API tools faq
paste
AyrA

magic

AyrA
Sep 23rd, 2014
4,751
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 486.17 KB | None | 0 0
raw download clone embed print report
  1. # Magic
  2. # Magic data for file(1) command.
  3. # Machine-generated from src/cmd/file/magdir/*; edit there only!
  4. # Format is described in magic(files), where:
  5. # files is 5 on V7 and BSD, 4 on SV, and ?? in the SVID.
  6.  
  7. #------------------------------------------------------------------------------
  8. # Localstuff: file(1) magic for locally observed files
  9. #
  10. # $File: Localstuff,v 1.4 2003/03/23 04:17:27 christos Exp $
  11. # Add any locally observed files here. Remember:
  12. # text if readable, executable if runnable binary, data if unreadable.
  13. #------------------------------------------------------------------------------
  14. # acorn: file(1) magic for files found on Acorn systems
  15. #
  16.  
  17. # RISC OS Chunk File Format
  18. # From RISC OS Programmer's Reference Manual, Appendix D
  19. # We guess the file type from the type of the first chunk.
  20. 0 lelong 0xc3cbc6c5 RISC OS Chunk data
  21. >12 string OBJ_ \b, AOF object
  22. >12 string LIB_ \b, ALF library
  23.  
  24. # RISC OS AIF, contains "SWI OS_Exit" at offset 16.
  25. 16 lelong 0xef000011 RISC OS AIF executable
  26.  
  27. # RISC OS Draw files
  28. # From RISC OS Programmer's Reference Manual, Appendix E
  29. 0 string Draw RISC OS Draw file data
  30.  
  31. # RISC OS new format font files
  32. # From RISC OS Programmer's Reference Manual, Appendix E
  33. 0 string FONT\0 RISC OS outline font data,
  34. >5 byte x version %d
  35. 0 string FONT\1 RISC OS 1bpp font data,
  36. >5 byte x version %d
  37. 0 string FONT\4 RISC OS 4bpp font data
  38. >5 byte x version %d
  39.  
  40. # RISC OS Music files
  41. # From RISC OS Programmer's Reference Manual, Appendix E
  42. 0 string Maestro\r RISC OS music file
  43. >8 byte x version %d
  44.  
  45. >8 byte x type %d
  46.  
  47. # Digital Symphony data files
  48. # From: Bernard Jungen (bern8817@euphonynet.be)
  49. 0 string \x02\x01\x13\x13\x13\x01\x0d\x10 Digital Symphony sound sample (RISC OS),
  50. >8 byte x version %d,
  51. >9 pstring x named "%s",
  52. >(9.b+19) byte =0 8-bit logarithmic
  53. >(9.b+19) byte =1 LZW-compressed linear
  54. >(9.b+19) byte =2 8-bit linear signed
  55. >(9.b+19) byte =3 16-bit linear signed
  56. >(9.b+19) byte =4 SigmaDelta-compressed linear
  57. >(9.b+19) byte =5 SigmaDelta-compressed logarithmic
  58. >(9.b+19) byte >5 unknown format
  59.  
  60. 0 string \x02\x01\x13\x13\x14\x12\x01\x0b Digital Symphony song (RISC OS),
  61. >8 byte x version %d,
  62. >9 byte =1 1 voice,
  63. >9 byte !1 %d voices,
  64. >10 leshort =1 1 track,
  65. >10 leshort !1 %d tracks,
  66. >12 leshort =1 1 pattern
  67. >12 leshort !1 %d patterns
  68.  
  69. 0 string \x02\x01\x13\x13\x10\x14\x12\x0e
  70. >9 byte =0 Digital Symphony sequence (RISC OS),
  71. >>8 byte x version %d,
  72. >>10 byte =1 1 line,
  73. >>10 byte !1 %d lines,
  74. >>11 leshort =1 1 position
  75. >>11 leshort !1 %d positions
  76. >9 byte =1 Digital Symphony pattern data (RISC OS),
  77. >>8 byte x version %d,
  78. >>10 leshort =1 1 pattern
  79. >>10 leshort !1 %d patterns
  80.  
  81. #------------------------------------------------------------------------------
  82. # adi: file(1) magic for ADi's objects
  83. # From Gregory McGarry <g.mcgarry@ieee.org>
  84. #
  85. 0 leshort 0x521c COFF DSP21k
  86. >18 lelong &02 executable,
  87. >18 lelong ^02
  88. >>18 lelong &01 static object,
  89. >>18 lelong ^01 relocatable object,
  90. >18 lelong &010 stripped
  91. >18 lelong ^010 not stripped
  92.  
  93. #------------------------------------------------------------------------------
  94. # adventure: file(1) magic for Adventure game files
  95. #
  96. # from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
  97. # Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998
  98. # Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
  99. #
  100. # ALAN
  101. # I assume there are other, lower versions, but these are the only ones I
  102. # saw in the archive.
  103. 0 beshort 0x0206 ALAN game data
  104. >2 byte <10 version 2.6%d
  105.  
  106.  
  107. # Infocom (see z-machine)
  108. #------------------------------------------------------------------------------
  109. # Z-machine: file(1) magic for Z-machine binaries.
  110. #
  111. # This will match ${TEX_BASE}/texmf/omega/ocp/char2uni/inbig5.ocp which
  112. # appears to be a version-0 Z-machine binary.
  113. #
  114. # The (false match) message is to correct that behavior. Perhaps it is
  115. # not needed.
  116. #
  117. 16 belong&0xfe00f0f0 0x3030 Infocom game data
  118. >0 ubyte 0 (false match)
  119. >0 ubyte >0 (Z-machine %d,
  120. >>2 ubeshort x Release %d /
  121. >>18 string >\0 Serial %.6s)
  122.  
  123. #------------------------------------------------------------------------------
  124. # Glulx: file(1) magic for Glulx binaries.
  125. #
  126. # I haven't checked for false matches yet.
  127. #
  128. 0 string Glul Glulx game data
  129. >4 beshort x (Version %d
  130. >>6 byte x \b.%d
  131. >>8 byte x \b.%d)
  132. >36 string Info Compiled by Inform
  133.  
  134.  
  135.  
  136. # For Quetzal and blorb magic see iff
  137.  
  138.  
  139. # TADS (Text Adventure Development System)
  140. # All files are machine-independent (games compile to byte-code) and are tagged
  141. # with a version string of the form "V2.<digit>.<digit>\0" (but TADS 3 is
  142. # on the way).
  143. # Game files start with "TADS2 bin\n\r\032\0" then the compiler version.
  144. 0 string TADS2\ bin TADS
  145. >9 belong !0x0A0D1A00 game data, CORRUPTED
  146. >9 belong 0x0A0D1A00
  147. >>13 string >\0 %s game data
  148. # Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version.
  149. 0 string TADS2\ rsc TADS
  150. >9 belong !0x0A0D1A00 resource data, CORRUPTED
  151. >9 belong 0x0A0D1A00
  152. >>13 string >\0 %s resource data
  153. # Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
  154. # 2-byte length N, the N-char name of the game file *without* a NUL (darn!),
  155. # "TADS2 save\n\r\032\0" and the interpreter version.
  156. 0 string TADS2\ save/g TADS
  157. >12 belong !0x0A0D1A00 saved game data, CORRUPTED
  158. >12 belong 0x0A0D1A00
  159. >>(16.s+32) string >\0 %s saved game data
  160. # Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter
  161. # version.
  162. 0 string TADS2\ save TADS
  163. >10 belong !0x0A0D1A00 saved game data, CORRUPTED
  164. >10 belong 0x0A0D1A00
  165. >>14 string >\0 %s saved game data
  166.  
  167. #------------------------------------------------------------------------------
  168. # allegro: file(1) magic for Allegro datafiles
  169. # Toby Deshane <hac@shoelace.digivill.net>
  170. #
  171. 0 belong 0x736C6821 Allegro datafile (packed)
  172. 0 belong 0x736C682E Allegro datafile (not packed/autodetect)
  173. 0 belong 0x736C682B Allegro datafile (appended exe data)
  174.  
  175. #------------------------------------------------------------------------------
  176. # alliant: file(1) magic for Alliant FX series a.out files
  177. #
  178. # If the FX series is the one that had a processor with a 68K-derived
  179. # instruction set, the "short" should probably become "beshort" and the
  180. # "long" should probably become "belong".
  181. # If it's the i860-based one, they should probably become either the
  182. # big-endian or little-endian versions, depending on the mode they ran
  183. # the 860 in....
  184. #
  185. 0 short 0420 0420 Alliant virtual executable
  186. >2 short &0x0020 common library
  187. >16 long >0 not stripped
  188. 0 short 0421 0421 Alliant compact executable
  189. >2 short &0x0020 common library
  190. >16 long >0 not stripped
  191. #------------------------------------------------------------------------------
  192. # alpha architecture description
  193. #
  194.  
  195. 0 leshort 0603 COFF format alpha
  196. >22 leshort&030000 !020000 executable
  197. >24 leshort 0410 pure
  198. >24 leshort 0413 paged
  199. >22 leshort&020000 !0 dynamically linked
  200. >16 lelong !0 not stripped
  201. >16 lelong 0 stripped
  202. >22 leshort&030000 020000 shared library
  203. >24 leshort 0407 object
  204. >27 byte x - version %d
  205. >26 byte x .%d
  206. >28 byte x -%d
  207.  
  208. # Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
  209. #
  210. # The actual magic number is just "Core", followed by a 2-byte version
  211. # number; however, treating any file that begins with "Core" as a Digital
  212. # UNIX core dump file may produce too many false hits, so we include one
  213. # byte of the version number as well; DU 5.0 appears only to be up to
  214. # version 2.
  215. #
  216. 0 string Core\001 Alpha COFF format core dump (Digital UNIX)
  217. >24 string >\0 \b, from '%s'
  218. 0 string Core\002 Alpha COFF format core dump (Digital UNIX)
  219. >24 string >\0 \b, from '%s'
  220.  
  221. #------------------------------------------------------------------------------
  222. # amanda: file(1) magic for amanda file format
  223. #
  224. 0 string AMANDA:\ AMANDA
  225. >8 string TAPESTART\ DATE tape header file,
  226. >>23 string X
  227. >>>25 string >\ Unused %s
  228. >>23 string >\ DATE %s
  229. >8 string FILE\ dump file,
  230. >>13 string >\ DATE %s
  231. #------------------------------------------------------------------------------
  232. # amigaos: file(1) magic for AmigaOS binary formats:
  233.  
  234. #
  235. # From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
  236. #
  237. 0 belong 0x000003fa AmigaOS shared library
  238. 0 belong 0x000003f3 AmigaOS loadseg()ble executable/binary
  239. 0 belong 0x000003e7 AmigaOS object/library data
  240. #
  241. 0 beshort 0xe310 Amiga Workbench
  242. >2 beshort 1
  243. >>48 byte 1 disk icon
  244. >>48 byte 2 drawer icon
  245. >>48 byte 3 tool icon
  246. >>48 byte 4 project icon
  247. >>48 byte 5 garbage icon
  248. >>48 byte 6 device icon
  249. >>48 byte 7 kickstart icon
  250. >>48 byte 8 workbench application icon
  251. >2 beshort >1 icon, vers. %d
  252. #
  253. # various sound formats from the Amiga
  254. # G=F6tz Waschk <waschk@informatik.uni-rostock.de>
  255. #
  256. 0 string FC14 Future Composer 1.4 Module sound file
  257. 0 string SMOD Future Composer 1.3 Module sound file
  258. 0 string AON4artofnoise Art Of Noise Module sound file
  259. 1 string MUGICIAN/SOFTEYES Mugician Module sound file
  260. 58 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file
  261. 0 string Synth4.0 Synthesis Module sound file
  262. 0 string ARP. The Holy Noise Module sound file
  263. 0 string BeEp\0 JamCracker Module sound file
  264. 0 string COSO\0 Hippel-COSO Module sound file
  265. # Too simple (short, pure ASCII, deep), MPi
  266. #26 string V.3 Brian Postma's Soundmon Module sound file v3
  267. #26 string BPSM Brian Postma's Soundmon Module sound file v3
  268. #26 string V.2 Brian Postma's Soundmon Module sound file v2
  269.  
  270. # The following are from: "Stefan A. Haubenthal" <polluks@web.de>
  271. 0 beshort 0x0f00 AmigaOS bitmap font
  272. 0 beshort 0x0f03 AmigaOS outline font
  273. 0 belong 0x80001001 AmigaOS outline tag
  274. 0 string ##\ version catalog translation
  275. 0 string EMOD\0 Amiga E module
  276. 8 string ECXM\0 ECX module
  277. 0 string/c @database AmigaGuide file
  278.  
  279. # Amiga disk types
  280. #
  281. 0 string RDSK Rigid Disk Block
  282. >160 string x on %.24s
  283. 0 string DOS\0 Amiga DOS disk
  284. 0 string DOS\1 Amiga FFS disk
  285. 0 string DOS\2 Amiga Inter DOS disk
  286. 0 string DOS\3 Amiga Inter FFS disk
  287. 0 string DOS\4 Amiga Fastdir DOS disk
  288. 0 string DOS\5 Amiga Fastdir FFS disk
  289. 0 string KICK Kickstart disk
  290.  
  291. # From: Alex Beregszaszi <alex@fsn.hu>
  292. 0 string LZX LZX compressed archive (Amiga)
  293.  
  294.  
  295. #------------------------------------------------------------------------------
  296. # animation: file(1) magic for animation/movie formats
  297. #
  298. # animation formats
  299. # MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
  300. # FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
  301.  
  302. # SGI and Apple formats
  303. 0 string MOVI Silicon Graphics movie file
  304. 4 string moov Apple QuickTime
  305. >12 string mvhd \b movie (fast start)
  306. >12 string mdra \b URL
  307. >12 string cmov \b movie (fast start, compressed header)
  308. >12 string rmra \b multiple URLs
  309. 4 string mdat Apple QuickTime movie (unoptimized)
  310. 4 string wide Apple QuickTime movie (unoptimized)
  311. 4 string skip Apple QuickTime movie (modified)
  312. 4 string free Apple QuickTime movie (modified)
  313. 4 string idsc Apple QuickTime image (fast start)
  314. 4 string idat Apple QuickTime image (unoptimized)
  315. 4 string pckg Apple QuickTime compressed archive
  316. 4 string/B jP JPEG 2000 image
  317. 4 string ftyp ISO Media
  318. >8 string isom \b, MPEG v4 system, version 1
  319. >8 string iso2 \b, MPEG v4 system, part 12 revision
  320. >8 string mp41 \b, MPEG v4 system, version 1
  321. >8 string mp42 \b, MPEG v4 system, version 2
  322. >8 string mp7t \b, MPEG v4 system, MPEG v7 XML
  323. >8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML
  324. >8 string/B jp2 \b, JPEG 2000
  325. >8 string 3gp \b, MPEG v4 system, 3GPP
  326. >>11 byte 4 \b v4 (H.263/AMR GSM 6.10)
  327. >>11 byte 5 \b v5 (H.263/AMR GSM 6.10)
  328. >>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10)
  329. >8 string mmp4 \b, MPEG v4 system, 3GPP Mobile
  330. >8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC
  331. >8 string/B M4A \b, MPEG v4 system, iTunes AAC-LC
  332. >8 string/B M4P \b, MPEG v4 system, iTunes AES encrypted
  333. >8 string/B M4B \b, MPEG v4 system, iTunes bookmarked
  334. >8 string/B qt \b, Apple QuickTime movie
  335.  
  336. # MPEG sequences
  337. # Scans for all common MPEG header start codes
  338. 0 belong 0x00000001 JVT NAL sequence
  339. >4 byte&0x1F 0x07 \b, H.264 video
  340. >>5 byte 66 \b, baseline
  341. >>5 byte 77 \b, main
  342. >>5 byte 88 \b, extended
  343. >>7 byte x \b @ L %u
  344. 0 belong&0xFFFFFF00 0x00000100 MPEG sequence
  345. >3 byte 0xBA
  346. >>4 byte &0x40 \b, v2, program multiplex
  347. >>4 byte ^0x40 \b, v1, system multiplex
  348. >3 byte 0xBB \b, v1/2, multiplex (missing pack header)
  349. >3 byte&0x1F 0x07 \b, H.264 video
  350. >>4 byte 66 \b, baseline
  351. >>4 byte 77 \b, main
  352. >>4 byte 88 \b, extended
  353. >>6 byte x \b @ L %u
  354. >3 byte 0xB0 \b, v4
  355. >>5 belong 0x000001B5
  356. >>>9 byte &0x80
  357. >>>>10 byte&0xF0 16 \b, video
  358. >>>>10 byte&0xF0 32 \b, still texture
  359. >>>>10 byte&0xF0 48 \b, mesh
  360. >>>>10 byte&0xF0 64 \b, face
  361. >>>9 byte&0xF8 8 \b, video
  362. >>>9 byte&0xF8 16 \b, still texture
  363. >>>9 byte&0xF8 24 \b, mesh
  364. >>>9 byte&0xF8 32 \b, face
  365. >>4 byte 1 \b, simple @ L1
  366. >>4 byte 2 \b, simple @ L2
  367. >>4 byte 3 \b, simple @ L3
  368. >>4 byte 4 \b, simple @ L0
  369. >>4 byte 17 \b, simple scalable @ L1
  370. >>4 byte 18 \b, simple scalable @ L2
  371. >>4 byte 33 \b, core @ L1
  372. >>4 byte 34 \b, core @ L2
  373. >>4 byte 50 \b, main @ L2
  374. >>4 byte 51 \b, main @ L3
  375. >>4 byte 53 \b, main @ L4
  376. >>4 byte 66 \b, n-bit @ L2
  377. >>4 byte 81 \b, scalable texture @ L1
  378. >>4 byte 97 \b, simple face animation @ L1
  379. >>4 byte 98 \b, simple face animation @ L2
  380. >>4 byte 99 \b, simple face basic animation @ L1
  381. >>4 byte 100 \b, simple face basic animation @ L2
  382. >>4 byte 113 \b, basic animation text @ L1
  383. >>4 byte 114 \b, basic animation text @ L2
  384. >>4 byte 129 \b, hybrid @ L1
  385. >>4 byte 130 \b, hybrid @ L2
  386. >>4 byte 145 \b, advanced RT simple @ L!
  387. >>4 byte 146 \b, advanced RT simple @ L2
  388. >>4 byte 147 \b, advanced RT simple @ L3
  389. >>4 byte 148 \b, advanced RT simple @ L4
  390. >>4 byte 161 \b, core scalable @ L1
  391. >>4 byte 162 \b, core scalable @ L2
  392. >>4 byte 163 \b, core scalable @ L3
  393. >>4 byte 177 \b, advanced coding efficiency @ L1
  394. >>4 byte 178 \b, advanced coding efficiency @ L2
  395. >>4 byte 179 \b, advanced coding efficiency @ L3
  396. >>4 byte 180 \b, advanced coding efficiency @ L4
  397. >>4 byte 193 \b, advanced core @ L1
  398. >>4 byte 194 \b, advanced core @ L2
  399. >>4 byte 209 \b, advanced scalable texture @ L1
  400. >>4 byte 210 \b, advanced scalable texture @ L2
  401. >>4 byte 211 \b, advanced scalable texture @ L3
  402. >>4 byte 225 \b, simple studio @ L1
  403. >>4 byte 226 \b, simple studio @ L2
  404. >>4 byte 227 \b, simple studio @ L3
  405. >>4 byte 228 \b, simple studio @ L4
  406. >>4 byte 229 \b, core studio @ L1
  407. >>4 byte 230 \b, core studio @ L2
  408. >>4 byte 231 \b, core studio @ L3
  409. >>4 byte 232 \b, core studio @ L4
  410. >>4 byte 240 \b, advanced simple @ L0
  411. >>4 byte 241 \b, advanced simple @ L1
  412. >>4 byte 242 \b, advanced simple @ L2
  413. >>4 byte 243 \b, advanced simple @ L3
  414. >>4 byte 244 \b, advanced simple @ L4
  415. >>4 byte 245 \b, advanced simple @ L5
  416. >>4 byte 247 \b, advanced simple @ L3b
  417. >>4 byte 248 \b, FGS @ L0
  418. >>4 byte 249 \b, FGS @ L1
  419. >>4 byte 250 \b, FGS @ L2
  420. >>4 byte 251 \b, FGS @ L3
  421. >>4 byte 252 \b, FGS @ L4
  422. >>4 byte 253 \b, FGS @ L5
  423. >3 byte 0xB5 \b, v4
  424. >>4 byte &0x80
  425. >>>5 byte&0xF0 16 \b, video (missing profile header)
  426. >>>5 byte&0xF0 32 \b, still texture (missing profile header)
  427. >>>5 byte&0xF0 48 \b, mesh (missing profile header)
  428. >>>5 byte&0xF0 64 \b, face (missing profile header)
  429. >>4 byte&0xF8 8 \b, video (missing profile header)
  430. >>4 byte&0xF8 16 \b, still texture (missing profile header)
  431. >>4 byte&0xF8 24 \b, mesh (missing profile header)
  432. >>4 byte&0xF8 32 \b, face (missing profile header)
  433. >3 byte 0xB3
  434. >>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
  435. >>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
  436. >>12 belong 0x000001B5 \b, v2,
  437. >>>16 byte&0x0F 1 \b HP
  438. >>>16 byte&0x0F 2 \b Spt
  439. >>>16 byte&0x0F 3 \b SNR
  440. >>>16 byte&0x0F 4 \b MP
  441. >>>16 byte&0x0F 5 \b SP
  442. >>>17 byte&0xF0 64 \b@HL
  443. >>>17 byte&0xF0 96 \b@H-14
  444. >>>17 byte&0xF0 128 \b@ML
  445. >>>17 byte&0xF0 160 \b@LL
  446. >>>17 byte &0x08 \b progressive
  447. >>>17 byte ^0x08 \b interlaced
  448. >>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video
  449. >>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video
  450. >>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video
  451. >>11 byte &0x02
  452. >>>75 byte &0x01
  453. >>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
  454. >>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
  455. >>>>140 belong 0x000001B5 \b, v2,
  456. >>>>>144 byte&0x0F 1 \b HP
  457. >>>>>144 byte&0x0F 2 \b Spt
  458. >>>>>144 byte&0x0F 3 \b SNR
  459. >>>>>144 byte&0x0F 4 \b MP
  460. >>>>>144 byte&0x0F 5 \b SP
  461. >>>>>145 byte&0xF0 64 \b@HL
  462. >>>>>145 byte&0xF0 96 \b@H-14
  463. >>>>>145 byte&0xF0 128 \b@ML
  464. >>>>>145 byte&0xF0 160 \b@LL
  465. >>>>>145 byte &0x08 \b progressive
  466. >>>>>145 byte ^0x08 \b interlaced
  467. >>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video
  468. >>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video
  469. >>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video
  470. >>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
  471. >>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
  472. >>76 belong 0x000001B5 \b, v2,
  473. >>>80 byte&0x0F 1 \b HP
  474. >>>80 byte&0x0F 2 \b Spt
  475. >>>80 byte&0x0F 3 \b SNR
  476. >>>80 byte&0x0F 4 \b MP
  477. >>>80 byte&0x0F 5 \b SP
  478. >>>81 byte&0xF0 64 \b@HL
  479. >>>81 byte&0xF0 96 \b@H-14
  480. >>>81 byte&0xF0 128 \b@ML
  481. >>>81 byte&0xF0 160 \b@LL
  482. >>>81 byte &0x08 \b progressive
  483. >>>81 byte ^0x08 \b interlaced
  484. >>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video
  485. >>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video
  486. >>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video
  487. >>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P
  488. >>>7 byte&0xF0 0x10 \b, 16:9
  489. >>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I
  490. >>>7 byte&0xF0 0x10 \b, 16:9
  491. >>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture
  492. >>>7 byte&0xF0 0x10 \b, 4:3
  493. >>4 beshort&0xFFF0 0x2C00 \b, 4CIF
  494. >>>5 beshort&0x0FFF 0x01E0 \b NTSC
  495. >>>5 beshort&0x0FFF 0x0240 \b PAL
  496. >>>7 byte&0xF0 0x20 \b, 4:3
  497. >>>7 byte&0xF0 0x30 \b, 16:9
  498. >>>7 byte&0xF0 0x40 \b, 11:5
  499. >>>7 byte&0xF0 0x80 \b, PAL 4:3
  500. >>>7 byte&0xF0 0xC0 \b, NTSC 4:3
  501. >>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P
  502. >>>7 byte&0xF0 0x10 \b, 4:3
  503. >>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240
  504. >>>7 byte&0xF0 0x10 \b, 4:3
  505. >>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160
  506. >>>7 byte&0xF0 0x10 \b, 4:3
  507. >>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120
  508. >>>7 byte&0xF0 0x10 \b, 4:3
  509. >>4 beshort&0xFFF0 0x1600 \b, CIF
  510. >>>5 beshort&0x0FFF 0x00F0 \b NTSC
  511. >>>5 beshort&0x0FFF 0x0120 \b PAL
  512. >>>7 byte&0xF0 0x20 \b, 4:3
  513. >>>7 byte&0xF0 0x30 \b, 16:9
  514. >>>7 byte&0xF0 0x40 \b, 11:5
  515. >>>7 byte&0xF0 0x80 \b, PAL 4:3
  516. >>>7 byte&0xF0 0xC0 \b, NTSC 4:3
  517. >>>5 beshort&0x0FFF 0x0240 \b PAL 625
  518. >>>>7 byte&0xF0 0x20 \b, 4:3
  519. >>>>7 byte&0xF0 0x30 \b, 16:9
  520. >>>>7 byte&0xF0 0x40 \b, 11:5
  521. >>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU
  522. >>>5 beshort&0x0FFF 0x01E0 \b NTSC 525
  523. >>>5 beshort&0x0FFF 0x0240 \b PAL 625
  524. >>>7 byte&0xF0 0x20 \b, 4:3
  525. >>>7 byte&0xF0 0x30 \b, 16:9
  526. >>>7 byte&0xF0 0x40 \b, 11:5
  527. >>4 beshort&0xFFF0 0x1E00 \b, SVCD
  528. >>>5 beshort&0x0FFF 0x01E0 \b NTSC 525
  529. >>>5 beshort&0x0FFF 0x0240 \b PAL 625
  530. >>>7 byte&0xF0 0x20 \b, 4:3
  531. >>>7 byte&0xF0 0x30 \b, 16:9
  532. >>>7 byte&0xF0 0x40 \b, 11:5
  533. >>7 byte&0x0F 1 \b, 23.976 fps
  534. >>7 byte&0x0F 2 \b, 24 fps
  535. >>7 byte&0x0F 3 \b, 25 fps
  536. >>7 byte&0x0F 4 \b, 29.97 fps
  537. >>7 byte&0x0F 5 \b, 30 fps
  538. >>7 byte&0x0F 6 \b, 50 fps
  539. >>7 byte&0x0F 7 \b, 59.94 fps
  540. >>7 byte&0x0F 8 \b, 60 fps
  541. >>11 byte &0x04 \b, Constrained
  542.  
  543. # MPEG ADTS Audio (*.mpx/mxa/aac)
  544. # from dreesen@math.fu-berlin.de
  545. # modified to fully support MPEG ADTS
  546.  
  547. # MP3, M1A
  548. 0 beshort&0xFFFE 0xFFFA MPEG ADTS, layer III, v1
  549. # rates
  550. >2 byte&0xF0 0x10 \b, 32 kBits
  551. >2 byte&0xF0 0x20 \b, 40 kBits
  552. >2 byte&0xF0 0x30 \b, 48 kBits
  553. >2 byte&0xF0 0x40 \b, 56 kBits
  554. >2 byte&0xF0 0x50 \b, 64 kBits
  555. >2 byte&0xF0 0x60 \b, 80 kBits
  556. >2 byte&0xF0 0x70 \b, 96 kBits
  557. >2 byte&0xF0 0x80 \b, 112 kBits
  558. >2 byte&0xF0 0x90 \b, 128 kBits
  559. >2 byte&0xF0 0xA0 \b, 160 kBits
  560. >2 byte&0xF0 0xB0 \b, 192 kBits
  561. >2 byte&0xF0 0xC0 \b, 224 kBits
  562. >2 byte&0xF0 0xD0 \b, 256 kBits
  563. >2 byte&0xF0 0xE0 \b, 320 kBits
  564. # timing
  565. >2 byte&0x0C 0x00 \b, 44.1 kHz
  566. >2 byte&0x0C 0x04 \b, 48 kHz
  567. >2 byte&0x0C 0x08 \b, 32 kHz
  568. # channels/options
  569. >3 byte&0xC0 0x00 \b, Stereo
  570. >3 byte&0xC0 0x40 \b, JntStereo
  571. >3 byte&0xC0 0x80 \b, 2x Monaural
  572. >3 byte&0xC0 0xC0 \b, Monaural
  573. #>1 byte ^0x01 \b, Data Verify
  574. #>2 byte &0x02 \b, Packet Pad
  575. #>2 byte &0x01 \b, Custom Flag
  576. #>3 byte &0x08 \b, Copyrighted
  577. #>3 byte &0x04 \b, Original Source
  578. #>3 byte&0x03 1 \b, NR: 50/15 ms
  579. #>3 byte&0x03 3 \b, NR: CCIT J.17
  580.  
  581. # MP2, M1A
  582. 0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1
  583. # rates
  584. >2 byte&0xF0 0x10 \b, 32 kBits
  585. >2 byte&0xF0 0x20 \b, 48 kBits
  586. >2 byte&0xF0 0x30 \b, 56 kBits
  587. >2 byte&0xF0 0x40 \b, 64 kBits
  588. >2 byte&0xF0 0x50 \b, 80 kBits
  589. >2 byte&0xF0 0x60 \b, 96 kBits
  590. >2 byte&0xF0 0x70 \b, 112 kBits
  591. >2 byte&0xF0 0x80 \b, 128 kBits
  592. >2 byte&0xF0 0x90 \b, 160 kBits
  593. >2 byte&0xF0 0xA0 \b, 192 kBits
  594. >2 byte&0xF0 0xB0 \b, 224 kBits
  595. >2 byte&0xF0 0xC0 \b, 256 kBits
  596. >2 byte&0xF0 0xD0 \b, 320 kBits
  597. >2 byte&0xF0 0xE0 \b, 384 kBits
  598. # timing
  599. >2 byte&0x0C 0x00 \b, 44.1 kHz
  600. >2 byte&0x0C 0x04 \b, 48 kHz
  601. >2 byte&0x0C 0x08 \b, 32 kHz
  602. # channels/options
  603. >3 byte&0xC0 0x00 \b, Stereo
  604. >3 byte&0xC0 0x40 \b, JntStereo
  605. >3 byte&0xC0 0x80 \b, 2x Monaural
  606. >3 byte&0xC0 0xC0 \b, Monaural
  607. #>1 byte ^0x01 \b, Data Verify
  608. #>2 byte &0x02 \b, Packet Pad
  609. #>2 byte &0x01 \b, Custom Flag
  610. #>3 byte &0x08 \b, Copyrighted
  611. #>3 byte &0x04 \b, Original Source
  612. #>3 byte&0x03 1 \b, NR: 50/15 ms
  613. #>3 byte&0x03 3 \b, NR: CCIT J.17
  614.  
  615. # MPA, M1A
  616. # updated by Joerg Jenderek
  617. # GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448
  618. 0 beshort&0xFFFE 0xFFFE
  619. >2 ubyte&0xF0 >0x0F
  620. >>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1
  621. # rate
  622. >>>2 byte&0xF0 0x10 \b, 32 kBits
  623. >>>2 byte&0xF0 0x20 \b, 64 kBits
  624. >>>2 byte&0xF0 0x30 \b, 96 kBits
  625. >>>2 byte&0xF0 0x40 \b, 128 kBits
  626. >>>2 byte&0xF0 0x50 \b, 160 kBits
  627. >>>2 byte&0xF0 0x60 \b, 192 kBits
  628. >>>2 byte&0xF0 0x70 \b, 224 kBits
  629. >>>2 byte&0xF0 0x80 \b, 256 kBits
  630. >>>2 byte&0xF0 0x90 \b, 288 kBits
  631. >>>2 byte&0xF0 0xA0 \b, 320 kBits
  632. >>>2 byte&0xF0 0xB0 \b, 352 kBits
  633. >>>2 byte&0xF0 0xC0 \b, 384 kBits
  634. >>>2 byte&0xF0 0xD0 \b, 416 kBits
  635. >>>2 byte&0xF0 0xE0 \b, 448 kBits
  636. # timing
  637. >>>2 byte&0x0C 0x00 \b, 44.1 kHz
  638. >>>2 byte&0x0C 0x04 \b, 48 kHz
  639. >>>2 byte&0x0C 0x08 \b, 32 kHz
  640. # channels/options
  641. >>>3 byte&0xC0 0x00 \b, Stereo
  642. >>>3 byte&0xC0 0x40 \b, JntStereo
  643. >>>3 byte&0xC0 0x80 \b, 2x Monaural
  644. >>>3 byte&0xC0 0xC0 \b, Monaural
  645. #>1 byte ^0x01 \b, Data Verify
  646. #>2 byte &0x02 \b, Packet Pad
  647. #>2 byte &0x01 \b, Custom Flag
  648. #>3 byte &0x08 \b, Copyrighted
  649. #>3 byte &0x04 \b, Original Source
  650. #>3 byte&0x03 1 \b, NR: 50/15 ms
  651. #>3 byte&0x03 3 \b, NR: CCIT J.17
  652.  
  653. # MP3, M2A
  654. 0 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2
  655. # rate
  656. >2 byte&0xF0 0x10 \b, 8 kBits
  657. >2 byte&0xF0 0x20 \b, 16 kBits
  658. >2 byte&0xF0 0x30 \b, 24 kBits
  659. >2 byte&0xF0 0x40 \b, 32 kBits
  660. >2 byte&0xF0 0x50 \b, 40 kBits
  661. >2 byte&0xF0 0x60 \b, 48 kBits
  662. >2 byte&0xF0 0x70 \b, 56 kBits
  663. >2 byte&0xF0 0x80 \b, 64 kBits
  664. >2 byte&0xF0 0x90 \b, 80 kBits
  665. >2 byte&0xF0 0xA0 \b, 96 kBits
  666. >2 byte&0xF0 0xB0 \b, 112 kBits
  667. >2 byte&0xF0 0xC0 \b, 128 kBits
  668. >2 byte&0xF0 0xD0 \b, 144 kBits
  669. >2 byte&0xF0 0xE0 \b, 160 kBits
  670. # timing
  671. >2 byte&0x0C 0x00 \b, 22.05 kHz
  672. >2 byte&0x0C 0x04 \b, 24 kHz
  673. >2 byte&0x0C 0x08 \b, 16 kHz
  674. # channels/options
  675. >3 byte&0xC0 0x00 \b, Stereo
  676. >3 byte&0xC0 0x40 \b, JntStereo
  677. >3 byte&0xC0 0x80 \b, 2x Monaural
  678. >3 byte&0xC0 0xC0 \b, Monaural
  679. #>1 byte ^0x01 \b, Data Verify
  680. #>2 byte &0x02 \b, Packet Pad
  681. #>2 byte &0x01 \b, Custom Flag
  682. #>3 byte &0x08 \b, Copyrighted
  683. #>3 byte &0x04 \b, Original Source
  684. #>3 byte&0x03 1 \b, NR: 50/15 ms
  685. #>3 byte&0x03 3 \b, NR: CCIT J.17
  686.  
  687. # MP2, M2A
  688. 0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2
  689. # rate
  690. >2 byte&0xF0 0x10 \b, 8 kBits
  691. >2 byte&0xF0 0x20 \b, 16 kBits
  692. >2 byte&0xF0 0x30 \b, 24 kBits
  693. >2 byte&0xF0 0x40 \b, 32 kBits
  694. >2 byte&0xF0 0x50 \b, 40 kBits
  695. >2 byte&0xF0 0x60 \b, 48 kBits
  696. >2 byte&0xF0 0x70 \b, 56 kBits
  697. >2 byte&0xF0 0x80 \b, 64 kBits
  698. >2 byte&0xF0 0x90 \b, 80 kBits
  699. >2 byte&0xF0 0xA0 \b, 96 kBits
  700. >2 byte&0xF0 0xB0 \b, 112 kBits
  701. >2 byte&0xF0 0xC0 \b, 128 kBits
  702. >2 byte&0xF0 0xD0 \b, 144 kBits
  703. >2 byte&0xF0 0xE0 \b, 160 kBits
  704. # timing
  705. >2 byte&0x0C 0x00 \b, 22.05 kHz
  706. >2 byte&0x0C 0x04 \b, 24 kHz
  707. >2 byte&0x0C 0x08 \b, 16 kHz
  708. # channels/options
  709. >3 byte&0xC0 0x00 \b, Stereo
  710. >3 byte&0xC0 0x40 \b, JntStereo
  711. >3 byte&0xC0 0x80 \b, 2x Monaural
  712. >3 byte&0xC0 0xC0 \b, Monaural
  713. #>1 byte ^0x01 \b, Data Verify
  714. #>2 byte &0x02 \b, Packet Pad
  715. #>2 byte &0x01 \b, Custom Flag
  716. #>3 byte &0x08 \b, Copyrighted
  717. #>3 byte &0x04 \b, Original Source
  718. #>3 byte&0x03 1 \b, NR: 50/15 ms
  719. #>3 byte&0x03 3 \b, NR: CCIT J.17
  720.  
  721. # MPA, M2A
  722. 0 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2
  723. # rate
  724. >2 byte&0xF0 0x10 \b, 32 kBits
  725. >2 byte&0xF0 0x20 \b, 48 kBits
  726. >2 byte&0xF0 0x30 \b, 56 kBits
  727. >2 byte&0xF0 0x40 \b, 64 kBits
  728. >2 byte&0xF0 0x50 \b, 80 kBits
  729. >2 byte&0xF0 0x60 \b, 96 kBits
  730. >2 byte&0xF0 0x70 \b, 112 kBits
  731. >2 byte&0xF0 0x80 \b, 128 kBits
  732. >2 byte&0xF0 0x90 \b, 144 kBits
  733. >2 byte&0xF0 0xA0 \b, 160 kBits
  734. >2 byte&0xF0 0xB0 \b, 176 kBits
  735. >2 byte&0xF0 0xC0 \b, 192 kBits
  736. >2 byte&0xF0 0xD0 \b, 224 kBits
  737. >2 byte&0xF0 0xE0 \b, 256 kBits
  738. # timing
  739. >2 byte&0x0C 0x00 \b, 22.05 kHz
  740. >2 byte&0x0C 0x04 \b, 24 kHz
  741. >2 byte&0x0C 0x08 \b, 16 kHz
  742. # channels/options
  743. >3 byte&0xC0 0x00 \b, Stereo
  744. >3 byte&0xC0 0x40 \b, JntStereo
  745. >3 byte&0xC0 0x80 \b, 2x Monaural
  746. >3 byte&0xC0 0xC0 \b, Monaural
  747. #>1 byte ^0x01 \b, Data Verify
  748. #>2 byte &0x02 \b, Packet Pad
  749. #>2 byte &0x01 \b, Custom Flag
  750. #>3 byte &0x08 \b, Copyrighted
  751. #>3 byte &0x04 \b, Original Source
  752. #>3 byte&0x03 1 \b, NR: 50/15 ms
  753. #>3 byte&0x03 3 \b, NR: CCIT J.17
  754.  
  755. # MP3, M25A
  756. 0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5
  757. # rate
  758. >2 byte&0xF0 0x10 \b, 8 kBits
  759. >2 byte&0xF0 0x20 \b, 16 kBits
  760. >2 byte&0xF0 0x30 \b, 24 kBits
  761. >2 byte&0xF0 0x40 \b, 32 kBits
  762. >2 byte&0xF0 0x50 \b, 40 kBits
  763. >2 byte&0xF0 0x60 \b, 48 kBits
  764. >2 byte&0xF0 0x70 \b, 56 kBits
  765. >2 byte&0xF0 0x80 \b, 64 kBits
  766. >2 byte&0xF0 0x90 \b, 80 kBits
  767. >2 byte&0xF0 0xA0 \b, 96 kBits
  768. >2 byte&0xF0 0xB0 \b, 112 kBits
  769. >2 byte&0xF0 0xC0 \b, 128 kBits
  770. >2 byte&0xF0 0xD0 \b, 144 kBits
  771. >2 byte&0xF0 0xE0 \b, 160 kBits
  772. # timing
  773. >2 byte&0x0C 0x00 \b, 11.025 kHz
  774. >2 byte&0x0C 0x04 \b, 12 kHz
  775. >2 byte&0x0C 0x08 \b, 8 kHz
  776. # channels/options
  777. >3 byte&0xC0 0x00 \b, Stereo
  778. >3 byte&0xC0 0x40 \b, JntStereo
  779. >3 byte&0xC0 0x80 \b, 2x Monaural
  780. >3 byte&0xC0 0xC0 \b, Monaural
  781. #>1 byte ^0x01 \b, Data Verify
  782. #>2 byte &0x02 \b, Packet Pad
  783. #>2 byte &0x01 \b, Custom Flag
  784. #>3 byte &0x08 \b, Copyrighted
  785. #>3 byte &0x04 \b, Original Source
  786. #>3 byte&0x03 1 \b, NR: 50/15 ms
  787. #>3 byte&0x03 3 \b, NR: CCIT J.17
  788.  
  789. # AAC (aka MPEG-2 NBC audio) and MPEG-4 audio
  790.  
  791. # Stored AAC streams (instead of the MP4 format)
  792. 0 string ADIF MPEG ADIF, AAC
  793. >4 byte &0x80
  794. >>13 byte &0x10 \b, VBR
  795. >>13 byte ^0x10 \b, CBR
  796. >>16 byte&0x1E 0x02 \b, single stream
  797. >>16 byte&0x1E 0x04 \b, 2 streams
  798. >>16 byte&0x1E 0x06 \b, 3 streams
  799. >>16 byte &0x08 \b, 4 or more streams
  800. >>16 byte &0x10 \b, 8 or more streams
  801. >>4 byte &0x80 \b, Copyrighted
  802. >>13 byte &0x40 \b, Original Source
  803. >>13 byte &0x20 \b, Home Flag
  804. >4 byte ^0x80
  805. >>4 byte &0x10 \b, VBR
  806. >>4 byte ^0x10 \b, CBR
  807. >>7 byte&0x1E 0x02 \b, single stream
  808. >>7 byte&0x1E 0x04 \b, 2 streams
  809. >>7 byte&0x1E 0x06 \b, 3 streams
  810. >>7 byte &0x08 \b, 4 or more streams
  811. >>7 byte &0x10 \b, 8 or more streams
  812. >>4 byte &0x40 \b, Original Stream(s)
  813. >>4 byte &0x20 \b, Home Source
  814.  
  815. # Live or stored single AAC stream (used with MPEG-2 systems)
  816. 0 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC
  817. >1 byte &0x08 \b, v2
  818. >1 byte ^0x08 \b, v4
  819. # profile
  820. >>2 byte &0xC0 \b LTP
  821. >2 byte&0xc0 0x00 \b Main
  822. >2 byte&0xc0 0x40 \b LC
  823. >2 byte&0xc0 0x80 \b SSR
  824. # timing
  825. >2 byte&0x3c 0x00 \b, 96 kHz
  826. >2 byte&0x3c 0x04 \b, 88.2 kHz
  827. >2 byte&0x3c 0x08 \b, 64 kHz
  828. >2 byte&0x3c 0x0c \b, 48 kHz
  829. >2 byte&0x3c 0x10 \b, 44.1 kHz
  830. >2 byte&0x3c 0x14 \b, 32 kHz
  831. >2 byte&0x3c 0x18 \b, 24 kHz
  832. >2 byte&0x3c 0x1c \b, 22.05 kHz
  833. >2 byte&0x3c 0x20 \b, 16 kHz
  834. >2 byte&0x3c 0x24 \b, 12 kHz
  835. >2 byte&0x3c 0x28 \b, 11.025 kHz
  836. >2 byte&0x3c 0x2c \b, 8 kHz
  837. # channels
  838. >2 beshort&0x01c0 0x0040 \b, monaural
  839. >2 beshort&0x01c0 0x0080 \b, stereo
  840. >2 beshort&0x01c0 0x00c0 \b, stereo + center
  841. >2 beshort&0x01c0 0x0100 \b, stereo+center+LFE
  842. >2 beshort&0x01c0 0x0140 \b, surround
  843. >2 beshort&0x01c0 0x0180 \b, surround + LFE
  844. >2 beshort &0x01C0 \b, surround + side
  845. #>1 byte ^0x01 \b, Data Verify
  846. #>2 byte &0x02 \b, Custom Flag
  847. #>3 byte &0x20 \b, Original Stream
  848. #>3 byte &0x10 \b, Home Source
  849. #>3 byte &0x08 \b, Copyrighted
  850.  
  851. # Live MPEG-4 audio streams (instead of RTP FlexMux)
  852. 0 beshort&0xFFE0 0x56E0 MPEG-4 LOAS
  853. #>1 beshort&0x1FFF x \b, %u byte packet
  854. >3 byte&0xE0 0x40
  855. >>4 byte&0x3C 0x04 \b, single stream
  856. >>4 byte&0x3C 0x08 \b, 2 streams
  857. >>4 byte&0x3C 0x0C \b, 3 streams
  858. >>4 byte &0x08 \b, 4 or more streams
  859. >>4 byte &0x20 \b, 8 or more streams
  860. >3 byte&0xC0 0
  861. >>4 byte&0x78 0x08 \b, single stream
  862. >>4 byte&0x78 0x10 \b, 2 streams
  863. >>4 byte&0x78 0x18 \b, 3 streams
  864. >>4 byte &0x20 \b, 4 or more streams
  865. >>4 byte &0x40 \b, 8 or more streams
  866. 0 beshort 0x4DE1 MPEG-4 LO-EP audio stream
  867.  
  868. # FLI animation format
  869. 4 leshort 0xAF11 FLI file
  870. >6 leshort x - %d frames,
  871. >8 leshort x width=%d pixels,
  872. >10 leshort x height=%d pixels,
  873. >12 leshort x depth=%d,
  874. >16 leshort x ticks/frame=%d
  875. # FLC animation format
  876. 4 leshort 0xAF12 FLC file
  877. >6 leshort x - %d frames
  878. >8 leshort x width=%d pixels,
  879. >10 leshort x height=%d pixels,
  880. >12 leshort x depth=%d,
  881. >16 leshort x ticks/frame=%d
  882.  
  883. # DL animation format
  884. # XXX - collision with most `mips' magic
  885. #
  886. # I couldn't find a real magic number for these, however, this
  887. # -appears- to work. Note that it might catch other files, too, so be
  888. # careful!
  889. #
  890. # Note that title and author appear in the two 20-byte chunks
  891. # at decimal offsets 2 and 22, respectively, but they are XOR'ed with
  892. # 255 (hex FF)! The DL format is really bad.
  893. #
  894. #0 byte 1 DL version 1, medium format (160x100, 4 images/screen)
  895. #>42 byte x - %d screens,
  896. #>43 byte x %d commands
  897. #0 byte 2 DL version 2
  898. #>1 byte 1 - large format (320x200,1 image/screen),
  899. #>1 byte 2 - medium format (160x100,4 images/screen),
  900. #>1 byte >2 - unknown format,
  901. #>42 byte x %d screens,
  902. #>43 byte x %d commands
  903. # Based on empirical evidence, DL version 3 have several nulls following the
  904. # \003. Most of them start with non-null values at hex offset 0x34 or so.
  905. #0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3
  906.  
  907. # iso 13818 transport stream
  908. #
  909. # from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
  910. # (the following is a little bit restrictive and works fine for a stream
  911. # that starts with PAT properly. it won't work for stream data, that is
  912. # cut from an input device data right in the middle, but this shouldn't
  913. # disturb)
  914. # syncbyte 8 bit 0x47
  915. # error_ind 1 bit -
  916. # payload_start 1 bit 1
  917. # priority 1 bit -
  918. # PID 13 bit 0x0000
  919. # scrambling 2 bit -
  920. # adaptfld_ctrl 2 bit 1 or 3
  921. # conti_count 4 bit 0
  922. 0 belong&0xFF5FFF1F 0x47400010 MPEG transport stream data
  923. >188 byte !0x47 CORRUPTED
  924.  
  925. # DIF digital video file format <mpruett@sgi.com>
  926. 0 belong&0xffffff00 0x1f070000 DIF
  927. >4 byte &0x01 (DVCPRO) movie file
  928. >4 byte ^0x01 (DV) movie file
  929. >3 byte &0x80 (PAL)
  930. >3 byte ^0x80 (NTSC)
  931.  
  932. # Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com>
  933. 0 belong 0x3026b275 Microsoft ASF
  934.  
  935. # MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
  936. 0 string \x8aMNG MNG video data,
  937. >4 belong !0x0d0a1a0a CORRUPTED,
  938. >4 belong 0x0d0a1a0a
  939. >>16 belong x %ld x
  940. >>20 belong x %ld
  941.  
  942. # JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
  943. 0 string \x8bJNG JNG video data,
  944. >4 belong !0x0d0a1a0a CORRUPTED,
  945. >4 belong 0x0d0a1a0a
  946. >>16 belong x %ld x
  947. >>20 belong x %ld
  948.  
  949. # Vivo video (Wolfram Kleff)
  950. 3 string \x0D\x0AVersion:Vivo Vivo video data
  951.  
  952. # VRML (Virtual Reality Modelling Language)
  953. 0 string/b #VRML\ V1.0\ ascii VRML 1 file
  954. 0 string/b #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file
  955.  
  956. #---------------------------------------------------------------------------
  957. # HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
  958. # From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03
  959. #
  960. 0 string HVQM4 %s
  961. >6 string >\0 v%s
  962. >0 byte x GameCube movie,
  963. >0x34 ubeshort x %d x
  964. >0x36 ubeshort x %d,
  965. >0x26 ubeshort x %dµs,
  966. >0x42 ubeshort 0 no audio
  967. >0x42 ubeshort >0 %dHz audio
  968.  
  969. # From: "Stefan A. Haubenthal" <polluks@web.de>
  970. 0 string DVDVIDEO-VTS Video title set,
  971. >0x21 byte x v%x
  972. 0 string DVDVIDEO-VMG Video manager,
  973. >0x21 byte x v%x
  974.  
  975. # From: Behan Webster <behanw@websterwood.com>
  976. # NuppelVideo used by Mythtv (*.nuv)
  977. 0 regex NuppelVideo|MythTVVideo MythTV NuppelVideo
  978. >12 string x v%s
  979. >20 lelong x (%d
  980. >24 lelong x \bx%d),
  981. >36 string P \bprogressive,
  982. >36 string I \binterlaced,
  983. >40 ledouble x \baspect:%.2f,
  984. >48 ledouble x \bfps:%.2f
  985.  
  986. #------------------------------------------------------------------------------
  987. # apl: file(1) magic for APL (see also "pdp" and "vax" for other APL
  988. # workspaces)
  989. #
  990. 0 long 0100554 APL workspace (Ken's original?)
  991.  
  992. #------------------------------------------------------------------------------
  993. # apple: file(1) magic for Apple file formats
  994. #
  995. 0 string FiLeStArTfIlEsTaRt binscii (apple ][) text
  996. 0 string \x0aGL Binary II (apple ][) data
  997. 0 string \x76\xff Squeezed (apple ][) data
  998. 0 string NuFile NuFile archive (apple ][) data
  999. 0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data
  1000. 0 belong 0x00051600 AppleSingle encoded Macintosh file
  1001. 0 belong 0x00051607 AppleDouble encoded Macintosh file
  1002.  
  1003. # magic for Newton PDA package formats
  1004. # from Ruda Moura <ruda@helllabs.org>
  1005. 0 string package0 Newton package, NOS 1.x,
  1006. >12 belong &0x80000000 AutoRemove,
  1007. >12 belong &0x40000000 CopyProtect,
  1008. >12 belong &0x10000000 NoCompression,
  1009. >12 belong &0x04000000 Relocation,
  1010. >12 belong &0x02000000 UseFasterCompression,
  1011. >16 belong x version %d
  1012.  
  1013. 0 string package1 Newton package, NOS 2.x,
  1014. >12 belong &0x80000000 AutoRemove,
  1015. >12 belong &0x40000000 CopyProtect,
  1016. >12 belong &0x10000000 NoCompression,
  1017. >12 belong &0x04000000 Relocation,
  1018. >12 belong &0x02000000 UseFasterCompression,
  1019. >16 belong x version %d
  1020.  
  1021. 0 string package4 Newton package,
  1022. >8 byte 8 NOS 1.x,
  1023. >8 byte 9 NOS 2.x,
  1024. >12 belong &0x80000000 AutoRemove,
  1025. >12 belong &0x40000000 CopyProtect,
  1026. >12 belong &0x10000000 NoCompression,
  1027.  
  1028. # The following entries for the Apple II are for files that have
  1029. # been transferred as raw binary data from an Apple, without having
  1030. # been encapsulated by any of the above archivers.
  1031. #
  1032. # In general, Apple II formats are hard to identify because Apple DOS
  1033. # and especially Apple ProDOS have strong typing in the file system and
  1034. # therefore programmers never felt much need to include type information
  1035. # in the files themselves.
  1036. #
  1037. # Eric Fischer <enf@pobox.com>
  1038.  
  1039. # AppleWorks word processor:
  1040. #
  1041. # This matches the standard tab stops for an AppleWorks file, but if
  1042. # a file has a tab stop set in the first four columns this will fail.
  1043. #
  1044. # The "O" is really the magic number, but that's so common that it's
  1045. # necessary to check the tab stops that follow it to avoid false positives.
  1046.  
  1047. 4 string O==== AppleWorks word processor data
  1048. >85 byte&0x01 >0 \b, zoomed
  1049. >90 byte&0x01 >0 \b, paginated
  1050. >92 byte&0x01 >0 \b, with mail merge
  1051. #>91 byte x \b, left margin %d
  1052.  
  1053. # AppleWorks database:
  1054. #
  1055. # This isn't really a magic number, but it's the closest thing to one
  1056. # that I could find. The 1 and 2 really mean "order in which you defined
  1057. # categories" and "left to right, top to bottom," respectively; the D and R
  1058. # mean that the cursor should move either down or right when you press Return.
  1059.  
  1060. #30 string \x01D AppleWorks database data
  1061. #30 string \x02D AppleWorks database data
  1062. #30 string \x01R AppleWorks database data
  1063. #30 string \x02R AppleWorks database data
  1064.  
  1065. # AppleWorks spreadsheet:
  1066. #
  1067. # Likewise, this isn't really meant as a magic number. The R or C means
  1068. # row- or column-order recalculation; the A or M means automatic or manual
  1069. # recalculation.
  1070.  
  1071. #131 string RA AppleWorks spreadsheet data
  1072. #131 string RM AppleWorks spreadsheet data
  1073. #131 string CA AppleWorks spreadsheet data
  1074. #131 string CM AppleWorks spreadsheet data
  1075.  
  1076. # Applesoft BASIC:
  1077. #
  1078. # This is incredibly sloppy, but will be true if the program was
  1079. # written at its usual memory location of 2048 and its first line
  1080. # number is less than 256. Yuck.
  1081.  
  1082. 0 belong&0xff00ff 0x80000 Applesoft BASIC program data
  1083. #>2 leshort x \b, first line number %d
  1084.  
  1085. # ORCA/EZ assembler:
  1086. #
  1087. # This will not identify ORCA/M source files, since those have
  1088. # some sort of date code instead of the two zero bytes at 6 and 7
  1089. # XXX Conflicts with ELF
  1090. #4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data
  1091. #>5 byte x \b, build number %d
  1092.  
  1093. # Broderbund Fantavision
  1094. #
  1095. # I don't know what these values really mean, but they seem to recur.
  1096. # Will they cause too many conflicts?
  1097.  
  1098. # Probably :-)
  1099. #2 belong&0xFF00FF 0x040008 Fantavision movie data
  1100.  
  1101. # Some attempts at images.
  1102. #
  1103. # These are actually just bit-for-bit dumps of the frame buffer, so
  1104. # there's really no reasonably way to distinguish them except for their
  1105. # address (if preserved) -- 8192 or 16384 -- and their length -- 8192
  1106. # or, occasionally, 8184.
  1107. #
  1108. # Nevertheless this will manage to catch a lot of images that happen
  1109. # to have a solid-colored line at the bottom of the screen.
  1110.  
  1111. 8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background
  1112. 8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background
  1113. 8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background
  1114. 8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background
  1115. 8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background
  1116.  
  1117. # Beagle Bros. Apple Mechanic fonts
  1118.  
  1119. 0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font
  1120.  
  1121. # Apple Universal Disk Image Format (UDIF) - dmg files.
  1122. # From Johan Gade.
  1123. # These entries are disabled for now until we fix the following issues.
  1124. #
  1125. # Note there might be some problems with the "VAX COFF executable"
  1126. # entry. Note this entry should be placed before the mac filesystem section,
  1127. # particularly the "Apple Partition data" entry.
  1128. #
  1129. # The intended meaning of these tests is, that the file is only of the
  1130. # specified type if both of the lines are correct - i.e. if the first
  1131. # line matches and the second doesn't then it is not of that type.
  1132. #
  1133. #0 long 0x7801730d
  1134. #>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO)
  1135. #
  1136. # Note that this entry is recognized correctly by the "Apple Partition
  1137. # data" entry - however since this entry is more specific - this
  1138. # information seems to be more useful.
  1139. #0 long 0x45520200
  1140. #>0x410 string disk\ image UDIF read/write image (UDRW)
  1141.  
  1142. # From: Toby Peterson <toby@apple.com>
  1143. 0 string bplist00 Apple binary property list
  1144.  
  1145. # Apple binary property list (bplist)
  1146. # Assumes version bytes are hex.
  1147. # Provides content hints for version 0 files. Assumes that the root
  1148. # object is the first object (true for CoreFoundation implementation).
  1149. # From: David Remahl <dremahl@apple.com>
  1150. 0 string bplist
  1151. >6 byte x \bCoreFoundation binary property list data, version 0x%c
  1152. >>7 byte x \b%c
  1153. >6 string 00 \b
  1154. >>8 byte&0xF0 0x00 \b
  1155. >>>8 byte&0x0F 0x00 \b, root type: null
  1156. >>>8 byte&0x0F 0x08 \b, root type: false boolean
  1157. >>>8 byte&0x0F 0x09 \b, root type: true boolean
  1158. >>8 byte&0xF0 0x10 \b, root type: integer
  1159. >>8 byte&0xF0 0x20 \b, root type: real
  1160. >>8 byte&0xF0 0x30 \b, root type: date
  1161. >>8 byte&0xF0 0x40 \b, root type: data
  1162. >>8 byte&0xF0 0x50 \b, root type: ascii string
  1163. >>8 byte&0xF0 0x60 \b, root type: unicode string
  1164. >>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT)
  1165. >>8 byte&0xF0 0xa0 \b, root type: array
  1166. >>8 byte&0xF0 0xd0 \b, root type: dictionary
  1167.  
  1168. # Apple/NeXT typedstream data
  1169. # Serialization format used by NeXT and Apple for various
  1170. # purposes in YellowStep/Cocoa, including some nib files.
  1171. # From: David Remahl <dremahl@apple.com>
  1172. 2 string typedstream NeXT/Apple typedstream data, big endian
  1173. >0 byte x \b, version %hhd
  1174. >0 byte <5 \b
  1175. >>13 byte 0x81 \b
  1176. >>>14 ubeshort x \b, system %hd
  1177. 2 string streamtyped NeXT/Apple typedstream data, little endian
  1178. >0 byte x \b, version %hhd
  1179. >0 byte <5 \b
  1180. >>13 byte 0x81 \b
  1181. >>>14 uleshort x \b, system %hd
  1182.  
  1183. #------------------------------------------------------------------------------
  1184. # CAF: Apple CoreAudio File Format
  1185. #
  1186. # Container format for high-end audio purposes.
  1187. # From: David Remahl <dremahl@apple.com>
  1188. #
  1189. 0 string caff CoreAudio Format audio file
  1190. >4 beshort <10 version %d
  1191. >6 beshort x
  1192.  
  1193.  
  1194. #------------------------------------------------------------------------------
  1195. # Keychain database files
  1196. 0 string kych Mac OS X Keychain File
  1197.  
  1198. #------------------------------------------------------------------------------
  1199. # Code Signing related file types
  1200. 0 belong 0xfade0c00 Mac OS X Code Requirement
  1201. >8 belong 1 (opExpr)
  1202. >4 belong x - %d bytes
  1203.  
  1204. 0 belong 0xfade0c01 Mac OS X Code Requirement Set
  1205. >8 belong >1 containing %d items
  1206. >4 belong x - %d bytes
  1207.  
  1208. 0 belong 0xfade0c02 Mac OS X Code Directory
  1209. >8 belong x version %x
  1210. >12 belong >0 flags 0x%x
  1211. >4 belong x - %d bytes
  1212.  
  1213. 0 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable)
  1214. >4 belong x - %d bytes
  1215.  
  1216. 0 belong 0xfade0cc1 Mac OS X Detached Code Signature
  1217. >8 belong >1 (%d elements)
  1218. >4 belong x - %d bytes
  1219.  
  1220. # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
  1221. # .vdi
  1222. 4 string innotek\ VirtualBox\ Disk\ Image %s
  1223.  
  1224. #------------------------------------------------------------------------------
  1225. # applix: file(1) magic for Applixware
  1226. # From: Peter Soos <sp@osb.hu>
  1227. #
  1228. 0 string *BEGIN Applixware
  1229. >7 string WORDS Words Document
  1230. >7 string GRAPHICS Graphic
  1231. >7 string RASTER Bitmap
  1232. >7 string SPREADSHEETS Spreadsheet
  1233. >7 string MACRO Macro
  1234. >7 string BUILDER Builder Object
  1235.  
  1236. #------------------------------------------------------------------------------
  1237. # archive: file(1) magic for archive formats (see also "msdos" for self-
  1238. # extracting compressed archives)
  1239. #
  1240. # cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
  1241. # pre-POSIX "tar" archives are handled in the C code.
  1242.  
  1243. # POSIX tar archives
  1244. 257 string ustar\0 POSIX tar archive
  1245. 257 string ustar\040\040\0 GNU tar archive
  1246.  
  1247. # cpio archives
  1248. #
  1249. # Yes, the top two "cpio archive" formats *are* supposed to just be "short".
  1250. # The idea is to indicate archives produced on machines with the same
  1251. # byte order as the machine running "file" with "cpio archive", and
  1252. # to indicate archives produced on machines with the opposite byte order
  1253. # from the machine running "file" with "byte-swapped cpio archive".
  1254. #
  1255. # The SVR4 "cpio(4)" hints that there are additional formats, but they
  1256. # are defined as "short"s; I think all the new formats are
  1257. # character-header formats and thus are strings, not numbers.
  1258. 0 short 070707 cpio archive
  1259. 0 short 0143561 byte-swapped cpio archive
  1260. 0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
  1261. 0 string 070701 ASCII cpio archive (SVR4 with no CRC)
  1262. 0 string 070702 ASCII cpio archive (SVR4 with CRC)
  1263.  
  1264. # Debian package (needs to go before regular portable archives)
  1265. #
  1266. 0 string =!<arch>\ndebian
  1267. >8 string debian-split part of multipart Debian package
  1268. >8 string debian-binary Debian binary package
  1269. >68 string >\0 (format %s)
  1270. # These next two lines do not work, because a bzip2 Debian archive
  1271. # still uses gzip for the control.tar (first in the archive). Only
  1272. # data.tar varies, and the location of its filename varies too.
  1273. # file/libmagic does not current have support for ascii-string based
  1274. # (offsets) as of 2005-09-15.
  1275. #>81 string bz2 \b, uses bzip2 compression
  1276. #>84 string gz \b, uses gzip compression
  1277. #>136 ledate x created: %s
  1278.  
  1279. # other archives
  1280. 0 long 0177555 very old archive
  1281. 0 short 0177555 very old PDP-11 archive
  1282. 0 long 0177545 old archive
  1283. 0 short 0177545 old PDP-11 archive
  1284. 0 long 0100554 apl workspace
  1285. 0 string =<ar> archive
  1286.  
  1287. # MIPS archive (needs to go before regular portable archives)
  1288. #
  1289. 0 string =!<arch>\n__________E MIPS archive
  1290. >20 string U with MIPS Ucode members
  1291. >21 string L with MIPSEL members
  1292. >21 string B with MIPSEB members
  1293. >19 string L and an EL hash table
  1294. >19 string B and an EB hash table
  1295. >22 string X -- out of date
  1296.  
  1297. 0 string -h- Software Tools format archive text
  1298.  
  1299. #
  1300. # XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is
  1301. # "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
  1302. #
  1303. # 0 string =!<arch> current ar archive
  1304. # 0 long 0x213c6172 archive file
  1305. #
  1306. # and for SVR1 archives, we have:
  1307. #
  1308. # 0 string \<ar> System V Release 1 ar archive
  1309. # 0 string =<ar> archive
  1310. #
  1311. # XXX - did Aegis really store shared libraries, breakpointed modules,
  1312. # and absolute code program modules in the same format as new-style
  1313. # "ar" archives?
  1314. #
  1315. 0 string =!<arch> current ar archive
  1316. >8 string __.SYMDEF random library
  1317. >0 belong =65538 - pre SR9.5
  1318. >0 belong =65539 - post SR9.5
  1319. >0 beshort 2 - object archive
  1320. >0 beshort 3 - shared library module
  1321. >0 beshort 4 - debug break-pointed module
  1322. >0 beshort 5 - absolute code program module
  1323. 0 string \<ar> System V Release 1 ar archive
  1324. 0 string =<ar> archive
  1325. #
  1326. # XXX - from "vax", which appears to collect a bunch of byte-swapped
  1327. # thingies, to help you recognize VAX files on big-endian machines;
  1328. # with "leshort", "lelong", and "string", that's no longer necessary....
  1329. #
  1330. 0 belong 0x65ff0000 VAX 3.0 archive
  1331. 0 belong 0x3c61723e VAX 5.0 archive
  1332. #
  1333. 0 long 0x213c6172 archive file
  1334. 0 lelong 0177555 very old VAX archive
  1335. 0 leshort 0177555 very old PDP-11 archive
  1336. #
  1337. # XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
  1338. # be a random library (it said 0xff65 rather than 0177545).
  1339. #
  1340. 0 lelong 0177545 old VAX archive
  1341. >8 string __.SYMDEF random library
  1342. 0 leshort 0177545 old PDP-11 archive
  1343. >8 string __.SYMDEF random library
  1344. #
  1345. # From "pdp" (but why a 4-byte quantity?)
  1346. #
  1347. 0 lelong 0x39bed PDP-11 old archive
  1348. 0 lelong 0x39bee PDP-11 4.0 archive
  1349.  
  1350. # ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
  1351. #
  1352. # The first byte is the magic (0x1a), byte 2 is the compression type for
  1353. # the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
  1354. # filename of the first file (null terminated). Since some types collide
  1355. # we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
  1356. # 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo.
  1357. 0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW
  1358. 0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed
  1359. 0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed
  1360. 0 lelong&0x8080ffff 0x0000031a ARC archive data, packed
  1361. 0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed
  1362. 0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched
  1363. # [JW] stuff taken from idarc, obviously ARC successors:
  1364. 0 lelong&0x8080ffff 0x00000a1a PAK archive data
  1365. 0 lelong&0x8080ffff 0x0000141a ARC+ archive data
  1366. 0 lelong&0x8080ffff 0x0000481a HYP archive data
  1367.  
  1368. # Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
  1369. # I can't create either SPARK or ArcFS archives so I have not tested this stuff
  1370. # [GRR: the original entries collide with ARC, above; replaced with combined
  1371. # version (not tested)]
  1372. #0 byte 0x1a RISC OS archive (spark format)
  1373. 0 string \032archive RISC OS archive (ArcFS format)
  1374. 0 string Archive\000 RISC OS archive (ArcFS format)
  1375.  
  1376. # All these were taken from idarc, many could not be verified. Unfortunately,
  1377. # there were many low-quality sigs, i.e. easy to trigger false positives.
  1378. # Please notify me of any real-world fishy/ambiguous signatures and I'll try
  1379. # to get my hands on the actual archiver and see if I find something better. [JW]
  1380. # probably many can be enhanced by finding some 0-byte or control char near the start
  1381.  
  1382. # idarc calls this Crush/Uncompressed... *shrug*
  1383. 0 string CRUSH Crush archive data
  1384. # Squeeze It (.sqz)
  1385. 0 string HLSQZ Squeeze It archive data
  1386. # SQWEZ
  1387. 0 string SQWEZ SQWEZ archive data
  1388. # HPack (.hpk)
  1389. 0 string HPAK HPack archive data
  1390. # HAP
  1391. 0 string \x91\x33HF HAP archive data
  1392. # MD/MDCD
  1393. 0 string MDmd MDCD archive data
  1394. # LIM
  1395. 0 string LIM\x1a LIM archive data
  1396. # SAR
  1397. 3 string LH5 SAR archive data
  1398. # BSArc/BS2
  1399. 0 string \212\3SB \0 BSArc/BS2 archive data
  1400. # MAR
  1401. 2 string =-ah MAR archive data
  1402. # ACB
  1403. 0 belong&0x00f800ff 0x00800000 ACB archive data
  1404. # CPZ
  1405. # TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data
  1406. # JRC
  1407. 0 string JRchive JRC archive data
  1408. # Quantum
  1409. 0 string DS\0 Quantum archive data
  1410. # ReSOF
  1411. 0 string PK\3\6 ReSOF archive data
  1412. # QuArk
  1413. 0 string 7\4 QuArk archive data
  1414. # YAC
  1415. 14 string YC YAC archive data
  1416. # X1
  1417. 0 string X1 X1 archive data
  1418. 0 string XhDr X1 archive data
  1419. # CDC Codec (.dqt)
  1420. 0 belong&0xffffe000 0x76ff2000 CDC Codec archive data
  1421. # AMGC
  1422. 0 string \xad6" AMGC archive data
  1423. # NuLIB
  1424. 0 string NõFélå NuLIB archive data
  1425. # PakLeo
  1426. 0 string LEOLZW PAKLeo archive data
  1427. # ChArc
  1428. 0 string SChF ChArc archive data
  1429. # PSA
  1430. 0 string PSA PSA archive data
  1431. # CrossePAC
  1432. 0 string DSIGDCC CrossePAC archive data
  1433. # Freeze
  1434. 0 string \x1f\x9f\x4a\x10\x0a Freeze archive data
  1435. # KBoom
  1436. 0 string ¨MP¨ KBoom archive data
  1437. # NSQ, must go after CDC Codec
  1438. 0 string \x76\xff NSQ archive data
  1439. # DPA
  1440. 0 string Dirk\ Paehl DPA archive data
  1441. # BA
  1442. # TODO: idarc says "bytes 0-2 == bytes 3-5"
  1443. # TTComp
  1444. 0 string \0\6 TTComp archive data
  1445. # ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
  1446. 0 string ESP ESP archive data
  1447. # ZPack
  1448. 0 string \1ZPK\1 ZPack archive data
  1449. # Sky
  1450. 0 string \xbc\x40 Sky archive data
  1451. # UFA
  1452. 0 string UFA UFA archive data
  1453. # Dry
  1454. 0 string =-H2O DRY archive data
  1455. # FoxSQZ
  1456. 0 string FOXSQZ FoxSQZ archive data
  1457. # AR7
  1458. 0 string ,AR7 AR7 archive data
  1459. # PPMZ
  1460. 0 string PPMZ PPMZ archive data
  1461. # MS Compress
  1462. 4 string \x88\xf0\x27 MS Compress archive data
  1463. # updated by Joerg Jenderek
  1464. >9 string \0
  1465. >>0 string KWAJ
  1466. >>>7 string \321\003 MS Compress archive data
  1467. >>>>14 ulong >0 \b, original size: %ld bytes
  1468. >>>>18 ubyte >0x65
  1469. >>>>>18 string x \b, was %.8s
  1470. >>>>>(10.b-4) string x \b.%.3s
  1471. # MP3 (archiver, not lossy audio compression)
  1472. 0 string MP3\x1a MP3-Archiver archive data
  1473. # ZET
  1474. 0 string OZÝ ZET archive data
  1475. # TSComp
  1476. 0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
  1477. # ARQ
  1478. 0 string gW\4\1 ARQ archive data
  1479. # Squash
  1480. 3 string OctSqu Squash archive data
  1481. # Terse
  1482. 0 string \5\1\1\0 Terse archive data
  1483. # PUCrunch
  1484. 0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
  1485. # UHarc
  1486. 0 string UHA UHarc archive data
  1487. # ABComp
  1488. 0 string \2AB ABComp archive data
  1489. 0 string \3AB2 ABComp archive data
  1490. # CMP
  1491. 0 string CO\0 CMP archive data
  1492. # Splint
  1493. 0 string \x93\xb9\x06 Splint archive data
  1494. # InstallShield
  1495. 0 string \x13\x5d\x65\x8c InstallShield Z archive Data
  1496. # Gather
  1497. 1 string GTH Gather archive data
  1498. # BOA
  1499. 0 string BOA BOA archive data
  1500. # RAX
  1501. 0 string ULEB\xa RAX archive data
  1502. # Xtreme
  1503. 0 string ULEB\0 Xtreme archive data
  1504. # Pack Magic
  1505. 0 string @â\1\0 Pack Magic archive data
  1506. # BTS
  1507. 0 belong&0xfeffffff 0x1a034465 BTS archive data
  1508. # ELI 5750
  1509. 0 string Ora\ ELI 5750 archive data
  1510. # QFC
  1511. 0 string \x1aFC\x1a QFC archive data
  1512. 0 string \x1aQF\x1a QFC archive data
  1513. # PRO-PACK
  1514. 0 string RNC PRO-PACK archive data
  1515. # 777
  1516. 0 string 777 777 archive data
  1517. # LZS221
  1518. 0 string sTaC LZS221 archive data
  1519. # HPA
  1520. 0 string HPA HPA archive data
  1521. # Arhangel
  1522. 0 string LG Arhangel archive data
  1523. # EXP1, uses bzip2
  1524. 0 string 0123456789012345BZh EXP1 archive data
  1525. # IMP
  1526. 0 string IMP\xa IMP archive data
  1527. # NRV
  1528. 0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data
  1529. # Squish
  1530. 0 string \x73\xb2\x90\xf4 Squish archive data
  1531. # Par
  1532. 0 string PHILIPP Par archive data
  1533. 0 string PAR Par archive data
  1534. # HIT
  1535. 0 string UB HIT archive data
  1536. # SBX
  1537. 0 belong&0xfffff000 0x53423000 SBX archive data
  1538. # NaShrink
  1539. 0 string NSK NaShrink archive data
  1540. # SAPCAR
  1541. 0 string #\ CAR\ archive\ header SAPCAR archive data
  1542. 0 string CAR\ 2.00RG SAPCAR archive data
  1543. # Disintegrator
  1544. 0 string DST Disintegrator archive data
  1545. # ASD
  1546. 0 string ASD ASD archive data
  1547. # InstallShield CAB
  1548. 0 string ISc( InstallShield CAB
  1549. # TOP4
  1550. 0 string T4\x1a TOP4 archive data
  1551. # BatComp left out: sig looks like COM executable
  1552. # so TODO: get real 4dos batcomp file and find sig
  1553. # BlakHole
  1554. 0 string BH\5\7 BlakHole archive data
  1555. # BIX
  1556. 0 string BIX0 BIX archive data
  1557. # ChiefLZA
  1558. 0 string ChfLZ ChiefLZA archive data
  1559. # Blink
  1560. 0 string Blink Blink archive data
  1561. # Logitech Compress
  1562. 0 string \xda\xfa Logitech Compress archive data
  1563. # ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
  1564. 1 string (C)\ STEPANYUK ARS-Sfx archive data
  1565. # AKT/AKT32
  1566. 0 string AKT32 AKT32 archive data
  1567. 0 string AKT AKT archive data
  1568. # NPack
  1569. 0 string MSTSM NPack archive data
  1570. # PFT
  1571. 0 string \0\x50\0\x14 PFT archive data
  1572. # SemOne
  1573. 0 string SEM SemOne archive data
  1574. # PPMD
  1575. 0 string \x8f\xaf\xac\x84 PPMD archive data
  1576. # FIZ
  1577. 0 string FIZ FIZ archive data
  1578. # MSXiE
  1579. 0 belong&0xfffff0f0 0x4d530000 MSXiE archive data
  1580. # DeepFreezer
  1581. 0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data
  1582. # DC
  1583. 0 string =<DC- DC archive data
  1584. # TPac
  1585. 0 string \4TPAC\3 TPac archive data
  1586. # Ai
  1587. 0 string Ai\1\1\0 Ai archive data
  1588. 0 string Ai\1\0\0 Ai archive data
  1589. # Ai32
  1590. 0 string Ai\2\0 Ai32 archive data
  1591. 0 string Ai\2\1 Ai32 archive data
  1592. # SBC
  1593. 0 string SBC SBC archive data
  1594. # Ybs
  1595. 0 string YBS Ybs archive data
  1596. # DitPack
  1597. 0 string \x9e\0\0 DitPack archive data
  1598. # DMS
  1599. 0 string DMS! DMS archive data
  1600. # EPC
  1601. 0 string \x8f\xaf\xac\x8c EPC archive data
  1602. # VSARC
  1603. 0 string VS\x1a VSARC archive data
  1604. # PDZ
  1605. 0 string PDZ PDZ archive data
  1606. # ReDuq
  1607. 0 string rdqx ReDuq archive data
  1608. # GCA
  1609. 0 string GCAX GCA archive data
  1610. # PPMN
  1611. 0 string pN PPMN archive data
  1612. # WinImage
  1613. 3 string WINIMAGE WinImage archive data
  1614. # Compressia
  1615. 0 string CMP0CMP Compressia archive data
  1616. # UHBC
  1617. 0 string UHB UHBC archive data
  1618. # WinHKI
  1619. 0 string \x61\x5C\x04\x05 WinHKI archive data
  1620. # WWPack data file
  1621. 0 string WWP WWPack archive data
  1622. # BSN (BSA, PTS-DOS)
  1623. 0 string \xffBSG BSN archive data
  1624. 1 string \xffBSG BSN archive data
  1625. 3 string \xffBSG BSN archive data
  1626. 1 string \0\xae\2 BSN archive data
  1627. 1 string \0\xae\3 BSN archive data
  1628. 1 string \0\xae\7 BSN archive data
  1629. # AIN
  1630. 0 string \x33\x18 AIN archive data
  1631. 0 string \x33\x17 AIN archive data
  1632. # XPA32
  1633. 0 string xpa\0\1 XPA32 archive data
  1634. # SZip (TODO: doesn't catch all versions)
  1635. 0 string SZ\x0a\4 SZip archive data
  1636. # XPack DiskImage
  1637. 0 string jm XPack DiskImage archive data
  1638. # XPack Data
  1639. 0 string xpa XPack archive data
  1640. # XPack Single Data
  1641. 0 string Í\ jm XPack single archive data
  1642.  
  1643. # TODO: missing due to unknown magic/magic at end of file:
  1644. #DWC
  1645. #ARG
  1646. #ZAR
  1647. #PC/3270
  1648. #InstallIt
  1649. #RKive
  1650. #RK
  1651. #XPack Diskimage
  1652.  
  1653. # These were inspired by idarc, but actually verified
  1654. # Dzip archiver (.dz)
  1655. 0 string DZ Dzip archive data
  1656. >2 byte x \b, version %i
  1657. >3 byte x \b.%i
  1658. # ZZip archiver (.zz)
  1659. 0 string ZZ\ \0\0 ZZip archive data
  1660. 0 string ZZ0 ZZip archive data
  1661. # PAQ archiver (.paq)
  1662. 0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
  1663. 0 string PAQ PAQ archive data
  1664. >3 byte&0xf0 0x30
  1665. >>3 byte x (v%c)
  1666. # JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
  1667. 0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data
  1668. 0 string JARCS JAR (ARJ Software, Inc.) archive data
  1669.  
  1670. # ARJ archiver (jason@jarthur.Claremont.EDU)
  1671. 0 leshort 0xea60 ARJ archive data
  1672. >5 byte x \b, v%d,
  1673. >8 byte &0x04 multi-volume,
  1674. >8 byte &0x10 slash-switched,
  1675. >8 byte &0x20 backup,
  1676. >34 string x original name: %s,
  1677. >7 byte 0 os: MS-DOS
  1678. >7 byte 1 os: PRIMOS
  1679. >7 byte 2 os: Unix
  1680. >7 byte 3 os: Amiga
  1681. >7 byte 4 os: Macintosh
  1682. >7 byte 5 os: OS/2
  1683. >7 byte 6 os: Apple ][ GS
  1684. >7 byte 7 os: Atari ST
  1685. >7 byte 8 os: NeXT
  1686. >7 byte 9 os: VAX/VMS
  1687. >3 byte >0 %d]
  1688. # [JW] idarc says this is also possible
  1689. 2 leshort 0xea60 ARJ archive data
  1690.  
  1691. # HA archiver (Greg Roelofs, newt@uchicago.edu)
  1692. # This is a really bad format. A file containing HAWAII will match this...
  1693. #0 string HA HA archive data,
  1694. #>2 leshort =1 1 file,
  1695. #>2 leshort >1 %u files,
  1696. #>4 byte&0x0f =0 first is type CPY
  1697. #>4 byte&0x0f =1 first is type ASC
  1698. #>4 byte&0x0f =2 first is type HSC
  1699. #>4 byte&0x0f =0x0e first is type DIR
  1700. #>4 byte&0x0f =0x0f first is type SPECIAL
  1701. # suggestion: at least identify small archives (<1024 files)
  1702. 0 belong&0xffff00fc 0x48410000 HA archive data
  1703. >2 leshort =1 1 file,
  1704. >2 leshort >1 %u files,
  1705. >4 byte&0x0f =0 first is type CPY
  1706. >4 byte&0x0f =1 first is type ASC
  1707. >4 byte&0x0f =2 first is type HSC
  1708. >4 byte&0x0f =0x0e first is type DIR
  1709. >4 byte&0x0f =0x0f first is type SPECIAL
  1710.  
  1711. # HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
  1712. 0 string HPAK HPACK archive data
  1713.  
  1714. # JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
  1715. 0 string \351,\001JAM\ JAM archive,
  1716. >7 string >\0 version %.4s
  1717. >0x26 byte =0x27 -
  1718. >>0x2b string >\0 label %.11s,
  1719. >>0x27 lelong x serial %08x,
  1720. >>0x36 string >\0 fstype %.8s
  1721.  
  1722. # LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
  1723. 2 string -lh0- LHarc 1.x/ARX archive data [lh0]
  1724. 2 string -lh1- LHarc 1.x/ARX archive data [lh1]
  1725. 2 string -lz4- LHarc 1.x archive data [lz4]
  1726. 2 string -lz5- LHarc 1.x archive data [lz5]
  1727. # [never seen any but the last; -lh4- reported in comp.compression:]
  1728. 2 string -lzs- LHa/LZS archive data [lzs]
  1729. 2 string -lh\40- LHa 2.x? archive data [lh ]
  1730. 2 string -lhd- LHa 2.x? archive data [lhd]
  1731. 2 string -lh2- LHa 2.x? archive data [lh2]
  1732. 2 string -lh3- LHa 2.x? archive data [lh3]
  1733. 2 string -lh4- LHa (2.x) archive data [lh4]
  1734. 2 string -lh5- LHa (2.x) archive data [lh5]
  1735. 2 string -lh6- LHa (2.x) archive data [lh6]
  1736. 2 string -lh7- LHa (2.x)/LHark archive data [lh7]
  1737. >20 byte x - header level %d
  1738. # taken from idarc [JW]
  1739. 2 string -lZ PUT archive data
  1740. 2 string -lz LZS archive data
  1741. 2 string -sw1- Swag archive data
  1742.  
  1743. # RAR archiver (Greg Roelofs, newt@uchicago.edu)
  1744. 0 string Rar! RAR archive data,
  1745. >44 byte x v%0x,
  1746. >10 byte >0 flags:
  1747. >>10 byte &0x01 Archive volume,
  1748. >>10 byte &0x02 Commented,
  1749. >>10 byte &0x04 Locked,
  1750. >>10 byte &0x08 Solid,
  1751. >>10 byte &0x20 Authenticated,
  1752. >35 byte 0 os: MS-DOS
  1753. >35 byte 1 os: OS/2
  1754. >35 byte 2 os: Win32
  1755. >35 byte 3 os: Unix
  1756. # some old version? idarc says:
  1757. 0 string RE\x7e\x5e RAR archive data
  1758.  
  1759. # SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
  1760. 0 string SQSH squished archive data (Acorn RISCOS)
  1761.  
  1762. # UC2 archiver (Greg Roelofs, newt@uchicago.edu)
  1763. # [JW] see exe section for self-extracting version
  1764. 0 string UC2\x1a UC2 archive data
  1765.  
  1766. # ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
  1767. 0 string PK\003\004
  1768. >4 byte 0x00 Zip archive data
  1769. >4 byte 0x09 Zip archive data, at least v0.9 to extract
  1770. >4 byte 0x0a Zip archive data, at least v1.0 to extract
  1771. >4 byte 0x0b Zip archive data, at least v1.1 to extract
  1772. >4 byte 0x14
  1773. >>30 ubelong !0x6d696d65 Zip archive data, at least v2.0 to extract
  1774. >0x161 string WINZIP Zip archive data, WinZIP self-extracting
  1775.  
  1776.  
  1777. # OpenOffice.org / KOffice / StarOffice documents
  1778. # From: Abel Cheung <abel@oaka.org>
  1779. # Listed here because they are basically zip files
  1780. >>30 string mimetype
  1781.  
  1782. # KOffice (1.2 or above) formats
  1783. >>>50 string vnd.kde. KOffice (>=1.2)
  1784. >>>>58 string karbon Karbon document
  1785. >>>>58 string kchart KChart document
  1786. >>>>58 string kformula KFormula document
  1787. >>>>58 string kivio Kivio document
  1788. >>>>58 string kontour Kontour document
  1789. >>>>58 string kpresenter KPresenter document
  1790. >>>>58 string kspread KSpread document
  1791. >>>>58 string kword KWord document
  1792.  
  1793. # OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
  1794. >>>50 string vnd.sun.xml. OpenOffice.org 1.x
  1795. >>>>62 string writer Writer
  1796. >>>>>68 byte !0x2e document
  1797. >>>>>68 string .template template
  1798. >>>>>68 string .global global document
  1799. >>>>62 string calc Calc
  1800. >>>>>66 byte !0x2e spreadsheet
  1801. >>>>>66 string .template template
  1802. >>>>62 string draw Draw
  1803. >>>>>66 byte !0x2e document
  1804. >>>>>66 string .template template
  1805. >>>>62 string impress Impress
  1806. >>>>>69 byte !0x2e presentation
  1807. >>>>>69 string .template template
  1808. >>>>62 string math Math document
  1809.  
  1810. # OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
  1811. # http://lists.oasis-open.org/archives/office/200505/msg00006.html
  1812. >>>50 string vnd.oasis.opendocument. OpenDocument
  1813. >>>>73 string text
  1814. >>>>>77 byte !0x2d Text
  1815. >>>>>77 string -template Text Template
  1816. >>>>>77 string -web HTML Document Template
  1817. >>>>>77 string -master Master Document
  1818. >>>>73 string graphics Drawing
  1819. >>>>>81 string -template Template
  1820. >>>>73 string presentation Presentation
  1821. >>>>>85 string -template Template
  1822. >>>>73 string spreadsheet Spreadsheet
  1823. >>>>>84 string -template Template
  1824. >>>>73 string chart Chart
  1825. >>>>>78 string -template Template
  1826. >>>>73 string formula Formula
  1827. >>>>>80 string -template Template
  1828. >>>>73 string database Database
  1829. >>>>73 string image Image
  1830.  
  1831. # Zoo archiver
  1832. 20 lelong 0xfdc4a7dc Zoo archive data
  1833. >4 byte >48 \b, v%c.
  1834. >>6 byte >47 \b%c
  1835. >>>7 byte >47 \b%c
  1836. >32 byte >0 \b, modify: v%d
  1837. >>33 byte x \b.%d+
  1838. >42 lelong 0xfdc4a7dc \b,
  1839. >>70 byte >0 extract: v%d
  1840. >>>71 byte x \b.%d+
  1841.  
  1842. # Shell archives
  1843. 10 string #\ This\ is\ a\ shell\ archive shell archive text
  1844.  
  1845. #
  1846. # LBR. NB: May conflict with the questionable
  1847. # "binary Computer Graphics Metafile" format.
  1848. #
  1849. 0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data
  1850. #
  1851. # PMA (CP/M derivative of LHA)
  1852. #
  1853. 2 string -pm0- PMarc archive data [pm0]
  1854. 2 string -pm1- PMarc archive data [pm1]
  1855. 2 string -pm2- PMarc archive data [pm2]
  1856. 2 string -pms- PMarc SFX archive (CP/M, DOS)
  1857. 5 string -pc1- PopCom compressed executable (CP/M)
  1858.  
  1859. # From Rafael Laboissiere <rafael@laboissiere.net>
  1860. # The Project Revision Control System (see
  1861. # http://prcs.sourceforge.net) generates a packaged project
  1862. # file which is recognized by the following entry:
  1863. 0 leshort 0xeb81 PRCS packaged project
  1864.  
  1865. # Microsoft cabinets
  1866. # by David Necas (Yeti) <yeti@physics.muni.cz>
  1867. #0 string MSCF\0\0\0\0 Microsoft cabinet file data,
  1868. #>25 byte x v%d
  1869. #>24 byte x \b.%d
  1870. # MPi: All CABs have version 1.3, so this is pointless.
  1871. # Better magic in debian-additions.
  1872.  
  1873. # GTKtalog catalogs
  1874. # by David Necas (Yeti) <yeti@physics.muni.cz>
  1875. 4 string gtktalog\ GTKtalog catalog data,
  1876. >13 string 3 version 3
  1877. >>14 beshort 0x677a (gzipped)
  1878. >>14 beshort !0x677a (not gzipped)
  1879. >13 string >3 version %s
  1880.  
  1881. ############################################################################
  1882. # Parity archive reconstruction file, the 'par' file format now used on Usenet.
  1883. 0 string PAR\0 PARity archive data
  1884. >48 leshort =0 - Index file
  1885. >48 leshort >0 - file number %d
  1886.  
  1887. # Felix von Leitner <felix-file@fefe.de>
  1888. 0 string d8:announce BitTorrent file
  1889.  
  1890. # Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
  1891. 0 beshort 0x0e0f Atari MSA archive data
  1892. >2 beshort x \b, %d sectors per track
  1893. >4 beshort 0 \b, 1 sided
  1894. >4 beshort 1 \b, 2 sided
  1895. >6 beshort x \b, starting track: %d
  1896. >8 beshort x \b, ending track: %d
  1897.  
  1898. # Alternate ZIP string (amc@arwen.cs.berkeley.edu)
  1899. 0 string PK00PK\003\004 Zip archive data
  1900.  
  1901. # ACE archive (from http://www.wotsit.org/download.asp?f=ace)
  1902. # by Stefan `Sec` Zehl <sec@42.org>
  1903. 7 string **ACE** ACE archive data
  1904. >15 byte >0 version %d
  1905. >16 byte =0x00 \b, from MS-DOS
  1906. >16 byte =0x01 \b, from OS/2
  1907. >16 byte =0x02 \b, from Win/32
  1908. >16 byte =0x03 \b, from Unix
  1909. >16 byte =0x04 \b, from MacOS
  1910. >16 byte =0x05 \b, from WinNT
  1911. >16 byte =0x06 \b, from Primos
  1912. >16 byte =0x07 \b, from AppleGS
  1913. >16 byte =0x08 \b, from Atari
  1914. >16 byte =0x09 \b, from Vax/VMS
  1915. >16 byte =0x0A \b, from Amiga
  1916. >16 byte =0x0B \b, from Next
  1917. >14 byte x \b, version %d to extract
  1918. >5 leshort &0x0080 \b, multiple volumes,
  1919. >>17 byte x \b (part %d),
  1920. >5 leshort &0x0002 \b, contains comment
  1921. >5 leshort &0x0200 \b, sfx
  1922. >5 leshort &0x0400 \b, small dictionary
  1923. >5 leshort &0x0800 \b, multi-volume
  1924. >5 leshort &0x1000 \b, contains AV-String
  1925. >>30 string \x16*UNREGISTERED\x20VERSION* (unregistered)
  1926. >5 leshort &0x2000 \b, with recovery record
  1927. >5 leshort &0x4000 \b, locked
  1928. >5 leshort &0x8000 \b, solid
  1929. # Date in MS-DOS format (whatever that is)
  1930. #>18 lelong x Created on
  1931.  
  1932. # sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
  1933. # <doj@cubic.org>
  1934. 0x1A string sfArk sfArk compressed Soundfont
  1935. >0x15 string 2
  1936. >>0x1 string >\0 Version %s
  1937. >>0x2A string >\0 : %s
  1938.  
  1939. # DR-DOS 7.03 Packed File *.??_
  1940. 0 string Packed\ File\ Personal NetWare Packed File
  1941. >12 string x \b, was "%.12s"
  1942.  
  1943. # EET archive
  1944. # From: Tilman Sauerbeck <tilman@code-monkey.de>
  1945. 0 belong 0x1ee7ff00 EET archive
  1946.  
  1947. # rzip archives
  1948. 0 string RZIP rzip compressed data
  1949. >4 byte x - version %d
  1950. >5 byte x \b.%d
  1951. >6 belong x (%d bytes)
  1952.  
  1953. # From: "Robert Dale" <robdale@gmail.com>
  1954. 0 belong 123 dar archive,
  1955. >4 belong x label "%.8x
  1956. >>8 belong x %.8x
  1957. >>>12 beshort x %.4x"
  1958. >14 byte 0x54 end slice
  1959. >14 beshort 0x4e4e multi-part
  1960. >14 beshort 0x4e53 multi-part, with -S
  1961.  
  1962. # Symbian installation files
  1963. # http://www.thouky.co.uk/software/psifs/sis.html
  1964. # http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
  1965. 8 lelong 0x10000419 Symbian installation file
  1966. >4 lelong 0x1000006D (EPOC release 3/4/5)
  1967. >4 lelong 0x10003A12 (EPOC release 6)
  1968. 0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x)
  1969.  
  1970. # Pack200 Java archives, http://jcp.org/en/jsr/detail?id=200
  1971. 0 belong 0xcafed00d Pack200 Java archive
  1972.  
  1973. # From "Nelson A. de Oliveira" <naoliv@gmail.com>
  1974. 0 string MPQ\032 MoPaQ (MPQ) archive
  1975.  
  1976. # From: Dirk Jagdmann <doj@cubic.org>
  1977. # xar archive format: http://code.google.com/p/xar/
  1978. 0 string xar! xar archive
  1979. >6 beshort x - version %ld
  1980.  
  1981. # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
  1982. # .kgb
  1983. 0 string KGB_arch KGB Archiver file
  1984. >10 string x with compression level %.1s
  1985.  
  1986. #------------------------------------------------------------------------------
  1987. # asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
  1988. # strings as "long" - we assume they're just strings:
  1989. # From: guy@netapp.com (Guy Harris)
  1990. #
  1991. 0 string *STA Aster*x
  1992. >7 string WORD Words Document
  1993. >7 string GRAP Graphic
  1994. >7 string SPRE Spreadsheet
  1995. >7 string MACR Macro
  1996. 0 string 2278 Aster*x Version 2
  1997. >29 byte 0x36 Words Document
  1998. >29 byte 0x35 Graphic
  1999. >29 byte 0x32 Spreadsheet
  2000. >29 byte 0x38 Macro
  2001.  
  2002.  
  2003. #------------------------------------------------------------------------------
  2004. # att3b: file(1) magic for AT&T 3B machines
  2005. #
  2006. # The `versions' should be un-commented if they work for you.
  2007. # (Was the problem just one of endianness?)
  2008. #
  2009. # 3B20
  2010. #
  2011. # The 3B20 conflicts with SCCS.
  2012. #0 beshort 0550 3b20 COFF executable
  2013. #>12 belong >0 not stripped
  2014. #>22 beshort >0 - version %ld
  2015. #0 beshort 0551 3b20 COFF executable (TV)
  2016. #>12 belong >0 not stripped
  2017. #>22 beshort >0 - version %ld
  2018. #
  2019. # WE32K
  2020. #
  2021. 0 beshort 0560 WE32000 COFF
  2022. >18 beshort ^00000020 object
  2023. >18 beshort &00000020 executable
  2024. >12 belong >0 not stripped
  2025. >18 beshort ^00010000 N/A on 3b2/300 w/paging
  2026. >18 beshort &00020000 32100 required
  2027. >18 beshort &00040000 and MAU hardware required
  2028. >20 beshort 0407 (impure)
  2029. >20 beshort 0410 (pure)
  2030. >20 beshort 0413 (demand paged)
  2031. >20 beshort 0443 (target shared library)
  2032. >22 beshort >0 - version %ld
  2033. 0 beshort 0561 WE32000 COFF executable (TV)
  2034. >12 belong >0 not stripped
  2035. #>18 beshort &00020000 - 32100 required
  2036. #>18 beshort &00040000 and MAU hardware required
  2037. #>22 beshort >0 - version %ld
  2038. #
  2039. # core file for 3b2
  2040. 0 string \000\004\036\212\200 3b2 core file
  2041. >364 string >\0 of '%s'
  2042.  
  2043. #------------------------------------------------------------------------------
  2044. # audio: file(1) magic for sound formats (see also "iff")
  2045. #
  2046. # Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
  2047. # and others
  2048. #
  2049.  
  2050. # Sun/NeXT audio data
  2051. 0 string .snd Sun/NeXT audio data:
  2052. >12 belong 1 8-bit ISDN mu-law,
  2053. >12 belong 2 8-bit linear PCM [REF-PCM],
  2054. >12 belong 3 16-bit linear PCM,
  2055. >12 belong 4 24-bit linear PCM,
  2056. >12 belong 5 32-bit linear PCM,
  2057. >12 belong 6 32-bit IEEE floating point,
  2058. >12 belong 7 64-bit IEEE floating point,
  2059. >12 belong 8 Fragmented sample data,
  2060. >12 belong 10 DSP program,
  2061. >12 belong 11 8-bit fixed point,
  2062. >12 belong 12 16-bit fixed point,
  2063. >12 belong 13 24-bit fixed point,
  2064. >12 belong 14 32-bit fixed point,
  2065. >12 belong 18 16-bit linear with emphasis,
  2066. >12 belong 19 16-bit linear compressed,
  2067. >12 belong 20 16-bit linear with emphasis and compression,
  2068. >12 belong 21 Music kit DSP commands,
  2069. >12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
  2070. >12 belong 24 compressed (8-bit CCITT G.722 ADPCM)
  2071. >12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM),
  2072. >12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM),
  2073. >12 belong 27 8-bit A-law (CCITT G.711),
  2074. >20 belong 1 mono,
  2075. >20 belong 2 stereo,
  2076. >20 belong 4 quad,
  2077. >16 belong >0 %d Hz
  2078.  
  2079. # DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
  2080. # that uses little-endian encoding and has a different magic number
  2081. 0 lelong 0x0064732E DEC audio data:
  2082. >12 lelong 1 8-bit ISDN mu-law,
  2083. >12 lelong 2 8-bit linear PCM [REF-PCM],
  2084. >12 lelong 3 16-bit linear PCM,
  2085. >12 lelong 4 24-bit linear PCM,
  2086. >12 lelong 5 32-bit linear PCM,
  2087. >12 lelong 6 32-bit IEEE floating point,
  2088. >12 lelong 7 64-bit IEEE floating point,
  2089. >12 belong 8 Fragmented sample data,
  2090. >12 belong 10 DSP program,
  2091. >12 belong 11 8-bit fixed point,
  2092. >12 belong 12 16-bit fixed point,
  2093. >12 belong 13 24-bit fixed point,
  2094. >12 belong 14 32-bit fixed point,
  2095. >12 belong 18 16-bit linear with emphasis,
  2096. >12 belong 19 16-bit linear compressed,
  2097. >12 belong 20 16-bit linear with emphasis and compression,
  2098. >12 belong 21 Music kit DSP commands,
  2099. >12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
  2100. >12 belong 24 compressed (8-bit CCITT G.722 ADPCM)
  2101. >12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM),
  2102. >12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM),
  2103. >12 belong 27 8-bit A-law (CCITT G.711),
  2104. >20 lelong 1 mono,
  2105. >20 lelong 2 stereo,
  2106. >20 lelong 4 quad,
  2107. >16 lelong >0 %d Hz
  2108.  
  2109. # Creative Labs AUDIO stuff
  2110. 0 string MThd Standard MIDI data
  2111. >8 beshort x (format %d)
  2112. >10 beshort x using %d track
  2113. >10 beshort >1 \bs
  2114. >12 beshort&0x7fff x at 1/%d
  2115. >12 beshort&0x8000 >0 SMPTE
  2116.  
  2117. 0 string CTMF Creative Music (CMF) data
  2118. 0 string SBI SoundBlaster instrument data
  2119. 0 string Creative\ Voice\ File Creative Labs voice data
  2120. # is this next line right? it came this way...
  2121. >19 byte 0x1A
  2122. >23 byte >0 - version %d
  2123. >22 byte >0 \b.%d
  2124.  
  2125. # first entry is also the string "NTRK"
  2126. 0 belong 0x4e54524b MultiTrack sound data
  2127. >4 belong x - version %ld
  2128.  
  2129. # Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
  2130. # [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
  2131. 0 string EMOD Extended MOD sound data,
  2132. >4 byte&0xf0 x version %d
  2133. >4 byte&0x0f x \b.%d,
  2134. >45 byte x %d instruments
  2135. >83 byte 0 (module)
  2136. >83 byte 1 (song)
  2137.  
  2138. # Real Audio (Magic .ra\0375)
  2139. 0 belong 0x2e7261fd RealAudio sound file
  2140. 0 string .RMF RealMedia file
  2141.  
  2142. # MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
  2143. # Oct 31, 1995
  2144. # fixed by <doj@cubic.org> 2003-06-24
  2145. # Too short...
  2146. #0 string MTM MultiTracker Module sound file
  2147. #0 string if Composer 669 Module sound data
  2148. #0 string JN Composer 669 Module sound data (extended format)
  2149. 0 string MAS_U ULT(imate) Module sound data
  2150.  
  2151. #0 string FAR Module sound data
  2152. #>4 string >\15 Title: "%s"
  2153.  
  2154. 0x2c string SCRM ScreamTracker III Module sound data
  2155. >0 string >\0 Title: "%s"
  2156.  
  2157. # Gravis UltraSound patches
  2158. # From <ache@nagual.ru>
  2159.  
  2160. 0 string GF1PATCH110\0ID#000002\0 GUS patch
  2161. 0 string GF1PATCH100\0ID#000002\0 Old GUS patch
  2162.  
  2163. #
  2164. # Taken from loader code from mikmod version 2.14
  2165. # by Steve McIntyre (stevem@chiark.greenend.org.uk)
  2166. # <doj@cubic.org> added title printing on 2003-06-24
  2167. 0 string MAS_UTrack_V00
  2168. >14 string >/0 ultratracker V1.%.1s module sound data
  2169.  
  2170. 0 string UN05 MikMod UNI format module sound data
  2171.  
  2172. 0 string Extended\ Module: Fasttracker II module sound data
  2173. >17 string >\0 Title: "%s"
  2174.  
  2175. 21 string/c =!SCREAM! Screamtracker 2 module sound data
  2176. 21 string BMOD2STM Screamtracker 2 module sound data
  2177. 1080 string M.K. 4-channel Protracker module sound data
  2178. >0 string >\0 Title: "%s"
  2179. 1080 string M!K! 4-channel Protracker module sound data
  2180. >0 string >\0 Title: "%s"
  2181. 1080 string FLT4 4-channel Startracker module sound data
  2182. >0 string >\0 Title: "%s"
  2183. 1080 string FLT8 8-channel Startracker module sound data
  2184. >0 string >\0 Title: "%s"
  2185. 1080 string 4CHN 4-channel Fasttracker module sound data
  2186. >0 string >\0 Title: "%s"
  2187. 1080 string 6CHN 6-channel Fasttracker module sound data
  2188. >0 string >\0 Title: "%s"
  2189. 1080 string 8CHN 8-channel Fasttracker module sound data
  2190. >0 string >\0 Title: "%s"
  2191. 1080 string CD81 8-channel Octalyser module sound data
  2192. >0 string >\0 Title: "%s"
  2193. 1080 string OKTA 8-channel Oktalyzer module sound data
  2194. >0 string >\0 Title: "%s"
  2195. # Not good enough.
  2196. #1082 string CH
  2197. #>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data
  2198. 1080 string 16CN 16-channel Taketracker module sound data
  2199. >0 string >\0 Title: "%s"
  2200. 1080 string 32CN 32-channel Taketracker module sound data
  2201. >0 string >\0 Title: "%s"
  2202.  
  2203. # TOC sound files -Trevor Johnson <trevor@jpj.net>
  2204. #
  2205. 0 string TOC TOC sound file
  2206.  
  2207. # sidfiles <pooka@iki.fi>
  2208. # added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24
  2209. 0 string SIDPLAY\ INFOFILE Sidplay info file
  2210.  
  2211. 0 string PSID PlaySID v2.2+ (AMIGA) sidtune
  2212. >4 beshort >0 w/ header v%d,
  2213. >14 beshort =1 single song,
  2214. >14 beshort >1 %d songs,
  2215. >16 beshort >0 default song: %d
  2216. >0x16 string >\0 name: "%s"
  2217. >0x36 string >\0 author: "%s"
  2218. >0x56 string >\0 copyright: "%s"
  2219.  
  2220. 0 string RSID RSID sidtune PlaySID compatible
  2221. >4 beshort >0 w/ header v%d,
  2222. >14 beshort =1 single song,
  2223. >14 beshort >1 %d songs,
  2224. >16 beshort >0 default song: %d
  2225. >0x16 string >\0 name: "%s"
  2226. >0x36 string >\0 author: "%s"
  2227. >0x56 string >\0 copyright: "%s"
  2228.  
  2229. # IRCAM <mpruett@sgi.com>
  2230. # VAX and MIPS files are little-endian; Sun and NeXT are big-endian
  2231. 0 belong 0x64a30100 IRCAM file (VAX)
  2232. 0 belong 0x64a30200 IRCAM file (Sun)
  2233. 0 belong 0x64a30300 IRCAM file (MIPS little-endian)
  2234. 0 belong 0x64a30400 IRCAM file (NeXT)
  2235.  
  2236. # NIST SPHERE <mpruett@sgi.com>
  2237. 0 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file
  2238.  
  2239. # Sample Vision <mpruett@sgi.com>
  2240. 0 string SOUND\ SAMPLE\ DATA\ Sample Vision file
  2241.  
  2242. # Audio Visual Research <tonigonenstein@users.sourceforge.net>
  2243. 0 string 2BIT Audio Visual Research file,
  2244. >12 beshort =0 mono,
  2245. >12 beshort =-1 stereo,
  2246. >14 beshort x %d bits
  2247. >16 beshort =0 unsigned,
  2248. >16 beshort =-1 signed,
  2249. >22 belong&0x00ffffff x %d Hz,
  2250. >18 beshort =0 no loop,
  2251. >18 beshort =-1 loop,
  2252. >21 ubyte <=127 note %d,
  2253. >22 byte =0 replay 5.485 KHz
  2254. >22 byte =1 replay 8.084 KHz
  2255. >22 byte =2 replay 10.971 Khz
  2256. >22 byte =3 replay 16.168 Khz
  2257. >22 byte =4 replay 21.942 KHz
  2258. >22 byte =5 replay 32.336 KHz
  2259. >22 byte =6 replay 43.885 KHz
  2260. >22 byte =7 replay 47.261 KHz
  2261.  
  2262. # SGI SoundTrack <mpruett@sgi.com>
  2263. 0 string _SGI_SoundTrack SGI SoundTrack project file
  2264. # ID3 version 2 tags <waschk@informatik.uni-rostock.de>
  2265. 0 string ID3 Audio file with ID3 version 2
  2266. >3 ubyte <0xff \b%d.
  2267. >4 ubyte <0xff \b%d tag
  2268. >2584 string fLaC \b, FLAC encoding
  2269. >>2588 byte&0x7f >0 \b, unknown version
  2270. >>2588 byte&0x7f 0 \b
  2271. # some common bits/sample values
  2272. >>>2600 beshort&0x1f0 0x030 \b, 4 bit
  2273. >>>2600 beshort&0x1f0 0x050 \b, 6 bit
  2274. >>>2600 beshort&0x1f0 0x070 \b, 8 bit
  2275. >>>2600 beshort&0x1f0 0x0b0 \b, 12 bit
  2276. >>>2600 beshort&0x1f0 0x0f0 \b, 16 bit
  2277. >>>2600 beshort&0x1f0 0x170 \b, 24 bit
  2278. >>>2600 byte&0xe 0x0 \b, mono
  2279. >>>2600 byte&0xe 0x2 \b, stereo
  2280. >>>2600 byte&0xe 0x4 \b, 3 channels
  2281. >>>2600 byte&0xe 0x6 \b, 4 channels
  2282. >>>2600 byte&0xe 0x8 \b, 5 channels
  2283. >>>2600 byte&0xe 0xa \b, 6 channels
  2284. >>>2600 byte&0xe 0xc \b, 7 channels
  2285. >>>2600 byte&0xe 0xe \b, 8 channels
  2286. # some common sample rates
  2287. >>>2597 belong&0xfffff0 0x0ac440 \b, 44.1 kHz
  2288. >>>2597 belong&0xfffff0 0x0bb800 \b, 48 kHz
  2289. >>>2597 belong&0xfffff0 0x07d000 \b, 32 kHz
  2290. >>>2597 belong&0xfffff0 0x056220 \b, 22.05 kHz
  2291. >>>2597 belong&0xfffff0 0x05dc00 \b, 24 kHz
  2292. >>>2597 belong&0xfffff0 0x03e800 \b, 16 kHz
  2293. >>>2597 belong&0xfffff0 0x02b110 \b, 11.025 kHz
  2294. >>>2597 belong&0xfffff0 0x02ee00 \b, 12 kHz
  2295. >>>2597 belong&0xfffff0 0x01f400 \b, 8 kHz
  2296. >>>2597 belong&0xfffff0 0x177000 \b, 96 kHz
  2297. >>>2597 belong&0xfffff0 0x0fa000 \b, 64 kHz
  2298. >>>2601 byte&0xf >0 \b, >4G samples
  2299. >2584 string !fLaC \b, MP3 encoding
  2300.  
  2301. # NSF (NES sound file) magic
  2302. 0 string NESM\x1a NES Sound File
  2303. >14 string >\0 ("%s" by
  2304. >46 string >\0 %s, copyright
  2305. >78 string >\0 %s),
  2306. >5 byte x version %d,
  2307. >6 byte x %d tracks,
  2308. >122 byte&0x2 =1 dual PAL/NTSC
  2309. >122 byte&0x1 =1 PAL
  2310. >122 byte&0x1 =0 NTSC
  2311.  
  2312. # Impulse tracker module (audio/x-it)
  2313. 0 string IMPM Impulse Tracker module sound data -
  2314. >4 string >\0 "%s"
  2315. >40 leshort !0 compatible w/ITv%x
  2316. >42 leshort !0 created w/ITv%x
  2317.  
  2318. # Imago Orpheus module (audio/x-imf)
  2319. 60 string IM10 Imago Orpheus module sound data -
  2320. >0 string >\0 "%s"
  2321.  
  2322. # From <collver1@attbi.com>
  2323. # These are the /etc/magic entries to decode modules, instruments, and
  2324. # samples in Impulse Tracker's native format.
  2325.  
  2326. 0 string IMPS Impulse Tracker Sample
  2327. >18 byte &2 16 bit
  2328. >18 byte ^2 8 bit
  2329. >18 byte &4 stereo
  2330. >18 byte ^4 mono
  2331. 0 string IMPI Impulse Tracker Instrument
  2332. >28 leshort !0 ITv%x
  2333. >30 byte !0 %d samples
  2334.  
  2335. # Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files
  2336. # From <collver1@attbi.com>
  2337. 0 string LM8953 Yamaha TX Wave
  2338. >22 byte 0x49 looped
  2339. >22 byte 0xC9 non-looped
  2340. >23 byte 1 33kHz
  2341. >23 byte 2 50kHz
  2342. >23 byte 3 16kHz
  2343.  
  2344. # scream tracker: file(1) magic for Scream Tracker sample files
  2345. #
  2346. # From <collver1@attbi.com>
  2347. 76 string SCRS Scream Tracker Sample
  2348. >0 byte 1 sample
  2349. >0 byte 2 adlib melody
  2350. >0 byte >2 adlib drum
  2351. >31 byte &2 stereo
  2352. >31 byte ^2 mono
  2353. >31 byte &4 16bit little endian
  2354. >31 byte ^4 8bit
  2355. >30 byte 0 unpacked
  2356. >30 byte 1 packed
  2357.  
  2358. # audio
  2359. # From: Cory Dikkers <cdikkers@swbell.net>
  2360. 0 string MMD0 MED music file, version 0
  2361. 0 string MMD1 OctaMED Pro music file, version 1
  2362. 0 string MMD3 OctaMED Soundstudio music file, version 3
  2363. 0 string OctaMEDCmpr OctaMED Soundstudio compressed file
  2364. 0 string MED MED_Song
  2365. 0 string SymM Symphonie SymMOD music file
  2366. #
  2367. 0 string THX AHX version
  2368. >3 byte =0 1 module data
  2369. >3 byte =1 2 module data
  2370. #
  2371. 0 string OKTASONG Oktalyzer module data
  2372. #
  2373. 0 string DIGI\ Booster\ module\0 %s
  2374. >20 byte >0 %c
  2375. >>21 byte >0 \b%c
  2376. >>>22 byte >0 \b%c
  2377. >>>>23 byte >0 \b%c
  2378. >610 string >\0 \b, "%s"
  2379. #
  2380. 0 string DBM0 DIGI Booster Pro Module
  2381. >4 byte >0 V%X.
  2382. >>5 byte x \b%02X
  2383. >16 string >\0 \b, "%s"
  2384. #
  2385. 0 string FTMN FaceTheMusic module
  2386. >16 string >\0d \b, "%s"
  2387.  
  2388. # From: <doj@cubic.org> 2003-06-24
  2389. 0 string AMShdr\32 Velvet Studio AMS Module v2.2
  2390. 0 string Extreme Extreme Tracker AMS Module v1.3
  2391. 0 string DDMF Xtracker DMF Module
  2392. >4 byte x v%i
  2393. >0xD string >\0 Title: "%s"
  2394. >0x2B string >\0 Composer: "%s"
  2395. 0 string DSM\32 Dynamic Studio Module DSM
  2396. 0 string SONG DigiTrekker DTM Module
  2397. 0 string DMDL DigiTrakker MDL Module
  2398. 0 string PSM\32 Protracker Studio PSM Module
  2399. 44 string PTMF Poly Tracker PTM Module
  2400. >0 string >\32 Title: "%s"
  2401. 0 string MT20 MadTracker 2.0 Module MT2
  2402. 0 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD
  2403. 0 string RTMM RTM Module
  2404. 0x426 string MaDoKaN96 XMS Adlib Module
  2405. >0 string >\0 Composer: "%s"
  2406. 0 string AMF AMF Module
  2407. >4 string >\0 Title: "%s"
  2408. 0 string MODINFO1 Open Cubic Player Module Inforation MDZ
  2409. 0 string Extended\40Instrument: Fast Tracker II Instrument
  2410.  
  2411. # From: Takeshi Hamasaki <hma@syd.odn.ne.jp>
  2412. # NOA Nancy Codec file
  2413. 0 string \210NOA\015\012\032 NOA Nancy Codec Movie file
  2414. # Yamaha SMAF format
  2415. 0 string MMMD Yamaha SMAF file
  2416. # Sharp Jisaku Melody format for PDC
  2417. 0 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody
  2418. >20 string Ver01.00 Ver. 1.00
  2419. >>32 byte x , %d tracks
  2420.  
  2421. # Free lossless audio codec <http://flac.sourceforge.net>
  2422. # From: Przemyslaw Augustyniak <silvathraec@rpg.pl>
  2423. 0 string fLaC FLAC audio bitstream data
  2424. >4 byte&0x7f >0 \b, unknown version
  2425. >4 byte&0x7f 0 \b
  2426. # some common bits/sample values
  2427. >>20 beshort&0x1f0 0x030 \b, 4 bit
  2428. >>20 beshort&0x1f0 0x050 \b, 6 bit
  2429. >>20 beshort&0x1f0 0x070 \b, 8 bit
  2430. >>20 beshort&0x1f0 0x0b0 \b, 12 bit
  2431. >>20 beshort&0x1f0 0x0f0 \b, 16 bit
  2432. >>20 beshort&0x1f0 0x170 \b, 24 bit
  2433. >>20 byte&0xe 0x0 \b, mono
  2434. >>20 byte&0xe 0x2 \b, stereo
  2435. >>20 byte&0xe 0x4 \b, 3 channels
  2436. >>20 byte&0xe 0x6 \b, 4 channels
  2437. >>20 byte&0xe 0x8 \b, 5 channels
  2438. >>20 byte&0xe 0xa \b, 6 channels
  2439. >>20 byte&0xe 0xc \b, 7 channels
  2440. >>20 byte&0xe 0xe \b, 8 channels
  2441. # some common sample rates
  2442. >>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz
  2443. >>17 belong&0xfffff0 0x0bb800 \b, 48 kHz
  2444. >>17 belong&0xfffff0 0x07d000 \b, 32 kHz
  2445. >>17 belong&0xfffff0 0x056220 \b, 22.05 kHz
  2446. >>17 belong&0xfffff0 0x05dc00 \b, 24 kHz
  2447. >>17 belong&0xfffff0 0x03e800 \b, 16 kHz
  2448. >>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz
  2449. >>17 belong&0xfffff0 0x02ee00 \b, 12 kHz
  2450. >>17 belong&0xfffff0 0x01f400 \b, 8 kHz
  2451. >>17 belong&0xfffff0 0x177000 \b, 96 kHz
  2452. >>17 belong&0xfffff0 0x0fa000 \b, 64 kHz
  2453. >>21 byte&0xf >0 \b, >4G samples
  2454. >>21 byte&0xf 0 \b
  2455. >>>22 belong >0 \b, %u samples
  2456. >>>22 belong 0 \b, length unknown
  2457.  
  2458. # (ISDN) VBOX voice message file (Wolfram Kleff)
  2459. 0 string VBOX VBOX voice message data
  2460.  
  2461. # ReBorn Song Files (.rbs)
  2462. # David J. Singer <doc@deadvirgins.org.uk>
  2463. 8 string RB40 RBS Song file
  2464. >29 string ReBorn created by ReBorn
  2465. >37 string Propellerhead created by ReBirth
  2466.  
  2467. # Synthesizer Generator and Kimwitu share their file format
  2468. 0 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data
  2469. # Kimwitu++ uses a slightly different magic
  2470. 0 string A#S#C#S#S#L#HUB Kimwitu++ data
  2471.  
  2472. # From "Simon Hosie
  2473. 0 string TFMX-SONG TFMX module sound data
  2474.  
  2475. # Monkey's Audio compressed audio format (.ape)
  2476. # From danny.milo@gmx.net (Danny Milosavljevic)
  2477. # New version from Abel Cheung <abel (@) oaka.org>
  2478. 0 string MAC\040 Monkey's Audio compressed format
  2479. >4 uleshort >0x0F8B version %d
  2480. >>(0x08.l) uleshort =1000 with fast compression
  2481. >>(0x08.l) uleshort =2000 with normal compression
  2482. >>(0x08.l) uleshort =3000 with high compression
  2483. >>(0x08.l) uleshort =4000 with extra high compression
  2484. >>(0x08.l) uleshort =5000 with insane compression
  2485. >>(0x08.l+18) uleshort =1 \b, mono
  2486. >>(0x08.l+18) uleshort =2 \b, stereo
  2487. >>(0x08.l+20) ulelong x \b, sample rate %d
  2488. >4 uleshort <0x0F8C version %d
  2489. >>6 uleshort =1000 with fast compression
  2490. >>6 uleshort =2000 with normal compression
  2491. >>6 uleshort =3000 with high compression
  2492. >>6 uleshort =4000 with extra high compression
  2493. >>6 uleshort =5000 with insane compression
  2494. >>10 uleshort =1 \b, mono
  2495. >>10 uleshort =2 \b, stereo
  2496. >>12 ulelong x \b, sample rate %d
  2497.  
  2498. # adlib sound files
  2499. # From Gürkan Sengün <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu
  2500. 0 string RAWADATA RdosPlay RAW
  2501.  
  2502. 1068 string RoR AMUSIC Adlib Tracker
  2503.  
  2504. 0 string JCH EdLib
  2505.  
  2506. 0 string mpu401tr MPU-401 Trakker
  2507.  
  2508. 0 string SAdT Surprise! Adlib Tracker
  2509. >4 byte x Version %d
  2510.  
  2511. 0 string XAD! eXotic ADlib
  2512.  
  2513. 0 string ofTAZ! eXtra Simple Music
  2514.  
  2515. # Spectrum 128 tunes (.ay files).
  2516. # From: Emanuel Haupt <ehaupt@critical.ch>
  2517. 0 string ZXAYEMUL Spectrum 128 tune
  2518.  
  2519. 0 string \0BONK BONK,
  2520. #>5 byte x version %d
  2521. >14 byte x %d channel(s),
  2522. >15 byte =1 lossless,
  2523. >15 byte =0 lossy,
  2524. >16 byte x mid-side
  2525.  
  2526. 384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones)
  2527.  
  2528. # format VQF (proprietary codec for sound)
  2529. # some infos on the header file available at :
  2530. # http://www.twinvq.org/english/technology_format.html
  2531. 0 string TWIN97012000 VQF data
  2532. >27 short 0 \b, Mono
  2533. >27 short 1 \b, Stereo
  2534. >31 short >0 \b, %d kbit/s
  2535. >35 short >0 \b, %d kHz
  2536.  
  2537. # Nelson A. de Oliveira (naoliv@gmail.com)
  2538. # .eqf
  2539. 0 string Winamp\ EQ\ library\ file %s
  2540. # it will match only versions like v<digit>.<digit>
  2541. # Since I saw only eqf files with version v1.1 I think that it's OK
  2542. >23 string x \b%.4s
  2543. # .preset
  2544. 0 string [Equalizer\ preset] XMMS equalizer preset
  2545. # .m3u
  2546. 0 string #EXTM3U M3U playlist
  2547. # .pls
  2548. 0 string [playlist] PLS playlist
  2549. # licq.conf
  2550. 1 string [licq] LICQ configuration file
  2551.  
  2552. # Atari ST audio files by Dirk Jagdmann <doj@cubic.org>
  2553. 0 string ICE! SNDH Atari ST music
  2554. 0 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music
  2555.  
  2556. # musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com>
  2557. 0 string MP+ Musepack audio
  2558. >3 byte 255 \b, SV pre8
  2559. >3 byte&0xF 0x6 \b, SV 6
  2560. >3 byte&0xF 0x8 \b, SV 8
  2561. >3 byte&0xF 0x7 \b, SV 7
  2562. >>3 byte&0xF0 0x0 \b.0
  2563. >>3 byte&0xF0 0x10 \b.1
  2564. >>3 byte&0xF0 240 \b.15
  2565. >>10 byte&0xF0 0x0 \b, no profile
  2566. >>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental'
  2567. >>10 byte&0xF0 0x50 \b, quality 0
  2568. >>10 byte&0xF0 0x60 \b, quality 1
  2569. >>10 byte&0xF0 0x70 \b, quality 2 (Telephone)
  2570. >>10 byte&0xF0 0x80 \b, quality 3 (Thumb)
  2571. >>10 byte&0xF0 0x90 \b, quality 4 (Radio)
  2572. >>10 byte&0xF0 0xA0 \b, quality 5 (Standard)
  2573. >>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme)
  2574. >>10 byte&0xF0 0xC0 \b, quality 7 (Insane)
  2575. >>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead)
  2576. >>10 byte&0xF0 0xE0 \b, quality 9
  2577. >>10 byte&0xF0 0xF0 \b, quality 10
  2578. >>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05
  2579. >>27 byte 102 \b, Beta 1.02
  2580. >>27 byte 104 \b, Beta 1.04
  2581. >>27 byte 105 \b, Alpha 1.05
  2582. >>27 byte 106 \b, Beta 1.06
  2583. >>27 byte 110 \b, Release 1.1
  2584. >>27 byte 111 \b, Alpha 1.11
  2585. >>27 byte 112 \b, Beta 1.12
  2586. >>27 byte 113 \b, Alpha 1.13
  2587. >>27 byte 114 \b, Beta 1.14
  2588. >>27 byte 115 \b, Alpha 1.15
  2589.  
  2590. # IMY
  2591. # from http://filext.com/detaillist.php?extdetail=IMY
  2592. # http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm
  2593. # http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html
  2594. # http://www.wx800.com/msg/download/irda/iMelody.pdf
  2595. 0 string BEGIN:IMELODY iMelody Ringtone Format
  2596.  
  2597. # From: Matthew Flaschen <matthew.flaschen@gatech.edu>
  2598. 0 string #EXTM3U M3U playlist text
  2599.  
  2600. # From: "Mateus Caruccio" <mateus@caruccio.com>
  2601. # guitar pro v3,4,5 from http://filext.com/file-extension/gp3
  2602. 0 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature
  2603.  
  2604. # From: "Leslie P. Polzer" <leslie.polzer@gmx.net>
  2605. 60 string SONG SoundFX Module sound file
  2606.  
  2607. #----------------------------------------------------------------
  2608. # basis: file(1) magic for BBx/Pro5-files
  2609. # Oliver Dammer <dammer@olida.de> 2005/11/07
  2610. # http://www.basis.com business-basic-files.
  2611. #
  2612. 0 string \074\074bbx\076\076 BBx
  2613. >7 string \000 indexed file
  2614. >7 string \001 serial file
  2615. >7 string \002 keyed file
  2616. >>13 short 0 (sort)
  2617. >7 string \004 program
  2618. >>18 byte x (LEVEL %d)
  2619. >>>23 string >\000 psaved
  2620. >7 string \006 mkeyed file
  2621. >>13 short 0 (sort)
  2622. >>8 string \000 (mkey)
  2623. #------------------------------------------------------------------------------
  2624. # bFLT: file(1) magic for BFLT uclinux binary files
  2625. #
  2626. # From Philippe De Muyter <phdm@macqel.be>
  2627. #
  2628. 0 string bFLT BFLT executable
  2629. >4 belong x - version %ld
  2630. >4 belong 4
  2631. >>36 belong&0x1 0x1 ram
  2632. >>36 belong&0x2 0x2 gotpic
  2633. >>36 belong&0x4 0x4 gzip
  2634. >>36 belong&0x8 0x8 gzdata
  2635. #------------------------------------------------------------------------------
  2636. # blender: file(1) magic for Blender 3D related files
  2637. #
  2638. # Native format rule v1.2. For questions use the developers list
  2639. # http://lists.blender.org/mailman/listinfo/bf-committers
  2640. # GLOB chunk was moved near start and provides subversion info since 2.42
  2641.  
  2642. 0 string =BLENDER Blender3D,
  2643. >7 string =_ saved as 32-bits
  2644. >>8 string =v little endian
  2645. >>>9 byte x with version %c.
  2646. >>>10 byte x \b%c
  2647. >>>11 byte x \b%c
  2648. >>>0x40 string =GLOB \b.
  2649. >>>>0x58 leshort x \b%.4d
  2650. >>8 string =V big endian
  2651. >>>9 byte x with version %c.
  2652. >>>10 byte x \b%c
  2653. >>>11 byte x \b%c
  2654. >>>0x40 string =GLOB \b.
  2655. >>>>0x58 beshort x \b%.4d
  2656. >7 string =- saved as 64-bits
  2657. >>8 string =v little endian
  2658. >>9 byte x with version %c.
  2659. >>10 byte x \b%c
  2660. >>11 byte x \b%c
  2661. >>0x44 string =GLOB \b.
  2662. >>>0x60 leshort x \b%.4d
  2663. >>8 string =V big endian
  2664. >>>9 byte x with version %c.
  2665. >>>10 byte x \b%c
  2666. >>>11 byte x \b%c
  2667. >>>0x44 string =GLOB \b.
  2668. >>>>0x60 beshort x \b%.4d
  2669.  
  2670. # Scripts that run in the embeded Python interpreter
  2671. 0 string #!BPY Blender3D BPython script
  2672.  
  2673. #------------------------------------------------------------------------------
  2674. # blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine
  2675. #
  2676. # Note that this 0407 conflicts with several other a.out formats...
  2677. #
  2678. # XXX - should this be redone with "be" and "le", so that it works on
  2679. # little-endian machines as well? If so, what's the deal with
  2680. # "VAX-order" and "VAX-order2"?
  2681. #
  2682. #0 long 0407 68K Blit (standalone) executable
  2683. #0 short 0407 VAX-order2 68K Blit (standalone) executable
  2684. 0 short 03401 VAX-order 68K Blit (standalone) executable
  2685. 0 long 0406 68k Blit mpx/mux executable
  2686. 0 short 0406 VAX-order2 68k Blit mpx/mux executable
  2687. 0 short 03001 VAX-order 68k Blit mpx/mux executable
  2688. # Need more values for WE32 DMD executables.
  2689. # Note that 0520 is the same as COFF
  2690. #0 short 0520 tty630 layers executable
  2691. #
  2692. # i80960 b.out objects and archives
  2693. #
  2694. 0 long 0x10d i960 b.out relocatable object
  2695. >16 long >0 not stripped
  2696. #
  2697. # b.out archive (hp-rt on i960)
  2698. 0 string =!<bout> b.out archive
  2699. >8 string __.SYMDEF random library
  2700. #------------------------------------------------------------------------------
  2701. # bsdi: file(1) magic for BSD/OS (from BSDI) objects
  2702. #
  2703.  
  2704. 0 lelong 0314 386 compact demand paged pure executable
  2705. >16 lelong >0 not stripped
  2706. >32 byte 0x6a (uses shared libs)
  2707.  
  2708. 0 lelong 0407 386 executable
  2709. >16 lelong >0 not stripped
  2710. >32 byte 0x6a (uses shared libs)
  2711.  
  2712. 0 lelong 0410 386 pure executable
  2713. >16 lelong >0 not stripped
  2714. >32 byte 0x6a (uses shared libs)
  2715.  
  2716. 0 lelong 0413 386 demand paged pure executable
  2717. >16 lelong >0 not stripped
  2718. >32 byte 0x6a (uses shared libs)
  2719.  
  2720. # same as in SunOS 4.x, except for static shared libraries
  2721. 0 belong&077777777 0600413 sparc demand paged
  2722. >0 byte &0x80
  2723. >>20 belong <4096 shared library
  2724. >>20 belong =4096 dynamically linked executable
  2725. >>20 belong >4096 dynamically linked executable
  2726. >0 byte ^0x80 executable
  2727. >16 belong >0 not stripped
  2728. >36 belong 0xb4100001 (uses shared libs)
  2729.  
  2730. 0 belong&077777777 0600410 sparc pure
  2731. >0 byte &0x80 dynamically linked executable
  2732. >0 byte ^0x80 executable
  2733. >16 belong >0 not stripped
  2734. >36 belong 0xb4100001 (uses shared libs)
  2735.  
  2736. 0 belong&077777777 0600407 sparc
  2737. >0 byte &0x80 dynamically linked executable
  2738. >0 byte ^0x80 executable
  2739. >16 belong >0 not stripped
  2740. >36 belong 0xb4100001 (uses shared libs)
  2741. #------------------------------------------------------------------------------
  2742. # BTSnoop: file(1) magic for BTSnoop files
  2743. #
  2744. # From <marcel@holtmann.org>
  2745. 0 string btsnoop\0 BTSnoop
  2746. >8 belong x version %d,
  2747. >12 belong 1001 Unencapsulated HCI
  2748. >12 belong 1002 HCI UART (H4)
  2749. >12 belong 1003 HCI BCSP
  2750. >12 belong 1004 HCI Serial (H5)
  2751. >>12 belong x type %d
  2752.  
  2753. #------------------------------------------------------------------------------
  2754. # autocad: file(1) magic for cad files
  2755. #
  2756.  
  2757. # AutoCAD DWG versions R13/R14 (www.autodesk.com)
  2758. # Written December 01, 2003 by Lester Hightower
  2759. # Based on the DWG File Format Specifications at http://www.opendwg.org/
  2760. 0 string \101\103\061\060\061 AutoCAD
  2761. >5 string \062\000\000\000\000 DWG ver. R13
  2762. >5 string \064\000\000\000\000 DWG ver. R14
  2763.  
  2764. # Microstation DGN/CIT Files (www.bentley.com)
  2765. # Last updated July 29, 2005 by Lester Hightower
  2766. # DGN is the default file extension of Microstation/Intergraph CAD files.
  2767. # CIT is the proprietary raster format (similar to TIFF) used to attach
  2768. # raster underlays to Microstation DGN (vector) drawings.
  2769. #
  2770. # http://www.wotsit.org/search.asp
  2771. # http://filext.com/detaillist.php?extdetail=DGN
  2772. # http://filext.com/detaillist.php?extdetail=CIT
  2773. #
  2774. # http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
  2775. # 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
  2776. # http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
  2777. # 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
  2778. 0 string \010\011\376 Microstation
  2779. >3 string \002
  2780. >>30 string \026\105 DGNFile
  2781. >>30 string \034\105 DGNFile
  2782. >>30 string \073\107 DGNFile
  2783. >>30 string \073\110 DGNFile
  2784. >>30 string \106\107 DGNFile
  2785. >>30 string \110\103 DGNFile
  2786. >>30 string \120\104 DGNFile
  2787. >>30 string \172\104 DGNFile
  2788. >>30 string \172\105 DGNFile
  2789. >>30 string \172\106 DGNFile
  2790. >>30 string \234\106 DGNFile
  2791. >>30 string \273\105 DGNFile
  2792. >>30 string \306\106 DGNFile
  2793. >>30 string \310\104 DGNFile
  2794. >>30 string \341\104 DGNFile
  2795. >>30 string \372\103 DGNFile
  2796. >>30 string \372\104 DGNFile
  2797. >>30 string \372\106 DGNFile
  2798. >>30 string \376\103 DGNFile
  2799. >4 string \030\000\000 CITFile
  2800. >4 string \030\000\003 CITFile
  2801.  
  2802. # AutoCad, from Nahuel Greco
  2803. # AutoCAD DWG versions R12/R13/R14 (www.autodesk.com)
  2804. 0 string AC1012 AutoCad (release 12)
  2805. 0 string AC1013 AutoCad (release 13)
  2806. 0 string AC1014 AutoCad (release 14)
  2807.  
  2808. # CAD: file(1) magic for computer aided design files
  2809. # Phillip Griffith <phillip dot griffith at gmail dot com>
  2810. # AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications.
  2811. #
  2812. 0 belong 0x08051700 Bentley/Intergraph MicroStation DGN cell library
  2813. 0 belong 0x0809fe02 Bentley/Intergraph MicroStation DGN vector CAD
  2814. 0 belong 0xc809fe02 Bentley/Intergraph MicroStation DGN vector CAD
  2815. 0 beshort 0x0809 Bentley/Intergraph MicroStation
  2816. >0x02 byte 0xfe
  2817. >>0x04 beshort 0x1800 CIT raster CAD
  2818. 0 string AC1012 AutoDesk AutoCAD R13
  2819. 0 string AC1014 AutoDesk AutoCAD R14
  2820. 0 string AC1015 AutoDesk AutoCAD R2000
  2821. #------------------------------------------------------------------------------
  2822. # Cafe Babes unite!
  2823. #
  2824. # Since Java bytecode and Mach-O fat-files have the same magic number, the test
  2825. # must be performed in the same "magic" sequence to get both right. The long
  2826. # at offset 4 in a mach-O fat file tells the number of architectures; the short at
  2827. # offset 4 in a Java bytecode file is the JVM minor version and the
  2828. # short at offset 6 is the JVM major version. Since there are only
  2829. # only 18 labeled Mach-O architectures at current, and the first released
  2830. # Java class format was version 43.0, we can safely choose any number
  2831. # between 18 and 39 to test the number of architectures against
  2832. # (and use as a hack). Let's not use 18, because the Mach-O people
  2833. # might add another one or two as time goes by...
  2834. #
  2835. 0 belong 0xcafebabe
  2836. >4 belong >30 compiled Java class data,
  2837. >>6 beshort x version %d.
  2838. >>4 beshort x \b%d
  2839. >4 belong 1 Mach-O fat file with 1 architecture
  2840. >4 belong >1
  2841. >>4 belong <20 Mach-O fat file with %ld architectures
  2842.  
  2843. #------------------------------------------------------------------------------
  2844. # c-lang: file(1) magic for C programs (or REXX)
  2845. #
  2846.  
  2847. # XPM icons (Greg Roelofs, newt@uchicago.edu)
  2848. # if you uncomment "/*" for C/REXX below, also uncomment this entry
  2849. #0 string /*\ XPM\ */ X pixmap image data
  2850.  
  2851. # this first will upset you if you're a PL/1 shop...
  2852. # in which case rm it; ascmagic will catch real C programs
  2853. #0 string /* C or REXX program text
  2854. #0 string // C++ program text
  2855.  
  2856. # From: Mikhail Teterin <mi@aldan.algebra.com>
  2857. 0 string cscope cscope reference data
  2858. >7 string x version %.2s
  2859. # We skip the path here, because it is often long (so file will
  2860. # truncate it) and mostly redundant.
  2861. # The inverted index functionality was added some time betwen
  2862. # versions 11 and 15, so look for -q if version is above 14:
  2863. >7 string >14
  2864. >>10 regex .+\ -q\ with inverted index
  2865. >10 regex .+\ -c\ text (non-compressed)
  2866.  
  2867. #------------------------------------------------------------------------------
  2868. # c64: file(1) magic for various commodore 64 related files
  2869. #
  2870. # From: Dirk Jagdmann <doj@cubic.org>
  2871.  
  2872. 0x16500 belong 0x12014100 D64 Image
  2873. 0x16500 belong 0x12014180 D71 Image
  2874. 0x61800 belong 0x28034400 D81 Image
  2875. 0 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image
  2876. 0 belong 0x43154164 X64 Image
  2877.  
  2878. 0 string GCR-1541 GCR Image
  2879. >8 byte x version: %i
  2880. >9 byte x tracks: %i
  2881.  
  2882. 9 string PSUR ARC archive (c64)
  2883. 2 string -LH1- LHA archive (c64)
  2884.  
  2885. 0 string C64File PC64 Emulator file
  2886. >8 string >\0 "%s"
  2887. 0 string C64Image PC64 Freezer Image
  2888.  
  2889. 0 beshort 0x38CD C64 PCLink Image
  2890. 0 string CBM\144\0\0 Power 64 C64 Emulator Snapshot
  2891.  
  2892. 0 belong 0xFF424CFF WRAptor packer (c64)
  2893.  
  2894. 0 string C64S\x20tape\x20file T64 tape Image
  2895. >32 leshort x Version:0x%x
  2896. >36 leshort !0 Entries:%i
  2897. >40 string x Name:%.24s
  2898.  
  2899. 0 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image
  2900. >32 leshort x Version:0x%x
  2901. >36 leshort !0 Entries:%i
  2902. >40 string x Name:%.24s
  2903.  
  2904. 0 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image
  2905. >32 leshort x Version:0x%x
  2906. >36 leshort !0 Entries:%i
  2907. >40 string x Name:%.24s
  2908.  
  2909. #------------------------------------------------------------------------------
  2910. # CDDB: file(1) magic for CDDB(tm) format CD text data files
  2911. #
  2912. # From <steve@gracenote.com>
  2913. #
  2914. # This is the /etc/magic entry to decode datafiles as used by
  2915. # CDDB-enabled CD player applications.
  2916. #
  2917.  
  2918. 0 string/b #\040xmcd CDDB(tm) format CD text data
  2919.  
  2920. #------------------------------------------------------------------------------
  2921. # chord: file(1) magic for Chord music sheet typesetting utility input files
  2922. #
  2923. # From Philippe De Muyter <phdm@macqel.be>
  2924. # File format is actually free, but many distributed files begin with `{title'
  2925. #
  2926. 0 string {title Chord text file
  2927.  
  2928. #------------------------------------------------------------------------------
  2929. # cisco: file(1) magic for cisco Systems routers
  2930. #
  2931. # Most cisco file-formats are covered by the generic elf code
  2932. #
  2933. # Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
  2934. 0 belong&0xffffff00 0x85011400 cisco IOS microcode
  2935. >7 string >\0 for '%s'
  2936. 0 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode
  2937. >7 string >\0 for '%s'
  2938. #------------------------------------------------------------------------------
  2939. # citrus locale declaration
  2940. #
  2941.  
  2942. 0 string RuneCT Citrus locale declaration for LC_CTYPE
  2943.  
  2944.  
  2945. #------------------------------------------------------------------------------
  2946. # claris: file(1) magic for claris
  2947. # "H. Nanosecond" <aldomel@ix.netcom.com>
  2948. # Claris Works a word processor, etc.
  2949. # Version 3.0
  2950.  
  2951. # .pct claris works clip art files
  2952. #0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
  2953. #*
  2954. #0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
  2955. #null to byte 1000 octal
  2956. 514 string \377\377\377\377\000 Claris clip art?
  2957. >0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes.
  2958. 514 string \377\377\377\377\001 Claris clip art?
  2959. >0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes.
  2960.  
  2961. # Claris works files
  2962. # .cwk
  2963. 0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document
  2964. # .plt
  2965. 0 string \020\341\000\000\010\010 Claris Works pallete files .plt
  2966.  
  2967. # .msp a dictionary file I am not sure about this I have only one .msp file
  2968. 0 string \002\271\262\000\040\002\000\164 Claris works dictionary
  2969.  
  2970. # .usp are user dictionary bits
  2971. # I am not sure about a magic header:
  2972. #0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
  2973. # soh S p f 8 U D sp ^ S cr nl p o d i
  2974. #0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
  2975. # a t r i s t sp ^ S cr nl d i v sp #
  2976.  
  2977. # .mth Thesaurus
  2978. # starts with \0 but no magic header
  2979.  
  2980. # .chy Hyphenation file
  2981. # I am not sure: 000 210 034 000 000
  2982.  
  2983. # other claris files
  2984. #./windows/claris/useng.ndx: data
  2985. #./windows/claris/xtndtran.l32: data
  2986. #./windows/claris/xtndtran.lst: data
  2987. #./windows/claris/clworks.lbl: data
  2988. #./windows/claris/clworks.prf: data
  2989. #./windows/claris/userd.spl: data
  2990.  
  2991. #------------------------------------------------------------------------------
  2992. # clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper.
  2993. #
  2994. # XXX - what byte order does the Clipper use?
  2995. #
  2996. # XXX - what's the "!" stuff:
  2997. #
  2998. # >18 short !074000,000000 C1 R1
  2999. # >18 short !074000,004000 C2 R1
  3000. # >18 short !074000,010000 C3 R1
  3001. # >18 short !074000,074000 TEST
  3002. #
  3003. # I shall assume it's ANDing the field with the first value and
  3004. # comparing it with the second, and rewrite it as:
  3005. #
  3006. # >18 short&074000 000000 C1 R1
  3007. # >18 short&074000 004000 C2 R1
  3008. # >18 short&074000 010000 C3 R1
  3009. # >18 short&074000 074000 TEST
  3010. #
  3011. # as SVR3.1's "file" doesn't support anything of the "!074000,000000"
  3012. # sort, nor does SunOS 4.x, so either it's something Intergraph added
  3013. # in CLIX, or something AT&T added in SVR3.2 or later, or something
  3014. # somebody else thought was a good idea; it's not documented in the
  3015. # man page for this version of "magic", nor does it appear to be
  3016. # implemented (at least not after I blew off the bogus code to turn
  3017. # old-style "&"s into new-style "&"s, which just didn't work at all).
  3018. #
  3019. 0 short 0575 CLIPPER COFF executable (VAX #)
  3020. >20 short 0407 (impure)
  3021. >20 short 0410 (5.2 compatible)
  3022. >20 short 0411 (pure)
  3023. >20 short 0413 (demand paged)
  3024. >20 short 0443 (target shared library)
  3025. >12 long >0 not stripped
  3026. >22 short >0 - version %ld
  3027. 0 short 0577 CLIPPER COFF executable
  3028. >18 short&074000 000000 C1 R1
  3029. >18 short&074000 004000 C2 R1
  3030. >18 short&074000 010000 C3 R1
  3031. >18 short&074000 074000 TEST
  3032. >20 short 0407 (impure)
  3033. >20 short 0410 (pure)
  3034. >20 short 0411 (separate I&D)
  3035. >20 short 0413 (paged)
  3036. >20 short 0443 (target shared library)
  3037. >12 long >0 not stripped
  3038. >22 short >0 - version %ld
  3039. >48 long&01 01 alignment trap enabled
  3040. >52 byte 1 -Ctnc
  3041. >52 byte 2 -Ctsw
  3042. >52 byte 3 -Ctpw
  3043. >52 byte 4 -Ctcb
  3044. >53 byte 1 -Cdnc
  3045. >53 byte 2 -Cdsw
  3046. >53 byte 3 -Cdpw
  3047. >53 byte 4 -Cdcb
  3048. >54 byte 1 -Csnc
  3049. >54 byte 2 -Cssw
  3050. >54 byte 3 -Cspw
  3051. >54 byte 4 -Cscb
  3052. 4 string pipe CLIPPER instruction trace
  3053. 4 string prof CLIPPER instruction profile
  3054.  
  3055. #------------------------------------------------------------------------------
  3056. # cracklib: file (1) magic for cracklib v2.7
  3057.  
  3058. 0 lelong 0x70775631 Cracklib password index, little endian
  3059. >4 long >0 (%i words)
  3060. >4 long 0 ("64-bit")
  3061. >>8 long >-1 (%i words)
  3062. 0 belong 0x70775631 Cracklib password index, big endian
  3063. >4 belong >-1 (%i words)
  3064. # really bellong 0x0000000070775631
  3065. 4 belong 0x70775631 Cracklib password index, big endian ("64-bit")
  3066. >12 belong >0 (%i words)
  3067.  
  3068. #------------------------------------------------------------------------------
  3069. # spec: file(1) magic for SPEC raw results (*.raw, *.rsf)
  3070. #
  3071. # Cloyce D. Spradling <cloyce@headgear.org>
  3072.  
  3073. 0 string spec SPEC
  3074. >4 string .cpu CPU
  3075. >>8 string <: \b%.4s
  3076. >>12 string . raw result text
  3077.  
  3078. 17 string version=SPECjbb SPECjbb
  3079. >32 string <: \b%.4s
  3080. >>37 string <: v%.4s raw result text
  3081.  
  3082. 0 string BEGIN\040SPECWEB SPECweb
  3083. >13 string <: \b%.2s
  3084. >>15 string _SSL \b_SSL
  3085. >>>20 string <: v%.4s raw result text
  3086. >>16 string <: v%.4s raw result text
  3087.  
  3088. #------------------------------------------------------------------------------
  3089. # commands: file(1) magic for various shells and interpreters
  3090. #
  3091. 0 string : shell archive or script for antique kernel text
  3092. 0 string/b #!\ /bin/sh Bourne shell script text executable
  3093. 0 string/b #!\ /bin/csh C shell script text executable
  3094. # korn shell magic, sent by George Wu, gwu@clyde.att.com
  3095. 0 string/b #!\ /bin/ksh Korn shell script text executable
  3096. 0 string/b #!\ /bin/tcsh Tenex C shell script text executable
  3097. 0 string/b #!\ /usr/local/tcsh Tenex C shell script text executable
  3098. 0 string/b #!\ /usr/local/bin/tcsh Tenex C shell script text executable
  3099.  
  3100. #
  3101. # zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
  3102. 0 string/b #!\ /bin/zsh Paul Falstad's zsh script text executable
  3103. 0 string/b #!\ /usr/bin/zsh Paul Falstad's zsh script text executable
  3104. 0 string/b #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable
  3105. 0 string/b #!\ /usr/local/bin/ash Neil Brown's ash script text executable
  3106. 0 string/b #!\ /usr/local/bin/ae Neil Brown's ae script text executable
  3107. 0 string/b #!\ /bin/nawk new awk script text executable
  3108. 0 string/b #!\ /usr/bin/nawk new awk script text executable
  3109. 0 string/b #!\ /usr/local/bin/nawk new awk script text executable
  3110. 0 string/b #!\ /bin/gawk GNU awk script text executable
  3111. 0 string/b #!\ /usr/bin/gawk GNU awk script text executable
  3112. 0 string/b #!\ /usr/local/bin/gawk GNU awk script text executable
  3113. #
  3114. 0 string/b #!\ /bin/awk awk script text executable
  3115. 0 string/b #!\ /usr/bin/awk awk script text executable
  3116. # update to distinguish from *.vcf files
  3117. # this is broken because postscript has /EBEGIN{ for example.
  3118. #0 regex BEGIN[[:space:]]*[{] awk script text
  3119.  
  3120. # AT&T Bell Labs' Plan 9 shell
  3121. 0 string/b #!\ /bin/rc Plan 9 rc shell script text executable
  3122.  
  3123. # bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
  3124. 0 string/b #!\ /bin/bash Bourne-Again shell script text executable
  3125. 0 string/b #!\ /usr/local/bin/bash Bourne-Again shell script text executable
  3126.  
  3127. # using env
  3128. 0 string #!/usr/bin/env a
  3129. >15 string >\0 %s script text executable
  3130. 0 string #!\ /usr/bin/env a
  3131. >16 string >\0 %s script text executable
  3132.  
  3133. # PHP scripts
  3134. # Ulf Harnhammar <ulfh@update.uu.se>
  3135. 0 string/c =<?php PHP script text
  3136. 0 string =<?\n PHP script text
  3137. 0 string =<?\r PHP script text
  3138. 0 string/b #!\ /usr/local/bin/php PHP script text executable
  3139. 0 string/b #!\ /usr/bin/php PHP script text executable
  3140.  
  3141. 0 string Zend\x00 PHP script Zend Optimizer data
  3142.  
  3143. 0 string $! DCL command file
  3144.  
  3145. #----------------------------------------------------------------------------
  3146. # communication
  3147.  
  3148. # TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3.
  3149. # It is used for conformance testing of communication protocols.
  3150. # Added by W. Borgert <debacle@debian.org>.
  3151. 0 string $Suite TTCN Abstract Test Suite
  3152. >&1 string $SuiteId
  3153. >>&1 string >\n %s
  3154. >&2 string $SuiteId
  3155. >>&1 string >\n %s
  3156. >&3 string $SuiteId
  3157. >>&1 string >\n %s
  3158.  
  3159. # MSC (message sequence charts) are a formal description technique,
  3160. # described in ITU-T Z.120, mainly used for communication protocols.
  3161. # Added by W. Borgert <debacle@debian.org>.
  3162. 0 string mscdocument Message Sequence Chart (document)
  3163. 0 string msc Message Sequence Chart (chart)
  3164. 0 string submsc Message Sequence Chart (subchart)
  3165.  
  3166. #------------------------------------------------------------------------------
  3167. # compress: file(1) magic for pure-compression formats (no archives)
  3168. #
  3169. # compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
  3170. #
  3171. # Formats for various forms of compressed data
  3172. # Formats for "compress" proper have been moved into "compress.c",
  3173. # because it tries to uncompress it to figure out what's inside.
  3174.  
  3175. # standard unix compress
  3176. 0 string \037\235 compress'd data
  3177. >2 byte&0x80 >0 block compressed
  3178. >2 byte&0x1f x %d bits
  3179.  
  3180. # gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
  3181. # Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
  3182. # * Original filename is only at offset 10 if "extra field" absent
  3183. # * Produce shorter output - notably, only report compression methods
  3184. # other than 8 ("deflate", the only method defined in RFC 1952).
  3185. 0 string \037\213 gzip compressed data
  3186. >2 byte <8 \b, reserved method
  3187. >2 byte >8 \b, unknown method
  3188. >3 byte &0x01 \b, ASCII
  3189. >3 byte &0x02 \b, has CRC
  3190. >3 byte &0x04 \b, extra field
  3191. >3 byte&0xC =0x08
  3192. >>10 string x \b, was "%s"
  3193. >3 byte &0x10 \b, has comment
  3194. >9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT)
  3195. >9 byte =0x01 \b, from Amiga
  3196. >9 byte =0x02 \b, from VMS
  3197. >9 byte =0x03 \b, from Unix
  3198. >9 byte =0x04 \b, from VM/CMS
  3199. >9 byte =0x05 \b, from Atari
  3200. >9 byte =0x06 \b, from HPFS filesystem (OS/2, NT)
  3201. >9 byte =0x07 \b, from MacOS
  3202. >9 byte =0x08 \b, from Z-System
  3203. >9 byte =0x09 \b, from CP/M
  3204. >9 byte =0x0A \b, from TOPS/20
  3205. >9 byte =0x0B \b, from NTFS filesystem (NT)
  3206. >9 byte =0x0C \b, from QDOS
  3207. >9 byte =0x0D \b, from Acorn RISCOS
  3208. >3 byte &0x10 \b, comment
  3209. >3 byte &0x20 \b, encrypted
  3210. >4 ledate >0 \b, last modified: %s
  3211. >8 byte 2 \b, max compression
  3212. >8 byte 4 \b, max speed
  3213.  
  3214. # packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
  3215. 0 string \037\036 packed data
  3216. >2 belong >1 \b, %d characters originally
  3217. >2 belong =1 \b, %d character originally
  3218. #
  3219. # This magic number is byte-order-independent.
  3220. 0 short 0x1f1f old packed data
  3221.  
  3222. # XXX - why *two* entries for "compacted data", one of which is
  3223. # byte-order independent, and one of which is byte-order dependent?
  3224. #
  3225. 0 short 0x1fff compacted data
  3226. # This string is valid for SunOS (BE) and a matching "short" is listed
  3227. # in the Ultrix (LE) magic file.
  3228. 0 string \377\037 compacted data
  3229. 0 short 0145405 huf output
  3230.  
  3231. # bzip2
  3232. 0 string BZh bzip2 compressed data
  3233. >3 byte >47 \b, block size = %c00k
  3234.  
  3235. # squeeze and crunch
  3236. # Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
  3237. 0 beshort 0x76FF squeezed data,
  3238. >4 string x original name %s
  3239. 0 beshort 0x76FE crunched data,
  3240. >2 string x original name %s
  3241. 0 beshort 0x76FD LZH compressed data,
  3242. >2 string x original name %s
  3243.  
  3244. # Freeze
  3245. 0 string \037\237 frozen file 2.1
  3246. 0 string \037\236 frozen file 1.0 (or gzip 0.5)
  3247.  
  3248. # SCO compress -H (LZH)
  3249. 0 string \037\240 SCO compress -H (LZH) data
  3250.  
  3251. # European GSM 06.10 is a provisional standard for full-rate speech
  3252. # transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
  3253. # excitation/long term prediction) coding at 13 kbit/s.
  3254. #
  3255. # There's only a magic nibble (4 bits); that nibble repeats every 33
  3256. # bytes. This isn't suited for use, but maybe we can use it someday.
  3257. #
  3258. # This will cause very short GSM files to be declared as data and
  3259. # mismatches to be declared as data too!
  3260. #0 byte&0xF0 0xd0 data
  3261. #>33 byte&0xF0 0xd0
  3262. #>66 byte&0xF0 0xd0
  3263. #>99 byte&0xF0 0xd0
  3264. #>132 byte&0xF0 0xd0 GSM 06.10 compressed audio
  3265.  
  3266. # bzip a block-sorting file compressor
  3267. # by Julian Seward <sewardj@cs.man.ac.uk> and others
  3268. #
  3269. 0 string BZ bzip compressed data
  3270. >2 byte x \b, version: %c
  3271. >3 string =1 \b, compression block size 100k
  3272. >3 string =2 \b, compression block size 200k
  3273. >3 string =3 \b, compression block size 300k
  3274. >3 string =4 \b, compression block size 400k
  3275. >3 string =5 \b, compression block size 500k
  3276. >3 string =6 \b, compression block size 600k
  3277. >3 string =7 \b, compression block size 700k
  3278. >3 string =8 \b, compression block size 800k
  3279. >3 string =9 \b, compression block size 900k
  3280.  
  3281. # lzop from <markus.oberhumer@jk.uni-linz.ac.at>
  3282. 0 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data
  3283. >9 beshort <0x0940
  3284. >>9 byte&0xf0 =0x00 - version 0.
  3285. >>9 beshort&0x0fff x \b%03x,
  3286. >>13 byte 1 LZO1X-1,
  3287. >>13 byte 2 LZO1X-1(15),
  3288. >>13 byte 3 LZO1X-999,
  3289. ## >>22 bedate >0 last modified: %s,
  3290. >>14 byte =0x00 os: MS-DOS
  3291. >>14 byte =0x01 os: Amiga
  3292. >>14 byte =0x02 os: VMS
  3293. >>14 byte =0x03 os: Unix
  3294. >>14 byte =0x05 os: Atari
  3295. >>14 byte =0x06 os: OS/2
  3296. >>14 byte =0x07 os: MacOS
  3297. >>14 byte =0x0A os: Tops/20
  3298. >>14 byte =0x0B os: WinNT
  3299. >>14 byte =0x0E os: Win32
  3300. >9 beshort >0x0939
  3301. >>9 byte&0xf0 =0x00 - version 0.
  3302. >>9 byte&0xf0 =0x10 - version 1.
  3303. >>9 byte&0xf0 =0x20 - version 2.
  3304. >>9 beshort&0x0fff x \b%03x,
  3305. >>15 byte 1 LZO1X-1,
  3306. >>15 byte 2 LZO1X-1(15),
  3307. >>15 byte 3 LZO1X-999,
  3308. ## >>25 bedate >0 last modified: %s,
  3309. >>17 byte =0x00 os: MS-DOS
  3310. >>17 byte =0x01 os: Amiga
  3311. >>17 byte =0x02 os: VMS
  3312. >>17 byte =0x03 os: Unix
  3313. >>17 byte =0x05 os: Atari
  3314. >>17 byte =0x06 os: OS/2
  3315. >>17 byte =0x07 os: MacOS
  3316. >>17 byte =0x0A os: Tops/20
  3317. >>17 byte =0x0B os: WinNT
  3318. >>17 byte =0x0E os: Win32
  3319.  
  3320. # 4.3BSD-Quasijarus Strong Compression
  3321. # http://minnie.tuhs.org/Quasijarus/compress.html
  3322. 0 string \037\241 Quasijarus strong compressed data
  3323.  
  3324. # From: Cory Dikkers <cdikkers@swbell.net>
  3325. 0 string XPKF Amiga xpkf.library compressed data
  3326. 0 string PP11 Power Packer 1.1 compressed data
  3327. 0 string PP20 Power Packer 2.0 compressed data,
  3328. >4 belong 0x09090909 fast compression
  3329. >4 belong 0x090A0A0A mediocre compression
  3330. >4 belong 0x090A0B0B good compression
  3331. >4 belong 0x090A0C0C very good compression
  3332. >4 belong 0x090A0C0D best compression
  3333.  
  3334. # 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
  3335. # http://www.7-zip.org or DOC/7zFormat.txt
  3336. #
  3337. 0 string 7z\274\257\047\034 7-zip archive data,
  3338. >6 byte x version %d
  3339. >7 byte x \b.%d
  3340.  
  3341. # AFX compressed files (Wolfram Kleff)
  3342. 2 string -afx- AFX compressed file data
  3343.  
  3344. # Supplementary magic data for the file(1) command to support
  3345. # rzip(1). The format is described in magic(5).
  3346. #
  3347. # Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with
  3348. # this file.
  3349. #
  3350. 0 string RZIP rzip compressed data
  3351. >4 byte x - version %d
  3352. >5 byte x \b.%d
  3353. >6 belong x (%d bytes)
  3354. #------------------------------------------------------------------------------
  3355. # Console game magic
  3356. # Toby Deshane <hac@shoelace.digivill.net>
  3357. # ines: file(1) magic for Marat's iNES Nintendo Entertainment System
  3358. # ROM dump format
  3359.  
  3360. 0 string NES\032 iNES ROM dump,
  3361. >4 byte x %dx16k PRG
  3362. >5 byte x \b, %dx8k CHR
  3363. >6 byte&0x01 =0x1 \b, [Vert.]
  3364. >6 byte&0x01 =0x0 \b, [Horiz.]
  3365. >6 byte&0x02 =0x2 \b, [SRAM]
  3366. >6 byte&0x04 =0x4 \b, [Trainer]
  3367. >6 byte&0x04 =0x8 \b, [4-Scr]
  3368.  
  3369. #------------------------------------------------------------------------------
  3370. # gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
  3371. #
  3372. 0x104 belong 0xCEED6666 Gameboy ROM:
  3373. >0x134 string >\0 "%.16s"
  3374. >0x146 byte 0x03 \b,[SGB]
  3375. >0x147 byte 0x00 \b, [ROM ONLY]
  3376. >0x147 byte 0x01 \b, [ROM+MBC1]
  3377. >0x147 byte 0x02 \b, [ROM+MBC1+RAM]
  3378. >0x147 byte 0x03 \b, [ROM+MBC1+RAM+BATT]
  3379. >0x147 byte 0x05 \b, [ROM+MBC2]
  3380. >0x147 byte 0x06 \b, [ROM+MBC2+BATTERY]
  3381. >0x147 byte 0x08 \b, [ROM+RAM]
  3382. >0x147 byte 0x09 \b, [ROM+RAM+BATTERY]
  3383. >0x147 byte 0x0B \b, [ROM+MMM01]
  3384. >0x147 byte 0x0C \b, [ROM+MMM01+SRAM]
  3385. >0x147 byte 0x0D \b, [ROM+MMM01+SRAM+BATT]
  3386. >0x147 byte 0x0F \b, [ROM+MBC3+TIMER+BATT]
  3387. >0x147 byte 0x10 \b, [ROM+MBC3+TIMER+RAM+BATT]
  3388. >0x147 byte 0x11 \b, [ROM+MBC3]
  3389. >0x147 byte 0x12 \b, [ROM+MBC3+RAM]
  3390. >0x147 byte 0x13 \b, [ROM+MBC3+RAM+BATT]
  3391. >0x147 byte 0x19 \b, [ROM+MBC5]
  3392. >0x147 byte 0x1A \b, [ROM+MBC5+RAM]
  3393. >0x147 byte 0x1B \b, [ROM+MBC5+RAM+BATT]
  3394. >0x147 byte 0x1C \b, [ROM+MBC5+RUMBLE]
  3395. >0x147 byte 0x1D \b, [ROM+MBC5+RUMBLE+SRAM]
  3396. >0x147 byte 0x1E \b, [ROM+MBC5+RUMBLE+SRAM+BATT]
  3397. >0x147 byte 0x1F \b, [Pocket Camera]
  3398. >0x147 byte 0xFD \b, [Bandai TAMA5]
  3399. >0x147 byte 0xFE \b, [Hudson HuC-3]
  3400. >0x147 byte 0xFF \b, [Hudson HuC-1]
  3401.  
  3402. >0x148 byte 0 \b, ROM: 256Kbit
  3403. >0x148 byte 1 \b, ROM: 512Kbit
  3404. >0x148 byte 2 \b, ROM: 1Mbit
  3405. >0x148 byte 3 \b, ROM: 2Mbit
  3406. >0x148 byte 4 \b, ROM: 4Mbit
  3407. >0x148 byte 5 \b, ROM: 8Mbit
  3408. >0x148 byte 6 \b, ROM: 16Mbit
  3409. >0x148 byte 0x52 \b, ROM: 9Mbit
  3410. >0x148 byte 0x53 \b, ROM: 10Mbit
  3411. >0x148 byte 0x54 \b, ROM: 12Mbit
  3412.  
  3413. >0x149 byte 1 \b, RAM: 16Kbit
  3414. >0x149 byte 2 \b, RAM: 64Kbit
  3415. >0x149 byte 3 \b, RAM: 128Kbit
  3416. >0x149 byte 4 \b, RAM: 1Mbit
  3417.  
  3418. #>0x14e long x \b, CRC: %x
  3419.  
  3420. #------------------------------------------------------------------------------
  3421. # genesis: file(1) magic for the Sega MegaDrive/Genesis raw ROM format
  3422. #
  3423. 0x100 string SEGA Sega MegaDrive/Genesis raw ROM dump
  3424. >0x120 string >\0 Name: "%.16s"
  3425. >0x110 string >\0 %.16s
  3426. >0x1B0 string RA with SRAM
  3427.  
  3428. #------------------------------------------------------------------------------
  3429. # genesis: file(1) magic for the Super MegaDrive ROM dump format
  3430. #
  3431. 0x280 string EAGN Super MagicDrive ROM dump
  3432. >0 byte x %dx16k blocks
  3433. >2 byte 0 \b, last in series or standalone
  3434. >2 byte >0 \b, split ROM
  3435. >8 byte 0xAA
  3436. >9 byte 0xBB
  3437.  
  3438. #------------------------------------------------------------------------------
  3439. # genesis: file(1) alternate magic for the Super MegaDrive ROM dump format
  3440. #
  3441. 0x280 string EAMG Super MagicDrive ROM dump
  3442. >0 byte x %dx16k blocks
  3443. >2 byte x \b, last in series or standalone
  3444. >8 byte 0xAA
  3445. >9 byte 0xBB
  3446.  
  3447. #------------------------------------------------------------------------------
  3448. # smsgg: file(1) magic for Sega Master System and Game Gear ROM dumps
  3449. #
  3450. # Does not detect all images. Very preliminary guesswork. Need more data
  3451. # on format.
  3452. #
  3453. # FIXME: need a little more info...;P
  3454. #
  3455. #0 byte 0xF3
  3456. #>1 byte 0xED Sega Master System/Game Gear ROM dump
  3457. #>1 byte 0x31 Sega Master System/Game Gear ROM dump
  3458. #>1 byte 0xDB Sega Master System/Game Gear ROM dump
  3459. #>1 byte 0xAF Sega Master System/Game Gear ROM dump
  3460. #>1 byte 0xC3 Sega Master System/Game Gear ROM dump
  3461.  
  3462. #------------------------------------------------------------------------------
  3463. # dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format
  3464. #
  3465. 0 belong 0x21068028 Sega Dreamcast VMU game image
  3466. 0 string LCDi Dream Animator file
  3467.  
  3468. #------------------------------------------------------------------------------
  3469. # v64: file(1) uncertain magic for the V64 format N64 ROM dumps
  3470. #
  3471. 0 belong 0x37804012 V64 Nintendo 64 ROM dump
  3472.  
  3473. #------------------------------------------------------------------------------
  3474. # msx: file(1) magic for MSX game cartridge dumps
  3475. # Too simple - MPi
  3476. #0 beshort 0x4142 MSX game cartridge dump
  3477.  
  3478. #------------------------------------------------------------------------------
  3479. # Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
  3480. 0 string PS-X\ EXE Sony Playstation executable
  3481. # Area:
  3482. >113 string x (%s)
  3483.  
  3484. #------------------------------------------------------------------------------
  3485. # Microsoft Xbox executables .xbe (Esa Hyytiä <ehyytia@cc.hut.fi>)
  3486. 0 string XBEH XBE, Microsoft Xbox executable
  3487. # probabilistic checks whether signed or not
  3488. >0x0004 ulelong =0x0
  3489. >>&2 ulelong =0x0
  3490. >>>&2 ulelong =0x0 \b, not signed
  3491. >0x0004 ulelong >0
  3492. >>&2 ulelong >0
  3493. >>>&2 ulelong >0 \b, signed
  3494. # expect base address of 0x10000
  3495. >0x0104 ulelong =0x10000
  3496. >>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions
  3497. >>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007
  3498. >>>(0x0118-0x0FF60) ulelong >0 (regions:
  3499. >>>>(0x0118-0x0FF60) ulelong &0x00000001 NA
  3500. >>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan
  3501. >>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World
  3502. >>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer
  3503. >>>(0x0118-0x0FF60) ulelong >0 \b)
  3504.  
  3505. # --------------------------------
  3506. # Microsoft Xbox data file formats
  3507. 0 string XIP0 XIP, Microsoft Xbox data
  3508. 0 string XTF0 XTF, Microsoft Xbox data
  3509.  
  3510. # Atari Lynx cartridge dump (EXE/BLL header)
  3511. # From: "Stefan A. Haubenthal" <polluks@web.de>
  3512.  
  3513. 0 beshort 0x8008 Lynx cartridge,
  3514. >2 beshort x RAM start $%04x
  3515. >6 string BS93
  3516.  
  3517. # Opera file system that is used on the 3DO console
  3518. # From: Serge van den Boom <svdb@stack.nl>
  3519. 0 string \x01ZZZZZ\x01 3DO "Opera" file system
  3520.  
  3521. # From Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
  3522. 0 string GBS Nintendo Gameboy Music/Audio Data
  3523. 12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module
  3524.  
  3525. # Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at>
  3526. 0 string PPF30 Playstation Patch File version 3.0
  3527. >5 byte 0 \b, PPF 1.0 patch
  3528. >5 byte 1 \b, PPF 2.0 patch
  3529. >5 byte 2 \b, PPF 3.0 patch
  3530. >>56 byte 0 \b, Imagetype BIN (any)
  3531. >>56 byte 1 \b, Imagetype GI (PrimoDVD)
  3532. >>57 byte 0 \b, Blockcheck disabled
  3533. >>57 byte 1 \b, Blockcheck enabled
  3534. >>58 byte 0 \b, Undo data not available
  3535. >>58 byte 1 \b, Undo data available
  3536. >6 string x \b, description: %s
  3537.  
  3538. 0 string PPF20 Playstation Patch File version 2.0
  3539. >5 byte 0 \b, PPF 1.0 patch
  3540. >5 byte 1 \b, PPF 2.0 patch
  3541. >>56 lelong >0 \b, size of file to patch %d
  3542. >6 string x \b, description: %s
  3543.  
  3544. 0 string PPF10 Playstation Patch File version 1.0
  3545. >5 byte 0 \b, Simple Encoding
  3546. >6 string x \b, description: %s
  3547.  
  3548. # From: Daniel Dawson <ddawson@icehouse.net>
  3549. # SNES9x .smv "movie" file format.
  3550. 0 string SMV\x1A SNES9x input recording
  3551. >0x4 lelong x \b, version %d
  3552. # version 4 is latest so far
  3553. >0x4 lelong <5
  3554. >>0x8 ledate x \b, recorded at %s
  3555. >>0xc lelong >0 \b, rerecorded %d times
  3556. >>0x10 lelong x \b, %d frames long
  3557. >>0x14 byte >0 \b, data for controller(s):
  3558. >>>0x14 byte &0x1 #1
  3559. >>>0x14 byte &0x2 #2
  3560. >>>0x14 byte &0x4 #3
  3561. >>>0x14 byte &0x8 #4
  3562. >>>0x14 byte &0x10 #5
  3563. >>0x15 byte ^0x1 \b, begins from snapshot
  3564. >>0x15 byte &0x1 \b, begins from reset
  3565. >>0x15 byte ^0x2 \b, NTSC standard
  3566. >>0x15 byte &0x2 \b, PAL standard
  3567. >>0x17 byte &0x1 \b, settings:
  3568. # WIP1Timing not used as of version 4
  3569. >>>0x4 lelong <4
  3570. >>>>0x17 byte &0x2 WIP1Timing
  3571. >>>0x17 byte &0x4 Left+Right
  3572. >>>0x17 byte &0x8 VolumeEnvX
  3573. >>>0x17 byte &0x10 FakeMute
  3574. >>>0x17 byte &0x20 SyncSound
  3575. # New flag as of version 4
  3576. >>>0x4 lelong >3
  3577. >>>>0x17 byte &0x80 NoCPUShutdown
  3578. >>0x4 lelong <4
  3579. >>>0x18 lelong >0x23
  3580. >>>>0x20 leshort !0
  3581. >>>>>0x20 lestring16 x \b, metadata: "%s"
  3582. >>0x4 lelong >3
  3583. >>>0x24 byte >0 \b, port 1:
  3584. >>>>0x24 byte 1 joypad
  3585. >>>>0x24 byte 2 mouse
  3586. >>>>0x24 byte 3 SuperScope
  3587. >>>>0x24 byte 4 Justifier
  3588. >>>>0x24 byte 5 multitap
  3589. >>>0x24 byte >0 \b, port 2:
  3590. >>>>0x25 byte 1 joypad
  3591. >>>>0x25 byte 2 mouse
  3592. >>>>0x25 byte 3 SuperScope
  3593. >>>>0x25 byte 4 Justifier
  3594. >>>>0x25 byte 5 multitap
  3595. >>>0x18 lelong >0x43
  3596. >>>>0x40 leshort !0
  3597. >>>>>0x40 lestring16 x \b, metadata: "%s"
  3598. >>0x17 byte &0x40 \b, ROM:
  3599. >>>(0x18.l-26) lelong x CRC32 0x%08x
  3600. >>>(0x18.l-23) string x "%s"
  3601.  
  3602. # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
  3603. # .w3g
  3604. 0 string Warcraft\ III\ recorded\ game %s
  3605. # .w3m
  3606. 0 string HM3W Warcraft III map file
  3607.  
  3608. #------------------------------------------------------------------------------
  3609. # convex: file(1) magic for Convex boxes
  3610. #
  3611. # Convexes are big-endian.
  3612. #
  3613. # /*\
  3614. # * Below are the magic numbers and tests added for Convex.
  3615. # * Added at beginning, because they are expected to be used most.
  3616. # \*/
  3617. 0 belong 0507 Convex old-style object
  3618. >16 belong >0 not stripped
  3619. 0 belong 0513 Convex old-style demand paged executable
  3620. >16 belong >0 not stripped
  3621. 0 belong 0515 Convex old-style pre-paged executable
  3622. >16 belong >0 not stripped
  3623. 0 belong 0517 Convex old-style pre-paged, non-swapped executable
  3624. >16 belong >0 not stripped
  3625. 0 belong 0x011257 Core file
  3626. #
  3627. # The following are a series of dump format magic numbers. Each one
  3628. # corresponds to a drastically different dump format. The first on is
  3629. # the original dump format on a 4.1 BSD or earlier file system. The
  3630. # second marks the change between the 4.1 file system and the 4.2 file
  3631. # system. The Third marks the changing of the block size from 1K
  3632. # to 2K to be compatible with an IDC file system. The fourth indicates
  3633. # a dump that is dependent on Convex Storage Manager, because data in
  3634. # secondary storage is not physically contained within the dump.
  3635. # The restore program uses these number to determine how the data is
  3636. # to be extracted.
  3637. #
  3638. 24 belong =60011 dump format, 4.1 BSD or earlier
  3639. 24 belong =60012 dump format, 4.2 or 4.3 BSD without IDC
  3640. 24 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible)
  3641. 24 belong =60014 dump format, Convex Storage Manager by-reference dump
  3642. #
  3643. # what follows is a bunch of bit-mask checks on the flags field of the opthdr.
  3644. # If there is no `=' sign, assume just checking for whether the bit is set?
  3645. #
  3646. 0 belong 0601 Convex SOFF
  3647. >88 belong&0x000f0000 =0x00000000 c1
  3648. >88 belong &0x00010000 c2
  3649. >88 belong &0x00020000 c2mp
  3650. >88 belong &0x00040000 parallel
  3651. >88 belong &0x00080000 intrinsic
  3652. >88 belong &0x00000001 demand paged
  3653. >88 belong &0x00000002 pre-paged
  3654. >88 belong &0x00000004 non-swapped
  3655. >88 belong &0x00000008 POSIX
  3656. #
  3657. >84 belong &0x80000000 executable
  3658. >84 belong &0x40000000 object
  3659. >84 belong&0x20000000 =0 not stripped
  3660. >84 belong&0x18000000 =0x00000000 native fpmode
  3661. >84 belong&0x18000000 =0x10000000 ieee fpmode
  3662. >84 belong&0x18000000 =0x18000000 undefined fpmode
  3663. #
  3664. 0 belong 0605 Convex SOFF core
  3665. #
  3666. 0 belong 0607 Convex SOFF checkpoint
  3667. >88 belong&0x000f0000 =0x00000000 c1
  3668. >88 belong &0x00010000 c2
  3669. >88 belong &0x00020000 c2mp
  3670. >88 belong &0x00040000 parallel
  3671. >88 belong &0x00080000 intrinsic
  3672. >88 belong &0x00000008 POSIX
  3673. #
  3674. >84 belong&0x18000000 =0x00000000 native fpmode
  3675. >84 belong&0x18000000 =0x10000000 ieee fpmode
  3676. >84 belong&0x18000000 =0x18000000 undefined fpmode
  3677.  
  3678. # ----------------------------------------------------------------------------
  3679. # ctags: file (1) magic for Exuberant Ctags files
  3680. # From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de>
  3681. 0 string =!_TAG Exuberant Ctags tag file text
  3682.  
  3683. #------------------------------------------------------------------------------
  3684. # dact: file(1) magic for DACT compressed files
  3685. #
  3686. 0 long 0x444354C3 DACT compressed data
  3687. >4 byte >-1 (version %i.
  3688. >5 byte >-1 $BS%i.
  3689. >6 byte >-1 $BS%i)
  3690. >7 long >0 $BS, original size: %i bytes
  3691. >15 long >30 $BS, block size: %i bytes
  3692.  
  3693. #------------------------------------------------------------------------------
  3694. # database: file(1) magic for various databases
  3695. #
  3696. # extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
  3697. #
  3698. #
  3699. # GDBM magic numbers
  3700. # Will be maintained as part of the GDBM distribution in the future.
  3701. # <downsj@teeny.org>
  3702. 0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian
  3703. 0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian
  3704. 0 string GDBM GNU dbm 2.x database
  3705. #
  3706. # Berkeley DB
  3707. #
  3708. # Ian Darwin's file /etc/magic files: big/little-endian version.
  3709. #
  3710. # Hash 1.85/1.86 databases store metadata in network byte order.
  3711. # Btree 1.85/1.86 databases store the metadata in host byte order.
  3712. # Hash and Btree 2.X and later databases store the metadata in host byte order.
  3713.  
  3714. 0 long 0x00061561 Berkeley DB
  3715. >8 belong 4321
  3716. >>4 belong >2 1.86
  3717. >>4 belong <3 1.85
  3718. >>4 belong >0 (Hash, version %d, native byte-order)
  3719. >8 belong 1234
  3720. >>4 belong >2 1.86
  3721. >>4 belong <3 1.85
  3722. >>4 belong >0 (Hash, version %d, little-endian)
  3723.  
  3724. 0 belong 0x00061561 Berkeley DB
  3725. >8 belong 4321
  3726. >>4 belong >2 1.86
  3727. >>4 belong <3 1.85
  3728. >>4 belong >0 (Hash, version %d, big-endian)
  3729. >8 belong 1234
  3730. >>4 belong >2 1.86
  3731. >>4 belong <3 1.85
  3732. >>4 belong >0 (Hash, version %d, native byte-order)
  3733.  
  3734. 0 long 0x00053162 Berkeley DB 1.85/1.86
  3735. >4 long >0 (Btree, version %d, native byte-order)
  3736. 0 belong 0x00053162 Berkeley DB 1.85/1.86
  3737. >4 belong >0 (Btree, version %d, big-endian)
  3738. 0 lelong 0x00053162 Berkeley DB 1.85/1.86
  3739. >4 lelong >0 (Btree, version %d, little-endian)
  3740.  
  3741. 12 long 0x00061561 Berkeley DB
  3742. >16 long >0 (Hash, version %d, native byte-order)
  3743. 12 belong 0x00061561 Berkeley DB
  3744. >16 belong >0 (Hash, version %d, big-endian)
  3745. 12 lelong 0x00061561 Berkeley DB
  3746. >16 lelong >0 (Hash, version %d, little-endian)
  3747.  
  3748. 12 long 0x00053162 Berkeley DB
  3749. >16 long >0 (Btree, version %d, native byte-order)
  3750. 12 belong 0x00053162 Berkeley DB
  3751. >16 belong >0 (Btree, version %d, big-endian)
  3752. 12 lelong 0x00053162 Berkeley DB
  3753. >16 lelong >0 (Btree, version %d, little-endian)
  3754.  
  3755. 12 long 0x00042253 Berkeley DB
  3756. >16 long >0 (Queue, version %d, native byte-order)
  3757. 12 belong 0x00042253 Berkeley DB
  3758. >16 belong >0 (Queue, version %d, big-endian)
  3759. 12 lelong 0x00042253 Berkeley DB
  3760. >16 lelong >0 (Queue, version %d, little-endian)
  3761.  
  3762. # From Max Bowsher.
  3763. 12 long 0x00040988 Berkeley DB
  3764. >16 long >0 (Log, version %d, native byte-order)
  3765. 12 belong 0x00040988 Berkeley DB
  3766. >16 belong >0 (Log, version %d, big-endian)
  3767. 12 lelong 0x00040988 Berkeley DB
  3768. >16 lelong >0 (Log, version %d, little-endian)
  3769.  
  3770. #
  3771. #
  3772. # Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
  3773. 0 string RRD RRDTool DB
  3774. >4 string x version %s
  3775. #----------------------------------------------------------------------
  3776. # ROOT: file(1) magic for ROOT databases
  3777. #
  3778. 0 string root\0 ROOT file
  3779. >4 belong x Version %d
  3780. >33 belong x (Compression: %d)
  3781.  
  3782. # XXX: Weak magic.
  3783. # Alex Ott <ott@jet.msk.su>
  3784. ## Paradox file formats
  3785. #2 leshort 0x0800 Paradox
  3786. #>0x39 byte 3 v. 3.0
  3787. #>0x39 byte 4 v. 3.5
  3788. #>0x39 byte 9 v. 4.x
  3789. #>0x39 byte 10 v. 5.x
  3790. #>0x39 byte 11 v. 5.x
  3791. #>0x39 byte 12 v. 7.x
  3792. #>>0x04 byte 0 indexed .DB data file
  3793. #>>0x04 byte 1 primary index .PX file
  3794. #>>0x04 byte 2 non-indexed .DB data file
  3795. #>>0x04 byte 3 non-incrementing secondary index .Xnn file
  3796. #>>0x04 byte 4 secondary index .Ynn file
  3797. #>>0x04 byte 5 incrementing secondary index .Xnn file
  3798. #>>0x04 byte 6 non-incrementing secondary index .XGn file
  3799. #>>0x04 byte 7 secondary index .YGn file
  3800. #>>>0x04 byte 8 incrementing secondary index .XGn file
  3801. ## XBase database files
  3802. #0 byte 0x02
  3803. #>8 leshort >0
  3804. #>>12 leshort 0 FoxBase
  3805. #>>>0x04 lelong 0 (no records)
  3806. #>>>0x04 lelong >0 (%ld records)
  3807. #
  3808. #0 byte 0x03
  3809. #>8 leshort >0
  3810. #>>12 leshort 0 FoxBase+, FoxPro, dBaseIII+, dBaseIV, no memo
  3811. #>>>0x04 lelong 0 (no records)
  3812. #>>>0x04 lelong >0 (%ld records)
  3813. #
  3814. #0 byte 0x04
  3815. #>8 leshort >0
  3816. #>>12 leshort 0 dBASE IV no memo file
  3817. #>>>0x04 lelong 0 (no records)
  3818. #>>>0x04 lelong >0 (%ld records)
  3819. #
  3820. #0 byte 0x05
  3821. #>8 leshort >0
  3822. #>>12 leshort 0 dBASE V no memo file
  3823. #>>>0x04 lelong 0 (no records)
  3824. #>>>0x04 lelong >0 (%ld records)
  3825. #
  3826. #0 byte 0x30
  3827. #>8 leshort >0
  3828. #>>12 leshort 0 Visual FoxPro
  3829. #>>>0x04 lelong 0 (no records)
  3830. #>>>0x04 lelong >0 (%ld records)
  3831. #
  3832. #0 byte 0x43
  3833. #>8 leshort >0
  3834. #>>12 leshort 0 FlagShip with memo var size
  3835. #>>>0x04 lelong 0 (no records)
  3836. #>>>0x04 lelong >0 (%ld records)
  3837. #
  3838. #0 byte 0x7b
  3839. #>8 leshort >0
  3840. #>>12 leshort 0 dBASEIV with memo
  3841. #>>>0x04 lelong 0 (no records)
  3842. #>>>0x04 lelong >0 (%ld records)
  3843. #
  3844. #0 byte 0x83
  3845. #>8 leshort >0
  3846. #>>12 leshort 0 FoxBase+, dBaseIII+ with memo
  3847. #>>>0x04 lelong 0 (no records)
  3848. #>>>0x04 lelong >0 (%ld records)
  3849. #
  3850. #0 byte 0x8b
  3851. #>8 leshort >0
  3852. #>>12 leshort 0 dBaseIV with memo
  3853. #>>>0x04 lelong 0 (no records)
  3854. #>>>0x04 lelong >0 (%ld records)
  3855. #
  3856. #0 byte 0x8e
  3857. #>8 leshort >0
  3858. #>>12 leshort 0 dBaseIV with SQL Table
  3859. #>>>0x04 lelong 0 (no records)
  3860. #>>>0x04 lelong >0 (%ld records)
  3861. #
  3862. #0 byte 0xb3
  3863. #>8 leshort >0
  3864. #>>12 leshort 0 FlagShip with .dbt memo
  3865. #>>>0x04 lelong 0 (no records)
  3866. #>>>0x04 lelong >0 (%ld records)
  3867. #
  3868. #0 byte 0xf5
  3869. #>8 leshort >0
  3870. #>>12 leshort 0 FoxPro with memo
  3871. #>>>0x04 lelong 0 (no records)
  3872. #>>>0x04 lelong >0 (%ld records)
  3873. #
  3874. #0 leshort 0x0006 DBase 3 index file
  3875.  
  3876. # MS Access database
  3877. 4 string Standard\ Jet\ DB Microsoft Access Database
  3878.  
  3879. # TDB database from Samba et al - Martin Pool <mbp@samba.org>
  3880. 0 string TDB\ file TDB database
  3881. >32 lelong 0x2601196D version 6, little-endian
  3882. >>36 lelong x hash size %d bytes
  3883.  
  3884. # SE Linux policy database
  3885. 0 lelong 0xf97cff8c SE Linux policy
  3886. >16 lelong x v%d
  3887. >20 lelong 1 MLS
  3888. >24 lelong x %d symbols
  3889. >28 lelong x %d ocons
  3890.  
  3891. # ICE authority file data (Wolfram Kleff)
  3892. 2 string ICE ICE authority data
  3893.  
  3894. # X11 Xauthority file (Wolfram Kleff)
  3895. 10 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  3896. 11 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  3897. 12 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  3898. 13 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  3899. 14 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  3900. 15 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  3901. 16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  3902. 17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  3903. 18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  3904.  
  3905. # From: Maxime Henrion <mux@FreeBSD.org>
  3906. # PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org>
  3907. 0 string PGDMP PostgreSQL custom database dump
  3908. >5 byte x - v%d
  3909. >6 byte x \b.%d
  3910. >5 beshort <=0x100 \b-0
  3911. >5 beshort >0x100
  3912. >>7 byte x \b-%d
  3913.  
  3914.  
  3915. #------------------------------------------------------------------------------
  3916. # diamond: file(1) magic for Diamond system
  3917. #
  3918. # ... diamond is a multi-media mail and electronic conferencing system....
  3919. #
  3920. # XXX - I think it was either renamed Slate, or replaced by Slate....
  3921. #
  3922. # The full deal is too long...
  3923. #0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document
  3924. 0 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document
  3925.  
  3926. #------------------------------------------------------------------------------
  3927. # diff: file(1) magic for diff(1) output
  3928. #
  3929. 0 string diff\ 'diff' output text
  3930. 0 string ***\ 'diff' output text
  3931. 0 string Only\ in\ 'diff' output text
  3932. 0 string Common\ subdirectories:\ 'diff' output text
  3933.  
  3934. 0 string Index: RCS/CVS diff output text
  3935. # Digital UNIX - Info
  3936. #
  3937. 0 string =!<arch>\n________64E Alpha archive
  3938. >22 string X -- out of date
  3939. #
  3940. # Alpha COFF Based Executables
  3941. # The stripped stuff really needs to be an 8 byte (64 bit) compare,
  3942. # but this works
  3943. 0 leshort 0x183 COFF format alpha
  3944. >22 leshort&020000 &010000 sharable library,
  3945. >22 leshort&020000 ^010000 dynamically linked,
  3946. >24 leshort 0410 pure
  3947. >24 leshort 0413 demand paged
  3948. >8 lelong >0 executable or object module, not stripped
  3949. >8 lelong 0
  3950. >>12 lelong 0 executable or object module, stripped
  3951. >>12 lelong >0 executable or object module, not stripped
  3952. >27 byte >0 - version %d.
  3953. >26 byte >0 %d-
  3954. >28 leshort >0 %d
  3955. #
  3956. # The next is incomplete, we could tell more about this format,
  3957. # but its not worth it.
  3958. 0 leshort 0x188 Alpha compressed COFF
  3959. 0 leshort 0x18f Alpha u-code object
  3960. #
  3961. #
  3962. # Some other interesting Digital formats,
  3963. 0 string \377\377\177 ddis/ddif
  3964. 0 string \377\377\174 ddis/dots archive
  3965. 0 string \377\377\176 ddis/dtif table data
  3966. 0 string \033c\033 LN03 output
  3967. 0 long 04553207 X image
  3968. #
  3969. 0 string =!<PDF>!\n profiling data file
  3970. #
  3971. # Locale data tables (MIPS and Alpha).
  3972. #
  3973. 0 short 0x0501 locale data table
  3974. >6 short 0x24 for MIPS
  3975. >6 short 0x40 for Alpha
  3976. # ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
  3977. # from http://www.atsc.org/standards/a_52a.pdf
  3978. # corrections, additions, etc. are always welcome!
  3979. #
  3980. # syncword
  3981. 0 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream,
  3982. # fscod
  3983. >4 byte&0xc0 0x00 48 kHz,
  3984. >4 byte&0xc0 0x40 44.1 kHz,
  3985. >4 byte&0xc0 0x80 32 kHz,
  3986. # is this one used for 96 kHz?
  3987. >4 byte&0xc0 0xc0 reserved frequency,
  3988. #
  3989. >5 byte&7 = 0 \b, complete main (CM)
  3990. >5 byte&7 = 1 \b, music and effects (ME)
  3991. >5 byte&7 = 2 \b, visually impaired (VI)
  3992. >5 byte&7 = 3 \b, hearing impaired (HI)
  3993. >5 byte&7 = 4 \b, dialogue (D)
  3994. >5 byte&7 = 5 \b, commentary (C)
  3995. >5 byte&7 = 6 \b, emergency (E)
  3996. # acmod
  3997. >6 byte&0xe0 0x00 1+1 front,
  3998. >6 byte&0xe0 0x20 1 front/0 rear,
  3999. >6 byte&0xe0 0x40 2 front/0 rear,
  4000. >6 byte&0xe0 0x60 3 front/0 rear,
  4001. >6 byte&0xe0 0x80 2 front/1 rear,
  4002. >6 byte&0xe0 0xa0 3 front/1 rear,
  4003. >6 byte&0xe0 0xc0 2 front/2 rear,
  4004. >6 byte&0xe0 0xe0 3 front/2 rear,
  4005. # lfeon (these may be incorrect)
  4006. >7 byte&0x40 0x00 LFE off,
  4007. >7 byte&0x40 0x40 LFE on,
  4008. #
  4009. >4 byte&0x3e = 0x00 \b, 32 kbit/s
  4010. >4 byte&0x3e = 0x02 \b, 40 kbit/s
  4011. >4 byte&0x3e = 0x04 \b, 48 kbit/s
  4012. >4 byte&0x3e = 0x06 \b, 56 kbit/s
  4013. >4 byte&0x3e = 0x08 \b, 64 kbit/s
  4014. >4 byte&0x3e = 0x0a \b, 80 kbit/s
  4015. >4 byte&0x3e = 0x0c \b, 96 kbit/s
  4016. >4 byte&0x3e = 0x0e \b, 112 kbit/s
  4017. >4 byte&0x3e = 0x10 \b, 128 kbit/s
  4018. >4 byte&0x3e = 0x12 \b, 160 kbit/s
  4019. >4 byte&0x3e = 0x14 \b, 192 kbit/s
  4020. >4 byte&0x3e = 0x16 \b, 224 kbit/s
  4021. >4 byte&0x3e = 0x18 \b, 256 kbit/s
  4022. >4 byte&0x3e = 0x1a \b, 320 kbit/s
  4023. >4 byte&0x3e = 0x1c \b, 384 kbit/s
  4024. >4 byte&0x3e = 0x1e \b, 448 kbit/s
  4025. >4 byte&0x3e = 0x20 \b, 512 kbit/s
  4026. >4 byte&0x3e = 0x22 \b, 576 kbit/s
  4027. >4 byte&0x3e = 0x24 \b, 640 kbit/s
  4028. # dsurmod (these may be incorrect)
  4029. >6 beshort&0x0180 0x0000 Dolby Surround not indicated
  4030. >6 beshort&0x0180 0x0080 not Dolby Surround encoded
  4031. >6 beshort&0x0180 0x0100 Dolby Surround encoded
  4032. >6 beshort&0x0180 0x0180 reserved Dolby Surround mode
  4033.  
  4034. #------------------------------------------------------------------------------
  4035. # dump: file(1) magic for dump file format--for new and old dump filesystems
  4036. #
  4037. # We specify both byte orders in order to recognize byte-swapped dumps.
  4038. #
  4039. 24 belong 60012 new-fs dump file (big endian),
  4040. >4 bedate x Previous dump %s,
  4041. >8 bedate x This dump %s,
  4042. >12 belong >0 Volume %ld,
  4043. >692 belong 0 Level zero, type:
  4044. >692 belong >0 Level %d, type:
  4045. >0 belong 1 tape header,
  4046. >0 belong 2 beginning of file record,
  4047. >0 belong 3 map of inodes on tape,
  4048. >0 belong 4 continuation of file record,
  4049. >0 belong 5 end of volume,
  4050. >0 belong 6 map of inodes deleted,
  4051. >0 belong 7 end of medium (for floppy),
  4052. >676 string >\0 Label %s,
  4053. >696 string >\0 Filesystem %s,
  4054. >760 string >\0 Device %s,
  4055. >824 string >\0 Host %s,
  4056. >888 belong >0 Flags %x
  4057.  
  4058. 24 belong 60011 old-fs dump file (big endian),
  4059. #>4 bedate x Previous dump %s,
  4060. #>8 bedate x This dump %s,
  4061. >12 belong >0 Volume %ld,
  4062. >692 belong 0 Level zero, type:
  4063. >692 belong >0 Level %d, type:
  4064. >0 belong 1 tape header,
  4065. >0 belong 2 beginning of file record,
  4066. >0 belong 3 map of inodes on tape,
  4067. >0 belong 4 continuation of file record,
  4068. >0 belong 5 end of volume,
  4069. >0 belong 6 map of inodes deleted,
  4070. >0 belong 7 end of medium (for floppy),
  4071. >676 string >\0 Label %s,
  4072. >696 string >\0 Filesystem %s,
  4073. >760 string >\0 Device %s,
  4074. >824 string >\0 Host %s,
  4075. >888 belong >0 Flags %x
  4076.  
  4077. 24 lelong 60012 new-fs dump file (little endian),
  4078. >4 ledate x This dump %s,
  4079. >8 ledate x Previous dump %s,
  4080. >12 lelong >0 Volume %ld,
  4081. >692 lelong 0 Level zero, type:
  4082. >692 lelong >0 Level %d, type:
  4083. >0 lelong 1 tape header,
  4084. >0 lelong 2 beginning of file record,
  4085. >0 lelong 3 map of inodes on tape,
  4086. >0 lelong 4 continuation of file record,
  4087. >0 lelong 5 end of volume,
  4088. >0 lelong 6 map of inodes deleted,
  4089. >0 lelong 7 end of medium (for floppy),
  4090. >676 string >\0 Label %s,
  4091. >696 string >\0 Filesystem %s,
  4092. >760 string >\0 Device %s,
  4093. >824 string >\0 Host %s,
  4094. >888 lelong >0 Flags %x
  4095.  
  4096. 24 lelong 60011 old-fs dump file (little endian),
  4097. #>4 ledate x Previous dump %s,
  4098. #>8 ledate x This dump %s,
  4099. >12 lelong >0 Volume %ld,
  4100. >692 lelong 0 Level zero, type:
  4101. >692 lelong >0 Level %d, type:
  4102. >0 lelong 1 tape header,
  4103. >0 lelong 2 beginning of file record,
  4104. >0 lelong 3 map of inodes on tape,
  4105. >0 lelong 4 continuation of file record,
  4106. >0 lelong 5 end of volume,
  4107. >0 lelong 6 map of inodes deleted,
  4108. >0 lelong 7 end of medium (for floppy),
  4109. >676 string >\0 Label %s,
  4110. >696 string >\0 Filesystem %s,
  4111. >760 string >\0 Device %s,
  4112. >824 string >\0 Host %s,
  4113. >888 lelong >0 Flags %x
  4114.  
  4115. 18 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness),
  4116. >2 medate x Previous dump %s,
  4117. >6 medate x This dump %s,
  4118. >10 leshort >0 Volume %ld,
  4119. >0 leshort 1 tape header.
  4120. >0 leshort 2 beginning of file record.
  4121. >0 leshort 3 map of inodes on tape.
  4122. >0 leshort 4 continuation of file record.
  4123. >0 leshort 5 end of volume.
  4124. >0 leshort 6 map of inodes deleted.
  4125. >0 leshort 7 end of medium (for floppy).
  4126.  
  4127. #------------------------------------------------------------------------------
  4128. # T602 editor documents
  4129. # by David Necas <yeti@physics.muni.cz>
  4130. 0 string @CT\ T602 document data,
  4131. >4 string 0 Kamenicky
  4132. >4 string 1 CP 852
  4133. >4 string 2 KOI8-CS
  4134. >4 string >2 unknown encoding
  4135.  
  4136. # Vi IMproved Encrypted file
  4137. # by David Necas <yeti@physics.muni.cz>
  4138. 0 string VimCrypt~ Vim encrypted file data
  4139. # Vi IMproved Swap file
  4140. # by Sven Wegener <swegener@gentoo.org>
  4141. 0 string b0VIM\ Vim swap file
  4142. >&0 string >\0 \b, version %s
  4143.  
  4144. #------------------------------------------------------------------------------
  4145. # efi: file(1) magic for Universal EFI binaries
  4146.  
  4147. 0 lelong 0x0ef1fab9
  4148. >4 lelong 1 Universal EFI binary with 1 architecture
  4149. >>&0 lelong 7 \b, i386
  4150. >>&0 lelong 0x01000007 \b, x86_64
  4151. >4 lelong 2 Universal EFI binary with 2 architectures
  4152. >>&0 lelong 7 \b, i386
  4153. >>&0 lelong 0x01000007 \b, x86_64
  4154. >>&20 lelong 7 \b, i386
  4155. >>&20 lelong 0x01000007 \b, x86_64
  4156. >4 lelong >2 Universal EFI binary with %ld architectures
  4157.  
  4158. #------------------------------------------------------------------------------
  4159. # elf: file(1) magic for ELF executables
  4160. #
  4161. # We have to check the byte order flag to see what byte order all the
  4162. # other stuff in the header is in.
  4163. #
  4164. # What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
  4165. #
  4166. # updated by Daniel Quinlan (quinlan@yggdrasil.com)
  4167. 0 string \177ELF ELF
  4168. >4 byte 0 invalid class
  4169. >4 byte 1 32-bit
  4170. >4 byte 2 64-bit
  4171. >5 byte 0 invalid byte order
  4172. >5 byte 1 LSB
  4173. >>16 leshort 0 no file type,
  4174. >>16 leshort 1 relocatable,
  4175. >>16 leshort 2 executable,
  4176. >>16 leshort 3 shared object,
  4177. # Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
  4178. # corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
  4179. >>16 leshort 4 core file
  4180. # Core file detection is not reliable.
  4181. #>>>(0x38+0xcc) string >\0 of '%s'
  4182. #>>>(0x38+0x10) lelong >0 (signal %d),
  4183. >>16 leshort &0xff00 processor-specific,
  4184. >>18 leshort 0 no machine,
  4185. >>18 leshort 1 AT&T WE32100 - invalid byte order,
  4186. >>18 leshort 2 SPARC - invalid byte order,
  4187. >>18 leshort 3 Intel 80386,
  4188. >>18 leshort 4 Motorola
  4189. >>>36 lelong &0x01000000 68000 - invalid byte order,
  4190. >>>36 lelong &0x00810000 CPU32 - invalid byte order,
  4191. >>>36 lelong 0 68020 - invalid byte order,
  4192. >>18 leshort 5 Motorola 88000 - invalid byte order,
  4193. >>18 leshort 6 Intel 80486,
  4194. >>18 leshort 7 Intel 80860,
  4195. # The official e_machine number for MIPS is now #8, regardless of endianness.
  4196. # The second number (#10) will be deprecated later. For now, we still
  4197. # say something if #10 is encountered, but only gory details for #8.
  4198. >>18 leshort 8 MIPS,
  4199. >>>36 lelong &0x20 N32
  4200. >>18 leshort 10 MIPS,
  4201. >>>36 lelong &0x20 N32
  4202. >>18 leshort 8
  4203. # only for 32-bit
  4204. >>>4 byte 1
  4205. >>>>36 lelong&0xf0000000 0x00000000 MIPS-I
  4206. >>>>36 lelong&0xf0000000 0x10000000 MIPS-II
  4207. >>>>36 lelong&0xf0000000 0x20000000 MIPS-III
  4208. >>>>36 lelong&0xf0000000 0x30000000 MIPS-IV
  4209. >>>>36 lelong&0xf0000000 0x40000000 MIPS-V
  4210. >>>>36 lelong&0xf0000000 0x50000000 MIPS32
  4211. >>>>36 lelong&0xf0000000 0x60000000 MIPS64
  4212. >>>>36 lelong&0xf0000000 0x70000000 MIPS32 rel2
  4213. >>>>36 lelong&0xf0000000 0x80000000 MIPS64 rel2
  4214. # only for 64-bit
  4215. >>>4 byte 2
  4216. >>>>48 lelong&0xf0000000 0x00000000 MIPS-I
  4217. >>>>48 lelong&0xf0000000 0x10000000 MIPS-II
  4218. >>>>48 lelong&0xf0000000 0x20000000 MIPS-III
  4219. >>>>48 lelong&0xf0000000 0x30000000 MIPS-IV
  4220. >>>>48 lelong&0xf0000000 0x40000000 MIPS-V
  4221. >>>>48 lelong&0xf0000000 0x50000000 MIPS32
  4222. >>>>48 lelong&0xf0000000 0x60000000 MIPS64
  4223. >>>>48 lelong&0xf0000000 0x70000000 MIPS32 rel2
  4224. >>>>48 lelong&0xf0000000 0x80000000 MIPS64 rel2
  4225. >>18 leshort 9 Amdahl - invalid byte order,
  4226. >>18 leshort 10 MIPS (deprecated),
  4227. >>18 leshort 11 RS6000 - invalid byte order,
  4228. >>18 leshort 15 PA-RISC - invalid byte order,
  4229. >>>50 leshort 0x0214 2.0
  4230. >>>48 leshort &0x0008 (LP64),
  4231. >>18 leshort 16 nCUBE,
  4232. >>18 leshort 17 Fujitsu VPP500,
  4233. >>18 leshort 18 SPARC32PLUS,
  4234. >>18 leshort 20 PowerPC,
  4235. >>18 leshort 22 IBM S/390,
  4236. >>18 leshort 36 NEC V800,
  4237. >>18 leshort 37 Fujitsu FR20,
  4238. >>18 leshort 38 TRW RH-32,
  4239. >>18 leshort 39 Motorola RCE,
  4240. >>18 leshort 40 ARM,
  4241. >>18 leshort 41 Alpha,
  4242. >>18 leshort 0xa390 IBM S/390 (obsolete),
  4243. >>18 leshort 42 Renesas SH,
  4244. >>18 leshort 43 SPARC V9 - invalid byte order,
  4245. >>18 leshort 44 Siemens Tricore Embedded Processor,
  4246. >>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
  4247. >>18 leshort 46 Renesas H8/300,
  4248. >>18 leshort 47 Renesas H8/300H,
  4249. >>18 leshort 48 Renesas H8S,
  4250. >>18 leshort 49 Renesas H8/500,
  4251. >>18 leshort 50 IA-64,
  4252. >>18 leshort 51 Stanford MIPS-X,
  4253. >>18 leshort 52 Motorola Coldfire,
  4254. >>18 leshort 53 Motorola M68HC12,
  4255. >>18 leshort 62 x86-64,
  4256. >>18 leshort 75 Digital VAX,
  4257. >>18 leshort 88 Renesas M32R,
  4258. >>18 leshort 94 Tensilica Xtensa,
  4259. >>18 leshort 97 NatSemi 32k,
  4260. >>18 leshort 106 Analog Devices Blackfin,
  4261. >>18 leshort 0x9026 Alpha (unofficial),
  4262. >>20 lelong 0 invalid version
  4263. >>20 lelong 1 version 1
  4264. >>36 lelong 1 MathCoPro/FPU/MAU Required
  4265. >5 byte 2 MSB
  4266. >>16 beshort 0 no file type,
  4267. >>16 beshort 1 relocatable,
  4268. >>16 beshort 2 executable,
  4269. >>16 beshort 3 shared object,
  4270. >>16 beshort 4 core file,
  4271. #>>>(0x38+0xcc) string >\0 of '%s'
  4272. #>>>(0x38+0x10) belong >0 (signal %d),
  4273. >>16 beshort &0xff00 processor-specific,
  4274. >>18 beshort 0 no machine,
  4275. >>18 beshort 1 AT&T WE32100,
  4276. >>18 beshort 2 SPARC,
  4277. >>18 beshort 3 Intel 80386 - invalid byte order,
  4278. >>18 beshort 4 Motorola
  4279. >>>36 belong &0x01000000 68000,
  4280. >>>36 belong &0x00810000 CPU32,
  4281. >>>36 belong 0 68020,
  4282. >>18 beshort 5 Motorola 88000,
  4283. >>18 beshort 6 Intel 80486 - invalid byte order,
  4284. >>18 beshort 7 Intel 80860,
  4285. # only for MIPS - see comment in little-endian section above.
  4286. >>18 beshort 8 MIPS,
  4287. >>>36 belong &0x20 N32
  4288. >>18 beshort 10 MIPS,
  4289. >>>36 belong &0x20 N32
  4290. >>18 beshort 8
  4291. # only for 32-bit
  4292. >>>4 byte 1
  4293. >>>>36 belong&0xf0000000 0x00000000 MIPS-I
  4294. >>>>36 belong&0xf0000000 0x10000000 MIPS-II
  4295. >>>>36 belong&0xf0000000 0x20000000 MIPS-III
  4296. >>>>36 belong&0xf0000000 0x30000000 MIPS-IV
  4297. >>>>36 belong&0xf0000000 0x40000000 MIPS-V
  4298. >>>>36 belong&0xf0000000 0x50000000 MIPS32
  4299. >>>>36 belong&0xf0000000 0x60000000 MIPS64
  4300. >>>>36 belong&0xf0000000 0x70000000 MIPS32 rel2
  4301. >>>>36 belong&0xf0000000 0x80000000 MIPS64 rel2
  4302. # only for 64-bit
  4303. >>>4 byte 2
  4304. >>>>48 belong&0xf0000000 0x00000000 MIPS-I
  4305. >>>>48 belong&0xf0000000 0x10000000 MIPS-II
  4306. >>>>48 belong&0xf0000000 0x20000000 MIPS-III
  4307. >>>>48 belong&0xf0000000 0x30000000 MIPS-IV
  4308. >>>>48 belong&0xf0000000 0x40000000 MIPS-V
  4309. >>>>48 belong&0xf0000000 0x50000000 MIPS32
  4310. >>>>48 belong&0xf0000000 0x60000000 MIPS64
  4311. >>>>48 belong&0xf0000000 0x70000000 MIPS32 rel2
  4312. >>>>48 belong&0xf0000000 0x80000000 MIPS64 rel2
  4313. >>18 beshort 9 Amdahl,
  4314. >>18 beshort 10 MIPS (deprecated),
  4315. >>18 beshort 11 RS6000,
  4316. >>18 beshort 15 PA-RISC
  4317. >>>50 beshort 0x0214 2.0
  4318. >>>48 beshort &0x0008 (LP64)
  4319. >>18 beshort 16 nCUBE,
  4320. >>18 beshort 17 Fujitsu VPP500,
  4321. >>18 beshort 18 SPARC32PLUS,
  4322. >>>36 belong&0xffff00 &0x000100 V8+ Required,
  4323. >>>36 belong&0xffff00 &0x000200 Sun UltraSPARC1 Extensions Required,
  4324. >>>36 belong&0xffff00 &0x000400 HaL R1 Extensions Required,
  4325. >>>36 belong&0xffff00 &0x000800 Sun UltraSPARC3 Extensions Required,
  4326. >>18 beshort 20 PowerPC or cisco 4500,
  4327. >>18 beshort 21 64-bit PowerPC or cisco 7500,
  4328. >>18 beshort 22 IBM S/390,
  4329. >>18 beshort 23 Cell SPU,
  4330. >>18 beshort 24 cisco SVIP,
  4331. >>18 beshort 25 cisco 7200,
  4332. >>18 beshort 36 NEC V800 or cisco 12000,
  4333. >>18 beshort 37 Fujitsu FR20,
  4334. >>18 beshort 38 TRW RH-32,
  4335. >>18 beshort 39 Motorola RCE,
  4336. >>18 beshort 40 ARM,
  4337. >>18 beshort 41 Alpha,
  4338. >>18 beshort 42 Renesas SH,
  4339. >>18 beshort 43 SPARC V9,
  4340. >>18 beshort 44 Siemens Tricore Embedded Processor,
  4341. >>18 beshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
  4342. >>18 beshort 46 Renesas H8/300,
  4343. >>18 beshort 47 Renesas H8/300H,
  4344. >>18 beshort 48 Renesas H8S,
  4345. >>18 beshort 49 Renesas H8/500,
  4346. >>18 beshort 50 IA-64,
  4347. >>18 beshort 51 Stanford MIPS-X,
  4348. >>18 beshort 52 Motorola Coldfire,
  4349. >>18 beshort 53 Motorola M68HC12,
  4350. >>18 beshort 73 Cray NV1,
  4351. >>18 beshort 75 Digital VAX,
  4352. >>18 beshort 88 Renesas M32R,
  4353. >>18 beshort 94 Tensilica Xtensa,
  4354. >>18 beshort 97 NatSemi 32k,
  4355. >>18 beshort 0x18ad AVR32 (unofficial),
  4356. >>18 beshort 0x9026 Alpha (unofficial),
  4357. >>18 beshort 0xa390 IBM S/390 (obsolete),
  4358. >>20 belong 0 invalid version
  4359. >>20 belong 1 version 1
  4360. >>36 belong 1 MathCoPro/FPU/MAU Required
  4361. # Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
  4362. # like proper ELF, but extracting the string had bad results.
  4363. >4 byte <0x80
  4364. >>8 string >\0 (%s)
  4365. >8 string \0
  4366. >>7 byte 0 (SYSV)
  4367. >>7 byte 1 (HP-UX)
  4368. >>7 byte 2 (NetBSD)
  4369. >>7 byte 3 (GNU/Linux)
  4370. >>7 byte 4 (GNU/Hurd)
  4371. >>7 byte 5 (86Open)
  4372. >>7 byte 6 (Solaris)
  4373. >>7 byte 7 (Monterey)
  4374. >>7 byte 8 (IRIX)
  4375. >>7 byte 9 (FreeBSD)
  4376. >>7 byte 10 (Tru64)
  4377. >>7 byte 11 (Novell Modesto)
  4378. >>7 byte 12 (OpenBSD)
  4379. # VMS Itanium added by gerardo.cacciari@gmail.com
  4380. >8 string \2
  4381. >>7 byte 13 (OpenVMS)
  4382. >>7 byte 97 (ARM)
  4383. >>7 byte 255 (embedded)
  4384.  
  4385. #------------------------------------------------------------------------------
  4386. # encore: file(1) magic for Encore machines
  4387. #
  4388. # XXX - needs to have the byte order specified (NS32K was little-endian,
  4389. # dunno whether they run the 88K in little-endian mode or not).
  4390. #
  4391. 0 short 0x154 Encore
  4392. >20 short 0x107 executable
  4393. >20 short 0x108 pure executable
  4394. >20 short 0x10b demand-paged executable
  4395. >20 short 0x10f unsupported executable
  4396. >12 long >0 not stripped
  4397. >22 short >0 - version %ld
  4398. >22 short 0 -
  4399. #>4 date x stamp %s
  4400. 0 short 0x155 Encore unsupported executable
  4401. >12 long >0 not stripped
  4402. >22 short >0 - version %ld
  4403. >22 short 0 -
  4404. #>4 date x stamp %s
  4405.  
  4406. #------------------------------------------------------------------------------
  4407. # Epoc 32 : file(1) magic for Epoc Documents [psion/osaris
  4408. # Stefan Praszalowicz (hpicollo@worldnet.fr)
  4409. #0 lelong 0x10000037 Epoc32
  4410. >4 lelong 0x1000006D
  4411. >>8 lelong 0x1000007F Word
  4412. >>8 lelong 0x10000088 Sheet
  4413. >>8 lelong 0x1000007D Sketch
  4414. >>8 lelong 0x10000085 TextEd
  4415.  
  4416. #------------------------------------------------------------------------------
  4417. # ESRI Shapefile format (.shp .shx .dbf=DBaseIII)
  4418. # Based on info from
  4419. # <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf>
  4420. 0 belong 9994 ESRI Shapefile
  4421. >4 belong =0
  4422. >8 belong =0
  4423. >12 belong =0
  4424. >16 belong =0
  4425. >20 belong =0
  4426. >28 lelong x version %d
  4427. >24 belong x length %d
  4428. >32 lelong =0 type Null Shape
  4429. >32 lelong =1 type Point
  4430. >32 lelong =3 type PolyLine
  4431. >32 lelong =5 type Polygon
  4432. >32 lelong =8 type MultiPoint
  4433. >32 lelong =11 type PointZ
  4434. >32 lelong =13 type PolyLineZ
  4435. >32 lelong =15 type PolygonZ
  4436. >32 lelong =18 type MultiPointZ
  4437. >32 lelong =21 type PointM
  4438. >32 lelong =23 type PolyLineM
  4439. >32 lelong =25 type PolygonM
  4440. >32 lelong =28 type MultiPointM
  4441. >32 lelong =31 type MultiPatch
  4442.  
  4443. #------------------------------------------------------------------------------
  4444. # fcs: file(1) magic for FCS (Flow Cytometry Standard) data files
  4445. # From Roger Leigh <roger@whinlatter.uklinux.net>
  4446. 0 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0
  4447. 0 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0
  4448. 0 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0
  4449.  
  4450.  
  4451. #------------------------------------------------------------------------------
  4452. # filesystems: file(1) magic for different filesystems
  4453. #
  4454. 0 string \366\366\366\366 PC formatted floppy with no filesystem
  4455. # Sun disk labels
  4456. # From /usr/include/sun/dklabel.h:
  4457. 0774 beshort 0xdabe
  4458. # modified by Joerg Jenderek, because original test
  4459. # succeeds for Cabinet archive dao360.dl_ with negative blocks
  4460. >0770 long >0 Sun disk label
  4461. >>0 string x '%s
  4462. >>>31 string >\0 \b%s
  4463. >>>>63 string >\0 \b%s
  4464. >>>>>95 string >\0 \b%s
  4465. >>0 string x \b'
  4466. >>0734 short >0 %d rpm,
  4467. >>0736 short >0 %d phys cys,
  4468. >>0740 short >0 %d alts/cyl,
  4469. >>0746 short >0 %d interleave,
  4470. >>0750 short >0 %d data cyls,
  4471. >>0752 short >0 %d alt cyls,
  4472. >>0754 short >0 %d heads/partition,
  4473. >>0756 short >0 %d sectors/track,
  4474. >>0764 long >0 start cyl %ld,
  4475. >>0770 long x %ld blocks
  4476. # Is there a boot block written 1 sector in?
  4477. >512 belong&077777777 0600407 \b, boot block present
  4478. # Joerg Jenderek: Smart Boot Manager backup file is 41 byte header + first sectors of disc
  4479. # (http://btmgr.sourceforge.net/docs/user-guide-3.html)
  4480. 0 string SBMBAKUP_ Smart Boot Manager backup file
  4481. >9 string x \b, version %-5.5s
  4482. >>14 string =_
  4483. >>>15 string x %-.1s
  4484. >>>>16 string =_ \b.
  4485. >>>>>17 string x \b%-.1s
  4486. >>>>>>18 string =_ \b.
  4487. >>>>>>>19 string x \b%-.1s
  4488. >>>22 ubyte 0
  4489. >>>>21 ubyte x \b, from drive 0x%x
  4490. >>>22 ubyte >0
  4491. >>>>21 string x \b, from drive %s
  4492.  
  4493. # Joerg Jenderek
  4494. # DOS Emulator image is 128 byte, null right padded header + harddisc image
  4495. 0 string DOSEMU\0
  4496. >0x27E leshort 0xAA55
  4497. #offset is 128
  4498. >>19 ubyte 128
  4499. >>>(19.b-1) ubyte 0x0 DOS Emulator image
  4500. >>>>7 ulelong >0 \b, %u heads
  4501. >>>>11 ulelong >0 \b, %d sectors/track
  4502. >>>>15 ulelong >0 \b, %d cylinders
  4503.  
  4504. # updated by Joerg Jenderek at Sep 2007
  4505. # only for sector sizes with 512 or more Bytes
  4506. 0x1FE leshort 0xAA55 x86 boot sector
  4507. # to do also for sectors < than 512 Bytes and some other files, GRR
  4508. #30 search/481 \x55\xAA x86 boot sector
  4509. # not for BeOS floppy 1440k, MBRs
  4510. #(11.s-2) uleshort 0xAA55 x86 boot sector
  4511. >2 string OSBS \b, OS/BS MBR
  4512. # J\xf6rg Jenderek <joerg dot jenderek at web dot de>
  4513. >0x8C string Invalid\ partition\ table \b, MS-DOS MBR
  4514. # dr-dos with some upper-, lowercase variants
  4515. >0x9D string Invalid\ partition\ table$
  4516. >>181 string No\ Operating\ System$
  4517. >>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
  4518. >0x9D string Invalid\ partition\ table$
  4519. >>181 string No\ operating\ system$
  4520. >>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
  4521. >342 string Invalid\ partition\ table$
  4522. >>366 string No\ operating\ system$
  4523. >>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03
  4524. >295 string NEWLDR\0
  4525. >>302 string Bad\ PT\ $
  4526. >>>310 string No\ OS\ $
  4527. >>>>317 string OS\ load\ err$
  4528. >>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r
  4529. >>>>>>358 string Press\ any\ key\ to\ continue.\n\r$
  4530. >>>>>>>387 string Copyright\ (c)\ 1984,1998
  4531. >>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR)
  4532. >0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222
  4533. >>0x1B8 ubelong >0 \b, Serial 0x%-.4x
  4534. >0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950
  4535. >271 string Invalid\ partition\ table\0
  4536. >>295 string Error\ loading\ operating\ system\0
  4537. >>>326 string Missing\ operating\ system\0 \b, mbr
  4538. #
  4539. >139 string Invalid\ partition\ table\0
  4540. >>163 string Error\ loading\ operating\ system\0
  4541. >>>194 string Missing\ operating\ system\0 \b, Microsoft Windows XP mbr
  4542. # http://www.heise.de/ct/05/09/006/ page 184
  4543. #HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\DosDevices\?:=Serial4Bytes+8Bytes
  4544. >>>>0x1B8 ulelong >0 \b,Serial 0x%-.4x
  4545. >300 string Invalid\ partition\ table\0
  4546. >>324 string Error\ loading\ operating\ system\0
  4547. >>>355 string Missing\ operating\ system\0 \b, Microsoft Windows XP MBR
  4548. #??>>>389 string Invalid\ system\ disk
  4549. >>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x
  4550. >300 string Ung\201ltige\ Partitionstabelle
  4551. #split string to avoid error: String too long
  4552. >>328 string Fehler\ beim\ Laden\
  4553. >>>346 string des\ Betriebssystems
  4554. >>>>366 string Betriebssystem\ nicht\ vorhanden \b, Microsoft Windows XP MBR (german)
  4555. >>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x
  4556. >0x145 string Default:\ F \b, FREE-DOS MBR
  4557. >64 string no\ active\ partition\ found
  4558. >>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR
  4559. >271 string Operating\ system\ loading
  4560. >>296 string error\r \b, SYSLINUX MBR (2.10)
  4561. # http://www.acronis.de/
  4562. >362 string MBR\ Error\ \0\r
  4563. >>376 string ress\ any\ key\ to\
  4564. >>>392 string boot\ from\ floppy...\0 \b, Acronis MBR
  4565. # added by Joerg Jenderek
  4566. # http://www.visopsys.org/
  4567. # http://partitionlogic.org.uk/
  4568. >309 string No\ bootable\ partition\ found\r
  4569. >>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR
  4570. >349 string No\ bootable\ partition\ found\r
  4571. >>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR
  4572. # bootloader, bootmanager
  4573. >0x40 string SBML
  4574. # label with 11 characters of FAT 12 bit filesystem
  4575. >>43 string SMART\ BTMGR
  4576. >>>430 string SBMK\ Bad!\r
  4577. >>>>3 string SBM \b, Smart Boot Manager
  4578. >>>>>6 string >\0 \b, version %s
  4579. >382 string XOSLLOADXCF \b, eXtended Operating System Loader
  4580. >6 string LILO \b, LInux i386 boot LOader
  4581. >>120 string LILO \b, version 22.3.4 SuSe
  4582. >>172 string LILO \b, version 22.5.8 Debian
  4583. # updated by Joerg Jenderek
  4584. # variables according to grub-0.97/stage1/stage1.S or
  4585. # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
  4586. # usual values are marked with comments to get only informations of strange GRUB loaders
  4587. >0 ulelong 0x009048EB
  4588. >>0x41 ubyte <2
  4589. >>>0x3E ubyte >2 \b; GRand Unified Bootloader
  4590. # 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
  4591. >>>>0x3E ubyte x \b, stage1 version 0x%x
  4592. #If it is 0xFF, use a drive passed by BIOS
  4593. >>>>0x40 ubyte <0xFF \b, boot drive 0x%x
  4594. # in most case 0,1,0x2e for GRUB 0.5.95
  4595. >>>>0x41 ubyte >0 \b, LBA flag 0x%x
  4596. >>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x
  4597. #>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual)
  4598. >>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x
  4599. #>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default)
  4600. >>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x
  4601. >>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x
  4602. #>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual)
  4603. >>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x
  4604. >>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0
  4605. >>>>>394 string stage1 \b, GRUB version 0.5.95
  4606. >>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0
  4607. >>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94
  4608. >>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0
  4609. >>>>>377 string GRUB\ \0 \b, GRUB version 0.94
  4610. >>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0
  4611. >>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96
  4612. >>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0
  4613. >>>>>385 string GRUB\ \0 \b, GRUB version 0.97
  4614. #unkown version
  4615. >>>343 string Geom\0Read\0\ Error\0
  4616. >>>>321 string Loading\ stage1.5 \b, GRUB version x.y
  4617. >>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0
  4618. >>>>374 string GRUB\ \0 \b, GRUB version n.m
  4619. # http://syslinux.zytor.com/
  4620. >478 string Boot\ failed\r
  4621. >>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (1.62)
  4622. >480 string Boot\ failed\r
  4623. >>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (2.06 or 2.11)
  4624. >484 string Boot\ error\r \b, SYSLINUX bootloader (3.11)
  4625. >395 string chksum\0\ ERROR!\0 \b, Gujin bootloader
  4626. # http://www.bcdwb.de/bcdw/index_e.htm
  4627. >3 string BCDL
  4628. >>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z)
  4629. # mbr partion table entries
  4630. # OEM-ID not Microsoft,SYSLINUX,or MTOOLs
  4631. >3 string !MS
  4632. >>3 string !SYSLINUX
  4633. >>>3 string !MTOOL
  4634. # not FAT (32 bit)
  4635. >>>>82 string !FAT32
  4636. #not IO.SYS
  4637. >>>>>472 string !IO\ \ \ \ \ \ SYS
  4638. >>>>>>480 string !IO\ \ \ \ \ \ SYS
  4639. #not Linux kernel
  4640. >>>>>>>514 string !HdrS
  4641. #not BeOS
  4642. >>>>>>>>422 string !Be\ Boot\ Loader
  4643. # active flag 0 or 0x80 and type > 0
  4644. >>>>>>>>>446 ubyte <0x81
  4645. >>>>>>>>>>446 ubyte&0x7F 0
  4646. >>>>>>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x
  4647. >>>>>>>>>>>>446 ubyte 0x80 \b, active
  4648. >>>>>>>>>>>>447 ubyte x \b, starthead %u
  4649. #>>>>>>>>>>>>448 ubyte x \b, start C_S: 0x%x
  4650. #>>>>>>>>>>>>448 ubeshort&1023 x \b, startcylinder? %d
  4651. >>>>>>>>>>>>454 ulelong x \b, startsector %u
  4652. >>>>>>>>>>>>458 ulelong x \b, %u sectors
  4653. #
  4654. >>>>>>>>>462 ubyte <0x81
  4655. >>>>>>>>>>462 ubyte&0x7F 0
  4656. >>>>>>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x
  4657. >>>>>>>>>>>>462 ubyte 0x80 \b, active
  4658. >>>>>>>>>>>>463 ubyte x \b, starthead %u
  4659. #>>>>>>>>>>>>464 ubyte x \b, start C_S: 0x%x
  4660. #>>>>>>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d
  4661. >>>>>>>>>>>>470 ulelong x \b, startsector %u
  4662. >>>>>>>>>>>>474 ulelong x \b, %u sectors
  4663. #
  4664. >>>>>>>>>478 ubyte <0x81
  4665. >>>>>>>>>>478 ubyte&0x7F 0
  4666. >>>>>>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x
  4667. >>>>>>>>>>>>478 ubyte 0x80 \b, active
  4668. >>>>>>>>>>>>479 ubyte x \b, starthead %u
  4669. #>>>>>>>>>>>>480 ubyte x \b, start C_S: 0x%x
  4670. #>>>>>>>>>>>>481 ubyte x \b, start C2S: 0x%x
  4671. #>>>>>>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d
  4672. >>>>>>>>>>>>486 ulelong x \b, startsector %u
  4673. >>>>>>>>>>>>490 ulelong x \b, %u sectors
  4674. #
  4675. >>>>>>>>>494 ubyte <0x81
  4676. >>>>>>>>>>494 ubyte&0x7F 0
  4677. >>>>>>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x
  4678. >>>>>>>>>>>>494 ubyte 0x80 \b, active
  4679. >>>>>>>>>>>>495 ubyte x \b, starthead %u
  4680. #>>>>>>>>>>>>496 ubyte x \b, start C_S: 0x%x
  4681. #>>>>>>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d
  4682. >>>>>>>>>>>>502 ulelong x \b, startsector %u
  4683. >>>>>>>>>>>>506 ulelong x \b, %u sectors
  4684. # mbr partion table entries end
  4685. # http://www.acronis.de/
  4686. #FAT label=ACRONIS\ SZ
  4687. #OEM-ID=BOOTWIZ0
  4688. >442 string Non-system\ disk,\
  4689. >>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader
  4690. # DOS names like F11.SYS are 8 right space padded bytes+3 bytes
  4691. >>>477 ubyte&0xDF >0
  4692. >>>>477 string x \b %-.3s
  4693. >>>>>480 ubyte&0xDF >0
  4694. >>>>>>480 string x \b%-.5s
  4695. >>>>485 ubyte&0xDF >0
  4696. >>>>>485 string x \b.%-.3s
  4697. #
  4698. >185 string FDBOOT\ Version\
  4699. >>204 string \rNo\ Systemdisk.\
  4700. >>>220 string Booting\ from\ harddisk.\n\r
  4701. >>>245 string Cannot\ load\ from\ harddisk.\n\r
  4702. >>>>273 string Insert\ Systemdisk\
  4703. >>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader
  4704. >>>>>>200 string >\0 \b, version %-3s
  4705. >242 string Bootsector\ from\ C.H.\ Hochst\204
  4706. >>278 string No\ Systemdisk.\
  4707. >>>293 string Booting\ from\ harddisk.\n\r
  4708. >>>441 string Cannot\ load\ from\ harddisk.\n\r
  4709. >>>>469 string Insert\ Systemdisk\
  4710. >>>>>487 string and\ press\ any\ key.\n\r \b, WinImage harddisk Bootloader
  4711. >>>>>>209 string >\0 \b, version %-4.4s
  4712. >(1.b+2) ubyte 0xe
  4713. >>(1.b+3) ubyte 0x1f
  4714. >>>(1.b+4) ubyte 0xbe
  4715. >>>>(1.b+5) ubyte 0x77
  4716. >>>>(1.b+6) ubyte 0x7c
  4717. >>>>>(1.b+7) ubyte 0xac
  4718. >>>>>>(1.b+8) ubyte 0x22
  4719. >>>>>>>(1.b+9) ubyte 0xc0
  4720. >>>>>>>>(1.b+10) ubyte 0x74
  4721. >>>>>>>>>(1.b+11) ubyte 0xb
  4722. >>>>>>>>>>(1.b+12) ubyte 0x56
  4723. >>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display
  4724. >103 string This\ is\ not\ a\ bootable\ disk.\
  4725. >>132 string Please\ insert\ a\ bootable\
  4726. >>>157 string floppy\ and\r\n
  4727. >>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display
  4728. #
  4729. >66 string Solaris\ Boot\ Sector
  4730. >>99 string Incomplete\ MDBoot\ load.
  4731. >>>89 string Version \b, Sun Solaris Bootloader
  4732. >>>>97 byte x version %c
  4733. #
  4734. >408 string OS/2\ !!\ SYS01475\r\0
  4735. >>429 string OS/2\ !!\ SYS02025\r\0
  4736. >>>450 string OS/2\ !!\ SYS02027\r\0
  4737. >>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader
  4738. #
  4739. >409 string OS/2\ !!\ SYS01475\r\0
  4740. >>430 string OS/2\ !!\ SYS02025\r\0
  4741. >>>451 string OS/2\ !!\ SYS02027\r\0
  4742. >>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader
  4743. >112 string This\ disk\ is\ not\ bootable\r
  4744. >>142 string If\ you\ wish\ to\ make\ it\ bootable
  4745. >>>176 string run\ the\ DOS\ program\ SYS\
  4746. >>>200 string after\ the\r
  4747. >>>>216 string system\ has\ been\ loaded\r\n
  4748. >>>>>242 string Please\ insert\ a\ DOS\ diskette\
  4749. >>>>>271 string into\r\n\ the\ drive\ and\
  4750. >>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display
  4751. # XP
  4752. >430 string NTLDR\ is\ missing\xFF\r\n
  4753. >>449 string Disk\ error\xFF\r\n
  4754. >>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader
  4755. # DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
  4756. >>>>417 ubyte&0xDF >0
  4757. >>>>>417 string x %-.5s
  4758. >>>>>>422 ubyte&0xDF >0
  4759. >>>>>>>422 string x \b%-.3s
  4760. >>>>>425 ubyte&0xDF >0
  4761. >>>>>>425 string >\ \b.%-.3s
  4762. #
  4763. >>>>371 ubyte >0x20
  4764. >>>>>368 ubyte&0xDF >0
  4765. >>>>>>368 string x %-.5s
  4766. >>>>>>>373 ubyte&0xDF >0
  4767. >>>>>>>>373 string x \b%-.3s
  4768. >>>>>>376 ubyte&0xDF >0
  4769. >>>>>>>376 string x \b.%-.3s
  4770. #
  4771. >430 string NTLDR\ nicht\ gefunden\xFF\r\n
  4772. >>453 string Datentr\204gerfehler\xFF\r\n
  4773. >>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german)
  4774. >>>>417 ubyte&0xDF >0
  4775. >>>>>417 string x %-.5s
  4776. >>>>>>422 ubyte&0xDF >0
  4777. >>>>>>>422 string x \b%-.3s
  4778. >>>>>425 ubyte&0xDF >0
  4779. >>>>>>425 string >\ \b.%-.3s
  4780. # offset variant
  4781. >>>>379 string \0
  4782. >>>>>368 ubyte&0xDF >0
  4783. >>>>>>368 string x %-.5s
  4784. >>>>>>>373 ubyte&0xDF >0
  4785. >>>>>>>>373 string x \b%-.3s
  4786. #
  4787. >430 string NTLDR\ fehlt\xFF\r\n
  4788. >>444 string Datentr\204gerfehler\xFF\r\n
  4789. >>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german)
  4790. >>>>417 ubyte&0xDF >0
  4791. >>>>>417 string x %-.5s
  4792. >>>>>>422 ubyte&0xDF >0
  4793. >>>>>>>422 string x \b%-.3s
  4794. >>>>>425 ubyte&0xDF >0
  4795. >>>>>>425 string >\ \b.%-.3s
  4796. # variant
  4797. >>>>371 ubyte >0x20
  4798. >>>>>368 ubyte&0xDF >0
  4799. >>>>>>368 string x %-.5s
  4800. >>>>>>>373 ubyte&0xDF >0
  4801. >>>>>>>>373 string x \b%-.3s
  4802. >>>>>>376 ubyte&0xDF >0
  4803. >>>>>>>376 string x \b.%-.3s
  4804. #
  4805. >430 string NTLDR\ fehlt\xFF\r\n
  4806. >>444 string Medienfehler\xFF\r\n
  4807. >>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german)
  4808. >>>>371 ubyte >0x20
  4809. >>>>>368 ubyte&0xDF >0
  4810. >>>>>>368 string x %-.5s
  4811. >>>>>>>373 ubyte&0xDF >0
  4812. >>>>>>>>373 string x \b%-.3s
  4813. >>>>>>376 ubyte&0xDF >0
  4814. >>>>>>>376 string x \b.%-.3s
  4815. # variant
  4816. >>>>417 ubyte&0xDF >0
  4817. >>>>>417 string x %-.5s
  4818. >>>>>>422 ubyte&0xDF >0
  4819. >>>>>>>422 string x \b%-.3s
  4820. >>>>>425 ubyte&0xDF >0
  4821. >>>>>>425 string >\ \b.%-.3s
  4822. #
  4823. >430 string Datentr\204ger\ entfernen\xFF\r\n
  4824. >>454 string Medienfehler\xFF\r\n
  4825. >>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german)
  4826. >>>>368 ubyte&0xDF >0
  4827. >>>>>368 string x %-.5s
  4828. >>>>>>373 ubyte&0xDF >0
  4829. >>>>>>>373 string x \b%-.3s
  4830. >>>>>376 ubyte&0xDF >0
  4831. >>>>>>376 string x \b.%-.3s
  4832. #>3 string NTFS\ \ \ \
  4833. >389 string Fehler\ beim\ Lesen\
  4834. >>407 string des\ Datentr\204gers
  4835. >>>426 string NTLDR\ fehlt
  4836. >>>>440 string NTLDR\ ist\ komprimiert
  4837. >>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german)
  4838. #>3 string NTFS\ \ \ \
  4839. >313 string A\ disk\ read\ error\ occurred.\r
  4840. >>345 string A\ kernel\ file\ is\ missing\
  4841. >>>370 string from\ the\ disk.\r
  4842. >>>>484 string NTLDR\ is\ compressed
  4843. >>>>>429 string Insert\ a\ system\ diskette\
  4844. >>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS
  4845. # DOS loader variants different languages,offsets
  4846. >472 ubyte&0xDF >0
  4847. >>389 string Invalid\ system\ disk\xFF\r\n
  4848. >>>411 string Disk\ I/O\ error
  4849. >>>>428 string Replace\ the\ disk,\ and\
  4850. >>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader
  4851. #IO.SYS
  4852. >>>>>>472 ubyte&0xDF >0
  4853. >>>>>>>472 string x \b %-.2s
  4854. >>>>>>>>474 ubyte&0xDF >0
  4855. >>>>>>>>>474 string x \b%-.5s
  4856. >>>>>>>>>>479 ubyte&0xDF >0
  4857. >>>>>>>>>>>479 string x \b%-.1s
  4858. >>>>>>>480 ubyte&0xDF >0
  4859. >>>>>>>>480 string x \b.%-.3s
  4860. #MSDOS.SYS
  4861. >>>>>>>483 ubyte&0xDF >0 \b+
  4862. >>>>>>>>483 string x \b%-.5s
  4863. >>>>>>>>>488 ubyte&0xDF >0
  4864. >>>>>>>>>>488 string x \b%-.3s
  4865. >>>>>>>>491 ubyte&0xDF >0
  4866. >>>>>>>>>491 string x \b.%-.3s
  4867. #
  4868. >>390 string Invalid\ system\ disk\xFF\r\n
  4869. >>>412 string Disk\ I/O\ error\xFF\r\n
  4870. >>>>429 string Replace\ the\ disk,\ and\
  4871. >>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader
  4872. >>388 string Ungueltiges\ System\ \xFF\r\n
  4873. >>>410 string E/A-Fehler\ \ \ \ \xFF\r\n
  4874. >>>>427 string Datentraeger\ wechseln\ und\
  4875. >>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german)
  4876. #WINBOOT.SYS only not spaces (0xDF)
  4877. >>>>>>497 ubyte&0xDF >0
  4878. >>>>>>>497 string x %-.5s
  4879. >>>>>>>>502 ubyte&0xDF >0
  4880. >>>>>>>>>502 string x \b%-.1s
  4881. >>>>>>>>>>503 ubyte&0xDF >0
  4882. >>>>>>>>>>>503 string x \b%-.1s
  4883. >>>>>>>>>>>>504 ubyte&0xDF >0
  4884. >>>>>>>>>>>>>504 string x \b%-.1s
  4885. >>>>>>505 ubyte&0xDF >0
  4886. >>>>>>>505 string x \b.%-.3s
  4887. #IO.SYS
  4888. >>>>>>472 ubyte&0xDF >0 or
  4889. >>>>>>>472 string x \b %-.2s
  4890. >>>>>>>>474 ubyte&0xDF >0
  4891. >>>>>>>>>474 string x \b%-.5s
  4892. >>>>>>>>>>479 ubyte&0xDF >0
  4893. >>>>>>>>>>>479 string x \b%-.1s
  4894. >>>>>>>480 ubyte&0xDF >0
  4895. >>>>>>>>480 string x \b.%-.3s
  4896. #MSDOS.SYS
  4897. >>>>>>>483 ubyte&0xDF >0 \b+
  4898. >>>>>>>>483 string x \b%-.5s
  4899. >>>>>>>>>488 ubyte&0xDF >0
  4900. >>>>>>>>>>488 string x \b%-.3s
  4901. >>>>>>>>491 ubyte&0xDF >0
  4902. >>>>>>>>>491 string x \b.%-.3s
  4903. #
  4904. >>390 string Ungueltiges\ System\ \xFF\r\n
  4905. >>>412 string E/A-Fehler\ \ \ \ \xFF\r\n
  4906. >>>>429 string Datentraeger\ wechseln\ und\
  4907. >>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German)
  4908. #WINBOOT.SYS only not spaces (0xDF)
  4909. >>>>>>497 ubyte&0xDF >0
  4910. >>>>>>>497 string x %-.7s
  4911. >>>>>>>>504 ubyte&0xDF >0
  4912. >>>>>>>>>504 string x \b%-.1s
  4913. >>>>>>505 ubyte&0xDF >0
  4914. >>>>>>>505 string x \b.%-.3s
  4915. #IO.SYS
  4916. >>>>>>472 ubyte&0xDF >0 or
  4917. >>>>>>>472 string x \b %-.2s
  4918. >>>>>>>>474 ubyte&0xDF >0
  4919. >>>>>>>>>474 string x \b%-.6s
  4920. >>>>>>>480 ubyte&0xDF >0
  4921. >>>>>>>>480 string x \b.%-.3s
  4922. #MSDOS.SYS
  4923. >>>>>>>483 ubyte&0xDF >0 \b+
  4924. >>>>>>>>483 string x \b%-.5s
  4925. >>>>>>>>>488 ubyte&0xDF >0
  4926. >>>>>>>>>>488 string x \b%-.3s
  4927. >>>>>>>>491 ubyte&0xDF >0
  4928. >>>>>>>>>491 string x \b.%-.3s
  4929. #
  4930. >>389 string Ungueltiges\ System\ \xFF\r\n
  4931. >>>411 string E/A-Fehler\ \ \ \ \xFF\r\n
  4932. >>>>428 string Datentraeger\ wechseln\ und\
  4933. >>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
  4934. # DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
  4935. >>>>>>472 string x %-.2s
  4936. >>>>>>>474 ubyte&0xDF >0
  4937. >>>>>>>>474 string x \b%-.5s
  4938. >>>>>>>>479 ubyte&0xDF >0
  4939. >>>>>>>>>479 string x \b%-.1s
  4940. >>>>>>480 ubyte&0xDF >0
  4941. >>>>>>>480 string x \b.%-.3s
  4942. >>>>>>483 ubyte&0xDF >0 \b+
  4943. >>>>>>>483 string x \b%-.5s
  4944. >>>>>>>488 ubyte&0xDF >0
  4945. >>>>>>>>488 string x \b%-.2s
  4946. >>>>>>>>490 ubyte&0xDF >0
  4947. >>>>>>>>>490 string x \b%-.1s
  4948. >>>>>>>491 ubyte&0xDF >0
  4949. >>>>>>>>491 string x \b.%-.3s
  4950. >479 ubyte&0xDF >0
  4951. >>416 string Kein\ System\ oder\
  4952. >>>433 string Laufwerksfehler
  4953. >>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german)
  4954. #IO.SYS
  4955. >>>>>479 string x \b %-.2s
  4956. >>>>>>481 ubyte&0xDF >0
  4957. >>>>>>>481 string x \b%-.6s
  4958. >>>>>487 ubyte&0xDF >0
  4959. >>>>>>487 string x \b.%-.3s
  4960. #MSDOS.SYS
  4961. >>>>>>490 ubyte&0xDF >0 \b+
  4962. >>>>>>>490 string x \b%-.5s
  4963. >>>>>>>>495 ubyte&0xDF >0
  4964. >>>>>>>>>495 string x \b%-.3s
  4965. >>>>>>>498 ubyte&0xDF >0
  4966. >>>>>>>>498 string x \b.%-.3s
  4967. #
  4968. >376 search/41 Non-System\ disk\ or\
  4969. >>395 search/41 disk\ error\r
  4970. >>>407 search/41 Replace\ and\
  4971. >>>>419 search/41 press\ \b,
  4972. >>>>419 search/41 strike\ \b, old
  4973. >>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader
  4974. #449 Disk\ Boot\ failure\r MS 3.21
  4975. #466 Boot\ Failure\r MS 3.30
  4976. >>>>>468 search/18 \0
  4977. #IO.SYS,IBMBIO.COM
  4978. >>>>>>&0 string x \b %-.2s
  4979. >>>>>>>&-20 ubyte&0xDF >0
  4980. >>>>>>>>&-1 string x \b%-.4s
  4981. >>>>>>>>>&-16 ubyte&0xDF >0
  4982. >>>>>>>>>>&-1 string x \b%-.2s
  4983. >>>>>>&8 ubyte&0xDF >0 \b.
  4984. >>>>>>>&-1 string x \b%-.3s
  4985. #MSDOS.SYS,IBMDOS.COM
  4986. >>>>>>&11 ubyte&0xDF >0 \b+
  4987. >>>>>>>&-1 string x \b%-.5s
  4988. >>>>>>>>&-6 ubyte&0xDF >0
  4989. >>>>>>>>>&-1 string x \b%-.1s
  4990. >>>>>>>>>>&-5 ubyte&0xDF >0
  4991. >>>>>>>>>>>&-1 string x \b%-.2s
  4992. >>>>>>>&7 ubyte&0xDF >0 \b.
  4993. >>>>>>>>&-1 string x \b%-.3s
  4994. >441 string Cannot\ load\ from\ harddisk.\n\r
  4995. >>469 string Insert\ Systemdisk\
  4996. >>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader
  4997. #>43 string \224R-LOADER\ \ SYS =label
  4998. >54 string SYS
  4999. >>324 string VASKK
  5000. >>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS)
  5001. #
  5002. >98 string Press\ a\ key\ to\ retry\0\r
  5003. >>120 string Cannot\ find\ file\ \0\r
  5004. >>>139 string Disk\ read\ error\0\r
  5005. >>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader
  5006. #DRBIOS.SYS
  5007. >>>>>44 ubyte&0xDF >0
  5008. >>>>>>44 string x \b %-.6s
  5009. >>>>>>>50 ubyte&0xDF >0
  5010. >>>>>>>>50 string x \b%-.2s
  5011. >>>>>>52 ubyte&0xDF >0
  5012. >>>>>>>52 string x \b.%-.3s
  5013. #
  5014. >70 string IBMBIO\ \ COM
  5015. >>472 string Cannot\ load\ DOS!\
  5016. >>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader
  5017. >>471 string Cannot\ load\ DOS\
  5018. >>487 string press\ key\ to\ retry \b, Open-DOS Bootloader
  5019. >444 string KERNEL\ \ SYS
  5020. >>314 string BOOT\ error! \b, FREE-DOS Bootloader
  5021. >499 string KERNEL\ \ SYS
  5022. >>305 string BOOT\ err!\0 \b, Free-DOS Bootloader
  5023. >449 string KERNEL\ \ SYS
  5024. >>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader
  5025. >125 string Loading\ FreeDOS...\r
  5026. >>311 string BOOT\ error!\r \b, FREE-DOS bootloader
  5027. >>>441 ubyte&0xDF >0
  5028. >>>>441 string x \b %-.6s
  5029. >>>>>447 ubyte&0xDF >0
  5030. >>>>>>447 string x \b%-.1s
  5031. >>>>>>>448 ubyte&0xDF >0
  5032. >>>>>>>>448 string x \b%-.1s
  5033. >>>>449 ubyte&0xDF >0
  5034. >>>>>449 string x \b.%-.3s
  5035. >124 string FreeDOS\0
  5036. >>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader
  5037. # DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
  5038. >>>497 ubyte&0xDF >0
  5039. >>>>497 string x \b %-.6s
  5040. >>>>>503 ubyte&0xDF >0
  5041. >>>>>>503 string x \b%-.1s
  5042. >>>>>>>504 ubyte&0xDF >0
  5043. >>>>>>>>504 string x \b%-.1s
  5044. >>>>505 ubyte&0xDF >0
  5045. >>>>>505 string x \b.%-.3s
  5046. >>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader
  5047. >>>497 ubyte&0xDF >0
  5048. >>>>497 string x \b %-.6s
  5049. >>>>>503 ubyte&0xDF >0
  5050. >>>>>>503 string x \b%-.1s
  5051. >>>>>>>504 ubyte&0xDF >0
  5052. >>>>>>>>504 string x \b%-.1s
  5053. >>>>505 ubyte&0xDF >0
  5054. >>>>>505 string x \b.%-.3s
  5055. >>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader
  5056. >>>497 ubyte&0xDF >0
  5057. >>>>497 string x \b %-.6s
  5058. >>>>>503 ubyte&0xDF >0
  5059. >>>>>>503 string x \b%-.1s
  5060. >>>>>>>504 ubyte&0xDF >0
  5061. >>>>>>>>504 string x \b%-.1s
  5062. >>>>505 ubyte&0xDF >0
  5063. >>>>>505 string x \b.%-.3s
  5064. >336 string Error!\
  5065. >>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader
  5066. >>>497 ubyte&0xDF >0
  5067. >>>>497 string x \b %-.6s
  5068. >>>>>503 ubyte&0xDF >0
  5069. >>>>>>503 string x \b%-.1s
  5070. >>>>>>>504 ubyte&0xDF >0
  5071. >>>>>>>>504 string x \b%-.1s
  5072. >>>>505 ubyte&0xDF >0
  5073. >>>>>505 string x \b.%-.3s
  5074. # added by Joerg Jenderek
  5075. # http://www.visopsys.org/
  5076. # http://partitionlogic.org.uk/
  5077. # OEM-ID=Visopsys
  5078. >478 ulelong 0
  5079. >>(1.b+326) string I/O\ Error\ reading\
  5080. >>>(1.b+344) string Visopsys\ loader\r
  5081. >>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader
  5082. # http://alexfru.chat.ru/epm.html#bootprog
  5083. >494 ubyte >0x4D
  5084. >>495 string >E
  5085. >>>495 string <S
  5086. #OEM-ID is not reliable
  5087. >>>>3 string BootProg
  5088. # It just looks for a program file name at the root directory
  5089. # and loads corresponding file with following execution.
  5090. # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
  5091. >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
  5092. >>>>>499 string x \b %-.1s
  5093. >>>>>>500 ubyte&0xDF >0
  5094. >>>>>>>500 string x \b%-.1s
  5095. >>>>>>>>501 ubyte&0xDF >0
  5096. >>>>>>>>>501 string x \b%-.1s
  5097. >>>>>>>>>>502 ubyte&0xDF >0
  5098. >>>>>>>>>>>502 string x \b%-.1s
  5099. >>>>>>>>>>>>503 ubyte&0xDF >0
  5100. >>>>>>>>>>>>>503 string x \b%-.1s
  5101. >>>>>>>>>>>>>>504 ubyte&0xDF >0
  5102. >>>>>>>>>>>>>>>504 string x \b%-.1s
  5103. >>>>>>>>>>>>>>>>505 ubyte&0xDF >0
  5104. >>>>>>>>>>>>>>>>>505 string x \b%-.1s
  5105. >>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
  5106. >>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
  5107. #name extension
  5108. >>>>>507 ubyte&0xDF >0 \b.
  5109. >>>>>>507 string x \b%-.1s
  5110. >>>>>>>508 ubyte&0xDF >0
  5111. >>>>>>>>508 string x \b%-.1s
  5112. >>>>>>>>>509 ubyte&0xDF >0
  5113. >>>>>>>>>>509 string x \b%-.1s
  5114. #If the boot sector fails to read any other sector,
  5115. #it prints a very short message ("RE") to the screen and hangs the computer.
  5116. #If the boot sector fails to find needed program in the root directory,
  5117. #it also hangs with another message ("NF").
  5118. >>>>>492 string RENF \b, FAT (12 bit)
  5119. >>>>>495 string RENF \b, FAT (16 bit)
  5120. # http://alexfru.chat.ru/epm.html#bootprog
  5121. >494 ubyte >0x4D
  5122. >>495 string >E
  5123. >>>495 string <S
  5124. #OEM-ID is not reliable
  5125. >>>>3 string BootProg
  5126. # It just looks for a program file name at the root directory
  5127. # and loads corresponding file with following execution.
  5128. # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
  5129. >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
  5130. >>>>>499 string x \b %-.1s
  5131. >>>>>>500 ubyte&0xDF >0
  5132. >>>>>>>500 string x \b%-.1s
  5133. >>>>>>>>501 ubyte&0xDF >0
  5134. >>>>>>>>>501 string x \b%-.1s
  5135. >>>>>>>>>>502 ubyte&0xDF >0
  5136. >>>>>>>>>>>502 string x \b%-.1s
  5137. >>>>>>>>>>>>503 ubyte&0xDF >0
  5138. >>>>>>>>>>>>>503 string x \b%-.1s
  5139. >>>>>>>>>>>>>>504 ubyte&0xDF >0
  5140. >>>>>>>>>>>>>>>504 string x \b%-.1s
  5141. >>>>>>>>>>>>>>>>505 ubyte&0xDF >0
  5142. >>>>>>>>>>>>>>>>>505 string x \b%-.1s
  5143. >>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
  5144. >>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
  5145. #name extension
  5146. >>>>>507 ubyte&0xDF >0 \b.
  5147. >>>>>>507 string x \b%-.1s
  5148. >>>>>>>508 ubyte&0xDF >0
  5149. >>>>>>>>508 string x \b%-.1s
  5150. >>>>>>>>>509 ubyte&0xDF >0
  5151. >>>>>>>>>>509 string x \b%-.1s
  5152. #If the boot sector fails to read any other sector,
  5153. #it prints a very short message ("RE") to the screen and hangs the computer.
  5154. #If the boot sector fails to find needed program in the root directory,
  5155. #it also hangs with another message ("NF").
  5156. >>>>>492 string RENF \b, FAT (12 bit)
  5157. >>>>>495 string RENF \b, FAT (16 bit)
  5158. # added by Joerg Jenderek
  5159. # http://syslinux.zytor.com/iso.php
  5160. 0 ulelong 0x7c40eafa isolinux Loader
  5161. # http://syslinux.zytor.com/pxe.php
  5162. 0 ulelong 0x007c05ea pxelinux Loader
  5163. 0 ulelong 0x60669c66 pxelinux Loader
  5164. # loader end
  5165. # updated by Joerg Jenderek at Sep 2007
  5166. >3 ubyte 0
  5167. #no active flag
  5168. >>446 ubyte 0
  5169. # partition 1 not empty
  5170. >>>450 ubyte >0
  5171. # partitions 3,4 empty
  5172. >>>>482 ubyte 0
  5173. >>>>>498 ubyte 0
  5174. # partition 2 ID=0,5,15
  5175. >>>>>>466 ubyte <0x10
  5176. >>>>>>>466 ubyte 0x05 \b, extended partition table
  5177. >>>>>>>466 ubyte 0x0F \b, extended partition table (LBA)
  5178. >>>>>>>466 ubyte 0x0 \b, extended partition table (last)
  5179. # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90
  5180. # http://mirror.href.com/thestarman/asm/2bytejumps.htmm#FWD
  5181. # older drives may use Near JuMP instruction E9 xx xx
  5182. >0 lelong&0x009000EB 0x009000EB
  5183. >0 lelong&0x000000E9 0x000000E9
  5184. # maximal short forward jump is 07fx
  5185. >1 ubyte <0xff \b, code offset 0x%x
  5186. # mtools-3.9.8/msdos.h
  5187. # usual values are marked with comments to get only informations of strange FAT systems
  5188. # valid sectorsize must be a power of 2 from 32 to 32768
  5189. >>11 uleshort&0x000f x
  5190. >>>11 uleshort <32769
  5191. >>>>11 uleshort >31
  5192. >>>>>3 string >\0 \b, OEM-ID "%8.8s"
  5193. #http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
  5194. >>>>>>8 string IHC \b cached by Windows 9M
  5195. >>>>>11 uleshort >512 \b, Bytes/sector %u
  5196. #>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual)
  5197. >>>>>11 uleshort <512 \b, Bytes/sector %u
  5198. >>>>>13 ubyte >1 \b, sectors/cluster %u
  5199. #>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
  5200. >>>>>14 uleshort >32 \b, reserved sectors %u
  5201. #>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
  5202. #>>>>>14 uleshort >1 \b, reserved sectors %u
  5203. #>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
  5204. >>>>>14 uleshort <1 \b, reserved sectors %u
  5205. >>>>>16 ubyte >2 \b, FATs %u
  5206. #>>>>>16 ubyte =2 \b, FATs %u (usual)
  5207. >>>>>16 ubyte =1 \b, FAT %u
  5208. >>>>>16 ubyte >0
  5209. >>>>>17 uleshort >0 \b, root entries %u
  5210. #>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32)
  5211. >>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
  5212. #>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32)
  5213. >>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
  5214. #>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
  5215. >>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x
  5216. >>>>>22 uleshort >0 \b, sectors/FAT %u
  5217. #>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32)
  5218. >>>>>26 ubyte >2 \b, heads %u
  5219. #>>>>>26 ubyte =2 \b, heads %u (usual floppy)
  5220. >>>>>26 ubyte =1 \b, heads %u
  5221. #skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk
  5222. >>>>>38 ubyte !0x70
  5223. >>>>>>28 ulelong >0 \b, hidden sectors %u
  5224. #>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
  5225. >>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
  5226. #>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
  5227. # FAT<32 specific
  5228. >>>>>82 string !FAT32
  5229. #>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
  5230. #>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy)
  5231. >>>>>>36 ubyte !0x80
  5232. >>>>>>>36 ubyte !0 \b, physical drive 0x%x
  5233. >>>>>>37 ubyte >0 \b, reserved 0x%x
  5234. #>>>>>>37 ubyte =0 \b, reserved 0x%x
  5235. >>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)
  5236. >>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)
  5237. >>>>>>38 ubyte =0x29
  5238. >>>>>>>39 ulelong x \b, serial number 0x%x
  5239. >>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
  5240. >>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
  5241. >>>>>>>43 string =NO\ NAME \b, unlabeled
  5242. >>>>>>54 string FAT \b, FAT
  5243. >>>>>>>54 string FAT12 \b (12 bit)
  5244. >>>>>>>54 string FAT16 \b (16 bit)
  5245. # FAT32 specific
  5246. >>>>>82 string FAT32 \b, FAT (32 bit)
  5247. >>>>>>36 ulelong x \b, sectors/FAT %u
  5248. >>>>>>40 uleshort >0 \b, extension flags %u
  5249. #>>>>>>40 uleshort =0 \b, extension flags %u
  5250. >>>>>>42 uleshort >0 \b, fsVersion %u
  5251. #>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
  5252. >>>>>>44 ulelong >2 \b, rootdir cluster %u
  5253. #>>>>>>44 ulelong =2 \b, rootdir cluster %u
  5254. #>>>>>>44 ulelong =1 \b, rootdir cluster %u
  5255. >>>>>>48 uleshort >1 \b, infoSector %u
  5256. #>>>>>>48 uleshort =1 \b, infoSector %u (usual)
  5257. >>>>>>48 uleshort <1 \b, infoSector %u
  5258. >>>>>>50 uleshort >6 \b, Backup boot sector %u
  5259. #>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
  5260. >>>>>>50 uleshort <6 \b, Backup boot sector %u
  5261. >>>>>>54 ulelong >0 \b, reserved1 0x%x
  5262. >>>>>>58 ulelong >0 \b, reserved2 0x%x
  5263. >>>>>>62 ulelong >0 \b, reserved3 0x%x
  5264. # same structure as FAT1X
  5265. >>>>>>64 ubyte >0x80 \b, physical drive 0x%x
  5266. #>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)
  5267. >>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x
  5268. #>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
  5269. >>>>>>65 ubyte >0 \b, reserved 0x%x
  5270. >>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)
  5271. >>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)
  5272. >>>>>>66 ubyte =0x29
  5273. >>>>>>>67 ulelong x \b, serial number 0x%x
  5274. >>>>>>>71 string <NO\ NAME \b, label: "%11.11s"
  5275. >>>>>>71 string >NO\ NAME \b, label: "%11.11s"
  5276. >>>>>>71 string =NO\ NAME \b, unlabeled
  5277. ### FATs end
  5278. >0x200 lelong 0x82564557 \b, BSD disklabel
  5279. # FATX
  5280. 0 string FATX FATX filesystem data
  5281.  
  5282.  
  5283. # Minix filesystems - Juan Cespedes <cespedes@debian.org>
  5284. 0x410 leshort 0x137f Minix filesystem
  5285. 0x410 beshort 0x137f Minix filesystem (big endian),
  5286. >0x402 beshort !0 \b, %d zones
  5287. >0x1e string minix \b, bootable
  5288. 0x410 leshort 0x138f Minix filesystem, 30 char names
  5289. 0x410 leshort 0x2468 Minix filesystem, version 2
  5290. 0x410 leshort 0x2478 Minix filesystem, version 2, 30 char names
  5291.  
  5292. # romfs filesystems - Juan Cespedes <cespedes@debian.org>
  5293. 0 string -rom1fs-\0 romfs filesystem, version 1
  5294. >8 belong x %d bytes,
  5295. >16 string x named %s.
  5296.  
  5297. # netboot image - Juan Cespedes <cespedes@debian.org>
  5298. 0 lelong 0x1b031336L Netboot image,
  5299. >4 lelong&0xFFFFFF00 0
  5300. >>4 lelong&0x100 0x000 mode 2
  5301. >>4 lelong&0x100 0x100 mode 3
  5302. >4 lelong&0xFFFFFF00 !0 unknown mode
  5303.  
  5304. 0x18b string OS/2 OS/2 Boot Manager
  5305.  
  5306. # added by Joerg Jenderek
  5307. # In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
  5308. # grub-1.94/kern/i386/pc/startup.S
  5309. # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
  5310. # usual values are marked with comments to get only informations of strange GRUB loaders
  5311. 0x200 uleshort 0x70EA
  5312. # found only version 3.{1,2}
  5313. >0x206 ubeshort >0x0300
  5314. # GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
  5315. >>0x212 ubyte >0x29
  5316. >>>0x213 ubyte >0x29
  5317. # not iso9660_stage1_5
  5318. #>>>0 ulelong&0x00BE5652 0x00BE5652
  5319. >>>>0x213 ubyte >0x29 GRand Unified Bootloader
  5320. # config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
  5321. >>>>0x217 ubyte 0xFF stage1_5
  5322. >>>>0x217 ubyte <0xFF stage2
  5323. >>>>0x206 ubyte x \b version %u
  5324. >>>>0x207 ubyte x \b.%u
  5325. # module_size for 1.94
  5326. >>>>0x208 ulelong <0xffffff \b, installed partition %u
  5327. #>>>>0x208 ulelong =0xffffff \b, %u (default)
  5328. >>>>0x208 ulelong >0xffffff \b, installed partition %u
  5329. # GRUB 0.5.95 unofficial
  5330. >>>>0x20C ulelong&0x2E300000 0x2E300000
  5331. # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs
  5332. >>>>>0x20C ubyte x \b, identifier 0x%x
  5333. #>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default)
  5334. >>>>>0x20D ubyte >0 \b, LBA flag 0x%x
  5335. # GRUB version as string
  5336. >>>>>0x20E string >\0 \b, GRUB version %-s
  5337. # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
  5338. >>>>>>0x215 ulong 0xffffffff
  5339. >>>>>>>0x219 string >\0 \b, configuration file %-s
  5340. >>>>>>0x215 ulong !0xffffffff
  5341. >>>>>>>0x215 string >\0 \b, configuration file %-s
  5342. # newer GRUB versions
  5343. >>>>0x20C ulelong&0x2E300000 !0x2E300000
  5344. ##>>>>>0x20C ulelong =0 \b, saved entry %d (usual)
  5345. >>>>>0x20C ulelong >0 \b, saved entry %d
  5346. # for 1.94 contains kernel image size
  5347. # for 0.93,0.94,0.96,0.97
  5348. # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2
  5349. >>>>>0x210 ubyte x \b, identifier 0x%x
  5350. # The flag for LBA forcing is in most cases 0
  5351. #>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default)
  5352. >>>>>0x211 ubyte >0 \b, LBA flag 0x%x
  5353. # GRUB version as string
  5354. >>>>>0x212 string >\0 \b, GRUB version %-s
  5355. # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
  5356. >>>>>0x217 ulong 0xffffffff
  5357. >>>>>>0x21b string >\0 \b, configuration file %-s
  5358. >>>>>0x217 ulong !0xffffffff
  5359. >>>>>>0x217 string >\0 \b, configuration file %-s
  5360.  
  5361. 9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian),
  5362. >8404 string x last mounted on %s,
  5363. #>9504 ledate x last checked at %s,
  5364. >8224 ledate x last written at %s,
  5365. >8401 byte x clean flag %d,
  5366. >8228 lelong x number of blocks %d,
  5367. >8232 lelong x number of data blocks %d,
  5368. >8236 lelong x number of cylinder groups %d,
  5369. >8240 lelong x block size %d,
  5370. >8244 lelong x fragment size %d,
  5371. >8252 lelong x minimum percentage of free blocks %d,
  5372. >8256 lelong x rotational delay %dms,
  5373. >8260 lelong x disk rotational speed %drps,
  5374. >8320 lelong 0 TIME optimization
  5375. >8320 lelong 1 SPACE optimization
  5376.  
  5377. 42332 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
  5378. >&-1164 string x last mounted on %s,
  5379. >&-696 string >\0 volume name %s,
  5380. >&-304 leqldate x last written at %s,
  5381. >&-1167 byte x clean flag %d,
  5382. >&-1168 byte x readonly flag %d,
  5383. >&-296 lequad x number of blocks %lld,
  5384. >&-288 lequad x number of data blocks %lld,
  5385. >&-1332 lelong x number of cylinder groups %d,
  5386. >&-1328 lelong x block size %d,
  5387. >&-1324 lelong x fragment size %d,
  5388. >&-180 lelong x average file size %d,
  5389. >&-176 lelong x average number of files in dir %d,
  5390. >&-272 lequad x pending blocks to free %lld,
  5391. >&-264 lelong x pending inodes to free %ld,
  5392. >&-664 lequad x system-wide uuid %0llx,
  5393. >&-1316 lelong x minimum percentage of free blocks %d,
  5394. >&-1248 lelong 0 TIME optimization
  5395. >&-1248 lelong 1 SPACE optimization
  5396.  
  5397. 66908 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
  5398. >&-1164 string x last mounted on %s,
  5399. >&-696 string >\0 volume name %s,
  5400. >&-304 leqldate x last written at %s,
  5401. >&-1167 byte x clean flag %d,
  5402. >&-1168 byte x readonly flag %d,
  5403. >&-296 lequad x number of blocks %lld,
  5404. >&-288 lequad x number of data blocks %lld,
  5405. >&-1332 lelong x number of cylinder groups %d,
  5406. >&-1328 lelong x block size %d,
  5407. >&-1324 lelong x fragment size %d,
  5408. >&-180 lelong x average file size %d,
  5409. >&-176 lelong x average number of files in dir %d,
  5410. >&-272 lequad x pending blocks to free %lld,
  5411. >&-264 lelong x pending inodes to free %ld,
  5412. >&-664 lequad x system-wide uuid %0llx,
  5413. >&-1316 lelong x minimum percentage of free blocks %d,
  5414. >&-1248 lelong 0 TIME optimization
  5415. >&-1248 lelong 1 SPACE optimization
  5416.  
  5417. 9564 belong 0x00011954 Unix Fast File system [v1] (big-endian),
  5418. >7168 belong 0x4c41424c Apple UFS Volume
  5419. >>7186 string x named %s,
  5420. >>7176 belong x volume label version %d,
  5421. >>7180 bedate x created on %s,
  5422. >8404 string x last mounted on %s,
  5423. #>9504 bedate x last checked at %s,
  5424. >8224 bedate x last written at %s,
  5425. >8401 byte x clean flag %d,
  5426. >8228 belong x number of blocks %d,
  5427. >8232 belong x number of data blocks %d,
  5428. >8236 belong x number of cylinder groups %d,
  5429. >8240 belong x block size %d,
  5430. >8244 belong x fragment size %d,
  5431. >8252 belong x minimum percentage of free blocks %d,
  5432. >8256 belong x rotational delay %dms,
  5433. >8260 belong x disk rotational speed %drps,
  5434. >8320 belong 0 TIME optimization
  5435. >8320 belong 1 SPACE optimization
  5436.  
  5437. 42332 belong 0x19540119 Unix Fast File system [v2] (big-endian)
  5438. >&-1164 string x last mounted on %s,
  5439. >&-696 string >\0 volume name %s,
  5440. >&-304 beqldate x last written at %s,
  5441. >&-1167 byte x clean flag %d,
  5442. >&-1168 byte x readonly flag %d,
  5443. >&-296 bequad x number of blocks %lld,
  5444. >&-288 bequad x number of data blocks %lld,
  5445. >&-1332 belong x number of cylinder groups %d,
  5446. >&-1328 belong x block size %d,
  5447. >&-1324 belong x fragment size %d,
  5448. >&-180 belong x average file size %d,
  5449. >&-176 belong x average number of files in dir %d,
  5450. >&-272 bequad x pending blocks to free %lld,
  5451. >&-264 belong x pending inodes to free %ld,
  5452. >&-664 bequad x system-wide uuid %0llx,
  5453. >&-1316 belong x minimum percentage of free blocks %d,
  5454. >&-1248 belong 0 TIME optimization
  5455. >&-1248 belong 1 SPACE optimization
  5456.  
  5457. 66908 belong 0x19540119 Unix Fast File system [v2] (big-endian)
  5458. >&-1164 string x last mounted on %s,
  5459. >&-696 string >\0 volume name %s,
  5460. >&-304 beqldate x last written at %s,
  5461. >&-1167 byte x clean flag %d,
  5462. >&-1168 byte x readonly flag %d,
  5463. >&-296 bequad x number of blocks %lld,
  5464. >&-288 bequad x number of data blocks %lld,
  5465. >&-1332 belong x number of cylinder groups %d,
  5466. >&-1328 belong x block size %d,
  5467. >&-1324 belong x fragment size %d,
  5468. >&-180 belong x average file size %d,
  5469. >&-176 belong x average number of files in dir %d,
  5470. >&-272 bequad x pending blocks to free %lld,
  5471. >&-264 belong x pending inodes to free %ld,
  5472. >&-664 bequad x system-wide uuid %0llx,
  5473. >&-1316 belong x minimum percentage of free blocks %d,
  5474. >&-1248 belong 0 TIME optimization
  5475. >&-1248 belong 1 SPACE optimization
  5476.  
  5477. # ext2/ext3 filesystems - Andreas Dilger <adilger@turbolabs.com>
  5478. 0x438 leshort 0xEF53 Linux
  5479. >0x44c lelong x rev %d
  5480. >0x43e leshort x \b.%d
  5481. >0x45c lelong ^0x0000004 ext2 filesystem data
  5482. >>0x43a leshort ^0x0000001 (mounted or unclean)
  5483. >0x45c lelong &0x0000004 ext3 filesystem data
  5484. >>0x460 lelong &0x0000004 (needs journal recovery)
  5485. >0x43a leshort &0x0000002 (errors)
  5486. >0x460 lelong &0x0000001 (compressed)
  5487. #>0x460 lelong &0x0000002 (filetype)
  5488. #>0x464 lelong &0x0000001 (sparse_super)
  5489. >0x464 lelong &0x0000002 (large files)
  5490.  
  5491. # SGI disk labels - Nathan Scott <nathans@debian.org>
  5492. 0 belong 0x0BE5A941 SGI disk label (volume header)
  5493.  
  5494. # SGI XFS filesystem - Nathan Scott <nathans@debian.org>
  5495. 0 belong 0x58465342 SGI XFS filesystem data
  5496. >0x4 belong x (blksz %d,
  5497. >0x68 beshort x inosz %d,
  5498. >0x64 beshort ^0x2004 v1 dirs)
  5499. >0x64 beshort &0x2004 v2 dirs)
  5500.  
  5501. ############################################################################
  5502. # Minix-ST kernel floppy
  5503. 0x800 belong 0x46fc2700 Atari-ST Minix kernel image
  5504. >19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy
  5505. >19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy
  5506.  
  5507. ############################################################################
  5508. # Hmmm, is this a better way of detecting _standard_ floppy images ?
  5509. 19 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k
  5510. >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
  5511. 19 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k
  5512. >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
  5513. 19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k
  5514. >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
  5515.  
  5516. 19 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM
  5517. >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
  5518. 19 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs
  5519. >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
  5520.  
  5521. 19 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k
  5522. 19 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k
  5523.  
  5524. # Valid media descriptor bytes for MS-DOS:
  5525. #
  5526. # Byte Capacity Media Size and Type
  5527. # -------------------------------------------------
  5528. #
  5529. # F0 2.88 MB 3.5-inch, 2-sided, 36-sector
  5530. # F0 1.44 MB 3.5-inch, 2-sided, 18-sector
  5531. # F9 720K 3.5-inch, 2-sided, 9-sector
  5532. # F9 1.2 MB 5.25-inch, 2-sided, 15-sector
  5533. # FD 360K 5.25-inch, 2-sided, 9-sector
  5534. # FF 320K 5.25-inch, 2-sided, 8-sector
  5535. # FC 180K 5.25-inch, 1-sided, 9-sector
  5536. # FE 160K 5.25-inch, 1-sided, 8-sector
  5537. # FE 250K 8-inch, 1-sided, single-density
  5538. # FD 500K 8-inch, 2-sided, single-density
  5539. # FE 1.2 MB 8-inch, 2-sided, double-density
  5540. # F8 ----- Fixed disk
  5541. #
  5542. # FC xxxK Apricot 70x1x9 boot disk.
  5543. #
  5544. # Originally a bitmap:
  5545. # xxxxxxx0 Not two sided
  5546. # xxxxxxx1 Double sided
  5547. # xxxxxx0x Not 8 SPT
  5548. # xxxxxx1x 8 SPT
  5549. # xxxxx0xx Not Removable drive
  5550. # xxxxx1xx Removable drive
  5551. # 11111xxx Must be one.
  5552. #
  5553. # But now it's rather random:
  5554. # 111111xx Low density disk
  5555. # 00 SS, Not 8 SPT
  5556. # 01 DS, Not 8 SPT
  5557. # 10 SS, 8 SPT
  5558. # 11 DS, 8 SPT
  5559. #
  5560. # 11111001 Double density 3ݠfloppy disk, high density 5܊# 11110000 High density 3ݠfloppy disk
  5561. # 11111000 Hard disk any format
  5562. #
  5563.  
  5564. # CDROM Filesystems
  5565. # Modified for UDF by gerardo.cacciari@gmail.com
  5566. 32769 string CD001
  5567. >38913 string !NSR0 ISO 9660 CD-ROM filesystem data
  5568. >38913 string NSR0 UDF filesystem data
  5569. >>38917 string 1 (version 1.0)
  5570. >>38917 string 2 (version 1.5)
  5571. >>38917 string 3 (version 2.0)
  5572. >>38917 byte >0x33 (unknown version, ID 0x%X)
  5573. >>38917 byte <0x31 (unknown version, ID 0x%X)
  5574. # "application id" which appears to be used as a volume label
  5575. >32808 string >\0 '%s'
  5576. >34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)
  5577. 37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
  5578. 32776 string CDROM High Sierra CD-ROM filesystem data
  5579.  
  5580. # cramfs filesystem - russell@coker.com.au
  5581. 0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian
  5582. >4 lelong x size %d
  5583. >8 lelong &1 version #2
  5584. >8 lelong &2 sorted_dirs
  5585. >8 lelong &4 hole_support
  5586. >32 lelong x CRC 0x%x,
  5587. >36 lelong x edition %d,
  5588. >40 lelong x %d blocks,
  5589. >44 lelong x %d files
  5590.  
  5591. 0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian
  5592. >4 belong x size %d
  5593. >8 belong &1 version #2
  5594. >8 belong &2 sorted_dirs
  5595. >8 belong &4 hole_support
  5596. >32 belong x CRC 0x%x,
  5597. >36 belong x edition %d,
  5598. >40 belong x %d blocks,
  5599. >44 belong x %d files
  5600.  
  5601. # reiserfs - russell@coker.com.au
  5602. 0x10034 string ReIsErFs ReiserFS V3.5
  5603. 0x10034 string ReIsEr2Fs ReiserFS V3.6
  5604. >0x1002c leshort x block size %d
  5605. >0x10032 leshort &2 (mounted or unclean)
  5606. >0x10000 lelong x num blocks %d
  5607. >0x10040 lelong 1 tea hash
  5608. >0x10040 lelong 2 yura hash
  5609. >0x10040 lelong 3 r5 hash
  5610.  
  5611. # JFFS - russell@coker.com.au
  5612. 0 lelong 0x34383931 Linux Journalled Flash File system, little endian
  5613. 0 belong 0x34383931 Linux Journalled Flash File system, big endian
  5614.  
  5615. # EST flat binary format (which isn't, but anyway)
  5616. # From: Mark Brown <broonie@sirena.org.uk>
  5617. 0 string ESTFBINR EST flat binary
  5618.  
  5619. # Aculab VoIP firmware
  5620. # From: Mark Brown <broonie@sirena.org.uk>
  5621. 0 string VoIP\ Startup\ and Aculab VoIP firmware
  5622. >35 string x format %s
  5623.  
  5624. # u-boot/PPCBoot image file
  5625. # From: Mark Brown <broonie@sirena.org.uk>
  5626. 0 belong 0x27051956 u-boot/PPCBoot image
  5627. >4 string PPCBoot
  5628. >>12 string x version %s
  5629.  
  5630. # JFFS2 file system
  5631. 0 leshort 0x1984 Linux old jffs2 filesystem data little endian
  5632. 0 leshort 0x1985 Linux jffs2 filesystem data little endian
  5633.  
  5634. # Squashfs
  5635. 0 string sqsh Squashfs filesystem, big endian,
  5636. >28 beshort x version %d.
  5637. >30 beshort x \b%d,
  5638. >28 beshort <3
  5639. >>8 belong x %d bytes,
  5640. >28 beshort >2
  5641. >>63 bequad x %lld bytes,
  5642. #>>67 belong x %d bytes,
  5643. >4 belong x %d inodes,
  5644. >28 beshort <2
  5645. >>32 beshort x blocksize: %d bytes,
  5646. >28 beshort >1
  5647. >>51 belong x blocksize: %d bytes,
  5648. >39 bedate x created: %s
  5649. 0 string hsqs Squashfs filesystem, little endian,
  5650. >28 leshort x version %d.
  5651. >30 leshort x \b%d,
  5652. >28 leshort <3
  5653. >>8 lelong x %d bytes,
  5654. >28 leshort >2
  5655. >>63 lequad x %lld bytes,
  5656. #>>63 lelong x %d bytes,
  5657. >4 lelong x %d inodes,
  5658. >28 leshort <2
  5659. >>32 leshort x blocksize: %d bytes,
  5660. >28 leshort >1
  5661. >>51 lelong x blocksize: %d bytes,
  5662. >39 ledate x created: %s
  5663.  
  5664. 0 string td\000 floppy image data (TeleDisk)
  5665.  
  5666. # AFS Dump Magic
  5667. # From: Ty Sarna <tsarna@sarna.org>
  5668. 0 string \x01\xb3\xa1\x13\x22 AFS Dump
  5669. >&0 belong x (v%d)
  5670. >>&0 byte 0x76
  5671. >>>&0 belong x Vol %d,
  5672. >>>>&0 byte 0x6e
  5673. >>>>>&0 string x %s
  5674. >>>>>>&1 byte 0x74
  5675. >>>>>>>&0 beshort 2
  5676. >>>>>>>>&4 bedate x on: %s
  5677. >>>>>>>>&0 bedate =0 full dump
  5678. >>>>>>>>&0 bedate !0 incremental since: %s
  5679.  
  5680. #----------------------------------------------------------
  5681. # VMS backup savesets - gerardo.cacciari@gmail.com
  5682. #
  5683. 4 string \x01\x00\x01\x00\x01\x00
  5684. >(0.s+16) string \x01\x01
  5685. >>&(&0.b+8) byte 0x42 OpenVMS backup saveset data
  5686. >>>40 lelong x (block size %d,
  5687. >>>49 string >\0 original name '%s',
  5688. >>>2 short 1024 VAX generated)
  5689. >>>2 short 2048 AXP generated)
  5690. >>>2 short 4096 I64 generated)
  5691.  
  5692. # Compaq/HP RILOE floppy image
  5693. # From: Dirk Jagdmann <doj@cubic.org>
  5694. 0 string CPQRFBLO Compaq/HP RILOE floppy image
  5695.  
  5696. #------------------------------------------------------------------------------
  5697. # Files-11 On-Disk Structure (OpenVMS file system) - gerardo.cacciari@gmail.com
  5698. # These bits come from LBN 1 (home block) of ODS-2 and ODS-5 volumes, which is
  5699. # mapped to VBN 2 of [000000]INDEXF.SYS;1
  5700. #
  5701. 1008 string DECFILE11B Files-11 On-Disk Structure
  5702. >525 byte x Level %d
  5703. >525 byte x (ODS-%d OpenVMS file system),
  5704. >984 string x volume label is '%-12.12s'
  5705.  
  5706. # From: Thomas Klausner <wiz@NetBSD.org>
  5707. # http://filext.com/file-extension/DAA
  5708. # describes the daa file format. The magic would be:
  5709. 0 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive
  5710.  
  5711. #------------------------------------------------------------------------------
  5712. # flash: file(1) magic for Macromedia Flash file format
  5713. #
  5714. # See
  5715. #
  5716. # http://www.macromedia.com/software/flash/open/
  5717. #
  5718. 0 string FWS Macromedia Flash data,
  5719. >3 byte x version %d
  5720. 0 string CWS Macromedia Flash data (compressed),
  5721. >3 byte x version %d
  5722. # From: Cal Peake <cp@absolutedigital.net>
  5723. 0 string FLV Macromedia Flash Video
  5724.  
  5725. #
  5726. # From Dave Wilson
  5727. 0 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document
  5728.  
  5729. #------------------------------------------------------------------------------
  5730. # fonts: file(1) magic for font data
  5731. #
  5732. 0 string FONT ASCII vfont text
  5733. 0 short 0436 Berkeley vfont data
  5734. 0 short 017001 byte-swapped Berkeley vfont data
  5735.  
  5736. # PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
  5737. 0 string %!PS-AdobeFont-1. PostScript Type 1 font text
  5738. >20 string >\0 (%s)
  5739. 6 string %!PS-AdobeFont-1. PostScript Type 1 font program data
  5740.  
  5741. # X11 font files in SNF (Server Natural Format) format
  5742. 0 belong 00000004 X11 SNF font data, MSB first
  5743. 0 lelong 00000004 X11 SNF font data, LSB first
  5744.  
  5745. # X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
  5746. 0 string STARTFONT\040 X11 BDF font text
  5747.  
  5748. # X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
  5749. # PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
  5750. 0 string \001fcp X11 Portable Compiled Font data
  5751. >12 byte 0x02 \b, LSB first
  5752. >12 byte 0x0a \b, MSB first
  5753. 0 string D1.0\015 X11 Speedo font data
  5754.  
  5755. #------------------------------------------------------------------------------
  5756. # FIGlet fonts and controlfiles
  5757. # From figmagic supplied with Figlet version 2.2
  5758. # "David E. O'Brien" <obrien@FreeBSD.ORG>
  5759. 0 string flf FIGlet font
  5760. >3 string >2a version %-2.2s
  5761. 0 string flc FIGlet controlfile
  5762. >3 string >2a version %-2.2s
  5763.  
  5764. # libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
  5765. # Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
  5766. 0 belong 0x14025919 libGrx font data,
  5767. >8 leshort x %dx
  5768. >10 leshort x \b%d
  5769. >40 string x %s
  5770. # Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
  5771. 0 belong 0xff464f4e DOS code page font data collection
  5772. 7 belong 0x00454741 DOS code page font data
  5773. 7 belong 0x00564944 DOS code page font data (from Linux?)
  5774. 4098 string DOSFONT DOSFONT2 encrypted font data
  5775.  
  5776. # downloadable fonts for browser (prints type) anthon@mnt.org
  5777. 0 string PFR1 PFR1 font
  5778. >102 string >0 \b: %s
  5779.  
  5780. # True Type fonts
  5781. 0 string \000\001\000\000\000 TrueType font data
  5782.  
  5783. 0 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
  5784. 0 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
  5785.  
  5786. # Opentype font data from Avi Bercovich
  5787. 0 string OTTO OpenType font data
  5788.  
  5789. # Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
  5790. 0 string SplineFontDB: Spline Font Database
  5791. >14 string x version %s
  5792. # FORTRAN source
  5793. 0 string/c c\ FORTRAN program
  5794.  
  5795. #------------------------------------------------------------------------------
  5796. # frame: file(1) magic for FrameMaker files
  5797. #
  5798. # This stuff came on a FrameMaker demo tape, most of which is
  5799. # copyright, but this file is "published" as witness the following:
  5800. #
  5801. 0 string \<MakerFile FrameMaker document
  5802. >11 string 5.5 (5.5
  5803. >11 string 5.0 (5.0
  5804. >11 string 4.0 (4.0
  5805. >11 string 3.0 (3.0
  5806. >11 string 2.0 (2.0
  5807. >11 string 1.0 (1.0
  5808. >14 byte x %c)
  5809. 0 string \<MIFFile FrameMaker MIF (ASCII) file
  5810. >9 string 4.0 (4.0)
  5811. >9 string 3.0 (3.0)
  5812. >9 string 2.0 (2.0)
  5813. >9 string 1.0 (1.x)
  5814. 0 string \<MakerDictionary FrameMaker Dictionary text
  5815. >17 string 3.0 (3.0)
  5816. >17 string 2.0 (2.0)
  5817. >17 string 1.0 (1.x)
  5818. 0 string \<MakerScreenFont FrameMaker Font file
  5819. >17 string 1.01 (%s)
  5820. 0 string \<MML FrameMaker MML file
  5821. 0 string \<BookFile FrameMaker Book file
  5822. >10 string 3.0 (3.0
  5823. >10 string 2.0 (2.0
  5824. >10 string 1.0 (1.0
  5825. >13 byte x %c)
  5826. # XXX - this book entry should be verified, if you find one, uncomment this
  5827. #0 string \<Book\ FrameMaker Book (ASCII) file
  5828. #>6 string 3.0 (3.0)
  5829. #>6 string 2.0 (2.0)
  5830. #>6 string 1.0 (1.0)
  5831. 0 string \<Maker Intermediate Print File FrameMaker IPL file
  5832.  
  5833. #------------------------------------------------------------------------------
  5834. # freebsd: file(1) magic for FreeBSD objects
  5835. #
  5836. # All new-style FreeBSD magic numbers are in host byte order (i.e.,
  5837. # little-endian on x86).
  5838. #
  5839. # XXX - this comes from the file "freebsd" in a recent FreeBSD version of
  5840. # "file"; it, and the NetBSD stuff in "netbsd", appear to use different
  5841. # schemes for distinguishing between executable images, shared libraries,
  5842. # and object files.
  5843. #
  5844. # FreeBSD says:
  5845. #
  5846. # Regardless of whether it's pure, demand-paged, or none of the
  5847. # above:
  5848. #
  5849. # if the entry point is < 4096, then it's a shared library if
  5850. # the "has run-time loader information" bit is set, and is
  5851. # position-independent if the "is position-independent" bit
  5852. # is set;
  5853. #
  5854. # if the entry point is >= 4096 (or >4095, same thing), then it's
  5855. # an executable, and is dynamically-linked if the "has run-time
  5856. # loader information" bit is set.
  5857. #
  5858. # On x86, NetBSD says:
  5859. #
  5860. # If it's neither pure nor demand-paged:
  5861. #
  5862. # if it has the "has run-time loader information" bit set, it's
  5863. # a dynamically-linked executable;
  5864. #
  5865. # if it doesn't have that bit set, then:
  5866. #
  5867. # if it has the "is position-independent" bit set, it's
  5868. # position-independent;
  5869. #
  5870. # if the entry point is non-zero, it's an executable, otherwise
  5871. # it's an object file.
  5872. #
  5873. # If it's pure:
  5874. #
  5875. # if it has the "has run-time loader information" bit set, it's
  5876. # a dynamically-linked executable, otherwise it's just an
  5877. # executable.
  5878. #
  5879. # If it's demand-paged:
  5880. #
  5881. # if it has the "has run-time loader information" bit set,
  5882. # then:
  5883. #
  5884. # if the entry point is < 4096, it's a shared library;
  5885. #
  5886. # if the entry point is = 4096 or > 4096 (i.e., >= 4096),
  5887. # it's a dynamically-linked executable);
  5888. #
  5889. # if it doesn't have the "has run-time loader information" bit
  5890. # set, then it's just an executable.
  5891. #
  5892. # (On non-x86, NetBSD does much the same thing, except that it uses
  5893. # 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
  5894. # pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
  5895. # had 8K pages; dunno about MIPS.)
  5896. #
  5897. # I suspect the two will differ only in perverse and uninteresting cases
  5898. # ("shared" libraries that aren't demand-paged and whose pages probably
  5899. # won't actually be shared, executables with entry points <4096).
  5900. #
  5901. # I leave it to those more familiar with FreeBSD and NetBSD to figure out
  5902. # what the right answer is (although using ">4095", FreeBSD-style, is
  5903. # probably better than separately checking for "=4096" and ">4096",
  5904. # NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged
  5905. # executables using the NetBSD technique.)
  5906. #
  5907. 0 lelong&0377777777 041400407 FreeBSD/i386
  5908. >20 lelong <4096
  5909. >>3 byte&0xC0 &0x80 shared library
  5910. >>3 byte&0xC0 0x40 PIC object
  5911. >>3 byte&0xC0 0x00 object
  5912. >20 lelong >4095
  5913. >>3 byte&0x80 0x80 dynamically linked executable
  5914. >>3 byte&0x80 0x00 executable
  5915. >16 lelong >0 not stripped
  5916.  
  5917. 0 lelong&0377777777 041400410 FreeBSD/i386 pure
  5918. >20 lelong <4096
  5919. >>3 byte&0xC0 &0x80 shared library
  5920. >>3 byte&0xC0 0x40 PIC object
  5921. >>3 byte&0xC0 0x00 object
  5922. >20 lelong >4095
  5923. >>3 byte&0x80 0x80 dynamically linked executable
  5924. >>3 byte&0x80 0x00 executable
  5925. >16 lelong >0 not stripped
  5926.  
  5927. 0 lelong&0377777777 041400413 FreeBSD/i386 demand paged
  5928. >20 lelong <4096
  5929. >>3 byte&0xC0 &0x80 shared library
  5930. >>3 byte&0xC0 0x40 PIC object
  5931. >>3 byte&0xC0 0x00 object
  5932. >20 lelong >4095
  5933. >>3 byte&0x80 0x80 dynamically linked executable
  5934. >>3 byte&0x80 0x00 executable
  5935. >16 lelong >0 not stripped
  5936.  
  5937. 0 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged
  5938. >20 lelong <4096
  5939. >>3 byte&0xC0 &0x80 shared library
  5940. >>3 byte&0xC0 0x40 PIC object
  5941. >>3 byte&0xC0 0x00 object
  5942. >20 lelong >4095
  5943. >>3 byte&0x80 0x80 dynamically linked executable
  5944. >>3 byte&0x80 0x00 executable
  5945. >16 lelong >0 not stripped
  5946.  
  5947. # XXX gross hack to identify core files
  5948. # cores start with a struct tss; we take advantage of the following:
  5949. # byte 7: highest byte of the kernel stack pointer, always 0xfe
  5950. # 8/9: kernel (ring 0) ss value, always 0x0010
  5951. # 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
  5952. # 28: low order byte of the current PTD entry, always 0 since the
  5953. # PTD is page-aligned
  5954. #
  5955. 7 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file
  5956. >1039 string >\0 from '%s'
  5957.  
  5958. # /var/run/ld.so.hints
  5959. # What are you laughing about?
  5960. 0 lelong 011421044151 ld.so hints file (Little Endian
  5961. >4 lelong >0 \b, version %d)
  5962. >4 belong <=0 \b)
  5963. 0 belong 011421044151 ld.so hints file (Big Endian
  5964. >4 belong >0 \b, version %d)
  5965. >4 belong <=0 \b)
  5966.  
  5967. #
  5968. # Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
  5969. #
  5970. 0 string SCRSHOT_ scrshot(1) screenshot,
  5971. >8 byte x version %d,
  5972. >9 byte 2 %d bytes in header,
  5973. >>10 byte x %d chars wide by
  5974. >>11 byte x %d chars high
  5975.  
  5976. #------------------------------------------------------------------------------
  5977. # fsav: file(1) magic for datafellows fsav virus definition files
  5978. # Anthon van der Neut (anthon@mnt.org)
  5979.  
  5980. # ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def}
  5981. 0 beshort 0x1575 fsav macro virus signatures
  5982. >8 leshort >0 (%d-
  5983. >11 byte >0 \b%02d-
  5984. >10 byte >0 \b%02d)
  5985. # ftp://ftp.f-prot.com/pub/sign.zip
  5986. #10 ubyte <12
  5987. #>9 ubyte <32
  5988. #>>8 ubyte 0x0a
  5989. #>>>12 ubyte 0x07
  5990. #>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d-
  5991. #>>>>10 byte 0 \b01-
  5992. #>>>>10 byte 1 \b02-
  5993. #>>>>10 byte 2 \b03-
  5994. #>>>>10 byte 3 \b04-
  5995. #>>>>10 byte 4 \b05-
  5996. #>>>>10 byte 5 \b06-
  5997. #>>>>10 byte 6 \b07-
  5998. #>>>>10 byte 7 \b08-
  5999. #>>>>10 byte 8 \b09-
  6000. #>>>>10 byte 9 \b10-
  6001. #>>>>10 byte 10 \b11-
  6002. #>>>>10 byte 11 \b12-
  6003. #>>>>9 ubyte >0 \b%02d)
  6004. # ftp://ftp.f-prot.com/pub/sign2.zip
  6005. #0 ubyte 0x62
  6006. #>1 ubyte 0xF5
  6007. #>>2 ubyte 0x1
  6008. #>>>3 ubyte 0x1
  6009. #>>>>4 ubyte 0x0e
  6010. #>>>>>13 ubyte >0 fsav virus signatures
  6011. #>>>>>>11 ubyte x size 0x%02x
  6012. #>>>>>>12 ubyte x \b%02x
  6013. #>>>>>>13 ubyte x \b%02x bytes
  6014.  
  6015. # Joerg Jenderek: joerg dot jenderek at web dot de
  6016. # http://www.clamav.net/doc/latest/html/node45.html
  6017. # .cvd files start with a 512 bytes colon separated header
  6018. # ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
  6019. # + gzipped tarball files
  6020. 0 string ClamAV-VDB:
  6021. >11 string >\0 Clam AntiVirus database %-.23s
  6022. >>34 string :
  6023. >>>35 regex [^:]+ \b, version
  6024. >>>>35 string x \b%-.1s
  6025. >>>>>36 string !:
  6026. >>>>>>36 string x \b%-.1s
  6027. >>>>>>>37 string !:
  6028. >>>>>>>>37 string x \b%-.1s
  6029. >>>>>>>>>38 string !:
  6030. >>>>>>>>>>38 string x \b%-.1s
  6031. >>>>512 string \037\213 \b, gzipped
  6032. >>>>769 string ustar\0 \b, tared
  6033. >512 string \037\213 \b, gzipped
  6034. >769 string ustar\0 \b, tared
  6035. #------------------------------------------------------------------------------
  6036. # games: file(1) for games
  6037.  
  6038. # Thomas M. Ott (ThMO)
  6039. 1 string =WAD DOOM data,
  6040. >0 string =I main wad
  6041. >0 string =P patch wad
  6042. >0 byte x unknown junk
  6043.  
  6044. # Fabio Bonelli <fabiobonelli@libero.it>
  6045. # Quake II - III data files
  6046. 0 string IDP2 Quake II 3D Model file,
  6047. >20 long x %lu skin(s),
  6048. >8 long x (%lu x
  6049. >12 long x %lu),
  6050. >40 long x %lu frame(s),
  6051. >16 long x Frame size %lu bytes,
  6052. >24 long x %lu vertices/frame,
  6053. >28 long x %lu texture coordinates,
  6054. >32 long x %lu triangles/frame
  6055.  
  6056. 0 string IBSP Quake
  6057. >4 long 0x26 II Map file (BSP)
  6058. >4 long 0x2E III Map file (BSP)
  6059.  
  6060. 0 string IDS2 Quake II SP2 sprite file
  6061.  
  6062. #---------------------------------------------------------------------------
  6063. # Doom and Quake
  6064. # submitted by Nicolas Patrois
  6065.  
  6066. # DOOM
  6067.  
  6068. 0 string IWAD DOOM or DOOM ][ world
  6069. 0 string PWAD DOOM or DOOM ][ extension world
  6070.  
  6071. 0 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo
  6072. # some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01
  6073.  
  6074. 24 string LxD\ 203 Linuxdoom save
  6075. >0 string x , name=%s
  6076. >44 string x , world=%s
  6077.  
  6078. # Quake
  6079.  
  6080. 0 string PACK Quake I or II world or extension
  6081.  
  6082. #0 string -1\x0a Quake I demo
  6083. #>30 string x version %.4s
  6084. #>61 string x level %s
  6085.  
  6086. #0 string 5\x0a Quake I save
  6087.  
  6088. # The levels
  6089.  
  6090. # Quake 1
  6091.  
  6092. 0 string 5\x0aIntroduction Quake I save: start Introduction
  6093. 0 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex
  6094. 0 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned
  6095. 0 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis
  6096. 0 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto
  6097. 0 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret)
  6098. 0 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep
  6099. 0 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon
  6100. 0 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon
  6101. 0 string 5\x0athe_Installation Quake I save: e2m1 The installation
  6102. 0 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel
  6103. 0 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!)
  6104. 0 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret)
  6105. 0 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress
  6106. 0 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse
  6107. 0 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette
  6108. 0 string 5\x0aTermination_Central Quake I save: e3m1 Termination central
  6109. 0 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin
  6110. 0 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror
  6111. 0 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight
  6112. 0 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret)
  6113. 0 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels
  6114. 0 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment
  6115. 0 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system
  6116. 0 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair
  6117. 0 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine
  6118. 0 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate
  6119. 0 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium
  6120. 0 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret)
  6121. 0 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze
  6122. 0 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony
  6123. 0 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit
  6124.  
  6125. # Quake DeathMatch levels
  6126.  
  6127. 0 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths
  6128. 0 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis
  6129. 0 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base
  6130. 0 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place
  6131. 0 string 5\x0aThe_Cistern Quake I save: dm5 The cistern
  6132. 0 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone
  6133.  
  6134. # Scourge of Armagon
  6135.  
  6136. 0 string 5\x0aCommand_HQ Quake I save: start Command HQ
  6137. 0 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station
  6138. 0 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility
  6139. 0 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret)
  6140. 0 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine
  6141. 0 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility
  6142. 0 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms
  6143. 0 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret)
  6144. 0 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral
  6145. 0 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs
  6146. 0 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt
  6147. 0 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep
  6148. 0 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment
  6149. 0 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium
  6150. 0 string 5\x0aLimbo Quake I save: hip3m3 Limbo
  6151. 0 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret)
  6152. 0 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet
  6153. 0 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair
  6154.  
  6155. # Malice
  6156.  
  6157. 0 string 5\x0aThe_Academy Quake I save: start The academy
  6158. 0 string 5\x0aThe_Lab Quake I save: d1 The lab
  6159. 0 string 5\x0aArea_33 Quake I save: d1b Area 33
  6160. 0 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions
  6161. 0 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret)
  6162. 0 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)
  6163. 0 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice
  6164. 0 string 5\x0aArea44 Quake I save: d1c Area 44
  6165. 0 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers
  6166. 0 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life
  6167. 0 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood
  6168. 0 string 5\x0aThe_Flood Quake I save: d5 The flood
  6169. 0 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant
  6170. 0 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant
  6171. 0 string 5\x0aThe_Foundry Quake I save: d7b The foundry
  6172. 0 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base
  6173. 0 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base
  6174. 0 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories
  6175. 0 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive
  6176. 0 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ
  6177. 0 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown!
  6178.  
  6179. # Malice DeathMatch levels
  6180.  
  6181. 0 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct
  6182. 0 string 5\x0aSub_Station Quake I save: ddm2 Sub station
  6183. 0 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights!
  6184. 0 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa
  6185. 0 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse
  6186. 0 string 5\x0aDOMINO Quake I save: ddm6 Domino
  6187. 0 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder
  6188.  
  6189.  
  6190. 0 string MComprHD MAME CHD compressed hard disk image,
  6191. >12 belong x version %lu
  6192.  
  6193. #------------------------------------------------------------------------------
  6194. # GEOS files (Vidar Madsen, vidar@gimp.org)
  6195. # semi-commonly used in embedded and handheld systems.
  6196. 0 belong 0xc745c153 GEOS
  6197. >40 byte 1 executable
  6198. >40 byte 2 VMFile
  6199. >40 byte 3 binary
  6200. >40 byte 4 directory label
  6201. >40 byte <1 unknown
  6202. >40 byte >4 unknown
  6203. >4 string >\0 \b, name "%s"
  6204. #>44 short x \b, version %d
  6205. #>46 short x \b.%d
  6206. #>48 short x \b, rev %d
  6207. #>50 short x \b.%d
  6208. #>52 short x \b, proto %d
  6209. #>54 short x \br%d
  6210. #>168 string >\0 \b, copyright "%s"
  6211.  
  6212. #------------------------------------------------------------------------------
  6213. # gcc: file(1) magic for GCC special files
  6214. #
  6215. 0 string gpch GCC precompiled header
  6216.  
  6217. # The version field is annoying. It's 3 characters, not zero-terminated.
  6218. >5 byte x (version %c
  6219. >6 byte x \b%c
  6220. >7 byte x \b%c)
  6221.  
  6222. # 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'
  6223. >4 byte 67 for C
  6224. >4 byte 111 for Objective C
  6225. >4 byte 43 for C++
  6226. >4 byte 79 for Objective C++
  6227. #------------------------------------------------------------------------------
  6228. # GIMP Gradient: file(1) magic for the GIMP's gradient data files
  6229. # by Federico Mena <federico@nuclecu.unam.mx>
  6230.  
  6231. 0 string GIMP\ Gradient GIMP gradient data
  6232.  
  6233. #------------------------------------------------------------------------------
  6234. # XCF: file(1) magic for the XCF image format used in the GIMP developed
  6235. # by Spencer Kimball and Peter Mattis
  6236. # ('Bucky' LaDieu, nega@vt.edu)
  6237.  
  6238. 0 string gimp\ xcf GIMP XCF image data,
  6239. >9 string file version 0,
  6240. >9 string v version
  6241. >>10 string >\0 %s,
  6242. >14 belong x %lu x
  6243. >18 belong x %lu,
  6244. >22 belong 0 RGB Color
  6245. >22 belong 1 Greyscale
  6246. >22 belong 2 Indexed Color
  6247. >22 belong >2 Unknown Image Type.
  6248.  
  6249. #------------------------------------------------------------------------------
  6250. # XCF: file(1) magic for the patterns used in the GIMP, developed
  6251. # by Spencer Kimball and Peter Mattis
  6252. # ('Bucky' LaDieu, nega@vt.edu)
  6253.  
  6254. 20 string GPAT GIMP pattern data,
  6255. >24 string x %s
  6256.  
  6257. #------------------------------------------------------------------------------
  6258. # XCF: file(1) magic for the brushes used in the GIMP, developed
  6259. # by Spencer Kimball and Peter Mattis
  6260. # ('Bucky' LaDieu, nega@vt.edu)
  6261.  
  6262. 20 string GIMP GIMP brush data
  6263. #------------------------------------------------------------------------------
  6264. # gnu: file(1) magic for various GNU tools
  6265. #
  6266. # GNU nlsutils message catalog file format
  6267. #
  6268. 0 string \336\22\4\225 GNU message catalog (little endian),
  6269. >4 lelong x revision %d,
  6270. >8 lelong x %d messages
  6271. 0 string \225\4\22\336 GNU message catalog (big endian),
  6272. >4 belong x revision %d,
  6273. >8 belong x %d messages
  6274. # message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
  6275. 0 string *nazgul* Nazgul style compiled message catalog
  6276. >8 lelong >0 \b, version %ld
  6277.  
  6278. # GnuPG
  6279. # The format is very similar to pgp
  6280. 0 string \001gpg GPG key trust database
  6281. >4 byte x version %d
  6282. 0 beshort 0x8502 GPG encrypted data
  6283. # This magic is not particularly good, as the keyrings don't have true
  6284. # magic. Nevertheless, it covers many keyrings.
  6285. 0 beshort 0x9901 GPG key public ring
  6286.  
  6287. # Gnumeric spreadsheet
  6288. # This entry is only semi-helpful, as Gnumeric compresses its files, so
  6289. # they will ordinarily reported as "compressed", but at least -z helps
  6290. 39 string =<gmr:Workbook Gnumeric spreadsheet
  6291.  
  6292. # From: James Youngman <jay@gnu.org>
  6293. # gnu find magic
  6294. 0 string \0LOCATE GNU findutils locate database data
  6295. >7 string >\0 \b, format %s
  6296. >7 string 02 \b (frcode)
  6297.  
  6298. #------------------------------------------------------------------------------
  6299. # ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
  6300. #
  6301. # ACE/gr binary
  6302. 0 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file
  6303. >39 byte >0 - version %c
  6304. # ACE/gr ascii
  6305. 0 string #\ xvgr\ parameter\ file ACE/gr ascii file
  6306. 0 string #\ xmgr\ parameter\ file ACE/gr ascii file
  6307. 0 string #\ ACE/gr\ parameter\ file ACE/gr ascii file
  6308. # Grace projects
  6309. 0 string #\ Grace\ project\ file Grace project file
  6310. >23 string @version\ (version
  6311. >>32 byte >0 %c
  6312. >>33 string >\0 \b.%.2s
  6313. >>35 string >\0 \b.%.2s)
  6314. # ACE/gr fit description files
  6315. 0 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file
  6316. # end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
  6317.  
  6318. #------------------------------------------------------------------------------
  6319. # gringotts: file(1) magic for Gringotts
  6320. # http://devel.pluto.linux.it/projects/Gringotts/
  6321. # author: Germano Rizzo <mano@pluto.linux.it>
  6322. #GRG3????Y
  6323. 0 string GRG Gringotts data file
  6324. #file format 1
  6325. >3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
  6326. #file format 2
  6327. >3 string 2 v.2, MCRYPT S2K,
  6328. >>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
  6329. >>8 byte&0x70 0x10 SERPENT crypt,
  6330. >>8 byte&0x70 0x20 TWOFISH crypt,
  6331. >>8 byte&0x70 0x30 CAST-256 crypt,
  6332. >>8 byte&0x70 0x40 SAFER+ crypt,
  6333. >>8 byte&0x70 0x50 LOKI97 crypt,
  6334. >>8 byte&0x70 0x60 3DES crypt,
  6335. >>8 byte&0x70 0x70 RIJNDAEL-256 crypt,
  6336. >>8 byte&0x08 0x00 SHA1 hash,
  6337. >>8 byte&0x08 0x08 RIPEMD-160 hash,
  6338. >>8 byte&0x04 0x00 ZLib
  6339. >>8 byte&0x04 0x04 BZip2
  6340. >>8 byte&0x03 0x00 lvl.0
  6341. >>8 byte&0x03 0x01 lvl.3
  6342. >>8 byte&0x03 0x02 lvl.6
  6343. >>8 byte&0x03 0x03 lvl.9
  6344. #file format 3
  6345. >3 string 3 v.3, OpenPGP S2K,
  6346. >>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
  6347. >>8 byte&0x70 0x10 SERPENT crypt,
  6348. >>8 byte&0x70 0x20 TWOFISH crypt,
  6349. >>8 byte&0x70 0x30 CAST-256 crypt,
  6350. >>8 byte&0x70 0x40 SAFER+ crypt,
  6351. >>8 byte&0x70 0x50 LOKI97 crypt,
  6352. >>8 byte&0x70 0x60 3DES crypt,
  6353. >>8 byte&0x70 0x70 RIJNDAEL-256 crypt,
  6354. >>8 byte&0x08 0x00 SHA1 hash,
  6355. >>8 byte&0x08 0x08 RIPEMD-160 hash,
  6356. >>8 byte&0x04 0x00 ZLib
  6357. >>8 byte&0x04 0x04 BZip2
  6358. >>8 byte&0x03 0x00 lvl.0
  6359. >>8 byte&0x03 0x01 lvl.3
  6360. >>8 byte&0x03 0x02 lvl.6
  6361. >>8 byte&0x03 0x03 lvl.9
  6362. #file format >3
  6363. >3 string >3 v.%.1s (unknown details)
  6364.  
  6365. #------------------------------------------------------------------------------
  6366. # hitach-sh: file(1) magic for Hitachi Super-H
  6367. #
  6368. # Super-H COFF
  6369. #
  6370. 0 beshort 0x0500 Hitachi SH big-endian COFF
  6371. >18 beshort&0x0002 =0x0000 object
  6372. >18 beshort&0x0002 =0x0002 executable
  6373. >18 beshort&0x0008 =0x0008 \b, stripped
  6374. >18 beshort&0x0008 =0x0000 \b, not stripped
  6375. #
  6376. 0 leshort 0x0550 Hitachi SH little-endian COFF
  6377. >18 leshort&0x0002 =0x0000 object
  6378. >18 leshort&0x0002 =0x0002 executable
  6379. >18 leshort&0x0008 =0x0008 \b, stripped
  6380. >18 leshort&0x0008 =0x0000 \b, not stripped
  6381.  
  6382.  
  6383. #------------------------------------------------------------------------------
  6384. # hp: file(1) magic for Hewlett Packard machines (see also "printer")
  6385. #
  6386. # XXX - somebody should figure out whether any byte order needs to be
  6387. # applied to the "TML" stuff; I'm assuming the Apollo stuff is
  6388. # big-endian as it was mostly 68K-based.
  6389. #
  6390. # I think the 500 series was the old stack-based machines, running a
  6391. # UNIX environment atop the "SUN kernel"; dunno whether it was
  6392. # big-endian or little-endian.
  6393. #
  6394. # Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
  6395. # hp300 are 68020+68881 based; hp400 are also 68k. The following basic
  6396. # HP magic is useful for reference, but using "long" magic is a better
  6397. # practice in order to avoid collisions.
  6398. #
  6399. # Guy Harris (guy@netapp.com): some additions to this list came from
  6400. # HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
  6401. # 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
  6402. # "/etc/magic", though, except for the "archive file relocatable library"
  6403. # stuff, and the 68030 and 68040 stuff isn't there at all - are they not
  6404. # used in executables, or have they just not yet updated "/etc/magic"
  6405. # completely?
  6406. #
  6407. # 0 beshort 200 hp200 (68010) BSD binary
  6408. # 0 beshort 300 hp300 (68020+68881) BSD binary
  6409. # 0 beshort 0x20c hp200/300 HP-UX binary
  6410. # 0 beshort 0x20d hp400 (68030) HP-UX binary
  6411. # 0 beshort 0x20e hp400 (68040?) HP-UX binary
  6412. # 0 beshort 0x20b PA-RISC1.0 HP-UX binary
  6413. # 0 beshort 0x210 PA-RISC1.1 HP-UX binary
  6414. # 0 beshort 0x211 PA-RISC1.2 HP-UX binary
  6415. # 0 beshort 0x214 PA-RISC2.0 HP-UX binary
  6416.  
  6417. #
  6418. # The "misc" stuff needs a byte order; the archives look suspiciously
  6419. # like the old 177545 archives (0xff65 = 0177545).
  6420. #
  6421. #### Old Apollo stuff
  6422. 0 beshort 0627 Apollo m68k COFF executable
  6423. >18 beshort ^040000 not stripped
  6424. >22 beshort >0 - version %ld
  6425. 0 beshort 0624 apollo a88k COFF executable
  6426. >18 beshort ^040000 not stripped
  6427. >22 beshort >0 - version %ld
  6428. 0 long 01203604016 TML 0123 byte-order format
  6429. 0 long 01702407010 TML 1032 byte-order format
  6430. 0 long 01003405017 TML 2301 byte-order format
  6431. 0 long 01602007412 TML 3210 byte-order format
  6432. #### PA-RISC 1.1
  6433. 0 belong 0x02100106 PA-RISC1.1 relocatable object
  6434. 0 belong 0x02100107 PA-RISC1.1 executable
  6435. >168 belong &0x00000004 dynamically linked
  6436. >(144) belong 0x054ef630 dynamically linked
  6437. >96 belong >0 - not stripped
  6438.  
  6439. 0 belong 0x02100108 PA-RISC1.1 shared executable
  6440. >168 belong&0x4 0x4 dynamically linked
  6441. >(144) belong 0x054ef630 dynamically linked
  6442. >96 belong >0 - not stripped
  6443.  
  6444. 0 belong 0x0210010b PA-RISC1.1 demand-load executable
  6445. >168 belong&0x4 0x4 dynamically linked
  6446. >(144) belong 0x054ef630 dynamically linked
  6447. >96 belong >0 - not stripped
  6448.  
  6449. 0 belong 0x0210010e PA-RISC1.1 shared library
  6450. >96 belong >0 - not stripped
  6451.  
  6452. 0 belong 0x0210010d PA-RISC1.1 dynamic load library
  6453. >96 belong >0 - not stripped
  6454.  
  6455. #### PA-RISC 2.0
  6456. 0 belong 0x02140106 PA-RISC2.0 relocatable object
  6457.  
  6458. 0 belong 0x02140107 PA-RISC2.0 executable
  6459. >168 belong &0x00000004 dynamically linked
  6460. >(144) belong 0x054ef630 dynamically linked
  6461. >96 belong >0 - not stripped
  6462.  
  6463. 0 belong 0x02140108 PA-RISC2.0 shared executable
  6464. >168 belong &0x00000004 dynamically linked
  6465. >(144) belong 0x054ef630 dynamically linked
  6466. >96 belong >0 - not stripped
  6467.  
  6468. 0 belong 0x0214010b PA-RISC2.0 demand-load executable
  6469. >168 belong &0x00000004 dynamically linked
  6470. >(144) belong 0x054ef630 dynamically linked
  6471. >96 belong >0 - not stripped
  6472.  
  6473. 0 belong 0x0214010e PA-RISC2.0 shared library
  6474. >96 belong >0 - not stripped
  6475.  
  6476. 0 belong 0x0214010d PA-RISC2.0 dynamic load library
  6477. >96 belong >0 - not stripped
  6478.  
  6479. #### 800
  6480. 0 belong 0x020b0106 PA-RISC1.0 relocatable object
  6481.  
  6482. 0 belong 0x020b0107 PA-RISC1.0 executable
  6483. >168 belong&0x4 0x4 dynamically linked
  6484. >(144) belong 0x054ef630 dynamically linked
  6485. >96 belong >0 - not stripped
  6486.  
  6487. 0 belong 0x020b0108 PA-RISC1.0 shared executable
  6488. >168 belong&0x4 0x4 dynamically linked
  6489. >(144) belong 0x054ef630 dynamically linked
  6490. >96 belong >0 - not stripped
  6491.  
  6492. 0 belong 0x020b010b PA-RISC1.0 demand-load executable
  6493. >168 belong&0x4 0x4 dynamically linked
  6494. >(144) belong 0x054ef630 dynamically linked
  6495. >96 belong >0 - not stripped
  6496.  
  6497. 0 belong 0x020b010e PA-RISC1.0 shared library
  6498. >96 belong >0 - not stripped
  6499.  
  6500. 0 belong 0x020b010d PA-RISC1.0 dynamic load library
  6501. >96 belong >0 - not stripped
  6502.  
  6503. 0 belong 0x213c6172 archive file
  6504. >68 belong 0x020b0619 - PA-RISC1.0 relocatable library
  6505. >68 belong 0x02100619 - PA-RISC1.1 relocatable library
  6506. >68 belong 0x02110619 - PA-RISC1.2 relocatable library
  6507. >68 belong 0x02140619 - PA-RISC2.0 relocatable library
  6508.  
  6509. #### 500
  6510. 0 long 0x02080106 HP s500 relocatable executable
  6511. >16 long >0 - version %ld
  6512.  
  6513. 0 long 0x02080107 HP s500 executable
  6514. >16 long >0 - version %ld
  6515.  
  6516. 0 long 0x02080108 HP s500 pure executable
  6517. >16 long >0 - version %ld
  6518.  
  6519. #### 200
  6520. 0 belong 0x020c0108 HP s200 pure executable
  6521. >4 beshort >0 - version %ld
  6522. >8 belong &0x80000000 save fp regs
  6523. >8 belong &0x40000000 dynamically linked
  6524. >8 belong &0x20000000 debuggable
  6525. >36 belong >0 not stripped
  6526.  
  6527. 0 belong 0x020c0107 HP s200 executable
  6528. >4 beshort >0 - version %ld
  6529. >8 belong &0x80000000 save fp regs
  6530. >8 belong &0x40000000 dynamically linked
  6531. >8 belong &0x20000000 debuggable
  6532. >36 belong >0 not stripped
  6533.  
  6534. 0 belong 0x020c010b HP s200 demand-load executable
  6535. >4 beshort >0 - version %ld
  6536. >8 belong &0x80000000 save fp regs
  6537. >8 belong &0x40000000 dynamically linked
  6538. >8 belong &0x20000000 debuggable
  6539. >36 belong >0 not stripped
  6540.  
  6541. 0 belong 0x020c0106 HP s200 relocatable executable
  6542. >4 beshort >0 - version %ld
  6543. >6 beshort >0 - highwater %d
  6544. >8 belong &0x80000000 save fp regs
  6545. >8 belong &0x20000000 debuggable
  6546. >8 belong &0x10000000 PIC
  6547.  
  6548. 0 belong 0x020a0108 HP s200 (2.x release) pure executable
  6549. >4 beshort >0 - version %ld
  6550. >36 belong >0 not stripped
  6551.  
  6552. 0 belong 0x020a0107 HP s200 (2.x release) executable
  6553. >4 beshort >0 - version %ld
  6554. >36 belong >0 not stripped
  6555.  
  6556. 0 belong 0x020c010e HP s200 shared library
  6557. >4 beshort >0 - version %ld
  6558. >6 beshort >0 - highwater %d
  6559. >36 belong >0 not stripped
  6560.  
  6561. 0 belong 0x020c010d HP s200 dynamic load library
  6562. >4 beshort >0 - version %ld
  6563. >6 beshort >0 - highwater %d
  6564. >36 belong >0 not stripped
  6565.  
  6566. #### MISC
  6567. 0 long 0x0000ff65 HP old archive
  6568. 0 long 0x020aff65 HP s200 old archive
  6569. 0 long 0x020cff65 HP s200 old archive
  6570. 0 long 0x0208ff65 HP s500 old archive
  6571.  
  6572. 0 long 0x015821a6 HP core file
  6573.  
  6574. 0 long 0x4da7eee8 HP-WINDOWS font
  6575. >8 byte >0 - version %ld
  6576. 0 string Bitmapfile HP Bitmapfile
  6577.  
  6578. 0 string IMGfile CIS compimg HP Bitmapfile
  6579. # XXX - see "lif"
  6580. #0 short 0x8000 lif file
  6581. 0 long 0x020c010c compiled Lisp
  6582.  
  6583. 0 string msgcat01 HP NLS message catalog,
  6584. >8 long >0 %d messages
  6585.  
  6586. # addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92
  6587. 0 string HPHP48- HP48 binary
  6588. >7 byte >0 - Rev %c
  6589. >8 beshort 0x1129 (ADR)
  6590. >8 beshort 0x3329 (REAL)
  6591. >8 beshort 0x5529 (LREAL)
  6592. >8 beshort 0x7729 (COMPLX)
  6593. >8 beshort 0x9d29 (LCOMPLX)
  6594. >8 beshort 0xbf29 (CHAR)
  6595. >8 beshort 0xe829 (ARRAY)
  6596. >8 beshort 0x0a2a (LNKARRAY)
  6597. >8 beshort 0x2c2a (STRING)
  6598. >8 beshort 0x4e2a (HXS)
  6599. >8 beshort 0x742a (LIST)
  6600. >8 beshort 0x962a (DIR)
  6601. >8 beshort 0xb82a (ALG)
  6602. >8 beshort 0xda2a (UNIT)
  6603. >8 beshort 0xfc2a (TAGGED)
  6604. >8 beshort 0x1e2b (GROB)
  6605. >8 beshort 0x402b (LIB)
  6606. >8 beshort 0x622b (BACKUP)
  6607. >8 beshort 0x882b (LIBDATA)
  6608. >8 beshort 0x9d2d (PROG)
  6609. >8 beshort 0xcc2d (CODE)
  6610. >8 beshort 0x482e (GNAME)
  6611. >8 beshort 0x6d2e (LNAME)
  6612. >8 beshort 0x922e (XLIB)
  6613. 0 string %%HP: HP48 text
  6614. >6 string T(0) - T(0)
  6615. >6 string T(1) - T(1)
  6616. >6 string T(2) - T(2)
  6617. >6 string T(3) - T(3)
  6618. >10 string A(D) A(D)
  6619. >10 string A(R) A(R)
  6620. >10 string A(G) A(G)
  6621. >14 string F(.) F(.);
  6622. >14 string F(,) F(,);
  6623.  
  6624. # hpBSD magic numbers
  6625. 0 beshort 200 hp200 (68010) BSD
  6626. >2 beshort 0407 impure binary
  6627. >2 beshort 0410 read-only binary
  6628. >2 beshort 0413 demand paged binary
  6629. 0 beshort 300 hp300 (68020+68881) BSD
  6630. >2 beshort 0407 impure binary
  6631. >2 beshort 0410 read-only binary
  6632. >2 beshort 0413 demand paged binary
  6633. #
  6634. # From David Gero <dgero@nortelnetworks.com>
  6635. # HP-UX 10.20 core file format from /usr/include/sys/core.h
  6636. # Unfortunately, HP-UX uses corehead blocks without specifying the order
  6637. # There are four we care about:
  6638. # CORE_KERNEL, which starts with the string "HP-UX"
  6639. # CORE_EXEC, which contains the name of the command
  6640. # CORE_PROC, which contains the signal number that caused the core dump
  6641. # CORE_FORMAT, which contains the version of the core file format (== 1)
  6642. # The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC
  6643. # but we include all 6 variations of the order of the first 3, and
  6644. # assume that PROC will always be last
  6645. # Order 1: KERNEL, EXEC, FORMAT, PROC
  6646. 0x10 string HP-UX
  6647. >0 belong 2
  6648. >>0xC belong 0x3C
  6649. >>>0x4C belong 0x100
  6650. >>>>0x58 belong 0x44
  6651. >>>>>0xA0 belong 1
  6652. >>>>>>0xAC belong 4
  6653. >>>>>>>0xB0 belong 1
  6654. >>>>>>>>0xB4 belong 4 core file
  6655. >>>>>>>>>0x90 string >\0 from '%s'
  6656. >>>>>>>>>0xC4 belong 3 - received SIGQUIT
  6657. >>>>>>>>>0xC4 belong 4 - received SIGILL
  6658. >>>>>>>>>0xC4 belong 5 - received SIGTRAP
  6659. >>>>>>>>>0xC4 belong 6 - received SIGABRT
  6660. >>>>>>>>>0xC4 belong 7 - received SIGEMT
  6661. >>>>>>>>>0xC4 belong 8 - received SIGFPE
  6662. >>>>>>>>>0xC4 belong 10 - received SIGBUS
  6663. >>>>>>>>>0xC4 belong 11 - received SIGSEGV
  6664. >>>>>>>>>0xC4 belong 12 - received SIGSYS
  6665. >>>>>>>>>0xC4 belong 33 - received SIGXCPU
  6666. >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
  6667. # Order 2: KERNEL, FORMAT, EXEC, PROC
  6668. >>>0x4C belong 1
  6669. >>>>0x58 belong 4
  6670. >>>>>0x5C belong 1
  6671. >>>>>>0x60 belong 0x100
  6672. >>>>>>>0x6C belong 0x44
  6673. >>>>>>>>0xB4 belong 4 core file
  6674. >>>>>>>>>0xA4 string >\0 from '%s'
  6675. >>>>>>>>>0xC4 belong 3 - received SIGQUIT
  6676. >>>>>>>>>0xC4 belong 4 - received SIGILL
  6677. >>>>>>>>>0xC4 belong 5 - received SIGTRAP
  6678. >>>>>>>>>0xC4 belong 6 - received SIGABRT
  6679. >>>>>>>>>0xC4 belong 7 - received SIGEMT
  6680. >>>>>>>>>0xC4 belong 8 - received SIGFPE
  6681. >>>>>>>>>0xC4 belong 10 - received SIGBUS
  6682. >>>>>>>>>0xC4 belong 11 - received SIGSEGV
  6683. >>>>>>>>>0xC4 belong 12 - received SIGSYS
  6684. >>>>>>>>>0xC4 belong 33 - received SIGXCPU
  6685. >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
  6686. # Order 3: FORMAT, KERNEL, EXEC, PROC
  6687. 0x24 string HP-UX
  6688. >0 belong 1
  6689. >>0xC belong 4
  6690. >>>0x10 belong 1
  6691. >>>>0x14 belong 2
  6692. >>>>>0x20 belong 0x3C
  6693. >>>>>>0x60 belong 0x100
  6694. >>>>>>>0x6C belong 0x44
  6695. >>>>>>>>0xB4 belong 4 core file
  6696. >>>>>>>>>0xA4 string >\0 from '%s'
  6697. >>>>>>>>>0xC4 belong 3 - received SIGQUIT
  6698. >>>>>>>>>0xC4 belong 4 - received SIGILL
  6699. >>>>>>>>>0xC4 belong 5 - received SIGTRAP
  6700. >>>>>>>>>0xC4 belong 6 - received SIGABRT
  6701. >>>>>>>>>0xC4 belong 7 - received SIGEMT
  6702. >>>>>>>>>0xC4 belong 8 - received SIGFPE
  6703. >>>>>>>>>0xC4 belong 10 - received SIGBUS
  6704. >>>>>>>>>0xC4 belong 11 - received SIGSEGV
  6705. >>>>>>>>>0xC4 belong 12 - received SIGSYS
  6706. >>>>>>>>>0xC4 belong 33 - received SIGXCPU
  6707. >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
  6708. # Order 4: EXEC, KERNEL, FORMAT, PROC
  6709. 0x64 string HP-UX
  6710. >0 belong 0x100
  6711. >>0xC belong 0x44
  6712. >>>0x54 belong 2
  6713. >>>>0x60 belong 0x3C
  6714. >>>>>0xA0 belong 1
  6715. >>>>>>0xAC belong 4
  6716. >>>>>>>0xB0 belong 1
  6717. >>>>>>>>0xB4 belong 4 core file
  6718. >>>>>>>>>0x44 string >\0 from '%s'
  6719. >>>>>>>>>0xC4 belong 3 - received SIGQUIT
  6720. >>>>>>>>>0xC4 belong 4 - received SIGILL
  6721. >>>>>>>>>0xC4 belong 5 - received SIGTRAP
  6722. >>>>>>>>>0xC4 belong 6 - received SIGABRT
  6723. >>>>>>>>>0xC4 belong 7 - received SIGEMT
  6724. >>>>>>>>>0xC4 belong 8 - received SIGFPE
  6725. >>>>>>>>>0xC4 belong 10 - received SIGBUS
  6726. >>>>>>>>>0xC4 belong 11 - received SIGSEGV
  6727. >>>>>>>>>0xC4 belong 12 - received SIGSYS
  6728. >>>>>>>>>0xC4 belong 33 - received SIGXCPU
  6729. >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
  6730. # Order 5: FORMAT, EXEC, KERNEL, PROC
  6731. 0x78 string HP-UX
  6732. >0 belong 1
  6733. >>0xC belong 4
  6734. >>>0x10 belong 1
  6735. >>>>0x14 belong 0x100
  6736. >>>>>0x20 belong 0x44
  6737. >>>>>>0x68 belong 2
  6738. >>>>>>>0x74 belong 0x3C
  6739. >>>>>>>>0xB4 belong 4 core file
  6740. >>>>>>>>>0x58 string >\0 from '%s'
  6741. >>>>>>>>>0xC4 belong 3 - received SIGQUIT
  6742. >>>>>>>>>0xC4 belong 4 - received SIGILL
  6743. >>>>>>>>>0xC4 belong 5 - received SIGTRAP
  6744. >>>>>>>>>0xC4 belong 6 - received SIGABRT
  6745. >>>>>>>>>0xC4 belong 7 - received SIGEMT
  6746. >>>>>>>>>0xC4 belong 8 - received SIGFPE
  6747. >>>>>>>>>0xC4 belong 10 - received SIGBUS
  6748. >>>>>>>>>0xC4 belong 11 - received SIGSEGV
  6749. >>>>>>>>>0xC4 belong 12 - received SIGSYS
  6750. >>>>>>>>>0xC4 belong 33 - received SIGXCPU
  6751. >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
  6752. # Order 6: EXEC, FORMAT, KERNEL, PROC
  6753. >0 belong 0x100
  6754. >>0xC belong 0x44
  6755. >>>0x54 belong 1
  6756. >>>>0x60 belong 4
  6757. >>>>>0x64 belong 1
  6758. >>>>>>0x68 belong 2
  6759. >>>>>>>0x74 belong 0x2C
  6760. >>>>>>>>0xB4 belong 4 core file
  6761. >>>>>>>>>0x44 string >\0 from '%s'
  6762. >>>>>>>>>0xC4 belong 3 - received SIGQUIT
  6763. >>>>>>>>>0xC4 belong 4 - received SIGILL
  6764. >>>>>>>>>0xC4 belong 5 - received SIGTRAP
  6765. >>>>>>>>>0xC4 belong 6 - received SIGABRT
  6766. >>>>>>>>>0xC4 belong 7 - received SIGEMT
  6767. >>>>>>>>>0xC4 belong 8 - received SIGFPE
  6768. >>>>>>>>>0xC4 belong 10 - received SIGBUS
  6769. >>>>>>>>>0xC4 belong 11 - received SIGSEGV
  6770. >>>>>>>>>0xC4 belong 12 - received SIGSYS
  6771. >>>>>>>>>0xC4 belong 33 - received SIGXCPU
  6772. >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
  6773.  
  6774. # From: AMAKAWA Shuhei <sa264@cam.ac.uk>
  6775. 0 string HPHP49- HP49 binary
  6776.  
  6777.  
  6778. #------------------------------------------------------------------------------
  6779. # human68k: file(1) magic for Human68k (X680x0 DOS) binary formats
  6780. # Magic too short!
  6781. #0 string HU Human68k
  6782. #>68 string LZX LZX compressed
  6783. #>>72 string >\0 (version %s)
  6784. #>(8.L+74) string LZX LZX compressed
  6785. #>>(8.L+78) string >\0 (version %s)
  6786. #>60 belong >0 binded
  6787. #>(8.L+66) string #HUPAIR hupair
  6788. #>0 string HU X executable
  6789. #>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1
  6790. #>4 belong >0 - base address 0x%x
  6791. #>28 belong >0 not stripped
  6792. #>32 belong >0 with debug information
  6793. #0 beshort 0x601a Human68k Z executable
  6794. #0 beshort 0x6000 Human68k object file
  6795. #0 belong 0xd1000000 Human68k ar binary archive
  6796. #0 belong 0xd1010000 Human68k ar ascii archive
  6797. #0 beshort 0x0068 Human68k lib archive
  6798. #4 string LZX Human68k LZX compressed
  6799. #>8 string >\0 (version %s)
  6800. #>4 string LZX R executable
  6801. #2 string #HUPAIR Human68k hupair R executable
  6802.  
  6803. #------------------------------------------------------------------------------
  6804. # ibm370: file(1) magic for IBM 370 and compatibles.
  6805. #
  6806. # "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
  6807. # What the heck *is* "USS/370"?
  6808. # AIX 4.1's "/etc/magic" has
  6809. #
  6810. # 0 short 0535 370 sysV executable
  6811. # >12 long >0 not stripped
  6812. # >22 short >0 - version %d
  6813. # >30 long >0 - 5.2 format
  6814. # 0 short 0530 370 sysV pure executable
  6815. # >12 long >0 not stripped
  6816. # >22 short >0 - version %d
  6817. # >30 long >0 - 5.2 format
  6818. #
  6819. # instead of the "USS/370" versions of the same magic numbers.
  6820. #
  6821. 0 beshort 0537 370 XA sysV executable
  6822. >12 belong >0 not stripped
  6823. >22 beshort >0 - version %d
  6824. >30 belong >0 - 5.2 format
  6825. 0 beshort 0532 370 XA sysV pure executable
  6826. >12 belong >0 not stripped
  6827. >22 beshort >0 - version %d
  6828. >30 belong >0 - 5.2 format
  6829. 0 beshort 054001 370 sysV pure executable
  6830. >12 belong >0 not stripped
  6831. 0 beshort 055001 370 XA sysV pure executable
  6832. >12 belong >0 not stripped
  6833. 0 beshort 056401 370 sysV executable
  6834. >12 belong >0 not stripped
  6835. 0 beshort 057401 370 XA sysV executable
  6836. >12 belong >0 not stripped
  6837. 0 beshort 0531 SVR2 executable (Amdahl-UTS)
  6838. >12 belong >0 not stripped
  6839. >24 belong >0 - version %ld
  6840. 0 beshort 0534 SVR2 pure executable (Amdahl-UTS)
  6841. >12 belong >0 not stripped
  6842. >24 belong >0 - version %ld
  6843. 0 beshort 0530 SVR2 pure executable (USS/370)
  6844. >12 belong >0 not stripped
  6845. >24 belong >0 - version %ld
  6846. 0 beshort 0535 SVR2 executable (USS/370)
  6847. >12 belong >0 not stripped
  6848. >24 belong >0 - version %ld
  6849.  
  6850. #------------------------------------------------------------------------------
  6851. # ibm6000: file(1) magic for RS/6000 and the RT PC.
  6852. #
  6853. 0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
  6854. >12 belong >0 not stripped
  6855. # Breaks sun4 statically linked execs.
  6856. #0 beshort 0x0103 executable (RT Version 2) or obj module
  6857. #>2 byte 0x50 pure
  6858. #>28 belong >0 not stripped
  6859. #>6 beshort >0 - version %ld
  6860. 0 beshort 0x0104 shared library
  6861. 0 beshort 0x0105 ctab data
  6862. 0 beshort 0xfe04 structured file
  6863. 0 string 0xabcdef AIX message catalog
  6864. 0 belong 0x000001f9 AIX compiled message catalog
  6865. 0 string \<aiaff> archive
  6866. 0 string \<bigaf> archive (big format)
  6867.  
  6868.  
  6869. #------------------------------------------------------------------------------
  6870. # iff: file(1) magic for Interchange File Format (see also "audio" & "images")
  6871. #
  6872. # Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
  6873. # Arts for file interchange. It has also been used by Apple, SGI, and
  6874. # especially Commodore-Amiga.
  6875. #
  6876. # IFF files begin with an 8 byte FORM header, followed by a 4 character
  6877. # FORM type, which is followed by the first chunk in the FORM.
  6878.  
  6879. 0 string FORM IFF data
  6880. #>4 belong x \b, FORM is %d bytes long
  6881. # audio formats
  6882. >8 string AIFF \b, AIFF audio
  6883. >8 string AIFC \b, AIFF-C compressed audio
  6884. >8 string 8SVX \b, 8SVX 8-bit sampled sound voice
  6885. >8 string 16SV \b, 16SV 16-bit sampled sound voice
  6886. >8 string SAMP \b, SAMP sampled audio
  6887. >8 string MAUD \b, MAUD MacroSystem audio
  6888. >8 string SMUS \b, SMUS simple music
  6889. >8 string CMUS \b, CMUS complex music
  6890. # image formats
  6891. >8 string ILBMBMHD \b, ILBM interleaved image
  6892. >>20 beshort x \b, %d x
  6893. >>22 beshort x %d
  6894. >8 string RGBN \b, RGBN 12-bit RGB image
  6895. >8 string RGB8 \b, RGB8 24-bit RGB image
  6896. >8 string DEEP \b, DEEP TVPaint/XiPaint image
  6897. >8 string DR2D \b, DR2D 2-D object
  6898. >8 string TDDD \b, TDDD 3-D rendering
  6899. >8 string LWOB \b, LWOB 3-D object
  6900. >8 string LWO2 \b, LWO2 3-D object, v2
  6901. >8 string LWLO \b, LWLO 3-D layered object
  6902. >8 string REAL \b, REAL Real3D rendering
  6903. >8 string MC4D \b, MC4D MaxonCinema4D rendering
  6904. >8 string ANIM \b, ANIM animation
  6905. >8 string YAFA \b, YAFA animation
  6906. >8 string SSA\ \b, SSA super smooth animation
  6907. >8 string ACBM \b, ACBM continuous image
  6908. >8 string FAXX \b, FAXX fax image
  6909. # other formats
  6910. >8 string FTXT \b, FTXT formatted text
  6911. >8 string CTLG \b, CTLG message catalog
  6912. >8 string PREF \b, PREF preferences
  6913. >8 string DTYP \b, DTYP datatype description
  6914. >8 string PTCH \b, PTCH binary patch
  6915. >8 string AMFF \b, AMFF AmigaMetaFile format
  6916. >8 string WZRD \b, WZRD StormWIZARD resource
  6917. >8 string DOC\ \b, DOC desktop publishing document
  6918.  
  6919. # These go at the end of the iff rules
  6920. #
  6921. # I don't see why these might collide with anything else.
  6922. #
  6923. # Interactive Fiction related formats
  6924. #
  6925. >8 string IFRS \b, Blorb Interactive Fiction
  6926. >>24 string Exec with executable chunk
  6927. >8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal)
  6928.  
  6929. #------------------------------------------------------------------------------
  6930. # images: file(1) magic for image formats (see also "iff")
  6931. #
  6932. # originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
  6933. # additions by janl@ifi.uio.no as well as others. Jan also suggested
  6934. # merging several one- and two-line files into here.
  6935. #
  6936. # little magic: PCX (first byte is 0x0a)
  6937.  
  6938. # Targa - matches `povray', `ppmtotga' and `xv' outputs
  6939. # by Philippe De Muyter <phdm@macqel.be>
  6940. # at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
  6941. # at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
  6942. # at 3, leshort Index is 0 for povray, ppmtotga and xv outputs
  6943. # `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
  6944. # `tgatoppm' recognizes a superset (Index may be anything)
  6945. 1 belong&0xfff7ffff 0x01010000 Targa image data - Map
  6946. >2 byte&8 8 - RLE
  6947. >12 leshort >0 %hd x
  6948. >14 leshort >0 %hd
  6949. 1 belong&0xfff7ffff 0x00020000 Targa image data - RGB
  6950. >2 byte&8 8 - RLE
  6951. >12 leshort >0 %hd x
  6952. >14 leshort >0 %hd
  6953. 1 belong&0xfff7ffff 0x00030000 Targa image data - Mono
  6954. >2 byte&8 8 - RLE
  6955. >12 leshort >0 %hd x
  6956. >14 leshort >0 %hd
  6957.  
  6958. # PBMPLUS images
  6959. # The next byte following the magic is always whitespace.
  6960. 0 string P1 Netpbm PBM image text
  6961. 0 string P2 Netpbm PGM image text
  6962. 0 string P3 Netpbm PPM image text
  6963. 0 string P4 Netpbm PBM "rawbits" image data
  6964. 0 string P5 Netpbm PGM "rawbits" image data
  6965. 0 string P6 Netpbm PPM "rawbits" image data
  6966. 0 string P7 Netpbm PAM image file
  6967.  
  6968. # From: bryanh@giraffe-data.com (Bryan Henderson)
  6969. 0 string \117\072 Solitaire Image Recorder format
  6970. >4 string \013 MGI Type 11
  6971. >4 string \021 MGI Type 17
  6972. 0 string .MDA MicroDesign data
  6973. >21 byte 48 version 2
  6974. >21 byte 51 version 3
  6975. 0 string .MDP MicroDesign page data
  6976. >21 byte 48 version 2
  6977. >21 byte 51 version 3
  6978.  
  6979. # NIFF (Navy Interchange File Format, a modification of TIFF) images
  6980. 0 string IIN1 NIFF image data
  6981.  
  6982. # Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
  6983. # The second word of TIFF files is the TIFF version number, 42, which has
  6984. # never changed. The TIFF specification recommends testing for it.
  6985. 0 string MM\x00\x2a TIFF image data, big-endian
  6986. 0 string II\x2a\x00 TIFF image data, little-endian
  6987.  
  6988. # PNG [Portable Network Graphics, or "PNG's Not GIF"] images
  6989. # (Greg Roelofs, newt@uchicago.edu)
  6990. # (Albert Cahalan, acahalan@cs.uml.edu)
  6991. #
  6992. # 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
  6993. #
  6994. 0 string \x89PNG PNG image data,
  6995. >4 belong !0x0d0a1a0a CORRUPTED,
  6996. >4 belong 0x0d0a1a0a
  6997. >>16 belong x %ld x
  6998. >>20 belong x %ld,
  6999. >>24 byte x %d-bit
  7000. >>25 byte 0 grayscale,
  7001. >>25 byte 2 \b/color RGB,
  7002. >>25 byte 3 colormap,
  7003. >>25 byte 4 gray+alpha,
  7004. >>25 byte 6 \b/color RGBA,
  7005. #>>26 byte 0 deflate/32K,
  7006. >>28 byte 0 non-interlaced
  7007. >>28 byte 1 interlaced
  7008. 1 string PNG PNG image data, CORRUPTED
  7009.  
  7010. # GIF
  7011. 0 string GIF8 GIF image data
  7012. >4 string 7a \b, version 8%s,
  7013. >4 string 9a \b, version 8%s,
  7014. >6 leshort >0 %hd x
  7015. >8 leshort >0 %hd
  7016. #>10 byte &0x80 color mapped,
  7017. #>10 byte&0x07 =0x00 2 colors
  7018. #>10 byte&0x07 =0x01 4 colors
  7019. #>10 byte&0x07 =0x02 8 colors
  7020. #>10 byte&0x07 =0x03 16 colors
  7021. #>10 byte&0x07 =0x04 32 colors
  7022. #>10 byte&0x07 =0x05 64 colors
  7023. #>10 byte&0x07 =0x06 128 colors
  7024. #>10 byte&0x07 =0x07 256 colors
  7025.  
  7026. # ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster,
  7027. # 1 plane, no encoding.
  7028. 0 string \361\0\100\273 CMU window manager raster image data
  7029. >4 lelong >0 %d x
  7030. >8 lelong >0 %d,
  7031. >12 lelong >0 %d-bit
  7032.  
  7033. # Magick Image File Format
  7034. 0 string id=ImageMagick MIFF image data
  7035.  
  7036. # Artisan
  7037. 0 long 1123028772 Artisan image data
  7038. >4 long 1 \b, rectangular 24-bit
  7039. >4 long 2 \b, rectangular 8-bit with colormap
  7040. >4 long 3 \b, rectangular 32-bit (24-bit with matte)
  7041.  
  7042. # FIG (Facility for Interactive Generation of figures), an object-based format
  7043. 0 string #FIG FIG image text
  7044. >5 string x \b, version %.3s
  7045.  
  7046. # PHIGS
  7047. 0 string ARF_BEGARF PHIGS clear text archive
  7048. 0 string @(#)SunPHIGS SunPHIGS
  7049. # version number follows, in the form m.n
  7050. >40 string SunBin binary
  7051. >32 string archive archive
  7052.  
  7053. # GKS (Graphics Kernel System)
  7054. 0 string GKSM GKS Metafile
  7055. >24 string SunGKS \b, SunGKS
  7056.  
  7057. # CGM image files
  7058. 0 string BEGMF clear text Computer Graphics Metafile
  7059. # XXX - questionable magic
  7060. 0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile
  7061. 0 beshort 0x3020 character Computer Graphics Metafile
  7062.  
  7063. # MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
  7064. 0 string yz MGR bitmap, modern format, 8-bit aligned
  7065. 0 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned
  7066. 0 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned
  7067. 0 string yx MGR bitmap, modern format, squeezed
  7068.  
  7069. # Fuzzy Bitmap (FBM) images
  7070. 0 string %bitmap\0 FBM image data
  7071. >30 long 0x31 \b, mono
  7072. >30 long 0x33 \b, color
  7073.  
  7074. # facsimile data
  7075. 1 string PC\ Research,\ Inc group 3 fax data
  7076. >29 byte 0 \b, normal resolution (204x98 DPI)
  7077. >29 byte 1 \b, fine resolution (204x196 DPI)
  7078. # From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at>
  7079. 0 string Sfff structured fax file
  7080.  
  7081.  
  7082. # PC bitmaps (OS/2, Windoze BMP files) (Greg Roelofs, newt@uchicago.edu)
  7083. 0 string BM PC bitmap data
  7084. >14 leshort 12 \b, OS/2 1.x format
  7085. >>18 leshort x \b, %d x
  7086. >>20 leshort x %d
  7087. >14 leshort 64 \b, OS/2 2.x format
  7088. >>18 leshort x \b, %d x
  7089. >>20 leshort x %d
  7090. >14 leshort 40 \b, Windows 3.x format
  7091. >>18 lelong x \b, %d x
  7092. >>22 lelong x %d x
  7093. >>28 leshort x %d
  7094. # Too simple - MPi
  7095. #0 string IC PC icon data
  7096. #0 string PI PC pointer image data
  7097. #0 string CI PC color icon data
  7098. #0 string CP PC color pointer image data
  7099. # Conflicts with other entries [BABYL]
  7100. #0 string BA PC bitmap array data
  7101.  
  7102. # XPM icons (Greg Roelofs, newt@uchicago.edu)
  7103. # note possible collision with C/REXX entry in c-lang; currently commented out
  7104. 0 string /*\ XPM\ */ X pixmap image text
  7105.  
  7106. # Utah Raster Toolkit RLE images (janl@ifi.uio.no)
  7107. 0 leshort 0xcc52 RLE image data,
  7108. >6 leshort x %d x
  7109. >8 leshort x %d
  7110. >2 leshort >0 \b, lower left corner: %d
  7111. >4 leshort >0 \b, lower right corner: %d
  7112. >10 byte&0x1 =0x1 \b, clear first
  7113. >10 byte&0x2 =0x2 \b, no background
  7114. >10 byte&0x4 =0x4 \b, alpha channel
  7115. >10 byte&0x8 =0x8 \b, comment
  7116. >11 byte >0 \b, %d color channels
  7117. >12 byte >0 \b, %d bits per pixel
  7118. >13 byte >0 \b, %d color map channels
  7119.  
  7120. # image file format (Robert Potter, potter@cs.rochester.edu)
  7121. 0 string Imagefile\ version- iff image data
  7122. # this adds the whole header (inc. version number), informative but longish
  7123. >10 string >\0 %s
  7124.  
  7125. # Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
  7126. 0 belong 0x59a66a95 Sun raster image data
  7127. >4 belong >0 \b, %d x
  7128. >8 belong >0 %d,
  7129. >12 belong >0 %d-bit,
  7130. #>16 belong >0 %d bytes long,
  7131. >20 belong 0 old format,
  7132. #>20 belong 1 standard,
  7133. >20 belong 2 compressed,
  7134. >20 belong 3 RGB,
  7135. >20 belong 4 TIFF,
  7136. >20 belong 5 IFF,
  7137. >20 belong 0xffff reserved for testing,
  7138. >24 belong 0 no colormap
  7139. >24 belong 1 RGB colormap
  7140. >24 belong 2 raw colormap
  7141. #>28 belong >0 colormap is %d bytes long
  7142.  
  7143. # SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
  7144. #
  7145. # See
  7146. # http://reality.sgi.com/grafica/sgiimage.html
  7147. #
  7148. 0 beshort 474 SGI image data
  7149. #>2 byte 0 \b, verbatim
  7150. >2 byte 1 \b, RLE
  7151. #>3 byte 1 \b, normal precision
  7152. >3 byte 2 \b, high precision
  7153. >4 beshort x \b, %d-D
  7154. >6 beshort x \b, %d x
  7155. >8 beshort x %d
  7156. >10 beshort x \b, %d channel
  7157. >10 beshort !1 \bs
  7158. >80 string >0 \b, "%s"
  7159.  
  7160. 0 string IT01 FIT image data
  7161. >4 belong x \b, %d x
  7162. >8 belong x %d x
  7163. >12 belong x %d
  7164. #
  7165. 0 string IT02 FIT image data
  7166. >4 belong x \b, %d x
  7167. >8 belong x %d x
  7168. >12 belong x %d
  7169. #
  7170. 2048 string PCD_IPI Kodak Photo CD image pack file
  7171. >0xe02 byte&0x03 0x00 , landscape mode
  7172. >0xe02 byte&0x03 0x01 , portrait mode
  7173. >0xe02 byte&0x03 0x02 , landscape mode
  7174. >0xe02 byte&0x03 0x03 , portrait mode
  7175. 0 string PCD_OPA Kodak Photo CD overview pack file
  7176.  
  7177. # FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
  7178. # FITS is the Flexible Image Transport System, the de facto standard for
  7179. # data and image transfer, storage, etc., for the astronomical community.
  7180. # (FITS floating point formats are big-endian.)
  7181. 0 string SIMPLE\ \ = FITS image data
  7182. >109 string 8 \b, 8-bit, character or unsigned binary integer
  7183. >108 string 16 \b, 16-bit, two's complement binary integer
  7184. >107 string \ 32 \b, 32-bit, two's complement binary integer
  7185. >107 string -32 \b, 32-bit, floating point, single precision
  7186. >107 string -64 \b, 64-bit, floating point, double precision
  7187.  
  7188. # other images
  7189. 0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file
  7190. 0 string =!! Bennet Yee's "face" format
  7191.  
  7192. # From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
  7193. # stuff.
  7194. #
  7195. 0 beshort 0x1010 PEX Binary Archive
  7196.  
  7197. # DICOM medical imaging data
  7198. 128 string DICM DICOM medical imaging data
  7199.  
  7200. # XWD - X Window Dump file.
  7201. # As described in /usr/X11R6/include/X11/XWDFile.h
  7202. # used by the xwd program.
  7203. # Bradford Castalia, idaeim, 1/01
  7204. 4 belong 7 XWD X Window Dump image data
  7205. >100 string >\0 \b, "%s"
  7206. >16 belong x \b, %dx
  7207. >20 belong x \b%dx
  7208. >12 belong x \b%d
  7209.  
  7210. # PDS - Planetary Data System
  7211. # These files use Parameter Value Language in the header section.
  7212. # Unfortunately, there is no certain magic, but the following
  7213. # strings have been found to be most likely.
  7214. 0 string NJPL1I00 PDS (JPL) image data
  7215. 2 string NJPL1I PDS (JPL) image data
  7216. 0 string CCSD3ZF PDS (CCSD) image data
  7217. 2 string CCSD3Z PDS (CCSD) image data
  7218. 0 string PDS_ PDS image data
  7219. 0 string LBLSIZE= PDS (VICAR) image data
  7220.  
  7221. # pM8x: ATARI STAD compressed bitmap format
  7222. #
  7223. # from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001
  7224. # p M 8 5/6 xx yy zz data...
  7225. # Atari ST STAD bitmap is always 640x400, bytewise runlength compressed.
  7226. # bytes either run horizontally (pM85) or vertically (pM86). yy is the
  7227. # most frequent byte, xx and zz are runlength escape codes, where xx is
  7228. # used for runs of yy.
  7229. #
  7230. 0 string pM85 Atari ST STAD bitmap image data (hor)
  7231. >5 byte 0x00 (white background)
  7232. >5 byte 0xFF (black background)
  7233. 0 string pM86 Atari ST STAD bitmap image data (vert)
  7234. >5 byte 0x00 (white background)
  7235. >5 byte 0xFF (black background)
  7236.  
  7237. # Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
  7238. # http://www.atarimax.com/jindroush.atari.org/afmtatr.html
  7239. 0 leshort 0x0296 Atari ATR image
  7240.  
  7241. # XXX:
  7242. # This is bad magic 0x5249 == 'RI' conflicts with RIFF and other
  7243. # magic.
  7244. # SGI RICE image file <mpruett@sgi.com>
  7245. #0 beshort 0x5249 RICE image
  7246. #>2 beshort x v%d
  7247. #>4 beshort x (%d x
  7248. #>6 beshort x %d)
  7249. #>8 beshort 0 8 bit
  7250. #>8 beshort 1 10 bit
  7251. #>8 beshort 2 12 bit
  7252. #>8 beshort 3 13 bit
  7253. #>10 beshort 0 4:2:2
  7254. #>10 beshort 1 4:2:2:4
  7255. #>10 beshort 2 4:4:4
  7256. #>10 beshort 3 4:4:4:4
  7257. #>12 beshort 1 RGB
  7258. #>12 beshort 2 CCIR601
  7259. #>12 beshort 3 RP175
  7260. #>12 beshort 4 YUV
  7261.  
  7262. #------------------------------------------------------------------------------
  7263. #
  7264. # Marco Schmidt (marcoschmidt@users.sourceforge.net) -- an image file format
  7265. # for the EPOC operating system, which is used with PDAs like those from Psion
  7266. #
  7267. # see http://huizen.dds.nl/~frodol/psiconv/html/Index.html for a description
  7268. # of various EPOC file formats
  7269.  
  7270. 0 string \x37\x00\x00\x10\x42\x00\x00\x10\x00\x00\x00\x00\x39\x64\x39\x47 EPOC MBM image file
  7271.  
  7272. # PCX image files
  7273. # From: Dan Fandrich <dan@coneharvesters.com>
  7274. 0 beshort 0x0a00 PCX ver. 2.5 image data
  7275. 0 beshort 0x0a02 PCX ver. 2.8 image data, with palette
  7276. 0 beshort 0x0a03 PCX ver. 2.8 image data, without palette
  7277. 0 beshort 0x0a04 PCX for Windows image data
  7278. 0 beshort 0x0a05 PCX ver. 3.0 image data
  7279. >4 leshort x bounding box [%hd,
  7280. >6 leshort x %hd] -
  7281. >8 leshort x [%hd,
  7282. >10 leshort x %hd],
  7283. >65 byte >1 %d planes each of
  7284. >3 byte x %hhd-bit
  7285. >68 byte 0 image,
  7286. >68 byte 1 colour,
  7287. >68 byte 2 grayscale,
  7288. >68 byte >2 image,
  7289. >68 byte <0 image,
  7290. >12 leshort >0 %hd x
  7291. >>14 leshort x %hd dpi,
  7292. >2 byte 0 uncompressed
  7293. >2 byte 1 RLE compressed
  7294.  
  7295. # Adobe Photoshop
  7296. 0 string 8BPS Adobe Photoshop Image
  7297.  
  7298. # XV thumbnail indicator (ThMO)
  7299. 0 string P7\ 332 XV thumbnail image data
  7300.  
  7301. # NITF is defined by United States MIL-STD-2500A
  7302. 0 string NITF National Imagery Transmission Format
  7303. >25 string >\0 dated %.14s
  7304.  
  7305. # GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
  7306. 0 belong 0x00010008 GEM Image data
  7307. >12 beshort x %d x
  7308. >14 beshort x %d,
  7309. >4 beshort x %d planes,
  7310. >8 beshort x %d x
  7311. >10 beshort x %d pixelsize
  7312.  
  7313. # GEM Metafile (Wolfram Kleff)
  7314. 0 lelong 0x0018FFFF GEM Metafile data
  7315. >4 leshort x version %d
  7316.  
  7317. #
  7318. # SMJPEG. A custom Motion JPEG format used by Loki Entertainment
  7319. # Software Torbjorn Andersson <d91tan@Update.UU.SE>.
  7320. #
  7321. 0 string \0\nSMJPEG SMJPEG
  7322. >8 belong x %d.x data
  7323. # According to the specification you could find any number of _TXT
  7324. # headers here, but I can't think of any way of handling that. None of
  7325. # the SMJPEG files I tried it on used this feature. Even if such a
  7326. # file is encountered the output should still be reasonable.
  7327. >16 string _SND \b,
  7328. >>24 beshort >0 %d Hz
  7329. >>26 byte 8 8-bit
  7330. >>26 byte 16 16-bit
  7331. >>28 string NONE uncompressed
  7332. # >>28 string APCM ADPCM compressed
  7333. >>27 byte 1 mono
  7334. >>28 byte 2 stereo
  7335. # Help! Isn't there any way to avoid writing this part twice?
  7336. >>32 string _VID \b,
  7337. # >>>48 string JFIF JPEG
  7338. >>>40 belong >0 %d frames
  7339. >>>44 beshort >0 (%d x
  7340. >>>46 beshort >0 %d)
  7341. >16 string _VID \b,
  7342. # >>32 string JFIF JPEG
  7343. >>24 belong >0 %d frames
  7344. >>28 beshort >0 (%d x
  7345. >>30 beshort >0 %d)
  7346.  
  7347. 0 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File
  7348.  
  7349. # "thumbnail file" (icon)
  7350. # descended from "xv", but in use by other applications as well (Wolfram Kleff)
  7351. 0 string P7\ 332 XV "thumbnail file" (icon) data
  7352.  
  7353. # taken from fkiss: (<yav@mte.biglobe.ne.jp> ?)
  7354. 0 string KiSS KISS/GS
  7355. >4 byte 16 color
  7356. >>5 byte x %d bit
  7357. >>8 leshort x %d colors
  7358. >>10 leshort x %d groups
  7359. >4 byte 32 cell
  7360. >>5 byte x %d bit
  7361. >>8 leshort x %d x
  7362. >>10 leshort x %d
  7363. >>12 leshort x +%d
  7364. >>14 leshort x +%d
  7365.  
  7366. # Webshots (www.webshots.com), by John Harrison
  7367. 0 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file
  7368.  
  7369. # Hercules DASD image files
  7370. # From Jan Jaeger <jj@septa.nl>
  7371. 0 string CKD_P370 Hercules CKD DASD image file
  7372. >8 long x \b, %d heads per cylinder
  7373. >12 long x \b, track size %d bytes
  7374. >16 byte x \b, device type 33%2.2X
  7375.  
  7376. 0 string CKD_C370 Hercules compressed CKD DASD image file
  7377. >8 long x \b, %d heads per cylinder
  7378. >12 long x \b, track size %d bytes
  7379. >16 byte x \b, device type 33%2.2X
  7380.  
  7381. 0 string CKD_S370 Hercules CKD DASD shadow file
  7382. >8 long x \b, %d heads per cylinder
  7383. >12 long x \b, track size %d bytes
  7384. >16 byte x \b, device type 33%2.2X
  7385.  
  7386. # Squeak images and - etoffi@softhome.net
  7387. 0 string \146\031\0\0 Squeak image data
  7388. 0 string 'From\040Squeak Squeak program text
  7389.  
  7390. # partimage: file(1) magic for PartImage files (experimental, incomplete)
  7391. # Author: Hans-Joachim Baader <hjb@pro-linux.de>
  7392. 0 string PaRtImAgE-VoLuMe PartImage
  7393. >0x0020 string 0.6.1 file version %s
  7394. >>0x0060 lelong >-1 volume %ld
  7395. #>>0x0064 8 byte identifier
  7396. #>>0x007c reserved
  7397. >>0x0200 string >\0 type %s
  7398. >>0x1400 string >\0 device %s,
  7399. >>0x1600 string >\0 original filename %s,
  7400. # Some fields omitted
  7401. >>0x2744 lelong 0 not compressed
  7402. >>0x2744 lelong 1 gzip compressed
  7403. >>0x2744 lelong 2 bzip2 compressed
  7404. >>0x2744 lelong >2 compressed with unknown algorithm
  7405. >0x0020 string >0.6.1 file version %s
  7406. >0x0020 string <0.6.1 file version %s
  7407.  
  7408. # DCX is multi-page PCX, using a simple header of up to 1024
  7409. # offsets for the respective PCX components.
  7410. # From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de>
  7411. 0 lelong 987654321 DCX multi-page PCX image data
  7412.  
  7413. # Simon Walton <simonw@matteworld.com>
  7414. # Kodak Cineon format for scanned negatives
  7415. # http://www.kodak.com/US/en/motion/support/dlad/
  7416. 0 lelong 0xd75f2a80 Cineon image data
  7417. >200 belong >0 \b, %ld x
  7418. >204 belong >0 %ld
  7419.  
  7420.  
  7421. # Bio-Rad .PIC is an image format used by microscope control systems
  7422. # and related image processing software used by biologists.
  7423. # From: Vebjorn Ljosa <vebjorn@ljosa.com>
  7424. 54 leshort 12345 Bio-Rad .PIC Image File
  7425. >0 leshort >0 %hd x
  7426. >2 leshort >0 %hd,
  7427. >4 leshort =1 1 image in file
  7428. >4 leshort >1 %hd images in file
  7429.  
  7430. # From Jan "Yenya" Kasprzak <kas@fi.muni.cz>
  7431. # The description of *.mrw format can be found at
  7432. # http://www.dalibor.cz/minolta/raw_file_format.htm
  7433. 0 string \000MRM Minolta Dimage camera raw image data
  7434.  
  7435. # From: stephane.loeuillet@tiscali.f
  7436. # http://www.djvuzone.org/
  7437. 0 string AT&TFORM DjVu Image file
  7438.  
  7439. # From: Jason Bacon <bacon@smithers.neuro.mcw.edu>
  7440. 0 beshort 0x3020 character Computer Graphics Metafile
  7441.  
  7442. # From Marc Espie
  7443. 0 lelong 20000630 OpenEXR image data
  7444.  
  7445. # From: Tom Hilinski <tom.hilinski@comcast.net>
  7446. # http://www.unidata.ucar.edu/packages/netcdf/
  7447. 0 string CDF\001 NetCDF Data Format data
  7448.  
  7449. #-----------------------------------------------------------------------
  7450. # Hierarchical Data Format, used to facilitate scientific data exchange
  7451. # specifications at http://hdf.ncsa.uiuc.edu/
  7452. 0 belong 0x0e031301 Hierarchical Data Format (version 4) data
  7453. 0 string \211HDF\r\n\032 Hierarchical Data Format (version 5) data
  7454.  
  7455. # From: Tobias Burnus <burnus@net-b.de>
  7456. # Xara (for a while: Corel Xara) is a graphic package, see
  7457. # http://www.xara.com/ for Windows and as GPL application for
  7458. 0 string XARA\243\243 Xara graphics file
  7459.  
  7460. #------------------------------------------------------------------------------
  7461. # intel: file(1) magic for x86 Unix
  7462. #
  7463. # Various flavors of x86 UNIX executable/object (other than Xenix, which
  7464. # is in "microsoft"). DOS is in "msdos"; the ambitious soul can do
  7465. # Windows as well.
  7466. #
  7467. # Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
  7468. # whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere
  7469. # as well, if, as, and when IBM makes it portable.
  7470. #
  7471. # The `versions' should be un-commented if they work for you.
  7472. # (Was the problem just one of endianness?)
  7473. #
  7474. 0 leshort 0502 basic-16 executable
  7475. >12 lelong >0 not stripped
  7476. #>22 leshort >0 - version %ld
  7477. 0 leshort 0503 basic-16 executable (TV)
  7478. >12 lelong >0 not stripped
  7479. #>22 leshort >0 - version %ld
  7480. 0 leshort 0510 x86 executable
  7481. >12 lelong >0 not stripped
  7482. 0 leshort 0511 x86 executable (TV)
  7483. >12 lelong >0 not stripped
  7484. 0 leshort =0512 iAPX 286 executable small model (COFF)
  7485. >12 lelong >0 not stripped
  7486. #>22 leshort >0 - version %ld
  7487. 0 leshort =0522 iAPX 286 executable large model (COFF)
  7488. >12 lelong >0 not stripped
  7489. #>22 leshort >0 - version %ld
  7490. # SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
  7491. 0 leshort =0514 80386 COFF executable
  7492. >12 lelong >0 not stripped
  7493. >22 leshort >0 - version %ld
  7494.  
  7495. # rom: file(1) magic for BIOS ROM Extensions found in intel machines
  7496. # mapped into memory between 0xC0000 and 0xFFFFF
  7497. # From Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
  7498. 0 beshort 0x55AA BIOS (ia32) ROM Ext.
  7499. >5 string USB USB
  7500. >7 string LDR UNDI image
  7501. >30 string IBM IBM comp. Video
  7502. >26 string Adaptec Adaptec
  7503. >28 string Adaptec Adaptec
  7504. >42 string PROMISE Promise
  7505. >2 byte x (%d*512)
  7506.  
  7507. #------------------------------------------------------------------------------
  7508. # interleaf: file(1) magic for InterLeaf TPS:
  7509. #
  7510. 0 string =\210OPS Interleaf saved data
  7511. 0 string =<!OPS Interleaf document text
  7512. >5 string ,\ Version\ = \b, version
  7513. >>17 string >\0 %.3s
  7514.  
  7515. #------------------------------------------------------------------------------
  7516. # island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
  7517. # "/etc/magic":
  7518. # From: guy@netapp.com (Guy Harris)
  7519. #
  7520. 4 string pgscriptver IslandWrite document
  7521. 13 string DrawFile IslandDraw document
  7522.  
  7523.  
  7524. #------------------------------------------------------------------------------
  7525. # ispell: file(1) magic for ispell
  7526. #
  7527. # Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic
  7528. # will match 0x9600 through 0x9603 in *both* little endian and big endian.
  7529. # (No other current magic entries collide.)
  7530. #
  7531. # Updated by Daniel Quinlan (quinlan@yggdrasil.com)
  7532. #
  7533. 0 leshort&0xFFFC 0x9600 little endian ispell
  7534. >0 byte 0 hash file (?),
  7535. >0 byte 1 3.0 hash file,
  7536. >0 byte 2 3.1 hash file,
  7537. >0 byte 3 hash file (?),
  7538. >2 leshort 0x00 8-bit, no capitalization, 26 flags
  7539. >2 leshort 0x01 7-bit, no capitalization, 26 flags
  7540. >2 leshort 0x02 8-bit, capitalization, 26 flags
  7541. >2 leshort 0x03 7-bit, capitalization, 26 flags
  7542. >2 leshort 0x04 8-bit, no capitalization, 52 flags
  7543. >2 leshort 0x05 7-bit, no capitalization, 52 flags
  7544. >2 leshort 0x06 8-bit, capitalization, 52 flags
  7545. >2 leshort 0x07 7-bit, capitalization, 52 flags
  7546. >2 leshort 0x08 8-bit, no capitalization, 128 flags
  7547. >2 leshort 0x09 7-bit, no capitalization, 128 flags
  7548. >2 leshort 0x0A 8-bit, capitalization, 128 flags
  7549. >2 leshort 0x0B 7-bit, capitalization, 128 flags
  7550. >2 leshort 0x0C 8-bit, no capitalization, 256 flags
  7551. >2 leshort 0x0D 7-bit, no capitalization, 256 flags
  7552. >2 leshort 0x0E 8-bit, capitalization, 256 flags
  7553. >2 leshort 0x0F 7-bit, capitalization, 256 flags
  7554. >4 leshort >0 and %d string characters
  7555. 0 beshort&0xFFFC 0x9600 big endian ispell
  7556. >1 byte 0 hash file (?),
  7557. >1 byte 1 3.0 hash file,
  7558. >1 byte 2 3.1 hash file,
  7559. >1 byte 3 hash file (?),
  7560. >2 beshort 0x00 8-bit, no capitalization, 26 flags
  7561. >2 beshort 0x01 7-bit, no capitalization, 26 flags
  7562. >2 beshort 0x02 8-bit, capitalization, 26 flags
  7563. >2 beshort 0x03 7-bit, capitalization, 26 flags
  7564. >2 beshort 0x04 8-bit, no capitalization, 52 flags
  7565. >2 beshort 0x05 7-bit, no capitalization, 52 flags
  7566. >2 beshort 0x06 8-bit, capitalization, 52 flags
  7567. >2 beshort 0x07 7-bit, capitalization, 52 flags
  7568. >2 beshort 0x08 8-bit, no capitalization, 128 flags
  7569. >2 beshort 0x09 7-bit, no capitalization, 128 flags
  7570. >2 beshort 0x0A 8-bit, capitalization, 128 flags
  7571. >2 beshort 0x0B 7-bit, capitalization, 128 flags
  7572. >2 beshort 0x0C 8-bit, no capitalization, 256 flags
  7573. >2 beshort 0x0D 7-bit, no capitalization, 256 flags
  7574. >2 beshort 0x0E 8-bit, capitalization, 256 flags
  7575. >2 beshort 0x0F 7-bit, capitalization, 256 flags
  7576. >4 beshort >0 and %d string characters
  7577. # ispell 4.0 hash files kromJx <kromJx@crosswinds.net>
  7578. # Ispell 4.0
  7579. 0 string ISPL ispell
  7580. >4 long x hash file version %d,
  7581. >8 long x lexletters %d,
  7582. >12 long x lexsize %d,
  7583. >16 long x hashsize %d,
  7584. >20 long x stblsize %d
  7585. #------------------------------------------------------------
  7586. # Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
  7587. # same magic number, 0xcafebabe, so they are both handled
  7588. # in the entry called "cafebabe".
  7589. #------------------------------------------------------------
  7590. # Java serialization
  7591. # From Martin Pool (m.pool@pharos.com.au)
  7592. 0 beshort 0xaced Java serialization data
  7593. >2 beshort >0x0004 \b, version %d
  7594.  
  7595. 0 belong 0xfeedfeed Java KeyStore
  7596.  
  7597. 0 belong 0xcececece Java JCE KeyStore
  7598.  
  7599. # Dalvik .dex format. http://retrodev.com/android/dexformat.html
  7600. # From <mkf@google.com> "Mike Fleming"
  7601. 0 string dex\n
  7602. >0 regex dex\n[0-9][0-9][0-9]\0 Dalvik dex file
  7603. >4 string >000 version %s
  7604. 0 string dey\n
  7605. >0 regex dey\n[0-9][0-9][0-9]\0 Dalvik dex file (optimized for host)
  7606. >4 string >000 version %s
  7607.  
  7608.  
  7609. #------------------------------------------------------------------------------
  7610. # JPEG images
  7611. # SunOS 5.5.1 had
  7612. #
  7613. # 0 string \377\330\377\340 JPEG file
  7614. # 0 string \377\330\377\356 JPG file
  7615. #
  7616. # both of which turn into "JPEG image data" here.
  7617. #
  7618. 0 beshort 0xffd8 JPEG image data
  7619. >6 string JFIF \b, JFIF standard
  7620. # The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
  7621. # in a vain attempt to add image size reporting for JFIF. Note that these
  7622. # tests are not fool-proof since some perfectly valid JPEGs are currently
  7623. # impossible to specify in magic(4) format.
  7624. # First, a little JFIF version info:
  7625. >>11 byte x \b %d.
  7626. >>12 byte x \b%02d
  7627. # Next, the resolution or aspect ratio of the image:
  7628. #>>13 byte 0 \b, aspect ratio
  7629. #>>13 byte 1 \b, resolution (DPI)
  7630. #>>13 byte 2 \b, resolution (DPCM)
  7631. #>>4 beshort x \b, segment length %d
  7632. # Next, show thumbnail info, if it exists:
  7633. >>18 byte !0 \b, thumbnail %dx
  7634. >>>19 byte x \b%d
  7635.  
  7636. # EXIF moved down here to avoid reporting a bogus version number,
  7637. # and EXIF version number printing added.
  7638. # - Patrik R=E5dman <patrik+file-magic@iki.fi>
  7639. >6 string Exif \b, EXIF standard
  7640. # Look for EXIF IFD offset in IFD 0, and then look for EXIF version tag in EXIF IFD.
  7641. # All possible combinations of entries have to be enumerated, since no looping
  7642. # is possible. And both endians are possible...
  7643. # The combinations included below are from real-world JPEGs.
  7644. # Little-endian
  7645. >>12 string II
  7646. # IFD 0 Entry #5:
  7647. >>>70 leshort 0x8769
  7648. # EXIF IFD Entry #1:
  7649. >>>>(78.l+14) leshort 0x9000
  7650. >>>>>(78.l+23) byte x %c
  7651. >>>>>(78.l+24) byte x \b.%c
  7652. >>>>>(78.l+25) byte !0x30 \b%c
  7653. # IFD 0 Entry #9:
  7654. >>>118 leshort 0x8769
  7655. # EXIF IFD Entry #3:
  7656. >>>>(126.l+38) leshort 0x9000
  7657. >>>>>(126.l+47) byte x %c
  7658. >>>>>(126.l+48) byte x \b.%c
  7659. >>>>>(126.l+49) byte !0x30 \b%c
  7660. # IFD 0 Entry #10
  7661. >>>130 leshort 0x8769
  7662. # EXIF IFD Entry #3:
  7663. >>>>(138.l+38) leshort 0x9000
  7664. >>>>>(138.l+47) byte x %c
  7665. >>>>>(138.l+48) byte x \b.%c
  7666. >>>>>(138.l+49) byte !0x30 \b%c
  7667. # EXIF IFD Entry #4:
  7668. >>>>(138.l+50) leshort 0x9000
  7669. >>>>>(138.l+59) byte x %c
  7670. >>>>>(138.l+60) byte x \b.%c
  7671. >>>>>(138.l+61) byte !0x30 \b%c
  7672. # EXIF IFD Entry #5:
  7673. >>>>(138.l+62) leshort 0x9000
  7674. >>>>>(138.l+71) byte x %c
  7675. >>>>>(138.l+72) byte x \b.%c
  7676. >>>>>(138.l+73) byte !0x30 \b%c
  7677. # IFD 0 Entry #11
  7678. >>>142 leshort 0x8769
  7679. # EXIF IFD Entry #3:
  7680. >>>>(150.l+38) leshort 0x9000
  7681. >>>>>(150.l+47) byte x %c
  7682. >>>>>(150.l+48) byte x \b.%c
  7683. >>>>>(150.l+49) byte !0x30 \b%c
  7684. # EXIF IFD Entry #4:
  7685. >>>>(150.l+50) leshort 0x9000
  7686. >>>>>(150.l+59) byte x %c
  7687. >>>>>(150.l+60) byte x \b.%c
  7688. >>>>>(150.l+61) byte !0x30 \b%c
  7689. # EXIF IFD Entry #5:
  7690. >>>>(150.l+62) leshort 0x9000
  7691. >>>>>(150.l+71) byte x %c
  7692. >>>>>(150.l+72) byte x \b.%c
  7693. >>>>>(150.l+73) byte !0x30 \b%c
  7694. # Big-endian
  7695. >>12 string MM
  7696. # IFD 0 Entry #9:
  7697. >>>118 beshort 0x8769
  7698. # EXIF IFD Entry #1:
  7699. >>>>(126.L+14) beshort 0x9000
  7700. >>>>>(126.L+23) byte x %c
  7701. >>>>>(126.L+24) byte x \b.%c
  7702. >>>>>(126.L+25) byte !0x30 \b%c
  7703. # EXIF IFD Entry #3:
  7704. >>>>(126.L+38) beshort 0x9000
  7705. >>>>>(126.L+47) byte x %c
  7706. >>>>>(126.L+48) byte x \b.%c
  7707. >>>>>(126.L+49) byte !0x30 \b%c
  7708. # IFD 0 Entry #10
  7709. >>>130 beshort 0x8769
  7710. # EXIF IFD Entry #3:
  7711. >>>>(138.L+38) beshort 0x9000
  7712. >>>>>(138.L+47) byte x %c
  7713. >>>>>(138.L+48) byte x \b.%c
  7714. >>>>>(138.L+49) byte !0x30 \b%c
  7715. # EXIF IFD Entry #5:
  7716. >>>>(138.L+62) beshort 0x9000
  7717. >>>>>(138.L+71) byte x %c
  7718. >>>>>(138.L+72) byte x \b.%c
  7719. >>>>>(138.L+73) byte !0x30 \b%c
  7720. # IFD 0 Entry #11
  7721. >>>142 beshort 0x8769
  7722. # EXIF IFD Entry #4:
  7723. >>>>(150.L+50) beshort 0x9000
  7724. >>>>>(150.L+59) byte x %c
  7725. >>>>>(150.L+60) byte x \b.%c
  7726. >>>>>(150.L+61) byte !0x30 \b%c
  7727. # Here things get sticky. We can do ONE MORE marker segment with
  7728. # indirect addressing, and that's all. It would be great if we could
  7729. # do pointer arithemetic like in an assembler language. Christos?
  7730. # And if there was some sort of looping construct to do searches, plus a few
  7731. # named accumulators, it would be even more effective...
  7732. # At least we can show a comment if no other segments got inserted before:
  7733. >(4.S+5) byte 0xFE
  7734. >>(4.S+8) string >\0 \b, comment: "%s"
  7735. #>(4.S+5) byte 0xFE \b, comment
  7736. #>>(4.S+6) beshort x \b length=%d
  7737. #>>(4.S+8) string >\0 \b, "%s"
  7738. # Or, we can show the encoding type (I've included only the three most common)
  7739. # and image dimensions if we are lucky and the SOFn (image segment) is here:
  7740. >(4.S+5) byte 0xC0 \b, baseline
  7741. >>(4.S+6) byte x \b, precision %d
  7742. >>(4.S+7) beshort x \b, %dx
  7743. >>(4.S+9) beshort x \b%d
  7744. >(4.S+5) byte 0xC1 \b, extended sequential
  7745. >>(4.S+6) byte x \b, precision %d
  7746. >>(4.S+7) beshort x \b, %dx
  7747. >>(4.S+9) beshort x \b%d
  7748. >(4.S+5) byte 0xC2 \b, progressive
  7749. >>(4.S+6) byte x \b, precision %d
  7750. >>(4.S+7) beshort x \b, %dx
  7751. >>(4.S+9) beshort x \b%d
  7752. # I've commented-out quantisation table reporting. I doubt anyone cares yet.
  7753. #>(4.S+5) byte 0xDB \b, quantisation table
  7754. #>>(4.S+6) beshort x \b length=%d
  7755. #>14 beshort x \b, %d x
  7756. #>16 beshort x \b %d
  7757.  
  7758. # HSI is Handmade Software's proprietary JPEG encoding scheme
  7759. 0 string hsi1 JPEG image data, HSI proprietary
  7760.  
  7761. # From: David Santinoli <david@santinoli.com>
  7762. 0 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 image data
  7763.  
  7764. #------------------------------------------------------------------------------
  7765. # karma: file(1) magic for Karma data files
  7766. #
  7767. # From <rgooch@atnf.csiro.au>
  7768.  
  7769. 0 string KarmaRHD Version Karma Data Structure Version
  7770. >16 belong x %lu
  7771. #------------------------------------------------------------------------------
  7772. # DEC SRC Virtual Paper: Lectern files
  7773. # Karl M. Hegbloom <karlheg@inetarena.com>
  7774. 0 string lect DEC SRC Virtual Paper Lectern file
  7775.  
  7776. #------------------------------------------------------------------------------
  7777. # lex: file(1) magic for lex
  7778. #
  7779. # derived empirically, your offsets may vary!
  7780. 53 string yyprevious C program text (from lex)
  7781. >3 string >\0 for %s
  7782. # C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
  7783. 21 string generated\ by\ flex C program text (from flex)
  7784. # lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
  7785. 0 string %{ lex description text
  7786.  
  7787. #------------------------------------------------------------------------------
  7788. # lif: file(1) magic for lif
  7789. #
  7790. # (Daniel Quinlan <quinlan@yggdrasil.com>)
  7791. #
  7792. 0 beshort 0x8000 lif file
  7793.  
  7794. #------------------------------------------------------------------------------
  7795. # linux: file(1) magic for Linux files
  7796. #
  7797. # Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
  7798. # The following basic Linux magic is useful for reference, but using
  7799. # "long" magic is a better practice in order to avoid collisions.
  7800. #
  7801. # 2 leshort 100 Linux/i386
  7802. # >0 leshort 0407 impure executable (OMAGIC)
  7803. # >0 leshort 0410 pure executable (NMAGIC)
  7804. # >0 leshort 0413 demand-paged executable (ZMAGIC)
  7805. # >0 leshort 0314 demand-paged executable (QMAGIC)
  7806. #
  7807. 0 lelong 0x00640107 Linux/i386 impure executable (OMAGIC)
  7808. >16 lelong 0 \b, stripped
  7809. 0 lelong 0x00640108 Linux/i386 pure executable (NMAGIC)
  7810. >16 lelong 0 \b, stripped
  7811. 0 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC)
  7812. >16 lelong 0 \b, stripped
  7813. 0 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC)
  7814. >16 lelong 0 \b, stripped
  7815. #
  7816. 0 string \007\001\000 Linux/i386 object file
  7817. >20 lelong >0x1020 \b, DLL library
  7818. # Linux-8086 stuff:
  7819. 0 string \01\03\020\04 Linux-8086 impure executable
  7820. >28 long !0 not stripped
  7821. 0 string \01\03\040\04 Linux-8086 executable
  7822. >28 long !0 not stripped
  7823. #
  7824. 0 string \243\206\001\0 Linux-8086 object file
  7825. #
  7826. 0 string \01\03\020\20 Minix-386 impure executable
  7827. >28 long !0 not stripped
  7828. 0 string \01\03\040\20 Minix-386 executable
  7829. >28 long !0 not stripped
  7830. # core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
  7831. 216 lelong 0421 Linux/i386 core file
  7832. >220 string >\0 of '%s'
  7833. >200 lelong >0 (signal %d)
  7834. #
  7835. # LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
  7836. # this can be overridden by the DOS executable (COM) entry
  7837. 2 string LILO Linux/i386 LILO boot/chain loader
  7838. #
  7839. # PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
  7840. 0 leshort 0x0436 Linux/i386 PC Screen Font data,
  7841. >2 byte 0 256 characters, no directory,
  7842. >2 byte 1 512 characters, no directory,
  7843. >2 byte 2 256 characters, Unicode directory,
  7844. >2 byte 3 512 characters, Unicode directory,
  7845. >3 byte >0 8x%d
  7846. # Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
  7847. 4086 string SWAP-SPACE Linux/i386 swap file
  7848. # From: Jeff Bailey <jbailey@ubuntu.com>
  7849. # Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com>
  7850. 4076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image
  7851. # according to man page of mkswap (8) March 1999
  7852. 4086 string SWAPSPACE2 Linux/i386 swap file (new style)
  7853. >0x400 long x %d (4K pages)
  7854. >0x404 long x size %d pages
  7855. >>4086 string SWAPSPACE2
  7856. >>>1052 string >\0 Label %s
  7857. # ECOFF magic for OSF/1 and Linux (only tested under Linux though)
  7858. #
  7859. # from Erik Troan (ewt@redhat.com) examining od dumps, so this
  7860. # could be wrong
  7861. # updated by David Mosberger (davidm@azstarnet.com) based on
  7862. # GNU BFD and MIPS info found below.
  7863. #
  7864. 0 leshort 0x0183 ECOFF alpha
  7865. >24 leshort 0407 executable
  7866. >24 leshort 0410 pure
  7867. >24 leshort 0413 demand paged
  7868. >8 long >0 not stripped
  7869. >8 long 0 stripped
  7870. >23 leshort >0 - version %ld.
  7871. #
  7872. # Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
  7873. # and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
  7874. # and NicolⳠLichtmaier <nick@debian.org>
  7875. # All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
  7876. # Linux kernel boot images (i386 arch) (Wolfram Kleff)
  7877. 514 string HdrS Linux kernel
  7878. >510 leshort 0xAA55 x86 boot executable
  7879. >>518 leshort >=0x200
  7880. >>529 byte 0 zImage,
  7881. >>>529 byte 1 bzImage,
  7882. >>>(526.s+0x200) string >\0 version %s,
  7883. >>498 leshort 1 RO-rootFS,
  7884. >>498 leshort 0 RW-rootFS,
  7885. >>508 leshort >0 root_dev 0x%X,
  7886. >>502 leshort >0 swap_dev 0x%X,
  7887. >>504 leshort >0 RAMdisksize %u KB,
  7888. >>506 leshort 0xFFFF Normal VGA
  7889. >>506 leshort 0xFFFE Extended VGA
  7890. >>506 leshort 0xFFFD Prompt for Videomode
  7891. >>506 leshort >0 Video mode %d
  7892. # This also matches new kernels, which were caught above by "HdrS".
  7893. 0 belong 0xb8c0078e Linux kernel
  7894. >0x1e3 string Loading version 1.3.79 or older
  7895. >0x1e9 string Loading from prehistoric times
  7896.  
  7897. # System.map files - NicolⳠLichtmaier <nick@debian.org>
  7898. 8 string \ A\ _text Linux kernel symbol map text
  7899.  
  7900. # LSM entries - NicolⳠLichtmaier <nick@debian.org>
  7901. 0 string Begin3 Linux Software Map entry text
  7902. 0 string Begin4 Linux Software Map entry text (new format)
  7903.  
  7904. # From Matt Zimmerman
  7905. 0 belong 0x4f4f4f4d User-mode Linux COW file
  7906. >4 belong x \b, version %d
  7907. >8 string >\0 \b, backing file %s
  7908.  
  7909. ############################################################################
  7910. # Linux kernel versions
  7911.  
  7912. 0 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux
  7913. >497 leshort 0 x86 boot sector
  7914. >>514 belong 0x8e of a kernel from the dawn of time!
  7915. >>514 belong 0x908ed8b4 version 0.99-1.1.42
  7916. >>514 belong 0x908ed8b8 for memtest86
  7917.  
  7918. >497 leshort !0 x86 kernel
  7919. >>504 leshort >0 RAMdisksize=%u KB
  7920. >>502 leshort >0 swap=0x%X
  7921. >>508 leshort >0 root=0x%X
  7922. >>>498 leshort 1 \b-ro
  7923. >>>498 leshort 0 \b-rw
  7924. >>506 leshort 0xFFFF vga=normal
  7925. >>506 leshort 0xFFFE vga=extended
  7926. >>506 leshort 0xFFFD vga=ask
  7927. >>506 leshort >0 vga=%d
  7928. >>514 belong 0x908ed881 version 1.1.43-1.1.45
  7929. >>514 belong 0x15b281cd
  7930. >>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0
  7931. >>>0xa99 belong 0x55AA5a5a version 1.3.1,2
  7932. >>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30
  7933. >>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41
  7934. >>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45
  7935. >>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72
  7936. >>514 string HdrS
  7937. >>>518 leshort >0x1FF
  7938. >>>>529 byte 0 \b, zImage
  7939. >>>>529 byte 1 \b, bzImage
  7940. >>>>(526.s+0x200) string >\0 \b, version %s
  7941.  
  7942. # Linux boot sector thefts.
  7943. 0 belong 0xb8c0078e Linux
  7944. >0x1e6 belong 0x454c4b53 ELKS Kernel
  7945. >0x1e6 belong !0x454c4b53 style boot sector
  7946.  
  7947. ############################################################################
  7948. # Linux 8086 executable
  7949. 0 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless
  7950. >5 string .
  7951. >>4 string >\0 \b, libc version %s
  7952.  
  7953. 0 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable
  7954. >2 byte&0x01 !0 \b, unmapped zero page
  7955. >2 byte&0x20 0 \b, impure
  7956. >2 byte&0x20 !0
  7957. >>2 byte&0x10 !0 \b, A_EXEC
  7958. >2 byte&0x02 !0 \b, A_PAL
  7959. >2 byte&0x04 !0 \b, A_NSYM
  7960. >2 byte&0x08 !0 \b, A_STAND
  7961. >2 byte&0x40 !0 \b, A_PURE
  7962. >2 byte&0x80 !0 \b, A_TOVLY
  7963. >28 long !0 \b, not stripped
  7964. >37 string .
  7965. >>36 string >\0 \b, libc version %s
  7966.  
  7967. # 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable
  7968. # 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable
  7969. # 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable
  7970. # 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable
  7971.  
  7972. # SYSLINUX boot logo files (from 'ppmtolss16' sources)
  7973. # http://syslinux.zytor.com/
  7974. #
  7975. 0 lelong =0x1413f33d SYSLINUX' LSS16 image data
  7976. >4 leshort x \b, width %d
  7977. >6 leshort x \b, height %d
  7978.  
  7979. 0 string OOOM User-Mode-Linux's Copy-On-Write disk image
  7980. >4 belong x version %d
  7981.  
  7982. # SE Linux policy database
  7983. # From: Mike Frysinger <vapier@gentoo.org>
  7984. 0 lelong 0xf97cff8c SE Linux policy
  7985. >16 lelong x v%d
  7986. >20 lelong 1 MLS
  7987. >24 lelong x %d symbols
  7988. >28 lelong x %d ocons
  7989.  
  7990. # Linux Logical Volume Manager (LVM)
  7991. # Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net>
  7992. #
  7993. # System ID, UUID and volume group name are 128 bytes long
  7994. # but they should never be full and initialized with zeros...
  7995. #
  7996. # LVM1
  7997. #
  7998. 0x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1
  7999. >0x12c string >\0 , System ID: %s
  8000.  
  8001. 0x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2
  8002. >0x12c string >\0 , System ID: %s
  8003.  
  8004. # LVM2
  8005. #
  8006. # It seems that the label header can be in one the four first sector
  8007. # of the disk... (from _find_labeller in lib/label/label.c of LVM2)
  8008. #
  8009. # 0x200 seems to be the common case
  8010.  
  8011. 0x218 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
  8012. # read the offset to add to the start of the header, and the header
  8013. # start in 0x200
  8014. >(0x214.l+0x200) string >\0 , UUID: %s
  8015.  
  8016. 0x018 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
  8017. >(0x014.l) string >\0 , UUID: %s
  8018.  
  8019. 0x418 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
  8020. >(0x414.l+0x400) string >\0 , UUID: %s
  8021.  
  8022. 0x618 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
  8023. >(0x614.l+0x600) string >\0 , UUID: %s
  8024.  
  8025. # SE Linux policy database
  8026. 0 lelong 0xf97cff8c SE Linux policy
  8027. >16 lelong x v%d
  8028. >20 lelong 1 MLS
  8029. >24 lelong x %d symbols
  8030. >28 lelong x %d ocons
  8031.  
  8032. # LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec
  8033. # Anthon van der Neut (anthon@mnt.org)
  8034. 0 string LUKS\xba\xbe LUKS encrypted file,
  8035. >6 beshort x ver %d
  8036. >8 string x [%s,
  8037. >40 string x %s,
  8038. >72 string x %s]
  8039. >168 string x UUID: %s
  8040.  
  8041.  
  8042. #------------------------------------------------------------------------------
  8043. # lisp: file(1) magic for lisp programs
  8044. #
  8045. # various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
  8046.  
  8047. # updated by Joerg Jenderek
  8048. 0 string ;;
  8049. # windows INF files often begin with semicolon and use CRLF as line end
  8050. # lisp files are mainly created on unix system with LF as line end
  8051. >2 search/2048 !\r Lisp/Scheme program text
  8052. >2 search/2048 \r Windows INF file
  8053.  
  8054. 0 search/256 (if\ Lisp/Scheme program text
  8055. 0 search/256 (setq\ Lisp/Scheme program text
  8056. 0 search/256 (defvar\ Lisp/Scheme program text
  8057. 0 search/256 (defparam\ Lisp/Scheme program text
  8058. 0 search/256 (defun\ Lisp/Scheme program text
  8059. 0 search/256 (autoload\ Lisp/Scheme program text
  8060. 0 search/256 (custom-set-variables\ Lisp/Scheme program text
  8061.  
  8062. # Emacs 18 - this is always correct, but not very magical.
  8063. 0 string \012( Emacs v18 byte-compiled Lisp data
  8064. # Emacs 19+ - ver. recognition added by Ian Springer
  8065. # Also applies to XEmacs 19+ .elc files; could tell them apart if we had regexp
  8066. # support or similar - Chris Chittleborough <cchittleborough@yahoo.com.au>
  8067. 0 string ;ELC
  8068. >4 byte >19
  8069. >4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data
  8070.  
  8071. # Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
  8072. 0 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program text
  8073. 0 long 0x70768BD2 CLISP memory image data
  8074. 0 long 0xD28B7670 CLISP memory image data, other endian
  8075.  
  8076. # Files produced by GNU gettext
  8077. 0 long 0xDE120495 GNU-format message catalog data
  8078. 0 long 0x950412DE GNU-format message catalog data
  8079.  
  8080. #.com and .bin for MIT scheme
  8081. 0 string \372\372\372\372 MIT scheme (library?)
  8082.  
  8083. # From: David Allouche <david@allouche.net>
  8084. 0 string \<TeXmacs| TeXmacs document text
  8085. #------------------------------------------------------------
  8086. # Mach has two magic numbers, 0xcafebabe and 0xfeedface.
  8087. # Unfortunately the first, cafebabe, is shared with
  8088. # Java ByteCode, so they are both handled in the file "cafebabe".
  8089. # The "feedface" ones are handled herein.
  8090. #------------------------------------------------------------
  8091. 0 lelong&0xfeffffff 0xfeedface Mach-O
  8092. >0 byte 0xcf 64-bit
  8093. >12 lelong 1 object
  8094. >12 lelong 2 executable
  8095. >12 lelong 3 fixed virtual memory shared library
  8096. >12 lelong 4 core
  8097. >12 lelong 5 preload executable
  8098. >12 lelong 6 dynamically linked shared library
  8099. >12 lelong 7 dynamic linker
  8100. >12 lelong 8 bundle
  8101. >12 lelong 9 dynamically linked shared library stub
  8102. >12 lelong >9
  8103. >>12 lelong x filetype=%ld
  8104. >4 lelong <0
  8105. >>4 lelong x architecture=%ld
  8106. >4 lelong 1 vax
  8107. >4 lelong 2 romp
  8108. >4 lelong 3 architecture=3
  8109. >4 lelong 4 ns32032
  8110. >4 lelong 5 ns32332
  8111. >4 lelong 6 m68k
  8112. >4 lelong 7 i386
  8113. >4 lelong 8 mips
  8114. >4 lelong 9 ns32532
  8115. >4 lelong 10 architecture=10
  8116. >4 lelong 11 hppa
  8117. >4 lelong 12 acorn
  8118. >4 lelong 13 m88k
  8119. >4 lelong 14 sparc
  8120. >4 lelong 15 i860-big
  8121. >4 lelong 16 i860
  8122. >4 lelong 17 rs6000
  8123. >4 lelong 18 ppc
  8124. >4 lelong 16777234 ppc64
  8125. >4 lelong >16777234
  8126. >>4 lelong x architecture=%ld
  8127. #
  8128. 0 belong&0xfffffffe 0xfeedface Mach-O
  8129. >3 byte 0xcf 64-bit
  8130. >12 belong 1 object
  8131. >12 belong 2 executable
  8132. >12 belong 3 fixed virtual memory shared library
  8133. >12 belong 4 core
  8134. >12 belong 5 preload executable
  8135. >12 belong 6 dynamically linked shared library
  8136. >12 belong 7 dynamic linker
  8137. >12 belong 8 bundle
  8138. >12 belong 9 dynamically linked shared library stub
  8139. >12 belong >9
  8140. >>12 belong x filetype=%ld
  8141. >4 belong <0
  8142. >>4 belong x architecture=%ld
  8143. >4 belong 1 vax
  8144. >4 belong 2 romp
  8145. >4 belong 3 architecture=3
  8146. >4 belong 4 ns32032
  8147. >4 belong 5 ns32332
  8148. >4 belong 6 for m68k architecture
  8149. # from NeXTstep 3.0 <mach/machine.h>
  8150. # i.e. mc680x0_all, ignore
  8151. # >>8 belong 1 (mc68030)
  8152. >>8 belong 2 (mc68040)
  8153. >>8 belong 3 (mc68030 only)
  8154. >4 belong 7 i386
  8155. >4 belong 8 mips
  8156. >4 belong 9 ns32532
  8157. >4 belong 10 architecture=10
  8158. >4 belong 11 hppa
  8159. >4 belong 12 acorn
  8160. >4 belong 13 m88k
  8161. >4 belong 14 sparc
  8162. >4 belong 15 i860-big
  8163. >4 belong 16 i860
  8164. >4 belong 17 rs6000
  8165. >4 belong 18 ppc
  8166. >4 belong 16777234 ppc64
  8167. >4 belong >16777234
  8168. >>4 belong x architecture=%ld
  8169.  
  8170. #------------------------------------------------------------------------------
  8171. # macintosh description
  8172. #
  8173. # BinHex is the Macintosh ASCII-encoded file format (see also "apple")
  8174. # Daniel Quinlan, quinlan@yggdrasil.com
  8175. 11 string must\ be\ converted\ with\ BinHex BinHex binary text
  8176. >41 string x \b, version %.3s
  8177.  
  8178. # Stuffit archives are the de facto standard of compression for Macintosh
  8179. # files obtained from most archives. (franklsm@tuns.ca)
  8180. 0 string SIT! StuffIt Archive (data)
  8181. >2 string x : %s
  8182. 0 string SITD StuffIt Deluxe (data)
  8183. >2 string x : %s
  8184. 0 string Seg StuffIt Deluxe Segment (data)
  8185. >2 string x : %s
  8186.  
  8187. # Newer StuffIt archives (grant@netbsd.org)
  8188. 0 string StuffIt StuffIt Archive
  8189. #>162 string >0 : %s
  8190.  
  8191. # Macintosh Applications and Installation binaries (franklsm@tuns.ca)
  8192. 0 string APPL Macintosh Application (data)
  8193. >2 string x \b: %s
  8194.  
  8195. # Macintosh System files (franklsm@tuns.ca)
  8196. 0 string zsys Macintosh System File (data)
  8197. 0 string FNDR Macintosh Finder (data)
  8198. 0 string libr Macintosh Library (data)
  8199. >2 string x : %s
  8200. 0 string shlb Macintosh Shared Library (data)
  8201. >2 string x : %s
  8202. 0 string cdev Macintosh Control Panel (data)
  8203. >2 string x : %s
  8204. 0 string INIT Macintosh Extension (data)
  8205. >2 string x : %s
  8206. 0 string FFIL Macintosh Truetype Font (data)
  8207. >2 string x : %s
  8208. 0 string LWFN Macintosh Postscript Font (data)
  8209. >2 string x : %s
  8210.  
  8211. # Additional Macintosh Files (franklsm@tuns.ca)
  8212. 0 string PACT Macintosh Compact Pro Archive (data)
  8213. >2 string x : %s
  8214. 0 string ttro Macintosh TeachText File (data)
  8215. >2 string x : %s
  8216. 0 string TEXT Macintosh TeachText File (data)
  8217. >2 string x : %s
  8218. 0 string PDF Macintosh PDF File (data)
  8219. >2 string x : %s
  8220.  
  8221. # MacBinary format (Eric Fischer, enf@pobox.com)
  8222. #
  8223. # Unfortunately MacBinary doesn't really have a magic number prior
  8224. # to the MacBinary III format. The checksum is really the way to
  8225. # do it, but the magic file format isn't up to the challenge.
  8226. #
  8227. # 0 byte 0
  8228. # 1 byte # filename length
  8229. # 2 string # filename
  8230. # 65 string # file type
  8231. # 69 string # file creator
  8232. # 73 byte # Finder flags
  8233. # 74 byte 0
  8234. # 75 beshort # vertical posn in window
  8235. # 77 beshort # horiz posn in window
  8236. # 79 beshort # window or folder ID
  8237. # 81 byte # protected?
  8238. # 82 byte 0
  8239. # 83 belong # length of data segment
  8240. # 87 belong # length of resource segment
  8241. # 91 belong # file creation date
  8242. # 95 belong # file modification date
  8243. # 99 beshort # length of comment after resource
  8244. # 101 byte # new Finder flags
  8245. # 102 string mBIN # (only in MacBinary III)
  8246. # 106 byte # char. code of file name
  8247. # 107 byte # still more Finder flags
  8248. # 116 belong # total file length
  8249. # 120 beshort # length of add'l header
  8250. # 122 byte 129 # for MacBinary II
  8251. # 122 byte 130 # for MacBinary III
  8252. # 123 byte 129 # minimum version that can read fmt
  8253. # 124 beshort # checksum
  8254. #
  8255. # This attempts to use the version numbers as a magic number, requiring
  8256. # that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second
  8257. # be 0x81. This works for the files I have, but maybe not for everyone's.
  8258.  
  8259. # Unfortunately, this magic is quite weak - MPi
  8260. #122 beshort&0xFCFF 0x8081 Macintosh MacBinary data
  8261.  
  8262. # MacBinary I doesn't have the version number field at all, but MacBinary II
  8263. # has been in use since 1987 so I hope there aren't many really old files
  8264. # floating around that this will miss. The original spec calls for using
  8265. # the nulls in 0, 74, and 82 as the magic number.
  8266. #
  8267. # Another possibility, that would also work for MacBinary I, is to use
  8268. # the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
  8269. # have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
  8270. # and that 74 will be 0. So something like
  8271. #
  8272. # 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data
  8273. #
  8274. # >73 byte&0x01 0x01 \b, inited
  8275. # >73 byte&0x02 0x02 \b, changed
  8276. # >73 byte&0x04 0x04 \b, busy
  8277. # >73 byte&0x08 0x08 \b, bozo
  8278. # >73 byte&0x10 0x10 \b, system
  8279. # >73 byte&0x10 0x20 \b, bundle
  8280. # >73 byte&0x10 0x40 \b, invisible
  8281. # >73 byte&0x10 0x80 \b, locked
  8282.  
  8283. #>65 string x \b, type "%4.4s"
  8284.  
  8285. #>65 string 8BIM (PhotoShop)
  8286. #>65 string ALB3 (PageMaker 3)
  8287. #>65 string ALB4 (PageMaker 4)
  8288. #>65 string ALT3 (PageMaker 3)
  8289. #>65 string APPL (application)
  8290. #>65 string AWWP (AppleWorks word processor)
  8291. #>65 string CIRC (simulated circuit)
  8292. #>65 string DRWG (MacDraw)
  8293. #>65 string EPSF (Encapsulated PostScript)
  8294. #>65 string FFIL (font suitcase)
  8295. #>65 string FKEY (function key)
  8296. #>65 string FNDR (Macintosh Finder)
  8297. #>65 string GIFf (GIF image)
  8298. #>65 string Gzip (GNU gzip)
  8299. #>65 string INIT (system extension)
  8300. #>65 string LIB\ (library)
  8301. #>65 string LWFN (PostScript font)
  8302. #>65 string MSBC (Microsoft BASIC)
  8303. #>65 string PACT (Compact Pro archive)
  8304. #>65 string PDF\ (Portable Document Format)
  8305. #>65 string PICT (picture)
  8306. #>65 string PNTG (MacPaint picture)
  8307. #>65 string PREF (preferences)
  8308. #>65 string PROJ (Think C project)
  8309. #>65 string QPRJ (Think Pascal project)
  8310. #>65 string SCFL (Defender scores)
  8311. #>65 string SCRN (startup screen)
  8312. #>65 string SITD (StuffIt Deluxe)
  8313. #>65 string SPn3 (SuperPaint)
  8314. #>65 string STAK (HyperCard stack)
  8315. #>65 string Seg\ (StuffIt segment)
  8316. #>65 string TARF (Unix tar archive)
  8317. #>65 string TEXT (ASCII)
  8318. #>65 string TIFF (TIFF image)
  8319. #>65 string TOVF (Eudora table of contents)
  8320. #>65 string WDBN (Microsoft Word word processor)
  8321. #>65 string WORD (MacWrite word processor)
  8322. #>65 string XLS\ (Microsoft Excel)
  8323. #>65 string ZIVM (compress (.Z))
  8324. #>65 string ZSYS (Pre-System 7 system file)
  8325. #>65 string acf3 (Aldus FreeHand)
  8326. #>65 string cdev (control panel)
  8327. #>65 string dfil (Desk Acessory suitcase)
  8328. #>65 string libr (library)
  8329. #>65 string nX^d (WriteNow word processor)
  8330. #>65 string nX^w (WriteNow dictionary)
  8331. #>65 string rsrc (resource)
  8332. #>65 string scbk (Scrapbook)
  8333. #>65 string shlb (shared library)
  8334. #>65 string ttro (SimpleText read-only)
  8335. #>65 string zsys (system file)
  8336.  
  8337. #>69 string x \b, creator "%4.4s"
  8338.  
  8339. # Somewhere, Apple has a repository of registered Creator IDs. These are
  8340. # just the ones that I happened to have files from and was able to identify.
  8341.  
  8342. #>69 string 8BIM (Adobe Photoshop)
  8343. #>69 string ALD3 (PageMaker 3)
  8344. #>69 string ALD4 (PageMaker 4)
  8345. #>69 string ALFA (Alpha editor)
  8346. #>69 string APLS (Apple Scanner)
  8347. #>69 string APSC (Apple Scanner)
  8348. #>69 string BRKL (Brickles)
  8349. #>69 string BTFT (BitFont)
  8350. #>69 string CCL2 (Common Lisp 2)
  8351. #>69 string CCL\ (Common Lisp)
  8352. #>69 string CDmo (The Talking Moose)
  8353. #>69 string CPCT (Compact Pro)
  8354. #>69 string CSOm (Eudora)
  8355. #>69 string DMOV (Font/DA Mover)
  8356. #>69 string DSIM (DigSim)
  8357. #>69 string EDIT (Macintosh Edit)
  8358. #>69 string ERIK (Macintosh Finder)
  8359. #>69 string EXTR (self-extracting archive)
  8360. #>69 string Gzip (GNU gzip)
  8361. #>69 string KAHL (Think C)
  8362. #>69 string LWFU (LaserWriter Utility)
  8363. #>69 string LZIV (compress)
  8364. #>69 string MACA (MacWrite)
  8365. #>69 string MACS (Macintosh operating system)
  8366. #>69 string MAcK (MacKnowledge terminal emulator)
  8367. #>69 string MLND (Defender)
  8368. #>69 string MPNT (MacPaint)
  8369. #>69 string MSBB (Microsoft BASIC (binary))
  8370. #>69 string MSWD (Microsoft Word)
  8371. #>69 string NCSA (NCSA Telnet)
  8372. #>69 string PJMM (Think Pascal)
  8373. #>69 string PSAL (Hunt the Wumpus)
  8374. #>69 string PSI2 (Apple File Exchange)
  8375. #>69 string R*ch (BBEdit)
  8376. #>69 string RMKR (Resource Maker)
  8377. #>69 string RSED (Resource Editor)
  8378. #>69 string Rich (BBEdit)
  8379. #>69 string SIT! (StuffIt)
  8380. #>69 string SPNT (SuperPaint)
  8381. #>69 string Unix (NeXT Mac filesystem)
  8382. #>69 string VIM! (Vim editor)
  8383. #>69 string WILD (HyperCard)
  8384. #>69 string XCEL (Microsoft Excel)
  8385. #>69 string aCa2 (Fontographer)
  8386. #>69 string aca3 (Aldus FreeHand)
  8387. #>69 string dosa (Macintosh MS-DOS file system)
  8388. #>69 string movr (Font/DA Mover)
  8389. #>69 string nX^n (WriteNow)
  8390. #>69 string pdos (Apple ProDOS file system)
  8391. #>69 string scbk (Scrapbook)
  8392. #>69 string ttxt (SimpleText)
  8393. #>69 string ufox (Foreign File Access)
  8394.  
  8395. # Just in case...
  8396.  
  8397. 102 string mBIN MacBinary III data with surprising version number
  8398.  
  8399. # sas magic from Bruce Foster (bef@nwu.edu)
  8400. #
  8401. #0 string SAS SAS
  8402. #>8 string x %s
  8403. 0 string SAS SAS
  8404. >24 string DATA data file
  8405. >24 string CATALOG catalog
  8406. >24 string INDEX data file index
  8407. >24 string VIEW data view
  8408. # sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
  8409. #
  8410. 0x54 string SAS SAS 7+
  8411. >0x9C string DATA data file
  8412. >0x9C string CATALOG catalog
  8413. >0x9C string INDEX data file index
  8414. >0x9C string VIEW data view
  8415.  
  8416. # spss magic for SPSS system and portable files,
  8417. # from Bruce Foster (bef@nwu.edu).
  8418.  
  8419. 0 long 0xc1e2c3c9 SPSS Portable File
  8420. >40 string x %s
  8421.  
  8422. 0 string $FL2 SPSS System File
  8423. >24 string x %s
  8424.  
  8425. # Macintosh filesystem data
  8426. # From "Tom N Harris" <telliamed@mac.com>
  8427. # Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
  8428. # The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
  8429. # entries depend on the data arithmetic added after v.35
  8430. # There's also some Pascal strings in here, ditto...
  8431.  
  8432. # The boot block signature, according to IM:Files, is
  8433. # "for HFS volumes, this field always contains the value 0x4C4B."
  8434. # But if this is true for MFS or HFS+ volumes, I don't know.
  8435. # Alternatively, the boot block is supposed to be zeroed if it's
  8436. # unused, so a simply >0 should suffice.
  8437.  
  8438. 0x400 beshort 0xD2D7 Macintosh MFS data
  8439. >0 beshort 0x4C4B (bootable)
  8440. >0x40a beshort &0x8000 (locked)
  8441. >0x402 beldate-0x7C25B080 x created: %s,
  8442. >0x406 beldate-0x7C25B080 >0 last backup: %s,
  8443. >0x414 belong x block size: %d,
  8444. >0x412 beshort x number of blocks: %d,
  8445. >0x424 pstring x volume name: %s
  8446.  
  8447. # "BD" is has many false positives
  8448. #0x400 beshort 0x4244 Macintosh HFS data
  8449. #>0 beshort 0x4C4B (bootable)
  8450. #>0x40a beshort &0x8000 (locked)
  8451. #>0x40a beshort ^0x0100 (mounted)
  8452. #>0x40a beshort &0x0200 (spared blocks)
  8453. #>0x40a beshort &0x0800 (unclean)
  8454. #>0x47C beshort 0x482B (Embedded HFS+ Volume)
  8455. #>0x402 beldate-0x7C25B080 x created: %s,
  8456. #>0x406 beldate-0x7C25B080 x last modified: %s,
  8457. #>0x440 beldate-0x7C25B080 >0 last backup: %s,
  8458. #>0x414 belong x block size: %d,
  8459. #>0x412 beshort x number of blocks: %d,
  8460. #>0x424 pstring x volume name: %s
  8461.  
  8462. 0x400 beshort 0x482B Macintosh HFS Extended
  8463. >&0 beshort x version %d data
  8464. >0 beshort 0x4C4B (bootable)
  8465. >0x404 belong ^0x00000100 (mounted)
  8466. >&2 belong &0x00000200 (spared blocks)
  8467. >&2 belong &0x00000800 (unclean)
  8468. >&2 belong &0x00008000 (locked)
  8469. >&6 string x last mounted by: '%.4s',
  8470. # really, that should be treated as a belong and we print a string
  8471. # based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
  8472. >&14 beldate-0x7C25B080 x created: %s,
  8473. # only the creation date is local time, all other timestamps in HFS+ are UTC.
  8474. >&18 bedate-0x7C25B080 x last modified: %s,
  8475. >&22 bedate-0x7C25B080 >0 last backup: %s,
  8476. >&26 bedate-0x7C25B080 >0 last checked: %s,
  8477. >&38 belong x block size: %d,
  8478. >&42 belong x number of blocks: %d,
  8479. >&46 belong x free blocks: %d
  8480.  
  8481. # I don't think this is really necessary since it doesn't do much and
  8482. # anything with a valid driver descriptor will also have a valid
  8483. # partition map
  8484. #0 beshort 0x4552 Apple Device Driver data
  8485. #>&24 beshort =1 \b, MacOS
  8486.  
  8487. # Is that the partition type a cstring or a pstring? Well, IM says "strings
  8488. # shorter than 32 bytes must be terminated with NULL" so I'll treat it as a
  8489. # cstring. Of course, partitions can contain more than four entries, but
  8490. # what're you gonna do?
  8491. 0x200 beshort 0x504D Apple Partition data
  8492. >0x2 beshort x block size: %d,
  8493. >0x230 string x first type: %s,
  8494. >0x210 string x name: %s,
  8495. >0x254 belong x number of blocks: %d,
  8496. >0x400 beshort 0x504D
  8497. >>0x430 string x second type: %s,
  8498. >>0x410 string x name: %s,
  8499. >>0x454 belong x number of blocks: %d,
  8500. >>0x800 beshort 0x504D
  8501. >>>0x830 string x third type: %s,
  8502. >>>0x810 string x name: %s,
  8503. >>>0x854 belong x number of blocks: %d,
  8504. >>>0xa00 beshort 0x504D
  8505. >>>>0xa30 string x fourth type: %s,
  8506. >>>>0xa10 string x name: %s,
  8507. >>>>0xa54 belong x number of blocks: %d
  8508. # AFAIK, only the signature is different
  8509. 0x200 beshort 0x5453 Apple Old Partition data
  8510. >0x2 beshort x block size: %d,
  8511. >0x230 string x first type: %s,
  8512. >0x210 string x name: %s,
  8513. >0x254 belong x number of blocks: %d,
  8514. >0x400 beshort 0x504D
  8515. >>0x430 string x second type: %s,
  8516. >>0x410 string x name: %s,
  8517. >>0x454 belong x number of blocks: %d,
  8518. >>0x800 beshort 0x504D
  8519. >>>0x830 string x third type: %s,
  8520. >>>0x810 string x name: %s,
  8521. >>>0x854 belong x number of blocks: %d,
  8522. >>>0xa00 beshort 0x504D
  8523. >>>>0xa30 string x fourth type: %s,
  8524. >>>>0xa10 string x name: %s,
  8525. >>>>0xa54 belong x number of blocks: %d
  8526.  
  8527. # From: Remi Mommsen <mommsen@slac.stanford.edu>
  8528. 0 string BOMStore Mac OS X bill of materials (BOM) file
  8529.  
  8530. #------------------------------------------------------------------------------
  8531. # magic: file(1) magic for magic files
  8532. #
  8533. 0 string #\ Magic magic text file for file(1) cmd
  8534. 0 lelong 0xF11E041C magic binary file for file(1) cmd
  8535. >4 lelong x (version %d) (little endian)
  8536. 0 belong 0xF11E041C magic binary file for file(1) cmd
  8537. >4 belong x (version %d) (big endian)
  8538.  
  8539. #------------------------------------------------------------------------------
  8540. # mail.news: file(1) magic for mail and news
  8541. #
  8542. # Unfortunately, saved netnews also has From line added in some news software.
  8543. #0 string From mail text
  8544. # There are tests to ascmagic.c to cope with mail and news.
  8545. 0 string Relay-Version: old news text
  8546. 0 string #!\ rnews batched news text
  8547. 0 string N#!\ rnews mailed, batched news text
  8548. 0 string Forward\ to mail forwarding text
  8549. 0 string Pipe\ to mail piping text
  8550. 0 string Return-Path: smtp mail text
  8551. 0 string Path: news text
  8552. 0 string Xref: news text
  8553. 0 string From: news or mail text
  8554. 0 string Article saved news text
  8555. 0 string BABYL Emacs RMAIL text
  8556. 0 string Received: RFC 822 mail text
  8557. 0 string MIME-Version: MIME entity text
  8558. #0 string Content- MIME entity text
  8559.  
  8560. # TNEF files...
  8561. 0 lelong 0x223E9F78 Transport Neutral Encapsulation Format
  8562.  
  8563. # From: Kevin Sullivan <ksulliva@psc.edu>
  8564. 0 string *mbx* MBX mail folder
  8565.  
  8566. # From: Simon Matter <simon.matter@invoca.ch>
  8567. 0 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB
  8568.  
  8569. # JAM(mbp) Fidonet message area databases
  8570. # JHR file
  8571. 0 string JAM\0 JAM message area header file
  8572. >12 leshort >0 (%d messages)
  8573.  
  8574. # Squish Fidonet message area databases
  8575. # SQD file (requires at least one message in the area)
  8576. # XXX: Weak magic
  8577. #256 leshort 0xAFAE4453 Squish message area data file
  8578. #>4 leshort >0 (%d messages)
  8579.  
  8580. #------------------------------------------------------------------------------
  8581. # maple: file(1) magic for maple files
  8582. # "H. Nanosecond" <aldomel@ix.netcom.com>
  8583. # Maple V release 4, a multi-purpose math program
  8584. #
  8585.  
  8586. # maple library .lib
  8587. 0 string \000MVR4\nI MapleVr4 library
  8588.  
  8589. # .ind
  8590. # no magic for these :-(
  8591. # they are compiled indexes for maple files
  8592.  
  8593. # .hdb
  8594. 0 string \000\004\000\000 Maple help database
  8595.  
  8596. # .mhp
  8597. # this has the form <PACKAGE=name>
  8598. 0 string \<PACKAGE= Maple help file
  8599. 0 string \<HELP\ NAME= Maple help file
  8600. 0 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck)
  8601. #0 string #\ Newton Maple help file, old style
  8602. 0 string #\ daub Maple help file, old style
  8603. #0 string #=========== Maple help file, old style
  8604.  
  8605. # .mws
  8606. 0 string \000\000\001\044\000\221 Maple worksheet
  8607. #this is anomalous
  8608. 0 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird
  8609. # this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n
  8610. # that is {VERSION major_version miunor_version computer_type version_string}
  8611. 0 string {VERSION\ Maple worksheet
  8612. >9 string >\0 version %.1s.
  8613. >>>11 string >\0 %.1s
  8614.  
  8615. # .mps
  8616. 0 string \0\0\001$ Maple something
  8617. # from byte 4 it is either 'nul E' or 'soh R'
  8618. # I think 'nul E' means a file that was saved as a different name
  8619. # a sort of revision marking
  8620. # 'soh R' means new
  8621. >4 string \000\105 An old revision
  8622. >4 string \001\122 The latest save
  8623.  
  8624. # .mpl
  8625. # some of these are the same as .mps above
  8626. #0000000 000 000 001 044 000 105 same as .mps
  8627. #0000000 000 000 001 044 001 122 same as .mps
  8628.  
  8629. 0 string #\n##\ <SHAREFILE= Maple something
  8630. 0 string \n#\n##\ <SHAREFILE= Maple something
  8631. 0 string ##\ <SHAREFILE= Maple something
  8632. 0 string #\r##\ <SHAREFILE= Maple something
  8633. 0 string \r#\r##\ <SHAREFILE= Maple something
  8634. 0 string #\ \r##\ <DESCRIBE> Maple something anomalous.
  8635.  
  8636. #------------------------------------------------------------------------------
  8637. # mathematica: file(1) magic for mathematica files
  8638. # "H. Nanosecond" <aldomel@ix.netcom.com>
  8639. # Mathematica a multi-purpose math program
  8640. # versions 2.2 and 3.0
  8641.  
  8642. #mathematica .mb
  8643. 0 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook
  8644. 0 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook
  8645.  
  8646. # .ma
  8647. # multiple possibilites:
  8648.  
  8649. 0 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook
  8650. #>41 string >\0 %s
  8651.  
  8652. #0 string (*^\n\n::[\011palette Mathematica notebook version 2.x
  8653.  
  8654. #0 string (*^\n\n::[\011Information Mathematica notebook version 2.x
  8655. #>675 string >\0 %s #doesn't work well
  8656.  
  8657. # there may be 'cr' instread of 'nl' in some does this matter?
  8658.  
  8659. # generic:
  8660. 0 string (*^\r\r::[\011 Mathematica notebook version 2.x
  8661. 0 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x
  8662. 0 string (*^\015 Mathematica notebook version 2.x
  8663. 0 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x
  8664. 0 string (*^\r::[\011 Mathematica notebook version 2.x
  8665. 0 string (*^\r\n::[\011 Mathematica notebook version 2.x
  8666. 0 string (*^\n\n::[\011 Mathematica notebook version 2.x
  8667. 0 string (*^\n::[\011 Mathematica notebook version 2.x
  8668.  
  8669.  
  8670. # Mathematica .mx files
  8671.  
  8672. #0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file
  8673. 0 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file
  8674. #>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
  8675. # >71... is optional
  8676. >88 string >\0 from %s
  8677.  
  8678.  
  8679. # Mathematica files PBF:
  8680. # 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000
  8681. 0 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think)
  8682.  
  8683. # .ml files These are menu resources I think
  8684. # these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
  8685. # how to put that into a magic rule?
  8686. 4 string \ A~ MAthematica .ml file
  8687.  
  8688. # .nb files
  8689. #too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook
  8690. 0 string (*********************** Mathematica 3.0 notebook
  8691.  
  8692. # other (* matches it is a comment start in these langs
  8693. 0 string (* Mathematica, or Pascal, Modula-2 or 3 code text
  8694.  
  8695. #########################
  8696. # MatLab v5
  8697. 0 string MATLAB Matlab v5 mat-file
  8698. >126 short 0x494d (big endian)
  8699. >>124 beshort x version 0x%04x
  8700. >126 short 0x4d49 (little endian)
  8701. >>124 leshort x version 0x%04x
  8702.  
  8703.  
  8704. #------------------------------------------------------------------------------
  8705. # matroska: file(1) magic for Matroska files
  8706. #
  8707. # See http://www.matroska.org/
  8708. #
  8709.  
  8710. # EBML id:
  8711. 0 belong 0x1a45dfa3
  8712. # DocType id:
  8713. >5 beshort 0x4282
  8714. # DocType contents:
  8715. >>8 string matroska Matroska data
  8716.  
  8717. #------------------------------------------------------------------------------
  8718. # Mavroyanopoulos Nikos <nmav@hellug.gr>
  8719. # mcrypt: file(1) magic for mcrypt 2.2.x;
  8720. 0 string \0m\3 mcrypt 2.5 encrypted data,
  8721. >4 string >\0 algorithm: %s,
  8722. >>&1 leshort >0 keysize: %d bytes,
  8723. >>>&0 string >\0 mode: %s,
  8724.  
  8725. 0 string \0m\2 mcrypt 2.2 encrypted data,
  8726. >3 byte 0 algorithm: blowfish-448,
  8727. >3 byte 1 algorithm: DES,
  8728. >3 byte 2 algorithm: 3DES,
  8729. >3 byte 3 algorithm: 3-WAY,
  8730. >3 byte 4 algorithm: GOST,
  8731. >3 byte 6 algorithm: SAFER-SK64,
  8732. >3 byte 7 algorithm: SAFER-SK128,
  8733. >3 byte 8 algorithm: CAST-128,
  8734. >3 byte 9 algorithm: xTEA,
  8735. >3 byte 10 algorithm: TWOFISH-128,
  8736. >3 byte 11 algorithm: RC2,
  8737. >3 byte 12 algorithm: TWOFISH-192,
  8738. >3 byte 13 algorithm: TWOFISH-256,
  8739. >3 byte 14 algorithm: blowfish-128,
  8740. >3 byte 15 algorithm: blowfish-192,
  8741. >3 byte 16 algorithm: blowfish-256,
  8742. >3 byte 100 algorithm: RC6,
  8743. >3 byte 101 algorithm: IDEA,
  8744. >4 byte 0 mode: CBC,
  8745. >4 byte 1 mode: ECB,
  8746. >4 byte 2 mode: CFB,
  8747. >4 byte 3 mode: OFB,
  8748. >4 byte 4 mode: nOFB,
  8749. >5 byte 0 keymode: 8bit
  8750. >5 byte 1 keymode: 4bit
  8751. >5 byte 2 keymode: SHA-1 hash
  8752. >5 byte 3 keymode: MD5 hash
  8753. #------------------------------------------------------------------------------
  8754. # mime: file(1) magic for MIME encoded files
  8755. #
  8756. 0 string Content-Type:\
  8757. >14 string >\0 %s
  8758. 0 string Content-Type:
  8759. >13 string >\0 %s
  8760.  
  8761. #------------------------------------------------------------------------------
  8762. # mips: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.)
  8763. # Dec Ultrix (MIPS)
  8764. # all of SGI's *current* machines and OSes run in big-endian mode on the
  8765. # MIPS machines, as far as I know.
  8766. #
  8767. # XXX - what is the blank "-" line?
  8768. #
  8769. # kbd file definitions
  8770. 0 string kbd!map kbd map file
  8771. >8 byte >0 Ver %d:
  8772. >10 short >0 with %d table(s)
  8773. 0 belong 0407 old SGI 68020 executable
  8774. 0 belong 0410 old SGI 68020 pure executable
  8775. 0 beshort 0x8765 disk quotas file
  8776. 0 beshort 0x0506 IRIS Showcase file
  8777. >2 byte 0x49 -
  8778. >3 byte x - version %ld
  8779. 0 beshort 0x0226 IRIS Showcase template
  8780. >2 byte 0x63 -
  8781. >3 byte x - version %ld
  8782. 0 belong 0x5343464d IRIS Showcase file
  8783. >4 byte x - version %ld
  8784. 0 belong 0x5443464d IRIS Showcase template
  8785. >4 byte x - version %ld
  8786. 0 belong 0xdeadbabe IRIX Parallel Arena
  8787. >8 belong >0 - version %ld
  8788. #
  8789. 0 beshort 0x0160 MIPSEB ECOFF executable
  8790. >20 beshort 0407 (impure)
  8791. >20 beshort 0410 (swapped)
  8792. >20 beshort 0413 (paged)
  8793. >8 belong >0 not stripped
  8794. >8 belong 0 stripped
  8795. >22 byte x - version %ld
  8796. >23 byte x .%ld
  8797. #
  8798. 0 beshort 0x0162 MIPSEL-BE ECOFF executable
  8799. >20 beshort 0407 (impure)
  8800. >20 beshort 0410 (swapped)
  8801. >20 beshort 0413 (paged)
  8802. >8 belong >0 not stripped
  8803. >8 belong 0 stripped
  8804. >23 byte x - version %d
  8805. >22 byte x .%ld
  8806. #
  8807. 0 beshort 0x6001 MIPSEB-LE ECOFF executable
  8808. >20 beshort 03401 (impure)
  8809. >20 beshort 04001 (swapped)
  8810. >20 beshort 05401 (paged)
  8811. >8 belong >0 not stripped
  8812. >8 belong 0 stripped
  8813. >23 byte x - version %d
  8814. >22 byte x .%ld
  8815. #
  8816. 0 beshort 0x6201 MIPSEL ECOFF executable
  8817. >20 beshort 03401 (impure)
  8818. >20 beshort 04001 (swapped)
  8819. >20 beshort 05401 (paged)
  8820. >8 belong >0 not stripped
  8821. >8 belong 0 stripped
  8822. >23 byte x - version %ld
  8823. >22 byte x .%ld
  8824. #
  8825. # MIPS 2 additions
  8826. #
  8827. 0 beshort 0x0163 MIPSEB MIPS-II ECOFF executable
  8828. >20 beshort 0407 (impure)
  8829. >20 beshort 0410 (swapped)
  8830. >20 beshort 0413 (paged)
  8831. >8 belong >0 not stripped
  8832. >8 belong 0 stripped
  8833. >22 byte x - version %ld
  8834. >23 byte x .%ld
  8835. #
  8836. 0 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable
  8837. >20 beshort 0407 (impure)
  8838. >20 beshort 0410 (swapped)
  8839. >20 beshort 0413 (paged)
  8840. >8 belong >0 not stripped
  8841. >8 belong 0 stripped
  8842. >22 byte x - version %ld
  8843. >23 byte x .%ld
  8844. #
  8845. 0 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable
  8846. >20 beshort 03401 (impure)
  8847. >20 beshort 04001 (swapped)
  8848. >20 beshort 05401 (paged)
  8849. >8 belong >0 not stripped
  8850. >8 belong 0 stripped
  8851. >23 byte x - version %ld
  8852. >22 byte x .%ld
  8853. #
  8854. 0 beshort 0x6601 MIPSEL MIPS-II ECOFF executable
  8855. >20 beshort 03401 (impure)
  8856. >20 beshort 04001 (swapped)
  8857. >20 beshort 05401 (paged)
  8858. >8 belong >0 not stripped
  8859. >8 belong 0 stripped
  8860. >23 byte x - version %ld
  8861. >22 byte x .%ld
  8862. #
  8863. # MIPS 3 additions
  8864. #
  8865. 0 beshort 0x0140 MIPSEB MIPS-III ECOFF executable
  8866. >20 beshort 0407 (impure)
  8867. >20 beshort 0410 (swapped)
  8868. >20 beshort 0413 (paged)
  8869. >8 belong >0 not stripped
  8870. >8 belong 0 stripped
  8871. >22 byte x - version %ld
  8872. >23 byte x .%ld
  8873. #
  8874. 0 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable
  8875. >20 beshort 0407 (impure)
  8876. >20 beshort 0410 (swapped)
  8877. >20 beshort 0413 (paged)
  8878. >8 belong >0 not stripped
  8879. >8 belong 0 stripped
  8880. >22 byte x - version %ld
  8881. >23 byte x .%ld
  8882. #
  8883. 0 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable
  8884. >20 beshort 03401 (impure)
  8885. >20 beshort 04001 (swapped)
  8886. >20 beshort 05401 (paged)
  8887. >8 belong >0 not stripped
  8888. >8 belong 0 stripped
  8889. >23 byte x - version %ld
  8890. >22 byte x .%ld
  8891. #
  8892. 0 beshort 0x4201 MIPSEL MIPS-III ECOFF executable
  8893. >20 beshort 03401 (impure)
  8894. >20 beshort 04001 (swapped)
  8895. >20 beshort 05401 (paged)
  8896. >8 belong >0 not stripped
  8897. >8 belong 0 stripped
  8898. >23 byte x - version %ld
  8899. >22 byte x .%ld
  8900. #
  8901. 0 beshort 0x180 MIPSEB Ucode
  8902. 0 beshort 0x182 MIPSEL-BE Ucode
  8903. # 32bit core file
  8904. 0 belong 0xdeadadb0 IRIX core dump
  8905. >4 belong 1 of
  8906. >16 string >\0 '%s'
  8907. # 64bit core file
  8908. 0 belong 0xdeadad40 IRIX 64-bit core dump
  8909. >4 belong 1 of
  8910. >16 string >\0 '%s'
  8911. # N32bit core file
  8912. 0 belong 0xbabec0bb IRIX N32 core dump
  8913. >4 belong 1 of
  8914. >16 string >\0 '%s'
  8915. # New style crash dump file
  8916. 0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of
  8917. >36 string >\0 '%s'
  8918. # Trusted IRIX info
  8919. 0 string SGIAUDIT SGI Audit file
  8920. >8 byte x - version %d
  8921. >9 byte x .%ld
  8922. #
  8923. 0 string WNGZWZSC Wingz compiled script
  8924. 0 string WNGZWZSS Wingz spreadsheet
  8925. 0 string WNGZWZHP Wingz help file
  8926. #
  8927. 0 string #Inventor V IRIS Inventor 1.0 file
  8928. 0 string #Inventor V2 Open Inventor 2.0 file
  8929. # GLF is OpenGL stream encoding
  8930. 0 string glfHeadMagic(); GLF_TEXT
  8931. 4 belong 0x7d000000 GLF_BINARY_LSB_FIRST
  8932. 4 belong 0x0000007d GLF_BINARY_MSB_FIRST
  8933. # GLS is OpenGL stream encoding; GLS is the successor of GLF
  8934. 0 string glsBeginGLS( GLS_TEXT
  8935. 4 belong 0x10000000 GLS_BINARY_LSB_FIRST
  8936. 4 belong 0x00000010 GLS_BINARY_MSB_FIRST
  8937.  
  8938. #------------------------------------------------------------------------------
  8939. # mirage: file(1) magic for Mirage executables
  8940. #
  8941. # XXX - byte order?
  8942. #
  8943. 0 long 31415 Mirage Assembler m.out executable
  8944. #-----------------------------------------------------------------------------
  8945. # misctools: file(1) magic for miscelanous UNIX tools.
  8946. #
  8947. 0 string %%!! X-Post-It-Note text
  8948. 0 string/c BEGIN:VCALENDAR vCalendar calendar file
  8949. 0 string/c BEGIN:VCARD vCard visiting card
  8950.  
  8951. # From: Alex Beregszaszi <alex@fsn.hu>
  8952. 4 string gtktalog GNOME Catalogue (gtktalog)
  8953. >13 string >\0 version %s
  8954.  
  8955. # From: Tomasz Trojanowski <tomek@uninet.com.pl>
  8956. 0 search/80 .la\ -\ a\ libtool\ library\ file libtool library file
  8957.  
  8958. #------------------------------------------------------------------------------
  8959. # mkid: file(1) magic for mkid(1) databases
  8960. #
  8961. # ID is the binary tags database produced by mkid(1).
  8962. #
  8963. # XXX - byte order?
  8964. #
  8965. 0 string \311\304 ID tags data
  8966. >2 short >0 version %d
  8967.  
  8968. #------------------------------------------------------------------------------
  8969. # mlssa: file(1) magic for MLSSA datafiles
  8970. #
  8971. 0 lelong 0xffffabcd MLSSA datafile,
  8972. >4 leshort x algorithm %d,
  8973. >10 lelong x %d samples
  8974.  
  8975. #------------------------------------------------------------------------------
  8976. # mmdf: file(1) magic for MMDF mail files
  8977. #
  8978. 0 string \001\001\001\001 MMDF mailbox
  8979. #------------------------------------------------------------------------------
  8980. # modem: file(1) magic for modem programs
  8981. #
  8982. # From: Florian La Roche <florian@knorke.saar.de>
  8983. 4 string Research, Digifax-G3-File
  8984. >29 byte 1 , fine resolution
  8985. >29 byte 0 , normal resolution
  8986.  
  8987. 0 short 0x0100 raw G3 data, byte-padded
  8988. 0 short 0x1400 raw G3 data
  8989. #
  8990. # Magic data for vgetty voice formats
  8991. # (Martin Seine & Marc Eberhard)
  8992.  
  8993. #
  8994. # raw modem data version 1
  8995. #
  8996. 0 string RMD1 raw modem data
  8997. >4 string >\0 (%s /
  8998. >20 short >0 compression type 0x%04x)
  8999.  
  9000. #
  9001. # portable voice format 1
  9002. #
  9003. 0 string PVF1\n portable voice format
  9004. >5 string >\0 (binary %s)
  9005.  
  9006. #
  9007. # portable voice format 2
  9008. #
  9009. 0 string PVF2\n portable voice format
  9010. >5 string >\0 (ascii %s)
  9011.  
  9012.  
  9013. #------------------------------------------------------------------------------
  9014. # motorola: file(1) magic for Motorola 68K and 88K binaries
  9015. #
  9016. # 68K
  9017. #
  9018. 0 beshort 0520 mc68k COFF
  9019. >18 beshort ^00000020 object
  9020. >18 beshort &00000020 executable
  9021. >12 belong >0 not stripped
  9022. >168 string .lowmem Apple toolbox
  9023. >20 beshort 0407 (impure)
  9024. >20 beshort 0410 (pure)
  9025. >20 beshort 0413 (demand paged)
  9026. >20 beshort 0421 (standalone)
  9027. 0 beshort 0521 mc68k executable (shared)
  9028. >12 belong >0 not stripped
  9029. 0 beshort 0522 mc68k executable (shared demand paged)
  9030. >12 belong >0 not stripped
  9031. #
  9032. # Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
  9033. #
  9034. 0 beshort 0554 68K BCS executable
  9035. #
  9036. # 88K
  9037. #
  9038. # Motorola/88Open BCS
  9039. #
  9040. 0 beshort 0555 88K BCS executable
  9041. #
  9042. # Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
  9043. 0 string S0 Motorola S-Record; binary data in text format
  9044.  
  9045. # ATARI ST relocatable PRG
  9046. #
  9047. # from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001
  9048. # (according to Roland Waldi, Oct 21, 1987)
  9049. # besides the magic 0x601a, the text segment size is checked to be
  9050. # not larger than 1 MB (which is a lot on ST).
  9051. # The additional 0x601b distinction I took from Doug Lee's magic.
  9052. 0 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable
  9053. >2 belong x (txt=%ld,
  9054. >6 belong x dat=%ld,
  9055. >10 belong x bss=%ld,
  9056. >14 belong x sym=%ld)
  9057. 0 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable
  9058. >2 belong x (txt=%ld,
  9059. >6 belong x dat=%ld,
  9060. >10 belong x bss=%ld,
  9061. >14 belong x sym=%ld)
  9062.  
  9063. # Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>)
  9064. 0 beshort 0x601A Atari 68xxx executable,
  9065. >2 belong x text len %lu,
  9066. >6 belong x data len %lu,
  9067. >10 belong x BSS len %lu,
  9068. >14 belong x symboltab len %lu,
  9069. >18 belong 0
  9070. >22 belong &0x01 fastload flag,
  9071. >22 belong &0x02 may be loaded to alternate RAM,
  9072. >22 belong &0x04 malloc may be from alternate RAM,
  9073. >22 belong x flags: 0x%lX,
  9074. >26 beshort 0 no relocation tab
  9075. >26 beshort !0 + relocation tab
  9076. >30 string SFX [Self-Extracting LZH SFX archive]
  9077. >38 string SFX [Self-Extracting LZH SFX archive]
  9078. >44 string ZIP! [Self-Extracting ZIP SFX archive]
  9079.  
  9080. 0 beshort 0x0064 Atari 68xxx CPX file
  9081. >8 beshort x (version %04lx)
  9082.  
  9083. #------------------------------------------------------------------------------
  9084. # msdos: file(1) magic for MS-DOS files
  9085. #
  9086.  
  9087. # .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
  9088. # updated by Joerg Jenderek
  9089. 0 string @
  9090. >1 string/cB \ echo\ off MS-DOS batch file text
  9091. >1 string/cB echo\ off MS-DOS batch file text
  9092. >1 string/cB rem\ MS-DOS batch file text
  9093. >1 string/cB set\ MS-DOS batch file text
  9094.  
  9095.  
  9096. # OS/2 batch files are REXX. the second regex is a bit generic, oh well
  9097. # the matched commands seem to be common in REXX and uncommon elsewhere
  9098. 100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text
  9099. 100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text
  9100.  
  9101. 0 leshort 0x14c MS Windows COFF Intel 80386 object file
  9102. #>4 ledate x stamp %s
  9103. 0 leshort 0x166 MS Windows COFF MIPS R4000 object file
  9104. #>4 ledate x stamp %s
  9105. 0 leshort 0x184 MS Windows COFF Alpha object file
  9106. #>4 ledate x stamp %s
  9107. 0 leshort 0x268 MS Windows COFF Motorola 68000 object file
  9108. #>4 ledate x stamp %s
  9109. 0 leshort 0x1f0 MS Windows COFF PowerPC object file
  9110. #>4 ledate x stamp %s
  9111. 0 leshort 0x290 MS Windows COFF PA-RISC object file
  9112. #>4 ledate x stamp %s
  9113.  
  9114. # XXX - according to Microsoft's spec, at an offset of 0x3c in a
  9115. # PE-format executable is the offset in the file of the PE header;
  9116. # unfortunately, that's a little-endian offset, and there's no way
  9117. # to specify an indirect offset with a specified byte order.
  9118. # So, for now, we assume the standard MS-DOS stub, which puts the
  9119. # PE header at 0x80 = 128.
  9120. #
  9121. # Required OS version and subsystem version were 4.0 on some NT 3.51
  9122. # executables built with Visual C++ 4.0, so it's not clear that
  9123. # they're interesting. The user version was 0.0, but there's
  9124. # probably some linker directive to set it. The linker version was
  9125. # 3.0, except for one ".exe" which had it as 4.20 (same damn linker!).
  9126. #
  9127. # many of the compressed formats were extraced from IDARC 1.23 source code
  9128. #
  9129. 0 string MZ MS-DOS executable
  9130. >0 string MZ\0\0\0\0\0\0\0\0\0\0PE\0\0 \b, PE for MS Windows
  9131. >>&18 leshort&0x2000 >0 (DLL)
  9132. >>&88 leshort 0 (unknown subsystem)
  9133. >>&88 leshort 1 (native)
  9134. >>&88 leshort 2 (GUI)
  9135. >>&88 leshort 3 (console)
  9136. >>&88 leshort 7 (POSIX)
  9137. >>&0 leshort 0x0 unknown processor
  9138. >>&0 leshort 0x14c Intel 80386
  9139. >>&0 leshort 0x166 MIPS R4000
  9140. >>&0 leshort 0x184 Alpha
  9141. >>&0 leshort 0x268 Motorola 68000
  9142. >>&0 leshort 0x1f0 PowerPC
  9143. >>&0 leshort 0x290 PA-RISC
  9144. >>&18 leshort&0x0100 >0 32-bit
  9145. >>&18 leshort&0x1000 >0 system file
  9146. >>&0xf4 search/0x140 \x0\x40\x1\x0
  9147. >>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
  9148.  
  9149. >0x18 leshort >0x3f
  9150. >>(0x3c.l) string PE\0\0 PE
  9151. # hooray, there's a DOS extender using the PE format, with a valid PE
  9152. # executable inside (which just prints a message and exits if run in win)
  9153. >>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender
  9154. >>>(8.s*16) string !32STUB for MS Windows
  9155. >>>>(0x3c.l+22) leshort&0x2000 >0 (DLL)
  9156. >>>>(0x3c.l+92) leshort 0 (unknown subsystem)
  9157. >>>>(0x3c.l+92) leshort 1 (native)
  9158. >>>>(0x3c.l+92) leshort 2 (GUI)
  9159. >>>>(0x3c.l+92) leshort 3 (console)
  9160. >>>>(0x3c.l+92) leshort 7 (POSIX)
  9161. >>>>(0x3c.l+4) leshort 0x0 unknown processor
  9162. >>>>(0x3c.l+4) leshort 0x14c Intel 80386
  9163. >>>>(0x3c.l+4) leshort 0x166 MIPS R4000
  9164. >>>>(0x3c.l+4) leshort 0x184 Alpha
  9165. >>>>(0x3c.l+4) leshort 0x268 Motorola 68000
  9166. >>>>(0x3c.l+4) leshort 0x1f0 PowerPC
  9167. >>>>(0x3c.l+4) leshort 0x290 PA-RISC
  9168. >>>>(0x3c.l+22) leshort&0x0100 >0 32-bit
  9169. >>>>(0x3c.l+22) leshort&0x1000 >0 system file
  9170. >>>>(0x3c.l+232) lelong >0 Mono/.Net assembly
  9171.  
  9172. >>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed
  9173. >>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed
  9174. >>>>(0x3c.l+0xf8) search/0x140 UPX2
  9175. >>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
  9176. >>>>(0x3c.l+0xf8) search/0x140 .idata
  9177. >>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
  9178. >>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive
  9179. >>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive
  9180. >>>>(0x3c.l+0xf8) search/0x140 .rsrc
  9181. >>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive
  9182. >>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive
  9183. >>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive
  9184. >>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive
  9185. >>>>(0x3c.l+0xf8) search/0x140 .data
  9186. >>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive
  9187. >>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed
  9188. >>>>>(0x3c.l+0xf7) byte x
  9189. >>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive
  9190. >>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive
  9191. >>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive
  9192. >>>>(0x3c.l+0xf8) search/0x140 .reloc
  9193. >>>>>(&0xe.l+(-4)) search/0x180 PK\3\4 \b, ZIP self-extracting archive (WinZip)
  9194.  
  9195. >>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip)
  9196. >>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive
  9197. >>>>0x30 string Inno \b, InnoSetup self-extracting archive
  9198.  
  9199. >>(0x3c.l) string NE \b, NE
  9200. >>>(0x3c.l+0x36) byte 0 (unknown OS)
  9201. >>>(0x3c.l+0x36) byte 1 for OS/2 1.x
  9202. >>>(0x3c.l+0x36) byte 2 for MS Windows 3.x
  9203. >>>(0x3c.l+0x36) byte 3 for MS-DOS
  9204. >>>(0x3c.l+0x36) byte >3 (unknown OS)
  9205. >>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender
  9206. >>>(0x3c.l+0x0c) leshort&0x8003 0x8002 (DLL)
  9207. >>>(0x3c.l+0x0c) leshort&0x8003 0x8001 (driver)
  9208. >>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive
  9209. >>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
  9210.  
  9211. >>(0x3c.l) string LX\0\0 \b, LX
  9212. >>>(0x3c.l+0x0a) leshort <1 (unknown OS)
  9213. >>>(0x3c.l+0x0a) leshort 1 for OS/2
  9214. >>>(0x3c.l+0x0a) leshort 2 for MS Windows
  9215. >>>(0x3c.l+0x0a) leshort 3 for DOS
  9216. >>>(0x3c.l+0x0a) leshort >3 (unknown OS)
  9217. >>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL)
  9218. >>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver)
  9219. >>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI)
  9220. >>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console)
  9221. >>>(0x3c.l+0x08) leshort 1 i80286
  9222. >>>(0x3c.l+0x08) leshort 2 i80386
  9223. >>>(0x3c.l+0x08) leshort 3 i80486
  9224. >>>(8.s*16) string emx \b, emx
  9225. >>>>&1 string x %s
  9226. >>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive
  9227.  
  9228. # MS Windows system file, supposedly a collection of LE executables
  9229. >>(0x3c.l) string W3 \b, W3 for MS Windows
  9230.  
  9231. >>(0x3c.l) string LE\0\0 \b, LE executable
  9232. >>>(0x3c.l+0x0a) leshort 1
  9233. # some DOS extenders use LE files with OS/2 header
  9234. >>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
  9235. >>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
  9236. >>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
  9237. >>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender
  9238. >>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
  9239. >>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
  9240. >>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
  9241. # this is a wild guess; hopefully it is a specific signature
  9242. >>>>&0x24 lelong <0x50
  9243. >>>>>(&0x4c.l) string \xfc\xb8WATCOM
  9244. >>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed
  9245. # another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP
  9246. #>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2
  9247. # fails with DOS-Extenders.
  9248. >>>(0x3c.l+0x0a) leshort 2 for MS Windows
  9249. >>>(0x3c.l+0x0a) leshort 3 for DOS
  9250. >>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD)
  9251. >>>(&0x7c.l+0x26) string UPX \b, UPX compressed
  9252. >>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive
  9253.  
  9254. # looks like ASCII, probably some embedded copyright message.
  9255. # and definitely not NE/LE/LX/PE
  9256. >>0x3c lelong >0x20000000
  9257. >>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS
  9258. # header data too small for extended executable
  9259. >2 long !0
  9260. >>0x18 leshort <0x40
  9261. >>>(4.s*512) leshort !0x014c
  9262.  
  9263. >>>>&(2.s-514) string !LE
  9264. >>>>>&-2 string !BW \b, MZ for MS-DOS
  9265. >>>>&(2.s-514) string LE \b, LE
  9266. >>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
  9267. # educated guess since indirection is still not capable enough for complex offset
  9268. # calculations (next embedded executable would be at &(&2*512+&0-2)
  9269. # I suspect there are only LE executables in these multi-exe files
  9270. >>>>&(2.s-514) string BW
  9271. >>>>>0x240 search/0x100 DOS/4G ,\b LE for MS-DOS, DOS4GW DOS extender (embedded)
  9272. >>>>>0x240 search/0x100 !DOS/4G ,\b BW collection for MS-DOS
  9273.  
  9274. # This sequence skips to the first COFF segment, usually .text
  9275. >(4.s*512) leshort 0x014c \b, COFF
  9276. >>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender
  9277. >>(8.s*16) string emx
  9278. >>>&1 string x for DOS, Win or OS/2, emx %s
  9279. >>&(&0x42.l-3) byte x
  9280. >>>&0x26 string UPX \b, UPX compressed
  9281. # and yet another guess: small .text, and after large .data is unusal, could be 32lite
  9282. >>&0x2c search/0xa0 .text
  9283. >>>&0x0b lelong <0x2000
  9284. >>>>&0 lelong >0x6000 \b, 32lite compressed
  9285.  
  9286. >(8.s*16) string $WdX \b, WDos/X DOS extender
  9287.  
  9288. # .EXE formats (Greg Roelofs, newt@uchicago.edu)
  9289. #
  9290. >0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
  9291. >0xe7 string LH/2\ Self-Extract \b, %s
  9292. >0x1c string diet \b, diet compressed
  9293. >0x1c string LZ09 \b, LZEXE v0.90 compressed
  9294. >0x1c string LZ91 \b, LZEXE v0.91 compressed
  9295. >0x1c string tz \b, TinyProg compressed
  9296. >0x1e string PKLITE \b, %s compressed
  9297. >0x64 string W\ Collis\0\0 \b, Compack compressed
  9298. >0x24 string LHa's\ SFX \b, LHa self-extracting archive
  9299. >0x24 string LHA's\ SFX \b, LHa self-extracting archive
  9300. >0x24 string \ $ARX \b, ARX self-extracting archive
  9301. >0x24 string \ $LHarc \b, LHarc self-extracting archive
  9302. >0x20 string SFX\ by\ LARC \b, LARC self-extracting archive
  9303. >1638 string -lh5- \b, LHa self-extracting archive v2.13S
  9304. >0x17888 string Rar! \b, RAR self-extracting archive
  9305. >0x40 string aPKG \b, aPackage self-extracting archive
  9306.  
  9307. >32 string AIN
  9308. >>35 string 2 \b, AIN 2.x compressed
  9309. >>35 string <2 \b, AIN 1.x compressed
  9310. >>35 string >2 \b, AIN 1.x compressed
  9311. >28 string UC2X \b, UCEXE compressed
  9312. >28 string WWP\ \b, WWPACK compressed
  9313.  
  9314. # skip to the end of the exe
  9315. >(4.s*512) long x
  9316. >>&(2.s-517) byte x
  9317. >>>&0 string PK\3\4 \b, ZIP self-extracting archive
  9318. >>>&0 string Rar! \b, RAR self-extracting archive
  9319. >>>&0 string =!\x11 \b, AIN 2.x self-extracting archive
  9320. >>>&0 string =!\x12 \b, AIN 2.x self-extracting archive
  9321. >>>&0 string =!\x17 \b, AIN 1.x self-extracting archive
  9322. >>>&0 string =!\x18 \b, AIN 1.x self-extracting archive
  9323. >>>&7 search/400 **ACE** \b, ACE self-extracting archive
  9324. >>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive
  9325.  
  9326. >0x1c string RJSX \b, ARJ self-extracting archive
  9327. # winarj stores a message in the stub instead of the sig in the MZ header
  9328. >0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive
  9329.  
  9330. # a few unknown ZIP sfxes, no idea if they are needed or if they are
  9331. # already captured by the generic patterns above
  9332. >122 string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive
  9333. >(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP)
  9334. # TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive
  9335. #
  9336.  
  9337. # TELVOX Teleinformatica CODEC self-extractor for OS/2:
  9338. >49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21
  9339. >>49824 leshort =1 \b, 1 file
  9340. >>49824 leshort >1 \b, %u files
  9341.  
  9342. # .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
  9343. # Uncommenting only the first two lines will cover about 2/3 of COM files,
  9344. # but it isn't feasible to match all COM files since there must be at least
  9345. # two dozen different one-byte "magics".
  9346. 0 byte 0xe9 DOS executable (COM)
  9347. >0x1FE leshort 0xAA55 \b, boot code
  9348. >6 string SFX\ of\ LHarc (%s)
  9349. 0 belong 0xffffffff DOS executable (device driver)
  9350. #CMD640X2.SYS
  9351. >10 string >\x23
  9352. >>10 string !\x2e
  9353. >>>17 string <\x5B
  9354. >>>>10 string x \b, name: %.8s
  9355. #UDMA.SYS KEYB.SYS CMD640X2.SYS
  9356. >10 string <\x41
  9357. >>12 string >\x40
  9358. >>>10 string !$
  9359. >>>>12 string x \b, name: %.8s
  9360. #BTCDROM.SYS ASPICD.SYS
  9361. >22 string >\x40
  9362. >>22 string <\x5B
  9363. >>>23 string <\x5B
  9364. >>>>22 string x \b, name: %.8s
  9365. #ATAPICD.SYS
  9366. >76 string \0
  9367. >>77 string >\x40
  9368. >>>77 string <\x5B
  9369. >>>>77 string x \b, name: %.8s
  9370. 0 byte 0x8c DOS executable (COM)
  9371. # 0xeb conflicts with "sequent" magic
  9372. 0 byte 0xeb DOS executable (COM)
  9373. >0x1FE leshort 0xAA55 \b, boot code
  9374. >85 string UPX \b, UPX compressed
  9375. >4 string \ $ARX \b, ARX self-extracting archive
  9376. >4 string \ $LHarc \b, LHarc self-extracting archive
  9377. >0x20e string SFX\ by\ LARC \b, LARC self-extracting archive
  9378. 0 byte 0xb8 COM executable
  9379. # modified by Joerg Jenderek
  9380. >1 lelong !0x21cd4cff for DOS
  9381. # http://syslinux.zytor.com/comboot.php
  9382. # (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
  9383. # start with assembler instructions mov eax,21cd4cffh
  9384. >1 lelong 0x21cd4cff (32-bit COMBOOT)
  9385. 0 string \x81\xfc
  9386. >4 string \x77\x02\xcd\x20\xb9
  9387. >>36 string UPX! FREE-DOS executable (COM), UPX compressed
  9388. 252 string Must\ have\ DOS\ version DR-DOS executable (COM)
  9389. # GRR search is not working
  9390. #2 search/28 \xcd\x21 COM executable for MS-DOS
  9391. #WHICHFAT.cOM
  9392. 2 string \xcd\x21 COM executable for DOS
  9393. #DELTREE.cOM DELTREE2.cOM
  9394. 4 string \xcd\x21 COM executable for DOS
  9395. #IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
  9396. 5 string \xcd\x21 COM executable for DOS
  9397. #DELTMP.COm HASFAT32.cOM
  9398. 7 string \xcd\x21
  9399. >0 byte !0xb8 COM executable for DOS
  9400. #COMP.cOM MORE.COm
  9401. 10 string \xcd\x21
  9402. >5 string !\xcd\x21 COM executable for DOS
  9403. #comecho.com
  9404. 13 string \xcd\x21 COM executable for DOS
  9405. #HELP.COm EDIT.coM
  9406. 18 string \xcd\x21 COM executable for MS-DOS
  9407. #NWRPLTRM.COm
  9408. 23 string \xcd\x21 COM executable for MS-DOS
  9409. #LOADFIX.cOm LOADFIX.cOm
  9410. 30 string \xcd\x21 COM executable for MS-DOS
  9411. #syslinux.com 3.11
  9412. 70 string \xcd\x21 COM executable for DOS
  9413. # many compressed/converted COMs start with a copy loop instead of a jump
  9414. 0x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS
  9415. 0x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS
  9416. >0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed
  9417. 0x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed
  9418. # FIXME: missing diet .com compression
  9419.  
  9420. # miscellaneous formats
  9421. 0 string LZ MS-DOS executable (built-in)
  9422. #0 byte 0xf0 MS-DOS program library data
  9423. #
  9424.  
  9425. #
  9426. # Windows Registry files.
  9427. # updated by Joerg Jenderek
  9428. 0 string regf Windows NT/XP registry file
  9429. 0 string CREG Windows 95/98/ME registry file
  9430. 0 string SHCC3 Windows 3.1 registry file
  9431.  
  9432.  
  9433. # AAF files:
  9434. # <stuartc@rd.bbc.co.uk> Stuart Cunningham
  9435. 0 string \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage
  9436. >30 byte 9 (512B sectors)
  9437. >30 byte 12 (4kB sectors)
  9438. 0 string \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage
  9439. >30 byte 9 (512B sectors)
  9440. >30 byte 12 (4kB sectors)
  9441.  
  9442. # Popular applications
  9443. 2080 string Microsoft\ Word\ 6.0\ Document %s
  9444. 2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
  9445. # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
  9446. 2112 string MSWordDoc Microsoft Word document data
  9447. #
  9448. 0 belong 0x31be0000 Microsoft Word Document
  9449. #
  9450. 0 string PO^Q` Microsoft Word 6.0 Document
  9451. #
  9452. 0 string \376\067\0\043 Microsoft Office Document
  9453. 0 string \333\245-\0\0\0 Microsoft Office Document
  9454. #
  9455. 2080 string Microsoft\ Excel\ 5.0\ Worksheet %s
  9456. 2080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s
  9457. #
  9458. # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
  9459. 2114 string Biff5 Microsoft Excel 5.0 Worksheet
  9460. # Italian MS-Excel
  9461. 2121 string Biff5 Microsoft Excel 5.0 Worksheet
  9462. 0 string \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet
  9463. #
  9464. 0 belong 0x00001a00 Lotus 1-2-3
  9465. >4 belong 0x00100400 wk3 document data
  9466. >4 belong 0x02100400 wk4 document data
  9467. >4 belong 0x07800100 fm3 or fmb document data
  9468. >4 belong 0x07800000 fm3 or fmb document data
  9469. #
  9470. 0 belong 0x00000200 Lotus 1-2-3
  9471. >4 belong 0x06040600 wk1 document data
  9472. >4 belong 0x06800200 fmt document data
  9473.  
  9474. # Help files
  9475. 0 string ?_\3\0 MS Windows Help Data
  9476.  
  9477. # DeIsL1.isu what this is I don't know
  9478. 0 string \161\250\000\000\001\002 DeIsL1.isu whatever that is
  9479.  
  9480. # Winamp .avs
  9481. #0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
  9482. 0 string Nullsoft\ AVS\ Preset\ Winamp plug in
  9483.  
  9484. # Hyper terminal:
  9485. 0 string HyperTerminal\ hyperterm
  9486. >15 string 1.0\ --\ HyperTerminal\ data\ file MS-windows Hyperterminal
  9487.  
  9488. # Windows Metafont .WMF
  9489. 0 string \327\315\306\232 ms-windows metafont .wmf
  9490. 0 string \002\000\011\000 ms-windows metafont .wmf
  9491. 0 string \001\000\011\000 ms-windows metafont .wmf
  9492.  
  9493. #tz3 files whatever that is (MS Works files)
  9494. 0 string \003\001\001\004\070\001\000\000 tz3 ms-works file
  9495. 0 string \003\002\001\004\070\001\000\000 tz3 ms-works file
  9496. 0 string \003\003\001\004\070\001\000\000 tz3 ms-works file
  9497.  
  9498. # PGP sig files .sig
  9499. #0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig
  9500. 0 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
  9501. 0 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
  9502. 0 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
  9503. 0 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
  9504. 0 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
  9505. 0 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
  9506.  
  9507. # windows zips files .dmf
  9508. 0 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
  9509.  
  9510.  
  9511. # Windows help file FTG FTS
  9512. 0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache
  9513.  
  9514. # grp old windows 3.1 group files
  9515. 0 string \120\115\103\103 MS Windows 3.1 group files
  9516.  
  9517.  
  9518. # lnk files windows symlinks
  9519. 0 string \114\000\000\000\001\024\002\000\000\000\000\000\300\000\000\000\000\000\000\106 MS Windows shortcut
  9520.  
  9521. #ico files
  9522. 0 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows
  9523.  
  9524. # Windows icons (Ian Springer <ips@fpk.hp.com>)
  9525. 0 string \000\000\001\000 MS Windows icon resource
  9526. >4 byte 1 - 1 icon
  9527. >4 byte >1 - %d icons
  9528. >>6 byte >0 \b, %dx
  9529. >>>7 byte >0 \b%d
  9530. >>8 byte 0 \b, 256-colors
  9531. >>8 byte >0 \b, %d-colors
  9532.  
  9533.  
  9534. # .chr files
  9535. 0 string PK\010\010BGI Borland font
  9536. >4 string >\0 %s
  9537. # then there is a copyright notice
  9538.  
  9539.  
  9540. # .bgi files
  9541. 0 string pk\010\010BGI Borland device
  9542. >4 string >\0 %s
  9543. # then there is a copyright notice
  9544.  
  9545.  
  9546. # recycled/info the windows trash bin index
  9547. 9 string \000\000\000\030\001\000\000\000 MS Windows recycled bin info
  9548.  
  9549.  
  9550. ##### put in Either Magic/font or Magic/news
  9551. # Acroread or something files wrongly identified as G3 .pfm
  9552. # these have the form \000 \001 any? \002 \000 \000
  9553. # or \000 \001 any? \022 \000 \000
  9554. #0 string \000\001 pfm?
  9555. #>3 string \022\000\000Copyright\ yes
  9556. #>3 string \002\000\000Copyright\ yes
  9557. #>3 string >\0 oops, not a font file. Cancel that.
  9558. #it clashes with ttf files so put it lower down.
  9559.  
  9560. # From Doug Lee via a FreeBSD pr
  9561. 9 string GERBILDOC First Choice document
  9562. 9 string GERBILDB First Choice database
  9563. 9 string GERBILCLIP First Choice database
  9564. 0 string GERBIL First Choice device file
  9565. 9 string RABBITGRAPH RabbitGraph file
  9566. 0 string DCU1 Borland Delphi .DCU file
  9567. 0 string =!<spell> MKS Spell hash list (old format)
  9568. 0 string =!<spell2> MKS Spell hash list
  9569. # Too simple - MPi
  9570. #0 string AH Halo(TM) bitmapped font file
  9571. 0 lelong 0x08086b70 TurboC BGI file
  9572. 0 lelong 0x08084b50 TurboC Font file
  9573.  
  9574. # WARNING: below line conflicts with Infocom game data Z-machine 3
  9575. 0 byte 0x03 DBase 3 data file
  9576. >0x04 lelong 0 (no records)
  9577. >0x04 lelong >0 (%ld records)
  9578. 0 byte 0x83 DBase 3 data file with memo(s)
  9579. >0x04 lelong 0 (no records)
  9580. >0x04 lelong >0 (%ld records)
  9581. 0 leshort 0x0006 DBase 3 index file
  9582. 0 string PMCC Windows 3.x .GRP file
  9583. 1 string RDC-meg MegaDots
  9584. >8 byte >0x2F version %c
  9585. >9 byte >0x2F \b.%c file
  9586. 0 lelong 0x4C
  9587. >4 lelong 0x00021401 Windows shortcut file
  9588.  
  9589. # DOS EPS Binary File Header
  9590. # From: Ed Sznyter <ews@Black.Market.NET>
  9591. 0 belong 0xC5D0D3C6 DOS EPS Binary File
  9592. >4 long >0 Postscript starts at byte %d
  9593. >>8 long >0 length %d
  9594. >>>12 long >0 Metafile starts at byte %d
  9595. >>>>16 long >0 length %d
  9596. >>>20 long >0 TIFF starts at byte %d
  9597. >>>>24 long >0 length %d
  9598.  
  9599. # TNEF magic From "Joomy" <joomy@se-ed.net>
  9600. 0 leshort 0x223e9f78 TNEF
  9601.  
  9602. # HtmlHelp files (.chm)
  9603. 0 string ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data
  9604.  
  9605. # GFA-BASIC (Wolfram Kleff)
  9606. 2 string GFA-BASIC3 GFA-BASIC 3 data
  9607.  
  9608. #------------------------------------------------------------------------------
  9609. # From Stuart Caie <kyzer@4u.net> (developer of cabextract)
  9610. # Microsoft Cabinet files
  9611. 0 string MSCF\0\0\0\0 Microsoft Cabinet archive data
  9612. >8 lelong x \b, %u bytes
  9613. >28 leshort 1 \b, 1 file
  9614. >28 leshort >1 \b, %u files
  9615.  
  9616. # InstallShield Cabinet files
  9617. 0 string ISc( InstallShield Cabinet archive data
  9618. >5 byte&0xf0 =0x60 version 6,
  9619. >5 byte&0xf0 !0x60 version 4/5,
  9620. >(12.l+40) lelong x %u files
  9621.  
  9622. # Windows CE package files
  9623. 0 string MSCE\0\0\0\0 Microsoft WinCE install header
  9624. >20 lelong 0 \b, architecture-independent
  9625. >20 lelong 103 \b, Hitachi SH3
  9626. >20 lelong 104 \b, Hitachi SH4
  9627. >20 lelong 0xA11 \b, StrongARM
  9628. >20 lelong 4000 \b, MIPS R4000
  9629. >20 lelong 10003 \b, Hitachi SH3
  9630. >20 lelong 10004 \b, Hitachi SH3E
  9631. >20 lelong 10005 \b, Hitachi SH4
  9632. >20 lelong 70001 \b, ARM 7TDMI
  9633. >52 leshort 1 \b, 1 file
  9634. >52 leshort >1 \b, %u files
  9635. >56 leshort 1 \b, 1 registry entry
  9636. >56 leshort >1 \b, %u registry entries
  9637.  
  9638. # Outlook Personal Folders
  9639. 0 lelong 0x4E444221 Microsoft Outlook binary email folder
  9640. >10 leshort 0x0e (Outlook <=2002)
  9641. >10 leshort 0x17 (Outlook >=2003)
  9642.  
  9643.  
  9644. # From: Dirk Jagdmann <doj@cubic.org>
  9645. 0 lelong 0x00035f3f Windows 3.x help file
  9646.  
  9647. # Christophe Monniez
  9648. 0 string Client\ UrlCache\ MMF Microsoft Internet Explorer Cache File
  9649. >20 string >\0 Version %s
  9650. 0 string \xCF\xAD\x12\xFE Microsoft Outlook Express DBX File
  9651. >4 byte =0xC5 Message database
  9652. >4 byte =0xC6 Folder database
  9653. >4 byte =0xC7 Accounts informations
  9654. >4 byte =0x30 Offline database
  9655.  
  9656.  
  9657. # Windows Enhanced Metafile (EMF)
  9658. # See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
  9659. # for further information. Note that "0 lelong 1" should be true i.e.
  9660. # the first double word in the file should be 1. With the extended
  9661. # syntax available by some file commands you could write:
  9662. # 0 lelong 1
  9663. # &40 ulelong 0x464D4520 Windows Enhanced Metafile (EMF) image data
  9664. 40 ulelong 0x464D4520 Windows Enhanced Metafile (EMF) image data
  9665. >44 ulelong x version 0x%x.
  9666. # If the description has a length greater than zero, it exists and is
  9667. # found at offset (*64).
  9668. >64 ulelong >0 Description available at offset 0x%x
  9669. >>60 ulelong >0 (length 0x%x)
  9670. # Note it would be better to print out the description, which is found
  9671. # as below. Unfortunately the following only prints out the first couple
  9672. # of characters instead of all the "description length"
  9673. # number of characters -- indicated by the ulelong at offset 60.
  9674. >>(64.l) lestring16 >0 Description: %15.15s
  9675.  
  9676. # From: Alex Beregszaszi <alex@fsn.hu>
  9677. 0 string COWD VMWare3
  9678. >4 byte 3 disk image
  9679. >>32 lelong x (%d/
  9680. >>36 lelong x \b%d/
  9681. >>40 lelong x \b%d)
  9682. >4 byte 2 undoable disk image
  9683. >>32 string >\0 (%s)
  9684.  
  9685. 0 string VMDK VMware4 disk image
  9686. 0 string KDMV VMware4 disk image
  9687.  
  9688. #--------------------------------------------------------------------
  9689. # Qemu Emulator Images
  9690. # Lines written by Friedrich Schwittay (f.schwittay@yousable.de)
  9691. # Made by reading sources and doing trial and error on existing
  9692. # qcow files
  9693. 0 string QFI Qemu Image, Format: Qcow
  9694.  
  9695. # Uncomment the following line to display Magic (only used for debugging
  9696. # this magic number)
  9697. #>0 string x , Magic: %s
  9698.  
  9699. # There are currently 2 Versions: "1" and "2"
  9700. # I do not use Version 2 and therefor branch here
  9701. # but can assure: it works (tested on both versions)
  9702. # Also my Qemu 0.9.0 which uses this Version 2 refuses
  9703. # to start in its bios
  9704. >0x04 belong 2 , Version: 2
  9705. >0x04 belong 1 , Version: 1
  9706.  
  9707. # Using the existence of the Backing File Offset to Branch or not
  9708. # to read Backing File Information
  9709. >>0xc belong >0 , Backing File( Offset: %d
  9710. >>>(0xc.L) string >\0 , Path: %s
  9711.  
  9712. # Didnt got the Trick here how qemu stores the "Size" at this Position
  9713. # There is actually something stored but nothing makes sense
  9714. # The header in the sources talks about it
  9715. #>>>16 lelong x , Size: %d
  9716.  
  9717. # Modification time of the Backing File
  9718. # Really usefull if you want to know if your backing
  9719. # file is still usable together with this image
  9720. >>>20 bedate x , Mtime: %s )
  9721.  
  9722. # Dont know how to calculate in Magicfiles
  9723. # Also: this Information is not reliably
  9724. # stored in image-files
  9725. >>24 lelong x , Disk Size could be: %d * 256 bytes
  9726.  
  9727. 0 string QEVM QEMU's suspend to disk image
  9728.  
  9729. 0 string Bochs\ Virtual\ HD\ Image Bochs disk image,
  9730. >32 string x type %s,
  9731. >48 string x subtype %s
  9732.  
  9733. 0 lelong 0x02468ace Bochs Sparse disk image
  9734.  
  9735. # from http://filext.com by Derek M Jones <derek@knosof.co.uk>
  9736. # False positive with PPT
  9737. #0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF Microsoft Installer
  9738. 0 string \320\317\021\340\241\261\032\341 Microsoft Office Document
  9739.  
  9740. # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
  9741. # Magic type for Dell's BIOS .hdr files
  9742. # Dell's .hdr
  9743. 0 string $RBU
  9744. >23 string Dell %s system BIOS
  9745. >48 string x version %.3s
  9746.  
  9747.  
  9748. #------------------------------------------------------------------------------
  9749. # msvc: file(1) magic for msvc
  9750. # "H. Nanosecond" <aldomel@ix.netcom.com>
  9751. # Microsoft visual C
  9752. #
  9753. # I have version 1.0
  9754.  
  9755. # .aps
  9756. 0 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file
  9757.  
  9758. # .ide
  9759. #too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide
  9760. 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide
  9761.  
  9762. # .res
  9763. 0 string \000\000\000\000\040\000\000\000\377 MSVC .res
  9764. 0 string \377\003\000\377\001\000\020\020\350 MSVC .res
  9765. 0 string \377\003\000\377\001\000\060\020\350 MSVC .res
  9766.  
  9767. #.lib
  9768. 0 string \360\015\000\000 Microsoft Visual C library
  9769. 0 string \360\075\000\000 Microsoft Visual C library
  9770. 0 string \360\175\000\000 Microsoft Visual C library
  9771.  
  9772. #.pch
  9773. 0 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch
  9774.  
  9775. # .pdb
  9776. # too long 0 string Microsoft\ C/C++\ program\ database\
  9777. 0 string Microsoft\ C/C++\ MSVC program database
  9778. >18 string program\ database\
  9779. >33 string >\0 ver %s
  9780.  
  9781. #.sbr
  9782. 0 string \000\002\000\007\000 MSVC .sbr
  9783. >5 string >\0 %s
  9784.  
  9785. #.bsc
  9786. 0 string \002\000\002\001 MSVC .bsc
  9787.  
  9788. #.wsp
  9789. 0 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000
  9790. # these seem to start with the version and contain menus
  9791. # ------------------------------------------------------------------------
  9792. # mup: file(1) magic for Mup (Music Publisher) input file.
  9793. #
  9794. # From: Abel Cheung <abel (@) oaka.org>
  9795. #
  9796. # NOTE: This header is mainly proposed in the Arkkra mailing list,
  9797. # and is not a mandatory header because of old mup input file
  9798. # compatibility. Noteedit also use mup format, but is not forcing
  9799. # user to use any header as well.
  9800. #
  9801. 0 string //!Mup Mup music publication program input text
  9802. >6 string -Arkkra (Arkkra)
  9803. >>13 string -
  9804. >>>16 string .
  9805. >>>>14 string x \b, need V%.4s
  9806. >>>15 string .
  9807. >>>>14 string x \b, need V%.3s
  9808. >6 string -
  9809. >>9 string .
  9810. >>>7 string x \b, need V%.4s
  9811. >>8 string .
  9812. >>>7 string x \b, need V%.3s
  9813.  
  9814. #-----------------------------------------------------------------------------
  9815. # natinst: file(1) magic for National Instruments Code Files
  9816.  
  9817. #
  9818. # From <egamez@fcfm.buap.mx> Enrique G⮥z-Flores
  9819. # version 1
  9820. # Many formats still missing, we use, for the moment LabVIEW
  9821. # We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing
  9822. #
  9823. 0 string RSRC National Instruments,
  9824. # Check if it's a LabVIEW File
  9825. >8 string LV LabVIEW File,
  9826. # Check wich kind of file is
  9827. >>10 string SB Code Resource File, data
  9828. >>10 string IN Virtual Instrument Program, data
  9829. >>10 string AR VI Library, data
  9830. # This is for Menu Libraries
  9831. >8 string LMNULBVW Portable File Names, data
  9832. # This is for General Resources
  9833. >8 string rsc Resources File, data
  9834. # This is for VXI Package
  9835. 0 string VMAP National Instruments, VXI File, data
  9836.  
  9837. #------------------------------------------------------------------------------
  9838. # ncr: file(1) magic for NCR Tower objects
  9839. #
  9840. # contributed by
  9841. # Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa
  9842. # uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP
  9843. #
  9844. 0 beshort 000610 Tower/XP rel 2 object
  9845. >12 belong >0 not stripped
  9846. >20 beshort 0407 executable
  9847. >20 beshort 0410 pure executable
  9848. >22 beshort >0 - version %ld
  9849. 0 beshort 000615 Tower/XP rel 2 object
  9850. >12 belong >0 not stripped
  9851. >20 beshort 0407 executable
  9852. >20 beshort 0410 pure executable
  9853. >22 beshort >0 - version %ld
  9854. 0 beshort 000620 Tower/XP rel 3 object
  9855. >12 belong >0 not stripped
  9856. >20 beshort 0407 executable
  9857. >20 beshort 0410 pure executable
  9858. >22 beshort >0 - version %ld
  9859. 0 beshort 000625 Tower/XP rel 3 object
  9860. >12 belong >0 not stripped
  9861. >20 beshort 0407 executable
  9862. >20 beshort 0410 pure executable
  9863. >22 beshort >0 - version %ld
  9864. 0 beshort 000630 Tower32/600/400 68020 object
  9865. >12 belong >0 not stripped
  9866. >20 beshort 0407 executable
  9867. >20 beshort 0410 pure executable
  9868. >22 beshort >0 - version %ld
  9869. 0 beshort 000640 Tower32/800 68020
  9870. >18 beshort &020000 w/68881 object
  9871. >18 beshort &040000 compatible object
  9872. >18 beshort &060000 object
  9873. >20 beshort 0407 executable
  9874. >20 beshort 0413 pure executable
  9875. >12 belong >0 not stripped
  9876. >22 beshort >0 - version %ld
  9877. 0 beshort 000645 Tower32/800 68010
  9878. >18 beshort &040000 compatible object
  9879. >18 beshort &060000 object
  9880. >20 beshort 0407 executable
  9881. >20 beshort 0413 pure executable
  9882. >12 belong >0 not stripped
  9883. >22 beshort >0 - version %ld
  9884.  
  9885. #------------------------------------------------------------------------------
  9886. # netbsd: file(1) magic for NetBSD objects
  9887. #
  9888. # All new-style magic numbers are in network byte order.
  9889. #
  9890.  
  9891. 0 lelong 000000407 a.out NetBSD little-endian object file
  9892. >16 lelong >0 not stripped
  9893. 0 belong 000000407 a.out NetBSD big-endian object file
  9894. >16 belong >0 not stripped
  9895.  
  9896. 0 belong&0377777777 041400413 a.out NetBSD/i386 demand paged
  9897. >0 byte &0x80
  9898. >>20 lelong <4096 shared library
  9899. >>20 lelong =4096 dynamically linked executable
  9900. >>20 lelong >4096 dynamically linked executable
  9901. >0 byte ^0x80 executable
  9902. >16 lelong >0 not stripped
  9903. 0 belong&0377777777 041400410 a.out NetBSD/i386 pure
  9904. >0 byte &0x80 dynamically linked executable
  9905. >0 byte ^0x80 executable
  9906. >16 lelong >0 not stripped
  9907. 0 belong&0377777777 041400407 a.out NetBSD/i386
  9908. >0 byte &0x80 dynamically linked executable
  9909. >0 byte ^0x80
  9910. >>0 byte &0x40 position independent
  9911. >>20 lelong !0 executable
  9912. >>20 lelong =0 object file
  9913. >16 lelong >0 not stripped
  9914. 0 belong&0377777777 041400507 a.out NetBSD/i386 core
  9915. >12 string >\0 from '%s'
  9916. >32 lelong !0 (signal %d)
  9917.  
  9918. 0 belong&0377777777 041600413 a.out NetBSD/m68k demand paged
  9919. >0 byte &0x80
  9920. >>20 belong <8192 shared library
  9921. >>20 belong =8192 dynamically linked executable
  9922. >>20 belong >8192 dynamically linked executable
  9923. >0 byte ^0x80 executable
  9924. >16 belong >0 not stripped
  9925. 0 belong&0377777777 041600410 a.out NetBSD/m68k pure
  9926. >0 byte &0x80 dynamically linked executable
  9927. >0 byte ^0x80 executable
  9928. >16 belong >0 not stripped
  9929. 0 belong&0377777777 041600407 a.out NetBSD/m68k
  9930. >0 byte &0x80 dynamically linked executable
  9931. >0 byte ^0x80
  9932. >>0 byte &0x40 position independent
  9933. >>20 belong !0 executable
  9934. >>20 belong =0 object file
  9935. >16 belong >0 not stripped
  9936. 0 belong&0377777777 041600507 a.out NetBSD/m68k core
  9937. >12 string >\0 from '%s'
  9938. >32 belong !0 (signal %d)
  9939.  
  9940. 0 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged
  9941. >0 byte &0x80
  9942. >>20 belong <4096 shared library
  9943. >>20 belong =4096 dynamically linked executable
  9944. >>20 belong >4096 dynamically linked executable
  9945. >0 byte ^0x80 executable
  9946. >16 belong >0 not stripped
  9947. 0 belong&0377777777 042000410 a.out NetBSD/m68k4k pure
  9948. >0 byte &0x80 dynamically linked executable
  9949. >0 byte ^0x80 executable
  9950. >16 belong >0 not stripped
  9951. 0 belong&0377777777 042000407 a.out NetBSD/m68k4k
  9952. >0 byte &0x80 dynamically linked executable
  9953. >0 byte ^0x80
  9954. >>0 byte &0x40 position independent
  9955. >>20 belong !0 executable
  9956. >>20 belong =0 object file
  9957. >16 belong >0 not stripped
  9958. 0 belong&0377777777 042000507 a.out NetBSD/m68k4k core
  9959. >12 string >\0 from '%s'
  9960. >32 belong !0 (signal %d)
  9961.  
  9962. 0 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged
  9963. >0 byte &0x80
  9964. >>20 lelong <4096 shared library
  9965. >>20 lelong =4096 dynamically linked executable
  9966. >>20 lelong >4096 dynamically linked executable
  9967. >0 byte ^0x80 executable
  9968. >16 lelong >0 not stripped
  9969. 0 belong&0377777777 042200410 a.out NetBSD/ns32532 pure
  9970. >0 byte &0x80 dynamically linked executable
  9971. >0 byte ^0x80 executable
  9972. >16 lelong >0 not stripped
  9973. 0 belong&0377777777 042200407 a.out NetBSD/ns32532
  9974. >0 byte &0x80 dynamically linked executable
  9975. >0 byte ^0x80
  9976. >>0 byte &0x40 position independent
  9977. >>20 lelong !0 executable
  9978. >>20 lelong =0 object file
  9979. >16 lelong >0 not stripped
  9980. 0 belong&0377777777 042200507 a.out NetBSD/ns32532 core
  9981. >12 string >\0 from '%s'
  9982. >32 lelong !0 (signal %d)
  9983.  
  9984. 0 belong&0377777777 045200507 a.out NetBSD/powerpc core
  9985. >12 string >\0 from '%s'
  9986.  
  9987. 0 belong&0377777777 042400413 a.out NetBSD/sparc demand paged
  9988. >0 byte &0x80
  9989. >>20 belong <8192 shared library
  9990. >>20 belong =8192 dynamically linked executable
  9991. >>20 belong >8192 dynamically linked executable
  9992. >0 byte ^0x80 executable
  9993. >16 belong >0 not stripped
  9994. 0 belong&0377777777 042400410 a.out NetBSD/sparc pure
  9995. >0 byte &0x80 dynamically linked executable
  9996. >0 byte ^0x80 executable
  9997. >16 belong >0 not stripped
  9998. 0 belong&0377777777 042400407 a.out NetBSD/sparc
  9999. >0 byte &0x80 dynamically linked executable
  10000. >0 byte ^0x80
  10001. >>0 byte &0x40 position independent
  10002. >>20 belong !0 executable
  10003. >>20 belong =0 object file
  10004. >16 belong >0 not stripped
  10005. 0 belong&0377777777 042400507 a.out NetBSD/sparc core
  10006. >12 string >\0 from '%s'
  10007. >32 belong !0 (signal %d)
  10008.  
  10009. 0 belong&0377777777 042600413 a.out NetBSD/pmax demand paged
  10010. >0 byte &0x80
  10011. >>20 lelong <4096 shared library
  10012. >>20 lelong =4096 dynamically linked executable
  10013. >>20 lelong >4096 dynamically linked executable
  10014. >0 byte ^0x80 executable
  10015. >16 lelong >0 not stripped
  10016. 0 belong&0377777777 042600410 a.out NetBSD/pmax pure
  10017. >0 byte &0x80 dynamically linked executable
  10018. >0 byte ^0x80 executable
  10019. >16 lelong >0 not stripped
  10020. 0 belong&0377777777 042600407 a.out NetBSD/pmax
  10021. >0 byte &0x80 dynamically linked executable
  10022. >0 byte ^0x80
  10023. >>0 byte &0x40 position independent
  10024. >>20 lelong !0 executable
  10025. >>20 lelong =0 object file
  10026. >16 lelong >0 not stripped
  10027. 0 belong&0377777777 042600507 a.out NetBSD/pmax core
  10028. >12 string >\0 from '%s'
  10029. >32 lelong !0 (signal %d)
  10030.  
  10031. 0 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged
  10032. >0 byte &0x80
  10033. >>20 lelong <4096 shared library
  10034. >>20 lelong =4096 dynamically linked executable
  10035. >>20 lelong >4096 dynamically linked executable
  10036. >0 byte ^0x80 executable
  10037. >16 lelong >0 not stripped
  10038. 0 belong&0377777777 043000410 a.out NetBSD/vax 1k pure
  10039. >0 byte &0x80 dynamically linked executable
  10040. >0 byte ^0x80 executable
  10041. >16 lelong >0 not stripped
  10042. 0 belong&0377777777 043000407 a.out NetBSD/vax 1k
  10043. >0 byte &0x80 dynamically linked executable
  10044. >0 byte ^0x80
  10045. >>0 byte &0x40 position independent
  10046. >>20 lelong !0 executable
  10047. >>20 lelong =0 object file
  10048. >16 lelong >0 not stripped
  10049. 0 belong&0377777777 043000507 a.out NetBSD/vax 1k core
  10050. >12 string >\0 from '%s'
  10051. >32 lelong !0 (signal %d)
  10052.  
  10053. 0 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged
  10054. >0 byte &0x80
  10055. >>20 lelong <4096 shared library
  10056. >>20 lelong =4096 dynamically linked executable
  10057. >>20 lelong >4096 dynamically linked executable
  10058. >0 byte ^0x80 executable
  10059. >16 lelong >0 not stripped
  10060. 0 belong&0377777777 045400410 a.out NetBSD/vax 4k pure
  10061. >0 byte &0x80 dynamically linked executable
  10062. >0 byte ^0x80 executable
  10063. >16 lelong >0 not stripped
  10064. 0 belong&0377777777 045400407 a.out NetBSD/vax 4k
  10065. >0 byte &0x80 dynamically linked executable
  10066. >0 byte ^0x80
  10067. >>0 byte &0x40 position independent
  10068. >>20 lelong !0 executable
  10069. >>20 lelong =0 object file
  10070. >16 lelong >0 not stripped
  10071. 0 belong&0377777777 045400507 a.out NetBSD/vax 4k core
  10072. >12 string >\0 from '%s'
  10073. >32 lelong !0 (signal %d)
  10074.  
  10075. # NetBSD/alpha does not support (and has never supported) a.out objects,
  10076. # so no rules are provided for them. NetBSD/alpha ELF objects are
  10077. # dealt with in "elf".
  10078. 0 lelong 0x00070185 ECOFF NetBSD/alpha binary
  10079. >10 leshort 0x0001 not stripped
  10080. >10 leshort 0x0000 stripped
  10081. 0 belong&0377777777 043200507 a.out NetBSD/alpha core
  10082. >12 string >\0 from '%s'
  10083. >32 lelong !0 (signal %d)
  10084.  
  10085. 0 belong&0377777777 043400413 a.out NetBSD/mips demand paged
  10086. >0 byte &0x80
  10087. >>20 belong <8192 shared library
  10088. >>20 belong =8192 dynamically linked executable
  10089. >>20 belong >8192 dynamically linked executable
  10090. >0 byte ^0x80 executable
  10091. >16 belong >0 not stripped
  10092. 0 belong&0377777777 043400410 a.out NetBSD/mips pure
  10093. >0 byte &0x80 dynamically linked executable
  10094. >0 byte ^0x80 executable
  10095. >16 belong >0 not stripped
  10096. 0 belong&0377777777 043400407 a.out NetBSD/mips
  10097. >0 byte &0x80 dynamically linked executable
  10098. >0 byte ^0x80
  10099. >>0 byte &0x40 position independent
  10100. >>20 belong !0 executable
  10101. >>20 belong =0 object file
  10102. >16 belong >0 not stripped
  10103. 0 belong&0377777777 043400507 a.out NetBSD/mips core
  10104. >12 string >\0 from '%s'
  10105. >32 belong !0 (signal %d)
  10106.  
  10107. 0 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged
  10108. >0 byte &0x80
  10109. >>20 lelong <4096 shared library
  10110. >>20 lelong =4096 dynamically linked executable
  10111. >>20 lelong >4096 dynamically linked executable
  10112. >0 byte ^0x80 executable
  10113. >16 lelong >0 not stripped
  10114. 0 belong&0377777777 043600410 a.out NetBSD/arm32 pure
  10115. >0 byte &0x80 dynamically linked executable
  10116. >0 byte ^0x80 executable
  10117. >16 lelong >0 not stripped
  10118. 0 belong&0377777777 043600407 a.out NetBSD/arm32
  10119. >0 byte &0x80 dynamically linked executable
  10120. >0 byte ^0x80
  10121. >>0 byte &0x40 position independent
  10122. >>20 lelong !0 executable
  10123. >>20 lelong =0 object file
  10124. >16 lelong >0 not stripped
  10125. # NetBSD/arm26 has always used ELF objects, but it shares a core file
  10126. # format with NetBSD/arm32.
  10127. 0 belong&0377777777 043600507 a.out NetBSD/arm core
  10128. >12 string >\0 from '%s'
  10129. >32 lelong !0 (signal %d)
  10130.  
  10131. #------------------------------------------------------------------------------
  10132. # netscape: file(1) magic for Netscape files
  10133. # "H. Nanosecond" <aldomel@ix.netcom.com>
  10134. # version 3 and 4 I think
  10135. #
  10136.  
  10137. # Netscape Address book .nab
  10138. 0 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book
  10139.  
  10140. # Netscape Communicator address book
  10141. 0 string \000\017\102\111 Netscape Communicator address book
  10142.  
  10143. # .snm Caches
  10144. 0 string #\ Netscape\ folder\ cache Netscape folder cache
  10145. 0 string \000\036\204\220\000 Netscape folder cache
  10146. # .n2p
  10147. # Net 2 Phone
  10148. #0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
  10149. 0 string SX961999 Net2phone
  10150.  
  10151. #
  10152. #This is files ending in .art, FIXME add more rules
  10153. 0 string JG\004\016\0\0\0\0 ART
  10154.  
  10155. #------------------------------------------------------------------------------
  10156. # news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
  10157. #
  10158. 0 string StartFontMetrics ASCII font metrics
  10159. 0 string StartFont ASCII font bits
  10160. 0 belong 0x137A2944 NeWS bitmap font
  10161. 0 belong 0x137A2947 NeWS font family
  10162. 0 belong 0x137A2950 scalable OpenFont binary
  10163. 0 belong 0x137A2951 encrypted scalable OpenFont binary
  10164. 8 belong 0x137A2B45 X11/NeWS bitmap font
  10165. 8 belong 0x137A2B48 X11/NeWS font family
  10166. #------------------------------------------------------------------------------
  10167. # nitpicker: file(1) magic for Flowfiles.
  10168. # From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de
  10169. 0 string NPFF NItpicker Flow File
  10170. >4 byte x V%d.
  10171. >5 byte x %d
  10172. >6 bedate x started: %s
  10173. >10 bedate x stopped: %s
  10174. >14 belong x Bytes: %u
  10175. >18 belong x Bytes1: %u
  10176. >22 belong x Flows: %u
  10177. >26 belong x Pkts: %u
  10178.  
  10179. #------------------------------------------------------------------------------
  10180. # ocaml: file(1) magic for Objective Caml files.
  10181. 0 string Caml1999 Objective caml
  10182. >8 string X exec file
  10183. >8 string I interface file (.cmi)
  10184. >8 string O object file (.cmo)
  10185. >8 string A library file (.cma)
  10186. >8 string Y native object file (.cmx)
  10187. >8 string Z native library file (.cmxa)
  10188. >8 string M abstract syntax tree implementation file
  10189. >8 string N abstract syntax tree interface file
  10190. >9 string >\0 (Version %3.3s).
  10191. #------------------------------------------------------------------------------
  10192. # octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org>
  10193. 0 string Octave-1-L Octave binary data (little endian)
  10194. 0 string Octave-1-B Octave binary data (big endian)
  10195.  
  10196. #------------------------------------------------------------------------------
  10197. # olf: file(1) magic for OLF executables
  10198. #
  10199. # We have to check the byte order flag to see what byte order all the
  10200. # other stuff in the header is in.
  10201. #
  10202. # MIPS R3000 may also be for MIPS R2000.
  10203. # What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
  10204. #
  10205. # Created by Erik Theisen <etheisen@openbsd.org>
  10206. # Based on elf from Daniel Quinlan <quinlan@yggdrasil.com>
  10207. 0 string \177OLF OLF
  10208. >4 byte 0 invalid class
  10209. >4 byte 1 32-bit
  10210. >4 byte 2 64-bit
  10211. >7 byte 0 invalid os
  10212. >7 byte 1 OpenBSD
  10213. >7 byte 2 NetBSD
  10214. >7 byte 3 FreeBSD
  10215. >7 byte 4 4.4BSD
  10216. >7 byte 5 Linux
  10217. >7 byte 6 SVR4
  10218. >7 byte 7 esix
  10219. >7 byte 8 Solaris
  10220. >7 byte 9 Irix
  10221. >7 byte 10 SCO
  10222. >7 byte 11 Dell
  10223. >7 byte 12 NCR
  10224. >5 byte 0 invalid byte order
  10225. >5 byte 1 LSB
  10226. >>16 leshort 0 no file type,
  10227. >>16 leshort 1 relocatable,
  10228. >>16 leshort 2 executable,
  10229. >>16 leshort 3 shared object,
  10230. # Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
  10231. # corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
  10232. >>16 leshort 4 core file
  10233. >>>(0x38+0xcc) string >\0 of '%s'
  10234. >>>(0x38+0x10) lelong >0 (signal %d),
  10235. >>16 leshort &0xff00 processor-specific,
  10236. >>18 leshort 0 no machine,
  10237. >>18 leshort 1 AT&T WE32100 - invalid byte order,
  10238. >>18 leshort 2 SPARC - invalid byte order,
  10239. >>18 leshort 3 Intel 80386,
  10240. >>18 leshort 4 Motorola 68000 - invalid byte order,
  10241. >>18 leshort 5 Motorola 88000 - invalid byte order,
  10242. >>18 leshort 6 Intel 80486,
  10243. >>18 leshort 7 Intel 80860,
  10244. >>18 leshort 8 MIPS R3000_BE - invalid byte order,
  10245. >>18 leshort 9 Amdahl - invalid byte order,
  10246. >>18 leshort 10 MIPS R3000_LE,
  10247. >>18 leshort 11 RS6000 - invalid byte order,
  10248. >>18 leshort 15 PA-RISC - invalid byte order,
  10249. >>18 leshort 16 nCUBE,
  10250. >>18 leshort 17 VPP500,
  10251. >>18 leshort 18 SPARC32PLUS,
  10252. >>18 leshort 20 PowerPC,
  10253. >>18 leshort 0x9026 Alpha,
  10254. >>20 lelong 0 invalid version
  10255. >>20 lelong 1 version 1
  10256. >>36 lelong 1 MathCoPro/FPU/MAU Required
  10257. >8 string >\0 (%s)
  10258. >5 byte 2 MSB
  10259. >>16 beshort 0 no file type,
  10260. >>16 beshort 1 relocatable,
  10261. >>16 beshort 2 executable,
  10262. >>16 beshort 3 shared object,
  10263. >>16 beshort 4 core file,
  10264. >>>(0x38+0xcc) string >\0 of '%s'
  10265. >>>(0x38+0x10) belong >0 (signal %d),
  10266. >>16 beshort &0xff00 processor-specific,
  10267. >>18 beshort 0 no machine,
  10268. >>18 beshort 1 AT&T WE32100,
  10269. >>18 beshort 2 SPARC,
  10270. >>18 beshort 3 Intel 80386 - invalid byte order,
  10271. >>18 beshort 4 Motorola 68000,
  10272. >>18 beshort 5 Motorola 88000,
  10273. >>18 beshort 6 Intel 80486 - invalid byte order,
  10274. >>18 beshort 7 Intel 80860,
  10275. >>18 beshort 8 MIPS R3000_BE,
  10276. >>18 beshort 9 Amdahl,
  10277. >>18 beshort 10 MIPS R3000_LE - invalid byte order,
  10278. >>18 beshort 11 RS6000,
  10279. >>18 beshort 15 PA-RISC,
  10280. >>18 beshort 16 nCUBE,
  10281. >>18 beshort 17 VPP500,
  10282. >>18 beshort 18 SPARC32PLUS,
  10283. >>18 beshort 20 PowerPC or cisco 4500,
  10284. >>18 beshort 21 cisco 7500,
  10285. >>18 beshort 24 cisco SVIP,
  10286. >>18 beshort 25 cisco 7200,
  10287. >>18 beshort 36 cisco 12000,
  10288. >>18 beshort 0x9026 Alpha,
  10289. >>20 belong 0 invalid version
  10290. >>20 belong 1 version 1
  10291. >>36 belong 1 MathCoPro/FPU/MAU Required
  10292.  
  10293. #------------------------------------------------------------------------------
  10294. # os2: file(1) magic for OS/2 files
  10295. #
  10296.  
  10297. # Provided 1998/08/22 by
  10298. # David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
  10299. 1 string InternetShortcut MS Windows 95 Internet shortcut text
  10300. >24 string >\ (URL=<%s>)
  10301.  
  10302. # OS/2 URL objects
  10303. # Provided 1998/08/22 by
  10304. # David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
  10305. #0 string http: OS/2 URL object text
  10306. #>5 string >\ (WWW) <http:%s>
  10307. #0 string mailto: OS/2 URL object text
  10308. #>7 string >\ (email) <%s>
  10309. #0 string news: OS/2 URL object text
  10310. #>5 string >\ (Usenet) <%s>
  10311. #0 string ftp: OS/2 URL object text
  10312. #>4 string >\ (FTP) <ftp:%s>
  10313. #0 string file: OS/2 URL object text
  10314. #>5 string >\ (Local file) <%s>
  10315.  
  10316. # >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com)
  10317. # Carl Hauser (chauser.parc@xerox.com) and
  10318. # Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
  10319. # list the following header format in inf02a.doc:
  10320. #
  10321. # int16 ID; // ID magic word (5348h = "HS")
  10322. # int8 unknown1; // unknown purpose, could be third letter of ID
  10323. # int8 flags; // probably a flag word...
  10324. # // bit 0: set if INF style file
  10325. # // bit 4: set if HLP style file
  10326. # // patching this byte allows reading HLP files
  10327. # // using the VIEW command, while help files
  10328. # // seem to work with INF settings here as well.
  10329. # int16 hdrsize; // total size of header
  10330. # int16 unknown2; // unknown purpose
  10331. #
  10332. 0 string HSP\x01\x9b\x00 OS/2 INF
  10333. >107 string >0 (%s)
  10334. 0 string HSP\x10\x9b\x00 OS/2 HLP
  10335. >107 string >0 (%s)
  10336.  
  10337. # OS/2 INI (this is a guess)
  10338. 0 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI
  10339. #------------------------------------------------------------------------------
  10340. # os400: file(1) magic for IBM OS/400 files
  10341. #
  10342. # IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com
  10343. # In spite of its quite variable format (due to internal memory page
  10344. # length differences between CISC and RISC versions of the OS) the
  10345. # SAVF structure hasn't suitable offsets to identify the catalog
  10346. # header in the first descriptor where there are some useful infos,
  10347. # so we must search in a somewhat large area for a particular string
  10348. # that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore
  10349. # descriptor space) preceded by a two byte constant.
  10350. #
  10351. 1090 search/7393 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data
  10352. >&212 byte 0x01 \b, created with SAVOBJ
  10353. >&212 byte 0x02 \b, created with SAVLIB
  10354. >&212 byte 0x07 \b, created with SAVCFG
  10355. >&212 byte 0x08 \b, created with SAVSECDTA
  10356. >&212 byte 0x0A \b, created with SAVSECDTA
  10357. >&212 byte 0x0B \b, created with SAVDLO
  10358. >&212 byte 0x0D \b, created with SAVLICPGM
  10359. >&212 byte 0x11 \b, created with SAVCHGOBJ
  10360. >&213 byte 0x44 \b, at least V5R4 to open
  10361. >&213 byte 0x43 \b, at least V5R3 to open
  10362. >&213 byte 0x42 \b, at least V5R2 to open
  10363. >&213 byte 0x41 \b, at least V5R1 to open
  10364. >&213 byte 0x40 \b, at least V4R5 to open
  10365. >&213 byte 0x3F \b, at least V4R4 to open
  10366. >&213 byte 0x3E \b, at least V4R3 to open
  10367. >&213 byte 0x3C \b, at least V4R2 to open
  10368. >&213 byte 0x3D \b, at least V4R1M4 to open
  10369. >&213 byte 0x3B \b, at least V4R1 to open
  10370. >&213 byte 0x3A \b, at least V3R7 to open
  10371. >&213 byte 0x35 \b, at least V3R6 to open
  10372. >&213 byte 0x36 \b, at least V3R2 to open
  10373. >&213 byte 0x34 \b, at least V3R1 to open
  10374. >&213 byte 0x31 \b, at least V3R0M5 to open
  10375. >&213 byte 0x30 \b, at least V2R3 to open
  10376. #
  10377. # Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
  10378. #
  10379. # Redistribution and use in source and binary forms, with or without
  10380. # modification, are permitted provided that the following conditions
  10381. # are met:
  10382. # 1. Redistributions of source code must retain the above copyright
  10383. # notice, this list of conditions and the following disclaimer.
  10384. # 2. Redistributions in binary form must reproduce the above copyright
  10385. # notice, this list of conditions and the following disclaimer in the
  10386. # documentation and/or other materials provided with the distribution.
  10387. # 3. All advertising materials mentioning features or use of this software
  10388. # must display the following acknowledgement:
  10389. # This product includes software developed by Ignatios Souvatzis for
  10390. # the NetBSD project.
  10391. # 4. The name of the author may not be used to endorse or promote products
  10392. # derived from this software without specific prior written permission.
  10393. #
  10394. #
  10395. # THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  10396. # IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  10397. # OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  10398. # IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  10399. # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  10400. # PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
  10401. # OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
  10402. # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
  10403. # OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
  10404. # ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  10405. #
  10406. #
  10407. #
  10408. # OS9/6809 module descriptions:
  10409. #
  10410. 0 beshort 0x87CD OS9/6809 module:
  10411. #
  10412. >6 byte&0x0f 0x00 non-executable
  10413. >6 byte&0x0f 0x01 machine language
  10414. >6 byte&0x0f 0x02 BASIC I-code
  10415. >6 byte&0x0f 0x03 Pascal P-code
  10416. >6 byte&0x0f 0x04 C I-code
  10417. >6 byte&0x0f 0x05 COBOL I-code
  10418. >6 byte&0x0f 0x06 Fortran I-code
  10419. #
  10420. >6 byte&0xf0 0x10 program executable
  10421. >6 byte&0xf0 0x20 subroutine
  10422. >6 byte&0xf0 0x30 multi-module
  10423. >6 byte&0xf0 0x40 data module
  10424. #
  10425. >6 byte&0xf0 0xC0 system module
  10426. >6 byte&0xf0 0xD0 file manager
  10427. >6 byte&0xf0 0xE0 device driver
  10428. >6 byte&0xf0 0xF0 device descriptor
  10429. #
  10430. # OS9/m68k stuff (to be continued)
  10431. #
  10432. 0 beshort 0x4AFC OS9/68K module:
  10433. #
  10434. # attr
  10435. >0x14 byte&0x80 0x80 re-entrant
  10436. >0x14 byte&0x40 0x40 ghost
  10437. >0x14 byte&0x20 0x20 system-state
  10438. #
  10439. # lang:
  10440. #
  10441. >0x13 byte 1 machine language
  10442. >0x13 byte 2 BASIC I-code
  10443. >0x13 byte 3 Pascal P-code
  10444. >0x13 byte 4 C I-code
  10445. >0x13 byte 5 COBOL I-code
  10446. >0x13 byte 6 Fortran I-code
  10447. #
  10448. #
  10449. # type:
  10450. #
  10451. >0x12 byte 1 program executable
  10452. >0x12 byte 2 subroutine
  10453. >0x12 byte 3 multi-module
  10454. >0x12 byte 4 data module
  10455. >0x12 byte 11 trap library
  10456. >0x12 byte 12 system module
  10457. >0x12 byte 13 file manager
  10458. >0x12 byte 14 device driver
  10459. >0x12 byte 15 device descriptor
  10460. #
  10461. # Mach magic number info
  10462. #
  10463. 0 long 0xefbe OSF/Rose object
  10464. # I386 magic number info
  10465. #
  10466. 0 short 0565 i386 COFF object
  10467.  
  10468. #------------------------------------------------------------------------------
  10469. # palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
  10470. #
  10471. # Brian Lalor <blalor@hcirisc.cs.binghamton.edu>
  10472.  
  10473. # appl
  10474. 60 belong 0x6170706c PalmOS application
  10475. >0 string >\0 "%s"
  10476. # TEXt
  10477. 60 belong 0x54455874 AportisDoc file
  10478. >0 string >\0 "%s"
  10479. # HACK
  10480. 60 belong 0x4841434b HackMaster hack
  10481. >0 string >\0 "%s"
  10482.  
  10483. # Variety of PalmOS document types
  10484. # Michael-John Turner <mj@debian.org>
  10485. # Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType
  10486. 60 string BVokBDIC BDicty PalmOS document
  10487. >0 string >\0 "%s"
  10488. 60 string DB99DBOS DB PalmOS document
  10489. >0 string >\0 "%s"
  10490. 60 string vIMGView FireViewer/ImageViewer PalmOS document
  10491. >0 string >\0 "%s"
  10492. 60 string PmDBPmDB HanDBase PalmOS document
  10493. >0 string >\0 "%s"
  10494. 60 string InfoINDB InfoView PalmOS document
  10495. >0 string >\0 "%s"
  10496. 60 string ToGoToGo iSilo PalmOS document
  10497. >0 string >\0 "%s"
  10498. 60 string JfDbJBas JFile PalmOS document
  10499. >0 string >\0 "%s"
  10500. 60 string JfDbJFil JFile Pro PalmOS document
  10501. >0 string >\0 "%s"
  10502. 60 string DATALSdb List PalmOS document
  10503. >0 string >\0 "%s"
  10504. 60 string Mdb1Mdb1 MobileDB PalmOS document
  10505. >0 string >\0 "%s"
  10506. 60 string PNRdPPrs PeanutPress PalmOS document
  10507. >0 string >\0 "%s"
  10508. 60 string DataPlkr Plucker PalmOS document
  10509. >0 string >\0 "%s"
  10510. 60 string DataSprd QuickSheet PalmOS document
  10511. >0 string >\0 "%s"
  10512. 60 string SM01SMem SuperMemo PalmOS document
  10513. >0 string >\0 "%s"
  10514. 60 string DataTlPt TealDoc PalmOS document
  10515. >0 string >\0 "%s"
  10516. 60 string InfoTlIf TealInfo PalmOS document
  10517. >0 string >\0 "%s"
  10518. 60 string DataTlMl TealMeal PalmOS document
  10519. >0 string >\0 "%s"
  10520. 60 string DataTlPt TealPaint PalmOS document
  10521. >0 string >\0 "%s"
  10522. 60 string dataTDBP ThinkDB PalmOS document
  10523. >0 string >\0 "%s"
  10524. 60 string TdatTide Tides PalmOS document
  10525. >0 string >\0 "%s"
  10526. 60 string ToRaTRPW TomeRaider PalmOS document
  10527. >0 string >\0 "%s"
  10528.  
  10529. # A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net)
  10530. # For version 1.xx zTXTs, outputs version and numbers of bookmarks and
  10531. # annotations.
  10532. # For other versions, just outputs version.
  10533. #
  10534. 60 string zTXT A GutenPalm zTXT e-book
  10535. >0 string >\0 "%s"
  10536. >(0x4E.L) byte 0
  10537. >>(0x4E.L+1) byte x (v0.%02d)
  10538. >(0x4E.L) byte 1
  10539. >>(0x4E.L+1) byte x (v1.%02d)
  10540. >>>(0x4E.L+10) beshort >0
  10541. >>>>(0x4E.L+10) beshort <2 - 1 bookmark
  10542. >>>>(0x4E.L+10) beshort >1 - %d bookmarks
  10543. >>>(0x4E.L+14) beshort >0
  10544. >>>>(0x4E.L+14) beshort <2 - 1 annotation
  10545. >>>>(0x4E.L+14) beshort >1 - %d annotations
  10546. >(0x4E.L) byte >1 (v%d.
  10547. >>(0x4E.L+1) byte x %02d)
  10548.  
  10549. # Palm OS .prc file types
  10550. 60 string libr Palm OS dynamic library data
  10551. >0 string >\0 "%s"
  10552. 60 string ptch Palm OS operating system patch data
  10553. >0 string >\0 "%s"
  10554.  
  10555. # Mobipocket (www.mobipocket.com), donated by Carl Witty
  10556. 60 string BOOKMOBI Mobipocket E-book
  10557. >0 string >\0 "%s"
  10558.  
  10559. #------------------------------------------------------------------------------
  10560. #
  10561. # Parix COFF executables
  10562. # From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de>
  10563. #
  10564. 0 beshort&0xfff 0xACE PARIX
  10565. >0 byte&0xf0 0x80 T800
  10566. >0 byte&0xf0 0x90 T9000
  10567. >19 byte&0x02 0x02 executable
  10568. >19 byte&0x02 0x00 object
  10569. >19 byte&0x0c 0x00 not stripped
  10570.  
  10571. #------------------------------------------------------------------------------
  10572. # pbm: file(1) magic for Portable Bitmap files
  10573. #
  10574. # XXX - byte order?
  10575. #
  10576. 0 short 0x2a17 "compact bitmap" format (Poskanzer)
  10577. #------------------------------------------------------------------------------
  10578. # pdf: file(1) magic for Portable Document Format
  10579. #
  10580.  
  10581. 0 string %PDF- PDF document
  10582. >5 byte x \b, version %c
  10583. >7 byte x \b.%c
  10584.  
  10585. # From: Nick Schmalenberger <nick@schmalenberger.us>
  10586. # Forms Data Format
  10587. 0 string %FDF- FDF text
  10588. >5 byte x \b, version %c
  10589. >7 byte x \b.%c
  10590.  
  10591. #------------------------------------------------------------------------------
  10592. # pdp: file(1) magic for PDP-11 executable/object and APL workspace
  10593. #
  10594. 0 lelong 0101555 PDP-11 single precision APL workspace
  10595. 0 lelong 0101554 PDP-11 double precision APL workspace
  10596. #
  10597. # PDP-11 a.out
  10598. #
  10599. 0 leshort 0407 PDP-11 executable
  10600. >8 leshort >0 not stripped
  10601. >15 byte >0 - version %ld
  10602.  
  10603. 0 leshort 0401 PDP-11 UNIX/RT ldp
  10604. 0 leshort 0405 PDP-11 old overlay
  10605.  
  10606. 0 leshort 0410 PDP-11 pure executable
  10607. >8 leshort >0 not stripped
  10608. >15 byte >0 - version %ld
  10609.  
  10610. 0 leshort 0411 PDP-11 separate I&D executable
  10611. >8 leshort >0 not stripped
  10612. >15 byte >0 - version %ld
  10613.  
  10614. 0 leshort 0437 PDP-11 kernel overlay
  10615.  
  10616. # These last three are derived from 2.11BSD file(1)
  10617. 0 leshort 0413 PDP-11 demand-paged pure executable
  10618. >8 leshort >0 not stripped
  10619.  
  10620. 0 leshort 0430 PDP-11 overlaid pure executable
  10621. >8 leshort >0 not stripped
  10622.  
  10623. 0 leshort 0431 PDP-11 overlaid separate executable
  10624. >8 leshort >0 not stripped
  10625.  
  10626. #------------------------------------------------------------------------------
  10627. # perl: file(1) magic for Larry Wall's perl language.
  10628. #
  10629. # The ``eval'' line recognizes an outrageously clever hack for USG systems.
  10630. # Keith Waclena <keith@cerberus.uchicago.edu>
  10631. # Send additions to <perl5-porters@perl.org>
  10632. 0 string/b #!\ /bin/perl perl script text executable
  10633. 0 string eval\ "exec\ /bin/perl perl script text
  10634. 0 string/b #!\ /usr/bin/perl perl script text executable
  10635. 0 string eval\ "exec\ /usr/bin/perl perl script text
  10636. 0 string/b #!\ /usr/local/bin/perl perl script text
  10637. 0 string eval\ "exec\ /usr/local/bin/perl perl script text executable
  10638. 0 string eval\ '(exit\ $?0)'\ &&\ eval\ 'exec perl script text
  10639.  
  10640.  
  10641. # by Dmitry V. Levin and Alexey Tourbin
  10642. # check the first line
  10643. 0 string package
  10644. >1 regex \^package[\ \t]+[A-Za-z_]
  10645. >>1 regex \^package[\ \t]+[0-9A-Za-z_:]*\ *; Perl5 module source text
  10646. # not 'p', check other lines
  10647. 0 byte !0x70
  10648. >0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *;
  10649. >>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text
  10650.  
  10651.  
  10652.  
  10653. # Perl POD documents
  10654. # From: Tom Hukins <tom@eborcom.com>
  10655. 0 string/B \=pod\n Perl POD document
  10656. 0 string/B \n\=pod\n Perl POD document
  10657. 0 string/B \=head1\ Perl POD document
  10658. 0 string/B \n\=head1\ Perl POD document
  10659. 0 string/B \=head2\ Perl POD document
  10660. 0 string/B \n\=head2\ Perl POD document
  10661.  
  10662. # Perl Storable data files.
  10663. 0 string perl-store perl Storable(v0.6) data
  10664. >4 byte >0 (net-order %d)
  10665. >>4 byte &01 (network-ordered)
  10666. >>4 byte =3 (major 1)
  10667. >>4 byte =2 (major 1)
  10668.  
  10669. 0 string pst0 perl Storable(v0.7) data
  10670. >4 byte >0
  10671. >>4 byte &01 (network-ordered)
  10672. >>4 byte =5 (major 2)
  10673. >>4 byte =4 (major 2)
  10674. >>5 byte >0 (minor %d)
  10675.  
  10676. #------------------------------------------------------------------------------
  10677. # pgp: file(1) magic for Pretty Good Privacy
  10678. #
  10679. 0 beshort 0x9900 PGP key public ring
  10680. 0 beshort 0x9501 PGP key security ring
  10681. 0 beshort 0x9500 PGP key security ring
  10682. 0 beshort 0xa600 PGP encrypted data
  10683. 0 string -----BEGIN\040PGP PGP armored data
  10684. >15 string PUBLIC\040KEY\040BLOCK- public key block
  10685. >15 string MESSAGE- message
  10686. >15 string SIGNED\040MESSAGE- signed message
  10687. >15 string PGP\040SIGNATURE- signature
  10688.  
  10689. #------------------------------------------------------------------------------
  10690. # pkgadd: file(1) magic for SysV R4 PKG Datastreams
  10691. #
  10692. 0 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4)
  10693.  
  10694. #------------------------------------------------------------------------------
  10695. # plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables
  10696. # From: "Stefan A. Haubenthal" <polluks@web.de>
  10697. #
  10698. 0 belong 0x00000107 Plan 9 executable, Motorola 68k
  10699. 0 belong 0x000001EB Plan 9 executable, Intel 386
  10700. 0 belong 0x00000247 Plan 9 executable, Intel 960
  10701. 0 belong 0x000002AB Plan 9 executable, SPARC
  10702. 0 belong 0x00000407 Plan 9 executable, MIPS R3000
  10703. 0 belong 0x0000048B Plan 9 executable, AT&T DSP 3210
  10704. 0 belong 0x00000517 Plan 9 executable, MIPS R4000 BE
  10705. 0 belong 0x000005AB Plan 9 executable, AMD 29000
  10706. 0 belong 0x00000647 Plan 9 executable, ARM 7-something
  10707. 0 belong 0x000006EB Plan 9 executable, PowerPC
  10708. 0 belong 0x00000797 Plan 9 executable, MIPS R4000 LE
  10709. 0 belong 0x0000084B Plan 9 executable, DEC Alpha
  10710.  
  10711. #------------------------------------------------------------------------------
  10712. # plus5: file(1) magic for Plus Five's UNIX MUMPS
  10713. #
  10714. # XXX - byte order? Paging Hokey....
  10715. #
  10716. 0 short 0x259 mumps avl global
  10717. >2 byte >0 (V%d)
  10718. >6 byte >0 with %d byte name
  10719. >7 byte >0 and %d byte data cells
  10720. 0 short 0x25a mumps blt global
  10721. >2 byte >0 (V%d)
  10722. >8 short >0 - %d byte blocks
  10723. >15 byte 0x00 - P/D format
  10724. >15 byte 0x01 - P/K/D format
  10725. >15 byte 0x02 - K/D format
  10726. >15 byte >0x02 - Bad Flags
  10727.  
  10728. #------------------------------------------------------------------------------
  10729. # printer: file(1) magic for printer-formatted files
  10730. #
  10731.  
  10732. # PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
  10733. 0 string %! PostScript document text
  10734. >2 string PS-Adobe- conforming
  10735. >>11 string >\0 at level %.3s
  10736. >>>15 string EPS - type %s
  10737. >>>15 string Query - type %s
  10738. >>>15 string ExitServer - type %s
  10739. # Some PCs have the annoying habit of adding a ^D as a document separator
  10740. 0 string \004%! PostScript document text
  10741. >3 string PS-Adobe- conforming
  10742. >>12 string >\0 at level %.3s
  10743. >>>16 string EPS - type %s
  10744. >>>16 string Query - type %s
  10745. >>>16 string ExitServer - type %s
  10746. 0 string \033%-12345X%!PS PostScript document
  10747.  
  10748.  
  10749. # DOS EPS Binary File Header
  10750. # From: Ed Sznyter <ews@Black.Market.NET>
  10751. 0 belong 0xC5D0D3C6 DOS EPS Binary File
  10752. >4 long >0 Postscript starts at byte %d
  10753. >>8 long >0 length %d
  10754. >>>12 long >0 Metafile starts at byte %d
  10755. >>>>16 long >0 length %d
  10756. >>>20 long >0 TIFF starts at byte %d
  10757. >>>>24 long >0 length %d
  10758.  
  10759. # Adobe's PostScript Printer Description (PPD) files
  10760. # Yves Arrouye <arrouye@marin.fdn.fr>
  10761. #
  10762. 0 string *PPD-Adobe: PPD file
  10763. >13 string x \b, ve
  10764.  
  10765. # HP Printer Job Language
  10766. 0 string \033%-12345X@PJL HP Printer Job Language data
  10767. # HP Printer Job Language
  10768. # The header found on Win95 HP plot files is the "Silliest Thing possible"
  10769. # (TM)
  10770. # Every driver puts the language at some random position, with random case
  10771. # (LANGUAGE and Language)
  10772. # For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
  10773. # From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
  10774. #
  10775. 0 string \033%-12345X@PJL HP Printer Job Language data
  10776. >&0 string >\0 %s
  10777. >>&0 string >\0 %s
  10778. >>>&0 string >\0 %s
  10779. >>>>&0 string >\0 %s
  10780. #>15 string \ ENTER\ LANGUAGE\ =
  10781. #>31 string PostScript PostScript
  10782.  
  10783. # HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
  10784. 0 string \033E\033 HP PCL printer data
  10785. >3 string \&l0A - default page size
  10786. >3 string \&l1A - US executive page size
  10787. >3 string \&l2A - US letter page size
  10788. >3 string \&l3A - US legal page size
  10789. >3 string \&l26A - A4 page size
  10790. >3 string \&l80A - Monarch envelope size
  10791. >3 string \&l81A - No. 10 envelope size
  10792. >3 string \&l90A - Intl. DL envelope size
  10793. >3 string \&l91A - Intl. C5 envelope size
  10794. >3 string \&l100A - Intl. B5 envelope size
  10795. >3 string \&l-81A - No. 10 envelope size (landscape)
  10796. >3 string \&l-90A - Intl. DL envelope size (landscape)
  10797.  
  10798. # IMAGEN printer-ready files:
  10799. 0 string @document( Imagen printer
  10800. # this only works if "language xxx" is first item in Imagen header.
  10801. >10 string language\ impress (imPRESS data)
  10802. >10 string language\ daisy (daisywheel text)
  10803. >10 string language\ diablo (daisywheel text)
  10804. >10 string language\ printer (line printer emulation)
  10805. >10 string language\ tektronix (Tektronix 4014 emulation)
  10806. # Add any other languages that your Imagen uses - remember
  10807. # to keep the word `text' if the file is human-readable.
  10808. # [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)]
  10809. #
  10810. # Now magic for IMAGEN font files...
  10811. 0 string Rast RST-format raster font data
  10812. >45 string >0 face %s
  10813. # From Jukka Ukkonen
  10814. 0 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data
  10815.  
  10816. # From <mike@flyn.org>
  10817. # These are the /etc/magic entries to decode data sent to an Epson printer.
  10818. 0 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data
  10819.  
  10820.  
  10821. #------------------------------------------------------------------------------
  10822. # zenographics: file(1) magic for Zenographics ZjStream printer data
  10823. # Rick Richardson rickr@mn.rr.com
  10824. 0 string JZJZ
  10825. >0x12 string ZZ Zenographics ZjStream printer data (big-endian)
  10826. 0 string ZJZJ
  10827. >0x12 string ZZ Zenographics ZjStream printer data (little-endian)
  10828.  
  10829.  
  10830. #------------------------------------------------------------------------------
  10831. # Oak Technologies printer stream
  10832. # Rick Richardson <rickr@mn.rr.com>
  10833. 0 string OAK
  10834. >0x07 byte 0
  10835. >0x0b byte 0 Oak Technologies printer stream
  10836.  
  10837. # This would otherwise be recognized as PostScript - nick@debian.org
  10838. 0 string %!VMF SunClock's Vector Map Format data
  10839.  
  10840. #------------------------------------------------------------------------------
  10841. # HP LaserJet 1000 series downloadable firmware file
  10842. 0 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware
  10843.  
  10844. # From: Paolo <oopla@users.sf.net>
  10845. # Epson ESC/Page, ESC/PageColor
  10846. 0 string \x1b\x01@EJL Epson ESC/Page language printer data
  10847.  
  10848. #------------------------------------------------------------------------------
  10849. # project: file(1) magic for Project management
  10850. #
  10851. # Magic strings for ftnchek project files. Alexander Mai
  10852. 0 string FTNCHEK_\ P project file for ftnchek
  10853. >10 string 1 version 2.7
  10854. >10 string 2 version 2.8 to 2.10
  10855. >10 string 3 version 2.11 or later
  10856.  
  10857. #------------------------------------------------------------------------------
  10858. # psdbms: file(1) magic for psdatabase
  10859. #
  10860. 0 belong&0xff00ffff 0x56000000 ps database
  10861. >1 string >\0 version %s
  10862. >4 string >\0 from kernel %s
  10863.  
  10864. #------------------------------------------------------------------------------
  10865. # psion: file(1) magic for Psion handhelds data
  10866. # from: Peter Breitenlohner <peb@mppmu.mpg.de>
  10867. #
  10868. 0 lelong 0x10000037 Psion Series 5
  10869. >4 lelong 0x10000039 font file
  10870. >4 lelong 0x1000003A printer driver
  10871. >4 lelong 0x1000003B clipboard
  10872. >4 lelong 0x10000042 multi-bitmap image
  10873. >4 lelong 0x1000006A application information file
  10874. >4 lelong 0x1000006D
  10875. >>8 lelong 0x1000007D sketch image
  10876. >>8 lelong 0x1000007E voice note
  10877. >>8 lelong 0x1000007F word file
  10878. >>8 lelong 0x10000085 OPL program
  10879. >>8 lelong 0x10000088 sheet file
  10880. >>8 lelong 0x100001C4 EasyFax initialisation file
  10881. >4 lelong 0x10000073 OPO module
  10882. >4 lelong 0x10000074 OPL application
  10883. >4 lelong 0x1000008A exported multi-bitmap image
  10884.  
  10885. 0 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image
  10886.  
  10887. 0 lelong 0x10000050 Psion Series 5
  10888. >4 lelong 0x1000006D database
  10889. >4 lelong 0x100000E4 ini file
  10890.  
  10891. 0 lelong 0x10000079 Psion Series 5 binary:
  10892. >4 lelong 0x00000000 DLL
  10893. >4 lelong 0x10000049 comms hardware library
  10894. >4 lelong 0x1000004A comms protocol library
  10895. >4 lelong 0x1000005D OPX
  10896. >4 lelong 0x1000006C application
  10897. >4 lelong 0x1000008D DLL
  10898. >4 lelong 0x100000AC logical device driver
  10899. >4 lelong 0x100000AD physical device driver
  10900. >4 lelong 0x100000E5 file transfer protocol
  10901. >4 lelong 0x100000E5 file transfer protocol
  10902. >4 lelong 0x10000140 printer definition
  10903. >4 lelong 0x10000141 printer definition
  10904.  
  10905. 0 lelong 0x1000007A Psion Series 5 executable
  10906.  
  10907. #------------------------------------------------------------------------------
  10908. # pulsar: file(1) magic for Pulsar POP3 daemon binary files
  10909. #
  10910. # http://pulsar.sourceforge.net
  10911. # mailto:rok.papez@lugos.si
  10912. #
  10913.  
  10914. 0 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file.
  10915. >4 ubelong x Version: %d.
  10916. >8 ubelong x \b%d
  10917.  
  10918.  
  10919. #------------------------------------------------------------------------------
  10920. # pyramid: file(1) magic for Pyramids
  10921. #
  10922. # XXX - byte order?
  10923. #
  10924. 0 long 0x50900107 Pyramid 90x family executable
  10925. 0 long 0x50900108 Pyramid 90x family pure executable
  10926. >16 long >0 not stripped
  10927. 0 long 0x5090010b Pyramid 90x family demand paged pure executable
  10928. >16 long >0 not stripped
  10929.  
  10930. #------------------------------------------------------------------------------
  10931. # python: file(1) magic for python
  10932. #
  10933. # From: David Necas <yeti@physics.muni.cz>
  10934. # often the module starts with a multiline string
  10935. 0 string """ a python script text executable
  10936. # MAGIC as specified in Python/import.c (1.5 to 2.3.0a)
  10937. # 20121 ( YEAR - 1995 ) + MONTH + DAY (little endian followed by "\r\n"
  10938. 0 belong 0x994e0d0a python 1.5/1.6 byte-compiled
  10939. 0 belong 0x87c60d0a python 2.0 byte-compiled
  10940. 0 belong 0x2aeb0d0a python 2.1 byte-compiled
  10941. 0 belong 0x2ded0d0a python 2.2 byte-compiled
  10942. 0 belong 0x3bf20d0a python 2.3 byte-compiled
  10943. 0 belong 0x6df20d0a python 2.4 byte-compiled
  10944. 0 belong 0xb3f20d0a python 2.5 byte-compiled
  10945.  
  10946. 0 string/b #!\ /usr/bin/python python script text executable
  10947.  
  10948.  
  10949. #------------------------------------------------------------------------------
  10950. # file(1) magic for revision control files
  10951. # From Hendrik Scholz <hendrik@scholz.net>
  10952. 0 string /1\ :pserver: cvs password text file
  10953.  
  10954. # Conary changesets
  10955. # From: Jonathan Smith <smithj@rpath.com>
  10956. 0 belong 0xea3f81bb Conary changeset data
  10957.  
  10958. #------------------------------------------------------------------------------
  10959. # riff: file(1) magic for RIFF format
  10960. # See
  10961. #
  10962. # http://www.seanet.com/users/matts/riffmci/riffmci.htm
  10963. #
  10964. # AVI section extended by Patrik R業an <patrik+file-magic@iki.fi>
  10965. #
  10966. 0 string RIFF RIFF (little-endian) data
  10967. # RIFF Palette format
  10968. >8 string PAL \b, palette
  10969. >>16 leshort x \b, version %d
  10970. >>18 leshort x \b, %d entries
  10971. # RIFF Device Independent Bitmap format
  10972. >8 string RDIB \b, device-independent bitmap
  10973. >>16 string BM
  10974. >>>30 leshort 12 \b, OS/2 1.x format
  10975. >>>>34 leshort x \b, %d x
  10976. >>>>36 leshort x %d
  10977. >>>30 leshort 64 \b, OS/2 2.x format
  10978. >>>>34 leshort x \b, %d x
  10979. >>>>36 leshort x %d
  10980. >>>30 leshort 40 \b, Windows 3.x format
  10981. >>>>34 lelong x \b, %d x
  10982. >>>>38 lelong x %d x
  10983. >>>>44 leshort x %d
  10984. # RIFF MIDI format
  10985. >8 string RMID \b, MIDI
  10986. # RIFF Multimedia Movie File format
  10987. >8 string RMMP \b, multimedia movie
  10988. # RIFF wrapper for MP3
  10989. >8 string RMP3 \b, MPEG Layer 3 audio
  10990. # Microsoft WAVE format (*.wav)
  10991. >8 string WAVE \b, WAVE audio
  10992. >>20 leshort 1 \b, Microsoft PCM
  10993. >>>34 leshort >0 \b, %d bit
  10994. >>20 leshort 2 \b, Microsoft ADPCM
  10995. >>20 leshort 6 \b, ITU G.711 A-law
  10996. >>20 leshort 7 \b, ITU G.711 mu-law
  10997. >>20 leshort 17 \b, IMA ADPCM
  10998. >>20 leshort 20 \b, ITU G.723 ADPCM (Yamaha)
  10999. >>20 leshort 49 \b, GSM 6.10
  11000. >>20 leshort 64 \b, ITU G.721 ADPCM
  11001. >>20 leshort 80 \b, MPEG
  11002. >>20 leshort 85 \b, MPEG Layer 3
  11003. >>22 leshort =1 \b, mono
  11004. >>22 leshort =2 \b, stereo
  11005. >>22 leshort >2 \b, %d channels
  11006. >>24 lelong >0 %d Hz
  11007. # Corel Draw Picture
  11008. >8 string CDRA \b, Corel Draw Picture
  11009. # AVI == Audio Video Interleave
  11010. >8 string AVI\040 \b, AVI
  11011. >>12 string LIST
  11012. >>>20 string hdrlavih
  11013. >>>>&36 lelong x \b, %lu x
  11014. >>>>&40 lelong x %lu,
  11015. >>>>&4 lelong >1000000 <1 fps,
  11016. >>>>&4 lelong 1000000 1.00 fps,
  11017. >>>>&4 lelong 500000 2.00 fps,
  11018. >>>>&4 lelong 333333 3.00 fps,
  11019. >>>>&4 lelong 250000 4.00 fps,
  11020. >>>>&4 lelong 200000 5.00 fps,
  11021. >>>>&4 lelong 166667 6.00 fps,
  11022. >>>>&4 lelong 142857 7.00 fps,
  11023. >>>>&4 lelong 125000 8.00 fps,
  11024. >>>>&4 lelong 111111 9.00 fps,
  11025. >>>>&4 lelong 100000 10.00 fps,
  11026. # ]9.9,10.1[
  11027. >>>>&4 lelong <101010
  11028. >>>>>&-4 lelong >99010
  11029. >>>>>>&-4 lelong !100000 ~10 fps,
  11030. >>>>&4 lelong 83333 12.00 fps,
  11031. # ]11.9,12.1[
  11032. >>>>&4 lelong <84034
  11033. >>>>>&-4 lelong >82645
  11034. >>>>>>&-4 lelong !83333 ~12 fps,
  11035. >>>>&4 lelong 66667 15.00 fps,
  11036. # ]14.9,15.1[
  11037. >>>>&4 lelong <67114
  11038. >>>>>&-4 lelong >66225
  11039. >>>>>>&-4 lelong !66667 ~15 fps,
  11040. >>>>&4 lelong 50000 20.00 fps,
  11041. >>>>&4 lelong 41708 23.98 fps,
  11042. >>>>&4 lelong 41667 24.00 fps,
  11043. # ]23.9,24.1[
  11044. >>>>&4 lelong <41841
  11045. >>>>>&-4 lelong >41494
  11046. >>>>>>&-4 lelong !41708
  11047. >>>>>>>&-4 lelong !41667 ~24 fps,
  11048. >>>>&4 lelong 40000 25.00 fps,
  11049. # ]24.9,25.1[
  11050. >>>>&4 lelong <40161
  11051. >>>>>&-4 lelong >39841
  11052. >>>>>>&-4 lelong !40000 ~25 fps,
  11053. >>>>&4 lelong 33367 29.97 fps,
  11054. >>>>&4 lelong 33333 30.00 fps,
  11055. # ]29.9,30.1[
  11056. >>>>&4 lelong <33445
  11057. >>>>>&-4 lelong >33223
  11058. >>>>>>&-4 lelong !33367
  11059. >>>>>>>&-4 lelong !33333 ~30 fps,
  11060. >>>>&4 lelong <32224 >30 fps,
  11061. ##>>>>&4 lelong x (%lu)
  11062. ##>>>>&20 lelong x %lu frames,
  11063. # Note: The tests below assume that the AVI has 1 or 2 streams,
  11064. # "vids" optionally followed by "auds".
  11065. # (Should cover 99.9% of all AVIs.)
  11066. # assuming avih length = 56
  11067. >>>88 string LIST
  11068. >>>>96 string strlstrh
  11069. >>>>>108 string vids video:
  11070. >>>>>>&0 lelong 0 uncompressed
  11071. # skip past vids strh
  11072. >>>>>>(104.l+108) string strf
  11073. >>>>>>>(104.l+132) lelong 1 RLE 8bpp
  11074. >>>>>>>(104.l+132) string/c cvid Cinepak
  11075. >>>>>>>(104.l+132) string/c i263 Intel I.263
  11076. >>>>>>>(104.l+132) string/c iv32 Indeo 3.2
  11077. >>>>>>>(104.l+132) string/c iv41 Indeo 4.1
  11078. >>>>>>>(104.l+132) string/c iv50 Indeo 5.0
  11079. >>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2
  11080. >>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3
  11081. >>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4
  11082. >>>>>>>(104.l+132) string/c mjpg Motion JPEG
  11083. >>>>>>>(104.l+132) string/c div3 DivX 3
  11084. >>>>>>>>112 string/c div3 Low-Motion
  11085. >>>>>>>>112 string/c div4 Fast-Motion
  11086. >>>>>>>(104.l+132) string/c divx DivX 4
  11087. >>>>>>>(104.l+132) string/c dx50 DivX 5
  11088. >>>>>>>(104.l+132) string/c xvid XviD
  11089. >>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9
  11090. >>>>>>>(104.l+132) string/c h264 X.264
  11091. >>>>>>>(104.l+132) lelong 0
  11092. ##>>>>>>>(104.l+132) string x (%.4s)
  11093. # skip past first (video) LIST
  11094. >>>>(92.l+96) string LIST
  11095. >>>>>(92.l+104) string strlstrh
  11096. >>>>>>(92.l+116) string auds \b, audio:
  11097. # auds strh length = 56:
  11098. >>>>>>>(92.l+172) string strf
  11099. >>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM
  11100. >>>>>>>>(92.l+180) leshort 0x0002 ADPCM
  11101. >>>>>>>>(92.l+180) leshort 0x0006 aLaw
  11102. >>>>>>>>(92.l+180) leshort 0x0007 uLaw
  11103. >>>>>>>>(92.l+180) leshort 0x0050 MPEG-1 Layer 1 or 2
  11104. >>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3
  11105. >>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3
  11106. >>>>>>>>(92.l+180) leshort 0x0161 DivX
  11107. ##>>>>>>>>(92.l+180) leshort x (0x%.4x)
  11108. >>>>>>>>(92.l+182) leshort 1 (mono,
  11109. >>>>>>>>(92.l+182) leshort 2 (stereo,
  11110. >>>>>>>>(92.l+182) leshort >2 (%d channels,
  11111. >>>>>>>>(92.l+184) lelong x %d Hz)
  11112. # auds strh length = 64:
  11113. >>>>>>>(92.l+180) string strf
  11114. >>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM
  11115. >>>>>>>>(92.l+188) leshort 0x0002 ADPCM
  11116. >>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3
  11117. >>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3
  11118. >>>>>>>>(92.l+188) leshort 0x0161 DivX
  11119. ##>>>>>>>>(92.l+188) leshort x (0x%.4x)
  11120. >>>>>>>>(92.l+190) leshort 1 (mono,
  11121. >>>>>>>>(92.l+190) leshort 2 (stereo,
  11122. >>>>>>>>(92.l+190) leshort >2 (%d channels,
  11123. >>>>>>>>(92.l+192) lelong x %d Hz)
  11124. # Animated Cursor format
  11125. >8 string ACON \b, animated cursor
  11126. # SoundFont 2 <mpruett@sgi.com>
  11127. >8 string sfbk SoundFont/Bank
  11128. # MPEG-1 wrapped in a RIFF, apparently
  11129. >8 string CDXA \b, wrapped MPEG-1 (CDXA)
  11130. >8 string 4XMV \b, 4X Movie file
  11131.  
  11132. #
  11133. # XXX - some of the below may only appear in little-endian form.
  11134. #
  11135. # Also "MV93" appears to be for one form of Macromedia Director
  11136. # files, and "GDMF" appears to be another multimedia format.
  11137. #
  11138. 0 string RIFX RIFF (big-endian) data
  11139. # RIFF Palette format
  11140. >8 string PAL \b, palette
  11141. >>16 beshort x \b, version %d
  11142. >>18 beshort x \b, %d entries
  11143. # RIFF Device Independent Bitmap format
  11144. >8 string RDIB \b, device-independent bitmap
  11145. >>16 string BM
  11146. >>>30 beshort 12 \b, OS/2 1.x format
  11147. >>>>34 beshort x \b, %d x
  11148. >>>>36 beshort x %d
  11149. >>>30 beshort 64 \b, OS/2 2.x format
  11150. >>>>34 beshort x \b, %d x
  11151. >>>>36 beshort x %d
  11152. >>>30 beshort 40 \b, Windows 3.x format
  11153. >>>>34 belong x \b, %d x
  11154. >>>>38 belong x %d x
  11155. >>>>44 beshort x %d
  11156. # RIFF MIDI format
  11157. >8 string RMID \b, MIDI
  11158. # RIFF Multimedia Movie File format
  11159. >8 string RMMP \b, multimedia movie
  11160. # Microsoft WAVE format (*.wav)
  11161. >8 string WAVE \b, WAVE audio
  11162. >>20 leshort 1 \b, Microsoft PCM
  11163. >>>34 leshort >0 \b, %d bit
  11164. >>22 beshort =1 \b, mono
  11165. >>22 beshort =2 \b, stereo
  11166. >>22 beshort >2 \b, %d channels
  11167. >>24 belong >0 %d Hz
  11168. # Corel Draw Picture
  11169. >8 string CDRA \b, Corel Draw Picture
  11170. # AVI == Audio Video Interleave
  11171. >8 string AVI\040 \b, AVI
  11172. # Animated Cursor format
  11173. >8 string ACON \b, animated cursor
  11174. # Notation Interchange File Format (big-endian only)
  11175. >8 string NIFF \b, Notation Interchange File Format
  11176. # SoundFont 2 <mpruett@sgi.com>
  11177. >8 string sfbk SoundFont/Bank
  11178. #------------------------------------------------------------------------------
  11179. #
  11180. # RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com)
  11181. #
  11182. 0 beshort 0xedab
  11183. >2 beshort 0xeedb RPM
  11184. >>4 byte x v%d
  11185. >>6 beshort 0 bin
  11186. >>6 beshort 1 src
  11187. >>8 beshort 1 i386
  11188. >>8 beshort 2 Alpha
  11189. >>8 beshort 3 Sparc
  11190. >>8 beshort 4 MIPS
  11191. >>8 beshort 5 PowerPC
  11192. >>8 beshort 6 68000
  11193. >>8 beshort 7 SGI
  11194. >>8 beshort 8 RS6000
  11195. >>8 beshort 9 IA64
  11196. >>8 beshort 10 Sparc64
  11197. >>8 beshort 11 MIPSel
  11198. >>8 beshort 12 ARM
  11199. >>10 string x %s
  11200.  
  11201. #------------------------------------------------------------------------------
  11202. # rtf: file(1) magic for Rich Text Format (RTF)
  11203. #
  11204. # Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
  11205. #
  11206. 0 string {\\rtf Rich Text Format data,
  11207. >5 byte x version %c,
  11208. >6 string \\ansi ANSI
  11209. >6 string \\mac Apple Macintosh
  11210. >6 string \\pc IBM PC, code page 437
  11211. >6 string \\pca IBM PS/2, code page 850
  11212.  
  11213. #------------------------------------------------------------------------------
  11214. # sc: file(1) magic for "sc" spreadsheet
  11215. #
  11216. 38 string Spreadsheet sc spreadsheet file
  11217.  
  11218. #------------------------------------------------------------------------------
  11219. # sccs: file(1) magic for SCCS archives
  11220. #
  11221. # SCCS archive structure:
  11222. # \001h01207
  11223. # \001s 00276/00000/00000
  11224. # \001d D 1.1 87/09/23 08:09:20 ian 1 0
  11225. # \001c date and time created 87/09/23 08:09:20 by ian
  11226. # \001e
  11227. # \001u
  11228. # \001U
  11229. # ... etc.
  11230. # Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
  11231. # *Sigh*. And these both came from various parts of the USG.
  11232. # Maybe we should just switch everybody from SCCS to RCS!
  11233. # Further, you can't just say '\001h0', because the five-digit number
  11234. # is a checksum that could (presumably) have any leading digit,
  11235. # and we don't have regular expression matching yet.
  11236. # Hence the following official kludge:
  11237. 8 string \001s\ SCCS archive data
  11238.  
  11239. #------------------------------------------------------------------------------
  11240. # sendmail: file(1) magic for sendmail config files
  11241. #
  11242. # XXX - byte order?
  11243. #
  11244. 0 byte 046 Sendmail frozen configuration
  11245. >16 string >\0 - version %s
  11246. 0 short 0x271c Sendmail frozen configuration
  11247. >16 string >\0 - version %s
  11248.  
  11249. #------------------------------------------------------------------------------
  11250. # sendmail: file(1) magic for sendmail m4(1) files
  11251. #
  11252. # From Hendrik Scholz <hendrik@scholz.net>
  11253. # i.e. files in /usr/share/sendmail/cf/
  11254. #
  11255. 0 string divert(-1)\n sendmail m4 text file
  11256.  
  11257.  
  11258. #------------------------------------------------------------------------------
  11259. # sequent: file(1) magic for Sequent machines
  11260. #
  11261. # Sequent information updated by Don Dwiggins <atsun!dwiggins>.
  11262. # For Sequent's multiprocessor systems (incomplete).
  11263. 0 lelong 0x00ea BALANCE NS32000 .o
  11264. >16 lelong >0 not stripped
  11265. >124 lelong >0 version %ld
  11266. 0 lelong 0x10ea BALANCE NS32000 executable (0 @ 0)
  11267. >16 lelong >0 not stripped
  11268. >124 lelong >0 version %ld
  11269. 0 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0)
  11270. >16 lelong >0 not stripped
  11271. >124 lelong >0 version %ld
  11272. 0 lelong 0x30ea BALANCE NS32000 standalone executable
  11273. >16 lelong >0 not stripped
  11274. >124 lelong >0 version %ld
  11275. #
  11276. # Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
  11277. # Symmetry magic nums will not be reached if DOS COM comes before them;
  11278. # byte 0xeb is matched before these get a chance.
  11279. 0 leshort 0x12eb SYMMETRY i386 .o
  11280. >16 lelong >0 not stripped
  11281. >124 lelong >0 version %ld
  11282. 0 leshort 0x22eb SYMMETRY i386 executable (0 @ 0)
  11283. >16 lelong >0 not stripped
  11284. >124 lelong >0 version %ld
  11285. 0 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0)
  11286. >16 lelong >0 not stripped
  11287. >124 lelong >0 version %ld
  11288. 0 leshort 0x42eb SYMMETRY i386 standalone executable
  11289. >16 lelong >0 not stripped
  11290. >124 lelong >0 version %ld
  11291.  
  11292. #------------------------------------------------------------------------------
  11293. # sgi: file(1) magic for Silicon Graphics applications
  11294.  
  11295. #
  11296. #
  11297. # Performance Co-Pilot file types
  11298. 0 string PmNs PCP compiled namespace (V.0)
  11299. 0 string PmN PCP compiled namespace
  11300. >3 string >\0 (V.%1.1s)
  11301. 3 lelong 0x84500526 PCP archive
  11302. >7 byte x (V.%d)
  11303. >20 lelong -2 temporal index
  11304. >20 lelong -1 metadata
  11305. >20 lelong 0 log volume #0
  11306. >20 lelong >0 log volume #%ld
  11307. >24 string >\0 host: %s
  11308. 0 string PCPFolio PCP
  11309. >9 string Version: Archive Folio
  11310. >18 string >\0 (V.%s)
  11311. 0 string #pmchart PCP pmchart view
  11312. >9 string Version
  11313. >17 string >\0 (V%-3.3s)
  11314. 0 string #kmchart PCP kmchart view
  11315. >9 string Version
  11316. >17 string >\0 (V.%s)
  11317. 0 string pmview PCP pmview config
  11318. >7 string Version
  11319. >15 string >\0 (V%-3.3s)
  11320. 0 string #pmlogger PCP pmlogger config
  11321. >10 string Version
  11322. >18 string >\0 (V%1.1s)
  11323. 0 string PcPh PCP Help
  11324. >4 string 1 Index
  11325. >4 string 2 Text
  11326. >5 string >\0 (V.%1.1s)
  11327. 0 string #pmieconf-rules PCP pmieconf rules
  11328. >16 string >\0 (V.%1.1s)
  11329. 3 string pmieconf-pmie PCP pmie config
  11330. >17 string >\0 (V.%1.1s)
  11331.  
  11332. # SpeedShop data files
  11333. 0 lelong 0x13130303 SpeedShop data file
  11334.  
  11335. # mdbm files
  11336. 0 lelong 0x01023962 mdbm file, version 0 (obsolete)
  11337. 0 string mdbm mdbm file,
  11338. >5 byte x version %d,
  11339. >6 byte x 2^%d pages,
  11340. >7 byte x pagesize 2^%d,
  11341. >17 byte x hash %d,
  11342. >11 byte x dataformat %d
  11343.  
  11344. # Alias Maya files
  11345. 0 string //Maya ASCII Alias Maya Ascii File,
  11346. >13 string >\0 version %s
  11347. 8 string MAYAFOR4 Alias Maya Binary File,
  11348. >32 string >\0 version %s scene
  11349. 8 string MayaFOR4 Alias Maya Binary File,
  11350. >32 string >\0 version %s scene
  11351. 8 string CIMG Alias Maya Image File
  11352. 8 string DEEP Alias Maya Image File
  11353.  
  11354. #------------------------------------------------------------------------------
  11355. # sgml: file(1) magic for Standard Generalized Markup Language
  11356. # HyperText Markup Language (HTML) is an SGML document type,
  11357. # from Daniel Quinlan (quinlan@yggdrasil.com)
  11358. # adapted to string extenstions by Anthon van der Neut <anthon@mnt.org)
  11359. 0 string/cB \<!DOCTYPE\ html HTML document text
  11360. 0 string/cb \<head HTML document text
  11361. 0 string/cb \<title HTML document text
  11362. 0 string/cb \<html HTML document text
  11363.  
  11364. # Extensible markup language (XML), a subset of SGML
  11365. # from Marc Prud'hommeaux (marc@apocalypse.org)
  11366. 0 string/cb \<?xml XML document text
  11367. 0 string \<?xml\ version\ " XML
  11368. 0 string \<?xml\ version=" XML
  11369. 0 string \<?xml\ version=' XML
  11370. >15 string >\0 %.3s document text
  11371. >>23 string \<xsl:stylesheet (XSL stylesheet)
  11372. >>24 string \<xsl:stylesheet (XSL stylesheet)
  11373. 0 string/b \<?xml XML document text
  11374. 0 string/cb \<?xml broken XML document text
  11375.  
  11376.  
  11377. # SGML, mostly from rph@sq
  11378. 0 string/cb \<!doctype exported SGML document text
  11379. 0 string/cb \<!subdoc exported SGML subdocument text
  11380. 0 string/cb \<!-- exported SGML document text
  11381.  
  11382. # Web browser cookie files
  11383. # (Mozilla, Galeon, Netscape 4, Konqueror..)
  11384. # Ulf Harnhammar <ulfh@update.uu.se>
  11385. 0 string #\ HTTP\ Cookie\ File Web browser cookie text
  11386. 0 string #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text
  11387. 0 string #\ KDE\ Cookie\ File Konqueror cookie text
  11388.  
  11389. #------------------------------------------------------------------------
  11390. # file(1) magic for sharc files
  11391. #
  11392. # SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
  11393. # FutureGroove Music (dsp@futuregroove.de)
  11394.  
  11395. #------------------------------------------------------------------------
  11396. 0 string Draw RiscOS Drawfile
  11397. 0 string PACK RiscOS PackdDir archive
  11398.  
  11399. #------------------------------------------------------------------------
  11400. # SHARC DSP stuff (based on the FGM SHARC DSP SDK)
  11401.  
  11402. 0 string =! Assembler source
  11403. 0 string Analog ADi asm listing file
  11404. 0 string .SYSTEM SHARC architecture file
  11405. 0 string .system SHARC architecture file
  11406.  
  11407. 0 leshort 0x521C SHARC COFF binary
  11408. >2 leshort >1 , %hd sections
  11409. >>12 lelong >0 , not stripped
  11410.  
  11411. #------------------------------------------------------------------------------
  11412. # sinclair: file(1) sinclair QL
  11413.  
  11414. # additions to /etc/magic by Thomas M. Ott (ThMO)
  11415.  
  11416. # Sinclair QL floppy disk formats (ThMO)
  11417. 0 string =QL5 QL disk dump data,
  11418. >3 string =A 720 KB,
  11419. >3 string =B 1.44 MB,
  11420. >3 string =C 3.2 MB,
  11421. >4 string >\0 label:%.10s
  11422.  
  11423. # Sinclair QL OS dump (ThMO)
  11424. # (NOTE: if `file' would be able to use indirect references in a endian format
  11425. # differing from the natural host format, this could be written more
  11426. # reliably and faster...)
  11427. #
  11428. # we *can't* lookup QL OS code dumps, because `file' is UNABLE to read more
  11429. # than the first 8K of a file... #-(
  11430. #
  11431. #0 belong =0x30000
  11432. #>49124 belong <47104
  11433. #>>49128 belong <47104
  11434. #>>>49132 belong <47104
  11435. #>>>>49136 belong <47104 QL OS dump data,
  11436. #>>>>>49148 string >\0 type %.3s,
  11437. #>>>>>49142 string >\0 version %.4s
  11438.  
  11439. # Sinclair QL firmware executables (ThMO)
  11440. 0 string NqNqNq`\004 QL firmware executable (BCPL)
  11441.  
  11442. # Sinclair QL libraries (was ThMO)
  11443. 0 beshort 0xFB01 QDOS object
  11444. >2 pstring x '%s'
  11445.  
  11446. # Sinclair QL executables (was ThMO)
  11447. 4 belong 0x4AFB QDOS executable
  11448. >9 pstring x '%s'
  11449.  
  11450. # Sinclair QL ROM (ThMO)
  11451. 0 belong =0x4AFB0001 QL plugin-ROM data,
  11452. >9 pstring =\0 un-named
  11453. >9 pstring >\0 named: %s
  11454.  
  11455. #------------------------------------------------------------------------------
  11456. # Sketch Drawings: http://sketch.sourceforge.net/
  11457. # From: Edwin Mons <e@ik.nu>
  11458. 0 string ##Sketch Sketch document text
  11459.  
  11460. #-----------------------------------------------
  11461. # GNU Smalltalk image, starting at version 1.6.2
  11462. # From: catull_us@yahoo.com
  11463. #
  11464. 0 string GSTIm\0\0 GNU SmallTalk
  11465. # little-endian
  11466. >7 byte&1 =0 LE image version
  11467. >>10 byte x %d.
  11468. >>9 byte x \b%d.
  11469. >>8 byte x \b%d
  11470. #>>12 lelong x , data: %ld
  11471. #>>16 lelong x , table: %ld
  11472. #>>20 lelong x , memory: %ld
  11473. # big-endian
  11474. >7 byte&1 =1 BE image version
  11475. >>8 byte x %d.
  11476. >>9 byte x \b%d.
  11477. >>10 byte x \b%d
  11478. #>>12 belong x , data: %ld
  11479. #>>16 belong x , table: %ld
  11480. #>>20 belong x , memory: %ld
  11481.  
  11482.  
  11483.  
  11484. #------------------------------------------------------------------------------
  11485. # sniffer: file(1) magic for packet capture files
  11486. #
  11487. # From: guy@alum.mit.edu (Guy Harris)
  11488. #
  11489.  
  11490. #
  11491. # Microsoft Network Monitor 1.x capture files.
  11492. #
  11493. 0 string RTSS NetMon capture file
  11494. >5 byte x - version %d
  11495. >4 byte x \b.%d
  11496. >6 leshort 0 (Unknown)
  11497. >6 leshort 1 (Ethernet)
  11498. >6 leshort 2 (Token Ring)
  11499. >6 leshort 3 (FDDI)
  11500. >6 leshort 4 (ATM)
  11501.  
  11502. #
  11503. # Microsoft Network Monitor 2.x capture files.
  11504. #
  11505. 0 string GMBU NetMon capture file
  11506. >5 byte x - version %d
  11507. >4 byte x \b.%d
  11508. >6 leshort 0 (Unknown)
  11509. >6 leshort 1 (Ethernet)
  11510. >6 leshort 2 (Token Ring)
  11511. >6 leshort 3 (FDDI)
  11512. >6 leshort 4 (ATM)
  11513.  
  11514. #
  11515. # Network General Sniffer capture files.
  11516. # Sorry, make that "Network Associates Sniffer capture files."
  11517. # Sorry, make that "Network General old DOS Sniffer capture files."
  11518. #
  11519. 0 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file
  11520. >33 byte 2 (compressed)
  11521. >23 leshort x - version %d
  11522. >25 leshort x \b.%d
  11523. >32 byte 0 (Token Ring)
  11524. >32 byte 1 (Ethernet)
  11525. >32 byte 2 (ARCNET)
  11526. >32 byte 3 (StarLAN)
  11527. >32 byte 4 (PC Network broadband)
  11528. >32 byte 5 (LocalTalk)
  11529. >32 byte 6 (Znet)
  11530. >32 byte 7 (Internetwork Analyzer)
  11531. >32 byte 9 (FDDI)
  11532. >32 byte 10 (ATM)
  11533.  
  11534. #
  11535. # Cinco Networks NetXRay capture files.
  11536. # Sorry, make that "Network General Sniffer Basic capture files."
  11537. # Sorry, make that "Network Associates Sniffer Basic capture files."
  11538. # Sorry, make that "Network Associates Sniffer Basic, and Windows
  11539. # Sniffer Pro", capture files."
  11540. # Sorry, make that "Network General Sniffer capture files."
  11541. #
  11542. 0 string XCP\0 NetXRay capture file
  11543. >4 string >\0 - version %s
  11544. >44 leshort 0 (Ethernet)
  11545. >44 leshort 1 (Token Ring)
  11546. >44 leshort 2 (FDDI)
  11547. >44 leshort 3 (WAN)
  11548. >44 leshort 8 (ATM)
  11549. >44 leshort 9 (802.11)
  11550.  
  11551. #
  11552. # "libpcap" capture files.
  11553. # (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
  11554. # the main program that uses that format, but there are other programs
  11555. # that use "libpcap", or that use the same capture file format.)
  11556. #
  11557. 0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian)
  11558. >4 beshort x - version %d
  11559. >6 beshort x \b.%d
  11560. >20 belong 0 (No link-layer encapsulation
  11561. >20 belong 1 (Ethernet
  11562. >20 belong 2 (3Mb Ethernet
  11563. >20 belong 3 (AX.25
  11564. >20 belong 4 (ProNET
  11565. >20 belong 5 (CHAOS
  11566. >20 belong 6 (Token Ring
  11567. >20 belong 7 (BSD ARCNET
  11568. >20 belong 8 (SLIP
  11569. >20 belong 9 (PPP
  11570. >20 belong 10 (FDDI
  11571. >20 belong 11 (RFC 1483 ATM
  11572. >20 belong 12 (raw IP
  11573. >20 belong 13 (BSD/OS SLIP
  11574. >20 belong 14 (BSD/OS PPP
  11575. >20 belong 19 (Linux ATM Classical IP
  11576. >20 belong 50 (PPP or Cisco HDLC
  11577. >20 belong 51 (PPP-over-Ethernet
  11578. >20 belong 99 (Symantec Enterprise Firewall
  11579. >20 belong 100 (RFC 1483 ATM
  11580. >20 belong 101 (raw IP
  11581. >20 belong 102 (BSD/OS SLIP
  11582. >20 belong 103 (BSD/OS PPP
  11583. >20 belong 104 (BSD/OS Cisco HDLC
  11584. >20 belong 105 (802.11
  11585. >20 belong 106 (Linux Classical IP over ATM
  11586. >20 belong 107 (Frame Relay
  11587. >20 belong 108 (OpenBSD loopback
  11588. >20 belong 109 (OpenBSD IPsec encrypted
  11589. >20 belong 112 (Cisco HDLC
  11590. >20 belong 113 (Linux "cooked"
  11591. >20 belong 114 (LocalTalk
  11592. >20 belong 117 (OpenBSD PFLOG
  11593. >20 belong 119 (802.11 with Prism header
  11594. >20 belong 122 (RFC 2625 IP over Fibre Channel
  11595. >20 belong 123 (SunATM
  11596. >20 belong 127 (802.11 with radiotap header
  11597. >20 belong 129 (Linux ARCNET
  11598. >20 belong 138 (Apple IP over IEEE 1394
  11599. >20 belong 140 (MTP2
  11600. >20 belong 141 (MTP3
  11601. >20 belong 143 (DOCSIS
  11602. >20 belong 144 (IrDA
  11603. >20 belong 147 (Private use 0
  11604. >20 belong 148 (Private use 1
  11605. >20 belong 149 (Private use 2
  11606. >20 belong 150 (Private use 3
  11607. >20 belong 151 (Private use 4
  11608. >20 belong 152 (Private use 5
  11609. >20 belong 153 (Private use 6
  11610. >20 belong 154 (Private use 7
  11611. >20 belong 155 (Private use 8
  11612. >20 belong 156 (Private use 9
  11613. >20 belong 157 (Private use 10
  11614. >20 belong 158 (Private use 11
  11615. >20 belong 159 (Private use 12
  11616. >20 belong 160 (Private use 13
  11617. >20 belong 161 (Private use 14
  11618. >20 belong 162 (Private use 15
  11619. >20 belong 163 (802.11 with AVS header
  11620. >16 belong x \b, capture length %d)
  11621. 0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian)
  11622. >4 leshort x - version %d
  11623. >6 leshort x \b.%d
  11624. >20 lelong 0 (No link-layer encapsulation
  11625. >20 lelong 1 (Ethernet
  11626. >20 lelong 2 (3Mb Ethernet
  11627. >20 lelong 3 (AX.25
  11628. >20 lelong 4 (ProNET
  11629. >20 lelong 5 (CHAOS
  11630. >20 lelong 6 (Token Ring
  11631. >20 lelong 7 (ARCNET
  11632. >20 lelong 8 (SLIP
  11633. >20 lelong 9 (PPP
  11634. >20 lelong 10 (FDDI
  11635. >20 lelong 11 (RFC 1483 ATM
  11636. >20 lelong 12 (raw IP
  11637. >20 lelong 13 (BSD/OS SLIP
  11638. >20 lelong 14 (BSD/OS PPP
  11639. >20 lelong 19 (Linux ATM Classical IP
  11640. >20 lelong 50 (PPP or Cisco HDLC
  11641. >20 lelong 51 (PPP-over-Ethernet
  11642. >20 lelong 99 (Symantec Enterprise Firewall
  11643. >20 lelong 100 (RFC 1483 ATM
  11644. >20 lelong 101 (raw IP
  11645. >20 lelong 102 (BSD/OS SLIP
  11646. >20 lelong 103 (BSD/OS PPP
  11647. >20 lelong 104 (BSD/OS Cisco HDLC
  11648. >20 lelong 105 (802.11
  11649. >20 lelong 106 (Linux Classical IP over ATM
  11650. >20 lelong 107 (Frame Relay
  11651. >20 lelong 108 (OpenBSD loopback
  11652. >20 lelong 109 (OpenBSD IPsec encrypted
  11653. >20 lelong 112 (Cisco HDLC
  11654. >20 lelong 113 (Linux "cooked"
  11655. >20 lelong 114 (LocalTalk
  11656. >20 lelong 117 (OpenBSD PFLOG
  11657. >20 lelong 119 (802.11 with Prism header
  11658. >20 lelong 122 (RFC 2625 IP over Fibre Channel
  11659. >20 lelong 123 (SunATM
  11660. >20 lelong 127 (802.11 with radiotap header
  11661. >20 lelong 129 (Linux ARCNET
  11662. >20 lelong 138 (Apple IP over IEEE 1394
  11663. >20 lelong 140 (MTP2
  11664. >20 lelong 141 (MTP3
  11665. >20 lelong 143 (DOCSIS
  11666. >20 lelong 144 (IrDA
  11667. >20 lelong 147 (Private use 0
  11668. >20 lelong 148 (Private use 1
  11669. >20 lelong 149 (Private use 2
  11670. >20 lelong 150 (Private use 3
  11671. >20 lelong 151 (Private use 4
  11672. >20 lelong 152 (Private use 5
  11673. >20 lelong 153 (Private use 6
  11674. >20 lelong 154 (Private use 7
  11675. >20 lelong 155 (Private use 8
  11676. >20 lelong 156 (Private use 9
  11677. >20 lelong 157 (Private use 10
  11678. >20 lelong 158 (Private use 11
  11679. >20 lelong 159 (Private use 12
  11680. >20 lelong 160 (Private use 13
  11681. >20 lelong 161 (Private use 14
  11682. >20 lelong 162 (Private use 15
  11683. >20 lelong 163 (802.11 with AVS header
  11684. >16 lelong x \b, capture length %d)
  11685.  
  11686. #
  11687. # "libpcap"-with-Alexey-Kuznetsov's-patches capture files.
  11688. # (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
  11689. # the main program that uses that format, but there are other programs
  11690. # that use "libpcap", or that use the same capture file format.)
  11691. #
  11692. 0 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian)
  11693. >4 beshort x - version %d
  11694. >6 beshort x \b.%d
  11695. >20 belong 0 (No link-layer encapsulation
  11696. >20 belong 1 (Ethernet
  11697. >20 belong 2 (3Mb Ethernet
  11698. >20 belong 3 (AX.25
  11699. >20 belong 4 (ProNET
  11700. >20 belong 5 (CHAOS
  11701. >20 belong 6 (Token Ring
  11702. >20 belong 7 (ARCNET
  11703. >20 belong 8 (SLIP
  11704. >20 belong 9 (PPP
  11705. >20 belong 10 (FDDI
  11706. >20 belong 11 (RFC 1483 ATM
  11707. >20 belong 12 (raw IP
  11708. >20 belong 13 (BSD/OS SLIP
  11709. >20 belong 14 (BSD/OS PPP
  11710. >16 belong x \b, capture length %d)
  11711. 0 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian)
  11712. >4 leshort x - version %d
  11713. >6 leshort x \b.%d
  11714. >20 lelong 0 (No link-layer encapsulation
  11715. >20 lelong 1 (Ethernet
  11716. >20 lelong 2 (3Mb Ethernet
  11717. >20 lelong 3 (AX.25
  11718. >20 lelong 4 (ProNET
  11719. >20 lelong 5 (CHAOS
  11720. >20 lelong 6 (Token Ring
  11721. >20 lelong 7 (ARCNET
  11722. >20 lelong 8 (SLIP
  11723. >20 lelong 9 (PPP
  11724. >20 lelong 10 (FDDI
  11725. >20 lelong 11 (RFC 1483 ATM
  11726. >20 lelong 12 (raw IP
  11727. >20 lelong 13 (BSD/OS SLIP
  11728. >20 lelong 14 (BSD/OS PPP
  11729. >16 lelong x \b, capture length %d)
  11730.  
  11731. #
  11732. # AIX "iptrace" capture files.
  11733. #
  11734. 0 string iptrace\ 1.0 "iptrace" capture file
  11735. 0 string iptrace\ 2.0 "iptrace" capture file
  11736.  
  11737. #
  11738. # Novell LANalyzer capture files.
  11739. #
  11740. 0 leshort 0x1001 LANalyzer capture file
  11741. 0 leshort 0x1007 LANalyzer capture file
  11742.  
  11743. #
  11744. # HP-UX "nettl" capture files.
  11745. #
  11746. 0 string \x54\x52\x00\x64\x00 "nettl" capture file
  11747.  
  11748. #
  11749. # RADCOM WAN/LAN Analyzer capture files.
  11750. #
  11751. 0 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file
  11752.  
  11753. #
  11754. # NetStumbler log files. Not really packets, per se, but about as
  11755. # close as you can get. These are log files from NetStumbler, a
  11756. # Windows program, that scans for 802.11b networks.
  11757. #
  11758. 0 string NetS NetStumbler log file
  11759. >8 lelong x \b, %d stations found
  11760.  
  11761. #
  11762. # EtherPeek/AiroPeek "version 9" capture files.
  11763. #
  11764. 0 string \177ver EtherPeek/AiroPeek capture file
  11765.  
  11766. #
  11767. # Visual Networks traffic capture files.
  11768. #
  11769. 0 string \x05VNF Visual Networks traffic capture file
  11770.  
  11771. #
  11772. # Network Instruments Observer capture files.
  11773. #
  11774. 0 string ObserverPktBuffe Network Instruments Observer capture file
  11775.  
  11776. #
  11777. # Files from Accellent Group's 5View products.
  11778. #
  11779. 0 string \xaa\xaa\xaa\xaa 5View capture file
  11780.  
  11781. #------------------------------------------------------------------------------
  11782. # Dyadic: file(1) magic for Dyalog APL.
  11783. #
  11784. 0 byte 0xaa
  11785. >1 byte <4 Dyalog APL
  11786. >>1 byte 0x00 incomplete workspace
  11787. >>1 byte 0x01 component file
  11788. >>1 byte 0x02 external variable
  11789. >>1 byte 0x03 workspace
  11790. >>2 byte x version %d
  11791. >>3 byte x .%d
  11792.  
  11793. #------------------------------------------------------------------------------
  11794. # scientific: file(1) magic for scientific formats
  11795. #
  11796. # From: Joe Krahn <krahn@niehs.nih.gov>
  11797.  
  11798. ########################################################
  11799. # CCP4 data and plot files:
  11800. 0 string MTZ\040 MTZ reflection file
  11801.  
  11802. 92 string PLOT%%84 Plot84 plotting file
  11803. >52 byte 1 , Little-endian
  11804. >55 byte 1 , Big-endian
  11805.  
  11806. ########################################################
  11807. # Electron density MAP/MASK formats
  11808.  
  11809. 0 string EZD_MAP NEWEZD Electron Density Map
  11810. 109 string MAP\040( Old EZD Electron Density Map
  11811.  
  11812. 0 string/c :-)\040Origin BRIX Electron Density Map
  11813. >170 string >0 , Sigma:%.12s
  11814. #>4 string >0 %.178s
  11815. #>4 addr x %.178s
  11816.  
  11817. 7 string 18\040!NTITLE XPLOR ASCII Electron Density Map
  11818. 9 string \040!NTITLE\012\040REMARK CNS ASCII electron density map
  11819.  
  11820. 208 string MAP\040 CCP4 Electron Density Map
  11821. # Assumes same stamp for float and double (normal case)
  11822. >212 byte 17 \b, Big-endian
  11823. >212 byte 34 \b, VAX format
  11824. >212 byte 68 \b, Little-endian
  11825. >212 byte 85 \b, Convex native
  11826.  
  11827. ############################################################
  11828. # X-Ray Area Detector images
  11829. 0 string R-AXIS4\ \ \ R-Axis Area Detector Image:
  11830. >796 lelong <20 Little-endian, IP #%d,
  11831. >>768 lelong >0 Size=%dx
  11832. >>772 lelong >0 \b%d
  11833. >796 belong <20 Big-endian, IP #%d,
  11834. >>768 belong >0 Size=%dx
  11835. >>772 belong >0 \b%d
  11836.  
  11837. 0 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32:
  11838. >796 lelong <20 Little-endian, IP #%d,
  11839. >>768 lelong >0 Size=%dx
  11840. >>772 lelong >0 \b%d
  11841. >796 belong <20 Big-endian, IP #%d,
  11842. >>768 belong >0 Size=%dx
  11843. >>772 belong >0 \b%d
  11844.  
  11845.  
  11846. 1028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image,
  11847. >1072 ulong >1 Compressed(%d),
  11848. >1100 ulong >1 %d headers,
  11849. >1104 ulong >0 %d x
  11850. >1108 ulong >0 %d,
  11851. >1120 ulong >0 %d bits/pixel
  11852.  
  11853. #------------------------------------------------------------------------------
  11854. # softquad: file(1) magic for SoftQuad Publishing Software
  11855. #
  11856. # Author/Editor and RulesBuilder
  11857. #
  11858. # XXX - byte order?
  11859. #
  11860. 0 string \<!SQ\ DTD> Compiled SGML rules file
  11861. >9 string >\0 Type %s
  11862. 0 string \<!SQ\ A/E> A/E SGML Document binary
  11863. >9 string >\0 Type %s
  11864. 0 string \<!SQ\ STS> A/E SGML binary styles file
  11865. >9 string >\0 Type %s
  11866. 0 short 0xc0de Compiled PSI (v1) data
  11867. 0 short 0xc0da Compiled PSI (v2) data
  11868. >3 string >\0 (%s)
  11869. # Binary sqtroff font/desc files...
  11870. 0 short 0125252 SoftQuad DESC or font file binary
  11871. >2 short >0 - version %d
  11872. # Bitmaps...
  11873. 0 string SQ\ BITMAP1 SoftQuad Raster Format text
  11874. #0 string SQ\ BITMAP2 SoftQuad Raster Format data
  11875. # sqtroff intermediate language (replacement for ditroff int. lang.)
  11876. 0 string X\ SoftQuad troff Context intermediate
  11877. >2 string 495 for AT&T 495 laser printer
  11878. >2 string hp for Hewlett-Packard LaserJet
  11879. >2 string impr for IMAGEN imPRESS
  11880. >2 string ps for PostScript
  11881.  
  11882. #------------------------------------------------------------------------------
  11883. # spectrum: file(1) magic for Spectrum emulator files.
  11884. #
  11885. # John Elliott <jce@seasip.demon.co.uk>
  11886.  
  11887. #
  11888. # Spectrum +3DOS header
  11889. #
  11890. 0 string PLUS3DOS\032 Spectrum +3 data
  11891. >15 byte 0 - BASIC program
  11892. >15 byte 1 - number array
  11893. >15 byte 2 - character array
  11894. >15 byte 3 - memory block
  11895. >>16 belong 0x001B0040 (screen)
  11896. >15 byte 4 - Tasword document
  11897. >15 string TAPEFILE - ZXT tapefile
  11898. #
  11899. # Tape file. This assumes the .TAP starts with a Spectrum-format header,
  11900. # which nearly all will.
  11901. #
  11902. 0 string \023\000\000 Spectrum .TAP data
  11903. >4 string x "%-10.10s"
  11904. >3 byte 0 - BASIC program
  11905. >3 byte 1 - number array
  11906. >3 byte 2 - character array
  11907. >3 byte 3 - memory block
  11908. >>14 belong 0x001B0040 (screen)
  11909.  
  11910. # The following three blocks are from pak21-spectrum@srcf.ucam.org
  11911. # TZX tape images
  11912. 0 string ZXTape!\x1a Spectrum .TZX data
  11913. >8 byte x version %d
  11914. >9 byte x .%d
  11915.  
  11916. # RZX input recording files
  11917. 0 string RZX! Spectrum .RZX data
  11918. >4 byte x version %d
  11919. >5 byte x .%d
  11920.  
  11921. # And three sorts of disk image
  11922. 0 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data
  11923. 0 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data
  11924. 0 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data
  11925.  
  11926. #------------------------------------------------------------------------------
  11927. # sql: file(1) magic for SQL files
  11928. #
  11929. # From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
  11930. # Recognize some MySQL files.
  11931. #
  11932. 0 beshort 0xfe01 MySQL table definition file
  11933. >2 byte x Version %d
  11934. 0 belong&0xffffff00 0xfefe0300 MySQL MISAM index file
  11935. >3 byte x Version %d
  11936. 0 belong&0xffffff00 0xfefe0700 MySQL MISAM compressed data file
  11937. >3 byte x Version %d
  11938. 0 belong&0xffffff00 0xfefe0500 MySQL ISAM index file
  11939. >3 byte x Version %d
  11940. 0 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file
  11941. >3 byte x Version %d
  11942. 0 string \376bin MySQL replication log
  11943.  
  11944. #------------------------------------------------------------------------------
  11945. # iRiver H Series database file
  11946. # From Ken Guest <ken@linux.ie>
  11947. # As observed from iRivNavi.iDB and unencoded firmware
  11948. #
  11949. 0 string iRivDB iRiver Database file
  11950. >11 string >\0 Version %s
  11951. >39 string iHP-100 [H Series]
  11952.  
  11953. #------------------------------------------------------------------------------
  11954. # SQLite database files
  11955. # Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg
  11956. #
  11957. # Version 1 used GDBM internally; its files cannot be distinguished
  11958. # from other GDBM files.
  11959. #
  11960. # Version 2 used this format:
  11961. 0 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database
  11962.  
  11963. # Version 3 of SQLite allows applications to embed their own "user version"
  11964. # number in the database. Detect this and distinguish those files.
  11965.  
  11966. 0 string SQLite\ format\ 3
  11967. >60 string _MTN Monotone source repository
  11968. >60 belong !0 SQLite 3.x database, user version %u
  11969. >60 belong 0 SQLite 3.x database
  11970.  
  11971. #------------------------------------------------------------------------------
  11972. # sun: file(1) magic for Sun machines
  11973. #
  11974. # Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
  11975. # releases. (5.x uses ELF.)
  11976. #
  11977. 0 belong&077777777 0600413 sparc demand paged
  11978. >0 byte &0x80
  11979. >>20 belong <4096 shared library
  11980. >>20 belong =4096 dynamically linked executable
  11981. >>20 belong >4096 dynamically linked executable
  11982. >0 byte ^0x80 executable
  11983. >16 belong >0 not stripped
  11984.  
  11985. 0 belong&077777777 0600410 sparc pure
  11986. >0 byte &0x80 dynamically linked executable
  11987. >0 byte ^0x80 executable
  11988. >16 belong >0 not stripped
  11989.  
  11990. 0 belong&077777777 0600407 sparc
  11991. >0 byte &0x80 dynamically linked executable
  11992. >0 byte ^0x80 executable
  11993. >16 belong >0 not stripped
  11994.  
  11995. 0 belong&077777777 0400413 mc68020 demand paged
  11996. >0 byte &0x80
  11997. >>20 belong <4096 shared library
  11998. >>20 belong =4096 dynamically linked executable
  11999. >>20 belong >4096 dynamically linked executable
  12000. >0 byte ^0x80 executable
  12001. >16 belong >0 not stripped
  12002.  
  12003. 0 belong&077777777 0400410 mc68020 pure
  12004. >0 byte &0x80 dynamically linked executable
  12005. >0 byte ^0x80 executable
  12006. >16 belong >0 not stripped
  12007.  
  12008. 0 belong&077777777 0400407 mc68020
  12009. >0 byte &0x80 dynamically linked executable
  12010. >0 byte ^0x80 executable
  12011. >16 belong >0 not stripped
  12012.  
  12013. 0 belong&077777777 0200413 mc68010 demand paged
  12014. >0 byte &0x80
  12015. >>20 belong <4096 shared library
  12016. >>20 belong =4096 dynamically linked executable
  12017. >>20 belong >4096 dynamically linked executable
  12018. >0 byte ^0x80 executable
  12019. >16 belong >0 not stripped
  12020.  
  12021. 0 belong&077777777 0200410 mc68010 pure
  12022. >0 byte &0x80 dynamically linked executable
  12023. >0 byte ^0x80 executable
  12024. >16 belong >0 not stripped
  12025.  
  12026. 0 belong&077777777 0200407 mc68010
  12027. >0 byte &0x80 dynamically linked executable
  12028. >0 byte ^0x80 executable
  12029. >16 belong >0 not stripped
  12030.  
  12031. # reworked these to avoid anything beginning with zero becoming "old sun-2"
  12032. 0 belong 0407 old sun-2 executable
  12033. >16 belong >0 not stripped
  12034. 0 belong 0410 old sun-2 pure executable
  12035. >16 belong >0 not stripped
  12036. 0 belong 0413 old sun-2 demand paged executable
  12037. >16 belong >0 not stripped
  12038.  
  12039. #
  12040. # Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
  12041. # binary executed in compatibility mode under SunOS 5.x".
  12042. #
  12043. 0 belong 0x080456 SunOS core file
  12044. >4 belong 432 (SPARC)
  12045. >>132 string >\0 from '%s'
  12046. >>116 belong =3 (quit)
  12047. >>116 belong =4 (illegal instruction)
  12048. >>116 belong =5 (trace trap)
  12049. >>116 belong =6 (abort)
  12050. >>116 belong =7 (emulator trap)
  12051. >>116 belong =8 (arithmetic exception)
  12052. >>116 belong =9 (kill)
  12053. >>116 belong =10 (bus error)
  12054. >>116 belong =11 (segmentation violation)
  12055. >>116 belong =12 (bad argument to system call)
  12056. >>116 belong =29 (resource lost)
  12057. >>120 belong x (T=%dK,
  12058. >>124 belong x D=%dK,
  12059. >>128 belong x S=%dK)
  12060. >4 belong 826 (68K)
  12061. >>128 string >\0 from '%s'
  12062. >4 belong 456 (SPARC 4.x BCP)
  12063. >>152 string >\0 from '%s'
  12064. # Sun SunPC
  12065. 0 long 0xfa33c08e SunPC 4.0 Hard Disk
  12066. 0 string #SUNPC_CONFIG SunPC 4.0 Properties Values
  12067. # Sun snoop (see RFC 1761, which describes the capture file format).
  12068. #
  12069. 0 string snoop Snoop capture file
  12070. >8 belong >0 - version %ld
  12071. >12 belong 0 (IEEE 802.3)
  12072. >12 belong 1 (IEEE 802.4)
  12073. >12 belong 2 (IEEE 802.5)
  12074. >12 belong 3 (IEEE 802.6)
  12075. >12 belong 4 (Ethernet)
  12076. >12 belong 5 (HDLC)
  12077. >12 belong 6 (Character synchronous)
  12078. >12 belong 7 (IBM channel-to-channel adapter)
  12079. >12 belong 8 (FDDI)
  12080. >12 belong 9 (Unknown)
  12081.  
  12082. # Microsoft ICM color profile
  12083. 36 string acspMSFT Microsoft ICM Color Profile
  12084. # Sun KCMS
  12085. 36 string acsp Kodak Color Management System, ICC Profile
  12086.  
  12087. #---------------------------------------------------------------------------
  12088. # The following entries have been tested by Duncan Laurie <duncan@sun.com> (a
  12089. # lead Sun/Cobalt developer) who agrees that they are good and worthy of
  12090. # inclusion.
  12091.  
  12092. # Boot ROM images for Sun/Cobalt Linux server appliances
  12093. 0 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom
  12094. >38 string x V%.4s
  12095.  
  12096. # New format for Sun/Cobalt boot ROMs is annoying, it stores the version code
  12097. # at the very end where file(1) can't get it.
  12098. 0 string CRfs COBALT boot rom data (Flat boot rom or file system)
  12099.  
  12100.  
  12101. #------------------------------------------------------------------------
  12102. # sysex: file(1) magic for MIDI sysex files
  12103. #
  12104. #
  12105. 0 byte 0xF0 SysEx File -
  12106.  
  12107. # North American Group
  12108. >1 byte 0x01 Sequential
  12109. >1 byte 0x02 IDP
  12110. >1 byte 0x03 OctavePlateau
  12111. >1 byte 0x04 Moog
  12112. >1 byte 0x05 Passport
  12113. >1 byte 0x06 Lexicon
  12114. >1 byte 0x07 Kurzweil/Future Retro
  12115. >>3 byte 0x77 777
  12116. >>4 byte 0x00 Bank
  12117. >>4 byte 0x01 Song
  12118. >>5 byte 0x0f 16
  12119. >>5 byte 0x0e 15
  12120. >>5 byte 0x0d 14
  12121. >>5 byte 0x0c 13
  12122. >>5 byte 0x0b 12
  12123. >>5 byte 0x0a 11
  12124. >>5 byte 0x09 10
  12125. >>5 byte 0x08 9
  12126. >>5 byte 0x07 8
  12127. >>5 byte 0x06 7
  12128. >>5 byte 0x05 6
  12129. >>5 byte 0x04 5
  12130. >>5 byte 0x03 4
  12131. >>5 byte 0x02 3
  12132. >>5 byte 0x01 2
  12133. >>5 byte 0x00 1
  12134. >>5 byte 0x10 (ALL)
  12135. >>2 byte x \b, Channel %d
  12136. >1 byte 0x08 Fender
  12137. >1 byte 0x09 Gulbransen
  12138. >1 byte 0x0a AKG
  12139. >1 byte 0x0b Voyce
  12140. >1 byte 0x0c Waveframe
  12141. >1 byte 0x0d ADA
  12142. >1 byte 0x0e Garfield
  12143. >1 byte 0x0f Ensoniq
  12144. >1 byte 0x10 Oberheim
  12145. >>2 byte 0x06 Matrix 6 series
  12146. >>3 byte 0x0A Dump (All)
  12147. >>3 byte 0x01 Dump (Bank)
  12148. >>4 belong 0x0002040E Matrix 1000
  12149. >>>11 byte <2 User bank %d
  12150. >>>11 byte >1 Preset bank %d
  12151. >1 byte 0x11 Apple
  12152. >1 byte 0x12 GreyMatter
  12153. >1 byte 0x14 PalmTree
  12154. >1 byte 0x15 JLCooper
  12155. >1 byte 0x16 Lowrey
  12156. >1 byte 0x17 AdamsSmith
  12157. >1 byte 0x18 E-mu
  12158. >1 byte 0x19 Harmony
  12159. >1 byte 0x1a ART
  12160. >1 byte 0x1b Baldwin
  12161. >1 byte 0x1c Eventide
  12162. >1 byte 0x1d Inventronics
  12163. >1 byte 0x1f Clarity
  12164.  
  12165. # European Group
  12166. >1 byte 0x21 SIEL
  12167. >1 byte 0x22 Synthaxe
  12168. >1 byte 0x24 Hohner
  12169. >1 byte 0x25 Twister
  12170. >1 byte 0x26 Solton
  12171. >1 byte 0x27 Jellinghaus
  12172. >1 byte 0x28 Southworth
  12173. >1 byte 0x29 PPG
  12174. >1 byte 0x2a JEN
  12175. >1 byte 0x2b SSL
  12176. >1 byte 0x2c AudioVertrieb
  12177.  
  12178. >1 byte 0x2f ELKA
  12179. >>3 byte 0x09 EK-44
  12180.  
  12181. >1 byte 0x30 Dynacord
  12182. >1 byte 0x31 Jomox
  12183. >1 byte 0x33 Clavia
  12184. >1 byte 0x39 Soundcraft
  12185. # Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs
  12186. >1 byte 0x3e Waldorf
  12187. >>2 byte 0x00 microWave
  12188. >>2 byte 0x0E microwave2 / XT
  12189. >>2 byte 0x0F Q / Q+
  12190. >>3 byte =0 (default id)
  12191. >>3 byte >0 (
  12192. >>>3 byte <0x7F \bdevice %d)
  12193. >>>3 byte =0x7F \bbroadcast id)
  12194. >>3 byte 0x7f Microwave I
  12195. >>>4 byte 0x00 SNDR (Sound Request)
  12196. >>>4 byte 0x10 SNDD (Sound Dump)
  12197. >>>4 byte 0x20 SNDP (Sound Parameter Change)
  12198. >>>4 byte 0x30 SNDQ (Sound Parameter Inquiry)
  12199. >>>4 byte 0x70 BOOT (Sound Reserved)
  12200. >>>4 byte 0x01 MULR (Multi Request)
  12201. >>>4 byte 0x11 MULD (Multi Dump)
  12202. >>>4 byte 0x21 MULP (Multi Parameter Change)
  12203. >>>4 byte 0x31 MULQ (Multi Parameter Inquiry)
  12204. >>>4 byte 0x71 OS (Multi Reserved)
  12205. >>>4 byte 0x02 DRMR (Drum Map Request)
  12206. >>>4 byte 0x12 DRMD (Drum Map Dump)
  12207. >>>4 byte 0x22 DRMP (Drum Map Parameter Change)
  12208. >>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry)
  12209. >>>4 byte 0x72 BIN (Drum Map Reserved)
  12210. >>>4 byte 0x03 PATR (Sequencer Pattern Request)
  12211. >>>4 byte 0x13 PATD (Sequencer Pattern Dump)
  12212. >>>4 byte 0x23 PATP (Sequencer Pattern Parameter Change)
  12213. >>>4 byte 0x33 PATQ (Sequencer Pattern Parameter Inquiry)
  12214. >>>4 byte 0x73 AFM (Sequencer Pattern Reserved)
  12215. >>>4 byte 0x04 GLBR (Global Parameter Request)
  12216. >>>4 byte 0x14 GLBD (Global Parameter Dump)
  12217. >>>4 byte 0x24 GLBP (Global Parameter Parameter Change)
  12218. >>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry)
  12219. >>>4 byte 0x07 MODR (Mode Parameter Request)
  12220. >>>4 byte 0x17 MODD (Mode Parameter Dump)
  12221. >>>4 byte 0x27 MODP (Mode Parameter Parameter Change)
  12222. >>>4 byte 0x37 MODQ (Mode Parameter Parameter Inquiry)
  12223. >>2 byte 0x10 microQ
  12224. >>>4 byte 0x00 SNDR (Sound Request)
  12225. >>>4 byte 0x10 SNDD (Sound Dump)
  12226. >>>4 byte 0x20 SNDP (Sound Parameter Change)
  12227. >>>4 byte 0x30 SNDQ (Sound Parameter Inquiry)
  12228. >>>4 byte 0x70 (Sound Reserved)
  12229. >>>4 byte 0x01 MULR (Multi Request)
  12230. >>>4 byte 0x11 MULD (Multi Dump)
  12231. >>>4 byte 0x21 MULP (Multi Parameter Change)
  12232. >>>4 byte 0x31 MULQ (Multi Parameter Inquiry)
  12233. >>>4 byte 0x71 OS (Multi Reserved)
  12234. >>>4 byte 0x02 DRMR (Drum Map Request)
  12235. >>>4 byte 0x12 DRMD (Drum Map Dump)
  12236. >>>4 byte 0x22 DRMP (Drum Map Parameter Change)
  12237. >>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry)
  12238. >>>4 byte 0x72 BIN (Drum Map Reserved)
  12239. >>>4 byte 0x04 GLBR (Global Parameter Request)
  12240. >>>4 byte 0x14 GLBD (Global Parameter Dump)
  12241. >>>4 byte 0x24 GLBP (Global Parameter Parameter Change)
  12242. >>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry)
  12243. >>2 byte 0x11 rackAttack
  12244. >>>4 byte 0x00 SNDR (Sound Parameter Request)
  12245. >>>4 byte 0x10 SNDD (Sound Parameter Dump)
  12246. >>>4 byte 0x20 SNDP (Sound Parameter Parameter Change)
  12247. >>>4 byte 0x30 SNDQ (Sound Parameter Parameter Inquiry)
  12248. >>>4 byte 0x01 PRGR (Program Parameter Request)
  12249. >>>4 byte 0x11 PRGD (Program Parameter Dump)
  12250. >>>4 byte 0x21 PRGP (Program Parameter Parameter Change)
  12251. >>>4 byte 0x31 PRGQ (Program Parameter Parameter Inquiry)
  12252. >>>4 byte 0x71 OS (Program Parameter Reserved)
  12253. >>>4 byte 0x03 PATR (Pattern Parameter Request)
  12254. >>>4 byte 0x13 PATD (Pattern Parameter Dump)
  12255. >>>4 byte 0x23 PATP (Pattern Parameter Parameter Change)
  12256. >>>4 byte 0x33 PATQ (Pattern Parameter Parameter Inquiry)
  12257. >>>4 byte 0x04 GLBR (Global Parameter Request)
  12258. >>>4 byte 0x14 GLBD (Global Parameter Dump)
  12259. >>>4 byte 0x24 GLBP (Global Parameter Parameter Change)
  12260. >>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry)
  12261. >>>4 byte 0x05 EFXR (FX Parameter Request)
  12262. >>>4 byte 0x15 EFXD (FX Parameter Dump)
  12263. >>>4 byte 0x25 EFXP (FX Parameter Parameter Change)
  12264. >>>4 byte 0x35 EFXQ (FX Parameter Parameter Inquiry)
  12265. >>>4 byte 0x07 MODR (Mode Command Request)
  12266. >>>4 byte 0x17 MODD (Mode Command Dump)
  12267. >>>4 byte 0x27 MODP (Mode Command Parameter Change)
  12268. >>>4 byte 0x37 MODQ (Mode Command Parameter Inquiry)
  12269. >>2 byte 0x03 Wave
  12270. >>>4 byte 0x00 SBPR (Soundprogram)
  12271. >>>4 byte 0x01 SAPR (Performance)
  12272. >>>4 byte 0x02 SWAVE (Wave)
  12273. >>>4 byte 0x03 SWTBL (Wave control table)
  12274. >>>4 byte 0x04 SVT (Velocity Curve)
  12275. >>>4 byte 0x05 STT (Tuning Table)
  12276. >>>4 byte 0x06 SGLB (Global Parameters)
  12277. >>>4 byte 0x07 SARRMAP (Performance Program Change Map)
  12278. >>>4 byte 0x08 SBPRMAP (Sound Program Change Map)
  12279. >>>4 byte 0x09 SBPRPAR (Sound Parameter)
  12280. >>>4 byte 0x0A SARRPAR (Performance Parameter)
  12281. >>>4 byte 0x0B SINSPAR (Instrument/External Parameter)
  12282. >>>4 byte 0x0F SBULK (Bulk Switch on/off)
  12283.  
  12284. # Japanese Group
  12285. >1 byte 0x40 Kawai
  12286. >>3 byte 0x20 K1
  12287. >>3 byte 0x22 K4
  12288.  
  12289. >1 byte 0x41 Roland
  12290. >>3 byte 0x14 D-50
  12291. >>3 byte 0x2b U-220
  12292. >>3 byte 0x02 TR-707
  12293.  
  12294. >1 byte 0x42 Korg
  12295. >>3 byte 0x19 M1
  12296.  
  12297. >1 byte 0x43 Yamaha
  12298. >1 byte 0x44 Casio
  12299. >1 byte 0x46 Kamiya
  12300. >1 byte 0x47 Akai
  12301. >1 byte 0x48 Victor
  12302. >1 byte 0x49 Mesosha
  12303. >1 byte 0x4b Fujitsu
  12304. >1 byte 0x4c Sony
  12305. >1 byte 0x4e Teac
  12306. >1 byte 0x50 Matsushita
  12307. >1 byte 0x51 Fostex
  12308. >1 byte 0x52 Zoom
  12309. >1 byte 0x54 Matsushita
  12310. >1 byte 0x57 Acoustic tech. lab.
  12311.  
  12312. >1 belong&0xffffff00 0x00007400 Ta Horng
  12313. >1 belong&0xffffff00 0x00007500 e-Tek
  12314. >1 belong&0xffffff00 0x00007600 E-Voice
  12315. >1 belong&0xffffff00 0x00007700 Midisoft
  12316. >1 belong&0xffffff00 0x00007800 Q-Sound
  12317. >1 belong&0xffffff00 0x00007900 Westrex
  12318. >1 belong&0xffffff00 0x00007a00 Nvidia*
  12319. >1 belong&0xffffff00 0x00007b00 ESS
  12320. >1 belong&0xffffff00 0x00007c00 Mediatrix
  12321. >1 belong&0xffffff00 0x00007d00 Brooktree
  12322. >1 belong&0xffffff00 0x00007e00 Otari
  12323. >1 belong&0xffffff00 0x00007f00 Key Electronics
  12324. >1 belong&0xffffff00 0x00010000 Shure
  12325. >1 belong&0xffffff00 0x00010100 AuraSound
  12326. >1 belong&0xffffff00 0x00010200 Crystal
  12327. >1 belong&0xffffff00 0x00010300 Rockwell
  12328. >1 belong&0xffffff00 0x00010400 Silicon Graphics
  12329. >1 belong&0xffffff00 0x00010500 Midiman
  12330. >1 belong&0xffffff00 0x00010600 PreSonus
  12331. >1 belong&0xffffff00 0x00010800 Topaz
  12332. >1 belong&0xffffff00 0x00010900 Cast Lightning
  12333. >1 belong&0xffffff00 0x00010a00 Microsoft
  12334. >1 belong&0xffffff00 0x00010b00 Sonic Foundry
  12335. >1 belong&0xffffff00 0x00010c00 Line 6
  12336. >1 belong&0xffffff00 0x00010d00 Beatnik Inc.
  12337. >1 belong&0xffffff00 0x00010e00 Van Koerving
  12338. >1 belong&0xffffff00 0x00010f00 Altech Systems
  12339. >1 belong&0xffffff00 0x00011000 S & S Research
  12340. >1 belong&0xffffff00 0x00011100 VLSI Technology
  12341. >1 belong&0xffffff00 0x00011200 Chromatic
  12342. >1 belong&0xffffff00 0x00011300 Sapphire
  12343. >1 belong&0xffffff00 0x00011400 IDRC
  12344. >1 belong&0xffffff00 0x00011500 Justonic Tuning
  12345. >1 belong&0xffffff00 0x00011600 TorComp
  12346. >1 belong&0xffffff00 0x00011700 Newtek Inc.
  12347. >1 belong&0xffffff00 0x00011800 Sound Sculpture
  12348. >1 belong&0xffffff00 0x00011900 Walker Technical
  12349. >1 belong&0xffffff00 0x00011a00 Digital Harmony
  12350. >1 belong&0xffffff00 0x00011b00 InVision
  12351. >1 belong&0xffffff00 0x00011c00 T-Square
  12352. >1 belong&0xffffff00 0x00011d00 Nemesys
  12353. >1 belong&0xffffff00 0x00011e00 DBX
  12354. >1 belong&0xffffff00 0x00011f00 Syndyne
  12355. >1 belong&0xffffff00 0x00012000 Bitheadz
  12356. >1 belong&0xffffff00 0x00012100 Cakewalk
  12357. >1 belong&0xffffff00 0x00012200 Staccato
  12358. >1 belong&0xffffff00 0x00012300 National Semicon.
  12359. >1 belong&0xffffff00 0x00012400 Boom Theory
  12360. >1 belong&0xffffff00 0x00012500 Virtual DSP Corp
  12361. >1 belong&0xffffff00 0x00012600 Antares
  12362. >1 belong&0xffffff00 0x00012700 Angel Software
  12363. >1 belong&0xffffff00 0x00012800 St Louis Music
  12364. >1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX
  12365. >1 belong&0xffffff00 0x00012a00 Ashley Audio
  12366. >1 belong&0xffffff00 0x00012b00 Vari-Lite
  12367. >1 belong&0xffffff00 0x00012c00 Summit Audio
  12368. >1 belong&0xffffff00 0x00012d00 Aureal Semicon.
  12369. >1 belong&0xffffff00 0x00012e00 SeaSound
  12370. >1 belong&0xffffff00 0x00012f00 U.S. Robotics
  12371. >1 belong&0xffffff00 0x00013000 Aurisis
  12372. >1 belong&0xffffff00 0x00013100 Nearfield Multimedia
  12373. >1 belong&0xffffff00 0x00013200 FM7 Inc.
  12374. >1 belong&0xffffff00 0x00013300 Swivel Systems
  12375. >1 belong&0xffffff00 0x00013400 Hyperactive
  12376. >1 belong&0xffffff00 0x00013500 MidiLite
  12377. >1 belong&0xffffff00 0x00013600 Radical
  12378. >1 belong&0xffffff00 0x00013700 Roger Linn
  12379. >1 belong&0xffffff00 0x00013800 Helicon
  12380. >1 belong&0xffffff00 0x00013900 Event
  12381. >1 belong&0xffffff00 0x00013a00 Sonic Network
  12382. >1 belong&0xffffff00 0x00013b00 Realtime Music
  12383. >1 belong&0xffffff00 0x00013c00 Apogee Digital
  12384.  
  12385. >1 belong&0xffffff00 0x00202b00 Medeli Electronics
  12386. >1 belong&0xffffff00 0x00202c00 Charlie Lab
  12387. >1 belong&0xffffff00 0x00202d00 Blue Chip Music
  12388. >1 belong&0xffffff00 0x00202e00 BEE OH Corp
  12389. >1 belong&0xffffff00 0x00202f00 LG Semicon America
  12390. >1 belong&0xffffff00 0x00203000 TESI
  12391. >1 belong&0xffffff00 0x00203100 EMAGIC
  12392. >1 belong&0xffffff00 0x00203200 Behringer
  12393. >1 belong&0xffffff00 0x00203300 Access Music
  12394. >1 belong&0xffffff00 0x00203400 Synoptic
  12395. >1 belong&0xffffff00 0x00203500 Hanmesoft Corp
  12396. >1 belong&0xffffff00 0x00203600 Terratec
  12397. >1 belong&0xffffff00 0x00203700 Proel SpA
  12398. >1 belong&0xffffff00 0x00203800 IBK MIDI
  12399. >1 belong&0xffffff00 0x00203900 IRCAM
  12400. >1 belong&0xffffff00 0x00203a00 Propellerhead Software
  12401. >1 belong&0xffffff00 0x00203b00 Red Sound Systems
  12402. >1 belong&0xffffff00 0x00203c00 Electron ESI AB
  12403. >1 belong&0xffffff00 0x00203d00 Sintefex Audio
  12404. >1 belong&0xffffff00 0x00203e00 Music and More
  12405. >1 belong&0xffffff00 0x00203f00 Amsaro
  12406. >1 belong&0xffffff00 0x00204000 CDS Advanced Technology
  12407. >1 belong&0xffffff00 0x00204100 Touched by Sound
  12408. >1 belong&0xffffff00 0x00204200 DSP Arts
  12409. >1 belong&0xffffff00 0x00204300 Phil Rees Music
  12410. >1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH
  12411. >1 belong&0xffffff00 0x00204500 Soundart
  12412. >1 belong&0xffffff00 0x00204600 C-Mexx Software
  12413. >1 belong&0xffffff00 0x00204700 Klavis Tech.
  12414. >1 belong&0xffffff00 0x00204800 Noteheads AB
  12415.  
  12416. 0 string T707 Roland TR-707 Data
  12417. #------------------------------------------------------------------------------
  12418. # teapot: file(1) magic for "teapot" spreadsheet
  12419. #
  12420. 0 string #!teapot\012xdr teapot work sheet (XDR format)
  12421.  
  12422. #------------------------------------------------------------------------------
  12423. # terminfo: file(1) magic for terminfo
  12424. #
  12425. # XXX - byte order for screen images?
  12426. #
  12427. 0 string \032\001 Compiled terminfo entry
  12428. 0 short 0433 Curses screen image
  12429. 0 short 0434 Curses screen image
  12430.  
  12431. #------------------------------------------------------------------------------
  12432. # tex: file(1) magic for TeX files
  12433. #
  12434. # From <conklin@talisman.kaleida.com>
  12435.  
  12436. # Although we may know the offset of certain text fields in TeX DVI
  12437. # and font files, we can't use them reliably because they are not
  12438. # zero terminated. [but we do anyway, christos]
  12439. 0 string \367\002 TeX DVI file
  12440. >16 string >\0 (%s)
  12441. 0 string \367\203 TeX generic font data
  12442. 0 string \367\131 TeX packed font data
  12443. >3 string >\0 (%s)
  12444. 0 string \367\312 TeX virtual font data
  12445. 0 string This\ is\ TeX, TeX transcript text
  12446. 0 string This\ is\ METAFONT, METAFONT transcript text
  12447.  
  12448. # There is no way to detect TeX Font Metric (*.tfm) files without
  12449. # breaking them apart and reading the data. The following patterns
  12450. # match most *.tfm files generated by METAFONT or afm2tfm.
  12451. 2 string \000\021 TeX font metric data
  12452. >33 string >\0 (%s)
  12453. 2 string \000\022 TeX font metric data
  12454. >33 string >\0 (%s)
  12455.  
  12456. # Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
  12457. 0 string \\input\ texinfo Texinfo source text
  12458. 0 string This\ is\ Info\ file GNU Info text
  12459.  
  12460. # TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
  12461. 0 search/400 \\input TeX document text
  12462. 0 search/400 \\section LaTeX document text
  12463. 0 search/400 \\setlength LaTeX document text
  12464. 0 search/400 \\documentstyle LaTeX document text
  12465. 0 search/400 \\chapter LaTeX document text
  12466. 0 search/400 \\documentclass LaTeX 2e document text
  12467. 0 search/400 \\relax LaTeX auxiliary file
  12468. 0 search/400 \\contentsline LaTeX table of contents
  12469. 0 search/400 %\ -*-latex-*- LaTeX document text
  12470.  
  12471. # Tex document, from Hendrik Scholz <hendrik@scholz.net>
  12472. 0 string \\ifx TeX document text
  12473.  
  12474. # Index and glossary files
  12475. 0 search/400 \\indexentry LaTeX raw index file
  12476. 0 search/400 \\begin{theindex} LaTeX sorted index
  12477. 0 search/400 \\glossaryentry LaTeX raw glossary
  12478. 0 search/400 \\begin{theglossary} LaTeX sorted glossary
  12479. 0 search/400 This\ is\ makeindex Makeindex log file
  12480.  
  12481. # End of TeX
  12482.  
  12483. #------------------------------------------------------------------------------
  12484. # file(1) magic for BibTex text files
  12485. # From Hendrik Scholz <hendrik@scholz.net>
  12486.  
  12487. 0 string/c @article{ BibTeX text file
  12488. 0 string/c @book{ BibTeX text file
  12489. 0 string/c @inbook{ BibTeX text file
  12490. 0 string/c @incollection{ BibTeX text file
  12491. 0 string/c @inproceedings{ BibTeX text file
  12492. 0 string/c @manual{ BibTeX text file
  12493. 0 string/c @misc{ BibTeX text file
  12494. 0 string/c @preamble{ BibTeX text file
  12495. 0 string/c @phdthesis{ BibTeX text file
  12496. 0 string/c @techreport{ BibTeX text file
  12497. 0 string/c @unpublished{ BibTeX text file
  12498.  
  12499. 73 string %%%\ \ BibTeX-file{ BibTex text file (with full header)
  12500.  
  12501. 73 string %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header)
  12502.  
  12503. 0 string %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file
  12504.  
  12505. 0 string %\ BibTeX\ ` BibTeX custom bibliography style text file
  12506.  
  12507. 0 string @c\ @mapfile{ TeX font aliases text file
  12508.  
  12509. #------------------------------------------------------------------------------
  12510. # file(1) magic for tgif(1) files
  12511. # From Hendrik Scholz <hendrik@scholz.net>
  12512.  
  12513. 0 string %TGIF\ x Tgif file version %s
  12514.  
  12515. # ------------------------------------------------------------------------
  12516. # ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators.
  12517. #
  12518. # From: Ryan McGuire (rmcguire@freenet.columbus.oh.us).
  12519. #
  12520. # Update: Romain Lievin (roms@lpg.ticalc.org).
  12521. #
  12522. # NOTE: This list is not complete.
  12523. # Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the
  12524. # program/group magic numbers in here because I cannot find any.
  12525. 0 string **TI80** TI-80 Graphing Calculator File.
  12526. 0 string **TI81** TI-81 Graphing Calculator File.
  12527. #
  12528. # Magic Numbers for the TI-73
  12529. #
  12530. 0 string **TI73** TI-73 Graphing Calculator
  12531. >0x00003B byte 0x00 (real number)
  12532. >0x00003B byte 0x01 (list)
  12533. >0x00003B byte 0x02 (matrix)
  12534. >0x00003B byte 0x03 (equation)
  12535. >0x00003B byte 0x04 (string)
  12536. >0x00003B byte 0x05 (program)
  12537. >0x00003B byte 0x06 (assembly program)
  12538. >0x00003B byte 0x07 (picture)
  12539. >0x00003B byte 0x08 (gdb)
  12540. >0x00003B byte 0x0C (complex number)
  12541. >0x00003B byte 0x0F (window settings)
  12542. >0x00003B byte 0x10 (zoom)
  12543. >0x00003B byte 0x11 (table setup)
  12544. >0x00003B byte 0x13 (backup)
  12545.  
  12546. # Magic Numbers for the TI-82
  12547. #
  12548. 0 string **TI82** TI-82 Graphing Calculator
  12549. >0x00003B byte 0x00 (real)
  12550. >0x00003B byte 0x01 (list)
  12551. >0x00003B byte 0x02 (matrix)
  12552. >0x00003B byte 0x03 (Y-variable)
  12553. >0x00003B byte 0x05 (program)
  12554. >0x00003B byte 0x06 (protected prgm)
  12555. >0x00003B byte 0x07 (picture)
  12556. >0x00003B byte 0x08 (gdb)
  12557. >0x00003B byte 0x0B (window settings)
  12558. >0x00003B byte 0x0C (window settings)
  12559. >0x00003B byte 0x0D (table setup)
  12560. >0x00003B byte 0x0E (screenshot)
  12561. >0x00003B byte 0x0F (backup)
  12562. #
  12563. # Magic Numbers for the TI-83
  12564. #
  12565. 0 string **TI83** TI-83 Graphing Calculator
  12566. >0x00003B byte 0x00 (real)
  12567. >0x00003B byte 0x01 (list)
  12568. >0x00003B byte 0x02 (matrix)
  12569. >0x00003B byte 0x03 (Y-variable)
  12570. >0x00003B byte 0x04 (string)
  12571. >0x00003B byte 0x05 (program)
  12572. >0x00003B byte 0x06 (protected prgm)
  12573. >0x00003B byte 0x07 (picture)
  12574. >0x00003B byte 0x08 (gdb)
  12575. >0x00003B byte 0x0B (window settings)
  12576. >0x00003B byte 0x0C (window settings)
  12577. >0x00003B byte 0x0D (table setup)
  12578. >0x00003B byte 0x0E (screenshot)
  12579. >0x00003B byte 0x13 (backup)
  12580. #
  12581. # Magic Numbers for the TI-83+
  12582. #
  12583. 0 string **TI83F* TI-83+ Graphing Calculator
  12584. >0x00003B byte 0x00 (real number)
  12585. >0x00003B byte 0x01 (list)
  12586. >0x00003B byte 0x02 (matrix)
  12587. >0x00003B byte 0x03 (equation)
  12588. >0x00003B byte 0x04 (string)
  12589. >0x00003B byte 0x05 (program)
  12590. >0x00003B byte 0x06 (assembly program)
  12591. >0x00003B byte 0x07 (picture)
  12592. >0x00003B byte 0x08 (gdb)
  12593. >0x00003B byte 0x0C (complex number)
  12594. >0x00003B byte 0x0F (window settings)
  12595. >0x00003B byte 0x10 (zoom)
  12596. >0x00003B byte 0x11 (table setup)
  12597. >0x00003B byte 0x13 (backup)
  12598. >0x00003B byte 0x15 (application variable)
  12599. >0x00003B byte 0x17 (group of variable)
  12600.  
  12601. #
  12602. # Magic Numbers for the TI-85
  12603. #
  12604. 0 string **TI85** TI-85 Graphing Calculator
  12605. >0x00003B byte 0x00 (real number)
  12606. >0x00003B byte 0x01 (complex number)
  12607. >0x00003B byte 0x02 (real vector)
  12608. >0x00003B byte 0x03 (complex vector)
  12609. >0x00003B byte 0x04 (real list)
  12610. >0x00003B byte 0x05 (complex list)
  12611. >0x00003B byte 0x06 (real matrix)
  12612. >0x00003B byte 0x07 (complex matrix)
  12613. >0x00003B byte 0x08 (real constant)
  12614. >0x00003B byte 0x09 (complex constant)
  12615. >0x00003B byte 0x0A (equation)
  12616. >0x00003B byte 0x0C (string)
  12617. >0x00003B byte 0x0D (function GDB)
  12618. >0x00003B byte 0x0E (polar GDB)
  12619. >0x00003B byte 0x0F (parametric GDB)
  12620. >0x00003B byte 0x10 (diffeq GDB)
  12621. >0x00003B byte 0x11 (picture)
  12622. >0x00003B byte 0x12 (program)
  12623. >0x00003B byte 0x13 (range)
  12624. >0x00003B byte 0x17 (window settings)
  12625. >0x00003B byte 0x18 (window settings)
  12626. >0x00003B byte 0x19 (window settings)
  12627. >0x00003B byte 0x1A (window settings)
  12628. >0x00003B byte 0x1B (zoom)
  12629. >0x00003B byte 0x1D (backup)
  12630. >0x00003B byte 0x1E (unknown)
  12631. >0x00003B byte 0x2A (equation)
  12632. >0x000032 string ZS4 - ZShell Version 4 File.
  12633. >0x000032 string ZS3 - ZShell Version 3 File.
  12634. #
  12635. # Magic Numbers for the TI-86
  12636. #
  12637. 0 string **TI86** TI-86 Graphing Calculator
  12638. >0x00003B byte 0x00 (real number)
  12639. >0x00003B byte 0x01 (complex number)
  12640. >0x00003B byte 0x02 (real vector)
  12641. >0x00003B byte 0x03 (complex vector)
  12642. >0x00003B byte 0x04 (real list)
  12643. >0x00003B byte 0x05 (complex list)
  12644. >0x00003B byte 0x06 (real matrix)
  12645. >0x00003B byte 0x07 (complex matrix)
  12646. >0x00003B byte 0x08 (real constant)
  12647. >0x00003B byte 0x09 (complex constant)
  12648. >0x00003B byte 0x0A (equation)
  12649. >0x00003B byte 0x0C (string)
  12650. >0x00003B byte 0x0D (function GDB)
  12651. >0x00003B byte 0x0E (polar GDB)
  12652. >0x00003B byte 0x0F (parametric GDB)
  12653. >0x00003B byte 0x10 (diffeq GDB)
  12654. >0x00003B byte 0x11 (picture)
  12655. >0x00003B byte 0x12 (program)
  12656. >0x00003B byte 0x13 (range)
  12657. >0x00003B byte 0x17 (window settings)
  12658. >0x00003B byte 0x18 (window settings)
  12659. >0x00003B byte 0x19 (window settings)
  12660. >0x00003B byte 0x1A (window settings)
  12661. >0x00003B byte 0x1B (zoom)
  12662. >0x00003B byte 0x1D (backup)
  12663. >0x00003B byte 0x1E (unknown)
  12664. >0x00003B byte 0x2A (equation)
  12665. #
  12666. # Magic Numbers for the TI-89
  12667. #
  12668. 0 string **TI89** TI-89 Graphing Calculator
  12669. >0x000048 byte 0x00 (expression)
  12670. >0x000048 byte 0x04 (list)
  12671. >0x000048 byte 0x06 (matrix)
  12672. >0x000048 byte 0x0A (data)
  12673. >0x000048 byte 0x0B (text)
  12674. >0x000048 byte 0x0C (string)
  12675. >0x000048 byte 0x0D (graphic data base)
  12676. >0x000048 byte 0x0E (figure)
  12677. >0x000048 byte 0x10 (picture)
  12678. >0x000048 byte 0x12 (program)
  12679. >0x000048 byte 0x13 (function)
  12680. >0x000048 byte 0x14 (macro)
  12681. >0x000048 byte 0x1C (zipped)
  12682. >0x000048 byte 0x21 (assembler)
  12683. #
  12684. # Magic Numbers for the TI-92
  12685. #
  12686. 0 string **TI92** TI-92 Graphing Calculator
  12687. >0x000048 byte 0x00 (expression)
  12688. >0x000048 byte 0x04 (list)
  12689. >0x000048 byte 0x06 (matrix)
  12690. >0x000048 byte 0x0A (data)
  12691. >0x000048 byte 0x0B (text)
  12692. >0x000048 byte 0x0C (string)
  12693. >0x000048 byte 0x0D (graphic data base)
  12694. >0x000048 byte 0x0E (figure)
  12695. >0x000048 byte 0x10 (picture)
  12696. >0x000048 byte 0x12 (program)
  12697. >0x000048 byte 0x13 (function)
  12698. >0x000048 byte 0x14 (macro)
  12699. >0x000048 byte 0x1D (backup)
  12700. #
  12701. # Magic Numbers for the TI-92+/V200
  12702. #
  12703. 0 string **TI92P* TI-92+/V200 Graphing Calculator
  12704. >0x000048 byte 0x00 (expression)
  12705. >0x000048 byte 0x04 (list)
  12706. >0x000048 byte 0x06 (matrix)
  12707. >0x000048 byte 0x0A (data)
  12708. >0x000048 byte 0x0B (text)
  12709. >0x000048 byte 0x0C (string)
  12710. >0x000048 byte 0x0D (graphic data base)
  12711. >0x000048 byte 0x0E (figure)
  12712. >0x000048 byte 0x10 (picture)
  12713. >0x000048 byte 0x12 (program)
  12714. >0x000048 byte 0x13 (function)
  12715. >0x000048 byte 0x14 (macro)
  12716. >0x000048 byte 0x1C (zipped)
  12717. >0x000048 byte 0x21 (assembler)
  12718. #
  12719. # Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades
  12720. #
  12721. 0x0000016 string Advanced TI-XX Graphing Calculator (FLASH)
  12722. 0 string **TIFL** TI-XX Graphing Calculator (FLASH)
  12723. >8 byte >0 - Revision %d
  12724. >>9 byte x \b.%d,
  12725. >12 byte >0 Revision date %02x
  12726. >>13 byte x \b/%02x
  12727. >>14 beshort x \b/%04x,
  12728. >17 string >/0 name: '%s',
  12729. >48 byte 0x74 device: TI-73,
  12730. >48 byte 0x73 device: TI-83+,
  12731. >48 byte 0x98 device: TI-89,
  12732. >48 byte 0x88 device: TI-92+,
  12733. >49 byte 0x23 type: OS upgrade,
  12734. >49 byte 0x24 type: application,
  12735. >49 byte 0x25 type: certificate,
  12736. >49 byte 0x3e type: license,
  12737. >74 lelong >0 size: %ld bytes
  12738.  
  12739. # VTi & TiEmu skins (TI Graphing Calculators).
  12740. # From: Romain Lievin (roms@lpg.ticalc.org).
  12741. # Magic Numbers for the VTi skins
  12742. 0 string VTI Virtual TI skin
  12743. >3 string v - Version
  12744. >>4 byte >0 \b %c
  12745. >>6 byte x \b.%c
  12746. # Magic Numbers for the TiEmu skins
  12747. 0 string TiEmu TiEmu skin
  12748. >6 string v - Version
  12749. >>7 byte >0 \b %c
  12750. >>9 byte x \b.%c
  12751. >>10 byte x \b%c
  12752.  
  12753. #------------------------------------------------------------------------------
  12754. # timezone: file(1) magic for timezone data
  12755. #
  12756. # from Daniel Quinlan (quinlan@yggdrasil.com)
  12757. # this should work on Linux, SunOS, and maybe others
  12758. # Added new official magic number for recent versions of the Olson code
  12759. 0 string TZif timezone data
  12760. 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data
  12761. 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data
  12762. 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data
  12763. 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data
  12764. 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data
  12765. 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data
  12766.  
  12767. #------------------------------------------------------------------------------
  12768. # troff: file(1) magic for *roff
  12769. #
  12770. # updated by Daniel Quinlan (quinlan@yggdrasil.com)
  12771.  
  12772. # troff input
  12773. 0 string .\\" troff or preprocessor input text
  12774. 0 string '\\" troff or preprocessor input text
  12775. 0 string '.\\" troff or preprocessor input text
  12776. 0 string \\" troff or preprocessor input text
  12777. 0 string ''' troff or preprocessor input text
  12778.  
  12779. # ditroff intermediate output text
  12780. 0 string x\ T ditroff output text
  12781. >4 string cat for the C/A/T phototypesetter
  12782. >4 string ps for PostScript
  12783. >4 string dvi for DVI
  12784. >4 string ascii for ASCII
  12785. >4 string lj4 for LaserJet 4
  12786. >4 string latin1 for ISO 8859-1 (Latin 1)
  12787. >4 string X75 for xditview at 75dpi
  12788. >>7 string -12 (12pt)
  12789. >4 string X100 for xditview at 100dpi
  12790. >>8 string -12 (12pt)
  12791.  
  12792. # output data formats
  12793. 0 string \100\357 very old (C/A/T) troff output data
  12794. #
  12795. #------------------------------------------------------------------------------
  12796. # tuxedo: file(1) magic for BEA TUXEDO data files
  12797. #
  12798. # from Ian Springer <ispringer@hotmail.com>
  12799. #
  12800. 0 string \0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0 BEA TUXEDO DES mask data
  12801.  
  12802. #------------------------------------------------------------------------------
  12803. # typeset: file(1) magic for other typesetting
  12804. #
  12805. 0 string Interpress/Xerox Xerox InterPress data
  12806. >16 string / (version
  12807. >>17 string >\0 %s)
  12808.  
  12809. #------------------------------------------------------------------------------
  12810. # unknown: file(1) magic for unknown machines
  12811. #
  12812. # XXX - this probably should be pruned, as it'll match PDP-11 and
  12813. # VAX image formats.
  12814. #
  12815. # 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure,
  12816. # respectively).
  12817. #
  12818. # 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't
  12819. # have the "version %ld", which may be a bogus COFFism (I don't think
  12820. # there ever was COFF for the PDP-11).
  12821. #
  12822. # 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
  12823. # long, as it would be on a VAX.
  12824. #
  12825. # 0x10C is 0414 and 0x10E is 416; those *are* unknown.
  12826. #
  12827. 0 short 0x107 unknown machine executable
  12828. >8 short >0 not stripped
  12829. >15 byte >0 - version %ld
  12830. 0 short 0x108 unknown pure executable
  12831. >8 short >0 not stripped
  12832. >15 byte >0 - version %ld
  12833. 0 short 0x109 PDP-11 separate I&D
  12834. >8 short >0 not stripped
  12835. >15 byte >0 - version %ld
  12836. 0 short 0x10b unknown pure executable
  12837. >8 short >0 not stripped
  12838. >15 byte >0 - version %ld
  12839. 0 long 0x10c unknown demand paged pure executable
  12840. >16 long >0 not stripped
  12841. 0 long 0x10e unknown readable demand paged pure executable
  12842.  
  12843. #---------------------------------------------------------------------------
  12844. # Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp>
  12845. #
  12846. 0 string +/v8 Unicode text, UTF-7
  12847. 0 string +/v9 Unicode text, UTF-7
  12848. 0 string +/v+ Unicode text, UTF-7
  12849. 0 string +/v/ Unicode text, UTF-7
  12850. 0 string \357\273\277 Unicode text, UTF-8
  12851. 0 string \335\163\146\163 Unicode text, UTF-8-EBCDIC
  12852. 0 string \376\377\000\000 Unicode text, UTF-32, big-endian
  12853. 0 string \377\376\000\000 Unicode text, UTF-32, little-endian
  12854. 0 string \376\377 Unicode text, UTF-16, big-endian
  12855. 0 string \377\376 Unicode text, UTF-16, little-endian
  12856. 0 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode)
  12857.  
  12858. #------------------------------------------------------------------------------
  12859. # uuencode: file(1) magic for ASCII-encoded files
  12860. #
  12861.  
  12862. # GRR: the first line of xxencoded files is identical to that in uuencoded
  12863. # files, but the first character in most subsequent lines is 'h' instead of
  12864. # 'M'. (xxencoding uses lowercase letters in place of most of uuencode's
  12865. # punctuation and survives BITNET gateways better.) If regular expressions
  12866. # were supported, this entry could possibly be split into two with
  12867. # "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
  12868. 0 string begin\040 uuencoded or xxencoded text
  12869.  
  12870. # btoa(1) is an alternative to uuencode that requires less space.
  12871. 0 string xbtoa\ Begin btoa'd text
  12872.  
  12873. # ship(1) is another, much cooler alternative to uuencode.
  12874. # Greg Roelofs, newt@uchicago.edu
  12875. 0 string $\012ship ship'd binary text
  12876.  
  12877. # bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
  12878. # Greg Roelofs, newt@uchicago.edu
  12879. 0 string Decode\ the\ following\ with\ bdeco bencoded News text
  12880.  
  12881. # BinHex is the Macintosh ASCII-encoded file format (see also "apple")
  12882. # Daniel Quinlan, quinlan@yggdrasil.com
  12883. 11 string must\ be\ converted\ with\ BinHex BinHex binary text
  12884. >41 string x \b, version %.3s
  12885.  
  12886. # GRR: is MIME BASE64 encoding handled somewhere?
  12887.  
  12888. #------------------------------------------------------------------------------
  12889. # varied.out: file(1) magic for various USG systems
  12890. #
  12891. # Herewith many of the object file formats used by USG systems.
  12892. # Most have been moved to files for a particular processor,
  12893. # and deleted if they duplicate other entries.
  12894. #
  12895. 0 short 0610 Perkin-Elmer executable
  12896. # AMD 29K
  12897. 0 beshort 0572 amd 29k coff noprebar executable
  12898. 0 beshort 01572 amd 29k coff prebar executable
  12899. 0 beshort 0160007 amd 29k coff archive
  12900. # Cray
  12901. 6 beshort 0407 unicos (cray) executable
  12902. # Ultrix 4.3
  12903. 596 string \130\337\377\377 Ultrix core file
  12904. >600 string >\0 from '%s'
  12905. # BeOS and MAcOS PEF executables
  12906. # From: hplus@zilker.net (Jon Watte)
  12907. 0 string Joy!peffpwpc header for PowerPC PEF executable
  12908. #
  12909. # ava assembler/linker Uros Platise <uros.platise@ijs.si>
  12910. 0 string avaobj AVR assembler object code
  12911. >7 string >\0 version '%s'
  12912. # gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr>
  12913. 0 string gmon GNU prof performance data
  12914. >4 long x - version %ld
  12915. # From: Dave Pearson <davep@davep.org>
  12916. # Harbour <URL:http://www.harbour-project.org/> HRB files.
  12917. 0 string \xc0HRB Harbour HRB file
  12918. >4 short x version %d
  12919.  
  12920. # From: Alex Beregszaszi <alex@fsn.hu>
  12921. # 0 string exec BugOS executable
  12922. # 0 string pack BugOS archive
  12923.  
  12924. # From: Jason Spence <jspence@lightconsulting.com>
  12925. # Generated by the "examples" in STM's ST40 devkit, and derived code.
  12926. 0 lelong 0x13a9f17e ST40 component image format
  12927. >4 string >\0 \b, name '%s'
  12928.  
  12929. #------------------------------------------------------------------------------
  12930. # varied.script: file(1) magic for various interpreter scripts
  12931.  
  12932. 0 string #!\ / a
  12933. >3 string >\0 %s script text executable
  12934. 0 string #!\t/ a
  12935. >3 string >\0 %s script text executable
  12936. 0 string #!/ a
  12937. >2 string >\0 %s script text executable
  12938. 0 string #!\ script text executable
  12939. >3 string >\0 for %s
  12940.  
  12941.  
  12942. #------------------------------------------------------------------------------
  12943. # vax: file(1) magic for VAX executable/object and APL workspace
  12944. #
  12945. 0 lelong 0101557 VAX single precision APL workspace
  12946. 0 lelong 0101556 VAX double precision APL workspace
  12947.  
  12948. #
  12949. # VAX a.out (32V, BSD)
  12950. #
  12951. 0 lelong 0407 VAX executable
  12952. >16 lelong >0 not stripped
  12953.  
  12954. 0 lelong 0410 VAX pure executable
  12955. >16 lelong >0 not stripped
  12956.  
  12957. 0 lelong 0413 VAX demand paged pure executable
  12958. >16 lelong >0 not stripped
  12959.  
  12960. 0 lelong 0420 VAX demand paged (first page unmapped) pure executable
  12961. >16 lelong >0 not stripped
  12962.  
  12963. #
  12964. # VAX COFF
  12965. #
  12966. # The `versions' should be un-commented if they work for you.
  12967. # (Was the problem just one of endianness?)
  12968. #
  12969. 0 leshort 0570 VAX COFF executable
  12970. >12 lelong >0 not stripped
  12971. >22 leshort >0 - version %ld
  12972. 0 leshort 0575 VAX COFF pure executable
  12973. >12 lelong >0 not stripped
  12974. >22 leshort >0 - version %ld
  12975.  
  12976. #------------------------------------------------------------------------------
  12977. # vicar: file(1) magic for VICAR files.
  12978. #
  12979. # From: Ossama Othman <othman@astrosun.tn.cornell.edu
  12980. # VICAR is JPL's in-house spacecraft image processing program
  12981. # VICAR image
  12982. 0 string LBLSIZE= VICAR image data
  12983. >32 string BYTE \b, 8 bits = VAX byte
  12984. >32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2
  12985. >32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4
  12986. >32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4
  12987. >32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8
  12988. >32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8
  12989. # VICAR label file
  12990. 43 string SFDU_LABEL VICAR label file
  12991. #------------------------------------------------------------------------------
  12992. # Virtutech Compressed Random Access File Format
  12993. #
  12994. # From <gustav@virtutech.com>
  12995. 0 string \211\277\036\203 Virtutech CRAFF
  12996. >4 belong x v%d
  12997. >20 belong 0 uncompressed
  12998. >20 belong 1 bzipp2ed
  12999. >20 belong 2 gzipped
  13000. >24 belong 0 not clean
  13001.  
  13002. #------------------------------------------------------------------------------
  13003. # visx: file(1) magic for Visx format files
  13004. #
  13005. 0 short 0x5555 VISX image file
  13006. >2 byte 0 (zero)
  13007. >2 byte 1 (unsigned char)
  13008. >2 byte 2 (short integer)
  13009. >2 byte 3 (float 32)
  13010. >2 byte 4 (float 64)
  13011. >2 byte 5 (signed char)
  13012. >2 byte 6 (bit-plane)
  13013. >2 byte 7 (classes)
  13014. >2 byte 8 (statistics)
  13015. >2 byte 10 (ascii text)
  13016. >2 byte 15 (image segments)
  13017. >2 byte 100 (image set)
  13018. >2 byte 101 (unsigned char vector)
  13019. >2 byte 102 (short integer vector)
  13020. >2 byte 103 (float 32 vector)
  13021. >2 byte 104 (float 64 vector)
  13022. >2 byte 105 (signed char vector)
  13023. >2 byte 106 (bit plane vector)
  13024. >2 byte 121 (feature vector)
  13025. >2 byte 122 (feature vector library)
  13026. >2 byte 124 (chain code)
  13027. >2 byte 126 (bit vector)
  13028. >2 byte 130 (graph)
  13029. >2 byte 131 (adjacency graph)
  13030. >2 byte 132 (adjacency graph library)
  13031. >2 string .VISIX (ascii text)
  13032.  
  13033. #------------------------------------------------------------------------------
  13034. # vms: file(1) magic for VMS executables (experimental)
  13035. #
  13036. # VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
  13037.  
  13038. # GRR 950122: I'm just guessing on these, based on inspection of the headers
  13039. # of three executables each for Alpha and VAX architectures. The VAX files
  13040. # all had headers similar to this:
  13041. #
  13042. # 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205
  13043. # 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................
  13044. #
  13045. 0 string \xb0\0\x30\0 VMS VAX executable
  13046. >44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
  13047. #
  13048. # The AXP files all looked like this, except that the byte at offset 0x22
  13049. # was 06 in some of them and 07 in others:
  13050. #
  13051. # 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................
  13052. # 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h...............
  13053. # 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
  13054. # 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
  13055. # 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................
  13056. #
  13057. 0 belong 0x03000000 VMS Alpha executable
  13058. >75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
  13059.  
  13060. # -----------------------------------------------------------
  13061. # VMware specific files (deducted from version 1.1 and log file entries)
  13062. # Anthon van der Neut (anthon@mnt.org)
  13063. 0 belong 0x4d52564e VMware nvram
  13064.  
  13065. #------------------------------------------------------------------------------
  13066. # vorbis: file(1) magic for Ogg/Vorbis files
  13067. #
  13068. # From Felix von Leitner <leitner@fefe.de>
  13069. # Extended by Beni Cherniavsky <cben@crosswinds.net>
  13070. # Further extended by Greg Wooledge <greg@wooledge.org>
  13071. #
  13072. # Most (everything but the number of channels and bitrate) is commented
  13073. # out with `##' as it's not interesting to the average user. The most
  13074. # probable things advanced users would want to uncomment are probably
  13075. # the number of comments and the encoder version.
  13076. #
  13077. # --- Ogg Framing ---
  13078. 0 string OggS Ogg data
  13079. >4 byte !0 UNKNOWN REVISION %u
  13080. ##>4 byte 0 revision 0
  13081. >4 byte 0
  13082. ##>>14 lelong x (Serial %lX)
  13083. # non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net)
  13084. >>28 string fLaC \b, FLAC audio
  13085. # non-Vorbis content: Theora
  13086. >>28 string \x80theora \b, Theora video
  13087. # non-Vorbis content: Speex
  13088. >>28 string Speex\ \ \ \b, Speex audio
  13089. # non-Vorbis content: OGM
  13090. >>28 string \x01video\0\0\0 \b, OGM video
  13091. >>>37 string/c div3 (DivX 3)
  13092. >>>37 string/c divx (DivX 4)
  13093. >>>37 string/c dx50 (DivX 5)
  13094. >>>37 string/c xvid (XviD)
  13095. # --- First vorbis packet - general header ---
  13096. >>28 string \x01vorbis \b, Vorbis audio,
  13097. >>>35 lelong !0 UNKNOWN VERSION %lu,
  13098. ##>>>35 lelong 0 version 0,
  13099. >>>35 lelong 0
  13100. >>>>39 ubyte 1 mono,
  13101. >>>>39 ubyte 2 stereo,
  13102. >>>>39 ubyte >2 %u channels,
  13103. >>>>40 lelong x %lu Hz
  13104. # Minimal, nominal and maximal bitrates specified when encoding
  13105. >>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b,
  13106. # The above tests if at least one of these is specified:
  13107. >>>>>52 lelong !-1
  13108. # Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields
  13109. # instead of -1.
  13110. # Vorbis 1.0 uses 0 instead of -1.
  13111. >>>>>>52 lelong !0
  13112. >>>>>>>52 lelong !-1000
  13113. >>>>>>>>52 lelong x <%lu
  13114. >>>>>48 lelong !-1
  13115. >>>>>>48 lelong x ~%lu
  13116. >>>>>44 lelong !-1
  13117. >>>>>>44 lelong !-1000
  13118. >>>>>>>44 lelong !0
  13119. >>>>>>>>44 lelong x >%lu
  13120. >>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps
  13121. # -- Second vorbis header packet - the comments
  13122. # A kludge to read the vendor string. It's a counted string, not a
  13123. # zero-terminated one, so file(1) can't read it in a generic way.
  13124. # libVorbis is the only one existing currently, so I detect specifically
  13125. # it. The interesting value is the cvs date (8 digits decimal).
  13126. # Post-RC1 Ogg files have the second header packet (and thus the version)
  13127. # in a different place, so we must use an indirect offset.
  13128. >>>(84.b+85) string \x03vorbis
  13129. >>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I
  13130. >>>>>(84.b+120) string >00000000
  13131. # Map to beta version numbers:
  13132. >>>>>>(84.b+120) string <20000508 (<beta1, prepublic)
  13133. >>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2)
  13134. >>>>>>(84.b+120) string >20000508
  13135. >>>>>>>(84.b+120) string <20001031 (beta2-3)
  13136. >>>>>>(84.b+120) string 20001031 (1.0 beta 3)
  13137. >>>>>>(84.b+120) string >20001031
  13138. >>>>>>>(84.b+120) string <20010225 (beta3-4)
  13139. >>>>>>(84.b+120) string 20010225 (1.0 beta 4)
  13140. >>>>>>(84.b+120) string >20010225
  13141. >>>>>>>(84.b+120) string <20010615 (beta4-RC1)
  13142. >>>>>>(84.b+120) string 20010615 (1.0 RC1)
  13143. >>>>>>(84.b+120) string 20010813 (1.0 RC2)
  13144. >>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1)
  13145. >>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2)
  13146. >>>>>>(84.b+120) string 20011217 (1.0 RC3)
  13147. >>>>>>(84.b+120) string 20011231 (1.0 RC3)
  13148. # Some pre-1.0 CVS snapshots still had "Xiphphorus"...
  13149. >>>>>>(84.b+120) string >20011231 (pre-1.0 CVS)
  13150. # For the 1.0 release, Xiphophorus is replaced by Xiph.Org
  13151. >>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I
  13152. >>>>>(84.b+117) string >00000000
  13153. >>>>>>(84.b+117) string <20020717 (pre-1.0 CVS)
  13154. >>>>>>(84.b+117) string 20020717 (1.0)
  13155. >>>>>>(84.b+117) string 20030909 (1.0.1)
  13156. >>>>>>(84.b+117) string 20040629 (1.1.0 RC1)
  13157.  
  13158. #------------------------------------------------------------------------------
  13159. # VXL: file(1) magic for VXL binary IO data files
  13160. #
  13161. # from Ian Scott <scottim@sf.net>
  13162. #
  13163. # VXL is a collection of C++ libraries for Computer Vision.
  13164. # See the vsl chapter in the VXL Book for more info
  13165. # http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html
  13166. # http:/vxl.sf.net
  13167.  
  13168. 2 lelong 0x472b2c4e VXL data file,
  13169. >0 leshort >0 schema version no %d
  13170.  
  13171. #------------------------------------------------------------------------------
  13172. # wordprocessors: file(1) magic fo word processors.
  13173. #
  13174. ####### PWP file format used on Smith Corona Personal Word Processors:
  13175. 2 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040'92 Smith Corona PWP
  13176. >24 byte 2 \b, single spaced
  13177. >24 byte 3 \b, 1.5 spaced
  13178. >24 byte 4 \b, double spaced
  13179. >25 byte 0x42 \b, letter
  13180. >25 byte 0x54 \b, legal
  13181. >26 byte 0x46 \b, A4
  13182.  
  13183. #WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
  13184. 0 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable text
  13185. >15 byte 0 Optimized for Intel
  13186. >15 byte 1 Optimized for Non-Intel
  13187. 1 string WPC (Corel/WP)
  13188. >8 short 257 WordPerfect macro
  13189. >8 short 258 WordPerfect help file
  13190. >8 short 259 WordPerfect keyboard file
  13191. >8 short 266 WordPerfect document
  13192. >8 short 267 WordPerfect dictionary
  13193. >8 short 268 WordPerfect thesaurus
  13194. >8 short 269 WordPerfect block
  13195. >8 short 270 WordPerfect rectangular block
  13196. >8 short 271 WordPerfect column block
  13197. >8 short 272 WordPerfect printer data
  13198. >8 short 275 WordPerfect printer data
  13199. >8 short 276 WordPerfect driver resource data
  13200. >8 short 279 WordPerfect hyphenation code
  13201. >8 short 280 WordPerfect hyphenation data
  13202. >8 short 281 WordPerfect macro resource data
  13203. >8 short 283 WordPerfect hyphenation lex
  13204. >8 short 285 WordPerfect wordlist
  13205. >8 short 286 WordPerfect equation resource data
  13206. >8 short 289 WordPerfect spell rules
  13207. >8 short 290 WordPerfect dictionary rules
  13208. >8 short 295 WordPerfect spell rules (Microlytics)
  13209. >8 short 299 WordPerfect settings file
  13210. >8 short 301 WordPerfect 4.2 document
  13211. >8 short 325 WordPerfect dialog file
  13212. >8 short 332 WordPerfect button bar
  13213. >8 short 513 Shell macro
  13214. >8 short 522 Shell definition
  13215. >8 short 769 Notebook macro
  13216. >8 short 770 Notebook help file
  13217. >8 short 771 Notebook keyboard file
  13218. >8 short 778 Notebook definition
  13219. >8 short 1026 Calculator help file
  13220. >8 short 1538 Calendar help file
  13221. >8 short 1546 Calendar data file
  13222. >8 short 1793 Editor macro
  13223. >8 short 1794 Editor help file
  13224. >8 short 1795 Editor keyboard file
  13225. >8 short 1817 Editor macro resource file
  13226. >8 short 2049 Macro editor macro
  13227. >8 short 2050 Macro editor help file
  13228. >8 short 2051 Macro editor keyboard file
  13229. >8 short 2305 PlanPerfect macro
  13230. >8 short 2306 PlanPerfect help file
  13231. >8 short 2307 PlanPerfect keyboard file
  13232. >8 short 2314 PlanPerfect worksheet
  13233. >8 short 2319 PlanPerfect printer definition
  13234. >8 short 2322 PlanPerfect graphic definition
  13235. >8 short 2323 PlanPerfect data
  13236. >8 short 2324 PlanPerfect temporary printer
  13237. >8 short 2329 PlanPerfect macro resource data
  13238. >8 byte 11 Mail
  13239. >8 short 2818 help file
  13240. >8 short 2821 distribution list
  13241. >8 short 2826 out box
  13242. >8 short 2827 in box
  13243. >8 short 2836 users archived mailbox
  13244. >8 short 2837 archived message database
  13245. >8 short 2838 archived attachments
  13246. >8 short 3083 Printer temporary file
  13247. >8 short 3330 Scheduler help file
  13248. >8 short 3338 Scheduler in file
  13249. >8 short 3339 Scheduler out file
  13250. >8 short 3594 GroupWise settings file
  13251. >8 short 3601 GroupWise directory services
  13252. >8 short 3627 GroupWise settings file
  13253. >8 short 4362 Terminal resource data
  13254. >8 short 4363 Terminal resource data
  13255. >8 short 4395 Terminal resource data
  13256. >8 short 4619 GUI loadable text
  13257. >8 short 4620 graphics resource data
  13258. >8 short 4621 printer settings file
  13259. >8 short 4622 port definition file
  13260. >8 short 4623 print queue parameters
  13261. >8 short 4624 compressed file
  13262. >8 short 5130 Network service msg file
  13263. >8 short 5131 Network service msg file
  13264. >8 short 5132 Async gateway login msg
  13265. >8 short 5134 GroupWise message file
  13266. >8 short 7956 GroupWise admin domain database
  13267. >8 short 7957 GroupWise admin host database
  13268. >8 short 7959 GroupWise admin remote host database
  13269. >8 short 7960 GroupWise admin ADS deferment data file
  13270. >8 short 8458 IntelliTAG (SGML) compiled DTD
  13271. >8 long 18219264 WordPerfect graphic image (1.0)
  13272. >8 long 18219520 WordPerfect graphic image (2.0)
  13273. #end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
  13274.  
  13275. # Hangul (Korean) Word Processor File
  13276. 0 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0
  13277. # From: Won-Kyu Park <wkpark@kldp.org>
  13278. 512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000
  13279.  
  13280. # CosmicBook, from BenoﴠRouits
  13281. 0 string CSBK Ted Neslson's CosmicBook hypertext file
  13282.  
  13283. 2 string EYWR AmigaWriter file
  13284.  
  13285. # chi: file(1) magic for ChiWriter files
  13286. 0 string \\1cw\ ChiWriter file
  13287. >5 string >\0 version %s
  13288. 0 string \\1cw ChiWriter file
  13289.  
  13290. # Quark Express from http://www.garykessler.net/library/file_sigs.html
  13291. 2 string IIXPR3 Intel Quark Express Document (English)
  13292. 2 string IIXPRa Intel Quark Express Document (Korean)
  13293. 2 string MMXPR3 Motorola Quark Express Document (English)
  13294. 2 string MMXPRa Motorola Quark Express Document (Korean)
  13295.  
  13296. # adobe indesign (document, whatever...) from querkan
  13297. 0 belong 0x0606edf5 Adobe InDesign
  13298. >16 string DOCUMENT Document
  13299.  
  13300. # From: Michael Piefel <piefel@debian.org>
  13301. # sqtroff intermediate language (replacement for ditroff int. lang.)
  13302. 0 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer
  13303. 0 string X\ hp SoftQuad troff Context intermediate for HP LaserJet
  13304. 0 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS
  13305. 0 string X\ ps SoftQuad troff Context intermediate for PostScript
  13306.  
  13307. #------------------------------------------------------------------------------
  13308. # file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU>
  13309. #
  13310. 0 string %XDELTA% XDelta binary patch file 0.14
  13311. 0 string %XDZ000% XDelta binary patch file 0.18
  13312. 0 string %XDZ001% XDelta binary patch file 0.20
  13313. 0 string %XDZ002% XDelta binary patch file 1.0
  13314. 0 string %XDZ003% XDelta binary patch file 1.0.4
  13315. 0 string %XDZ004% XDelta binary patch file 1.1
  13316.  
  13317. #------------------------------------------------------------------------------
  13318. # xenix: file(1) magic for Microsoft Xenix
  13319. #
  13320. # "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
  13321. # model" lifted from "magic.xenix", with comment "derived empirically;
  13322. # treat as folklore until proven"
  13323. #
  13324. # "small model", "large model", "huge model" stuff lifted from XXX
  13325. #
  13326. # XXX - "x.out" collides with PDP-11 archives
  13327. #
  13328. 0 string core core file (Xenix)
  13329. 0 byte 0x80 8086 relocatable (Microsoft)
  13330. 0 leshort 0xff65 x.out
  13331. >2 string __.SYMDEF randomized
  13332. >0 byte x archive
  13333. 0 leshort 0x206 Microsoft a.out
  13334. >8 leshort 1 Middle model
  13335. >0x1e leshort &0x10 overlay
  13336. >0x1e leshort &0x2 separate
  13337. >0x1e leshort &0x4 pure
  13338. >0x1e leshort &0x800 segmented
  13339. >0x1e leshort &0x400 standalone
  13340. >0x1e leshort &0x8 fixed-stack
  13341. >0x1c byte &0x80 byte-swapped
  13342. >0x1c byte &0x40 word-swapped
  13343. >0x10 lelong >0 not-stripped
  13344. >0x1e leshort ^0xc000 pre-SysV
  13345. >0x1e leshort &0x4000 V2.3
  13346. >0x1e leshort &0x8000 V3.0
  13347. >0x1c byte &0x4 86
  13348. >0x1c byte &0xb 186
  13349. >0x1c byte &0x9 286
  13350. >0x1c byte &0xa 386
  13351. >0x1f byte <0x040 small model
  13352. >0x1f byte =0x048 large model
  13353. >0x1f byte =0x049 huge model
  13354. >0x1e leshort &0x1 executable
  13355. >0x1e leshort ^0x1 object file
  13356. >0x1e leshort &0x40 Large Text
  13357. >0x1e leshort &0x20 Large Data
  13358. >0x1e leshort &0x120 Huge Objects Enabled
  13359. >0x10 lelong >0 not stripped
  13360.  
  13361. 0 leshort 0x140 old Microsoft 8086 x.out
  13362. >0x3 byte &0x4 separate
  13363. >0x3 byte &0x2 pure
  13364. >0 byte &0x1 executable
  13365. >0 byte ^0x1 relocatable
  13366. >0x14 lelong >0 not stripped
  13367.  
  13368. 0 lelong 0x206 b.out
  13369. >0x1e leshort &0x10 overlay
  13370. >0x1e leshort &0x2 separate
  13371. >0x1e leshort &0x4 pure
  13372. >0x1e leshort &0x800 segmented
  13373. >0x1e leshort &0x400 standalone
  13374. >0x1e leshort &0x1 executable
  13375. >0x1e leshort ^0x1 object file
  13376. >0x1e leshort &0x4000 V2.3
  13377. >0x1e leshort &0x8000 V3.0
  13378. >0x1c byte &0x4 86
  13379. >0x1c byte &0xb 186
  13380. >0x1c byte &0x9 286
  13381. >0x1c byte &0x29 286
  13382. >0x1c byte &0xa 386
  13383. >0x1e leshort &0x4 Large Text
  13384. >0x1e leshort &0x2 Large Data
  13385. >0x1e leshort &0x102 Huge Objects Enabled
  13386.  
  13387. 0 leshort 0x580 XENIX 8086 relocatable or 80286 small model
  13388.  
  13389. #------------------------------------------------------------------------------
  13390. # xo65 object files
  13391. # From: "Ullrich von Bassewitz" <uz@cc65.org>
  13392. #
  13393. 0 string \x55\x7A\x6E\x61 xo65 object,
  13394. >4 leshort x version %d,
  13395. >6 leshort&0x0001 =0x0001 with debug info
  13396. >6 leshort&0x0001 =0x0000 no debug info
  13397.  
  13398. # xo65 library files
  13399. 0 string \x6E\x61\x55\x7A xo65 library,
  13400. >4 leshort x version %d
  13401.  
  13402. # o65 object files
  13403. 0 string \x01\x00\x6F\x36\x35 o65
  13404. >6 leshort&0x1000 =0x0000 executable,
  13405. >6 leshort&0x1000 =0x1000 object,
  13406. >5 byte x version %d,
  13407. >6 leshort&0x8000 =0x8000 65816,
  13408. >6 leshort&0x8000 =0x0000 6502,
  13409. >6 leshort&0x2000 =0x2000 32 bit,
  13410. >6 leshort&0x2000 =0x0000 16 bit,
  13411. >6 leshort&0x4000 =0x4000 page reloc,
  13412. >6 leshort&0x4000 =0x0000 byte reloc,
  13413. >6 leshort&0x0003 =0x0000 alignment 1
  13414. >6 leshort&0x0003 =0x0001 alignment 2
  13415. >6 leshort&0x0003 =0x0002 alignment 4
  13416. >6 leshort&0x0003 =0x0003 alignment 256
  13417.  
  13418. #------------------------------------------------------------------------------
  13419. # xwindows: file(1) magic for various X/Window system file formats.
  13420.  
  13421. # Compiled X Keymap
  13422. # XKM (compiled X keymap) files (including version and byte ordering)
  13423. 1 string mkx Compiled XKB Keymap: lsb,
  13424. >0 byte >0 version %d
  13425. >0 byte =0 obsolete
  13426. 0 string xkm Compiled XKB Keymap: msb,
  13427. >3 byte >0 version %d
  13428. >0 byte =0 obsolete
  13429.  
  13430. # xfsdump archive
  13431. 0 string xFSdump0 xfsdump archive
  13432. >8 belong x (version %d)
  13433.  
  13434. # Jaleo XFS files
  13435. 0 long 395726 Jaleo XFS file
  13436. >4 long x - version %ld
  13437. >8 long x - [%ld -
  13438. >20 long x %ldx
  13439. >24 long x %ldx
  13440. >28 long 1008 YUV422]
  13441. >28 long 1000 RGB24]
  13442.  
  13443. #------------------------------------------------------------------------------
  13444. # zilog: file(1) magic for Zilog Z8000.
  13445. #
  13446. # Was it big-endian or little-endian? My Product Specification doesn't
  13447. # say.
  13448. #
  13449. 0 long 0xe807 object file (z8000 a.out)
  13450. 0 long 0xe808 pure object file (z8000 a.out)
  13451. 0 long 0xe809 separate object file (z8000 a.out)
  13452. 0 long 0xe805 overlay object file (z8000 a.out)
  13453.  
  13454. #------------------------------------------------------------------------------
  13455. # zyxel: file(1) magic for ZyXEL modems
  13456. #
  13457. # From <rob@pe1chl.ampr.org>
  13458. # These are the /etc/magic entries to decode datafiles as used for the
  13459. # ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a
  13460. # ZyXEL-defined standard)
  13461.  
  13462. 0 string ZyXEL\002 ZyXEL voice data
  13463. >10 byte 0 - CELP encoding
  13464. >10 byte&0x0B 1 - ADPCM2 encoding
  13465. >10 byte&0x0B 2 - ADPCM3 encoding
  13466. >10 byte&0x0B 3 - ADPCM4 encoding
  13467. >10 byte&0x0B 8 - New ADPCM3 encoding
  13468. >10 byte&0x04 4 with resync
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!