| commit | author | age | ||
| ce56b9 | 1 | # Magic |
| T | 2 | # Magic data for file(1) command. |
| 3 | # Machine-generated from src/cmd/file/magdir/*; edit there only! | |
| 4 | # Format is described in magic(files), where: | |
| 5 | # files is 5 on V7 and BSD, 4 on SV, and ?? in the SVID. | |
| 6 | ||
| 7 | #------------------------------------------------------------------------------ | |
| 8 | # Localstuff: file(1) magic for locally observed files | |
| 9 | # | |
| 10 | # $Id: Localstuff,v 1.4 2003/03/23 04:17:27 christos Exp $ | |
| 11 | # Add any locally observed files here. Remember: | |
| 12 | # text if readable, executable if runnable binary, data if unreadable. | |
| 13 | ||
| 14 | #------------------------------------------------------------------------------ | |
| 15 | # zyxel: file(1) magic for ZyXEL modems | |
| 16 | # | |
| 17 | # From <rob@pe1chl.ampr.org> | |
| 18 | # These are the /etc/magic entries to decode datafiles as used for the | |
| 19 | # ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a | |
| 20 | # ZyXEL-defined standard) | |
| 21 | ||
| 22 | 0 string ZyXEL\002 ZyXEL voice data | |
| 23 | >10 byte 0 - CELP encoding | |
| 24 | >10 byte&0x0B 1 - ADPCM2 encoding | |
| 25 | >10 byte&0x0B 2 - ADPCM3 encoding | |
| 26 | >10 byte&0x0B 3 - ADPCM4 encoding | |
| 27 | >10 byte&0x0B 8 - New ADPCM3 encoding | |
| 28 | >10 byte&0x04 4 with resync | |
| 29 | ||
| 30 | #------------------------------------------------------------------------------ | |
| 31 | # file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU> | |
| 32 | # | |
| 33 | 0 string %XDELTA% XDelta binary patch file 0.14 | |
| 34 | 0 string %XDZ000% XDelta binary patch file 0.18 | |
| 35 | 0 string %XDZ001% XDelta binary patch file 0.20 | |
| 36 | 0 string %XDZ002% XDelta binary patch file 1.0 | |
| 37 | 0 string %XDZ003% XDelta binary patch file 1.0.4 | |
| 38 | 0 string %XDZ004% XDelta binary patch file 1.1 | |
| 39 | #------------------------------------------------------------------------ | |
| 40 | # sysex: file(1) magic for MIDI sysex files | |
| 41 | # | |
| 42 | # | |
| 43 | 0 byte 0xF0 SysEx File - | |
| 44 | ||
| 45 | # North American Group | |
| 46 | >1 byte 0x01 Sequential | |
| 47 | >1 byte 0x02 IDP | |
| 48 | >1 byte 0x03 OctavePlateau | |
| 49 | >1 byte 0x04 Moog | |
| 50 | >1 byte 0x05 Passport | |
| 51 | >1 byte 0x06 Lexicon | |
| 52 | >1 byte 0x07 Kurzweil | |
| 53 | >1 byte 0x08 Fender | |
| 54 | >1 byte 0x09 Gulbransen | |
| 55 | >1 byte 0x0a AKG | |
| 56 | >1 byte 0x0b Voyce | |
| 57 | >1 byte 0x0c Waveframe | |
| 58 | >1 byte 0x0d ADA | |
| 59 | >1 byte 0x0e Garfield | |
| 60 | >1 byte 0x0f Ensoniq | |
| 61 | >1 byte 0x10 Oberheim | |
| 62 | >1 byte 0x11 Apple | |
| 63 | >1 byte 0x12 GreyMatter | |
| 64 | >1 byte 0x14 PalmTree | |
| 65 | >1 byte 0x15 JLCooper | |
| 66 | >1 byte 0x16 Lowrey | |
| 67 | >1 byte 0x17 AdamsSmith | |
| 68 | >1 byte 0x18 E-mu | |
| 69 | >1 byte 0x19 Harmony | |
| 70 | >1 byte 0x1a ART | |
| 71 | >1 byte 0x1b Baldwin | |
| 72 | >1 byte 0x1c Eventide | |
| 73 | >1 byte 0x1d Inventronics | |
| 74 | >1 byte 0x1f Clarity | |
| 75 | ||
| 76 | # European Group | |
| 77 | >1 byte 0x21 SIEL | |
| 78 | >1 byte 0x22 Synthaxe | |
| 79 | >1 byte 0x24 Hohner | |
| 80 | >1 byte 0x25 Twister | |
| 81 | >1 byte 0x26 Solton | |
| 82 | >1 byte 0x27 Jellinghaus | |
| 83 | >1 byte 0x28 Southworth | |
| 84 | >1 byte 0x29 PPG | |
| 85 | >1 byte 0x2a JEN | |
| 86 | >1 byte 0x2b SSL | |
| 87 | >1 byte 0x2c AudioVertrieb | |
| 88 | ||
| 89 | >1 byte 0x2f ELKA | |
| 90 | >>3 byte 0x09 EK-44 | |
| 91 | ||
| 92 | >1 byte 0x30 Dynacord | |
| 93 | >1 byte 0x33 Clavia | |
| 94 | >1 byte 0x39 Soundcraft | |
| 95 | ||
| 96 | >1 byte 0x3e Waldorf | |
| 97 | >>3 byte 0x7f Microwave I | |
| 98 | ||
| 99 | # Japanese Group | |
| 100 | >1 byte 0x40 Kawai | |
| 101 | >>3 byte 0x20 K1 | |
| 102 | >>3 byte 0x22 K4 | |
| 103 | ||
| 104 | >1 byte 0x41 Roland | |
| 105 | >>3 byte 0x14 D-50 | |
| 106 | >>3 byte 0x2b U-220 | |
| 107 | >>3 byte 0x02 TR-707 | |
| 108 | ||
| 109 | >1 byte 0x42 Korg | |
| 110 | >>3 byte 0x19 M1 | |
| 111 | ||
| 112 | >1 byte 0x43 Yamaha | |
| 113 | >1 byte 0x44 Casio | |
| 114 | >1 byte 0x46 Kamiya | |
| 115 | >1 byte 0x47 Akai | |
| 116 | >1 byte 0x48 Victor | |
| 117 | >1 byte 0x49 Mesosha | |
| 118 | >1 byte 0x4b Fujitsu | |
| 119 | >1 byte 0x4c Sony | |
| 120 | >1 byte 0x4e Teac | |
| 121 | >1 byte 0x50 Matsushita | |
| 122 | >1 byte 0x51 Fostex | |
| 123 | >1 byte 0x52 Zoom | |
| 124 | >1 byte 0x54 Matsushita | |
| 125 | >1 byte 0x57 Acoustic tech. lab. | |
| 126 | ||
| 127 | >1 belong&0xffffff00 0x00007400 Ta Horng | |
| 128 | >1 belong&0xffffff00 0x00007500 e-Tek | |
| 129 | >1 belong&0xffffff00 0x00007600 E-Voice | |
| 130 | >1 belong&0xffffff00 0x00007700 Midisoft | |
| 131 | >1 belong&0xffffff00 0x00007800 Q-Sound | |
| 132 | >1 belong&0xffffff00 0x00007900 Westrex | |
| 133 | >1 belong&0xffffff00 0x00007a00 Nvidia* | |
| 134 | >1 belong&0xffffff00 0x00007b00 ESS | |
| 135 | >1 belong&0xffffff00 0x00007c00 Mediatrix | |
| 136 | >1 belong&0xffffff00 0x00007d00 Brooktree | |
| 137 | >1 belong&0xffffff00 0x00007e00 Otari | |
| 138 | >1 belong&0xffffff00 0x00007f00 Key Electronics | |
| 139 | >1 belong&0xffffff00 0x00010000 Shure | |
| 140 | >1 belong&0xffffff00 0x00010100 AuraSound | |
| 141 | >1 belong&0xffffff00 0x00010200 Crystal | |
| 142 | >1 belong&0xffffff00 0x00010300 Rockwell | |
| 143 | >1 belong&0xffffff00 0x00010400 Silicon Graphics | |
| 144 | >1 belong&0xffffff00 0x00010500 Midiman | |
| 145 | >1 belong&0xffffff00 0x00010600 PreSonus | |
| 146 | >1 belong&0xffffff00 0x00010800 Topaz | |
| 147 | >1 belong&0xffffff00 0x00010900 Cast Lightning | |
| 148 | >1 belong&0xffffff00 0x00010a00 Microsoft | |
| 149 | >1 belong&0xffffff00 0x00010b00 Sonic Foundry | |
| 150 | >1 belong&0xffffff00 0x00010c00 Line 6 | |
| 151 | >1 belong&0xffffff00 0x00010d00 Beatnik Inc. | |
| 152 | >1 belong&0xffffff00 0x00010e00 Van Koerving | |
| 153 | >1 belong&0xffffff00 0x00010f00 Altech Systems | |
| 154 | >1 belong&0xffffff00 0x00011000 S & S Research | |
| 155 | >1 belong&0xffffff00 0x00011100 VLSI Technology | |
| 156 | >1 belong&0xffffff00 0x00011200 Chromatic | |
| 157 | >1 belong&0xffffff00 0x00011300 Sapphire | |
| 158 | >1 belong&0xffffff00 0x00011400 IDRC | |
| 159 | >1 belong&0xffffff00 0x00011500 Justonic Tuning | |
| 160 | >1 belong&0xffffff00 0x00011600 TorComp | |
| 161 | >1 belong&0xffffff00 0x00011700 Newtek Inc. | |
| 162 | >1 belong&0xffffff00 0x00011800 Sound Sculpture | |
| 163 | >1 belong&0xffffff00 0x00011900 Walker Technical | |
| 164 | >1 belong&0xffffff00 0x00011a00 Digital Harmony | |
| 165 | >1 belong&0xffffff00 0x00011b00 InVision | |
| 166 | >1 belong&0xffffff00 0x00011c00 T-Square | |
| 167 | >1 belong&0xffffff00 0x00011d00 Nemesys | |
| 168 | >1 belong&0xffffff00 0x00011e00 DBX | |
| 169 | >1 belong&0xffffff00 0x00011f00 Syndyne | |
| 170 | >1 belong&0xffffff00 0x00012000 Bitheadz | |
| 171 | >1 belong&0xffffff00 0x00012100 Cakewalk | |
| 172 | >1 belong&0xffffff00 0x00012200 Staccato | |
| 173 | >1 belong&0xffffff00 0x00012300 National Semicon. | |
| 174 | >1 belong&0xffffff00 0x00012400 Boom Theory | |
| 175 | >1 belong&0xffffff00 0x00012500 Virtual DSP Corp | |
| 176 | >1 belong&0xffffff00 0x00012600 Antares | |
| 177 | >1 belong&0xffffff00 0x00012700 Angel Software | |
| 178 | >1 belong&0xffffff00 0x00012800 St Louis Music | |
| 179 | >1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX | |
| 180 | >1 belong&0xffffff00 0x00012a00 Ashley Audio | |
| 181 | >1 belong&0xffffff00 0x00012b00 Vari-Lite | |
| 182 | >1 belong&0xffffff00 0x00012c00 Summit Audio | |
| 183 | >1 belong&0xffffff00 0x00012d00 Aureal Semicon. | |
| 184 | >1 belong&0xffffff00 0x00012e00 SeaSound | |
| 185 | >1 belong&0xffffff00 0x00012f00 U.S. Robotics | |
| 186 | >1 belong&0xffffff00 0x00013000 Aurisis | |
| 187 | >1 belong&0xffffff00 0x00013100 Nearfield Multimedia | |
| 188 | >1 belong&0xffffff00 0x00013200 FM7 Inc. | |
| 189 | >1 belong&0xffffff00 0x00013300 Swivel Systems | |
| 190 | >1 belong&0xffffff00 0x00013400 Hyperactive | |
| 191 | >1 belong&0xffffff00 0x00013500 MidiLite | |
| 192 | >1 belong&0xffffff00 0x00013600 Radical | |
| 193 | >1 belong&0xffffff00 0x00013700 Roger Linn | |
| 194 | >1 belong&0xffffff00 0x00013800 Helicon | |
| 195 | >1 belong&0xffffff00 0x00013900 Event | |
| 196 | >1 belong&0xffffff00 0x00013a00 Sonic Network | |
| 197 | >1 belong&0xffffff00 0x00013b00 Realtime Music | |
| 198 | >1 belong&0xffffff00 0x00013c00 Apogee Digital | |
| 199 | ||
| 200 | >1 belong&0xffffff00 0x00202b00 Medeli Electronics | |
| 201 | >1 belong&0xffffff00 0x00202c00 Charlie Lab | |
| 202 | >1 belong&0xffffff00 0x00202d00 Blue Chip Music | |
| 203 | >1 belong&0xffffff00 0x00202e00 BEE OH Corp | |
| 204 | >1 belong&0xffffff00 0x00202f00 LG Semicon America | |
| 205 | >1 belong&0xffffff00 0x00203000 TESI | |
| 206 | >1 belong&0xffffff00 0x00203100 EMAGIC | |
| 207 | >1 belong&0xffffff00 0x00203200 Behringer | |
| 208 | >1 belong&0xffffff00 0x00203300 Access Music | |
| 209 | >1 belong&0xffffff00 0x00203400 Synoptic | |
| 210 | >1 belong&0xffffff00 0x00203500 Hanmesoft Corp | |
| 211 | >1 belong&0xffffff00 0x00203600 Terratec | |
| 212 | >1 belong&0xffffff00 0x00203700 Proel SpA | |
| 213 | >1 belong&0xffffff00 0x00203800 IBK MIDI | |
| 214 | >1 belong&0xffffff00 0x00203900 IRCAM | |
| 215 | >1 belong&0xffffff00 0x00203a00 Propellerhead Software | |
| 216 | >1 belong&0xffffff00 0x00203b00 Red Sound Systems | |
| 217 | >1 belong&0xffffff00 0x00203c00 Electron ESI AB | |
| 218 | >1 belong&0xffffff00 0x00203d00 Sintefex Audio | |
| 219 | >1 belong&0xffffff00 0x00203e00 Music and More | |
| 220 | >1 belong&0xffffff00 0x00203f00 Amsaro | |
| 221 | >1 belong&0xffffff00 0x00204000 CDS Advanced Technology | |
| 222 | >1 belong&0xffffff00 0x00204100 Touched by Sound | |
| 223 | >1 belong&0xffffff00 0x00204200 DSP Arts | |
| 224 | >1 belong&0xffffff00 0x00204300 Phil Rees Music | |
| 225 | >1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH | |
| 226 | >1 belong&0xffffff00 0x00204500 Soundart | |
| 227 | >1 belong&0xffffff00 0x00204600 C-Mexx Software | |
| 228 | >1 belong&0xffffff00 0x00204700 Klavis Tech. | |
| 229 | >1 belong&0xffffff00 0x00204800 Noteheads AB | |
| 230 | ||
| 231 | 0 string T707 Roland TR-707 Data | |
| 232 | ||
| 233 | #------------------------------------------------------------------------------ | |
| 234 | # sccs: file(1) magic for SCCS archives | |
| 235 | # | |
| 236 | # SCCS archive structure: | |
| 237 | # \001h01207 | |
| 238 | # \001s 00276/00000/00000 | |
| 239 | # \001d D 1.1 87/09/23 08:09:20 ian 1 0 | |
| 240 | # \001c date and time created 87/09/23 08:09:20 by ian | |
| 241 | # \001e | |
| 242 | # \001u | |
| 243 | # \001U | |
| 244 | # ... etc. | |
| 245 | # Now '\001h' happens to be the same as the 3B20's a.out magic number (0550). | |
| 246 | # *Sigh*. And these both came from various parts of the USG. | |
| 247 | # Maybe we should just switch everybody from SCCS to RCS! | |
| 248 | # Further, you can't just say '\001h0', because the five-digit number | |
| 249 | # is a checksum that could (presumably) have any leading digit, | |
| 250 | # and we don't have regular expression matching yet. | |
| 251 | # Hence the following official kludge: | |
| 252 | 8 string \001s\ SCCS archive data | |
| 253 | #------------------------------------------------------------------------------ | |
| 254 | # allegro: file(1) magic for Allegro datafiles | |
| 255 | # Toby Deshane <hac@shoelace.digivill.net> | |
| 256 | # | |
| 257 | 0 belong 0x736C6821 Allegro datafile (packed) | |
| 258 | 0 belong 0x736C682E Allegro datafile (not packed/autodetect) | |
| 259 | 0 belong 0x736C682B Allegro datafile (appended exe data) | |
| 260 | #------------------------------------------------------------------------------ | |
| 261 | # file(1) magic for cvs(1) files | |
| 262 | # From Hendrik Scholz <hendrik@scholz.net> | |
| 263 | ||
| 264 | 0 string /1\ :pserver: cvs password text file | |
| 265 | ||
| 266 | ||
| 267 | #------------------------------------------------------------------------------ | |
| 268 | # vicar: file(1) magic for VICAR files. | |
| 269 | # | |
| 270 | # From: Ossama Othman <othman@astrosun.tn.cornell.edu | |
| 271 | # VICAR is JPL's in-house spacecraft image processing program | |
| 272 | # VICAR image | |
| 273 | 0 string LBLSIZE= VICAR image data | |
| 274 | >32 string BYTE \b, 8 bits = VAX byte | |
| 275 | >32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2 | |
| 276 | >32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4 | |
| 277 | >32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4 | |
| 278 | >32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8 | |
| 279 | >32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8 | |
| 280 | # VICAR label file | |
| 281 | 43 string SFDU_LABEL VICAR label file | |
| 282 | ||
| 283 | #------------------------------------------------------------------------------ | |
| 284 | # varied.out: file(1) magic for various USG systems | |
| 285 | # | |
| 286 | # Herewith many of the object file formats used by USG systems. | |
| 287 | # Most have been moved to files for a particular processor, | |
| 288 | # and deleted if they duplicate other entries. | |
| 289 | # | |
| 290 | 0 short 0610 Perkin-Elmer executable | |
| 291 | # AMD 29K | |
| 292 | 0 beshort 0572 amd 29k coff noprebar executable | |
| 293 | 0 beshort 01572 amd 29k coff prebar executable | |
| 294 | 0 beshort 0160007 amd 29k coff archive | |
| 295 | # Cray | |
| 296 | 6 beshort 0407 unicos (cray) executable | |
| 297 | # Ultrix 4.3 | |
| 298 | 596 string \130\337\377\377 Ultrix core file | |
| 299 | >600 string >\0 from '%s' | |
| 300 | # BeOS and MAcOS PEF executables | |
| 301 | # From: hplus@zilker.net (Jon Watte) | |
| 302 | 0 string Joy!peffpwpc header for PowerPC PEF executable | |
| 303 | # | |
| 304 | # ava assembler/linker Uros Platise <uros.platise@ijs.si> | |
| 305 | 0 string avaobj AVR assembler object code | |
| 306 | >7 string >\0 version '%s' | |
| 307 | # gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr> | |
| 308 | 0 string gmon GNU prof performance data | |
| 309 | >4 long x - version %ld | |
| 310 | # From: Dave Pearson <davep@davep.org> | |
| 311 | # Harbour <URL:http://www.harbour-project.org/> HRB files. | |
| 312 | 0 string \xc0HRB Harbour HRB file | |
| 313 | >4 short x version %d | |
| 314 | ||
| 315 | # From: "Stefan A. Haubenthal" <polluks@web.de> | |
| 316 | 0 belong 0x000001EB Plan 9 executable | |
| 317 | ||
| 318 | #------------------------------------------------------------------------------ | |
| 319 | # c64: file(1) magic for various commodore 64 related files | |
| 320 | # | |
| 321 | # From <doj@cubic.org> | |
| 322 | ||
| 323 | 0x16500 belong 0x12014100 D64 Image | |
| 324 | 0x16500 belong 0x12014180 D71 Image | |
| 325 | 0x61800 belong 0x28034400 D81 Image | |
| 326 | 0 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image | |
| 327 | 0 belong 0x43154164 X64 Image | |
| 328 | ||
| 329 | 0 string GCR-1541 GCR Image | |
| 330 | >8 byte x version: $i | |
| 331 | >9 byte x tracks: %i | |
| 332 | ||
| 333 | 9 string PSUR ARC archive (c64) | |
| 334 | 2 string -LH1- LHA archive (c64) | |
| 335 | ||
| 336 | 0 string C64File PC64 Emulator file | |
| 337 | >8 string >\0 "%s" | |
| 338 | 0 string C64Image PC64 Freezer Image | |
| 339 | ||
| 340 | 0 beshort 0x38CD C64 PCLink Image | |
| 341 | 0 string CBM\144\0\0 Power 64 C64 Emulator Snapshot | |
| 342 | ||
| 343 | 0 belong 0xFF424CFF WRAptor packer (c64) | |
| 344 | #------------------------------------------------------------------------------ | |
| 345 | # games: file(1) for games | |
| 346 | ||
| 347 | # Thomas M. Ott (ThMO) | |
| 348 | 1 string =WAD DOOM data, | |
| 349 | >0 string =I main wad | |
| 350 | >0 string =P patch wad | |
| 351 | >0 byte x unknown junk | |
| 352 | ||
| 353 | # Fabio Bonelli <fabiobonelli@libero.it> | |
| 354 | # Quake II - III data files | |
| 355 | 0 string IDP2 Quake II 3D Model file, | |
| 356 | >20 long x %lu skin(s), | |
| 357 | >8 long x (%lu x | |
| 358 | >12 long x %lu), | |
| 359 | >40 long x %lu frame(s), | |
| 360 | >16 long x Frame size %lu bytes, | |
| 361 | >24 long x %lu vertices/frame, | |
| 362 | >28 long x %lu texture coordinates, | |
| 363 | >32 long x %lu triangles/frame | |
| 364 | ||
| 365 | 0 string IBSP Quake | |
| 366 | >4 long 0x26 II Map file (BSP) | |
| 367 | >4 long 0x2E III Map file (BSP) | |
| 368 | ||
| 369 | 0 string IDS2 Quake II SP2 sprite file | |
| 370 | ||
| 371 | #--------------------------------------------------------------------------- | |
| 372 | # Doom and Quake | |
| 373 | # submitted by Nicolas Patrois | |
| 374 | ||
| 375 | # DOOM | |
| 376 | ||
| 377 | 0 string IWAD DOOM or DOOM ][ world | |
| 378 | 0 string PWAD DOOM or DOOM ][ extension world | |
| 379 | ||
| 380 | 0 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo | |
| 381 | # some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01 | |
| 382 | ||
| 383 | 24 string LxD\ 203 Linuxdoom save | |
| 384 | >0 string x , name=%s | |
| 385 | >44 string x , world=%s | |
| 386 | ||
| 387 | # Quake | |
| 388 | ||
| 389 | 0 string PACK Quake I or II world or extension | |
| 390 | ||
| 391 | #0 string -1\x0a Quake I demo | |
| 392 | #>30 string x version %.4s | |
| 393 | #>61 string x level %s | |
| 394 | ||
| 395 | #0 string 5\x0a Quake I save | |
| 396 | ||
| 397 | # The levels | |
| 398 | ||
| 399 | # Quake 1 | |
| 400 | ||
| 401 | 0 string 5\x0aIntroduction Quake I save: start Introduction | |
| 402 | 0 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex | |
| 403 | 0 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned | |
| 404 | 0 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis | |
| 405 | 0 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto | |
| 406 | 0 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret) | |
| 407 | 0 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep | |
| 408 | 0 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon | |
| 409 | 0 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon | |
| 410 | 0 string 5\x0athe_Installation Quake I save: e2m1 The installation | |
| 411 | 0 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel | |
| 412 | 0 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!) | |
| 413 | 0 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret) | |
| 414 | 0 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress | |
| 415 | 0 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse | |
| 416 | 0 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette | |
| 417 | 0 string 5\x0aTermination_Central Quake I save: e3m1 Termination central | |
| 418 | 0 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin | |
| 419 | 0 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror | |
| 420 | 0 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight | |
| 421 | 0 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret) | |
| 422 | 0 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels | |
| 423 | 0 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment | |
| 424 | 0 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system | |
| 425 | 0 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair | |
| 426 | 0 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine | |
| 427 | 0 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate | |
| 428 | 0 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium | |
| 429 | 0 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret) | |
| 430 | 0 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze | |
| 431 | 0 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony | |
| 432 | 0 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit | |
| 433 | ||
| 434 | # Quake DeathMatch levels | |
| 435 | ||
| 436 | 0 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths | |
| 437 | 0 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis | |
| 438 | 0 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base | |
| 439 | 0 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place | |
| 440 | 0 string 5\x0aThe_Cistern Quake I save: dm5 The cistern | |
| 441 | 0 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone | |
| 442 | ||
| 443 | # Scourge of Armagon | |
| 444 | ||
| 445 | 0 string 5\x0aCommand_HQ Quake I save: start Command HQ | |
| 446 | 0 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station | |
| 447 | 0 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility | |
| 448 | 0 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret) | |
| 449 | 0 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine | |
| 450 | 0 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility | |
| 451 | 0 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms | |
| 452 | 0 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret) | |
| 453 | 0 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral | |
| 454 | 0 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs | |
| 455 | 0 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt | |
| 456 | 0 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep | |
| 457 | 0 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment | |
| 458 | 0 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium | |
| 459 | 0 string 5\x0aLimbo Quake I save: hip3m3 Limbo | |
| 460 | 0 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret) | |
| 461 | 0 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet | |
| 462 | 0 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair | |
| 463 | ||
| 464 | # Malice | |
| 465 | ||
| 466 | 0 string 5\x0aThe_Academy Quake I save: start The academy | |
| 467 | 0 string 5\x0aThe_Lab Quake I save: d1 The lab | |
| 468 | 0 string 5\x0aArea_33 Quake I save: d1b Area 33 | |
| 469 | 0 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions | |
| 470 | 0 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret) | |
| 471 | 0 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret) | |
| 472 | 0 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice | |
| 473 | 0 string 5\x0aArea44 Quake I save: d1c Area 44 | |
| 474 | 0 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers | |
| 475 | 0 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life | |
| 476 | 0 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood | |
| 477 | 0 string 5\x0aThe_Flood Quake I save: d5 The flood | |
| 478 | 0 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant | |
| 479 | 0 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant | |
| 480 | 0 string 5\x0aThe_Foundry Quake I save: d7b The foundry | |
| 481 | 0 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base | |
| 482 | 0 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base | |
| 483 | 0 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories | |
| 484 | 0 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive | |
| 485 | 0 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ | |
| 486 | 0 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown! | |
| 487 | ||
| 488 | # Malice DeathMatch levels | |
| 489 | ||
| 490 | 0 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct | |
| 491 | 0 string 5\x0aSub_Station Quake I save: ddm2 Sub station | |
| 492 | 0 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights! | |
| 493 | 0 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa | |
| 494 | 0 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse | |
| 495 | 0 string 5\x0aDOMINO Quake I save: ddm6 Domino | |
| 496 | 0 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder | |
| 497 | ||
| 498 | ||
| 499 | 0 string MComprHD MAME CHD compressed hard disk image, | |
| 500 | >12 belong x version %lu | |
| 501 | #------------------------------------------------------------------------------ | |
| 502 | # Mavroyanopoulos Nikos <nmav@hellug.gr> | |
| 503 | # mcrypt: file(1) magic for mcrypt 2.2.x; | |
| 504 | 0 string \0m\3 mcrypt 2.5 encrypted data, | |
| 505 | >4 string >\0 algorithm: %s, | |
| 506 | >>&1 leshort >0 keysize: %d bytes, | |
| 507 | >>>&0 string >\0 mode: %s, | |
| 508 | ||
| 509 | 0 string \0m\2 mcrypt 2.2 encrypted data, | |
| 510 | >3 byte 0 algorithm: blowfish-448, | |
| 511 | >3 byte 1 algorithm: DES, | |
| 512 | >3 byte 2 algorithm: 3DES, | |
| 513 | >3 byte 3 algorithm: 3-WAY, | |
| 514 | >3 byte 4 algorithm: GOST, | |
| 515 | >3 byte 6 algorithm: SAFER-SK64, | |
| 516 | >3 byte 7 algorithm: SAFER-SK128, | |
| 517 | >3 byte 8 algorithm: CAST-128, | |
| 518 | >3 byte 9 algorithm: xTEA, | |
| 519 | >3 byte 10 algorithm: TWOFISH-128, | |
| 520 | >3 byte 11 algorithm: RC2, | |
| 521 | >3 byte 12 algorithm: TWOFISH-192, | |
| 522 | >3 byte 13 algorithm: TWOFISH-256, | |
| 523 | >3 byte 14 algorithm: blowfish-128, | |
| 524 | >3 byte 15 algorithm: blowfish-192, | |
| 525 | >3 byte 16 algorithm: blowfish-256, | |
| 526 | >3 byte 100 algorithm: RC6, | |
| 527 | >3 byte 101 algorithm: IDEA, | |
| 528 | >4 byte 0 mode: CBC, | |
| 529 | >4 byte 1 mode: ECB, | |
| 530 | >4 byte 2 mode: CFB, | |
| 531 | >4 byte 3 mode: OFB, | |
| 532 | >4 byte 4 mode: nOFB, | |
| 533 | >5 byte 0 keymode: 8bit | |
| 534 | >5 byte 1 keymode: 4bit | |
| 535 | >5 byte 2 keymode: SHA-1 hash | |
| 536 | >5 byte 3 keymode: MD5 hash | |
| 537 | ||
| 538 | #------------------------------------------------------------------------------ | |
| 539 | # archive: file(1) magic for archive formats (see also "msdos" for self- | |
| 540 | # extracting compressed archives) | |
| 541 | # | |
| 542 | # cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. | |
| 543 | # pre-POSIX "tar" archives are handled in the C code. | |
| 544 | ||
| 545 | # POSIX tar archives | |
| 546 | 257 string ustar\0 POSIX tar archive | |
| 547 | 257 string ustar\040\040\0 GNU tar archive | |
| 548 | ||
| 549 | # cpio archives | |
| 550 | # | |
| 551 | # Yes, the top two "cpio archive" formats *are* supposed to just be "short". | |
| 552 | # The idea is to indicate archives produced on machines with the same | |
| 553 | # byte order as the machine running "file" with "cpio archive", and | |
| 554 | # to indicate archives produced on machines with the opposite byte order | |
| 555 | # from the machine running "file" with "byte-swapped cpio archive". | |
| 556 | # | |
| 557 | # The SVR4 "cpio(4)" hints that there are additional formats, but they | |
| 558 | # are defined as "short"s; I think all the new formats are | |
| 559 | # character-header formats and thus are strings, not numbers. | |
| 560 | 0 short 070707 cpio archive | |
| 561 | 0 short 0143561 byte-swapped cpio archive | |
| 562 | 0 string 070707 ASCII cpio archive (pre-SVR4 or odc) | |
| 563 | 0 string 070701 ASCII cpio archive (SVR4 with no CRC) | |
| 564 | 0 string 070702 ASCII cpio archive (SVR4 with CRC) | |
| 565 | ||
| 566 | # Debian package (needs to go before regular portable archives) | |
| 567 | # | |
| 568 | 0 string !<arch>\ndebian | |
| 569 | >8 string debian-split part of multipart Debian package | |
| 570 | >8 string debian-binary Debian binary package | |
| 571 | >68 string >\0 (format %s) | |
| 572 | >81 string bz2 \b, uses bzip2 compression | |
| 573 | >84 string gz \b, uses gzip compression | |
| 574 | #>136 ledate x created: %s | |
| 575 | ||
| 576 | # other archives | |
| 577 | 0 long 0177555 very old archive | |
| 578 | 0 short 0177555 very old PDP-11 archive | |
| 579 | 0 long 0177545 old archive | |
| 580 | 0 short 0177545 old PDP-11 archive | |
| 581 | 0 long 0100554 apl workspace | |
| 582 | 0 string =<ar> archive | |
| 583 | ||
| 584 | # MIPS archive (needs to go before regular portable archives) | |
| 585 | # | |
| 586 | 0 string !<arch>\n__________E MIPS archive | |
| 587 | >20 string U with MIPS Ucode members | |
| 588 | >21 string L with MIPSEL members | |
| 589 | >21 string B with MIPSEB members | |
| 590 | >19 string L and an EL hash table | |
| 591 | >19 string B and an EB hash table | |
| 592 | >22 string X -- out of date | |
| 593 | ||
| 594 | 0 string -h- Software Tools format archive text | |
| 595 | ||
| 596 | # | |
| 597 | # XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is | |
| 598 | # "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have: | |
| 599 | # | |
| 600 | # 0 string !<arch> current ar archive | |
| 601 | # 0 long 0x213c6172 archive file | |
| 602 | # | |
| 603 | # and for SVR1 archives, we have: | |
| 604 | # | |
| 605 | # 0 string \<ar> System V Release 1 ar archive | |
| 606 | # 0 string =<ar> archive | |
| 607 | # | |
| 608 | # XXX - did Aegis really store shared libraries, breakpointed modules, | |
| 609 | # and absolute code program modules in the same format as new-style | |
| 610 | # "ar" archives? | |
| 611 | # | |
| 612 | 0 string !<arch> current ar archive | |
| 613 | >8 string __.SYMDEF random library | |
| 614 | >0 belong =65538 - pre SR9.5 | |
| 615 | >0 belong =65539 - post SR9.5 | |
| 616 | >0 beshort 2 - object archive | |
| 617 | >0 beshort 3 - shared library module | |
| 618 | >0 beshort 4 - debug break-pointed module | |
| 619 | >0 beshort 5 - absolute code program module | |
| 620 | 0 string \<ar> System V Release 1 ar archive | |
| 621 | 0 string =<ar> archive | |
| 622 | # | |
| 623 | # XXX - from "vax", which appears to collect a bunch of byte-swapped | |
| 624 | # thingies, to help you recognize VAX files on big-endian machines; | |
| 625 | # with "leshort", "lelong", and "string", that's no longer necessary.... | |
| 626 | # | |
| 627 | 0 belong 0x65ff0000 VAX 3.0 archive | |
| 628 | 0 belong 0x3c61723e VAX 5.0 archive | |
| 629 | # | |
| 630 | 0 long 0x213c6172 archive file | |
| 631 | 0 lelong 0177555 very old VAX archive | |
| 632 | 0 leshort 0177555 very old PDP-11 archive | |
| 633 | # | |
| 634 | # XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus | |
| 635 | # be a random library (it said 0xff65 rather than 0177545). | |
| 636 | # | |
| 637 | 0 lelong 0177545 old VAX archive | |
| 638 | >8 string __.SYMDEF random library | |
| 639 | 0 leshort 0177545 old PDP-11 archive | |
| 640 | >8 string __.SYMDEF random library | |
| 641 | # | |
| 642 | # From "pdp" (but why a 4-byte quantity?) | |
| 643 | # | |
| 644 | 0 lelong 0x39bed PDP-11 old archive | |
| 645 | 0 lelong 0x39bee PDP-11 4.0 archive | |
| 646 | ||
| 647 | # ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) | |
| 648 | # | |
| 649 | # The first byte is the magic (0x1a), byte 2 is the compression type for | |
| 650 | # the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS | |
| 651 | # filename of the first file (null terminated). Since some types collide | |
| 652 | # we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), | |
| 653 | # 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. | |
| 654 | 0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW | |
| 655 | 0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed | |
| 656 | 0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed | |
| 657 | 0 lelong&0x8080ffff 0x0000031a ARC archive data, packed | |
| 658 | 0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed | |
| 659 | 0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched | |
| 660 | ||
| 661 | # Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) | |
| 662 | # I can't create either SPARK or ArcFS archives so I have not tested this stuff | |
| 663 | # [GRR: the original entries collide with ARC, above; replaced with combined | |
| 664 | # version (not tested)] | |
| 665 | #0 byte 0x1a RISC OS archive | |
| 666 | #>1 string archive (ArcFS format) | |
| 667 | #0 string \032archive RISC OS archive (ArcFS format) | |
| 668 | 0 string \032 RISC OS archive (spark format) | |
| 669 | 0 string Archive\000 RISC OS archive (ArcFS format) | |
| 670 | ||
| 671 | # ARJ archiver (jason@jarthur.Claremont.EDU) | |
| 672 | 0 leshort 0xea60 ARJ archive data | |
| 673 | >5 byte x \b, v%d, | |
| 674 | >8 byte &0x04 multi-volume, | |
| 675 | >8 byte &0x10 slash-switched, | |
| 676 | >8 byte &0x20 backup, | |
| 677 | >34 string x original name: %s, | |
| 678 | >7 byte 0 os: MS-DOS | |
| 679 | >7 byte 1 os: PRIMOS | |
| 680 | >7 byte 2 os: Unix | |
| 681 | >7 byte 3 os: Amiga | |
| 682 | >7 byte 4 os: Macintosh | |
| 683 | >7 byte 5 os: OS/2 | |
| 684 | >7 byte 6 os: Apple ][ GS | |
| 685 | >7 byte 7 os: Atari ST | |
| 686 | >7 byte 8 os: NeXT | |
| 687 | >7 byte 9 os: VAX/VMS | |
| 688 | >3 byte >0 %d] | |
| 689 | ||
| 690 | # HA archiver (Greg Roelofs, newt@uchicago.edu) | |
| 691 | # This is a really bad format. A file containing HAWAII will match this... | |
| 692 | #0 string HA HA archive data, | |
| 693 | #>2 leshort =1 1 file, | |
| 694 | #>2 leshort >1 %u files, | |
| 695 | #>4 byte&0x0f =0 first is type CPY | |
| 696 | #>4 byte&0x0f =1 first is type ASC | |
| 697 | #>4 byte&0x0f =2 first is type HSC | |
| 698 | #>4 byte&0x0f =0x0e first is type DIR | |
| 699 | #>4 byte&0x0f =0x0f first is type SPECIAL | |
| 700 | ||
| 701 | # HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) | |
| 702 | 0 string HPAK HPACK archive data | |
| 703 | ||
| 704 | # JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net | |
| 705 | 0 string \351,\001JAM\ JAM archive, | |
| 706 | >7 string >\0 version %.4s | |
| 707 | >0x26 byte =0x27 - | |
| 708 | >>0x2b string >\0 label %.11s, | |
| 709 | >>0x27 lelong x serial %08x, | |
| 710 | >>0x36 string >\0 fstype %.8s | |
| 711 | ||
| 712 | # LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) | |
| 713 | 2 string -lh0- LHarc 1.x archive data [lh0] | |
| 714 | 2 string -lh1- LHarc 1.x archive data [lh1] | |
| 715 | 2 string -lz4- LHarc 1.x archive data [lz4] | |
| 716 | 2 string -lz5- LHarc 1.x archive data [lz5] | |
| 717 | # [never seen any but the last; -lh4- reported in comp.compression:] | |
| 718 | 2 string -lzs- LHa 2.x? archive data [lzs] | |
| 719 | 2 string -lh\40- LHa 2.x? archive data [lh ] | |
| 720 | 2 string -lhd- LHa 2.x? archive data [lhd] | |
| 721 | 2 string -lh2- LHa 2.x? archive data [lh2] | |
| 722 | 2 string -lh3- LHa 2.x? archive data [lh3] | |
| 723 | 2 string -lh4- LHa (2.x) archive data [lh4] | |
| 724 | 2 string -lh5- LHa (2.x) archive data [lh5] | |
| 725 | 2 string -lh6- LHa (2.x) archive data [lh6] | |
| 726 | 2 string -lh7- LHa (2.x) archive data [lh7] | |
| 727 | >20 byte x - header level %d | |
| 728 | ||
| 729 | # RAR archiver (Greg Roelofs, newt@uchicago.edu) | |
| 730 | 0 string Rar! RAR archive data, | |
| 731 | >44 byte x v%0x, | |
| 732 | >35 byte 0 os: MS-DOS | |
| 733 | >35 byte 1 os: OS/2 | |
| 734 | >35 byte 2 os: Win32 | |
| 735 | >35 byte 3 os: Unix | |
| 736 | ||
| 737 | # SQUISH archiver (Greg Roelofs, newt@uchicago.edu) | |
| 738 | 0 string SQSH squished archive data (Acorn RISCOS) | |
| 739 | ||
| 740 | # UC2 archiver (Greg Roelofs, newt@uchicago.edu) | |
| 741 | # I can't figure out the self-extracting form of these buggers... | |
| 742 | 0 string UC2\x1a UC2 archive data | |
| 743 | ||
| 744 | # ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) | |
| 745 | 0 string PK\003\004 Zip archive data | |
| 746 | >4 byte 0x09 \b, at least v0.9 to extract | |
| 747 | >4 byte 0x0a \b, at least v1.0 to extract | |
| 748 | >4 byte 0x0b \b, at least v1.1 to extract | |
| 749 | >4 byte 0x14 \b, at least v2.0 to extract | |
| 750 | ||
| 751 | # Zoo archiver | |
| 752 | 20 lelong 0xfdc4a7dc Zoo archive data | |
| 753 | >4 byte >48 \b, v%c. | |
| 754 | >>6 byte >47 \b%c | |
| 755 | >>>7 byte >47 \b%c | |
| 756 | >32 byte >0 \b, modify: v%d | |
| 757 | >>33 byte x \b.%d+ | |
| 758 | >42 lelong 0xfdc4a7dc \b, | |
| 759 | >>70 byte >0 extract: v%d | |
| 760 | >>>71 byte x \b.%d+ | |
| 761 | ||
| 762 | # Shell archives | |
| 763 | 10 string #\ This\ is\ a\ shell\ archive shell archive text | |
| 764 | ||
| 765 | # | |
| 766 | # LBR. NB: May conflict with the questionable | |
| 767 | # "binary Computer Graphics Metafile" format. | |
| 768 | # | |
| 769 | 0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data | |
| 770 | # | |
| 771 | # PMA (CP/M derivative of LHA) | |
| 772 | # | |
| 773 | 2 string -pm0- PMarc archive data [pm0] | |
| 774 | 2 string -pm1- PMarc archive data [pm1] | |
| 775 | 2 string -pm2- PMarc archive data [pm2] | |
| 776 | 2 string -pms- PMarc SFX archive (CP/M, DOS) | |
| 777 | 5 string -pc1- PopCom compressed executable (CP/M) | |
| 778 | ||
| 779 | # From Rafael Laboissiere <rafael@laboissiere.net> | |
| 780 | # The Project Revision Control System (see | |
| 781 | # http://prcs.sourceforge.net) generates a packaged project | |
| 782 | # file which is recognized by the following entry: | |
| 783 | 0 leshort 0xeb81 PRCS packaged project | |
| 784 | ||
| 785 | # Microsoft cabinets | |
| 786 | # by David Necas (Yeti) <yeti@physics.muni.cz> | |
| 787 | #0 string MSCF\0\0\0\0 Microsoft cabinet file data, | |
| 788 | #>25 byte x v%d | |
| 789 | #>24 byte x \b.%d | |
| 790 | # MPi: All CABs have version 1.3, so this is pointless. | |
| 791 | # Better magic in debian-additions. | |
| 792 | ||
| 793 | # GTKtalog catalogs | |
| 794 | # by David Necas (Yeti) <yeti@physics.muni.cz> | |
| 795 | 4 string gtktalog\ GTKtalog catalog data, | |
| 796 | >13 string 3 version 3 | |
| 797 | >>14 beshort 0x677a (gzipped) | |
| 798 | >>14 beshort !0x677a (not gzipped) | |
| 799 | >13 string >3 version %s | |
| 800 | ||
| 801 | ############################################################################ | |
| 802 | # Parity archive reconstruction file, the 'par' file format now used on Usenet. | |
| 803 | 0 string PAR\0 PARity archive data | |
| 804 | >48 leshort =0 - Index file | |
| 805 | >48 leshort >0 - file number %d | |
| 806 | ||
| 807 | # Felix von Leitner <felix-file@fefe.de> | |
| 808 | 0 string d8:announce BitTorrent file | |
| 809 | ||
| 810 | # Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> | |
| 811 | 0 beshort 0x0e0f Atari MSA archive data | |
| 812 | >2 beshort x \b, %d sectors per track | |
| 813 | >4 beshort 0 \b, 1 sided | |
| 814 | >4 beshort 1 \b, 2 sided | |
| 815 | >6 beshort x \b, starting track: %d | |
| 816 | >8 beshort x \b, ending track: %d | |
| 817 | ||
| 818 | # Alternate ZIP string (amc@arwen.cs.berkeley.edu) | |
| 819 | 0 string PK00PK\003\004 Zip archive data | |
| 820 | ||
| 821 | # ACE archive (from http://www.wotsit.org/download.asp?f=ace) | |
| 822 | # by Stefan `Sec` Zehl <sec@42.org> | |
| 823 | 7 string **ACE** ACE compressed archive | |
| 824 | >15 byte >0 version %d | |
| 825 | >16 byte =0x00 \b, from MS-DOS | |
| 826 | >16 byte =0x01 \b, from OS/2 | |
| 827 | >16 byte =0x02 \b, from Win/32 | |
| 828 | >16 byte =0x03 \b, from Unix | |
| 829 | >16 byte =0x04 \b, from MacOS | |
| 830 | >16 byte =0x05 \b, from WinNT | |
| 831 | >16 byte =0x06 \b, from Primos | |
| 832 | >16 byte =0x07 \b, from AppleGS | |
| 833 | >16 byte =0x08 \b, from Atari | |
| 834 | >16 byte =0x09 \b, from Vax/VMS | |
| 835 | >16 byte =0x0A \b, from Amiga | |
| 836 | >16 byte =0x0B \b, from Next | |
| 837 | >14 byte x \b, version %d to extract | |
| 838 | >5 leshort &0x0080 \b, multiple volumes, | |
| 839 | >>17 byte x \b (part %d), | |
| 840 | >5 leshort &0x0002 \b, contains comment | |
| 841 | >5 leshort &0x0200 \b, sfx | |
| 842 | >5 leshort &0x0400 \b, small dictionary | |
| 843 | >5 leshort &0x0800 \b, multi-volume | |
| 844 | >5 leshort &0x1000 \b, contains AV-String | |
| 845 | >>30 string\x16*UNREGISTERED\x20VERSION* (unregistered) | |
| 846 | >5 leshort &0x2000 \b, with recovery record | |
| 847 | >5 leshort &0x4000 \b, locked | |
| 848 | >5 leshort &0x8000 \b, solid | |
| 849 | # Date in MS-DOS format (whatever that is) | |
| 850 | #>18 lelong x Created on | |
| 851 | ||
| 852 | # sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann | |
| 853 | # <doj@cubic.org> | |
| 854 | 0x1A string sfArk sfArk compressed Soundfont | |
| 855 | >0x15 string 2 | |
| 856 | >>0x1 string >\0 Version %s | |
| 857 | >>0x2A string >\0 : %s | |
| 858 | ||
| 859 | #------------------------------------------------------------------------------ | |
| 860 | # citrus locale declaration | |
| 861 | # | |
| 862 | ||
| 863 | 0 string RuneCT Citrus locale declaration for LC_CTYPE | |
| 864 | ||
| 865 | ||
| 866 | #------------------------------------------------------------------------------ | |
| 867 | # compress: file(1) magic for pure-compression formats (no archives) | |
| 868 | # | |
| 869 | # compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc. | |
| 870 | # | |
| 871 | # Formats for various forms of compressed data | |
| 872 | # Formats for "compress" proper have been moved into "compress.c", | |
| 873 | # because it tries to uncompress it to figure out what's inside. | |
| 874 | ||
| 875 | # standard unix compress | |
| 876 | 0 string \037\235 compress'd data | |
| 877 | >2 byte&0x80 >0 block compressed | |
| 878 | >2 byte&0x1f x %d bits | |
| 879 | ||
| 880 | # gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver) | |
| 881 | # Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 | |
| 882 | # * Original filename is only at offset 10 if "extra field" absent | |
| 883 | # * Produce shorter output - notably, only report compression methods | |
| 884 | # other than 8 ("deflate", the only method defined in RFC 1952). | |
| 885 | 0 string \037\213 gzip compressed data | |
| 886 | >2 byte <8 \b, reserved method | |
| 887 | >2 byte >8 \b, unknown method | |
| 888 | >3 byte &0x01 \b, ASCII | |
| 889 | >3 byte &0x02 \b, continuation | |
| 890 | >3 byte &0x04 \b, extra field | |
| 891 | >3 byte&0xC =0x08 | |
| 892 | >>10 string x \b, was "%s" | |
| 893 | >9 byte =0x00 \b, from MS-DOS | |
| 894 | >9 byte =0x01 \b, from Amiga | |
| 895 | >9 byte =0x02 \b, from VMS | |
| 896 | >9 byte =0x03 \b, from Unix | |
| 897 | >9 byte =0x05 \b, from Atari | |
| 898 | >9 byte =0x06 \b, from OS/2 | |
| 899 | >9 byte =0x07 \b, from MacOS | |
| 900 | >9 byte =0x0A \b, from Tops/20 | |
| 901 | >9 byte =0x0B \b, from Win/32 | |
| 902 | >3 byte &0x10 \b, comment | |
| 903 | >3 byte &0x20 \b, encrypted | |
| 904 | ### >4 ledate x last modified: %s, | |
| 905 | >8 byte 2 \b, max compression | |
| 906 | >8 byte 4 \b, max speed | |
| 907 | ||
| 908 | # packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis | |
| 909 | 0 string \037\036 packed data | |
| 910 | >2 belong >1 \b, %d characters originally | |
| 911 | >2 belong =1 \b, %d character originally | |
| 912 | # | |
| 913 | # This magic number is byte-order-independent. | |
| 914 | 0 short 0x1f1f old packed data | |
| 915 | ||
| 916 | # XXX - why *two* entries for "compacted data", one of which is | |
| 917 | # byte-order independent, and one of which is byte-order dependent? | |
| 918 | # | |
| 919 | 0 short 0x1fff compacted data | |
| 920 | # This string is valid for SunOS (BE) and a matching "short" is listed | |
| 921 | # in the Ultrix (LE) magic file. | |
| 922 | 0 string \377\037 compacted data | |
| 923 | 0 short 0145405 huf output | |
| 924 | ||
| 925 | # bzip2 | |
| 926 | 0 string BZh bzip2 compressed data | |
| 927 | >3 byte >47 \b, block size = %c00k | |
| 928 | ||
| 929 | # squeeze and crunch | |
| 930 | # Michael Haardt <michael@cantor.informatik.rwth-aachen.de> | |
| 931 | 0 beshort 0x76FF squeezed data, | |
| 932 | >4 string x original name %s | |
| 933 | 0 beshort 0x76FE crunched data, | |
| 934 | >2 string x original name %s | |
| 935 | 0 beshort 0x76FD LZH compressed data, | |
| 936 | >2 string x original name %s | |
| 937 | ||
| 938 | # Freeze | |
| 939 | 0 string \037\237 frozen file 2.1 | |
| 940 | 0 string \037\236 frozen file 1.0 (or gzip 0.5) | |
| 941 | ||
| 942 | # SCO compress -H (LZH) | |
| 943 | 0 string \037\240 SCO compress -H (LZH) data | |
| 944 | ||
| 945 | # European GSM 06.10 is a provisional standard for full-rate speech | |
| 946 | # transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse | |
| 947 | # excitation/long term prediction) coding at 13 kbit/s. | |
| 948 | # | |
| 949 | # There's only a magic nibble (4 bits); that nibble repeats every 33 | |
| 950 | # bytes. This isn't suited for use, but maybe we can use it someday. | |
| 951 | # | |
| 952 | # This will cause very short GSM files to be declared as data and | |
| 953 | # mismatches to be declared as data too! | |
| 954 | #0 byte&0xF0 0xd0 data | |
| 955 | #>33 byte&0xF0 0xd0 | |
| 956 | #>66 byte&0xF0 0xd0 | |
| 957 | #>99 byte&0xF0 0xd0 | |
| 958 | #>132 byte&0xF0 0xd0 GSM 06.10 compressed audio | |
| 959 | ||
| 960 | # bzip a block-sorting file compressor | |
| 961 | # by Julian Seward <sewardj@cs.man.ac.uk> and others | |
| 962 | # | |
| 963 | 0 string BZ bzip compressed data | |
| 964 | >2 byte x \b, version: %c | |
| 965 | >3 string =1 \b, compression block size 100k | |
| 966 | >3 string =2 \b, compression block size 200k | |
| 967 | >3 string =3 \b, compression block size 300k | |
| 968 | >3 string =4 \b, compression block size 400k | |
| 969 | >3 string =5 \b, compression block size 500k | |
| 970 | >3 string =6 \b, compression block size 600k | |
| 971 | >3 string =7 \b, compression block size 700k | |
| 972 | >3 string =8 \b, compression block size 800k | |
| 973 | >3 string =9 \b, compression block size 900k | |
| 974 | ||
| 975 | # lzop from <markus.oberhumer@jk.uni-linz.ac.at> | |
| 976 | 0 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data | |
| 977 | >9 beshort <0x0940 | |
| 978 | >>9 byte&0xf0 =0x00 - version 0. | |
| 979 | >>9 beshort&0x0fff x \b%03x, | |
| 980 | >>13 byte 1 LZO1X-1, | |
| 981 | >>13 byte 2 LZO1X-1(15), | |
| 982 | >>13 byte 3 LZO1X-999, | |
| 983 | ## >>22 bedate >0 last modified: %s, | |
| 984 | >>14 byte =0x00 os: MS-DOS | |
| 985 | >>14 byte =0x01 os: Amiga | |
| 986 | >>14 byte =0x02 os: VMS | |
| 987 | >>14 byte =0x03 os: Unix | |
| 988 | >>14 byte =0x05 os: Atari | |
| 989 | >>14 byte =0x06 os: OS/2 | |
| 990 | >>14 byte =0x07 os: MacOS | |
| 991 | >>14 byte =0x0A os: Tops/20 | |
| 992 | >>14 byte =0x0B os: WinNT | |
| 993 | >>14 byte =0x0E os: Win32 | |
| 994 | >9 beshort >0x0939 | |
| 995 | >>9 byte&0xf0 =0x00 - version 0. | |
| 996 | >>9 byte&0xf0 =0x10 - version 1. | |
| 997 | >>9 byte&0xf0 =0x20 - version 2. | |
| 998 | >>9 beshort&0x0fff x \b%03x, | |
| 999 | >>15 byte 1 LZO1X-1, | |
| 1000 | >>15 byte 2 LZO1X-1(15), | |
| 1001 | >>15 byte 3 LZO1X-999, | |
| 1002 | ## >>25 bedate >0 last modified: %s, | |
| 1003 | >>17 byte =0x00 os: MS-DOS | |
| 1004 | >>17 byte =0x01 os: Amiga | |
| 1005 | >>17 byte =0x02 os: VMS | |
| 1006 | >>17 byte =0x03 os: Unix | |
| 1007 | >>17 byte =0x05 os: Atari | |
| 1008 | >>17 byte =0x06 os: OS/2 | |
| 1009 | >>17 byte =0x07 os: MacOS | |
| 1010 | >>17 byte =0x0A os: Tops/20 | |
| 1011 | >>17 byte =0x0B os: WinNT | |
| 1012 | >>17 byte =0x0E os: Win32 | |
| 1013 | ||
| 1014 | # 4.3BSD-Quasijarus Strong Compression | |
| 1015 | # http://minnie.tuhs.org/Quasijarus/compress.html | |
| 1016 | 0 string \037\241 Quasijarus strong compressed data | |
| 1017 | ||
| 1018 | # From: Cory Dikkers <cdikkers@swbell.net> | |
| 1019 | 0 string XPKF Amiga xpkf.library compressed data | |
| 1020 | 0 string PP11 Power Packer 1.1 compressed data | |
| 1021 | 0 string PP20 Power Packer 2.0 compressed data, | |
| 1022 | >4 belong 0x09090909 fast compression | |
| 1023 | >4 belong 0x090A0A0A mediocre compression | |
| 1024 | >4 belong 0x090A0B0B good compression | |
| 1025 | >4 belong 0x090A0C0C very good compression | |
| 1026 | >4 belong 0x090A0C0D best compression | |
| 1027 | ||
| 1028 | # 7z archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at) | |
| 1029 | # http://www.7-zip.org or DOC/7zFormat.txt | |
| 1030 | # | |
| 1031 | 0 string 7z\274\257\047\034 7z archive data, | |
| 1032 | >6 byte x version %d | |
| 1033 | >7 byte x \b.%d | |
| 1034 | ||
| 1035 | # AFX compressed files (Wolfram Kleff) | |
| 1036 | 2 string -afx- AFX compressed file data | |
| 1037 | ||
| 1038 | #------------------------------------------------------------------------------ | |
| 1039 | # fsav: file(1) magic for datafellows fsav virus definition files | |
| 1040 | # Anthon van der Neut (anthon@mnt.org) | |
| 1041 | 0 beshort 0x1575 fsav (linux) macro virus | |
| 1042 | >8 leshort >0 (%d- | |
| 1043 | >11 byte >0 \b%02d- | |
| 1044 | >10 byte >0 \b%02d) | |
| 1045 | ||
| 1046 | # comment this out for now because it regognizes every file where | |
| 1047 | # the eighth character is \n | |
| 1048 | #8 byte 0x0a | |
| 1049 | #>12 byte 0x07 | |
| 1050 | #>11 leshort >0 fsav (linux) virus (%d- | |
| 1051 | #>10 byte 0 \b01- | |
| 1052 | #>10 byte 1 \b02- | |
| 1053 | #>10 byte 2 \b03- | |
| 1054 | #>10 byte 3 \b04- | |
| 1055 | #>10 byte 4 \b05- | |
| 1056 | #>10 byte 5 \b06- | |
| 1057 | #>10 byte 6 \b07- | |
| 1058 | #>10 byte 7 \b08- | |
| 1059 | #>10 byte 8 \b08- | |
| 1060 | #>10 byte 9 \b10- | |
| 1061 | #>10 byte 10 \b11- | |
| 1062 | #>10 byte 11 \b12- | |
| 1063 | #>9 byte >0 \b%02d) | |
| 1064 | ||
| 1065 | #------------------------------------------------------------------------------ | |
| 1066 | # GEOS files (Vidar Madsen, vidar@gimp.org) | |
| 1067 | # semi-commonly used in embedded and handheld systems. | |
| 1068 | 0 belong 0xc745c153 GEOS | |
| 1069 | >40 byte 1 executable | |
| 1070 | >40 byte 2 VMFile | |
| 1071 | >40 byte 3 binary | |
| 1072 | >40 byte 4 directory label | |
| 1073 | >40 byte <1 unknown | |
| 1074 | >40 byte >4 unknown | |
| 1075 | >4 string >\0 \b, name "%s" | |
| 1076 | #>44 short x \b, version %d | |
| 1077 | #>46 short x \b.%d | |
| 1078 | #>48 short x \b, rev %d | |
| 1079 | #>50 short x \b.%d | |
| 1080 | #>52 short x \b, proto %d | |
| 1081 | #>54 short x \br%d | |
| 1082 | #>168 string >\0 \b, copyright "%s" | |
| 1083 | #------------------------------------------------------------ | |
| 1084 | # Java ByteCode | |
| 1085 | # From Larry Schwimmer (schwim@cs.stanford.edu) | |
| 1086 | 0 belong 0xcafebabe compiled Java class data, | |
| 1087 | >6 beshort x version %d. | |
| 1088 | >4 beshort x \b%d | |
| 1089 | #------------------------------------------------------------ | |
| 1090 | # Java serialization | |
| 1091 | # From Martin Pool (m.pool@pharos.com.au) | |
| 1092 | 0 beshort 0xaced Java serialization data | |
| 1093 | >2 beshort >0x0004 \b, version %d | |
| 1094 | ||
| 1095 | #------------------------------------------------------------------------------ | |
| 1096 | # mlssa: file(1) magic for MLSSA datafiles | |
| 1097 | # | |
| 1098 | 0 lelong 0xffffabcd MLSSA datafile, | |
| 1099 | >4 leshort x algorithm %d, | |
| 1100 | >10 lelong x %d samples | |
| 1101 | ||
| 1102 | #------------------------------------------------------------------------------ | |
| 1103 | # mmdf: file(1) magic for MMDF mail files | |
| 1104 | # | |
| 1105 | 0 string \001\001\001\001 MMDF mailbox | |
| 1106 | ||
| 1107 | #------------------------------------------------------------------------------ | |
| 1108 | # msdos: file(1) magic for MS-DOS files | |
| 1109 | # | |
| 1110 | ||
| 1111 | # .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) | |
| 1112 | 0 string/c @echo\ off MS-DOS batch file text | |
| 1113 | ||
| 1114 | # XXX - according to Microsoft's spec, at an offset of 0x3c in a | |
| 1115 | # PE-format executable is the offset in the file of the PE header; | |
| 1116 | # unfortunately, that's a little-endian offset, and there's no way | |
| 1117 | # to specify an indirect offset with a specified byte order. | |
| 1118 | # So, for now, we assume the standard MS-DOS stub, which puts the | |
| 1119 | # PE header at 0x80 = 128. | |
| 1120 | # | |
| 1121 | # Required OS version and subsystem version were 4.0 on some NT 3.51 | |
| 1122 | # executables built with Visual C++ 4.0, so it's not clear that | |
| 1123 | # they're interesting. The user version was 0.0, but there's | |
| 1124 | # probably some linker directive to set it. The linker version was | |
| 1125 | # 3.0, except for one ".exe" which had it as 4.20 (same damn linker!). | |
| 1126 | # | |
| 1127 | 128 string PE\0\0 MS Windows PE | |
| 1128 | >150 leshort&0x0100 >0 32-bit | |
| 1129 | >132 leshort 0x0 unknown processor | |
| 1130 | >132 leshort 0x14c Intel 80386 | |
| 1131 | >132 leshort 0x166 MIPS R4000 | |
| 1132 | >132 leshort 0x184 Alpha | |
| 1133 | >132 leshort 0x268 Motorola 68000 | |
| 1134 | >132 leshort 0x1f0 PowerPC | |
| 1135 | >132 leshort 0x290 PA-RISC | |
| 1136 | >148 leshort >27 | |
| 1137 | >>220 leshort 0 unknown subsystem | |
| 1138 | >>220 leshort 1 native | |
| 1139 | >>220 leshort 2 GUI | |
| 1140 | >>220 leshort 3 console | |
| 1141 | >>220 leshort 7 POSIX | |
| 1142 | >150 leshort&0x2000 =0 executable | |
| 1143 | #>>136 ledate x stamp %s, | |
| 1144 | >>150 leshort&0x0001 >0 not relocatable | |
| 1145 | #>>150 leshort&0x0004 =0 with line numbers, | |
| 1146 | #>>150 leshort&0x0008 =0 with local symbols, | |
| 1147 | #>>150 leshort&0x0200 =0 with debug symbols, | |
| 1148 | >>150 leshort&0x1000 >0 system file | |
| 1149 | #>>148 leshort >0 | |
| 1150 | #>>>154 byte x linker %d | |
| 1151 | #>>>155 byte x \b.%d, | |
| 1152 | #>>148 leshort >27 | |
| 1153 | #>>>192 leshort x requires OS %d | |
| 1154 | #>>>194 leshort x \b.%d, | |
| 1155 | #>>>196 leshort x user version %d | |
| 1156 | #>>>198 leshort x \b.%d, | |
| 1157 | #>>>200 leshort x subsystem version %d | |
| 1158 | #>>>202 leshort x \b.%d, | |
| 1159 | >150 leshort&0x2000 >0 DLL | |
| 1160 | #>>136 ledate x stamp %s, | |
| 1161 | >>150 leshort&0x0001 >0 not relocatable | |
| 1162 | #>>150 leshort&0x0004 =0 with line numbers, | |
| 1163 | #>>150 leshort&0x0008 =0 with local symbols, | |
| 1164 | #>>150 leshort&0x0200 =0 with debug symbols, | |
| 1165 | >>150 leshort&0x1000 >0 system file | |
| 1166 | #>>148 leshort >0 | |
| 1167 | #>>>154 byte x linker %d | |
| 1168 | #>>>155 byte x \b.%d, | |
| 1169 | #>>148 leshort >27 | |
| 1170 | #>>>192 leshort x requires OS %d | |
| 1171 | #>>>194 leshort x \b.%d, | |
| 1172 | #>>>196 leshort x user version %d | |
| 1173 | #>>>198 leshort x \b.%d, | |
| 1174 | #>>>200 leshort x subsystem version %d | |
| 1175 | #>>>202 leshort x \b.%d, | |
| 1176 | 0 leshort 0x14c MS Windows COFF Intel 80386 object file | |
| 1177 | #>4 ledate x stamp %s | |
| 1178 | 0 leshort 0x166 MS Windows COFF MIPS R4000 object file | |
| 1179 | #>4 ledate x stamp %s | |
| 1180 | 0 leshort 0x184 MS Windows COFF Alpha object file | |
| 1181 | #>4 ledate x stamp %s | |
| 1182 | 0 leshort 0x268 MS Windows COFF Motorola 68000 object file | |
| 1183 | #>4 ledate x stamp %s | |
| 1184 | 0 leshort 0x1f0 MS Windows COFF PowerPC object file | |
| 1185 | #>4 ledate x stamp %s | |
| 1186 | 0 leshort 0x290 MS Windows COFF PA-RISC object file | |
| 1187 | #>4 ledate x stamp %s | |
| 1188 | ||
| 1189 | # .EXE formats (Greg Roelofs, newt@uchicago.edu) | |
| 1190 | # | |
| 1191 | 0 string MZ MS-DOS executable (EXE) | |
| 1192 | >24 string @ \b, OS/2 or MS Windows | |
| 1193 | >>0xe7 string LH/2\ Self-Extract \b, %s | |
| 1194 | >>0xe9 string PKSFX2 \b, %s | |
| 1195 | >>122 string Windows\ self-extracting\ ZIP \b, %s | |
| 1196 | >0x1c string RJSX\xff\xff \b, ARJ SFX | |
| 1197 | >0x1c string diet\xf9\x9c \b, diet compressed | |
| 1198 | >0x1c string LZ09 \b, LZEXE v0.90 compressed | |
| 1199 | >0x1c string LZ91 \b, LZEXE v0.91 compressed | |
| 1200 | >0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. \b, PKSFX | |
| 1201 | # JM: 0x1e "PKLITE Copr. 1990-92 PKWARE Inc. All Rights Reserved\7\0\0\0" | |
| 1202 | >0x1e string PKLITE\ Copr. \b, %.6s compressed | |
| 1203 | >0x24 string LHa's\ SFX \b, %.15s | |
| 1204 | >0x24 string LHA's\ SFX \b, %.15s | |
| 1205 | >1638 string -lh5- \b, LHa SFX archive v2.13S | |
| 1206 | >7195 string Rar! \b, RAR self-extracting archive | |
| 1207 | # | |
| 1208 | # [GRR 950118: file 3.15 has a buffer-size limitation; offsets bigger than | |
| 1209 | # 8161 bytes are ignored. To make the following entries work, increase | |
| 1210 | # HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2, | |
| 1211 | # NT/Win32 and VMS.] | |
| 1212 | # [GRR: some company sells a self-extractor/displayer for image data(!)] | |
| 1213 | # | |
| 1214 | >11696 string PK\003\004 \b, PKZIP SFX archive v1.1 | |
| 1215 | >13297 string PK\003\004 \b, PKZIP SFX archive v1.93a | |
| 1216 | >15588 string PK\003\004 \b, PKZIP2 SFX archive v1.09 | |
| 1217 | >15770 string PK\003\004 \b, PKZIP SFX archive v2.04g | |
| 1218 | >28374 string PK\003\004 \b, PKZIP2 SFX archive v1.02 | |
| 1219 | # | |
| 1220 | # Info-ZIP self-extractors | |
| 1221 | # these are the DOS versions: | |
| 1222 | >25115 string PK\003\004 \b, Info-ZIP SFX archive v5.12 | |
| 1223 | >26331 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption | |
| 1224 | # these are the OS/2 versions (OS/2 is flagged above): | |
| 1225 | >47031 string PK\003\004 \b, Info-ZIP SFX archive v5.12 | |
| 1226 | >49845 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption | |
| 1227 | # this is the NT/Win32 version: | |
| 1228 | >69120 string PK\003\004 \b, Info-ZIP NT SFX archive v5.12 w/decryption | |
| 1229 | # | |
| 1230 | # TELVOX Teleinformatica CODEC self-extractor for OS/2: | |
| 1231 | >49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 | |
| 1232 | >>49824 leshort =1 \b, 1 file | |
| 1233 | >>49824 leshort >1 \b, %u files | |
| 1234 | ||
| 1235 | # .COM formats (Daniel Quinlan, quinlan@yggdrasil.com) | |
| 1236 | # Uncommenting only the first two lines will cover about 2/3 of COM files, | |
| 1237 | # but it isn't feasible to match all COM files since there must be at least | |
| 1238 | # two dozen different one-byte "magics". | |
| 1239 | #0 byte 0xe9 MS-DOS executable (COM) | |
| 1240 | #>6 string SFX\ of\ LHarc (%s) | |
| 1241 | #0 byte 0x8c MS-DOS executable (COM) | |
| 1242 | # 0xeb conflicts with "sequent" magic | |
| 1243 | #0 byte 0xeb MS-DOS executable (COM) | |
| 1244 | #0 byte 0xb8 MS-DOS executable (COM) | |
| 1245 | ||
| 1246 | # miscellaneous formats | |
| 1247 | 0 string LZ MS-DOS executable (built-in) | |
| 1248 | #0 byte 0xf0 MS-DOS program library data | |
| 1249 | # | |
| 1250 | ||
| 1251 | # | |
| 1252 | # Windows Registry files. | |
| 1253 | # | |
| 1254 | 0 string regf Windows NT registry file | |
| 1255 | 0 string CREG Windows 95 registry file | |
| 1256 | ||
| 1257 | ||
| 1258 | # AAF files: | |
| 1259 | # <stuartc@rd.bbc.co.uk> Stuart Cunningham | |
| 1260 | 0 string \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage | |
| 1261 | >30 byte 9 (512B sectors) | |
| 1262 | >30 byte 12 (4kB sectors) | |
| 1263 | 0 string \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage | |
| 1264 | >30 byte 9 (512B sectors) | |
| 1265 | >30 byte 12 (4kB sectors) | |
| 1266 | ||
| 1267 | # Popular applications | |
| 1268 | 2080 string Microsoft\ Word\ 6.0\ Document %s | |
| 1269 | 2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data | |
| 1270 | # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word) | |
| 1271 | 2112 string MSWordDoc Microsoft Word document data | |
| 1272 | # | |
| 1273 | 0 belong 0x31be0000 Microsoft Word Document | |
| 1274 | # | |
| 1275 | 0 string PO^Q` Microsoft Word 6.0 Document | |
| 1276 | # | |
| 1277 | 0 string \376\067\0\043 Microsoft Office Document | |
| 1278 | 0 string \320\317\021\340\241\261\032\341 Microsoft Office Document | |
| 1279 | 0 string \333\245-\0\0\0 Microsoft Office Document | |
| 1280 | # | |
| 1281 | 2080 string Microsoft\ Excel\ 5.0\ Worksheet %s | |
| 1282 | 2080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s | |
| 1283 | # | |
| 1284 | # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel) | |
| 1285 | 2114 string Biff5 Microsoft Excel 5.0 Worksheet | |
| 1286 | # Italian MS-Excel | |
| 1287 | 2121 string Biff5 Microsoft Excel 5.0 Worksheet | |
| 1288 | 0 string \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet | |
| 1289 | # | |
| 1290 | 0 belong 0x00001a00 Lotus 1-2-3 | |
| 1291 | >4 belong 0x00100400 wk3 document data | |
| 1292 | >4 belong 0x02100400 wk4 document data | |
| 1293 | >4 belong 0x07800100 fm3 or fmb document data | |
| 1294 | >4 belong 0x07800000 fm3 or fmb document data | |
| 1295 | # | |
| 1296 | 0 belong 0x00000200 Lotus 1-2-3 | |
| 1297 | >4 belong 0x06040600 wk1 document data | |
| 1298 | >4 belong 0x06800200 fmt document data | |
| 1299 | ||
| 1300 | # Help files | |
| 1301 | 0 string ?_\3\0 MS Windows Help Data | |
| 1302 | ||
| 1303 | # DeIsL1.isu what this is I don't know | |
| 1304 | 0 string \161\250\000\000\001\002 DeIsL1.isu whatever that is | |
| 1305 | ||
| 1306 | # Winamp .avs | |
| 1307 | #0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player | |
| 1308 | 0 string Nullsoft\ AVS\ Preset\ Winamp plug in | |
| 1309 | ||
| 1310 | # Hyper terminal: | |
| 1311 | 0 string HyperTerminal\ hyperterm | |
| 1312 | >15 string 1.0\ --\ HyperTerminal\ data\ file MS-windows Hyperterminal | |
| 1313 | ||
| 1314 | # Windows Metafont .WMF | |
| 1315 | 0 string \327\315\306\232\000\000\000\000\000\000 ms-windows metafont .wmf | |
| 1316 | ||
| 1317 | #tz3 files whatever that is (MS Works files) | |
| 1318 | 0 string \003\001\001\004\070\001\000\000 tz3 ms-works file | |
| 1319 | 0 string \003\002\001\004\070\001\000\000 tz3 ms-works file | |
| 1320 | 0 string \003\003\001\004\070\001\000\000 tz3 ms-works file | |
| 1321 | ||
| 1322 | # PGP sig files .sig | |
| 1323 | #0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig | |
| 1324 | 0 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig | |
| 1325 | 0 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig | |
| 1326 | 0 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig | |
| 1327 | 0 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig | |
| 1328 | 0 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig | |
| 1329 | 0 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig | |
| 1330 | ||
| 1331 | # windows zips files .dmf | |
| 1332 | 0 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 Ms-windows special zipped file | |
| 1333 | ||
| 1334 | ||
| 1335 | # Windows help file FTG FTS | |
| 1336 | 0 string \164\146\115\122\012\000\000\000\001\000\000\000 ms-windows help cache | |
| 1337 | ||
| 1338 | # grp old windows 3.1 group files | |
| 1339 | 0 string \120\115\103\103 Ms-windows 3.1 group files | |
| 1340 | ||
| 1341 | ||
| 1342 | # lnk files windows symlinks | |
| 1343 | 0 string \114\000\000\000\001\024\002\000\000\000\000\000\300\000\000\000\000\000\000\106 ms-Windows shortcut | |
| 1344 | ||
| 1345 | #ico files | |
| 1346 | 0 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for ms-windows | |
| 1347 | ||
| 1348 | # Windows icons (Ian Springer <ips@fpk.hp.com>) | |
| 1349 | 0 string \000\000\001\000 ms-windows icon resource | |
| 1350 | >4 byte 1 - 1 icon | |
| 1351 | >4 byte >1 - %d icons | |
| 1352 | >>6 byte >0 \b, %dx | |
| 1353 | >>>7 byte >0 \b%d | |
| 1354 | >>8 byte 0 \b, 256-colors | |
| 1355 | >>8 byte >0 \b, %d-colors | |
| 1356 | ||
| 1357 | ||
| 1358 | # .chr files | |
| 1359 | 0 string PK\010\010BGI Borland font | |
| 1360 | >4 string >\0 %s | |
| 1361 | # then there is a copyright notice | |
| 1362 | ||
| 1363 | ||
| 1364 | # .bgi files | |
| 1365 | 0 string pk\010\010BGI Borland device | |
| 1366 | >4 string >\0 %s | |
| 1367 | # then there is a copyright notice | |
| 1368 | ||
| 1369 | ||
| 1370 | # recycled/info the windows trash bin index | |
| 1371 | 9 string \000\000\000\030\001\000\000\000 ms-windows recycled bin info | |
| 1372 | ||
| 1373 | ||
| 1374 | ##### put in Either Magic/font or Magic/news | |
| 1375 | # Acroread or something files wrongly identified as G3 .pfm | |
| 1376 | # these have the form \000 \001 any? \002 \000 \000 | |
| 1377 | # or \000 \001 any? \022 \000 \000 | |
| 1378 | #0 string \000\001 pfm? | |
| 1379 | #>3 string \022\000\000Copyright\ yes | |
| 1380 | #>3 string \002\000\000Copyright\ yes | |
| 1381 | #>3 string >\0 oops, not a font file. Cancel that. | |
| 1382 | #it clashes with ttf files so put it lower down. | |
| 1383 | ||
| 1384 | # From Doug Lee via a FreeBSD pr | |
| 1385 | 9 string GERBILDOC First Choice document | |
| 1386 | 9 string GERBILDB First Choice database | |
| 1387 | 9 string GERBILCLIP First Choice database | |
| 1388 | 0 string GERBIL First Choice device file | |
| 1389 | 9 string RABBITGRAPH RabbitGraph file | |
| 1390 | 0 string DCU1 Borland Delphi .DCU file | |
| 1391 | 0 string !<spell> MKS Spell hash list (old format) | |
| 1392 | 0 string !<spell2> MKS Spell hash list | |
| 1393 | # Too simple - MPi | |
| 1394 | #0 string AH Halo(TM) bitmapped font file | |
| 1395 | 0 lelong 0x08086b70 TurboC BGI file | |
| 1396 | 0 lelong 0x08084b50 TurboC Font file | |
| 1397 | ||
| 1398 | # WARNING: below line conflicts with Infocom game data Z-machine 3 | |
| 1399 | 0 byte 0x03 DBase 3 data file | |
| 1400 | >0x04 lelong 0 (no records) | |
| 1401 | >0x04 lelong >0 (%ld records) | |
| 1402 | 0 byte 0x83 DBase 3 data file with memo(s) | |
| 1403 | >0x04 lelong 0 (no records) | |
| 1404 | >0x04 lelong >0 (%ld records) | |
| 1405 | 0 leshort 0x0006 DBase 3 index file | |
| 1406 | 0 string PMCC Windows 3.x .GRP file | |
| 1407 | 1 string RDC-meg MegaDots | |
| 1408 | >8 byte >0x2F version %c | |
| 1409 | >9 byte >0x2F \b.%c file | |
| 1410 | 0 lelong 0x4C | |
| 1411 | >4 lelong 0x00021401 Windows shortcut file | |
| 1412 | ||
| 1413 | # DOS EPS Binary File Header | |
| 1414 | # From: Ed Sznyter <ews@Black.Market.NET> | |
| 1415 | 0 belong 0xC5D0D3C6 DOS EPS Binary File | |
| 1416 | >4 long >0 Postscript starts at byte %d | |
| 1417 | >>8 long >0 length %d | |
| 1418 | >>>12 long >0 Metafile starts at byte %d | |
| 1419 | >>>>16 long >0 length %d | |
| 1420 | >>>20 long >0 TIFF starts at byte %d | |
| 1421 | >>>>24 long >0 length %d | |
| 1422 | ||
| 1423 | # TNEF magic From "Joomy" <joomy@se-ed.net> | |
| 1424 | 0 leshort 0x223e9f78 TNEF | |
| 1425 | ||
| 1426 | # HtmlHelp files (.chm) | |
| 1427 | 0 string ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data | |
| 1428 | ||
| 1429 | # GFA-BASIC (Wolfram Kleff) | |
| 1430 | 2 string GFA-BASIC3 GFA-BASIC 3 data | |
| 1431 | ||
| 1432 | # DJGPP compiled files | |
| 1433 | # v >2, uses DPMI & small(2k) stub (Robert vd Boon, rjvdboon@europe.com) | |
| 1434 | 0x200 string go32stub DOS-executable compiled w/DJGPP | |
| 1435 | >0x20c string >0 (stub v%.4s) | |
| 1436 | >>0x8b2 string djp [compressed w/%s | |
| 1437 | >>>&1 string >\0 %.4s] | |
| 1438 | >>0x8ad string UPX [compressed w/%s | |
| 1439 | >>>&1 string >\0 %.4s] | |
| 1440 | >>0x1c string pmodedj stubbed with %s | |
| 1441 | ||
| 1442 | # QDOS | |
| 1443 | 4 belong 0x4AFB QDOS executable | |
| 1444 | >9 pstring x '%s' | |
| 1445 | 0 beshort 0xFB01 QDOS object | |
| 1446 | >2 pstring x '%s' | |
| 1447 | ||
| 1448 | #------------------------------------------------------------------------------ | |
| 1449 | # From Stuart Caie <kyzer@4u.net> (developer of cabextract) | |
| 1450 | # Microsoft Cabinet files | |
| 1451 | 0 string MSCF\0\0\0\0 Microsoft Cabinet file | |
| 1452 | >8 lelong x \b, %u bytes | |
| 1453 | >28 leshort 1 \b, 1 file | |
| 1454 | >28 leshort >1 \b, %u files | |
| 1455 | ||
| 1456 | # InstallShield Cabinet files | |
| 1457 | 0 string ISc( InstallShield Cabinet file | |
| 1458 | >5 byte&0xf0 =0x60 version 6, | |
| 1459 | >5 byte&0xf0 !0x60 version 4/5, | |
| 1460 | >(12.l+40) lelong x %u files | |
| 1461 | ||
| 1462 | # Windows CE package files | |
| 1463 | 0 string MSCE\0\0\0\0 Microsoft WinCE install header | |
| 1464 | >20 lelong 0 \b, architecture-independent | |
| 1465 | >20 lelong 103 \b, Hitachi SH3 | |
| 1466 | >20 lelong 104 \b, Hitachi SH4 | |
| 1467 | >20 lelong 0xA11 \b, StrongARM | |
| 1468 | >20 lelong 4000 \b, MIPS R4000 | |
| 1469 | >20 lelong 10003 \b, Hitachi SH3 | |
| 1470 | >20 lelong 10004 \b, Hitachi SH3E | |
| 1471 | >20 lelong 10005 \b, Hitachi SH4 | |
| 1472 | >20 lelong 70001 \b, ARM 7TDMI | |
| 1473 | >52 leshort 1 \b, 1 file | |
| 1474 | >52 leshort >1 \b, %u files | |
| 1475 | >56 leshort 1 \b, 1 registry entry | |
| 1476 | >56 leshort >1 \b, %u registry entries | |
| 1477 | ||
| 1478 | # Outlook Personal Folders | |
| 1479 | 0 lelong 0x4E444221 Microsoft Outlook binary email folder | |
| 1480 | ||
| 1481 | # From: Dirk Jagdmann <doj@cubic.org> | |
| 1482 | 0 lelong 0x00035f3f Windows 3.x help file | |
| 1483 | ||
| 1484 | # Christophe Monniez | |
| 1485 | 0 string Client\ UrlCache\ MMF Microsoft Internet Explorer Cache File | |
| 1486 | >20 string >\0 Version %s | |
| 1487 | 0 string \xCF\xAD\x12\xFE Microsoft Outlook Express DBX File | |
| 1488 | >4 byte =0xC5 Message database | |
| 1489 | >4 byte =0xC6 Folder database | |
| 1490 | >4 byte =0xC7 Accounts informations | |
| 1491 | >4 byte =0x30 Offline database | |
| 1492 | ||
| 1493 | ||
| 1494 | # Windows Enhanced Metafile (EMF) | |
| 1495 | # See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp | |
| 1496 | # for further information. Note that "0 lelong 1" should be true i.e. | |
| 1497 | # the first double word in the file should be 1. With the extended | |
| 1498 | # syntax available by some file commands you could write: | |
| 1499 | # 0 lelong 1 | |
| 1500 | # &40 ulelong 0x464D4520 Windows Enhanced Metafile (EMF) image data | |
| 1501 | 40 ulelong 0x464D4520 Windows Enhanced Metafile (EMF) image data | |
| 1502 | >44 ulelong x version 0x%x. | |
| 1503 | # If the description has a length greater than zero, it exists and is | |
| 1504 | # found at offset (*64). | |
| 1505 | >64 ulelong >0 Description available at offset 0x%x | |
| 1506 | >>60 ulelong >0 (length 0x%x) | |
| 1507 | # Note it would be better to print out the description, which is found | |
| 1508 | # as below. Unfortunately the following only prints out the first couple | |
| 1509 | # of characters instead of all the "description length" | |
| 1510 | # number of characters -- indicated by the ulelong at offset 60. | |
| 1511 | >>(64.l) lestring16 >0 Description: %15.15s | |
| 1512 | #WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE | |
| 1513 | 0 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable text | |
| 1514 | >15 byte 0 Optimized for Intel | |
| 1515 | >15 byte 1 Optimized for Non-Intel | |
| 1516 | 1 string WPC (Corel/WP) | |
| 1517 | >8 short 257 WordPerfect macro | |
| 1518 | >8 short 258 WordPerfect help file | |
| 1519 | >8 short 259 WordPerfect keyboard file | |
| 1520 | >8 short 266 WordPerfect document | |
| 1521 | >8 short 267 WordPerfect dictionary | |
| 1522 | >8 short 268 WordPerfect thesaurus | |
| 1523 | >8 short 269 WordPerfect block | |
| 1524 | >8 short 270 WordPerfect rectangular block | |
| 1525 | >8 short 271 WordPerfect column block | |
| 1526 | >8 short 272 WordPerfect printer data | |
| 1527 | >8 short 275 WordPerfect printer data | |
| 1528 | >8 short 276 WordPerfect driver resource data | |
| 1529 | >8 short 279 WordPerfect hyphenation code | |
| 1530 | >8 short 280 WordPerfect hyphenation data | |
| 1531 | >8 short 281 WordPerfect macro resource data | |
| 1532 | >8 short 283 WordPerfect hyphenation lex | |
| 1533 | >8 short 285 WordPerfect wordlist | |
| 1534 | >8 short 286 WordPerfect equation resource data | |
| 1535 | >8 short 289 WordPerfect spell rules | |
| 1536 | >8 short 290 WordPerfect dictionary rules | |
| 1537 | >8 short 295 WordPerfect spell rules (Microlytics) | |
| 1538 | >8 short 299 WordPerfect settings file | |
| 1539 | >8 short 301 WordPerfect 4.2 document | |
| 1540 | >8 short 325 WordPerfect dialog file | |
| 1541 | >8 short 332 WordPerfect button bar | |
| 1542 | >8 short 513 Shell macro | |
| 1543 | >8 short 522 Shell definition | |
| 1544 | >8 short 769 Notebook macro | |
| 1545 | >8 short 770 Notebook help file | |
| 1546 | >8 short 771 Notebook keyboard file | |
| 1547 | >8 short 778 Notebook definition | |
| 1548 | >8 short 1026 Calculator help file | |
| 1549 | >8 short 1538 Calendar help file | |
| 1550 | >8 short 1546 Calendar data file | |
| 1551 | >8 short 1793 Editor macro | |
| 1552 | >8 short 1794 Editor help file | |
| 1553 | >8 short 1795 Editor keyboard file | |
| 1554 | >8 short 1817 Editor macro resource file | |
| 1555 | >8 short 2049 Macro editor macro | |
| 1556 | >8 short 2050 Macro editor help file | |
| 1557 | >8 short 2051 Macro editor keyboard file | |
| 1558 | >8 short 2305 PlanPerfect macro | |
| 1559 | >8 short 2306 PlanPerfect help file | |
| 1560 | >8 short 2307 PlanPerfect keyboard file | |
| 1561 | >8 short 2314 PlanPerfect worksheet | |
| 1562 | >8 short 2319 PlanPerfect printer definition | |
| 1563 | >8 short 2322 PlanPerfect graphic definition | |
| 1564 | >8 short 2323 PlanPerfect data | |
| 1565 | >8 short 2324 PlanPerfect temporary printer | |
| 1566 | >8 short 2329 PlanPerfect macro resource data | |
| 1567 | >8 byte 11 Mail | |
| 1568 | >8 short 2818 help file | |
| 1569 | >8 short 2821 distribution list | |
| 1570 | >8 short 2826 out box | |
| 1571 | >8 short 2827 in box | |
| 1572 | >8 short 2836 users archived mailbox | |
| 1573 | >8 short 2837 archived message database | |
| 1574 | >8 short 2838 archived attachments | |
| 1575 | >8 short 3083 Printer temporary file | |
| 1576 | >8 short 3330 Scheduler help file | |
| 1577 | >8 short 3338 Scheduler in file | |
| 1578 | >8 short 3339 Scheduler out file | |
| 1579 | >8 short 3594 GroupWise settings file | |
| 1580 | >8 short 3601 GroupWise directory services | |
| 1581 | >8 short 3627 GroupWise settings file | |
| 1582 | >8 short 4362 Terminal resource data | |
| 1583 | >8 short 4363 Terminal resource data | |
| 1584 | >8 short 4395 Terminal resource data | |
| 1585 | >8 short 4619 GUI loadable text | |
| 1586 | >8 short 4620 graphics resource data | |
| 1587 | >8 short 4621 printer settings file | |
| 1588 | >8 short 4622 port definition file | |
| 1589 | >8 short 4623 print queue parameters | |
| 1590 | >8 short 4624 compressed file | |
| 1591 | >8 short 5130 Network service msg file | |
| 1592 | >8 short 5131 Network service msg file | |
| 1593 | >8 short 5132 Async gateway login msg | |
| 1594 | >8 short 5134 GroupWise message file | |
| 1595 | >8 short 7956 GroupWise admin domain database | |
| 1596 | >8 short 7957 GroupWise admin host database | |
| 1597 | >8 short 7959 GroupWise admin remote host database | |
| 1598 | >8 short 7960 GroupWise admin ADS deferment data file | |
| 1599 | >8 short 8458 IntelliTAG (SGML) compiled DTD | |
| 1600 | >8 long 18219264 WordPerfect graphic image (1.0) | |
| 1601 | >8 long 18219520 WordPerfect graphic image (2.0) | |
| 1602 | #end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE | |
| 1603 | ||
| 1604 | #------------------------------------------------------------------------------ | |
| 1605 | # rtf: file(1) magic for Rich Text Format (RTF) | |
| 1606 | # | |
| 1607 | # Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk | |
| 1608 | # | |
| 1609 | 0 string {\\rtf Rich Text Format data, | |
| 1610 | >5 byte x version %c, | |
| 1611 | >6 string \\ansi ANSI | |
| 1612 | >6 string \\mac Apple Macintosh | |
| 1613 | >6 string \\pc IBM PC, code page 437 | |
| 1614 | >6 string \\pca IBM PS/2, code page 850 | |
| 1615 | ||
| 1616 | #------------------------------------------------------------------------------ | |
| 1617 | # animation: file(1) magic for animation/movie formats | |
| 1618 | # | |
| 1619 | # animation formats | |
| 1620 | # MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) | |
| 1621 | # FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) | |
| 1622 | ||
| 1623 | # MPEG sequences | |
| 1624 | # Scans for all common MPEG header start codes | |
| 1625 | 0 belong&0xFFFFFF00 0x00000100 MPEG sequence | |
| 1626 | >3 byte 0xBA | |
| 1627 | >>4 byte &0x40 \b, v2, program multiplex | |
| 1628 | >>4 byte ^0x40 \b, v1, system multiplex | |
| 1629 | >3 byte 0xBB \b, v1/2, multiplex (missing pack header) | |
| 1630 | >3 byte 0xB0 \b, v4 | |
| 1631 | >>5 belong 0x000001B5 | |
| 1632 | >>>9 byte &0x80 | |
| 1633 | >>>>10 byte&0xF0 16 \b, video | |
| 1634 | >>>>10 byte&0xF0 32 \b, still texture | |
| 1635 | >>>>10 byte&0xF0 48 \b, mesh | |
| 1636 | >>>>10 byte&0xF0 64 \b, face | |
| 1637 | >>>9 byte ^0x80 | |
| 1638 | >>>>9 byte&0xF8 8 \b, video | |
| 1639 | >>>>9 byte&0xF8 16 \b, still texture | |
| 1640 | >>>>9 byte&0xF8 24 \b, mesh | |
| 1641 | >>>>9 byte&0xF8 32 \b, face | |
| 1642 | >>4 byte 1 \b, simple @ L1 | |
| 1643 | >>4 byte 2 \b, simple @ L2 | |
| 1644 | >>4 byte 3 \b, simple @ L3 | |
| 1645 | >>4 byte 4 \b, simple @ L0 | |
| 1646 | >>4 byte 17 \b, simple scalable @ L1 | |
| 1647 | >>4 byte 18 \b, simple scalable @ L2 | |
| 1648 | >>4 byte 33 \b, core @ L1 | |
| 1649 | >>4 byte 34 \b, core @ L2 | |
| 1650 | >>4 byte 50 \b, main @ L2 | |
| 1651 | >>4 byte 51 \b, main @ L3 | |
| 1652 | >>4 byte 53 \b, main @ L4 | |
| 1653 | >>4 byte 66 \b, n-bit @ L2 | |
| 1654 | >>4 byte 81 \b, scalable texture @ L1 | |
| 1655 | >>4 byte 97 \b, simple face animation @ L1 | |
| 1656 | >>4 byte 98 \b, simple face animation @ L2 | |
| 1657 | >>4 byte 99 \b, simple face basic animation @ L1 | |
| 1658 | >>4 byte 100 \b, simple face basic animation @ L2 | |
| 1659 | >>4 byte 113 \b, basic animation text @ L1 | |
| 1660 | >>4 byte 114 \b, basic animation text @ L2 | |
| 1661 | >>4 byte 129 \b, hybrid @ L1 | |
| 1662 | >>4 byte 130 \b, hybrid @ L2 | |
| 1663 | >>4 byte 145 \b, advanced RT simple @ L! | |
| 1664 | >>4 byte 146 \b, advanced RT simple @ L2 | |
| 1665 | >>4 byte 147 \b, advanced RT simple @ L3 | |
| 1666 | >>4 byte 148 \b, advanced RT simple @ L4 | |
| 1667 | >>4 byte 161 \b, core scalable @ L1 | |
| 1668 | >>4 byte 162 \b, core scalable @ L2 | |
| 1669 | >>4 byte 163 \b, core scalable @ L3 | |
| 1670 | >>4 byte 177 \b, advanced coding efficiency @ L1 | |
| 1671 | >>4 byte 178 \b, advanced coding efficiency @ L2 | |
| 1672 | >>4 byte 179 \b, advanced coding efficiency @ L3 | |
| 1673 | >>4 byte 180 \b, advanced coding efficiency @ L4 | |
| 1674 | >>4 byte 193 \b, advanced core @ L1 | |
| 1675 | >>4 byte 194 \b, advanced core @ L2 | |
| 1676 | >>4 byte 209 \b, advanced scalable texture @ L1 | |
| 1677 | >>4 byte 210 \b, advanced scalable texture @ L2 | |
| 1678 | >>4 byte 211 \b, advanced scalable texture @ L3 | |
| 1679 | >>4 byte 225 \b, simple studio @ L1 | |
| 1680 | >>4 byte 226 \b, simple studio @ L2 | |
| 1681 | >>4 byte 227 \b, simple studio @ L3 | |
| 1682 | >>4 byte 228 \b, simple studio @ L4 | |
| 1683 | >>4 byte 229 \b, core studio @ L1 | |
| 1684 | >>4 byte 230 \b, core studio @ L2 | |
| 1685 | >>4 byte 231 \b, core studio @ L3 | |
| 1686 | >>4 byte 232 \b, core studio @ L4 | |
| 1687 | >>4 byte 240 \b, advanced simple @ L0 | |
| 1688 | >>4 byte 241 \b, advanced simple @ L1 | |
| 1689 | >>4 byte 242 \b, advanced simple @ L2 | |
| 1690 | >>4 byte 243 \b, advanced simple @ L3 | |
| 1691 | >>4 byte 244 \b, advanced simple @ L4 | |
| 1692 | >>4 byte 245 \b, advanced simple @ L5 | |
| 1693 | >>4 byte 247 \b, advanced simple @ L3b | |
| 1694 | >>4 byte 248 \b, FGS @ L0 | |
| 1695 | >>4 byte 249 \b, FGS @ L1 | |
| 1696 | >>4 byte 250 \b, FGS @ L2 | |
| 1697 | >>4 byte 251 \b, FGS @ L3 | |
| 1698 | >>4 byte 252 \b, FGS @ L4 | |
| 1699 | >>4 byte 253 \b, FGS @ L5 | |
| 1700 | >3 byte 0xB5 \b, v4 | |
| 1701 | >>4 byte &0x80 | |
| 1702 | >>>5 byte&0xF0 16 \b, video (missing profile header) | |
| 1703 | >>>5 byte&0xF0 32 \b, still texture (missing profile header) | |
| 1704 | >>>5 byte&0xF0 48 \b, mesh (missing profile header) | |
| 1705 | >>>5 byte&0xF0 64 \b, face (missing profile header) | |
| 1706 | >>4 byte ^0x80 | |
| 1707 | >>>4 byte&0xF8 8 \b, video (missing profile header) | |
| 1708 | >>>4 byte&0xF8 16 \b, still texture (missing profile header) | |
| 1709 | >>>4 byte&0xF8 24 \b, mesh (missing profile header) | |
| 1710 | >>>4 byte&0xF8 32 \b, face (missing profile header) | |
| 1711 | >3 byte 0xB3 | |
| 1712 | >>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video | |
| 1713 | >>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video | |
| 1714 | >>12 belong 0x000001B5 \b, v2, | |
| 1715 | >>>16 byte&0x0F 1 \b HP | |
| 1716 | >>>16 byte&0x0F 2 \b Spt | |
| 1717 | >>>16 byte&0x0F 3 \b SNR | |
| 1718 | >>>16 byte&0x0F 4 \b MP | |
| 1719 | >>>16 byte&0x0F 5 \b SP | |
| 1720 | >>>17 byte&0xF0 64 \b@HL | |
| 1721 | >>>17 byte&0xF0 96 \b@H-14 | |
| 1722 | >>>17 byte&0xF0 128 \b@ML | |
| 1723 | >>>17 byte&0xF0 160 \b@LL | |
| 1724 | >>>17 byte &0x08 \b progressive | |
| 1725 | >>>17 byte ^0x08 \b interlaced | |
| 1726 | >>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video | |
| 1727 | >>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video | |
| 1728 | >>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video | |
| 1729 | >>11 byte &0x02 | |
| 1730 | >>>75 byte &0x01 | |
| 1731 | >>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video | |
| 1732 | >>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video | |
| 1733 | >>>>140 belong 0x000001B5 \b, v2, | |
| 1734 | >>>>>144 byte&0x0F 1 \b HP | |
| 1735 | >>>>>144 byte&0x0F 2 \b Spt | |
| 1736 | >>>>>144 byte&0x0F 3 \b SNR | |
| 1737 | >>>>>144 byte&0x0F 4 \b MP | |
| 1738 | >>>>>144 byte&0x0F 5 \b SP | |
| 1739 | >>>>>145 byte&0xF0 64 \b@HL | |
| 1740 | >>>>>145 byte&0xF0 96 \b@H-14 | |
| 1741 | >>>>>145 byte&0xF0 128 \b@ML | |
| 1742 | >>>>>145 byte&0xF0 160 \b@LL | |
| 1743 | >>>>>145 byte &0x08 \b progressive | |
| 1744 | >>>>>145 byte ^0x08 \b interlaced | |
| 1745 | >>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video | |
| 1746 | >>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video | |
| 1747 | >>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video | |
| 1748 | >>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video | |
| 1749 | >>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video | |
| 1750 | >>>76 belong 0x000001B5 \b, v2, | |
| 1751 | >>>80 byte&0x0F 1 \b HP | |
| 1752 | >>>80 byte&0x0F 2 \b Spt | |
| 1753 | >>>80 byte&0x0F 3 \b SNR | |
| 1754 | >>>80 byte&0x0F 4 \b MP | |
| 1755 | >>>80 byte&0x0F 5 \b SP | |
| 1756 | >>>81 byte&0xF0 64 \b@HL | |
| 1757 | >>>81 byte&0xF0 96 \b@H-14 | |
| 1758 | >>>81 byte&0xF0 128 \b@ML | |
| 1759 | >>>81 byte&0xF0 160 \b@LL | |
| 1760 | >>>81 byte &0x08 \b progressive | |
| 1761 | >>>81 byte ^0x08 \b interlaced | |
| 1762 | >>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video | |
| 1763 | >>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video | |
| 1764 | >>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video | |
| 1765 | >>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P | |
| 1766 | >>>7 byte&0xF0 0x10 \b, 16:9 | |
| 1767 | >>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I | |
| 1768 | >>>7 byte&0xF0 0x10 \b, 16:9 | |
| 1769 | >>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture | |
| 1770 | >>>7 byte&0xF0 0x10 \b, 4:3 | |
| 1771 | >>4 beshort&0xFFF0 0x2C00 \b, 4CIF | |
| 1772 | >>>5 beshort&0x0FFF 0x01E0 \b NTSC | |
| 1773 | >>>5 beshort&0x0FFF 0x0240 \b PAL | |
| 1774 | >>>7 byte&0xF0 0x20 \b, 4:3 | |
| 1775 | >>>7 byte&0xF0 0x30 \b, 16:9 | |
| 1776 | >>>7 byte&0xF0 0x40 \b, 11:5 | |
| 1777 | >>>7 byte&0xF0 0x80 \b, PAL 4:3 | |
| 1778 | >>>7 byte&0xF0 0xC0 \b, NTSC 4:3 | |
| 1779 | >>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P | |
| 1780 | >>>7 byte&0xF0 0x10 \b, 4:3 | |
| 1781 | >>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240 | |
| 1782 | >>>7 byte&0xF0 0x10 \b, 4:3 | |
| 1783 | >>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160 | |
| 1784 | >>>7 byte&0xF0 0x10 \b, 4:3 | |
| 1785 | >>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120 | |
| 1786 | >>>7 byte&0xF0 0x10 \b, 4:3 | |
| 1787 | >>4 beshort&0xFFF0 0x1600 \b, CIF | |
| 1788 | >>>5 beshort&0x0FFF 0x00F0 \b NTSC | |
| 1789 | >>>5 beshort&0x0FFF 0x0120 \b PAL | |
| 1790 | >>>7 byte&0xF0 0x20 \b, 4:3 | |
| 1791 | >>>7 byte&0xF0 0x30 \b, 16:9 | |
| 1792 | >>>7 byte&0xF0 0x40 \b, 11:5 | |
| 1793 | >>>7 byte&0xF0 0x80 \b, PAL 4:3 | |
| 1794 | >>>7 byte&0xF0 0xC0 \b, NTSC 4:3 | |
| 1795 | >>>5 beshort&0x0FFF 0x0240 \b PAL 625 | |
| 1796 | >>>>7 byte&0xF0 0x20 \b, 4:3 | |
| 1797 | >>>>7 byte&0xF0 0x30 \b, 16:9 | |
| 1798 | >>>>7 byte&0xF0 0x40 \b, 11:5 | |
| 1799 | >>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU | |
| 1800 | >>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 | |
| 1801 | >>>5 beshort&0x0FFF 0x0240 \b PAL 625 | |
| 1802 | >>>7 byte&0xF0 0x20 \b, 4:3 | |
| 1803 | >>>7 byte&0xF0 0x30 \b, 16:9 | |
| 1804 | >>>7 byte&0xF0 0x40 \b, 11:5 | |
| 1805 | >>4 beshort&0xFFF0 0x1E00 \b, SVCD | |
| 1806 | >>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 | |
| 1807 | >>>5 beshort&0x0FFF 0x0240 \b PAL 625 | |
| 1808 | >>>7 byte&0xF0 0x20 \b, 4:3 | |
| 1809 | >>>7 byte&0xF0 0x30 \b, 16:9 | |
| 1810 | >>>7 byte&0xF0 0x40 \b, 11:5 | |
| 1811 | >>7 byte&0x0F 1 \b, 23.976 fps | |
| 1812 | >>7 byte&0x0F 2 \b, 24 fps | |
| 1813 | >>7 byte&0x0F 3 \b, 25 fps | |
| 1814 | >>7 byte&0x0F 4 \b, 29.97 fps | |
| 1815 | >>7 byte&0x0F 5 \b, 30 fps | |
| 1816 | >>7 byte&0x0F 6 \b, 50 fps | |
| 1817 | >>7 byte&0x0F 7 \b, 59.94 fps | |
| 1818 | >>7 byte&0x0F 8 \b, 60 fps | |
| 1819 | >>11 byte &0x04 \b, Constrained | |
| 1820 | ||
| 1821 | # MPEG ADTS Audio (*.mpx/mxa/aac) | |
| 1822 | # from dreesen@math.fu-berlin.de | |
| 1823 | # modified to fully support MPEG ADTS | |
| 1824 | ||
| 1825 | # MP3, M1A | |
| 1826 | 0 beshort&0xFFFE 0xFFFA MPEG ADTS, layer III, v1 | |
| 1827 | # rates | |
| 1828 | >2 byte&0xF0 0x10 \b, 32 kBits | |
| 1829 | >2 byte&0xF0 0x20 \b, 40 kBits | |
| 1830 | >2 byte&0xF0 0x30 \b, 48 kBits | |
| 1831 | >2 byte&0xF0 0x40 \b, 56 kBits | |
| 1832 | >2 byte&0xF0 0x50 \b, 64 kBits | |
| 1833 | >2 byte&0xF0 0x60 \b, 80 kBits | |
| 1834 | >2 byte&0xF0 0x70 \b, 96 kBits | |
| 1835 | >2 byte&0xF0 0x80 \b, 112 kBits | |
| 1836 | >2 byte&0xF0 0x90 \b, 128 kBits | |
| 1837 | >2 byte&0xF0 0xA0 \b, 160 kBits | |
| 1838 | >2 byte&0xF0 0xB0 \b, 192 kBits | |
| 1839 | >2 byte&0xF0 0xC0 \b, 224 kBits | |
| 1840 | >2 byte&0xF0 0xD0 \b, 256 kBits | |
| 1841 | >2 byte&0xF0 0xE0 \b, 320 kBits | |
| 1842 | # timing | |
| 1843 | >2 byte&0x0C 0x00 \b, 44.1 kHz | |
| 1844 | >2 byte&0x0C 0x04 \b, 48 kHz | |
| 1845 | >2 byte&0x0C 0x08 \b, 32 kHz | |
| 1846 | # channels/options | |
| 1847 | >3 byte&0xC0 0x00 \b, Stereo | |
| 1848 | >3 byte&0xC0 0x40 \b, JntStereo | |
| 1849 | >3 byte&0xC0 0x80 \b, 2x Monaural | |
| 1850 | >3 byte&0xC0 0xC0 \b, Monaural | |
| 1851 | #>1 byte ^0x01 \b, Data Verify | |
| 1852 | #>2 byte &0x02 \b, Packet Pad | |
| 1853 | #>2 byte &0x01 \b, Custom Flag | |
| 1854 | #>3 byte &0x08 \b, Copyrighted | |
| 1855 | #>3 byte &0x04 \b, Original Source | |
| 1856 | #>3 byte&0x03 1 \b, NR: 50/15 ms | |
| 1857 | #>3 byte&0x03 3 \b, NR: CCIT J.17 | |
| 1858 | ||
| 1859 | # MP2, M1A | |
| 1860 | 0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 | |
| 1861 | # rates | |
| 1862 | >2 byte&0xF0 0x10 \b, 32 kBits | |
| 1863 | >2 byte&0xF0 0x20 \b, 48 kBits | |
| 1864 | >2 byte&0xF0 0x30 \b, 56 kBits | |
| 1865 | >2 byte&0xF0 0x40 \b, 64 kBits | |
| 1866 | >2 byte&0xF0 0x50 \b, 80 kBits | |
| 1867 | >2 byte&0xF0 0x60 \b, 96 kBits | |
| 1868 | >2 byte&0xF0 0x70 \b, 112 kBits | |
| 1869 | >2 byte&0xF0 0x80 \b, 128 kBits | |
| 1870 | >2 byte&0xF0 0x90 \b, 160 kBits | |
| 1871 | >2 byte&0xF0 0xA0 \b, 192 kBits | |
| 1872 | >2 byte&0xF0 0xB0 \b, 224 kBits | |
| 1873 | >2 byte&0xF0 0xC0 \b, 256 kBits | |
| 1874 | >2 byte&0xF0 0xD0 \b, 320 kBits | |
| 1875 | >2 byte&0xF0 0xE0 \b, 384 kBits | |
| 1876 | # timing | |
| 1877 | >2 byte&0x0C 0x00 \b, 44.1 kHz | |
| 1878 | >2 byte&0x0C 0x04 \b, 48 kHz | |
| 1879 | >2 byte&0x0C 0x08 \b, 32 kHz | |
| 1880 | # channels/options | |
| 1881 | >3 byte&0xC0 0x00 \b, Stereo | |
| 1882 | >3 byte&0xC0 0x40 \b, JntStereo | |
| 1883 | >3 byte&0xC0 0x80 \b, 2x Monaural | |
| 1884 | >3 byte&0xC0 0xC0 \b, Monaural | |
| 1885 | #>1 byte ^0x01 \b, Data Verify | |
| 1886 | #>2 byte &0x02 \b, Packet Pad | |
| 1887 | #>2 byte &0x01 \b, Custom Flag | |
| 1888 | #>3 byte &0x08 \b, Copyrighted | |
| 1889 | #>3 byte &0x04 \b, Original Source | |
| 1890 | #>3 byte&0x03 1 \b, NR: 50/15 ms | |
| 1891 | #>3 byte&0x03 3 \b, NR: CCIT J.17 | |
| 1892 | ||
| 1893 | # MPA, M1A | |
| 1894 | 0 beshort&0xFFFE 0xFFFE MPEG ADTS, layer I, v1 | |
| 1895 | # rate | |
| 1896 | >2 byte&0xF0 0x10 \b, 32 kBits | |
| 1897 | >2 byte&0xF0 0x20 \b, 64 kBits | |
| 1898 | >2 byte&0xF0 0x30 \b, 96 kBits | |
| 1899 | >2 byte&0xF0 0x40 \b, 128 kBits | |
| 1900 | >2 byte&0xF0 0x50 \b, 160 kBits | |
| 1901 | >2 byte&0xF0 0x60 \b, 192 kBits | |
| 1902 | >2 byte&0xF0 0x70 \b, 224 kBits | |
| 1903 | >2 byte&0xF0 0x80 \b, 256 kBits | |
| 1904 | >2 byte&0xF0 0x90 \b, 288 kBits | |
| 1905 | >2 byte&0xF0 0xA0 \b, 320 kBits | |
| 1906 | >2 byte&0xF0 0xB0 \b, 352 kBits | |
| 1907 | >2 byte&0xF0 0xC0 \b, 384 kBits | |
| 1908 | >2 byte&0xF0 0xD0 \b, 416 kBits | |
| 1909 | >2 byte&0xF0 0xE0 \b, 448 kBits | |
| 1910 | # timing | |
| 1911 | >2 byte&0x0C 0x00 \b, 44.1 kHz | |
| 1912 | >2 byte&0x0C 0x04 \b, 48 kHz | |
| 1913 | >2 byte&0x0C 0x08 \b, 32 kHz | |
| 1914 | # channels/options | |
| 1915 | >3 byte&0xC0 0x00 \b, Stereo | |
| 1916 | >3 byte&0xC0 0x40 \b, JntStereo | |
| 1917 | >3 byte&0xC0 0x80 \b, 2x Monaural | |
| 1918 | >3 byte&0xC0 0xC0 \b, Monaural | |
| 1919 | #>1 byte ^0x01 \b, Data Verify | |
| 1920 | #>2 byte &0x02 \b, Packet Pad | |
| 1921 | #>2 byte &0x01 \b, Custom Flag | |
| 1922 | #>3 byte &0x08 \b, Copyrighted | |
| 1923 | #>3 byte &0x04 \b, Original Source | |
| 1924 | #>3 byte&0x03 1 \b, NR: 50/15 ms | |
| 1925 | #>3 byte&0x03 3 \b, NR: CCIT J.17 | |
| 1926 | ||
| 1927 | # MP3, M2A | |
| 1928 | 0 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2 | |
| 1929 | # rate | |
| 1930 | >2 byte&0xF0 0x10 \b, 8 kBits | |
| 1931 | >2 byte&0xF0 0x20 \b, 16 kBits | |
| 1932 | >2 byte&0xF0 0x30 \b, 24 kBits | |
| 1933 | >2 byte&0xF0 0x40 \b, 32 kBits | |
| 1934 | >2 byte&0xF0 0x50 \b, 40 kBits | |
| 1935 | >2 byte&0xF0 0x60 \b, 48 kBits | |
| 1936 | >2 byte&0xF0 0x70 \b, 56 kBits | |
| 1937 | >2 byte&0xF0 0x80 \b, 64 kBits | |
| 1938 | >2 byte&0xF0 0x90 \b, 80 kBits | |
| 1939 | >2 byte&0xF0 0xA0 \b, 96 kBits | |
| 1940 | >2 byte&0xF0 0xB0 \b, 112 kBits | |
| 1941 | >2 byte&0xF0 0xC0 \b, 128 kBits | |
| 1942 | >2 byte&0xF0 0xD0 \b, 144 kBits | |
| 1943 | >2 byte&0xF0 0xE0 \b, 160 kBits | |
| 1944 | # timing | |
| 1945 | >2 byte&0x0C 0x00 \b, 22.05 kHz | |
| 1946 | >2 byte&0x0C 0x04 \b, 24 kHz | |
| 1947 | >2 byte&0x0C 0x08 \b, 16 kHz | |
| 1948 | # channels/options | |
| 1949 | >3 byte&0xC0 0x00 \b, Stereo | |
| 1950 | >3 byte&0xC0 0x40 \b, JntStereo | |
| 1951 | >3 byte&0xC0 0x80 \b, 2x Monaural | |
| 1952 | >3 byte&0xC0 0xC0 \b, Monaural | |
| 1953 | #>1 byte ^0x01 \b, Data Verify | |
| 1954 | #>2 byte &0x02 \b, Packet Pad | |
| 1955 | #>2 byte &0x01 \b, Custom Flag | |
| 1956 | #>3 byte &0x08 \b, Copyrighted | |
| 1957 | #>3 byte &0x04 \b, Original Source | |
| 1958 | #>3 byte&0x03 1 \b, NR: 50/15 ms | |
| 1959 | #>3 byte&0x03 3 \b, NR: CCIT J.17 | |
| 1960 | ||
| 1961 | # MP2, M2A | |
| 1962 | 0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2 | |
| 1963 | # rate | |
| 1964 | >2 byte&0xF0 0x10 \b, 8 kBits | |
| 1965 | >2 byte&0xF0 0x20 \b, 16 kBits | |
| 1966 | >2 byte&0xF0 0x30 \b, 24 kBits | |
| 1967 | >2 byte&0xF0 0x40 \b, 32 kBits | |
| 1968 | >2 byte&0xF0 0x50 \b, 40 kBits | |
| 1969 | >2 byte&0xF0 0x60 \b, 48 kBits | |
| 1970 | >2 byte&0xF0 0x70 \b, 56 kBits | |
| 1971 | >2 byte&0xF0 0x80 \b, 64 kBits | |
| 1972 | >2 byte&0xF0 0x90 \b, 80 kBits | |
| 1973 | >2 byte&0xF0 0xA0 \b, 96 kBits | |
| 1974 | >2 byte&0xF0 0xB0 \b, 112 kBits | |
| 1975 | >2 byte&0xF0 0xC0 \b, 128 kBits | |
| 1976 | >2 byte&0xF0 0xD0 \b, 144 kBits | |
| 1977 | >2 byte&0xF0 0xE0 \b, 160 kBits | |
| 1978 | # timing | |
| 1979 | >2 byte&0x0C 0x00 \b, 22.05 kHz | |
| 1980 | >2 byte&0x0C 0x04 \b, 24 kHz | |
| 1981 | >2 byte&0x0C 0x08 \b, 16 kHz | |
| 1982 | # channels/options | |
| 1983 | >3 byte&0xC0 0x00 \b, Stereo | |
| 1984 | >3 byte&0xC0 0x40 \b, JntStereo | |
| 1985 | >3 byte&0xC0 0x80 \b, 2x Monaural | |
| 1986 | >3 byte&0xC0 0xC0 \b, Monaural | |
| 1987 | #>1 byte ^0x01 \b, Data Verify | |
| 1988 | #>2 byte &0x02 \b, Packet Pad | |
| 1989 | #>2 byte &0x01 \b, Custom Flag | |
| 1990 | #>3 byte &0x08 \b, Copyrighted | |
| 1991 | #>3 byte &0x04 \b, Original Source | |
| 1992 | #>3 byte&0x03 1 \b, NR: 50/15 ms | |
| 1993 | #>3 byte&0x03 3 \b, NR: CCIT J.17 | |
| 1994 | ||
| 1995 | # MPA, M2A | |
| 1996 | 0 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2 | |
| 1997 | # rate | |
| 1998 | >2 byte&0xF0 0x10 \b, 32 kBits | |
| 1999 | >2 byte&0xF0 0x20 \b, 48 kBits | |
| 2000 | >2 byte&0xF0 0x30 \b, 56 kBits | |
| 2001 | >2 byte&0xF0 0x40 \b, 64 kBits | |
| 2002 | >2 byte&0xF0 0x50 \b, 80 kBits | |
| 2003 | >2 byte&0xF0 0x60 \b, 96 kBits | |
| 2004 | >2 byte&0xF0 0x70 \b, 112 kBits | |
| 2005 | >2 byte&0xF0 0x80 \b, 128 kBits | |
| 2006 | >2 byte&0xF0 0x90 \b, 144 kBits | |
| 2007 | >2 byte&0xF0 0xA0 \b, 160 kBits | |
| 2008 | >2 byte&0xF0 0xB0 \b, 176 kBits | |
| 2009 | >2 byte&0xF0 0xC0 \b, 192 kBits | |
| 2010 | >2 byte&0xF0 0xD0 \b, 224 kBits | |
| 2011 | >2 byte&0xF0 0xE0 \b, 256 kBits | |
| 2012 | # timing | |
| 2013 | >2 byte&0x0C 0x00 \b, 22.05 kHz | |
| 2014 | >2 byte&0x0C 0x04 \b, 24 kHz | |
| 2015 | >2 byte&0x0C 0x08 \b, 16 kHz | |
| 2016 | # channels/options | |
| 2017 | >3 byte&0xC0 0x00 \b, Stereo | |
| 2018 | >3 byte&0xC0 0x40 \b, JntStereo | |
| 2019 | >3 byte&0xC0 0x80 \b, 2x Monaural | |
| 2020 | >3 byte&0xC0 0xC0 \b, Monaural | |
| 2021 | #>1 byte ^0x01 \b, Data Verify | |
| 2022 | #>2 byte &0x02 \b, Packet Pad | |
| 2023 | #>2 byte &0x01 \b, Custom Flag | |
| 2024 | #>3 byte &0x08 \b, Copyrighted | |
| 2025 | #>3 byte &0x04 \b, Original Source | |
| 2026 | #>3 byte&0x03 1 \b, NR: 50/15 ms | |
| 2027 | #>3 byte&0x03 3 \b, NR: CCIT J.17 | |
| 2028 | ||
| 2029 | # MP3, M25A | |
| 2030 | 0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5 | |
| 2031 | # rate | |
| 2032 | >2 byte&0xF0 0x10 \b, 8 kBits | |
| 2033 | >2 byte&0xF0 0x20 \b, 16 kBits | |
| 2034 | >2 byte&0xF0 0x30 \b, 24 kBits | |
| 2035 | >2 byte&0xF0 0x40 \b, 32 kBits | |
| 2036 | >2 byte&0xF0 0x50 \b, 40 kBits | |
| 2037 | >2 byte&0xF0 0x60 \b, 48 kBits | |
| 2038 | >2 byte&0xF0 0x70 \b, 56 kBits | |
| 2039 | >2 byte&0xF0 0x80 \b, 64 kBits | |
| 2040 | >2 byte&0xF0 0x90 \b, 80 kBits | |
| 2041 | >2 byte&0xF0 0xA0 \b, 96 kBits | |
| 2042 | >2 byte&0xF0 0xB0 \b, 112 kBits | |
| 2043 | >2 byte&0xF0 0xC0 \b, 128 kBits | |
| 2044 | >2 byte&0xF0 0xD0 \b, 144 kBits | |
| 2045 | >2 byte&0xF0 0xE0 \b, 160 kBits | |
| 2046 | # timing | |
| 2047 | >2 byte&0x0C 0x00 \b, 11.025 kHz | |
| 2048 | >2 byte&0x0C 0x04 \b, 12 kHz | |
| 2049 | >2 byte&0x0C 0x08 \b, 8 kHz | |
| 2050 | # channels/options | |
| 2051 | >3 byte&0xC0 0x00 \b, Stereo | |
| 2052 | >3 byte&0xC0 0x40 \b, JntStereo | |
| 2053 | >3 byte&0xC0 0x80 \b, 2x Monaural | |
| 2054 | >3 byte&0xC0 0xC0 \b, Monaural | |
| 2055 | #>1 byte ^0x01 \b, Data Verify | |
| 2056 | #>2 byte &0x02 \b, Packet Pad | |
| 2057 | #>2 byte &0x01 \b, Custom Flag | |
| 2058 | #>3 byte &0x08 \b, Copyrighted | |
| 2059 | #>3 byte &0x04 \b, Original Source | |
| 2060 | #>3 byte&0x03 1 \b, NR: 50/15 ms | |
| 2061 | #>3 byte&0x03 3 \b, NR: CCIT J.17 | |
| 2062 | ||
| 2063 | # AAC (aka MPEG-2 NBC audio) and MPEG-4 audio | |
| 2064 | ||
| 2065 | # Stored AAC streams (instead of the MP4 format) | |
| 2066 | 0 string ADIF MPEG ADIF, AAC | |
| 2067 | >4 byte &0x80 | |
| 2068 | >>13 byte &0x10 \b, VBR | |
| 2069 | >>13 byte ^0x10 \b, CBR | |
| 2070 | >>16 byte&0x1E 0x02 \b, single stream | |
| 2071 | >>16 byte&0x1E 0x04 \b, 2 streams | |
| 2072 | >>16 byte&0x1E 0x06 \b, 3 streams | |
| 2073 | >>16 byte &0x08 \b, 4 or more streams | |
| 2074 | >>16 byte &0x10 \b, 8 or more streams | |
| 2075 | >>4 byte &0x80 \b, Copyrighted | |
| 2076 | >>13 byte &0x40 \b, Original Source | |
| 2077 | >>13 byte &0x20 \b, Home Flag | |
| 2078 | >4 byte ^0x80 | |
| 2079 | >>4 byte &0x10 \b, VBR | |
| 2080 | >>4 byte ^0x10 \b, CBR | |
| 2081 | >>7 byte&0x1E 0x02 \b, single stream | |
| 2082 | >>7 byte&0x1E 0x04 \b, 2 streams | |
| 2083 | >>7 byte&0x1E 0x06 \b, 3 streams | |
| 2084 | >>7 byte &0x08 \b, 4 or more streams | |
| 2085 | >>7 byte &0x10 \b, 8 or more streams | |
| 2086 | >>4 byte &0x40 \b, Original Stream(s) | |
| 2087 | >>4 byte &0x20 \b, Home Source | |
| 2088 | ||
| 2089 | # Live or stored single AAC stream (used with MPEG-2 systems) | |
| 2090 | 0 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC | |
| 2091 | >1 byte ^0x08 \b, v2 | |
| 2092 | >1 byte &0x08 \b, v4 | |
| 2093 | # profile | |
| 2094 | >>2 byte &0xC0 \b LTP | |
| 2095 | >2 byte&0xc0 0x00 \b, Main | |
| 2096 | >2 byte&0xc0 0x40 \b, LC | |
| 2097 | >2 byte&0xc0 0x80 \b, SSR | |
| 2098 | # timing | |
| 2099 | >2 byte&0x3c 0x00 \b, 96 kHz | |
| 2100 | >2 byte&0x3c 0x04 \b, 88.2 kHz | |
| 2101 | >2 byte&0x3c 0x08 \b, 64 kHz | |
| 2102 | >2 byte&0x3c 0x0c \b, 48 kHz | |
| 2103 | >2 byte&0x3c 0x10 \b, 44.1 kHz | |
| 2104 | >2 byte&0x3c 0x14 \b, 32 kHz | |
| 2105 | >2 byte&0x3c 0x18 \b, 24 kHz | |
| 2106 | >2 byte&0x3c 0x1c \b, 22.05 kHz | |
| 2107 | >2 byte&0x3c 0x20 \b, 16 kHz | |
| 2108 | >2 byte&0x3c 0x24 \b, 12 kHz | |
| 2109 | >2 byte&0x3c 0x28 \b, 11.025 kHz | |
| 2110 | >2 byte&0x3c 0x2c \b, 8 kHz | |
| 2111 | # channels/options | |
| 2112 | >2 beshort&0x01c0 0x0040 \b, monaural | |
| 2113 | >2 beshort&0x01c0 0x0080 \b, stereo | |
| 2114 | >2 beshort&0x01c0 0x00c0 \b, stereo + center | |
| 2115 | >2 beshort&0x01c0 0x0100 \b, stereo+center+LFE | |
| 2116 | >2 beshort&0x01c0 0x0140 \b, surround | |
| 2117 | >2 beshort&0x01c0 0x0180 \b, surround + LFE | |
| 2118 | >2 beshort &0x01C0 \b, surround + side | |
| 2119 | #>1 byte ^0x01 \b, Data Verify | |
| 2120 | #>2 byte &0x02 \b, Custom Flag | |
| 2121 | #>3 byte &0x20 \b, Original Stream | |
| 2122 | #>3 byte &0x10 \b, Home Source | |
| 2123 | #>3 byte &0x08 \b, Copyrighted | |
| 2124 | ||
| 2125 | # Live MPEG-4 audio streams (instead of RTP FlexMux) | |
| 2126 | 0 beshort&0xFFE0 0x56E0 MPEG-4 LOAS | |
| 2127 | #>1 beshort&0x1FFF x \b, %u byte packet | |
| 2128 | >3 byte&0xE0 0x40 | |
| 2129 | >>4 byte&0x3C 0x04 \b, single stream | |
| 2130 | >>4 byte&0x3C 0x08 \b, 2 streams | |
| 2131 | >>4 byte&0x3C 0x0C \b, 3 streams | |
| 2132 | >>4 byte &0x08 \b, 4 or more streams | |
| 2133 | >>4 byte &0x20 \b, 8 or more streams | |
| 2134 | >3 byte&0xC0 0 | |
| 2135 | >>4 byte&0x78 0x08 \b, single stream | |
| 2136 | >>4 byte&0x78 0x10 \b, 2 streams | |
| 2137 | >>4 byte&0x78 0x18 \b, 3 streams | |
| 2138 | >>4 byte &0x20 \b, 4 or more streams | |
| 2139 | >>4 byte &0x40 \b, 8 or more streams | |
| 2140 | 0 beshort 0x4DE1 MPEG-4 LO-EP audio stream | |
| 2141 | ||
| 2142 | # FLI animation format | |
| 2143 | 4 leshort 0xAF11 FLI file | |
| 2144 | >6 leshort x - %d frames, | |
| 2145 | >8 leshort x width=%d pixels, | |
| 2146 | >10 leshort x height=%d pixels, | |
| 2147 | >12 leshort x depth=%d, | |
| 2148 | >16 leshort x ticks/frame=%d | |
| 2149 | # FLC animation format | |
| 2150 | 4 leshort 0xAF12 FLC file | |
| 2151 | >6 leshort x - %d frames | |
| 2152 | >8 leshort x width=%d pixels, | |
| 2153 | >10 leshort x height=%d pixels, | |
| 2154 | >12 leshort x depth=%d, | |
| 2155 | >16 leshort x ticks/frame=%d | |
| 2156 | ||
| 2157 | # DL animation format | |
| 2158 | # XXX - collision with most `mips' magic | |
| 2159 | # | |
| 2160 | # I couldn't find a real magic number for these, however, this | |
| 2161 | # -appears- to work. Note that it might catch other files, too, so be | |
| 2162 | # careful! | |
| 2163 | # | |
| 2164 | # Note that title and author appear in the two 20-byte chunks | |
| 2165 | # at decimal offsets 2 and 22, respectively, but they are XOR'ed with | |
| 2166 | # 255 (hex FF)! The DL format is really bad. | |
| 2167 | # | |
| 2168 | #0 byte 1 DL version 1, medium format (160x100, 4 images/screen) | |
| 2169 | #>42 byte x - %d screens, | |
| 2170 | #>43 byte x %d commands | |
| 2171 | #0 byte 2 DL version 2 | |
| 2172 | #>1 byte 1 - large format (320x200,1 image/screen), | |
| 2173 | #>1 byte 2 - medium format (160x100,4 images/screen), | |
| 2174 | #>1 byte >2 - unknown format, | |
| 2175 | #>42 byte x %d screens, | |
| 2176 | #>43 byte x %d commands | |
| 2177 | # Based on empirical evidence, DL version 3 have several nulls following the | |
| 2178 | # \003. Most of them start with non-null values at hex offset 0x34 or so. | |
| 2179 | #0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3 | |
| 2180 | ||
| 2181 | # SGI formats | |
| 2182 | 0 string MOVI Silicon Graphics movie file | |
| 2183 | ||
| 2184 | # Apple Quicktime and ISO types | |
| 2185 | 4 string moov Apple QuickTime | |
| 2186 | >12 string mvhd \b movie (fast start) | |
| 2187 | >12 string mdra \b URL | |
| 2188 | >12 string cmov \b movie (fast start, compressed header) | |
| 2189 | >12 string rmra \b multiple URLs | |
| 2190 | 4 string mdat Apple QuickTime movie (unoptimized) | |
| 2191 | 4 string wide Apple QuickTime movie (unoptimized) | |
| 2192 | 4 string skip Apple QuickTime movie (modified) | |
| 2193 | 4 string free Apple QuickTime movie (modified) | |
| 2194 | 4 string idsc Apple QuickTime image (fast start) | |
| 2195 | 4 string idat Apple QuickTime image (unoptimized) | |
| 2196 | 4 string pckg Apple QuickTime compressed archive | |
| 2197 | 4 string/B jP JPEG 2000 image | |
| 2198 | 4 string ftyp ISO Media | |
| 2199 | >8 string isom \b, MPEG v4 system | |
| 2200 | >8 string mp41 \b, MPEG v4 system, version 1 | |
| 2201 | >8 string mp42 \b, MPEG v4 system, version 2 | |
| 2202 | >8 string/B jp2 \b, JPEG 2000 image | |
| 2203 | >8 string 3gp \b, MPEG v4 system, 3GPP (H.263/AMR) | |
| 2204 | >8 string mmp4 \b, MPEG v4 system, Mobile | |
| 2205 | >8 string/B M4A \b, MPEG v4 system, iTunes AAC-LC | |
| 2206 | >8 string/B M4P \b, MPEG v4 system, ISMA encrypted AAC-LC | |
| 2207 | >8 string/B M4B \b, MPEG v4 system, iTunes AAC-LC/AMR | |
| 2208 | >8 string/B qt \b, Apple QuickTime movie | |
| 2209 | ||
| 2210 | # iso 13818 transport stream | |
| 2211 | # | |
| 2212 | # from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1) | |
| 2213 | # (the following is a little bit restrictive and works fine for a stream | |
| 2214 | # that starts with PAT properly. it won't work for stream data, that is | |
| 2215 | # cut from an input device data right in the middle, but this shouldn't | |
| 2216 | # disturb) | |
| 2217 | # syncbyte 8 bit 0x47 | |
| 2218 | # error_ind 1 bit - | |
| 2219 | # payload_start 1 bit 1 | |
| 2220 | # priority 1 bit - | |
| 2221 | # PID 13 bit 0x0000 | |
| 2222 | # scrambling 2 bit - | |
| 2223 | # adaptfld_ctrl 2 bit 1 or 3 | |
| 2224 | # conti_count 4 bit 0 | |
| 2225 | 0 belong&0xFF5FFF1F 0x47400010 MPEG transport stream data | |
| 2226 | >188 byte !0x47 CORRUPTED | |
| 2227 | ||
| 2228 | # DIF digital video file format <mpruett@sgi.com> | |
| 2229 | 0 belong&0xffffff00 0x1f070000 DIF | |
| 2230 | >4 byte &0x01 (DVCPRO) movie file | |
| 2231 | >4 byte ^0x01 (DV) movie file | |
| 2232 | >3 byte &0x80 (PAL) | |
| 2233 | >3 byte ^0x80 (NTSC) | |
| 2234 | ||
| 2235 | # Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com> | |
| 2236 | 0 belong 0x3026b275 Microsoft ASF | |
| 2237 | ||
| 2238 | # MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> | |
| 2239 | 0 string \x8aMNG MNG video data, | |
| 2240 | >4 belong !0x0d0a1a0a CORRUPTED, | |
| 2241 | >4 belong 0x0d0a1a0a | |
| 2242 | >>16 belong x %ld x | |
| 2243 | >>20 belong x %ld | |
| 2244 | ||
| 2245 | # JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> | |
| 2246 | 0 string \x8bJNG JNG video data, | |
| 2247 | >4 belong !0x0d0a1a0a CORRUPTED, | |
| 2248 | >4 belong 0x0d0a1a0a | |
| 2249 | >>16 belong x %ld x | |
| 2250 | >>20 belong x %ld | |
| 2251 | ||
| 2252 | # Vivo video (Wolfram Kleff) | |
| 2253 | 3 string \x0D\x0AVersion:Vivo Vivo video data | |
| 2254 | ||
| 2255 | # VRML (Virtual Reality Modelling Language) | |
| 2256 | 0 string/b #VRML\ V1.0\ ascii VRML 1 file | |
| 2257 | 0 string/b #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file | |
| 2258 | ||
| 2259 | #--------------------------------------------------------------------------- | |
| 2260 | # HVQM4: compressed movie format designed by Hudson for Nintendo GameCube | |
| 2261 | # From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03 | |
| 2262 | # | |
| 2263 | 0 string HVQM4 %s | |
| 2264 | >6 string >\0 v%s | |
| 2265 | >0 byte x GameCube movie, | |
| 2266 | >0x34 ubeshort x %d x | |
| 2267 | >0x36 ubeshort x %d, | |
| 2268 | >0x26 ubeshort x %dµs, | |
| 2269 | >0x42 ubeshort 0 no audio | |
| 2270 | >0x42 ubeshort >0 %dHz audio | |
| 2271 | ||
| 2272 | #------------------------------------------------------------------------------ | |
| 2273 | # chi: file(1) magic for ChiWriter files | |
| 2274 | # | |
| 2275 | 0 string \\1cw\ ChiWriter file | |
| 2276 | >5 string >\0 version %s | |
| 2277 | 0 string \\1cw ChiWriter file | |
| 2278 | ||
| 2279 | #------------------------------------------------------------------------------ | |
| 2280 | # claris: file(1) magic for claris | |
| 2281 | # "H. Nanosecond" <aldomel@ix.netcom.com> | |
| 2282 | # Claris Works a word processor, etc. | |
| 2283 | # Version 3.0 | |
| 2284 | ||
| 2285 | # .pct claris works clip art files | |
| 2286 | #0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 | |
| 2287 | #* | |
| 2288 | #0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000 | |
| 2289 | #null to byte 1000 octal | |
| 2290 | 514 string \377\377\377\377\000 Claris clip art? | |
| 2291 | >0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes. | |
| 2292 | 514 string \377\377\377\377\001 Claris clip art? | |
| 2293 | >0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes. | |
| 2294 | ||
| 2295 | # Claris works files | |
| 2296 | # .cwk | |
| 2297 | 0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document | |
| 2298 | # .plt | |
| 2299 | 0 string \020\341\000\000\010\010 Claris Works pallete files .plt | |
| 2300 | ||
| 2301 | # .msp a dictionary file I am not sure about this I have only one .msp file | |
| 2302 | 0 string \002\271\262\000\040\002\000\164 Claris works dictionary | |
| 2303 | ||
| 2304 | # .usp are user dictionary bits | |
| 2305 | # I am not sure about a magic header: | |
| 2306 | #0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151 | |
| 2307 | # soh S p f 8 U D sp ^ S cr nl p o d i | |
| 2308 | #0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043 | |
| 2309 | # a t r i s t sp ^ S cr nl d i v sp # | |
| 2310 | ||
| 2311 | # .mth Thesaurus | |
| 2312 | # starts with \0 but no magic header | |
| 2313 | ||
| 2314 | # .chy Hyphenation file | |
| 2315 | # I am not sure: 000 210 034 000 000 | |
| 2316 | ||
| 2317 | # other claris files | |
| 2318 | #./windows/claris/useng.ndx: data | |
| 2319 | #./windows/claris/xtndtran.l32: data | |
| 2320 | #./windows/claris/xtndtran.lst: data | |
| 2321 | #./windows/claris/clworks.lbl: data | |
| 2322 | #./windows/claris/clworks.prf: data | |
| 2323 | #./windows/claris/userd.spl: data | |
| 2324 | ||
| 2325 | #------------------------------------------------------------------------------ | |
| 2326 | # fonts: file(1) magic for font data | |
| 2327 | # | |
| 2328 | 0 string FONT ASCII vfont text | |
| 2329 | 0 short 0436 Berkeley vfont data | |
| 2330 | 0 short 017001 byte-swapped Berkeley vfont data | |
| 2331 | ||
| 2332 | # PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com | |
| 2333 | 0 string %!PS-AdobeFont-1. PostScript Type 1 font text | |
| 2334 | >20 string >\0 (%s) | |
| 2335 | 6 string %!PS-AdobeFont-1. PostScript Type 1 font program data | |
| 2336 | ||
| 2337 | # X11 font files in SNF (Server Natural Format) format | |
| 2338 | 0 belong 00000004 X11 SNF font data, MSB first | |
| 2339 | 0 lelong 00000004 X11 SNF font data, LSB first | |
| 2340 | ||
| 2341 | # X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com) | |
| 2342 | 0 string STARTFONT\040 X11 BDF font text | |
| 2343 | ||
| 2344 | # X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) | |
| 2345 | # PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides) | |
| 2346 | 0 string \001fcp X11 Portable Compiled Font data | |
| 2347 | >12 byte 0x02 \b, LSB first | |
| 2348 | >12 byte 0x0a \b, MSB first | |
| 2349 | 0 string D1.0\015 X11 Speedo font data | |
| 2350 | ||
| 2351 | #------------------------------------------------------------------------------ | |
| 2352 | # FIGlet fonts and controlfiles | |
| 2353 | # From figmagic supplied with Figlet version 2.2 | |
| 2354 | # "David E. O'Brien" <obrien@FreeBSD.ORG> | |
| 2355 | 0 string flf FIGlet font | |
| 2356 | >3 string >2a version %-2.2s | |
| 2357 | 0 string flc FIGlet controlfile | |
| 2358 | >3 string >2a version %-2.2s | |
| 2359 | ||
| 2360 | # libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu) | |
| 2361 | # Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++ | |
| 2362 | 0 belong 0x14025919 libGrx font data, | |
| 2363 | >8 leshort x %dx | |
| 2364 | >10 leshort x \b%d | |
| 2365 | >40 string x %s | |
| 2366 | # Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu) | |
| 2367 | 0 belong 0xff464f4e DOS code page font data collection | |
| 2368 | 7 belong 0x00454741 DOS code page font data | |
| 2369 | 7 belong 0x00564944 DOS code page font data (from Linux?) | |
| 2370 | 4098 string DOSFONT DOSFONT2 encrypted font data | |
| 2371 | ||
| 2372 | # downloadable fonts for browser (prints type) anthon@mnt.org | |
| 2373 | 0 string PFR1 PFR1 font | |
| 2374 | >102 string >0 \b: %s | |
| 2375 | ||
| 2376 | # True Type fonts | |
| 2377 | 0 string \000\001\000\000\000 TrueType font data | |
| 2378 | ||
| 2379 | 0 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font | |
| 2380 | 0 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font | |
| 2381 | ||
| 2382 | # Opentype font data from Avi Bercovich | |
| 2383 | 0 string OTTO OpenType font data | |
| 2384 | ||
| 2385 | ||
| 2386 | #------------------------------------------------------------------------------ | |
| 2387 | # macintosh description | |
| 2388 | # | |
| 2389 | # BinHex is the Macintosh ASCII-encoded file format (see also "apple") | |
| 2390 | # Daniel Quinlan, quinlan@yggdrasil.com | |
| 2391 | 11 string must\ be\ converted\ with\ BinHex BinHex binary text | |
| 2392 | >41 string x \b, version %.3s | |
| 2393 | ||
| 2394 | # Stuffit archives are the de facto standard of compression for Macintosh | |
| 2395 | # files obtained from most archives. (franklsm@tuns.ca) | |
| 2396 | 0 string SIT! StuffIt Archive (data) | |
| 2397 | >2 string x : %s | |
| 2398 | 0 string SITD StuffIt Deluxe (data) | |
| 2399 | >2 string x : %s | |
| 2400 | 0 string Seg StuffIt Deluxe Segment (data) | |
| 2401 | >2 string x : %s | |
| 2402 | ||
| 2403 | # Newer StuffIt archives (grant@netbsd.org) | |
| 2404 | 0 string StuffIt StuffIt Archive | |
| 2405 | >162 string >0 : %s | |
| 2406 | ||
| 2407 | # Macintosh Applications and Installation binaries (franklsm@tuns.ca) | |
| 2408 | 0 string APPL Macintosh Application (data) | |
| 2409 | >2 string x \b: %s | |
| 2410 | ||
| 2411 | # Macintosh System files (franklsm@tuns.ca) | |
| 2412 | 0 string zsys Macintosh System File (data) | |
| 2413 | 0 string FNDR Macintosh Finder (data) | |
| 2414 | 0 string libr Macintosh Library (data) | |
| 2415 | >2 string x : %s | |
| 2416 | 0 string shlb Macintosh Shared Library (data) | |
| 2417 | >2 string x : %s | |
| 2418 | 0 string cdev Macintosh Control Panel (data) | |
| 2419 | >2 string x : %s | |
| 2420 | 0 string INIT Macintosh Extension (data) | |
| 2421 | >2 string x : %s | |
| 2422 | 0 string FFIL Macintosh Truetype Font (data) | |
| 2423 | >2 string x : %s | |
| 2424 | 0 string LWFN Macintosh Postscript Font (data) | |
| 2425 | >2 string x : %s | |
| 2426 | ||
| 2427 | # Additional Macintosh Files (franklsm@tuns.ca) | |
| 2428 | 0 string PACT Macintosh Compact Pro Archive (data) | |
| 2429 | >2 string x : %s | |
| 2430 | 0 string ttro Macintosh TeachText File (data) | |
| 2431 | >2 string x : %s | |
| 2432 | 0 string TEXT Macintosh TeachText File (data) | |
| 2433 | >2 string x : %s | |
| 2434 | 0 string PDF Macintosh PDF File (data) | |
| 2435 | >2 string x : %s | |
| 2436 | ||
| 2437 | # MacBinary format (Eric Fischer, enf@pobox.com) | |
| 2438 | # | |
| 2439 | # Unfortunately MacBinary doesn't really have a magic number prior | |
| 2440 | # to the MacBinary III format. The checksum is really the way to | |
| 2441 | # do it, but the magic file format isn't up to the challenge. | |
| 2442 | # | |
| 2443 | # 0 byte 0 | |
| 2444 | # 1 byte # filename length | |
| 2445 | # 2 string # filename | |
| 2446 | # 65 string # file type | |
| 2447 | # 69 string # file creator | |
| 2448 | # 73 byte # Finder flags | |
| 2449 | # 74 byte 0 | |
| 2450 | # 75 beshort # vertical posn in window | |
| 2451 | # 77 beshort # horiz posn in window | |
| 2452 | # 79 beshort # window or folder ID | |
| 2453 | # 81 byte # protected? | |
| 2454 | # 82 byte 0 | |
| 2455 | # 83 belong # length of data segment | |
| 2456 | # 87 belong # length of resource segment | |
| 2457 | # 91 belong # file creation date | |
| 2458 | # 95 belong # file modification date | |
| 2459 | # 99 beshort # length of comment after resource | |
| 2460 | # 101 byte # new Finder flags | |
| 2461 | # 102 string mBIN # (only in MacBinary III) | |
| 2462 | # 106 byte # char. code of file name | |
| 2463 | # 107 byte # still more Finder flags | |
| 2464 | # 116 belong # total file length | |
| 2465 | # 120 beshort # length of add'l header | |
| 2466 | # 122 byte 129 # for MacBinary II | |
| 2467 | # 122 byte 130 # for MacBinary III | |
| 2468 | # 123 byte 129 # minimum version that can read fmt | |
| 2469 | # 124 beshort # checksum | |
| 2470 | # | |
| 2471 | # This attempts to use the version numbers as a magic number, requiring | |
| 2472 | # that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second | |
| 2473 | # be 0x81. This works for the files I have, but maybe not for everyone's. | |
| 2474 | ||
| 2475 | # Unfortunately, this magic is quite weak - MPi | |
| 2476 | #122 beshort&0xFCFF 0x8081 Macintosh MacBinary data | |
| 2477 | ||
| 2478 | # MacBinary I doesn't have the version number field at all, but MacBinary II | |
| 2479 | # has been in use since 1987 so I hope there aren't many really old files | |
| 2480 | # floating around that this will miss. The original spec calls for using | |
| 2481 | # the nulls in 0, 74, and 82 as the magic number. | |
| 2482 | # | |
| 2483 | # Another possibility, that would also work for MacBinary I, is to use | |
| 2484 | # the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will | |
| 2485 | # have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset, | |
| 2486 | # and that 74 will be 0. So something like | |
| 2487 | # | |
| 2488 | # 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data | |
| 2489 | # | |
| 2490 | # >73 byte&0x01 0x01 \b, inited | |
| 2491 | # >73 byte&0x02 0x02 \b, changed | |
| 2492 | # >73 byte&0x04 0x04 \b, busy | |
| 2493 | # >73 byte&0x08 0x08 \b, bozo | |
| 2494 | # >73 byte&0x10 0x10 \b, system | |
| 2495 | # >73 byte&0x10 0x20 \b, bundle | |
| 2496 | # >73 byte&0x10 0x40 \b, invisible | |
| 2497 | # >73 byte&0x10 0x80 \b, locked | |
| 2498 | ||
| 2499 | #>65 string x \b, type "%4.4s" | |
| 2500 | ||
| 2501 | #>65 string 8BIM (PhotoShop) | |
| 2502 | #>65 string ALB3 (PageMaker 3) | |
| 2503 | #>65 string ALB4 (PageMaker 4) | |
| 2504 | #>65 string ALT3 (PageMaker 3) | |
| 2505 | #>65 string APPL (application) | |
| 2506 | #>65 string AWWP (AppleWorks word processor) | |
| 2507 | #>65 string CIRC (simulated circuit) | |
| 2508 | #>65 string DRWG (MacDraw) | |
| 2509 | #>65 string EPSF (Encapsulated PostScript) | |
| 2510 | #>65 string FFIL (font suitcase) | |
| 2511 | #>65 string FKEY (function key) | |
| 2512 | #>65 string FNDR (Macintosh Finder) | |
| 2513 | #>65 string GIFf (GIF image) | |
| 2514 | #>65 string Gzip (GNU gzip) | |
| 2515 | #>65 string INIT (system extension) | |
| 2516 | #>65 string LIB\ (library) | |
| 2517 | #>65 string LWFN (PostScript font) | |
| 2518 | #>65 string MSBC (Microsoft BASIC) | |
| 2519 | #>65 string PACT (Compact Pro archive) | |
| 2520 | #>65 string PDF\ (Portable Document Format) | |
| 2521 | #>65 string PICT (picture) | |
| 2522 | #>65 string PNTG (MacPaint picture) | |
| 2523 | #>65 string PREF (preferences) | |
| 2524 | #>65 string PROJ (Think C project) | |
| 2525 | #>65 string QPRJ (Think Pascal project) | |
| 2526 | #>65 string SCFL (Defender scores) | |
| 2527 | #>65 string SCRN (startup screen) | |
| 2528 | #>65 string SITD (StuffIt Deluxe) | |
| 2529 | #>65 string SPn3 (SuperPaint) | |
| 2530 | #>65 string STAK (HyperCard stack) | |
| 2531 | #>65 string Seg\ (StuffIt segment) | |
| 2532 | #>65 string TARF (Unix tar archive) | |
| 2533 | #>65 string TEXT (ASCII) | |
| 2534 | #>65 string TIFF (TIFF image) | |
| 2535 | #>65 string TOVF (Eudora table of contents) | |
| 2536 | #>65 string WDBN (Microsoft Word word processor) | |
| 2537 | #>65 string WORD (MacWrite word processor) | |
| 2538 | #>65 string XLS\ (Microsoft Excel) | |
| 2539 | #>65 string ZIVM (compress (.Z)) | |
| 2540 | #>65 string ZSYS (Pre-System 7 system file) | |
| 2541 | #>65 string acf3 (Aldus FreeHand) | |
| 2542 | #>65 string cdev (control panel) | |
| 2543 | #>65 string dfil (Desk Acessory suitcase) | |
| 2544 | #>65 string libr (library) | |
| 2545 | #>65 string nX^d (WriteNow word processor) | |
| 2546 | #>65 string nX^w (WriteNow dictionary) | |
| 2547 | #>65 string rsrc (resource) | |
| 2548 | #>65 string scbk (Scrapbook) | |
| 2549 | #>65 string shlb (shared library) | |
| 2550 | #>65 string ttro (SimpleText read-only) | |
| 2551 | #>65 string zsys (system file) | |
| 2552 | ||
| 2553 | #>69 string x \b, creator "%4.4s" | |
| 2554 | ||
| 2555 | # Somewhere, Apple has a repository of registered Creator IDs. These are | |
| 2556 | # just the ones that I happened to have files from and was able to identify. | |
| 2557 | ||
| 2558 | #>69 string 8BIM (Adobe Photoshop) | |
| 2559 | #>69 string ALD3 (PageMaker 3) | |
| 2560 | #>69 string ALD4 (PageMaker 4) | |
| 2561 | #>69 string ALFA (Alpha editor) | |
| 2562 | #>69 string APLS (Apple Scanner) | |
| 2563 | #>69 string APSC (Apple Scanner) | |
| 2564 | #>69 string BRKL (Brickles) | |
| 2565 | #>69 string BTFT (BitFont) | |
| 2566 | #>69 string CCL2 (Common Lisp 2) | |
| 2567 | #>69 string CCL\ (Common Lisp) | |
| 2568 | #>69 string CDmo (The Talking Moose) | |
| 2569 | #>69 string CPCT (Compact Pro) | |
| 2570 | #>69 string CSOm (Eudora) | |
| 2571 | #>69 string DMOV (Font/DA Mover) | |
| 2572 | #>69 string DSIM (DigSim) | |
| 2573 | #>69 string EDIT (Macintosh Edit) | |
| 2574 | #>69 string ERIK (Macintosh Finder) | |
| 2575 | #>69 string EXTR (self-extracting archive) | |
| 2576 | #>69 string Gzip (GNU gzip) | |
| 2577 | #>69 string KAHL (Think C) | |
| 2578 | #>69 string LWFU (LaserWriter Utility) | |
| 2579 | #>69 string LZIV (compress) | |
| 2580 | #>69 string MACA (MacWrite) | |
| 2581 | #>69 string MACS (Macintosh operating system) | |
| 2582 | #>69 string MAcK (MacKnowledge terminal emulator) | |
| 2583 | #>69 string MLND (Defender) | |
| 2584 | #>69 string MPNT (MacPaint) | |
| 2585 | #>69 string MSBB (Microsoft BASIC (binary)) | |
| 2586 | #>69 string MSWD (Microsoft Word) | |
| 2587 | #>69 string NCSA (NCSA Telnet) | |
| 2588 | #>69 string PJMM (Think Pascal) | |
| 2589 | #>69 string PSAL (Hunt the Wumpus) | |
| 2590 | #>69 string PSI2 (Apple File Exchange) | |
| 2591 | #>69 string R*ch (BBEdit) | |
| 2592 | #>69 string RMKR (Resource Maker) | |
| 2593 | #>69 string RSED (Resource Editor) | |
| 2594 | #>69 string Rich (BBEdit) | |
| 2595 | #>69 string SIT! (StuffIt) | |
| 2596 | #>69 string SPNT (SuperPaint) | |
| 2597 | #>69 string Unix (NeXT Mac filesystem) | |
| 2598 | #>69 string VIM! (Vim editor) | |
| 2599 | #>69 string WILD (HyperCard) | |
| 2600 | #>69 string XCEL (Microsoft Excel) | |
| 2601 | #>69 string aCa2 (Fontographer) | |
| 2602 | #>69 string aca3 (Aldus FreeHand) | |
| 2603 | #>69 string dosa (Macintosh MS-DOS file system) | |
| 2604 | #>69 string movr (Font/DA Mover) | |
| 2605 | #>69 string nX^n (WriteNow) | |
| 2606 | #>69 string pdos (Apple ProDOS file system) | |
| 2607 | #>69 string scbk (Scrapbook) | |
| 2608 | #>69 string ttxt (SimpleText) | |
| 2609 | #>69 string ufox (Foreign File Access) | |
| 2610 | ||
| 2611 | # Just in case... | |
| 2612 | ||
| 2613 | 102 string mBIN MacBinary III data with surprising version number | |
| 2614 | ||
| 2615 | # sas magic from Bruce Foster (bef@nwu.edu) | |
| 2616 | # | |
| 2617 | #0 string SAS SAS | |
| 2618 | #>8 string x %s | |
| 2619 | 0 string SAS SAS | |
| 2620 | >24 string DATA data file | |
| 2621 | >24 string CATALOG catalog | |
| 2622 | >24 string INDEX data file index | |
| 2623 | >24 string VIEW data view | |
| 2624 | # sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) | |
| 2625 | # | |
| 2626 | 0x54 string SAS SAS 7+ | |
| 2627 | >0x9C string DATA data file | |
| 2628 | >0x9C string CATALOG catalog | |
| 2629 | >0x9C string INDEX data file index | |
| 2630 | >0x9C string VIEW data view | |
| 2631 | ||
| 2632 | # spss magic for SPSS system and portable files, | |
| 2633 | # from Bruce Foster (bef@nwu.edu). | |
| 2634 | ||
| 2635 | 0 long 0xc1e2c3c9 SPSS Portable File | |
| 2636 | >40 string x %s | |
| 2637 | ||
| 2638 | 0 string $FL2 SPSS System File | |
| 2639 | >24 string x %s | |
| 2640 | ||
| 2641 | # Macintosh filesystem data | |
| 2642 | # From "Tom N Harris" <telliamed@mac.com> | |
| 2643 | # Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> | |
| 2644 | # The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these | |
| 2645 | # entries depend on the data arithmetic added after v.35 | |
| 2646 | # There's also some Pascal strings in here, ditto... | |
| 2647 | ||
| 2648 | # The boot block signature, according to IM:Files, is | |
| 2649 | # "for HFS volumes, this field always contains the value 0x4C4B." | |
| 2650 | # But if this is true for MFS or HFS+ volumes, I don't know. | |
| 2651 | # Alternatively, the boot block is supposed to be zeroed if it's | |
| 2652 | # unused, so a simply >0 should suffice. | |
| 2653 | ||
| 2654 | 0x400 beshort 0xD2D7 Macintosh MFS data | |
| 2655 | >0 beshort 0x4C4B (bootable) | |
| 2656 | >0x40a beshort &0x8000 (locked) | |
| 2657 | >0x402 beldate-0x7C25B080 x created: %s, | |
| 2658 | >0x406 beldate-0x7C25B080 >0 last backup: %s, | |
| 2659 | >0x414 belong x block size: %d, | |
| 2660 | >0x412 beshort x number of blocks: %d, | |
| 2661 | >0x424 pstring x volume name: %s | |
| 2662 | ||
| 2663 | # "BD" is has many false positives | |
| 2664 | #0x400 beshort 0x4244 Macintosh HFS data | |
| 2665 | #>0 beshort 0x4C4B (bootable) | |
| 2666 | #>0x40a beshort &0x8000 (locked) | |
| 2667 | #>0x40a beshort ^0x0100 (mounted) | |
| 2668 | #>0x40a beshort &0x0200 (spared blocks) | |
| 2669 | #>0x40a beshort &0x0800 (unclean) | |
| 2670 | #>0x47C beshort 0x482B (Embedded HFS+ Volume) | |
| 2671 | #>0x402 beldate-0x7C25B080 x created: %s, | |
| 2672 | #>0x406 beldate-0x7C25B080 x last modified: %s, | |
| 2673 | #>0x440 beldate-0x7C25B080 >0 last backup: %s, | |
| 2674 | #>0x414 belong x block size: %d, | |
| 2675 | #>0x412 beshort x number of blocks: %d, | |
| 2676 | #>0x424 pstring x volume name: %s | |
| 2677 | ||
| 2678 | 0x400 beshort 0x482B Macintosh HFS Extended | |
| 2679 | >&0 beshort x version %d data | |
| 2680 | >0 beshort 0x4C4B (bootable) | |
| 2681 | >0x404 belong ^0x00000100 (mounted) | |
| 2682 | >&2 belong &0x00000200 (spared blocks) | |
| 2683 | >&2 belong &0x00000800 (unclean) | |
| 2684 | >&2 belong &0x00008000 (locked) | |
| 2685 | >&6 string x last mounted by: '%.4s', | |
| 2686 | # really, that should be treated as a belong and we print a string | |
| 2687 | # based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" | |
| 2688 | >&14 beldate-0x7C25B080 x created: %s, | |
| 2689 | # only the creation date is local time, all other timestamps in HFS+ are UTC. | |
| 2690 | >&18 bedate-0x7C25B080 x last modified: %s, | |
| 2691 | >&22 bedate-0x7C25B080 >0 last backup: %s, | |
| 2692 | >&26 bedate-0x7C25B080 >0 last checked: %s, | |
| 2693 | >&38 belong x block size: %d, | |
| 2694 | >&42 belong x number of blocks: %d, | |
| 2695 | >&46 belong x free blocks: %d | |
| 2696 | ||
| 2697 | # I don't think this is really necessary since it doesn't do much and | |
| 2698 | # anything with a valid driver descriptor will also have a valid | |
| 2699 | # partition map | |
| 2700 | #0 beshort 0x4552 Apple Device Driver data | |
| 2701 | #>&24 beshort =1 \b, MacOS | |
| 2702 | ||
| 2703 | # Is that the partition type a cstring or a pstring? Well, IM says "strings | |
| 2704 | # shorter than 32 bytes must be terminated with NULL" so I'll treat it as a | |
| 2705 | # cstring. Of course, partitions can contain more than four entries, but | |
| 2706 | # what're you gonna do? | |
| 2707 | 0x200 beshort 0x504D Apple Partition data | |
| 2708 | >0x2 beshort x block size: %d, | |
| 2709 | >0x230 string x first type: %s, | |
| 2710 | >0x210 string x name: %s, | |
| 2711 | >0x254 belong x number of blocks: %d, | |
| 2712 | >0x400 beshort 0x504D | |
| 2713 | >>0x430 string x second type: %s, | |
| 2714 | >>0x410 string x name: %s, | |
| 2715 | >>0x454 belong x number of blocks: %d, | |
| 2716 | >>0x800 beshort 0x504D | |
| 2717 | >>>0x830 string x third type: %s, | |
| 2718 | >>>0x810 string x name: %s, | |
| 2719 | >>>0x854 belong x number of blocks: %d, | |
| 2720 | >>>0xa00 beshort 0x504D | |
| 2721 | >>>>0xa30 string x fourth type: %s, | |
| 2722 | >>>>0xa10 string x name: %s, | |
| 2723 | >>>>0xa54 belong x number of blocks: %d | |
| 2724 | # AFAIK, only the signature is different | |
| 2725 | 0x200 beshort 0x5453 Apple Old Partition data | |
| 2726 | >0x2 beshort x block size: %d, | |
| 2727 | >0x230 string x first type: %s, | |
| 2728 | >0x210 string x name: %s, | |
| 2729 | >0x254 belong x number of blocks: %d, | |
| 2730 | >0x400 beshort 0x504D | |
| 2731 | >>0x430 string x second type: %s, | |
| 2732 | >>0x410 string x name: %s, | |
| 2733 | >>0x454 belong x number of blocks: %d, | |
| 2734 | >>0x800 beshort 0x504D | |
| 2735 | >>>0x830 string x third type: %s, | |
| 2736 | >>>0x810 string x name: %s, | |
| 2737 | >>>0x854 belong x number of blocks: %d, | |
| 2738 | >>>0xa00 beshort 0x504D | |
| 2739 | >>>>0xa30 string x fourth type: %s, | |
| 2740 | >>>>0xa10 string x name: %s, | |
| 2741 | >>>>0xa54 belong x number of blocks: %d | |
| 2742 | ||
| 2743 | # From: Remi Mommsen <mommsen@slac.stanford.edu> | |
| 2744 | 0 string BOMStore Mac OS X bill of materials (BOM) fil | |
| 2745 | ||
| 2746 | #------------------------------------------------------------------------------ | |
| 2747 | # mathematica: file(1) magic for mathematica files | |
| 2748 | # "H. Nanosecond" <aldomel@ix.netcom.com> | |
| 2749 | # Mathematica a multi-purpose math program | |
| 2750 | # versions 2.2 and 3.0 | |
| 2751 | ||
| 2752 | #mathematica .mb | |
| 2753 | 0 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook | |
| 2754 | 0 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook | |
| 2755 | ||
| 2756 | # .ma | |
| 2757 | # multiple possibilites: | |
| 2758 | ||
| 2759 | 0 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook | |
| 2760 | #>41 string >\0 %s | |
| 2761 | ||
| 2762 | #0 string (*^\n\n::[\011palette Mathematica notebook version 2.x | |
| 2763 | ||
| 2764 | #0 string (*^\n\n::[\011Information Mathematica notebook version 2.x | |
| 2765 | #>675 string >\0 %s #doesn't work well | |
| 2766 | ||
| 2767 | # there may be 'cr' instread of 'nl' in some does this matter? | |
| 2768 | ||
| 2769 | # generic: | |
| 2770 | 0 string (*^\r\r::[\011 Mathematica notebook version 2.x | |
| 2771 | 0 string \(\*\^\r\n\r\n\:\:\[\011 Mathematica notebook version 2.x | |
| 2772 | 0 string (*^\015 Mathematica notebook version 2.x | |
| 2773 | 0 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x | |
| 2774 | 0 string (*^\r::[\011 Mathematica notebook version 2.x | |
| 2775 | 0 string (*^\r\n::[\011 Mathematica notebook version 2.x | |
| 2776 | 0 string (*^\n\n::[\011 Mathematica notebook version 2.x | |
| 2777 | 0 string (*^\n::[\011 Mathematica notebook version 2.x | |
| 2778 | ||
| 2779 | ||
| 2780 | # Mathematica .mx files | |
| 2781 | ||
| 2782 | #0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file | |
| 2783 | 0 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file | |
| 2784 | #>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000 | |
| 2785 | # >71... is optional | |
| 2786 | >88 string >\0 from %s | |
| 2787 | ||
| 2788 | ||
| 2789 | # Mathematica files PBF: | |
| 2790 | # 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000 | |
| 2791 | 0 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think) | |
| 2792 | ||
| 2793 | # .ml files These are menu resources I think | |
| 2794 | # these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\ | |
| 2795 | # how to put that into a magic rule? | |
| 2796 | 4 string \ A~ MAthematica .ml file | |
| 2797 | ||
| 2798 | # .nb files | |
| 2799 | #too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook | |
| 2800 | 0 string (*********************** Mathematica 3.0 notebook | |
| 2801 | ||
| 2802 | # other (* matches it is a comment start in these langs | |
| 2803 | 0 string (* Mathematica, or Pascal, Modula-2 or 3 code text | |
| 2804 | ||
| 2805 | ######################### | |
| 2806 | # MatLab v5 | |
| 2807 | 0 string MATLAB Matlab v5 mat-file | |
| 2808 | >126 short 0x494d (big endian) | |
| 2809 | >>124 beshort x version 0x%04x | |
| 2810 | >126 short 0x4d49 (little endian) | |
| 2811 | >>124 leshort x version 0x%04x | |
| 2812 | ||
| 2813 | #------------------------------------------------------------------------------ | |
| 2814 | # teapot: file(1) magic for "teapot" spreadsheet | |
| 2815 | # | |
| 2816 | 0 string #!teapot\012xdr teapot work sheet (XDR format) | |
| 2817 | ||
| 2818 | #------------------------------------------------------------------------------ | |
| 2819 | # psion: file(1) magic for Psion handhelds data | |
| 2820 | # from: Peter Breitenlohner <peb@mppmu.mpg.de> | |
| 2821 | # | |
| 2822 | 0 lelong 0x10000037 Psion Series 5 | |
| 2823 | >4 lelong 0x10000039 font file | |
| 2824 | >4 lelong 0x1000003A printer driver | |
| 2825 | >4 lelong 0x1000003B clipboard | |
| 2826 | >4 lelong 0x10000042 multi-bitmap image | |
| 2827 | >4 lelong 0x1000006A application infomation file | |
| 2828 | >4 lelong 0x1000006D | |
| 2829 | >>8 lelong 0x1000007D sketch image | |
| 2830 | >>8 lelong 0x1000007E voice note | |
| 2831 | >>8 lelong 0x1000007F word file | |
| 2832 | >>8 lelong 0x10000085 OPL program | |
| 2833 | >>8 lelong 0x10000088 sheet file | |
| 2834 | >>8 lelong 0x100001C4 EasyFax initialisation file | |
| 2835 | >4 lelong 0x10000073 OPO module | |
| 2836 | >4 lelong 0x10000074 OPL application | |
| 2837 | >4 lelong 0x1000008A exported multi-bitmap image | |
| 2838 | ||
| 2839 | 0 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image | |
| 2840 | ||
| 2841 | 0 lelong 0x10000050 Psion Series 5 | |
| 2842 | >4 lelong 0x1000006D database | |
| 2843 | >4 lelong 0x100000E4 ini file | |
| 2844 | ||
| 2845 | 0 lelong 0x10000079 Psion Series 5 binary: | |
| 2846 | >4 lelong 0x00000000 DLL | |
| 2847 | >4 lelong 0x10000049 comms hardware library | |
| 2848 | >4 lelong 0x1000004A comms protocol library | |
| 2849 | >4 lelong 0x1000005D OPX | |
| 2850 | >4 lelong 0x1000006C application | |
| 2851 | >4 lelong 0x1000008D DLL | |
| 2852 | >4 lelong 0x100000AC logical device driver | |
| 2853 | >4 lelong 0x100000AD physical device driver | |
| 2854 | >4 lelong 0x100000E5 file transfer protocol | |
| 2855 | >4 lelong 0x100000E5 file transfer protocol | |
| 2856 | >4 lelong 0x10000140 printer defintion | |
| 2857 | >4 lelong 0x10000141 printer defintion | |
| 2858 | ||
| 2859 | 0 lelong 0x1000007A Psion Series 5 executable | |
| 2860 | ||
| 2861 | #------------------------------------------------------------------------------ | |
| 2862 | # diff: file(1) magic for diff(1) output | |
| 2863 | # | |
| 2864 | 0 string diff\ 'diff' output text | |
| 2865 | 0 string ***\ 'diff' output text | |
| 2866 | 0 string Only\ in\ 'diff' output text | |
| 2867 | 0 string Common\ subdirectories:\ 'diff' output text | |
| 2868 | ||
| 2869 | #------------------------------------------------------------------------------ | |
| 2870 | # ESRI Shapefile format (.shp .shx .dbf=DBaseIII) | |
| 2871 | # Based on info from | |
| 2872 | # <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf> | |
| 2873 | 0 belong 9994 ESRI Shapefile | |
| 2874 | >4 belong =0 | |
| 2875 | >8 belong =0 | |
| 2876 | >12 belong =0 | |
| 2877 | >16 belong =0 | |
| 2878 | >20 belong =0 | |
| 2879 | >28 lelong x version %d | |
| 2880 | >24 belong x length %d | |
| 2881 | >32 lelong =0 type Null Shape | |
| 2882 | >32 lelong =1 type Point | |
| 2883 | >32 lelong =3 type PolyLine | |
| 2884 | >32 lelong =5 type Polygon | |
| 2885 | >32 lelong =8 type MultiPoint | |
| 2886 | >32 lelong =11 type PointZ | |
| 2887 | >32 lelong =13 type PolyLineZ | |
| 2888 | >32 lelong =15 type PolygonZ | |
| 2889 | >32 lelong =18 type MultiPointZ | |
| 2890 | >32 lelong =21 type PointM | |
| 2891 | >32 lelong =23 type PolyLineM | |
| 2892 | >32 lelong =25 type PolygonM | |
| 2893 | >32 lelong =28 type MultiPointM | |
| 2894 | >32 lelong =31 type MultiPatch | |
| 2895 | #------------------------------------------------------------------------------ | |
| 2896 | # GIMP Gradient: file(1) magic for the GIMP's gradient data files | |
| 2897 | # by Federico Mena <federico@nuclecu.unam.mx> | |
| 2898 | ||
| 2899 | 0 string GIMP\ Gradient GIMP gradient data | |
| 2900 | ||
| 2901 | #------------------------------------------------------------------------------ | |
| 2902 | # XCF: file(1) magic for the XCF image format used in the GIMP developed | |
| 2903 | # by Spencer Kimball and Peter Mattis | |
| 2904 | # ('Bucky' LaDieu, nega@vt.edu) | |
| 2905 | ||
| 2906 | 0 string gimp\ xcf GIMP XCF image data, | |
| 2907 | >9 string file version 0, | |
| 2908 | >9 string v version | |
| 2909 | >>10 string >\0 %s, | |
| 2910 | >14 belong x %lu x | |
| 2911 | >18 belong x %lu, | |
| 2912 | >22 belong 0 RGB Color | |
| 2913 | >22 belong 1 Greyscale | |
| 2914 | >22 belong 2 Indexed Color | |
| 2915 | >22 belong >2 Unknown Image Type. | |
| 2916 | ||
| 2917 | #------------------------------------------------------------------------------ | |
| 2918 | # XCF: file(1) magic for the patterns used in the GIMP, developed | |
| 2919 | # by Spencer Kimball and Peter Mattis | |
| 2920 | # ('Bucky' LaDieu, nega@vt.edu) | |
| 2921 | ||
| 2922 | 20 string GPAT GIMP pattern data, | |
| 2923 | >24 string x %s | |
| 2924 | ||
| 2925 | #------------------------------------------------------------------------------ | |
| 2926 | # XCF: file(1) magic for the brushes used in the GIMP, developed | |
| 2927 | # by Spencer Kimball and Peter Mattis | |
| 2928 | # ('Bucky' LaDieu, nega@vt.edu) | |
| 2929 | ||
| 2930 | 20 string GIMP GIMP brush data | |
| 2931 | ||
| 2932 | #------------------------------------------------------------------------------ | |
| 2933 | # adi: file(1) magic for ADi's objects | |
| 2934 | # From Gregory McGarry <g.mcgarry@ieee.org> | |
| 2935 | # | |
| 2936 | 0 leshort 0x521c COFF DSP21k | |
| 2937 | >18 lelong &02 executable, | |
| 2938 | >18 lelong ^02 | |
| 2939 | >>18 lelong &01 static object, | |
| 2940 | >>18 lelong ^01 relocatable object, | |
| 2941 | >18 lelong &010 stripped | |
| 2942 | >18 lelong ^010 not stripped | |
| 2943 | ||
| 2944 | #------------------------------------------------------------------------------ | |
| 2945 | # autocad: file(1) magic for cad files | |
| 2946 | # | |
| 2947 | ||
| 2948 | # AutoCAD DWG versions R13/R14 (www.autodesk.com) | |
| 2949 | # Written December 01, 2003 by Lester Hightower | |
| 2950 | # Based on the DWG File Format Specifications at http://www.opendwg.org/ | |
| 2951 | 0 string \101\103\061\060\061 AutoCAD | |
| 2952 | >5 string \062\000\000\000\000 DWG ver. R13 | |
| 2953 | >5 string \064\000\000\000\000 DWG ver. R14 | |
| 2954 | ||
| 2955 | # Microstation DGN/CIT Files (www.bentley.com) | |
| 2956 | # Written October 30, 2003 by Lester Hightower | |
| 2957 | # DGN is the default file extension of Microstation/Intergraph CAD files. | |
| 2958 | # CIT is the proprietary raster format (similar to TIFF) used to attach | |
| 2959 | # raster underlays to Microstation DGN (vector) drawings. | |
| 2960 | # | |
| 2961 | # http://www.wotsit.org/search.asp | |
| 2962 | # http://filext.com/detaillist.php?extdetail=DGN | |
| 2963 | # http://filext.com/detaillist.php?extdetail=CIT | |
| 2964 | # | |
| 2965 | # http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2 | |
| 2966 | # 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928 | |
| 2967 | # http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 | |
| 2968 | # 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F | |
| 2969 | 0 string \010\011\376 Microstation | |
| 2970 | >3 string \002 | |
| 2971 | >>30 string \372\104 DGN File | |
| 2972 | >>30 string \172\104 DGN File | |
| 2973 | >>30 string \026\105 DGN File | |
| 2974 | >4 string \030\000\000 CIT File | |
| 2975 | ||
| 2976 | # AutoCad, from Nahuel Greco | |
| 2977 | 0 string AC1012 AutoCad (release 12) | |
| 2978 | 0 string AC1014 AutoCad (release 14) | |
| 2979 | ||
| 2980 | #------------------------------------------------------------------------------ | |
| 2981 | # T602 editor documents | |
| 2982 | # by David Necas <yeti@physics.muni.cz> | |
| 2983 | 0 string @CT\ T602 document data, | |
| 2984 | >4 string 0 Kamenicky | |
| 2985 | >4 string 1 CP 852 | |
| 2986 | >4 string 2 KOI8-CS | |
| 2987 | >4 string >2 unknown encoding | |
| 2988 | ||
| 2989 | # Vi IMproved Encrypted file | |
| 2990 | # by David Necas <yeti@physics.muni.cz> | |
| 2991 | 0 string VimCrypt~ Vim encrypted file data | |
| 2992 | ||
| 2993 | #------------------------------------------------------------------------------ | |
| 2994 | # tex: file(1) magic for TeX files | |
| 2995 | # | |
| 2996 | # From <conklin@talisman.kaleida.com> | |
| 2997 | ||
| 2998 | # Although we may know the offset of certain text fields in TeX DVI | |
| 2999 | # and font files, we can't use them reliably because they are not | |
| 3000 | # zero terminated. [but we do anyway, christos] | |
| 3001 | 0 string \367\002 TeX DVI file | |
| 3002 | >16 string >\0 (%s) | |
| 3003 | 0 string \367\203 TeX generic font data | |
| 3004 | 0 string \367\131 TeX packed font data | |
| 3005 | >3 string >\0 (%s) | |
| 3006 | 0 string \367\312 TeX virtual font data | |
| 3007 | 0 string This\ is\ TeX, TeX transcript text | |
| 3008 | 0 string This\ is\ METAFONT, METAFONT transcript text | |
| 3009 | ||
| 3010 | # There is no way to detect TeX Font Metric (*.tfm) files without | |
| 3011 | # breaking them apart and reading the data. The following patterns | |
| 3012 | # match most *.tfm files generated by METAFONT or afm2tfm. | |
| 3013 | 2 string \000\021 TeX font metric data | |
| 3014 | >33 string >\0 (%s) | |
| 3015 | 2 string \000\022 TeX font metric data | |
| 3016 | >33 string >\0 (%s) | |
| 3017 | ||
| 3018 | # Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com) | |
| 3019 | 0 string \\input\ texinfo Texinfo source text | |
| 3020 | 0 string This\ is\ Info\ file GNU Info text | |
| 3021 | ||
| 3022 | # TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com) | |
| 3023 | 0 string \\input TeX document text | |
| 3024 | 0 string \\section LaTeX document text | |
| 3025 | 0 string \\setlength LaTeX document text | |
| 3026 | 0 string \\documentstyle LaTeX document text | |
| 3027 | 0 string \\chapter LaTeX document text | |
| 3028 | 0 string \\documentclass LaTeX 2e document text | |
| 3029 | 0 string \\relax LaTeX auxiliary file | |
| 3030 | 0 string \\contentsline LaTeX table of contents | |
| 3031 | 0 string %\ -*-latex-*- LaTeX document text | |
| 3032 | ||
| 3033 | # Tex document, from Hendrik Scholz <hendrik@scholz.net> | |
| 3034 | 0 string \\ifx TeX document text | |
| 3035 | ||
| 3036 | # Index and glossary files | |
| 3037 | 0 string \\indexentry LaTeX raw index file | |
| 3038 | 0 string \\begin{theindex} LaTeX sorted index | |
| 3039 | 0 string \\glossaryentry LaTeX raw glossary | |
| 3040 | 0 string \\begin{theglossary} LaTeX sorted glossary | |
| 3041 | 0 string This\ is\ makeindex Makeindex log file | |
| 3042 | ||
| 3043 | # End of TeX | |
| 3044 | ||
| 3045 | #------------------------------------------------------------------------------ | |
| 3046 | # file(1) magic for BibTex text files | |
| 3047 | # From Hendrik Scholz <hendrik@scholz.net> | |
| 3048 | ||
| 3049 | 0 string/c @article{ BibTeX text file | |
| 3050 | 0 string/c @book{ BibTeX text file | |
| 3051 | 0 string/c @inbook{ BibTeX text file | |
| 3052 | 0 string/c @incollection{ BibTeX text file | |
| 3053 | 0 string/c @inproceedings{ BibTeX text file | |
| 3054 | 0 string/c @manual{ BibTeX text file | |
| 3055 | 0 string/c @misc{ BibTeX text file | |
| 3056 | 0 string/c @preamble{ BibTeX text file | |
| 3057 | 0 string/c @phdthesis{ BibTeX text file | |
| 3058 | 0 string/c @techreport{ BibTeX text file | |
| 3059 | 0 string/c @unpublished{ BibTeX text file | |
| 3060 | ||
| 3061 | 73 string %%%\ \ BibTeX-file{ BibTex text file (with full header) | |
| 3062 | ||
| 3063 | 73 string %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header) | |
| 3064 | ||
| 3065 | 0 string %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file | |
| 3066 | ||
| 3067 | 0 string %\ BibTeX\ ` BibTeX custom bibliography style text file | |
| 3068 | ||
| 3069 | 0 string @c\ @mapfile{ TeX font aliases text file | |
| 3070 | ||
| 3071 | ||
| 3072 | #------------------------------------------------------------------------------ | |
| 3073 | # psdbms: file(1) magic for psdatabase | |
| 3074 | # | |
| 3075 | 0 belong&0xff00ffff 0x56000000 ps database | |
| 3076 | >1 string >\0 version %s | |
| 3077 | >4 string >\0 from kernel %s | |
| 3078 | #------------------------------------------------------------------------------ | |
| 3079 | # convex: file(1) magic for Convex boxes | |
| 3080 | # | |
| 3081 | # Convexes are big-endian. | |
| 3082 | # | |
| 3083 | # /*\ | |
| 3084 | # * Below are the magic numbers and tests added for Convex. | |
| 3085 | # * Added at beginning, because they are expected to be used most. | |
| 3086 | # \*/ | |
| 3087 | 0 belong 0507 Convex old-style object | |
| 3088 | >16 belong >0 not stripped | |
| 3089 | 0 belong 0513 Convex old-style demand paged executable | |
| 3090 | >16 belong >0 not stripped | |
| 3091 | 0 belong 0515 Convex old-style pre-paged executable | |
| 3092 | >16 belong >0 not stripped | |
| 3093 | 0 belong 0517 Convex old-style pre-paged, non-swapped executable | |
| 3094 | >16 belong >0 not stripped | |
| 3095 | 0 belong 0x011257 Core file | |
| 3096 | # | |
| 3097 | # The following are a series of dump format magic numbers. Each one | |
| 3098 | # corresponds to a drastically different dump format. The first on is | |
| 3099 | # the original dump format on a 4.1 BSD or earlier file system. The | |
| 3100 | # second marks the change between the 4.1 file system and the 4.2 file | |
| 3101 | # system. The Third marks the changing of the block size from 1K | |
| 3102 | # to 2K to be compatible with an IDC file system. The fourth indicates | |
| 3103 | # a dump that is dependent on Convex Storage Manager, because data in | |
| 3104 | # secondary storage is not physically contained within the dump. | |
| 3105 | # The restore program uses these number to determine how the data is | |
| 3106 | # to be extracted. | |
| 3107 | # | |
| 3108 | 24 belong =60011 dump format, 4.1 BSD or earlier | |
| 3109 | 24 belong =60012 dump format, 4.2 or 4.3 BSD without IDC | |
| 3110 | 24 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible) | |
| 3111 | 24 belong =60014 dump format, Convex Storage Manager by-reference dump | |
| 3112 | # | |
| 3113 | # what follows is a bunch of bit-mask checks on the flags field of the opthdr. | |
| 3114 | # If there is no `=' sign, assume just checking for whether the bit is set? | |
| 3115 | # | |
| 3116 | 0 belong 0601 Convex SOFF | |
| 3117 | >88 belong&0x000f0000 =0x00000000 c1 | |
| 3118 | >88 belong &0x00010000 c2 | |
| 3119 | >88 belong &0x00020000 c2mp | |
| 3120 | >88 belong &0x00040000 parallel | |
| 3121 | >88 belong &0x00080000 intrinsic | |
| 3122 | >88 belong &0x00000001 demand paged | |
| 3123 | >88 belong &0x00000002 pre-paged | |
| 3124 | >88 belong &0x00000004 non-swapped | |
| 3125 | >88 belong &0x00000008 POSIX | |
| 3126 | # | |
| 3127 | >84 belong &0x80000000 executable | |
| 3128 | >84 belong &0x40000000 object | |
| 3129 | >84 belong&0x20000000 =0 not stripped | |
| 3130 | >84 belong&0x18000000 =0x00000000 native fpmode | |
| 3131 | >84 belong&0x18000000 =0x10000000 ieee fpmode | |
| 3132 | >84 belong&0x18000000 =0x18000000 undefined fpmode | |
| 3133 | # | |
| 3134 | 0 belong 0605 Convex SOFF core | |
| 3135 | # | |
| 3136 | 0 belong 0607 Convex SOFF checkpoint | |
| 3137 | >88 belong&0x000f0000 =0x00000000 c1 | |
| 3138 | >88 belong &0x00010000 c2 | |
| 3139 | >88 belong &0x00020000 c2mp | |
| 3140 | >88 belong &0x00040000 parallel | |
| 3141 | >88 belong &0x00080000 intrinsic | |
| 3142 | >88 belong &0x00000008 POSIX | |
| 3143 | # | |
| 3144 | >84 belong&0x18000000 =0x00000000 native fpmode | |
| 3145 | >84 belong&0x18000000 =0x10000000 ieee fpmode | |
| 3146 | >84 belong&0x18000000 =0x18000000 undefined fpmode | |
| 3147 | ||
| 3148 | #------------------------------------------------------------------------------ | |
| 3149 | # freebsd: file(1) magic for FreeBSD objects | |
| 3150 | # | |
| 3151 | # All new-style FreeBSD magic numbers are in host byte order (i.e., | |
| 3152 | # little-endian on x86). | |
| 3153 | # | |
| 3154 | # XXX - this comes from the file "freebsd" in a recent FreeBSD version of | |
| 3155 | # "file"; it, and the NetBSD stuff in "netbsd", appear to use different | |
| 3156 | # schemes for distinguishing between executable images, shared libraries, | |
| 3157 | # and object files. | |
| 3158 | # | |
| 3159 | # FreeBSD says: | |
| 3160 | # | |
| 3161 | # Regardless of whether it's pure, demand-paged, or none of the | |
| 3162 | # above: | |
| 3163 | # | |
| 3164 | # if the entry point is < 4096, then it's a shared library if | |
| 3165 | # the "has run-time loader information" bit is set, and is | |
| 3166 | # position-independent if the "is position-independent" bit | |
| 3167 | # is set; | |
| 3168 | # | |
| 3169 | # if the entry point is >= 4096 (or >4095, same thing), then it's | |
| 3170 | # an executable, and is dynamically-linked if the "has run-time | |
| 3171 | # loader information" bit is set. | |
| 3172 | # | |
| 3173 | # On x86, NetBSD says: | |
| 3174 | # | |
| 3175 | # If it's neither pure nor demand-paged: | |
| 3176 | # | |
| 3177 | # if it has the "has run-time loader information" bit set, it's | |
| 3178 | # a dynamically-linked executable; | |
| 3179 | # | |
| 3180 | # if it doesn't have that bit set, then: | |
| 3181 | # | |
| 3182 | # if it has the "is position-independent" bit set, it's | |
| 3183 | # position-independent; | |
| 3184 | # | |
| 3185 | # if the entry point is non-zero, it's an executable, otherwise | |
| 3186 | # it's an object file. | |
| 3187 | # | |
| 3188 | # If it's pure: | |
| 3189 | # | |
| 3190 | # if it has the "has run-time loader information" bit set, it's | |
| 3191 | # a dynamically-linked executable, otherwise it's just an | |
| 3192 | # executable. | |
| 3193 | # | |
| 3194 | # If it's demand-paged: | |
| 3195 | # | |
| 3196 | # if it has the "has run-time loader information" bit set, | |
| 3197 | # then: | |
| 3198 | # | |
| 3199 | # if the entry point is < 4096, it's a shared library; | |
| 3200 | # | |
| 3201 | # if the entry point is = 4096 or > 4096 (i.e., >= 4096), | |
| 3202 | # it's a dynamically-linked executable); | |
| 3203 | # | |
| 3204 | # if it doesn't have the "has run-time loader information" bit | |
| 3205 | # set, then it's just an executable. | |
| 3206 | # | |
| 3207 | # (On non-x86, NetBSD does much the same thing, except that it uses | |
| 3208 | # 8192 on 68K - except for "68k4k", which is presumably "68K with 4K | |
| 3209 | # pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's | |
| 3210 | # had 8K pages; dunno about MIPS.) | |
| 3211 | # | |
| 3212 | # I suspect the two will differ only in perverse and uninteresting cases | |
| 3213 | # ("shared" libraries that aren't demand-paged and whose pages probably | |
| 3214 | # won't actually be shared, executables with entry points <4096). | |
| 3215 | # | |
| 3216 | # I leave it to those more familiar with FreeBSD and NetBSD to figure out | |
| 3217 | # what the right answer is (although using ">4095", FreeBSD-style, is | |
| 3218 | # probably better than separately checking for "=4096" and ">4096", | |
| 3219 | # NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged | |
| 3220 | # executables using the NetBSD technique.) | |
| 3221 | # | |
| 3222 | 0 lelong&0377777777 041400407 FreeBSD/i386 | |
| 3223 | >20 lelong <4096 | |
| 3224 | >>3 byte&0xC0 &0x80 shared library | |
| 3225 | >>3 byte&0xC0 0x40 PIC object | |
| 3226 | >>3 byte&0xC0 0x00 object | |
| 3227 | >20 lelong >4095 | |
| 3228 | >>3 byte&0x80 0x80 dynamically linked executable | |
| 3229 | >>3 byte&0x80 0x00 executable | |
| 3230 | >16 lelong >0 not stripped | |
| 3231 | ||
| 3232 | 0 lelong&0377777777 041400410 FreeBSD/i386 pure | |
| 3233 | >20 lelong <4096 | |
| 3234 | >>3 byte&0xC0 &0x80 shared library | |
| 3235 | >>3 byte&0xC0 0x40 PIC object | |
| 3236 | >>3 byte&0xC0 0x00 object | |
| 3237 | >20 lelong >4095 | |
| 3238 | >>3 byte&0x80 0x80 dynamically linked executable | |
| 3239 | >>3 byte&0x80 0x00 executable | |
| 3240 | >16 lelong >0 not stripped | |
| 3241 | ||
| 3242 | 0 lelong&0377777777 041400413 FreeBSD/i386 demand paged | |
| 3243 | >20 lelong <4096 | |
| 3244 | >>3 byte&0xC0 &0x80 shared library | |
| 3245 | >>3 byte&0xC0 0x40 PIC object | |
| 3246 | >>3 byte&0xC0 0x00 object | |
| 3247 | >20 lelong >4095 | |
| 3248 | >>3 byte&0x80 0x80 dynamically linked executable | |
| 3249 | >>3 byte&0x80 0x00 executable | |
| 3250 | >16 lelong >0 not stripped | |
| 3251 | ||
| 3252 | 0 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged | |
| 3253 | >20 lelong <4096 | |
| 3254 | >>3 byte&0xC0 &0x80 shared library | |
| 3255 | >>3 byte&0xC0 0x40 PIC object | |
| 3256 | >>3 byte&0xC0 0x00 object | |
| 3257 | >20 lelong >4095 | |
| 3258 | >>3 byte&0x80 0x80 dynamically linked executable | |
| 3259 | >>3 byte&0x80 0x00 executable | |
| 3260 | >16 lelong >0 not stripped | |
| 3261 | ||
| 3262 | # XXX gross hack to identify core files | |
| 3263 | # cores start with a struct tss; we take advantage of the following: | |
| 3264 | # byte 7: highest byte of the kernel stack pointer, always 0xfe | |
| 3265 | # 8/9: kernel (ring 0) ss value, always 0x0010 | |
| 3266 | # 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0 | |
| 3267 | # 28: low order byte of the current PTD entry, always 0 since the | |
| 3268 | # PTD is page-aligned | |
| 3269 | # | |
| 3270 | 7 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file | |
| 3271 | >1039 string >\0 from '%s' | |
| 3272 | ||
| 3273 | # /var/run/ld.so.hints | |
| 3274 | # What are you laughing about? | |
| 3275 | 0 lelong 011421044151 ld.so hints file (Little Endian | |
| 3276 | >4 lelong >0 \b, version %d) | |
| 3277 | >4 belong <=0 \b) | |
| 3278 | 0 belong 011421044151 ld.so hints file (Big Endian | |
| 3279 | >4 belong >0 \b, version %d) | |
| 3280 | >4 belong <=0 \b) | |
| 3281 | ||
| 3282 | # | |
| 3283 | # Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities | |
| 3284 | # | |
| 3285 | 0 string SCRSHOT_ scrshot(1) screenshot, | |
| 3286 | >8 byte x version %d, | |
| 3287 | >9 byte 2 %d bytes in header, | |
| 3288 | >>10 byte x %d chars wide by | |
| 3289 | >>11 byte x %d chars high | |
| 3290 | ||
| 3291 | #------------------------------------------------------------------------------ | |
| 3292 | # gcc: file(1) magic for GCC special files | |
| 3293 | # | |
| 3294 | 0 string gpch GCC precompiled header | |
| 3295 | ||
| 3296 | # The version field is annoying. It's 3 characters, not zero-terminated. | |
| 3297 | >5 byte x (version %c | |
| 3298 | >6 byte x \b%c | |
| 3299 | >7 byte x \b%c) | |
| 3300 | ||
| 3301 | # 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O' | |
| 3302 | >4 byte 67 for C | |
| 3303 | >4 byte 111 for Objective C | |
| 3304 | >4 byte 43 for C++ | |
| 3305 | >4 byte 79 for Objective C++ | |
| 3306 | ||
| 3307 | #----------------------------------------------------------------------------- | |
| 3308 | # natinst: file(1) magic for National Instruments Code Files | |
| 3309 | ||
| 3310 | # | |
| 3311 | # From <egamez@fcfm.buap.mx> Enrique Gámez-Flores | |
| 3312 | # version 1 | |
| 3313 | # Many formats still missing, we use, for the moment LabVIEW | |
| 3314 | # We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing | |
| 3315 | # | |
| 3316 | 0 string RSRC National Instruments, | |
| 3317 | # Check if it's a LabVIEW File | |
| 3318 | >8 string LV LabVIEW File, | |
| 3319 | # Check wich kind of file is | |
| 3320 | >>10 string SB Code Resource File, data | |
| 3321 | >>10 string IN Virtual Instrument Program, data | |
| 3322 | >>10 string AR VI Library, data | |
| 3323 | # This is for Menu Libraries | |
| 3324 | >8 string LMNULBVW Portable File Names, data | |
| 3325 | # This is for General Resources | |
| 3326 | >8 string rsc Resources File, data | |
| 3327 | # This is for VXI Package | |
| 3328 | 0 string VMAP National Instruments, VXI File, data | |
| 3329 | #------------------------------------------------------------------------------ | |
| 3330 | # nitpicker: file(1) magic for Flowfiles. | |
| 3331 | # From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de | |
| 3332 | 0 string NPFF NItpicker Flow File | |
| 3333 | >4 byte x V%d. | |
| 3334 | >5 byte x %d | |
| 3335 | >6 bedate x started: %s | |
| 3336 | >10 bedate x stopped: %s | |
| 3337 | >14 belong x Bytes: %u | |
| 3338 | >18 belong x Bytes1: %u | |
| 3339 | >22 belong x Flows: %u | |
| 3340 | >26 belong x Pkts: %u | |
| 3341 | ||
| 3342 | #------------------------------------------------------------------------------ | |
| 3343 | # typeset: file(1) magic for other typesetting | |
| 3344 | # | |
| 3345 | 0 string Interpress/Xerox Xerox InterPress data | |
| 3346 | >16 string / (version | |
| 3347 | >>17 string >\0 %s) | |
| 3348 | ||
| 3349 | #------------------------------------------------------------------------------ | |
| 3350 | # commands: file(1) magic for various shells and interpreters | |
| 3351 | # | |
| 3352 | 0 string : shell archive or script for antique kernel text | |
| 3353 | 0 string/b #!\ /bin/sh Bourne shell script text executable | |
| 3354 | 0 string/b #!\ /bin/csh C shell script text executable | |
| 3355 | # korn shell magic, sent by George Wu, gwu@clyde.att.com | |
| 3356 | 0 string/b #!\ /bin/ksh Korn shell script text executable | |
| 3357 | 0 string/b #!\ /bin/tcsh Tenex C shell script text executable | |
| 3358 | 0 string/b #!\ /usr/local/tcsh Tenex C shell script text executable | |
| 3359 | 0 string/b #!\ /usr/local/bin/tcsh Tenex C shell script text executable | |
| 3360 | ||
| 3361 | # | |
| 3362 | # zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson) | |
| 3363 | 0 string/b #!\ /bin/zsh Paul Falstad's zsh script text executable | |
| 3364 | 0 string/b #!\ /usr/bin/zsh Paul Falstad's zsh script text executable | |
| 3365 | 0 string/b #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable | |
| 3366 | 0 string/b #!\ /usr/local/bin/ash Neil Brown's ash script text executable | |
| 3367 | 0 string/b #!\ /usr/local/bin/ae Neil Brown's ae script text executable | |
| 3368 | 0 string/b #!\ /bin/nawk new awk script text executable | |
| 3369 | 0 string/b #!\ /usr/bin/nawk new awk script text executable | |
| 3370 | 0 string/b #!\ /usr/local/bin/nawk new awk script text executable | |
| 3371 | 0 string/b #!\ /bin/gawk GNU awk script text executable | |
| 3372 | 0 string/b #!\ /usr/bin/gawk GNU awk script text executable | |
| 3373 | 0 string/b #!\ /usr/local/bin/gawk GNU awk script text executable | |
| 3374 | # | |
| 3375 | 0 string/b #!\ /bin/awk awk script text executable | |
| 3376 | 0 string/b #!\ /usr/bin/awk awk script text executable | |
| 3377 | 0 string BEGIN awk script text | |
| 3378 | ||
| 3379 | # AT&T Bell Labs' Plan 9 shell | |
| 3380 | 0 string/b #!\ /bin/rc Plan 9 rc shell script text executable | |
| 3381 | ||
| 3382 | # bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) | |
| 3383 | 0 string/b #!\ /bin/bash Bourne-Again shell script text executable | |
| 3384 | 0 string/b #!\ /usr/local/bin/bash Bourne-Again shell script text executable | |
| 3385 | ||
| 3386 | # using env | |
| 3387 | 0 string #!/usr/bin/env a | |
| 3388 | >15 string >\0 %s script text executable | |
| 3389 | 0 string #!\ /usr/bin/env a | |
| 3390 | >16 string >\0 %s script text executable | |
| 3391 | ||
| 3392 | # PHP scripts | |
| 3393 | # Ulf Harnhammar <ulfh@update.uu.se> | |
| 3394 | 0 string/c =<?php PHP script text | |
| 3395 | 0 string =<?\n PHP script text | |
| 3396 | 0 string =<?\r PHP script text | |
| 3397 | 0 string/b #!\ /usr/local/bin/php PHP script text executable | |
| 3398 | 0 string/b #!\ /usr/bin/php PHP script text executable | |
| 3399 | ||
| 3400 | 0 string Zend\x00 PHP script Zend Optimizer data | |
| 3401 | ||
| 3402 | #------------------------------------------------------------------------------ | |
| 3403 | # encore: file(1) magic for Encore machines | |
| 3404 | # | |
| 3405 | # XXX - needs to have the byte order specified (NS32K was little-endian, | |
| 3406 | # dunno whether they run the 88K in little-endian mode or not). | |
| 3407 | # | |
| 3408 | 0 short 0x154 Encore | |
| 3409 | >20 short 0x107 executable | |
| 3410 | >20 short 0x108 pure executable | |
| 3411 | >20 short 0x10b demand-paged executable | |
| 3412 | >20 short 0x10f unsupported executable | |
| 3413 | >12 long >0 not stripped | |
| 3414 | >22 short >0 - version %ld | |
| 3415 | >22 short 0 - | |
| 3416 | #>4 date x stamp %s | |
| 3417 | 0 short 0x155 Encore unsupported executable | |
| 3418 | >12 long >0 not stripped | |
| 3419 | >22 short >0 - version %ld | |
| 3420 | >22 short 0 - | |
| 3421 | #>4 date x stamp %s | |
| 3422 | ||
| 3423 | #------------------------------------------------------------------------------ | |
| 3424 | # filesystems: file(1) magic for different filesystems | |
| 3425 | # | |
| 3426 | 0 string \366\366\366\366 PC formatted floppy with no filesystem | |
| 3427 | # Sun disk labels | |
| 3428 | # From /usr/include/sun/dklabel.h: | |
| 3429 | 0774 beshort 0xdabe Sun disk label | |
| 3430 | >0 string x '%s | |
| 3431 | >>31 string >\0 \b%s | |
| 3432 | >>>63 string >\0 \b%s | |
| 3433 | >>>>95 string >\0 \b%s | |
| 3434 | >0 string x \b' | |
| 3435 | >0734 short >0 %d rpm, | |
| 3436 | >0736 short >0 %d phys cys, | |
| 3437 | >0740 short >0 %d alts/cyl, | |
| 3438 | >0746 short >0 %d interleave, | |
| 3439 | >0750 short >0 %d data cyls, | |
| 3440 | >0752 short >0 %d alt cyls, | |
| 3441 | >0754 short >0 %d heads/partition, | |
| 3442 | >0756 short >0 %d sectors/track, | |
| 3443 | >0764 long >0 start cyl %ld, | |
| 3444 | >0770 long x %ld blocks | |
| 3445 | # Is there a boot block written 1 sector in? | |
| 3446 | >512 belong&077777777 0600407 \b, boot block present | |
| 3447 | 0x1FE leshort 0xAA55 x86 boot sector | |
| 3448 | >2 string OSBS \b, OS/BS MBR | |
| 3449 | # J\xf6rg Jenderek <joerg.jenderek@gmx.net> | |
| 3450 | >0x8C string Invalid\ partition\ table \b, MS-DOS MBR | |
| 3451 | >0x9D string Invalid\ partition\ table \b, DR-DOS MBR, version 7.01 to 7.03 | |
| 3452 | >0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222 | |
| 3453 | >0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950 | |
| 3454 | >0x145 string Default:\ F \b, FREE-DOS MBR | |
| 3455 | >0 string \0\0\0\0 \b, extended partition table | |
| 3456 | # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 | |
| 3457 | # older drives may use E9 xx xx | |
| 3458 | >0 lelong&0x009000EB 0x009000EB | |
| 3459 | >0 lelong&0x000000E9 0x000000E9 | |
| 3460 | >>1 ubyte >37 \b, code offset 0x%x | |
| 3461 | # mtools-3.9.8/msdos.h | |
| 3462 | # usual values are marked with comments to get only informations of strange FAT systems | |
| 3463 | # valid sectorsize are from 32 to 2048 | |
| 3464 | >>>11 uleshort <2049 | |
| 3465 | >>>>11 uleshort >31 | |
| 3466 | >>>>>3 string >\0 \b, OEM-ID "%8.8s" | |
| 3467 | >>>>>11 uleshort >512 \b, Bytes/sector %u | |
| 3468 | #>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) | |
| 3469 | >>>>>11 uleshort <512 \b, Bytes/sector %u | |
| 3470 | >>>>>13 ubyte >1 \b, sectors/cluster %u | |
| 3471 | #>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) | |
| 3472 | >>>>>14 uleshort >32 \b, reserved sectors %u | |
| 3473 | #>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) | |
| 3474 | #>>>>>14 uleshort >1 \b, reserved sectors %u | |
| 3475 | #>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) | |
| 3476 | >>>>>14 uleshort <1 \b, reserved sectors %u | |
| 3477 | >>>>>16 ubyte >2 \b, FATs %u | |
| 3478 | #>>>>>16 ubyte =2 \b, FATs %u (usual) | |
| 3479 | >>>>>16 ubyte =1 \b, FAT %u | |
| 3480 | >>>>>16 ubyte >0 | |
| 3481 | >>>>>17 uleshort >0 \b, root entries %u | |
| 3482 | #>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32) | |
| 3483 | >>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) | |
| 3484 | #>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32) | |
| 3485 | >>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x | |
| 3486 | #>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) | |
| 3487 | >>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x | |
| 3488 | >>>>>22 uleshort >0 \b, sectors/FAT %u | |
| 3489 | #>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32) | |
| 3490 | >>>>>26 ubyte >2 \b, heads %u | |
| 3491 | #>>>>>26 ubyte =2 \b, heads %u (usual floppy) | |
| 3492 | >>>>>26 ubyte =1 \b, heads %u | |
| 3493 | >>>>>28 ulelong >0 \b, hidden sectors %u | |
| 3494 | #>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) | |
| 3495 | >>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) | |
| 3496 | #>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) | |
| 3497 | # FAT<32 specific | |
| 3498 | # NOT le FAT3=NOT 3TAF=0xCCABBEB9 | |
| 3499 | >>>>>82 ulelong&0xCCABBEB9 >0 | |
| 3500 | >>>>>>36 ubyte >0x80 \b, physical drive 0x%x | |
| 3501 | #>>>>>>36 ubyte =0x80 \b, physical drive 0x%x=0x80 (usual harddisk) | |
| 3502 | >>>>>>36 ubyte&0x7F >0 \b, physical drive 0x%x | |
| 3503 | #>>>>>>36 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) | |
| 3504 | >>>>>>37 ubyte >0 \b, reserved 0x%x | |
| 3505 | #>>>>>>37 ubyte =0 \b, reserved 0x%x | |
| 3506 | >>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) | |
| 3507 | >>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) | |
| 3508 | >>>>>>38 ubyte =0x29 | |
| 3509 | >>>>>>>39 ulelong x \b, serial number 0x%x | |
| 3510 | >>>>>>>43 string <NO\ NAME \b, label: "%11.11s" | |
| 3511 | >>>>>>>43 string >NO\ NAME \b, label: "%11.11s" | |
| 3512 | >>>>>>>43 string =NO\ NAME \b, unlabeled | |
| 3513 | >>>>>>54 string FAT1 \b, FAT | |
| 3514 | >>>>>>>54 string FAT12 \b (12 bit) | |
| 3515 | >>>>>>>54 string FAT16 \b (16 bit) | |
| 3516 | # FAT32 specific | |
| 3517 | >>>>>82 string FAT32 \b, FAT (32 bit) | |
| 3518 | >>>>>>36 ulelong x \b, sectors/FAT %u | |
| 3519 | >>>>>>40 uleshort >0 \b, extension flags %u | |
| 3520 | #>>>>>>40 uleshort =0 \b, extension flags %u | |
| 3521 | >>>>>>42 uleshort >0 \b, fsVersion %u | |
| 3522 | #>>>>>>42 uleshort =0 \b, fsVersion %u (usual) | |
| 3523 | >>>>>>44 ulelong >2 \b, rootdir cluster %u | |
| 3524 | #>>>>>>44 ulelong =2 \b, rootdir cluster %u | |
| 3525 | #>>>>>>44 ulelong =1 \b, rootdir cluster %u | |
| 3526 | >>>>>>48 uleshort >1 \b, infoSector %u | |
| 3527 | #>>>>>>48 uleshort =1 \b, infoSector %u (usual) | |
| 3528 | >>>>>>48 uleshort <1 \b, infoSector %u | |
| 3529 | >>>>>>50 uleshort >6 \b, Backup boot sector %u | |
| 3530 | #>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) | |
| 3531 | >>>>>>50 uleshort <6 \b, Backup boot sector %u | |
| 3532 | >>>>>>54 ulelong >0 \b, reserved1 0x%x | |
| 3533 | >>>>>>58 ulelong >0 \b, reserved2 0x%x | |
| 3534 | >>>>>>62 ulelong >0 \b, reserved3 0x%x | |
| 3535 | # same structure as FAT1X | |
| 3536 | >>>>>>64 ubyte >0x80 \b, physical drive 0x%x | |
| 3537 | #>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) | |
| 3538 | >>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x | |
| 3539 | #>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) | |
| 3540 | >>>>>>65 ubyte >0 \b, reserved 0x%x | |
| 3541 | >>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) | |
| 3542 | >>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) | |
| 3543 | >>>>>>66 ubyte =0x29 | |
| 3544 | >>>>>>>67 ulelong x \b, serial number 0x%x | |
| 3545 | >>>>>>>71 string <NO\ NAME \b, label: "%11.11s" | |
| 3546 | >>>>>>71 string >NO\ NAME \b, label: "%11.11s" | |
| 3547 | >>>>>>71 string =NO\ NAME \b, unlabeled | |
| 3548 | ### FATs end | |
| 3549 | >0x200 lelong 0x82564557 \b, BSD disklabel | |
| 3550 | # FATX | |
| 3551 | 0 string FATX FATX filesystem data | |
| 3552 | ||
| 3553 | ||
| 3554 | # Minix filesystems - Juan Cespedes <cespedes@debian.org> | |
| 3555 | 0x410 leshort 0x137f Minix filesystem | |
| 3556 | 0x410 beshort 0x137f Minix filesystem (big endian), | |
| 3557 | >0x402 beshort !0 \b, %d zones | |
| 3558 | >0x1e string minix \b, bootable | |
| 3559 | 0x410 leshort 0x138f Minix filesystem, 30 char names | |
| 3560 | 0x410 leshort 0x2468 Minix filesystem, version 2 | |
| 3561 | 0x410 leshort 0x2478 Minix filesystem, version 2, 30 char names | |
| 3562 | ||
| 3563 | # romfs filesystems - Juan Cespedes <cespedes@debian.org> | |
| 3564 | 0 string -rom1fs-\0 romfs filesystem, version 1 | |
| 3565 | >8 belong x %d bytes, | |
| 3566 | >16 string x named %s. | |
| 3567 | ||
| 3568 | # netboot image - Juan Cespedes <cespedes@debian.org> | |
| 3569 | 0 lelong 0x1b031336L Netboot image, | |
| 3570 | >4 lelong&0xFFFFFF00 0 | |
| 3571 | >>4 lelong&0x100 0x000 mode 2 | |
| 3572 | >>4 lelong&0x100 0x100 mode 3 | |
| 3573 | >4 lelong&0xFFFFFF00 !0 unknown mode | |
| 3574 | ||
| 3575 | 0x18b string OS/2 OS/2 Boot Manager | |
| 3576 | ||
| 3577 | 9564 lelong 0x00011954 Unix Fast File system (little-endian), | |
| 3578 | >8404 string x last mounted on %s, | |
| 3579 | #>9504 ledate x last checked at %s, | |
| 3580 | >8224 ledate x last written at %s, | |
| 3581 | >8401 byte x clean flag %d, | |
| 3582 | >8228 lelong x number of blocks %d, | |
| 3583 | >8232 lelong x number of data blocks %d, | |
| 3584 | >8236 lelong x number of cylinder groups %d, | |
| 3585 | >8240 lelong x block size %d, | |
| 3586 | >8244 lelong x fragment size %d, | |
| 3587 | >8252 lelong x minimum percentage of free blocks %d, | |
| 3588 | >8256 lelong x rotational delay %dms, | |
| 3589 | >8260 lelong x disk rotational speed %drps, | |
| 3590 | >8320 lelong 0 TIME optimization | |
| 3591 | >8320 lelong 1 SPACE optimization | |
| 3592 | ||
| 3593 | 9564 belong 0x00011954 Unix Fast File system (big-endian), | |
| 3594 | >7168 long 0x4c41424c Apple UFS Volume | |
| 3595 | >>7186 string x named %s, | |
| 3596 | >>7176 belong x volume label version %d, | |
| 3597 | >>7180 bedate x created on %s, | |
| 3598 | >8404 string x last mounted on %s, | |
| 3599 | #>9504 bedate x last checked at %s, | |
| 3600 | >8224 bedate x last written at %s, | |
| 3601 | >8401 byte x clean flag %d, | |
| 3602 | >8228 belong x number of blocks %d, | |
| 3603 | >8232 belong x number of data blocks %d, | |
| 3604 | >8236 belong x number of cylinder groups %d, | |
| 3605 | >8240 belong x block size %d, | |
| 3606 | >8244 belong x fragment size %d, | |
| 3607 | >8252 belong x minimum percentage of free blocks %d, | |
| 3608 | >8256 belong x rotational delay %dms, | |
| 3609 | >8260 belong x disk rotational speed %drps, | |
| 3610 | >8320 belong 0 TIME optimization | |
| 3611 | >8320 belong 1 SPACE optimization | |
| 3612 | ||
| 3613 | # ext2/ext3 filesystems - Andreas Dilger <adilger@turbolabs.com> | |
| 3614 | 0x438 leshort 0xEF53 Linux | |
| 3615 | >0x44c lelong x rev %d | |
| 3616 | >0x43e leshort x \b.%d | |
| 3617 | >0x45c lelong ^0x0000004 ext2 filesystem data | |
| 3618 | >>0x43a leshort ^0x0000001 (mounted or unclean) | |
| 3619 | >0x45c lelong &0x0000004 ext3 filesystem data | |
| 3620 | >>0x460 lelong &0x0000004 (needs journal recovery) | |
| 3621 | >0x43a leshort &0x0000002 (errors) | |
| 3622 | >0x460 lelong &0x0000001 (compressed) | |
| 3623 | #>0x460 lelong &0x0000002 (filetype) | |
| 3624 | #>0x464 lelong &0x0000001 (sparse_super) | |
| 3625 | >0x464 lelong &0x0000002 (large files) | |
| 3626 | ||
| 3627 | # SGI disk labels - Nathan Scott <nathans@debian.org> | |
| 3628 | 0 belong 0x0BE5A941 SGI disk label (volume header) | |
| 3629 | ||
| 3630 | # SGI XFS filesystem - Nathan Scott <nathans@debian.org> | |
| 3631 | 0 belong 0x58465342 SGI XFS filesystem data | |
| 3632 | >0x4 belong x (blksz %d, | |
| 3633 | >0x68 beshort x inosz %d, | |
| 3634 | >0x64 beshort ^0x2004 v1 dirs) | |
| 3635 | >0x64 beshort &0x2004 v2 dirs) | |
| 3636 | ||
| 3637 | ############################################################################ | |
| 3638 | # Minix-ST kernel floppy | |
| 3639 | 0x800 belong 0x46fc2700 Atari-ST Minix kernel image | |
| 3640 | >19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy | |
| 3641 | >19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy | |
| 3642 | ||
| 3643 | ############################################################################ | |
| 3644 | # Hmmm, is this a better way of detecting _standard_ floppy images ? | |
| 3645 | 19 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k | |
| 3646 | >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector | |
| 3647 | 19 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k | |
| 3648 | >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector | |
| 3649 | 19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k | |
| 3650 | >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector | |
| 3651 | ||
| 3652 | 19 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM | |
| 3653 | >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector | |
| 3654 | 19 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs | |
| 3655 | >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector | |
| 3656 | ||
| 3657 | 19 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k | |
| 3658 | 19 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k | |
| 3659 | ||
| 3660 | # Valid media descriptor bytes for MS-DOS: | |
| 3661 | # | |
| 3662 | # Byte Capacity Media Size and Type | |
| 3663 | # ------------------------------------------------- | |
| 3664 | # | |
| 3665 | # F0 2.88 MB 3.5-inch, 2-sided, 36-sector | |
| 3666 | # F0 1.44 MB 3.5-inch, 2-sided, 18-sector | |
| 3667 | # F9 720K 3.5-inch, 2-sided, 9-sector | |
| 3668 | # F9 1.2 MB 5.25-inch, 2-sided, 15-sector | |
| 3669 | # FD 360K 5.25-inch, 2-sided, 9-sector | |
| 3670 | # FF 320K 5.25-inch, 2-sided, 8-sector | |
| 3671 | # FC 180K 5.25-inch, 1-sided, 9-sector | |
| 3672 | # FE 160K 5.25-inch, 1-sided, 8-sector | |
| 3673 | # FE 250K 8-inch, 1-sided, single-density | |
| 3674 | # FD 500K 8-inch, 2-sided, single-density | |
| 3675 | # FE 1.2 MB 8-inch, 2-sided, double-density | |
| 3676 | # F8 ----- Fixed disk | |
| 3677 | # | |
| 3678 | # FC xxxK Apricot 70x1x9 boot disk. | |
| 3679 | # | |
| 3680 | # Originally a bitmap: | |
| 3681 | # xxxxxxx0 Not two sided | |
| 3682 | # xxxxxxx1 Double sided | |
| 3683 | # xxxxxx0x Not 8 SPT | |
| 3684 | # xxxxxx1x 8 SPT | |
| 3685 | # xxxxx0xx Not Removable drive | |
| 3686 | # xxxxx1xx Removable drive | |
| 3687 | # 11111xxx Must be one. | |
| 3688 | # | |
| 3689 | # But now it's rather random: | |
| 3690 | # 111111xx Low density disk | |
| 3691 | # 00 SS, Not 8 SPT | |
| 3692 | # 01 DS, Not 8 SPT | |
| 3693 | # 10 SS, 8 SPT | |
| 3694 | # 11 DS, 8 SPT | |
| 3695 | # | |
| 3696 | # 11111001 Double density 3½ floppy disk, high density 5¼ | |
| 3697 | # 11110000 High density 3½ floppy disk | |
| 3698 | # 11111000 Hard disk any format | |
| 3699 | # | |
| 3700 | ||
| 3701 | # CDROM Filesystems | |
| 3702 | 32769 string CD001 ISO 9660 CD-ROM filesystem data | |
| 3703 | # "application id" which appears to be used as a volume label | |
| 3704 | >32808 string >\0 '%s' | |
| 3705 | >34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) | |
| 3706 | 37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) | |
| 3707 | 32776 string CDROM High Sierra CD-ROM filesystem data | |
| 3708 | ||
| 3709 | # cramfs filesystem - russell@coker.com.au | |
| 3710 | 0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian | |
| 3711 | >4 lelong x size %d | |
| 3712 | >8 lelong &1 version #2 | |
| 3713 | >8 lelong &2 sorted_dirs | |
| 3714 | >8 lelong &4 hole_support | |
| 3715 | >32 lelong x CRC 0x%x, | |
| 3716 | >36 lelong x edition %d, | |
| 3717 | >40 lelong x %d blocks, | |
| 3718 | >44 lelong x %d files | |
| 3719 | ||
| 3720 | 0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian | |
| 3721 | >4 belong x size %d | |
| 3722 | >8 belong &1 version #2 | |
| 3723 | >8 belong &2 sorted_dirs | |
| 3724 | >8 belong &4 hole_support | |
| 3725 | >32 belong x CRC 0x%x, | |
| 3726 | >36 belong x edition %d, | |
| 3727 | >40 belong x %d blocks, | |
| 3728 | >44 belong x %d files | |
| 3729 | ||
| 3730 | # reiserfs - russell@coker.com.au | |
| 3731 | 0x10034 string ReIsErFs ReiserFS V3.5 | |
| 3732 | 0x10034 string ReIsEr2Fs ReiserFS V3.6 | |
| 3733 | >0x1002c leshort x block size %d | |
| 3734 | >0x10032 leshort &2 (mounted or unclean) | |
| 3735 | >0x10000 lelong x num blocks %d | |
| 3736 | >0x10040 lelong 1 tea hash | |
| 3737 | >0x10040 lelong 2 yura hash | |
| 3738 | >0x10040 lelong 3 r5 hash | |
| 3739 | ||
| 3740 | # JFFS - russell@coker.com.au | |
| 3741 | 0 lelong 0x34383931 Linux Journalled Flash File system, little endian | |
| 3742 | 0 belong 0x34383931 Linux Journalled Flash File system, big endian | |
| 3743 | ||
| 3744 | # EST flat binary format (which isn't, but anyway) | |
| 3745 | # From: Mark Brown <broonie@sirena.org.uk> | |
| 3746 | 0 string ESTFBINR EST flat binary | |
| 3747 | ||
| 3748 | # Aculab VoIP firmware | |
| 3749 | # From: Mark Brown <broonie@sirena.org.uk> | |
| 3750 | 0 string VoIP\ Startup\ and Aculab VoIP firmware | |
| 3751 | >35 string x format %s | |
| 3752 | ||
| 3753 | # PPCBoot image file | |
| 3754 | # From: Mark Brown <broonie@sirena.org.uk> | |
| 3755 | 0 belong 0x27051956 PPCBoot image | |
| 3756 | >4 string PPCBoot | |
| 3757 | >>12 string x version %s | |
| 3758 | ||
| 3759 | # JFFS2 file system | |
| 3760 | 0 leshort 0x1984 Linux old jffs2 filesystem data little endian | |
| 3761 | 0 lelong 0xe0011985 Linux jffs2 filesystem data little endian | |
| 3762 | ||
| 3763 | #------------------------------------------------------------------------------ | |
| 3764 | # hp: file(1) magic for Hewlett Packard machines (see also "printer") | |
| 3765 | # | |
| 3766 | # XXX - somebody should figure out whether any byte order needs to be | |
| 3767 | # applied to the "TML" stuff; I'm assuming the Apollo stuff is | |
| 3768 | # big-endian as it was mostly 68K-based. | |
| 3769 | # | |
| 3770 | # I think the 500 series was the old stack-based machines, running a | |
| 3771 | # UNIX environment atop the "SUN kernel"; dunno whether it was | |
| 3772 | # big-endian or little-endian. | |
| 3773 | # | |
| 3774 | # Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based; | |
| 3775 | # hp300 are 68020+68881 based; hp400 are also 68k. The following basic | |
| 3776 | # HP magic is useful for reference, but using "long" magic is a better | |
| 3777 | # practice in order to avoid collisions. | |
| 3778 | # | |
| 3779 | # Guy Harris (guy@netapp.com): some additions to this list came from | |
| 3780 | # HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1, | |
| 3781 | # 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0 | |
| 3782 | # "/etc/magic", though, except for the "archive file relocatable library" | |
| 3783 | # stuff, and the 68030 and 68040 stuff isn't there at all - are they not | |
| 3784 | # used in executables, or have they just not yet updated "/etc/magic" | |
| 3785 | # completely? | |
| 3786 | # | |
| 3787 | # 0 beshort 200 hp200 (68010) BSD binary | |
| 3788 | # 0 beshort 300 hp300 (68020+68881) BSD binary | |
| 3789 | # 0 beshort 0x20c hp200/300 HP-UX binary | |
| 3790 | # 0 beshort 0x20d hp400 (68030) HP-UX binary | |
| 3791 | # 0 beshort 0x20e hp400 (68040?) HP-UX binary | |
| 3792 | # 0 beshort 0x20b PA-RISC1.0 HP-UX binary | |
| 3793 | # 0 beshort 0x210 PA-RISC1.1 HP-UX binary | |
| 3794 | # 0 beshort 0x211 PA-RISC1.2 HP-UX binary | |
| 3795 | # 0 beshort 0x214 PA-RISC2.0 HP-UX binary | |
| 3796 | ||
| 3797 | # | |
| 3798 | # The "misc" stuff needs a byte order; the archives look suspiciously | |
| 3799 | # like the old 177545 archives (0xff65 = 0177545). | |
| 3800 | # | |
| 3801 | #### Old Apollo stuff | |
| 3802 | 0 beshort 0627 Apollo m68k COFF executable | |
| 3803 | >18 beshort ^040000 not stripped | |
| 3804 | >22 beshort >0 - version %ld | |
| 3805 | 0 beshort 0624 apollo a88k COFF executable | |
| 3806 | >18 beshort ^040000 not stripped | |
| 3807 | >22 beshort >0 - version %ld | |
| 3808 | 0 long 01203604016 TML 0123 byte-order format | |
| 3809 | 0 long 01702407010 TML 1032 byte-order format | |
| 3810 | 0 long 01003405017 TML 2301 byte-order format | |
| 3811 | 0 long 01602007412 TML 3210 byte-order format | |
| 3812 | #### PA-RISC 1.1 | |
| 3813 | 0 belong 0x02100106 PA-RISC1.1 relocatable object | |
| 3814 | 0 belong 0x02100107 PA-RISC1.1 executable | |
| 3815 | >168 belong &0x00000004 dynamically linked | |
| 3816 | >(144) belong 0x054ef630 dynamically linked | |
| 3817 | >96 belong >0 - not stripped | |
| 3818 | ||
| 3819 | 0 belong 0x02100108 PA-RISC1.1 shared executable | |
| 3820 | >168 belong&0x4 0x4 dynamically linked | |
| 3821 | >(144) belong 0x054ef630 dynamically linked | |
| 3822 | >96 belong >0 - not stripped | |
| 3823 | ||
| 3824 | 0 belong 0x0210010b PA-RISC1.1 demand-load executable | |
| 3825 | >168 belong&0x4 0x4 dynamically linked | |
| 3826 | >(144) belong 0x054ef630 dynamically linked | |
| 3827 | >96 belong >0 - not stripped | |
| 3828 | ||
| 3829 | 0 belong 0x0210010e PA-RISC1.1 shared library | |
| 3830 | >96 belong >0 - not stripped | |
| 3831 | ||
| 3832 | 0 belong 0x0210010d PA-RISC1.1 dynamic load library | |
| 3833 | >96 belong >0 - not stripped | |
| 3834 | ||
| 3835 | #### PA-RISC 2.0 | |
| 3836 | 0 belong 0x02140106 PA-RISC2.0 relocatable object | |
| 3837 | ||
| 3838 | 0 belong 0x02140107 PA-RISC2.0 executable | |
| 3839 | >168 belong &0x00000004 dynamically linked | |
| 3840 | >(144) belong 0x054ef630 dynamically linked | |
| 3841 | >96 belong >0 - not stripped | |
| 3842 | ||
| 3843 | 0 belong 0x02140108 PA-RISC2.0 shared executable | |
| 3844 | >168 belong &0x00000004 dynamically linked | |
| 3845 | >(144) belong 0x054ef630 dynamically linked | |
| 3846 | >96 belong >0 - not stripped | |
| 3847 | ||
| 3848 | 0 belong 0x0214010b PA-RISC2.0 demand-load executable | |
| 3849 | >168 belong &0x00000004 dynamically linked | |
| 3850 | >(144) belong 0x054ef630 dynamically linked | |
| 3851 | >96 belong >0 - not stripped | |
| 3852 | ||
| 3853 | 0 belong 0x0214010e PA-RISC2.0 shared library | |
| 3854 | >96 belong >0 - not stripped | |
| 3855 | ||
| 3856 | 0 belong 0x0214010d PA-RISC2.0 dynamic load library | |
| 3857 | >96 belong >0 - not stripped | |
| 3858 | ||
| 3859 | #### 800 | |
| 3860 | 0 belong 0x020b0106 PA-RISC1.0 relocatable object | |
| 3861 | ||
| 3862 | 0 belong 0x020b0107 PA-RISC1.0 executable | |
| 3863 | >168 belong&0x4 0x4 dynamically linked | |
| 3864 | >(144) belong 0x054ef630 dynamically linked | |
| 3865 | >96 belong >0 - not stripped | |
| 3866 | ||
| 3867 | 0 belong 0x020b0108 PA-RISC1.0 shared executable | |
| 3868 | >168 belong&0x4 0x4 dynamically linked | |
| 3869 | >(144) belong 0x054ef630 dynamically linked | |
| 3870 | >96 belong >0 - not stripped | |
| 3871 | ||
| 3872 | 0 belong 0x020b010b PA-RISC1.0 demand-load executable | |
| 3873 | >168 belong&0x4 0x4 dynamically linked | |
| 3874 | >(144) belong 0x054ef630 dynamically linked | |
| 3875 | >96 belong >0 - not stripped | |
| 3876 | ||
| 3877 | 0 belong 0x020b010e PA-RISC1.0 shared library | |
| 3878 | >96 belong >0 - not stripped | |
| 3879 | ||
| 3880 | 0 belong 0x020b010d PA-RISC1.0 dynamic load library | |
| 3881 | >96 belong >0 - not stripped | |
| 3882 | ||
| 3883 | 0 belong 0x213c6172 archive file | |
| 3884 | >68 belong 0x020b0619 - PA-RISC1.0 relocatable library | |
| 3885 | >68 belong 0x02100619 - PA-RISC1.1 relocatable library | |
| 3886 | >68 belong 0x02110619 - PA-RISC1.2 relocatable library | |
| 3887 | >68 belong 0x02140619 - PA-RISC2.0 relocatable library | |
| 3888 | ||
| 3889 | #### 500 | |
| 3890 | 0 long 0x02080106 HP s500 relocatable executable | |
| 3891 | >16 long >0 - version %ld | |
| 3892 | ||
| 3893 | 0 long 0x02080107 HP s500 executable | |
| 3894 | >16 long >0 - version %ld | |
| 3895 | ||
| 3896 | 0 long 0x02080108 HP s500 pure executable | |
| 3897 | >16 long >0 - version %ld | |
| 3898 | ||
| 3899 | #### 200 | |
| 3900 | 0 belong 0x020c0108 HP s200 pure executable | |
| 3901 | >4 beshort >0 - version %ld | |
| 3902 | >8 belong &0x80000000 save fp regs | |
| 3903 | >8 belong &0x40000000 dynamically linked | |
| 3904 | >8 belong &0x20000000 debuggable | |
| 3905 | >36 belong >0 not stripped | |
| 3906 | ||
| 3907 | 0 belong 0x020c0107 HP s200 executable | |
| 3908 | >4 beshort >0 - version %ld | |
| 3909 | >8 belong &0x80000000 save fp regs | |
| 3910 | >8 belong &0x40000000 dynamically linked | |
| 3911 | >8 belong &0x20000000 debuggable | |
| 3912 | >36 belong >0 not stripped | |
| 3913 | ||
| 3914 | 0 belong 0x020c010b HP s200 demand-load executable | |
| 3915 | >4 beshort >0 - version %ld | |
| 3916 | >8 belong &0x80000000 save fp regs | |
| 3917 | >8 belong &0x40000000 dynamically linked | |
| 3918 | >8 belong &0x20000000 debuggable | |
| 3919 | >36 belong >0 not stripped | |
| 3920 | ||
| 3921 | 0 belong 0x020c0106 HP s200 relocatable executable | |
| 3922 | >4 beshort >0 - version %ld | |
| 3923 | >6 beshort >0 - highwater %d | |
| 3924 | >8 belong &0x80000000 save fp regs | |
| 3925 | >8 belong &0x20000000 debuggable | |
| 3926 | >8 belong &0x10000000 PIC | |
| 3927 | ||
| 3928 | 0 belong 0x020a0108 HP s200 (2.x release) pure executable | |
| 3929 | >4 beshort >0 - version %ld | |
| 3930 | >36 belong >0 not stripped | |
| 3931 | ||
| 3932 | 0 belong 0x020a0107 HP s200 (2.x release) executable | |
| 3933 | >4 beshort >0 - version %ld | |
| 3934 | >36 belong >0 not stripped | |
| 3935 | ||
| 3936 | 0 belong 0x020c010e HP s200 shared library | |
| 3937 | >4 beshort >0 - version %ld | |
| 3938 | >6 beshort >0 - highwater %d | |
| 3939 | >36 belong >0 not stripped | |
| 3940 | ||
| 3941 | 0 belong 0x020c010d HP s200 dynamic load library | |
| 3942 | >4 beshort >0 - version %ld | |
| 3943 | >6 beshort >0 - highwater %d | |
| 3944 | >36 belong >0 not stripped | |
| 3945 | ||
| 3946 | #### MISC | |
| 3947 | 0 long 0x0000ff65 HP old archive | |
| 3948 | 0 long 0x020aff65 HP s200 old archive | |
| 3949 | 0 long 0x020cff65 HP s200 old archive | |
| 3950 | 0 long 0x0208ff65 HP s500 old archive | |
| 3951 | ||
| 3952 | 0 long 0x015821a6 HP core file | |
| 3953 | ||
| 3954 | 0 long 0x4da7eee8 HP-WINDOWS font | |
| 3955 | >8 byte >0 - version %ld | |
| 3956 | 0 string Bitmapfile HP Bitmapfile | |
| 3957 | ||
| 3958 | 0 string IMGfile CIS compimg HP Bitmapfile | |
| 3959 | # XXX - see "lif" | |
| 3960 | #0 short 0x8000 lif file | |
| 3961 | 0 long 0x020c010c compiled Lisp | |
| 3962 | ||
| 3963 | 0 string msgcat01 HP NLS message catalog, | |
| 3964 | >8 long >0 %d messages | |
| 3965 | ||
| 3966 | # addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92 | |
| 3967 | 0 string HPHP48- HP48 binary | |
| 3968 | >7 byte >0 - Rev %c | |
| 3969 | >8 beshort 0x1129 (ADR) | |
| 3970 | >8 beshort 0x3329 (REAL) | |
| 3971 | >8 beshort 0x5529 (LREAL) | |
| 3972 | >8 beshort 0x7729 (COMPLX) | |
| 3973 | >8 beshort 0x9d29 (LCOMPLX) | |
| 3974 | >8 beshort 0xbf29 (CHAR) | |
| 3975 | >8 beshort 0xe829 (ARRAY) | |
| 3976 | >8 beshort 0x0a2a (LNKARRAY) | |
| 3977 | >8 beshort 0x2c2a (STRING) | |
| 3978 | >8 beshort 0x4e2a (HXS) | |
| 3979 | >8 beshort 0x742a (LIST) | |
| 3980 | >8 beshort 0x962a (DIR) | |
| 3981 | >8 beshort 0xb82a (ALG) | |
| 3982 | >8 beshort 0xda2a (UNIT) | |
| 3983 | >8 beshort 0xfc2a (TAGGED) | |
| 3984 | >8 beshort 0x1e2b (GROB) | |
| 3985 | >8 beshort 0x402b (LIB) | |
| 3986 | >8 beshort 0x622b (BACKUP) | |
| 3987 | >8 beshort 0x882b (LIBDATA) | |
| 3988 | >8 beshort 0x9d2d (PROG) | |
| 3989 | >8 beshort 0xcc2d (CODE) | |
| 3990 | >8 beshort 0x482e (GNAME) | |
| 3991 | >8 beshort 0x6d2e (LNAME) | |
| 3992 | >8 beshort 0x922e (XLIB) | |
| 3993 | 0 string %%HP: HP48 text | |
| 3994 | >6 string T(0) - T(0) | |
| 3995 | >6 string T(1) - T(1) | |
| 3996 | >6 string T(2) - T(2) | |
| 3997 | >6 string T(3) - T(3) | |
| 3998 | >10 string A(D) A(D) | |
| 3999 | >10 string A(R) A(R) | |
| 4000 | >10 string A(G) A(G) | |
| 4001 | >14 string F(.) F(.); | |
| 4002 | >14 string F(,) F(,); | |
| 4003 | ||
| 4004 | # hpBSD magic numbers | |
| 4005 | 0 beshort 200 hp200 (68010) BSD | |
| 4006 | >2 beshort 0407 impure binary | |
| 4007 | >2 beshort 0410 read-only binary | |
| 4008 | >2 beshort 0413 demand paged binary | |
| 4009 | 0 beshort 300 hp300 (68020+68881) BSD | |
| 4010 | >2 beshort 0407 impure binary | |
| 4011 | >2 beshort 0410 read-only binary | |
| 4012 | >2 beshort 0413 demand paged binary | |
| 4013 | # | |
| 4014 | # From David Gero <dgero@nortelnetworks.com> | |
| 4015 | # HP-UX 10.20 core file format from /usr/include/sys/core.h | |
| 4016 | # Unfortunately, HP-UX uses corehead blocks without specifying the order | |
| 4017 | # There are four we care about: | |
| 4018 | # CORE_KERNEL, which starts with the string "HP-UX" | |
| 4019 | # CORE_EXEC, which contains the name of the command | |
| 4020 | # CORE_PROC, which contains the signal number that caused the core dump | |
| 4021 | # CORE_FORMAT, which contains the version of the core file format (== 1) | |
| 4022 | # The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC | |
| 4023 | # but we include all 6 variations of the order of the first 3, and | |
| 4024 | # assume that PROC will always be last | |
| 4025 | # Order 1: KERNEL, EXEC, FORMAT, PROC | |
| 4026 | 0x10 string HP-UX | |
| 4027 | >0 belong 2 | |
| 4028 | >>0xC belong 0x3C | |
| 4029 | >>>0x4C belong 0x100 | |
| 4030 | >>>>0x58 belong 0x44 | |
| 4031 | >>>>>0xA0 belong 1 | |
| 4032 | >>>>>>0xAC belong 4 | |
| 4033 | >>>>>>>0xB0 belong 1 | |
| 4034 | >>>>>>>>0xB4 belong 4 core file | |
| 4035 | >>>>>>>>>0x90 string >\0 from '%s' | |
| 4036 | >>>>>>>>>0xC4 belong 3 - received SIGQUIT | |
| 4037 | >>>>>>>>>0xC4 belong 4 - received SIGILL | |
| 4038 | >>>>>>>>>0xC4 belong 5 - received SIGTRAP | |
| 4039 | >>>>>>>>>0xC4 belong 6 - received SIGABRT | |
| 4040 | >>>>>>>>>0xC4 belong 7 - received SIGEMT | |
| 4041 | >>>>>>>>>0xC4 belong 8 - received SIGFPE | |
| 4042 | >>>>>>>>>0xC4 belong 10 - received SIGBUS | |
| 4043 | >>>>>>>>>0xC4 belong 11 - received SIGSEGV | |
| 4044 | >>>>>>>>>0xC4 belong 12 - received SIGSYS | |
| 4045 | >>>>>>>>>0xC4 belong 33 - received SIGXCPU | |
| 4046 | >>>>>>>>>0xC4 belong 34 - received SIGXFSZ | |
| 4047 | # Order 2: KERNEL, FORMAT, EXEC, PROC | |
| 4048 | >>>0x4C belong 1 | |
| 4049 | >>>>0x58 belong 4 | |
| 4050 | >>>>>0x5C belong 1 | |
| 4051 | >>>>>>0x60 belong 0x100 | |
| 4052 | >>>>>>>0x6C belong 0x44 | |
| 4053 | >>>>>>>>0xB4 belong 4 core file | |
| 4054 | >>>>>>>>>0xA4 string >\0 from '%s' | |
| 4055 | >>>>>>>>>0xC4 belong 3 - received SIGQUIT | |
| 4056 | >>>>>>>>>0xC4 belong 4 - received SIGILL | |
| 4057 | >>>>>>>>>0xC4 belong 5 - received SIGTRAP | |
| 4058 | >>>>>>>>>0xC4 belong 6 - received SIGABRT | |
| 4059 | >>>>>>>>>0xC4 belong 7 - received SIGEMT | |
| 4060 | >>>>>>>>>0xC4 belong 8 - received SIGFPE | |
| 4061 | >>>>>>>>>0xC4 belong 10 - received SIGBUS | |
| 4062 | >>>>>>>>>0xC4 belong 11 - received SIGSEGV | |
| 4063 | >>>>>>>>>0xC4 belong 12 - received SIGSYS | |
| 4064 | >>>>>>>>>0xC4 belong 33 - received SIGXCPU | |
| 4065 | >>>>>>>>>0xC4 belong 34 - received SIGXFSZ | |
| 4066 | # Order 3: FORMAT, KERNEL, EXEC, PROC | |
| 4067 | 0x24 string HP-UX | |
| 4068 | >0 belong 1 | |
| 4069 | >>0xC belong 4 | |
| 4070 | >>>0x10 belong 1 | |
| 4071 | >>>>0x14 belong 2 | |
| 4072 | >>>>>0x20 belong 0x3C | |
| 4073 | >>>>>>0x60 belong 0x100 | |
| 4074 | >>>>>>>0x6C belong 0x44 | |
| 4075 | >>>>>>>>0xB4 belong 4 core file | |
| 4076 | >>>>>>>>>0xA4 string >\0 from '%s' | |
| 4077 | >>>>>>>>>0xC4 belong 3 - received SIGQUIT | |
| 4078 | >>>>>>>>>0xC4 belong 4 - received SIGILL | |
| 4079 | >>>>>>>>>0xC4 belong 5 - received SIGTRAP | |
| 4080 | >>>>>>>>>0xC4 belong 6 - received SIGABRT | |
| 4081 | >>>>>>>>>0xC4 belong 7 - received SIGEMT | |
| 4082 | >>>>>>>>>0xC4 belong 8 - received SIGFPE | |
| 4083 | >>>>>>>>>0xC4 belong 10 - received SIGBUS | |
| 4084 | >>>>>>>>>0xC4 belong 11 - received SIGSEGV | |
| 4085 | >>>>>>>>>0xC4 belong 12 - received SIGSYS | |
| 4086 | >>>>>>>>>0xC4 belong 33 - received SIGXCPU | |
| 4087 | >>>>>>>>>0xC4 belong 34 - received SIGXFSZ | |
| 4088 | # Order 4: EXEC, KERNEL, FORMAT, PROC | |
| 4089 | 0x64 string HP-UX | |
| 4090 | >0 belong 0x100 | |
| 4091 | >>0xC belong 0x44 | |
| 4092 | >>>0x54 belong 2 | |
| 4093 | >>>>0x60 belong 0x3C | |
| 4094 | >>>>>0xA0 belong 1 | |
| 4095 | >>>>>>0xAC belong 4 | |
| 4096 | >>>>>>>0xB0 belong 1 | |
| 4097 | >>>>>>>>0xB4 belong 4 core file | |
| 4098 | >>>>>>>>>0x44 string >\0 from '%s' | |
| 4099 | >>>>>>>>>0xC4 belong 3 - received SIGQUIT | |
| 4100 | >>>>>>>>>0xC4 belong 4 - received SIGILL | |
| 4101 | >>>>>>>>>0xC4 belong 5 - received SIGTRAP | |
| 4102 | >>>>>>>>>0xC4 belong 6 - received SIGABRT | |
| 4103 | >>>>>>>>>0xC4 belong 7 - received SIGEMT | |
| 4104 | >>>>>>>>>0xC4 belong 8 - received SIGFPE | |
| 4105 | >>>>>>>>>0xC4 belong 10 - received SIGBUS | |
| 4106 | >>>>>>>>>0xC4 belong 11 - received SIGSEGV | |
| 4107 | >>>>>>>>>0xC4 belong 12 - received SIGSYS | |
| 4108 | >>>>>>>>>0xC4 belong 33 - received SIGXCPU | |
| 4109 | >>>>>>>>>0xC4 belong 34 - received SIGXFSZ | |
| 4110 | # Order 5: FORMAT, EXEC, KERNEL, PROC | |
| 4111 | 0x78 string HP-UX | |
| 4112 | >0 belong 1 | |
| 4113 | >>0xC belong 4 | |
| 4114 | >>>0x10 belong 1 | |
| 4115 | >>>>0x14 belong 0x100 | |
| 4116 | >>>>>0x20 belong 0x44 | |
| 4117 | >>>>>>0x68 belong 2 | |
| 4118 | >>>>>>>0x74 belong 0x3C | |
| 4119 | >>>>>>>>0xB4 belong 4 core file | |
| 4120 | >>>>>>>>>0x58 string >\0 from '%s' | |
| 4121 | >>>>>>>>>0xC4 belong 3 - received SIGQUIT | |
| 4122 | >>>>>>>>>0xC4 belong 4 - received SIGILL | |
| 4123 | >>>>>>>>>0xC4 belong 5 - received SIGTRAP | |
| 4124 | >>>>>>>>>0xC4 belong 6 - received SIGABRT | |
| 4125 | >>>>>>>>>0xC4 belong 7 - received SIGEMT | |
| 4126 | >>>>>>>>>0xC4 belong 8 - received SIGFPE | |
| 4127 | >>>>>>>>>0xC4 belong 10 - received SIGBUS | |
| 4128 | >>>>>>>>>0xC4 belong 11 - received SIGSEGV | |
| 4129 | >>>>>>>>>0xC4 belong 12 - received SIGSYS | |
| 4130 | >>>>>>>>>0xC4 belong 33 - received SIGXCPU | |
| 4131 | >>>>>>>>>0xC4 belong 34 - received SIGXFSZ | |
| 4132 | # Order 6: EXEC, FORMAT, KERNEL, PROC | |
| 4133 | >0 belong 0x100 | |
| 4134 | >>0xC belong 0x44 | |
| 4135 | >>>0x54 belong 1 | |
| 4136 | >>>>0x60 belong 4 | |
| 4137 | >>>>>0x64 belong 1 | |
| 4138 | >>>>>>0x68 belong 2 | |
| 4139 | >>>>>>>0x74 belong 0x2C | |
| 4140 | >>>>>>>>0xB4 belong 4 core file | |
| 4141 | >>>>>>>>>0x44 string >\0 from '%s' | |
| 4142 | >>>>>>>>>0xC4 belong 3 - received SIGQUIT | |
| 4143 | >>>>>>>>>0xC4 belong 4 - received SIGILL | |
| 4144 | >>>>>>>>>0xC4 belong 5 - received SIGTRAP | |
| 4145 | >>>>>>>>>0xC4 belong 6 - received SIGABRT | |
| 4146 | >>>>>>>>>0xC4 belong 7 - received SIGEMT | |
| 4147 | >>>>>>>>>0xC4 belong 8 - received SIGFPE | |
| 4148 | >>>>>>>>>0xC4 belong 10 - received SIGBUS | |
| 4149 | >>>>>>>>>0xC4 belong 11 - received SIGSEGV | |
| 4150 | >>>>>>>>>0xC4 belong 12 - received SIGSYS | |
| 4151 | >>>>>>>>>0xC4 belong 33 - received SIGXCPU | |
| 4152 | >>>>>>>>>0xC4 belong 34 - received SIGXFSZ | |
| 4153 | ||
| 4154 | # From: AMAKAWA Shuhei <sa264@cam.ac.uk> | |
| 4155 | 0 string HPHP49- HP49 binary | |
| 4156 | ||
| 4157 | ||
| 4158 | #------------------------------------------------------------------------------ | |
| 4159 | # JPEG images | |
| 4160 | # SunOS 5.5.1 had | |
| 4161 | # | |
| 4162 | # 0 string \377\330\377\340 JPEG file | |
| 4163 | # 0 string \377\330\377\356 JPG file | |
| 4164 | # | |
| 4165 | # both of which turn into "JPEG image data" here. | |
| 4166 | # | |
| 4167 | 0 beshort 0xffd8 JPEG image data | |
| 4168 | >6 string JFIF \b, JFIF standard | |
| 4169 | # The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06 | |
| 4170 | # in a vain attempt to add image size reporting for JFIF. Note that these | |
| 4171 | # tests are not fool-proof since some perfectly valid JPEGs are currently | |
| 4172 | # impossible to specify in magic(4) format. | |
| 4173 | # First, a little JFIF version info: | |
| 4174 | >>11 byte x \b %d. | |
| 4175 | >>12 byte x \b%02d | |
| 4176 | # Next, the resolution or aspect ratio of the image: | |
| 4177 | #>>13 byte 0 \b, aspect ratio | |
| 4178 | #>>13 byte 1 \b, resolution (DPI) | |
| 4179 | #>>13 byte 2 \b, resolution (DPCM) | |
| 4180 | #>>4 beshort x \b, segment length %d | |
| 4181 | # Next, show thumbnail info, if it exists: | |
| 4182 | >>18 byte !0 \b, thumbnail %dx | |
| 4183 | >>>19 byte x \b%d | |
| 4184 | ||
| 4185 | # EXIF moved down here to avoid reporting a bogus version number, | |
| 4186 | # and EXIF version number printing added. | |
| 4187 | # - Patrik R=E5dman <patrik+file-magic@iki.fi> | |
| 4188 | >6 string Exif \b, EXIF standard | |
| 4189 | # Look for EXIF IFD offset in IFD 0, and then look for EXIF version tag in EXIF IFD. | |
| 4190 | # All possible combinations of entries have to be enumerated, since no looping | |
| 4191 | # is possible. And both endians are possible... | |
| 4192 | # The combinations included below are from real-world JPEGs. | |
| 4193 | # Little-endian | |
| 4194 | >>12 string II | |
| 4195 | # IFD 0 Entry #5: | |
| 4196 | >>>70 leshort 0x8769 | |
| 4197 | # EXIF IFD Entry #1: | |
| 4198 | >>>>(78.l+14) leshort 0x9000 | |
| 4199 | >>>>>(78.l+23) byte x %c | |
| 4200 | >>>>>(78.l+24) byte x \b.%c | |
| 4201 | >>>>>(78.l+25) byte !0x30 \b%c | |
| 4202 | # IFD 0 Entry #9: | |
| 4203 | >>>118 leshort 0x8769 | |
| 4204 | # EXIF IFD Entry #3: | |
| 4205 | >>>>(126.l+38) leshort 0x9000 | |
| 4206 | >>>>>(126.l+47) byte x %c | |
| 4207 | >>>>>(126.l+48) byte x \b.%c | |
| 4208 | >>>>>(126.l+49) byte !0x30 \b%c | |
| 4209 | # IFD 0 Entry #10 | |
| 4210 | >>>130 leshort 0x8769 | |
| 4211 | # EXIF IFD Entry #3: | |
| 4212 | >>>>(138.l+38) leshort 0x9000 | |
| 4213 | >>>>>(138.l+47) byte x %c | |
| 4214 | >>>>>(138.l+48) byte x \b.%c | |
| 4215 | >>>>>(138.l+49) byte !0x30 \b%c | |
| 4216 | # EXIF IFD Entry #4: | |
| 4217 | >>>>(138.l+50) leshort 0x9000 | |
| 4218 | >>>>>(138.l+59) byte x %c | |
| 4219 | >>>>>(138.l+60) byte x \b.%c | |
| 4220 | >>>>>(138.l+61) byte !0x30 \b%c | |
| 4221 | # EXIF IFD Entry #5: | |
| 4222 | >>>>(138.l+62) leshort 0x9000 | |
| 4223 | >>>>>(138.l+71) byte x %c | |
| 4224 | >>>>>(138.l+72) byte x \b.%c | |
| 4225 | >>>>>(138.l+73) byte !0x30 \b%c | |
| 4226 | # IFD 0 Entry #11 | |
| 4227 | >>>142 leshort 0x8769 | |
| 4228 | # EXIF IFD Entry #3: | |
| 4229 | >>>>(150.l+38) leshort 0x9000 | |
| 4230 | >>>>>(150.l+47) byte x %c | |
| 4231 | >>>>>(150.l+48) byte x \b.%c | |
| 4232 | >>>>>(150.l+49) byte !0x30 \b%c | |
| 4233 | # EXIF IFD Entry #4: | |
| 4234 | >>>>(150.l+50) leshort 0x9000 | |
| 4235 | >>>>>(150.l+59) byte x %c | |
| 4236 | >>>>>(150.l+60) byte x \b.%c | |
| 4237 | >>>>>(150.l+61) byte !0x30 \b%c | |
| 4238 | # EXIF IFD Entry #5: | |
| 4239 | >>>>(150.l+62) leshort 0x9000 | |
| 4240 | >>>>>(150.l+71) byte x %c | |
| 4241 | >>>>>(150.l+72) byte x \b.%c | |
| 4242 | >>>>>(150.l+73) byte !0x30 \b%c | |
| 4243 | # Big-endian | |
| 4244 | >>12 string MM | |
| 4245 | # IFD 0 Entry #9: | |
| 4246 | >>>118 beshort 0x8769 | |
| 4247 | # EXIF IFD Entry #1: | |
| 4248 | >>>>(126.L+14) beshort 0x9000 | |
| 4249 | >>>>>(126.L+23) byte x %c | |
| 4250 | >>>>>(126.L+24) byte x \b.%c | |
| 4251 | >>>>>(126.L+25) byte !0x30 \b%c | |
| 4252 | # EXIF IFD Entry #3: | |
| 4253 | >>>>(126.L+38) beshort 0x9000 | |
| 4254 | >>>>>(126.L+47) byte x %c | |
| 4255 | >>>>>(126.L+48) byte x \b.%c | |
| 4256 | >>>>>(126.L+49) byte !0x30 \b%c | |
| 4257 | # IFD 0 Entry #10 | |
| 4258 | >>>130 beshort 0x8769 | |
| 4259 | # EXIF IFD Entry #3: | |
| 4260 | >>>>(138.L+38) beshort 0x9000 | |
| 4261 | >>>>>(138.L+47) byte x %c | |
| 4262 | >>>>>(138.L+48) byte x \b.%c | |
| 4263 | >>>>>(138.L+49) byte !0x30 \b%c | |
| 4264 | # EXIF IFD Entry #5: | |
| 4265 | >>>>(138.L+62) beshort 0x9000 | |
| 4266 | >>>>>(138.L+71) byte x %c | |
| 4267 | >>>>>(138.L+72) byte x \b.%c | |
| 4268 | >>>>>(138.L+73) byte !0x30 \b%c | |
| 4269 | # IFD 0 Entry #11 | |
| 4270 | >>>142 beshort 0x8769 | |
| 4271 | # EXIF IFD Entry #4: | |
| 4272 | >>>>(150.L+50) beshort 0x9000 | |
| 4273 | >>>>>(150.L+59) byte x %c | |
| 4274 | >>>>>(150.L+60) byte x \b.%c | |
| 4275 | >>>>>(150.L+61) byte !0x30 \b%c | |
| 4276 | # Here things get sticky. We can do ONE MORE marker segment with | |
| 4277 | # indirect addressing, and that's all. It would be great if we could | |
| 4278 | # do pointer arithemetic like in an assembler language. Christos? | |
| 4279 | # And if there was some sort of looping construct to do searches, plus a few | |
| 4280 | # named accumulators, it would be even more effective... | |
| 4281 | # At least we can show a comment if no other segments got inserted before: | |
| 4282 | >(4.S+5) byte 0xFE | |
| 4283 | >>(4.S+8) string >\0 \b, comment: "%s" | |
| 4284 | #>(4.S+5) byte 0xFE \b, comment | |
| 4285 | #>>(4.S+6) beshort x \b length=%d | |
| 4286 | #>>(4.S+8) string >\0 \b, "%s" | |
| 4287 | # Or, we can show the encoding type (I've included only the three most common) | |
| 4288 | # and image dimensions if we are lucky and the SOFn (image segment) is here: | |
| 4289 | >(4.S+5) byte 0xC0 \b, baseline | |
| 4290 | >>(4.S+6) byte x \b, precision %d | |
| 4291 | >>(4.S+7) beshort x \b, %dx | |
| 4292 | >>(4.S+9) beshort x \b%d | |
| 4293 | >(4.S+5) byte 0xC1 \b, extended sequential | |
| 4294 | >>(4.S+6) byte x \b, precision %d | |
| 4295 | >>(4.S+7) beshort x \b, %dx | |
| 4296 | >>(4.S+9) beshort x \b%d | |
| 4297 | >(4.S+5) byte 0xC2 \b, progressive | |
| 4298 | >>(4.S+6) byte x \b, precision %d | |
| 4299 | >>(4.S+7) beshort x \b, %dx | |
| 4300 | >>(4.S+9) beshort x \b%d | |
| 4301 | # I've commented-out quantisation table reporting. I doubt anyone cares yet. | |
| 4302 | #>(4.S+5) byte 0xDB \b, quantisation table | |
| 4303 | #>>(4.S+6) beshort x \b length=%d | |
| 4304 | #>14 beshort x \b, %d x | |
| 4305 | #>16 beshort x \b %d | |
| 4306 | ||
| 4307 | # HSI is Handmade Software's proprietary JPEG encoding scheme | |
| 4308 | 0 string hsi1 JPEG image data, HSI proprietary | |
| 4309 | ||
| 4310 | # From: David Santinoli <david@santinoli.com> | |
| 4311 | 0 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 image data | |
| 4312 | ||
| 4313 | #------------------------------------------------------------------------------ | |
| 4314 | # sinclair: file(1) sinclair QL | |
| 4315 | ||
| 4316 | # additions to /etc/magic by Thomas M. Ott (ThMO) | |
| 4317 | ||
| 4318 | # Sinclair QL floppy disk formats (ThMO) | |
| 4319 | 0 string =QL5 QL disk dump data, | |
| 4320 | >3 string =A 720 KB, | |
| 4321 | >3 string =B 1.44 MB, | |
| 4322 | >3 string =C 3.2 MB, | |
| 4323 | >4 string >\0 label:%.10s | |
| 4324 | ||
| 4325 | # Sinclair QL OS dump (ThMO) | |
| 4326 | # (NOTE: if `file' would be able to use indirect references in a endian format | |
| 4327 | # differing from the natural host format, this could be written more | |
| 4328 | # reliably and faster...) | |
| 4329 | # | |
| 4330 | # we *can't* lookup QL OS code dumps, because `file' is UNABLE to read more | |
| 4331 | # than the first 8K of a file... #-( | |
| 4332 | # | |
| 4333 | #0 belong =0x30000 | |
| 4334 | #>49124 belong <47104 | |
| 4335 | #>>49128 belong <47104 | |
| 4336 | #>>>49132 belong <47104 | |
| 4337 | #>>>>49136 belong <47104 QL OS dump data, | |
| 4338 | #>>>>>49148 string >\0 type %.3s, | |
| 4339 | #>>>>>49142 string >\0 version %.4s | |
| 4340 | ||
| 4341 | # Sinclair QL firmware executables (ThMO) | |
| 4342 | 0 string NqNqNq`\004 QL firmware executable (BCPL) | |
| 4343 | ||
| 4344 | # Sinclair QL libraries (was ThMO) | |
| 4345 | 0 beshort 0xFB01 QDOS object | |
| 4346 | >2 pstring x '%s' | |
| 4347 | ||
| 4348 | # Sinclair QL executables (was ThMO) | |
| 4349 | 4 belong 0x4AFB QDOS executable | |
| 4350 | >9 pstring x '%s' | |
| 4351 | ||
| 4352 | # Sinclair QL ROM (ThMO) | |
| 4353 | 0 belong =0x4AFB0001 QL plugin-ROM data, | |
| 4354 | >9 pstring =\0 un-named | |
| 4355 | >9 pstring >\0 named: %s | |
| 4356 | #------------------------------------------------------------------------------ | |
| 4357 | # acorn: file(1) magic for files found on Acorn systems | |
| 4358 | # | |
| 4359 | ||
| 4360 | # RISC OS Chunk File Format | |
| 4361 | # From RISC OS Programmer's Reference Manual, Appendix D | |
| 4362 | # We guess the file type from the type of the first chunk. | |
| 4363 | 0 lelong 0xc3cbc6c5 RISC OS Chunk data | |
| 4364 | >12 string OBJ_ \b, AOF object | |
| 4365 | >12 string LIB_ \b, ALF library | |
| 4366 | ||
| 4367 | # RISC OS AIF, contains "SWI OS_Exit" at offset 16. | |
| 4368 | 16 lelong 0xef000011 RISC OS AIF executable | |
| 4369 | ||
| 4370 | # RISC OS Draw files | |
| 4371 | # From RISC OS Programmer's Reference Manual, Appendix E | |
| 4372 | 0 string Draw RISC OS Draw file data | |
| 4373 | ||
| 4374 | # RISC OS new format font files | |
| 4375 | # From RISC OS Programmer's Reference Manual, Appendix E | |
| 4376 | 0 string FONT\0 RISC OS outline font data, | |
| 4377 | >5 byte x version %d | |
| 4378 | 0 string FONT\1 RISC OS 1bpp font data, | |
| 4379 | >5 byte x version %d | |
| 4380 | 0 string FONT\4 RISC OS 4bpp font data | |
| 4381 | >5 byte x version %d | |
| 4382 | ||
| 4383 | # RISC OS Music files | |
| 4384 | # From RISC OS Programmer's Reference Manual, Appendix E | |
| 4385 | 0 string Maestro\r RISC OS music file | |
| 4386 | >8 byte x version %d | |
| 4387 | ||
| 4388 | ||
| 4389 | #------------------------------------------------------------------------------ | |
| 4390 | # iff: file(1) magic for Interchange File Format (see also "audio" & "images") | |
| 4391 | # | |
| 4392 | # Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic | |
| 4393 | # Arts for file interchange. It has also been used by Apple, SGI, and | |
| 4394 | # especially Commodore-Amiga. | |
| 4395 | # | |
| 4396 | # IFF files begin with an 8 byte FORM header, followed by a 4 character | |
| 4397 | # FORM type, which is followed by the first chunk in the FORM. | |
| 4398 | ||
| 4399 | 0 string FORM IFF data | |
| 4400 | #>4 belong x \b, FORM is %d bytes long | |
| 4401 | # audio formats | |
| 4402 | >8 string AIFF \b, AIFF audio | |
| 4403 | >8 string AIFC \b, AIFF-C compressed audio | |
| 4404 | >8 string 8SVX \b, 8SVX 8-bit sampled sound voice | |
| 4405 | >8 string SAMP \b, SAMP sampled audio | |
| 4406 | >8 string DTYP \b, DTYP datatype description | |
| 4407 | >8 string PTCH \b, PTCH binary patch | |
| 4408 | # image formats | |
| 4409 | >8 string ILBMBMHD \b, ILBM interleaved image | |
| 4410 | >>20 beshort x \b, %d x | |
| 4411 | >>22 beshort x %d | |
| 4412 | >8 string RGBN \b, RGBN 12-bit RGB image | |
| 4413 | >8 string RGB8 \b, RGB8 24-bit RGB image | |
| 4414 | >8 string DR2D \b, DR2D 2-D object | |
| 4415 | >8 string TDDD \b, TDDD 3-D rendering | |
| 4416 | # other formats | |
| 4417 | >8 string FTXT \b, FTXT formatted text | |
| 4418 | >8 string CTLG \b, CTLG message catalog | |
| 4419 | >8 string PREF \b, PREF preferences | |
| 4420 | ||
| 4421 | #------------------------------------------------------------------------------ | |
| 4422 | # lif: file(1) magic for lif | |
| 4423 | # | |
| 4424 | # (Daniel Quinlan <quinlan@yggdrasil.com>) | |
| 4425 | # | |
| 4426 | 0 beshort 0x8000 lif file | |
| 4427 | ||
| 4428 | #------------------------------------------------------------------------------ | |
| 4429 | # mirage: file(1) magic for Mirage executables | |
| 4430 | # | |
| 4431 | # XXX - byte order? | |
| 4432 | # | |
| 4433 | 0 long 31415 Mirage Assembler m.out executable | |
| 4434 | ||
| 4435 | #------------------------------------------------------------------------------ | |
| 4436 | # netscape: file(1) magic for Netscape files | |
| 4437 | # "H. Nanosecond" <aldomel@ix.netcom.com> | |
| 4438 | # version 3 and 4 I think | |
| 4439 | # | |
| 4440 | ||
| 4441 | # Netscape Address book .nab | |
| 4442 | 0 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book | |
| 4443 | ||
| 4444 | # Netscape Communicator address book | |
| 4445 | 0 string \000\017\102\111 Netscape Communicator address book | |
| 4446 | ||
| 4447 | # .snm Caches | |
| 4448 | 0 string #\ Netscape\ folder\ cache Netscape folder cache | |
| 4449 | 0 string \000\036\204\220\000 Netscape folder cache | |
| 4450 | # .n2p | |
| 4451 | # Net 2 Phone | |
| 4452 | #0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060 | |
| 4453 | 0 string SX961999 Net2phone | |
| 4454 | ||
| 4455 | # | |
| 4456 | #This is files ending in .art, FIXME add more rules | |
| 4457 | 0 string JG\004\016\0\0\0\0 ART | |
| 4458 | ||
| 4459 | #------------------------------------------------------------------------------ | |
| 4460 | # olf: file(1) magic for OLF executables | |
| 4461 | # | |
| 4462 | # We have to check the byte order flag to see what byte order all the | |
| 4463 | # other stuff in the header is in. | |
| 4464 | # | |
| 4465 | # MIPS R3000 may also be for MIPS R2000. | |
| 4466 | # What're the correct byte orders for the nCUBE and the Fujitsu VPP500? | |
| 4467 | # | |
| 4468 | # Created by Erik Theisen <etheisen@openbsd.org> | |
| 4469 | # Based on elf from Daniel Quinlan <quinlan@yggdrasil.com> | |
| 4470 | 0 string \177OLF OLF | |
| 4471 | >4 byte 0 invalid class | |
| 4472 | >4 byte 1 32-bit | |
| 4473 | >4 byte 2 64-bit | |
| 4474 | >7 byte 0 invalid os | |
| 4475 | >7 byte 1 OpenBSD | |
| 4476 | >7 byte 2 NetBSD | |
| 4477 | >7 byte 3 FreeBSD | |
| 4478 | >7 byte 4 4.4BSD | |
| 4479 | >7 byte 5 Linux | |
| 4480 | >7 byte 6 SVR4 | |
| 4481 | >7 byte 7 esix | |
| 4482 | >7 byte 8 Solaris | |
| 4483 | >7 byte 9 Irix | |
| 4484 | >7 byte 10 SCO | |
| 4485 | >7 byte 11 Dell | |
| 4486 | >7 byte 12 NCR | |
| 4487 | >5 byte 0 invalid byte order | |
| 4488 | >5 byte 1 LSB | |
| 4489 | >>16 leshort 0 no file type, | |
| 4490 | >>16 leshort 1 relocatable, | |
| 4491 | >>16 leshort 2 executable, | |
| 4492 | >>16 leshort 3 shared object, | |
| 4493 | # Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> | |
| 4494 | # corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> | |
| 4495 | >>16 leshort 4 core file | |
| 4496 | >>>(0x38+0xcc) string >\0 of '%s' | |
| 4497 | >>>(0x38+0x10) lelong >0 (signal %d), | |
| 4498 | >>16 leshort &0xff00 processor-specific, | |
| 4499 | >>18 leshort 0 no machine, | |
| 4500 | >>18 leshort 1 AT&T WE32100 - invalid byte order, | |
| 4501 | >>18 leshort 2 SPARC - invalid byte order, | |
| 4502 | >>18 leshort 3 Intel 80386, | |
| 4503 | >>18 leshort 4 Motorola 68000 - invalid byte order, | |
| 4504 | >>18 leshort 5 Motorola 88000 - invalid byte order, | |
| 4505 | >>18 leshort 6 Intel 80486, | |
| 4506 | >>18 leshort 7 Intel 80860, | |
| 4507 | >>18 leshort 8 MIPS R3000_BE - invalid byte order, | |
| 4508 | >>18 leshort 9 Amdahl - invalid byte order, | |
| 4509 | >>18 leshort 10 MIPS R3000_LE, | |
| 4510 | >>18 leshort 11 RS6000 - invalid byte order, | |
| 4511 | >>18 leshort 15 PA-RISC - invalid byte order, | |
| 4512 | >>18 leshort 16 nCUBE, | |
| 4513 | >>18 leshort 17 VPP500, | |
| 4514 | >>18 leshort 18 SPARC32PLUS, | |
| 4515 | >>18 leshort 20 PowerPC, | |
| 4516 | >>18 leshort 0x9026 Alpha, | |
| 4517 | >>20 lelong 0 invalid version | |
| 4518 | >>20 lelong 1 version 1 | |
| 4519 | >>36 lelong 1 MathCoPro/FPU/MAU Required | |
| 4520 | >8 string >\0 (%s) | |
| 4521 | >5 byte 2 MSB | |
| 4522 | >>16 beshort 0 no file type, | |
| 4523 | >>16 beshort 1 relocatable, | |
| 4524 | >>16 beshort 2 executable, | |
| 4525 | >>16 beshort 3 shared object, | |
| 4526 | >>16 beshort 4 core file, | |
| 4527 | >>>(0x38+0xcc) string >\0 of '%s' | |
| 4528 | >>>(0x38+0x10) belong >0 (signal %d), | |
| 4529 | >>16 beshort &0xff00 processor-specific, | |
| 4530 | >>18 beshort 0 no machine, | |
| 4531 | >>18 beshort 1 AT&T WE32100, | |
| 4532 | >>18 beshort 2 SPARC, | |
| 4533 | >>18 beshort 3 Intel 80386 - invalid byte order, | |
| 4534 | >>18 beshort 4 Motorola 68000, | |
| 4535 | >>18 beshort 5 Motorola 88000, | |
| 4536 | >>18 beshort 6 Intel 80486 - invalid byte order, | |
| 4537 | >>18 beshort 7 Intel 80860, | |
| 4538 | >>18 beshort 8 MIPS R3000_BE, | |
| 4539 | >>18 beshort 9 Amdahl, | |
| 4540 | >>18 beshort 10 MIPS R3000_LE - invalid byte order, | |
| 4541 | >>18 beshort 11 RS6000, | |
| 4542 | >>18 beshort 15 PA-RISC, | |
| 4543 | >>18 beshort 16 nCUBE, | |
| 4544 | >>18 beshort 17 VPP500, | |
| 4545 | >>18 beshort 18 SPARC32PLUS, | |
| 4546 | >>18 beshort 20 PowerPC or cisco 4500, | |
| 4547 | >>18 beshort 21 cisco 7500, | |
| 4548 | >>18 beshort 24 cisco SVIP, | |
| 4549 | >>18 beshort 25 cisco 7200, | |
| 4550 | >>18 beshort 36 cisco 12000, | |
| 4551 | >>18 beshort 0x9026 Alpha, | |
| 4552 | >>20 belong 0 invalid version | |
| 4553 | >>20 belong 1 version 1 | |
| 4554 | >>36 belong 1 MathCoPro/FPU/MAU Required | |
| 4555 | ||
| 4556 | #------------------------------------------------------------------------------ | |
| 4557 | # VXL: file(1) magic for VXL binary IO data files | |
| 4558 | # | |
| 4559 | # from Ian Scott <scottim@sf.net> | |
| 4560 | # | |
| 4561 | # VXL is a collection of C++ libraries for Computer Vision. | |
| 4562 | # See the vsl chapter in the VXL Book for more info | |
| 4563 | # http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html | |
| 4564 | # http:/vxl.sf.net | |
| 4565 | ||
| 4566 | 2 lelong 0x472b2c4e VXL data file, | |
| 4567 | >0 leshort >0 schema version no %d | |
| 4568 | ||
| 4569 | #------------------------------------------------------------------------------ | |
| 4570 | # unknown: file(1) magic for unknown machines | |
| 4571 | # | |
| 4572 | # XXX - this probably should be pruned, as it'll match PDP-11 and | |
| 4573 | # VAX image formats. | |
| 4574 | # | |
| 4575 | # 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure, | |
| 4576 | # respectively). | |
| 4577 | # | |
| 4578 | # 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't | |
| 4579 | # have the "version %ld", which may be a bogus COFFism (I don't think | |
| 4580 | # there ever was COFF for the PDP-11). | |
| 4581 | # | |
| 4582 | # 0x10B is 0413; that's VAX demand-paged, but this is a short, not a | |
| 4583 | # long, as it would be on a VAX. | |
| 4584 | # | |
| 4585 | # 0x10C is 0414 and 0x10E is 416; those *are* unknown. | |
| 4586 | # | |
| 4587 | 0 short 0x107 unknown machine executable | |
| 4588 | >8 short >0 not stripped | |
| 4589 | >15 byte >0 - version %ld | |
| 4590 | 0 short 0x108 unknown pure executable | |
| 4591 | >8 short >0 not stripped | |
| 4592 | >15 byte >0 - version %ld | |
| 4593 | 0 short 0x109 PDP-11 separate I&D | |
| 4594 | >8 short >0 not stripped | |
| 4595 | >15 byte >0 - version %ld | |
| 4596 | 0 short 0x10b unknown pure executable | |
| 4597 | >8 short >0 not stripped | |
| 4598 | >15 byte >0 - version %ld | |
| 4599 | 0 long 0x10c unknown demand paged pure executable | |
| 4600 | >16 long >0 not stripped | |
| 4601 | 0 long 0x10e unknown readable demand paged pure executable | |
| 4602 | ||
| 4603 | #------------------------------------------------------------------------------ | |
| 4604 | # Hierarchical Data Format, used to facilitate scientific data exchange | |
| 4605 | # specifications at http://hdf.ncsa.uiuc.edu/ | |
| 4606 | ||
| 4607 | 0 belong 0x0e031301 Hierarchical Data Format (version 4) data | |
| 4608 | 0 string \211HDF\r\n\032 Hierarchical Data Format (version 5) data | |
| 4609 | ||
| 4610 | #------------------------------------------------------------------------------ | |
| 4611 | # mail.news: file(1) magic for mail and news | |
| 4612 | # | |
| 4613 | # Unfortunately, saved netnews also has From line added in some news software. | |
| 4614 | #0 string From mail text | |
| 4615 | # There are tests to ascmagic.c to cope with mail and news. | |
| 4616 | 0 string Relay-Version: old news text | |
| 4617 | 0 string #!\ rnews batched news text | |
| 4618 | 0 string N#!\ rnews mailed, batched news text | |
| 4619 | 0 string Forward\ to mail forwarding text | |
| 4620 | 0 string Pipe\ to mail piping text | |
| 4621 | 0 string Return-Path: smtp mail text | |
| 4622 | 0 string Path: news text | |
| 4623 | 0 string Xref: news text | |
| 4624 | 0 string From: news or mail text | |
| 4625 | 0 string Article saved news text | |
| 4626 | 0 string BABYL Emacs RMAIL text | |
| 4627 | 0 string Received: RFC 822 mail text | |
| 4628 | 0 string MIME-Version: MIME entity text | |
| 4629 | #0 string Content- MIME entity text | |
| 4630 | ||
| 4631 | # TNEF files... | |
| 4632 | 0 lelong 0x223E9F78 Transport Neutral Encapsulation Format | |
| 4633 | ||
| 4634 | # From: Kevin Sullivan <ksulliva@psc.edu> | |
| 4635 | 0 string *mbx* MBX mail folder | |
| 4636 | ||
| 4637 | # From: Simon Matter <simon.matter@invoca.ch> | |
| 4638 | 0 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB | |
| 4639 | ||
| 4640 | # JAM(mbp) Fidonet message area databases | |
| 4641 | # JHR file | |
| 4642 | 0 string JAM\0 JAM message area header file | |
| 4643 | >12 leshort >0 (%d messages) | |
| 4644 | ||
| 4645 | # Squish Fidonet message area databases | |
| 4646 | # SQD file (requires at least one message in the area) | |
| 4647 | 256 leshort 0xAFAE4453 Squish message area data file | |
| 4648 | >4 leshort >0 (%d messages) | |
| 4649 | #------------------------------------------------------------------------------ | |
| 4650 | # modem: file(1) magic for modem programs | |
| 4651 | # | |
| 4652 | # From: Florian La Roche <florian@knorke.saar.de> | |
| 4653 | 4 string Research, Digifax-G3-File | |
| 4654 | >29 byte 1 , fine resolution | |
| 4655 | >29 byte 0 , normal resolution | |
| 4656 | ||
| 4657 | 0 short 0x0100 raw G3 data, byte-padded | |
| 4658 | 0 short 0x1400 raw G3 data | |
| 4659 | # | |
| 4660 | # Magic data for vgetty voice formats | |
| 4661 | # (Martin Seine & Marc Eberhard) | |
| 4662 | ||
| 4663 | # | |
| 4664 | # raw modem data version 1 | |
| 4665 | # | |
| 4666 | 0 string RMD1 raw modem data | |
| 4667 | >4 string >\0 (%s / | |
| 4668 | >20 short >0 compression type 0x%04x) | |
| 4669 | ||
| 4670 | # | |
| 4671 | # portable voice format 1 | |
| 4672 | # | |
| 4673 | 0 string PVF1\n portable voice format | |
| 4674 | >5 string >\0 (binary %s) | |
| 4675 | ||
| 4676 | # | |
| 4677 | # portable voice format 2 | |
| 4678 | # | |
| 4679 | 0 string PVF2\n portable voice format | |
| 4680 | >5 string >\0 (ascii %s) | |
| 4681 | ||
| 4682 | ||
| 4683 | #------------------------------------------------------------------------------ | |
| 4684 | # xwindows: file(1) magic for various X/Window system file formats. | |
| 4685 | ||
| 4686 | # Compiled X Keymap | |
| 4687 | # XKM (compiled X keymap) files (including version and byte ordering) | |
| 4688 | 1 string mkx Compiled XKB Keymap: lsb, | |
| 4689 | >0 byte >0 version %d | |
| 4690 | >0 byte =0 obsolete | |
| 4691 | 0 string xkm Compiled XKB Keymap: msb, | |
| 4692 | >3 byte >0 version %d | |
| 4693 | >0 byte =0 obsolete | |
| 4694 | ||
| 4695 | # xfsdump archive | |
| 4696 | 0 string xFSdump0 xfsdump archive | |
| 4697 | >8 long x (version %d) | |
| 4698 | ||
| 4699 | # Jaleo XFS files | |
| 4700 | 0 long 395726 Jaleo XFS file | |
| 4701 | >4 long x - version %ld | |
| 4702 | >8 long x - [%ld - | |
| 4703 | >20 long x %ldx | |
| 4704 | >24 long x %ldx | |
| 4705 | >28 long 1008 YUV422] | |
| 4706 | >28 long 1000 RGB24] | |
| 4707 | ||
| 4708 | #------------------------------------------------------------------------------ | |
| 4709 | # wordprocessors: file(1) magic fo word processors. | |
| 4710 | # | |
| 4711 | ####### PWP file format used on Smith Corona Personal Word Processors: | |
| 4712 | 2 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040\'92 Smith Corona PWP | |
| 4713 | >24 byte 2 \b, single spaced | |
| 4714 | >24 byte 3 \b, 1.5 spaced | |
| 4715 | >24 byte 4 \b, double spaced | |
| 4716 | >25 byte 0x42 \b, letter | |
| 4717 | >25 byte 0x54 \b, legal | |
| 4718 | >26 byte 0x46 \b, A4 | |
| 4719 | ||
| 4720 | #WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE | |
| 4721 | 0 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable text | |
| 4722 | >15 byte 0 Optimized for Intel | |
| 4723 | >15 byte 1 Optimized for Non-Intel | |
| 4724 | 1 string WPC (Corel/WP) | |
| 4725 | >8 short 257 WordPerfect macro | |
| 4726 | >8 short 258 WordPerfect help file | |
| 4727 | >8 short 259 WordPerfect keyboard file | |
| 4728 | >8 short 266 WordPerfect document | |
| 4729 | >8 short 267 WordPerfect dictionary | |
| 4730 | >8 short 268 WordPerfect thesaurus | |
| 4731 | >8 short 269 WordPerfect block | |
| 4732 | >8 short 270 WordPerfect rectangular block | |
| 4733 | >8 short 271 WordPerfect column block | |
| 4734 | >8 short 272 WordPerfect printer data | |
| 4735 | >8 short 275 WordPerfect printer data | |
| 4736 | >8 short 276 WordPerfect driver resource data | |
| 4737 | >8 short 279 WordPerfect hyphenation code | |
| 4738 | >8 short 280 WordPerfect hyphenation data | |
| 4739 | >8 short 281 WordPerfect macro resource data | |
| 4740 | >8 short 283 WordPerfect hyphenation lex | |
| 4741 | >8 short 285 WordPerfect wordlist | |
| 4742 | >8 short 286 WordPerfect equation resource data | |
| 4743 | >8 short 289 WordPerfect spell rules | |
| 4744 | >8 short 290 WordPerfect dictionary rules | |
| 4745 | >8 short 295 WordPerfect spell rules (Microlytics) | |
| 4746 | >8 short 299 WordPerfect settings file | |
| 4747 | >8 short 301 WordPerfect 4.2 document | |
| 4748 | >8 short 325 WordPerfect dialog file | |
| 4749 | >8 short 332 WordPerfect button bar | |
| 4750 | >8 short 513 Shell macro | |
| 4751 | >8 short 522 Shell definition | |
| 4752 | >8 short 769 Notebook macro | |
| 4753 | >8 short 770 Notebook help file | |
| 4754 | >8 short 771 Notebook keyboard file | |
| 4755 | >8 short 778 Notebook definition | |
| 4756 | >8 short 1026 Calculator help file | |
| 4757 | >8 short 1538 Calendar help file | |
| 4758 | >8 short 1546 Calendar data file | |
| 4759 | >8 short 1793 Editor macro | |
| 4760 | >8 short 1794 Editor help file | |
| 4761 | >8 short 1795 Editor keyboard file | |
| 4762 | >8 short 1817 Editor macro resource file | |
| 4763 | >8 short 2049 Macro editor macro | |
| 4764 | >8 short 2050 Macro editor help file | |
| 4765 | >8 short 2051 Macro editor keyboard file | |
| 4766 | >8 short 2305 PlanPerfect macro | |
| 4767 | >8 short 2306 PlanPerfect help file | |
| 4768 | >8 short 2307 PlanPerfect keyboard file | |
| 4769 | >8 short 2314 PlanPerfect worksheet | |
| 4770 | >8 short 2319 PlanPerfect printer definition | |
| 4771 | >8 short 2322 PlanPerfect graphic definition | |
| 4772 | >8 short 2323 PlanPerfect data | |
| 4773 | >8 short 2324 PlanPerfect temporary printer | |
| 4774 | >8 short 2329 PlanPerfect macro resource data | |
| 4775 | >8 byte 11 Mail | |
| 4776 | >8 short 2818 help file | |
| 4777 | >8 short 2821 distribution list | |
| 4778 | >8 short 2826 out box | |
| 4779 | >8 short 2827 in box | |
| 4780 | >8 short 2836 users archived mailbox | |
| 4781 | >8 short 2837 archived message database | |
| 4782 | >8 short 2838 archived attachments | |
| 4783 | >8 short 3083 Printer temporary file | |
| 4784 | >8 short 3330 Scheduler help file | |
| 4785 | >8 short 3338 Scheduler in file | |
| 4786 | >8 short 3339 Scheduler out file | |
| 4787 | >8 short 3594 GroupWise settings file | |
| 4788 | >8 short 3601 GroupWise directory services | |
| 4789 | >8 short 3627 GroupWise settings file | |
| 4790 | >8 short 4362 Terminal resource data | |
| 4791 | >8 short 4363 Terminal resource data | |
| 4792 | >8 short 4395 Terminal resource data | |
| 4793 | >8 short 4619 GUI loadable text | |
| 4794 | >8 short 4620 graphics resource data | |
| 4795 | >8 short 4621 printer settings file | |
| 4796 | >8 short 4622 port definition file | |
| 4797 | >8 short 4623 print queue parameters | |
| 4798 | >8 short 4624 compressed file | |
| 4799 | >8 short 5130 Network service msg file | |
| 4800 | >8 short 5131 Network service msg file | |
| 4801 | >8 short 5132 Async gateway login msg | |
| 4802 | >8 short 5134 GroupWise message file | |
| 4803 | >8 short 7956 GroupWise admin domain database | |
| 4804 | >8 short 7957 GroupWise admin host database | |
| 4805 | >8 short 7959 GroupWise admin remote host database | |
| 4806 | >8 short 7960 GroupWise admin ADS deferment data file | |
| 4807 | >8 short 8458 IntelliTAG (SGML) compiled DTD | |
| 4808 | >8 long 18219264 WordPerfect graphic image (1.0) | |
| 4809 | >8 long 18219520 WordPerfect graphic image (2.0) | |
| 4810 | #end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE | |
| 4811 | ||
| 4812 | # Hangul (Korean) Word Processor File | |
| 4813 | 0 string HWP\ Document\ File Hangul (Korean) Word Processor File | |
| 4814 | ||
| 4815 | # CosmicBook, from Benoît Rouits | |
| 4816 | 0 string CSBK Ted Neslson's CosmicBook hypertext file | |
| 4817 | ||
| 4818 | ||
| 4819 | #------------------------------------------------------------------------------ | |
| 4820 | # sun: file(1) magic for Sun machines | |
| 4821 | # | |
| 4822 | # Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x | |
| 4823 | # releases. (5.x uses ELF.) | |
| 4824 | # | |
| 4825 | 0 belong&077777777 0600413 sparc demand paged | |
| 4826 | >0 byte &0x80 | |
| 4827 | >>20 belong <4096 shared library | |
| 4828 | >>20 belong =4096 dynamically linked executable | |
| 4829 | >>20 belong >4096 dynamically linked executable | |
| 4830 | >0 byte ^0x80 executable | |
| 4831 | >16 belong >0 not stripped | |
| 4832 | 0 belong&077777777 0600410 sparc pure | |
| 4833 | >0 byte &0x80 dynamically linked executable | |
| 4834 | >0 byte ^0x80 executable | |
| 4835 | >16 belong >0 not stripped | |
| 4836 | 0 belong&077777777 0600407 sparc | |
| 4837 | >0 byte &0x80 dynamically linked executable | |
| 4838 | >0 byte ^0x80 executable | |
| 4839 | >16 belong >0 not stripped | |
| 4840 | ||
| 4841 | 0 belong&077777777 0400413 mc68020 demand paged | |
| 4842 | >0 byte &0x80 | |
| 4843 | >>20 belong <4096 shared library | |
| 4844 | >>20 belong =4096 dynamically linked executable | |
| 4845 | >>20 belong >4096 dynamically linked executable | |
| 4846 | >16 belong >0 not stripped | |
| 4847 | 0 belong&077777777 0400410 mc68020 pure | |
| 4848 | >0 byte &0x80 dynamically linked executable | |
| 4849 | >0 byte ^0x80 executable | |
| 4850 | >16 belong >0 not stripped | |
| 4851 | 0 belong&077777777 0400407 mc68020 | |
| 4852 | >0 byte &0x80 dynamically linked executable | |
| 4853 | >0 byte ^0x80 executable | |
| 4854 | >16 belong >0 not stripped | |
| 4855 | ||
| 4856 | 0 belong&077777777 0200413 mc68010 demand paged | |
| 4857 | >0 byte &0x80 | |
| 4858 | >>20 belong <4096 shared library | |
| 4859 | >>20 belong =4096 dynamically linked executable | |
| 4860 | >>20 belong >4096 dynamically linked executable | |
| 4861 | >16 belong >0 not stripped | |
| 4862 | 0 belong&077777777 0200410 mc68010 pure | |
| 4863 | >0 byte &0x80 dynamically linked executable | |
| 4864 | >0 byte ^0x80 executable | |
| 4865 | >16 belong >0 not stripped | |
| 4866 | 0 belong&077777777 0200407 mc68010 | |
| 4867 | >0 byte &0x80 dynamically linked executable | |
| 4868 | >0 byte ^0x80 executable | |
| 4869 | >16 belong >0 not stripped | |
| 4870 | ||
| 4871 | # reworked these to avoid anything beginning with zero becoming "old sun-2" | |
| 4872 | 0 belong 0407 old sun-2 executable | |
| 4873 | >16 belong >0 not stripped | |
| 4874 | 0 belong 0410 old sun-2 pure executable | |
| 4875 | >16 belong >0 not stripped | |
| 4876 | 0 belong 0413 old sun-2 demand paged executable | |
| 4877 | >16 belong >0 not stripped | |
| 4878 | ||
| 4879 | # | |
| 4880 | # Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC | |
| 4881 | # binary executed in compatibility mode under SunOS 5.x". | |
| 4882 | # | |
| 4883 | 0 belong 0x080456 SunOS core file | |
| 4884 | >4 belong 432 (SPARC) | |
| 4885 | >>132 string >\0 from '%s' | |
| 4886 | >>116 belong =3 (quit) | |
| 4887 | >>116 belong =4 (illegal instruction) | |
| 4888 | >>116 belong =5 (trace trap) | |
| 4889 | >>116 belong =6 (abort) | |
| 4890 | >>116 belong =7 (emulator trap) | |
| 4891 | >>116 belong =8 (arithmetic exception) | |
| 4892 | >>116 belong =9 (kill) | |
| 4893 | >>116 belong =10 (bus error) | |
| 4894 | >>116 belong =11 (segmentation violation) | |
| 4895 | >>116 belong =12 (bad argument to system call) | |
| 4896 | >>116 belong =29 (resource lost) | |
| 4897 | >>120 belong x (T=%dK, | |
| 4898 | >>124 belong x D=%dK, | |
| 4899 | >>128 belong x S=%dK) | |
| 4900 | >4 belong 826 (68K) | |
| 4901 | >>128 string >\0 from '%s' | |
| 4902 | >4 belong 456 (SPARC 4.x BCP) | |
| 4903 | >>152 string >\0 from '%s' | |
| 4904 | # Sun SunPC | |
| 4905 | 0 long 0xfa33c08e SunPC 4.0 Hard Disk | |
| 4906 | 0 string #SUNPC_CONFIG SunPC 4.0 Properties Values | |
| 4907 | # Sun snoop (see RFC 1761, which describes the capture file format). | |
| 4908 | # | |
| 4909 | 0 string snoop Snoop capture file | |
| 4910 | >8 belong >0 - version %ld | |
| 4911 | >12 belong 0 (IEEE 802.3) | |
| 4912 | >12 belong 1 (IEEE 802.4) | |
| 4913 | >12 belong 2 (IEEE 802.5) | |
| 4914 | >12 belong 3 (IEEE 802.6) | |
| 4915 | >12 belong 4 (Ethernet) | |
| 4916 | >12 belong 5 (HDLC) | |
| 4917 | >12 belong 6 (Character synchronous) | |
| 4918 | >12 belong 7 (IBM channel-to-channel adapter) | |
| 4919 | >12 belong 8 (FDDI) | |
| 4920 | >12 belong 9 (Unknown) | |
| 4921 | ||
| 4922 | # Microsoft ICM color profile | |
| 4923 | 36 string acspMSFT Microsoft ICM Color Profile | |
| 4924 | # Sun KCMS | |
| 4925 | 36 string acsp Kodak Color Management System, ICC Profile | |
| 4926 | ||
| 4927 | #--------------------------------------------------------------------------- | |
| 4928 | # The following entries have been tested by Duncan Laurie <duncan@sun.com> (a | |
| 4929 | # lead Sun/Cobalt developer) who agrees that they are good and worthy of | |
| 4930 | # inclusion. | |
| 4931 | ||
| 4932 | # Boot ROM images for Sun/Cobalt Linux server appliances | |
| 4933 | 0 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom | |
| 4934 | >38 string x V%.4s | |
| 4935 | ||
| 4936 | # New format for Sun/Cobalt boot ROMs is annoying, it stores the version code | |
| 4937 | # at the very end where file(1) can't get it. | |
| 4938 | 0 string CRfs COBALT boot rom data (Flat boot rom or file system) | |
| 4939 | ||
| 4940 | ||
| 4941 | ||
| 4942 | #------------------------------------------------------------------------------ | |
| 4943 | # Sketch Drawings: http://sketch.sourceforge.net/ | |
| 4944 | # From: Edwin Mons <e@ik.nu> | |
| 4945 | 0 string ##Sketch Sketch document text | |
| 4946 | #------------------------------------------------------------------------------ | |
| 4947 | # bFLT: file(1) magic for BFLT uclinux binary files | |
| 4948 | # | |
| 4949 | # From Philippe De Muyter <phdm@macqel.be> | |
| 4950 | # | |
| 4951 | 0 string bFLT BFLT executable | |
| 4952 | >4 belong x - version %ld | |
| 4953 | >4 belong 4 | |
| 4954 | >>36 belong&0x1 0x1 ram | |
| 4955 | >>36 belong&0x2 0x2 gotpic | |
| 4956 | >>36 belong&0x4 0x4 gzip | |
| 4957 | >>36 belong&0x8 0x8 gzdata | |
| 4958 | # | |
| 4959 | # i80960 b.out objects and archives | |
| 4960 | # | |
| 4961 | 0 long 0x10d i960 b.out relocatable object | |
| 4962 | >16 long >0 not stripped | |
| 4963 | # | |
| 4964 | # b.out archive (hp-rt on i960) | |
| 4965 | 0 string !<bout> b.out archive | |
| 4966 | >8 string __.SYMDEF random library | |
| 4967 | ||
| 4968 | #------------------------------------------------------------------------------ | |
| 4969 | # hitach-sh: file(1) magic for Hitachi Super-H | |
| 4970 | # | |
| 4971 | # Super-H COFF | |
| 4972 | # | |
| 4973 | 0 beshort 0x0500 Hitachi SH big-endian COFF | |
| 4974 | >18 beshort&0x0002 =0x0000 object | |
| 4975 | >18 beshort&0x0002 =0x0002 executable | |
| 4976 | >18 beshort&0x0008 =0x0008 \b, stripped | |
| 4977 | >18 beshort&0x0008 =0x0000 \b, not stripped | |
| 4978 | # | |
| 4979 | 0 leshort 0x0550 Hitachi SH little-endian COFF | |
| 4980 | >18 leshort&0x0002 =0x0000 object | |
| 4981 | >18 leshort&0x0002 =0x0002 executable | |
| 4982 | >18 leshort&0x0008 =0x0008 \b, stripped | |
| 4983 | >18 leshort&0x0008 =0x0000 \b, not stripped | |
| 4984 | ||
| 4985 | ||
| 4986 | #------------------------------------------------------------------------------ | |
| 4987 | # matroska: file(1) magic for Matroska files | |
| 4988 | # | |
| 4989 | # See http://www.matroska.org/ | |
| 4990 | # | |
| 4991 | ||
| 4992 | # EBML id: | |
| 4993 | 0 belong 0x1a45dfa3 | |
| 4994 | # DocType id: | |
| 4995 | >5 beshort 0x4282 | |
| 4996 | # DocType contents: | |
| 4997 | >>8 string matroska Matroska data | |
| 4998 | ||
| 4999 | ||
| 5000 | #------------------------------------------------------------------------------ | |
| 5001 | # ocaml: file(1) magic for Objective Caml files. | |
| 5002 | 0 string Caml1999 Objective caml | |
| 5003 | >8 string X exec file | |
| 5004 | >8 string I interface file (.cmi) | |
| 5005 | >8 string O object file (.cmo) | |
| 5006 | >8 string A library file (.cma) | |
| 5007 | >8 string Y native object file (.cmx) | |
| 5008 | >8 string Z native library file (.cmxa) | |
| 5009 | >8 string M abstract syntax tree implementation file | |
| 5010 | >8 string N abstract syntax tree interface file | |
| 5011 | >9 string >\0 (Version %3.3s). | |
| 5012 | ||
| 5013 | #------------------------------------------------------------------------------ | |
| 5014 | # vax: file(1) magic for VAX executable/object and APL workspace | |
| 5015 | # | |
| 5016 | 0 lelong 0101557 VAX single precision APL workspace | |
| 5017 | 0 lelong 0101556 VAX double precision APL workspace | |
| 5018 | ||
| 5019 | # | |
| 5020 | # VAX a.out (32V, BSD) | |
| 5021 | # | |
| 5022 | 0 lelong 0407 VAX executable | |
| 5023 | >16 lelong >0 not stripped | |
| 5024 | ||
| 5025 | 0 lelong 0410 VAX pure executable | |
| 5026 | >16 lelong >0 not stripped | |
| 5027 | ||
| 5028 | 0 lelong 0413 VAX demand paged pure executable | |
| 5029 | >16 lelong >0 not stripped | |
| 5030 | ||
| 5031 | 0 lelong 0420 VAX demand paged (first page unmapped) pure executable | |
| 5032 | >16 lelong >0 not stripped | |
| 5033 | ||
| 5034 | # | |
| 5035 | # VAX COFF | |
| 5036 | # | |
| 5037 | # The `versions' should be un-commented if they work for you. | |
| 5038 | # (Was the problem just one of endianness?) | |
| 5039 | # | |
| 5040 | 0 leshort 0570 VAX COFF executable | |
| 5041 | >12 lelong >0 not stripped | |
| 5042 | >22 leshort >0 - version %ld | |
| 5043 | 0 leshort 0575 VAX COFF pure executable | |
| 5044 | >12 lelong >0 not stripped | |
| 5045 | >22 leshort >0 - version %ld | |
| 5046 | ||
| 5047 | #------------------------------------------------------------------------------ | |
| 5048 | # clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper. | |
| 5049 | # | |
| 5050 | # XXX - what byte order does the Clipper use? | |
| 5051 | # | |
| 5052 | # XXX - what's the "!" stuff: | |
| 5053 | # | |
| 5054 | # >18 short !074000,000000 C1 R1 | |
| 5055 | # >18 short !074000,004000 C2 R1 | |
| 5056 | # >18 short !074000,010000 C3 R1 | |
| 5057 | # >18 short !074000,074000 TEST | |
| 5058 | # | |
| 5059 | # I shall assume it's ANDing the field with the first value and | |
| 5060 | # comparing it with the second, and rewrite it as: | |
| 5061 | # | |
| 5062 | # >18 short&074000 000000 C1 R1 | |
| 5063 | # >18 short&074000 004000 C2 R1 | |
| 5064 | # >18 short&074000 010000 C3 R1 | |
| 5065 | # >18 short&074000 074000 TEST | |
| 5066 | # | |
| 5067 | # as SVR3.1's "file" doesn't support anything of the "!074000,000000" | |
| 5068 | # sort, nor does SunOS 4.x, so either it's something Intergraph added | |
| 5069 | # in CLIX, or something AT&T added in SVR3.2 or later, or something | |
| 5070 | # somebody else thought was a good idea; it's not documented in the | |
| 5071 | # man page for this version of "magic", nor does it appear to be | |
| 5072 | # implemented (at least not after I blew off the bogus code to turn | |
| 5073 | # old-style "&"s into new-style "&"s, which just didn't work at all). | |
| 5074 | # | |
| 5075 | 0 short 0575 CLIPPER COFF executable (VAX #) | |
| 5076 | >20 short 0407 (impure) | |
| 5077 | >20 short 0410 (5.2 compatible) | |
| 5078 | >20 short 0411 (pure) | |
| 5079 | >20 short 0413 (demand paged) | |
| 5080 | >20 short 0443 (target shared library) | |
| 5081 | >12 long >0 not stripped | |
| 5082 | >22 short >0 - version %ld | |
| 5083 | 0 short 0577 CLIPPER COFF executable | |
| 5084 | >18 short&074000 000000 C1 R1 | |
| 5085 | >18 short&074000 004000 C2 R1 | |
| 5086 | >18 short&074000 010000 C3 R1 | |
| 5087 | >18 short&074000 074000 TEST | |
| 5088 | >20 short 0407 (impure) | |
| 5089 | >20 short 0410 (pure) | |
| 5090 | >20 short 0411 (separate I&D) | |
| 5091 | >20 short 0413 (paged) | |
| 5092 | >20 short 0443 (target shared library) | |
| 5093 | >12 long >0 not stripped | |
| 5094 | >22 short >0 - version %ld | |
| 5095 | >48 long&01 01 alignment trap enabled | |
| 5096 | >52 byte 1 -Ctnc | |
| 5097 | >52 byte 2 -Ctsw | |
| 5098 | >52 byte 3 -Ctpw | |
| 5099 | >52 byte 4 -Ctcb | |
| 5100 | >53 byte 1 -Cdnc | |
| 5101 | >53 byte 2 -Cdsw | |
| 5102 | >53 byte 3 -Cdpw | |
| 5103 | >53 byte 4 -Cdcb | |
| 5104 | >54 byte 1 -Csnc | |
| 5105 | >54 byte 2 -Cssw | |
| 5106 | >54 byte 3 -Cspw | |
| 5107 | >54 byte 4 -Cscb | |
| 5108 | 4 string pipe CLIPPER instruction trace | |
| 5109 | 4 string prof CLIPPER instruction profile | |
| 5110 | ||
| 5111 | #------------------------------------------------------------------------------ | |
| 5112 | # frame: file(1) magic for FrameMaker files | |
| 5113 | # | |
| 5114 | # This stuff came on a FrameMaker demo tape, most of which is | |
| 5115 | # copyright, but this file is "published" as witness the following: | |
| 5116 | # | |
| 5117 | 0 string \<MakerFile FrameMaker document | |
| 5118 | >11 string 5.5 (5.5 | |
| 5119 | >11 string 5.0 (5.0 | |
| 5120 | >11 string 4.0 (4.0 | |
| 5121 | >11 string 3.0 (3.0 | |
| 5122 | >11 string 2.0 (2.0 | |
| 5123 | >11 string 1.0 (1.0 | |
| 5124 | >14 byte x %c) | |
| 5125 | 0 string \<MIFFile FrameMaker MIF (ASCII) file | |
| 5126 | >9 string 4.0 (4.0) | |
| 5127 | >9 string 3.0 (3.0) | |
| 5128 | >9 string 2.0 (2.0) | |
| 5129 | >9 string 1.0 (1.x) | |
| 5130 | 0 string \<MakerDictionary FrameMaker Dictionary text | |
| 5131 | >17 string 3.0 (3.0) | |
| 5132 | >17 string 2.0 (2.0) | |
| 5133 | >17 string 1.0 (1.x) | |
| 5134 | 0 string \<MakerScreenFont FrameMaker Font file | |
| 5135 | >17 string 1.01 (%s) | |
| 5136 | 0 string \<MML FrameMaker MML file | |
| 5137 | 0 string \<BookFile FrameMaker Book file | |
| 5138 | >10 string 3.0 (3.0 | |
| 5139 | >10 string 2.0 (2.0 | |
| 5140 | >10 string 1.0 (1.0 | |
| 5141 | >13 byte x %c) | |
| 5142 | # XXX - this book entry should be verified, if you find one, uncomment this | |
| 5143 | #0 string \<Book\ FrameMaker Book (ASCII) file | |
| 5144 | #>6 string 3.0 (3.0) | |
| 5145 | #>6 string 2.0 (2.0) | |
| 5146 | #>6 string 1.0 (1.0) | |
| 5147 | 0 string \<Maker Intermediate Print File FrameMaker IPL file | |
| 5148 | ||
| 5149 | #------------------------------------------------------------------------------ | |
| 5150 | # magic: file(1) magic for magic files | |
| 5151 | # | |
| 5152 | 0 string #\ Magic magic text file for file(1) cmd | |
| 5153 | 0 lelong 0xF11E041C magic binary file for file(1) cmd | |
| 5154 | >4 lelong x (version %d) (little endian) | |
| 5155 | 0 belong 0xF11E041C magic binary file for file(1) cmd | |
| 5156 | >4 belong x (version %d) (big endian) | |
| 5157 | ||
| 5158 | #------------------------------------------------------------------------------ | |
| 5159 | # sql: file(1) magic for SQL files | |
| 5160 | # | |
| 5161 | # From: "Marty Leisner" <mleisner@eng.mc.xerox.com> | |
| 5162 | # Recognize some MySQL files. | |
| 5163 | # | |
| 5164 | 0 beshort 0xfe01 MySQL table definition file | |
| 5165 | >2 byte x Version %d | |
| 5166 | 0 belong&0xffffff00 0xfefe0300 MySQL MISAM index file | |
| 5167 | >3 byte x Version %d | |
| 5168 | 0 belong&0xffffff00 0xfefe0700 MySQL MISAM compressed data file | |
| 5169 | >3 byte x Version %d | |
| 5170 | 0 belong&0xffffff00 0xfefe0500 MySQL ISAM index file | |
| 5171 | >3 byte x Version %d | |
| 5172 | 0 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file | |
| 5173 | >3 byte x Version %d | |
| 5174 | 0 string \376bin MySQL replication log | |
| 5175 | ||
| 5176 | #------------------------------------------------------------------------------ | |
| 5177 | # dact: file(1) magic for DACT compressed files | |
| 5178 | # | |
| 5179 | 0 long 0x444354C3 DACT compressed data | |
| 5180 | >4 byte >-1 (version %i. | |
| 5181 | >5 byte >-1 $BS%i. | |
| 5182 | >6 byte >-1 $BS%i) | |
| 5183 | >7 long >0 $BS, original size: %i bytes | |
| 5184 | >15 long >30 $BS, block size: %i bytes | |
| 5185 | # | |
| 5186 | # GNU nlsutils message catalog file format | |
| 5187 | # | |
| 5188 | 0 string \336\22\4\225 GNU message catalog (little endian), | |
| 5189 | >4 lelong x revision %d, | |
| 5190 | >8 lelong x %d messages | |
| 5191 | 0 string \225\4\22\336 GNU message catalog (big endian), | |
| 5192 | >4 belong x revision %d, | |
| 5193 | >8 belong x %d messages | |
| 5194 | # message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk> | |
| 5195 | 0 string *nazgul* Nazgul style compiled message catalog | |
| 5196 | >8 lelong >0 \b, version %ld | |
| 5197 | # GnuPG | |
| 5198 | # The format is very similar to pgp | |
| 5199 | 0 string \001gpg GPG key trust database | |
| 5200 | >4 byte x version %d | |
| 5201 | 0 beshort 0x9901 GPG key public ring | |
| 5202 | # This magic is not particularly good, as the keyrings don't have true | |
| 5203 | # magic. Nevertheless, it covers many keyrings. | |
| 5204 | ||
| 5205 | # Gnumeric spreadsheet | |
| 5206 | # This entry is only semi-helpful, as Gnumeric compresses its files, so | |
| 5207 | # they will ordinarily reported as "compressed", but at least -z helps | |
| 5208 | 39 string =<gmr:Workbook Gnumeric spreadsheet | |
| 5209 | ||
| 5210 | #------------------------------------------------------------------------------ | |
| 5211 | # ibm6000: file(1) magic for RS/6000 and the RT PC. | |
| 5212 | # | |
| 5213 | 0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module | |
| 5214 | >12 belong >0 not stripped | |
| 5215 | # Breaks sun4 statically linked execs. | |
| 5216 | #0 beshort 0x0103 executable (RT Version 2) or obj module | |
| 5217 | #>2 byte 0x50 pure | |
| 5218 | #>28 belong >0 not stripped | |
| 5219 | #>6 beshort >0 - version %ld | |
| 5220 | 0 beshort 0x0104 shared library | |
| 5221 | 0 beshort 0x0105 ctab data | |
| 5222 | 0 beshort 0xfe04 structured file | |
| 5223 | 0 string 0xabcdef AIX message catalog | |
| 5224 | 0 belong 0x000001f9 AIX compiled message catalog | |
| 5225 | 0 string \<aiaff> archive | |
| 5226 | 0 string \<bigaf> archive (big format) | |
| 5227 | ||
| 5228 | ||
| 5229 | #------------------------------------------------------------------------------ | |
| 5230 | # os2: file(1) magic for OS/2 files | |
| 5231 | # | |
| 5232 | ||
| 5233 | # Provided 1998/08/22 by | |
| 5234 | # David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> | |
| 5235 | 1 string InternetShortcut MS Windows 95 Internet shortcut text | |
| 5236 | >24 string >\ (URL=<%s>) | |
| 5237 | ||
| 5238 | # OS/2 URL objects | |
| 5239 | # Provided 1998/08/22 by | |
| 5240 | # David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> | |
| 5241 | #0 string http: OS/2 URL object text | |
| 5242 | #>5 string >\ (WWW) <http:%s> | |
| 5243 | #0 string mailto: OS/2 URL object text | |
| 5244 | #>7 string >\ (email) <%s> | |
| 5245 | #0 string news: OS/2 URL object text | |
| 5246 | #>5 string >\ (Usenet) <%s> | |
| 5247 | #0 string ftp: OS/2 URL object text | |
| 5248 | #>4 string >\ (FTP) <ftp:%s> | |
| 5249 | #0 string file: OS/2 URL object text | |
| 5250 | #>5 string >\ (Local file) <%s> | |
| 5251 | ||
| 5252 | # >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com) | |
| 5253 | # Carl Hauser (chauser.parc@xerox.com) and | |
| 5254 | # Marcus Groeber (marcusg@ph-cip.uni-koeln.de) | |
| 5255 | # list the following header format in inf02a.doc: | |
| 5256 | # | |
| 5257 | # int16 ID; // ID magic word (5348h = "HS") | |
| 5258 | # int8 unknown1; // unknown purpose, could be third letter of ID | |
| 5259 | # int8 flags; // probably a flag word... | |
| 5260 | # // bit 0: set if INF style file | |
| 5261 | # // bit 4: set if HLP style file | |
| 5262 | # // patching this byte allows reading HLP files | |
| 5263 | # // using the VIEW command, while help files | |
| 5264 | # // seem to work with INF settings here as well. | |
| 5265 | # int16 hdrsize; // total size of header | |
| 5266 | # int16 unknown2; // unknown purpose | |
| 5267 | # | |
| 5268 | 0 string HSP\x01\x9b\x00 OS/2 INF | |
| 5269 | >107 string >0 (%s) | |
| 5270 | 0 string HSP\x10\x9b\x00 OS/2 HLP | |
| 5271 | >107 string >0 (%s) | |
| 5272 | ||
| 5273 | # OS/2 INI (this is a guess) | |
| 5274 | 0 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI | |
| 5275 | #------------------------------------------------------------------------------ | |
| 5276 | # | |
| 5277 | # RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com) | |
| 5278 | # | |
| 5279 | 0 beshort 0xedab | |
| 5280 | >2 beshort 0xeedb RPM | |
| 5281 | >>4 byte x v%d | |
| 5282 | >>6 beshort 0 bin | |
| 5283 | >>6 beshort 1 src | |
| 5284 | >>8 beshort 1 i386 | |
| 5285 | >>8 beshort 2 Alpha | |
| 5286 | >>8 beshort 3 Sparc | |
| 5287 | >>8 beshort 4 MIPS | |
| 5288 | >>8 beshort 5 PowerPC | |
| 5289 | >>8 beshort 6 68000 | |
| 5290 | >>8 beshort 7 SGI | |
| 5291 | >>8 beshort 8 RS6000 | |
| 5292 | >>8 beshort 9 IA64 | |
| 5293 | >>8 beshort 10 Sparc64 | |
| 5294 | >>8 beshort 11 MIPSel | |
| 5295 | >>8 beshort 12 ARM | |
| 5296 | >>10 string x %s | |
| 5297 | #----------------------------------------------------------------------------- | |
| 5298 | # misctools: file(1) magic for miscelanous UNIX tools. | |
| 5299 | # | |
| 5300 | 0 string %%!! X-Post-It-Note text | |
| 5301 | 0 string BEGIN:VCALENDAR vCalendar calendar file | |
| 5302 | ||
| 5303 | #------------------------------------------------------------------------------ | |
| 5304 | # motorola: file(1) magic for Motorola 68K and 88K binaries | |
| 5305 | # | |
| 5306 | # 68K | |
| 5307 | # | |
| 5308 | 0 beshort 0520 mc68k COFF | |
| 5309 | >18 beshort ^00000020 object | |
| 5310 | >18 beshort &00000020 executable | |
| 5311 | >12 belong >0 not stripped | |
| 5312 | >168 string .lowmem Apple toolbox | |
| 5313 | >20 beshort 0407 (impure) | |
| 5314 | >20 beshort 0410 (pure) | |
| 5315 | >20 beshort 0413 (demand paged) | |
| 5316 | >20 beshort 0421 (standalone) | |
| 5317 | 0 beshort 0521 mc68k executable (shared) | |
| 5318 | >12 belong >0 not stripped | |
| 5319 | 0 beshort 0522 mc68k executable (shared demand paged) | |
| 5320 | >12 belong >0 not stripped | |
| 5321 | # | |
| 5322 | # Motorola/UniSoft 68K Binary Compatibility Standard (BCS) | |
| 5323 | # | |
| 5324 | 0 beshort 0554 68K BCS executable | |
| 5325 | # | |
| 5326 | # 88K | |
| 5327 | # | |
| 5328 | # Motorola/88Open BCS | |
| 5329 | # | |
| 5330 | 0 beshort 0555 88K BCS executable | |
| 5331 | # | |
| 5332 | # Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de> | |
| 5333 | 0 string S0 Motorola S-Record; binary data in text format | |
| 5334 | ||
| 5335 | # ATARI ST relocatable PRG | |
| 5336 | # | |
| 5337 | # from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 | |
| 5338 | # (according to Roland Waldi, Oct 21, 1987) | |
| 5339 | # besides the magic 0x601a, the text segment size is checked to be | |
| 5340 | # not larger than 1 MB (which is a lot on ST). | |
| 5341 | # The additional 0x601b distinction I took from Doug Lee's magic. | |
| 5342 | 0 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable | |
| 5343 | >2 belong x (txt=%ld, | |
| 5344 | >6 belong x dat=%ld, | |
| 5345 | >10 belong x bss=%ld, | |
| 5346 | >14 belong x sym=%ld) | |
| 5347 | 0 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable | |
| 5348 | >2 belong x (txt=%ld, | |
| 5349 | >6 belong x dat=%ld, | |
| 5350 | >10 belong x bss=%ld, | |
| 5351 | >14 belong x sym=%ld) | |
| 5352 | ||
| 5353 | # Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>) | |
| 5354 | 0 beshort 0x601A Atari 68xxx executable, | |
| 5355 | >2 belong x text len %lu, | |
| 5356 | >6 belong x data len %lu, | |
| 5357 | >10 belong x BSS len %lu, | |
| 5358 | >14 belong x symboltab len %lu, | |
| 5359 | >18 belong 0 | |
| 5360 | >22 belong &0x01 fastload flag, | |
| 5361 | >22 belong &0x02 may be loaded to alternate RAM, | |
| 5362 | >22 belong &0x04 malloc may be from alternate RAM, | |
| 5363 | >22 belong x flags: 0x%lX, | |
| 5364 | >26 beshort 0 no relocation tab | |
| 5365 | >26 beshort !0 + relocation tab | |
| 5366 | >30 string SFX [Self-Extracting LZH SFX archive] | |
| 5367 | >38 string SFX [Self-Extracting LZH SFX archive] | |
| 5368 | >44 string ZIP! [Self-Extracting ZIP SFX archive] | |
| 5369 | ||
| 5370 | 0 beshort 0x0064 Atari 68xxx CPX file | |
| 5371 | >8 beshort x (version %04lx) | |
| 5372 | # | |
| 5373 | # Mach magic number info | |
| 5374 | # | |
| 5375 | 0 long 0xefbe OSF/Rose object | |
| 5376 | # I386 magic number info | |
| 5377 | # | |
| 5378 | 0 short 0565 i386 COFF object | |
| 5379 | ||
| 5380 | #------------------------------------------------------------------------------ | |
| 5381 | # perl: file(1) magic for Larry Wall's perl language. | |
| 5382 | # | |
| 5383 | # The ``eval'' line recognizes an outrageously clever hack for USG systems. | |
| 5384 | # Keith Waclena <keith@cerberus.uchicago.edu> | |
| 5385 | # Send additions to <perl5-porters@perl.org> | |
| 5386 | 0 string/b #!\ /bin/perl perl script text executable | |
| 5387 | 0 string eval\ "exec\ /bin/perl perl script text | |
| 5388 | 0 string/b #!\ /usr/bin/perl perl script text executable | |
| 5389 | 0 string eval\ "exec\ /usr/bin/perl perl script text | |
| 5390 | 0 string/b #!\ /usr/local/bin/perl perl script text | |
| 5391 | 0 string eval\ "exec\ /usr/local/bin/perl perl script text executable | |
| 5392 | 0 string eval\ '(exit\ $?0)'\ &&\ eval\ 'exec perl script text | |
| 5393 | ||
| 5394 | # a couple more, by me | |
| 5395 | # XXX: christos matches | |
| 5396 | #0 regex package Perl5 module source text (via regex) | |
| 5397 | 0 string package Perl5 module source text | |
| 5398 | ||
| 5399 | # Perl Storable data files. | |
| 5400 | 0 string perl-store perl Storable(v0.6) data | |
| 5401 | >4 byte >0 (net-order %d) | |
| 5402 | >>4 byte &01 (network-ordered) | |
| 5403 | >>4 byte =3 (major 1) | |
| 5404 | >>4 byte =2 (major 1) | |
| 5405 | ||
| 5406 | 0 string pst0 perl Storable(v0.7) data | |
| 5407 | >4 byte >0 | |
| 5408 | >>4 byte &01 (network-ordered) | |
| 5409 | >>4 byte =5 (major 2) | |
| 5410 | >>4 byte =4 (major 2) | |
| 5411 | >>5 byte >0 (minor %d) | |
| 5412 | ||
| 5413 | #------------------------------------------------------------------------------ | |
| 5414 | # xenix: file(1) magic for Microsoft Xenix | |
| 5415 | # | |
| 5416 | # "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small | |
| 5417 | # model" lifted from "magic.xenix", with comment "derived empirically; | |
| 5418 | # treat as folklore until proven" | |
| 5419 | # | |
| 5420 | # "small model", "large model", "huge model" stuff lifted from XXX | |
| 5421 | # | |
| 5422 | # XXX - "x.out" collides with PDP-11 archives | |
| 5423 | # | |
| 5424 | 0 string core core file (Xenix) | |
| 5425 | 0 byte 0x80 8086 relocatable (Microsoft) | |
| 5426 | 0 leshort 0xff65 x.out | |
| 5427 | >2 string __.SYMDEF randomized | |
| 5428 | >0 byte x archive | |
| 5429 | 0 leshort 0x206 Microsoft a.out | |
| 5430 | >8 leshort 1 Middle model | |
| 5431 | >0x1e leshort &0x10 overlay | |
| 5432 | >0x1e leshort &0x2 separate | |
| 5433 | >0x1e leshort &0x4 pure | |
| 5434 | >0x1e leshort &0x800 segmented | |
| 5435 | >0x1e leshort &0x400 standalone | |
| 5436 | >0x1e leshort &0x8 fixed-stack | |
| 5437 | >0x1c byte &0x80 byte-swapped | |
| 5438 | >0x1c byte &0x40 word-swapped | |
| 5439 | >0x10 lelong >0 not-stripped | |
| 5440 | >0x1e leshort ^0xc000 pre-SysV | |
| 5441 | >0x1e leshort &0x4000 V2.3 | |
| 5442 | >0x1e leshort &0x8000 V3.0 | |
| 5443 | >0x1c byte &0x4 86 | |
| 5444 | >0x1c byte &0xb 186 | |
| 5445 | >0x1c byte &0x9 286 | |
| 5446 | >0x1c byte &0xa 386 | |
| 5447 | >0x1f byte <0x040 small model | |
| 5448 | >0x1f byte =0x048 large model | |
| 5449 | >0x1f byte =0x049 huge model | |
| 5450 | >0x1e leshort &0x1 executable | |
| 5451 | >0x1e leshort ^0x1 object file | |
| 5452 | >0x1e leshort &0x40 Large Text | |
| 5453 | >0x1e leshort &0x20 Large Data | |
| 5454 | >0x1e leshort &0x120 Huge Objects Enabled | |
| 5455 | >0x10 lelong >0 not stripped | |
| 5456 | ||
| 5457 | 0 leshort 0x140 old Microsoft 8086 x.out | |
| 5458 | >0x3 byte &0x4 separate | |
| 5459 | >0x3 byte &0x2 pure | |
| 5460 | >0 byte &0x1 executable | |
| 5461 | >0 byte ^0x1 relocatable | |
| 5462 | >0x14 lelong >0 not stripped | |
| 5463 | ||
| 5464 | 0 lelong 0x206 b.out | |
| 5465 | >0x1e leshort &0x10 overlay | |
| 5466 | >0x1e leshort &0x2 separate | |
| 5467 | >0x1e leshort &0x4 pure | |
| 5468 | >0x1e leshort &0x800 segmented | |
| 5469 | >0x1e leshort &0x400 standalone | |
| 5470 | >0x1e leshort &0x1 executable | |
| 5471 | >0x1e leshort ^0x1 object file | |
| 5472 | >0x1e leshort &0x4000 V2.3 | |
| 5473 | >0x1e leshort &0x8000 V3.0 | |
| 5474 | >0x1c byte &0x4 86 | |
| 5475 | >0x1c byte &0xb 186 | |
| 5476 | >0x1c byte &0x9 286 | |
| 5477 | >0x1c byte &0x29 286 | |
| 5478 | >0x1c byte &0xa 386 | |
| 5479 | >0x1e leshort &0x4 Large Text | |
| 5480 | >0x1e leshort &0x2 Large Data | |
| 5481 | >0x1e leshort &0x102 Huge Objects Enabled | |
| 5482 | ||
| 5483 | 0 leshort 0x580 XENIX 8086 relocatable or 80286 small model | |
| 5484 | #------------------------------------------------------------------------------ | |
| 5485 | # file(1) magic for tgif(1) files | |
| 5486 | # From Hendrik Scholz <hendrik@scholz.net> | |
| 5487 | ||
| 5488 | 0 string %TGIF\ 4 tgif version 4 object file | |
| 5489 | ||
| 5490 | ||
| 5491 | #------------------------------------------------------------------------------ | |
| 5492 | # sc: file(1) magic for "sc" spreadsheet | |
| 5493 | # | |
| 5494 | 38 string Spreadsheet sc spreadsheet file | |
| 5495 | ||
| 5496 | #------------------------------------------------------------------------------ | |
| 5497 | # pyramid: file(1) magic for Pyramids | |
| 5498 | # | |
| 5499 | # XXX - byte order? | |
| 5500 | # | |
| 5501 | 0 long 0x50900107 Pyramid 90x family executable | |
| 5502 | 0 long 0x50900108 Pyramid 90x family pure executable | |
| 5503 | >16 long >0 not stripped | |
| 5504 | 0 long 0x5090010b Pyramid 90x family demand paged pure executable | |
| 5505 | >16 long >0 not stripped | |
| 5506 | ||
| 5507 | #------------------------------------------------------------------------------ | |
| 5508 | # adventure: file(1) magic for Adventure game files | |
| 5509 | # | |
| 5510 | # from Allen Garvin <earendil@faeryland.tamu-commerce.edu> | |
| 5511 | # Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998 | |
| 5512 | # Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 | |
| 5513 | # | |
| 5514 | # ALAN | |
| 5515 | # I assume there are other, lower versions, but these are the only ones I | |
| 5516 | # saw in the archive. | |
| 5517 | 0 beshort 0x0206 ALAN game data | |
| 5518 | >2 byte <10 version 2.6%d | |
| 5519 | ||
| 5520 | # Conflicts with too much other stuff! | |
| 5521 | # Infocom | |
| 5522 | # (Note: to avoid false matches Z-machine version 1 and 2 are not | |
| 5523 | # recognized since only the oldest Zork I and II used them. Similarly | |
| 5524 | # there are 4 Infocom games that use version 4 that are not recognized.) | |
| 5525 | #0 byte 3 Infocom game data (Z-machine 3, | |
| 5526 | #>2 beshort <0x7fff Release %3d, | |
| 5527 | #>26 beshort >0 Size %d*2 | |
| 5528 | #>18 string >\0 Serial %.6s) | |
| 5529 | #0 byte 5 Infocom game data (Z-machine 5, | |
| 5530 | #>2 beshort <0x7fff Release %3d, | |
| 5531 | #>26 beshort >0 Size %d*4 | |
| 5532 | #>18 string >\0 Serial %.6s) | |
| 5533 | #0 byte 6 Infocom game data (Z-machine 6, | |
| 5534 | #>2 beshort <0x7fff Release %3d, | |
| 5535 | #>26 beshort >0 Size %d*8 | |
| 5536 | #>18 string >\0 Serial %.6s) | |
| 5537 | #0 byte 8 Infocom game data (Z-machine 8, | |
| 5538 | #>2 beshort <0x7fff Release %3d, | |
| 5539 | #>26 beshort >0 Size %d*8 | |
| 5540 | #>18 string >\0 Serial %.6s) | |
| 5541 | ||
| 5542 | # TADS (Text Adventure Development System) | |
| 5543 | # All files are machine-independent (games compile to byte-code) and are tagged | |
| 5544 | # with a version string of the form "V2.<digit>.<digit>\0" (but TADS 3 is | |
| 5545 | # on the way). | |
| 5546 | # Game files start with "TADS2 bin\n\r\032\0" then the compiler version. | |
| 5547 | 0 string TADS2\ bin TADS | |
| 5548 | >9 belong !0x0A0D1A00 game data, CORRUPTED | |
| 5549 | >9 belong 0x0A0D1A00 | |
| 5550 | >>13 string >\0 %s game data | |
| 5551 | # Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version. | |
| 5552 | 0 string TADS2\ rsc TADS | |
| 5553 | >9 belong !0x0A0D1A00 resource data, CORRUPTED | |
| 5554 | >9 belong 0x0A0D1A00 | |
| 5555 | >>13 string >\0 %s resource data | |
| 5556 | # Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian | |
| 5557 | # 2-byte length N, the N-char name of the game file *without* a NUL (darn!), | |
| 5558 | # "TADS2 save\n\r\032\0" and the interpreter version. | |
| 5559 | 0 string TADS2\ save/g TADS | |
| 5560 | >12 belong !0x0A0D1A00 saved game data, CORRUPTED | |
| 5561 | >12 belong 0x0A0D1A00 | |
| 5562 | >>(16.s+32) string >\0 %s saved game data | |
| 5563 | # Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter | |
| 5564 | # version. | |
| 5565 | 0 string TADS2\ save TADS | |
| 5566 | >10 belong !0x0A0D1A00 saved game data, CORRUPTED | |
| 5567 | >10 belong 0x0A0D1A00 | |
| 5568 | >>14 string >\0 %s saved game data | |
| 5569 | ||
| 5570 | #------------------------------------------------------------------------------ | |
| 5571 | # att3b: file(1) magic for AT&T 3B machines | |
| 5572 | # | |
| 5573 | # The `versions' should be un-commented if they work for you. | |
| 5574 | # (Was the problem just one of endianness?) | |
| 5575 | # | |
| 5576 | # 3B20 | |
| 5577 | # | |
| 5578 | # The 3B20 conflicts with SCCS. | |
| 5579 | #0 beshort 0550 3b20 COFF executable | |
| 5580 | #>12 belong >0 not stripped | |
| 5581 | #>22 beshort >0 - version %ld | |
| 5582 | #0 beshort 0551 3b20 COFF executable (TV) | |
| 5583 | #>12 belong >0 not stripped | |
| 5584 | #>22 beshort >0 - version %ld | |
| 5585 | # | |
| 5586 | # WE32K | |
| 5587 | # | |
| 5588 | 0 beshort 0560 WE32000 COFF | |
| 5589 | >18 beshort ^00000020 object | |
| 5590 | >18 beshort &00000020 executable | |
| 5591 | >12 belong >0 not stripped | |
| 5592 | >18 beshort ^00010000 N/A on 3b2/300 w/paging | |
| 5593 | >18 beshort &00020000 32100 required | |
| 5594 | >18 beshort &00040000 and MAU hardware required | |
| 5595 | >20 beshort 0407 (impure) | |
| 5596 | >20 beshort 0410 (pure) | |
| 5597 | >20 beshort 0413 (demand paged) | |
| 5598 | >20 beshort 0443 (target shared library) | |
| 5599 | >22 beshort >0 - version %ld | |
| 5600 | 0 beshort 0561 WE32000 COFF executable (TV) | |
| 5601 | >12 belong >0 not stripped | |
| 5602 | #>18 beshort &00020000 - 32100 required | |
| 5603 | #>18 beshort &00040000 and MAU hardware required | |
| 5604 | #>22 beshort >0 - version %ld | |
| 5605 | # | |
| 5606 | # core file for 3b2 | |
| 5607 | 0 string \000\004\036\212\200 3b2 core file | |
| 5608 | >364 string >\0 of '%s' | |
| 5609 | ||
| 5610 | #------------------------------------------------------------------------------ | |
| 5611 | # flash: file(1) magic for Macromedia Flash file format | |
| 5612 | # | |
| 5613 | # See | |
| 5614 | # | |
| 5615 | # http://www.macromedia.com/software/flash/open/ | |
| 5616 | # | |
| 5617 | 0 string FWS Macromedia Flash data, | |
| 5618 | >3 byte x version %d | |
| 5619 | 0 string CWS Macromedia Flash data (compressed), | |
| 5620 | >3 byte x version %d | |
| 5621 | # | |
| 5622 | # From Dave Wilson | |
| 5623 | 0 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document | |
| 5624 | ||
| 5625 | #------------------------------------------------------------------------------ | |
| 5626 | # karma: file(1) magic for Karma data files | |
| 5627 | # | |
| 5628 | # From <rgooch@atnf.csiro.au> | |
| 5629 | ||
| 5630 | 0 string KarmaRHD Version Karma Data Structure Version | |
| 5631 | >16 belong x %lu | |
| 5632 | #------------------------------------------------------------------------------ | |
| 5633 | # octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org> | |
| 5634 | 0 string Octave-1-L Octave binary data (little endian) | |
| 5635 | 0 string Octave-1-B Octave binary data (big endian) | |
| 5636 | ||
| 5637 | #------------------------------------------------------------------------------ | |
| 5638 | # | |
| 5639 | # Parix COFF executables | |
| 5640 | # From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de> | |
| 5641 | # | |
| 5642 | 0 beshort&0xfff 0xACE PARIX | |
| 5643 | >0 byte&0xf0 0x80 T800 | |
| 5644 | >0 byte&0xf0 0x90 T9000 | |
| 5645 | >19 byte&0x02 0x02 executable | |
| 5646 | >19 byte&0x02 0x00 object | |
| 5647 | >19 byte&0x0c 0x00 not stripped | |
| 5648 | ||
| 5649 | #------------------------------------------------------------------------------ | |
| 5650 | # plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables | |
| 5651 | # From: "Stefan A. Haubenthal" <polluks@web.de> | |
| 5652 | # | |
| 5653 | 0 belong 0x00000107 Plan 9 executable, Motorola 68k | |
| 5654 | 0 belong 0x000001EB Plan 9 executable, Intel 386 | |
| 5655 | 0 belong 0x00000247 Plan 9 executable, Intel 960 | |
| 5656 | 0 belong 0x000002AB Plan 9 executable, SPARC | |
| 5657 | 0 belong 0x00000407 Plan 9 executable, MIPS R3000 | |
| 5658 | 0 belong 0x0000048B Plan 9 executable, AT&T DSP 3210 | |
| 5659 | 0 belong 0x00000517 Plan 9 executable, MIPS R4000 BE | |
| 5660 | 0 belong 0x000005AB Plan 9 executable, AMD 29000 | |
| 5661 | 0 belong 0x00000647 Plan 9 executable, ARM 7-something | |
| 5662 | 0 belong 0x000006EB Plan 9 executable, PowerPC | |
| 5663 | 0 belong 0x00000797 Plan 9 executable, MIPS R4000 LE | |
| 5664 | 0 belong 0x0000084B Plan 9 executable, DEC Alpha | |
| 5665 | ||
| 5666 | #------------------------------------------------------------------------------ | |
| 5667 | # troff: file(1) magic for *roff | |
| 5668 | # | |
| 5669 | # updated by Daniel Quinlan (quinlan@yggdrasil.com) | |
| 5670 | ||
| 5671 | # troff input | |
| 5672 | 0 string .\\" troff or preprocessor input text | |
| 5673 | 0 string '\\" troff or preprocessor input text | |
| 5674 | 0 string '.\\" troff or preprocessor input text | |
| 5675 | 0 string \\" troff or preprocessor input text | |
| 5676 | 0 string ''' troff or preprocessor input text | |
| 5677 | ||
| 5678 | # ditroff intermediate output text | |
| 5679 | 0 string x\ T ditroff output text | |
| 5680 | >4 string cat for the C/A/T phototypesetter | |
| 5681 | >4 string ps for PostScript | |
| 5682 | >4 string dvi for DVI | |
| 5683 | >4 string ascii for ASCII | |
| 5684 | >4 string lj4 for LaserJet 4 | |
| 5685 | >4 string latin1 for ISO 8859-1 (Latin 1) | |
| 5686 | >4 string X75 for xditview at 75dpi | |
| 5687 | >>7 string -12 (12pt) | |
| 5688 | >4 string X100 for xditview at 100dpi | |
| 5689 | >>8 string -12 (12pt) | |
| 5690 | ||
| 5691 | # output data formats | |
| 5692 | 0 string \100\357 very old (C/A/T) troff output data | |
| 5693 | ||
| 5694 | #------------------------------------------------------------------------------ | |
| 5695 | # spectrum: file(1) magic for Spectrum emulator files. | |
| 5696 | # | |
| 5697 | # John Elliott <jce@seasip.demon.co.uk> | |
| 5698 | ||
| 5699 | # | |
| 5700 | # Spectrum +3DOS header | |
| 5701 | # | |
| 5702 | 0 string PLUS3DOS\032 Spectrum +3 data | |
| 5703 | >15 byte 0 - BASIC program | |
| 5704 | >15 byte 1 - number array | |
| 5705 | >15 byte 2 - character array | |
| 5706 | >15 byte 3 - memory block | |
| 5707 | >>16 belong 0x001B0040 (screen) | |
| 5708 | >15 byte 4 - Tasword document | |
| 5709 | >15 string TAPEFILE - ZXT tapefile | |
| 5710 | # | |
| 5711 | # Tape file. This assumes the .TAP starts with a Spectrum-format header, | |
| 5712 | # which nearly all will. | |
| 5713 | # | |
| 5714 | 0 string \023\000\000 Spectrum .TAP data | |
| 5715 | >4 string x "%-10.10s" | |
| 5716 | >3 byte 0 - BASIC program | |
| 5717 | >3 byte 1 - number array | |
| 5718 | >3 byte 2 - character array | |
| 5719 | >3 byte 3 - memory block | |
| 5720 | >>14 belong 0x001B0040 (screen) | |
| 5721 | ||
| 5722 | # The following three blocks are from pak21-spectrum@srcf.ucam.org | |
| 5723 | # TZX tape images | |
| 5724 | 0 string ZXTape!\x1a Spectrum .TZX data | |
| 5725 | >8 byte x version %d | |
| 5726 | >9 byte x .%d | |
| 5727 | ||
| 5728 | # RZX input recording files | |
| 5729 | 0 string RZX! Spectrum .RZX data | |
| 5730 | >4 byte x version %d | |
| 5731 | >5 byte x .%d | |
| 5732 | ||
| 5733 | # And three sorts of disk image | |
| 5734 | 0 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data | |
| 5735 | 0 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data | |
| 5736 | 0 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data | |
| 5737 | ||
| 5738 | #------------------------------------------------------------------------------ | |
| 5739 | # softquad: file(1) magic for SoftQuad Publishing Software | |
| 5740 | # | |
| 5741 | # Author/Editor and RulesBuilder | |
| 5742 | # | |
| 5743 | # XXX - byte order? | |
| 5744 | # | |
| 5745 | 0 string \<!SQ\ DTD> Compiled SGML rules file | |
| 5746 | >9 string >\0 Type %s | |
| 5747 | 0 string \<!SQ\ A/E> A/E SGML Document binary | |
| 5748 | >9 string >\0 Type %s | |
| 5749 | 0 string \<!SQ\ STS> A/E SGML binary styles file | |
| 5750 | >9 string >\0 Type %s | |
| 5751 | 0 short 0xc0de Compiled PSI (v1) data | |
| 5752 | 0 short 0xc0da Compiled PSI (v2) data | |
| 5753 | >3 string >\0 (%s) | |
| 5754 | # Binary sqtroff font/desc files... | |
| 5755 | 0 short 0125252 SoftQuad DESC or font file binary | |
| 5756 | >2 short >0 - version %d | |
| 5757 | # Bitmaps... | |
| 5758 | 0 string SQ\ BITMAP1 SoftQuad Raster Format text | |
| 5759 | #0 string SQ\ BITMAP2 SoftQuad Raster Format data | |
| 5760 | # sqtroff intermediate language (replacement for ditroff int. lang.) | |
| 5761 | 0 string X\ SoftQuad troff Context intermediate | |
| 5762 | >2 string 495 for AT&T 495 laser printer | |
| 5763 | >2 string hp for Hewlett-Packard LaserJet | |
| 5764 | >2 string impr for IMAGEN imPRESS | |
| 5765 | >2 string ps for PostScript | |
| 5766 | ||
| 5767 | #------------------------------------------------------------------------------ | |
| 5768 | # Dyadic: file(1) magic for Dyalog APL. | |
| 5769 | # | |
| 5770 | 0 byte 0xaa | |
| 5771 | >1 byte <4 Dyalog APL | |
| 5772 | >>1 byte 0x00 incomplete workspace | |
| 5773 | >>1 byte 0x01 component file | |
| 5774 | >>1 byte 0x02 external variable | |
| 5775 | >>1 byte 0x03 workspace | |
| 5776 | >>2 byte x version %d | |
| 5777 | >>3 byte x .%d | |
| 5778 | ||
| 5779 | #------------------------------------------------------------------------------ | |
| 5780 | # palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks | |
| 5781 | # | |
| 5782 | # Brian Lalor <blalor@hcirisc.cs.binghamton.edu> | |
| 5783 | ||
| 5784 | # appl | |
| 5785 | 60 belong 0x6170706c PalmOS application | |
| 5786 | >0 string >\0 "%s" | |
| 5787 | # TEXt | |
| 5788 | 60 belong 0x54455874 AportisDoc file | |
| 5789 | >0 string >\0 "%s" | |
| 5790 | # HACK | |
| 5791 | 60 belong 0x4841434b HackMaster hack | |
| 5792 | >0 string >\0 "%s" | |
| 5793 | ||
| 5794 | # Variety of PalmOS document types | |
| 5795 | # Michael-John Turner <mj@debian.org> | |
| 5796 | # Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType | |
| 5797 | 60 string BVokBDIC BDicty PalmOS document | |
| 5798 | >0 string >\0 "%s" | |
| 5799 | 60 string DB99DBOS DB PalmOS document | |
| 5800 | >0 string >\0 "%s" | |
| 5801 | 60 string vIMGView FireViewer/ImageViewer PalmOS document | |
| 5802 | >0 string >\0 "%s" | |
| 5803 | 60 string PmDBPmDB HanDBase PalmOS document | |
| 5804 | >0 string >\0 "%s" | |
| 5805 | 60 string InfoINDB InfoView PalmOS document | |
| 5806 | >0 string >\0 "%s" | |
| 5807 | 60 string ToGoToGo iSilo PalmOS document | |
| 5808 | >0 string >\0 "%s" | |
| 5809 | 60 string JfDbJBas JFile PalmOS document | |
| 5810 | >0 string >\0 "%s" | |
| 5811 | 60 string JfDbJFil JFile Pro PalmOS document | |
| 5812 | >0 string >\0 "%s" | |
| 5813 | 60 string DATALSdb List PalmOS document | |
| 5814 | >0 string >\0 "%s" | |
| 5815 | 60 string Mdb1Mdb1 MobileDB PalmOS document | |
| 5816 | >0 string >\0 "%s" | |
| 5817 | 60 string PNRdPPrs PeanutPress PalmOS document | |
| 5818 | >0 string >\0 "%s" | |
| 5819 | 60 string DataPlkr Plucker PalmOS document | |
| 5820 | >0 string >\0 "%s" | |
| 5821 | 60 string DataSprd QuickSheet PalmOS document | |
| 5822 | >0 string >\0 "%s" | |
| 5823 | 60 string SM01SMem SuperMemo PalmOS document | |
| 5824 | >0 string >\0 "%s" | |
| 5825 | 60 string DataTlPt TealDoc PalmOS document | |
| 5826 | >0 string >\0 "%s" | |
| 5827 | 60 string InfoTlIf TealInfo PalmOS document | |
| 5828 | >0 string >\0 "%s" | |
| 5829 | 60 string DataTlMl TealMeal PalmOS document | |
| 5830 | >0 string >\0 "%s" | |
| 5831 | 60 string DataTlPt TealPaint PalmOS document | |
| 5832 | >0 string >\0 "%s" | |
| 5833 | 60 string dataTDBP ThinkDB PalmOS document | |
| 5834 | >0 string >\0 "%s" | |
| 5835 | 60 string TdatTide Tides PalmOS document | |
| 5836 | >0 string >\0 "%s" | |
| 5837 | 60 string ToRaTRPW TomeRaider PalmOS document | |
| 5838 | >0 string >\0 "%s" | |
| 5839 | ||
| 5840 | # A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net) | |
| 5841 | # For version 1.xx zTXTs, outputs version and numbers of bookmarks and | |
| 5842 | # annotations. | |
| 5843 | # For other versions, just outputs version. | |
| 5844 | # | |
| 5845 | 60 string zTXT A GutenPalm zTXT e-book | |
| 5846 | >0 string >\0 "%s" | |
| 5847 | >(0x4E.L) byte 0 | |
| 5848 | >>(0x4E.L+1) byte x (v0.%02d) | |
| 5849 | >(0x4E.L) byte 1 | |
| 5850 | >>(0x4E.L+1) byte x (v1.%02d) | |
| 5851 | >>>(0x4E.L+10) beshort >0 | |
| 5852 | >>>>(0x4E.L+10) beshort <2 - 1 bookmark | |
| 5853 | >>>>(0x4E.L+10) beshort >1 - %d bookmarks | |
| 5854 | >>>(0x4E.L+14) beshort >0 | |
| 5855 | >>>>(0x4E.L+14) beshort <2 - 1 annotation | |
| 5856 | >>>>(0x4E.L+14) beshort >1 - %d annotations | |
| 5857 | >(0x4E.L) byte >1 (v%d. | |
| 5858 | >>(0x4E.L+1) byte x %02d) | |
| 5859 | ||
| 5860 | # Palm OS .prc file types | |
| 5861 | 60 string libr Palm OS dynamic library data | |
| 5862 | >0 string >\0 "%s" | |
| 5863 | 60 string ptch Palm OS operating system patch data | |
| 5864 | >0 string >\0 "%s" | |
| 5865 | ||
| 5866 | # Mobipocket (www.mobipocket.com), donated by Carl Witty | |
| 5867 | 60 string BOOKMOBI Mobipocket E-book | |
| 5868 | >0 string >\0 "%s" | |
| 5869 | #------------------------------------------------------------------------------ | |
| 5870 | # pdf: file(1) magic for Portable Document Format | |
| 5871 | # | |
| 5872 | ||
| 5873 | 0 string %PDF- PDF document | |
| 5874 | >5 byte x \b, version %c | |
| 5875 | >7 byte x \b.%c | |
| 5876 | ||
| 5877 | #------------------------------------------------------------------------------ | |
| 5878 | # vorbis: file(1) magic for Ogg/Vorbis files | |
| 5879 | # | |
| 5880 | # From Felix von Leitner <leitner@fefe.de> | |
| 5881 | # Extended by Beni Cherniavsky <cben@crosswinds.net> | |
| 5882 | # Further extended by Greg Wooledge <greg@wooledge.org> | |
| 5883 | # | |
| 5884 | # Most (everything but the number of channels and bitrate) is commented | |
| 5885 | # out with `##' as it's not interesting to the average user. The most | |
| 5886 | # probable things advanced users would want to uncomment are probably | |
| 5887 | # the number of comments and the encoder version. | |
| 5888 | # | |
| 5889 | # --- Ogg Framing --- | |
| 5890 | 0 string OggS Ogg data | |
| 5891 | >4 byte !0 UNKNOWN REVISION %u | |
| 5892 | ##>4 byte 0 revision 0 | |
| 5893 | >4 byte 0 | |
| 5894 | ##>>14 lelong x (Serial %lX) | |
| 5895 | # non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net) | |
| 5896 | >>28 string fLaC \b, FLAC audio | |
| 5897 | # non-Vorbis content: Theora | |
| 5898 | >>28 string \x80theora \b, Theora video | |
| 5899 | # non-Vorbis content: Speex | |
| 5900 | >>28 string Speex\ \ \ \b, Speex audio | |
| 5901 | # non-Vorbis content: OGM | |
| 5902 | >>28 string \x01video\0\0\0 \b, OGM video | |
| 5903 | >>>37 string/c div3 (DivX 3) | |
| 5904 | >>>37 string/c divx (DivX 4) | |
| 5905 | >>>37 string/c dx50 (DivX 5) | |
| 5906 | >>>37 string/c xvid (XviD) | |
| 5907 | # --- First vorbis packet - general header --- | |
| 5908 | >>28 string \x01vorbis \b, Vorbis audio, | |
| 5909 | >>>35 lelong !0 UNKNOWN VERSION %lu, | |
| 5910 | ##>>>35 lelong 0 version 0, | |
| 5911 | >>>35 lelong 0 | |
| 5912 | >>>>39 ubyte 1 mono, | |
| 5913 | >>>>39 ubyte 2 stereo, | |
| 5914 | >>>>39 ubyte >2 %u channels, | |
| 5915 | >>>>40 lelong x %lu Hz | |
| 5916 | # Minimal, nominal and maximal bitrates specified when encoding | |
| 5917 | >>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b, | |
| 5918 | # The above tests if at least one of these is specified: | |
| 5919 | >>>>>52 lelong !-1 | |
| 5920 | # Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields | |
| 5921 | # instead of -1. | |
| 5922 | # Vorbis 1.0 uses 0 instead of -1. | |
| 5923 | >>>>>>52 lelong !0 | |
| 5924 | >>>>>>>52 lelong !-1000 | |
| 5925 | >>>>>>>>52 lelong x <%lu | |
| 5926 | >>>>>48 lelong !-1 | |
| 5927 | >>>>>>48 lelong x ~%lu | |
| 5928 | >>>>>44 lelong !-1 | |
| 5929 | >>>>>>44 lelong !-1000 | |
| 5930 | >>>>>>>44 lelong !0 | |
| 5931 | >>>>>>>>44 lelong x >%lu | |
| 5932 | >>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps | |
| 5933 | # -- Second vorbis header packet - the comments | |
| 5934 | # A kludge to read the vendor string. It's a counted string, not a | |
| 5935 | # zero-terminated one, so file(1) can't read it in a generic way. | |
| 5936 | # libVorbis is the only one existing currently, so I detect specifically | |
| 5937 | # it. The interesting value is the cvs date (8 digits decimal). | |
| 5938 | # Post-RC1 Ogg files have the second header packet (and thus the version) | |
| 5939 | # in a different place, so we must use an indirect offset. | |
| 5940 | >>>(84.b+85) string \x03vorbis | |
| 5941 | >>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I | |
| 5942 | >>>>>(84.b+120) string >00000000 | |
| 5943 | # Map to beta version numbers: | |
| 5944 | >>>>>>(84.b+120) string <20000508 (<beta1, prepublic) | |
| 5945 | >>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2) | |
| 5946 | >>>>>>(84.b+120) string >20000508 | |
| 5947 | >>>>>>>(84.b+120) string <20001031 (beta2-3) | |
| 5948 | >>>>>>(84.b+120) string 20001031 (1.0 beta 3) | |
| 5949 | >>>>>>(84.b+120) string >20001031 | |
| 5950 | >>>>>>>(84.b+120) string <20010225 (beta3-4) | |
| 5951 | >>>>>>(84.b+120) string 20010225 (1.0 beta 4) | |
| 5952 | >>>>>>(84.b+120) string >20010225 | |
| 5953 | >>>>>>>(84.b+120) string <20010615 (beta4-RC1) | |
| 5954 | >>>>>>(84.b+120) string 20010615 (1.0 RC1) | |
| 5955 | >>>>>>(84.b+120) string 20010813 (1.0 RC2) | |
| 5956 | >>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1) | |
| 5957 | >>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2) | |
| 5958 | >>>>>>(84.b+120) string 20011217 (1.0 RC3) | |
| 5959 | >>>>>>(84.b+120) string 20011231 (1.0 RC3) | |
| 5960 | # Some pre-1.0 CVS snapshots still had "Xiphphorus"... | |
| 5961 | >>>>>>(84.b+120) string >20011231 (pre-1.0 CVS) | |
| 5962 | # For the 1.0 release, Xiphophorus is replaced by Xiph.Org | |
| 5963 | >>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I | |
| 5964 | >>>>>(84.b+117) string >00000000 | |
| 5965 | >>>>>>(84.b+117) string <20020717 (pre-1.0 CVS) | |
| 5966 | >>>>>>(84.b+117) string 20020717 (1.0) | |
| 5967 | >>>>>>(84.b+117) string 20030909 (1.0.1) | |
| 5968 | >>>>>>(84.b+117) string 20040629 (1.1.0 RC1) | |
| 5969 | ||
| 5970 | #----------------------------------------------- | |
| 5971 | # GNU Smalltalk image, starting at version 1.6.2 | |
| 5972 | # From: catull_us@yahoo.com | |
| 5973 | # | |
| 5974 | 0 string GSTIm\0\0 GNU SmallTalk | |
| 5975 | # little-endian | |
| 5976 | >7 byte&1 =0 LE image version | |
| 5977 | >>10 byte x %d. | |
| 5978 | >>9 byte x \b%d. | |
| 5979 | >>8 byte x \b%d | |
| 5980 | #>>12 lelong x , data: %ld | |
| 5981 | #>>16 lelong x , table: %ld | |
| 5982 | #>>20 lelong x , memory: %ld | |
| 5983 | # big-endian | |
| 5984 | >7 byte&1 =1 BE image version | |
| 5985 | >>8 byte x %d. | |
| 5986 | >>9 byte x \b%d. | |
| 5987 | >>10 byte x \b%d | |
| 5988 | #>>12 belong x , data: %ld | |
| 5989 | #>>16 belong x , table: %ld | |
| 5990 | #>>20 belong x , memory: %ld | |
| 5991 | ||
| 5992 | ||
| 5993 | ||
| 5994 | #------------------------------------------------------------------------------ | |
| 5995 | # sgml: file(1) magic for Standard Generalized Markup Language | |
| 5996 | # HyperText Markup Language (HTML) is an SGML document type, | |
| 5997 | # from Daniel Quinlan (quinlan@yggdrasil.com) | |
| 5998 | # adapted to string extenstions by Anthon van der Neut <anthon@mnt.org) | |
| 5999 | 0 string/cB \<!DOCTYPE\ html HTML document text | |
| 6000 | 0 string/cb \<head HTML document text | |
| 6001 | 0 string/cb \<title HTML document text | |
| 6002 | 0 string/cb \<html HTML document text | |
| 6003 | ||
| 6004 | # Extensible markup language (XML), a subset of SGML | |
| 6005 | # from Marc Prud'hommeaux (marc@apocalypse.org) | |
| 6006 | 0 string/cb \<?xml XML document text | |
| 6007 | 0 string \<?xml\ version " XML | |
| 6008 | 0 string \<?xml\ version=" XML | |
| 6009 | >15 string >\0 %.3s document text | |
| 6010 | >>23 string \<xsl:stylesheet (XSL stylesheet) | |
| 6011 | >>24 string \<xsl:stylesheet (XSL stylesheet) | |
| 6012 | 0 string/b \<?xml XML document text | |
| 6013 | 0 string/cb \<?xml broken XML document text | |
| 6014 | ||
| 6015 | ||
| 6016 | # SGML, mostly from rph@sq | |
| 6017 | 0 string/cb \<!doctype exported SGML document text | |
| 6018 | 0 string/cb \<!subdoc exported SGML subdocument text | |
| 6019 | 0 string/cb \<!-- exported SGML document text | |
| 6020 | ||
| 6021 | # Web browser cookie files | |
| 6022 | # (Mozilla, Galeon, Netscape 4, Konqueror..) | |
| 6023 | # Ulf Harnhammar <ulfh@update.uu.se> | |
| 6024 | 0 string #\ HTTP\ Cookie\ File Web browser cookie text | |
| 6025 | 0 string #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text | |
| 6026 | 0 string #\ KDE\ Cookie\ File Konqueror cookie text | |
| 6027 | ||
| 6028 | #------------------------------------------------------------------------------ | |
| 6029 | # msvc: file(1) magic for msvc | |
| 6030 | # "H. Nanosecond" <aldomel@ix.netcom.com> | |
| 6031 | # Microsoft visual C | |
| 6032 | # | |
| 6033 | # I have version 1.0 | |
| 6034 | ||
| 6035 | # .aps | |
| 6036 | 0 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file | |
| 6037 | ||
| 6038 | # .ide | |
| 6039 | #too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide | |
| 6040 | 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide | |
| 6041 | ||
| 6042 | # .res | |
| 6043 | 0 string \000\000\000\000\040\000\000\000\377 MSVC .res | |
| 6044 | 0 string \377\003\000\377\001\000\020\020\350 MSVC .res | |
| 6045 | 0 string \377\003\000\377\001\000\060\020\350 MSVC .res | |
| 6046 | ||
| 6047 | #.lib | |
| 6048 | 0 string \360\015\000\000 Microsoft Visual C library | |
| 6049 | 0 string \360\075\000\000 Microsoft Visual C library | |
| 6050 | 0 string \360\175\000\000 Microsoft Visual C library | |
| 6051 | ||
| 6052 | #.pch | |
| 6053 | 0 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch | |
| 6054 | ||
| 6055 | # .pdb | |
| 6056 | # too long 0 string Microsoft\ C/C++\ program\ database\ | |
| 6057 | 0 string Microsoft\ C/C++\ MSVC program database | |
| 6058 | >18 string program\ database\ | |
| 6059 | >33 string >\0 ver %s | |
| 6060 | ||
| 6061 | #.sbr | |
| 6062 | 0 string \000\002\000\007\000 MSVC .sbr | |
| 6063 | >5 string >\0 %s | |
| 6064 | ||
| 6065 | #.bsc | |
| 6066 | 0 string \002\000\002\001 MSVC .bsc | |
| 6067 | ||
| 6068 | #.wsp | |
| 6069 | 0 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000 | |
| 6070 | # these seem to start with the version and contain menus | |
| 6071 | ||
| 6072 | #------------------------------------------------------------------------------ | |
| 6073 | # news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews") | |
| 6074 | # | |
| 6075 | 0 string StartFontMetrics ASCII font metrics | |
| 6076 | 0 string StartFont ASCII font bits | |
| 6077 | 0 belong 0x137A2944 NeWS bitmap font | |
| 6078 | 0 belong 0x137A2947 NeWS font family | |
| 6079 | 0 belong 0x137A2950 scalable OpenFont binary | |
| 6080 | 0 belong 0x137A2951 encrypted scalable OpenFont binary | |
| 6081 | 8 belong 0x137A2B45 X11/NeWS bitmap font | |
| 6082 | 8 belong 0x137A2B48 X11/NeWS font family | |
| 6083 | ||
| 6084 | # ----------------------------------------------------------- | |
| 6085 | # VMware specific files (deducted from version 1.1 and log file entries) | |
| 6086 | # Anthon van der Neut (anthon@mnt.org) | |
| 6087 | 0 belong 0x4d52564e VMware nvram | |
| 6088 | 0 belong 0x434f5744 VMware | |
| 6089 | >4 byte 3 virtual disk | |
| 6090 | >>32 lelong x (%d/ | |
| 6091 | >>36 lelong x \b%d/ | |
| 6092 | >>40 lelong x \b%d) | |
| 6093 | >4 byte 2 undoable disk | |
| 6094 | >>32 string >\0 (%s) | |
| 6095 | ||
| 6096 | #------------------------------------------------------------------------------ | |
| 6097 | # diamond: file(1) magic for Diamond system | |
| 6098 | # | |
| 6099 | # ... diamond is a multi-media mail and electronic conferencing system.... | |
| 6100 | # | |
| 6101 | # XXX - I think it was either renamed Slate, or replaced by Slate.... | |
| 6102 | # | |
| 6103 | # The full deal is too long... | |
| 6104 | #0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document | |
| 6105 | 0 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document | |
| 6106 | ||
| 6107 | #------------------------------------------------------------------------------ | |
| 6108 | # dump: file(1) magic for dump file format--for new and old dump filesystems | |
| 6109 | # | |
| 6110 | # We specify both byte orders in order to recognize byte-swapped dumps. | |
| 6111 | # | |
| 6112 | 24 belong 60012 new-fs dump file (big endian), | |
| 6113 | >4 bedate x Previous dump %s, | |
| 6114 | >8 bedate x This dump %s, | |
| 6115 | >12 belong >0 Volume %ld, | |
| 6116 | >692 belong 0 Level zero, type: | |
| 6117 | >692 belong >0 Level %d, type: | |
| 6118 | >0 belong 1 tape header, | |
| 6119 | >0 belong 2 beginning of file record, | |
| 6120 | >0 belong 3 map of inodes on tape, | |
| 6121 | >0 belong 4 continuation of file record, | |
| 6122 | >0 belong 5 end of volume, | |
| 6123 | >0 belong 6 map of inodes deleted, | |
| 6124 | >0 belong 7 end of medium (for floppy), | |
| 6125 | >676 string >\0 Label %s, | |
| 6126 | >696 string >\0 Filesystem %s, | |
| 6127 | >760 string >\0 Device %s, | |
| 6128 | >824 string >\0 Host %s, | |
| 6129 | >888 belong >0 Flags %x | |
| 6130 | ||
| 6131 | 24 belong 60011 old-fs dump file (big endian), | |
| 6132 | #>4 bedate x Previous dump %s, | |
| 6133 | #>8 bedate x This dump %s, | |
| 6134 | >12 belong >0 Volume %ld, | |
| 6135 | >692 belong 0 Level zero, type: | |
| 6136 | >692 belong >0 Level %d, type: | |
| 6137 | >0 belong 1 tape header, | |
| 6138 | >0 belong 2 beginning of file record, | |
| 6139 | >0 belong 3 map of inodes on tape, | |
| 6140 | >0 belong 4 continuation of file record, | |
| 6141 | >0 belong 5 end of volume, | |
| 6142 | >0 belong 6 map of inodes deleted, | |
| 6143 | >0 belong 7 end of medium (for floppy), | |
| 6144 | >676 string >\0 Label %s, | |
| 6145 | >696 string >\0 Filesystem %s, | |
| 6146 | >760 string >\0 Device %s, | |
| 6147 | >824 string >\0 Host %s, | |
| 6148 | >888 belong >0 Flags %x | |
| 6149 | ||
| 6150 | 24 lelong 60012 new-fs dump file (little endian), | |
| 6151 | >4 ledate x This dump %s, | |
| 6152 | >8 ledate x Previous dump %s, | |
| 6153 | >12 lelong >0 Volume %ld, | |
| 6154 | >692 lelong 0 Level zero, type: | |
| 6155 | >692 lelong >0 Level %d, type: | |
| 6156 | >0 lelong 1 tape header, | |
| 6157 | >0 lelong 2 beginning of file record, | |
| 6158 | >0 lelong 3 map of inodes on tape, | |
| 6159 | >0 lelong 4 continuation of file record, | |
| 6160 | >0 lelong 5 end of volume, | |
| 6161 | >0 lelong 6 map of inodes deleted, | |
| 6162 | >0 lelong 7 end of medium (for floppy), | |
| 6163 | >676 string >\0 Label %s, | |
| 6164 | >696 string >\0 Filesystem %s, | |
| 6165 | >760 string >\0 Device %s, | |
| 6166 | >824 string >\0 Host %s, | |
| 6167 | >888 lelong >0 Flags %x | |
| 6168 | ||
| 6169 | 24 lelong 60011 old-fs dump file (little endian), | |
| 6170 | #>4 ledate x Previous dump %s, | |
| 6171 | #>8 ledate x This dump %s, | |
| 6172 | >12 lelong >0 Volume %ld, | |
| 6173 | >692 lelong 0 Level zero, type: | |
| 6174 | >692 lelong >0 Level %d, type: | |
| 6175 | >0 lelong 1 tape header, | |
| 6176 | >0 lelong 2 beginning of file record, | |
| 6177 | >0 lelong 3 map of inodes on tape, | |
| 6178 | >0 lelong 4 continuation of file record, | |
| 6179 | >0 lelong 5 end of volume, | |
| 6180 | >0 lelong 6 map of inodes deleted, | |
| 6181 | >0 lelong 7 end of medium (for floppy), | |
| 6182 | >676 string >\0 Label %s, | |
| 6183 | >696 string >\0 Filesystem %s, | |
| 6184 | >760 string >\0 Device %s, | |
| 6185 | >824 string >\0 Host %s, | |
| 6186 | >888 lelong >0 Flags %x | |
| 6187 | ||
| 6188 | #------------------------------------------------------------------------------ | |
| 6189 | # linux: file(1) magic for Linux files | |
| 6190 | # | |
| 6191 | # Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> | |
| 6192 | # The following basic Linux magic is useful for reference, but using | |
| 6193 | # "long" magic is a better practice in order to avoid collisions. | |
| 6194 | # | |
| 6195 | # 2 leshort 100 Linux/i386 | |
| 6196 | # >0 leshort 0407 impure executable (OMAGIC) | |
| 6197 | # >0 leshort 0410 pure executable (NMAGIC) | |
| 6198 | # >0 leshort 0413 demand-paged executable (ZMAGIC) | |
| 6199 | # >0 leshort 0314 demand-paged executable (QMAGIC) | |
| 6200 | # | |
| 6201 | 0 lelong 0x00640107 Linux/i386 impure executable (OMAGIC) | |
| 6202 | >16 lelong 0 \b, stripped | |
| 6203 | 0 lelong 0x00640108 Linux/i386 pure executable (NMAGIC) | |
| 6204 | >16 lelong 0 \b, stripped | |
| 6205 | 0 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC) | |
| 6206 | >16 lelong 0 \b, stripped | |
| 6207 | 0 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC) | |
| 6208 | >16 lelong 0 \b, stripped | |
| 6209 | # | |
| 6210 | 0 string \007\001\000 Linux/i386 object file | |
| 6211 | >20 lelong >0x1020 \b, DLL library | |
| 6212 | # Linux-8086 stuff: | |
| 6213 | 0 string \01\03\020\04 Linux-8086 impure executable | |
| 6214 | >28 long !0 not stripped | |
| 6215 | 0 string \01\03\040\04 Linux-8086 executable | |
| 6216 | >28 long !0 not stripped | |
| 6217 | # | |
| 6218 | 0 string \243\206\001\0 Linux-8086 object file | |
| 6219 | # | |
| 6220 | 0 string \01\03\020\20 Minix-386 impure executable | |
| 6221 | >28 long !0 not stripped | |
| 6222 | 0 string \01\03\040\20 Minix-386 executable | |
| 6223 | >28 long !0 not stripped | |
| 6224 | # core dump file, from Bill Reynolds <bill@goshawk.lanl.gov> | |
| 6225 | 216 lelong 0421 Linux/i386 core file | |
| 6226 | >220 string >\0 of '%s' | |
| 6227 | >200 lelong >0 (signal %d) | |
| 6228 | # | |
| 6229 | # LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com> | |
| 6230 | # this can be overridden by the DOS executable (COM) entry | |
| 6231 | 2 string LILO Linux/i386 LILO boot/chain loader | |
| 6232 | # | |
| 6233 | # PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> | |
| 6234 | 0 leshort 0x0436 Linux/i386 PC Screen Font data, | |
| 6235 | >2 byte 0 256 characters, no directory, | |
| 6236 | >2 byte 1 512 characters, no directory, | |
| 6237 | >2 byte 2 256 characters, Unicode directory, | |
| 6238 | >2 byte 3 512 characters, Unicode directory, | |
| 6239 | >3 byte >0 8x%d | |
| 6240 | # Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com> | |
| 6241 | 4086 string SWAP-SPACE Linux/i386 swap file | |
| 6242 | # according to man page of mkswap (8) March 1999 | |
| 6243 | 4086 string SWAPSPACE2 Linux/i386 swap file (new style) | |
| 6244 | >0x400 long x %d (4K pages) | |
| 6245 | >0x404 long x size %d pages | |
| 6246 | # ECOFF magic for OSF/1 and Linux (only tested under Linux though) | |
| 6247 | # | |
| 6248 | # from Erik Troan (ewt@redhat.com) examining od dumps, so this | |
| 6249 | # could be wrong | |
| 6250 | # updated by David Mosberger (davidm@azstarnet.com) based on | |
| 6251 | # GNU BFD and MIPS info found below. | |
| 6252 | # | |
| 6253 | 0 leshort 0x0183 ECOFF alpha | |
| 6254 | >24 leshort 0407 executable | |
| 6255 | >24 leshort 0410 pure | |
| 6256 | >24 leshort 0413 demand paged | |
| 6257 | >8 long >0 not stripped | |
| 6258 | >8 long 0 stripped | |
| 6259 | >23 leshort >0 - version %ld. | |
| 6260 | # | |
| 6261 | # Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu> | |
| 6262 | # and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de> | |
| 6263 | # and Nicolás Lichtmaier <nick@debian.org> | |
| 6264 | # All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 | |
| 6265 | # Linux kernel boot images (i386 arch) (Wolfram Kleff) | |
| 6266 | 514 string HdrS Linux kernel | |
| 6267 | >510 leshort 0xAA55 x86 boot executable | |
| 6268 | >>518 leshort >=3D0x200 | |
| 6269 | >>529 byte 0 zImage, | |
| 6270 | >>>529 byte 1 bzImage, | |
| 6271 | >>>(526.s+0x200) string >\0 version %s, | |
| 6272 | >>498 leshort 1 RO-rootFS, | |
| 6273 | >>498 leshort 0 RW-rootFS, | |
| 6274 | >>508 leshort >0 root_dev 0x%X, | |
| 6275 | >>502 leshort >0 swap_dev 0x%X, | |
| 6276 | >>504 leshort >0 RAMdisksize %u KB, | |
| 6277 | >>506 leshort 0xFFFF Normal VGA | |
| 6278 | >>506 leshort 0xFFFE Extended VGA | |
| 6279 | >>506 leshort 0xFFFD Prompt for Videomode | |
| 6280 | >>506 leshort >0 Video mode %d | |
| 6281 | # This also matches new kernels, which were caught above by "HdrS". | |
| 6282 | 0 belong 0xb8c0078e Linux kernel | |
| 6283 | >0x1e3 string Loading version 1.3.79 or older | |
| 6284 | >0x1e9 string Loading from prehistoric times | |
| 6285 | ||
| 6286 | # System.map files - Nicolás Lichtmaier <nick@debian.org> | |
| 6287 | 8 string \ A\ _text Linux kernel symbol map text | |
| 6288 | ||
| 6289 | # LSM entries - Nicolás Lichtmaier <nick@debian.org> | |
| 6290 | 0 string Begin3 Linux Software Map entry text | |
| 6291 | 0 string Begin4 Linux Software Map entry text (new format) | |
| 6292 | ||
| 6293 | # From Matt Zimmerman | |
| 6294 | 0 belong 0x4f4f4f4d User-mode Linux COW file | |
| 6295 | >4 belong x \b, version %d | |
| 6296 | >8 string >\0 \b, backing file %s | |
| 6297 | ||
| 6298 | ############################################################################ | |
| 6299 | # Linux kernel versions | |
| 6300 | ||
| 6301 | 0 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux | |
| 6302 | >497 leshort 0 x86 boot sector | |
| 6303 | >>514 belong 0x8e of a kernel from the dawn of time! | |
| 6304 | >>514 belong 0x908ed8b4 version 0.99-1.1.42 | |
| 6305 | >>514 belong 0x908ed8b8 for memtest86 | |
| 6306 | ||
| 6307 | >497 leshort !0 x86 kernel | |
| 6308 | >>504 leshort >0 RAMdisksize=%u KB | |
| 6309 | >>502 leshort >0 swap=0x%X | |
| 6310 | >>508 leshort >0 root=0x%X | |
| 6311 | >>>498 leshort 1 \b-ro | |
| 6312 | >>>498 leshort 0 \b-rw | |
| 6313 | >>506 leshort 0xFFFF vga=normal | |
| 6314 | >>506 leshort 0xFFFE vga=extended | |
| 6315 | >>506 leshort 0xFFFD vga=ask | |
| 6316 | >>506 leshort >0 vga=%d | |
| 6317 | >>514 belong 0x908ed881 version 1.1.43-1.1.45 | |
| 6318 | >>514 belong 0x15b281cd | |
| 6319 | >>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0 | |
| 6320 | >>>0xa99 belong 0x55AA5a5a version 1.3.1,2 | |
| 6321 | >>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30 | |
| 6322 | >>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41 | |
| 6323 | >>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45 | |
| 6324 | >>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72 | |
| 6325 | >>514 string HdrS | |
| 6326 | >>>518 leshort >0x1FF | |
| 6327 | >>>>529 byte 0 \b, zImage | |
| 6328 | >>>>529 byte 1 \b, bzImage | |
| 6329 | >>>>(526.s+0x200) string >\0 \b, version %s | |
| 6330 | ||
| 6331 | # Linux boot sector thefts. | |
| 6332 | 0 belong 0xb8c0078e Linux | |
| 6333 | >0x1e6 belong 0x454c4b53 ELKS Kernel | |
| 6334 | >0x1e6 belong !0x454c4b53 style boot sector | |
| 6335 | ||
| 6336 | ############################################################################ | |
| 6337 | # Linux 8086 executable | |
| 6338 | 0 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless | |
| 6339 | >5 string . | |
| 6340 | >>4 string >\0 \b, libc version %s | |
| 6341 | ||
| 6342 | 0 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable | |
| 6343 | >2 byte&0x01 !0 \b, unmapped zero page | |
| 6344 | >2 byte&0x20 0 \b, impure | |
| 6345 | >2 byte&0x20 !0 | |
| 6346 | >>2 byte&0x10 !0 \b, A_EXEC | |
| 6347 | >2 byte&0x02 !0 \b, A_PAL | |
| 6348 | >2 byte&0x04 !0 \b, A_NSYM | |
| 6349 | >2 byte&0x08 !0 \b, A_STAND | |
| 6350 | >2 byte&0x40 !0 \b, A_PURE | |
| 6351 | >2 byte&0x80 !0 \b, A_TOVLY | |
| 6352 | >28 long !0 \b, not stripped | |
| 6353 | >37 string . | |
| 6354 | >>36 string >\0 \b, libc version %s | |
| 6355 | ||
| 6356 | # 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable | |
| 6357 | # 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable | |
| 6358 | # 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable | |
| 6359 | # 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable | |
| 6360 | ||
| 6361 | # SYSLINUX boot logo files (from 'ppmtolss16' sources) | |
| 6362 | # http://syslinux.zytor.com/ | |
| 6363 | # | |
| 6364 | 0 lelong =0x1413f33d SYSLINUX' LSS16 image data | |
| 6365 | >4 leshort x \b, width %d | |
| 6366 | >6 leshort x \b, height %d | |
| 6367 | #------------------------------------------------------------------------------ | |
| 6368 | # mime: file(1) magic for MIME encoded files | |
| 6369 | # | |
| 6370 | 0 string Content-Type:\ | |
| 6371 | >14 string >\0 %s | |
| 6372 | 0 string Content-Type: | |
| 6373 | >13 string >\0 %s | |
| 6374 | ||
| 6375 | #------------------------------------------------------------------------------ | |
| 6376 | # zilog: file(1) magic for Zilog Z8000. | |
| 6377 | # | |
| 6378 | # Was it big-endian or little-endian? My Product Specification doesn't | |
| 6379 | # say. | |
| 6380 | # | |
| 6381 | 0 long 0xe807 object file (z8000 a.out) | |
| 6382 | 0 long 0xe808 pure object file (z8000 a.out) | |
| 6383 | 0 long 0xe809 separate object file (z8000 a.out) | |
| 6384 | 0 long 0xe805 overlay object file (z8000 a.out) | |
| 6385 | ||
| 6386 | #------------------------------------------------------------------------------ | |
| 6387 | # sgi: file(1) magic for Silicon Graphics applications | |
| 6388 | ||
| 6389 | # | |
| 6390 | # | |
| 6391 | # Performance Co-Pilot file types | |
| 6392 | 0 string PmNs PCP compiled namespace (V.0) | |
| 6393 | 0 string PmN PCP compiled namespace | |
| 6394 | >3 string >\0 (V.%1.1s) | |
| 6395 | 3 lelong 0x84500526 PCP archive | |
| 6396 | >7 byte x (V.%d) | |
| 6397 | >20 lelong -2 temporal index | |
| 6398 | >20 lelong -1 metadata | |
| 6399 | >20 lelong 0 log volume #0 | |
| 6400 | >20 lelong >0 log volume #%ld | |
| 6401 | >24 string >\0 host: %s | |
| 6402 | 0 string PCPFolio PCP | |
| 6403 | >9 string Version: Archive Folio | |
| 6404 | >18 string >\0 (V.%s) | |
| 6405 | 0 string #pmchart PCP pmchart view | |
| 6406 | >9 string Version | |
| 6407 | >17 string >\0 (V%-3.3s) | |
| 6408 | 0 string pmview PCP pmview config | |
| 6409 | >7 string Version | |
| 6410 | >15 string >\0 (V%-3.3s) | |
| 6411 | 0 string #pmlogger PCP pmlogger config | |
| 6412 | >10 string Version | |
| 6413 | >18 string >\0 (V%1.1s) | |
| 6414 | 0 string PcPh PCP Help | |
| 6415 | >4 string 1 Index | |
| 6416 | >4 string 2 Text | |
| 6417 | >5 string >\0 (V.%1.1s) | |
| 6418 | 0 string #pmieconf-rules PCP pmieconf rules | |
| 6419 | >16 string >\0 (V.%1.1s) | |
| 6420 | 3 string pmieconf-pmie PCP pmie config | |
| 6421 | >17 string >\0 (V.%1.1s) | |
| 6422 | ||
| 6423 | # SpeedShop data files | |
| 6424 | 0 lelong 0x13130303 SpeedShop data file | |
| 6425 | ||
| 6426 | # mdbm files | |
| 6427 | 0 lelong 0x01023962 mdbm file, version 0 (obsolete) | |
| 6428 | 0 string mdbm mdbm file, | |
| 6429 | >5 byte x version %d, | |
| 6430 | >6 byte x 2^%d pages, | |
| 6431 | >7 byte x pagesize 2^%d, | |
| 6432 | >17 byte x hash %d, | |
| 6433 | >11 byte x dataformat %d | |
| 6434 | ||
| 6435 | # Alias|Wavefront Maya files | |
| 6436 | 0 string //Maya ASCII Alias|Wavefront Maya Ascii File, | |
| 6437 | >13 string >\0 version %s | |
| 6438 | 8 string MAYAFOR4 Alias|Wavefront Maya Binary File, | |
| 6439 | >32 string >\0 version %s scene | |
| 6440 | 8 string MayaFOR4 Alias|Wavefront Maya Binary File, | |
| 6441 | >32 string >\0 version %s scene | |
| 6442 | 8 string CIMG Alias|Wavefront Maya Image File | |
| 6443 | 8 string DEEP Alias|Wavefront Maya Image File | |
| 6444 | ||
| 6445 | #------------------------------------------------------------------------------ | |
| 6446 | # sequent: file(1) magic for Sequent machines | |
| 6447 | # | |
| 6448 | # Sequent information updated by Don Dwiggins <atsun!dwiggins>. | |
| 6449 | # For Sequent's multiprocessor systems (incomplete). | |
| 6450 | 0 lelong 0x00ea BALANCE NS32000 .o | |
| 6451 | >16 lelong >0 not stripped | |
| 6452 | >124 lelong >0 version %ld | |
| 6453 | 0 lelong 0x10ea BALANCE NS32000 executable (0 @ 0) | |
| 6454 | >16 lelong >0 not stripped | |
| 6455 | >124 lelong >0 version %ld | |
| 6456 | 0 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0) | |
| 6457 | >16 lelong >0 not stripped | |
| 6458 | >124 lelong >0 version %ld | |
| 6459 | 0 lelong 0x30ea BALANCE NS32000 standalone executable | |
| 6460 | >16 lelong >0 not stripped | |
| 6461 | >124 lelong >0 version %ld | |
| 6462 | # | |
| 6463 | # Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>. | |
| 6464 | # Symmetry magic nums will not be reached if DOS COM comes before them; | |
| 6465 | # byte 0xeb is matched before these get a chance. | |
| 6466 | 0 leshort 0x12eb SYMMETRY i386 .o | |
| 6467 | >16 lelong >0 not stripped | |
| 6468 | >124 lelong >0 version %ld | |
| 6469 | 0 leshort 0x22eb SYMMETRY i386 executable (0 @ 0) | |
| 6470 | >16 lelong >0 not stripped | |
| 6471 | >124 lelong >0 version %ld | |
| 6472 | 0 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0) | |
| 6473 | >16 lelong >0 not stripped | |
| 6474 | >124 lelong >0 version %ld | |
| 6475 | 0 leshort 0x42eb SYMMETRY i386 standalone executable | |
| 6476 | >16 lelong >0 not stripped | |
| 6477 | >124 lelong >0 version %ld | |
| 6478 | ||
| 6479 | #------------------------------------------------------------------------------ | |
| 6480 | # blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine | |
| 6481 | # | |
| 6482 | # Note that this 0407 conflicts with several other a.out formats... | |
| 6483 | # | |
| 6484 | # XXX - should this be redone with "be" and "le", so that it works on | |
| 6485 | # little-endian machines as well? If so, what's the deal with | |
| 6486 | # "VAX-order" and "VAX-order2"? | |
| 6487 | # | |
| 6488 | #0 long 0407 68K Blit (standalone) executable | |
| 6489 | #0 short 0407 VAX-order2 68K Blit (standalone) executable | |
| 6490 | 0 short 03401 VAX-order 68K Blit (standalone) executable | |
| 6491 | 0 long 0406 68k Blit mpx/mux executable | |
| 6492 | 0 short 0406 VAX-order2 68k Blit mpx/mux executable | |
| 6493 | 0 short 03001 VAX-order 68k Blit mpx/mux executable | |
| 6494 | # Need more values for WE32 DMD executables. | |
| 6495 | # Note that 0520 is the same as COFF | |
| 6496 | #0 short 0520 tty630 layers executable | |
| 6497 | #------------------------------------------------------------------------------ | |
| 6498 | # impulse tracker: file(1) magic for Impulse Tracker data files | |
| 6499 | # | |
| 6500 | # From <collver1@attbi.com> | |
| 6501 | # These are the /etc/magic entries to decode modules, instruments, and | |
| 6502 | # samples in Impulse Tracker's native format. | |
| 6503 | ||
| 6504 | 0 string IMPS Impulse Tracker Sample | |
| 6505 | >18 byte &2 16 bit | |
| 6506 | >18 byte ^2 8 bit | |
| 6507 | >18 byte &4 stereo | |
| 6508 | >18 byte ^4 mono | |
| 6509 | 0 string IMPI Impulse Tracker Instrument | |
| 6510 | >28 leshort !0 ITv%x | |
| 6511 | >30 byte !0 %d samples | |
| 6512 | 0 string IMPM Impulse Tracker Module | |
| 6513 | >40 leshort !0 compatible w/ITv%x | |
| 6514 | >42 leshort !0 created w/ITv%x | |
| 6515 | ||
| 6516 | #------------------------------------------------------------------------------ | |
| 6517 | # island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1 | |
| 6518 | # "/etc/magic": | |
| 6519 | # From: guy@netapp.com (Guy Harris) | |
| 6520 | # | |
| 6521 | 4 string pgscriptver IslandWrite document | |
| 6522 | 13 string DrawFile IslandDraw document | |
| 6523 | ||
| 6524 | ||
| 6525 | #------------------------------------------------------------------------------ | |
| 6526 | # maple: file(1) magic for maple files | |
| 6527 | # "H. Nanosecond" <aldomel@ix.netcom.com> | |
| 6528 | # Maple V release 4, a multi-purpose math program | |
| 6529 | # | |
| 6530 | ||
| 6531 | # maple library .lib | |
| 6532 | 0 string \000MVR4\nI MapleVr4 library | |
| 6533 | ||
| 6534 | # .ind | |
| 6535 | # no magic for these :-( | |
| 6536 | # they are compiled indexes for maple files | |
| 6537 | ||
| 6538 | # .hdb | |
| 6539 | 0 string \000\004\000\000 Maple help database | |
| 6540 | ||
| 6541 | # .mhp | |
| 6542 | # this has the form <PACKAGE=name> | |
| 6543 | 0 string \<PACKAGE= Maple help file | |
| 6544 | 0 string \<HELP\ NAME= Maple help file | |
| 6545 | 0 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck) | |
| 6546 | #0 string #\ Newton Maple help file, old style | |
| 6547 | 0 string #\ daub Maple help file, old style | |
| 6548 | #0 string #=========== Maple help file, old style | |
| 6549 | ||
| 6550 | # .mws | |
| 6551 | 0 string \000\000\001\044\000\221 Maple worksheet | |
| 6552 | #this is anomalous | |
| 6553 | 0 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird | |
| 6554 | # this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n | |
| 6555 | # that is {VERSION major_version miunor_version computer_type version_string} | |
| 6556 | 0 string {VERSION\ Maple worksheet | |
| 6557 | >9 string >\0 version %.1s. | |
| 6558 | >>10 string | |
| 6559 | >>>11 string >\0 %.1s | |
| 6560 | ||
| 6561 | # .mps | |
| 6562 | 0 string \0\0\001$ Maple something | |
| 6563 | # from byte 4 it is either 'nul E' or 'soh R' | |
| 6564 | # I think 'nul E' means a file that was saved as a different name | |
| 6565 | # a sort of revision marking | |
| 6566 | # 'soh R' means new | |
| 6567 | >4 string \000\105 An old revision | |
| 6568 | >4 string \001\122 The latest save | |
| 6569 | ||
| 6570 | # .mpl | |
| 6571 | # some of these are the same as .mps above | |
| 6572 | #0000000 000 000 001 044 000 105 same as .mps | |
| 6573 | #0000000 000 000 001 044 001 122 same as .mps | |
| 6574 | ||
| 6575 | 0 string #\n##\ <SHAREFILE= Maple something | |
| 6576 | 0 string \n#\n##\ <SHAREFILE= Maple something | |
| 6577 | 0 string ##\ <SHAREFILE= Maple something | |
| 6578 | 0 string #\r##\ <SHAREFILE= Maple something | |
| 6579 | 0 string \r#\r##\ <SHAREFILE= Maple something | |
| 6580 | 0 string #\ \r##\ <DESCRIBE> Maple something anomalous. | |
| 6581 | # | |
| 6582 | # Copyright (c) 1996 Ignatios Souvatzis. All rights reserved. | |
| 6583 | # | |
| 6584 | # Redistribution and use in source and binary forms, with or without | |
| 6585 | # modification, are permitted provided that the following conditions | |
| 6586 | # are met: | |
| 6587 | # 1. Redistributions of source code must retain the above copyright | |
| 6588 | # notice, this list of conditions and the following disclaimer. | |
| 6589 | # 2. Redistributions in binary form must reproduce the above copyright | |
| 6590 | # notice, this list of conditions and the following disclaimer in the | |
| 6591 | # documentation and/or other materials provided with the distribution. | |
| 6592 | # 3. All advertising materials mentioning features or use of this software | |
| 6593 | # must display the following acknowledgement: | |
| 6594 | # This product includes software developed by Ignatios Souvatzis for | |
| 6595 | # the NetBSD project. | |
| 6596 | # 4. The name of the author may not be used to endorse or promote products | |
| 6597 | # derived from this software without specific prior written permission. | |
| 6598 | # | |
| 6599 | # | |
| 6600 | # THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR | |
| 6601 | # IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | |
| 6602 | # OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | |
| 6603 | # IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, | |
| 6604 | # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, | |
| 6605 | # PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; | |
| 6606 | # OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, | |
| 6607 | # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR | |
| 6608 | # OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF | |
| 6609 | # ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | |
| 6610 | # | |
| 6611 | # | |
| 6612 | # | |
| 6613 | # OS9/6809 module descriptions: | |
| 6614 | # | |
| 6615 | 0 beshort 0x87CD OS9/6809 module: | |
| 6616 | # | |
| 6617 | >6 byte&0x0f 0x00 non-executable | |
| 6618 | >6 byte&0x0f 0x01 machine language | |
| 6619 | >6 byte&0x0f 0x02 BASIC I-code | |
| 6620 | >6 byte&0x0f 0x03 Pascal P-code | |
| 6621 | >6 byte&0x0f 0x04 C I-code | |
| 6622 | >6 byte&0x0f 0x05 COBOL I-code | |
| 6623 | >6 byte&0x0f 0x06 Fortran I-code | |
| 6624 | # | |
| 6625 | >6 byte&0xf0 0x10 program executable | |
| 6626 | >6 byte&0xf0 0x20 subroutine | |
| 6627 | >6 byte&0xf0 0x30 multi-module | |
| 6628 | >6 byte&0xf0 0x40 data module | |
| 6629 | # | |
| 6630 | >6 byte&0xf0 0xC0 system module | |
| 6631 | >6 byte&0xf0 0xD0 file manager | |
| 6632 | >6 byte&0xf0 0xE0 device driver | |
| 6633 | >6 byte&0xf0 0xF0 device descriptor | |
| 6634 | # | |
| 6635 | # OS9/m68k stuff (to be continued) | |
| 6636 | # | |
| 6637 | 0 beshort 0x4AFC OS9/68K module: | |
| 6638 | # | |
| 6639 | # attr | |
| 6640 | >0x14 byte&0x80 0x80 re-entrant | |
| 6641 | >0x14 byte&0x40 0x40 ghost | |
| 6642 | >0x14 byte&0x20 0x20 system-state | |
| 6643 | # | |
| 6644 | # lang: | |
| 6645 | # | |
| 6646 | >0x13 byte 1 machine language | |
| 6647 | >0x13 byte 2 BASIC I-code | |
| 6648 | >0x13 byte 3 Pascal P-code | |
| 6649 | >0x13 byte 4 C I-code | |
| 6650 | >0x13 byte 5 COBOL I-code | |
| 6651 | >0x13 byte 6 Fortran I-code | |
| 6652 | # | |
| 6653 | # | |
| 6654 | # type: | |
| 6655 | # | |
| 6656 | >0x12 byte 1 program executable | |
| 6657 | >0x12 byte 2 subroutine | |
| 6658 | >0x12 byte 3 multi-module | |
| 6659 | >0x12 byte 4 data module | |
| 6660 | >0x12 byte 11 trap library | |
| 6661 | >0x12 byte 12 system module | |
| 6662 | >0x12 byte 13 file manager | |
| 6663 | >0x12 byte 14 device driver | |
| 6664 | >0x12 byte 15 device descriptor | |
| 6665 | ||
| 6666 | #------------------------------------------------------------------------------ | |
| 6667 | # pkgadd: file(1) magic for SysV R4 PKG Datastreams | |
| 6668 | # | |
| 6669 | 0 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4) | |
| 6670 | ||
| 6671 | #------------------------------------------------------------------------------ | |
| 6672 | # xo65 object files | |
| 6673 | # From: "Ullrich von Bassewitz" <uz@cc65.org> | |
| 6674 | # | |
| 6675 | 0 string \x55\x7A\x6E\x61 xo65 object, | |
| 6676 | >4 leshort x version %d, | |
| 6677 | >6 leshort&0x0001 =0x0001 with debug info | |
| 6678 | >6 leshort&0x0001 =0x0000 no debug info | |
| 6679 | ||
| 6680 | # xo65 library files | |
| 6681 | 0 string \x6E\x61\x55\x7A xo65 library, | |
| 6682 | >4 leshort x version %d | |
| 6683 | ||
| 6684 | # o65 object files | |
| 6685 | 0 string \x01\x00\x6F\x36\x35 o65 | |
| 6686 | >6 leshort&0x1000 =0x0000 executable, | |
| 6687 | >6 leshort&0x1000 =0x1000 object, | |
| 6688 | >5 byte x version %d, | |
| 6689 | >6 leshort&0x8000 =0x8000 65816, | |
| 6690 | >6 leshort&0x8000 =0x0000 6502, | |
| 6691 | >6 leshort&0x2000 =0x2000 32 bit, | |
| 6692 | >6 leshort&0x2000 =0x0000 16 bit, | |
| 6693 | >6 leshort&0x4000 =0x4000 page reloc, | |
| 6694 | >6 leshort&0x4000 =0x0000 byte reloc, | |
| 6695 | >6 leshort&0x0003 =0x0000 alignment 1 | |
| 6696 | >6 leshort&0x0003 =0x0001 alignment 2 | |
| 6697 | >6 leshort&0x0003 =0x0002 alignment 4 | |
| 6698 | >6 leshort&0x0003 =0x0003 alignment 256 | |
| 6699 | #------------------------------------------------------------------------------ | |
| 6700 | # Virtutech Compressed Random Access File Format | |
| 6701 | # | |
| 6702 | # From <gustav@virtutech.com> | |
| 6703 | 0 string \211\277\036\203 Virtutech CRAFF | |
| 6704 | >4 belong x v%d | |
| 6705 | >20 belong 0 uncompressed | |
| 6706 | >20 belong 1 bzipp2ed | |
| 6707 | >20 belong 2 gzipped | |
| 6708 | >24 belong 0 not clean | |
| 6709 | ||
| 6710 | #------------------------------------------------------------------------------ | |
| 6711 | # uuencode: file(1) magic for ASCII-encoded files | |
| 6712 | # | |
| 6713 | ||
| 6714 | # GRR: the first line of xxencoded files is identical to that in uuencoded | |
| 6715 | # files, but the first character in most subsequent lines is 'h' instead of | |
| 6716 | # 'M'. (xxencoding uses lowercase letters in place of most of uuencode's | |
| 6717 | # punctuation and survives BITNET gateways better.) If regular expressions | |
| 6718 | # were supported, this entry could possibly be split into two with | |
| 6719 | # "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs). | |
| 6720 | 0 string begin\040 uuencoded or xxencoded text | |
| 6721 | ||
| 6722 | # btoa(1) is an alternative to uuencode that requires less space. | |
| 6723 | 0 string xbtoa\ Begin btoa'd text | |
| 6724 | ||
| 6725 | # ship(1) is another, much cooler alternative to uuencode. | |
| 6726 | # Greg Roelofs, newt@uchicago.edu | |
| 6727 | 0 string $\012ship ship'd binary text | |
| 6728 | ||
| 6729 | # bencode(8) is used to encode compressed news batches (Bnews/Cnews only?) | |
| 6730 | # Greg Roelofs, newt@uchicago.edu | |
| 6731 | 0 string Decode\ the\ following\ with\ bdeco bencoded News text | |
| 6732 | ||
| 6733 | # BinHex is the Macintosh ASCII-encoded file format (see also "apple") | |
| 6734 | # Daniel Quinlan, quinlan@yggdrasil.com | |
| 6735 | 11 string must\ be\ converted\ with\ BinHex BinHex binary text | |
| 6736 | >41 string x \b, version %.3s | |
| 6737 | ||
| 6738 | # GRR: is MIME BASE64 encoding handled somewhere? | |
| 6739 | #------------------------------------------------------------------------------ | |
| 6740 | # amanda: file(1) magic for amanda file format | |
| 6741 | # | |
| 6742 | 0 string AMANDA:\ AMANDA | |
| 6743 | >8 string TAPESTART\ DATE tape header file, | |
| 6744 | >>23 string X | |
| 6745 | >>>25 string >\ Unused %s | |
| 6746 | >>23 string >\ DATE %s | |
| 6747 | >8 string FILE\ dump file, | |
| 6748 | >>13 string >\ DATE %s | |
| 6749 | ||
| 6750 | #------------------------------------------------------------------------------ | |
| 6751 | # audio: file(1) magic for sound formats (see also "iff") | |
| 6752 | # | |
| 6753 | # Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com), | |
| 6754 | # and others | |
| 6755 | # | |
| 6756 | ||
| 6757 | # Sun/NeXT audio data | |
| 6758 | 0 string .snd Sun/NeXT audio data: | |
| 6759 | >12 belong 1 8-bit ISDN mu-law, | |
| 6760 | >12 belong 2 8-bit linear PCM [REF-PCM], | |
| 6761 | >12 belong 3 16-bit linear PCM, | |
| 6762 | >12 belong 4 24-bit linear PCM, | |
| 6763 | >12 belong 5 32-bit linear PCM, | |
| 6764 | >12 belong 6 32-bit IEEE floating point, | |
| 6765 | >12 belong 7 64-bit IEEE floating point, | |
| 6766 | >12 belong 8 Fragmented sample data, | |
| 6767 | >12 belong 10 DSP program, | |
| 6768 | >12 belong 11 8-bit fixed point, | |
| 6769 | >12 belong 12 16-bit fixed point, | |
| 6770 | >12 belong 13 24-bit fixed point, | |
| 6771 | >12 belong 14 32-bit fixed point, | |
| 6772 | >12 belong 18 16-bit linear with emphasis, | |
| 6773 | >12 belong 19 16-bit linear compressed, | |
| 6774 | >12 belong 20 16-bit linear with emphasis and compression, | |
| 6775 | >12 belong 21 Music kit DSP commands, | |
| 6776 | >12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice data encoding), | |
| 6777 | >12 belong 24 compressed (8-bit CCITT G.722 ADPCM) | |
| 6778 | >12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), | |
| 6779 | >12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), | |
| 6780 | >12 belong 27 8-bit A-law (CCITT G.711), | |
| 6781 | >20 belong 1 mono, | |
| 6782 | >20 belong 2 stereo, | |
| 6783 | >20 belong 4 quad, | |
| 6784 | >16 belong >0 %d Hz | |
| 6785 | ||
| 6786 | # DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format | |
| 6787 | # that uses little-endian encoding and has a different magic number | |
| 6788 | 0 lelong 0x0064732E DEC audio data: | |
| 6789 | >12 lelong 1 8-bit ISDN mu-law, | |
| 6790 | >12 lelong 2 8-bit linear PCM [REF-PCM], | |
| 6791 | >12 lelong 3 16-bit linear PCM, | |
| 6792 | >12 lelong 4 24-bit linear PCM, | |
| 6793 | >12 lelong 5 32-bit linear PCM, | |
| 6794 | >12 lelong 6 32-bit IEEE floating point, | |
| 6795 | >12 lelong 7 64-bit IEEE floating point, | |
| 6796 | >12 belong 8 Fragmented sample data, | |
| 6797 | >12 belong 10 DSP program, | |
| 6798 | >12 belong 11 8-bit fixed point, | |
| 6799 | >12 belong 12 16-bit fixed point, | |
| 6800 | >12 belong 13 24-bit fixed point, | |
| 6801 | >12 belong 14 32-bit fixed point, | |
| 6802 | >12 belong 18 16-bit linear with emphasis, | |
| 6803 | >12 belong 19 16-bit linear compressed, | |
| 6804 | >12 belong 20 16-bit linear with emphasis and compression, | |
| 6805 | >12 belong 21 Music kit DSP commands, | |
| 6806 | >12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice data encoding), | |
| 6807 | >12 belong 24 compressed (8-bit CCITT G.722 ADPCM) | |
| 6808 | >12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), | |
| 6809 | >12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), | |
| 6810 | >12 belong 27 8-bit A-law (CCITT G.711), | |
| 6811 | >20 lelong 1 mono, | |
| 6812 | >20 lelong 2 stereo, | |
| 6813 | >20 lelong 4 quad, | |
| 6814 | >16 lelong >0 %d Hz | |
| 6815 | ||
| 6816 | # Creative Labs AUDIO stuff | |
| 6817 | 0 string MThd Standard MIDI data | |
| 6818 | >8 beshort x (format %d) | |
| 6819 | >10 beshort x using %d track | |
| 6820 | >10 beshort >1 \bs | |
| 6821 | >12 beshort&0x7fff x at 1/%d | |
| 6822 | >12 beshort&0x8000 >0 SMPTE | |
| 6823 | ||
| 6824 | 0 string CTMF Creative Music (CMF) data | |
| 6825 | 0 string SBI SoundBlaster instrument data | |
| 6826 | 0 string Creative\ Voice\ File Creative Labs voice data | |
| 6827 | # is this next line right? it came this way... | |
| 6828 | >19 byte 0x1A | |
| 6829 | >23 byte >0 - version %d | |
| 6830 | >22 byte >0 \b.%d | |
| 6831 | ||
| 6832 | # first entry is also the string "NTRK" | |
| 6833 | 0 belong 0x4e54524b MultiTrack sound data | |
| 6834 | >4 belong x - version %ld | |
| 6835 | ||
| 6836 | # Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED | |
| 6837 | # [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi] | |
| 6838 | 0 string EMOD Extended MOD sound data, | |
| 6839 | >4 byte&0xf0 x version %d | |
| 6840 | >4 byte&0x0f x \b.%d, | |
| 6841 | >45 byte x %d instruments | |
| 6842 | >83 byte 0 (module) | |
| 6843 | >83 byte 1 (song) | |
| 6844 | ||
| 6845 | # Real Audio (Magic .ra\0375) | |
| 6846 | 0 belong 0x2e7261fd RealAudio sound file | |
| 6847 | 0 string .RMF RealMedia file | |
| 6848 | ||
| 6849 | # MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net] | |
| 6850 | # Oct 31, 1995 | |
| 6851 | # fixed by <doj@cubic.org> 2003-06-24 | |
| 6852 | # Too short... | |
| 6853 | #0 string MTM MultiTracker Module sound file | |
| 6854 | #0 string if Composer 669 Module sound data | |
| 6855 | #0 string JN Composer 669 Module sound data (extended format) | |
| 6856 | 0 string MAS_U ULT(imate) Module sound data | |
| 6857 | ||
| 6858 | #0 string FAR Module sound data | |
| 6859 | #>4 string >\15 Title: "%s" | |
| 6860 | ||
| 6861 | 0x2c string SCRM ScreamTracker III Module sound data | |
| 6862 | >0 string >\0 Title: "%s" | |
| 6863 | ||
| 6864 | # Gravis UltraSound patches | |
| 6865 | # From <ache@nagual.ru> | |
| 6866 | ||
| 6867 | 0 string GF1PATCH110\0ID#000002\0 GUS patch | |
| 6868 | 0 string GF1PATCH100\0ID#000002\0 Old GUS patch | |
| 6869 | ||
| 6870 | # | |
| 6871 | # Taken from loader code from mikmod version 2.14 | |
| 6872 | # by Steve McIntyre (stevem@chiark.greenend.org.uk) | |
| 6873 | # <doj@cubic.org> added title printing on 2003-06-24 | |
| 6874 | 0 string MAS_UTrack_V00 | |
| 6875 | >14 string >/0 ultratracker V1.%.1s module sound data | |
| 6876 | ||
| 6877 | 0 string UN05 MikMod UNI format module sound data | |
| 6878 | ||
| 6879 | 0 string Extended\ Module: Fasttracker II module sound data | |
| 6880 | >17 string >\0 Title: "%s" | |
| 6881 | ||
| 6882 | 21 string/c !SCREAM! Screamtracker 2 module sound data | |
| 6883 | 21 string BMOD2STM Screamtracker 2 module sound data | |
| 6884 | 1080 string M.K. 4-channel Protracker module sound data | |
| 6885 | >0 string >\0 Title: "%s" | |
| 6886 | 1080 string M!K! 4-channel Protracker module sound data | |
| 6887 | >0 string >\0 Title: "%s" | |
| 6888 | 1080 string FLT4 4-channel Startracker module sound data | |
| 6889 | >0 string >\0 Title: "%s" | |
| 6890 | 1080 string FLT8 8-channel Startracker module sound data | |
| 6891 | >0 string >\0 Title: "%s" | |
| 6892 | 1080 string 4CHN 4-channel Fasttracker module sound data | |
| 6893 | >0 string >\0 Title: "%s" | |
| 6894 | 1080 string 6CHN 6-channel Fasttracker module sound data | |
| 6895 | >0 string >\0 Title: "%s" | |
| 6896 | 1080 string 8CHN 8-channel Fasttracker module sound data | |
| 6897 | >0 string >\0 Title: "%s" | |
| 6898 | 1080 string CD81 8-channel Octalyser module sound data | |
| 6899 | >0 string >\0 Title: "%s" | |
| 6900 | 1080 string OKTA 8-channel Oktalyzer module sound data | |
| 6901 | >0 string >\0 Title: "%s" | |
| 6902 | # Not good enough. | |
| 6903 | #1082 string CH | |
| 6904 | #>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data | |
| 6905 | 1080 string 16CN 16-channel Taketracker module sound data | |
| 6906 | >0 string >\0 Title: "%s" | |
| 6907 | 1080 string 32CN 32-channel Taketracker module sound data | |
| 6908 | >0 string >\0 Title: "%s" | |
| 6909 | ||
| 6910 | # TOC sound files -Trevor Johnson <trevor@jpj.net> | |
| 6911 | # | |
| 6912 | 0 string TOC TOC sound file | |
| 6913 | ||
| 6914 | # sidfiles <pooka@iki.fi> | |
| 6915 | # added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24 | |
| 6916 | 0 string SIDPLAY\ INFOFILE Sidplay info file | |
| 6917 | ||
| 6918 | 0 string PSID PlaySID v2.2+ (AMIGA) sidtune | |
| 6919 | >4 beshort >0 w/ header v%d, | |
| 6920 | >14 beshort =1 single song, | |
| 6921 | >14 beshort >1 %d songs, | |
| 6922 | >16 beshort >0 default song: %d | |
| 6923 | >0x16 string >\0 name: "%s" | |
| 6924 | >0x36 string >\0 author: "%s" | |
| 6925 | >0x56 string >\0 copyright: "%s" | |
| 6926 | ||
| 6927 | 0 string RSID RSID sidtune PlaySID compatible | |
| 6928 | >4 beshort >0 w/ header v%d, | |
| 6929 | >14 beshort =1 single song, | |
| 6930 | >14 beshort >1 %d songs, | |
| 6931 | >16 beshort >0 default song: %d | |
| 6932 | >0x16 string >\0 name: "%s" | |
| 6933 | >0x36 string >\0 author: "%s" | |
| 6934 | >0x56 string >\0 copyright: "%s" | |
| 6935 | ||
| 6936 | # IRCAM <mpruett@sgi.com> | |
| 6937 | # VAX and MIPS files are little-endian; Sun and NeXT are big-endian | |
| 6938 | 0 belong 0x64a30100 IRCAM file (VAX) | |
| 6939 | 0 belong 0x64a30200 IRCAM file (Sun) | |
| 6940 | 0 belong 0x64a30300 IRCAM file (MIPS little-endian) | |
| 6941 | 0 belong 0x64a30400 IRCAM file (NeXT) | |
| 6942 | ||
| 6943 | # NIST SPHERE <mpruett@sgi.com> | |
| 6944 | 0 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file | |
| 6945 | ||
| 6946 | # Sample Vision <mpruett@sgi.com> | |
| 6947 | 0 string SOUND\ SAMPLE\ DATA\ Sample Vision file | |
| 6948 | ||
| 6949 | # Audio Visual Research <tonigonenstein@users.sourceforge.net> | |
| 6950 | 0 string 2BIT Audio Visual Research file, | |
| 6951 | >12 beshort =0 mono, | |
| 6952 | >12 beshort =-1 stereo, | |
| 6953 | >14 beshort x %d bits | |
| 6954 | >16 beshort =0 unsigned, | |
| 6955 | >16 beshort =-1 signed, | |
| 6956 | >22 belong&0x00ffffff x %d Hz, | |
| 6957 | >18 beshort =0 no loop, | |
| 6958 | >18 beshort =-1 loop, | |
| 6959 | >21 ubyte <=127 note %d, | |
| 6960 | >22 byte =0 replay 5.485 KHz | |
| 6961 | >22 byte =1 replay 8.084 KHz | |
| 6962 | >22 byte =2 replay 10.971 Khz | |
| 6963 | >22 byte =3 replay 16.168 Khz | |
| 6964 | >22 byte =4 replay 21.942 KHz | |
| 6965 | >22 byte =5 replay 32.336 KHz | |
| 6966 | >22 byte =6 replay 43.885 KHz | |
| 6967 | >22 byte =7 replay 47.261 KHz | |
| 6968 | ||
| 6969 | # SGI SoundTrack <mpruett@sgi.com> | |
| 6970 | 0 string _SGI_SoundTrack SGI SoundTrack project file | |
| 6971 | # ID3 version 2 tags <waschk@informatik.uni-rostock.de> | |
| 6972 | 0 string ID3 MP3 file with ID3 version 2. | |
| 6973 | >3 ubyte <0xff \b%d. | |
| 6974 | >4 ubyte <0xff \b%d tag | |
| 6975 | ||
| 6976 | # NSF (NES sound file) magic | |
| 6977 | 0 string NESM\x1a NES Sound File | |
| 6978 | >14 string >\0 ("%s" by | |
| 6979 | >46 string >\0 %s, copyright | |
| 6980 | >78 string >\0 %s), | |
| 6981 | >5 byte x version %d, | |
| 6982 | >6 byte x %d tracks, | |
| 6983 | >122 byte&0x2 =1 dual PAL/NTSC | |
| 6984 | >122 byte&0x1 =1 PAL | |
| 6985 | >122 byte&0x1 =0 NTSC | |
| 6986 | ||
| 6987 | # Impuse tracker module (audio/x-it) | |
| 6988 | 0 string IMPM Impulse Tracker module sound data - | |
| 6989 | >4 string >\0 "%s" | |
| 6990 | >40 leshort !0 compatible w/ITv%x | |
| 6991 | >42 leshort !0 created w/ITv%x | |
| 6992 | ||
| 6993 | # Imago Orpheus module (audio/x-imf) | |
| 6994 | 60 string IM10 Imago Orpheus module sound data - | |
| 6995 | >0 string >\0 "%s" | |
| 6996 | ||
| 6997 | # From <collver1@attbi.com> | |
| 6998 | # These are the /etc/magic entries to decode modules, instruments, and | |
| 6999 | # samples in Impulse Tracker's native format. | |
| 7000 | ||
| 7001 | 0 string IMPS Impulse Tracker Sample | |
| 7002 | >18 byte &2 16 bit | |
| 7003 | >18 byte ^2 8 bit | |
| 7004 | >18 byte &4 stereo | |
| 7005 | >18 byte ^4 mono | |
| 7006 | 0 string IMPI Impulse Tracker Instrument | |
| 7007 | >28 leshort !0 ITv%x | |
| 7008 | >30 byte !0 %d samples | |
| 7009 | ||
| 7010 | # Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files | |
| 7011 | # From <collver1@attbi.com> | |
| 7012 | 0 string LM8953 Yamaha TX Wave | |
| 7013 | >22 byte 0x49 looped | |
| 7014 | >22 byte 0xC9 non-looped | |
| 7015 | >23 byte 1 33kHz | |
| 7016 | >23 byte 2 50kHz | |
| 7017 | >23 byte 3 16kHz | |
| 7018 | ||
| 7019 | # scream tracker: file(1) magic for Scream Tracker sample files | |
| 7020 | # | |
| 7021 | # From <collver1@attbi.com> | |
| 7022 | 76 string SCRS Scream Tracker Sample | |
| 7023 | >0 byte 1 sample | |
| 7024 | >0 byte 2 adlib melody | |
| 7025 | >0 byte >2 adlib drum | |
| 7026 | >31 byte &2 stereo | |
| 7027 | >31 byte ^2 mono | |
| 7028 | >31 byte &4 16bit little endian | |
| 7029 | >31 byte ^4 8bit | |
| 7030 | >30 byte 0 unpacked | |
| 7031 | >30 byte 1 packed | |
| 7032 | ||
| 7033 | # audio | |
| 7034 | # From: Cory Dikkers <cdikkers@swbell.net> | |
| 7035 | 0 string MMD0 MED music file, version 0 | |
| 7036 | 0 string MMD1 OctaMED Pro music file, version 1 | |
| 7037 | 0 string MMD3 OctaMED Soundstudio music file, version 3 | |
| 7038 | 0 string OctaMEDCmpr OctaMED Soundstudio compressed file | |
| 7039 | 0 string MED MED_Song | |
| 7040 | 0 string SymM Symphonie SymMOD music file | |
| 7041 | # | |
| 7042 | 0 string THX AHX version | |
| 7043 | >3 byte =0 1 module data | |
| 7044 | >3 byte =1 2 module data | |
| 7045 | # | |
| 7046 | 0 string OKTASONG Oktalyzer module data | |
| 7047 | # | |
| 7048 | 0 string DIGI\ Booster\ module\0 %s | |
| 7049 | >20 byte >0 %c | |
| 7050 | >>21 byte >0 \b%c | |
| 7051 | >>>22 byte >0 \b%c | |
| 7052 | >>>>23 byte >0 \b%c | |
| 7053 | >610 string >\0 \b, "%s" | |
| 7054 | # | |
| 7055 | 0 string DBM0 DIGI Booster Pro Module | |
| 7056 | >4 byte >0 V%X. | |
| 7057 | >>5 byte x \b%02X | |
| 7058 | >16 string >\0 \b, "%s" | |
| 7059 | # | |
| 7060 | 0 string FTMN FaceTheMusic module | |
| 7061 | >16 string >\0d \b, "%s" | |
| 7062 | ||
| 7063 | # From: <doj@cubic.org> 2003-06-24 | |
| 7064 | 0 string AMShdr\32 Velvet Studio AMS Module v2.2 | |
| 7065 | 0 string Extreme Extreme Tracker AMS Module v1.3 | |
| 7066 | 0 string DDMF Xtracker DMF Module | |
| 7067 | >4 byte x v%i | |
| 7068 | >0xD string >\0 Title: "%s" | |
| 7069 | >0x2B string >\0 Composer: "%s" | |
| 7070 | 0 string DSM\32 Dynamic Studio Module DSM | |
| 7071 | 0 string SONG DigiTrekker DTM Module | |
| 7072 | 0 string DMDL DigiTrakker MDL Module | |
| 7073 | 0 string PSM\32 Protracker Studio PSM Module | |
| 7074 | 44 string PTMF Poly Tracker PTM Module | |
| 7075 | >0 string >\32 Title: "%s" | |
| 7076 | 0 string MT20 MadTracker 2.0 Module MT2 | |
| 7077 | 0 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD | |
| 7078 | 0 string RTMM RTM Module | |
| 7079 | 0x426 string MaDoKaN96 XMS Adlib Module | |
| 7080 | >0 string >\0 Composer: "%s" | |
| 7081 | 0 string AMF AMF Module | |
| 7082 | >4 string >\0 Title: "%s" | |
| 7083 | 0 string MODINFO1 Open Cubic Player Module Inforation MDZ | |
| 7084 | 0 string Extended\40Instrument: Fast Tracker II Instrument | |
| 7085 | ||
| 7086 | # From: Takeshi Hamasaki <hma@syd.odn.ne.jp> | |
| 7087 | # NOA Nancy Codec file | |
| 7088 | 0 string \210NOA\015\012\032 NOA Nancy Codec Movie file | |
| 7089 | # Yamaha SMAF format | |
| 7090 | 0 string MMMD Yamaha SMAF file | |
| 7091 | # Sharp Jisaku Melody format for PDC | |
| 7092 | 0 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody | |
| 7093 | >20 string Ver01.00 Ver. 1.00 | |
| 7094 | >>32 byte x , %d tracks | |
| 7095 | ||
| 7096 | # Free lossless audio codec <http://flac.sourceforge.net> | |
| 7097 | # From: Przemyslaw Augustyniak <silvathraec@rpg.pl> | |
| 7098 | 0 string fLaC FLAC audio bitstream data | |
| 7099 | >4 byte&0x7f >0 \b, unknown version | |
| 7100 | >4 byte&0x7f 0 \b | |
| 7101 | # some common bits/sample values | |
| 7102 | >>20 beshort&0x1f0 0x030 \b, 4 bit | |
| 7103 | >>20 beshort&0x1f0 0x050 \b, 6 bit | |
| 7104 | >>20 beshort&0x1f0 0x070 \b, 8 bit | |
| 7105 | >>20 beshort&0x1f0 0x0b0 \b, 12 bit | |
| 7106 | >>20 beshort&0x1f0 0x0f0 \b, 16 bit | |
| 7107 | >>20 beshort&0x1f0 0x170 \b, 24 bit | |
| 7108 | >>20 byte&0xe 0x0 \b, mono | |
| 7109 | >>20 byte&0xe 0x2 \b, stereo | |
| 7110 | >>20 byte&0xe 0x4 \b, 3 channels | |
| 7111 | >>20 byte&0xe 0x6 \b, 4 channels | |
| 7112 | >>20 byte&0xe 0x8 \b, 5 channels | |
| 7113 | >>20 byte&0xe 0xa \b, 6 channels | |
| 7114 | >>20 byte&0xe 0xc \b, 7 channels | |
| 7115 | >>20 byte&0xe 0xe \b, 8 channels | |
| 7116 | # some common sample rates | |
| 7117 | >>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz | |
| 7118 | >>17 belong&0xfffff0 0x0bb800 \b, 48 kHz | |
| 7119 | >>17 belong&0xfffff0 0x07d000 \b, 32 kHz | |
| 7120 | >>17 belong&0xfffff0 0x056220 \b, 22.05 kHz | |
| 7121 | >>17 belong&0xfffff0 0x05dc00 \b, 24 kHz | |
| 7122 | >>17 belong&0xfffff0 0x03e800 \b, 16 kHz | |
| 7123 | >>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz | |
| 7124 | >>17 belong&0xfffff0 0x02ee00 \b, 12 kHz | |
| 7125 | >>17 belong&0xfffff0 0x01f400 \b, 8 kHz | |
| 7126 | >>17 belong&0xfffff0 0x177000 \b, 96 kHz | |
| 7127 | >>17 belong&0xfffff0 0x0fa000 \b, 64 kHz | |
| 7128 | >>21 byte&0xf >0 \b, >4G samples | |
| 7129 | >>21 byte&0xf 0 \b | |
| 7130 | >>>22 belong >0 \b, %u samples | |
| 7131 | >>>22 belong 0 \b, length unknown | |
| 7132 | ||
| 7133 | # (ISDN) VBOX voice message file (Wolfram Kleff) | |
| 7134 | 0 string VBOX VBOX voice message data | |
| 7135 | ||
| 7136 | # ReBorn Song Files (.rbs) | |
| 7137 | # David J. Singer <doc@deadvirgins.org.uk> | |
| 7138 | 8 string RB40 RBS Song file | |
| 7139 | >29 string ReBorn created by ReBorn | |
| 7140 | >37 string Propellerhead created by ReBirth | |
| 7141 | ||
| 7142 | # Synthesizer Generator and Kimwitu share their file format | |
| 7143 | 0 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data | |
| 7144 | # Kimwitu++ uses a slightly different magic | |
| 7145 | 0 string A#S#C#S#S#L#HUB Kimwitu++ data | |
| 7146 | ||
| 7147 | # From "Simon Hosie | |
| 7148 | 0 string TFMX-SONG TFMX module sound data | |
| 7149 | ||
| 7150 | # From danny.milo@gmx.net (Danny Milosavljevic) | |
| 7151 | # monkeysaudio for magic.mime | |
| 7152 | 0 string MAC\ X/Monkey audio, | |
| 7153 | >4 leshort >0 version %d, | |
| 7154 | >6 leshort >0 compression level %d, | |
| 7155 | >8 leshort >0 flags %x, | |
| 7156 | >10 leshort >0 channels %d, | |
| 7157 | >12 lelong >0 samplerate %d, | |
| 7158 | >24 lelong >0 frames %d | |
| 7159 | ||
| 7160 | #------------------------------------------------------------------------------ | |
| 7161 | # bsdi: file(1) magic for BSD/OS (from BSDI) objects | |
| 7162 | # | |
| 7163 | ||
| 7164 | 0 lelong 0314 386 compact demand paged pure executable | |
| 7165 | >16 lelong >0 not stripped | |
| 7166 | >32 byte 0x6a (uses shared libs) | |
| 7167 | ||
| 7168 | 0 lelong 0407 386 executable | |
| 7169 | >16 lelong >0 not stripped | |
| 7170 | >32 byte 0x6a (uses shared libs) | |
| 7171 | ||
| 7172 | 0 lelong 0410 386 pure executable | |
| 7173 | >16 lelong >0 not stripped | |
| 7174 | >32 byte 0x6a (uses shared libs) | |
| 7175 | ||
| 7176 | 0 lelong 0413 386 demand paged pure executable | |
| 7177 | >16 lelong >0 not stripped | |
| 7178 | >32 byte 0x6a (uses shared libs) | |
| 7179 | ||
| 7180 | # same as in SunOS 4.x, except for static shared libraries | |
| 7181 | 0 belong&077777777 0600413 sparc demand paged | |
| 7182 | >0 byte &0x80 | |
| 7183 | >>20 belong <4096 shared library | |
| 7184 | >>20 belong =4096 dynamically linked executable | |
| 7185 | >>20 belong >4096 dynamically linked executable | |
| 7186 | >0 byte ^0x80 executable | |
| 7187 | >16 belong >0 not stripped | |
| 7188 | >36 belong 0xb4100001 (uses shared libs) | |
| 7189 | ||
| 7190 | 0 belong&077777777 0600410 sparc pure | |
| 7191 | >0 byte &0x80 dynamically linked executable | |
| 7192 | >0 byte ^0x80 executable | |
| 7193 | >16 belong >0 not stripped | |
| 7194 | >36 belong 0xb4100001 (uses shared libs) | |
| 7195 | ||
| 7196 | 0 belong&077777777 0600407 sparc | |
| 7197 | >0 byte &0x80 dynamically linked executable | |
| 7198 | >0 byte ^0x80 executable | |
| 7199 | >16 belong >0 not stripped | |
| 7200 | >36 belong 0xb4100001 (uses shared libs) | |
| 7201 | ||
| 7202 | #------------------------------------------------------------------------------ | |
| 7203 | # fcs: file(1) magic for FCS (Flow Cytometry Standard) data files | |
| 7204 | # From Roger Leigh <roger@whinlatter.uklinux.net> | |
| 7205 | 0 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0 | |
| 7206 | 0 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0 | |
| 7207 | 0 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0 | |
| 7208 | ||
| 7209 | ||
| 7210 | #------------------------------------------------------------------------------ | |
| 7211 | # intel: file(1) magic for x86 Unix | |
| 7212 | # | |
| 7213 | # Various flavors of x86 UNIX executable/object (other than Xenix, which | |
| 7214 | # is in "microsoft"). DOS is in "msdos"; the ambitious soul can do | |
| 7215 | # Windows as well. | |
| 7216 | # | |
| 7217 | # Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and | |
| 7218 | # whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere | |
| 7219 | # as well, if, as, and when IBM makes it portable. | |
| 7220 | # | |
| 7221 | # The `versions' should be un-commented if they work for you. | |
| 7222 | # (Was the problem just one of endianness?) | |
| 7223 | # | |
| 7224 | 0 leshort 0502 basic-16 executable | |
| 7225 | >12 lelong >0 not stripped | |
| 7226 | #>22 leshort >0 - version %ld | |
| 7227 | 0 leshort 0503 basic-16 executable (TV) | |
| 7228 | >12 lelong >0 not stripped | |
| 7229 | #>22 leshort >0 - version %ld | |
| 7230 | 0 leshort 0510 x86 executable | |
| 7231 | >12 lelong >0 not stripped | |
| 7232 | 0 leshort 0511 x86 executable (TV) | |
| 7233 | >12 lelong >0 not stripped | |
| 7234 | 0 leshort =0512 iAPX 286 executable small model (COFF) | |
| 7235 | >12 lelong >0 not stripped | |
| 7236 | #>22 leshort >0 - version %ld | |
| 7237 | 0 leshort =0522 iAPX 286 executable large model (COFF) | |
| 7238 | >12 lelong >0 not stripped | |
| 7239 | #>22 leshort >0 - version %ld | |
| 7240 | # SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan | |
| 7241 | 0 leshort =0514 80386 COFF executable | |
| 7242 | >12 lelong >0 not stripped | |
| 7243 | >22 leshort >0 - version %ld | |
| 7244 | ||
| 7245 | # rom: file(1) magic for BIOS ROM Extensions found in intel machines | |
| 7246 | # mapped into memory between 0xC0000 and 0xFFFFF | |
| 7247 | # From Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu | |
| 7248 | 0 beshort 0x55AA BIOS (ia32) ROM Ext. | |
| 7249 | >5 string USB USB | |
| 7250 | >7 string LDR UNDI image | |
| 7251 | >30 string IBM IBM comp. Video | |
| 7252 | >26 string Adaptec Adaptec | |
| 7253 | >28 string Adaptec Adaptec | |
| 7254 | >42 string PROMISE Promise | |
| 7255 | >2 byte x (%d*512) | |
| 7256 | ||
| 7257 | #------------------------------------------------------------------------------ | |
| 7258 | # netbsd: file(1) magic for NetBSD objects | |
| 7259 | # | |
| 7260 | # All new-style magic numbers are in network byte order. | |
| 7261 | # | |
| 7262 | ||
| 7263 | 0 lelong 000000407 a.out NetBSD little-endian object file | |
| 7264 | >16 lelong >0 not stripped | |
| 7265 | 0 belong 000000407 a.out NetBSD big-endian object file | |
| 7266 | >16 belong >0 not stripped | |
| 7267 | ||
| 7268 | 0 belong&0377777777 041400413 a.out NetBSD/i386 demand paged | |
| 7269 | >0 byte &0x80 | |
| 7270 | >>20 lelong <4096 shared library | |
| 7271 | >>20 lelong =4096 dynamically linked executable | |
| 7272 | >>20 lelong >4096 dynamically linked executable | |
| 7273 | >0 byte ^0x80 executable | |
| 7274 | >16 lelong >0 not stripped | |
| 7275 | 0 belong&0377777777 041400410 a.out NetBSD/i386 pure | |
| 7276 | >0 byte &0x80 dynamically linked executable | |
| 7277 | >0 byte ^0x80 executable | |
| 7278 | >16 lelong >0 not stripped | |
| 7279 | 0 belong&0377777777 041400407 a.out NetBSD/i386 | |
| 7280 | >0 byte &0x80 dynamically linked executable | |
| 7281 | >0 byte ^0x80 | |
| 7282 | >>0 byte &0x40 position independent | |
| 7283 | >>20 lelong !0 executable | |
| 7284 | >>20 lelong =0 object file | |
| 7285 | >16 lelong >0 not stripped | |
| 7286 | 0 belong&0377777777 041400507 a.out NetBSD/i386 core | |
| 7287 | >12 string >\0 from '%s' | |
| 7288 | >32 lelong !0 (signal %d) | |
| 7289 | ||
| 7290 | 0 belong&0377777777 041600413 a.out NetBSD/m68k demand paged | |
| 7291 | >0 byte &0x80 | |
| 7292 | >>20 belong <8192 shared library | |
| 7293 | >>20 belong =8192 dynamically linked executable | |
| 7294 | >>20 belong >8192 dynamically linked executable | |
| 7295 | >0 byte ^0x80 executable | |
| 7296 | >16 belong >0 not stripped | |
| 7297 | 0 belong&0377777777 041600410 a.out NetBSD/m68k pure | |
| 7298 | >0 byte &0x80 dynamically linked executable | |
| 7299 | >0 byte ^0x80 executable | |
| 7300 | >16 belong >0 not stripped | |
| 7301 | 0 belong&0377777777 041600407 a.out NetBSD/m68k | |
| 7302 | >0 byte &0x80 dynamically linked executable | |
| 7303 | >0 byte ^0x80 | |
| 7304 | >>0 byte &0x40 position independent | |
| 7305 | >>20 belong !0 executable | |
| 7306 | >>20 belong =0 object file | |
| 7307 | >16 belong >0 not stripped | |
| 7308 | 0 belong&0377777777 041600507 a.out NetBSD/m68k core | |
| 7309 | >12 string >\0 from '%s' | |
| 7310 | >32 belong !0 (signal %d) | |
| 7311 | ||
| 7312 | 0 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged | |
| 7313 | >0 byte &0x80 | |
| 7314 | >>20 belong <4096 shared library | |
| 7315 | >>20 belong =4096 dynamically linked executable | |
| 7316 | >>20 belong >4096 dynamically linked executable | |
| 7317 | >0 byte ^0x80 executable | |
| 7318 | >16 belong >0 not stripped | |
| 7319 | 0 belong&0377777777 042000410 a.out NetBSD/m68k4k pure | |
| 7320 | >0 byte &0x80 dynamically linked executable | |
| 7321 | >0 byte ^0x80 executable | |
| 7322 | >16 belong >0 not stripped | |
| 7323 | 0 belong&0377777777 042000407 a.out NetBSD/m68k4k | |
| 7324 | >0 byte &0x80 dynamically linked executable | |
| 7325 | >0 byte ^0x80 | |
| 7326 | >>0 byte &0x40 position independent | |
| 7327 | >>20 belong !0 executable | |
| 7328 | >>20 belong =0 object file | |
| 7329 | >16 belong >0 not stripped | |
| 7330 | 0 belong&0377777777 042000507 a.out NetBSD/m68k4k core | |
| 7331 | >12 string >\0 from '%s' | |
| 7332 | >32 belong !0 (signal %d) | |
| 7333 | ||
| 7334 | 0 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged | |
| 7335 | >0 byte &0x80 | |
| 7336 | >>20 lelong <4096 shared library | |
| 7337 | >>20 lelong =4096 dynamically linked executable | |
| 7338 | >>20 lelong >4096 dynamically linked executable | |
| 7339 | >0 byte ^0x80 executable | |
| 7340 | >16 lelong >0 not stripped | |
| 7341 | 0 belong&0377777777 042200410 a.out NetBSD/ns32532 pure | |
| 7342 | >0 byte &0x80 dynamically linked executable | |
| 7343 | >0 byte ^0x80 executable | |
| 7344 | >16 lelong >0 not stripped | |
| 7345 | 0 belong&0377777777 042200407 a.out NetBSD/ns32532 | |
| 7346 | >0 byte &0x80 dynamically linked executable | |
| 7347 | >0 byte ^0x80 | |
| 7348 | >>0 byte &0x40 position independent | |
| 7349 | >>20 lelong !0 executable | |
| 7350 | >>20 lelong =0 object file | |
| 7351 | >16 lelong >0 not stripped | |
| 7352 | 0 belong&0377777777 042200507 a.out NetBSD/ns32532 core | |
| 7353 | >12 string >\0 from '%s' | |
| 7354 | >32 lelong !0 (signal %d) | |
| 7355 | ||
| 7356 | 0 belong&0377777777 045200507 a.out NetBSD/powerpc core | |
| 7357 | >12 string >\0 from '%s' | |
| 7358 | ||
| 7359 | 0 belong&0377777777 042400413 a.out NetBSD/sparc demand paged | |
| 7360 | >0 byte &0x80 | |
| 7361 | >>20 belong <8192 shared library | |
| 7362 | >>20 belong =8192 dynamically linked executable | |
| 7363 | >>20 belong >8192 dynamically linked executable | |
| 7364 | >0 byte ^0x80 executable | |
| 7365 | >16 belong >0 not stripped | |
| 7366 | 0 belong&0377777777 042400410 a.out NetBSD/sparc pure | |
| 7367 | >0 byte &0x80 dynamically linked executable | |
| 7368 | >0 byte ^0x80 executable | |
| 7369 | >16 belong >0 not stripped | |
| 7370 | 0 belong&0377777777 042400407 a.out NetBSD/sparc | |
| 7371 | >0 byte &0x80 dynamically linked executable | |
| 7372 | >0 byte ^0x80 | |
| 7373 | >>0 byte &0x40 position independent | |
| 7374 | >>20 belong !0 executable | |
| 7375 | >>20 belong =0 object file | |
| 7376 | >16 belong >0 not stripped | |
| 7377 | 0 belong&0377777777 042400507 a.out NetBSD/sparc core | |
| 7378 | >12 string >\0 from '%s' | |
| 7379 | >32 belong !0 (signal %d) | |
| 7380 | ||
| 7381 | 0 belong&0377777777 042600413 a.out NetBSD/pmax demand paged | |
| 7382 | >0 byte &0x80 | |
| 7383 | >>20 lelong <4096 shared library | |
| 7384 | >>20 lelong =4096 dynamically linked executable | |
| 7385 | >>20 lelong >4096 dynamically linked executable | |
| 7386 | >0 byte ^0x80 executable | |
| 7387 | >16 lelong >0 not stripped | |
| 7388 | 0 belong&0377777777 042600410 a.out NetBSD/pmax pure | |
| 7389 | >0 byte &0x80 dynamically linked executable | |
| 7390 | >0 byte ^0x80 executable | |
| 7391 | >16 lelong >0 not stripped | |
| 7392 | 0 belong&0377777777 042600407 a.out NetBSD/pmax | |
| 7393 | >0 byte &0x80 dynamically linked executable | |
| 7394 | >0 byte ^0x80 | |
| 7395 | >>0 byte &0x40 position independent | |
| 7396 | >>20 lelong !0 executable | |
| 7397 | >>20 lelong =0 object file | |
| 7398 | >16 lelong >0 not stripped | |
| 7399 | 0 belong&0377777777 042600507 a.out NetBSD/pmax core | |
| 7400 | >12 string >\0 from '%s' | |
| 7401 | >32 lelong !0 (signal %d) | |
| 7402 | ||
| 7403 | 0 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged | |
| 7404 | >0 byte &0x80 | |
| 7405 | >>20 lelong <4096 shared library | |
| 7406 | >>20 lelong =4096 dynamically linked executable | |
| 7407 | >>20 lelong >4096 dynamically linked executable | |
| 7408 | >0 byte ^0x80 executable | |
| 7409 | >16 lelong >0 not stripped | |
| 7410 | 0 belong&0377777777 043000410 a.out NetBSD/vax 1k pure | |
| 7411 | >0 byte &0x80 dynamically linked executable | |
| 7412 | >0 byte ^0x80 executable | |
| 7413 | >16 lelong >0 not stripped | |
| 7414 | 0 belong&0377777777 043000407 a.out NetBSD/vax 1k | |
| 7415 | >0 byte &0x80 dynamically linked executable | |
| 7416 | >0 byte ^0x80 | |
| 7417 | >>0 byte &0x40 position independent | |
| 7418 | >>20 lelong !0 executable | |
| 7419 | >>20 lelong =0 object file | |
| 7420 | >16 lelong >0 not stripped | |
| 7421 | 0 belong&0377777777 043000507 a.out NetBSD/vax 1k core | |
| 7422 | >12 string >\0 from '%s' | |
| 7423 | >32 lelong !0 (signal %d) | |
| 7424 | ||
| 7425 | 0 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged | |
| 7426 | >0 byte &0x80 | |
| 7427 | >>20 lelong <4096 shared library | |
| 7428 | >>20 lelong =4096 dynamically linked executable | |
| 7429 | >>20 lelong >4096 dynamically linked executable | |
| 7430 | >0 byte ^0x80 executable | |
| 7431 | >16 lelong >0 not stripped | |
| 7432 | 0 belong&0377777777 045400410 a.out NetBSD/vax 4k pure | |
| 7433 | >0 byte &0x80 dynamically linked executable | |
| 7434 | >0 byte ^0x80 executable | |
| 7435 | >16 lelong >0 not stripped | |
| 7436 | 0 belong&0377777777 045400407 a.out NetBSD/vax 4k | |
| 7437 | >0 byte &0x80 dynamically linked executable | |
| 7438 | >0 byte ^0x80 | |
| 7439 | >>0 byte &0x40 position independent | |
| 7440 | >>20 lelong !0 executable | |
| 7441 | >>20 lelong =0 object file | |
| 7442 | >16 lelong >0 not stripped | |
| 7443 | 0 belong&0377777777 045400507 a.out NetBSD/vax 4k core | |
| 7444 | >12 string >\0 from '%s' | |
| 7445 | >32 lelong !0 (signal %d) | |
| 7446 | ||
| 7447 | # NetBSD/alpha does not support (and has never supported) a.out objects, | |
| 7448 | # so no rules are provided for them. NetBSD/alpha ELF objects are | |
| 7449 | # dealt with in "elf". | |
| 7450 | 0 lelong 0x00070185 ECOFF NetBSD/alpha binary | |
| 7451 | >10 leshort 0x0001 not stripped | |
| 7452 | >10 leshort 0x0000 stripped | |
| 7453 | 0 belong&0377777777 043200507 a.out NetBSD/alpha core | |
| 7454 | >12 string >\0 from '%s' | |
| 7455 | >32 lelong !0 (signal %d) | |
| 7456 | ||
| 7457 | 0 belong&0377777777 043400413 a.out NetBSD/mips demand paged | |
| 7458 | >0 byte &0x80 | |
| 7459 | >>20 belong <8192 shared library | |
| 7460 | >>20 belong =8192 dynamically linked executable | |
| 7461 | >>20 belong >8192 dynamically linked executable | |
| 7462 | >0 byte ^0x80 executable | |
| 7463 | >16 belong >0 not stripped | |
| 7464 | 0 belong&0377777777 043400410 a.out NetBSD/mips pure | |
| 7465 | >0 byte &0x80 dynamically linked executable | |
| 7466 | >0 byte ^0x80 executable | |
| 7467 | >16 belong >0 not stripped | |
| 7468 | 0 belong&0377777777 043400407 a.out NetBSD/mips | |
| 7469 | >0 byte &0x80 dynamically linked executable | |
| 7470 | >0 byte ^0x80 | |
| 7471 | >>0 byte &0x40 position independent | |
| 7472 | >>20 belong !0 executable | |
| 7473 | >>20 belong =0 object file | |
| 7474 | >16 belong >0 not stripped | |
| 7475 | 0 belong&0377777777 043400507 a.out NetBSD/mips core | |
| 7476 | >12 string >\0 from '%s' | |
| 7477 | >32 belong !0 (signal %d) | |
| 7478 | ||
| 7479 | 0 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged | |
| 7480 | >0 byte &0x80 | |
| 7481 | >>20 lelong <4096 shared library | |
| 7482 | >>20 lelong =4096 dynamically linked executable | |
| 7483 | >>20 lelong >4096 dynamically linked executable | |
| 7484 | >0 byte ^0x80 executable | |
| 7485 | >16 lelong >0 not stripped | |
| 7486 | 0 belong&0377777777 043600410 a.out NetBSD/arm32 pure | |
| 7487 | >0 byte &0x80 dynamically linked executable | |
| 7488 | >0 byte ^0x80 executable | |
| 7489 | >16 lelong >0 not stripped | |
| 7490 | 0 belong&0377777777 043600407 a.out NetBSD/arm32 | |
| 7491 | >0 byte &0x80 dynamically linked executable | |
| 7492 | >0 byte ^0x80 | |
| 7493 | >>0 byte &0x40 position independent | |
| 7494 | >>20 lelong !0 executable | |
| 7495 | >>20 lelong =0 object file | |
| 7496 | >16 lelong >0 not stripped | |
| 7497 | # NetBSD/arm26 has always used ELF objects, but it shares a core file | |
| 7498 | # format with NetBSD/arm32. | |
| 7499 | 0 belong&0377777777 043600507 a.out NetBSD/arm core | |
| 7500 | >12 string >\0 from '%s' | |
| 7501 | >32 lelong !0 (signal %d) | |
| 7502 | ||
| 7503 | #------------------------------------------------------------------------------ | |
| 7504 | # riff: file(1) magic for RIFF format | |
| 7505 | # See | |
| 7506 | # | |
| 7507 | # http://www.seanet.com/users/matts/riffmci/riffmci.htm | |
| 7508 | # | |
| 7509 | # AVI section extended by Patrik Rådman <patrik+file-magic@iki.fi> | |
| 7510 | # | |
| 7511 | 0 string RIFF RIFF (little-endian) data | |
| 7512 | # RIFF Palette format | |
| 7513 | >8 string PAL \b, palette | |
| 7514 | >>16 leshort x \b, version %d | |
| 7515 | >>18 leshort x \b, %d entries | |
| 7516 | # RIFF Device Independent Bitmap format | |
| 7517 | >8 string RDIB \b, device-independent bitmap | |
| 7518 | >>16 string BM | |
| 7519 | >>>30 leshort 12 \b, OS/2 1.x format | |
| 7520 | >>>>34 leshort x \b, %d x | |
| 7521 | >>>>36 leshort x %d | |
| 7522 | >>>30 leshort 64 \b, OS/2 2.x format | |
| 7523 | >>>>34 leshort x \b, %d x | |
| 7524 | >>>>36 leshort x %d | |
| 7525 | >>>30 leshort 40 \b, Windows 3.x format | |
| 7526 | >>>>34 lelong x \b, %d x | |
| 7527 | >>>>38 lelong x %d x | |
| 7528 | >>>>44 leshort x %d | |
| 7529 | # RIFF MIDI format | |
| 7530 | >8 string RMID \b, MIDI | |
| 7531 | # RIFF Multimedia Movie File format | |
| 7532 | >8 string RMMP \b, multimedia movie | |
| 7533 | # Microsoft WAVE format (*.wav) | |
| 7534 | >8 string WAVE \b, WAVE audio | |
| 7535 | >>20 leshort 1 \b, Microsoft PCM | |
| 7536 | >>>34 leshort >0 \b, %d bit | |
| 7537 | >>20 leshort 2 \b, Microsoft ADPCM | |
| 7538 | >>20 leshort 6 \b, ITU G.711 A-law | |
| 7539 | >>20 leshort 7 \b, ITU G.711 mu-law | |
| 7540 | >>20 leshort 17 \b, IMA ADPCM | |
| 7541 | >>20 leshort 20 \b, ITU G.723 ADPCM (Yamaha) | |
| 7542 | >>20 leshort 49 \b, GSM 6.10 | |
| 7543 | >>20 leshort 64 \b, ITU G.721 ADPCM | |
| 7544 | >>20 leshort 80 \b, MPEG | |
| 7545 | >>20 leshort 85 \b, MPEG Layer 3 | |
| 7546 | >>22 leshort =1 \b, mono | |
| 7547 | >>22 leshort =2 \b, stereo | |
| 7548 | >>22 leshort >2 \b, %d channels | |
| 7549 | >>24 lelong >0 %d Hz | |
| 7550 | # Corel Draw Picture | |
| 7551 | >8 string CDRA \b, Corel Draw Picture | |
| 7552 | # AVI == Audio Video Interleave | |
| 7553 | >8 string AVI\040 \b, AVI | |
| 7554 | >>12 string LIST | |
| 7555 | >>>20 string hdrlavih | |
| 7556 | >>>>&36 lelong x \b, %lu x | |
| 7557 | >>>>&40 lelong x %lu, | |
| 7558 | >>>>&4 lelong >1000000 <1 fps, | |
| 7559 | >>>>&4 lelong 1000000 1.00 fps, | |
| 7560 | >>>>&4 lelong 500000 2.00 fps, | |
| 7561 | >>>>&4 lelong 333333 3.00 fps, | |
| 7562 | >>>>&4 lelong 250000 4.00 fps, | |
| 7563 | >>>>&4 lelong 200000 5.00 fps, | |
| 7564 | >>>>&4 lelong 166667 6.00 fps, | |
| 7565 | >>>>&4 lelong 142857 7.00 fps, | |
| 7566 | >>>>&4 lelong 125000 8.00 fps, | |
| 7567 | >>>>&4 lelong 111111 9.00 fps, | |
| 7568 | >>>>&4 lelong 100000 10.00 fps, | |
| 7569 | # ]9.9,10.1[ | |
| 7570 | >>>>&4 lelong <101010 | |
| 7571 | >>>>>&-4 lelong >99010 | |
| 7572 | >>>>>>&-4 lelong !100000 ~10 fps, | |
| 7573 | >>>>&4 lelong 83333 12.00 fps, | |
| 7574 | # ]11.9,12.1[ | |
| 7575 | >>>>&4 lelong <84034 | |
| 7576 | >>>>>&-4 lelong >82645 | |
| 7577 | >>>>>>&-4 lelong !83333 ~12 fps, | |
| 7578 | >>>>&4 lelong 66667 15.00 fps, | |
| 7579 | # ]14.9,15.1[ | |
| 7580 | >>>>&4 lelong <67114 | |
| 7581 | >>>>>&-4 lelong >66225 | |
| 7582 | >>>>>>&-4 lelong !66667 ~15 fps, | |
| 7583 | >>>>&4 lelong 50000 20.00 fps, | |
| 7584 | >>>>&4 lelong 41708 23.98 fps, | |
| 7585 | >>>>&4 lelong 41667 24.00 fps, | |
| 7586 | # ]23.9,24.1[ | |
| 7587 | >>>>&4 lelong <41841 | |
| 7588 | >>>>>&-4 lelong >41494 | |
| 7589 | >>>>>>&-4 lelong !41708 | |
| 7590 | >>>>>>>&-4 lelong !41667 ~24 fps, | |
| 7591 | >>>>&4 lelong 40000 25.00 fps, | |
| 7592 | # ]24.9,25.1[ | |
| 7593 | >>>>&4 lelong <40161 | |
| 7594 | >>>>>&-4 lelong >39841 | |
| 7595 | >>>>>>&-4 lelong !40000 ~25 fps, | |
| 7596 | >>>>&4 lelong 33367 29.97 fps, | |
| 7597 | >>>>&4 lelong 33333 30.00 fps, | |
| 7598 | # ]29.9,30.1[ | |
| 7599 | >>>>&4 lelong <33445 | |
| 7600 | >>>>>&-4 lelong >33223 | |
| 7601 | >>>>>>&-4 lelong !33367 | |
| 7602 | >>>>>>>&-4 lelong !33333 ~30 fps, | |
| 7603 | >>>>&4 lelong <32224 >30 fps, | |
| 7604 | ##>>>>&4 lelong x (%lu) | |
| 7605 | ##>>>>&20 lelong x %lu frames, | |
| 7606 | # Note: The tests below assume that the AVI has 1 or 2 streams, | |
| 7607 | # "vids" optionally followed by "auds". | |
| 7608 | # (Should cover 99.9% of all AVIs.) | |
| 7609 | # assuming avih length = 56 | |
| 7610 | >>>88 string LIST | |
| 7611 | >>>>96 string strlstrh | |
| 7612 | >>>>>108 string vids video: | |
| 7613 | >>>>>>&0 lelong 0 uncompressed | |
| 7614 | # skip past vids strh | |
| 7615 | >>>>>>(104.l+108) string strf | |
| 7616 | >>>>>>>(104.l+132) lelong 1 RLE 8bpp | |
| 7617 | >>>>>>>(104.l+132) string/c cvid Cinepak | |
| 7618 | >>>>>>>(104.l+132) string/c i263 Intel I.263 | |
| 7619 | >>>>>>>(104.l+132) string/c iv32 Indeo 3.2 | |
| 7620 | >>>>>>>(104.l+132) string/c iv41 Indeo 4.1 | |
| 7621 | >>>>>>>(104.l+132) string/c iv50 Indeo 5.0 | |
| 7622 | >>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2 | |
| 7623 | >>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3 | |
| 7624 | >>>>>>>(104.l+132) string/c mjpg Motion JPEG | |
| 7625 | >>>>>>>(104.l+132) string/c div3 DivX 3 | |
| 7626 | >>>>>>>>112 string/c div3 Low-Motion | |
| 7627 | >>>>>>>>112 string/c div4 Fast-Motion | |
| 7628 | >>>>>>>(104.l+132) string/c divx DivX 4 | |
| 7629 | >>>>>>>(104.l+132) string/c dx50 DivX 5 | |
| 7630 | >>>>>>>(104.l+132) string/c xvid XviD | |
| 7631 | >>>>>>>(104.l+132) lelong 0 | |
| 7632 | ##>>>>>>>(104.l+132) string x (%.4s) | |
| 7633 | # skip past first (video) LIST | |
| 7634 | >>>>(92.l+96) string LIST | |
| 7635 | >>>>>(92.l+104) string strlstrh | |
| 7636 | >>>>>>(92.l+116) string auds \b, audio: | |
| 7637 | # auds strh length = 56: | |
| 7638 | >>>>>>>(92.l+172) string strf | |
| 7639 | >>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM | |
| 7640 | >>>>>>>>(92.l+180) leshort 0x0002 ADPCM | |
| 7641 | >>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3 | |
| 7642 | >>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3 | |
| 7643 | >>>>>>>>(92.l+180) leshort 0x0161 DivX | |
| 7644 | ##>>>>>>>>(92.l+180) leshort x (0x%.4x) | |
| 7645 | >>>>>>>>(92.l+182) leshort 1 (mono, | |
| 7646 | >>>>>>>>(92.l+182) leshort 2 (stereo, | |
| 7647 | >>>>>>>>(92.l+182) leshort >2 (%d channels, | |
| 7648 | >>>>>>>>(92.l+184) lelong x %d Hz) | |
| 7649 | # auds strh length = 64: | |
| 7650 | >>>>>>>(92.l+180) string strf | |
| 7651 | >>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM | |
| 7652 | >>>>>>>>(92.l+188) leshort 0x0002 ADPCM | |
| 7653 | >>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3 | |
| 7654 | >>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3 | |
| 7655 | >>>>>>>>(92.l+188) leshort 0x0161 DivX | |
| 7656 | ##>>>>>>>>(92.l+188) leshort x (0x%.4x) | |
| 7657 | >>>>>>>>(92.l+190) leshort 1 (mono, | |
| 7658 | >>>>>>>>(92.l+190) leshort 2 (stereo, | |
| 7659 | >>>>>>>>(92.l+190) leshort >2 (%d channels, | |
| 7660 | >>>>>>>>(92.l+192) lelong x %d Hz) | |
| 7661 | # Animated Cursor format | |
| 7662 | >8 string ACON \b, animated cursor | |
| 7663 | # SoundFont 2 <mpruett@sgi.com> | |
| 7664 | >8 string sfbk SoundFont/Bank | |
| 7665 | # MPEG-1 wrapped in a RIFF, apparently | |
| 7666 | >8 string CDXA \b, wrapped MPEG-1 (CDXA) | |
| 7667 | >8 string 4XMV \b, 4X Movie file | |
| 7668 | ||
| 7669 | # | |
| 7670 | # XXX - some of the below may only appear in little-endian form. | |
| 7671 | # | |
| 7672 | # Also "MV93" appears to be for one form of Macromedia Director | |
| 7673 | # files, and "GDMF" appears to be another multimedia format. | |
| 7674 | # | |
| 7675 | 0 string RIFX RIFF (big-endian) data | |
| 7676 | # RIFF Palette format | |
| 7677 | >8 string PAL \b, palette | |
| 7678 | >>16 beshort x \b, version %d | |
| 7679 | >>18 beshort x \b, %d entries | |
| 7680 | # RIFF Device Independent Bitmap format | |
| 7681 | >8 string RDIB \b, device-independent bitmap | |
| 7682 | >>16 string BM | |
| 7683 | >>>30 beshort 12 \b, OS/2 1.x format | |
| 7684 | >>>>34 beshort x \b, %d x | |
| 7685 | >>>>36 beshort x %d | |
| 7686 | >>>30 beshort 64 \b, OS/2 2.x format | |
| 7687 | >>>>34 beshort x \b, %d x | |
| 7688 | >>>>36 beshort x %d | |
| 7689 | >>>30 beshort 40 \b, Windows 3.x format | |
| 7690 | >>>>34 belong x \b, %d x | |
| 7691 | >>>>38 belong x %d x | |
| 7692 | >>>>44 beshort x %d | |
| 7693 | # RIFF MIDI format | |
| 7694 | >8 string RMID \b, MIDI | |
| 7695 | # RIFF Multimedia Movie File format | |
| 7696 | >8 string RMMP \b, multimedia movie | |
| 7697 | # Microsoft WAVE format (*.wav) | |
| 7698 | >8 string WAVE \b, WAVE audio | |
| 7699 | >>20 leshort 1 \b, Microsoft PCM | |
| 7700 | >>>34 leshort >0 \b, %d bit | |
| 7701 | >>22 beshort =1 \b, mono | |
| 7702 | >>22 beshort =2 \b, stereo | |
| 7703 | >>22 beshort >2 \b, %d channels | |
| 7704 | >>24 belong >0 %d Hz | |
| 7705 | # Corel Draw Picture | |
| 7706 | >8 string CDRA \b, Corel Draw Picture | |
| 7707 | # AVI == Audio Video Interleave | |
| 7708 | >8 string AVI\040 \b, AVI | |
| 7709 | # Animated Cursor format | |
| 7710 | >8 string ACON \b, animated cursor | |
| 7711 | # Notation Interchange File Format (big-endian only) | |
| 7712 | >8 string NIFF \b, Notation Interchange File Format | |
| 7713 | # SoundFont 2 <mpruett@sgi.com> | |
| 7714 | >8 string sfbk SoundFont/Bank | |
| 7715 | #------------------------------------------------------------------------------ | |
| 7716 | # Console game magic | |
| 7717 | # Toby Deshane <hac@shoelace.digivill.net> | |
| 7718 | # ines: file(1) magic for Marat's iNES Nintendo Entertainment System | |
| 7719 | # ROM dump format | |
| 7720 | ||
| 7721 | 0 string NES\032 iNES ROM dump, | |
| 7722 | >4 byte x %dx16k PRG | |
| 7723 | >5 byte x \b, %dx8k CHR | |
| 7724 | >6 byte&0x01 =0x1 \b, [Vert.] | |
| 7725 | >6 byte&0x01 =0x0 \b, [Horiz.] | |
| 7726 | >6 byte&0x02 =0x2 \b, [SRAM] | |
| 7727 | >6 byte&0x04 =0x4 \b, [Trainer] | |
| 7728 | >6 byte&0x04 =0x8 \b, [4-Scr] | |
| 7729 | ||
| 7730 | #------------------------------------------------------------------------------ | |
| 7731 | # gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format | |
| 7732 | # | |
| 7733 | 0x104 belong 0xCEED6666 Gameboy ROM: | |
| 7734 | >0x134 string >\0 "%.16s" | |
| 7735 | >0x146 byte 0x03 \b,[SGB] | |
| 7736 | >0x147 byte 0x00 \b, [ROM ONLY] | |
| 7737 | >0x147 byte 0x01 \b, [ROM+MBC1] | |
| 7738 | >0x147 byte 0x02 \b, [ROM+MBC1+RAM] | |
| 7739 | >0x147 byte 0x03 \b, [ROM+MBC1+RAM+BATT] | |
| 7740 | >0x147 byte 0x05 \b, [ROM+MBC2] | |
| 7741 | >0x147 byte 0x06 \b, [ROM+MBC2+BATTERY] | |
| 7742 | >0x147 byte 0x08 \b, [ROM+RAM] | |
| 7743 | >0x147 byte 0x09 \b, [ROM+RAM+BATTERY] | |
| 7744 | >0x147 byte 0x0B \b, [ROM+MMM01] | |
| 7745 | >0x147 byte 0x0C \b, [ROM+MMM01+SRAM] | |
| 7746 | >0x147 byte 0x0D \b, [ROM+MMM01+SRAM+BATT] | |
| 7747 | >0x147 byte 0x0F \b, [ROM+MBC3+TIMER+BATT] | |
| 7748 | >0x147 byte 0x10 \b, [ROM+MBC3+TIMER+RAM+BATT] | |
| 7749 | >0x147 byte 0x11 \b, [ROM+MBC3] | |
| 7750 | >0x147 byte 0x12 \b, [ROM+MBC3+RAM] | |
| 7751 | >0x147 byte 0x13 \b, [ROM+MBC3+RAM+BATT] | |
| 7752 | >0x147 byte 0x19 \b, [ROM+MBC5] | |
| 7753 | >0x147 byte 0x1A \b, [ROM+MBC5+RAM] | |
| 7754 | >0x147 byte 0x1B \b, [ROM+MBC5+RAM+BATT] | |
| 7755 | >0x147 byte 0x1C \b, [ROM+MBC5+RUMBLE] | |
| 7756 | >0x147 byte 0x1D \b, [ROM+MBC5+RUMBLE+SRAM] | |
| 7757 | >0x147 byte 0x1E \b, [ROM+MBC5+RUMBLE+SRAM+BATT] | |
| 7758 | >0x147 byte 0x1F \b, [Pocket Camera] | |
| 7759 | >0x147 byte 0xFD \b, [Bandai TAMA5] | |
| 7760 | >0x147 byte 0xFE \b, [Hudson HuC-3] | |
| 7761 | >0x147 byte 0xFF \b, [Hudson HuC-1] | |
| 7762 | ||
| 7763 | >0x148 byte 0 \b, ROM: 256Kbit | |
| 7764 | >0x148 byte 1 \b, ROM: 512Kbit | |
| 7765 | >0x148 byte 2 \b, ROM: 1Mbit | |
| 7766 | >0x148 byte 3 \b, ROM: 2Mbit | |
| 7767 | >0x148 byte 4 \b, ROM: 4Mbit | |
| 7768 | >0x148 byte 5 \b, ROM: 8Mbit | |
| 7769 | >0x148 byte 6 \b, ROM: 16Mbit | |
| 7770 | >0x148 byte 0x52 \b, ROM: 9Mbit | |
| 7771 | >0x148 byte 0x53 \b, ROM: 10Mbit | |
| 7772 | >0x148 byte 0x54 \b, ROM: 12Mbit | |
| 7773 | ||
| 7774 | >0x149 byte 1 \b, RAM: 16Kbit | |
| 7775 | >0x149 byte 2 \b, RAM: 64Kbit | |
| 7776 | >0x149 byte 3 \b, RAM: 128Kbit | |
| 7777 | >0x149 byte 4 \b, RAM: 1Mbit | |
| 7778 | ||
| 7779 | #>0x14e long x \b, CRC: %x | |
| 7780 | ||
| 7781 | #------------------------------------------------------------------------------ | |
| 7782 | # genesis: file(1) magic for the Sega MegaDrive/Genesis raw ROM format | |
| 7783 | # | |
| 7784 | 0x100 string SEGA Sega MegaDrive/Genesis raw ROM dump | |
| 7785 | >0x120 string >\0 Name: "%.16s" | |
| 7786 | >0x110 string >\0 %.16s | |
| 7787 | >0x1B0 string RA with SRAM | |
| 7788 | ||
| 7789 | #------------------------------------------------------------------------------ | |
| 7790 | # genesis: file(1) magic for the Super MegaDrive ROM dump format | |
| 7791 | # | |
| 7792 | 0x280 string EAGN Super MagicDrive ROM dump | |
| 7793 | >0 byte x %dx16k blocks | |
| 7794 | >2 byte 0 \b, last in series or standalone | |
| 7795 | >2 byte >0 \b, split ROM | |
| 7796 | >8 byte 0xAA | |
| 7797 | >9 byte 0xBB | |
| 7798 | ||
| 7799 | #------------------------------------------------------------------------------ | |
| 7800 | # genesis: file(1) alternate magic for the Super MegaDrive ROM dump format | |
| 7801 | # | |
| 7802 | 0x280 string EAMG Super MagicDrive ROM dump | |
| 7803 | >0 byte x %dx16k blocks | |
| 7804 | >2 byte x \b, last in series or standalone | |
| 7805 | >8 byte 0xAA | |
| 7806 | >9 byte 0xBB | |
| 7807 | ||
| 7808 | #------------------------------------------------------------------------------ | |
| 7809 | # smsgg: file(1) magic for Sega Master System and Game Gear ROM dumps | |
| 7810 | # | |
| 7811 | # Does not detect all images. Very preliminary guesswork. Need more data | |
| 7812 | # on format. | |
| 7813 | # | |
| 7814 | # FIXME: need a little more info...;P | |
| 7815 | # | |
| 7816 | #0 byte 0xF3 | |
| 7817 | #>1 byte 0xED Sega Master System/Game Gear ROM dump | |
| 7818 | #>1 byte 0x31 Sega Master System/Game Gear ROM dump | |
| 7819 | #>1 byte 0xDB Sega Master System/Game Gear ROM dump | |
| 7820 | #>1 byte 0xAF Sega Master System/Game Gear ROM dump | |
| 7821 | #>1 byte 0xC3 Sega Master System/Game Gear ROM dump | |
| 7822 | ||
| 7823 | #------------------------------------------------------------------------------ | |
| 7824 | # dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format | |
| 7825 | # | |
| 7826 | 0 belong 0x21068028 Sega Dreamcast VMU game image | |
| 7827 | 0 string LCDi Dream Animator file | |
| 7828 | ||
| 7829 | #------------------------------------------------------------------------------ | |
| 7830 | # v64: file(1) uncertain magic for the V64 format N64 ROM dumps | |
| 7831 | # | |
| 7832 | 0 belong 0x37804012 V64 Nintendo 64 ROM dump | |
| 7833 | ||
| 7834 | #------------------------------------------------------------------------------ | |
| 7835 | # msx: file(1) magic for MSX game cartridge dumps | |
| 7836 | # Too simple - MPi | |
| 7837 | #0 beshort 0x4142 MSX game cartridge dump | |
| 7838 | ||
| 7839 | #------------------------------------------------------------------------------ | |
| 7840 | # Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) : | |
| 7841 | 0 string PS-X\ EXE Sony Playstation executable | |
| 7842 | # Area: | |
| 7843 | >113 string x (%s) | |
| 7844 | ||
| 7845 | #------------------------------------------------------------------------------ | |
| 7846 | # Microsoft Xbox executables .xbe (Esa Hyytiä <ehyytia@cc.hut.fi>) | |
| 7847 | 0 string XBEH XBE, Microsoft Xbox executable | |
| 7848 | # probabilistic checks whether signed or not | |
| 7849 | >0x0004 ulelong =0x0 | |
| 7850 | >>&2 ulelong =0x0 | |
| 7851 | >>>&2 ulelong =0x0 \b, not signed | |
| 7852 | >0x0004 ulelong >0 | |
| 7853 | >>&2 ulelong >0 | |
| 7854 | >>>&2 ulelong >0 \b, signed | |
| 7855 | # expect base address of 0x10000 | |
| 7856 | >0x0104 ulelong =0x10000 | |
| 7857 | >>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions | |
| 7858 | >>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007 | |
| 7859 | >>>(0x0118-0x0FF60) ulelong >0 (regions: | |
| 7860 | >>>>(0x0118-0x0FF60) ulelong &0x00000001 NA | |
| 7861 | >>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan | |
| 7862 | >>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World | |
| 7863 | >>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer | |
| 7864 | >>>(0x0118-0x0FF60) ulelong >0 \b) | |
| 7865 | ||
| 7866 | # -------------------------------- | |
| 7867 | # Microsoft Xbox data file formats | |
| 7868 | 0 string XIP0 XIP, Microsoft Xbox data | |
| 7869 | 0 string XTF0 XTF, Microsoft Xbox data | |
| 7870 | ||
| 7871 | # Atari Lynx cartridge dump (EXE/BLL header) | |
| 7872 | # From: "Stefan A. Haubenthal" <polluks@web.de> | |
| 7873 | ||
| 7874 | 0 beshort 0x8008 Lynx cartridge, | |
| 7875 | >2 beshort x RAM start $%04x | |
| 7876 | >6 string BS93 | |
| 7877 | ||
| 7878 | #------------------------------------------------------------------------------ | |
| 7879 | # Z-machine: file(1) magic for Z-machine binaries. | |
| 7880 | # | |
| 7881 | # This will match ${TEX_BASE}/texmf/omega/ocp/char2uni/inbig5.ocp which | |
| 7882 | # appears to be a version-0 Z-machine binary. | |
| 7883 | # | |
| 7884 | # The (false match) message is to correct that behavior. Perhaps it is | |
| 7885 | # not needed. | |
| 7886 | # | |
| 7887 | >16 belong&0xfe00f0f0 0x3030 Infocom game data | |
| 7888 | >0 ubyte 0 (false match) | |
| 7889 | >0 ubyte >0 (Z-machine %d, | |
| 7890 | >>2 ubeshort x Release %d / | |
| 7891 | >>18 string >\0 Serial %.6s) | |
| 7892 | ||
| 7893 | #------------------------------------------------------------------------------ | |
| 7894 | # Glulx: file(1) magic for Glulx binaries. | |
| 7895 | # | |
| 7896 | # I haven't checked for false matches yet. | |
| 7897 | # | |
| 7898 | 0 string Glul Glulx game data | |
| 7899 | ||
| 7900 | ||
| 7901 | ||
| 7902 | # These go at the end of the iff rules | |
| 7903 | # | |
| 7904 | # I don't see why these might collide with anything else. | |
| 7905 | # | |
| 7906 | # Interactive Fiction related formats | |
| 7907 | # | |
| 7908 | >8 string IFRS \b, Blorb Interactive Fiction | |
| 7909 | >>24 string Exec with executable chunk | |
| 7910 | >8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal) | |
| 7911 | ||
| 7912 | #------------------------------------------------------------------------------ | |
| 7913 | # DEC SRC Virtual Paper: Lectern files | |
| 7914 | # Karl M. Hegbloom <karlheg@inetarena.com> | |
| 7915 | 0 string lect DEC SRC Virtual Paper Lectern file | |
| 7916 | ||
| 7917 | #------------------------------------------------------------------------------ | |
| 7918 | # visx: file(1) magic for Visx format files | |
| 7919 | # | |
| 7920 | 0 short 0x5555 VISX image file | |
| 7921 | >2 byte 0 (zero) | |
| 7922 | >2 byte 1 (unsigned char) | |
| 7923 | >2 byte 2 (short integer) | |
| 7924 | >2 byte 3 (float 32) | |
| 7925 | >2 byte 4 (float 64) | |
| 7926 | >2 byte 5 (signed char) | |
| 7927 | >2 byte 6 (bit-plane) | |
| 7928 | >2 byte 7 (classes) | |
| 7929 | >2 byte 8 (statistics) | |
| 7930 | >2 byte 10 (ascii text) | |
| 7931 | >2 byte 15 (image segments) | |
| 7932 | >2 byte 100 (image set) | |
| 7933 | >2 byte 101 (unsigned char vector) | |
| 7934 | >2 byte 102 (short integer vector) | |
| 7935 | >2 byte 103 (float 32 vector) | |
| 7936 | >2 byte 104 (float 64 vector) | |
| 7937 | >2 byte 105 (signed char vector) | |
| 7938 | >2 byte 106 (bit plane vector) | |
| 7939 | >2 byte 121 (feature vector) | |
| 7940 | >2 byte 122 (feature vector library) | |
| 7941 | >2 byte 124 (chain code) | |
| 7942 | >2 byte 126 (bit vector) | |
| 7943 | >2 byte 130 (graph) | |
| 7944 | >2 byte 131 (adjacency graph) | |
| 7945 | >2 byte 132 (adjacency graph library) | |
| 7946 | >2 string .VISIX (ascii text) | |
| 7947 | #------------------------------------------------------------------------------ | |
| 7948 | # varied.script: file(1) magic for various interpreter scripts | |
| 7949 | ||
| 7950 | 0 string #!\ / a | |
| 7951 | >3 string >\0 %s script text executable | |
| 7952 | 0 string #!\ / a | |
| 7953 | >3 string >\0 %s script text executable | |
| 7954 | 0 string #!/ a | |
| 7955 | >2 string >\0 %s script text executable | |
| 7956 | 0 string #!\ script text executable | |
| 7957 | >3 string >\0 for %s | |
| 7958 | ||
| 7959 | # ------------------------------------------------------------------------ | |
| 7960 | # ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators. | |
| 7961 | # | |
| 7962 | # From: Ryan McGuire (rmcguire@freenet.columbus.oh.us). | |
| 7963 | # | |
| 7964 | # Update: Romain Lievin (roms@lpg.ticalc.org). | |
| 7965 | # | |
| 7966 | # NOTE: This list is not complete. | |
| 7967 | # Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the | |
| 7968 | # program/group magic numbers in here because I cannot find any. | |
| 7969 | 0 string **TI80** TI-80 Graphing Calculator File. | |
| 7970 | 0 string **TI81** TI-81 Graphing Calculator File. | |
| 7971 | # | |
| 7972 | # Magic Numbers for the TI-73 | |
| 7973 | # | |
| 7974 | 0 string **TI73** TI-73 Graphing Calculator | |
| 7975 | >0x00003B byte 0x00 (real number) | |
| 7976 | >0x00003B byte 0x01 (list) | |
| 7977 | >0x00003B byte 0x02 (matrix) | |
| 7978 | >0x00003B byte 0x03 (equation) | |
| 7979 | >0x00003B byte 0x04 (string) | |
| 7980 | >0x00003B byte 0x05 (program) | |
| 7981 | >0x00003B byte 0x06 (assembly program) | |
| 7982 | >0x00003B byte 0x07 (picture) | |
| 7983 | >0x00003B byte 0x08 (gdb) | |
| 7984 | >0x00003B byte 0x0C (complex number) | |
| 7985 | >0x00003B byte 0x0F (window settings) | |
| 7986 | >0x00003B byte 0x10 (zoom) | |
| 7987 | >0x00003B byte 0x11 (table setup) | |
| 7988 | >0x00003B byte 0x13 (backup) | |
| 7989 | ||
| 7990 | # Magic Numbers for the TI-82 | |
| 7991 | # | |
| 7992 | 0 string **TI82** TI-82 Graphing Calculator | |
| 7993 | >0x00003B byte 0x00 (real) | |
| 7994 | >0x00003B byte 0x01 (list) | |
| 7995 | >0x00003B byte 0x02 (matrix) | |
| 7996 | >0x00003B byte 0x03 (Y-variable) | |
| 7997 | >0x00003B byte 0x05 (program) | |
| 7998 | >0x00003B byte 0x06 (protected prgm) | |
| 7999 | >0x00003B byte 0x07 (picture) | |
| 8000 | >0x00003B byte 0x08 (gdb) | |
| 8001 | >0x00003B byte 0x0B (window settings) | |
| 8002 | >0x00003B byte 0x0C (window settings) | |
| 8003 | >0x00003B byte 0x0D (table setup) | |
| 8004 | >0x00003B byte 0x0E (screenshot) | |
| 8005 | >0x00003B byte 0x0F (backup) | |
| 8006 | # | |
| 8007 | # Magic Numbers for the TI-83 | |
| 8008 | # | |
| 8009 | 0 string **TI83** TI-83 Graphing Calculator | |
| 8010 | >0x00003B byte 0x00 (real) | |
| 8011 | >0x00003B byte 0x01 (list) | |
| 8012 | >0x00003B byte 0x02 (matrix) | |
| 8013 | >0x00003B byte 0x03 (Y-variable) | |
| 8014 | >0x00003B byte 0x04 (string) | |
| 8015 | >0x00003B byte 0x05 (program) | |
| 8016 | >0x00003B byte 0x06 (protected prgm) | |
| 8017 | >0x00003B byte 0x07 (picture) | |
| 8018 | >0x00003B byte 0x08 (gdb) | |
| 8019 | >0x00003B byte 0x0B (window settings) | |
| 8020 | >0x00003B byte 0x0C (window settings) | |
| 8021 | >0x00003B byte 0x0D (table setup) | |
| 8022 | >0x00003B byte 0x0E (screenshot) | |
| 8023 | >0x00003B byte 0x13 (backup) | |
| 8024 | # | |
| 8025 | # Magic Numbers for the TI-83+ | |
| 8026 | # | |
| 8027 | 0 string **TI83F* TI-83+ Graphing Calculator | |
| 8028 | >0x00003B byte 0x00 (real number) | |
| 8029 | >0x00003B byte 0x01 (list) | |
| 8030 | >0x00003B byte 0x02 (matrix) | |
| 8031 | >0x00003B byte 0x03 (equation) | |
| 8032 | >0x00003B byte 0x04 (string) | |
| 8033 | >0x00003B byte 0x05 (program) | |
| 8034 | >0x00003B byte 0x06 (assembly program) | |
| 8035 | >0x00003B byte 0x07 (picture) | |
| 8036 | >0x00003B byte 0x08 (gdb) | |
| 8037 | >0x00003B byte 0x0C (complex number) | |
| 8038 | >0x00003B byte 0x0F (window settings) | |
| 8039 | >0x00003B byte 0x10 (zoom) | |
| 8040 | >0x00003B byte 0x11 (table setup) | |
| 8041 | >0x00003B byte 0x13 (backup) | |
| 8042 | >0x00003B byte 0x15 (application variable) | |
| 8043 | >0x00003B byte 0x17 (group of variable) | |
| 8044 | ||
| 8045 | # | |
| 8046 | # Magic Numbers for the TI-85 | |
| 8047 | # | |
| 8048 | 0 string **TI85** TI-85 Graphing Calculator | |
| 8049 | >0x00003B byte 0x00 (real number) | |
| 8050 | >0x00003B byte 0x01 (complex number) | |
| 8051 | >0x00003B byte 0x02 (real vector) | |
| 8052 | >0x00003B byte 0x03 (complex vector) | |
| 8053 | >0x00003B byte 0x04 (real list) | |
| 8054 | >0x00003B byte 0x05 (complex list) | |
| 8055 | >0x00003B byte 0x06 (real matrix) | |
| 8056 | >0x00003B byte 0x07 (complex matrix) | |
| 8057 | >0x00003B byte 0x08 (real constant) | |
| 8058 | >0x00003B byte 0x09 (complex constant) | |
| 8059 | >0x00003B byte 0x0A (equation) | |
| 8060 | >0x00003B byte 0x0C (string) | |
| 8061 | >0x00003B byte 0x0D (function GDB) | |
| 8062 | >0x00003B byte 0x0E (polar GDB) | |
| 8063 | >0x00003B byte 0x0F (parametric GDB) | |
| 8064 | >0x00003B byte 0x10 (diffeq GDB) | |
| 8065 | >0x00003B byte 0x11 (picture) | |
| 8066 | >0x00003B byte 0x12 (program) | |
| 8067 | >0x00003B byte 0x13 (range) | |
| 8068 | >0x00003B byte 0x17 (window settings) | |
| 8069 | >0x00003B byte 0x18 (window settings) | |
| 8070 | >0x00003B byte 0x19 (window settings) | |
| 8071 | >0x00003B byte 0x1A (window settings) | |
| 8072 | >0x00003B byte 0x1B (zoom) | |
| 8073 | >0x00003B byte 0x1D (backup) | |
| 8074 | >0x00003B byte 0x1E (unknown) | |
| 8075 | >0x00003B byte 0x2A (equation) | |
| 8076 | >0x000032 string ZS4 - ZShell Version 4 File. | |
| 8077 | >0x000032 string ZS3 - ZShell Version 3 File. | |
| 8078 | # | |
| 8079 | # Magic Numbers for the TI-86 | |
| 8080 | # | |
| 8081 | 0 string **TI86** TI-86 Graphing Calculator | |
| 8082 | >0x00003B byte 0x00 (real number) | |
| 8083 | >0x00003B byte 0x01 (complex number) | |
| 8084 | >0x00003B byte 0x02 (real vector) | |
| 8085 | >0x00003B byte 0x03 (complex vector) | |
| 8086 | >0x00003B byte 0x04 (real list) | |
| 8087 | >0x00003B byte 0x05 (complex list) | |
| 8088 | >0x00003B byte 0x06 (real matrix) | |
| 8089 | >0x00003B byte 0x07 (complex matrix) | |
| 8090 | >0x00003B byte 0x08 (real constant) | |
| 8091 | >0x00003B byte 0x09 (complex constant) | |
| 8092 | >0x00003B byte 0x0A (equation) | |
| 8093 | >0x00003B byte 0x0C (string) | |
| 8094 | >0x00003B byte 0x0D (function GDB) | |
| 8095 | >0x00003B byte 0x0E (polar GDB) | |
| 8096 | >0x00003B byte 0x0F (parametric GDB) | |
| 8097 | >0x00003B byte 0x10 (diffeq GDB) | |
| 8098 | >0x00003B byte 0x11 (picture) | |
| 8099 | >0x00003B byte 0x12 (program) | |
| 8100 | >0x00003B byte 0x13 (range) | |
| 8101 | >0x00003B byte 0x17 (window settings) | |
| 8102 | >0x00003B byte 0x18 (window settings) | |
| 8103 | >0x00003B byte 0x19 (window settings) | |
| 8104 | >0x00003B byte 0x1A (window settings) | |
| 8105 | >0x00003B byte 0x1B (zoom) | |
| 8106 | >0x00003B byte 0x1D (backup) | |
| 8107 | >0x00003B byte 0x1E (unknown) | |
| 8108 | >0x00003B byte 0x2A (equation) | |
| 8109 | # | |
| 8110 | # Magic Numbers for the TI-89 | |
| 8111 | # | |
| 8112 | 0 string **TI89** TI-89 Graphing Calculator | |
| 8113 | >0x000048 byte 0x00 (expression) | |
| 8114 | >0x000048 byte 0x04 (list) | |
| 8115 | >0x000048 byte 0x06 (matrix) | |
| 8116 | >0x000048 byte 0x0A (data) | |
| 8117 | >0x000048 byte 0x0B (text) | |
| 8118 | >0x000048 byte 0x0C (string) | |
| 8119 | >0x000048 byte 0x0D (graphic data base) | |
| 8120 | >0x000048 byte 0x0E (figure) | |
| 8121 | >0x000048 byte 0x10 (picture) | |
| 8122 | >0x000048 byte 0x12 (program) | |
| 8123 | >0x000048 byte 0x13 (function) | |
| 8124 | >0x000048 byte 0x14 (macro) | |
| 8125 | >0x000048 byte 0x1C (zipped) | |
| 8126 | >0x000048 byte 0x21 (assembler) | |
| 8127 | # | |
| 8128 | # Magic Numbers for the TI-92 | |
| 8129 | # | |
| 8130 | 0 string **TI92** TI-92 Graphing Calculator | |
| 8131 | >0x000048 byte 0x00 (expression) | |
| 8132 | >0x000048 byte 0x04 (list) | |
| 8133 | >0x000048 byte 0x06 (matrix) | |
| 8134 | >0x000048 byte 0x0A (data) | |
| 8135 | >0x000048 byte 0x0B (text) | |
| 8136 | >0x000048 byte 0x0C (string) | |
| 8137 | >0x000048 byte 0x0D (graphic data base) | |
| 8138 | >0x000048 byte 0x0E (figure) | |
| 8139 | >0x000048 byte 0x10 (picture) | |
| 8140 | >0x000048 byte 0x12 (program) | |
| 8141 | >0x000048 byte 0x13 (function) | |
| 8142 | >0x000048 byte 0x14 (macro) | |
| 8143 | >0x000048 byte 0x1D (backup) | |
| 8144 | # | |
| 8145 | # Magic Numbers for the TI-92+/V200 | |
| 8146 | # | |
| 8147 | 0 string **TI92P* TI-92+/V200 Graphing Calculator | |
| 8148 | >0x000048 byte 0x00 (expression) | |
| 8149 | >0x000048 byte 0x04 (list) | |
| 8150 | >0x000048 byte 0x06 (matrix) | |
| 8151 | >0x000048 byte 0x0A (data) | |
| 8152 | >0x000048 byte 0x0B (text) | |
| 8153 | >0x000048 byte 0x0C (string) | |
| 8154 | >0x000048 byte 0x0D (graphic data base) | |
| 8155 | >0x000048 byte 0x0E (figure) | |
| 8156 | >0x000048 byte 0x10 (picture) | |
| 8157 | >0x000048 byte 0x12 (program) | |
| 8158 | >0x000048 byte 0x13 (function) | |
| 8159 | >0x000048 byte 0x14 (macro) | |
| 8160 | >0x000048 byte 0x1C (zipped) | |
| 8161 | >0x000048 byte 0x21 (assembler) | |
| 8162 | # | |
| 8163 | # Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades | |
| 8164 | # | |
| 8165 | 0x0000016 string Advanced TI-XX Graphing Calculator (FLASH) | |
| 8166 | 0 string **TIFL** TI-XX Graphing Calculator (FLASH) | |
| 8167 | >8 byte >0 - Revision %d | |
| 8168 | >>9 byte x \b.%d, | |
| 8169 | >12 byte >0 Revision date %02x | |
| 8170 | >>13 byte x \b/%02x | |
| 8171 | >>14 beshort x \b/%04x, | |
| 8172 | >17 string >/0 name: '%s', | |
| 8173 | >48 byte 0x74 device: TI-73, | |
| 8174 | >48 byte 0x73 device: TI-83+, | |
| 8175 | >48 byte 0x98 device: TI-89, | |
| 8176 | >48 byte 0x88 device: TI-92+, | |
| 8177 | >49 byte 0x23 type: OS upgrade, | |
| 8178 | >49 byte 0x24 type: application, | |
| 8179 | >49 byte 0x25 type: certificate, | |
| 8180 | >49 byte 0x3e type: license, | |
| 8181 | >74 lelong >0 size: %ld bytes | |
| 8182 | ||
| 8183 | # VTi & TiEmu skins (TI Graphing Calculators). | |
| 8184 | # From: Romain Lievin (roms@lpg.ticalc.org). | |
| 8185 | # Magic Numbers for the VTi skins | |
| 8186 | 0 string VTI Virtual TI skin | |
| 8187 | >3 string v - Version | |
| 8188 | >>4 byte >0 \b %c | |
| 8189 | >>6 byte x \b.%c | |
| 8190 | # Magic Numbers for the TiEmu skins | |
| 8191 | 0 string TiEmu TiEmu skin | |
| 8192 | >6 string v - Version | |
| 8193 | >>7 byte >0 \b %c | |
| 8194 | >>9 byte x \b.%c | |
| 8195 | >>10 byte x \b%c | |
| 8196 | ||
| 8197 | #------------------------------------------------------------------------------ | |
| 8198 | # c-lang: file(1) magic for C programs (or REXX) | |
| 8199 | # | |
| 8200 | ||
| 8201 | # XPM icons (Greg Roelofs, newt@uchicago.edu) | |
| 8202 | # if you uncomment "/*" for C/REXX below, also uncomment this entry | |
| 8203 | #0 string /*\ XPM\ */ X pixmap image data | |
| 8204 | ||
| 8205 | # this first will upset you if you're a PL/1 shop... | |
| 8206 | # in which case rm it; ascmagic will catch real C programs | |
| 8207 | #0 string /* C or REXX program text | |
| 8208 | #0 string // C++ program text | |
| 8209 | ||
| 8210 | # From: Mikhail Teterin <mi@aldan.algebra.com> | |
| 8211 | 0 string cscope cscope reference data | |
| 8212 | >7 string x version %.2s | |
| 8213 | # We skip the path here, because it is often long (so file will | |
| 8214 | # truncate it) and mostly redundant. | |
| 8215 | # The inverted index functionality was added some time betwen | |
| 8216 | # versions 11 and 15, so look for -q if version is above 14: | |
| 8217 | >7 string >14 | |
| 8218 | >>10 regex .+\ -q\ with inverted index | |
| 8219 | >10 regex .+\ -c\ text (non-compressed) | |
| 8220 | # Digital UNIX - Info | |
| 8221 | # | |
| 8222 | 0 string !<arch>\n________64E Alpha archive | |
| 8223 | >22 string X -- out of date | |
| 8224 | # | |
| 8225 | # Alpha COFF Based Executables | |
| 8226 | # The stripped stuff really needs to be an 8 byte (64 bit) compare, | |
| 8227 | # but this works | |
| 8228 | 0 leshort 0x183 COFF format alpha | |
| 8229 | >22 leshort&020000 &010000 sharable library, | |
| 8230 | >22 leshort&020000 ^010000 dynamically linked, | |
| 8231 | >24 leshort 0410 pure | |
| 8232 | >24 leshort 0413 demand paged | |
| 8233 | >8 lelong >0 executable or object module, not stripped | |
| 8234 | >8 lelong 0 | |
| 8235 | >>12 lelong 0 executable or object module, stripped | |
| 8236 | >>12 lelong >0 executable or object module, not stripped | |
| 8237 | >27 byte >0 - version %d. | |
| 8238 | >26 byte >0 %d- | |
| 8239 | >28 leshort >0 %d | |
| 8240 | # | |
| 8241 | # The next is incomplete, we could tell more about this format, | |
| 8242 | # but its not worth it. | |
| 8243 | 0 leshort 0x188 Alpha compressed COFF | |
| 8244 | 0 leshort 0x18f Alpha u-code object | |
| 8245 | # | |
| 8246 | # | |
| 8247 | # Some other interesting Digital formats, | |
| 8248 | 0 string \377\377\177 ddis/ddif | |
| 8249 | 0 string \377\377\174 ddis/dots archive | |
| 8250 | 0 string \377\377\176 ddis/dtif table data | |
| 8251 | 0 string \033c\033 LN03 output | |
| 8252 | 0 long 04553207 X image | |
| 8253 | # | |
| 8254 | 0 string !<PDF>!\n profiling data file | |
| 8255 | # | |
| 8256 | # Locale data tables (MIPS and Alpha). | |
| 8257 | # | |
| 8258 | 0 short 0x0501 locale data table | |
| 8259 | >6 short 0x24 for MIPS | |
| 8260 | >6 short 0x40 for Alpha | |
| 8261 | # ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at> | |
| 8262 | # from http://www.atsc.org/standards/a_52a.pdf | |
| 8263 | # corrections, additions, etc. are always welcome! | |
| 8264 | # | |
| 8265 | # syncword | |
| 8266 | 0 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream, | |
| 8267 | # fscod | |
| 8268 | >4 byte&0xc0 0x00 48 kHz, | |
| 8269 | >4 byte&0xc0 0x40 44.1 kHz, | |
| 8270 | >4 byte&0xc0 0x80 32 kHz, | |
| 8271 | # is this one used for 96 kHz? | |
| 8272 | >4 byte&0xc0 0xc0 reserved frequency, | |
| 8273 | # | |
| 8274 | >5 byte&7 = 0 \b, complete main (CM) | |
| 8275 | >5 byte&7 = 1 \b, music and effects (ME) | |
| 8276 | >5 byte&7 = 2 \b, visually impaired (VI) | |
| 8277 | >5 byte&7 = 3 \b, hearing impaired (HI) | |
| 8278 | >5 byte&7 = 4 \b, dialogue (D) | |
| 8279 | >5 byte&7 = 5 \b, commentary (C) | |
| 8280 | >5 byte&7 = 6 \b, emergency (E) | |
| 8281 | # acmod | |
| 8282 | >6 byte&0xe0 0x00 1+1 front, | |
| 8283 | >6 byte&0xe0 0x20 1 front/0 rear, | |
| 8284 | >6 byte&0xe0 0x40 2 front/0 rear, | |
| 8285 | >6 byte&0xe0 0x60 3 front/0 rear, | |
| 8286 | >6 byte&0xe0 0x80 2 front/1 rear, | |
| 8287 | >6 byte&0xe0 0xa0 3 front/1 rear, | |
| 8288 | >6 byte&0xe0 0xc0 2 front/2 rear, | |
| 8289 | >6 byte&0xe0 0xe0 3 front/2 rear, | |
| 8290 | # lfeon (these may be incorrect) | |
| 8291 | >7 byte&0x40 0x00 LFE off, | |
| 8292 | >7 byte&0x40 0x40 LFE on, | |
| 8293 | # | |
| 8294 | >4 byte&0x3e = 0x00 \b, 32 kbit/s | |
| 8295 | >4 byte&0x3e = 0x02 \b, 40 kbit/s | |
| 8296 | >4 byte&0x3e = 0x04 \b, 48 kbit/s | |
| 8297 | >4 byte&0x3e = 0x06 \b, 56 kbit/s | |
| 8298 | >4 byte&0x3e = 0x08 \b, 64 kbit/s | |
| 8299 | >4 byte&0x3e = 0x0a \b, 80 kbit/s | |
| 8300 | >4 byte&0x3e = 0x0c \b, 96 kbit/s | |
| 8301 | >4 byte&0x3e = 0x0e \b, 112 kbit/s | |
| 8302 | >4 byte&0x3e = 0x10 \b, 128 kbit/s | |
| 8303 | >4 byte&0x3e = 0x12 \b, 160 kbit/s | |
| 8304 | >4 byte&0x3e = 0x14 \b, 192 kbit/s | |
| 8305 | >4 byte&0x3e = 0x16 \b, 224 kbit/s | |
| 8306 | >4 byte&0x3e = 0x18 \b, 256 kbit/s | |
| 8307 | >4 byte&0x3e = 0x1a \b, 320 kbit/s | |
| 8308 | >4 byte&0x3e = 0x1c \b, 384 kbit/s | |
| 8309 | >4 byte&0x3e = 0x1e \b, 448 kbit/s | |
| 8310 | >4 byte&0x3e = 0x20 \b, 512 kbit/s | |
| 8311 | >4 byte&0x3e = 0x22 \b, 576 kbit/s | |
| 8312 | >4 byte&0x3e = 0x24 \b, 640 kbit/s | |
| 8313 | # dsurmod (these may be incorrect) | |
| 8314 | >6 beshort&0x0180 0x0000 Dolby Surround not indicated | |
| 8315 | >6 beshort&0x0180 0x0080 not Dolby Surround encoded | |
| 8316 | >6 beshort&0x0180 0x0100 Dolby Surround encoded | |
| 8317 | >6 beshort&0x0180 0x0180 reserved Dolby Surround mode | |
| 8318 | ||
| 8319 | #------------------------------------------------------------------------------ | |
| 8320 | # ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE | |
| 8321 | # | |
| 8322 | # ACE/gr binary | |
| 8323 | 0 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file | |
| 8324 | >39 byte >0 - version %c | |
| 8325 | # ACE/gr ascii | |
| 8326 | 0 string #\ xvgr\ parameter\ file ACE/gr ascii file | |
| 8327 | 0 string #\ xmgr\ parameter\ file ACE/gr ascii file | |
| 8328 | 0 string #\ ACE/gr\ parameter\ file ACE/gr ascii file | |
| 8329 | # Grace projects | |
| 8330 | 0 string #\ Grace\ project\ file Grace project file | |
| 8331 | >23 string @version\ (version | |
| 8332 | >>32 byte >0 %c | |
| 8333 | >>33 string >\0 \b.%.2s | |
| 8334 | >>35 string >\0 \b.%.2s) | |
| 8335 | # ACE/gr fit description files | |
| 8336 | 0 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file | |
| 8337 | # end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE | |
| 8338 | ||
| 8339 | #------------------------------------------------------------------------------ | |
| 8340 | # ibm370: file(1) magic for IBM 370 and compatibles. | |
| 8341 | # | |
| 8342 | # "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable". | |
| 8343 | # What the heck *is* "USS/370"? | |
| 8344 | # AIX 4.1's "/etc/magic" has | |
| 8345 | # | |
| 8346 | # 0 short 0535 370 sysV executable | |
| 8347 | # >12 long >0 not stripped | |
| 8348 | # >22 short >0 - version %d | |
| 8349 | # >30 long >0 - 5.2 format | |
| 8350 | # 0 short 0530 370 sysV pure executable | |
| 8351 | # >12 long >0 not stripped | |
| 8352 | # >22 short >0 - version %d | |
| 8353 | # >30 long >0 - 5.2 format | |
| 8354 | # | |
| 8355 | # instead of the "USS/370" versions of the same magic numbers. | |
| 8356 | # | |
| 8357 | 0 beshort 0537 370 XA sysV executable | |
| 8358 | >12 belong >0 not stripped | |
| 8359 | >22 beshort >0 - version %d | |
| 8360 | >30 belong >0 - 5.2 format | |
| 8361 | 0 beshort 0532 370 XA sysV pure executable | |
| 8362 | >12 belong >0 not stripped | |
| 8363 | >22 beshort >0 - version %d | |
| 8364 | >30 belong >0 - 5.2 format | |
| 8365 | 0 beshort 054001 370 sysV pure executable | |
| 8366 | >12 belong >0 not stripped | |
| 8367 | 0 beshort 055001 370 XA sysV pure executable | |
| 8368 | >12 belong >0 not stripped | |
| 8369 | 0 beshort 056401 370 sysV executable | |
| 8370 | >12 belong >0 not stripped | |
| 8371 | 0 beshort 057401 370 XA sysV executable | |
| 8372 | >12 belong >0 not stripped | |
| 8373 | 0 beshort 0531 SVR2 executable (Amdahl-UTS) | |
| 8374 | >12 belong >0 not stripped | |
| 8375 | >24 belong >0 - version %ld | |
| 8376 | 0 beshort 0534 SVR2 pure executable (Amdahl-UTS) | |
| 8377 | >12 belong >0 not stripped | |
| 8378 | >24 belong >0 - version %ld | |
| 8379 | 0 beshort 0530 SVR2 pure executable (USS/370) | |
| 8380 | >12 belong >0 not stripped | |
| 8381 | >24 belong >0 - version %ld | |
| 8382 | 0 beshort 0535 SVR2 executable (USS/370) | |
| 8383 | >12 belong >0 not stripped | |
| 8384 | >24 belong >0 - version %ld | |
| 8385 | ||
| 8386 | #------------------------------------------------------------------------------ | |
| 8387 | # images: file(1) magic for image formats (see also "iff") | |
| 8388 | # | |
| 8389 | # originally from jef@helios.ee.lbl.gov (Jef Poskanzer), | |
| 8390 | # additions by janl@ifi.uio.no as well as others. Jan also suggested | |
| 8391 | # merging several one- and two-line files into here. | |
| 8392 | # | |
| 8393 | # little magic: PCX (first byte is 0x0a) | |
| 8394 | ||
| 8395 | # Targa - matches `povray', `ppmtotga' and `xv' outputs | |
| 8396 | # by Philippe De Muyter <phdm@macqel.be> | |
| 8397 | # at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11 | |
| 8398 | # at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise | |
| 8399 | # at 3, leshort Index is 0 for povray, ppmtotga and xv outputs | |
| 8400 | # `xv' recognizes only a subset of the following (RGB with pixelsize = 24) | |
| 8401 | # `tgatoppm' recognizes a superset (Index may be anything) | |
| 8402 | 1 belong&0xfff7ffff 0x01010000 Targa image data - Map | |
| 8403 | >2 byte&8 8 - RLE | |
| 8404 | >12 leshort >0 %hd x | |
| 8405 | >14 leshort >0 %hd | |
| 8406 | 1 belong&0xfff7ffff 0x00020000 Targa image data - RGB | |
| 8407 | >2 byte&8 8 - RLE | |
| 8408 | >12 leshort >0 %hd x | |
| 8409 | >14 leshort >0 %hd | |
| 8410 | 1 belong&0xfff7ffff 0x00030000 Targa image data - Mono | |
| 8411 | >2 byte&8 8 - RLE | |
| 8412 | >12 leshort >0 %hd x | |
| 8413 | >14 leshort >0 %hd | |
| 8414 | ||
| 8415 | # PBMPLUS images | |
| 8416 | # The next byte following the magic is always whitespace. | |
| 8417 | 0 string P1 Netpbm PBM image text | |
| 8418 | 0 string P2 Netpbm PGM image text | |
| 8419 | 0 string P3 Netpbm PPM image text | |
| 8420 | 0 string P4 Netpbm PBM "rawbits" image data | |
| 8421 | 0 string P5 Netpbm PGM "rawbits" image data | |
| 8422 | 0 string P6 Netpbm PPM "rawbits" image data | |
| 8423 | 0 string P7 Netpbm PAM image file | |
| 8424 | ||
| 8425 | # From: bryanh@giraffe-data.com (Bryan Henderson) | |
| 8426 | 0 string \117\072 Solitaire Image Recorder format | |
| 8427 | >4 string \013 MGI Type 11 | |
| 8428 | >4 string \021 MGI Type 17 | |
| 8429 | 0 string .MDA MicroDesign data | |
| 8430 | >21 byte 48 version 2 | |
| 8431 | >21 byte 51 version 3 | |
| 8432 | 0 string .MDP MicroDesign page data | |
| 8433 | >21 byte 48 version 2 | |
| 8434 | >21 byte 51 version 3 | |
| 8435 | ||
| 8436 | # NIFF (Navy Interchange File Format, a modification of TIFF) images | |
| 8437 | 0 string IIN1 NIFF image data | |
| 8438 | ||
| 8439 | # Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com) | |
| 8440 | # The second word of TIFF files is the TIFF version number, 42, which has | |
| 8441 | # never changed. The TIFF specification recommends testing for it. | |
| 8442 | 0 string MM\x00\x2a TIFF image data, big-endian | |
| 8443 | 0 string II\x2a\x00 TIFF image data, little-endian | |
| 8444 | ||
| 8445 | # PNG [Portable Network Graphics, or "PNG's Not GIF"] images | |
| 8446 | # (Greg Roelofs, newt@uchicago.edu) | |
| 8447 | # (Albert Cahalan, acahalan@cs.uml.edu) | |
| 8448 | # | |
| 8449 | # 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ... | |
| 8450 | # | |
| 8451 | 0 string \x89PNG PNG image data, | |
| 8452 | >4 belong !0x0d0a1a0a CORRUPTED, | |
| 8453 | >4 belong 0x0d0a1a0a | |
| 8454 | >>16 belong x %ld x | |
| 8455 | >>20 belong x %ld, | |
| 8456 | >>24 byte x %d-bit | |
| 8457 | >>25 byte 0 grayscale, | |
| 8458 | >>25 byte 2 \b/color RGB, | |
| 8459 | >>25 byte 3 colormap, | |
| 8460 | >>25 byte 4 gray+alpha, | |
| 8461 | >>25 byte 6 \b/color RGBA, | |
| 8462 | #>>26 byte 0 deflate/32K, | |
| 8463 | >>28 byte 0 non-interlaced | |
| 8464 | >>28 byte 1 interlaced | |
| 8465 | 1 string PNG PNG image data, CORRUPTED | |
| 8466 | ||
| 8467 | # GIF | |
| 8468 | 0 string GIF8 GIF image data | |
| 8469 | >4 string 7a \b, version 8%s, | |
| 8470 | >4 string 9a \b, version 8%s, | |
| 8471 | >6 leshort >0 %hd x | |
| 8472 | >8 leshort >0 %hd | |
| 8473 | #>10 byte &0x80 color mapped, | |
| 8474 | #>10 byte&0x07 =0x00 2 colors | |
| 8475 | #>10 byte&0x07 =0x01 4 colors | |
| 8476 | #>10 byte&0x07 =0x02 8 colors | |
| 8477 | #>10 byte&0x07 =0x03 16 colors | |
| 8478 | #>10 byte&0x07 =0x04 32 colors | |
| 8479 | #>10 byte&0x07 =0x05 64 colors | |
| 8480 | #>10 byte&0x07 =0x06 128 colors | |
| 8481 | #>10 byte&0x07 =0x07 256 colors | |
| 8482 | ||
| 8483 | # ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster, | |
| 8484 | # 1 plane, no encoding. | |
| 8485 | 0 string \361\0\100\273 CMU window manager raster image data | |
| 8486 | >4 lelong >0 %d x | |
| 8487 | >8 lelong >0 %d, | |
| 8488 | >12 lelong >0 %d-bit | |
| 8489 | ||
| 8490 | # Magick Image File Format | |
| 8491 | 0 string id=ImageMagick MIFF image data | |
| 8492 | ||
| 8493 | # Artisan | |
| 8494 | 0 long 1123028772 Artisan image data | |
| 8495 | >4 long 1 \b, rectangular 24-bit | |
| 8496 | >4 long 2 \b, rectangular 8-bit with colormap | |
| 8497 | >4 long 3 \b, rectangular 32-bit (24-bit with matte) | |
| 8498 | ||
| 8499 | # FIG (Facility for Interactive Generation of figures), an object-based format | |
| 8500 | 0 string #FIG FIG image text | |
| 8501 | >5 string x \b, version %.3s | |
| 8502 | ||
| 8503 | # PHIGS | |
| 8504 | 0 string ARF_BEGARF PHIGS clear text archive | |
| 8505 | 0 string @(#)SunPHIGS SunPHIGS | |
| 8506 | # version number follows, in the form m.n | |
| 8507 | >40 string SunBin binary | |
| 8508 | >32 string archive archive | |
| 8509 | ||
| 8510 | # GKS (Graphics Kernel System) | |
| 8511 | 0 string GKSM GKS Metafile | |
| 8512 | >24 string SunGKS \b, SunGKS | |
| 8513 | ||
| 8514 | # CGM image files | |
| 8515 | 0 string BEGMF clear text Computer Graphics Metafile | |
| 8516 | # XXX - questionable magic | |
| 8517 | 0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile | |
| 8518 | 0 beshort 0x3020 character Computer Graphics Metafile | |
| 8519 | ||
| 8520 | # MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de) | |
| 8521 | 0 string yz MGR bitmap, modern format, 8-bit aligned | |
| 8522 | 0 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned | |
| 8523 | 0 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned | |
| 8524 | 0 string yx MGR bitmap, modern format, squeezed | |
| 8525 | ||
| 8526 | # Fuzzy Bitmap (FBM) images | |
| 8527 | 0 string %bitmap\0 FBM image data | |
| 8528 | >30 long 0x31 \b, mono | |
| 8529 | >30 long 0x33 \b, color | |
| 8530 | ||
| 8531 | # facsimile data | |
| 8532 | 1 string PC\ Research,\ Inc group 3 fax data | |
| 8533 | >29 byte 0 \b, normal resolution (204x98 DPI) | |
| 8534 | >29 byte 1 \b, fine resolution (204x196 DPI) | |
| 8535 | # From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at> | |
| 8536 | 0 string Sfff structured fax file | |
| 8537 | ||
| 8538 | ||
| 8539 | # PC bitmaps (OS/2, Windoze BMP files) (Greg Roelofs, newt@uchicago.edu) | |
| 8540 | 0 string BM PC bitmap data | |
| 8541 | >14 leshort 12 \b, OS/2 1.x format | |
| 8542 | >>18 leshort x \b, %d x | |
| 8543 | >>20 leshort x %d | |
| 8544 | >14 leshort 64 \b, OS/2 2.x format | |
| 8545 | >>18 leshort x \b, %d x | |
| 8546 | >>20 leshort x %d | |
| 8547 | >14 leshort 40 \b, Windows 3.x format | |
| 8548 | >>18 lelong x \b, %d x | |
| 8549 | >>22 lelong x %d x | |
| 8550 | >>28 leshort x %d | |
| 8551 | # Too simple - MPi | |
| 8552 | #0 string IC PC icon data | |
| 8553 | #0 string PI PC pointer image data | |
| 8554 | #0 string CI PC color icon data | |
| 8555 | #0 string CP PC color pointer image data | |
| 8556 | # Conflicts with other entries [BABYL] | |
| 8557 | #0 string BA PC bitmap array data | |
| 8558 | ||
| 8559 | # XPM icons (Greg Roelofs, newt@uchicago.edu) | |
| 8560 | # note possible collision with C/REXX entry in c-lang; currently commented out | |
| 8561 | 0 string /*\ XPM\ */ X pixmap image text | |
| 8562 | ||
| 8563 | # Utah Raster Toolkit RLE images (janl@ifi.uio.no) | |
| 8564 | 0 leshort 0xcc52 RLE image data, | |
| 8565 | >6 leshort x %d x | |
| 8566 | >8 leshort x %d | |
| 8567 | >2 leshort >0 \b, lower left corner: %d | |
| 8568 | >4 leshort >0 \b, lower right corner: %d | |
| 8569 | >10 byte&0x1 =0x1 \b, clear first | |
| 8570 | >10 byte&0x2 =0x2 \b, no background | |
| 8571 | >10 byte&0x4 =0x4 \b, alpha channel | |
| 8572 | >10 byte&0x8 =0x8 \b, comment | |
| 8573 | >11 byte >0 \b, %d color channels | |
| 8574 | >12 byte >0 \b, %d bits per pixel | |
| 8575 | >13 byte >0 \b, %d color map channels | |
| 8576 | ||
| 8577 | # image file format (Robert Potter, potter@cs.rochester.edu) | |
| 8578 | 0 string Imagefile\ version- iff image data | |
| 8579 | # this adds the whole header (inc. version number), informative but longish | |
| 8580 | >10 string >\0 %s | |
| 8581 | ||
| 8582 | # Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com) | |
| 8583 | 0 belong 0x59a66a95 Sun raster image data | |
| 8584 | >4 belong >0 \b, %d x | |
| 8585 | >8 belong >0 %d, | |
| 8586 | >12 belong >0 %d-bit, | |
| 8587 | #>16 belong >0 %d bytes long, | |
| 8588 | >20 belong 0 old format, | |
| 8589 | #>20 belong 1 standard, | |
| 8590 | >20 belong 2 compressed, | |
| 8591 | >20 belong 3 RGB, | |
| 8592 | >20 belong 4 TIFF, | |
| 8593 | >20 belong 5 IFF, | |
| 8594 | >20 belong 0xffff reserved for testing, | |
| 8595 | >24 belong 0 no colormap | |
| 8596 | >24 belong 1 RGB colormap | |
| 8597 | >24 belong 2 raw colormap | |
| 8598 | #>28 belong >0 colormap is %d bytes long | |
| 8599 | ||
| 8600 | # SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com) | |
| 8601 | # | |
| 8602 | # See | |
| 8603 | # http://reality.sgi.com/grafica/sgiimage.html | |
| 8604 | # | |
| 8605 | 0 beshort 474 SGI image data | |
| 8606 | #>2 byte 0 \b, verbatim | |
| 8607 | >2 byte 1 \b, RLE | |
| 8608 | #>3 byte 1 \b, normal precision | |
| 8609 | >3 byte 2 \b, high precision | |
| 8610 | >4 beshort x \b, %d-D | |
| 8611 | >6 beshort x \b, %d x | |
| 8612 | >8 beshort x %d | |
| 8613 | >10 beshort x \b, %d channel | |
| 8614 | >10 beshort !1 \bs | |
| 8615 | >80 string >0 \b, "%s" | |
| 8616 | ||
| 8617 | 0 string IT01 FIT image data | |
| 8618 | >4 belong x \b, %d x | |
| 8619 | >8 belong x %d x | |
| 8620 | >12 belong x %d | |
| 8621 | # | |
| 8622 | 0 string IT02 FIT image data | |
| 8623 | >4 belong x \b, %d x | |
| 8624 | >8 belong x %d x | |
| 8625 | >12 belong x %d | |
| 8626 | # | |
| 8627 | 2048 string PCD_IPI Kodak Photo CD image pack file | |
| 8628 | >0xe02 byte&0x03 0x00 , landscape mode | |
| 8629 | >0xe02 byte&0x03 0x01 , portrait mode | |
| 8630 | >0xe02 byte&0x03 0x02 , landscape mode | |
| 8631 | >0xe02 byte&0x03 0x03 , portrait mode | |
| 8632 | 0 string PCD_OPA Kodak Photo CD overview pack file | |
| 8633 | ||
| 8634 | # FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu> | |
| 8635 | # FITS is the Flexible Image Transport System, the de facto standard for | |
| 8636 | # data and image transfer, storage, etc., for the astronomical community. | |
| 8637 | # (FITS floating point formats are big-endian.) | |
| 8638 | 0 string SIMPLE\ \ = FITS image data | |
| 8639 | >109 string 8 \b, 8-bit, character or unsigned binary integer | |
| 8640 | >108 string 16 \b, 16-bit, two's complement binary integer | |
| 8641 | >107 string \ 32 \b, 32-bit, two's complement binary integer | |
| 8642 | >107 string -32 \b, 32-bit, floating point, single precision | |
| 8643 | >107 string -64 \b, 64-bit, floating point, double precision | |
| 8644 | ||
| 8645 | # other images | |
| 8646 | 0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file | |
| 8647 | 0 string !! Bennet Yee's "face" format | |
| 8648 | ||
| 8649 | # From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image | |
| 8650 | # stuff. | |
| 8651 | # | |
| 8652 | 0 beshort 0x1010 PEX Binary Archive | |
| 8653 | ||
| 8654 | # Visio drawings | |
| 8655 | 03000 string Visio\ (TM)\ Drawing %s | |
| 8656 | ||
| 8657 | # Tgif files | |
| 8658 | 0 string \%TGIF\ x Tgif file version %s | |
| 8659 | ||
| 8660 | # DICOM medical imaging data | |
| 8661 | 128 string DICM DICOM medical imaging data | |
| 8662 | ||
| 8663 | # XWD - X Window Dump file. | |
| 8664 | # As described in /usr/X11R6/include/X11/XWDFile.h | |
| 8665 | # used by the xwd program. | |
| 8666 | # Bradford Castalia, idaeim, 1/01 | |
| 8667 | 4 belong 7 XWD X Window Dump image data | |
| 8668 | >100 string >\0 \b, "%s" | |
| 8669 | >16 belong x \b, %dx | |
| 8670 | >20 belong x \b%dx | |
| 8671 | >12 belong x \b%d | |
| 8672 | ||
| 8673 | # PDS - Planetary Data System | |
| 8674 | # These files use Parameter Value Language in the header section. | |
| 8675 | # Unfortunately, there is no certain magic, but the following | |
| 8676 | # strings have been found to be most likely. | |
| 8677 | 0 string NJPL1I00 PDS (JPL) image data | |
| 8678 | 2 string NJPL1I PDS (JPL) image data | |
| 8679 | 0 string CCSD3ZF PDS (CCSD) image data | |
| 8680 | 2 string CCSD3Z PDS (CCSD) image data | |
| 8681 | 0 string PDS_ PDS image data | |
| 8682 | 0 string LBLSIZE= PDS (VICAR) image data | |
| 8683 | ||
| 8684 | # pM8x: ATARI STAD compressed bitmap format | |
| 8685 | # | |
| 8686 | # from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001 | |
| 8687 | # p M 8 5/6 xx yy zz data... | |
| 8688 | # Atari ST STAD bitmap is always 640x400, bytewise runlength compressed. | |
| 8689 | # bytes either run horizontally (pM85) or vertically (pM86). yy is the | |
| 8690 | # most frequent byte, xx and zz are runlength escape codes, where xx is | |
| 8691 | # used for runs of yy. | |
| 8692 | # | |
| 8693 | 0 string pM85 Atari ST STAD bitmap image data (hor) | |
| 8694 | >5 byte 0x00 (white background) | |
| 8695 | >5 byte 0xFF (black background) | |
| 8696 | 0 string pM86 Atari ST STAD bitmap image data (vert) | |
| 8697 | >5 byte 0x00 (white background) | |
| 8698 | >5 byte 0xFF (black background) | |
| 8699 | ||
| 8700 | # XXX: | |
| 8701 | # This is bad magic 0x5249 == 'RI' conflicts with RIFF and other | |
| 8702 | # magic. | |
| 8703 | # SGI RICE image file <mpruett@sgi.com> | |
| 8704 | #0 beshort 0x5249 RICE image | |
| 8705 | #>2 beshort x v%d | |
| 8706 | #>4 beshort x (%d x | |
| 8707 | #>6 beshort x %d) | |
| 8708 | #>8 beshort 0 8 bit | |
| 8709 | #>8 beshort 1 10 bit | |
| 8710 | #>8 beshort 2 12 bit | |
| 8711 | #>8 beshort 3 13 bit | |
| 8712 | #>10 beshort 0 4:2:2 | |
| 8713 | #>10 beshort 1 4:2:2:4 | |
| 8714 | #>10 beshort 2 4:4:4 | |
| 8715 | #>10 beshort 3 4:4:4:4 | |
| 8716 | #>12 beshort 1 RGB | |
| 8717 | #>12 beshort 2 CCIR601 | |
| 8718 | #>12 beshort 3 RP175 | |
| 8719 | #>12 beshort 4 YUV | |
| 8720 | ||
| 8721 | #------------------------------------------------------------------------------ | |
| 8722 | # | |
| 8723 | # Marco Schmidt (marcoschmidt@users.sourceforge.net) -- an image file format | |
| 8724 | # for the EPOC operating system, which is used with PDAs like those from Psion | |
| 8725 | # | |
| 8726 | # see http://huizen.dds.nl/~frodol/psiconv/html/Index.html for a description | |
| 8727 | # of various EPOC file formats | |
| 8728 | ||
| 8729 | 0 string \x37\x00\x00\x10\x42\x00\x00\x10\x00\x00\x00\x00\x39\x64\x39\x47 EPOC MBM image file | |
| 8730 | ||
| 8731 | # PCX image files | |
| 8732 | # From: Dan Fandrich <dan@coneharvesters.com> | |
| 8733 | 0 beshort 0x0a00 PCX ver. 2.5 image data | |
| 8734 | 0 beshort 0x0a02 PCX ver. 2.8 image data, with palette | |
| 8735 | 0 beshort 0x0a03 PCX ver. 2.8 image data, without palette | |
| 8736 | 0 beshort 0x0a04 PCX for Windows image data | |
| 8737 | 0 beshort 0x0a05 PCX ver. 3.0 image data | |
| 8738 | >4 leshort x bounding box [%hd, | |
| 8739 | >6 leshort x %hd] - | |
| 8740 | >8 leshort x [%hd, | |
| 8741 | >10 leshort x %hd], | |
| 8742 | >65 byte >1 %d planes each of | |
| 8743 | >3 byte x %hhd-bit | |
| 8744 | >68 byte 0 image, | |
| 8745 | >68 byte 1 colour, | |
| 8746 | >68 byte 2 grayscale, | |
| 8747 | >68 byte >2 image, | |
| 8748 | >68 byte <0 image, | |
| 8749 | >12 leshort >0 %hd x | |
| 8750 | >>14 leshort x %hd dpi, | |
| 8751 | >2 byte 0 uncompressed | |
| 8752 | >2 byte 1 RLE compressed | |
| 8753 | ||
| 8754 | # Adobe Photoshop | |
| 8755 | 0 string 8BPS Adobe Photoshop Image | |
| 8756 | ||
| 8757 | # XV thumbnail indicator (ThMO) | |
| 8758 | 0 string P7\ 332 XV thumbnail image data | |
| 8759 | ||
| 8760 | # NITF is defined by United States MIL-STD-2500A | |
| 8761 | 0 string NITF National Imagery Transmission Format | |
| 8762 | >25 string >\0 dated %.14s | |
| 8763 | ||
| 8764 | # GEM Image: Version 1, Headerlen 8 (Wolfram Kleff) | |
| 8765 | 0 belong 0x00010008 GEM Image data | |
| 8766 | >12 beshort x %d x | |
| 8767 | >14 beshort x %d, | |
| 8768 | >4 beshort x %d planes, | |
| 8769 | >8 beshort x %d x | |
| 8770 | >10 beshort x %d pixelsize | |
| 8771 | ||
| 8772 | # GEM Metafile (Wolfram Kleff) | |
| 8773 | 0 lelong 0x0018FFFF GEM Metafile data | |
| 8774 | >4 leshort x version %d | |
| 8775 | ||
| 8776 | # | |
| 8777 | # SMJPEG. A custom Motion JPEG format used by Loki Entertainment | |
| 8778 | # Software Torbjorn Andersson <d91tan@Update.UU.SE>. | |
| 8779 | # | |
| 8780 | 0 string \0\nSMJPEG SMJPEG | |
| 8781 | >8 belong x %d.x data | |
| 8782 | # According to the specification you could find any number of _TXT | |
| 8783 | # headers here, but I can't think of any way of handling that. None of | |
| 8784 | # the SMJPEG files I tried it on used this feature. Even if such a | |
| 8785 | # file is encountered the output should still be reasonable. | |
| 8786 | >16 string _SND \b, | |
| 8787 | >>24 beshort >0 %d Hz | |
| 8788 | >>26 byte 8 8-bit | |
| 8789 | >>26 byte 16 16-bit | |
| 8790 | >>28 string NONE uncompressed | |
| 8791 | # >>28 string APCM ADPCM compressed | |
| 8792 | >>27 byte 1 mono | |
| 8793 | >>28 byte 2 stereo | |
| 8794 | # Help! Isn't there any way to avoid writing this part twice? | |
| 8795 | >>32 string _VID \b, | |
| 8796 | # >>>48 string JFIF JPEG | |
| 8797 | >>>40 belong >0 %d frames | |
| 8798 | >>>44 beshort >0 (%d x | |
| 8799 | >>>46 beshort >0 %d) | |
| 8800 | >16 string _VID \b, | |
| 8801 | # >>32 string JFIF JPEG | |
| 8802 | >>24 belong >0 %d frames | |
| 8803 | >>28 beshort >0 (%d x | |
| 8804 | >>30 beshort >0 %d) | |
| 8805 | ||
| 8806 | 0 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File | |
| 8807 | ||
| 8808 | # "thumbnail file" (icon) | |
| 8809 | # descended from "xv", but in use by other applications as well (Wolfram Kleff) | |
| 8810 | 0 string P7\ 332 XV "thumbnail file" (icon) data | |
| 8811 | ||
| 8812 | # taken from fkiss: (<yav@mte.biglobe.ne.jp> ?) | |
| 8813 | 0 string KiSS KISS/GS | |
| 8814 | >4 byte 16 color | |
| 8815 | >>5 byte x %d bit | |
| 8816 | >>8 leshort x %d colors | |
| 8817 | >>10 leshort x %d groups | |
| 8818 | >4 byte 32 cell | |
| 8819 | >>5 byte x %d bit | |
| 8820 | >>8 leshort x %d x | |
| 8821 | >>10 leshort x %d | |
| 8822 | >>12 leshort x +%d | |
| 8823 | >>14 leshort x +%d | |
| 8824 | ||
| 8825 | # Webshots (www.webshots.com), by John Harrison | |
| 8826 | 0 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file | |
| 8827 | ||
| 8828 | # Hercules DASD image files | |
| 8829 | # From Jan Jaeger <jj@septa.nl> | |
| 8830 | 0 string CKD_P370 Hercules CKD DASD image file | |
| 8831 | >8 long x \b, %d heads per cylinder | |
| 8832 | >12 long x \b, track size %d bytes | |
| 8833 | >16 byte x \b, device type 33%2.2X | |
| 8834 | ||
| 8835 | 0 string CKD_C370 Hercules compressed CKD DASD image file | |
| 8836 | >8 long x \b, %d heads per cylinder | |
| 8837 | >12 long x \b, track size %d bytes | |
| 8838 | >16 byte x \b, device type 33%2.2X | |
| 8839 | ||
| 8840 | 0 string CKD_S370 Hercules CKD DASD shadow file | |
| 8841 | >8 long x \b, %d heads per cylinder | |
| 8842 | >12 long x \b, track size %d bytes | |
| 8843 | >16 byte x \b, device type 33%2.2X | |
| 8844 | ||
| 8845 | # Squeak images and - etoffi@softhome.net | |
| 8846 | 0 string \146\031\0\0 Squeak image data | |
| 8847 | 0 string 'From\040Squeak Squeak program text | |
| 8848 | ||
| 8849 | # partimage: file(1) magic for PartImage files (experimental, incomplete) | |
| 8850 | # Author: Hans-Joachim Baader <hjb@pro-linux.de> | |
| 8851 | 0 string PaRtImAgE-VoLuMe PartImage | |
| 8852 | >0x0020 string 0.6.1 file version %s | |
| 8853 | >>0x0060 lelong >-1 volume %ld | |
| 8854 | #>>0x0064 8 byte identifier | |
| 8855 | #>>0x007c reserved | |
| 8856 | >>0x0200 string >\0 type %s | |
| 8857 | >>0x1400 string >\0 device %s, | |
| 8858 | >>0x1600 string >\0 original filename %s, | |
| 8859 | # Some fields omitted | |
| 8860 | >>0x2744 lelong 0 not compressed | |
| 8861 | >>0x2744 lelong 1 gzip compressed | |
| 8862 | >>0x2744 lelong 2 bzip2 compressed | |
| 8863 | >>0x2744 lelong >2 compressed with unknown algorithm | |
| 8864 | >0x0020 string >0.6.1 file version %s | |
| 8865 | >0x0020 string <0.6.1 file version %s | |
| 8866 | ||
| 8867 | # DCX is multi-page PCX, using a simple header of up to 1024 | |
| 8868 | # offsets for the respective PCX components. | |
| 8869 | # From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de> | |
| 8870 | 0 lelong 987654321 DCX multi-page PCX image data | |
| 8871 | ||
| 8872 | # Simon Walton <simonw@matteworld.com> | |
| 8873 | # Kodak Cineon format for scanned negatives | |
| 8874 | # http://www.kodak.com/US/en/motion/support/dlad/ | |
| 8875 | 0 lelong 0xd75f2a80 Cineon image data | |
| 8876 | >200 belong >0 \b, %ld x | |
| 8877 | >204 belong >0 %ld | |
| 8878 | ||
| 8879 | ||
| 8880 | # Bio-Rad .PIC is an image format used by microscope control systems | |
| 8881 | # and related image processing software used by biologists. | |
| 8882 | # From: Vebjorn Ljosa <vebjorn@ljosa.com> | |
| 8883 | 54 leshort 12345 Bio-Rad .PIC Image File | |
| 8884 | >0 leshort >0 %hd x | |
| 8885 | >2 leshort >0 %hd, | |
| 8886 | >4 leshort =1 1 image in file | |
| 8887 | >4 leshort >1 %hd images in file | |
| 8888 | ||
| 8889 | # From Jan "Yenya" Kasprzak <kas@fi.muni.cz> | |
| 8890 | # The description of *.mrw format can be found at | |
| 8891 | # http://www.dalibor.cz/minolta/raw_file_format.htm | |
| 8892 | 0 string \000MRM Minolta Dimage camera raw image data | |
| 8893 | ||
| 8894 | # From: stephane.loeuillet@tiscali.f | |
| 8895 | # http://www.djvuzone.org/ | |
| 8896 | 0 string AT&TFORM DjVu Image file | |
| 8897 | ||
| 8898 | # From: Jason Bacon <bacon@smithers.neuro.mcw.edu> | |
| 8899 | 0 beshort 0x3020 character Computer Graphics Metafile | |
| 8900 | ||
| 8901 | ||
| 8902 | ||
| 8903 | # From: Tom Hilinski <tom.hilinski@comcast.net> | |
| 8904 | # http://www.unidata.ucar.edu/packages/netcdf/ | |
| 8905 | 0 string CDF\001 netcdf file | |
| 8906 | # | |
| 8907 | #------------------------------------------------------------------------------ | |
| 8908 | # tuxedo: file(1) magic for BEA TUXEDO data files | |
| 8909 | # | |
| 8910 | # from Ian Springer <ispringer@hotmail.com> | |
| 8911 | # | |
| 8912 | 0 string \0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0 BEA TUXEDO DES mask data | |
| 8913 | ||
| 8914 | #------------------------------------------------------------------------------ | |
| 8915 | # timezone: file(1) magic for timezone data | |
| 8916 | # | |
| 8917 | # from Daniel Quinlan (quinlan@yggdrasil.com) | |
| 8918 | # this should work on Linux, SunOS, and maybe others | |
| 8919 | # Added new official magic number for recent versions of the Olson code | |
| 8920 | 0 string TZif timezone data | |
| 8921 | 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data | |
| 8922 | 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data | |
| 8923 | 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data | |
| 8924 | 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data | |
| 8925 | 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data | |
| 8926 | 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data | |
| 8927 | ||
| 8928 | #------------------------------------------------------------------------------ | |
| 8929 | # project: file(1) magic for Project management | |
| 8930 | # | |
| 8931 | # Magic strings for ftnchek project files. Alexander Mai | |
| 8932 | 0 string FTNCHEK_\ P project file for ftnchek | |
| 8933 | >10 string 1 version 2.7 | |
| 8934 | >10 string 2 version 2.8 to 2.10 | |
| 8935 | >10 string 3 version 2.11 or later | |
| 8936 | #------------------------------------------------------------------------------ | |
| 8937 | # cisco: file(1) magic for cisco Systems routers | |
| 8938 | # | |
| 8939 | # Most cisco file-formats are covered by the generic elf code | |
| 8940 | # | |
| 8941 | # Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha. | |
| 8942 | 0 belong&0xffffff00 0x85011400 cisco IOS microcode | |
| 8943 | >7 string >\0 for '%s' | |
| 8944 | 0 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode | |
| 8945 | >7 string >\0 for '%s' | |
| 8946 | #------------------------------------------------------------------------------ | |
| 8947 | # mach file description | |
| 8948 | # | |
| 8949 | 0 belong 0xcafebabe Mach-O fat file | |
| 8950 | >4 belong 1 with 1 architecture | |
| 8951 | >4 belong >1 | |
| 8952 | >>4 belong x with %ld architectures | |
| 8953 | # | |
| 8954 | 0 belong 0xfeedface Mach-O | |
| 8955 | >12 belong 1 object | |
| 8956 | >12 belong 2 executable | |
| 8957 | >12 belong 3 shared library | |
| 8958 | >12 belong 4 core | |
| 8959 | >12 belong 5 preload executable | |
| 8960 | >12 belong 6 dynamically linked shared library | |
| 8961 | >12 belong 7 dynamic linker | |
| 8962 | >12 belong 8 bundle | |
| 8963 | >12 belong >8 | |
| 8964 | >>12 belong x filetype=%ld | |
| 8965 | >4 belong <0 | |
| 8966 | >>4 belong x architecture=%ld | |
| 8967 | >4 belong 1 vax | |
| 8968 | >4 belong 2 romp | |
| 8969 | >4 belong 3 architecture=3 | |
| 8970 | >4 belong 4 ns32032 | |
| 8971 | >4 belong 5 ns32332 | |
| 8972 | >4 belong 6 for m68k architecture | |
| 8973 | # from NeXTstep 3.0 <mach/machine.h> | |
| 8974 | # i.e. mc680x0_all, ignore | |
| 8975 | # >>8 belong 1 (mc68030) | |
| 8976 | >>8 belong 2 (mc68040) | |
| 8977 | >>8 belong 3 (mc68030 only) | |
| 8978 | >4 belong 7 i386 | |
| 8979 | >4 belong 8 mips | |
| 8980 | >4 belong 9 ns32532 | |
| 8981 | >4 belong 10 architecture=10 | |
| 8982 | >4 belong 11 hp pa-risc | |
| 8983 | >4 belong 12 acorn | |
| 8984 | >4 belong 13 m88k | |
| 8985 | >4 belong 14 sparc | |
| 8986 | >4 belong 15 i860-big | |
| 8987 | >4 belong 16 i860 | |
| 8988 | >4 belong 17 rs6000 | |
| 8989 | >4 belong 18 ppc | |
| 8990 | >4 belong >18 | |
| 8991 | >>4 belong x architecture=%ld | |
| 8992 | ||
| 8993 | #------------------------------------------------------------------------------ | |
| 8994 | # mkid: file(1) magic for mkid(1) databases | |
| 8995 | # | |
| 8996 | # ID is the binary tags database produced by mkid(1). | |
| 8997 | # | |
| 8998 | # XXX - byte order? | |
| 8999 | # | |
| 9000 | 0 string \311\304 ID tags data | |
| 9001 | >2 short >0 version %d | |
| 9002 | ||
| 9003 | #------------------------------------------------------------------------------ | |
| 9004 | # pgp: file(1) magic for Pretty Good Privacy | |
| 9005 | # | |
| 9006 | 0 beshort 0x9900 PGP key public ring | |
| 9007 | 0 beshort 0x9501 PGP key security ring | |
| 9008 | 0 beshort 0x9500 PGP key security ring | |
| 9009 | 0 beshort 0xa600 PGP encrypted data | |
| 9010 | 0 string -----BEGIN\040PGP PGP armored data | |
| 9011 | >15 string PUBLIC\040KEY\040BLOCK- public key block | |
| 9012 | >15 string MESSAGE- message | |
| 9013 | >15 string SIGNED\040MESSAGE- signed message | |
| 9014 | >15 string PGP\040SIGNATURE- signature | |
| 9015 | ||
| 9016 | #------------------------------------------------------------------------------ | |
| 9017 | # terminfo: file(1) magic for terminfo | |
| 9018 | # | |
| 9019 | # XXX - byte order for screen images? | |
| 9020 | # | |
| 9021 | 0 string \032\001 Compiled terminfo entry | |
| 9022 | 0 short 0433 Curses screen image | |
| 9023 | 0 short 0434 Curses screen image | |
| 9024 | ||
| 9025 | #------------------------------------------------------------------------------ | |
| 9026 | # printer: file(1) magic for printer-formatted files | |
| 9027 | # | |
| 9028 | ||
| 9029 | # PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com) | |
| 9030 | 0 string %! PostScript document text | |
| 9031 | >2 string PS-Adobe- conforming | |
| 9032 | >>11 string >\0 at level %.3s | |
| 9033 | >>>15 string EPS - type %s | |
| 9034 | >>>15 string Query - type %s | |
| 9035 | >>>15 string ExitServer - type %s | |
| 9036 | # Some PCs have the annoying habit of adding a ^D as a document separator | |
| 9037 | 0 string \004%! PostScript document text | |
| 9038 | >3 string PS-Adobe- conforming | |
| 9039 | >>12 string >\0 at level %.3s | |
| 9040 | >>>16 string EPS - type %s | |
| 9041 | >>>16 string Query - type %s | |
| 9042 | >>>16 string ExitServer - type %s | |
| 9043 | 0 string \033%-12345X%!PS PostScript document | |
| 9044 | ||
| 9045 | ||
| 9046 | # DOS EPS Binary File Header | |
| 9047 | # From: Ed Sznyter <ews@Black.Market.NET> | |
| 9048 | 0 belong 0xC5D0D3C6 DOS EPS Binary File | |
| 9049 | >4 long >0 Postscript starts at byte %d | |
| 9050 | >>8 long >0 length %d | |
| 9051 | >>>12 long >0 Metafile starts at byte %d | |
| 9052 | >>>>16 long >0 length %d | |
| 9053 | >>>20 long >0 TIFF starts at byte %d | |
| 9054 | >>>>24 long >0 length %d | |
| 9055 | ||
| 9056 | # Adobe's PostScript Printer Description (PPD) files | |
| 9057 | # Yves Arrouye <arrouye@marin.fdn.fr> | |
| 9058 | # | |
| 9059 | 0 string *PPD-Adobe: PPD file | |
| 9060 | >13 string x \b, ve | |
| 9061 | ||
| 9062 | # HP Printer Job Language | |
| 9063 | 0 string \033%-12345X@PJL HP Printer Job Language data | |
| 9064 | # HP Printer Job Language | |
| 9065 | # The header found on Win95 HP plot files is the "Silliest Thing possible" | |
| 9066 | # (TM) | |
| 9067 | # Every driver puts the language at some random position, with random case | |
| 9068 | # (LANGUAGE and Language) | |
| 9069 | # For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10 | |
| 9070 | # From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de> | |
| 9071 | # | |
| 9072 | 0 string \033%-12345X@PJL HP Printer Job Language data | |
| 9073 | >&0 string >\0 %s | |
| 9074 | >>&0 string >\0 %s | |
| 9075 | >>>&0 string >\0 %s | |
| 9076 | >>>>&0 string >\0 %s | |
| 9077 | #>15 string \ ENTER\ LANGUAGE\ = | |
| 9078 | #>31 string PostScript PostScript | |
| 9079 | ||
| 9080 | # HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com) | |
| 9081 | 0 string \033E\033 HP PCL printer data | |
| 9082 | >3 string \&l0A - default page size | |
| 9083 | >3 string \&l1A - US executive page size | |
| 9084 | >3 string \&l2A - US letter page size | |
| 9085 | >3 string \&l3A - US legal page size | |
| 9086 | >3 string \&l26A - A4 page size | |
| 9087 | >3 string \&l80A - Monarch envelope size | |
| 9088 | >3 string \&l81A - No. 10 envelope size | |
| 9089 | >3 string \&l90A - Intl. DL envelope size | |
| 9090 | >3 string \&l91A - Intl. C5 envelope size | |
| 9091 | >3 string \&l100A - Intl. B5 envelope size | |
| 9092 | >3 string \&l-81A - No. 10 envelope size (landscape) | |
| 9093 | >3 string \&l-90A - Intl. DL envelope size (landscape) | |
| 9094 | ||
| 9095 | # IMAGEN printer-ready files: | |
| 9096 | 0 string @document( Imagen printer | |
| 9097 | # this only works if "language xxx" is first item in Imagen header. | |
| 9098 | >10 string language\ impress (imPRESS data) | |
| 9099 | >10 string language\ daisy (daisywheel text) | |
| 9100 | >10 string language\ diablo (daisywheel text) | |
| 9101 | >10 string language\ printer (line printer emulation) | |
| 9102 | >10 string language\ tektronix (Tektronix 4014 emulation) | |
| 9103 | # Add any other languages that your Imagen uses - remember | |
| 9104 | # to keep the word `text' if the file is human-readable. | |
| 9105 | # [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)] | |
| 9106 | # | |
| 9107 | # Now magic for IMAGEN font files... | |
| 9108 | 0 string Rast RST-format raster font data | |
| 9109 | >45 string >0 face %s | |
| 9110 | # From Jukka Ukkonen | |
| 9111 | 0 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data | |
| 9112 | ||
| 9113 | # From <mike@flyn.org> | |
| 9114 | # These are the /etc/magic entries to decode data sent to an Epson printer. | |
| 9115 | 0 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data | |
| 9116 | ||
| 9117 | ||
| 9118 | #------------------------------------------------------------------------------ | |
| 9119 | # zenographics: file(1) magic for Zenographics ZjStream printer data | |
| 9120 | # Rick Richardson rickr@mn.rr.com | |
| 9121 | 0 string JZJZ | |
| 9122 | >0x12 string ZZ Zenographics ZjStream printer data (big-endian) | |
| 9123 | 0 string ZJZJ | |
| 9124 | >0x12 string ZZ Zenographics ZjStream printer data (little-endian) | |
| 9125 | ||
| 9126 | ||
| 9127 | #------------------------------------------------------------------------------ | |
| 9128 | # Oak Technologies printer stream | |
| 9129 | # Rick Richardson <rickr@mn.rr.com> | |
| 9130 | 0 string OAK | |
| 9131 | >0x07 byte 0 | |
| 9132 | >0x0b byte 0 Oak Technologies printer stream | |
| 9133 | ||
| 9134 | # This would otherwise be recognized as PostScript - nick@debian.org | |
| 9135 | 0 string %!VMF SunClock's Vector Map Format data | |
| 9136 | ||
| 9137 | #------------------------------------------------------------------------------ | |
| 9138 | # HP LaserJet 1000 series downloadable firmware file | |
| 9139 | 0 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware | |
| 9140 | ||
| 9141 | #------------------------------------------------------------------------------ | |
| 9142 | # apple: file(1) magic for Apple file formats | |
| 9143 | # | |
| 9144 | 0 string FiLeStArTfIlEsTaRt binscii (apple ][) text | |
| 9145 | 0 string \x0aGL Binary II (apple ][) data | |
| 9146 | 0 string \x76\xff Squeezed (apple ][) data | |
| 9147 | 0 string NuFile NuFile archive (apple ][) data | |
| 9148 | 0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data | |
| 9149 | 0 belong 0x00051600 AppleSingle encoded Macintosh file | |
| 9150 | 0 belong 0x00051607 AppleDouble encoded Macintosh file | |
| 9151 | ||
| 9152 | # magic for Newton PDA package formats | |
| 9153 | # from Ruda Moura <ruda@helllabs.org> | |
| 9154 | 0 string package0 Newton package, NOS 1.x, | |
| 9155 | >12 belong &0x80000000 AutoRemove, | |
| 9156 | >12 belong &0x40000000 CopyProtect, | |
| 9157 | >12 belong &0x10000000 NoCompression, | |
| 9158 | >12 belong &0x04000000 Relocation, | |
| 9159 | >12 belong &0x02000000 UseFasterCompression, | |
| 9160 | >16 belong x version %d | |
| 9161 | ||
| 9162 | 0 string package1 Newton package, NOS 2.x, | |
| 9163 | >12 belong &0x80000000 AutoRemove, | |
| 9164 | >12 belong &0x40000000 CopyProtect, | |
| 9165 | >12 belong &0x10000000 NoCompression, | |
| 9166 | >12 belong &0x04000000 Relocation, | |
| 9167 | >12 belong &0x02000000 UseFasterCompression, | |
| 9168 | >16 belong x version %d | |
| 9169 | ||
| 9170 | 0 string package4 Newton package, | |
| 9171 | >8 byte 8 NOS 1.x, | |
| 9172 | >8 byte 9 NOS 2.x, | |
| 9173 | >12 belong &0x80000000 AutoRemove, | |
| 9174 | >12 belong &0x40000000 CopyProtect, | |
| 9175 | >12 belong &0x10000000 NoCompression, | |
| 9176 | ||
| 9177 | # The following entries for the Apple II are for files that have | |
| 9178 | # been transferred as raw binary data from an Apple, without having | |
| 9179 | # been encapsulated by any of the above archivers. | |
| 9180 | # | |
| 9181 | # In general, Apple II formats are hard to identify because Apple DOS | |
| 9182 | # and especially Apple ProDOS have strong typing in the file system and | |
| 9183 | # therefore programmers never felt much need to include type information | |
| 9184 | # in the files themselves. | |
| 9185 | # | |
| 9186 | # Eric Fischer <enf@pobox.com> | |
| 9187 | ||
| 9188 | # AppleWorks word processor: | |
| 9189 | # | |
| 9190 | # This matches the standard tab stops for an AppleWorks file, but if | |
| 9191 | # a file has a tab stop set in the first four columns this will fail. | |
| 9192 | # | |
| 9193 | # The "O" is really the magic number, but that's so common that it's | |
| 9194 | # necessary to check the tab stops that follow it to avoid false positives. | |
| 9195 | ||
| 9196 | 4 string O==== AppleWorks word processor data | |
| 9197 | >85 byte&0x01 >0 \b, zoomed | |
| 9198 | >90 byte&0x01 >0 \b, paginated | |
| 9199 | >92 byte&0x01 >0 \b, with mail merge | |
| 9200 | #>91 byte x \b, left margin %d | |
| 9201 | ||
| 9202 | # AppleWorks database: | |
| 9203 | # | |
| 9204 | # This isn't really a magic number, but it's the closest thing to one | |
| 9205 | # that I could find. The 1 and 2 really mean "order in which you defined | |
| 9206 | # categories" and "left to right, top to bottom," respectively; the D and R | |
| 9207 | # mean that the cursor should move either down or right when you press Return. | |
| 9208 | ||
| 9209 | #30 string \x01D AppleWorks database data | |
| 9210 | #30 string \x02D AppleWorks database data | |
| 9211 | #30 string \x01R AppleWorks database data | |
| 9212 | #30 string \x02R AppleWorks database data | |
| 9213 | ||
| 9214 | # AppleWorks spreadsheet: | |
| 9215 | # | |
| 9216 | # Likewise, this isn't really meant as a magic number. The R or C means | |
| 9217 | # row- or column-order recalculation; the A or M means automatic or manual | |
| 9218 | # recalculation. | |
| 9219 | ||
| 9220 | #131 string RA AppleWorks spreadsheet data | |
| 9221 | #131 string RM AppleWorks spreadsheet data | |
| 9222 | #131 string CA AppleWorks spreadsheet data | |
| 9223 | #131 string CM AppleWorks spreadsheet data | |
| 9224 | ||
| 9225 | # Applesoft BASIC: | |
| 9226 | # | |
| 9227 | # This is incredibly sloppy, but will be true if the program was | |
| 9228 | # written at its usual memory location of 2048 and its first line | |
| 9229 | # number is less than 256. Yuck. | |
| 9230 | ||
| 9231 | 0 belong&0xff00ff 0x80000 Applesoft BASIC program data | |
| 9232 | #>2 leshort x \b, first line number %d | |
| 9233 | ||
| 9234 | # ORCA/EZ assembler: | |
| 9235 | # | |
| 9236 | # This will not identify ORCA/M source files, since those have | |
| 9237 | # some sort of date code instead of the two zero bytes at 6 and 7 | |
| 9238 | # XXX Conflicts with ELF | |
| 9239 | #4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data | |
| 9240 | #>5 byte x \b, build number %d | |
| 9241 | ||
| 9242 | # Broderbund Fantavision | |
| 9243 | # | |
| 9244 | # I don't know what these values really mean, but they seem to recur. | |
| 9245 | # Will they cause too many conflicts? | |
| 9246 | ||
| 9247 | # Probably :-) | |
| 9248 | #2 belong&0xFF00FF 0x040008 Fantavision movie data | |
| 9249 | ||
| 9250 | # Some attempts at images. | |
| 9251 | # | |
| 9252 | # These are actually just bit-for-bit dumps of the frame buffer, so | |
| 9253 | # there's really no reasonably way to distinguish them except for their | |
| 9254 | # address (if preserved) -- 8192 or 16384 -- and their length -- 8192 | |
| 9255 | # or, occasionally, 8184. | |
| 9256 | # | |
| 9257 | # Nevertheless this will manage to catch a lot of images that happen | |
| 9258 | # to have a solid-colored line at the bottom of the screen. | |
| 9259 | ||
| 9260 | 8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background | |
| 9261 | 8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background | |
| 9262 | 8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background | |
| 9263 | 8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background | |
| 9264 | 8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background | |
| 9265 | ||
| 9266 | # Beagle Bros. Apple Mechanic fonts | |
| 9267 | ||
| 9268 | 0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font | |
| 9269 | ||
| 9270 | # Apple Universal Disk Image Format (UDIF) - dmg files. | |
| 9271 | # From Johan Gade. | |
| 9272 | # These entries are disabled for now until we fix the following issues. | |
| 9273 | # | |
| 9274 | # Note there might be some problems with the "VAX COFF executable" | |
| 9275 | # entry. Note this entry should be placed before the mac filesystem section, | |
| 9276 | # particularly the "Apple Partition data" entry. | |
| 9277 | # | |
| 9278 | # The intended meaning of these tests is, that the file is only of the | |
| 9279 | # specified type if both of the lines are correct - i.e. if the first | |
| 9280 | # line matches and the second doesn't then it is not of that type. | |
| 9281 | # | |
| 9282 | #0 long 0x7801730d | |
| 9283 | #>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) | |
| 9284 | # | |
| 9285 | # Note that this entry is recognized correctly by the "Apple Partition | |
| 9286 | # data" entry - however since this entry is more specific - this | |
| 9287 | # information seems to be more useful. | |
| 9288 | #0 long 0x45520200 | |
| 9289 | #>0x410 string disk\ image UDIF read/write image (UDRW) | |
| 9290 | ||
| 9291 | #------------------------------------------------------------------------------ | |
| 9292 | # applix: file(1) magic for Applixware | |
| 9293 | # From: Peter Soos <sp@osb.hu> | |
| 9294 | # | |
| 9295 | 0 string *BEGIN Applixware | |
| 9296 | >7 string WORDS Words Document | |
| 9297 | >7 string GRAPHICS Graphic | |
| 9298 | >7 string RASTER Bitmap | |
| 9299 | >7 string SPREADSHEETS Spreadsheet | |
| 9300 | >7 string MACRO Macro | |
| 9301 | >7 string BUILDER Builder Object | |
| 9302 | ||
| 9303 | #------------------------------------------------------------------------------ | |
| 9304 | # interleaf: file(1) magic for InterLeaf TPS: | |
| 9305 | # | |
| 9306 | 0 string =\210OPS Interleaf saved data | |
| 9307 | 0 string =<!OPS Interleaf document text | |
| 9308 | >5 string ,\ Version\ = \b, version | |
| 9309 | >>17 string >\0 %.3s | |
| 9310 | ||
| 9311 | #------------------------------------------------------------------------------ | |
| 9312 | # lisp: file(1) magic for lisp programs | |
| 9313 | # | |
| 9314 | # various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) | |
| 9315 | ||
| 9316 | # This is a guess, but a good one. | |
| 9317 | 0 string ;; Lisp/Scheme program text | |
| 9318 | ||
| 9319 | # Emacs 18 - this is always correct, but not very magical. | |
| 9320 | 0 string \012( Emacs v18 byte-compiled Lisp data | |
| 9321 | # Emacs 19+ - ver. recognition added by Ian Springer | |
| 9322 | # Also applies to XEmacs 19+ .elc files; could tell them apart if we had regexp | |
| 9323 | # support or similar - Chris Chittleborough <cchittleborough@yahoo.com.au> | |
| 9324 | 0 string ;ELC | |
| 9325 | >4 byte >19 | |
| 9326 | >4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data | |
| 9327 | ||
| 9328 | # Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr> | |
| 9329 | 0 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program text | |
| 9330 | 0 long 0x70768BD2 CLISP memory image data | |
| 9331 | 0 long 0xD28B7670 CLISP memory image data, other endian | |
| 9332 | ||
| 9333 | # Files produced by GNU gettext | |
| 9334 | 0 long 0xDE120495 GNU-format message catalog data | |
| 9335 | 0 long 0x950412DE GNU-format message catalog data | |
| 9336 | ||
| 9337 | #.com and .bin for MIT scheme | |
| 9338 | 0 string \372\372\372\372 MIT scheme (library?) | |
| 9339 | ||
| 9340 | # From: David Allouche <david@allouche.net> | |
| 9341 | 0 string \<TeXmacs| TeXmacs document text | |
| 9342 | ||
| 9343 | #------------------------------------------------------------------------------ | |
| 9344 | # spec: file(1) magic for SPEC raw results (*.raw, *.rsf) | |
| 9345 | # | |
| 9346 | # Cloyce D. Spradling <cloyce@headgear.org> | |
| 9347 | ||
| 9348 | 0 string spec SPEC | |
| 9349 | >4 string .cpu CPU | |
| 9350 | >>8 string <: \b%.4s | |
| 9351 | >>12 string . raw result text | |
| 9352 | ||
| 9353 | 17 string version=SPECjbb SPECjbb | |
| 9354 | >32 string <: \b%.4s | |
| 9355 | >>37 string <: v%.4s raw result text | |
| 9356 | ||
| 9357 | 0 string BEGIN\040SPECWEB SPECweb | |
| 9358 | >13 string <: \b%.2s | |
| 9359 | >>15 string _SSL \b_SSL | |
| 9360 | >>>20 string <: v%.4s raw result text | |
| 9361 | >>16 string <: v%.4s raw result text | |
| 9362 | ||
| 9363 | #------------------------------------------------------------------------------ | |
| 9364 | # sniffer: file(1) magic for packet capture files | |
| 9365 | # | |
| 9366 | # From: guy@alum.mit.edu (Guy Harris) | |
| 9367 | # | |
| 9368 | ||
| 9369 | # | |
| 9370 | # Microsoft Network Monitor 1.x capture files. | |
| 9371 | # | |
| 9372 | 0 string RTSS NetMon capture file | |
| 9373 | >5 byte x - version %d | |
| 9374 | >4 byte x \b.%d | |
| 9375 | >6 leshort 0 (Unknown) | |
| 9376 | >6 leshort 1 (Ethernet) | |
| 9377 | >6 leshort 2 (Token Ring) | |
| 9378 | >6 leshort 3 (FDDI) | |
| 9379 | >6 leshort 4 (ATM) | |
| 9380 | ||
| 9381 | # | |
| 9382 | # Microsoft Network Monitor 2.x capture files. | |
| 9383 | # | |
| 9384 | 0 string GMBU NetMon capture file | |
| 9385 | >5 byte x - version %d | |
| 9386 | >4 byte x \b.%d | |
| 9387 | >6 leshort 0 (Unknown) | |
| 9388 | >6 leshort 1 (Ethernet) | |
| 9389 | >6 leshort 2 (Token Ring) | |
| 9390 | >6 leshort 3 (FDDI) | |
| 9391 | >6 leshort 4 (ATM) | |
| 9392 | ||
| 9393 | # | |
| 9394 | # Network General Sniffer capture files. | |
| 9395 | # Sorry, make that "Network Associates Sniffer capture files." | |
| 9396 | # Sorry, make that "Network General old DOS Sniffer capture files." | |
| 9397 | # | |
| 9398 | 0 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file | |
| 9399 | >33 byte 2 (compressed) | |
| 9400 | >23 leshort x - version %d | |
| 9401 | >25 leshort x \b.%d | |
| 9402 | >32 byte 0 (Token Ring) | |
| 9403 | >32 byte 1 (Ethernet) | |
| 9404 | >32 byte 2 (ARCNET) | |
| 9405 | >32 byte 3 (StarLAN) | |
| 9406 | >32 byte 4 (PC Network broadband) | |
| 9407 | >32 byte 5 (LocalTalk) | |
| 9408 | >32 byte 6 (Znet) | |
| 9409 | >32 byte 7 (Internetwork Analyzer) | |
| 9410 | >32 byte 9 (FDDI) | |
| 9411 | >32 byte 10 (ATM) | |
| 9412 | ||
| 9413 | # | |
| 9414 | # Cinco Networks NetXRay capture files. | |
| 9415 | # Sorry, make that "Network General Sniffer Basic capture files." | |
| 9416 | # Sorry, make that "Network Associates Sniffer Basic capture files." | |
| 9417 | # Sorry, make that "Network Associates Sniffer Basic, and Windows | |
| 9418 | # Sniffer Pro", capture files." | |
| 9419 | # Sorry, make that "Network General Sniffer capture files." | |
| 9420 | # | |
| 9421 | 0 string XCP\0 NetXRay capture file | |
| 9422 | >4 string >\0 - version %s | |
| 9423 | >44 leshort 0 (Ethernet) | |
| 9424 | >44 leshort 1 (Token Ring) | |
| 9425 | >44 leshort 2 (FDDI) | |
| 9426 | >44 leshort 3 (WAN) | |
| 9427 | >44 leshort 8 (ATM) | |
| 9428 | >44 leshort 9 (802.11) | |
| 9429 | ||
| 9430 | # | |
| 9431 | # "libpcap" capture files. | |
| 9432 | # (We call them "tcpdump capture file(s)" for now, as "tcpdump" is | |
| 9433 | # the main program that uses that format, but there are other programs | |
| 9434 | # that use "libpcap", or that use the same capture file format.) | |
| 9435 | # | |
| 9436 | 0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian) | |
| 9437 | >4 beshort x - version %d | |
| 9438 | >6 beshort x \b.%d | |
| 9439 | >20 belong 0 (No link-layer encapsulation | |
| 9440 | >20 belong 1 (Ethernet | |
| 9441 | >20 belong 2 (3Mb Ethernet | |
| 9442 | >20 belong 3 (AX.25 | |
| 9443 | >20 belong 4 (ProNET | |
| 9444 | >20 belong 5 (CHAOS | |
| 9445 | >20 belong 6 (Token Ring | |
| 9446 | >20 belong 7 (BSD ARCNET | |
| 9447 | >20 belong 8 (SLIP | |
| 9448 | >20 belong 9 (PPP | |
| 9449 | >20 belong 10 (FDDI | |
| 9450 | >20 belong 11 (RFC 1483 ATM | |
| 9451 | >20 belong 12 (raw IP | |
| 9452 | >20 belong 13 (BSD/OS SLIP | |
| 9453 | >20 belong 14 (BSD/OS PPP | |
| 9454 | >20 belong 19 (Linux ATM Classical IP | |
| 9455 | >20 belong 50 (PPP or Cisco HDLC | |
| 9456 | >20 belong 51 (PPP-over-Ethernet | |
| 9457 | >20 belong 99 (Symantec Enterprise Firewall | |
| 9458 | >20 belong 100 (RFC 1483 ATM | |
| 9459 | >20 belong 101 (raw IP | |
| 9460 | >20 belong 102 (BSD/OS SLIP | |
| 9461 | >20 belong 103 (BSD/OS PPP | |
| 9462 | >20 belong 104 (BSD/OS Cisco HDLC | |
| 9463 | >20 belong 105 (802.11 | |
| 9464 | >20 belong 106 (Linux Classical IP over ATM | |
| 9465 | >20 belong 107 (Frame Relay | |
| 9466 | >20 belong 108 (OpenBSD loopback | |
| 9467 | >20 belong 109 (OpenBSD IPsec encrypted | |
| 9468 | >20 belong 112 (Cisco HDLC | |
| 9469 | >20 belong 113 (Linux "cooked" | |
| 9470 | >20 belong 114 (LocalTalk | |
| 9471 | >20 belong 117 (OpenBSD PFLOG | |
| 9472 | >20 belong 119 (802.11 with Prism header | |
| 9473 | >20 belong 122 (RFC 2625 IP over Fibre Channel | |
| 9474 | >20 belong 123 (SunATM | |
| 9475 | >20 belong 127 (802.11 with radiotap header | |
| 9476 | >20 belong 129 (Linux ARCNET | |
| 9477 | >20 belong 138 (Apple IP over IEEE 1394 | |
| 9478 | >20 belong 140 (MTP2 | |
| 9479 | >20 belong 141 (MTP3 | |
| 9480 | >20 belong 143 (DOCSIS | |
| 9481 | >20 belong 144 (IrDA | |
| 9482 | >20 belong 147 (Private use 0 | |
| 9483 | >20 belong 148 (Private use 1 | |
| 9484 | >20 belong 149 (Private use 2 | |
| 9485 | >20 belong 150 (Private use 3 | |
| 9486 | >20 belong 151 (Private use 4 | |
| 9487 | >20 belong 152 (Private use 5 | |
| 9488 | >20 belong 153 (Private use 6 | |
| 9489 | >20 belong 154 (Private use 7 | |
| 9490 | >20 belong 155 (Private use 8 | |
| 9491 | >20 belong 156 (Private use 9 | |
| 9492 | >20 belong 157 (Private use 10 | |
| 9493 | >20 belong 158 (Private use 11 | |
| 9494 | >20 belong 159 (Private use 12 | |
| 9495 | >20 belong 160 (Private use 13 | |
| 9496 | >20 belong 161 (Private use 14 | |
| 9497 | >20 belong 162 (Private use 15 | |
| 9498 | >20 belong 163 (802.11 with AVS header | |
| 9499 | >16 belong x \b, capture length %d) | |
| 9500 | 0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian) | |
| 9501 | >4 leshort x - version %d | |
| 9502 | >6 leshort x \b.%d | |
| 9503 | >20 lelong 0 (No link-layer encapsulation | |
| 9504 | >20 lelong 1 (Ethernet | |
| 9505 | >20 lelong 2 (3Mb Ethernet | |
| 9506 | >20 lelong 3 (AX.25 | |
| 9507 | >20 lelong 4 (ProNET | |
| 9508 | >20 lelong 5 (CHAOS | |
| 9509 | >20 lelong 6 (Token Ring | |
| 9510 | >20 lelong 7 (ARCNET | |
| 9511 | >20 lelong 8 (SLIP | |
| 9512 | >20 lelong 9 (PPP | |
| 9513 | >20 lelong 10 (FDDI | |
| 9514 | >20 lelong 11 (RFC 1483 ATM | |
| 9515 | >20 lelong 12 (raw IP | |
| 9516 | >20 lelong 13 (BSD/OS SLIP | |
| 9517 | >20 lelong 14 (BSD/OS PPP | |
| 9518 | >20 lelong 19 (Linux ATM Classical IP | |
| 9519 | >20 lelong 50 (PPP or Cisco HDLC | |
| 9520 | >20 lelong 51 (PPP-over-Ethernet | |
| 9521 | >20 lelong 99 (Symantec Enterprise Firewall | |
| 9522 | >20 lelong 100 (RFC 1483 ATM | |
| 9523 | >20 lelong 101 (raw IP | |
| 9524 | >20 lelong 102 (BSD/OS SLIP | |
| 9525 | >20 lelong 103 (BSD/OS PPP | |
| 9526 | >20 lelong 104 (BSD/OS Cisco HDLC | |
| 9527 | >20 lelong 105 (802.11 | |
| 9528 | >20 lelong 106 (Linux Classical IP over ATM | |
| 9529 | >20 lelong 107 (Frame Relay | |
| 9530 | >20 lelong 108 (OpenBSD loopback | |
| 9531 | >20 lelong 109 (OpenBSD IPsec encrypted | |
| 9532 | >20 lelong 112 (Cisco HDLC | |
| 9533 | >20 lelong 113 (Linux "cooked" | |
| 9534 | >20 lelong 114 (LocalTalk | |
| 9535 | >20 lelong 117 (OpenBSD PFLOG | |
| 9536 | >20 lelong 119 (802.11 with Prism header | |
| 9537 | >20 lelong 122 (RFC 2625 IP over Fibre Channel | |
| 9538 | >20 lelong 123 (SunATM | |
| 9539 | >20 lelong 127 (802.11 with radiotap header | |
| 9540 | >20 lelong 129 (Linux ARCNET | |
| 9541 | >20 lelong 138 (Apple IP over IEEE 1394 | |
| 9542 | >20 lelong 140 (MTP2 | |
| 9543 | >20 lelong 141 (MTP3 | |
| 9544 | >20 lelong 143 (DOCSIS | |
| 9545 | >20 lelong 144 (IrDA | |
| 9546 | >20 lelong 147 (Private use 0 | |
| 9547 | >20 lelong 148 (Private use 1 | |
| 9548 | >20 lelong 149 (Private use 2 | |
| 9549 | >20 lelong 150 (Private use 3 | |
| 9550 | >20 lelong 151 (Private use 4 | |
| 9551 | >20 lelong 152 (Private use 5 | |
| 9552 | >20 lelong 153 (Private use 6 | |
| 9553 | >20 lelong 154 (Private use 7 | |
| 9554 | >20 lelong 155 (Private use 8 | |
| 9555 | >20 lelong 156 (Private use 9 | |
| 9556 | >20 lelong 157 (Private use 10 | |
| 9557 | >20 lelong 158 (Private use 11 | |
| 9558 | >20 lelong 159 (Private use 12 | |
| 9559 | >20 lelong 160 (Private use 13 | |
| 9560 | >20 lelong 161 (Private use 14 | |
| 9561 | >20 lelong 162 (Private use 15 | |
| 9562 | >20 lelong 163 (802.11 with AVS header | |
| 9563 | >16 lelong x \b, capture length %d) | |
| 9564 | ||
| 9565 | # | |
| 9566 | # "libpcap"-with-Alexey-Kuznetsov's-patches capture files. | |
| 9567 | # (We call them "tcpdump capture file(s)" for now, as "tcpdump" is | |
| 9568 | # the main program that uses that format, but there are other programs | |
| 9569 | # that use "libpcap", or that use the same capture file format.) | |
| 9570 | # | |
| 9571 | 0 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian) | |
| 9572 | >4 beshort x - version %d | |
| 9573 | >6 beshort x \b.%d | |
| 9574 | >20 belong 0 (No link-layer encapsulation | |
| 9575 | >20 belong 1 (Ethernet | |
| 9576 | >20 belong 2 (3Mb Ethernet | |
| 9577 | >20 belong 3 (AX.25 | |
| 9578 | >20 belong 4 (ProNET | |
| 9579 | >20 belong 5 (CHAOS | |
| 9580 | >20 belong 6 (Token Ring | |
| 9581 | >20 belong 7 (ARCNET | |
| 9582 | >20 belong 8 (SLIP | |
| 9583 | >20 belong 9 (PPP | |
| 9584 | >20 belong 10 (FDDI | |
| 9585 | >20 belong 11 (RFC 1483 ATM | |
| 9586 | >20 belong 12 (raw IP | |
| 9587 | >20 belong 13 (BSD/OS SLIP | |
| 9588 | >20 belong 14 (BSD/OS PPP | |
| 9589 | >16 belong x \b, capture length %d) | |
| 9590 | 0 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian) | |
| 9591 | >4 leshort x - version %d | |
| 9592 | >6 leshort x \b.%d | |
| 9593 | >20 lelong 0 (No link-layer encapsulation | |
| 9594 | >20 lelong 1 (Ethernet | |
| 9595 | >20 lelong 2 (3Mb Ethernet | |
| 9596 | >20 lelong 3 (AX.25 | |
| 9597 | >20 lelong 4 (ProNET | |
| 9598 | >20 lelong 5 (CHAOS | |
| 9599 | >20 lelong 6 (Token Ring | |
| 9600 | >20 lelong 7 (ARCNET | |
| 9601 | >20 lelong 8 (SLIP | |
| 9602 | >20 lelong 9 (PPP | |
| 9603 | >20 lelong 10 (FDDI | |
| 9604 | >20 lelong 11 (RFC 1483 ATM | |
| 9605 | >20 lelong 12 (raw IP | |
| 9606 | >20 lelong 13 (BSD/OS SLIP | |
| 9607 | >20 lelong 14 (BSD/OS PPP | |
| 9608 | >16 lelong x \b, capture length %d) | |
| 9609 | ||
| 9610 | # | |
| 9611 | # AIX "iptrace" capture files. | |
| 9612 | # | |
| 9613 | 0 string iptrace\ 1.0 "iptrace" capture file | |
| 9614 | 0 string iptrace\ 2.0 "iptrace" capture file | |
| 9615 | ||
| 9616 | # | |
| 9617 | # Novell LANalyzer capture files. | |
| 9618 | # | |
| 9619 | 0 leshort 0x1001 LANalyzer capture file | |
| 9620 | 0 leshort 0x1007 LANalyzer capture file | |
| 9621 | ||
| 9622 | # | |
| 9623 | # HP-UX "nettl" capture files. | |
| 9624 | # | |
| 9625 | 0 string \x54\x52\x00\x64\x00 "nettl" capture file | |
| 9626 | ||
| 9627 | # | |
| 9628 | # RADCOM WAN/LAN Analyzer capture files. | |
| 9629 | # | |
| 9630 | 0 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file | |
| 9631 | ||
| 9632 | # | |
| 9633 | # NetStumbler log files. Not really packets, per se, but about as | |
| 9634 | # close as you can get. These are log files from NetStumbler, a | |
| 9635 | # Windows program, that scans for 802.11b networks. | |
| 9636 | # | |
| 9637 | 0 string NetS NetStumbler log file | |
| 9638 | >8 lelong x \b, %d stations found | |
| 9639 | ||
| 9640 | # | |
| 9641 | # EtherPeek/AiroPeek "version 9" capture files. | |
| 9642 | # | |
| 9643 | 0 string \177ver EtherPeek/AiroPeek capture file | |
| 9644 | ||
| 9645 | # | |
| 9646 | # Visual Networks traffic capture files. | |
| 9647 | # | |
| 9648 | 0 string \x05VNF Visual Networks traffic capture file | |
| 9649 | ||
| 9650 | # | |
| 9651 | # Network Instruments Observer capture files. | |
| 9652 | # | |
| 9653 | 0 string ObserverPktBuffe Network Instruments Observer capture file | |
| 9654 | ||
| 9655 | # | |
| 9656 | # Files from Accellent Group's 5View products. | |
| 9657 | # | |
| 9658 | 0 string \xaa\xaa\xaa\xaa 5View capture file | |
| 9659 | ||
| 9660 | #------------------------------------------------------------------------------ | |
| 9661 | # file(1) magic for revision control files | |
| 9662 | # From Hendrik Scholz <hendrik@scholz.net> | |
| 9663 | 0 string /1\ :pserver: cvs password text file | |
| 9664 | #------------------------------------------------------------------------------ | |
| 9665 | # amigaos: file(1) magic for AmigaOS binary formats: | |
| 9666 | ||
| 9667 | # | |
| 9668 | # From ignatios@cs.uni-bonn.de (Ignatios Souvatzis) | |
| 9669 | # | |
| 9670 | 0 belong 0x000003fa AmigaOS shared library | |
| 9671 | 0 belong 0x000003f3 AmigaOS loadseg()ble executable/binary | |
| 9672 | 0 belong 0x000003e7 AmigaOS object/library data | |
| 9673 | # | |
| 9674 | 0 beshort 0xe310 Amiga Workbench | |
| 9675 | >2 beshort 1 | |
| 9676 | >>48 byte 1 disk icon | |
| 9677 | >>48 byte 2 drawer icon | |
| 9678 | >>48 byte 3 tool icon | |
| 9679 | >>48 byte 4 project icon | |
| 9680 | >>48 byte 5 garbage icon | |
| 9681 | >>48 byte 6 device icon | |
| 9682 | >>48 byte 7 kickstart icon | |
| 9683 | >>48 byte 8 workbench application icon | |
| 9684 | >2 beshort >1 icon, vers. %d | |
| 9685 | # | |
| 9686 | # various sound formats from the Amiga | |
| 9687 | # G=F6tz Waschk <waschk@informatik.uni-rostock.de> | |
| 9688 | # | |
| 9689 | 0 string FC14 Future Composer 1.4 Module sound file | |
| 9690 | 0 string SMOD Future Composer 1.3 Module sound file | |
| 9691 | 0 string AON4artofnoise Art Of Noise Module sound file | |
| 9692 | 1 string MUGICIAN/SOFTEYES Mugician Module sound file | |
| 9693 | 58 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file | |
| 9694 | 0 string Synth4.0 Synthesis Module sound file | |
| 9695 | 0 string ARP. The Holy Noise Module sound file | |
| 9696 | 0 string BeEp\0 JamCracker Module sound file | |
| 9697 | 0 string COSO\0 Hippel-COSO Module sound file | |
| 9698 | # Too simple (short, pure ASCII, deep), MPi | |
| 9699 | #26 string V.3 Brian Postma's Soundmon Module sound file v3 | |
| 9700 | #26 string BPSM Brian Postma's Soundmon Module sound file v3 | |
| 9701 | #26 string V.2 Brian Postma's Soundmon Module sound file v2 | |
| 9702 | ||
| 9703 | # The following are from: "Stefan A. Haubenthal" <polluks@web.de> | |
| 9704 | 0 beshort 0x0f00 AmigaOS bitmap font | |
| 9705 | 0 beshort 0x0f03 AmigaOS outline font | |
| 9706 | 0 belong 0x80001001 AmigaOS outline tag | |
| 9707 | 0 string ##\ version catalog translation | |
| 9708 | ||
| 9709 | # Amiga disk types | |
| 9710 | # | |
| 9711 | 0 string RDSK Rigid Disk Block | |
| 9712 | >160 string x on %.24s | |
| 9713 | 0 string DOS\0 Amiga DOS disk | |
| 9714 | 0 string DOS\1 Amiga FFS disk | |
| 9715 | 0 string DOS\2 Amiga Inter DOS disk | |
| 9716 | 0 string DOS\3 Amiga Inter FFS disk | |
| 9717 | 0 string DOS\4 Amiga Fastdir DOS disk | |
| 9718 | 0 string DOS\5 Amiga Fastdir FFS disk | |
| 9719 | 0 string KICK Kickstart disk | |
| 9720 | ||
| 9721 | #------------------------------------------------------------------------------ | |
| 9722 | # database: file(1) magic for various databases | |
| 9723 | # | |
| 9724 | # extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) | |
| 9725 | # | |
| 9726 | # | |
| 9727 | # GDBM magic numbers | |
| 9728 | # Will be maintained as part of the GDBM distribution in the future. | |
| 9729 | # <downsj@teeny.org> | |
| 9730 | 0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian | |
| 9731 | 0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian | |
| 9732 | 0 string GDBM GNU dbm 2.x database | |
| 9733 | # | |
| 9734 | # Berkeley DB | |
| 9735 | # | |
| 9736 | # Ian Darwin's file /etc/magic files: big/little-endian version. | |
| 9737 | # | |
| 9738 | # Hash 1.85/1.86 databases store metadata in network byte order. | |
| 9739 | # Btree 1.85/1.86 databases store the metadata in host byte order. | |
| 9740 | # Hash and Btree 2.X and later databases store the metadata in host byte order. | |
| 9741 | ||
| 9742 | 0 long 0x00061561 Berkeley DB | |
| 9743 | >8 belong 4321 | |
| 9744 | >>4 belong >2 1.86 | |
| 9745 | >>4 belong <3 1.85 | |
| 9746 | >>4 belong >0 (Hash, version %d, native byte-order) | |
| 9747 | >8 belong 1234 | |
| 9748 | >>4 belong >2 1.86 | |
| 9749 | >>4 belong <3 1.85 | |
| 9750 | >>4 belong >0 (Hash, version %d, little-endian) | |
| 9751 | ||
| 9752 | 0 belong 0x00061561 Berkeley DB | |
| 9753 | >8 belong 4321 | |
| 9754 | >>4 belong >2 1.86 | |
| 9755 | >>4 belong <3 1.85 | |
| 9756 | >>4 belong >0 (Hash, version %d, big-endian) | |
| 9757 | >8 belong 1234 | |
| 9758 | >>4 belong >2 1.86 | |
| 9759 | >>4 belong <3 1.85 | |
| 9760 | >>4 belong >0 (Hash, version %d, native byte-order) | |
| 9761 | ||
| 9762 | 0 long 0x00053162 Berkeley DB 1.85/1.86 | |
| 9763 | >4 long >0 (Btree, version %d, native byte-order) | |
| 9764 | 0 belong 0x00053162 Berkeley DB 1.85/1.86 | |
| 9765 | >4 belong >0 (Btree, version %d, big-endian) | |
| 9766 | 0 lelong 0x00053162 Berkeley DB 1.85/1.86 | |
| 9767 | >4 lelong >0 (Btree, version %d, little-endian) | |
| 9768 | ||
| 9769 | 12 long 0x00061561 Berkeley DB | |
| 9770 | >16 long >0 (Hash, version %d, native byte-order) | |
| 9771 | 12 belong 0x00061561 Berkeley DB | |
| 9772 | >16 belong >0 (Hash, version %d, big-endian) | |
| 9773 | 12 lelong 0x00061561 Berkeley DB | |
| 9774 | >16 lelong >0 (Hash, version %d, little-endian) | |
| 9775 | ||
| 9776 | 12 long 0x00053162 Berkeley DB | |
| 9777 | >16 long >0 (Btree, version %d, native byte-order) | |
| 9778 | 12 belong 0x00053162 Berkeley DB | |
| 9779 | >16 belong >0 (Btree, version %d, big-endian) | |
| 9780 | 12 lelong 0x00053162 Berkeley DB | |
| 9781 | >16 lelong >0 (Btree, version %d, little-endian) | |
| 9782 | ||
| 9783 | 12 long 0x00042253 Berkeley DB | |
| 9784 | >16 long >0 (Queue, version %d, native byte-order) | |
| 9785 | 12 belong 0x00042253 Berkeley DB | |
| 9786 | >16 belong >0 (Queue, version %d, big-endian) | |
| 9787 | 12 lelong 0x00042253 Berkeley DB | |
| 9788 | >16 lelong >0 (Queue, version %d, little-endian) | |
| 9789 | # | |
| 9790 | # | |
| 9791 | # Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch> | |
| 9792 | 0 string RRD RRDTool DB | |
| 9793 | >4 string x version %s | |
| 9794 | #---------------------------------------------------------------------- | |
| 9795 | # ROOT: file(1) magic for ROOT databases | |
| 9796 | # | |
| 9797 | 0 string root\0 ROOT file | |
| 9798 | >4 belong x Version %d | |
| 9799 | >33 belong x (Compression: %d) | |
| 9800 | ||
| 9801 | # XXX: Weak magic. | |
| 9802 | # Alex Ott <ott@jet.msk.su> | |
| 9803 | ## Paradox file formats | |
| 9804 | #2 leshort 0x0800 Paradox | |
| 9805 | #>0x39 byte 3 v. 3.0 | |
| 9806 | #>0x39 byte 4 v. 3.5 | |
| 9807 | #>0x39 byte 9 v. 4.x | |
| 9808 | #>0x39 byte 10 v. 5.x | |
| 9809 | #>0x39 byte 11 v. 5.x | |
| 9810 | #>0x39 byte 12 v. 7.x | |
| 9811 | #>>0x04 byte 0 indexed .DB data file | |
| 9812 | #>>0x04 byte 1 primary index .PX file | |
| 9813 | #>>0x04 byte 2 non-indexed .DB data file | |
| 9814 | #>>0x04 byte 3 non-incrementing secondary index .Xnn file | |
| 9815 | #>>0x04 byte 4 secondary index .Ynn file | |
| 9816 | #>>0x04 byte 5 incrementing secondary index .Xnn file | |
| 9817 | #>>0x04 byte 6 non-incrementing secondary index .XGn file | |
| 9818 | #>>0x04 byte 7 secondary index .YGn file | |
| 9819 | #>>>0x04 byte 8 incrementing secondary index .XGn file | |
| 9820 | ## XBase database files | |
| 9821 | #0 byte 0x02 | |
| 9822 | #>8 leshort >0 | |
| 9823 | #>>12 leshort 0 FoxBase | |
| 9824 | #>>>0x04 lelong 0 (no records) | |
| 9825 | #>>>0x04 lelong >0 (%ld records) | |
| 9826 | # | |
| 9827 | #0 byte 0x03 | |
| 9828 | #>8 leshort >0 | |
| 9829 | #>>12 leshort 0 FoxBase+, FoxPro, dBaseIII+, dBaseIV, no memo | |
| 9830 | #>>>0x04 lelong 0 (no records) | |
| 9831 | #>>>0x04 lelong >0 (%ld records) | |
| 9832 | # | |
| 9833 | #0 byte 0x04 | |
| 9834 | #>8 leshort >0 | |
| 9835 | #>>12 leshort 0 dBASE IV no memo file | |
| 9836 | #>>>0x04 lelong 0 (no records) | |
| 9837 | #>>>0x04 lelong >0 (%ld records) | |
| 9838 | # | |
| 9839 | #0 byte 0x05 | |
| 9840 | #>8 leshort >0 | |
| 9841 | #>>12 leshort 0 dBASE V no memo file | |
| 9842 | #>>>0x04 lelong 0 (no records) | |
| 9843 | #>>>0x04 lelong >0 (%ld records) | |
| 9844 | # | |
| 9845 | #0 byte 0x30 | |
| 9846 | #>8 leshort >0 | |
| 9847 | #>>12 leshort 0 Visual FoxPro | |
| 9848 | #>>>0x04 lelong 0 (no records) | |
| 9849 | #>>>0x04 lelong >0 (%ld records) | |
| 9850 | # | |
| 9851 | #0 byte 0x43 | |
| 9852 | #>8 leshort >0 | |
| 9853 | #>>12 leshort 0 FlagShip with memo var size | |
| 9854 | #>>>0x04 lelong 0 (no records) | |
| 9855 | #>>>0x04 lelong >0 (%ld records) | |
| 9856 | # | |
| 9857 | #0 byte 0x7b | |
| 9858 | #>8 leshort >0 | |
| 9859 | #>>12 leshort 0 dBASEIV with memo | |
| 9860 | #>>>0x04 lelong 0 (no records) | |
| 9861 | #>>>0x04 lelong >0 (%ld records) | |
| 9862 | # | |
| 9863 | #0 byte 0x83 | |
| 9864 | #>8 leshort >0 | |
| 9865 | #>>12 leshort 0 FoxBase+, dBaseIII+ with memo | |
| 9866 | #>>>0x04 lelong 0 (no records) | |
| 9867 | #>>>0x04 lelong >0 (%ld records) | |
| 9868 | # | |
| 9869 | #0 byte 0x8b | |
| 9870 | #>8 leshort >0 | |
| 9871 | #>>12 leshort 0 dBaseIV with memo | |
| 9872 | #>>>0x04 lelong 0 (no records) | |
| 9873 | #>>>0x04 lelong >0 (%ld records) | |
| 9874 | # | |
| 9875 | #0 byte 0x8e | |
| 9876 | #>8 leshort >0 | |
| 9877 | #>>12 leshort 0 dBaseIV with SQL Table | |
| 9878 | #>>>0x04 lelong 0 (no records) | |
| 9879 | #>>>0x04 lelong >0 (%ld records) | |
| 9880 | # | |
| 9881 | #0 byte 0xb3 | |
| 9882 | #>8 leshort >0 | |
| 9883 | #>>12 leshort 0 FlagShip with .dbt memo | |
| 9884 | #>>>0x04 lelong 0 (no records) | |
| 9885 | #>>>0x04 lelong >0 (%ld records) | |
| 9886 | # | |
| 9887 | #0 byte 0xf5 | |
| 9888 | #>8 leshort >0 | |
| 9889 | #>>12 leshort 0 FoxPro with memo | |
| 9890 | #>>>0x04 lelong 0 (no records) | |
| 9891 | #>>>0x04 lelong >0 (%ld records) | |
| 9892 | # | |
| 9893 | #0 leshort 0x0006 DBase 3 index file | |
| 9894 | ||
| 9895 | # MS Access database | |
| 9896 | 4 string Standard\ Jet\ DB Microsoft Access Database | |
| 9897 | ||
| 9898 | # TDB database from Samba et al - Martin Pool <mbp@samba.org> | |
| 9899 | 0 string TDB\ file TDB database | |
| 9900 | >32 lelong 0x2601196D version 6, little-endian | |
| 9901 | >>36 lelong x hash size %d bytes | |
| 9902 | ||
| 9903 | # SE Linux policy database | |
| 9904 | 0 lelong 0xf97cff8c SE Linux policy | |
| 9905 | >16 lelong x v%d | |
| 9906 | >20 lelong 1 MLS | |
| 9907 | >24 lelong x %d symbols | |
| 9908 | >28 lelong x %d ocons | |
| 9909 | ||
| 9910 | # ICE authority file data (Wolfram Kleff) | |
| 9911 | 2 string ICE ICE authority data | |
| 9912 | ||
| 9913 | # X11 Xauthority file (Wolfram Kleff) | |
| 9914 | 10 string MIT-MAGIC-COOKIE-1 X11 Xauthority data | |
| 9915 | 11 string MIT-MAGIC-COOKIE-1 X11 Xauthority data | |
| 9916 | 12 string MIT-MAGIC-COOKIE-1 X11 Xauthority data | |
| 9917 | 13 string MIT-MAGIC-COOKIE-1 X11 Xauthority data | |
| 9918 | 14 string MIT-MAGIC-COOKIE-1 X11 Xauthority data | |
| 9919 | 15 string MIT-MAGIC-COOKIE-1 X11 Xauthority data | |
| 9920 | 16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data | |
| 9921 | 17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data | |
| 9922 | 18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data | |
| 9923 | ||
| 9924 | #------------------------------------------------------------------------------ | |
| 9925 | # gringotts: file(1) magic for Gringotts | |
| 9926 | # http://devel.pluto.linux.it/projects/Gringotts/ | |
| 9927 | # author: Germano Rizzo <mano@pluto.linux.it> | |
| 9928 | #GRG3????Y | |
| 9929 | 0 string GRG Gringotts data file | |
| 9930 | #file format 1 | |
| 9931 | >3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9 | |
| 9932 | #file format 2 | |
| 9933 | >3 string 2 v.2, MCRYPT S2K, | |
| 9934 | >>8 byte&0x70 0x00 RIJNDAEL-128 crypt, | |
| 9935 | >>8 byte&0x70 0x10 SERPENT crypt, | |
| 9936 | >>8 byte&0x70 0x20 TWOFISH crypt, | |
| 9937 | >>8 byte&0x70 0x30 CAST-256 crypt, | |
| 9938 | >>8 byte&0x70 0x40 SAFER+ crypt, | |
| 9939 | >>8 byte&0x70 0x50 LOKI97 crypt, | |
| 9940 | >>8 byte&0x70 0x60 3DES crypt, | |
| 9941 | >>8 byte&0x70 0x70 RIJNDAEL-256 crypt, | |
| 9942 | >>8 byte&0x08 0x00 SHA1 hash, | |
| 9943 | >>8 byte&0x08 0x08 RIPEMD-160 hash, | |
| 9944 | >>8 byte&0x04 0x00 ZLib | |
| 9945 | >>8 byte&0x04 0x04 BZip2 | |
| 9946 | >>8 byte&0x03 0x00 lvl.0 | |
| 9947 | >>8 byte&0x03 0x01 lvl.3 | |
| 9948 | >>8 byte&0x03 0x02 lvl.6 | |
| 9949 | >>8 byte&0x03 0x03 lvl.9 | |
| 9950 | #file format 3 | |
| 9951 | >3 string 3 v.3, OpenPGP S2K, | |
| 9952 | >>8 byte&0x70 0x00 RIJNDAEL-128 crypt, | |
| 9953 | >>8 byte&0x70 0x10 SERPENT crypt, | |
| 9954 | >>8 byte&0x70 0x20 TWOFISH crypt, | |
| 9955 | >>8 byte&0x70 0x30 CAST-256 crypt, | |
| 9956 | >>8 byte&0x70 0x40 SAFER+ crypt, | |
| 9957 | >>8 byte&0x70 0x50 LOKI97 crypt, | |
| 9958 | >>8 byte&0x70 0x60 3DES crypt, | |
| 9959 | >>8 byte&0x70 0x70 RIJNDAEL-256 crypt, | |
| 9960 | >>8 byte&0x08 0x00 SHA1 hash, | |
| 9961 | >>8 byte&0x08 0x08 RIPEMD-160 hash, | |
| 9962 | >>8 byte&0x04 0x00 ZLib | |
| 9963 | >>8 byte&0x04 0x04 BZip2 | |
| 9964 | >>8 byte&0x03 0x00 lvl.0 | |
| 9965 | >>8 byte&0x03 0x01 lvl.3 | |
| 9966 | >>8 byte&0x03 0x02 lvl.6 | |
| 9967 | >>8 byte&0x03 0x03 lvl.9 | |
| 9968 | #file format >3 | |
| 9969 | >3 string >3 v.%.1s (unknown details) | |
| 9970 | ||
| 9971 | #------------------------------------------------------------------------------ | |
| 9972 | # pbm: file(1) magic for Portable Bitmap files | |
| 9973 | # | |
| 9974 | # XXX - byte order? | |
| 9975 | # | |
| 9976 | 0 short 0x2a17 "compact bitmap" format (Poskanzer) | |
| 9977 | ||
| 9978 | #------------------------------------------------------------------------------ | |
| 9979 | # plus5: file(1) magic for Plus Five's UNIX MUMPS | |
| 9980 | # | |
| 9981 | # XXX - byte order? Paging Hokey.... | |
| 9982 | # | |
| 9983 | 0 short 0x259 mumps avl global | |
| 9984 | >2 byte >0 (V%d) | |
| 9985 | >6 byte >0 with %d byte name | |
| 9986 | >7 byte >0 and %d byte data cells | |
| 9987 | 0 short 0x25a mumps blt global | |
| 9988 | >2 byte >0 (V%d) | |
| 9989 | >8 short >0 - %d byte blocks | |
| 9990 | >15 byte 0x00 - P/D format | |
| 9991 | >15 byte 0x01 - P/K/D format | |
| 9992 | >15 byte 0x02 - K/D format | |
| 9993 | >15 byte >0x02 - Bad Flags | |
| 9994 | ||
| 9995 | #------------------------------------------------------------------------------ | |
| 9996 | # vms: file(1) magic for VMS executables (experimental) | |
| 9997 | # | |
| 9998 | # VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu) | |
| 9999 | ||
| 10000 | # GRR 950122: I'm just guessing on these, based on inspection of the headers | |
| 10001 | # of three executables each for Alpha and VAX architectures. The VAX files | |
| 10002 | # all had headers similar to this: | |
| 10003 | # | |
| 10004 | # 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205 | |
| 10005 | # 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................ | |
| 10006 | # | |
| 10007 | 0 string \xb0\0\x30\0 VMS VAX executable | |
| 10008 | >44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption | |
| 10009 | # | |
| 10010 | # The AXP files all looked like this, except that the byte at offset 0x22 | |
| 10011 | # was 06 in some of them and 07 in others: | |
| 10012 | # | |
| 10013 | # 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................ | |
| 10014 | # 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h............... | |
| 10015 | # 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | |
| 10016 | # 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ | |
| 10017 | # 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................ | |
| 10018 | # | |
| 10019 | 0 belong 0x03000000 VMS Alpha executable | |
| 10020 | >75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption | |
| 10021 | ||
| 10022 | #------------------------------------------------------------------------------ | |
| 10023 | # python: file(1) magic for python | |
| 10024 | # | |
| 10025 | # From: David Necas <yeti@physics.muni.cz> | |
| 10026 | # often the module starts with a multiline string | |
| 10027 | 0 string """ a python script text executable | |
| 10028 | # MAGIC as specified in Python/import.c (1.5 to 2.3.0a) | |
| 10029 | # 20121 ( YEAR - 1995 ) + MONTH + DAY (little endian followed by "\r\n" | |
| 10030 | 0 belong 0x994e0d0a python 1.5/1.6 byte-compiled | |
| 10031 | 0 belong 0x87c60d0a python 2.0 byte-compiled | |
| 10032 | 0 belong 0x2aeb0d0a python 2.1 byte-compiled | |
| 10033 | 0 belong 0x2ded0d0a python 2.2 byte-compiled | |
| 10034 | 0 belong 0x3bf20d0a python 2.3 byte-compiled | |
| 10035 | ||
| 10036 | #------------------------------------------------------------------------------ | |
| 10037 | # chord: file(1) magic for Chord music sheet typesetting utility input files | |
| 10038 | # | |
| 10039 | # From Philippe De Muyter <phdm@macqel.be> | |
| 10040 | # File format is actually free, but many distributed files begin with `{title' | |
| 10041 | # | |
| 10042 | 0 string {title Chord text file | |
| 10043 | ||
| 10044 | ||
| 10045 | # ---------------------------------------------------------------------------- | |
| 10046 | # ctags: file (1) magic for Exuberant Ctags files | |
| 10047 | # From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de> | |
| 10048 | 0 string !_TAG Exuberant Ctags tag file text | |
| 10049 | ||
| 10050 | #------------------------------------------------------------------------------ | |
| 10051 | # human68k: file(1) magic for Human68k (X680x0 DOS) binary formats | |
| 10052 | # Magic too short! | |
| 10053 | #0 string HU Human68k | |
| 10054 | #>68 string LZX LZX compressed | |
| 10055 | #>>72 string >\0 (version %s) | |
| 10056 | #>(8.L+74) string LZX LZX compressed | |
| 10057 | #>>(8.L+78) string >\0 (version %s) | |
| 10058 | #>60 belong >0 binded | |
| 10059 | #>(8.L+66) string #HUPAIR hupair | |
| 10060 | #>0 string HU X executable | |
| 10061 | #>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1 | |
| 10062 | #>4 belong >0 - base address 0x%x | |
| 10063 | #>28 belong >0 not stripped | |
| 10064 | #>32 belong >0 with debug information | |
| 10065 | #0 beshort 0x601a Human68k Z executable | |
| 10066 | #0 beshort 0x6000 Human68k object file | |
| 10067 | #0 belong 0xd1000000 Human68k ar binary archive | |
| 10068 | #0 belong 0xd1010000 Human68k ar ascii archive | |
| 10069 | #0 beshort 0x0068 Human68k lib archive | |
| 10070 | #4 string LZX Human68k LZX compressed | |
| 10071 | #>8 string >\0 (version %s) | |
| 10072 | #>4 string LZX R executable | |
| 10073 | #2 string #HUPAIR Human68k hupair R executable | |
| 10074 | ||
| 10075 | #------------------------------------------------------------------------------ | |
| 10076 | # pdp: file(1) magic for PDP-11 executable/object and APL workspace | |
| 10077 | # | |
| 10078 | 0 lelong 0101555 PDP-11 single precision APL workspace | |
| 10079 | 0 lelong 0101554 PDP-11 double precision APL workspace | |
| 10080 | # | |
| 10081 | # PDP-11 a.out | |
| 10082 | # | |
| 10083 | 0 leshort 0407 PDP-11 executable | |
| 10084 | >8 leshort >0 not stripped | |
| 10085 | >15 byte >0 - version %ld | |
| 10086 | ||
| 10087 | 0 leshort 0401 PDP-11 UNIX/RT ldp | |
| 10088 | 0 leshort 0405 PDP-11 old overlay | |
| 10089 | ||
| 10090 | 0 leshort 0410 PDP-11 pure executable | |
| 10091 | >8 leshort >0 not stripped | |
| 10092 | >15 byte >0 - version %ld | |
| 10093 | ||
| 10094 | 0 leshort 0411 PDP-11 separate I&D executable | |
| 10095 | >8 leshort >0 not stripped | |
| 10096 | >15 byte >0 - version %ld | |
| 10097 | ||
| 10098 | 0 leshort 0437 PDP-11 kernel overlay | |
| 10099 | ||
| 10100 | # These last three are derived from 2.11BSD file(1) | |
| 10101 | 0 leshort 0413 PDP-11 demand-paged pure executable | |
| 10102 | >8 leshort >0 not stripped | |
| 10103 | ||
| 10104 | 0 leshort 0430 PDP-11 overlaid pure executable | |
| 10105 | >8 leshort >0 not stripped | |
| 10106 | ||
| 10107 | 0 leshort 0431 PDP-11 overlaid separate executable | |
| 10108 | >8 leshort >0 not stripped | |
| 10109 | ||
| 10110 | #------------------------------------------------------------------------ | |
| 10111 | # file(1) magic for sharc files | |
| 10112 | # | |
| 10113 | # SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by | |
| 10114 | # FutureGroove Music (dsp@futuregroove.de) | |
| 10115 | ||
| 10116 | #------------------------------------------------------------------------ | |
| 10117 | 0 string Draw RiscOS Drawfile | |
| 10118 | 0 string PACK RiscOS PackdDir archive | |
| 10119 | ||
| 10120 | #------------------------------------------------------------------------ | |
| 10121 | # SHARC DSP stuff (based on the FGM SHARC DSP SDK) | |
| 10122 | ||
| 10123 | 0 string ! Assembler source | |
| 10124 | 0 string Analog ADi asm listing file | |
| 10125 | 0 string .SYSTEM SHARC architecture file | |
| 10126 | 0 string .system SHARC architecture file | |
| 10127 | ||
| 10128 | 0 leshort 0x521C SHARC COFF binary | |
| 10129 | >2 leshort >1 , %hd sections | |
| 10130 | >>12 lelong >0 , not stripped | |
| 10131 | ||
| 10132 | #------------------------------------------------------------------------------ | |
| 10133 | # pulsar: file(1) magic for Pulsar POP3 daemon binary files | |
| 10134 | # | |
| 10135 | # http://pulsar.sourceforge.net | |
| 10136 | # mailto:rok.papez@lugos.si | |
| 10137 | # | |
| 10138 | ||
| 10139 | 0 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file. | |
| 10140 | >4 ubelong x Version: %d. | |
| 10141 | >8 ubelong x \b%d | |
| 10142 | ||
| 10143 | ||
| 10144 | #------------------------------------------------------------------------------ | |
| 10145 | # apl: file(1) magic for APL (see also "pdp" and "vax" for other APL | |
| 10146 | # workspaces) | |
| 10147 | # | |
| 10148 | 0 long 0100554 APL workspace (Ken's original?) | |
| 10149 | ||
| 10150 | #---------------------------------------------------------------------------- | |
| 10151 | # communication | |
| 10152 | ||
| 10153 | # TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3. | |
| 10154 | # It is used for conformance testing of communication protocols. | |
| 10155 | # Added by W. Borgert <debacle@debian.org>. | |
| 10156 | 0 string $Suite TTCN Abstract Test Suite | |
| 10157 | >&1 string $SuiteId | |
| 10158 | >>&1 string >\n %s | |
| 10159 | >&2 string $SuiteId | |
| 10160 | >>&1 string >\n %s | |
| 10161 | >&3 string $SuiteId | |
| 10162 | >>&1 string >\n %s | |
| 10163 | ||
| 10164 | # MSC (message sequence charts) are a formal description technique, | |
| 10165 | # described in ITU-T Z.120, mainly used for communication protocols. | |
| 10166 | # Added by W. Borgert <debacle@debian.org>. | |
| 10167 | 0 string mscdocument Message Sequence Chart (document) | |
| 10168 | 0 string msc Message Sequence Chart (chart) | |
| 10169 | 0 string submsc Message Sequence Chart (subchart) | |
| 10170 | ||
| 10171 | #------------------------------------------------------------------------------ | |
| 10172 | # ncr: file(1) magic for NCR Tower objects | |
| 10173 | # | |
| 10174 | # contributed by | |
| 10175 | # Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa | |
| 10176 | # uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP | |
| 10177 | # | |
| 10178 | 0 beshort 000610 Tower/XP rel 2 object | |
| 10179 | >12 belong >0 not stripped | |
| 10180 | >20 beshort 0407 executable | |
| 10181 | >20 beshort 0410 pure executable | |
| 10182 | >22 beshort >0 - version %ld | |
| 10183 | 0 beshort 000615 Tower/XP rel 2 object | |
| 10184 | >12 belong >0 not stripped | |
| 10185 | >20 beshort 0407 executable | |
| 10186 | >20 beshort 0410 pure executable | |
| 10187 | >22 beshort >0 - version %ld | |
| 10188 | 0 beshort 000620 Tower/XP rel 3 object | |
| 10189 | >12 belong >0 not stripped | |
| 10190 | >20 beshort 0407 executable | |
| 10191 | >20 beshort 0410 pure executable | |
| 10192 | >22 beshort >0 - version %ld | |
| 10193 | 0 beshort 000625 Tower/XP rel 3 object | |
| 10194 | >12 belong >0 not stripped | |
| 10195 | >20 beshort 0407 executable | |
| 10196 | >20 beshort 0410 pure executable | |
| 10197 | >22 beshort >0 - version %ld | |
| 10198 | 0 beshort 000630 Tower32/600/400 68020 object | |
| 10199 | >12 belong >0 not stripped | |
| 10200 | >20 beshort 0407 executable | |
| 10201 | >20 beshort 0410 pure executable | |
| 10202 | >22 beshort >0 - version %ld | |
| 10203 | 0 beshort 000640 Tower32/800 68020 | |
| 10204 | >18 beshort &020000 w/68881 object | |
| 10205 | >18 beshort &040000 compatible object | |
| 10206 | >18 beshort &~060000 object | |
| 10207 | >20 beshort 0407 executable | |
| 10208 | >20 beshort 0413 pure executable | |
| 10209 | >12 belong >0 not stripped | |
| 10210 | >22 beshort >0 - version %ld | |
| 10211 | 0 beshort 000645 Tower32/800 68010 | |
| 10212 | >18 beshort &040000 compatible object | |
| 10213 | >18 beshort &~060000 object | |
| 10214 | >20 beshort 0407 executable | |
| 10215 | >20 beshort 0413 pure executable | |
| 10216 | >12 belong >0 not stripped | |
| 10217 | >22 beshort >0 - version %ld | |
| 10218 | #------------------------------------------------------------------------------ | |
| 10219 | # alpha architecture description | |
| 10220 | # | |
| 10221 | ||
| 10222 | 0 leshort 0603 COFF format alpha | |
| 10223 | >22 leshort&030000 !020000 executable | |
| 10224 | >24 leshort 0410 pure | |
| 10225 | >24 leshort 0413 paged | |
| 10226 | >22 leshort&020000 !0 dynamically linked | |
| 10227 | >16 lelong !0 not stripped | |
| 10228 | >16 lelong 0 stripped | |
| 10229 | >22 leshort&030000 020000 shared library | |
| 10230 | >24 leshort 0407 object | |
| 10231 | >27 byte x - version %d | |
| 10232 | >26 byte x .%d | |
| 10233 | >28 byte x -%d | |
| 10234 | ||
| 10235 | # Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk> | |
| 10236 | # | |
| 10237 | # The actual magic number is just "Core", followed by a 2-byte version | |
| 10238 | # number; however, treating any file that begins with "Core" as a Digital | |
| 10239 | # UNIX core dump file may produce too many false hits, so we include one | |
| 10240 | # byte of the version number as well; DU 5.0 appears only to be up to | |
| 10241 | # version 2. | |
| 10242 | # | |
| 10243 | 0 string Core\001 Alpha COFF format core dump (Digital UNIX) | |
| 10244 | >24 string >\0 \b, from '%s' | |
| 10245 | 0 string Core\002 Alpha COFF format core dump (Digital UNIX) | |
| 10246 | >24 string >\0 \b, from '%s' | |
| 10247 | ||
| 10248 | ||
| 10249 | #------------------------------------------------------------------------------ | |
| 10250 | # asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character | |
| 10251 | # strings as "long" - we assume they're just strings: | |
| 10252 | # From: guy@netapp.com (Guy Harris) | |
| 10253 | # | |
| 10254 | 0 string *STA Aster*x | |
| 10255 | >7 string WORD Words Document | |
| 10256 | >7 string GRAP Graphic | |
| 10257 | >7 string SPRE Spreadsheet | |
| 10258 | >7 string MACR Macro | |
| 10259 | 0 string 2278 Aster*x Version 2 | |
| 10260 | >29 byte 0x36 Words Document | |
| 10261 | >29 byte 0x35 Graphic | |
| 10262 | >29 byte 0x32 Spreadsheet | |
| 10263 | >29 byte 0x38 Macro | |
| 10264 | ||
| 10265 | #------------------------------------------------------------------------------ | |
| 10266 | # blender: file(1) magic for Blender 3D data files | |
| 10267 | # | |
| 10268 | # Coded by Guillermo S. Romero <gsromero@alumnos.euitt.upm.es> using the | |
| 10269 | # data from Ton Roosendaal <ton@blender.nl>. Ton or his company do not | |
| 10270 | # support the rule, so mail GSR if problems with it. Rule version: 1.1. | |
| 10271 | # You can get latest version with comments and details about the format | |
| 10272 | # at http://acd.asoc.euitt.upm.es/~gsromero/3d/blender/magic.blender | |
| 10273 | ||
| 10274 | 0 string =BLENDER Blender3D, | |
| 10275 | >7 string =_ saved as 32-bits | |
| 10276 | >7 string =- saved as 64-bits | |
| 10277 | >8 string =v little endian | |
| 10278 | >8 string =V big endian | |
| 10279 | >9 byte x with version %c. | |
| 10280 | >10 byte x \b%c | |
| 10281 | >11 byte x \b%c | |
| 10282 | ||
| 10283 | #------------------------------------------------------------------------------ | |
| 10284 | # sendmail: file(1) magic for sendmail config files | |
| 10285 | # | |
| 10286 | # XXX - byte order? | |
| 10287 | # | |
| 10288 | 0 byte 046 Sendmail frozen configuration | |
| 10289 | >16 string >\0 - version %s | |
| 10290 | 0 short 0x271c Sendmail frozen configuration | |
| 10291 | >16 string >\0 - version %s | |
| 10292 | ||
| 10293 | #------------------------------------------------------------------------------ | |
| 10294 | # sendmail: file(1) magic for sendmail m4(1) files | |
| 10295 | # | |
| 10296 | # From Hendrik Scholz <hendrik@scholz.net> | |
| 10297 | # i.e. files in /usr/share/sendmail/cf/ | |
| 10298 | # | |
| 10299 | 0 string divert(-1)\n sendmail m4 text file | |
| 10300 | ||
| 10301 | ||
| 10302 | #------------------------------------------------------------------------------ | |
| 10303 | # alliant: file(1) magic for Alliant FX series a.out files | |
| 10304 | # | |
| 10305 | # If the FX series is the one that had a processor with a 68K-derived | |
| 10306 | # instruction set, the "short" should probably become "beshort" and the | |
| 10307 | # "long" should probably become "belong". | |
| 10308 | # If it's the i860-based one, they should probably become either the | |
| 10309 | # big-endian or little-endian versions, depending on the mode they ran | |
| 10310 | # the 860 in.... | |
| 10311 | # | |
| 10312 | 0 short 0420 0420 Alliant virtual executable | |
| 10313 | >2 short &0x0020 common library | |
| 10314 | >16 long >0 not stripped | |
| 10315 | 0 short 0421 0421 Alliant compact executable | |
| 10316 | >2 short &0x0020 common library | |
| 10317 | >16 long >0 not stripped | |
| 10318 | ||
| 10319 | #------------------------------------------------------------------------------ | |
| 10320 | # CDDB: file(1) magic for CDDB(tm) format CD text data files | |
| 10321 | # | |
| 10322 | # From <steve@gracenote.com> | |
| 10323 | # | |
| 10324 | # This is the /etc/magic entry to decode datafiles as used by | |
| 10325 | # CDDB-enabled CD player applications. | |
| 10326 | # | |
| 10327 | ||
| 10328 | 0 string/b #\040xmcd CDDB(tm) format CD text data | |
| 10329 | ||
| 10330 | #------------------------------------------------------------------------------ | |
| 10331 | # elf: file(1) magic for ELF executables | |
| 10332 | # | |
| 10333 | # We have to check the byte order flag to see what byte order all the | |
| 10334 | # other stuff in the header is in. | |
| 10335 | # | |
| 10336 | # What're the correct byte orders for the nCUBE and the Fujitsu VPP500? | |
| 10337 | # | |
| 10338 | # updated by Daniel Quinlan (quinlan@yggdrasil.com) | |
| 10339 | 0 string \177ELF ELF | |
| 10340 | >4 byte 0 invalid class | |
| 10341 | >4 byte 1 32-bit | |
| 10342 | # only for MIPS - in the future, the ABI field of e_flags should be used. | |
| 10343 | >>18 leshort 8 | |
| 10344 | >>>36 lelong &0x20 N32 | |
| 10345 | >>18 leshort 10 | |
| 10346 | >>>36 lelong &0x20 N32 | |
| 10347 | >>18 beshort 8 | |
| 10348 | >>>36 belong &0x20 N32 | |
| 10349 | >>18 beshort 10 | |
| 10350 | >>>36 belong &0x20 N32 | |
| 10351 | >4 byte 2 64-bit | |
| 10352 | >5 byte 0 invalid byte order | |
| 10353 | >5 byte 1 LSB | |
| 10354 | # The official e_machine number for MIPS is now #8, regardless of endianness. | |
| 10355 | # The second number (#10) will be deprecated later. For now, we still | |
| 10356 | # say something if #10 is encountered, but only gory details for #8. | |
| 10357 | >>18 leshort 8 | |
| 10358 | # only for 32-bit | |
| 10359 | >>>4 byte 1 | |
| 10360 | >>>>36 lelong&0xf0000000 0x00000000 MIPS-I | |
| 10361 | >>>>36 lelong&0xf0000000 0x10000000 MIPS-II | |
| 10362 | >>>>36 lelong&0xf0000000 0x20000000 MIPS-III | |
| 10363 | >>>>36 lelong&0xf0000000 0x30000000 MIPS-IV | |
| 10364 | >>>>36 lelong&0xf0000000 0x40000000 MIPS-V | |
| 10365 | >>>>36 lelong&0xf0000000 0x60000000 MIPS32 | |
| 10366 | >>>>36 lelong&0xf0000000 0x70000000 MIPS64 | |
| 10367 | >>>>36 lelong&0xf0000000 0x80000000 MIPS32 rel2 | |
| 10368 | >>>>36 lelong&0xf0000000 0x90000000 MIPS64 rel2 | |
| 10369 | # only for 64-bit | |
| 10370 | >>>4 byte 2 | |
| 10371 | >>>>48 lelong&0xf0000000 0x00000000 MIPS-I | |
| 10372 | >>>>48 lelong&0xf0000000 0x10000000 MIPS-II | |
| 10373 | >>>>48 lelong&0xf0000000 0x20000000 MIPS-III | |
| 10374 | >>>>48 lelong&0xf0000000 0x30000000 MIPS-IV | |
| 10375 | >>>>48 lelong&0xf0000000 0x40000000 MIPS-V | |
| 10376 | >>>>48 lelong&0xf0000000 0x60000000 MIPS32 | |
| 10377 | >>>>48 lelong&0xf0000000 0x70000000 MIPS64 | |
| 10378 | >>>>48 lelong&0xf0000000 0x80000000 MIPS32 rel2 | |
| 10379 | >>>>48 lelong&0xf0000000 0x90000000 MIPS64 rel2 | |
| 10380 | >>16 leshort 0 no file type, | |
| 10381 | >>16 leshort 1 relocatable, | |
| 10382 | >>16 leshort 2 executable, | |
| 10383 | >>16 leshort 3 shared object, | |
| 10384 | # Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> | |
| 10385 | # corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> | |
| 10386 | >>16 leshort 4 core file | |
| 10387 | # Core file detection is not reliable. | |
| 10388 | #>>>(0x38+0xcc) string >\0 of '%s' | |
| 10389 | #>>>(0x38+0x10) lelong >0 (signal %d), | |
| 10390 | >>16 leshort &0xff00 processor-specific, | |
| 10391 | >>18 leshort 0 no machine, | |
| 10392 | >>18 leshort 1 AT&T WE32100 - invalid byte order, | |
| 10393 | >>18 leshort 2 SPARC - invalid byte order, | |
| 10394 | >>18 leshort 3 Intel 80386, | |
| 10395 | >>18 leshort 4 Motorola | |
| 10396 | >>>36 lelong &0x01000000 68000 - invalid byte order, | |
| 10397 | >>>36 lelong &0x00810000 CPU32 - invalid byte order, | |
| 10398 | >>>36 lelong 0 68020 - invalid byte order, | |
| 10399 | >>18 leshort 5 Motorola 88000 - invalid byte order, | |
| 10400 | >>18 leshort 6 Intel 80486, | |
| 10401 | >>18 leshort 7 Intel 80860, | |
| 10402 | >>18 leshort 8 MIPS, | |
| 10403 | >>18 leshort 9 Amdahl - invalid byte order, | |
| 10404 | >>18 leshort 10 MIPS (deprecated), | |
| 10405 | >>18 leshort 11 RS6000 - invalid byte order, | |
| 10406 | >>18 leshort 15 PA-RISC - invalid byte order, | |
| 10407 | >>>50 leshort 0x0214 2.0 | |
| 10408 | >>>48 leshort &0x0008 (LP64), | |
| 10409 | >>18 leshort 16 nCUBE, | |
| 10410 | >>18 leshort 17 Fujitsu VPP500, | |
| 10411 | >>18 leshort 18 SPARC32PLUS, | |
| 10412 | >>18 leshort 20 PowerPC, | |
| 10413 | >>18 leshort 22 IBM S/390, | |
| 10414 | >>18 leshort 36 NEC V800, | |
| 10415 | >>18 leshort 37 Fujitsu FR20, | |
| 10416 | >>18 leshort 38 TRW RH-32, | |
| 10417 | >>18 leshort 39 Motorola RCE, | |
| 10418 | >>18 leshort 40 ARM, | |
| 10419 | >>18 leshort 41 Alpha, | |
| 10420 | >>18 leshort 0xa390 IBM S/390 (obsolete), | |
| 10421 | >>18 leshort 42 Hitachi SH, | |
| 10422 | >>18 leshort 43 SPARC V9 - invalid byte order, | |
| 10423 | >>18 leshort 44 Siemens Tricore Embedded Processor, | |
| 10424 | >>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc., | |
| 10425 | >>18 leshort 46 Hitachi H8/300, | |
| 10426 | >>18 leshort 47 Hitachi H8/300H, | |
| 10427 | >>18 leshort 48 Hitachi H8S, | |
| 10428 | >>18 leshort 49 Hitachi H8/500, | |
| 10429 | >>18 leshort 50 IA-64 (Intel 64 bit architecture) | |
| 10430 | >>18 leshort 51 Stanford MIPS-X, | |
| 10431 | >>18 leshort 52 Motorola Coldfire, | |
| 10432 | >>18 leshort 53 Motorola M68HC12, | |
| 10433 | >>18 leshort 62 AMD x86-64, | |
| 10434 | >>18 leshort 75 Digital VAX, | |
| 10435 | >>18 leshort 88 Renesas M32R, | |
| 10436 | >>18 leshort 97 NatSemi 32k, | |
| 10437 | >>18 leshort 0x9026 Alpha (unofficial), | |
| 10438 | >>20 lelong 0 invalid version | |
| 10439 | >>20 lelong 1 version 1 | |
| 10440 | >>36 lelong 1 MathCoPro/FPU/MAU Required | |
| 10441 | >5 byte 2 MSB | |
| 10442 | # only for MIPS - see comment in little-endian section above. | |
| 10443 | >>18 beshort 8 | |
| 10444 | # only for 32-bit | |
| 10445 | >>>4 byte 1 | |
| 10446 | >>>>36 belong&0xf0000000 0x00000000 MIPS-I | |
| 10447 | >>>>36 belong&0xf0000000 0x10000000 MIPS-II | |
| 10448 | >>>>36 belong&0xf0000000 0x20000000 MIPS-III | |
| 10449 | >>>>36 belong&0xf0000000 0x30000000 MIPS-IV | |
| 10450 | >>>>36 belong&0xf0000000 0x40000000 MIPS-V | |
| 10451 | >>>>36 belong&0xf0000000 0x60000000 MIPS32 | |
| 10452 | >>>>36 belong&0xf0000000 0x70000000 MIPS64 | |
| 10453 | >>>>36 belong&0xf0000000 0x80000000 MIPS32 rel2 | |
| 10454 | >>>>36 belong&0xf0000000 0x90000000 MIPS64 rel2 | |
| 10455 | # only for 64-bit | |
| 10456 | >>>4 byte 2 | |
| 10457 | >>>>48 belong&0xf0000000 0x00000000 MIPS-I | |
| 10458 | >>>>48 belong&0xf0000000 0x10000000 MIPS-II | |
| 10459 | >>>>48 belong&0xf0000000 0x20000000 MIPS-III | |
| 10460 | >>>>48 belong&0xf0000000 0x30000000 MIPS-IV | |
| 10461 | >>>>48 belong&0xf0000000 0x40000000 MIPS-V | |
| 10462 | >>>>48 belong&0xf0000000 0x60000000 MIPS32 | |
| 10463 | >>>>48 belong&0xf0000000 0x70000000 MIPS64 | |
| 10464 | >>>>48 belong&0xf0000000 0x80000000 MIPS32 rel2 | |
| 10465 | >>>>48 belong&0xf0000000 0x90000000 MIPS64 rel2 | |
| 10466 | >>16 beshort 0 no file type, | |
| 10467 | >>16 beshort 1 relocatable, | |
| 10468 | >>16 beshort 2 executable, | |
| 10469 | >>16 beshort 3 shared object, | |
| 10470 | >>16 beshort 4 core file, | |
| 10471 | #>>>(0x38+0xcc) string >\0 of '%s' | |
| 10472 | #>>>(0x38+0x10) belong >0 (signal %d), | |
| 10473 | >>16 beshort &0xff00 processor-specific, | |
| 10474 | >>18 beshort 0 no machine, | |
| 10475 | >>18 beshort 1 AT&T WE32100, | |
| 10476 | >>18 beshort 2 SPARC, | |
| 10477 | >>18 beshort 3 Intel 80386 - invalid byte order, | |
| 10478 | >>18 beshort 4 Motorola | |
| 10479 | >>>36 belong &0x01000000 68000, | |
| 10480 | >>>36 belong &0x00810000 CPU32, | |
| 10481 | >>>36 belong 0 68020, | |
| 10482 | >>18 beshort 5 Motorola 88000, | |
| 10483 | >>18 beshort 6 Intel 80486 - invalid byte order, | |
| 10484 | >>18 beshort 7 Intel 80860, | |
| 10485 | >>18 beshort 8 MIPS, | |
| 10486 | >>18 beshort 9 Amdahl, | |
| 10487 | >>18 beshort 10 MIPS (deprecated), | |
| 10488 | >>18 beshort 11 RS6000, | |
| 10489 | >>18 beshort 15 PA-RISC | |
| 10490 | >>>50 beshort 0x0214 2.0 | |
| 10491 | >>>48 beshort &0x0008 (LP64) | |
| 10492 | >>18 beshort 16 nCUBE, | |
| 10493 | >>18 beshort 17 Fujitsu VPP500, | |
| 10494 | >>18 beshort 18 SPARC32PLUS, | |
| 10495 | >>>36 belong&0xffff00 &0x000100 V8+ Required, | |
| 10496 | >>>36 belong&0xffff00 &0x000200 Sun UltraSPARC1 Extensions Required, | |
| 10497 | >>>36 belong&0xffff00 &0x000400 HaL R1 Extensions Required, | |
| 10498 | >>>36 belong&0xffff00 &0x000800 Sun UltraSPARC3 Extensions Required, | |
| 10499 | >>18 beshort 20 PowerPC or cisco 4500, | |
| 10500 | >>18 beshort 21 cisco 7500, | |
| 10501 | >>18 beshort 22 IBM S/390, | |
| 10502 | >>18 beshort 24 cisco SVIP, | |
| 10503 | >>18 beshort 25 cisco 7200, | |
| 10504 | >>18 beshort 36 NEC V800 or cisco 12000, | |
| 10505 | >>18 beshort 37 Fujitsu FR20, | |
| 10506 | >>18 beshort 38 TRW RH-32, | |
| 10507 | >>18 beshort 39 Motorola RCE, | |
| 10508 | >>18 beshort 40 ARM, | |
| 10509 | >>18 beshort 41 Alpha, | |
| 10510 | >>18 beshort 42 Hitachi SH, | |
| 10511 | >>18 beshort 43 SPARC V9, | |
| 10512 | >>18 beshort 44 Siemens Tricore Embedded Processor, | |
| 10513 | >>18 beshort 45 Argonaut RISC Core, Argonaut Technologies Inc., | |
| 10514 | >>18 beshort 46 Hitachi H8/300, | |
| 10515 | >>18 beshort 47 Hitachi H8/300H, | |
| 10516 | >>18 beshort 48 Hitachi H8S, | |
| 10517 | >>18 beshort 49 Hitachi H8/500, | |
| 10518 | >>18 beshort 50 Intel Merced Processor, | |
| 10519 | >>18 beshort 51 Stanford MIPS-X, | |
| 10520 | >>18 beshort 52 Motorola Coldfire, | |
| 10521 | >>18 beshort 53 Motorola M68HC12, | |
| 10522 | >>18 beshort 73 Cray NV1, | |
| 10523 | >>18 beshort 75 Digital VAX, | |
| 10524 | >>18 beshort 88 Renesas M32R, | |
| 10525 | >>18 beshort 97 NatSemi 32k, | |
| 10526 | >>18 beshort 0x9026 Alpha (unofficial), | |
| 10527 | >>18 beshort 0xa390 IBM S/390 (obsolete), | |
| 10528 | >>20 belong 0 invalid version | |
| 10529 | >>20 belong 1 version 1 | |
| 10530 | >>36 belong 1 MathCoPro/FPU/MAU Required | |
| 10531 | # Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed | |
| 10532 | # like proper ELF, but extracting the string had bad results. | |
| 10533 | >4 byte <0x80 | |
| 10534 | >>8 string >\0 (%s) | |
| 10535 | >8 string \0 | |
| 10536 | >>7 byte 0 (SYSV) | |
| 10537 | >>7 byte 1 (HP-UX) | |
| 10538 | >>7 byte 2 (NetBSD) | |
| 10539 | >>7 byte 3 (GNU/Linux) | |
| 10540 | >>7 byte 4 (GNU/Hurd) | |
| 10541 | >>7 byte 5 (86Open) | |
| 10542 | >>7 byte 6 (Solaris) | |
| 10543 | >>7 byte 7 (Monterey) | |
| 10544 | >>7 byte 8 (IRIX) | |
| 10545 | >>7 byte 9 (FreeBSD) | |
| 10546 | >>7 byte 10 (Tru64) | |
| 10547 | >>7 byte 11 (Novell Modesto) | |
| 10548 | >>7 byte 12 (OpenBSD) | |
| 10549 | >>7 byte 97 (ARM) | |
| 10550 | >>7 byte 255 (embedded) | |
| 10551 | ||
| 10552 | #------------------------------------------------------------------------------ | |
| 10553 | # Epoc 32 : file(1) magic for Epoc Documents [psion/osaris | |
| 10554 | # Stefan Praszalowicz (hpicollo@worldnet.fr) | |
| 10555 | #0 lelong 0x10000037 Epoc32 | |
| 10556 | >4 lelong 0x1000006D | |
| 10557 | >>8 lelong 0x1000007F Word | |
| 10558 | >>8 lelong 0x10000088 Sheet | |
| 10559 | >>8 lelong 0x1000007D Sketch | |
| 10560 | >>8 lelong 0x10000085 TextEd | |
| 10561 | ||
| 10562 | #------------------------------------------------------------------------------ | |
| 10563 | # ispell: file(1) magic for ispell | |
| 10564 | # | |
| 10565 | # Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic | |
| 10566 | # will match 0x9600 through 0x9603 in *both* little endian and big endian. | |
| 10567 | # (No other current magic entries collide.) | |
| 10568 | # | |
| 10569 | # Updated by Daniel Quinlan (quinlan@yggdrasil.com) | |
| 10570 | # | |
| 10571 | 0 leshort&0xFFFC 0x9600 little endian ispell | |
| 10572 | >0 byte 0 hash file (?), | |
| 10573 | >0 byte 1 3.0 hash file, | |
| 10574 | >0 byte 2 3.1 hash file, | |
| 10575 | >0 byte 3 hash file (?), | |
| 10576 | >2 leshort 0x00 8-bit, no capitalization, 26 flags | |
| 10577 | >2 leshort 0x01 7-bit, no capitalization, 26 flags | |
| 10578 | >2 leshort 0x02 8-bit, capitalization, 26 flags | |
| 10579 | >2 leshort 0x03 7-bit, capitalization, 26 flags | |
| 10580 | >2 leshort 0x04 8-bit, no capitalization, 52 flags | |
| 10581 | >2 leshort 0x05 7-bit, no capitalization, 52 flags | |
| 10582 | >2 leshort 0x06 8-bit, capitalization, 52 flags | |
| 10583 | >2 leshort 0x07 7-bit, capitalization, 52 flags | |
| 10584 | >2 leshort 0x08 8-bit, no capitalization, 128 flags | |
| 10585 | >2 leshort 0x09 7-bit, no capitalization, 128 flags | |
| 10586 | >2 leshort 0x0A 8-bit, capitalization, 128 flags | |
| 10587 | >2 leshort 0x0B 7-bit, capitalization, 128 flags | |
| 10588 | >2 leshort 0x0C 8-bit, no capitalization, 256 flags | |
| 10589 | >2 leshort 0x0D 7-bit, no capitalization, 256 flags | |
| 10590 | >2 leshort 0x0E 8-bit, capitalization, 256 flags | |
| 10591 | >2 leshort 0x0F 7-bit, capitalization, 256 flags | |
| 10592 | >4 leshort >0 and %d string characters | |
| 10593 | 0 beshort&0xFFFC 0x9600 big endian ispell | |
| 10594 | >1 byte 0 hash file (?), | |
| 10595 | >1 byte 1 3.0 hash file, | |
| 10596 | >1 byte 2 3.1 hash file, | |
| 10597 | >1 byte 3 hash file (?), | |
| 10598 | >2 beshort 0x00 8-bit, no capitalization, 26 flags | |
| 10599 | >2 beshort 0x01 7-bit, no capitalization, 26 flags | |
| 10600 | >2 beshort 0x02 8-bit, capitalization, 26 flags | |
| 10601 | >2 beshort 0x03 7-bit, capitalization, 26 flags | |
| 10602 | >2 beshort 0x04 8-bit, no capitalization, 52 flags | |
| 10603 | >2 beshort 0x05 7-bit, no capitalization, 52 flags | |
| 10604 | >2 beshort 0x06 8-bit, capitalization, 52 flags | |
| 10605 | >2 beshort 0x07 7-bit, capitalization, 52 flags | |
| 10606 | >2 beshort 0x08 8-bit, no capitalization, 128 flags | |
| 10607 | >2 beshort 0x09 7-bit, no capitalization, 128 flags | |
| 10608 | >2 beshort 0x0A 8-bit, capitalization, 128 flags | |
| 10609 | >2 beshort 0x0B 7-bit, capitalization, 128 flags | |
| 10610 | >2 beshort 0x0C 8-bit, no capitalization, 256 flags | |
| 10611 | >2 beshort 0x0D 7-bit, no capitalization, 256 flags | |
| 10612 | >2 beshort 0x0E 8-bit, capitalization, 256 flags | |
| 10613 | >2 beshort 0x0F 7-bit, capitalization, 256 flags | |
| 10614 | >4 beshort >0 and %d string characters | |
| 10615 | # ispell 4.0 hash files kromJx <kromJx@crosswinds.net> | |
| 10616 | # Ispell 4.0 | |
| 10617 | 0 string ISPL ispell | |
| 10618 | >4 long x hash file version %d, | |
| 10619 | >8 long x lexletters %d, | |
| 10620 | >12 long x lexsize %d, | |
| 10621 | >16 long x hashsize %d, | |
| 10622 | >20 long x stblsize %d | |
| 10623 | ||
| 10624 | #------------------------------------------------------------------------------ | |
| 10625 | # lex: file(1) magic for lex | |
| 10626 | # | |
| 10627 | # derived empirically, your offsets may vary! | |
| 10628 | 53 string yyprevious C program text (from lex) | |
| 10629 | >3 string >\0 for %s | |
| 10630 | # C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com> | |
| 10631 | 21 string generated\ by\ flex C program text (from flex) | |
| 10632 | # lex description file, from Daniel Quinlan <quinlan@yggdrasil.com> | |
| 10633 | 0 string %{ lex description text | |
| 10634 | ||
| 10635 | #------------------------------------------------------------------------------ | |
| 10636 | # mips: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.) | |
| 10637 | # Dec Ultrix (MIPS) | |
| 10638 | # all of SGI's *current* machines and OSes run in big-endian mode on the | |
| 10639 | # MIPS machines, as far as I know. | |
| 10640 | # | |
| 10641 | # XXX - what is the blank "-" line? | |
| 10642 | # | |
| 10643 | # kbd file definitions | |
| 10644 | 0 string kbd!map kbd map file | |
| 10645 | >8 byte >0 Ver %d: | |
| 10646 | >10 short >0 with %d table(s) | |
| 10647 | 0 belong 0407 old SGI 68020 executable | |
| 10648 | 0 belong 0410 old SGI 68020 pure executable | |
| 10649 | 0 beshort 0x8765 disk quotas file | |
| 10650 | 0 beshort 0x0506 IRIS Showcase file | |
| 10651 | >2 byte 0x49 - | |
| 10652 | >3 byte x - version %ld | |
| 10653 | 0 beshort 0x0226 IRIS Showcase template | |
| 10654 | >2 byte 0x63 - | |
| 10655 | >3 byte x - version %ld | |
| 10656 | 0 belong 0x5343464d IRIS Showcase file | |
| 10657 | >4 byte x - version %ld | |
| 10658 | 0 belong 0x5443464d IRIS Showcase template | |
| 10659 | >4 byte x - version %ld | |
| 10660 | 0 belong 0xdeadbabe IRIX Parallel Arena | |
| 10661 | >8 belong >0 - version %ld | |
| 10662 | # | |
| 10663 | 0 beshort 0x0160 MIPSEB ECOFF executable | |
| 10664 | >20 beshort 0407 (impure) | |
| 10665 | >20 beshort 0410 (swapped) | |
| 10666 | >20 beshort 0413 (paged) | |
| 10667 | >8 belong >0 not stripped | |
| 10668 | >8 belong 0 stripped | |
| 10669 | >22 byte x - version %ld | |
| 10670 | >23 byte x .%ld | |
| 10671 | # | |
| 10672 | 0 beshort 0x0162 MIPSEL-BE ECOFF executable | |
| 10673 | >20 beshort 0407 (impure) | |
| 10674 | >20 beshort 0410 (swapped) | |
| 10675 | >20 beshort 0413 (paged) | |
| 10676 | >8 belong >0 not stripped | |
| 10677 | >8 belong 0 stripped | |
| 10678 | >23 byte x - version %d | |
| 10679 | >22 byte x .%ld | |
| 10680 | # | |
| 10681 | 0 beshort 0x6001 MIPSEB-LE ECOFF executable | |
| 10682 | >20 beshort 03401 (impure) | |
| 10683 | >20 beshort 04001 (swapped) | |
| 10684 | >20 beshort 05401 (paged) | |
| 10685 | >8 belong >0 not stripped | |
| 10686 | >8 belong 0 stripped | |
| 10687 | >23 byte x - version %d | |
| 10688 | >22 byte x .%ld | |
| 10689 | # | |
| 10690 | 0 beshort 0x6201 MIPSEL ECOFF executable | |
| 10691 | >20 beshort 03401 (impure) | |
| 10692 | >20 beshort 04001 (swapped) | |
| 10693 | >20 beshort 05401 (paged) | |
| 10694 | >8 belong >0 not stripped | |
| 10695 | >8 belong 0 stripped | |
| 10696 | >23 byte x - version %ld | |
| 10697 | >22 byte x .%ld | |
| 10698 | # | |
| 10699 | # MIPS 2 additions | |
| 10700 | # | |
| 10701 | 0 beshort 0x0163 MIPSEB MIPS-II ECOFF executable | |
| 10702 | >20 beshort 0407 (impure) | |
| 10703 | >20 beshort 0410 (swapped) | |
| 10704 | >20 beshort 0413 (paged) | |
| 10705 | >8 belong >0 not stripped | |
| 10706 | >8 belong 0 stripped | |
| 10707 | >22 byte x - version %ld | |
| 10708 | >23 byte x .%ld | |
| 10709 | # | |
| 10710 | 0 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable | |
| 10711 | >20 beshort 0407 (impure) | |
| 10712 | >20 beshort 0410 (swapped) | |
| 10713 | >20 beshort 0413 (paged) | |
| 10714 | >8 belong >0 not stripped | |
| 10715 | >8 belong 0 stripped | |
| 10716 | >22 byte x - version %ld | |
| 10717 | >23 byte x .%ld | |
| 10718 | # | |
| 10719 | 0 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable | |
| 10720 | >20 beshort 03401 (impure) | |
| 10721 | >20 beshort 04001 (swapped) | |
| 10722 | >20 beshort 05401 (paged) | |
| 10723 | >8 belong >0 not stripped | |
| 10724 | >8 belong 0 stripped | |
| 10725 | >23 byte x - version %ld | |
| 10726 | >22 byte x .%ld | |
| 10727 | # | |
| 10728 | 0 beshort 0x6601 MIPSEL MIPS-II ECOFF executable | |
| 10729 | >20 beshort 03401 (impure) | |
| 10730 | >20 beshort 04001 (swapped) | |
| 10731 | >20 beshort 05401 (paged) | |
| 10732 | >8 belong >0 not stripped | |
| 10733 | >8 belong 0 stripped | |
| 10734 | >23 byte x - version %ld | |
| 10735 | >22 byte x .%ld | |
| 10736 | # | |
| 10737 | # MIPS 3 additions | |
| 10738 | # | |
| 10739 | 0 beshort 0x0140 MIPSEB MIPS-III ECOFF executable | |
| 10740 | >20 beshort 0407 (impure) | |
| 10741 | >20 beshort 0410 (swapped) | |
| 10742 | >20 beshort 0413 (paged) | |
| 10743 | >8 belong >0 not stripped | |
| 10744 | >8 belong 0 stripped | |
| 10745 | >22 byte x - version %ld | |
| 10746 | >23 byte x .%ld | |
| 10747 | # | |
| 10748 | 0 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable | |
| 10749 | >20 beshort 0407 (impure) | |
| 10750 | >20 beshort 0410 (swapped) | |
| 10751 | >20 beshort 0413 (paged) | |
| 10752 | >8 belong >0 not stripped | |
| 10753 | >8 belong 0 stripped | |
| 10754 | >22 byte x - version %ld | |
| 10755 | >23 byte x .%ld | |
| 10756 | # | |
| 10757 | 0 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable | |
| 10758 | >20 beshort 03401 (impure) | |
| 10759 | >20 beshort 04001 (swapped) | |
| 10760 | >20 beshort 05401 (paged) | |
| 10761 | >8 belong >0 not stripped | |
| 10762 | >8 belong 0 stripped | |
| 10763 | >23 byte x - version %ld | |
| 10764 | >22 byte x .%ld | |
| 10765 | # | |
| 10766 | 0 beshort 0x4201 MIPSEL MIPS-III ECOFF executable | |
| 10767 | >20 beshort 03401 (impure) | |
| 10768 | >20 beshort 04001 (swapped) | |
| 10769 | >20 beshort 05401 (paged) | |
| 10770 | >8 belong >0 not stripped | |
| 10771 | >8 belong 0 stripped | |
| 10772 | >23 byte x - version %ld | |
| 10773 | >22 byte x .%ld | |
| 10774 | # | |
| 10775 | 0 beshort 0x180 MIPSEB Ucode | |
| 10776 | 0 beshort 0x182 MIPSEL-BE Ucode | |
| 10777 | # 32bit core file | |
| 10778 | 0 belong 0xdeadadb0 IRIX core dump | |
| 10779 | >4 belong 1 of | |
| 10780 | >16 string >\0 '%s' | |
| 10781 | # 64bit core file | |
| 10782 | 0 belong 0xdeadad40 IRIX 64-bit core dump | |
| 10783 | >4 belong 1 of | |
| 10784 | >16 string >\0 '%s' | |
| 10785 | # N32bit core file | |
| 10786 | 0 belong 0xbabec0bb IRIX N32 core dump | |
| 10787 | >4 belong 1 of | |
| 10788 | >16 string >\0 '%s' | |
| 10789 | # New style crash dump file | |
| 10790 | 0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of | |
| 10791 | >36 string >\0 '%s' | |
| 10792 | # Trusted IRIX info | |
| 10793 | 0 string SGIAUDIT SGI Audit file | |
| 10794 | >8 byte x - version %d | |
| 10795 | >9 byte x .%ld | |
| 10796 | # | |
| 10797 | 0 string WNGZWZSC Wingz compiled script | |
| 10798 | 0 string WNGZWZSS Wingz spreadsheet | |
| 10799 | 0 string WNGZWZHP Wingz help file | |
| 10800 | # | |
| 10801 | 0 string \#Inventor V IRIS Inventor 1.0 file | |
| 10802 | 0 string \#Inventor V2 Open Inventor 2.0 file | |
| 10803 | # GLF is OpenGL stream encoding | |
| 10804 | 0 string glfHeadMagic(); GLF_TEXT | |
| 10805 | 4 belong 0x7d000000 GLF_BINARY_LSB_FIRST | |
| 10806 | 4 belong 0x0000007d GLF_BINARY_MSB_FIRST | |
| 10807 | # GLS is OpenGL stream encoding; GLS is the successor of GLF | |
| 10808 | 0 string glsBeginGLS( GLS_TEXT | |
| 10809 | 4 belong 0x10000000 GLS_BINARY_LSB_FIRST | |
| 10810 | 4 belong 0x00000010 GLS_BINARY_MSB_FIRST | |
