d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

file: upgrade to 5.41.

Browse Source 
MFC after:	2 weeks
This commit is contained in:
Xin LI 2022-01-03 22:02:42 -08:00
commit 43a5ec4eb4
200 changed files with 6714 additions and 2711 deletions

78
contrib/file/ChangeLog

@ -1,3 +1,81 @@
2021-10-18 11:57 Christos Zoulas <christos@zoulas.com>
* release 5.41
2021-09-23 03:51 Christos Zoulas <christos@zoulas.com>
* Avinash Sonawane: Fix tzname detection
2021-09-03 09:17 Christos Zoulas <christos@zoulas.com>
* Fix relationship tests with "search" magic, don't short circuit
logic
2021-07-13 01:06 Christos Zoulas <christos@zoulas.com>
* Fix memory leak in compile mode
2021-07-01 03:51 Christos Zoulas <christos@zoulas.com>
* PR/272: kiefermat: Only set returnval = 1 when we printed something
(in all cases print or !print). This simplifies the logic and fixes
the issue in the PR with -k and --mime-type there was no continuation
printed before the default case.
2021-06-30 13:07 Christos Zoulas <christos@zoulas.com>
* PR/270: Don't translate unprintable characters in %s magic formats
when -r
* PR/269: Avoid undefined behavior with clang (adding offset to NULL)
2021-05-09 18:38 Christos Zoulas <christos@zoulas.com>
* Add a new flag (f) that requires that the match is a full word,
not a partial word match.
* Add varint types (unused)
2021-04-19 17:17 Christos Zoulas <christos@zoulas.com>
* PR/256: mutableVoid: If the file is less than 3 bytes, use the file
length to determine type
* PR/259: aleksandr.v.novichkov: mime printing through indirect magic
is not taken into account, use match directly so that it does.
2021-04-04 17:02 Christos Zoulas <christos@zoulas.com>
* count the total bytes found not the total byte positions
in order to determine encoding (Anatol Belski)
2021-03-30 20:21 Christos Zoulas <christos@zoulas.com>
* release 5.40
2021-02-05 16:31 Christos Zoulas <christos@zoulas.com>
* PR/234: Add limit to the number of bytes to scan for encoding
* PR/230: Fix /T (trim flag) for regex
2021-02-01 12:31 Christos Zoulas <christos@zoulas.com>
* PR/77: Trim trailing separator.
2020-12-17 15:44 Christos Zoulas <christos@zoulas.com>
* PR/211: Convert system read errors from corrupt ELF
files into human readable error messages
2020-12-08 16:24 Christos Zoulas <christos@zoulas.com>
* fix multithreaded decompression file descriptor issue
by using close-on-exec (Denys Vlasenko)
2020-06-27 11:58 Christos Zoulas <christos@zoulas.com>
* Exclude surrogate pairs from utf-8 detection (Michael Liu)
2020-06-25 12:53 Christos Zoulas <christos@zoulas.com>
* Include # to the list of ignored format chars (Werner Fink)
2020-06-14 20:02 Christos Zoulas <christos@zoulas.com>
* release 5.39

2
contrib/file/Makefile.am

@ -1,6 +1,6 @@
ACLOCAL_AMFLAGS = -I m4
EXTRA_DIST = MAINT
EXTRA_DIST = MAINT RELEASE-PROCEDURE README.DEVELOPER m4/visibility.m4
SUBDIRS = src magic tests doc python

7
contrib/file/Makefile.in

@ -92,7 +92,8 @@ ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \
$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
$(top_srcdir)/acinclude.m4 $(top_srcdir)/configure.ac
$(top_srcdir)/m4/visibility.m4 $(top_srcdir)/acinclude.m4 \
$(top_srcdir)/configure.ac
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
DIST_COMMON = $(srcdir)/Makefile.am $(top_srcdir)/configure \
@ -191,7 +192,7 @@ CSCOPE = cscope
DIST_SUBDIRS = $(SUBDIRS)
am__DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/config.h.in \
$(srcdir)/libmagic.pc.in AUTHORS COPYING ChangeLog INSTALL \
NEWS README TODO compile config.guess config.sub install-sh \
NEWS TODO compile config.guess config.sub depcomp install-sh \
ltmain.sh missing
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
distdir = $(PACKAGE)-$(VERSION)
@ -357,7 +358,7 @@ top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
ACLOCAL_AMFLAGS = -I m4
EXTRA_DIST = MAINT
EXTRA_DIST = MAINT RELEASE-PROCEDURE README.DEVELOPER m4/visibility.m4
SUBDIRS = src magic tests doc python
# This variable must have 'exec' in its name, in order to be installed

159
contrib/file/README

@ -1,159 +0,0 @@
## README for file(1) Command and the libmagic(3) library ##
@(#) $File: README,v 1.59 2019/09/19 01:04:01 christos Exp $
Mailing List: file@astron.com
Mailing List archives: http://mailman.astron.com/pipermail/file/
Bug tracker: http://bugs.astron.com/
E-mail: christos@astron.com
Build Status: https://travis-ci.org/file/file
Phone: Do not even think of telephoning me about this program. Send cash first!
This is Release 5.x of Ian Darwin's (copyright but distributable)
file(1) command, an implementation of the Unix File(1) command.
It knows the 'magic number' of several thousands of file types.
This version is the standard "file" command for Linux,
*BSD, and other systems. (See "patchlevel.h" for the exact release number).
You can download the latest version of the original sources for file from:
ftp://ftp.astron.com/pub/file/
A public read-only git repository of the same sources is available at:
https://github.com/file/file
We are continuously being fuzzed by OSS-FUZZ:
https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:file
The major changes for 5.x are CDF file parsing, indirect magic, name/use
(recursion) and overhaul in mime and ascii encoding handling.
The major feature of 4.x is the refactoring of the code into a library,
and the re-write of the file command in terms of that library. The library
itself, libmagic can be used by 3rd party programs that wish to identify
file types without having to fork() and exec() file. The prime contributor
for 4.0 was Mans Rullgard.
UNIX is a trademark of UNIX System Laboratories.
The prime contributor to Release 3.8 was Guy Harris, who put in megachanges
including byte-order independence.
The prime contributor to Release 3.0 was Christos Zoulas, who put
in hundreds of lines of source code changes, including his own
ANSIfication of the code (I liked my own ANSIfication better, but
his (__P()) is the "Berkeley standard" way of doing it, and I wanted UCB
to include the code...), his HP-like "indirection" (a feature of
the HP file command, I think), and his mods that finally got the
uncompress (-z) mode finished and working.
This release has compiled in numerous environments; see PORTING
for a list and problems.
This fine freeware file(1) follows the USG (System V) model of the file
command, rather than the Research (V7) version or the V7-derived 4.[23]
Berkeley one. That is, the file /etc/magic contains much of the ritual
information that is the source of this program's power. My version
knows a little more magic (including tar archives) than System V; the
/etc/magic parsing seems to be compatible with the (poorly documented)
System V /etc/magic format (with one exception; see the man page).
In addition, the /etc/magic file is built from a subdirectory
for easier(?) maintenance. I will act as a clearinghouse for
magic numbers assigned to all sorts of data files that
are in reasonable circulation. Send your magic numbers,
in magic(5) format please, to the maintainer, Christos Zoulas.
COPYING - read this first.
README - read this second (you are currently reading this file).
INSTALL - read on how to install
src/apprentice.c - parses /etc/magic to learn magic
src/apptype.c - used for OS/2 specific application type magic
src/ascmagic.c - third & last set of tests, based on hardwired assumptions.
src/asctime_r.c - replacement for OS's that don't have it.
src/asprintf.c - replacement for OS's that don't have it.
src/asctime_r.c - replacement for OS's that don't have it.
src/asprintf.c - replacement for OS's that don't have it.
src/buffer.c - buffer handling functions.
src/cdf.[ch] - parser for Microsoft Compound Document Files
src/cdf_time.c - time converter for CDF.
src/compress.c - handles decompressing files to look inside.
src/ctime_r.c - replacement for OS's that don't have it.
src/der.[ch] - parser for Distinguished Encoding Rules
src/dprintf.c - replacement for OS's that don't have it.
src/elfclass.h - common code for elf 32/64.
src/encoding.c - handles unicode encodings
src/file.c - the main program
src/file.h - header file
src/file_opts.h - list of options
src/fmtcheck.c - replacement for OS's that don't have it.
src/fsmagic.c - first set of tests the program runs, based on filesystem info
src/funcs.c - utilility functions
src/getline.c - replacement for OS's that don't have it.
src/getopt_long.c - replacement for OS's that don't have it.
src/gmtime_r.c - replacement for OS's that don't have it.
src/is_csv.c - knows about Comma Separated Value file format (RFC 4180).
src/is_json.c - knows about JavaScript Object Notation format (RFC 8259).
src/is_tar.c, tar.h - knows about Tape ARchive format (courtesy John Gilmore).
src/localtime_r.c - replacement for OS's that don't have it.
src/magic.h.in - source file for magic.h
src/mygetopt.h - replacement for OS's that don't have it.
src/magic.c - the libmagic api
src/names.h - header file for ascmagic.c
src/pread.c - replacement for OS's that don't have it.
src/print.c - print results, errors, warnings.
src/readcdf.c - CDF wrapper.
src/readelf.[ch] - Stand-alone elf parsing code.
src/softmagic.c - 2nd set of tests, based on /etc/magic
src/mygetopt.h - replacement for OS's that don't have it.
src/strcasestr.c - replacement for OS's that don't have it.
src/strlcat.c - replacement for OS's that don't have it.
src/strlcpy.c - replacement for OS's that don't have it.
src/strndup.c - replacement for OS's that don't have it.
src/tar.h - tar file definitions
src/vasprintf.c - for systems that don't have it.
doc/file.man - man page for the command
doc/magic.man - man page for the magic file, courtesy Guy Harris.
Install as magic.4 on USG and magic.5 on V7 or Berkeley; cf Makefile.
Magdir - directory of /etc/magic pieces
------------------------------------------------------------------------------
If you submit a new magic entry please make sure you read the following
guidelines:
- Initial match is preferably at least 32 bits long, and is a _unique_ match
- If this is not feasible, use additional check
- Match of <= 16 bits are not accepted
- Delay printing string as much as possible, don't print output too early
- Avoid printf arbitrary byte as string, which can be a source of
crash and buffer overflow
- Provide complete information with entry:
* One line short summary
* Optional long description
* File extension, if applicable
* Full name and contact method (for discussion when entry has problem)
* Further reference, such as documentation of format
------------------------------------------------------------------------------
gpg for dummies:
$ gpg --verify file-X.YY.tar.gz.asc file-X.YY.tar.gz
gpg: assuming signed data in `file-X.YY.tar.gz'
gpg: Signature made WWW MMM DD HH:MM:SS YYYY ZZZ using DSA key ID KKKKKKKK
To download the key:
$ gpg --keyserver hkp://keys.gnupg.net --recv-keys KKKKKKKK
------------------------------------------------------------------------------
Parts of this software were developed at SoftQuad Inc., developers
of SGML/HTML/XML publishing software, in Toronto, Canada.
SoftQuad was swallowed up by Corel in 2002 and does not exist any longer.

49
contrib/file/README.DEVELOPER Normal file

@ -0,0 +1,49 @@
# How to get started developing
@(#) $File: README.DEVELOPER,v 1.9 2021/09/20 14:04:39 christos Exp $
## Auto files
After checking out the source, run the following:
autoreconf -f -i
make distclean # this can fail if you have not built before
./configure --disable-silent-rules
make -j4
make -C tests check
If you see errors, make sure you have the latest libtool and autoconf
This has been tested with autoconf-2.69 and libtool-2.4.2
## Installing dependencies
If your platform doesn't have the above tools, install the following
packages first.
### Debian
apt-get install \
automake \
gcc \
libtool \
make \
python \
zlib1g-dev \
See also `.travis.yml`.
### Mac OS X (MacPorts)
port install \
autoconf \
automake \
libtool \
### Mac OS X (HomeBrew)
brew install autoconf automake libtool
Tested with:
autoconf 2.69
automake 1.16.1
libtool 2.4.6

29
contrib/file/RELEASE-PROCEDURE Normal file

@ -0,0 +1,29 @@
# HOW TO RELEASE FILE
@(#) $File: RELEASE-PROCEDURE,v 1.7 2021/10/18 16:38:25 christos Exp $
1) Update version number in configure.ac
2) Note the new version in ChangeLog
3) Update README.md if applicable
4) Commit changes into CVS
5) Rebuild and run tests (see README.DEVELOPER)
6) Tag the release with FILEx_yy
7) Create the source tarball: make distcheck
7a) Sign the source tarball.
gpg --armor --detach-sign mysoftware-0.4.tar.gz
8) Make the source tarball available on ftp
9) Add the new version to bugs.astron.com:
- Click: Manage > Manage Projects > file
- Scroll down to "Versions"
- Click on "Edit" next to the HEAD version
- Change the "Version" from HEAD to the newly released version
- Change the "Date Order" to the current time
- Check the "Released" box
- Click on "Update Version"
- Type HEAD into the box at the bottom of the version list and
click on "Add and Edit Version"
- Set the "Date Order" to 2030-01-01 (i.e. far in the future)
- Click on "Update Version"
10) Mail an announcement to file@astron.com containing a summary of the
ChangeLog changes. Historically we don't mention magic changes in the
ChangeLog or the mail message, only source changes.

35
contrib/file/acinclude.m4

@ -3,8 +3,9 @@ dnl from autoconf 2.13 acspecific.m4, with changes to check for daylight
AC_DEFUN([AC_STRUCT_TIMEZONE_DAYLIGHT],
[AC_REQUIRE([AC_STRUCT_TM])dnl
AC_CACHE_CHECK([for tm_zone in struct tm], ac_cv_struct_tm_zone,
[AC_TRY_COMPILE([#include <sys/types.h>
#include <$ac_cv_struct_tm>], [struct tm tm; tm.tm_zone;],
[AC_COMPILE_IFELSE(
[AC_LANG_PROGRAM([#include <sys/types.h>
#include <$ac_cv_struct_tm>], [struct tm tm; tm.tm_zone;])],
ac_cv_struct_tm_zone=yes, ac_cv_struct_tm_zone=no)])
if test "$ac_cv_struct_tm_zone" = yes; then
AC_DEFINE(HAVE_TM_ZONE,1,[HAVE_TM_ZONE])
@ -14,19 +15,20 @@ fi
# consider it declared and we won't give our own extern.
AC_CHECK_DECLS([tzname], , , [#include <time.h>])
AC_CACHE_CHECK(for tzname, ac_cv_var_tzname,
[AC_TRY_LINK(
[#include <time.h>
#if !HAVE_DECL_TZNAME
[AC_LINK_IFELSE(
[AC_LANG_PROGRAM([#include <time.h>],
[[#if !HAVE_DECL_TZNAME
extern char *tzname[];
#endif],
[return tzname[0][0];], [ac_cv_var_tzname=yes], [ac_cv_var_tzname=no])])
#endif
return tzname[0][0];]])], [ac_cv_var_tzname=yes], [ac_cv_var_tzname=no])])
if test $ac_cv_var_tzname = yes; then
AC_DEFINE(HAVE_TZNAME,1,[HAVE_TZNAME])
fi
AC_CACHE_CHECK([for tm_isdst in struct tm], ac_cv_struct_tm_isdst,
[AC_TRY_COMPILE([#include <sys/types.h>
#include <$ac_cv_struct_tm>], [struct tm tm; tm.tm_isdst;],
[AC_COMPILE_IFELSE(
[AC_LANG_PROGRAM([#include <sys/types.h>
#include <$ac_cv_struct_tm>], [struct tm tm; tm.tm_isdst;])],
ac_cv_struct_tm_isdst=yes, ac_cv_struct_tm_isdst=no)])
if test "$ac_cv_struct_tm_isdst" = yes; then
AC_DEFINE(HAVE_TM_ISDST,1,[HAVE_TM_ISDST])
@ -35,14 +37,12 @@ fi
AC_CHECK_DECLS([daylight], , , [#include <time.h>])
AC_CACHE_CHECK(for daylight, ac_cv_var_daylight,
[AC_TRY_LINK(
changequote(<<, >>)dnl
<<#include <time.h>
#if !HAVE_DECL_DAYLIGHT
[AC_LINK_IFELSE(
[AC_LANG_PROGRAM([#include <time.h>],
[#if !HAVE_DECL_DAYLIGHT
extern int daylight;
#endif>>,
changequote([, ])dnl
[atoi(daylight);], ac_cv_var_daylight=yes, ac_cv_var_daylight=no)])
#endif
atoi(daylight);])], ac_cv_var_daylight=yes, ac_cv_var_daylight=no)])
if test $ac_cv_var_daylight = yes; then
AC_DEFINE(HAVE_DAYLIGHT,1,[HAVE_DAYLIGHT])
fi
@ -50,7 +50,8 @@ changequote([, ])dnl
AC_DEFUN([AC_STRUCT_OPTION_GETOPT_H],
[AC_CACHE_CHECK([for struct option in getopt], ac_cv_struct_option_getopt_h,
[AC_TRY_COMPILE([#include <getopt.h>], [struct option op; op.name;],
[AC_COMPILE_IFELSE(
[AC_LANG_PROGRAM([#include <getopt.h>], [struct option op; op.name;])],
ac_cv_struct_option_getopt_h=yes, ac_cv_struct_option_getopt_h=no)])
if test "$ac_cv_struct_option_getopt_h" = yes; then
AC_DEFINE(HAVE_STRUCT_OPTION,1,[HAVE_STRUCT_OPTION])

79
contrib/file/aclocal.m4 vendored

@ -20,84 +20,6 @@ You have another version of autoconf. It may work, but is not guaranteed to.
If you have problems, you may need to regenerate the build system entirely.
To do so, use the procedure documented by the package, typically 'autoreconf'.])])
# visibility.m4 serial 6
dnl Copyright (C) 2005, 2008, 2010-2019 Free Software Foundation, Inc.
dnl This file is free software; the Free Software Foundation
dnl gives unlimited permission to copy and/or distribute it,
dnl with or without modifications, as long as this notice is preserved.
dnl From Bruno Haible.
dnl Tests whether the compiler supports the command-line option
dnl -fvisibility=hidden and the function and variable attributes
dnl __attribute__((__visibility__("hidden"))) and
dnl __attribute__((__visibility__("default"))).
dnl Does *not* test for __visibility__("protected") - which has tricky
dnl semantics (see the 'vismain' test in glibc) and does not exist e.g. on
dnl Mac OS X.
dnl Does *not* test for __visibility__("internal") - which has processor
dnl dependent semantics.
dnl Does *not* test for #pragma GCC visibility push(hidden) - which is
dnl "really only recommended for legacy code".
dnl Set the variable CFLAG_VISIBILITY.
dnl Defines and sets the variable HAVE_VISIBILITY.
AC_DEFUN([gl_VISIBILITY],
[
AC_REQUIRE([AC_PROG_CC])
CFLAG_VISIBILITY=
HAVE_VISIBILITY=0
if test -n "$GCC"; then
dnl First, check whether -Werror can be added to the command line, or
dnl whether it leads to an error because of some other option that the
dnl user has put into $CC $CFLAGS $CPPFLAGS.
AC_CACHE_CHECK([whether the -Werror option is usable],
[gl_cv_cc_vis_werror],
[gl_save_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS -Werror"
AC_COMPILE_IFELSE(
[AC_LANG_PROGRAM([[]], [[]])],
[gl_cv_cc_vis_werror=yes],
[gl_cv_cc_vis_werror=no])
CFLAGS="$gl_save_CFLAGS"
])
dnl Now check whether visibility declarations are supported.
AC_CACHE_CHECK([for simple visibility declarations],
[gl_cv_cc_visibility],
[gl_save_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS -fvisibility=hidden"
dnl We use the option -Werror and a function dummyfunc, because on some
dnl platforms (Cygwin 1.7) the use of -fvisibility triggers a warning
dnl "visibility attribute not supported in this configuration; ignored"
dnl at the first function definition in every compilation unit, and we
dnl don't want to use the option in this case.
if test $gl_cv_cc_vis_werror = yes; then
CFLAGS="$CFLAGS -Werror"
fi
AC_COMPILE_IFELSE(
[AC_LANG_PROGRAM(
[[extern __attribute__((__visibility__("hidden"))) int hiddenvar;
extern __attribute__((__visibility__("default"))) int exportedvar;
extern __attribute__((__visibility__("hidden"))) int hiddenfunc (void);
extern __attribute__((__visibility__("default"))) int exportedfunc (void);
void dummyfunc (void) {}
]],
[[]])],
[gl_cv_cc_visibility=yes],
[gl_cv_cc_visibility=no])
CFLAGS="$gl_save_CFLAGS"
])
if test $gl_cv_cc_visibility = yes; then
CFLAG_VISIBILITY="-fvisibility=hidden"
HAVE_VISIBILITY=1
fi
fi
AC_SUBST([CFLAG_VISIBILITY])
AC_SUBST([HAVE_VISIBILITY])
AC_DEFINE_UNQUOTED([HAVE_VISIBILITY], [$HAVE_VISIBILITY],
[Define to 1 or 0, depending whether the compiler supports simple visibility declarations.])
])
# Copyright (C) 2002-2018 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
@ -1216,4 +1138,5 @@ m4_include([m4/ltoptions.m4])
m4_include([m4/ltsugar.m4])
m4_include([m4/ltversion.m4])
m4_include([m4/lt~obsolete.m4])
m4_include([m4/visibility.m4])
m4_include([acinclude.m4])

3
contrib/file/config.h.in

@ -125,6 +125,9 @@
/* Define to 1 if you have the `newlocale' function. */
#undef HAVE_NEWLOCALE
/* Define to 1 if you have the `pipe2' function. */
#undef HAVE_PIPE2
/* Define to 1 if you have the `pread' function. */
#undef HAVE_PREAD

608
contrib/file/configure vendored

@ -1,6 +1,6 @@
#! /bin/sh
# Guess values for system-dependent variables and create Makefiles.
# Generated by GNU Autoconf 2.69 for file 5.39.
# Generated by GNU Autoconf 2.69 for file 5.41.
#
# Report bugs to <christos@astron.com>.
#
@ -590,8 +590,8 @@ MAKEFLAGS=
# Identity of this package.
PACKAGE_NAME='file'
PACKAGE_TARNAME='file'
PACKAGE_VERSION='5.39'
PACKAGE_STRING='file 5.39'
PACKAGE_VERSION='5.41'
PACKAGE_STRING='file 5.41'
PACKAGE_BUGREPORT='christos@astron.com'
PACKAGE_URL=''
@ -1334,7 +1334,7 @@ if test "$ac_init_help" = "long"; then
# Omit some internal or obsolete options to make the list less imposing.
# This message is too long to be a string in the A/UX 3.1 sh.
cat <<_ACEOF
\`configure' configures file 5.39 to adapt to many kinds of systems.
\`configure' configures file 5.41 to adapt to many kinds of systems.
Usage: $0 [OPTION]... [VAR=VALUE]...
@ -1404,7 +1404,7 @@ fi
if test -n "$ac_init_help"; then
case $ac_init_help in
short | recursive ) echo "Configuration of file 5.39:";;
short | recursive ) echo "Configuration of file 5.41:";;
esac
cat <<\_ACEOF
@ -1524,7 +1524,7 @@ fi
test -n "$ac_init_help" && exit $ac_status
if $ac_init_version; then
cat <<\_ACEOF
file configure 5.39
file configure 5.41
generated by GNU Autoconf 2.69
Copyright (C) 2012 Free Software Foundation, Inc.
@ -2180,7 +2180,7 @@ cat >config.log <<_ACEOF
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
It was created by file $as_me 5.39, which was
It was created by file $as_me 5.41, which was
generated by GNU Autoconf 2.69. Invocation command line was
$ $0 $@
@ -3046,7 +3046,7 @@ fi
# Define the identity of the package.
PACKAGE='file'
VERSION='5.39'
VERSION='5.41'
cat >>confdefs.h <<_ACEOF
@ -3401,69 +3401,6 @@ fi
DEPDIR="${am__leading_dot}deps"
ac_config_commands="$ac_config_commands depfiles"
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether ${MAKE-make} supports the include directive" >&5
$as_echo_n "checking whether ${MAKE-make} supports the include directive... " >&6; }
cat > confinc.mk << 'END'
am__doit:
@echo this is the am__doit target >confinc.out
.PHONY: am__doit
END
am__include="#"
am__quote=
# BSD make does it like this.
echo '.include "confinc.mk" # ignored' > confmf.BSD
# Other make implementations (GNU, Solaris 10, AIX) do it like this.
echo 'include confinc.mk # ignored' > confmf.GNU
_am_result=no
for s in GNU BSD; do
{ echo "$as_me:$LINENO: ${MAKE-make} -f confmf.$s && cat confinc.out" >&5
(${MAKE-make} -f confmf.$s && cat confinc.out) >&5 2>&5
ac_status=$?
echo "$as_me:$LINENO: \$? = $ac_status" >&5
(exit $ac_status); }
case $?:`cat confinc.out 2>/dev/null` in #(
'0:this is the am__doit target') :
case $s in #(
BSD) :
am__include='.include' am__quote='"' ;; #(
*) :
am__include='include' am__quote='' ;;
esac ;; #(
*) :
;;
esac
if test "$am__include" != "#"; then
_am_result="yes ($s style)"
break
fi
done
rm -f confinc.* confmf.*
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: ${_am_result}" >&5
$as_echo "${_am_result}" >&6; }
# Check whether --enable-dependency-tracking was given.
if test "${enable_dependency_tracking+set}" = set; then :
enableval=$enable_dependency_tracking;
fi
if test "x$enable_dependency_tracking" != xno; then
am_depcomp="$ac_aux_dir/depcomp"
AMDEPBACKSLASH='\'
am__nodep='_no'
fi
if test "x$enable_dependency_tracking" != xno; then
AMDEP_TRUE=
AMDEP_FALSE='#'
else
AMDEP_TRUE='#'
AMDEP_FALSE=
fi
ac_ext=c
ac_cpp='$CPP $CPPFLAGS'
ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
@ -4311,6 +4248,69 @@ ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
ac_compiler_gnu=$ac_cv_c_compiler_gnu
DEPDIR="${am__leading_dot}deps"
ac_config_commands="$ac_config_commands depfiles"
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether ${MAKE-make} supports the include directive" >&5
$as_echo_n "checking whether ${MAKE-make} supports the include directive... " >&6; }
cat > confinc.mk << 'END'
am__doit:
@echo this is the am__doit target >confinc.out
.PHONY: am__doit
END
am__include="#"
am__quote=
# BSD make does it like this.
echo '.include "confinc.mk" # ignored' > confmf.BSD
# Other make implementations (GNU, Solaris 10, AIX) do it like this.
echo 'include confinc.mk # ignored' > confmf.GNU
_am_result=no
for s in GNU BSD; do
{ echo "$as_me:$LINENO: ${MAKE-make} -f confmf.$s && cat confinc.out" >&5
(${MAKE-make} -f confmf.$s && cat confinc.out) >&5 2>&5
ac_status=$?
echo "$as_me:$LINENO: \$? = $ac_status" >&5
(exit $ac_status); }
case $?:`cat confinc.out 2>/dev/null` in #(
'0:this is the am__doit target') :
case $s in #(
BSD) :
am__include='.include' am__quote='"' ;; #(
*) :
am__include='include' am__quote='' ;;
esac ;; #(
*) :
;;
esac
if test "$am__include" != "#"; then
_am_result="yes ($s style)"
break
fi
done
rm -f confinc.* confmf.*
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: ${_am_result}" >&5
$as_echo "${_am_result}" >&6; }
# Check whether --enable-dependency-tracking was given.
if test "${enable_dependency_tracking+set}" = set; then :
enableval=$enable_dependency_tracking;
fi
if test "x$enable_dependency_tracking" != xno; then
am_depcomp="$ac_aux_dir/depcomp"
AMDEPBACKSLASH='\'
am__nodep='_no'
fi
if test "x$enable_dependency_tracking" != xno; then
AMDEP_TRUE=
AMDEP_FALSE='#'
else
AMDEP_TRUE='#'
AMDEP_FALSE=
fi
depcc="$CC" am_compiler_list=
@ -4440,298 +4440,6 @@ else
fi
case $ac_cv_prog_cc_stdc in #(
no) :
ac_cv_prog_cc_c99=no; ac_cv_prog_cc_c89=no ;; #(
*) :
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $CC option to accept ISO C99" >&5
$as_echo_n "checking for $CC option to accept ISO C99... " >&6; }
if ${ac_cv_prog_cc_c99+:} false; then :
$as_echo_n "(cached) " >&6
else
ac_cv_prog_cc_c99=no
ac_save_CC=$CC
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h. */
#include <stdarg.h>
#include <stdbool.h>
#include <stdlib.h>
#include <wchar.h>
#include <stdio.h>
// Check varargs macros. These examples are taken from C99 6.10.3.5.
#define debug(...) fprintf (stderr, __VA_ARGS__)
#define showlist(...) puts (#__VA_ARGS__)
#define report(test,...) ((test) ? puts (#test) : printf (__VA_ARGS__))
static void
test_varargs_macros (void)
{
int x = 1234;
int y = 5678;
debug ("Flag");
debug ("X = %d\n", x);
showlist (The first, second, and third items.);
report (x>y, "x is %d but y is %d", x, y);
}
// Check long long types.
#define BIG64 18446744073709551615ull
#define BIG32 4294967295ul
#define BIG_OK (BIG64 / BIG32 == 4294967297ull && BIG64 % BIG32 == 0)
#if !BIG_OK
your preprocessor is broken;
#endif
#if BIG_OK
#else
your preprocessor is broken;
#endif
static long long int bignum = -9223372036854775807LL;
static unsigned long long int ubignum = BIG64;
struct incomplete_array
{
int datasize;
double data[];
};
struct named_init {
int number;
const wchar_t *name;
double average;
};
typedef const char *ccp;
static inline int
test_restrict (ccp restrict text)
{
// See if C++-style comments work.
// Iterate through items via the restricted pointer.
// Also check for declarations in for loops.
for (unsigned int i = 0; *(text+i) != '\0'; ++i)
continue;
return 0;
}
// Check varargs and va_copy.
static void
test_varargs (const char *format, ...)
{
va_list args;
va_start (args, format);
va_list args_copy;
va_copy (args_copy, args);
const char *str;
int number;
float fnumber;
while (*format)
{
switch (*format++)
{
case 's': // string
str = va_arg (args_copy, const char *);
break;
case 'd': // int
number = va_arg (args_copy, int);
break;
case 'f': // float
fnumber = va_arg (args_copy, double);
break;
default:
break;
}
}
va_end (args_copy);
va_end (args);
}
int
main ()
{
// Check bool.
_Bool success = false;
// Check restrict.
if (test_restrict ("String literal") == 0)
success = true;
char *restrict newvar = "Another string";
// Check varargs.
test_varargs ("s, d' f .", "string", 65, 34.234);
test_varargs_macros ();
// Check flexible array members.
struct incomplete_array *ia =
malloc (sizeof (struct incomplete_array) + (sizeof (double) * 10));
ia->datasize = 10;
for (int i = 0; i < ia->datasize; ++i)
ia->data[i] = i * 1.234;
// Check named initializers.
struct named_init ni = {
.number = 34,
.name = L"Test wide string",
.average = 543.34343,
};
ni.number = 58;
int dynamic_array[ni.number];
dynamic_array[ni.number - 1] = 543;
// work around unused variable warnings
return (!success || bignum == 0LL || ubignum == 0uLL || newvar[0] == 'x'
|| dynamic_array[ni.number - 1] != 543);
;
return 0;
}
_ACEOF
for ac_arg in '' -std=gnu99 -std=c99 -c99 -AC99 -D_STDC_C99= -qlanglvl=extc99
do
CC="$ac_save_CC $ac_arg"
if ac_fn_c_try_compile "$LINENO"; then :
ac_cv_prog_cc_c99=$ac_arg
fi
rm -f core conftest.err conftest.$ac_objext
test "x$ac_cv_prog_cc_c99" != "xno" && break
done
rm -f conftest.$ac_ext
CC=$ac_save_CC
fi
# AC_CACHE_VAL
case "x$ac_cv_prog_cc_c99" in
x)
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: none needed" >&5
$as_echo "none needed" >&6; } ;;
xno)
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5
$as_echo "unsupported" >&6; } ;;
*)
CC="$CC $ac_cv_prog_cc_c99"
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c99" >&5
$as_echo "$ac_cv_prog_cc_c99" >&6; } ;;
esac
if test "x$ac_cv_prog_cc_c99" != xno; then :
ac_cv_prog_cc_stdc=$ac_cv_prog_cc_c99
else
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $CC option to accept ISO C89" >&5
$as_echo_n "checking for $CC option to accept ISO C89... " >&6; }
if ${ac_cv_prog_cc_c89+:} false; then :
$as_echo_n "(cached) " >&6
else
ac_cv_prog_cc_c89=no
ac_save_CC=$CC
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h. */
#include <stdarg.h>
#include <stdio.h>
struct stat;
/* Most of the following tests are stolen from RCS 5.7's src/conf.sh. */
struct buf { int x; };
FILE * (*rcsopen) (struct buf *, struct stat *, int);
static char *e (p, i)
char **p;
int i;
{
return p[i];
}
static char *f (char * (*g) (char **, int), char **p, ...)
{
char *s;
va_list v;
va_start (v,p);
s = g (p, va_arg (v,int));
va_end (v);
return s;
}
/* OSF 4.0 Compaq cc is some sort of almost-ANSI by default. It has
function prototypes and stuff, but not '\xHH' hex character constants.
These don't provoke an error unfortunately, instead are silently treated
as 'x'. The following induces an error, until -std is added to get
proper ANSI mode. Curiously '\x00'!='x' always comes out true, for an
array size at least. It's necessary to write '\x00'==0 to get something
that's true only with -std. */
int osf4_cc_array ['\x00' == 0 ? 1 : -1];
/* IBM C 6 for AIX is almost-ANSI by default, but it replaces macro parameters
inside strings and character constants. */
#define FOO(x) 'x'
int xlc6_cc_array[FOO(a) == 'x' ? 1 : -1];
int test (int i, double x);
struct s1 {int (*f) (int a);};
struct s2 {int (*f) (double a);};
int pairnames (int, char **, FILE *(*)(struct buf *, struct stat *, int), int, int);
int argc;
char **argv;
int
main ()
{
return f (e, argv, 0) != argv[0] || f (e, argv, 1) != argv[1];
;
return 0;
}
_ACEOF
for ac_arg in '' -qlanglvl=extc89 -qlanglvl=ansi -std \
-Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__"
do
CC="$ac_save_CC $ac_arg"
if ac_fn_c_try_compile "$LINENO"; then :
ac_cv_prog_cc_c89=$ac_arg
fi
rm -f core conftest.err conftest.$ac_objext
test "x$ac_cv_prog_cc_c89" != "xno" && break
done
rm -f conftest.$ac_ext
CC=$ac_save_CC
fi
# AC_CACHE_VAL
case "x$ac_cv_prog_cc_c89" in
x)
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: none needed" >&5
$as_echo "none needed" >&6; } ;;
xno)
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5
$as_echo "unsupported" >&6; } ;;
*)
CC="$CC $ac_cv_prog_cc_c89"
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c89" >&5
$as_echo "$ac_cv_prog_cc_c89" >&6; } ;;
esac
if test "x$ac_cv_prog_cc_c89" != xno; then :
ac_cv_prog_cc_stdc=$ac_cv_prog_cc_c89
else
ac_cv_prog_cc_stdc=no
fi
fi
;;
esac
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $CC option to accept ISO Standard C" >&5
$as_echo_n "checking for $CC option to accept ISO Standard C... " >&6; }
if ${ac_cv_prog_cc_stdc+:} false; then :
$as_echo_n "(cached) " >&6
fi
case $ac_cv_prog_cc_stdc in #(
no) :
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5
$as_echo "unsupported" >&6; } ;; #(
'') :
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: none needed" >&5
$as_echo "none needed" >&6; } ;; #(
*) :
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_stdc" >&5
$as_echo "$ac_cv_prog_cc_stdc" >&6; } ;;
esac
ac_ext=c
ac_cpp='$CPP $CPPFLAGS'
@ -13022,12 +12730,13 @@ CC=$lt_save_CC
if test -n "$GCC"; then
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the -Werror option is usable" >&5
$as_echo_n "checking whether the -Werror option is usable... " >&6; }
if ${gl_cv_cc_vis_werror+:} false; then :
if ${gl_cv_cc_vis_werror+:} false; then :
$as_echo_n "(cached) " >&6
else
gl_save_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS -Werror"
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
gl_save_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS -Werror"
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h. */
int
@ -13044,28 +12753,29 @@ else
gl_cv_cc_vis_werror=no
fi
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
CFLAGS="$gl_save_CFLAGS"
CFLAGS="$gl_save_CFLAGS"
fi
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $gl_cv_cc_vis_werror" >&5
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $gl_cv_cc_vis_werror" >&5
$as_echo "$gl_cv_cc_vis_werror" >&6; }
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for simple visibility declarations" >&5
$as_echo_n "checking for simple visibility declarations... " >&6; }
if ${gl_cv_cc_visibility+:} false; then :
if ${gl_cv_cc_visibility+:} false; then :
$as_echo_n "(cached) " >&6
else
gl_save_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS -fvisibility=hidden"
if test $gl_cv_cc_vis_werror = yes; then
CFLAGS="$CFLAGS -Werror"
fi
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
gl_save_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS -fvisibility=hidden"
if test $gl_cv_cc_vis_werror = yes; then
CFLAGS="$CFLAGS -Werror"
fi
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h. */
extern __attribute__((__visibility__("hidden"))) int hiddenvar;
extern __attribute__((__visibility__("default"))) int exportedvar;
extern __attribute__((__visibility__("hidden"))) int hiddenfunc (void);
extern __attribute__((__visibility__("default"))) int exportedfunc (void);
void dummyfunc (void) {}
extern __attribute__((__visibility__("default"))) int exportedvar;
extern __attribute__((__visibility__("hidden"))) int hiddenfunc (void);
extern __attribute__((__visibility__("default"))) int exportedfunc (void);
void dummyfunc (void) {}
int
main ()
@ -13081,10 +12791,10 @@ else
gl_cv_cc_visibility=no
fi
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
CFLAGS="$gl_save_CFLAGS"
CFLAGS="$gl_save_CFLAGS"
fi
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $gl_cv_cc_visibility" >&5
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $gl_cv_cc_visibility" >&5
$as_echo "$gl_cv_cc_visibility" >&6; }
if test $gl_cv_cc_visibility = yes; then
CFLAG_VISIBILITY="-fvisibility=hidden"
@ -13099,118 +12809,6 @@ cat >>confdefs.h <<_ACEOF
_ACEOF
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for ANSI C header files" >&5
$as_echo_n "checking for ANSI C header files... " >&6; }
if ${ac_cv_header_stdc+:} false; then :
$as_echo_n "(cached) " >&6
else
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h. */
#include <stdlib.h>
#include <stdarg.h>
#include <string.h>
#include <float.h>
int
main ()
{
;
return 0;
}
_ACEOF
if ac_fn_c_try_compile "$LINENO"; then :
ac_cv_header_stdc=yes
else
ac_cv_header_stdc=no
fi
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
if test $ac_cv_header_stdc = yes; then
# SunOS 4.x string.h does not declare mem*, contrary to ANSI.
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h. */
#include <string.h>
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
$EGREP "memchr" >/dev/null 2>&1; then :
else
ac_cv_header_stdc=no
fi
rm -f conftest*
fi
if test $ac_cv_header_stdc = yes; then
# ISC 2.0.2 stdlib.h does not declare free, contrary to ANSI.
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h. */
#include <stdlib.h>
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
$EGREP "free" >/dev/null 2>&1; then :
else
ac_cv_header_stdc=no
fi
rm -f conftest*
fi
if test $ac_cv_header_stdc = yes; then
# /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi.
if test "$cross_compiling" = yes; then :
:
else
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h. */
#include <ctype.h>
#include <stdlib.h>
#if ((' ' & 0x0FF) == 0x020)
# define ISLOWER(c) ('a' <= (c) && (c) <= 'z')
# define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c))
#else
# define ISLOWER(c) \
(('a' <= (c) && (c) <= 'i') \
|| ('j' <= (c) && (c) <= 'r') \
|| ('s' <= (c) && (c) <= 'z'))
# define TOUPPER(c) (ISLOWER(c) ? ((c) | 0x40) : (c))
#endif
#define XOR(e, f) (((e) && !(f)) || (!(e) && (f)))
int
main ()
{
int i;
for (i = 0; i < 256; i++)
if (XOR (islower (i), ISLOWER (i))
|| toupper (i) != TOUPPER (i))
return 2;
return 0;
}
_ACEOF
if ac_fn_c_try_run "$LINENO"; then :
else
ac_cv_header_stdc=no
fi
rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
conftest.$ac_objext conftest.beam conftest.$ac_ext
fi
fi
fi
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_header_stdc" >&5
$as_echo "$ac_cv_header_stdc" >&6; }
if test $ac_cv_header_stdc = yes; then
$as_echo "#define STDC_HEADERS 1" >>confdefs.h
fi
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether sys/types.h defines makedev" >&5
$as_echo_n "checking whether sys/types.h defines makedev... " >&6; }
if ${ac_cv_header_sys_types_h_makedev+:} false; then :
@ -13605,12 +13203,12 @@ else
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h. */
#include <time.h>
#if !HAVE_DECL_TZNAME
extern char *tzname[];
#endif
int
main ()
{
#if !HAVE_DECL_TZNAME
extern char *tzname[];
#endif
return tzname[0][0];
;
return 0;
@ -13685,12 +13283,12 @@ else
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h. */
#include <time.h>
#if !HAVE_DECL_DAYLIGHT
extern int daylight;
#endif
int
main ()
{
#if !HAVE_DECL_DAYLIGHT
extern int daylight;
#endif
atoi(daylight);
;
return 0;
@ -14692,7 +14290,7 @@ fi
fi
for ac_func in strndup mkstemp mkostemp utimes utime wcwidth strtof newlocale uselocale freelocale memmem
for ac_func in strndup mkstemp mkostemp utimes utime wcwidth strtof newlocale uselocale freelocale memmem pipe2
do :
as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
@ -15712,7 +15310,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
# report actual input values of CONFIG_FILES etc. instead of their
# values after options handling.
ac_log="
This file was extended by file $as_me 5.39, which was
This file was extended by file $as_me 5.41, which was
generated by GNU Autoconf 2.69. Invocation command line was
CONFIG_FILES = $CONFIG_FILES
@ -15778,7 +15376,7 @@ _ACEOF
cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
ac_cs_version="\\
file config.status 5.39
file config.status 5.41
configured by $0, generated by GNU Autoconf 2.69,
with options \\"\$ac_cs_config\\"

7
contrib/file/configure.ac

@ -1,5 +1,5 @@
dnl Process this file with autoconf to produce a configure script.
AC_INIT([file],[5.39],[christos@astron.com])
AC_INIT([file],[5.41],[christos@astron.com])
AM_INIT_AUTOMAKE([subdir-objects foreign])
m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
@ -88,7 +88,7 @@ AM_CONDITIONAL(FSECT5, test x$fsect = x5)
AC_SUBST(WARNINGS)
dnl Checks for programs.
AC_PROG_CC_STDC
AC_PROG_CC
AC_USE_SYSTEM_EXTENSIONS
AM_PROG_CC_C_O
AC_C_BIGENDIAN
@ -97,7 +97,6 @@ AC_PROG_LN_S
LT_INIT([disable-static pic-only])
gl_VISIBILITY
dnl Checks for headers
AC_HEADER_STDC
AC_HEADER_MAJOR
AC_HEADER_SYS_WAIT
AC_CHECK_HEADERS(stdint.h fcntl.h inttypes.h unistd.h)
@ -166,7 +165,7 @@ else
fi])
dnl Checks for functions
AC_CHECK_FUNCS(strndup mkstemp mkostemp utimes utime wcwidth strtof newlocale uselocale freelocale memmem)
AC_CHECK_FUNCS(strndup mkstemp mkostemp utimes utime wcwidth strtof newlocale uselocale freelocale memmem pipe2)
dnl Provide implementation of some required functions if necessary
AC_REPLACE_FUNCS(getopt_long asprintf vasprintf strlcpy strlcat getline ctime_r asctime_r localtime_r gmtime_r pread strcasestr fmtcheck dprintf)

3
contrib/file/doc/Makefile.in

@ -91,7 +91,8 @@ ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \
$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
$(top_srcdir)/acinclude.m4 $(top_srcdir)/configure.ac
$(top_srcdir)/m4/visibility.m4 $(top_srcdir)/acinclude.m4 \
$(top_srcdir)/configure.ac
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)

61
contrib/file/doc/file.man

@ -1,5 +1,5 @@
.\" $File: file.man,v 1.140 2020/06/07 17:41:07 christos Exp $
.Dd June 7, 2020
.\" $File: file.man,v 1.144 2021/02/05 22:08:31 christos Exp $
.Dd February 5, 2021
.Dt FILE __CSECTION__
.Os
.Sh NAME
@ -59,7 +59,7 @@ or non-printable).
Exceptions are well-known file formats (core files, tar archives)
that are known to contain binary data.
When modifying magic files or the program itself, make sure to
.Em "preserve these keywords" .
.Em preserve these keywords .
Users depend on knowing that all the readable files in a directory
have the word
.Dq text
@ -91,14 +91,14 @@ and possibly
.In exec.h
in the standard include directory.
These files have a
.Dq "magic number"
.Dq magic number
stored in a particular place
near the beginning of the file that tells the
.Tn UNIX
operating system
that the file is a binary executable, and which of several types thereof.
The concept of a
.Dq "magic"
.Dq magic number
has been applied by extension to data files.
Any file with some invariant identifier at a small fixed
offset into the file can usually be described in this way.
@ -168,7 +168,9 @@ in any of the character sets listed above is simply said to be
.Sh OPTIONS
.Bl -tag -width indent
.It Fl Fl apple
Causes the file command to output the file type and creator code as
Causes the
.Nm
command to output the file type and creator code as
used by older MacOS versions.
The code consists of eight letters,
the first describing the file type, the latter the creator.
@ -184,7 +186,7 @@ output file that contains a pre-parsed version of the magic file or directory.
Cause a checking printout of the parsed form of the magic file.
This is usually used in conjunction with the
.Fl m
flag to debug a new magic file before installing it.
option to debug a new magic file before installing it.
.It Fl d
Prints internal debugging information to stderr.
.It Fl E
@ -236,7 +238,7 @@ Like
but ignore tests that
.Nm
does not know about.
This is intended for compatilibity with older versions of
This is intended for compatibility with older versions of
.Nm .
.It Fl Fl extension
Print a slash-separated list of valid extensions for the file type found.
@ -270,13 +272,15 @@ the list of files, like:
instead of:
.Dq Fl f Ar namefile Fl F Ar @ .
.It Fl h , Fl Fl no-dereference
option causes symlinks not to be followed
This option causes symlinks not to be followed
(on systems that support symbolic links).
This is the default if the environment variable
.Dv POSIXLY_CORRECT
is not defined.
.It Fl i , Fl Fl mime
Causes the file command to output mime type strings rather than the more
Causes the
.Nm
command to output mime type strings rather than the more
traditional human readable ones.
Thus it may say
.Sq text/plain; charset=us-ascii
@ -306,7 +310,7 @@ which is used for the matching (see also the
.Fl k
option).
.It Fl L , Fl Fl dereference
option causes symlinks to be followed, as the like-named option in
This option causes symlinks to be followed, as the like-named option in
.Xr ls 1
(on systems that support symbolic links).
This is the default if the environment variable
@ -339,6 +343,7 @@ Set various parameter limits.
.It Li elf_notes Ta 256 Ta max ELF notes processed
.It Li elf_phnum Ta 2048 Ta max ELF program sections processed
.It Li elf_shnum Ta 32768 Ta max ELF sections processed
.It Li encoding Ta 65536 Ta max number of bytes to scan for encoding evaluation
.It Li indir Ta 50 Ta recursion limit for indirect magic
.It Li name Ta 50 Ta use count limit for name/use magic
.It Li regex Ta 8192 Ta length limit for regex searches
@ -373,11 +378,13 @@ On systems where libseccomp
.Pa ( https://github.com/seccomp/libseccomp )
is available, the
.Fl S
flag disables sandboxing which is enabled by default.
This option is needed for file to execute external decompressing programs,
option disables sandboxing which is enabled by default.
This option is needed for
.Nm
to execute external decompressing programs,
i.e. when the
.Fl z
flag is specified and the built-in decompressors are not available.
option is specified and the built-in decompressors are not available.
On systems where sandboxing is not available, this option has no effect.
.It Fl v , Fl Fl version
Print the version of the program and exit.
@ -456,9 +463,9 @@ The file type cannot be determined
.Sh EXAMPLES
.Bd -literal -offset indent
$ file file.c file /dev/{wd0a,hda}
file.c: C program text
file: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV),
dynamically linked (uses shared libs), stripped
file.c: C program text
file: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV),
dynamically linked (uses shared libs), stripped
/dev/wd0a: block special (0/0)
/dev/hda: block special (3/0)
@ -480,8 +487,8 @@ $ file -s /dev/hda{,1,2,3,4,5,6,7,8,9,10}
/dev/hda10: empty
$ file -i file.c file /dev/{wd0a,hda}
file.c: text/x-c
file: application/x-executable
file.c: text/x-c
file: application/x-executable
/dev/hda: application/x-not-regular-file
/dev/wd0a: application/x-not-regular-file
@ -507,7 +514,7 @@ is that this version treats any white space
as a delimiter, so that spaces in pattern strings must be escaped.
For example,
.Bd -literal -offset indent
\*[Gt]10 string language impress\ (imPRESS data)
\*[Gt]10 string language impress\ (imPRESS data)
.Ed
.Pp
in an existing magic file would have to be changed to
@ -554,7 +561,7 @@ option.
To enable execution of external decompressors, one needs to disable
sandboxing using the
.Fl S
flag.
option.
.Sh MAGIC DIRECTORY
The magic file entries have been collected from various sources,
mainly USENET, and contributed by various authors.
@ -666,7 +673,7 @@ and printing \e012- between entries is clumsy and complicated; refactor
and centralize.
.Pp
Some of the encoding logic is hard-coded in encoding.c and can be moved
to the magic files if we had a !:charset annotation
to the magic files if we had a !:charset annotation.
.Pp
Continue to squash all magic bugs.
See Debian BTS for a good source.
@ -719,9 +726,13 @@ If the offsets specified internally in the file exceed the buffer size
.Dv HOWMANY
variable in file.h), then we don't seek to that offset, but we give up.
It would be better if buffer managements was done when the file descriptor
is available so move around the file.
One must be careful though because this has performance (and thus security
considerations).
is available so we can seek around the file.
One must be careful though because this has performance and thus security
considerations, because one can slow down things by repeateadly seeking.
.Pp
There is support now for keeping separate buffers and having offsets from
the end of the file, but the internal buffer management still needs an
overhaul.
.Sh AVAILABILITY
You can obtain the original author's latest version by anonymous FTP
on

9
contrib/file/doc/magic.man

@ -1,5 +1,5 @@
.\" $File: magic.man,v 1.98 2020/05/09 18:55:23 christos Exp $
.Dd May 9, 2020
.\" $File: magic.man,v 1.99 2021/05/09 22:37:23 christos Exp $
.Dd May 9, 2021
.Dt MAGIC __FSECTION__
.Os
.\" install as magic.4 on USG, magic.5 on V7, Berkeley and Linux systems.
@ -69,7 +69,7 @@ A 64-bit double precision IEEE floating point number in this machine's native by
.It Dv string
A string of bytes.
The string type specification can be optionally followed
by /[WwcCtbT]*.
by /[WwcCtbTf]*.
The
.Dq W
flag compacts whitespace in the target, which must
@ -83,6 +83,9 @@ The
.Dq w
flag treats every blank in the magic as an optional blank.
The
.Dq f
flags requires that the matched string is a full word, not a partial word match.
The
.Dq c
flag specifies case insensitive matching: lower case
characters in the magic match both lower and upper case characters in the

0
contrib/file/ltmain.sh Executable file → Normal file

77
contrib/file/m4/visibility.m4 Normal file

@ -0,0 +1,77 @@
# visibility.m4 serial 4 (gettext-0.18.2)
dnl Copyright (C) 2005, 2008, 2010-2012 Free Software Foundation, Inc.
dnl This file is free software; the Free Software Foundation
dnl gives unlimited permission to copy and/or distribute it,
dnl with or without modifications, as long as this notice is preserved.
dnl From Bruno Haible.
dnl Tests whether the compiler supports the command-line option
dnl -fvisibility=hidden and the function and variable attributes
dnl __attribute__((__visibility__("hidden"))) and
dnl __attribute__((__visibility__("default"))).
dnl Does *not* test for __visibility__("protected") - which has tricky
dnl semantics (see the 'vismain' test in glibc) and does not exist e.g. on
dnl MacOS X.
dnl Does *not* test for __visibility__("internal") - which has processor
dnl dependent semantics.
dnl Does *not* test for #pragma GCC visibility push(hidden) - which is
dnl "really only recommended for legacy code".
dnl Set the variable CFLAG_VISIBILITY.
dnl Defines and sets the variable HAVE_VISIBILITY.
AC_DEFUN([gl_VISIBILITY],
[
AC_REQUIRE([AC_PROG_CC])
CFLAG_VISIBILITY=
HAVE_VISIBILITY=0
if test -n "$GCC"; then
dnl First, check whether -Werror can be added to the command line, or
dnl whether it leads to an error because of some other option that the
dnl user has put into $CC $CFLAGS $CPPFLAGS.
AC_MSG_CHECKING([whether the -Werror option is usable])
AC_CACHE_VAL([gl_cv_cc_vis_werror], [
gl_save_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS -Werror"
AC_COMPILE_IFELSE(
[AC_LANG_PROGRAM([[]], [[]])],
[gl_cv_cc_vis_werror=yes],
[gl_cv_cc_vis_werror=no])
CFLAGS="$gl_save_CFLAGS"])
AC_MSG_RESULT([$gl_cv_cc_vis_werror])
dnl Now check whether visibility declarations are supported.
AC_MSG_CHECKING([for simple visibility declarations])
AC_CACHE_VAL([gl_cv_cc_visibility], [
gl_save_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS -fvisibility=hidden"
dnl We use the option -Werror and a function dummyfunc, because on some
dnl platforms (Cygwin 1.7) the use of -fvisibility triggers a warning
dnl "visibility attribute not supported in this configuration; ignored"
dnl at the first function definition in every compilation unit, and we
dnl don't want to use the option in this case.
if test $gl_cv_cc_vis_werror = yes; then
CFLAGS="$CFLAGS -Werror"
fi
AC_COMPILE_IFELSE(
[AC_LANG_PROGRAM(
[[extern __attribute__((__visibility__("hidden"))) int hiddenvar;
extern __attribute__((__visibility__("default"))) int exportedvar;
extern __attribute__((__visibility__("hidden"))) int hiddenfunc (void);
extern __attribute__((__visibility__("default"))) int exportedfunc (void);
void dummyfunc (void) {}
]],
[[]])],
[gl_cv_cc_visibility=yes],
[gl_cv_cc_visibility=no])
CFLAGS="$gl_save_CFLAGS"])
AC_MSG_RESULT([$gl_cv_cc_visibility])
if test $gl_cv_cc_visibility = yes; then
CFLAG_VISIBILITY="-fvisibility=hidden"
HAVE_VISIBILITY=1
fi
fi
AC_SUBST([CFLAG_VISIBILITY])
AC_SUBST([HAVE_VISIBILITY])
AC_DEFINE_UNQUOTED([HAVE_VISIBILITY], [$HAVE_VISIBILITY],
[Define to 1 or 0, depending whether the compiler supports simple visibility declarations.])
])

10
contrib/file/magic/Magdir/acorn

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: acorn,v 1.7 2019/04/19 00:42:27 christos Exp $
# $File: acorn,v 1.8 2021/04/26 15:56:00 christos Exp $
# acorn: file(1) magic for files found on Acorn systems
#
@ -90,13 +90,13 @@
# null terminated root directory object like IDEFS::IDE-4.$.Apps.GRAPHICS.!XFMPdemo
>>>9 string x \b, root "%s"
# load address 0xFFFtttdd, ttt is the object filetype and dddddddddd is time
>>>>&1 ulelong x \b, load address 0x%x
>>>>&1 ulelong x \b, load address %#x
# execution address 0xdddddddd dddddddddd is 40 bit unsigned centiseconds since 1.1.1900 UTC
>>>>&5 ulelong x \b, exec address 0x%x
>>>>&5 ulelong x \b, exec address %#x
# attributes (bits: 0~owner read,1~owner write,3~no delete,4~public read,5~public write)
>>>>&9 ulelong x \b, attributes 0x%x
>>>>&9 ulelong x \b, attributes %#x
# number of entries in this directory. for root dir 0
#>>>&13 ulelong x \b, entries 0x%x
#>>>&13 ulelong x \b, entries %#x
# the entries start here with object name
>>>>&17 string x \b, 1st object "%s"

29
contrib/file/magic/Magdir/aes Normal file

@ -0,0 +1,29 @@
#------------------------------------------------------------------------------
# $File: aes,v 1.1 2020/08/18 21:20:22 christos Exp $
#
# aes: magic file for AES encrypted files
# Summary: AES Crypt Encrypted Data File
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Advanced_Encryption_Standard
# Reference: https://www.aescrypt.com/aes_file_format.html
0 string AES
>3 ubyte <3 AES encrypted data, version %u
#!:mime application/aes
!:mime application/x-aes-encrypted
!:ext aes
# For Version 2 the encrypted file can have text tags
>>3 ubyte =2
# length of an extension identifier and contents like: 0 24 33 38
#>>5 ubeshort x \b, tag length %u
#>>5 pstring/H x '%s'
# standard extension tags like CREATED_BY
>>>7 string CREATED_BY \b, created by
# software product, manufacturer like "SharpAESCrypt v1.3.3.0" "aescrypt (Windows GUI) 3.10" ...
>>>>&1 string x "%s"
# TODO: more other tags
# tag CREATED_DATE like YYYY-MM-DD
# tag CREATED_TIME like HH:MM:SS
#

42
contrib/file/magic/Magdir/algol68

@ -1,19 +1,41 @@
#------------------------------------------------------------------------------
# $File: algol68,v 1.3 2018/10/19 01:04:21 christos Exp $
# $File: algol68,v 1.4 2021/08/15 06:00:55 christos Exp $
# algol68: file(1) magic for Algol 68 source
#
0 search/8192 (input, Algol 68 source text
!:mime text/x-Algol68
0 regex/1024 \^PROC Algol 68 source text
!:mime text/x-Algol68
0 regex/1024 \bMODE[\t\ ] Algol 68 source text
!:mime text/x-Algol68
0 regex/1024 \bREF[\t\ ] Algol 68 source text
!:mime text/x-Algol68
0 regex/1024 \bFLEX[\t\ ]\*\\[ Algol 68 source text
# URL: https://en.wikipedia.org/wiki/ALGOL_68
# Reference: http://www.softwarepreservation.org/projects/ALGOL/report/Algol68_revised_report-AB.pdf
# Update: Joerg Jenderek
0 search/8192 (input,
>0 use algol_68
# graph_2d.a68
0 regex/4006 \^PROC
#>&-4 string x \b, dBase or Algol "%s"
# most xBase scripts *.prg with PROCEDURE like: Areacode BarCount Def_mens Vendors
#>&-4 string =PROCEDURE \b, dBase PROCEDURE
# skip xBase program scripts *.prg with PROCEDURE keyword
# keyword proc probably followed by white space used to specify algol procedures
>&-4 string !PROCEDURE
>>0 use algol_68
0 regex/1024 \bMODE[\t\ ]
>0 use algol_68
0 regex/1024 \bMODE[\t\ ]
>0 use algol_68
0 regex/1024 \bREF[\t\ ]
>0 use algol_68
0 regex/1024 \bFLEX[\t\ ]\*\\[
>0 use algol_68
# display information like mime type and file name extension of Algol 68 source text
0 name algol_68 Algol 68 source text
!:mime text/x-Algol68
# https://file-extension.net/seeker/file_extension_a68
!:ext a68
#!:ext a68/alg
#0 regex [\t\ ]OD Algol 68 source text
#>0 use algol_68
#!:mime text/x-Algol68
#0 regex [\t\ ]FI Algol 68 source text
#>0 use algol_68
#!:mime text/x-Algol68

147
contrib/file/magic/Magdir/amigaos

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: amigaos,v 1.17 2018/10/16 18:57:19 christos Exp $
# $File: amigaos,v 1.20 2021/09/20 00:42:19 christos Exp $
# amigaos: file(1) magic for AmigaOS binary formats:
#
@ -40,7 +40,62 @@
#26 string V.2 Brian Postma's Soundmon Module sound file v2
# The following are from: "Stefan A. Haubenthal" <polluks@web.de>
0 beshort 0x0f00 AmigaOS bitmap font
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/Amiga_bitmap_font
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/font-amiga.trid.xml
# https://wiki.amigaos.net/wiki/Graphics_Library_and_Text
# fch_FileID=FCH_ID=0x0f00
0 beshort 0x0f00
# skip some AVM powerline firmware images by check for positive number of font elements
# https://download.avm.de/fritzpowerline/fritzpowerline-1000e-t/other/fritz.os/fritz.powerline_1000ET_01_05.image
>2 ubeshort >0 AmigaOS bitmap font
#!:mime application/octet-stream
!:mime font/x-amiga-font
!:ext font
# struct FontContents fch_FC; 1st fc_FileName [MAXFONTPATH=256]; ~ filename "/" fc_YSize
# like: topazb/6 suits/8 Excel/9e emerald/17 Franklin/23 DIAMONDS/60.8C
>>4 string x "%.256s"
# fc_YSize ~number after slash in fc_FileName; like: 6 7 8 9 11 12 16 17 21 23 45 60
>>260 beshort x \b, fc_YSize %u
# fch_NumEntries; number of FontContents elements like:
# 1 (often) 2 3 (IconCondensed.font tempfont.font) 4 (Franklin.font) 6 (mcoop.font)
>>2 ubeshort >1 \b, %u elements
#>>2 beshort x \b, %u element
# plural s
#>>2 beshort !1 \bs
# like: 6 7 8 9 11 12 16 17 21 23 45 60
#>>262 beshort x \b, FLAGS_STYLE
>>2 beshort >1 \b, 2nd
# 2nd fc_FileName like: Franklin/36
>>>264 string x "%.256s"
>>2 beshort >2 \b, 3rd
# 3rd fc_FileName like: Franklin/18
>>>524 string x "%.256s"
# URL: http://fileformats.archiveteam.org/wiki/Amiga_bitmap_font
# Reference: https://wiki.amigaos.net/wiki/Graphics_Library_and_Text
# http://mark0.net/download/triddefs_xml.7z/defs/f/font-amiga-var2.trid.xml
# Note: called by TrID "Amiga bitmap Font (var.2)"
# fch_FileID=TFCH_ID=0x0f02
0 beshort 0x0f02
# skip possible misidentified foo by check for positive number of font elements
>2 ubeshort >0 AmigaOS bitmap font (TFCH)
#!:mime application/octet-stream
!:mime font/x-amiga-font
!:ext font
# struct TFontContents fch_TFC[]; 1st tfc_FileName [254]; ~ filename "/" fc_YSize
# like: Abbey/45 XScript/75 XTriumvirate/45
>>4 string x "%.254s"
# tfc_TagCount; including the TAG_END tag like: 4
>>258 ubeshort x \b, tfc_TagCount %u
# tfc_YSize ~number after slash in tfc_FileName; like: 45 75
>>260 beshort x \b, tfc_YSize %u
# tfc_Style; tfc_Flags like: 8022h 8222h
#>>262 ubeshort x \b, FLAGS_STYLE %#x
# fch_NumEntries; number of FontContents elements like: 1 (abbey.font) 2 (xscript.font xtriumvirate.font)
>>2 ubeshort >1 \b, %u elements
>>2 beshort >1 \b, 2nd
# 2nd tfc_FileName like: XScript/45 XTriumvirate/30
>>>264 string x "%.254s"
0 beshort 0x0f03 AmigaOS outline font
0 belong 0x80001001 AmigaOS outline tag
0 string ##\ version catalog translation
@ -49,15 +104,91 @@
0 string/c @database AmigaGuide file
# Amiga disk types
# display information like volume name of root block on Amiga (floppy) disk
0 name adf-rootblock
# block primary type = T_HEADER (value 2)
>0x000 ubelong !2 \b, type %u
# header_key; unused in rootblock (value 0)
>0x004 ubelong !0 \b, header_key %u
# high_seq; unused (value 0)
>0x008 ubelong !0 \b, high_seq %u
# ht_size; hash table size; 0x48 for flopies
>0x00c ubelong !0x48 \b, hash table size %#x
# bm_flag; bitmap flag, -1 means VALID
>0x138 belong !-1 \b, bitmap flag %#x
# bm_ext; first bitmap extension block (Hard disks only)
>0x1A0 ubelong !0 \b, bitmap extension block %#x
# name_len; volume name length; diskname[30]; volume name
>0x1B0 pstring >\0 \b, "%s"
# first directory cache block for FFS; otherwise 0
>0x1F8 ubelong !0 \b, directory cache block %#x
# block secondary type = ST_ROOT (value 1)
>0x1FC ubelong !1 \b, sec_type %#x
#
0 string RDSK Rigid Disk Block
>160 string x on %.24s
0 string DOS\0 Amiga DOS disk
0 string DOS\1 Amiga FFS disk
0 string DOS\2 Amiga Inter DOS disk
0 string DOS\3 Amiga Inter FFS disk
0 string DOS\4 Amiga Fastdir DOS disk
0 string DOS\5 Amiga Fastdir FFS disk
# URL: http://fileformats.archiveteam.org/wiki/ADF_(Amiga)
# https://en.wikipedia.org/wiki/Amiga_Fast_File_System
# Reference: http://lclevy.free.fr/adflib/adf_info.html
# Update: Joerg Jenderek
# Note: created by ADFOpus.exe
# and verified by `unadf -l TURBO_SILVER_SV.ADF`
0 string DOS
# skip DOS Client Message Files like IPXODI.MSG DOSRQSTR.MSG
>3 ubyte <8 Amiga
# https://reposcope.com/mimetype/application/x-amiga-disk-format
!:mime application/x-amiga-disk-format
!:ext adf
>>3 ubyte 0 DOS disk
>>3 ubyte 1 FFS disk
>>3 ubyte 2 Inter DOS disk
>>3 ubyte 3 Inter FFS disk
# For Fastdir mode the international mode is also enabled,
>>3 ubyte 4 Fastdir DOS disk
>>3 ubyte 5 Fastdir FFS dis
# called by TrID "Amiga Disk image File (OFS+INTL+DIRC)"
>>3 ubyte 6 Inter Fastdir DOS disk
# called by TrID "Amiga Disk image File (FFS+INTL+DIRC)"
>>3 ubyte 7 Inter Fastdir FFS disk
# but according to Wikipedia variants with long name support
#>>3 ubyte 6 long name DOS disk
#>>3 ubyte 7 long name FFS disk
# DOES NOT only work! Partly for file size ~< FILE_BYTES_MAX=1 MiB defined in ../../src/file.h
#>>-0 offset x \b, %lld bytes
# Correct file size, but next lines are NOT executed
#>>-0 offset 901120 (DD 880 KiB floppy)
# 880 KiB Double Density floppy disk by characteristic hash table size 0x48 and T_HEADER=2
>>0x6E00C ubelong 0x48
>>>0x6E000 ubelong 2 (DD 880 KiB)
# 1760 KiB High Density floppy disk (1802240 bytes) by characteristic hash table size 0x48
>>0xDC00C ubelong 0x48
>>>0xDC000 ubelong 2 (HD 1760 KiB)
# Chksum; special block checksum like: 0 0x44ccf4c0 0x51f32cac 0xe33d0e7d ...
#>>4 ubelong x \b, CRC %#x
# Rootblock: 0 880 (often for DD and HD) 1146049280 (IMAGINE_1_0_DISK_01.ADF TURBO_SILVER_SV.ADF)
>>8 ubelong >0 \b, probably root block %d
# bootblock code
>>12 quad !0 \b, bootable
# assembler instructions: lea exp(pc),a1; moveq 25h,d0; jsr -552(a6)
>>>12 ubequad =0x43fa003e70254eae AmigaDOS 3.0
>>>12 default x
>>>>12 ubequad !0x43fa003e70254eae %#llx..
# 880 KiB Double Density floppy disk (901120 bytes)
>>0x6E00C ubelong 0x48
>>>0x6E000 ubelong 2
>>>>0x6E000 use adf-rootblock
# 1760 KiB High Density floppy disk (1802240 bytes)
>>0xDC00C ubelong 0x48
>>>0xDC000 ubelong 2
>>>>0xDC000 use adf-rootblock
# 1 MiB hard disc by test for T_HEADER=2 and header_key=0=high_seq
>>0x80000 ubelong 2
>>>0x80004 quad 0
>>>>0x80000 use adf-rootblock
# 2 MiB hard disc; only works if in ../../src/file.h FILE_BYTES_MAX is raised to 2 MiB
#>>0x100000 ubelong x 2 MiB TEST
#>>0x100000 ubelong 2 \b, 2 MiB hard disc rootblock
#>>>0x100000 use adf-rootblock
0 string KICK Kickstart disk
# From: Alex Beregszaszi <alex@fsn.hu>

33
contrib/file/magic/Magdir/android

@ -1,6 +1,6 @@
#------------------------------------------------------------
# $File: android,v 1.16 2019/11/15 21:03:14 christos Exp $
# $File: android,v 1.19 2021/04/26 15:56:00 christos Exp $
# Various android related magic entries
#------------------------------------------------------------
@ -24,11 +24,11 @@
>>1028 lelong 0 \b (boot)
>>1028 lelong 1 \b (recovery)
>8 lelong >0 \b, kernel
>>12 lelong >0 \b (0x%x)
>>12 lelong >0 \b (%#x)
>16 lelong >0 \b, ramdisk
>>20 lelong >0 \b (0x%x)
>>20 lelong >0 \b (%#x)
>24 lelong >0 \b, second stage
>>28 lelong >0 \b (0x%x)
>>28 lelong >0 \b (%#x)
>36 lelong >0 \b, page size: %d
>38 string >0 \b, name: %s
>64 string >0 \b, cmdline (%s)
@ -64,7 +64,7 @@
# look for backup content after line with encryption info
#>>19 search/7 \n
# data part after header for not encrypted Android Backup
#>>>&0 ubequad x \b, content 0x%16.16llx...
#>>>&0 ubequad x \b, content %#16.16llx...
# look for zlib compressed by ./compress after message with 1 space at end
#>>>&0 indirect x \b; contains
# look for tar archive block by ./archive for package name manifest
@ -155,9 +155,9 @@
# flags
>>>0x0C ulelong&0x00000002 2 \b+RW
# partition ID:
# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~KENREl,RECOVER,misc;7~RECOVER
# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~kernel,RECOVER,misc;7~RECOVER
# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW
>>>0x08 ulelong x (0x%x)
>>>0x08 ulelong x (%#x)
# filename
>>>0x44 string >\0 "%-.64s"
#>>>0x18 ulelong >0
@ -188,3 +188,22 @@
0 lelong 0xd0b5b1c4 Android cryptfs footer
>4 leshort x \b, version: %d
>6 leshort x \b.%d
# Android Vdex format
# From https://android.googlesource.com/\
# platform/art/+/master/runtime/vdex_file.h
0 string vdex Android vdex file,
>4 string >000 verifier deps version: %s,
>8 string >000 dex section version: %s,
>12 lelong >0 number of dex files: %d,
>16 lelong >0 verifier deps size: %d
# Android Vdex format, dexfile is currently being updated
# by android system
# From https://android.googlesource.com/\
# platform/art/+/master/dex2oat/dex2oat.cc
0 string wdex Android vdex file, being processed by dex2oat,
>4 string >000 verifier deps version: %s,
>8 string >000 dex section version: %s,
>12 lelong >0 number of dex files: %d,
>16 lelong >0 verifier deps size: %d

163
contrib/file/magic/Magdir/animation

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: animation,v 1.77 2020/04/26 15:23:43 christos Exp $
# $File: animation,v 1.87 2021/08/24 09:25:11 christos Exp $
# animation: file(1) magic for animation/movie formats
#
# animation formats
@ -32,7 +32,10 @@
!:mime application/x-quicktime-player
4 string/W jP JPEG 2000 image
!:mime image/jp2
#### MP4 ####
# https://www.ftyps.com/ with local additions
# https://cconcolato.github.io/mp4ra/filetype.html
4 string ftyp ISO Media
# https://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/
>8 string XAVC \b, MPEG v4 system, Sony XAVC Codec
@ -53,11 +56,21 @@
>>11 byte 0x63 \b C.S0050-0-B V1.0
>8 string 3ge \b, MPEG v4 system, 3GPP
!:mime video/3gpp
>>11 byte 6 \b, Release 6 MBMS Extended Presentations
>>11 byte 7 \b, Release 7 MBMS Extended Presentations
>>11 byte 6 \b, Release %d MBMS Extended Presentations
>>11 byte 7 \b, Release %d MBMS Extended Presentations
>>11 byte 9 \b, Release %d MBMS Extended Presentations
>8 string 3gf \b, MPEG v4 system, 3GPP
>>11 byte 9 \b, Release %d File-delivery profile
>8 string 3gg \b, MPEG v4 system, 3GPP
!:mime video/3gpp
>>11 byte 6 \b, Release 6 General Profile
>>11 byte 6 \b, Release %d General Profile
>>11 byte 9 \b, Release %d General Profile
>8 string 3gh \b, MPEG v4 system, 3GPP
!:mime video/3gpp
>>11 byte 9 \b, Release %d Adaptive Streaming Profile
>8 string 3gm \b, MPEG v4 system, 3GPP
!:mime video/3gpp
>>11 byte 9 \b, Release %d Media Segment Profile
>8 string 3gp \b, MPEG v4 system, 3GPP
!:mime video/3gpp
>>11 byte 1 \b, Release %d (non existent)
@ -67,16 +80,49 @@
>>11 byte 5 \b, Release %d
>>11 byte 6 \b, Release %d
>>11 byte 7 \b, Release %d Streaming Servers
>8 string 3gr \b, MPEG v4 system, 3GPP
!:mime video/3gpp
>>11 byte 6 \b, Release %d Progressive Download Profile
>>11 byte 9 \b, Release %d Progressive Download Profile
>8 string 3gs \b, MPEG v4 system, 3GPP
!:mime video/3gpp
>>11 byte 6 \b, Release %d Streaming Servers
>>11 byte 7 \b, Release %d Streaming Servers
>>11 byte 9 \b, Release %d Streaming Servers
>8 string 3gt \b, MPEG v4 system, 3GPP
!:mime video/3gpp
>>11 byte 8 \b, Release %d Media Stream Recording Profile
>>11 byte 9 \b, Release %d Media Stream Recording Profile
>8 string ARRI \b, MPEG v4 system, ARRI Digital Camera
!:mime video/mp4
>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC [ISO 14496-12:2005]
!:mime video/mp4
>8 string bbxm \b, Blinkbox Master File: H.264 video/16-bit LE LPCM audio
!:mime video/mp4
>8 string/W qt \b, Apple QuickTime movie
!:mime video/quicktime
>8 string CAEP \b, Canon Digital Camera
>8 string caqv \b, Casio Digital Camera
>8 string CDes \b, Convergent Design
>8 string caaa \b, CMAF Media Profile - AAC Adaptive Audio
>8 string caac \b, CMAF Media Profile - AAC Core
>8 string caqv \b, Casio Digital Camera Casio
>8 string ccea \b, CMAF Supplemental Data - CEA-608/708
>8 string ccff \b, Common container file format
>8 string cfhd \b, CMAF Media Profile - AVC HD
>8 string cfsd \b, CMAF Media Profile - AVC SD
>8 string chd1 \b, CMAF Media Profile - HEVC HDR10
>8 string chdf \b, CMAF Media Profile - AVC HDHF
>8 string chhd \b, CMAF Media Profile - HEVC HHD8
>8 string chh1 \b, CMAF Media Profile - HEVC HHD10
>8 string clg1 \b, CMAF Media Profile - HEVC HLG10
>8 string cmfc \b, CMAF Track Format
>8 string cmff \b, CMAF Fragment Format
>8 string cmfl \b, CMAF Chunk Format
>8 string cmfs \b, CMAF Segment Format
>8 string cud1 \b, CMAF Media Profile - HEVC UHD10
>8 string cud8 \b, CMAF Media Profile - HEVC UHD8
>8 string cwvt \b, CMAF Media Profile - WebVTT
>8 string da0a \b, DMB MAF w/ MPEG Layer II aud, MOT slides, DLS, JPG/PNG/MNG
>8 string da0b \b, DMB MAF, ext DA0A, with 3GPP timed text, DID, TVA, REL, IPMP
>8 string da1a \b, DMB MAF audio with ER-BSAC audio, JPG/PNG/MNG images
@ -87,6 +133,12 @@
>8 string da3b \b, DMB MAF, ext da3a w/ BIFS, 3GPP, DID, TVA, REL, IPMP
>8 string dash \b, MPEG v4 system, Dynamic Adaptive Streaming over HTTP
!:mime video/mp4
>8 string dby1 \b, MP4 files with Dolby content
>8 string dsms \b, Media Segment DASH conformant
>8 string dts1 \b, MP4 track file with audio codecs dtsc dtsh or dtse
>8 string dts2 \b, MP4 track file with audio codec dtsx
>8 string dts3 \b, MP4 track file with audio codec dtsy
>8 string dxo$20 \b, DxO ONE camera
>8 string dmb1 \b, DMB MAF supporting all the components defined in the spec
>8 string dmpf \b, Digital Media Project
>8 string drc1 \b, Dirac (wavelet compression), encap in ISO base media (MP4)
@ -99,6 +151,7 @@
>8 string dvr1 \b, DVB (.DVB) over RTP
!:mime video/vnd.dvb.file
>8 string dvt1 \b, DVB (.DVB) over MPEG-2 Transport Stream
>8 string emsg \b, Event message box present
!:mime video/vnd.dvb.file
>8 string F4V \b, Video for Adobe Flash Player 9+ (.F4V)
!:mime video/mp4
@ -108,12 +161,22 @@
!:mime audio/mp4
>8 string F4B \b, Audio Book for Adobe Flash Player 9+ (.F4B)
!:mime audio/mp4
>8 string ifrm \b, Apple iFrame Specification, Version 8.1 Jan 2013
>8 string im1i \b, CMAF Media Profile - IMSC1 Image
>8 string im1t \b, CMAF Media Profile - IMSC1 Text
>8 string isc2 \b, ISMACryp 2.0 Encrypted File
# ?/enc-isoff-generic
>8 string iso2 \b, MP4 Base Media v2 [ISO 14496-12:2005]
>8 string iso \b, MP4 Base Media
!:mime video/mp4
>8 string isom \b, MP4 Base Media v1 [IS0 14496-12:2003]
>>11 string m v1 [ISO 14496-12:2003]
>>11 string 2 v2 [ISO 14496-12:2005]
>>11 string 4 v4
>>11 string 5 v5
>>11 string 6 v6
>8 string isml \b, MP4 Base Media v2 [ISO 14496-12:2005]
!:mime video/mp4
>8 string J2P0 \b, JPEG2000 Profile 0
>8 string J2P1 \b, JPEG2000 Profile 1
>8 string/W jp2 \b, JPEG 2000
!:mime image/jp2
>8 string JP2 \b, JPEG 2000 Image (.JP2) [ISO 15444-1 ?]
@ -121,10 +184,13 @@
>8 string JP20 \b, Unknown, from GPAC samples (prob non-existent)
>8 string jpm \b, JPEG 2000 Compound Image (.JPM) [ISO 15444-6]
!:mime image/jpm
>8 string jpsi \b, The JPSearch data interchange format
>8 string jpx \b, JPEG 2000 w/ extensions (.JPX) [ISO 15444-2]
!:mime image/jpx
>8 string KDDI \b, 3GPP2 EZmovie for KDDI 3G cellphones
!:mime video/3gpp2
>8 string LCAG \b, Leica digital camera
>8 string lmsg \b, Last Media Segment indicator for ISO base media file format.
>8 string M4A \b, Apple iTunes ALAC/AAC-LC (.M4A) Audio
!:mime audio/x-m4a
>8 string M4B \b, Apple iTunes ALAC/AAC-LC (.M4B) Audio Book
@ -140,6 +206,8 @@
>8 string mj2s \b, Motion JPEG 2000 [ISO 15444-3] Simple Profile
!:mime video/mj2
>8 string mjp2 \b, Motion JPEG 2000 [ISO 15444-3] General Profile
>8 string MFSM \b, Media File for Samsung video Metadata
>8 string MGSV \b, Sony Home and Mobile Multimedia Platform (HMMP)
!:mime video/mj2
>8 string mmp4 \b, MPEG-4/3GPP Mobile Profile (.MP4 / .3GP) (for NTT)
!:mime video/mp4
@ -153,13 +221,16 @@
>8 string mp71 \b, MP4 w/ MPEG-7 Metadata [per ISO 14496-12]
>8 string mp7t \b, MPEG v4 system, MPEG v7 XML
>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML
>8 string mpuf \b, Compliance with the MMT Processing Unit format
>8 string msdh \b, Media Segment conforming to ISO base media file format.
>8 string msix \b, Media Segment conforming to ISO base media file format.
>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile
!:mime video/mp4
>8 string MPPI \b, Photo Player, MAF [ISO/IEC 23000-3]
>8 string mqt \b, Sony / Mobile QuickTime (.MQV) US Pat 7,477,830
!:mime video/quicktime
>8 string MSNV \b, MPEG-4 (.MP4) for SonyPSP
!:mime video/mp4
!:mime audio/mp4
>8 string NDAS \b, MP4 v2 [ISO 14496-14] Nero Digital AAC Audio
!:mime audio/mp4
>8 string NDSC \b, MPEG-4 (.MP4) Nero Cinema Profile
@ -181,11 +252,14 @@
>8 string NDXP \b, H.264/MPEG-4 AVC (.MP4) Nero Portable Profile
!:mime video/mp4
>8 string NDXS \b, H.264/MPEG-4 AVC (.MP4) Nero Standard Profile
>8 string niko \b, Nikon Digital Camera
!:mime video/mp4
>8 string odcf \b, OMA DCF DRM Format 2.0 (OMA-TS-DRM-DCF-V2_0-20060303-A)
>8 string opf2 \b, OMA PDCF DRM Format 2.1 (OMA-TS-DRM-DCF-V2_1-20070724-C)
>8 string opx2 \b, OMA PDCF DRM + XBS ext (OMA-TS-DRM_XBS-V1_0-20070529-C)
>8 string pana \b, Panasonic Digital Camera
>8 string piff \b, Protected Interoperable File Format
>8 string pnvi ]b, Panasonic Video Intercom
>8 string qt \b, Apple QuickTime (.MOV/QT)
!:mime video/quicktime
# HEIF image format
@ -217,11 +291,24 @@
!:mime image/heif-sequence
>8 string avcs \b, HEIF Image Sequence AVC
!:mime image/heif-sequence
# AVIF image format
# see https://aomediacodec.github.io/av1-avif/
>8 string avif \b, AVIF Image
!:mime image/avif
>8 string avis \b, AVIF Image Sequence
!:mime image/avif
>8 string risx \b, Representation Index Segment for MPEG-2 TS Segments
>8 string ROSS \b, Ross Video
>8 string sdv \b, SD Memory Card Video
>8 string ssc1 \b, Samsung stereo, single stream (patent pending)
>8 string ssc2 \b, Samsung stereo, dual stream (patent pending)
>8 string SEAU \b, Sony Home and Mobile Multimedia Platform (HMMP)
>8 string SEBK \b, Sony Home and Mobile Multimedia Platform (HMMP)
>8 string senv \b, Video contents Sony Entertainment Network
>8 string sims \b, Media Segment for Sub-Indexed Media Segment format
>8 string sisx \b, Single Index Segment forindex MPEG-2 TS
>8 string ssss \b, Subsegment Index Segment used to index MPEG-2 Segments
>8 string uvvu \b, UltraViolet file brand for DECE Common Format
# MPEG sequences
# Scans for all common MPEG header start codes
@ -234,6 +321,9 @@
0 belong&0xFFFFFF00 0x00000100
>3 byte 0xBA MPEG sequence
!:mime video/mpeg
# http://fileformats.archiveteam.org/wiki/Enhanced_VOB
# https://reposcope.com/mimetype/video/mpeg
!:ext vob/evo/mpg/mpeg
>>4 byte &0x40 \b, v2, program multiplex
>>4 byte ^0x40 \b, v1, system multiplex
>3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header)
@ -877,21 +967,6 @@
# ABC (alembic.io 3d models)
0 string 0gawa ABC 3d model
# VRML (Virtual Reality Modelling Language)
0 string/w #VRML\ V1.0\ ascii VRML 1 file
!:mime model/vrml
0 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file
!:mime model/vrml
# X3D (Extensible 3D) [https://www.web3d.org/specifications/x3d-3.0.dtd]
# From Michel Briand <michelbriand@free.fr>
# mimetype from https://www.iana.org/assignments/media-types/model/x3d+xml
# Example https://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d
0 string/w \<?xml\ version=
!:strength + 5
>20 search/1000/w \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text
!:mime model/x3d+xml
#---------------------------------------------------------------------------
# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03
@ -905,12 +980,22 @@
>0x42 ubeshort 0 no audio
>0x42 ubeshort >0 %dHz audio
# From: "Stefan A. Haubenthal" <polluks@web.de>
# From: Stefan A. Haubenthal <polluks@sdf.lonestar.org>
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/VOB
0 string DVDVIDEO-VTS Video title set,
!:mime video/x-ifo
!:ext ifo/bup
>0x21 byte x v%x
0 string DVDVIDEO-VMG Video manager,
!:mime video/x-ifo
!:ext ifo/bup
>0x21 byte x v%x
# From: Stefan A. Haubenthal <polluks@sdf.lonestar.org>
0 string xMovieSetter MovieSetter movie
0 string xSceneEditor MovieSetter movie
# From: Behan Webster <behanw@websterwood.com>
# NuppelVideo used by Mythtv (*.nuv)
# Note: there are two identical stanzas here differing only in the
@ -1069,3 +1154,33 @@
# From: David Korth <gerbilsoft@gerbilsoft.com>
0 string CRID
>32 string @UTF Scaleform video
# http://www.jerrysguide.com/tips/demystify-tvs-file-format.html
0 string TVS\015\012
>&0 string Version\040 TeamViewer Session File
>>&0 string x \b, version %s
# SER file format - simple uncompressed video format for astronomical use
# Initially developed by Lucam Recorder,
# as of 2021 maintained by Heiko Wilkens, Grischa Hahn
# Typical extensions: .SER
# http://www.grischa-hahn.homepage.t-online.de/astro/ser/SER%20Doc%20V3b.pdf
0 string LUCAM-RECORDER SER video sequence
!:ext ser
>18 lelong 0 \b, bayer: mono
>18 lelong 8 \b, bayer: RGGB
>18 lelong 9 \b, bayer: GRBG
>18 lelong 10 \b, bayer: GBRG
>18 lelong 11 \b, bayer: BGGR
>18 lelong 16 \b, bayer: CYYM
>18 lelong 17 \b, bayer: YCMY
>18 lelong 18 \b, bayer: YMCY
>18 lelong 19 \b, bayer: MYYC
>18 lelong 100 \b, bayer: RGB
>18 lelong 101 \b, bayer: BGR
>22 lelong 0 \b, big-endian
>22 lelong 1 \b, little-endian
>26 lelong x \b, width: %d
>30 lelong x \b, height: %d
>34 lelong x \b, %d bit
>38 lelong x \b, frames: %d

10
contrib/file/magic/Magdir/apple

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: apple,v 1.44 2019/10/18 15:21:02 christos Exp $
# $File: apple,v 1.45 2021/04/26 15:56:00 christos Exp $
# apple: file(1) magic for Apple file formats
#
0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text
@ -180,7 +180,7 @@
# minimum version needed to read this files. SFMinVers (0 , 30~3.0 )
>>>183 ubyte 30 3.0
>>>183 ubyte !30
>>>>183 ubyte !0 0x%x
>>>>183 ubyte !0 %#x
# usual tabstop start sequence "=====<"
>>>5 string x \b, tabstop ruler "%6.6s"
# tabstop ruler
@ -299,7 +299,7 @@
# object is the first object (true for CoreFoundation implementation).
# From: David Remahl <dremahl@apple.com>
0 string bplist
>6 byte x \bCoreFoundation binary property list data, version 0x%c
>6 byte x \bCoreFoundation binary property list data, version %#c
>>7 byte x \b%c
>6 string 00 \b
>>8 byte&0xF0 0x00 \b
@ -358,7 +358,7 @@
0 belong 0xfade0c02 Mac OS X Code Directory
>8 belong x version %x
>12 belong >0 flags 0x%x
>12 belong >0 flags %#x
>4 belong x - %d bytes
0 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable)
@ -438,7 +438,7 @@
# descSize driver size in blocks
>>4 ubeshort x \b, size %u
# descType driver system type 1 701h F8FFh FFFFh
>>6 ubeshort x \b, type 0x%x
>>6 ubeshort x \b, type %#x
# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
# Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h

207
contrib/file/magic/Magdir/archive

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: archive,v 1.138 2020/06/07 23:29:26 christos Exp $
# $File: archive,v 1.151 2021/08/16 10:19:56 christos Exp $
# archive: file(1) magic for archive formats (see also "msdos" for self-
# extracting compressed archives)
#
@ -168,8 +168,11 @@
0 short 0143561 byte-swapped cpio archive
!:mime application/x-cpio # encoding: swapped
0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
!:mime application/x-cpio
0 string 070701 ASCII cpio archive (SVR4 with no CRC)
!:mime application/x-cpio
0 string 070702 ASCII cpio archive (SVR4 with CRC)
!:mime application/x-cpio
#
# Various archive formats used by various versions of the "ar"
@ -240,7 +243,7 @@
!:ext deb/udeb/ipk
# This should not happen
>14 default x Unknown Debian package
# NL terminated version; for most Debian cases this is 2.0 or 2.1 for splitted
# NL terminated version; for most Debian cases this is 2.0 or 2.1 for split
>68 string >\0 (format %s)
#>68 string !2.0\n
#>>68 string x (format %.3s)
@ -261,7 +264,7 @@
>>>>>>>&-1 ubyte !0x2f
# display 4th character of file name extension like a of lzma
>>>>>>>>&-1 ubyte x \b%c
# splitted debian package case
# split debian package case
>68 string =2.1\n
# dpkg-1.18.25/dpkg-split/info.c
# NL terminated ASCII package name like ckermit
@ -447,36 +450,116 @@
# look for first keyword of Panorama database *.pan
>12 search/261 DESIGN
# skip keyword with low entropy
>12 default x TTComp archive, binary, 4K dictionary
# (version 5.25) labeled the above entry as "TTComp archive data"
>12 default x
# skip DOS 2.0 backup id file, sequence 6 with many nils like BACKUPID_xx6.@@@ handled by ./msdos
>>8 quad !0
>>>0 use ttcomp
# variant ASCII, 4K dictionary (strength=48=50-2). With strength=49 wrong order! WHY?
0 string \1\6
# TODO:
# skip VAX-order 68k Blit mpx/mux executable (strength=50) handled by ./blit
!:strength -2
>0 use ttcomp
0 string \0\5
# skip some DOS 2.0 backup id file, sequence 5 with many nils like BACKUPID_075.@@@ handled by ./msdos
>8 quad !0
>>0 use ttcomp
0 string \1\5
# TODO:
# variant ASCII, 2K dictionary (strength=48=50-2). With strength=49 wrong order! WHY?
# skip ctab data (strength=50) handled by ./ibm6000
# skip locale data table (strength=50) handled by ./digital
!:strength -2
>0 use ttcomp
0 string \0\4
# skip many Maple help database *.hdb with version tag handled by ./maple
>1028 string !version
# skip veclib maple.hdb by looking for Mable keyword
>>4 search/1091 Maple\040
#>4 search/34090 Maple\040
>>4 default x
# skip DOS 2.0-3.2 backed up sequence 4 with many nils like LOTUS5.RAR handled by ./msdos
# skip xBASE Compound Index file *.CDX with many nils
>>>0x54 quad !0
>>>>0 use ttcomp
0 string \1\4
# TODO:
# skip Commodore PET BASIC 4.0 program *.prg
# variant ASCII, 1K dictionary (strength=48=50-2). With strength=49 wrong order! WHY?
# skip shared library (strength=50) handled by ./ibm6000
!:strength -2
>0 use ttcomp
# display information of TTComp archive
0 name ttcomp
# (version 5.25) labeled the entry as "TTComp archive data"
>0 ubyte x TTComp archive data
!:mime application/x-compress-ttcomp
# PBACKSCR.PI1
!:ext $xe/$ts/pi1/__d
# compression type: 0~binary compression 1~ASCII compression
>0 ubyte 0 \b, binary
>0 ubyte 1 \b, ASCII
# size of the dictionary: 4~1024 bytes 5~2048 bytes 6~4096 bytes
>1 ubyte 4 \b, 1K
>1 ubyte 5 \b, 2K
>1 ubyte 6 \b, 4K
>1 ubyte x dictionary
# https://mark0.net/forum/index.php?topic=848
# last 3 bytes probably have only 8 possible bit sequences
# xxxxxxxx 0000000x 11111111 ____FFh
# xxxxxxxx 10000000 01111111 __807Fh
# 0xxxxxxx 11000000 00111111 __C03Fh
# 00xxxxxx 11100000 00011111 __E01Fh
# 000xxxxx 11110000 00001111 __F00Fh
# 0000xxxx 11111000 00000111 __F807h
# 00000xxx 11111100 00000011 __FC03h
# 000000xx 11111110 00000001 __FE01h
# but for quickgif.__d 0A7DD4h
#>-3 ubyte x \b, last 3 bytes 0x%2.2x
#>-2 ubeshort x \b%4.4x
# From: Joerg Jenderek
# URL: https://wiki.68kmla.org/DiskCopy_4.2_format_specification
# reference: http://nulib.com/library/FTN.e00005.htm
0x52 ubeshort 0x0100
# test for disk size equal or above 400k
>0x40 ubelong >409599 Apple DiskCopy 4.2 image
# test for disk image size equal or above 400k
>0x40 ubelong >409599
# test also for disk image size equal or below 1440k to skip
# windows7en.mbr UNICODE.DAT
>>0x40 ubelong <1474561
# To skip Flags$StringJoiner.class with size 00106A61h test also for only 4 disk image sizes
# 00064000 for 400k GCR disks
# 000c8000 for 800k GCR disks
# 000b4000 for 720k MFM disks
# 00168000 for 1440k MFM disks
>>>0x40 ubelong&0xffE03fFF 0
>>>>0 use dc42-floppy
# display information of Apple DiskCopy 4.2 floppy image
0 name dc42-floppy
# image pascal name padded with NULs like Microsoft Mail
>00 pstring/B x Apple DiskCopy 4.2 image %s
#!:mime application/octet-stream
!:mime application/x-dc42-floppy-image
!:apple dCpydImg
!:ext image/dc42
# image pascal name padded with NULs like Microsoft Mail
>>00 pstring/B x %s
# data size in bytes like 409600
>>0x40 ubelong x \b, %u bytes
>0x40 ubelong x \b, %u bytes
# for debugging purpose size in hexadecimal
#>0x40 ubelong x (%#8.8x)
# tag size in bytes
>>0x44 ubelong >0 \b, 0x%x tag size
>0x44 ubelong >0 \b, %#x tag size
# data checksum
#>>0x48 ubelong x \b, 0x%x checksum
#>0x48 ubelong x \b, %#x checksum
# tag checksum
#>>0x4c ubelong x \b, 0x%x tag checksum
#>0x4c ubelong x \b, %#x tag checksum
# disk encoding
>>0x50 ubyte 0 \b, GCR CLV ssdd (400k)
>>0x50 ubyte 1 \b, GCR CLV dsdd (800k)
>>0x50 ubyte 2 \b, MFM CAV dsdd (720k)
>>0x50 ubyte 3 \b, MFM CAV dshd (1440k)
>>0x50 ubyte >3 \b, 0x%x encoding
>0x50 ubyte 0 \b, GCR CLV ssdd (400k)
>0x50 ubyte 1 \b, GCR CLV dsdd (800k)
>0x50 ubyte 2 \b, MFM CAV dsdd (720k)
>0x50 ubyte 3 \b, MFM CAV dshd (1440k)
>0x50 ubyte >3 \b, %#x encoding
# format byte
>>0x51 ubyte x \b, 0x%x format
#>>0x54 ubequad x \b, data 0x%16.16llx
>0x51 ubyte x \b, %#x format
#>0x54 ubequad x \b, data %#16.16llx
# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
0 string ESP ESP archive data
# ZPack
@ -509,11 +592,11 @@
# compression method (0-4)
>>8 uleshort x \b, %u method
# offset of compressed data
>>10 uleshort x \b, 0x%x offset
>>10 uleshort x \b, %#x offset
#>>(10.s) uleshort x
#>>>&-6 string x \b, TEST extension %-.3s
# header flags to mark header extensions
>>12 uleshort >0 \b, 0x%x flags
>>12 uleshort >0 \b, %#x flags
# 4 bytes: decompressed length of file
>>12 uleshort &0x01
>>>14 ulelong x \b, original size: %u bytes
@ -603,6 +686,21 @@
!:ext ??$
>>8 ulelong >0 \b, original size: %u bytes
# Summary: FTCOMP compressed archive
# From: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/FTCOMP
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-ftcomp.trid.xml
# Note: called by TrID "FTCOMP compressed archive"
# extracted by `unpack seahelp.hl_`
24 string/b FTCOMP FTCOMP compressed archive
#!:mime application/octet-stream
!:mime application/x-compress-ftcomp
!:ext ??_/??@/dll/drv/pk2/
# probably A596FDFF magic at the beginning
>0 ubelong !0xA596FDFF \b, at beginning %#x
# probably original file name with directory like: \OS2\unpack.exe \SYSTEM\8514.DRV MAHJONGG.EXE
>41 string x "%s"
# MP3 (archiver, not lossy audio compression)
0 string MP3\x1a MP3-Archiver archive data
# ZET
@ -816,7 +914,7 @@
!:ext dz
>>2 byte x \b, version %i
>>3 byte x \b.%i
>>4 ulelong x \b, offset 0x%x
>>4 ulelong x \b, offset %#x
>>8 ulelong x \b, %u files
# ZZip archiver (.zz)
0 string ZZ\ \0\0 ZZip archive data
@ -923,7 +1021,7 @@
>>>>>>3 regex \^lh[456] LHa (2.x) archive data
>>>>>>>2 string -lh5 \b
# https://en.wikipedia.org/wiki/BIOS
# Some mainboard BIOS like Award use LHa compression. So archives with unusal extension are found like
# Some mainboard BIOS like Award use LHa compression. So archives with unusual extension are found like
# bios.rom , kd7_v14.bin, 1010.004, ...
!:ext lha/lzh/rom/bin
# missing -lh?- variants (Joe Jared)
@ -950,21 +1048,21 @@
# compressed data size != compressed file size
#>7 ulelong x \b, data size %d
# attribute: 0x2~?? 0x10~symlink|target 0x20~normal
#>19 ubyte x \b, 19_0x%x
#>19 ubyte x \b, 19_%#x
# level identifier 0 1 2 3
#>20 ubyte x \b, level %d
# time stamp
#>15 ubelong x DATE 0x%8.8x
#>15 ubelong x DATE %#8.8x
# OS ID for level 1
>20 ubyte 1
# 0x20 types find for *.rom files
>>(21.b+24) ubyte <0x21 \b, 0x%x OS
>>(21.b+24) ubyte <0x21 \b, %#x OS
# ascii type like M for MSDOS
>>(21.b+24) ubyte >0x20 \b, '%c' OS
# OS ID for level 2
>20 ubyte 2
#>>23 ubyte x \b, OS ID 0x%x
>>23 ubyte <0x21 \b, 0x%x OS
#>>23 ubyte x \b, OS ID %#x
>>23 ubyte <0x21 \b, %#x OS
>>23 ubyte >0x20 \b, '%c' OS
# filename only for level 0 and 1
>20 ubyte <2
@ -1319,8 +1417,9 @@
>>>>38 search/64 .app/ iOS App
!:mime application/x-ios-app
>30 search/100/b application/epub+zip EPUB document
!:mime application/epub+zip
# Dup, see above.
#>30 search/100/b application/epub+zip EPUB document
#!:mime application/epub+zip
# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
# Next line excludes specialized formats:
@ -1331,6 +1430,8 @@
>>>>4 beshort x \b, at least
>>>>4 use zipversion
>>>>4 beshort x to extract
>>>>8 beshort x \b, compression method=
>>>>8 use zipcompression
>>>>0x161 string WINZIP \b, WinZIP self-extracting
# StarView Metafile
@ -1472,8 +1573,17 @@
>>0x2A string >\0 : %s
# DR-DOS 7.03 Packed File *.??_
0 string Packed\ File\ Personal NetWare Packed File
>12 string x \b, was "%.12s"
# Reference: http://www.antonis.de/dos/dos-tuts/mpdostip/html/nwdostip.htm
# Note: unpacked by PNUNPACK.EXE
0 string Packed\ File\
# by looking for Control-Z skip ASCII text starting with Packed File
>0x18 ubyte 0x1a Personal NetWare Packed File
!:mime application/x-novell-compress
!:ext ??_
>>12 string x \b, was "%.12s"
# 1 or 2
#>>0x19 ubyte x \b, at 0x19 %u
>>0x1b ulelong x with %u bytes
# EET archive
# From: Tilman Sauerbeck <tilman@code-monkey.de>
@ -1548,7 +1658,7 @@
>24 belong 2 MD5 checksum
>24 belong 3 SHA-256 checksum
>24 belong 4 SHA-512 checksum
>24 belong >4 unknown 0x%x checksum
>24 belong >4 unknown %#x checksum
#>24 belong >4 checksum
# For no compression jump 0 bytes
>24 belong 0
@ -1556,7 +1666,7 @@
# jump more bytes forward by header size
>>>&(4.S) ubyte x
# jump more bytes forward by compressed table of contents size
#>>>>&(8.Q) ubequad x \b, heap data 0x%llx
#>>>>&(8.Q) ubequad x \b, heap data %#llx
>>>>&(8.Q) ubyte x
# look for data by ./compress after message with 1 space at end
>>>>>&-3 indirect x \b, contains
@ -1628,7 +1738,7 @@
# *.GHS or *.[0-9] with cns program option
>2 ubyte&0x08 0x08 \b, split file
# part of split index interesting for *.ghs
>>4 ubyte x id=0x%x
>>4 ubyte x id=%#x
# compression tag minus one equals numeric compression command line switch z[1-9]
>3 ubyte 0 \b, no compression
>3 ubyte 2 \b, fast compression (Z1)
@ -1676,9 +1786,9 @@
!:mime application/x-acronis-tib
!:ext tib
# 01000000
#>20 ubelong x \b, at 20 0x%x
#>20 ubelong x \b, at 20 %#x
# 20000000
#>28 ubelong x \b, at 28 0x%x
#>28 ubelong x \b, at 28 %#x
# strings like "Generic- SD/MMC 1.00" "Unknown Disk" "Msft Virtual Disk 1.0"
# ???
# strings like "\Device\0000011e" "\Device\0000015a"
@ -1719,3 +1829,24 @@
# path[CXBTFFile[MaximumPathLength=256]
>>9 string x \b, 1st %s
# ALZIP archive
# by Hyungjun Park <hyungjun.park@worksmobile.com>, Hajin Jang <hajin_jang@worksmobile.com>
# http://kippler.com/win/unalz/
# https://salsa.debian.org/l10n-korean-team/unalz
0 string ALZ\001 ALZ archive data
!:ext alz
# https://cf-aldn.altools.co.kr/setup/EGG_Specification.zip
0 string EGGA EGG archive data,
!:ext egg
>5 byte x version %u
>4 byte x \b.%u
>>0x0E ulelong =0x08E28222
>>0x0E ulelong =0x24F5A262 \b, split
>>0x0E ulelong =0x24E5A060 \b, solid
>>0x0E default x \b, unknown
# PAQ9A archive
# URL: http://mattmahoney.net/dc/#paq9a
# Note: Line 1186 of paq9a.cpp gives the magic bytes
0 string pQ9\001 PAQ9A archive

41
contrib/file/magic/Magdir/arm Normal file

@ -0,0 +1,41 @@
#------------------------------------------------------------------------------
# $File: arm,v 1.2 2021/07/14 17:40:31 christos Exp $
# arm: file(1) magic for ARM COFF
#
# https://docs.microsoft.com/en-us/windows/win32/debug/pe-format
# Aarch64
0 leshort 0xaa64
# test for unused flag bits in f_flags
>18 uleshort&0x8E80 0
# use little endian variant of subroutine to
# display name+variables+flags for common object formatted files
>>0 use display-coff
!:strength -10
# ARM
0 leshort 0x01c0
# test for unused flag bits in f_flags
>18 uleshort&0x8E80 0
# use little endian variant of subroutine to
# display name+variables+flags for common object formatted files
>>0 use display-coff
!:strength -10
# ARM Thumb
0 leshort 0x01c2
# test for unused flag bits in f_flags
>18 uleshort&0x8E80 0
# use little endian variant of subroutine to
# display name+variables+flags for common object formatted files
>>0 use display-coff
!:strength -10
# ARMv7 Thumb
0 leshort 0x01c4
# test for unused flag bits in f_flags
>18 uleshort&0x8E80 0
# use little endian variant of subroutine to
# display name+variables+flags for common object formatted files
>>0 use display-coff
!:strength -10

6
contrib/file/magic/Magdir/asf

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: asf,v 1.1 2019/12/26 02:07:53 christos Exp $
# $File: asf,v 1.2 2021/04/26 15:56:00 christos Exp $
# asf: file(1) magic for Microsoft Advanced Systems Format (ASF) files
# http://www.staroceans.org/e-book/ASF_Specification.pdf
@ -23,7 +23,7 @@
#>>56 lequad x Time Offset %lld
#>>64 lelong x Type-Specicic Data Length %d
#>>68 lelong x Error Correction Data Length %d
#>>72 leshort x Flags 0x%x
#>>72 leshort x Flags %#x
#>>74 lelong x Reserved %x
# ASF_Audio_Media
>>24 guid F8699E40-5B4D-11CF-A8FD-00805F5C442B \b, Audio Media (
@ -40,7 +40,7 @@
#>>>85 leshort x \b, Format Data Size %x
>>>93 lelong x \b, Image Width %d
>>>97 lelong x \b, Image Height %d
#>>>101 leshort x \b, Reserved 0x%x
#>>>101 leshort x \b, Reserved %#x
>>>103 leshort x \b, Bits Per Pixel Count %d
#>>>105 lelong x \b, Compression ID %d
#>>>109 lelong x \b, Image Size %d

64
contrib/file/magic/Magdir/audio

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: audio,v 1.118 2019/11/19 05:30:07 christos Exp $
# $File: audio,v 1.121 2021/04/26 15:56:00 christos Exp $
# audio: file(1) magic for sound formats (see also "iff")
#
# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
@ -445,7 +445,7 @@
>0 string >\0 Composer: "%s"
0 string AMF AMF Module
>4 string >\0 Title: "%s"
0 string MODINFO1 Open Cubic Player Module Inforation MDZ
0 string MODINFO1 Open Cubic Player Module Information MDZ
0 string Extended\40Instrument: Fast Tracker II Instrument
# From: Takeshi Hamasaki <hma@syd.odn.ne.jp>
@ -716,36 +716,36 @@
>>8 ubyte&0x0F >0 \b%d
#Get soundchips
>>8 ubyte x \b, soundchip(s)=
>>0x0C ulelong >0 SN76489,
>>0x10 ulelong >0 YM2413,
>>0x2C ulelong >0 YM2612,
>>0x30 ulelong >0 YM2151,
>>0x0C ulelong >0 SN76489 (PSG),
>>0x10 ulelong >0 YM2413 (OPLL),
>>0x2C ulelong >0 YM2612 (OPN2),
>>0x30 ulelong >0 YM2151 (OPM),
>>0x38 ulelong >0 Sega PCM,
>>0x34 ulelong >0xC
>>>0x40 ulelong >0 RF5C68,
>>>0x40 ulelong >0 RF5C68 (PCM),
>>0x34 ulelong >0x10
>>>0x44 ulelong >0 YM2203,
>>>0x44 ulelong >0 YM2203 (OPN),
>>0x34 ulelong >0x14
>>>0x48 ulelong >0 YM2608,
>>>0x48 ulelong >0 YM2608 (OPNA),
>>0x34 ulelong >0x18
>>>0x4C lelong >0 YM2610,
>>>0x4C lelong <0 YM2610B,
>>>0x4C lelong >0 YM2610 (OPNB),
>>>0x4C lelong <0 YM2610B (OPNB+2FM),
>>0x34 ulelong >0x1C
>>>0x50 ulelong >0 YM3812,
>>>0x50 ulelong >0 YM3812 (OPL2),
>>0x34 ulelong >0x20
>>>0x54 ulelong >0 YM3526,
>>>0x54 ulelong >0 YM3526 (OPL),
>>0x34 ulelong >0x24
>>>0x58 ulelong >0 Y8950,
>>>0x58 ulelong >0 Y8950 (MSX-Audio),
>>0x34 ulelong >0x28
>>>0x5C ulelong >0 YMF262,
>>>0x5C ulelong >0 YMF262 (OPL3),
>>0x34 ulelong >0x2C
>>>0x60 ulelong >0 YMF278B,
>>>0x60 ulelong >0 YMF278B (OPL4),
>>0x34 ulelong >0x30
>>>0x64 ulelong >0 YMF271,
>>>0x64 ulelong >0 YMF271 (OPX),
>>0x34 ulelong >0x34
>>>0x68 ulelong >0 YMZ280B,
>>>0x68 ulelong >0 YMZ280B (PCMD8),
>>0x34 ulelong >0x38
>>>0x6C ulelong >0 RF5C164,
>>>0x6C ulelong >0 RF5C164 (PCM),
>>0x34 ulelong >0x3C
>>>0x70 ulelong >0 PWM,
>>0x34 ulelong >0x40
@ -767,11 +767,11 @@
>>0x34 ulelong >0x54
>>>0x88 ulelong >0 MultiPCM,
>>0x34 ulelong >0x58
>>>0x8C ulelong >0 uPD7759,
>>>0x8C ulelong >0 uPD7759 (ADPCM Speech),
>>0x34 ulelong >0x5C
>>>0x90 ulelong >0 OKIM6258,
>>>0x90 ulelong >0 OKIM6258 (ADPCM Speech),
>>0x34 ulelong >0x64
>>>0x98 ulelong >0 OKIM6295,
>>>0x98 ulelong >0 OKIM6295 (ADPCM),
>>0x34 ulelong >0x68
>>>0x9C ulelong >0 K051649,
>>0x34 ulelong >0x6C
@ -796,10 +796,10 @@
>>0x34 ulelong >0x94
>>>0xC8 ulelong >0 SAA1099,
>>0x34 ulelong >0x98
>>>0xCC ulelong >0 ES5503,
>>>0xCC ulelong >0 ES5503 (DOC),
>>0x34 ulelong >0x9C
>>>0xD0 lelong >0 ES5505,
>>>0xD0 lelong <0 ES5506,
>>>0xD0 lelong >0 ES5505 (OTIS),
>>>0xD0 lelong <0 ES5506 (OTTO),
>>0x34 ulelong >0xA4
>>>0xD8 ulelong >0 X1-010,
>>0x34 ulelong >0xA8
@ -847,16 +847,16 @@
>>18 ubyte x \b, language ID %d
# structure for phrases/sentences?
# number of voice sample in the 1st phrase?
#>>19 uleshort x \b, 0x%x samples
#>>>21 uleshort >0 \b, at 0x%4.4x
#>>>(21.s) ubequad x 0x%llx
#>>19 uleshort x \b, %#x samples
#>>>21 uleshort >0 \b, at %#4.4x
#>>>(21.s) ubequad x %#llx
# 2nd phrase?
#>>23 uleshort x \b, 0x%x samples
#>>>25 uleshort >0 \b, at 0x%4.4x
#>>>(25.s) ubequad x 0x%llx
#>>23 uleshort x \b, %#x samples
#>>>25 uleshort >0 \b, at %#4.4x
#>>>(25.s) ubequad x %#llx
# pointer to 1st audio WAV sample
>>16 uleshort >0
>>>(16.s) ulelong >0 \b, at 0x%x
>>>(16.s) ulelong >0 \b, at %#x
# WAV length
# 1 space char after "bytes" to get phrase "bytes RIFF"
>>>>(16.s+4) ulelong >0 %u bytes

33
contrib/file/magic/Magdir/avm Normal file

@ -0,0 +1,33 @@
#------------------------------------------------------------------------------
# $File: avm,v 1.1 2020/08/28 20:37:58 christos Exp $
# avm: file(1) magic for avm files; this is not use
# Summary: FRITZ!Box router configuration backup
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Fritz!Box
# Reference: http://www.mengelke.de/Projekte/FritzBoxTools2
# Note: only tested with models 4040 and 6490 Cable (lgi)
0 string ****\ FRITZ!Box\ FRITZ!Box configuration backup
#!:mime text/plain
!:mime application/x-avm-export
!:ext export
# router model name like "4040" , "6490 Cable (lgi)" followed by " CONFIGURATION EXPORT"
>15 string x of %-.4s
# on 2nd line hashed password
#>41 search/54 Password= \b, password
# on 3rd line firmware version like: 141.06.24 141.06.50 141.07.10 ... 155.06.83
>41 search/172 FirmwareVersion= \b, firmware version
>>&0 string x %s
# on 5th line oem like: avme lgi
>41 search/285 OEM= \b, oem
>>&0 string x %s
# on 7th line language like: de en
>41 search/305 Language= \b, language
>>&0 string x %s
# on 10th line cfg file name like: /var/tmp.cfg
>41 search/349 tmp.cfg
# on 11th line date inside c-comment like: Thu Jun 4 22:25:19 2015
>>&4 string x \b, %s
#

2
contrib/file/magic/Magdir/biosig

@ -19,7 +19,7 @@
0 string ATES\x20MEDICA\x20SOFT.\x20EEG\x20for\x20Windows Biosig/ATES MEDICA SOFT. EEG for Windows
!:mime biosig/ates
#
0 string ATF\x09 Biosig/Axon Text fomrat
0 string ATF\x09 Biosig/Axon Text format
!:mime biosig/atf
#
0 string ADU1 Biosig/Axona file format

6
contrib/file/magic/Magdir/blit

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $
# $File: blit,v 1.9 2021/07/03 14:01:46 christos Exp $
# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine
#
# Note that this 0407 conflicts with several other a.out formats...
@ -14,7 +14,11 @@
0 short 03401 VAX-order 68K Blit (standalone) executable
0 long 0406 68k Blit mpx/mux executable
0 short 0406 VAX-order2 68k Blit mpx/mux executable
# GRR: line below is too general as it matches also TTComp archive, ASCII, 4K handled by ./archive
0 short 03001 VAX-order 68k Blit mpx/mux executable
# TODO:
# skip TTComp archive, ASCII, 4K by looking for executable keyword like main
#>0 search/5536 main\0 VAX-order 68k Blit mpx/mux executable
# Need more values for WE32 DMD executables.
# Note that 0520 is the same as COFF
#0 short 0520 tty630 layers executable

10
contrib/file/magic/Magdir/bm Normal file

@ -0,0 +1,10 @@
#------------------------------------------------------------------------------
# $File: bm,v 1.2 2021/03/14 16:56:51 christos Exp $
# bm: file(1) magic for "Birtual Machine", cf. https://github.com/tsoding/bm
0 string bm\001\244 Birtual Machine
>4 leshort x \b, version %d
>6 lelong x \b, program size %u
>14 lelong x \b, memory size %u
>22 lelong x \b, memory capacity %u

7
contrib/file/magic/Magdir/bsi

@ -2,8 +2,9 @@
# Office for Information Security (Bundesamt fuer Sicherheit in der
# Informationstechnik).
# Extension: .xia
0 string XIA1 Chiasmus encrypted data
# https://www.bsi.bund.de/EN/Topics/OtherTopics/Chiasmus/Chiasmus_node.html
0 string XIA1\r Chiasmus Encrypted data
!:ext xia
# Extension: .xis
0 string XIS Chiasmus key
!:ext xis

30
contrib/file/magic/Magdir/bytecode Normal file

@ -0,0 +1,30 @@
#------------------------------------------------------------
# $File: bytecode,v 1.2 2021/06/30 11:57:32 christos Exp $
# magic for various bytecodes
# From: Mikhail Gusarov <dottedmag@dottedmag.net>
# NekoVM (https://nekovm.org/) bytecode
0 string NEKO NekoVM bytecode
>4 lelong x (%d global symbols,
>8 lelong x %d global fields,
>12 lelong x %d bytecode ops)
!:mime application/x-nekovm-bytecode
# https://www.iana.org/assignments/media-types/application/vnd.resilient.logic
# From: Benedikt Muessig <benedikt@resilient-group.de>
0 belong 0x07524c4d Resilient Logic bytecode
!:mime application/vnd.resilient.logic
>4 byte/16 x \b, version %d
>4 byte&0x0f x \b.%d
# Guile file magic from <dalepsmith@gmail.com>
# https://www.gnu.org/s/guile/
# https://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250
0 string GOOF---- Guile Object
>8 string LE \b, little endian
>8 string BE \b, big endian
>11 string 4 \b, 32bit
>11 string 8 \b, 64bit
>13 regex .\.. \b, bytecode v%s

7
contrib/file/magic/Magdir/c-lang

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: c-lang,v 1.28 2019/11/15 21:03:14 christos Exp $
# $File: c-lang,v 1.30 2021/08/16 10:17:05 christos Exp $
# c-lang: file(1) magic for C and related languages programs
#
# The strength is to beat standard HTML
@ -49,7 +49,10 @@
>0 regex \^union[[:space:]]+ C source text
!:mime text/x-c
0 search/8192 main(
>&0 regex \\)[[:space:]]*\\{ C source text
>&0 search/64 String Java source text
!:mime text/x-java
>&0 default x
>>&0 regex \\)[[:space:]]*\\{ C source text
!:mime text/x-c
# C++

13
contrib/file/magic/Magdir/c64

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: c64,v 1.7 2017/11/15 12:19:06 christos Exp $
# $File: c64,v 1.9 2021/04/26 15:56:00 christos Exp $
# c64: file(1) magic for various commodore 64 related files
#
# From: Dirk Jagdmann <doj@cubic.org>
@ -28,17 +28,17 @@
0 belong 0xFF424CFF WRAptor packer (c64)
0 string C64S\x20tape\x20file T64 tape Image
>32 leshort x Version:0x%x
>32 leshort x Version:%#x
>36 leshort !0 Entries:%i
>40 string x Name:%.24s
0 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image
>32 leshort x Version:0x%x
>32 leshort x Version:%#x
>36 leshort !0 Entries:%i
>40 string x Name:%.24s
0 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image
>32 leshort x Version:0x%x
>32 leshort x Version:%#x
>36 leshort !0 Entries:%i
>40 string x Name:%.24s
@ -56,3 +56,8 @@
>68 string >\0 \b (C) %s
>100 byte >0 \b, %u subsong(s)
# CBM BASIC (cc65 compiled)
0 leshort 0x0801
>2 leshort 0x080b
>6 string \x9e CBM BASIC
>7 string >\0 \b, SYS %s

109
contrib/file/magic/Magdir/cad

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: cad,v 1.23 2020/05/30 23:58:07 christos Exp $
# $File: cad,v 1.28 2021/04/26 15:56:00 christos Exp $
# autocad: file(1) magic for cad files
#
@ -32,8 +32,8 @@
#>0 ubyte &0x40 \b, reserved
# type of element 9~TCB 8~Digitizer setup 5~Group Data Elements
#>1 ubyte&0x7F x \b, type %u
# words to follow in element: 17H~CEL libray 2FEh~DGN 9FEh,DFEh~CIT
#>2 uleshort x \b, words 0x%4.4x to follow
# words to follow in element: 17H~CEL library 2FEh~DGN 9FEh,DFEh~CIT
#>2 uleshort x \b, words %#4.4x to follow
# test for 3 reserved 0 bytes in CIT or "conversion" in ViewInfo structure (DGN CEL)
#>508 ubelong x \b, RESERVED %8.8x
>508 ubelong&0xFFffFF00 =0
@ -58,7 +58,7 @@
>>>>1120 string x \b, units %-.2s
# 2 chars for name of master unit like IN in ML SU tn th TH HU mm "\0 "\040 \0\0
>>>>1122 string >\0 %-.2s
#>>>>1120 ubelong x \b, units 0x%8.8x
#>>>>1120 ubelong x \b, units %#8.8x
# element range low,high x y z like xlow=0 08010000h 01080000h
#>>>>4 ubelong !0 \b, xlow %8.8x
#>>>>8 ubelong !0 \b, ylow %8.8x
@ -67,7 +67,7 @@
#>>>>20 ubelong !0 \b, yhigh %8.8x
#>>>>24 ubelong !0 \b, zhigh %8.8x
# graphic group number; all other elements in that group have same non-0 number
#>>>>28 leshort x \b, grphgrp 0x%4.4x
#>>>>28 leshort x \b, grphgrp %#4.4x
# words to optional attribute linkage
#>>>>30 ubyte x \b, attindx \%o
#>>>>31 ubyte x \b\%o
@ -91,11 +91,11 @@
# >>30 string \372\106 DGNFile
# >>30 string \376\103 DGNFile
# elements properties indicator
#>>>>32 uleshort !0 \b, properties 0x%4.4x
#>>>>32 uleshort !0 \b, properties %#4.4x
# class 0~Primary
#>>>>>32 uleshort&0x000F !0 \b, class 0x%4.4x
#>>>>>32 uleshort&0x000F !0 \b, class %#4.4x
# Symbology
#>>>>>34 uleshort x \b, Symbology 0x%4.4x
#>>>>>34 uleshort x \b, Symbology %#4.4x
# test for 2nd element type 1~library cell header
>>&1 ubyte&0x7F 1
# test for 1st element with level 8 and type 5 for cell library
@ -151,13 +151,13 @@
>194 ubyte &0x04 horizontal
>194 ubyte ^0x04 vertical
# ScannableFlag; Scanline indexing method used
#>195 ubyte !0 \b, ScannableFlag 0x%x
#>195 ubyte !0 \b, ScannableFlag %#x
# RotationAngle; Rotation angle of raster data
#>196 ubequad !0 \b, RotationAngle 0x%llx
#>196 ubequad !0 \b, RotationAngle %#llx
# SkewAngle; Skew angle of raster data
#>204 ubequad !0 \b, SkewAngle %llx
# DataTypeModifier; Additional raster data format info
#>212 uleshort !0 \b, DataTypeModifier 0x%4.4x
#>212 uleshort !0 \b, DataTypeModifier %#4.4x
# DesignFile[66]; Name of the design file
>214 string >\0 \b, DesignFile %-.66s
# DatabaseFile[66]; Name of the database file
@ -167,9 +167,9 @@
# FileDescription[80]; Text description of file and contents
>412 string >\0 \b, FileDescription %-.80s
# MinValue
#>492 ubequad !0 \b, MinValue 0x%llx
#>492 ubequad !0 \b, MinValue %#llx
# MaxValue
#>500 ubequad !0 \b, MaxValue 0x%llx
#>500 ubequad !0 \b, MaxValue %#llx
# Reserved[3]; Unused (always 0)
#>508 ubelong&0xFFffFF00 x \b, RESERVED %8.8x
# GridFileVersion; Grid File Version like 2 3
@ -213,9 +213,11 @@
# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com)
0 string AC1012 DWG AutoDesk AutoCAD Release 13
!:mime image/vnd.dwg
0 string AC1013 DWG AutoDesk AutoCAD Release 13c3
!:mime image/vnd.dwg
0 string AC1014 DWG AutoDesk AutoCAD Release 14
!:mime image/vnd.dwg
0 string AC1015 DWG AutoDesk AutoCAD 2000/2002
0 string AC1015 DWG AutoDesk AutoCAD 2000
!:mime image/vnd.dwg
# A new version of AutoCAD DWG
@ -233,7 +235,9 @@
!:mime image/vnd.dwg
# From GNU LibreDWG
0 string AC1032 DWG AutoDesk AutoCAD 2018/2019
0 string AC1032 DWG AutoDesk AutoCAD 2018/2019/2020
!:mime image/vnd.dwg
0 string AC1035 DWG AutoDesk AutoCAD 2021
!:mime image/vnd.dwg
# KOMPAS 2D drawing from ASCON
@ -309,11 +313,15 @@
>>>>&1 search/8192 AC1006 \b, R10
>>>>&1 search/8192 AC1009 \b, R11/R12
>>>>&1 search/8192 AC1012 \b, R13
>>>>&1 search/8192 AC1013 \b, R13c3
>>>>&1 search/8192 AC1014 \b, R14
>>>>&1 search/8192 AC1015 \b, version 2000
>>>>&1 search/8192 AC1018 \b, version 2004
>>>>&1 search/8192 AC1021 \b, version 2007
>>>>&1 search/8192 AC1024 \b, version 2010
>>>>&1 search/8192 AC1027 \b, version 2013
>>>>&1 search/8192 AC1032 \b, version 2018
>>>>&1 search/8192 AC1035 \b, version 2021
# The Sketchup 3D model format https://www.sketchup.com/
0 string \xff\xfe\xff\x0e\x53\x00\x6b\x00\x65\x00\x74\x00\x63\x00\x68\x00\x55\x00\x70\x00\x20\x00\x4d\x00\x6f\x00\x64\x00\x65\x00\x6c\x00 SketchUp Model
@ -322,3 +330,74 @@
4 regex/b P[0-9][0-9]\\.[0-9][0-9][0-9][0-9]\\.[0-9][0-9][0-9][0-9]\\.[0-9] NAXOS CAD System file from version %s
!:strength +40
# glTF (GL Transmission Format) - by the Khronos Group
# Reference: https://github.com/KhronosGroup/glTF/tree/master/specification/2.0#glb-file-format-specification
0 string glTF glTF binary model
>4 ulelong x \b, version %d
>8 ulelong x \b, length %d bytes
!:mime model/gltf-binary
!:ext glb
# FBX (FilmBoX) - by Kaydara/Autodesk
# Reference: https://code.blender.org/2013/08/fbx-binary-file-format-specification
0 string Kaydara\ FBX\ Binary\ \ \0 Kaydara FBX model,
>&2 ulelong x version %d
!:ext fbx
# PLY (Polygon File Format/Stanford Triangle Format) - by Greg Turk
# Reference: https://web.archive.org/web/20161204152348/http://www.dcs.ed.ac.uk/teaching/cs4/www/graphics/Web/ply.html
0 string ply\n PLY model,
!:ext ply
>4 string format\ ascii\ ASCII,
>>&0 regex/6 [0-9.]+ version %s
>4 string format\ binary binary,
>>&0 string _little_endian\ little endian,
>>>&0 regex/6 [0-9.]+ version %s
>>&0 string _big_endian\ big endian,
>>>&0 regex/6 [0-9.]+ version %s
# VRML (Virtual Reality Modeling Language) - by the Web3D Consortium
# From: Michel Briand <michelbriand@free.fr>
# Reference: https://www.web3d.org/standards
0 string/w #VRML\ V1.0\ ascii VRML 1 file
!:mime model/vrml
!:ext wrl
0 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file
!:mime model/vrml
!:ext wrl
# X3D, VRML encoded
0 string #X3D X3D (Extensible 3D) model, VRML format
>4 string V
>>5 regex/6 [0-9.]+ \b, version %s
!:mime model/x3d+vrml
!:ext x3dv
## XML-based 3D CAD Formats
# From: Michel Briand <michelbriand@free.fr>, Oliver Galvin <odg@riseup.net>
0 string/w \<?xml\ version=
!:strength + 5
# X3D (Extensible 3D)
# Schema: https://www.web3d.org/specifications/x3d-3.2.dtd
# MIME Type: https://www.iana.org/assignments/media-types/model/x3d+xml
# Example: https://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d
>20 search/1000/w \<!DOCTYPE\ X3D X3D (Extensible 3D) model, XML document
!:mime model/x3d+xml
!:ext x3d
# COLLADA (COLLAborative Design Activity) - by the Khronos Group
# Schema: http://www.collada.org/2005/11/COLLADASchema
# Reference: https://www.khronos.org/collada
>20 search/1000/w \<COLLADA COLLADA model, XML document
!:mime model/vnd.collada+xml
!:ext dae
# 3MF (3D Manufacturing Format) - by the 3MF Consortium
# Schema: http://schemas.microsoft.com/3dmanufacturing/core/2015/02
# Reference: https://3mf.io/specification
>20 search/1000/w xmlns="http://schemas.microsoft.com/3dmanufacturing 3MF (3D Manufacturing Format) model, XML document
!:mime model/3mf
!:ext 3mf
# AMF (Additive Manufacturing File)
# Reference: https://www.astm.org/Standards/ISOASTM52915.htm
>20 search/1000/w \<amf AMF (Additive Manufacturing Format) model, XML document
!:mime application/x-amf
!:ext amf

61
contrib/file/magic/Magdir/cafebabe

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: cafebabe,v 1.24 2018/10/01 23:33:15 christos Exp $
# $File: cafebabe,v 1.27 2021/04/26 15:56:00 christos Exp $
# Cafe Babes unite!
#
# Since Java bytecode and Mach-O universal binaries have the same magic number,
@ -15,12 +15,20 @@
# might add another one or two as time goes by...
#
### JAVA START ###
# Reference: http://en.wikipedia.org/wiki/Java_class_file
# Update: Joerg Jenderek
0 belong 0xcafebabe
>4 belong >30 compiled Java class data,
>4 ubelong >30 compiled Java class data,
!:mime application/x-java-applet
>>6 beshort x version %d.
>>4 beshort x \b%d
#!:mime application/java-byte-code
!:ext class
>>6 ubeshort x version %d.
>>4 ubeshort x \b%d
# for debugging purpose version as hexadecimal to compare with Mach-O universal binary
#>>4 ubelong x (%#8.8x)
# Which is which?
# https://docs.oracle.com/javase/specs/jvms/se6/html/ClassFile.doc.html
#>>4 belong 0x002b (Java 0.?)
#>>4 belong 0x032d (Java 1.0)
#>>4 belong 0x032d (Java 1.1)
>>4 belong 0x002e (Java 1.2)
@ -30,6 +38,16 @@
>>4 belong 0x0032 (Java 1.6)
>>4 belong 0x0033 (Java 1.7)
>>4 belong 0x0034 (Java 1.8)
>>4 belong 0x0035 (Java SE 9)
>>4 belong 0x0036 (Java SE 10)
>>4 belong 0x0037 (Java SE 11)
>>4 belong 0x0038 (Java SE 12)
>>4 belong 0x0039 (Java SE 13)
>>4 belong 0x003A (Java SE 14)
# pool count unequal zero
#>>8 beshort x \b, pool count %#x
# pool table
#>>10 ubequad x \b, pool %#16.16llx...
0 belong 0xcafed00d JAR compressed with pack200,
>5 byte x version %d.
@ -44,29 +62,40 @@
### JAVA END ###
### MACH-O START ###
# URL: https://en.wikipedia.org/wiki/Mach-O
0 name mach-o \b [
# for debugging purpose CPU type as hexadecimal
#>0 ubequad x CPU=%16.16llx
# display CPU type as string like: i386 x86_64 ... armv7 armv7k ...
>0 use mach-o-cpu \b
# for debugging purpose print offset to 1st mach_header like:
# 1000h 4000h seldom 2d000h 88000h 5b000h 10e000 h
#>8 ubelong x at %#x offset
>(8.L) indirect x \b:
>0 belong x \b]
# Reference: https://opensource.apple.com/source/cctools/cctools-949.0.1/
# include/mach-o/fat.h
# include/mach/machine.h
0 belong 0xcafebabe
>4 belong 1 Mach-O universal binary with 1 architecture:
!:mime application/x-mach-binary
>>8 use mach-o \b
>4 belong >1
>>4 belong <20 Mach-O universal binary with %d architectures:
# nfat_arch; number of CPU architectures; highest is 18 for CPU_TYPE_POWERPC in 2020
>4 ubelong >1
>>4 ubelong <20 Mach-O universal binary with %d architectures:
!:mime application/x-mach-binary
>>>8 use mach-o \b
>>4 belong >1
>>>28 use mach-o \b
>>4 belong >2
>>>48 use mach-o \b
>>4 belong >3
>>>68 use mach-o \b
>>4 belong >4
>>>88 use mach-o \b
>>4 belong >5
>>>108 use mach-o \b
>>>4 ubelong >1
>>>>28 use mach-o \b
>>>4 ubelong >2
>>>>48 use mach-o \b
>>>4 ubelong >3
>>>>68 use mach-o \b
>>>4 ubelong >4
>>>>88 use mach-o \b
>>>4 ubelong >5
>>>>108 use mach-o \b
### MACH-O END ###

6
contrib/file/magic/Magdir/citrus

@ -1,8 +1,12 @@
#------------------------------------------------------------------------------
# $File: citrus,v 1.4 2009/09/19 16:28:08 christos Exp $
# $File: citrus,v 1.5 2021/01/04 19:48:31 christos Exp $
# citrus locale declaration
#
0 string RuneCT Citrus locale declaration for LC_CTYPE
0 string CtrsME Citrus locale declaration for LC_MESSAGES
0 string CtrsMO Citrus locale declaration for LC_MONETARY
0 string CtrsNU Citrus locale declaration for LC_NUMERIC
0 string CtrsTI Citrus locale declaration for LC_TIME

6
contrib/file/magic/Magdir/clipper

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: clipper,v 1.8 2017/03/17 21:35:28 christos Exp $
# $File: clipper,v 1.9 2020/12/15 23:57:27 christos Exp $
# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper.
#
# XXX - what byte order does the Clipper use?
@ -61,5 +61,5 @@
>54 byte 2 -Cssw
>54 byte 3 -Cspw
>54 byte 4 -Cscb
4 string pipe CLIPPER instruction trace
4 string prof CLIPPER instruction profile
#4 string pipe CLIPPER instruction trace
#4 string prof CLIPPER instruction profile

78
contrib/file/magic/Magdir/coff

@ -1,11 +1,11 @@
#------------------------------------------------------------------------------
# $File: coff,v 1.3 2018/08/01 10:34:03 christos Exp $
# $File: coff,v 1.6 2021/04/26 15:56:00 christos Exp $
# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures
#
# COFF
#
# by Joerg Jenderek at Oct 2015
# by Joerg Jenderek at Oct 2015, Feb 2021
# https://en.wikipedia.org/wiki/COFF
# https://de.wikipedia.org/wiki/Common_Object_File_Format
# http://www.delorie.com/djgpp/doc/coff/filhdr.html
@ -16,62 +16,78 @@
0 name display-coff
# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
>18 uleshort&0x8E80 0
>>0 clear x
# skip DOCTOR.DAILY READER.NDA REDBOX.ROOT by looking for positive number of sections
>>2 uleshort >0
# skip ega80woa.fnt svgafix.fnt HP3FNTS1.DAT HP3FNTS2.DAT INTRO.ACT LEARN.PIF by looking for low number of sections
>>>2 uleshort <4207
>>>>0 clear x
# f_magic - magic number
# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel)
>>0 uleshort 0x014C Intel 80386
>>>>0 uleshort 0x014C Intel 80386
# Hitachi SH big-endian COFF (./hitachi-sh)
>>0 uleshort 0x0500 Hitachi SH big-endian
>>>>0 uleshort 0x0500 Hitachi SH big-endian
# Hitachi SH little-endian COFF (./hitachi-sh)
>>0 uleshort 0x0550 Hitachi SH little-endian
>>>>0 uleshort 0x0550 Hitachi SH little-endian
# executable (RISC System/6000 V3.1) or obj module (./ibm6000)
#>>0 uleshort 0x01DF
#>>>>0 uleshort 0x01DF
# MS Windows COFF Intel Itanium, AMD64
# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=vs.85).aspx
>>0 uleshort 0x0200 Intel ia64
>>0 uleshort 0x8664 Intel amd64
>>>>0 uleshort 0x0200 Intel ia64
>>>>0 uleshort 0x8664 Intel amd64
# ARM COFF (./arm)
>>>>0 uleshort 0xaa64 Aarch64
>>>>0 uleshort 0x01c0 ARM
>>>>0 uleshort 0x01c2 ARM Thumb
>>>>0 uleshort 0x01c4 ARMv7 Thumb
# TODO for other COFFs
#>>0 uleshort 0xABCD COFF_TEMPLATE
>>0 default x
>>>0 uleshort x type 0x%04x
>>0 uleshort x COFF
#>>>>0 uleshort 0xABCD COFF_TEMPLATE
>>>>0 default x
>>>>>0 uleshort x type %#04x
>>>>0 uleshort x COFF
# F_EXEC flag bit
>>18 leshort ^0x0002 object file
#!:mime application/x-coff
#!:ext cof/o/obj/lib
>>18 leshort &0x0002 executable
>>>>18 leshort ^0x0002 object file
!:mime application/x-coff
!:ext o/obj/lib
# no cof sample found
#!:ext cof/o/obj/lib
>>>>18 leshort &0x0002 executable
#!:mime application/x-coffexec
# F_RELFLG flag bit,static object
>>18 leshort &0x0001 \b, no relocation info
>>>>18 leshort &0x0001 \b, no relocation info
# F_LNNO flag bit
>>18 leshort &0x0004 \b, no line number info
>>>>18 leshort &0x0004 \b, no line number info
# F_LSYMS flag bit
>>18 leshort &0x0008 \b, stripped
>>18 leshort ^0x0008 \b, not stripped
>>>>18 leshort &0x0008 \b, stripped
>>>>18 leshort ^0x0008 \b, not stripped
# flags in other COFF versions
#0x0010 F_FDPR_PROF
#0x0020 F_FDPR_OPTI
#0x0040 F_DSA
# F_AR32WR flag bit
#>>>18 leshort &0x0100 \b, 32 bit little endian
#>>>>18 leshort &0x0100 \b, 32 bit little endian
#0x1000 F_DYNLOAD
#0x2000 F_SHROBJ
#0x4000 F_LOADONLY
# f_nscns - number of sections
>>2 uleshort <2 \b, %d section
>>2 uleshort >1 \b, %d sections
# f_timdat - file time & date stamp only for little endian
#>>4 date x \b, %s
# f_nscns - number of sections like: 1 2 3 4 5 7 8 9 11 12 15 16 19 20 21 22 26 30 36 40 42 56 80 89 96 124
>>>>2 uleshort <2 \b, %u section
>>>>2 uleshort >1 \b, %u sections
# f_symptr - symbol table pointer, only for not stripped
>>8 ulelong >0 \b, symbol offset=0x%x
# like: 0 0x7c 0xf4 0x104 0x182 0x1c2 0x1c6 0x468 0x948 0x416e 0x149a6 0x1c9d8 0x23a68 0x35120 0x7afa0
>>>>8 ulelong >0 \b, symbol offset=%#x
# f_nsyms - number of symbols, only for not stripped
>>12 ulelong >0 \b, %d symbols
# f_opthdr - optional header size
>>16 uleshort >0 \b, optional header size %d
# like: 0 2 7 9 10 11 20 35 41 63 71 80 105 146 153 158 170 208 294 572 831 1546
>>>>12 ulelong >0 \b, %d symbols
# f_opthdr - optional header size. An object file should have a value of 0
>>>>16 uleshort >0 \b, optional header size %u
# f_timdat - file time & date stamp only for little endian
>>>>4 ledate >0 \b, created %s
# at offset 20 can be optional header, extra bytes FILHSZ-20 because
# do not rely on sizeof(FILHDR) to give the correct size for header.
# or first section header
# additional variables for other COFF files
>>>>16 uleshort =0
# first section name s_name[8] like: .text .data .debug$S .drectve .testseg
>>>>>20 string x \b, 1st section name "%.8s"
# >20 beshort 0407 (impure)
# >20 beshort 0410 (pure)
# >20 beshort 0413 (demand paged)

98
contrib/file/magic/Magdir/commands

@ -1,112 +1,132 @@
#------------------------------------------------------------------------------
# $File: commands,v 1.63 2020/06/06 15:36:30 christos Exp $
# $File: commands,v 1.66 2021/07/03 13:50:29 christos Exp $
# commands: file(1) magic for various shells and interpreters
#
#0 string/w : shell archive or script for antique kernel text
0 string/wt #!\ /bin/sh POSIX shell script text executable
0 string/fwt #!\ /bin/sh POSIX shell script text executable
!:mime text/x-shellscript
0 string/wb #!\ /bin/sh POSIX shell script executable (binary data)
0 string/fwb #!\ /bin/sh POSIX shell script executable (binary data)
!:mime text/x-shellscript
0 string/wt #!\ /bin/csh C shell script text executable
0 string/fwt #!\ /bin/csh C shell script text executable
!:mime text/x-shellscript
# korn shell magic, sent by George Wu, gwu@clyde.att.com
0 string/wt #!\ /bin/ksh Korn shell script text executable
0 string/fwt #!\ /bin/ksh Korn shell script text executable
!:mime text/x-shellscript
0 string/wb #!\ /bin/ksh Korn shell script executable (binary data)
0 string/fwb #!\ /bin/ksh Korn shell script executable (binary data)
!:mime text/x-shellscript
0 string/wt #!\ /bin/tcsh Tenex C shell script text executable
0 string/fwt #!\ /bin/tcsh Tenex C shell script text executable
!:mime text/x-shellscript
0 string/wt #!\ /usr/bin/tcsh Tenex C shell script text executable
0 string/fwt #!\ /usr/bin/tcsh Tenex C shell script text executable
!:mime text/x-shellscript
0 string/wt #!\ /usr/local/tcsh Tenex C shell script text executable
0 string/fwt #!\ /usr/local/tcsh Tenex C shell script text executable
!:mime text/x-shellscript
0 string/wt #!\ /usr/local/bin/tcsh Tenex C shell script text executable
0 string/fwt #!\ /usr/local/bin/tcsh Tenex C shell script text executable
!:mime text/x-shellscript
#
# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
0 string/wt #!\ /bin/zsh Paul Falstad's zsh script text executable
0 string/fwt #!\ /bin/zsh Paul Falstad's zsh script text executable
!:mime text/x-shellscript
0 string/wt #!\ /usr/bin/zsh Paul Falstad's zsh script text executable
0 string/fwt #!\ /usr/bin/zsh Paul Falstad's zsh script text executable
!:mime text/x-shellscript
0 string/wt #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable
0 string/fwt #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable
!:mime text/x-shellscript
0 search/1 #!/usr/bin/env\ zsh Paul Falstad's zsh script text executable
!:mime text/x-shellscript
0 string/wt #!\ /usr/local/bin/ash Neil Brown's ash script text executable
0 string/fwt #!\ /bin/ash Neil Brown's ash script text executable
!:mime text/x-shellscript
0 string/wt #!\ /usr/local/bin/ae Neil Brown's ae script text executable
0 string/fwt #!\ /usr/bin/ash Neil Brown's ash script text executable
!:mime text/x-shellscript
0 string/wt #!\ /bin/nawk new awk script text executable
0 string/fwt #!\ /usr/local/bin/ash Neil Brown's ash script text executable
!:mime text/x-shellscript
0 string/fwt #!\ /usr/local/bin/ae Neil Brown's ae script text executable
!:mime text/x-shellscript
0 string/fwt #!\ /bin/nawk new awk script text executable
!:mime text/x-nawk
0 string/wt #!\ /usr/bin/nawk new awk script text executable
0 string/fwt #!\ /usr/bin/nawk new awk script text executable
!:mime text/x-nawk
0 string/wt #!\ /usr/local/bin/nawk new awk script text executable
0 string/fwt #!\ /usr/local/bin/nawk new awk script text executable
!:mime text/x-nawk
0 string/wt #!\ /bin/gawk GNU awk script text executable
0 string/fwt #!\ /bin/gawk GNU awk script text executable
!:mime text/x-gawk
0 string/wt #!\ /usr/bin/gawk GNU awk script text executable
!:mime text/x-gawk
0 string/wt #!\ /usr/local/bin/gawk GNU awk script text executable
0 string/fwt #!\ /usr/local/bin/gawk GNU awk script text executable
!:mime text/x-gawk
#
0 string/wt #!\ /bin/awk awk script text executable
0 string/fwt #!\ /bin/awk awk script text executable
!:mime text/x-awk
0 string/wt #!\ /usr/bin/awk awk script text executable
0 string/fwt #!\ /usr/bin/awk awk script text executable
!:mime text/x-awk
0 regex/4096 =^[\040\t\f\r\n]{0,100}BEGIN[\040\t\f\r\n]{0,100}[{] awk or perl script text
# AT&T Bell Labs' Plan 9 shell
0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable
0 string/fwt #!\ /bin/rc Plan 9 rc shell script text executable
# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
0 string/wt #!\ /bin/bash Bourne-Again shell script text executable
0 string/fwt #!\ /bin/bash Bourne-Again shell script text executable
!:mime text/x-shellscript
0 string/wb #!\ /bin/bash Bourne-Again shell script executable (binary data)
0 string/fwb #!\ /bin/bash Bourne-Again shell script executable (binary data)
!:mime text/x-shellscript
0 string/wt #!\ /usr/bin/bash Bourne-Again shell script text executable
0 string/fwt #!\ /usr/bin/bash Bourne-Again shell script text executable
!:mime text/x-shellscript
0 string/wb #!\ /usr/bin/bash Bourne-Again shell script executable (binary data)
0 string/fwb #!\ /usr/bin/bash Bourne-Again shell script executable (binary data)
!:mime text/x-shellscript
0 string/wt #!\ /usr/local/bash Bourne-Again shell script text executable
0 string/fwt #!\ /usr/local/bash Bourne-Again shell script text executable
!:mime text/x-shellscript
0 string/wb #!\ /usr/local/bash Bourne-Again shell script executable (binary data)
0 string/fwb #!\ /usr/local/bash Bourne-Again shell script executable (binary data)
!:mime text/x-shellscript
0 string/wt #!\ /usr/local/bin/bash Bourne-Again shell script text executable
0 string/fwt #!\ /usr/local/bin/bash Bourne-Again shell script text executable
!:mime text/x-shellscript
0 string/wb #!\ /usr/local/bin/bash Bourne-Again shell script executable (binary data)
0 string/fwb #!\ /usr/local/bin/bash Bourne-Again shell script executable (binary data)
!:mime text/x-shellscript
0 string/wt #!\ /usr/bin/env\ bash Bourne-Again shell script text executable
0 string/fwt #!\ /usr/bin/env\ bash Bourne-Again shell script text executable
!:mime text/x-shellscript
# Fish shell magic
# From: Benjamin Lowry <ben@ben.gmbh>
0 string/wt #!\ /usr/local/bin/fish fish shell script text executable
0 string/fwt #!\ /usr/local/bin/fish fish shell script text executable
!:mime text/x-shellscript
0 string/wt #!\ /usr/bin/fish fish shell script text executable
0 string/fwt #!\ /usr/bin/fish fish shell script text executable
!:mime text/x-shellscript
0 string/wt #!\ /usr/bin/env\ fish fish shell script text executable
0 string/fwt #!\ /usr/bin/env\ fish fish shell script text executable
!:mime text/x-shellscript
0 string/wt #!\ a
>&-1 string x %s script text executable
0 search/1/wt #!\ /usr/bin/tclsh Tcl/Tk script text executable
0 search/1/fwt #!\ /usr/bin/tclsh Tcl/Tk script text executable
!:mime text/x-tcl
0 search/1/wt #!\ /usr/bin/texlua LuaTex script text executable
0 search/1/fwt #!\ /usr/bin/texlua LuaTex script text executable
!:mime text/x-luatex
0 search/1/wt #!\ /usr/bin/luatex LuaTex script text executable
0 search/1/fwt #!\ /usr/bin/luatex LuaTex script text executable
!:mime text/x-luatex
0 search/1/wt #!\ /usr/bin/stap Systemtap script text executable
0 search/1/fwt #!\ /usr/bin/stap Systemtap script text executable
!:mime text/x-systemtap
# From: Kylie McClain <kylie@somas.is>
# Type: execline scripts
# URL: https://skarnet.org/software/execline/
0 string/fwt #!\ /command/execlineb execline script text executable
!:mime text/x-execline
0 string/fwt #!\ /bin/execlineb execline script text executable
!:mime text/x-execline
0 string/fwt #!\ /usr/bin/execlineb execline script text executable
!:mime text/x-execline
0 string/fwt #!\ /usr/bin/env\ execlineb execline script text executable
!:mime text/x-execline
0 string #!
>0 regex \^#!.*/bin/execlineb([[:space:]].*)*$ execline script text executable
!:mime text/x-execline
# PHP scripts
# Ulf Harnhammar <ulfh@update.uu.se>

9
contrib/file/magic/Magdir/compress

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: compress,v 1.79 2020/05/30 23:53:04 christos Exp $
# $File: compress,v 1.82 2021/06/30 08:11:29 christos Exp $
# compress: file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
@ -264,14 +264,19 @@
>>5 lequad !0xffffffffffffffff non-streamed, size %lld
# http://tukaani.org/xz/xz-file-format.txt
0 ustring \xFD7zXZ\x00 XZ compressed data
0 ustring \xFD7zXZ\x00 XZ compressed data, checksum
!:strength * 2
!:mime application/x-xz
>7 byte&0xf 0x0 NONE
>7 byte&0xf 0x1 CRC32
>7 byte&0xf 0x4 CRC64
>7 byte&0xf 0xa SHA-256
# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt
0 string LRZI LRZIP compressed data
>4 byte x - version %d
>5 byte x \b.%d
>22 byte 1 \b, encrypted
!:mime application/x-lrzip
# https://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html

62
contrib/file/magic/Magdir/console

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: console,v 1.55 2020/04/19 17:30:55 christos Exp $
# $File: console,v 1.63 2021/04/26 15:56:00 christos Exp $
# Console game magic
# Toby Deshane <hac@shoelace.digivill.net>
@ -125,6 +125,7 @@
>0x14c byte x (Rev.%02u)
# Machine type. (SGB, CGB, SGB+CGB)
# Old licensee code 0x33 is required for SGB, but not CGB.
>0x14b byte 0x33
>>0x146 byte 0x03
>>>0x143 byte&0x80 0x80 [SGB+CGB]
@ -133,6 +134,8 @@
>>>0x143 byte&0xC0 0x80 [CGB]
>>>0x143 byte&0xC0 0xC0 [CGB ONLY]
>0x14b byte !0x33
>>0x143 byte&0xC0 0x80 [CGB]
>>0x143 byte&0xC0 0xC0 [CGB ONLY]
# Mapper.
>0x147 byte 0x00 [ROM ONLY]
@ -178,7 +181,7 @@
# RAM size.
>0x149 byte 1 \b, RAM: 16Kbit
>0x149 byte 2 \b, RAM: 64Kbit
>0x149 byte 3 \b, RAM: 128Kbit
>0x149 byte 3 \b, RAM: 256Kbit
>0x149 byte 4 \b, RAM: 1Mbit
>0x149 byte 5 \b, RAM: 512Kbit
@ -486,17 +489,17 @@
#------------------------------------------------------------------------------
# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
0 string PS-X\ EXE Sony Playstation executable
>16 lelong x PC=0x%08x,
>20 lelong !0 GP=0x%08x,
>24 lelong !0 .text=[0x%08x,
>>28 lelong x \b0x%x],
>32 lelong !0 .data=[0x%08x,
>>36 lelong x \b0x%x],
>40 lelong !0 .bss=[0x%08x,
>>44 lelong x \b0x%x],
>48 lelong !0 Stack=0x%08x,
>16 lelong x PC=%#08x,
>20 lelong !0 GP=%#08x,
>24 lelong !0 .text=[%#08x,
>>28 lelong x \b%#x],
>32 lelong !0 .data=[%#08x,
>>36 lelong x \b%#x],
>40 lelong !0 .bss=[%#08x,
>>44 lelong x \b%#x],
>48 lelong !0 Stack=%#08x,
>48 lelong =0 No Stack!,
>52 lelong !0 StackSize=0x%x,
>52 lelong !0 StackSize=%#x,
#>76 string >\0 (%s)
# Area:
>113 string x (%s)
@ -768,7 +771,7 @@
>>>>0x40 leshort !0
>>>>>0x40 lestring16 x \b, metadata: "%s"
>>0x17 byte &0x40 \b, ROM:
>>>(0x18.l-26) lelong x CRC32 0x%08x
>>>(0x18.l-26) lelong x CRC32 %#08x
>>>(0x18.l-23) string x "%s"
# Type: scummVM savegame files
@ -1003,6 +1006,11 @@
# Reference: https://3dbrew.org/wiki/3DSX_Format
0 string 3DSX Nintendo 3DS Homebrew Application (3DSX)
# Type: Nintendo 3DS Banner Model Data.
# From: David Korth <gerbilsoft@gerbilsoft.com>
# Reference: https://3dbrew.org/wiki/CBMD
0 string CBMD\0\0\0\0 Nintendo 3DS Banner Model Data
#------------------------------------------------------------------------------
# a7800: file(1) magic for the Atari 7800 raw ROM format.
# From: David Korth <gerbilsoft@gerbilsoft.com>
@ -1101,3 +1109,31 @@
>0x2C byte >0x20 Nintendo Badge Arcade badge set:
>>0x2C string x "%.48s"
>>0x24 ulelong x \b, set ID: %u
#------------------------------------------------------------------------------
# sufami: file(1) magic for Sufami Turbo ROM images.
# From: David Korth <gerbilsoft@gerbilsoft.com>
# References:
# - https://problemkaputt.de/fullsnes.htm#snescartsufamiturbominicartridgeadaptor
0 string BANDAI\ SFC-ADX
>0x10 string !SFC-ADX\ BACKUP Sufami Turbo ROM image:
>>0x10 string/T x "%.14s"
>>0x30 byte x \b, ID %02X
>>0x31 byte x \b%02X
>>0x32 byte x \b%02X
>>0x33 ubyte >0 \b, series index %u
>>0x34 ubyte 0 [SlowROM]
>>0x34 ubyte 1 [FastROM]
>>0x35 ubyte 1 [SRAM]
>>0x35 ubyte 3 [Special]
# Type: Nintendo GameCube/Wii disc image (RVZ format)
0 string RVZ\001 Nintendo
>0x48 belong 1 GameCube
!:mime application/x-gamecube-rom
>0x48 belong 2 Wii
!:mime application/x-wii-rom
>0x48 default x GameCube/Wii
>0x48 belong x disc image (RVZ format):
>>0x58 use nintendo-gcn-disc-common

4
contrib/file/magic/Magdir/coverage

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: coverage,v 1.2 2019/04/19 00:42:27 christos Exp $
# $File: coverage,v 1.3 2021/02/23 00:51:10 christos Exp $
# xoverage: file(1) magic for test coverage data
# File formats used to store test coverage data
@ -55,7 +55,7 @@
# Coverage reports generated by gcov
# i.e. source code annoted with coverage information
# i.e. source code annotated with coverage information
0 string \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Source:
>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Graph:
>>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Data: GCOV coverage report

5
contrib/file/magic/Magdir/crypto Normal file

@ -0,0 +1,5 @@
#------------------------------------------------------------------------------
# $File: crypto,v 1.2 2021/03/27 20:15:53 christos Exp $
# crypto: file(1) magic for crypto formats
#

212
contrib/file/magic/Magdir/database

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: database,v 1.59 2020/03/25 01:49:58 christos Exp $
# $File: database,v 1.63 2021/10/04 00:44:30 christos Exp $
# database: file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
@ -181,7 +181,10 @@
#!:mime application/x-dbase
>>>>>>>>>>>>0 use xbase-type
# database file
>>>>>>>>>>>>0 ubyte x \b DBF
>>>>>>>>>>>>28 ubyte&0x04 =0 \b DBF
!:ext dbf
>>>>>>>>>>>>28 ubyte&0x04 =4 \b DataBaseContainer
!:ext dbc
>>>>>>>>>>>>4 lelong 0 \b, no records
>>>>>>>>>>>>4 lelong >0 \b, %d record
# plural s appended
@ -193,13 +196,14 @@
>>>>>>>>>>>>1 ubyte x \b, update-date
>>>>>>>>>>>>1 use xbase-date
# https://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
#>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x
#>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=%#x
# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ?
>>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x
>>>>>>>>>>>>29 ubyte >0 \b, codepage ID=%#x
#>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file
# MDX or CDX index
>>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX
>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT
>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer
#>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer
# 1st record offset + 1 = header size
>>>>>>>>>>>>8 uleshort >0
>>>>>>>>>>>>(8.s+1) ubyte >0
@ -241,72 +245,111 @@
# 1 < version
>0 ubyte >1
>>0 ubyte 0x02 FoxBase
!:mime application/x-dbf
# like: ACCESS.DBF USER.DBF dbase3date.dbf mitarbei.dbf produkte.dbf umlaut-test-v2.dbf
# FoxBase+/dBaseIII+, no memo
>>0 ubyte 0x03 FoxBase+/dBase III
!:mime application/x-dbf
# like: 92DATA.DBF MSCATLOG.DBF SYLLABI2.DBF SYLLABUS.DBF T4.DBF Teleadr.dbf us_city.dbf
# dBASE IV no memo file
>>0 ubyte 0x04 dBase IV
!:mime application/x-dbf
# like: Quattro-test11.dbf umlaut-test-v4.dbf
# dBASE V no memo file
>>0 ubyte 0x05 dBase V
!:mime application/x-dbf
# like: dbase4double.dbf Quattro-test2.dbf umlaut-test7.dbf
!:ext dbf
# probably Apollo Database Server 9.7? xBase (0x6)
>>0 ubyte 0x06 Apollo
!:mime application/x-dbf
# like: ALIAS.DBF CRYPT.DBF PROCS.DBF USERS.DBF
# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
>>0 ubyte 0x2F FoxBase+/Dbase III plus, no memo
!:mime application/x-dbf
# no example
>>0 ubyte 0x30 Visual FoxPro
!:mime application/x-dbf
# like: 26FRX.DBF 30DBC.DBF 30DBCPRO.DBF BEHINDSC.DBF USER_LEV.DBF
# Microsoft Visual FoxPro Database Container File like: FOXPRO-DB-TEST.DBC TESTDATA.DBC TASTRADE.DBC
>>0 ubyte 0x31 Visual FoxPro, autoincrement
!:mime application/x-dbf
# like: AI_Table.DBF dbase_31.dbf w_cityFoxpro.dbf
# Visual FoxPro, with field type Varchar or Varbinary
>>0 ubyte 0x32 Visual FoxPro, with field type Varchar
!:mime application/x-dbf
# like: dbase_32.dbf
# dBASE IV SQL, no memo;dbv memo var size (Flagship)
>>0 ubyte 0x43 dBase IV, with SQL table
!:mime application/x-dbf
# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#>>0 ubyte 0x62 dBase IV, with SQL table
# like: ASSEMBLY.DBF INVENTRY.DBF STAFF.DBF
# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
>>0 ubyte 0x62 dBase IV, with SQL table
#!:mime application/x-dbf
# no example
# dBASE IV, with memo!!
>>0 ubyte 0x7b dBase IV, with memo
!:mime application/x-dbf
# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#>>0 ubyte 0x82 dBase IV, with SQL system
# like: test3memo.DBF dbase5.DBF
# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
>>0 ubyte 0x82 dBase IV, with SQL system
#!:mime application/x-dbf
# no example
# FoxBase+/dBaseIII+ with memo .DBT!
>>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT
!:mime application/x-dbf
# like: T2.DBF t3.DBF biblio.dbf dbase_83.dbf dbase3dbt0_4.dbf fsadress.dbf stop.dbf
# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file
>>0 ubyte 0x87 VISUAL OBJECTS, with memo file
!:mime application/x-dbf
# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT
# like: ACCESS.DBF dbase3date.dbf dbase3float.dbf holdings.dbf mitarbei.dbf
# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT
#!:mime application/x-dbf
# no example
# dBASE IV with memo!
>>0 ubyte 0x8B dBase IV, with memo .DBT
!:mime application/x-dbf
# like: animals.dbf archive.dbf callin.dbf dbase_8b.dbf phnebook.dbf t6.dbf
# dBase IV with SQL Table,no memo?
>>0 ubyte 0x8E dBase IV, with SQL table
!:mime application/x-dbf
# like: dbase5.DBF test3memo.DBF test-memo.DBF
# .dbv and .dbt memo (Flagship)?
>>0 ubyte 0xB3 Flagship
# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#>>0 ubyte 0xCA dBase IV with memo .DBT
!:mime application/x-dbf
# no example
# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
>>0 ubyte 0xCA dBase IV with memo .DBT
#!:mime application/x-dbf
# no example
# dBASE IV with SQL table, with memo .DBT
>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT
!:mime application/x-dbf
# like: dbase5.DBF test3memo.DBF test-memo.DBF
# HiPer-Six format;Clipper SIX, with SMT memo file
>>0 ubyte 0xE5 Clipper SIX with memo
!:mime application/x-dbf
# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#>>0 ubyte 0xF4 dBase IV, with SQL table, with memo
# like: dbase5.DBF test3memo.DBF test-memo.DBF testClipper.dbf DATA.DBF
# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
>>0 ubyte 0xF4 dBase IV, with SQL table, with memo
#!:mime application/x-dbf
# no example
>>0 ubyte 0xF5 FoxPro with memo
!:mime application/x-dbf
# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
# like: CUSTOMER.DBF FOXUSER1.DBF Invoice.DBF NG.DBF OBJSAMP.DBF dbase_f5.dbf kunde.dbf
# probably Apollo Database Server 9.7 with SQL and memo mask? xBase (0xF6)
>>0 ubyte 0xF6 Apollo, with SQL table with memo
!:mime application/x-dbf
# like: SCRIPTS.DBF
# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
#>>0 ubyte 0xFA FoxPro 2.x, with memo
#!:mime application/x-dbf
# no example
# unknown version (should not happen)
>>0 default x xBase
!:mime application/x-dbf
>>>0 ubyte x (0x%x)
>>>0 ubyte x (%#x)
# flags in version byte
# DBT flag (with dBASE III memo .DBT)!!
# >>0 ubyte&0x80 >0 DBT_FLAG=%x
@ -393,7 +436,7 @@
# Number of next available block for appending data
#>0 lelong =0 \b, next free block index %u
>0 lelong !0 \b, next free block index %u
# no positiv block length
# no positive block length
#>20 uleshort =0 \b, block length %u
>20 uleshort !0 \b, block length %u
# dBase III memo field terminated by \032\032
@ -404,7 +447,7 @@
>0 lelong x dBase IV DBT
!:mime application/x-dbt
!:ext dbt
# 8 character shorted main name of coresponding dBASE IV DBF file
# 8 character shorted main name of corresponding dBASE IV DBF file
>8 ubelong >0x20000000
# skip unusual like for angest.dbt
>>20 uleshort >0
@ -455,10 +498,131 @@
>>516 belong >0 \b, field length %d
>>>520 string >\0 \b, 1st item "%s"
# Summary: DBASE Compound Index file *.CDX and FoxPro index *.IDX
# From: Joerg Jenderek
# URL: https://www.clicketyclick.dk/databases/xbase/format/cdx.html
# https://www.clicketyclick.dk/databases/xbase/format/idx.html
# https://www.clicketyclick.dk/databases/xbase/format/idx_comp.html
# Reference: https://mark0.net/download/triddefs_xml.7z/defs/s/sybase-ianywhere-cdx.trid.xml
# https://mark0.net/download/triddefs_xml.7z/defs/c/cdx-vfp7.trid.xml
# like: kunde.cdx
0 ulelong 0x1C00
>0 use xbase-index
# like: SYLLABI2.CDX SYLLABUS.CDX
0 ulelong 0x0800
>0 use xbase-index
# often in xBase index pointer to root node 400h
0 ulelong 0x0400
# skip most Maple help database *.hdb with version tag handled by ./maple
>1028 string !version
# skip Maple help database hsum.hdb checking for valid reserved area
>>492 quad =0
# skip remaining Maple help database *.hdb by checking key length
#>>>12 uleshort !0x000F KEY_LENGTHVALID
>>>0 use xbase-index
# display information about dBase/FoxPro index
0 name xbase-index
>0 ulelong x xBase
!:mime application/x-dbase-index
>14 ubyte &0x40 compound index
# DCX for FoxPro database index like: TESTDATA.DCX
!:ext cdx/dcx
>14 ubyte ^0x40 index
# only 1 example like: TEST.IDX
!:ext idx
# pointer to root node like: 1C00h 800h often 400h
>0 ulelong !0x400 \b, root pointer %#x
# Pointer to free node list: often 0 but -1 if not present
>4 ulelong !0 \b, free node pointer %#x
# MAYBE number of pages in file (Foxbase, FoxPro 1.x) or
# http://www.foxpert.com/foxpro/knowlbits/files/knowlbits_200708_1.HTM
# Whenever Visual FoxPro updates the index file it increments this reserved field
# Reserved for internal use like: 02000000h 03000000h 460c0000h 780f0000h 89000000h 9fdc0100h often 0
>8 ulelong !0 \b, reserved counter %#x
# length of key like: mostly 000Ah 0028h (TEST.IDX)
>12 uleshort !0x000A \b, key length %#x
# index options like: 24h E0h E8h
# 1~a unique index 8~index has FOR clause 32~compact index format 64~compound index header
# 16~Bit vector (SoftC) 128~Structure index (FoxPro)
>14 ubyte x \b, index options (%#x
>14 ubyte &0x01 \b, unique
>14 ubyte &0x08 \b, has FOR clause
>14 ubyte &0x10 \b, bit vector (SoftC)
>14 ubyte &0x20 \b, compact format
#>14 ubyte &0x40 \b, compound header
>14 ubyte &0x80 \b, structure
>14 ubyte x \b)
# WHAT EXACTLY IS THAT? index signature like: 0 (sybase-ianywhere-cdx.trid.xml) 1 (cdx-vfp7.trid.xml)
>15 ubyte !0 \b, index signature %u
# reserved area (0-bytes) til about 500, but not for uncompressed Index files *.idx
>16 quad !0 \b, at 16 reserved %#llx
>492 quad !0 \b, at 492 reserved %#llx
# for IDX variant
#>14 ubyte ^0x40 IDX
# for CDX variant
>14 ubyte &0x40
# Ascending or descending: 0~ascending 1~descending
>>502 uleshort x \b, sort order %u
# Total expression length (FoxPro 2) like: 0 1
>>504 uleshort !0 \b, expression length %u
# FOR expression pool length like: 1
>>506 uleshort !1 \b, FOR expression pool length %#x
# reserved for internal use like: 0
>>508 uleshort !0 \b, at 0x508 reserved %#x
# Key expression pool length like: 1
>>510 uleshort !1 \b, key expression pool length %#x
# 512 - 1023 Key & FOR expression pool (uncompiled)
>>512 quad !0 \b, key expression pool %#llx
#>>520 quad !0 \b, key expression pool %#llx
# Summary: dBASE IV Printer Form *.PRF
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/.dbf#Other_file_types_found_in_dBASE
# Reference: https://mark0.net/download/triddefs_xml.7z/defs/p/prf-dbase.trid.xml
0 ubeshort 0x0400
# skip some Xbase Index files *.ndx and Infocom (Z-machine 4) *.z4 handled by ./adventure
# by looking for valid printer driver name extension
>0x58 search/8 .PR2
>>0 use xbase-prf
# display information of dbase print form like printer driver *.PR2
0 name xbase-prf dBase Printer Form
!:mime application/x-dbase-prf
!:ext prf
# MAYBE version? like: 4~DBASE IV
#>0 ubyte x \b, version %u
# MAYBE flag like: 1~with output file name 0~not
#>2 ubyte !0 \b, flag %u
# optional printer text output file name like E:\DBASE\IV\T6.txt
>3 string >\0 \b, output file %s
# probably padding with nils til 0x53
#>0x48 uquad !0 \b, at 0x48 padding %#llx
# dBASE IV printer driver name like: Generic.PR2 ASCII.PR2
>0x56 string >\0 \b, using printer driver %s
# 2 is probably last character of previous dBASE printer driver name
#>0x60 ubyte !0x32 \b, at 0x60 %#x
# probably padding with nils til 0xa8
#>0x61 uquad !0 \b, at 0x61 padding %#llx
# unknown 0x03020300 0x03020100 at 0xa8
>0xa8 ubelong x \b, at 0xa8 unknown %#8.8x
# probably padding with nils til 0x2aa
#>0x2a0 uquad !0 \b, at 0x2a0 padding %#llx
# unknown 0x100ff7f01000001 at 0x2AB
>0x2ab ubequad !0x100ff7f01000001 \b, at 0x2ab unknown %#llx
# unknown 0x0042 at 0x2b3
>0x2b3 ubeshort !0x0042 \b, at 0x2b3 unknown %#4.4x
# unknown last 4 bytes at 0x2b6 like: 0 0x23
>0x2b6 ubelong !0 \b, at 0x2b6 unknown %#8.8x
# TODO:
# DBASE index file *.NDX
# DBASE Compound Index file *.CDX
# dBASE IV Printer Driver *.PRF
# dBASE compiled Format *.FMO
# FoxPro Database memo file *.DCT
# FoxPro Forms Memo *.SCT
# FoxPro Generated Menu Program *.MPR
# FoxPro Report *.FRX
# FoxPro Report Memo *.FRT
# Foxpro Generated Screen Program *.SPR
# Foxpro memo *.PJT
## End of XBase database stuff
# MS Access database
@ -485,9 +649,9 @@
>>12 ulelong 1 STreaMing
!:ext stm
# format_version 620h
>>8 uleshort x \b, version 0x%x
>>10 uleshort >0 revision 0x%4.4x
>>0 ubelong x \b, checksum 0x%8.8x
>>8 uleshort x \b, version %#x
>>10 uleshort >0 revision %#4.4x
>>0 ubelong x \b, checksum %#8.8x
# Page size 4096 8192 32768
>>236 ulequad x \b, page size %lld
# database_state

7
contrib/file/magic/Magdir/der

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: der,v 1.3 2020/02/16 20:45:21 christos Exp $
# $File: der,v 1.4 2021/03/14 17:12:04 christos Exp $
# der: file(1) magic for DER encoded files
#
@ -117,8 +117,9 @@
0 der seq
>&0 der seq
>>&0 der eoc Certificate
>>>&0 der int1=02 \b, Version=3
>>&0 der eoc
>>>&0 der int1=02 Certificate, Version=3
>>>&0 der int1=x Certificate, Version=%s
>>&0 der int9=x \b, Serial=%s
>>&0 der seq
>>>&0 der obj_id9=2a864886f70d01010b

15
contrib/file/magic/Magdir/diff

@ -1,11 +1,12 @@
#------------------------------------------------------------------------------
# $File: diff,v 1.16 2017/03/17 22:20:22 christos Exp $
# $File: diff,v 1.17 2020/08/22 18:16:58 christos Exp $
# diff: file(1) magic for diff(1) output
#
0 search/1 diff\040 diff output text
!:mime text/x-diff
0 search/1 ***\040 diff output text
0 search/1 ***\040
>&0 search/1024 \n---\040 context diff output text
!:mime text/x-diff
0 search/1 Only\040in\040 diff output text
!:mime text/x-diff
@ -16,15 +17,15 @@
!:mime text/x-diff
# bsdiff: file(1) magic for bsdiff(1) output
0 string/b BSDIFF40 bsdiff(1) patch file
0 string/b BSDIFF40 bsdiff(1) patch file
# unified diff
0 search/4096 ---\040
>&0 search/1024 \n
>>&0 search/1 +++\040
>>>&0 search/1024 \n
>>>>&0 search/1 @@ unified diff output text
>&0 search/1024 \n
>>&0 search/1 +++\040
>>>&0 search/1024 \n
>>>>&0 search/1 @@ unified diff output text
!:mime text/x-diff
!:strength + 90

3
contrib/file/magic/Magdir/digital

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: digital,v 1.11 2013/01/11 16:45:23 christos Exp $
# $File: digital,v 1.12 2021/07/03 14:01:46 christos Exp $
# Digital UNIX - Info
#
0 string =!<arch>\n________64E Alpha archive
@ -53,6 +53,7 @@
#
# Locale data tables (MIPS and Alpha).
#
# GRR: line below is too general as it matches also TTComp archive, ASCII, 2K handled by ./archive
0 short 0x0501 locale data table
>6 short 0x24 for MIPS
>6 short 0x40 for Alpha

6
contrib/file/magic/Magdir/editors

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: editors,v 1.11 2017/03/17 21:35:28 christos Exp $
# $File: editors,v 1.12 2020/10/11 20:28:07 christos Exp $
# T602 editor documents
# by David Necas <yeti@physics.muni.cz>
0 string @CT\ T602 document data,
@ -11,7 +11,11 @@
# Vi IMproved Encrypted file
# by David Necas <yeti@physics.muni.cz>
# updated by Osman Surkatty
0 string VimCrypt~ Vim encrypted file data
>9 string 01! with zip cryptmethod
>9 string 02! with blowfish cryptmethod
>9 string 03! with blowfish2 cryptmethod
0 name vimnanoswap
>67 byte 0

45
contrib/file/magic/Magdir/elf

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: elf,v 1.80 2020/02/12 22:17:33 christos Exp $
# $File: elf,v 1.87 2021/05/25 15:19:51 christos Exp $
# elf: file(1) magic for ELF executables
#
# We have to check the byte order flag to see what byte order all the
@ -43,6 +43,14 @@
>2 leshort 0x0214 2.0
>0 leshort &0x0008 (LP64)
0 name elf-riscv
>0 lelong&0x00000001 0x00000001 RVC,
>0 lelong&0x00000008 0x00000008 RVE,
>0 lelong&0x00000006 0x00000000 soft-float ABI,
>0 lelong&0x00000006 0x00000002 single-float ABI,
>0 lelong&0x00000006 0x00000004 double-float ABI,
>0 lelong&0x00000006 0x00000006 quad-float ABI,
0 name elf-le
>16 leshort 0 no file type,
!:mime application/octet-stream
@ -62,7 +70,12 @@
# Core file detection is not reliable.
#>>>(0x38+0xcc) string >\0 of '%s'
#>>>(0x38+0x10) lelong >0 (signal %d),
>16 leshort &0xff00 processor-specific,
>16 leshort &0xff00
>>18 leshort !8 processor-specific,
>>18 leshort 8
>>>16 leshort 0xFF80 PlayStation 2 IOP module,
!:mime application/x-sharedlib
>>>16 leshort !0xFF80 processor-specific,
>18 clear x
>18 leshort 0 no machine,
>18 leshort 1 AT&T WE32100,
@ -182,7 +195,7 @@
>18 leshort 90 Matsushita MN10200,
>18 leshort 91 picoJava,
>18 leshort 92 OpenRISC,
>18 leshort 93 ARC Cores Tangent-A5,
>18 leshort 93 Synopsys ARCompact ARC700 cores,
>18 leshort 94 Tensilica Xtensa,
>18 leshort 95 Alphamosaic VideoCore,
>18 leshort 96 Thompson Multimedia,
@ -221,6 +234,7 @@
>18 leshort 140 TI TMS320C6000 DSP family,
>18 leshort 141 TI TMS320C2000 DSP family,
>18 leshort 142 TI TMS320C55x DSP family,
>18 leshort 144 TI Programmable Realtime Unit
>18 leshort 160 STMicroelectronics 64bit VLIW DSP,
>18 leshort 161 Cypress M8C,
>18 leshort 162 Renesas R32C series,
@ -251,6 +265,7 @@
>18 leshort 189 Xilinx MicroBlaze 32-bit RISC,
>18 leshort 190 NVIDIA CUDA architecture,
>18 leshort 191 Tilera TILE-Gx,
>18 leshort 195 Synopsys ARCv2/HS3x/HS4x cores,
>18 leshort 197 Renesas RL78 family,
>18 leshort 199 Renesas 78K0R,
>18 leshort 200 Freescale 56800EX,
@ -268,8 +283,28 @@
>18 leshort 217 iCelero CoolEngine,
>18 leshort 218 Nanoradio Optimized RISC,
>18 leshort 243 UCB RISC-V,
# only for 32-bit
>>4 byte 1
>>>36 use elf-riscv
# only for 64-bit
>>4 byte 2
>>>48 use elf-riscv
>18 leshort 244 Lanai 32-bit processor,
>18 leshort 245 CEVA Processor Architecture Family,
>18 leshort 246 CEVA X2 Processor Family,
>18 leshort 247 eBPF,
>18 leshort 251 NEC VE,
>18 leshort 248 Graphcore Intelligent Processing Unit,
>18 leshort 249 Imagination Technologies,
>18 leshort 250 Netronome Flow Processor,
>18 leshort 251 NEC Vector Engine,
>18 leshort 252 C-SKY processor family,
>18 leshort 253 Synopsys ARCv3 64-bit ISA/HS6x cores,
>18 leshort 254 MOS Technology MCS 6502 processor,
>18 leshort 255 Synopsys ARCv3 32-bit,
>18 leshort 256 Kalray VLIW core of the MPPA family,
>18 leshort 257 WDC 65816/65C816,
>18 leshort 258 LoongArch,
>18 leshort 259 ChipON KungFu32,
>18 leshort 0x1057 AVR (unofficial),
>18 leshort 0x1059 MSP430 (unofficial),
>18 leshort 0x1223 Adapteva Epiphany (unofficial),
@ -299,7 +334,7 @@
>18 leshort 0xfebb NIOS (unofficial),
>18 leshort 0xfeed Moxie (unofficial),
>18 default x
>>18 leshort x *unknown arch 0x%x*
>>18 leshort x *unknown arch %#x*
>20 lelong 0 invalid version
>20 lelong 1 version 1

4
contrib/file/magic/Magdir/espressif

@ -1,5 +1,5 @@
# $File: espressif,v 1.2 2019/11/15 21:03:14 christos Exp $
# $File: espressif,v 1.3 2021/04/26 15:56:00 christos Exp $
# configuration dump of Tasmota firmware for ESP8266 based devices by Espressif
# URL: https://github.com/arendst/Sonoff-Tasmota/
# Reference: https://codeload.github.com/arendst/Sonoff-Tasmota/zip/release-6.2/
@ -17,7 +17,7 @@
>>10 ubyte^0x64 x \b.%u
>>9 ubyte^0x63 x \b.%u
>>8 ubyte^0x62 x \b.%u
#>8 ubelong x (0x%x)
#>8 ubelong x (%#x)
# hostname[33] XORed
>>0x165 ubyte^0x1BF x \b, hostname %c
>>0x166 ubyte^0x1C0 >037 \b%c

297
contrib/file/magic/Magdir/filesystems

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: filesystems,v 1.133 2020/05/17 19:32:00 christos Exp $
# $File: filesystems,v 1.145 2021/09/07 18:57:50 christos Exp $
# filesystems: file(1) magic for different filesystems
#
0 name partid
@ -220,7 +220,7 @@
>>>>>>18 string =_ \b.
>>>>>>>19 string x \b%-.1s
>>>22 ubyte 0
>>>>21 ubyte x \b, from drive 0x%x
>>>>21 ubyte x \b, from drive %#x
>>>22 ubyte >0
>>>>21 string x \b, from drive %s
>>>535 search/17 \x55\xAA
@ -261,6 +261,18 @@
# for sector sizes with 512 or more Bytes
>0x1FE leshort 0xAA55 DOS/MBR boot sector
# ExFAT
3 string/w =EXFAT
>0x1FE leshort 0xAA55
>>0x6E ubyte 1
>>>0x6F ubyte 0x80
>>>0 ubyte 0xEB DOS/MBR boot sector,
>>>0x69 ubyte x ExFAT Filesystem version %d.
>>>0x68 ubyte x \b%d
>>>0x6d ubyte x \b, (1<<%d) sectors per cluster
>>>0x48 ulequad x \b, sectors %lld
>>>0x64 ulelong x \b, serial number %#x
# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying
# only for sector sizes with 512 or more Bytes
0x1FE leshort 0xAA55 DOS/MBR boot sector
@ -296,7 +308,7 @@
>>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese
>>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish
>>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian
>>>>>0x49 ubyte >0 at offset 0x%x
>>>>>0x49 ubyte >0 at offset %#x
>>>>>>(0x49.b) string >\0 "%s"
# "Error loading operating system" nn=0xa3 for english version
# "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version
@ -304,7 +316,7 @@
# "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version
# "Error al cargar sistema operativo" nn=0xa8 for spanish version
# "Errore durante il caricamento del sistema operativo" nn=0xae for italian version
>>>>>0x74 ubyte >0 at offset 0x%x
>>>>>0x74 ubyte >0 at offset %#x
>>>>>>(0x74.b) string >\0 "%s"
# "Missing operating system" nn=0xc2 for english version
# "Betriebssystem fehlt" nn=0xcd for german version
@ -312,7 +324,7 @@
# "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version
# "Falta sistema operativo" nn=0xca for spanish version
# "Sistema operativo mancante" nn=0xe2 for italian version
>>>>>0x79 ubyte >0 at offset 0x%x
>>>>>0x79 ubyte >0 at offset %#x
>>>>>>(0x79.b) string >\0 "%s"
# Microsoft Windows 95B to XP (https://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
# assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b
@ -327,7 +339,7 @@
>>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german
>>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french
>>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian
>>>>0x3C ubyte x at offset 0x%x+0xFF
>>>>0x3C ubyte x at offset %#x+0xFF
>>>>(0x3C.b+0x0FF) string >\0 "%s"
# "Error loading operating system" nn=0x127 for english version
# "Fehler beim Laden des Betriebssystems" nn=0x12b for german version
@ -400,12 +412,12 @@
>>>>(0x1b7.b+0x100) string >\0 "%s"
# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs
# https://en.wikipedia.org/wiki/MBR_disk_signature#ID
>>0x1b8 ulelong >0 \b, disk signature 0x%-.4x
>>0x1b8 ulelong >0 \b, disk signature %#-.4x
# driveID/timestamp for Win 95B,98,98SE and ME. See https://thestarman.pcministry.com/asm/mbr/mystery.htm
>>0xDA uleshort 0
>>>0xDC ulelong >0 \b, created
# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive
>>>>0xDC ubyte x with driveID 0x%x
>>>>0xDC ubyte x with driveID %#x
# hours, minutes and seconds
>>>>0xDf ubyte x at %x
>>>>0xDe ubyte x \b:%x
@ -452,13 +464,13 @@
>>>397 search/4 Booting\040
>>>>408 search/4 HD1/\0 \b, Ranish MBR (
>>>>>416 string Writing\ changes... \b2.37
>>>>>>438 ubyte x \b,0x%x dots
>>>>>>438 ubyte x \b,%#x dots
>>>>>>440 ubyte >0 \b,virus check
>>>>>>441 ubyte >0 \b,partition %c
#2.38,2.42,2.44
>>>>>416 string !Writing\ changes... \b
>>>>>>418 ubyte 1 \bvirus check,
>>>>>>419 ubyte x \b0x%x seconds
>>>>>>419 ubyte x \b%#x seconds
>>>>>>420 ubyte&0x0F >0 \b,partition
>>>>>>>420 ubyte&0x0F <5 \b %x
>>>>>>>420 ubyte&0x0F 0Xf \b ask
@ -491,25 +503,25 @@
# updated by Joerg Jenderek at Oct 2008
# variables according to grub-0.97/stage1/stage1.S or
# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data
# usual values are marked with comments to get only informations of strange GRUB loaders
# usual values are marked with comments to get only information of strange GRUB loaders
>342 search/60 \0Geom\0
#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0
>>0x41 ubyte <2
>>>0x3E ubyte >2 \b; GRand Unified Bootloader
# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
>>>>0x3E ubyte x \b, stage1 version 0x%x
>>>>0x3E ubyte x \b, stage1 version %#x
#If it is 0xFF, use a drive passed by BIOS
>>>>0x40 ubyte <0xFF \b, boot drive 0x%x
>>>>0x40 ubyte <0xFF \b, boot drive %#x
# in most case 0,1,0x2e for GRUB 0.5.95
>>>>0x41 ubyte >0 \b, LBA flag 0x%x
>>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x
#>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual)
>>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x
#>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default)
>>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x
>>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x
#>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual)
>>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x
>>>>0x41 ubyte >0 \b, LBA flag %#x
>>>>0x42 uleshort <0x8000 \b, stage2 address %#x
#>>>>0x42 uleshort =0x8000 \b, stage2 address %#x (usual)
>>>>0x42 uleshort >0x8000 \b, stage2 address %#x
#>>>>0x44 ulelong =1 \b, 1st sector stage2 %#x (default)
>>>>0x44 ulelong >1 \b, 1st sector stage2 %#x
>>>>0x48 uleshort <0x800 \b, stage2 segment %#x
#>>>>0x48 uleshort =0x800 \b, stage2 segment %#x (usual)
>>>>0x48 uleshort >0x800 \b, stage2 segment %#x
>>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0
>>>>>394 string stage1 \b, GRUB version 0.5.95
>>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0
@ -533,7 +545,7 @@
# mbr partition table entries updated by Joerg Jenderek at Sep 2013
# skip Norton Utilities disc image data
>3 string !IHISK
# skip Linux style boot sector starting with assember instructions mov 0x7c0,ax;
# skip Linux style boot sector starting with assembler instructions mov 0x7c0,ax;
>>0 belong !0xb8c0078e
# not Linux kernel
>>>514 string !HdrS
@ -548,7 +560,7 @@
>>>>>0 ubelong&0xFD000000 !0xE9000000
# skip FSInfosector
>>>>>>0 string !RRaA
# skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX,
# skip 3rd sector of MS x86 bootloader with assembler instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX,
# https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm
>>>>>>>0 ubequad !0xfa660fb64610668b
# skip 13rd sector of MS x86 bootloader
@ -1114,9 +1126,9 @@
>>48 leshort 0xAA55 2
>>32 leshort 0xAA55 3
>>16 leshort 0xAA55 4
>>4 ubyte x : ID=0x%x
>>4 ubyte x : ID=%#x
>>0 ubyte&0x80 0x80 \b, active
>>0 ubyte >0x80 0x%x
>>0 ubyte >0x80 %#x
>>1 ubyte x \b, start-CHS (
>>1 use partition-chs
>>5 ubyte x \b), end-CHS (
@ -1214,7 +1226,7 @@
# ERRorTeXT
>>181 search/166 Error\ \0\r\n NetBSD mbr
# NT Drive Serial Number https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
>>>0x1B8 ubelong >0 \b,Serial 0x%-.8x
>>>0x1B8 ubelong >0 \b,Serial %#-.8x
# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
>>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector
# BOOT_EXTENDED definitions contains assembler instructions:
@ -1265,38 +1277,38 @@
# variant used by testdisk of https://www.cgsecurity.org/wiki/Menu_MBRCode
>>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk
#0x1~1,..,0x8~4,0x10~F,0x80~A enabled
#>>>(0x1BC.s+10) ubyte x \b,flags 0x%x
#>>>(0x1BC.s+10) ubyte x \b,flags %#x
#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
#>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x
#>>>(0x1BC.s+11) ubyte x \b,cfg_def %#x
# for older versions
>>>(0x1BC.s+9) ubyte <2
#>>>>(0x1BC.s+12) ubyte 18 \b,%hhu/18 seconds
>>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds
# floppy A: or B:
>>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x
>>>>(0x1BC.s+13) ubyte <2 \b,floppy %#x
>>>>(0x1BC.s+13) ubyte >1
# 1st hard disc
#>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x
#>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive %#x
# not 1st hard disc
>>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x
>>>>>(0x1BC.s+13) ubyte !0x80 \b,drive %#x
# for version >= 2 maximal timeout can be 65534
>>>(0x1BC.s+9) ubyte >1
#>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds
>>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds
# floppy A: or B:
>>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x
>>>>(0x1BC.s+14) ubyte <2 \b,floppy %#x
>>>>(0x1BC.s+14) ubyte >1
# 1st hard disc
#>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x
#>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive %#x
# not 1st hard disc
>>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x
>>>>>(0x1BC.s+14) ubyte !0x80 \b,drive %#x
>>>0 ubyte x \b)
# added by Joerg Jenderek
# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
# grub-1.94/kern/i386/pc/startup.S
# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data
# usual values are marked with comments to get only informations of strange GRUB loaders
# usual values are marked with comments to get only information of strange GRUB loaders
0x200 uleshort 0x70EA
# found only version 3.{1,2}
>0x206 ubeshort >0x0300
@ -1318,9 +1330,9 @@
# GRUB 0.5.95 unofficial
>>>>0x20C ulelong&0x2E300000 0x2E300000
# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs
>>>>>0x20C ubyte x \b, identifier 0x%x
#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default)
>>>>>0x20D ubyte >0 \b, LBA flag 0x%x
>>>>>0x20C ubyte x \b, identifier %#x
#>>>>>0x20D ubyte =0 \b, LBA flag %#x (default)
>>>>>0x20D ubyte >0 \b, LBA flag %#x
# GRUB version as string
>>>>>0x20E string >\0 \b, GRUB version %-s
# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
@ -1335,10 +1347,10 @@
# for 1.94 contains kernel image size
# for 0.93,0.94,0.96,0.97
# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2
>>>>>0x210 ubyte x \b, identifier 0x%x
>>>>>0x210 ubyte x \b, identifier %#x
# The flag for LBA forcing is in most cases 0
#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default)
>>>>>0x211 ubyte >0 \b, LBA flag 0x%x
#>>>>>0x211 ubyte =0 \b, LBA flag %#x (default)
>>>>>0x211 ubyte >0 \b, LBA flag %#x
# GRUB version as string
>>>>>0x212 string >\0 \b, GRUB version %-s
# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
@ -1358,16 +1370,16 @@
0 ulelong&0x804000E9 0x000000E9
!:strength +60
# mtools-3.9.8/msdos.h
# usual values are marked with comments to get only informations of strange FAT systems
# usual values are marked with comments to get only information of strange FAT systems
# valid sectorsize must be a power of 2 from 32 to 32768
>11 uleshort&0x001f 0
>>11 uleshort <32769
>>>11 uleshort >31
>>>>21 ubyte&0xf0 0xF0
>>>>>0 ubyte 0xEB DOS/MBR boot sector
>>>>>>1 ubyte x \b, code offset 0x%x+2
>>>>>>1 ubyte x \b, code offset %#x+2
>>>>>0 ubyte 0xE9
>>>>>>1 uleshort x \b, code offset 0x%x+3
>>>>>>1 uleshort x \b, code offset %#x+3
>>>>>3 string >\0 \b, OEM-ID "%-.8s"
#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
>>>>>>8 string IHC \b cached by Windows 9M
@ -1392,9 +1404,9 @@
#>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32)
>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
#>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32)
>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x
>>>>>21 ubyte >0xF0 \b, Media descriptor %#x
#>>>>>21 ubyte =0xF0 \b, Media descriptor %#x (usual floppy)
>>>>>21 ubyte <0xF0 \b, Media descriptor %#x
>>>>>22 uleshort >0 \b, sectors/FAT %u
#>>>>>22 uleshort =0 \b, sectors/FAT %hu=0 (usual Fat32)
>>>>>24 uleshort x \b, sectors/track %u
@ -1413,18 +1425,18 @@
#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
# FAT<32 bit specific
>>>>>>>82 string/c !fat32
#>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
#>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy)
#>>>>>>>>36 ubyte 0x80 \b, physical drive %#x=0x80 (usual harddisk)
#>>>>>>>>36 ubyte 0 \b, physical drive %#x=0 (usual floppy)
>>>>>>>>36 ubyte !0x80
>>>>>>>>>36 ubyte !0 \b, physical drive 0x%x
>>>>>>>>>36 ubyte !0 \b, physical drive %#x
# VGA-copy CRC or
# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
>>>>>>>>37 ubyte >0 \b, reserved 0x%x
#>>>>>>>>37 ubyte =0 \b, reserved 0x%x
# extended boot signatur value is 0x80 for NTFS, 0x28 or 0x29 for others
>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x)
>>>>>>>>37 ubyte >0 \b, reserved %#x
#>>>>>>>>37 ubyte =0 \b, reserved %#x
# extended boot signature value is 0x80 for NTFS, 0x28 or 0x29 for others
>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (%#x)
>>>>>>>>38 ubyte&0xFE =0x28
>>>>>>>>>39 ulelong x \b, serial number 0x%x
>>>>>>>>>39 ulelong x \b, serial number %#x
>>>>>>>>38 ubyte =0x29
>>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
>>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
@ -1466,7 +1478,7 @@
>>>>>82 string/c fat32 \b, FAT (32 bit)
>>>>>>36 ulelong x \b, sectors/FAT %u
# https://technet.microsoft.com/en-us/library/cc977221.aspx
>>>>>>40 uleshort >0 \b, extension flags 0x%x
>>>>>>40 uleshort >0 \b, extension flags %#x
#>>>>>>40 uleshort =0 \b, extension flags %hu
>>>>>>42 uleshort >0 \b, fsVersion %u
#>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
@ -1483,19 +1495,19 @@
>>>>>>50 default x
>>>>>>>50 uleshort x \b, Backup boot sector %u
# corrected by Joerg Jenderek at Feb 2011 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
>>>>>>52 ulelong >0 \b, reserved1 0x%x
>>>>>>56 ulelong >0 \b, reserved2 0x%x
>>>>>>60 ulelong >0 \b, reserved3 0x%x
>>>>>>52 ulelong >0 \b, reserved1 %#x
>>>>>>56 ulelong >0 \b, reserved2 %#x
>>>>>>60 ulelong >0 \b, reserved3 %#x
# same structure as FAT1X
#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)
#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
#>>>>>>64 ubyte =0x80 \b, physical drive %#x=80 (usual harddisk)
#>>>>>>64 ubyte =0 \b, physical drive %#x=0 (usual floppy)
>>>>>>64 ubyte !0x80
>>>>>>>64 ubyte >0 \b, physical drive 0x%x
>>>>>>>64 ubyte >0 \b, physical drive %#x
# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
>>>>>>65 ubyte >0 \b, reserved 0x%x
>>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x)
>>>>>>65 ubyte >0 \b, reserved %#x
>>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (%#x)
>>>>>>66 ubyte =0x29
>>>>>>>67 ulelong x \b, serial number 0x%x
>>>>>>>67 ulelong x \b, serial number %#x
>>>>>>>71 string <NO\ NAME \b, label: "%11.11s"
>>>>>>>71 string >NO\ NAME \b, label: "%11.11s"
>>>>>>>71 string =NO\ NAME \b, unlabeled
@ -1518,10 +1530,10 @@
>>>>>>>19 uleshort =0
# 0 sectors/FAT
# dos < 4.0 BootSector value found is 0x80
#38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x)
#38 ubyte =0x80 \b, dos < 4.0 BootSector (%#x)
>>>>>>>>22 uleshort =0 \b; NTFS
>>>>>>>>>24 uleshort >0 \b, sectors/track %u
>>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x
>>>>>>>>>36 ulelong !0x800080 \b, physical drive %#x
>>>>>>>>>40 ulequad >0 \b, sectors %lld
>>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld
>>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld
@ -1537,8 +1549,8 @@
#>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d)
>>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%i)
>>>>>>>>>72 ulequad x \b, serial number 0%llx
>>>>>>>>>80 ulelong >0 \b, checksum 0x%x
#>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual)
>>>>>>>>>80 ulelong >0 \b, checksum %#x
#>>>>>>>>>80 ulelong =0 \b, checksum %#x=0 (usual)
# unicode loadername size jump
>>>>>>>>>(0x200.s*2) ubyte x
# in next sector loadername terminated by unicode CTRL-D and $
@ -1705,7 +1717,13 @@
>0x94 lelong x (of %d),
>0x50 string x name %s,
>0x98 ulelong x version %u,
>0xa0 ulelong x flags 0x%x
>0xa0 ulelong x flags %#x
0 ulequad 0x48414d3205172011 HAMMER2 filesystem (little-endian),
>0x3b byte x volume %d,
>0x28 ulequad/1073741824 x size %lluGB,
>0x30 ulelong x version %u,
>0x34 ulelong x flags %#x
# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
@ -1727,12 +1745,12 @@
>>>0x464 lelong >0x0000007 ext4 filesystem data
# else large INCOMPAT?
>>0x460 lelong >0x000003f ext4 filesystem data
>0x468 belong x \b, UUID=%08x
>0x46c beshort x \b-%04x
>0x46e beshort x \b-%04x
>0x470 beshort x \b-%04x
>0x472 belong x \b-%08x
>0x476 beshort x \b%04x
>0x468 ubelong x \b, UUID=%08x
>0x46c ubeshort x \b-%04x
>0x46e ubeshort x \b-%04x
>0x470 ubeshort x \b-%04x
>0x472 ubelong x \b-%08x
>0x476 ubeshort x \b%04x
>0x478 string >0 \b, volume name "%s"
# General flags for any ext* fs
>0x460 lelong &0x0000004 (needs journal recovery)
@ -1755,12 +1773,12 @@
# f2fs filesystem - Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
0x400 lelong 0xF2F52010 F2FS filesystem
>0x46c belong x \b, UUID=%08x
>0x470 beshort x \b-%04x
>0x472 beshort x \b-%04x
>0x474 beshort x \b-%04x
>0x476 belong x \b-%08x
>0x47a beshort x \b%04x
>0x46c ubelong x \b, UUID=%08x
>0x470 ubeshort x \b-%04x
>0x472 ubeshort x \b-%04x
>0x474 ubeshort x \b-%04x
>0x476 ubelong x \b-%08x
>0x47a ubeshort x \b%04x
>0x147c lestring16 x \b, volume name "%s"
# Minix filesystems - Juan Cespedes <cespedes@debian.org>
@ -1925,7 +1943,7 @@
#>>>0x60E ubequad 0
#>>>>0x600 ubequad !0
#!:mime application/x-ima
#>>512 ubyte x \b, Media descriptor 0x%x
#>>512 ubyte x \b, Media descriptor %#x
# without x86 jump instruction
#>>0 ulelong&0x804000E9 !0x000000E9
# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV
@ -1935,7 +1953,7 @@
#>>0 ulelong&0x804000E9 =0x000000E9
# only x86 short jump instruction found
#>>>0 ubyte =0xEB
#>>>>1 ubyte x \b, code offset 0x%x+2
#>>>>1 ubyte x \b, code offset %#x+2
# https://thestarman.pcministry.com/DOS/ibm100/Boot.htm
# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0
#>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader
@ -1975,16 +1993,19 @@
>>38917 string 1 (version 1.0)
>>38917 string 2 (version 1.5)
>>38917 string 3 (version 2.0)
>>38917 byte >0x33 (unknown version, ID 0x%X)
>>38917 byte <0x31 (unknown version, ID 0x%X)
>>38917 byte >0x33 (unknown version, ID %#X)
>>38917 byte <0x31 (unknown version, ID %#X)
# The next line is not necessary because the MBR staff is done looking for boot signature
>0x1FE leshort 0xAA55 (DOS/MBR boot sector)
# "application id" which appears to be used as a volume label
>32808 string/T >\0 '%s'
>32808 string/T >\0 '%.32s'
>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)
37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
!:mime application/x-iso9660-image
32777 string CDROM High Sierra CD-ROM filesystem data
# "application id" which appears to be used as a volume label
>32816 string/T >\0 '%.32s'
# CDROM Filesystems
# https://en.wikipedia.org/wiki/ISO_9660
@ -2031,7 +2052,7 @@
>8 lelong &1 version #2
>8 lelong &2 sorted_dirs
>8 lelong &4 hole_support
>32 lelong x CRC 0x%x,
>32 lelong x CRC %#x,
>36 lelong x edition %u,
>40 lelong x %u blocks,
>44 lelong x %u files
@ -2041,7 +2062,7 @@
>8 belong &1 version #2
>8 belong &2 sorted_dirs
>8 belong &4 hole_support
>32 belong x CRC 0x%x,
>32 belong x CRC %#x,
>36 belong x edition %u,
>40 belong x %u blocks,
>44 belong x %u files
@ -2134,10 +2155,10 @@
>31 byte 3 (lzma),
>12 belong x %d bytes,
>8 bedate x %s,
>16 belong x Load Address: 0x%08X,
>20 belong x Entry Point: 0x%08X,
>4 belong x Header CRC: 0x%08X,
>24 belong x Data CRC: 0x%08X
>16 belong x Load Address: %#08X,
>20 belong x Entry Point: %#08X,
>4 belong x Header CRC: %#08X,
>24 belong x Data CRC: %#08X
# JFFS2 file system
0 leshort 0x1984 Linux old jffs2 filesystem data little endian
@ -2281,20 +2302,20 @@
>>0x10060 string >\0 lockproto %s)
# Russell Coker <russell@coker.com.au>
0x10040 string _BHRfS_M BTRFS Filesystem
>0x1012b string >\0 label "%s",
>0x10090 lelong x sectorsize %d,
>0x10094 lelong x nodesize %d,
>0x10098 lelong x leafsize %d,
>0x10020 belong x UUID=%08x-
>0x10024 beshort x \b%04x-
>0x10026 beshort x \b%04x-
>0x10028 beshort x \b%04x-
>0x1002a beshort x \b%04x
>0x1002c belong x \b%08x,
>0x10078 lequad x %lld/
>0x10070 lequad x \b%lld bytes used,
>0x10088 lequad x %lld devices
0x10040 string _BHRfS_M BTRFS Filesystem
>0x1012b string >\0 label "%s",
>0x10090 lelong x sectorsize %d,
>0x10094 lelong x nodesize %d,
>0x10098 lelong x leafsize %d,
>0x10020 ubelong x UUID=%08x-
>0x10024 ubeshort x \b%04x-
>0x10026 ubeshort x \b%04x-
>0x10028 ubeshort x \b%04x-
>0x1002a ubeshort x \b%04x
>0x1002c ubelong x \b%08x,
>0x10078 lequad x %lld/
>0x10070 lequad x \b%lld bytes used,
>0x10088 lequad x %lld devices
# dvdisaster's .ecc
# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
@ -2363,11 +2384,11 @@
>40 lelong x \b number of files %u,
>44 lelong x \b blocks available for writing %d,
>48 lelong x \b inodes in cache %d,
>52 lelong x \b inode file disk address 0x%x,
>52 lelong x \b inode file disk address %#x,
>56 lelong x \b inode file inode number %u,
>60 lelong x \b address of last segment written 0x%x,
>64 lelong x \b address of next segment to write 0x%x,
>68 lelong x \b address of current segment written 0x%x
>60 lelong x \b address of last segment written %#x,
>64 lelong x \b address of next segment to write %#x,
>68 lelong x \b address of current segment written %#x
0 string td\000 floppy image data (TeleDisk, compressed)
0 string TD\000 floppy image data (TeleDisk)
@ -2399,7 +2420,7 @@
>0x16 leshort 0 UBIfs image
>0x08 lequad x \b, sequence number %llu
>0x10 leshort x \b, length %u
>0x04 lelong x \b, CRC 0x%08x
>0x04 lelong x \b, CRC %#08x
0 lelong 0x23494255
>0x04 leshort <2
@ -2433,3 +2454,53 @@
>0x400 pstring x serial: %s
#>0x500 pstring x unknown: %s
!:ext imgc
# http://martin.hinner.info/fs/bfs/bfs-structure.html
0 lelong 0x1BADFACE SCO UnixWare BFS filesystem
# https://arstechnica.com/information-technology/2018/07/the-beos-filesystem/
32 lelong 0x42465331 BE/OS BFS1 filesystem
>36 lelong x \b, byte order %d
>40 lelong x \b, block size %d
>44 lelong x \b, block shift %d
>48 lequad x \b, total blocks %lld
>56 lequad x \b, used blocks %lld
0 name next
>0 lelong x \b, size %d
>4 string x \b, label %s
# https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-44.3\
# /IONeXTPartitionScheme.h
0 string NeXT NeXT version 1 disklabel
>12 use next
0 string dlV1 NeXT version 2 disklabel
>12 use next
0 string dlV2 NeXT version 3 disklabel
>12 use next
# bcachefs
# From: Thomas Weißschuh <thomas@t-8ch.de>
0 name bcachefs-uuid
>0 ubelong x \b%08x
>4 ubeshort x \b-%04x
>6 ubeshort x \b-%04x
>8 ubeshort x \b-%04x
>10 ubelong x \b-%08x
>14 ubeshort x \b%04x
0x1018 string \xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81 bcachefs
>0x1068 lequad 8 \b, UUID=
>>0x1038 use bcachefs-uuid
>>0x1048 string >0 \b, label "%.32s"
>>0x1010 uleshort x \b, version %u
>>0x1012 uleshort x \b, min version %u
>>0x107a byte x \b, device %d
# assumes the first field is the members field
>>0x12f4 ulelong 0x01 \b/UUID=
>>>0x12f0 default x
>>>&(0x107a.b*56) use bcachefs-uuid
>>0x107b byte x \b, %d devices
>>0x1090 byte ^0x02 \b (unclean)

33
contrib/file/magic/Magdir/fonts

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: fonts,v 1.43 2019/07/16 11:11:31 christos Exp $
# $File: fonts,v 1.46 2021/04/26 15:56:00 christos Exp $
# fonts: file(1) magic for font data
#
0 search/1 FONT ASCII vfont text
@ -11,6 +11,7 @@
0 string %!PS-AdobeFont-1. PostScript Type 1 font text
>20 string >\0 (%s)
6 string %!PS-AdobeFont-1. PostScript Type 1 font program data
>26 string >\0 (%s)
0 string %!FontType1 PostScript Type 1 font program data
6 string %!FontType1 PostScript Type 1 font program data
0 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text
@ -123,7 +124,15 @@
>10 leshort x \b%d
>40 string x %s
# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/CPI
# Reference: http://www.delorie.com/djgpp/doc/rbinter/it/58/17.html
0 belong 0xff464f4e DOS code page font data collection
!:mime font/x-dos-cpi
!:ext cpi
0 string \x7fDRFONT DR-DOS code page font data collection
!:mime font/x-drdos-cpi
!:ext cpi
7 belong 0x00454741 DOS code page font data
7 belong 0x00564944 DOS code page font data (from Linux?)
4098 string DOSFONT DOSFONT2 encrypted font data
@ -158,7 +167,7 @@
# face size in points 3-72 SLSS03CG.FNT H1CELT72.FNT
>2 uleshort x %u
# face ID (must be unique)
>0 uleshort x \b, ID 0x%4.4x
>0 uleshort x \b, ID %#4.4x
# lowest character index in face (4 but usually 32 for disk-loaded fonts)
#>36 uleshort !32 \b, unusual character index %u
# width of the widest character like 0 8 10 12 16 24 32
@ -168,21 +177,21 @@
# thickening size in pixel like 0 1 2 3 4 5 6 7 8
#>58 uleshort x \b, %u thick
# lightening mask to eliminate pixels, usually 5555h
>62 uleshort !0x5555 \b, lightening mask 0x%x
>62 uleshort !0x5555 \b, lightening mask %#x
# skewing mask to determine when to perform additional rotation when skewing, usually 5555h
>64 uleshort !0x5555 \b, skewing mask 0x%x
>64 uleshort !0x5555 \b, skewing mask %#x
# offset to optional horizontal offset table 0 58h~88 5eh 252h
#>68 ulelong x \b, 0x%x horizontal table offset
#>68 ulelong x \b, %#x horizontal table offset
# offset of character offset table 54h for many *.GFT 55h 58h 5Eh 120h 1D4h 202h 220h
#>72 ulelong x \b, 0x%x coffset
#>72 ulelong x \b, %#x coffset
# offset to font data like 116h 118h 158 20Ah 20Eh
>76 ulelong x \b, 0x%x foffset
>76 ulelong x \b, %#x foffset
# form width in bytes like 58 67 156 190 227 317 345
#>80 uleshort x \b, %u fwidth
# form height in bytes like 4 8 11 17 26 56 70 90 120 146 150
#>82 uleshort x \b, %u fheight
# pointer to the next font like 0 10000h 20000h 30000h 40000h 60000h 80000h E0000h D0000h
#>84 ulelong x \b, 0x%x noffset
#>84 ulelong x \b, %#x noffset
# downloadable fonts for browser (prints type) anthon@mnt.org
# https://tools.ietf.org/html/rfc3073
@ -221,7 +230,7 @@
# tag names consist of up to four characters padded with spaces at end like
# BASE DSIG OS/2 Zapf acnt glyf cvt vmtx xref ...
>>12 regex/4l \^[A-Za-z][A-Za-z][A-Za-z/][A-Za-z2\ ]
#>>>0 ubelong x \b, sfnt version 0x%x
#>>>0 ubelong x \b, sfnt version %#x
>>>0 ubelong !0x4f54544f TrueType
!:mime font/sfnt
!:apple ????tfil
@ -253,7 +262,7 @@
#>>>>&8 ubelong >0x0100bd27 BIGGEST OFFSET
>>&8 ubelong >0x00100000
# offset of name table
>>>&-4 ubelong x \b, name offset 0x%x
>>>&-4 ubelong x \b, name offset %#x
# GRR: pointer to name table only works if offset ~< FILE_BYTES_MAX = 100000h defined in src\file.h
>>&8 ubelong <0x00100000
>>>&-16 ubelong x
@ -284,7 +293,7 @@
>>>>>&-2 ubeshort 1 \b, Macintosh
>>>>>&-2 ubeshort 3 \b, Microsoft
# languageID (0~english Macintosh, 0409h~english Microsoft, ...)
>>>>>&2 ubeshort >0 \b, language 0x%x
>>>>>&2 ubeshort >0 \b, language %#x
# name identifiers
# often 0~copyright, 1~font, 2~font subfamily, 5~version, 13~license, 19~sample, ...
>>>>>&4 ubeshort >0 \b, type %d string
@ -339,7 +348,7 @@
# 0x44454947 = 'DSIG'
>>>&4 belong 0x44534947 \b, digitally signed
# offset to 1st font
>>12 ubelong x \b, at 0x%x
>>12 ubelong x \b, at %#x
# point to 1st font that starts with sfnt version
>>(12.L) use sfnt-font

46
contrib/file/magic/Magdir/forth

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: forth,v 1.1 2019/06/06 19:14:20 christos Exp $
# $File: forth,v 1.4 2021/04/26 15:56:00 christos Exp $
# forth: file(1) magic for various Forth environments
# From: Lubomir Rintel <lkundrak@v3.sk>
#
@ -16,16 +16,18 @@
0 regex \^:[[:space:]].*[[:space:]]\\(([[:space:]].*)?\ --\ (.*[[:space:]])?\\)[[:space:]].*[[:space:]];$ FORTH program
!:mime text/x-forth
# Various dictionary images used by OpenFirware FORTH environent
# Various dictionary images used by OpenFirware FORTH environment
0 lelong 0xe1a00000
>8 lelong 0xe1a00000 ARM OpenFirmware FORTH Dictionary,
>>24 lelong x Text length: %d bytes,
>>28 lelong x Data length: %d bytes,
>>32 lelong x Text Relocation Table length: %d bytes,
>>36 lelong x Data Relocation Table length: %d bytes,
>>40 lelong x Entry Point: 0x%08X,
>>44 lelong x BSS length: %d bytes
>8 lelong 0xe1a00000
# skip raspberry pi kernel image kernel7.img by checking for positive text length
>>24 lelong >0 ARM OpenFirmware FORTH Dictionary,
>>>24 lelong x Text length: %d bytes,
>>>28 lelong x Data length: %d bytes,
>>>32 lelong x Text Relocation Table length: %d bytes,
>>>36 lelong x Data Relocation Table length: %d bytes,
>>>40 lelong x Entry Point: %#08X,
>>>44 lelong x BSS length: %d bytes
0 string MP
>28 lelong 1 x86 OpenFirmware FORTH Dictionary,
@ -35,18 +37,18 @@
>>8 leshort x Header length: %d paragraphs,
>>10 leshort x Data Size: %d
>>12 leshort x - %d 4K pages,
>>14 lelong x Initial Stack Pointer: 0x%08X,
>>20 lelong x Entry Point: 0x%08X,
>>14 lelong x Initial Stack Pointer: %#08X,
>>20 lelong x Entry Point: %#08X,
>>24 lelong x First Relocation Item: %d,
>>26 lelong x Overlay Number: %d,
>>18 leshort x Checksum: 0x%08X
>>18 leshort x Checksum: %#08X
0 belong 0x48000020 PowerPC OpenFirmware FORTH Dictionary,
>4 belong x Text length: %d bytes,
>8 belong x Data length: %d bytes,
>12 belong x BSS length: %d bytes,
>16 belong x Symbol Table length: %d bytes,
>20 belong x Entry Point: 0x%08X,
>20 belong x Entry Point: %#08X,
>24 belong x Text Relocation Table length: %d bytes,
>28 belong x Data Relocation Table length: %d bytes
@ -55,7 +57,7 @@
>8 lelong x Data length: %d bytes,
>12 lelong x BSS length: %d bytes,
>16 lelong x Symbol Table length: %d bytes,
>20 lelong x Entry Point: 0x%08X,
>20 lelong x Entry Point: %#08X,
>24 lelong x Text Relocation Table length: %d bytes,
>28 lelong x Data Relocation Table length: %d bytes
@ -64,17 +66,17 @@
# Weak.
#0 short 0x5820 cForth 16-bit Dictionary,
#>2 short x Serial: 0x%08X,
#>4 short x Dictionary Start: 0x%08X,
#>2 short x Serial: %#08X,
#>4 short x Dictionary Start: %#08X,
#>6 short x Dictionary Size: %d bytes,
#>8 short x User Area Start: 0x%08X,
#>8 short x User Area Start: %#08X,
#>10 short x User Area Size: %d bytes,
#>12 short x Entry Point: 0x%08X
#>12 short x Entry Point: %#08X
0 long 0x581120 cForth 32-bit Dictionary,
>4 long x Serial: 0x%08X,
>8 long x Dictionary Start: 0x%08X,
>4 long x Serial: %#08X,
>8 long x Dictionary Start: %#08X,
>12 long x Dictionary Size: %d bytes,
>16 long x User Area Start: 0x%08X,
>16 long x User Area Start: %#08X,
>20 long x User Area Size: %d bytes,
>24 long x Entry Point: 0x%08X
>24 long x Entry Point: %#08X

12
contrib/file/magic/Magdir/fsav

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: fsav,v 1.19 2019/04/19 00:42:27 christos Exp $
# $File: fsav,v 1.22 2021/04/26 15:56:00 christos Exp $
# fsav: file(1) magic for datafellows fsav virus definition files
# Anthon van der Neut (anthon@mnt.org)
@ -35,7 +35,7 @@
#>>>3 ubyte 0x1
#>>>>4 ubyte 0x0e
#>>>>>13 ubyte >0 fsav virus signatures
#>>>>>>11 ubyte x size 0x%02x
#>>>>>>11 ubyte x size %#02x
#>>>>>>12 ubyte x \b%02x
#>>>>>>13 ubyte x \b%02x bytes
@ -59,7 +59,7 @@
# file: could not find any valid magic files! (No error)
>>10 default x (with buildtime)
#>>10 default x
# clamtmp is used for temporily database like update process
# clamtmp is used for temporarily database like update process
# for pure tar database only cld extension found
!:ext cld/cvd/clamtmp/cud
>511 default x file
@ -86,16 +86,16 @@
#>>>>>>>>>&1 regex \^[^:]{1,10} \b, %s
>>>>>>>>>&1 regex \^[^:]{1,10}
# padding with spaces
#>>>>>>>>>>&1 ubequad x \b, padding 0x%16.16llx
#>>>>>>>>>>&1 ubequad x \b, padding %#16.16llx
>510 ubyte =0x20
# inspect real database content
#>>512 ubeshort x \b, database MAGIC 0x%x
#>>512 ubeshort x \b, database MAGIC %#x
# ./archive handle pure tar archives
>>1012 quad =0 \b, with
>>>512 use tar-file
# not pure tar
>>1012 quad !0
# one space at the end of text and then handles gziped archives by ./compress
# one space at the end of text and then handles gzipped archives by ./compress
>>>512 string \037\213 \b, with
>>>>512 indirect x

215
contrib/file/magic/Magdir/games

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: games,v 1.20 2020/02/01 16:32:33 christos Exp $
# $File: games,v 1.24 2021/04/26 15:56:00 christos Exp $
# games: file(1) for games
# Fabio Bonelli <fabiobonelli@libero.it>
@ -53,11 +53,11 @@
# dividing this by entry size (64) gives number of files
>>>8 ulelong/64 x \b, %u files
# offset to the beginning of the file table
>>>4 ulelong x \b, offset 0x%x
>>>4 ulelong x \b, offset %#x
# 1st file entry
>>>(4.l) use pak-entry
# 2nd file entry
#>>>4 ulelong+64 x \b, offset 0x%x
#>>>4 ulelong+64 x \b, offset %#x
#>>>(4.l+64) use pak-entry
#
# display file table entry of Quake PAK archive
@ -65,7 +65,7 @@
# normally entry start after header which implies offset 12 or higher
>56 ulelong >11
# the offset from the beginning of pak to beginning of this entry file contents
>>56 ulelong x at 0x%x
>>56 ulelong x at %#x
# the size of file for this entry
>>60 ulelong x %u bytes
# 56 byte null-terminated entry name string includes path like maps/e1m1.bsp
@ -276,7 +276,7 @@
# Summary: NetImmerse game engine file
# Extension .nif
# Created by: Abel Cheung <abelcheung@gmail.com>
0 string NetImmerse\ File\ Format,\ Versio
0 string NetImmerse\ File\ Format,\ Version
>&0 string n\ NetImmerse game engine file
>>&0 regex [0-9a-z.]+ \b, version %s
@ -313,3 +313,208 @@
>>12 regex [0-9a-z.]+ saved by game version %s
0 string CIV6 Sid Meier's Civilization VI saved game
# https://syzygy-tables.info/
# From Michel Van den Bergh
0 string \327f\f\245 Syzygy DTZ tablebase
!:mime application/syzygy
0 string q\350#] Syzygy WDL tablebase
!:mime application/syzygy
##############################################################################
# Grand Theft Auto (GTA) file formats.
#
# Summary:
# Includes GTA-specific formats used in all games from 1997 to present. Games
# and formats were created by Rockstar North, formerly DMA Design. Magic tests
# were written based on a combination of official and community documentation.
#
# Created by: Oliver Galvin <odg@riseup.net>
#
# References:
# * Classic GTA documentation and research:
# <https://gitlab.com/classic-gta/gta-data>
# * Official RenderWare documentation available from EA:
# <https://github.com/electronicarts/RenderWare3Docs>
# * Lots of community research in the GTAMods wiki:
# <https://gtamods.com/wiki>
# GTA 2D-Era data - 'Classic' top down games (1/L/2)
## GTA text
0 string \xbf\xf8\xbd\x49\x62\xbe GTA1 in-game text (FXT),
0 string GBL GTA2 in-game text (GXT),
>3 string E English,
>>4 uleshort x version %d
>3 string F French,
>>4 uleshort x version %d
>3 string G German,
>>4 uleshort x version %d
>3 string I Italian,
>>4 uleshort x version %d
>3 string S Spanish,
>>4 uleshort x version %d
>3 string J Japanese,
>>4 uleshort x version %d
## GTA maps
0 ulelong 331 GTA1 map layout (CMP),
>4 byte 1 Level 1
>4 byte 2 Level 2
>4 byte 3 Level 3
0 string GBMP GTA2/GBH map layout (GMP),
>4 uleshort x version %d
0 string/t [MapFiles] GTA2 multiplayer map metadata (MMP)
0 string/t MainOrBonus\ =\ MAIN GTA2 single player map listing (test1.seq)
## GTA 2D sprites and textures
0 ulelong 290 GTA1 style data (GRX), 8 bit editor graphics
0 ulelong 325 GTA1 style data (GRY), 8 bit in-game graphics
0 ulelong 336 GTA1 style data (G24), 24 bit in-game graphics
0 string GBST GTA2/GBH style data (STY), in-game graphics,
>4 uleshort x version %d
## GTA audio index
0 ulelong 0
>4 ulelong <0x40000
>>8 ulelong >4500
>>>8 ulelong <45000 GTA audio index data (SDT)
## GTA scripts
0 ulelong 0x00080000
>4 uleshort 0x0024 GTA2 binary main script (SCR)
0 uleshort 0x063c GTA2 binary mission script (SCR), Residential area (ste)
0 uleshort 0x055b GTA2 binary mission script (SCR), Downtown area (wil)
0 uleshort 0x0469 GTA2 binary mission script (SCR), Industrial area (bil)
0 string v9.6\0\0 GTA2 replay file (REP),
>8 regex/30c [a-z0-9:\ ]+\0\0 created on %s
# GTA 3D-Era (III/VC/SA/LCS/VCS) - used by the RenderWare engine by Criterion Games
## GTA 3D models and textures - RenderWare binary streams
8 ulelong 0x00000310 RenderWare data, v3.1.0.0, used in GTA III on PS2,
>0 ulelong 0x00000016 texture archive (TXD)
>0 ulelong 0x00000010 3D models (DFF)
8 ulelong 0x0401ffff RenderWare data, v3.1.0.1, used in GTA III on PC/PS2,
>0 ulelong 0x00000016 texture archive (TXD)
>0 ulelong 0x00000010 3D models (DFF)
8 ulelong 0x0800ffff RenderWare data, v3.2.0.0, used in GTA III on PC,
>0 ulelong 0x00000016 texture archive (TXD)
>0 ulelong 0x00000010 3D models (DFF)
8 ulelong 0x0c00ffff RenderWare data, v3.3.0.0,
>0 ulelong 0x00000016 texture archive (TXD)
>0 ulelong 0x00000010 3D models (DFF)
8 ulelong 0x0c02ffff RenderWare data, v3.3.0.2, used in GTA III PC and GTA VC PS2,
>0 ulelong 0x00000016 texture archive (TXD)
>0 ulelong 0x00000010 3D models (DFF)
8 ulelong 0x1000ffff RenderWare data, v3.4.0.0,
>0 ulelong 0x00000016 texture archive (TXD)
>0 ulelong 0x00000010 3D models (DFF)
8 ulelong 0x1003ffff RenderWare data, v3.4.0.3, used in GTA VC PC,
>0 ulelong 0x00000016 texture archive (TXD)
>0 ulelong 0x00000010 3D models (DFF)
8 ulelong 0x1005ffff RenderWare data, v3.4.0.5, used in GTA III/VC on Android,
>0 ulelong 0x00000016 texture archive (TXD)
>0 ulelong 0x00000010 3D models (DFF)
8 ulelong 0x1400ffff RenderWare data, v3.5.0.0, used in GTA III/VC on Xbox,
>0 ulelong 0x00000016 texture archive (TXD)
>0 ulelong 0x00000010 3D models (DFF)
8 ulelong 0x1803ffff RenderWare data, v3.6.0.3, used in GTA SA,
>0 ulelong 0x00000016 texture archive (TXD)
>0 ulelong 0x00000010 3D models (DFF)
0 string COL RenderWare collision data (COL),
>3 string L version 1, used in GTA III/VC/SA
>3 string 2 version 2, used in GTA SA
>3 string 3 version 3, used in GTA SA
>3 string 4 version 4, used in GTA SA
## GTA items and animations
0 string/c #\ ipl\ generated\ from\ max\ file GTA Item Placement data (IPL), used in GTA III/VC
0 string/b bnry GTA Item Placement data (IPL), used in GTA SA/IV,
>4 ulelong x %d items
0 string ANP GTA animation data (IFP),
>3 string K version 1, used in GTA III/VC
>3 string 3 version 2, used in GTA SA
0 string GtaSA29 GTA Replay data (REP), used in GTA SA
## GTA text
0 string TKEY GTA in-game text (GXT), version 2, used in GTA III
0 string TABL GTA in-game text (GXT), version 3, used in GTA VC/LS/VCS
## GTA scripts
0 string \x02\x00\x01 GTA script (SCM), used in GTA III/VC/SA
## GTA archives
0 string VER2 GTA archive (IMG), version 2, used in GTA SA,
>4 ulelong x %d items
# GTA HD-Era (IV/V) - used by the Rockstar Advanced Game Engine (RAGE)
## GTA models and textures - RAGE resources
# Note: GTA IV formats not yet documented - WAD, WBD, WBN, WHM, WPL
0 ulelong 0x00695254 GTA Drawable data (WDR), model and weapon data, used in GTA IV
0 ulelong 0x00695238 GTA Windows Frag Type (WFT), vehicle models, used in GTA IV
0 ulelong 0x006953A4 GTA Ped and LOD models (WDD), used in GTA IV
0 ulelong 0x00695384 GTA Windows Texture Dictionary (WTD), used in GTA IV
## GTA text
4 string TABL GTA in-game text (GXT),
>0 uleshort x version %d, used in GTA SA/IV
0 string 2GXT GTA in-game text (GXT2), used in GTA V
## GTA scripts
0 ulelong 0x0d524353 GTA script (SCO), unencrypted, used in GTA IV,
>4 ulelong x %d code bytes,
>>8 ulelong x %d static variables,
>>>12 ulelong x %d global variables
0 ulelong 0x0e726373 GTA script (SCO), encrypted, used in GTA IV
>4 ulelong x %d code bytes,
>>8 ulelong x %d static variables,
>>>12 ulelong x %d global variables
## GTA archives
0 ulelong 0xa94e2a52 GTA archive (IMG),
>4 ulelong x version %d, used in GTA IV,
>>8 ulelong x %d items
0 uleshort 0x5250 RAGE Package Format (RPF),
>2 uleshort 0x4630 version 0, used in Rockstar Table Tennis,
>>4 ulelong x %d bytes,
>>>8 ulelong x %d entries
>2 uleshort 0x4632 version 2, used in GTA IV,
>>4 ulelong x %d bytes,
>>>8 ulelong x %d entries
>2 uleshort 0x4633 version 3, used in GTA IV Audio & Midnight Club: LA,
>>4 ulelong x %d bytes,
>>>8 ulelong x %d entries
>2 uleshort 0x4634 version 4, used in Max Payne 3,
>>4 ulelong x %d bytes,
>>>8 ulelong x %d entries
>2 uleshort 0x4636 version 6, used in RDR,
>>4 ulelong x %d bytes,
>>>8 ulelong x %d entries
>2 uleshort 0x4637 version 7, used in GTA V,
>>4 ulelong x %d bytes,
>>>8 ulelong x %d entries
>2 uleshort 0x4638 version 8, used in RDR 2,
>>4 ulelong x %d bytes,
>>>8 ulelong x %d entries

8
contrib/file/magic/Magdir/git

@ -1,13 +1,13 @@
#------------------------------------------------------------------------------
# $File: git,v 1.1 2019/10/04 18:46:29 christos Exp $
# $File: git,v 1.2 2020/08/09 16:57:15 christos Exp $
# git: file(1) magic for Git objects
0 string blob\040
>5 regex [0-9]+ Git blob %s
>5 regex [0-9a-f]+ Git blob %s
0 string tree\040
>5 regex [0-9]+ Git tree %s
>5 regex [0-9a-f]+ Git tree %s
0 string commit\040
>7 regex [0-9]+ Git commit %s
>7 regex [0-9a-f]+ Git commit %s

6
contrib/file/magic/Magdir/gnome

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: gnome,v 1.6 2019/04/19 00:42:27 christos Exp $
# $File: gnome,v 1.7 2020/06/23 16:17:08 christos Exp $
# GNOME related files
# Contributed by Josh Triplett
@ -55,5 +55,5 @@
0 string GOBJ\nMETADATA\r\n\032 G-IR binary database
>16 byte x \b, v%d
>17 byte x \b.%d
>20 leshort x \b, %d entries
>22 leshort x \b/%d local
>20 short x \b, %d entries
>22 short x \b/%d local

42
contrib/file/magic/Magdir/gnu

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: gnu,v 1.22 2020/04/09 19:11:58 christos Exp $
# $File: gnu,v 1.24 2021/04/26 15:56:00 christos Exp $
# gnu: file(1) magic for various GNU tools
#
# GNU nlsutils message catalog file format
@ -33,48 +33,48 @@
# size of hashing table
#>20 ulelong x \b, %u hash
#>20 ulelong >1 \bes
#>24 ulelong x at 0x%x
# for revsion x.0 offset of table with originals is 1Ch if directly after header
#>24 ulelong x at %#x
# for revision x.0 offset of table with originals is 1Ch if directly after header
>4 ulelong&0x0000FFff =0
>>12 ulelong !0x1C \b, at 0x%x string table
>>12 ulelong !0x1C \b, at %#x string table
# but for x.1 table offset i found is 30h. That means directly after bigger header
>4 ulelong&0x0000FFff >0
>>12 ulelong !0x30 \b, at 0x%x string table
>>12 ulelong !0x30 \b, at %#x string table
# The following variables are only used in .mo files with minor revision >= 1
# number of system dependent segments
#>>28 ulelong x \b, %u segment
#>>28 ulelong >1 \bs
# offset of table describing system dependent segments
#>>32 ulelong x at 0x%x
#>>32 ulelong x at %#x
# number of system dependent strings pairs
>>36 ulelong x \b, %u sysdep message
>>36 ulelong >1 \bs
# offset of table with start offsets of original sysdep strings
#>>40 ulelong x \b, at 0x%x sysdep strings
#>>40 ulelong x \b, at %#x sysdep strings
# offset of table with start offsets of translated sysdep strings
#>>44 ulelong x \b, at 0x%x sysdep translations
# >>(44.l) ulelong x 0x%x chars
# >>>&0 ulelong x at 0x%x
#>>44 ulelong x \b, at %#x sysdep translations
# >>(44.l) ulelong x %#x chars
# >>>&0 ulelong x at %#x
# >>>>(&-4) string x "%s"
# string table after big header
#>>48 ubequad x \b, string table 0x%llx
#>>48 ubequad x \b, string table %#llx
#
# 0th string length seems to be always 0
#>(12.l) ulelong x \b, %u chars
#>>&0 ulelong x at 0x%x
# if 1st string length positiv inspect offset and string
#>>&0 ulelong x at %#x
# if 1st string length positive inspect offset and string
#>(12.l+8) ulelong >0 \b, %u chars
#>>&0 ulelong x at 0x%x
# if 2nd string length positiv inspect offset and string
#>>&0 ulelong x at %#x
# if 2nd string length positive inspect offset and string
# >(12.l+16) ulelong >0 \b, %u chars
# >>&0 ulelong x at 0x%x
# >>&0 ulelong x at %#x
# skip newline byte
#>>>(&-4) ubyte =0x0A
#>>>>&0 string x "%s"
#>>>(&-4) ubyte !0x0A
#>>>>&-1 string x '%s'
# offset of table with translation strings
#>16 ulelong x \b, at 0x%x translation table
#>16 ulelong x \b, at %#x translation table
# check translation 0 length and offset
>(16.l) ulelong >0
>>&0 ulelong x
@ -100,11 +100,11 @@
# TODO: for big endian use same code as for little endian
#>0 use \^gettext-object
# DEBUG code
#>16 ubelong x \b, at 0x%x translation table
#>(16.L) ubelong x 0x%x chars
#>>&0 ubelong x at 0x%x
#>16 ubelong x \b, at %#x translation table
#>(16.L) ubelong x %#x chars
#>>&0 ubelong x at %#x
# unexpected value HERE!
#>>>(&-4) ubequad x 0x%llx
#>>>(&-4) ubequad x %#llx
#
>4 beshort x revision %d.
>6 beshort >0 \b%d,

4
contrib/file/magic/Magdir/gpt

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: gpt,v 1.4 2017/03/17 21:35:28 christos Exp $
# $File: gpt,v 1.5 2020/12/12 20:01:47 christos Exp $
#
# GPT Partition table patterns.
# Author: Rogier Goossens (goossens.rogier@gmail.com)
@ -12,7 +12,7 @@
# This is kept separate, so that MBR partitions are not reported as well.
# (use -k if you do want them as well)
# First, detect the MBR partiton table
# First, detect the MBR partition table
# If more than one GPT protective MBR partition exists, don't print anything
# (the other MBR detection code will then just print the MBR partition table)
0x1FE leshort 0xAA55

10
contrib/file/magic/Magdir/gpu

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: gpu,v 1.2 2017/03/23 22:11:53 christos Exp $
# $File: gpu,v 1.3 2021/04/26 15:56:00 christos Exp $
# gpu: file(1) magic for GPU input files
# Standard Portable Intermediate Representation (SPIR)
@ -8,12 +8,12 @@
# Typical file extension: .spv
0 belong 0x07230203 Khronos SPIR-V binary, big-endian
>4 belong x \b, version 0x%08x
>8 belong x \b, generator 0x%08x
>4 belong x \b, version %#08x
>8 belong x \b, generator %#08x
0 lelong 0x07230203 Khronos SPIR-V binary, little-endian
>4 lelong x \b, version 0x%08x
>8 lelong x \b, generator 0x%08x
>4 lelong x \b, version %#08x
>8 lelong x \b, generator %#08x
# Vulkan Trace file
# Documentation:

13
contrib/file/magic/Magdir/guile

@ -1,13 +0,0 @@
#------------------------------------------------------------------------------
# $File: guile,v 1.2 2019/04/19 00:42:27 christos Exp $
# Guile file magic from <dalepsmith@gmail.com>
# https://www.gnu.org/s/guile/
# https://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250
0 string GOOF---- Guile Object
>8 string LE \b, little endian
>8 string BE \b, big endian
>11 string 4 \b, 32bit
>11 string 8 \b, 64bit
>13 regex .\.. \b, bytecode v%s

6
contrib/file/magic/Magdir/hitachi-sh

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: hitachi-sh,v 1.9 2018/08/21 12:48:41 christos Exp $
# $File: hitachi-sh,v 1.10 2020/12/12 20:01:47 christos Exp $
# hitach-sh: file(1) magic for Hitachi Super-H
#
# Super-H COFF
@ -16,7 +16,7 @@
# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
>18 ubeshort&0x8E80 0
# use big endian variant of subroutine to display name+variables+flags
# for common object formated files
# for common object formatted files
>>0 use \^display-coff
!:strength -10
@ -24,7 +24,7 @@
# test for unused flag bits in f_flags
>18 uleshort&0x8E80 0
# use little endian variant of subroutine to
# display name+variables+flags for common object formated files
# display name+variables+flags for common object formatted files
>>0 use display-coff
!:strength -10

4
contrib/file/magic/Magdir/human68k

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $
# $File: human68k,v 1.6 2021/04/26 15:56:00 christos Exp $
# human68k: file(1) magic for Human68k (X680x0 DOS) binary formats
# Magic too short!
#0 string HU Human68k
@ -12,7 +12,7 @@
#>(8.L+66) string #HUPAIR hupair
#>0 string HU X executable
#>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1
#>4 belong >0 - base address 0x%x
#>4 belong >0 - base address %#x
#>28 belong >0 not stripped
#>32 belong >0 with debug information
#0 beshort 0x601a Human68k Z executable

6
contrib/file/magic/Magdir/ibm370

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: ibm370,v 1.10 2017/03/17 21:35:28 christos Exp $
# $File: ibm370,v 1.11 2021/03/14 16:51:45 christos Exp $
# ibm370: file(1) magic for IBM 370 and compatibles.
#
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
@ -46,3 +46,7 @@
0 beshort 0535 SVR2 executable (USS/370)
>12 belong >0 not stripped
>24 belong >0 - version %d
# NETDATA (https://en.wikipedia.org/wiki/NETDATA)
# -\INMR01 In EBCDIC
0 string \x60\xe0\xc9\xd5\xd4\xd9\xf0\xf1 IBM NETDATA file

4
contrib/file/magic/Magdir/ibm6000

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: ibm6000,v 1.14 2019/03/07 17:21:54 christos Exp $
# $File: ibm6000,v 1.15 2021/07/03 14:01:46 christos Exp $
# ibm6000: file(1) magic for RS/6000 and the RT PC.
#
0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
@ -10,7 +10,9 @@
#>2 byte 0x50 pure
#>28 belong >0 not stripped
#>6 beshort >0 - version %ld
# GRR: line below is too general as it matches also TTComp archive, ASCII, 1K handled by ./archive
0 beshort 0x0104 shared library
# GRR: line below is too general as it matches also TTComp archive, ASCII, 2K handled by ./archive
0 beshort 0x0105 ctab data
0 beshort 0xfe04 structured file
0 string 0xabcdef AIX message catalog

26
contrib/file/magic/Magdir/icc

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: icc,v 1.6 2019/11/15 21:03:14 christos Exp $
# $File: icc,v 1.7 2021/04/26 15:56:00 christos Exp $
# icc: file(1) magic for International Color Consortium file formats
#
@ -123,9 +123,9 @@
# seconds <= 59
>>>>>34 ubeshort x \b:%.2u
# vendor specific flags like 2 in HPCLJ5.ICM
>>>44 ubeshort >0 \b, 0x%x vendor flags
>>>44 ubeshort >0 \b, %#x vendor flags
# profile flags bits 0-2 of least 16 used by ICC
#>>>44 ubelong >0 \b, 0x%x flags
#>>>44 ubelong >0 \b, %#x flags
# icEmbeddedProfileTrue
>>>44 ubelong &1 \b, embedded
# icEmbeddedProfileFalse
@ -138,9 +138,9 @@
#>>>44 ubelong ^4 \b, no MCS
# vendor specific device attributes 1~srgb.icc
# E000D00h~CNB7QEDA.ICM C000A00h~CNB5FCAA.ICM 01040401h~CNB25PE3.ICM
>>>56 ubelong >0 \b, 0x%x vendor attribute
>>>56 ubelong >0 \b, %#x vendor attribute
# ICC device attributes bits 0-7 used
#>>>60 ubelong x \b, 0x%x attribute
#>>>60 ubelong x \b, %#x attribute
# http://www.color.org/icc34.h
>>>60 ubelong &0x01 \b, transparent
#>>>60 ubelong ^0x01 \b, reflective
@ -159,7 +159,7 @@
>>>60 ubelong &0x80 \b, self-luminous
#>>>60 ubelong ^0x80 \b, non-self-luminous
# rendering intent 0-3 but 7AEA5027h in EE051__1.ICM 6CB1BCh in EE061__1.ICM
>>>64 ubelong >3 \b, 0x%x rendering intent
>>>64 ubelong >3 \b, %#x rendering intent
#>>>64 ubelong =0 \b, perceptual
>>>64 ubelong =1 \b, relative colorimetric
>>>64 ubelong =2 \b, saturation
@ -168,16 +168,16 @@
>>>71 ubequad !0xd6000100000000d3 \b, PCS
# usually X~0.9642*65536=63189.8112~63190=F6D5h ; but also found
# often F6D6 in gt5000r.icm, F6B8 in kodakce.icm, F6CA in RSWOP.icm
>>>>68 ubelong !0x0000f6d5 X=0x%x
>>>>68 ubelong !0x0000f6d5 X=%#x
# usually Y=1.0~00010000h but Y=0 in brmsl07f.icm
>>>>72 ubelong !0x00010000 Y=0x%x
>>>>72 ubelong !0x00010000 Y=%#x
# usually Z~0.8249*65536=54060.6464~54061=D32Dh ; but also found
# D2F7 in hp1200c.icm, often D32C in A925A.icm, D309 in RSWOP.icm , D2F8 in kodak_dc.icm
>>>>76 ubelong !0x0000d32d Z=0x%x
>>>>76 ubelong !0x0000d32d Z=%#x
# Profile ID. MD5 fingerprinting method as defined in Internet RFC 1321.
>>>84 ubequad >0 \b, 0x%llx MD5
>>>84 ubequad >0 \b, %#llx MD5
# reserved in older versions should be zero but also found CDCDCDCDCDCDCDCD
#>>100 ubequad x \b 0x%llx reserved
#>>100 ubequad x \b %#llx reserved
# tag table
# 6 <= tags count <= 43
#>>>128 ubelong >43 \b, %u tags
@ -191,8 +191,8 @@
>>>>132 default x \b, no copyright tag
# 1st tag
#>>>132 string x \b, 1st tag %.4s
#>>>136 ubelong x 0x%x offset
#>>>140 ubelong x 0x%x len
#>>>136 ubelong x %#x offset
#>>>140 ubelong x %#x len
# 2nd tag,...
# look also for profileDescriptionTag "desc"
>>>132 search/508 desc

10
contrib/file/magic/Magdir/iff

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: iff,v 1.14 2015/09/07 10:03:21 christos Exp $
# $File: iff,v 1.17 2021/02/23 01:07:32 christos Exp $
# iff: file(1) magic for Interchange File Format (see also "audio" & "images")
#
# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
@ -41,8 +41,10 @@
>8 string ANIM \b, ANIM animation
>8 string YAFA \b, YAFA animation
>8 string SSA\ \b, SSA super smooth animation
>8 string FANT \b, Fantavision animation
>8 string ACBM \b, ACBM continuous image
>8 string FAXX \b, FAXX fax image
>8 string STFX \b, ST-Fax image
# other formats
>8 string FTXT \b, FTXT formatted text
>8 string CTLG \b, CTLG message catalog
@ -51,7 +53,11 @@
>8 string PTCH \b, PTCH binary patch
>8 string AMFF \b, AMFF AmigaMetaFile format
>8 string WZRD \b, WZRD StormWIZARD resource
>8 string DOC\ \b, DOC desktop publishing document
>8 string DOC\040 \b, DOC desktop publishing document
>8 string SWRT \b, SWRT Final Copy/Writer document
>8 string WORD \b, ProWrite document
>8 string WTXT \b, WTXT Wordworth document
>8 string WOWO \b, WOWO Wordworth document
>8 string WVQA \b, Westwood Studios VQA Multimedia,
>>24 leshort x %d video frames,
>>26 leshort x %d x

736
contrib/file/magic/Magdir/images

File diff suppressed because it is too large Load Diff

6
contrib/file/magic/Magdir/intel

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: intel,v 1.18 2020/04/18 16:19:03 christos Exp $
# $File: intel,v 1.20 2021/04/26 15:56:00 christos Exp $
# intel: file(1) magic for x86 Unix
#
# Various flavors of x86 UNIX executable/object (other than Xenix, which
@ -37,7 +37,7 @@
# ./intel (version 5.25) label labeled the next entry as "80386 COFF executable"
# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
0 leshort =0514
# use subroutine to display name+flags+variables for common object formated files
# use subroutine to display name+flags+variables for common object formatted files
>0 use display-coff
#>12 lelong >0 not stripped
# no hint found, that at offset 22 is version
@ -118,7 +118,7 @@
# length, in bytes, of the entire DSDT (including the header)
>>4 ulelong x \b, %u bytes
# entire table must sum to zero
#>>9 ubyte x \b, checksum 0x%x
#>>9 ubyte x \b, checksum %#x
# vendor ID for the ASL Compiler like: INTL MSFT ...
>>28 string >\0 \b, created by %.4s
# revision number of the ASL Compiler like: 20051117 20140724 20190703 20200110 ...

25
contrib/file/magic/Magdir/jpeg

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: jpeg,v 1.32 2018/10/01 18:58:29 christos Exp $
# $File: jpeg,v 1.36 2021/08/28 12:30:52 christos Exp $
# JPEG images
# SunOS 5.5.1 had
#
@ -9,11 +9,19 @@
#
# both of which turn into "JPEG image data" here.
#
0 beshort 0xffd8 JPEG image data
0 belong 0xffd8fff7 JPEG-LS image data
!:mime image/jls
!:ext jls
>0 use jpeg
0 belong&0xffffff00 0xffd8ff00 JPEG image data
!:mime image/jpeg
!:apple 8BIMJPEG
!:strength *3
!:ext jpeg/jpg/jpe/jfif
>0 use jpeg
0 name jpeg
>6 string JFIF \b, JFIF standard
# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
# in a vain attempt to add image size reporting for JFIF. Note that these
@ -91,7 +99,7 @@
>>0 beshort&0xFFE0 !0xFFE0
>>>(2.S+2) use jpeg_segment
#>0 beshort x unknown 0x%x
#>0 beshort x unknown %#x
#>>(2.S+2) use jpeg_segment
# HSI is Handmade Software's proprietary JPEG encoding scheme
@ -124,3 +132,14 @@
>>4 lelong%2 0 JPEG-XR
!:mime image/jxr
!:ext jxr
# JPEG XL
# From: Ian Tester
0 string \xff\x0a JPEG XL codestream
!:mime image/jxl
!:ext jxl
# JPEG XL (transcoded JPEG file)
0 string \x00\x00\x00\x0cJXL\x20\x0d\x0a\x87\x0a JPEG XL container
!:mime image/jxl
!:ext jxl

64
contrib/file/magic/Magdir/lammps Normal file

@ -0,0 +1,64 @@
#------------------------------------------------------------------------------
# $File: lammps,v 1.1 2021/03/14 16:24:18 christos Exp $
#
# Magic file patterns for use with file(1) for the
# LAMMPS molecular dynamics simulation software.
# https://lammps.sandia.gov
#
# Updated: 2021-03-14 by akohlmey@gmail.com
# Binary restart file for the LAMMPS MD code
0 string LammpS\ RestartT LAMMPS binary restart file
>0x14 long x (rev %d),
>>0x20 string x Version %s,
>>>0x10 lelong 0x0001 Little Endian
>>>0x10 lelong 0x1000 Big Endian
# Atom style binary dump file for the LAMMPS MD code
# written on a little endian machine
0 lequad -8
>0x08 string DUMPATOM LAMMPS atom style binary dump
>>0x14 long x (rev %d),
>>>0x10 lelong 0x0001 Little Endian,
>>>>0x18 lequad x First time step: %lld
# written on a big endian machine
0 bequad -8
>0x08 string DUMPATOM LAMMPS atom style binary dump
>>0x14 belong x (rev %d),
>>>0x10 lelong 0x1000 Big Endian,
>>>>0x18 bequad x First time step: %lld
# Atom style binary dump file for the LAMMPS MD code
# written on a little endian machine
0 lequad -10
>0x08 string DUMPCUSTOM LAMMPS custom style binary dump
>>0x16 lelong x (rev %d),
>>>0x12 lelong 0x0001 Little Endian,
>>>>0x1a lequad x First time step: %lld
# written on a big endian machine
0 bequad -10
>0x08 string DUMPCUSTOM LAMMPS custom style binary dump
>>0x16 belong x (rev %d),
>>>0x12 lelong 0x1000 Big Endian,
>>>>0x1a bequad x First time step: %lld
# LAMMPS log file
0 string LAMMPS\ ( LAMMPS log file
>8 regex/16 [0-9]+\ [A-Za-z]+\ [0-9]+ written by version %s
# Data file written either by LAMMPS, msi2lmp or VMD/TopoTools
0 string LAMMPS\ data\ file LAMMPS data file
>0x12 string CGCMM\ style written by TopoTools
>0x12 string msi2lmp written by msi2lmp
>0x11 string via\ write_data written by LAMMPS
# LAMMPS data file written by OVITO
0 string #\ LAMMPS\ data\ file LAMMPS data file
>0x13 string written\ by\ OVITO written by OVITO
# LAMMPS text mode dump file
0 string ITEM:\ TIMESTEP LAMMPS text mode dump,
>15 regex/16 [0-9]+ First time step: %s

45
contrib/file/magic/Magdir/lif

@ -1,8 +1,49 @@
#------------------------------------------------------------------------------
# $File: lif,v 1.8 2009/09/19 16:28:10 christos Exp $
# $File: lif,v 1.10 2021/04/26 15:56:00 christos Exp $
# lif: file(1) magic for lif
#
# (Daniel Quinlan <quinlan@yggdrasil.com>)
#
0 beshort 0x8000 lif file
# Modified by: Joerg Jenderek
# URL: https://www.hp9845.net/9845/projects/hpdir/
# https://github.com/bug400/lifutils
# Reference: https://www.hp9845.net/9845/downloads/manuals/LIF_excerpt_64941-90906_flpRef_Jan84.pdf
# Note: called by TrID "HP Logical Interchange Format disk image"
0 beshort 0x8000
# GRR: line above is too general as it catches also compressed DEGAS low-res bitmap *.pc1
# skip many compressed DEGAS low-res bitmap *.pc1 by test for unused bytes
>14 beshort =0
# skip MUNCHIE.PC1 BOARD.PC1 ENEMIES.PC1 by test for low version number
>>20 ubeshort <0x0100
# skip DEGAS MUNCHIE.PC1 BOARD.PC1 ENEMIES.PC1 by test for ASCII like volume name
#>>>2 ubelong >0x2020201F
>>>0 use lif-file
0 name lif-file
# LIF ID
>0 beshort x lif file
!:mime application/x-lif-disk
# lif used by Tony Duell LIF utilities; enhanced version by Joachim Siebold use also dat; hpi used by hpdir
!:ext lif/hpi/dat
# volume label; A-Z 0-9 _ ; default are 6 spaces
>2 string x "%.6s"
# version number; 0 for systems without extensions or 1 for model 64000
>20 ubeshort x \b, version %u
# LIF identifier; 010000 for system 3000
>12 beshort !0x1000 \b, LIF identifier %#x
# directory start address in units like: 2
>8 ubelong x \b, directory
>8 ubelong !2 start address %u
# length of directory like: 2 4 7 10 12 14 (for model 64000) 16 18 20 24 30 50 57 77 80
>16 ubelong x length %u
# level 1 extensions
>20 beshort =0
>>24 ubequad !0 \b, for extensions %#llx...
>20 beshort >0
>>24 ubequad !0 \b, extensions %#llx...
# word 21-126 reserved for extensions and future use; set to nil
>42 ubequad !0 \b, RESERVED %#llx
# lif first file name for standard directory; 0xffff... means uninitialized
>8 ubelong 2
>>512 string <\xff\xff \b, 1st file %-.10s

79
contrib/file/magic/Magdir/linux

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: linux,v 1.72 2020/06/07 21:56:13 christos Exp $
# $File: linux,v 1.79 2021/04/26 15:56:00 christos Exp $
# linux: file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
@ -83,20 +83,20 @@
# format v1, supported since 1998
0 name linux-swap
>0x400 lelong 1 little endian, version %u,
>>0x404 lelong x size %u pages,
>>0x408 lelong x %u bad pages,
>0x400 belong 1 big endian, version %u,
>>0x404 belong x size %u pages,
>>0x408 belong x %u bad pages,
>0x41c string \0 no label,
>0x41c string >\0 LABEL=%s,
>0x40c belong x UUID=%08x
>0x410 beshort x \b-%04x
>0x412 beshort x \b-%04x
>0x414 beshort x \b-%04x
>0x416 belong x \b-%08x
>0x41a beshort x \b%04x
>0x400 lelong 1 little endian, version %u,
>>0x404 lelong x size %u pages,
>>0x408 lelong x %u bad pages,
>0x400 belong 1 big endian, version %u,
>>0x404 belong x size %u pages,
>>0x408 belong x %u bad pages,
>0x41c string \0 no label,
>0x41c string >\0 LABEL=%s,
>0x40c ubelong x UUID=%08x
>0x410 ubeshort x \b-%04x
>0x412 ubeshort x \b-%04x
>0x414 ubeshort x \b-%04x
>0x416 ubelong x \b-%08x
>0x41a ubeshort x \b%04x
0xff6 string SWAPSPACE2 Linux swap file, 4k page size,
>0 use linux-swap
@ -154,8 +154,8 @@
>>>>(526.s+0x200) string >\0 version %s,
>>498 leshort 1 RO-rootFS,
>>498 leshort 0 RW-rootFS,
>>508 leshort >0 root_dev 0x%X,
>>502 leshort >0 swap_dev 0x%X,
>>508 leshort >0 root_dev %#X,
>>502 leshort >0 swap_dev %#X,
>>504 leshort >0 RAMdisksize %u KB,
>>506 leshort 0xFFFF Normal VGA
>>506 leshort 0xFFFE Extended VGA
@ -191,8 +191,8 @@
>497 leshort !0 x86 kernel
>>504 leshort >0 RAMdisksize=%u KB
>>502 leshort >0 swap=0x%X
>>508 leshort >0 root=0x%X
>>502 leshort >0 swap=%#X
>>508 leshort >0 root=%#X
>>>498 leshort 1 \b-ro
>>>498 leshort 0 \b-rw
>>506 leshort 0xFFFF vga=normal
@ -239,14 +239,14 @@
# From: Kevin Cernekee <cernekee@gmail.com>
# Update: Joerg Jenderek
0x24 lelong 0x016f2818 Linux kernel ARM boot executable zImage
# There are three posible situations: LE, BE with LE bootloader and pure BE.
# There are three possible situations: LE, BE with LE bootloader and pure BE.
# In order to aid telling these apart a new endian flag was added. In order
# to support kernels before the flag and BE with LE bootloader was added we'll
# do a negative check against the BE variant of the flag when we see a LE magic.
>0x30 belong !0x04030201 (little-endian)
>0x30 belong 0x04030201 (big-endian)
# raspian "kernel7.img", Vu+ Ultimo4K "kernel_auto.bin"
!:ext img/bin
>0x30 belong 0x04030201 (big-endian)
0x24 belong 0x016f2818 Linux kernel ARM boot executable zImage (big-endian)
############################################################################
@ -438,17 +438,16 @@
# Documentation/devicetree/booting-without-of.txt
# From Christoph Biedl
0 belong 0xd00dfeed
# structure and strings must be within blob
# structure must be within blob, strings are omitted to handle devicetrees > 1M
>&(8.L) byte x
>>&(12.L) byte x
>>>20 belong >1 Device Tree Blob version %d
>>>>4 belong x \b, size=%d
>>>>20 belong >1
>>>>>28 belong x \b, boot CPU=%d
>>>>20 belong >2
>>>>>32 belong x \b, string block size=%d
>>>>20 belong >16
>>>>>36 belong x \b, DT structure block size=%d
>>20 belong >1 Device Tree Blob version %d
>>>4 belong x \b, size=%d
>>>20 belong >1
>>>>28 belong x \b, boot CPU=%d
>>>20 belong >2
>>>>32 belong x \b, string block size=%d
>>>20 belong >16
>>>>36 belong x \b, DT structure block size=%d
# glibc locale archive as defined in glibc locale/locarchive.h
0 lelong 0xde020109 locale archive
@ -518,3 +517,21 @@
0 search/1024 /dts-v1/ Device Tree File (v1)
# beat c code
!:strength +14
# e2fsck undo file
# David Gilman <davidgilman1@gmail.com>
0 string E2UNDO02 e2fsck undo file, version 2
>44 lelong x \b, undo file is
>>44 lelong&1 0 not finished
>>44 lelong&1 1 finished
>48 lelong x \b, undo file features:
>>48 lelong&1 0 lacks filesystem offset
>>48 lelong&1 1 has filesystem offset
>>>64 lequad x at %#llx
# ansible vault (does not really belong here)
0 string $ANSIBLE_VAULT; Ansible Vault
>&0 regex [0-9]*\.[0-9]* \b, version %s
>>&0 string ;
>>>&0 regex [A-Z0-9]* \b, encryption %s

5
contrib/file/magic/Magdir/lisp

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: lisp,v 1.26 2019/04/19 00:42:27 christos Exp $
# $File: lisp,v 1.27 2020/08/14 19:23:39 christos Exp $
# lisp: file(1) magic for lisp programs
#
# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
@ -60,6 +60,9 @@
!:apple EMAxTEXT
!:ext elc
# Files produced by GNU/Emacs pdumper
0 string DUMPEDGNUEMACS GNU/Emacs pdumper image
# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
0 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27)
0 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text

12
contrib/file/magic/Magdir/locoscript Normal file

@ -0,0 +1,12 @@
#------------------------------------------------------------------------------
# $File: locoscript,v 1.1 2021/01/03 20:56:25 christos Exp $
# locoscript: file(1) magic for LocoScript documents and related files
#
# See http://fileformats.archiveteam.org/wiki/LocoScript
0 string JOY\x01\x01 LocoScript 1 document
0 string JOY\x01\x02 LocoScript 2 document
0 string JOY\x01\x04 LocoScript 3 document
0 string JOY\x01\x06 LocoScript 4 document
0 string DOC\x01\x01 LocoScript PC document
0 string DOC\x01\x03 LocoScript Professional document

11
contrib/file/magic/Magdir/lua

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: lua,v 1.7 2019/04/19 00:42:27 christos Exp $
# $File: lua,v 1.8 2020/10/08 23:23:56 christos Exp $
# lua: file(1) magic for Lua scripting language
# URL: https://www.lua.org/
# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
@ -17,6 +17,15 @@
# Lua bytecode
0 string \033Lua Lua bytecode,
# 2.4 uses 0x23 as its version byte because it shares the format
# with 2.3 (which was never released publicly).
>4 byte 0x23 version 2.4
>4 byte 0x25 version 2.5/3.0
>4 byte 0x31 version 3.1
>4 byte 0x32 version 3.2
>4 byte 0x40 version 4.0
>4 byte 0x50 version 5.0
>4 byte 0x51 version 5.1
>4 byte 0x52 version 5.2
>4 byte 0x53 version 5.3
>4 byte 0x54 version 5.4

140
contrib/file/magic/Magdir/mach

@ -1,6 +1,6 @@
#------------------------------------------------------------
# $File: mach,v 1.23 2015/10/15 21:51:22 christos Exp $
# $File: mach,v 1.29 2021/04/26 15:56:00 christos Exp $
# Mach has two magic numbers, 0xcafebabe and 0xfeedface.
# Unfortunately the first, cafebabe, is shared with
# Java ByteCode, so they are both handled in the file "cafebabe".
@ -11,8 +11,11 @@
# it's also separate from the "64-bit libraries" bit in the
# upper 8 bits of the CPU subtype
# Reference: https://opensource.apple.com/source/cctools/cctools-949.0.1/
# include/mach-o/loader.h
# display CPU type as string like: i386 x86_64 ... armv7 armv7k ...
0 name mach-o-cpu
>0 belong&0x01000000 0
>0 belong&0xff000000 0
#
# 32-bit ABIs.
#
@ -51,37 +54,37 @@
>>>>4 belong&0x00fffff0 0x30 pentium_2_m3
>>>>4 belong&0x00fffff0 0x40 pentium_2_m0x40
>>>>4 belong&0x00fffff0 0x50 pentium_2_m5
>>>>4 belong&0x00fffff0 >0x50 pentium_2_m0x%x
>>>>4 belong&0x00fffff0 >0x50 pentium_2_m%#x
>>>4 belong&0x0000000f 7 celeron
>>>>4 belong&0x00fffff0 0x00 \b_m0x%x
>>>>4 belong&0x00fffff0 0x10 \b_m0x%x
>>>>4 belong&0x00fffff0 0x20 \b_m0x%x
>>>>4 belong&0x00fffff0 0x30 \b_m0x%x
>>>>4 belong&0x00fffff0 0x40 \b_m0x%x
>>>>4 belong&0x00fffff0 0x50 \b_m0x%x
>>>>4 belong&0x00fffff0 0x00 \b_m%#x
>>>>4 belong&0x00fffff0 0x10 \b_m%#x
>>>>4 belong&0x00fffff0 0x20 \b_m%#x
>>>>4 belong&0x00fffff0 0x30 \b_m%#x
>>>>4 belong&0x00fffff0 0x40 \b_m%#x
>>>>4 belong&0x00fffff0 0x50 \b_m%#x
>>>>4 belong&0x00fffff0 0x60
>>>>4 belong&0x00fffff0 0x70 \b_mobile
>>>>4 belong&0x00fffff0 >0x70 \b_m0x%x
>>>>4 belong&0x00fffff0 >0x70 \b_m%#x
>>>4 belong&0x0000000f 8 pentium_3
>>>>4 belong&0x00fffff0 0x00
>>>>4 belong&0x00fffff0 0x10 \b_m
>>>>4 belong&0x00fffff0 0x20 \b_xeon
>>>>4 belong&0x00fffff0 >0x20 \b_m0x%x
>>>>4 belong&0x00fffff0 >0x20 \b_m%#x
>>>4 belong&0x0000000f 9 pentiumM
>>>>4 belong&0x00fffff0 0x00
>>>>4 belong&0x00fffff0 >0x00 \b_m0x%x
>>>>4 belong&0x00fffff0 >0x00 \b_m%#x
>>>4 belong&0x0000000f 10 pentium_4
>>>>4 belong&0x00fffff0 0x00
>>>>4 belong&0x00fffff0 0x10 \b_m
>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x
>>>>4 belong&0x00fffff0 >0x10 \b_m%#x
>>>4 belong&0x0000000f 11 itanium
>>>>4 belong&0x00fffff0 0x00
>>>>4 belong&0x00fffff0 0x10 \b_2
>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x
>>>>4 belong&0x00fffff0 >0x10 \b_m%#x
>>>4 belong&0x0000000f 12 xeon
>>>>4 belong&0x00fffff0 0x00
>>>>4 belong&0x00fffff0 0x10 \b_mp
>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x
>>>>4 belong&0x00fffff0 >0x10 \b_m%#x
>>>4 belong&0x0000000f >12 ia32 family=%d
>>>>4 belong&0x00fffff0 0x00
>>>>4 belong&0x00fffff0 >0x00 model=%x
@ -139,13 +142,13 @@
>>>4 belong&0x00ffffff 6 \b_604
>>>4 belong&0x00ffffff 7 \b_604e
>>>4 belong&0x00ffffff 8 \b_620
>>>4 belong&0x00ffffff 9 \b_650
>>>4 belong&0x00ffffff 9 \b_750
>>>4 belong&0x00ffffff 10 \b_7400
>>>4 belong&0x00ffffff 11 \b_7450
>>>4 belong&0x00ffffff 100 \b_970
>>>4 belong&0x00ffffff >100 subarchitecture=%d
>>0 belong&0x00ffffff >18 architecture=%d
>0 belong&0x01000000 0x01000000
>0 belong&0xff000000 0x01000000
#
# 64-bit ABIs.
#
@ -171,6 +174,15 @@
>>0 belong&0x00ffffff 12 arm64
>>>4 belong&0x00ffffff 0
>>>4 belong&0x00ffffff 1 \bv8
>>>4 belong&0x00ffffff 2 \be
>>>>7 ubyte&0xff >0 (caps:
>>>>7 ubyte&0xff <0x80 %#02x
>>>>7 ubyte&0xc0 0x80 PAC
>>>>>7 ubyte&0x3f x \b%02d
>>>>7 ubyte&0xc0 0xc0 PAK
>>>>>7 ubyte&0x3f x \b%02d
>>>>7 ubyte&0xff x \b)
>>>4 belong&0x00ffffff >2 subarchitecture=%d
>>0 belong&0x00ffffff 13 64-bit architecture=%d
>>0 belong&0x00ffffff 14 64-bit architecture=%d
>>0 belong&0x00ffffff 15 64-bit architecture=%d
@ -192,51 +204,91 @@
>>>4 belong&0x00ffffff 100 \b_970
>>>4 belong&0x00ffffff >100 subarchitecture=%d
>>0 belong&0x00ffffff >18 64-bit architecture=%d
>0 belong&0xff000000 0x02000000
#
# 64_32-bit ABIs.
#
>>0 belong&0x00ffffff 0 64_32-bit architecture=%d
>>0 belong&0x00ffffff 1 64_32-bit architecture=%d
>>0 belong&0x00ffffff 2 64_32-bit architecture=%d
>>0 belong&0x00ffffff 3 64_32-bit architecture=%d
>>0 belong&0x00ffffff 4 64_32-bit architecture=%d
>>0 belong&0x00ffffff 5 64_32-bit architecture=%d
>>0 belong&0x00ffffff 6 64_32-bit architecture=%d
>>0 belong&0x00ffffff 7 64_32-bit architecture=%d
>>0 belong&0x00ffffff 8 64_32-bit architecture=%d
>>0 belong&0x00ffffff 9 64_32-bit architecture=%d
>>0 belong&0x00ffffff 10 64_32-bit architecture=%d
>>0 belong&0x00ffffff 11 64_32-bit architecture=%d
>>0 belong&0x00ffffff 12 64_32-bit arm
>>>4 belong&0x00ffffff 0
>>>4 belong&0x00ffffff 1 \bv8
>>>4 belong&0x00ffffff >1 subarchitecture=%d
>>0 belong&0x00ffffff 13 64_32-bit architecture=%d
>>0 belong&0x00ffffff 14 64_32-bit architecture=%d
>>0 belong&0x00ffffff 15 64_32-bit architecture=%d
>>0 belong&0x00ffffff 16 64_32-bit architecture=%d
>>0 belong&0x00ffffff 17 64_32-bit architecture=%d
>>0 belong&0x00ffffff 18 64_32-bit architecture=%d
>>0 belong&0x00ffffff >18 64_32-bit architecture=%d
0 name mach-o-be
>0 byte 0xcf 64-bit
>4 use mach-o-cpu
>12 belong 1 object
# GRR: Does not work for Mach-O with 2 architectures; instead display oo
#!:ext o
!:ext o/
>12 belong 2 executable
# the executables normally have no file extension like perl,
# but exceptions like perl5.18 perl5.16
!:ext 16/18/
>12 belong 3 fixed virtual memory shared library
>12 belong 4 core
>12 belong 5 preload executable
>12 belong 6 dynamically linked shared library
# GRR: Does not work for Mach-O with 2 architectures; instead display dylibdylib
#!:ext dylib
!:ext dylib/
>12 belong 7 dynamic linker
>12 belong 8 bundle
# normally name extension bundle; but exceptions like: AMDil_r700.dylib
!:ext bundle/dylib/
>12 belong 9 dynamically linked shared library stub
>12 belong 10 dSYM companion file
>12 belong 11 kext bundle
>12 belong >11
>>12 belong x filetype=%d
>24 belong >0 \b, flags:<
>>24 belong &0x0000001 \bNOUNDEFS
>>24 belong &0x0000002 \b|INCRLINK
>>24 belong &0x0000004 \b|DYLDLINK
>>24 belong &0x0000008 \b|BINDATLOAD
>>24 belong &0x0000010 \b|PREBOUND
>>24 belong &0x0000020 \b|SPLIT_SEGS
>>24 belong &0x0000040 \b|LAZY_INIT
>>24 belong &0x0000080 \b|TWOLEVEL
>>24 belong &0x0000100 \b|FORCE_FLAT
>>24 belong &0x0000200 \b|NOMULTIDEFS
>>24 belong &0x0000400 \b|NOFIXPREBINDING
>>24 belong &0x0000800 \b|PREBINDABLE
>>24 belong &0x0001000 \b|ALLMODSBOUND
>>24 belong &0x0002000 \b|SUBSECTIONS_VIA_SYMBOLS
>>24 belong &0x0004000 \b|CANONICAL
>>24 belong &0x0008000 \b|WEAK_DEFINES
>>24 belong &0x0010000 \b|BINDS_TO_WEAK
>>24 belong &0x0020000 \b|ALLOW_STACK_EXECUTION
>>24 belong &0x0040000 \b|ROOT_SAFE
>>24 belong &0x0080000 \b|SETUID_SAFE
>>24 belong &0x0100000 \b|NO_REEXPORTED_DYLIBS
>>24 belong &0x0200000 \b|PIE
>>24 belong &0x0400000 \b|DEAD_STRIPPABLE_DYLIB
>>24 belong &0x0800000 \b|HAS_TLV_DESCRIPTORS
>>24 belong &0x1000000 \b|NO_HEAP_EXECUTION
>>24 belong &0x2000000 \b|APP_EXTENSION_SAFE
>>24 belong &0x00000001 \bNOUNDEFS
>>24 belong &0x00000002 \b|INCRLINK
>>24 belong &0x00000004 \b|DYLDLINK
>>24 belong &0x00000008 \b|BINDATLOAD
>>24 belong &0x00000010 \b|PREBOUND
>>24 belong &0x00000020 \b|SPLIT_SEGS
>>24 belong &0x00000040 \b|LAZY_INIT
>>24 belong &0x00000080 \b|TWOLEVEL
>>24 belong &0x00000100 \b|FORCE_FLAT
>>24 belong &0x00000200 \b|NOMULTIDEFS
>>24 belong &0x00000400 \b|NOFIXPREBINDING
>>24 belong &0x00000800 \b|PREBINDABLE
>>24 belong &0x00001000 \b|ALLMODSBOUND
>>24 belong &0x00002000 \b|SUBSECTIONS_VIA_SYMBOLS
>>24 belong &0x00004000 \b|CANONICAL
>>24 belong &0x00008000 \b|WEAK_DEFINES
>>24 belong &0x00010000 \b|BINDS_TO_WEAK
>>24 belong &0x00020000 \b|ALLOW_STACK_EXECUTION
>>24 belong &0x00040000 \b|ROOT_SAFE
>>24 belong &0x00080000 \b|SETUID_SAFE
>>24 belong &0x00100000 \b|NO_REEXPORTED_DYLIBS
>>24 belong &0x00200000 \b|PIE
>>24 belong &0x00400000 \b|DEAD_STRIPPABLE_DYLIB
>>24 belong &0x00800000 \b|HAS_TLV_DESCRIPTORS
>>24 belong &0x01000000 \b|NO_HEAP_EXECUTION
>>24 belong &0x02000000 \b|APP_EXTENSION_SAFE
>>24 belong &0x04000000 \b|NLIST_OUTOFSYNC_WITH_DYLDINFO
>>24 belong &0x08000000 \b|SIM_SUPPORT
>>24 belong &0x80000000 \b|DYLIB_IN_CACHE
>>24 belong x \b>
#

18
contrib/file/magic/Magdir/macintosh

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: macintosh,v 1.30 2019/12/14 20:40:26 christos Exp $
# $File: macintosh,v 1.32 2021/04/26 15:56:00 christos Exp $
# macintosh description
#
# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
@ -17,7 +17,7 @@
0 search/2652/b (This\ file\
>&0 use binhex
0 name binhex
# keep splitted search string format similar like in version 5.37
# keep split search string format similar like in version 5.37
>0 string must\ be\ converted\ with\ BinHex\ BinHex binary text, version
# http://www.macdisk.com/binhexen.php3
!:apple BNHQTEXT
@ -141,7 +141,7 @@
!:ext bin/macbin
# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary
#>1 ubyte >63 \b, name length %u too BIG!
#>122 ubeshort x \b, version 0x%x
#>122 ubeshort x \b, version %#x
# Finder flags if not 0
# >73 byte !0 \b, flags 0x
# >73 byte =0
@ -164,21 +164,21 @@
# 77 beshort # horiz posn in window
#>77 beshort !0 \b, h.pos %u
# 79 beshort # window or folder ID
>79 ubeshort !0 \b, ID 0x%x
>79 ubeshort !0 \b, ID %#x
# protected flag
>81 byte !0 \b, protected 0x%x
>81 byte !0 \b, protected %#x
# length of comment after resource
>99 ubeshort !0 \b, comment length %u
# char. code of file name
>106 ubyte !0 \b, char. code 0x%x
>106 ubyte !0 \b, char. code %#x
# still more Finder flags
>107 ubyte !0 \b, more flags 0x%x
>107 ubyte !0 \b, more flags %#x
# length of total files when unpacked only used when pack and unpack on the fly
>116 ubelong !0 \b, total length %u
# 120 beshort # length of add'l header
>120 ubeshort !0 \b, 2nd header length %u
# 124 beshort # checksum
#>124 ubeshort !0 \b, CRC 0x%x
#>124 ubeshort !0 \b, CRC %#x
# creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080
>91 beldate-0x7C25B080 x \b, %s
# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow
@ -204,7 +204,7 @@
# Afterwards resource fork if length of resource segment not zero
>87 ubelong !0
# calculate resource fork offset
>>83 ubelong+128 x \b, at 0x%x
>>83 ubelong+128 x \b, at %#x
# length of resource segment
>>87 ubelong !0 %u bytes
>>(83.S+128) ubequad x resource

11
contrib/file/magic/Magdir/mail.news

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: mail.news,v 1.25 2019/06/21 20:06:05 christos Exp $
# $File: mail.news,v 1.28 2021/09/11 19:20:15 christos Exp $
# mail.news: file(1) magic for mail and news
#
# Unfortunately, saved netnews also has From line added in some news software.
@ -24,6 +24,8 @@
!:mime message/news
0 string/t From: news or mail text
!:mime message/rfc822
0 string/t Date: news or mail text
!:mime message/rfc822
0 string/t Article saved news text
!:mime message/news
# Reference: http://quimby.gnus.org/notes/BABYL
@ -75,3 +77,10 @@
>12 belong =1 version 1, big-endian
>12 lelong =1 version 1, little-endian
>12 belong x version %d, network-endian
# Dovecot mail server, version 2.2 and later.
# Dovecot mailing list: dovecot@dovecot.org
# File format spec: https://wiki.dovecot.org/Design/Dcrypt/#File_format
# From: Stephen Gildea
0 string CRYPTED\003\007 Dovecot encrypted message
>9 byte x \b, dcrypt version %d

112
contrib/file/magic/Magdir/map

@ -1,7 +1,7 @@
#------------------------------------------------------------------------------
# $File: map,v 1.8 2019/12/01 22:46:23 christos Exp $
# $File: map,v 1.9 2021/04/26 15:56:00 christos Exp $
# map: file(1) magic for Map data
#
@ -40,7 +40,7 @@
>0 ubyte x Garmin
!:mime application/x-garmin-map
# If non-zero, every byte of the entire .img file is to be XORed with this value
>0 ubyte !0 \b, 0x%x XORed
>0 ubyte !0 \b, %#x XORed
# goto block before FAT
>(0x40.b*512) ubyte x
# 1st fat name "DLLINFO TXT" only found for vpm
@ -54,7 +54,7 @@
>>&512 string !DLLINFO\ TXT map
!:ext img
# 9 zeros
>1 ubelong !0 \b, zeroes 0x%x
>1 ubelong !0 \b, zeroes %#x
# Map's version major
>8 ubyte x v%u
# Map's version minor
@ -72,12 +72,12 @@
# Update month (0-11)
>0xA ubyte x \b-%.2u
# All zeroes
>0xc uleshort !0 \b, zeroes 0x%x
>0xc uleshort !0 \b, zeroes %#x
# Mapsource flag, 1 - file created by Mapsource, 0 - Garmin map visible in Basecamp and Homeport
#>0xE ubyte !0 \b, Mapsource flag 0x%x
#>0xE ubyte !0 \b, Mapsource flag %#x
>0xE ubyte 1 \b, Mapsource
# Checksum, sum of all bytes modulo 256 should be 0
#>0xF ubyte x \b, Checksum 0x%x
#>0xF ubyte x \b, Checksum %#x
# Signature: DSKIMG 0x00 or DSDIMG 0x00 for demo map
>0x10 string !DSKIMG \b, signature "%.7s"
>0x39 use garmin-date
@ -99,20 +99,20 @@
# MBR signature
>0x1FE leshort !0xAA55 \b, invalid MBR
# 512 zeros
>0x200 uquad !0 \b, zeroes 0x%llx
>0x200 uquad !0 \b, zeroes %#llx
# First sub-file offset (absolute); sometimes NO/UNKNOWN sub file!
>0x40C ulelong >0 \b, at 0x%x
>0x40C ulelong >0 \b, at %#x
# sub-file Header length
#>>(0x40C.l) uleshort x \b, header len 0x%x
#>>(0x40C.l) uleshort x \b, header len %#x
>>(0x40C.l) uleshort x %u bytes
# sub-file Type[10] like "GARMIN RGN" "GARMIN TRE", "GARMIN TYP", etc.
>>(0x40C.l+2) ubyte >0x1F
>>>(0x40C.l+2) ubyte <0xFF
>>>>(0x40C.l+2) string x "%.10s"
# 0x00 for most maps, 0x80 for locked maps (City Nav, City Select, etc.)
>>>>(0x40C.l+13) ubyte >0 \b, locked 0x%x
>>>>(0x40C.l+13) ubyte >0 \b, locked %#x
# Block sequence numbers like 0000 0100 0200 ... FFFF
# >0x420 ubequad >0 \b, seq. 0x%16.16llx
# >0x420 ubequad >0 \b, seq. %#16.16llx
# >>0x428 ubequad >0 \b%16.16llx
# >>>0x430 ubequad >0 \b%16.16llx
# >>>>0x438 ubequad >0 \b%16.16llx
@ -147,12 +147,12 @@
# ... xth FAT block
#
# 314 zeros but not in vpm and also gmaptz.img
>0x84 uquad !0 \b, at 0x84 0x%llx
>0x84 uquad !0 \b, at 0x84 %#llx
# display FileAllocationTable block entry in garmin map
0 name garmin-fat
>0 ubyte x \b;
# sub file part; 0x0003 seems to be garbage
>0x10 uleshort !0 next 0x%4.4x
>0x10 uleshort !0 next %#4.4x
>0x10 uleshort =0
# fat flag 0~dummy block 1~true sub file
>>0 ubyte !1 flag %u
@ -164,7 +164,7 @@
# size of sub file
>>>0xC ulelong x \b, %u bytes
# 32-bit block sequence numbers
#>>>0x20 ubequad x \b, seq. 0x%16.16llx
#>>>0x20 ubequad x \b, seq. %#16.16llx
# display date stored inside Garmin maps like yyyy-mm-dd h:mm:ss
0 name garmin-date
@ -207,38 +207,38 @@
!:mime application/x-garmin-nod
!:ext nod
>>>0x0E use garmin-date
#>>>0x15 ulelong x \b, at 0x%x
#>>>0x19 ulelong x 0x%x bytes NOD1
#>>>0x25 ulelong x \b, at 0x%x
#>>>0x29 ulelong x 0x%x bytes NOD2
#>>>0x31 ulelong x \b, at 0x%x
#>>>0x35 ulelong x 0x%x bytes NOD3
#>>>0x15 ulelong x \b, at %#x
#>>>0x19 ulelong x %#x bytes NOD1
#>>>0x25 ulelong x \b, at %#x
#>>>0x29 ulelong x %#x bytes NOD2
#>>>0x31 ulelong x \b, at %#x
#>>>0x35 ulelong x %#x bytes NOD3
# URL: http://www.pinns.co.uk/osm/net.html
# routable highways (length, direction, allowed speed,house address information)
>>9 string NET highways
!:mime application/x-garmin-net
!:ext net
#>>>0x15 ulelong x \b, at 0x%x
#>>>0x19 ulelong x 0x%x bytes NET1
#>>>0x15 ulelong x \b, at %#x
#>>>0x19 ulelong x %#x bytes NET1
#>>>0x22 ulelong >0
#>>>>0x1E ulelong x \b, at 0x%x
#>>>>0x22 ulelong x 0x%x bytes NET2
#>>>>0x1E ulelong x \b, at %#x
#>>>>0x22 ulelong x %#x bytes NET2
#>>>0x2B ulelong >0
#>>>>0x27 ulelong x \b, at 0x%x
#>>>>0x2B ulelong x 0x%x bytes NET3
#>>>>0x27 ulelong x \b, at %#x
#>>>>0x2B ulelong x %#x bytes NET3
# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/LBL_Subfile_Format
>>9 string LBL labels
!:mime application/x-garmin-lbl
!:ext lbl
>>>(0.s) string x %s
# Label coding type 6h 9h and ah
>>>0x1E ubyte x \b, coding type 0x%x
#>>>0x15 ulelong x \b, at 0x%x
#>>>0x19 ulelong x 0x%x bytes LBL1
#>>>0x1F ulelong x \b, at 0x%x
#>>>0x23 ulelong x 0x%x bytes LBL2
#>>>0x2D ulelong x \b, at 0x%x
#>>>0x31 ulelong x 0x%x bytes LBL3
>>>0x1E ubyte x \b, coding type %#x
#>>>0x15 ulelong x \b, at %#x
#>>>0x19 ulelong x %#x bytes LBL1
#>>>0x1F ulelong x \b, at %#x
#>>>0x23 ulelong x %#x bytes LBL2
#>>>0x2D ulelong x \b, at %#x
#>>>0x31 ulelong x %#x bytes LBL3
# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/SRT_Subfile_Format
# A lookup table of the chars in the map's codepage, and their collating sequence
>>9 string SRT sort table
@ -256,16 +256,16 @@
# or http://www.openstreetmap.org/
>>>>&1 string x %s
>>>0x0E use garmin-date
#>>>0x21 ulelong x \b, at 0x%x
#>>>0x25 ulelong x 0x%x bytes TRE1
#>>>0x29 ulelong x \b, at 0x%x
#>>>0x2D ulelong x 0x%x bytes TRE2
#>>>0x31 ulelong x \b, at 0x%x
#>>>0x35 ulelong x 0x%x bytes TRE3
#>>>0x21 ulelong x \b, at %#x
#>>>0x25 ulelong x %#x bytes TRE1
#>>>0x29 ulelong x \b, at %#x
#>>>0x2D ulelong x %#x bytes TRE2
#>>>0x31 ulelong x \b, at %#x
#>>>0x35 ulelong x %#x bytes TRE3
# Copyright record size
#>>>0x39 uleshort x \b, copyright record size %u
# Map ID
>>>0x74 ulelong x \b, ID 0x%x
>>>0x74 ulelong x \b, ID %#x
# URL: https://www.gpspower.net/garmin-tutorials/353310-basecamp-installing-free-desktop-map.html
# For road traffic information service (RDS/TMS/TMC). Commonly seen in City Navigator maps
>>9 string TRF traffic,
@ -285,11 +285,11 @@
# character set 1252 65001~UTF8
>>>0x15 uleshort x \b, code page %u
# POIs
#>>>0x17 ulelong x \b, at 0x%x
#>>>0x1B ulelong x 0x%x bytes TYP1
#>>>0x17 ulelong x \b, at %#x
#>>>0x1B ulelong x %#x bytes TYP1
# extra pois
#>>>0x5B ulelong x \b, at 0x%x
#>>>0x5F ulelong x 0x%x bytes TYP8
#>>>0x5B ulelong x \b, at %#x
#>>>0x5F ulelong x %#x bytes TYP8
# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/RGN_Subfile_Format
# http://www.pinns.co.uk/osm/RGN.html
# region data used by the Garmin software
@ -297,24 +297,24 @@
!:mime application/x-garmin-rgn
!:ext rgn
# POIs,Indexed POIs,Polylines or Polygons or first map level
#>>>0x15 ulelong x \b, at 0x%x
#>>>0x19 ulelong x 0x%x bytes RGN1
#>>>0x15 ulelong x \b, at %#x
#>>>0x19 ulelong x %#x bytes RGN1
# polygons with extended types
#>>>0x21 ulelong >0
#>>>>0x1D ulelong x \b, at 0x%x
#>>>>0x21 ulelong x 0x%x bytes RGN2
#>>>>0x1D ulelong x \b, at %#x
#>>>>0x21 ulelong x %#x bytes RGN2
# polylines with extended types
#>>>0x3D ulelong >0
#>>>>0x39 ulelong x \b, at 0x%x
#>>>>0x3D ulelong x 0x%x bytes RGN3
#>>>>0x39 ulelong x \b, at %#x
#>>>>0x3D ulelong x %#x bytes RGN3
# extended POIs
#>>>0x59 ulelong >0
#>>>>0x55 ulelong x \b, at 0x%x
#>>>>0x59 ulelong x 0x%x bytes RGN3
#>>>>0x55 ulelong x \b, at %#x
#>>>>0x59 ulelong x %#x bytes RGN3
#>>9 default x unknown map type
# Header length; GMP:31h 35h 3Dh,MDR:11Eh 238h 2C4h 310h,NOD:3Fh 7Fh,NET:64h,
# LBL:2A9h,SRT:1Dh 25h 27h,TRE:CFh 135h,TRF:5Ah,TYP:5Bh 6Eh 7Ch AEh,RGN:7Dh
>>0 uleshort x \b, header length 0x%x
>>0 uleshort x \b, header length %#x
# URL: https://www.memotech.franken.de/FileFormats/
# Reference: https://www.memotech.franken.de/FileFormats/Garmin_RGN_Format.pdf
@ -357,7 +357,7 @@
# display information of Garmin RGN record
0 name garmin-entry
# record length: 2 for Data, for Application often 1Bh sometimes 1Dh, "big" for Region
#>0 ulelong x \b, length 0x%x
#>0 ulelong x \b, length %#x
# data record (ID='D') with version content like 0064h~1.0
>4 ubyte =0x44
>>5 uleshort !0x0064 \b; Data
@ -382,11 +382,11 @@
# delay in ms: like 0, 500
>>7 ulelong !0 \b, %u ms
# region size (is record length - 10)
#>>11 ulelong x \b, length 0x%x
#>>11 ulelong x \b, length %#x
# region content like:
# "KpGr"~recursiv embedded,"GARMIN BITMAP"~Garmin Bitmap *.srf, "PK"~ZIP archive
#>>15 string x \b, content "%s"
>>15 ubequad x \b, content 0x%llx...
>>15 ubequad x \b, content %#llx...
# This does NOT WORK!
#>>15 indirect x \b; contains
>4 default x \b; other

58
contrib/file/magic/Magdir/maple

@ -1,20 +1,72 @@
#------------------------------------------------------------------------------
# $File: maple,v 1.8 2017/03/17 21:35:28 christos Exp $
# $File: maple,v 1.10 2021/08/30 13:31:25 christos Exp $
# maple: file(1) magic for maple files
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Maple V release 4, a multi-purpose math program
#
# maple library .lib
0 string \000MVR4\nI MapleVr4 library
# URL: https://en.wikipedia.org/wiki/Maple_(software)
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lib-maple-v-r4.trid.xml
# Update: Joerg Jenderek
0 string \000MVR4\nI Maple Vr4 library
#!:mime application/octet-stream
!:mime application/x-maple-lib
!:ext lib
# URL: https://en.wikipedia.org/wiki/Maple_(software)
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lib-maple-v-r5.trid.xml
# From: Joerg Jenderek
0 string \000MVR5\n Maple Vr5 library
#!:mime application/octet-stream
!:mime application/x-maple-lib
!:ext lib
# From: Joerg Jenderek
0x400 string M7R0\nI Maple Vr7 library
#!:mime application/octet-stream
!:mime application/x-maple-lib
!:ext lib
# null terminated library name like: C:\Maple12/Cliffordlib\maple.lib ../Maplets/Tutors.lib
>5 string x %s
# probably library name padding with nil or points (0x2E)
#>0xF8 uquad x \b, PADDING 0x%16.16llx
# null terminated strings like: Exterior Clifford FunctionArithmetics
# like: 1 20 40
>0x115 ulelong x \b, %u string
# plural s
>0x115 ulelong >1 \bs
>0x119 string x 1st '%s'
# probably second name section padding with nil or points (0x2E)
#>0x3F0 uquad x \b, 2nd PADDING 0x%16.16llx
# line feed separated ASCII string with maximal 79 length
#>0x407 string x \b, section "%s"
>0x454 ubyte !0x0a \b, at 0x454 0x%x
# .ind
# no magic for these :-(
# they are compiled indexes for maple files
# .hdb
0 string \000\004\000\000 Maple help database
# Update: Joerg Jenderek
# URL: https://www.maplesoft.com/support/help/maple/view.aspx?path=Formats/HDB
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/h/hdb-maple.trid.xml
# Note: This format was replaced in Maple 18 by the Maple Help format (*.help)
0 string \000\004\000\000
# skip xBASE Compound Index file *.CDX by looking for version
>1028 string version Maple help database
# length of string version
#>>1024 ulelong !7 \b, at 0x400 unexpected %u
#!:mime application/octet-stream
!:mime application/x-maple-hdb
!:ext hdb
>1028 default x
# skip more xBASE Compound Index file *.CDX by looking for keyword Maple
# like hsum.hdb
>>4 search/0xCC41 Maple Maple help database
!:mime application/x-maple-hdb
!:ext hdb
# .mhp
# this has the form <PACKAGE=name>

95
contrib/file/magic/Magdir/mathematica

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: mathematica,v 1.9 2017/03/17 21:35:28 christos Exp $
# $File: mathematica,v 1.13 2021/07/14 09:06:24 christos Exp $
# mathematica: file(1) magic for mathematica files
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Mathematica a multi-purpose math program
@ -13,7 +13,7 @@
!:ext mb
# .ma
# multiple possibilites:
# multiple possibilities:
0 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook
#>41 string >\0 %s
@ -24,7 +24,7 @@
#0 string (*^\n\n::[\011Information Mathematica notebook version 2.x
#>675 string >\0 %s #doesn't work well
# there may be 'cr' instread of 'nl' in some does this matter?
# there may be 'cr' instead of 'nl' in some does this matter?
# generic:
0 string (*^\r\r::[\011 Mathematica notebook version 2.x
@ -73,9 +73,90 @@
#########################
# MatLab v5
0 string MATLAB Matlab v5 mat-file
# URL: http://fileformats.archiveteam.org/wiki/MAT
# Reference: https://www.mathworks.com/help/pdf_doc/matlab/matfile_format.pdf
# first 116 bytes of header contain text in human-readable form
0 string MATLAB Matlab v
#>11 string/T x \b, at 11 "%.105s"
#!:mime application/octet-stream
!:mime application/x-matlab-data
!:ext mat
# https://de.mathworks.com/help/matlab/import_export/mat-file-versions.html
# level of the MAT-file like: 5.0 7.0 or maybe 7.3
#>7 string x LEVEL "%.3s"
>7 ubyte =0x35 \b5 mat-file
>7 ubyte !0x35
>>7 string x \b%.3s mat-file
>126 short 0x494d (big endian)
>>124 beshort x version 0x%04x
>>124 beshort x version %#04x
>126 short 0x4d49 (little endian)
>>124 leshort x version 0x%04x
# 0x0100 for level 5.0 and 0x0200 for level 7.0
>>124 leshort x version %#04x
# test again so that default clause works
>126 short x
# created by MATLAB include Platform sometimes without leading comma (0x2C) or missing
# like: GLNX86 PCWIN PCWIN64 SOL2 Windows\0407 nt posix
>>20 search/2 Platform:\040 \b, platform
>>>&0 string x %-0.2s
>>>&2 ubyte !0x2C \b%c
>>>>&0 ubyte !0x2C \b%c
>>>>>&0 ubyte !0x2C \b%c
>>>>>>&0 ubyte !0x2C \b%c
>>>>>>>&0 ubyte !0x2C \b%c
>>>>>>>>&0 ubyte !0x2C \b%c
>>>>>>>>>&0 ubyte !0x2C \b%c
# examples without Platform tag like one_by_zero_char.mat
>>20 default x
>>>11 string x "%s"
# created by MATLAB include time like: Fri Feb 20 15:26:59 2009
>34 search/9/c created\040on:\040 \b, created
>>&0 string x %-.24s
# MatLab v4
# From: Joerg Jenderek
# check for valid imaginary flag of Matlab matrix version 4
13 ushort 0
# check for valid ASCII matrix name
>20 ubyte >0x1F
# skip some CD-ROM filesystem like test-hfs.iso by looking for valid big endian type flag
>>0 ubelong&0xFFffFF00 0x00000300
>>>0 use matlab4
# no example for 8-bit and 16-bit integers matrix
>>0 ubelong&0xFFffFF00 0x00000400
>>>0 use matlab4
>>0 ulelong x
# skip big endian variant by looking for valid low lttle endian type flag
>>0 ulelong <53
>>>0 use \^matlab4
# display information of Matlab v4 mat-file
0 name matlab4 Matlab v4 mat-file
#!:mime application/octet-stream
!:mime application/x-matlab-data
!:ext mat
# 20-byte header with 5 long integers that contains information describing certain attributes of the Matrix
# type flag decimal MOPT; maximal 4052=FD4h; maximal 52=34h for little endian
#>0 ubelong x \b, type flag %u
#>0 ubelong x (%#x)
# M: 0~little endian 1~Big Endian 2~VAX D-float 3~VAX G-float 4~Cray
#>0 ubelong/1000 x \b, M=%u
>0 ubelong/1000 0 (little endian)
>0 ubelong/1000 1 (big endian)
>0 ubelong/1000 2 (VAX D-float)
>0 ubelong/1000 3 (VAX G-float)
>0 ubelong/1000 4 (Cray)
# namlen; the length of the matrix name
#>16 ubelong x \b, name length %u
# nul terminated matrix name like: fit_params testmatrix testsparsecomplex teststringarray
#>20 string x \b, MATRIX NAME="%s"
>16 pstring/L x %s
# T indicates the matrix type: 0~numeric 1~text 2~sparse
#>0 ubelong%10 x \b, T=%u
>0 ubelong%10 0 \b, numeric
>0 ubelong%10 1 \b, text
>0 ubelong%10 2 \b, sparse
# mrows; number of rows in the matrix like: 1 3 8
>4 ubelong x \b, rows %u
# ncols; number of columns in the matrix like: 1 3 4 5 9 43
>8 ubelong x \b, columns %u
# imagf; imaginary flag; 1~matrix has an imaginary part 0~only real data
>12 ubelong !0 \b, imaginary
# real; Real part of the matrix consists of mrows * ncols numbers

7
contrib/file/magic/Magdir/measure

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: measure,v 1.2 2018/06/23 16:13:15 christos Exp $
# $File: measure,v 1.3 2021/03/25 17:30:10 christos Exp $
# measure: file(1) magic for measurement data
# DIY-Thermocam raw data
@ -37,3 +37,8 @@
>>9600 default x (Lepton 2.x),
>>>9600 use diy-thermocam-parser
# Becker & Hickl Photon Counting (PMS) data file
# format documentation: https://www.becker-hickl.com/wp-content/uploads/2018/11/opm-pms400-v01.pdf (page 57)
(0x02.l) string *IDENTIFICATION Becker & Hickl PMS Data File
>0x12 short x (%d data blocks)
!:ext sdt

35
contrib/file/magic/Magdir/misctools

@ -1,22 +1,37 @@
#-----------------------------------------------------------------------------
# $File: misctools,v 1.18 2019/04/19 00:42:27 christos Exp $
# $File: misctools,v 1.20 2021/05/25 15:13:55 christos Exp $
# misctools: file(1) magic for miscellaneous UNIX tools.
#
0 search/1 %%!! X-Post-It-Note text
0 string/c BEGIN:VCALENDAR vCalendar calendar file
!:mime text/calendar
# updated by Joerg Jenderek at Apr 2015
# Extension: .vcf
# updated by Joerg Jenderek at Apr 2015, May 2021
# https://en.wikipedia.org/wiki/VCard
0 string/c BEGIN:VCARD vCard visiting card
# URL: http://fileformats.archiveteam.org/wiki/VCard
# https://datatracker.ietf.org/doc/html/rfc6350
# the value is case-insensitive
0 string/c begin:vcard
# skip DROID fmt-395-signature-id-634.vcf
>13 string !VERSION:END vCard visiting card
# deprecated
#!:mime text/x-vcard
!:mime text/vcard
!:apple ????vCrd
!:ext vcf/vcard
# VERSION must come right after BEGIN for 3.0 or 4.0 except in 2.1 , where it can be anywhere
>12 search/14000/c VERSION:
# Joerg_Jenderek_67.vcf
>>12 search/0x113b4/c version:
# VERSION 2.1 , 3.0 or 4.0
>>&0 string x \b, version %-.3s
>>>&0 string x \b, version %-.3s
>>>&0 string !2.1
>>>>13 string !VERSION: \b, 2nd line does not start with VERSION:
# downcase violates RFC 6350, but some "bad" software produce such vcards
>>0 string !BEGIN \b, not up case
# http://ftp.mozilla.org/pub/thunderbird/candidates/
# 78.10.1-candidates/build1/source/thunderbird-78.10.1.source.tar.xz
# thunderbird-78.10.1/comm/mailnews/import/test/unit/resources/basic_vcard_addressbook.vcf
>>11 beshort !0x0D0A \b, lines not separated by CRLF
# Summary: Libtool library file
# Extension: .la
@ -41,18 +56,18 @@
!:ext dmp/mdmp
# The high-order word is an internal value that is implementation specific.
# The low-order word is MINIDUMP_VERSION 0xA793
>4 ulelong&0x0000FFFF !0xA793 \b, version 0x%4.4x
>4 ulelong&0x0000FFFF !0xA793 \b, version %#4.4x
# NumberOfStreams 8,9,10,13
>8 ulelong x \b, %d streams
# StreamDirectoryRva 0x20
>12 ulelong !0x20 \b, 0x%8.8x RVA
>12 ulelong !0x20 \b, %#8.8x RVA
# CheckSum 0
>16 ulelong !0 \b, CheckSum 0x%8.8x
>16 ulelong !0 \b, CheckSum %#8.8x
# Reserved or TimeDateStamp
>20 ledate x \b, %s
# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519%28v=vs.85%29.aspx
# Flags MINIDUMP_TYPE enumeration type 0 0x121 0x800
>24 ulelong x \b, 0x%x type
>24 ulelong x \b, %#x type
# >24 ulelong >0 \b; include
# >>24 ulelong &0x00000001 \b data sections,
# >>24 ulelong &0x00000020 \b list of unloaded modules,

4
contrib/file/magic/Magdir/modem

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: modem,v 1.9 2019/04/19 00:42:27 christos Exp $
# $File: modem,v 1.10 2021/04/26 15:56:00 christos Exp $
# modem: file(1) magic for modem programs
#
# From: Florian La Roche <florian@knorke.saar.de>
@ -59,7 +59,7 @@
#
0 string RMD1 raw modem data
>4 string >\0 (%s /
>20 short >0 compression type 0x%04x)
>20 short >0 compression type %#04x)
#
# portable voice format 1

4
contrib/file/magic/Magdir/motorola

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: motorola,v 1.11 2014/04/30 21:41:02 christos Exp $
# $File: motorola,v 1.12 2021/04/26 15:56:00 christos Exp $
# motorola: file(1) magic for Motorola 68K and 88K binaries
#
# 68K
@ -60,7 +60,7 @@
>22 belong &0x01 fastload flag,
>22 belong &0x02 may be loaded to alternate RAM,
>22 belong &0x04 malloc may be from alternate RAM,
>22 belong x flags: 0x%X,
>22 belong x flags: %#X,
>26 beshort 0 no relocation tab
>26 beshort !0 + relocation tab
>30 string SFX [Self-Extracting LZH SFX archive]

6
contrib/file/magic/Magdir/mozilla

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: mozilla,v 1.10 2019/04/19 00:42:27 christos Exp $
# $File: mozilla,v 1.12 2021/04/26 15:56:00 christos Exp $
# mozilla: file(1) magic for Mozilla XUL fastload files
# (XUL.mfasl and XPC.mfasl)
# URL: https://www.mozilla.org/
@ -14,7 +14,7 @@
# Reference: https://github.com/avih/dejsonlz4/archive/master.zip/
# dejsonlz4-master\src\dejsonlz4.c
# Note: mostly JSON compressed with a non-standard LZ4 header
# can be unpacked by dejsonlz4 but not lz4 programm.
# can be unpacked by dejsonlz4 but not lz4 program.
0 string mozLz40\0 Mozilla lz4 compressed data
!:mime application/x-lz4+json
# mozlz4 extension seems to be used for search/store, while jsonlz4 for bookmarks
@ -22,7 +22,7 @@
# decomp_size
>8 ulelong x \b, originally %u bytes
# lz4 data
#>12 ubequad x \b, lz4 data 0x%16.16llx
#>12 ubequad x \b, lz4 data %#16.16llx
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Firefox_4

313
contrib/file/magic/Magdir/msdos

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: msdos,v 1.137 2020/03/20 17:20:19 christos Exp $
# $File: msdos,v 1.152 2021/10/12 18:26:10 christos Exp $
# msdos: file(1) magic for MS-DOS files
#
@ -47,7 +47,7 @@
# Tests for various EXE types.
#
# Many of the compressed formats were extraced from IDARC 1.23 source code.
# Many of the compressed formats were extracted from IDARC 1.23 source code.
#
0 string/b MZ
# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file.
@ -55,7 +55,9 @@
!:mime application/x-dosexec
# Windows and later versions of DOS will allow .EXEs to be named with a .COM
# extension, mostly for compatibility's sake.
!:ext exe/com
# URL: https://en.wikipedia.org/wiki/Personal_NetWare#VLM
# Reference: https://mark0.net/download/triddefs_xml.7z/defs/e/exe-vlm-msg.trid.xml
!:ext exe/com/vlm
# These traditional tests usually work but not always. When test quality support is
# implemented these can be turned on.
#>>0x18 leshort 0x1c (Borland compiler)
@ -68,7 +70,7 @@
>>(0x3c.l+24) leshort 0x020b \b32+ executable
>>(0x3c.l+24) leshort 0x0107 ROM image
>>(0x3c.l+24) default x Unknown PE signature
>>>&0 leshort x 0x%x
>>>&0 leshort x %#x
>>(0x3c.l+22) leshort&0x2000 >0 (DLL)
>>(0x3c.l+92) leshort 1
# Native PEs include ntoskrnl.exe, hal.dll, smss.exe, autochk.exe, and all the
@ -107,7 +109,7 @@
>>(0x3c.l+92) leshort 14 (XBOX)
>>(0x3c.l+92) leshort 15 (Windows boot application)
>>(0x3c.l+92) default x (Unknown subsystem
>>>&0 leshort x 0x%x)
>>>&0 leshort x %#x)
>>(0x3c.l+4) leshort 0x14c Intel 80386
>>(0x3c.l+4) leshort 0x166 MIPS R4000
>>(0x3c.l+4) leshort 0x168 MIPS R10000
@ -139,7 +141,7 @@
>>(0x3c.l+4) leshort 0xaa64 Aarch64
>>(0x3c.l+4) leshort 0xc0ee MSIL
>>(0x3c.l+4) default x Unknown processor type
>>>&0 leshort x 0x%x
>>>&0 leshort x %#x
>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB)
>>(0x3c.l+22) leshort&0x1000 >0 system file
>>(0x3c.l+24) leshort 0x010b
@ -289,7 +291,7 @@
>>>&1 string x for DOS, Win or OS/2, emx %s
>>&(&0x42.l-3) byte x
>>>&0x26 string UPX \b, UPX compressed
# and yet another guess: small .text, and after large .data is unusal, could be 32lite
# and yet another guess: small .text, and after large .data is unusual, could be 32lite
>>&0x2c search/0xa0 .text
>>>&0x0b lelong <0x2000
>>>>&0 lelong >0x6000 \b, 32lite compressed
@ -362,12 +364,93 @@
>>49824 leshort =1 \b, 1 file
>>49824 leshort >1 \b, %u files
# Summary: OS/2 LX Library and device driver (no DOS stub)
# From: Joerg Jenderek
# URL: http://en.wikipedia.org/wiki/EXE
# Reference: http://www.textfiles.com/programming/FORMATS/lxexe.txt
# https://github.com/open-watcom/open-watcom-v2/blob/master/bld/watcom/h/exeflat.h
# Note: by dll-os2-no-dos-stub.trid.xml called "OS/2 Dynamic Link Library (no DOS stub)"
# TODO: unify with DOS stub variant (MZ magic)
0 string/b LX
>2 ushort =0
>>0 use lx-executable
# no examples found for big endian variant
>2 ushort =0x0101
>>0 use \^lx-executable
0 name lx-executable
# similar looking like variant with MS-DOS stub (MZ magic): "MS-DOS executable, LX"
#>0x00 uleshort x executable,
# signature OSF_FLAT_LX_SIGNATURE~0x584C~LX OSF_FLAT_SIGNATURE~0x454C~LE
>0x00 uleshort =0x584c LX
>0x00 uleshort =0x454C LE
>0x00 uleshort x executable
#!:mime application/x-msdownload
!:mime application/x-lx-executable
# byte order: 00h~little-endian non-zero=1~big-endian
#>0x02 ubyte =0 (little-endian)
>0x02 ubyte !0 (big-endian)
# FOR DEBUGGING!
# word order: 00h~little-endian non-zero=1~big-endian
#>0x03 ubyte =0 \b, little-endian word order
#>0x03 ubyte !0 \b, big-endian word order
# cpu_type; CPU type like: 1~286 2~386 3~486 4 20h~i860 21h~Intel N11 40h~MIPS R2000,R3000 41h~MIPS R6000 42h~MIPS R4000
#>0x08 uleshort x \b, CPU %u
# os_type; target operating system like: 0~unknown 1~OS/2 2~Windows 3~DOS 4.x 4~Windows 386
#>0x0A leshort x \b, OS %u
# flags; module type flags
#>0x10 ulelong x \b, FLAGS %#8.8x
# 00000002h ~Reserved for system use
#>0x10 ulelong &0x00000002 \b, 2h reserved
# OSF_INIT_INSTANCE=00000004h ~Per-Process Library Initialization; setting this bit for EXE file is invalid
#>0x10 ulelong &0x00000004 \b, per-process library Initialization
# OSF_INTERNAL_FIXUPS_DONE=00000010h ~Internal fixups for the module have been applied
#>0x10 ulelong &0x00000010 \b, int. fixup
# OSF_EXTERNAL_FIXUPS_DONE=00000020h ~External fixups for the module have been applied
#>0x10 ulelong &0x00000020 \b, ext. fixup
# OSF_NOT_PM_COMPATIBLE=00000100h ~Incompatible with PM windowing
#>0x10 ulelong&0x00000100 =0x00000100 \b, incompatible with PM windowing
# OSF_PM_COMPATIBLE=00000200h ~Compatible with PM windowing
#>0x10 ulelong&0x00000200 =0x00000200 \b, compatible with PM windowing
# bit 17; device driver
#>0x10 ulelong&0x00020000 >0 \b, device driver
# Per-process Library Termination; setting this bit for EXE file is invalid
#>0x10 ulelong&0x40000000 =0x40000000 \b, per-process library termination
>0x0a leshort 1 for OS/2
# no example found
>0x0a leshort 3 for DOS
# http://www.ctyme.com/intr/rb-2939.htm#Table1610
# library by module type mask 00038000h (bits 15-17);
# 0h ~exectable Program module
>0x10 ulelong&0x00038000 =0x00000000 (program)
#!:ext exe
# OSF_IS_DLL=8000h ~Library module (DLL)
>0x10 ulelong&0x00038000 >0x00000000
# OSF_PHYS_DEVICE=00020000h ~device driver
>>0x10 ulelong&0x00020000 >0 (device driver)
!:ext sys
# if not device driver it is library (DLL)
>>0x10 ulelong&0x00020000 =0 (library)
!:ext dll
# bits 8-10; OSF_PM_APP=300h in flags ~Uses PM windowing API; either it is GUI or console
>0x10 ulelong&0x00000300 =0x00000300 (GUI)
>0x10 ulelong&0x00000300 !0x00000300 (console)
# CPU type
>0x08 uleshort 1 i80286
# all inspected examples
>0x08 uleshort 2 i80386
>0x08 uleshort 3 i80486
>0x08 uleshort 4 i80586
# 21h Intel "N11" or compatible
# 40h MIPS Mark I ( R2000, R3000) or compatible
# 41h MIPS Mark II ( R6000 ) or compatible
# 42h MIPS Mark III ( R4000 ) or compatible
# added by Joerg Jenderek of https://www.freedos.org/software/?prog=kc
# and https://www.freedos.org/software/?prog=kpdos
# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD
0 string/b KCF FreeDOS KEYBoard Layout collection
# only version=0x100 found
>3 uleshort x \b, version 0x%x
>3 uleshort x \b, version %#x
# length of string containing author,info and special characters
>6 ubyte >0
#>>6 pstring x \b, name=%s
@ -378,42 +461,54 @@
# for FreeDOS *.KL files
0 string/b KLF FreeDOS KEYBoard Layout file
# only version=0x100 or 0x101 found
>3 uleshort x \b, version 0x%x
>3 uleshort x \b, version %#x
# stringlength
>5 ubyte >0
>>8 string x \b, name=%-.2s
0 string \xffKEYB\ \ \ \0\0\0\0
>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file
# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017
# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017,Aug 2020
# URL: http://fileformats.archiveteam.org/wiki/DOS_device_driver
# Reference: http://www.delorie.com/djgpp/doc/rbinter/it/46/16.html
# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
0 ulequad&0x07a0ffffffff 0xffffffff
>0 use msdos-driver
# skip OS/2 INI ./os2
>4 ubelong !0x14000000
>>0 use msdos-driver
0 name msdos-driver DOS executable (
#!:mime application/octet-stream
!:mime application/x-dosdriver
# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN
!:ext sys/dev/bin
>40 search/7 UPX! \bUPX compressed
# and IBM Token-Ring adapter IBMTOK.DOS. Why and when DOS instead SYS is used?
# PROTMAN.DOS ELNKPL.DOS
!:ext sys/dev/bin/dos
# 1 space char after "UPX compressed" to get phrase like "UPX compressed character device"
>40 search/7 UPX! \bUPX compressed
# DOS device driver attributes
>4 uleshort&0x8000 0x0000 \bblock device driver
# character device
>4 uleshort&0x8000 0x8000 \b
>>4 uleshort&0x0008 0x0008 \bclock
# 1 space char after "clock" to get phrase like "clock character device driver CLOCK$"
>>4 uleshort&0x0008 0x0008 \bclock
# fast video output by int 29h
>>4 uleshort&0x0010 0x0010 \bfast
# 1 space char after "fast" to get phrase like "fast standard input/output character device driver"
>>4 uleshort&0x0010 0x0010 \bfast
# standard input/output device
>>4 uleshort&0x0003 >0 \bstandard
# 1 space char after "standard" to get phrase like "standard input/output character device driver"
>>4 uleshort&0x0003 >0 \bstandard
>>>4 uleshort&0x0001 0x0001 \binput
>>>4 uleshort&0x0003 0x0003 \b/
>>>4 uleshort&0x0002 0x0002 \boutput
# 1 space char after "output" to get phrase like "input/output character device driver"
>>>4 uleshort&0x0002 0x0002 \boutput
>>4 uleshort&0x8000 0x8000 \bcharacter device driver
>0 ubyte x
# upx compressed device driver has garbage instead of real in name field of header
>>40 search/7 UPX!
>>40 default x
# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped
>>>12 ubyte >0x2E \b
# 1 space char before device driver name to get phrase like "device driver PROTMAN$"
>>>12 ubyte >0x2E \b
>>>>10 ubyte >0x20
>>>>>10 ubyte !0x2E
>>>>>>10 ubyte !0x2A \b%c
@ -456,6 +551,7 @@
>4 uleshort&0x8000 0x0000
>>4 uleshort&0x4842 >0 \bsupport
>0 ubyte x \b)
>0 ulelong !0xffffffff with pointer %#x
# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
0 ulequad 0x0513c00000000012
>0 use msdos-driver
@ -464,6 +560,7 @@
>0 use msdos-driver
0 ulequad 0x007f00000000ffff
>0 use msdos-driver
# https://www.uwe-sieber.de/files/cfg_echo.zip
0 ulequad 0x001600000000ffff
>0 use msdos-driver
# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field
@ -471,6 +568,12 @@
>0 use msdos-driver
0 ulequad 0x07bd08c2ffffffff
>0 use msdos-driver
# 3Com EtherLink 3C501 CID\SERVER\IBMLS\IBM500D1\DLSNETDR.ZIP\ELNK.DOS
0 ulequad 0x027ac0c0ffffffff
>0 use msdos-driver
# IBM Streamer CID\SERVER\IBMLS\IBM500D1\DLSNETDR.ZIP\IBMMPC.DOS
0 ulequad 0x00228880ffffffff
>0 use msdos-driver
# updated by Joerg Jenderek
# GRR: line below too general as it catches also
@ -558,35 +661,48 @@
# syslinux version (4.x)
# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID
>>>1 lelong 0x21CD4CFe \b, relocatable)
# remaining are DOS COM executables starting with assembler instruction MOV
# like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM
# MS-DOS SYS.COM RESTART.COM
# SYSLINUX.COM (version 1.40 - 2.13)
# GFXBOOT.COM (version 3.75)
# COPYBS.COM POWEROFF.COM INT18.COM
# Hajin Jang <hajin_jang@worksmobile.com>:
# Disable simplest COM signature to prevent false positive on some EUC-KR text files.
## remaining are DOS COM executables starting with assembler instruction MOV
## like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM
## MS-DOS SYS.COM RESTART.COM
## SYSLINUX.COM (version 1.40 - 2.13)
## GFXBOOT.COM (version 3.75)
## COPYBS.COM POWEROFF.COM INT18.COM
>>1 default x COM executable for DOS
!:mime application/x-dosexec
#!:mime application/x-ms-dos-executable
#!:mime application/x-msdos-program
##!:mime application/x-ms-dos-executable
##!:mime application/x-msdos-program
!:ext com
# URL: https://en.wikipedia.org/wiki/UPX
# Reference: https://github.com/upx/upx/archive/v3.96.zip/upx-3.96/
# src/stub/src/i086-dos16.com.S
# Update: Joerg Jenderek
# assembler instructions: cmp sp, offset sp_limit
0 string/b \x81\xfc
#>2 uleshort x \b, sp_limit=%#x
# assembler instructions: jump above +2; int 0x20; mov cx, offset bytes_to_copy
>4 string \x77\x02\xcd\x20\xb9
>>36 string UPX! FREE-DOS executable (COM), UPX compressed
#>9 uleshort x \b, [bytes_to_copy]=%#x
# at different offsets assembler instructions: push di; jump decomp_start_n2b
>0x1e search/3 \x57\xe9
#>>&0 uleshort x \b, decomp_start_n2b=%#x
# src/stub/src/include/header.S; UPX_MAGIC_LE32
>>&2 string UPX! FREE-DOS executable (COM), UPX
!:mime application/x-dosexec
# UPX compressed *.CPI; See ./fonts
>>>&21 string =FONT compressed DOS code page font
!:ext cpx
>>>&21 string !FONT compressed
!:ext com
# compressed size?
#>>>&14 uleshort+152 x \b, %u bytes
# uncompressed len
>>>&12 uleshort x \b, uncompressed %u bytes
252 string Must\ have\ DOS\ version DR-DOS executable (COM)
!:mime application/x-dosexec
!:ext com
# added by Joerg Jenderek at Oct 2008
# GRR search is not working
#34 search/2 UPX! FREE-DOS executable (COM), UPX compressed
34 string UPX! FREE-DOS executable (COM), UPX compressed
!:mime application/x-dosexec
!:ext com
35 string UPX! FREE-DOS executable (COM), UPX compressed
!:mime application/x-dosexec
!:ext com
# GRR search is not working
#2 search/28 \xcd\x21 COM executable for MS-DOS
#WHICHFAT.cOM
@ -616,7 +732,11 @@
!:mime application/x-dosexec
!:ext com
#HELP.COm EDIT.coM
18 string \xcd\x21 COM executable for MS-DOS
18 string \xcd\x21
# not printable before it?
>17 byte >32
>>17 byte <126
>>17 default x COM executable for MS-DOS
!:mime application/x-dosexec
!:ext com
#NWRPLTRM.COm
@ -687,7 +807,7 @@
# reserved; must be zero
#>>6 ulelong !0 \b, reserved %u
# block pointer to the block containing optional file manager information
#>>0x1C uleshort x \b, at 0x%x info block
#>>0x1C uleshort x \b, at %#x info block
# jump to File manager information block
>>(0x1C.s*128) uleshort x
# test for valid information start; maybe also 0012h
@ -717,7 +837,7 @@
# number of blocks used in the file; seems to be 0 for Word 4.0 and Write 3.0
>>0x6A uleshort >0 \b, %u blocks
# bit field for corrected text areas
#>>0x6C uleshort x \b, 0x%x bit field
#>>0x6C uleshort x \b, %#x bit field
# text of document; some times start with 4 non printable characters like CR LF
>>128 ubyte x \b,
>>>128 ubyte >0x1F
@ -821,7 +941,7 @@
>>>>6 uleshort !0x0004 formatting data
!:ext fXX
# main revision number
>>>>4 uleshort x \b, revision 0x%x
>>>>4 uleshort x \b, revision %#x
>>>6 uleshort =0x0004 \b, cell range
# active cellcoord range (start row, page,column ; end row, page, column)
# start values normally 0~1st sheet A1
@ -835,9 +955,9 @@
>>>>12 uleshort x \b%d,
>>>>15 ubyte x \b%d
# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??)
>>>>20 ubyte >1 \b, character set 0x%x
>>>>20 ubyte >1 \b, character set %#x
# flags
>>>>21 ubyte x \b, flags 0x%x
>>>>21 ubyte x \b, flags %#x
>>>6 uleshort !0x0004
# record type (FONTNAME=00AEh)
>>>>30 search/29 \0\xAE
@ -855,7 +975,7 @@
!:strength -1
# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h
>7 ubyte 0
# skip Windows cursors with image width 256 and keep Lotus with positiv opcode
# skip Windows cursors with image width 256 and keep Lotus with positive opcode
>>6 ubyte >0 Lotus
# !:mime application/x-123
!:mime application/vnd.lotus-1-2-3
@ -911,10 +1031,10 @@
# (version 5.26) labeled the entry as "Lotus 1-2-3"
>>>4 default x unknown worksheet or configuration
!:ext cnf
>>>>4 uleshort x \b, revision 0x%x
>>>>4 uleshort x \b, revision %#x
# 2nd record for most worksheets describes cells range
>>>6 use lotus-cells
# 3nd record for most japan worksheets describes cells range
# 3rd record for most japan worksheets describes cells range
>>>(8.s+10) use lotus-cells
# check and then display Lotus worksheet cells range
0 name lotus-cells
@ -1037,7 +1157,7 @@
#>3 ubyte x \b, reserved %x
#>8 ulelong x \b, image size %d
# offset of PNG or DIB image
#>12 ulelong x \b, offset 0x%x
#>12 ulelong x \b, offset %#x
# PNG header (\x89PNG)
>(12.l) ubelong =0x89504e47
# 1 space char after "with" to get phrase "with PNG image" by magic in ./images
@ -1166,6 +1286,9 @@
0 string NG\0\001
# only value 0x100 found at offset 2
>2 ulelong 0x00000100 Norton Guide
!:mime application/x-norton-guide
# often like NORTON.NG but some times like NC.HLP
!:ext ng/hlp
# Title[40]
>>8 string >\0 "%-.40s"
#>>6 uleshort x \b, MenuCount=%u
@ -1173,6 +1296,66 @@
>>48 string >\0 \b, %-.66s
>>114 string >\0 %-.66s
# URL: https://en.wikipedia.org/wiki/Norton_Commander
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/msg-nc-eng.trid.xml
# From: Joerg Jenderek
# Note: Message file is used by executable with same main name.
# Only tested with version 5.50 (english) and 2.01 (Windows)
0 string Abort
# \0 or i
#>5 ubyte x %x
# skip ASCII Abort text by looking for error message like in NCVIEW.MSG
>6 search/7089 Non-DOS\ disk Norton Commander module message
!:mime application/x-norton-msg
!:ext msg
# URL: http://www.antonis.de/dos/dos-tuts/mpdostip/html/nwdostip.htm
# Reference: https://mark0.net/download/triddefs_xml.7z/defs/m/msg-netware-dos.trid.xml
# From: Joerg Jenderek
0 string DOS\ Client\ Message\ File: Novell DOS client message
#!:mime application/octet-stream
#!:mime application/x-novell-msg
!:ext msg
# look for second letter instead space character
>26 ubyte >0x20
# digit 1 or often main or program name like: IPXODI.COM TASKID pnwtrap DOSRqstr
>>25 ubyte !0x20 %c
>>>26 ubyte !0x20 \b%c
>>>>27 ubyte !0x20 \b%c
>>>>>28 ubyte !0x20 \b%c
>>>>>>29 ubyte !0x20 \b%c
>>>>>>>30 ubyte !0x20 \b%c
>>>>>>>>31 ubyte !0x20 \b%c
>>>>>>>>>32 ubyte !0x20 \b%c
>>>>>>>>>>33 ubyte !0x20 \b%c
>>>>>>>>>>>34 ubyte !0x20 \b%c
>>>>>>>>>>>>35 ubyte !0x20 \b%c
>>>>>>>>>>>>>36 ubyte !0x20 \b%c
# followed by string like: 0 v.10 V1.20
#
# followed by ,\040Tran
>28 search/14 ,\040Tran
# probably translated version string like: 0 v1.00
>>&0 string x \b, tran version %s
# followed by Ctrl-J Ctrl-Z
>>>&0 ubyte !0xa \b, terminated by %#2.2x
>>>>&0 ubyte x \b%2.2x
# Ctrl-Z
>0x65 ubyte !0x1A \b, at 0x65 %#x
# one
>0x66 ubyte !0x01 \b, at 0x66 %#x
# URL: https://en.wikipedia.org/wiki/NetWare
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dat-novell-msg.trid.xml
# ftp://ftp.iitb.ac.in/LDP/en/NLM-HOWTO/NLM-HOWTO-single.html
# From: Joerg Jenderek
0 string Novell\ Message\ Librarian\ Data\ File Novell message librarian data
#>35 string Version\ 1.00
#>49 string COPYRIGHT\ (c)\ 1985\ by\ Novell,\ Inc.
#>83 string \ \ All\ Rights\ Reserved
#!:mime application/octet-stream
#!:mime application/x-novell-msg
!:ext msg
#!:ext msg/dat
# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
# of https://www.4dos.info/
# pointer,HelpID[8]=4DHnnnmm
@ -1234,7 +1417,7 @@
# member Macromedia Flash data *.swf implies IncrediMail skin like in im2.ims
>>0x2c search/211/c .swf\0 skin
!:ext ims
# member anim.im3 implies IncrediMail animation like in letter_fold.ima
# member anim.im3 implies IncrediMail animation like in letter_fold.ima
>>0x2c search/92/c anim.im3\0 animation
!:ext ima
# other IncrediMail cab archive
@ -1270,7 +1453,7 @@
!:mime application/vnd.ms-cab-compressed
!:ext msu
>>>&-1 default x
# look at point charcter of 1st archive member name for file name extension
# look at point character of 1st archive member name for file name extension
>>>>&-1 search/255 .
# http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm
# PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002
@ -1329,7 +1512,7 @@
#>4 belong !0 \b, reserved1 %x
#>12 belong !0 \b, reserved2 %x
# offset of the first CFFILE entry coffFiles: minimal 2Ch
>16 ulelong x \b, at 0x%x
>16 ulelong x \b, at %#x
>(16.l) use cab-file
# at least also 2nd member
>28 uleshort >1
@ -1339,12 +1522,12 @@
>>>>&0 use cab-file
#>20 belong !0 \b, reserved %x
# Cabinet file format version. Currently, versionMajor = 1 and versionMinor = 3
>24 ubeshort !0x0301 \b version 0x%x
>24 ubeshort !0x0301 \b version %#x
# number of CFFOLDER entries
>26 uleshort >1 \b, %u cffolders
# cabinet file option indicators 1~PREVIOUS, 2~NEXT, 4~reserved fields
# only found for flags 0 1 2 3 4 not 7
>30 uleshort >0 \b, flags 0x%x
>30 uleshort >0 \b, flags %#x
# Cabinet files have a 16-bit cabinet setID field that is designed for application use.
# default is zero, however, the -i option of cabarc can be used to set this field
>32 uleshort >0 \b, ID %u
@ -1395,30 +1578,30 @@
# display folder structure CFFOLDER information like compression of cabinet
0 name cab-folder
# offset of the CFDATA block in this folder
#>0 ulelong x \b, coffCabStart 0x%x
#>0 ulelong x \b, coffCabStart %#x
# number of CFDATA blocks in folder
>4 uleshort x \b, %u datablock
# plural s
>4 uleshort >1 \bs
# compression typeCompress: 0~None 1~MSZIP 0x1503~LZX:21 0x1003~LZX:16 0x0f03~LZX:15
>6 uleshort x \b, 0x%x compression
>6 uleshort x \b, %#x compression
# optional per-folder reserved area
#>8 ubequad x \b, abReserve 0x%llx
#>8 ubequad x \b, abReserve %#llx
# display member structure CFFILE information like member name of cabinet
0 name cab-file
# cbFile is uncompressed size of file in bytes
# cbFile is uncompressed size of file in bytes
#>0 ulelong x \b, cbFile %u
# uoffFolderStart is uncompressed offset of file in folder
#>4 ulelong >0 \b, uoffFolderStart 0x%x
#>4 ulelong >0 \b, uoffFolderStart %#x
# iFolder is index into the CFFOLDER area. 0 indicates first folder in cabinet
# define ifoldCONTINUED_FROM_PREV (0xFFFD)
# define ifoldCONTINUED_TO_NEXT (0xFFFE)
# define ifoldCONTINUED_PREV_AND_NEXT (0xFFFF)
>8 uleshort >0 \b, iFolder 0x%x
>8 uleshort >0 \b, iFolder %#x
# date stamp for file
#>10 uleshort x \b, date 0x%x
#>10 uleshort x \b, date %#x
# time stamp for file
#>12 uleshort x \b, time 0x%x
#>12 uleshort x \b, time %#x
# attribs is attribute flags for file
# define _A_RDONLY (0x01) file is read-only
# define _A_HIDDEN (0x02) file is hidden
@ -1428,7 +1611,7 @@
# define _A_EXEC (0x40) run after extraction
# define _A_NAME_IS_UTF (0x80) szName[] contains UTF
# define UNKNOWN (0x0100) undocumented or accident
#>14 uleshort x \b, attribs 0x%x
#>14 uleshort x \b, attribs %#x
>14 uleshort >0 +
>>14 uleshort &0x0001 \bR
>>14 uleshort &0x0002 \bH
@ -1471,7 +1654,7 @@
# for further information.
0 ulelong 1
>40 string \ EMF Windows Enhanced Metafile (EMF) image data
>>44 ulelong x version 0x%x
>>44 ulelong x version %#x
0 string/b \224\246\056 Microsoft Word Document
@ -1516,7 +1699,8 @@
0 string Jetsam0 Mallard BASIC Jetsam index data
# DOS backup 2.0 to 3.2
# URL: http://fileformats.archiveteam.org/wiki/BACKUP_(MS-DOS)
# Reference: http://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/dos/restore/brtecdoc.htm
# backupid.@@@
# plausibility check for date
@ -1526,6 +1710,7 @@
# actually 121 nul bytes
>>>0x7 string \0\0\0\0\0\0\0\0
>>>>0x1 ubyte x DOS 2.0 backup id file, sequence %d
#!:mime application/octet-stream
!:ext @@@
>>>>0x0 ubyte 0xff \b, last disk
@ -1548,7 +1733,7 @@
# but sometimes garbage according to Ralf Quint. So can not be used as test
#>0x54 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator
# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE
# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE
>>>>>5 ubyte&0x8C 0x0C
# ./msdos (version 5.30) labeled the entry as
# "DOS 2.0 backed up file %s, split file, sequence %d" or
@ -1559,7 +1744,9 @@
>>>>>>>1 uleshort x sequence %d of
# full file name with path but without drive letter and colon stored from 0x05 til 0x52
>>>>>>0x5 string x file %s
#!:mime application/octet-stream
# backup name is original filename
#!:ext doc/exe/rar/zip
#!:ext *
# magic/Magdir/msdos, 1169: Warning: EXTENSION type ` *' has bad char '*'
# file: line 1169: Bad magic entry ' *'

23
contrib/file/magic/Magdir/msooxml

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: msooxml,v 1.13 2019/11/27 13:12:55 christos Exp $
# $File: msooxml,v 1.16 2021/08/16 10:06:55 christos Exp $
# msooxml: file(1) magic for Microsoft Office XML
# From: Ralf Brown <ralf.brown@gmail.com>
@ -19,29 +19,32 @@
!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation
>0 string xl/ Microsoft Excel 2007+
!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
0 string visio/ Microsoft Visio 2013+
>0 string visio/ Microsoft Visio 2013+
!:mime application/vnd.ms-visio.drawing.main+xml
>0 string AppManifest.xaml Microsoft Silverlight Application
!:mime application/x-silverlight-app
# start by checking for ZIP local file header signature
0 string PK\003\004
!:strength +10
# make sure the first file is correct
>0x1E use msooxml
>0x1E regex \\[Content_Types\\]\\.xml|_rels/\\.rels|docProps
>0x1E default x
>>0x1E regex \\[Content_Types\\]\\.xml|_rels/\\.rels|docProps
# skip to the second local file header
# since some documents include a 520-byte extra field following the file
# header, we need to scan for the next header
>>(18.l+49) search/6000 PK\003\004
>>>(18.l+49) search/6000 PK\003\004
# now skip to the *third* local file header; again, we need to scan due to a
# 520-byte extra field following the file header
>>>&26 search/6000 PK\003\004
>>>>&26 search/6000 PK\003\004
# and check the subdirectory name to determine which type of OOXML
# file we have. Correct the mimetype with the registered ones:
# https://technet.microsoft.com/en-us/library/cc179224.aspx
>>>>&26 use msooxml
>>>>&26 default x
>>>>>&26 use msooxml
>>>>>&26 default x
# OpenOffice/Libreoffice orders ZIP entry differently, so check the 4th file
>>>>>&26 search/6000 PK\003\004
>>>>>>&26 use msooxml
>>>>>>&26 default x Microsoft OOXML
>>>>>>&26 search/6000 PK\003\004
>>>>>>>&26 use msooxml
>>>>>>>&26 default x Microsoft OOXML
>>>>>&26 default x Microsoft OOXML

68
contrib/file/magic/Magdir/msx

@ -138,8 +138,8 @@
>>>>>>>>>>>>>>>0x002D ubyte 2 \b, version=MSX2+
>>>>>>>>>>>>>>>0x002D ubyte 3 \b, version=MSX Turbo-R
>>>>>>>>>>>>>>>0x002D ubyte >3 \b, version=Unknown MSX %d version
>>>>>>>>>>>>>>>0x0006 ubyte x \b, VDP.DR=0x%2x
>>>>>>>>>>>>>>>0x0007 ubyte x \b, VDP.DW=0x%2x
>>>>>>>>>>>>>>>0x0006 ubyte x \b, VDP.DR=%#2x
>>>>>>>>>>>>>>>0x0007 ubyte x \b, VDP.DW=%#2x
>>>>>>>>>>>>>>>0x002B ubyte&0xF 0 \b, charset=Japanese
>>>>>>>>>>>>>>>0x002B ubyte&0xF 1 \b, charset=International
>>>>>>>>>>>>>>>0x002B ubyte&0xF 2 \b, charset=Korean
@ -188,32 +188,32 @@
# MSX extension ROMs
0 string/b AB
>2 uleshort 0x0010 MSX ROM
>>2 uleshort x \b, init=0x%4x
>>4 uleshort >0 \b, stahdl=0x%4x
>>6 uleshort >0 \b, devhdl=0x%4x
>>8 uleshort >0 \b, bas=0x%4x
>>2 uleshort x \b, init=%#4x
>>4 uleshort >0 \b, stahdl=%#4x
>>6 uleshort >0 \b, devhdl=%#4x
>>8 uleshort >0 \b, bas=%#4x
>2 uleshort 0x4010 MSX ROM
>>2 uleshort x \b, init=0x%04x
>>4 uleshort >0 \b, stahdl=0x%04x
>>6 uleshort >0 \b, devhdl=0x%04x
>>8 uleshort >0 \b, bas=0x%04x
>>2 uleshort x \b, init=%#04x
>>4 uleshort >0 \b, stahdl=%#04x
>>6 uleshort >0 \b, devhdl=%#04x
>>8 uleshort >0 \b, bas=%#04x
>2 uleshort 0x8010 MSX ROM
>>2 uleshort x \b, init=0x%04x
>>4 uleshort >0 \b, stahdl=0x%04x
>>6 uleshort >0 \b, devhdl=0x%04x
>>8 uleshort >0 \b, bas=0x%04x
>>2 uleshort x \b, init=%#04x
>>4 uleshort >0 \b, stahdl=%#04x
>>6 uleshort >0 \b, devhdl=%#04x
>>8 uleshort >0 \b, bas=%#04x
0 string/b AB\0\0
>6 uleshort 0
>>4 uleshort >0x400F MSX-BASIC extension ROM
>>>4 uleshort >0 \b, stahdl=0x%04x
>>>6 uleshort >0 \b, devhdl=0x%04x
>>>4 uleshort >0 \b, stahdl=%#04x
>>>6 uleshort >0 \b, devhdl=%#04x
>>>0x1C string OPLL \b, MSX-Music
>>>>0x18 string PAC2 \b (external)
>>>>0x18 string APRL \b (internal)
0 string/b AB\0\0\0\0
>6 uleshort >0x400F MSX device BIOS
>>6 uleshort >0 \b, devhdl=0x%04x
>>6 uleshort >0 \b, devhdl=%#04x
0 string/b AB
@ -233,38 +233,38 @@
>>>>>>0x12 ubyte x \b%d
>>>>>>0x13 ubyte/16 x \b%d
>>>>>>0x13 ubyte&0xF x \b%d
>>>>>2 uleshort x \b, init=0x%04x
>>>>>4 uleshort >0 \b, stahdl=0x%04x
>>>>>6 uleshort >0 \b, devhdl=0x%04x
>>>>>8 uleshort >0 \b, bas=0x%04x
>>>>>2 uleshort x \b, init=%#04x
>>>>>4 uleshort >0 \b, stahdl=%#04x
>>>>>6 uleshort >0 \b, devhdl=%#04x
>>>>>8 uleshort >0 \b, bas=%#04x
>>>2 uleshort 0
>>>>4 uleshort 0
>>>>>6 uleshort 0
>>>>>>8 uleshort >0 MSX BASIC program in ROM, bas=0x%04x
>>>>>>8 uleshort >0 MSX BASIC program in ROM, bas=%#04x
0x4000 string/b AB
>0x4002 uleshort >0x400F
>>0x400A string \0\0\0\0\0\0 MSX ROM with nonstandard page order
>>>0x4002 uleshort x \b, init=0x%04x
>>>0x4004 uleshort >0 \b, stahdl=0x%04x
>>>0x4006 uleshort >0 \b, devhdl=0x%04x
>>>0x4008 uleshort >0 \b, bas=0x%04x
>>>0x4002 uleshort x \b, init=%#04x
>>>0x4004 uleshort >0 \b, stahdl=%#04x
>>>0x4006 uleshort >0 \b, devhdl=%#04x
>>>0x4008 uleshort >0 \b, bas=%#04x
0x8000 string/b AB
>0x8002 uleshort >0x400F
>>0x800A string \0\0\0\0\0\0 MSX ROM with nonstandard page order
>>>0x8002 uleshort x \b, init=0x%04x
>>>0x8004 uleshort >0 \b, stahdl=0x%04x
>>>0x8006 uleshort >0 \b, devhdl=0x%04x
>>>0x8008 uleshort >0 \b, bas=0x%04x
>>>0x8002 uleshort x \b, init=%#04x
>>>0x8004 uleshort >0 \b, stahdl=%#04x
>>>0x8006 uleshort >0 \b, devhdl=%#04x
>>>0x8008 uleshort >0 \b, bas=%#04x
0x3C000 string/b AB
>0x3C008 string \0\0\0\0\0\0\0\0 MSX MegaROM with nonstandard page order
>>0x3C002 uleshort x \b, init=0x%04x
>>0x3C004 uleshort >0 \b, stahdl=0x%04x
>>0x3C006 uleshort >0 \b, devhdl=0x%04x
>>0x3C008 uleshort >0 \b, bas=0x%04x
>>0x3C002 uleshort x \b, init=%#04x
>>0x3C004 uleshort >0 \b, stahdl=%#04x
>>0x3C006 uleshort >0 \b, devhdl=%#04x
>>0x3C008 uleshort >0 \b, bas=%#04x
# MSX BIN file
#0 byte 0xFE

12
contrib/file/magic/Magdir/neko

@ -1,12 +0,0 @@
#------------------------------------------------------------
# $File: neko,v 1.2 2019/04/19 00:42:27 christos Exp $
# From: Mikhail Gusarov <dottedmag@dottedmag.net>
# NekoVM (https://nekovm.org/) bytecode
0 string NEKO NekoVM bytecode
>4 lelong x (%d global symbols,
>8 lelong x %d global fields,
>12 lelong x %d bytecode ops)
!:mime application/x-nekovm-bytecode

6
contrib/file/magic/Magdir/netware

@ -1,7 +1,11 @@
#------------------------------------------------------------------------------
# $File: netware,v 1.4 2009/09/19 16:28:11 christos Exp $
# $File: netware,v 1.5 2020/09/04 16:30:51 christos Exp $
# netware: file(1) magic for NetWare Loadable Modules (NLMs)
# From: Mads Martin Joergensen <mmj@suse.de>
# URL: https://en.wikipedia.org/wiki/NetWare_Loadable_Module
0 string NetWare\ Loadable\ Module NetWare Loadable Module
#!:mime application/octet-stream
!:ext nlm

29
contrib/file/magic/Magdir/nim-lang Normal file

@ -0,0 +1,29 @@
#------------------------------------------------------------------------------
# $File: nim-lang,v 1.3 2021/07/06 12:34:06 christos Exp $
# nim-lang: file(1) magic for nim
# URL: https://nim-lang.org/
0 search/8192 import
>&0 search/64 os
>>&0 use nim1
>&0 default x
>>&0 search/64 osproc
>>>&0 use nim1
>>&0 default x
>>>&0 search/64 strutils
>>>>&0 use nim1
0 name nim1
>&0 search/8192 proc
>>&0 use nim2
>&0 default x
>>&0 search/8192 template
>>>&0 use nim2
>>&0 default x
>>>&0 search/8192 let
>>>>&0 use nim2
0 name nim2
>&0 search/8192 when Nim source code
!:ext nim

71
contrib/file/magic/Magdir/ole2compounddocs

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: ole2compounddocs,v 1.8 2020/03/28 23:10:30 christos Exp $
# $File: ole2compounddocs,v 1.12 2021/09/04 16:00:38 christos Exp $
# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
# Additional tests for OLE 2 Compound Documents should be under this recipe.
@ -10,7 +10,7 @@
# https://digital-preservation.github.io/droid/
# skip droid skeleton like fmt-39-signature-id-128.doc by valid version
>0x1A ushort !0xABAB OLE 2 Compound Document
#>0x1C uleshort x \b, endnian 0x%4.4x
#>0x1C uleshort x \b, endnian %#4.4x
# big endian not tested
>>0x1C ubeshort =0xfffe \b, big-endian
>>>546 string jbjb : Microsoft Word Document
@ -26,25 +26,25 @@
# Minor Version 32h=50 3Bh=59 3Eh=62
>>>0x18 uleshort x \b.%u
# SecID of first sector of the directory stream is often 1 but high like 3144h
>>>48 ulelong x \b, SecID 0x%x
>>>48 ulelong x \b, SecID %#x
# Sector Shift Exponent in short-stream container stream: 6~64 bytes
>>>32 uleshort !6 \b, exponent of short stream %u
# total number of sectors used for the FAT
>>>44 ulelong >1 \b, %u FAT sectors
# SecID of first sector of the short-sector allocation table (Mini FAT)
# or -2 (End Of ChainSecID) if not extant
>>>60 ulelong !0xffFFffFE \b, Mini FAT start sector 0x%x
>>>60 ulelong !0xffFFffFE \b, Mini FAT start sector %#x
# total number of sectors used for the short-sector allocation table
>>>64 ulelong !1 \b, %u Mini FAT sector
# plural s
>>>>64 ulelong >1 \bs
# SecID of first sector of the master sector allocation table (DIFAT)
# or -2 (End Of Chain SecID) if no additional sectors used
>>>68 ulelong !0xffFFffFE \b, DIFAT start sector 0x%x
>>>68 ulelong !0xffFFffFE \b, DIFAT start sector %#x
# total number of sectors used for the master sector allocation table (DIFAT)
>>>72 ulelong >0 \b, %u DIFAT sectors
# First part of the master sector allocation table (DIFAT) containing 109 SecIDs
#>>>76 ubequad x \b, DIFAT=0x%16.16llx
#>>>76 ubequad x \b, DIFAT=%#16.16llx
#>>>84 ubequad x \b%16.16llx...
# pointer to root entry only works with standard configuration for SecID ~< 800h
# Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls
@ -87,8 +87,8 @@
# https://wikileaks.org/ciav7p1/cms/page_13762814.html
# https://m.blog.naver.com/superman4u/40047693679
# https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt
# http://www.windowstricks.in/online-windows-guid-converter
#>80 ubequad !0 \b, clsid 0x%16.16llx
# https://toolslick.com/conversion/data/guid
#>80 ubequad !0 \b, clsid %#16.16llx
#>>88 ubequad x \b%16.16llx
# test for "Root Entry" inside directory by type 5 value
>66 ubyte 5
@ -210,6 +210,15 @@
>>>>256 lestring16 Thumbnail : Corel PrintHouse image
!:mime application/x-corel-cph
!:ext cph
# URL: http://fileformats.archiveteam.org/wiki/Corel_Gallery
# Note: format since Gallery 2; sometimes called Corel Multimedia Manager Album
# third directory entry name _INFO_
>>>>256 lestring16 _INFO_ : Corel Gallery
# second directory entry name _ITEM_ or _DATA_
# later directory entry names: _ALBUM_ _THUMBNAIL_
#!:mime application/x-ole-storage
!:mime application/x-corel-gal
!:ext gal
#
# URL: https://en.wikipedia.org/wiki/Hangul_(word_processor)
# Note: "HWP Document File" signature found in FileHeader
@ -231,7 +240,7 @@
>>>>128 lestring16 Current\ User : SoftMaker
# third directory entry name SMNativeObjData
>>>>>256 lestring16 SMNativeObjData
# 5th directory entry nane PowerPoint
# 5th directory entry name PowerPoint
>>>>>>512 lestring16 PowerPoint PowerPoint presentation or template
!:mime application/vnd.ms-powerpoint
!:ext ppt/pps/pot
@ -251,6 +260,12 @@
>>>>>>128 lestring16 Pictures with pictures
# remaining null clsid
>>>>128 default x : UNKNOWN
# second directory entry name like VisioDocument Control000
>>>>>128 lestring16 x with names %.20s
# third directory entry like WordDocument
>>>>>256 lestring16 x %.20s
# forth
>>>>>384 lestring16 x %.20s
!:mime application/x-ole-storage
# look for known clsid GUID
# - Visio documents
@ -315,7 +330,7 @@
!:mime application/vnd.ms-excel
# https://www.macdisk.com/macsigen.php XLS5 for Excel 5
!:apple ????XLS9
# 3nd directory entry name
# 3rd directory entry name
>>>>256 lestring16 _VBA_PROJECT_CUR addin
!:ext xla/
# 4th directory entry name
@ -365,6 +380,21 @@
!:mime application/vnd.ms-works
!:apple ????AWWP
!:ext wps
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Microsoft_Works
# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
# Note: probably version 6 and 7
# organize pictures like JPFG images in streams __cf1 with names like
# 001.JPG, 002.JPG ... in streams __fname
>>88 ubequad 0xa1c800c04f612452 : Microsoft
>>>80 ubequad 0xc0c7266eb98cd311 Works portfolio
# 2nd directory entry name PfOrder, 3rd __LastID and 4th __SizeUsed
#!:mime application/x-ole-storage
# https://www.iana.org/assignments/media-types/application/vnd.ms-works
!:mime application/vnd.ms-works
# https://extension.nirsoft.net/wsb
# like: wsbsamp.wsb WORKS2003_CD:\MSWorks\Common\Sammlung.wsb
!:ext wsb
#??
# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Publisher
>>88 ubequad 0x00c0000000000046 : Microsoft
@ -395,6 +425,25 @@
!:mime application/vnd.ms-project
!:ext mpp
#
# URL: http://fileformats.archiveteam.org/wiki/WordPerfect
# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
# https://github.com/OneWingedShark/WordPerfect/
# blob/master/doc/SDK_Help/FileFormats/WPFF_DocumentStructure.htm
# From: Joerg Jenderek
# Note: internal version x.2 or 2.2 like in embedded ole6-PerfectOffice_MAIN.wpd
# 3rd directory entry name PerfectOffice_OBJECT and 2nd PerfectOffice_MAIN,
# which contains WordPerfect document \xffWPC signature handled by ./wordprocessors
>>88 ubequad 0x19370000929679cd : WordPerfect 7
>>>80 ubequad 0xff739851ad2d2002 Document
!:mime application/vnd.wordperfect
#!:apple ????WPC?
# https://fossies.org/linux/wp2latex/test/ole6.wpd
!:ext wpd
#>>>>0 search/0xc01/s \xffWPC \b, WPC SIGNATURE
# inspect embedded WordPerfect document by ./wordprocessors with 1 space at end
#>>>>>&0 indirect x \b; contains
# GRR: the above expression does not work correctly
#
# URL: http://fileformats.archiveteam.org/wiki/SHW_(Corel)
#???
>>88 ubequad 0x99ae04021c007002 : WordPerfect
@ -514,6 +563,6 @@
# remaining non null clsid
>>88 default x : UNKNOWN
!:mime application/x-ole-storage
>>>80 ubequad !0 \b, clsid 0x%16.16llx
>>>80 ubequad !0 \b, clsid %#16.16llx
>>>88 ubequad x \b%16.16llx

137
contrib/file/magic/Magdir/os2

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: os2,v 1.10 2017/03/17 21:35:28 christos Exp $
# $File: os2,v 1.13 2021/04/26 15:56:00 christos Exp $
# os2: file(1) magic for OS/2 files
#
@ -25,6 +25,8 @@
#>5 string >\ (Local file) <%s>
# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com)
# URL: http://fileformats.archiveteam.org/wiki/INF/HLP_(OS/2)
# Reference: http://www.edm2.com/0308/inf.html
# Carl Hauser (chauser.parc@xerox.com) and
# Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
# list the following header format in inf02a.doc:
@ -41,9 +43,142 @@
# int16 unknown2; // unknown purpose
#
0 string HSP\x01\x9b\x00 OS/2 INF
!:mime application/x-os2-inf
!:ext inf
>107 string >0 (%s)
0 string HSP\x10\x9b\x00 OS/2 HLP
!:mime application/x-os2-hlp
!:ext hlp
>107 string >0 (%s)
# From: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/MSG_(OS/2)
# Reference: https://github.com/OS2World/UTIL-SYSTEM-MKMSGF/blob/master/mkmsgf.h
# Note: created by MKMSGF.EXE. Text source can be recreated by E_MSGF
# example like OS001H.MSG
0 string \xffMKMSGF\0 OS/2 help message
!:mime application/x-os2-msg
!:ext msg
# identifier[3] like: DOS NET REX SYS ...
>8 string x '%.3s'
# msgnumber: number of messages
>11 uleshort x \b, %u messages
# firstmsgnumber; number of the first message like: some times 0 often 1 169 1000 3502
>13 uleshort >1 \b, 1st number %u
# offset16bit; 1~Index table has 16-bit offsets (files<64k) 0~Index table has 32-bit offsets
>15 ubyte =0 \b, 32-bit
#>15 ubyte =1 \b, 16-bit
# version; file version: 2~new 0~old
>16 uleshort !2 \b, version %u
# indextaboffset; offset of index table: 1F~after header 0~no index table for version 0?
>18 uleshort >0
>>18 uleshort !0x1f \b, at %#x index
# 32-bit offset
>>15 ubyte =0
# offset with message table
>>>(18.s) ulelong x \b, at %#x
# 1st message
# http://www.os2museum.com/files/docs/os210ptk/os2-1.0-ptk-tools-1988.pdf
# message type: E~Error H~Help I~Information P~Prompt W~Warning ?
>>>>(&-4.l) ubyte x %c-type
>>>>>&0 string x %s
# 16-bit offset
>>15 ubyte =1
# msgnum; message number
>>>(18.s) uleshort x \b, number %u
# msgindex; offset of message from begin of file
>>>(18.s+2) uleshort x at %#x
# message type E H I P W ?
>>>>(&-2.s) ubyte x %c-type
# skip newline carriage return
>>>>>&0 ubeshort =0x0D0a
>>>>>>&0 string x %s
>>>>>&0 ubeshort !0x0D0a
>>>>>>&-2 string x %s
# for version 0 index table apparently at offset 1F
>16 uleshort 0
>>15 ubyte 1
# 1st message 16-bit
>>>0x1F uleshort x \b, at %#x
# message type: E~Error H~Help I~Information P~Prompt W~Warning ?
>>>>(0x1F.s) ubyte x %c-type
>>>>>&0 string x %s
# 2nd message 16-bit
>>>0x21 uleshort x \b, at %#x
>>>>(0x21.s) ubyte x %c-type
>>>>>&0 string x %s
# 3rd message 16-bit
>>>0x23 uleshort x \b, at %#x
>>>>(0x23.s) ubyte x %c-type
>>>>>&0 string x %s
# version 0 32-bit
>>15 ubyte 0
# 1st message 32-bit
>>>0x1f ulelong x \b, at %#x
>>>>(0x1F.l) ubyte x %c-type
>>>>>&0 string x %s
# 2nd message 32-bit
>>>0x23 ulelong x \b, at %#x
>>>>(0x23.l) ubyte x %c-type
>>>>>&0 string x %s
# 3rd message 32-bit
>>>0x27 ulelong x \b, AT %#x
>>>>(0x27.l) ubyte x %c-type
>>>>>&0 string x %s
# countryinfo; offset of country info block: 0 for version 0
>20 uleshort !0 \b, at %#x countryinfo
# nextcoutryinfo
>>22 uleshort >0 \b, at %#x next
# reserved[5]; Must be 0
>>25 ulelong !0 \b, RESERVED %#x
>>(20.s) use os2-msg-info
# display country info block of MKMSGF message file
0 name os2-msg-info
# bytesperchar; bytes per char: 1~SBCS 2~DBCS
>0 ubyte >1 \b, %u bytes/char
# reserved; Not known
>1 uleshort !0 \b, reserved %#x
# langfamilyID; language family ID like: 0~? 1~Arabic ... 7~German ... 9~English ... 34~Slovene
>3 uleshort >0 \b, language %u
# langversionID; like: 7_1~German 7_2~Swiss German 12_1~French 12_3~Canadian French
>>5 uleshort x \b_%u
# langfamilyID too high. This should not happen
>3 uleshort >34 (invalid language)
# codepagesnumber; number of codepages like: 1 2 ... 16
>7 uleshort x \b, %u code page
# plural s
>7 uleshort >1 \bs
# too many number of codepages. This should not happen
>7 uleshort >16 (Too many)
# codepages[16]; codepages list like 437 850 ...
>7 uleshort <17
# 1st code page
>>9 uleshort >0 %u
# possible 2nd code page number
>>>7 uleshort >1
>>>>11 uleshort x %u
# filename[260]; name of file like: dbaseos2.msg dde4c01e.msg os2ldr.mgr xdfh.msg ...
>41 string x \b, %s
# OS/2 INI (this is a guess)
0 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI
!:mime application/x-os2-ini
!:ext ini
# From: Joerg Jenderek
# URL: http://warpin.netlabs.org/
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-wpi.trid.xml
# Note: called by TrID "WarpIN Installer"
# probably magic at the beginning
0 ubelong =0x770402BE WarpIN Installer
#>4 ubelong =0x03000000
#!:mime application/octet-stream
!:mime application/x-os2-wpi
!:ext wpi
# creator program name like: "reserved" or "WIC x.y.z"
>0x106 string x \b, created by %s
# name like: "reserved" or "OS/2 Netlabs"
>0x146 string x \b, '%s'
# name like: "N/A" "http://warpin.netlabs.org"
>0x186 string x \b, URL %s

8
contrib/file/magic/Magdir/pcjr Normal file

@ -0,0 +1,8 @@
#------------------------------------------------------------------------------
# $File: pcjr,v 1.1 2021/01/09 15:09:58 christos Exp $
# pcjr: file(1) magic for PCjr Cartridge image file format
# From: Francis Laniel <laniel_francis@privacyrequired.com>
0 string PCjr
>0x80 beshort 0x55aa PCjr Cartridge image
>0x200 beshort 0x55aa PCjr Cartridge image

11
contrib/file/magic/Magdir/pdf

@ -1,15 +1,18 @@
#------------------------------------------------------------------------------
# $File: pdf,v 1.12 2020/01/30 01:48:44 christos Exp $
# $File: pdf,v 1.16 2021/07/30 11:47:07 christos Exp $
# pdf: file(1) magic for Portable Document Format
#
0 name pdf
>8 search/512 /Filter/FlateDecode/ (password protected)
>8 search /Count
>>&0 regex [0-9]+ \b, %s pages
>8 search/512 /Filter/FlateDecode/ (zip deflate encoded)
0 string %PDF- PDF document
!:mime application/pdf
!:strength +60
!:ext pdf
>5 byte x \b, version %c
>7 byte x \b.%c
>0 use pdf
@ -17,6 +20,7 @@
0 string \012%PDF- PDF document
!:mime application/pdf
!:strength +60
!:ext pdf
>6 byte x \b, version %c
>8 byte x \b.%c
>0 use pdf
@ -24,6 +28,7 @@
0 string \xef\xbb\xbf%PDF- PDF document (UTF-8)
!:mime application/pdf
!:strength +60
!:ext pdf
>6 byte x \b, version %c
>8 byte x \b.%c
>0 use pdf
@ -33,12 +38,14 @@
0 string %FDF- FDF document
!:mime application/vnd.fdf
!:strength +60
!:ext pdf
>5 byte x \b, version %c
>7 byte x \b.%c
0 search/256 %PDF- PDF document
!:mime application/pdf
!:strength +60
!:ext pdf
>&0 byte x \b, version %c
>&2 byte x \b.%c
>0 use pdf

6
contrib/file/magic/Magdir/pgf

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: pgf,v 1.2 2017/03/17 21:35:28 christos Exp $
# $File: pgf,v 1.3 2021/02/23 00:51:10 christos Exp $
# pgf: file(1) magic for Progressive Graphics File (PGF)
#
# <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf>
@ -25,7 +25,7 @@
>>20 byte 1 gray scale,
>>20 byte 2 indexed color,
>>20 byte 3 RGB color,
>>20 byte 4 CYMK color,
>>20 byte 4 CMYK color,
>>20 byte 5 HSL color,
>>20 byte 6 HSB color,
>>20 byte 7 multi-channel,
@ -34,7 +34,7 @@
>>20 byte 10 gray scale 16,
>>20 byte 11 RGB color 48,
>>20 byte 12 LAB color 48,
>>20 byte 13 CYMK color 64,
>>20 byte 13 CMYK color 64,
>>20 byte 14 deep multi-channel,
>>20 byte 15 duo tone 16,
>>20 byte 17 RGBA color,

Some files were not shown because too many files have changed in this diff Show More