d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

MFV r323678: file 5.32

Browse Source 
Approved by:	emaste (mentor)
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D12400
This commit is contained in:
gordon 2017-09-17 19:14:38 +00:00
commit 8166f0a416
146 changed files with 3244 additions and 1861 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
contrib/file/ChangeLog
View File

@ -1,6 +1,60 @@
2017-09-02 11:53 Christos Zoulas <christos@zoulas.com>
* release 5.32
2017-08-28 16:37 Christos Zoulas <christos@zoulas.com>
* Always reset state in {file,buffer}_apprentice (Krzysztof Wilczynski)
2017-08-27 03:55 Christos Zoulas <christos@zoulas.com>
* Fix always true condition (Thomas Jarosch)
2017-05-24 17:30 Christos Zoulas <christos@zoulas.com>
* pickier parsing of numeric values in magic files.
2017-05-23 17:55 Christos Zoulas <christos@zoulas.com>
* PR/615 add magic_getflags()
2017-05-23 13:55 Christos Zoulas <christos@zoulas.com>
* release 5.31
2017-03-17 20:32 Christos Zoulas <christos@zoulas.com>
* remove trailing spaces from magic files
* refactor is_tar
* better bounds checks for cdf
2017-02-10 12:24 Christos Zoulas <christos@zoulas.com>
* release 5.30
2017-02-07 23:27 Christos Zoulas <christos@zoulas.com>
* If we exceeded the offset in a search return no match
(Christoph Biedl)
* Be more lenient on corrupt CDF files (Christoph Biedl)
2017-02-04 16:46 Christos Zoulas <christos@zoulas.com>
* pacify ubsan sign extension (oss-fuzz/524)
2017-02-01 12:42 Christos Zoulas <christos@zoulas.com>
* off by one in cdf parsing (PR/593)
* report debugging sections in elf (PR/591)
2016-11-06 10:52 Christos Zoulas <christos@zoulas.com>
* Allow @@@ in extensions
* Add missing overflow check in der magic (Jonas Wagner)
2016-10-25 10:40 Christos Zoulas <christos@zoulas.com>
* release 5.28
* release 5.29
2016-10-24 11:20 Christos Zoulas <christos@zoulas.com>
@ -387,7 +441,7 @@
`
2013-11-06 14:40 Christos Zoulas <christos@zoulas.com>
* fix erroneous non-zero exit code from non-existant file and message
* fix erroneous non-zero exit code from non-existent file and message
2013-10-29 14:25 Christos Zoulas <christos@zoulas.com>

2
contrib/file/aclocal.m4 vendored
View File

@ -21,7 +21,7 @@ If you have problems, you may need to regenerate the build system entirely.
To do so, use the procedure documented by the package, typically 'autoreconf'.])])
# visibility.m4 serial 5 (gettext-0.18.2)
dnl Copyright (C) 2005, 2008, 2010-2014 Free Software Foundation, Inc.
dnl Copyright (C) 2005, 2008, 2010-2016 Free Software Foundation, Inc.
dnl This file is free software; the Free Software Foundation
dnl gives unlimited permission to copy and/or distribute it,
dnl with or without modifications, as long as this notice is preserved.

144
contrib/file/config.guess vendored
View File

@ -1,8 +1,8 @@
#! /bin/sh
# Attempt to guess a canonical system name.
# Copyright 1992-2015 Free Software Foundation, Inc.
# Copyright 1992-2017 Free Software Foundation, Inc.
timestamp='2015-03-04'
timestamp='2017-01-01'
# This file is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
@ -27,7 +27,7 @@ timestamp='2015-03-04'
# Originally written by Per Bothner; maintained since 2000 by Ben Elliston.
#
# You can get the latest version of this script from:
# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD
# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess
#
# Please send patches to <config-patches@gnu.org>.
@ -50,7 +50,7 @@ version="\
GNU config.guess ($timestamp)
Originally written by Per Bothner.
Copyright 1992-2015 Free Software Foundation, Inc.
Copyright 1992-2017 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@ -186,9 +186,12 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
*) machine=${UNAME_MACHINE_ARCH}-unknown ;;
esac
# The Operating System including object format, if it has switched
# to ELF recently, or will in the future.
# to ELF recently (or will in the future) and ABI.
case "${UNAME_MACHINE_ARCH}" in
arm*|earm*|i386|m68k|ns32k|sh3*|sparc|vax)
earm*)
os=netbsdelf
;;
arm*|i386|m68k|ns32k|sh3*|sparc|vax)
eval $set_cc_for_build
if echo __ELF__ | $CC_FOR_BUILD -E - 2>/dev/null \
| grep -q __ELF__
@ -221,7 +224,7 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
release='-gnu'
;;
*)
release=`echo ${UNAME_RELEASE}|sed -e 's/[-_].*/\./'`
release=`echo ${UNAME_RELEASE} | sed -e 's/[-_].*//' | cut -d. -f1,2`
;;
esac
# Since CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM:
@ -237,6 +240,10 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
UNAME_MACHINE_ARCH=`arch | sed 's/OpenBSD.//'`
echo ${UNAME_MACHINE_ARCH}-unknown-openbsd${UNAME_RELEASE}
exit ;;
*:LibertyBSD:*:*)
UNAME_MACHINE_ARCH=`arch | sed 's/^.*BSD\.//'`
echo ${UNAME_MACHINE_ARCH}-unknown-libertybsd${UNAME_RELEASE}
exit ;;
*:ekkoBSD:*:*)
echo ${UNAME_MACHINE}-unknown-ekkobsd${UNAME_RELEASE}
exit ;;
@ -249,6 +256,9 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
*:MirBSD:*:*)
echo ${UNAME_MACHINE}-unknown-mirbsd${UNAME_RELEASE}
exit ;;
*:Sortix:*:*)
echo ${UNAME_MACHINE}-unknown-sortix
exit ;;
alpha:OSF1:*:*)
case $UNAME_RELEASE in
*4.0)
@ -265,42 +275,42 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
ALPHA_CPU_TYPE=`/usr/sbin/psrinfo -v | sed -n -e 's/^ The alpha \(.*\) processor.*$/\1/p' | head -n 1`
case "$ALPHA_CPU_TYPE" in
"EV4 (21064)")
UNAME_MACHINE="alpha" ;;
UNAME_MACHINE=alpha ;;
"EV4.5 (21064)")
UNAME_MACHINE="alpha" ;;
UNAME_MACHINE=alpha ;;
"LCA4 (21066/21068)")
UNAME_MACHINE="alpha" ;;
UNAME_MACHINE=alpha ;;
"EV5 (21164)")
UNAME_MACHINE="alphaev5" ;;
UNAME_MACHINE=alphaev5 ;;
"EV5.6 (21164A)")
UNAME_MACHINE="alphaev56" ;;
UNAME_MACHINE=alphaev56 ;;
"EV5.6 (21164PC)")
UNAME_MACHINE="alphapca56" ;;
UNAME_MACHINE=alphapca56 ;;
"EV5.7 (21164PC)")
UNAME_MACHINE="alphapca57" ;;
UNAME_MACHINE=alphapca57 ;;
"EV6 (21264)")
UNAME_MACHINE="alphaev6" ;;
UNAME_MACHINE=alphaev6 ;;
"EV6.7 (21264A)")
UNAME_MACHINE="alphaev67" ;;
UNAME_MACHINE=alphaev67 ;;
"EV6.8CB (21264C)")
UNAME_MACHINE="alphaev68" ;;
UNAME_MACHINE=alphaev68 ;;
"EV6.8AL (21264B)")
UNAME_MACHINE="alphaev68" ;;
UNAME_MACHINE=alphaev68 ;;
"EV6.8CX (21264D)")
UNAME_MACHINE="alphaev68" ;;
UNAME_MACHINE=alphaev68 ;;
"EV6.9A (21264/EV69A)")
UNAME_MACHINE="alphaev69" ;;
UNAME_MACHINE=alphaev69 ;;
"EV7 (21364)")
UNAME_MACHINE="alphaev7" ;;
UNAME_MACHINE=alphaev7 ;;
"EV7.9 (21364A)")
UNAME_MACHINE="alphaev79" ;;
UNAME_MACHINE=alphaev79 ;;
esac
# A Pn.n version is a patched version.
# A Vn.n version is a released version.
# A Tn.n version is a released field test version.
# A Xn.n version is an unreleased experimental baselevel.
# 1.2 uses "1.2" for uname -r.
echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[PVTX]//' | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[PVTX]//' | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz`
# Reset EXIT trap before exiting to avoid spurious non-zero exit code.
exitcode=$?
trap '' 0
@ -373,16 +383,16 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
exit ;;
i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*)
eval $set_cc_for_build
SUN_ARCH="i386"
SUN_ARCH=i386
# If there is a compiler, see if it is configured for 64-bit objects.
# Note that the Sun cc does not turn __LP64__ into 1 like gcc does.
# This test works for both compilers.
if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
if [ "$CC_FOR_BUILD" != no_compiler_found ]; then
if (echo '#ifdef __amd64'; echo IS_64BIT_ARCH; echo '#endif') | \
(CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
(CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
grep IS_64BIT_ARCH >/dev/null
then
SUN_ARCH="x86_64"
SUN_ARCH=x86_64
fi
fi
echo ${SUN_ARCH}-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
@ -407,7 +417,7 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
exit ;;
sun*:*:4.2BSD:*)
UNAME_RELEASE=`(sed 1q /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null`
test "x${UNAME_RELEASE}" = "x" && UNAME_RELEASE=3
test "x${UNAME_RELEASE}" = x && UNAME_RELEASE=3
case "`/bin/arch`" in
sun3)
echo m68k-sun-sunos${UNAME_RELEASE}
@ -632,13 +642,13 @@ EOF
sc_cpu_version=`/usr/bin/getconf SC_CPU_VERSION 2>/dev/null`
sc_kernel_bits=`/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null`
case "${sc_cpu_version}" in
523) HP_ARCH="hppa1.0" ;; # CPU_PA_RISC1_0
528) HP_ARCH="hppa1.1" ;; # CPU_PA_RISC1_1
523) HP_ARCH=hppa1.0 ;; # CPU_PA_RISC1_0
528) HP_ARCH=hppa1.1 ;; # CPU_PA_RISC1_1
532) # CPU_PA_RISC2_0
case "${sc_kernel_bits}" in
32) HP_ARCH="hppa2.0n" ;;
64) HP_ARCH="hppa2.0w" ;;
'') HP_ARCH="hppa2.0" ;; # HP-UX 10.20
32) HP_ARCH=hppa2.0n ;;
64) HP_ARCH=hppa2.0w ;;
'') HP_ARCH=hppa2.0 ;; # HP-UX 10.20
esac ;;
esac
fi
@ -677,11 +687,11 @@ EOF
exit (0);
}
EOF
(CCOPTS= $CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null) && HP_ARCH=`$dummy`
(CCOPTS="" $CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null) && HP_ARCH=`$dummy`
test -z "$HP_ARCH" && HP_ARCH=hppa
fi ;;
esac
if [ ${HP_ARCH} = "hppa2.0w" ]
if [ ${HP_ARCH} = hppa2.0w ]
then
eval $set_cc_for_build
@ -694,12 +704,12 @@ EOF
# $ CC_FOR_BUILD="cc +DA2.0w" ./config.guess
# => hppa64-hp-hpux11.23
if echo __LP64__ | (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) |
if echo __LP64__ | (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) |
grep -q __LP64__
then
HP_ARCH="hppa2.0w"
HP_ARCH=hppa2.0w
else
HP_ARCH="hppa64"
HP_ARCH=hppa64
fi
fi
echo ${HP_ARCH}-hp-hpux${HPUX_REV}
@ -804,14 +814,14 @@ EOF
echo craynv-cray-unicosmp${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
exit ;;
F30[01]:UNIX_System_V:*:* | F700:UNIX_System_V:*:*)
FUJITSU_PROC=`uname -m | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
FUJITSU_PROC=`uname -m | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz`
FUJITSU_SYS=`uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///'`
FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'`
echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
exit ;;
5000:UNIX_System_V:4.*:*)
FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
FUJITSU_REL=`echo ${UNAME_RELEASE} | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/ /_/'`
FUJITSU_SYS=`uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///'`
FUJITSU_REL=`echo ${UNAME_RELEASE} | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/ /_/'`
echo "sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
exit ;;
i*86:BSD/386:*:* | i*86:BSD/OS:*:* | *:Ascend\ Embedded/OS:*:*)
@ -893,7 +903,7 @@ EOF
exit ;;
*:GNU/*:*:*)
# other systems with GNU libc and userland
echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr '[A-Z]' '[a-z]'``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-${LIBC}
echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr "[:upper:]" "[:lower:]"``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-${LIBC}
exit ;;
i*86:Minix:*:*)
echo ${UNAME_MACHINE}-pc-minix
@ -916,7 +926,7 @@ EOF
EV68*) UNAME_MACHINE=alphaev68 ;;
esac
objdump --private-headers /bin/sh | grep -q ld.so.1
if test "$?" = 0 ; then LIBC="gnulibc1" ; fi
if test "$?" = 0 ; then LIBC=gnulibc1 ; fi
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
arc:Linux:*:* | arceb:Linux:*:*)
@ -962,6 +972,9 @@ EOF
ia64:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
k1om:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
m32r*:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
@ -987,6 +1000,9 @@ EOF
eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'`
test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; }
;;
mips64el:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
openrisc*:Linux:*:*)
echo or1k-unknown-linux-${LIBC}
exit ;;
@ -1019,6 +1035,9 @@ EOF
ppcle:Linux:*:*)
echo powerpcle-unknown-linux-${LIBC}
exit ;;
riscv32:Linux:*:* | riscv64:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
s390:Linux:*:* | s390x:Linux:*:*)
echo ${UNAME_MACHINE}-ibm-linux-${LIBC}
exit ;;
@ -1038,7 +1057,7 @@ EOF
echo ${UNAME_MACHINE}-dec-linux-${LIBC}
exit ;;
x86_64:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
echo ${UNAME_MACHINE}-pc-linux-${LIBC}
exit ;;
xtensa*:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
@ -1117,7 +1136,7 @@ EOF
# uname -m prints for DJGPP always 'pc', but it prints nothing about
# the processor, so we play safe by assuming i586.
# Note: whatever this is, it MUST be the same as what config.sub
# prints for the "djgpp" host, or else GDB configury will decide that
# prints for the "djgpp" host, or else GDB configure will decide that
# this is a cross-build.
echo i586-pc-msdosdjgpp
exit ;;
@ -1266,6 +1285,9 @@ EOF
SX-8R:SUPER-UX:*:*)
echo sx8r-nec-superux${UNAME_RELEASE}
exit ;;
SX-ACE:SUPER-UX:*:*)
echo sxace-nec-superux${UNAME_RELEASE}
exit ;;
Power*:Rhapsody:*:*)
echo powerpc-apple-rhapsody${UNAME_RELEASE}
exit ;;
@ -1279,9 +1301,9 @@ EOF
UNAME_PROCESSOR=powerpc
fi
if test `echo "$UNAME_RELEASE" | sed -e 's/\..*//'` -le 10 ; then
if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
if [ "$CC_FOR_BUILD" != no_compiler_found ]; then
if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
(CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
(CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
grep IS_64BIT_ARCH >/dev/null
then
case $UNAME_PROCESSOR in
@ -1303,7 +1325,7 @@ EOF
exit ;;
*:procnto*:*:* | *:QNX:[0123456789]*:*)
UNAME_PROCESSOR=`uname -p`
if test "$UNAME_PROCESSOR" = "x86"; then
if test "$UNAME_PROCESSOR" = x86; then
UNAME_PROCESSOR=i386
UNAME_MACHINE=pc
fi
@ -1334,7 +1356,7 @@ EOF
# "uname -m" is not consistent, so use $cputype instead. 386
# is converted to i386 for consistency with other x86
# operating systems.
if test "$cputype" = "386"; then
if test "$cputype" = 386; then
UNAME_MACHINE=i386
else
UNAME_MACHINE="$cputype"
@ -1376,7 +1398,7 @@ EOF
echo i386-pc-xenix
exit ;;
i*86:skyos:*:*)
echo ${UNAME_MACHINE}-pc-skyos`echo ${UNAME_RELEASE}` | sed -e 's/ .*$//'
echo ${UNAME_MACHINE}-pc-skyos`echo ${UNAME_RELEASE} | sed -e 's/ .*$//'`
exit ;;
i*86:rdos:*:*)
echo ${UNAME_MACHINE}-pc-rdos
@ -1387,23 +1409,25 @@ EOF
x86_64:VMkernel:*:*)
echo ${UNAME_MACHINE}-unknown-esx
exit ;;
amd64:Isilon\ OneFS:*:*)
echo x86_64-unknown-onefs
exit ;;
esac
cat >&2 <<EOF
$0: unable to guess system type
This script, last modified $timestamp, has failed to recognize
the operating system you are using. It is advised that you
download the most up to date version of the config scripts from
This script (version $timestamp), has failed to recognize the
operating system you are using. If your script is old, overwrite
config.guess and config.sub with the latest versions from:
http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD
http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess
and
http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD
http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub
If the version you run ($0) is already up to date, please
send the following data and any information you think might be
pertinent to <config-patches@gnu.org> in order to provide the needed
information to handle your system.
If $0 has already been updated, send the following data and any
information you think might be pertinent to config-patches@gnu.org to
provide the necessary information to handle your system.
config.guess timestamp = $timestamp

52
contrib/file/config.sub vendored
View File

@ -1,8 +1,8 @@
#! /bin/sh
# Configuration validation subroutine script.
# Copyright 1992-2015 Free Software Foundation, Inc.
# Copyright 1992-2017 Free Software Foundation, Inc.
timestamp='2015-03-08'
timestamp='2017-01-01'
# This file is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
@ -33,7 +33,7 @@ timestamp='2015-03-08'
# Otherwise, we print the canonical config type on stdout and succeed.
# You can get the latest version of this script from:
# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD
# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub
# This file is supposed to be the same for all GNU packages
# and recognize all the CPU types, system types and aliases
@ -53,8 +53,7 @@ timestamp='2015-03-08'
me=`echo "$0" | sed -e 's,.*/,,'`
usage="\
Usage: $0 [OPTION] CPU-MFR-OPSYS
$0 [OPTION] ALIAS
Usage: $0 [OPTION] CPU-MFR-OPSYS or ALIAS
Canonicalize a configuration name.
@ -68,7 +67,7 @@ Report bugs and patches to <config-patches@gnu.org>."
version="\
GNU config.sub ($timestamp)
Copyright 1992-2015 Free Software Foundation, Inc.
Copyright 1992-2017 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@ -118,7 +117,7 @@ case $maybe_os in
nto-qnx* | linux-gnu* | linux-android* | linux-dietlibc | linux-newlib* | \
linux-musl* | linux-uclibc* | uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | \
knetbsd*-gnu* | netbsd*-gnu* | netbsd*-eabi* | \
kopensolaris*-gnu* | \
kopensolaris*-gnu* | cloudabi*-eabi* | \
storm-chaos* | os2-emx* | rtmk-nova*)
os=-$maybe_os
basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
@ -255,6 +254,7 @@ case $basic_machine in
| arc | arceb \
| arm | arm[bl]e | arme[lb] | armv[2-8] | armv[3-8][lb] | armv7[arm] \
| avr | avr32 \
| ba \
| be32 | be64 \
| bfin \
| c4x | c8051 | clipper \
@ -301,11 +301,12 @@ case $basic_machine in
| open8 | or1k | or1knd | or32 \
| pdp10 | pdp11 | pj | pjl \
| powerpc | powerpc64 | powerpc64le | powerpcle \
| pru \
| pyramid \
| riscv32 | riscv64 \
| rl78 | rx \
| score \
| sh | sh[1234] | sh[24]a | sh[24]aeb | sh[23]e | sh[34]eb | sheb | shbe | shle | sh[1234]le | sh3ele \
| sh | sh[1234] | sh[24]a | sh[24]aeb | sh[23]e | sh[234]eb | sheb | shbe | shle | sh[1234]le | sh3ele \
| sh64 | sh64le \
| sparc | sparc64 | sparc64b | sparc64v | sparc86x | sparclet | sparclite \
| sparcv8 | sparcv9 | sparcv9b | sparcv9v \
@ -376,6 +377,7 @@ case $basic_machine in
| alphapca5[67]-* | alpha64pca5[67]-* | arc-* | arceb-* \
| arm-* | armbe-* | armle-* | armeb-* | armv*-* \
| avr-* | avr32-* \
| ba-* \
| be32-* | be64-* \
| bfin-* | bs2000-* \
| c[123]* | c30-* | [cjt]90-* | c4x-* \
@ -427,13 +429,15 @@ case $basic_machine in
| orion-* \
| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \
| pru-* \
| pyramid-* \
| riscv32-* | riscv64-* \
| rl78-* | romp-* | rs6000-* | rx-* \
| sh-* | sh[1234]-* | sh[24]a-* | sh[24]aeb-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \
| shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \
| sparc-* | sparc64-* | sparc64b-* | sparc64v-* | sparc86x-* | sparclet-* \
| sparclite-* \
| sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | sv1-* | sx?-* \
| sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | sv1-* | sx*-* \
| tahoe-* \
| tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* \
| tile*-* \
@ -518,7 +522,7 @@ case $basic_machine in
basic_machine=i386-pc
os=-aros
;;
asmjs)
asmjs)
basic_machine=asmjs-unknown
;;
aux)
@ -641,6 +645,14 @@ case $basic_machine in
basic_machine=m68k-bull
os=-sysv3
;;
e500v[12])
basic_machine=powerpc-unknown
os=$os"spe"
;;
e500v[12]-*)
basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
os=$os"spe"
;;
ebmon29k)
basic_machine=a29k-amd
os=-ebmon
@ -1020,7 +1032,7 @@ case $basic_machine in
ppc-* | ppcbe-*)
basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
;;
ppcle | powerpclittle | ppc-le | powerpc-little)
ppcle | powerpclittle)
basic_machine=powerpcle-unknown
;;
ppcle-* | powerpclittle-*)
@ -1030,7 +1042,7 @@ case $basic_machine in
;;
ppc64-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'`
;;
ppc64le | powerpc64little | ppc64-le | powerpc64-little)
ppc64le | powerpc64little)
basic_machine=powerpc64le-unknown
;;
ppc64le-* | powerpc64little-*)
@ -1376,18 +1388,18 @@ case $os in
| -hpux* | -unos* | -osf* | -luna* | -dgux* | -auroraux* | -solaris* \
| -sym* | -kopensolaris* | -plan9* \
| -amigaos* | -amigados* | -msdos* | -newsos* | -unicos* | -aof* \
| -aos* | -aros* | -cloudabi* \
| -aos* | -aros* | -cloudabi* | -sortix* \
| -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
| -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \
| -hiux* | -386bsd* | -knetbsd* | -mirbsd* | -netbsd* \
| -bitrig* | -openbsd* | -solidbsd* \
| -bitrig* | -openbsd* | -solidbsd* | -libertybsd* \
| -ekkobsd* | -kfreebsd* | -freebsd* | -riscix* | -lynxos* \
| -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
| -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \
| -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
| -chorusos* | -chorusrdb* | -cegcc* \
| -chorusos* | -chorusrdb* | -cegcc* | -glidix* \
| -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
| -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
| -midipix* | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
| -linux-newlib* | -linux-musl* | -linux-uclibc* \
| -uxpv* | -beos* | -mpeix* | -udk* | -moxiebox* \
| -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
@ -1396,7 +1408,8 @@ case $os in
| -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
| -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
| -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
| -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* | -tirtos*)
| -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* \
| -onefs* | -tirtos* | -phoenix* | -fuchsia* | -redox*)
# Remember, each alternative MUST END IN *, to match a version number.
;;
-qnx*)
@ -1528,6 +1541,8 @@ case $os in
;;
-nacl*)
;;
-ios)
;;
-none)
;;
*)
@ -1623,6 +1638,9 @@ case $basic_machine in
sparc-* | *-sun)
os=-sunos4.1.1
;;
pru-*)
os=-elf
;;
*-be)
os=-beos
;;

20
contrib/file/configure vendored
View File

@ -1,6 +1,6 @@
#! /bin/sh
# Guess values for system-dependent variables and create Makefiles.
# Generated by GNU Autoconf 2.69 for file 5.29.
# Generated by GNU Autoconf 2.69 for file 5.32.
#
# Report bugs to <christos@astron.com>.
#
@ -590,8 +590,8 @@ MAKEFLAGS=
# Identity of this package.
PACKAGE_NAME='file'
PACKAGE_TARNAME='file'
PACKAGE_VERSION='5.29'
PACKAGE_STRING='file 5.29'
PACKAGE_VERSION='5.32'
PACKAGE_STRING='file 5.32'
PACKAGE_BUGREPORT='christos@astron.com'
PACKAGE_URL=''
@ -1328,7 +1328,7 @@ if test "$ac_init_help" = "long"; then
# Omit some internal or obsolete options to make the list less imposing.
# This message is too long to be a string in the A/UX 3.1 sh.
cat <<_ACEOF
\`configure' configures file 5.29 to adapt to many kinds of systems.
\`configure' configures file 5.32 to adapt to many kinds of systems.
Usage: $0 [OPTION]... [VAR=VALUE]...
@ -1398,7 +1398,7 @@ fi
if test -n "$ac_init_help"; then
case $ac_init_help in
short | recursive ) echo "Configuration of file 5.29:";;
short | recursive ) echo "Configuration of file 5.32:";;
esac
cat <<\_ACEOF
@ -1509,7 +1509,7 @@ fi
test -n "$ac_init_help" && exit $ac_status
if $ac_init_version; then
cat <<\_ACEOF
file configure 5.29
file configure 5.32
generated by GNU Autoconf 2.69
Copyright (C) 2012 Free Software Foundation, Inc.
@ -2165,7 +2165,7 @@ cat >config.log <<_ACEOF
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
It was created by file $as_me 5.29, which was
It was created by file $as_me 5.32, which was
generated by GNU Autoconf 2.69. Invocation command line was
$ $0 $@
@ -3031,7 +3031,7 @@ fi
# Define the identity of the package.
PACKAGE='file'
VERSION='5.29'
VERSION='5.32'
cat >>confdefs.h <<_ACEOF
@ -15075,7 +15075,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
# report actual input values of CONFIG_FILES etc. instead of their
# values after options handling.
ac_log="
This file was extended by file $as_me 5.29, which was
This file was extended by file $as_me 5.32, which was
generated by GNU Autoconf 2.69. Invocation command line was
CONFIG_FILES = $CONFIG_FILES
@ -15141,7 +15141,7 @@ _ACEOF
cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
ac_cs_version="\\
file config.status 5.29
file config.status 5.32
configured by $0, generated by GNU Autoconf 2.69,
with options \\"\$ac_cs_config\\"

2
contrib/file/configure.ac
View File

@ -1,5 +1,5 @@
dnl Process this file with autoconf to produce a configure script.
AC_INIT([file],[5.29],[christos@astron.com])
AC_INIT([file],[5.32],[christos@astron.com])
AM_INIT_AUTOMAKE([subdir-objects foreign])
m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])

21
contrib/file/doc/file.man
View File

@ -1,4 +1,4 @@
.\" $File: file.man,v 1.124 2016/10/19 20:52:45 christos Exp $
.\" $File: file.man,v 1.125 2017/01/03 11:24:46 christos Exp $
.Dd October 19, 2016
.Dt FILE __CSECTION__
.Os
@ -238,8 +238,8 @@ or at least one filename argument must be present;
to test the standard input, use
.Sq -
as a filename argument.
Please note that
.Ar namefile
Please note that
.Ar namefile
is unwrapped and the enclosed filenames are processed when this option is
encountered and before any further options processing is done.
This allows one to process multiple lists of files with different command line
@ -411,10 +411,10 @@ and
.Fl h
options.
.Sh SEE ALSO
.Xr magic __FSECTION__ ,
.Xr hexdump 1 ,
.Xr od 1 ,
.Xr strings 1 ,
.Xr magic __FSECTION__ ,
.Xr fstyp 8
.Sh STANDARDS CONFORMANCE
This program is believed to exceed the System V Interface Definition
@ -531,16 +531,15 @@ John Gilmore revised the code extensively, making it better than
the first version.
Geoff Collyer found several inadequacies
and provided some magic file entries.
Contributions by the
Contributions of the
.Sq \*[Am]
operator by Rob McMahon,
.Aq cudcv@warwick.ac.uk ,
1989.
.Pp
Guy Harris,
Guy Harris,
.Aq guy@netapp.com ,
made many changes from 1993 to the present.
1989.
.Pp
Primary development and maintenance from 1990 to the present by
Christos Zoulas
@ -588,7 +587,6 @@ program, and are not covered by the above license.
.Nm
returns 0 on success, and non-zero on error.
.Sh BUGS
.Pp
Please report bugs and send patches to the bug tracker at
.Pa http://bugs.gw.com/
or the mailing list at
@ -597,7 +595,6 @@ or the mailing list at
.Pa http://mx.gw.com/mailman/listinfo/file
first to subscribe).
.Sh TODO
.Pp
Fix output so that tests for MIME and APPLE flags are not needed all
over the place, and actual output is only done in one place.
This needs a design.
@ -646,16 +643,16 @@ Fix
.Dq name
and
.Dq use
to check for consistency at compile time (duplicate
to check for consistency at compile time (duplicate
.Dq name ,
.Dq use
pointing to undefined
.Dq name
).
Make
Make
.Dq name
/
.Dq use
.Dq use
more efficient by keeping a sorted list of names.
Special-case ^ to flip endianness in the parser so that it does not
have to be escaped, and document it.

13
contrib/file/doc/libmagic.man
View File

@ -1,4 +1,4 @@
.\" $File: libmagic.man,v 1.40 2016/03/31 17:51:12 christos Exp $
.\" $File: libmagic.man,v 1.41 2017/05/23 21:54:07 christos Exp $
.\"
.\" Copyright (c) Christos Zoulas 2003.
.\" All Rights Reserved.
@ -25,7 +25,7 @@
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.Dd September 11, 2015
.Dd May 23, 2017
.Dt LIBMAGIC 3
.Os
.Sh NAME
@ -35,6 +35,7 @@
.Nm magic_errno ,
.Nm magic_descriptor ,
.Nm magic_buffer ,
.Nm magic_getflags ,
.Nm magic_setflags ,
.Nm magic_check ,
.Nm magic_compile ,
@ -64,6 +65,8 @@
.Ft const char *
.Fn magic_buffer "magic_t cookie" "const void *buffer" "size_t length"
.Ft int
.Fn magic_getflags "magic_t cookie"
.Ft int
.Fn magic_setflags "magic_t cookie" "int flags"
.Ft int
.Fn magic_check "magic_t cookie" "const char *filename"
@ -206,6 +209,12 @@ argument with
bytes size.
.Pp
The
.Fn magic_getflags
functions returns a value representing current
.Ar flags
set.
.Pp
The
.Fn magic_setflags
function sets the
.Ar flags

32
contrib/file/doc/magic.man
View File

@ -1,5 +1,5 @@
.\" $File: magic.man,v 1.88 2016/07/27 09:42:49 rrt Exp $
.Dd July 20, 2016
.\" $File: magic.man,v 1.91 2017/02/12 15:30:08 christos Exp $
.Dd February 12, 2017
.Dt MAGIC __FSECTION__
.Os
.\" install as magic.4 on USG, magic.5 on V7, Berkeley and Linux systems.
@ -7,7 +7,7 @@
.Nm magic
.Nd file command's magic pattern file
.Sh DESCRIPTION
This manual page documents the format of the magic file as
This manual page documents the format of magic files as
used by the
.Xr file __CSECTION__
command, version __VERSION__.
@ -17,13 +17,19 @@ command identifies the type of a file using,
among other tests,
a test for whether the file contains certain
.Dq "magic patterns" .
The file
.Pa __MAGIC__
specifies what patterns are to be tested for, what message or
The database of these
.Dq "magic patterns"
is usually located in a binary file in
.Pa __MAGIC__.mgc
or a directory of source text magic pattern fragment files in
.Pa __MAGIC__ .
The database specifies what patterns are to be tested for, what message or
MIME type to print if a particular pattern is found,
and additional information to extract from the file.
.Pp
Each line of the file specifies a test to be performed.
The format of the source fragment files that are used to build this database
is as follows:
Each line of a fragment file specifies a test to be performed.
A test compares the data starting at a particular offset
in the file with a byte value, a string or a numeric value.
If the test succeeds, a message is printed.
@ -98,13 +104,13 @@ The following modifiers are supported:
.It B
A byte length (default).
.It H
A 2 byte big endian length.
.It h
A 2 byte big little length.
.It L
A 4 byte big endian length.
.It h
A 2 byte big endian length.
.It L
A 4 byte little endian length.
.It l
A 4 byte big little length.
A 2 byte little endian length.
.It J
The length includes itself in its count.
.El
@ -651,7 +657,7 @@ start of the main indirect offset.
\*[Gt]\*[Gt]\*[Gt]\*[Gt](\*[Am]0xe.l+(-4)) string PK\e3\e4 \eb, ZIP self-extracting archive
.Ed
.Pp
If you have a list of known avalues at a particular continuation level,
If you have a list of known values at a particular continuation level,
and you want to provide a switch-like default case:
.Bd -literal -offset indent
# clear that continuation level match

2
contrib/file/magic/Localstuff
View File

@ -2,6 +2,6 @@
#------------------------------------------------------------------------------
# Localstuff: file(1) magic for locally observed files
#
# $File: Localstuff,v 1.4 2003/03/23 04:17:27 christos Exp $
# $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $
# Add any locally observed files here. Remember:
# text if readable, executable if runnable binary, data if unreadable.

15
contrib/file/magic/Magdir/adventure
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: adventure,v 1.15 2015/09/07 10:03:21 christos Exp $
# $File: adventure,v 1.17 2017/07/03 16:03:40 christos Exp $
# adventure: file(1) magic for Adventure game files
#
# from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
@ -36,11 +36,12 @@
>0 ubyte <9
>>16 belong&0xfe00f0f0 0x3030
>>>0 ubyte < 10
>>>>2 ubeshort < 10
>>>>2 ubeshort x
>>>>>18 regex [0-9][0-9][0-9][0-9][0-9][0-9]
>>>>>>0 ubyte < 10 Infocom (Z-machine %d,
>>>>>>>2 ubeshort < 10 Release %d /
>>>>>>>>18 string >\0 Serial %.6s)
>>>>>>0 ubyte < 10 Infocom (Z-machine %d
>>>>>>>2 ubeshort x \b, Release %d
>>>>>>>>18 string >\0 \b, Serial %.6s
>>>>>>>>18 string x \b)
!:strength + 40
!:mime application/x-zmachine
@ -78,7 +79,7 @@
!:mime application/x-tads
# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
# 2-byte length N, the N-char name of the game file *without* a NUL (darn!),
# "TADS2 save\n\r\032\0" and the interpreter version.
# "TADS2 save\n\r\032\0" and the interpreter version.
0 string TADS2\ save/g TADS
>12 belong !0x0A0D1A00 saved game data, CORRUPTED
>12 belong 0x0A0D1A00
@ -109,7 +110,7 @@
# edited by David Griffith <dave@661.org>
# Danny Milosavljevic <danny.milo@gmx.net>
# These are ADRIFT (adventure game standard) game files, extension .taf
# Checked from source at (http://www.adrift.co/) and various taf files
# Checked from source at (http://www.adrift.co/) and various taf files
# found at the Interactive Fiction Archive (http://ifarchive.org/)
0 belong 0x3C423FC9
>4 belong 0x6A87C2CF Adrift game file version

4
contrib/file/magic/Magdir/amanda
View File

@ -1,9 +1,9 @@
#------------------------------------------------------------------------------
# $File: amanda,v 1.5 2009/09/19 16:28:07 christos Exp $
# $File: amanda,v 1.6 2017/03/17 21:35:28 christos Exp $
# amanda: file(1) magic for amanda file format
#
0 string AMANDA:\ AMANDA
0 string AMANDA:\ AMANDA
>8 string TAPESTART\ DATE tape header file,
>>23 string X
>>>25 string >\ Unused %s

6
contrib/file/magic/Magdir/amigaos
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: amigaos,v 1.15 2012/06/21 01:13:59 christos Exp $
# $File: amigaos,v 1.16 2017/03/17 21:35:28 christos Exp $
# amigaos: file(1) magic for AmigaOS binary formats:
#
@ -11,7 +11,7 @@
0 belong 0x000003e7 AmigaOS object/library data
#
0 beshort 0xe310 Amiga Workbench
>2 beshort 1
>2 beshort 1
>>48 byte 1 disk icon
>>48 byte 2 drawer icon
>>48 byte 3 tool icon
@ -49,7 +49,7 @@
0 string/c @database AmigaGuide file
# Amiga disk types
#
#
0 string RDSK Rigid Disk Block
>160 string x on %.24s
0 string DOS\0 Amiga DOS disk

12
contrib/file/magic/Magdir/android
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------
# $File: android,v 1.9 2016/01/11 21:19:18 christos Exp $
# $File: android,v 1.10 2017/03/17 21:35:28 christos Exp $
# Various android related magic entries
#------------------------------------------------------------
@ -61,9 +61,9 @@
# http://forum.xda-developers.com/showthread.php?t=816449
# Partition Information Table for Samsung's smartphone with Android
# used by flash software Odin
0 ulelong 0x12349876
0 ulelong 0x12349876
# 1st pit entry marker
>0x01C ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000
>0x01C ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000
# minimal 13 and maximal 18 PIT entries found
>>4 ulelong <128 Partition Information Table for Samsung smartphone
>>>4 ulelong x \b, %d entries
@ -109,9 +109,9 @@
0 name PIT-entry
# garbage value implies end of pit entries
>0x00 ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000
>0x00 ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000
# skip empty partition name
>>0x24 ubyte !0
>>0x24 ubyte !0
# partition name
>>>0x24 string >\0 %-.32s
# flags
@ -122,7 +122,7 @@
>>>0x08 ulelong x (0x%x)
# filename
>>>0x44 string >\0 "%-.64s"
#>>>0x18 ulelong >0
#>>>0x18 ulelong >0
# blocksize in 512 byte units ?
#>>>>0x18 ulelong x \b, %db
# partition size in blocks ?

41
contrib/file/magic/Magdir/animation
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: animation,v 1.58 2016/07/03 14:13:11 christos Exp $
# $File: animation,v 1.63 2017/05/26 14:33:07 christos Exp $
# animation: file(1) magic for animation/movie formats
#
# animation formats
@ -34,14 +34,23 @@
!:mime image/jp2
# http://www.ftyps.com/ with local additions
4 string ftyp ISO Media
# http://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/
>8 string XAVC \b, MPEG v4 system, Sony XAVC Codec
>>96 string x \b, Audio "%.4s"
>>118 beshort x at %dHz
>>140 string x \b, Video "%.4s"
>>168 beshort x %d
>>170 beshort x \bx%d
>8 string 3g2 \b, MPEG v4 system, 3GPP2
!:mime video/3gpp2
>>11 byte 4 \b v4 (H.263/AMR GSM 6.10)
>>11 byte 5 \b v5 (H.263/AMR GSM 6.10)
>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10)
>>11 byte a \b C.S0050-0 V1.0
>>11 byte b \b C.S0050-0-A V1.0.0
>>11 byte c \b C.S0050-0-B V1.0
# http://www.3gpp2.org/Public_html/Specs/C.S0050-B_v1.0_070521.pdf
# Section 8.1.1, corresponds to a, b, c
>>11 byte 0x61 \b C.S0050-0 V1.0
>>11 byte 0x62 \b C.S0050-0-A V1.0.0
>>11 byte 0x63 \b C.S0050-0-B V1.0
>8 string 3ge \b, MPEG v4 system, 3GPP
!:mime video/3gpp
>>11 byte 6 \b, Release 6 MBMS Extended Presentations
@ -186,13 +195,13 @@
# MPEG sequences
# Scans for all common MPEG header start codes
0 belong 0x00000001
0 belong 0x00000001
>4 byte&0x1F 0x07 JVT NAL sequence, H.264 video
>>5 byte 66 \b, baseline
>>5 byte 77 \b, main
>>5 byte 88 \b, extended
>>7 byte x \b @ L %u
0 belong&0xFFFFFF00 0x00000100
0 belong&0xFFFFFF00 0x00000100
>3 byte 0xBA MPEG sequence
!:mime video/mpeg
>>4 byte &0x40 \b, v2, program multiplex
@ -493,8 +502,8 @@
# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448
# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE)
# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries
#0 beshort&0xFFFE 0xFFFE
#>2 ubyte&0xF0 >0x0F
#0 beshort&0xFFFE 0xFFFE
#>2 ubyte&0xF0 >0x0F
#>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1
## rate
#>>>2 byte&0xF0 0x10 \b, 32 kbps
@ -566,9 +575,9 @@
# MP2, M2A
0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2
!:mime audio/mpeg
# rate
# rate
>2 byte&0xF0 0x10 \b, 8 kbps
>2 byte&0xF0 0x20 \b, 16 kbps
>2 byte&0xF0 0x20 \b, 16 kbps
>2 byte&0xF0 0x30 \b, 24 kbps
>2 byte&0xF0 0x40 \b, 32 kbps
>2 byte&0xF0 0x50 \b, 40 kbps
@ -636,7 +645,7 @@
# MP3, M25A
0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5
!:mime audio/mpeg
# rate
# rate
>2 byte&0xF0 0x10 \b, 8 kbps
>2 byte&0xF0 0x20 \b, 16 kbps
>2 byte&0xF0 0x30 \b, 24 kbps
@ -855,10 +864,12 @@
# X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd]
# From Michel Briand <michelbriand@free.fr>
0 string/t \<?xml\ version="
!:strength +1
>20 search/1000/cw \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text
!:mime model/x3d
# mimetype from https://www.iana.org/assignments/media-types/model/x3d+xml
# Example http://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d
0 string/w \<?xml\ version=
!:strength + 5
>20 search/1000/w \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text
!:mime model/x3d+xml
#---------------------------------------------------------------------------
# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube

28
contrib/file/magic/Magdir/apache Executable file
View File

@ -0,0 +1,28 @@
#------------------------------------------------------------------------------
# $File: apache,v 1.1 2017/04/11 14:52:15 christos Exp $
# apache: file(1) magic for Apache Big Data formats
# Avro files
0 string Obj Apache Avro
>3 byte x version %d
# ORC files
# Important information is in file footer, which we can't index to :(
0 string ORC Apache ORC
# Parquet files
0 string PAR1 Apache Parquet
# Hive RC files
0 string RCF Apache Hive RC file
>3 byte x version %d
# Sequence files (and the careless first version of RC file)
0 string SEQ
>3 byte <6 Apache Hadoop Sequence file version %d
>3 byte >6 Apache Hadoop Sequence file version %d
>3 byte =6
>>5 string org.apache.hadoop.hive.ql.io.RCFile$KeyBuffer Apache Hive RC file version 0
>>3 default x Apache Hadoop Sequence file version 6

56
contrib/file/magic/Magdir/apple
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: apple,v 1.35 2016/08/17 09:45:13 christos Exp $
# $File: apple,v 1.36 2017/03/17 21:35:28 christos Exp $
# apple: file(1) magic for Apple file formats
#
0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text
@ -67,15 +67,15 @@
# AppleWorks word processor:
# URL: https://en.wikipedia.org/wiki/AppleWorks
# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx
# Update: Joerg Jenderek
# Update: Joerg Jenderek
# NOTE:
# The "O" is really the magic number, but that's so common that it's
# necessary to check the tab stops that follow it to avoid false positives.
# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge
# the newer AppleWorks is from claris with extension CWK
4 string O
4 string O
# test for unused bits of zoom- , paginated-boolean bytes
>84 ubequad ^0x00Fe00000000Fe00
>84 ubequad ^0x00Fe00000000Fe00
# look for tabstop definitions "=" no tab, "|" no tab
# "<" left tab,"^" center tab,">" right tab, "." decimal tab,
# unofficial "!" other , "\x8a" other
@ -92,9 +92,9 @@
!:ext awp
# minimum version needed to read this files. SFMinVers (0 , 30~3.0 )
>>>183 ubyte 30 3.0
>>>183 ubyte !30
>>>183 ubyte !30
>>>>183 ubyte !0 0x%x
# usual tabstop start sequence "=====<"
# usual tabstop start sequence "=====<"
>>>5 string x \b, tabstop ruler "%6.6s"
# tabstop ruler
#>>>5 string >\0 \b, tabstops "%-79s"
@ -105,7 +105,7 @@
# contains any mail-merge commands
>>>92 byte&0x01 >0 \b, with mail merge
# left margin in 1/10 inches ( normally 0 or 10 )
>>>91 ubyte >0
>>>91 ubyte >0
>>>>91 ubyte x \b, %d/10 inch left margin
# AppleWorks database:
@ -140,13 +140,13 @@
# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
#0 belong&0xff00ff 0x80000 Applesoft BASIC program data
0 belong&0x00ff00ff 0x00080000
0 belong&0x00ff00ff 0x00080000
# assuming that line number must be positive
>2 leshort >0 Applesoft BASIC program data, first line number %d
#>2 leshort x \b, first line number %d
# ORCA/EZ assembler:
#
#
# This will not identify ORCA/M source files, since those have
# some sort of date code instead of the two zero bytes at 6 and 7
# XXX Conflicts with ELF
@ -186,18 +186,18 @@
# From Johan Gade.
# These entries are disabled for now until we fix the following issues.
#
# Note there might be some problems with the "VAX COFF executable"
# entry. Note this entry should be placed before the mac filesystem section,
# Note there might be some problems with the "VAX COFF executable"
# entry. Note this entry should be placed before the mac filesystem section,
# particularly the "Apple Partition data" entry.
#
# The intended meaning of these tests is, that the file is only of the
# The intended meaning of these tests is, that the file is only of the
# specified type if both of the lines are correct - i.e. if the first
# line matches and the second doesn't then it is not of that type.
#
#0 long 0x7801730d
#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO)
#
# Note that this entry is recognized correctly by the "Apple Partition
# Note that this entry is recognized correctly by the "Apple Partition
# data" entry - however since this entry is more specific - this
# information seems to be more useful.
#0 long 0x45520200
@ -288,7 +288,7 @@
# Apple disk partition stuff
# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h
# Update: Joerg Jenderek
# Update: Joerg Jenderek
# "ER" is APPLE_DRVR_MAP_MAGIC signature
0 beshort 0x4552
# display Apple Driver Map (strength=50) after Syslinux bootloader (71)
@ -315,7 +315,7 @@
# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
>>10 ubeshort x \b, devid %u
# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso)
>>12 ubelong >0
>>12 ubelong >0
>>>12 ubelong x \b, driver data %u
# number of driver descriptors sbDrvrCount <= 61
# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
@ -327,26 +327,26 @@
# >>500 use apple-driver-map
# number of partitions is always same in every partition (map block count)
#>>0x0204 ubelong x \b, %u partitions
>>0x0204 ubelong >0 \b, contains[@0x200]:
>>0x0204 ubelong >0 \b, contains[@0x200]:
>>>0x0200 use apple-apm
>>0x0204 ubelong >1 \b, contains[@0x400]:
>>0x0204 ubelong >1 \b, contains[@0x400]:
>>>0x0400 use apple-apm
>>0x0204 ubelong >2 \b, contains[@0x600]:
>>0x0204 ubelong >2 \b, contains[@0x600]:
>>>0x0600 use apple-apm
>>0x0204 ubelong >3 \b, contains[@0x800]:
>>0x0204 ubelong >3 \b, contains[@0x800]:
>>>0x0800 use apple-apm
>>0x0204 ubelong >4 \b, contains[@0xA00]:
>>0x0204 ubelong >4 \b, contains[@0xA00]:
>>>0x0A00 use apple-apm
>>0x0204 ubelong >5 \b, contains[@0xC00]:
>>0x0204 ubelong >5 \b, contains[@0xC00]:
>>>0x0C00 use apple-apm
>>0x0204 ubelong >6 \b, contains[@0xE00]:
>>0x0204 ubelong >6 \b, contains[@0xE00]:
>>>0x0E00 use apple-apm
>>0x0204 ubelong >7 \b, contains[@0x1000]:
>>0x0204 ubelong >7 \b, contains[@0x1000]:
>>>0x1000 use apple-apm
# display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type)
0 name apple-driver-map
>0 ubequad !0
# descBlock first block of driver
>0 ubequad !0
# descBlock first block of driver
>>0 ubelong x \b, driver start block %u
# descSize driver size in blocks
>>4 ubeshort x \b, size %u
@ -355,11 +355,11 @@
# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
# Reference: http://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h
# Update: Joerg Jenderek
# Update: Joerg Jenderek
# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the
# magic stronger.
# for apple partition map stored as a single file
0 belong 0x504d0000
0 belong 0x504d0000
# to display Apple Partition Map (strength=70) after Syslinux bootloader (71)
#!:strength +0
>0 use apple-apm
@ -417,7 +417,7 @@
0 name appleworks
>0 belong&0x00ffffff 0x07e100 AppleWorks CWK Document
>0 belong&0x00ffffff 0x008803 ClarisWorks CWK Document
>0 default x
>0 default x
>>0 belong x AppleWorks/ClarisWorks CWK Document
>0 byte x \b, version %d
>30 beshort x \b, %d

115
contrib/file/magic/Magdir/archive
View File

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: archive,v 1.103 2016/05/05 17:07:40 christos Exp $
# $File: archive,v 1.108 2017/08/30 13:45:10 christos Exp $
# archive: file(1) magic for archive formats (see also "msdos" for self-
# extracting compressed archives)
#
@ -249,9 +249,9 @@
# URL: http://fileformats.archiveteam.org/wiki/TTComp_archive
# Update: Joerg Jenderek
# GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", others
0 string \0\6
0 string \0\6
# look for first keyword of Panorama database *.pan
>12 search/261 DESIGN
>12 search/261 DESIGN
# skip keyword with low entropy
>12 default x TTComp archive, binary, 4K dictionary
# (version 5.25) labeled the above entry as "TTComp archive data"
@ -447,9 +447,9 @@
0 string SZ\x0a\4 SZip archive data
# XPack DiskImage
# *.XDI updated by Joerg Jenderek Sep 2015
# ftp://ftp.sac.sk/pub/sac/pack/0index.txt
# ftp://ftp.sac.sk/pub/sac/pack/0index.txt
# GRR: this test is still too general as it catches also text files starting with jm
0 string jm
0 string jm
# only found examples with this additional characteristic 2 bytes
>2 string \x2\x4 Xpack DiskImage archive data
#!:ext xdi
@ -462,7 +462,7 @@
# ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip
# created by XPA32.EXE version 1.0.2 for Windows
>0 string xpa\0\1 \b32 archive data
# created by XPACK.COM version 1.67m or 1.67r with short 0x1800
# created by XPACK.COM version 1.67m or 1.67r with short 0x1800
>3 ubeshort !0x0001 \bck archive data
# XPack Single Data
# changed by Joerg Jenderek Sep 2015 back to like in version 5.12
@ -552,7 +552,7 @@
>>0x36 string >\0 fstype %.8s
# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
# Update: Joerg Jenderek
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/LHA_(file_format)
# Reference: http://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html
#
@ -561,14 +561,14 @@
# check 1st character of method id like -lz4- -lh5- or -pm2-
>2 string -
# check 5th character of method id
>>6 string -
>>6 string -
# check header level 0 1 2 3
>>>20 ubyte <4
>>>20 ubyte <4
# check 2nd, 3th and 4th character of method id
>>>>3 regex \^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1) \b
!:mime application/x-lzh-compressed
# creator type "LHA "
!:apple ????LHA
!:apple ????LHA
# display archive type name like "LHa/LZS archive data" or "LArc archive"
>>>>>2 string -lz \b
!:ext lzs
@ -578,7 +578,7 @@
# missing -lz?- with wikipedia names
>>>>>>3 regex \^lz[2378] LArc archive
# display archive type name like "LHa (2.x) archive data"
>>>>>2 string -lh \b
>>>>>2 string -lh \b
# already known -lh0- -lh1- -lh2- -lh3- -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names
>>>>>>3 regex \^lh[01] LHarc 1.x/ARX archive data
# LHice archiver use ".ICE" as name extension instead usual one ".lzh"
@ -614,28 +614,28 @@
# check and display information of lharc header
0 name lharc-header
# header size 0x4 , 0x1b-0x61
>0 ubyte x
>0 ubyte x
# compressed data size != compressed file size
#>7 ulelong x \b, data size %d
# attribute: 0x2~?? 0x10~symlink|target 0x20~normal
# attribute: 0x2~?? 0x10~symlink|target 0x20~normal
#>19 ubyte x \b, 19_0x%x
# level identifier 0 1 2 3
#>20 ubyte x \b, level %d
# time stamp
#>15 ubelong x DATE 0x%8.8x
# OS ID for level 1
>20 ubyte 1
>20 ubyte 1
# 0x20 types find for *.rom files
>>(21.b+24) ubyte <0x21 \b, 0x%x OS
# ascii type like M for MSDOS
>>(21.b+24) ubyte >0x20 \b, '%c' OS
# OS ID for level 2
>20 ubyte 2
>20 ubyte 2
#>>23 ubyte x \b, OS ID 0x%x
>>23 ubyte <0x21 \b, 0x%x OS
>>23 ubyte >0x20 \b, '%c' OS
# filename only for level 0 and 1
>20 ubyte <2
>20 ubyte <2
# length of filename
>>21 ubyte >0 \b, with
# filename
@ -643,73 +643,73 @@
#
#2 string -lh0- LHarc 1.x/ARX archive data [lh0]
#!:mime application/x-lharc
2 string -lh0-
2 string -lh0-
>0 use lharc-file
#2 string -lh1- LHarc 1.x/ARX archive data [lh1]
#!:mime application/x-lharc
2 string -lh1-
2 string -lh1-
>0 use lharc-file
# NEW -lz2- ... -lz8-
2 string -lz2-
2 string -lz2-
>0 use lharc-file
2 string -lz3-
2 string -lz3-
>0 use lharc-file
2 string -lz4-
2 string -lz4-
>0 use lharc-file
2 string -lz5-
2 string -lz5-
>0 use lharc-file
2 string -lz7-
2 string -lz7-
>0 use lharc-file
2 string -lz8-
2 string -lz8-
>0 use lharc-file
# [never seen any but the last; -lh4- reported in comp.compression:]
#2 string -lzs- LHa/LZS archive data [lzs]
2 string -lzs-
2 string -lzs-
>0 use lharc-file
# According to wikipedia and others such a version does not exist
#2 string -lh\40- LHa 2.x? archive data [lh ]
#2 string -lhd- LHa 2.x? archive data [lhd]
2 string -lhd-
2 string -lhd-
>0 use lharc-file
#2 string -lh2- LHa 2.x? archive data [lh2]
2 string -lh2-
2 string -lh2-
>0 use lharc-file
#2 string -lh3- LHa 2.x? archive data [lh3]
2 string -lh3-
2 string -lh3-
>0 use lharc-file
#2 string -lh4- LHa (2.x) archive data [lh4]
2 string -lh4-
2 string -lh4-
>0 use lharc-file
#2 string -lh5- LHa (2.x) archive data [lh5]
2 string -lh5-
2 string -lh5-
>0 use lharc-file
#2 string -lh6- LHa (2.x) archive data [lh6]
2 string -lh6-
2 string -lh6-
>0 use lharc-file
#2 string -lh7- LHa (2.x)/LHark archive data [lh7]
2 string -lh7-
2 string -lh7-
# !:mime application/x-lha
# >20 byte x - header level %d
>0 use lharc-file
# NEW -lh8- ... -lhe- , -lhx-
2 string -lh8-
2 string -lh8-
>0 use lharc-file
2 string -lh9-
2 string -lh9-
>0 use lharc-file
2 string -lha-
2 string -lha-
>0 use lharc-file
2 string -lhb-
2 string -lhb-
>0 use lharc-file
2 string -lhc-
2 string -lhc-
>0 use lharc-file
2 string -lhe-
2 string -lhe-
>0 use lharc-file
2 string -lhx-
2 string -lhx-
>0 use lharc-file
# taken from idarc [JW]
2 string -lZ PUT archive data
# already done by LHarc magics
# this should never happen if all sub types of LZS archive are identified
# this should never happen if all sub types of LZS archive are identified
#2 string -lz LZS archive data
2 string -sw1- Swag archive data
@ -908,7 +908,17 @@
>>>4 byte 0x0a \b, at least v1.0 to extract
>>>4 byte 0x0b \b, at least v1.1 to extract
>>>4 byte 0x14 \b, at least v2.0 to extract
>>>4 byte 0x15 \b, at least v2.1 to extract
>>>4 byte 0x19 \b, at least v2.5 to extract
>>>4 byte 0x1b \b, at least v2.7 to extract
>>>4 byte 0x2d \b, at least v4.5 to extract
>>>4 byte 0x2e \b, at least v4.6 to extract
>>>4 byte 0x32 \b, at least v5.0 to extract
>>>4 byte 0x33 \b, at least v5.1 to extract
>>>4 byte 0x34 \b, at least v5.2 to extract
>>>4 byte 0x3d \b, at least v6.1 to extract
>>>4 byte 0x3e \b, at least v6.2 to extract
>>>4 byte 0x3f \b, at least v6.3 to extract
>>>0x161 string WINZIP \b, WinZIP self-extracting
# StarView Metafile
@ -940,17 +950,17 @@
0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data
#
# PMA (CP/M derivative of LHA)
# Update: Joerg Jenderek
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/LHA_(file_format)
#
#2 string -pm0- PMarc archive data [pm0]
2 string -pm0-
2 string -pm0-
>0 use lharc-file
#2 string -pm1- PMarc archive data [pm1]
2 string -pm1-
2 string -pm1-
>0 use lharc-file
#2 string -pm2- PMarc archive data [pm2]
2 string -pm2-
2 string -pm2-
>0 use lharc-file
2 string -pms- PMarc SFX archive (CP/M, DOS)
#!:mime application/x-foobar-exec
@ -1145,12 +1155,12 @@
>3 ubyte 0 \b, no compression
>3 ubyte 2 \b, fast compression (Z1)
>3 ubyte 3 \b, medium compression (Z2)
>3 ubyte >3
>3 ubyte >3
>>3 ubyte <11 \b, compression (Z%d-1)
>2 ubyte&0x08 0x00
>2 ubyte&0x08 0x00
# ~ 30 byte password field only for *.gho
>>12 ubequad !0 \b, password protected
>>44 ubyte !1
>>44 ubyte !1
# 1~Image All, sector-by-sector only for *.gho
>>>10 ubyte 1 \b, sector copy
# 1~Image Boot track only for *.gho
@ -1160,8 +1170,8 @@
# optional image description only *.gho
>>0xff string >\0 "%-.254s"
# look for DOS sector end sequence
>0xE08 search/7776 \x55\xAA
>>&-512 indirect x \b; contains
>0xE08 search/7776 \x55\xAA
>>&-512 indirect x \b; contains
# Google Chrome extensions
# https://developer.chrome.com/extensions/crx
@ -1169,3 +1179,10 @@
0 string Cr24 Google Chrome extension
!:mime application/x-chrome-extension
>4 ulong x \b, version %u
# SeqBox - Sequenced container
# ext: sbx, seqbox
# Marco Pontello marcopon@gmail.com
# reference: https://github.com/MarcoPon/SeqBox
0 string SBx SeqBox,
>3 byte x version %d

4
contrib/file/magic/Magdir/att3b
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: att3b,v 1.9 2014/04/30 21:41:02 christos Exp $
# $File: att3b,v 1.10 2017/03/17 21:35:28 christos Exp $
# att3b: file(1) magic for AT&T 3B machines
#
# The `versions' should be un-commented if they work for you.
@ -36,6 +36,6 @@
#>18 beshort &00040000 and MAU hardware required
#>22 beshort >0 - version %d
#
# core file for 3b2
# core file for 3b2
0 string \000\004\036\212\200 3b2 core file
>364 string >\0 of '%s'

72
contrib/file/magic/Magdir/audio
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: audio,v 1.75 2016/02/08 17:30:11 christos Exp $
# $File: audio,v 1.80 2017/08/13 00:21:47 christos Exp $
# audio: file(1) magic for sound formats (see also "iff")
#
# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
@ -300,7 +300,7 @@
>>5 byte &0x40 \b, extended header
>>5 byte &0x20 \b, experimental
>>5 byte &0x10 \b, footer present
>(6.I+10) indirect x \b, contains:
>(6.I+10) indirect x \b, contains:
# NSF (NES sound file) magic
0 string NESM\x1a NES Sound File
@ -314,7 +314,7 @@
>122 byte&0x1 =0 NTSC
# NSFE (Extended NES sound file) magic
# http://slickproductions.org/docs/NSF/nsfespec.txt
# http://slickproductions.org/docs/NSF/nsfespec.txt
# From: David Pflug <david@pflug.email>
0 string NSFE Extended NES Sound File
>48 search/0x1000 auth
@ -469,6 +469,8 @@
>>20 byte&0xe 0xc \b, 7 channels
>>20 byte&0xe 0xe \b, 8 channels
# some common sample rates
>>17 belong&0xfffff0 0x2ee000 \b, 192 kHz
>>17 belong&0xfffff0 0x158880 \b, 88.2 kHz
>>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz
>>17 belong&0xfffff0 0x0bb800 \b, 48 kHz
>>17 belong&0xfffff0 0x07d000 \b, 32 kHz
@ -658,7 +660,7 @@
# From Fabio R. Schmidlin <frs@pop.com.br>
# VGM music file
0 string Vgm\
0 string Vgm\040
>9 ubyte >0 VGM Video Game Music dump v
>>9 ubyte/16 >0 \b%d
>>9 ubyte&0x0F x \b%d
@ -723,7 +725,7 @@
# URL: http://www.garmin.com/
# Reference: http://turboccc.wikispaces.com/share/view/28622555
# NOTE: there exist 2 other Garmin VPM formats
0 string AUDIMG
0 string AUDIMG
# skip text files starting with string "AUDIMG"
>13 ubyte <13 Garmin Voice Processing Module
!:mime audio/x-vpm-wav-garmin
@ -743,16 +745,68 @@
# second of release (0-59)
>>9 ubyte x \b:%.2d
# if you select a language like german on your garmin device
# you can only select voice modules with correponding language byte ID like 1
# you can only select voice modules with corresponding language byte ID like 1
>>18 ubyte x \b, language ID %d
# pointer to 1st audio WAV sample
>>16 uleshort >0
>>16 uleshort >0
>>>(16.s) ulelong >0 \b, at offset 0x%x
# WAV length
>>>>(16.s+4) ulelong >0 %d Bytes
# look for magic
>>>>>(&-8.l) string RIFF
>>>>>(&-8.l) string RIFF
# determine type by ./riff
>>>>>>&-4 indirect x \b
>>>>>>&-4 indirect x \b
# 2 - ~ 131 WAV samples following same way
# From Martin Mueller Skarbiniks Pedersen
0 string GDM
>0x3 byte 0xFE General Digital Music.
>0x4 string >\0 title: "%s"
>0x24 string >\0 musician: "%s"
>>0x44 beshort 0x0D0A
>>>0x46 byte 0x1A
>>>>0x47 string GMFS Version
>>>>0x4B byte x %d.
>>>>0x4C byte x \b%02d
>>>>0x4D beshort 0x000 (2GDM v
>>>>0x4F byte x \b%d.
>>>>>0x50 byte x \b%d)
0 string MTM Multitracker
>0x3 byte/16 x Version %d.
>0x3 byte&0x0F x \b%02d
>>0x4 string >\0 title: "%s"
0 string HVL
>3 byte <2 Hively Tracker Song
>3 byte 0 1 module data
>3 byte 1 2 module data
0 string MO3
>3 ubyte <6 MOdule with MP3
>>3 byte 0 Version 0 (With MP3 and lossless)
>>3 byte 1 Version 1 (With ogg and lossless)
>>3 byte 3 Version 2.2
>>3 byte 4 (With no LAME header)
>>3 byte 5 Version 2.4
0 string ADRVPACK AProSys module
# ftp://ftp.modland.com/pub/documents/format_documentation/\
# Art%20Of%20Noise%20(.aon).txt
0 string AON
>4 string "ArtOfNoise by Bastian Spiegel(twice/lego)"
>0x2e string NAME Art of Noise Tracker Song
>3 string <9
>3 string 4 (4 voices)
>3 string 8 (8 voices)
>>0x36 string >\0 Title: "%s"
0 string FAR
>0x2c byte 0x0d
>0x2d byte 0x0a
>0x2e byte 0x1a
>>0x3 byte 0xFE Farandole Tracker Song
>>>0x31 byte/16 x Version %d.
>>>0x31 byte&0x0F x \b%02d
>>>>0x4 string >\0 \b, title: "%s"

10
contrib/file/magic/Magdir/bhl Normal file
View File

@ -0,0 +1,10 @@
#------------------------------------------------------------------------------
# $File: bhl,v 1.1 2017/06/11 22:20:02 christos Exp $
# BlockHashLoc
# ext: bhl
# Marco Pontello marcopon@gmail.com
# reference: https://github.com/MarcoPon/BlockHashLoc
0 string BlockHashLoc\x1a BlockHashLoc recovery info,
>13 byte x version %d
!:ext bhl

4
contrib/file/magic/Magdir/blackberry
View File

@ -1,8 +1,8 @@
#------------------------------------------------------------------------------
# $File: blackberry,v 1.1 2014/01/31 01:51:32 christos Exp $
# $File: blackberry,v 1.2 2017/03/17 21:35:28 christos Exp $
# blackberry: file(1) magic for BlackBerry file formats
#
5 belong 0
5 belong 0
>8 belong 010010010 BlackBerry RIM ETP file
>>22 string x \b for %s

6
contrib/file/magic/Magdir/blender
View File

@ -1,11 +1,11 @@
#------------------------------------------------------------------------------
# $File: blender,v 1.6 2014/08/30 08:34:17 christos Exp $
# $File: blender,v 1.7 2017/03/17 21:35:28 christos Exp $
# blender: file(1) magic for Blender 3D related files
#
# Native format rule v1.2. For questions use the developers list
# Native format rule v1.2. For questions use the developers list
# http://lists.blender.org/mailman/listinfo/bf-committers
# GLOB chunk was moved near start and provides subversion info since 2.42
# GLOB chunk was moved near start and provides subversion info since 2.42
0 string =BLENDER Blender3D,
>7 string =_ saved as 32-bits

61
contrib/file/magic/Magdir/c-lang
View File

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: c-lang,v 1.24 2016/07/01 23:31:13 christos Exp $
# $File: c-lang,v 1.26 2017/08/14 07:40:38 christos Exp $
# c-lang: file(1) magic for C and related languages programs
#
# The strength is to beat standard HTML
@ -11,49 +11,72 @@
!:mime text/x-bcpl
# C
0 regex \^#include C source text
!:strength +25
# Check for class if include is found, otherwise class is beaten by include becouse of lowered strength
0 regex \^#include C
>0 regex \^class[[:space:]]+
>>&0 regex \\{[\.\*]\\}(;)?$ \b++
>&0 clear x source text
!:strength + 13
!:mime text/x-c
0 regex \^char[\ \t\n]+ C source text
0 regex \^#[[:space:]]*pragma C source text
!:mime text/x-c
0 regex \^double[\ \t\n]+ C source text
0 regex \^#[[:space:]]*(if\|ifn)def
>&0 regex \^#[[:space:]]*endif$ C source text
!:mime text/x-c
0 regex \^extern[\ \t\n]+ C source text
0 regex \^#[[:space:]]*(if\|ifn)def
>&0 regex \^#[[:space:]]*define C source text
!:mime text/x-c
0 regex \^float[\ \t\n]+ C source text
0 regex \^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text
!:mime text/x-c
0 regex \^struct[\ \t\n]+ C source text
0 regex \^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text
!:mime text/x-c
0 regex \^union[\ \t\n]+ C source text
0 regex \^[[:space:]]*extern[[:space:]]+ C source text
!:mime text/x-c
0 search/8192 main( C source text
0 regex \^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text
!:mime text/x-c
0 regex \^struct[[:space:]]+ C source text
!:mime text/x-c
0 regex \^union[[:space:]]+ C source text
!:mime text/x-c
0 search/8192 main(
>&0 regex \\)[[:space:]]*\\{ C source text
!:mime text/x-c
# C++
# The strength of these rules is increased so they beat the C rules above
0 regex \^template[\ \t]+<.*>[\ \t\n]+ C++ source text
0 regex \^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{ C++ source text
!:strength + 30
!:mime text/x-c++
0 regex \^virtual[\ \t\n]+ C++ source text
# using namespace [namespace] or using std::[lib]
0 regex \^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*; C++ source text
!:strength + 30
!:mime text/x-c++
0 regex \^class[\ \t\n]+ C++ source text
# But class is reduced to avoid beating php (Jens Schleusener)
0 regex \^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$ C++ source text
!:strength + 30
!:mime text/x-c++
0 regex \^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$ C++ source text
!:strength + 30
!:mime text/x-c++
# But class alone is reduced to avoid beating php (Jens Schleusener)
0 regex \^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$ C++ source text
!:strength + 13
!:mime text/x-c++
0 regex \^public: C++ source text
0 regex \^[[:space:]]*public: C++ source text
!:strength + 30
!:mime text/x-c++
0 regex \^private: C++ source text
0 regex \^[[:space:]]*private: C++ source text
!:strength + 30
!:mime text/x-c++
0 regex \^[[:space:]]*protected: C++ source text
!:strength + 30
!:mime text/x-c++
# Objective-C
0 regex \^#import Objective-C source text
!:strength +25
0 regex \^#import Objective-C source text
!:strength + 25
!:mime text/x-objective-c
# From: Mikhail Teterin <mi@aldan.algebra.com>
# From: Mikhail Teterin <mi@aldan.algebra.com>
0 string cscope cscope reference data
>7 string x version %.2s
# We skip the path here, because it is often long (so file will

67
contrib/file/magic/Magdir/cad
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: cad,v 1.13 2014/03/23 18:05:38 christos Exp $
# $File: cad,v 1.15 2017/06/24 15:24:56 christos Exp $
# autocad: file(1) magic for cad files
#
@ -9,7 +9,7 @@
# DGN is the default file extension of Microstation/Intergraph CAD files.
# CIT is the proprietary raster format (similar to TIFF) used to attach
# raster underlays to Microstation DGN (vector) drawings.
#
#
# http://www.wotsit.org/search.asp
# http://filext.com/detaillist.php?extdetail=DGN
# http://filext.com/detaillist.php?extdetail=CIT
@ -42,7 +42,7 @@
>4 string \030\000\000 CITFile
>4 string \030\000\003 CITFile
# AutoCAD
# AutoCAD
# Merge of the different contributions and updates from http://en.wikipedia.org/wiki/Dwg
# and http://www.iana.org/assignments/media-types/image/vnd.dwg
0 string MC0.0 DWG AutoDesk AutoCAD Release 1.0
@ -99,42 +99,42 @@
0 string AC1027 DWG AutoDesk AutoCAD 2013/2014
!:mime image/vnd.dwg
# KOMPAS 2D drawing from ASCON
# KOMPAS 2D drawing from ASCON
# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor
# gathered nor specification
# ASCON http://ascon.net/main/ in English,
# http://ascon.ru/ main site in Russian
# Extension is CDW for drawing and FRW for fragment of drawing
# Extension is CDW for drawing and FRW for fragment of drawing
# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
# ICQ 358572321, http://vkontakte.ru/id16076543)
# From:
# http://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292
# (in russian) and my experiments
0 string KF
>2 belong 0x4E00000C Kompas drawing 12.0 SP1
>2 belong 0x4D00000C Kompas drawing 12.0
>2 belong 0x3200000B Kompas drawing 11.0 SP1
>2 belong 0x3100000B Kompas drawing 11.0
>2 belong 0x2310000A Kompas drawing 10.0 SP1
>2 belong 0x2110000A Kompas drawing 10.0
>2 belong 0x08000009 Kompas drawing 9.0 SP1
>2 belong 0x05000009 Kompas drawing 9.0
>2 belong 0x33010008 Kompas drawing 8+
>2 belong 0x1A000008 Kompas drawing 8.0
>2 belong 0x2C010107 Kompas drawing 7+
>2 belong 0x05000007 Kompas drawing 7.0
>2 belong 0x32000006 Kompas drawing 6+
>2 belong 0x09000006 Kompas drawing 6.0
>2 belong 0x5C009005 Kompas drawing 5.11R03
>2 belong 0x54009005 Kompas drawing 5.11R02
>2 belong 0x51009005 Kompas drawing 5.11R01
>2 belong 0x22009005 Kompas drawing 5.10R03
>2 belong 0x22009005 Kompas drawing 5.10R02 mar
>2 belong 0x21009005 Kompas drawing 5.10R02 febr
>2 belong 0x19009005 Kompas drawing 5.10R01
>2 belong 0xF4008005 Kompas drawing 5.9R01.003
>2 belong 0x1C008005 Kompas drawing 5.9R01.002
>2 belong 0x11008005 Kompas drawing 5.8R01.003
>2 belong 0x4E00000C Kompas drawing 12.0 SP1
>2 belong 0x4D00000C Kompas drawing 12.0
>2 belong 0x3200000B Kompas drawing 11.0 SP1
>2 belong 0x3100000B Kompas drawing 11.0
>2 belong 0x2310000A Kompas drawing 10.0 SP1
>2 belong 0x2110000A Kompas drawing 10.0
>2 belong 0x08000009 Kompas drawing 9.0 SP1
>2 belong 0x05000009 Kompas drawing 9.0
>2 belong 0x33010008 Kompas drawing 8+
>2 belong 0x1A000008 Kompas drawing 8.0
>2 belong 0x2C010107 Kompas drawing 7+
>2 belong 0x05000007 Kompas drawing 7.0
>2 belong 0x32000006 Kompas drawing 6+
>2 belong 0x09000006 Kompas drawing 6.0
>2 belong 0x5C009005 Kompas drawing 5.11R03
>2 belong 0x54009005 Kompas drawing 5.11R02
>2 belong 0x51009005 Kompas drawing 5.11R01
>2 belong 0x22009005 Kompas drawing 5.10R03
>2 belong 0x22009005 Kompas drawing 5.10R02 mar
>2 belong 0x21009005 Kompas drawing 5.10R02 febr
>2 belong 0x19009005 Kompas drawing 5.10R01
>2 belong 0xF4008005 Kompas drawing 5.9R01.003
>2 belong 0x1C008005 Kompas drawing 5.9R01.002
>2 belong 0x11008005 Kompas drawing 5.8R01.003
# CAD: file(1) magic for computer aided design files
# Phillip Griffith <phillip dot griffith at gmail dot com>
@ -147,8 +147,13 @@
>0x02 byte 0xfe
>>0x04 beshort 0x1800 CIT raster CAD
# 3DS (3d Studio files) Conflicts with diff output 0x3d '='
#16 beshort 0x3d3d image/x-3ds
# 3DS (3d Studio files)
0 leshort 0x4d4d
>6 leshort 0x2
>>8 lelong 0xa
>>>16 leshort 0x3d3d 3D Studio model
!:mime image/x-3ds
!:extension 3ds
# MegaCAD 2D/3D drawing (.prt)
# http://megacad.de/

8
contrib/file/magic/Magdir/cafebabe
View File

@ -1,14 +1,14 @@
#------------------------------------------------------------------------------
# $File: cafebabe,v 1.21 2015/10/15 20:56:51 christos Exp $
# $File: cafebabe,v 1.23 2017/05/25 20:07:23 christos Exp $
# Cafe Babes unite!
#
# Since Java bytecode and Mach-O universal binaries have the same magic number,
# the test must be performed in the same "magic" sequence to get both right.
# The long at offset 4 in a Mach-O universal binary tells the number of
# architectures; the short at offset 4 in a Java bytecode file is the JVM minor
# version and the short at offset 6 is the JVM major version. Since there are only
# only 18 labeled Mach-O architectures at current, and the first released
# version and the short at offset 6 is the JVM major version. Since there are only
# only 18 labeled Mach-O architectures at current, and the first released
# Java class format was version 43.0, we can safely choose any number
# between 18 and 39 to test the number of architectures against
# (and use as a hack). Let's not use 18, because the Mach-O people
@ -47,7 +47,7 @@
0 name mach-o \b [
>0 use mach-o-cpu \b
>(8.L) indirect \b:
>(8.L) indirect x \b:
>0 belong x \b]
0 belong 0xcafebabe

8
contrib/file/magic/Magdir/clipper
View File

@ -1,13 +1,13 @@
#------------------------------------------------------------------------------
# $File: clipper,v 1.7 2014/04/30 21:41:02 christos Exp $
# $File: clipper,v 1.8 2017/03/17 21:35:28 christos Exp $
# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper.
#
# XXX - what byte order does the Clipper use?
#
# XXX - what's the "!" stuff:
#
# >18 short !074000,000000 C1 R1
# >18 short !074000,000000 C1 R1
# >18 short !074000,004000 C2 R1
# >18 short !074000,010000 C3 R1
# >18 short !074000,074000 TEST
@ -15,7 +15,7 @@
# I shall assume it's ANDing the field with the first value and
# comparing it with the second, and rewrite it as:
#
# >18 short&074000 000000 C1 R1
# >18 short&074000 000000 C1 R1
# >18 short&074000 004000 C2 R1
# >18 short&074000 010000 C3 R1
# >18 short&074000 074000 TEST
@ -37,7 +37,7 @@
>12 long >0 not stripped
>22 short >0 - version %d
0 short 0577 CLIPPER COFF executable
>18 short&074000 000000 C1 R1
>18 short&074000 000000 C1 R1
>18 short&074000 004000 C2 R1
>18 short&074000 010000 C3 R1
>18 short&074000 074000 TEST

12
contrib/file/magic/Magdir/coff
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: coff,v 1.1 2015/09/30 20:32:35 christos Exp $
# $File: coff,v 1.2 2017/03/17 21:35:28 christos Exp $
# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures
#
# COFF
@ -15,7 +15,7 @@
# mips,motorola,msdos,osf1,sharc,varied.out,vax
0 name display-coff
# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
>18 uleshort&0x8E80 0
>18 uleshort&0x8E80 0
>>0 clear x
# f_magic - magic number
# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel)
@ -25,7 +25,7 @@
# Hitachi SH little-endian COFF (./hitachi-sh)
>>0 uleshort 0x0550 Hitachi SH little-endian
# executable (RISC System/6000 V3.1) or obj module (./ibm6000)
#>>0 uleshort 0x01DF
#>>0 uleshort 0x01DF
# TODO for other COFFs
#>>0 uleshort 0xABCD COFF_TEMPLATE
>>0 default x
@ -45,12 +45,12 @@
>>18 leshort &0x0008 \b, stripped
>>18 leshort ^0x0008 \b, not stripped
# flags in other COFF versions
#0x0010 F_FDPR_PROF
#0x0010 F_FDPR_PROF
#0x0020 F_FDPR_OPTI
#0x0040 F_DSA
# F_AR32WR flag bit
#>>>18 leshort &0x0100 \b, 32 bit little endian
#0x1000 F_DYNLOAD
#0x1000 F_DYNLOAD
#0x2000 F_SHROBJ
#0x4000 F_LOADONLY
# f_nscns - number of sections
@ -62,7 +62,7 @@
>>8 ulelong >0 \b, symbol offset=0x%x
# f_nsyms - number of symbols, only for not stripped
>>12 ulelong >0 \b, %d symbols
# f_opthdr - optional header size
# f_opthdr - optional header size
>>16 uleshort >0 \b, optional header size %d
# at offset 20 can be optional header, extra bytes FILHSZ-20 because
# do not rely on sizeof(FILHDR) to give the correct size for header.

6
contrib/file/magic/Magdir/commands
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: commands,v 1.56 2016/07/14 19:01:12 christos Exp $
# $File: commands,v 1.59 2017/08/14 07:40:38 christos Exp $
# commands: file(1) magic for various shells and interpreters
#
#0 string/w : shell archive or script for antique kernel text
@ -56,7 +56,7 @@
!:mime text/x-awk
0 string/wt #!\ /usr/bin/awk awk script text executable
!:mime text/x-awk
0 regex/4096 =^\\s{0,100}BEGIN\\s{0,100}[{] awk or perl script text
0 regex/4096 =^[\040\t\f\r\n]{0,100}BEGIN[\040\t\f\r\n]{0,100}[{] awk or perl script text
# AT&T Bell Labs' Plan 9 shell
0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable
@ -84,7 +84,7 @@
# PHP scripts
# Ulf Harnhammar <ulfh@update.uu.se>
0 search/1/c =<?php PHP script text
!:strength + 10
!:strength + 30
!:mime text/x-php
0 search/1 =<?\n PHP script text
!:mime text/x-php

6
contrib/file/magic/Magdir/compress
View File

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: compress,v 1.66 2016/09/16 12:12:05 christos Exp $
# $File: compress,v 1.68 2017/05/25 20:07:23 christos Exp $
# compress: file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
@ -223,7 +223,7 @@
# Zstandard/LZ4 skippable frames
# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
0 lelong&0xFFFFFFF0 0x184D2A50
>(4.l+8) indirect
>(4.l+8) indirect x
# Zstandard Dictionary ID subroutine
0 name zstd-dictionary-id
@ -310,7 +310,7 @@
# Zlib https://www.ietf.org/rfc/rfc6713.txt
0 string/b x
>0 beshort%31 =0
>0 beshort%31 =0
>>0 byte&0xf =8
>>>0 byte&0x80 =0 zlib compressed data
!:mime application/zlib

127
contrib/file/magic/Magdir/console
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: console,v 1.26 2016/06/12 15:20:37 christos Exp $
# $File: console,v 1.32 2017/08/13 00:21:47 christos Exp $
# Console game magic
# Toby Deshane <hac@shoelace.digivill.net>
@ -9,17 +9,19 @@
# References:
# - http://wiki.nesdev.com/w/index.php/INES
# - http://wiki.nesdev.com/w/index.php/NES_2.0
0 string NES\x1A iNES ROM image
# Common header for iNES, NES 2.0, and Wii U iNES.
0 name nes-rom-image-ines
>7 byte&0x0C =0x8 (NES 2.0)
>4 byte x \b: %ux16k PRG
>5 byte x \b, %ux16k CHR
>5 byte x \b, %ux8k CHR
>6 byte&0x08 =0x8 [4-Scr]
>6 byte&0x09 =0x0 [H-mirror]
>6 byte&0x09 =0x1 [V-mirror]
>6 byte&0x02 =0x2 [SRAM]
>6 byte&0x04 =0x4 [Trainer]
>7 byte&0x03 =0x2 [PC10]
>7 byte&0x03 =0x1 [VS
>7 byte&0x03 =0x1 [VS]
>>7 byte&0x0C =0x8
# NES 2.0: VS PPU
>>>13 byte&0x0F =0x0 \b, RP2C03B
@ -43,17 +45,24 @@
>>12 byte&0x03 =0x1 [PAL]
>>12 byte&0x02 =0x2 [NTSC+PAL]
# Standard iNES ROM header.
0 string NES\x1A NES ROM image (iNES)
>0 use nes-rom-image-ines
# Wii U Virtual Console iNES ROM header.
0 belong 0x4E455300 NES ROM image (Wii U Virtual Console)
>0 use nes-rom-image-ines
#------------------------------------------------------------------------------
# unif: file(1) magic for UNIF-format Nintendo Entertainment System ROM images
# Reference: http://wiki.nesdev.com/w/index.php/UNIF
# From: David Korth <gerbilsoft@gerbilsoft.com>
# TODO commit on 2016/03/21
#
# NOTE: The UNIF format uses chunks instead of a fixed header,
# so most of the data isn't easily parseable.
#
0 string UNIF
>4 lelong <16 UNIF v%d format NES ROM image
>4 lelong <16 NES ROM image (UNIF v%d format)
#------------------------------------------------------------------------------
# fds: file(1) magic for Famciom Disk System disk images
@ -63,24 +72,39 @@
# Disk info block. (block 1)
0 name nintendo-fds-disk-info-block
>1 string *NINTENDO-HVC* Famicom Disk System disk image:
>23 byte !1 FMC-
>23 byte 1 FSC-
>16 string x \b%.3s
>15 byte x \b, mfr 0x%02X
>15 byte x \b, mfr %02X
>20 byte x (Rev.%02u)
# Headered version.
0 string FDS\x1A
>0x11 string *NINTENDO-HVC*
>0x11 string *NINTENDO-HVC* Famicom Disk System disk image:
>>0x10 use nintendo-fds-disk-info-block
>4 byte 1 (%u side)
>4 byte !1 (%u sides)
# Unheadered version.
1 string *NINTENDO-HVC*
1 string *NINTENDO-HVC* Famicom Disk System disk image:
>0 use nintendo-fds-disk-info-block
#------------------------------------------------------------------------------
# tnes: file(1) magic for TNES-format Nintendo Entertainment System ROM images
# Used by Nintendo 3DS NES Virtual Console games.
# From: David Korth <gerbilsoft@gerbilsoft.com>
#
0 string TNES NES ROM image (Nintendo 3DS Virtual Console)
>4 byte 100 \b: FDS,
>>0x2010 use nintendo-fds-disk-info-block
>4 byte !100 \b: TNES mapper %u
>>5 byte x \b, %ux8k PRG
>>6 byte x \b, %ux8k CHR
>>7 byte&0x08 =1 [WRAM]
>>8 byte&0x09 =1 [H-mirror]
>>8 byte&0x09 =2 [V-mirror]
>>8 byte&0x02 =3 [VRAM]
#------------------------------------------------------------------------------
# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
# Reference: http://gbdev.gg8.se/wiki/articles/The_Cartridge_Header
@ -389,6 +413,15 @@
>0x1E byte x \b, Rev.%02u)
>0x12 byte 2 (DSi enhanced)
>0x12 byte 3 (DSi only)
# Secure Area check.
>0x20 lelong <0x4000 (homebrew)
>0x20 lelong >0x3FFF
>>0x4000 lequad 0x0000000000000000 (multiboot)
>>0x4000 lequad !0x0000000000000000
>>>0x4000 lequad 0xE7FFDEFFE7FFDEFF (decrypted)
>>>0x4000 lequad !0xE7FFDEFFE7FFDEFF
>>>>0x1000 lequad 0x0000000000000000 (encrypted)
>>>>0x1000 lequad !0x0000000000000000 (mask ROM)
#------------------------------------------------------------------------------
# nds_passme: file(1) magic for Nintendo DS ROM images for GBA cartridge boot.
@ -412,7 +445,7 @@
#------------------------------------------------------------------------------
# msx: file(1) magic for MSX game cartridge dumps
# Too simple - MPi
#0 beshort 0x4142 MSX game cartridge dump
#0 beshort 0x4142 MSX game cartridge dump
#------------------------------------------------------------------------------
# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
@ -467,7 +500,7 @@
# Double-check that the image type matches too, 0x8008 conflicts with
# 8 character OMF-86 object file headers.
0 beshort 0x8008
0 beshort 0x8008
>6 string BS93 Lynx homebrew cartridge
>>2 beshort x \b, RAM start $%04x
>6 string LYNX Lynx cartridge
@ -482,7 +515,7 @@
# is the offset 12 or the offset 16 correct?
# GBS (Game Boy Sound) magic
# ftp://ftp.modland.com/pub/documents/format_documentation/\
# Gameboy%20Sound%20System%20(.gbs).txt
# Gameboy%20Sound%20System%20(.gbs).txt
0 string GBS Nintendo Gameboy Music/Audio Data
#12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module
>16 string >\0 ("%s" by
@ -491,6 +524,10 @@
>3 byte x version %d,
>4 byte x %d tracks
# IPS Patch Files from: From: Thomas Klausner <tk@giga.or.at>
# see http://zerosoft.zophar.net/ips.php
0 string PATCH IPS patch file
# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at>
0 string PPF30 Playstation Patch File version 3.0
>5 byte 0 \b, PPF 1.0 patch
@ -518,7 +555,7 @@
# SNES9x .smv "movie" file format.
0 string SMV\x1A SNES9x input recording
>0x4 lelong x \b, version %d
# version 4 is latest so far
# version 4 is latest so far
>0x4 lelong <5
>>0x8 ledate x \b, recorded at %s
>>0xc lelong >0 \b, rerecorded %d times
@ -617,6 +654,52 @@
>0x218 belong 0x5D1C9EA3 Nintendo Wii disc image (WBFS format):
>>0x200 use nintendo-gcn-disc-common
# Type: Nintendo GameCube/Wii disc image (CISO format)
# NOTE: This is NOT the same as Compact ISO or PSP CISO,
# though it has the same magic number.
0 string CISO
# Other fields are used to determine what type of CISO this is:
# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
# - None of the above: Compact ISO.
>4 lelong 0x200000
>>8 byte 1
>>>0x801C belong 0xC2339F3D Nintendo GameCube disc image (CISO format):
>>>>0x8000 use nintendo-gcn-disc-common
>>>0x8018 belong 0x5D1C9EA3 Nintendo Wii disc image (CISO format):
>>>>0x8000 use nintendo-gcn-disc-common
# Type: Nintendo GameCube/Wii disc image (GCZ format)
# Due to zlib compression, we can't get the actual disc information.
0 lelong 0xB10BC001
>4 lelong 0 Nintendo GameCube disc image (GCZ format)
>4 lelong 1 Nintendo Wii disc image (GCZ format)
>4 lelong >1 Nintendo GameCube/Wii disc image (GCZ format)
# Type: Nintendo GameCube/Wii disc image (WDF format)
0 string WII\001DISC
>8 belong 1
# WDFv1
>>0x54 belong 0xC2339F3D Nintendo GameCube disc image (WDFv1 format):
>>>0x38 use nintendo-gcn-disc-common
>>0x58 belong 0x5D1C9EA3 Nintendo Wii disc image (WDFv1 format):
>>>0x38 use nintendo-gcn-disc-common
>8 belong 2
# WDFv2
>>(12.L+0x1C) belong 0xC2339F3D Nintendo GameCube disc image (WDFv2 format):
>>>(12.L) use nintendo-gcn-disc-common
>>(12.L+0x18) belong 0x5D1C9EA3 Nintendo Wii disc image (WDFv2 format):
>>>(12.L) use nintendo-gcn-disc-common
# Type: Nintendo GameCube/Wii disc image (WIA format)
0 string WIA\001 Nintendo
>0x48 belong 0 GameCube/Wii
>0x48 belong 1 GameCube
>0x48 belong 2 Wii
>0x48 belong >2 GameCube/Wii
>0x48 belong x disc image (WIA format):
>>0x58 use nintendo-gcn-disc-common
#------------------------------------------------------------------------------
# Nintendo 3DS file formats.
#
@ -722,7 +805,7 @@
# Type: Nintendo 3DS Homebrew Application.
# From: David Korth <gerbilsoft@gerbilsoft.com>
# Refernece: https://3dbrew.org/wiki/3DSX_Format
# Reference: https://3dbrew.org/wiki/3DSX_Format
0 string 3DSX Nintendo 3DS Homebrew Application (3DSX)
#------------------------------------------------------------------------------
@ -750,3 +833,17 @@
#
0 string g\ GCE Vectrex ROM image
>0x11 string >\0 \b: "%.16s"
#------------------------------------------------------------------------------
# amiibo: file(1) magic for Nintendo amiibo NFC dumps.
# From: David Korth <gerbilsoft@gerbilsoft.com>
# Reference: https://www.3dbrew.org/wiki/Amiibo
0x00 byte 0x04
>0x0A beshort 0x0FE0
>>0x0C belong 0xF110FFEE
>>>0x208 beshort 0x0100
>>>>0x020A byte 0x0F
>>>>>0x020C bequad 0x000000045F000000
>>>>>>0x5B byte 0x02
>>>>>>>0x54 belong x Nintendo amiibo NFC dump - amiibo ID: %08X-
>>>>>>>0x58 belong x \b%08X

6
contrib/file/magic/Magdir/cups
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: cups,v 1.4 2016/10/17 18:51:02 christos Exp $
# $File: cups,v 1.5 2017/03/17 21:35:28 christos Exp $
# Cups: file(1) magic for the cups raster file format
# From: Laurent Martelli <martellilaurent@gmail.com>
# http://www.cups.org/documentation.php/spec-raster.html
@ -39,7 +39,7 @@
>404 lelong 20 ColorSpace=AdobeRGB
# Cups Raster image format, Big Endian
0 string RaS
0 string RaS
>3 string t Cups Raster version 1, Big Endian
>3 string 2 Cups Raster version 2, Big Endian
>3 string 3 Cups Raster version 3, Big Endian
@ -48,7 +48,7 @@
# Cups Raster image format, Little Endian
1 string SaR
1 string SaR
>0 string t Cups Raster version 1, Little Endian
>0 string 2 Cups Raster version 2, Little Endian
>0 string 3 Cups Raster version 3, Little Endian

214
contrib/file/magic/Magdir/database
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: database,v 1.49 2016/06/11 17:01:51 christos Exp $
# $File: database,v 1.52 2017/08/13 00:21:47 christos Exp $
# database: file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
@ -84,7 +84,7 @@
# From Max Bowsher.
12 long 0x00040988 Berkeley DB
>16 long >0 (Log, version %d, native byte-order)
12 belong 0x00040988 Berkeley DB
12 belong 0x00040988 Berkeley DB
>16 belong >0 (Log, version %d, big-endian)
12 lelong 0x00040988 Berkeley DB
>16 lelong >0 (Log, version %d, little-endian)
@ -103,7 +103,7 @@
>>>12 long !0 32bit aligned
>>>>12 bedouble 8.642135e+130 big-endian
>>>>>20 long 0 64bit long
>>>>>20 long !0 32bit long
>>>>>20 long !0 32bit long
>>>>12 ledouble 8.642135e+130 little-endian
>>>>>24 long 0 64bit long
>>>>>24 long !0 32bit long (i386)
@ -128,22 +128,22 @@
# XXX: Weak magic.
# Alex Ott <ott@jet.msk.su>
## Paradox file formats
#2 leshort 0x0800 Paradox
#>0x39 byte 3 v. 3.0
#>0x39 byte 4 v. 3.5
#>0x39 byte 9 v. 4.x
#>0x39 byte 10 v. 5.x
#>0x39 byte 11 v. 5.x
#>0x39 byte 12 v. 7.x
#>>0x04 byte 0 indexed .DB data file
#>>0x04 byte 1 primary index .PX file
#>>0x04 byte 2 non-indexed .DB data file
#>>0x04 byte 3 non-incrementing secondary index .Xnn file
#>>0x04 byte 4 secondary index .Ynn file
#>>0x04 byte 5 incrementing secondary index .Xnn file
#>>0x04 byte 6 non-incrementing secondary index .XGn file
#>>0x04 byte 7 secondary index .YGn file
#>>>0x04 byte 8 incrementing secondary index .XGn file
#2 leshort 0x0800 Paradox
#>0x39 byte 3 v. 3.0
#>0x39 byte 4 v. 3.5
#>0x39 byte 9 v. 4.x
#>0x39 byte 10 v. 5.x
#>0x39 byte 11 v. 5.x
#>0x39 byte 12 v. 7.x
#>>0x04 byte 0 indexed .DB data file
#>>0x04 byte 1 primary index .PX file
#>>0x04 byte 2 non-indexed .DB data file
#>>0x04 byte 3 non-incrementing secondary index .Xnn file
#>>0x04 byte 4 secondary index .Ynn file
#>>0x04 byte 5 incrementing secondary index .Xnn file
#>>0x04 byte 6 non-incrementing secondary index .XGn file
#>>0x04 byte 7 secondary index .YGn file
#>>>0x04 byte 8 incrementing secondary index .XGn file
## XBase database files
# updated by Joerg Jenderek at Feb 2013
@ -151,33 +151,33 @@
# http://www.clicketyclick.dk/databases/xbase/format/dbf.html
# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm
# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
0 ubelong&0x0000FFFF <0x00000C20
0 ubelong&0x0000FFFF <0x00000C20
# skip Infocom game Z-machine
>2 ubyte >0
>2 ubyte >0
# skip Androids *.xml
>>3 ubyte >0
>>>3 ubyte <32
>>3 ubyte >0
>>>3 ubyte <32
# 1 < version VV
>>>>0 ubyte >1
>>>>0 ubyte >1
# skip HELP.CA3 by test for reserved byte ( NULL )
>>>>>27 ubyte 0
>>>>>27 ubyte 0
# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
#>>>>>30 ubeshort x 30NULL?%x
# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
>>>>>>24 ubelong&0xffFFFFff >0x01302000
# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
>>>>>>24 ubelong&0xffFFFFff >0x01302000
# .DBF or .MDX
>>>>>>24 ubelong&0xffFFFFff <0x01302001
>>>>>>24 ubelong&0xffFFFFff <0x01302001
# for Xbase Database file (*.DBF) reserved (NULL) for multi-user
>>>>>>>24 ubelong&0xffFFFFff =0
>>>>>>>24 ubelong&0xffFFFFff =0
# test for 2 reserved NULL bytes,transaction and encryption byte flag
>>>>>>>>12 ubelong&0xFFFFfEfE 0
>>>>>>>>12 ubelong&0xFFFFfEfE 0
# test for MDX flag
>>>>>>>>>28 ubyte x
>>>>>>>>>28 ubyte&0xf8 0
>>>>>>>>>28 ubyte x
>>>>>>>>>28 ubyte&0xf8 0
# header size >= 32
>>>>>>>>>>8 uleshort >31
>>>>>>>>>>8 uleshort >31
# skip PIC15736.PCX by test for language driver name or field name
>>>>>>>>>>>32 ubyte >0
>>>>>>>>>>>32 ubyte >0
#!:mime application/x-dbf; charset=unknown-8bit ??
#!:mime application/x-dbase
>>>>>>>>>>>>0 use xbase-type
@ -202,22 +202,22 @@
>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT
>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer
# 1st record offset + 1 = header size
>>>>>>>>>>>>8 uleshort >0
>>>>>>>>>>>>(8.s+1) ubyte >0
>>>>>>>>>>>>8 uleshort >0
>>>>>>>>>>>>(8.s+1) ubyte >0
>>>>>>>>>>>>>8 uleshort >0 \b, at offset %d
>>>>>>>>>>>>>(8.s+1) ubyte >0
>>>>>>>>>>>>>(8.s+1) ubyte >0
>>>>>>>>>>>>>>&-1 string >\0 1st record "%s"
# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL)
>>>>>>>24 ubelong&0x0133f7ff >0
# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
>>>>>>>24 ubelong&0x0133f7ff >0
# test for reserved NULL byte
>>>>>>>>47 ubyte 0
>>>>>>>>47 ubyte 0
# test for valid TAG key format (0x10 or 0)
>>>>>>>>>559 ubyte&0xeF 0
>>>>>>>>>559 ubyte&0xeF 0
# test MM <= 12
>>>>>>>>>>45 ubeshort <0x0C20
>>>>>>>>>>>45 ubyte >0
>>>>>>>>>>>>46 ubyte <32
>>>>>>>>>>>>>46 ubyte >0
>>>>>>>>>>45 ubeshort <0x0C20
>>>>>>>>>>>45 ubyte >0
>>>>>>>>>>>>46 ubyte <32
>>>>>>>>>>>>>46 ubyte >0
#!:mime application/x-mdx
>>>>>>>>>>>>>>0 use xbase-type
>>>>>>>>>>>>>>0 ubyte x \b MDX
@ -236,11 +236,11 @@
# 2nd tag name
#>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s"
#
# Print the xBase names of different version variants
# Print the xBase names of different version variants
0 name xbase-type
>0 ubyte <2
>0 ubyte <2
# 1 < version
>0 ubyte >1
>0 ubyte >1
>>0 ubyte 0x02 FoxBase
# FoxBase+/dBaseIII+, no memo
>>0 ubyte 0x03 FoxBase+/dBase III
@ -293,7 +293,7 @@
# dBASE IV with SQL table, with memo .DBT
>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT
!:mime application/x-dbf
# HiPer-Six format;Clipper SIX, with SMT memo file
# HiPer-Six format;Clipper SIX, with SMT memo file
>>0 ubyte 0xE5 Clipper SIX with memo
!:mime application/x-dbf
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
@ -318,12 +318,12 @@
# test and print the date of xBase .DBF .MDX
0 name xbase-date
# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
>0 ubelong x
>1 ubyte <13
>>1 ubyte >0
>>>2 ubyte >0
>>>>2 ubyte <32
>>>>>0 ubyte x
>0 ubelong x
>1 ubyte <13
>>1 ubyte >0
>>>2 ubyte >0
>>>>2 ubyte <32
>>>>>0 ubyte x
# YY is interpreted as 20YY or 19YY
>>>>>>0 ubyte <100 \b %.2d
# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
@ -333,56 +333,56 @@
# dBase memo files .DBT or .FPT
# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
16 ubyte <4
>16 ubyte !2
>>16 ubyte !1
16 ubyte <4
>16 ubyte !2
>>16 ubyte !1
# next free block index is positive
>>>0 ulelong >0
>>>0 ulelong >0
# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
>>>>17 ubelong&0xFFfdFE00 0x00000000
>>>>17 ubelong&0xFFfdFE00 0x00000000
# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
>>>>>20 ubelong&0xFF01209B 0x00000000
>>>>>20 ubelong&0xFF01209B 0x00000000
# dBASE III
>>>>>>16 ubyte 3
>>>>>>16 ubyte 3
# dBASE III DBT
>>>>>>>0 use dbase3-memo-print
# dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage
>>>>>>16 ubyte 0
>>>>>>16 ubyte 0
# unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT , or garbage PCX DBF
>>>>>>>20 uleshort 0
>>>>>>>20 uleshort 0
# FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage
>>>>>>>>8 ulong =0
>>>>>>>>>6 ubeshort >0
>>>>>>>>8 ulong =0
>>>>>>>>>6 ubeshort >0
# skip emacs.PIF
>>>>>>>>>>4 ushort 0
>>>>>>>>>>4 ushort 0
>>>>>>>>>>>0 use foxpro-memo-print
# dBASE III DBT , garbage
>>>>>>>>>6 ubeshort 0
>>>>>>>>>6 ubeshort 0
# skip MM*DD*.bin by test for for reserved NULL byte
>>>>>>>>>>510 ubeshort 0
>>>>>>>>>>510 ubeshort 0
# skip TK-DOS11.img image by looking for memo text
>>>>>>>>>>>512 ubelong <0xfeffff03
>>>>>>>>>>>512 ubelong <0xfeffff03
# skip EFI executables by looking for memo text
>>>>>>>>>>>>512 ubelong >0x1F202020
>>>>>>>>>>>>>513 ubyte >0
>>>>>>>>>>>>512 ubelong >0x1F202020
>>>>>>>>>>>>>513 ubyte >0
# unusual dBASE III DBT like adressen.dbt
>>>>>>>>>>>>>>0 use dbase3-memo-print
# dBASE III DBT like angest.dbt, or garbage PCX DBF
>>>>>>>>8 ubelong !0
>>>>>>>>8 ubelong !0
# skip PCX and some DBF by test for for reserved NULL bytes
>>>>>>>>>510 ubeshort 0
>>>>>>>>>510 ubeshort 0
# skip some DBF by test of invalid version
>>>>>>>>>>0 ubyte >5
>>>>>>>>>>>0 ubyte <48
>>>>>>>>>>0 ubyte >5
>>>>>>>>>>>0 ubyte <48
>>>>>>>>>>>>0 use dbase3-memo-print
# dBASE IV DBT with positive block size
>>>>>>>20 uleshort >0
# dBASE IV DBT with valid block length like 512, 1024
>>>>>>>20 uleshort >0
# dBASE IV DBT with valid block length like 512, 1024
# multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero
>>>>>>>>20 uleshort&0x800f 0
>>>>>>>>20 uleshort&0x800f 0
>>>>>>>>>0 use dbase4-memo-print
# Print the information of dBase III DBT memo file
# Print the information of dBase III DBT memo file
0 name dbase3-memo-print
>0 ubyte x dBase III DBT
# instead 3 as version number 0 for unusual examples like biblio.dbt
@ -395,45 +395,45 @@
>20 uleshort !0 \b, block length %u
# dBase III memo field terminated by \032\032
>512 string >\0 \b, 1st item "%s"
# Print the information of dBase IV DBT memo file
# Print the information of dBase IV DBT memo file
0 name dbase4-memo-print
>0 lelong x dBase IV DBT
!:mime application/x-dbt
!:ext dbt
# 8 character shorted main name of coresponding dBASE IV DBF file
>8 ubelong >0x20000000
>8 ubelong >0x20000000
# skip unusual like for angest.dbt
>>20 uleshort >0
>>20 uleshort >0
>>>8 string >\0 \b of %-.8s.DBF
# value 0 implies 512 as size
#>4 ulelong =0 \b, blocks size %u
# size of blocks not reliable like 0x2020204C in angest.dbt
>4 ulelong !0
>4 ulelong !0
>>4 ulelong&0x0000003f 0 \b, blocks size %u
# dBase IV DBT with positive block length (found 512 , 1024)
>20 uleshort >0 \b, block length %u
# next available block
#>0 lelong =0 \b, next free block index %u
>0 lelong !0 \b, next free block index %u
>20 uleshort >0
>>(20.s) ubelong x
>20 uleshort >0
>>(20.s) ubelong x
>>>&-4 use dbase4-memofield-print
# unusual dBase IV DBT without block length (implies 512 as length)
>20 uleshort =0
>>512 ubelong x
>20 uleshort =0
>>512 ubelong x
>>>&-4 use dbase4-memofield-print
# Print the information of dBase IV memo field
# Print the information of dBase IV memo field
0 name dbase4-memofield-print
# free dBase IV memo field
>0 ubelong !0xFFFF0800
>0 ubelong !0xFFFF0800
>>0 lelong x \b, next free block %u
>>4 lelong x \b, next used block %u
# used dBase IV memo field
>0 ubelong =0xFFFF0800
>0 ubelong =0xFFFF0800
# length of memo field
>>4 lelong x \b, field length %d
>>>8 string >\0 \b, 1st used item "%s"
# Print the information of FoxPro FPT memo file
# Print the information of FoxPro FPT memo file
0 name foxpro-memo-print
>0 belong x FoxPro FPT
# Size of blocks for FoxPro ( 64,256 )
@ -441,14 +441,14 @@
# next available block
#>0 belong =0 \b, next free block index %u
>0 belong !0 \b, next free block index %u
# field type ( 0~picture, 1~memo, 2~object )
# field type ( 0~picture, 1~memo, 2~object )
>512 ubelong <3 \b, field type %u
# length of memo field
>512 ubelong 1
>512 ubelong 1
>>516 belong >0 \b, field length %d
>>>520 string >\0 \b, 1st item "%s"
# TODO:
# TODO:
# DBASE index file *.NDX
# DBASE Compound Index file *.CDX
# dBASE IV Printer Driver *.PRF
@ -465,9 +465,9 @@
# Reference: https://github.com/libyal/libesedb/archive/master.zip
# libesedb-master/documentation/
# Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc
# Note: also known as "JET Blue". Used by numerous Windows components such as
# Note: also known as "JET Blue". Used by numerous Windows components such as
# Windows Search, Mail, Exchange and Active Directory.
4 ubelong 0xefcdab89
4 ubelong 0xefcdab89
# unknown1
>132 ubelong 0 Extensible storage engine
!:mime application/x-ms-ese
@ -497,8 +497,8 @@
# From: Joerg Jenderek
# URL: http://forensicswiki.org/wiki/Windows_Application_Compatibility
# Note: files contain application compatibility fixes, application compatibility modes and application help messages.
8 string sdbf
>7 ubyte 0
8 string sdbf
>7 ubyte 0
# TAG_TYPE_LIST+TAG_INDEXES
>>12 uleshort 0x7802 Windows application compatibility Shim DataBase
# version? 2 3
@ -600,10 +600,10 @@
# Reference: http://www.provue.com/Panorama/
# From: Joerg Jenderek
# NOTE: test only versions 4 and 6.0 with Windows
# length of Panorama database name
5 ubyte >0
# length of Panorama database name
5 ubyte >0
# look after database name for "some" null bits
>(5.B+7) ubelong&0xF3ffF000 0
>(5.B+7) ubelong&0xF3ffF000 0
# look for first keyword
>>&1 search/2 DESIGN Panorama database
#!:mime application/x-panorama-database
@ -622,3 +622,13 @@
# MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de>
0 string MBSTV\040 MUIbase DB
>6 string x version %s
#
# CDB database
0 string NBCDB\012 NetBSD Constant Database
>7 byte x \b, version %d
>8 string x \b, for '%s'
>24 lelong x \b, datasize %d
>28 lelong x \b, entries %d
>32 lelong x \b, index %d
>36 lelong x \b, seed %#x

16
contrib/file/magic/Magdir/der
View File

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: der,v 1.1 2016/01/19 15:07:45 christos Exp $
# $File: der,v 1.2 2017/03/17 21:35:28 christos Exp $
# der: file(1) magic for DER encoded files
#
@ -32,37 +32,37 @@
# Key Pairs
0 der seq
>&0 der int1=00
>&0 der int1=00
>&0 der int65=x
>&0 der int3=010001 DER Encoded Key Pair, 512 bits
0 der seq
>&0 der int1=00
>&0 der int1=00
>&0 der int129=x
>&0 der int3=010001 DER Encoded Key Pair, 1024 bits
0 der seq
>&0 der int1=00
>&0 der int1=00
>&0 der int257=x
>&0 der int3=010001 DER Encoded Key Pair, 2048 bits
0 der seq
>&0 der int1=00
>&0 der int1=00
>&0 der int513=x
>&0 der int3=010001 DER Encoded Key Pair, 4096 bits
0 der seq
>&0 der int1=00
>&0 der int1=00
>&0 der int1025=x
>&0 der int3=010001 DER Encoded Key Pair, 8192 bits
0 der seq
>&0 der int1=00
>&0 der int1=00
>&0 der int2049=x
>&0 der int3=010001 DER Encoded Key Pair, 16k bits
0 der seq
>&0 der int1=00
>&0 der int1=00
>&0 der int4097=x
>&0 der int3=010001 DER Encoded Key Pair, 32k bits

14
contrib/file/magic/Magdir/diff
View File

@ -1,15 +1,15 @@
#------------------------------------------------------------------------------
# $File: diff,v 1.14 2012/09/16 23:08:54 christos Exp $
# $File: diff,v 1.16 2017/03/17 22:20:22 christos Exp $
# diff: file(1) magic for diff(1) output
#
0 search/1 diff\ diff output text
0 search/1 diff\040 diff output text
!:mime text/x-diff
0 search/1 ***\ diff output text
0 search/1 ***\040 diff output text
!:mime text/x-diff
0 search/1 Only\ in\ diff output text
0 search/1 Only\040in\040 diff output text
!:mime text/x-diff
0 search/1 Common\ subdirectories:\ diff output text
0 search/1 Common\040subdirectories:\040 diff output text
!:mime text/x-diff
0 search/1 Index: RCS/CVS diff output text
@ -20,9 +20,9 @@
# unified diff
0 search/4096 ---\
0 search/4096 ---\040
>&0 search/1024 \n
>>&0 search/1 +++\
>>&0 search/1 +++\040
>>>&0 search/1024 \n
>>>>&0 search/1 @@ unified diff output text
!:mime text/x-diff

4
contrib/file/magic/Magdir/dolby
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: dolby,v 1.7 2014/01/08 22:37:23 christos Exp $
# $File: dolby,v 1.8 2017/03/17 21:35:28 christos Exp $
# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
# from http://www.atsc.org/standards/a_52a.pdf
# corrections, additions, etc. are always welcome!
@ -23,7 +23,7 @@
>5 byte&0x07 = 0x04 \b, dialogue (D)
>5 byte&0x07 = 0x05 \b, commentary (C)
>5 byte&0x07 = 0x06 \b, emergency (E)
>5 beshort&0x07e0 0x0720 \b, voiceover (VO)
>5 beshort&0x07e0 0x0720 \b, voiceover (VO)
>5 beshort&0x07e0 >0x0720 \b, karaoke
# acmod
>6 byte&0xe0 = 0x00 1+1 front,

16
contrib/file/magic/Magdir/dump
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: dump,v 1.13 2014/04/30 21:41:02 christos Exp $
# $File: dump,v 1.16 2017/07/22 19:21:02 christos Exp $
# dump: file(1) magic for dump file format--for new and old dump filesystems
#
# We specify both byte orders in order to recognize byte-swapped dumps.
@ -62,23 +62,25 @@
>824 string >\0 Host %s,
>888 belong >0 Flags %x
24 belong 60012 new-fs dump file (big endian),
24 belong 60012 new-fs dump file (big endian),
>0 use new-dump-be
24 belong 60011 old-fs dump file (big endian),
24 belong 60011 old-fs dump file (big endian),
>0 use old-dump-be
24 lelong 60012 new-fs dump file (little endian),
24 lelong 60012 new-fs dump file (little endian),
# to correctly recognize '*.mo' GNU message catalog (little endian)
!:strength - 15
>0 use \^new-dump-be
24 lelong 60011 old-fs dump file (little endian),
24 lelong 60011 old-fs dump file (little endian),
>0 use \^old-dump-be
24 belong 0x19540119 new-fs dump file (ufs2, big endian),
24 belong 0x19540119 new-fs dump file (ufs2, big endian),
>0 use ufs2-dump-be
24 lelong 0x19540119 new-fs dump file (ufs2, little endian),
24 lelong 0x19540119 new-fs dump file (ufs2, little endian),
>0 use \^ufs2-dump-be
18 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness),

6
contrib/file/magic/Magdir/dyadic
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: dyadic,v 1.7 2015/05/27 18:02:48 christos Exp $
# $File: dyadic,v 1.8 2017/03/17 21:35:28 christos Exp $
# Dyadic: file(1) magic for Dyalog APL.
#
# updated by Joerg Jenderek at Oct 2013
@ -10,9 +10,9 @@
# .DIN Dyalog APL Input Table
# .DOT Dyalog APL Output Table
# .DFT Dyalog APL Format File
0 ubeshort&0xFF60 0xaa00
0 ubeshort&0xFF60 0xaa00
# skip biblio.dbt
>1 byte !4
>1 byte !4
# real Dyalog APL have non zero version numbers like 7.3 or 13.4
>>2 ubeshort >0x0000 Dyalog APL
>>>1 byte 0x00 aplcore

6
contrib/file/magic/Magdir/editors
View File

@ -1,7 +1,7 @@
#------------------------------------------------------------------------------
# $File: editors,v 1.10 2016/07/18 17:44:49 christos Exp $
# T602 editor documents
# $File: editors,v 1.11 2017/03/17 21:35:28 christos Exp $
# T602 editor documents
# by David Necas <yeti@physics.muni.cz>
0 string @CT\ T602 document data,
>4 string 0 Kamenicky
@ -9,7 +9,7 @@
>4 string 2 KOI8-CS
>4 string >2 unknown encoding
# Vi IMproved Encrypted file
# Vi IMproved Encrypted file
# by David Necas <yeti@physics.muni.cz>
0 string VimCrypt~ Vim encrypted file data

871
contrib/file/magic/Magdir/filesystems
View File

File diff suppressed because it is too large Load Diff

60
contrib/file/magic/Magdir/flash
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: flash,v 1.11 2014/05/02 00:26:49 christos Exp $
# $File: flash,v 1.14 2017/05/25 20:09:55 christos Exp $
# flash: file(1) magic for Macromedia Flash file format
#
# See
@ -10,23 +10,45 @@
# en/devnet/swf/pdf/swf-file-format-spec.pdf page 27
#
0 name swf-details
>0 string F Macromedia Flash data
!:mime application/x-shockwave-flash
>0 string C Macromedia Flash data (compressed)
!:mime application/x-shockwave-flash
>0 string Z Macromedia Flash data (lzma compressed)
!:mime application/x-shockwave-flash
>3 byte x \b, version %d
0 name swf-details
1 string WS
>4 lelong !0
>>3 byte 255 Suspicious
>>>0 use swf-details
>0 string F
>>8 byte&0xfd 0x08 Macromedia Flash data
!:mime application/x-shockwave-flash
>>>3 byte x \b, version %d
>>8 byte&0xfe 0x10 Macromedia Flash data
!:mime application/x-shockwave-flash
>>>3 byte x \b, version %d
>>8 byte 0x18 Macromedia Flash data
!:mime application/x-shockwave-flash
>>>3 byte x \b, version %d
>>8 beshort&0xff87 0x2000 Macromedia Flash data
!:mime application/x-shockwave-flash
>>>3 byte x \b, version %d
>>8 beshort&0xffe0 0x3000 Macromedia Flash data
!:mime application/x-shockwave-flash
>>>3 byte x \b, version %d
>>8 byte&0x7 0
>>>8 ubyte >0x2f
>>>>9 ubyte <0x20 Macromedia Flash data
!:mime application/x-shockwave-flash
>>>>>3 byte x \b, version %d
>>3 ubyte <32
>>>3 ubyte !0
>>>>0 use swf-details
>0 string C
>>8 byte 0x78 Macromedia Flash data (compressed)
!:mime application/x-shockwave-flash
>>>3 byte x \b, version %d
>0 string Z
>>8 byte 0x5d Macromedia Flash data (lzma compressed)
!:mime application/x-shockwave-flash
>>>3 byte x \b, version %d
1 string WS
>4 ulelong >14
>>3 ubyte !0
>>>0 use swf-details
# From: Cal Peake <cp@absolutedigital.net>
0 string FLV\x01 Macromedia Flash Video
@ -34,7 +56,7 @@
#
# Yosu Gomez
0 string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document
0 string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document
0 string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document
0 string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document
# From Dave Wilson
0 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document
0 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document

196
contrib/file/magic/Magdir/fonts
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: fonts,v 1.33 2016/09/14 01:26:26 christos Exp $
# $File: fonts,v 1.37 2017/06/24 00:39:00 christos Exp $
# fonts: file(1) magic for font data
#
0 search/1 FONT ASCII vfont text
@ -19,17 +19,17 @@
# URL: https://en.wikipedia.org/wiki/PostScript_fonts
# Reference: http://partners.adobe.com/public/developer/en/font/5178.PFM.pdf
# Modified by: Joerg Jenderek
# Note: moved from ./msdos magic
# dfVersion 256=0100h
0 uleshort 0x0100
# Note: moved from ./msdos magic
# dfVersion 256=0100h
0 uleshort 0x0100
# GRR: line above is too general as it catches also TrueType font,
# raw G3 data FAX, WhatsApp encrypted and Panorama database
# dfType 129=0081h
>66 uleshort 0x0081
>66 uleshort 0x0081
# dfVertRes 300=012Ch not needed as additional test
#>>70 uleshort 0x012c
#>>70 uleshort 0x012c
# dfHorizRes 300=012Ch
#>>>72 uleshort 0x012c
#>>>72 uleshort 0x012c
# dfDriverInfo points to postscript information section
>>(101.l) string/c Postscript Printer Font Metrics
# above labeled "PFM data" by ./msdos (version 5.28) or "Adobe Printer Font Metrics" by TrID
@ -40,13 +40,13 @@
# dfCopyright 60 byte null padded Copyright string. uncomment it to get old looking
#>>>6 string >\060 - %-.60s
# dfDriverInfo
>>>139 ulelong >0
>>>139 ulelong >0
# often abbreviated and same as filename
>>>>(139.l) string x %s
# dfSize
>>>2 ulelong x \b, %d bytes
# dfFace 210=D2h 9Eh
>>>105 ulelong >0
>>>105 ulelong >0
# Windows font name
>>>>(105.l) string x \b, %s
# dfItalic
@ -72,7 +72,7 @@
#>104 belong 00000004 X11 SNF font data, MSB first
!:mime application/x-font-sfn
# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX
0 lelong 00000004
0 lelong 00000004
>104 lelong 00000004 X11 SNF font data, LSB first
!:mime application/x-font-sfn
@ -82,27 +82,29 @@
# From: Joerg Jenderek
# URL: http://grub.gibibit.com/New_font_format
# Reference: util/grub-mkfont.c
# include/grub/fontformat.h
# include/grub/fontformat.h
# FONT_FORMAT_SECTION_NAMES_FILE
0 string FILE
0 string FILE
# FONT_FORMAT_PFF2_MAGIC
>8 string PFF2
>8 string PFF2
# leng 4 only at the moment
>>4 ubelong 4
>>4 ubelong 4
# FONT_FORMAT_SECTION_NAMES_FONT_NAME
>>>12 string NAME GRUB2 font
!:mime application/x-font-pf2
!:ext pf2
# length of font_name
>>>>16 ubelong >0
>>>>16 ubelong >0
# font_name
>>>>>20 string >\0 "%-s"
# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
0 string \001fcp X11 Portable Compiled Font data
>12 byte 0x02 \b, LSB first
>12 byte 0x0a \b, MSB first
0 string \001fcp X11 Portable Compiled Font data,
>12 lelong ^0x08 bit: LSB,
>12 lelong &0x08 bit: MSB,
>12 lelong ^0x04 byte: LSB first
>12 lelong &0x04 byte: MSB first
0 string D1.0\015 X11 Speedo font data
#------------------------------------------------------------------------------
@ -134,28 +136,166 @@
>4 beshort >0 version %d
# True Type fonts
0 string \000\001\000\000\000 TrueType font data
!:mime application/x-font-ttf
# Modified by: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/TrueType
# Reference: https://developer.apple.com/fonts/TrueType-Reference-Manual/
#
# sfnt version "typ1" used by some Apple, but no example found
0 string typ1
>0 use sfnt-font
>0 use sfnt-names
# sfnt version "true" used by some Apple
0 string true
>0 use sfnt-font
>0 use sfnt-names
# GRR: below test is too general
# sfnt version often 0x00010000
0 string \000\001\000\000
>0 use sfnt-font
>0 use sfnt-names
# validate and display sfnt font data like number of tables
0 name sfnt-font
# file 5.30 version assumes 00FFh as maximal number of tables
#>4 ubeshort <0x0100
# maximal 27 tables found like in Skia.ttf
# 46 different table names mentioned on Apple specification
# skip 1st sequence of DOS 2 backup with path separator (\~92 or /~47) misinterpreted as table number
>4 ubeshort <47
# skip bad examples with garbage table names like in a5.show HYPERC MAC
# tag names consist of up to four characters padded with spaces at end like
# BASE DSIG OS/2 Zapf acnt glyf cvt vmtx xref ...
>>12 regex/4l \^[A-Za-z][A-Za-z][A-Za-z/][A-Za-z2\ ]
#>>>0 ubelong x \b, sfnt version 0x%x
>>>0 ubelong !0x4f54544f TrueType
!:mime application/font-sfnt
#!:mime font/ttf
!:apple ????tfil
# .ttf for TrueType font
# EUDC.tte created by privat character editor %WINDIR%\system32\eudcedit.exe
!:ext ttf/tte
# sfnt version 4F54544Fh~OTTO
>>>0 ubelong =0x4f54544f OpenType
!:mime application/font-sfnt
#!:mime font/otf
!:apple ????OTTO
!:ext otf
>>>0 ubelong x Font data
# DSIG=44454947h table name implies a digitally signed font
# search range = number of tables * 16 =< maximal number of tables * 16 = 27 * 16 = 432
>>>12 search/432 DSIG \b, digitally signed
>>>4 ubeshort x \b, %d tables
# minimal 9 tables found like in NISC18030.ttf
#>>>4 ubeshort <10 TMIN
#>>>4 ubeshort >24 TBIG
# table directory entries
>>>12 string x \b, 1st "%4.4s"
# search and display 1st name in sfnt font which is often copyright text
# does not work inside font collections
0 name sfnt-names
# search for naming table
>12 search/432/s name
# biggest offset 0x0100bd28 like Windows10 Fonts\simsunb.ttf
#>>>>&8 ubelong >0x0100bd27 BIGGEST OFFSET
>>&8 ubelong >0x00100000
# offset of name table
>>>&-4 ubelong x \b, name offset 0x%x
# GRR: pointer to name table only works if offset ~< FILE_BYTES_MAX = 100000h defined in src\file.h
>>&8 ubelong <0x00100000
>>>&-16 ubelong x
# name table
>>>>(&8.L) ubequad x
# invalid format selector
#>>>>>&-8 ubeshort !0 \b, invalid selector %x
# minimal 3 name records found like in c:\Program Files (x86)\Tesseract-OCR\tessdata\pdf.ttf
# maximal 1227 name records found like in Apple Chancery.ttf
#>>>>>&-6 ubeshort <0x4 mincount
#>>>>>&-6 ubeshort >130 maxcount
>>>>>&-6 ubeshort x \b, %d names
# offset to start of string storage from start of table
#>>>>>&-4 ubeshort x \b, record offset %d
# 1st name record
# string offset from start of storage area
#>>>>>&8 ubeshort x \b, string offset %d
# string length
#>>>>>&6 ubeshort x \b, string length %d
# minimal name string 7 like in c:\Program Files (x86)\Kodi\addons\webinterface.default\lib\video-js\font\VideoJS.ttf
# also found 0 like in SWZCONLN.TTF
#>>>>>&6 ubeshort <8 MIN STRING
# maximal name string 806 like in c:\Windows\Fonts\palabi.ttf
#>>>>>&6 ubeshort >805 MAX STRING
# platform identifier: 0~Apple Unicode, 1~Macintosh, 3~Microsoft
#>>>>>&-2 ubeshort >3 BAD PLATFORM
>>>>>&-2 ubeshort 0 \b, Unicode
>>>>>&-2 ubeshort 1 \b, Macintosh
>>>>>&-2 ubeshort 3 \b, Microsoft
# languageID (0~english Macintosh, 0409h~english Microsoft, ...)
>>>>>&2 ubeshort >0 \b, language 0x%x
# name identifiers
# often 0~copyright, 1~font, 2~font subfamily, 5~version, 13~license, 19~sample, ...
>>>>>&4 ubeshort >0 \b, type %d string
# platform specific encoding:
# 0~undefined character set, 1~UGL set with Unicode, 3~Unicode 2.0 BMP only, 4~Unicode 2.0
#>>>>>&0 ubeshort x \b, %d encoding
>>>>>&0 ubeshort 0
# handle only name string offset 0 because do not know how to add 2 relative offsets
>>>>>>&6 ubeshort 0
>>>>>>>&(&-14.S-18) ubyte !0
# GRR: instead 806 only first MAXstring = 96 characters are displayed as defined in src\file.h
# often copyright string that starts like \251 2006 The Monotype Corporation
>>>>>>>>&-1 string x \b, %-11.96s
# test for unicode string
>>>>>>>&(&-14.S-18) ubyte 0
>>>>>>>>&0 lestring16 x \b, %-11.96s
# unicode encoding
>>>>>&0 ubeshort >0
>>>>>>&6 ubeshort 0
>>>>>>>&(&-14.S-17) lestring16 x \b, %-11.96s
0 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
0 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
# TrueType/OpenType font collections (.ttc)
# URL: https://en.wikipedia.org/wiki/OpenType
# http://www.microsoft.com/typography/otspec/otff.htm
0 string ttcf TrueType font collection data
>4 belong 0x00010000 \b, 1.0
>>8 belong >0 \b, %d fonts
>4 belong 0x00020000 \b, 2.0
>>8 belong >0 \b, %d fonts
# Modified by: Joerg Jenderek
# Note: container for TrueType, OpenType font
0 string ttcf
# skip ASCII text
>4 ubyte 0
# sfnt version often 0x00010000 of 1st table is TrueType
>>(12.L) ubelong !0x4f54544f TrueType
#!:mime font/ttf
!:apple ????tfil
!:ext ttc
# sfnt version 4F54544Fh~OTTO of 1st table is OpenType font
>>(12.L) ubelong =0x4f54544f OpenType
#!:mime font/otf
!:apple ????OTTO
# no example found for otc
!:ext ttc/otc
>>4 ubyte x font collection data
!:mime application/font-sfnt
#!:mime font/collection
# TCC version
>>4 belong 0x00010000 \b, 1.0
>>4 belong 0x00020000 \b, 2.0
>>8 ubelong >0 \b, %d fonts
# array offset size = fonts * offsetsize = fonts * 4
>>(8.L*4) ubequad x
# 0x44454947 = 'DSIG'
>>>16 belong 0x44534947 \b, digitally signed
>>>&4 belong 0x44534947 \b, digitally signed
# offset to 1st font
>>12 ubelong x \b, at 0x%x
# point to 1st font that starts with sfnt version
>>(12.L) use sfnt-font
# Opentype font data from Avi Bercovich
0 string OTTO OpenType font data
!:mime application/vnd.ms-opentype
# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
0 string SplineFontDB: Spline Font Database
# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
0 string SplineFontDB: Spline Font Database
!:mime application/vnd.font-fontforge-sfd
>14 string x version %s

24
contrib/file/magic/Magdir/fsav
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: fsav,v 1.13 2013/03/25 17:18:47 christos Exp $
# $File: fsav,v 1.14 2017/03/17 21:35:28 christos Exp $
# fsav: file(1) magic for datafellows fsav virus definition files
# Anthon van der Neut (anthon@mnt.org)
@ -29,11 +29,11 @@
#>>>>10 byte 11 \b12-
#>>>>9 ubyte >0 \b%02d)
# ftp://ftp.f-prot.com/pub/sign2.zip
#0 ubyte 0x62
#>1 ubyte 0xF5
#>>2 ubyte 0x1
#>>>3 ubyte 0x1
#>>>>4 ubyte 0x0e
#0 ubyte 0x62
#>1 ubyte 0xF5
#>>2 ubyte 0x1
#>>>3 ubyte 0x1
#>>>>4 ubyte 0x0e
#>>>>>13 ubyte >0 fsav virus signatures
#>>>>>>11 ubyte x size 0x%02x
#>>>>>>12 ubyte x \b%02x
@ -44,16 +44,16 @@
# .cvd files start with a 512 bytes colon separated header
# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
# + gzipped tarball files
0 string ClamAV-VDB:
0 string ClamAV-VDB:
>11 string >\0 Clam AntiVirus database %-.23s
>>34 string :
>>>35 string !: \b, version
>>34 string :
>>>35 string !: \b, version
>>>>35 string x \b%-.1s
>>>>>36 string !:
>>>>>36 string !:
>>>>>>36 string x \b%-.1s
>>>>>>>37 string !:
>>>>>>>37 string !:
>>>>>>>>37 string x \b%-.1s
>>>>>>>>>38 string !:
>>>>>>>>>38 string !:
>>>>>>>>>>38 string x \b%-.1s
>512 string \037\213 \b, gzipped
>769 string ustar\0 \b, tarred

6
contrib/file/magic/Magdir/games
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: games,v 1.14 2014/04/30 21:41:02 christos Exp $
# $File: games,v 1.15 2017/03/17 21:35:28 christos Exp $
# games: file(1) for games
# Fabio Bonelli <fabiobonelli@libero.it>
@ -39,7 +39,7 @@
#0 string -1\x0a Quake I demo
#>30 string x version %.4s
#>61 string x level %s
#>61 string x level %s
#0 string 5\x0a Quake I save
@ -240,7 +240,7 @@
# Summary: NetImmerse game engine file
# Extension .nif
# Created by: Abel Cheung <abelcheung@gmail.com>
0 string NetImmerse\ File\ Format,\ Versio
0 string NetImmerse\ File\ Format,\ Versio
>&0 string n\ NetImmerse game engine file
>>&0 regex [0-9a-z.]+ \b, version %s

10
contrib/file/magic/Magdir/gconv Normal file
View File

@ -0,0 +1,10 @@
#------------------------------------------------------------------------------
# $File: gconv
# gconv: file(1) magic for iconv/gconv module configuration cache
#
# Magic number defined in glibc/iconv/iconvconfig.h as GCONVCACHE_MAGIC
#
# From: Marek Cermak <macermak@redhat.com>
#
0 lelong 0x20010324 gconv module configuration cache data

4
contrib/file/magic/Magdir/geo
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: geo,v 1.3 2013/01/04 00:47:02 christos Exp $
# $File: geo,v 1.4 2017/03/17 21:35:28 christos Exp $
# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu>
######################################################################
@ -57,7 +57,7 @@
4 beshort 0x2002 GeoSwath RDF
0 string Start:- GeoSwatch auf text file
# Seabeam 2100
# Seabeam 2100
# mbsystem code mb41
0 string SB2100 SeaBeam 2100 multibeam sonar
0 string SB2100DR SeaBeam 2100 DR multibeam sonar

4
contrib/file/magic/Magdir/gnu
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: gnu,v 1.17 2016/07/16 22:17:04 christos Exp $
# $File: gnu,v 1.18 2017/03/17 21:35:28 christos Exp $
# gnu: file(1) magic for various GNU tools
#
# GNU nlsutils message catalog file format
@ -71,7 +71,7 @@
# they will ordinarily reported as "compressed", but at least -z helps
39 string =<gmr:Workbook Gnumeric spreadsheet
# From: James Youngman <jay@gnu.org>
# From: James Youngman <jay@gnu.org>
# gnu find magic
0 string \0LOCATE GNU findutils locate database data
>7 string >\0 \b, format %s

14
contrib/file/magic/Magdir/gpt
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: gpt,v 1.3 2014/04/30 21:41:02 christos Exp $
# $File: gpt,v 1.4 2017/03/17 21:35:28 christos Exp $
#
# GPT Partition table patterns.
# Author: Rogier Goossens (goossens.rogier@gmail.com)
@ -36,7 +36,7 @@
>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART
>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>0 use gpt-mbr-type
@ -66,7 +66,7 @@
>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART
>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>0 use gpt-mbr-type
@ -96,7 +96,7 @@
>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART
>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>0 use gpt-mbr-type
@ -126,7 +126,7 @@
>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART
>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>0 use gpt-mbr-type
@ -166,7 +166,7 @@
##>(8.l*8192) string EFI\ PART
##>>(8.l*8192) use gpt-mbr-type
##>>&-8 use gpt-table
##>>0 ubyte x of 8192 bytes
##>>0 ubyte x of 8192 bytes
##>(8.l*8192) string !EFI\ PART
##>>(8.l*4096) string EFI\ PART GPT partition table
##>>>0 use gpt-mbr-type
@ -212,7 +212,7 @@
>>486 ulelong !1 \b (nonstandard: not at LBA 1)
# GPT with protective MBR entry in partition 4
>498 ubyte 0xee
>>502 ulelong 1
>>502 ulelong 1
>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
>>502 ulelong !1 \b (nonstandard: not at LBA 1)

28
contrib/file/magic/Magdir/gpu Normal file
View File

@ -0,0 +1,28 @@
#------------------------------------------------------------------------------
# $File: gpu,v 1.2 2017/03/23 22:11:53 christos Exp $
# gpu: file(1) magic for GPU input files
# Standard Portable Intermediate Representation (SPIR)
# Documentation: https://www.khronos.org/spir
# Typical file extension: .spv
0 belong 0x07230203 Khronos SPIR-V binary, big-endian
>4 belong x \b, version 0x%08x
>8 belong x \b, generator 0x%08x
0 lelong 0x07230203 Khronos SPIR-V binary, little-endian
>4 lelong x \b, version 0x%08x
>8 lelong x \b, generator 0x%08x
# Vulkan Trace file
# Documentation:
# https://github.com/LunarG/VulkanTools/blob/master/vktrace/vktrace_common/\
# vktrace_trace_packet_identifiers.h
# Typical file extension: .vktrace
8 lequad 0xABADD068ADEAFD0C Vulkan trace file, little-endian
>0 leshort x \b, version %d
8 bequad 0xABADD068ADEAFD0C Vulkan trace file, big-endian
>0 beshort x \b, version %d

10
contrib/file/magic/Magdir/gringotts
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: gringotts,v 1.5 2009/09/19 16:28:09 christos Exp $
# $File: gringotts,v 1.6 2017/03/17 21:35:28 christos Exp $
# gringotts: file(1) magic for Gringotts
# http://devel.pluto.linux.it/projects/Gringotts/
# author: Germano Rizzo <mano@pluto.linux.it>
@ -9,10 +9,10 @@
#file format 1
>3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
#file format 2
>3 string 2 v.2, MCRYPT S2K,
>3 string 2 v.2, MCRYPT S2K,
>>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
>>8 byte&0x70 0x10 SERPENT crypt,
>>8 byte&0x70 0x20 TWOFISH crypt,
>>8 byte&0x70 0x20 TWOFISH crypt,
>>8 byte&0x70 0x30 CAST-256 crypt,
>>8 byte&0x70 0x40 SAFER+ crypt,
>>8 byte&0x70 0x50 LOKI97 crypt,
@ -27,10 +27,10 @@
>>8 byte&0x03 0x02 lvl.6
>>8 byte&0x03 0x03 lvl.9
#file format 3
>3 string 3 v.3, OpenPGP S2K,
>3 string 3 v.3, OpenPGP S2K,
>>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
>>8 byte&0x70 0x10 SERPENT crypt,
>>8 byte&0x70 0x20 TWOFISH crypt,
>>8 byte&0x70 0x20 TWOFISH crypt,
>>8 byte&0x70 0x30 CAST-256 crypt,
>>8 byte&0x70 0x40 SAFER+ crypt,
>>8 byte&0x70 0x50 LOKI97 crypt,

18
contrib/file/magic/Magdir/hitachi-sh
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: hitachi-sh,v 1.7 2015/09/30 20:32:35 christos Exp $
# $File: hitachi-sh,v 1.8 2017/03/17 21:35:28 christos Exp $
# hitach-sh: file(1) magic for Hitachi Super-H
#
# Super-H COFF
@ -9,20 +9,20 @@
# https://en.wikipedia.org/wiki/COFF
# https://de.wikipedia.org/wiki/Common_Object_File_Format
# http://www.delorie.com/djgpp/doc/coff/filhdr.html
# below test line conflicts with 2nd NTFS filesystem sector
# below test line conflicts with 2nd NTFS filesystem sector
# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR
# and Portable Gaming Notation Compressed format (*.WID http://pgn.freeservers.com/)
0 beshort 0x0500
0 beshort 0x0500
# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
>18 ubeshort&0x8E80 0
>18 ubeshort&0x8E80 0
# use big endian variant of subroutine to display name+variables+flags
# for common object formated files
# for common object formated files
>>0 use \^display-coff
0 leshort 0x0550
0 leshort 0x0550
# test for unused flag bits in f_flags
>18 uleshort&0x8E80 0
# use little endian variant of subroutine to
# display name+variables+flags for common object formated files
>18 uleshort&0x8E80 0
# use little endian variant of subroutine to
# display name+variables+flags for common object formated files
>>0 use display-coff

10
contrib/file/magic/Magdir/ibm370
View File

@ -1,28 +1,28 @@
#------------------------------------------------------------------------------
# $File: ibm370,v 1.9 2014/04/30 21:41:02 christos Exp $
# $File: ibm370,v 1.10 2017/03/17 21:35:28 christos Exp $
# ibm370: file(1) magic for IBM 370 and compatibles.
#
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
# What the heck *is* "USS/370"?
# AIX 4.1's "/etc/magic" has
#
# 0 short 0535 370 sysV executable
# 0 short 0535 370 sysV executable
# >12 long >0 not stripped
# >22 short >0 - version %d
# >30 long >0 - 5.2 format
# 0 short 0530 370 sysV pure executable
# 0 short 0530 370 sysV pure executable
# >12 long >0 not stripped
# >22 short >0 - version %d
# >30 long >0 - 5.2 format
#
# instead of the "USS/370" versions of the same magic numbers.
#
0 beshort 0537 370 XA sysV executable
0 beshort 0537 370 XA sysV executable
>12 belong >0 not stripped
>22 beshort >0 - version %d
>30 belong >0 - 5.2 format
0 beshort 0532 370 XA sysV pure executable
0 beshort 0532 370 XA sysV pure executable
>12 belong >0 not stripped
>22 beshort >0 - version %d
>30 belong >0 - 5.2 format

4
contrib/file/magic/Magdir/ibm6000
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: ibm6000,v 1.12 2013/09/16 15:12:42 christos Exp $
# $File: ibm6000,v 1.13 2017/03/17 21:35:28 christos Exp $
# ibm6000: file(1) magic for RS/6000 and the RT PC.
#
0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
@ -21,7 +21,7 @@
0 beshort 0x01f7 64-bit XCOFF executable or object module
>20 belong 0 not stripped
# GRR: this test is still too general as it catches also many FATs of DOS filesystems
4 belong &0x0feeddb0
4 belong &0x0feeddb0
# real core dump could not be 32-bit and 64-bit together
>7 byte&0x03 !3 AIX core file
>>1 byte &0x01 fulldump

187
contrib/file/magic/Magdir/icc
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: icc,v 1.1 2013/01/08 01:43:18 christos Exp $
# $File: icc,v 1.5 2017/08/13 00:21:47 christos Exp $
# icc: file(1) magic for International Color Consortium file formats
#
@ -11,41 +11,204 @@
# http://www.color.org/specification/ICC1v43_2010-12.pdf
#
# for Specification ICC.1:2010 (Profile version 4.3.0.0).
# URL: http://fileformats.archiveteam.org/wiki/ICC_profile
# Reference: http://www.color.org/iccmax/ICC.2-2016-7.pdf
# Update: Joerg Jenderek
#
# Bytes 36 to 39 contain a generic profile file signature of "acsp";
# bytes 40 to 43 "may be used to identify the primary platform/operating
# system framework for which the profile was created".
#
# There are other fields that might be worth dumping as well.
#
# check and display ICC/ICM color profile
0 name color-profile
>36 string acsp
# skip ASCII like Cognacspirit.txt by month <= 12
>>26 ubeshort <13
# platform/operating system. Only 5 mentioned
#
# This appears to be what's used for Apple ColorSync profiles.
# Instead of adding that, Apple just changed the generic "acsp" entry
# to be for "ColorSync ICC Color Profile" rather than "Kodak Color
# Management System, ICC Profile".
# Yes, it's "APPL", not "AAPL"; see the spec.
36 string acspAPPL ColorSync ICC Profile
!:mime application/vnd.iccprofile
>>>40 string APPL ColorSync
# Microsoft ICM color profile
36 string acspMSFT Microsoft ICM Color Profile
!:mime application/vnd.iccprofile
>>>40 string MSFT Microsoft
# Yes, that's a blank after "SGI".
36 string acspSGI\ SGI ICC Profile
!:mime application/vnd.iccprofile
>>>40 string SGI\ SGI
# XXX - is this what's used for the Sun KCMS or not? The standard file
# uses just "acsp" for that, but Apple's file uses it for "ColorSync",
# and there *is* an identified "primary platform" value of SUNW.
36 string acspSUNW Sun KCMS ICC Profile
>>>40 string SUNW Sun KCMS
# 5th platform
>>>40 string TGNT Taligent
# remaining "l" "e" of "color profile" printed later to avoid error
>>>40 string x color profi
#>>>40 string x (%.4s)
!:mime application/vnd.iccprofile
# for "ICM" extension only versions 2.x and for Kodak "CC" 2.0 is found
>>>8 ubyte =2
# do not use empty message text to a avoid error like
# icc, 82: Warning: Current entry does not yet have a description for adding a EXTENSION type
# file.exe: could not find any valid magic files!
>>>>9 ubyte !0 \ble
!:ext icc/icm
# minor version
>>>>9 ubyte =0 \bl
# Kodak colour management system
>>>>>4 string =KCMS \be
!:ext icc/icm/cc
>>>>>4 string !KCMS \be
!:ext icc/icm
>>>8 ubyte !2 \ble
!:ext icc
# Profile version major.4bit-minor.sub1.sub2 like 4.3.0.0 (04300000h)
>>>8 ubyte x %u
>>>9 ubyte/16 x \b.%u
# reserved and shall be null but 205.205 in umx1220u.icm
>>>10 ubyte >0 \b.%u
>>>>11 ubyte >0 \b.%u
# preferred colour management module like appl CCMS KCMS Lino UCCM "Win " "FF "
# skip space like in brmsl08f.icm and null like in brmsl09f.icm, brmsl07f.icm
>>>4 string >\ \b, type %.2s
>>>>6 string >\ \b%.1s
>>>>>7 string >\ \b%.1s
# colour space "XYZ " "Lab " "RGB " CMYK GRAY ...
>>>16 string x \b, %.3s
>>>19 string >\ \b%.1s
# Profile Connection Space (PCS) field usually "XYZ " or "Lab " but sometimes
# null or CMYK like in ISOcoated_v2_to_PSOcoated_v3_DeviceLink.icc
>>>20 string >\0 \b/%.3s
>>>>23 string >\ \b%.1s
# eleven device classes
>>>12 string x \b-%.4s device
# skip 00001964h in hpf69000.icc or 0h in XRDC50Q.ICM or " ROT" in brmsl05f.icm
>>>52 string >\040
# skip "none" model like in "Trinitron Compatible 9300K G2.2.icm"
>>>>52 ubelong !0x6e6f6e65
# device manufacturer field like "HP " "IBM " EPSO
>>>>>48 string x \b, %.2s
>>>>>50 string >\ \b%.1s
>>>>>51 string >\ \b%.1s
# model like "ADI " "A265" and skip 20000404h in IS330.icm for RICOH RUSSIAN-SC
>>>>>52 string >\ \ \b/%.3s
>>>>>>55 string >\ \b%.1s
>>>>>52 string x model
# creator (often same as manufacture) like HP SONY XROX or null like in A925A.icm
>>>80 string >\0 by %.2s
>>>>82 string >\ \b%.1s
>>>>>83 string >\ \b%.1s
# profile size
>>>0 ubelong x \b, %u bytes
# skip invalid date 0 like in linearSRGB.icc
>>>24 ubequad !0
# datetime dd-mm-yyyy hh:mm:ss
>>>>28 ubeshort x \b, %u
# month <= 12
>>>>26 ubeshort x \b-%u
# year
>>>>24 ubeshort x \b-%u
# do not display midnight time like in CNHP8308.ICC
>>>>30 ubequad&0xFFffFFffFFff0000 !0
# hour <= 24
>>>>>30 ubeshort x %u
# minutes <= 59
>>>>>32 ubeshort x \b:%.2u
# seconds <= 59
>>>>>34 ubeshort x \b:%.2u
# vendor specific flags like 2 in HPCLJ5.ICM
>>>44 ubeshort >0 \b, 0x%x vendor flags
# profile flags bits 0-2 of least 16 used by ICC
#>>>44 ubelong >0 \b, 0x%x flags
# icEmbeddedProfileTrue
>>>44 ubelong &1 \b, embedded
# icEmbeddedProfileFalse
#>>>44 ubelong ^1 \b, not embedded
# icUseWithEmbeddedDataOnly
>>>44 ubelong &2 \b, dependently
# icUseAnywhere
#>>>44 ubelong ^2 \b, independently
>>>44 ubelong &4 \b, MCS
#>>>44 ubelong ^4 \b, no MCS
# vendor specific device attributes 1~srgb.icc
# E000D00h~CNB7QEDA.ICM C000A00h~CNB5FCAA.ICM 01040401h~CNB25PE3.ICM
>>>56 ubelong >0 \b, 0x%x vendor attribute
# ICC device attributes bits 0-7 used
#>>>60 ubelong x \b, 0x%x attribute
# http://www.color.org/icc34.h
>>>60 ubelong &0x01 \b, transparent
#>>>60 ubelong ^0x01 \b, reflective
>>>60 ubelong &0x02 \b, matte
#>>>60 ubelong ^0x02 \b, glossy
>>>60 ubelong &0x04 \b, negative
#>>>60 ubelong ^0x04 \b, positive
>>>60 ubelong &0x08 \b, black&white
#>>>60 ubelong ^0x08 \b, colour
>>>60 ubelong &0x10 \b, non-paper
#>>>60 ubelong ^0x10 \b, paper
>>>60 ubelong &0x20 \b, non-textured
#>>>60 ubelong ^0x20 \b, textured
>>>60 ubelong &0x40 \b, non-isotropic
#>>>60 ubelong ^0x40 \b, isotropic
>>>60 ubelong &0x80 \b, self-luminous
#>>>60 ubelong ^0x80 \b, non-self-luminous
# rendering intent 0-3 but 7AEA5027h in EE051__1.ICM 6CB1BCh in EE061__1.ICM
>>>64 ubelong >3 \b, 0x%x rendering intent
#>>>64 ubelong =0 \b, perceptual
>>>64 ubelong =1 \b, relative colorimetric
>>>64 ubelong =2 \b, saturation
>>>64 ubelong =3 \b, absolute colorimetric
# PCS illuminant (3*s15Fixed16Numbers) often 0000f6d6 00010000 0000d32d
>>>71 ubequad !0xd6000100000000d3 \b, PCS
# usually X~0.9642*65536=63189.8112~63190=F6D5h ; but also found
# often F6D6 in gt5000r.icm, F6B8 in kodakce.icm, F6CA in RSWOP.icm
>>>>68 ubelong !0x0000f6d5 X=0x%x
# usually Y=1.0~00010000h but Y=0 in brmsl07f.icm
>>>>72 ubelong !0x00010000 Y=0x%x
# usually Z~0.8249*65536=54060.6464~54061=D32Dh ; but also found
# D2F7 in hp1200c.icm, often D32C in A925A.icm, D309 in RSWOP.icm , D2F8 in kodak_dc.icm
>>>>76 ubelong !0x0000d32d Z=0x%x
# Profile ID. MD5 fingerprinting method as defined in Internet RFC 1321.
>>>84 ubequad >0 \b, 0x%llx MD5
# reserved in older versions should be zero but also found CDCDCDCDCDCDCDCD
#>>100 ubequad x \b 0x%llx reserved
# tag table
# 6 <= tags count <= 43
#>>>128 ubelong >43 \b, %u tags
>>>128 ubelong x
# shall contain the profileDescriptionTag "desc" , copyrightTag "cprt"
# search range = tags count * 12 -8=< maximal tag count * 12 -8= 43 * 12 -8= 508
>>>>132 search/508 cprt
# but no copyright tag in linearSRGB.icc
# beneath /System/Library/Frameworks/WebKit.framework/
# Versions/A/Frameworks/WebCore.framework/Versions/A/Resources
>>>>132 default x \b, no copyright tag
# 1st tag
#>>>132 string x \b, 1st tag %.4s
#>>>136 ubelong x 0x%x offset
#>>>140 ubelong x 0x%x len
# 2nd tag,...
# look also for profileDescriptionTag "desc"
>>>132 search/508 desc
# look further for TextDescriptionType "desc" signature
>>>>(&0.L) string =desc
>>>>>&4 pstring/l x "%s"
# look alternative for multiLocalizedUnicodeType "mluc" signature like in VideoPAL.icc
>>>>(&0.L) string =mluc
>>>>>&(&8.L) ubequad x
>>>>>>&4 bestring16 x '%s'
# Any other profile.
# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles,
# and use "acsp" for everything else and dump the "primary platform"
# string in those cases?
36 string acsp ICC Profile
!:mime application/vnd.iccprofile
36 string acsp
>0 use color-profile

178
contrib/file/magic/Magdir/images
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: images,v 1.117 2016/07/05 19:12:21 christos Exp $
# $File: images,v 1.126 2017/06/11 22:25:44 christos Exp $
# images: file(1) magic for image formats (see also "iff", and "c-lang" for
# XPM bitmaps)
#
@ -26,23 +26,28 @@
# test of Color Map Type 0~no 1~color map
# and Image Type 1 2 3 9 10 11 32 33
# and Color Map Entry Size 0 15 16 24 32
0 ubequad&0x00FeC400000000C0 0
0 ubequad&0x00FeC400000000C0 0
# skip more garbage by looking for positive image type
>2 ubyte >0
>2 ubyte >0
# skip some compiled terminfo by looking for image type less equal 33
>>2 ubyte <34
>>2 ubyte <34
# skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel sizes 15 16 24 32
>>>16 ubyte <33
>>>16 ubyte <33
# skip more by looking for pixel size 0Fh 10h 18h 20h
>>>>16 ubyte&0xC0 0x00
# skip 260-16.ico by looking for no color map
>>>>>1 ubyte 0
# implies no first map entry
>>>>>>3 uleshort 0
>>>>>>>0 use tga-image
>>>>16 ubyte&0xC0 0x00
# Color Map
>>>>>1 ubyte >0
>>>>>1 belong&0xfff7ffff 0x01010000
>>>>>>0 use tga-image
>>>>>1 belong&0xfff7ffff 0x00020000
>>>>>>0 use tga-image
>>>>>1 belong&0xfff7ffff 0x00030000
>>>>>>0 use tga-image
>>>>>1 default x
# skip 260-16.ico by looking for no color map
>>>>>>1 ubyte 0
# implies no first map entry
>>>>>>>3 uleshort 0
>>>>>>>>0 use tga-image
# display tga bitmap image information
0 name tga-image
>2 ubyte <34 Targa image data
@ -78,7 +83,7 @@
>14 uleshort =0 65536
# Image Pixel Size 15 16 24 32
>16 ubyte x x %d
# X origin of image. 0 normal
# X origin of image. 0 normal
>8 uleshort >0 +%d
# Y origin of image. 0 normal; positive for top
>10 uleshort >0 +%d
@ -90,27 +95,27 @@
>17 ubyte &0x10 - right
#>17 ubyte ^0x10 - left
# some info say other bits 6-7 should be zero
# but data storage interleave by http://www.fileformat.info/format/tga/corion.htm
# but data storage interleave by http://www.fileformat.info/format/tga/corion.htm
# 00 - no interleave;01 - even/odd interleave; 10 - four way interleave; 11 - reserved
#>17 ubyte&0xC0 0x00 - no interleave
>17 ubyte&0xC0 0x40 - interleave
>17 ubyte&0xC0 0x80 - four way interleave
>17 ubyte&0xC0 0xC0 - reserved
# positive length implies identification field
>0 ubyte >0
# positive length implies identification field
>0 ubyte >0
>>18 string x "%s"
# last 18 bytes of newer tga file footer signature
>18 search/4261301/s TRUEVISION-XFILE.\0
>18 search/4261301/s TRUEVISION-XFILE.\0
# extension area offset if not 0
>>&-8 ulelong >0
>>&-8 ulelong >0
# length of the extension area. normal 495 for version 2.0
>>>(&-4.l) uleshort 0x01EF
>>>(&-4.l) uleshort 0x01EF
# AuthorName[41]
>>>>&0 string >\0 - author "%-.40s"
# Comment[324]=4 * 80 null terminated
>>>>&41 string >\0 - comment "%-.80s"
# date
>>>>&365 ubequad&0xffffFFFFffff0000 !0
>>>>&365 ubequad&0xffffFFFFffff0000 !0
# Day
>>>>>&-6 uleshort x %d
# Month
@ -118,7 +123,7 @@
# Year
>>>>>&-4 uleshort x \b-%d
# time
>>>>&371 ubequad&0xffffFFFFffff0000 !0
>>>>&371 ubequad&0xffffFFFFffff0000 !0
# hour
>>>>>&-8 uleshort x %d
# minutes
@ -128,14 +133,14 @@
# JobName[41]
>>>>&377 string >\0 - job "%-.40s"
# JobHour Jobminute Jobsecond
>>>>&418 ubequad&0xffffFFFFffff0000 !0
>>>>&418 ubequad&0xffffFFFFffff0000 !0
>>>>>&-8 uleshort x %d
>>>>>&-6 uleshort x \b:%.2d
>>>>>&-4 uleshort x \b:%.2d
# SoftwareId[41]
>>>>&424 string >\0 - %-.40s
# SoftwareVersionNumber
>>>>&424 ubyte >0
>>>>&424 ubyte >0
>>>>>&40 uleshort/100 x %d
>>>>>&40 uleshort%100 x \b.%d
# VersionLetter
@ -143,16 +148,16 @@
# KeyColor
>>>>&468 ulelong >0 - keycolor 0x%8.8x
# Denominator of Pixel ratio. 0~no pixel aspect
>>>>&474 uleshort >0
>>>>&474 uleshort >0
# Numerator
>>>>>&-4 uleshort >0 - aspect %d
>>>>>&-2 uleshort x \b/%d
# Denominator of Gamma ratio. 0~no Gamma value
>>>>&478 uleshort >0
>>>>&478 uleshort >0
# Numerator
>>>>>&-4 uleshort >0 - gamma %d
>>>>>&-2 uleshort x \b/%d
# ColorOffset
# ColorOffset
#>>>>&480 ulelong x - col offset 0x%8.8x
# StampOffset
#>>>>&484 ulelong x - stamp offset 0x%8.8x
@ -170,43 +175,43 @@
>>&0 regex =[0-9]{1,50} \b, size = %s x
>>>&0 regex =[0-9]{1,50} \b %s
0 search/1 P1
>0 regex/4 P1\\s
0 search/1 P1
>0 regex/4 P1[\040\t\f\r\n]
>>0 use netpbm
>>>0 string x \b, bitmap
!:strength + 45
!:mime image/x-portable-bitmap
0 search/1 P2
>0 regex/4 P2\\s
0 search/1 P2
>0 regex/4 P2[\040\t\f\r\n]
>>0 use netpbm
>>>0 string x \b, greymap
!:strength + 45
!:mime image/x-portable-greymap
0 search/1 P3
>0 regex/4 P3\\s
>0 regex/4 P3[\040\t\f\r\n]
>>0 use netpbm
>>>0 string x \b, pixmap
!:strength + 45
!:mime image/x-portable-pixmap
0 string P4
>0 regex/4 P4\\s
0 string P4
>0 regex/4 P4[\040\t\f\r\n]
>>0 use netpbm
>>>0 string x \b, rawbits, bitmap
!:strength + 45
!:mime image/x-portable-bitmap
0 string P5
>0 regex/4 P5\\s
0 string P5
>0 regex/4 P5[\040\t\f\r\n]
>>0 use netpbm
>>>0 string x \b, rawbits, greymap
!:strength + 45
!:mime image/x-portable-greymap
0 string P6
>0 regex/4 P6\\s
0 string P6
>0 regex/4 P6[\040\t\f\r\n]
>>0 use netpbm
>>>0 string x \b, rawbits, pixmap
!:strength + 45
@ -303,7 +308,7 @@
>>>8 leshort 0x8765 \bJBIG
>>>8 leshort 0x8798 \bJPEG2000
>>>8 leshort 0x8799 \bNikon NEF Compressed
>>>8 default x
>>>8 default x
>>>>8 leshort x \b(unknown 0x%x)
>>>12 use tiff_entry
>0 leshort 0x106 \b, PhotometricIntepretation=
@ -414,21 +419,35 @@
# (Greg Roelofs, newt@uchicago.edu)
# (Albert Cahalan, acahalan@cs.uml.edu)
#
# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
# 137 P N G \r \n ^Z \n [4-byte length] I H D R [HEAD data] [HEAD crc] ...
#
0 string \x89PNG\x0d\x0a\x1a\x0a PNG image data
# IHDR parser
0 name png-ihdr
>0 belong x \b, %d x
>4 belong x %d,
>8 byte x %d-bit
>9 byte 0 grayscale,
>9 byte 2 \b/color RGB,
>9 byte 3 colormap,
>9 byte 4 gray+alpha,
>9 byte 6 \b/color RGBA,
#>10 byte 0 deflate/32K,
>12 byte 0 non-interlaced
>12 byte 1 interlaced
# Standard PNG image.
0 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0DIHDR PNG image data
!:mime image/png
>16 belong x \b, %d x
>20 belong x %d,
>24 byte x %d-bit
>25 byte 0 grayscale,
>25 byte 2 \b/color RGB,
>25 byte 3 colormap,
>25 byte 4 gray+alpha,
>25 byte 6 \b/color RGBA,
#>26 byte 0 deflate/32K,
>28 byte 0 non-interlaced
>28 byte 1 interlaced
!:strength +10
>16 use png-ihdr
# Apple CgBI PNG image.
0 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x04CgBI
>24 string \x00\x00\x00\x0DIHDR PNG image data (CgBI)
!:mime image/png
!:strength +10
>>32 use png-ihdr
# possible GIF replacements; none yet released!
# (Greg Roelofs, newt@uchicago.edu)
@ -438,13 +457,13 @@
!:mime image/x-unknown
#
# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better):
#
#
0 string FGF95a FGF image (GIF+deflate beta)
!:mime image/x-unknown
#
# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal
# (best; not yet implemented):
#
#
0 string PBF PBF image (deflate compression)
!:mime image/x-unknown
@ -528,19 +547,19 @@
# http://www.blackfiveservices.co.uk/awbmtools.shtml
# http://biosgfx.narod.ru/v3/
# http://biosgfx.narod.ru/abr-2/
0 string AWBM
0 string AWBM
>4 leshort <1981 Award BIOS bitmap
!:mime image/x-award-bmp
# image width is a multiple of 4
>>4 leshort&0x0003 0
>>4 leshort&0x0003 0
>>>4 leshort x \b, %d
>>>6 leshort x x %d
>>4 leshort&0x0003 >0 \b,
>>>4 leshort&0x0003 =1
>>>4 leshort&0x0003 =1
>>>>4 leshort x %d+3
>>>4 leshort&0x0003 =2
>>>4 leshort&0x0003 =2
>>>>4 leshort x %d+2
>>>4 leshort&0x0003 =3
>>>4 leshort&0x0003 =3
>>>>4 leshort x %d+1
>>>6 leshort x x %d
# at offset 8 starts imagedata followed by "RGB " marker
@ -764,11 +783,11 @@
# http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000
# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT
0 ubelong&0xffF8fe00 0x0a000000
# for PCX bit depth > 0
>3 ubyte >0
0 ubelong&0xffF8fe00 0x0a000000
# for PCX bit depth > 0
>3 ubyte >0
# test for valid versions
>>1 ubyte <6
>>1 ubyte <6
>>>1 ubyte !1 PCX
!:mime image/x-pcx
#!:mime image/pcx
@ -828,29 +847,29 @@
# Update: Joerg Jenderek
# See http://fileformats.archiveteam.org/wiki/GEM_Raster
# For variations, also see:
# http://www.seasip.info/Gem/ff_img.html (Ventura)
# http://www.seasip.info/Gem/ff_img.html (Ventura)
# http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT)
# http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT)
# http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG)
0 beshort 0x0001
# header_size
>2 beshort 0x0008
>2 beshort 0x0008
>>0 use gem_info
>2 beshort 0x0009
>2 beshort 0x0009
>>0 use gem_info
# no example for NOSIG
>2 beshort 24
>2 beshort 24
>>0 use gem_info
# no example for HYPERPAINT
>2 beshort 25
>2 beshort 25
>>0 use gem_info
16 string XIMG\0
16 string XIMG\0
>0 use gem_info
# no example
16 string STTT\0\x10
16 string STTT\0\x10
>0 use gem_info
# no example or description
16 string TIMG\0
16 string TIMG\0
>0 use gem_info
0 name gem_info
@ -859,15 +878,15 @@
# http://www.snowstone.org.uk/riscos/mimeman/mimemap.txt
!:mime image/x-gem
# header_size 24 25 27 59 779 words for colored bitmaps
>>2 beshort >9
>>2 beshort >9
>>>16 string STTT\0\x10 STTT
>>>16 string TIMG\0 TIMG
# HYPERPAINT or NOSIG variant
>>>16 string \0\x80
>>>16 string \0\x80
>>>>2 beshort =24 NOSIG
>>>>2 beshort !24 HYPERPAINT
# NOSIG or XIMG variant
>>>16 default x
>>>16 default x
>>>>16 string !XIMG\0 NOSIG
>>16 string =XIMG\0 XIMG Image data
!:ext img/ximg
@ -1177,7 +1196,7 @@
# updated by: Joerg Jenderek
# URL: http://techmods.net/nuvi/
0 string GARMIN\ BITMAP\ 01 Garmin Bitmap file
# extension is also used for
# extension is also used for
# Sony SRF raw image (image/x-sony-srf)
# SRF map
# Terragen Surface Map (http://www.planetside.co.uk/terragen)
@ -1318,7 +1337,7 @@
!:mime image/x-icns
!:apple ????icns
!:ext icns
>4 ubelong >0
>4 ubelong >0
# file size
>>4 ubelong x \b, %d bytes
# icon type
@ -1451,3 +1470,12 @@
>0x10 string GVRT Sega GVR image:
>>0x10 use sega-gvr-image-header
>>0x08 belong x \b, global index = %u
# Light Field Picture
# Documentation: http://optics.miloush.net/lytro/TheFileFormat.aspx
# Typical file extensions: .lfp .lfr .lfx
0 belong 0x894C4650
>4 belong 0x0D0A1A0A
>12 belong 0x00000000 Lytro Light Field Picture
>8 belong x \b, version %d

6
contrib/file/magic/Magdir/intel
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: intel,v 1.14 2015/11/10 00:13:27 christos Exp $
# $File: intel,v 1.15 2017/03/17 21:35:28 christos Exp $
# intel: file(1) magic for x86 Unix
#
# Various flavors of x86 UNIX executable/object (other than Xenix, which
@ -36,8 +36,8 @@
# ./msdos (version 5.25) labeled the next entry as "MS Windows COFF Intel 80386 object file"
# ./intel (version 5.25) label labeled the next entry as "80386 COFF executable"
# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
0 leshort =0514
# use subroutine to display name+flags+variables for common object formated files
0 leshort =0514
# use subroutine to display name+flags+variables for common object formated files
>0 use display-coff
#>12 lelong >0 not stripped
# no hint found, that at offset 22 is version

4
contrib/file/magic/Magdir/isz
View File

@ -1,7 +1,7 @@
#------------------------------------------------------------------------------
# $File: isz,v 1.3 2014/04/30 21:41:02 christos Exp $
# ISO Zipped file format
# $File: isz,v 1.4 2017/03/17 21:35:28 christos Exp $
# ISO Zipped file format
# http://www.ezbsystems.com/isz/iszspec.txt
0 string IsZ! ISO Zipped file
>4 byte x \b, header size %u

10
contrib/file/magic/Magdir/jpeg
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: jpeg,v 1.30 2016/07/04 15:18:23 christos Exp $
# $File: jpeg,v 1.31 2017/03/17 21:35:28 christos Exp $
# JPEG images
# SunOS 5.5.1 had
#
@ -53,14 +53,14 @@
>>5 beshort x \b%d
>>9 byte x \b, frames %d
>0 beshort 0xFFC1
>0 beshort 0xFFC1
>>(2.S+2) use jpeg_segment
>>4 byte x \b, extended sequential, precision %d
>>7 beshort x \b, %dx
>>5 beshort x \b%d
>>9 byte x \b, frames %d
>0 beshort 0xFFC2
>0 beshort 0xFFC2
>>(2.S+2) use jpeg_segment
>>4 byte x \b, progressive, precision %d
>>7 beshort x \b, %dx
@ -71,11 +71,11 @@
>0 beshort 0xFFC4
>>(2.S+2) use jpeg_segment
>0 beshort 0xFFE1
>0 beshort 0xFFE1
# Recursion handled by FFE0
#>>(2.S+2) use jpeg_segment
>>4 string Exif \b, Exif Standard: [
>>>10 indirect/r x
>>>10 indirect/r x
>>>10 string x \b]
# Application specific markers

4
contrib/file/magic/Magdir/kerberos
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: kerberos,v 1.1 2014/12/10 18:45:43 christos Exp $
# $File: kerberos,v 1.2 2017/03/17 21:35:28 christos Exp $
# kerberos: MIT kerberos file binary formats
#
@ -38,7 +38,7 @@
>>>>>&0 bedate x \b, date=%s
>>>>>>&0 byte x \b, kvno=%u
#>>>>>>>&0 pstring/H x
#>>>>>>>>&0 belong x
#>>>>>>>>&0 belong x
#>>>>>>>>>>&0 use keytab_entry
0 belong 0x05020000 Kerberos Keytab file

6
contrib/file/magic/Magdir/kml
View File

@ -1,13 +1,13 @@
#------------------------------------------------------------------------------
# $File: kml,v 1.3 2010/11/25 15:00:12 christos Exp $
# $File: kml,v 1.4 2017/03/17 21:35:28 christos Exp $
# Type: Google KML, formerly Keyhole Markup Language
# Future development of this format has been handed
# over to the Open Geospatial Consortium.
# http://www.opengeospatial.org/standards/kml/
# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
0 string/t \<?xml
>20 search/400 \ xmlns=
>20 search/400 \ xmlns=
>>&0 regex ['"]http://earth.google.com/kml Google KML document
!:mime application/vnd.google-earth.kml+xml
>>>&1 string 2.0' \b, version 2.0
@ -25,7 +25,7 @@
>>>&1 string/t 2.2 \b, version 2.2
#------------------------------------------------------------------------------
# Type: Google KML Archive (ZIP based)
# Type: Google KML Archive (ZIP based)
# http://code.google.com/apis/kml/documentation/kml_tut.html
# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
0 string PK\003\004

14
contrib/file/magic/Magdir/linux
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: linux,v 1.63 2015/08/24 05:16:11 christos Exp $
# $File: linux,v 1.64 2017/03/17 21:35:28 christos Exp $
# linux: file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
@ -199,7 +199,7 @@
############################################################################
# Linux 8086 executable
0 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless
>5 string .
>5 string .
>>4 string >\0 \b, libc version %s
0 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable
@ -213,7 +213,7 @@
>2 byte&0x40 !0 \b, A_PURE
>2 byte&0x80 !0 \b, A_TOVLY
>28 long !0 \b, not stripped
>37 string .
>37 string .
>>36 string >\0 \b, libc version %s
# 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable
@ -241,7 +241,7 @@
>24 lelong x %d symbols
>28 lelong x %d ocons
# Linux Logical Volume Manager (LVM)
# Linux Logical Volume Manager (LVM)
# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net>
#
# System ID, UUID and volume group name are 128 bytes long
@ -301,7 +301,7 @@
>>&0x20 lequad x \b, size: %lld
0x618 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager)
>&(&-12.l-0x21) byte x
>&(&-12.l-0x21) byte x
# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
>>&0x0 string >\x2f \b, UUID: %.6s
>>&0x6 string >\x2f \b-%.4s
@ -340,7 +340,7 @@
# Summary: Xen saved domain file
# Created by: Radek Vokal <rvokal@redhat.com>
0 string LinuxGuestRecord Xen saved domain
>20 search/256 (name
>20 search/256 (name
>>&1 string x (name %s)
# Type: Xen, the virtual machine monitor
@ -397,7 +397,7 @@
>>0x1046 ubeshort x \b%04x
# Linux device tree:
# File format description can be found in the Linux kernel sources at
# File format description can be found in the Linux kernel sources at
# Documentation/devicetree/booting-without-of.txt
# From Christoph Biedl
0 belong 0xd00dfeed

16
contrib/file/magic/Magdir/lisp
View File

@ -1,13 +1,13 @@
#------------------------------------------------------------------------------
# $File: lisp,v 1.24 2015/11/30 20:54:26 christos Exp $
# $File: lisp,v 1.25 2017/03/17 21:35:28 christos Exp $
# lisp: file(1) magic for lisp programs
#
# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
# updated by Joerg Jenderek
# GRR: This lot is too weak
#0 string ;;
#0 string ;;
# windows INF files often begin with semicolon and use CRLF as line end
# lisp files are mainly created on unix system with LF as line end
#>2 search/4096 !\r Lisp/Scheme program text
@ -28,9 +28,9 @@
# URL: https://en.wikipedia.org/wiki/Emacs_Lisp
# Reference: http://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz
# Update: Joerg Jenderek
# Update: Joerg Jenderek
# Emacs 18 - this is always correct, but not very magical.
0 string \012(
0 string \012(
# look for emacs lisp keywords
# GRR: split regex because it is too long or get error like
# lisp, 36: Warning: cannot get string from `^(defun|defvar|defconst|defmacro|setq|fset|put|provide|require|'
@ -50,13 +50,13 @@
# Emacs 19+ - ver. recognition added by Ian Springer
# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs
# - Chris Chittleborough <cchittleborough@yahoo.com.au>
# Update: Joerg Jenderek
0 string ;ELC
# Update: Joerg Jenderek
0 string ;ELC
# version\0\0\0
>4 byte >18 Emacs/XEmacs v%d byte-compiled Lisp data
# why less than 32 ? does not make sense to me. GNU Emacs version is 24.5 at April 2015
#>4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data
!:mime application/x-elc
!:mime application/x-elc
!:apple EMAxTEXT
!:ext elc
@ -67,7 +67,7 @@
0 long 0x70768BD2 CLISP memory image data
0 long 0xD28B7670 CLISP memory image data, other endian
#.com and .bin for MIT scheme
#.com and .bin for MIT scheme
0 string \372\372\372\372 MIT scheme (library?)
# From: David Allouche <david@allouche.net>

5
contrib/file/magic/Magdir/m4
View File

@ -1,6 +1,9 @@
#------------------------------------------------------------------------------
# $File: m4,v 1.1 2011/12/08 12:12:46 rrt Exp $
# $File: m4,v 1.2 2017/08/14 07:40:38 christos Exp $
# make: file(1) magic for M4 scripts
#
0 regex \^dnl\ M4 macro processor script text
!:mime text/x-m4
0 regex \^AC_DEFUN\\(\\[ M4 macro processor script text
!:strength + 15
!:mime text/x-m4

20
contrib/file/magic/Magdir/macintosh
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: macintosh,v 1.26 2015/11/25 00:36:02 christos Exp $
# $File: macintosh,v 1.27 2017/03/17 21:35:28 christos Exp $
# macintosh description
#
# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
@ -109,9 +109,9 @@
# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
# and that 74 will be 0. So something like
#
#
# 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data
#
#
# >73 byte&0x01 0x01 \b, inited
# >73 byte&0x02 0x02 \b, changed
# >73 byte&0x04 0x04 \b, busy
@ -254,7 +254,7 @@
>0x9C string INDEX data file index
>0x9C string VIEW data view
# spss magic for SPSS system and portable files,
# spss magic for SPSS system and portable files,
# from Bruce Foster (bef@nwu.edu).
0 long 0xc1e2c3c9 SPSS Portable File
@ -273,7 +273,7 @@
# entries depend on the data arithmetic added after v.35
# There's also some Pascal strings in here, ditto...
# The boot block signature, according to IM:Files, is
# The boot block signature, according to IM:Files, is
# "for HFS volumes, this field always contains the value 0x4C4B."
# But if this is true for MFS or HFS+ volumes, I don't know.
# Alternatively, the boot block is supposed to be zeroed if it's
@ -291,10 +291,10 @@
# *.hfs updated by Joerg Jenderek
# http://en.wikipedia.org/wiki/Hierarchical_File_System
# "BD" gives many false positives
0x400 beshort 0x4244
0x400 beshort 0x4244
# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h
# first block of volume bit map (always 3)
>0x40e ubeshort 0x0003
>0x40e ubeshort 0x0003
# maximal length of volume name is 27
>>0x424 ubyte <28 Macintosh HFS data
!:mime application/x-apple-diskimage
@ -351,15 +351,15 @@
#>0x230 string x first type: %s,
#>0x210 string x name: %s,
#>0x254 belong x number of blocks: %d,
#>0x400 beshort 0x504D
#>0x400 beshort 0x504D
#>>0x430 string x second type: %s,
#>>0x410 string x name: %s,
#>>0x454 belong x number of blocks: %d,
#>>0x800 beshort 0x504D
#>>0x800 beshort 0x504D
#>>>0x830 string x third type: %s,
#>>>0x810 string x name: %s,
#>>>0x854 belong x number of blocks: %d,
#>>>0xa00 beshort 0x504D
#>>>0xa00 beshort 0x504D
#>>>>0xa30 string x fourth type: %s,
#>>>>0xa10 string x name: %s,
#>>>>0xa54 belong x number of blocks: %d

18
contrib/file/magic/Magdir/make
View File

@ -1,7 +1,8 @@
#------------------------------------------------------------------------------
# $File: make,v 1.2 2015/08/25 07:34:06 christos Exp $
# $File: make,v 1.3 2016/12/10 14:21:29 christos Exp $
# make: file(1) magic for makefiles
#
# URL: https://en.wikipedia.org/wiki/Make_(software)
0 regex/100l \^CFLAGS makefile script text
!:mime text/x-makefile
0 regex/100l \^VPATH makefile script text
@ -10,12 +11,19 @@
!:mime text/x-makefile
0 regex/100l \^all: makefile script text
!:mime text/x-makefile
0 regex/100l \^\.PRECIOUS makefile script text
0 regex/100l \^\\.PRECIOUS makefile script text
!:mime text/x-makefile
0 regex/100l \^\.BEGIN BSD makefile script text
# Update: Joerg Jenderek
# Reference: https://www.freebsd.org/cgi/man.cgi?make(1)
# exclude grub-core\lib\libgcrypt\mpi\Makefile.am with "#BEGIN_ASM_LIST"
# by additional escaping point character
0 regex/100l \^\\.BEGIN BSD makefile script text with "%s"
!:mime text/x-makefile
0 regex/100l \^\.include BSD makefile script text
!:ext /mk
# exclude MS Windows help file CoNtenT with ":include FOOBAR.CNT"
# and NSIS script with "!include" by additional escaping point character
0 regex/100l \^\\.include BSD makefile script text with "%s"
!:mime text/x-makefile
!:ext /mk
0 regex/100l \^SUBDIRS automake makefile script text
!:mime text/x-makefile

6
contrib/file/magic/Magdir/maple
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: maple,v 1.7 2013/01/11 16:45:23 christos Exp $
# $File: maple,v 1.8 2017/03/17 21:35:28 christos Exp $
# maple: file(1) magic for maple files
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Maple V release 4, a multi-purpose math program
@ -13,7 +13,7 @@
# no magic for these :-(
# they are compiled indexes for maple files
# .hdb
# .hdb
0 string \000\004\000\000 Maple help database
# .mhp
@ -40,7 +40,7 @@
# from byte 4 it is either 'nul E' or 'soh R'
# I think 'nul E' means a file that was saved as a different name
# a sort of revision marking
# 'soh R' means new
# 'soh R' means new
>4 string \000\105 An old revision
>4 string \001\122 The latest save

18
contrib/file/magic/Magdir/marc21
View File

@ -2,27 +2,29 @@
# marc21: file(1) magic for MARC 21 Format
#
# Kevin Ford (kefo@loc.gov)
#
#
# MARC21 formats are for the representation and communication
# of bibliographic and related information in machine-readable
# form. For more info, see http://www.loc.gov/marc/
# leader position 20-21 must be 45
20 string 45
# and 22-23 also 00 so far, but we check that later.
20 string 45
>0 search/2048 \x1e
# leader starts with 5 digits, followed by codes specific to MARC format
>0 regex/1l (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic
>>0 regex/1l (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic
!:mime application/marc
>0 regex/1l (^[0-9]{5})[acdnosx][z] MARC21 Authority
>>0 regex/1l (^[0-9]{5})[acdnosx][z] MARC21 Authority
!:mime application/marc
>0 regex/1l (^[0-9]{5})[cdn][uvxy] MARC21 Holdings
>>0 regex/1l (^[0-9]{5})[cdn][uvxy] MARC21 Holdings
!:mime application/marc
0 regex/1l (^[0-9]{5})[acdn][w] MARC21 Classification
>>0 regex/1l (^[0-9]{5})[acdn][w] MARC21 Classification
!:mime application/marc
>0 regex/1l (^[0-9]{5})[cdn][q] MARC21 Community
>>0 regex/1l (^[0-9]{5})[cdn][q] MARC21 Community
!:mime application/marc
# leader position 22-23, should be "00" but is it?
>0 regex/1l (^.{21})([^0]{2}) (non-conforming)
>>0 regex/1l (^.{21})([^0]{2}) (non-conforming)
!:mime application/marc

6
contrib/file/magic/Magdir/mathematica
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: mathematica,v 1.8 2015/04/09 20:01:40 christos Exp $
# $File: mathematica,v 1.9 2017/03/17 21:35:28 christos Exp $
# mathematica: file(1) magic for mathematica files
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Mathematica a multi-purpose math program
@ -49,7 +49,7 @@
#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file
0 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file
#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
# >71... is optional
>88 string >\0 from %s
@ -59,7 +59,7 @@
0 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think)
# .ml files These are menu resources I think
# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
# how to put that into a magic rule?
4 string \ A~ MAthematica .ml file

4
contrib/file/magic/Magdir/metastore
View File

@ -1,8 +1,8 @@
#------------------------------------------------------------------------------
# $File: metastore,v 1.1 2011/04/06 12:37:44 christos Exp $
# $File: metastore,v 1.2 2017/03/17 21:35:28 christos Exp $
# metastore: file(1) magic for metastore files
# From: Thomas Wissen
# see http://david.hardeman.nu/software.php#metastore
0 string MeTaSt00r3 Metastore data file,
0 string MeTaSt00r3 Metastore data file,
>10 bequad x version %0llx

4
contrib/file/magic/Magdir/meteorological
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: meteorological,v 1.1 2014/08/04 06:26:16 christos Exp $
# $File: meteorological,v 1.2 2017/03/17 21:35:28 christos Exp $
# rinex: file(1) magic for RINEX files
# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf
@ -34,7 +34,7 @@
>>&32 string x \b, date %15.15s
>>5 string x \b, version %6.6s
!:mime rinex/meteorological
>80 search/256 XXRINEXN RINEX Data, Navigation
>80 search/256 XXRINEXN RINEX Data, Navigation
>>&32 string x \b, date %15.15s
>>5 string x \b, version %6.6s
!:mime rinex/navigation

4
contrib/file/magic/Magdir/microfocus
View File

@ -1,7 +1,7 @@
#------------------------------------------------------------------------------
# $File: microfocus,v 1.1 2016/02/09 01:22:49 christos Exp $
# Micro Focus COBOL data files.
# $File: microfocus,v 1.2 2017/03/17 21:35:28 christos Exp $
# Micro Focus COBOL data files.
# http://documentation.microfocus.com/help/index.jsp?topic=\
# %2FGUID-0E0191D8-C39A-44D1-BA4C-D67107BAF784%2FHRFLRHFILE05.html

4
contrib/file/magic/Magdir/mime
View File

@ -1,9 +1,9 @@
#------------------------------------------------------------------------------
# $File: mime,v 1.6 2010/11/25 15:00:12 christos Exp $
# $File: mime,v 1.8 2017/03/17 22:20:22 christos Exp $
# mime: file(1) magic for MIME encoded files
#
0 string/t Content-Type:\
0 string/t Content-Type:\040
>14 string >\0 %s
0 string/t Content-Type:
>13 string >\0 %s

6
contrib/file/magic/Magdir/misctools
View File

@ -1,6 +1,6 @@
#-----------------------------------------------------------------------------
# $File: misctools,v 1.16 2016/02/14 15:46:52 christos Exp $
# $File: misctools,v 1.17 2017/03/17 21:35:28 christos Exp $
# misctools: file(1) magic for miscellaneous UNIX tools.
#
0 search/1 %%!! X-Post-It-Note text
@ -14,7 +14,7 @@
#!:mime text/x-vcard
!:mime text/vcard
# VERSION must come right after BEGIN for 3.0 or 4.0 except in 2.1 , where it can be anywhere
>12 search/14000/c VERSION:
>12 search/14000/c VERSION:
# VERSION 2.1 , 3.0 or 4.0
>>&0 string x \b, version %-.3s
@ -48,7 +48,7 @@
>12 ulelong !0x20 \b, 0x%8.8x RVA
# CheckSum 0
>16 ulelong !0 \b, CheckSum 0x%8.8x
# Reserved or TimeDateStamp
# Reserved or TimeDateStamp
>20 ledate x \b, %s
# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519%28v=vs.85%29.aspx
# Flags MINIDUMP_TYPE enumeration type 0 0x121 0x800

26
contrib/file/magic/Magdir/modem
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: modem,v 1.7 2016/01/08 00:56:42 christos Exp $
# $File: modem,v 1.8 2017/03/17 21:35:28 christos Exp $
# modem: file(1) magic for modem programs
#
# From: Florian La Roche <florian@knorke.saar.de>
@ -13,24 +13,24 @@
# URL: https://de.wikipedia.org/wiki/Fax
# Reference: http://web.archive.org/web/20020628195336/http://www.netnam.vn/unescocourse/computervision/104.htm
# GRR: EOL of G3 is too general as it catches also TrueType fonts, Postscript PrinterFontMetric, others
0 short 0x0100
0 short 0x0100
# 16 0-bits near beginning like True Type fonts *.ttf, Postscript PrinterFontMetric *.pfm, FTYPE.HYPERCARD, XFER
>2 search/9 \0\0
>2 search/9 \0\0
# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
>2 default x
>2 default x
# skip IRCAM file (VAX big-endian) ./audio
>>0 belong !0x0001a364
>>0 belong !0x0001a364
# skip GEM Image data ./images
>>>2 beshort !0x0008
>>>2 beshort !0x0008
# look for first keyword of Panorama database *.pan
>>>>11 search/262 \x06DESIGN
>>>>11 search/262 \x06DESIGN
# skip Panorama database
>>>>11 default x
>>>>11 default x
# old Apple DreamWorld DreamGrafix *.3200 with keyword at end of g3 looking files
>>>>>27118 search/1864 DreamWorld
>>>>>27118 default x
>>>>>27118 search/1864 DreamWorld
>>>>>27118 default x
# skip MouseTrap/Mt.Defaults with file size 16 found on Golden Orchard Apple II CD Rom
>>>>>>8 ubequad !0x2e01010454010203
>>>>>>8 ubequad !0x2e01010454010203
# skip PICTUREH.SML found on Golden Orchard Apple II CD Rom
>>>>>>>8 ubequad !0x5dee74ad1aa56394 raw G3 (Group 3) FAX, byte-padded
# version 5.25 labeled the entry above "raw G3 data, byte-padded"
@ -39,9 +39,9 @@
!:ext g3
# unusual image starting with black pixel
#0 short 0x1300 raw G3 (Group 3) FAX
0 short 0x1400
0 short 0x1400
# 16 0-bits near beginning like PicturePuzzler found on Golden Orchard Apple CD Rom
>2 search/9 \0\0
>2 search/9 \0\0
# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
>2 default x raw G3 (Group 3) FAX
# version 5.25 labeled the above entry as "raw G3 data"

4
contrib/file/magic/Magdir/mozilla
View File

@ -1,7 +1,7 @@
#------------------------------------------------------------------------------
# $File: mozilla,v 1.6 2015/01/25 16:20:46 christos Exp $
# mozilla: file(1) magic for Mozilla XUL fastload files
# $File: mozilla,v 1.7 2017/03/17 21:35:28 christos Exp $
# mozilla: file(1) magic for Mozilla XUL fastload files
# (XUL.mfasl and XPC.mfasl)
# URL: http://www.mozilla.org/
# From: Josh Triplett <josh@freedesktop.org>

284
contrib/file/magic/Magdir/msdos
View File

@ -1,12 +1,12 @@
#------------------------------------------------------------------------------
# $File: msdos,v 1.111 2016/09/14 01:26:26 christos Exp $
# $File: msdos,v 1.120 2017/08/13 00:21:47 christos Exp $
# msdos: file(1) magic for MS-DOS files
#
# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
# updated by Joerg Jenderek at Oct 2008,Apr 2011
0 string/t @
0 string/t @
>1 string/cW \ echo\ off DOS batch file text
!:mime text/x-msdos-batch
>1 string/cW echo\ off DOS batch file text
@ -230,7 +230,7 @@
>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender
>>(8.s*16) string emx
>>>&1 string x for DOS, Win or OS/2, emx %s
>>&(&0x42.l-3) byte x
>>&(&0x42.l-3) byte x
>>>&0x26 string UPX \b, UPX compressed
# and yet another guess: small .text, and after large .data is unusal, could be 32lite
>>&0x2c search/0xa0 .text
@ -240,8 +240,8 @@
>(8.s*16) string $WdX \b, WDos/X DOS extender
# By now an executable type should have been printed out. The executable
# may be a self-uncompressing archive, so look for evidence of that and
# print it out.
# may be a self-uncompressing archive, so look for evidence of that and
# print it out.
#
# Some signatures below from Greg Roelofs, newt@uchicago.edu.
#
@ -283,8 +283,8 @@
# Skip to the end of the EXE. This will usually work fine in the PE case
# because the MZ image is hardcoded into the toolchain and almost certainly
# won't match any of these signatures.
>(4.s*512) long x
>>&(2.s-517) byte x
>(4.s*512) long x
>>&(2.s-517) byte x
>>>&0 string PK\3\4 \b, ZIP self-extracting archive
>>>&0 string Rar! \b, RAR self-extracting archive
>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive
@ -312,71 +312,77 @@
# only version=0x100 found
>3 uleshort x \b, version 0x%x
# length of string containing author,info and special characters
>6 ubyte >0
>6 ubyte >0
#>>6 pstring x \b, name=%s
>>7 string >\0 \b, author=%-.14s
>>7 search/254 \xff \b, info=
#>>>&0 string x \b%-s
>>>&0 string x \b%-.15s
# for FreeDOS *.KL files
# for FreeDOS *.KL files
0 string/b KLF FreeDOS KEYBoard Layout file
# only version=0x100 or 0x101 found
>3 uleshort x \b, version 0x%x
# stringlength
>5 ubyte >0
>5 ubyte >0
>>8 string x \b, name=%-.2s
0 string \xffKEYB\ \ \ \0\0\0\0
0 string \xffKEYB\ \ \ \0\0\0\0
>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file
# DOS device driver updated by Joerg Jenderek at May 2011
# http://maben.homeip.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
0 ulequad&0x07a0ffffffff 0xffffffff DOS executable (
>40 search/7 UPX! \bUPX compressed
# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017
# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
0 ulequad&0x07a0ffffffff 0xffffffff
>0 use msdos-driver
0 name msdos-driver DOS executable (
#!:mime application/octet-stream
!:mime application/x-dosdriver
# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN
!:ext sys/dev/bin
>40 search/7 UPX! \bUPX compressed
# DOS device driver attributes
>4 uleshort&0x8000 0x0000 \bblock device driver
# character device
>4 uleshort&0x8000 0x8000 \b
>>4 uleshort&0x0008 0x0008 \bclock
>>4 uleshort&0x0008 0x0008 \bclock
# fast video output by int 29h
>>4 uleshort&0x0010 0x0010 \bfast
>>4 uleshort&0x0010 0x0010 \bfast
# standard input/output device
>>4 uleshort&0x0003 >0 \bstandard
>>4 uleshort&0x0003 >0 \bstandard
>>>4 uleshort&0x0001 0x0001 \binput
>>>4 uleshort&0x0003 0x0003 \b/
>>>4 uleshort&0x0002 0x0002 \boutput
>>>4 uleshort&0x0002 0x0002 \boutput
>>4 uleshort&0x8000 0x8000 \bcharacter device driver
>0 ubyte x
>0 ubyte x
# upx compressed device driver has garbage instead of real in name field of header
>>40 search/7 UPX!
>>40 default x
>>40 search/7 UPX!
>>40 default x
# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped
>>>12 ubyte >0x27 \b
>>>>10 ubyte >0x20
>>>>>10 ubyte !0x2E
>>>12 ubyte >0x2E \b
>>>>10 ubyte >0x20
>>>>>10 ubyte !0x2E
>>>>>>10 ubyte !0x2A \b%c
>>>>11 ubyte >0x20
>>>>11 ubyte >0x20
>>>>>11 ubyte !0x2E \b%c
>>>>12 ubyte >0x20
>>>>>12 ubyte !0x39
>>>>12 ubyte >0x20
>>>>>12 ubyte !0x39
>>>>>>12 ubyte !0x2E \b%c
>>>13 ubyte >0x20
>>>13 ubyte >0x20
>>>>13 ubyte !0x2E \b%c
>>>>14 ubyte >0x20
>>>>14 ubyte >0x20
>>>>>14 ubyte !0x2E \b%c
>>>>15 ubyte >0x20
>>>>15 ubyte >0x20
>>>>>15 ubyte !0x2E \b%c
>>>>16 ubyte >0x20
>>>>>16 ubyte !0x2E
>>>>16 ubyte >0x20
>>>>>16 ubyte !0x2E
>>>>>>16 ubyte <0xCB \b%c
>>>>17 ubyte >0x20
>>>>>17 ubyte !0x2E
>>>>17 ubyte >0x20
>>>>>17 ubyte !0x2E
>>>>>>17 ubyte <0x90 \b%c
# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field
>>>4 uleshort&0x8000 0x8000
>>>>12 ubyte <0x2F
>>>12 ubyte <0x2F
# they have their real name at offset 22
>>>>>22 string >\0 \b%-.5s
>4 uleshort&0x8000 0x0000
# also block device drivers like DUMBDRV.SYS
>>>>22 string >\056 %-.6s
>4 uleshort&0x8000 0x0000
# 32 bit sector addressing ( > 32 MB) for block devices
>>4 uleshort&0x0002 0x0002 \b,32-bit sector-
# support by driver functions 13h, 17h, 18h
@ -384,33 +390,42 @@
# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh
>4 uleshort&0x0800 0x0800 \b,close media-
# output until busy support by int 10h for character device driver
>4 uleshort&0x8000 0x8000
>4 uleshort&0x8000 0x8000
>>4 uleshort&0x2000 0x2000 \b,until busy-
# direct read/write support by driver functions 03h,0Ch
>4 uleshort&0x4000 0x4000 \b,control strings-
>4 uleshort&0x8000 0x8000
>4 uleshort&0x8000 0x8000
>>4 uleshort&0x6840 >0 \bsupport
>4 uleshort&0x8000 0x0000
>4 uleshort&0x8000 0x0000
>>4 uleshort&0x4842 >0 \bsupport
>0 ubyte x \b)
# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
# Too weak, matches files that only contain 0's
#0 ulequad&0x000007a0ffffffed 0x0000000000000000 DOS-executable (
#>4 uleshort&0x8000 0x8000 \bcharacter device driver
#>>10 string x %-.8s
#>4 uleshort&0x4000 0x4000 \b,control strings-support)
# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
0 ulequad 0x0513c00000000012
>0 use msdos-driver
# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field
0 ulequad 0x32f28000ffff0016
>0 use msdos-driver
0 ulequad 0x007f00000000ffff
>0 use msdos-driver
0 ulequad 0x001600000000ffff
>0 use msdos-driver
# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field
0 ulequad 0x0bf708c2ffffffff
>0 use msdos-driver
0 ulequad 0x07bd08c2ffffffff
>0 use msdos-driver
# updated by Joerg Jenderek
# GRR: line below too general as it catches also
# GRR: line below too general as it catches also
# rt.lib DYADISKS.PIC and many more
# start with assembler instruction MOV
0 ubyte 0x8c
0 ubyte 0x8c
# skip "AppleWorks word processor data" like ARTICLE.1 ./apple
>4 string !O====
>4 string !O====
# skip some unknown basic binaries like RocketRnger.SHR
>>5 string !MAIN
>>5 string !MAIN
# skip "GPG symmetrically encrypted data" ./gnu
# skip "PGP symmetric key encrypted data" ./pgp
# skip "PGP symmetric key encrypted data" ./pgp
# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type
>>>4 ubyte >13 DOS executable (COM, 0x8C-variant)
# the remaining files should be DOS *.COM executables
@ -428,7 +443,7 @@
# updated by Joerg Jenderek at Oct 2008
0 ulelong 0xffff10eb DR-DOS executable (COM)
# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb
0 ubeshort&0xeb8d >0xeb00
0 ubeshort&0xeb8d >0xeb00
# DR-DOS STACKER.COM SCREATE.SYS missed
0 name msdos-com
@ -463,9 +478,9 @@
# updated by Joerg Jenderek at Oct 2008,2015
# following line is too general
0 ubyte 0xb8
0 ubyte 0xb8
# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux
>0 string !\xb8\xc0\x07\x8e
>0 string !\xb8\xc0\x07\x8e
# modified by Joerg Jenderek
# syslinux COM32 or COM32R executable
>>1 lelong&0xFFFFFFFe 0x21CD4CFe COM executable (32-bit COMBOOT
@ -496,8 +511,8 @@
#!:mime application/x-msdos-program
!:ext com
0 string/b \x81\xfc
>4 string \x77\x02\xcd\x20\xb9
0 string/b \x81\xfc
>4 string \x77\x02\xcd\x20\xb9
>>36 string UPX! FREE-DOS executable (COM), UPX compressed
252 string Must\ have\ DOS\ version DR-DOS executable (COM)
# added by Joerg Jenderek at Oct 2008
@ -514,10 +529,10 @@
#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
5 string \xcd\x21 COM executable for DOS
#DELTMP.COm HASFAT32.cOM
7 string \xcd\x21
7 string \xcd\x21
>0 byte !0xb8 COM executable for DOS
#COMP.cOM MORE.COm
10 string \xcd\x21
10 string \xcd\x21
>5 string !\xcd\x21 COM executable for DOS
#comecho.com
13 string \xcd\x21 COM executable for DOS
@ -565,10 +580,23 @@
0 string/b PO^Q` Microsoft Word 6.0 Document
!:mime application/msword
#
0 string/b \376\067\0\043 Microsoft Office Document
4 long 0
>0 belong 0xfe320000 Microsoft Word for Macintosh 1.0
!:mime application/msword
0 string/b \333\245-\0\0\0 Microsoft Office Document
!:ext mcw
>0 belong 0xfe340000 Microsoft Word for Macintosh 3.0
!:mime application/msword
!:ext mcw
>0 belong 0xfe37001c Microsoft Word for Macintosh 4.0
!:mime application/msword
!:ext mcw
>0 belong 0xfe370023 Microsoft Word for Macintosh 5.0
!:mime application/msword
!:ext mcw
0 string/b \333\245-\0\0\0 Microsoft Word 2.0 Document
!:mime application/msword
!:ext doc
512 string/b \354\245\301 Microsoft Word Document
!:mime application/msword
@ -599,11 +627,11 @@
# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf
# Note: newer Lotus versions >2 use longer BOF record
# record type (BeginningOfFile=0000h) + length (001Ah)
0 belong 0x00001a00
0 belong 0x00001a00
# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3
#>18 uleshort&0x73E0 0
#>18 uleshort&0x73E0 0
# Lotus Multi Byte Character Set (LMBCS=1-31)
>20 ubyte >0
>20 ubyte >0
>>20 ubyte <32 Lotus 1-2-3
#!:mime application/x-123
!:mime application/vnd.lotus-1-2-3
@ -640,10 +668,10 @@
!:ext fXX
# main revision number
>>>>4 uleshort x \b, revision 0x%x
>>>6 uleshort =0x0004 \b, cell range
>>>6 uleshort =0x0004 \b, cell range
# active cellcoord range (start row, page,column ; end row, page, column)
# start values normally 0~1st sheet A1
>>>>8 ulelong !0
>>>>8 ulelong !0
>>>>>10 ubyte >0 \b%d*
>>>>>8 uleshort x \b%d,
>>>>>11 ubyte x \b%d-
@ -656,9 +684,9 @@
>>>>20 ubyte >1 \b, character set 0x%x
# flags
>>>>21 ubyte x \b, flags 0x%x
>>>6 uleshort !0x0004
>>>6 uleshort !0x0004
# record type (FONTNAME=00AEh)
>>>>30 search/29 \0\xAE
>>>>30 search/29 \0\xAE
# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n)
>>>>>&4 string >\0 \b, 1st font "%s"
#
@ -667,12 +695,12 @@
# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT
# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x
# record type (BeginningOfFile=0000h) + length (0002h)
0 belong 0x00000200
0 belong 0x00000200
# GRR: line above is too general as it catches also MS Windows CURsor
# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1)
!:strength -1
# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h
>7 ubyte 0
>7 ubyte 0
# skip Windows cursors with image width 256 and keep Lotus with positiv opcode
>>6 ubyte >0 Lotus
# !:mime application/x-123
@ -737,9 +765,9 @@
# check and then display Lotus worksheet cells range
0 name lotus-cells
# look for type (RANGE=0006h) + length (0008h) at record begin
>0 ubelong 0x06000800 \b, cell range
>0 ubelong 0x06000800 \b, cell range
# cell range (start column, row, end column, row) start values normally 0,0~A1 cell
>>4 ulong !0
>>4 ulong !0
>>>4 uleshort x \b%d,
>>>6 uleshort x \b%d-
# end of cell range
@ -792,19 +820,19 @@
# Windows icons
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
# Note: similiar to Windows CURsor. container for BMP (only DIB part) or PNG
# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG
0 belong 0x00000100
>9 byte 0
>>0 byte x
>>0 byte x
>>0 use cur-ico-dir
>9 ubyte 0xff
>>0 byte x
>>0 byte x
>>0 use cur-ico-dir
# displays number of icons and information for icon or cursor
0 name cur-ico-dir
# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with
# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h
>18 ulelong &0x00000006
>18 ulelong &0x00000006
# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG)
>>(18.l) ulelong x MS Windows
>>>0 ubelong 0x00000100 icon resource
@ -817,7 +845,7 @@
# 1st icon
>>>>0x06 use ico-entry
# 2nd icon
>>>>4 uleshort >1
>>>>4 uleshort >1
>>>>>0x16 use ico-entry
>>>0 ubelong 0x00000200 cursor resource
#!:mime image/x-cur
@ -854,16 +882,16 @@
# offset of PNG or DIB image
#>12 ulelong x \b, offset 0x%x
# PNG header (\x89PNG)
>(12.l) ubelong =0x89504e47
>>&-4 indirect x \b with
>(12.l) ubelong =0x89504e47
>>&-4 indirect x \b with
# DIB image
>(12.l) ubelong !0x89504e47
>(12.l) ubelong !0x89504e47
#>>&-4 use dib-image
# Windows non-animated cursors
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
# Note: similiar to Windows ICOn. container for BMP ( only DIB part)
# Note: similar to Windows ICOn. container for BMP ( only DIB part)
# GRR: line below is too general as it catches also Lotus 1-2-3 files
0 belong 0x00000200
>9 byte 0
@ -872,13 +900,13 @@
>>0 use cur-ico-dir
# .chr files
0 string/b PK\010\010BGI Borland font
0 string/b PK\010\010BGI Borland font
>4 string >\0 %s
# then there is a copyright notice
# .bgi files
0 string/b pk\010\010BGI Borland device
0 string/b pk\010\010BGI Borland device
>4 string >\0 %s
# then there is a copyright notice
@ -909,7 +937,7 @@
0 lelong 0x08086b70 TurboC BGI file
0 lelong 0x08084b50 TurboC Font file
# Debian#712046: The magic below identifies "Delphi compiled form data".
# Debian#712046: The magic below identifies "Delphi compiled form data".
# An additional source of information is available at:
# http://www.woodmann.com/fravia/dafix_t1.htm
0 string TPF0
@ -918,7 +946,7 @@
# tests for DBase files moved, updated and merged to database
0 string PMCC Windows 3.x .GRP file
1 string RDC-meg MegaDots
1 string RDC-meg MegaDots
>8 byte >0x2F version %c
>9 byte >0x2F \b.%c file
0 lelong 0x4C
@ -935,16 +963,16 @@
#>0x181 leshort x \b, offset %x
#>0x183 leshort x \b, offsetdata %x
#>0x185 leshort x \b, section length %x
>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0
>>&0x5e ubyte >0
>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0
>>&0x5e ubyte >0
>>>&-1 string <PIFMGR.DLL \b, icon=%s
#>>>&-1 string PIFMGR.DLL \b, icon=%s
>>>&-1 string >PIFMGR.DLL \b, icon=%s
>>&0xF0 ubyte >0
>>&0xF0 ubyte >0
>>>&-1 string <Terminal \b, font=%.32s
#>>>&-1 string =Terminal \b, font=%.32s
>>>&-1 string >Terminal \b, font=%.32s
>>&0x110 ubyte >0
>>&0x110 ubyte >0
>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s
#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s
>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s
@ -960,6 +988,7 @@
# DOS EPS Binary File Header
# From: Ed Sznyter <ews@Black.Market.NET>
0 belong 0xC5D0D3C6 DOS EPS Binary File
!:mime image/x-eps
>4 long >0 Postscript starts at byte %d
>>8 long >0 length %d
>>>12 long >0 Metafile starts at byte %d
@ -967,15 +996,15 @@
>>>20 long >0 TIFF starts at byte %d
>>>>24 long >0 length %d
# TNEF magic From "Joomy" <joomy@se-ed.net>
# TNEF magic From "Joomy" <joomy@se-ed.net>
# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
0 leshort 0x223e9f78 TNEF
0 lelong 0x223e9f78 TNEF
!:mime application/vnd.ms-tnef
# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C
# of http://www.davep.org/norton-guides/ng2h-105.tgz
# http://en.wikipedia.org/wiki/Norton_Guides
0 string NG\0\001
0 string NG\0\001
# only value 0x100 found at offset 2
>2 ulelong 0x00000100 Norton Guide
# Title[40]
@ -985,7 +1014,7 @@
>>48 string >\0 \b, %-.66s
>>114 string >\0 %-.66s
# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
# of http://www.4dos.info/
# pointer,HelpID[8]=4DHnnnmm
0 ulelong 0x48443408 4DOS help file
@ -1033,7 +1062,7 @@
# Windows Enhanced Metafile (EMF)
# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
# for further information.
0 ulelong 1
>40 string \ EMF Windows Enhanced Metafile (EMF) image data
@ -1095,7 +1124,7 @@
0 string/b MSWIM\000\000\000 Windows imaging (WIM) image
0 string/b WLPWM\000\000\000 Windows imaging (WIM) image, wimlib pipable format
# The second byte of these signatures is a file version; I don't know what,
# The second byte of these signatures is a file version; I don't know what,
# if anything, produced files with version numbers 0-2.
# From: John Elliott <johne@seasip.demon.co.uk>
0 string \xfc\x03\x00 Mallard BASIC program data (v1.11)
@ -1106,3 +1135,66 @@
0 string MIOPEN Mallard BASIC Jetsam data
0 string Jetsam0 Mallard BASIC Jetsam index data
# DOS backup 2.0 to 3.2
# backupid.@@@
# plausibility check for date
0x3 ushort >1979
>0x5 ubyte-1 <31
>>0x6 ubyte-1 <12
# actually 121 nul bytes
>>>0x7 string \0\0\0\0\0\0\0\0
>>>>0x1 ubyte x DOS 2.0 backup id file, sequence %d
!:ext @@@
>>>>0x0 ubyte 0xff \b, last disk
# backed up file
# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd
# by looking for trailing nul of maximal file name string
0x52 ubyte 0
# test for flag byte: FFh~complete file, 00h~split file
# FFh -127 = -1 -127 = -128
# 00h -127 = 0 -127 = -127
>0 byte-127 <-126
# plausibility check for file name length
>>0x53 ubyte-1 <78
# looking for terminating nul of file name string
>>>(0x53.b+4) ubyte 0
# looking if last char of string is valid DOS file name
>>>>(0x53.b+3) ubyte >0x1F
# actually 44 nul bytes
# but sometimes garbage according to Ralf Quint. So can not be used as test
#>0x54 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator
# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE
>>>>>5 ubyte&0x8C 0x0C
# ./msdos (version 5.30) labeled the entry as
# "DOS 2.0 backed up file %s, split file, sequence %d" or
# "DOS 2.0 backed up file %s, complete file"
>>>>>>0 ubyte x DOS 2.0-3.2 backed up
#>>>>>>0 ubyte 0xff complete
>>>>>>0 ubyte 0
>>>>>>>1 uleshort x sequence %d of
# full file name with path but without drive letter and colon stored from 0x05 til 0x52
>>>>>>0x5 string x file %s
# backup name is original filename
#!:ext *
# magic/Magdir/msdos, 1169: Warning: EXTENSION type ` *' has bad char '*'
# file: line 1169: Bad magic entry ' *'
# after header original file content
>>>>>>128 indirect x \b;
# DOS backup 3.3 to 5.x
# CONTROL.nnn files
0 string \x8bBACKUP\x20
# actually 128 nul bytes
>0xa string \0\0\0\0\0\0\0\0
>>0x9 ubyte x DOS 3.3 backup control file, sequence %d
>>0x8a ubyte 0xff \b, last disk
# NB: The BACKUP.nnn files consist of the files backed up,
# concatenated.

15
contrib/file/magic/Magdir/msvc
View File

@ -1,10 +1,10 @@
#------------------------------------------------------------------------------
# $File: msvc,v 1.6 2016/01/26 00:03:19 christos Exp $
# $File: msvc,v 1.9 2017/08/02 08:15:20 christos Exp $
# msvc: file(1) magic for msvc
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Microsoft visual C
#
#
# I have version 1.0
# .aps
@ -30,10 +30,10 @@
# Summary: Symbol Table / Debug info used by Microsoft compilers
# URL: https://en.wikipedia.org/wiki/Program_database
# Reference: https://code.google.com/p/pdbparser/wiki/MSF_Format
# Update: Joerg Jenderek
# Update: Joerg Jenderek
# Note: test only for Windows XP+SP3 x86 , 8.1 x64 arm and 10.1 x86
# info does only applies partly for older files like msvbvm50.pdb about year 2001
0 string Microsoft\ C/C++\
0 string Microsoft\ C/C++\040
# "Microsoft Program DataBase" by TrID
>24 search/14 \r\n\x1A MSVC program database
!:mime application/x-ms-pdb
@ -42,18 +42,21 @@
>>16 regex \([0-9.]+\) ver %s
#>>>0x38 search/128123456 /LinkInfo \b with linkinfo
# "MSF 7.00" variant
>>0x1e leshort 0
>>0x1e leshort 0
# PageSize 400h 1000h
>>>0x20 lelong x \b, %d
# Page Count
>>>0x28 lelong x \b*%d bytes
# "program database 2.00" variant
>>0x1e leshort !0
>>0x1e leshort !0
# PageSize 400h
>>>0x2c lelong x \b, %d
# Page Count for msoo-dll.pdb 4379h
>>>0x32 leshort x \b*%d bytes
# Reference: https://github.com/Microsoft/vstest/pull/856/commits/fdc7a9f074ca5a8dfeec83b1be9162bf0cf4000d
0 string/c bsjb\001\000\001\000\000\000\000\000\f\000\000\000pdb\ v1.0 Microsoft Rosyln C# debugging symbols version 1.0
#.sbr
0 string \000\002\000\007\000 MSVC .sbr
>5 string >\0 %s

22
contrib/file/magic/Magdir/msx
View File

@ -7,7 +7,7 @@
############## MSX Music file formats ##############
# Gigamix MGSDRV music file
0 string/b MGS MSX Gigamix MGSDRV3 music file,
0 string/b MGS MSX Gigamix MGSDRV3 music file,
>6 ubeshort 0x0D0A
>>3 byte x \bv%c
>>4 byte x \b.%c
@ -35,7 +35,7 @@
>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+)
>>0xF byte&0x02 0x02 \b, soundchips: SN76489
>>>0xF byte&0x04 0x04 stereo
>>0xF byte&0x01 0x01 \b,
>>0xF byte&0x01 0x01 \b,
>>>0xF byte&0x18 0x00 \bYM2413
>>>0xF byte&0x18 0x08 \bYM2413, Y8950
>>>0xF byte&0x18 0x18 \bYM2413+Y8950 pseudostereo
@ -245,18 +245,18 @@
0x4000 string/b AB
>0x4002 uleshort >0x400F
>>0x400A string \0\0\0\0\0\0 MSX ROM with nonstandard page order
>>0x4002 uleshort x \b, init=0x%04x
>>0x4004 uleshort >0 \b, stahdl=0x%04x
>>0x4006 uleshort >0 \b, devhdl=0x%04x
>>0x4008 uleshort >0 \b, bas=0x%04x
>>>0x4002 uleshort x \b, init=0x%04x
>>>0x4004 uleshort >0 \b, stahdl=0x%04x
>>>0x4006 uleshort >0 \b, devhdl=0x%04x
>>>0x4008 uleshort >0 \b, bas=0x%04x
0x8000 string/b AB
>0x8002 uleshort >0x400F
>>0x800A string \0\0\0\0\0\0 MSX ROM with nonstandard page order
>>0x8002 uleshort x \b, init=0x%04x
>>0x8004 uleshort >0 \b, stahdl=0x%04x
>>0x8006 uleshort >0 \b, devhdl=0x%04x
>>0x8008 uleshort >0 \b, bas=0x%04x
>>>0x8002 uleshort x \b, init=0x%04x
>>>0x8004 uleshort >0 \b, stahdl=0x%04x
>>>0x8006 uleshort >0 \b, devhdl=0x%04x
>>>0x8008 uleshort >0 \b, bas=0x%04x
0x3C000 string/b AB
@ -296,7 +296,7 @@
4 uleshort 0x0900
>0xF byte 1
>>0x14 byte 0
>>>0x1E string \ \ \
>>>0x1E string \040\040\040
>>>>0x23 byte 1
>>>>>0x25 byte 0
>>>>>>0x15 string >\x30

14
contrib/file/magic/Magdir/mup
View File

@ -1,6 +1,6 @@
# ------------------------------------------------------------------------
# $File: mup,v 1.4 2009/09/19 16:28:11 christos Exp $
# $File: mup,v 1.5 2017/03/17 21:35:28 christos Exp $
# mup: file(1) magic for Mup (Music Publisher) input file.
#
# From: Abel Cheung <abel (@) oaka.org>
@ -12,13 +12,13 @@
#
0 search/1 //!Mup Mup music publication program input text
>6 string -Arkkra (Arkkra)
>>13 string -
>>>16 string .
>>13 string -
>>>16 string .
>>>>14 string x \b, need V%.4s
>>>15 string .
>>>15 string .
>>>>14 string x \b, need V%.3s
>6 string -
>>9 string .
>6 string -
>>9 string .
>>>7 string x \b, need V%.4s
>>8 string .
>>8 string .
>>>7 string x \b, need V%.3s

2
contrib/file/magic/Magdir/nasa
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# nasa: file(1) magic
# nasa: file(1) magic
# From: Barry Carter <carter.barry@gmail.com>
0 string DAF/SPK NASA SPICE file (binary format)

22
contrib/file/magic/Magdir/netbsd
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: netbsd,v 1.23 2015/11/29 01:55:14 christos Exp $
# $File: netbsd,v 1.24 2017/03/17 21:35:28 christos Exp $
# netbsd: file(1) magic for NetBSD objects
#
# All new-style magic numbers are in network byte order.
@ -10,7 +10,7 @@
#
0 belong&0377777777 041400413 a.out NetBSD/i386 demand paged
>0 byte &0x80
>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
@ -32,7 +32,7 @@
>32 lelong !0 (signal %d)
0 belong&0377777777 041600413 a.out NetBSD/m68k demand paged
>0 byte &0x80
>0 byte &0x80
>>20 belong <8192 shared library
>>20 belong =8192 dynamically linked executable
>>20 belong >8192 dynamically linked executable
@ -54,7 +54,7 @@
>32 belong !0 (signal %d)
0 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged
>0 byte &0x80
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
>>20 belong >4096 dynamically linked executable
@ -76,7 +76,7 @@
>32 belong !0 (signal %d)
0 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged
>0 byte &0x80
>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
@ -101,7 +101,7 @@
>12 string >\0 from '%s'
0 belong&0377777777 042400413 a.out NetBSD/SPARC demand paged
>0 byte &0x80
>0 byte &0x80
>>20 belong <8192 shared library
>>20 belong =8192 dynamically linked executable
>>20 belong >8192 dynamically linked executable
@ -123,7 +123,7 @@
>32 belong !0 (signal %d)
0 belong&0377777777 042600413 a.out NetBSD/pmax demand paged
>0 byte &0x80
>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
@ -145,7 +145,7 @@
>32 lelong !0 (signal %d)
0 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged
>0 byte &0x80
>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
@ -167,7 +167,7 @@
>32 lelong !0 (signal %d)
0 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged
>0 byte &0x80
>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
@ -189,7 +189,7 @@
>32 lelong !0 (signal %d)
# NetBSD/alpha does not support (and has never supported) a.out objects,
# so no rules are provided for them. NetBSD/alpha ELF objects are
# so no rules are provided for them. NetBSD/alpha ELF objects are
# dealt with in "elf".
0 lelong 0x00070185 ECOFF NetBSD/alpha binary
>10 leshort 0x0001 not stripped
@ -199,7 +199,7 @@
>32 lelong !0 (signal %d)
0 belong&0377777777 043400413 a.out NetBSD/mips demand paged
>0 byte &0x80
>0 byte &0x80
>>20 belong <8192 shared library
>>20 belong =8192 dynamically linked executable
>>20 belong >8192 dynamically linked executable

6
contrib/file/magic/Magdir/netscape
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: netscape,v 1.7 2015/08/24 05:20:52 christos Exp $
# $File: netscape,v 1.8 2017/03/17 21:35:28 christos Exp $
# netscape: file(1) magic for Netscape files
# "H. Nanosecond" <aldomel@ix.netcom.com>
# version 3 and 4 I think
@ -15,8 +15,8 @@
# .snm Caches
0 string #\ Netscape\ folder\ cache Netscape folder cache
0 string \000\036\204\220\000 Netscape folder cache
# .n2p
# Net 2 Phone
# .n2p
# Net 2 Phone
#0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
0 string SX961999 Net2phone

4
contrib/file/magic/Magdir/nitpicker
View File

@ -1,9 +1,9 @@
#------------------------------------------------------------------------------
# $File: nitpicker,v 1.6 2014/04/30 21:41:02 christos Exp $
# $File: nitpicker,v 1.7 2017/03/17 21:35:28 christos Exp $
# nitpicker: file(1) magic for Flowfiles.
# From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de
0 string NPFF NItpicker Flow File
0 string NPFF NItpicker Flow File
>4 byte x V%d.
>5 byte x %d
>6 bedate x started: %s

8
contrib/file/magic/Magdir/os2
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: os2,v 1.9 2016/05/11 15:51:57 christos Exp $
# $File: os2,v 1.10 2017/03/17 21:35:28 christos Exp $
# os2: file(1) magic for OS/2 files
#
@ -25,7 +25,7 @@
#>5 string >\ (Local file) <%s>
# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com)
# Carl Hauser (chauser.parc@xerox.com) and
# Carl Hauser (chauser.parc@xerox.com) and
# Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
# list the following header format in inf02a.doc:
#
@ -35,11 +35,11 @@
# // bit 0: set if INF style file
# // bit 4: set if HLP style file
# // patching this byte allows reading HLP files
# // using the VIEW command, while help files
# // using the VIEW command, while help files
# // seem to work with INF settings here as well.
# int16 hdrsize; // total size of header
# int16 unknown2; // unknown purpose
#
#
0 string HSP\x01\x9b\x00 OS/2 INF
>107 string >0 (%s)
0 string HSP\x10\x9b\x00 OS/2 HLP

4
contrib/file/magic/Magdir/os9
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: os9,v 1.7 2011/05/13 22:15:54 christos Exp $
# $File: os9,v 1.8 2017/03/17 21:35:28 christos Exp $
#
# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
#
@ -15,7 +15,7 @@
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;

8
contrib/file/magic/Magdir/pbf
View File

@ -1,11 +1,11 @@
#------------------------------------------------------------------------------
# $File: pbf,v 1.1 2013/12/21 14:27:24 christos Exp $
# $File: pbf,v 1.2 2017/01/18 16:16:21 christos Exp $
# file(1) magic(5) data for OpenStreetMap
# OpenStreetMap Protocolbuffer Binary Format (.osm.pbf)
# http://wiki.openstreetmap.org/wiki/PBF_Format
# From: Markus Heidelberg <markus.heidelberg@web.de>
0 belong 0x0000000D
>4 beshort 0x0A09
>>6 string OSMHeader OpenStreetMap Protocolbuffer Binary Format
0 belong&0xfffffff0 0
>4 beshort 0x0A09
>>6 string OSMHeader OpenStreetMap Protocolbuffer Binary Format

2
contrib/file/magic/Magdir/pc88
View File

@ -9,7 +9,7 @@
>>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
>>>0x1A ubyte&0xEF 0
>>>>0x1B ubyte&0x8F 0
>>>>>0x1B ubyte&70 <0x40
>>>>>0x1B ubyte&70 <0x40
>>>>>>0x1C ulelong >0x21
>>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s
>>>>>>>>0x1B ubyte 0 \b, media=2D

2
contrib/file/magic/Magdir/pc98
View File

@ -8,7 +8,7 @@
# http://www.jisyo.com/viewer/faq/maki_tech.htm
0 string/b MAKI01 Maki-chan v1.
>6 ubyte|0x20 x \b%c image
>8 ubelong >0x40404040 \b, system ID:
>8 ubelong >0x40404040 \b, system ID:
>>8 byte x %c
>>9 byte x \b%c
>>10 byte x \b%c

7
contrib/file/magic/Magdir/pdf
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: pdf,v 1.8 2015/01/11 18:19:18 christos Exp $
# $File: pdf,v 1.9 2017/05/24 17:35:20 christos Exp $
# pdf: file(1) magic for Portable Document Format
#
@ -20,3 +20,8 @@
!:mime application/vnd.fdf
>5 byte x \b, version %c
>7 byte x \b.%c
0 search/256 %PDF- PDF document
!:mime application/pdf
>&0 byte x \b, version %c
>&2 byte x \b.%c

6
contrib/file/magic/Magdir/pdp
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: pdp,v 1.10 2014/04/30 21:41:02 christos Exp $
# $File: pdp,v 1.11 2017/03/17 21:35:28 christos Exp $
# pdp: file(1) magic for PDP-11 executable/object and APL workspace
#
0 lelong 0101555 PDP-11 single precision APL workspace
@ -14,8 +14,8 @@
# updated by Joerg Jenderek at Mar 2013
# GRR: line below too general as it catches also Windows precompiled setup information *.PNF
0 leshort 0401
# skip *.PNF with WinDirPathOffset 58h
0 leshort 0401
# skip *.PNF with WinDirPathOffset 58h
>68 ulelong !0x00000058 PDP-11 UNIX/RT ldp
# skip *.PNF with high byte of InfVersionDatumCount zero
#>>15 byte !0 PDP-11 UNIX/RT ldp

10
contrib/file/magic/Magdir/perl
View File

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: perl,v 1.25 2016/06/07 23:28:37 rrt Exp $
# $File: perl,v 1.26 2017/02/21 18:34:55 christos Exp $
# perl: file(1) magic for Larry Wall's perl language.
#
# The `eval' lines recognizes an outrageously clever hack.
@ -33,14 +33,14 @@
# by Dmitry V. Levin and Alexey Tourbin
# check the first line
0 search/1024 package
0 search/8192 package
>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text
!:strength + 10
!:strength + 40
# not 'p', check other lines
0 search/1024 !p
0 search/8192 !p
>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *;
>>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text
!:strength + 10
!:strength + 75
# Perl POD documents
# From: Tom Hukins <tom@eborcom.com>

4
contrib/file/magic/Magdir/pgf
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: pgf,v 1.1 2013/04/22 15:19:49 christos Exp $
# $File: pgf,v 1.2 2017/03/17 21:35:28 christos Exp $
# pgf: file(1) magic for Progressive Graphics File (PGF)
#
# <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf>
@ -42,7 +42,7 @@
>>20 byte 19 RGB color 12,
>>20 byte 20 RGB color 16,
>>20 byte 255 unknown format,
>>20 default x format
>>20 default x format
>>>20 byte x \b %d,
>>21 byte x %d bpc
# PGFPostHeader

26
contrib/file/magic/Magdir/pgp
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: pgp,v 1.12 2016/10/07 20:22:12 christos Exp $
# $File: pgp,v 1.14 2017/03/17 21:35:28 christos Exp $
# pgp: file(1) magic for Pretty Good Privacy
# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
#
@ -19,15 +19,15 @@
#>15 string SIGNED\040MESSAGE- signed message
#>15 string PGP\040SIGNATURE- signature
2 string ---BEGIN\ PGP\ PUBLIC\ KEY\ BLOCK- PGP public key block
2 string ---BEGIN\040PGP\040PUBLIC\040KEY\040BLOCK- PGP public key block
!:mime application/pgp-keys
>10 search/100 \n\n
>>&0 use pgp
0 string -----BEGIN\040PGP\40MESSAGE- PGP message
0 string -----BEGIN\040PGP\040MESSAGE- PGP message
!:mime application/pgp
>10 search/100 \n\n
>>&0 use pgp
0 string -----BEGIN\040PGP\40SIGNATURE- PGP signature
0 string -----BEGIN\040PGP\040SIGNATURE- PGP signature
!:mime application/pgp-signature
>10 search/100 \n\n
>>&0 use pgp
@ -77,7 +77,7 @@
>0 byte 0x30
>>1 byte&0xc0 0x00 Unused [0%x]
>>1 byte&0xc0 0x40 User Attribute
>>1 byte&0xc0 0x80 Sym. Encrypted and Integrity Protected Data
>>1 byte&0xc0 0x80 Sym. Encrypted and Integrity Protected Data
>>1 byte&0xc0 0xc0 Modification Detection Code
# magic signatures to detect PGP crypto material (from stef)
@ -206,7 +206,7 @@
>0 byte 19 ECDSA
>0 byte 20 ElGamal (Encrypt or Sign)
>0 byte 21 Diffie-Hellman
>0 default x
>0 default x
>>0 ubyte <22 unknown (pub %d)
# this should never happen
>>0 ubyte >21 invalid (%d)
@ -482,16 +482,16 @@
>1 use pgpkey
0 byte 0x97 PGP Secret Sub-key -
>1 use pgpkey
0 byte 0x9d
0 byte 0x9d
# Update: Joerg Jenderek
# secret subkey packet (tag 7) with same structure as secret key packet (tag 5)
# skip Fetus.Sys16 CALIBUS.MAIN OrbFix.Sys16.Ex by looking for positive len
>1 ubeshort >0
>1 ubeshort >0
#>1 ubeshort x \b, body length 0x%x
# next packet type often 88h,89h~(tag 2)~Signature Packet
#>>(1.S+3) ubyte x \b, next packet type 0x%x
# skip Dragon.SHR DEMO.INIT by looking for positive version
>>3 ubyte >0
>>3 ubyte >0
# skip BUISSON.13 GUITAR1 by looking for low version number
>>>3 ubyte <5 PGP Secret Sub-key
# sub-key are normally part of secret key. So it does not occur as standalone file
@ -500,7 +500,7 @@
>>>>3 ubyte x (v%d)
>>>>3 ubyte x -
# old versions 2 or 3 but no real example found
>>>>3 ubyte <4
>>>>3 ubyte <4
# 2 byte for key bits in version 5.28 look
>>>>>11 ubeshort x %db
>>>>>4 beldate x created on %s -
@ -508,15 +508,15 @@
#>>>>>8 ubeshort x 0x%x
# display key algorithm 1~RSA Encrypt|Sign - 21~Diffie-Hellman
>>>>>10 use key_algo
>>>>>(11.S/8) ubequad x
>>>>>(11.S/8) ubequad x
# look after first key
>>>>>>&5 use keyend
# new version
>>>>3 ubyte >3
>>>>3 ubyte >3
>>>>>9 ubeshort x %db
>>>>>4 beldate x created on %s -
# display key algorithm
>>>>>8 use key_algo
>>>>>(9.S/8) ubequad x
>>>>>(9.S/8) ubequad x
# look after first key for something like s2k
>>>>>>&3 use keyend

22
contrib/file/magic/Magdir/printer
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: printer,v 1.26 2014/04/12 14:51:52 christos Exp $
# $File: printer,v 1.28 2017/03/17 22:20:22 christos Exp $
# printer: file(1) magic for printer-formatted files
#
@ -13,7 +13,7 @@
>>>15 string EPS \b, type %s
>>>15 string Query \b, type %s
>>>15 string ExitServer \b, type %s
>>>15 search/1000 %%LanguageLevel:\
>>>15 search/1000 %%LanguageLevel:\040
>>>>&0 string >\0 \b, Level %s
# Some PCs have the annoying habit of adding a ^D as a document separator
0 string \004%! PostScript document text
@ -24,7 +24,7 @@
>>>16 string EPS \b, type %s
>>>16 string Query \b, type %s
>>>16 string ExitServer \b, type %s
>>>16 search/1000 %%LanguageLevel:\
>>>16 search/1000 %%LanguageLevel:\040
>>>>&0 string >\0 \b, Level %s
0 string \033%-12345X%!PS PostScript document
@ -49,18 +49,18 @@
# HP Printer Job Language
0 string \033%-12345X@PJL HP Printer Job Language data
# HP Printer Job Language
# The header found on Win95 HP plot files is the "Silliest Thing possible"
# The header found on Win95 HP plot files is the "Silliest Thing possible"
# (TM)
# Every driver puts the language at some random position, with random case
# (LANGUAGE and Language)
# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
#
#
0 string \033%-12345X@PJL HP Printer Job Language data
>&0 string >\0 %s
>>&0 string >\0 %s
>>>&0 string >\0 %s
>>>>&0 string >\0 %s
>&0 string >\0 %s
>>&0 string >\0 %s
>>>&0 string >\0 %s
>>>>&0 string >\0 %s
#>15 string \ ENTER\ LANGUAGE\ =
#>31 string PostScript PostScript
@ -143,8 +143,8 @@
#------------------------------------------------------------------------------
# HP LaserJet 1000 series downloadable firmware file
0 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware
0 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware
# From: Paolo <oopla@users.sf.net>
# Epson ESC/Page, ESC/PageColor
# Epson ESC/Page, ESC/PageColor
0 string \x1b\x01@EJL Epson ESC/Page language printer data

4
contrib/file/magic/Magdir/project
View File

@ -1,8 +1,8 @@
#------------------------------------------------------------------------------
# $File: project,v 1.4 2009/09/19 16:28:11 christos Exp $
# $File: project,v 1.5 2017/03/17 21:35:28 christos Exp $
# project: file(1) magic for Project management
#
#
# Magic strings for ftnchek project files. Alexander Mai
0 string FTNCHEK_\ P project file for ftnchek
>10 string 1 version 2.7

4
contrib/file/magic/Magdir/psdbms
View File

@ -1,12 +1,12 @@
#------------------------------------------------------------------------------
# $File: psdbms,v 1.7 2016/01/08 00:41:02 christos Exp $
# $File: psdbms,v 1.8 2017/03/17 21:35:28 christos Exp $
# psdbms: file(1) magic for psdatabase
#
# Update: Joerg Jenderek
# GRR: line below too general as it catches also some Panorama database *.pan ,
# AppleWorks word processor
0 belong&0xff00ffff 0x56000000
0 belong&0xff00ffff 0x56000000
# assume version starts with digit
>1 regex/s =^[0-9] ps database
>>1 string >\0 version %s

38
contrib/file/magic/Magdir/python
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: python,v 1.29 2016/07/27 09:42:16 rrt Exp $
# $File: python,v 1.34 2017/08/14 07:40:38 christos Exp $
# python: file(1) magic for python
#
# Outlook puts """ too for urgent messages
@ -24,7 +24,11 @@
0 belong 0x6c0c0d0a python 3.2 byte-compiled
0 belong 0x9e0c0d0a python 3.3 byte-compiled
0 belong 0xee0c0d0a python 3.4 byte-compiled
0 belong 0x160d0d0a python 3.5 byte-compiled
0 belong 0x160d0d0a python 3.5.1- byte-compiled
0 belong 0x170d0d0a python 3.5.2+ byte-compiled
0 belong 0x330d0d0a python 3.6 byte-compiled
0 belong 0x3e0d0d0a python 3.7 byte-compiled
0 search/1/w #!\ /usr/bin/python Python script text executable
!:strength + 15
@ -41,12 +45,25 @@
# from module.submodule import func1, func2
0 regex \^from\\s+(\\w|\\.)+\\s+import.*$ Python script text executable
0 regex \^from[\040\t\f\r\n]+([A-Za-z0-9_]|\\.)+[\040\t\f\r\n]+import.*$ Python script text executable
!:strength + 15
!:mime text/x-python
# def __init__ (self, ...):
0 search/4096 def\ __init__
>&0 search/64 self Python script text executable
!:strength + 15
!:mime text/x-python
# if __name__ == "__main__":
0 search/4096 if\ __name__
>&0 search/64 '__main__' Python script text executable
>&0 search/64 "__main__" Python script text executable
!:strength + 15
!:mime text/x-python
# import module [as abrev]
0 regex \^import\ [_[:alpha:]]+\ as\ [[:alpha:]][[:space:]]*$ Python script text executable
!:mime text/x-python
# comments
@ -62,12 +79,19 @@
# except: or finally:
# block
0 search/4096 try:
>&0 regex \^\\s*except.*: Python script text executable
>&0 regex \^[[:space:]]*except.*:$ Python script text executable
!:strength + 15
!:mime text/x-python
>&0 search/4096 finally: Python script text executable
!:mime text/x-python
# def name(args, args):
0 regex \^(\ |\\t){0,50}def\ {1,50}[a-zA-Z]{1,100}
>&0 regex \ {0,50}\\(([a-zA-Z]|,|\ ){1,255}\\):$ Python script text executable
# class name[(base classes,)]: [pass]
0 regex \^class\ [_[:alpha:]]+(\\(.*\\))?(\ )*:([\ \t]+pass)?$ Python script text executable
!:strength + 15
!:mime text/x-python
# def name(*args, **kwargs):
0 regex \^[[:space:]]{0,50}def\ {1,50}[_a-zA-Z]{1,100}
>&0 regex \\(([[:alpha:]*_,\ ]){0,255}\\):$ Python script text executable
!:strength + 15
!:mime text/x-python

12
contrib/file/magic/Magdir/riff
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: riff,v 1.31 2015/02/14 17:30:03 christos Exp $
# $File: riff,v 1.32 2017/03/17 21:35:28 christos Exp $
# riff: file(1) magic for RIFF format
# See
#
@ -75,7 +75,7 @@
>>18 leshort x \b, %d entries
# RIFF Device Independent Bitmap format
>8 string RDIB \b, device-independent bitmap
>>16 string BM
>>16 string BM
>>>30 leshort 12 \b, OS/2 1.x format
>>>>34 leshort x \b, %d x
>>>>36 leshort x %d
@ -226,9 +226,9 @@
>8 string sfbk SoundFont/Bank
# MPEG-1 wrapped in a RIFF, apparently
>8 string CDXA \b, wrapped MPEG-1 (CDXA)
>8 string 4XMV \b, 4X Movie file
>8 string 4XMV \b, 4X Movie file
# AMV-type AVI file: http://wiki.multimedia.cx/index.php?title=AMV
>8 string AMV\040 \b, AMV
>8 string AMV\040 \b, AMV
>8 string WEBP \b, Web/P image
!:mime image/webp
>>12 use riff-walk
@ -246,7 +246,7 @@
>>18 beshort x \b, %d entries
# RIFF Device Independent Bitmap format
>8 string RDIB \b, device-independent bitmap
>>16 string BM
>>16 string BM
>>>30 beshort 12 \b, OS/2 1.x format
>>>>34 beshort x \b, %d x
>>>>36 beshort x %d
@ -284,7 +284,7 @@
#------------------------------------------------------------------------------
# Sony Wave64
# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf
# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian
# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian
0 string riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00 Sony Wave64 RIFF data
# 128 bit + total file size (64 bits) so 24 bytes
# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A }

37
contrib/file/magic/Magdir/ruby
View File

@ -1,32 +1,51 @@
#------------------------------------------------------------------------------
# $File: ruby,v 1.6 2016/07/27 09:46:29 rrt Exp $
# $File: ruby,v 1.7 2017/08/14 13:39:18 christos Exp $
# ruby: file(1) magic for Ruby scripting language
# URL: http://www.ruby-lang.org/
# From: Reuben Thomas <rrt@sc3d.org>
# Ruby scripts
0 search/1/w #!\ /usr/bin/ruby Ruby script text executable
0 search/1/w #!\ /usr/bin/ruby Ruby script text executable
!:strength + 15
!:mime text/x-ruby
0 search/1/w #!\ /usr/local/bin/ruby Ruby script text executable
!:strength + 15
!:mime text/x-ruby
0 search/1 #!/usr/bin/env\ ruby Ruby script text executable
0 search/1 #!/usr/bin/env\ ruby Ruby script text executable
!:strength + 15
!:mime text/x-ruby
0 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable
0 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable
!:strength + 15
!:mime text/x-ruby
# What looks like ruby, but does not have a shebang
# (modules and such)
# From: Lubomir Rintel <lkundrak@v3.sk>
0 regex \^[\ \t]*require[\ \t]'[A-Za-z_/]+'
>0 regex include\ [A-Z]|def\ [a-z]|\ do$
>>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby script text
0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/]+'
>0 regex def\ [a-z]|\ do$
>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text
!:strength + 30
!:mime text/x-ruby
0 regex \^[\ \t]*(class|module)[\ \t][A-Z]
0 regex \^[[:space:]]*(class|module)[[:space:]][A-Z]
>0 regex (modul|includ)e\ [A-Z]|def\ [a-z]
>>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby module source text
>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text
!:strength + 30
!:mime text/x-ruby
# Classes with no modules or defs, beats simple ASCII
0 regex \^[[:space:]]*(class|module)[[:space:]][A-Z]
>&0 regex \^[[:space:]]*end([[:space:]]+[;#if].*)?$ Ruby script text
!:strength + 10
!:mime text/x-ruby
# Looks for function definition to balance python magic
# def name (args)
# end
0 regex \^[[:space:]]*def\ [a-z]|def\ [[:alpha:]]+::[a-z]
>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text
!:strength + 10
!:mime text/x-ruby
0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/]+' Ruby script text
!:mime text/x-ruby
0 regex \^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+ Ruby script text
!:mime text/x-ruby

4
contrib/file/magic/Magdir/sccs
View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: sccs,v 1.6 2009/09/19 16:28:12 christos Exp $
# $File: sccs,v 1.7 2017/03/17 21:35:28 christos Exp $
# sccs: file(1) magic for SCCS archives
#
# SCCS archive structure:
@ -17,6 +17,6 @@
# Maybe we should just switch everybody from SCCS to RCS!
# Further, you can't just say '\001h0', because the five-digit number
# is a checksum that could (presumably) have any leading digit,
# and we don't have regular expression matching yet.
# and we don't have regular expression matching yet.
# Hence the following official kludge:
8 string \001s\ SCCS archive data

Some files were not shown because too many files have changed in this diff Show More