137 lines
4.9 KiB
Plaintext
137 lines
4.9 KiB
Plaintext
|
|
#------------------------------------------------------------------------------
|
|
# msdos: file(1) magic for MS-DOS files
|
|
#
|
|
|
|
# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
|
|
0 string @echo\ off MS-DOS batch file text
|
|
|
|
# WinNT/WinCE PE files (Warner Losh, imp@village.org)
|
|
#
|
|
# XXX Missing powerpc from the WinNT world and Hitatchi SH-3 from the CE world.
|
|
128 string PE\000\000 Microsoft Portable Executable
|
|
>132 leshort 0x0000 \b, Unknown CPU
|
|
>132 leshort 0x14c \b, Intel 386
|
|
>132 leshort 0x14d \b, Intel 486
|
|
>132 leshort 0x14e \b, Intel 586
|
|
>132 leshort 0x162 \b, MIPS ISA I
|
|
>132 leshort 0x163 \b, MIPS ISA II
|
|
>132 leshort 0x166 \b, MIPS ISA III
|
|
>132 leshort 0x184 \b, Digital Alpha
|
|
0 string PE\000\000 Microsoft Portable Executable (no dos header)
|
|
>4 leshort 0x0000 \b, Unknown CPU
|
|
>4 leshort 0x14c \b, Intel 386
|
|
>4 leshort 0x14d \b, Intel 486
|
|
>4 leshort 0x14e \b, Intel 586
|
|
>4 leshort 0x162 \b, MIPS ISA I
|
|
>4 leshort 0x163 \b, MIPS ISA II
|
|
>4 leshort 0x166 \b, MIPS ISA III
|
|
>4 leshort 0x184 \b, Digital Alpha
|
|
# It would appear that the debugger information is in basically the same
|
|
# format as what binutils calls PEI files.
|
|
0 string DI\000\000 Microsoft PE Debugger Information
|
|
>4 leshort 0x0000 \b, Unknown CPU
|
|
>4 leshort 0x14c \b, Intel 386
|
|
>4 leshort 0x14d \b, Intel 486
|
|
>4 leshort 0x14e \b, Intel 586
|
|
>4 leshort 0x162 \b, MIPS ISA I
|
|
>4 leshort 0x163 \b, MIPS ISA II
|
|
>4 leshort 0x166 \b, MIPS ISA III
|
|
>4 leshort 0x184 \b, Digital Alpha
|
|
|
|
# .EXE formats (Greg Roelofs, newt@uchicago.edu)
|
|
#
|
|
0 string MZ MS-DOS executable (EXE)
|
|
>24 string @ \b, OS/2 or MS Windows
|
|
>>0xe7 string LH/2\ Self-Extract \b, %s
|
|
>>0xe9 string PKSFX2 \b, %s
|
|
>0x1c string RJSX\xff\xff \b, ARJ SFX
|
|
>0x1c string diet\xf9\x9c \b, diet compressed
|
|
>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. \b, PKSFX
|
|
# JM: 0x1e "PKLITE Copr. 1990-92 PKWARE Inc. All Rights Reserved\7\0\0\0"
|
|
>0x1e string PKLITE\ Copr. \b, %.6s compressed
|
|
>0x24 string LHa's\ SFX \b, %.15s
|
|
>0x24 string LHA's\ SFX \b, %.15s
|
|
>1638 string -lh5- \b, LHa SFX archive v2.13S
|
|
>7195 string Rar! \b, RAR self-extracting archive
|
|
#
|
|
# [GRR 950118: file 3.15 has a buffer-size limitation; offsets bigger than
|
|
# 8161 bytes are ignored. To make the following entries work, increase
|
|
# HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2,
|
|
# NT/Win32 and VMS.]
|
|
# [GRR: some company sells a self-extractor/displayer for image data(!)]
|
|
#
|
|
>11696 string PK\003\004 \b, PKZIP SFX archive v1.1
|
|
>13297 string PK\003\004 \b, PKZIP SFX archive v1.93a
|
|
>15588 string PK\003\004 \b, PKZIP2 SFX archive v1.09
|
|
>15770 string PK\003\004 \b, PKZIP SFX archive v2.04g
|
|
>28374 string PK\003\004 \b, PKZIP2 SFX archive v1.02
|
|
#
|
|
# Info-ZIP self-extractors
|
|
# these are the DOS versions:
|
|
>25115 string PK\003\004 \b, Info-ZIP SFX archive v5.12
|
|
>26331 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
|
|
# these are the OS/2 versions (OS/2 is flagged above):
|
|
>47031 string PK\003\004 \b, Info-ZIP SFX archive v5.12
|
|
>49845 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
|
|
# this is the NT/Win32 version:
|
|
>69120 string PK\003\004 \b, Info-ZIP NT SFX archive v5.12 w/decryption
|
|
#
|
|
# TELVOX Teleinformatica CODEC self-extractor for OS/2:
|
|
>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21
|
|
>>49824 leshort =1 \b, 1 file
|
|
>>49824 leshort >1 \b, %u files
|
|
|
|
# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
|
|
# Uncommenting only the first two lines will cover about 2/3 of COM files,
|
|
# but it isn't feasible to match all COM files since there must be at least
|
|
# two dozen different one-byte "magics".
|
|
#0 byte 0xe9 MS-DOS executable (COM)
|
|
#>6 string SFX\ of\ LHarc (%s)
|
|
#0 byte 0x8c MS-DOS executable (COM)
|
|
# 0xeb conflicts with "sequent" magic
|
|
#0 byte 0xeb MS-DOS executable (COM)
|
|
#0 byte 0xb8 MS-DOS executable (COM)
|
|
|
|
# miscellaneous formats
|
|
0 string LZ MS-DOS executable (built-in)
|
|
#0 byte 0xf0 MS-DOS program library data
|
|
#
|
|
|
|
#
|
|
# Windows NT Registry files.
|
|
#
|
|
0 string regf Windows NT Registry file
|
|
|
|
# Popular applications
|
|
2080 string Microsoft\ Word\ 6.0\ Document %s
|
|
2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
|
|
# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
|
|
2112 string MSWordDoc Microsoft Word document data
|
|
#
|
|
0 belong 0x31be0000 Microsoft Word Document
|
|
#
|
|
0 string PO^Q` Microsoft Word 6.0 Document
|
|
#
|
|
2080 string Microsoft\ Excel\ 5.0\ Worksheet %s
|
|
#
|
|
# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
|
|
2114 string Biff5 Microsoft Excel 5.0 Worksheet
|
|
#
|
|
0 belong 0x00001a00 Lotus 1-2-3
|
|
>4 belong 0x00100400 wk3 document data
|
|
>4 belong 0x02100400 wk4 document data
|
|
>4 belong 0x07800100 fm3 or fmb document data
|
|
>4 belong 0x07800000 fm3 or fmb document data
|
|
#
|
|
0 belong 0x00000200 Lotus 1-2-3
|
|
>4 belong 0x06040600 wk1 document data
|
|
>4 belong 0x06800200 fmt document data
|
|
|
|
# WordPerfect documents - Trevor Johnson <trevor@jpj.net>
|
|
#
|
|
1 string WPC WordPerfect document
|
|
|
|
# Help files
|
|
0 string ?_\3\0 MS Windows Help Data
|