Convert to mdoc. Move Id to the top.
This commit is contained in:
parent
ed158e7e93
commit
fb9d8a6886
@ -1,195 +1,205 @@
|
||||
.TH MAGIC 5 "Public Domain"
|
||||
.\"
|
||||
.\" @(#)$Id: magic.5,v 1.8 1997/11/04 03:56:56 steve Exp $
|
||||
.\"
|
||||
.\" install as magic.4 on USG, magic.5 on V7 or Berkeley systems.
|
||||
.SH NAME
|
||||
magic \- file command's magic number file
|
||||
.SH DESCRIPTION
|
||||
.\"
|
||||
.Dd September 3, 1994
|
||||
.Dt MAGIC 5
|
||||
.Os "Public Domain"
|
||||
.Sh NAME
|
||||
.Nm magic
|
||||
.Nd file command's magic number file
|
||||
.Sh DESCRIPTION
|
||||
This manual page documents the format of the magic file as
|
||||
used by the
|
||||
.BR file (1)
|
||||
.Xr file 1
|
||||
command, version 3.22. The
|
||||
.B file
|
||||
.Nm file
|
||||
command identifies the type of a file using,
|
||||
among other tests,
|
||||
a test for whether the file begins with a certain
|
||||
.IR "magic number" .
|
||||
.Em "magic number" .
|
||||
The file
|
||||
.I /usr/share/misc/magic
|
||||
.Pa /usr/share/misc/magic
|
||||
specifies what magic numbers are to be tested for,
|
||||
what message to print if a particular magic number is found,
|
||||
and additional information to extract from the file.
|
||||
.PP
|
||||
.Pp
|
||||
Each line of the file specifies a test to be performed.
|
||||
A test compares the data starting at a particular offset
|
||||
in the file with a 1-byte, 2-byte, or 4-byte numeric value or
|
||||
a string. If the test succeeds, a message is printed.
|
||||
The line consists of the following fields:
|
||||
.IP offset \w'message'u+2n
|
||||
.Bl -tag -width indent
|
||||
.It offset
|
||||
A number specifying the offset, in bytes, into the file of the data
|
||||
which is to be tested.
|
||||
.IP type
|
||||
.It type
|
||||
The type of the data to be tested. The possible values are:
|
||||
.RS
|
||||
.IP byte \w'message'u+2n
|
||||
.Bl -tag -width indent
|
||||
.It byte
|
||||
A one-byte value.
|
||||
.IP short
|
||||
.It short
|
||||
A two-byte value (on most systems) in this machine's native byte order.
|
||||
.IP long
|
||||
.It long
|
||||
A four-byte value (on most systems) in this machine's native byte order.
|
||||
.IP string
|
||||
.It string
|
||||
A string of bytes.
|
||||
.IP date
|
||||
.It date
|
||||
A four-byte value interpreted as a unix date.
|
||||
.IP beshort
|
||||
.It beshort
|
||||
A two-byte value (on most systems) in big-endian byte order.
|
||||
.IP belong
|
||||
.It belong
|
||||
A four-byte value (on most systems) in big-endian byte order.
|
||||
.IP bedate
|
||||
.It bedate
|
||||
A four-byte value (on most systems) in big-endian byte order,
|
||||
interpreted as a unix date.
|
||||
.IP leshort
|
||||
.It leshort
|
||||
A two-byte value (on most systems) in little-endian byte order.
|
||||
.IP lelong
|
||||
.It lelong
|
||||
A four-byte value (on most systems) in little-endian byte order.
|
||||
.IP ledate
|
||||
.It ledate
|
||||
A four-byte value (on most systems) in little-endian byte order,
|
||||
interpreted as a unix date.
|
||||
.RE
|
||||
.PP
|
||||
.El
|
||||
.El
|
||||
.Pp
|
||||
The numeric types may optionally be followed by
|
||||
.B &
|
||||
.Em &
|
||||
and a numeric value,
|
||||
to specify that the value is to be AND'ed with the
|
||||
numeric value before any comparisons are done. Prepending a
|
||||
.B u
|
||||
.Em u
|
||||
to the type indicates that ordered comparisons should be unsigned.
|
||||
.IP test
|
||||
.Bl -tag -width indent
|
||||
.It test
|
||||
The value to be compared with the value from the file. If the type is
|
||||
numeric, this value
|
||||
is specified in C form; if it is a string, it is specified as a C string
|
||||
with the usual escapes permitted (e.g. \en for new-line).
|
||||
.IP
|
||||
.It ""
|
||||
Numeric values
|
||||
may be preceded by a character indicating the operation to be performed.
|
||||
It may be
|
||||
.BR = ,
|
||||
.Em = ,
|
||||
to specify that the value from the file must equal the specified value,
|
||||
.BR < ,
|
||||
.Em < ,
|
||||
to specify that the value from the file must be less than the specified
|
||||
value,
|
||||
.BR > ,
|
||||
.Em > ,
|
||||
to specify that the value from the file must be greater than the specified
|
||||
value,
|
||||
.BR & ,
|
||||
.Em & ,
|
||||
to specify that the value from the file must have set all of the bits
|
||||
that are set in the specified value,
|
||||
.BR ^ ,
|
||||
.Em ^ ,
|
||||
to specify that the value from the file must have clear any of the bits
|
||||
that are set in the specified value, or
|
||||
.BR x ,
|
||||
.Em x ,
|
||||
to specify that any value will match. If the character is omitted,
|
||||
it is assumed to be
|
||||
.BR = .
|
||||
.IP
|
||||
.Em = .
|
||||
.It ""
|
||||
Numeric values are specified in C form; e.g.
|
||||
.B 13
|
||||
.Em 13
|
||||
is decimal,
|
||||
.B 013
|
||||
.Em 013
|
||||
is octal, and
|
||||
.B 0x13
|
||||
.Em 0x13
|
||||
is hexadecimal.
|
||||
.IP
|
||||
.It ""
|
||||
For string values, the byte string from the
|
||||
file must match the specified byte string.
|
||||
The operators
|
||||
.BR = ,
|
||||
.B <
|
||||
.Em = ,
|
||||
.Em <
|
||||
and
|
||||
.B >
|
||||
.Em >
|
||||
(but not
|
||||
.BR & )
|
||||
.Em & )
|
||||
can be applied to strings.
|
||||
The length used for matching is that of the string argument
|
||||
in the magic file. This means that a line can match any string, and
|
||||
then presumably print that string, by doing
|
||||
.B >\e0
|
||||
.Em >\e0
|
||||
(because all strings are greater than the null string).
|
||||
.IP message
|
||||
.It message
|
||||
The message to be printed if the comparison succeeds. If the string
|
||||
contains a
|
||||
.BR printf (3S)
|
||||
.Xr printf 3
|
||||
format specification, the value from the file (with any specified masking
|
||||
performed) is printed using the message as the format string.
|
||||
.PP
|
||||
.El
|
||||
.Pp
|
||||
Some file formats contain additional information which is to be printed
|
||||
along with the file type. A line which begins with the character
|
||||
.B >
|
||||
.Em >
|
||||
indicates additional tests and messages to be printed. The number of
|
||||
.B >
|
||||
.Em >
|
||||
on the line indicates the level of the test; a line with no
|
||||
.B >
|
||||
.Em >
|
||||
at the beginning is considered to be at level 0.
|
||||
Each line at level
|
||||
.IB n \(pl1
|
||||
.Em n+1
|
||||
is under the control of the line at level
|
||||
.IB n
|
||||
.Em n
|
||||
most closely preceding it in the magic file.
|
||||
If the test on a line at level
|
||||
.I n
|
||||
.Em n
|
||||
succeeds, the tests specified in all the subsequent lines at level
|
||||
.IB n \(pl1
|
||||
.Em n+1
|
||||
are performed, and the messages printed if the tests succeed. The next
|
||||
line at level
|
||||
.I n
|
||||
.Em n
|
||||
terminates this.
|
||||
If the first character following the last
|
||||
.B >
|
||||
.Em >
|
||||
is a
|
||||
.B (
|
||||
.Em (
|
||||
then the string after the parenthesis is interpreted as an indirect offset.
|
||||
That means that the number after the parenthesis is used as an offset in
|
||||
the file. The value at that offset is read, and is used again as an offset
|
||||
in the file. Indirect offsets are of the form:
|
||||
.BI ( x [.[bsl]][+-][ y ]).
|
||||
.Em (x[.[bsl]][+-][y]) .
|
||||
The value of
|
||||
.I x
|
||||
.Em x
|
||||
is used as an offset in the file. A byte, short or long is read at that offset
|
||||
depending on the
|
||||
.B [bsl]
|
||||
.Em [bsl]
|
||||
type specifier. To that number the value of
|
||||
.I y
|
||||
.Em y
|
||||
is added and the result is used as an offset in the file. The default type
|
||||
if one is not specified is long.
|
||||
.PP
|
||||
.Pp
|
||||
Sometimes you do not know the exact offset as this depends on the length of
|
||||
preceding fields. You can specify an offset relative to the end of the
|
||||
last uplevel field (of course this may only be done for sublevel tests, i.e.
|
||||
test beginning with
|
||||
.B >
|
||||
). Such a relative offset is specified using
|
||||
.B &
|
||||
.Em > Ns ).
|
||||
Such a relative offset is specified using
|
||||
.Em &
|
||||
as a prefix to the offset.
|
||||
.SH BUGS
|
||||
.Sh BUGS
|
||||
The formats
|
||||
.IR long ,
|
||||
.IR belong ,
|
||||
.IR lelong ,
|
||||
.IR short ,
|
||||
.IR beshort ,
|
||||
.IR leshort ,
|
||||
.IR date ,
|
||||
.IR bedate ,
|
||||
.Em long ,
|
||||
.Em belong ,
|
||||
.Em lelong ,
|
||||
.Em short ,
|
||||
.Em beshort ,
|
||||
.Em leshort ,
|
||||
.Em date ,
|
||||
.Em bedate ,
|
||||
and
|
||||
.I ledate
|
||||
.Em ledate
|
||||
are system-dependent; perhaps they should be specified as a number
|
||||
of bytes (2B, 4B, etc),
|
||||
since the files being recognized typically come from
|
||||
a system on which the lengths are invariant.
|
||||
.PP
|
||||
.Pp
|
||||
There is (currently) no support for specified-endian data to be used in
|
||||
indirect offsets.
|
||||
.SH SEE ALSO
|
||||
.BR file (1)
|
||||
\- the command that reads this file.
|
||||
.Sh SEE ALSO
|
||||
.Xr file 1
|
||||
.\"
|
||||
.\" From: guy@sun.uucp (Guy Harris)
|
||||
.\" Newsgroups: net.bugs.usg
|
||||
@ -203,4 +213,3 @@ indirect offsets.
|
||||
.\" the changes I posted to the S5R2 version.
|
||||
.\"
|
||||
.\" Modified for Ian Darwin's version of the file command.
|
||||
.\" @(#)$Id: magic.5,v 1.7 1997/03/18 19:37:20 mpp Exp $
|
||||
|
Loading…
x
Reference in New Issue
Block a user