diff --git a/contrib/file/AUTHORS b/contrib/file/AUTHORS index 3d3d34a0af6a..bac5d5bcc950 100644 --- a/contrib/file/AUTHORS +++ b/contrib/file/AUTHORS @@ -1 +1 @@ -See COPYING. \ No newline at end of file +See COPYING. diff --git a/contrib/file/COPYING b/contrib/file/COPYING index b3db8b23fbf3..16410a17f2f5 100644 --- a/contrib/file/COPYING +++ b/contrib/file/COPYING @@ -1,4 +1,4 @@ -$File: COPYING,v 1.1 2008/02/05 19:08:11 christos Exp $ +$File: COPYING,v 1.2 2018/09/09 20:33:28 christos Exp $ Copyright (c) Ian F. Darwin 1986, 1987, 1989, 1990, 1991, 1992, 1994, 1995. Software written by Ian F. Darwin and others; maintained 1994- Christos Zoulas. @@ -15,7 +15,7 @@ are met: 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - + THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE diff --git a/contrib/file/ChangeLog b/contrib/file/ChangeLog index 4923bc3c163e..482a5f7c2de4 100644 --- a/contrib/file/ChangeLog +++ b/contrib/file/ChangeLog @@ -1,3 +1,75 @@ +2019-05-14 22:26 Christos Zoulas + + * release 5.37 + +2019-05-09 22:27 Christos Zoulas + + * Make sure that continuation separators are printed + with -k within softmagic + +2019-05-06 22:27 Christos Zoulas + + * Change SIGPIPE saving and restoring during compression to use + sigaction(2) instead of signal(3) and cache it. (Denys Vlasenko) + * Cache stat(2) calls more to reduce number of calls (Denys Vlasenko) + +2019-05-06 17:25 Christos Zoulas + + * PR/77: Handle --mime-type and -k correctly. + +2019-05-03 15:26 Christos Zoulas + + * Switch decompression code to use vfork() because + tools like rpmdiff and rpmbuild call libmagic + with large process footprints (Denys Vlasenko) + +2019-04-07 14:05 Christos Zoulas + + * PR/75: --enable-zlib, did not work. + +2019-02-27 11:54 Christos Zoulas + + * Improve regex efficiency (Michael Schroeder) by: + 1. Prefixing regex searches with regular search + for keywords where possible + 2. Using memmem(3) where available + +2019-02-20 10:16 Christos Zoulas + + * release 5.36 + +2019-02-19 15:30 Christos Zoulas + + * Fix cast to use cast macros + * Add UCS-32 builtin detection (PR/61) reported by tmc + +2019-02-18 18:24 Christos Zoulas + + * Fix stack read (PR/62) and write (PR/64) stack overflows + reported by spinpx + +2018-10-18 19:32 Christos Zoulas + + * release 5.35 + +2018-09-10 20:38 Christos Zoulas + + * Add FreeBSD ELF core file support (John Baldwin) + +2018-08-20 18:40 Christos Zoulas + + * PR/30: Allow all parameter values to be set (don't treat 0 specially) + * handle default annotations on the softmagic match instead at the + end. + +2018-07-25 10:17 Christos Zoulas + + * PR/23: Recognize JSON files + +2018-07-25 10:17 Christos Zoulas + + * PR/18: file --mime-encoding should not print mime-type + 2018-07-25 8:50 Christos Zoulas * release 5.34 @@ -14,11 +86,11 @@ * release 5.33 -2018-02-24 14:50 Christos Zoulas +2018-02-24 14:50 Christos Zoulas * extend the support for ${x?:} expansions for magic descriptions -2018-02-21 16:25 Christos Zoulas +2018-02-21 16:25 Christos Zoulas * add support for ${x?:} in mime types to handle pie binaries. @@ -90,7 +162,7 @@ * Add missing overflow check in der magic (Jonas Wagner) 2016-10-25 10:40 Christos Zoulas - + * release 5.29 2016-10-24 11:20 Christos Zoulas @@ -131,11 +203,11 @@ - set offset to 0 on failure. 2016-05-13 12:00 Christos Zoulas - + * release 5.27 2016-04-18 9:35 Christos Zoulas - + * Errors comparing DER entries or computing offsets are just indications of malformed non-DER files. Don't print them. @@ -144,7 +216,7 @@ * Put new bytes constant in the right file (not the generated one) 2016-04-16 18:34 Christos Zoulas - + * release 5.26 2016-03-31 13:50 Christos Zoulas @@ -190,7 +262,7 @@ * PR/492: compression forking was broken with magic_buffer. 2015-09-16 9:50 Christos Zoulas - + * release 5.25 2015-09-11 13:25 Christos Zoulas @@ -218,7 +290,7 @@ * release 5.23 2015-06-09 16:10 Christos Zoulas - + * Fix issue with regex range for magic with offset * Always return true from mget with USE (success to mget not match indication). Fixes mime evaluation after USE magic @@ -271,12 +343,12 @@ * add indirect relative for TIFF/Exif 2014-12-16 18:10 Christos Zoulas - + * restructure elf note printing to avoid repeated messages * add note limit, suggested by Alexander Cherepanov 2014-12-16 16:53 Christos Zoulas - + * Bail out on partial pread()'s (Alexander Cherepanov) * Fix incorrect bounds check in file_printable (Alexander Cherepanov) @@ -287,7 +359,7 @@ more places for safety * in ELF, instead of "(uses dynamic libraries)" when PT_INTERP is present print the interpreter name. - + 2014-12-10 20:01 Christos Zoulas * release 5.21 @@ -330,7 +402,7 @@ on a byte by byte basis, so that we don't get issues with locale's trying to interpret random byte streams as UTF-8 and having printf error out with EILSEQ. - + 2014-10-17 11:48 Christos Zoulas * fix bounds in note reading (Francisco Alonso / Red Hat) @@ -361,7 +433,7 @@ * release 5.19 2014-06-09 9:04 Christos Zoulas - + * Misc buffer overruns and missing buffer size tests in cdf parsing (Francisco Alonso, Jan Kaluza) @@ -391,7 +463,7 @@ 2014-05-04 14:55 Christos Zoulas - * PR/351: Fix compilation of empty files + * PR/351: Fix compilation of empty files 2014-04-30 17:39 Christos Zoulas @@ -495,7 +567,7 @@ * Don't treat magic as an error if offset was past EOF (Christoph Biedl) 2013-05-28 17:25 Christos Zoulas - + * Fix spacing issues in softmagic and elf (Jan Kaluza) 2013-05-02 18:00 Christos Zoulas @@ -551,7 +623,7 @@ * Make getline public so that file can link against it. Perhaps it is better to rename it, or hide it differently. Fixes builds on platforms that do not provide it. - + 2013-01-07 16:30 Christos Zoulas * Add SuS d{,1,2,4,8}, u{,1,2,4,8} and document @@ -901,7 +973,7 @@ (Cheng Renquan) 2009-05-08 13:40 Christos Zoulas - + * lint fixes and more from NetBSD 2009-05-06 10:25 Christos Zoulas @@ -921,7 +993,7 @@ 2009-03-27 18:43 Christos Zoulas - * don't print \012- separators in the same magic entry + * don't print \012- separators in the same magic entry if it consists of multiple magic printing lines. 2009-03-23 10:20 Christos Zoulas diff --git a/contrib/file/NEWS b/contrib/file/NEWS index 939a2790ecc9..898a3dab3470 100644 --- a/contrib/file/NEWS +++ b/contrib/file/NEWS @@ -1 +1 @@ -See ChangeLog. \ No newline at end of file +See ChangeLog. diff --git a/contrib/file/README b/contrib/file/README index f57a76dbda3b..bb29a4640b73 100644 --- a/contrib/file/README +++ b/contrib/file/README @@ -1,6 +1,6 @@ -## README for file(1) Command ## +## README for file(1) Command and the libmagic(3) library ## - @(#) $File: README,v 1.54 2018/05/30 03:06:56 christos Exp $ + @(#) $File: README,v 1.57 2019/02/06 00:20:56 christos Exp $ Mailing List: file@astron.com Mailing List archives: http://mailman.astron.com/pipermail/file/ @@ -63,53 +63,54 @@ magic numbers assigned to all sorts of data files that are in reasonable circulation. Send your magic numbers, in magic(5) format please, to the maintainer, Christos Zoulas. -COPYING - read this first. -README - read this second (you are currently reading this file). +COPYING - read this first. +README - read this second (you are currently reading this file). INSTALL - read on how to install -src/apprentice.c - parses /etc/magic to learn magic -src/apptype.c - used for OS/2 specific application type magic -src/ascmagic.c - third & last set of tests, based on hardwired assumptions. -src/asctime_r.c - replacement for OS's that don't have it. -src/asprintf.c - replacement for OS's that don't have it. -src/asctime_r.c - replacement for OS's that don't have it. -src/asprintf.c - replacement for OS's that don't have it. +src/apprentice.c - parses /etc/magic to learn magic +src/apptype.c - used for OS/2 specific application type magic +src/ascmagic.c - third & last set of tests, based on hardwired assumptions. +src/asctime_r.c - replacement for OS's that don't have it. +src/asprintf.c - replacement for OS's that don't have it. +src/asctime_r.c - replacement for OS's that don't have it. +src/asprintf.c - replacement for OS's that don't have it. src/buffer.c - buffer handling functions. -src/cdf.[ch] - parser for Microsoft Compound Document Files -src/cdf_time.c - time converter for CDF. -src/compress.c - handles decompressing files to look inside. -src/ctime_r.c - replacement for OS's that don't have it. +src/cdf.[ch] - parser for Microsoft Compound Document Files +src/cdf_time.c - time converter for CDF. +src/compress.c - handles decompressing files to look inside. +src/ctime_r.c - replacement for OS's that don't have it. src/der.[ch] - parser for Distinguished Encoding Rules src/dprintf.c - replacement for OS's that don't have it. src/elfclass.h - common code for elf 32/64. -src/encoding.c - handles unicode encodings -src/file.c - the main program -src/file.h - header file +src/encoding.c - handles unicode encodings +src/file.c - the main program +src/file.h - header file src/file_opts.h - list of options -src/fmtcheck.c - replacement for OS's that don't have it. -src/fsmagic.c - first set of tests the program runs, based on filesystem info -src/funcs.c - utilility functions -src/getline.c - replacement for OS's that don't have it. -src/getopt_long.c - replacement for OS's that don't have it. -src/gmtime_r.c - replacement for OS's that don't have it. -src/is_tar.c, tar.h - knows about Tape ARchive format (courtesy John Gilmore). -src/localtime_r.c - replacement for OS's that don't have it. +src/fmtcheck.c - replacement for OS's that don't have it. +src/fsmagic.c - first set of tests the program runs, based on filesystem info +src/funcs.c - utilility functions +src/getline.c - replacement for OS's that don't have it. +src/getopt_long.c - replacement for OS's that don't have it. +src/gmtime_r.c - replacement for OS's that don't have it. +src/is_json.c - knows about JavaScript Object Notation format (RFC 8259). +src/is_tar.c, tar.h - knows about Tape ARchive format (courtesy John Gilmore). +src/localtime_r.c - replacement for OS's that don't have it. src/magic.h.in - source file for magic.h -src/mygetopt.h - replacement for OS's that don't have it. -src/magic.c - the libmagic api -src/names.h - header file for ascmagic.c -src/pread.c - replacement for OS's that don't have it. -src/print.c - print results, errors, warnings. -src/readcdf.c - CDF wrapper. -src/readelf.[ch] - Stand-alone elf parsing code. -src/softmagic.c - 2nd set of tests, based on /etc/magic -src/mygetopt.h - replacement for OS's that don't have it. -src/strcasestr.c - replacement for OS's that don't have it. -src/strlcat.c - replacement for OS's that don't have it. -src/strlcpy.c - replacement for OS's that don't have it. -src/strndup.c - replacement for OS's that don't have it. +src/mygetopt.h - replacement for OS's that don't have it. +src/magic.c - the libmagic api +src/names.h - header file for ascmagic.c +src/pread.c - replacement for OS's that don't have it. +src/print.c - print results, errors, warnings. +src/readcdf.c - CDF wrapper. +src/readelf.[ch] - Stand-alone elf parsing code. +src/softmagic.c - 2nd set of tests, based on /etc/magic +src/mygetopt.h - replacement for OS's that don't have it. +src/strcasestr.c - replacement for OS's that don't have it. +src/strlcat.c - replacement for OS's that don't have it. +src/strlcpy.c - replacement for OS's that don't have it. +src/strndup.c - replacement for OS's that don't have it. src/tar.h - tar file definitions -src/vasprintf.c - for systems that don't have it. -doc/file.man - man page for the command +src/vasprintf.c - for systems that don't have it. +doc/file.man - man page for the command doc/magic.man - man page for the magic file, courtesy Guy Harris. Install as magic.4 on USG and magic.5 on V7 or Berkeley; cf Makefile. diff --git a/contrib/file/config.h.in b/contrib/file/config.h.in index 3c8ffa3b0250..97ed41c0e2bf 100644 --- a/contrib/file/config.h.in +++ b/contrib/file/config.h.in @@ -83,12 +83,6 @@ /* Define to 1 if you have the `z' library (-lz). */ #undef HAVE_LIBZ -/* Define to 1 if you have the header file. */ -#undef HAVE_LIMITS_H - -/* Define to 1 if you have the header file. */ -#undef HAVE_LOCALE_H - /* Define to 1 if you have the `localtime_r' function. */ #undef HAVE_LOCALTIME_R @@ -98,6 +92,9 @@ /* Define to 1 if declares mbstate_t. */ #undef HAVE_MBSTATE_T +/* Define to 1 if you have the `memmem' function. */ +#undef HAVE_MEMMEM + /* Define to 1 if you have the header file. */ #undef HAVE_MEMORY_H @@ -116,18 +113,9 @@ /* Define to 1 if you have the `pread' function. */ #undef HAVE_PREAD -/* Define to 1 if you have the `setlocale' function. */ -#undef HAVE_SETLOCALE - -/* Define to 1 if you have the header file. */ -#undef HAVE_SIGNAL_H - /* Have sig_t type */ #undef HAVE_SIG_T -/* Define to 1 if you have the header file. */ -#undef HAVE_STDDEF_H - /* Define to 1 if you have the header file. */ #undef HAVE_STDINT_H @@ -137,9 +125,6 @@ /* Define to 1 if you have the `strcasestr' function. */ #undef HAVE_STRCASESTR -/* Define to 1 if you have the `strerror' function. */ -#undef HAVE_STRERROR - /* Define to 1 if you have the header file. */ #undef HAVE_STRINGS_H @@ -158,9 +143,6 @@ /* Define to 1 if you have the `strtof' function. */ #undef HAVE_STRTOF -/* Define to 1 if you have the `strtoul' function. */ -#undef HAVE_STRTOUL - /* HAVE_STRUCT_OPTION */ #undef HAVE_STRUCT_OPTION @@ -182,6 +164,9 @@ /* Define to 1 if you have the header file. */ #undef HAVE_SYS_STAT_H +/* Define to 1 if you have the header file. */ +#undef HAVE_SYS_SYSMACROS_H + /* Define to 1 if you have the header file. */ #undef HAVE_SYS_TIME_H diff --git a/contrib/file/configure b/contrib/file/configure index 436a9460a043..a26523061fd6 100755 --- a/contrib/file/configure +++ b/contrib/file/configure @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.69 for file 5.34. +# Generated by GNU Autoconf 2.69 for file 5.37. # # Report bugs to . # @@ -590,8 +590,8 @@ MAKEFLAGS= # Identity of this package. PACKAGE_NAME='file' PACKAGE_TARNAME='file' -PACKAGE_VERSION='5.34' -PACKAGE_STRING='file 5.34' +PACKAGE_VERSION='5.37' +PACKAGE_STRING='file 5.37' PACKAGE_BUGREPORT='christos@astron.com' PACKAGE_URL='' @@ -1329,7 +1329,7 @@ if test "$ac_init_help" = "long"; then # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures file 5.34 to adapt to many kinds of systems. +\`configure' configures file 5.37 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1399,7 +1399,7 @@ fi if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of file 5.34:";; + short | recursive ) echo "Configuration of file 5.37:";; esac cat <<\_ACEOF @@ -1511,7 +1511,7 @@ fi test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -file configure 5.34 +file configure 5.37 generated by GNU Autoconf 2.69 Copyright (C) 2012 Free Software Foundation, Inc. @@ -2167,7 +2167,7 @@ cat >config.log <<_ACEOF This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by file $as_me 5.34, which was +It was created by file $as_me 5.37, which was generated by GNU Autoconf 2.69. Invocation command line was $ $0 $@ @@ -3033,7 +3033,7 @@ fi # Define the identity of the package. PACKAGE='file' - VERSION='5.34' + VERSION='5.37' cat >>confdefs.h <<_ACEOF @@ -12784,7 +12784,7 @@ $as_echo "#define HAVE_SYS_WAIT_H 1" >>confdefs.h fi -for ac_header in stdint.h fcntl.h locale.h stdint.h inttypes.h unistd.h +for ac_header in stdint.h fcntl.h inttypes.h unistd.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" @@ -12797,7 +12797,7 @@ fi done -for ac_header in stddef.h utime.h wchar.h wctype.h limits.h +for ac_header in utime.h wchar.h wctype.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" @@ -12810,7 +12810,7 @@ fi done -for ac_header in getopt.h err.h xlocale.h signal.h +for ac_header in getopt.h err.h xlocale.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" @@ -12823,7 +12823,7 @@ fi done -for ac_header in sys/mman.h sys/stat.h sys/types.h sys/utime.h sys/time.h +for ac_header in sys/mman.h sys/stat.h sys/types.h sys/utime.h sys/time.h sys/sysmacros.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" @@ -12850,10 +12850,7 @@ fi done fi -ac_fn_c_check_type "$LINENO" "sig_t" "ac_cv_type_sig_t" " -#ifdef HAVE_SIGNAL_H -#include -#endif +ac_fn_c_check_type "$LINENO" "sig_t" "ac_cv_type_sig_t" "#include " if test "x$ac_cv_type_sig_t" = xyes; then : @@ -12976,7 +12973,8 @@ _ACEOF fi -ac_fn_c_check_member "$LINENO" "struct tm" "tm_gmtoff" "ac_cv_member_struct_tm_tm_gmtoff" "$ac_includes_default" +ac_fn_c_check_member "$LINENO" "struct tm" "tm_gmtoff" "ac_cv_member_struct_tm_tm_gmtoff" "#include +" if test "x$ac_cv_member_struct_tm_tm_gmtoff" = xyes; then : cat >>confdefs.h <<_ACEOF @@ -14229,7 +14227,7 @@ fi fi -for ac_func in strerror strndup strtoul mkstemp mkostemp utimes utime wcwidth strtof newlocale uselocale freelocale setlocale +for ac_func in strndup mkstemp mkostemp utimes utime wcwidth strtof newlocale uselocale freelocale memmem do : as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh` ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var" @@ -14583,7 +14581,8 @@ if test "$enable_zlib" = "yes"; then if test "$ac_cv_header_zlib_h$ac_cv_lib_z_gzopen" != "yesyes"; then as_fn_error $? "zlib support requested but not found" "$LINENO" 5 fi -elif test "$ac_cv_header_zlib_h$ac_cv_lib_z_gzopen" = "yesyes"; then +fi +if test "$ac_cv_header_zlib_h$ac_cv_lib_z_gzopen" = "yesyes"; then $as_echo "#define ZLIBSUPPORT 1" >>confdefs.h @@ -15134,7 +15133,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by file $as_me 5.34, which was +This file was extended by file $as_me 5.37, which was generated by GNU Autoconf 2.69. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -15200,7 +15199,7 @@ _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ -file config.status 5.34 +file config.status 5.37 configured by $0, generated by GNU Autoconf 2.69, with options \\"\$ac_cs_config\\" diff --git a/contrib/file/configure.ac b/contrib/file/configure.ac index ab4f6fc21cf4..7da62aa26987 100644 --- a/contrib/file/configure.ac +++ b/contrib/file/configure.ac @@ -1,5 +1,5 @@ dnl Process this file with autoconf to produce a configure script. -AC_INIT([file],[5.34],[christos@astron.com]) +AC_INIT([file],[5.37],[christos@astron.com]) AM_INIT_AUTOMAKE([subdir-objects foreign]) m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])]) @@ -35,12 +35,12 @@ fi], [ ]) AC_MSG_CHECKING(for zlib support) -AC_ARG_ENABLE(zlib, +AC_ARG_ENABLE([zlib], [AS_HELP_STRING([--disable-zlib], [disable zlib compression support @<:@default=auto@:>@])]) AC_MSG_RESULT($enable_zlib) AC_MSG_CHECKING(for libseccomp support) -AC_ARG_ENABLE(libseccomp, +AC_ARG_ENABLE([libseccomp], [AS_HELP_STRING([--disable-libseccomp], [disable libseccomp sandboxing @<:@default=auto@:>@])]) AC_MSG_RESULT($enable_libseccomp) @@ -90,17 +90,14 @@ dnl Checks for headers AC_HEADER_STDC AC_HEADER_MAJOR AC_HEADER_SYS_WAIT -AC_CHECK_HEADERS(stdint.h fcntl.h locale.h stdint.h inttypes.h unistd.h) -AC_CHECK_HEADERS(stddef.h utime.h wchar.h wctype.h limits.h) -AC_CHECK_HEADERS(getopt.h err.h xlocale.h signal.h) -AC_CHECK_HEADERS(sys/mman.h sys/stat.h sys/types.h sys/utime.h sys/time.h) +AC_CHECK_HEADERS(stdint.h fcntl.h inttypes.h unistd.h) +AC_CHECK_HEADERS(utime.h wchar.h wctype.h) +AC_CHECK_HEADERS(getopt.h err.h xlocale.h) +AC_CHECK_HEADERS(sys/mman.h sys/stat.h sys/types.h sys/utime.h sys/time.h sys/sysmacros.h) if test "$enable_zlib" != "no"; then AC_CHECK_HEADERS(zlib.h) fi -AC_CHECK_TYPE([sig_t],[AC_DEFINE([HAVE_SIG_T],1,[Have sig_t type])],,[ -#ifdef HAVE_SIGNAL_H -#include -#endif]) +AC_CHECK_TYPE([sig_t],[AC_DEFINE([HAVE_SIG_T],1,[Have sig_t type])],,[#include ]) dnl Checks for typedefs, structures, and compiler characteristics. AC_C_CONST @@ -108,7 +105,7 @@ AC_TYPE_OFF_T AC_TYPE_SIZE_T AC_CHECK_MEMBERS([struct stat.st_rdev]) -AC_CHECK_MEMBERS([struct tm.tm_gmtoff]) +AC_CHECK_MEMBERS([struct tm.tm_gmtoff],,,[#include ]) AC_STRUCT_TIMEZONE AC_STRUCT_TIMEZONE_DAYLIGHT AC_SYS_LARGEFILE @@ -154,7 +151,7 @@ else fi]) dnl Checks for functions -AC_CHECK_FUNCS(strerror strndup strtoul mkstemp mkostemp utimes utime wcwidth strtof newlocale uselocale freelocale setlocale) +AC_CHECK_FUNCS(strndup mkstemp mkostemp utimes utime wcwidth strtof newlocale uselocale freelocale memmem) dnl Provide implementation of some required functions if necessary AC_REPLACE_FUNCS(getopt_long asprintf vasprintf strlcpy strlcat getline ctime_r asctime_r localtime_r gmtime_r pread strcasestr fmtcheck dprintf) @@ -178,7 +175,8 @@ if test "$enable_zlib" = "yes"; then if test "$ac_cv_header_zlib_h$ac_cv_lib_z_gzopen" != "yesyes"; then AC_MSG_ERROR([zlib support requested but not found]) fi -elif test "$ac_cv_header_zlib_h$ac_cv_lib_z_gzopen" = "yesyes"; then +fi +if test "$ac_cv_header_zlib_h$ac_cv_lib_z_gzopen" = "yesyes"; then AC_DEFINE([ZLIBSUPPORT], 1, [Enable zlib compression support]) fi diff --git a/contrib/file/doc/file.man b/contrib/file/doc/file.man index 00909db73a1e..824310c2e072 100644 --- a/contrib/file/doc/file.man +++ b/contrib/file/doc/file.man @@ -1,5 +1,5 @@ -.\" $File: file.man,v 1.131 2018/07/24 21:33:56 christos Exp $ -.Dd July 25, 2018 +.\" $File: file.man,v 1.135 2019/03/03 02:32:40 christos Exp $ +.Dd February 18, 2019 .Dt FILE __CSECTION__ .Os .Sh NAME @@ -159,7 +159,7 @@ two groups, so they are performed last. The language test routines also test for some miscellany (such as .Xr tar 1 -archives). +archives, JSON files). .Pp Any file that cannot be identified as having been written in any of the character sets listed above is simply said to be @@ -171,6 +171,8 @@ Causes the file command to output the file type and creator code as used by older MacOS versions. The code consists of eight letters, the first describing the file type, the latter the creator. +This option works properly only for file formats that have the +apple-style output defined. .It Fl b , Fl Fl brief Do not prepend filenames to output lines (brief mode). .It Fl C , Fl Fl compile @@ -213,6 +215,8 @@ Checks for, and looks inside, compressed files. .It elf Prints ELF file details, provided soft magic tests are enabled and the elf magic is found. +.It json +Examines JSON (RFC-7159) files by parsing them for compliance. .It soft Consults magic files. .It tar @@ -629,11 +633,11 @@ were written by John Gilmore from his public-domain program, and are not covered by the above license. .Sh BUGS Please report bugs and send patches to the bug tracker at -.Pa http://bugs.astron.com/ +.Pa https://bugs.astron.com/ or the mailing list at .Aq file@astron.com (visit -.Pa http://mailman.astron.com/mailman/listinfo/file +.Pa https://mailman.astron.com/mailman/listinfo/file first to subscribe). .Sh TODO Fix output so that tests for MIME and APPLE flags are not needed all diff --git a/contrib/file/doc/libmagic.man b/contrib/file/doc/libmagic.man index 4c7e42ff4f9c..086f0659f113 100644 --- a/contrib/file/doc/libmagic.man +++ b/contrib/file/doc/libmagic.man @@ -1,6 +1,6 @@ -.\" $File: libmagic.man,v 1.41 2017/05/23 21:54:07 christos Exp $ +.\" $File: libmagic.man,v 1.44 2018/09/09 20:33:28 christos Exp $ .\" -.\" Copyright (c) Christos Zoulas 2003. +.\" Copyright (c) Christos Zoulas 2003, 2018. .\" All Rights Reserved. .\" .\" Redistribution and use in source and binary forms, with or without @@ -25,7 +25,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd May 23, 2017 +.Dd August 18, 2018 .Dt LIBMAGIC 3 .Os .Sh NAME @@ -159,6 +159,8 @@ Don't examine tar files. Don't check for various types of text files. .It Dv MAGIC_NO_CHECK_TOKENS Don't look for known tokens inside ascii files. +.It Dv MAGIC_NO_CHECK_JSON +Don't example JSON files. .El .Pp The @@ -391,6 +393,19 @@ The compiled default magic database. .Sh SEE ALSO .Xr file __CSECTION__ , .Xr magic __FSECTION__ +.Sh BUGS +The results from +.Fn magic_buffer +and +.Fn magic_file +where the buffer and the file contain the same data +can produce different results, because in the +.Fn magic_file +case, the program can +.Xr lseek 2 +and +.Xr stat 2 +the file descriptor. .Sh AUTHORS .An M\(oans Rullg\(oard Initial libmagic implementation, and configuration. diff --git a/contrib/file/doc/magic.man b/contrib/file/doc/magic.man index 15165daa5eab..bc69604a3df5 100644 --- a/contrib/file/doc/magic.man +++ b/contrib/file/doc/magic.man @@ -1,6 +1,5 @@ -.It S2 -.\" $File: magic.man,v 1.93 2018/06/22 20:39:49 christos Exp $ -.Dd June 22, 2018 +.\" $File: magic.man,v 1.96 2019/01/21 14:56:53 christos Exp $ +.Dd January 21, 2019 .Dt MAGIC __FSECTION__ .Os .\" install as magic.4 on USG, magic.5 on V7, Berkeley and Linux systems. @@ -117,13 +116,13 @@ The following modifiers are supported: .It B A byte length (default). .It H -A 4 byte big endian length. -.It h A 2 byte big endian length. -.It L -A 4 byte little endian length. -.It l +.It h A 2 byte little endian length. +.It L +A 4 byte big endian length. +.It l +A 4 byte little endian length. .It J The length includes itself in its count. .El diff --git a/contrib/file/magic/Header b/contrib/file/magic/Header index 831122e27a80..345a50fb1e67 100644 --- a/contrib/file/magic/Header +++ b/contrib/file/magic/Header @@ -2,4 +2,4 @@ # Format is described in magic(files), where: # files is 5 on V7 and BSD, 4 on SV, and ?? on SVID. # Don't edit this file, edit /etc/magic or send your magic improvements -# to the maintainers, at file@mx.gw.com +# to the maintainers, at file@astron.com diff --git a/contrib/file/magic/Magdir/acorn b/contrib/file/magic/Magdir/acorn index c4debd0849fb..4aa34551a74b 100644 --- a/contrib/file/magic/Magdir/acorn +++ b/contrib/file/magic/Magdir/acorn @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: acorn,v 1.6 2017/10/19 16:40:37 christos Exp $ +# $File: acorn,v 1.7 2019/04/19 00:42:27 christos Exp $ # acorn: file(1) magic for files found on Acorn systems # @@ -83,7 +83,7 @@ # compression mode y (0 - 4) for GIF LZW with a maximum n bits # (y~n,0~12,1~13,2~14,3~15,4~16) >>>5 ulelong+12 x \b, LZW %u-bits compression -# http://www.filebase.org.uk/filetypes +# https://www.filebase.org.uk/filetypes # !Packdir compressed archive has three hexadecimal digits code 68E !:mime application/x-acorn-68E !:ext pkd/bin diff --git a/contrib/file/magic/Magdir/adventure b/contrib/file/magic/Magdir/adventure index 6fae85adfd40..bd7f863be28b 100644 --- a/contrib/file/magic/Magdir/adventure +++ b/contrib/file/magic/Magdir/adventure @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: adventure,v 1.17 2017/07/03 16:03:40 christos Exp $ +# $File: adventure,v 1.18 2019/04/19 00:42:27 christos Exp $ # adventure: file(1) magic for Adventure game files # # from Allen Garvin @@ -21,8 +21,8 @@ # Updated by Adam Buchbinder # #http://www.gnelson.demon.co.uk/zspec/sect11.html -#http://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt -#http://en.wikipedia.org/wiki/Z-machine +#https://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt +#https://en.wikipedia.org/wiki/Z-machine # The first byte is the Z-machine revision; it is always between 1 and 8. We # had false matches (for instance, inbig5.ocp from the Omega TeX extension as # well as an occasional MP3 file), so we sanity-check the version number. @@ -111,7 +111,7 @@ # Danny Milosavljevic # These are ADRIFT (adventure game standard) game files, extension .taf # Checked from source at (http://www.adrift.co/) and various taf files -# found at the Interactive Fiction Archive (http://ifarchive.org/) +# found at the Interactive Fiction Archive (https://ifarchive.org/) 0 belong 0x3C423FC9 >4 belong 0x6A87C2CF Adrift game file version >>8 belong 0x94453661 3.80 diff --git a/contrib/file/magic/Magdir/algol68 b/contrib/file/magic/Magdir/algol68 index a9aad46e1fc3..3675b840e3b6 100644 --- a/contrib/file/magic/Magdir/algol68 +++ b/contrib/file/magic/Magdir/algol68 @@ -1,17 +1,17 @@ #------------------------------------------------------------------------------ -# $File: algol68,v 1.2 2016/10/17 14:17:48 christos Exp $ +# $File: algol68,v 1.3 2018/10/19 01:04:21 christos Exp $ # algol68: file(1) magic for Algol 68 source # 0 search/8192 (input, Algol 68 source text !:mime text/x-Algol68 -0 regex \^PROC Algol 68 source text +0 regex/1024 \^PROC Algol 68 source text !:mime text/x-Algol68 -0 regex MODE[\t\ ] Algol 68 source text +0 regex/1024 \bMODE[\t\ ] Algol 68 source text !:mime text/x-Algol68 -0 regex REF[\t\ ] Algol 68 source text +0 regex/1024 \bREF[\t\ ] Algol 68 source text !:mime text/x-Algol68 -0 regex FLEX[\t\ ]\*\\[ Algol 68 source text +0 regex/1024 \bFLEX[\t\ ]\*\\[ Algol 68 source text !:mime text/x-Algol68 #0 regex [\t\ ]OD Algol 68 source text #!:mime text/x-Algol68 diff --git a/contrib/file/magic/Magdir/amigaos b/contrib/file/magic/Magdir/amigaos index d9330bd1493c..e719921ef39f 100644 --- a/contrib/file/magic/Magdir/amigaos +++ b/contrib/file/magic/Magdir/amigaos @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: amigaos,v 1.16 2017/03/17 21:35:28 christos Exp $ +# $File: amigaos,v 1.17 2018/10/16 18:57:19 christos Exp $ # amigaos: file(1) magic for AmigaOS binary formats: # @@ -66,3 +66,22 @@ # From: Przemek Kramarczyk 0 string .KEY AmigaDOS script 0 string .key AmigaDOS script + +# AMOS Basic file formats +# https://www.exotica.org.uk/wiki/AMOS_file_formats +0 string AMOS\040Basic\040 AMOS Basic source code +>11 byte =0x56 \b, tested +>11 byte =0x76 \b, untested +0 string AMOS\040Pro AMOS Basic source code +>11 byte =0x56 \b, tested +>11 byte =0x76 \b, untested +0 string AmSp AMOS Basic sprite bank +>4 beshort x \b, %d sprites +0 string AmIc AMOS Basic icon bank +>4 beshort x \b, %d icons +0 string AmBk AMOS Basic memory bank +>4 beshort x \b, bank number %d +>8 belong&0xFFFFFFF x \b, length %d +>12 regex .{8} \b, type %s +0 string AmBs AMOS Basic memory banks +>4 beshort x \b, %d banks diff --git a/contrib/file/magic/Magdir/android b/contrib/file/magic/Magdir/android index dca5c33482bf..a9cfb3575a1b 100644 --- a/contrib/file/magic/Magdir/android +++ b/contrib/file/magic/Magdir/android @@ -1,6 +1,6 @@ #------------------------------------------------------------ -# $File: android,v 1.10 2017/03/17 21:35:28 christos Exp $ +# $File: android,v 1.12 2019/04/19 00:42:27 christos Exp $ # Various android related magic entries #------------------------------------------------------------ @@ -32,33 +32,68 @@ # Android Backup archive # From: Ariel Shkedi -# File extension: .ab -# No mime-type defined +# Update: Joerg Jenderek # URL: https://github.com/android/platform_frameworks_base/blob/\ # 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\ # android/server/BackupManagerService.java#L2367 +# Reference: https://sourceforge.net/projects/adbextractor/ +# android-backup-extractor/perl/backupencrypt.pl +# Note: only unix line feeds "\n" found # After the header comes a tar file # If compressed, the entire tar file is compressed with JAVA deflate # # Include the version number hardcoded with the magic string to avoid # false positives -0 string/b ANDROID\ BACKUP\n1\n Android Backup +0 string/b ANDROID\ BACKUP\n Android Backup +# maybe look for some more characteristics like linefeed '\n' or version +#>16 string \n +# No mime-type defined offically +!:mime application/x-google-ab +!:ext ab +# on 2nd line version (often 1, 2 on kitkat 4.4.3+, 4 on 7.1.2) +>15 string >\0 \b, version %s +# "1" on 3rd line means compressed >17 string 0\n \b, Not-Compressed >17 string 1\n \b, Compressed +# The 4th line is encryption "none" or "AES-256" # any string as long as it's not the word none (which is matched below) +>19 string none\n \b, Not-Encrypted +# look for backup content after line with encryption info +#>>19 search/7 \n +# data part after header for not encrypted Android Backup +#>>>&0 ubequad x \b, content 0x%16.16llx... +# look for zlib compressed by ./compress after message with 1 space at end +#>>>&0 indirect x \b; contains +# look for tar archive block by ./archive for package name manifest +>>288 string ustar \b; contains +>>>31 use tar-file +# look for zip/jar archive by ./archive ./zip after message with 1 space at end +#>>2079 search/1025/s PK\003\004 \b; contains +#>>>&0 indirect x +>19 string !none >>19 regex/1l \^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).* \b, Encrypted (%s) ->>19 string none\n \b, Not-Encrypted # Commented out because they don't seem useful to print # (but they are part of the header - the tar file comes after them): +# The 5th line is User Password Salt (128 Hex) +# string length too high with standard src configuration +#>>>&1 string >\0 \b, PASSWORD salt: "%-128.128s" #>>>&1 regex/1l .* \b, Password salt: %s +# The 6th line is Master Key Checksum Salt (128 Hex) #>>>>&1 regex/1l .* \b, Master salt: %s +# The 7th line is Number of PBDKF2 Rounds (10000) #>>>>>&1 regex/1l .* \b, PBKDF2 rounds: %s +# The 8th line is User key Initialization Vector (IV) (32 Hex) #>>>>>>&1 regex/1l .* \b, IV: %s +#>>>>>>&1 regex/1l .* \b, IV: %s +# The 9th line is Master IV+Key+Checksum (192 Hex) #>>>>>>>&1 regex/1l .* \b, Key: %s +# look for new line separator char after line number 9 +#>>>0x204 ubyte 0x0a NL found +#>>>>&1 ubequad x \b, Content magic %16.16llx # *.pit files by Joerg Jenderek -# http://forum.xda-developers.com/showthread.php?p=9122369 -# http://forum.xda-developers.com/showthread.php?t=816449 +# https://forum.xda-developers.com/showthread.php?p=9122369 +# https://forum.xda-developers.com/showthread.php?t=816449 # Partition Information Table for Samsung's smartphone with Android # used by flash software Odin 0 ulelong 0x12349876 diff --git a/contrib/file/magic/Magdir/animation b/contrib/file/magic/Magdir/animation index 76e45de57e89..aaf32dd4c43c 100644 --- a/contrib/file/magic/Magdir/animation +++ b/contrib/file/magic/Magdir/animation @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: animation,v 1.68 2018/05/06 16:08:07 christos Exp $ +# $File: animation,v 1.71 2019/04/19 00:42:27 christos Exp $ # animation: file(1) magic for animation/movie formats # # animation formats @@ -32,9 +32,9 @@ !:mime application/x-quicktime-player 4 string/W jP JPEG 2000 image !:mime image/jp2 -# http://www.ftyps.com/ with local additions +# https://www.ftyps.com/ with local additions 4 string ftyp ISO Media -# http://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/ +# https://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/ >8 string XAVC \b, MPEG v4 system, Sony XAVC Codec >>96 string x \b, Audio "%.4s" >>118 beshort x at %dHz @@ -46,7 +46,7 @@ >>11 byte 4 \b v4 (H.263/AMR GSM 6.10) >>11 byte 5 \b v5 (H.263/AMR GSM 6.10) >>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10) -# http://www.3gpp2.org/Public_html/Specs/C.S0050-B_v1.0_070521.pdf +# https://www.3gpp2.org/Public_html/Specs/C.S0050-B_v1.0_070521.pdf # Section 8.1.1, corresponds to a, b, c >>11 byte 0x61 \b C.S0050-0 V1.0 >>11 byte 0x62 \b C.S0050-0-A V1.0.0 @@ -855,6 +855,7 @@ # conti_count 4 bit - 0 belong&0xFF5FFF10 0x47400010 >188 byte 0x47 MPEG transport stream data +!:mime video/MP2T # DIF digital video file format 0 belong&0xffffff00 0x1f070000 DIF @@ -892,10 +893,10 @@ 0 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file !:mime model/vrml -# X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd] +# X3D (Extensible 3D) [https://www.web3d.org/specifications/x3d-3.0.dtd] # From Michel Briand # mimetype from https://www.iana.org/assignments/media-types/model/x3d+xml -# Example http://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d +# Example https://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d 0 string/w \20 search/1000/w \ 2008-07-18 0 string BIK Bink Video >3 regex =[a-z] rev.%s @@ -988,61 +989,61 @@ #>>51 byte&0x10 !0 DCT # Type: NUT Container -# URL: http://wiki.multimedia.cx/index.php?title=NUT +# URL: https://wiki.multimedia.cx/index.php?title=NUT # From: Adam Buchbinder 0 string nut/multimedia\ container\0 NUT multimedia container # Type: Nullsoft Video (NSV) -# URL: http://wiki.multimedia.cx/index.php?title=Nullsoft_Video +# URL: https://wiki.multimedia.cx/index.php?title=Nullsoft_Video # From: Mike Melanson 0 string NSVf Nullsoft Video # Type: REDCode Video -# URL: http://www.red.com/ ; http://wiki.multimedia.cx/index.php?title=REDCode +# URL: https://www.red.com/ ; https://wiki.multimedia.cx/index.php?title=REDCode # From: Mike Melanson 4 string RED1 REDCode Video # Type: MTV Multimedia File -# URL: http://wiki.multimedia.cx/index.php?title=MTV +# URL: https://wiki.multimedia.cx/index.php?title=MTV # From: Mike Melanson 0 string AMVS MTV Multimedia File # Type: ARMovie -# URL: http://wiki.multimedia.cx/index.php?title=ARMovie +# URL: https://wiki.multimedia.cx/index.php?title=ARMovie # From: Mike Melanson 0 string ARMovie\012 ARMovie # Type: Interplay MVE Movie -# URL: http://wiki.multimedia.cx/index.php?title=Interplay_MVE +# URL: https://wiki.multimedia.cx/index.php?title=Interplay_MVE # From: Mike Melanson 0 string Interplay\040MVE\040File\032 Interplay MVE Movie # Type: Windows Television DVR File -# URL: http://wiki.multimedia.cx/index.php?title=WTV +# URL: https://wiki.multimedia.cx/index.php?title=WTV # From: Mike Melanson # This takes the form of a Windows-style GUID 0 bequad 0xB7D800203749DA11 >8 bequad 0xA64E0007E95EAD8D Windows Television DVR Media # Type: Sega FILM/CPK Multimedia -# URL: http://wiki.multimedia.cx/index.php?title=Sega_FILM +# URL: https://wiki.multimedia.cx/index.php?title=Sega_FILM # From: Mike Melanson 0 string FILM Sega FILM/CPK Multimedia, >32 belong x %d x >28 belong x %d # Type: Nintendo THP Multimedia -# URL: http://wiki.multimedia.cx/index.php?title=THP +# URL: https://wiki.multimedia.cx/index.php?title=THP # From: Mike Melanson 0 string THP\0 Nintendo THP Multimedia # Type: BBC Dirac Video -# URL: http://wiki.multimedia.cx/index.php?title=Dirac +# URL: https://wiki.multimedia.cx/index.php?title=Dirac # From: Mike Melanson 0 string BBCD BBC Dirac Video # Type: RAD Game Tools Smacker Multimedia -# URL: http://wiki.multimedia.cx/index.php?title=Smacker +# URL: https://wiki.multimedia.cx/index.php?title=Smacker # From: Mike Melanson 0 string SMK RAD Game Tools Smacker Multimedia >3 byte x version %c, @@ -1064,3 +1065,10 @@ >8 string AHDR LucasArts Smush Animation Format (SAN) video 0 string SANM >8 string SHDR LucasArts Smush v2 (SANM) video + +# Type: Scaleform video +# Extension: .usm +# URL: https://wiki.multimedia.cx/index.php/USM +# From: David Korth +0 string CRID +>32 string @UTF Scaleform video diff --git a/contrib/file/magic/Magdir/apple b/contrib/file/magic/Magdir/apple index 39e838b57bd2..4ac10fc5be92 100644 --- a/contrib/file/magic/Magdir/apple +++ b/contrib/file/magic/Magdir/apple @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: apple,v 1.39 2018/03/02 15:26:39 christos Exp $ +# $File: apple,v 1.43 2019/04/19 00:42:27 christos Exp $ # apple: file(1) magic for Apple file formats # 0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text @@ -11,22 +11,97 @@ 0 belong 0x00051600 AppleSingle encoded Macintosh file 0 belong 0x00051607 AppleDouble encoded Macintosh file +# Type: Apple Emulator WOZ format +# From: Greg Wildman +# Ref: https://applesaucefdc.com/woz/reference/ +# Ref: https://applesaucefdc.com/woz/reference2/ +# +# Note: The following test are mostly identical. I would rather not +# use a regex to identify the WOZ format number. +0 string WOZ1 +>4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image +>12 string INFO +>>21 byte 01 \b, 5.25 inch +>>21 byte 02 \b, 3.5 inch +>>22 byte 01 \b, write protected +>>23 byte 01 \b, cross track synchronized +>>25 string/T x \b, %.32s +0 string WOZ2 +>4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image +>12 string INFO +>>21 byte 01 \b, 5.25 inch +>>21 byte 02 \b, 3.5 inch +>>22 byte 01 \b, write protected +>>23 byte 01 \b, cross track synchronized +>>25 string/T x \b, %.32s + +# Type: Apple Emulator disk images +# From: Greg Wildman +# ProDOS boot loader? +0 string \x01\x38\xB0\x03\x4C Apple ProDOS Image +# Detect Volume Directory block ($02) +>0x400 string \x00\x00\x03\x00 +>>0x404 byte &0xF0 +>>>0x405 string x \b, Volume /%s +>>>0x429 leshort x \b, %u Blocks +# ProDOS ordered ? +>0xb00 string \x00\x00\x03\x00 +>>0xb04 byte &0xF0 +>>>0xb05 string x \b, Volume /%s +>>>0xb29 leshort x \b, %u Blocks +# +# DOS3.3 boot loader? +0 string \x01\xA5\x27\xC9\x09\xD0\x18\xA5\x2B +>0x11001 string \x11\x0F\x03 Apple DOS 3.3 Image +>>0x11006 byte x \b, Volume %u +>>0x11034 byte x \b, %u Tracks +>>0x11035 byte x \b, %u Sectors +>>0x11036 leshort x \b, %u bytes per sector +# DOS3.2 ? +>0x11001 string \x11\x0C\x02 Apple DOS 3.2 Image +>>0x11006 byte x \b, Volume %u +>>0x11034 byte x \b, %u Tracks +>>0x11035 byte x \b, %u Sectors +>>0x11036 leshort x \b, %u bytes per sector +# DOS3.1 ? +>0x11001 string \x11\x0C\x01 +>>0x11c00 string \x00\x11\x0B Apple DOS 3.1 Image +# +# Pascal boot loader? +0 string \x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD +>0xd6 pstring SYSTEM.APPLE +>>0xb00 leshort 0x0000 +>>>0xb04 leshort 0x0000 Apple Pascal Image +>>>>0xb06 pstring x \b, Volume %s: +>>>>0xb0e leshort x \b, %u Blocks +>>>>0xb10 leshort x \b, %u Files + # Type: Apple Emulator 2IMG format # From: Radek Vokal -0 string 2IMG Apple ][ 2IMG Disk Image ->4 string XGS! \b, XGS ->4 string CTKG \b, Catakig ->4 string ShIm \b, Sheppy's ImageMaker ->4 string WOOF \b, Sweet 16 ->4 string B2TR \b, Bernie ][ the Rescue ->4 string !nfc \b, ASIMOV2 ->4 string x \b, Unknown Format ->0xc byte 00 \b, DOS 3.3 sector order ->>0x10 byte 00 \b, Volume 254 ->>0x10 byte&0x7f x \b, Volume %u ->0xc byte 01 \b, ProDOS sector order ->>0x14 short x \b, %u Blocks ->0xc byte 02 \b, NIB data +# Update: Greg Wildman +0 string 2IMG Apple ][ 2IMG Disk Image +>4 clear x +>4 string XGS! \b, XGS +>4 string CTKG \b, Catakig +>4 string ShIm \b, Sheppy's ImageMaker +>4 string SHEP \b, Sheppy's ImageMaker +>4 string WOOF \b, Sweet 16 +>4 string B2TR \b, Bernie ][ the Rescue +>4 string \!nfc \b, ASIMOV2 +>4 string \>BD\< \b, Brutal Deluxe's Cadius +>4 string CdrP \b, CiderPress +>4 string Vi][ \b, Virtual ][ +>4 string PRFS \b, ProFUSE +>4 string FISH \b, FishWings +>4 string RVLW \b, Revival for Windows +>4 default x +>>4 string x \b, Creator tag "%-4.4s" +>0xc byte 00 \b, DOS 3.3 sector order +>>0x10 byte 00 \b, Volume 254 +>>0x10 byte&0x7f x \b, Volume %u +>0xc byte 01 \b, ProDOS sector order +>>0x14 short x \b, %u Blocks +>0xc byte 02 \b, NIB data # magic for Newton PDA package formats # from Ruda Moura @@ -88,7 +163,7 @@ # http://home.earthlink.net/~hughhood/appleiiworksenvoy/ # ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type') # $70 $1A $F8 $FF is this the apple type ? -#:apple pdospøÿ +#:apple pdosp^Z\xf8\xff !:ext awp # minimum version needed to read this files. SFMinVers (0 , 30~3.0 ) >>>183 ubyte 30 3.0 @@ -354,7 +429,7 @@ >>6 ubeshort x \b, type 0x%x # URL: https://en.wikipedia.org/wiki/Apple_Partition_Map -# Reference: http://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h +# Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h # Update: Joerg Jenderek # Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the # magic stronger. @@ -396,8 +471,8 @@ # is the startup partition APPLE_PS_STARTUP >>88 ubelong &0x80000000 \b, is the startup partition -#http://wiki.mozilla.org/DS_Store_File_Format -#http://en.wikipedia.org/wiki/.DS_Store +#https://wiki.mozilla.org/DS_Store_File_Format +#https://en.wikipedia.org/wiki/.DS_Store 0 string \0\0\0\1Bud1\0 Apple Desktop Services Store # HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015) diff --git a/contrib/file/magic/Magdir/archive b/contrib/file/magic/Magdir/archive index f8cf3a2684b5..cd0213fa9f3c 100644 --- a/contrib/file/magic/Magdir/archive +++ b/contrib/file/magic/Magdir/archive @@ -1,5 +1,5 @@ #------------------------------------------------------------------------------ -# $File: archive,v 1.119 2018/04/24 23:19:45 christos Exp $ +# $File: archive,v 1.129 2019/05/09 18:58:02 christos Exp $ # archive: file(1) magic for archive formats (see also "msdos" for self- # extracting compressed archives) # @@ -148,7 +148,7 @@ >>>257 string >\0 \b, comment: %-.40s # Incremental snapshot gnu-tar format from: -# http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html +# https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html 0 string GNU\ tar- GNU tar incremental snapshot data >&0 regex [0-9]\.[0-9]+-[0-9]+ version %s @@ -226,21 +226,48 @@ # a portable archive whose first member has a name beginning with # "debian". # +# Update: Joerg Jenderek +# URL: https://en.wikipedia.org/wiki/Deb_(file_format) 0 string =!\ndebian ->8 string debian-split part of multipart Debian package +# https://manpages.debian.org/testing/dpkg/dpkg-split.1.en.html +>14 string -split part of multipart Debian package !:mime application/vnd.debian.binary-package ->8 string debian-binary Debian binary package +# udeb is used for stripped down deb file +!:ext deb/udeb +>14 string -binary Debian binary package !:mime application/vnd.debian.binary-package ->8 string !debian +!:ext deb/udeb +# This should not happen +>14 default x Unknown Debian package +# NL terminated version; for most Debian cases this is 2.0 or 2.1 for splitted >68 string >\0 (format %s) -# These next two lines do not work, because a bzip2 Debian archive -# still uses gzip for the control.tar (first in the archive). Only -# data.tar varies, and the location of its filename varies too. -# file/libmagic does not current have support for ascii-string based -# (offsets) as of 2005-09-15. -#>81 string bz2 \b, uses bzip2 compression -#>84 string gz \b, uses gzip compression -#>136 ledate x created: %s +#>68 string !2.0\n +#>>68 string x (format %.3s) +>68 string =2.0\n +# 2nd archive name=control archive name like control.tar.gz or control.tar.xz +>>72 string >\0 \b, with %.14s +# look for 3rd archive name=data archive name like data.tar.{gz,xz,bz2,lzma} +>>0 search/0x93e4f data.tar. \b, data compression +# the above line only works if FILE_BYTES_MAX in ../../src/file.h is raised +# for example like libreoffice-dev-doc_1%3a5.2.7-1+rpi1+deb9u3_all.deb +>>>&0 string x %.4s +# splitted debian package case +>68 string =2.1\n +# dpkg-1.18.25/dpkg-split/info.c +# NL terminated ASCII package name like ckermit +>>&0 string x \b, %s +# NL terminated package version like 302-5.3 +>>>&1 string x %s +# NL terminated MD5 checksum +>>>>&1 string x \b, MD5 %s +# NL terminated original package length +>>>>>&1 string x \b, unsplitted size %s +# NL terminated part length +>>>>>>&1 string x \b, part lenght %s +# NL terminated package part like n/m +>>>>>>>&1 string x \b, part %s +# NL terminated package architecture like armhf since dpkg 1.16.1 or later +>>>>>>>>&1 string x \b, %s # # MIPS archive; they're in the portable archive format, and need to go @@ -257,15 +284,35 @@ >19 string B and an EB hash table >22 string X -- out of date -0 search/1 -h- Software Tools format archive text - # # BSD/SVR2-and-later portable archive formats. # +# Update: Joerg Jenderek +# URL: http://fileformats.archiveteam.org/wiki/AR +# Reference: https://www.unix.com/man-page/opensolaris/3HEAD/ar.h/ +# Note: Mach-O universal binary in ./cafebabe is dependent +# TODO: unify current ar archive, MIPS archive, Debian package +# distinguish BSD, SVR; 32, 64 bit; HP from other 32-bit SVR; +# *.ar packages from *.a libraries. handle empty archive 0 string =!\n current ar archive +# print first and possibly second ar_name[16] for debugging purpose +#>8 string x \b, 1st "%.16s" +#>68 string x \b, 2nd "%.16s" !:mime application/x-archive +# a in most case for libraries; lib for Microsoft libraries; ar else cases +!:ext a/lib/ar >8 string __.SYMDEF random library +# first member with long marked name __.SYMDEF SORTED implies BSD library >68 string __.SYMDEF\ SORTED random library +# Reference: https://parisc.wiki.kernel.org/images-parisc/b/b2/Rad_11_0_32.pdf +# "archive file" entry moved from ./hp +# LST header system_id 0210h~PA-RISC 1.1,... identifies the target architecture +# LST header a_magic 0619h~relocatable library +>68 belong 0x020b0619 - PA-RISC1.0 relocatable library +>68 belong 0x02100619 - PA-RISC1.1 relocatable library +>68 belong 0x02110619 - PA-RISC1.2 relocatable library +>68 belong 0x02140619 - PA-RISC2.0 relocatable library +#EOF for common ar archives # # "Thin" archive, as can be produced by GNU ar. @@ -275,6 +322,8 @@ >68 belong 1 %d symbol entry >68 belong >1 %d symbol entries +0 search/1 -h- Software Tools format archive text + # ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) # # The first byte is the magic (0x1a), byte 2 is the compression type for @@ -799,7 +848,7 @@ # LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) # Update: Joerg Jenderek # URL: https://en.wikipedia.org/wiki/LHA_(file_format) -# Reference: http://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html +# Reference: https://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html # # check and display information of lharc (LHa,PMarc) file 0 name lharc-file @@ -999,7 +1048,7 @@ !:ext rar # Very old RAR archive -# http://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf +# https://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf 0 string RE\x7e\x5e RAR archive data (>>62 string base Database file # OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) -# http://lists.oasis-open.org/archives/office/200505/msg00006.html +# https://lists.oasis-open.org/archives/office/200505/msg00006.html # (mimetype contains "application/vnd.oasis.opendocument.") >>50 string vnd.oasis.opendocument. OpenDocument >>>73 string text @@ -1112,7 +1163,7 @@ !:mime application/vnd.oasis.opendocument.image-template # EPUB (OEBPS) books using OCF (OEBPS Container Format) -# http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. +# https://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. # From: Ralf Brown >>50 string epub+zip EPUB document !:mime application/epub+zip @@ -1306,6 +1357,16 @@ >5 byte x \b.%d >6 belong x (%d bytes) +# From: Joerg Jenderek +# URL: https://help.foxitsoftware.com/kb/install-fzip-file.php +# reference: http://mark0.net/download/triddefs_xml.7z/ +# defs/f/fzip.trid.xml +# Note: unknown compression; No "PK" zip magic; normally in directory like +# "%APPDATA%\Foxit Software\Addon\Foxit Reader\Install" +0 ubequad 0x2506781901010000 Foxit add-on/update +!:mime application/x-fzip +!:ext fzip + # From: "Robert Dale" 0 belong 123 dar archive, >4 belong x label "%.8x @@ -1316,7 +1377,7 @@ >14 beshort 0x4e53 multi-part, with -S # Symbian installation files -# http://www.thouky.co.uk/software/psifs/sis.html +# https://www.thouky.co.uk/software/psifs/sis.html # http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 8 lelong 0x10000419 Symbian installation file !:mime application/vnd.symbian.install @@ -1334,24 +1395,74 @@ >10 string x with compression level %.1s # xar (eXtensible ARchiver) archive -# xar archive format: http://code.google.com/p/xar/ +# URL: https://en.wikipedia.org/wiki/Xar_(archiver) +# xar archive format: https://code.google.com/p/xar/ # From: "David Remahl" +# Update: Joerg Jenderek +# TODO: lzma compression; X509Data for pkg and xip +# Note: verified by `xar --dump-header -f FullBundleUpdate.xar` or +# 7z t -txar Xcode_10.2_beta_4.xip` 0 string xar! xar archive !:mime application/x-xar -#>4 beshort x header size %d ->6 beshort x version %d, -#>8 quad x compressed TOC: %d, -#>16 quad x uncompressed TOC: %d, +# pkg for Mac OSX installer package like FullBundleUpdate.pkg +# xip for signed Apple software like Xcode_10.2_beta_4.xip +!:ext xar/pkg/xip +# always 28 in older archives +>4 ubeshort >28 \b, header size %u +# currently there exit only version 1 since about 2014 +>6 ubeshort >1 version %u, +>8 ubequad x compressed TOC: %llu, +#>16 ubequad x uncompressed TOC: %llu, +# cksum_alg 0-2 in older and also 3-4 in newer >24 belong 0 no checksum >24 belong 1 SHA-1 checksum >24 belong 2 MD5 checksum +>24 belong 3 SHA-256 checksum +>24 belong 4 SHA-512 checksum +>24 belong >4 unknown 0x%x checksum +#>24 belong >4 checksum +# For no compression jump 0 bytes +>24 belong 0 +>>0 ubyte x +# jump more bytes forward by header size +>>>&(4.S) ubyte x +# jump more bytes forward by compressed table of contents size +#>>>>&(8.Q) ubequad x \b, heap data 0x%llx +>>>>&(8.Q) ubyte x +# look for data by ./compress after message with 1 space at end +>>>>>&-3 indirect x \b, contains +# For SHA-1 jump 20 minus 2 bytes +>24 belong 1 +>>18 ubyte x +# jump more bytes forward by header size +>>>&(4.S) ubyte x +# jump more bytes forward by compressed table of contents size +>>>>&(8.Q) ubyte x +# data compressed by gzip, bzip, lzma or none +>>>>>&-1 indirect x \b, contains +# For SHA-256 jump 32 minus 2 bytes +>24 belong 3 +>>30 ubyte x +# jump more bytes forward by header size +>>>&(4.S) ubyte x +# jump more bytes forward by compressed table of contents size +>>>>&(8.Q) ubyte x +>>>>>&-1 indirect x \b, contains +# For SHA-512 jump 64 minus 2 bytes +>24 belong 4 +>>62 ubyte x +# jump more bytes forward by header size +>>>&(4.S) ubyte x +# jump more bytes forward by compressed table of contents size +>>>>&(8.Q) ubyte x +>>>>>&-1 indirect x \b, contains # Type: Parity Archive # From: Daniel van Eeden 0 string PAR2 Parity Archive Volume Set # Bacula volume format. (Volumes always start with a block header.) -# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html +# URL: https://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html # From: Adam Buchbinder 12 string BB02 Bacula volume >20 bedate x \b, started %s @@ -1366,11 +1477,11 @@ 0 string zPQ ZPAQ stream >3 byte x \b, level %d # From: Barry Carter -# http://encode.ru/threads/456-zpaq-updates/page32 +# https://encode.ru/threads/456-zpaq-updates/page32 0 string 7kSt ZPAQ file # BBeB ebook, unencrypted (LRF format) -# URL: http://www.sven.de/librie/Librie/LrfFormat +# URL: https://www.sven.de/librie/Librie/LrfFormat # From: Adam Buchbinder 0 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted >8 beshort x \b, version %d @@ -1380,8 +1491,8 @@ >44 beshort x %d) # Symantec GHOST image by Joerg Jenderek at May 2014 -# http://us.norton.com/ghost/ -# http://www.garykessler.net/library/file_sigs.html +# https://us.norton.com/ghost/ +# https://www.garykessler.net/library/file_sigs.html 0 ubelong&0xFFFFf7f0 0xFEEF0100 Norton GHost image # *.GHO >2 ubyte&0x08 0x00 \b, first file @@ -1427,3 +1538,55 @@ # LyNX archive 56 string USE\040LYNX\040TO\040DISSOLVE\040THIS\040FILE LyNX archive + +# From: Joerg Jenderek +# URL: https://www.acronis.com/ +# Reference: https://en.wikipedia.org/wiki/TIB_(file_format) +# Note: only tested with True Image 2013 Build 5962 and 2019 Build 14110 +0 ubequad 0xce24b9a220000000 Acronis True Image backup +!:mime application/x-acronis-tib +!:ext tib +# 01000000 +#>20 ubelong x \b, at 20 0x%x +# 20000000 +#>28 ubelong x \b, at 28 0x%x +# strings like "Generic- SD/MMC 1.00" "Unknown Disk" "Msft Virtual Disk 1.0" +# ??? +# strings like "\Device\0000011e" "\Device\0000015a" +#>0 search/0x6852300/cs \\Device\\ +#>>&-1 pstring x \b, %s +# "\Device\HarddiskVolume30" "\Device\HarddiskVolume39" +#>>>&1 search/180/cs \\Device\\ +#>>>>&-1 pstring x \b, %s +#>>>>>&0 search/29/cs \0\0\xc8\0 +# disk label +#>>>>>>&10 lestring16 x \b, disk label %11.11s +#>>>>>>&9 plestring16 x \b, disk label "%11.11s" +#>>>>>>&10 ubequad x %16.16llx + + +# Gentoo XPAK binary package +# by Michal Gorny +# https://gitweb.gentoo.org/proj/portage.git/tree/man/xpak.5 +-4 string STOP +>-16 string XPAKSTOP Gentoo binary package (XPAK) + +# From: Joerg Jenderek +# URL: https://kodi.wiki/view/TexturePacker +# Reference: https://mirrors.kodi.tv/releases/source/17.3-Krypton.tar.gz +# /xbmc-Krypton/xbmc/guilib/XBTF.h +# /xbmc-Krypton/xbmc/guilib/XBTF.cpp +0 string XBTF +# skip ASCII text by looking for terminating \0 of path +>264 ubyte 0 XBMC texture package +!:mime application/x-xbmc-xbt +!:ext xbt +# XBTF_VERSION 2 +>>4 string !2 \b, version %-.1s +# nofFiles /xbmc-Krypton/xbmc/guilib/XBTFReader.cpp +>>5 ulelong x \b, %u file +# plural s +>>5 ulelong >1 \bs +# path[CXBTFFile[MaximumPathLength=256] +>>9 string x \b, 1st %s + diff --git a/contrib/file/magic/Magdir/audio b/contrib/file/magic/Magdir/audio index 1c92cf5d9fae..5492635dfc1d 100644 --- a/contrib/file/magic/Magdir/audio +++ b/contrib/file/magic/Magdir/audio @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: audio,v 1.89 2018/07/03 20:55:37 christos Exp $ +# $File: audio,v 1.111 2019/05/08 18:02:45 christos Exp $ # audio: file(1) magic for sound formats (see also "iff") # # Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com), @@ -393,9 +393,15 @@ 0 string MED MED_Song 0 string SymM Symphonie SymMOD music file # +# Track Length (TRL), Tracks (TRK), Samples (SMP), Subsongs (SS) +# http://lclevy.free.fr/exotica/ahx/ahxformat.txt 0 string THX AHX version >3 byte =0 1 module data >3 byte =1 2 module data +>10 byte x TRL: %u +>11 byte x TRK: %u +>12 byte x SMP: %u +>13 byte x SS: %u # 0 string OKTASONG Oktalyzer module data # @@ -535,6 +541,18 @@ # adlib sound files # From: Alex Myczko + +# https://github.com/rerrahkr/BambooTracker +0 string BambooTrackerMod BambooTracker module +>22 byte x \b, version %u +>21 byte x \b.%u +>20 byte x \b.%u + +0 string BambooTrackerIst BambooTracker instrument +>22 byte x \b, version %u +>21 byte x \b.%u +>20 byte x \b.%u + 0 string RAWADATA RdosPlay RAW 1068 string RoR AMUSIC Adlib Tracker @@ -550,6 +568,14 @@ 0 string ofTAZ! eXtra Simple Music +0 string FMK! FM Kingtracker Song + +0 string DFM DFM Song + +0 string \ CFF Song + +0 string _A2module A2M Song + # Spectrum 128 tunes (.ay files). # From: Emanuel Haupt 0 string ZXAYEMUL Spectrum 128 tune @@ -631,7 +657,7 @@ # IMY # from http://filext.com/detaillist.php?extdetail=IMY -# http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm +# https://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm # http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html # http://www.wx800.com/msg/download/irda/iMelody.pdf 0 string BEGIN:IMELODY iMelody Ringtone Format @@ -647,6 +673,8 @@ # URL: http://filext.com/detaillist.php?extdetail=AMR # From: Russell Coker 0 string #!AMR Adaptive Multi-Rate Codec (GSM telephony) +!:mime audio/amr +!:ext amr # Type: SuperCollider 3 Synth Definition File Format # From: Mario Lang @@ -654,12 +682,12 @@ >4 belong x version %d # Type: True Audio Lossless Audio -# URL: http://wiki.multimedia.cx/index.php?title=True_Audio +# URL: https://wiki.multimedia.cx/index.php?title=True_Audio # From: Mike Melanson 0 string TTA1 True Audio Lossless Audio # Type: WavPack Lossless Audio -# URL: http://wiki.multimedia.cx/index.php?title=WavPack +# URL: https://wiki.multimedia.cx/index.php?title=WavPack # From: Mike Melanson 0 string wvpk WavPack Lossless Audio @@ -667,6 +695,8 @@ # VGM music file 0 string Vgm\040 >9 ubyte >0 VGM Video Game Music dump v +!:mime audio/x-vgm +!:ext vgm >>9 ubyte/16 >0 \b%d >>9 ubyte&0x0F x \b%d >>8 ubyte/16 x \b.%d @@ -713,6 +743,54 @@ >>>>0x78 ubyte 0x03 AY-3-8930, >>>>0x78 ubyte 0x10 YM2149, >>>>0x78 ubyte 0x11 YM3439, +# VGM 1.61 +>>0x34 ulelong >0x4C +>>>0x80 ulelong >0 DMG, +>>0x34 ulelong >0x50 +>>>0x84 lelong >0 NES APU, +>>>0x84 lelong <0 NES APU with FDS, +>>0x34 ulelong >0x54 +>>>0x88 ulelong >0 MultiPCM, +>>0x34 ulelong >0x58 +>>>0x8C ulelong >0 uPD7759, +>>0x34 ulelong >0x5C +>>>0x90 ulelong >0 OKIM6258, +>>0x34 ulelong >0x64 +>>>0x98 ulelong >0 OKIM6295, +>>0x34 ulelong >0x68 +>>>0x9C ulelong >0 K051649, +>>0x34 ulelong >0x6C +>>>0xA0 ulelong >0 K054539, +>>0x34 ulelong >0x70 +>>>0xA4 ulelong >0 HuC6280, +>>0x34 ulelong >0x74 +>>>0xA8 ulelong >0 C140, +>>0x34 ulelong >0x78 +>>>0xAC ulelong >0 K053260, +>>0x34 ulelong >0x7C +>>>0xB0 ulelong >0 Pokey, +>>0x34 ulelong >0x80 +>>>0xB4 ulelong >0 QSound, +# VGM 1.71 +>>0x34 ulelong >0x84 +>>>0xB8 ulelong >0 SCSP, +>>0x34 ulelong >0x8C +>>>0xC0 ulelong >0 WonderSwan, +>>0x34 ulelong >0x90 +>>>0xC4 ulelong >0 VSU, +>>0x34 ulelong >0x94 +>>>0xC8 ulelong >0 SAA1099, +>>0x34 ulelong >0x98 +>>>0xCC ulelong >0 ES5503, +>>0x34 ulelong >0x9C +>>>0xD0 lelong >0 ES5505, +>>>0xD0 lelong <0 ES5506, +>>0x34 ulelong >0xA4 +>>>0xD8 ulelong >0 X1-010, +>>0x34 ulelong >0xA8 +>>>0xDC ulelong >0 C352, +>>0x34 ulelong >0xAC +>>>0xE0 ulelong >0 GA20, # GVOX Encore file format # Since this is a proprietary file format and there is no publicly available @@ -727,8 +805,8 @@ # Summary: Garmin Voice Processing Module (WAVE audios) # From: Joerg Jenderek -# URL: http://www.garmin.com/ -# Reference: http://turboccc.wikispaces.com/share/view/28622555 +# URL: https://www.garmin.com/ +# Reference: http://www.poi-factory.com/node/19580 # NOTE: there exist 2 other Garmin VPM formats 0 string AUDIMG # skip text files starting with string "AUDIMG" @@ -752,16 +830,35 @@ # if you select a language like german on your garmin device # you can only select voice modules with corresponding language byte ID like 1 >>18 ubyte x \b, language ID %d +# structure for phrases/sentences? +# number of voice sample in the 1st phrase? +#>>19 uleshort x \b, 0x%x samples +#>>>21 uleshort >0 \b, at 0x%4.4x +#>>>(21.s) ubequad x 0x%llx +# 2nd phrase? +#>>23 uleshort x \b, 0x%x samples +#>>>25 uleshort >0 \b, at 0x%4.4x +#>>>(25.s) ubequad x 0x%llx # pointer to 1st audio WAV sample >>16 uleshort >0 ->>>(16.s) ulelong >0 \b, at offset 0x%x +>>>(16.s) ulelong >0 \b, at 0x%x # WAV length ->>>>(16.s+4) ulelong >0 %d Bytes +# 1 space char after "bytes" to get phrase "bytes RIFF" +>>>>(16.s+4) ulelong >0 %u bytes # look for magic >>>>>(&-8.l) string RIFF # determine type by ./riff ->>>>>>&-4 indirect x \b +>>>>>>&-4 indirect x # 2 - ~ 131 WAV samples following same way +# +# Summary: encrypted Garmin Voice Processing Module +# From: Joerg Jenderek +# URL: https://www.garmin.com/us/products/ontheroad/voicestudio +# NOTE: Encrypted variant used in voices like DrNightmare, Elfred, Yeti. +# There exist 2 other Garmin VPM formats +0 ubequad 0xa141190fecc8ced6 Garmin Voice Processing Module (encrypted) +!:mime audio/x-vpm-garmin +!:ext vpm # From Martin Mueller Skarbiniks Pedersen 0 string GDM @@ -816,7 +913,7 @@ >>>0x31 byte&0x0F x \b%02d >>>>0x4 string >\0 \b, title: "%s" -# magic for Klystrack, http://kometbomb.github.io/klystrack/ +# magic for Klystrack, https://kometbomb.github.io/klystrack/ # from Alex Myczko 0 string cyd!song Klystrack song >8 byte >0 \b, version %u @@ -866,11 +963,15 @@ # Added by David Korth 0x00 beshort 0x8000 >(2.S-2) string (c)CRI CRI ADX ADPCM audio +!:ext adx +!:mime audio/x-adx +!:strength +50 >>0x12 byte x v%u >>0x04 byte 0x02 \b, pre-set prediction coefficients >>0x04 byte 0x03 \b, standard ADX >>0x04 byte 0x04 \b, exponential scale ->>0x04 byte 0x05 \b, AHX +>>0x04 byte 0x10 \b, AHX (Dreamcast) +>>0x04 byte 0x11 \b, AHX >>0x08 belong x \b, %u Hz >>0x12 byte 0x03 >>>0x02 beshort >0x2B @@ -888,3 +989,125 @@ # Sony PlayStation Audio (.xa) 0 leshort 0x4158 Sony PlayStation Audio +# Portable Sound Format +# Used for audio rips for various consoles. +# http://fileformats.archiveteam.org/wiki/Portable_Sound_Format +# Added by David Korth +0 string PSF Portable Sound Format +!:mime audio/x-psf +>3 byte 0x01 (Sony PlayStation) +>3 byte 0x02 (Sony PlayStation 2) +>3 byte 0x11 (Sega Saturn) +>3 byte 0x12 (Sega Dreamcast) +>3 byte 0x13 (Sega Mega Drive) +>3 byte 0x21 (Nintendo 64) +>3 byte 0x22 (Game Boy Advance) +>3 byte 0x23 (Super NES) +>3 byte 0x41 (Capcom QSound) + +# Atari 8-bit SAP audio format +# http://asap.sourceforge.net/sap-format.html +# Added by David Korth +0 string SAP\r\n Atari 8-bit SAP audio file +!:mime audio/x-sap +!:ext sap +>5 search/1024 NAME +>>&1 string x \b: %s +>>5 search/1024 AUTHOR +>>>&1 string x by %s + +# Nintendo Wii BRSTM audio format (fields) +# NOTE: Assuming HEAD starts at 0x40. +# FIXME: Replace 0x48 with HEAD offset plus 8. +0 name nintendo-wii-brstm-fields +>(0x10.L) string HEAD \b: +>>(0x10.L+0x0C) belong x +>>>(&-4.L+0x48) belong x +>>>>&-4 byte 0 PCM, signed 8-bit, +>>>>&-4 byte 1 PCM, signed 16-bit, +>>>>&-4 byte 2 THP ADPCM, +>>>>&-3 byte !0 looping, +>>>>&-2 byte 1 mono +>>>>&-2 byte 2 stereo +>>>>&-2 byte 3 3 channels +>>>>&-2 byte 4 quad +>>>>&-2 byte >4 %u channels +>>>>&0 beshort !0 %u Hz + +# Nintendo Wii BRSTM audio format +# https://wiibrew.org/wiki/BRSTM_file +# Added by David Korth +0 string RSTM Nintendo Wii BRSTM audio file +!:mime audio/x-brstm +!:ext brstm +# Wii is big-endian, so default to BE. +>4 beshort 0xFEFF +>>0 use nintendo-wii-brstm-fields +>4 leshort 0xFEFF +>>0 use \^nintendo-wii-brstm-fields + +# Nintendo 3DS BCSTM audio format (fields) +0 name nintendo-3ds-bcstm-fields +>(0x18.l) string INFO \b: +# INFO block: Stream information starts at 0x20 (minus 4 for the 'INFO' magic) +>>&0x1C byte 0 PCM, signed 8-bit, +>>&0x1C byte 1 PCM, signed 16-bit, +>>&0x1C byte 2 DSP ADPCM, +>>&0x1C byte 3 IMA ADPCM, +>>&0x1D byte !0 looping, +>>&0x1E byte 1 mono +>>&0x1E byte 2 stereo +>>&0x1E byte 3 3 channels +>>&0x1E byte 4 quad +>>&0x1E byte >4 %u channels +>>&0x20 lelong !0 %u Hz + +# Nintendo 3DS BCSTM audio format +# https://www.3dbrew.org/wiki/BCSTM +# Added by David Korth +0 string CSTM Nintendo 3DS BCSTM audio file +!:mime audio/x-bcstm +!:ext bcstm +# 3DS is little-endian, so default to LE. +>4 leshort 0xFEFF +>>0 use nintendo-3ds-bcstm-fields +>4 beshort 0xFEFF +>>0 use \^nintendo-3ds-bcstm-fields + +# Nintendo Wii U BFSTM audio format +# http://mk8.tockdom.com/wiki/BFSTM_(File_Format) +# NOTE: This format is very similar to BCSTM. +# Added by David Korth +0 string FSTM Nintendo Wii U BFSTM audio file +!:mime audio/x-bfstm +!:ext bfstm +# BFSTM is used on both Wii U (BE) and Switch (LE), +# so default to LE. +>4 leshort 0xFEFF +>>0 use nintendo-3ds-bcstm-fields +>4 beshort 0xFEFF +>>0 use \^nintendo-3ds-bcstm-fields + +# Nintendo 3DS BCSTM audio format (fields) +0 name nintendo-3ds-bcwav-fields +>(0x18.l) string INFO \b: +# INFO block (minus 4 for INFO magic) +>>&0x4 byte 0 PCM, signed 8-bit, +>>&0x4 byte 1 PCM, signed 16-bit, +>>&0x4 byte 2 DSP ADPCM, +>>&0x4 byte 3 IMA ADPCM, +>>&0x5 byte !0 looping, +>>&0x8 lelong x stereo +>>&0x8 lelong !0 %u Hz + +# Nintendo 3DS BCWAV audio format +# https://www.3dbrew.org/wiki/BCWAV +# Added by David Korth +0 string CWAV Nintendo 3DS BCWAV audio file +!:mime audio/x-bcwav +!:ext bcwav +# 3DS is little-endian, so default to LE. +>4 leshort 0xFEFF +>>0 use nintendo-3ds-bcwav-fields +>4 beshort 0xFEFF +>>0 use \^nintendo-3ds-bcwav-fields diff --git a/contrib/file/magic/Magdir/basis b/contrib/file/magic/Magdir/basis index 128aa4c77c2d..19dd463b414b 100644 --- a/contrib/file/magic/Magdir/basis +++ b/contrib/file/magic/Magdir/basis @@ -1,9 +1,9 @@ #---------------------------------------------------------------- -# $File: basis,v 1.4 2009/09/19 16:28:08 christos Exp $ +# $File: basis,v 1.5 2019/04/19 00:42:27 christos Exp $ # basis: file(1) magic for BBx/Pro5-files # Oliver Dammer 2005/11/07 -# http://www.basis.com business-basic-files. +# https://www.basis.com business-basic-files. # 0 string \074\074bbx\076\076 BBx >7 string \000 indexed file diff --git a/contrib/file/magic/Magdir/ber b/contrib/file/magic/Magdir/ber index db7a8613d91a..15288c682416 100644 --- a/contrib/file/magic/Magdir/ber +++ b/contrib/file/magic/Magdir/ber @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: ber,v 1.1 2016/06/05 00:21:30 christos Exp $ +# $File: ber,v 1.2 2019/04/19 00:42:27 christos Exp $ # ber: file(1) magic for several BER formats used in the mobile # telecommunications industry (Georg Sauthoff) @@ -19,7 +19,7 @@ # # TAP 3 Files # TAP -> Transferred Account Procedure -# cf. http://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf +# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf # TransferBatch short tag 0 byte 0x61 # BatchControlInfo short tag @@ -47,7 +47,7 @@ >>&0 byte x NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange) # RAP Files -# cf. http://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf +# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf # Long ReturnBatch tag 0 string \x7f\x84\x16 # Long RapBatchControlInfo tag diff --git a/contrib/file/magic/Magdir/bioinformatics b/contrib/file/magic/Magdir/bioinformatics index 0c761ed351fe..2966fa6e49d1 100644 --- a/contrib/file/magic/Magdir/bioinformatics +++ b/contrib/file/magic/Magdir/bioinformatics @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: bioinformatics,v 1.4 2016/06/20 16:13:46 christos Exp $ +# $File: bioinformatics,v 1.5 2019/04/19 00:42:27 christos Exp $ # bioinfomatics: file(1) magic for Bioinfomatics file formats ############################################################################### @@ -83,7 +83,7 @@ ############################################################################### # BCF (Binary Call Format), version 2.1 -# used by SAMtools (http://samtools.github.io/hts-specs/BCFv2_qref.pdf) +# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf) # data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it ############################################################################### 0 string BCF\2\1 Binary Call Format (BCF) version 2.1 @@ -96,7 +96,7 @@ ############################################################################### # BCF (Binary Call Format), version 2.2 -# used by SAMtools (http://samtools.github.io/hts-specs/BCFv2_qref.pdf) +# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf) # data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it ############################################################################### 0 string BCF\2\2 Binary Call Format (BCF) version 2.2 @@ -129,7 +129,7 @@ ############################################################################### # FASTA -# used by FASTA (http://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf) +# used by FASTA (https://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf) ############################################################################### #0 byte 0x3e # q>0 regex =^[>][!-~\t\ ]+$ diff --git a/contrib/file/magic/Magdir/biosig b/contrib/file/magic/Magdir/biosig new file mode 100644 index 000000000000..e490f6cc7eff --- /dev/null +++ b/contrib/file/magic/Magdir/biosig @@ -0,0 +1,154 @@ + +############################################################################## +# +# Magic ids for biomedical signal file formats +# Copyright (C) 2018 Alois Schloegl +# +# The list has been derived from biosig projects +# http://biosig.sourceforge.net +# https://pub.ist.ac.at/~schloegl/matlab/eeg/ +# https://pub.ist.ac.at/~schloegl/biosig/TESTED +# +############################################################################## +# +0 string ABF\x20 Biosig/Axon Binary format +!:mime biosig/abf2 +0 string ABF2\0\0 Biosig/Axon Binary format +!:mime biosig/abf2 +# +0 string ATES\x20MEDICA\x20SOFT.\x20EEG\x20for\x20Windows Biosig/ATES MEDICA SOFT. EEG for Windows +!:mime biosig/ates +# +0 string ATF\x09 Biosig/Axon Text fomrat +!:mime biosig/atf +# +0 string ADU1 Biosig/Axona file format +!:mime biosig/axona +0 string ADU2 Biosig/Axona file format +!:mime biosig/axona +# +0 string ALPHA-TRACE-MEDICAL Biosig/alpha trace +!:mime biosig/alpha +# +0 string AxGr Biosig/AXG +0 string axgx Biosig/AXG +!:mime biosig/axg +# +0 string HeaderLen= Biosig/BCI2000 +0 string BCI2000V Biosig/BCI2000 +!:mime biosig/bci2000 +# +### Specification: https://www.biosemi.com/faq/file_format.htm +0 string \xffBIOSEMI Biosig/Biosemi data format +!:mime biosig/bdf +# +0 string Brain\x20Vision\x20Data\x20Exchange\x20Header\x20File Biosig/Brainvision data file +0 string Brain\x20Vision\x20V-Amp\x20Data\x20Header\x20File\x20Version Biosig/Brainvision V-Amp file +0 string Brain\x20Vision\x20Data\x20Exchange\x20Marker\x20File,\x20Version Biosig/Brainvision Marker file +!:mime biosig/brainvision +# +0 string CEDFILE Biosig/CFS: Cambridge Electronic devices File format +!:mime biosig/ced +# +### Specification: https://www.edfplus.info/specs/index.html +0 string 0\x20\x20\x20\x20\x20\x20\x20 Biosig/EDF: European Data format +!:mime biosig/edf +# +### Specifications: https://arxiv.org/abs/cs/0608052 +0 string GDF Biosig/GDF: General data format for biosignals +!:mime biosig/gdf +# +0 string DATA\0\0\0\0 Biosig/Heka Patchmaster +0 string DAT1\0\0\0\0 Biosig/Heka Patchmaster +0 string DAT2\0\0\0\0 Biosig/Heka Patchmaster +!:mime biosig/heka +# +0 string (C)\x20CED\x2087 Biosig/CED SMR +!:mime biosig/ced-smr +# +0 string CFWB\1\0\0\0 Biosig/CFWB +!:mime biosig/cfwb +# +0 string DEMG Biosig/DEMG +!:mime biosig/demg +# +0 string EBS\x94\x0a\x13\x1a\x0d Biosig/EBS +!:mime biosig/ebs +# +0 string Embla\x20data\x20file Biosig/Embla +!:mime biosig/embla +# +0 string Header\r\nFile Version Biosig/ETG4000 +!:mime biosig/etg4000 +# +0 string GALILEO\x20EEG\x20TRACE\x20FILE Biosig/Galileo +!:mime biosig/galileo +# +0 string IGOR Biosig/IgorPro ITX file +!:mime biosig/igorpro +# +# Specification: http://www.ampsmedical.com/uploads/2017-12-7/The_ISHNE_Format.pdf +0 string ISHNE1.0 Biosig/ISHNE +!:mime biosig/ishne +# +# CEN/ISO 11073/22077 series, http://www.mfer.org/en/document.htm +0 string @\x20\x20MFER\x20 Biosig/MFER +0 string @\x20MFR\x20 Biosig/MFER +!:mime biosig/mfer +# +0 string NEURALEV Biosig/NEV +0 string N.EV.\0 Biosig/NEV +!:mime biosig/nev +# +0 string NEX1 Biosig/NEX +!:mime biosig/nex1 +# +0 string PLEX Biosig/Plexon v1.0 +10 string PLEXON Biosig/Plexon v2.0 +!:mime biosig/plexon +# +0 string \x02\x27\x91\xC6 Biosig/RHD2000: Intan RHD2000 format +# +# Specification: CEN 1064:2005/ISO 11073:91064 +16 string SCPECG\0\0 Biosig/SCP-ECG format CEN 1064:2005/ISO 11073:91064 +!:mime biosig/scpecg +# +0 string IAvSFo Biosig/SIGIF +!:mime biosig/sigif +# +0 string POLY\x20SAMPLE\x20FILEversion\x20 Biosig/TMS32 +!:mime biosig/tms32 +# +0 string FileId=TMSi\x20PortiLab\x20sample\x20log\x20file\x0a\x0dVersion= Biosig/TMSiLOG +!:mime biosig/tmsilog +# +4 string Synergy\0\48\49\50\46\48\48\51\46\48\48\48\46\48\48\48\0\28\0\0\0\2\0\0\0 +>63 string CRawDataElement +>>85 string CRawDataBuffer Biosig/SYNERGY +!:mime biosig/synergy +# +4 string \40\0\4\1\44\1\102\2\146\3\44\0\190\3 Biosig/UNIPRO +!:mime biosig/unipro +# +0 string VER=9\r\nCTIME= Biosig/WCP +!:mime biosig/wcp +# +0 string \xAF\xFE\xDA\xDA Biosig/Walter Graphtek +0 string \xDA\xDA\xFE\xAF Biosig/Walter Graphtek +0 string \x55\x55\xFE\xAF Biosig/Walter Graphtek +!:mime biosig/walter-graphtek +# +0 string V3.0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20 +>32 string [PatInfo] Biosig/Sigma +!:mime biosig/sigma +# +0 string \067\069\078\013\010\0x1a\04\0x84 Biosig/File exchange format (FEF) +!:mime biosig/fef +0 string \67\69\78\0x13\0x10\0x1a\4\0x84 Biosig/File exchange format (FEF) +!:mime biosig/fef +# +0 string \0\0\0\x64\0\0\0\x1f\0\0\0\x14\0\0\0\0\0\1 +>36 string \0\0\0\x65\0\0\0\3\0\0\0\4\0\0 +>>56 string \0\0\0\x6a\0\0\0\3\0\0\0\4\0\0\0\0\xff\xff\xff\xff\0\0 Biosig/FIFF +!:mime biosig/fiff +# diff --git a/contrib/file/magic/Magdir/blcr b/contrib/file/magic/Magdir/blcr index 70ea563e182d..d2f901ae921e 100644 --- a/contrib/file/magic/Magdir/blcr +++ b/contrib/file/magic/Magdir/blcr @@ -1,5 +1,5 @@ # Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files -# http://ftg.lbl.gov/checkpoint +# https://ftg.lbl.gov/checkpoint 0 string C\0\0\0R\0\0\0 BLCR >16 lelong 1 x86 >16 lelong 3 alpha diff --git a/contrib/file/magic/Magdir/blender b/contrib/file/magic/Magdir/blender index 09485702b15b..276242eab02f 100644 --- a/contrib/file/magic/Magdir/blender +++ b/contrib/file/magic/Magdir/blender @@ -1,10 +1,10 @@ #------------------------------------------------------------------------------ -# $File: blender,v 1.7 2017/03/17 21:35:28 christos Exp $ +# $File: blender,v 1.8 2019/04/19 00:42:27 christos Exp $ # blender: file(1) magic for Blender 3D related files # # Native format rule v1.2. For questions use the developers list -# http://lists.blender.org/mailman/listinfo/bf-committers +# https://lists.blender.org/mailman/listinfo/bf-committers # GLOB chunk was moved near start and provides subversion info since 2.42 0 string =BLENDER Blender3D, diff --git a/contrib/file/magic/Magdir/c-lang b/contrib/file/magic/Magdir/c-lang index 7b3f703ef3ec..becf6b02ecca 100644 --- a/contrib/file/magic/Magdir/c-lang +++ b/contrib/file/magic/Magdir/c-lang @@ -1,5 +1,5 @@ #------------------------------------------------------------------------------ -# $File: c-lang,v 1.26 2017/08/14 07:40:38 christos Exp $ +# $File: c-lang,v 1.27 2019/02/27 16:46:23 christos Exp $ # c-lang: file(1) magic for C and related languages programs # # The strength is to beat standard HTML @@ -12,31 +12,41 @@ # C # Check for class if include is found, otherwise class is beaten by include becouse of lowered strength -0 regex \^#include C ->0 regex \^class[[:space:]]+ ->>&0 regex \\{[\.\*]\\}(;)?$ \b++ ->&0 clear x source text +0 search/8192 #include +>0 regex \^#include C +>>0 regex \^class[[:space:]]+ +>>>&0 regex \\{[\.\*]\\}(;)?$ \b++ +>>&0 clear x source text !:strength + 13 !:mime text/x-c -0 regex \^#[[:space:]]*pragma C source text +0 search/8192 pragma +>0 regex \^#[[:space:]]*pragma C source text !:mime text/x-c -0 regex \^#[[:space:]]*(if\|ifn)def ->&0 regex \^#[[:space:]]*endif$ C source text +0 search/8192 endif +>0 regex \^#[[:space:]]*(if\|ifn)def +>>&0 regex \^#[[:space:]]*endif$ C source text !:mime text/x-c -0 regex \^#[[:space:]]*(if\|ifn)def ->&0 regex \^#[[:space:]]*define C source text +0 search/8192 define +>0 regex \^#[[:space:]]*(if\|ifn)def +>>&0 regex \^#[[:space:]]*define C source text !:mime text/x-c -0 regex \^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text +0 search/8192 char +>0 regex \^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text !:mime text/x-c -0 regex \^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text +0 search/8192 double +>0 regex \^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text !:mime text/x-c -0 regex \^[[:space:]]*extern[[:space:]]+ C source text +0 search/8192 extern +>0 regex \^[[:space:]]*extern[[:space:]]+ C source text !:mime text/x-c -0 regex \^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text +0 search/8192 float +>0 regex \^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text !:mime text/x-c -0 regex \^struct[[:space:]]+ C source text +0 search/8192 struct +>0 regex \^struct[[:space:]]+ C source text !:mime text/x-c -0 regex \^union[[:space:]]+ C source text +0 search/8192 union +>0 regex \^union[[:space:]]+ C source text !:mime text/x-c 0 search/8192 main( >&0 regex \\)[[:space:]]*\\{ C source text @@ -44,35 +54,44 @@ # C++ # The strength of these rules is increased so they beat the C rules above -0 regex \^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{ C++ source text +0 search/8192 namespace +>0 regex \^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{ C++ source text !:strength + 30 !:mime text/x-c++ # using namespace [namespace] or using std::[lib] -0 regex \^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*; C++ source text +0 search/8192 using +>0 regex \^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*; C++ source text !:strength + 30 !:mime text/x-c++ -0 regex \^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$ C++ source text +0 search/8192 template +>0 regex \^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$ C++ source text !:strength + 30 !:mime text/x-c++ -0 regex \^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$ C++ source text +0 search/8192 virtual +>0 regex \^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$ C++ source text !:strength + 30 !:mime text/x-c++ # But class alone is reduced to avoid beating php (Jens Schleusener) -0 regex \^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$ C++ source text +0 search/8192 class +>0 regex \^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$ C++ source text !:strength + 13 !:mime text/x-c++ -0 regex \^[[:space:]]*public: C++ source text +0 search/8192 public +>0 regex \^[[:space:]]*public: C++ source text !:strength + 30 !:mime text/x-c++ -0 regex \^[[:space:]]*private: C++ source text +0 search/8192 private +>0 regex \^[[:space:]]*private: C++ source text !:strength + 30 !:mime text/x-c++ -0 regex \^[[:space:]]*protected: C++ source text +0 search/8192 protected +>0 regex \^[[:space:]]*protected: C++ source text !:strength + 30 !:mime text/x-c++ # Objective-C -0 regex \^#import Objective-C source text +0 search/8192 #import +>0 regex \^#import Objective-C source text !:strength + 25 !:mime text/x-objective-c diff --git a/contrib/file/magic/Magdir/cad b/contrib/file/magic/Magdir/cad index 3a71e06b6901..48a76d14c976 100644 --- a/contrib/file/magic/Magdir/cad +++ b/contrib/file/magic/Magdir/cad @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: cad,v 1.16 2018/05/07 23:26:31 christos Exp $ +# $File: cad,v 1.19 2019/04/19 00:42:27 christos Exp $ # autocad: file(1) magic for cad files # @@ -11,12 +11,12 @@ # raster underlays to Microstation DGN (vector) drawings. # # http://www.wotsit.org/search.asp -# http://filext.com/detaillist.php?extdetail=DGN -# http://filext.com/detaillist.php?extdetail=CIT +# https://filext.com/detaillist.php?extdetail=DGN +# https://filext.com/detaillist.php?extdetail=CIT # -# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2 +# https://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2 # 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928 -# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 +# https://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 # 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F 0 string \010\011\376 Microstation >3 string \002 @@ -43,8 +43,8 @@ >4 string \030\000\003 CITFile # AutoCAD -# Merge of the different contributions and updates from http://en.wikipedia.org/wiki/Dwg -# and http://www.iana.org/assignments/media-types/image/vnd.dwg +# Merge of the different contributions and updates from https://en.wikipedia.org/wiki/Dwg +# and https://www.iana.org/assignments/media-types/image/vnd.dwg 0 string MC0.0 DWG AutoDesk AutoCAD Release 1.0 !:mime image/vnd.dwg 0 string AC1.2 DWG AutoDesk AutoCAD Release 1.2 @@ -89,7 +89,7 @@ # Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, # ICQ 358572321) # From various sources like: -# http://autodesk.blogs.com/between_the_lines/autocad-release-history.html +# https://autodesk.blogs.com/between_the_lines/autocad-release-history.html 0 string AC1018 DWG AutoDesk AutoCAD 2004/2005/2006 !:mime image/vnd.dwg 0 string AC1021 DWG AutoDesk AutoCAD 2007/2008/2009 @@ -102,13 +102,13 @@ # KOMPAS 2D drawing from ASCON # This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor # gathered nor specification -# ASCON http://ascon.net/main/ in English, -# http://ascon.ru/ main site in Russian +# ASCON https://ascon.net/main/ in English, +# https://ascon.ru/ main site in Russian # Extension is CDW for drawing and FRW for fragment of drawing # Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, -# ICQ 358572321, http://vkontakte.ru/id16076543) +# ICQ 358572321, https://vkontakte.ru/id16076543) # From: -# http://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292 +# https://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292 # (in russian) and my experiments 0 string KF >2 belong 0x4E00000C Kompas drawing 12.0 SP1 @@ -156,7 +156,7 @@ !:ext 3ds # MegaCAD 2D/3D drawing (.prt) -# http://megacad.de/ +# https://megacad.de/ # From: Markus Heidelberg 0 string MegaCad23\0 MegaCAD 2D/3D drawing @@ -167,3 +167,24 @@ 0 string ;;\020HSF\020V OpenHSF (Hoops Stream Format) >7 regex/9 V[.0-9]{4,5}\020 %s !:ext hsf + +# AutoCAD Drawing Exchange Format +0 regex \^[\ \t]*0\r?\000$ +>1 regex \^[\ \t]*SECTION\r?$ +>>2 regex \^[\ \t]*2\r?$ +>>>3 regex \^[\ \t]*HEADER\r?$ AutoCAD Drawing Exchange Format +!:mime application/x-dxf +!:ext dxf +>>>>&1 search/8192 AC1006 \b, R10 +>>>>&1 search/8192 AC1009 \b, R11/R12 +>>>>&1 search/8192 AC1012 \b, R13 +>>>>&1 search/8192 AC1014 \b, R14 +>>>>&1 search/8192 AC1015 \b, version 2000 +>>>>&1 search/8192 AC1018 \b, version 2004 +>>>>&1 search/8192 AC1021 \b, version 2007 +>>>>&1 search/8192 AC1024 \b, version 2010 + +# The Sketchup 3D model format https://www.sketchup.com/ +0 string \xff\xfe\xff\x0e\x53\x00\x6b\x00\x65\x00\x74\x00\x63\x00\x68\x00\x55\x00\x70\x00\x20\x00\x4d\x00\x6f\x00\x64\x00\x65\x00\x6c\x00 SketchUp Model +!:mime application/vnd.sketchup.skp +!:ext skp diff --git a/contrib/file/magic/Magdir/cafebabe b/contrib/file/magic/Magdir/cafebabe index 6482858fc62c..18dd1a27a39f 100644 --- a/contrib/file/magic/Magdir/cafebabe +++ b/contrib/file/magic/Magdir/cafebabe @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: cafebabe,v 1.23 2017/05/25 20:07:23 christos Exp $ +# $File: cafebabe,v 1.24 2018/10/01 23:33:15 christos Exp $ # Cafe Babes unite! # # Since Java bytecode and Mach-O universal binaries have the same magic number, @@ -58,15 +58,15 @@ >>4 belong <20 Mach-O universal binary with %d architectures: !:mime application/x-mach-binary >>>8 use mach-o \b ->>4 belong 2 +>>4 belong >1 >>>28 use mach-o \b ->>4 belong 3 +>>4 belong >2 >>>48 use mach-o \b ->>4 belong 4 +>>4 belong >3 >>>68 use mach-o \b ->>4 belong 5 +>>4 belong >4 >>>88 use mach-o \b ->>4 belong 6 +>>4 belong >5 >>>108 use mach-o \b ### MACH-O END ### diff --git a/contrib/file/magic/Magdir/clojure b/contrib/file/magic/Magdir/clojure new file mode 100644 index 000000000000..1f1cddf9a2db --- /dev/null +++ b/contrib/file/magic/Magdir/clojure @@ -0,0 +1,30 @@ +#------------------------------------------------------------------------------ +# file: file(1) magic for Clojure +# URL: https://clojure.org/ +# From: Jason Felice + +0 string/w #!\ /usr/bin/clj Clojure script text executable +!:mime text/x-clojure +0 string/w #!\ /usr/local/bin/clj Clojure script text executable +!:mime text/x-clojure +0 string/w #!\ /usr/bin/clojure Clojure script text executable +!:mime text/x-clojure +0 string/w #!\ /usr/local/bin/clojure Clojure script text executable +!:mime text/x-clojure +0 string/W #!/usr/bin/env\ clj Clojure script text executable +!:mime text/x-clojure +0 string/W #!/usr/bin/env\ clojure Clojure script text executable +!:mime text/x-clojure +0 string/W #!\ /usr/bin/env\ clj Clojure script text executable +!:mime text/x-clojure +0 string/W #!\ /usr/bin/env\ clojure Clojure script text executable +!:mime text/x-clojure + +0 regex \^\\\(ns[[:space:]]+[a-z] Clojure module source text +!:mime text/x-clojure + +0 regex \^\\\(ns[[:space:]]+\\\^\\{: Clojure module source text +!:mime text/x-clojure + +0 regex \^\\\(defn-?[[:space:]] Clojure module source text +!:mime text/x-clojure diff --git a/contrib/file/magic/Magdir/coff b/contrib/file/magic/Magdir/coff index b4addec58ffd..31b47e7aff42 100644 --- a/contrib/file/magic/Magdir/coff +++ b/contrib/file/magic/Magdir/coff @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: coff,v 1.2 2017/03/17 21:35:28 christos Exp $ +# $File: coff,v 1.3 2018/08/01 10:34:03 christos Exp $ # coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures # # COFF @@ -26,6 +26,10 @@ >>0 uleshort 0x0550 Hitachi SH little-endian # executable (RISC System/6000 V3.1) or obj module (./ibm6000) #>>0 uleshort 0x01DF +# MS Windows COFF Intel Itanium, AMD64 +# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=vs.85).aspx +>>0 uleshort 0x0200 Intel ia64 +>>0 uleshort 0x8664 Intel amd64 # TODO for other COFFs #>>0 uleshort 0xABCD COFF_TEMPLATE >>0 default x diff --git a/contrib/file/magic/Magdir/commands b/contrib/file/magic/Magdir/commands index f6ad1c878a31..1120c7d06f6b 100644 --- a/contrib/file/magic/Magdir/commands +++ b/contrib/file/magic/Magdir/commands @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: commands,v 1.59 2017/08/14 07:40:38 christos Exp $ +# $File: commands,v 1.60 2019/04/19 00:42:27 christos Exp $ # commands: file(1) magic for various shells and interpreters # #0 string/w : shell archive or script for antique kernel text @@ -96,7 +96,7 @@ 0 search/1/w #!\ /usr/bin/php PHP script text executable !:strength + 10 !:mime text/x-php -# Smarty compiled template, http://www.smarty.net/ +# Smarty compiled template, https://www.smarty.net/ # Elan Ruusamae 0 string =5 regex [\ \n] @@ -109,7 +109,7 @@ 0 string/t $! DCL command file # Type: Pdmenu -# URL: http://packages.debian.org/pdmenu +# URL: https://packages.debian.org/pdmenu # From: Edward Betts 0 string #!/usr/bin/pdmenu Pdmenu configuration file text diff --git a/contrib/file/magic/Magdir/compress b/contrib/file/magic/Magdir/compress index 107d317c1537..7520eb4ab0f1 100644 --- a/contrib/file/magic/Magdir/compress +++ b/contrib/file/magic/Magdir/compress @@ -1,5 +1,5 @@ #------------------------------------------------------------------------------ -# $File: compress,v 1.72 2018/03/27 23:26:41 christos Exp $ +# $File: compress,v 1.75 2019/04/19 00:42:27 christos Exp $ # compress: file(1) magic for pure-compression formats (no archives) # # compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc. @@ -16,13 +16,78 @@ >2 byte&0x1f x %d bits # gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver) +# URL: https://en.wikipedia.org/wiki/Gzip +# Reference: https://tools.ietf.org/html/rfc1952 +# Update: Joerg Jenderek, Apr 2019 # Edited by Chris Chittleborough , March 2002 # * Original filename is only at offset 10 if "extra field" absent # * Produce shorter output - notably, only report compression methods # other than 8 ("deflate", the only method defined in RFC 1952). -0 string \037\213 gzip compressed data -!:mime application/x-gzip -!:strength * 2 +# Note: find defs -iname '*.trid.xml' -exec grep -q '1F8B08' {} \; -ls +# TODO: +# FBR Blueberry FlashBack screen Record https://www.flashbackrecorder.com/ +# KPR KOffice/Calligra KPresenter application/x-kpresenter +# KPT KOffice/Calligra KPresenter template? application/x-kpresenter +# SAV Diggles Saved Game File http://www.innonics.com +# SAV FarCry (demo) saved game http://www.farcry-thegame.com +# DAT ZOAGZIP game data format http://en.wikipedia.org/wiki/SD_Gundam_Capsule_Fighter +0 string \037\213 +# to display gzip compressed (strength=100=2*50) before other (strength=50)? +#!:strength * 2 +# no FNAME and FCOMMENT bit implies no file name/comment. That means only binary +>3 byte&0x18 =0 +# For binary gzipped no ASCII text should occur +# mcd-monu-cad.trid.xml +>>10 string MCD Monu-Cad Drawing, Component or Font +#>>36 string Created\ with\ MONU-CAD +#!:mime application/octet-stream +# http://fileformats.archiveteam.org/wiki/Monu-CAD +# http://www.monucad.com/downloads/FullDemo-2005.EXE +# /HANDS96.MCC Component +# /DEMO_DD01.MCD Drawing +# /MCALF020.FNT Font +!:ext mcc/mcd/fnt +# http://www.generalcadd.com +>>10 string GXD General CADD, Drawing or Component +#!:mime application/octet-stream +# /gxc/BUILDINGEDGE.gxc Component +# /gxd/HOCKETT-STPAUL-WRHSE.gxd Drawing +# /gxd/POWERLAND-MILL-ADD-11.gxd Drawing v9.1.06 +!:ext gxc/gxd +#>>>13 ubyte 0 \b, version 0 +>>>13 string 09 \b, version 9 +# other gzipped binary like gzipped tar, VirtualBox extension package,... +>>10 default x gzip compressed data +>>>0 use gzip-info +# size of the original (uncompressed) input data modulo 2^32 +>>>-4 ulelong x \b, original size modulo 2^32 %u +# gzipped TAR or VirtualBox extension package +!:mime application/gzip +#!:mime application/x-compressed-tar +#!:mime application/x-virtualbox-vbox-extpack +# https://www.w3.org/TR/SVG/mimereg.html +#!:mime image/image/svg+xml-compressed +# zlib.3.gz +# microcode-20180312.tgz +# tpz same as tgz +# lua-md5_1.2-1_i386_i486.ipk https://en.wikipedia.org/wiki/Opkg +# Oracle_VM_VirtualBox_Extension_Pack-5.0.12-104815.vbox-extpack +!:ext gz/tgz/tpz/ipk/vbox-extpack/svgz +# FNAME/FCOMMENT bit implies file name/comment as iso-8859-1 text +>3 byte&0x18 >0 gzip compressed data +!:mime application/gzip +# gzipped tar, gzipped Abiword document +#!:mime application/x-compressed-tar +#!:mime application/x-abiword-compressed +#!:mime image/image/svg+xml-compressed +# kleopatra_splashscreen.svgz gzipped .svg +!:ext gz/tgz/tpz/zabw/svgz +>>0 use gzip-info +# size of the original (uncompressed) input data modulo 2^32 +>>-4 ulelong x \b, original size modulo 2^32 %u +# display information of gzip compressed files +0 name gzip-info +#>2 byte x THIS iS GZIP >2 byte <8 \b, reserved method >2 byte >8 \b, unknown method >3 byte &0x01 \b, ASCII @@ -49,7 +114,9 @@ >9 byte =0x0B \b, from NTFS filesystem (NT) >9 byte =0x0C \b, from QDOS >9 byte =0x0D \b, from Acorn RISCOS ->-4 lelong x \b, original size %d +# size of the original (uncompressed) input data modulo 2^32 +#>-4 ulelong x \b, original size modulo 2^32 %u +#ERROR: line 114: non zero offset 1048572 at level 1 # packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis 0 string \037\036 packed data @@ -160,7 +227,7 @@ >>17 byte =0x0E os: Win32 # 4.3BSD-Quasijarus Strong Compression -# http://minnie.tuhs.org/Quasijarus/compress.html +# https://minnie.tuhs.org/Quasijarus/compress.html 0 string \037\241 Quasijarus strong compressed data # From: Cory Dikkers @@ -174,7 +241,7 @@ >4 belong 0x090A0C0D best compression # 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at) -# http://www.7-zip.org or DOC/7zFormat.txt +# https://www.7-zip.org or DOC/7zFormat.txt # 0 string 7z\274\257\047\034 7-zip archive data, >6 byte x version %d @@ -203,7 +270,7 @@ >5 byte x \b.%d !:mime application/x-lrzip -# http://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html +# https://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html 0 lelong 0x184d2204 LZ4 compressed data (v1.4+) !:mime application/x-lz4 # Added by osm0sis@xda-developers.com @@ -292,11 +359,11 @@ >0x8 lelong x \b, %u entries # Snappy framing format -# http://code.google.com/p/snappy/source/browse/trunk/framing_format.txt +# https://code.google.com/p/snappy/source/browse/trunk/framing_format.txt 0 string \377\006\0\0sNaPpY snappy framed data !:mime application/x-snappy-framed -# qpress, http://www.quicklz.com/ +# qpress, https://www.quicklz.com/ 0 string qpress10 qpress compressed data !:mime application/x-qpress diff --git a/contrib/file/magic/Magdir/console b/contrib/file/magic/Magdir/console index ab2954f0b5af..5e5e5816ecc9 100644 --- a/contrib/file/magic/Magdir/console +++ b/contrib/file/magic/Magdir/console @@ -1,14 +1,14 @@ #------------------------------------------------------------------------------ -# $File: console,v 1.40 2018/06/23 16:40:40 christos Exp $ +# $File: console,v 1.45 2019/04/19 00:42:27 christos Exp $ # Console game magic # Toby Deshane # ines: file(1) magic for Marat's iNES Nintendo Entertainment System ROM dump format # Updated by David Korth # References: -# - http://wiki.nesdev.com/w/index.php/INES -# - http://wiki.nesdev.com/w/index.php/NES_2.0 +# - https://wiki.nesdev.com/w/index.php/INES +# - https://wiki.nesdev.com/w/index.php/NES_2.0 # Common header for iNES, NES 2.0, and Wii U iNES. 0 name nes-rom-image-ines @@ -57,7 +57,7 @@ #------------------------------------------------------------------------------ # unif: file(1) magic for UNIF-format Nintendo Entertainment System ROM images -# Reference: http://wiki.nesdev.com/w/index.php/UNIF +# Reference: https://wiki.nesdev.com/w/index.php/UNIF # From: David Korth # # NOTE: The UNIF format uses chunks instead of a fixed header, @@ -69,7 +69,7 @@ #------------------------------------------------------------------------------ # fds: file(1) magic for Famciom Disk System disk images -# Reference: http://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format +# Reference: https://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format # From: David Korth # TODO: Check "Disk info block" and get info from that in addition to the optional header. @@ -186,7 +186,7 @@ # genesis: file(1) magic for various Sega Mega Drive / Genesis ROM image and disc formats # Updated by David Korth # References: -# - http://www.retrodev.com/segacd.html +# - https://www.retrodev.com/segacd.html # - http://devster.monkeeh.com/sega/32xguide1.txt # @@ -269,7 +269,7 @@ # Detects all Game Gear and export Sega Master System ROM images, # and some Japanese Sega Master System ROM images. # From: David Korth -# Reference: http://www.smspower.org/Development/ROMHeader +# Reference: https://www.smspower.org/Development/ROMHeader # # General SMS header rule. @@ -359,7 +359,7 @@ #------------------------------------------------------------------------------ # dreamcast: file(1) magic for the Sega Dreamcast disc image format. # From: David Korth -# Reference: http://mc.pp.se/dc/ip0000.bin.html +# Reference: https://mc.pp.se/dc/ip0000.bin.html # # Common Sega Dreamcast disc header format. @@ -422,7 +422,7 @@ #------------------------------------------------------------------------------ # gba: file(1) magic for the Nintendo Game Boy Advance raw ROM format -# Reference: http://problemkaputt.de/gbatek.htm#gbacartridgeheader +# Reference: https://problemkaputt.de/gbatek.htm#gbacartridgeheader # # Original version from: "Nelson A. de Oliveira" # Updated version from: David Korth @@ -435,7 +435,7 @@ #------------------------------------------------------------------------------ # nds: file(1) magic for the Nintendo DS(i) raw ROM format -# Reference: http://problemkaputt.de/gbatek.htm#dscartridgeheader +# Reference: https://problemkaputt.de/gbatek.htm#dscartridgeheader # # Original version from: "Nelson A. de Oliveira" # Updated version from: David Korth @@ -469,7 +469,7 @@ # From: David Korth # References: # - https://neogpc.googlecode.com/svn-history/r10/trunk/src/core/neogpc.cpp -# - http://www.devrs.com/ngp/files/ngpctech.txt +# - https://www.devrs.com/ngp/files/ngpctech.txt # 0x0A string BY\ SNK\ CORPORATION Neo Geo Pocket !:mime application/x-neo-geo-pocket-rom @@ -507,7 +507,21 @@ #------------------------------------------------------------------------------ # Microsoft Xbox executables .xbe (Esa Hyytia ) -0 string XBEH XBE, Microsoft Xbox executable +0 string XBEH Microsoft Xbox executable +# expect base address of 0x10000 +>0x0104 ulelong =0x10000 +>>(0x0118.l-0x0FFF4) lestring16 x \b: "%.40s" +>>(0x0118.l-0x0FFF5) byte x (%c +>>(0x0118.l-0x0FFF6) byte x \b%c- +>>(0x0118.l-0x0FFF8) uleshort x \b%03u) +>>(0x0118.l-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions +>>(0x0118.l-0x0FF60) ulelong&0x80000007 !0x80000007 +>>>(0x0118.l-0x0FF60) ulelong >0 (regions: +>>>>(0x0118.l-0x0FF60) ulelong &0x00000001 NA +>>>>(0x0118.l-0x0FF60) ulelong &0x00000002 Japan +>>>>(0x0118.l-0x0FF60) ulelong &0x00000004 Rest_of_World +>>>>(0x0118.l-0x0FF60) ulelong &0x80000000 Manufacturer +>>>(0x0118.l-0x0FF60) ulelong >0 \b) # probabilistic checks whether signed or not >0x0004 ulelong =0x0 >>&2 ulelong =0x0 @@ -515,22 +529,43 @@ >0x0004 ulelong >0 >>&2 ulelong >0 >>>&2 ulelong >0 \b, signed -# expect base address of 0x10000 ->0x0104 ulelong =0x10000 ->>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions ->>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007 ->>>(0x0118-0x0FF60) ulelong >0 (regions: ->>>>(0x0118-0x0FF60) ulelong &0x00000001 NA ->>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan ->>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World ->>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer ->>>(0x0118-0x0FF60) ulelong >0 \b) # -------------------------------- # Microsoft Xbox data file formats 0 string XIP0 XIP, Microsoft Xbox data 0 string XTF0 XTF, Microsoft Xbox data +#------------------------------------------------------------------------------ +# Microsoft Xbox 360 executables (.xex) +# From: David Korth +# References: +# - https://free60project.github.io/wiki/XEX.html +# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h + +# Title ID (part of Execution ID section) +0 name xbox-360-xex-execution-id +>(0.L+0xC) byte x (%c +>(0.L+0xD) byte x \b%c +>(0.L+0xE) beshort x \b-%04u) + +0 string XEX2 Microsoft Xbox 360 executable +>0x18 search/0x100 \x00\x04\x00\x06 +>>&0 use xbox-360-xex-execution-id +>(0x010.L+0x178) ubelong 0xFFFFFFFF \b, all regions +>(0x010.L+0x178) ubelong !0xFFFFFFFF +>>(0x010.L+0x178) ubelong >0 (regions: +>>(0x010.L+0x178) ubelong&0x000000FF 0x000000FF USA +>>(0x010.L+0x178) ubelong&0x00000100 0x00000100 Japan +>>(0x010.L+0x178) ubelong&0x00000200 0x00000200 China +>>(0x010.L+0x178) ubelong&0x0000FC00 0x0000FC00 Asia +>>(0x010.L+0x178) ubelong&0x00FF0000 0x00FF0000 PAL +>>(0x010.L+0x178) ubelong&0x00FF0000 0x00FE0000 PAL [except AU/NZ] +>>(0x010.L+0x178) ubelong&0x00FF0000 0x00010000 AU/NZ +>>(0x010.L+0x178) ubelong&0xFF000000 0xFF000000 Other +>>(0x010.L+0x178) ubelong >0 \b) + + + # Atari Lynx cartridge dump (EXE/BLL header) # From: "Stefan A. Haubenthal" @@ -563,7 +598,7 @@ >4 byte x %u tracks # IPS Patch Files from: From: Thomas Klausner -# see http://zerosoft.zophar.net/ips.php +# see https://zerosoft.zophar.net/ips.php 0 string PATCH IPS patch file # Playstations Patch Files from: From: Thomas Klausner @@ -654,7 +689,7 @@ # Type: Nintendo GameCube/Wii common disc header data. # From: David Korth -# Reference: http://wiibrew.org/wiki/Wii_Disc +# Reference: https://wiibrew.org/wiki/Wii_Disc 0 name nintendo-gcn-disc-common >0x20 string x "%.64s" >0x00 string x (%.6s @@ -668,7 +703,7 @@ # Type: Nintendo GameCube disc image # From: David Korth -# Reference: http://wiibrew.org/wiki/Wii_Disc +# Reference: https://wiibrew.org/wiki/Wii_Disc 0x1C belong 0xC2339F3D Nintendo GameCube disc image: !:mime application/x-gamecube-rom >0 use nintendo-gcn-disc-common @@ -685,13 +720,13 @@ # Type: Nintendo Wii disc image # From: David Korth -# Reference: http://wiibrew.org/wiki/Wii_Disc +# Reference: https://wiibrew.org/wiki/Wii_Disc 0x18 belong 0x5D1C9EA3 Nintendo Wii disc image: >0 use nintendo-gcn-disc-common # Type: Nintendo Wii disc image (WBFS format) # From: David Korth -# Reference: http://wiibrew.org/wiki/Wii_Disc +# Reference: https://wiibrew.org/wiki/Wii_Disc 0 string WBFS >0x218 belong 0x5D1C9EA3 Nintendo Wii disc image (WBFS format): !:mime application/x-wii-rom @@ -754,13 +789,15 @@ # Type: Nintendo GameCube/Wii disc image (with SDK header) # From: David Korth -# Reference: http://wiibrew.org/wiki/Wii_Disc +# Reference: https://wiibrew.org/wiki/Wii_Disc 0 belong 0xFFFF0000 >0x18 belong 0x00000000 >>0x1C belong 0x00000000 >>>0x8018 belong 0x5D1C9EA3 Nintendo Wii SDK disc image: +!:mime application/x-wii-rom >>>>0x8000 use nintendo-gcn-disc-common >>>0x801C belong 0xC2339F3D Nintendo GameCube SDK disc image: +!:mime application/x-gamecube-rom >>>>0x8000 use nintendo-gcn-disc-common #------------------------------------------------------------------------------ diff --git a/contrib/file/magic/Magdir/coverage b/contrib/file/magic/Magdir/coverage index 6dd36fa61101..69eab704933c 100644 --- a/contrib/file/magic/Magdir/coverage +++ b/contrib/file/magic/Magdir/coverage @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: coverage,v 1.1 2016/06/05 00:26:32 christos Exp $ +# $File: coverage,v 1.2 2019/04/19 00:42:27 christos Exp $ # xoverage: file(1) magic for test coverage data # File formats used to store test coverage data @@ -67,7 +67,7 @@ # `clang -fprofile-instr-generate -fcoverage-mapping ...` # default name: default.profraw # magic is: \xFF lprofr \x81 -# cf. http://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html +# cf. https://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html 0 lequad 0xff6c70726f667281 LLVM raw profile data, >&0 byte x version %d @@ -78,10 +78,10 @@ # LLVM indexed instruction profile (as generated by llvm-profdata) # magic is: reverse(\xFF lprofi \x81) -# cf. http://llvm.org/docs/CoverageMappingFormat.html -# http://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html -# http://llvm.org/docs/CommandGuide/llvm-cov.html -# http://llvm.org/docs/CommandGuide/llvm-profdata.html +# cf. https://llvm.org/docs/CoverageMappingFormat.html +# https://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html +# https://llvm.org/docs/CommandGuide/llvm-cov.html +# https://llvm.org/docs/CommandGuide/llvm-profdata.html 0 lequad 0x8169666f72706cff LLVM indexed profile data, >&0 byte x version %d diff --git a/contrib/file/magic/Magdir/ctf b/contrib/file/magic/Magdir/ctf index 37fdd1b60d23..ebea8f316961 100644 --- a/contrib/file/magic/Magdir/ctf +++ b/contrib/file/magic/Magdir/ctf @@ -2,7 +2,7 @@ #-------------------------------------------------------------- # ctf: file(1) magic for CTF (Common Trace Format) trace files # -# Specs. available here: +# Specs. available here: #-------------------------------------------------------------- # CTF trace data diff --git a/contrib/file/magic/Magdir/cups b/contrib/file/magic/Magdir/cups index a065de39637d..6dd14ac5a5a2 100644 --- a/contrib/file/magic/Magdir/cups +++ b/contrib/file/magic/Magdir/cups @@ -1,9 +1,9 @@ #------------------------------------------------------------------------------ -# $File: cups,v 1.5 2017/03/17 21:35:28 christos Exp $ +# $File: cups,v 1.6 2019/04/19 00:42:27 christos Exp $ # Cups: file(1) magic for the cups raster file format # From: Laurent Martelli -# http://www.cups.org/documentation.php/spec-raster.html +# https://www.cups.org/documentation.php/spec-raster.html # 0 name cups-le diff --git a/contrib/file/magic/Magdir/database b/contrib/file/magic/Magdir/database index dd88f25e9d7c..071a1156485b 100644 --- a/contrib/file/magic/Magdir/database +++ b/contrib/file/magic/Magdir/database @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: database,v 1.54 2018/06/23 16:37:21 christos Exp $ +# $File: database,v 1.55 2019/04/19 00:42:27 christos Exp $ # database: file(1) magic for various databases # # extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) @@ -147,8 +147,8 @@ ## XBase database files # updated by Joerg Jenderek at Feb 2013 -# http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm -# http://www.clicketyclick.dk/databases/xbase/format/dbf.html +# https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm +# https://www.clicketyclick.dk/databases/xbase/format/dbf.html # http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm # inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 0 ubelong&0x0000FFFF <0x00000C20 @@ -187,13 +187,13 @@ >>>>>>>>>>>>4 lelong >0 \b, %d record # plural s appended >>>>>>>>>>>>>4 lelong >1 \bs -# http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF +# https://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF # 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000) >>>>>>>>>>>>10 uleshort x * %d # file size = records * record size + header size >>>>>>>>>>>>1 ubyte x \b, update-date >>>>>>>>>>>>1 use xbase-date -# http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx +# https://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx #>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x # 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ? >>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x @@ -261,13 +261,13 @@ # dBASE IV SQL, no memo;dbv memo var size (Flagship) >>0 ubyte 0x43 dBase IV, with SQL table !:mime application/x-dbf -# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx +# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0x62 dBase IV, with SQL table #!:mime application/x-dbf # dBASE IV, with memo!! >>0 ubyte 0x7b dBase IV, with memo !:mime application/x-dbf -# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx +# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0x82 dBase IV, with SQL system #!:mime application/x-dbf # FoxBase+/dBaseIII+ with memo .DBT! @@ -276,7 +276,7 @@ # VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file >>0 ubyte 0x87 VISUAL OBJECTS, with memo file !:mime application/x-dbf -# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx +# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT #!:mime application/x-dbf # dBASE IV with memo! @@ -287,7 +287,7 @@ !:mime application/x-dbf # .dbv and .dbt memo (Flagship)? >>0 ubyte 0xB3 Flagship -# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx +# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0xCA dBase IV with memo .DBT #!:mime application/x-dbf # dBASE IV with SQL table, with memo .DBT @@ -296,12 +296,12 @@ # HiPer-Six format;Clipper SIX, with SMT memo file >>0 ubyte 0xE5 Clipper SIX with memo !:mime application/x-dbf -# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx +# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0xF4 dBase IV, with SQL table, with memo #!:mime application/x-dbf >>0 ubyte 0xF5 FoxPro with memo !:mime application/x-dbf -# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx +# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0xFA FoxPro 2.x, with memo #!:mime application/x-dbf # unknown version (should not happen) @@ -332,7 +332,7 @@ >>>>>2 ubyte x \b-%d # dBase memo files .DBT or .FPT -# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx +# https://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx 16 ubyte <4 >16 ubyte !2 >>16 ubyte !1 @@ -495,7 +495,7 @@ >>220 ulelong x \b.%d # From: Joerg Jenderek -# URL: http://forensicswiki.org/wiki/Windows_Application_Compatibility +# URL: https://forensicswiki.org/wiki/Windows_Application_Compatibility # Note: files contain application compatibility fixes, application compatibility modes and application help messages. 8 string sdbf >7 ubyte 0 @@ -542,7 +542,7 @@ >>7 byte x \b-%d # Type: Advanced Data Format (ADF) database -# URL: http://www.grc.nasa.gov/WWW/cgns/adf/ +# URL: https://www.grc.nasa.gov/WWW/cgns/adf/ # From: Nicolas Chauvat 0 string @(#)ADF\ Database CGNS Advanced Data Format @@ -582,7 +582,7 @@ 0 string ToKyO\ CaBiNeT\n TokyoCabinet database >14 string x (version %s) -# From: Stephane Blondon http://www.yaal.fr +# From: Stephane Blondon https://www.yaal.fr # Database file for Zope (done by FileStorage) 0 string FS21 Zope Object Database File Storage v3 (data) 0 string FS30 Zope Object Database File Storage v4 (data) @@ -593,7 +593,7 @@ # IDA (Interactive Disassembler) database 0 string IDA1 IDA (Interactive Disassembler) database -# Hopper (reverse engineering tool) http://www.hopperapp.com/ +# Hopper (reverse engineering tool) https://www.hopperapp.com/ 0 string hopperdb Hopper database # URL: https://en.wikipedia.org/wiki/Panorama_(database_engine) diff --git a/contrib/file/magic/Magdir/dataone b/contrib/file/magic/Magdir/dataone index 8bbe87aac141..8ef3f798163f 100644 --- a/contrib/file/magic/Magdir/dataone +++ b/contrib/file/magic/Magdir/dataone @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: dataone,v 1.1 2018/06/06 01:16:40 christos Exp $ +# $File: dataone,v 1.2 2019/04/19 00:42:27 christos Exp $ # # DataONE- files from Dave Vieglais & # Pratik Shrivastava @@ -13,35 +13,35 @@ >&0 regex (eml)-[0-9].[0-9].[0-9]+ eml://ecoinformatics.org/%s # onedcx (DataONE Dublin Core Extended v1.0) ->&0 regex (onedcx/v)[0-9].[0-9]+ http://ns.dataone.org/metadata/schema/onedcx/v1.0 +>&0 regex (onedcx/v)[0-9].[0-9]+ https://ns.dataone.org/metadata/schema/onedcx/v1.0 # FGDC-STD-001-1998 (Content Standard for Digital Geospatial Metadata, # version 001-1998) >&0 regex fgdc FGDC-STD-001-1998 # Mercury (Oak Ridge National Lab Mercury Metadata version 1.0) ->&0 regex (mercury/terms/v)[0-9].[0-9] http://purl.org/ornl/schema/mercury/terms/v1.0 +>&0 regex (mercury/terms/v)[0-9].[0-9] https://purl.org/ornl/schema/mercury/terms/v1.0 # ISOTC211 (Geographic MetaData (GMD) Extensible Markup Language) >&0 regex isotc211 ->>&0 regex eng;USA http://www.isotc211.org/2005/gmd +>>&0 regex eng;USA https://www.isotc211.org/2005/gmd # ISOTC211 (NOAA Variant Geographic MetaData (GMD) Extensible Markup Language) ->>&0 regex gov.noaa.nodc:[0-9]+ http://www.isotc211.org/2005/gmd-noaa +>>&0 regex gov.noaa.nodc:[0-9]+ https://www.isotc211.org/2005/gmd-noaa # ISOTC211 PANGAEA Variant Geographic MetaData (GMD) Extensible Markup Language ->>&0 regex pangaea.dataset[0-9][0-9][0-9][0-9][0-9][0-9]+ http://www.isotc211.org/2005/gmd-pangaea +>>&0 regex pangaea.dataset[0-9][0-9][0-9][0-9][0-9][0-9]+ https://www.isotc211.org/2005/gmd-pangaea !:mime text/xml # Object Reuse and Exchange Vocabulary 0 string &0 regex rdf ->>&0 regex openarchives http://www.openarchives.org/ore/terms +>>&0 regex openarchives https://www.openarchives.org/ore/terms !:mime application/rdf+xml # Dryad Metadata Application Profile Version 3.1 0 string &0 regex (dryad-bibo/v)[0-9].[0-9] http://datadryad.org/profile/v3.1 +>&0 regex (dryad-bibo/v)[0-9].[0-9] https://datadryad.org/profile/v3.1 !:mime text/xml diff --git a/contrib/file/magic/Magdir/dbpf b/contrib/file/magic/Magdir/dbpf index 8545720dae50..df07ff809a43 100644 --- a/contrib/file/magic/Magdir/dbpf +++ b/contrib/file/magic/Magdir/dbpf @@ -1,9 +1,9 @@ #------------------------------------------------------------------------------ -# $File: dbpf,v 1.2 2018/05/24 18:54:40 christos Exp $ +# $File: dbpf,v 1.3 2019/04/19 00:42:27 christos Exp $ # dppf: Maxis Database Packed Files, the stored data file format used by all # Maxis games after the Sims: http://wiki.niotso.org/DBPF -# http://www.wiki.sc4devotion.com/index.php?title=DBPF +# https://www.wiki.sc4devotion.com/index.php?title=DBPF # 13 Oct 2017, Kip Warner 0 string DBPF Maxis Database Packed File >4 ulelong x \b, version: %u. diff --git a/contrib/file/magic/Magdir/dolby b/contrib/file/magic/Magdir/dolby index 8034eddc2a8f..d73e7d35f999 100644 --- a/contrib/file/magic/Magdir/dolby +++ b/contrib/file/magic/Magdir/dolby @@ -1,8 +1,8 @@ #------------------------------------------------------------------------------ -# $File: dolby,v 1.8 2017/03/17 21:35:28 christos Exp $ +# $File: dolby,v 1.9 2019/04/19 00:42:27 christos Exp $ # ATSC A/53 aka AC-3 aka Dolby Digital -# from http://www.atsc.org/standards/a_52a.pdf +# from https://www.atsc.org/standards/a_52a.pdf # corrections, additions, etc. are always welcome! # # syncword diff --git a/contrib/file/magic/Magdir/dyadic b/contrib/file/magic/Magdir/dyadic index 185970e4ee00..c57f81b7cbbb 100644 --- a/contrib/file/magic/Magdir/dyadic +++ b/contrib/file/magic/Magdir/dyadic @@ -1,11 +1,11 @@ #------------------------------------------------------------------------------ -# $File: dyadic,v 1.8 2017/03/17 21:35:28 christos Exp $ +# $File: dyadic,v 1.9 2019/04/19 00:42:27 christos Exp $ # Dyadic: file(1) magic for Dyalog APL. # # updated by Joerg Jenderek at Oct 2013 -# http://en.wikipedia.org/wiki/Dyalog_APL -# http://www.dyalog.com/ +# https://en.wikipedia.org/wiki/Dyalog_APL +# https://www.dyalog.com/ # .DXV Dyalog APL External Variable # .DIN Dyalog APL Input Table # .DOT Dyalog APL Output Table diff --git a/contrib/file/magic/Magdir/ebml b/contrib/file/magic/Magdir/ebml index d5d174329a52..d37b5c0b23f1 100644 --- a/contrib/file/magic/Magdir/ebml +++ b/contrib/file/magic/Magdir/ebml @@ -1,8 +1,8 @@ #------------------------------------------------------------------------------ -# $File: ebml,v 1.1 2010/07/02 00:07:03 christos Exp $ +# $File: ebml,v 1.2 2019/04/19 00:42:27 christos Exp $ # ebml: file(1) magic for various Extensible Binary Meta Language -# http://www.matroska.org/technical/specs/index.html#track +# https://www.matroska.org/technical/specs/index.html#track 0 belong 0x1a45dfa3 EBML file >4 search/b/100 \102\202 >>&1 string x \b, creator %.8s diff --git a/contrib/file/magic/Magdir/edid b/contrib/file/magic/Magdir/edid new file mode 100644 index 000000000000..a17b6c4ea728 --- /dev/null +++ b/contrib/file/magic/Magdir/edid @@ -0,0 +1,11 @@ + +#------------------------------------------------------------------------------ +# $File: edid,v 1.1 2019/03/28 12:36:01 christos Exp $ +# edid: file(1) magic for EDID dump files + +0 quad 0x00ffffffffffff00 Extended display identification data dump +!:mime application/x-edid-dump +>18 byte 0x01 Version 1 +>>19 byte <0x04 \b.%d +>18 byte 0x02 Version 2 +>>19 byte 0x00 \b.0 diff --git a/contrib/file/magic/Magdir/elf b/contrib/file/magic/Magdir/elf index d57e9ea00f6f..efb68459c93d 100644 --- a/contrib/file/magic/Magdir/elf +++ b/contrib/file/magic/Magdir/elf @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: elf,v 1.74 2018/06/23 16:39:53 christos Exp $ +# $File: elf,v 1.77 2019/01/16 19:33:35 christos Exp $ # elf: file(1) magic for ELF executables # # We have to check the byte order flag to see what byte order all the @@ -38,6 +38,8 @@ >0 lelong&0x3 2 relaxed memory ordering, 0 name elf-pa-risc +>2 leshort 0x0208 1.0 +>2 leshort 0x0210 1.1 >2 leshort 0x0214 2.0 >0 leshort &0x0008 (LP64) @@ -265,6 +267,8 @@ >18 leshort 217 iCelero CoolEngine, >18 leshort 218 Nanoradio Optimized RISC, >18 leshort 243 UCB RISC-V, +>18 leshort 247 eBPF, +>18 leshort 251 NEC VE, >18 leshort 0x1057 AVR (unofficial), >18 leshort 0x1059 MSP430 (unofficial), >18 leshort 0x1223 Adapteva Epiphany (unofficial), diff --git a/contrib/file/magic/Magdir/erlang b/contrib/file/magic/Magdir/erlang index b604a06828f1..df7aa2aac8ad 100644 --- a/contrib/file/magic/Magdir/erlang +++ b/contrib/file/magic/Magdir/erlang @@ -1,8 +1,8 @@ #------------------------------------------------------------------------------ -# $File: erlang,v 1.6 2010/09/20 19:19:17 rrt Exp $ +# $File: erlang,v 1.7 2019/04/19 00:42:27 christos Exp $ # erlang: file(1) magic for Erlang JAM and BEAM files -# URL: http://www.erlang.org/faq/x779.html#AEN812 +# URL: https://www.erlang.org/faq/x779.html#AEN812 # OTP R3-R4 0 string \0177BEAM! Old Erlang BEAM file diff --git a/contrib/file/magic/Magdir/espressif b/contrib/file/magic/Magdir/espressif new file mode 100644 index 000000000000..72a0ec9b4f34 --- /dev/null +++ b/contrib/file/magic/Magdir/espressif @@ -0,0 +1,57 @@ + +# $File: espressif,v 1.1 2018/11/20 18:57:17 christos Exp $ +# configuration dump of Tasmota firmware for ESP8266 based devices by Espressif +# URL: https://github.com/arendst/Sonoff-Tasmota/ +# Reference: https://codeload.github.com/arendst/Sonoff-Tasmota/zip/release-6.2/ +# Sonoff-Tasmota-release-6.2.zip/Sonoff-Tasmota-release-6.2/sonoff/settings.h +# From: Joerg Jenderek +# +# cfg_holder=4617=0x1209 +0 uleshort 4617 +# remainig settings normally 0x5A+offset XORed; free_1D5[20] empty since 5.12.0e +>0x1D5 ubequad 0x2f30313233343536 configuration of Tasmota firmware (ESP8266) +!:mime application/x-tasmota-dmp +!:ext dmp +# version like 6.2.1.0 ~ 0x06020100 XORed to 0x63666262 +>>11 ubyte^0x65 x \b, version %u +>>10 ubyte^0x64 x \b.%u +>>9 ubyte^0x63 x \b.%u +>>8 ubyte^0x62 x \b.%u +#>8 ubelong x (0x%x) +# hostname[33] XORed +>>0x165 ubyte^0x1BF x \b, hostname %c +>>0x166 ubyte^0x1C0 >037 \b%c +>>0x167 ubyte^0x1C1 >037 \b%c +>>0x168 ubyte^0x1C2 >037 \b%c +>>0x169 ubyte^0x1C3 >037 \b%c +>>0x16A ubyte^0x1C4 >037 \b%c +>>0x16B ubyte^0x1C5 >037 \b%c +>>0x16C ubyte^0x1C6 >037 \b%c +>>0x16D ubyte^0x1C7 >037 \b%c +>>0x16E ubyte^0x1C8 >037 \b%c +>>0x16F ubyte^0x1C9 >037 \b%c +>>0x170 ubyte^0x1CA >037 \b%c +>>0x171 ubyte^0x1CB >037 \b%c +>>0x172 ubyte^0x1CC >037 \b%c +>>0x173 ubyte^0x1CD >037 \b%c +>>0x174 ubyte^0x1CE >037 \b%c +>>0x175 ubyte^0x1CF >037 \b%c +>>0x176 ubyte^0x1D0 >037 \b%c +>>0x177 ubyte^0x1D1 >037 \b%c +>>0x178 ubyte^0x1D2 >037 \b%c +>>0x179 ubyte^0x1D3 >037 \b%c +>>0x17A ubyte^0x1D4 >037 \b%c +>>0x17B ubyte^0x1D5 >037 \b%c +>>0x17C ubyte^0x1D6 >037 \b%c +>>0x17D ubyte^0x1D7 >037 \b%c +>>0x17E ubyte^0x1D8 >037 \b%c +>>0x17F ubyte^0x1D9 >037 \b%c +>>0x180 ubyte^0x1DA >037 \b%c +>>0x181 ubyte^0x1DB >037 \b%c +>>0x182 ubyte^0x1DC >037 \b%c +>>0x183 ubyte^0x1DD >037 \b%c +>>0x184 ubyte^0x1DE >037 \b%c +>>0x185 ubyte^0x1DF >037 \b%c +#>>0x165 string x (%.33s) + + diff --git a/contrib/file/magic/Magdir/esri b/contrib/file/magic/Magdir/esri index e070e4f83f45..e49a7ce40706 100644 --- a/contrib/file/magic/Magdir/esri +++ b/contrib/file/magic/Magdir/esri @@ -1,9 +1,9 @@ #------------------------------------------------------------------------------ -# $File: esri,v 1.4 2009/09/19 16:28:09 christos Exp $ +# $File: esri,v 1.5 2019/04/19 00:42:27 christos Exp $ # ESRI Shapefile format (.shp .shx .dbf=DBaseIII) # Based on info from -# +# 0 belong 9994 ESRI Shapefile >4 belong =0 >8 belong =0 diff --git a/contrib/file/magic/Magdir/filesystems b/contrib/file/magic/Magdir/filesystems index eb41868ff453..1920e562a67c 100644 --- a/contrib/file/magic/Magdir/filesystems +++ b/contrib/file/magic/Magdir/filesystems @@ -1,5 +1,5 @@ #------------------------------------------------------------------------------ -# $File: filesystems,v 1.124 2018/01/12 12:35:30 christos Exp $ +# $File: filesystems,v 1.128 2019/04/23 15:43:27 christos Exp $ # filesystems: file(1) magic for different filesystems # 0 name partid @@ -268,21 +268,21 @@ # to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version !:strength +65 >2 string OSBS OS/BS MBR -# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/ -# and http://en.wikipedia.org/wiki/Master_Boot_Record +# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/ +# and https://en.wikipedia.org/wiki/Master_Boot_Record # test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by # characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00 >0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR -# Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) +# Microsoft Windows 95A and early ( https://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) # assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld >>8 ubequad 0x8bf45007501ffbfc -# http://thestarman.pcministry.com/asm/mbr/200MBR.htm +# https://thestarman.pcministry.com/asm/mbr/200MBR.htm >>>0x16 ubyte 0xF3 \b,DOS 2 >>>>219 regex Author\ -\ Author: # found "David Litton" , "A Pehrsson " >>>>>&0 string x "%s" >>>0x16 ubyte 0xF2 -# NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm +# NEC MS-DOS 3.30 Rev. 3 . See https://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm # assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz >>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3 # version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111) @@ -314,7 +314,7 @@ # "Sistema operativo mancante" nn=0xe2 for italian version >>>>>0x79 ubyte >0 at offset 0x%x >>>>>>(0x79.b) string >\0 "%s" -# Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) +# Microsoft Windows 95B to XP (https://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) # assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b >>8 ubequad 0x5007501ffcbe1b7c # assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04 @@ -341,7 +341,7 @@ # "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version >>>>0xA9 ubyte x at offset 0x1%x >>>>(0xA9.b+0x100) string >\0 "%s" -# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm +# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm # assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04 >>>24 ubequad 0xf3a4cbbdbe07b104 XP # where xxyyzz are lower bits from offsets of error messages varying for different languages @@ -362,7 +362,7 @@ # Microsoft Windows Vista or 7 # assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00 >>8 ubequad 0xc08ed8be007cbf00 -# Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) +# Microsoft Windows Vista (https://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) # assembler instructions: jnz 0729;cmp ebx,"TCPA" >>>0xEC ubequad 0x753b6681fb544350 Vista # where xxyyzz are lower bits from offsets of error messages varying for different languages @@ -380,7 +380,7 @@ # "Betriebssystem nicht vorhanden" zz=0x1?? for german version >>>>0x1b7 ubyte >0 at offset 0x1%x >>>>(0x1b7.b+0x100) string >\0 "%s" -# Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm) +# Microsoft Windows 7 (https://thestarman.pcministry.com/asm/mbr/W7MBR.htm) # assembler instructions: cmp ebx,"TCPA";cmp >>>0xEC ubequad 0x6681fb5443504175 Windows 7 # where xxyyzz are lower bits from offsets of error messages varying for different languages @@ -398,10 +398,10 @@ # "Betriebssystem nicht vorhanden" zz=0x1?? for german version >>>>0x1b7 ubyte >0 at offset 0x1%x >>>>(0x1b7.b+0x100) string >\0 "%s" -# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs -# http://en.wikipedia.org/wiki/MBR_disk_signature#ID +# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs +# https://en.wikipedia.org/wiki/MBR_disk_signature#ID >>0x1b8 ulelong >0 \b, disk signature 0x%-.4x -# driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm +# driveID/timestamp for Win 95B,98,98SE and ME. See https://thestarman.pcministry.com/asm/mbr/mystery.htm >>0xDA uleshort 0 >>>0xDC ulelong >0 \b, created # physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive @@ -465,13 +465,13 @@ >>>>>420 ubyte x \b) # # SYSLINUX MBR moved -# http://www.acronis.de/ +# https://www.acronis.de/ >362 string MBR\ Error\ \0\r >>376 string ress\ any\ key\ to\040 >>>392 string boot\ from\ floppy...\0 \b, Acronis MBR # added by Joerg Jenderek -# http://www.visopsys.org/ -# http://partitionlogic.org.uk/ +# https://www.visopsys.org/ +# https://partitionlogic.org.uk/ >309 string No\ bootable\ partition\ found\r >>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR >349 string No\ bootable\ partition\ found\r @@ -490,7 +490,7 @@ >>172 string LILO \b, version 22.5.8 Debian # updated by Joerg Jenderek at Oct 2008 # variables according to grub-0.97/stage1/stage1.S or -# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data +# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data # usual values are marked with comments to get only informations of strange GRUB loaders >342 search/60 \0Geom\0 #>0 ulelong x %x=0x009048EB , 0x2a9048EB 0 @@ -549,7 +549,7 @@ # skip FSInfosector >>>>>>0 string !RRaA # skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX, -# http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm +# https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm >>>>>>>0 ubequad !0xfa660fb64610668b # skip 13rd sector of MS x86 bootloader >>>>>>>>0 ubequad !0x660fb64610668b4e @@ -562,7 +562,7 @@ >>>>>>>>>>>446 use partition-table # TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries # mbr partition table entries end -# http://www.acronis.de/ +# https://www.acronis.de/ #FAT label=ACRONIS\ SZ #OEM-ID=BOOTWIZ0 >442 string Non-system\ disk,\040 @@ -995,8 +995,8 @@ >>>>505 ubyte&0xDF >0 >>>>>505 string x \b.%-.3s # added by Joerg Jenderek -# http://www.visopsys.org/ -# http://partitionlogic.org.uk/ +# https://www.visopsys.org/ +# https://partitionlogic.org.uk/ # OEM-ID=Visopsys >478 ulelong 0 >>(1.b+326) string I/O\ Error\ reading\040 @@ -1023,8 +1023,8 @@ #it prints a very short message ("RE") to the screen and hangs the computer. # x86 bootloader end -# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO -# and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector +# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO +# and https://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector >0 string RRaA >>0x1E4 string rrAa \b, FSInfosector #>>0x1FC uleshort =0 SHOULD BE ZERO @@ -1087,7 +1087,7 @@ >11 ubyte x \b+ >11 use DOS-filename -# http://en.wikipedia.org/wiki/Master_boot_record#PTE +# https://en.wikipedia.org/wiki/Master_boot_record#PTE # display standard partition table 0 name partition-table #>0 ubyte x PARTITION-TABLE @@ -1154,20 +1154,20 @@ 0x18b string OS/2 OS/2 Boot Manager # updated by Joerg Jenderek at Oct 2008 and Sep 2012 -# http://syslinux.zytor.com/iso.php +# https://syslinux.zytor.com/iso.php # tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05 # assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop 0 ulequad&0x909000007cc0eafa 0x909000007c40eafa >631 search/689 ISOLINUX\ isolinux Loader >>&0 string x (version %-4.4s) -# http://syslinux.zytor.com/pxe.php +# https://syslinux.zytor.com/pxe.php # assembler instructions: jmp 7C05 0 ulelong 0x007c05ea pxelinux loader (version 2.13 or older) # assembler instructions: pushfd;pushad 0 ulelong 0x60669c66 pxelinux loader # assembler instructions: jmp 05 0 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer) -# http://syslinux.zytor.com/wiki/index.php/SYSLINUX +# https://syslinux.zytor.com/wiki/index.php/SYSLINUX 0 string LDLINUX\ SYS\ SYSLINUX loader >12 string x (older version %-4.4s) 0 string \r\nSYSLINUX\ SYSLINUX loader @@ -1213,7 +1213,7 @@ >0004 uleshort x # ERRorTeXT >>181 search/166 Error\ \0\r\n NetBSD mbr -# NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS +# NT Drive Serial Number https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS >>>0x1B8 ubelong >0 \b,Serial 0x%-.8x # BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx >>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector @@ -1249,7 +1249,7 @@ >>>398 string Disk\ error\r\n\0FDD\0HDD\0 >>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr -# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/ +# Neil Turton mbr loader variant of https://www.chiark.greenend.org.uk/~neilt/mbr/ # added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11 # for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI, # or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS, @@ -1262,7 +1262,7 @@ >>>(0x1BC.s+9) ubyte x \bVersion<=%u #>>>(0x1BC.s+8) ubyte x asm_flag_%x >>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix -# variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode +# variant used by testdisk of https://www.cgsecurity.org/wiki/Menu_MBRCode >>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk #0x1~1,..,0x8~4,0x10~F,0x80~A enabled #>>>(0x1BC.s+10) ubyte x \b,flags 0x%x @@ -1295,7 +1295,7 @@ # added by Joerg Jenderek # In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or # grub-1.94/kern/i386/pc/startup.S -# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data +# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data # usual values are marked with comments to get only informations of strange GRUB loaders 0x200 uleshort 0x70EA # found only version 3.{1,2} @@ -1350,7 +1350,7 @@ # DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 # over BIOS parameter block (BPB) -# http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD +# https://thestarman.pcministry.com/asm/2bytejumps.htm#FWD # older drives may use Near JuMP instruction E9 xx xx # minimal short forward jump found 0x29 for bootloaders or 0x0 # maximal short forward jump is 0x7f @@ -1403,7 +1403,7 @@ >>>>>26 ubyte =1 \b, heads %u # valid only for sector sizes with more then 32 Bytes >>>>>11 uleshort >32 -# http://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block +# https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block # skip for values 2,2Ah,70h,73h,DFh # and continue for extended boot signature values 0,28h,29h,80h >>>>>>38 ubyte&0x56 =0 @@ -1465,7 +1465,7 @@ # FAT32 bit specific >>>>>82 string/c fat32 \b, FAT (32 bit) >>>>>>36 ulelong x \b, sectors/FAT %u -# http://technet.microsoft.com/en-us/library/cc977221.aspx +# https://technet.microsoft.com/en-us/library/cc977221.aspx >>>>>>40 uleshort >0 \b, extension flags 0x%x #>>>>>>40 uleshort =0 \b, extension flags %hu >>>>>>42 uleshort >0 \b, fsVersion %u @@ -1482,7 +1482,7 @@ #>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) >>>>>>50 default x >>>>>>>50 uleshort x \b, Backup boot sector %u -# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO +# corrected by Joerg Jenderek at Feb 2011 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO >>>>>>52 ulelong >0 \b, reserved1 0x%x >>>>>>56 ulelong >0 \b, reserved2 0x%x >>>>>>60 ulelong >0 \b, reserved3 0x%x @@ -1508,7 +1508,7 @@ >>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT # floppy image !:mime application/x-ima -# NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm +# NTFS specific added by Joerg Jenderek at Mar 2011 according to https://thestarman.pcministry.com/asm/mbr/NTFSBR.htm # and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html # 0 FATs >>>>>16 ubyte =0 @@ -1539,18 +1539,39 @@ >>>>>>>>>72 ulequad x \b, serial number 0%llx >>>>>>>>>80 ulelong >0 \b, checksum 0x%x #>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual) ->>>>>>>>>0x258 ulelong&0x00009090 =0x00009090 ->>>>>>>>>>&-92 indirect x \b; contains -# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013 -# http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm -# unused assembler instructions JMP y2;NOP;NOP -0x056 ulelong&0xFFFF0FFF 0x909002EB -# unicode loadername terminated by CTRL-D ->(0.s*2) ulelong&0xFFFFFF00 0x00040000 +# unicode loadername size jump +>>>>>>>>>(0x200.s*2) ubyte x +# in next sector loadername terminated by unicode CTRL-D and $ +>>>>>>>>>>&0x1FF ulequad&0x0000FFffFFffFF00 0x0000002400040000 \b; contains +# if 2nd NTFS sectors is found then assume whole filesystem +#!:mime application/x-raw-disk-image +!:ext img/bin/ntfs +>>>>>>>>>>>0x200 use ntfs-sector2 + +# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013, Mar 2019 +# https://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm +# unused assembler instructions short JMP y2;NOP;NOP +0x056 ulelong&0xFFFF0FFF 0x909002EB NTFS +#!:mime application/octet-stream +!:ext bin +>0 use ntfs-sector2 +# https://memory.dataram.com/products-and-services/software/ramdisk +# assembler instructions JMP C000;NOP +0x056 ulelong 0x9000c0e9 NTFS +#!:mime application/octet-stream +!:ext bin +>0 use ntfs-sector2 +# check for characteristics of second NTFS sector and then display loader name +0 name ntfs-sector2 +# number of utf16 characters of loadername +>0 uleshort <8 +# unused assembler instructions JMP y2;NOP;NOP or JMP C000;NOP +>>0x056 ulelong&0xFF0000FD 0x900000E9 # loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR ->>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s ->>0x12 string $ ->>>0x0c lestring16 x \b%-2.2s +>>>0x002 lestring16 x bootstrap %-5.5s +# check for 7 character length of loader name like BOOTMGR +>>>0 uleshort 7 +>>>>0x0c lestring16 x \b%-2.2s ### DOS,NTFS boot sectors end # ntfsclone-image is a special save format for NTFS volumes, @@ -1689,7 +1710,7 @@ # ext2/ext3 filesystems - Andreas Dilger # ext4 filesystem - Eric Sandeen # volume label and UUID Russell Coker -# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ +# https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 0x438 leshort 0xEF53 Linux >0x44c lelong x rev %d >0x43e leshort x \b.%d @@ -1801,7 +1822,7 @@ ############################################################################ # Minix-ST kernel floppy 0x800 belong 0x46fc2700 Atari-ST Minix kernel image -# http://en.wikipedia.org/wiki/BIOS_parameter_block +# https://en.wikipedia.org/wiki/BIOS_parameter_block # floppies with valid BPB and any instruction at beginning >19 string \240\005\371\005\0\011\0\2\0 \b, 720k floppy >19 string \320\002\370\005\0\011\0\1\0 \b, 360k floppy @@ -1871,7 +1892,7 @@ # # all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013 -# http://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions +# https://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions # Too Weak. #512 ubelong&0xE0ffff00 0xE0ffff00 # without valid Media descriptor in place of BPB, cases with are done at other places @@ -1884,7 +1905,7 @@ #>>512 ubyte =0xfa 320k #>>512 ubyte =0xfb 640k #>>512 ubyte =0xfc 180k -# look like an an old DOS directory entry +# look like an old DOS directory entry #>>>0xA0E ubequad 0 #>>>>0xA00 ubequad !0 #!:mime application/x-ima @@ -1915,26 +1936,26 @@ # only x86 short jump instruction found #>>>0 ubyte =0xEB #>>>>1 ubyte x \b, code offset 0x%x+2 -# http://thestarman.pcministry.com/DOS/ibm100/Boot.htm +# https://thestarman.pcministry.com/DOS/ibm100/Boot.htm # assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0 #>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader # ibmbio.com+ibmdos.com #>>>>>0x176 use DOS-filename #>>>>>0x181 ubyte x \b+ #>>>>>0x182 use DOS-filename -# http://thestarman.pcministry.com/DOS/ibm110/Boot.htm +# https://thestarman.pcministry.com/DOS/ibm110/Boot.htm # assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV #>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader # ibmbio.com+ibmdos.com #>>>>>0x18b use DOS-filename #>>>>>0x196 ubyte x \b+ #>>>>>0x197 use DOS-filename -# http://en.wikipedia.org/wiki/Zenith_Data_Systems +# https://en.wikipedia.org/wiki/Zenith_Data_Systems # assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6 #>>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader # IO.SYS+MSDOS.SYS #>>>>>0x20 use 2xDOS-filename -# http://en.wikipedia.org/wiki/Corona_Data_Systems +# https://en.wikipedia.org/wiki/Corona_Data_Systems # assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX; #>>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader # IO.SYS+MSDOS.SYS @@ -1987,7 +2008,7 @@ >307200 use cdrom # .cso files -# Reference: http://pismotec.com/ciso/ciso.h +# Reference: https://pismotec.com/ciso/ciso.h # NOTE: There are two other formats with the same magic but # completely incompatible specifications: # - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h @@ -1996,10 +2017,13 @@ # Other fields are used to determine what type of CISO this is: # - 0x04 == 0x00200000: GameCube/Wii CISO (block_size) # - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size) +# - 0x10 == 0x00004000: For >2GB files using maxcso... +# https://github.com/unknownbrackets/maxcso/issues/26 # - None of the above: Compact ISO. >4 lelong !0 >>4 lelong !0x200000 ->>>0x10 lelong !0x800 Compressed ISO CD image +>>>16 lelong !0x800 +>>>>16 lelong !0x4000 Compressed ISO CD image # cramfs filesystem - russell@coker.com.au 0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian @@ -2247,7 +2271,7 @@ >984 string x volume label is '%-12.12s' # From: Thomas Klausner -# http://filext.com/file-extension/DAA +# https://filext.com/file-extension/DAA # describes the daa file format. The magic would be: 0 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive diff --git a/contrib/file/magic/Magdir/finger b/contrib/file/magic/Magdir/finger index d8611f685528..ab43ac6f9d7b 100644 --- a/contrib/file/magic/Magdir/finger +++ b/contrib/file/magic/Magdir/finger @@ -1,11 +1,11 @@ #------------------------------------------------------------------------------ -# $File: finger,v 1.2 2015/10/07 02:37:57 christos Exp $ +# $File: finger,v 1.3 2019/04/19 00:42:27 christos Exp $ # fingerprint: file(1) magic for fingerprint data # XPM bitmaps) # -# http://cgit.freedesktop.org/libfprint/libfprint/tree/libfprint/data.c +# https://cgit.freedesktop.org/libfprint/libfprint/tree/libfprint/data.c 0 string FP1 libfprint fingerprint data V1 >3 beshort x \b, driver_id %x diff --git a/contrib/file/magic/Magdir/flash b/contrib/file/magic/Magdir/flash index b48abe968eb4..33b734499c4d 100644 --- a/contrib/file/magic/Magdir/flash +++ b/contrib/file/magic/Magdir/flash @@ -1,12 +1,12 @@ #------------------------------------------------------------------------------ -# $File: flash,v 1.14 2017/05/25 20:09:55 christos Exp $ +# $File: flash,v 1.15 2019/04/19 00:42:27 christos Exp $ # flash: file(1) magic for Macromedia Flash file format # # See # -# http://www.macromedia.com/software/flash/open/ -# http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\ +# https://www.macromedia.com/software/flash/open/ +# https://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\ # en/devnet/swf/pdf/swf-file-format-spec.pdf page 27 # diff --git a/contrib/file/magic/Magdir/fonts b/contrib/file/magic/Magdir/fonts index cf9d58882371..f47736f4e4f4 100644 --- a/contrib/file/magic/Magdir/fonts +++ b/contrib/file/magic/Magdir/fonts @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: fonts,v 1.38 2017/11/14 15:48:36 christos Exp $ +# $File: fonts,v 1.41 2019/05/05 16:44:04 christos Exp $ # fonts: file(1) magic for font data # 0 search/1 FONT ASCII vfont text @@ -17,7 +17,7 @@ # Summary: PostScript Type 1 Printer Font Metrics # URL: https://en.wikipedia.org/wiki/PostScript_fonts -# Reference: http://partners.adobe.com/public/developer/en/font/5178.PFM.pdf +# Reference: https://partners.adobe.com/public/developer/en/font/5178.PFM.pdf # Modified by: Joerg Jenderek # Note: moved from ./msdos magic # dfVersion 256=0100h @@ -80,7 +80,7 @@ 0 search/1 STARTFONT\ X11 BDF font text # From: Joerg Jenderek -# URL: http://grub.gibibit.com/New_font_format +# URL: https://grub.gibibit.com/New_font_format # Reference: util/grub-mkfont.c # include/grub/fontformat.h # FONT_FORMAT_SECTION_NAMES_FILE @@ -128,6 +128,58 @@ 7 belong 0x00564944 DOS code page font data (from Linux?) 4098 string DOSFONT DOSFONT2 encrypted font data +# From: Joerg Jenderek +# URL: http://fileformats.archiveteam.org/wiki/GEM_bitmap_font +# Reference: http://cd.textfiles.com/ataricompendium/BOOK/HTML/APPENDC.HTM#cnt +# +# usual case with lightening mask and skewing mask 5555h~UU +62 ulelong 0x55555555 +>0 use gdos-font +# BOX18.GFT COWBOY30.GFT ROYALK30.GFT +62 ulelong 0 +# skip ISO 9660 CD-ROM ./filesystem by looking for low positive face size +>2 uleshort >2 +# skip DOS 2.0 backup id file ./msdos by looking for face size lower/equal 48 +>>2 uleshort <49 +# skip MS Windows ICO ./msdos by looking for valid face name +>>>4 ubeshort >0x1F00 +# skip DOS executable BACKM212.COM by looking for horizontal offset table after header +#>>>>68 ulelong >87 OFFSET_OK +>>>>0 use gdos-font +0 name gdos-font +>0 uleshort x GEM GDOS font +!:mime application/x-font-gdos +# also .eps found like AA070GEP.EPS AI360GEP.EPS +!:ext fnt/gtf +# font name like University Bold +>4 string x %.32s +# face size in points 3-48 +>2 uleshort x %u +# face ID (must be unique) +>0 uleshort x \b, ID 0x%4.4x +# lowest character index in face (usually 32 for disk-loaded fonts). +#>36 uleshort x \b, low character index %u +# width of the widest character +#>50 uleshort x \b, %u char width +# width of the widest character cell +#>52 uleshort x \b, %u cell width +# thickening size +#>58 uleshort x \b, %u thick +# lightening mask to eliminate pixels, usually 5555h +>62 uleshort !0x5555 \b, lightening mask 0x%x +# skewing mask to determine when to perform additional rotation when skewing, usually 5555h +>64 uleshort !0x5555 \b, skewing mask 0x%x +# offset to horizontal offset table 58h~88 5eh +#>68 ulelong >88 \b, 0x%x horizontal table offset +# offset character offset table +#>72 ulelong x \b, 0x%x coffset +# offset to font data +#>72 ulelong x \b, 0x%x foffset +# form width in bytes +#>80 uleshort x \b, %u fwidth +# pointer to the next font, set by GDOS after loading +#>84 ulelong x \b, 0x%x noffset + # downloadable fonts for browser (prints type) anthon@mnt.org # https://tools.ietf.org/html/rfc3073 0 string PFR1 Portable Font Resource font data (new) @@ -167,16 +219,14 @@ >>12 regex/4l \^[A-Za-z][A-Za-z][A-Za-z/][A-Za-z2\ ] #>>>0 ubelong x \b, sfnt version 0x%x >>>0 ubelong !0x4f54544f TrueType -!:mime application/font-sfnt -#!:mime font/ttf +!:mime font/sfnt !:apple ????tfil # .ttf for TrueType font # EUDC.tte created by privat character editor %WINDIR%\system32\eudcedit.exe !:ext ttf/tte # sfnt version 4F54544Fh~OTTO >>>0 ubelong =0x4f54544f OpenType -!:mime application/font-sfnt -#!:mime font/otf +!:mime font/otf !:apple ????OTTO !:ext otf >>>0 ubelong x Font data @@ -257,7 +307,7 @@ # TrueType/OpenType font collections (.ttc) # URL: https://en.wikipedia.org/wiki/OpenType -# http://www.microsoft.com/typography/otspec/otff.htm +# https://www.microsoft.com/typography/otspec/otff.htm # Modified by: Joerg Jenderek # Note: container for TrueType, OpenType font 0 string ttcf @@ -265,17 +315,16 @@ >4 ubyte 0 # sfnt version often 0x00010000 of 1st table is TrueType >>(12.L) ubelong !0x4f54544f TrueType -#!:mime font/ttf +!:mime font/ttf !:apple ????tfil !:ext ttc # sfnt version 4F54544Fh~OTTO of 1st table is OpenType font >>(12.L) ubelong =0x4f54544f OpenType -#!:mime font/otf +!:mime font/otf !:apple ????OTTO # no example found for otc !:ext ttc/otc >>4 ubyte x font collection data -!:mime application/font-sfnt #!:mime font/collection # TCC version >>4 belong 0x00010000 \b, 1.0 @@ -320,12 +369,12 @@ #>14 beshort x \b, reserved %d #>16 belong x \b, totalSfntSize %d -# http://www.w3.org/TR/WOFF/ +# https://www.w3.org/TR/WOFF/ 0 string wOFF Web Open Font Format >0 use woff >20 beshort x \b, version %d >22 beshort x \b.%d -# http://www.w3.org/TR/WOFF2/ +# https://www.w3.org/TR/WOFF2/ 0 string wOF2 Web Open Font Format (Version 2) >0 use woff #>20 belong x \b, totalCompressedSize %d diff --git a/contrib/file/magic/Magdir/fsav b/contrib/file/magic/Magdir/fsav index d260157bc3f0..7ea094144e70 100644 --- a/contrib/file/magic/Magdir/fsav +++ b/contrib/file/magic/Magdir/fsav @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: fsav,v 1.15 2018/07/16 12:30:41 christos Exp $ +# $File: fsav,v 1.19 2019/04/19 00:42:27 christos Exp $ # fsav: file(1) magic for datafellows fsav virus definition files # Anthon van der Neut (anthon@mnt.org) @@ -40,25 +40,64 @@ #>>>>>>13 ubyte x \b%02x bytes # Joerg Jenderek: joerg dot jenderek at web dot de -# http://www.clamav.net/doc/latest/html/node45.html -# .cvd files start with a 512 bytes colon separated header +# clamav-0.100.2\docs\html\node60.html +# https://github.com/vrtadmin/clamav-faq/raw/master/manual/clamdoc.pdf +# ClamAV virus database files start with a 512 bytes colon separated header # ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime -# + gzipped tarball files -0 string ClamAV-VDB: ->11 string >\0 Clam AntiVirus database %-.23s ->>34 string : ->>>35 string !: \b, version ->>>>35 string x \b %-.1s ->>>>>36 string !: ->>>>>>36 string x \b%-.1s ->>>>>>>37 string !: ->>>>>>>>37 string x \b%-.1s ->>>>>>>>>38 string !: ->>>>>>>>>>38 string x \b%-.1s ->>>>>>>>>>>39 string !: ->>>>>>>>>>>>39 string x \b%-.1s ->512 string \037\213 \b, gzipped ->769 string ustar\0 \b, tarred +# + gzipped (optional) tarball files +# output can often be verified by `sigtool --info=FILE` +0 string ClamAV-VDB: Clam AntiVirus +# padding spaces implies database +>511 ubyte =0x20 database +!:mime application/x-clamav-database +# empty build time +>>10 string =:: (unsigned) +# sigtool(1) man page +!:ext cud +# display some text to avoid error like: +# Magdir/fsav, 78: Warning: Current entry does not yet have a description for adding a EXTENSION type +# file: could not find any valid magic files! (No error) +>>10 default x (with buildtime) +#>>10 default x +# clamtmp is used for temporily database like update process +# for pure tar database only cld extension found +!:ext cld/cvd/clamtmp/cud +>511 default x file +!:mime application/x-clamav +!:ext info +>11 string >\0 +# buildDate empty or like "22 Mar 2017 12-57 -0400"; verified by `sigtool -i FILE` +>>11 regex \^[^:]{0,23} \b, %s +# version like 25170 +>>>&1 regex \^[^:]{1,6} \b, version %s +# signaturesNumbers like 4566249 +>>>>&1 regex \^[^:]{1,10} \b, %s signatures +# functionalityLevelRequired like 60 +>>>>>&1 regex \^[^:]{1,4} \b, level %s +# X for nothing or MD5 +#>>>>>>&1 regex \^[^:]{1,32} \b, MD5 "%s" +>>>>>>&1 regex \^[^:]{1,32} +# X for nothing or digital signature starting like AIzk/LYbX +#>>>>>>>&1 regex \^[^:]{1,255} \b, signature "%s" +>>>>>>>&1 regex \^[^:]{1,255} +# builder like neo +>>>>>>>>&1 regex \^[^:]{1,32} \b, builder %s +# buildTime like 1506611558 +#>>>>>>>>>&1 regex \^[^:]{1,10} \b, %s +>>>>>>>>>&1 regex \^[^:]{1,10} +# padding with spaces +#>>>>>>>>>>&1 ubequad x \b, padding 0x%16.16llx +>510 ubyte =0x20 +# inspect real database content +#>>512 ubeshort x \b, database MAGIC 0x%x +# ./archive handle pure tar archives +>>1012 quad =0 \b, with +>>>512 use tar-file +# not pure tar +>>1012 quad !0 +# one space at the end of text and then handles gziped archives by ./compress +>>>512 string \037\213 \b, with +>>>>512 indirect x # Type: Grisoft AVG AntiVirus # From: David Newgas @@ -66,3 +105,24 @@ 0 string X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR >33 string -STANDARD-ANTIVIRUS-TEST-FILE!$H+H* EICAR virus test files + +# From: Joerg Jenderek +# URL: https://www.avira.com/ +# Note: found in directory %ProgramData%\Avira\Antivirus\INFECTED (Windows) +# tested with version 15.0.43.23 at November 2019 +0 string AntiVir\ Qua Avira AntiVir quarantined +!:mime application/x-avira-qua +#!:mime application/octet-stream +!:ext qua +>156 string SUSPICIOUS_FILE +# file path of suspicious file +>>220 lestring16 x %s +>156 string !SUSPICIOUS_FILE +# file path of virus file +>>228 lestring16 x %s +# quarantined date +>60 ldate x at %s +# virus/danger name +>156 string !SUSPICIOUS_FILE +>>156 string x \b, category "%s" + diff --git a/contrib/file/magic/Magdir/games b/contrib/file/magic/Magdir/games index c5a5e4d041aa..30e6159a1746 100644 --- a/contrib/file/magic/Magdir/games +++ b/contrib/file/magic/Magdir/games @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: games,v 1.16 2017/10/19 16:40:37 christos Exp $ +# $File: games,v 1.17 2019/04/19 00:42:27 christos Exp $ # games: file(1) for games # Fabio Bonelli @@ -211,7 +211,7 @@ # Summary: SGF Smart Game Format # Extension: .sgf -# Reference: http://www.red-bean.com/sgf/ +# Reference: https://www.red-bean.com/sgf/ # Created by: Eduardo Sabbatella # Modified by (1): Abel Cheung (regex, more game format) # FIXME: Some games don't have GM (game type) @@ -281,7 +281,7 @@ >>&0 regex [0-9a-z.]+ \b, version %s # Type: SGF Smart Game Format -# URL: http://www.red-bean.com/sgf/ +# URL: https://www.red-bean.com/sgf/ # From: Eduardo Sabbatella 2 regex/c \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format >2 regex/c GM\\[1\\] - Go Game diff --git a/contrib/file/magic/Magdir/geo b/contrib/file/magic/Magdir/geo index 3e75b703deaf..d72e514a2338 100644 --- a/contrib/file/magic/Magdir/geo +++ b/contrib/file/magic/Magdir/geo @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: geo,v 1.6 2018/03/11 00:48:16 christos Exp $ +# $File: geo,v 1.7 2019/04/19 00:42:27 christos Exp $ # Geo- files from Kurt Schwehr ###################################################################### @@ -49,7 +49,7 @@ ###################################################################### # -# MULTIBEAM SONARS http://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/ +# MULTIBEAM SONARS https://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/ # ###################################################################### @@ -67,11 +67,11 @@ # format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR. 0 string $HSF XSE multibeam -# mb121 http://www.saic.com/maritime/gsf/ +# mb121 https://www.saic.com/maritime/gsf/ 8 string GSF-v SAIC generic sensor format (GSF) sonar data, >&0 regex [0-9]*\.[0-9]* version %s -# MGD77 - http://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm +# MGD77 - https://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm # mb161 9 string MGD77 MGD77 Header, Marine Geophysical Data Exchange Format @@ -104,7 +104,7 @@ # https://midas.psi.ch/elog/ 0 string $@MID@$ elog journal entry -# Geospatial Designs http://www.geospatialdesigns.com/surfer6_format.htm +# Geospatial Designs https://www.geospatialdesigns.com/surfer6_format.htm 0 string DSBB Surfer 6 binary grid file >4 leshort x \b, %d >6 leshort x \bx%d @@ -117,7 +117,7 @@ # magic for LAS format files # alex myczko -# http://www.asprs.org/wp-content/uploads/2010/12/LAS_1_3_r11.pdf +# https://www.asprs.org/wp-content/uploads/2010/12/LAS_1_3_r11.pdf 0 string LASF LIDAR point data records >24 byte >0 \b, version %u >25 byte >0 \b.%u diff --git a/contrib/file/magic/Magdir/glibc b/contrib/file/magic/Magdir/glibc new file mode 100644 index 000000000000..3b856f38363f --- /dev/null +++ b/contrib/file/magic/Magdir/glibc @@ -0,0 +1,21 @@ + +#------------------------------------------------------------------------------ +# $File: glibc,v 1.1 2018/10/11 15:35:43 christos Exp $ +# glibc locale files +# +# https://sourceware.org/git/?p=glibc.git;f=locale/localeinfo.h;h=68822a63#l32 + +0 belong 0x20070920 glibc locale file LC_CTYPE +0 belong 0x14110320 glibc locale file LC_NUMERIC +0 belong 0x17110320 glibc locale file LC_TIME +0 belong 0x17100520 glibc locale file LC_COLLATE +0 belong 0x11110320 glibc locale file LC_MONETARY +0 belong 0x10110320 glibc locale file LC_MESSAGES +0 belong 0x13110320 glibc locale file LC_ALL +0 belong 0x12110320 glibc locale file LC_PAPER +0 belong 0x1d110320 glibc locale file LC_NAME +0 belong 0x1c110320 glibc locale file LC_ADDRESS +0 belong 0x1f110320 glibc locale file LC_TELEPHONE +0 belong 0x1e110320 glibc locale file LC_MEASUREMENT +0 belong 0x19110320 glibc locale file LC_IDENTIFICATION + diff --git a/contrib/file/magic/Magdir/gnome b/contrib/file/magic/Magdir/gnome index 32c9ae938812..2905340c7e06 100644 --- a/contrib/file/magic/Magdir/gnome +++ b/contrib/file/magic/Magdir/gnome @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: gnome,v 1.5 2014/04/30 21:41:02 christos Exp $ +# $File: gnome,v 1.6 2019/04/19 00:42:27 christos Exp $ # GNOME related files # Contributed by Josh Triplett @@ -42,7 +42,7 @@ # It's always "GVariant", it's byte swapped on incompatible archs # See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c # file_builder_serialise() -# http://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant +# https://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant 0 string GVariant GVariant Database file, # version is never filled. probably future extension >8 lelong x version %d @@ -51,7 +51,7 @@ #>>>20 lelong x end %d # G-IR database made by gobject-introspect toolset, -# http://live.gnome.org/GObjectIntrospection +# https://live.gnome.org/GObjectIntrospection 0 string GOBJ\nMETADATA\r\n\032 G-IR binary database >16 byte x \b, v%d >17 byte x \b.%d diff --git a/contrib/file/magic/Magdir/gnu b/contrib/file/magic/Magdir/gnu index f30f8d7d9b8f..bf6b93da94d0 100644 --- a/contrib/file/magic/Magdir/gnu +++ b/contrib/file/magic/Magdir/gnu @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: gnu,v 1.20 2018/02/24 16:11:23 christos Exp $ +# $File: gnu,v 1.21 2019/04/19 00:42:27 christos Exp $ # gnu: file(1) magic for various GNU tools # # GNU nlsutils message catalog file format @@ -148,7 +148,7 @@ # GnuPG Keybox file -# +# # From: Philipp Hahn 0 belong 32 >4 byte 1 diff --git a/contrib/file/magic/Magdir/graphviz b/contrib/file/magic/Magdir/graphviz index cddc1164005a..d8bf22db4353 100644 --- a/contrib/file/magic/Magdir/graphviz +++ b/contrib/file/magic/Magdir/graphviz @@ -1,7 +1,7 @@ #------------------------------------------------------------------------------ -# $File: graphviz,v 1.8 2014/06/03 19:01:34 christos Exp $ -# graphviz: file(1) magic for http://www.graphviz.org/ +# $File: graphviz,v 1.9 2019/04/30 04:01:40 christos Exp $ +# graphviz: file(1) magic for https://www.graphviz.org/ # FIXME: These patterns match too generally. For example, the first # line matches a LaTeX file containing the word "graph" (with a { diff --git a/contrib/file/magic/Magdir/guile b/contrib/file/magic/Magdir/guile index 7ee0c48b2c8b..99f837133c7c 100644 --- a/contrib/file/magic/Magdir/guile +++ b/contrib/file/magic/Magdir/guile @@ -1,9 +1,9 @@ #------------------------------------------------------------------------------ -# $File: guile,v 1.1 2011/12/16 17:44:33 christos Exp $ +# $File: guile,v 1.2 2019/04/19 00:42:27 christos Exp $ # Guile file magic from -# http://www.gnu.org/s/guile/ -# http://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250 +# https://www.gnu.org/s/guile/ +# https://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250 0 string GOOF---- Guile Object >8 string LE \b, little endian diff --git a/contrib/file/magic/Magdir/hardware b/contrib/file/magic/Magdir/hardware new file mode 100644 index 000000000000..e92986c5a81c --- /dev/null +++ b/contrib/file/magic/Magdir/hardware @@ -0,0 +1,12 @@ + +#------------------------------------------------------------------------------ +# $File: hardware,v 1.1 2018/08/02 06:32:52 christos Exp $ +# hardware magic + +# EDID +# https://en.wikipedia.org/wiki/Extended_Display_Identification_Data +0 string \x00\xFF\xFF\xFF\xFF\xFF\xFF\x00 +>19 byte x +>>18 byte x EDID data, version %u. +>>19 byte x \b%u +#>>17 ubyte+1990 <255 \b, manufactured %u diff --git a/contrib/file/magic/Magdir/hitachi-sh b/contrib/file/magic/Magdir/hitachi-sh index 0238ed7ebc4e..18d83844515f 100644 --- a/contrib/file/magic/Magdir/hitachi-sh +++ b/contrib/file/magic/Magdir/hitachi-sh @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: hitachi-sh,v 1.8 2017/03/17 21:35:28 christos Exp $ +# $File: hitachi-sh,v 1.9 2018/08/21 12:48:41 christos Exp $ # hitach-sh: file(1) magic for Hitachi Super-H # # Super-H COFF @@ -18,6 +18,7 @@ # use big endian variant of subroutine to display name+variables+flags # for common object formated files >>0 use \^display-coff +!:strength -10 0 leshort 0x0550 # test for unused flag bits in f_flags @@ -25,4 +26,5 @@ # use little endian variant of subroutine to # display name+variables+flags for common object formated files >>0 use display-coff +!:strength -10 diff --git a/contrib/file/magic/Magdir/hp b/contrib/file/magic/Magdir/hp index b01c3a40b0a7..d57169ee16e7 100644 --- a/contrib/file/magic/Magdir/hp +++ b/contrib/file/magic/Magdir/hp @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: hp,v 1.24 2014/04/30 21:41:02 christos Exp $ +# $File: hp,v 1.25 2019/01/13 00:32:38 christos Exp $ # hp: file(1) magic for Hewlett Packard machines (see also "printer") # # XXX - somebody should figure out whether any byte order needs to be @@ -120,12 +120,6 @@ 0 belong 0x020b010d PA-RISC1.0 dynamic load library >96 belong >0 - not stripped -0 belong 0x213c6172 archive file ->68 belong 0x020b0619 - PA-RISC1.0 relocatable library ->68 belong 0x02100619 - PA-RISC1.1 relocatable library ->68 belong 0x02110619 - PA-RISC1.2 relocatable library ->68 belong 0x02140619 - PA-RISC2.0 relocatable library - #### 500 0 long 0x02080106 HP s500 relocatable executable >16 long >0 - version %d diff --git a/contrib/file/magic/Magdir/ibm6000 b/contrib/file/magic/Magdir/ibm6000 index 8b48f370eb79..2112e71652d3 100644 --- a/contrib/file/magic/Magdir/ibm6000 +++ b/contrib/file/magic/Magdir/ibm6000 @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: ibm6000,v 1.13 2017/03/17 21:35:28 christos Exp $ +# $File: ibm6000,v 1.14 2019/03/07 17:21:54 christos Exp $ # ibm6000: file(1) magic for RS/6000 and the RT PC. # 0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module @@ -17,6 +17,8 @@ 0 belong 0x000001f9 AIX compiled message catalog 0 string \ archive 0 string \ archive (big format) +0 belong 0x09006bea AIX backup/restore format file +0 belong 0x09006fea AIX backup/restore format file 0 beshort 0x01f7 64-bit XCOFF executable or object module >20 belong 0 not stripped diff --git a/contrib/file/magic/Magdir/images b/contrib/file/magic/Magdir/images index 15ec18a70d05..0e314adecb18 100644 --- a/contrib/file/magic/Magdir/images +++ b/contrib/file/magic/Magdir/images @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: images,v 1.146 2018/07/03 20:55:37 christos Exp $ +# $File: images,v 1.160 2019/04/19 00:42:27 christos Exp $ # images: file(1) magic for image formats (see also "iff", and "c-lang" for # XPM bitmaps) # @@ -27,23 +27,25 @@ # and Image Type 1 2 3 9 10 11 32 33 # and Color Map Entry Size 0 15 16 24 32 0 ubequad&0x00FeC400000000C0 0 +# Prevent conflicts with CRI ADX. +>(2.S-2) belong !0x28632943 # skip more garbage like *.iso by looking for positive image type ->2 ubyte >0 +>>2 ubyte >0 # skip some compiled terminfo like xterm+tmux by looking for image type less equal 33 ->>2 ubyte <34 +>>>2 ubyte <34 # skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel depth 1 8 15 16 24 32 ->>>16 ubyte 1 ->>>>0 use tga-image ->>>16 ubyte 8 ->>>>0 use tga-image ->>>16 ubyte 15 ->>>>0 use tga-image ->>>16 ubyte 16 ->>>>0 use tga-image ->>>16 ubyte 24 ->>>>0 use tga-image ->>>16 ubyte 32 ->>>>0 use tga-image +>>>>16 ubyte 1 +>>>>>0 use tga-image +>>>>16 ubyte 8 +>>>>>0 use tga-image +>>>>16 ubyte 15 +>>>>>0 use tga-image +>>>>16 ubyte 16 +>>>>>0 use tga-image +>>>>16 ubyte 24 +>>>>>0 use tga-image +>>>>16 ubyte 32 +>>>>>0 use tga-image # display tga bitmap image information 0 name tga-image >2 ubyte <34 Targa image data @@ -174,43 +176,43 @@ 0 search/1 P1 >0 regex/4 P1[\040\t\f\r\n] >>0 use netpbm ->>>0 string x \b, bitmap -!:strength + 45 +>>0 string x \b, bitmap +!:strength + 65 !:mime image/x-portable-bitmap 0 search/1 P2 >0 regex/4 P2[\040\t\f\r\n] >>0 use netpbm ->>>0 string x \b, greymap -!:strength + 45 +>>0 string x \b, greymap +!:strength + 65 !:mime image/x-portable-greymap 0 search/1 P3 >0 regex/4 P3[\040\t\f\r\n] >>0 use netpbm ->>>0 string x \b, pixmap -!:strength + 45 +>>0 string x \b, pixmap +!:strength + 65 !:mime image/x-portable-pixmap 0 string P4 >0 regex/4 P4[\040\t\f\r\n] >>0 use netpbm ->>>0 string x \b, rawbits, bitmap -!:strength + 45 +>>0 string x \b, rawbits, bitmap +!:strength + 65 !:mime image/x-portable-bitmap 0 string P5 >0 regex/4 P5[\040\t\f\r\n] >>0 use netpbm ->>>0 string x \b, rawbits, greymap -!:strength + 45 +>>0 string x \b, rawbits, greymap +!:strength + 65 !:mime image/x-portable-greymap 0 string P6 >0 regex/4 P6[\040\t\f\r\n] >>0 use netpbm ->>>0 string x \b, rawbits, pixmap -!:strength + 45 +>>0 string x \b, rawbits, pixmap +!:strength + 65 !:mime image/x-portable-pixmap 0 string P7 Netpbm PAM image file @@ -235,7 +237,7 @@ # Canon RAW version 1 (CRW) files are a type of Canon Image File Format # (CIFF) file. These are apparently all little-endian. # From: Adam Buchbinder -# URL: http://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html +# URL: https://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html 0 string II\x1a\0\0\0HEAPCCDR Canon CIFF raw image data !:mime image/x-canon-crw >16 leshort x \b, version %d. @@ -245,9 +247,10 @@ # number. Put this above the TIFF test to make sure we detect them. # These are apparently all little-endian. # From: Adam Buchbinder -# URL: http://libopenraw.freedesktop.org/wiki/Canon_CR2 +# URL: https://libopenraw.freedesktop.org/wiki/Canon_CR2 0 string II\x2a\0\x10\0\0\0CR Canon CR2 raw image data !:mime image/x-canon-cr2 +!:strength +80 >10 byte x \b, version %d. >11 byte x \b%d @@ -437,6 +440,7 @@ # Standard PNG image. 0 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0DIHDR PNG image data !:mime image/png +!:ext png !:strength +10 >16 use png-ihdr @@ -444,6 +448,7 @@ 0 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x04CgBI >24 string \x00\x00\x00\x0DIHDR PNG image data (CgBI) !:mime image/png +!:ext png !:strength +10 >>32 use png-ihdr @@ -565,7 +570,7 @@ # at offset 8 starts imagedata followed by "RGB " marker # PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu) -# http://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\ +# https://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\ # 28bitmap_information_header.29 0 string BM >14 leshort 12 PC bitmap, OS/2 1.x format @@ -755,7 +760,7 @@ >5 byte 0xFF (black background) # From: Alex Myczko -# http://www.atarimax.com/jindroush.atari.org/afmtatr.html +# https://www.atarimax.com/jindroush.atari.org/afmtatr.html 0 leshort 0x0296 Atari ATR image # XXX: @@ -781,8 +786,8 @@ # PCX image files # From: Dan Fandrich -# updated by Joerg Jenderek at Feb 2013 by http://de.wikipedia.org/wiki/PCX -# http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt +# updated by Joerg Jenderek at Feb 2013 by https://de.wikipedia.org/wiki/PCX +# https://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt # GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000 # test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT 0 ubelong&0xffF8fe00 0x0a000000 @@ -849,7 +854,7 @@ # Update: Joerg Jenderek # See http://fileformats.archiveteam.org/wiki/GEM_Raster # For variations, also see: -# http://www.seasip.info/Gem/ff_img.html (Ventura) +# https://www.seasip.info/Gem/ff_img.html (Ventura) # http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT) # http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT) # http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG) @@ -877,7 +882,7 @@ 0 name gem_info # version is 2 for some XIMG and 1 for all others >0 beshort <0x0003 GEM -# http://www.snowstone.org.uk/riscos/mimeman/mimemap.txt +# https://www.snowstone.org.uk/riscos/mimeman/mimemap.txt !:mime image/x-gem # header_size 24 25 27 59 779 words for colored bitmaps >>2 beshort >9 @@ -1020,8 +1025,8 @@ # and related image processing software used by biologists. # From: Vebjorn Ljosa # BOOL values are two-byte integers; use them to rule out false positives. -# http://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt -# Samples: http://www.loci.wisc.edu/software/sample-data +# https://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt +# Samples: https://www.loci.wisc.edu/software/sample-data 14 leshort <2 >62 leshort <2 >>54 leshort 12345 Bio-Rad .PIC Image File @@ -1052,7 +1057,7 @@ # Originally by Marc Espie # Modified by Robert Minsk -# http://www.openexr.com/openexrfilelayout.pdf +# https://www.openexr.com/openexrfilelayout.pdf 0 lelong 20000630 OpenEXR image data, !:mime image/x-exr >4 lelong&0x000000ff x version %d, @@ -1116,7 +1121,7 @@ >768 beshort 7 bottom to top/right to left # From: Tom Hilinski -# http://www.unidata.ucar.edu/packages/netcdf/ +# https://www.unidata.ucar.edu/packages/netcdf/ 0 string CDF\001 NetCDF Data Format data #----------------------------------------------------------------------- @@ -1141,7 +1146,7 @@ # http://www.xara.com/ for Windows and as GPL application for Linux 0 string XARA\243\243 Xara graphics file -# http://www.cartesianinc.com/Tech/ +# https://www.cartesianinc.com/Tech/ 0 string CPC\262 Cartesian Perceptual Compression image !:mime image/x-cpi @@ -1210,8 +1215,8 @@ # extension is also used for # Sony SRF raw image (image/x-sony-srf) # SRF map -# Terragen Surface Map (http://www.planetside.co.uk/terragen) -# FileLocator Pro search criteria file (http://www.mythicsoft.com/filelocatorpro) +# Terragen Surface Map (https://www.planetside.co.uk/terragen) +# FileLocator Pro search criteria file (https://www.mythicsoft.com/filelocatorpro) !:ext srf #!:mime image/x-garmin-srf # version 1.00,2.00,2.10,2.40,2.50 @@ -1232,7 +1237,7 @@ 0 string Xcur X11 cursor # Type: Olympus ORF raw images. -# URL: http://libopenraw.freedesktop.org/wiki/Olympus_ORF +# URL: https://libopenraw.freedesktop.org/wiki/Olympus_ORF # From: Adam Buchbinder 0 string MMOR Olympus ORF raw image data, big-endian !:mime image/x-olympus-orf @@ -1253,7 +1258,7 @@ #!mime image/vnd.radiance # From: Adam Buchbinder -# URL: http://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf +# URL: https://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf # Used by the pfstools packages. The regex matches for the image size could # probably use some work. The MIME type is made up; if there's one in # actual common use, it should replace the one below. @@ -1263,7 +1268,7 @@ >>1 regex \ [0-9]{4} \bx%s # Type: Foveon X3F -# URL: http://www.photofo.com/downloads/x3f-raw-format.pdf +# URL: https://www.photofo.com/downloads/x3f-raw-format.pdf # From: Adam Buchbinder # Note that the MIME type isn't defined anywhere that I can find; if # there's a canonical type for this format, it should replace this one. @@ -1283,8 +1288,8 @@ # From: "Tano M. Fotang" 0 string \x46\x4d\x52\x00 ISO/IEC 19794-2 Format Minutiae Record (FMR) -# doc: http://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip -# example: http://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip +# doc: https://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip +# example: https://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip 90 bequad 0x574D50484F544F00 JPEG-XR Image >98 byte&0x08 =0x08 \b, hard tiling >99 byte&0x80 =0x80 \b, tiling present @@ -1336,7 +1341,7 @@ # From: Johan van der Knijff # # BPG (Better Portable Graphics) format -# http://bellard.org/bpg/ +# https://bellard.org/bpg/ # http://fileformats.archiveteam.org/wiki/BPG # 0 string \x42\x50\x47\xFB BPG (Better Portable Graphics) @@ -1399,7 +1404,7 @@ >12 ubelong x \b%d # Type: Microsoft DirectDraw Surface (common data) -# URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp +# URL: https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp # From: Morten Hustveit # Updated by: David Korth 0 name ms-directdraw-surface @@ -1501,7 +1506,7 @@ >>>>0x64 ulequad 0xC00000003FF00000 \b, A2B10G10R10 # Type: Microsoft DirectDraw Surface -# URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp +# URL: https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp # From: Morten Hustveit # Updated by: David Korth 0 string/b DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS): @@ -1510,7 +1515,7 @@ # Type: Sega PVR image. # From: David Korth # References: -# - http://fabiensanglard.net/Mykaruga/tools/segaPVRFormat.txt +# - https://fabiensanglard.net/Mykaruga/tools/segaPVRFormat.txt # - https://github.com/yazgoo/pvrx2png # - https://github.com/nickworonekin/puyotools @@ -1553,7 +1558,7 @@ 0 string GBIX >0x10 string PVRT >>0x10 string DDS\040\174\000\000\000 Sega PVR (Xbox) image: ->>0x20 use ms-directdraw-surface +>>>0x20 use ms-directdraw-surface >>0x10 belong !0x44445320 Sega PVR image: >>>0x10 use sega-pvr-image-header >>0x08 lelong x \b, global index = %u @@ -1703,7 +1708,7 @@ >12 lelong 0x04030201 (little-endian) >>16 use khronos-ktx-endian-header >12 belong 0x04030201 (big-endian) ->>16 use ^khronos-ktx-endian-header +>>16 use \^khronos-ktx-endian-header # Type: Valve VTF texture. # From: David Korth @@ -1793,3 +1798,165 @@ 0 string LinS Microsoft Paint image data (version 2.0) >4 leshort x (%d >>6 leshort x x %d) + +# reMarkable tablet internal file format (https://www.remarkable.com/) +# https://github.com/ax3l/lines-are-beautiful +# https://plasma.ninja/blog/devices/remarkable/binary/format/2017/12/26/\ +# reMarkable-lines-file-format.html#what-to-do-next +# from Axel Huebl +0 string reMarkable +>11 string lines +>>17 string with +>>>22 string selections +>>>>33 string and +>>>>>37 string layers +>>>>>>43 lelong x reMarkable tablet notebook lines, 1404 x 1872, %x page(s) + +# newer per-page files for the reMarkable +0 string reMarkable +>11 string .lines +>>18 string file, +>>>24 string version= +>>>>32 byte x reMarkable tablet page (v%c), 1404 x 1872, +>>>>>43 lelong x %d layer(s) + +# Type: PVR3 texture. +# From: David Korth +# References: +# - http://cdn.imgtec.com/sdk-documentation/PVR+File+Format.Specification.pdf + +# PVR3 pixel formats. +0 name pvr3-pixel-format +>4 ulelong 0 +>>0 ulelong 0 PVRTC 2bpp RGB +>>0 ulelong 1 PVRTC 2bpp RGBA +>>0 ulelong 2 PVRTC 4bpp RGB +>>0 ulelong 3 PVRTC 4bpp RGBA +>>0 ulelong 4 PVRTC-II 2bpp +>>0 ulelong 5 PVRTC-II 4bpp +>>0 ulelong 6 ETC1 +>>0 ulelong 7 DXT1 +>>0 ulelong 8 DXT2 +>>0 ulelong 9 DXT3 +>>0 ulelong 10 DXT4 +>>0 ulelong 11 DXT5 +>>0 ulelong 12 BC4 +>>0 ulelong 13 BC5 +>>0 ulelong 14 BC6 +>>0 ulelong 15 BC7 +>>0 ulelong 16 UYVY +>>0 ulelong 17 YUY2 +>>0 ulelong 18 BW1bpp +>>0 ulelong 19 R9G9B9E5 Shared Exponent +>>0 ulelong 20 RGBG8888 +>>0 ulelong 21 GRGB8888 +>>0 ulelong 22 ETC2 RGB +>>0 ulelong 23 ETC2 RGBA +>>0 ulelong 24 ETC2 RGB A1 +>>0 ulelong 25 EAC R11 +>>0 ulelong 26 EAC RG11 +>>0 ulelong 27 ASTC_4x4 +>>0 ulelong 28 ASTC_5x4 +>>0 ulelong 29 ASTC_5x5 +>>0 ulelong 30 ASTC_6x5 +>>0 ulelong 31 ASTC_6x6 +>>0 ulelong 32 ASTC_8x5 +>>0 ulelong 33 ASTC_8x6 +>>0 ulelong 34 ASTC_8x8 +>>0 ulelong 35 ASTC_10x5 +>>0 ulelong 36 ASTC_10x6 +>>0 ulelong 37 ASTC_10x8 +>>0 ulelong 38 ASTC_10x10 +>>0 ulelong 39 ASTC_12x10 +>>0 ulelong 40 ASTC_12x12 +>>0 ulelong 41 ASTC_3x3x3 +>>0 ulelong 42 ASTC_4x3x3 +>>0 ulelong 43 ASTC_4x4x3 +>>0 ulelong 44 ASTC_4x4x4 +>>0 ulelong 45 ASTC_5x4x4 +>>0 ulelong 46 ASTC_5x5x4 +>>0 ulelong 47 ASTC_5x5x5 +>>0 ulelong 48 ASTC_6x5x5 +>>0 ulelong 49 ASTC_6x6x5 +>>0 ulelong 50 ASTC_6x6x6 +>4 ulelong !0 +>>0 byte !0 %c +>>1 byte !0 \b%c +>>2 byte !0 \b%c +>>3 byte !0 \b%c + +0 string PVR\x03 PVR 3.0 texture: +>0x18 ulelong x %u x +>0x1C ulelong x %u +>0x20 ulelong >1 x %u +>0x08 byte x \b, +>0x08 use pvr3-pixel-format +>0x10 ulelong 1 \b, sRGB +>0x04 ulelong&0x02 0x02 \b, premultiplied alpha + +# Type: Microsoft Xbox XPR0 texture. +# From: David Korth +# References: +# - https://github.com/Cxbx-Reloaded/Cxbx-Reloaded/blob/develop/src/core/hle/D3D8/XbD3D8Types.h + +# XPR pixel formats. +0 name xbox-xpr-pixel-format +>0 byte 0x00 L8 +>0 byte 0x01 AL8 +>0 byte 0x02 ARGB1555 +>0 byte 0x03 RGB555 +>0 byte 0x04 ARGB4444 +>0 byte 0x05 RGB565 +>0 byte 0x06 ARGB8888 +>0 byte 0x07 xRGB8888 +>0 byte 0x0B P8 +>0 byte 0x0C DXT1 +>0 byte 0x0E DXT2 +>0 byte 0x0F DXT4 +>0 byte 0x10 Linear ARGB1555 +>0 byte 0x11 Linear RGB565 +>0 byte 0x12 Linear ARGB8888 +>0 byte 0x13 Linear L8 +>0 byte 0x16 Linear R8B8 +>0 byte 0x17 Linear G8B8 +>0 byte 0x19 A8 +>0 byte 0x1A A8L8 +>0 byte 0x1B Linear AL8 +>0 byte 0x1C Linear RGB555 +>0 byte 0x1D Linear ARGB4444 +>0 byte 0x1E Linear xRGB8888 +>0 byte 0x1F Linear A8 +>0 byte 0x20 Linear A8L8 +>0 byte 0x24 YUY2 +>0 byte 0x25 UYVY +>0 byte 0x27 L6V5U5 +>0 byte 0x28 V8U8 +>0 byte 0x29 R8B8 +>0 byte 0x2A D24S8 +>0 byte 0x2B F24S8 +>0 byte 0x2C D16 +>0 byte 0x2D F16 +>0 byte 0x2E Linear D24S8 +>0 byte 0x2F Linear F24S8 +>0 byte 0x30 Linear D16 +>0 byte 0x31 Linear F16 +>0 byte 0x32 L16 +>0 byte 0x33 V16U16 +>0 byte 0x35 Linear L16 +>0 byte 0x36 Linear V16U16 +>0 byte 0x37 Linear L6V5U5 +>0 byte 0x38 RGBA5551 +>0 byte 0x39 RGBA4444 +>0 byte 0x3A QWVU8888 +>0 byte 0x3B BGRA8888 +>0 byte 0x3C RGBA8888 +>0 byte 0x3D Linear RGBA5551 +>0 byte 0x3E Linear RGBA4444 +>0 byte 0x3F Linear ABGR8888 +>0 byte 0x40 Linear BGRA8888 +>0 byte 0x41 Linear RGBA8888 +>0 byte 0x64 Vertex Data + +0 string XPR0 Microsoft Xbox XPR0 texture +>0x19 byte x \b, format: +>>0x19 use xbox-xpr-pixel-format diff --git a/contrib/file/magic/Magdir/intel b/contrib/file/magic/Magdir/intel index 8a7eae4ee1ee..85e2abef457d 100644 --- a/contrib/file/magic/Magdir/intel +++ b/contrib/file/magic/Magdir/intel @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: intel,v 1.16 2017/11/14 15:48:36 christos Exp $ +# $File: intel,v 1.17 2018/08/01 10:34:03 christos Exp $ # intel: file(1) magic for x86 Unix # # Various flavors of x86 UNIX executable/object (other than Xenix, which @@ -42,6 +42,10 @@ #>12 lelong >0 not stripped # no hint found, that at offset 22 is version #>22 leshort >0 - version %d +0 leshort 0x0200 +>0 use display-coff +0 leshort 0x8664 +>0 use display-coff # rom: file(1) magic for BIOS ROM Extensions found in intel machines # mapped into memory between 0xC0000 and 0xFFFFF diff --git a/contrib/file/magic/Magdir/isz b/contrib/file/magic/Magdir/isz index af68db2b3e2e..4d9c03084445 100644 --- a/contrib/file/magic/Magdir/isz +++ b/contrib/file/magic/Magdir/isz @@ -1,8 +1,8 @@ #------------------------------------------------------------------------------ -# $File: isz,v 1.4 2017/03/17 21:35:28 christos Exp $ +# $File: isz,v 1.5 2019/04/19 00:42:27 christos Exp $ # ISO Zipped file format -# http://www.ezbsystems.com/isz/iszspec.txt +# https://www.ezbsystems.com/isz/iszspec.txt 0 string IsZ! ISO Zipped file >4 byte x \b, header size %u >5 byte x \b, version %u diff --git a/contrib/file/magic/Magdir/java b/contrib/file/magic/Magdir/java index 21acf295e086..b9854e54c159 100644 --- a/contrib/file/magic/Magdir/java +++ b/contrib/file/magic/Magdir/java @@ -1,6 +1,6 @@ #------------------------------------------------------------ -# $File: java,v 1.18 2015/11/29 22:08:14 christos Exp $ +# $File: java,v 1.21 2019/02/18 17:58:50 christos Exp $ # Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the # same magic number, 0xcafebabe, so they are both handled # in the entry called "cafebabe". @@ -22,6 +22,24 @@ # Java HPROF dumps # https://java.net/downloads/heap-snapshot/hprof-binary-format.html 0 string JAVA\x20PROFILE\x201.0. ->0x12 short 0 ->>0x11 ushort-0x31 <2 Java HPROF dump, ->>0x17 beqdate/1000 x created %s +>0x12 byte 0 +>>0x11 ubyte-0x31 <2 Java HPROF dump, +>>>0x17 beqdate/1000 x created %s + +# Java jmod module +# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/classes/jdk/internal/jmod/JmodFile.java +# Grr. 2 byte magic "JM", really? In 2019? +0 belong 0x4a4d0100 Java jmod module version 1.0 +!:mime application/x-java-jmod + +# Java jlinked image +# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/native/libjimage/imageFile.hpp +0 belong 0xcafedada Java module image (big endian) +>4 beshort >0x00 \b, version %d +>6 beshort x \b.%d +!:mime application/x-java-image + +0 lelong 0xcafedada Java module image (little endian) +>6 leshort >0x00 \b, version %d +>4 leshort x \b.%d +!:mime application/x-java-image diff --git a/contrib/file/magic/Magdir/jpeg b/contrib/file/magic/Magdir/jpeg index 57adb1e546b0..52c9ad36203e 100644 --- a/contrib/file/magic/Magdir/jpeg +++ b/contrib/file/magic/Magdir/jpeg @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: jpeg,v 1.31 2017/03/17 21:35:28 christos Exp $ +# $File: jpeg,v 1.32 2018/10/01 18:58:29 christos Exp $ # JPEG images # SunOS 5.5.1 had # @@ -51,21 +51,21 @@ >>4 byte x \b, baseline, precision %d >>7 beshort x \b, %dx >>5 beshort x \b%d ->>9 byte x \b, frames %d +>>9 byte x \b, components %d >0 beshort 0xFFC1 >>(2.S+2) use jpeg_segment >>4 byte x \b, extended sequential, precision %d >>7 beshort x \b, %dx >>5 beshort x \b%d ->>9 byte x \b, frames %d +>>9 byte x \b, components %d >0 beshort 0xFFC2 >>(2.S+2) use jpeg_segment >>4 byte x \b, progressive, precision %d >>7 beshort x \b, %dx >>5 beshort x \b%d ->>9 byte x \b, frames %d +>>9 byte x \b, components %d # Define Huffman Tables >0 beshort 0xFFC4 diff --git a/contrib/file/magic/Magdir/keepass b/contrib/file/magic/Magdir/keepass index ba132d57de83..3d26efa5c56f 100644 --- a/contrib/file/magic/Magdir/keepass +++ b/contrib/file/magic/Magdir/keepass @@ -1,12 +1,12 @@ #------------------------------------------------------------------------------ -# $File: keepass,v 1.1 2012/12/24 22:14:56 christos Exp $ +# $File: keepass,v 1.2 2019/04/19 00:42:27 christos Exp $ # keepass: file(1) magic for KeePass file # # Keepass Password Safe: -# * original one: http://keepass.info/ -# * *nix port: http://www.keepassx.org/ -# * android port: http://code.google.com/p/keepassdroid/ +# * original one: https://keepass.info/ +# * *nix port: https://www.keepassx.org/ +# * android port: https://code.google.com/p/keepassdroid/ 0 lelong 0x9AA2D903 Keepass password database >4 lelong 0xB54BFB65 1.x KDB diff --git a/contrib/file/magic/Magdir/kerberos b/contrib/file/magic/Magdir/kerberos index 93b8f79de99b..df6dc5236446 100644 --- a/contrib/file/magic/Magdir/kerberos +++ b/contrib/file/magic/Magdir/kerberos @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: kerberos,v 1.2 2017/03/17 21:35:28 christos Exp $ +# $File: kerberos,v 1.3 2019/04/19 00:42:27 christos Exp $ # kerberos: MIT kerberos file binary formats # @@ -24,7 +24,7 @@ # can refer to ${name} # - Provide a way to format strings as hex values # -# http://www.gnu.org/software/shishi/manual/html_node/\ +# https://www.gnu.org/software/shishi/manual/html_node/\ # The-Keytab-Binary-File-Format.html # diff --git a/contrib/file/magic/Magdir/kicad b/contrib/file/magic/Magdir/kicad new file mode 100644 index 000000000000..00c9ead5ae9b --- /dev/null +++ b/contrib/file/magic/Magdir/kicad @@ -0,0 +1,69 @@ + +#------------------------------------------------------------------------------ +# $File: kicad,v 1.1 2018/10/01 18:39:21 christos Exp $ +# kicad: file(1) magic for KiCad files +# +# See +# +# http://kicad-pcb.org +# + +# KiCad Schematic Document +0 string EESchema +>8 byte 0x20 +>>9 string Schematic +>>>18 byte 0x20 KiCad Schematic Document +!:ext sch/bak +>>>>24 string Version +>>>>>31 byte 0x20 +>>>>>>32 string x (Version %s) + +# KiCad Symbol Library +0 string EESchema-LIBRARY +>16 byte 0x20 KiCad Symbol Library +!:ext lib +>>17 string Version +>>>24 byte 0x20 +>>>>25 string x (Version %s) + +# KiCad Symbol Library Documentation +0 string EESchema-DOCLIB +>15 byte 0x20 KiCad Symbol Library Documentation +!:ext dcm +>>17 string Version +>>>24 byte 0x20 +>>>>25 string x (Version %s) + +# KiCad Board Layout +0 string (kicad_pcb +>10 byte 0x20 KiCad Board Layout +!:ext kicad_pcb/kicad_pcb-bak +>>11 string (version +>>>19 byte 0x20 +>>>>20 byte x (Version %c) + +# KiCad Footprint +0 string (module +>7 byte 0x20 KiCad Footprint +!:ext kicad_mod + +# KiCad Footprint (Legacy) +0 string PCBNEW-LibModule-V1 KiCad Footprint (Legacy) +!:ext mod + +# KiCad Netlist +0 string (export +>7 byte 0x20 KiCad Netlist +!:ext net + +# KiCad Symbol Library Table +0 string (sym_lib_table +>14 byte 0xA KiCad Symbol Library Table +>14 byte 0xD KiCad Symbol Library Table +>14 byte 0x20 KiCad Symbol Library Table + +# KiCad Footprint Library Table +0 string (fp_lib_table +>13 byte 0xA KiCad Footprint Library Table +>13 byte 0xD KiCad Footprint Library Table +>13 byte 0x20 KiCad Footprint Library Table diff --git a/contrib/file/magic/Magdir/kml b/contrib/file/magic/Magdir/kml index d603ea806288..dcdf64cf454f 100644 --- a/contrib/file/magic/Magdir/kml +++ b/contrib/file/magic/Magdir/kml @@ -1,14 +1,14 @@ #------------------------------------------------------------------------------ -# $File: kml,v 1.4 2017/03/17 21:35:28 christos Exp $ +# $File: kml,v 1.5 2019/04/19 00:42:27 christos Exp $ # Type: Google KML, formerly Keyhole Markup Language # Future development of this format has been handed # over to the Open Geospatial Consortium. -# http://www.opengeospatial.org/standards/kml/ +# https://www.opengeospatial.org/standards/kml/ # From: Asbjoern Sloth Toennesen 0 string/t \20 search/400 \ xmlns= ->>&0 regex ['"]http://earth.google.com/kml Google KML document +>>&0 regex ['"]https://earth.google.com/kml Google KML document !:mime application/vnd.google-earth.kml+xml >>>&1 string 2.0' \b, version 2.0 >>>&1 string 2.1' \b, version 2.1 @@ -18,15 +18,15 @@ # Type: OpenGIS KML, formerly Keyhole Markup Language # This standard is maintained by the # Open Geospatial Consortium. -# http://www.opengeospatial.org/standards/kml/ +# https://www.opengeospatial.org/standards/kml/ # From: Asbjoern Sloth Toennesen ->>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document +>>&0 regex ['"]https://www.opengis.net/kml OpenGIS KML document !:mime application/vnd.google-earth.kml+xml >>>&1 string/t 2.2 \b, version 2.2 #------------------------------------------------------------------------------ # Type: Google KML Archive (ZIP based) -# http://code.google.com/apis/kml/documentation/kml_tut.html +# https://code.google.com/apis/kml/documentation/kml_tut.html # From: Asbjoern Sloth Toennesen 0 string PK\003\004 >4 byte 0x14 diff --git a/contrib/file/magic/Magdir/linux b/contrib/file/magic/Magdir/linux index 0486656f6a6b..ed7dcd10a251 100644 --- a/contrib/file/magic/Magdir/linux +++ b/contrib/file/magic/Magdir/linux @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: linux,v 1.65 2018/07/16 12:32:08 christos Exp $ +# $File: linux,v 1.67 2019/04/19 00:42:27 christos Exp $ # linux: file(1) magic for Linux files # # Values for Linux/i386 binaries, from Daniel Quinlan @@ -56,7 +56,7 @@ # # PSF fonts, from H. Peter Anvin # Updated by Adam Buchbinder -# See: http://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html +# See: https://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html 0 leshort 0x0436 Linux/i386 PC Screen Font v1 data, >2 byte&0x01 0 256 characters, >2 byte&0x01 !0 512 characters, @@ -79,7 +79,7 @@ 4076 string SWAPSPACE2LINHIB0001 Linux/i386 swap file (new style) (compressed hibernate) # according to man page of mkswap (8) March 1999 # volume label and UUID Russell Coker -# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ +# https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 4086 string SWAPSPACE2 Linux/i386 swap file (new style), >0x400 long x version %d (4K pages), >0x404 long x size %d pages, @@ -111,8 +111,13 @@ # and Nicolas Lichtmaier # All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 # Linux kernel boot images (i386 arch) (Wolfram Kleff) +# URL: https://www.kernel.org/doc/Documentation/x86/boot.txt 514 string HdrS Linux kernel !:strength + 55 +# often no extension like in linux, vmlinuz, bzimage or memdisk but sometimes +# Acronis Recovery kernel64.dat and Plop Boot Manager plpbtrom.bin +# DamnSmallLinux 1.5 damnsmll.lnx +!:ext /dat/bin/lnx >510 leshort 0xAA55 x86 boot executable >>518 leshort >0x1ff >>>529 byte 0 zImage, @@ -203,7 +208,10 @@ # Linux ARM compressed kernel image # From: Kevin Cernekee +# Update: Joerg Jenderek 36 lelong 0x016f2818 Linux kernel ARM boot executable zImage (little-endian) +# raspian "kernel7.img", Vu+ Ultimo4K "kernel_auto.bin" +!:ext img/bin 36 belong 0x016f2818 Linux kernel ARM boot executable zImage (big-endian) ############################################################################ @@ -232,7 +240,7 @@ # 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable # SYSLINUX boot logo files (from 'ppmtolss16' sources) -# http://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename: +# https://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename: # file extension .lss .16 0 lelong =0x1413f33d SYSLINUX' LSS16 image data # syslinux-4.05/mime/image/x-lss16.xml @@ -361,7 +369,7 @@ >>&1 string x %s...) # Systemd journald files -# See http://www.freedesktop.org/wiki/Software/systemd/journal-files/. +# See https://www.freedesktop.org/wiki/Software/systemd/journal-files/. # From: Zbigniew Jedrzejewski-Szmek # check magic @@ -453,7 +461,7 @@ # the default version of locate on Arch Linux (and others). # File path: /var/lib/mlocate/mlocate.db by default (but configurable) # Site: https://fedorahosted.org/mlocate/ -# Format docs: http://linux.die.net/man/5/mlocate.db +# Format docs: https://linux.die.net/man/5/mlocate.db # Type: mlocate database file # URL: https://fedorahosted.org/mlocate/ # From: Wander Nauta @@ -469,14 +477,14 @@ 0 lelong 0x47361222 iproute2 addresses dump # Image and service files for CRIU tool. -# URL: http://criu.org +# URL: https://criu.org # From: Pavel Emelyanov 0 lelong 0x54564319 CRIU image file v1.1 0 lelong 0x55105940 CRIU service file 0 lelong 0x58313116 CRIU inventory # Kdump compressed dump files -# http://sourceforge.net/p/makedumpfile/code/ci/master/tree/IMPLEMENTATION +# https://sourceforge.net/p/makedumpfile/code/ci/master/tree/IMPLEMENTATION 0 string KDUMP Kdump compressed dump >8 long x v%d diff --git a/contrib/file/magic/Magdir/lisp b/contrib/file/magic/Magdir/lisp index 43d102e1dd76..d32cc101a90a 100644 --- a/contrib/file/magic/Magdir/lisp +++ b/contrib/file/magic/Magdir/lisp @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: lisp,v 1.25 2017/03/17 21:35:28 christos Exp $ +# $File: lisp,v 1.26 2019/04/19 00:42:27 christos Exp $ # lisp: file(1) magic for lisp programs # # various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) @@ -27,7 +27,7 @@ !:mime text/x-lisp # URL: https://en.wikipedia.org/wiki/Emacs_Lisp -# Reference: http://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz +# Reference: https://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz # Update: Joerg Jenderek # Emacs 18 - this is always correct, but not very magical. 0 string \012( diff --git a/contrib/file/magic/Magdir/llvm b/contrib/file/magic/Magdir/llvm index 1f15eac7b52e..2691ef1ac92f 100644 --- a/contrib/file/magic/Magdir/llvm +++ b/contrib/file/magic/Magdir/llvm @@ -1,8 +1,8 @@ #------------------------------------------------------------------------------ -# $File: llvm,v 1.8 2013/01/12 03:09:51 christos Exp $ +# $File: llvm,v 1.9 2019/04/19 00:42:27 christos Exp $ # llvm: file(1) magic for LLVM byte-codes -# URL: http://llvm.org/docs/BitCodeFormat.html +# URL: https://llvm.org/docs/BitCodeFormat.html # From: Al Stone 0 string llvm LLVM byte-codes, uncompressed diff --git a/contrib/file/magic/Magdir/lua b/contrib/file/magic/Magdir/lua index 4c578be60ff5..0e47c2f9122a 100644 --- a/contrib/file/magic/Magdir/lua +++ b/contrib/file/magic/Magdir/lua @@ -1,8 +1,8 @@ #------------------------------------------------------------------------------ -# $File: lua,v 1.6 2013/01/09 16:23:17 christos Exp $ +# $File: lua,v 1.7 2019/04/19 00:42:27 christos Exp $ # lua: file(1) magic for Lua scripting language -# URL: http://www.lua.org/ +# URL: https://www.lua.org/ # From: Reuben Thomas , Seo Sanghyeon # Lua scripts diff --git a/contrib/file/magic/Magdir/m4 b/contrib/file/magic/Magdir/m4 index 3a1c6d19f7db..587ebe80c66d 100644 --- a/contrib/file/magic/Magdir/m4 +++ b/contrib/file/magic/Magdir/m4 @@ -1,9 +1,11 @@ #------------------------------------------------------------------------------ -# $File: m4,v 1.2 2017/08/14 07:40:38 christos Exp $ +# $File: m4,v 1.3 2019/02/27 16:46:23 christos Exp $ # make: file(1) magic for M4 scripts # -0 regex \^dnl\ M4 macro processor script text +0 search/8192 dnl +>0 regex \^dnl\ M4 macro processor script text !:mime text/x-m4 -0 regex \^AC_DEFUN\\(\\[ M4 macro processor script text +0 search/8192 AC_DEFUN +>0 regex \^AC_DEFUN\\(\\[ M4 macro processor script text !:strength + 15 !:mime text/x-m4 diff --git a/contrib/file/magic/Magdir/macintosh b/contrib/file/magic/Magdir/macintosh index 249a4d8050b6..2a9f7a7b9897 100644 --- a/contrib/file/magic/Magdir/macintosh +++ b/contrib/file/magic/Magdir/macintosh @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: macintosh,v 1.28 2017/12/05 02:17:48 christos Exp $ +# $File: macintosh,v 1.29 2019/04/19 00:42:27 christos Exp $ # macintosh description # # BinHex is the Macintosh ASCII-encoded file format (see also "apple") @@ -62,7 +62,7 @@ # MacBinary format (Eric Fischer, enf@pobox.com) # Update: Joerg Jenderek # URL: https://en.wikipedia.org/wiki/MacBinary -# Reference: http://files.stairways.com/other/macbinaryii-standard-info.txt +# Reference: https://files.stairways.com/other/macbinaryii-standard-info.txt # # Unfortunately MacBinary doesn't really have a magic number prior # to the MacBinary III format. @@ -180,8 +180,8 @@ # Apple Type/Creator Database # URL: https://en.wikipedia.org/wiki/Type_code -# Reference: http://www.lacikam.co.il/tcdb/ -# http://www.macdisk.com/macsigen.php +# Reference: https://www.lacikam.co.il/tcdb/ +# https://www.macdisk.com/macsigen.php # Note: classic Mac OS files have two 4 character codes for type and creator. # Thereby the Finder attach documents types to applications. @@ -379,7 +379,7 @@ >0x424 pstring x volume name: %s # *.hfs updated by Joerg Jenderek -# http://en.wikipedia.org/wiki/Hierarchical_File_System +# https://en.wikipedia.org/wiki/Hierarchical_File_System # "BD" gives many false positives 0x400 beshort 0x4244 # ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h @@ -390,7 +390,7 @@ !:mime application/x-apple-diskimage #!:apple hfsdINIT #!:apple MACSdisk -# http://www.macdisk.com/macsigen.php +# https://www.macdisk.com/macsigen.php #!:apple ddskdevi !:apple ????devi # https://en.wikipedia.org/wiki/Apple_Disk_Image @@ -402,7 +402,7 @@ >>>0x40a beshort &0x0200 (spared blocks) >>>0x40a beshort &0x0800 (unclean) >>>0x47C beshort 0x482B (Embedded HFS+ Volume) -# http://www.epochconverter.com/ +# https://www.epochconverter.com/ # 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970 # 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00 # construct not working @@ -458,7 +458,7 @@ 0 string BOMStore Mac OS X bill of materials (BOM) file # From: Adam Buchbinder -# URL: http://en.wikipedia.org/wiki/Datafork_TrueType +# URL: https://en.wikipedia.org/wiki/Datafork_TrueType # Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is # TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I # don't know what they mean. diff --git a/contrib/file/magic/Magdir/mail.news b/contrib/file/magic/Magdir/mail.news index a61bc72cb8d9..c58b3710af28 100644 --- a/contrib/file/magic/Magdir/mail.news +++ b/contrib/file/magic/Magdir/mail.news @@ -1,5 +1,5 @@ #------------------------------------------------------------------------------ -# $File: mail.news,v 1.23 2015/06/29 14:44:26 christos Exp $ +# $File: mail.news,v 1.24 2019/04/19 00:42:27 christos Exp $ # mail.news: file(1) magic for mail and news # # Unfortunately, saved netnews also has From line added in some news software. @@ -57,7 +57,7 @@ #0 string \