_default_magic(void)
default_magic = NULL;
}
/* Before anything else, try to get a magic file from user HOME */
if ((home = getenv("HOME")) != NULL)
_w32_append_path(&hmagicpath, "%s%s", home, hmagic);
/* First, try to get a magic file from user-application data */
if ((home = getenv("LOCALAPPDATA")) != NULL)
_w32_append_path(&hmagicpath, "%s%s", home, hmagic);
@ -273,9 +277,22 @@ unreadable_info(struct magic_set *ms, mode_t md, const char *file)
if (access(file, W_OK) == 0)
if (file_printf(ms, "writable, ") == -1)
return -1;
#ifndef WIN32
if (access(file, X_OK) == 0)
if (file_printf(ms, "executable, ") == -1)
return -1;
#else
/* X_OK doesn't work well on MS-Windows */
{
const char *p = strrchr(file, '.');
if (p && (stricmp(p, ".exe")
|| stricmp(p, ".dll")
|| stricmp(p, ".bat")
|| stricmp(p, ".cmd")))
if (file_printf(ms, "writable, ") == -1)
return -1;
}
#endif
}
if (S_ISREG(md))
if (file_printf(ms, "regular file, ") == -1)
@ -442,8 +459,6 @@ file_or_fd(struct magic_set *ms, const char *inname, int fd)
errno = 0;
if ((fd = open(inname, flags)) < 0) {
okstat = stat(inname, &sb) == 0;
if (okstat && S_ISFIFO(sb.st_mode))
ispipe = 1;
#ifdef WIN32
/*
* Can't stat, can't open. It may have been opened in
@ -462,7 +477,7 @@ file_or_fd(struct magic_set *ms, const char *inname, int fd)
rv = 0;
goto done;
}
#if O_CLOEXEC == 0
#if O_CLOEXEC == 0 && defined(F_SETFD)
(void)fcntl(fd, F_SETFD, FD_CLOEXEC);
#endif
}
@ -500,7 +515,7 @@ file_or_fd(struct magic_set *ms, const char *inname, int fd)
} else if (fd != -1) {
/* Windows refuses to read from a big console buffer. */
size_t howmany =
#if defined(WIN32)
#ifdef WIN32
_isatty(fd) ? 8 * 1024 :
#endif
ms->bytes_max;

71
src/print.c
View File

@ -32,7 +32,7 @@
#include "file.h"
#ifndef lint
FILE_RCSID("@(#)$File: print.c,v 1.89 2021/06/30 10:08:48 christos Exp $")
FILE_RCSID("@(#)$File: print.c,v 1.90 2021/10/24 15:52:18 christos Exp $")
#endif /* lint */
#include <string.h>
@ -157,34 +157,34 @@ file_mdump(struct magic *m)
case FILE_BEDATE:
case FILE_MEDATE:
(void)fprintf(stderr, "%s,",
file_fmttime(tbuf, sizeof(tbuf), m->value.l, 0));
file_fmtdatetime(tbuf, sizeof(tbuf), m->value.l, 0));
break;
case FILE_LDATE:
case FILE_LELDATE:
case FILE_BELDATE:
case FILE_MELDATE:
(void)fprintf(stderr, "%s,",
file_fmttime(tbuf, sizeof(tbuf), m->value.l,
file_fmtdatetime(tbuf, sizeof(tbuf), m->value.l,
FILE_T_LOCAL));
break;
case FILE_QDATE:
case FILE_LEQDATE:
case FILE_BEQDATE:
(void)fprintf(stderr, "%s,",
file_fmttime(tbuf, sizeof(tbuf), m->value.q, 0));
file_fmtdatetime(tbuf, sizeof(tbuf), m->value.q, 0));
break;
case FILE_QLDATE:
case FILE_LEQLDATE:
case FILE_BEQLDATE:
(void)fprintf(stderr, "%s,",
file_fmttime(tbuf, sizeof(tbuf), m->value.q,
file_fmtdatetime(tbuf, sizeof(tbuf), m->value.q,
FILE_T_LOCAL));
break;
case FILE_QWDATE:
case FILE_LEQWDATE:
case FILE_BEQWDATE:
(void)fprintf(stderr, "%s,",
file_fmttime(tbuf, sizeof(tbuf), m->value.q,
file_fmtdatetime(tbuf, sizeof(tbuf), m->value.q,
FILE_T_WINDOWS));
break;
case FILE_FLOAT:
@ -202,6 +202,18 @@ file_mdump(struct magic *m)
(void)fprintf(stderr, "%s", file_fmtvarint(
m->value.us, m->type, tbuf, sizeof(tbuf)));
break;
case FILE_MSDOSDATE:
case FILE_BEMSDOSDATE:
case FILE_LEMSDOSDATE:
(void)fprintf(stderr, "%s,",
file_fmtdate(tbuf, sizeof(tbuf), m->value.h));
break;
case FILE_MSDOSTIME:
case FILE_BEMSDOSTIME:
case FILE_LEMSDOSTIME:
(void)fprintf(stderr, "%s,",
file_fmttime(tbuf, sizeof(tbuf), m->value.h));
break;
case FILE_DEFAULT:
/* XXX - do anything here? */
break;
@ -252,7 +264,7 @@ file_fmtvarint(const unsigned char *us, int t, char *buf, size_t blen)
}
protected const char *
file_fmttime(char *buf, size_t bsize, uint64_t v, int flags)
file_fmtdatetime(char *buf, size_t bsize, uint64_t v, int flags)
{
char *pp;
time_t t;
@ -282,6 +294,49 @@ file_fmttime(char *buf, size_t bsize, uint64_t v, int flags)
pp[strcspn(pp, "\n")] = '\0';
return pp;
out:
strlcpy(buf, "*Invalid time*", bsize);
strlcpy(buf, "*Invalid datetime*", bsize);
return buf;
}
/*
* https://docs.microsoft.com/en-us/windows/win32/api/winbase/\
* nf-winbase-dosdatetimetofiletime?redirectedfrom=MSDN
*/
protected const char *
file_fmtdate(char *buf, size_t bsize, uint16_t v)
{
struct tm tm;
memset(&tm, 0, sizeof(tm));
tm.tm_mday = v & 0x1f;
tm.tm_mon = ((v >> 5) & 0xf) - 1;
tm.tm_year = (v >> 9) + 80;
if (strftime(buf, bsize, "%a, %b %d %Y", &tm) == 0)
goto out;
return buf;
out:
strlcpy(buf, "*Invalid date*", bsize);
return buf;
}
protected const char *
file_fmttime(char *buf, size_t bsize, uint16_t v)
{
struct tm tm;
memset(&tm, 0, sizeof(tm));
tm.tm_sec = (v & 0x1f) * 2;
tm.tm_min = ((v >> 5) & 0x3f);
tm.tm_hour = (v >> 11);
if (strftime(buf, bsize, "%T", &tm) == 0)
goto out;
return buf;
out:
strlcpy(buf, "*Invalid time*", bsize);
return buf;
}

9
src/readcdf.c
View File

@ -26,7 +26,7 @@
#include "file.h"
#ifndef lint
FILE_RCSID("@(#)$File: readcdf.c,v 1.74 2019/09/11 15:46:30 christos Exp $")
FILE_RCSID("@(#)$File: readcdf.c,v 1.76 2022/01/17 16:59:01 christos Exp $")
#endif
#include <assert.h>
@ -605,8 +605,8 @@ file_trycdf(struct magic_set *ms, const struct buffer *b)
}
#endif
if ((i = cdf_read_user_stream(&info, &h, &sat, &ssat, &sst, &dir,
"FileHeader", &scn)) != -1) {
if (cdf_read_user_stream(&info, &h, &sat, &ssat, &sst, &dir,
"FileHeader", &scn) != -1) {
#define HWP5_SIGNATURE "HWP Document File"
if (scn.sst_len * scn.sst_ss >= sizeof(HWP5_SIGNATURE) - 1
&& memcmp(scn.sst_tab, HWP5_SIGNATURE,
@ -674,7 +674,8 @@ file_trycdf(struct magic_set *ms, const struct buffer *b)
if (file_printf(ms, ", %s", expn) == -1)
return -1;
} else if (ms->flags & MAGIC_MIME_TYPE) {
if (file_printf(ms, "application/CDFV2") == -1)
/* https://reposcope.com/mimetype/application/x-ole-storage */
if (file_printf(ms, "application/x-ole-storage") == -1)
return -1;
}
return 1;

13
src/readelf.c
View File

@ -27,7 +27,7 @@
#include "file.h"
#ifndef lint
FILE_RCSID("@(#)$File: readelf.c,v 1.178 2021/06/30 10:08:48 christos Exp $")
FILE_RCSID("@(#)$File: readelf.c,v 1.180 2022/01/10 14:15:08 christos Exp $")
#endif
#ifdef BUILTIN_ELF
@ -1015,7 +1015,7 @@ do_auxv_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type,
size_t elsize = xauxv_sizeof;
const char *tag;
int is_string;
size_t nval;
size_t nval, off;
if ((*flags & (FLAGS_IS_CORE|FLAGS_DID_CORE_STYLE)) !=
(FLAGS_IS_CORE|FLAGS_DID_CORE_STYLE))
@ -1043,7 +1043,7 @@ do_auxv_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type,
*flags |= FLAGS_DID_AUXV;
nval = 0;
for (size_t off = 0; off + elsize <= descsz; off += elsize) {
for (off = 0; off + elsize <= descsz; off += elsize) {
memcpy(xauxv_addr, &nbuf[doff + off], xauxv_sizeof);
/* Limit processing to 50 vector entries to prevent DoS */
if (nval++ >= 50) {
@ -1649,7 +1649,7 @@ dophn_exec(struct magic_set *ms, int clazz, int swap, int fd, off_t off,
char ibuf[BUFSIZ];
char interp[BUFSIZ];
ssize_t bufsize;
size_t offset, align, len, need = 0;
size_t offset, align, need = 0;
int pie = 0, dynamic = 0;
if (num == 0) {
@ -1709,7 +1709,7 @@ dophn_exec(struct magic_set *ms, int clazz, int swap, int fd, off_t off,
}
if (doread) {
len = xph_filesz < sizeof(nbuf) ? xph_filesz
size_t len = xph_filesz < sizeof(nbuf) ? xph_filesz
: sizeof(nbuf);
off_t offs = xph_offset;
bufsize = pread(fd, nbuf, len, offs);
@ -1720,8 +1720,7 @@ dophn_exec(struct magic_set *ms, int clazz, int swap, int fd, off_t off,
return -1;
return 0;
}
} else
len = 0;
}
/* Things we can determine when we seek */
switch (xph_type) {

239
src/softmagic.c
View File

@ -32,7 +32,7 @@
#include "file.h"
#ifndef lint
FILE_RCSID("@(#)$File: softmagic.c,v 1.315 2021/09/03 13:17:52 christos Exp $")
FILE_RCSID("@(#)$File: softmagic.c,v 1.323 2022/05/28 00:44:22 christos Exp $")
#endif /* lint */
#include "magic.h"
@ -43,7 +43,7 @@ FILE_RCSID("@(#)$File: softmagic.c,v 1.315 2021/09/03 13:17:52 christos Exp $")
#include <time.h>
#include "der.h"
private int match(struct magic_set *, struct magic *, uint32_t,
private int match(struct magic_set *, struct magic *, file_regex_t **, uint32_t,
const struct buffer *, size_t, int, int, int, uint16_t *,
uint16_t *, int *, int *, int *, int *);
private int mget(struct magic_set *, struct magic *, const struct buffer *,
@ -52,8 +52,8 @@ private int mget(struct magic_set *, struct magic *, const struct buffer *,
uint16_t *, int *, int *, int *, int *);
private int msetoffset(struct magic_set *, struct magic *, struct buffer *,
const struct buffer *, size_t, unsigned int);
private int magiccheck(struct magic_set *, struct magic *);
private int32_t mprint(struct magic_set *, struct magic *);
private int magiccheck(struct magic_set *, struct magic *, file_regex_t **);
private int mprint(struct magic_set *, struct magic *);
private int moffset(struct magic_set *, struct magic *, const struct buffer *,
int32_t *);
private void mdebug(uint32_t, const char *, size_t);
@ -131,8 +131,8 @@ file_softmagic(struct magic_set *ms, const struct buffer *b,
}
for (ml = ms->mlist[0]->next; ml != ms->mlist[0]; ml = ml->next)
if ((rv = match(ms, ml->magic, ml->nmagic, b, 0, mode,
text, 0, indir_count, name_count,
if ((rv = match(ms, ml->magic, ml->magic_rxcomp, ml->nmagic, b,
0, mode, text, 0, indir_count, name_count,
&printed_something, &need_separator, NULL, NULL)) != 0)
return rv;
@ -191,8 +191,8 @@ file_fmtcheck(struct magic_set *ms, const char *desc, const char *def,
* so that higher-level continuations are processed.
*/
private int
match(struct magic_set *ms, struct magic *magic, uint32_t nmagic,
const struct buffer *b, size_t offset, int mode, int text,
match(struct magic_set *ms, struct magic *magic, file_regex_t **magic_rxcomp,
uint32_t nmagic, const struct buffer *b, size_t offset, int mode, int text,
int flip, uint16_t *indir_count, uint16_t *name_count,
int *printed_something, int *need_separator, int *returnval,
int *found_match)
@ -220,6 +220,7 @@ match(struct magic_set *ms, struct magic *magic, uint32_t nmagic,
for (magindex = 0; magindex < nmagic; magindex++) {
int flush = 0;
struct magic *m = &magic[magindex];
file_regex_t **m_rxcomp = &magic_rxcomp[magindex];
if (m->type != FILE_NAME)
if ((IS_STRING(m->type) &&
@ -257,7 +258,7 @@ match(struct magic_set *ms, struct magic *magic, uint32_t nmagic,
*returnval = 1;
}
switch (magiccheck(ms, m)) {
switch (magiccheck(ms, m, m_rxcomp)) {
case -1:
return -1;
case 0:
@ -318,6 +319,7 @@ match(struct magic_set *ms, struct magic *magic, uint32_t nmagic,
while (magindex + 1 < nmagic &&
magic[magindex + 1].cont_level != 0) {
m = &magic[++magindex];
m_rxcomp = &magic_rxcomp[magindex];
ms->line = m->lineno; /* for messages */
if (cont_level < m->cont_level)
@ -371,7 +373,7 @@ match(struct magic_set *ms, struct magic *magic, uint32_t nmagic,
break;
}
switch (flush ? 1 : magiccheck(ms, m)) {
switch (flush ? 1 : magiccheck(ms, m, m_rxcomp)) {
case -1:
return -1;
case 0:
@ -436,7 +438,6 @@ match(struct magic_set *ms, struct magic *magic, uint32_t nmagic,
&ms->c.li[cont_level].off)) {
case -1:
case 0:
flush = 1;
cont_level--;
break;
default:
@ -473,15 +474,14 @@ check_fmt(struct magic_set *ms, const char *fmt)
{
file_regex_t rx;
int rc, rv = -1;
const char* pat = "%[-0-9\\.]*s";
if (strchr(fmt, '%') == NULL)
return 0;
rc = file_regcomp(&rx, "%[-0-9\\.]*s", REG_EXTENDED|REG_NOSUB);
if (rc) {
file_regerror(&rx, rc, ms);
} else {
rc = file_regexec(&rx, fmt, 0, 0, 0);
rc = file_regcomp(ms, &rx, pat, REG_EXTENDED|REG_NOSUB);
if (rc == 0) {
rc = file_regexec(ms, &rx, fmt, 0, 0, 0);
rv = !rc;
}
file_regfree(&rx);
@ -502,7 +502,7 @@ strndup(const char *str, size_t n)
for (len = 0; len < n && str[len]; len++)
continue;
if ((copy = malloc(len + 1)) == NULL)
if ((copy = CAST(char *, malloc(len + 1))) == NULL)
return NULL;
(void)memcpy(copy, str, len);
copy[len] = '\0';
@ -565,13 +565,12 @@ varexpand(struct magic_set *ms, char *buf, size_t len, const char *str)
}
private int32_t
private int
mprint(struct magic_set *ms, struct magic *m)
{
uint64_t v;
float vf;
double vd;
int64_t t = 0;
char buf[128], tbuf[26], sbuf[512], ebuf[512];
const char *desc;
union VALUETYPE *p = &ms->ms_value;
@ -609,7 +608,6 @@ mprint(struct magic_set *ms, struct magic *m)
} \
break; \
} \
t = ms->offset + sizeof(stype); \
break
switch (m->type) {
@ -642,20 +640,18 @@ mprint(struct magic_set *ms, struct magic *m)
file_printable(ms, sbuf, sizeof(sbuf), m->value.s,
sizeof(m->value.s))) == -1)
return -1;
t = ms->offset + m->vallen;
}
else {
char *str = p->s;
/* compute t before we mangle the string? */
t = ms->offset + strlen(str);
if (*m->value.s == '\0')
str[strcspn(str, "\r\n")] = '\0';
if (m->str_flags & STRING_TRIM)
str = file_strtrim(str);
if (file_printf(ms, F(ms, desc, "%s"),
file_printable(ms, sbuf, sizeof(sbuf), str,
sizeof(p->s) - (str - p->s))) == -1)
@ -665,7 +661,6 @@ mprint(struct magic_set *ms, struct magic *m)
size_t l = file_pstring_length_size(ms, m);
if (l == FILE_BADSIZE)
return -1;
t += l;
}
}
break;
@ -675,9 +670,8 @@ mprint(struct magic_set *ms, struct magic *m)
case FILE_LEDATE:
case FILE_MEDATE:
if (file_printf(ms, F(ms, desc, "%s"),
file_fmttime(tbuf, sizeof(tbuf), p->l, 0)) == -1)
file_fmtdatetime(tbuf, sizeof(tbuf), p->l, 0)) == -1)
return -1;
t = ms->offset + sizeof(uint32_t);
break;
case FILE_LDATE:
@ -685,37 +679,34 @@ mprint(struct magic_set *ms, struct magic *m)
case FILE_LELDATE:
case FILE_MELDATE:
if (file_printf(ms, F(ms, desc, "%s"),
file_fmttime(tbuf, sizeof(tbuf), p->l, FILE_T_LOCAL)) == -1)
file_fmtdatetime(tbuf, sizeof(tbuf), p->l, FILE_T_LOCAL))
== -1)
return -1;
t = ms->offset + sizeof(uint32_t);
break;
case FILE_QDATE:
case FILE_BEQDATE:
case FILE_LEQDATE:
if (file_printf(ms, F(ms, desc, "%s"),
file_fmttime(tbuf, sizeof(tbuf), p->q, 0)) == -1)
file_fmtdatetime(tbuf, sizeof(tbuf), p->q, 0)) == -1)
return -1;
t = ms->offset + sizeof(uint64_t);
break;
case FILE_QLDATE:
case FILE_BEQLDATE:
case FILE_LEQLDATE:
if (file_printf(ms, F(ms, desc, "%s"),
file_fmttime(tbuf, sizeof(tbuf), p->q, FILE_T_LOCAL)) == -1)
file_fmtdatetime(tbuf, sizeof(tbuf), p->q, FILE_T_LOCAL)) == -1)
return -1;
t = ms->offset + sizeof(uint64_t);
break;
case FILE_QWDATE:
case FILE_BEQWDATE:
case FILE_LEQWDATE:
if (file_printf(ms, F(ms, desc, "%s"),
file_fmttime(tbuf, sizeof(tbuf), p->q, FILE_T_WINDOWS))
file_fmtdatetime(tbuf, sizeof(tbuf), p->q, FILE_T_WINDOWS))
== -1)
return -1;
t = ms->offset + sizeof(uint64_t);
break;
case FILE_FLOAT:
@ -735,7 +726,6 @@ mprint(struct magic_set *ms, struct magic *m)
return -1;
break;
}
t = ms->offset + sizeof(float);
break;
case FILE_DOUBLE:
@ -755,7 +745,6 @@ mprint(struct magic_set *ms, struct magic *m)
return -1;
break;
}
t = ms->offset + sizeof(double);
break;
case FILE_SEARCH:
@ -770,18 +759,13 @@ mprint(struct magic_set *ms, struct magic *m)
return -1;
}
scp = (m->str_flags & STRING_TRIM) ? file_strtrim(cp) : cp;
rval = file_printf(ms, F(ms, desc, "%s"), file_printable(ms,
sbuf, sizeof(sbuf), scp, ms->search.rm_len));
free(cp);
if (rval == -1)
return -1;
if ((m->str_flags & REGEX_OFFSET_START))
t = ms->search.offset;
else
t = ms->search.offset + ms->search.rm_len;
break;
}
@ -789,32 +773,42 @@ mprint(struct magic_set *ms, struct magic *m)
case FILE_CLEAR:
if (file_printf(ms, "%s", m->desc) == -1)
return -1;
t = ms->offset;
break;
case FILE_INDIRECT:
case FILE_USE:
case FILE_NAME:
t = ms->offset;
break;
case FILE_DER:
if (file_printf(ms, F(ms, desc, "%s"),
file_printable(ms, sbuf, sizeof(sbuf), ms->ms_value.s,
sizeof(ms->ms_value.s))) == -1)
return -1;
t = ms->offset;
break;
case FILE_GUID:
(void) file_print_guid(buf, sizeof(buf), ms->ms_value.guid);
if (file_printf(ms, F(ms, desc, "%s"), buf) == -1)
return -1;
t = ms->offset;
break;
case FILE_MSDOSDATE:
case FILE_BEMSDOSDATE:
case FILE_LEMSDOSDATE:
if (file_printf(ms, F(ms, desc, "%s"),
file_fmtdate(tbuf, sizeof(tbuf), p->h)) == -1)
return -1;
break;
case FILE_MSDOSTIME:
case FILE_BEMSDOSTIME:
case FILE_LEMSDOSTIME:
if (file_printf(ms, F(ms, desc, "%s"),
file_fmttime(tbuf, sizeof(tbuf), p->h)) == -1)
return -1;
break;
default:
file_magerror(ms, "invalid m->type (%d) in mprint()", m->type);
return -1;
}
return CAST(int32_t, t);
return 0;
}
private int
@ -832,6 +826,12 @@ moffset(struct magic_set *ms, struct magic *m, const struct buffer *b,
case FILE_SHORT:
case FILE_BESHORT:
case FILE_LESHORT:
case FILE_MSDOSDATE:
case FILE_LEMSDOSDATE:
case FILE_BEMSDOSDATE:
case FILE_MSDOSTIME:
case FILE_LEMSDOSTIME:
case FILE_BEMSDOSTIME:
o = CAST(int32_t, (ms->offset + sizeof(short)));
break;
@ -1137,6 +1137,12 @@ mconvert(struct magic_set *ms, struct magic *m, int flip)
goto out;
return 1;
case FILE_SHORT:
case FILE_MSDOSDATE:
case FILE_LEMSDOSDATE:
case FILE_BEMSDOSDATE:
case FILE_MSDOSTIME:
case FILE_LEMSDOSTIME:
case FILE_BEMSDOSTIME:
if (cvt_16(p, m) == -1)
goto out;
return 1;
@ -1819,12 +1825,13 @@ mget(struct magic_set *ms, struct magic *m, const struct buffer *b,
bb = *b;
bb.fbuf = s + offset;
bb.flen = nbytes - offset;
rv = -1;
for (mlp = ms->mlist[0]->next; mlp != ms->mlist[0];
mlp = mlp->next)
{
if ((rv = match(ms, mlp->magic, mlp->nmagic, &bb, 0,
BINTEST, text, 0, indir_count, name_count,
printed_something, need_separator, NULL,
if ((rv = match(ms, mlp->magic, mlp->magic_rxcomp,
mlp->nmagic, &bb, 0, BINTEST, text, 0, indir_count,
name_count, printed_something, need_separator, NULL,
NULL)) != 0)
break;
}
@ -1875,8 +1882,8 @@ mget(struct magic_set *ms, struct magic *m, const struct buffer *b,
nfound_match = 0;
(*name_count)++;
eoffset = ms->eoffset;
rv = match(ms, ml.magic, ml.nmagic, b, offset + o,
mode, text, flip, indir_count, name_count,
rv = match(ms, ml.magic, ml.magic_rxcomp, ml.nmagic, b,
offset + o, mode, text, flip, indir_count, name_count,
printed_something, need_separator, returnval,
&nfound_match);
ms->ms_value.q = nfound_match;
@ -1998,8 +2005,29 @@ file_strncmp16(const char *a, const char *b, size_t len, size_t maxlen,
return file_strncmp(a, b, len, maxlen, flags);
}
private file_regex_t *
alloc_regex(struct magic_set *ms, struct magic *m)
{
int rc;
file_regex_t *rx = CAST(file_regex_t *, malloc(sizeof(*rx)));
if (rx == NULL) {
file_error(ms, errno, "can't allocate %" SIZE_T_FORMAT
"u bytes", sizeof(*rx));
return NULL;
}
rc = file_regcomp(ms, rx, m->value.s, REG_EXTENDED | REG_NEWLINE |
((m->str_flags & STRING_IGNORE_CASE) ? REG_ICASE : 0));
if (rc == 0)
return rx;
free(rx);
return NULL;
}
private int
magiccheck(struct magic_set *ms, struct magic *m)
magiccheck(struct magic_set *ms, struct magic *m, file_regex_t **m_cache)
{
uint64_t l = m->value.q;
uint64_t v;
@ -2016,6 +2044,12 @@ magiccheck(struct magic_set *ms, struct magic *m)
case FILE_SHORT:
case FILE_BESHORT:
case FILE_LESHORT:
case FILE_MSDOSDATE:
case FILE_LEMSDOSDATE:
case FILE_BEMSDOSDATE:
case FILE_MSDOSTIME:
case FILE_LEMSDOSTIME:
case FILE_BEMSDOSTIME:
v = p->h;
break;
@ -2077,8 +2111,8 @@ magiccheck(struct magic_set *ms, struct magic *m)
break;
default:
file_magerror(ms, "cannot happen with float: invalid relation `%c'",
m->reln);
file_magerror(ms, "cannot happen with float: "
"invalid relation `%c'", m->reln);
return -1;
}
return matched;
@ -2110,7 +2144,8 @@ magiccheck(struct magic_set *ms, struct magic *m)
break;
default:
file_magerror(ms, "cannot happen with double: invalid relation `%c'", m->reln);
file_magerror(ms, "cannot happen with double: "
"invalid relation `%c'", m->reln);
return -1;
}
return matched;
@ -2182,64 +2217,56 @@ magiccheck(struct magic_set *ms, struct magic *m)
}
case FILE_REGEX: {
int rc;
file_regex_t rx;
file_regex_t *rx = *m_cache;
const char *search;
regmatch_t pmatch;
size_t slen = ms->search.s_len;
char *copy;
if (ms->search.s == NULL)
return 0;
l = 0;
rc = file_regcomp(&rx, m->value.s,
REG_EXTENDED|REG_NEWLINE|
((m->str_flags & STRING_IGNORE_CASE) ? REG_ICASE : 0));
if (rc) {
file_regerror(&rx, rc, ms);
v = CAST(uint64_t, -1);
} else {
regmatch_t pmatch;
size_t slen = ms->search.s_len;
char *copy;
if (slen != 0) {
copy = CAST(char *, malloc(slen));
if (copy == NULL) {
file_regfree(&rx);
file_error(ms, errno,
"can't allocate %" SIZE_T_FORMAT "u bytes",
slen);
if (rx == NULL) {
rx = *m_cache = alloc_regex(ms, m);
if (rx == NULL)
return -1;
}
memcpy(copy, ms->search.s, slen);
copy[--slen] = '\0';
search = copy;
} else {
search = CCAST(char *, "");
copy = NULL;
}
rc = file_regexec(&rx, RCAST(const char *, search),
1, &pmatch, 0);
free(copy);
switch (rc) {
case 0:
ms->search.s += CAST(int, pmatch.rm_so);
ms->search.offset += CAST(size_t, pmatch.rm_so);
ms->search.rm_len = CAST(size_t,
pmatch.rm_eo - pmatch.rm_so);
v = 0;
break;
case REG_NOMATCH:
v = 1;
break;
default:
file_regerror(&rx, rc, ms);
v = CAST(uint64_t, -1);
break;
}
}
file_regfree(&rx);
if (v == CAST(uint64_t, -1))
l = 0;
if (slen != 0) {
copy = CAST(char *, malloc(slen));
if (copy == NULL) {
file_error(ms, errno,
"can't allocate %" SIZE_T_FORMAT "u bytes",
slen);
return -1;
}
memcpy(copy, ms->search.s, slen);
copy[--slen] = '\0';
search = copy;
} else {
search = CCAST(char *, "");
copy = NULL;
}
rc = file_regexec(ms, rx, RCAST(const char *, search),
1, &pmatch, 0);
free(copy);
switch (rc) {
case 0:
ms->search.s += CAST(int, pmatch.rm_so);
ms->search.offset += CAST(size_t, pmatch.rm_so);
ms->search.rm_len = CAST(size_t,
pmatch.rm_eo - pmatch.rm_so);
v = 0;
break;
case REG_NOMATCH:
v = 1;
break;
default:
return -1;
break;
}
break;
}
case FILE_USE:

6
tests/Makefile.am
View File

@ -7,6 +7,8 @@ android-vdex-1.result \
android-vdex-1.testfile \
android-vdex-2.result \
android-vdex-2.testfile \
arj.result \
arj.testfile \
CVE-2014-1943.result \
CVE-2014-1943.testfile \
JW07022A.mp3.result \
@ -35,6 +37,10 @@ json2.result \
json2.testfile \
json3.result \
json3.testfile \
json4.result \
json4.testfile \
json5.result \
json5.testfile \
matilde.arm.result \
matilde.arm.testfile \
pcjr.result \

6
tests/Makefile.in
View File

@ -299,6 +299,8 @@ android-vdex-1.result \
android-vdex-1.testfile \
android-vdex-2.result \
android-vdex-2.testfile \
arj.result \
arj.testfile \
CVE-2014-1943.result \
CVE-2014-1943.testfile \
JW07022A.mp3.result \
@ -327,6 +329,10 @@ json2.result \
json2.testfile \
json3.result \
json3.testfile \
json4.result \
json4.testfile \
json5.result \
json5.testfile \
matilde.arm.result \
matilde.arm.testfile \
pcjr.result \

1
tests/arj.result Normal file
View File

@ -0,0 +1 @@
ARJ archive data, v11, slash-switched, created 5 1980+48, original name: example_m0.arj, os: Unix

BIN
tests/arj.testfile Normal file
View File

Binary file not shown.

2
tests/json1.result
View File

@ -1 +1 @@
JSON data
JSON text data

2
tests/json2.result
View File

@ -1 +1 @@
JSON data
JSON text data

2
tests/json3.result
View File

@ -1 +1 @@
JSON data
JSON text data

1
tests/json4.result Normal file
View File

@ -0,0 +1 @@
JSON text data

1
tests/json4.testfile Normal file
View File

@ -0,0 +1 @@
[1]

1
tests/json5.result Normal file
View File

@ -0,0 +1 @@
ASCII text

1
tests/json5.testfile Normal file
View File

@ -0,0 +1 @@
[1] 2

3
tests/test.c
View File

@ -86,7 +86,7 @@ main(int argc, char **argv)
else
prog = argv[0];
ms = magic_open(MAGIC_NONE);
ms = magic_open(MAGIC_ERROR);
if (ms == NULL) {
(void)fprintf(stderr, "%s: ERROR opening MAGIC_NONE: %s\n",
prog, strerror(errno));
@ -105,7 +105,6 @@ main(int argc, char **argv)
if (argc != 3) {
(void)fprintf(stderr, "Usage: %s TEST-FILE RESULT\n", prog);
magic_close(ms);
goto bad;
}
if ((result = magic_file(ms, argv[1])) == NULL) {