system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-07-22 10:48:02 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

MFV r354582: file 5.37.

Browse source 
MFC after:	3 days
This commit is contained in:
Xin LI 2019-11-10 17:00:23 +00:00
parent e5d9d07948 4ef4bf0189
commit 48c779cdec
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=354595
235 changed files with 5354 additions and 2013 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
contrib/file/AUTHORS
View file

@ -1 +1 @@
See COPYING.
See COPYING.

4
contrib/file/COPYING
View file

@ -1,4 +1,4 @@
$File: COPYING,v 1.1 2008/02/05 19:08:11 christos Exp $
$File: COPYING,v 1.2 2018/09/09 20:33:28 christos Exp $
Copyright (c) Ian F. Darwin 1986, 1987, 1989, 1990, 1991, 1992, 1994, 1995.
Software written by Ian F. Darwin and others;
maintained 1994- Christos Zoulas.
@ -15,7 +15,7 @@ are met:
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

108
contrib/file/ChangeLog
View file

@ -1,3 +1,75 @@
2019-05-14 22:26 Christos Zoulas <christos@zoulas.com>
* release 5.37
2019-05-09 22:27 Christos Zoulas <christos@zoulas.com>
* Make sure that continuation separators are printed
with -k within softmagic
2019-05-06 22:27 Christos Zoulas <christos@zoulas.com>
* Change SIGPIPE saving and restoring during compression to use
sigaction(2) instead of signal(3) and cache it. (Denys Vlasenko)
* Cache stat(2) calls more to reduce number of calls (Denys Vlasenko)
2019-05-06 17:25 Christos Zoulas <christos@zoulas.com>
* PR/77: Handle --mime-type and -k correctly.
2019-05-03 15:26 Christos Zoulas <christos@zoulas.com>
* Switch decompression code to use vfork() because
tools like rpmdiff and rpmbuild call libmagic
with large process footprints (Denys Vlasenko)
2019-04-07 14:05 Christos Zoulas <christos@zoulas.com>
* PR/75: --enable-zlib, did not work.
2019-02-27 11:54 Christos Zoulas <christos@zoulas.com>
* Improve regex efficiency (Michael Schroeder) by:
1. Prefixing regex searches with regular search
for keywords where possible
2. Using memmem(3) where available
2019-02-20 10:16 Christos Zoulas <christos@zoulas.com>
* release 5.36
2019-02-19 15:30 Christos Zoulas <christos@zoulas.com>
* Fix cast to use cast macros
* Add UCS-32 builtin detection (PR/61) reported by tmc
2019-02-18 18:24 Christos Zoulas <christos@zoulas.com>
* Fix stack read (PR/62) and write (PR/64) stack overflows
reported by spinpx
2018-10-18 19:32 Christos Zoulas <christos@zoulas.com>
* release 5.35
2018-09-10 20:38 Christos Zoulas <christos@zoulas.com>
* Add FreeBSD ELF core file support (John Baldwin)
2018-08-20 18:40 Christos Zoulas <christos@zoulas.com>
* PR/30: Allow all parameter values to be set (don't treat 0 specially)
* handle default annotations on the softmagic match instead at the
end.
2018-07-25 10:17 Christos Zoulas <christos@zoulas.com>
* PR/23: Recognize JSON files
2018-07-25 10:17 Christos Zoulas <christos@zoulas.com>
* PR/18: file --mime-encoding should not print mime-type
2018-07-25 8:50 Christos Zoulas <christos@zoulas.com>
* release 5.34
@ -14,11 +86,11 @@
* release 5.33
2018-02-24 14:50 Christos Zoulas <christos@zoulas.com>
2018-02-24 14:50 Christos Zoulas <christos@zoulas.com>
* extend the support for ${x?:} expansions for magic descriptions
2018-02-21 16:25 Christos Zoulas <christos@zoulas.com>
2018-02-21 16:25 Christos Zoulas <christos@zoulas.com>
* add support for ${x?:} in mime types to handle
pie binaries.
@ -90,7 +162,7 @@
* Add missing overflow check in der magic (Jonas Wagner)
2016-10-25 10:40 Christos Zoulas <christos@zoulas.com>
* release 5.29
2016-10-24 11:20 Christos Zoulas <christos@zoulas.com>
@ -131,11 +203,11 @@
- set offset to 0 on failure.
2016-05-13 12:00 Christos Zoulas <christos@zoulas.com>
* release 5.27
2016-04-18 9:35 Christos Zoulas <christos@zoulas.com>
* Errors comparing DER entries or computing offsets
are just indications of malformed non-DER files.
Don't print them.
@ -144,7 +216,7 @@
* Put new bytes constant in the right file (not the generated one)
2016-04-16 18:34 Christos Zoulas <christos@zoulas.com>
* release 5.26
2016-03-31 13:50 Christos Zoulas <christos@zoulas.com>
@ -190,7 +262,7 @@
* PR/492: compression forking was broken with magic_buffer.
2015-09-16 9:50 Christos Zoulas <christos@zoulas.com>
* release 5.25
2015-09-11 13:25 Christos Zoulas <christos@zoulas.com>
@ -218,7 +290,7 @@
* release 5.23
2015-06-09 16:10 Christos Zoulas <christos@zoulas.com>
* Fix issue with regex range for magic with offset
* Always return true from mget with USE (success to mget not match
indication). Fixes mime evaluation after USE magic
@ -271,12 +343,12 @@
* add indirect relative for TIFF/Exif
2014-12-16 18:10 Christos Zoulas <christos@zoulas.com>
* restructure elf note printing to avoid repeated messages
* add note limit, suggested by Alexander Cherepanov
2014-12-16 16:53 Christos Zoulas <christos@zoulas.com>
* Bail out on partial pread()'s (Alexander Cherepanov)
* Fix incorrect bounds check in file_printable (Alexander Cherepanov)
@ -287,7 +359,7 @@
more places for safety
* in ELF, instead of "(uses dynamic libraries)" when PT_INTERP
is present print the interpreter name.
2014-12-10 20:01 Christos Zoulas <christos@zoulas.com>
* release 5.21
@ -330,7 +402,7 @@
on a byte by byte basis, so that we don't get issues with
locale's trying to interpret random byte streams as UTF-8 and
having printf error out with EILSEQ.
2014-10-17 11:48 Christos Zoulas <christos@zoulas.com>
* fix bounds in note reading (Francisco Alonso / Red Hat)
@ -361,7 +433,7 @@
* release 5.19
2014-06-09 9:04 Christos Zoulas <christos@zoulas.com>
* Misc buffer overruns and missing buffer size tests in cdf parsing
(Francisco Alonso, Jan Kaluza)
@ -391,7 +463,7 @@
2014-05-04 14:55 Christos Zoulas <christos@zoulas.com>
* PR/351: Fix compilation of empty files
* PR/351: Fix compilation of empty files
2014-04-30 17:39 Christos Zoulas <christos@zoulas.com>
@ -495,7 +567,7 @@
* Don't treat magic as an error if offset was past EOF (Christoph Biedl)
2013-05-28 17:25 Christos Zoulas <christos@zoulas.com>
* Fix spacing issues in softmagic and elf (Jan Kaluza)
2013-05-02 18:00 Christos Zoulas <christos@zoulas.com>
@ -551,7 +623,7 @@
* Make getline public so that file can link against it.
Perhaps it is better to rename it, or hide it differently.
Fixes builds on platforms that do not provide it.
2013-01-07 16:30 Christos Zoulas <christos@zoulas.com>
* Add SuS d{,1,2,4,8}, u{,1,2,4,8} and document
@ -901,7 +973,7 @@
(Cheng Renquan)
2009-05-08 13:40 Christos Zoulas <christos@zoulas.com>
* lint fixes and more from NetBSD
2009-05-06 10:25 Christos Zoulas <christos@zoulas.com>
@ -921,7 +993,7 @@
2009-03-27 18:43 Christos Zoulas <christos@zoulas.com>
* don't print \012- separators in the same magic entry
* don't print \012- separators in the same magic entry
if it consists of multiple magic printing lines.
2009-03-23 10:20 Christos Zoulas <christos@zoulas.com>

2
contrib/file/NEWS
View file

@ -1 +1 @@
See ChangeLog.
See ChangeLog.

83
contrib/file/README
View file

@ -1,6 +1,6 @@
## README for file(1) Command ##
## README for file(1) Command and the libmagic(3) library ##
@(#) $File: README,v 1.54 2018/05/30 03:06:56 christos Exp $
@(#) $File: README,v 1.57 2019/02/06 00:20:56 christos Exp $
Mailing List: file@astron.com
Mailing List archives: http://mailman.astron.com/pipermail/file/
@ -63,53 +63,54 @@ magic numbers assigned to all sorts of data files that
are in reasonable circulation. Send your magic numbers,
in magic(5) format please, to the maintainer, Christos Zoulas.
COPYING - read this first.
README - read this second (you are currently reading this file).
COPYING - read this first.
README - read this second (you are currently reading this file).
INSTALL - read on how to install
src/apprentice.c - parses /etc/magic to learn magic
src/apptype.c - used for OS/2 specific application type magic
src/ascmagic.c - third & last set of tests, based on hardwired assumptions.
src/asctime_r.c - replacement for OS's that don't have it.
src/asprintf.c - replacement for OS's that don't have it.
src/asctime_r.c - replacement for OS's that don't have it.
src/asprintf.c - replacement for OS's that don't have it.
src/apprentice.c - parses /etc/magic to learn magic
src/apptype.c - used for OS/2 specific application type magic
src/ascmagic.c - third & last set of tests, based on hardwired assumptions.
src/asctime_r.c - replacement for OS's that don't have it.
src/asprintf.c - replacement for OS's that don't have it.
src/asctime_r.c - replacement for OS's that don't have it.
src/asprintf.c - replacement for OS's that don't have it.
src/buffer.c - buffer handling functions.
src/cdf.[ch] - parser for Microsoft Compound Document Files
src/cdf_time.c - time converter for CDF.
src/compress.c - handles decompressing files to look inside.
src/ctime_r.c - replacement for OS's that don't have it.
src/cdf.[ch] - parser for Microsoft Compound Document Files
src/cdf_time.c - time converter for CDF.
src/compress.c - handles decompressing files to look inside.
src/ctime_r.c - replacement for OS's that don't have it.
src/der.[ch] - parser for Distinguished Encoding Rules
src/dprintf.c - replacement for OS's that don't have it.
src/elfclass.h - common code for elf 32/64.
src/encoding.c - handles unicode encodings
src/file.c - the main program
src/file.h - header file
src/encoding.c - handles unicode encodings
src/file.c - the main program
src/file.h - header file
src/file_opts.h - list of options
src/fmtcheck.c - replacement for OS's that don't have it.
src/fsmagic.c - first set of tests the program runs, based on filesystem info
src/funcs.c - utilility functions
src/getline.c - replacement for OS's that don't have it.
src/getopt_long.c - replacement for OS's that don't have it.
src/gmtime_r.c - replacement for OS's that don't have it.
src/is_tar.c, tar.h - knows about Tape ARchive format (courtesy John Gilmore).
src/localtime_r.c - replacement for OS's that don't have it.
src/fmtcheck.c - replacement for OS's that don't have it.
src/fsmagic.c - first set of tests the program runs, based on filesystem info
src/funcs.c - utilility functions
src/getline.c - replacement for OS's that don't have it.
src/getopt_long.c - replacement for OS's that don't have it.
src/gmtime_r.c - replacement for OS's that don't have it.
src/is_json.c - knows about JavaScript Object Notation format (RFC 8259).
src/is_tar.c, tar.h - knows about Tape ARchive format (courtesy John Gilmore).
src/localtime_r.c - replacement for OS's that don't have it.
src/magic.h.in - source file for magic.h
src/mygetopt.h - replacement for OS's that don't have it.
src/magic.c - the libmagic api
src/names.h - header file for ascmagic.c
src/pread.c - replacement for OS's that don't have it.
src/print.c - print results, errors, warnings.
src/readcdf.c - CDF wrapper.
src/readelf.[ch] - Stand-alone elf parsing code.
src/softmagic.c - 2nd set of tests, based on /etc/magic
src/mygetopt.h - replacement for OS's that don't have it.
src/strcasestr.c - replacement for OS's that don't have it.
src/strlcat.c - replacement for OS's that don't have it.
src/strlcpy.c - replacement for OS's that don't have it.
src/strndup.c - replacement for OS's that don't have it.
src/mygetopt.h - replacement for OS's that don't have it.
src/magic.c - the libmagic api
src/names.h - header file for ascmagic.c
src/pread.c - replacement for OS's that don't have it.
src/print.c - print results, errors, warnings.
src/readcdf.c - CDF wrapper.
src/readelf.[ch] - Stand-alone elf parsing code.
src/softmagic.c - 2nd set of tests, based on /etc/magic
src/mygetopt.h - replacement for OS's that don't have it.
src/strcasestr.c - replacement for OS's that don't have it.
src/strlcat.c - replacement for OS's that don't have it.
src/strlcpy.c - replacement for OS's that don't have it.
src/strndup.c - replacement for OS's that don't have it.
src/tar.h - tar file definitions
src/vasprintf.c - for systems that don't have it.
doc/file.man - man page for the command
src/vasprintf.c - for systems that don't have it.
doc/file.man - man page for the command
doc/magic.man - man page for the magic file, courtesy Guy Harris.
Install as magic.4 on USG and magic.5 on V7 or Berkeley; cf Makefile.

27
contrib/file/config.h.in
View file

@ -83,12 +83,6 @@
/* Define to 1 if you have the `z' library (-lz). */
#undef HAVE_LIBZ
/* Define to 1 if you have the <limits.h> header file. */
#undef HAVE_LIMITS_H
/* Define to 1 if you have the <locale.h> header file. */
#undef HAVE_LOCALE_H
/* Define to 1 if you have the `localtime_r' function. */
#undef HAVE_LOCALTIME_R
@ -98,6 +92,9 @@
/* Define to 1 if <wchar.h> declares mbstate_t. */
#undef HAVE_MBSTATE_T
/* Define to 1 if you have the `memmem' function. */
#undef HAVE_MEMMEM
/* Define to 1 if you have the <memory.h> header file. */
#undef HAVE_MEMORY_H
@ -116,18 +113,9 @@
/* Define to 1 if you have the `pread' function. */
#undef HAVE_PREAD
/* Define to 1 if you have the `setlocale' function. */
#undef HAVE_SETLOCALE
/* Define to 1 if you have the <signal.h> header file. */
#undef HAVE_SIGNAL_H
/* Have sig_t type */
#undef HAVE_SIG_T
/* Define to 1 if you have the <stddef.h> header file. */
#undef HAVE_STDDEF_H
/* Define to 1 if you have the <stdint.h> header file. */
#undef HAVE_STDINT_H
@ -137,9 +125,6 @@
/* Define to 1 if you have the `strcasestr' function. */
#undef HAVE_STRCASESTR
/* Define to 1 if you have the `strerror' function. */
#undef HAVE_STRERROR
/* Define to 1 if you have the <strings.h> header file. */
#undef HAVE_STRINGS_H
@ -158,9 +143,6 @@
/* Define to 1 if you have the `strtof' function. */
#undef HAVE_STRTOF
/* Define to 1 if you have the `strtoul' function. */
#undef HAVE_STRTOUL
/* HAVE_STRUCT_OPTION */
#undef HAVE_STRUCT_OPTION
@ -182,6 +164,9 @@
/* Define to 1 if you have the <sys/stat.h> header file. */
#undef HAVE_SYS_STAT_H
/* Define to 1 if you have the <sys/sysmacros.h> header file. */
#undef HAVE_SYS_SYSMACROS_H
/* Define to 1 if you have the <sys/time.h> header file. */
#undef HAVE_SYS_TIME_H

41
contrib/file/configure vendored
View file

@ -1,6 +1,6 @@
#! /bin/sh
# Guess values for system-dependent variables and create Makefiles.
# Generated by GNU Autoconf 2.69 for file 5.34.
# Generated by GNU Autoconf 2.69 for file 5.37.
#
# Report bugs to <christos@astron.com>.
#
@ -590,8 +590,8 @@ MAKEFLAGS=
# Identity of this package.
PACKAGE_NAME='file'
PACKAGE_TARNAME='file'
PACKAGE_VERSION='5.34'
PACKAGE_STRING='file 5.34'
PACKAGE_VERSION='5.37'
PACKAGE_STRING='file 5.37'
PACKAGE_BUGREPORT='christos@astron.com'
PACKAGE_URL=''
@ -1329,7 +1329,7 @@ if test "$ac_init_help" = "long"; then
# Omit some internal or obsolete options to make the list less imposing.
# This message is too long to be a string in the A/UX 3.1 sh.
cat <<_ACEOF
\`configure' configures file 5.34 to adapt to many kinds of systems.
\`configure' configures file 5.37 to adapt to many kinds of systems.
Usage: $0 [OPTION]... [VAR=VALUE]...
@ -1399,7 +1399,7 @@ fi
if test -n "$ac_init_help"; then
case $ac_init_help in
short | recursive ) echo "Configuration of file 5.34:";;
short | recursive ) echo "Configuration of file 5.37:";;
esac
cat <<\_ACEOF
@ -1511,7 +1511,7 @@ fi
test -n "$ac_init_help" && exit $ac_status
if $ac_init_version; then
cat <<\_ACEOF
file configure 5.34
file configure 5.37
generated by GNU Autoconf 2.69
Copyright (C) 2012 Free Software Foundation, Inc.
@ -2167,7 +2167,7 @@ cat >config.log <<_ACEOF
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
It was created by file $as_me 5.34, which was
It was created by file $as_me 5.37, which was
generated by GNU Autoconf 2.69. Invocation command line was
$ $0 $@
@ -3033,7 +3033,7 @@ fi
# Define the identity of the package.
PACKAGE='file'
VERSION='5.34'
VERSION='5.37'
cat >>confdefs.h <<_ACEOF
@ -12784,7 +12784,7 @@ $as_echo "#define HAVE_SYS_WAIT_H 1" >>confdefs.h
fi
for ac_header in stdint.h fcntl.h locale.h stdint.h inttypes.h unistd.h
for ac_header in stdint.h fcntl.h inttypes.h unistd.h
do :
as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
@ -12797,7 +12797,7 @@ fi
done
for ac_header in stddef.h utime.h wchar.h wctype.h limits.h
for ac_header in utime.h wchar.h wctype.h
do :
as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
@ -12810,7 +12810,7 @@ fi
done
for ac_header in getopt.h err.h xlocale.h signal.h
for ac_header in getopt.h err.h xlocale.h
do :
as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
@ -12823,7 +12823,7 @@ fi
done
for ac_header in sys/mman.h sys/stat.h sys/types.h sys/utime.h sys/time.h
for ac_header in sys/mman.h sys/stat.h sys/types.h sys/utime.h sys/time.h sys/sysmacros.h
do :
as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
@ -12850,10 +12850,7 @@ fi
done
fi
ac_fn_c_check_type "$LINENO" "sig_t" "ac_cv_type_sig_t" "
#ifdef HAVE_SIGNAL_H
#include <signal.h>
#endif
ac_fn_c_check_type "$LINENO" "sig_t" "ac_cv_type_sig_t" "#include <signal.h>
"
if test "x$ac_cv_type_sig_t" = xyes; then :
@ -12976,7 +12973,8 @@ _ACEOF
fi
ac_fn_c_check_member "$LINENO" "struct tm" "tm_gmtoff" "ac_cv_member_struct_tm_tm_gmtoff" "$ac_includes_default"
ac_fn_c_check_member "$LINENO" "struct tm" "tm_gmtoff" "ac_cv_member_struct_tm_tm_gmtoff" "#include <time.h>
"
if test "x$ac_cv_member_struct_tm_tm_gmtoff" = xyes; then :
cat >>confdefs.h <<_ACEOF
@ -14229,7 +14227,7 @@ fi
fi
for ac_func in strerror strndup strtoul mkstemp mkostemp utimes utime wcwidth strtof newlocale uselocale freelocale setlocale
for ac_func in strndup mkstemp mkostemp utimes utime wcwidth strtof newlocale uselocale freelocale memmem
do :
as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
@ -14583,7 +14581,8 @@ if test "$enable_zlib" = "yes"; then
if test "$ac_cv_header_zlib_h$ac_cv_lib_z_gzopen" != "yesyes"; then
as_fn_error $? "zlib support requested but not found" "$LINENO" 5
fi
elif test "$ac_cv_header_zlib_h$ac_cv_lib_z_gzopen" = "yesyes"; then
fi
if test "$ac_cv_header_zlib_h$ac_cv_lib_z_gzopen" = "yesyes"; then
$as_echo "#define ZLIBSUPPORT 1" >>confdefs.h
@ -15134,7 +15133,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
# report actual input values of CONFIG_FILES etc. instead of their
# values after options handling.
ac_log="
This file was extended by file $as_me 5.34, which was
This file was extended by file $as_me 5.37, which was
generated by GNU Autoconf 2.69. Invocation command line was
CONFIG_FILES = $CONFIG_FILES
@ -15200,7 +15199,7 @@ _ACEOF
cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
ac_cs_version="\\
file config.status 5.34
file config.status 5.37
configured by $0, generated by GNU Autoconf 2.69,
with options \\"\$ac_cs_config\\"

26
contrib/file/configure.ac
View file

@ -1,5 +1,5 @@
dnl Process this file with autoconf to produce a configure script.
AC_INIT([file],[5.34],[christos@astron.com])
AC_INIT([file],[5.37],[christos@astron.com])
AM_INIT_AUTOMAKE([subdir-objects foreign])
m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
@ -35,12 +35,12 @@ fi], [
])
AC_MSG_CHECKING(for zlib support)
AC_ARG_ENABLE(zlib,
AC_ARG_ENABLE([zlib],
[AS_HELP_STRING([--disable-zlib], [disable zlib compression support @<:@default=auto@:>@])])
AC_MSG_RESULT($enable_zlib)
AC_MSG_CHECKING(for libseccomp support)
AC_ARG_ENABLE(libseccomp,
AC_ARG_ENABLE([libseccomp],
[AS_HELP_STRING([--disable-libseccomp], [disable libseccomp sandboxing @<:@default=auto@:>@])])
AC_MSG_RESULT($enable_libseccomp)
@ -90,17 +90,14 @@ dnl Checks for headers
AC_HEADER_STDC
AC_HEADER_MAJOR
AC_HEADER_SYS_WAIT
AC_CHECK_HEADERS(stdint.h fcntl.h locale.h stdint.h inttypes.h unistd.h)
AC_CHECK_HEADERS(stddef.h utime.h wchar.h wctype.h limits.h)
AC_CHECK_HEADERS(getopt.h err.h xlocale.h signal.h)
AC_CHECK_HEADERS(sys/mman.h sys/stat.h sys/types.h sys/utime.h sys/time.h)
AC_CHECK_HEADERS(stdint.h fcntl.h inttypes.h unistd.h)
AC_CHECK_HEADERS(utime.h wchar.h wctype.h)
AC_CHECK_HEADERS(getopt.h err.h xlocale.h)
AC_CHECK_HEADERS(sys/mman.h sys/stat.h sys/types.h sys/utime.h sys/time.h sys/sysmacros.h)
if test "$enable_zlib" != "no"; then
AC_CHECK_HEADERS(zlib.h)
fi
AC_CHECK_TYPE([sig_t],[AC_DEFINE([HAVE_SIG_T],1,[Have sig_t type])],,[
#ifdef HAVE_SIGNAL_H
#include <signal.h>
#endif])
AC_CHECK_TYPE([sig_t],[AC_DEFINE([HAVE_SIG_T],1,[Have sig_t type])],,[#include <signal.h>])
dnl Checks for typedefs, structures, and compiler characteristics.
AC_C_CONST
@ -108,7 +105,7 @@ AC_TYPE_OFF_T
AC_TYPE_SIZE_T
AC_CHECK_MEMBERS([struct stat.st_rdev])
AC_CHECK_MEMBERS([struct tm.tm_gmtoff])
AC_CHECK_MEMBERS([struct tm.tm_gmtoff],,,[#include <time.h>])
AC_STRUCT_TIMEZONE
AC_STRUCT_TIMEZONE_DAYLIGHT
AC_SYS_LARGEFILE
@ -154,7 +151,7 @@ else
fi])
dnl Checks for functions
AC_CHECK_FUNCS(strerror strndup strtoul mkstemp mkostemp utimes utime wcwidth strtof newlocale uselocale freelocale setlocale)
AC_CHECK_FUNCS(strndup mkstemp mkostemp utimes utime wcwidth strtof newlocale uselocale freelocale memmem)
dnl Provide implementation of some required functions if necessary
AC_REPLACE_FUNCS(getopt_long asprintf vasprintf strlcpy strlcat getline ctime_r asctime_r localtime_r gmtime_r pread strcasestr fmtcheck dprintf)
@ -178,7 +175,8 @@ if test "$enable_zlib" = "yes"; then
if test "$ac_cv_header_zlib_h$ac_cv_lib_z_gzopen" != "yesyes"; then
AC_MSG_ERROR([zlib support requested but not found])
fi
elif test "$ac_cv_header_zlib_h$ac_cv_lib_z_gzopen" = "yesyes"; then
fi
if test "$ac_cv_header_zlib_h$ac_cv_lib_z_gzopen" = "yesyes"; then
AC_DEFINE([ZLIBSUPPORT], 1, [Enable zlib compression support])
fi

14
contrib/file/doc/file.man
View file

@ -1,5 +1,5 @@
.\" $File: file.man,v 1.131 2018/07/24 21:33:56 christos Exp $
.Dd July 25, 2018
.\" $File: file.man,v 1.135 2019/03/03 02:32:40 christos Exp $
.Dd February 18, 2019
.Dt FILE __CSECTION__
.Os
.Sh NAME
@ -159,7 +159,7 @@ two groups, so they are performed last.
The language test routines also test for some miscellany
(such as
.Xr tar 1
archives).
archives, JSON files).
.Pp
Any file that cannot be identified as having been written
in any of the character sets listed above is simply said to be
@ -171,6 +171,8 @@ Causes the file command to output the file type and creator code as
used by older MacOS versions.
The code consists of eight letters,
the first describing the file type, the latter the creator.
This option works properly only for file formats that have the
apple-style output defined.
.It Fl b , Fl Fl brief
Do not prepend filenames to output lines (brief mode).
.It Fl C , Fl Fl compile
@ -213,6 +215,8 @@ Checks for, and looks inside, compressed files.
.It elf
Prints ELF file details, provided soft magic tests are enabled and the
elf magic is found.
.It json
Examines JSON (RFC-7159) files by parsing them for compliance.
.It soft
Consults magic files.
.It tar
@ -629,11 +633,11 @@ were written by John Gilmore from his public-domain
program, and are not covered by the above license.
.Sh BUGS
Please report bugs and send patches to the bug tracker at
.Pa http://bugs.astron.com/
.Pa https://bugs.astron.com/
or the mailing list at
.Aq file@astron.com
(visit
.Pa http://mailman.astron.com/mailman/listinfo/file
.Pa https://mailman.astron.com/mailman/listinfo/file
first to subscribe).
.Sh TODO
Fix output so that tests for MIME and APPLE flags are not needed all

21
contrib/file/doc/libmagic.man
View file

@ -1,6 +1,6 @@
.\" $File: libmagic.man,v 1.41 2017/05/23 21:54:07 christos Exp $
.\" $File: libmagic.man,v 1.44 2018/09/09 20:33:28 christos Exp $
.\"
.\" Copyright (c) Christos Zoulas 2003.
.\" Copyright (c) Christos Zoulas 2003, 2018.
.\" All Rights Reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
@ -25,7 +25,7 @@
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.Dd May 23, 2017
.Dd August 18, 2018
.Dt LIBMAGIC 3
.Os
.Sh NAME
@ -159,6 +159,8 @@ Don't examine tar files.
Don't check for various types of text files.
.It Dv MAGIC_NO_CHECK_TOKENS
Don't look for known tokens inside ascii files.
.It Dv MAGIC_NO_CHECK_JSON
Don't example JSON files.
.El
.Pp
The
@ -391,6 +393,19 @@ The compiled default magic database.
.Sh SEE ALSO
.Xr file __CSECTION__ ,
.Xr magic __FSECTION__
.Sh BUGS
The results from
.Fn magic_buffer
and
.Fn magic_file
where the buffer and the file contain the same data
can produce different results, because in the
.Fn magic_file
case, the program can
.Xr lseek 2
and
.Xr stat 2
the file descriptor.
.Sh AUTHORS
.An M\(oans Rullg\(oard
Initial libmagic implementation, and configuration.

15
contrib/file/doc/magic.man
View file

@ -1,6 +1,5 @@
.It S2
.\" $File: magic.man,v 1.93 2018/06/22 20:39:49 christos Exp $
.Dd June 22, 2018
.\" $File: magic.man,v 1.96 2019/01/21 14:56:53 christos Exp $
.Dd January 21, 2019
.Dt MAGIC __FSECTION__
.Os
.\" install as magic.4 on USG, magic.5 on V7, Berkeley and Linux systems.
@ -117,13 +116,13 @@ The following modifiers are supported:
.It B
A byte length (default).
.It H
A 4 byte big endian length.
.It h
A 2 byte big endian length.
.It L
A 4 byte little endian length.
.It l
.It h
A 2 byte little endian length.
.It L
A 4 byte big endian length.
.It l
A 4 byte little endian length.
.It J
The length includes itself in its count.
.El

2
contrib/file/magic/Header
View file

@ -2,4 +2,4 @@
# Format is described in magic(files), where:
# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID.
# Don't edit this file, edit /etc/magic or send your magic improvements
# to the maintainers, at file@mx.gw.com
# to the maintainers, at file@astron.com

4
contrib/file/magic/Magdir/acorn
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: acorn,v 1.6 2017/10/19 16:40:37 christos Exp $
# $File: acorn,v 1.7 2019/04/19 00:42:27 christos Exp $
# acorn: file(1) magic for files found on Acorn systems
#
@ -83,7 +83,7 @@
# compression mode y (0 - 4) for GIF LZW with a maximum n bits
# (y~n,0~12,1~13,2~14,3~15,4~16)
>>>5 ulelong+12 x \b, LZW %u-bits compression
# http://www.filebase.org.uk/filetypes
# https://www.filebase.org.uk/filetypes
# !Packdir compressed archive has three hexadecimal digits code 68E
!:mime application/x-acorn-68E
!:ext pkd/bin

8
contrib/file/magic/Magdir/adventure
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: adventure,v 1.17 2017/07/03 16:03:40 christos Exp $
# $File: adventure,v 1.18 2019/04/19 00:42:27 christos Exp $
# adventure: file(1) magic for Adventure game files
#
# from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
@ -21,8 +21,8 @@
# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
#
#http://www.gnelson.demon.co.uk/zspec/sect11.html
#http://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt
#http://en.wikipedia.org/wiki/Z-machine
#https://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt
#https://en.wikipedia.org/wiki/Z-machine
# The first byte is the Z-machine revision; it is always between 1 and 8. We
# had false matches (for instance, inbig5.ocp from the Omega TeX extension as
# well as an occasional MP3 file), so we sanity-check the version number.
@ -111,7 +111,7 @@
# Danny Milosavljevic <danny.milo@gmx.net>
# These are ADRIFT (adventure game standard) game files, extension .taf
# Checked from source at (http://www.adrift.co/) and various taf files
# found at the Interactive Fiction Archive (http://ifarchive.org/)
# found at the Interactive Fiction Archive (https://ifarchive.org/)
0 belong 0x3C423FC9
>4 belong 0x6A87C2CF Adrift game file version
>>8 belong 0x94453661 3.80

10
contrib/file/magic/Magdir/algol68
View file

@ -1,17 +1,17 @@
#------------------------------------------------------------------------------
# $File: algol68,v 1.2 2016/10/17 14:17:48 christos Exp $
# $File: algol68,v 1.3 2018/10/19 01:04:21 christos Exp $
# algol68: file(1) magic for Algol 68 source
#
0 search/8192 (input, Algol 68 source text
!:mime text/x-Algol68
0 regex \^PROC Algol 68 source text
0 regex/1024 \^PROC Algol 68 source text
!:mime text/x-Algol68
0 regex MODE[\t\ ] Algol 68 source text
0 regex/1024 \bMODE[\t\ ] Algol 68 source text
!:mime text/x-Algol68
0 regex REF[\t\ ] Algol 68 source text
0 regex/1024 \bREF[\t\ ] Algol 68 source text
!:mime text/x-Algol68
0 regex FLEX[\t\ ]\*\\[ Algol 68 source text
0 regex/1024 \bFLEX[\t\ ]\*\\[ Algol 68 source text
!:mime text/x-Algol68
#0 regex [\t\ ]OD Algol 68 source text
#!:mime text/x-Algol68

21
contrib/file/magic/Magdir/amigaos
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: amigaos,v 1.16 2017/03/17 21:35:28 christos Exp $
# $File: amigaos,v 1.17 2018/10/16 18:57:19 christos Exp $
# amigaos: file(1) magic for AmigaOS binary formats:
#
@ -66,3 +66,22 @@
# From: Przemek Kramarczyk <pkramarczyk@gmail.com>
0 string .KEY AmigaDOS script
0 string .key AmigaDOS script
# AMOS Basic file formats
# https://www.exotica.org.uk/wiki/AMOS_file_formats
0 string AMOS\040Basic\040 AMOS Basic source code
>11 byte =0x56 \b, tested
>11 byte =0x76 \b, untested
0 string AMOS\040Pro AMOS Basic source code
>11 byte =0x56 \b, tested
>11 byte =0x76 \b, untested
0 string AmSp AMOS Basic sprite bank
>4 beshort x \b, %d sprites
0 string AmIc AMOS Basic icon bank
>4 beshort x \b, %d icons
0 string AmBk AMOS Basic memory bank
>4 beshort x \b, bank number %d
>8 belong&0xFFFFFFF x \b, length %d
>12 regex .{8} \b, type %s
0 string AmBs AMOS Basic memory banks
>4 beshort x \b, %d banks

49
contrib/file/magic/Magdir/android
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------
# $File: android,v 1.10 2017/03/17 21:35:28 christos Exp $
# $File: android,v 1.12 2019/04/19 00:42:27 christos Exp $
# Various android related magic entries
#------------------------------------------------------------
@ -32,33 +32,68 @@
# Android Backup archive
# From: Ariel Shkedi
# File extension: .ab
# No mime-type defined
# Update: Joerg Jenderek
# URL: https://github.com/android/platform_frameworks_base/blob/\
# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\
# android/server/BackupManagerService.java#L2367
# Reference: https://sourceforge.net/projects/adbextractor/
# android-backup-extractor/perl/backupencrypt.pl
# Note: only unix line feeds "\n" found
# After the header comes a tar file
# If compressed, the entire tar file is compressed with JAVA deflate
#
# Include the version number hardcoded with the magic string to avoid
# false positives
0 string/b ANDROID\ BACKUP\n1\n Android Backup
0 string/b ANDROID\ BACKUP\n Android Backup
# maybe look for some more characteristics like linefeed '\n' or version
#>16 string \n
# No mime-type defined offically
!:mime application/x-google-ab
!:ext ab
# on 2nd line version (often 1, 2 on kitkat 4.4.3+, 4 on 7.1.2)
>15 string >\0 \b, version %s
# "1" on 3rd line means compressed
>17 string 0\n \b, Not-Compressed
>17 string 1\n \b, Compressed
# The 4th line is encryption "none" or "AES-256"
# any string as long as it's not the word none (which is matched below)
>19 string none\n \b, Not-Encrypted
# look for backup content after line with encryption info
#>>19 search/7 \n
# data part after header for not encrypted Android Backup
#>>>&0 ubequad x \b, content 0x%16.16llx...
# look for zlib compressed by ./compress after message with 1 space at end
#>>>&0 indirect x \b; contains
# look for tar archive block by ./archive for package name manifest
>>288 string ustar \b; contains
>>>31 use tar-file
# look for zip/jar archive by ./archive ./zip after message with 1 space at end
#>>2079 search/1025/s PK\003\004 \b; contains
#>>>&0 indirect x
>19 string !none
>>19 regex/1l \^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).* \b, Encrypted (%s)
>>19 string none\n \b, Not-Encrypted
# Commented out because they don't seem useful to print
# (but they are part of the header - the tar file comes after them):
# The 5th line is User Password Salt (128 Hex)
# string length too high with standard src configuration
#>>>&1 string >\0 \b, PASSWORD salt: "%-128.128s"
#>>>&1 regex/1l .* \b, Password salt: %s
# The 6th line is Master Key Checksum Salt (128 Hex)
#>>>>&1 regex/1l .* \b, Master salt: %s
# The 7th line is Number of PBDKF2 Rounds (10000)
#>>>>>&1 regex/1l .* \b, PBKDF2 rounds: %s
# The 8th line is User key Initialization Vector (IV) (32 Hex)
#>>>>>>&1 regex/1l .* \b, IV: %s
#>>>>>>&1 regex/1l .* \b, IV: %s
# The 9th line is Master IV+Key+Checksum (192 Hex)
#>>>>>>>&1 regex/1l .* \b, Key: %s
# look for new line separator char after line number 9
#>>>0x204 ubyte 0x0a NL found
#>>>>&1 ubequad x \b, Content magic %16.16llx
# *.pit files by Joerg Jenderek
# http://forum.xda-developers.com/showthread.php?p=9122369
# http://forum.xda-developers.com/showthread.php?t=816449
# https://forum.xda-developers.com/showthread.php?p=9122369
# https://forum.xda-developers.com/showthread.php?t=816449
# Partition Information Table for Samsung's smartphone with Android
# used by flash software Odin
0 ulelong 0x12349876

44
contrib/file/magic/Magdir/animation
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: animation,v 1.68 2018/05/06 16:08:07 christos Exp $
# $File: animation,v 1.71 2019/04/19 00:42:27 christos Exp $
# animation: file(1) magic for animation/movie formats
#
# animation formats
@ -32,9 +32,9 @@
!:mime application/x-quicktime-player
4 string/W jP JPEG 2000 image
!:mime image/jp2
# http://www.ftyps.com/ with local additions
# https://www.ftyps.com/ with local additions
4 string ftyp ISO Media
# http://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/
# https://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/
>8 string XAVC \b, MPEG v4 system, Sony XAVC Codec
>>96 string x \b, Audio "%.4s"
>>118 beshort x at %dHz
@ -46,7 +46,7 @@
>>11 byte 4 \b v4 (H.263/AMR GSM 6.10)
>>11 byte 5 \b v5 (H.263/AMR GSM 6.10)
>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10)
# http://www.3gpp2.org/Public_html/Specs/C.S0050-B_v1.0_070521.pdf
# https://www.3gpp2.org/Public_html/Specs/C.S0050-B_v1.0_070521.pdf
# Section 8.1.1, corresponds to a, b, c
>>11 byte 0x61 \b C.S0050-0 V1.0
>>11 byte 0x62 \b C.S0050-0-A V1.0.0
@ -855,6 +855,7 @@
# conti_count 4 bit -
0 belong&0xFF5FFF10 0x47400010
>188 byte 0x47 MPEG transport stream data
!:mime video/MP2T
# DIF digital video file format <mpruett@sgi.com>
0 belong&0xffffff00 0x1f070000 DIF
@ -892,10 +893,10 @@
0 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file
!:mime model/vrml
# X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd]
# X3D (Extensible 3D) [https://www.web3d.org/specifications/x3d-3.0.dtd]
# From Michel Briand <michelbriand@free.fr>
# mimetype from https://www.iana.org/assignments/media-types/model/x3d+xml
# Example http://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d
# Example https://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d
0 string/w \<?xml\ version=
!:strength + 5
>20 search/1000/w \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text
@ -967,7 +968,7 @@
# Type: Bink Video
# Extension: .bik
# URL: http://wiki.multimedia.cx/index.php?title=Bink_Container
# URL: https://wiki.multimedia.cx/index.php?title=Bink_Container
# From: <hoehle@users.sourceforge.net> 2008-07-18
0 string BIK Bink Video
>3 regex =[a-z] rev.%s
@ -988,61 +989,61 @@
#>>51 byte&0x10 !0 DCT
# Type: NUT Container
# URL: http://wiki.multimedia.cx/index.php?title=NUT
# URL: https://wiki.multimedia.cx/index.php?title=NUT
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
0 string nut/multimedia\ container\0 NUT multimedia container
# Type: Nullsoft Video (NSV)
# URL: http://wiki.multimedia.cx/index.php?title=Nullsoft_Video
# URL: https://wiki.multimedia.cx/index.php?title=Nullsoft_Video
# From: Mike Melanson <mike@multimedia.cx>
0 string NSVf Nullsoft Video
# Type: REDCode Video
# URL: http://www.red.com/ ; http://wiki.multimedia.cx/index.php?title=REDCode
# URL: https://www.red.com/ ; https://wiki.multimedia.cx/index.php?title=REDCode
# From: Mike Melanson <mike@multimedia.cx>
4 string RED1 REDCode Video
# Type: MTV Multimedia File
# URL: http://wiki.multimedia.cx/index.php?title=MTV
# URL: https://wiki.multimedia.cx/index.php?title=MTV
# From: Mike Melanson <mike@multimedia.cx>
0 string AMVS MTV Multimedia File
# Type: ARMovie
# URL: http://wiki.multimedia.cx/index.php?title=ARMovie
# URL: https://wiki.multimedia.cx/index.php?title=ARMovie
# From: Mike Melanson <mike@multimedia.cx>
0 string ARMovie\012 ARMovie
# Type: Interplay MVE Movie
# URL: http://wiki.multimedia.cx/index.php?title=Interplay_MVE
# URL: https://wiki.multimedia.cx/index.php?title=Interplay_MVE
# From: Mike Melanson <mike@multimedia.cx>
0 string Interplay\040MVE\040File\032 Interplay MVE Movie
# Type: Windows Television DVR File
# URL: http://wiki.multimedia.cx/index.php?title=WTV
# URL: https://wiki.multimedia.cx/index.php?title=WTV
# From: Mike Melanson <mike@mutlimedia.cx>
# This takes the form of a Windows-style GUID
0 bequad 0xB7D800203749DA11
>8 bequad 0xA64E0007E95EAD8D Windows Television DVR Media
# Type: Sega FILM/CPK Multimedia
# URL: http://wiki.multimedia.cx/index.php?title=Sega_FILM
# URL: https://wiki.multimedia.cx/index.php?title=Sega_FILM
# From: Mike Melanson <mike@multimedia.cx>
0 string FILM Sega FILM/CPK Multimedia,
>32 belong x %d x
>28 belong x %d
# Type: Nintendo THP Multimedia
# URL: http://wiki.multimedia.cx/index.php?title=THP
# URL: https://wiki.multimedia.cx/index.php?title=THP
# From: Mike Melanson <mike@multimedia.cx>
0 string THP\0 Nintendo THP Multimedia
# Type: BBC Dirac Video
# URL: http://wiki.multimedia.cx/index.php?title=Dirac
# URL: https://wiki.multimedia.cx/index.php?title=Dirac
# From: Mike Melanson <mike@multimedia.cx>
0 string BBCD BBC Dirac Video
# Type: RAD Game Tools Smacker Multimedia
# URL: http://wiki.multimedia.cx/index.php?title=Smacker
# URL: https://wiki.multimedia.cx/index.php?title=Smacker
# From: Mike Melanson <mike@multimedia.cx>
0 string SMK RAD Game Tools Smacker Multimedia
>3 byte x version %c,
@ -1064,3 +1065,10 @@
>8 string AHDR LucasArts Smush Animation Format (SAN) video
0 string SANM
>8 string SHDR LucasArts Smush v2 (SANM) video
# Type: Scaleform video
# Extension: .usm
# URL: https://wiki.multimedia.cx/index.php/USM
# From: David Korth <gerbilsoft@gerbilsoft.com>
0 string CRID
>32 string @UTF Scaleform video

113
contrib/file/magic/Magdir/apple
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: apple,v 1.39 2018/03/02 15:26:39 christos Exp $
# $File: apple,v 1.43 2019/04/19 00:42:27 christos Exp $
# apple: file(1) magic for Apple file formats
#
0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text
@ -11,22 +11,97 @@
0 belong 0x00051600 AppleSingle encoded Macintosh file
0 belong 0x00051607 AppleDouble encoded Macintosh file
# Type: Apple Emulator WOZ format
# From: Greg Wildman <greg@apple2.org.za>
# Ref: https://applesaucefdc.com/woz/reference/
# Ref: https://applesaucefdc.com/woz/reference2/
#
# Note: The following test are mostly identical. I would rather not
# use a regex to identify the WOZ format number.
0 string WOZ1
>4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image
>12 string INFO
>>21 byte 01 \b, 5.25 inch
>>21 byte 02 \b, 3.5 inch
>>22 byte 01 \b, write protected
>>23 byte 01 \b, cross track synchronized
>>25 string/T x \b, %.32s
0 string WOZ2
>4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image
>12 string INFO
>>21 byte 01 \b, 5.25 inch
>>21 byte 02 \b, 3.5 inch
>>22 byte 01 \b, write protected
>>23 byte 01 \b, cross track synchronized
>>25 string/T x \b, %.32s
# Type: Apple Emulator disk images
# From: Greg Wildman <greg@apple2.org.za>
# ProDOS boot loader?
0 string \x01\x38\xB0\x03\x4C Apple ProDOS Image
# Detect Volume Directory block ($02)
>0x400 string \x00\x00\x03\x00
>>0x404 byte &0xF0
>>>0x405 string x \b, Volume /%s
>>>0x429 leshort x \b, %u Blocks
# ProDOS ordered ?
>0xb00 string \x00\x00\x03\x00
>>0xb04 byte &0xF0
>>>0xb05 string x \b, Volume /%s
>>>0xb29 leshort x \b, %u Blocks
#
# DOS3.3 boot loader?
0 string \x01\xA5\x27\xC9\x09\xD0\x18\xA5\x2B
>0x11001 string \x11\x0F\x03 Apple DOS 3.3 Image
>>0x11006 byte x \b, Volume %u
>>0x11034 byte x \b, %u Tracks
>>0x11035 byte x \b, %u Sectors
>>0x11036 leshort x \b, %u bytes per sector
# DOS3.2 ?
>0x11001 string \x11\x0C\x02 Apple DOS 3.2 Image
>>0x11006 byte x \b, Volume %u
>>0x11034 byte x \b, %u Tracks
>>0x11035 byte x \b, %u Sectors
>>0x11036 leshort x \b, %u bytes per sector
# DOS3.1 ?
>0x11001 string \x11\x0C\x01
>>0x11c00 string \x00\x11\x0B Apple DOS 3.1 Image
#
# Pascal boot loader?
0 string \x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD
>0xd6 pstring SYSTEM.APPLE
>>0xb00 leshort 0x0000
>>>0xb04 leshort 0x0000 Apple Pascal Image
>>>>0xb06 pstring x \b, Volume %s:
>>>>0xb0e leshort x \b, %u Blocks
>>>>0xb10 leshort x \b, %u Files
# Type: Apple Emulator 2IMG format
# From: Radek Vokal <rvokal@redhat.com>
0 string 2IMG Apple ][ 2IMG Disk Image
>4 string XGS! \b, XGS
>4 string CTKG \b, Catakig
>4 string ShIm \b, Sheppy's ImageMaker
>4 string WOOF \b, Sweet 16
>4 string B2TR \b, Bernie ][ the Rescue
>4 string !nfc \b, ASIMOV2
>4 string x \b, Unknown Format
>0xc byte 00 \b, DOS 3.3 sector order
>>0x10 byte 00 \b, Volume 254
>>0x10 byte&0x7f x \b, Volume %u
>0xc byte 01 \b, ProDOS sector order
>>0x14 short x \b, %u Blocks
>0xc byte 02 \b, NIB data
# Update: Greg Wildman <greg@apple2.org.za>
0 string 2IMG Apple ][ 2IMG Disk Image
>4 clear x
>4 string XGS! \b, XGS
>4 string CTKG \b, Catakig
>4 string ShIm \b, Sheppy's ImageMaker
>4 string SHEP \b, Sheppy's ImageMaker
>4 string WOOF \b, Sweet 16
>4 string B2TR \b, Bernie ][ the Rescue
>4 string \!nfc \b, ASIMOV2
>4 string \>BD\< \b, Brutal Deluxe's Cadius
>4 string CdrP \b, CiderPress
>4 string Vi][ \b, Virtual ][
>4 string PRFS \b, ProFUSE
>4 string FISH \b, FishWings
>4 string RVLW \b, Revival for Windows
>4 default x
>>4 string x \b, Creator tag "%-4.4s"
>0xc byte 00 \b, DOS 3.3 sector order
>>0x10 byte 00 \b, Volume 254
>>0x10 byte&0x7f x \b, Volume %u
>0xc byte 01 \b, ProDOS sector order
>>0x14 short x \b, %u Blocks
>0xc byte 02 \b, NIB data
# magic for Newton PDA package formats
# from Ruda Moura <ruda@helllabs.org>
@ -88,7 +163,7 @@
# http://home.earthlink.net/~hughhood/appleiiworksenvoy/
# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type')
# $70 $1A $F8 $FF is this the apple type ?
#:apple pdospøÿ
#:apple pdosp^Z\xf8\xff
!:ext awp
# minimum version needed to read this files. SFMinVers (0 , 30~3.0 )
>>>183 ubyte 30 3.0
@ -354,7 +429,7 @@
>>6 ubeshort x \b, type 0x%x
# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
# Reference: http://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h
# Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h
# Update: Joerg Jenderek
# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the
# magic stronger.
@ -396,8 +471,8 @@
# is the startup partition APPLE_PS_STARTUP
>>88 ubelong &0x80000000 \b, is the startup partition
#http://wiki.mozilla.org/DS_Store_File_Format
#http://en.wikipedia.org/wiki/.DS_Store
#https://wiki.mozilla.org/DS_Store_File_Format
#https://en.wikipedia.org/wiki/.DS_Store
0 string \0\0\0\1Bud1\0 Apple Desktop Services Store
# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015)

223
contrib/file/magic/Magdir/archive
View file

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: archive,v 1.119 2018/04/24 23:19:45 christos Exp $
# $File: archive,v 1.129 2019/05/09 18:58:02 christos Exp $
# archive: file(1) magic for archive formats (see also "msdos" for self-
# extracting compressed archives)
#
@ -148,7 +148,7 @@
>>>257 string >\0 \b, comment: %-.40s
# Incremental snapshot gnu-tar format from:
# http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
# https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
0 string GNU\ tar- GNU tar incremental snapshot data
>&0 regex [0-9]\.[0-9]+-[0-9]+ version %s
@ -226,21 +226,48 @@
# a portable archive whose first member has a name beginning with
# "debian".
#
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Deb_(file_format)
0 string =!<arch>\ndebian
>8 string debian-split part of multipart Debian package
# https://manpages.debian.org/testing/dpkg/dpkg-split.1.en.html
>14 string -split part of multipart Debian package
!:mime application/vnd.debian.binary-package
>8 string debian-binary Debian binary package
# udeb is used for stripped down deb file
!:ext deb/udeb
>14 string -binary Debian binary package
!:mime application/vnd.debian.binary-package
>8 string !debian
!:ext deb/udeb
# This should not happen
>14 default x Unknown Debian package
# NL terminated version; for most Debian cases this is 2.0 or 2.1 for splitted
>68 string >\0 (format %s)
# These next two lines do not work, because a bzip2 Debian archive
# still uses gzip for the control.tar (first in the archive). Only
# data.tar varies, and the location of its filename varies too.
# file/libmagic does not current have support for ascii-string based
# (offsets) as of 2005-09-15.
#>81 string bz2 \b, uses bzip2 compression
#>84 string gz \b, uses gzip compression
#>136 ledate x created: %s
#>68 string !2.0\n
#>>68 string x (format %.3s)
>68 string =2.0\n
# 2nd archive name=control archive name like control.tar.gz or control.tar.xz
>>72 string >\0 \b, with %.14s
# look for 3rd archive name=data archive name like data.tar.{gz,xz,bz2,lzma}
>>0 search/0x93e4f data.tar. \b, data compression
# the above line only works if FILE_BYTES_MAX in ../../src/file.h is raised
# for example like libreoffice-dev-doc_1%3a5.2.7-1+rpi1+deb9u3_all.deb
>>>&0 string x %.4s
# splitted debian package case
>68 string =2.1\n
# dpkg-1.18.25/dpkg-split/info.c
# NL terminated ASCII package name like ckermit
>>&0 string x \b, %s
# NL terminated package version like 302-5.3
>>>&1 string x %s
# NL terminated MD5 checksum
>>>>&1 string x \b, MD5 %s
# NL terminated original package length
>>>>>&1 string x \b, unsplitted size %s
# NL terminated part length
>>>>>>&1 string x \b, part lenght %s
# NL terminated package part like n/m
>>>>>>>&1 string x \b, part %s
# NL terminated package architecture like armhf since dpkg 1.16.1 or later
>>>>>>>>&1 string x \b, %s
#
# MIPS archive; they're in the portable archive format, and need to go
@ -257,15 +284,35 @@
>19 string B and an EB hash table
>22 string X -- out of date
0 search/1 -h- Software Tools format archive text
#
# BSD/SVR2-and-later portable archive formats.
#
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/AR
# Reference: https://www.unix.com/man-page/opensolaris/3HEAD/ar.h/
# Note: Mach-O universal binary in ./cafebabe is dependent
# TODO: unify current ar archive, MIPS archive, Debian package
# distinguish BSD, SVR; 32, 64 bit; HP from other 32-bit SVR;
# *.ar packages from *.a libraries. handle empty archive
0 string =!<arch>\n current ar archive
# print first and possibly second ar_name[16] for debugging purpose
#>8 string x \b, 1st "%.16s"
#>68 string x \b, 2nd "%.16s"
!:mime application/x-archive
# a in most case for libraries; lib for Microsoft libraries; ar else cases
!:ext a/lib/ar
>8 string __.SYMDEF random library
# first member with long marked name __.SYMDEF SORTED implies BSD library
>68 string __.SYMDEF\ SORTED random library
# Reference: https://parisc.wiki.kernel.org/images-parisc/b/b2/Rad_11_0_32.pdf
# "archive file" entry moved from ./hp
# LST header system_id 0210h~PA-RISC 1.1,... identifies the target architecture
# LST header a_magic 0619h~relocatable library
>68 belong 0x020b0619 - PA-RISC1.0 relocatable library
>68 belong 0x02100619 - PA-RISC1.1 relocatable library
>68 belong 0x02110619 - PA-RISC1.2 relocatable library
>68 belong 0x02140619 - PA-RISC2.0 relocatable library
#EOF for common ar archives
#
# "Thin" archive, as can be produced by GNU ar.
@ -275,6 +322,8 @@
>68 belong 1 %d symbol entry
>68 belong >1 %d symbol entries
0 search/1 -h- Software Tools format archive text
# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
#
# The first byte is the magic (0x1a), byte 2 is the compression type for
@ -799,7 +848,7 @@
# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/LHA_(file_format)
# Reference: http://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html
# Reference: https://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html
#
# check and display information of lharc (LHa,PMarc) file
0 name lharc-file
@ -999,7 +1048,7 @@
!:ext rar
# Very old RAR archive
# http://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf
# https://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf
0 string RE\x7e\x5e RAR archive data (<v1.5)
!:mime application/x-rar
!:ext rar/cbr
@ -1020,7 +1069,9 @@
0 string PK\005\006 Zip archive data (empty)
!:mime application/zip
!:ext zip/cbz
!:strength +1
0 string PK\003\004
!:strength +1
# Specialised zip formats which start with a member named 'mimetype'
# (stored uncompressed, with no 'extra field') containing the file's MIME type.
@ -1063,7 +1114,7 @@
>>>62 string base Database file
# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
# http://lists.oasis-open.org/archives/office/200505/msg00006.html
# https://lists.oasis-open.org/archives/office/200505/msg00006.html
# (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>")
>>50 string vnd.oasis.opendocument. OpenDocument
>>>73 string text
@ -1112,7 +1163,7 @@
!:mime application/vnd.oasis.opendocument.image-template
# EPUB (OEBPS) books using OCF (OEBPS Container Format)
# http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4.
# https://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4.
# From: Ralf Brown <ralf.brown@gmail.com>
>>50 string epub+zip EPUB document
!:mime application/epub+zip
@ -1306,6 +1357,16 @@
>5 byte x \b.%d
>6 belong x (%d bytes)
# From: Joerg Jenderek
# URL: https://help.foxitsoftware.com/kb/install-fzip-file.php
# reference: http://mark0.net/download/triddefs_xml.7z/
# defs/f/fzip.trid.xml
# Note: unknown compression; No "PK" zip magic; normally in directory like
# "%APPDATA%\Foxit Software\Addon\Foxit Reader\Install"
0 ubequad 0x2506781901010000 Foxit add-on/update
!:mime application/x-fzip
!:ext fzip
# From: "Robert Dale" <robdale@gmail.com>
0 belong 123 dar archive,
>4 belong x label "%.8x
@ -1316,7 +1377,7 @@
>14 beshort 0x4e53 multi-part, with -S
# Symbian installation files
# http://www.thouky.co.uk/software/psifs/sis.html
# https://www.thouky.co.uk/software/psifs/sis.html
# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
8 lelong 0x10000419 Symbian installation file
!:mime application/vnd.symbian.install
@ -1334,24 +1395,74 @@
>10 string x with compression level %.1s
# xar (eXtensible ARchiver) archive
# xar archive format: http://code.google.com/p/xar/
# URL: https://en.wikipedia.org/wiki/Xar_(archiver)
# xar archive format: https://code.google.com/p/xar/
# From: "David Remahl" <dremahl@apple.com>
# Update: Joerg Jenderek
# TODO: lzma compression; X509Data for pkg and xip
# Note: verified by `xar --dump-header -f FullBundleUpdate.xar` or
# 7z t -txar Xcode_10.2_beta_4.xip`
0 string xar! xar archive
!:mime application/x-xar
#>4 beshort x header size %d
>6 beshort x version %d,
#>8 quad x compressed TOC: %d,
#>16 quad x uncompressed TOC: %d,
# pkg for Mac OSX installer package like FullBundleUpdate.pkg
# xip for signed Apple software like Xcode_10.2_beta_4.xip
!:ext xar/pkg/xip
# always 28 in older archives
>4 ubeshort >28 \b, header size %u
# currently there exit only version 1 since about 2014
>6 ubeshort >1 version %u,
>8 ubequad x compressed TOC: %llu,
#>16 ubequad x uncompressed TOC: %llu,
# cksum_alg 0-2 in older and also 3-4 in newer
>24 belong 0 no checksum
>24 belong 1 SHA-1 checksum
>24 belong 2 MD5 checksum
>24 belong 3 SHA-256 checksum
>24 belong 4 SHA-512 checksum
>24 belong >4 unknown 0x%x checksum
#>24 belong >4 checksum
# For no compression jump 0 bytes
>24 belong 0
>>0 ubyte x
# jump more bytes forward by header size
>>>&(4.S) ubyte x
# jump more bytes forward by compressed table of contents size
#>>>>&(8.Q) ubequad x \b, heap data 0x%llx
>>>>&(8.Q) ubyte x
# look for data by ./compress after message with 1 space at end
>>>>>&-3 indirect x \b, contains
# For SHA-1 jump 20 minus 2 bytes
>24 belong 1
>>18 ubyte x
# jump more bytes forward by header size
>>>&(4.S) ubyte x
# jump more bytes forward by compressed table of contents size
>>>>&(8.Q) ubyte x
# data compressed by gzip, bzip, lzma or none
>>>>>&-1 indirect x \b, contains
# For SHA-256 jump 32 minus 2 bytes
>24 belong 3
>>30 ubyte x
# jump more bytes forward by header size
>>>&(4.S) ubyte x
# jump more bytes forward by compressed table of contents size
>>>>&(8.Q) ubyte x
>>>>>&-1 indirect x \b, contains
# For SHA-512 jump 64 minus 2 bytes
>24 belong 4
>>62 ubyte x
# jump more bytes forward by header size
>>>&(4.S) ubyte x
# jump more bytes forward by compressed table of contents size
>>>>&(8.Q) ubyte x
>>>>>&-1 indirect x \b, contains
# Type: Parity Archive
# From: Daniel van Eeden <daniel_e@dds.nl>
0 string PAR2 Parity Archive Volume Set
# Bacula volume format. (Volumes always start with a block header.)
# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html
# URL: https://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
12 string BB02 Bacula volume
>20 bedate x \b, started %s
@ -1366,11 +1477,11 @@
0 string zPQ ZPAQ stream
>3 byte x \b, level %d
# From: Barry Carter <carter.barry@gmail.com>
# http://encode.ru/threads/456-zpaq-updates/page32
# https://encode.ru/threads/456-zpaq-updates/page32
0 string 7kSt ZPAQ file
# BBeB ebook, unencrypted (LRF format)
# URL: http://www.sven.de/librie/Librie/LrfFormat
# URL: https://www.sven.de/librie/Librie/LrfFormat
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
0 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted
>8 beshort x \b, version %d
@ -1380,8 +1491,8 @@
>44 beshort x %d)
# Symantec GHOST image by Joerg Jenderek at May 2014
# http://us.norton.com/ghost/
# http://www.garykessler.net/library/file_sigs.html
# https://us.norton.com/ghost/
# https://www.garykessler.net/library/file_sigs.html
0 ubelong&0xFFFFf7f0 0xFEEF0100 Norton GHost image
# *.GHO
>2 ubyte&0x08 0x00 \b, first file
@ -1427,3 +1538,55 @@
# LyNX archive
56 string USE\040LYNX\040TO\040DISSOLVE\040THIS\040FILE LyNX archive
# From: Joerg Jenderek
# URL: https://www.acronis.com/
# Reference: https://en.wikipedia.org/wiki/TIB_(file_format)
# Note: only tested with True Image 2013 Build 5962 and 2019 Build 14110
0 ubequad 0xce24b9a220000000 Acronis True Image backup
!:mime application/x-acronis-tib
!:ext tib
# 01000000
#>20 ubelong x \b, at 20 0x%x
# 20000000
#>28 ubelong x \b, at 28 0x%x
# strings like "Generic- SD/MMC 1.00" "Unknown Disk" "Msft Virtual Disk 1.0"
# ???
# strings like "\Device\0000011e" "\Device\0000015a"
#>0 search/0x6852300/cs \\Device\\
#>>&-1 pstring x \b, %s
# "\Device\HarddiskVolume30" "\Device\HarddiskVolume39"
#>>>&1 search/180/cs \\Device\\
#>>>>&-1 pstring x \b, %s
#>>>>>&0 search/29/cs \0\0\xc8\0
# disk label
#>>>>>>&10 lestring16 x \b, disk label %11.11s
#>>>>>>&9 plestring16 x \b, disk label "%11.11s"
#>>>>>>&10 ubequad x %16.16llx
# Gentoo XPAK binary package
# by Michal Gorny <mgorny@gentoo.org>
# https://gitweb.gentoo.org/proj/portage.git/tree/man/xpak.5
-4 string STOP
>-16 string XPAKSTOP Gentoo binary package (XPAK)
# From: Joerg Jenderek
# URL: https://kodi.wiki/view/TexturePacker
# Reference: https://mirrors.kodi.tv/releases/source/17.3-Krypton.tar.gz
# /xbmc-Krypton/xbmc/guilib/XBTF.h
# /xbmc-Krypton/xbmc/guilib/XBTF.cpp
0 string XBTF
# skip ASCII text by looking for terminating \0 of path
>264 ubyte 0 XBMC texture package
!:mime application/x-xbmc-xbt
!:ext xbt
# XBTF_VERSION 2
>>4 string !2 \b, version %-.1s
# nofFiles /xbmc-Krypton/xbmc/guilib/XBTFReader.cpp
>>5 ulelong x \b, %u file
# plural s
>>5 ulelong >1 \bs
# path[CXBTFFile[MaximumPathLength=256]
>>9 string x \b, 1st %s

245
contrib/file/magic/Magdir/audio
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: audio,v 1.89 2018/07/03 20:55:37 christos Exp $
# $File: audio,v 1.111 2019/05/08 18:02:45 christos Exp $
# audio: file(1) magic for sound formats (see also "iff")
#
# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
@ -393,9 +393,15 @@
0 string MED MED_Song
0 string SymM Symphonie SymMOD music file
#
# Track Length (TRL), Tracks (TRK), Samples (SMP), Subsongs (SS)
# http://lclevy.free.fr/exotica/ahx/ahxformat.txt
0 string THX AHX version
>3 byte =0 1 module data
>3 byte =1 2 module data
>10 byte x TRL: %u
>11 byte x TRK: %u
>12 byte x SMP: %u
>13 byte x SS: %u
#
0 string OKTASONG Oktalyzer module data
#
@ -535,6 +541,18 @@
# adlib sound files
# From: Alex Myczko <alex@aiei.ch>
# https://github.com/rerrahkr/BambooTracker
0 string BambooTrackerMod BambooTracker module
>22 byte x \b, version %u
>21 byte x \b.%u
>20 byte x \b.%u
0 string BambooTrackerIst BambooTracker instrument
>22 byte x \b, version %u
>21 byte x \b.%u
>20 byte x \b.%u
0 string RAWADATA RdosPlay RAW
1068 string RoR AMUSIC Adlib Tracker
@ -550,6 +568,14 @@
0 string ofTAZ! eXtra Simple Music
0 string FMK! FM Kingtracker Song
0 string DFM DFM Song
0 string \<CUD-FM-File\> CFF Song
0 string _A2module A2M Song
# Spectrum 128 tunes (.ay files).
# From: Emanuel Haupt <ehaupt@critical.ch>
0 string ZXAYEMUL Spectrum 128 tune
@ -631,7 +657,7 @@
# IMY
# from http://filext.com/detaillist.php?extdetail=IMY
# http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm
# https://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm
# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html
# http://www.wx800.com/msg/download/irda/iMelody.pdf
0 string BEGIN:IMELODY iMelody Ringtone Format
@ -647,6 +673,8 @@
# URL: http://filext.com/detaillist.php?extdetail=AMR
# From: Russell Coker <russell@coker.com.au>
0 string #!AMR Adaptive Multi-Rate Codec (GSM telephony)
!:mime audio/amr
!:ext amr
# Type: SuperCollider 3 Synth Definition File Format
# From: Mario Lang <mlang@debian.org>
@ -654,12 +682,12 @@
>4 belong x version %d
# Type: True Audio Lossless Audio
# URL: http://wiki.multimedia.cx/index.php?title=True_Audio
# URL: https://wiki.multimedia.cx/index.php?title=True_Audio
# From: Mike Melanson <mike@multimedia.cx>
0 string TTA1 True Audio Lossless Audio
# Type: WavPack Lossless Audio
# URL: http://wiki.multimedia.cx/index.php?title=WavPack
# URL: https://wiki.multimedia.cx/index.php?title=WavPack
# From: Mike Melanson <mike@multimedia.cx>
0 string wvpk WavPack Lossless Audio
@ -667,6 +695,8 @@
# VGM music file
0 string Vgm\040
>9 ubyte >0 VGM Video Game Music dump v
!:mime audio/x-vgm
!:ext vgm
>>9 ubyte/16 >0 \b%d
>>9 ubyte&0x0F x \b%d
>>8 ubyte/16 x \b.%d
@ -713,6 +743,54 @@
>>>>0x78 ubyte 0x03 AY-3-8930,
>>>>0x78 ubyte 0x10 YM2149,
>>>>0x78 ubyte 0x11 YM3439,
# VGM 1.61
>>0x34 ulelong >0x4C
>>>0x80 ulelong >0 DMG,
>>0x34 ulelong >0x50
>>>0x84 lelong >0 NES APU,
>>>0x84 lelong <0 NES APU with FDS,
>>0x34 ulelong >0x54
>>>0x88 ulelong >0 MultiPCM,
>>0x34 ulelong >0x58
>>>0x8C ulelong >0 uPD7759,
>>0x34 ulelong >0x5C
>>>0x90 ulelong >0 OKIM6258,
>>0x34 ulelong >0x64
>>>0x98 ulelong >0 OKIM6295,
>>0x34 ulelong >0x68
>>>0x9C ulelong >0 K051649,
>>0x34 ulelong >0x6C
>>>0xA0 ulelong >0 K054539,
>>0x34 ulelong >0x70
>>>0xA4 ulelong >0 HuC6280,
>>0x34 ulelong >0x74
>>>0xA8 ulelong >0 C140,
>>0x34 ulelong >0x78
>>>0xAC ulelong >0 K053260,
>>0x34 ulelong >0x7C
>>>0xB0 ulelong >0 Pokey,
>>0x34 ulelong >0x80
>>>0xB4 ulelong >0 QSound,
# VGM 1.71
>>0x34 ulelong >0x84
>>>0xB8 ulelong >0 SCSP,
>>0x34 ulelong >0x8C
>>>0xC0 ulelong >0 WonderSwan,
>>0x34 ulelong >0x90
>>>0xC4 ulelong >0 VSU,
>>0x34 ulelong >0x94
>>>0xC8 ulelong >0 SAA1099,
>>0x34 ulelong >0x98
>>>0xCC ulelong >0 ES5503,
>>0x34 ulelong >0x9C
>>>0xD0 lelong >0 ES5505,
>>>0xD0 lelong <0 ES5506,
>>0x34 ulelong >0xA4
>>>0xD8 ulelong >0 X1-010,
>>0x34 ulelong >0xA8
>>>0xDC ulelong >0 C352,
>>0x34 ulelong >0xAC
>>>0xE0 ulelong >0 GA20,
# GVOX Encore file format
# Since this is a proprietary file format and there is no publicly available
@ -727,8 +805,8 @@
# Summary: Garmin Voice Processing Module (WAVE audios)
# From: Joerg Jenderek
# URL: http://www.garmin.com/
# Reference: http://turboccc.wikispaces.com/share/view/28622555
# URL: https://www.garmin.com/
# Reference: http://www.poi-factory.com/node/19580
# NOTE: there exist 2 other Garmin VPM formats
0 string AUDIMG
# skip text files starting with string "AUDIMG"
@ -752,16 +830,35 @@
# if you select a language like german on your garmin device
# you can only select voice modules with corresponding language byte ID like 1
>>18 ubyte x \b, language ID %d
# structure for phrases/sentences?
# number of voice sample in the 1st phrase?
#>>19 uleshort x \b, 0x%x samples
#>>>21 uleshort >0 \b, at 0x%4.4x
#>>>(21.s) ubequad x 0x%llx
# 2nd phrase?
#>>23 uleshort x \b, 0x%x samples
#>>>25 uleshort >0 \b, at 0x%4.4x
#>>>(25.s) ubequad x 0x%llx
# pointer to 1st audio WAV sample
>>16 uleshort >0
>>>(16.s) ulelong >0 \b, at offset 0x%x
>>>(16.s) ulelong >0 \b, at 0x%x
# WAV length
>>>>(16.s+4) ulelong >0 %d Bytes
# 1 space char after "bytes" to get phrase "bytes RIFF"
>>>>(16.s+4) ulelong >0 %u bytes
# look for magic
>>>>>(&-8.l) string RIFF
# determine type by ./riff
>>>>>>&-4 indirect x \b
>>>>>>&-4 indirect x
# 2 - ~ 131 WAV samples following same way
#
# Summary: encrypted Garmin Voice Processing Module
# From: Joerg Jenderek
# URL: https://www.garmin.com/us/products/ontheroad/voicestudio
# NOTE: Encrypted variant used in voices like DrNightmare, Elfred, Yeti.
# There exist 2 other Garmin VPM formats
0 ubequad 0xa141190fecc8ced6 Garmin Voice Processing Module (encrypted)
!:mime audio/x-vpm-garmin
!:ext vpm
# From Martin Mueller Skarbiniks Pedersen
0 string GDM
@ -816,7 +913,7 @@
>>>0x31 byte&0x0F x \b%02d
>>>>0x4 string >\0 \b, title: "%s"
# magic for Klystrack, http://kometbomb.github.io/klystrack/
# magic for Klystrack, https://kometbomb.github.io/klystrack/
# from Alex Myczko <alex@aiei.ch>
0 string cyd!song Klystrack song
>8 byte >0 \b, version %u
@ -866,11 +963,15 @@
# Added by David Korth <gerbilsoft@gerbilsoft.com>
0x00 beshort 0x8000
>(2.S-2) string (c)CRI CRI ADX ADPCM audio
!:ext adx
!:mime audio/x-adx
!:strength +50
>>0x12 byte x v%u
>>0x04 byte 0x02 \b, pre-set prediction coefficients
>>0x04 byte 0x03 \b, standard ADX
>>0x04 byte 0x04 \b, exponential scale
>>0x04 byte 0x05 \b, AHX
>>0x04 byte 0x10 \b, AHX (Dreamcast)
>>0x04 byte 0x11 \b, AHX
>>0x08 belong x \b, %u Hz
>>0x12 byte 0x03
>>>0x02 beshort >0x2B
@ -888,3 +989,125 @@
# Sony PlayStation Audio (.xa)
0 leshort 0x4158 Sony PlayStation Audio
# Portable Sound Format
# Used for audio rips for various consoles.
# http://fileformats.archiveteam.org/wiki/Portable_Sound_Format
# Added by David Korth <gerbilsoft@gerbilsoft.com>
0 string PSF Portable Sound Format
!:mime audio/x-psf
>3 byte 0x01 (Sony PlayStation)
>3 byte 0x02 (Sony PlayStation 2)
>3 byte 0x11 (Sega Saturn)
>3 byte 0x12 (Sega Dreamcast)
>3 byte 0x13 (Sega Mega Drive)
>3 byte 0x21 (Nintendo 64)
>3 byte 0x22 (Game Boy Advance)
>3 byte 0x23 (Super NES)
>3 byte 0x41 (Capcom QSound)
# Atari 8-bit SAP audio format
# http://asap.sourceforge.net/sap-format.html
# Added by David Korth <gerbilsoft@gerbilsoft.com>
0 string SAP\r\n Atari 8-bit SAP audio file
!:mime audio/x-sap
!:ext sap
>5 search/1024 NAME
>>&1 string x \b: %s
>>5 search/1024 AUTHOR
>>>&1 string x by %s
# Nintendo Wii BRSTM audio format (fields)
# NOTE: Assuming HEAD starts at 0x40.
# FIXME: Replace 0x48 with HEAD offset plus 8.
0 name nintendo-wii-brstm-fields
>(0x10.L) string HEAD \b:
>>(0x10.L+0x0C) belong x
>>>(&-4.L+0x48) belong x
>>>>&-4 byte 0 PCM, signed 8-bit,
>>>>&-4 byte 1 PCM, signed 16-bit,
>>>>&-4 byte 2 THP ADPCM,
>>>>&-3 byte !0 looping,
>>>>&-2 byte 1 mono
>>>>&-2 byte 2 stereo
>>>>&-2 byte 3 3 channels
>>>>&-2 byte 4 quad
>>>>&-2 byte >4 %u channels
>>>>&0 beshort !0 %u Hz
# Nintendo Wii BRSTM audio format
# https://wiibrew.org/wiki/BRSTM_file
# Added by David Korth <gerbilsoft@gerbilsoft.com>
0 string RSTM Nintendo Wii BRSTM audio file
!:mime audio/x-brstm
!:ext brstm
# Wii is big-endian, so default to BE.
>4 beshort 0xFEFF
>>0 use nintendo-wii-brstm-fields
>4 leshort 0xFEFF
>>0 use \^nintendo-wii-brstm-fields
# Nintendo 3DS BCSTM audio format (fields)
0 name nintendo-3ds-bcstm-fields
>(0x18.l) string INFO \b:
# INFO block: Stream information starts at 0x20 (minus 4 for the 'INFO' magic)
>>&0x1C byte 0 PCM, signed 8-bit,
>>&0x1C byte 1 PCM, signed 16-bit,
>>&0x1C byte 2 DSP ADPCM,
>>&0x1C byte 3 IMA ADPCM,
>>&0x1D byte !0 looping,
>>&0x1E byte 1 mono
>>&0x1E byte 2 stereo
>>&0x1E byte 3 3 channels
>>&0x1E byte 4 quad
>>&0x1E byte >4 %u channels
>>&0x20 lelong !0 %u Hz
# Nintendo 3DS BCSTM audio format
# https://www.3dbrew.org/wiki/BCSTM
# Added by David Korth <gerbilsoft@gerbilsoft.com>
0 string CSTM Nintendo 3DS BCSTM audio file
!:mime audio/x-bcstm
!:ext bcstm
# 3DS is little-endian, so default to LE.
>4 leshort 0xFEFF
>>0 use nintendo-3ds-bcstm-fields
>4 beshort 0xFEFF
>>0 use \^nintendo-3ds-bcstm-fields
# Nintendo Wii U BFSTM audio format
# http://mk8.tockdom.com/wiki/BFSTM_(File_Format)
# NOTE: This format is very similar to BCSTM.
# Added by David Korth <gerbilsoft@gerbilsoft.com>
0 string FSTM Nintendo Wii U BFSTM audio file
!:mime audio/x-bfstm
!:ext bfstm
# BFSTM is used on both Wii U (BE) and Switch (LE),
# so default to LE.
>4 leshort 0xFEFF
>>0 use nintendo-3ds-bcstm-fields
>4 beshort 0xFEFF
>>0 use \^nintendo-3ds-bcstm-fields
# Nintendo 3DS BCSTM audio format (fields)
0 name nintendo-3ds-bcwav-fields
>(0x18.l) string INFO \b:
# INFO block (minus 4 for INFO magic)
>>&0x4 byte 0 PCM, signed 8-bit,
>>&0x4 byte 1 PCM, signed 16-bit,
>>&0x4 byte 2 DSP ADPCM,
>>&0x4 byte 3 IMA ADPCM,
>>&0x5 byte !0 looping,
>>&0x8 lelong x stereo
>>&0x8 lelong !0 %u Hz
# Nintendo 3DS BCWAV audio format
# https://www.3dbrew.org/wiki/BCWAV
# Added by David Korth <gerbilsoft@gerbilsoft.com>
0 string CWAV Nintendo 3DS BCWAV audio file
!:mime audio/x-bcwav
!:ext bcwav
# 3DS is little-endian, so default to LE.
>4 leshort 0xFEFF
>>0 use nintendo-3ds-bcwav-fields
>4 beshort 0xFEFF
>>0 use \^nintendo-3ds-bcwav-fields

4
contrib/file/magic/Magdir/basis
View file

@ -1,9 +1,9 @@
#----------------------------------------------------------------
# $File: basis,v 1.4 2009/09/19 16:28:08 christos Exp $
# $File: basis,v 1.5 2019/04/19 00:42:27 christos Exp $
# basis: file(1) magic for BBx/Pro5-files
# Oliver Dammer <dammer@olida.de> 2005/11/07
# http://www.basis.com business-basic-files.
# https://www.basis.com business-basic-files.
#
0 string \074\074bbx\076\076 BBx
>7 string \000 indexed file

6
contrib/file/magic/Magdir/ber
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: ber,v 1.1 2016/06/05 00:21:30 christos Exp $
# $File: ber,v 1.2 2019/04/19 00:42:27 christos Exp $
# ber: file(1) magic for several BER formats used in the mobile
# telecommunications industry (Georg Sauthoff)
@ -19,7 +19,7 @@
#
# TAP 3 Files
# TAP -> Transferred Account Procedure
# cf. http://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf
# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf
# TransferBatch short tag
0 byte 0x61
# BatchControlInfo short tag
@ -47,7 +47,7 @@
>>&0 byte x NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange)
# RAP Files
# cf. http://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf
# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf
# Long ReturnBatch tag
0 string \x7f\x84\x16
# Long RapBatchControlInfo tag

8
contrib/file/magic/Magdir/bioinformatics
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: bioinformatics,v 1.4 2016/06/20 16:13:46 christos Exp $
# $File: bioinformatics,v 1.5 2019/04/19 00:42:27 christos Exp $
# bioinfomatics: file(1) magic for Bioinfomatics file formats
###############################################################################
@ -83,7 +83,7 @@
###############################################################################
# BCF (Binary Call Format), version 2.1
# used by SAMtools (http://samtools.github.io/hts-specs/BCFv2_qref.pdf)
# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf)
# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
###############################################################################
0 string BCF\2\1 Binary Call Format (BCF) version 2.1
@ -96,7 +96,7 @@
###############################################################################
# BCF (Binary Call Format), version 2.2
# used by SAMtools (http://samtools.github.io/hts-specs/BCFv2_qref.pdf)
# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf)
# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
###############################################################################
0 string BCF\2\2 Binary Call Format (BCF) version 2.2
@ -129,7 +129,7 @@
###############################################################################
# FASTA
# used by FASTA (http://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf)
# used by FASTA (https://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf)
###############################################################################
#0 byte 0x3e
# q>0 regex =^[>][!-~\t\ ]+$

154
contrib/file/magic/Magdir/biosig Normal file
View file

@ -0,0 +1,154 @@
##############################################################################
#
# Magic ids for biomedical signal file formats
# Copyright (C) 2018 Alois Schloegl <alois.schloegl@gmail.com>
#
# The list has been derived from biosig projects
# http://biosig.sourceforge.net
# https://pub.ist.ac.at/~schloegl/matlab/eeg/
# https://pub.ist.ac.at/~schloegl/biosig/TESTED
#
##############################################################################
#
0 string ABF\x20 Biosig/Axon Binary format
!:mime biosig/abf2
0 string ABF2\0\0 Biosig/Axon Binary format
!:mime biosig/abf2
#
0 string ATES\x20MEDICA\x20SOFT.\x20EEG\x20for\x20Windows Biosig/ATES MEDICA SOFT. EEG for Windows
!:mime biosig/ates
#
0 string ATF\x09 Biosig/Axon Text fomrat
!:mime biosig/atf
#
0 string ADU1 Biosig/Axona file format
!:mime biosig/axona
0 string ADU2 Biosig/Axona file format
!:mime biosig/axona
#
0 string ALPHA-TRACE-MEDICAL Biosig/alpha trace
!:mime biosig/alpha
#
0 string AxGr Biosig/AXG
0 string axgx Biosig/AXG
!:mime biosig/axg
#
0 string HeaderLen= Biosig/BCI2000
0 string BCI2000V Biosig/BCI2000
!:mime biosig/bci2000
#
### Specification: https://www.biosemi.com/faq/file_format.htm
0 string \xffBIOSEMI Biosig/Biosemi data format
!:mime biosig/bdf
#
0 string Brain\x20Vision\x20Data\x20Exchange\x20Header\x20File Biosig/Brainvision data file
0 string Brain\x20Vision\x20V-Amp\x20Data\x20Header\x20File\x20Version Biosig/Brainvision V-Amp file
0 string Brain\x20Vision\x20Data\x20Exchange\x20Marker\x20File,\x20Version Biosig/Brainvision Marker file
!:mime biosig/brainvision
#
0 string CEDFILE Biosig/CFS: Cambridge Electronic devices File format
!:mime biosig/ced
#
### Specification: https://www.edfplus.info/specs/index.html
0 string 0\x20\x20\x20\x20\x20\x20\x20 Biosig/EDF: European Data format
!:mime biosig/edf
#
### Specifications: https://arxiv.org/abs/cs/0608052
0 string GDF Biosig/GDF: General data format for biosignals
!:mime biosig/gdf
#
0 string DATA\0\0\0\0 Biosig/Heka Patchmaster
0 string DAT1\0\0\0\0 Biosig/Heka Patchmaster
0 string DAT2\0\0\0\0 Biosig/Heka Patchmaster
!:mime biosig/heka
#
0 string (C)\x20CED\x2087 Biosig/CED SMR
!:mime biosig/ced-smr
#
0 string CFWB\1\0\0\0 Biosig/CFWB
!:mime biosig/cfwb
#
0 string DEMG Biosig/DEMG
!:mime biosig/demg
#
0 string EBS\x94\x0a\x13\x1a\x0d Biosig/EBS
!:mime biosig/ebs
#
0 string Embla\x20data\x20file Biosig/Embla
!:mime biosig/embla
#
0 string Header\r\nFile Version Biosig/ETG4000
!:mime biosig/etg4000
#
0 string GALILEO\x20EEG\x20TRACE\x20FILE Biosig/Galileo
!:mime biosig/galileo
#
0 string IGOR Biosig/IgorPro ITX file
!:mime biosig/igorpro
#
# Specification: http://www.ampsmedical.com/uploads/2017-12-7/The_ISHNE_Format.pdf
0 string ISHNE1.0 Biosig/ISHNE
!:mime biosig/ishne
#
# CEN/ISO 11073/22077 series, http://www.mfer.org/en/document.htm
0 string @\x20\x20MFER\x20 Biosig/MFER
0 string @\x20MFR\x20 Biosig/MFER
!:mime biosig/mfer
#
0 string NEURALEV Biosig/NEV
0 string N.EV.\0 Biosig/NEV
!:mime biosig/nev
#
0 string NEX1 Biosig/NEX
!:mime biosig/nex1
#
0 string PLEX Biosig/Plexon v1.0
10 string PLEXON Biosig/Plexon v2.0
!:mime biosig/plexon
#
0 string \x02\x27\x91\xC6 Biosig/RHD2000: Intan RHD2000 format
#
# Specification: CEN 1064:2005/ISO 11073:91064
16 string SCPECG\0\0 Biosig/SCP-ECG format CEN 1064:2005/ISO 11073:91064
!:mime biosig/scpecg
#
0 string IAvSFo Biosig/SIGIF
!:mime biosig/sigif
#
0 string POLY\x20SAMPLE\x20FILEversion\x20 Biosig/TMS32
!:mime biosig/tms32
#
0 string FileId=TMSi\x20PortiLab\x20sample\x20log\x20file\x0a\x0dVersion= Biosig/TMSiLOG
!:mime biosig/tmsilog
#
4 string Synergy\0\48\49\50\46\48\48\51\46\48\48\48\46\48\48\48\0\28\0\0\0\2\0\0\0
>63 string CRawDataElement
>>85 string CRawDataBuffer Biosig/SYNERGY
!:mime biosig/synergy
#
4 string \40\0\4\1\44\1\102\2\146\3\44\0\190\3 Biosig/UNIPRO
!:mime biosig/unipro
#
0 string VER=9\r\nCTIME= Biosig/WCP
!:mime biosig/wcp
#
0 string \xAF\xFE\xDA\xDA Biosig/Walter Graphtek
0 string \xDA\xDA\xFE\xAF Biosig/Walter Graphtek
0 string \x55\x55\xFE\xAF Biosig/Walter Graphtek
!:mime biosig/walter-graphtek
#
0 string V3.0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20
>32 string [PatInfo] Biosig/Sigma
!:mime biosig/sigma
#
0 string \067\069\078\013\010\0x1a\04\0x84 Biosig/File exchange format (FEF)
!:mime biosig/fef
0 string \67\69\78\0x13\0x10\0x1a\4\0x84 Biosig/File exchange format (FEF)
!:mime biosig/fef
#
0 string \0\0\0\x64\0\0\0\x1f\0\0\0\x14\0\0\0\0\0\1
>36 string \0\0\0\x65\0\0\0\3\0\0\0\4\0\0
>>56 string \0\0\0\x6a\0\0\0\3\0\0\0\4\0\0\0\0\xff\xff\xff\xff\0\0 Biosig/FIFF
!:mime biosig/fiff
#

2
contrib/file/magic/Magdir/blcr
View file

@ -1,5 +1,5 @@
# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files
# http://ftg.lbl.gov/checkpoint
# https://ftg.lbl.gov/checkpoint
0 string C\0\0\0R\0\0\0 BLCR
>16 lelong 1 x86
>16 lelong 3 alpha

4
contrib/file/magic/Magdir/blender
View file

@ -1,10 +1,10 @@
#------------------------------------------------------------------------------
# $File: blender,v 1.7 2017/03/17 21:35:28 christos Exp $
# $File: blender,v 1.8 2019/04/19 00:42:27 christos Exp $
# blender: file(1) magic for Blender 3D related files
#
# Native format rule v1.2. For questions use the developers list
# http://lists.blender.org/mailman/listinfo/bf-committers
# https://lists.blender.org/mailman/listinfo/bf-committers
# GLOB chunk was moved near start and provides subversion info since 2.42
0 string =BLENDER Blender3D,

69
contrib/file/magic/Magdir/c-lang
View file

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: c-lang,v 1.26 2017/08/14 07:40:38 christos Exp $
# $File: c-lang,v 1.27 2019/02/27 16:46:23 christos Exp $
# c-lang: file(1) magic for C and related languages programs
#
# The strength is to beat standard HTML
@ -12,31 +12,41 @@
# C
# Check for class if include is found, otherwise class is beaten by include becouse of lowered strength
0 regex \^#include C
>0 regex \^class[[:space:]]+
>>&0 regex \\{[\.\*]\\}(;)?$ \b++
>&0 clear x source text
0 search/8192 #include
>0 regex \^#include C
>>0 regex \^class[[:space:]]+
>>>&0 regex \\{[\.\*]\\}(;)?$ \b++
>>&0 clear x source text
!:strength + 13
!:mime text/x-c
0 regex \^#[[:space:]]*pragma C source text
0 search/8192 pragma
>0 regex \^#[[:space:]]*pragma C source text
!:mime text/x-c
0 regex \^#[[:space:]]*(if\|ifn)def
>&0 regex \^#[[:space:]]*endif$ C source text
0 search/8192 endif
>0 regex \^#[[:space:]]*(if\|ifn)def
>>&0 regex \^#[[:space:]]*endif$ C source text
!:mime text/x-c
0 regex \^#[[:space:]]*(if\|ifn)def
>&0 regex \^#[[:space:]]*define C source text
0 search/8192 define
>0 regex \^#[[:space:]]*(if\|ifn)def
>>&0 regex \^#[[:space:]]*define C source text
!:mime text/x-c
0 regex \^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text
0 search/8192 char
>0 regex \^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text
!:mime text/x-c
0 regex \^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text
0 search/8192 double
>0 regex \^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text
!:mime text/x-c
0 regex \^[[:space:]]*extern[[:space:]]+ C source text
0 search/8192 extern
>0 regex \^[[:space:]]*extern[[:space:]]+ C source text
!:mime text/x-c
0 regex \^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text
0 search/8192 float
>0 regex \^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text
!:mime text/x-c
0 regex \^struct[[:space:]]+ C source text
0 search/8192 struct
>0 regex \^struct[[:space:]]+ C source text
!:mime text/x-c
0 regex \^union[[:space:]]+ C source text
0 search/8192 union
>0 regex \^union[[:space:]]+ C source text
!:mime text/x-c
0 search/8192 main(
>&0 regex \\)[[:space:]]*\\{ C source text
@ -44,35 +54,44 @@
# C++
# The strength of these rules is increased so they beat the C rules above
0 regex \^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{ C++ source text
0 search/8192 namespace
>0 regex \^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{ C++ source text
!:strength + 30
!:mime text/x-c++
# using namespace [namespace] or using std::[lib]
0 regex \^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*; C++ source text
0 search/8192 using
>0 regex \^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*; C++ source text
!:strength + 30
!:mime text/x-c++
0 regex \^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$ C++ source text
0 search/8192 template
>0 regex \^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$ C++ source text
!:strength + 30
!:mime text/x-c++
0 regex \^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$ C++ source text
0 search/8192 virtual
>0 regex \^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$ C++ source text
!:strength + 30
!:mime text/x-c++
# But class alone is reduced to avoid beating php (Jens Schleusener)
0 regex \^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$ C++ source text
0 search/8192 class
>0 regex \^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$ C++ source text
!:strength + 13
!:mime text/x-c++
0 regex \^[[:space:]]*public: C++ source text
0 search/8192 public
>0 regex \^[[:space:]]*public: C++ source text
!:strength + 30
!:mime text/x-c++
0 regex \^[[:space:]]*private: C++ source text
0 search/8192 private
>0 regex \^[[:space:]]*private: C++ source text
!:strength + 30
!:mime text/x-c++
0 regex \^[[:space:]]*protected: C++ source text
0 search/8192 protected
>0 regex \^[[:space:]]*protected: C++ source text
!:strength + 30
!:mime text/x-c++
# Objective-C
0 regex \^#import Objective-C source text
0 search/8192 #import
>0 regex \^#import Objective-C source text
!:strength + 25
!:mime text/x-objective-c

47
contrib/file/magic/Magdir/cad
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: cad,v 1.16 2018/05/07 23:26:31 christos Exp $
# $File: cad,v 1.19 2019/04/19 00:42:27 christos Exp $
# autocad: file(1) magic for cad files
#
@ -11,12 +11,12 @@
# raster underlays to Microstation DGN (vector) drawings.
#
# http://www.wotsit.org/search.asp
# http://filext.com/detaillist.php?extdetail=DGN
# http://filext.com/detaillist.php?extdetail=CIT
# https://filext.com/detaillist.php?extdetail=DGN
# https://filext.com/detaillist.php?extdetail=CIT
#
# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
# https://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
# https://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
0 string \010\011\376 Microstation
>3 string \002
@ -43,8 +43,8 @@
>4 string \030\000\003 CITFile
# AutoCAD
# Merge of the different contributions and updates from http://en.wikipedia.org/wiki/Dwg
# and http://www.iana.org/assignments/media-types/image/vnd.dwg
# Merge of the different contributions and updates from https://en.wikipedia.org/wiki/Dwg
# and https://www.iana.org/assignments/media-types/image/vnd.dwg
0 string MC0.0 DWG AutoDesk AutoCAD Release 1.0
!:mime image/vnd.dwg
0 string AC1.2 DWG AutoDesk AutoCAD Release 1.2
@ -89,7 +89,7 @@
# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
# ICQ 358572321)
# From various sources like:
# http://autodesk.blogs.com/between_the_lines/autocad-release-history.html
# https://autodesk.blogs.com/between_the_lines/autocad-release-history.html
0 string AC1018 DWG AutoDesk AutoCAD 2004/2005/2006
!:mime image/vnd.dwg
0 string AC1021 DWG AutoDesk AutoCAD 2007/2008/2009
@ -102,13 +102,13 @@
# KOMPAS 2D drawing from ASCON
# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor
# gathered nor specification
# ASCON http://ascon.net/main/ in English,
# http://ascon.ru/ main site in Russian
# ASCON https://ascon.net/main/ in English,
# https://ascon.ru/ main site in Russian
# Extension is CDW for drawing and FRW for fragment of drawing
# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
# ICQ 358572321, http://vkontakte.ru/id16076543)
# ICQ 358572321, https://vkontakte.ru/id16076543)
# From:
# http://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292
# https://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292
# (in russian) and my experiments
0 string KF
>2 belong 0x4E00000C Kompas drawing 12.0 SP1
@ -156,7 +156,7 @@
!:ext 3ds
# MegaCAD 2D/3D drawing (.prt)
# http://megacad.de/
# https://megacad.de/
# From: Markus Heidelberg <markus.heidelberg@web.de>
0 string MegaCad23\0 MegaCAD 2D/3D drawing
@ -167,3 +167,24 @@
0 string ;;\020HSF\020V OpenHSF (Hoops Stream Format)
>7 regex/9 V[.0-9]{4,5}\020 %s
!:ext hsf
# AutoCAD Drawing Exchange Format
0 regex \^[\ \t]*0\r?\000$
>1 regex \^[\ \t]*SECTION\r?$
>>2 regex \^[\ \t]*2\r?$
>>>3 regex \^[\ \t]*HEADER\r?$ AutoCAD Drawing Exchange Format
!:mime application/x-dxf
!:ext dxf
>>>>&1 search/8192 AC1006 \b, R10
>>>>&1 search/8192 AC1009 \b, R11/R12
>>>>&1 search/8192 AC1012 \b, R13
>>>>&1 search/8192 AC1014 \b, R14
>>>>&1 search/8192 AC1015 \b, version 2000
>>>>&1 search/8192 AC1018 \b, version 2004
>>>>&1 search/8192 AC1021 \b, version 2007
>>>>&1 search/8192 AC1024 \b, version 2010
# The Sketchup 3D model format https://www.sketchup.com/
0 string \xff\xfe\xff\x0e\x53\x00\x6b\x00\x65\x00\x74\x00\x63\x00\x68\x00\x55\x00\x70\x00\x20\x00\x4d\x00\x6f\x00\x64\x00\x65\x00\x6c\x00 SketchUp Model
!:mime application/vnd.sketchup.skp
!:ext skp

12
contrib/file/magic/Magdir/cafebabe
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: cafebabe,v 1.23 2017/05/25 20:07:23 christos Exp $
# $File: cafebabe,v 1.24 2018/10/01 23:33:15 christos Exp $
# Cafe Babes unite!
#
# Since Java bytecode and Mach-O universal binaries have the same magic number,
@ -58,15 +58,15 @@
>>4 belong <20 Mach-O universal binary with %d architectures:
!:mime application/x-mach-binary
>>>8 use mach-o \b
>>4 belong 2
>>4 belong >1
>>>28 use mach-o \b
>>4 belong 3
>>4 belong >2
>>>48 use mach-o \b
>>4 belong 4
>>4 belong >3
>>>68 use mach-o \b
>>4 belong 5
>>4 belong >4
>>>88 use mach-o \b
>>4 belong 6
>>4 belong >5
>>>108 use mach-o \b
### MACH-O END ###

30
contrib/file/magic/Magdir/clojure Normal file
View file

@ -0,0 +1,30 @@
#------------------------------------------------------------------------------
# file: file(1) magic for Clojure
# URL: https://clojure.org/
# From: Jason Felice <jason.m.felice@gmail.com>
0 string/w #!\ /usr/bin/clj Clojure script text executable
!:mime text/x-clojure
0 string/w #!\ /usr/local/bin/clj Clojure script text executable
!:mime text/x-clojure
0 string/w #!\ /usr/bin/clojure Clojure script text executable
!:mime text/x-clojure
0 string/w #!\ /usr/local/bin/clojure Clojure script text executable
!:mime text/x-clojure
0 string/W #!/usr/bin/env\ clj Clojure script text executable
!:mime text/x-clojure
0 string/W #!/usr/bin/env\ clojure Clojure script text executable
!:mime text/x-clojure
0 string/W #!\ /usr/bin/env\ clj Clojure script text executable
!:mime text/x-clojure
0 string/W #!\ /usr/bin/env\ clojure Clojure script text executable
!:mime text/x-clojure
0 regex \^\\\(ns[[:space:]]+[a-z] Clojure module source text
!:mime text/x-clojure
0 regex \^\\\(ns[[:space:]]+\\\^\\{: Clojure module source text
!:mime text/x-clojure
0 regex \^\\\(defn-?[[:space:]] Clojure module source text
!:mime text/x-clojure

6
contrib/file/magic/Magdir/coff
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: coff,v 1.2 2017/03/17 21:35:28 christos Exp $
# $File: coff,v 1.3 2018/08/01 10:34:03 christos Exp $
# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures
#
# COFF
@ -26,6 +26,10 @@
>>0 uleshort 0x0550 Hitachi SH little-endian
# executable (RISC System/6000 V3.1) or obj module (./ibm6000)
#>>0 uleshort 0x01DF
# MS Windows COFF Intel Itanium, AMD64
# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=vs.85).aspx
>>0 uleshort 0x0200 Intel ia64
>>0 uleshort 0x8664 Intel amd64
# TODO for other COFFs
#>>0 uleshort 0xABCD COFF_TEMPLATE
>>0 default x

6
contrib/file/magic/Magdir/commands
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: commands,v 1.59 2017/08/14 07:40:38 christos Exp $
# $File: commands,v 1.60 2019/04/19 00:42:27 christos Exp $
# commands: file(1) magic for various shells and interpreters
#
#0 string/w : shell archive or script for antique kernel text
@ -96,7 +96,7 @@
0 search/1/w #!\ /usr/bin/php PHP script text executable
!:strength + 10
!:mime text/x-php
# Smarty compiled template, http://www.smarty.net/
# Smarty compiled template, https://www.smarty.net/
# Elan Ruusamae <glen@delfi.ee>
0 string =<?php
>5 regex [\ \n]
@ -109,7 +109,7 @@
0 string/t $! DCL command file
# Type: Pdmenu
# URL: http://packages.debian.org/pdmenu
# URL: https://packages.debian.org/pdmenu
# From: Edward Betts <edward@debian.org>
0 string #!/usr/bin/pdmenu Pdmenu configuration file text

87
contrib/file/magic/Magdir/compress
View file

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: compress,v 1.72 2018/03/27 23:26:41 christos Exp $
# $File: compress,v 1.75 2019/04/19 00:42:27 christos Exp $
# compress: file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
@ -16,13 +16,78 @@
>2 byte&0x1f x %d bits
# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
# URL: https://en.wikipedia.org/wiki/Gzip
# Reference: https://tools.ietf.org/html/rfc1952
# Update: Joerg Jenderek, Apr 2019
# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
# * Original filename is only at offset 10 if "extra field" absent
# * Produce shorter output - notably, only report compression methods
# other than 8 ("deflate", the only method defined in RFC 1952).
0 string \037\213 gzip compressed data
!:mime application/x-gzip
!:strength * 2
# Note: find defs -iname '*.trid.xml' -exec grep -q '<Bytes>1F8B08' {} \; -ls
# TODO:
# FBR Blueberry FlashBack screen Record https://www.flashbackrecorder.com/
# KPR KOffice/Calligra KPresenter application/x-kpresenter
# KPT KOffice/Calligra KPresenter template? application/x-kpresenter
# SAV Diggles Saved Game File http://www.innonics.com
# SAV FarCry (demo) saved game http://www.farcry-thegame.com
# DAT ZOAGZIP game data format http://en.wikipedia.org/wiki/SD_Gundam_Capsule_Fighter
0 string \037\213
# to display gzip compressed (strength=100=2*50) before other (strength=50)?
#!:strength * 2
# no FNAME and FCOMMENT bit implies no file name/comment. That means only binary
>3 byte&0x18 =0
# For binary gzipped no ASCII text should occur
# mcd-monu-cad.trid.xml
>>10 string MCD Monu-Cad Drawing, Component or Font
#>>36 string Created\ with\ MONU-CAD
#!:mime application/octet-stream
# http://fileformats.archiveteam.org/wiki/Monu-CAD
# http://www.monucad.com/downloads/FullDemo-2005.EXE
# /HANDS96.MCC Component
# /DEMO_DD01.MCD Drawing
# /MCALF020.FNT Font
!:ext mcc/mcd/fnt
# http://www.generalcadd.com
>>10 string GXD General CADD, Drawing or Component
#!:mime application/octet-stream
# /gxc/BUILDINGEDGE.gxc Component
# /gxd/HOCKETT-STPAUL-WRHSE.gxd Drawing
# /gxd/POWERLAND-MILL-ADD-11.gxd Drawing v9.1.06
!:ext gxc/gxd
#>>>13 ubyte 0 \b, version 0
>>>13 string 09 \b, version 9
# other gzipped binary like gzipped tar, VirtualBox extension package,...
>>10 default x gzip compressed data
>>>0 use gzip-info
# size of the original (uncompressed) input data modulo 2^32
>>>-4 ulelong x \b, original size modulo 2^32 %u
# gzipped TAR or VirtualBox extension package
!:mime application/gzip
#!:mime application/x-compressed-tar
#!:mime application/x-virtualbox-vbox-extpack
# https://www.w3.org/TR/SVG/mimereg.html
#!:mime image/image/svg+xml-compressed
# zlib.3.gz
# microcode-20180312.tgz
# tpz same as tgz
# lua-md5_1.2-1_i386_i486.ipk https://en.wikipedia.org/wiki/Opkg
# Oracle_VM_VirtualBox_Extension_Pack-5.0.12-104815.vbox-extpack
!:ext gz/tgz/tpz/ipk/vbox-extpack/svgz
# FNAME/FCOMMENT bit implies file name/comment as iso-8859-1 text
>3 byte&0x18 >0 gzip compressed data
!:mime application/gzip
# gzipped tar, gzipped Abiword document
#!:mime application/x-compressed-tar
#!:mime application/x-abiword-compressed
#!:mime image/image/svg+xml-compressed
# kleopatra_splashscreen.svgz gzipped .svg
!:ext gz/tgz/tpz/zabw/svgz
>>0 use gzip-info
# size of the original (uncompressed) input data modulo 2^32
>>-4 ulelong x \b, original size modulo 2^32 %u
# display information of gzip compressed files
0 name gzip-info
#>2 byte x THIS iS GZIP
>2 byte <8 \b, reserved method
>2 byte >8 \b, unknown method
>3 byte &0x01 \b, ASCII
@ -49,7 +114,9 @@
>9 byte =0x0B \b, from NTFS filesystem (NT)
>9 byte =0x0C \b, from QDOS
>9 byte =0x0D \b, from Acorn RISCOS
>-4 lelong x \b, original size %d
# size of the original (uncompressed) input data modulo 2^32
#>-4 ulelong x \b, original size modulo 2^32 %u
#ERROR: line 114: non zero offset 1048572 at level 1
# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
0 string \037\036 packed data
@ -160,7 +227,7 @@
>>17 byte =0x0E os: Win32
# 4.3BSD-Quasijarus Strong Compression
# http://minnie.tuhs.org/Quasijarus/compress.html
# https://minnie.tuhs.org/Quasijarus/compress.html
0 string \037\241 Quasijarus strong compressed data
# From: Cory Dikkers <cdikkers@swbell.net>
@ -174,7 +241,7 @@
>4 belong 0x090A0C0D best compression
# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
# http://www.7-zip.org or DOC/7zFormat.txt
# https://www.7-zip.org or DOC/7zFormat.txt
#
0 string 7z\274\257\047\034 7-zip archive data,
>6 byte x version %d
@ -203,7 +270,7 @@
>5 byte x \b.%d
!:mime application/x-lrzip
# http://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html
# https://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html
0 lelong 0x184d2204 LZ4 compressed data (v1.4+)
!:mime application/x-lz4
# Added by osm0sis@xda-developers.com
@ -292,11 +359,11 @@
>0x8 lelong x \b, %u entries
# Snappy framing format
# http://code.google.com/p/snappy/source/browse/trunk/framing_format.txt
# https://code.google.com/p/snappy/source/browse/trunk/framing_format.txt
0 string \377\006\0\0sNaPpY snappy framed data
!:mime application/x-snappy-framed
# qpress, http://www.quicklz.com/
# qpress, https://www.quicklz.com/
0 string qpress10 qpress compressed data
!:mime application/x-qpress

93
contrib/file/magic/Magdir/console
View file

@ -1,14 +1,14 @@
#------------------------------------------------------------------------------
# $File: console,v 1.40 2018/06/23 16:40:40 christos Exp $
# $File: console,v 1.45 2019/04/19 00:42:27 christos Exp $
# Console game magic
# Toby Deshane <hac@shoelace.digivill.net>
# ines: file(1) magic for Marat's iNES Nintendo Entertainment System ROM dump format
# Updated by David Korth <gerbilsoft@gerbilsoft.com>
# References:
# - http://wiki.nesdev.com/w/index.php/INES
# - http://wiki.nesdev.com/w/index.php/NES_2.0
# - https://wiki.nesdev.com/w/index.php/INES
# - https://wiki.nesdev.com/w/index.php/NES_2.0
# Common header for iNES, NES 2.0, and Wii U iNES.
0 name nes-rom-image-ines
@ -57,7 +57,7 @@
#------------------------------------------------------------------------------
# unif: file(1) magic for UNIF-format Nintendo Entertainment System ROM images
# Reference: http://wiki.nesdev.com/w/index.php/UNIF
# Reference: https://wiki.nesdev.com/w/index.php/UNIF
# From: David Korth <gerbilsoft@gerbilsoft.com>
#
# NOTE: The UNIF format uses chunks instead of a fixed header,
@ -69,7 +69,7 @@
#------------------------------------------------------------------------------
# fds: file(1) magic for Famciom Disk System disk images
# Reference: http://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format
# Reference: https://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format
# From: David Korth <gerbilsoft@gerbilsoft.com>
# TODO: Check "Disk info block" and get info from that in addition to the optional header.
@ -186,7 +186,7 @@
# genesis: file(1) magic for various Sega Mega Drive / Genesis ROM image and disc formats
# Updated by David Korth <gerbilsoft@gerbilsoft.com>
# References:
# - http://www.retrodev.com/segacd.html
# - https://www.retrodev.com/segacd.html
# - http://devster.monkeeh.com/sega/32xguide1.txt
#
@ -269,7 +269,7 @@
# Detects all Game Gear and export Sega Master System ROM images,
# and some Japanese Sega Master System ROM images.
# From: David Korth <gerbilsoft@gerbilsoft.com>
# Reference: http://www.smspower.org/Development/ROMHeader
# Reference: https://www.smspower.org/Development/ROMHeader
#
# General SMS header rule.
@ -359,7 +359,7 @@
#------------------------------------------------------------------------------
# dreamcast: file(1) magic for the Sega Dreamcast disc image format.
# From: David Korth <gerbilsoft@gerbilsoft.com>
# Reference: http://mc.pp.se/dc/ip0000.bin.html
# Reference: https://mc.pp.se/dc/ip0000.bin.html
#
# Common Sega Dreamcast disc header format.
@ -422,7 +422,7 @@
#------------------------------------------------------------------------------
# gba: file(1) magic for the Nintendo Game Boy Advance raw ROM format
# Reference: http://problemkaputt.de/gbatek.htm#gbacartridgeheader
# Reference: https://problemkaputt.de/gbatek.htm#gbacartridgeheader
#
# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com>
# Updated version from: David Korth <gerbilsoft@gerbilsoft.com>
@ -435,7 +435,7 @@
#------------------------------------------------------------------------------
# nds: file(1) magic for the Nintendo DS(i) raw ROM format
# Reference: http://problemkaputt.de/gbatek.htm#dscartridgeheader
# Reference: https://problemkaputt.de/gbatek.htm#dscartridgeheader
#
# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com>
# Updated version from: David Korth <gerbilsoft@gerbilsoft.com>
@ -469,7 +469,7 @@
# From: David Korth <gerbilsoft@gerbilsoft.com>
# References:
# - https://neogpc.googlecode.com/svn-history/r10/trunk/src/core/neogpc.cpp
# - http://www.devrs.com/ngp/files/ngpctech.txt
# - https://www.devrs.com/ngp/files/ngpctech.txt
#
0x0A string BY\ SNK\ CORPORATION Neo Geo Pocket
!:mime application/x-neo-geo-pocket-rom
@ -507,7 +507,21 @@
#------------------------------------------------------------------------------
# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>)
0 string XBEH XBE, Microsoft Xbox executable
0 string XBEH Microsoft Xbox executable
# expect base address of 0x10000
>0x0104 ulelong =0x10000
>>(0x0118.l-0x0FFF4) lestring16 x \b: "%.40s"
>>(0x0118.l-0x0FFF5) byte x (%c
>>(0x0118.l-0x0FFF6) byte x \b%c-
>>(0x0118.l-0x0FFF8) uleshort x \b%03u)
>>(0x0118.l-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions
>>(0x0118.l-0x0FF60) ulelong&0x80000007 !0x80000007
>>>(0x0118.l-0x0FF60) ulelong >0 (regions:
>>>>(0x0118.l-0x0FF60) ulelong &0x00000001 NA
>>>>(0x0118.l-0x0FF60) ulelong &0x00000002 Japan
>>>>(0x0118.l-0x0FF60) ulelong &0x00000004 Rest_of_World
>>>>(0x0118.l-0x0FF60) ulelong &0x80000000 Manufacturer
>>>(0x0118.l-0x0FF60) ulelong >0 \b)
# probabilistic checks whether signed or not
>0x0004 ulelong =0x0
>>&2 ulelong =0x0
@ -515,22 +529,43 @@
>0x0004 ulelong >0
>>&2 ulelong >0
>>>&2 ulelong >0 \b, signed
# expect base address of 0x10000
>0x0104 ulelong =0x10000
>>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions
>>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007
>>>(0x0118-0x0FF60) ulelong >0 (regions:
>>>>(0x0118-0x0FF60) ulelong &0x00000001 NA
>>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan
>>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World
>>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer
>>>(0x0118-0x0FF60) ulelong >0 \b)
# --------------------------------
# Microsoft Xbox data file formats
0 string XIP0 XIP, Microsoft Xbox data
0 string XTF0 XTF, Microsoft Xbox data
#------------------------------------------------------------------------------
# Microsoft Xbox 360 executables (.xex)
# From: David Korth <gerbilsoft@gerbilsoft.com>
# References:
# - https://free60project.github.io/wiki/XEX.html
# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h
# Title ID (part of Execution ID section)
0 name xbox-360-xex-execution-id
>(0.L+0xC) byte x (%c
>(0.L+0xD) byte x \b%c
>(0.L+0xE) beshort x \b-%04u)
0 string XEX2 Microsoft Xbox 360 executable
>0x18 search/0x100 \x00\x04\x00\x06
>>&0 use xbox-360-xex-execution-id
>(0x010.L+0x178) ubelong 0xFFFFFFFF \b, all regions
>(0x010.L+0x178) ubelong !0xFFFFFFFF
>>(0x010.L+0x178) ubelong >0 (regions:
>>(0x010.L+0x178) ubelong&0x000000FF 0x000000FF USA
>>(0x010.L+0x178) ubelong&0x00000100 0x00000100 Japan
>>(0x010.L+0x178) ubelong&0x00000200 0x00000200 China
>>(0x010.L+0x178) ubelong&0x0000FC00 0x0000FC00 Asia
>>(0x010.L+0x178) ubelong&0x00FF0000 0x00FF0000 PAL
>>(0x010.L+0x178) ubelong&0x00FF0000 0x00FE0000 PAL [except AU/NZ]
>>(0x010.L+0x178) ubelong&0x00FF0000 0x00010000 AU/NZ
>>(0x010.L+0x178) ubelong&0xFF000000 0xFF000000 Other
>>(0x010.L+0x178) ubelong >0 \b)
# Atari Lynx cartridge dump (EXE/BLL header)
# From: "Stefan A. Haubenthal" <polluks@web.de>
@ -563,7 +598,7 @@
>4 byte x %u tracks
# IPS Patch Files from: From: Thomas Klausner <tk@giga.or.at>
# see http://zerosoft.zophar.net/ips.php
# see https://zerosoft.zophar.net/ips.php
0 string PATCH IPS patch file
# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at>
@ -654,7 +689,7 @@
# Type: Nintendo GameCube/Wii common disc header data.
# From: David Korth <gerbilsoft@gerbilsoft.com>
# Reference: http://wiibrew.org/wiki/Wii_Disc
# Reference: https://wiibrew.org/wiki/Wii_Disc
0 name nintendo-gcn-disc-common
>0x20 string x "%.64s"
>0x00 string x (%.6s
@ -668,7 +703,7 @@
# Type: Nintendo GameCube disc image
# From: David Korth <gerbilsoft@gerbilsoft.com>
# Reference: http://wiibrew.org/wiki/Wii_Disc
# Reference: https://wiibrew.org/wiki/Wii_Disc
0x1C belong 0xC2339F3D Nintendo GameCube disc image:
!:mime application/x-gamecube-rom
>0 use nintendo-gcn-disc-common
@ -685,13 +720,13 @@
# Type: Nintendo Wii disc image
# From: David Korth <gerbilsoft@gerbilsoft.com>
# Reference: http://wiibrew.org/wiki/Wii_Disc
# Reference: https://wiibrew.org/wiki/Wii_Disc
0x18 belong 0x5D1C9EA3 Nintendo Wii disc image:
>0 use nintendo-gcn-disc-common
# Type: Nintendo Wii disc image (WBFS format)
# From: David Korth <gerbilsoft@gerbilsoft.com>
# Reference: http://wiibrew.org/wiki/Wii_Disc
# Reference: https://wiibrew.org/wiki/Wii_Disc
0 string WBFS
>0x218 belong 0x5D1C9EA3 Nintendo Wii disc image (WBFS format):
!:mime application/x-wii-rom
@ -754,13 +789,15 @@
# Type: Nintendo GameCube/Wii disc image (with SDK header)
# From: David Korth <gerbilsoft@gerbilsoft.com>
# Reference: http://wiibrew.org/wiki/Wii_Disc
# Reference: https://wiibrew.org/wiki/Wii_Disc
0 belong 0xFFFF0000
>0x18 belong 0x00000000
>>0x1C belong 0x00000000
>>>0x8018 belong 0x5D1C9EA3 Nintendo Wii SDK disc image:
!:mime application/x-wii-rom
>>>>0x8000 use nintendo-gcn-disc-common
>>>0x801C belong 0xC2339F3D Nintendo GameCube SDK disc image:
!:mime application/x-gamecube-rom
>>>>0x8000 use nintendo-gcn-disc-common
#------------------------------------------------------------------------------

12
contrib/file/magic/Magdir/coverage
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: coverage,v 1.1 2016/06/05 00:26:32 christos Exp $
# $File: coverage,v 1.2 2019/04/19 00:42:27 christos Exp $
# xoverage: file(1) magic for test coverage data
# File formats used to store test coverage data
@ -67,7 +67,7 @@
# `clang -fprofile-instr-generate -fcoverage-mapping ...`
# default name: default.profraw
# magic is: \xFF lprofr \x81
# cf. http://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html
# cf. https://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html
0 lequad 0xff6c70726f667281 LLVM raw profile data,
>&0 byte x version %d
@ -78,10 +78,10 @@
# LLVM indexed instruction profile (as generated by llvm-profdata)
# magic is: reverse(\xFF lprofi \x81)
# cf. http://llvm.org/docs/CoverageMappingFormat.html
# http://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html
# http://llvm.org/docs/CommandGuide/llvm-cov.html
# http://llvm.org/docs/CommandGuide/llvm-profdata.html
# cf. https://llvm.org/docs/CoverageMappingFormat.html
# https://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html
# https://llvm.org/docs/CommandGuide/llvm-cov.html
# https://llvm.org/docs/CommandGuide/llvm-profdata.html
0 lequad 0x8169666f72706cff LLVM indexed profile data,
>&0 byte x version %d

2
contrib/file/magic/Magdir/ctf
View file

@ -2,7 +2,7 @@
#--------------------------------------------------------------
# ctf: file(1) magic for CTF (Common Trace Format) trace files
#
# Specs. available here: <http://www.efficios.com/ctf>
# Specs. available here: <https://www.efficios.com/ctf>
#--------------------------------------------------------------
# CTF trace data

4
contrib/file/magic/Magdir/cups
View file

@ -1,9 +1,9 @@
#------------------------------------------------------------------------------
# $File: cups,v 1.5 2017/03/17 21:35:28 christos Exp $
# $File: cups,v 1.6 2019/04/19 00:42:27 christos Exp $
# Cups: file(1) magic for the cups raster file format
# From: Laurent Martelli <martellilaurent@gmail.com>
# http://www.cups.org/documentation.php/spec-raster.html
# https://www.cups.org/documentation.php/spec-raster.html
#
0 name cups-le

32
contrib/file/magic/Magdir/database
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: database,v 1.54 2018/06/23 16:37:21 christos Exp $
# $File: database,v 1.55 2019/04/19 00:42:27 christos Exp $
# database: file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
@ -147,8 +147,8 @@
## XBase database files
# updated by Joerg Jenderek at Feb 2013
# http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
# http://www.clicketyclick.dk/databases/xbase/format/dbf.html
# https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
# https://www.clicketyclick.dk/databases/xbase/format/dbf.html
# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm
# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
0 ubelong&0x0000FFFF <0x00000C20
@ -187,13 +187,13 @@
>>>>>>>>>>>>4 lelong >0 \b, %d record
# plural s appended
>>>>>>>>>>>>>4 lelong >1 \bs
# http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
# https://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000)
>>>>>>>>>>>>10 uleshort x * %d
# file size = records * record size + header size
>>>>>>>>>>>>1 ubyte x \b, update-date
>>>>>>>>>>>>1 use xbase-date
# http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
# https://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
#>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x
# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ?
>>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x
@ -261,13 +261,13 @@
# dBASE IV SQL, no memo;dbv memo var size (Flagship)
>>0 ubyte 0x43 dBase IV, with SQL table
!:mime application/x-dbf
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#>>0 ubyte 0x62 dBase IV, with SQL table
#!:mime application/x-dbf
# dBASE IV, with memo!!
>>0 ubyte 0x7b dBase IV, with memo
!:mime application/x-dbf
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#>>0 ubyte 0x82 dBase IV, with SQL system
#!:mime application/x-dbf
# FoxBase+/dBaseIII+ with memo .DBT!
@ -276,7 +276,7 @@
# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file
>>0 ubyte 0x87 VISUAL OBJECTS, with memo file
!:mime application/x-dbf
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT
#!:mime application/x-dbf
# dBASE IV with memo!
@ -287,7 +287,7 @@
!:mime application/x-dbf
# .dbv and .dbt memo (Flagship)?
>>0 ubyte 0xB3 Flagship
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#>>0 ubyte 0xCA dBase IV with memo .DBT
#!:mime application/x-dbf
# dBASE IV with SQL table, with memo .DBT
@ -296,12 +296,12 @@
# HiPer-Six format;Clipper SIX, with SMT memo file
>>0 ubyte 0xE5 Clipper SIX with memo
!:mime application/x-dbf
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#>>0 ubyte 0xF4 dBase IV, with SQL table, with memo
#!:mime application/x-dbf
>>0 ubyte 0xF5 FoxPro with memo
!:mime application/x-dbf
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#>>0 ubyte 0xFA FoxPro 2.x, with memo
#!:mime application/x-dbf
# unknown version (should not happen)
@ -332,7 +332,7 @@
>>>>>2 ubyte x \b-%d
# dBase memo files .DBT or .FPT
# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
# https://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
16 ubyte <4
>16 ubyte !2
>>16 ubyte !1
@ -495,7 +495,7 @@
>>220 ulelong x \b.%d
# From: Joerg Jenderek
# URL: http://forensicswiki.org/wiki/Windows_Application_Compatibility
# URL: https://forensicswiki.org/wiki/Windows_Application_Compatibility
# Note: files contain application compatibility fixes, application compatibility modes and application help messages.
8 string sdbf
>7 ubyte 0
@ -542,7 +542,7 @@
>>7 byte x \b-%d
# Type: Advanced Data Format (ADF) database
# URL: http://www.grc.nasa.gov/WWW/cgns/adf/
# URL: https://www.grc.nasa.gov/WWW/cgns/adf/
# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr>
0 string @(#)ADF\ Database CGNS Advanced Data Format
@ -582,7 +582,7 @@
0 string ToKyO\ CaBiNeT\n TokyoCabinet database
>14 string x (version %s)
# From: Stephane Blondon http://www.yaal.fr
# From: Stephane Blondon https://www.yaal.fr
# Database file for Zope (done by FileStorage)
0 string FS21 Zope Object Database File Storage v3 (data)
0 string FS30 Zope Object Database File Storage v4 (data)
@ -593,7 +593,7 @@
# IDA (Interactive Disassembler) database
0 string IDA1 IDA (Interactive Disassembler) database
# Hopper (reverse engineering tool) http://www.hopperapp.com/
# Hopper (reverse engineering tool) https://www.hopperapp.com/
0 string hopperdb Hopper database
# URL: https://en.wikipedia.org/wiki/Panorama_(database_engine)

16
contrib/file/magic/Magdir/dataone
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: dataone,v 1.1 2018/06/06 01:16:40 christos Exp $
# $File: dataone,v 1.2 2019/04/19 00:42:27 christos Exp $
#
# DataONE- files from Dave Vieglais <dave.vieglais@gmail.com> &
# Pratik Shrivastava <pratikshrivastava23@gmail.com>
@ -13,35 +13,35 @@
>&0 regex (eml)-[0-9].[0-9].[0-9]+ eml://ecoinformatics.org/%s
# onedcx (DataONE Dublin Core Extended v1.0)
>&0 regex (onedcx/v)[0-9].[0-9]+ http://ns.dataone.org/metadata/schema/onedcx/v1.0
>&0 regex (onedcx/v)[0-9].[0-9]+ https://ns.dataone.org/metadata/schema/onedcx/v1.0
# FGDC-STD-001-1998 (Content Standard for Digital Geospatial Metadata,
# version 001-1998)
>&0 regex fgdc FGDC-STD-001-1998
# Mercury (Oak Ridge National Lab Mercury Metadata version 1.0)
>&0 regex (mercury/terms/v)[0-9].[0-9] http://purl.org/ornl/schema/mercury/terms/v1.0
>&0 regex (mercury/terms/v)[0-9].[0-9] https://purl.org/ornl/schema/mercury/terms/v1.0
# ISOTC211 (Geographic MetaData (GMD) Extensible Markup Language)
>&0 regex isotc211
>>&0 regex eng;USA http://www.isotc211.org/2005/gmd
>>&0 regex eng;USA https://www.isotc211.org/2005/gmd
# ISOTC211 (NOAA Variant Geographic MetaData (GMD) Extensible Markup Language)
>>&0 regex gov.noaa.nodc:[0-9]+ http://www.isotc211.org/2005/gmd-noaa
>>&0 regex gov.noaa.nodc:[0-9]+ https://www.isotc211.org/2005/gmd-noaa
# ISOTC211 PANGAEA Variant Geographic MetaData (GMD) Extensible Markup Language
>>&0 regex pangaea.dataset[0-9][0-9][0-9][0-9][0-9][0-9]+ http://www.isotc211.org/2005/gmd-pangaea
>>&0 regex pangaea.dataset[0-9][0-9][0-9][0-9][0-9][0-9]+ https://www.isotc211.org/2005/gmd-pangaea
!:mime text/xml
# Object Reuse and Exchange Vocabulary
0 string <?xml
>&0 regex rdf
>>&0 regex openarchives http://www.openarchives.org/ore/terms
>>&0 regex openarchives https://www.openarchives.org/ore/terms
!:mime application/rdf+xml
# Dryad Metadata Application Profile Version 3.1
0 string <DryadData
>&0 regex (dryad-bibo/v)[0-9].[0-9] http://datadryad.org/profile/v3.1
>&0 regex (dryad-bibo/v)[0-9].[0-9] https://datadryad.org/profile/v3.1
!:mime text/xml

4
contrib/file/magic/Magdir/dbpf
View file

@ -1,9 +1,9 @@
#------------------------------------------------------------------------------
# $File: dbpf,v 1.2 2018/05/24 18:54:40 christos Exp $
# $File: dbpf,v 1.3 2019/04/19 00:42:27 christos Exp $
# dppf: Maxis Database Packed Files, the stored data file format used by all
# Maxis games after the Sims: http://wiki.niotso.org/DBPF
# http://www.wiki.sc4devotion.com/index.php?title=DBPF
# https://www.wiki.sc4devotion.com/index.php?title=DBPF
# 13 Oct 2017, Kip Warner <kip at thevertigo dot com>
0 string DBPF Maxis Database Packed File
>4 ulelong x \b, version: %u.

4
contrib/file/magic/Magdir/dolby
View file

@ -1,8 +1,8 @@
#------------------------------------------------------------------------------
# $File: dolby,v 1.8 2017/03/17 21:35:28 christos Exp $
# $File: dolby,v 1.9 2019/04/19 00:42:27 christos Exp $
# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
# from http://www.atsc.org/standards/a_52a.pdf
# from https://www.atsc.org/standards/a_52a.pdf
# corrections, additions, etc. are always welcome!
#
# syncword

6
contrib/file/magic/Magdir/dyadic
View file

@ -1,11 +1,11 @@
#------------------------------------------------------------------------------
# $File: dyadic,v 1.8 2017/03/17 21:35:28 christos Exp $
# $File: dyadic,v 1.9 2019/04/19 00:42:27 christos Exp $
# Dyadic: file(1) magic for Dyalog APL.
#
# updated by Joerg Jenderek at Oct 2013
# http://en.wikipedia.org/wiki/Dyalog_APL
# http://www.dyalog.com/
# https://en.wikipedia.org/wiki/Dyalog_APL
# https://www.dyalog.com/
# .DXV Dyalog APL External Variable
# .DIN Dyalog APL Input Table
# .DOT Dyalog APL Output Table

4
contrib/file/magic/Magdir/ebml
View file

@ -1,8 +1,8 @@
#------------------------------------------------------------------------------
# $File: ebml,v 1.1 2010/07/02 00:07:03 christos Exp $
# $File: ebml,v 1.2 2019/04/19 00:42:27 christos Exp $
# ebml: file(1) magic for various Extensible Binary Meta Language
# http://www.matroska.org/technical/specs/index.html#track
# https://www.matroska.org/technical/specs/index.html#track
0 belong 0x1a45dfa3 EBML file
>4 search/b/100 \102\202
>>&1 string x \b, creator %.8s

11
contrib/file/magic/Magdir/edid Normal file
View file

@ -0,0 +1,11 @@
#------------------------------------------------------------------------------
# $File: edid,v 1.1 2019/03/28 12:36:01 christos Exp $
# edid: file(1) magic for EDID dump files
0 quad 0x00ffffffffffff00 Extended display identification data dump
!:mime application/x-edid-dump
>18 byte 0x01 Version 1
>>19 byte <0x04 \b.%d
>18 byte 0x02 Version 2
>>19 byte 0x00 \b.0

6
contrib/file/magic/Magdir/elf
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: elf,v 1.74 2018/06/23 16:39:53 christos Exp $
# $File: elf,v 1.77 2019/01/16 19:33:35 christos Exp $
# elf: file(1) magic for ELF executables
#
# We have to check the byte order flag to see what byte order all the
@ -38,6 +38,8 @@
>0 lelong&0x3 2 relaxed memory ordering,
0 name elf-pa-risc
>2 leshort 0x0208 1.0
>2 leshort 0x0210 1.1
>2 leshort 0x0214 2.0
>0 leshort &0x0008 (LP64)
@ -265,6 +267,8 @@
>18 leshort 217 iCelero CoolEngine,
>18 leshort 218 Nanoradio Optimized RISC,
>18 leshort 243 UCB RISC-V,
>18 leshort 247 eBPF,
>18 leshort 251 NEC VE,
>18 leshort 0x1057 AVR (unofficial),
>18 leshort 0x1059 MSP430 (unofficial),
>18 leshort 0x1223 Adapteva Epiphany (unofficial),

4
contrib/file/magic/Magdir/erlang
View file

@ -1,8 +1,8 @@
#------------------------------------------------------------------------------
# $File: erlang,v 1.6 2010/09/20 19:19:17 rrt Exp $
# $File: erlang,v 1.7 2019/04/19 00:42:27 christos Exp $
# erlang: file(1) magic for Erlang JAM and BEAM files
# URL: http://www.erlang.org/faq/x779.html#AEN812
# URL: https://www.erlang.org/faq/x779.html#AEN812
# OTP R3-R4
0 string \0177BEAM! Old Erlang BEAM file

57
contrib/file/magic/Magdir/espressif Normal file
View file

@ -0,0 +1,57 @@
# $File: espressif,v 1.1 2018/11/20 18:57:17 christos Exp $
# configuration dump of Tasmota firmware for ESP8266 based devices by Espressif
# URL: https://github.com/arendst/Sonoff-Tasmota/
# Reference: https://codeload.github.com/arendst/Sonoff-Tasmota/zip/release-6.2/
# Sonoff-Tasmota-release-6.2.zip/Sonoff-Tasmota-release-6.2/sonoff/settings.h
# From: Joerg Jenderek
#
# cfg_holder=4617=0x1209
0 uleshort 4617
# remainig settings normally 0x5A+offset XORed; free_1D5[20] empty since 5.12.0e
>0x1D5 ubequad 0x2f30313233343536 configuration of Tasmota firmware (ESP8266)
!:mime application/x-tasmota-dmp
!:ext dmp
# version like 6.2.1.0 ~ 0x06020100 XORed to 0x63666262
>>11 ubyte^0x65 x \b, version %u
>>10 ubyte^0x64 x \b.%u
>>9 ubyte^0x63 x \b.%u
>>8 ubyte^0x62 x \b.%u
#>8 ubelong x (0x%x)
# hostname[33] XORed
>>0x165 ubyte^0x1BF x \b, hostname %c
>>0x166 ubyte^0x1C0 >037 \b%c
>>0x167 ubyte^0x1C1 >037 \b%c
>>0x168 ubyte^0x1C2 >037 \b%c
>>0x169 ubyte^0x1C3 >037 \b%c
>>0x16A ubyte^0x1C4 >037 \b%c
>>0x16B ubyte^0x1C5 >037 \b%c
>>0x16C ubyte^0x1C6 >037 \b%c
>>0x16D ubyte^0x1C7 >037 \b%c
>>0x16E ubyte^0x1C8 >037 \b%c
>>0x16F ubyte^0x1C9 >037 \b%c
>>0x170 ubyte^0x1CA >037 \b%c
>>0x171 ubyte^0x1CB >037 \b%c
>>0x172 ubyte^0x1CC >037 \b%c
>>0x173 ubyte^0x1CD >037 \b%c
>>0x174 ubyte^0x1CE >037 \b%c
>>0x175 ubyte^0x1CF >037 \b%c
>>0x176 ubyte^0x1D0 >037 \b%c
>>0x177 ubyte^0x1D1 >037 \b%c
>>0x178 ubyte^0x1D2 >037 \b%c
>>0x179 ubyte^0x1D3 >037 \b%c
>>0x17A ubyte^0x1D4 >037 \b%c
>>0x17B ubyte^0x1D5 >037 \b%c
>>0x17C ubyte^0x1D6 >037 \b%c
>>0x17D ubyte^0x1D7 >037 \b%c
>>0x17E ubyte^0x1D8 >037 \b%c
>>0x17F ubyte^0x1D9 >037 \b%c
>>0x180 ubyte^0x1DA >037 \b%c
>>0x181 ubyte^0x1DB >037 \b%c
>>0x182 ubyte^0x1DC >037 \b%c
>>0x183 ubyte^0x1DD >037 \b%c
>>0x184 ubyte^0x1DE >037 \b%c
>>0x185 ubyte^0x1DF >037 \b%c
#>>0x165 string x (%.33s)

4
contrib/file/magic/Magdir/esri
View file

@ -1,9 +1,9 @@
#------------------------------------------------------------------------------
# $File: esri,v 1.4 2009/09/19 16:28:09 christos Exp $
# $File: esri,v 1.5 2019/04/19 00:42:27 christos Exp $
# ESRI Shapefile format (.shp .shx .dbf=DBaseIII)
# Based on info from
# <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf>
# <URL:https://www.esri.com/library/whitepapers/pdfs/shapefile.pdf>
0 belong 9994 ESRI Shapefile
>4 belong =0
>8 belong =0

140
contrib/file/magic/Magdir/filesystems
View file

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: filesystems,v 1.124 2018/01/12 12:35:30 christos Exp $
# $File: filesystems,v 1.128 2019/04/23 15:43:27 christos Exp $
# filesystems: file(1) magic for different filesystems
#
0 name partid
@ -268,21 +268,21 @@
# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
!:strength +65
>2 string OSBS OS/BS MBR
# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
# and http://en.wikipedia.org/wiki/Master_Boot_Record
# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/
# and https://en.wikipedia.org/wiki/Master_Boot_Record
# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00
>0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR
# Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm )
# Microsoft Windows 95A and early ( https://thestarman.pcministry.com/asm/mbr/STDMBR.htm )
# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld
>>8 ubequad 0x8bf45007501ffbfc
# http://thestarman.pcministry.com/asm/mbr/200MBR.htm
# https://thestarman.pcministry.com/asm/mbr/200MBR.htm
>>>0x16 ubyte 0xF3 \b,DOS 2
>>>>219 regex Author\ -\ Author:
# found "David Litton" , "A Pehrsson "
>>>>>&0 string x "%s"
>>>0x16 ubyte 0xF2
# NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm
# NEC MS-DOS 3.30 Rev. 3 . See https://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm
# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz
>>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3
# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111)
@ -314,7 +314,7 @@
# "Sistema operativo mancante" nn=0xe2 for italian version
>>>>>0x79 ubyte >0 at offset 0x%x
>>>>>>(0x79.b) string >\0 "%s"
# Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
# Microsoft Windows 95B to XP (https://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
# assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b
>>8 ubequad 0x5007501ffcbe1b7c
# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04
@ -341,7 +341,7 @@
# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version
>>>>0xA9 ubyte x at offset 0x1%x
>>>>(0xA9.b+0x100) string >\0 "%s"
# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm
# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm
# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04
>>>24 ubequad 0xf3a4cbbdbe07b104 XP
# where xxyyzz are lower bits from offsets of error messages varying for different languages
@ -362,7 +362,7 @@
# Microsoft Windows Vista or 7
# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00
>>8 ubequad 0xc08ed8be007cbf00
# Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm)
# Microsoft Windows Vista (https://thestarman.pcministry.com/asm/mbr/VistaMBR.htm)
# assembler instructions: jnz 0729;cmp ebx,"TCPA"
>>>0xEC ubequad 0x753b6681fb544350 Vista
# where xxyyzz are lower bits from offsets of error messages varying for different languages
@ -380,7 +380,7 @@
# "Betriebssystem nicht vorhanden" zz=0x1?? for german version
>>>>0x1b7 ubyte >0 at offset 0x1%x
>>>>(0x1b7.b+0x100) string >\0 "%s"
# Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm)
# Microsoft Windows 7 (https://thestarman.pcministry.com/asm/mbr/W7MBR.htm)
# assembler instructions: cmp ebx,"TCPA";cmp
>>>0xEC ubequad 0x6681fb5443504175 Windows 7
# where xxyyzz are lower bits from offsets of error messages varying for different languages
@ -398,10 +398,10 @@
# "Betriebssystem nicht vorhanden" zz=0x1?? for german version
>>>>0x1b7 ubyte >0 at offset 0x1%x
>>>>(0x1b7.b+0x100) string >\0 "%s"
# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs
# http://en.wikipedia.org/wiki/MBR_disk_signature#ID
# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs
# https://en.wikipedia.org/wiki/MBR_disk_signature#ID
>>0x1b8 ulelong >0 \b, disk signature 0x%-.4x
# driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm
# driveID/timestamp for Win 95B,98,98SE and ME. See https://thestarman.pcministry.com/asm/mbr/mystery.htm
>>0xDA uleshort 0
>>>0xDC ulelong >0 \b, created
# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive
@ -465,13 +465,13 @@
>>>>>420 ubyte x \b)
#
# SYSLINUX MBR moved
# http://www.acronis.de/
# https://www.acronis.de/
>362 string MBR\ Error\ \0\r
>>376 string ress\ any\ key\ to\040
>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR
# added by Joerg Jenderek
# http://www.visopsys.org/
# http://partitionlogic.org.uk/
# https://www.visopsys.org/
# https://partitionlogic.org.uk/
>309 string No\ bootable\ partition\ found\r
>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR
>349 string No\ bootable\ partition\ found\r
@ -490,7 +490,7 @@
>>172 string LILO \b, version 22.5.8 Debian
# updated by Joerg Jenderek at Oct 2008
# variables according to grub-0.97/stage1/stage1.S or
# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data
# usual values are marked with comments to get only informations of strange GRUB loaders
>342 search/60 \0Geom\0
#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0
@ -549,7 +549,7 @@
# skip FSInfosector
>>>>>>0 string !RRaA
# skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX,
# http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm
# https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm
>>>>>>>0 ubequad !0xfa660fb64610668b
# skip 13rd sector of MS x86 bootloader
>>>>>>>>0 ubequad !0x660fb64610668b4e
@ -562,7 +562,7 @@
>>>>>>>>>>>446 use partition-table
# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries
# mbr partition table entries end
# http://www.acronis.de/
# https://www.acronis.de/
#FAT label=ACRONIS\ SZ
#OEM-ID=BOOTWIZ0
>442 string Non-system\ disk,\040
@ -995,8 +995,8 @@
>>>>505 ubyte&0xDF >0
>>>>>505 string x \b.%-.3s
# added by Joerg Jenderek
# http://www.visopsys.org/
# http://partitionlogic.org.uk/
# https://www.visopsys.org/
# https://partitionlogic.org.uk/
# OEM-ID=Visopsys
>478 ulelong 0
>>(1.b+326) string I/O\ Error\ reading\040
@ -1023,8 +1023,8 @@
#it prints a very short message ("RE") to the screen and hangs the computer.
# x86 bootloader end
# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
# and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
# and https://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
>0 string RRaA
>>0x1E4 string rrAa \b, FSInfosector
#>>0x1FC uleshort =0 SHOULD BE ZERO
@ -1087,7 +1087,7 @@
>11 ubyte x \b+
>11 use DOS-filename
# http://en.wikipedia.org/wiki/Master_boot_record#PTE
# https://en.wikipedia.org/wiki/Master_boot_record#PTE
# display standard partition table
0 name partition-table
#>0 ubyte x PARTITION-TABLE
@ -1154,20 +1154,20 @@
0x18b string OS/2 OS/2 Boot Manager
# updated by Joerg Jenderek at Oct 2008 and Sep 2012
# http://syslinux.zytor.com/iso.php
# https://syslinux.zytor.com/iso.php
# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
0 ulequad&0x909000007cc0eafa 0x909000007c40eafa
>631 search/689 ISOLINUX\ isolinux Loader
>>&0 string x (version %-4.4s)
# http://syslinux.zytor.com/pxe.php
# https://syslinux.zytor.com/pxe.php
# assembler instructions: jmp 7C05
0 ulelong 0x007c05ea pxelinux loader (version 2.13 or older)
# assembler instructions: pushfd;pushad
0 ulelong 0x60669c66 pxelinux loader
# assembler instructions: jmp 05
0 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer)
# http://syslinux.zytor.com/wiki/index.php/SYSLINUX
# https://syslinux.zytor.com/wiki/index.php/SYSLINUX
0 string LDLINUX\ SYS\ SYSLINUX loader
>12 string x (older version %-4.4s)
0 string \r\nSYSLINUX\ SYSLINUX loader
@ -1213,7 +1213,7 @@
>0004 uleshort x
# ERRorTeXT
>>181 search/166 Error\ \0\r\n NetBSD mbr
# NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
# NT Drive Serial Number https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
>>>0x1B8 ubelong >0 \b,Serial 0x%-.8x
# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
>>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector
@ -1249,7 +1249,7 @@
>>>398 string Disk\ error\r\n\0FDD\0HDD\0
>>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr
# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/
# Neil Turton mbr loader variant of https://www.chiark.greenend.org.uk/~neilt/mbr/
# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
# for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
# or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
@ -1262,7 +1262,7 @@
>>>(0x1BC.s+9) ubyte x \bVersion<=%u
#>>>(0x1BC.s+8) ubyte x asm_flag_%x
>>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix
# variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode
# variant used by testdisk of https://www.cgsecurity.org/wiki/Menu_MBRCode
>>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk
#0x1~1,..,0x8~4,0x10~F,0x80~A enabled
#>>>(0x1BC.s+10) ubyte x \b,flags 0x%x
@ -1295,7 +1295,7 @@
# added by Joerg Jenderek
# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
# grub-1.94/kern/i386/pc/startup.S
# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data
# usual values are marked with comments to get only informations of strange GRUB loaders
0x200 uleshort 0x70EA
# found only version 3.{1,2}
@ -1350,7 +1350,7 @@
# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90
# over BIOS parameter block (BPB)
# http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD
# https://thestarman.pcministry.com/asm/2bytejumps.htm#FWD
# older drives may use Near JuMP instruction E9 xx xx
# minimal short forward jump found 0x29 for bootloaders or 0x0
# maximal short forward jump is 0x7f
@ -1403,7 +1403,7 @@
>>>>>26 ubyte =1 \b, heads %u
# valid only for sector sizes with more then 32 Bytes
>>>>>11 uleshort >32
# http://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block
# https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block
# skip for values 2,2Ah,70h,73h,DFh
# and continue for extended boot signature values 0,28h,29h,80h
>>>>>>38 ubyte&0x56 =0
@ -1465,7 +1465,7 @@
# FAT32 bit specific
>>>>>82 string/c fat32 \b, FAT (32 bit)
>>>>>>36 ulelong x \b, sectors/FAT %u
# http://technet.microsoft.com/en-us/library/cc977221.aspx
# https://technet.microsoft.com/en-us/library/cc977221.aspx
>>>>>>40 uleshort >0 \b, extension flags 0x%x
#>>>>>>40 uleshort =0 \b, extension flags %hu
>>>>>>42 uleshort >0 \b, fsVersion %u
@ -1482,7 +1482,7 @@
#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
>>>>>>50 default x
>>>>>>>50 uleshort x \b, Backup boot sector %u
# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
# corrected by Joerg Jenderek at Feb 2011 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
>>>>>>52 ulelong >0 \b, reserved1 0x%x
>>>>>>56 ulelong >0 \b, reserved2 0x%x
>>>>>>60 ulelong >0 \b, reserved3 0x%x
@ -1508,7 +1508,7 @@
>>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT
# floppy image
!:mime application/x-ima
# NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
# NTFS specific added by Joerg Jenderek at Mar 2011 according to https://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
# 0 FATs
>>>>>16 ubyte =0
@ -1539,18 +1539,39 @@
>>>>>>>>>72 ulequad x \b, serial number 0%llx
>>>>>>>>>80 ulelong >0 \b, checksum 0x%x
#>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual)
>>>>>>>>>0x258 ulelong&0x00009090 =0x00009090
>>>>>>>>>>&-92 indirect x \b; contains
# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013
# http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
# unused assembler instructions JMP y2;NOP;NOP
0x056 ulelong&0xFFFF0FFF 0x909002EB
# unicode loadername terminated by CTRL-D
>(0.s*2) ulelong&0xFFFFFF00 0x00040000
# unicode loadername size jump
>>>>>>>>>(0x200.s*2) ubyte x
# in next sector loadername terminated by unicode CTRL-D and $
>>>>>>>>>>&0x1FF ulequad&0x0000FFffFFffFF00 0x0000002400040000 \b; contains
# if 2nd NTFS sectors is found then assume whole filesystem
#!:mime application/x-raw-disk-image
!:ext img/bin/ntfs
>>>>>>>>>>>0x200 use ntfs-sector2
# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013, Mar 2019
# https://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
# unused assembler instructions short JMP y2;NOP;NOP
0x056 ulelong&0xFFFF0FFF 0x909002EB NTFS
#!:mime application/octet-stream
!:ext bin
>0 use ntfs-sector2
# https://memory.dataram.com/products-and-services/software/ramdisk
# assembler instructions JMP C000;NOP
0x056 ulelong 0x9000c0e9 NTFS
#!:mime application/octet-stream
!:ext bin
>0 use ntfs-sector2
# check for characteristics of second NTFS sector and then display loader name
0 name ntfs-sector2
# number of utf16 characters of loadername
>0 uleshort <8
# unused assembler instructions JMP y2;NOP;NOP or JMP C000;NOP
>>0x056 ulelong&0xFF0000FD 0x900000E9
# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR
>>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s
>>0x12 string $
>>>0x0c lestring16 x \b%-2.2s
>>>0x002 lestring16 x bootstrap %-5.5s
# check for 7 character length of loader name like BOOTMGR
>>>0 uleshort 7
>>>>0x0c lestring16 x \b%-2.2s
### DOS,NTFS boot sectors end
# ntfsclone-image is a special save format for NTFS volumes,
@ -1689,7 +1710,7 @@
# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
# volume label and UUID Russell Coker
# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
# https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
0x438 leshort 0xEF53 Linux
>0x44c lelong x rev %d
>0x43e leshort x \b.%d
@ -1801,7 +1822,7 @@
############################################################################
# Minix-ST kernel floppy
0x800 belong 0x46fc2700 Atari-ST Minix kernel image
# http://en.wikipedia.org/wiki/BIOS_parameter_block
# https://en.wikipedia.org/wiki/BIOS_parameter_block
# floppies with valid BPB and any instruction at beginning
>19 string \240\005\371\005\0\011\0\2\0 \b, 720k floppy
>19 string \320\002\370\005\0\011\0\1\0 \b, 360k floppy
@ -1871,7 +1892,7 @@
#
# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013
# http://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions
# https://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions
# Too Weak.
#512 ubelong&0xE0ffff00 0xE0ffff00
# without valid Media descriptor in place of BPB, cases with are done at other places
@ -1884,7 +1905,7 @@
#>>512 ubyte =0xfa 320k
#>>512 ubyte =0xfb 640k
#>>512 ubyte =0xfc 180k
# look like an an old DOS directory entry
# look like an old DOS directory entry
#>>>0xA0E ubequad 0
#>>>>0xA00 ubequad !0
#!:mime application/x-ima
@ -1915,26 +1936,26 @@
# only x86 short jump instruction found
#>>>0 ubyte =0xEB
#>>>>1 ubyte x \b, code offset 0x%x+2
# http://thestarman.pcministry.com/DOS/ibm100/Boot.htm
# https://thestarman.pcministry.com/DOS/ibm100/Boot.htm
# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0
#>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader
# ibmbio.com+ibmdos.com
#>>>>>0x176 use DOS-filename
#>>>>>0x181 ubyte x \b+
#>>>>>0x182 use DOS-filename
# http://thestarman.pcministry.com/DOS/ibm110/Boot.htm
# https://thestarman.pcministry.com/DOS/ibm110/Boot.htm
# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV
#>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader
# ibmbio.com+ibmdos.com
#>>>>>0x18b use DOS-filename
#>>>>>0x196 ubyte x \b+
#>>>>>0x197 use DOS-filename
# http://en.wikipedia.org/wiki/Zenith_Data_Systems
# https://en.wikipedia.org/wiki/Zenith_Data_Systems
# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6
#>>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader
# IO.SYS+MSDOS.SYS
#>>>>>0x20 use 2xDOS-filename
# http://en.wikipedia.org/wiki/Corona_Data_Systems
# https://en.wikipedia.org/wiki/Corona_Data_Systems
# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX;
#>>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader
# IO.SYS+MSDOS.SYS
@ -1987,7 +2008,7 @@
>307200 use cdrom
# .cso files
# Reference: http://pismotec.com/ciso/ciso.h
# Reference: https://pismotec.com/ciso/ciso.h
# NOTE: There are two other formats with the same magic but
# completely incompatible specifications:
# - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h
@ -1996,10 +2017,13 @@
# Other fields are used to determine what type of CISO this is:
# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
# - 0x10 == 0x00004000: For >2GB files using maxcso...
# https://github.com/unknownbrackets/maxcso/issues/26
# - None of the above: Compact ISO.
>4 lelong !0
>>4 lelong !0x200000
>>>0x10 lelong !0x800 Compressed ISO CD image
>>>16 lelong !0x800
>>>>16 lelong !0x4000 Compressed ISO CD image
# cramfs filesystem - russell@coker.com.au
0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian
@ -2247,7 +2271,7 @@
>984 string x volume label is '%-12.12s'
# From: Thomas Klausner <wiz@NetBSD.org>
# http://filext.com/file-extension/DAA
# https://filext.com/file-extension/DAA
# describes the daa file format. The magic would be:
0 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive

4
contrib/file/magic/Magdir/finger
View file

@ -1,11 +1,11 @@
#------------------------------------------------------------------------------
# $File: finger,v 1.2 2015/10/07 02:37:57 christos Exp $
# $File: finger,v 1.3 2019/04/19 00:42:27 christos Exp $
# fingerprint: file(1) magic for fingerprint data
# XPM bitmaps)
#
# http://cgit.freedesktop.org/libfprint/libfprint/tree/libfprint/data.c
# https://cgit.freedesktop.org/libfprint/libfprint/tree/libfprint/data.c
0 string FP1 libfprint fingerprint data V1
>3 beshort x \b, driver_id %x

6
contrib/file/magic/Magdir/flash
View file

@ -1,12 +1,12 @@
#------------------------------------------------------------------------------
# $File: flash,v 1.14 2017/05/25 20:09:55 christos Exp $
# $File: flash,v 1.15 2019/04/19 00:42:27 christos Exp $
# flash: file(1) magic for Macromedia Flash file format
#
# See
#
# http://www.macromedia.com/software/flash/open/
# http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\
# https://www.macromedia.com/software/flash/open/
# https://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\
# en/devnet/swf/pdf/swf-file-format-spec.pdf page 27
#

75
contrib/file/magic/Magdir/fonts
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: fonts,v 1.38 2017/11/14 15:48:36 christos Exp $
# $File: fonts,v 1.41 2019/05/05 16:44:04 christos Exp $
# fonts: file(1) magic for font data
#
0 search/1 FONT ASCII vfont text
@ -17,7 +17,7 @@
# Summary: PostScript Type 1 Printer Font Metrics
# URL: https://en.wikipedia.org/wiki/PostScript_fonts
# Reference: http://partners.adobe.com/public/developer/en/font/5178.PFM.pdf
# Reference: https://partners.adobe.com/public/developer/en/font/5178.PFM.pdf
# Modified by: Joerg Jenderek
# Note: moved from ./msdos magic
# dfVersion 256=0100h
@ -80,7 +80,7 @@
0 search/1 STARTFONT\ X11 BDF font text
# From: Joerg Jenderek
# URL: http://grub.gibibit.com/New_font_format
# URL: https://grub.gibibit.com/New_font_format
# Reference: util/grub-mkfont.c
# include/grub/fontformat.h
# FONT_FORMAT_SECTION_NAMES_FILE
@ -128,6 +128,58 @@
7 belong 0x00564944 DOS code page font data (from Linux?)
4098 string DOSFONT DOSFONT2 encrypted font data
# From: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/GEM_bitmap_font
# Reference: http://cd.textfiles.com/ataricompendium/BOOK/HTML/APPENDC.HTM#cnt
#
# usual case with lightening mask and skewing mask 5555h~UU
62 ulelong 0x55555555
>0 use gdos-font
# BOX18.GFT COWBOY30.GFT ROYALK30.GFT
62 ulelong 0
# skip ISO 9660 CD-ROM ./filesystem by looking for low positive face size
>2 uleshort >2
# skip DOS 2.0 backup id file ./msdos by looking for face size lower/equal 48
>>2 uleshort <49
# skip MS Windows ICO ./msdos by looking for valid face name
>>>4 ubeshort >0x1F00
# skip DOS executable BACKM212.COM by looking for horizontal offset table after header
#>>>>68 ulelong >87 OFFSET_OK
>>>>0 use gdos-font
0 name gdos-font
>0 uleshort x GEM GDOS font
!:mime application/x-font-gdos
# also .eps found like AA070GEP.EPS AI360GEP.EPS
!:ext fnt/gtf
# font name like University Bold
>4 string x %.32s
# face size in points 3-48
>2 uleshort x %u
# face ID (must be unique)
>0 uleshort x \b, ID 0x%4.4x
# lowest character index in face (usually 32 for disk-loaded fonts).
#>36 uleshort x \b, low character index %u
# width of the widest character
#>50 uleshort x \b, %u char width
# width of the widest character cell
#>52 uleshort x \b, %u cell width
# thickening size
#>58 uleshort x \b, %u thick
# lightening mask to eliminate pixels, usually 5555h
>62 uleshort !0x5555 \b, lightening mask 0x%x
# skewing mask to determine when to perform additional rotation when skewing, usually 5555h
>64 uleshort !0x5555 \b, skewing mask 0x%x
# offset to horizontal offset table 58h~88 5eh
#>68 ulelong >88 \b, 0x%x horizontal table offset
# offset character offset table
#>72 ulelong x \b, 0x%x coffset
# offset to font data
#>72 ulelong x \b, 0x%x foffset
# form width in bytes
#>80 uleshort x \b, %u fwidth
# pointer to the next font, set by GDOS after loading
#>84 ulelong x \b, 0x%x noffset
# downloadable fonts for browser (prints type) anthon@mnt.org
# https://tools.ietf.org/html/rfc3073
0 string PFR1 Portable Font Resource font data (new)
@ -167,16 +219,14 @@
>>12 regex/4l \^[A-Za-z][A-Za-z][A-Za-z/][A-Za-z2\ ]
#>>>0 ubelong x \b, sfnt version 0x%x
>>>0 ubelong !0x4f54544f TrueType
!:mime application/font-sfnt
#!:mime font/ttf
!:mime font/sfnt
!:apple ????tfil
# .ttf for TrueType font
# EUDC.tte created by privat character editor %WINDIR%\system32\eudcedit.exe
!:ext ttf/tte
# sfnt version 4F54544Fh~OTTO
>>>0 ubelong =0x4f54544f OpenType
!:mime application/font-sfnt
#!:mime font/otf
!:mime font/otf
!:apple ????OTTO
!:ext otf
>>>0 ubelong x Font data
@ -257,7 +307,7 @@
# TrueType/OpenType font collections (.ttc)
# URL: https://en.wikipedia.org/wiki/OpenType
# http://www.microsoft.com/typography/otspec/otff.htm
# https://www.microsoft.com/typography/otspec/otff.htm
# Modified by: Joerg Jenderek
# Note: container for TrueType, OpenType font
0 string ttcf
@ -265,17 +315,16 @@
>4 ubyte 0
# sfnt version often 0x00010000 of 1st table is TrueType
>>(12.L) ubelong !0x4f54544f TrueType
#!:mime font/ttf
!:mime font/ttf
!:apple ????tfil
!:ext ttc
# sfnt version 4F54544Fh~OTTO of 1st table is OpenType font
>>(12.L) ubelong =0x4f54544f OpenType
#!:mime font/otf
!:mime font/otf
!:apple ????OTTO
# no example found for otc
!:ext ttc/otc
>>4 ubyte x font collection data
!:mime application/font-sfnt
#!:mime font/collection
# TCC version
>>4 belong 0x00010000 \b, 1.0
@ -320,12 +369,12 @@
#>14 beshort x \b, reserved %d
#>16 belong x \b, totalSfntSize %d
# http://www.w3.org/TR/WOFF/
# https://www.w3.org/TR/WOFF/
0 string wOFF Web Open Font Format
>0 use woff
>20 beshort x \b, version %d
>22 beshort x \b.%d
# http://www.w3.org/TR/WOFF2/
# https://www.w3.org/TR/WOFF2/
0 string wOF2 Web Open Font Format (Version 2)
>0 use woff
#>20 belong x \b, totalCompressedSize %d

98
contrib/file/magic/Magdir/fsav
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: fsav,v 1.15 2018/07/16 12:30:41 christos Exp $
# $File: fsav,v 1.19 2019/04/19 00:42:27 christos Exp $
# fsav: file(1) magic for datafellows fsav virus definition files
# Anthon van der Neut (anthon@mnt.org)
@ -40,25 +40,64 @@
#>>>>>>13 ubyte x \b%02x bytes
# Joerg Jenderek: joerg dot jenderek at web dot de
# http://www.clamav.net/doc/latest/html/node45.html
# .cvd files start with a 512 bytes colon separated header
# clamav-0.100.2\docs\html\node60.html
# https://github.com/vrtadmin/clamav-faq/raw/master/manual/clamdoc.pdf
# ClamAV virus database files start with a 512 bytes colon separated header
# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
# + gzipped tarball files
0 string ClamAV-VDB:
>11 string >\0 Clam AntiVirus database %-.23s
>>34 string :
>>>35 string !: \b, version
>>>>35 string x \b %-.1s
>>>>>36 string !:
>>>>>>36 string x \b%-.1s
>>>>>>>37 string !:
>>>>>>>>37 string x \b%-.1s
>>>>>>>>>38 string !:
>>>>>>>>>>38 string x \b%-.1s
>>>>>>>>>>>39 string !:
>>>>>>>>>>>>39 string x \b%-.1s
>512 string \037\213 \b, gzipped
>769 string ustar\0 \b, tarred
# + gzipped (optional) tarball files
# output can often be verified by `sigtool --info=FILE`
0 string ClamAV-VDB: Clam AntiVirus
# padding spaces implies database
>511 ubyte =0x20 database
!:mime application/x-clamav-database
# empty build time
>>10 string =:: (unsigned)
# sigtool(1) man page
!:ext cud
# display some text to avoid error like:
# Magdir/fsav, 78: Warning: Current entry does not yet have a description for adding a EXTENSION type
# file: could not find any valid magic files! (No error)
>>10 default x (with buildtime)
#>>10 default x
# clamtmp is used for temporily database like update process
# for pure tar database only cld extension found
!:ext cld/cvd/clamtmp/cud
>511 default x file
!:mime application/x-clamav
!:ext info
>11 string >\0
# buildDate empty or like "22 Mar 2017 12-57 -0400"; verified by `sigtool -i FILE`
>>11 regex \^[^:]{0,23} \b, %s
# version like 25170
>>>&1 regex \^[^:]{1,6} \b, version %s
# signaturesNumbers like 4566249
>>>>&1 regex \^[^:]{1,10} \b, %s signatures
# functionalityLevelRequired like 60
>>>>>&1 regex \^[^:]{1,4} \b, level %s
# X for nothing or MD5
#>>>>>>&1 regex \^[^:]{1,32} \b, MD5 "%s"
>>>>>>&1 regex \^[^:]{1,32}
# X for nothing or digital signature starting like AIzk/LYbX
#>>>>>>>&1 regex \^[^:]{1,255} \b, signature "%s"
>>>>>>>&1 regex \^[^:]{1,255}
# builder like neo
>>>>>>>>&1 regex \^[^:]{1,32} \b, builder %s
# buildTime like 1506611558
#>>>>>>>>>&1 regex \^[^:]{1,10} \b, %s
>>>>>>>>>&1 regex \^[^:]{1,10}
# padding with spaces
#>>>>>>>>>>&1 ubequad x \b, padding 0x%16.16llx
>510 ubyte =0x20
# inspect real database content
#>>512 ubeshort x \b, database MAGIC 0x%x
# ./archive handle pure tar archives
>>1012 quad =0 \b, with
>>>512 use tar-file
# not pure tar
>>1012 quad !0
# one space at the end of text and then handles gziped archives by ./compress
>>>512 string \037\213 \b, with
>>>>512 indirect x
# Type: Grisoft AVG AntiVirus
# From: David Newgas <david@newgas.net>
@ -66,3 +105,24 @@
0 string X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR
>33 string -STANDARD-ANTIVIRUS-TEST-FILE!$H+H* EICAR virus test files
# From: Joerg Jenderek
# URL: https://www.avira.com/
# Note: found in directory %ProgramData%\Avira\Antivirus\INFECTED (Windows)
# tested with version 15.0.43.23 at November 2019
0 string AntiVir\ Qua Avira AntiVir quarantined
!:mime application/x-avira-qua
#!:mime application/octet-stream
!:ext qua
>156 string SUSPICIOUS_FILE
# file path of suspicious file
>>220 lestring16 x %s
>156 string !SUSPICIOUS_FILE
# file path of virus file
>>228 lestring16 x %s
# quarantined date
>60 ldate x at %s
# virus/danger name
>156 string !SUSPICIOUS_FILE
>>156 string x \b, category "%s"

6
contrib/file/magic/Magdir/games
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: games,v 1.16 2017/10/19 16:40:37 christos Exp $
# $File: games,v 1.17 2019/04/19 00:42:27 christos Exp $
# games: file(1) for games
# Fabio Bonelli <fabiobonelli@libero.it>
@ -211,7 +211,7 @@
# Summary: SGF Smart Game Format
# Extension: .sgf
# Reference: http://www.red-bean.com/sgf/
# Reference: https://www.red-bean.com/sgf/
# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
# Modified by (1): Abel Cheung (regex, more game format)
# FIXME: Some games don't have GM (game type)
@ -281,7 +281,7 @@
>>&0 regex [0-9a-z.]+ \b, version %s
# Type: SGF Smart Game Format
# URL: http://www.red-bean.com/sgf/
# URL: https://www.red-bean.com/sgf/
# From: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
2 regex/c \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format
>2 regex/c GM\\[1\\] - Go Game

12
contrib/file/magic/Magdir/geo
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: geo,v 1.6 2018/03/11 00:48:16 christos Exp $
# $File: geo,v 1.7 2019/04/19 00:42:27 christos Exp $
# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu>
######################################################################
@ -49,7 +49,7 @@
######################################################################
#
# MULTIBEAM SONARS http://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/
# MULTIBEAM SONARS https://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/
#
######################################################################
@ -67,11 +67,11 @@
# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR.
0 string $HSF XSE multibeam
# mb121 http://www.saic.com/maritime/gsf/
# mb121 https://www.saic.com/maritime/gsf/
8 string GSF-v SAIC generic sensor format (GSF) sonar data,
>&0 regex [0-9]*\.[0-9]* version %s
# MGD77 - http://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm
# MGD77 - https://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm
# mb161
9 string MGD77 MGD77 Header, Marine Geophysical Data Exchange Format
@ -104,7 +104,7 @@
# https://midas.psi.ch/elog/
0 string $@MID@$ elog journal entry
# Geospatial Designs http://www.geospatialdesigns.com/surfer6_format.htm
# Geospatial Designs https://www.geospatialdesigns.com/surfer6_format.htm
0 string DSBB Surfer 6 binary grid file
>4 leshort x \b, %d
>6 leshort x \bx%d
@ -117,7 +117,7 @@
# magic for LAS format files
# alex myczko <alex@aiei.ch>
# http://www.asprs.org/wp-content/uploads/2010/12/LAS_1_3_r11.pdf
# https://www.asprs.org/wp-content/uploads/2010/12/LAS_1_3_r11.pdf
0 string LASF LIDAR point data records
>24 byte >0 \b, version %u
>25 byte >0 \b.%u

21
contrib/file/magic/Magdir/glibc Normal file
View file

@ -0,0 +1,21 @@
#------------------------------------------------------------------------------
# $File: glibc,v 1.1 2018/10/11 15:35:43 christos Exp $
# glibc locale files
#
# https://sourceware.org/git/?p=glibc.git;f=locale/localeinfo.h;h=68822a63#l32
0 belong 0x20070920 glibc locale file LC_CTYPE
0 belong 0x14110320 glibc locale file LC_NUMERIC
0 belong 0x17110320 glibc locale file LC_TIME
0 belong 0x17100520 glibc locale file LC_COLLATE
0 belong 0x11110320 glibc locale file LC_MONETARY
0 belong 0x10110320 glibc locale file LC_MESSAGES
0 belong 0x13110320 glibc locale file LC_ALL
0 belong 0x12110320 glibc locale file LC_PAPER
0 belong 0x1d110320 glibc locale file LC_NAME
0 belong 0x1c110320 glibc locale file LC_ADDRESS
0 belong 0x1f110320 glibc locale file LC_TELEPHONE
0 belong 0x1e110320 glibc locale file LC_MEASUREMENT
0 belong 0x19110320 glibc locale file LC_IDENTIFICATION

6
contrib/file/magic/Magdir/gnome
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: gnome,v 1.5 2014/04/30 21:41:02 christos Exp $
# $File: gnome,v 1.6 2019/04/19 00:42:27 christos Exp $
# GNOME related files
# Contributed by Josh Triplett
@ -42,7 +42,7 @@
# It's always "GVariant", it's byte swapped on incompatible archs
# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c
# file_builder_serialise()
# http://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant
# https://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant
0 string GVariant GVariant Database file,
# version is never filled. probably future extension
>8 lelong x version %d
@ -51,7 +51,7 @@
#>>>20 lelong x end %d
# G-IR database made by gobject-introspect toolset,
# http://live.gnome.org/GObjectIntrospection
# https://live.gnome.org/GObjectIntrospection
0 string GOBJ\nMETADATA\r\n\032 G-IR binary database
>16 byte x \b, v%d
>17 byte x \b.%d

4
contrib/file/magic/Magdir/gnu
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: gnu,v 1.20 2018/02/24 16:11:23 christos Exp $
# $File: gnu,v 1.21 2019/04/19 00:42:27 christos Exp $
# gnu: file(1) magic for various GNU tools
#
# GNU nlsutils message catalog file format
@ -148,7 +148,7 @@
# GnuPG Keybox file
# <http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD>
# <https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD>
# From: Philipp Hahn <hahn@univention.de>
0 belong 32
>4 byte 1

4
contrib/file/magic/Magdir/graphviz
View file

@ -1,7 +1,7 @@
#------------------------------------------------------------------------------
# $File: graphviz,v 1.8 2014/06/03 19:01:34 christos Exp $
# graphviz: file(1) magic for http://www.graphviz.org/
# $File: graphviz,v 1.9 2019/04/30 04:01:40 christos Exp $
# graphviz: file(1) magic for https://www.graphviz.org/
# FIXME: These patterns match too generally. For example, the first
# line matches a LaTeX file containing the word "graph" (with a {

6
contrib/file/magic/Magdir/guile
View file

@ -1,9 +1,9 @@
#------------------------------------------------------------------------------
# $File: guile,v 1.1 2011/12/16 17:44:33 christos Exp $
# $File: guile,v 1.2 2019/04/19 00:42:27 christos Exp $
# Guile file magic from <dalepsmith@gmail.com>
# http://www.gnu.org/s/guile/
# http://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250
# https://www.gnu.org/s/guile/
# https://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250
0 string GOOF---- Guile Object
>8 string LE \b, little endian

12
contrib/file/magic/Magdir/hardware Normal file
View file

@ -0,0 +1,12 @@
#------------------------------------------------------------------------------
# $File: hardware,v 1.1 2018/08/02 06:32:52 christos Exp $
# hardware magic
# EDID
# https://en.wikipedia.org/wiki/Extended_Display_Identification_Data
0 string \x00\xFF\xFF\xFF\xFF\xFF\xFF\x00
>19 byte x
>>18 byte x EDID data, version %u.
>>19 byte x \b%u
#>>17 ubyte+1990 <255 \b, manufactured %u

4
contrib/file/magic/Magdir/hitachi-sh
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: hitachi-sh,v 1.8 2017/03/17 21:35:28 christos Exp $
# $File: hitachi-sh,v 1.9 2018/08/21 12:48:41 christos Exp $
# hitach-sh: file(1) magic for Hitachi Super-H
#
# Super-H COFF
@ -18,6 +18,7 @@
# use big endian variant of subroutine to display name+variables+flags
# for common object formated files
>>0 use \^display-coff
!:strength -10
0 leshort 0x0550
# test for unused flag bits in f_flags
@ -25,4 +26,5 @@
# use little endian variant of subroutine to
# display name+variables+flags for common object formated files
>>0 use display-coff
!:strength -10

8
contrib/file/magic/Magdir/hp
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: hp,v 1.24 2014/04/30 21:41:02 christos Exp $
# $File: hp,v 1.25 2019/01/13 00:32:38 christos Exp $
# hp: file(1) magic for Hewlett Packard machines (see also "printer")
#
# XXX - somebody should figure out whether any byte order needs to be
@ -120,12 +120,6 @@
0 belong 0x020b010d PA-RISC1.0 dynamic load library
>96 belong >0 - not stripped
0 belong 0x213c6172 archive file
>68 belong 0x020b0619 - PA-RISC1.0 relocatable library
>68 belong 0x02100619 - PA-RISC1.1 relocatable library
>68 belong 0x02110619 - PA-RISC1.2 relocatable library
>68 belong 0x02140619 - PA-RISC2.0 relocatable library
#### 500
0 long 0x02080106 HP s500 relocatable executable
>16 long >0 - version %d

4
contrib/file/magic/Magdir/ibm6000
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: ibm6000,v 1.13 2017/03/17 21:35:28 christos Exp $
# $File: ibm6000,v 1.14 2019/03/07 17:21:54 christos Exp $
# ibm6000: file(1) magic for RS/6000 and the RT PC.
#
0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
@ -17,6 +17,8 @@
0 belong 0x000001f9 AIX compiled message catalog
0 string \<aiaff> archive
0 string \<bigaf> archive (big format)
0 belong 0x09006bea AIX backup/restore format file
0 belong 0x09006fea AIX backup/restore format file
0 beshort 0x01f7 64-bit XCOFF executable or object module
>20 belong 0 not stripped

273
contrib/file/magic/Magdir/images
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: images,v 1.146 2018/07/03 20:55:37 christos Exp $
# $File: images,v 1.160 2019/04/19 00:42:27 christos Exp $
# images: file(1) magic for image formats (see also "iff", and "c-lang" for
# XPM bitmaps)
#
@ -27,23 +27,25 @@
# and Image Type 1 2 3 9 10 11 32 33
# and Color Map Entry Size 0 15 16 24 32
0 ubequad&0x00FeC400000000C0 0
# Prevent conflicts with CRI ADX.
>(2.S-2) belong !0x28632943
# skip more garbage like *.iso by looking for positive image type
>2 ubyte >0
>>2 ubyte >0
# skip some compiled terminfo like xterm+tmux by looking for image type less equal 33
>>2 ubyte <34
>>>2 ubyte <34
# skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel depth 1 8 15 16 24 32
>>>16 ubyte 1
>>>>0 use tga-image
>>>16 ubyte 8
>>>>0 use tga-image
>>>16 ubyte 15
>>>>0 use tga-image
>>>16 ubyte 16
>>>>0 use tga-image
>>>16 ubyte 24
>>>>0 use tga-image
>>>16 ubyte 32
>>>>0 use tga-image
>>>>16 ubyte 1
>>>>>0 use tga-image
>>>>16 ubyte 8
>>>>>0 use tga-image
>>>>16 ubyte 15
>>>>>0 use tga-image
>>>>16 ubyte 16
>>>>>0 use tga-image
>>>>16 ubyte 24
>>>>>0 use tga-image
>>>>16 ubyte 32
>>>>>0 use tga-image
# display tga bitmap image information
0 name tga-image
>2 ubyte <34 Targa image data
@ -174,43 +176,43 @@
0 search/1 P1
>0 regex/4 P1[\040\t\f\r\n]
>>0 use netpbm
>>>0 string x \b, bitmap
!:strength + 45
>>0 string x \b, bitmap
!:strength + 65
!:mime image/x-portable-bitmap
0 search/1 P2
>0 regex/4 P2[\040\t\f\r\n]
>>0 use netpbm
>>>0 string x \b, greymap
!:strength + 45
>>0 string x \b, greymap
!:strength + 65
!:mime image/x-portable-greymap
0 search/1 P3
>0 regex/4 P3[\040\t\f\r\n]
>>0 use netpbm
>>>0 string x \b, pixmap
!:strength + 45
>>0 string x \b, pixmap
!:strength + 65
!:mime image/x-portable-pixmap
0 string P4
>0 regex/4 P4[\040\t\f\r\n]
>>0 use netpbm
>>>0 string x \b, rawbits, bitmap
!:strength + 45
>>0 string x \b, rawbits, bitmap
!:strength + 65
!:mime image/x-portable-bitmap
0 string P5
>0 regex/4 P5[\040\t\f\r\n]
>>0 use netpbm
>>>0 string x \b, rawbits, greymap
!:strength + 45
>>0 string x \b, rawbits, greymap
!:strength + 65
!:mime image/x-portable-greymap
0 string P6
>0 regex/4 P6[\040\t\f\r\n]
>>0 use netpbm
>>>0 string x \b, rawbits, pixmap
!:strength + 45
>>0 string x \b, rawbits, pixmap
!:strength + 65
!:mime image/x-portable-pixmap
0 string P7 Netpbm PAM image file
@ -235,7 +237,7 @@
# Canon RAW version 1 (CRW) files are a type of Canon Image File Format
# (CIFF) file. These are apparently all little-endian.
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
# URL: http://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html
# URL: https://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html
0 string II\x1a\0\0\0HEAPCCDR Canon CIFF raw image data
!:mime image/x-canon-crw
>16 leshort x \b, version %d.
@ -245,9 +247,10 @@
# number. Put this above the TIFF test to make sure we detect them.
# These are apparently all little-endian.
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
# URL: http://libopenraw.freedesktop.org/wiki/Canon_CR2
# URL: https://libopenraw.freedesktop.org/wiki/Canon_CR2
0 string II\x2a\0\x10\0\0\0CR Canon CR2 raw image data
!:mime image/x-canon-cr2
!:strength +80
>10 byte x \b, version %d.
>11 byte x \b%d
@ -437,6 +440,7 @@
# Standard PNG image.
0 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0DIHDR PNG image data
!:mime image/png
!:ext png
!:strength +10
>16 use png-ihdr
@ -444,6 +448,7 @@
0 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x04CgBI
>24 string \x00\x00\x00\x0DIHDR PNG image data (CgBI)
!:mime image/png
!:ext png
!:strength +10
>>32 use png-ihdr
@ -565,7 +570,7 @@
# at offset 8 starts imagedata followed by "RGB " marker
# PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu)
# http://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\
# https://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\
# 28bitmap_information_header.29
0 string BM
>14 leshort 12 PC bitmap, OS/2 1.x format
@ -755,7 +760,7 @@
>5 byte 0xFF (black background)
# From: Alex Myczko <alex@aiei.ch>
# http://www.atarimax.com/jindroush.atari.org/afmtatr.html
# https://www.atarimax.com/jindroush.atari.org/afmtatr.html
0 leshort 0x0296 Atari ATR image
# XXX:
@ -781,8 +786,8 @@
# PCX image files
# From: Dan Fandrich <dan@coneharvesters.com>
# updated by Joerg Jenderek at Feb 2013 by http://de.wikipedia.org/wiki/PCX
# http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
# updated by Joerg Jenderek at Feb 2013 by https://de.wikipedia.org/wiki/PCX
# https://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000
# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT
0 ubelong&0xffF8fe00 0x0a000000
@ -849,7 +854,7 @@
# Update: Joerg Jenderek
# See http://fileformats.archiveteam.org/wiki/GEM_Raster
# For variations, also see:
# http://www.seasip.info/Gem/ff_img.html (Ventura)
# https://www.seasip.info/Gem/ff_img.html (Ventura)
# http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT)
# http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT)
# http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG)
@ -877,7 +882,7 @@
0 name gem_info
# version is 2 for some XIMG and 1 for all others
>0 beshort <0x0003 GEM
# http://www.snowstone.org.uk/riscos/mimeman/mimemap.txt
# https://www.snowstone.org.uk/riscos/mimeman/mimemap.txt
!:mime image/x-gem
# header_size 24 25 27 59 779 words for colored bitmaps
>>2 beshort >9
@ -1020,8 +1025,8 @@
# and related image processing software used by biologists.
# From: Vebjorn Ljosa <vebjorn@ljosa.com>
# BOOL values are two-byte integers; use them to rule out false positives.
# http://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt
# Samples: http://www.loci.wisc.edu/software/sample-data
# https://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt
# Samples: https://www.loci.wisc.edu/software/sample-data
14 leshort <2
>62 leshort <2
>>54 leshort 12345 Bio-Rad .PIC Image File
@ -1052,7 +1057,7 @@
# Originally by Marc Espie
# Modified by Robert Minsk <robertminsk at yahoo.com>
# http://www.openexr.com/openexrfilelayout.pdf
# https://www.openexr.com/openexrfilelayout.pdf
0 lelong 20000630 OpenEXR image data,
!:mime image/x-exr
>4 lelong&0x000000ff x version %d,
@ -1116,7 +1121,7 @@
>768 beshort 7 bottom to top/right to left
# From: Tom Hilinski <tom.hilinski@comcast.net>
# http://www.unidata.ucar.edu/packages/netcdf/
# https://www.unidata.ucar.edu/packages/netcdf/
0 string CDF\001 NetCDF Data Format data
#-----------------------------------------------------------------------
@ -1141,7 +1146,7 @@
# http://www.xara.com/ for Windows and as GPL application for Linux
0 string XARA\243\243 Xara graphics file
# http://www.cartesianinc.com/Tech/
# https://www.cartesianinc.com/Tech/
0 string CPC\262 Cartesian Perceptual Compression image
!:mime image/x-cpi
@ -1210,8 +1215,8 @@
# extension is also used for
# Sony SRF raw image (image/x-sony-srf)
# SRF map
# Terragen Surface Map (http://www.planetside.co.uk/terragen)
# FileLocator Pro search criteria file (http://www.mythicsoft.com/filelocatorpro)
# Terragen Surface Map (https://www.planetside.co.uk/terragen)
# FileLocator Pro search criteria file (https://www.mythicsoft.com/filelocatorpro)
!:ext srf
#!:mime image/x-garmin-srf
# version 1.00,2.00,2.10,2.40,2.50
@ -1232,7 +1237,7 @@
0 string Xcur X11 cursor
# Type: Olympus ORF raw images.
# URL: http://libopenraw.freedesktop.org/wiki/Olympus_ORF
# URL: https://libopenraw.freedesktop.org/wiki/Olympus_ORF
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
0 string MMOR Olympus ORF raw image data, big-endian
!:mime image/x-olympus-orf
@ -1253,7 +1258,7 @@
#!mime image/vnd.radiance
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
# URL: http://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf
# URL: https://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf
# Used by the pfstools packages. The regex matches for the image size could
# probably use some work. The MIME type is made up; if there's one in
# actual common use, it should replace the one below.
@ -1263,7 +1268,7 @@
>>1 regex \ [0-9]{4} \bx%s
# Type: Foveon X3F
# URL: http://www.photofo.com/downloads/x3f-raw-format.pdf
# URL: https://www.photofo.com/downloads/x3f-raw-format.pdf
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
# Note that the MIME type isn't defined anywhere that I can find; if
# there's a canonical type for this format, it should replace this one.
@ -1283,8 +1288,8 @@
# From: "Tano M. Fotang" <mfotang@quanteq.com>
0 string \x46\x4d\x52\x00 ISO/IEC 19794-2 Format Minutiae Record (FMR)
# doc: http://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip
# example: http://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip
# doc: https://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip
# example: https://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip
90 bequad 0x574D50484F544F00 JPEG-XR Image
>98 byte&0x08 =0x08 \b, hard tiling
>99 byte&0x80 =0x80 \b, tiling present
@ -1336,7 +1341,7 @@
# From: Johan van der Knijff <johan.vanderknijff@kb.nl>
#
# BPG (Better Portable Graphics) format
# http://bellard.org/bpg/
# https://bellard.org/bpg/
# http://fileformats.archiveteam.org/wiki/BPG
#
0 string \x42\x50\x47\xFB BPG (Better Portable Graphics)
@ -1399,7 +1404,7 @@
>12 ubelong x \b%d
# Type: Microsoft DirectDraw Surface (common data)
# URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
# URL: https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
# From: Morten Hustveit <morten@debian.org>
# Updated by: David Korth <gerbilsoft@gerbilsoft.com>
0 name ms-directdraw-surface
@ -1501,7 +1506,7 @@
>>>>0x64 ulequad 0xC00000003FF00000 \b, A2B10G10R10
# Type: Microsoft DirectDraw Surface
# URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
# URL: https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
# From: Morten Hustveit <morten@debian.org>
# Updated by: David Korth <gerbilsoft@gerbilsoft.com>
0 string/b DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS):
@ -1510,7 +1515,7 @@
# Type: Sega PVR image.
# From: David Korth <gerbilsoft@gerbilsoft.com>
# References:
# - http://fabiensanglard.net/Mykaruga/tools/segaPVRFormat.txt
# - https://fabiensanglard.net/Mykaruga/tools/segaPVRFormat.txt
# - https://github.com/yazgoo/pvrx2png
# - https://github.com/nickworonekin/puyotools
@ -1553,7 +1558,7 @@
0 string GBIX
>0x10 string PVRT
>>0x10 string DDS\040\174\000\000\000 Sega PVR (Xbox) image:
>>0x20 use ms-directdraw-surface
>>>0x20 use ms-directdraw-surface
>>0x10 belong !0x44445320 Sega PVR image:
>>>0x10 use sega-pvr-image-header
>>0x08 lelong x \b, global index = %u
@ -1703,7 +1708,7 @@
>12 lelong 0x04030201 (little-endian)
>>16 use khronos-ktx-endian-header
>12 belong 0x04030201 (big-endian)
>>16 use ^khronos-ktx-endian-header
>>16 use \^khronos-ktx-endian-header
# Type: Valve VTF texture.
# From: David Korth <gerbilsoft@gerbilsoft.com>
@ -1793,3 +1798,165 @@
0 string LinS Microsoft Paint image data (version 2.0)
>4 leshort x (%d
>>6 leshort x x %d)
# reMarkable tablet internal file format (https://www.remarkable.com/)
# https://github.com/ax3l/lines-are-beautiful
# https://plasma.ninja/blog/devices/remarkable/binary/format/2017/12/26/\
# reMarkable-lines-file-format.html#what-to-do-next
# from Axel Huebl
0 string reMarkable
>11 string lines
>>17 string with
>>>22 string selections
>>>>33 string and
>>>>>37 string layers
>>>>>>43 lelong x reMarkable tablet notebook lines, 1404 x 1872, %x page(s)
# newer per-page files for the reMarkable
0 string reMarkable
>11 string .lines
>>18 string file,
>>>24 string version=
>>>>32 byte x reMarkable tablet page (v%c), 1404 x 1872,
>>>>>43 lelong x %d layer(s)
# Type: PVR3 texture.
# From: David Korth <gerbilsoft@gerbilsoft.com>
# References:
# - http://cdn.imgtec.com/sdk-documentation/PVR+File+Format.Specification.pdf
# PVR3 pixel formats.
0 name pvr3-pixel-format
>4 ulelong 0
>>0 ulelong 0 PVRTC 2bpp RGB
>>0 ulelong 1 PVRTC 2bpp RGBA
>>0 ulelong 2 PVRTC 4bpp RGB
>>0 ulelong 3 PVRTC 4bpp RGBA
>>0 ulelong 4 PVRTC-II 2bpp
>>0 ulelong 5 PVRTC-II 4bpp
>>0 ulelong 6 ETC1
>>0 ulelong 7 DXT1
>>0 ulelong 8 DXT2
>>0 ulelong 9 DXT3
>>0 ulelong 10 DXT4
>>0 ulelong 11 DXT5
>>0 ulelong 12 BC4
>>0 ulelong 13 BC5
>>0 ulelong 14 BC6
>>0 ulelong 15 BC7
>>0 ulelong 16 UYVY
>>0 ulelong 17 YUY2
>>0 ulelong 18 BW1bpp
>>0 ulelong 19 R9G9B9E5 Shared Exponent
>>0 ulelong 20 RGBG8888
>>0 ulelong 21 GRGB8888
>>0 ulelong 22 ETC2 RGB
>>0 ulelong 23 ETC2 RGBA
>>0 ulelong 24 ETC2 RGB A1
>>0 ulelong 25 EAC R11
>>0 ulelong 26 EAC RG11
>>0 ulelong 27 ASTC_4x4
>>0 ulelong 28 ASTC_5x4
>>0 ulelong 29 ASTC_5x5
>>0 ulelong 30 ASTC_6x5
>>0 ulelong 31 ASTC_6x6
>>0 ulelong 32 ASTC_8x5
>>0 ulelong 33 ASTC_8x6
>>0 ulelong 34 ASTC_8x8
>>0 ulelong 35 ASTC_10x5
>>0 ulelong 36 ASTC_10x6
>>0 ulelong 37 ASTC_10x8
>>0 ulelong 38 ASTC_10x10
>>0 ulelong 39 ASTC_12x10
>>0 ulelong 40 ASTC_12x12
>>0 ulelong 41 ASTC_3x3x3
>>0 ulelong 42 ASTC_4x3x3
>>0 ulelong 43 ASTC_4x4x3
>>0 ulelong 44 ASTC_4x4x4
>>0 ulelong 45 ASTC_5x4x4
>>0 ulelong 46 ASTC_5x5x4
>>0 ulelong 47 ASTC_5x5x5
>>0 ulelong 48 ASTC_6x5x5
>>0 ulelong 49 ASTC_6x6x5
>>0 ulelong 50 ASTC_6x6x6
>4 ulelong !0
>>0 byte !0 %c
>>1 byte !0 \b%c
>>2 byte !0 \b%c
>>3 byte !0 \b%c
0 string PVR\x03 PVR 3.0 texture:
>0x18 ulelong x %u x
>0x1C ulelong x %u
>0x20 ulelong >1 x %u
>0x08 byte x \b,
>0x08 use pvr3-pixel-format
>0x10 ulelong 1 \b, sRGB
>0x04 ulelong&0x02 0x02 \b, premultiplied alpha
# Type: Microsoft Xbox XPR0 texture.
# From: David Korth <gerbilsoft@gerbilsoft.com>
# References:
# - https://github.com/Cxbx-Reloaded/Cxbx-Reloaded/blob/develop/src/core/hle/D3D8/XbD3D8Types.h
# XPR pixel formats.
0 name xbox-xpr-pixel-format
>0 byte 0x00 L8
>0 byte 0x01 AL8
>0 byte 0x02 ARGB1555
>0 byte 0x03 RGB555
>0 byte 0x04 ARGB4444
>0 byte 0x05 RGB565
>0 byte 0x06 ARGB8888
>0 byte 0x07 xRGB8888
>0 byte 0x0B P8
>0 byte 0x0C DXT1
>0 byte 0x0E DXT2
>0 byte 0x0F DXT4
>0 byte 0x10 Linear ARGB1555
>0 byte 0x11 Linear RGB565
>0 byte 0x12 Linear ARGB8888
>0 byte 0x13 Linear L8
>0 byte 0x16 Linear R8B8
>0 byte 0x17 Linear G8B8
>0 byte 0x19 A8
>0 byte 0x1A A8L8
>0 byte 0x1B Linear AL8
>0 byte 0x1C Linear RGB555
>0 byte 0x1D Linear ARGB4444
>0 byte 0x1E Linear xRGB8888
>0 byte 0x1F Linear A8
>0 byte 0x20 Linear A8L8
>0 byte 0x24 YUY2
>0 byte 0x25 UYVY
>0 byte 0x27 L6V5U5
>0 byte 0x28 V8U8
>0 byte 0x29 R8B8
>0 byte 0x2A D24S8
>0 byte 0x2B F24S8
>0 byte 0x2C D16
>0 byte 0x2D F16
>0 byte 0x2E Linear D24S8
>0 byte 0x2F Linear F24S8
>0 byte 0x30 Linear D16
>0 byte 0x31 Linear F16
>0 byte 0x32 L16
>0 byte 0x33 V16U16
>0 byte 0x35 Linear L16
>0 byte 0x36 Linear V16U16
>0 byte 0x37 Linear L6V5U5
>0 byte 0x38 RGBA5551
>0 byte 0x39 RGBA4444
>0 byte 0x3A QWVU8888
>0 byte 0x3B BGRA8888
>0 byte 0x3C RGBA8888
>0 byte 0x3D Linear RGBA5551
>0 byte 0x3E Linear RGBA4444
>0 byte 0x3F Linear ABGR8888
>0 byte 0x40 Linear BGRA8888
>0 byte 0x41 Linear RGBA8888
>0 byte 0x64 Vertex Data
0 string XPR0 Microsoft Xbox XPR0 texture
>0x19 byte x \b, format:
>>0x19 use xbox-xpr-pixel-format

6
contrib/file/magic/Magdir/intel
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: intel,v 1.16 2017/11/14 15:48:36 christos Exp $
# $File: intel,v 1.17 2018/08/01 10:34:03 christos Exp $
# intel: file(1) magic for x86 Unix
#
# Various flavors of x86 UNIX executable/object (other than Xenix, which
@ -42,6 +42,10 @@
#>12 lelong >0 not stripped
# no hint found, that at offset 22 is version
#>22 leshort >0 - version %d
0 leshort 0x0200
>0 use display-coff
0 leshort 0x8664
>0 use display-coff
# rom: file(1) magic for BIOS ROM Extensions found in intel machines
# mapped into memory between 0xC0000 and 0xFFFFF

4
contrib/file/magic/Magdir/isz
View file

@ -1,8 +1,8 @@
#------------------------------------------------------------------------------
# $File: isz,v 1.4 2017/03/17 21:35:28 christos Exp $
# $File: isz,v 1.5 2019/04/19 00:42:27 christos Exp $
# ISO Zipped file format
# http://www.ezbsystems.com/isz/iszspec.txt
# https://www.ezbsystems.com/isz/iszspec.txt
0 string IsZ! ISO Zipped file
>4 byte x \b, header size %u
>5 byte x \b, version %u

26
contrib/file/magic/Magdir/java
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------
# $File: java,v 1.18 2015/11/29 22:08:14 christos Exp $
# $File: java,v 1.21 2019/02/18 17:58:50 christos Exp $
# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
# same magic number, 0xcafebabe, so they are both handled
# in the entry called "cafebabe".
@ -22,6 +22,24 @@
# Java HPROF dumps
# https://java.net/downloads/heap-snapshot/hprof-binary-format.html
0 string JAVA\x20PROFILE\x201.0.
>0x12 short 0
>>0x11 ushort-0x31 <2 Java HPROF dump,
>>0x17 beqdate/1000 x created %s
>0x12 byte 0
>>0x11 ubyte-0x31 <2 Java HPROF dump,
>>>0x17 beqdate/1000 x created %s
# Java jmod module
# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/classes/jdk/internal/jmod/JmodFile.java
# Grr. 2 byte magic "JM", really? In 2019?
0 belong 0x4a4d0100 Java jmod module version 1.0
!:mime application/x-java-jmod
# Java jlinked image
# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/native/libjimage/imageFile.hpp
0 belong 0xcafedada Java module image (big endian)
>4 beshort >0x00 \b, version %d
>6 beshort x \b.%d
!:mime application/x-java-image
0 lelong 0xcafedada Java module image (little endian)
>6 leshort >0x00 \b, version %d
>4 leshort x \b.%d
!:mime application/x-java-image

8
contrib/file/magic/Magdir/jpeg
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: jpeg,v 1.31 2017/03/17 21:35:28 christos Exp $
# $File: jpeg,v 1.32 2018/10/01 18:58:29 christos Exp $
# JPEG images
# SunOS 5.5.1 had
#
@ -51,21 +51,21 @@
>>4 byte x \b, baseline, precision %d
>>7 beshort x \b, %dx
>>5 beshort x \b%d
>>9 byte x \b, frames %d
>>9 byte x \b, components %d
>0 beshort 0xFFC1
>>(2.S+2) use jpeg_segment
>>4 byte x \b, extended sequential, precision %d
>>7 beshort x \b, %dx
>>5 beshort x \b%d
>>9 byte x \b, frames %d
>>9 byte x \b, components %d
>0 beshort 0xFFC2
>>(2.S+2) use jpeg_segment
>>4 byte x \b, progressive, precision %d
>>7 beshort x \b, %dx
>>5 beshort x \b%d
>>9 byte x \b, frames %d
>>9 byte x \b, components %d
# Define Huffman Tables
>0 beshort 0xFFC4

8
contrib/file/magic/Magdir/keepass
View file

@ -1,12 +1,12 @@
#------------------------------------------------------------------------------
# $File: keepass,v 1.1 2012/12/24 22:14:56 christos Exp $
# $File: keepass,v 1.2 2019/04/19 00:42:27 christos Exp $
# keepass: file(1) magic for KeePass file
#
# Keepass Password Safe:
# * original one: http://keepass.info/
# * *nix port: http://www.keepassx.org/
# * android port: http://code.google.com/p/keepassdroid/
# * original one: https://keepass.info/
# * *nix port: https://www.keepassx.org/
# * android port: https://code.google.com/p/keepassdroid/
0 lelong 0x9AA2D903 Keepass password database
>4 lelong 0xB54BFB65 1.x KDB

4
contrib/file/magic/Magdir/kerberos
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: kerberos,v 1.2 2017/03/17 21:35:28 christos Exp $
# $File: kerberos,v 1.3 2019/04/19 00:42:27 christos Exp $
# kerberos: MIT kerberos file binary formats
#
@ -24,7 +24,7 @@
# can refer to ${name}
# - Provide a way to format strings as hex values
#
# http://www.gnu.org/software/shishi/manual/html_node/\
# https://www.gnu.org/software/shishi/manual/html_node/\
# The-Keytab-Binary-File-Format.html
#

69
contrib/file/magic/Magdir/kicad Normal file
View file

@ -0,0 +1,69 @@
#------------------------------------------------------------------------------
# $File: kicad,v 1.1 2018/10/01 18:39:21 christos Exp $
# kicad: file(1) magic for KiCad files
#
# See
#
# http://kicad-pcb.org
#
# KiCad Schematic Document
0 string EESchema
>8 byte 0x20
>>9 string Schematic
>>>18 byte 0x20 KiCad Schematic Document
!:ext sch/bak
>>>>24 string Version
>>>>>31 byte 0x20
>>>>>>32 string x (Version %s)
# KiCad Symbol Library
0 string EESchema-LIBRARY
>16 byte 0x20 KiCad Symbol Library
!:ext lib
>>17 string Version
>>>24 byte 0x20
>>>>25 string x (Version %s)
# KiCad Symbol Library Documentation
0 string EESchema-DOCLIB
>15 byte 0x20 KiCad Symbol Library Documentation
!:ext dcm
>>17 string Version
>>>24 byte 0x20
>>>>25 string x (Version %s)
# KiCad Board Layout
0 string (kicad_pcb
>10 byte 0x20 KiCad Board Layout
!:ext kicad_pcb/kicad_pcb-bak
>>11 string (version
>>>19 byte 0x20
>>>>20 byte x (Version %c)
# KiCad Footprint
0 string (module
>7 byte 0x20 KiCad Footprint
!:ext kicad_mod
# KiCad Footprint (Legacy)
0 string PCBNEW-LibModule-V1 KiCad Footprint (Legacy)
!:ext mod
# KiCad Netlist
0 string (export
>7 byte 0x20 KiCad Netlist
!:ext net
# KiCad Symbol Library Table
0 string (sym_lib_table
>14 byte 0xA KiCad Symbol Library Table
>14 byte 0xD KiCad Symbol Library Table
>14 byte 0x20 KiCad Symbol Library Table
# KiCad Footprint Library Table
0 string (fp_lib_table
>13 byte 0xA KiCad Footprint Library Table
>13 byte 0xD KiCad Footprint Library Table
>13 byte 0x20 KiCad Footprint Library Table

12
contrib/file/magic/Magdir/kml
View file

@ -1,14 +1,14 @@
#------------------------------------------------------------------------------
# $File: kml,v 1.4 2017/03/17 21:35:28 christos Exp $
# $File: kml,v 1.5 2019/04/19 00:42:27 christos Exp $
# Type: Google KML, formerly Keyhole Markup Language
# Future development of this format has been handed
# over to the Open Geospatial Consortium.
# http://www.opengeospatial.org/standards/kml/
# https://www.opengeospatial.org/standards/kml/
# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
0 string/t \<?xml
>20 search/400 \ xmlns=
>>&0 regex ['"]http://earth.google.com/kml Google KML document
>>&0 regex ['"]https://earth.google.com/kml Google KML document
!:mime application/vnd.google-earth.kml+xml
>>>&1 string 2.0' \b, version 2.0
>>>&1 string 2.1' \b, version 2.1
@ -18,15 +18,15 @@
# Type: OpenGIS KML, formerly Keyhole Markup Language
# This standard is maintained by the
# Open Geospatial Consortium.
# http://www.opengeospatial.org/standards/kml/
# https://www.opengeospatial.org/standards/kml/
# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document
>>&0 regex ['"]https://www.opengis.net/kml OpenGIS KML document
!:mime application/vnd.google-earth.kml+xml
>>>&1 string/t 2.2 \b, version 2.2
#------------------------------------------------------------------------------
# Type: Google KML Archive (ZIP based)
# http://code.google.com/apis/kml/documentation/kml_tut.html
# https://code.google.com/apis/kml/documentation/kml_tut.html
# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
0 string PK\003\004
>4 byte 0x14

24
contrib/file/magic/Magdir/linux
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: linux,v 1.65 2018/07/16 12:32:08 christos Exp $
# $File: linux,v 1.67 2019/04/19 00:42:27 christos Exp $
# linux: file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
@ -56,7 +56,7 @@
#
# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
# See: http://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html
# See: https://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html
0 leshort 0x0436 Linux/i386 PC Screen Font v1 data,
>2 byte&0x01 0 256 characters,
>2 byte&0x01 !0 512 characters,
@ -79,7 +79,7 @@
4076 string SWAPSPACE2LINHIB0001 Linux/i386 swap file (new style) (compressed hibernate)
# according to man page of mkswap (8) March 1999
# volume label and UUID Russell Coker
# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
# https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
4086 string SWAPSPACE2 Linux/i386 swap file (new style),
>0x400 long x version %d (4K pages),
>0x404 long x size %d pages,
@ -111,8 +111,13 @@
# and Nicolas Lichtmaier <nick@debian.org>
# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
# Linux kernel boot images (i386 arch) (Wolfram Kleff)
# URL: https://www.kernel.org/doc/Documentation/x86/boot.txt
514 string HdrS Linux kernel
!:strength + 55
# often no extension like in linux, vmlinuz, bzimage or memdisk but sometimes
# Acronis Recovery kernel64.dat and Plop Boot Manager plpbtrom.bin
# DamnSmallLinux 1.5 damnsmll.lnx
!:ext /dat/bin/lnx
>510 leshort 0xAA55 x86 boot executable
>>518 leshort >0x1ff
>>>529 byte 0 zImage,
@ -203,7 +208,10 @@
# Linux ARM compressed kernel image
# From: Kevin Cernekee <cernekee@gmail.com>
# Update: Joerg Jenderek
36 lelong 0x016f2818 Linux kernel ARM boot executable zImage (little-endian)
# raspian "kernel7.img", Vu+ Ultimo4K "kernel_auto.bin"
!:ext img/bin
36 belong 0x016f2818 Linux kernel ARM boot executable zImage (big-endian)
############################################################################
@ -232,7 +240,7 @@
# 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable
# SYSLINUX boot logo files (from 'ppmtolss16' sources)
# http://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename:
# https://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename:
# file extension .lss .16
0 lelong =0x1413f33d SYSLINUX' LSS16 image data
# syslinux-4.05/mime/image/x-lss16.xml
@ -361,7 +369,7 @@
>>&1 string x %s...)
# Systemd journald files
# See http://www.freedesktop.org/wiki/Software/systemd/journal-files/.
# See https://www.freedesktop.org/wiki/Software/systemd/journal-files/.
# From: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl>
# check magic
@ -453,7 +461,7 @@
# the default version of locate on Arch Linux (and others).
# File path: /var/lib/mlocate/mlocate.db by default (but configurable)
# Site: https://fedorahosted.org/mlocate/
# Format docs: http://linux.die.net/man/5/mlocate.db
# Format docs: https://linux.die.net/man/5/mlocate.db
# Type: mlocate database file
# URL: https://fedorahosted.org/mlocate/
# From: Wander Nauta <info@wandernauta.nl>
@ -469,14 +477,14 @@
0 lelong 0x47361222 iproute2 addresses dump
# Image and service files for CRIU tool.
# URL: http://criu.org
# URL: https://criu.org
# From: Pavel Emelyanov <xemul@parallels.com>
0 lelong 0x54564319 CRIU image file v1.1
0 lelong 0x55105940 CRIU service file
0 lelong 0x58313116 CRIU inventory
# Kdump compressed dump files
# http://sourceforge.net/p/makedumpfile/code/ci/master/tree/IMPLEMENTATION
# https://sourceforge.net/p/makedumpfile/code/ci/master/tree/IMPLEMENTATION
0 string KDUMP Kdump compressed dump
>8 long x v%d

4
contrib/file/magic/Magdir/lisp
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: lisp,v 1.25 2017/03/17 21:35:28 christos Exp $
# $File: lisp,v 1.26 2019/04/19 00:42:27 christos Exp $
# lisp: file(1) magic for lisp programs
#
# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
@ -27,7 +27,7 @@
!:mime text/x-lisp
# URL: https://en.wikipedia.org/wiki/Emacs_Lisp
# Reference: http://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz
# Reference: https://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz
# Update: Joerg Jenderek
# Emacs 18 - this is always correct, but not very magical.
0 string \012(

4
contrib/file/magic/Magdir/llvm
View file

@ -1,8 +1,8 @@
#------------------------------------------------------------------------------
# $File: llvm,v 1.8 2013/01/12 03:09:51 christos Exp $
# $File: llvm,v 1.9 2019/04/19 00:42:27 christos Exp $
# llvm: file(1) magic for LLVM byte-codes
# URL: http://llvm.org/docs/BitCodeFormat.html
# URL: https://llvm.org/docs/BitCodeFormat.html
# From: Al Stone <ahs3@fc.hp.com>
0 string llvm LLVM byte-codes, uncompressed

4
contrib/file/magic/Magdir/lua
View file

@ -1,8 +1,8 @@
#------------------------------------------------------------------------------
# $File: lua,v 1.6 2013/01/09 16:23:17 christos Exp $
# $File: lua,v 1.7 2019/04/19 00:42:27 christos Exp $
# lua: file(1) magic for Lua scripting language
# URL: http://www.lua.org/
# URL: https://www.lua.org/
# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
# Lua scripts

8
contrib/file/magic/Magdir/m4
View file

@ -1,9 +1,11 @@
#------------------------------------------------------------------------------
# $File: m4,v 1.2 2017/08/14 07:40:38 christos Exp $
# $File: m4,v 1.3 2019/02/27 16:46:23 christos Exp $
# make: file(1) magic for M4 scripts
#
0 regex \^dnl\ M4 macro processor script text
0 search/8192 dnl
>0 regex \^dnl\ M4 macro processor script text
!:mime text/x-m4
0 regex \^AC_DEFUN\\(\\[ M4 macro processor script text
0 search/8192 AC_DEFUN
>0 regex \^AC_DEFUN\\(\\[ M4 macro processor script text
!:strength + 15
!:mime text/x-m4

16
contrib/file/magic/Magdir/macintosh
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: macintosh,v 1.28 2017/12/05 02:17:48 christos Exp $
# $File: macintosh,v 1.29 2019/04/19 00:42:27 christos Exp $
# macintosh description
#
# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
@ -62,7 +62,7 @@
# MacBinary format (Eric Fischer, enf@pobox.com)
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/MacBinary
# Reference: http://files.stairways.com/other/macbinaryii-standard-info.txt
# Reference: https://files.stairways.com/other/macbinaryii-standard-info.txt
#
# Unfortunately MacBinary doesn't really have a magic number prior
# to the MacBinary III format.
@ -180,8 +180,8 @@
# Apple Type/Creator Database
# URL: https://en.wikipedia.org/wiki/Type_code
# Reference: http://www.lacikam.co.il/tcdb/
# http://www.macdisk.com/macsigen.php
# Reference: https://www.lacikam.co.il/tcdb/
# https://www.macdisk.com/macsigen.php
# Note: classic Mac OS files have two 4 character codes for type and creator.
# Thereby the Finder attach documents types to applications.
@ -379,7 +379,7 @@
>0x424 pstring x volume name: %s
# *.hfs updated by Joerg Jenderek
# http://en.wikipedia.org/wiki/Hierarchical_File_System
# https://en.wikipedia.org/wiki/Hierarchical_File_System
# "BD" gives many false positives
0x400 beshort 0x4244
# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h
@ -390,7 +390,7 @@
!:mime application/x-apple-diskimage
#!:apple hfsdINIT
#!:apple MACSdisk
# http://www.macdisk.com/macsigen.php
# https://www.macdisk.com/macsigen.php
#!:apple ddskdevi
!:apple ????devi
# https://en.wikipedia.org/wiki/Apple_Disk_Image
@ -402,7 +402,7 @@
>>>0x40a beshort &0x0200 (spared blocks)
>>>0x40a beshort &0x0800 (unclean)
>>>0x47C beshort 0x482B (Embedded HFS+ Volume)
# http://www.epochconverter.com/
# https://www.epochconverter.com/
# 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970
# 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00
# construct not working
@ -458,7 +458,7 @@
0 string BOMStore Mac OS X bill of materials (BOM) file
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
# URL: http://en.wikipedia.org/wiki/Datafork_TrueType
# URL: https://en.wikipedia.org/wiki/Datafork_TrueType
# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
# don't know what they mean.

4
contrib/file/magic/Magdir/mail.news
View file

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: mail.news,v 1.23 2015/06/29 14:44:26 christos Exp $
# $File: mail.news,v 1.24 2019/04/19 00:42:27 christos Exp $
# mail.news: file(1) magic for mail and news
#
# Unfortunately, saved netnews also has From line added in some news software.
@ -57,7 +57,7 @@
#0 string \<!--\ MHonArc text/html; x-type=mhonarc
# Cyrus: file(1) magic for compiled Cyrus sieve scripts
# URL: http://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php
# URL: https://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php
# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master
# From: Philipp Hahn <hahn@univention.de>

298
contrib/file/magic/Magdir/map
View file

@ -1,16 +1,16 @@
#------------------------------------------------------------------------------
# $File: map,v 1.4 2015/08/10 05:18:27 christos Exp $
# $File: map,v 1.7 2019/04/30 04:02:04 christos Exp $
# map: file(1) magic for Map data
#
# Garmin .FIT files http://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
# Garmin .FIT files https://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
8 string .FIT FIT Map data
>15 byte 0
>>35 belong x \b, unit id %d
>>39 lelong x \b, serial %u
# http://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
# https://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
# 20 years after unix epoch
# TZ=GMT date -d '1989-12-31 0:00' +%s
>>43 leldate+631065600 x \b, %s
@ -26,8 +26,298 @@
>>53 byte 8 \b (Elevations)
>>53 byte 10 \b (Totals)
# Summary: Garmin map
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Garmin_.img
# Reference: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/IMG_File_Format
# sourceforge.net/projects/garmin-img/files/IMG%20File%20Format/1.0/imgformat-1.0.pdf
# GRR: similar to MBR boot sector handled by ./filesystems
0x1FE leshort =0xAA55
# look for valid map signature
>0x13 string =IMG\0
>>0 use garmin-map
0 name garmin-map
>0 ubyte x Garmin
!:mime application/x-garmin-map
# If non-zero, every byte of the entire .img file is to be XORed with this value
>0 ubyte !0 \b, 0x%x XORed
# goto block before FAT
>(0x40.b*512) ubyte x
# 1st fat name "DLLINFO TXT" only found for vpm
>>&512 string =DLLINFO\ TXT map (Voice Processing)
# there exist 2 other Garmin VPM formats; see ./audio
!:ext vpm
# Deutsch__Yannick_D4481-00_0210.vpm
#>>>512 search/0x0116da60/s RIFF \b; with
# determine type voice type by ./riff
#>>>>&0 indirect x \b
>>&512 string !DLLINFO\ TXT map
!:ext img
# 9 zeros
>1 ubelong !0 \b, zeroes 0x%x
# Map's version major
>8 ubyte x v%u
# Map's version minor
>9 ubyte x \b.%.2u
# Map description[20], 0x20 padded
>0x49 string x %.20s
# Map name, continued (0x20 padded, \0 terminated)
>0x65 string >\ \b%.31s
# Update year (+1900 for val >= 0x63, +2000 for val <= 0x62)
>0xB ubyte x \b, updated
>>0xB ubyte >0x62
>>>0xB ubyte-100 x 20%.2u
>>0xB ubyte <0x63
>>>0xB ubyte x 20%.2u
# Update month (0-11)
>0xA ubyte x \b-%.2u
# All zeroes
>0xc uleshort !0 \b, zeroes 0x%x
# Mapsource flag, 1 - file created by Mapsource, 0 - Garmin map visible in Basecamp and Homeport
#>0xE ubyte !0 \b, Mapsource flag 0x%x
>0xE ubyte 1 \b, Mapsource
# Checksum, sum of all bytes modulo 256 should be 0
#>0xF ubyte x \b, Checksum 0x%x
# Signature: DSKIMG 0x00 or DSDIMG 0x00 for demo map
>0x10 string !DSKIMG \b, signature "%.7s"
>0x39 use garmin-date
# Map file identifier like GARMIN\0
>0x41 string !GARMIN \b, id "%.7s"
# Block size exponent, E1; appears to always be 0x09; minimum block size 512 bytes
>0x61 ubyte !0x09 \b, E1=%u
# Block size exponent, E2 ; file blocksize=2**(E1+E2)
>>0x62 ubyte x \b, E2=%u
>0x61 ubyte =0x09 \b, blocksize
>>0x62 ubyte 0 512
>>0x62 ubyte 1 1024
>>0x62 ubyte 2 2048
>>0x62 ubyte 3 4096
>>0x62 ubyte 4 8192
>>0x62 ubyte 5 16384
>>0x62 default x
>>>0x62 ubyte x E2=%u
# MBR signature
>0x1FE leshort !0xAA55 \b, invalid MBR
# 512 zeros
>0x200 uquad !0 \b, zeroes 0x%llx
# First sub-file offset (absolute); sometimes NO/UNKNOWN sub file!
>0x40C ulelong >0 \b, at 0x%x
# sub-file Header length
#>>(0x40C.l) uleshort x \b, header len 0x%x
>>(0x40C.l) uleshort x %u bytes
# sub-file Type[10] like "GARMIN RGN" "GARMIN TRE", "GARMIN TYP", etc.
>>(0x40C.l+2) ubyte >0x1F
>>>(0x40C.l+2) ubyte <0xFF
>>>>(0x40C.l+2) string x "%.10s"
# 0x00 for most maps, 0x80 for locked maps (City Nav, City Select, etc.)
>>>>(0x40C.l+13) ubyte >0 \b, locked 0x%x
# Block sequence numbers like 0000 0100 0200 ... FFFF
# >0x420 ubequad >0 \b, seq. 0x%16.16llx
# >>0x428 ubequad >0 \b%16.16llx
# >>>0x430 ubequad >0 \b%16.16llx
# >>>>0x438 ubequad >0 \b%16.16llx
# >>>>>0x440 ubequad >0 \b%16.16llx
# >>>>>>0x448 ubequad >0 \b%16.16llx
# >>>>>>>0x450 ubequad >0 \b%16.16llx
# >>>>>>>>0x458 ubequad >0 \b%16.16llx
# >>>>>>>>>0x460 ubequad >0 \b%16.16llx
# >>>>>>>>>>0x468 ubequad >0 \b%16.16llx
# >>>>>>>>>>>0x470 ubequad >0 \b%16.16llx
# >>>>>>>>>>>>0x478 ubequad >0 \b%16.16llx
# >>>>>>>>>>>>>0x480 ubequad >0 \b%16.16llx
# >>>>>>>>>>>>>>0x488 ubequad >0 \b%16.16llx
# >>>>>>>>>>>>>>>0x490 ubequad >0 \b%16.16llx
# >>>>>>>>>>>>>>>>0x498 ubequad >0 \b%16.16llx
# >>>>>>>>>>>>>>>>>0x4A0 ubequad >0 \b%16.16llx
# >>>>>>>>>>>>>>>>>>0x4A8 ubequad >0 \b%16.16llx
# look for end of FAT
#>>0x420 search/512/s \xff\xff FAT END
# Physical block number of FAT header
#>0x40 ubyte x \b, FAT at phy. block %u
>0x40 ubyte x
>>(0x40.b*512) ubyte x
# 1st FAT block
>>>&511 use garmin-fat
# 2nd FAT block
>>>&1023 use garmin-fat
# 3th FAT block
>>>&1535 use garmin-fat
# 4th FAT block
>>>&2047 use garmin-fat
# ... xth FAT block
#
# 314 zeros but not in vpm and also gmaptz.img
>0x84 uquad !0 \b, at 0x84 0x%llx
# display FileAllocationTable block entry in garmin map
0 name garmin-fat
>0 ubyte x \b;
# sub file part; 0x0003 seems to be garbage
>0x10 uleshort !0 next 0x%4.4x
>0x10 uleshort =0
# fat flag 0~dummy block 1~true sub file
>>0 ubyte !1 flag %u
>>0 ubyte =1
# sub-file name like MAKEGMAP 12345678
>>>0x1 string x %.8s
# sub-file typ like RGN TRE MDR LBL
>>>0x9 string x \b.%.3s
# size of sub file
>>>0xC ulelong x \b, %u bytes
# 32-bit block sequence numbers
#>>>0x20 ubequad x \b, seq. 0x%16.16llx
# display date stored inside Garmin maps like yyyy-mm-dd h:mm:ss
0 name garmin-date
# year like 2018
>0 uleshort x \b, created %u
# month (0-11)
>2 ubyte x \b-%.2u
# day (1-31)
>3 ubyte x \b-%.2u
# hour (0-23)
>4 ubyte x %u
# minute (0-59)
>5 ubyte x \b:%.2u
# second (0-59)
>6 ubyte x \b:%.2u
# Summary: Garmin Map subfiles
# From: Joerg Jenderek
# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/IMG_File_Format
# Garmin Common Header
2 string GARMIN\
# skip ASCII text by checking for low header length
>0 uleshort <0x1000 Garmin map,
# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/GMP_Subfile_Format
>>9 string GMP subtile
!:mime application/x-garmin-gpm
!:ext gmp
# copyright message
>>>(0.s) string x %s
>>>0x0E use garmin-date
# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/MDR_Subfile_Format
# This contains the searchable address table used for finding routing destinations
>>9 string MDR address table
!:mime application/x-garmin-mdr
!:ext mdr
# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/NOD_Subfile_Format
# http://svn.parabola.me.uk/display/trunk/doc/nod.txt
# This contains the routing information
>>9 string NOD routing
!:mime application/x-garmin-nod
!:ext nod
>>>0x0E use garmin-date
#>>>0x15 ulelong x \b, at 0x%x
#>>>0x19 ulelong x 0x%x bytes NOD1
#>>>0x25 ulelong x \b, at 0x%x
#>>>0x29 ulelong x 0x%x bytes NOD2
#>>>0x31 ulelong x \b, at 0x%x
#>>>0x35 ulelong x 0x%x bytes NOD3
# URL: http://www.pinns.co.uk/osm/net.html
# routable highways (length, direction, allowed speed,house address information)
>>9 string NET highways
!:mime application/x-garmin-net
!:ext net
#>>>0x15 ulelong x \b, at 0x%x
#>>>0x19 ulelong x 0x%x bytes NET1
#>>>0x22 ulelong >0
#>>>>0x1E ulelong x \b, at 0x%x
#>>>>0x22 ulelong x 0x%x bytes NET2
#>>>0x2B ulelong >0
#>>>>0x27 ulelong x \b, at 0x%x
#>>>>0x2B ulelong x 0x%x bytes NET3
# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/LBL_Subfile_Format
>>9 string LBL labels
!:mime application/x-garmin-lbl
!:ext lbl
>>>(0.s) string x %s
# Label coding type 6h 9h and ah
>>>0x1E ubyte x \b, coding type 0x%x
#>>>0x15 ulelong x \b, at 0x%x
#>>>0x19 ulelong x 0x%x bytes LBL1
#>>>0x1F ulelong x \b, at 0x%x
#>>>0x23 ulelong x 0x%x bytes LBL2
#>>>0x2D ulelong x \b, at 0x%x
#>>>0x31 ulelong x 0x%x bytes LBL3
# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/SRT_Subfile_Format
# A lookup table of the chars in the map's codepage, and their collating sequence
>>9 string SRT sort table
!:mime application/x-garmin-srt
!:ext srt
>>>0x0E use garmin-date
# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/TRE_Subfile_Format
>>9 string TRE tree
!:mime application/x-garmin-tre
!:ext tre
# title like City Nav Europe NTU 2019.2 Basemap
# or OSM Street map
>>>(0.s) string x %s
# 2nd title like Copyright 1995-2018 by GARMIN Corporation.
# or http://www.openstreetmap.org/
>>>>&1 string x %s
>>>0x0E use garmin-date
#>>>0x21 ulelong x \b, at 0x%x
#>>>0x25 ulelong x 0x%x bytes TRE1
#>>>0x29 ulelong x \b, at 0x%x
#>>>0x2D ulelong x 0x%x bytes TRE2
#>>>0x31 ulelong x \b, at 0x%x
#>>>0x35 ulelong x 0x%x bytes TRE3
# Copyright record size
#>>>0x39 uleshort x \b, copyright record size %u
# Map ID
>>>0x74 ulelong x \b, ID 0x%x
# URL: https://www.gpspower.net/garmin-tutorials/353310-basecamp-installing-free-desktop-map.html
# For road traffic information service (RDS/TMS/TMC). Commonly seen in City Navigator maps
>>9 string TRF traffic,
!:mime application/x-garmin-trf
!:ext trf
# city/region like Preitenegg
>>>(0.s+1) string x 1st %s
# highway part like L606/L148
>>>>&1 string x %s
# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/Format
# Reference: http://www.pinns.co.uk/osm/typformat.html
# customize the appearance of objects. For GPS and MapSource/Qlandkarte better looking maps
>>9 string TYP types
!:mime application/x-garmin-typ
!:ext typ
>>>0x0E use garmin-date
# character set 1252 65001~UTF8
>>>0x15 uleshort x \b, code page %u
# POIs
#>>>0x17 ulelong x \b, at 0x%x
#>>>0x1B ulelong x 0x%x bytes TYP1
# extra pois
#>>>0x5B ulelong x \b, at 0x%x
#>>>0x5F ulelong x 0x%x bytes TYP8
# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/RGN_Subfile_Format
# http://www.pinns.co.uk/osm/RGN.html
# region data used by the Garmin software
>>9 string RGN region
!:mime application/x-garmin-rgn
!:ext rgn
# POIs,Indexed POIs,Polylines or Polygons or first map level
#>>>0x15 ulelong x \b, at 0x%x
#>>>0x19 ulelong x 0x%x bytes RGN1
# polygons with extended types
#>>>0x21 ulelong >0
#>>>>0x1D ulelong x \b, at 0x%x
#>>>>0x21 ulelong x 0x%x bytes RGN2
# polylines with extended types
#>>>0x3D ulelong >0
#>>>>0x39 ulelong x \b, at 0x%x
#>>>>0x3D ulelong x 0x%x bytes RGN3
# extended POIs
#>>>0x59 ulelong >0
#>>>>0x55 ulelong x \b, at 0x%x
#>>>>0x59 ulelong x 0x%x bytes RGN3
#>>9 default x unknown map type
# Header length; GMP:31h 35h 3Dh,MDR:11Eh 238h 2C4h 310h,NOD:3Fh 7Fh,NET:64h,
# LBL:2A9h,SRT:1Dh 25h 27h,TRE:CFh 135h,TRF:5Ah,TYP:5Bh 6Eh 7Ch AEh,RGN:7Dh
>>0 uleshort x \b, header length 0x%x
# TOM TOM GPS watches ttbin files:
# http://github.com/ryanbinns/ttwatch/tree/master/ttbin
# https://github.com/ryanbinns/ttwatch/tree/master/ttbin
# From: Daniel Lenski
0 byte 0x20
>1 leshort 0x0007

2
contrib/file/magic/Magdir/marc21
View file

@ -5,7 +5,7 @@
#
# MARC21 formats are for the representation and communication
# of bibliographic and related information in machine-readable
# form. For more info, see http://www.loc.gov/marc/
# form. For more info, see https://www.loc.gov/marc/
# leader position 20-21 must be 45

4
contrib/file/magic/Magdir/matroska
View file

@ -1,9 +1,9 @@
#------------------------------------------------------------------------------
# $File: matroska,v 1.8 2013/02/08 17:25:16 christos Exp $
# $File: matroska,v 1.9 2019/04/19 00:42:27 christos Exp $
# matroska: file(1) magic for Matroska files
#
# See http://www.matroska.org/
# See https://www.matroska.org/
#
# EBML id:

4
contrib/file/magic/Magdir/mercurial
View file

@ -1,8 +1,8 @@
#------------------------------------------------------------------------------
# $File: mercurial,v 1.4 2009/09/19 16:28:10 christos Exp $
# $File: mercurial,v 1.5 2019/04/19 00:42:27 christos Exp $
# mercurial: file(1) magic for Mercurial changeset bundles
# http://www.selenic.com/mercurial/wiki/
# https://www.selenic.com/mercurial/wiki/
#
# Jesse Glick (jesse.glick@sun.com)
#

4
contrib/file/magic/Magdir/metastore
View file

@ -1,8 +1,8 @@
#------------------------------------------------------------------------------
# $File: metastore,v 1.2 2017/03/17 21:35:28 christos Exp $
# $File: metastore,v 1.3 2019/04/19 00:42:27 christos Exp $
# metastore: file(1) magic for metastore files
# From: Thomas Wissen
# see http://david.hardeman.nu/software.php#metastore
# see https://david.hardeman.nu/software.php#metastore
0 string MeTaSt00r3 Metastore data file,
>10 bequad x version %0llx

4
contrib/file/magic/Magdir/microfocus
View file

@ -1,9 +1,9 @@
#------------------------------------------------------------------------------
# $File: microfocus,v 1.2 2017/03/17 21:35:28 christos Exp $
# $File: microfocus,v 1.3 2019/04/19 00:42:27 christos Exp $
# Micro Focus COBOL data files.
# http://documentation.microfocus.com/help/index.jsp?topic=\
# https://documentation.microfocus.com/help/index.jsp?topic=\
# %2FGUID-0E0191D8-C39A-44D1-BA4C-D67107BAF784%2FHRFLRHFILE05.html
# http://www.cobolproducts.com/datafile/data-viewer.html
# https://github.com/miracle2k/mfcobol-export

6
contrib/file/magic/Magdir/misctools
View file

@ -1,6 +1,6 @@
#-----------------------------------------------------------------------------
# $File: misctools,v 1.17 2017/03/17 21:35:28 christos Exp $
# $File: misctools,v 1.18 2019/04/19 00:42:27 christos Exp $
# misctools: file(1) magic for miscellaneous UNIX tools.
#
0 search/1 %%!! X-Post-It-Note text
@ -8,7 +8,7 @@
!:mime text/calendar
# updated by Joerg Jenderek at Apr 2015
# Extension: .vcf
# http://en.wikipedia.org/wiki/VCard
# https://en.wikipedia.org/wiki/VCard
0 string/c BEGIN:VCARD vCard visiting card
# deprecated
#!:mime text/x-vcard
@ -36,7 +36,7 @@
# "Windows Minidump" by TrID
# ./misctools (version 5.25) labeled the entry as "MDMP crash report data"
0 string MDMP Mini DuMP crash report
# http://filext.com/file-extension/DMP
# https://filext.com/file-extension/DMP
!:mime application/x-dmp
!:ext dmp/mdmp
# The high-order word is an internal value that is implementation specific.

4
contrib/file/magic/Magdir/modem
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: modem,v 1.8 2017/03/17 21:35:28 christos Exp $
# $File: modem,v 1.9 2019/04/19 00:42:27 christos Exp $
# modem: file(1) magic for modem programs
#
# From: Florian La Roche <florian@knorke.saar.de>
@ -11,7 +11,7 @@
# Summary: CCITT Group 3 Facsimile in "raw" form (i.e. no header).
# Modified by: Joerg Jenderek
# URL: https://de.wikipedia.org/wiki/Fax
# Reference: http://web.archive.org/web/20020628195336/http://www.netnam.vn/unescocourse/computervision/104.htm
# Reference: https://web.archive.org/web/20020628195336/http://www.netnam.vn/unescocourse/computervision/104.htm
# GRR: EOL of G3 is too general as it catches also TrueType fonts, Postscript PrinterFontMetric, others
0 short 0x0100
# 16 0-bits near beginning like True Type fonts *.ttf, Postscript PrinterFontMetric *.pfm, FTYPE.HYPERCARD, XFER

19
contrib/file/magic/Magdir/mozilla
View file

@ -1,13 +1,28 @@
#------------------------------------------------------------------------------
# $File: mozilla,v 1.8 2018/01/17 12:08:36 christos Exp $
# $File: mozilla,v 1.10 2019/04/19 00:42:27 christos Exp $
# mozilla: file(1) magic for Mozilla XUL fastload files
# (XUL.mfasl and XPC.mfasl)
# URL: http://www.mozilla.org/
# URL: https://www.mozilla.org/
# From: Josh Triplett <josh@freedesktop.org>
0 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data
# Probably the next magic line contains misspelled "mozLz40\0"
0 string mozLz4a Mozilla lz4 compressed bookmark data
# From: Joerg Jenderek
# URL: https://lz4.github.io/lz4/
# Reference: https://github.com/avih/dejsonlz4/archive/master.zip/
# dejsonlz4-master\src\dejsonlz4.c
# Note: mostly JSON compressed with a non-standard LZ4 header
# can be unpacked by dejsonlz4 but not lz4 programm.
0 string mozLz40\0 Mozilla lz4 compressed data
!:mime application/x-lz4+json
# mozlz4 extension seems to be used for search/store, while jsonlz4 for bookmarks
!:ext jsonlz4/mozlz4
# decomp_size
>8 ulelong x \b, originally %u bytes
# lz4 data
#>12 ubequad x \b, lz4 data 0x%16.16llx
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Firefox_4

126
contrib/file/magic/Magdir/msdos
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: msdos,v 1.124 2018/07/10 04:05:50 christos Exp $
# $File: msdos,v 1.128 2019/04/19 00:42:27 christos Exp $
# msdos: file(1) magic for MS-DOS files
#
@ -9,12 +9,16 @@
0 string/t @
>1 string/cW \ echo\ off DOS batch file text
!:mime text/x-msdos-batch
!:ext bat
>1 string/cW echo\ off DOS batch file text
!:mime text/x-msdos-batch
!:ext bat
>1 string/cW rem DOS batch file text
!:mime text/x-msdos-batch
!:ext bat
>1 string/cW set\ DOS batch file text
!:mime text/x-msdos-batch
!:ext bat
# OS/2 batch files are REXX. the second regex is a bit generic, oh well
@ -49,6 +53,9 @@
# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file.
>0x18 leshort <0x40 MS-DOS executable
!:mime application/x-dosexec
# Windows and later versions of DOS will allow .EXEs to be named with a .COM
# extension, mostly for compatibility's sake.
!:ext exe/com
# These traditional tests usually work but not always. When test quality support is
# implemented these can be turned on.
#>>0x18 leshort 0x1c (Borland compiler)
@ -67,9 +74,33 @@
>>>(0x3c.l+24) default x Unknown PE signature
>>>>&0 leshort x 0x%x
>>>(0x3c.l+22) leshort&0x2000 >0 (DLL)
>>>(0x3c.l+92) leshort 1 (native)
>>>(0x3c.l+92) leshort 2 (GUI)
>>>(0x3c.l+92) leshort 3 (console)
>>>(0x3c.l+92) leshort 1
# Native PEs include ntoskrnl.exe, hal.dll, smss.exe, autochk.exe, and all the
# drivers in Windows/System32/drivers/*.sys.
>>>>(0x3c.l+22) leshort&0x2000 >0 (native)
!:ext dll/sys
>>>>(0x3c.l+22) leshort&0x2000 0 (native)
!:ext exe/sys
>>>(0x3c.l+92) leshort 2
>>>>(0x3c.l+22) leshort&0x2000 >0 (GUI)
# These could probably be at least partially distinguished from one another by
# looking for specific exported functions.
# CPL: Control Panel item
# TLB: Type library
# OCX: OLE/ActiveX control
# ACM: Audio compression manager codec
# AX: DirectShow source filter
# IME: Input method editor
!:ext dll/cpl/tlb/ocx/acm/ax/ime
>>>>(0x3c.l+22) leshort&0x2000 0 (GUI)
# Screen savers typically include code from the scrnsave.lib static library, but
# that's not guaranteed.
!:ext exe/scr
>>>(0x3c.l+92) leshort 3
>>>>(0x3c.l+22) leshort&0x2000 >0 (console)
!:ext dll/cpl/tlb/ocx/acm/ax/ime
>>>>(0x3c.l+22) leshort&0x2000 0 (console)
!:ext exe/com
>>>(0x3c.l+92) leshort 7 (POSIX)
>>>(0x3c.l+92) leshort 9 (Windows CE)
>>>(0x3c.l+92) leshort 10 (EFI application)
@ -151,8 +182,16 @@
>>>(0x3c.l+0x36) default x
>>>>(0x3c.l+0x36) byte x (unknown OS %x)
>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender
>>>(0x3c.l+0x0c) leshort&0x8003 0x8002 (DLL)
>>>(0x3c.l+0x0c) leshort&0x8003 0x8001 (driver)
>>>(0x3c.l+0x0c) leshort&0x8000 0x8000 (DLL or font)
# DRV: Driver
# 3GR: Grabber device driver
# CPL: Control Panel Item
# VBX: Visual Basic Extension
# FON: Bitmap font
# FOT: Font resource file
!:ext dll/drv/3gr/cpl/vbx/fon/fot
>>>(0x3c.l+0x0c) leshort&0x8000 0 (EXE)
!:ext exe/scr
>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive
>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
@ -199,6 +238,11 @@
>>>(0x3c.l+0x0a) leshort 2 for MS Windows
>>>(0x3c.l+0x0a) leshort 3 for DOS
>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD)
# VXD: VxD for Windows 95/98/Me
# 386: VxD for Windows 2.10, 3.0, 3.1x
# PDR: Port driver
# MPD: Miniport driver (?)
!:ext vxd/386/pdr/mpd
>>>(&0x7c.l+0x26) string UPX \b, UPX compressed
>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive
@ -207,6 +251,7 @@
>>0x3c lelong >0x20000000
>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS
!:mime application/x-dosexec
!:ext exe/com
# header data too small for extended executable
>2 long !0
>>0x18 leshort <0x40
@ -305,8 +350,8 @@
>>49824 leshort =1 \b, 1 file
>>49824 leshort >1 \b, %u files
# added by Joerg Jenderek of http://www.freedos.org/software/?prog=kc
# and http://www.freedos.org/software/?prog=kpdos
# added by Joerg Jenderek of https://www.freedos.org/software/?prog=kc
# and https://www.freedos.org/software/?prog=kpdos
# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD
0 string/b KCF FreeDOS KEYBoard Layout collection
# only version=0x100 found
@ -448,6 +493,8 @@
0 name msdos-com
>0 byte x DOS executable (COM)
!:mime application/x-dosexec
!:ext com
>6 string SFX\ of\ LHarc \b, %s
>0x1FE leshort 0xAA55 \b, boot code
>85 string UPX \b, UPX compressed
@ -484,11 +531,11 @@
# modified by Joerg Jenderek
# syslinux COM32 or COM32R executable
>>1 lelong&0xFFFFFFFe 0x21CD4CFe COM executable (32-bit COMBOOT
# http://www.syslinux.org/wiki/index.php/Comboot_API
# https://www.syslinux.org/wiki/index.php/Comboot_API
# Since version 5.00 c32 modules switched from the COM32 object format to ELF
!:mime application/x-c32-comboot-syslinux-exec
!:ext c32
# http://syslinux.zytor.com/comboot.php
# https://syslinux.zytor.com/comboot.php
# older syslinux version ( <4 )
# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
# start with assembler instructions mov eax,21cd4cffh
@ -514,41 +561,75 @@
0 string/b \x81\xfc
>4 string \x77\x02\xcd\x20\xb9
>>36 string UPX! FREE-DOS executable (COM), UPX compressed
!:mime application/x-dosexec
!:ext com
252 string Must\ have\ DOS\ version DR-DOS executable (COM)
!:mime application/x-dosexec
!:ext com
# added by Joerg Jenderek at Oct 2008
# GRR search is not working
#34 search/2 UPX! FREE-DOS executable (COM), UPX compressed
34 string UPX! FREE-DOS executable (COM), UPX compressed
!:mime application/x-dosexec
!:ext com
35 string UPX! FREE-DOS executable (COM), UPX compressed
!:mime application/x-dosexec
!:ext com
# GRR search is not working
#2 search/28 \xcd\x21 COM executable for MS-DOS
#WHICHFAT.cOM
2 string \xcd\x21 COM executable for DOS
!:mime application/x-dosexec
!:ext com
#DELTREE.cOM DELTREE2.cOM
4 string \xcd\x21 COM executable for DOS
!:mime application/x-dosexec
!:ext com
#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
5 string \xcd\x21 COM executable for DOS
!:mime application/x-dosexec
!:ext com
#DELTMP.COm HASFAT32.cOM
7 string \xcd\x21
>0 byte !0xb8 COM executable for DOS
!:mime application/x-dosexec
!:ext com
#COMP.cOM MORE.COm
10 string \xcd\x21
>5 string !\xcd\x21 COM executable for DOS
!:mime application/x-dosexec
!:ext com
#comecho.com
13 string \xcd\x21 COM executable for DOS
!:mime application/x-dosexec
!:ext com
#HELP.COm EDIT.coM
18 string \xcd\x21 COM executable for MS-DOS
!:mime application/x-dosexec
!:ext com
#NWRPLTRM.COm
23 string \xcd\x21 COM executable for MS-DOS
!:mime application/x-dosexec
!:ext com
#LOADFIX.cOm LOADFIX.cOm
30 string \xcd\x21 COM executable for MS-DOS
!:mime application/x-dosexec
!:ext com
#syslinux.com 3.11
70 string \xcd\x21 COM executable for DOS
!:mime application/x-dosexec
!:ext com
# many compressed/converted COMs start with a copy loop instead of a jump
0x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS
!:mime application/x-dosexec
!:ext com
0x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS
!:mime application/x-dosexec
!:ext com
>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed
0x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed
!:mime application/x-dosexec
!:ext com
# FIXME: missing diet .com compression
# miscellaneous formats
@ -843,8 +924,9 @@
# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG)
>>(18.l) ulelong x MS Windows
>>>0 ubelong 0x00000100 icon resource
#!:mime image/vnd.microsoft.icon
!:mime image/x-icon
# https://www.iana.org/assignments/media-types/image/vnd.microsoft.icon
!:mime image/vnd.microsoft.icon
#!:mime image/x-icon
!:ext ico
>>>>4 uleshort x - %d icon
# plural s
@ -890,7 +972,8 @@
#>12 ulelong x \b, offset 0x%x
# PNG header (\x89PNG)
>(12.l) ubelong =0x89504e47
>>&-4 indirect x \b with
# 1 space char after "with" to get phrase "with PNG image" by magic in ./images
>>&-4 indirect x \b with
# DIB image
>(12.l) ubelong !0x89504e47
#>>&-4 use dib-image
@ -959,10 +1042,11 @@
0 lelong 0x4C
>4 lelong 0x00021401 Windows shortcut file
# .PIF files added by Joerg Jenderek from http://smsoft.ru/en/pifdoc.htm
# .PIF files added by Joerg Jenderek from https://smsoft.ru/en/pifdoc.htm
# only for windows versions equal or greater 3.0
0x171 string MICROSOFT\ PIFEX\0 Windows Program Information File
!:mime application/x-dosexec
!:ext pif
#>2 string >\0 \b, Title:%.30s
>0x24 string >\0 \b for %.63s
>0x65 string >\0 \b, directory=%.64s
@ -1010,7 +1094,7 @@
# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C
# of http://www.davep.org/norton-guides/ng2h-105.tgz
# http://en.wikipedia.org/wiki/Norton_Guides
# https://en.wikipedia.org/wiki/Norton_Guides
0 string NG\0\001
# only value 0x100 found at offset 2
>2 ulelong 0x00000100 Norton Guide
@ -1022,7 +1106,7 @@
>>114 string >\0 %-.66s
# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
# of http://www.4dos.info/
# of https://www.4dos.info/
# pointer,HelpID[8]=4DHnnnmm
0 ulelong 0x48443408 4DOS help file
>4 string x \b, version %-4.4s
@ -1098,7 +1182,7 @@
!:mime application/vnd.ms-cab-compressed
!:ext cab
# http://support.microsoft.com/kb/934307/en-US
# https://support.microsoft.com/kb/934307/en-US
# All inspected MSU contain a file with name WSUSSCAN.cab
# that is called "Windows Update meta data" by Microsoft
>>>&-1 string/c wsusscan.cab \b, Microsoft Standalone Update
@ -1119,7 +1203,7 @@
# or Windows 8 Desktop Theme Pack like in PanoramicGlaciers.deskthemepack
>>>>>&0 string/c theme \b, Windows
!:mime application/x-windows-themepack
# http://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8
# https://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8
# 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack
# with MTSM=RJSPBS in [MasterThemeSelector] inside *.theme
>>>>>>(16.l+16) string =Panoram 8
@ -1329,7 +1413,7 @@
>>48 string x version %.3s
# Type: Microsoft Document Imaging Format (.mdi)
# URL: http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
# URL: https://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
# From: Daniele Sempione <scrows@oziosi.org>
# Too weak (EP)
#0 short 0x5045 Microsoft Document Imaging Format
@ -1343,10 +1427,6 @@
# From: Dr. Jesus <j@hug.gs>
0 string/b B000FF\n Windows Embedded CE binary image
# Windows Imaging (WIM) Image
0 string/b MSWIM\000\000\000 Windows imaging (WIM) image
0 string/b WLPWM\000\000\000 Windows imaging (WIM) image, wimlib pipable format
# The second byte of these signatures is a file version; I don't know what,
# if anything, produced files with version numbers 0-2.
# From: John Elliott <johne@seasip.demon.co.uk>

13
contrib/file/magic/Magdir/msooxml
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: msooxml,v 1.8 2018/05/24 18:11:17 christos Exp $
# $File: msooxml,v 1.12 2019/04/19 00:42:27 christos Exp $
# msooxml: file(1) magic for Microsoft Office XML
# From: Ralf Brown <ralf.brown@gmail.com>
@ -25,20 +25,21 @@
!:strength +10
# make sure the first file is correct
>0x1E use msooxml
>0x1E regex \\[Content_Types\\]\\.xml|_rels/\\.rels
>0x1E regex \\[Content_Types\\]\\.xml|_rels/\\.rels|docProps
# skip to the second local file header
# since some documents include a 520-byte extra field following the file
# header, we need to scan for the next header
>>(18.l+49) search/2000 PK\003\004
>>(18.l+49) search/6000 PK\003\004
# now skip to the *third* local file header; again, we need to scan due to a
# 520-byte extra field following the file header
>>>&26 search/1000 PK\003\004
>>>&26 search/6000 PK\003\004
# and check the subdirectory name to determine which type of OOXML
# file we have. Correct the mimetype with the registered ones:
# http://technet.microsoft.com/en-us/library/cc179224.aspx
# https://technet.microsoft.com/en-us/library/cc179224.aspx
>>>>&26 use msooxml
>>>>&26 default x
# OpenOffice/Libreoffice orders ZIP entry differently, so check the 4th file
>>>>>&26 search/1000 PK\003\004
>>>>>&26 search/6000 PK\003\004
>>>>>>&26 use msooxml
>>>>>>&26 default x Microsoft OOXML
>>>>>&26 default x Microsoft OOXML

4
contrib/file/magic/Magdir/msvc
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: msvc,v 1.9 2017/08/02 08:15:20 christos Exp $
# $File: msvc,v 1.10 2018/10/01 19:14:03 christos Exp $
# msvc: file(1) magic for msvc
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Microsoft visual C
@ -55,7 +55,7 @@
>>>0x32 leshort x \b*%d bytes
# Reference: https://github.com/Microsoft/vstest/pull/856/commits/fdc7a9f074ca5a8dfeec83b1be9162bf0cf4000d
0 string/c bsjb\001\000\001\000\000\000\000\000\f\000\000\000pdb\ v1.0 Microsoft Rosyln C# debugging symbols version 1.0
0 string/c bsjb\001\000\001\000\000\000\000\000\f\000\000\000pdb\ v1.0 Microsoft Roslyn C# debugging symbols version 1.0
#.sbr
0 string \000\002\000\007\000 MSVC .sbr

4
contrib/file/magic/Magdir/neko
View file

@ -1,9 +1,9 @@
#------------------------------------------------------------
# $File: neko,v 1.1 2009/11/10 20:36:10 christos Exp $
# $File: neko,v 1.2 2019/04/19 00:42:27 christos Exp $
# From: Mikhail Gusarov <dottedmag@dottedmag.net>
# NekoVM (http://nekovm.org/) bytecode
# NekoVM (https://nekovm.org/) bytecode
0 string NEKO NekoVM bytecode
>4 lelong x (%d global symbols,
>8 lelong x %d global fields,

264
contrib/file/magic/Magdir/netbsd
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: netbsd,v 1.25 2017/09/28 02:37:47 christos Exp $
# $File: netbsd,v 1.26 2019/01/01 03:11:23 christos Exp $
# netbsd: file(1) magic for NetBSD objects
#
# All new-style magic numbers are in network byte order.
@ -9,184 +9,149 @@
# in aout.
#
0 belong&0377777777 041400413 a.out NetBSD/i386 demand paged
0 name netbsd-detail
>20 lelong x @%#x
>4 lelong >0 \b+T=%d
>8 lelong >0 \b+D=%d
>12 lelong >0 \b+B=%d
>16 lelong >0 \b+S=%d
>24 lelong >0 \b+TR=%d
>28 lelong >0 \b+TD=%d
0 name netbsd-4096
>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
0 belong&0377777777 041400410 a.out NetBSD/i386 pure
>0 byte &0x80 dynamically linked executable
0 name netbsd-8192
>0 byte &0x80
>>20 lelong <8192 shared library
>>20 lelong =8192 dynamically linked executable
>>20 lelong >8192 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
0 belong&0377777777 041400407 a.out NetBSD/i386
>0 use netbsd-detail
0 name netbsd-normal
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 lelong !0 executable
>>20 lelong =0 object file
>16 lelong >0 not stripped
0 belong&0377777777 041400507 a.out NetBSD/i386 core
>0 use netbsd-detail
0 name netbsd-pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
>0 use netbsd-detail
0 name netbsd-core
>12 string >\0 from '%s'
>32 lelong !0 (signal %d)
0 belong&0377777777 041400413 a.out NetBSD/i386 demand paged
>0 use netbsd-4096
0 belong&0377777777 041400410 a.out NetBSD/i386 pure
>0 use netbsd-pure
0 belong&0377777777 041400407 a.out NetBSD/i386
>0 use netbsd-normal
0 belong&0377777777 041400507 a.out NetBSD/i386 core
>0 use netbsd-core
0 belong&0377777777 041600413 a.out NetBSD/m68k demand paged
>0 byte &0x80
>>20 belong <8192 shared library
>>20 belong =8192 dynamically linked executable
>>20 belong >8192 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
>0 use \^netbsd-8192
0 belong&0377777777 041600410 a.out NetBSD/m68k pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
>0 use \^netbsd-pure
0 belong&0377777777 041600407 a.out NetBSD/m68k
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 belong !0 executable
>>20 belong =0 object file
>16 belong >0 not stripped
>0 use \^netbsd-normal
0 belong&0377777777 041600507 a.out NetBSD/m68k core
>12 string >\0 from '%s'
>32 belong !0 (signal %d)
>0 use \^netbsd-core
0 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
>>20 belong >4096 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
>0 use \^netbsd-4096
0 belong&0377777777 042000410 a.out NetBSD/m68k4k pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
>0 use \^netbsd-pure
0 belong&0377777777 042000407 a.out NetBSD/m68k4k
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 belong !0 executable
>>20 belong =0 object file
>16 belong >0 not stripped
>0 use \^netbsd-normal
0 belong&0377777777 042000507 a.out NetBSD/m68k4k core
>12 string >\0 from '%s'
>32 belong !0 (signal %d)
>0 use \^netbsd-core
0 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged
>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
>0 use netbsd-4096
0 belong&0377777777 042200410 a.out NetBSD/ns32532 pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
>0 use netbsd-pure
0 belong&0377777777 042200407 a.out NetBSD/ns32532
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 lelong !0 executable
>>20 lelong =0 object file
>16 lelong >0 not stripped
>0 use netbsd-normal
0 belong&0377777777 042200507 a.out NetBSD/ns32532 core
>12 string >\0 from '%s'
>32 lelong !0 (signal %d)
>0 use netbsd-core
0 belong&0377777777 045200507 a.out NetBSD/powerpc core
>12 string >\0 from '%s'
>0 use netbsd-core
0 belong&0377777777 042400413 a.out NetBSD/SPARC demand paged
>0 byte &0x80
>>20 belong <8192 shared library
>>20 belong =8192 dynamically linked executable
>>20 belong >8192 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
>0 use \^netbsd-8192
0 belong&0377777777 042400410 a.out NetBSD/SPARC pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
>0 use \^netbsd-pure
0 belong&0377777777 042400407 a.out NetBSD/SPARC
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 belong !0 executable
>>20 belong =0 object file
>16 belong >0 not stripped
>0 use \^netbsd-normal
0 belong&0377777777 042400507 a.out NetBSD/SPARC core
>12 string >\0 from '%s'
>32 belong !0 (signal %d)
>0 use \^netbsd-core
0 belong&0377777777 042600413 a.out NetBSD/pmax demand paged
>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
>0 use netbsd-4096
0 belong&0377777777 042600410 a.out NetBSD/pmax pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
>0 use \^netbsd-pure
0 belong&0377777777 042600407 a.out NetBSD/pmax
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 lelong !0 executable
>>20 lelong =0 object file
>16 lelong >0 not stripped
>0 use netbsd-normal
0 belong&0377777777 042600507 a.out NetBSD/pmax core
>12 string >\0 from '%s'
>32 lelong !0 (signal %d)
>0 use netbsd-core
0 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged
>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
>0 use netbsd-4096
0 belong&0377777777 043000410 a.out NetBSD/vax 1k pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
>0 use netbsd-pure
0 belong&0377777777 043000407 a.out NetBSD/vax 1k
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 lelong !0 executable
>>20 lelong =0 object file
>16 lelong >0 not stripped
>0 use netbsd-normal
0 belong&0377777777 043000507 a.out NetBSD/vax 1k core
>12 string >\0 from '%s'
>32 lelong !0 (signal %d)
>0 use netbsd-core
0 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged
>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
>0 use netbsd-4096
0 belong&0377777777 045400410 a.out NetBSD/vax 4k pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
>0 use netbsd-pure
0 belong&0377777777 045400407 a.out NetBSD/vax 4k
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 lelong !0 executable
>>20 lelong =0 object file
>16 lelong >0 not stripped
>0 use netbsd-normal
0 belong&0377777777 045400507 a.out NetBSD/vax 4k core
>12 string >\0 from '%s'
>32 lelong !0 (signal %d)
>0 use netbsd-core
# NetBSD/alpha does not support (and has never supported) a.out objects,
# so no rules are provided for them. NetBSD/alpha ELF objects are
@ -199,50 +164,31 @@
>32 lelong !0 (signal %d)
0 belong&0377777777 043400413 a.out NetBSD/mips demand paged
>0 byte &0x80
>>20 belong <8192 shared library
>>20 belong =8192 dynamically linked executable
>>20 belong >8192 dynamically linked executable
>0 byte ^0x80 executable
>0 use \^netbsd-8192
>16 belong >0 not stripped
0 belong&0377777777 043400410 a.out NetBSD/mips pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
>0 use netbsd-pure
0 belong&0377777777 043400407 a.out NetBSD/mips
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 belong !0 executable
>>20 belong =0 object file
>16 belong >0 not stripped
>0 use netbsd-normal
0 belong&0377777777 043400507 a.out NetBSD/mips core
>12 string >\0 from '%s'
>32 belong !0 (signal %d)
>0 use netbsd-core
0 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged
>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
>0 use netbsd-4096
0 belong&0377777777 043600410 a.out NetBSD/arm32 pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
>0 use netbsd-pure
0 belong&0377777777 043600407 a.out NetBSD/arm32
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 lelong !0 executable
>>20 lelong =0 object file
>16 lelong >0 not stripped
>0 use netbsd-normal
# NetBSD/arm26 has always used ELF objects, but it shares a core file
# format with NetBSD/arm32.
0 belong&0377777777 043600507 a.out NetBSD/arm core
>12 string >\0 from '%s'
>32 lelong !0 (signal %d)
>0 use netbsd-core
# Kernel core dump format
0 belong&0x0000ffff 0x00008fca NetBSD kernel core file

4
contrib/file/magic/Magdir/nitpicker
View file

@ -1,8 +1,8 @@
#------------------------------------------------------------------------------
# $File: nitpicker,v 1.7 2017/03/17 21:35:28 christos Exp $
# $File: nitpicker,v 1.8 2019/04/19 00:42:27 christos Exp $
# nitpicker: file(1) magic for Flowfiles.
# From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de
# From: Christian Jachmann <C.Jachmann@gmx.net> https://www.nitpicker.de
0 string NPFF NItpicker Flow File
>4 byte x V%d.
>5 byte x %d

9
contrib/file/magic/Magdir/numpy Normal file
View file

@ -0,0 +1,9 @@
#------------------------------------------------------------------------------
# $File: numpy,v 1.1 2019/05/09 16:24:36 christos Exp $
# numpy: file(1) magic for NumPy array binary serialization format
# Reference: https://docs.scipy.org/doc/numpy/reference/generated/numpy.lib.format.html
0 string \x93NUMPY NumPy array,
>6 ubyte x version %d
>7 ubyte x \b.%d,
>8 uleshort x header length %d

4
contrib/file/magic/Magdir/ole2compounddocs
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: ole2compounddocs,v 1.5 2017/10/27 21:43:23 christos Exp $
# $File: ole2compounddocs,v 1.6 2019/04/19 00:42:27 christos Exp $
# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
# Additional tests for OLE 2 Compound Documents should be under this recipe.
@ -15,7 +15,7 @@
# Note: moved & merged Microsoft Office parts from ./msdos Oct 2017
# Update: Joerg Jenderek
# from http://filext.com by Derek M Jones <derek@knosof.co.uk>
# from https://filext.com by Derek M Jones <derek@knosof.co.uk>
# False positive with PPT (also currently this string is too long)
#0 string/b \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer
#0 string/b \320\317\021\340\241\261\032\341 Microsoft Office Document

6
contrib/file/magic/Magdir/palm
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: palm,v 1.13 2014/03/30 21:40:08 christos Exp $
# $File: palm,v 1.14 2019/04/19 00:42:27 christos Exp $
# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
#
# Brian Lalor <blalor@hcirisc.cs.binghamton.edu>
@ -143,8 +143,8 @@
# Palm OS .prc file types
60 string libr
# flags, only bit 0 or bit 6
# http://en.wikipedia.org/wiki/PRC_%28Palm_OS%29
# http://web.mit.edu/tytso/www/pilot/prc-format.html
# https://en.wikipedia.org/wiki/PRC_%28Palm_OS%29
# https://web.mit.edu/tytso/www/pilot/prc-format.html
>0x20 beshort&0xffbe 0
>>0 string >\0 Palm OS dynamic library data "%s"
60 string ptch Palm OS operating system patch data

4
contrib/file/magic/Magdir/parrot
View file

@ -1,7 +1,7 @@
#------------------------------------------------------------------------------
# $File: parrot,v 1.1 2010/07/08 20:18:40 christos Exp $
# $File: parrot,v 1.2 2019/04/19 00:42:27 christos Exp $
# parrot: file(1) magic for Parrot Virtual Machine
# URL: http://www.lua.org/
# URL: https://www.lua.org/
# From: Lubomir Rintel <lkundrak@v3.sk>
# Compiled Parrot byte code

Some files were not shown because too many files have changed in this diff Show more