[Midnightbsd-cvs] src [6704] trunk/contrib/file/magic.mime: update the mime list
laffer1 at midnightbsd.org
laffer1 at midnightbsd.org
Mon Jun 30 19:54:14 EDT 2014
Revision: 6704
http://svnweb.midnightbsd.org/src/?rev=6704
Author: laffer1
Date: 2014-06-30 19:54:13 -0400 (Mon, 30 Jun 2014)
Log Message:
-----------
update the mime list
Modified Paths:
--------------
trunk/contrib/file/magic.mime
Modified: trunk/contrib/file/magic.mime
===================================================================
--- trunk/contrib/file/magic.mime 2014-06-30 12:28:30 UTC (rev 6703)
+++ trunk/contrib/file/magic.mime 2014-06-30 23:54:13 UTC (rev 6704)
@@ -82,7 +82,7 @@
>18 lelong ^010 not stripped
#------------------------------------------------------------------------------
-# $File: adventure,v 1.13 2010/12/31 16:32:54 christos Exp $
+# $File: adventure,v 1.14 2012/06/21 01:32:26 christos Exp $
# adventure: file(1) magic for Adventure game files
#
# from Allen Garvin <earendil at faeryland.tamu-commerce.edu>
@@ -115,10 +115,14 @@
#
0 ubyte >0
>0 ubyte <9
->>16 belong&0xfe00f0f0 0x3030 Infocom game data
->>>0 ubyte x (Z-machine %d,
->>>>2 ubeshort x Release %d /
->>>>18 string >\0 Serial %.6s)
+>>16 belong&0xfe00f0f0 0x3030
+>>>0 ubyte < 10
+>>>>2 ubeshort < 10
+>>>>>18 regex [0-9][0-9][0-9][0-9][0-9][0-9]
+>>>>>>0 ubyte < 10 Infocom (Z-machine %d,
+>>>>>>>2 ubeshort < 10 Release %d /
+>>>>>>>>18 string >\0 Serial %.6s)
+!:strength + 40
#------------------------------------------------------------------------------
# Glulx: file(1) magic for Glulx binaries.
@@ -215,38 +219,6 @@
>16 long >0 not stripped
#------------------------------------------------------------------------------
-# $File: alpha,v 1.7 2009/09/19 16:28:07 christos Exp $
-# alpha architecture description
-#
-
-0 leshort 0603 COFF format alpha
->22 leshort&030000 !020000 executable
->24 leshort 0410 pure
->24 leshort 0413 paged
->22 leshort&020000 !0 dynamically linked
->16 lelong !0 not stripped
->16 lelong 0 stripped
->22 leshort&030000 020000 shared library
->24 leshort 0407 object
->27 byte x - version %d
->26 byte x .%d
->28 byte x -%d
-
-# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike at opac.bl.uk>
-#
-# The actual magic number is just "Core", followed by a 2-byte version
-# number; however, treating any file that begins with "Core" as a Digital
-# UNIX core dump file may produce too many false hits, so we include one
-# byte of the version number as well; DU 5.0 appears only to be up to
-# version 2.
-#
-0 string Core\001 Alpha COFF format core dump (Digital UNIX)
->24 string >\0 \b, from '%s'
-0 string Core\002 Alpha COFF format core dump (Digital UNIX)
->24 string >\0 \b, from '%s'
-
-
-#------------------------------------------------------------------------------
# $File: amanda,v 1.5 2009/09/19 16:28:07 christos Exp $
# amanda: file(1) magic for amanda file format
#
@@ -259,7 +231,7 @@
>>13 string >\ DATE %s
#------------------------------------------------------------------------------
-# $File: amigaos,v 1.14 2009/09/19 16:28:07 christos Exp $
+# $File: amigaos,v 1.15 2012/06/21 01:13:59 christos Exp $
# amigaos: file(1) magic for AmigaOS binary formats:
#
@@ -322,9 +294,112 @@
# From: Alex Beregszaszi <alex at fsn.hu>
0 string LZX LZX compressed archive (Amiga)
+# From: Przemek Kramarczyk <pkramarczyk at gmail.com>
+0 string .KEY AmigaDOS script
+0 string .key AmigaDOS script
+#------------------------------------------------------------
+# $File: android,v 1.4 2014/06/03 19:01:34 christos Exp $
+# Various android related magic entries
+#------------------------------------------------------------
+
+# Dalvik .dex format. http://retrodev.com/android/dexformat.html
+# From <mkf at google.com> "Mike Fleming"
+# Fixed to avoid regexec 17 errors on some dex files
+# From <diff at lookout.com> "Tim Strazzere"
+0 string dex\n
+>0 regex dex\n[0-9]{2}\0 Dalvik dex file
+>4 string >000 version %s
+0 string dey\n
+>0 regex dey\n[0-9]{2}\0 Dalvik dex file (optimized for host)
+>4 string >000 version %s
+
+# http://android.stackexchange.com/questions/23357/\
+# is-there-a-way-to-look-inside-and-modify-an-adb-backup-created-file/\
+# 23608#23608
+0 string ANDROID\040BACKUP\n Android Backup
+>15 string 1\n \b, version 1
+>17 string 0\n \b, uncompressed
+>17 string 1\n \b, compressed
+>19 string none\n \b, unencrypted
+>19 string AES-256\n \b, encrypted AES-256
+
+# Android bootimg format
+# From https://android.googlesource.com/\
+# platform/system/core/+/master/mkbootimg/bootimg.h
+0 string ANDROID! Android bootimg
+>8 lelong >0 \b, kernel
+>>12 lelong >0 \b (0x%x)
+>16 lelong >0 \b, ramdisk
+>>20 lelong >0 \b (0x%x)
+>24 lelong >0 \b, second stage
+>>28 lelong >0 \b (0x%x)
+>36 lelong >0 \b, page size: %d
+>38 string >0 \b, name: %s
+>64 string >0 \b, cmdline (%s)
+# Dalvik .dex format. http://retrodev.com/android/dexformat.html
+# From <mkf at google.com> "Mike Fleming"
+# Fixed to avoid regexec 17 errors on some dex files
+# From <diff at lookout.com> "Tim Strazzere"
+0 string dex\n
+>0 regex dex\n[0-9]{2}\0 Dalvik dex file
+>4 string >000 version %s
+0 string dey\n
+>0 regex dey\n[0-9]{2}\0 Dalvik dex file (optimized for host)
+>4 string >000 version %s
+
+# http://android.stackexchange.com/questions/23357/\
+# is-there-a-way-to-look-inside-and-modify-an-adb-backup-created-file/\
+# 23608#23608
+0 string ANDROID\040BACKUP\n Android Backup
+>15 string 1\n \b, version 1
+>17 string 0\n \b, uncompressed
+>17 string 1\n \b, compressed
+>19 string none\n \b, unencrypted
+>19 string AES-256\n \b, encrypted AES-256
+
+# Android bootimg format
+# From https://android.googlesource.com/\
+# platform/system/core/+/master/mkbootimg/bootimg.h
+0 string ANDROID! Android bootimg
+>8 lelong >0 \b, kernel
+>>12 lelong >0 \b (0x%x)
+>16 lelong >0 \b, ramdisk
+>>20 lelong >0 \b (0x%x)
+>24 lelong >0 \b, second stage
+>>28 lelong >0 \b (0x%x)
+>36 lelong >0 \b, page size: %d
+>38 string >0 \b, name: %s
+>64 string >0 \b, cmdline (%s)
+
+# Android Backup archive
+# From: Ariel Shkedi
+# File extension: .ab
+# No mime-type defined
+# URL: https://github.com/android/platform_frameworks_base/blob/\
+# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\
+# android/server/BackupManagerService.java#L2367
+# After the header comes a tar file
+# If compressed, the entire tar file is compressed with JAVA deflate
+#
+# Include the version number hardcoded with the magic string to avoid
+# false positives
+0 string/b ANDROID\ BACKUP\n1\n Android Backup
+>17 string 0\n \b, Not-Compressed
+>17 string 1\n \b, Compressed
+# any string as long as it's not the word none (which is matched below)
+>>19 regex/1l \^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).* \b, Encrypted (%s)
+>>19 string none\n \b, Not-Encrypted
+# Commented out because they don't seem useful to print
+# (but they are part of the header - the tar file comes after them):
+#>>>&1 regex/1l .* \b, Password salt: %s
+#>>>>&1 regex/1l .* \b, Master salt: %s
+#>>>>>&1 regex/1l .* \b, PBKDF2 rounds: %s
+#>>>>>>&1 regex/1l .* \b, IV: %s
+#>>>>>>>&1 regex/1l .* \b, Key: %s
+
#------------------------------------------------------------------------------
-# $File: animation,v 1.44 2010/11/25 15:00:12 christos Exp $
+# $File: animation,v 1.53 2014/04/30 21:41:02 christos Exp $
# animation: file(1) magic for animation/movie formats
#
# animation formats
@@ -413,7 +488,10 @@
>>4 byte 77 \b, main
>>4 byte 88 \b, extended
>>6 byte x \b @ L %u
+# GRR too general as it catches also FoxPro Memo example NG.FPT
>3 byte 0xB0 MPEG sequence, v4
+# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000
+#>>4 byte !0 MPEG sequence, v4
!:mime video/mpeg4-generic
>>5 belong 0x000001B5
>>>9 byte &0x80
@@ -772,6 +850,7 @@
# MP2, M2A
0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2
+!:mime audio/mpeg
# rate
>2 byte&0xF0 0x10 \b, 8 kbps
>2 byte&0xF0 0x20 \b, 16 kbps
@@ -941,7 +1020,7 @@
# Live MPEG-4 audio streams (instead of RTP FlexMux)
0 beshort&0xFFE0 0x56E0 MPEG-4 LOAS
!:mime audio/x-mp4a-latm
-#>1 beshort&0x1FFF x \b, %u byte packet
+#>1 beshort&0x1FFF x \b, %hu byte packet
>3 byte&0xE0 0x40
>>4 byte&0x3C 0x04 \b, single stream
>>4 byte&0x3C 0x08 \b, 2 streams
@@ -1012,10 +1091,6 @@
# iso 13818 transport stream
#
# from Oskar Schirmer <schirmer at scara.com> Feb 3, 2001 (ISO 13818.1)
-# (the following is a little bit restrictive and works fine for a stream
-# that starts with PAT properly. it won't work for stream data, that is
-# cut from an input device data right in the middle, but this shouldn't
-# disturb)
# syncbyte 8 bit 0x47
# error_ind 1 bit -
# payload_start 1 bit 1
@@ -1023,9 +1098,9 @@
# PID 13 bit 0x0000
# scrambling 2 bit -
# adaptfld_ctrl 2 bit 1 or 3
-# conti_count 4 bit 0
-0 belong&0xFF5FFF1F 0x47400010 MPEG transport stream data
->188 byte !0x47 CORRUPTED
+# conti_count 4 bit -
+0 belong&0xFF5FFF10 0x47400010
+>188 byte 0x47 MPEG transport stream data
# DIF digital video file format <mpruett at sgi.com>
0 belong&0xffffff00 0x1f070000 DIF
@@ -1043,8 +1118,8 @@
!:mime video/x-mng
>4 belong !0x0d0a1a0a CORRUPTED,
>4 belong 0x0d0a1a0a
->>16 belong x %ld x
->>20 belong x %ld
+>>16 belong x %d x
+>>20 belong x %d
# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
0 string \x8bJNG JNG video data,
@@ -1051,8 +1126,8 @@
!:mime video/x-jng
>4 belong !0x0d0a1a0a CORRUPTED,
>4 belong 0x0d0a1a0a
->>16 belong x %ld x
->>20 belong x %ld
+>>16 belong x %d x
+>>20 belong x %d
# Vivo video (Wolfram Kleff)
3 string \x0D\x0AVersion:Vivo Vivo video data
@@ -1079,7 +1154,7 @@
>0 byte x GameCube movie,
>0x34 ubeshort x %d x
>0x36 ubeshort x %d,
->0x26 ubeshort x %dµs,
+>0x26 ubeshort x %dus,
>0x42 ubeshort 0 no audio
>0x42 ubeshort >0 %dHz audio
@@ -1113,25 +1188,26 @@
# MPEG file
# MPEG sequences
-# FIXME: This section is from the old magic.mime file and needs integrating with the rest
-0 belong 0x000001BA
->4 byte &0x40
-!:mime video/mp2p
->4 byte ^0x40
-!:mime video/mpeg
-0 belong 0x000001BB
-!:mime video/mpeg
-0 belong 0x000001B0
-!:mime video/mp4v-es
-0 belong 0x000001B5
-!:mime video/mp4v-es
-0 belong 0x000001B3
-!:mime video/mpv
-0 belong&0xFF5FFF1F 0x47400010
-!:mime video/mp2t
-0 belong 0x00000001
->4 byte&0x1F 0x07
-!:mime video/h264
+# FIXME: This section is from the old magic.mime file and needs
+# integrating with the rest
+#0 belong 0x000001BA
+#>4 byte &0x40
+#!:mime video/mp2p
+#>4 byte ^0x40
+#!:mime video/mpeg
+#0 belong 0x000001BB
+#!:mime video/mpeg
+#0 belong 0x000001B0
+#!:mime video/mp4v-es
+#0 belong 0x000001B5
+#!:mime video/mp4v-es
+#0 belong 0x000001B3
+#!:mime video/mpv
+#0 belong&0xFF5FFF10 0x47400010
+#!:mime video/mp2t
+#0 belong 0x00000001
+#>4 byte&0x1F 0x07
+#!:mime video/h264
# Type: Bink Video
# Extension: .bik
@@ -1160,7 +1236,111 @@
# From: Adam Buchbinder <adam.buchbinder at gmail.com>
0 string nut/multimedia\ container\0 NUT multimedia container
+# Type: Nullsoft Video (NSV)
+# URL: http://wiki.multimedia.cx/index.php?title=Nullsoft_Video
+# From: Mike Melanson <mike at multimedia.cx>
+0 string NSVf Nullsoft Video
+
+# Type: REDCode Video
+# URL: http://www.red.com/ ; http://wiki.multimedia.cx/index.php?title=REDCode
+# From: Mike Melanson <mike at multimedia.cx>
+4 string RED1 REDCode Video
+
+# Type: MTV Multimedia File
+# URL: http://wiki.multimedia.cx/index.php?title=MTV
+# From: Mike Melanson <mike at multimedia.cx>
+0 string AMVS MTV Multimedia File
+
+# Type: ARMovie
+# URL: http://wiki.multimedia.cx/index.php?title=ARMovie
+# From: Mike Melanson <mike at multimedia.cx>
+0 string ARMovie\012 ARMovie
+
+# Type: Interplay MVE Movie
+# URL: http://wiki.multimedia.cx/index.php?title=Interplay_MVE
+# From: Mike Melanson <mike at multimedia.cx>
+0 string Interplay\040MVE\040File\032 Interplay MVE Movie
+
+# Type: Windows Television DVR File
+# URL: http://wiki.multimedia.cx/index.php?title=WTV
+# From: Mike Melanson <mike at mutlimedia.cx>
+# This takes the form of a Windows-style GUID
+0 bequad 0xB7D800203749DA11
+>8 bequad 0xA64E0007E95EAD8D Windows Television DVR Media
+
+# Type: Sega FILM/CPK Multimedia
+# URL: http://wiki.multimedia.cx/index.php?title=Sega_FILM
+# From: Mike Melanson <mike at multimedia.cx>
+0 string FILM Sega FILM/CPK Multimedia,
+>32 belong x %d x
+>28 belong x %d
+
+# Type: Nintendo THP Multimedia
+# URL: http://wiki.multimedia.cx/index.php?title=THP
+# From: Mike Melanson <mike at multimedia.cx>
+0 string THP\0 Nintendo THP Multimedia
+
+# Type: BBC Dirac Video
+# URL: http://wiki.multimedia.cx/index.php?title=Dirac
+# From: Mike Melanson <mike at multimedia.cx>
+0 string BBCD BBC Dirac Video
+
+# Type: RAD Game Tools Smacker Multimedia
+# URL: http://wiki.multimedia.cx/index.php?title=Smacker
+# From: Mike Melanson <mike at multimedia.cx>
+0 string SMK RAD Game Tools Smacker Multimedia
+>3 byte x version %c,
+>4 lelong x %d x
+>8 lelong x %d,
+>12 lelong x %d frames
+
#------------------------------------------------------------------------------
+# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $
+# aout: file(1) magic for a.out executable/object/etc entries that
+# handle executables on multiple platforms.
+#
+
+#
+# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from
+# BSDI), netbsd, and vax (for UNIX/32V and BSD)
+#
+# XXX - is there anything we can look at to distinguish BSD/OS 386 from
+# NetBSD 386 from various VAX binaries? The BSD/OS shared library flag
+# works only for binaries using shared libraries. Grabbing the entry
+# point from the a.out header, using it to find the first code executed
+# in the program, and looking at that might help.
+#
+0 lelong 0407 a.out little-endian 32-bit executable
+>16 lelong >0 not stripped
+>32 byte 0x6a (uses BSD/OS shared libs)
+
+0 lelong 0410 a.out little-endian 32-bit pure executable
+>16 lelong >0 not stripped
+>32 byte 0x6a (uses BSD/OS shared libs)
+
+0 lelong 0413 a.out little-endian 32-bit demand paged pure executable
+>16 lelong >0 not stripped
+>32 byte 0x6a (uses BSD/OS shared libs)
+
+#
+# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out),
+# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out).
+#
+# XXX - is there anything we can look at to distinguish old SunOS 68010
+# from old 68020 IRIX from old NetBSD? Again, I guess we could look at
+# the first instruction or instructions in the program.
+#
+0 belong 0407 a.out big-endian 32-bit executable
+>16 belong >0 not stripped
+
+0 belong 0410 a.out big-endian 32-bit pure executable
+>16 belong >0 not stripped
+
+0 belong 0413 a.out big-endian 32-bit demand paged executable
+>16 belong >0 not stripped
+
+
+#------------------------------------------------------------------------------
# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $
# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL
# workspaces)
@@ -1168,7 +1348,7 @@
0 long 0100554 APL workspace (Ken's original?)
#------------------------------------------------------------------------------
-# $File: apple,v 1.24 2010/11/25 15:00:12 christos Exp $
+# $File: apple,v 1.29 2014/04/30 21:41:02 christos Exp $
# apple: file(1) magic for Apple file formats
#
0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text
@@ -1274,8 +1454,13 @@
# This is incredibly sloppy, but will be true if the program was
# written at its usual memory location of 2048 and its first line
# number is less than 256. Yuck.
+# update by Joerg Jenderek at Feb 2013
-0 belong&0xff00ff 0x80000 Applesoft BASIC program data
+# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
+#0 belong&0xff00ff 0x80000 Applesoft BASIC program data
+0 belong&0x00ff00ff 0x00080000
+# assuming that line number must be positive
+>2 leshort >0 Applesoft BASIC program data, first line number %d
#>2 leshort x \b, first line number %d
# ORCA/EZ assembler:
@@ -1367,15 +1552,15 @@
# purposes in YellowStep/Cocoa, including some nib files.
# From: David Remahl <dremahl at apple.com>
2 string typedstream NeXT/Apple typedstream data, big endian
->0 byte x \b, version %hhd
+>0 byte x \b, version %d
>0 byte <5 \b
>>13 byte 0x81 \b
->>>14 ubeshort x \b, system %hd
+>>>14 ubeshort x \b, system %d
2 string streamtyped NeXT/Apple typedstream data, little endian
->0 byte x \b, version %hhd
+>0 byte x \b, version %d
>0 byte <5 \b
>>13 byte 0x81 \b
->>>14 uleshort x \b, system %hd
+>>>14 uleshort x \b, system %d
#------------------------------------------------------------------------------
# CAF: Apple CoreAudio File Format
@@ -1418,6 +1603,52 @@
# .vdi
4 string innotek\ VirtualBox\ Disk\ Image %s
+# Apple disk partition stuff, strengthen the magic using byte 4
+0 beshort 0x4552
+>4 byte 0 Apple Driver Map
+>>2 beshort x \b, blocksize %d
+>>4 belong x \b, blockcount %d
+>>10 beshort x \b, devtype %d
+>>12 beshort x \b, devid %d
+>>20 beshort x \b, descriptors %d
+# Assume 8 partitions each at a multiple of the sector size.
+# We could glean this from the partition descriptors, but they are empty!?!?
+>>(2.S*1) indirect \b, contains[@0x%x]:
+>>(2.S*2) indirect \b, contains[@0x%x]:
+>>(2.S*3) indirect \b, contains[@0x%x]:
+>>(2.S*4) indirect \b, contains[@0x%x]:
+>>(2.S*5) indirect \b, contains[@0x%x]:
+>>(2.S*6) indirect \b, contains[@0x%x]:
+>>(2.S*7) indirect \b, contains[@0x%x]:
+>>(2.S*8) indirect \b, contains[@0x%x]:
+
+# Yes, the 3rd and 4th bytes are reserved, but we use them to make the
+# magic stronger.
+0 belong 0x504d0000 Apple Partition Map
+>4 belong x \b, map block count %d
+>8 belong x \b, start block %d
+>12 belong x \b, block count %d
+>16 string >0 \b, name %s
+>48 string >0 \b, type %s
+>124 string >0 \b, processor %s
+>140 string >0 \b, boot arguments %s
+>92 belong & 1 \b, valid
+>92 belong & 2 \b, allocated
+>92 belong & 4 \b, in use
+>92 belong & 8 \b, has boot info
+>92 belong & 16 \b, readable
+>92 belong & 32 \b, writable
+>92 belong & 64 \b, pic boot code
+>92 belong & 128 \b, chain compatible driver
+>92 belong & 256 \b, real driver
+>92 belong & 512 \b, chain driver
+>92 belong & 1024 \b, mount at startup
+>92 belong & 2048 \b, is the startup partition
+
+#http://wiki.mozilla.org/DS_Store_File_Format`
+#http://en.wikipedia.org/wiki/.DS_Store
+0 string \0\0\0\1Bud1\0 Apple Desktop Services Store
+
#------------------------------------------------------------------------------
# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $
# applix: file(1) magic for Applixware
@@ -1431,7 +1662,7 @@
>7 string MACRO Macro
>7 string BUILDER Builder Object
#------------------------------------------------------------------------------
-# $File: archive,v 1.62 2011/01/07 20:24:25 christos Exp $
+# $File: archive,v 1.87 2014/06/03 19:15:58 christos Exp $
# archive: file(1) magic for archive formats (see also "msdos" for self-
# extracting compressed archives)
#
@@ -1444,6 +1675,11 @@
257 string ustar\040\040\0 GNU tar archive
!:mime application/x-tar # encoding: gnu
+# Incremental snapshot gnu-tar format from:
+# http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
+0 string GNU\ tar- GNU tar incremental snapshot data
+>&0 regex [0-9]\.[0-9]+-[0-9]+ version %s
+
# cpio archives
#
# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
@@ -1463,12 +1699,66 @@
0 string 070701 ASCII cpio archive (SVR4 with no CRC)
0 string 070702 ASCII cpio archive (SVR4 with CRC)
-# Debian package (needs to go before regular portable archives)
#
+# Various archive formats used by various versions of the "ar"
+# command.
+#
+
+#
+# Original UNIX archive formats.
+# They were written with binary values in host byte order, and
+# the magic number was a host "int", which might have been 16 bits
+# or 32 bits. We don't say "PDP-11" or "VAX", as there might have
+# been ports to little-endian 16-bit-int or 32-bit-int platforms
+# (x86?) using some of those formats; if none existed, feel free
+# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian
+# 32-bit. There might have been big-endian ports of that sort as
+# well.
+#
+0 leshort 0177555 very old 16-bit-int little-endian archive
+0 beshort 0177555 very old 16-bit-int big-endian archive
+0 lelong 0177555 very old 32-bit-int little-endian archive
+0 belong 0177555 very old 32-bit-int big-endian archive
+
+0 leshort 0177545 old 16-bit-int little-endian archive
+>2 string __.SYMDEF random library
+0 beshort 0177545 old 16-bit-int big-endian archive
+>2 string __.SYMDEF random library
+0 lelong 0177545 old 32-bit-int little-endian archive
+>4 string __.SYMDEF random library
+0 belong 0177545 old 32-bit-int big-endian archive
+>4 string __.SYMDEF random library
+
+#
+# From "pdp" (but why a 4-byte quantity?)
+#
+0 lelong 0x39bed PDP-11 old archive
+0 lelong 0x39bee PDP-11 4.0 archive
+
+#
+# XXX - what flavor of APL used this, and was it a variant of
+# some ar archive format? It's similar to, but not the same
+# as, the APL workspace magic numbers in pdp.
+#
+0 long 0100554 apl workspace
+
+#
+# System V Release 1 portable(?) archive format.
+#
+0 string =<ar> System V Release 1 ar archive
+!:mime application/x-archive
+
+#
+# Debian package; it's in the portable archive format, and needs to go
+# before the entry for regular portable archives, as it's recognized as
+# a portable archive whose first member has a name beginning with
+# "debian".
+#
0 string =!<arch>\ndebian
-!:mime application/x-debian-package
>8 string debian-split part of multipart Debian package
+!:mime application/vnd.debian.binary-package
>8 string debian-binary Debian binary package
+!:mime application/vnd.debian.binary-package
>8 string !debian
>68 string >\0 (format %s)
# These next two lines do not work, because a bzip2 Debian archive
@@ -1480,18 +1770,14 @@
#>84 string gz \b, uses gzip compression
#>136 ledate x created: %s
-# other archives
-0 long 0177555 very old archive
-0 short 0177555 very old PDP-11 archive
-0 long 0177545 old archive
-0 short 0177545 old PDP-11 archive
-0 long 0100554 apl workspace
-0 string =<ar> archive
-!:mime application/x-archive
-
-# MIPS archive (needs to go before regular portable archives)
#
+# MIPS archive; they're in the portable archive format, and need to go
+# before the entry for regular portable archives, as it's recognized as
+# a portable archive whose first member has a name beginning with
+# "__________E".
+#
0 string =!<arch>\n__________E MIPS archive
+!:mime application/x-archive
>20 string U with MIPS Ucode members
>21 string L with MIPSEL members
>21 string B with MIPSEB members
@@ -1502,56 +1788,20 @@
0 search/1 -h- Software Tools format archive text
#
-# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is
-# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
+# BSD/SVR2-and-later portable archive formats.
#
-# 0 string =!<arch> current ar archive
-# 0 long 0x213c6172 archive file
-#
-# and for SVR1 archives, we have:
-#
-# 0 string \<ar> System V Release 1 ar archive
-# 0 string =<ar> archive
-#
-# XXX - did Aegis really store shared libraries, breakpointed modules,
-# and absolute code program modules in the same format as new-style
-# "ar" archives?
-#
0 string =!<arch> current ar archive
!:mime application/x-archive
>8 string __.SYMDEF random library
->0 belong =65538 - pre SR9.5
->0 belong =65539 - post SR9.5
->0 beshort 2 - object archive
->0 beshort 3 - shared library module
->0 beshort 4 - debug break-pointed module
->0 beshort 5 - absolute code program module
-0 string \<ar> System V Release 1 ar archive
-0 string =<ar> archive
+>68 string __.SYMDEF\ SORTED random library
+
#
-# XXX - from "vax", which appears to collect a bunch of byte-swapped
-# thingies, to help you recognize VAX files on big-endian machines;
-# with "leshort", "lelong", and "string", that's no longer necessary....
+# "Thin" archive, as can be produced by GNU ar.
#
-0 belong 0x65ff0000 VAX 3.0 archive
-0 belong 0x3c61723e VAX 5.0 archive
-#
-0 long 0x213c6172 archive file
-0 lelong 0177555 very old VAX archive
-0 leshort 0177555 very old PDP-11 archive
-#
-# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
-# be a random library (it said 0xff65 rather than 0177545).
-#
-0 lelong 0177545 old VAX archive
->8 string __.SYMDEF random library
-0 leshort 0177545 old PDP-11 archive
->8 string __.SYMDEF random library
-#
-# From "pdp" (but why a 4-byte quantity?)
-#
-0 lelong 0x39bed PDP-11 old archive
-0 lelong 0x39bee PDP-11 4.0 archive
+0 string =!<thin>\n thin archive with
+>68 belong 0 no symbol entries
+>68 belong 1 %d symbol entry
+>68 belong >1 %d symbol entries
# ARC archiver, from Daniel Quinlan (quinlan at yggdrasil.com)
#
@@ -1611,11 +1861,14 @@
# SAR
3 string LH5 SAR archive data
# BSArc/BS2
-0 string \212\3SB \0 BSArc/BS2 archive data
+0 string \212\3SB\020\0 BSArc/BS2 archive data
+# Bethesda Softworks Archive (Oblivion)
+0 string BSA\0 BSArc archive data
+>4 lelong x version %d
# MAR
2 string =-ah MAR archive data
# ACB
-0 belong&0x00f800ff 0x00800000 ACB archive data
+#0 belong&0x00f800ff 0x00800000 ACB archive data
# CPZ
# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data
# JRC
@@ -1636,7 +1889,7 @@
# AMGC
0 string \xad6" AMGC archive data
# NuLIB
-0 string NõFélå NuLIB archive data
+0 string N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data
# PakLeo
0 string LEOLZW PAKLeo archive data
# ChArc
@@ -1648,7 +1901,7 @@
# Freeze
0 string \x1f\x9f\x4a\x10\x0a Freeze archive data
# KBoom
-0 string ¨MP¨ KBoom archive data
+0 string \xc2\xa8MP\xc2\xa8 KBoom archive data
# NSQ, must go after CDC Codec
0 string \x76\xff NSQ archive data
# DPA
@@ -1679,7 +1932,7 @@
>9 string \0
>>0 string KWAJ
>>>7 string \321\003 MS Compress archive data
->>>>14 ulong >0 \b, original size: %ld bytes
+>>>>14 ulong >0 \b, original size: %d bytes
>>>>18 ubyte >0x65
>>>>>18 string x \b, was %.8s
>>>>>(10.b-4) string x \b.%.3s
@@ -1686,7 +1939,7 @@
# MP3 (archiver, not lossy audio compression)
0 string MP3\x1a MP3-Archiver archive data
# ZET
-0 string OZÝ ZET archive data
+0 string OZ\xc3\x9d ZET archive data
# TSComp
0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
# ARQ
@@ -1717,7 +1970,7 @@
# Xtreme
0 string ULEB\0 Xtreme archive data
# Pack Magic
-0 string @â\1\0 Pack Magic archive data
+0 string @\xc3\xa2\1\0 Pack Magic archive data
# BTS
0 belong&0xfeffffff 0x1a034465 BTS archive data
# ELI 5750
@@ -1853,7 +2106,7 @@
# XPack Data
0 string xpa XPack archive data
# XPack Single Data
-0 string Í\ jm XPack single archive data
+0 string \xc3\x8d\ jm XPack single archive data
# TODO: missing due to unknown magic/magic at end of file:
#DWC
@@ -1908,7 +2161,7 @@
# This is a really bad format. A file containing HAWAII will match this...
#0 string HA HA archive data,
#>2 leshort =1 1 file,
-#>2 leshort >1 %u files,
+#>2 leshort >1 %hu files,
#>4 byte&0x0f =0 first is type CPY
#>4 byte&0x0f =1 first is type ASC
#>4 byte&0x0f =2 first is type HSC
@@ -1998,6 +2251,7 @@
!:mime application/zip
# Zip archives (Greg Roelofs, c/o zip-bugs at wkuvx1.wku.edu)
+0 string PK\005\006 Zip archive data (empty)
0 string PK\003\004
# Specialised zip formats which start with a member named 'mimetype'
@@ -2087,11 +2341,10 @@
!:mime application/vnd.oasis.opendocument.image-template
# EPUB (OEBPS) books using OCF (OEBPS Container Format)
-# From: Adam Buchbinder <adam.buchbinder at gmail.com>
# http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4.
-# (mimetype contains "application/epub+zip")
->>50 string epub+zip EPUB ebook data
-!:mime application/epub+zip
+# From: Ralf Brown <ralf.brown at gmail.com>
+>>50 string epub+zip EPUB document
+!:mime application/epub+zip
# Catch other ZIP-with-mimetype formats
# In a ZIP file, the bytes immediately after a member's contents are
@@ -2111,16 +2364,28 @@
>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?)
!:mime application/zip
+# Java Jar files
+>(26.s+30) leshort 0xcafe Java archive data (JAR)
+!:mime application/java-archive
+
# Generic zip archives (Greg Roelofs, c/o zip-bugs at wkuvx1.wku.edu)
# Next line excludes specialized formats:
->26 string !\x8\0\0\0mimetype Zip archive data
+>(26.s+30) leshort !0xcafe
+>>26 string !\x8\0\0\0mimetype Zip archive data
!:mime application/zip
->>4 byte 0x09 \b, at least v0.9 to extract
->>4 byte 0x0a \b, at least v1.0 to extract
->>4 byte 0x0b \b, at least v1.1 to extract
->>0x161 string WINZIP \b, WinZIP self-extracting
->>4 byte 0x14 \b, at least v2.0 to extract
+>>>4 byte 0x09 \b, at least v0.9 to extract
+>>>4 byte 0x0a \b, at least v1.0 to extract
+>>>4 byte 0x0b \b, at least v1.1 to extract
+>>>4 byte 0x14 \b, at least v2.0 to extract
+>>>4 byte 0x2d \b, at least v3.0 to extract
+>>>0x161 string WINZIP \b, WinZIP self-extracting
+# StarView Metafile
+# From Pierre Ducroquet <pinaraf at pinaraf.info>
+0 string VCLMTF StarView MetaFile
+>6 beshort x \b, version %d
+>8 belong x \b, size %d
+
# Zoo archiver
20 lelong 0xfdc4a7dc Zoo archive data
!:mime application/x-zoo
@@ -2272,7 +2537,7 @@
# From: Dirk Jagdmann <doj at cubic.org>
# xar archive format: http://code.google.com/p/xar/
0 string xar! xar archive
->6 beshort x - version %ld
+>6 beshort x - version %d
# From: "Nelson A. de Oliveira" <naoliv at gmail.com>
# .kgb
@@ -2304,19 +2569,105 @@
# archive must be an uncompressed file called 'mimetype' with contents
# 'application/epub+zip'
-# start by checking that this is a ZIP archive, then check for the
-# proper mimetype file
-# From: Ralf Brown <ralf.brown at gmail.com>
-0 string PK\003\004
->0x1E string mimetypeapplication/epub+zip EPUB document
-!:mime application/epub+zip
-# From: "Michał Górny" <mgorny at gentoo.org>
+# From: "Michael Gorny" <mgorny at gentoo.org>
# ZPAQ: http://mattmahoney.net/dc/zpaq.html
0 string zPQ ZPAQ stream
>3 byte x \b, level %d
+# BBeB ebook, unencrypted (LRF format)
+# URL: http://www.sven.de/librie/Librie/LrfFormat
+# From: Adam Buchbinder <adam.buchbinder at gmail.com>
+0 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted
+>8 beshort x \b, version %d
+>36 byte 1 \b, front-to-back
+>36 byte 16 \b, back-to-front
+>42 beshort x \b, (%dx,
+>44 beshort x %d)
+
+# Symantec GHOST image by Joerg Jenderek at May 2014
+# http://us.norton.com/ghost/
+# http://www.garykessler.net/library/file_sigs.html
+0 ubelong&0xFFFFf7f0 0xFEEF0100 Norton GHost image
+# *.GHO
+>2 ubyte&0x08 0x00 \b, first file
+# *.GHS or *.[0-9] with cns program option
+>2 ubyte&0x08 0x08 \b, split file
+# part of split index interesting for *.ghs
+>>4 ubyte x id=0x%x
+# compression tag minus one equals numeric compression command line switch z[1-9]
+>3 ubyte 0 \b, no compression
+>3 ubyte 2 \b, fast compression (Z1)
+>3 ubyte 3 \b, medium compression (Z2)
+>3 ubyte >3
+>>3 ubyte <11 \b, compression (Z%d-1)
+>2 ubyte&0x08 0x00
+# ~ 30 byte password field only for *.gho
+>>12 ubequad !0 \b, password protected
+>>44 ubyte !1
+# 1~Image All, sector-by-sector only for *.gho
+>>>10 ubyte 1 \b, sector copy
+# 1~Image Boot track only for *.gho
+>>>43 ubyte 1 \b, boot track
+# 1~Image Disc only for *.gho implies Image Boot track and sector copy
+>>44 ubyte 1 \b, disc sector copy
+# optional image description only *.gho
+>>0xff string >\0 "%-.254s"
+# look for DOS sector end sequence
+>0xE08 search/7776 \x55\xAA
+>>&-512 indirect x \b; contains
+
+# Symantec GHOST image by Joerg Jenderek at May 2014
+# http://us.norton.com/ghost/
+# http://www.garykessler.net/library/file_sigs.html
+0 ubelong&0xFFFFf7f0 0xFEEF0100 Norton GHost image
+# *.GHO
+>2 ubyte&0x08 0x00 \b, first file
+# *.GHS or *.[0-9] with cns program option
+>2 ubyte&0x08 0x08 \b, split file
+# part of split index interesting for *.ghs
+>>4 ubyte x id=0x%x
+# compression tag minus one equals numeric compression command line switch z[1-9]
+>3 ubyte 0 \b, no compression
+>3 ubyte 2 \b, fast compression (Z1)
+>3 ubyte 3 \b, medium compression (Z2)
+>3 ubyte >3
+>>3 ubyte <11 \b, compression (Z%d-1)
+>2 ubyte&0x08 0x00
+# ~ 30 byte password field only for *.gho
+>>12 ubequad !0 \b, password protected
+>>44 ubyte !1
+# 1~Image All, sector-by-sector only for *.gho
+>>>10 ubyte 1 \b, sector copy
+# 1~Image Boot track only for *.gho
+>>>43 ubyte 1 \b, boot track
+# 1~Image Disc only for *.gho implies Image Boot track and sector copy
+>>44 ubyte 1 \b, disc sector copy
+# optional image description only *.gho
+>>0xff string >\0 "%-.254s"
+# look for DOS sector end sequence
+>0xE08 search/7776 \x55\xAA
+>>&-512 indirect x \b; contains
#------------------------------------------------------------------------------
+# $File: assembler,v 1.6 2013/12/11 14:14:20 christos Exp $
+# make: file(1) magic for assembler source
+#
+0 regex \^[\040\t]{0,50}\\.asciiz assembler source text
+!:mime text/x-asm
+0 regex \^[\040\t]{0,50}\\.byte assembler source text
+!:mime text/x-asm
+0 regex \^[\040\t]{0,50}\\.even assembler source text
+!:mime text/x-asm
+0 regex \^[\040\t]{0,50}\\.globl assembler source text
+!:mime text/x-asm
+0 regex \^[\040\t]{0,50}\\.text assembler source text
+!:mime text/x-asm
+0 regex \^[\040\t]{0,50}\\.file assembler source text
+!:mime text/x-asm
+0 regex \^[\040\t]{0,50}\\.type assembler source text
+!:mime text/x-asm
+
+#------------------------------------------------------------------------------
# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $
# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
# strings as "long" - we assume they're just strings:
@@ -2335,7 +2686,7 @@
#------------------------------------------------------------------------------
-# $File: att3b,v 1.8 2009/09/19 16:28:08 christos Exp $
+# $File: att3b,v 1.9 2014/04/30 21:41:02 christos Exp $
# att3b: file(1) magic for AT&T 3B machines
#
# The `versions' should be un-commented if they work for you.
@@ -2346,10 +2697,10 @@
# The 3B20 conflicts with SCCS.
#0 beshort 0550 3b20 COFF executable
#>12 belong >0 not stripped
-#>22 beshort >0 - version %ld
+#>22 beshort >0 - version %d
#0 beshort 0551 3b20 COFF executable (TV)
#>12 belong >0 not stripped
-#>22 beshort >0 - version %ld
+#>22 beshort >0 - version %d
#
# WE32K
#
@@ -2364,12 +2715,12 @@
>20 beshort 0410 (pure)
>20 beshort 0413 (demand paged)
>20 beshort 0443 (target shared library)
->22 beshort >0 - version %ld
+>22 beshort >0 - version %d
0 beshort 0561 WE32000 COFF executable (TV)
>12 belong >0 not stripped
#>18 beshort &00020000 - 32100 required
#>18 beshort &00040000 and MAU hardware required
-#>22 beshort >0 - version %ld
+#>22 beshort >0 - version %d
#
# core file for 3b2
0 string \000\004\036\212\200 3b2 core file
@@ -2376,7 +2727,7 @@
>364 string >\0 of '%s'
#------------------------------------------------------------------------------
-# $File: audio,v 1.61 2010/09/20 19:19:16 rrt Exp $
+# $File: audio,v 1.71 2014/05/14 23:30:28 christos Exp $
# audio: file(1) magic for sound formats (see also "iff")
#
# Jan Nicolai Langfeldt (janl at ifi.uio.no), Dan Quinlan (quinlan at yggdrasil.com),
@@ -2480,7 +2831,7 @@
# first entry is also the string "NTRK"
0 belong 0x4e54524b MultiTrack sound data
->4 belong x - version %ld
+>4 belong x - version %d
# Extended MOD format (*.emd) (Greg Roelofs, newt at uchicago.edu); NOT TESTED
# [based on posting 940824 by "Dirk/Elastik", husberg at lehtori.cc.tut.fi]
@@ -2628,12 +2979,17 @@
>0x36 string >\0 author: "%s"
>0x56 string >\0 copyright: "%s"
-# IRCAM <mpruett at sgi.com>
-# VAX and MIPS files are little-endian; Sun and NeXT are big-endian
-0 belong 0x64a30100 IRCAM file (VAX)
-0 belong 0x64a30200 IRCAM file (Sun)
+# IRCAM sound files - Michael Pruett <michael at 68k.org>
+# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html
+0 belong 0x64a30100 IRCAM file (VAX little-endian)
+0 belong 0x0001a364 IRCAM file (VAX big-endian)
+0 belong 0x64a30200 IRCAM file (Sun big-endian)
+0 belong 0x0002a364 IRCAM file (Sun little-endian)
0 belong 0x64a30300 IRCAM file (MIPS little-endian)
-0 belong 0x64a30400 IRCAM file (NeXT)
+0 belong 0x0003a364 IRCAM file (MIPS big-endian)
+0 belong 0x64a30400 IRCAM file (NeXT big-endian)
+0 belong 0x64a30400 IRCAM file (NeXT big-endian)
+0 belong 0x0004a364 IRCAM file (NeXT little-endian)
# NIST SPHERE <mpruett at sgi.com>
0 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file
@@ -2862,6 +3218,7 @@
# From danny.milo at gmx.net (Danny Milosavljevic)
# New version from Abel Cheung <abel (@) oaka.org>
0 string MAC\040 Monkey's Audio compressed format
+!:mime audio/x-ape
>4 uleshort >0x0F8B version %d
>>(0x08.l) uleshort =1000 with fast compression
>>(0x08.l) uleshort =2000 with normal compression
@@ -2882,7 +3239,7 @@
>>12 ulelong x \b, sample rate %d
# adlib sound files
-# From Gürkan Sengün <gurkan at linuks.mine.nu>, http://www.linuks.mine.nu
+# From Gurkan Sengun <gurkan at linuks.mine.nu>, http://www.linuks.mine.nu
0 string RAWADATA RdosPlay RAW
1068 string RoR AMUSIC Adlib Tracker
@@ -2941,6 +3298,7 @@
# musepak support From: "Jiri Pejchal" <jiri.pejchal at gmail.com>
0 string MP+ Musepack audio
+!:mime audio/x-musepack
>3 byte 255 \b, SV pre8
>3 byte&0xF 0x6 \b, SV 6
>3 byte&0xF 0x8 \b, SV 8
@@ -2997,6 +3355,79 @@
0 string SCgf SuperCollider3 Synth Definition file,
>4 belong x version %d
+# Type: True Audio Lossless Audio
+# URL: http://wiki.multimedia.cx/index.php?title=True_Audio
+# From: Mike Melanson <mike at multimedia.cx>
+0 string TTA1 True Audio Lossless Audio
+
+# Type: WavPack Lossless Audio
+# URL: http://wiki.multimedia.cx/index.php?title=WavPack
+# From: Mike Melanson <mike at multimedia.cx>
+0 string wvpk WavPack Lossless Audio
+
+# From Fabio R. Schmidlin <frs at pop.com.br>
+# VGM music file
+0 string Vgm\
+>9 ubyte >0 VGM Video Game Music dump v
+>>9 ubyte/16 >0 \b%d
+>>9 ubyte&0x0F x \b%d
+>>8 ubyte/16 x \b.%d
+>>8 ubyte&0x0F >0 \b%d
+#Get soundchips
+>>8 ubyte x \b, soundchip(s)=
+>>0x0C ulelong >0 SN76489,
+>>0x10 ulelong >0 YM2413,
+>>0x2C ulelong >0 YM2612,
+>>0x30 ulelong >0 YM2151,
+>>0x38 ulelong >0 Sega PCM,
+>>0x34 ulelong >0xC
+>>>0x40 ulelong >0 RF5C68,
+>>0x34 ulelong >0x10
+>>>0x44 ulelong >0 YM2203,
+>>0x34 ulelong >0x14
+>>>0x48 ulelong >0 YM2608,
+>>0x34 ulelong >0x18
+>>>0x4C lelong >0 YM2610,
+>>>0x4C lelong <0 YM2610B,
+>>0x34 ulelong >0x1C
+>>>0x50 ulelong >0 YM3812,
+>>0x34 ulelong >0x20
+>>>0x54 ulelong >0 YM3526,
+>>0x34 ulelong >0x24
+>>>0x58 ulelong >0 Y8950,
+>>0x34 ulelong >0x28
+>>>0x5C ulelong >0 YMF262,
+>>0x34 ulelong >0x2C
+>>>0x60 ulelong >0 YMF278B,
+>>0x34 ulelong >0x30
+>>>0x64 ulelong >0 YMF271,
+>>0x34 ulelong >0x34
+>>>0x68 ulelong >0 YMZ280B,
+>>0x34 ulelong >0x38
+>>>0x6C ulelong >0 RF5C164,
+>>0x34 ulelong >0x3C
+>>>0x70 ulelong >0 PWM,
+>>0x34 ulelong >0x40
+>>>0x74 ulelong >0
+>>>>0x78 ubyte 0x00 AY-3-8910,
+>>>>0x78 ubyte 0x01 AY-3-8912,
+>>>>0x78 ubyte 0x02 AY-3-8913,
+>>>>0x78 ubyte 0x03 AY-3-8930,
+>>>>0x78 ubyte 0x10 YM2149,
+>>>>0x78 ubyte 0x11 YM3439,
+
+# GVOX Encore file format
+# Since this is a proprietary file format and there is no publicly available
+# format specification, this is just based on induction
+#
+0 string SCOW
+>4 byte 0xc4 GVOX Encore music, version 5.0 or above
+>4 byte 0xc2 GVOX Encore music, version < 5.0
+
+0 string ZBOT
+>4 byte 0xc5 GVOX Encore music, version < 5.0
+
+
#----------------------------------------------------------------
# $File: basis,v 1.4 2009/09/19 16:28:08 christos Exp $
# basis: file(1) magic for BBx/Pro5-files
@@ -3016,18 +3447,26 @@
>>8 string \000 (mkey)
#------------------------------------------------------------------------------
-# $File: bflt,v 1.4 2009/09/19 16:28:08 christos Exp $
+# $File: bflt,v 1.5 2014/04/30 21:41:02 christos Exp $
# bFLT: file(1) magic for BFLT uclinux binary files
#
# From Philippe De Muyter <phdm at macqel.be>
#
0 string bFLT BFLT executable
->4 belong x - version %ld
+>4 belong x - version %d
>4 belong 4
>>36 belong&0x1 0x1 ram
>>36 belong&0x2 0x2 gotpic
>>36 belong&0x4 0x4 gzip
>>36 belong&0x8 0x8 gzdata
+
+#------------------------------------------------------------------------------
+# $File: blackberry,v 1.1 2014/01/31 01:51:32 christos Exp $
+# blackberry: file(1) magic for BlackBerry file formats
+#
+5 belong 0
+>8 belong 010010010 BlackBerry RIM ETP file
+>>22 string x \b for %s
# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files
# http://ftg.lbl.gov/checkpoint
0 string C\0\0\0R\0\0\0 BLCR
@@ -3051,8 +3490,8 @@
# Uncomment the following only of your "file" program supports "search"
#>0 search/1024 VMA\06 for kernel
#>>&1 byte x %d.
-#>>&2 byte x %d.
-#>>&3 byte x %d
+#>>&2 byte x \b%d.
+#>>&3 byte x \b%d
#------------------------------------------------------------------------------
# $File: blender,v 1.5 2009/09/19 16:28:08 christos Exp $
@@ -3125,8 +3564,10 @@
>8 string __.SYMDEF random library
#------------------------------------------------------------------------------
-# $File: bsdi,v 1.5 2009/09/19 16:28:08 christos Exp $
+# $File: bsdi,v 1.7 2014/03/29 15:40:34 christos Exp $
# bsdi: file(1) magic for BSD/OS (from BSDI) objects
+# Some object/executable formats use the same magic numbers as are used
+# in other OSes; those are handled by entries in aout.
#
0 lelong 0314 386 compact demand paged pure executable
@@ -3133,20 +3574,8 @@
>16 lelong >0 not stripped
>32 byte 0x6a (uses shared libs)
-0 lelong 0407 386 executable
->16 lelong >0 not stripped
->32 byte 0x6a (uses shared libs)
-
-0 lelong 0410 386 pure executable
->16 lelong >0 not stripped
->32 byte 0x6a (uses shared libs)
-
-0 lelong 0413 386 demand paged pure executable
->16 lelong >0 not stripped
->32 byte 0x6a (uses shared libs)
-
# same as in SunOS 4.x, except for static shared libraries
-0 belong&077777777 0600413 sparc demand paged
+0 belong&077777777 0600413 SPARC demand paged
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
@@ -3155,13 +3584,13 @@
>16 belong >0 not stripped
>36 belong 0xb4100001 (uses shared libs)
-0 belong&077777777 0600410 sparc pure
+0 belong&077777777 0600410 SPARC pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
>36 belong 0xb4100001 (uses shared libs)
-0 belong&077777777 0600407 sparc
+0 belong&077777777 0600407 SPARC
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
@@ -3188,24 +3617,52 @@
>12 belong 1003 HCI BCSP
>12 belong 1004 HCI Serial (H5)
>>12 belong x type %d
-
#------------------------------------------------------------------------------
-# $File: c-lang,v 1.14 2009/09/19 16:28:08 christos Exp $
-# c-lang: file(1) magic for C programs (or REXX)
+# $File: c-lang,v 1.19 2014/06/03 19:17:27 christos Exp $
+# c-lang: file(1) magic for C and related languages programs
#
-# XPM icons (Greg Roelofs, newt at uchicago.edu)
-# if you uncomment "/*" for C/REXX below, also uncomment this entry
-#0 string /*\ XPM\ */ X pixmap image data
-#!:mime image/x-xpmi
+# BCPL
+0 search/8192 "libhdr" BCPL source text
+!:mime text/x-bcpl
+0 search/8192 "LIBHDR" BCPL source text
+!:mime text/x-bcpl
-# 3DS (3d Studio files) Conflicts with diff output 0x3d '='
-#16 beshort 0x3d3d image/x-3ds
+# C
+0 regex \^#include C source text
+!:mime text/x-c
+0 regex \^char[\ \t\n]+ C source text
+!:mime text/x-c
+0 regex \^double[\ \t\n]+ C source text
+!:mime text/x-c
+0 regex \^extern[\ \t\n]+ C source text
+!:mime text/x-c
+0 regex \^float[\ \t\n]+ C source text
+!:mime text/x-c
+0 regex \^struct[\ \t\n]+ C source text
+!:mime text/x-c
+0 regex \^union[\ \t\n]+ C source text
+!:mime text/x-c
+0 search/8192 main( C source text
+!:mime text/x-c
-# this first will upset you if you're a PL/1 shop...
-# in which case rm it; ascmagic will catch real C programs
-#0 search/1 /* C or REXX program text
-#0 search/1 // C++ program text
+# C++
+# The strength of these rules is increased so they beat the C rules above
+0 regex \^template[\ \t\n]+ C++ source text
+!:strength + 5
+!:mime text/x-c++
+0 regex \^virtual[\ \t\n]+ C++ source text
+!:strength + 5
+!:mime text/x-c++
+0 regex \^class[\ \t\n]+ C++ source text
+!:strength + 5
+!:mime text/x-c++
+0 regex \^public: C++ source text
+!:strength + 5
+!:mime text/x-c++
+0 regex \^private: C++ source text
+!:strength + 5
+!:mime text/x-c++
# From: Mikhail Teterin <mi at aldan.algebra.com>
0 string cscope cscope reference data
@@ -3212,7 +3669,7 @@
>7 string x version %.2s
# We skip the path here, because it is often long (so file will
# truncate it) and mostly redundant.
-# The inverted index functionality was added some time betwen
+# The inverted index functionality was added some time between
# versions 11 and 15, so look for -q if version is above 14:
>7 string >14
>>10 search/100 \ -q\ with inverted index
@@ -3262,17 +3719,10 @@
>40 string x Name:%.24s
#------------------------------------------------------------------------------
-# $File: cad,v 1.10 2010/12/25 14:33:43 christos Exp $
+# $File: cad,v 1.13 2014/03/23 18:05:38 christos Exp $
# autocad: file(1) magic for cad files
#
-# AutoCAD DWG versions R13/R14 (www.autodesk.com)
-# Written December 01, 2003 by Lester Hightower
-# Based on the DWG File Format Specifications at http://www.opendwg.org/
-0 string \101\103\061\060\061 AutoCAD
->5 string \062\000\000\000\000 DWG ver. R13
->5 string \064\000\000\000\000 DWG ver. R14
-
# Microstation DGN/CIT Files (www.bentley.com)
# Last updated July 29, 2005 by Lester Hightower
# DGN is the default file extension of Microstation/Intergraph CAD files.
@@ -3311,19 +3761,62 @@
>4 string \030\000\000 CITFile
>4 string \030\000\003 CITFile
+# AutoCAD
+# Merge of the different contributions and updates from http://en.wikipedia.org/wiki/Dwg
+# and http://www.iana.org/assignments/media-types/image/vnd.dwg
+0 string MC0.0 DWG AutoDesk AutoCAD Release 1.0
+!:mime image/vnd.dwg
+0 string AC1.2 DWG AutoDesk AutoCAD Release 1.2
+!:mime image/vnd.dwg
+0 string AC1.3 DWG AutoDesk AutoCAD Release 1.3
+!:mime image/vnd.dwg
+0 string AC1.40 DWG AutoDesk AutoCAD Release 1.40
+!:mime image/vnd.dwg
+0 string AC1.50 DWG AutoDesk AutoCAD Release 2.05
+!:mime image/vnd.dwg
+0 string AC2.10 DWG AutoDesk AutoCAD Release 2.10
+!:mime image/vnd.dwg
+0 string AC2.21 DWG AutoDesk AutoCAD Release 2.21
+!:mime image/vnd.dwg
+0 string AC2.22 DWG AutoDesk AutoCAD Release 2.22
+!:mime image/vnd.dwg
+0 string AC1001 DWG AutoDesk AutoCAD Release 2.22
+!:mime image/vnd.dwg
+0 string AC1002 DWG AutoDesk AutoCAD Release 2.50
+!:mime image/vnd.dwg
+0 string AC1003 DWG AutoDesk AutoCAD Release 2.60
+!:mime image/vnd.dwg
+0 string AC1004 DWG AutoDesk AutoCAD Release 9
+!:mime image/vnd.dwg
+0 string AC1006 DWG AutoDesk AutoCAD Release 10
+!:mime image/vnd.dwg
+0 string AC1009 DWG AutoDesk AutoCAD Release 11/12
+!:mime image/vnd.dwg
+# AutoCAD DWG versions R13/R14 (www.autodesk.com)
+# Written December 01, 2003 by Lester Hightower
+# Based on the DWG File Format Specifications at http://www.opendwg.org/
# AutoCad, from Nahuel Greco
# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com)
-0 string AC1012 DWG AutoDesk AutoCad (release 12)
-0 string AC1013 DWG AutoDesk AutoCad (release 13)
-0 string AC1014 DWG AutoDesk AutoCad (release 14)
+0 string AC1012 DWG AutoDesk AutoCAD Release 13
+!:mime image/vnd.dwg
+0 string AC1014 DWG AutoDesk AutoCAD Release 14
+!:mime image/vnd.dwg
+0 string AC1015 DWG AutoDesk AutoCAD 2000/2002
+!:mime image/vnd.dwg
+
# A new version of AutoCAD DWG
# Sergey Zaykov (mail_of_sergey at mail.ru, sergey_zaikov at rambler.ru,
# ICQ 358572321)
# From various sources like:
# http://autodesk.blogs.com/between_the_lines/autocad-release-history.html
-0 string AC1018 DWG AutoDesk AutoCAD 2004/2005/2006
-0 string AC1021 DWG AutoDesk AutoCAD 2007/2008/2009
-0 string AC1024 DWG AutoDesk AutoCAD 2010/2011
+0 string AC1018 DWG AutoDesk AutoCAD 2004/2005/2006
+!:mime image/vnd.dwg
+0 string AC1021 DWG AutoDesk AutoCAD 2007/2008/2009
+!:mime image/vnd.dwg
+0 string AC1024 DWG AutoDesk AutoCAD 2010/2011/2012
+!:mime image/vnd.dwg
+0 string AC1027 DWG AutoDesk AutoCAD 2013/2014
+!:mime image/vnd.dwg
# KOMPAS 2D drawing from ASCON
# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor
@@ -3372,19 +3865,24 @@
0 beshort 0x0809 Bentley/Intergraph MicroStation
>0x02 byte 0xfe
>>0x04 beshort 0x1800 CIT raster CAD
-0 string AC1012 AutoDesk AutoCAD R13
-0 string AC1014 AutoDesk AutoCAD R14
-0 string AC1015 AutoDesk AutoCAD R2000
+# 3DS (3d Studio files) Conflicts with diff output 0x3d '='
+#16 beshort 0x3d3d image/x-3ds
+
+# MegaCAD 2D/3D drawing (.prt)
+# http://megacad.de/
+# From: Markus Heidelberg <markus.heidelberg at web.de>
+0 string MegaCad23\0 MegaCAD 2D/3D drawing
+
#------------------------------------------------------------------------------
-# $File: cafebabe,v 1.8 2009/09/19 16:28:08 christos Exp $
+# $File: cafebabe,v 1.16 2014/04/30 21:41:02 christos Exp $
# Cafe Babes unite!
#
-# Since Java bytecode and Mach-O fat-files have the same magic number, the test
-# must be performed in the same "magic" sequence to get both right. The long
-# at offset 4 in a mach-O fat file tells the number of architectures; the short at
-# offset 4 in a Java bytecode file is the JVM minor version and the
-# short at offset 6 is the JVM major version. Since there are only
+# Since Java bytecode and Mach-O universal binaries have the same magic number,
+# the test must be performed in the same "magic" sequence to get both right.
+# The long at offset 4 in a Mach-O universal binary tells the number of
+# architectures; the short at offset 4 in a Java bytecode file is the JVM minor
+# version and the short at offset 6 is the JVM major version. Since there are only
# only 18 labeled Mach-O architectures at current, and the first released
# Java class format was version 43.0, we can safely choose any number
# between 18 and 39 to test the number of architectures against
@@ -3391,9 +3889,10 @@
# (and use as a hack). Let's not use 18, because the Mach-O people
# might add another one or two as time goes by...
#
+### JAVA START ###
0 belong 0xcafebabe
+>4 belong >30 compiled Java class data,
!:mime application/x-java-applet
->4 belong >30 compiled Java class data,
>>6 beshort x version %d.
>>4 beshort x \b%d
# Which is which?
@@ -3405,17 +3904,39 @@
>>4 belong 0x0031 (Java 1.5)
>>4 belong 0x0032 (Java 1.6)
+0 belong 0xcafed00d JAR compressed with pack200,
+>5 byte x version %d.
+>4 byte x \b%d
+!:mime application/x-java-pack200
-0 belong 0xcafebabe
->4 belong 1 Mach-O fat file with 1 architecture
->4 belong >1
->>4 belong <20 Mach-O fat file with %ld architectures
0 belong 0xcafed00d JAR compressed with pack200,
->>5 byte x version %d.
->>4 byte x \b%d
+>5 byte x version %d.
+>4 byte x \b%d
!:mime application/x-java-pack200
+### JAVA END ###
+### MACH-O START ###
+
+0 name mach-o \b [
+>0 use mach-o-cpu \b
+>&(8.L) indirect \b:
+>0 belong x \b]
+
+0 belong 0xcafebabe
+>4 belong 1 Mach-O universal binary with 1 architecture:
+>>8 use mach-o \b
+>4 belong >1
+>>4 belong <20 Mach-O universal binary with %d architectures:
+>>>8 use mach-o \b
+>>>28 use mach-o \b
+>>4 belong >2
+>>>48 use mach-o \b
+>>4 belong >3
+>>>68 use mach-o \b
+
+### MACH-O END ###
+
#------------------------------------------------------------------------------
# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $
# CDDB: file(1) magic for CDDB(tm) format CD text data files
@@ -3464,7 +3985,7 @@
#------------------------------------------------------------------------------
-# $File: clarion,v 1.4 2009/09/19 16:28:08 christos Exp $
+# $File: clarion,v 1.5 2014/04/30 21:41:02 christos Exp $
# clarion: file(1) magic for # Clarion Personal/Professional Developer
# (v2 and above)
# From: Julien Blache <jb at jblache.org>
@@ -3479,7 +4000,7 @@
>2 leshort &0x0010 \b, compressed
>2 leshort &0x0040 \b, read only
# number of records
->5 lelong x \b, %ld records
+>5 lelong x \b, %d records
# Memo files
0 leshort 0x334d Clarion Developer (v2 and above) memo data
@@ -3491,7 +4012,7 @@
0 leshort 0x49e0 Clarion Developer (v2 and above) help data
#------------------------------------------------------------------------------
-# $File: claris,v 1.5 2009/09/19 16:28:08 christos Exp $
+# $File: claris,v 1.7 2014/06/03 19:17:27 christos Exp $
# claris: file(1) magic for claris
# "H. Nanosecond" <aldomel at ix.netcom.com>
# Claris Works a word processor, etc.
@@ -3502,16 +4023,16 @@
#*
#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
#null to byte 1000 octal
-514 string \377\377\377\377\000 Claris clip art?
->0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes.
-514 string \377\377\377\377\001 Claris clip art?
->0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes.
+514 string \377\377\377\377\000
+>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art
+514 string \377\377\377\377\001
+>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art
# Claris works files
# .cwk
0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document
# .plt
-0 string \020\341\000\000\010\010 Claris Works pallete files .plt
+0 string \020\341\000\000\010\010 Claris Works palette files .plt
# .msp a dictionary file I am not sure about this I have only one .msp file
0 string \002\271\262\000\040\002\000\164 Claris works dictionary
@@ -3538,7 +4059,7 @@
#./windows/claris/userd.spl: data
#------------------------------------------------------------------------------
-# $File: clipper,v 1.6 2009/09/19 16:28:08 christos Exp $
+# $File: clipper,v 1.7 2014/04/30 21:41:02 christos Exp $
# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper.
#
# XXX - what byte order does the Clipper use?
@@ -3573,7 +4094,7 @@
>20 short 0413 (demand paged)
>20 short 0443 (target shared library)
>12 long >0 not stripped
->22 short >0 - version %ld
+>22 short >0 - version %d
0 short 0577 CLIPPER COFF executable
>18 short&074000 000000 C1 R1
>18 short&074000 004000 C2 R1
@@ -3585,7 +4106,7 @@
>20 short 0413 (paged)
>20 short 0443 (target shared library)
>12 long >0 not stripped
->22 short >0 - version %ld
+>22 short >0 - version %d
>48 long&01 01 alignment trap enabled
>52 byte 1 -Ctnc
>52 byte 2 -Ctsw
@@ -3603,17 +4124,24 @@
4 string prof CLIPPER instruction profile
#------------------------------------------------------------------------------
-# $File: commands,v 1.39 2010/11/25 15:00:12 christos Exp $
+# $File: commands,v 1.50 2014/05/30 16:48:44 christos Exp $
# commands: file(1) magic for various shells and interpreters
#
#0 string/w : shell archive or script for antique kernel text
0 string/wt #!\ /bin/sh POSIX shell script text executable
!:mime text/x-shellscript
+0 string/wb #!\ /bin/sh POSIX shell script executable (binary data)
+!:mime text/x-shellscript
+
0 string/wt #!\ /bin/csh C shell script text executable
!:mime text/x-shellscript
+
# korn shell magic, sent by George Wu, gwu at clyde.att.com
0 string/wt #!\ /bin/ksh Korn shell script text executable
!:mime text/x-shellscript
+0 string/wb #!\ /bin/ksh Korn shell script executable (binary data)
+!:mime text/x-shellscript
+
0 string/wt #!\ /bin/tcsh Tenex C shell script text executable
!:mime text/x-shellscript
0 string/wt #!\ /usr/bin/tcsh Tenex C shell script text executable
@@ -3652,7 +4180,7 @@
!:mime text/x-awk
0 string/wt #!\ /usr/bin/awk awk script text executable
!:mime text/x-awk
-0 regex =^\\s*BEGIN\\s*[{] awk script text
+0 regex/4096 =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text
# AT&T Bell Labs' Plan 9 shell
0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable
@@ -3660,22 +4188,25 @@
# bash shell magic, from Peter Tobias (tobias at server.et-inf.fho-emden.de)
0 string/wt #!\ /bin/bash Bourne-Again shell script text executable
!:mime text/x-shellscript
+0 string/wb #!\ /bin/bash Bourne-Again shell script executable (binary data)
+!:mime text/x-shellscript
0 string/wt #!\ /usr/bin/bash Bourne-Again shell script text executable
!:mime text/x-shellscript
+0 string/wb #!\ /usr/bin/bash Bourne-Again shell script executable (binary data)
+!:mime text/x-shellscript
0 string/wt #!\ /usr/local/bash Bourne-Again shell script text executable
!:mime text/x-shellscript
+0 string/wb #!\ /usr/local/bash Bourne-Again shell script executable (binary data)
+!:mime text/x-shellscript
0 string/wt #!\ /usr/local/bin/bash Bourne-Again shell script text executable
!:mime text/x-shellscript
+0 string/wb #!\ /usr/local/bin/bash Bourne-Again shell script executable (binary data)
+!:mime text/x-shellscript
-# using env
-0 string/t #!/usr/bin/env a
->15 string/t >\0 %s script text executable
-0 string/t #!\ /usr/bin/env a
->16 string/t >\0 %s script text executable
-
# PHP scripts
# Ulf Harnhammar <ulfh at update.uu.se>
0 search/1/c =<?php PHP script text
+!:strength + 10
!:mime text/x-php
0 search/1 =<?\n PHP script text
!:mime text/x-php
@@ -3682,18 +4213,25 @@
0 search/1 =<?\r PHP script text
!:mime text/x-php
0 search/1/w #!\ /usr/local/bin/php PHP script text executable
+!:strength + 10
!:mime text/x-php
0 search/1/w #!\ /usr/bin/php PHP script text executable
+!:strength + 10
!:mime text/x-php
+# Smarty compiled template, http://www.smarty.net/
+# Elan Ruusamae <glen at delfi.ee>
+0 string =<?php\ /*\ Smarty\ version Smarty compiled template
+>24 regex [0-9.]+ \b, version %s
+!:mime text/x-php
0 string Zend\x00 PHP script Zend Optimizer data
-0 string/t $! DCL command file
+0 string/t $! DCL command file
# Type: Pdmenu
# URL: http://packages.debian.org/pdmenu
# From: Edward Betts <edward at debian.org>
-0 string #!/usr/bin/pdmenu Pdmenu configuration file text
+0 string #!/usr/bin/pdmenu Pdmenu configuration file text
#----------------------------------------------------------------------------
# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $
@@ -3717,7 +4255,7 @@
0 string msc Message Sequence Chart (chart)
0 string submsc Message Sequence Chart (subchart)
#------------------------------------------------------------------------------
-# $File: compress,v 1.46 2010/09/20 19:19:17 rrt Exp $
+# $File: compress,v 1.58 2014/05/07 19:36:59 christos Exp $
# compress: file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
@@ -3740,6 +4278,7 @@
# other than 8 ("deflate", the only method defined in RFC 1952).
0 string \037\213 gzip compressed data
!:mime application/x-gzip
+!:strength * 2
>2 byte <8 \b, reserved method
>2 byte >8 \b, unknown method
>3 byte &0x01 \b, ASCII
@@ -3748,6 +4287,10 @@
>3 byte&0xC =0x08
>>10 string x \b, was "%s"
>3 byte &0x10 \b, has comment
+>3 byte &0x20 \b, encrypted
+>4 ledate >0 \b, last modified: %s
+>8 byte 2 \b, max compression
+>8 byte 4 \b, max speed
>9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT)
>9 byte =0x01 \b, from Amiga
>9 byte =0x02 \b, from VMS
@@ -3762,11 +4305,6 @@
>9 byte =0x0B \b, from NTFS filesystem (NT)
>9 byte =0x0C \b, from QDOS
>9 byte =0x0D \b, from Acorn RISCOS
->3 byte &0x10 \b, comment
->3 byte &0x20 \b, encrypted
->4 ledate >0 \b, last modified: %s
->8 byte 2 \b, max compression
->8 byte 4 \b, max speed
# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
0 string \037\036 packed data
@@ -3908,15 +4446,34 @@
!:mime application/x-7z-compressed
# Type: LZMA
-0 lelong 0x8000005d LZMA compressed data,
->5 lequad =0xffffffffffffffff streamed
->5 lequad !0xffffffffffffffff non-streamed, size %lld
+0 lelong&0xffffff =0x5d
+>12 leshort 0xff LZMA compressed data,
!:mime application/x-lzma
+>>5 lequad =0xffffffffffffffff streamed
+>>5 lequad !0xffffffffffffffff non-streamed, size %lld
+>12 leshort 0 LZMA compressed data,
+>>5 lequad =0xffffffffffffffff streamed
+>>5 lequad !0xffffffffffffffff non-streamed, size %lld
# http://tukaani.org/xz/xz-file-format.txt
0 ustring \xFD7zXZ\x00 XZ compressed data
!:mime application/x-xz
+# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt
+0 string LRZI LRZIP compressed data
+>4 byte x - version %d
+>5 byte x \b.%d
+!:mime application/x-lrzip
+
+# http://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html
+0 lelong 0x184d2204 LZ4 compressed data (v1.4+)
+!:mime application/x-lz4
+# Added by osm0sis at xda-developers.com
+0 lelong 0x184c2103 LZ4 compressed data (v1.0-v1.3)
+!:mime application/x-lz4
+0 lelong 0x184c2102 LZ4 compressed data (v0.1-v0.9)
+!:mime application/x-lz4
+
# AFX compressed files (Wolfram Kleff)
2 string -afx- AFX compressed file data
@@ -3931,11 +4488,6 @@
>5 byte x \b.%d
>6 belong x (%d bytes)
-# Type: XZ
-# URL: http://tukaani.org/xz/
-0 string \xfd\x37\x7a\x58\x5a\x00 XZ compressed data
-!:mime application/x-xz
-
0 string ArC\x01 FreeArc archive <http://freearc.org>
# Type: DACT compressed files
@@ -3946,8 +4498,18 @@
>7 long >0 , original size: %i bytes
>15 long >30 , block size: %i bytes
+# Valve Pack (VPK) files
+0 lelong 0x55aa1234 Valve Pak file
+>0x4 lelong x \b, version %u
+>0x8 lelong x \b, %u entries
+
+# Snappy framing format
+# http://code.google.com/p/snappy/source/browse/trunk/framing_format.txt
+0 string \377\006\0\0sNaPpY snappy framed data
+!:mime application/x-snappy-framed
+
#------------------------------------------------------------------------------
-# $File: console,v 1.18 2010/09/20 19:19:17 rrt Exp $
+# $File: console,v 1.19 2013/02/06 14:18:52 christos Exp $
# Console game magic
# Toby Deshane <hac at shoelace.digivill.net>
# ines: file(1) magic for Marat's iNES Nintendo Entertainment System
@@ -4084,7 +4646,7 @@
>113 string x (%s)
#------------------------------------------------------------------------------
-# Microsoft Xbox executables .xbe (Esa Hyytiä <ehyytia at cc.hut.fi>)
+# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia at cc.hut.fi>)
0 string XBEH XBE, Microsoft Xbox executable
# probabilistic checks whether signed or not
>0x0004 ulelong =0x0
@@ -4124,7 +4686,7 @@
# From: Serge van den Boom <svdb at stack.nl>
0 string \x01ZZZZZ\x01 3DO "Opera" file system
-# From Gürkan Sengün <gurkan at linuks.mine.nu>, www.linuks.mine.nu
+# From Gurkan Sengun <gurkan at linuks.mine.nu>, www.linuks.mine.nu
0 string GBS Nintendo Gameboy Music/Audio Data
12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module
@@ -4211,7 +4773,7 @@
>12 string >\0 "%s"
#------------------------------------------------------------------------------
-# $File: convex,v 1.7 2009/09/19 16:28:08 christos Exp $
+# $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $
# convex: file(1) magic for Convex boxes
#
# Convexes are big-endian.
@@ -4241,8 +4803,6 @@
# The restore program uses these number to determine how the data is
# to be extracted.
#
-24 belong =60011 dump format, 4.1 BSD or earlier
-24 belong =60012 dump format, 4.2 or 4.3 BSD without IDC
24 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible)
24 belong =60014 dump format, Convex Storage Manager by-reference dump
#
@@ -4301,7 +4861,94 @@
# From: Alexander Mai <mai at migdal.ikp.physik.tu-darmstadt.de>
0 search/1 =!_TAG Exuberant Ctags tag file text
+#--------------------------------------------------------------
+# ctf: file(1) magic for CTF (Common Trace Format) trace files
+#
+# Specs. available here: <http://www.efficios.com/ctf>
+#--------------------------------------------------------------
+
+# CTF trace data
+0 lelong 0xc1fc1fc1 Common Trace Format (CTF) trace data (LE)
+0 belong 0xc1fc1fc1 Common Trace Format (CTF) trace data (BE)
+
+# CTF metadata (packetized)
+0 lelong 0x75d11d57 Common Trace Format (CTF) packetized metadata (LE)
+>35 byte x \b, v%d
+>36 byte x \b.%d
+0 belong 0x75d11d57 Common Trace Format (CTF) packetized metadata (BE)
+>35 byte x \b, v%d
+>36 byte x \b.%d
+
+# CTF metadata (plain text)
+0 string /*\x20CTF\x20 Common Trace Format (CTF) plain text metadata
+!:strength + 5 # this is to make sure we beat C
+>&0 regex [0-9]+\.[0-9]+ \b, v%s
+
#------------------------------------------------------------------------------
+# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $
+# file(1) magic(5) data for cubemaps Martin Erik Werner <martinerikwerner at gmail.com>
+#
+0 string ACMP Map file for the AssaultCube FPS game
+0 string CUBE Map file for cube and cube2 engine games
+0 string MAPZ) Map file for the Blood Frontier/Red Eclipse FPS games
+
+#------------------------------------------------------------------------------
+# $File: cups,v 1.3 2014/05/28 19:50:41 christos Exp $
+# Cups: file(1) magic for the cups raster file format
+# From: Laurent Martelli <martellilaurent at gmail.com>
+# http://www.cups.org/documentation.php/spec-raster.html
+#
+
+0 name cups-le
+>280 lelong x \b, %d
+>284 lelong x \bx%d dpi
+>376 lelong x \b, %dx
+>380 lelong x \b%d pixels
+>388 lelong x %d bits/color
+>392 lelong x %d bits/pixel
+>400 lelong 0 ColorOrder=Chunky
+>400 lelong 1 ColorOrder=Banded
+>400 lelong 2 ColorOrder=Planar
+>404 lelong 0 ColorSpace=gray
+>404 lelong 1 ColorSpace=RGB
+>404 lelong 2 ColorSpace=RGBA
+>404 lelong 3 ColorSpace=black
+>404 lelong 4 ColorSpace=CMY
+>404 lelong 5 ColorSpace=YMC
+>404 lelong 6 ColorSpace=CMYK
+>404 lelong 7 ColorSpace=YMCK
+>404 lelong 8 ColorSpace=KCMY
+>404 lelong 9 ColorSpace=KCMYcm
+>404 lelong 10 ColorSpace=GMCK
+>404 lelong 11 ColorSpace=GMCS
+>404 lelong 12 ColorSpace=WHITE
+>404 lelong 13 ColorSpace=GOLD
+>404 lelong 14 ColorSpace=SILVER
+>404 lelong 15 ColorSpace=CIE XYZ
+>404 lelong 16 ColorSpace=CIE Lab
+>404 lelong 17 ColorSpace=RGBW
+>404 lelong 18 ColorSpace=sGray
+>404 lelong 19 ColorSpace=sRGB
+>404 lelong 20 ColorSpace=AdobeRGB
+
+# Cups Raster image format, Big Endian
+0 string RaS
+>3 string t Cups Raster version 1, Big Endian
+>3 string 2 Cups Raster version 2, Big Endian
+>3 string 3 Cups Raster version 3, Big Endian
+!:mime application/vnd.cups-raster
+>0 use ^cups-le
+
+
+# Cups Raster image format, Little Endian
+1 string SaR
+>0 string t Cups Raster version 1, Little Endian
+>0 string 2 Cups Raster version 2, Little Endian
+>0 string 3 Cups Raster version 3, Little Endian
+!:mime application/vnd.cups-raster
+>0 use cups-le
+
+#------------------------------------------------------------------------------
# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $
# dact: file(1) magic for DACT compressed files
#
@@ -4313,7 +4960,7 @@
>15 long >30 $BS, block size: %i bytes
#------------------------------------------------------------------------------
-# $File: database,v 1.26 2010/12/26 23:10:59 christos Exp $
+# $File: database,v 1.41 2014/06/03 19:17:27 christos Exp $
# database: file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw at ee.surrey.ac.uk)
@@ -4397,8 +5044,32 @@
#
#
# Round Robin Database Tool by Tobias Oetiker <oetiker at ee.ethz.ch>
-0 string RRD RRDTool DB
->4 string x version %s
+0 string/b RRD\0 RRDTool DB
+>4 string/b x version %s
+
+>>10 short !0 16bit aligned
+>>>10 bedouble 8.642135e+130 big-endian
+>>>>18 short x 32bit long (m68k)
+
+>>10 short 0
+>>>12 long !0 32bit aligned
+>>>>12 bedouble 8.642135e+130 big-endian
+>>>>>20 long 0 64bit long
+>>>>>20 long !0 32bit long
+>>>>12 ledouble 8.642135e+130 little-endian
+>>>>>24 long 0 64bit long
+>>>>>24 long !0 32bit long (i386)
+>>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian
+>>>>>24 short !0 32bit long (arm)
+
+>>8 quad 0 64bit aligned
+>>>16 bedouble 8.642135e+130 big-endian
+>>>>24 long 0 64bit long (s390x)
+>>>>24 long !0 32bit long (hppa/mips/ppc/s390/SPARC)
+>>>16 ledouble 8.642135e+130 little-endian
+>>>>28 long 0 64bit long (alpha/amd64/ia64)
+>>>>28 long !0 32bit long (armel/mipsel)
+
#----------------------------------------------------------------------
# ROOT: file(1) magic for ROOT databases
#
@@ -4427,95 +5098,271 @@
#>>>0x04 byte 8 incrementing secondary index .XGn file
## XBase database files
-#0 byte 0x02
-#>8 leshort >0
-#>>12 leshort 0 FoxBase
-#!:mime application/x-dbf
-#>>>0x04 lelong 0 (no records)
-#>>>0x04 lelong >0 (%ld records)
+# updated by Joerg Jenderek at Feb 2013
+# http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
+# http://www.clicketyclick.dk/databases/xbase/format/dbf.html
+# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm
+# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
+0 ubelong&0x0000FFFF <0x00000C20
+# skip Infocom game Z-machine
+>2 ubyte >0
+# skip Androids *.xml
+>>3 ubyte >0
+>>>3 ubyte <32
+# 1 < version VV
+>>>>0 ubyte >1
+# skip HELP.CA3 by test for reserved byte ( NULL )
+>>>>>27 ubyte 0
+# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
+#>>>>>30 ubeshort x 30NULL?%x
+# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
+>>>>>>24 ubelong&0xffFFFFff >0x01302000
+# .DBF or .MDX
+>>>>>>24 ubelong&0xffFFFFff <0x01302001
+# for Xbase Database file (*.DBF) reserved (NULL) for multi-user
+>>>>>>>24 ubelong&0xffFFFFff =0
+# test for 2 reserved NULL bytes,transaction and encryption byte flag
+>>>>>>>>12 ubelong&0xFFFFfEfE 0
+# test for MDX flag
+>>>>>>>>>28 ubyte x
+>>>>>>>>>28 ubyte&0xf8 0
+# header size >= 32
+>>>>>>>>>>8 uleshort >31
+# skip PIC15736.PCX by test for language driver name or field name
+>>>>>>>>>>>32 ubyte >0
+#!:mime application/x-dbf; charset=unknown-8bit ??
+#!:mime application/x-dbase
+>>>>>>>>>>>>0 use xbase-type
+# database file
+>>>>>>>>>>>>0 ubyte x \b DBF
+>>>>>>>>>>>>4 lelong 0 \b, no records
+>>>>>>>>>>>>4 lelong >0 \b, %d record
+# plural s appended
+>>>>>>>>>>>>>4 lelong >1 \bs
+# http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
+# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000)
+>>>>>>>>>>>>10 uleshort x * %d
+# file size = records * record size + header size
+>>>>>>>>>>>>1 ubyte x \b, update-date
+>>>>>>>>>>>>1 use xbase-date
+# http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
+#>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x
+# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ?
+>>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x
+#>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file
+>>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX
+>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT
+>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer
+# 1st record offset + 1 = header size
+>>>>>>>>>>>>8 uleshort >0
+>>>>>>>>>>>>(8.s+1) ubyte >0
+>>>>>>>>>>>>>8 uleshort >0 \b, at offset %d
+>>>>>>>>>>>>>(8.s+1) ubyte >0
+>>>>>>>>>>>>>>&-1 string >\0 1st record "%s"
+# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL)
+>>>>>>>24 ubelong&0x0133f7ff >0
+# test for reserved NULL byte
+>>>>>>>>47 ubyte x
+# test for valid TAG key format (0x10 or 0)
+>>>>>>>>>559 ubyte&0xeF 0
+# test MM <= 12
+>>>>>>>>>45 ubeshort <0x0C20
+>>>>>>>>>>45 ubyte >0
+>>>>>>>>>>>46 ubyte <32
+>>>>>>>>>>>>46 ubyte >0
+#!:mime application/x-mdx
+>>>>>>>>>>>>>0 use xbase-type
+>>>>>>>>>>>>>0 ubyte x \b MDX
+>>>>>>>>>>>>>1 ubyte x \b, creation-date
+>>>>>>>>>>>>>1 use xbase-date
+>>>>>>>>>>>>>44 ubyte x \b, update-date
+>>>>>>>>>>>>>44 use xbase-date
+# No.of tags in use (1,2,5,12)
+>>>>>>>>>>>>>28 uleshort x \b, %d
+# No. of entries in tag (0x30)
+>>>>>>>>>>>>>25 ubyte x \b/%d tags
+# Length of tag
+>>>>>>>>>>>>>26 ubyte x * %d
+# 1st tag name_
+>>>>>>>>>>>>>548 string x \b, 1st tag "%.11s"
+# 2nd tag name
+#>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s"
#
-#0 byte 0x03
+# Print the xBase names of different version variants
+0 name xbase-type
+>0 ubyte <2
+# 1 < version
+>0 ubyte >1
+>>0 ubyte 0x02 FoxBase
+# FoxBase+/dBaseIII+, no memo
+>>0 ubyte 0x03 FoxBase+/dBase III
+!:mime application/x-dbf
+# dBASE IV no memo file
+>>0 ubyte 0x04 dBase IV
+!:mime application/x-dbf
+# dBASE V no memo file
+>>0 ubyte 0x05 dBase V
+!:mime application/x-dbf
+>>0 ubyte 0x30 Visual FoxPro
+!:mime application/x-dbf
+>>0 ubyte 0x31 Visual FoxPro, autoincrement
+!:mime application/x-dbf
+# Visual FoxPro, with field type Varchar or Varbinary
+>>0 ubyte 0x32 Visual FoxPro, with field type Varchar
+!:mime application/x-dbf
+# dBASE IV SQL, no memo;dbv memo var size (Flagship)
+>>0 ubyte 0x43 dBase IV, with SQL table
+!:mime application/x-dbf
+# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
+#>>0 ubyte 0x62 dBase IV, with SQL table
#!:mime application/x-dbf
-#>8 leshort >0
-#>>12 leshort 0 FoxBase+, FoxPro, dBaseIII+, dBaseIV, no memo
-#>>>0x04 lelong 0 (no records)
-#>>>0x04 lelong >0 (%ld records)
-#
-#0 byte 0x04
+# dBASE IV, with memo!!
+>>0 ubyte 0x7b dBase IV, with memo
+!:mime application/x-dbf
+# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
+#>>0 ubyte 0x82 dBase IV, with SQL system
#!:mime application/x-dbf
-#>8 leshort >0
-#>>12 leshort 0 dBASE IV no memo file
-#>>>0x04 lelong 0 (no records)
-#>>>0x04 lelong >0 (%ld records)
-#
-#0 byte 0x05
+# FoxBase+/dBaseIII+ with memo .DBT!
+>>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT
+!:mime application/x-dbf
+# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file
+>>0 ubyte 0x87 VISUAL OBJECTS, with memo file
+!:mime application/x-dbf
+# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
+#>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT
#!:mime application/x-dbf
-#>8 leshort >0
-#>>12 leshort 0 dBASE V no memo file
-#>>>0x04 lelong 0 (no records)
-#>>>0x04 lelong >0 (%ld records)
-#
-#0 byte 0x30
+# dBASE IV with memo!
+>>0 ubyte 0x8B dBase IV, with memo .DBT
+!:mime application/x-dbf
+# dBase IV with SQL Table,no memo?
+>>0 ubyte 0x8E dBase IV, with SQL table
+!:mime application/x-dbf
+# .dbv and .dbt memo (Flagship)?
+>>0 ubyte 0xB3 Flagship
+# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
+#>>0 ubyte 0xCA dBase IV with memo .DBT
#!:mime application/x-dbf
-#>8 leshort >0
-#>>12 leshort 0 Visual FoxPro
-#>>>0x04 lelong 0 (no records)
-#>>>0x04 lelong >0 (%ld records)
-#
-#0 byte 0x43
+# dBASE IV with SQL table, with memo .DBT
+>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT
+!:mime application/x-dbf
+# HiPer-Six format;Clipper SIX, with SMT memo file
+>>0 ubyte 0xE5 Clipper SIX with memo
+!:mime application/x-dbf
+# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
+#>>0 ubyte 0xF4 dBase IV, with SQL table, with memo
#!:mime application/x-dbf
-#>8 leshort >0
-#>>12 leshort 0 FlagShip with memo var size
-#>>>0x04 lelong 0 (no records)
-#>>>0x04 lelong >0 (%ld records)
-#
-#0 byte 0x7b
+>>0 ubyte 0xF5 FoxPro with memo
+!:mime application/x-dbf
+# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
+#>>0 ubyte 0xFA FoxPro 2.x, with memo
#!:mime application/x-dbf
-#>8 leshort >0
-#>>12 leshort 0 dBASEIV with memo
-#>>>0x04 lelong 0 (no records)
-#>>>0x04 lelong >0 (%ld records)
-#
-#0 byte 0x83
-#!:mime application/x-dbf
-#>8 leshort >0
-#>>12 leshort 0 FoxBase+, dBaseIII+ with memo
-#>>>0x04 lelong 0 (no records)
-#>>>0x04 lelong >0 (%ld records)
-#
-#0 byte 0x8b
-#!:mime application/x-dbf
-#>8 leshort >0
-#>>12 leshort 0 dBaseIV with memo
-#>>>0x04 lelong 0 (no records)
-#>>>0x04 lelong >0 (%ld records)
-#
-#0 byte 0x8e
-#!:mime application/x-dbf
-#>8 leshort >0
-#>>12 leshort 0 dBaseIV with SQL Table
-#>>>0x04 lelong 0 (no records)
-#>>>0x04 lelong >0 (%ld records)
-#
-#0 byte 0xb3
-#!:mime application/x-dbf
-#>8 leshort >0
-#>>12 leshort 0 FlagShip with .dbt memo
-#>>>0x04 lelong 0 (no records)
-#>>>0x04 lelong >0 (%ld records)
-#
-#0 byte 0xf5
-#!:mime application/x-dbf
-#>8 leshort >0
-#>>12 leshort 0 FoxPro with memo
-#>>>0x04 lelong 0 (no records)
-#>>>0x04 lelong >0 (%ld records)
-#
-#0 leshort 0x0006 DBase 3 index file
+# unknown version (should not happen)
+>>0 default x xBase
+!:mime application/x-dbf
+>>>0 ubyte x (0x%x)
+# flags in version byte
+# DBT flag (with dBASE III memo .DBT)!!
+# >>0 ubyte&0x80 >0 DBT_FLAG=%x
+# memo flag ??
+# >>0 ubyte&0x08 >0 MEMO_FLAG=%x
+# SQL flag ??
+# >>0 ubyte&0x70 >0 SQL_FLAG=%x
+# test and print the date of xBase .DBF .MDX
+0 name xbase-date
+# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
+>0 ubelong x
+>1 ubyte <13
+>>1 ubyte >0
+>>>2 ubyte >0
+>>>>2 ubyte <32
+>>>>>0 ubyte x
+# YY is interpreted as 20YY or 19YY
+>>>>>>0 ubyte <100 \b %.2d
+# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
+>>>>>>0 ubyte >99 \b %d
+>>>>>1 ubyte x \b-%d
+>>>>>2 ubyte x \b-%d
+# dBase memo files .DBT or .FPT
+# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
+16 ubyte <4
+>16 ubyte !2
+>>16 ubyte !1
+# next free block index is positive
+>>>0 ulelong >0
+# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
+>>>>17 ubelong&0xFFfdFE00 0x00000000
+# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
+>>>>>20 ubelong&0xFF01209B 0x00000000
+# dBASE III
+>>>>>>16 ubyte 3
+# dBASE III DBT
+>>>>>>>0 use xbase-memo-print
+# dBASE IV DBT , FoxPro FPT or many PNG , ZIP , DBF garbage
+>>>>>>16 ubyte 0
+# dBASE IV DBT with DBF name or DBF garbage
+>>>>>>>8 ubelong >0x40000000
+# skip DBF and catch dBASE IV DBT with DBF name and with non big index of next free block
+>>>>>>>>0 ulelong <0x01010002
+>>>>>>>>>0 use xbase-memo-print
+>>>>>>>8 ubelong 0
+# skip MM*DD*.bin by test for for reserved NULL byte
+>>>>>>>>508 ubelong 0
+# real memo files should contain text here
+>>>>>>>>>520 ubelong >0x20202019
+>>>>>>>>>>520 ubelong <0xFEFEFEFF
+>>>>>>>>>>>0 use xbase-memo-print
+# garbage PCX , ZIP , JAR , XPI
+>>>>>>>8 default x
+
+# Print the information of dBase DBT or FoxPro FPT memo files
+0 name xbase-memo-print
+>0 ubyte x
+# test version
+# memo file
+>>16 ubyte 3 dBase III DBT
+>>16 ubyte 0
+>>>512 ubelong <0x00000003 FoxPro FPT
+# Size of blocks for FoxPro
+>>>>6 ubeshort x \b, blocks size %u
+# Number of next available block for appending data for FoxPro
+>>>>0 ubelong =0 \b, next free block index %u
+>>>>0 ubelong !0 \b, next free block index %u
+>>>512 default x dBase IV DBT
+# DBF file name without extension
+>>>>8 string >\0 \b of %-.8s.DBF
+# size of blocks ; not reliable 0x2020204C
+#>>>>4 ulelong =0 \b, blocks size %u
+>>>>4 ulelong !0 \b, blocks size %u
+# Block length found 0 , 512
+#>>>>20 uleshort =0 \b, block length %u
+>>>>20 uleshort !0 \b, block length %u
+# Number of next available block for appending data
+>>>>0 ulelong =0 \b, next free block index %u
+>>>>0 ulelong !0 \b, next free block index %u
+>>512 ubelong x
+>>>512 ubelong =0xFFFF0800
+>>>>520 string >\0 \b, 1st used item "%s"
+# FoxPro
+>>>512 ubelong <3
+# FoxPro memo
+>>>>512 ubelong =1
+>>>>520 string >\0 \b, 1st used item "%s"
+>>>512 default x
+# may be deleted memo field
+>>>>512 string >\0 \b, 1st item "%s"
+
+# TODO:
+# DBASE index file *.NDX
+# DBASE Compound Index file *.CDX
+# dBASE IV Printer Driver *.PRF
+## End of XBase database stuff
+
# MS Access database
4 string Standard\ Jet\ DB Microsoft Access Database
!:mime application/x-msaccess
+4 string Standard\ ACE\ DB Microsoft Access Database
+!:mime application/x-msaccess
# TDB database from Samba et al - Martin Pool <mbp at samba.org>
0 string TDB\ file TDB database
@@ -4582,14 +5429,6 @@
>48 lequad x \b, rnum=%lld
>56 lequad x \b, fsiz=%lld
-# G-IR database made by gobject-introspect toolset,
-# http://live.gnome.org/GObjectIntrospection
-0 string GOBJ\nMETADATA\r\n\032 G-IR binary database
->16 byte x \b, v%d
->17 byte x \b.%d
->20 leshort x \b, %d entries
->22 leshort x \b/%d local
-
# Type: QDBM Quick Database Manager
# From: Benoit Sibaud <bsibaud at april.org>
0 string \\[depot\\]\n\f Quick Database Manager, little endian
@@ -4601,6 +5440,15 @@
0 string ToKyO\ CaBiNeT\n TokyoCabinet database
>14 string x (version %s)
+# From: Stephane Blondon http://www.yaal.fr
+# Database file for Zope (done by FileStorage)
+0 string FS21 Zope Object Database File Storage (data)
+# Cache file for the database of Zope (done by ClientStorage)
+0 string ZEC3 Zope Object Database Client Cache File (data)
+
+# IDA (Interactive Disassembler) database
+0 string IDA1 IDA (Interactive Disassembler) database
+
#------------------------------------------------------------------------------
# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $
# diamond: file(1) magic for Diamond system
@@ -4614,7 +5462,7 @@
0 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document
#------------------------------------------------------------------------------
-# $File: diff,v 1.12 2010/12/07 16:52:52 christos Exp $
+# $File: diff,v 1.14 2012/09/16 23:08:54 christos Exp $
# diff: file(1) magic for diff(1) output
#
0 search/1 diff\ diff output text
@@ -4630,7 +5478,7 @@
!:mime text/x-diff
# bsdiff: file(1) magic for bsdiff(1) output
-0 string/t BSDIFF40 bsdiff(1) patch file
+0 string/b BSDIFF40 bsdiff(1) patch file
# unified diff
@@ -4642,29 +5490,54 @@
!:mime text/x-diff
!:strength + 90
+# librsync -- the library for network deltas
+#
+# Copyright (C) 2001 by Martin Pool. You may do whatever you want with
+# this file.
+#
+0 belong 0x72730236 rdiff network-delta data
+
+0 belong 0x72730136 rdiff network-delta signature data
+>4 belong x (block length=%d,
+>8 belong x signature strength=%d)
+
#------------------------------------------------------------------------------
-# $File: digital,v 1.8 2009/09/19 16:28:08 christos Exp $
+# $File: digital,v 1.11 2013/01/11 16:45:23 christos Exp $
# Digital UNIX - Info
#
0 string =!<arch>\n________64E Alpha archive
>22 string X -- out of date
#
-# Alpha COFF Based Executables
-# The stripped stuff really needs to be an 8 byte (64 bit) compare,
-# but this works
-0 leshort 0x183 COFF format alpha
->22 leshort&020000 &010000 sharable library,
->22 leshort&020000 ^010000 dynamically linked,
->24 leshort 0410 pure
->24 leshort 0413 demand paged
->8 lelong >0 executable or object module, not stripped
->8 lelong 0
->>12 lelong 0 executable or object module, stripped
->>12 lelong >0 executable or object module, not stripped
->27 byte >0 - version %d.
->26 byte >0 %d-
->28 leshort >0 %d
+
+0 leshort 0603
+>24 leshort 0410 COFF format alpha pure
+>24 leshort 0413 COFF format alpha demand paged
+>>22 leshort&030000 !020000 executable
+>>22 leshort&020000 !0 dynamically linked
+>>16 lelong !0 not stripped
+>>16 lelong 0 stripped
+>>27 byte x - version %d
+>>26 byte x \b.%d
+>>28 byte x \b-%d
+>24 leshort 0407 COFF format alpha object
+>>22 leshort&030000 020000 shared library
+>>27 byte x - version %d
+>>26 byte x \b.%d
+>>28 byte x \b-%d
+
+# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike at opac.bl.uk>
#
+# The actual magic number is just "Core", followed by a 2-byte version
+# number; however, treating any file that begins with "Core" as a Digital
+# UNIX core dump file may produce too many false hits, so we include one
+# byte of the version number as well; DU 5.0 appears only to be up to
+# version 2.
+#
+0 string Core\001 Alpha COFF format core dump (Digital UNIX)
+>24 string >\0 \b, from '%s'
+0 string Core\002 Alpha COFF format core dump (Digital UNIX)
+>24 string >\0 \b, from '%s'
+#
# The next is incomplete, we could tell more about this format,
# but its not worth it.
0 leshort 0x188 Alpha compressed COFF
@@ -4687,75 +5560,84 @@
>6 short 0x40 for Alpha
#------------------------------------------------------------------------------
-# $File: dolby,v 1.5 2009/09/19 16:28:08 christos Exp $
+# $File: dolby,v 1.7 2014/01/08 22:37:23 christos Exp $
# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka at gmx.at>
# from http://www.atsc.org/standards/a_52a.pdf
# corrections, additions, etc. are always welcome!
#
# syncword
-0 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream,
+0 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream,
+# Proposed audio/ac3 RFC/4184
+!:mime audio/vnd.dolby.dd-raw
# fscod
->4 byte&0xc0 0x00 48 kHz,
->4 byte&0xc0 0x40 44.1 kHz,
->4 byte&0xc0 0x80 32 kHz,
+>4 byte&0xc0 = 0x00 48 kHz,
+>4 byte&0xc0 = 0x40 44.1 kHz,
+>4 byte&0xc0 = 0x80 32 kHz,
# is this one used for 96 kHz?
->4 byte&0xc0 0xc0 reserved frequency,
+>4 byte&0xc0 = 0xc0 reserved frequency,
#
->5 byte&7 = 0 \b, complete main (CM)
->5 byte&7 = 1 \b, music and effects (ME)
->5 byte&7 = 2 \b, visually impaired (VI)
->5 byte&7 = 3 \b, hearing impaired (HI)
->5 byte&7 = 4 \b, dialogue (D)
->5 byte&7 = 5 \b, commentary (C)
->5 byte&7 = 6 \b, emergency (E)
+>5 byte&0x07 = 0x00 \b, complete main (CM)
+>5 byte&0x07 = 0x01 \b, music and effects (ME)
+>5 byte&0x07 = 0x02 \b, visually impaired (VI)
+>5 byte&0x07 = 0x03 \b, hearing impaired (HI)
+>5 byte&0x07 = 0x04 \b, dialogue (D)
+>5 byte&0x07 = 0x05 \b, commentary (C)
+>5 byte&0x07 = 0x06 \b, emergency (E)
+>5 beshort&0x07e0 0x0720 \b, voiceover (VO)
+>5 beshort&0x07e0 >0x0720 \b, karaoke
# acmod
->6 byte&0xe0 0x00 1+1 front,
->6 byte&0xe0 0x20 1 front/0 rear,
->6 byte&0xe0 0x40 2 front/0 rear,
->6 byte&0xe0 0x60 3 front/0 rear,
->6 byte&0xe0 0x80 2 front/1 rear,
->6 byte&0xe0 0xa0 3 front/1 rear,
->6 byte&0xe0 0xc0 2 front/2 rear,
->6 byte&0xe0 0xe0 3 front/2 rear,
-# lfeon (these may be incorrect)
->7 byte&0x40 0x00 LFE off,
->7 byte&0x40 0x40 LFE on,
+>6 byte&0xe0 = 0x00 1+1 front,
+>>6 byte&0x10 = 0x10 LFE on,
+>6 byte&0xe0 = 0x20 1 front/0 rear,
+>>6 byte&0x10 = 0x10 LFE on,
+>6 byte&0xe0 = 0x40 2 front/0 rear,
+# dsurmod (for stereo only)
+>>6 byte&0x18 = 0x00 Dolby Surround not indicated
+>>6 byte&0x18 = 0x08 not Dolby Surround encoded
+>>6 byte&0x18 = 0x10 Dolby Surround encoded
+>>6 byte&0x18 = 0x18 reserved Dolby Surround mode
+>>6 byte&0x04 = 0x04 LFE on,
+>6 byte&0xe0 = 0x60 3 front/0 rear,
+>>6 byte&0x04 = 0x04 LFE on,
+>6 byte&0xe0 = 0x80 2 front/1 rear,
+>>6 byte&0x04 = 0x04 LFE on,
+>6 byte&0xe0 = 0xa0 3 front/1 rear,
+>>6 byte&0x01 = 0x01 LFE on,
+>6 byte&0xe0 = 0xc0 2 front/2 rear,
+>>6 byte&0x04 = 0x04 LFE on,
+>6 byte&0xe0 = 0xe0 3 front/2 rear,
+>>6 byte&0x01 = 0x01 LFE on,
#
>4 byte&0x3e = 0x00 \b, 32 kbit/s
->4 byte&0x3e = 0x02 \b, 40 kbit/s
->4 byte&0x3e = 0x04 \b, 48 kbit/s
->4 byte&0x3e = 0x06 \b, 56 kbit/s
->4 byte&0x3e = 0x08 \b, 64 kbit/s
->4 byte&0x3e = 0x0a \b, 80 kbit/s
->4 byte&0x3e = 0x0c \b, 96 kbit/s
->4 byte&0x3e = 0x0e \b, 112 kbit/s
->4 byte&0x3e = 0x10 \b, 128 kbit/s
->4 byte&0x3e = 0x12 \b, 160 kbit/s
->4 byte&0x3e = 0x14 \b, 192 kbit/s
->4 byte&0x3e = 0x16 \b, 224 kbit/s
->4 byte&0x3e = 0x18 \b, 256 kbit/s
->4 byte&0x3e = 0x1a \b, 320 kbit/s
->4 byte&0x3e = 0x1c \b, 384 kbit/s
->4 byte&0x3e = 0x1e \b, 448 kbit/s
->4 byte&0x3e = 0x20 \b, 512 kbit/s
->4 byte&0x3e = 0x22 \b, 576 kbit/s
->4 byte&0x3e = 0x24 \b, 640 kbit/s
-# dsurmod (these may be incorrect)
->6 beshort&0x0180 0x0000 Dolby Surround not indicated
->6 beshort&0x0180 0x0080 not Dolby Surround encoded
->6 beshort&0x0180 0x0100 Dolby Surround encoded
->6 beshort&0x0180 0x0180 reserved Dolby Surround mode
+>4 byte&0x3e = 0x02 \b, 40 kbit/s
+>4 byte&0x3e = 0x04 \b, 48 kbit/s
+>4 byte&0x3e = 0x06 \b, 56 kbit/s
+>4 byte&0x3e = 0x08 \b, 64 kbit/s
+>4 byte&0x3e = 0x0a \b, 80 kbit/s
+>4 byte&0x3e = 0x0c \b, 96 kbit/s
+>4 byte&0x3e = 0x0e \b, 112 kbit/s
+>4 byte&0x3e = 0x10 \b, 128 kbit/s
+>4 byte&0x3e = 0x12 \b, 160 kbit/s
+>4 byte&0x3e = 0x14 \b, 192 kbit/s
+>4 byte&0x3e = 0x16 \b, 224 kbit/s
+>4 byte&0x3e = 0x18 \b, 256 kbit/s
+>4 byte&0x3e = 0x1a \b, 320 kbit/s
+>4 byte&0x3e = 0x1c \b, 384 kbit/s
+>4 byte&0x3e = 0x1e \b, 448 kbit/s
+>4 byte&0x3e = 0x20 \b, 512 kbit/s
+>4 byte&0x3e = 0x22 \b, 576 kbit/s
+>4 byte&0x3e = 0x24 \b, 640 kbit/s
#------------------------------------------------------------------------------
-# $File: dump,v 1.11 2009/09/19 16:28:09 christos Exp $
+# $File: dump,v 1.13 2014/04/30 21:41:02 christos Exp $
# dump: file(1) magic for dump file format--for new and old dump filesystems
#
# We specify both byte orders in order to recognize byte-swapped dumps.
#
-24 belong 60012 new-fs dump file (big endian),
+0 name new-dump-be
>4 bedate x Previous dump %s,
>8 bedate x This dump %s,
->12 belong >0 Volume %ld,
+>12 belong >0 Volume %d,
>692 belong 0 Level zero, type:
>692 belong >0 Level %d, type:
>0 belong 1 tape header,
@@ -4771,10 +5653,10 @@
>824 string >\0 Host %s,
>888 belong >0 Flags %x
-24 belong 60011 old-fs dump file (big endian),
+0 name old-dump-be
#>4 bedate x Previous dump %s,
#>8 bedate x This dump %s,
->12 belong >0 Volume %ld,
+>12 belong >0 Volume %d,
>692 belong 0 Level zero, type:
>692 belong >0 Level %d, type:
>0 belong 1 tape header,
@@ -4790,60 +5672,10 @@
>824 string >\0 Host %s,
>888 belong >0 Flags %x
-24 lelong 60012 new-fs dump file (little endian),
->4 ledate x This dump %s,
->8 ledate x Previous dump %s,
->12 lelong >0 Volume %ld,
->692 lelong 0 Level zero, type:
->692 lelong >0 Level %d, type:
->0 lelong 1 tape header,
->0 lelong 2 beginning of file record,
->0 lelong 3 map of inodes on tape,
->0 lelong 4 continuation of file record,
->0 lelong 5 end of volume,
->0 lelong 6 map of inodes deleted,
->0 lelong 7 end of medium (for floppy),
->676 string >\0 Label %s,
->696 string >\0 Filesystem %s,
->760 string >\0 Device %s,
->824 string >\0 Host %s,
->888 lelong >0 Flags %x
-
-24 lelong 60011 old-fs dump file (little endian),
-#>4 ledate x Previous dump %s,
-#>8 ledate x This dump %s,
->12 lelong >0 Volume %ld,
->692 lelong 0 Level zero, type:
->692 lelong >0 Level %d, type:
->0 lelong 1 tape header,
->0 lelong 2 beginning of file record,
->0 lelong 3 map of inodes on tape,
->0 lelong 4 continuation of file record,
->0 lelong 5 end of volume,
->0 lelong 6 map of inodes deleted,
->0 lelong 7 end of medium (for floppy),
->676 string >\0 Label %s,
->696 string >\0 Filesystem %s,
->760 string >\0 Device %s,
->824 string >\0 Host %s,
->888 lelong >0 Flags %x
-
-18 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness),
->2 medate x Previous dump %s,
->6 medate x This dump %s,
->10 leshort >0 Volume %ld,
->0 leshort 1 tape header.
->0 leshort 2 beginning of file record.
->0 leshort 3 map of inodes on tape.
->0 leshort 4 continuation of file record.
->0 leshort 5 end of volume.
->0 leshort 6 map of inodes deleted.
->0 leshort 7 end of medium (for floppy).
-
-24 belong 0x19540119 new-fs dump file (ufs2, big endian),
+0 name ufs2-dump-be
>896 beqdate x Previous dump %s,
>904 beqdate x This dump %s,
->12 belong >0 Volume %ld,
+>12 belong >0 Volume %d,
>692 belong 0 Level zero, type:
>692 belong >0 Level %d, type:
>0 belong 1 tape header,
@@ -4859,69 +5691,91 @@
>824 string >\0 Host %s,
>888 belong >0 Flags %x
-24 lelong 0x19540119 new-fs dump file (ufs2, little endian),
->896 leqdate x This dump %s,
->904 leqdate x Previous dump %s,
->12 lelong >0 Volume %ld,
->692 lelong 0 Level zero, type:
->692 lelong >0 Level %d, type:
->0 lelong 1 tape header,
->0 lelong 2 beginning of file record,
->0 lelong 3 map of inodes on tape,
->0 lelong 4 continuation of file record,
->0 lelong 5 end of volume,
->0 lelong 6 map of inodes deleted,
->0 lelong 7 end of medium (for floppy),
->676 string >\0 Label %s,
->696 string >\0 Filesystem %s,
->760 string >\0 Device %s,
->824 string >\0 Host %s,
->888 lelong >0 Flags %x
+24 belong 60012 new-fs dump file (big endian),
+>0 use new-dump-be
+24 belong 60011 old-fs dump file (big endian),
+>0 use old-dump-be
+
+24 lelong 60012 new-fs dump file (little endian),
+>0 use \^new-dump-be
+
+24 lelong 60011 old-fs dump file (little endian),
+>0 use \^old-dump-be
+
+
+24 belong 0x19540119 new-fs dump file (ufs2, big endian),
+>0 use ufs2-dump-be
+
+24 lelong 0x19540119 new-fs dump file (ufs2, little endian),
+>0 use \^ufs2-dump-be
+
+18 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness),
+>2 medate x Previous dump %s,
+>6 medate x This dump %s,
+>10 leshort >0 Volume %d,
+>0 leshort 1 tape header.
+>0 leshort 2 beginning of file record.
+>0 leshort 3 map of inodes on tape.
+>0 leshort 4 continuation of file record.
+>0 leshort 5 end of volume.
+>0 leshort 6 map of inodes deleted.
+>0 leshort 7 end of medium (for floppy).
+
#------------------------------------------------------------------------------
-# $File: dyadic,v 1.5 2010/09/20 18:55:20 rrt Exp $
+# $File: dyadic,v 1.6 2014/06/01 19:14:42 christos Exp $
# Dyadic: file(1) magic for Dyalog APL.
#
-0 byte 0xaa
->1 byte <4 Dyalog APL
->>1 byte 0x00 incomplete workspace
->>1 byte 0x01 component file
->>1 byte 0x02 external variable
->>1 byte 0x03 workspace
->>2 byte x version %d
->>3 byte x .%d
+# updated by Joerg Jenderek at Oct 2013
+# http://en.wikipedia.org/wiki/Dyalog_APL
+# http://www.dyalog.com/
+# .DXV Dyalog APL External Variable
+# .DIN Dyalog APL Input Table
+# .DOT Dyalog APL Output Table
+# .DFT Dyalog APL Format File
+0 ubeshort&0xFF60 0xaa00
+# skip biblio.dbt
+>1 byte !4
+# real Dyalog APL have non zero version numbers like 7.3 or 13.4
+>>2 ubeshort >0x0000 Dyalog APL
+>>>1 byte 0x00 aplcore
+#>>>1 byte 0x00 incomplete workspace
+# *.DCF Dyalog APL Component File
+>>>1 byte 0x01 component file 32-bit non-journaled non-checksummed
+#>>>1 byte 0x01 component file
+>>>1 byte 0x02 external variable exclusive
+#>>>1 byte 0x02 external variable
+# *.DWS Dyalog APL Workspace
+>>>1 byte 0x03 workspace
+>>>>7 byte&0x28 0x00 32-bit
+>>>>7 byte&0x28 0x20 64-bit
+>>>>7 byte&0x0c 0x00 classic
+>>>>7 byte&0x0c 0x04 unicode
+>>>>7 byte&0x88 0x00 big-endian
+>>>>7 byte&0x88 0x80 little-endian
+>>>1 byte 0x06 external variable shared
+# *.DSE Dyalog APL Session , *.DLF Dyalog APL Session Log File
+>>>1 byte 0x07 session
+>>>1 byte 0x08 mapped file 32-bit
+>>>1 byte 0x09 component file 64-bit non-journaled non-checksummed
+>>>1 byte 0x0a mapped file 64-bit
+>>>1 byte 0x0b component file 32-bit level 1 journaled non-checksummed
+>>>1 byte 0x0c component file 64-bit level 1 journaled non-checksummed
+>>>1 byte 0x0d component file 32-bit level 1 journaled checksummed
+>>>1 byte 0x0e component file 64-bit level 1 journaled checksummed
+>>>1 byte 0x0f component file 32-bit level 2 journaled checksummed
+>>>1 byte 0x10 component file 64-bit level 2 journaled checksummed
+>>>1 byte 0x11 component file 32-bit level 3 journaled checksummed
+>>>1 byte 0x12 component file 64-bit level 3 journaled checksummed
+>>>1 byte 0x13 component file 32-bit non-journaled checksummed
+>>>1 byte 0x14 component file 64-bit non-journaled checksummed
+>>>1 byte 0x80 DDB
+>>>2 byte x version %d
+>>>3 byte x \b.%d
+#>>>2 byte x type %d
+#>>>3 byte x subtype %d
-0 beshort 0xaa03 Dyalog APL
->2 byte x workspace type %d
->3 byte x subtype %d
->7 byte&0x28 0x00 32-bit
->7 byte&0x28 0x20 64-bit
->7 byte&0x0c 0x00 classic
->7 byte&0x0c 0x04 unicode
->7 byte&0x88 0x00 big-endian
->7 byte&0x88 0x80 little-endian
-
-0 byte 0xaa Dyalog APL
->1 byte 0x00 aplcore
->1 byte 0x01 component file 32-bit non-journaled non-checksummed
->1 byte 0x02 external variable exclusive
->1 byte 0x06 external variable shared
->1 byte 0x07 session
->1 byte 0x08 mapped file 32-bit
->1 byte 0x09 component file 64-bit non-journaled non-checksummed
->1 byte 0x0a mapped file 64-bit
->1 byte 0x0b component file 32-bit level 1 journaled non-checksummed
->1 byte 0x0c component file 64-bit level 1 journaled non-checksummed
->1 byte 0x0d component file 32-bit level 1 journaled checksummed
->1 byte 0x0e component file 64-bit level 1 journaled checksummed
->1 byte 0x0f component file 32-bit level 2 journaled checksummed
->1 byte 0x10 component file 64-bit level 2 journaled checksummed
->1 byte 0x11 component file 32-bit level 3 journaled checksummed
->1 byte 0x12 component file 64-bit level 3 journaled checksummed
->1 byte 0x13 component file 32-bit non-journaled checksummed
->1 byte 0x14 component file 64-bit non-journaled checksummed
->1 byte 0x80 DDB
-
+# *.DXF Dyalog APL Transfer File
0 short 0x6060 Dyalog APL transfer
#------------------------------------------------------------------------------
@@ -4951,7 +5805,7 @@
>&0 string >\0 \b, version %s
#------------------------------------------------------------------------------
-# $File: efi,v 1.4 2009/09/19 16:28:09 christos Exp $
+# $File: efi,v 1.5 2014/04/30 21:41:02 christos Exp $
# efi: file(1) magic for Universal EFI binaries
0 lelong 0x0ef1fab9
@@ -4963,10 +5817,10 @@
>>&0 lelong 0x01000007 \b, x86_64
>>&20 lelong 7 \b, i386
>>&20 lelong 0x01000007 \b, x86_64
->4 lelong >2 Universal EFI binary with %ld architectures
+>4 lelong >2 Universal EFI binary with %d architectures
#------------------------------------------------------------------------------
-# $File: elf,v 1.53 2009/09/19 16:28:09 christos Exp $
+# $File: elf,v 1.67 2014/06/12 13:52:48 christos Exp $
# elf: file(1) magic for ELF executables
#
# We have to check the byte order flag to see what byte order all the
@@ -4980,257 +5834,292 @@
# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk at ds9.au.s.shuttle.de> (fix of core support)
# Modified by (4): <gerardo.cacciari at gmail.com> (VMS Itanium)
# Modified by (5): Matthias Urlichs <smurf at debian.org> (Listing of many architectures)
-0 string \177ELF ELF
->4 byte 0 invalid class
->4 byte 1 32-bit
->4 byte 2 64-bit
->5 byte 0 invalid byte order
->5 byte 1 LSB
->>16 leshort 0 no file type,
-!:strength *2
+
+0 name elf-le
+>16 leshort 0 no file type,
!:mime application/octet-stream
->>16 leshort 1 relocatable,
+>16 leshort 1 relocatable,
!:mime application/x-object
->>16 leshort 2 executable,
+>16 leshort 2 executable,
!:mime application/x-executable
->>16 leshort 3 shared object,
+>16 leshort 3 shared object,
!:mime application/x-sharedlib
->>16 leshort 4 core file
+>16 leshort 4 core file
!:mime application/x-coredump
# Core file detection is not reliable.
#>>>(0x38+0xcc) string >\0 of '%s'
#>>>(0x38+0x10) lelong >0 (signal %d),
->>16 leshort &0xff00 processor-specific,
->>18 leshort 0 no machine,
->>18 leshort 1 AT&T WE32100 - invalid byte order,
->>18 leshort 2 SPARC - invalid byte order,
->>18 leshort 3 Intel 80386,
->>18 leshort 4 Motorola
->>>36 lelong &0x01000000 68000 - invalid byte order,
->>>36 lelong &0x00810000 CPU32 - invalid byte order,
->>>36 lelong 0 68020 - invalid byte order,
->>18 leshort 5 Motorola 88000 - invalid byte order,
->>18 leshort 6 Intel 80486,
->>18 leshort 7 Intel 80860,
+>16 leshort &0xff00 processor-specific,
+>18 clear x
+>18 leshort 0 no machine,
+>18 leshort 1 AT&T WE32100,
+>18 leshort 2 SPARC,
+>18 leshort 3 Intel 80386,
+>18 leshort 4 Motorola m68k,
+>>4 byte 1
+>>>36 lelong &0x01000000 68000,
+>>>36 lelong &0x00810000 CPU32,
+>>>36 lelong 0 68020,
+>18 leshort 5 Motorola m88k,
+>18 leshort 6 Intel 80486,
+>18 leshort 7 Intel 80860,
# The official e_machine number for MIPS is now #8, regardless of endianness.
# The second number (#10) will be deprecated later. For now, we still
# say something if #10 is encountered, but only gory details for #8.
->>18 leshort 8 MIPS,
+>18 leshort 8 MIPS,
+>>4 byte 1
>>>36 lelong &0x20 N32
->>18 leshort 10 MIPS,
+>18 leshort 10 MIPS,
+>>4 byte 1
>>>36 lelong &0x20 N32
->>18 leshort 8
+>18 leshort 8
# only for 32-bit
->>>4 byte 1
->>>>36 lelong&0xf0000000 0x00000000 MIPS-I
->>>>36 lelong&0xf0000000 0x10000000 MIPS-II
->>>>36 lelong&0xf0000000 0x20000000 MIPS-III
->>>>36 lelong&0xf0000000 0x30000000 MIPS-IV
->>>>36 lelong&0xf0000000 0x40000000 MIPS-V
->>>>36 lelong&0xf0000000 0x50000000 MIPS32
->>>>36 lelong&0xf0000000 0x60000000 MIPS64
->>>>36 lelong&0xf0000000 0x70000000 MIPS32 rel2
->>>>36 lelong&0xf0000000 0x80000000 MIPS64 rel2
+>>4 byte 1
+>>>36 lelong&0xf0000000 0x00000000 MIPS-I
+>>>36 lelong&0xf0000000 0x10000000 MIPS-II
+>>>36 lelong&0xf0000000 0x20000000 MIPS-III
+>>>36 lelong&0xf0000000 0x30000000 MIPS-IV
+>>>36 lelong&0xf0000000 0x40000000 MIPS-V
+>>>36 lelong&0xf0000000 0x50000000 MIPS32
+>>>36 lelong&0xf0000000 0x60000000 MIPS64
+>>>36 lelong&0xf0000000 0x70000000 MIPS32 rel2
+>>>36 lelong&0xf0000000 0x80000000 MIPS64 rel2
# only for 64-bit
->>>4 byte 2
->>>>48 lelong&0xf0000000 0x00000000 MIPS-I
->>>>48 lelong&0xf0000000 0x10000000 MIPS-II
->>>>48 lelong&0xf0000000 0x20000000 MIPS-III
->>>>48 lelong&0xf0000000 0x30000000 MIPS-IV
->>>>48 lelong&0xf0000000 0x40000000 MIPS-V
->>>>48 lelong&0xf0000000 0x50000000 MIPS32
->>>>48 lelong&0xf0000000 0x60000000 MIPS64
->>>>48 lelong&0xf0000000 0x70000000 MIPS32 rel2
->>>>48 lelong&0xf0000000 0x80000000 MIPS64 rel2
->>18 leshort 9 Amdahl - invalid byte order,
->>18 leshort 10 MIPS (deprecated),
->>18 leshort 11 RS6000 - invalid byte order,
->>18 leshort 15 PA-RISC - invalid byte order,
+>>4 byte 2
+>>>48 lelong&0xf0000000 0x00000000 MIPS-I
+>>>48 lelong&0xf0000000 0x10000000 MIPS-II
+>>>48 lelong&0xf0000000 0x20000000 MIPS-III
+>>>48 lelong&0xf0000000 0x30000000 MIPS-IV
+>>>48 lelong&0xf0000000 0x40000000 MIPS-V
+>>>48 lelong&0xf0000000 0x50000000 MIPS32
+>>>48 lelong&0xf0000000 0x60000000 MIPS64
+>>>48 lelong&0xf0000000 0x70000000 MIPS32 rel2
+>>>48 lelong&0xf0000000 0x80000000 MIPS64 rel2
+>18 leshort 9 Amdahl,
+>18 leshort 10 MIPS (deprecated),
+>18 leshort 11 RS6000,
+>18 leshort 15 PA-RISC,
+# only for 32-bit
+>>4 byte 1
+>>>38 leshort 0x0214 2.0
+>>>36 leshort &0x0008 (LP64)
+# only for 64-bit
+>>4 byte 2
>>>50 leshort 0x0214 2.0
->>>48 leshort &0x0008 (LP64),
->>18 leshort 16 nCUBE,
->>18 leshort 17 Fujitsu VPP500,
->>18 leshort 18 SPARC32PLUS - invalid byte order,
->>18 leshort 20 PowerPC,
->>18 leshort 22 IBM S/390,
->>18 leshort 36 NEC V800,
->>18 leshort 37 Fujitsu FR20,
->>18 leshort 38 TRW RH-32,
->>18 leshort 39 Motorola RCE,
->>18 leshort 40 ARM,
->>18 leshort 41 Alpha,
->>18 leshort 0xa390 IBM S/390 (obsolete),
->>18 leshort 42 Renesas SH,
->>18 leshort 43 SPARC V9 - invalid byte order,
->>18 leshort 44 Siemens Tricore Embedded Processor,
->>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
->>18 leshort 46 Renesas H8/300,
->>18 leshort 47 Renesas H8/300H,
->>18 leshort 48 Renesas H8S,
->>18 leshort 49 Renesas H8/500,
->>18 leshort 50 IA-64,
->>18 leshort 51 Stanford MIPS-X,
->>18 leshort 52 Motorola Coldfire,
->>18 leshort 53 Motorola M68HC12,
->>18 leshort 54 Fujitsu MMA,
->>18 leshort 55 Siemens PCP,
->>18 leshort 56 Sony nCPU,
->>18 leshort 57 Denso NDR1,
->>18 leshort 58 Start*Core,
->>18 leshort 59 Toyota ME16,
->>18 leshort 60 ST100,
->>18 leshort 61 Tinyj emb.,
->>18 leshort 62 x86-64,
->>18 leshort 63 Sony DSP,
->>18 leshort 66 FX66,
->>18 leshort 67 ST9+ 8/16 bit,
->>18 leshort 68 ST7 8 bit,
->>18 leshort 69 MC68HC16,
->>18 leshort 70 MC68HC11,
->>18 leshort 71 MC68HC08,
->>18 leshort 72 MC68HC05,
->>18 leshort 73 SGI SVx,
->>18 leshort 74 ST19 8 bit,
->>18 leshort 75 Digital VAX,
->>18 leshort 76 Axis cris,
->>18 leshort 77 Infineon 32-bit embedded,
->>18 leshort 78 Element 14 64-bit DSP,
->>18 leshort 79 LSI Logic 16-bit DSP,
->>18 leshort 80 MMIX,
->>18 leshort 81 Harvard machine-independent,
->>18 leshort 82 SiTera Prism,
->>18 leshort 83 Atmel AVR 8-bit,
->>18 leshort 84 Fujitsu FR30,
->>18 leshort 85 Mitsubishi D10V,
->>18 leshort 86 Mitsubishi D30V,
->>18 leshort 87 NEC v850,
->>18 leshort 88 Renesas M32R,
->>18 leshort 89 Matsushita MN10300,
->>18 leshort 90 Matsushita MN10200,
->>18 leshort 91 picoJava,
->>18 leshort 92 OpenRISC,
->>18 leshort 93 ARC Cores Tangent-A5,
->>18 leshort 94 Tensilica Xtensa,
->>18 leshort 97 NatSemi 32k,
->>18 leshort 106 Analog Devices Blackfin,
->>18 leshort 113 Altera Nios II,
->>18 leshort 0xae META,
->>18 leshort 0x3426 OpenRISC (obsolete),
->>18 leshort 0x8472 OpenRISC (obsolete),
->>18 leshort 0x9026 Alpha (unofficial),
->>20 lelong 0 invalid version
->>20 lelong 1 version 1
->>36 lelong 1 MathCoPro/FPU/MAU Required
+>>>48 leshort &0x0008 (LP64)
+>18 leshort 16 nCUBE,
+>18 leshort 17 Fujitsu VPP500,
+>18 leshort 18 SPARC32PLUS,
+# only for 32-bit
+>>4 byte 1
+>>>36 lelong&0xffff00 0x000100 V8+ Required,
+>>>36 lelong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required,
+>>>36 lelong&0xffff00 0x000400 HaL R1 Extensions Required,
+>>>36 lelong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required,
+>18 leshort 19 Intel 80960,
+>18 leshort 20 PowerPC or cisco 4500,
+>18 leshort 21 64-bit PowerPC or cisco 7500,
+>18 leshort 22 IBM S/390,
+>18 leshort 23 Cell SPU,
+>18 leshort 24 cisco SVIP,
+>18 leshort 25 cisco 7200,
+>18 leshort 36 NEC V800 or cisco 12000,
+>18 leshort 37 Fujitsu FR20,
+>18 leshort 38 TRW RH-32,
+>18 leshort 39 Motorola RCE,
+>18 leshort 40 ARM,
+>>4 byte 1
+>>>36 lelong&0xff000000 0x04000000 EABI4
+>>>36 lelong&0xff000000 0x05000000 EABI5
+>>>36 lelong &0x00800000 BE8
+>>>36 lelong &0x00400000 LE8
+>18 leshort 41 Alpha,
+>18 leshort 42 Renesas SH,
+>18 leshort 43 SPARC V9,
+>>4 byte 2
+>>>48 lelong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required,
+>>>48 lelong&0xffff00 0x000400 HaL R1 Extensions Required,
+>>>48 lelong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required,
+>>>48 lelong&0x3 0 total store ordering,
+>>>48 lelong&0x3 1 partial store ordering,
+>>>48 lelong&0x3 2 relaxed memory ordering,
+>18 leshort 44 Siemens Tricore Embedded Processor,
+>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
+>18 leshort 46 Renesas H8/300,
+>18 leshort 47 Renesas H8/300H,
+>18 leshort 48 Renesas H8S,
+>18 leshort 49 Renesas H8/500,
+>18 leshort 50 IA-64,
+>18 leshort 51 Stanford MIPS-X,
+>18 leshort 52 Motorola Coldfire,
+>18 leshort 53 Motorola M68HC12,
+>18 leshort 54 Fujitsu MMA,
+>18 leshort 55 Siemens PCP,
+>18 leshort 56 Sony nCPU,
+>18 leshort 57 Denso NDR1,
+>18 leshort 58 Start*Core,
+>18 leshort 59 Toyota ME16,
+>18 leshort 60 ST100,
+>18 leshort 61 Tinyj emb.,
+>18 leshort 62 x86-64,
+>18 leshort 63 Sony DSP,
+>18 leshort 64 DEC PDP-10,
+>18 leshort 65 DEC PDP-11,
+>18 leshort 66 FX66,
+>18 leshort 67 ST9+ 8/16 bit,
+>18 leshort 68 ST7 8 bit,
+>18 leshort 69 MC68HC16,
+>18 leshort 70 MC68HC11,
+>18 leshort 71 MC68HC08,
+>18 leshort 72 MC68HC05,
+>18 leshort 73 SGI SVx or Cray NV1,
+>18 leshort 74 ST19 8 bit,
+>18 leshort 75 Digital VAX,
+>18 leshort 76 Axis cris,
+>18 leshort 77 Infineon 32-bit embedded,
+>18 leshort 78 Element 14 64-bit DSP,
+>18 leshort 79 LSI Logic 16-bit DSP,
+>18 leshort 80 MMIX,
+>18 leshort 81 Harvard machine-independent,
+>18 leshort 82 SiTera Prism,
+>18 leshort 83 Atmel AVR 8-bit,
+>18 leshort 84 Fujitsu FR30,
+>18 leshort 85 Mitsubishi D10V,
+>18 leshort 86 Mitsubishi D30V,
+>18 leshort 87 NEC v850,
+>18 leshort 88 Renesas M32R,
+>18 leshort 89 Matsushita MN10300,
+>18 leshort 90 Matsushita MN10200,
+>18 leshort 91 picoJava,
+>18 leshort 92 OpenRISC,
+>18 leshort 93 ARC Cores Tangent-A5,
+>18 leshort 94 Tensilica Xtensa,
+>18 leshort 95 Alphamosaic VideoCore,
+>18 leshort 96 Thompson Multimedia,
+>18 leshort 97 NatSemi 32k,
+>18 leshort 98 Tenor Network TPC,
+>18 leshort 99 Trebia SNP 1000,
+>18 leshort 100 STMicroelectronics ST200,
+>18 leshort 101 Ubicom IP2022,
+>18 leshort 102 MAX Processor,
+>18 leshort 103 NatSemi CompactRISC,
+>18 leshort 104 Fujitsu F2MC16,
+>18 leshort 105 TI msp430,
+>18 leshort 106 Analog Devices Blackfin,
+>18 leshort 107 S1C33 Family of Seiko Epson,
+>18 leshort 108 Sharp embedded,
+>18 leshort 109 Arca RISC,
+>18 leshort 110 PKU-Unity Ltd.,
+>18 leshort 111 eXcess: 16/32/64-bit,
+>18 leshort 112 Icera Deep Execution Processor,
+>18 leshort 113 Altera Nios II,
+>18 leshort 114 NatSemi CRX,
+>18 leshort 115 Motorola XGATE,
+>18 leshort 116 Infineon C16x/XC16x,
+>18 leshort 117 Renesas M16C series,
+>18 leshort 118 Microchip dsPIC30F,
+>18 leshort 119 Freescale RISC core,
+>18 leshort 120 Renesas M32C series,
+>18 leshort 131 Altium TSK3000 core,
+>18 leshort 132 Freescale RS08,
+>18 leshort 134 Cyan Technology eCOG2,
+>18 leshort 135 Sunplus S+core7 RISC,
+>18 leshort 136 New Japan Radio (NJR) 24-bit DSP,
+>18 leshort 137 Broadcom VideoCore III,
+>18 leshort 138 LatticeMico32,
+>18 leshort 139 Seiko Epson C17 family,
+>18 leshort 140 TI TMS320C6000 DSP family,
+>18 leshort 141 TI TMS320C2000 DSP family,
+>18 leshort 142 TI TMS320C55x DSP family,
+>18 leshort 160 STMicroelectronics 64bit VLIW DSP,
+>18 leshort 161 Cypress M8C,
+>18 leshort 162 Renesas R32C series,
+>18 leshort 163 NXP TriMedia family,
+>18 leshort 164 QUALCOMM DSP6,
+>18 leshort 165 Intel 8051 and variants,
+>18 leshort 166 STMicroelectronics STxP7x family,
+>18 leshort 167 Andes embedded RISC,
+>18 leshort 168 Cyan eCOG1X family,
+>18 leshort 169 Dallas MAXQ30,
+>18 leshort 170 New Japan Radio (NJR) 16-bit DSP,
+>18 leshort 171 M2000 Reconfigurable RISC,
+>18 leshort 172 Cray NV2 vector architecture,
+>18 leshort 173 Renesas RX family,
+>18 leshort 174 META,
+>18 leshort 175 MCST Elbrus,
+>18 leshort 176 Cyan Technology eCOG16 family,
+>18 leshort 177 NatSemi CompactRISC,
+>18 leshort 178 Freescale Extended Time Processing Unit,
+>18 leshort 179 Infineon SLE9X,
+>18 leshort 180 Intel L1OM,
+>18 leshort 181 Intel K1OM,
+>18 leshort 183 ARM aarch64,
+>18 leshort 185 Atmel 32-bit family,
+>18 leshort 186 STMicroeletronics STM8 8-bit,
+>18 leshort 187 Tilera TILE64,
+>18 leshort 188 Tilera TILEPro,
+>18 leshort 189 Xilinx MicroBlaze 32-bit RISC,
+>18 leshort 190 NVIDIA CUDA architecture,
+>18 leshort 191 Tilera TILE-Gx,
+>18 leshort 197 Renesas RL78 family,
+>18 leshort 199 Renesas 78K0R,
+>18 leshort 200 Freescale 56800EX,
+>18 leshort 201 Beyond BA1,
+>18 leshort 202 Beyond BA2,
+>18 leshort 203 XMOS xCORE,
+>18 leshort 204 Microchip 8-bit PIC(r),
+>18 leshort 210 KM211 KM32,
+>18 leshort 211 KM211 KMX32,
+>18 leshort 212 KM211 KMX16,
+>18 leshort 213 KM211 KMX8,
+>18 leshort 214 KM211 KVARC,
+>18 leshort 215 Paneve CDP,
+>18 leshort 216 Cognitive Smart Memory,
+>18 leshort 217 iCelero CoolEngine,
+>18 leshort 218 Nanoradio Optimized RISC,
+>18 leshort 0x1057 AVR (unofficial),
+>18 leshort 0x1059 MSP430 (unofficial),
+>18 leshort 0x1223 Adapteva Epiphany (unofficial),
+>18 leshort 0x2530 Morpho MT (unofficial),
+>18 leshort 0x3330 FR30 (unofficial),
+>18 leshort 0x3426 OpenRISC (obsolete),
+>18 leshort 0x4688 Infineon C166 (unofficial),
+>18 leshort 0x5441 Cygnus FRV (unofficial),
+>18 leshort 0x5aa5 DLX (unofficial),
+>18 leshort 0x7650 Cygnus D10V (unofficial),
+>18 leshort 0x7676 Cygnus D30V (unofficial),
+>18 leshort 0x8217 Ubicom IP2xxx (unofficial),
+>18 leshort 0x8472 OpenRISC (obsolete),
+>18 leshort 0x9025 Cygnus PowerPC (unofficial),
+>18 leshort 0x9026 Alpha (unofficial),
+>18 leshort 0x9041 Cygnus M32R (unofficial),
+>18 leshort 0x9080 Cygnus V850 (unofficial),
+>18 leshort 0xa390 IBM S/390 (obsolete),
+>18 leshort 0xabc7 Old Xtensa (unofficial),
+>18 leshort 0xad45 xstormy16 (unofficial),
+>18 leshort 0xbaab Old MicroBlaze (unofficial),,
+>18 leshort 0xbeef Cygnus MN10300 (unofficial),
+>18 leshort 0xdead Cygnus MN10200 (unofficial),
+>18 leshort 0xf00d Toshiba MeP (unofficial),
+>18 leshort 0xfeb0 Renesas M32C (unofficial),
+>18 leshort 0xfeba Vitesse IQ2000 (unofficial),
+>18 leshort 0xfebb NIOS (unofficial),
+>18 leshort 0xfeed Moxie (unofficial),
+>18 default x
+>>18 leshort x *unknown arch 0x%x*
+>20 lelong 0 invalid version
+>20 lelong 1 version 1
+
+0 string \177ELF ELF
+!:strength *2
+>4 byte 0 invalid class
+>4 byte 1 32-bit
+>4 byte 2 64-bit
+>5 byte 0 invalid byte order
+>5 byte 1 LSB
+>>0 use elf-le
>5 byte 2 MSB
->>16 beshort 0 no file type,
-!:mime application/octet-stream
->>16 beshort 1 relocatable,
-!:mime application/x-object
->>16 beshort 2 executable,
-!:mime application/x-executable
->>16 beshort 3 shared object,
-!:mime application/x-sharedlib
->>16 beshort 4 core file,
-!:mime application/x-coredump
-#>>>(0x38+0xcc) string >\0 of '%s'
-#>>>(0x38+0x10) belong >0 (signal %d),
->>16 beshort &0xff00 processor-specific,
->>18 beshort 0 no machine,
->>18 beshort 1 AT&T WE32100,
->>18 beshort 2 SPARC,
->>18 beshort 3 Intel 80386 - invalid byte order,
->>18 beshort 4 Motorola
->>>36 belong &0x01000000 68000,
->>>36 belong &0x00810000 CPU32,
->>>36 belong 0 68020,
->>18 beshort 5 Motorola 88000,
->>18 beshort 6 Intel 80486 - invalid byte order,
->>18 beshort 7 Intel 80860,
-# only for MIPS - see comment in little-endian section above.
->>18 beshort 8 MIPS,
->>>36 belong &0x20 N32
->>18 beshort 10 MIPS,
->>>36 belong &0x20 N32
->>18 beshort 8
-# only for 32-bit
->>>4 byte 1
->>>>36 belong&0xf0000000 0x00000000 MIPS-I
->>>>36 belong&0xf0000000 0x10000000 MIPS-II
->>>>36 belong&0xf0000000 0x20000000 MIPS-III
->>>>36 belong&0xf0000000 0x30000000 MIPS-IV
->>>>36 belong&0xf0000000 0x40000000 MIPS-V
->>>>36 belong&0xf0000000 0x50000000 MIPS32
->>>>36 belong&0xf0000000 0x60000000 MIPS64
->>>>36 belong&0xf0000000 0x70000000 MIPS32 rel2
->>>>36 belong&0xf0000000 0x80000000 MIPS64 rel2
-# only for 64-bit
->>>4 byte 2
->>>>48 belong&0xf0000000 0x00000000 MIPS-I
->>>>48 belong&0xf0000000 0x10000000 MIPS-II
->>>>48 belong&0xf0000000 0x20000000 MIPS-III
->>>>48 belong&0xf0000000 0x30000000 MIPS-IV
->>>>48 belong&0xf0000000 0x40000000 MIPS-V
->>>>48 belong&0xf0000000 0x50000000 MIPS32
->>>>48 belong&0xf0000000 0x60000000 MIPS64
->>>>48 belong&0xf0000000 0x70000000 MIPS32 rel2
->>>>48 belong&0xf0000000 0x80000000 MIPS64 rel2
->>18 beshort 9 Amdahl,
->>18 beshort 10 MIPS (deprecated),
->>18 beshort 11 RS6000,
->>18 beshort 15 PA-RISC
->>>50 beshort 0x0214 2.0
->>>48 beshort &0x0008 (LP64)
->>18 beshort 16 nCUBE,
->>18 beshort 17 Fujitsu VPP500,
->>18 beshort 18 SPARC32PLUS,
->>>36 belong&0xffff00 0x000100 V8+ Required,
->>>36 belong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required,
->>>36 belong&0xffff00 0x000400 HaL R1 Extensions Required,
->>>36 belong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required,
->>18 beshort 20 PowerPC or cisco 4500,
->>18 beshort 21 64-bit PowerPC or cisco 7500,
->>18 beshort 22 IBM S/390,
->>18 beshort 23 Cell SPU,
->>18 beshort 24 cisco SVIP,
->>18 beshort 25 cisco 7200,
->>18 beshort 36 NEC V800 or cisco 12000,
->>18 beshort 37 Fujitsu FR20,
->>18 beshort 38 TRW RH-32,
->>18 beshort 39 Motorola RCE,
->>18 beshort 40 ARM,
->>18 beshort 41 Alpha,
->>18 beshort 42 Renesas SH,
->>18 beshort 43 SPARC V9,
->>>48 belong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required,
->>>48 belong&0xffff00 0x000400 HaL R1 Extensions Required,
->>>48 belong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required,
->>>48 belong&0x3 0 total store ordering,
->>>48 belong&0x3 1 partial store ordering,
->>>48 belong&0x3 2 relaxed memory ordering,
->>18 beshort 44 Siemens Tricore Embedded Processor,
->>18 beshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
->>18 beshort 46 Renesas H8/300,
->>18 beshort 47 Renesas H8/300H,
->>18 beshort 48 Renesas H8S,
->>18 beshort 49 Renesas H8/500,
->>18 beshort 50 IA-64,
->>18 beshort 51 Stanford MIPS-X,
->>18 beshort 52 Motorola Coldfire,
->>18 beshort 53 Motorola M68HC12,
->>18 beshort 73 Cray NV1,
->>18 beshort 75 Digital VAX,
->>18 beshort 88 Renesas M32R,
->>18 leshort 92 OpenRISC,
->>18 leshort 0x3426 OpenRISC (obsolete),
->>18 leshort 0x8472 OpenRISC (obsolete),
->>18 beshort 94 Tensilica Xtensa,
->>18 beshort 97 NatSemi 32k,
->>18 beshort 0x18ad AVR32 (unofficial),
->>18 beshort 0x9026 Alpha (unofficial),
->>18 beshort 0xa390 IBM S/390 (obsolete),
->>20 belong 0 invalid version
->>20 belong 1 version 1
->>36 belong 1 MathCoPro/FPU/MAU Required
+>>0 use \^elf-le
# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
# like proper ELF, but extracting the string had bad results.
>4 byte <0x80
@@ -5255,7 +6144,7 @@
>>7 byte 255 (embedded)
#------------------------------------------------------------------------------
-# $File: encore,v 1.6 2009/09/19 16:28:09 christos Exp $
+# $File: encore,v 1.7 2014/04/30 21:41:02 christos Exp $
# encore: file(1) magic for Encore machines
#
# XXX - needs to have the byte order specified (NS32K was little-endian,
@@ -5267,17 +6156,17 @@
>20 short 0x10b demand-paged executable
>20 short 0x10f unsupported executable
>12 long >0 not stripped
->22 short >0 - version %ld
+>22 short >0 - version %d
>22 short 0 -
#>4 date x stamp %s
0 short 0x155 Encore unsupported executable
>12 long >0 not stripped
->22 short >0 - version %ld
+>22 short >0 - version %d
>22 short 0 -
#>4 date x stamp %s
#------------------------------------------------------------------------------
-# $File: epoc,v 1.7 2009/09/19 16:28:09 christos Exp $
+# $File: epoc,v 1.9 2013/12/21 14:28:15 christos Exp $
# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1]
# Stefan Praszalowicz <hpicollo at worldnet.fr> and Peter Breitenlohner <peb at mppmu.mpg.de>
# Useful information for improving this file can be found at:
@@ -5298,6 +6187,7 @@
!:mime application/x-epoc-word
>>8 lelong 0x10000085 OPL program (TextEd)
!:mime application/x-epoc-opl
+>>8 lelong 0x10000087 Comms settings
>>8 lelong 0x10000088 Sheet file
!:mime application/x-epoc-sheet
>>8 lelong 0x100001C4 EasyFax initialisation file
@@ -5306,11 +6196,19 @@
>4 lelong 0x10000074 OPL application
!:mime application/x-epoc-app
>4 lelong 0x1000008A exported multi-bitmap image
+>4 lelong 0x1000016D
+>>8 lelong 0x10000087 Comms names
0 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image
0 lelong 0x10000050 Psion Series 5
>4 lelong 0x1000006D database
+>>8 lelong 0x10000084 Agenda file
+!:mime application/x-epoc-agenda
+>>8 lelong 0x10000086 Data file
+!:mime application/x-epoc-data
+>>8 lelong 0x10000CEA Jotter file
+!:mime application/x-epoc-jotter
>4 lelong 0x100000E4 ini file
0 lelong 0x10000079 Psion Series 5 binary:
@@ -5386,11 +6284,192 @@
0 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0
0 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0
-
#------------------------------------------------------------------------------
-# $File: filesystems,v 1.61 2011/01/10 14:01:10 christos Exp $
+# $File: filesystems,v 1.95 2014/06/03 19:17:27 christos Exp $
# filesystems: file(1) magic for different filesystems
#
+0 name partid
+>0 ubyte 0x00 Unused
+>0 ubyte 0x01 12-bit FAT
+>0 ubyte 0x02 XENIX /
+>0 ubyte 0x03 XENIX /usr
+>0 ubyte 0x04 16-bit FAT, less than 32M
+>0 ubyte 0x05 extended partition
+>0 ubyte 0x06 16-bit FAT, more than 32M
+>0 ubyte 0x07 OS/2 HPFS, NTFS, QNX2, Adv. UNIX
+>0 ubyte 0x08 AIX or os, or etc.
+>0 ubyte 0x09 AIX boot partition or Coherent
+>0 ubyte 0x0a O/2 boot manager or Coherent swap
+>0 ubyte 0x0b 32-bit FAT
+>0 ubyte 0x0c 32-bit FAT, LBA-mapped
+>0 ubyte 0x0d 7XXX, LBA-mapped
+>0 ubyte 0x0e 16-bit FAT, LBA-mapped
+>0 ubyte 0x0f extended partition, LBA-mapped
+>0 ubyte 0x10 OPUS
+>0 ubyte 0x11 OS/2 DOS 12-bit FAT
+>0 ubyte 0x12 Compaq diagnostics
+>0 ubyte 0x14 OS/2 DOS 16-bit FAT <32M
+>0 ubyte 0x16 OS/2 DOS 16-bit FAT >=32M
+>0 ubyte 0x17 OS/2 hidden IFS
+>0 ubyte 0x18 AST Windows swapfile
+>0 ubyte 0x19 Willowtech Photon coS
+>0 ubyte 0x1b hidden win95 fat 32
+>0 ubyte 0x1c hidden win95 fat 32 lba
+>0 ubyte 0x1d hidden win95 fat 16 lba
+>0 ubyte 0x20 Willowsoft OFS1
+>0 ubyte 0x21 reserved
+>0 ubyte 0x23 reserved
+>0 ubyte 0x24 NEC DOS
+>0 ubyte 0x26 reserved
+>0 ubyte 0x31 reserved
+>0 ubyte 0x32 Alien Internet Services NOS
+>0 ubyte 0x33 reserved
+>0 ubyte 0x34 reserved
+>0 ubyte 0x35 JFS on OS2
+>0 ubyte 0x36 reserved
+>0 ubyte 0x38 Theos
+>0 ubyte 0x39 Plan 9, or Theos spanned
+>0 ubyte 0x3a Theos ver 4 4gb partition
+>0 ubyte 0x3b Theos ve 4 extended partition
+>0 ubyte 0x3c PartitionMagic recovery
+>0 ubyte 0x3d Hidden Netware
+>0 ubyte 0x40 VENIX 286 or LynxOS
+>0 ubyte 0x41 PReP
+>0 ubyte 0x42 linux swap sharing DRDOS disk
+>0 ubyte 0x43 linux sharing DRDOS disk
+>0 ubyte 0x44 GoBack change utility
+>0 ubyte 0x45 Boot US Boot manager
+>0 ubyte 0x46 EUMEL/Elan or Ergos 3
+>0 ubyte 0x47 EUMEL/Elan or Ergos 3
+>0 ubyte 0x48 EUMEL/Elan or Ergos 3
+>0 ubyte 0x4a ALFX/THIN filesystem for DOS
+>0 ubyte 0x4c Oberon partition
+>0 ubyte 0x4d QNX4.x
+>0 ubyte 0x4e QNX4.x 2nd part
+>0 ubyte 0x4f QNX4.x 3rd part
+>0 ubyte 0x50 DM (disk manager)
+>0 ubyte 0x51 DM6 Aux1 (or Novell)
+>0 ubyte 0x52 CP/M or Microport SysV/AT
+>0 ubyte 0x53 DM6 Aux3
+>0 ubyte 0x54 DM6 DDO
+>0 ubyte 0x55 EZ-Drive (disk manager)
+>0 ubyte 0x56 Golden Bow (disk manager)
+>0 ubyte 0x57 Drive PRO
+>0 ubyte 0x5c Priam Edisk (disk manager)
+>0 ubyte 0x61 SpeedStor
+>0 ubyte 0x63 GNU HURD or Mach or Sys V/386
+>0 ubyte 0x64 Novell Netware 2.xx or Speedstore
+>0 ubyte 0x65 Novell Netware 3.xx
+>0 ubyte 0x66 Novell 386 Netware
+>0 ubyte 0x67 Novell
+>0 ubyte 0x68 Novell
+>0 ubyte 0x69 Novell
+>0 ubyte 0x70 DiskSecure Multi-Boot
+>0 ubyte 0x71 reserved
+>0 ubyte 0x73 reserved
+>0 ubyte 0x74 reserved
+>0 ubyte 0x75 PC/IX
+>0 ubyte 0x76 reserved
+>0 ubyte 0x77 M2FS/M2CS partition
+>0 ubyte 0x78 XOSL boot loader filesystem
+>0 ubyte 0x80 MINIX until 1.4a
+>0 ubyte 0x81 MINIX since 1.4b
+>0 ubyte 0x82 Linux swap or Solaris
+>0 ubyte 0x83 Linux native
+>0 ubyte 0x84 OS/2 hidden C: drive
+>0 ubyte 0x85 Linux extended partition
+>0 ubyte 0x86 NT FAT volume set
+>0 ubyte 0x87 NTFS volume set or HPFS mirrored
+>0 ubyte 0x8a Linux Kernel AiR-BOOT partition
+>0 ubyte 0x8b Legacy Fault tolerant FAT32
+>0 ubyte 0x8c Legacy Fault tolerant FAT32 ext
+>0 ubyte 0x8d Hidden free FDISK FAT12
+>0 ubyte 0x8e Linux Logical Volume Manager
+>0 ubyte 0x90 Hidden free FDISK FAT16
+>0 ubyte 0x91 Hidden free FDISK DOS EXT
+>0 ubyte 0x92 Hidden free FDISK FAT16 Big
+>0 ubyte 0x93 Amoeba filesystem
+>0 ubyte 0x94 Amoeba bad block table
+>0 ubyte 0x95 MIT EXOPC native partitions
+>0 ubyte 0x97 Hidden free FDISK FAT32
+>0 ubyte 0x98 Datalight ROM-DOS Super-Boot
+>0 ubyte 0x99 Mylex EISA SCSI
+>0 ubyte 0x9a Hidden free FDISK FAT16 LBA
+>0 ubyte 0x9b Hidden free FDISK EXT LBA
+>0 ubyte 0x9f BSDI?
+>0 ubyte 0xa0 IBM Thinkpad hibernation
+>0 ubyte 0xa1 HP Volume expansion (SpeedStor)
+>0 ubyte 0xa3 HP Volume expansion (SpeedStor)
+>0 ubyte 0xa4 HP Volume expansion (SpeedStor)
+>0 ubyte 0xa5 386BSD partition type
+>0 ubyte 0xa6 OpenBSD partition type
+>0 ubyte 0xa7 NeXTSTEP 486
+>0 ubyte 0xa8 Apple UFS
+>0 ubyte 0xa9 NetBSD partition type
+>0 ubyte 0xaa Olivetty Fat12 1.44MB Service part
+>0 ubyte 0xab Apple Boot
+>0 ubyte 0xae SHAG OS filesystem
+>0 ubyte 0xaf Apple HFS
+>0 ubyte 0xb0 BootStar Dummy
+>0 ubyte 0xb1 reserved
+>0 ubyte 0xb3 reserved
+>0 ubyte 0xb4 reserved
+>0 ubyte 0xb6 reserved
+>0 ubyte 0xb7 BSDI BSD/386 filesystem
+>0 ubyte 0xb8 BSDI BSD/386 swap
+>0 ubyte 0xbb Boot Wizard Hidden
+>0 ubyte 0xbe Solaris 8 partition type
+>0 ubyte 0xbf Solaris partition type
+>0 ubyte 0xc0 CTOS
+>0 ubyte 0xc1 DRDOS/sec (FAT-12)
+>0 ubyte 0xc2 Hidden Linux
+>0 ubyte 0xc3 Hidden Linux swap
+>0 ubyte 0xc4 DRDOS/sec (FAT-16, < 32M)
+>0 ubyte 0xc5 DRDOS/sec (EXT)
+>0 ubyte 0xc6 DRDOS/sec (FAT-16, >= 32M)
+>0 ubyte 0xc7 Syrinx (Cyrnix?) or HPFS disabled
+>0 ubyte 0xc8 Reserved for DR-DOS 8.0+
+>0 ubyte 0xc9 Reserved for DR-DOS 8.0+
+>0 ubyte 0xca Reserved for DR-DOS 8.0+
+>0 ubyte 0xcb DR-DOS 7.04+ Secured FAT32 CHS
+>0 ubyte 0xcc DR-DOS 7.04+ Secured FAT32 LBA
+>0 ubyte 0xcd CTOS Memdump
+>0 ubyte 0xce DR-DOS 7.04+ FAT16X LBA
+>0 ubyte 0xcf DR-DOS 7.04+ EXT LBA
+>0 ubyte 0xd0 REAL/32 secure big partition
+>0 ubyte 0xd1 Old Multiuser DOS FAT12
+>0 ubyte 0xd4 Old Multiuser DOS FAT16 Small
+>0 ubyte 0xd5 Old Multiuser DOS Extended
+>0 ubyte 0xd6 Old Multiuser DOS FAT16 Big
+>0 ubyte 0xd8 CP/M 86
+>0 ubyte 0xdb CP/M or Concurrent CP/M
+>0 ubyte 0xdd Hidden CTOS Memdump
+>0 ubyte 0xde Dell PowerEdge Server utilities
+>0 ubyte 0xdf DG/UX virtual disk manager
+>0 ubyte 0xe0 STMicroelectronics ST AVFS
+>0 ubyte 0xe1 DOS access or SpeedStor 12-bit
+>0 ubyte 0xe3 DOS R/O or Storage Dimensions
+>0 ubyte 0xe4 SpeedStor 16-bit FAT < 1024 cyl.
+>0 ubyte 0xe5 reserved
+>0 ubyte 0xe6 reserved
+>0 ubyte 0xeb BeOS
+>0 ubyte 0xee GPT Protective MBR
+>0 ubyte 0xef EFI system partition
+>0 ubyte 0xf0 Linux PA-RISC boot loader
+>0 ubyte 0xf1 SpeedStor or Storage Dimensions
+>0 ubyte 0xf2 DOS 3.3+ Secondary
+>0 ubyte 0xf3 reserved
+>0 ubyte 0xf4 SpeedStor large partition
+>0 ubyte 0xf5 Prologue multi-volumen partition
+>0 ubyte 0xf6 reserved
+>0 ubyte 0xf9 pCache: ext2/ext3 persistent cache
+>0 ubyte 0xfa Bochs x86 emulator
+>0 ubyte 0xfb VMware File System
+>0 ubyte 0xfc VMware Swap
+>0 ubyte 0xfd Linux RAID partition persistent sb
+>0 ubyte 0xfe LANstep or IBM PS/2 IML
+>0 ubyte 0xff Xenix Bad Block Table
+
0 string \366\366\366\366 PC formatted floppy with no filesystem
# Sun disk labels
# From /usr/include/sun/dklabel.h:
@@ -5411,11 +6490,12 @@
>>0752 short >0 %d alt cyls,
>>0754 short >0 %d heads/partition,
>>0756 short >0 %d sectors/track,
->>0764 long >0 start cyl %ld,
->>0770 long x %ld blocks
+>>0764 long >0 start cyl %d,
+>>0770 long x %d blocks
# Is there a boot block written 1 sector in?
>512 belong&077777777 0600407 \b, boot block present
-# Joerg Jenderek: Smart Boot Manager backup file is 41 byte header + first sectors of disc
+
+# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk
# (http://btmgr.sourceforge.net/docs/user-guide-3.html)
0 string SBMBAKUP_ Smart Boot Manager backup file
>9 string x \b, version %-5.5s
@@ -5429,8 +6509,10 @@
>>>>21 ubyte x \b, from drive 0x%x
>>>22 ubyte >0
>>>>21 string x \b, from drive %s
+>>>535 search/17 \x55\xAA
+>>>>&-512 indirect x \b; contains
-# Joerg Jenderek
+# updated by Joerg Jenderek at Nov 2012
# DOS Emulator image is 128 byte, null right padded header + harddisc image
0 string DOSEMU\0
>0x27E leshort 0xAA55
@@ -5440,17 +6522,186 @@
>>>>7 ulelong >0 \b, %u heads
>>>>11 ulelong >0 \b, %d sectors/track
>>>>15 ulelong >0 \b, %d cylinders
+>>>>128 indirect x \b; contains
-# updated by Joerg Jenderek at Sep 2007
+# added by Joerg Jenderek at Nov 2012
+# http://www.thenakedpc.com/articles/v04/08/0408-05.html
+# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data
+0 string PNCIHISK\0 Norton Utilities disc image data
+# real x86 boot sector with jump instruction
+>509 search/1026 \x55\xAA\xeb
+>>&-1 indirect x \b; contains
+# http://file-extension.net/seeker/file_extension_dat
+0 string PNCIUNDO Norton Disk Doctor UnDo file
+#
+
+# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013
+# for any allowed sector sizes
+30 search/481 \x55\xAA
+# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
+# DOS BPB information (70) and after DOS floppy (120) like in previous file version
+!:strength +72
+# for sector sizes < 512 Bytes
+>11 uleshort <512
+>>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector
+# for sector sizes with 512 or more Bytes
+>0x1FE leshort 0xAA55 DOS/MBR boot sector
+# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying
# only for sector sizes with 512 or more Bytes
-0x1FE leshort 0xAA55 x86 boot sector
-# to do also for sectors < than 512 Bytes and some other files, GRR
-#30 search/481 \x55\xAA x86 boot sector
-# not for BeOS floppy 1440k, MBRs
-#(11.s-2) uleshort 0xAA55 x86 boot sector
+0x1FE leshort 0xAA55
+#
+# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
+!:strength +21
>2 string OSBS \b, OS/BS MBR
-# J\xf6rg Jenderek <joerg dot jenderek at web dot de>
->0x8C string Invalid\ partition\ table \b, MS-DOS MBR
+# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
+# and http://en.wikipedia.org/wiki/Master_Boot_Record
+# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
+# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00
+>0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR
+# Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm )
+# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld
+>>8 ubequad 0x8bf45007501ffbfc
+# http://thestarman.pcministry.com/asm/mbr/200MBR.htm
+>>>0x16 ubyte 0xF3 \b,DOS 2
+>>>>219 regex Author\ -\ Author:
+# found "David Litton" , "A Pehrsson "
+>>>>>&0 string x "%s"
+>>>0x16 ubyte 0xF2
+# NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm
+# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz
+>>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3
+# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111)
+>>>>0x22 default x \b,D0S version 3.3-7.0
+# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...)
+# where nn is string offset varying for different languages
+# "Invalid partition table" nn=0x8b for english version
+>>>>>(0x49.b) string Invalid\ partition\ table english
+>>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german
+>>>>>(0x49.b) string Table\ de\ partition\ invalide french
+>>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese
+>>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish
+>>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian
+>>>>>0x49 ubyte >0 at offset 0x%x
+>>>>>>(0x49.b) string >\0 "%s"
+# "Error loading operating system" nn=0xa3 for english version
+# "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version
+# "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version
+# "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version
+# "Error al cargar sistema operativo" nn=0xa8 for spanish version
+# "Errore durante il caricamento del sistema operativo" nn=0xae for italian version
+>>>>>0x74 ubyte >0 at offset 0x%x
+>>>>>>(0x74.b) string >\0 "%s"
+# "Missing operating system" nn=0xc2 for english version
+# "Betriebssystem fehlt" nn=0xcd for german version
+# "Syst\212me d'exploitation absent" nn=0xd2 for french version
+# "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version
+# "Falta sistema operativo" nn=0xca for spanish version
+# "Sistema operativo mancante" nn=0xe2 for italian version
+>>>>>0x79 ubyte >0 at offset 0x%x
+>>>>>>(0x79.b) string >\0 "%s"
+# Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
+# assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b
+>>8 ubequad 0x5007501ffcbe1b7c
+# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04
+>>>24 ubequad 0xf3a4cbbebe07b104 9M
+# "Invalid partition table" nn=0x10F for english version
+# "Ung\201ltige Partitionstabelle" nn=0x10F for german version
+# "Table de partition erron\202e" nn=0x10F for french version
+# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version
+>>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english
+>>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german
+>>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french
+>>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian
+>>>>0x3C ubyte x at offset 0x%x+0xFF
+>>>>(0x3C.b+0x0FF) string >\0 "%s"
+# "Error loading operating system" nn=0x127 for english version
+# "Fehler beim Laden des Betriebssystems" nn=0x12b for german version
+# "Erreur lors du chargement du syst\212me d'exploitation" nn=0x12a for french version
+# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version
+>>>>0xBD ubyte x at offset 0x1%x
+>>>>(0xBD.b+0x100) string >\0 "%s"
+# "Missing operating system" nn=0x146 for english version
+# "Betriebssystem fehlt" nn=0x151 for german version
+# "Syst\212me d'exploitation manquant" nn=0x15e for french version
+# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version
+>>>>0xA9 ubyte x at offset 0x1%x
+>>>>(0xA9.b+0x100) string >\0 "%s"
+# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm
+# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04
+>>>24 ubequad 0xf3a4cbbdbe07b104 XP
+# where xxyyzz are lower bits from offsets of error messages varying for different languages
+>>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english
+>>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german
+# "Invalid partition table" xx=0x12C for english version
+# "Ung\201ltige Partitionstabelle" xx=0x12C for german version
+>>>>0x1b5 ubyte >0 at offset 0x1%x
+>>>>(0x1b5.b+0x100) string >\0 "%s"
+# "Error loading operating system" yy=0x144 for english version
+# "Fehler beim Laden des Betriebssystems" yy=0x148 for german version
+>>>>0x1b6 ubyte >0 at offset 0x1%x
+>>>>(0x1b6.b+0x100) string >\0 "%s"
+# "Missing operating system" zz=0x163 for english version
+# "Betriebssystem nicht vorhanden" zz=0x16e for german version
+>>>>0x1b7 ubyte >0 at offset 0x1%x
+>>>>(0x1b7.b+0x100) string >\0 "%s"
+# Microsoft Windows Vista or 7
+# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00
+>>8 ubequad 0xc08ed8be007cbf00
+# Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm)
+# assembler instructions: jnz 0729;cmp ebx,"TCPA"
+>>>0xEC ubequad 0x753b6681fb544350 Vista
+# where xxyyzz are lower bits from offsets of error messages varying for different languages
+>>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english
+#>>>>0x1B4 ubelong&0x00FFFFFF ? german
+# "Invalid partition table" xx=0x162 for english version
+# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version
+>>>>0x1b5 ubyte >0 at offset 0x1%x
+>>>>(0x1b5.b+0x100) string >\0 "%s"
+# "Error loading operating system" yy=0x17a for english version
+# "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version
+>>>>0x1b6 ubyte >0 at offset 0x1%x
+>>>>(0x1b6.b+0x100) string >\0 "%s"
+# "Missing operating system" zz=0x199 for english version
+# "Betriebssystem nicht vorhanden" zz=0x1?? for german version
+>>>>0x1b7 ubyte >0 at offset 0x1%x
+>>>>(0x1b7.b+0x100) string >\0 "%s"
+# Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm)
+# assembler instructions: cmp ebx,"TCPA";cmp
+>>>0xEC ubequad 0x6681fb5443504175 Windows 7
+# where xxyyzz are lower bits from offsets of error messages varying for different languages
+>>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english
+#>>>>0x1B4 ubelong&0x00FFFFFF ? german
+# "Invalid partition table" xx=0x163 for english version
+# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version
+>>>>0x1b5 ubyte >0 at offset 0x1%x
+>>>>(0x1b5.b+0x100) string >\0 "%s"
+# "Error loading operating system" yy=0x17b for english version
+# "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version
+>>>>0x1b6 ubyte >0 at offset 0x1%x
+>>>>(0x1b6.b+0x100) string >\0 "%s"
+# "Missing operating system" zz=0x19a for english version
+# "Betriebssystem nicht vorhanden" zz=0x1?? for german version
+>>>>0x1b7 ubyte >0 at offset 0x1%x
+>>>>(0x1b7.b+0x100) string >\0 "%s"
+# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs
+# http://en.wikipedia.org/wiki/MBR_disk_signature#ID
+>>0x1b8 ulelong >0 \b, disk signature 0x%-.4x
+# driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm
+>>0xDA uleshort 0
+>>>0xDC ulelong >0 \b, created
+# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive
+>>>>0xDC ubyte x with driveID 0x%x
+# hours, minutes and seconds
+>>>>0xDf ubyte x at %x
+>>>>0xDe ubyte x \b:%x
+>>>>0xDd ubyte x \b:%x
+# special case for Microsoft MS-DOS 3.21 spanish
+# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov
+>0 ubequad 0xfab830008ed0bc00
+# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov
+>>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish
+# Microsoft MBR IPL end
+
# dr-dos with some upper-, lowercase variants
>0x9D string Invalid\ partition\ table$
>>181 string No\ Operating\ System$
@@ -5469,30 +6720,9 @@
>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$
>>>>>>>387 string Copyright\ (c)\ 1984,1998
>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR)
->0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222
->>0x1B8 ubelong >0 \b, Serial 0x%-.4x
->0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950
->271 string Invalid\ partition\ table\0
->>295 string Error\ loading\ operating\ system\0
->>>326 string Missing\ operating\ system\0 \b, mbr
#
->139 string Invalid\ partition\ table\0
->>163 string Error\ loading\ operating\ system\0
->>>194 string Missing\ operating\ system\0 \b, Microsoft Windows XP mbr
-# http://www.heise.de/ct/05/09/006/ page 184
-#HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\DosDevices\?:=Serial4Bytes+8Bytes
->>>>0x1B8 ulelong >0 \b,Serial 0x%-.4x
->300 string Invalid\ partition\ table\0
->>324 string Error\ loading\ operating\ system\0
->>>355 string Missing\ operating\ system\0 \b, Microsoft Windows XP MBR
-#??>>>389 string Invalid\ system\ disk
->>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x
->300 string Ung\201ltige\ Partitionstabelle
-#split string to avoid error: String too long
->>328 string Fehler\ beim\ Laden\
->>>346 string des\ Betriebssystems
->>>>366 string Betriebssystem\ nicht\ vorhanden \b, Microsoft Windows XP MBR (german)
->>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x
+# tests for different MS-DOS Master Boot Records (MBR) moved and merged
+#
#>0x145 string Default:\ F \b, FREE-DOS MBR
#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR
>0x145 search/7 Default:\ F \b, FREE-DOS MBR
@@ -5519,8 +6749,7 @@
>>>>>>>420 ubyte&0x0F 0Xf \b ask
>>>>>420 ubyte x \b)
#
->271 string Operating\ system\ loading
->>296 string error\r \b, SYSLINUX MBR (2.10)
+# SYSLINUX MBR moved
# http://www.acronis.de/
>362 string MBR\ Error\ \0\r
>>376 string ress\ any\ key\ to\
@@ -5576,75 +6805,47 @@
>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96
>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0
>>>>>385 string GRUB\ \0 \b, GRUB version 0.97
-#unkown version
+# unknown version
>>>343 string Geom\0Read\0\ Error\0
>>>>321 string Loading\ stage1.5 \b, GRUB version x.y
>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0
>>>>374 string GRUB\ \0 \b, GRUB version n.m
-# http://syslinux.zytor.com/
->478 string Boot\ failed\r
->>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (1.62)
->480 string Boot\ failed\r
->>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (2.06 or 2.11)
->484 string Boot\ error\r \b, SYSLINUX bootloader (3.11)
+# SYSLINUX bootloader moved
>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader
# http://www.bcdwb.de/bcdw/index_e.htm
>3 string BCDL
>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z)
-# mbr partition table entries
-# OEM-ID does not contain MicroSoft,NEWLDR,DOS,SYSLINUX,or MTOOLs
->3 string !MS
->>3 string !SYSLINUX
->>>3 string !MTOOL
->>>>3 string !NEWLDR
->>>>>5 string !DOS
-# not FAT (32 bit)
->>>>>>82 string !FAT32
-#not Linux kernel
->>>>>>>514 string !HdrS
-#not BeOS
->>>>>>>>422 string !Be\ Boot\ Loader
-# active flag 0 or 0x80 and type > 0
->>>>>>>>>446 ubyte <0x81
->>>>>>>>>>446 ubyte&0x7F 0
->>>>>>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x
->>>>>>>>>>>>446 ubyte 0x80 \b, active
->>>>>>>>>>>>447 ubyte x \b, starthead %u
-#>>>>>>>>>>>>448 ubyte x \b, start C_S: 0x%x
-#>>>>>>>>>>>>448 ubeshort&1023 x \b, startcylinder? %d
->>>>>>>>>>>>454 ulelong x \b, startsector %u
->>>>>>>>>>>>458 ulelong x \b, %u sectors
-#
->>>>>>>>>462 ubyte <0x81
->>>>>>>>>>462 ubyte&0x7F 0
->>>>>>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x
->>>>>>>>>>>>462 ubyte 0x80 \b, active
->>>>>>>>>>>>463 ubyte x \b, starthead %u
-#>>>>>>>>>>>>464 ubyte x \b, start C_S: 0x%x
-#>>>>>>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d
->>>>>>>>>>>>470 ulelong x \b, startsector %u
->>>>>>>>>>>>474 ulelong x \b, %u sectors
-#
->>>>>>>>>478 ubyte <0x81
->>>>>>>>>>478 ubyte&0x7F 0
->>>>>>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x
->>>>>>>>>>>>478 ubyte 0x80 \b, active
->>>>>>>>>>>>479 ubyte x \b, starthead %u
-#>>>>>>>>>>>>480 ubyte x \b, start C_S: 0x%x
-#>>>>>>>>>>>>481 ubyte x \b, start C2S: 0x%x
-#>>>>>>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d
->>>>>>>>>>>>486 ulelong x \b, startsector %u
->>>>>>>>>>>>490 ulelong x \b, %u sectors
-#
->>>>>>>>>494 ubyte <0x81
->>>>>>>>>>494 ubyte&0x7F 0
->>>>>>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x
->>>>>>>>>>>>494 ubyte 0x80 \b, active
->>>>>>>>>>>>495 ubyte x \b, starthead %u
-#>>>>>>>>>>>>496 ubyte x \b, start C_S: 0x%x
-#>>>>>>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d
->>>>>>>>>>>>502 ulelong x \b, startsector %u
->>>>>>>>>>>>506 ulelong x \b, %u sectors
+# mbr partition table entries updated by Joerg Jenderek at Sep 2013
+# skip Norton Utilities disc image data
+>3 string !IHISK
+# skip Linux style boot sector starting with assember instructions mov 0x7c0,ax;
+>>0 belong !0xb8c0078e
+# not Linux kernel
+>>>514 string !HdrS
+# not BeOS
+>>>>422 string !Be\ Boot\ Loader
+# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr
+>>>>>0 ubelong&0xFD000000 =0xE9000000
+# AdvanceMAME mbr
+>>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e
+>>>>>>>446 use partition-table
+# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader
+>>>>>0 ubelong&0xFD000000 !0xE9000000
+# skip FSInfosector
+>>>>>>0 string !RRaA
+# skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX,
+# http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm
+>>>>>>>0 ubequad !0xfa660fb64610668b
+# skip 13rd sector of MS x86 bootloader
+>>>>>>>>0 ubequad !0x660fb64610668b4e
+# skip sector starting with DOS new line
+>>>>>>>>>0 string !\r\n
+# allowed active flag 0,80h-FFh
+>>>>>>>>>>446 ubyte 0
+>>>>>>>>>>>446 use partition-table
+>>>>>>>>>>446 ubyte >0x7F
+>>>>>>>>>>>446 use partition-table
+# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries
# mbr partition table entries end
# http://www.acronis.de/
#FAT label=ACRONIS\ SZ
@@ -5651,13 +6852,11 @@
#OEM-ID=BOOTWIZ0
>442 string Non-system\ disk,\
>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader
-# DOS names like F11.SYS are 8 right space padded bytes+3 bytes
->>>477 ubyte&0xDF >0
->>>>477 string x \b %-.3s
->>>>>480 ubyte&0xDF >0
->>>>>>480 string x \b%-.5s
->>>>485 ubyte&0xDF >0
->>>>>485 string x \b.%-.3s
+# updated by Joerg Jenderek at Nov 2012, Sep 2013
+# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
+# display 1 space
+>>>447 ubyte x \b
+>>>477 use DOS-filename
#
>185 string FDBOOT\ Version\
>>204 string \rNo\ Systemdisk.\
@@ -5667,24 +6866,39 @@
>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader
>>>>>>200 string >\0 \b, version %-3s
>242 string Bootsector\ from\ C.H.\ Hochst\204
->>278 string No\ Systemdisk.\
->>>293 string Booting\ from\ harddisk.\n\r
->>>441 string Cannot\ load\ from\ harddisk.\n\r
->>>>469 string Insert\ Systemdisk\
->>>>>487 string and\ press\ any\ key.\n\r \b, WinImage harddisk Bootloader
->>>>>>209 string >\0 \b, version %-4.4s
+# http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c
+# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string
+# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut
+>242 search/127 Bootsector\ from\ C.H.\ Hochst
+>>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk
+# followed by variants with point,CR-NL or NL-CR
+>>>208 search/261 Cannot\ load\ from\ harddisk.
+# followed by variants CR-NL or NL-CR
+>>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key.
+# followed by variants with point,CR-NL or NL-CR
+>>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader
+# followed by string like "6.50 (c) 1993-2004 Gilles Vollant"
+>>>>>>&0 string x \b, version %-4.4s
>(1.b+2) ubyte 0xe
>>(1.b+3) ubyte 0x1f
>>>(1.b+4) ubyte 0xbe
->>>>(1.b+5) ubyte 0x77
->>>>(1.b+6) ubyte 0x7c
->>>>>(1.b+7) ubyte 0xac
->>>>>>(1.b+8) ubyte 0x22
->>>>>>>(1.b+9) ubyte 0xc0
->>>>>>>>(1.b+10) ubyte 0x74
->>>>>>>>>(1.b+11) ubyte 0xb
->>>>>>>>>>(1.b+12) ubyte 0x56
->>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display
+# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others
+>>>>(1.b+5) ubyte&0xd3 0x53
+>>>>>(1.b+6) ubyte 0x7c
+# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah,
+>>>>>>(1.b+7) ubyte 0xac
+>>>>>>>(1.b+8) ubyte 0x22
+>>>>>>>>(1.b+9) ubyte 0xc0
+>>>>>>>>>(1.b+10) ubyte 0x74
+>>>>>>>>>>(1.b+11) ubyte 0x0b
+>>>>>>>>>>>(1.b+12) ubyte 0x56
+>>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display
+# FAT1X version
+>>>>>>>>>>>>>(1.b+5) ubyte 0x5b
+>>>>>>>>>>>>>>0x5b string >\0 "%-s"
+# FAT32 version
+>>>>>>>>>>>>>(1.b+5) ubyte 0x77
+>>>>>>>>>>>>>>0x77 string >\0 "%-s"
>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display
#>>244 string from\ dosemu-freedos-*-bin.tgz\r
#>>>170 string Sorry,\ could\ not\ load\ an\
@@ -6082,29 +7296,8 @@
# It just looks for a program file name at the root directory
# and loads corresponding file with following execution.
# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
->>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
->>>>>499 string x \b %-.1s
->>>>>>500 ubyte&0xDF >0
->>>>>>>500 string x \b%-.1s
->>>>>>>>501 ubyte&0xDF >0
->>>>>>>>>501 string x \b%-.1s
->>>>>>>>>>502 ubyte&0xDF >0
->>>>>>>>>>>502 string x \b%-.1s
->>>>>>>>>>>>503 ubyte&0xDF >0
->>>>>>>>>>>>>503 string x \b%-.1s
->>>>>>>>>>>>>>504 ubyte&0xDF >0
->>>>>>>>>>>>>>>504 string x \b%-.1s
->>>>>>>>>>>>>>>>505 ubyte&0xDF >0
->>>>>>>>>>>>>>>>>505 string x \b%-.1s
->>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
->>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
-#name extension
->>>>>507 ubyte&0xDF >0 \b.
->>>>>>507 string x \b%-.1s
->>>>>>>508 ubyte&0xDF >0
->>>>>>>>508 string x \b%-.1s
->>>>>>>>>509 ubyte&0xDF >0
->>>>>>>>>>509 string x \b%-.1s
+>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
+>>>>>499 use DOS-filename
#If the boot sector fails to read any other sector,
#it prints a very short message ("RE") to the screen and hangs the computer.
#If the boot sector fails to find needed program in the root directory,
@@ -6111,45 +7304,18 @@
#it also hangs with another message ("NF").
>>>>>492 string RENF \b, FAT (12 bit)
>>>>>495 string RENF \b, FAT (16 bit)
-# http://alexfru.chat.ru/epm.html#bootprog
->494 ubyte >0x4D
->>495 string >E
->>>495 string <S
-#OEM-ID is not reliable
->>>>3 string BootProg
-# It just looks for a program file name at the root directory
-# and loads corresponding file with following execution.
-# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
->>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
->>>>>499 string x \b %-.1s
->>>>>>500 ubyte&0xDF >0
->>>>>>>500 string x \b%-.1s
->>>>>>>>501 ubyte&0xDF >0
->>>>>>>>>501 string x \b%-.1s
->>>>>>>>>>502 ubyte&0xDF >0
->>>>>>>>>>>502 string x \b%-.1s
->>>>>>>>>>>>503 ubyte&0xDF >0
->>>>>>>>>>>>>503 string x \b%-.1s
->>>>>>>>>>>>>>504 ubyte&0xDF >0
->>>>>>>>>>>>>>>504 string x \b%-.1s
->>>>>>>>>>>>>>>>505 ubyte&0xDF >0
->>>>>>>>>>>>>>>>>505 string x \b%-.1s
->>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
->>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
-#name extension
->>>>>507 ubyte&0xDF >0 \b.
->>>>>>507 string x \b%-.1s
->>>>>>>508 ubyte&0xDF >0
->>>>>>>>508 string x \b%-.1s
->>>>>>>>>509 ubyte&0xDF >0
->>>>>>>>>>509 string x \b%-.1s
#If the boot sector fails to read any other sector,
#it prints a very short message ("RE") to the screen and hangs the computer.
-#If the boot sector fails to find needed program in the root directory,
-#it also hangs with another message ("NF").
->>>>>492 string RENF \b, FAT (12 bit)
->>>>>495 string RENF \b, FAT (16 bit)
# x86 bootloader end
+
+# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
+# and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
+>0 string RRaA
+>>0x1E4 string rrAa \b, FSInfosector
+#>>0x1FC uleshort =0 SHOULD BE ZERO
+>>>0x1E8 ulelong <0xffffffff \b, %u free clusters
+>>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u
+
# updated by Joerg Jenderek at Sep 2007
>3 ubyte 0
#no active flag
@@ -6164,148 +7330,99 @@
>>>>>>>466 ubyte 0x05 \b, extended partition table
>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA)
>>>>>>>466 ubyte 0x0 \b, extended partition table (last)
-# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90
-# http://mirror.href.com/thestarman/asm/2bytejumps.htmm#FWD
-# older drives may use Near JuMP instruction E9 xx xx
->0 lelong&0x009000EB 0x009000EB
->0 lelong&0x000000E9 0x000000E9
-# minimal short forward jump found 03cx??
-# maximal short forward jump is 07fx
->1 ubyte <0xff \b, code offset 0x%x
-# mtools-3.9.8/msdos.h
-# usual values are marked with comments to get only informations of strange FAT systems
-# valid sectorsize must be a power of 2 from 32 to 32768
->>11 uleshort&0x000f x
->>>11 uleshort <32769
->>>>11 uleshort >31
->>>>>21 ubyte&0xf0 0xF0
->>>>>>3 string >\0 \b, OEM-ID "%8.8s"
-#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
->>>>>>>8 string IHC \b cached by Windows 9M
->>>>>>11 uleshort >512 \b, Bytes/sector %u
-#>>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual)
->>>>>>11 uleshort <512 \b, Bytes/sector %u
->>>>>>13 ubyte >1 \b, sectors/cluster %u
-#>>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
->>>>>>14 uleshort >32 \b, reserved sectors %u
-#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
-#>>>>>>14 uleshort >1 \b, reserved sectors %u
-#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
->>>>>>14 uleshort <1 \b, reserved sectors %u
->>>>>>16 ubyte >2 \b, FATs %u
-#>>>>>>16 ubyte =2 \b, FATs %u (usual)
->>>>>>16 ubyte =1 \b, FAT %u
->>>>>>16 ubyte >0
->>>>>>17 uleshort >0 \b, root entries %u
-#>>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32)
->>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
-#>>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32)
->>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
-#>>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
->>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x
->>>>>>22 uleshort >0 \b, sectors/FAT %u
-#>>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32)
->>>>>>26 ubyte >2 \b, heads %u
-#>>>>>>26 ubyte =2 \b, heads %u (usual floppy)
->>>>>>26 ubyte =1 \b, heads %u
-#skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk
->>>>>>38 ubyte !0x70
->>>>>>>28 ulelong >0 \b, hidden sectors %u
-#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
->>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
-#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
-# FAT<32 specific
->>>>>>82 string !FAT32
-#>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
-#>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy)
->>>>>>>36 ubyte !0x80
->>>>>>>>36 ubyte !0 \b, physical drive 0x%x
->>>>>>>37 ubyte >0 \b, reserved 0x%x
-#>>>>>>>37 ubyte =0 \b, reserved 0x%x
->>>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)
->>>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)
->>>>>>>38 ubyte =0x29
->>>>>>>>39 ulelong x \b, serial number 0x%x
->>>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
->>>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
->>>>>>>>43 string =NO\ NAME \b, unlabeled
->>>>>>>54 string FAT \b, FAT
->>>>>>>>54 string FAT12 \b (12 bit)
->>>>>>>>54 string FAT16 \b (16 bit)
-# FAT32 specific
->>>>>>82 string FAT32 \b, FAT (32 bit)
->>>>>>>36 ulelong x \b, sectors/FAT %u
->>>>>>>40 uleshort >0 \b, extension flags %u
-#>>>>>>>40 uleshort =0 \b, extension flags %u
->>>>>>>42 uleshort >0 \b, fsVersion %u
-#>>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
->>>>>>>44 ulelong >2 \b, rootdir cluster %u
-#>>>>>>>44 ulelong =2 \b, rootdir cluster %u
-#>>>>>>>44 ulelong =1 \b, rootdir cluster %u
->>>>>>>48 uleshort >1 \b, infoSector %u
-#>>>>>>>48 uleshort =1 \b, infoSector %u (usual)
->>>>>>>48 uleshort <1 \b, infoSector %u
->>>>>>>50 uleshort >6 \b, Backup boot sector %u
-#>>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
->>>>>>>50 uleshort <6 \b, Backup boot sector %u
->>>>>>>54 ulelong >0 \b, reserved1 0x%x
->>>>>>>58 ulelong >0 \b, reserved2 0x%x
->>>>>>>62 ulelong >0 \b, reserved3 0x%x
-# same structure as FAT1X
->>>>>>>64 ubyte >0x80 \b, physical drive 0x%x
-#>>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)
->>>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x
-#>>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
->>>>>>>65 ubyte >0 \b, reserved 0x%x
->>>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)
->>>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)
->>>>>>>66 ubyte =0x29
->>>>>>>>67 ulelong x \b, serial number 0x%x
->>>>>>>>71 string <NO\ NAME \b, label: "%11.11s"
->>>>>>>71 string >NO\ NAME \b, label: "%11.11s"
->>>>>>>71 string =NO\ NAME \b, unlabeled
-### FATs end
+
+# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
+
>0x200 lelong 0x82564557 \b, BSD disklabel
-# FATX
-0 string FATX FATX filesystem data
+# by Joerg Jenderek at Apr 2013
+# Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension
+# like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS
+0 name DOS-filename
+# space=0x20 (00100000b) means empty
+>0 ubyte&0xDF >0
+>>0 ubyte x \b%c
+>>>1 ubyte&0xDF >0
+>>>>1 ubyte x \b%c
+>>>>>2 ubyte&0xDF >0
+>>>>>>2 ubyte x \b%c
+>>>>>>>3 ubyte&0xDF >0
+>>>>>>>>3 ubyte x \b%c
+>>>>>>>>>4 ubyte&0xDF >0
+>>>>>>>>>>4 ubyte x \b%c
+>>>>>>>>>>>5 ubyte&0xDF >0
+>>>>>>>>>>>>5 ubyte x \b%c
+>>>>>>>>>>>>>6 ubyte&0xDF >0
+>>>>>>>>>>>>>>6 ubyte x \b%c
+>>>>>>>>>>>>>>>7 ubyte&0xDF >0
+>>>>>>>>>>>>>>>>7 ubyte x \b%c
+# DOS filename extension
+>>8 ubyte&0xDF >0 \b.
+>>>8 ubyte x \b%c
+>>>>9 ubyte&0xDF >0
+>>>>>9 ubyte x \b%c
+>>>>>>10 ubyte&0xDF >0
+>>>>>>>10 ubyte x \b%c
+# Print 2 following DOS filenames from directory entry form
+# like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com
+0 name 2xDOS-filename
+# display 1 space
+>0 ubyte x \b
+>0 use DOS-filename
+>11 ubyte x \b+
+>11 use DOS-filename
-# Minix filesystems - Juan Cespedes <cespedes at debian.org>
-0x410 leshort 0x137f
-!:strength / 2
->0x402 beshort < 100 Minix filesystem, V1, %d zones
->0x1e string minix \b, bootable
-0x410 beshort 0x137f
-!:strength / 2
->0x402 beshort < 100 Minix filesystem, V1 (big endian), %d zones
->0x1e string minix \b, bootable
-0x410 leshort 0x138f
-!:strength / 2
->0x402 beshort < 100 Minix filesystem, V1, 30 char names, %d zones
->0x1e string minix \b, bootable
-0x410 beshort 0x138f
-!:strength / 2
->0x402 beshort < 100 Minix filesystem, V1, 30 char names (big endian), %d zones
->0x1e string minix \b, bootable
-0x410 leshort 0x2468
->0x402 beshort < 100 Minix filesystem, V2, %d zones
->0x1e string minix \b, bootable
-0x410 beshort 0x2468
->0x402 beshort < 100 Minix filesystem, V2 (big endian), %d zones
->0x1e string minix \b, bootable
+# http://en.wikipedia.org/wiki/Master_boot_record#PTE
+# display standard partition table
+0 name partition-table
+#>0 ubyte x PARTITION-TABLE
+# test and display 1st til 4th partition table entry
+>0 use partition-entry-test
+>16 use partition-entry-test
+>32 use partition-entry-test
+>48 use partition-entry-test
+# test for entry of partition table
+0 name partition-entry-test
+# partition type ID > 0
+>4 ubyte >0
+# active flag 0
+>>0 ubyte 0
+>>>0 use partition-entry
+# active flag 0x80, 0x81, ...
+>>0 ubyte >0x7F
+>>>0 use partition-entry
+# Print entry of partition table
+0 name partition-entry
+# partition type ID > 0
+>4 ubyte >0 \b; partition
+>>64 leshort 0xAA55 1
+>>48 leshort 0xAA55 2
+>>32 leshort 0xAA55 3
+>>16 leshort 0xAA55 4
+>>4 ubyte x : ID=0x%x
+>>0 ubyte&0x80 0x80 \b, active
+>>0 ubyte >0x80 0x%x
+>>1 ubyte x \b, start-CHS (
+>>1 use partition-chs
+>>5 ubyte x \b), end-CHS (
+>>5 use partition-chs
+>>8 ulelong x \b), startsector %u
+>>12 ulelong x \b, %u sectors
+# Print cylinder,head,sector (CHS) of partition entry
+0 name partition-chs
+# cylinder
+>1 ubyte x \b0x
+>1 ubyte&0xC0 0x40 \b1
+>1 ubyte&0xC0 0x80 \b2
+>1 ubyte&0xC0 0xC0 \b3
+>2 ubyte x \b%x
+# head
+>0 ubyte x \b,%u
+# sector
+>1 ubyte&0x3F x \b,%u
-0x410 leshort 0x2478
->0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones
->0x1e string minix \b, bootable
-0x410 leshort 0x2478
->0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones
->0x1e string minix \b, bootable
-0x410 beshort 0x2478
->0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones
->0x1e string minix \b, bootable
-0x410 leshort 0x4d5a
->0x402 beshort !0 Minix filesystem, V3, %d zones
->0x1e string minix \b, bootable
+# FATX
+0 string FATX FATX filesystem data
# romfs filesystems - Juan Cespedes <cespedes at debian.org>
0 string -rom1fs- romfs filesystem, version 1
@@ -6321,13 +7438,144 @@
0x18b string OS/2 OS/2 Boot Manager
-# updated by Joerg Jenderek at Oct 2008!!
+# updated by Joerg Jenderek at Oct 2008 and Sep 2012
# http://syslinux.zytor.com/iso.php
-0 ulelong 0x7c40eafa isolinux Loader
+# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
+# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
+0 ulequad&0x909000007cc0eafa 0x909000007c40eafa
+>631 search/689 ISOLINUX\ isolinux Loader
+>>&0 string x (version %-4.4s)
# http://syslinux.zytor.com/pxe.php
-0 ulelong 0x007c05ea pxelinux Loader
-0 ulelong 0x60669c66 pxelinux Loader
+# assembler instructions: jmp 7C05
+0 ulelong 0x007c05ea pxelinux loader (version 2.13 or older)
+# assembler instructions: pushfd;pushad
+0 ulelong 0x60669c66 pxelinux loader
+# assembler instructions: jmp 05
+0 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer)
+# http://syslinux.zytor.com/wiki/index.php/SYSLINUX
+0 string LDLINUX\ SYS\ SYSLINUX loader
+>12 string x (older version %-4.4s)
+0 string \r\nSYSLINUX\ SYSLINUX loader
+>11 string x (version %-4.4s)
+# syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
+# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX"
+0 ulelong&0x80909bEB 0x009018EB
+# OEM-ID not always "SYSLINUX"
+>434 search/47 Boot\ failed
+# followed by \r\n\0 or :\
+>>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older)
+>>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9)
+>459 search/30 Boot\ error\r\n\0
+>>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer)
+# SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
+# assembler instructions: mov di,0600h;mov cx,0100h
+16 search/4 \xbf\x00\x06\xb9\x00\x01
+# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21)
+!:strength +36
+>94 search/249 Missing\ operating\ system
+# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other
+# skip Ranish MBR
+>>408 search/4 HD1/\0
+>>408 default x
+>>>250 search/118 \0Operating\ system\ load SYSLINUX MBR
+# followed by "ing " or space
+>>>>292 search/98 error
+>>>>>&0 string \r (version 3.35 or older)
+>>>>>&0 string .\r (version 3.52 or newer)
+>>>>>&0 default x (version 3.36-3.51 )
+>368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR
+>>156 search/10 \0Boot\ partition\ not\ found\r\n
+>>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older)
+>>174 search/10 \0Missing\ OS\r\n
+>>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer)
+# SYSLINUX END
+# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012
+# assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax,
+0 ubequad 0x31c08ed0bc007c8e
+# mbr_bootsel magic before partition table not reliable with small ipl fragments
+#>444 uleshort 0xb5e1
+>0004 uleshort x
+# ERRorTeXT
+>>181 search/166 Error\ \0\r\n NetBSD mbr
+# NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
+>>>0x1B8 ubelong >0 \b,Serial 0x%-.8x
+# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
+>>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector
+# BOOT_EXTENDED definitions contains assembler instructions:
+# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13
+>>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended
+# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al
+>>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO
+# not TERSE_ERROR
+>>>196 search/106 No\ active\ partition\0
+>>>>&0 string Disk\ read\ error\0
+>>>>>&0 string No\ operating\ system\0 \b,verbose
+# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13
+>>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS
+# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13
+>>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check
+# assembler instructions: movw nametab,bx
+>>>0x26 search/21 \xBB\x94\x07
+# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf
+>>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94
+>>>>>181 search/166 Error\ \0
+# "a: disk" , "Fn: diskn" or "NetBSD MBR boot"
+>>>>>>&3 string x \b,"%s"
+# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
+# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
+# assembler instructions: jmp short 0x58;nop;ASCII
+0 ubequad&0xeb58908000000000 0xeb58900000000000
+# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss,
+>(1.b+2) ubequad 0xfa31c08ed88ec08e
+# Error messages at end of code
+>>376 string No\ operating\ system\r\n\0
+>>>398 string Disk\ error\r\n\0FDD\0HDD\0
+>>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr
+
+# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/
+# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
+# for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
+# or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
+0 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC
+# pointer to the data starting with Neil Turton signature string
+>(0x1BC.s) string NDTmbr
+>>&-14 string 1234F\0 Turton mbr (
+# parameters also viewed by install-mbr --list
+>>>(0x1BC.s+7) ubyte x \b%u<=
+>>>(0x1BC.s+9) ubyte x \bVersion<=%u
+#>>>(0x1BC.s+8) ubyte x asm_flag_%x
+>>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix
+# variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode
+>>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk
+#0x1~1,..,0x8~4,0x10~F,0x80~A enabled
+#>>>(0x1BC.s+10) ubyte x \b,flags 0x%x
+#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
+#>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x
+# for older versions
+>>>(0x1BC.s+9) ubyte <2
+#>>>>(0x1BC.s+12) ubyte 18 \b,%hhu/18 seconds
+>>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds
+# floppy A: or B:
+>>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x
+>>>>(0x1BC.s+13) ubyte >1
+# 1st hard disc
+#>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x
+# not 1st hard disc
+>>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x
+# for version >= 2 maximal timeout can be 65534
+>>>(0x1BC.s+9) ubyte >1
+#>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds
+>>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds
+# floppy A: or B:
+>>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x
+>>>>(0x1BC.s+14) ubyte >1
+# 1st hard disc
+#>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x
+# not 1st hard disc
+>>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x
+>>>0 ubyte x \b)
+
# added by Joerg Jenderek
# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
# grub-1.94/kern/i386/pc/startup.S
@@ -6349,7 +7597,7 @@
>>>>0x207 ubyte x \b.%u
# module_size for 1.94
>>>>0x208 ulelong <0xffffff \b, installed partition %u
-#>>>>0x208 ulelong =0xffffff \b, %u (default)
+#>>>>0x208 ulelong =0xffffff \b, %lu (default)
>>>>0x208 ulelong >0xffffff \b, installed partition %u
# GRUB 0.5.95 unofficial
>>>>0x20C ulelong&0x2E300000 0x2E300000
@@ -6383,6 +7631,178 @@
>>>>>0x217 ulong !0xffffffff
>>>>>>0x217 string >\0 \b, configuration file %-s
+# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
+# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90
+# over BIOS parameter block (BPB)
+# http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD
+# older drives may use Near JuMP instruction E9 xx xx
+# minimal short forward jump found 0x29 for bootloaders or 0x0
+# maximal short forward jump is 0x7f
+# OEM-ID is empty or contain readable bytes
+0 ulelong&0x804000E9 0x000000E9
+# mtools-3.9.8/msdos.h
+# usual values are marked with comments to get only informations of strange FAT systems
+# valid sectorsize must be a power of 2 from 32 to 32768
+>11 uleshort&0xf001f 0
+>>11 uleshort <32769
+>>>11 uleshort >31
+>>>>21 ubyte&0xf0 0xF0
+>>>>>0 ubyte 0xEB
+>>>>>>1 ubyte x \b, code offset 0x%x+2
+>>>>>0 ubyte 0xE9
+>>>>>>1 uleshort x \b, code offset 0x%x+2
+>>>>>3 string >\0 \b, OEM-ID "%-.8s"
+#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
+>>>>>>8 string IHC \b cached by Windows 9M
+>>>>>11 uleshort >512 \b, Bytes/sector %u
+#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual)
+>>>>>11 uleshort <512 \b, Bytes/sector %u
+>>>>>13 ubyte >1 \b, sectors/cluster %u
+#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
+>>>>>82 string FAT32
+>>>>>>14 uleshort !32 \b, reserved sectors %u
+#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
+>>>>>82 string !FAT32
+>>>>>>14 uleshort >1 \b, reserved sectors %u
+#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
+#>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS)
+>>>>>16 ubyte >2 \b, FATs %u
+#>>>>>16 ubyte =2 \b, FATs %u (usual)
+>>>>>16 ubyte =1 \b, FAT %u
+>>>>>16 ubyte >0
+>>>>>17 uleshort >0 \b, root entries %u
+#>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32)
+>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
+#>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32)
+>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
+#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
+>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x
+>>>>>22 uleshort >0 \b, sectors/FAT %u
+#>>>>>22 uleshort =0 \b, sectors/FAT %hu=0 (usual Fat32)
+>>>>>24 uleshort x \b, sectors/track %u
+>>>>>26 ubyte >2 \b, heads %u
+#>>>>>26 ubyte =2 \b, heads %u (usual floppy)
+>>>>>26 ubyte =1 \b, heads %u
+# valid only for sector sizes with more then 32 Bytes
+>>>>>11 uleshort >32
+# skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk
+>>>>>>38 ubyte !0x70
+>>>>>>>28 ulelong >0 \b, hidden sectors %u
+#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
+>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
+#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
+# FAT<32 bit specific
+>>>>>>>82 string !FAT32
+#>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
+#>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy)
+>>>>>>>>36 ubyte !0x80
+>>>>>>>>>36 ubyte !0 \b, physical drive 0x%x
+>>>>>>>>37 ubyte >0 \b, reserved 0x%x
+#>>>>>>>>37 ubyte =0 \b, reserved 0x%x
+# value is 0x80 for NTFS
+>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x)
+>>>>>>>>38 ubyte =0x29
+>>>>>>>>>39 ulelong x \b, serial number 0x%x
+>>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
+>>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
+>>>>>>>>>43 string =NO\ NAME \b, unlabeled
+# there exist some old floppies without word FAT at offset 54
+# a word like "FATnm " is only a hint for a FAT size on nm-bits
+# Normally the number of clusters is calculated by the values of BPP.
+# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
+# otherwise FAT is 16 bit.
+# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
+>>>>>>54 string FAT \b, FAT
+>>>>>>>54 string FAT12 \b (12 bit)
+>>>>>>>54 string FAT16 \b (16 bit)
+# FAT32 bit specific
+>>>>>82 string FAT32 \b, FAT (32 bit)
+>>>>>>36 ulelong x \b, sectors/FAT %u
+# http://technet.microsoft.com/en-us/library/cc977221.aspx
+>>>>>>40 uleshort >0 \b, extension flags 0x%x
+#>>>>>>40 uleshort =0 \b, extension flags %hu
+>>>>>>42 uleshort >0 \b, fsVersion %u
+#>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
+>>>>>>44 ulelong >2 \b, rootdir cluster %u
+#>>>>>>44 ulelong =2 \b, rootdir cluster %u
+#>>>>>>44 ulelong =1 \b, rootdir cluster %u
+>>>>>>48 uleshort >1 \b, infoSector %u
+#>>>>>>48 uleshort =1 \b, infoSector %u (usual)
+>>>>>>48 uleshort <1 \b, infoSector %u
+>>>>>>50 uleshort >6 \b, Backup boot sector %u
+#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
+>>>>>>50 uleshort <6 \b, Backup boot sector %u
+# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
+>>>>>>52 ulelong >0 \b, reserved1 0x%x
+>>>>>>56 ulelong >0 \b, reserved2 0x%x
+>>>>>>60 ulelong >0 \b, reserved3 0x%x
+# same structure as FAT1X
+#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)
+#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
+>>>>>>64 ubyte !0x80
+>>>>>>>64 ubyte >0 \b, physical drive 0x%x
+# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
+>>>>>>65 ubyte >0 \b, reserved 0x%x
+>>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x)
+>>>>>>66 ubyte =0x29
+>>>>>>>67 ulelong x \b, serial number 0x%x
+>>>>>>>71 string <NO\ NAME \b, label: "%11.11s"
+>>>>>>>71 string >NO\ NAME \b, label: "%11.11s"
+>>>>>>>71 string =NO\ NAME \b, unlabeled
+# additional tests for floppy image added by Joerg Jenderek
+# no fixed disk
+>>>>>21 ubyte !0xF8
+# floppy media with 12 bit FAT
+>>>>>>54 string !FAT16
+# test for FAT after bootsector
+>>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT
+# floppy image
+!:mime application/x-ima
+# NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
+# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
+# 0 FATs
+>>>>>16 ubyte =0
+# 0 root entries
+>>>>>>17 uleshort =0
+# 0 DOS sectors
+>>>>>>>19 uleshort =0
+# 0 sectors/FAT
+# dos < 4.0 BootSector value found is 0x80
+#38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x)
+>>>>>>>>22 uleshort =0 \b; NTFS
+>>>>>>>>>24 uleshort >0 \b, sectors/track %u
+>>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x
+>>>>>>>>>40 ulequad >0 \b, sectors %lld
+>>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld
+>>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld
+# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters.
+# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
+>>>>>>>>>64 lelong <256
+>>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d
+>>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%i)
+# Values 0 to 127 represent index block sizes of 0 to 127 clusters.
+# Values 128 to 255 represent index block sizes of 2^(256-N) byte
+>>>>>>>>>68 ulelong <256
+>>>>>>>>>>68 ulelong <128 \b, clusters/index block %d
+#>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d)
+>>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%i)
+>>>>>>>>>72 ulequad x \b, serial number 0%llx
+>>>>>>>>>80 ulelong >0 \b, checksum 0x%x
+#>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual)
+>>>>>>>>>0x258 ulelong&0x00009090 =0x00009090
+>>>>>>>>>>&-92 indirect x \b; contains
+# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013
+# http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
+# unused assembler instructions JMP y2;NOP;NOP
+0x056 ulelong&0xFFFF0FFF 0x909002EB
+# unicode loadername terminated by CTRL-D
+>(0.s*2) ulelong&0xFFFFFF00 0x00040000
+# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR
+>>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s
+>>0x12 string $
+>>>0x0c lestring16 x \b%-2.2s
+### DOS,NTFS boot sectors end
+
9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian),
>8404 string x last mounted on %s,
#>9504 ledate x last checked at %s,
@@ -6413,7 +7833,7 @@
>&-180 lelong x average file size %d,
>&-176 lelong x average number of files in dir %d,
>&-272 lequad x pending blocks to free %lld,
->&-264 lelong x pending inodes to free %ld,
+>&-264 lelong x pending inodes to free %d,
>&-664 lequad x system-wide uuid %0llx,
>&-1316 lelong x minimum percentage of free blocks %d,
>&-1248 lelong 0 TIME optimization
@@ -6433,7 +7853,7 @@
>&-180 lelong x average file size %d,
>&-176 lelong x average number of files in dir %d,
>&-272 lequad x pending blocks to free %lld,
->&-264 lelong x pending inodes to free %ld,
+>&-264 lelong x pending inodes to free %d,
>&-664 lequad x system-wide uuid %0llx,
>&-1316 lelong x minimum percentage of free blocks %d,
>&-1248 lelong 0 TIME optimization
@@ -6473,7 +7893,7 @@
>&-180 belong x average file size %d,
>&-176 belong x average number of files in dir %d,
>&-272 bequad x pending blocks to free %lld,
->&-264 belong x pending inodes to free %ld,
+>&-264 belong x pending inodes to free %d,
>&-664 bequad x system-wide uuid %0llx,
>&-1316 belong x minimum percentage of free blocks %d,
>&-1248 belong 0 TIME optimization
@@ -6493,7 +7913,7 @@
>&-180 belong x average file size %d,
>&-176 belong x average number of files in dir %d,
>&-272 bequad x pending blocks to free %lld,
->&-264 belong x pending inodes to free %ld,
+>&-264 belong x pending inodes to free %d,
>&-664 bequad x system-wide uuid %0llx,
>&-1316 belong x minimum percentage of free blocks %d,
>&-1248 belong 0 TIME optimization
@@ -6545,6 +7965,51 @@
#>0x464 lelong &0x0000020 (many subdirs)
#>0x463 lelong &0x0000040 (extra isize)
+# Minix filesystems - Juan Cespedes <cespedes at debian.org>
+0x410 leshort 0x137f
+!:strength / 2
+>0x402 beshort < 100
+>0x402 beshort > -1 Minix filesystem, V1, %d zones
+>0x1e string minix \b, bootable
+0x410 beshort 0x137f
+!:strength / 2
+>0x402 beshort < 100
+>0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones
+>0x1e string minix \b, bootable
+0x410 leshort 0x138f
+!:strength / 2
+>0x402 beshort < 100
+>0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones
+>0x1e string minix \b, bootable
+0x410 beshort 0x138f
+!:strength / 2
+>0x402 beshort < 100
+>0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones
+>0x1e string minix \b, bootable
+0x410 leshort 0x2468
+>0x402 beshort < 100
+>>0x402 beshort > -1 Minix filesystem, V2, %d zones
+>0x1e string minix \b, bootable
+0x410 beshort 0x2468
+>0x402 beshort < 100
+>0x402 beshort > -1 Minix filesystem, V2 (big endian), %d zones
+>0x1e string minix \b, bootable
+
+0x410 leshort 0x2478
+>0x402 beshort < 100
+>0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones
+>0x1e string minix \b, bootable
+0x410 leshort 0x2478
+>0x402 beshort < 100
+>0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones
+>0x1e string minix \b, bootable
+0x410 beshort 0x2478
+>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones
+>0x1e string minix \b, bootable
+0x410 leshort 0x4d5a
+>0x402 beshort !0 Minix filesystem, V3, %d zones
+>0x1e string minix \b, bootable
+
# SGI disk labels - Nathan Scott <nathans at debian.org>
0 belong 0x0BE5A941 SGI disk label (volume header)
@@ -6558,25 +8023,33 @@
############################################################################
# Minix-ST kernel floppy
0x800 belong 0x46fc2700 Atari-ST Minix kernel image
->19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy
->19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy
+# http://en.wikipedia.org/wiki/BIOS_parameter_block
+# floppies with valid BPB and any instruction at beginning
+>19 string \240\005\371\005\0\011\0\2\0 \b, 720k floppy
+>19 string \320\002\370\005\0\011\0\1\0 \b, 360k floppy
############################################################################
# Hmmm, is this a better way of detecting _standard_ floppy images ?
-19 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k
->0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
-19 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k
->0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
+19 string \320\002\360\003\0\011\0\1\0 DOS floppy 360k
+>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector
+19 string \240\005\371\003\0\011\0\2\0 DOS floppy 720k
+>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector
19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k
->0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
+>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector
-19 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM
->0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
-19 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs
->0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
+19 string \240\005\371\005\0\011\0\2\0 DOS floppy 720k, IBM
+>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector
+19 string \100\013\371\005\0\011\0\2\0 DOS floppy 1440k, mkdosfs
+>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector
-19 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k
-19 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k
+19 string \320\002\370\005\0\011\0\1\0 Atari-ST floppy 360k
+19 string \240\005\371\005\0\011\0\2\0 Atari-ST floppy 720k
+# | | | | |
+# | | | | heads
+# | | | sectors/track
+# | | sectors/FAT
+# | media descriptor
+# BPB: sectors
# Valid media descriptor bytes for MS-DOS:
#
@@ -6614,11 +8087,85 @@
# 10 SS, 8 SPT
# 11 DS, 8 SPT
#
-# 11111001 Double density 3\xBD floppy disk, high density 5\xBC
-# 11110000 High density 3\xBD floppy disk
+# 11111001 Double density 3 1/2 floppy disk, high density 5 1/4
+# 11110000 High density 3 1/2 floppy disk
# 11111000 Hard disk any format
#
+# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013
+# http://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions
+# Too Weak.
+#512 ubelong&0xE0ffff00 0xE0ffff00
+# without valid Media descriptor in place of BPB, cases with are done at other places
+#>21 ubyte <0xE5 floppy with old FAT filesystem
+# but valid Media descriptor at begin of FAT
+#>>512 ubyte =0xed 720k
+#>>512 ubyte =0xf0 1440k
+#>>512 ubyte =0xf8 720k
+#>>512 ubyte =0xf9 1220k
+#>>512 ubyte =0xfa 320k
+#>>512 ubyte =0xfb 640k
+#>>512 ubyte =0xfc 180k
+# look like an an old DOS directory entry
+#>>>0xA0E ubequad 0
+#>>>>0xA00 ubequad !0
+#!:mime application/x-ima
+#>>512 ubyte =0xfd
+# look for 2nd FAT at different location to distinguish between 360k and 500k
+#>>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k
+#>>>0x500 ubelong&0xE0ffff00 0xE0ffff00 500k
+#>>>0xA0E ubequad 0
+#!:mime application/x-ima
+#>>512 ubyte =0xfe
+#>>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k
+#>>>>0x60E ubequad 0
+#>>>>>0x600 ubequad !0
+#!:mime application/x-ima
+#>>>0xC00 ubelong&0xE0ffff00 0xE0ffff00 1200k
+#>>512 ubyte =0xff 320k
+#>>>0x60E ubequad 0
+#>>>>0x600 ubequad !0
+#!:mime application/x-ima
+#>>512 ubyte x \b, Media descriptor 0x%x
+# without x86 jump instruction
+#>>0 ulelong&0x804000E9 !0x000000E9
+# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV
+#>>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader
+# IOSYS.COM+MSDOS.COM
+#>>>>0xc4 use 2xDOS-filename
+#>>0 ulelong&0x804000E9 =0x000000E9
+# only x86 short jump instruction found
+#>>>0 ubyte =0xEB
+#>>>>1 ubyte x \b, code offset 0x%x+2
+# http://thestarman.pcministry.com/DOS/ibm100/Boot.htm
+# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0
+#>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader
+# ibmbio.com+ibmdos.com
+#>>>>>0x176 use DOS-filename
+#>>>>>0x181 ubyte x \b+
+#>>>>>0x182 use DOS-filename
+# http://thestarman.pcministry.com/DOS/ibm110/Boot.htm
+# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV
+#>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader
+# ibmbio.com+ibmdos.com
+#>>>>>0x18b use DOS-filename
+#>>>>>0x196 ubyte x \b+
+#>>>>>0x197 use DOS-filename
+# http://en.wikipedia.org/wiki/Zenith_Data_Systems
+# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6
+#>>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader
+# IO.SYS+MSDOS.SYS
+#>>>>>0x20 use 2xDOS-filename
+# http://en.wikipedia.org/wiki/Corona_Data_Systems
+# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX;
+#>>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader
+# IO.SYS+MSDOS.SYS
+#>>>>>0x69 use 2xDOS-filename
+# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00;
+#>>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader
+# defect IO.SYS+MSDOS.SYS ?
+#>>>>>0x162 use 2xDOS-filename
+
# CDROM Filesystems
# Modified for UDF by gerardo.cacciari at gmail.com
32769 string CD001 #
@@ -6631,11 +8178,11 @@
>>38917 byte >0x33 (unknown version, ID 0x%X)
>>38917 byte <0x31 (unknown version, ID 0x%X)
# "application id" which appears to be used as a volume label
->32808 string >\0 '%s'
+>32808 string/T >\0 '%s'
>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)
37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
!:mime application/x-iso9660-image
-32776 string CDROM High Sierra CD-ROM filesystem data
+32777 string CDROM High Sierra CD-ROM filesystem data
# .cso files
0 string CISO Compressed ISO CD image
@@ -6642,24 +8189,24 @@
# cramfs filesystem - russell at coker.com.au
0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian
->4 lelong x size %lu
+>4 lelong x size %u
>8 lelong &1 version #2
>8 lelong &2 sorted_dirs
>8 lelong &4 hole_support
>32 lelong x CRC 0x%x,
->36 lelong x edition %lu,
->40 lelong x %lu blocks,
->44 lelong x %lu files
+>36 lelong x edition %u,
+>40 lelong x %u blocks,
+>44 lelong x %u files
0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian
->4 belong x size %lu
+>4 belong x size %u
>8 belong &1 version #2
>8 belong &2 sorted_dirs
>8 belong &4 hole_support
>32 belong x CRC 0x%x,
->36 belong x edition %lu,
->40 belong x %lu blocks,
->44 belong x %lu files
+>36 belong x edition %u,
+>40 belong x %u blocks,
+>44 belong x %u files
# reiserfs - russell at coker.com.au
0x10034 string ReIsErFs ReiserFS V3.5
@@ -6802,8 +8349,6 @@
>28 leshort >3
>>8 ledate x created: %s
-0 string td\000 floppy image data (TeleDisk)
-
# AFS Dump Magic
# From: Ty Sarna <tsarna at sarna.org>
0 string \x01\xb3\xa1\x13\x22 AFS Dump
@@ -6926,8 +8471,8 @@
>16 ulequad >0 \b fblock table at %lld,
>24 ulequad >0 \b inode table at %lld,
>32 ulequad >0 \b root at %lld,
->40 ulelong >0 \b fblock size = %ld,
->44 ulelong >0 \b block size = %ld,
+>40 ulelong >0 \b fblock size = %d,
+>44 ulelong >0 \b block size = %d,
>48 ulequad >0 \b bytes = %lld
# Type: xfs metadump image
@@ -6958,22 +8503,98 @@
>>&32 lelong&0x00000006 >0 (dirty)
>>&36 lelong >0 (compressed)
+# LFS
+0 lelong 0x070162 LFS filesystem image
+>4 lelong 1 version 1,
+>>8 lelong x \b blocks %u,
+>>12 lelong x \b blocks per segment %u,
+>4 lelong 2 version 2,
+>>8 lelong x \b fragments %u,
+>>12 lelong x \b bytes per segment %u,
+>16 lelong x \b disk blocks %u,
+>20 lelong x \b block size %u,
+>24 lelong x \b fragment size %u,
+>28 lelong x \b fragments per block %u,
+>32 lelong x \b start for free list %u,
+>36 lelong x \b number of free blocks %d,
+>40 lelong x \b number of files %u,
+>44 lelong x \b blocks available for writing %d,
+>48 lelong x \b inodes in cache %d,
+>52 lelong x \b inode file disk address 0x%x,
+>56 lelong x \b inode file inode number %u,
+>60 lelong x \b address of last segment written 0x%x,
+>64 lelong x \b address of next segment to write 0x%x,
+>68 lelong x \b address of current segment written 0x%x
+
+0 string td\000 floppy image data (TeleDisk, compressed)
+0 string TD\000 floppy image data (TeleDisk)
+
+0 string CQ\024 floppy image data (CopyQM,
+>16 leshort x %d sectors,
+>18 leshort x %d heads.)
+
+0 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk)
+
+0 beshort 0xAA58 floppy image data (IBM SaveDskF, old)
+0 beshort 0xAA59 floppy image data (IBM SaveDskF)
+0 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed)
+
+0 string \074CPM_Disk\076 disk image data (YAZE)
+
+# ReFS
+# Richard W.M. Jones <rjones at redhat.com>
+0 string \0\0\0ReFS\0 ReFS filesystem image
+
+# EFW encase image file format:
+# Gregoire Passault
+# http://www.forensicswiki.org/wiki/Encase_image_file_format
+0 string EVF\x09\x0d\x0a\xff\x00 EWF/Expert Witness/EnCase image file format
+
+# UBIfs
+# Linux kernel sources: fs/ubifs/ubifs-media.h
+0 belong 0x31181006
+>0x16 short 0 UBIfs image
+>0x08 lequad x \b, sequence number %llu
+>0x10 leshort x \b, length %u
+>0x04 lelong x \b, CRC 0x%08x
+
+0 belong 0x55424923
+>0x04 short <2
+>0x05 string \0\0\0
+>0x1c string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+>0x04 short x UBI image, version %u
+
#------------------------------------------------------------------------------
-# $File: flash,v 1.9 2009/11/08 01:30:01 christos Exp $
+# $File: flash,v 1.11 2014/05/02 00:26:49 christos Exp $
# flash: file(1) magic for Macromedia Flash file format
#
# See
#
# http://www.macromedia.com/software/flash/open/
+# http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\
+# en/devnet/swf/pdf/swf-file-format-spec.pdf page 27
#
-0 string FWS Macromedia Flash data,
->3 byte x version %d
+
+0 name swf-details
+>0 string F Macromedia Flash data
!:mime application/x-shockwave-flash
-0 string CWS Macromedia Flash data (compressed),
+>0 string C Macromedia Flash data (compressed)
!:mime application/x-shockwave-flash
->3 byte x version %d
+>0 string Z Macromedia Flash data (lzma compressed)
+!:mime application/x-shockwave-flash
+>3 byte x \b, version %d
+
+1 string WS
+>4 lelong !0
+>>3 byte 255 Suspicious
+>>>0 use swf-details
+
+>>3 ubyte <32
+>>>3 ubyte !0
+>>>>0 use swf-details
+
# From: Cal Peake <cp at absolutedigital.net>
-0 string FLV Macromedia Flash Video
+0 string FLV\x01 Macromedia Flash Video
!:mime video/x-flv
#
@@ -6984,7 +8605,7 @@
0 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document
#------------------------------------------------------------------------------
-# $File: fonts,v 1.23 2010/09/20 18:55:20 rrt Exp $
+# $File: fonts,v 1.27 2014/04/30 21:41:02 christos Exp $
# fonts: file(1) magic for font data
#
0 search/1 FONT ASCII vfont text
@@ -7000,8 +8621,15 @@
0 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text
# X11 font files in SNF (Server Natural Format) format
+# updated by Joerg Jenderek at Feb 2013
+# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm
0 belong 00000004 X11 SNF font data, MSB first
-0 lelong 00000004 X11 SNF font data, LSB first
+#>104 belong 00000004 X11 SNF font data, MSB first
+!:mime application/x-font-sfn
+# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX
+0 lelong 00000004
+>104 lelong 00000004 X11 SNF font data, LSB first
+!:mime application/x-font-sfn
# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan at yggdrasil.com)
0 search/1 STARTFONT\ X11 BDF font text
@@ -7059,7 +8687,7 @@
0 string OTTO OpenType font data
!:mime application/vnd.ms-opentype
-# Gürkan Sengün <gurkan at linuks.mine.nu>, www.linuks.mine.nu
+# Gurkan Sengun <gurkan at linuks.mine.nu>, www.linuks.mine.nu
0 string SplineFontDB: Spline Font Database
!:mime application/vnd.font-fontforge-sfd
>14 string x version %s
@@ -7068,11 +8696,20 @@
34 string LP Embedded OpenType (EOT)
!:mime application/vnd.ms-fontobject
+# Web Open Font Format (.woff)
+# http://www.w3.org/TR/WOFF/
+0 string wOFF Web Open Font Format
+>4 belong x \b, flavor %d
+>8 belong x \b, length %d
+>20 beshort x \b, version %d
+>22 beshort x \b.%d
+
#------------------------------------------------------------------------------
-# $File: fortran,v 1.6 2009/09/19 16:28:09 christos Exp $
+# $File: fortran,v 1.8 2014/06/03 19:01:34 christos Exp $
# FORTRAN source
-0 regex/100 \^[Cc][\ \t] FORTRAN program
+0 regex/100l \^[Cc][\ \t] FORTRAN program
!:mime text/x-fortran
+!:strength - 5
#------------------------------------------------------------------------------
# $File: frame,v 1.12 2009/09/19 16:28:09 christos Exp $
@@ -7269,7 +8906,7 @@
>>11 byte x %d chars high
#------------------------------------------------------------------------------
-# $File: fsav,v 1.11 2009/09/19 16:28:09 christos Exp $
+# $File: fsav,v 1.13 2013/03/25 17:18:47 christos Exp $
# fsav: file(1) magic for datafellows fsav virus definition files
# Anthon van der Neut (anthon at mnt.org)
@@ -7331,21 +8968,36 @@
# From: David Newgas <david at newgas.net>
0 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data
+0 string X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR
+>33 string -STANDARD-ANTIVIRUS-TEST-FILE!$H+H* EICAR virus test files
+
#------------------------------------------------------------------------------
-# $File: games,v 1.12 2010/11/25 15:00:12 christos Exp $
+# $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $
+# fusecompress: file(1) magic for fusecompress
+0 string \037\135\211 FuseCompress(ed) data
+>3 byte 0x00 (none format)
+>3 byte 0x01 (bz2 format)
+>3 byte 0x02 (gz format)
+>3 byte 0x03 (lzo format)
+>3 byte 0x04 (xor format)
+>3 byte >0x04 (unknown format)
+>4 long x uncompressed size: %d
+
+#------------------------------------------------------------------------------
+# $File: games,v 1.14 2014/04/30 21:41:02 christos Exp $
# games: file(1) for games
# Fabio Bonelli <fabiobonelli at libero.it>
# Quake II - III data files
0 string IDP2 Quake II 3D Model file,
->20 long x %lu skin(s),
->8 long x (%lu x
->12 long x %lu),
->40 long x %lu frame(s),
->16 long x Frame size %lu bytes,
->24 long x %lu vertices/frame,
->28 long x %lu texture coordinates,
->32 long x %lu triangles/frame
+>20 long x %u skin(s),
+>8 long x (%u x
+>12 long x %u),
+>40 long x %u frame(s),
+>16 long x Frame size %u bytes,
+>24 long x %u vertices/frame,
+>28 long x %u texture coordinates,
+>32 long x %u triangles/frame
0 string IBSP Quake
>4 long 0x26 II Map file (BSP)
@@ -7478,7 +9130,7 @@
0 string MComprHD MAME CHD compressed hard disk image,
->12 belong x version %lu
+>12 belong x version %u
# doom - submitted by Jon Dowland
@@ -7588,6 +9240,14 @@
>2 regex/c GM\\[20\\] - Gess Game
>2 regex/c GM\\[21\\] - twix Game
+# Epic Games/Unreal Engine Package
+#
+0 lelong 0x9E2A83C1 Unreal Engine Package,
+>4 leshort x version: %i
+>12 lelong !0 \b, names: %i
+>28 lelong !0 \b, imports: %i
+>20 lelong !0 \b, exports: %i
+
#------------------------------------------------------------------------------
# $File: gcc,v 1.4 2009/09/19 16:28:09 christos Exp $
# gcc: file(1) magic for GCC special files
@@ -7606,7 +9266,7 @@
>4 byte 79 for Objective C++
#------------------------------------------------------------------------------
-# $File: geo,v 1.1 2010/02/23 23:40:07 christos Exp $
+# $File: geo,v 1.3 2013/01/04 00:47:02 christos Exp $
# Geo- files from Kurt Schwehr <schwehr at ccom.unh.edu>
######################################################################
@@ -7710,6 +9370,18 @@
# https://midas.psi.ch/elog/
0 string $@MID@$ elog journal entry
+# Geospatial Designs http://www.geospatialdesigns.com/surfer6_format.htm
+0 string DSBB Surfer 6 binary grid file
+>4 leshort x \b, %d
+>6 leshort x \bx%d
+>8 ledouble x \b, minx=%g
+>16 ledouble x \b, maxx=%g
+>24 ledouble x \b, miny=%g
+>32 ledouble x \b, maxy=%g
+>40 ledouble x \b, minz=%g
+>48 ledouble x \b, maxz=%g
+
+
#------------------------------------------------------------------------------
# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $
# GEOS files (Vidar Madsen, vidar at gimp.org)
@@ -7731,14 +9403,18 @@
#>168 string >\0 \b, copyright "%s"
#------------------------------------------------------------------------------
-# $File: gimp,v 1.7 2010/09/20 18:55:20 rrt Exp $
-# GIMP Gradient: file(1) magic for the GIMP's gradient data files
+# $File: gimp,v 1.9 2014/04/30 21:41:02 christos Exp $
+# GIMP Gradient: file(1) magic for the GIMP's gradient data files (.ggr)
# by Federico Mena <federico at nuclecu.unam.mx>
-0 string GIMP\ Gradient GIMP gradient data
+0 string/t GIMP\ Gradient GIMP gradient data
+# GIMP palette (.gpl)
+# From: Markus Heidelberg <markus.heidelberg at web.de>
+0 string/t GIMP\ Palette GIMP palette data
+
#------------------------------------------------------------------------------
-# XCF: file(1) magic for the XCF image format used in the GIMP developed
+# XCF: file(1) magic for the XCF image format used in the GIMP (.xcf) developed
# by Spencer Kimball and Peter Mattis
# ('Bucky' LaDieu, nega at vt.edu)
@@ -7747,8 +9423,8 @@
>9 string file version 0,
>9 string v version
>>10 string >\0 %s,
->14 belong x %lu x
->18 belong x %lu,
+>14 belong x %u x
+>18 belong x %u,
>22 belong 0 RGB Color
>22 belong 1 Greyscale
>22 belong 2 Indexed Color
@@ -7755,7 +9431,7 @@
>22 belong >2 Unknown Image Type.
#------------------------------------------------------------------------------
-# XCF: file(1) magic for the patterns used in the GIMP, developed
+# XCF: file(1) magic for the patterns used in the GIMP (.pat), developed
# by Spencer Kimball and Peter Mattis
# ('Bucky' LaDieu, nega at vt.edu)
@@ -7763,7 +9439,7 @@
>24 string x %s
#------------------------------------------------------------------------------
-# XCF: file(1) magic for the brushes used in the GIMP, developed
+# XCF: file(1) magic for the brushes used in the GIMP (.gbr), developed
# by Spencer Kimball and Peter Mattis
# ('Bucky' LaDieu, nega at vt.edu)
@@ -7774,17 +9450,18 @@
0 string #\040GIMP\040Curves\040File GIMP curve file
#------------------------------------------------------------------------------
-# $File: gnome-keyring,v 1.2 2009/09/19 16:28:09 christos Exp $
-# GNOME keyring
+# $File: gnome,v 1.5 2014/04/30 21:41:02 christos Exp $
+# GNOME related files
+
# Contributed by Josh Triplett
# FIXME: Could be simplified if pstring supported two-byte counts
0 string GnomeKeyring\n\r\0\n GNOME keyring
>&0 ubyte 0 \b, major version 0
>>&0 ubyte 0 \b, minor version 0
->>>&0 ubyte 0 \b, crypto type 0 (AEL)
->>>&0 ubyte >0 \b, crypto type %hhu (unknown)
+>>>&0 ubyte 0 \b, crypto type 0 (AES)
+>>>&0 ubyte >0 \b, crypto type %u (unknown)
>>>&1 ubyte 0 \b, hash type 0 (MD5)
->>>&1 ubyte >0 \b, hash type %hhu (unknown)
+>>>&1 ubyte >0 \b, hash type %u (unknown)
>>>&2 ubelong 0xFFFFFFFF \b, name NULL
>>>&2 ubelong !0xFFFFFFFF
>>>>&-4 ubelong >255 \b, name too long for file's pstring type
@@ -7799,22 +9476,63 @@
>>>>>>&28 ubequad x \b, salt %llu
>>>>>>&52 ubelong x \b, %u item(s)
+# From: Alex Beregszaszi <alex at fsn.hu>
+4 string gtktalog GNOME Catalogue (gtktalog)
+>13 string >\0 version %s
+
+# Summary: GStreamer binary registry
+# Extension: .bin
+# Submitted by: Josh Triplett <josh at joshtriplett.org>
+0 belong 0xc0def00d GStreamer binary registry
+>4 string x \b, version %s
+
+# GVariant Database file
+# By Elan Ruusamae <glen at delfi.ee>
+# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h
+# It's always "GVariant", it's byte swapped on incompatible archs
+# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c
+# file_builder_serialise()
+# http://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant
+0 string GVariant GVariant Database file,
+# version is never filled. probably future extension
+>8 lelong x version %d
+# not sure are these usable, so commented out
+#>>16 lelong x start %d,
+#>>>20 lelong x end %d
+
+# G-IR database made by gobject-introspect toolset,
+# http://live.gnome.org/GObjectIntrospection
+0 string GOBJ\nMETADATA\r\n\032 G-IR binary database
+>16 byte x \b, v%d
+>17 byte x \b.%d
+>20 leshort x \b, %d entries
+>22 leshort x \b/%d local
+
#------------------------------------------------------------------------------
-# $File: gnu,v 1.11 2009/09/19 16:28:09 christos Exp $
+# $File: gnu,v 1.15 2014/02/06 14:21:02 christos Exp $
# gnu: file(1) magic for various GNU tools
#
# GNU nlsutils message catalog file format
#
+# GNU message catalog (.mo and .gmo files)
+
0 string \336\22\4\225 GNU message catalog (little endian),
->4 lelong x revision %d,
->8 lelong x %d messages
+>6 leshort x revision %d.
+>4 leshort >0 \b%d,
+>>8 lelong x %d messages,
+>>36 lelong x %d sysdep messages
+>4 leshort =0 \b%d,
+>>8 lelong x %d messages
+
0 string \225\4\22\336 GNU message catalog (big endian),
->4 belong x revision %d,
->8 belong x %d messages
-# message catalogs, from Mitchum DSouza <m.dsouza at mrc-apu.cam.ac.uk>
-0 string *nazgul* Nazgul style compiled message catalog
->8 lelong >0 \b, version %ld
+>4 beshort x revision %d.
+>6 beshort >0 \b%d,
+>>8 belong x %d messages,
+>>36 belong x %d sysdep messages
+>6 beshort =0 \b%d,
+>>8 belong x %d messages
+
# GnuPG
# The format is very similar to pgp
0 string \001gpg GPG key trust database
@@ -7828,6 +9546,32 @@
0 beshort 0x9901 GPG key public ring
!:mime application/x-gnupg-keyring
+# Symmetric encryption
+0 leshort 0x0d8c
+>4 leshort 0x0203
+>>2 leshort 0x0204 GPG symmetrically encrypted data (3DES cipher)
+>>2 leshort 0x0304 GPG symmetrically encrypted data (CAST5 cipher)
+>>2 leshort 0x0404 GPG symmetrically encrypted data (BLOWFISH cipher)
+>>2 leshort 0x0704 GPG symmetrically encrypted data (AES cipher)
+>>2 leshort 0x0804 GPG symmetrically encrypted data (AES192 cipher)
+>>2 leshort 0x0904 GPG symmetrically encrypted data (AES256 cipher)
+>>2 leshort 0x0a04 GPG symmetrically encrypted data (TWOFISH cipher)
+>>2 leshort 0x0b04 GPG symmetrically encrypted data (CAMELLIA128 cipher)
+>>2 leshort 0x0c04 GPG symmetrically encrypted data (CAMELLIA192 cipher)
+>>2 leshort 0x0d04 GPG symmetrically encrypted data (CAMELLIA256 cipher)
+
+
+# GnuPG Keybox file
+# <http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD>
+# From: Philipp Hahn <hahn at univention.de>
+0 belong 32
+>4 byte 1
+>>8 string KBXf GPG keybox database
+>>>5 byte 1 version %d
+>>>16 bedate x \b, created-at %s
+>>>20 bedate x \b, last-maintained %s
+
+
# Gnumeric spreadsheet
# This entry is only semi-helpful, as Gnumeric compresses its files, so
# they will ordinarily reported as "compressed", but at least -z helps
@@ -7843,6 +9587,10 @@
0 long 0xDE120495 GNU-format message catalog data
0 long 0x950412DE GNU-format message catalog data
+# gettext message catalogue
+0 regex \^msgid\ GNU gettext message catalogue text
+!:mime text/x-po
+
#------------------------------------------------------------------------------
# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $
# gnumeric: file(1) magic for Gnumeric spreadsheet
@@ -7852,6 +9600,246 @@
!:mime application/x-gnumeric
#------------------------------------------------------------------------------
+# $File: gpt,v 1.3 2014/04/30 21:41:02 christos Exp $
+#
+# GPT Partition table patterns.
+# Author: Rogier Goossens (goossens.rogier at gmail.com)
+# Note that a GPT-formatted disk must contain an MBR as well.
+#
+
+# The initial segment (up to >>>>>>>>422) was copied from the X86
+# partition table code (aka MBR).
+# This is kept separate, so that MBR partitions are not reported as well.
+# (use -k if you do want them as well)
+
+# First, detect the MBR partiton table
+# If more than one GPT protective MBR partition exists, don't print anything
+# (the other MBR detection code will then just print the MBR partition table)
+0x1FE leshort 0xAA55
+>3 string !MS
+>>3 string !SYSLINUX
+>>>3 string !MTOOL
+>>>>3 string !NEWLDR
+>>>>>5 string !DOS
+# not FAT (32 bit)
+>>>>>>82 string !FAT32
+#not Linux kernel
+>>>>>>>514 string !HdrS
+#not BeOS
+>>>>>>>>422 string !Be\ Boot\ Loader
+# GPT with protective MBR entry in partition 1 (only)
+>>>>>>>>>450 ubyte 0xee
+>>>>>>>>>>466 ubyte !0xee
+>>>>>>>>>>>482 ubyte !0xee
+>>>>>>>>>>>>498 ubyte !0xee
+#>>>>>>>>>>>>>446 use gpt-mbr-partition
+>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
+>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART
+>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
+>>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART
+>>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
+>>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART
+>>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
+>>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART
+>>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
+# GPT with protective MBR entry in partition 2 (only)
+>>>>>>>>>450 ubyte !0xee
+>>>>>>>>>>466 ubyte 0xee
+>>>>>>>>>>>482 ubyte !0xee
+>>>>>>>>>>>>498 ubyte !0xee
+#>>>>>>>>>>>>>462 use gpt-mbr-partition
+>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
+>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART
+>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
+>>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART
+>>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
+>>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART
+>>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
+>>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART
+>>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
+# GPT with protective MBR entry in partition 3 (only)
+>>>>>>>>>450 ubyte !0xee
+>>>>>>>>>>466 ubyte !0xee
+>>>>>>>>>>>482 ubyte 0xee
+>>>>>>>>>>>>498 ubyte !0xee
+#>>>>>>>>>>>>>478 use gpt-mbr-partition
+>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
+>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART
+>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
+>>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART
+>>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
+>>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART
+>>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
+>>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART
+>>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
+# GPT with protective MBR entry in partition 4 (only)
+>>>>>>>>>450 ubyte !0xee
+>>>>>>>>>>466 ubyte !0xee
+>>>>>>>>>>>482 ubyte !0xee
+>>>>>>>>>>>>498 ubyte 0xee
+#>>>>>>>>>>>>>494 use gpt-mbr-partition
+>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
+>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART
+>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
+>>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART
+>>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
+>>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART
+>>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
+>>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART
+>>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table
+>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
+>>>>>>>>>>>>>>>>>>&-8 use gpt-table
+>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
+
+# The following code does GPT detection and processing, including
+# sector size detection.
+# It has to be duplicated above because the top-level pattern
+# (i.e. not called using 'use') must print *something* for file
+# to count it as a match. Text only printed in named patterns is
+# not counted, and causes file to continue, and try and match
+# other patterns.
+#
+# Unfortunately, when assuming sector sizes >=16k, if the sector size
+# happens to be 512 instead, we may find confusing data after the GPT
+# table... If the GPT table has less than 128 entries, this may even
+# happen for assumed sector sizes as small as 4k
+# This could be solved by checking for the presence of the backup GPT
+# header as well, but that makes the logic extremely complex
+##0 name gpt-mbr-partition
+##>(8.l*8192) string EFI\ PART
+##>>(8.l*8192) use gpt-mbr-type
+##>>&-8 use gpt-table
+##>>0 ubyte x of 8192 bytes
+##>(8.l*8192) string !EFI\ PART
+##>>(8.l*4096) string EFI\ PART GPT partition table
+##>>>0 use gpt-mbr-type
+##>>>&-8 use gpt-table
+##>>>0 ubyte x of 4096 bytes
+##>>(8.l*4096) string !EFI\ PART
+##>>>(8.l*2048) string EFI\ PART GPT partition table
+##>>>>0 use gpt-mbr-type
+##>>>>&-8 use gpt-table
+##>>>>0 ubyte x of 2048 bytes
+##>>>(8.l*2048) string !EFI\ PART
+##>>>>(8.l*1024) string EFI\ PART GPT partition table
+##>>>>>0 use gpt-mbr-type
+##>>>>>&-8 use gpt-table
+##>>>>>0 ubyte x of 1024 bytes
+##>>>>(8.l*1024) string !EFI\ PART
+##>>>>>(8.l*512) string EFI\ PART GPT partition table
+##>>>>>>0 use gpt-mbr-type
+##>>>>>>&-8 use gpt-table
+##>>>>>>0 ubyte x of 512 bytes
+
+# Print details of MBR type for a GPT-disk
+# Calling code ensures that there is only one 0xee partition.
+0 name gpt-mbr-type
+# GPT with protective MBR entry in partition 1
+>450 ubyte 0xee
+>>454 ulelong 1
+>>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
+>>454 ulelong !1 \b (nonstandard: not at LBA 1)
+# GPT with protective MBR entry in partition 2
+>466 ubyte 0xee
+>>470 ulelong 1
+>>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
+>>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
+>>470 ulelong !1 \b (nonstandard: not at LBA 1)
+# GPT with protective MBR entry in partition 3
+>482 ubyte 0xee
+>>486 ulelong 1
+>>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
+>>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
+>>486 ulelong !1 \b (nonstandard: not at LBA 1)
+# GPT with protective MBR entry in partition 4
+>498 ubyte 0xee
+>>502 ulelong 1
+>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
+>>502 ulelong !1 \b (nonstandard: not at LBA 1)
+
+# Print the information from a GPT partition table structure
+0 name gpt-table
+>10 uleshort x \b, version %u
+>8 uleshort x \b.%u
+>56 ulelong x \b, GUID: %08x
+>60 uleshort x \b-%04x
+>62 uleshort x \b-%04x
+>64 ubeshort x \b-%04x
+>66 ubeshort x \b-%04x
+>68 ubelong x \b%08x
+#>80 uleshort x \b, %d partition entries
+>32 ulequad+1 x \b, disk size: %lld sectors
+
+# In case a GPT data-structure is at LBA 0, report it as well
+# This covers systems which are not GPT-aware, and which show
+# and allow access to the protective partition. This code will
+# detect the contents of such a partition.
+0 string EFI\ PART GPT data structure (nonstandard: at LBA 0)
+>0 use gpt-table
+>0 ubyte x (sector size unknown)
+
+
+
+#------------------------------------------------------------------------------
# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $
# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
#
@@ -7873,15 +9861,15 @@
# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
#------------------------------------------------------------------------------
-# $File: graphviz,v 1.7 2009/09/19 16:28:09 christos Exp $
+# $File: graphviz,v 1.8 2014/06/03 19:01:34 christos Exp $
# graphviz: file(1) magic for http://www.graphviz.org/
# FIXME: These patterns match too generally. For example, the first
# line matches a LaTeX file containing the word "graph" (with a {
# following later) and the second line matches this file.
-#0 regex/100 [\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{ graphviz graph text
+#0 regex/100l [\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{ graphviz graph text
#!:mime text/vnd.graphviz
-#0 regex/100 [\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{ graphviz digraph text
+#0 regex/100l [\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{ graphviz digraph text
#!:mime text/vnd.graphviz
#------------------------------------------------------------------------------
@@ -7933,12 +9921,28 @@
>3 string >3 v.%.1s (unknown details)
#------------------------------------------------------------------------------
-# $File: hitachi-sh,v 1.5 2009/09/19 16:28:09 christos Exp $
+# $File: guile,v 1.1 2011/12/16 17:44:33 christos Exp $
+# Guile file magic from <dalepsmith at gmail.com>
+# http://www.gnu.org/s/guile/
+# http://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250
+
+0 string GOOF---- Guile Object
+>8 string LE \b, little endian
+>8 string BE \b, big endian
+>11 string 4 \b, 32bit
+>11 string 8 \b, 64bit
+>13 regex .\.. \b, bytecode v%s
+
+#------------------------------------------------------------------------------
+# $File: hitachi-sh,v 1.6 2013/01/29 19:31:33 christos Exp $
# hitach-sh: file(1) magic for Hitachi Super-H
#
# Super-H COFF
#
+# below test line conflicts with 2nd NTFS filesystem sector
0 beshort 0x0500 Hitachi SH big-endian COFF
+# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR
+#0 ubelong&0xFFFFNMPQ 0x0500NMPQ Hitachi SH big-endian COFF
>18 beshort&0x0002 =0x0000 object
>18 beshort&0x0002 =0x0002 executable
>18 beshort&0x0008 =0x0008 \b, stripped
@@ -7952,7 +9956,7 @@
#------------------------------------------------------------------------------
-# $File: hp,v 1.23 2009/09/19 16:28:09 christos Exp $
+# $File: hp,v 1.24 2014/04/30 21:41:02 christos Exp $
# hp: file(1) magic for Hewlett Packard machines (see also "printer")
#
# XXX - somebody should figure out whether any byte order needs to be
@@ -7993,10 +9997,10 @@
#### Old Apollo stuff
0 beshort 0627 Apollo m68k COFF executable
>18 beshort ^040000 not stripped
->22 beshort >0 - version %ld
+>22 beshort >0 - version %d
0 beshort 0624 apollo a88k COFF executable
>18 beshort ^040000 not stripped
->22 beshort >0 - version %ld
+>22 beshort >0 - version %d
0 long 01203604016 TML 0123 byte-order format
0 long 01702407010 TML 1032 byte-order format
0 long 01003405017 TML 2301 byte-order format
@@ -8080,17 +10084,17 @@
#### 500
0 long 0x02080106 HP s500 relocatable executable
->16 long >0 - version %ld
+>16 long >0 - version %d
0 long 0x02080107 HP s500 executable
->16 long >0 - version %ld
+>16 long >0 - version %d
0 long 0x02080108 HP s500 pure executable
->16 long >0 - version %ld
+>16 long >0 - version %d
#### 200
0 belong 0x020c0108 HP s200 pure executable
->4 beshort >0 - version %ld
+>4 beshort >0 - version %d
>8 belong &0x80000000 save fp regs
>8 belong &0x40000000 dynamically linked
>8 belong &0x20000000 debuggable
@@ -8097,7 +10101,7 @@
>36 belong >0 not stripped
0 belong 0x020c0107 HP s200 executable
->4 beshort >0 - version %ld
+>4 beshort >0 - version %d
>8 belong &0x80000000 save fp regs
>8 belong &0x40000000 dynamically linked
>8 belong &0x20000000 debuggable
@@ -8104,7 +10108,7 @@
>36 belong >0 not stripped
0 belong 0x020c010b HP s200 demand-load executable
->4 beshort >0 - version %ld
+>4 beshort >0 - version %d
>8 belong &0x80000000 save fp regs
>8 belong &0x40000000 dynamically linked
>8 belong &0x20000000 debuggable
@@ -8111,7 +10115,7 @@
>36 belong >0 not stripped
0 belong 0x020c0106 HP s200 relocatable executable
->4 beshort >0 - version %ld
+>4 beshort >0 - version %d
>6 beshort >0 - highwater %d
>8 belong &0x80000000 save fp regs
>8 belong &0x20000000 debuggable
@@ -8118,20 +10122,20 @@
>8 belong &0x10000000 PIC
0 belong 0x020a0108 HP s200 (2.x release) pure executable
->4 beshort >0 - version %ld
+>4 beshort >0 - version %d
>36 belong >0 not stripped
0 belong 0x020a0107 HP s200 (2.x release) executable
->4 beshort >0 - version %ld
+>4 beshort >0 - version %d
>36 belong >0 not stripped
0 belong 0x020c010e HP s200 shared library
->4 beshort >0 - version %ld
+>4 beshort >0 - version %d
>6 beshort >0 - highwater %d
>36 belong >0 not stripped
0 belong 0x020c010d HP s200 dynamic load library
->4 beshort >0 - version %ld
+>4 beshort >0 - version %d
>6 beshort >0 - highwater %d
>36 belong >0 not stripped
@@ -8144,7 +10148,7 @@
0 long 0x015821a6 HP core file
0 long 0x4da7eee8 HP-WINDOWS font
->8 byte >0 - version %ld
+>8 byte >0 - version %d
0 string Bitmapfile HP Bitmapfile
0 string IMGfile CIS compimg HP Bitmapfile
@@ -8417,7 +10421,7 @@
#2 string #HUPAIR Human68k hupair R executable
#------------------------------------------------------------------------------
-# $File: ibm370,v 1.8 2009/09/19 16:28:09 christos Exp $
+# $File: ibm370,v 1.9 2014/04/30 21:41:02 christos Exp $
# ibm370: file(1) magic for IBM 370 and compatibles.
#
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
@@ -8453,19 +10457,19 @@
>12 belong >0 not stripped
0 beshort 0531 SVR2 executable (Amdahl-UTS)
>12 belong >0 not stripped
->24 belong >0 - version %ld
+>24 belong >0 - version %d
0 beshort 0534 SVR2 pure executable (Amdahl-UTS)
>12 belong >0 not stripped
->24 belong >0 - version %ld
+>24 belong >0 - version %d
0 beshort 0530 SVR2 pure executable (USS/370)
>12 belong >0 not stripped
->24 belong >0 - version %ld
+>24 belong >0 - version %d
0 beshort 0535 SVR2 executable (USS/370)
>12 belong >0 not stripped
->24 belong >0 - version %ld
+>24 belong >0 - version %d
#------------------------------------------------------------------------------
-# $File: ibm6000,v 1.9 2009/09/19 16:28:09 christos Exp $
+# $File: ibm6000,v 1.12 2013/09/16 15:12:42 christos Exp $
# ibm6000: file(1) magic for RS/6000 and the RT PC.
#
0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
@@ -8483,9 +10487,71 @@
0 string \<aiaff> archive
0 string \<bigaf> archive (big format)
+0 beshort 0x01f7 64-bit XCOFF executable or object module
+>20 belong 0 not stripped
+# GRR: this test is still too general as it catches also many FATs of DOS filesystems
+4 belong &0x0feeddb0
+# real core dump could not be 32-bit and 64-bit together
+>7 byte&0x03 !3 AIX core file
+>>1 byte &0x01 fulldump
+>>7 byte &0x01 32-bit
+>>>0x6e0 string >\0 \b, %s
+>>7 byte &0x02 64-bit
+>>>0x524 string >\0 \b, %s
#------------------------------------------------------------------------------
-# $File: iff,v 1.12 2009/09/19 16:28:09 christos Exp $
+# $File: icc,v 1.1 2013/01/08 01:43:18 christos Exp $
+# icc: file(1) magic for International Color Consortium file formats
+
+#
+# Color profiles as per the ICC's "Image technology colour management -
+# Architecture, profile format, and data structure" specification.
+# See
+#
+# http://www.color.org/specification/ICC1v43_2010-12.pdf
+#
+# for Specification ICC.1:2010 (Profile version 4.3.0.0).
+#
+# Bytes 36 to 39 contain a generic profile file signature of "acsp";
+# bytes 40 to 43 "may be used to identify the primary platform/operating
+# system framework for which the profile was created".
+#
+# There are other fields that might be worth dumping as well.
+#
+
+# This appears to be what's used for Apple ColorSync profiles.
+# Instead of adding that, Apple just changed the generic "acsp" entry
+# to be for "ColorSync ICC Color Profile" rather than "Kodak Color
+# Management System, ICC Profile".
+# Yes, it's "APPL", not "AAPL"; see the spec.
+36 string acspAPPL ColorSync ICC Profile
+!:mime application/vnd.iccprofile
+
+# Microsoft ICM color profile
+36 string acspMSFT Microsoft ICM Color Profile
+!:mime application/vnd.iccprofile
+
+# Yes, that's a blank after "SGI".
+36 string acspSGI\ SGI ICC Profile
+!:mime application/vnd.iccprofile
+
+# XXX - is this what's used for the Sun KCMS or not? The standard file
+# uses just "acsp" for that, but Apple's file uses it for "ColorSync",
+# and there *is* an identified "primary platform" value of SUNW.
+36 string acspSUNW Sun KCMS ICC Profile
+!:mime application/vnd.iccprofile
+
+# Any other profile.
+# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles,
+# and use "acsp" for everything else and dump the "primary platform"
+# string in those cases?
+36 string acsp ICC Profile
+!:mime application/vnd.iccprofile
+
+
+
+#------------------------------------------------------------------------------
+# $File: iff,v 1.13 2011/09/06 11:00:06 christos Exp $
# iff: file(1) magic for Interchange File Format (see also "audio" & "images")
#
# Daniel Quinlan (quinlan at yggdrasil.com) -- IFF was designed by Electronic
@@ -8537,6 +10603,13 @@
>8 string AMFF \b, AMFF AmigaMetaFile format
>8 string WZRD \b, WZRD StormWIZARD resource
>8 string DOC\ \b, DOC desktop publishing document
+>8 string WVQA \b, Westwood Studios VQA Multimedia,
+>>24 leshort x %d video frames,
+>>26 leshort x %d x
+>>28 leshort x %d
+>8 string MOVE \b, Wing Commander III Video
+>>12 string _PC_ \b, PC version
+>>12 string 3DO_ \b, 3DO version
# These go at the end of the iff rules
#
@@ -8549,7 +10622,7 @@
>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal)
#------------------------------------------------------------------------------
-# $File: images,v 1.70 2010/11/25 15:00:12 christos Exp $
+# $File: images,v 1.91 2014/04/30 21:41:02 christos Exp $
# images: file(1) magic for image formats (see also "iff", and "c-lang" for
# XPM bitmaps)
#
@@ -8567,31 +10640,59 @@
# `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
# `tgatoppm' recognizes a superset (Index may be anything)
1 belong&0xfff7ffff 0x01010000 Targa image data - Map
+!:strength + 2
>2 byte&8 8 - RLE
->12 leshort >0 %hd x
->14 leshort >0 %hd
+>12 leshort >0 %d x
+>14 leshort >0 %d
1 belong&0xfff7ffff 0x00020000 Targa image data - RGB
+!:strength + 2
>2 byte&8 8 - RLE
->12 leshort >0 %hd x
->14 leshort >0 %hd
+>12 leshort >0 %d x
+>14 leshort >0 %d
1 belong&0xfff7ffff 0x00030000 Targa image data - Mono
+!:strength + 2
>2 byte&8 8 - RLE
->12 leshort >0 %hd x
->14 leshort >0 %hd
+>12 leshort >0 %d x
+>14 leshort >0 %d
# PBMPLUS images
# The next byte following the magic is always whitespace.
-0 search/1 P1 Netpbm PBM image text
+# strength is changed to try these patterns before "x86 boot sector"
+0 search/1 P1
+>3 regex =[0-9]{0,50}\ [0-9]{0,50} Netpbm PBM image text
+>3 regex =[0-9]{1,50}\ \b, size = %sx
+>>3 regex =\ [0-9]{1,50} \b%s
+!:strength + 45
!:mime image/x-portable-bitmap
-0 search/1b P2 Netpbm PGM image text
+0 search/1 P2
+>3 regex =[0-9]{0,50}\ [0-9]{0,50} Netpbm PGM image text
+>3 regex =[0-9]{1,50}\ \b, size = %sx
+>>3 regex =\ [0-9]{1,50} \b%s
+!:strength + 45
!:mime image/x-portable-greymap
-0 search/1 P3 Netpbm PPM image text
+0 search/1 P3
+>3 regex =[0-9]{0,50}\ [0-9]{0,50} Netpbm PPM image text
+>3 regex =[0-9]{1,50}\ \b, size = %sx
+>>3 regex =\ [0-9]{1,50} \b%s
+!:strength + 45
!:mime image/x-portable-pixmap
-0 string P4 Netpbm PBM "rawbits" image data
+0 string P4
+>3 regex =[0-9]{0,50}\ [0-9]{0,50} Netpbm PBM "rawbits" image data
+>3 regex =[0-9]{1,50}\ \b, size = %sx
+>>3 regex =\ [0-9]{1,50} \b%s
+!:strength + 45
!:mime image/x-portable-bitmap
-0 string P5 Netpbm PGM "rawbits" image data
+0 string P5
+>3 regex =[0-9]{0,50}\ [0-9]{0,50} Netpbm PGM "rawbits" image data
+>3 regex =[0-9]{1,50}\ \b, size = %sx
+>>3 regex =\ [0-9]{1,50} \b%s
+!:strength + 45
!:mime image/x-portable-greymap
-0 string P6 Netpbm PPM "rawbits" image data
+0 string P6
+>3 regex =[0-9]{0,50}\ [0-9]{0,50} Netpbm PPM "rawbits" image data
+>3 regex =[0-9]{1,50}\ \b, size = %sx
+>>3 regex =\ [0-9]{1,50} \b%s
+!:strength + 45
!:mime image/x-portable-pixmap
0 string P7 Netpbm PAM image file
!:mime image/x-portable-pixmap
@@ -8639,6 +10740,11 @@
0 string II\x2a\x00 TIFF image data, little-endian
!:mime image/tiff
+0 string MM\x00\x2b Big TIFF image data, big-endian
+!:mime image/tiff
+0 string II\x2b\x00 Big TIFF image data, little-endian
+!:mime image/tiff
+
# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
# (Greg Roelofs, newt at uchicago.edu)
# (Albert Cahalan, acahalan at cs.uml.edu)
@@ -8647,8 +10753,8 @@
#
0 string \x89PNG\x0d\x0a\x1a\x0a PNG image data
!:mime image/png
->16 belong x \b, %ld x
->20 belong x %ld,
+>16 belong x \b, %d x
+>20 belong x %d,
>24 byte x %d-bit
>25 byte 0 grayscale,
>25 byte 2 \b/color RGB,
@@ -8683,8 +10789,8 @@
!:apple 8BIMGIFf
>4 string 7a \b, version 8%s,
>4 string 9a \b, version 8%s,
->6 leshort >0 %hd x
->8 leshort >0 %hd
+>6 leshort >0 %d x
+>8 leshort >0 %d
#>10 byte &0x80 color mapped,
#>10 byte&0x07 =0x00 2 colors
#>10 byte&0x07 =0x01 4 colors
@@ -8747,8 +10853,36 @@
# From: Herbert Rosmanith <herp at wildsau.idv.uni.linz.at>
0 string Sfff structured fax file
+# From: Joerg Jenderek <joerg.jen.der.ek at gmx.net>
+# most files with the extension .EPA and some with .BMP
+0 string \x11\x06 Award BIOS Logo, 136 x 84
+!:mime image/x-award-bioslogo
+0 string \x11\x09 Award BIOS Logo, 136 x 126
+!:mime image/x-award-bioslogo
+#0 string \x07\x1f BIOS Logo corrupted?
+# http://www.blackfiveservices.co.uk/awbmtools.shtml
+# http://biosgfx.narod.ru/v3/
+# http://biosgfx.narod.ru/abr-2/
+0 string AWBM
+>4 leshort <1981 Award BIOS bitmap
+!:mime image/x-award-bmp
+# image width is a multiple of 4
+>>4 leshort&0x0003 0
+>>>4 leshort x \b, %d
+>>>6 leshort x x %d
+>>4 leshort&0x0003 >0 \b,
+>>>4 leshort&0x0003 =1
+>>>>4 leshort x %d+3
+>>>4 leshort&0x0003 =2
+>>>>4 leshort x %d+2
+>>>4 leshort&0x0003 =3
+>>>>4 leshort x %d+1
+>>>6 leshort x x %d
+# at offset 8 starts imagedata followed by "RGB " marker
# PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt at uchicago.edu)
+# http://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\
+# 28bitmap_information_header.29
0 string BM
>14 leshort 12 PC bitmap, OS/2 1.x format
!:mime image/x-ms-bmp
@@ -8763,6 +10897,16 @@
>>18 lelong x \b, %d x
>>22 lelong x %d x
>>28 leshort x %d
+>14 leshort 124 PC bitmap, Windows 98/2000 and newer format
+!:mime image/x-ms-bmp
+>>18 lelong x \b, %d x
+>>22 lelong x %d x
+>>28 leshort x %d
+>14 leshort 108 PC bitmap, Windows 95/NT4 and newer format
+!:mime image/x-ms-bmp
+>>18 lelong x \b, %d x
+>>22 lelong x %d x
+>>28 leshort x %d
>14 leshort 128 PC bitmap, Windows NT/2000 format
!:mime image/x-ms-bmp
>>18 lelong x \b, %d x
@@ -8777,8 +10921,8 @@
#0 string BA PC bitmap array data
# XPM icons (Greg Roelofs, newt at uchicago.edu)
-# note possible collision with C/REXX entry in c-lang; currently commented out
0 search/1 /*\ XPM\ */ X pixmap image text
+!:mime image/x-xpmi
# Utah Raster Toolkit RLE images (janl at ifi.uio.no)
0 leshort 0xcc52 RLE image data,
@@ -8920,7 +11064,7 @@
>5 byte 0x00 (white background)
>5 byte 0xFF (black background)
-# Gürkan Sengün <gurkan at linuks.mine.nu>, www.linuks.mine.nu
+# Gurkan Sengun <gurkan at linuks.mine.nu>, www.linuks.mine.nu
# http://www.atarimax.com/jindroush.atari.org/afmtatr.html
0 leshort 0x0296 Atari ATR image
@@ -8945,38 +11089,39 @@
#>12 beshort 3 RP175
#>12 beshort 4 YUV
-#------------------------------------------------------------------------------
-#
-# Marco Schmidt (marcoschmidt at users.sourceforge.net) -- an image file format
-# for the EPOC operating system, which is used with PDAs like those from Psion
-#
-# see http://huizen.dds.nl/~frodol/psiconv/html/Index.html for a description
-# of various EPOC file formats
-
-0 string \x37\x00\x00\x10\x42\x00\x00\x10\x00\x00\x00\x00\x39\x64\x39\x47 EPOC MBM image file
-
# PCX image files
# From: Dan Fandrich <dan at coneharvesters.com>
-0 beshort 0x0a00 PCX ver. 2.5 image data
-0 beshort 0x0a02 PCX ver. 2.8 image data, with palette
-0 beshort 0x0a03 PCX ver. 2.8 image data, without palette
-0 beshort 0x0a04 PCX for Windows image data
-0 beshort 0x0a05 PCX ver. 3.0 image data
->4 leshort x bounding box [%hd,
->6 leshort x %hd] -
->8 leshort x [%hd,
->10 leshort x %hd],
->65 byte >1 %d planes each of
->3 byte x %hhd-bit
->68 byte 0 image,
->68 byte 1 colour,
->68 byte 2 grayscale,
->68 byte >2 image,
->68 byte <0 image,
->12 leshort >0 %hd x
->>14 leshort x %hd dpi,
->2 byte 0 uncompressed
->2 byte 1 RLE compressed
+# updated by Joerg Jenderek at Feb 2013 by http://de.wikipedia.org/wiki/PCX
+# http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
+# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000
+# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT
+0 ubelong&0xffF8fe00 0x0a000000
+# for PCX bit depth > 0
+>3 ubyte >0
+# test for valid versions
+>>1 ubyte <6
+>>>1 ubyte !1 PCX
+!:mime image/x-pcx
+#!:mime image/pcx
+>>>>1 ubyte 0 ver. 2.5 image data
+>>>>1 ubyte 2 ver. 2.8 image data, with palette
+>>>>1 ubyte 3 ver. 2.8 image data, without palette
+>>>>1 ubyte 4 for Windows image data
+>>>>1 ubyte 5 ver. 3.0 image data
+>>>>4 uleshort x bounding box [%d,
+>>>>6 uleshort x %d] -
+>>>>8 uleshort x [%d,
+>>>>10 uleshort x %d],
+>>>>65 ubyte >1 %d planes each of
+>>>>3 ubyte x %d-bit
+>>>>68 byte 1 colour,
+>>>>68 byte 2 grayscale,
+# this should not happen
+>>>>68 default x image,
+>>>>12 leshort >0 %d x
+>>>>>14 uleshort x %d dpi,
+>>>>2 byte 0 uncompressed
+>>>>2 byte 1 RLE compressed
# Adobe Photoshop
# From: Asbjoern Sloth Toennesen <asbjorn at lila.io>
@@ -9098,7 +11243,7 @@
# Author: Hans-Joachim Baader <hjb at pro-linux.de>
0 string PaRtImAgE-VoLuMe PartImage
>0x0020 string 0.6.1 file version %s
->>0x0060 lelong >-1 volume %ld
+>>0x0060 lelong >-1 volume %d
#>>0x0064 8 byte identifier
#>>0x007c reserved
>>0x0200 string >\0 type %s
@@ -9121,8 +11266,8 @@
# Kodak Cineon format for scanned negatives
# http://www.kodak.com/US/en/motion/support/dlad/
0 lelong 0xd75f2a80 Cineon image data
->200 belong >0 \b, %ld x
->204 belong >0 %ld
+>200 belong >0 \b, %d x
+>204 belong >0 %d
# Bio-Rad .PIC is an image format used by microscope control systems
@@ -9134,10 +11279,10 @@
14 leshort <2
>62 leshort <2
>>54 leshort 12345 Bio-Rad .PIC Image File
->>>0 leshort >0 %hd x
->>>2 leshort >0 %hd,
+>>>0 leshort >0 %d x
+>>>2 leshort >0 %d,
>>>4 leshort =1 1 image in file
->>>4 leshort >1 %hd images in file
+>>>4 leshort >1 %d images in file
# From Jan "Yenya" Kasprzak <kas at fi.muni.cz>
# The description of *.mrw format can be found at
@@ -9159,9 +11304,61 @@
>12 string THUM DjVu page thumbnails
!:mime image/vnd.djvu
+# Originally by Marc Espie
+# Modified by Robert Minsk <robertminsk at yahoo.com>
+# http://www.openexr.com/openexrfilelayout.pdf
+0 lelong 20000630 OpenEXR image data,
+!:mime image/x-exr
+>4 lelong&0x000000ff x version %d,
+>4 lelong ^0x00000200 storage: scanline
+>4 lelong &0x00000200 storage: tiled
+>8 search/0x1000 compression\0 \b, compression:
+>>&16 byte 0 none
+>>&16 byte 1 rle
+>>&16 byte 2 zips
+>>&16 byte 3 zip
+>>&16 byte 4 piz
+>>&16 byte 5 pxr24
+>>&16 byte 6 b44
+>>&16 byte 7 b44a
+>>&16 byte >7 unknown
+>8 search/0x1000 dataWindow\0 \b, dataWindow:
+>>&10 lelong x (%d
+>>&14 lelong x %d)-
+>>&18 lelong x \b(%d
+>>&22 lelong x %d)
+>8 search/0x1000 displayWindow\0 \b, displayWindow:
+>>&10 lelong x (%d
+>>&14 lelong x %d)-
+>>&18 lelong x \b(%d
+>>&22 lelong x %d)
+>8 search/0x1000 lineOrder\0 \b, lineOrder:
+>>&14 byte 0 increasing y
+>>&14 byte 1 decreasing y
+>>&14 byte 2 random y
+>>&14 byte >2 unknown
-# From Marc Espie
-0 lelong 20000630 OpenEXR image data
+# SMPTE Digital Picture Exchange Format, SMPTE DPX
+#
+# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital
+# Moving-Picture Exchange (DPX), v1.0, 18 February 1994
+# Robert Minsk <robertminsk at yahoo.com>
+0 string SDPX DPX image data, big-endian,
+!:mime image/x-dpx
+>768 beshort <4
+>>772 belong x %dx
+>>776 belong x \b%d,
+>768 beshort >3
+>>776 belong x %dx
+>>772 belong x \b%d,
+>768 beshort 0 left to right/top to bottom
+>768 beshort 1 right to left/top to bottom
+>768 beshort 2 left to right/bottom to top
+>768 beshort 3 right to left/bottom to top
+>768 beshort 4 top to bottom/left to right
+>768 beshort 5 top to bottom/right to left
+>768 leshort 6 bottom to top/left to right
+>768 leshort 7 bottom to top/right to left
# From: Tom Hilinski <tom.hilinski at comcast.net>
# http://www.unidata.ucar.edu/packages/netcdf/
@@ -9174,7 +11371,16 @@
!:mime application/x-hdf
0 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) data
!:mime application/x-hdf
+512 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 512 bytes user block
+!:mime application/x-hdf
+1024 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 1k user block
+!:mime application/x-hdf
+2048 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 2k user block
+!:mime application/x-hdf
+4096 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 4k user block
+!:mime application/x-hdf
+
# From: Tobias Burnus <burnus at net-b.de>
# Xara (for a while: Corel Xara) is a graphic package, see
# http://www.xara.com/ for Windows and as GPL application for Linux
@@ -9209,11 +11415,40 @@
# From Tano M Fotang <mfotang at quanteq.com>
0 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data
-# JPEG 2000 Code Stream Bitmap
-# From Petr Splichal <psplicha at redhat.com>
-0 string \xFF\x4F\xFF\x51\x00 JPEG-2000 Code Stream Bitmap data
+# Type: PCO B16 image files
+# URL: http://www.pco.de/fileadmin/user_upload/db/download/MA_CWDCOPIE_0412b.pdf
+# From: Florian Philipp <florian.philipp at binarywings.net>
+# Extension: .b16
+# Description: Pixel image format produced by PCO Camware, typically used
+# together with PCO cameras.
+# Note: Different versions exist for e.g. 8 bit and 16 bit images.
+# Documentation is incomplete.
+0 string/b PCO- PCO B16 image data
+>12 lelong x \b, %dx
+>16 lelong x \b%d
+>20 lelong 0 \b, short header
+>20 lelong -1 \b, extended header
+>>24 lelong 0 \b, grayscale
+>>>36 lelong 0 linear LUT
+>>>36 lelong 1 logarithmic LUT
+>>>28 lelong x [%d
+>>>32 lelong x \b,%d]
+>>24 lelong 1 \b, color
+>>>64 lelong 0 linear LUT
+>>>64 lelong 1 logarithmic LUT
+>>>40 lelong x r[%d
+>>>44 lelong x \b,%d]
+>>>48 lelong x g[%d
+>>>52 lelong x \b,%d]
+>>>56 lelong x b[%d
+>>>60 lelong x \b,%d]
-# From: Rick Richardson <rick.richardson at comcast.net>
+# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches
+# From: Markus Heidelberg <markus.heidelberg at web.de>
+0 string/t [BitmapInfo2] Polar Monitor Bitmap text
+!:mime image/x-polar-monitor-bitmap
+
+# From: Rick Richardson <rickrich at gmail.com>
0 string GARMIN\ BITMAP\ 01 Garmin Bitmap file
# Type: Ulead Photo Explorer5 (.pe5)
@@ -9278,6 +11513,11 @@
# From: "Tano M. Fotang" <mfotang at quanteq.com>
0 string \x46\x4d\x52\x00 ISO/IEC 19794-2 Format Minutiae Record (FMR)
+# WEBP https://developers.google.com/speed/webp/docs/riff_container
+0 string RIFF
+>8 string WEBP Web/P image data
+>>4 lelong x \b, %d bytes
+
#------------------------------------------------------------------------------
# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $
# inform: file(1) magic for Inform interactive fiction language
@@ -9288,7 +11528,7 @@
0 search/100/cW constant\ story Inform source text
#------------------------------------------------------------------------------
-# $File: intel,v 1.8 2009/09/19 16:28:10 christos Exp $
+# $File: intel,v 1.12 2014/04/30 21:41:02 christos Exp $
# intel: file(1) magic for x86 Unix
#
# Various flavors of x86 UNIX executable/object (other than Xenix, which
@@ -9304,10 +11544,10 @@
#
0 leshort 0502 basic-16 executable
>12 lelong >0 not stripped
-#>22 leshort >0 - version %ld
+#>22 leshort >0 - version %d
0 leshort 0503 basic-16 executable (TV)
>12 lelong >0 not stripped
-#>22 leshort >0 - version %ld
+#>22 leshort >0 - version %d
0 leshort 0510 x86 executable
>12 lelong >0 not stripped
0 leshort 0511 x86 executable (TV)
@@ -9314,18 +11554,18 @@
>12 lelong >0 not stripped
0 leshort =0512 iAPX 286 executable small model (COFF)
>12 lelong >0 not stripped
-#>22 leshort >0 - version %ld
+#>22 leshort >0 - version %d
0 leshort =0522 iAPX 286 executable large model (COFF)
>12 lelong >0 not stripped
-#>22 leshort >0 - version %ld
+#>22 leshort >0 - version %d
# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
0 leshort =0514 80386 COFF executable
>12 lelong >0 not stripped
->22 leshort >0 - version %ld
+>22 leshort >0 - version %d
# rom: file(1) magic for BIOS ROM Extensions found in intel machines
# mapped into memory between 0xC0000 and 0xFFFFF
-# From Gürkan Sengün <gurkan at linuks.mine.nu>, www.linuks.mine.nu
+# From Gurkan Sengun <gurkan at linuks.mine.nu>, www.linuks.mine.nu
0 beshort 0x55AA BIOS (ia32) ROM Ext.
>5 string USB USB
>7 string LDR UNDI image
@@ -9335,6 +11575,11 @@
>42 string PROMISE Promise
>2 byte x (%d*512)
+# Flash descriptors for Intel SPI flash roms.
+# From Dr. Jesus <j at hug.gs>
+0 lelong 0x0ff0a55a Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step
+16 lelong 0x0ff0a55a Intel serial flash for PCH ROM
+
#------------------------------------------------------------------------------
# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $
# interleaf: file(1) magic for InterLeaf TPS:
@@ -9418,7 +11663,7 @@
>20 long x stblsize %d
#------------------------------------------------------------------------------
-# $File: isz,v 1.1 2010/03/27 16:17:09 christos Exp $
+# $File: isz,v 1.3 2014/04/30 21:41:02 christos Exp $
# ISO Zipped file format
# http://www.ezbsystems.com/isz/iszspec.txt
0 string IsZ! ISO Zipped file
@@ -9433,7 +11678,7 @@
#>36 lelong x \b, block size %u
#------------------------------------------------------------
-# $File: java,v 1.12 2009/09/19 16:28:10 christos Exp $
+# $File: java,v 1.16 2013/09/24 20:22:03 christos Exp $
# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
# same magic number, 0xcafebabe, so they are both handled
# in the entry called "cafebabe".
@@ -9448,18 +11693,29 @@
0 belong 0xcececece Java JCE KeyStore
!:mime application/x-java-jce-keystore
-# Dalvik .dex format. http://retrodev.com/android/dexformat.html
-# From <mkf at google.com> "Mike Fleming"
-0 string dex\n
->0 regex dex\n[0-9][0-9][0-9]\0 Dalvik dex file
->4 string >000 version %s
-0 string dey\n
->0 regex dey\n[0-9][0-9][0-9]\0 Dalvik dex file (optimized for host)
->4 string >000 version %s
+# Java source
+0 regex ^import.*;$ Java source
+!:mime text/x-java
+#------------------------------------------------------------------------------
+# $File: javascript,v 1.1 2012/06/16 13:30:36 christos Exp $
+# javascript: magic for javascript and node.js scripts.
+#
+0 search/1/w #!/bin/node Node.js script text executable
+!:mime application/javascript
+0 search/1/w #!/usr/bin/node Node.js script text executable
+!:mime application/javascript
+0 search/1/w #!/bin/nodejs Node.js script text executable
+!:mime application/javascript
+0 search/1/w #!/usr/bin/nodejs Node.js script text executable
+!:mime application/javascript
+0 search/1 #!/usr/bin/env\ node Node.js script text executable
+!:mime application/javascript
+0 search/1 #!/usr/bin/env\ nodejs Node.js script text executable
+!:mime application/javascript
#------------------------------------------------------------------------------
-# $File: jpeg,v 1.16 2011/01/04 19:29:32 rrt Exp $
+# $File: jpeg,v 1.19 2013/02/04 15:50:03 christos Exp $
# JPEG images
# SunOS 5.5.1 had
#
@@ -9471,7 +11727,7 @@
0 beshort 0xffd8 JPEG image data
!:mime image/jpeg
!:apple 8BIMJPEG
-!:strength +1
+!:strength +2
>6 string JFIF \b, JFIF standard
# The following added by Erik Rossen <rossen at freesurf.ch> 1999-09-06
# in a vain attempt to add image size reporting for JFIF. Note that these
@@ -9612,7 +11868,20 @@
0 string hsi1 JPEG image data, HSI proprietary
# From: David Santinoli <david at santinoli.com>
-0 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 image data
+0 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000
+# From: Johan van der Knijff <johan.vanderknijff at kb.nl>
+# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes
+# https://github.com/bitsgalore/jp2kMagic
+#
+# Now read value of 'Brand' field, which yields a few possibilities:
+>20 string \x6a\x70\x32\x20 Part 1 (JP2)
+!:mime image/jp2
+>20 string \x6a\x70\x78\x20 Part 2 (JPX)
+!:mime image/jpx
+>20 string \x6a\x70\x6d\x20 Part 6 (JPM)
+!:mime image/jpm
+>20 string \x6d\x6a\x70\x32 Part 3 (MJ2)
+!:mime video/mj2
# Type: JPEG 2000 codesream
# From: Mathieu Malaterre <mathieu.malaterre at gmail.com>
@@ -9620,13 +11889,13 @@
45 beshort 0xff52
#------------------------------------------------------------------------------
-# $File: karma,v 1.6 2009/09/19 16:28:10 christos Exp $
+# $File: karma,v 1.7 2014/04/30 21:41:02 christos Exp $
# karma: file(1) magic for Karma data files
#
# From <rgooch at atnf.csiro.au>
0 string KarmaRHD Version Karma Data Structure Version
->16 belong x %lu
+>16 belong x %u
#------------------------------------------------------------------------------
# $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $
@@ -9640,6 +11909,26 @@
!:mime text/x-xmcd
#------------------------------------------------------------------------------
+# $File: keepass,v 1.1 2012/12/24 22:14:56 christos Exp $
+# keepass: file(1) magic for KeePass file
+#
+# Keepass Password Safe:
+# * original one: http://keepass.info/
+# * *nix port: http://www.keepassx.org/
+# * android port: http://code.google.com/p/keepassdroid/
+
+0 lelong 0x9AA2D903 Keepass password database
+>4 lelong 0xB54BFB65 1.x KDB
+>>48 lelong >0 \b, %d groups
+>>52 lelong >0 \b, %d entries
+>>8 lelong&0x0f 1 \b, SHA-256
+>>8 lelong&0x0f 2 \b, AES
+>>8 lelong&0x0f 4 \b, RC4
+>>8 lelong&0x0f 8 \b, Twofish
+>>120 lelong >0 \b, %d key transformation rounds
+>4 lelong 0xB54BFB67 2.x KDBX
+
+#------------------------------------------------------------------------------
# $File: kml,v 1.3 2010/11/25 15:00:12 christos Exp $
# Type: Google KML, formerly Keyhole Markup Language
# Future development of this format has been handed
@@ -9700,7 +11989,7 @@
0 beshort 0x8000 lif file
#------------------------------------------------------------------------------
-# $File: linux,v 1.37 2010/12/17 14:19:51 christos Exp $
+# $File: linux,v 1.57 2014/05/20 20:10:17 christos Exp $
# linux: file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan at yggdrasil.com>
@@ -9736,8 +12025,11 @@
>28 long !0 not stripped
0 string \01\03\040\20 Minix-386 executable
>28 long !0 not stripped
+0 string \01\03\04\20 Minix-386 NSYM/GNU executable
+>28 long !0 not stripped
# core dump file, from Bill Reynolds <bill at goshawk.lanl.gov>
216 lelong 0421 Linux/i386 core file
+!:strength / 2
>220 string >\0 of '%s'
>200 lelong >0 (signal %d)
#
@@ -9746,7 +12038,10 @@
2 string LILO Linux/i386 LILO boot/chain loader
#
# Linux make config build file, from Ole Aamot <oka at oka.no>
-28 string make\ config Linux make config build file
+# Updated by Ken Sharp
+28 string make\ config Linux make config build file (old)
+49 search/70 Kernel\ Configuration Linux make config build file
+
#
# PSF fonts, from H. Peter Anvin <hpa at yggdrasil.com>
# Updated by Adam Buchbinder <adam.buchbinder at gmail.com>
@@ -9788,32 +12083,21 @@
# From Daniel Novotny <dnovotny at redhat.com>
# swap file for PowerPC
65526 string SWAPSPACE2 Linux/ppc swap file
-# ECOFF magic for OSF/1 and Linux (only tested under Linux though)
+16374 string SWAPSPACE2 Linux/ia64 swap file
#
-# from Erik Troan (ewt at redhat.com) examining od dumps, so this
-# could be wrong
-# updated by David Mosberger (davidm at azstarnet.com) based on
-# GNU BFD and MIPS info found below.
-#
-0 leshort 0x0183 ECOFF alpha
->24 leshort 0407 executable
->24 leshort 0410 pure
->24 leshort 0413 demand paged
->8 long >0 not stripped
->8 long 0 stripped
->23 leshort >0 - version %ld.
-#
# Linux kernel boot images, from Albert Cahalan <acahalan at cs.uml.edu>
# and others such as Axel Kohlmeyer <akohlmey at rincewind.chemie.uni-ulm.de>
-# and Nicol\xE1s Lichtmaier <nick at debian.org>
+# and Nicolas Lichtmaier <nick at debian.org>
# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
# Linux kernel boot images (i386 arch) (Wolfram Kleff)
514 string HdrS Linux kernel
+!:strength + 55
>510 leshort 0xAA55 x86 boot executable
>>518 leshort >0x1ff
>>>529 byte 0 zImage,
>>>529 byte 1 bzImage,
->>>(526.s+0x200) string >\0 version %s,
+>>>526 lelong >0
+>>>>(526.s+0x200) string >\0 version %s,
>>498 leshort 1 RO-rootFS,
>>498 leshort 0 RW-rootFS,
>>508 leshort >0 root_dev 0x%X,
@@ -9828,10 +12112,10 @@
>0x1e3 string Loading version 1.3.79 or older
>0x1e9 string Loading from prehistoric times
-# System.map files - Nicol\xE1s Lichtmaier <nick at debian.org>
+# System.map files - Nicolas Lichtmaier <nick at debian.org>
8 search/1 \ A\ _text Linux kernel symbol map text
-# LSM entries - Nicol\xE1s Lichtmaier <nick at debian.org>
+# LSM entries - Nicolas Lichtmaier <nick at debian.org>
0 search/1 Begin3 Linux Software Map entry text
0 search/1 Begin4 Linux Software Map entry text (new format)
@@ -9881,6 +12165,27 @@
>0x1e6 belong !0x454c4b53 style boot sector
############################################################################
+# Linux S390 kernel image
+# Created by: Jan Kaluza <jkaluza at redhat.com>
+8 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390
+>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc
+# 64bit
+>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel
+>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel
+>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel
+>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel
+# 32bit
+>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel
+>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel
+>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel
+>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel
+
+# Linux ARM compressed kernel image
+# From: Kevin Cernekee <cernekee at gmail.com>
+36 lelong 0x016f2818 Linux kernel ARM boot executable zImage (little-endian)
+36 belong 0x016f2818 Linux kernel ARM boot executable zImage (big-endian)
+
+############################################################################
# Linux 8086 executable
0 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless
>5 string .
@@ -9906,9 +12211,11 @@
# 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable
# SYSLINUX boot logo files (from 'ppmtolss16' sources)
-# http://syslinux.zytor.com/
-#
+# http://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename:
+# file extension .lss .16
0 lelong =0x1413f33d SYSLINUX' LSS16 image data
+# syslinux-4.05/mime/image/x-lss16.xml
+!:mime image/x-lss16
>4 leshort x \b, width %d
>6 leshort x \b, height %d
@@ -9944,19 +12251,55 @@
#
# 0x200 seems to be the common case
-0x218 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
+0x218 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager)
# read the offset to add to the start of the header, and the header
# start in 0x200
->(0x214.l+0x200) string >\0 , UUID: %s
+>&(&-12.l-0x21) byte x
+# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
+>>&0x0 string >\x2f \b, UUID: %.6s
+>>&0x6 string >\x2f \b-%.4s
+>>&0xa string >\x2f \b-%.4s
+>>&0xe string >\x2f \b-%.4s
+>>&0x12 string >\x2f \b-%.4s
+>>&0x16 string >\x2f \b-%.4s
+>>&0x1a string >\x2f \b-%.6s
+>>&0x20 lequad x \b, size: %lld
-0x018 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
->(0x014.l) string >\0 , UUID: %s
+0x018 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager)
+>&(&-12.l-0x21) byte x
+# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
+>>&0x0 string >\x2f \b, UUID: %.6s
+>>&0x6 string >\x2f \b-%.4s
+>>&0xa string >\x2f \b-%.4s
+>>&0xe string >\x2f \b-%.4s
+>>&0x12 string >\x2f \b-%.4s
+>>&0x16 string >\x2f \b-%.4s
+>>&0x1a string >\x2f \b-%.6s
+>>&0x20 lequad x \b, size: %lld
-0x418 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
->(0x414.l+0x400) string >\0 , UUID: %s
+0x418 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager)
+>&(&-12.l-0x21) byte x
+# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
+>>&0x0 string >\x2f \b, UUID: %.6s
+>>&0x6 string >\x2f \b-%.4s
+>>&0xa string >\x2f \b-%.4s
+>>&0xe string >\x2f \b-%.4s
+>>&0x12 string >\x2f \b-%.4s
+>>&0x16 string >\x2f \b-%.4s
+>>&0x1a string >\x2f \b-%.6s
+>>&0x20 lequad x \b, size: %lld
-0x618 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
->(0x614.l+0x600) string >\0 , UUID: %s
+0x618 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager)
+>&(&-12.l-0x21) byte x
+# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
+>>&0x0 string >\x2f \b, UUID: %.6s
+>>&0x6 string >\x2f \b-%.4s
+>>&0xa string >\x2f \b-%.4s
+>>&0xe string >\x2f \b-%.4s
+>>&0x12 string >\x2f \b-%.4s
+>>&0x16 string >\x2f \b-%.4s
+>>&0x1a string >\x2f \b-%.6s
+>>&0x20 lequad x \b, size: %lld
# LVM snapshot
# from Jason Farrel
@@ -9996,6 +12339,70 @@
>20 search/256 (name (name
>>&1 string x %s...)
+# Systemd journald files
+# See http://www.freedesktop.org/wiki/Software/systemd/journal-files/.
+# From: Zbigniew Jedrzejewski-Szmek <zbyszek at in.waw.pl>
+
+# check magic
+0 string LPKSHHRH
+# check that state is one of known values
+>16 ubyte&252 0
+# check that each half of three unique id128s is non-zero
+>>24 ubequad >0
+>>>32 ubequad >0
+>>>>40 ubequad >0
+>>>>>48 ubequad >0
+>>>>>>56 ubequad >0
+>>>>>>>64 ubequad >0 Journal file
+!:mime application/octet-stream
+# provide more info
+>>>>>>>>184 leqdate 0 empty
+>>>>>>>>16 ubyte 0 \b, offline
+>>>>>>>>16 ubyte 1 \b, online
+>>>>>>>>16 ubyte 2 \b, archived
+>>>>>>>>8 ulelong&1 1 \b, sealed
+>>>>>>>>12 ulelong&1 1 \b, compressed
+
+# BCache backing and cache devices
+# From: Gabriel de Perthuis <g2p.code at gmail.com>
+0x1008 lequad 8
+>0x1018 string \xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81 BCache
+>>0x1010 ulequad 0 cache device
+>>0x1010 ulequad 1 backing device
+>>0x1010 ulequad 3 cache device
+>>0x1010 ulequad 4 backing device
+>>0x1048 string >0 \b, label "%.32s"
+>>0x1028 ubelong x \b, uuid %08x
+>>0x102c ubeshort x \b-%04x
+>>0x102e ubeshort x \b-%04x
+>>0x1030 ubeshort x \b-%04x
+>>0x1032 ubelong x \b-%08x
+>>0x1036 ubeshort x \b%04x
+>>0x1038 ubelong x \b, set uuid %08x
+>>0x103c ubeshort x \b-%04x
+>>0x103e ubeshort x \b-%04x
+>>0x1040 ubeshort x \b-%04x
+>>0x1042 ubelong x \b-%08x
+>>0x1046 ubeshort x \b%04x
+
+# Linux device tree:
+# File format description can be found in the Linux kernel sources at
+# Documentation/devicetree/booting-without-of.txt
+# From Christoph Biedl
+0 belong 0xd00dfeed
+# structure and strings must be within blob
+>&(8.L) byte x
+>>&(12.L) byte x
+>>>20 belong >1 Device Tree Blob version %d
+>>>>4 belong x \b, size=%d
+>>>>20 belong >1
+>>>>>28 belong x \b, boot CPU=%d
+>>>>20 belong >2
+>>>>>32 belong x \b, string block size=%d
+>>>>20 belong >16
+>>>>>36 belong x \b, DT structure block size=%d
+
+
#------------------------------------------------------------------------------
# $File: lisp,v 1.23 2009/09/19 16:28:10 christos Exp $
# lisp: file(1) magic for lisp programs
@@ -10049,7 +12456,7 @@
!:mime text/texmacs
#------------------------------------------------------------------------------
-# $File: llvm,v 1.5 2010/09/20 18:55:20 rrt Exp $
+# $File: llvm,v 1.8 2013/01/12 03:09:51 christos Exp $
# llvm: file(1) magic for LLVM byte-codes
# URL: http://llvm.org/docs/BitCodeFormat.html
# From: Al Stone <ahs3 at fc.hp.com>
@@ -10058,11 +12465,19 @@
0 string llvc0 LLVM byte-codes, null compression
0 string llvc1 LLVM byte-codes, gzip compression
0 string llvc2 LLVM byte-codes, bzip2 compression
-0 string \xde\xc0\x17\x0b LLVM bitcode, wrapper
-0 string BC\xc0\xde LLVM bitcode
+0 lelong 0x0b17c0de LLVM bitcode, wrapper
+# Are these Mach-O ABI values? They appear to be.
+>16 lelong 0x01000007 x86_64
+>16 lelong 0x00000007 i386
+>16 lelong 0x00000012 ppc
+>16 lelong 0x01000012 ppc64
+>16 lelong 0x0000000c arm
+
+0 string BC\xc0\xde LLVM IR bitcode
+
#------------------------------------------------------------------------------
-# $File: lua,v 1.5 2009/09/19 16:28:10 christos Exp $
+# $File: lua,v 1.6 2013/01/09 16:23:17 christos Exp $
# lua: file(1) magic for Lua scripting language
# URL: http://www.lua.org/
# From: Reuben Thomas <rrt at sc3d.org>, Seo Sanghyeon <tinuviel at sparcs.kaist.ac.kr>
@@ -10081,6 +12496,7 @@
0 string \033Lua Lua bytecode,
>4 byte 0x50 version 5.0
>4 byte 0x51 version 5.1
+>4 byte 0x52 version 5.2
#------------------------------------------------------------------------------
# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $
@@ -10094,95 +12510,229 @@
>40 string x %s,
>72 string x %s]
>168 string x UUID: %s
+#------------------------------------------------------------------------------
+# $File: m4,v 1.1 2011/12/08 12:12:46 rrt Exp $
+# make: file(1) magic for M4 scripts
+#
+0 regex \^dnl\ M4 macro processor script text
+!:mime text/x-m4
#------------------------------------------------------------
-# $File: mach,v 1.9 2009/09/19 16:28:10 christos Exp $
+# $File: mach,v 1.19 2014/04/30 21:41:02 christos Exp $
# Mach has two magic numbers, 0xcafebabe and 0xfeedface.
# Unfortunately the first, cafebabe, is shared with
# Java ByteCode, so they are both handled in the file "cafebabe".
# The "feedface" ones are handled herein.
#------------------------------------------------------------
-0 lelong&0xfffffffe 0xfeedface Mach-O
+# if set, it's for the 64-bit version of the architecture
+# yes, this is separate from the low-order magic number bit
+# it's also separate from the "64-bit libraries" bit in the
+# upper 8 bits of the CPU subtype
+
+0 name mach-o-cpu
+>0 belong&0x01000000 0
+#
+# 32-bit ABIs.
+#
+# 1 vax
+>>0 belong&0x00ffffff 1
+>>>4 belong&0x00ffffff 0 vax
+>>>4 belong&0x00ffffff 1 vax11/780
+>>>4 belong&0x00ffffff 2 vax11/785
+>>>4 belong&0x00ffffff 3 vax11/750
+>>>4 belong&0x00ffffff 4 vax11/730
+>>>4 belong&0x00ffffff 5 uvaxI
+>>>4 belong&0x00ffffff 6 uvaxII
+>>>4 belong&0x00ffffff 7 vax8200
+>>>4 belong&0x00ffffff 8 vax8500
+>>>4 belong&0x00ffffff 9 vax8600
+>>>4 belong&0x00ffffff 10 vax8650
+>>>4 belong&0x00ffffff 11 vax8800
+>>>4 belong&0x00ffffff 12 uvaxIII
+>>>4 belong&0x00ffffff >12 vax subarchitecture=%d
+>>0 belong&0x00ffffff 2 romp
+>>0 belong&0x00ffffff 3 architecture=3
+>>0 belong&0x00ffffff 4 ns32032
+>>0 belong&0x00ffffff 5 ns32332
+>>0 belong&0x00ffffff 6 m68k
+# 7 x86
+>>0 belong&0x00ffffff 7
+>>>4 belong&0x0000000f 3 i386
+>>>4 belong&0x0000000f 4 i486
+>>>>4 belong&0x00fffff0 0
+>>>>4 belong&0x00fffff0 0x80 \bsx
+>>>4 belong&0x0000000f 5 i586
+>>>4 belong&0x0000000f 6
+>>>>4 belong&0x00fffff0 0 p6
+>>>>4 belong&0x00fffff0 0x10 pentium_pro
+>>>>4 belong&0x00fffff0 0x20 pentium_2_m0x20
+>>>>4 belong&0x00fffff0 0x30 pentium_2_m3
+>>>>4 belong&0x00fffff0 0x40 pentium_2_m0x40
+>>>>4 belong&0x00fffff0 0x50 pentium_2_m5
+>>>>4 belong&0x00fffff0 >0x50 pentium_2_m0x%x
+>>>4 belong&0x0000000f 7 celeron
+>>>>4 belong&0x00fffff0 0x00 \b_m0x%x
+>>>>4 belong&0x00fffff0 0x10 \b_m0x%x
+>>>>4 belong&0x00fffff0 0x20 \b_m0x%x
+>>>>4 belong&0x00fffff0 0x30 \b_m0x%x
+>>>>4 belong&0x00fffff0 0x40 \b_m0x%x
+>>>>4 belong&0x00fffff0 0x50 \b_m0x%x
+>>>>4 belong&0x00fffff0 0x60
+>>>>4 belong&0x00fffff0 0x70 \b_mobile
+>>>>4 belong&0x00fffff0 >0x70 \b_m0x%x
+>>>4 belong&0x0000000f 8 pentium_3
+>>>>4 belong&0x00fffff0 0x00
+>>>>4 belong&0x00fffff0 0x10 \b_m
+>>>>4 belong&0x00fffff0 0x20 \b_xeon
+>>>>4 belong&0x00fffff0 >0x20 \b_m0x%x
+>>>4 belong&0x0000000f 9 pentiumM
+>>>>4 belong&0x00fffff0 0x00
+>>>>4 belong&0x00fffff0 >0x00 \b_m0x%x
+>>>4 belong&0x0000000f 10 pentium_4
+>>>>4 belong&0x00fffff0 0x00
+>>>>4 belong&0x00fffff0 0x10 \b_m
+>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x
+>>>4 belong&0x0000000f 11 itanium
+>>>>4 belong&0x00fffff0 0x00
+>>>>4 belong&0x00fffff0 0x10 \b_2
+>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x
+>>>4 belong&0x0000000f 12 xeon
+>>>>4 belong&0x00fffff0 0x00
+>>>>4 belong&0x00fffff0 0x10 \b_mp
+>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x
+>>>4 belong&0x0000000f >12 ia32 family=%d
+>>>>4 belong&0x00fffff0 0x00
+>>>>4 belong&0x00fffff0 >0x00 model=%x
+>>0 belong&0x00ffffff 8 mips
+>>>4 belong&0x00ffffff 1 R2300
+>>>4 belong&0x00ffffff 2 R2600
+>>>4 belong&0x00ffffff 3 R2800
+>>>4 belong&0x00ffffff 4 R2000a
+>>>4 belong&0x00ffffff 5 R2000
+>>>4 belong&0x00ffffff 6 R3000a
+>>>4 belong&0x00ffffff 7 R3000
+>>>4 belong&0x00ffffff >7 subarchitecture=%d
+>>0 belong&0x00ffffff 9 ns32532
+>>0 belong&0x00ffffff 10 mc98000
+>>0 belong&0x00ffffff 11 hppa
+>>>4 belong&0x00ffffff 0 7100
+>>>4 belong&0x00ffffff 1 7100LC
+>>>4 belong&0x00ffffff >1 subarchitecture=%d
+>>0 belong&0x00ffffff 12 arm
+>>>4 belong&0x00ffffff 0
+>>>4 belong&0x00ffffff 1 subarchitecture=%d
+>>>4 belong&0x00ffffff 2 subarchitecture=%d
+>>>4 belong&0x00ffffff 3 subarchitecture=%d
+>>>4 belong&0x00ffffff 4 subarchitecture=%d
+>>>4 belong&0x00ffffff 5 \b_v4t
+>>>4 belong&0x00ffffff 6 \b_v6
+>>>4 belong&0x00ffffff 7 \b_v5tej
+>>>4 belong&0x00ffffff 8 \b_xscale
+>>>4 belong&0x00ffffff 9 \b_v7
+>>>4 belong&0x00ffffff 10 \b_v7f
+>>>4 belong&0x00ffffff 11 subarchitecture=%d
+>>>4 belong&0x00ffffff 12 \b_v7k
+>>>4 belong&0x00ffffff >12 subarchitecture=%d
+# 13 m88k
+>>0 belong&0x00ffffff 13
+>>>4 belong&0x00ffffff 0 mc88000
+>>>4 belong&0x00ffffff 1 mc88100
+>>>4 belong&0x00ffffff 2 mc88110
+>>>4 belong&0x00ffffff >2 mc88000 subarchitecture=%d
+>>0 belong&0x00ffffff 14 SPARC
+>>0 belong&0x00ffffff 15 i860g
+>>0 belong&0x00ffffff 16 alpha
+>>0 belong&0x00ffffff 17 rs6000
+>>0 belong&0x00ffffff 18 ppc
+>>>4 belong&0x00ffffff 0
+>>>4 belong&0x00ffffff 1 \b_601
+>>>4 belong&0x00ffffff 2 \b_602
+>>>4 belong&0x00ffffff 3 \b_603
+>>>4 belong&0x00ffffff 4 \b_603e
+>>>4 belong&0x00ffffff 5 \b_603ev
+>>>4 belong&0x00ffffff 6 \b_604
+>>>4 belong&0x00ffffff 7 \b_604e
+>>>4 belong&0x00ffffff 8 \b_620
+>>>4 belong&0x00ffffff 9 \b_650
+>>>4 belong&0x00ffffff 10 \b_7400
+>>>4 belong&0x00ffffff 11 \b_7450
+>>>4 belong&0x00ffffff 100 \b_970
+>>>4 belong&0x00ffffff >100 subarchitecture=%d
+>>0 belong&0x00ffffff >18 architecture=%d
+>0 belong&0x01000000 0x01000000
+#
+# 64-bit ABIs.
+#
+>>0 belong&0x00ffffff 0 64-bit architecture=%d
+>>0 belong&0x00ffffff 1 64-bit architecture=%d
+>>0 belong&0x00ffffff 2 64-bit architecture=%d
+>>0 belong&0x00ffffff 3 64-bit architecture=%d
+>>0 belong&0x00ffffff 4 64-bit architecture=%d
+>>0 belong&0x00ffffff 5 64-bit architecture=%d
+>>0 belong&0x00ffffff 6 64-bit architecture=%d
+>>0 belong&0x00ffffff 7 x86_64
+>>>4 belong&0x00ffffff 0 subarchitecture=%d
+>>>4 belong&0x00ffffff 1 subarchitecture=%d
+>>>4 belong&0x00ffffff 2 subarchitecture=%d
+>>>4 belong&0x00ffffff 3
+>>>4 belong&0x00ffffff 4 \b_arch1
+>>>4 belong&0x00ffffff >4 subarchitecture=%d
+>>0 belong&0x00ffffff 8 64-bit architecture=%d
+>>0 belong&0x00ffffff 9 64-bit architecture=%d
+>>0 belong&0x00ffffff 10 64-bit architecture=%d
+>>0 belong&0x00ffffff 11 64-bit architecture=%d
+>>0 belong&0x00ffffff 12 64-bit architecture=%d
+>>0 belong&0x00ffffff 13 64-bit architecture=%d
+>>0 belong&0x00ffffff 14 64-bit architecture=%d
+>>0 belong&0x00ffffff 15 64-bit architecture=%d
+>>0 belong&0x00ffffff 16 64-bit architecture=%d
+>>0 belong&0x00ffffff 17 64-bit architecture=%d
+>>0 belong&0x00ffffff 18 ppc64
+>>>4 belong&0x00ffffff 0
+>>>4 belong&0x00ffffff 1 \b_601
+>>>4 belong&0x00ffffff 2 \b_602
+>>>4 belong&0x00ffffff 3 \b_603
+>>>4 belong&0x00ffffff 4 \b_603e
+>>>4 belong&0x00ffffff 5 \b_603ev
+>>>4 belong&0x00ffffff 6 \b_604
+>>>4 belong&0x00ffffff 7 \b_604e
+>>>4 belong&0x00ffffff 8 \b_620
+>>>4 belong&0x00ffffff 9 \b_650
+>>>4 belong&0x00ffffff 10 \b_7400
+>>>4 belong&0x00ffffff 11 \b_7450
+>>>4 belong&0x00ffffff 100 \b_970
+>>>4 belong&0x00ffffff >100 subarchitecture=%d
+>>0 belong&0x00ffffff >18 64-bit architecture=%d
+
+
+0 name mach-o-be
>0 byte 0xcf 64-bit
->12 lelong 1 object
->12 lelong 2 executable
->12 lelong 3 fixed virtual memory shared library
->12 lelong 4 core
->12 lelong 5 preload executable
->12 lelong 6 dynamically linked shared library
->12 lelong 7 dynamic linker
->12 lelong 8 bundle
->12 lelong 9 dynamically linked shared library stub
->12 lelong >9
->>12 lelong x filetype=%ld
->4 lelong <0
->>4 lelong x architecture=%ld
->4 lelong 1 vax
->4 lelong 2 romp
->4 lelong 3 architecture=3
->4 lelong 4 ns32032
->4 lelong 5 ns32332
->4 lelong 6 m68k
->4 lelong 7 i386
->4 lelong 8 mips
->4 lelong 9 ns32532
->4 lelong 10 architecture=10
->4 lelong 11 hppa
->4 lelong 12 acorn
->4 lelong 13 m88k
->4 lelong 14 sparc
->4 lelong 15 i860-big
->4 lelong 16 i860
->4 lelong 17 rs6000
->4 lelong 18 ppc
->4 lelong 16777234 ppc64
->4 lelong >16777234
->>4 lelong x architecture=%ld
-#
-0 belong&0xfffffffe 0xfeedface Mach-O
->3 byte 0xcf 64-bit
+>4 use mach-o-cpu
>12 belong 1 object
>12 belong 2 executable
>12 belong 3 fixed virtual memory shared library
>12 belong 4 core
>12 belong 5 preload executable
->12 belong 6 dynamically linked shared library
->12 belong 7 dynamic linker
+>12 belong 6 dynamically linked shared library
+>12 belong 7 dynamic linker
>12 belong 8 bundle
>12 belong 9 dynamically linked shared library stub
->12 belong >9
->>12 belong x filetype=%ld
->4 belong <0
->>4 belong x architecture=%ld
->4 belong 1 vax
->4 belong 2 romp
->4 belong 3 architecture=3
->4 belong 4 ns32032
->4 belong 5 ns32332
->4 belong 6 for m68k architecture
-# from NeXTstep 3.0 <mach/machine.h>
-# i.e. mc680x0_all, ignore
-# >>8 belong 1 (mc68030)
->>8 belong 2 (mc68040)
->>8 belong 3 (mc68030 only)
->4 belong 7 i386
->4 belong 8 mips
->4 belong 9 ns32532
->4 belong 10 architecture=10
->4 belong 11 hppa
->4 belong 12 acorn
->4 belong 13 m88k
->4 belong 14 sparc
->4 belong 15 i860-big
->4 belong 16 i860
->4 belong 17 rs6000
->4 belong 18 ppc
->4 belong 16777234 ppc64
->4 belong >16777234
->>4 belong x architecture=%ld
+>12 belong 10 dSYM companion file
+>12 belong 11 kext bundle
+>12 belong >11
+>>12 belong x filetype=%d
+#
+0 lelong&0xfffffffe 0xfeedface Mach-O
+!:strength +1
+>0 use \^mach-o-be
+
+0 belong&0xfffffffe 0xfeedface Mach-O
+!:strength +1
+>0 use mach-o-be
+
#------------------------------------------------------------------------------
-# $File: macintosh,v 1.21 2010/09/20 19:19:17 rrt Exp $
+# $File: macintosh,v 1.23 2013/11/19 18:47:58 christos Exp $
# macintosh description
#
# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
@@ -10445,6 +12995,9 @@
0 string $FL2 SPSS System File
>24 string x %s
+0 string $FL3 SPSS System File
+>24 string x %s
+
# Macintosh filesystem data
# From "Tom N Harris" <telliamed at mac.com>
# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson at alaska.net>
@@ -10467,7 +13020,7 @@
>0x412 beshort x number of blocks: %d,
>0x424 pstring x volume name: %s
-# "BD" is has many false positives
+# "BD" gives many false positives
#0x400 beshort 0x4244 Macintosh HFS data
#>0 beshort 0x4C4B (bootable)
#>0x40a beshort &0x8000 (locked)
@@ -10572,6 +13125,13 @@
>>&4 belong 0x504f5354 Mac OSX datafork font, PostScript
#------------------------------------------------------------------------------
+# $File: macos,v 1.1 2012/12/21 16:41:07 christos Exp $
+# MacOS files
+#
+
+0 string book\0\0\0\0mark\0\0\0\0 MacOS Alias file
+
+#------------------------------------------------------------------------------
# $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $
# magic: file(1) magic for magic files
#
@@ -10580,14 +13140,12 @@
>4 lelong x (version %d) (little endian)
0 belong 0xF11E041C magic binary file for file(1) cmd
>4 belong x (version %d) (big endian)
-
#------------------------------------------------------------------------------
-# $File: mail.news,v 1.18 2010/11/25 15:00:12 christos Exp $
+# $File: mail.news,v 1.22 2013/01/04 14:22:07 christos Exp $
# mail.news: file(1) magic for mail and news
#
# Unfortunately, saved netnews also has From line added in some news software.
#0 string From mail text
-# There are tests to ascmagic.c to cope with mail and news.
0 string/t Relay-Version: old news text
!:mime message/rfc822
0 string/t #!\ rnews batched news text
@@ -10598,8 +13156,10 @@
!:mime message/rfc822
0 string/t Pipe\ to mail piping text
!:mime message/rfc822
-0 string/t Return-Path: smtp mail text
+0 string/tc delivered-to: SMTP mail text
!:mime message/rfc822
+0 string/tc return-path: SMTP mail text
+!:mime message/rfc822
0 string/t Path: news text
!:mime message/news
0 string/t Xref: news text
@@ -10616,6 +13176,7 @@
# TNEF files...
0 lelong 0x223E9F78 Transport Neutral Encapsulation Format
+!:mime application/vnd.ms-tnef
# From: Kevin Sullivan <ksulliva at psc.edu>
0 string *mbx* MBX mail folder
@@ -10636,8 +13197,59 @@
#0 string \<!--\ MHonArc text/html; x-type=mhonarc
+# Cyrus: file(1) magic for compiled Cyrus sieve scripts
+# URL: http://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php
+# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master
+# From: Philipp Hahn <hahn at univention.de>
+
+# Compiled Cyrus sieve script
+0 string CyrSBytecode Cyrus sieve bytecode data,
+>12 belong =1 version 1, big-endian
+>12 lelong =1 version 1, little-endian
+>12 belong x version %d, network-endian
#------------------------------------------------------------------------------
-# $File: maple,v 1.6 2009/09/19 16:28:10 christos Exp $
+# $File: make,v 1.1 2011/12/08 12:12:46 rrt Exp $
+# make: file(1) magic for makefiles
+#
+0 regex \^CFLAGS makefile script text
+!:mime text/x-makefile
+0 regex \^LDFLAGS makefile script text
+!:mime text/x-makefile
+0 regex \^all: makefile script text
+!:mime text/x-makefile
+0 regex \^.PRECIOUS makefile script text
+!:mime text/x-makefile
+
+0 regex \^SUBDIRS automake makefile script text
+!:mime text/x-makefile
+
+
+#------------------------------------------------------------------------------
+# $File: map,v 1.1 2014/06/03 18:22:25 christos Exp $
+# map: file(1) magic for Map data
+#
+
+# Garmin .FIT files http://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
+8 string .FIT FIT Map data
+>15 byte 0
+>>35 belong x \b, unit id %d
+# 20 years after unix epoch
+>>39 lelong x \b, serial %u
+>>43 ledate/631152000 x \b, %s
+
+>>47 leshort x \b, manufacturer %d
+>>47 leshort 1 \b (garmin)
+>>49 leshort x \b, product %d
+>>53 byte x \b, type %d
+>>53 byte 1 \b (Device)
+>>53 byte 2 \b (Settings)
+>>53 byte 3 \b (Sports/Cycling)
+>>53 byte 4 \b (Activity)
+>>53 byte 8 \b (Elevations)
+>>53 byte 10 \b (Totals)
+
+#------------------------------------------------------------------------------
+# $File: maple,v 1.7 2013/01/11 16:45:23 christos Exp $
# maple: file(1) magic for maple files
# "H. Nanosecond" <aldomel at ix.netcom.com>
# Maple V release 4, a multi-purpose math program
@@ -10670,7 +13282,7 @@
# that is {VERSION major_version miunor_version computer_type version_string}
0 string {VERSION\ Maple worksheet
>9 string >\0 version %.1s.
->>>11 string >\0 %.1s
+>>11 string >\0 %.1s
# .mps
0 string \0\0\001$ Maple something
@@ -10692,7 +13304,35 @@
0 string #\r##\ <SHAREFILE= Maple something
0 string \r#\r##\ <SHAREFILE= Maple something
0 string #\ \r##\ <DESCRIBE> Maple something anomalous.
+#--------------------------------------------
+# marc21: file(1) magic for MARC 21 Format
+#
+# Kevin Ford (kefo at loc.gov)
+#
+# MARC21 formats are for the representation and communication
+# of bibliographic and related information in machine-readable
+# form. For more info, see http://www.loc.gov/marc/
+
+# leader position 20-21 must be 45
+20 string 45
+
+# leader starts with 5 digits, followed by codes specific to MARC format
+>0 regex/1l (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic
+!:mime application/marc
+>0 regex/1l (^[0-9]{5})[acdnosx][z] MARC21 Authority
+!:mime application/marc
+>0 regex/1l (^[0-9]{5})[cdn][uvxy] MARC21 Holdings
+!:mime application/marc
+0 regex/1l (^[0-9]{5})[acdn][w] MARC21 Classification
+!:mime application/marc
+>0 regex/1l (^[0-9]{5})[cdn][q] MARC21 Community
+!:mime application/marc
+
+# leader position 22-23, should be "00" but is it?
+>0 regex/1l (^.{21})([^0]{2}) (non-conforming)
+!:mime application/marc
+
#------------------------------------------------------------------------------
# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $
# mathcad: file(1) magic for Mathcad documents
@@ -10772,7 +13412,7 @@
#------------------------------------------------------------------------------
-# $File: matroska,v 1.6 2010/09/20 21:11:35 rrt Exp $
+# $File: matroska,v 1.8 2013/02/08 17:25:16 christos Exp $
# matroska: file(1) magic for Matroska files
#
# See http://www.matroska.org/
@@ -10781,19 +13421,13 @@
# EBML id:
0 belong 0x1a45dfa3
# DocType id:
->5 beshort 0x4282
+>4 search/4096 \x42\x82
# DocType contents:
->>8 string matroska Matroska data
+>>&1 string webm WebM
+!:mime video/webm
+>>&1 string matroska Matroska data
!:mime video/x-matroska
-# EBML id:
-0 belong 0x1a45dfa3
-# DocType id:
->0 search/4096 \x42\x82
-# DocType contents:
->>&1 string webm WebM
-!:mime video/webm
-
#------------------------------------------------------------------------------
# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $
# Mavroyanopoulos Nikos <nmav at hellug.gr>
@@ -10846,6 +13480,14 @@
>4 string BZ (bzip2 compressed)
#------------------------------------------------------------------------------
+# $File: metastore,v 1.1 2011/04/06 12:37:44 christos Exp $
+# metastore: file(1) magic for metastore files
+# From: Thomas Wissen
+# see http://david.hardeman.nu/software.php#metastore
+0 string MeTaSt00r3 Metastore data file,
+>10 bequad x version %0llx
+
+#------------------------------------------------------------------------------
# $File: mime,v 1.6 2010/11/25 15:00:12 christos Exp $
# mime: file(1) magic for MIME encoded files
#
@@ -10855,34 +13497,10 @@
>13 string >\0 %s
#------------------------------------------------------------------------------
-# $File: mips,v 1.6 2010/08/13 16:12:30 christos Exp $
-# mips: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.)
-# Dec Ultrix (MIPS)
-# all of SGI's *current* machines and OSes run in big-endian mode on the
-# MIPS machines, as far as I know.
+# $File: mips,v 1.10 2014/04/30 21:41:02 christos Exp $
+# mips: file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX
+# and DEC Ultrix
#
-# XXX - what is the blank "-" line?
-#
-# kbd file definitions
-0 string kbd!map kbd map file
->8 byte >0 Ver %d:
->10 short >0 with %d table(s)
-0 belong 0407 old SGI 68020 executable
-0 belong 0410 old SGI 68020 pure executable
-0 beshort 0x8765 disk quotas file
-0 beshort 0x0506 IRIS Showcase file
->2 byte 0x49 -
->3 byte x - version %ld
-0 beshort 0x0226 IRIS Showcase template
->2 byte 0x63 -
->3 byte x - version %ld
-0 belong 0x5343464d IRIS Showcase file
->4 byte x - version %ld
-0 belong 0x5443464d IRIS Showcase template
->4 byte x - version %ld
-0 belong 0xdeadbabe IRIX Parallel Arena
->8 belong >0 - version %ld
-#
0 beshort 0x0160 MIPSEB ECOFF executable
>20 beshort 0407 (impure)
>20 beshort 0410 (swapped)
@@ -10889,8 +13507,8 @@
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
->22 byte x - version %ld
->23 byte x .%ld
+>22 byte x - version %d
+>23 byte x \b.%d
#
0 beshort 0x0162 MIPSEL-BE ECOFF executable
>20 beshort 0407 (impure)
@@ -10899,7 +13517,7 @@
>8 belong >0 not stripped
>8 belong 0 stripped
>23 byte x - version %d
->22 byte x .%ld
+>22 byte x \b.%d
#
0 beshort 0x6001 MIPSEB-LE ECOFF executable
>20 beshort 03401 (impure)
@@ -10908,7 +13526,7 @@
>8 belong >0 not stripped
>8 belong 0 stripped
>23 byte x - version %d
->22 byte x .%ld
+>22 byte x \b.%d
#
0 beshort 0x6201 MIPSEL ECOFF executable
>20 beshort 03401 (impure)
@@ -10916,8 +13534,8 @@
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
->23 byte x - version %ld
->22 byte x .%ld
+>23 byte x - version %d
+>22 byte x \b.%d
#
# MIPS 2 additions
#
@@ -10927,8 +13545,8 @@
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
->22 byte x - version %ld
->23 byte x .%ld
+>22 byte x - version %d
+>23 byte x \b.%d
#
0 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable
>20 beshort 0407 (impure)
@@ -10936,8 +13554,8 @@
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
->22 byte x - version %ld
->23 byte x .%ld
+>22 byte x - version %d
+>23 byte x \b.%d
#
0 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable
>20 beshort 03401 (impure)
@@ -10945,8 +13563,8 @@
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
->23 byte x - version %ld
->22 byte x .%ld
+>23 byte x - version %d
+>22 byte x \b.%d
#
0 beshort 0x6601 MIPSEL MIPS-II ECOFF executable
>20 beshort 03401 (impure)
@@ -10954,8 +13572,8 @@
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
->23 byte x - version %ld
->22 byte x .%ld
+>23 byte x - version %d
+>22 byte x \b.%d
#
# MIPS 3 additions
#
@@ -10965,8 +13583,8 @@
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
->22 byte x - version %ld
->23 byte x .%ld
+>22 byte x - version %d
+>23 byte x \b.%d
#
0 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable
>20 beshort 0407 (impure)
@@ -10974,8 +13592,8 @@
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
->22 byte x - version %ld
->23 byte x .%ld
+>22 byte x - version %d
+>23 byte x \b.%d
#
0 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable
>20 beshort 03401 (impure)
@@ -10983,8 +13601,8 @@
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
->23 byte x - version %ld
->22 byte x .%ld
+>23 byte x - version %d
+>22 byte x \b.%d
#
0 beshort 0x4201 MIPSEL MIPS-III ECOFF executable
>20 beshort 03401 (impure)
@@ -10992,49 +13610,11 @@
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
->23 byte x - version %ld
->22 byte x .%ld
+>23 byte x - version %d
+>22 byte x \b.%d
#
0 beshort 0x180 MIPSEB Ucode
0 beshort 0x182 MIPSEL-BE Ucode
-# 32bit core file
-0 belong 0xdeadadb0 IRIX core dump
->4 belong 1 of
->16 string >\0 '%s'
-# 64bit core file
-0 belong 0xdeadad40 IRIX 64-bit core dump
->4 belong 1 of
->16 string >\0 '%s'
-# N32bit core file
-0 belong 0xbabec0bb IRIX N32 core dump
->4 belong 1 of
->16 string >\0 '%s'
-# New style crash dump file
-0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of
->36 string >\0 '%s'
-# Trusted IRIX info
-0 string SGIAUDIT SGI Audit file
->8 byte x - version %d
->9 byte x .%ld
-#
-0 string WNGZWZSC Wingz compiled script
-0 string WNGZWZSS Wingz spreadsheet
-0 string WNGZWZHP Wingz help file
-#
-0 string #Inventor V IRIS Inventor 1.0 file
-0 string #Inventor V2 Open Inventor 2.0 file
-# GLF is OpenGL stream encoding
-0 string glfHeadMagic(); GLF_TEXT
-4 belong 0x7d000000 GLF_BINARY_LSB_FIRST
-!:strength -30
-4 belong 0x0000007d GLF_BINARY_MSB_FIRST
-!:strength -30
-# GLS is OpenGL stream encoding; GLS is the successor of GLF
-0 string glsBeginGLS( GLS_TEXT
-4 belong 0x10000000 GLS_BINARY_LSB_FIRST
-!:strength -30
-4 belong 0x00000010 GLS_BINARY_MSB_FIRST
-!:strength -30
#------------------------------------------------------------------------------
# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $
@@ -11045,7 +13625,7 @@
0 long 31415 Mirage Assembler m.out executable
#-----------------------------------------------------------------------------
-# $File: misctools,v 1.12 2010/09/29 18:36:49 rrt Exp $
+# $File: misctools,v 1.14 2014/03/06 16:08:58 christos Exp $
# misctools: file(1) magic for miscellaneous UNIX tools.
#
0 search/1 %%!! X-Post-It-Note text
@@ -11054,16 +13634,6 @@
0 string/c BEGIN:VCARD vCard visiting card
!:mime text/x-vcard
-# From: Alex Beregszaszi <alex at fsn.hu>
-4 string gtktalog GNOME Catalogue (gtktalog)
->13 string >\0 version %s
-
-# Summary: GStreamer binary registry
-# Extension: .bin
-# Submitted by: Josh Triplett <josh at joshtriplett.org>
-0 belong 0xc0def00d GStreamer binary registry
->4 string x \b, version %s
-
# Summary: Libtool library file
# Extension: .la
# Submitted by: Tomasz Trojanowski <tomek at uninet.com.pl>
@@ -11077,6 +13647,11 @@
# From: Daniel Novotny <dnovotny at redhat.com>
0 string MDMP\x93\xA7 MDMP crash report data
+# Summary: abook addressbook file
+# Submitted by: Mark Schreiber <mark7 at alumni.cmu.edu>
+0 string #\x20abook\x20addressbook\x20file abook address book
+!:mime application/x-abook-addressbook
+
#------------------------------------------------------------------------------
# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $
# mkid: file(1) magic for mkid(1) databases
@@ -11138,7 +13713,7 @@
#------------------------------------------------------------------------------
-# $File: motorola,v 1.10 2009/09/19 16:28:11 christos Exp $
+# $File: motorola,v 1.11 2014/04/30 21:41:02 christos Exp $
# motorola: file(1) magic for Motorola 68K and 88K binaries
#
# 68K
@@ -11178,27 +13753,27 @@
# not larger than 1 MB (which is a lot on ST).
# The additional 0x601b distinction I took from Doug Lee's magic.
0 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable
->2 belong x (txt=%ld,
->6 belong x dat=%ld,
->10 belong x bss=%ld,
->14 belong x sym=%ld)
+>2 belong x (txt=%d,
+>6 belong x dat=%d,
+>10 belong x bss=%d,
+>14 belong x sym=%d)
0 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable
->2 belong x (txt=%ld,
->6 belong x dat=%ld,
->10 belong x bss=%ld,
->14 belong x sym=%ld)
+>2 belong x (txt=%d,
+>6 belong x dat=%d,
+>10 belong x bss=%d,
+>14 belong x sym=%d)
# Atari ST/TT... program format (sent by Wolfram Kleff <kleff at cs.uni-bonn.de>)
0 beshort 0x601A Atari 68xxx executable,
->2 belong x text len %lu,
->6 belong x data len %lu,
->10 belong x BSS len %lu,
->14 belong x symboltab len %lu,
+>2 belong x text len %u,
+>6 belong x data len %u,
+>10 belong x BSS len %u,
+>14 belong x symboltab len %u,
>18 belong 0
>22 belong &0x01 fastload flag,
>22 belong &0x02 may be loaded to alternate RAM,
>22 belong &0x04 malloc may be from alternate RAM,
->22 belong x flags: 0x%lX,
+>22 belong x flags: 0x%X,
>26 beshort 0 no relocation tab
>26 beshort !0 + relocation tab
>30 string SFX [Self-Extracting LZH SFX archive]
@@ -11206,7 +13781,7 @@
>44 string ZIP! [Self-Extracting ZIP SFX archive]
0 beshort 0x0064 Atari 68xxx CPX file
->8 beshort x (version %04lx)
+>8 beshort x (version %04x)
#------------------------------------------------------------------------------
# $File: mozilla,v 1.4 2009/09/19 16:28:11 christos Exp $
@@ -11218,18 +13793,18 @@
0 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data
#------------------------------------------------------------------------------
-# $File: msdos,v 1.71 2011/01/10 14:01:10 christos Exp $
+# $File: msdos,v 1.100 2014/06/03 19:17:27 christos Exp $
# msdos: file(1) magic for MS-DOS files
#
# .BAT files (Daniel Quinlan, quinlan at yggdrasil.com)
-# updated by Joerg Jenderek at Oct 2008
+# updated by Joerg Jenderek at Oct 2008,Apr 2011
0 string/t @
>1 string/cW \ echo\ off DOS batch file text
!:mime text/x-msdos-batch
>1 string/cW echo\ off DOS batch file text
!:mime text/x-msdos-batch
->1 string/cW rem\ DOS batch file text
+>1 string/cW rem DOS batch file text
!:mime text/x-msdos-batch
>1 string/cW set\ DOS batch file text
!:mime text/x-msdos-batch
@@ -11259,10 +13834,10 @@
#
# Many of the compressed formats were extraced from IDARC 1.23 source code.
#
-0 string MZ
-!:mime application/x-dosexec
+0 string/b MZ
# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file.
>0x18 leshort <0x40 MS-DOS executable
+!:mime application/x-dosexec
# These traditional tests usually work but not always. When test quality support is
# implemented these can be turned on.
#>>0x18 leshort 0x1c (Borland compiler)
@@ -11274,6 +13849,7 @@
# Maybe it's a PE?
>>(0x3c.l) string PE\0\0 PE
+!:mime application/x-dosexec
>>>(0x3c.l+24) leshort 0x010b \b32 executable
>>>(0x3c.l+24) leshort 0x020b \b32+ executable
>>>(0x3c.l+24) leshort 0x0107 ROM image
@@ -11301,6 +13877,7 @@
>>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4
>>>(0x3c.l+4) leshort 0x1c0 ARM
>>>(0x3c.l+4) leshort 0x1c2 ARM Thumb
+>>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb
>>>(0x3c.l+4) leshort 0x1f0 PowerPC
>>>(0x3c.l+4) leshort 0x200 Intel Itanium
>>>(0x3c.l+4) leshort 0x266 MIPS16
@@ -11351,8 +13928,10 @@
# Hmm, not a PE but the relocation table is too high for a traditional DOS exe,
# must be one of the unusual subformats.
>>(0x3c.l) string !PE\0\0 MS-DOS executable
+!:mime application/x-dosexec
>>(0x3c.l) string NE \b, NE
+!:mime application/x-dosexec
>>>(0x3c.l+0x36) byte 1 for OS/2 1.x
>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x
>>>(0x3c.l+0x36) byte 3 for MS-DOS
@@ -11367,6 +13946,7 @@
>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
>>(0x3c.l) string LX\0\0 \b, LX
+!:mime application/x-dosexec
>>>(0x3c.l+0x0a) leshort <1 (unknown OS)
>>>(0x3c.l+0x0a) leshort 1 for OS/2
>>>(0x3c.l+0x0a) leshort 2 for MS Windows
@@ -11385,8 +13965,10 @@
# MS Windows system file, supposedly a collection of LE executables
>>(0x3c.l) string W3 \b, W3 for MS Windows
+!:mime application/x-dosexec
>>(0x3c.l) string LE\0\0 \b, LE executable
+!:mime application/x-dosexec
>>>(0x3c.l+0x0a) leshort 1
# some DOS extenders use LE files with OS/2 header
>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
@@ -11413,6 +13995,7 @@
# and definitely not NE/LE/LX/PE
>>0x3c lelong >0x20000000
>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS
+!:mime application/x-dosexec
# header data too small for extended executable
>2 long !0
>>0x18 leshort <0x40
@@ -11420,6 +14003,7 @@
>>>>&(2.s-514) string !LE
>>>>>&-2 string !BW \b, MZ for MS-DOS
+!:mime application/x-dosexec
>>>>&(2.s-514) string LE \b, LE
>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
# educated guess since indirection is still not capable enough for complex offset
@@ -11426,11 +14010,12 @@
# calculations (next embedded executable would be at &(&2*512+&0-2)
# I suspect there are only LE executables in these multi-exe files
>>>>&(2.s-514) string BW
->>>>>0x240 search/0x100 DOS/4G ,\b LE for MS-DOS, DOS4GW DOS extender (embedded)
->>>>>0x240 search/0x100 !DOS/4G ,\b BW collection for MS-DOS
+>>>>>0x240 search/0x100 DOS/4G \b, LE for MS-DOS, DOS4GW DOS extender (embedded)
+>>>>>0x240 search/0x100 !DOS/4G \b, BW collection for MS-DOS
# This sequence skips to the first COFF segment, usually .text
>(4.s*512) leshort 0x014c \b, COFF
+!:mime application/x-dosexec
>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender
>>(8.s*16) string emx
>>>&1 string x for DOS, Win or OS/2, emx %s
@@ -11509,6 +14094,29 @@
>>49824 leshort =1 \b, 1 file
>>49824 leshort >1 \b, %u files
+# added by Joerg Jenderek of http://www.freedos.org/software/?prog=kc
+# and http://www.freedos.org/software/?prog=kpdos
+# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD
+0 string/b KCF FreeDOS KEYBoard Layout collection
+# only version=0x100 found
+>3 uleshort x \b, version 0x%x
+# length of string containing author,info and special characters
+>6 ubyte >0
+#>>6 pstring x \b, name=%s
+>>7 string >\0 \b, author=%-.14s
+>>7 search/254 \xff \b, info=
+#>>>&0 string x \b%-s
+>>>&0 string x \b%-.15s
+# for FreeDOS *.KL files
+0 string/b KLF FreeDOS KEYBoard Layout file
+# only version=0x100 or 0x101 found
+>3 uleshort x \b, version 0x%x
+# stringlength
+>5 ubyte >0
+>>8 string x \b, name=%-.2s
+0 string \xffKEYB\ \ \ \0\0\0\0
+>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file
+
# .COM formats (Daniel Quinlan, quinlan at yggdrasil.com)
# Uncommenting only the first two lines will cover about 2/3 of COM files,
# but it isn't feasible to match all COM files since there must be at least
@@ -11517,27 +14125,79 @@
0 byte 0xe9 DOS executable (COM)
>0x1FE leshort 0xAA55 \b, boot code
>6 string SFX\ of\ LHarc (%s)
-0 belong 0xffffffff DOS executable (device driver)
-#CMD640X2.SYS
->10 string >\x23
->>10 string !\x2e
->>>17 string <\x5B
->>>>10 string x \b, name: %.8s
-#UDMA.SYS KEYB.SYS CMD640X2.SYS
->10 string <\x41
->>12 string >\x40
->>>10 string !$
->>>>12 string x \b, name: %.8s
-#BTCDROM.SYS ASPICD.SYS
->22 string >\x40
->>22 string <\x5B
->>>23 string <\x5B
->>>>22 string x \b, name: %.8s
-#ATAPICD.SYS
->76 string \0
->>77 string >\x40
->>>77 string <\x5B
->>>>77 string x \b, name: %.8s
+
+# DOS device driver updated by Joerg Jenderek at May 2011
+# http://maben.homeip.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
+0 ulequad&0x07a0ffffffff 0xffffffff DOS executable (
+>40 search/7 UPX! \bUPX compressed
+# DOS device driver attributes
+>4 uleshort&0x8000 0x0000 \bblock device driver
+# character device
+>4 uleshort&0x8000 0x8000 \b
+>>4 uleshort&0x0008 0x0008 \bclock
+# fast video output by int 29h
+>>4 uleshort&0x0010 0x0010 \bfast
+# standard input/output device
+>>4 uleshort&0x0003 >0 \bstandard
+>>>4 uleshort&0x0001 0x0001 \binput
+>>>4 uleshort&0x0003 0x0003 \b/
+>>>4 uleshort&0x0002 0x0002 \boutput
+>>4 uleshort&0x8000 0x8000 \bcharacter device driver
+>0 ubyte x
+# upx compressed device driver has garbage instead of real in name field of header
+>>40 search/7 UPX!
+>>40 default x
+# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped
+>>>12 ubyte >0x27 \b
+>>>>10 ubyte >0x20
+>>>>>10 ubyte !0x2E
+>>>>>>10 ubyte !0x2A \b%c
+>>>>11 ubyte >0x20
+>>>>>11 ubyte !0x2E \b%c
+>>>>12 ubyte >0x20
+>>>>>12 ubyte !0x39
+>>>>>>12 ubyte !0x2E \b%c
+>>>13 ubyte >0x20
+>>>>13 ubyte !0x2E \b%c
+>>>>14 ubyte >0x20
+>>>>>14 ubyte !0x2E \b%c
+>>>>15 ubyte >0x20
+>>>>>15 ubyte !0x2E \b%c
+>>>>16 ubyte >0x20
+>>>>>16 ubyte !0x2E
+>>>>>>16 ubyte <0xCB \b%c
+>>>>17 ubyte >0x20
+>>>>>17 ubyte !0x2E
+>>>>>>17 ubyte <0x90 \b%c
+# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field
+>>>4 uleshort&0x8000 0x8000
+>>>>12 ubyte <0x2F
+# they have their real name at offset 22
+>>>>>22 string >\0 \b%-.5s
+>4 uleshort&0x8000 0x0000
+# 32 bit sector addressing ( > 32 MB) for block devices
+>>4 uleshort&0x0002 0x0002 \b,32-bit sector-
+# support by driver functions 13h, 17h, 18h
+>4 uleshort&0x0040 0x0040 \b,IOCTL-
+# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh
+>4 uleshort&0x0800 0x0800 \b,close media-
+# output until busy support by int 10h for character device driver
+>4 uleshort&0x8000 0x8000
+>>4 uleshort&0x2000 0x2000 \b,until busy-
+# direct read/write support by driver functions 03h,0Ch
+>4 uleshort&0x4000 0x4000 \b,control strings-
+>4 uleshort&0x8000 0x8000
+>>4 uleshort&0x6840 >0 \bsupport
+>4 uleshort&0x8000 0x0000
+>>4 uleshort&0x4842 >0 \bsupport
+>0 ubyte x \b)
+# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
+# Too weak, matches files that only contain 0's
+#0 ulequad&0x000007a0ffffffed 0x0000000000000000 DOS-executable (
+#>4 uleshort&0x8000 0x8000 \bcharacter device driver
+#>>10 string x %-.8s
+#>4 uleshort&0x4000 0x4000 \b,control strings-support)
+
# test too generic ?
0 byte 0x8c DOS executable (COM)
# updated by Joerg Jenderek at Oct 2008
@@ -11545,12 +14205,12 @@
# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb
0 ubeshort&0xeb8d >0xeb00
# DR-DOS STACKER.COM SCREATE.SYS missed
->0 byte 0xeb DOS executable (COM)
->>0x1FE leshort 0xAA55 \b, boot code
->>85 string UPX \b, UPX compressed
->>4 string \ $ARX \b, ARX self-extracting archive
->>4 string \ $LHarc \b, LHarc self-extracting archive
->>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive
+>0 byte 0xeb
+>>0x1FE leshort 0xAA55 DOS executable (COM), boot code
+>>85 string UPX DOS executable (COM), UPX compressed
+>>4 string \ $ARX DOS executable (COM), ARX self-extracting archive
+>>4 string \ $LHarc DOS executable (COM), LHarc self-extracting archive
+>>0x20e string SFX\ by\ LARC DOS executable (COM), LARC self-extracting archive
# updated by Joerg Jenderek at Oct 2008
#0 byte 0xb8 COM executable
0 uleshort&0x80ff 0x00b8
@@ -11564,11 +14224,11 @@
# syslinux:doc/comboot.txt
# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov
# eax,21cd4cfeh) as a magic number.
-0 string \xb8\xfe\x4c\xcd\x21 COM executable (COM32R)
+0 string/b \xb8\xfe\x4c\xcd\x21 COM executable (COM32R)
# start with assembler instructions mov eax,21cd4cfeh
0 uleshort&0xc0ff 0xc0b8
>1 lelong 0x21cd4cfe COM executable (32-bit COMBOOT, relocatable)
-0 string \x81\xfc
+0 string/b \x81\xfc
>4 string \x77\x02\xcd\x20\xb9
>>36 string UPX! FREE-DOS executable (COM), UPX compressed
252 string Must\ have\ DOS\ version DR-DOS executable (COM)
@@ -11609,16 +14269,16 @@
# FIXME: missing diet .com compression
# miscellaneous formats
-0 string LZ MS-DOS executable (built-in)
+0 string/b LZ MS-DOS executable (built-in)
#0 byte 0xf0 MS-DOS program library data
#
# AAF files:
# <stuartc at rd.bbc.co.uk> Stuart Cunningham
-0 string \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage
+0 string/b \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage
>30 byte 9 (512B sectors)
>30 byte 12 (4kB sectors)
-0 string \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage
+0 string/b \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage
>30 byte 9 (512B sectors)
>30 byte 12 (4kB sectors)
@@ -11634,18 +14294,25 @@
0 belong 0x31be0000 Microsoft Word Document
!:mime application/msword
#
-0 string PO^Q` Microsoft Word 6.0 Document
+0 string/b PO^Q` Microsoft Word 6.0 Document
!:mime application/msword
#
-0 string \376\067\0\043 Microsoft Office Document
+0 string/b \376\067\0\043 Microsoft Office Document
!:mime application/msword
-0 string \333\245-\0\0\0 Microsoft Office Document
+0 string/b \333\245-\0\0\0 Microsoft Office Document
!:mime application/msword
-512 string \354\245\301 Microsoft Word Document
+512 string/b \354\245\301 Microsoft Word Document
!:mime application/msword
+
#
+0 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document
+!:mime application/msword
+#
2080 string Microsoft\ Excel\ 5.0\ Worksheet %s
!:mime application/vnd.ms-excel
+#
+0 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document
+!:mime application/msword
2080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s
!:mime application/vnd.ms-excel
@@ -11656,7 +14323,7 @@
# Italian MS-Excel
2121 string Biff5 Microsoft Excel 5.0 Worksheet
!:mime application/vnd.ms-excel
-0 string \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet
+0 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet
!:mime application/vnd.ms-excel
#
0 belong 0x00001a00 Lotus 1-2-3
@@ -11670,9 +14337,9 @@
!:mime application/x-123
>4 belong 0x06040600 wk1 document data
>4 belong 0x06800200 fmt document data
-0 string WordPro\0 Lotus WordPro
+0 string/b WordPro\0 Lotus WordPro
!:mime application/vnd.lotus-wordpro
-0 string WordPro\r\373 Lotus WordPro
+0 string/b WordPro\r\373 Lotus WordPro
!:mime application/vnd.lotus-wordpro
@@ -11685,17 +14352,17 @@
# Winamp .avs
#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
-0 string Nullsoft\ AVS\ Preset\ Winamp plug in
+0 string/b Nullsoft\ AVS\ Preset\ Winamp plug in
# Windows Metafont .WMF
-0 string \327\315\306\232 ms-windows metafont .wmf
-0 string \002\000\011\000 ms-windows metafont .wmf
-0 string \001\000\011\000 ms-windows metafont .wmf
+0 string/b \327\315\306\232 ms-windows metafont .wmf
+0 string/b \002\000\011\000 ms-windows metafont .wmf
+0 string/b \001\000\011\000 ms-windows metafont .wmf
#tz3 files whatever that is (MS Works files)
-0 string \003\001\001\004\070\001\000\000 tz3 ms-works file
-0 string \003\002\001\004\070\001\000\000 tz3 ms-works file
-0 string \003\003\001\004\070\001\000\000 tz3 ms-works file
+0 string/b \003\001\001\004\070\001\000\000 tz3 ms-works file
+0 string/b \003\002\001\004\070\001\000\000 tz3 ms-works file
+0 string/b \003\003\001\004\070\001\000\000 tz3 ms-works file
# PGP sig files .sig
#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig
@@ -11707,31 +14374,63 @@
0 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
# windows zips files .dmf
-0 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
+0 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
#ico files
-0 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows
+0 string/b \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows
-# Windows icons (Ian Springer <ips at fpk.hp.com>)
-0 string \000\000\001\000 MS Windows icon resource
+# Windows icons
+0 name ico-dir
+# not entirely accurate, the number of icons is part of the header
+>0 byte 1 - 1 icon
+>0 ubyte >1 - %d icons
+>2 byte 0 \b, 256x
+>2 byte !0 \b, %dx
+>3 byte 0 \b256
+>3 byte !0 \b%d
+>4 ubyte !0 \b, %d colors
+
+0 belong 0x00000100
+>9 byte 0
+>>0 byte x MS Windows icon resource
!:mime image/x-icon
->4 byte 1 - 1 icon
->4 byte >1 - %d icons
->>6 byte >0 \b, %dx
->>>7 byte >0 \b%d
->>8 byte 0 \b, 256-colors
->>8 byte >0 \b, %d-colors
+>>4 use ico-dir
+>9 ubyte 0xff
+>>0 byte x MS Windows icon resource
+!:mime image/x-icon
+>>4 use ico-dir
+# Windows non-animated cursors
+0 name cur-dir
+# not entirely accurate, the number of icons is part of the header
+>0 byte 1 - 1 icon
+>0 ubyte >1 - %d icons
+>2 byte 0 \b, 256x
+>2 byte !0 \b, %dx
+>3 byte 0 \b256
+>3 byte !0 \b%d
+>6 uleshort x \b, hotspot @%dx
+>8 uleshort x \b%d
+0 belong 0x00000200
+>9 byte 0
+>>0 byte x MS Windows cursor resource
+!:mime image/x-cur
+>>4 use cur-dir
+>9 ubyte 0xff
+>>0 byte x MS Windows cursor resource
+!:mime image/x-cur
+>>4 use cur-dir
+
# .chr files
-0 string PK\010\010BGI Borland font
+0 string/b PK\010\010BGI Borland font
>4 string >\0 %s
# then there is a copyright notice
# .bgi files
-0 string pk\010\010BGI Borland device
+0 string/b pk\010\010BGI Borland device
>4 string >\0 %s
# then there is a copyright notice
@@ -11780,14 +14479,14 @@
0 lelong 0x08086b70 TurboC BGI file
0 lelong 0x08084b50 TurboC Font file
-# WARNING: below line conflicts with Infocom game data Z-machine 3
-0 byte 0x03 DBase 3 data file
->0x04 lelong 0 (no records)
->0x04 lelong >0 (%ld records)
-0 byte 0x83 DBase 3 data file with memo(s)
->0x04 lelong 0 (no records)
->0x04 lelong >0 (%ld records)
-0 leshort 0x0006 DBase 3 index file
+# Debian#712046: The magic below identifies "Delphi compiled form data".
+# An additional source of information is available at:
+# http://www.woodmann.com/fravia/dafix_t1.htm
+0 string TPF0
+>4 pstring >\0 Delphi compiled form '%s'
+
+# tests for DBase files moved, updated and merged to database
+
0 string PMCC Windows 3.x .GRP file
1 string RDC-meg MegaDots
>8 byte >0x2F version %c
@@ -11795,6 +14494,39 @@
0 lelong 0x4C
>4 lelong 0x00021401 Windows shortcut file
+# .PIF files added by Joerg Jenderek from http://smsoft.ru/en/pifdoc.htm
+# only for windows versions equal or greater 3.0
+0x171 string MICROSOFT\ PIFEX\0 Windows Program Information File
+!:mime application/x-dosexec
+#>2 string >\0 \b, Title:%.30s
+>0x24 string >\0 \b for %.63s
+>0x65 string >\0 \b, directory=%.64s
+>0xA5 string >\0 \b, parameters=%.64s
+#>0x181 leshort x \b, offset %x
+#>0x183 leshort x \b, offsetdata %x
+#>0x185 leshort x \b, section length %x
+>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0
+>>&0x5e ubyte >0
+>>>&-1 string <PIFMGR.DLL \b, icon=%s
+#>>>&-1 string PIFMGR.DLL \b, icon=%s
+>>>&-1 string >PIFMGR.DLL \b, icon=%s
+>>&0xF0 ubyte >0
+>>>&-1 string <Terminal \b, font=%.32s
+#>>>&-1 string =Terminal \b, font=%.32s
+>>>&-1 string >Terminal \b, font=%.32s
+>>&0x110 ubyte >0
+>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s
+#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s
+>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s
+#>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style
+#>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style
+>0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style
+#>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style
+>0x187 search/0xB55 CONFIG\ \ SYS\ 4.0\0 \b +CONFIG.SYS
+#>>&06 string x \b:%s
+>0x187 search/0xB55 AUTOEXECBAT\ 4.0\0 \b +AUTOEXEC.BAT
+#>>&06 string x \b:%s
+
# DOS EPS Binary File Header
# From: Ed Sznyter <ews at Black.Market.NET>
0 belong 0xC5D0D3C6 DOS EPS Binary File
@@ -11810,16 +14542,38 @@
0 leshort 0x223e9f78 TNEF
!:mime application/vnd.ms-tnef
+# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C
+# of http://www.davep.org/norton-guides/ng2h-105.tgz
+# http://en.wikipedia.org/wiki/Norton_Guides
+0 string NG\0\001
+# only value 0x100 found at offset 2
+>2 ulelong 0x00000100 Norton Guide
+# Title[40]
+>>8 string >\0 "%-.40s"
+#>>6 uleshort x \b, MenuCount=%u
+# szCredits[5][66]
+>>48 string >\0 \b, %-.66s
+>>114 string >\0 %-.66s
+
+# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
+# of http://www.4dos.info/
+# pointer,HelpID[8]=4DHnnnmm
+0 ulelong 0x48443408 4DOS help file
+>4 string x \b, version %-4.4s
+
+# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp
+0 ulequad 0x3a000000024e4c MS Advisor help file
+
# HtmlHelp files (.chm)
-0 string ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data
+0 string/b ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data
# GFA-BASIC (Wolfram Kleff)
-2 string GFA-BASIC3 GFA-BASIC 3 data
+2 string/b GFA-BASIC3 GFA-BASIC 3 data
#------------------------------------------------------------------------------
# From Stuart Caie <kyzer at 4u.net> (developer of cabextract)
# Microsoft Cabinet files
-0 string MSCF\0\0\0\0 Microsoft Cabinet archive data
+0 string/b MSCF\0\0\0\0 Microsoft Cabinet archive data
!:mime application/vnd.ms-cab-compressed
>8 lelong x \b, %u bytes
>28 leshort 1 \b, 1 file
@@ -11826,13 +14580,13 @@
>28 leshort >1 \b, %u files
# InstallShield Cabinet files
-0 string ISc( InstallShield Cabinet archive data
+0 string/b ISc( InstallShield Cabinet archive data
>5 byte&0xf0 =0x60 version 6,
>5 byte&0xf0 !0x60 version 4/5,
>(12.l+40) lelong x %u files
# Windows CE package files
-0 string MSCE\0\0\0\0 Microsoft WinCE install header
+0 string/b MSCE\0\0\0\0 Microsoft WinCE install header
>20 lelong 0 \b, architecture-independent
>20 lelong 103 \b, Hitachi SH3
>20 lelong 104 \b, Hitachi SH4
@@ -11855,84 +14609,10 @@
>40 string \ EMF Windows Enhanced Metafile (EMF) image data
>>44 ulelong x version 0x%x
-# From: Alex Beregszaszi <alex at fsn.hu>
-0 string COWD VMWare3
->4 byte 3 disk image
->>32 lelong x (%d/
->>36 lelong x \b%d/
->>40 lelong x \b%d)
->4 byte 2 undoable disk image
->>32 string >\0 (%s)
-
-0 string VMDK VMware4 disk image
-0 string KDMV VMware4 disk image
-
-#--------------------------------------------------------------------
-# Qemu Emulator Images
-# Lines written by Friedrich Schwittay (f.schwittay at yousable.de)
-# Updated by Adam Buchbinder (adam.buchbinder at gmail.com)
-# Made by reading sources, reading documentation, and doing trial and error
-# on existing QCOW files
-0 string QFI\xFB QEMU QCOW Image
-
-# Uncomment the following line to display Magic (only used for debugging
-# this magic number)
-#>0 string x , Magic: %s
-
-# There are currently 2 Versions: "1" and "2".
-# http://www.gnome.org/~markmc/qcow-image-format-version-1.html
->4 belong 1 (v1)
-
-# Using the existence of the Backing File Offset to determine whether
-# to read Backing File Information
->>12 belong >0 \b, has backing file (
-# Note that this isn't a null-terminated string; the length is actually
-# (16.L). Assuming a null-terminated string happens to work usually, but it
-# may spew junk until it reaches a \0 in some cases.
->>>(12.L) string >\0 \bpath %s
-
-# Modification time of the Backing File
-# Really useful if you want to know if your backing
-# file is still usable together with this image
->>>>20 bedate >0 \b, mtime %s)
->>>>20 default x \b)
-
-# Size is stored in bytes in a big-endian u64.
->>24 bequad x \b, %lld bytes
-
-# 1 for AES encryption, 0 for none.
->>36 belong 1 \b, AES-encrypted
-
-# http://www.gnome.org/~markmc/qcow-image-format.html
->4 belong 2 (v2)
-# Using the existence of the Backing File Offset to determine whether
-# to read Backing File Information
->>8 bequad >0 \b, has backing file
-# Note that this isn't a null-terminated string; the length is actually
-# (16.L). Assuming a null-terminated string happens to work usually, but it
-# may spew junk until it reaches a \0 in some cases. Also, since there's no
-# .Q modifier, we just use the bottom four bytes as an offset. Note that if
-# the file is over 4G, and the backing file path is stored after the first 4G,
-# the wrong filename will be printed. (This should be (8.Q), when that syntax
-# is introduced.)
->>>(12.L) string >\0 (path %s)
->>24 bequad x \b, %lld bytes
->>32 belong 1 \b, AES-encrypted
-
->4 default x (unknown version)
-
-0 string QEVM QEMU suspend to disk image
-
-0 string Bochs\ Virtual\ HD\ Image Bochs disk image,
->32 string x type %s,
->48 string x subtype %s
-
-0 lelong 0x02468ace Bochs Sparse disk image
-
# from http://filext.com by Derek M Jones <derek at knosof.co.uk>
# False positive with PPT (also currently this string is too long)
-#0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer
-0 string \320\317\021\340\241\261\032\341 Microsoft Office Document
+#0 string/b \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer
+0 string/b \320\317\021\340\241\261\032\341 Microsoft Office Document
#>48 byte 0x1B Excel Document
#!:mime application/vnd.ms-excel
>546 string bjbj Microsoft Word Document
@@ -11940,7 +14620,7 @@
>546 string jbjb Microsoft Word Document
!:mime application/msword
-0 string \224\246\056 Microsoft Word Document
+0 string/b \224\246\056 Microsoft Word Document
!:mime application/msword
512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document
@@ -11949,16 +14629,21 @@
# From: "Nelson A. de Oliveira" <naoliv at gmail.com>
# Magic type for Dell's BIOS .hdr files
# Dell's .hdr
-0 string $RBU
+0 string/b $RBU
>23 string Dell %s system BIOS
->48 string x version %.3s
+>5 byte 2
+>>48 byte x version %d.
+>>49 byte x \b%d.
+>>50 byte x \b%d
+>5 byte <2
+>>48 string x version %.3s
# Type: Microsoft DirectDraw Surface
# URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
# From: Morten Hustveit <morten at debian.org>
-0 string DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS),
->16 lelong >0 %hd x
->12 lelong >0 %hd,
+0 string/b DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS),
+>16 lelong >0 %d x
+>12 lelong >0 %d,
>84 string x %.4s
# Type: Microsoft Document Imaging Format (.mdi)
@@ -11967,18 +14652,66 @@
0 short 0x5045 Microsoft Document Imaging Format
# MS eBook format (.lit)
-0 string ITOLITLS Microsoft Reader eBook Data
+0 string/b ITOLITLS Microsoft Reader eBook Data
>8 lelong x \b, version %u
!:mime application/x-ms-reader
# Windows CE Binary Image Data Format
# From: Dr. Jesus <j at hug.gs>
-0 string B000FF\n Windows Embedded CE binary image
+0 string/b B000FF\n Windows Embedded CE binary image
# Windows Imaging (WIM) Image
-0 string MSWIM\000\000\000 Windows imaging (WIM) image
+0 string/b MSWIM\000\000\000 Windows imaging (WIM) image
+# The second byte of these signatures is a file version; I don't know what,
+# if anything, produced files with version numbers 0-2.
+# From: John Elliott <johne at seasip.demon.co.uk>
+0 string \xfc\x03\x00 Mallard BASIC program data (v1.11)
+0 string \xfc\x04\x00 Mallard BASIC program data (v1.29+)
+0 string \xfc\x03\x01 Mallard BASIC protected program data (v1.11)
+0 string \xfc\x04\x01 Mallard BASIC protected program data (v1.29+)
+
+0 string MIOPEN Mallard BASIC Jetsam data
+0 string Jetsam0 Mallard BASIC Jetsam index data
+
+
#------------------------------------------------------------------------------
+# $File: msooxml,v 1.4 2014/01/06 18:16:24 rrt Exp $
+# msooxml: file(1) magic for Microsoft Office XML
+# From: Ralf Brown <ralf.brown at gmail.com>
+
+# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP
+# archive. The first member file is normally "[Content_Types].xml".
+# but some libreoffice generated files put this later. Perhaps skip
+# the "[Content_Types].xml" test?
+# Since MSOOXML doesn't have anything like the uncompressed "mimetype"
+# file of ePub or OpenDocument, we'll have to scan for a filename
+# which can distinguish between the three types
+
+# start by checking for ZIP local file header signature
+0 string PK\003\004
+!:strength +10
+# make sure the first file is correct
+>0x1E regex \[Content_Types\]\.xml|_rels/\.rels
+# skip to the second local file header
+# since some documents include a 520-byte extra field following the file
+# header, we need to scan for the next header
+>>(18.l+49) search/2000 PK\003\004
+# now skip to the *third* local file header; again, we need to scan due to a
+# 520-byte extra field following the file header
+>>>&26 search/1000 PK\003\004
+# and check the subdirectory name to determine which type of OOXML
+# file we have. Correct the mimetype with the registered ones:
+# http://technet.microsoft.com/en-us/library/cc179224.aspx
+>>>>&26 string word/ Microsoft Word 2007+
+!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document
+>>>>&26 string ppt/ Microsoft PowerPoint 2007+
+!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation
+>>>>&26 string xl/ Microsoft Excel 2007+
+!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
+>>>>&26 default x Microsoft OOXML
+
+#------------------------------------------------------------------------------
# $File: msvc,v 1.5 2009/09/19 16:28:11 christos Exp $
# msvc: file(1) magic for msvc
# "H. Nanosecond" <aldomel at ix.netcom.com>
@@ -12023,6 +14756,261 @@
0 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000
# these seem to start with the version and contain menus
+#------------------------------------------------------------------------------
+# msx: file(1) magic for the MSX Home Computer
+# v1.1
+# Fabio R. Schmidlin <sd-snatcher at users.sourceforge.net>
+
+############## MSX Music file formats ##############
+
+# Gigamix MGSDRV music file
+0 string MGS MSX Gigamix MGSDRV3 music file,
+>6 ubeshort 0x0D0A
+>>3 byte x \bv%c
+>>4 byte x \b.%c
+>>5 byte x \b%c
+>>8 string >\0 \b, title: %s
+
+1 string mgs2\ MSX Gigamix MGSDRV2 music file
+>6 uleshort 0x80
+>>0x2E uleshort 0
+>>>0x30 string >\0 \b, title: %s
+
+# KSS music file
+0 string KSCC KSS music file v1.03
+>0xE byte 0
+>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+)
+>>0xF byte&0x02 2 \b, soundchip(s): SN76489
+>>>0xF byte&0x04 4 stereo
+>>0xF byte&0x01 1 \b, YM2413
+>>0xF byte&0x08 8 \b, Y8950
+
+0 string KSSX KSS music file v1.20
+>0xE byte&0xEF 0
+>>0xF byte&0x40 0x00 \b, 60Hz
+>>0xF byte&0x40 0x40 \b, 50Hz
+>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+)
+>>0xF byte&0x02 0x02 \b, soundchips: SN76489
+>>>0xF byte&0x04 0x04 stereo
+>>0xF byte&0x01 0x01 \b,
+>>>0xF byte&0x18 0x00 \bYM2413
+>>>0xF byte&0x18 0x08 \bYM2413, Y8950
+>>>0xF byte&0x18 0x18 \bYM2413+Y8950 pseudostereo
+>>0xF byte&0x18 0x10 \b, Majyutsushi DAC
+
+# Moonblaster for Moonsound
+0 string MBMS
+>4 byte 0x10 MSX Moonblaster for MoonSound music
+
+# Music Player K-kaz
+0 string MPK MSX Music Player K-kaz song
+>6 ubeshort 0x0D0A
+>>3 byte x v%c
+>>4 byte x \b.%c
+>>5 byte x \b%c
+
+# I don't know why these don't work
+#0 search/0xFFFF \r\n.FM9
+#>0 search/0xFFFF \r\n#FORMAT MSX Music Player K-kaz source MML file
+#0 search/0xFFFF \r\nFM1\ \=
+#>0 search/0xFFFF \r\nPSG1\=
+#>>0 search/0xFFFF \r\nSCC1\= MSX MuSiCa MML source file
+
+# OPX Music file
+0x35 beshort 0x0d0a
+>0x7B beshort 0x0d0a
+>>0x7D byte 0x1a
+>>>0x87 uleshort 0 MSX OPX Music file
+>>>>0x86 byte 0 v1.5
+>>>>>0 string >\32 \b, title: %s
+>>>>0x86 byte 1 v2.4
+>>>>>0 string >\32 \b, title: %s
+
+# SCMD music file
+0x8B string SCMD
+>0xCE uleshort 0 MSX SCMD Music file
+#>>-2 uleshort 0x6a71 ; The file must end with this value. How to code this here?
+>>0x8F string >\0 \b, title: %s
+
+0 search/0xFFFF \r\n at title
+>&0 search/0xFFFF \r\n at m=[ MSX SCMD source MML file
+
+
+############## MSX image file formats ##############
+
+# MSX raw VRAM dump
+0 ubyte 0xFE
+>1 uleshort 0
+>>5 uleshort 0
+>>>3 uleshort 0x37FF MSX SC2/GRP raw image
+>>>3 uleshort 0x6A00 MSX Graph Saurus SR5 raw image
+>>>3 uleshort >0x769E
+>>>>3 uleshort <0x8000 MSX GE5/GE6 raw image
+>>>>>3 uleshort 0x7FFF \b, with sprite patterns
+>>>3 uleshort 0xD3FF MSX screen 7-12 raw image
+>>>3 uleshort 0xD400 MSX Graph Saurus SR7/SR8/SRS raw image
+
+# Graph Saurus compressed images
+0 ubyte 0xFD
+>1 uleshort 0
+>>5 uleshort 0
+>>>3 uleshort >0x013D MSX Graph Saurus compressed image
+
+# Maki-chan Graphic format
+0 string MAKI02\ \ Maki-chan image,
+>8 byte x system ID: %c
+>9 byte x \b%c
+>10 byte x \b%c
+>11 byte x \b%c,
+>13 search/0x200 \x1A
+# >>&3 ubyte 0 , video mode: PC-98 400 lines, 16 analog colors
+# >>&3 ubyte 1 , video mode: MSX SC7, 16 analog colors
+# >>&3 ubyte 2 , video mode: VM-98 400 lines, 8 analog colors
+# >>&3 ubyte 3 , video mode: PC-88 analog, 200 lines, 8 analog colors
+# >>&3 ubyte 4 , video mode: 400 lines, 16 digital colors
+# >>&3 ubyte 5 , video mode: 200 lines, 16 digital colors
+# >>&3 ubyte 6 , video mode: old PC-98 digital 400 lines, 8 colors
+# >>&3 ubyte 7 , video mode: PC-88 400 lines, 8 digital colors
+>>&8 uleshort+1 x %dx
+>>&10 uleshort+1 x \b%d,
+>>&3 ubyte&0x82 0x80 256 colors
+>>&3 ubyte&0x82 0x00 16 colors
+>>&3 ubyte&0x82 0x01 8 colors
+>>&3 ubyte&0x04 4 digital
+>>&3 ubyte&0x04 0 analog
+>>&3 ubyte&0x01 1 \b, 2:1 dot aspect ratio
+
+# Japanese PIC file
+0 string PIC\x1A
+>4 lelong 0 Japanese PIC image file
+
+# MSX G9B image file
+0 string G9B
+>1 uleshort 11
+>>3 uleshort >10
+>>>5 ubyte >0 MSX G9B image, depth=%d
+>>>>8 uleshort x \b, %dx
+>>>>10 uleshort x \b%d
+>>>>5 ubyte <9
+>>>>>6 ubyte 0
+>>>>>>7 ubyte x \b, codec=%d RGB color palettes
+>>>>>6 ubyte 64 \b, codec=RGB fixed color
+>>>>>6 ubyte 128 \b, codec=YJK
+>>>>>6 ubyte 192 \b, codec=YUV
+>>>>5 ubyte >8 codec=RGB fixed color
+>>>>12 ubyte 0 \b, raw
+>>>>12 ubyte 1 \b, bitbuster compression
+
+############## Other MSX file formats ##############
+
+# MSX ROMs
+0 string AB
+>2 uleshort 0x0010 MSX ROM
+>>2 uleshort x \b, init=0x%4x
+>>4 uleshort >0 \b, stat=0x%4x
+>>6 uleshort >0 \b, dev=0x%4x
+>>8 uleshort >0 \b, bas=0x%4x
+>2 uleshort 0x4010 MSX ROM
+>>2 uleshort x \b, init=0x%04x
+>>4 uleshort >0 \b, stat=0x%04x
+>>6 uleshort >0 \b, dev=0x%04x
+>>8 uleshort >0 \b, bas=0x%04x
+>2 uleshort 0x8010 MSX ROM
+>>2 uleshort x \b, init=0x%04x
+>>4 uleshort >0 \b, stat=0x%04x
+>>6 uleshort >0 \b, dev=0x%04x
+>>8 uleshort >0 \b, bas=0x%04x
+
+0 string AB
+#>2 string 5JSuperLAYDOCK MSX Super Laydock ROM
+#>3 string @HYDLIDE3MSX MSX Hydlide-3 ROM
+#>3 string @3\x80IA862 Golvellius MSX1 ROM
+>2 uleshort >10
+>>10 string \0\0\0\0\0\0 MSX ROM
+>>>0x10 string YZ\0\0\0\0 Konami Game Master 2 MSX ROM
+>>>0x10 string CD \b, Konami RC-
+>>>>0x12 ubyte x \b%d
+>>>>0x13 ubyte/16 x \b%d
+>>>>0x13 ubyte&0xF x \b%d
+>>>0x10 string EF \b, Konami RC-
+>>>>0x12 ubyte x \b%d
+>>>>0x13 ubyte/16 x \b%d
+>>>>0x13 ubyte&0xF x \b%d
+>>>2 uleshort x \b, init=0x%04x
+>>>4 uleshort >0 \b, stat=0x%04x
+>>>6 uleshort >0 \b, dev=0x%04x
+>>>8 uleshort >0 \b, bas=0x%04x
+>2 uleshort 0
+>>4 uleshort 0
+>>>6 uleshort 0
+>>>>8 uleshort >0 MSX BASIC program in ROM, bas=0x%04x
+
+0x4000 string AB
+>0x4002 uleshort >0x4010
+>>0x400A string \0\0\0\0\0\0 MSX MegaROM with nonstandard page order
+>>0x4002 uleshort x \b, init=0x%04x
+>>0x4004 uleshort >0 \b, stat=0x%04x
+>>0x4006 uleshort >0 \b, dev=0x%04x
+>>0x4008 uleshort >0 \b, bas=0x%04x
+
+0x8000 string AB
+>0x8002 uleshort >0x4010
+>>0x800A string \0\0\0\0\0\0 MSX MegaROM with nonstandard page order
+>>0x8002 uleshort x \b, init=0x%04x
+>>0x8004 uleshort >0 \b, stat=0x%04x
+>>0x8006 uleshort >0 \b, dev=0x%04x
+>>0x8008 uleshort >0 \b, bas=0x%04x
+
+
+0x3C000 string AB
+>0x3C008 string \0\0\0\0\0\0\0\0 MSX MegaROM with nonstandard page order
+>>0x3C002 uleshort x \b, init=0x%04x
+>>0x3C004 uleshort >0 \b, stat=0x%04x
+>>0x3C006 uleshort >0 \b, dev=0x%04x
+>>0x3C008 uleshort >0 \b, bas=0x%04x
+
+# MSX BIN file
+#0 byte 0xFE
+#>1 uleshort >0x8000
+#>>3 uleshort >0x8004
+#>>>5 uleshort >0x8000 MSX BIN file
+
+# MSX-BASIC file
+0 byte 0xFF
+>3 uleshort 0x000A
+>>1 uleshort >0x8000 MSX-BASIC program
+
+# MSX .CAS file
+0 string \x1F\xA6\xDE\xBA\xCC\x13\x7D\x74 MSX cassette archive
+
+# Mega-Assembler file
+0 byte 0xFE
+>1 uleshort 0x0001
+>>5 uleshort 0xffff
+>>>6 byte 0x0A MSX Mega-Assembler source
+
+# Execrom Patchfile
+0 string ExecROM\ patchfile\x1A MSX ExecROM patchfile
+>0x12 ubyte/16 x v%d
+>0x12 ubyte&0xF x \b.%d
+>0x13 ubyte x \b, contains %d patches
+
+# Konami's King's Valley-2 custom stage (ELG file)
+4 uleshort 0x0900
+>0xF byte 1
+>>0x14 byte 0
+>>>0x1E string \ \ \
+>>>>0x23 byte 1
+>>>>>0x25 byte 0
+>>>>>>0x15 string >\x30
+>>>>>>>0x15 string <\x5A Konami King's Valley-2 custom stage, title: "%-8.8s"
+>>>>>>>>0x1D byte <32 \b, theme: %d
+
+# Metal Gear 1 savegame
+#0x4F string \x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF
+#>>0x60 string \xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF
+#>>>0x7B string \0x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00 Metal Gear 1 savegame
+
# ------------------------------------------------------------------------
# $File: mup,v 1.4 2009/09/19 16:28:11 christos Exp $
# mup: file(1) magic for Mup (Music Publisher) input file.
@@ -12046,13 +15034,30 @@
>>>7 string x \b, need V%.4s
>>8 string .
>>>7 string x \b, need V%.3s
+#------------------------------------------------------------------------------
+# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $
+# music: file (1) magic for music formats
+# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks
+# and Bagpipe Writer by Doug Wickstrom
+#
+0 string Bagpipe Bagpipe
+>8 string Reader Reader
+>>15 string >\0 (version %.3s)
+>8 string Music\ Writer Music Writer
+>>20 string :
+>>>21 string >\0 (version %.3s)
+>>21 string Gold Gold
+>>>25 string :
+>>>>26 string >\0 (version %.3s)
+
+
#-----------------------------------------------------------------------------
-# $File: natinst,v 1.4 2009/09/19 16:28:11 christos Exp $
+# $File: natinst,v 1.6 2014/06/03 19:17:27 christos Exp $
# natinst: file(1) magic for National Instruments Code Files
#
-# From <egamez at fcfm.buap.mx> Enrique G\xE1mez-Flores
+# From <egamez at fcfm.buap.mx> Enrique Gamez-Flores
# version 1
# Many formats still missing, we use, for the moment LabVIEW
# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing
@@ -12060,7 +15065,7 @@
0 string RSRC National Instruments,
# Check if it's a LabVIEW File
>8 string LV LabVIEW File,
-# Check wich kind of file is
+# Check which kind of file it is
>>10 string SB Code Resource File, data
>>10 string IN Virtual Instrument Program, data
>>10 string AR VI Library, data
@@ -12072,7 +15077,7 @@
0 string VMAP National Instruments, VXI File, data
#------------------------------------------------------------------------------
-# $File: ncr,v 1.7 2009/09/19 16:28:11 christos Exp $
+# $File: ncr,v 1.8 2014/04/30 21:41:02 christos Exp $
# ncr: file(1) magic for NCR Tower objects
#
# contributed by
@@ -12083,27 +15088,27 @@
>12 belong >0 not stripped
>20 beshort 0407 executable
>20 beshort 0410 pure executable
->22 beshort >0 - version %ld
+>22 beshort >0 - version %d
0 beshort 000615 Tower/XP rel 2 object
>12 belong >0 not stripped
>20 beshort 0407 executable
>20 beshort 0410 pure executable
->22 beshort >0 - version %ld
+>22 beshort >0 - version %d
0 beshort 000620 Tower/XP rel 3 object
>12 belong >0 not stripped
>20 beshort 0407 executable
>20 beshort 0410 pure executable
->22 beshort >0 - version %ld
+>22 beshort >0 - version %d
0 beshort 000625 Tower/XP rel 3 object
>12 belong >0 not stripped
>20 beshort 0407 executable
>20 beshort 0410 pure executable
->22 beshort >0 - version %ld
+>22 beshort >0 - version %d
0 beshort 000630 Tower32/600/400 68020 object
>12 belong >0 not stripped
>20 beshort 0407 executable
>20 beshort 0410 pure executable
->22 beshort >0 - version %ld
+>22 beshort >0 - version %d
0 beshort 000640 Tower32/800 68020
>18 beshort &020000 w/68881 object
>18 beshort &040000 compatible object
@@ -12111,7 +15116,7 @@
>20 beshort 0407 executable
>20 beshort 0413 pure executable
>12 belong >0 not stripped
->22 beshort >0 - version %ld
+>22 beshort >0 - version %d
0 beshort 000645 Tower32/800 68010
>18 beshort &040000 compatible object
>18 beshort &060000 object
@@ -12118,20 +15123,30 @@
>20 beshort 0407 executable
>20 beshort 0413 pure executable
>12 belong >0 not stripped
->22 beshort >0 - version %ld
+>22 beshort >0 - version %d
+#------------------------------------------------------------
+# $File: neko,v 1.1 2009/11/10 20:36:10 christos Exp $
+
+# From: Mikhail Gusarov <dottedmag at dottedmag.net>
+# NekoVM (http://nekovm.org/) bytecode
+0 string NEKO NekoVM bytecode
+>4 lelong x (%d global symbols,
+>8 lelong x %d global fields,
+>12 lelong x %d bytecode ops)
+!:mime application/x-nekovm-bytecode
+
+
#------------------------------------------------------------------------------
-# $File: netbsd,v 1.18 2009/09/19 16:28:11 christos Exp $
+# $File: netbsd,v 1.21 2014/03/29 15:40:34 christos Exp $
# netbsd: file(1) magic for NetBSD objects
#
# All new-style magic numbers are in network byte order.
+# The old-style magic numbers are indistinguishable from the same magic
+# numbers used in other systems, and are handled, for all those systems,
+# in aout.
#
-0 lelong 000000407 a.out NetBSD little-endian object file
->16 lelong >0 not stripped
-0 belong 000000407 a.out NetBSD big-endian object file
->16 belong >0 not stripped
-
0 belong&0377777777 041400413 a.out NetBSD/i386 demand paged
>0 byte &0x80
>>20 lelong <4096 shared library
@@ -12223,7 +15238,7 @@
0 belong&0377777777 045200507 a.out NetBSD/powerpc core
>12 string >\0 from '%s'
-0 belong&0377777777 042400413 a.out NetBSD/sparc demand paged
+0 belong&0377777777 042400413 a.out NetBSD/SPARC demand paged
>0 byte &0x80
>>20 belong <8192 shared library
>>20 belong =8192 dynamically linked executable
@@ -12230,11 +15245,11 @@
>>20 belong >8192 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
-0 belong&0377777777 042400410 a.out NetBSD/sparc pure
+0 belong&0377777777 042400410 a.out NetBSD/SPARC pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
-0 belong&0377777777 042400407 a.out NetBSD/sparc
+0 belong&0377777777 042400407 a.out NetBSD/SPARC
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
@@ -12241,7 +15256,7 @@
>>20 belong !0 executable
>>20 belong =0 object file
>16 belong >0 not stripped
-0 belong&0377777777 042400507 a.out NetBSD/sparc core
+0 belong&0377777777 042400507 a.out NetBSD/SPARC core
>12 string >\0 from '%s'
>32 belong !0 (signal %d)
@@ -12367,6 +15382,45 @@
>12 string >\0 from '%s'
>32 lelong !0 (signal %d)
+# Kernel core dump format
+0 belong&0x0000ffff 0x00008fca NetBSD kernel core file
+>0 belong&0x03ff0000 0x00000000 \b, Unknown
+>0 belong&0x03ff0000 0x00001000 \b, sun 68010/68020
+>0 belong&0x03ff0000 0x00020000 \b, sun 68020
+>0 belong&0x03ff0000 0x00640000 \b, 386 PC
+>0 belong&0x03ff0000 0x00860000 \b, i386 BSD
+>0 belong&0x03ff0000 0x00870000 \b, m68k BSD (8K pages)
+>0 belong&0x03ff0000 0x00880000 \b, m68k BSD (4K pages)
+>0 belong&0x03ff0000 0x00890000 \b, ns32532 BSD
+>0 belong&0x03ff0000 0x008a0000 \b, SPARC/32 BSD
+>0 belong&0x03ff0000 0x008b0000 \b, pmax BSD
+>0 belong&0x03ff0000 0x008c0000 \b, vax BSD (1K pages)
+>0 belong&0x03ff0000 0x008d0000 \b, alpha BSD
+>0 belong&0x03ff0000 0x008e0000 \b, mips BSD (Big Endian)
+>0 belong&0x03ff0000 0x008f0000 \b, arm6 BSD
+>0 belong&0x03ff0000 0x00900000 \b, m68k BSD (2K pages)
+>0 belong&0x03ff0000 0x00910000 \b, sh3 BSD
+>0 belong&0x03ff0000 0x00920000 \b, ppc BSD (Big Endian)
+>0 belong&0x03ff0000 0x00930000 \b, vax BSD (4K pages)
+>0 belong&0x03ff0000 0x00940000 \b, mips1 BSD
+>0 belong&0x03ff0000 0x00950000 \b, mips2 BSD
+>0 belong&0x03ff0000 0x00960000 \b, parisc BSD
+>0 belong&0x03ff0000 0x00970000 \b, sh5/64 BSD
+>0 belong&0x03ff0000 0x00980000 \b, SPARC/64 BSD
+>0 belong&0x03ff0000 0x00990000 \b, amd64 BSD
+>0 belong&0x03ff0000 0x009a0000 \b, hp200 (68010) BSD
+>0 belong&0x03ff0000 0x009b0000 \b, hp300 (68020+68881) BSD
+>0 belong&0x03ff0000 0x009b0000 \b, hp300 (68020+68881) BSD
+>0 belong&0x03ff0000 0x00c80000 \b, hp200
+>0 belong&0x03ff0000 0x020b0000 \b, hp300 (68020+68881) HP-UX
+>0 belong&0x03ff0000 0x020c0000 \b, hp300 (68020+68881) HP-UX
+>0 belong&0xfc000000 0x04000000 \b, CPU
+>0 belong&0xfc000000 0x08000000 \b, DATA
+>0 belong&0xfc000000 0x10000000 \b, STACK
+>4 leshort x \b, (headersize = %d
+>6 leshort x \b, segmentsize = %d
+>6 lelong x \b, segments = %d)
+
#------------------------------------------------------------------------------
# $File: netscape,v 1.6 2009/09/19 16:28:11 christos Exp $
# netscape: file(1) magic for Netscape files
@@ -12413,7 +15467,7 @@
8 belong 0x137A2B48 X11/NeWS font family
#------------------------------------------------------------------------------
-# $File: nitpicker,v 1.4 2009/09/19 16:28:11 christos Exp $
+# $File: nitpicker,v 1.6 2014/04/30 21:41:02 christos Exp $
# nitpicker: file(1) magic for Flowfiles.
# From: Christian Jachmann <C.Jachmann at gmx.net> http://www.nitpicker.de
0 string NPFF NItpicker Flow File
@@ -12427,6 +15481,18 @@
>26 belong x Pkts: %u
#------------------------------------------------------------------------------
+# $File: oasis,v 1.2 2014/06/03 19:17:27 christos Exp $
+# OASIS
+# Summary: OASIS stream file
+# Long description: Open Artwork System Interchange Standard
+# File extension: .oas
+# Full name: Ben Cowley (bcowley at broadcom.com)
+# Philip Dixon (pdixon at broadcom.com)
+# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf
+# (see page 3)
+0 string %SEMI-OASIS\r\n OASIS Stream file
+
+#------------------------------------------------------------------------------
# $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $
# ocaml: file(1) magic for Objective Caml files.
0 string Caml1999 OCaml
@@ -12646,7 +15712,7 @@
>&213 byte 0x30 \b, at least V2R3 to open
#------------------------------------------------------------------------------
-# $File: os9,v 1.6 2009/09/19 16:28:11 christos Exp $
+# $File: os9,v 1.7 2011/05/13 22:15:54 christos Exp $
#
# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
#
@@ -12658,14 +15724,7 @@
# 2. Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
-# 3. All advertising materials mentioning features or use of this software
-# must display the following acknowledgement:
-# This product includes software developed by Ignatios Souvatzis for
-# the NetBSD project.
-# 4. The name of the author may not be used to endorse or promote products
-# derived from this software without specific prior written permission.
#
-#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
@@ -12743,66 +15802,125 @@
0 short 0565 i386 COFF object
#------------------------------------------------------------------------------
-# $File: palm,v 1.7 2009/09/19 16:28:11 christos Exp $
-# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
+# $File: palm,v 1.13 2014/03/30 21:40:08 christos Exp $
+# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
#
# Brian Lalor <blalor at hcirisc.cs.binghamton.edu>
+# These are weak, byte 59 is not guaranteed to be 0 and there are
+# 8 character identifiers at byte 60, one I found for appl is BIGb.
+# What are the possibilities and where is this documented?
+
+# The common header format for PalmOS .pdb/.prc files is
+# {
+# char name[ 32 ];
+# Word attributes;
+# Word version;
+# DWord creationDate;
+# DWord modificationDate;
+# DWord lastBackupDate;
+# DWord modificationNumber;
+# DWord appInfoID;
+# DWord sortInfoID;
+# char type[4];
+# char creator[4];
+# DWord uniqueIDSeed;
+# RecordListType recordList;
+# };
+#
+# Datestamps are unsigned seconds since the MacOS epoch (Jan 1, 1904),
+# or Unix/POSIX time + 2082844800.
+
+0 name aportisdoc
+# date is supposed to be big-endian seconds since 1 Jan 1904, but many
+# files contain the timestamp in little-endian or a completely
+# nonsensical value...
+#>36 bedate-2082844800 >0 \b, created %s
+# compression: 1=uncomp, 2=orig, 0x4448=HuffDic
+>(78.L) beshort =1 \b, uncompressed
+# compressed
+>(78.L) beshort >1
+>>(78.L+4) belong x \b, %d bytes uncompressed
+
# appl
-60 belong 0x6170706c PalmOS application
->0 string >\0 "%s"
-# TEXt
-60 belong 0x54455874 AportisDoc file
->0 string >\0 "%s"
+#60 string appl PalmOS application
+#>0 string >\0 "%s"
+
# HACK
-60 belong 0x4841434b HackMaster hack
->0 string >\0 "%s"
+#60 string HACK HackMaster hack
+#>0 string >\0 "%s"
+# iSiloX e-book
+60 string SDocSilX iSiloX E-book
+>0 string >\0 "%s"
+
+# Mobipocket (www.mobipocket.com), donated by Carl Witty
+# expanded by Ralf Brown
+60 string BOOKMOBI Mobipocket E-book
+# MobiPocket stores a full title, pointed at by the belong at offset
+# 0x54 in its header at (78.L), with length given by the belong at
+# offset 0x58.
+# there's no guarantee that the title string is null-terminated, but
+# we currently can't specify a variable-length string where the length
+# field is not at the start of the string; in practice, the data
+# following the string always seems to start with a zero byte
+>(78.L) belong x
+>>&(&0x50.L-4) string >\0 "%s"
+>0 use aportisdoc
+>>(78.L+0x68) belong >0 \b, version %d
+>>(78.L+0x1C) belong !0 \b, codepage %d
+>>(78.L+0x0C) beshort >0 \b, encrypted (type %d)
+
+# AportisDoc/PalmDOC
+60 string TEXtREAd AportisDoc/PalmDOC E-book
+>0 string >\0 "%s"
+>0 use aportisdoc
+
# Variety of PalmOS document types
# Michael-John Turner <mj at debian.org>
# Thanks to Hasan Umit Ezerce <humit at tr-net.net.tr> for his DocType
-60 string BVokBDIC BDicty PalmOS document
->0 string >\0 "%s"
-60 string DB99DBOS DB PalmOS document
->0 string >\0 "%s"
-60 string vIMGView FireViewer/ImageViewer PalmOS document
->0 string >\0 "%s"
-60 string PmDBPmDB HanDBase PalmOS document
->0 string >\0 "%s"
-60 string InfoINDB InfoView PalmOS document
->0 string >\0 "%s"
-60 string ToGoToGo iSilo PalmOS document
->0 string >\0 "%s"
-60 string JfDbJBas JFile PalmOS document
->0 string >\0 "%s"
-60 string JfDbJFil JFile Pro PalmOS document
->0 string >\0 "%s"
-60 string DATALSdb List PalmOS document
->0 string >\0 "%s"
-60 string Mdb1Mdb1 MobileDB PalmOS document
->0 string >\0 "%s"
-60 string PNRdPPrs PeanutPress PalmOS document
->0 string >\0 "%s"
-60 string DataPlkr Plucker PalmOS document
->0 string >\0 "%s"
-60 string DataSprd QuickSheet PalmOS document
->0 string >\0 "%s"
-60 string SM01SMem SuperMemo PalmOS document
->0 string >\0 "%s"
-60 string TEXtTlDc TealDoc PalmOS document
->0 string >\0 "%s"
-60 string InfoTlIf TealInfo PalmOS document
->0 string >\0 "%s"
-60 string DataTlMl TealMeal PalmOS document
->0 string >\0 "%s"
-60 string DataTlPt TealPaint PalmOS document
->0 string >\0 "%s"
-60 string dataTDBP ThinkDB PalmOS document
->0 string >\0 "%s"
-60 string TdatTide Tides PalmOS document
->0 string >\0 "%s"
-60 string ToRaTRPW TomeRaider PalmOS document
->0 string >\0 "%s"
+60 string BVokBDIC BDicty PalmOS document
+>0 string >\0 "%s"
+60 string DB99DBOS DB PalmOS document
+>0 string >\0 "%s"
+60 string vIMGView FireViewer/ImageViewer PalmOS document
+>0 string >\0 "%s"
+60 string PmDBPmDB HanDBase PalmOS document
+>0 string >\0 "%s"
+60 string InfoINDB InfoView PalmOS document
+>0 string >\0 "%s"
+60 string ToGoToGo iSilo PalmOS document
+>0 string >\0 "%s"
+60 string JfDbJBas JFile PalmOS document
+>0 string >\0 "%s"
+60 string JfDbJFil JFile Pro PalmOS document
+>0 string >\0 "%s"
+60 string DATALSdb List PalmOS document
+>0 string >\0 "%s"
+60 string Mdb1Mdb1 MobileDB PalmOS document
+>0 string >\0 "%s"
+60 string PNRdPPrs PeanutPress PalmOS document
+>0 string >\0 "%s"
+60 string DataPlkr Plucker PalmOS document
+>0 string >\0 "%s"
+60 string DataSprd QuickSheet PalmOS document
+>0 string >\0 "%s"
+60 string SM01SMem SuperMemo PalmOS document
+>0 string >\0 "%s"
+60 string TEXtTlDc TealDoc PalmOS document
+>0 string >\0 "%s"
+60 string InfoTlIf TealInfo PalmOS document
+>0 string >\0 "%s"
+60 string DataTlMl TealMeal PalmOS document
+>0 string >\0 "%s"
+60 string DataTlPt TealPaint PalmOS document
+>0 string >\0 "%s"
+60 string dataTDBP ThinkDB PalmOS document
+>0 string >\0 "%s"
+60 string TdatTide Tides PalmOS document
+>0 string >\0 "%s"
+60 string ToRaTRPW TomeRaider PalmOS document
+>0 string >\0 "%s"
# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net)
# For version 1.xx zTXTs, outputs version and numbers of bookmarks and
@@ -12825,14 +15943,18 @@
>>(0x4E.L+1) byte x %02d)
# Palm OS .prc file types
-60 string libr Palm OS dynamic library data
->0 string >\0 "%s"
+60 string libr
+# flags, only bit 0 or bit 6
+# http://en.wikipedia.org/wiki/PRC_%28Palm_OS%29
+# http://web.mit.edu/tytso/www/pilot/prc-format.html
+>0x20 beshort&0xffbe 0
+>>0 string >\0 Palm OS dynamic library data "%s"
60 string ptch Palm OS operating system patch data
>0 string >\0 "%s"
# Mobipocket (www.mobipocket.com), donated by Carl Witty
-60 string BOOKMOBI Mobipocket E-book
->0 string >\0 "%s"
+60 string BOOKMOBI Mobipocket E-book
+>0 string >\0 "%s"
#------------------------------------------------------------------------------
# $File: parix,v 1.4 2009/09/19 16:28:11 christos Exp $
@@ -12868,8 +15990,29 @@
>40 byte x Parrot %d.
>48 byte x \b%d.
>56 byte x \b%d
+#------------------------------------------------------------------------------
+# $File: pascal,v 1.1 2011/12/08 12:12:46 rrt Exp $
+# pascal: file(1) magic for Pascal source
+#
+0 search/8192 (input, Pascal source text
+!:mime text/x-pascal
+0 regex \^program Pascal source text
+!:mime text/x-pascal
+0 regex \^record Pascal source text
+!:mime text/x-pascal
#------------------------------------------------------------------------------
+# $File: pbf,v 1.1 2013/12/21 14:27:24 christos Exp $
+# file(1) magic(5) data for OpenStreetMap
+
+# OpenStreetMap Protocolbuffer Binary Format (.osm.pbf)
+# http://wiki.openstreetmap.org/wiki/PBF_Format
+# From: Markus Heidelberg <markus.heidelberg at web.de>
+0 belong 0x0000000D
+>4 beshort 0x0A09
+>>6 string OSMHeader OpenStreetMap Protocolbuffer Binary Format
+
+#------------------------------------------------------------------------------
# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $
# pbm: file(1) magic for Portable Bitmap files
#
@@ -12878,7 +16021,7 @@
0 short 0x2a17 "compact bitmap" format (Poskanzer)
#------------------------------------------------------------------------------
-# $File: pdf,v 1.6 2009/09/19 16:28:11 christos Exp $
+# $File: pdf,v 1.7 2013/08/22 07:47:26 christos Exp $
# pdf: file(1) magic for Portable Document Format
#
@@ -12890,11 +16033,12 @@
# From: Nick Schmalenberger <nick at schmalenberger.us>
# Forms Data Format
0 string %FDF- FDF document
+!:mime application/vnd.fdf
>5 byte x \b, version %c
>7 byte x \b.%c
#------------------------------------------------------------------------------
-# $File: pdp,v 1.8 2009/09/19 16:28:11 christos Exp $
+# $File: pdp,v 1.10 2014/04/30 21:41:02 christos Exp $
# pdp: file(1) magic for PDP-11 executable/object and APL workspace
#
0 lelong 0101555 PDP-11 single precision APL workspace
@@ -12904,18 +16048,24 @@
#
0 leshort 0407 PDP-11 executable
>8 leshort >0 not stripped
->15 byte >0 - version %ld
+>15 byte >0 - version %d
-0 leshort 0401 PDP-11 UNIX/RT ldp
+# updated by Joerg Jenderek at Mar 2013
+# GRR: line below too general as it catches also Windows precompiled setup information *.PNF
+0 leshort 0401
+# skip *.PNF with WinDirPathOffset 58h
+>68 ulelong !0x00000058 PDP-11 UNIX/RT ldp
+# skip *.PNF with high byte of InfVersionDatumCount zero
+#>>15 byte !0 PDP-11 UNIX/RT ldp
0 leshort 0405 PDP-11 old overlay
0 leshort 0410 PDP-11 pure executable
>8 leshort >0 not stripped
->15 byte >0 - version %ld
+>15 byte >0 - version %d
0 leshort 0411 PDP-11 separate I&D executable
>8 leshort >0 not stripped
->15 byte >0 - version %ld
+>15 byte >0 - version %d
0 leshort 0437 PDP-11 kernel overlay
@@ -12928,41 +16078,40 @@
0 leshort 0431 PDP-11 overlaid separate executable
>8 leshort >0 not stripped
-
#------------------------------------------------------------------------------
-# $File: perl,v 1.16 2009/09/19 16:28:11 christos Exp $
+# $File: perl,v 1.22 2014/04/28 12:04:35 christos Exp $
# perl: file(1) magic for Larry Wall's perl language.
#
# The `eval' lines recognizes an outrageously clever hack.
# Keith Waclena <keith at cerberus.uchicago.edu>
# Send additions to <perl5-porters at perl.org>
-0 search/1/w #!\ /bin/perl Perl script text executable
-!:mime text/x-perl
0 search/1 eval\ "exec\ /bin/perl Perl script text
!:mime text/x-perl
-0 search/1/w #!\ /usr/bin/perl Perl script text executable
-!:mime text/x-perl
0 search/1 eval\ "exec\ /usr/bin/perl Perl script text
!:mime text/x-perl
-0 search/1/w #!\ /usr/local/bin/perl Perl script text executable
-!:mime text/x-perl
0 search/1 eval\ "exec\ /usr/local/bin/perl Perl script text
!:mime text/x-perl
0 search/1 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text
!:mime text/x-perl
+0 search/1 #!/usr/bin/env\ perl Perl script text executable
+!:mime text/x-perl
+0 search/1 #!\ /usr/bin/env\ perl Perl script text executable
+!:mime text/x-perl
+0 search/1 #!
+>0 regex \^#!.*/bin/perl$ Perl script text executable
+!:mime text/x-perl
-
# by Dmitry V. Levin and Alexey Tourbin
# check the first line
0 search/1 package
>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text
+!:strength + 10
# not 'p', check other lines
0 search/1 !p
>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *;
>>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text
+!:strength + 10
-
-
# Perl POD documents
# From: Tom Hukins <tom at eborcom.com>
0 search/1/W \=pod\n Perl POD document text
@@ -12971,7 +16120,10 @@
0 search/1/W \n\=head1\ Perl POD document text
0 search/1/W \=head2\ Perl POD document text
0 search/1/W \n\=head2\ Perl POD document text
+0 search/1/W \=encoding\ Perl POD document text
+0 search/1/W \n\=encoding\ Perl POD document text
+
# Perl Storable data files.
0 string perl-store perl Storable (v0.6) data
>4 byte >0 (net-order %d)
@@ -12986,7 +16138,90 @@
>>4 byte =4 (major 2)
>>5 byte >0 (minor %d)
+# This is Debian #742949 by Zefram <zefram at fysh.org>:
+# -----------------------------------------------------------
+# The Perl module Hash::SharedMem
+# <https://metacpan.org/release/Hash-SharedMem> defines a file format
+# for a key/value store. Details of the file format are in the "DESIGN"
+# file in the module distribution. Magic:
+0 bequad =0xa58afd185cbf5af7 Hash::SharedMem master file, big-endian
+>8 bequad <0x1000000
+>>15 byte >2 \b, line size 2^%d byte
+>>14 byte >2 \b, page size 2^%d byte
+>>13 byte &1
+>>>13 byte >1 \b, max fanout %d
+0 lequad =0xa58afd185cbf5af7 Hash::SharedMem master file, little-endian
+>8 lequad <0x1000000
+>>8 byte >2 \b, line size 2^%d byte
+>>9 byte >2 \b, page size 2^%d byte
+>>10 byte &1
+>>>10 byte >1 \b, max fanout %d
+0 bequad =0xc693dac5ed5e47c2 Hash::SharedMem data file, big-endian
+>8 bequad <0x1000000
+>>15 byte >2 \b, line size 2^%d byte
+>>14 byte >2 \b, page size 2^%d byte
+>>13 byte &1
+>>>13 byte >1 \b, max fanout %d
+0 lequad =0xc693dac5ed5e47c2 Hash::SharedMem data file, little-endian
+>8 lequad <0x1000000
+>>8 byte >2 \b, line size 2^%d byte
+>>9 byte >2 \b, page size 2^%d byte
+>>10 byte &1
+>>>10 byte >1 \b, max fanout %d
+
#------------------------------------------------------------------------------
+# $File: pgf,v 1.1 2013/04/22 15:19:49 christos Exp $
+# pgf: file(1) magic for Progressive Graphics File (PGF)
+#
+# <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf>
+# 2013 by Philipp Hahn <pmhahn debian org>
+0 string PGF Progressive Graphics image data,
+!:mime image/x-pgf
+>3 string 2 version %s,
+>3 string 4 version %s,
+>3 string 5 version %s,
+>3 string 6 version %s,
+# PGFPreHeader
+#>>4 lelong x header size %d,
+# PGFHeader
+>>8 lelong x %d x
+>>12 lelong x %d,
+>>16 byte x %d levels,
+>>17 byte x compression level %d,
+>>18 byte x %d bpp,
+>>19 byte x %d channels,
+>>20 clear x
+>>20 byte 0 bitmap,
+>>20 byte 1 gray scale,
+>>20 byte 2 indexed color,
+>>20 byte 3 RGB color,
+>>20 byte 4 CYMK color,
+>>20 byte 5 HSL color,
+>>20 byte 6 HSB color,
+>>20 byte 7 multi-channel,
+>>20 byte 8 duo tone,
+>>20 byte 9 LAB color,
+>>20 byte 10 gray scale 16,
+>>20 byte 11 RGB color 48,
+>>20 byte 12 LAB color 48,
+>>20 byte 13 CYMK color 64,
+>>20 byte 14 deep multi-channel,
+>>20 byte 15 duo tone 16,
+>>20 byte 17 RGBA color,
+>>20 byte 18 gray scale 32,
+>>20 byte 19 RGB color 12,
+>>20 byte 20 RGB color 16,
+>>20 byte 255 unknown format,
+>>20 default x format
+>>>20 byte x \b %d,
+>>21 byte x %d bpc
+# PGFPostHeader
+# Level-Sizes
+#>>(4.l+4) lelong x level 0 size: %d
+#>>(4.l+8) lelong x level 1 size: %d
+#>>(4.l+12) lelong x level 2 size: %d
+
+#------------------------------------------------------------------------------
# $File: pgp,v 1.9 2009/09/19 16:28:11 christos Exp $
# pgp: file(1) magic for Pretty Good Privacy
# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
@@ -13057,12 +16292,12 @@
>15 byte >0x02 - Bad Flags
#------------------------------------------------------------------------------
-# $File: printer,v 1.23 2010/11/25 15:00:12 christos Exp $
+# $File: printer,v 1.26 2014/04/12 14:51:52 christos Exp $
# printer: file(1) magic for printer-formatted files
#
# PostScript, updated by Daniel Quinlan (quinlan at yggdrasil.com)
-0 string/t %! PostScript document text
+0 string %! PostScript document text
!:mime application/postscript
!:apple ASPSTEXT
>2 string PS-Adobe- conforming
@@ -13121,6 +16356,26 @@
#>15 string \ ENTER\ LANGUAGE\ =
#>31 string PostScript PostScript
+# From: Stefan Thurner <thurners at nicsys.de>
+0 string \033%-12345X at PJL
+>&0 search/10000 %! PJL encapsulated PostScript document text
+
+# Rick Richardson <rickrich at gmail.com>
+
+# For Fuji-Xerox Printers - HBPL stands for Host Based Printer Language
+# For Oki Data Printers - HIPERC
+# For Konica Minolta Printers - LAVAFLOW
+# For Samsung Printers - QPDL
+# For HP Printers - ZJS stands for Zenographics ZJStream
+0 string \033%-12345X at PJL HP Printer Job Language data
+>0 search/10000 @PJL\ ENTER\ LANGUAGE=HBPL - HBPL
+>0 search/10000 @PJL\ ENTER\ LANGUAGE=HIPERC - Oki Data HIPERC
+>0 search/10000 @PJL\ ENTER\ LANGUAGE=LAVAFLOW - Konica Minolta LAVAFLOW
+>0 search/10000 @PJL\ ENTER\ LANGUAGE=QPDL - Samsung QPDL
+>0 search/10000 @PJL\ ENTER\ LANGUAGE\ =\ QPDL - Samsung QPDL
+>0 search/10000 @PJL\ ENTER\ LANGUAGE=ZJS - HP ZJS
+
+
# HP Printer Control Language, Daniel Quinlan (quinlan at yggdrasil.com)
0 string \033E\033 HP PCL printer data
>3 string \&l0A - default page size
@@ -13161,7 +16416,7 @@
#------------------------------------------------------------------------------
# zenographics: file(1) magic for Zenographics ZjStream printer data
-# Rick Richardson rickr at mn.rr.com
+# Rick Richardson <rickrich at gmail.com>
0 string JZJZ
>0x12 string ZZ Zenographics ZjStream printer data (big-endian)
0 string ZJZJ
@@ -13170,7 +16425,7 @@
#------------------------------------------------------------------------------
# Oak Technologies printer stream
-# Rick Richardson <rickr at mn.rr.com>
+# Rick Richardson <rickrich at gmail.com>
0 string OAK
>0x07 byte 0
>0x0b byte 0 Oak Technologies printer stream
@@ -13218,6 +16473,20 @@
#------------------------------------------------------------------------------
+# $File: pwsafe,v 1.1 2012/10/25 00:12:19 christos Exp $
+# pwsafe: file(1) magic for passwordsafe file
+#
+# Password Safe
+# http://passwordsafe.sourceforge.net/
+# file format specs
+# http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt
+# V2 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt
+# V1 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt
+# V2 and V1 have no easy identifier that I can find
+# .psafe3
+0 string PWS3 Password Safe V3 database
+
+#------------------------------------------------------------------------------
# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $
# pyramid: file(1) magic for Pyramids
#
@@ -13230,12 +16499,13 @@
>16 long >0 not stripped
#------------------------------------------------------------------------------
-# $File: python,v 1.16 2010/12/31 18:15:28 christos Exp $
+# $File: python,v 1.25 2014/05/06 16:08:32 christos Exp $
# python: file(1) magic for python
#
+# Outlook puts """ too for urgent messages
# From: David Necas <yeti at physics.muni.cz>
# often the module starts with a multiline string
-0 string/t """ a python script text executable
+0 string/t """ Python script text executable
# MAGIC as specified in Python/import.c (1.5 to 2.7a0 and 3.1a0, assuming
# that Py_UnicodeFlag is off for Python 2)
# 20121 ( YEAR - 1995 ) + MONTH + DAY (little endian followed by "\r\n"
@@ -13250,6 +16520,8 @@
0 belong 0x03f30d0a python 2.7 byte-compiled
0 belong 0x3b0c0d0a python 3.0 byte-compiled
0 belong 0x4f0c0d0a python 3.1 byte-compiled
+0 belong 0x6c0c0d0a python 3.2 byte-compiled
+0 belong 0x9e0c0d0a python 3.3 byte-compiled
0 search/1/w #!\ /usr/bin/python Python script text executable
!:mime text/x-python
@@ -13262,7 +16534,7 @@
# from module.submodule import func1, func2
-0 regex/b \^from\\s+(\\w|\\.)+\\s+import.*$ Python script text executable
+0 regex \^from\\s+(\\w|\\.)+\\s+import.*$ Python script text executable
!:mime text/x-python
# def __init__ (self, ...):
@@ -13271,13 +16543,13 @@
!:mime text/x-python
# comments
-0 search/4096 '''
->&0 regex .*'''$ Python script text executable
-!:mime text/x-python
+#0 search/4096 '''
+#>&0 regex .*'''$ Python script text executable
+#!:mime text/x-python
-0 search/4096 """
->&0 regex .*"""$ Python script text executable
-!:mime text/x-python
+#0 search/4096 """
+#>&0 regex .*"""$ Python script text executable
+#!:mime text/x-python
# try:
# except: or finally:
@@ -13288,8 +16560,13 @@
>&0 search/4096 finally: Python script text executable
!:mime text/x-python
+# def name(args, args):
+0 regex \^(\ |\\t){0,50}def\ {1,50}[a-zA-Z]{1,100}
+>&0 regex \ {0,50}\\(([a-zA-Z]|,|\ ){1,255}\\):$ Python script text executable
+!:mime text/x-python
+
#------------------------------------------------------------------------------
-# $File: revision,v 1.8 2010/11/25 15:00:12 christos Exp $
+# $File: revision,v 1.9 2013/02/06 14:18:52 christos Exp $
# file(1) magic for revision control files
# From Hendrik Scholz <hendrik at scholz.net>
0 string/t /1\ :pserver: cvs password text file
@@ -13318,7 +16595,7 @@
>4 belong =2 \b, version 2
# Type: Git index file
-# From: Frédéric Brière <fbriere at fbriere.net>
+# From: Frederic Briare <fbriere at fbriere.net>
0 string DIRC Git index
>4 belong >0 \b, version %d
>>8 belong >0 \b, %d entries
@@ -13341,13 +16618,53 @@
0 string #\ Bazaar\ merge\ directive\ format Bazaar merge directive
#------------------------------------------------------------------------------
-# $File: riff,v 1.20 2010/09/20 18:55:20 rrt Exp $
+# $File: riff,v 1.27 2014/04/30 21:41:02 christos Exp $
# riff: file(1) magic for RIFF format
# See
#
# http://www.seanet.com/users/matts/riffmci/riffmci.htm
#
-# AVI section extended by Patrik R\xE5dman <patrik+file-magic at iki.fi>
+
+# audio format tag. Assume limits: max 1024 bit, 128 channels, 1 MHz
+0 name riff-wave
+>0 leshort 1 \b, Microsoft PCM
+>>14 leshort >0
+>>>14 leshort <1024 \b, %d bit
+>0 leshort 2 \b, Microsoft ADPCM
+>0 leshort 6 \b, ITU G.711 A-law
+>0 leshort 7 \b, ITU G.711 mu-law
+>0 leshort 8 \b, Microsoft DTS
+>0 leshort 17 \b, IMA ADPCM
+>0 leshort 20 \b, ITU G.723 ADPCM (Yamaha)
+>0 leshort 49 \b, GSM 6.10
+>0 leshort 64 \b, ITU G.721 ADPCM
+>0 leshort 80 \b, MPEG
+>0 leshort 85 \b, MPEG Layer 3
+>0 leshort 0x2001 \b, DTS
+>2 leshort =1 \b, mono
+>2 leshort =2 \b, stereo
+>2 leshort >2
+>>2 leshort <128 \b, %d channels
+>4 lelong >0
+>>4 lelong <1000000 %d Hz
+
+# try to find "fmt "
+0 name riff-walk
+>0 string fmt\x20
+>>4 lelong <0x80
+>>>8 use riff-wave
+>0 string LIST
+>>&(4.l+4) use riff-walk
+>0 string DISP
+>>&(4.l+4) use riff-walk
+>0 string bext
+>>&(4.l+4) use riff-walk
+>0 string Fake
+>>&(4.l+4) use riff-walk
+>0 string fact
+>>&(4.l+4) use riff-walk
+
+# AVI section extended by Patrik Radman <patrik+file-magic at iki.fi>
#
0 string RIFF RIFF (little-endian) data
# RIFF Palette format
@@ -13376,33 +16693,21 @@
# Microsoft WAVE format (*.wav)
>8 string WAVE \b, WAVE audio
!:mime audio/x-wav
->>20 leshort 1 \b, Microsoft PCM
->>>34 leshort >0 \b, %d bit
->>20 leshort 2 \b, Microsoft ADPCM
->>20 leshort 6 \b, ITU G.711 A-law
->>20 leshort 7 \b, ITU G.711 mu-law
->>20 leshort 8 \b, Microsoft DTS
->>20 leshort 17 \b, IMA ADPCM
->>20 leshort 20 \b, ITU G.723 ADPCM (Yamaha)
->>20 leshort 49 \b, GSM 6.10
->>20 leshort 64 \b, ITU G.721 ADPCM
->>20 leshort 80 \b, MPEG
->>20 leshort 85 \b, MPEG Layer 3
->>20 leshort 0x2001 \b, DTS
->>22 leshort =1 \b, mono
->>22 leshort =2 \b, stereo
->>22 leshort >2 \b, %d channels
->>24 lelong >0 %d Hz
+>>12 string >\0
+>>>12 use riff-walk
# Corel Draw Picture
>8 string CDRA \b, Corel Draw Picture
!:mime image/x-coreldraw
+>8 string CDR6 \b, Corel Draw Picture, version 6
+!:mime image/x-coreldraw
+>8 string NUNDROOT \b, Steinberg CuBase
# AVI == Audio Video Interleave
>8 string AVI\040 \b, AVI
!:mime video/x-msvideo
>>12 string LIST
>>>20 string hdrlavih
->>>>&36 lelong x \b, %lu x
->>>>&40 lelong x %lu,
+>>>>&36 lelong x \b, %u x
+>>>>&40 lelong x %u,
>>>>&4 lelong >1000000 <1 fps,
>>>>&4 lelong 1000000 1.00 fps,
>>>>&4 lelong 500000 2.00 fps,
@@ -13520,6 +16825,8 @@
# MPEG-1 wrapped in a RIFF, apparently
>8 string CDXA \b, wrapped MPEG-1 (CDXA)
>8 string 4XMV \b, 4X Movie file
+# AMV-type AVI file: http://wiki.multimedia.cx/index.php?title=AMV
+>8 string AMV\040 \b, AMV
#
# XXX - some of the below may only appear in little-endian form.
@@ -13559,6 +16866,7 @@
>>24 belong >0 %d Hz
# Corel Draw Picture
>8 string CDRA \b, Corel Draw Picture
+>8 string CDR6 \b, Corel Draw Picture, version 6
# AVI == Audio Video Interleave
>8 string AVI\040 \b, AVI
# Animated Cursor format
@@ -13586,10 +16894,10 @@
#------------------------------------------------------------------------------
# MBWF/RF64
-# see EBU \x96 TECH 3306 http://tech.ebu.ch/docs/tech/tech3306-2009.pdf
+# see EBU TECH 3306 http://tech.ebu.ch/docs/tech/tech3306-2009.pdf
0 string RF64\xff\xff\xff\xffWAVEds64 MBWF/RF64 audio
!:mime audio/x-wav
->52 search/256 fmt\x20 \b
+>40 search/256 fmt\x20 \b
>>&6 leshort =1 \b, mono
>>&6 leshort =2 \b, stereo
>>&6 leshort >2 \b, %d channels
@@ -13597,49 +16905,94 @@
#------------------------------------------------------------------------------
-# $File: rpm,v 1.10 2010/09/20 19:19:17 rrt Exp $
+# $File: rinex,v 1.4 2011/05/03 01:44:17 christos Exp $
+# rinex: file(1) magic for RINEX files
+# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
+# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf
+# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data
+60 string RINEX
+>80 search/256 XXRINEXB RINEX Data, GEO SBAS Broadcast
+>>&32 string x \b, date %15.15s
+>>5 string x \b, version %6.6s
+!:mime rinex/broadcast
+>80 search/256 XXRINEXD RINEX Data, Observation (Hatanaka comp)
+>>&32 string x \b, date %15.15s
+>>5 string x \b, version %6.6s
+!:mime rinex/observation
+>80 search/256 XXRINEXC RINEX Data, Clock
+>>&32 string x \b, date %15.15s
+>>5 string x \b, version %6.6s
+!:mime rinex/clock
+>80 search/256 XXRINEXH RINEX Data, GEO SBAS Navigation
+>>&32 string x \b, date %15.15s
+>>5 string x \b, version %6.6s
+!:mime rinex/navigation
+>80 search/256 XXRINEXG RINEX Data, GLONASS Navigation
+>>&32 string x \b, date %15.15s
+>>5 string x \b, version %6.6s
+!:mime rinex/navigation
+>80 search/256 XXRINEXL RINEX Data, Galileo Navigation
+>>&32 string x \b, date %15.15s
+>>5 string x \b, version %6.6s
+!:mime rinex/navigation
+>80 search/256 XXRINEXM RINEX Data, Meteorological
+>>&32 string x \b, date %15.15s
+>>5 string x \b, version %6.6s
+!:mime rinex/meteorological
+>80 search/256 XXRINEXN RINEX Data, Navigation
+>>&32 string x \b, date %15.15s
+>>5 string x \b, version %6.6s
+!:mime rinex/navigation
+>80 search/256 XXRINEXO RINEX Data, Observation
+>>&32 string x \b, date %15.15s
+>>5 string x \b, version %6.6s
+!:mime rinex/observation
+
+#------------------------------------------------------------------------------
+# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $
#
# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt at redhat.com)
#
-0 beshort 0xedab
->2 beshort 0xeedb RPM
+0 belong 0xedabeedb RPM
!:mime application/x-rpm
->>4 byte x v%d
->>5 byte x \b.%d
->>6 beshort 1 src
->>6 beshort 0 bin
->>>8 beshort 1 i386/x86_64
->>>8 beshort 2 Alpha/Sparc64
->>>8 beshort 3 Sparc
->>>8 beshort 4 MIPS
->>>8 beshort 5 PowerPC
->>>8 beshort 6 68000
->>>8 beshort 7 SGI
->>>8 beshort 8 RS6000
->>>8 beshort 9 IA64
->>>8 beshort 10 Sparc64
+>4 byte x v%d
+>5 byte x \b.%d
+>6 beshort 1 src
+>6 beshort 0 bin
+>>8 beshort 1 i386/x86_64
+>>8 beshort 2 Alpha/Sparc64
+>>8 beshort 3 Sparc
+>>8 beshort 4 MIPS
+>>8 beshort 5 PowerPC
+>>8 beshort 6 68000
+>>8 beshort 7 SGI
+>>8 beshort 8 RS6000
+>>8 beshort 9 IA64
+>>8 beshort 10 Sparc64
+>>8 beshort 11 MIPSel
+>>8 beshort 12 ARM
+>>8 beshort 13 MiNT
+>>8 beshort 14 S/390
+>>8 beshort 15 S/390x
+>>8 beshort 16 PowerPC64
+>>8 beshort 17 SuperH
+>>8 beshort 18 Xtensa
+>>8 beshort 255 noarch
#delta RPM Daniel Novotny (dnovotny at redhat.com)
-0 string drpm Delta RPM
+0 string drpm Delta RPM
!:mime application/x-rpm
>12 string x %s
-
->>>8 beshort 11 MIPSel
->>>8 beshort 12 ARM
->>>8 beshort 13 MiNT
->>>8 beshort 14 S/390
->>>8 beshort 15 S/390x
->>>8 beshort 16 PowerPC64
->>>8 beshort 17 SuperH
->>>8 beshort 18 Xtensa
+>>8 beshort 11 MIPSel
+>>8 beshort 12 ARM
+>>8 beshort 13 MiNT
+>>8 beshort 14 S/390
+>>8 beshort 15 S/390x
+>>8 beshort 16 PowerPC64
+>>8 beshort 17 SuperH
+>>8 beshort 18 Xtensa
>>10 string x %s
-# Type: Delta RPM
-# From: Daniel Novotny (dnovotny at redhat.com)
-0 string drpm Delta RPM
-!:mime application/x-rpm
->12 string x %s
-
#------------------------------------------------------------------------------
# $File: rtf,v 1.7 2009/09/19 16:28:12 christos Exp $
# rtf: file(1) magic for Rich Text Format (RTF)
@@ -13714,7 +17067,7 @@
8 string \001s\ SCCS archive data
#------------------------------------------------------------------------------
-# $File: scientific,v 1.7 2010/09/20 19:19:17 rrt Exp $
+# $File: scientific,v 1.9 2014/06/03 19:01:34 christos Exp $
# scientific: file(1) magic for scientific formats
#
# From: Joe Krahn <krahn at niehs.nih.gov>
@@ -13779,7 +17132,7 @@
0 search/1/c 0\ HEAD GEDCOM genealogy text
>&0 search 1\ GEDC
>>&0 search 2\ VERS version
->>>&1 search/1 >\0 %s
+>>>&1 string >\0 %s
# From: Phil Endecott <phil05 at chezphil.org>
0 string \000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data
0 string \060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data
@@ -13805,12 +17158,12 @@
# uppercase letters. However, examples have been seen without the date string,
# e.g., the example on the chemime site.
0 string HEADER\ \ \ \
->&0 regex/1 \^.{40}
->>&0 regex/1 [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3}
->>>&0 regex/1s [A-Z0-9]{4}.{14}$
->>>>&0 regex/1 [A-Z0-9]{4} Protein Data Bank data, ID Code %s
+>&0 regex/1l \^.{40}
+>>&0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3}
+>>>&0 regex/1ls [A-Z0-9]{4}.{14}$
+>>>>&0 regex/1l [A-Z0-9]{4} Protein Data Bank data, ID Code %s
!:mime chemical/x-pdb
->>>>0 regex/1 [0-9]{2}-[A-Z]{3}-[0-9]{2} \b, %s
+>>>>0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2} \b, %s
# Type: GDSII Stream file
0 belong 0x00060002 GDSII Stream file
@@ -13870,7 +17223,7 @@
#------------------------------------------------------------------------------
-# $File: sequent,v 1.8 2009/09/19 16:28:12 christos Exp $
+# $File: sequent,v 1.11 2014/06/02 19:27:54 christos Exp $
# sequent: file(1) magic for Sequent machines
#
# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
@@ -13877,16 +17230,16 @@
# For Sequent's multiprocessor systems (incomplete).
0 lelong 0x00ea BALANCE NS32000 .o
>16 lelong >0 not stripped
->124 lelong >0 version %ld
+>124 lelong >0 version %d
0 lelong 0x10ea BALANCE NS32000 executable (0 @ 0)
>16 lelong >0 not stripped
->124 lelong >0 version %ld
+>124 lelong >0 version %d
0 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0)
>16 lelong >0 not stripped
->124 lelong >0 version %ld
+>124 lelong >0 version %d
0 lelong 0x30ea BALANCE NS32000 standalone executable
>16 lelong >0 not stripped
->124 lelong >0 version %ld
+>124 lelong >0 version %d
#
# Symmetry information added by Jason Merrill <jason at jarthur.claremont.edu>.
# Symmetry magic nums will not be reached if DOS COM comes before them;
@@ -13893,23 +17246,124 @@
# byte 0xeb is matched before these get a chance.
0 leshort 0x12eb SYMMETRY i386 .o
>16 lelong >0 not stripped
->124 lelong >0 version %ld
+>124 lelong >0 version %d
0 leshort 0x22eb SYMMETRY i386 executable (0 @ 0)
>16 lelong >0 not stripped
->124 lelong >0 version %ld
+>124 lelong >0 version %d
0 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0)
>16 lelong >0 not stripped
->124 lelong >0 version %ld
+>124 lelong >0 version %d
0 leshort 0x42eb SYMMETRY i386 standalone executable
>16 lelong >0 not stripped
->124 lelong >0 version %ld
+>124 lelong >0 version %d
+# http://en.wikipedia.org/wiki/Sequent_Computer_Systems
+# below test line conflicts with MS-DOS 2.11 floppies and Acronis loader
+#0 leshort 0x42eb SYMMETRY i386 standalone executable
+0 leshort 0x42eb
+# skip unlike negative version
+>124 lelong >-1
+# assuming version 28867614 is very low probable
+>>124 lelong !28867614 SYMMETRY i386 standalone executable
+>>>16 lelong >0 not stripped
+>>>124 lelong >0 version %d
+#------------------------------------------------------------------------------
+# $File: sereal,v 1.1 2014/05/14 23:04:59 christos Exp $
+# sereal: file(1) magic the Sereal binary serialization format
+#
+# From: Ævar Arnfjörð Bjarmason <avarab at gmail.com>
+#
+# See the specification of the format at
+# https://github.com/Sereal/Sereal/blob/master/sereal_spec.pod#document-header-format
+#
+# I'd have liked to do the byte&0xF0 matching against 0, 1, 2 ... by
+# doing (byte&0xF0)>>4 here, but unfortunately that's not
+# supported. So when we print out a message about an unknown format
+# we'll print out e.g. 0x30 instead of the more human-readable
+# 0x30>>4.
+#
+# See https://github.com/Sereal/Sereal/commit/35372ae01d in the
+# Sereal.git repository for test Sereal data.
+0 string \=srl Sereal data
+!:mime application/sereal
+>4 byte&0x0F x (version %d,
+>4 byte&0xF0 0x00 uncompressed)
+>4 byte&0xF0 0x10 compressed with non-incremental Snappy)
+>4 byte&0xF0 0x20 compressed with incremental Snappy)
+>4 byte&0xF0 >0x20 unknown subformat, flag: %d>>4)
#------------------------------------------------------------------------------
-# $File: sgi,v 1.18 2010/11/25 15:00:12 christos Exp $
-# sgi: file(1) magic for Silicon Graphics applications
+# $File: sgi,v 1.21 2014/04/30 21:41:02 christos Exp $
+# sgi: file(1) magic for Silicon Graphics operating systems and applications
+#
+# Executable images are handled either in aout (for old-style a.out
+# files for 68K; they are indistinguishable from other big-endian 32-bit
+# a.out files) or in mips (for MIPS ECOFF and Ucode files)
+#
+# kbd file definitions
+0 string kbd!map kbd map file
+>8 byte >0 Ver %d:
+>10 short >0 with %d table(s)
+
+0 beshort 0x8765 disk quotas file
+
+0 beshort 0x0506 IRIS Showcase file
+>2 byte 0x49 -
+>3 byte x - version %d
+0 beshort 0x0226 IRIS Showcase template
+>2 byte 0x63 -
+>3 byte x - version %d
+0 belong 0x5343464d IRIS Showcase file
+>4 byte x - version %d
+0 belong 0x5443464d IRIS Showcase template
+>4 byte x - version %d
+0 belong 0xdeadbabe IRIX Parallel Arena
+>8 belong >0 - version %d
+
+# core files
#
+# 32bit core file
+0 belong 0xdeadadb0 IRIX core dump
+>4 belong 1 of
+>16 string >\0 '%s'
+# 64bit core file
+0 belong 0xdeadad40 IRIX 64-bit core dump
+>4 belong 1 of
+>16 string >\0 '%s'
+# N32bit core file
+0 belong 0xbabec0bb IRIX N32 core dump
+>4 belong 1 of
+>16 string >\0 '%s'
+# New style crash dump file
+0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of
+>36 string >\0 '%s'
+
+# Trusted IRIX info
+0 string SGIAUDIT SGI Audit file
+>8 byte x - version %d
+>9 byte x \b.%d
#
+0 string WNGZWZSC Wingz compiled script
+0 string WNGZWZSS Wingz spreadsheet
+0 string WNGZWZHP Wingz help file
+#
+0 string #Inventor V IRIS Inventor 1.0 file
+0 string #Inventor V2 Open Inventor 2.0 file
+# GLF is OpenGL stream encoding
+0 string glfHeadMagic(); GLF_TEXT
+4 belong 0x7d000000 GLF_BINARY_LSB_FIRST
+!:strength -30
+4 belong 0x0000007d GLF_BINARY_MSB_FIRST
+!:strength -30
+# GLS is OpenGL stream encoding; GLS is the successor of GLF
+0 string glsBeginGLS( GLS_TEXT
+4 belong 0x10000000 GLS_BINARY_LSB_FIRST
+!:strength -30
+4 belong 0x00000010 GLS_BINARY_MSB_FIRST
+!:strength -30
+
+#
+#
# Performance Co-Pilot file types
0 string PmNs PCP compiled namespace (V.0)
0 string PmN PCP compiled namespace
@@ -13920,11 +17374,11 @@
#>20 lelong -2 temporal index
#>20 lelong -1 metadata
#>20 lelong 0 log volume #0
-#>20 lelong >0 log volume #%ld
+#>20 lelong >0 log volume #%d
>20 belong -2 temporal index
>20 belong -1 metadata
>20 belong 0 log volume #0
->20 belong >0 log volume #%ld
+>20 belong >0 log volume #%d
>24 string >\0 host: %s
0 string PCPFolio PCP
>9 string Version: Archive Folio
@@ -13966,7 +17420,7 @@
>11 byte x dataformat %d
# Alias Maya files
-0 string/t //Maya ASCII Alias Maya Ascii File,
+0 string/t //Maya\040ASCII Alias Maya Ascii File,
>13 string >\0 version %s
8 string MAYAFOR4 Alias Maya Binary File,
>32 string >\0 version %s scene
@@ -13975,10 +17429,10 @@
8 string CIMG Alias Maya Image File
8 string DEEP Alias Maya Image File
#------------------------------------------------------------------------------
-# $File: sgml,v 1.25 2010/11/25 15:00:12 christos Exp $
+# $File: sgml,v 1.30 2013/12/21 14:27:24 christos Exp $
# Type: SVG Vectorial Graphics
# From: Noel Torres <tecnico at ejerciciosresueltos.com>
-0 string/t \<?xml\ version="
+0 string \<?xml\ version="
>15 string >\0
>>19 search/4096 \<svg SVG Scalable Vector Graphics image
!:mime image/svg+xml
@@ -13991,18 +17445,25 @@
>>19 search/4096 \<urlset XML Sitemap document text
!:mime application/xml-sitemap
+# OpenStreetMap XML (.osm)
+# http://wiki.openstreetmap.org/wiki/OSM_XML
+# From: Markus Heidelberg <markus.heidelberg at web.de>
+0 string \<?xml\ version="
+>15 string >\0
+>>19 search/4096 \<osm OpenStreetMap XML data
+
# xhtml
0 string/t \<?xml\ version="
>15 string >\0
->>19 search/4096/cWbt \<!doctype\ html xHTML document text
+>>19 search/4096/cWbt \<!doctype\ html XHTML document text
!:mime text/html
0 string/t \<?xml\ version='
>15 string >\0
->>19 search/4096/cWbt \<!doctype\ html xHTML document text
+>>19 search/4096/cWbt \<!doctype\ html XHTML document text
!:mime text/html
0 string/t \<?xml\ version="
>15 string >\0
->>19 search/4096/cWbt \<html broken xHTML document text
+>>19 search/4096/cWbt \<html broken XHTML document text
!:mime text/html
#------------------------------------------------------------------------------
@@ -14012,35 +17473,47 @@
# adapted to string extenstions by Anthon van der Neut <anthon at mnt.org)
0 search/4096/cWt \<!doctype\ html HTML document text
!:mime text/html
+!:strength + 5
0 search/4096/cwt \<head HTML document text
!:mime text/html
+!:strength + 5
0 search/4096/cwt \<title HTML document text
!:mime text/html
+!:strength + 5
0 search/4096/cwt \<html HTML document text
!:mime text/html
+!:strength + 5
0 search/4096/cwt \<script HTML document text
!:mime text/html
+!:strength + 5
0 search/4096/cwt \<style HTML document text
!:mime text/html
+!:strength + 5
0 search/4096/cwt \<table HTML document text
!:mime text/html
+!:strength + 5
0 search/4096/cwt \<a\ href= HTML document text
!:mime text/html
+!:strength + 5
# Extensible markup language (XML), a subset of SGML
# from Marc Prud'hommeaux (marc at apocalypse.org)
0 search/1/cwt \<?xml XML document text
!:mime application/xml
+!:strength + 5
0 string/t \<?xml\ version\ " XML
!:mime application/xml
+!:strength + 5
0 string/t \<?xml\ version=" XML
!:mime application/xml
->15 search/1 >\0 %.3s document text
+!:strength + 5
+>15 string/t >\0 %.3s document text
>>23 search/1 \<xsl:stylesheet (XSL stylesheet)
>>24 search/1 \<xsl:stylesheet (XSL stylesheet)
0 string \<?xml\ version=' XML
!:mime application/xml
->15 search/1 >\0 %.3s document text
+!:strength + 5
+>15 string/t >\0 %.3s document text
>>23 search/1 \<xsl:stylesheet (XSL stylesheet)
>>24 search/1 \<xsl:stylesheet (XSL stylesheet)
0 search/1/wbt \<?xml XML document text
@@ -14065,7 +17538,7 @@
0 search/1 #\ KDE\ Cookie\ File Konqueror cookie text
#------------------------------------------------------------------------
-# $File: sharc,v 1.6 2009/09/19 16:28:12 christos Exp $
+# $File: sharc,v 1.7 2014/04/30 21:41:02 christos Exp $
# file(1) magic for sharc files
#
# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
@@ -14084,7 +17557,7 @@
0 string .system SHARC architecture file
0 leshort 0x521C SHARC COFF binary
->2 leshort >1 , %hd sections
+>2 leshort >1 , %d sections
>>12 lelong >0 , not stripped
#------------------------------------------------------------------------------
@@ -14182,7 +17655,41 @@
#------------------------------------------------------------------------------
-# $File: sniffer,v 1.14 2009/09/19 16:28:12 christos Exp $
+# $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $
+# smile: file(1) magic for Smile serialization
+#
+# The Smile serialization format uses a 4-byte header:
+#
+# Constant byte #0: 0x3A (ASCII ':')
+# Constant byte #1: 0x29 (ASCII ')')
+# Constant byte #2: 0x0A (ASCII linefeed, '\n')
+# Variable byte #3, consisting of bits:
+# Bits 4-7 (4 MSB): 4-bit version number
+# Bits 3: Reserved
+# Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content
+# Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false
+# Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true
+#
+# Reference: http://wiki.fasterxml.com/SmileFormatSpec
+# Created by: Pierre-Alexandre Meyer <pierre at mouraf.org>
+
+# Detection
+0 string :)\n Smile binary data
+
+# Versioning
+>3 byte&0xF0 x version %d:
+
+# Properties
+>3 byte&0x04 0x04 binary raw,
+>3 byte&0x04 0x00 binary encoded,
+>3 byte&0x02 0x02 shared String values enabled,
+>3 byte&0x02 0x00 shared String values disabled,
+>3 byte&0x01 0x01 shared field names enabled
+>3 byte&0x01 0x00 shared field names disabled
+
+
+#------------------------------------------------------------------------------
+# $File: sniffer,v 1.19 2013/01/06 01:11:04 christos Exp $
# sniffer: file(1) magic for packet capture files
#
# From: guy at alum.mit.edu (Guy Harris)
@@ -14199,6 +17706,7 @@
>6 leshort 2 (Token Ring)
>6 leshort 3 (FDDI)
>6 leshort 4 (ATM)
+>6 leshort >4 (type %d)
#
# Microsoft Network Monitor 2.x capture files.
@@ -14211,6 +17719,12 @@
>6 leshort 2 (Token Ring)
>6 leshort 3 (FDDI)
>6 leshort 4 (ATM)
+>6 leshort 5 (IP-over-IEEE 1394)
+>6 leshort 6 (802.11)
+>6 leshort 7 (Raw IP)
+>6 leshort 8 (Raw IP)
+>6 leshort 9 (Raw IP)
+>6 leshort >9 (type %d)
#
# Network General Sniffer capture files.
@@ -14239,6 +17753,7 @@
# Sorry, make that "Network Associates Sniffer Basic, and Windows
# Sniffer Pro", capture files."
# Sorry, make that "Network General Sniffer capture files."
+# Sorry, make that "NetScout Sniffer capture files."
#
0 string XCP\0 NetXRay capture file
>4 string >\0 - version %s
@@ -14255,7 +17770,7 @@
# the main program that uses that format, but there are other programs
# that use "libpcap", or that use the same capture file format.)
#
-0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian)
+0 name pcap-be
>4 beshort x - version %d
>6 beshort x \b.%d
>20 belong 0 (No link-layer encapsulation
@@ -14297,8 +17812,10 @@
>20 belong 127 (802.11 with radiotap header
>20 belong 129 (Linux ARCNET
>20 belong 138 (Apple IP over IEEE 1394
+>20 belong 139 (MTP2 with pseudo-header
>20 belong 140 (MTP2
>20 belong 141 (MTP3
+>20 belong 142 (SCCP
>20 belong 143 (DOCSIS
>20 belong 144 (IrDA
>20 belong 147 (Private use 0
@@ -14318,71 +17835,53 @@
>20 belong 161 (Private use 14
>20 belong 162 (Private use 15
>20 belong 163 (802.11 with AVS header
+>20 belong 165 (BACnet MS/TP
+>20 belong 166 (PPPD
+>20 belong 169 (GPRS LLC
+>20 belong 177 (Linux LAPD
+>20 belong 187 (Bluetooth HCI H4
+>20 belong 189 (Linux USB
+>20 belong 192 (PPI
+>20 belong 195 (802.15.4
+>20 belong 196 (SITA
+>20 belong 197 (Endace ERF
+>20 belong 201 (Bluetooth HCI H4 with pseudo-header
+>20 belong 202 (AX.25 with KISS header
+>20 belong 203 (LAPD
+>20 belong 204 (PPP with direction pseudo-header
+>20 belong 205 (Cisco HDLC with direction pseudo-header
+>20 belong 206 (Frame Relay with direction pseudo-header
+>20 belong 209 (Linux IPMB
+>20 belong 215 (802.15.4 with non-ASK PHY header
+>20 belong 220 (Memory-mapped Linux USB
+>20 belong 224 (Fibre Channel FC-2
+>20 belong 225 (Fibre Channel FC-2 with frame delimiters
+>20 belong 226 (Solaris IPNET
+>20 belong 227 (SocketCAN
+>20 belong 228 (Raw IPv4
+>20 belong 229 (Raw IPv6
+>20 belong 230 (802.15.4 without FCS
+>20 belong 231 (D-Bus messages
+>20 belong 235 (DVB-CI
+>20 belong 236 (MUX27010
+>20 belong 237 (STANAG 5066 D_PDUs
+>20 belong 239 (Linux netlink NFLOG messages
+>20 belong 240 (Hilscher netAnalyzer
+>20 belong 241 (Hilscher netAnalyzer with delimiters
+>20 belong 242 (IP-over-Infiniband
+>20 belong 243 (MPEG-2 Transport Stream packets
+>20 belong 244 (ng4t ng40
+>20 belong 245 (NFC LLCP
+>20 belong 247 (Infiniband
+>20 belong 248 (SCTP
>16 belong x \b, capture length %d)
+
+0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian)
+!:mime application/vnd.tcpdump.pcap
+>0 use pcap-be
0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian)
->4 leshort x - version %d
->6 leshort x \b.%d
->20 lelong 0 (No link-layer encapsulation
->20 lelong 1 (Ethernet
->20 lelong 2 (3Mb Ethernet
->20 lelong 3 (AX.25
->20 lelong 4 (ProNET
->20 lelong 5 (CHAOS
->20 lelong 6 (Token Ring
->20 lelong 7 (ARCNET
->20 lelong 8 (SLIP
->20 lelong 9 (PPP
->20 lelong 10 (FDDI
->20 lelong 11 (RFC 1483 ATM
->20 lelong 12 (raw IP
->20 lelong 13 (BSD/OS SLIP
->20 lelong 14 (BSD/OS PPP
->20 lelong 19 (Linux ATM Classical IP
->20 lelong 50 (PPP or Cisco HDLC
->20 lelong 51 (PPP-over-Ethernet
->20 lelong 99 (Symantec Enterprise Firewall
->20 lelong 100 (RFC 1483 ATM
->20 lelong 101 (raw IP
->20 lelong 102 (BSD/OS SLIP
->20 lelong 103 (BSD/OS PPP
->20 lelong 104 (BSD/OS Cisco HDLC
->20 lelong 105 (802.11
->20 lelong 106 (Linux Classical IP over ATM
->20 lelong 107 (Frame Relay
->20 lelong 108 (OpenBSD loopback
->20 lelong 109 (OpenBSD IPsec encrypted
->20 lelong 112 (Cisco HDLC
->20 lelong 113 (Linux "cooked"
->20 lelong 114 (LocalTalk
->20 lelong 117 (OpenBSD PFLOG
->20 lelong 119 (802.11 with Prism header
->20 lelong 122 (RFC 2625 IP over Fibre Channel
->20 lelong 123 (SunATM
->20 lelong 127 (802.11 with radiotap header
->20 lelong 129 (Linux ARCNET
->20 lelong 138 (Apple IP over IEEE 1394
->20 lelong 140 (MTP2
->20 lelong 141 (MTP3
->20 lelong 143 (DOCSIS
->20 lelong 144 (IrDA
->20 lelong 147 (Private use 0
->20 lelong 148 (Private use 1
->20 lelong 149 (Private use 2
->20 lelong 150 (Private use 3
->20 lelong 151 (Private use 4
->20 lelong 152 (Private use 5
->20 lelong 153 (Private use 6
->20 lelong 154 (Private use 7
->20 lelong 155 (Private use 8
->20 lelong 156 (Private use 9
->20 lelong 157 (Private use 10
->20 lelong 158 (Private use 11
->20 lelong 159 (Private use 12
->20 lelong 160 (Private use 13
->20 lelong 161 (Private use 14
->20 lelong 162 (Private use 15
->20 lelong 163 (802.11 with AVS header
->16 lelong x \b, capture length %d)
+!:mime application/vnd.tcpdump.pcap
+>0 use \^pcap-be
#
# "libpcap"-with-Alexey-Kuznetsov's-patches capture files.
@@ -14391,45 +17890,26 @@
# that use "libpcap", or that use the same capture file format.)
#
0 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian)
->4 beshort x - version %d
->6 beshort x \b.%d
->20 belong 0 (No link-layer encapsulation
->20 belong 1 (Ethernet
->20 belong 2 (3Mb Ethernet
->20 belong 3 (AX.25
->20 belong 4 (ProNET
->20 belong 5 (CHAOS
->20 belong 6 (Token Ring
->20 belong 7 (ARCNET
->20 belong 8 (SLIP
->20 belong 9 (PPP
->20 belong 10 (FDDI
->20 belong 11 (RFC 1483 ATM
->20 belong 12 (raw IP
->20 belong 13 (BSD/OS SLIP
->20 belong 14 (BSD/OS PPP
->16 belong x \b, capture length %d)
+>0 use pcap-be
0 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian)
->4 leshort x - version %d
->6 leshort x \b.%d
->20 lelong 0 (No link-layer encapsulation
->20 lelong 1 (Ethernet
->20 lelong 2 (3Mb Ethernet
->20 lelong 3 (AX.25
->20 lelong 4 (ProNET
->20 lelong 5 (CHAOS
->20 lelong 6 (Token Ring
->20 lelong 7 (ARCNET
->20 lelong 8 (SLIP
->20 lelong 9 (PPP
->20 lelong 10 (FDDI
->20 lelong 11 (RFC 1483 ATM
->20 lelong 12 (raw IP
->20 lelong 13 (BSD/OS SLIP
->20 lelong 14 (BSD/OS PPP
->16 lelong x \b, capture length %d)
+>0 use \^pcap-be
#
+# "pcap-ng" capture files.
+# http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html
+# Pcap-ng files can contain multiple sections. Printing the endianness,
+# snaplen, or other information from the first SHB may be misleading.
+#
+0 ubelong 0x0a0d0d0a
+>8 ubelong 0x1a2b3c4d pcap-ng capture file
+>>12 beshort x - version %d
+>>14 beshort x \b.%d
+0 ulelong 0x0a0d0d0a
+>8 ulelong 0x1a2b3c4d pcap-ng capture file
+>>12 leshort x - version %d
+>>14 leshort x \b.%d
+
+#
# AIX "iptrace" capture files.
#
0 string iptrace\ 1.0 "iptrace" capture file
@@ -14460,9 +17940,9 @@
>8 lelong x \b, %d stations found
#
-# EtherPeek/AiroPeek "version 9" capture files.
+# *Peek tagged capture files.
#
-0 string \177ver EtherPeek/AiroPeek capture file
+0 string \177ver EtherPeek/AiroPeek/OmniPeek capture file
#
# Visual Networks traffic capture files.
@@ -14592,23 +18072,35 @@
>7 byte x \b, version 0x%02x
#------------------------------------------------------------------------------
-# $File: sql,v 1.6 2009/09/19 16:28:12 christos Exp $
+# $File: sql,v 1.15 2014/04/30 21:41:02 christos Exp $
# sql: file(1) magic for SQL files
#
# From: "Marty Leisner" <mleisner at eng.mc.xerox.com>
# Recognize some MySQL files.
+# Elan Ruusamae <glen at delfi.ee>, added MariaDB signatures
+# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic
#
0 beshort 0xfe01 MySQL table definition file
>2 byte x Version %d
-0 belong&0xffffff00 0xfefe0300 MySQL MISAM index file
+0 belong&0xffffff00 0xfefe0700 MySQL MyISAM index file
>3 byte x Version %d
-0 belong&0xffffff00 0xfefe0700 MySQL MISAM compressed data file
+0 belong&0xffffff00 0xfefe0800 MySQL MyISAM compressed data file
>3 byte x Version %d
+0 belong&0xffffff00 0xfefe0900 MySQL Maria index file
+>3 byte x Version %d
+0 belong&0xffffff00 0xfefe0A00 MySQL Maria compressed data file
+>3 byte x Version %d
0 belong&0xffffff00 0xfefe0500 MySQL ISAM index file
>3 byte x Version %d
0 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file
>3 byte x Version %d
-0 string \376bin MySQL replication log
+0 string \376bin MySQL replication log
+0 belong&0xffffff00 0xfefe0b00
+>4 string MARIALOG MySQL Maria transaction log file
+>>3 byte x Version %d
+0 belong&0xffffff00 0xfefe0c00
+>4 string MACF MySQL Maria control file
+>>3 byte x Version %d
#------------------------------------------------------------------------------
# iRiver H Series database file
@@ -14630,12 +18122,37 @@
0 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database
# Version 3 of SQLite allows applications to embed their own "user version"
-# number in the database. Detect this and distinguish those files.
+# number in the database at offset 60. Later, SQLite added an "application id"
+# at offset 68 that is preferred over "user version" for indicating the
+# associated application.
+#
+0 string SQLite\ format\ 3
+>60 belong =0x5f4d544e Monotone source repository - SQLite3 database
+>68 belong =0x0f055112 Fossil checkout - SQLite3 database
+>68 belong =0x0f055113 Fossil global configuration - SQLite3 database
+>68 belong =0x0f055111 Fossil repository - SQLite3 database
+>68 belong =0x42654462 Bentley Systems BeSQLite Database - SQLite3 database
+>68 belong =0x42654c6e Bentley Systems Localization File - SQLite3 database
+>68 belong =0x47504b47 OGC GeoPackage file - SQLite3 database
+>68 default x SQLite 3.x database
+>>68 belong !0 \b, application id %u
+>>60 belong !0 \b, user version %d
-0 string SQLite\ format\ 3
->60 string _MTN Monotone source repository
->60 belong !0 SQLite 3.x database, user version %u
->60 belong 0 SQLite 3.x database
+# SQLite Write-Ahead Log from SQLite version >= 3.7.0
+# http://www.sqlite.org/fileformat.html#walformat
+0 belong&0xfffffffe 0x377f0682 SQLite Write-Ahead Log,
+>4 belong x version %d
+
+# SQLite Rollback Journal
+# http://www.sqlite.org/fileformat.html#rollbackjournal
+0 string \xd9\xd5\x05\xf9\x20\xa1\x63\xd7 SQLite Rollback Journal
+
+# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek
+# http://www.ullrich.es/job/service-menue/panasonic/panasonic-sendersortierung-sat-am-pc/
+# pceditor_V2003.jar
+0 string PSDB\0 Panasonic channel list database
+>126 string SQLite\ format\ 3
+>>&-15 indirect x \b; contains
# Type: OpenSSH key files
# From: Nicolas Collignon <tsointsoin at gmail.com>
@@ -14644,6 +18161,9 @@
0 string ssh-dss\ OpenSSH DSA public key
0 string ssh-rsa\ OpenSSH RSA public key
+0 string ecdsa-sha2-nistp256 OpenSSH ECDSA public key
+0 string ecdsa-sha2-nistp384 OpenSSH ECDSA public key
+0 string ecdsa-sha2-nistp521 OpenSSH ECDSA public key
# Type: OpenSSL certificates/key files
# From: Nicolas Collignon <tsointsoin at gmail.com>
@@ -14651,15 +18171,19 @@
0 string -----BEGIN\ CERTIFICATE\ REQ PEM certificate request
0 string -----BEGIN\ RSA\ PRIVATE PEM RSA private key
0 string -----BEGIN\ DSA\ PRIVATE PEM DSA private key
+0 string -----BEGIN\ EC\ PRIVATE PEM EC private key
#------------------------------------------------------------------------------
-# $File: sun,v 1.21 2010/05/05 17:38:18 christos Exp $
+# $File: sun,v 1.27 2014/04/30 21:41:02 christos Exp $
# sun: file(1) magic for Sun machines
#
# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
-# releases. (5.x uses ELF.)
+# releases. (5.x uses ELF.) Entries for executables without an
+# architecture type, used before the 68020-based Sun-3's came out,
+# are in aout, as they're indistinguishable from other big-endian
+# 32-bit a.out files.
#
-0 belong&077777777 0600413 sparc demand paged
+0 belong&077777777 0600413 a.out SunOS SPARC demand paged
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
@@ -14667,17 +18191,17 @@
>0 byte ^0x80 executable
>16 belong >0 not stripped
-0 belong&077777777 0600410 sparc pure
+0 belong&077777777 0600410 a.out SunOS SPARC pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
-0 belong&077777777 0600407 sparc
+0 belong&077777777 0600407 a.out SunOS SPARC
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
-0 belong&077777777 0400413 mc68020 demand paged
+0 belong&077777777 0400413 a.out SunOS mc68020 demand paged
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
@@ -14685,17 +18209,17 @@
>0 byte ^0x80 executable
>16 belong >0 not stripped
-0 belong&077777777 0400410 mc68020 pure
+0 belong&077777777 0400410 a.out SunOS mc68020 pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
-0 belong&077777777 0400407 mc68020
+0 belong&077777777 0400407 a.out SunOS mc68020
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
-0 belong&077777777 0200413 mc68010 demand paged
+0 belong&077777777 0200413 a.out SunOS mc68010 demand paged
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
@@ -14703,24 +18227,16 @@
>0 byte ^0x80 executable
>16 belong >0 not stripped
-0 belong&077777777 0200410 mc68010 pure
+0 belong&077777777 0200410 a.out SunOS mc68010 pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
-0 belong&077777777 0200407 mc68010
+0 belong&077777777 0200407 a.out SunOS mc68010
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
-# reworked these to avoid anything beginning with zero becoming "old sun-2"
-0 belong 0407 old sun-2 executable
->16 belong >0 not stripped
-0 belong 0410 old sun-2 pure executable
->16 belong >0 not stripped
-0 belong 0413 old sun-2 demand paged executable
->16 belong >0 not stripped
-
#
# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
# binary executed in compatibility mode under SunOS 5.x".
@@ -14749,10 +18265,13 @@
# Sun SunPC
0 long 0xfa33c08e SunPC 4.0 Hard Disk
0 string #SUNPC_CONFIG SunPC 4.0 Properties Values
-# Sun snoop (see RFC 1761, which describes the capture file format).
+# Sun snoop (see RFC 1761, which describes the capture file format,
+# RFC 3827, which describes some additional datalink types, and
+# http://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml,
+# which is the IANA registry of Snoop datalink types)
#
0 string snoop Snoop capture file
->8 belong >0 - version %ld
+>8 belong >0 - version %d
>12 belong 0 (IEEE 802.3)
>12 belong 1 (IEEE 802.4)
>12 belong 2 (IEEE 802.5)
@@ -14762,15 +18281,26 @@
>12 belong 6 (Character synchronous)
>12 belong 7 (IBM channel-to-channel adapter)
>12 belong 8 (FDDI)
->12 belong 9 (Unknown)
+>12 belong 9 (Other)
+>12 belong 10 (type %d)
+>12 belong 11 (type %d)
+>12 belong 12 (type %d)
+>12 belong 13 (type %d)
+>12 belong 14 (type %d)
+>12 belong 15 (type %d)
+>12 belong 16 (Fibre Channel)
+>12 belong 17 (ATM)
+>12 belong 18 (ATM Classical IP)
+>12 belong 19 (type %d)
+>12 belong 20 (type %d)
+>12 belong 21 (type %d)
+>12 belong 22 (type %d)
+>12 belong 23 (type %d)
+>12 belong 24 (type %d)
+>12 belong 25 (type %d)
+>12 belong 26 (IP over Infiniband)
+>12 belong >26 (type %d)
-# Microsoft ICM color profile
-!:mime application/vnd.iccprofile
-36 string acspMSFT Microsoft ICM Color Profile
-# Sun KCMS
-36 string acsp Kodak Color Management System, ICC Profile
-!:mime application/vnd.iccprofile
-
#---------------------------------------------------------------------------
# The following entries have been tested by Duncan Laurie <duncan at sun.com> (a
# lead Sun/Cobalt developer) who agrees that they are good and worthy of
@@ -14784,14 +18314,56 @@
# at the very end where file(1) can't get it.
0 string CRfs COBALT boot rom data (Flat boot rom or file system)
+#------------------------------------------------------------------------------
+# msx: file(1) magic for the SymbOS operating system
+# http://www.symbos.de
+# Fabio R. Schmidlin <frs at pop.com.br>
+# SymbOS EXE file
+0x30 string SymExe SymbOS executable
+>0x36 ubyte x v%c
+>0x37 ubyte x \b.%c
+>0xF string x \b, name: %s
+# SymbOS DOX document
+0 string INFOq\0 SymbOS DOX document
+
+# Symbos driver
+0 string SMD1 SymbOS driver
+>19 byte x \b, name: %c
+>20 byte x \b%c
+>21 byte x \b%c
+>22 byte x \b%c
+>23 byte x \b%c
+>24 byte x \b%c
+>25 byte x \b%c
+>26 byte x \b%c
+>27 byte x \b%c
+>28 byte x \b%c
+>29 byte x \b%c
+>30 byte x \b%c
+>31 byte x \b%c
+
+# Symbos video
+0 string SymVid SymbOS video
+>6 ubyte x v%c
+>7 ubyte x \b.%c
+
+# Soundtrakker 128 ST2 music
+0 byte 0
+>0xC string \x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x40\x00 Soundtrakker 128 ST2 music,
+>>1 string x name: %s
+
+
+
#------------------------------------------------------------------------
-# $File: sysex,v 1.6 2009/09/19 16:28:12 christos Exp $
+# $File: sysex,v 1.8 2014/06/03 19:17:27 christos Exp $
# sysex: file(1) magic for MIDI sysex files
#
-#
-0 byte 0xF0 SysEx File -
+# GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems
+# where real SYStem EXclusive messages at offset 1 are limited to seven bits
+# http://en.wikipedia.org/wiki/MIDI
+0 ubeshort&0xFF80 0xF000 SysEx File -
# North American Group
>1 byte 0x01 Sequential
@@ -14997,7 +18569,7 @@
>1 byte 0x52 Zoom
>1 byte 0x54 Matsushita
>1 byte 0x57 Acoustic tech. lab.
-
+# http://www.midi.org/techspecs/manid.php
>1 belong&0xffffff00 0x00007400 Ta Horng
>1 belong&0xffffff00 0x00007500 e-Tek
>1 belong&0xffffff00 0x00007600 E-Voice
@@ -15110,7 +18682,7 @@
# Tcl scripts
0 search/1/w #!\ /usr/bin/tcl Tcl script text executable
-!:mime text/x-lua
+!:mime text/x-tcl
0 search/1/w #!\ /usr/local/bin/tcl Tcl script text executable
!:mime text/x-tcl
0 search/1 #!/usr/bin/env\ tcl Tcl script text executable
@@ -15150,7 +18722,7 @@
0 short 0434 Curses screen image
#------------------------------------------------------------------------------
-# $File: tex,v 1.17 2010/09/20 19:19:17 rrt Exp $
+# $File: tex,v 1.20 2014/03/16 02:53:03 christos Exp $
# tex: file(1) magic for TeX files
#
# XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
@@ -15187,34 +18759,45 @@
!:mime text/x-info
# TeX documents, from Daniel Quinlan (quinlan at yggdrasil.com)
-0 search/400 \\input TeX document text
+0 search/4096 \\input TeX document text
!:mime text/x-tex
-0 search/400 \\section LaTeX document text
+!:strength + 15
+0 search/4096 \\begin LaTeX document text
!:mime text/x-tex
-0 search/400 \\setlength LaTeX document text
+!:strength + 15
+0 search/4096 \\section LaTeX document text
!:mime text/x-tex
-0 search/400 \\documentstyle LaTeX document text
+!:strength + 18
+0 search/4096 \\setlength LaTeX document text
!:mime text/x-tex
-0 search/400 \\chapter LaTeX document text
+!:strength + 15
+0 search/4096 \\documentstyle LaTeX document text
!:mime text/x-tex
-0 search/400 \\documentclass LaTeX 2e document text
+!:strength + 18
+0 search/4096 \\chapter LaTeX document text
!:mime text/x-tex
-0 search/400 \\relax LaTeX auxiliary file
+!:strength + 18
+0 search/4096 \\documentclass LaTeX 2e document text
!:mime text/x-tex
-0 search/400 \\contentsline LaTeX table of contents
+!:strength + 15
+0 search/4096 \\relax LaTeX auxiliary file
!:mime text/x-tex
-0 search/400 %\ -*-latex-*- LaTeX document text
+!:strength + 15
+0 search/4096 \\contentsline LaTeX table of contents
!:mime text/x-tex
+!:strength + 15
+0 search/4096 %\ -*-latex-*- LaTeX document text
+!:mime text/x-tex
# Tex document, from Hendrik Scholz <hendrik at scholz.net>
0 search/1 \\ifx TeX document text
# Index and glossary files
-0 search/400 \\indexentry LaTeX raw index file
-0 search/400 \\begin{theindex} LaTeX sorted index
-0 search/400 \\glossaryentry LaTeX raw glossary
-0 search/400 \\begin{theglossary} LaTeX sorted glossary
-0 search/400 This\ is\ makeindex Makeindex log file
+0 search/4096 \\indexentry LaTeX raw index file
+0 search/4096 \\begin{theindex} LaTeX sorted index
+0 search/4096 \\glossaryentry LaTeX raw glossary
+0 search/4096 \\begin{theglossary} LaTeX sorted glossary
+0 search/4096 This\ is\ makeindex Makeindex log file
# End of TeX
@@ -15246,6 +18829,37 @@
0 string #LyX LyX document text
+# ConTeXt documents
+# http://wiki.contextgarden.net/
+0 search/4096 \\setupcolors[ ConTeXt document text
+!:strength + 15
+0 search/4096 \\definecolor[ ConTeXt document text
+!:strength + 15
+0 search/4096 \\setupinteraction[ ConTeXt document text
+!:strength + 15
+0 search/4096 \\useURL[ ConTeXt document text
+!:strength + 15
+0 search/4096 \\setuppapersize[ ConTeXt document text
+!:strength + 15
+0 search/4096 \\setuplayout[ ConTeXt document text
+!:strength + 15
+0 search/4096 \\setupfooter[ ConTeXt document text
+!:strength + 15
+0 search/4096 \\setupfootertexts[ ConTeXt document text
+!:strength + 15
+0 search/4096 \\setuppagenumbering[ ConTeXt document text
+!:strength + 15
+0 search/4096 \\setupbodyfont[ ConTeXt document text
+!:strength + 15
+0 search/4096 \\setuphead[ ConTeXt document text
+!:strength + 15
+0 search/4096 \\setupitemize[ ConTeXt document text
+!:strength + 15
+0 search/4096 \\setupwhitespace[ ConTeXt document text
+!:strength + 15
+0 search/4096 \\setupindenting[ ConTeXt document text
+!:strength + 15
+
#------------------------------------------------------------------------------
# $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $
# file(1) magic for tgif(1) files
@@ -15254,7 +18868,7 @@
>6 string x %s
#------------------------------------------------------------------------------
-# $File: ti-8x,v 1.6 2009/09/19 16:28:12 christos Exp $
+# $File: ti-8x,v 1.7 2014/04/30 21:41:02 christos Exp $
# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators.
#
# From: Ryan McGuire (rmcguire at freenet.columbus.oh.us).
@@ -15476,7 +19090,7 @@
>49 byte 0x24 type: application,
>49 byte 0x25 type: certificate,
>49 byte 0x3e type: license,
->74 lelong >0 size: %ld bytes
+>74 lelong >0 size: %d bytes
# VTi & TiEmu skins (TI Graphing Calculators).
# From: Romain Lievin (roms at lpg.ticalc.org).
@@ -15525,7 +19139,7 @@
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data
#------------------------------------------------------------------------------
-# $File: troff,v 1.10 2009/09/19 16:28:12 christos Exp $
+# $File: troff,v 1.11 2014/06/03 19:01:34 christos Exp $
# troff: file(1) magic for *roff
#
# updated by Daniel Quinlan (quinlan at yggdrasil.com)
@@ -15541,9 +19155,9 @@
!:mime text/troff
0 search/1 ''' troff or preprocessor input text
!:mime text/troff
-0 regex/20 \^\\.[A-Za-z0-9][A-Za-z0-9][\ \t] troff or preprocessor input text
+0 regex/20l \^\\.[A-Za-z0-9][A-Za-z0-9][\ \t] troff or preprocessor input text
!:mime text/troff
-0 regex/20 \^\\.[A-Za-z0-9][A-Za-z0-9]$ troff or preprocessor input text
+0 regex/20l \^\\.[A-Za-z0-9][A-Za-z0-9]$ troff or preprocessor input text
!:mime text/troff
# ditroff intermediate output text
@@ -15595,41 +19209,56 @@
0 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode)
#------------------------------------------------------------------------------
-# $File: unknown,v 1.7 2009/09/19 16:28:13 christos Exp $
+# $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $
# unknown: file(1) magic for unknown machines
#
-# XXX - this probably should be pruned, as it'll match PDP-11 and
-# VAX image formats.
+# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11
+# (executable, pure, and split I&D, respectively), but the PDP-11 version
+# doesn't have the "version %ld", which may be a bogus COFFism (I don't
+# think there was ever COFF for the PDP-11).
#
-# 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure,
-# respectively).
+# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
+# long, as it would be on a VAX. In any case, that could collide with
+# VAX demand-paged files, as the magic number is little-endian on those
+# binaries, so the first 16 bits of the file would contain 0x10B.
#
-# 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't
-# have the "version %ld", which may be a bogus COFFism (I don't think
-# there ever was COFF for the PDP-11).
+# Therefore, those entries are commented out.
#
-# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
-# long, as it would be on a VAX.
+# 0x10C is 0414 and 0x10E is 0416; those *are* unknown.
#
-# 0x10C is 0414 and 0x10E is 416; those *are* unknown.
-#
-0 short 0x107 unknown machine executable
->8 short >0 not stripped
->15 byte >0 - version %ld
-0 short 0x108 unknown pure executable
->8 short >0 not stripped
->15 byte >0 - version %ld
-0 short 0x109 PDP-11 separate I&D
->8 short >0 not stripped
->15 byte >0 - version %ld
-0 short 0x10b unknown pure executable
->8 short >0 not stripped
->15 byte >0 - version %ld
+#0 short 0x107 unknown machine executable
+#>8 short >0 not stripped
+#>15 byte >0 - version %ld
+#0 short 0x108 unknown pure executable
+#>8 short >0 not stripped
+#>15 byte >0 - version %ld
+#0 short 0x109 PDP-11 separate I&D
+#>8 short >0 not stripped
+#>15 byte >0 - version %ld
+#0 short 0x10b unknown pure executable
+#>8 short >0 not stripped
+#>15 byte >0 - version %ld
0 long 0x10c unknown demand paged pure executable
>16 long >0 not stripped
0 long 0x10e unknown readable demand paged pure executable
#------------------------------------------------------------------------------
+# $File: uterus,v 1.3 2014/04/30 21:41:02 christos Exp $
+# file(1) magic for uterus files
+# http://freecode.com/projects/uterus
+#
+0 string UTE+ uterus file
+>4 string v \b, version
+>5 byte x %c
+>6 string . \b.
+>7 byte x \b%c
+>8 string \<\> \b, big-endian
+>>16 belong >0 \b, slut size %u
+>8 string \>\< \b, litte-endian
+>>16 lelong >0 \b, slut size %u
+>10 byte &8 \b, compressed
+
+#------------------------------------------------------------------------------
# $File: uuencode,v 1.7 2009/09/19 16:28:13 christos Exp $
# uuencode: file(1) magic for ASCII-encoded files
#
@@ -15661,7 +19290,7 @@
# GRR: handle BASE64
#------------------------------------------------------------------------------
-# $File: varied.out,v 1.22 2010/07/02 00:06:27 christos Exp $
+# $File: varied.out,v 1.23 2014/04/30 21:41:02 christos Exp $
# varied.out: file(1) magic for various USG systems
#
# Herewith many of the object file formats used by USG systems.
@@ -15687,7 +19316,7 @@
>7 string >\0 version '%s'
# gnu gmon magic From: Eugen Dedu <dedu at ese-metz.fr>
0 string gmon GNU prof performance data
->4 long x - version %ld
+>4 long x - version %d
# From: Dave Pearson <davep at davep.org>
# Harbour <URL:http://harbour-project.org/> HRB files.
0 string \xc0HRB Harbour HRB file
@@ -15705,20 +19334,59 @@
0 lelong 0x13a9f17e ST40 component image format
>4 string >\0 \b, name '%s'
-
#------------------------------------------------------------------------------
-# $File: varied.script,v 1.7 2010/11/25 15:00:12 christos Exp $
+# $File: varied.script,v 1.10 2014/03/01 22:32:39 christos Exp $
# varied.script: file(1) magic for various interpreter scripts
0 string/t #!\ / a
>3 string >\0 %s script text executable
+!:strength / 2
+
+0 string/b #!\ / a
+>3 string >\0 %s script executable (binary data)
+!:strength / 2
+
0 string/t #!\t/ a
>3 string >\0 %s script text executable
+!:strength / 2
+
+0 string/b #!\t/ a
+>3 string >\0 %s script executable (binary data)
+!:strength / 2
+
0 string/t #!/ a
>2 string >\0 %s script text executable
+!:strength / 2
+
+0 string/b #!/ a
+>2 string >\0 %s script executable (binary data)
+!:strength / 2
+
0 string/t #!\ script text executable
>3 string >\0 for %s
+!:strength / 3
+0 string/b #!\ script executable
+>3 string >\0 for %s (binary data)
+!:strength / 3
+
+# using env
+0 string/t #!/usr/bin/env a
+>15 string/t >\0 %s script text executable
+!:strength / 10
+
+0 string/b #!/usr/bin/env a
+>15 string/b >\0 %s script executable (binary data)
+!:strength / 10
+
+0 string/t #!\ /usr/bin/env a
+>16 string/t >\0 %s script text executable
+!:strength / 10
+
+0 string/b #!\ /usr/bin/env a
+>16 string/b >\0 %s script executable (binary data)
+!:strength / 10
+
# From: arno <arenevier at fdn.fr>
# mozilla xpconnect typelib
# see http://www.mozilla.org/scriptable/typelib_file.html
@@ -15727,7 +19395,7 @@
>>0x11 byte x \b.%d
#------------------------------------------------------------------------------
-# $File: vax,v 1.7 2009/09/19 16:28:13 christos Exp $
+# $File: vax,v 1.9 2014/04/30 21:41:02 christos Exp $
# vax: file(1) magic for VAX executable/object and APL workspace
#
0 lelong 0101557 VAX single precision APL workspace
@@ -15734,32 +19402,24 @@
0 lelong 0101556 VAX double precision APL workspace
#
-# VAX a.out (32V, BSD)
+# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian
+# executables, and are handled in aout)
#
-0 lelong 0407 VAX executable
+0 lelong 0420 a.out VAX demand paged (first page unmapped) pure executable
>16 lelong >0 not stripped
-0 lelong 0410 VAX pure executable
->16 lelong >0 not stripped
-
-0 lelong 0413 VAX demand paged pure executable
->16 lelong >0 not stripped
-
-0 lelong 0420 VAX demand paged (first page unmapped) pure executable
->16 lelong >0 not stripped
-
#
# VAX COFF
#
-# The `versions' should be un-commented if they work for you.
+# The `versions' were commented out, but have been un-commented out.
# (Was the problem just one of endianness?)
#
0 leshort 0570 VAX COFF executable
>12 lelong >0 not stripped
->22 leshort >0 - version %ld
+>22 leshort >0 - version %d
0 leshort 0575 VAX COFF pure executable
>12 lelong >0 not stripped
->22 leshort >0 - version %ld
+>22 leshort >0 - version %d
#------------------------------------------------------------------------------
# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $
@@ -15779,7 +19439,7 @@
43 string SFDU_LABEL VICAR label file
#------------------------------------------------------------------------------
-# $File: virtual,v 1.1 2009/12/25 16:04:30 christos Exp $
+# $File: virtual,v 1.6 2014/05/07 21:25:41 christos Exp $
# From: James Nobis <quel at quelrod.net>
# Microsoft hard disk images for:
# Virtual Server
@@ -15788,13 +19448,119 @@
# .vhd
0 string conectix Microsoft Disk Image, Virtual Server or Virtual PC
+# libvirt
+# From: Philipp Hahn <hahn at univention.de>
+0 string LibvirtQemudSave Libvirt QEMU Suspend Image
+>0x10 lelong x \b, version %u
+>0x14 lelong x \b, XML length %u
+>0x18 lelong 1 \b, running
+>0x1c lelong 1 \b, compressed
+
+0 string LibvirtQemudPart Libvirt QEMU partial Suspend Image
+# From: Alex Beregszaszi <alex at fsn.hu>
+0 string/b COWD VMWare3
+>4 byte 3 disk image
+>>32 lelong x (%d/
+>>36 lelong x \b%d/
+>>40 lelong x \b%d)
+>4 byte 2 undoable disk image
+>>32 string >\0 (%s)
+
+0 string/b VMDK VMware4 disk image
+0 string/b KDMV VMware4 disk image
+
+#--------------------------------------------------------------------
+# Qemu Emulator Images
+# Lines written by Friedrich Schwittay (f.schwittay at yousable.de)
+# Updated by Adam Buchbinder (adam.buchbinder at gmail.com)
+# Made by reading sources, reading documentation, and doing trial and error
+# on existing QCOW files
+0 string/b QFI\xFB QEMU QCOW Image
+
+# Uncomment the following line to display Magic (only used for debugging
+# this magic number)
+#>0 string/b x , Magic: %s
+
+# There are currently 2 Versions: "1" and "2".
+# http://www.gnome.org/~markmc/qcow-image-format-version-1.html
+>4 belong 1 (v1)
+
+# Using the existence of the Backing File Offset to determine whether
+# to read Backing File Information
+>>12 belong >0 \b, has backing file (
+# Note that this isn't a null-terminated string; the length is actually
+# (16.L). Assuming a null-terminated string happens to work usually, but it
+# may spew junk until it reaches a \0 in some cases.
+>>>(12.L) string >\0 \bpath %s
+
+# Modification time of the Backing File
+# Really useful if you want to know if your backing
+# file is still usable together with this image
+>>>>20 bedate >0 \b, mtime %s)
+>>>>20 default x \b)
+
+# Size is stored in bytes in a big-endian u64.
+>>24 bequad x \b, %lld bytes
+
+# 1 for AES encryption, 0 for none.
+>>36 belong 1 \b, AES-encrypted
+
+# http://www.gnome.org/~markmc/qcow-image-format.html
+>4 belong 2 (v2)
+# Using the existence of the Backing File Offset to determine whether
+# to read Backing File Information
+>>8 bequad >0 \b, has backing file
+# Note that this isn't a null-terminated string; the length is actually
+# (16.L). Assuming a null-terminated string happens to work usually, but it
+# may spew junk until it reaches a \0 in some cases. Also, since there's no
+# .Q modifier, we just use the bottom four bytes as an offset. Note that if
+# the file is over 4G, and the backing file path is stored after the first 4G,
+# the wrong filename will be printed. (This should be (8.Q), when that syntax
+# is introduced.)
+>>>(12.L) string >\0 (path %s)
+>>24 bequad x \b, %lld bytes
+>>32 belong 1 \b, AES-encrypted
+
+>4 belong 3 (v3)
+# Using the existence of the Backing File Offset to determine whether
+# to read Backing File Information
+>>8 bequad >0 \b, has backing file
+# Note that this isn't a null-terminated string; the length is actually
+# (16.L). Assuming a null-terminated string happens to work usually, but it
+# may spew junk until it reaches a \0 in some cases. Also, since there's no
+# .Q modifier, we just use the bottom four bytes as an offset. Note that if
+# the file is over 4G, and the backing file path is stored after the first 4G,
+# the wrong filename will be printed. (This should be (8.Q), when that syntax
+# is introduced.)
+>>>(12.L) string >\0 (path %s)
+>>24 bequad x \b, %lld bytes
+>>32 belong 1 \b, AES-encrypted
+
+>4 default x (unknown version)
+
+0 string/b QEVM QEMU suspend to disk image
+
+# QEMU QED Image
+# http://wiki.qemu.org/Features/QED/Specification
+0 string/b QED\0 QEMU QED Image
+
+# VDI Image
# Sun xVM VirtualBox Disk Image
-# string <<< Sun xVM VirtualBox Disk Image >>>
-# .vdi
-0 string \<\<\<\ Sun\ xVM\ VirtualBox\ Disk Sun xVM VirtualBox Disk Image
+# From: Richard W.M. Jones <rich at annexia.org>
+# VirtualBox Disk Image
+0x40 ulelong 0xbeda107f VirtualBox Disk Image
+>0x44 uleshort >0 \b, major %u
+>0x46 uleshort >0 \b, minor %u
+>0 string >\0 (%s)
+>368 lequad x \b, %lld bytes
+0 string/b Bochs\ Virtual\ HD\ Image Bochs disk image,
+>32 string x type %s,
+>48 string x subtype %s
+0 lelong 0x02468ace Bochs Sparse disk image
+
#------------------------------------------------------------------------------
# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $
# Virtutech Compressed Random Access File Format
@@ -15840,7 +19606,7 @@
>2 string .VISIX (ascii text)
#------------------------------------------------------------------------------
-# $File: vms,v 1.6 2009/09/19 16:28:13 christos Exp $
+# $File: vms,v 1.7 2013/03/09 22:36:00 christos Exp $
# vms: file(1) magic for VMS executables (experimental)
#
# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt at uchicago.edu)
@@ -15864,8 +19630,10 @@
# 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................
#
-0 belong 0x03000000 VMS Alpha executable
->75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
+# GRR this test is still too general as it catches example adressen.dbt
+0 belong 0x03000000
+>8 ubelong 0xec020000 VMS Alpha executable
+>>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
#------------------------------------------------------------------------------
# $File: vmware,v 1.7 2009/09/19 16:28:13 christos Exp $
@@ -15874,7 +19642,7 @@
0 belong 0x4d52564e VMware nvram
#------------------------------------------------------------------------------
-# $File: vorbis,v 1.16 2009/09/19 16:28:13 christos Exp $
+# $File: vorbis,v 1.18 2014/04/30 21:41:02 christos Exp $
# vorbis: file(1) magic for Ogg/Vorbis files
#
# From Felix von Leitner <leitner at fefe.de>
@@ -15930,13 +19698,13 @@
>>>37 string/c xvid (XviD)
# --- First vorbis packet - general header ---
>>28 string \x01vorbis \b, Vorbis audio,
->>>35 lelong !0 UNKNOWN VERSION %lu,
+>>>35 lelong !0 UNKNOWN VERSION %u,
##>>>35 lelong 0 version 0,
>>>35 lelong 0
>>>>39 ubyte 1 mono,
>>>>39 ubyte 2 stereo,
>>>>39 ubyte >2 %u channels,
->>>>40 lelong x %lu Hz
+>>>>40 lelong x %u Hz
# Minimal, nominal and maximal bitrates specified when encoding
>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b,
# The above tests if at least one of these is specified:
@@ -15946,13 +19714,13 @@
# Vorbis 1.0 uses 0 instead of -1.
>>>>>>52 lelong !0
>>>>>>>52 lelong !-1000
->>>>>>>>52 lelong x <%lu
+>>>>>>>>52 lelong x <%u
>>>>>48 lelong !-1
->>>>>>48 lelong x ~%lu
+>>>>>>48 lelong x ~%u
>>>>>44 lelong !-1
>>>>>>44 lelong !-1000
>>>>>>>44 lelong !0
->>>>>>>>44 lelong x >%lu
+>>>>>>>>44 lelong x >%u
>>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps
# -- Second vorbis header packet - the comments
# A kludge to read the vendor string. It's a counted string, not a
@@ -16038,7 +19806,7 @@
#0 string =!! Bennet Yee's "face" format
#------------------------------------------------------------------------------
-# $File: windows,v 1.4 2009/09/19 16:28:13 christos Exp $
+# $File: windows,v 1.8 2014/04/30 21:41:02 christos Exp $
# windows: file(1) magic for Microsoft Windows
#
# This file is mainly reserved for files where programs
@@ -16074,7 +19842,7 @@
>>0xf88 lelong 1 \b, full dump
>>0xf88 lelong 2 \b, kernel dump
>>0xf88 lelong 3 \b, small dump
->>0x068 lelong x \b, %ld pages
+>>0x068 lelong x \b, %d pages
>4 string DU64 MS Windows 64bit crash dump
>>0xf98 lelong 1 \b, full dump
>>0xf98 lelong 2 \b, kernel dump
@@ -16113,13 +19881,56 @@
0 string HyperTerminal\
>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile
-
+# http://ithreats.files.wordpress.com/2009/05/\
+# lnk_the_windows_shortcut_file_format.pdf
# Summary: Windows shortcut
# Extension: .lnk
# Created by: unknown
+# 'L' + GUUID
0 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut
+>20 lelong&1 1 \b, Item id list present
+>20 lelong&2 2 \b, Points to a file or directory
+>20 lelong&4 4 \b, Has Description string
+>20 lelong&8 8 \b, Has Relative path
+>20 lelong&16 16 \b, Has Working directory
+>20 lelong&32 32 \b, Has command line arguments
+>20 lelong&64 64 \b, Icon
+>>56 lelong \b number=%d
+>24 lelong&1 1 \b, Read-Only
+>24 lelong&2 2 \b, Hidden
+>24 lelong&4 4 \b, System
+>24 lelong&8 8 \b, Volume Label
+>24 lelong&16 16 \b, Directory
+>24 lelong&32 32 \b, Archive
+>24 lelong&64 64 \b, Encrypted
+>24 lelong&128 128 \b, Normal
+>24 lelong&256 256 \b, Temporary
+>24 lelong&512 512 \b, Sparse
+>24 lelong&1024 1024 \b, Reparse point
+>24 lelong&2048 2048 \b, Compressed
+>24 lelong&4096 4096 \b, Offline
+>28 leqwdate x \b, ctime=%s
+>36 leqwdate x \b, mtime=%s
+>44 leqwdate x \b, atime=%s
+>52 lelong x \b, length=%u, window=
+>60 lelong&1 1 \bhide
+>60 lelong&2 2 \bnormal
+>60 lelong&4 4 \bshowminimized
+>60 lelong&8 8 \bshowmaximized
+>60 lelong&16 16 \bshownoactivate
+>60 lelong&32 32 \bminimize
+>60 lelong&64 64 \bshowminnoactive
+>60 lelong&128 128 \bshowna
+>60 lelong&256 256 \brestore
+>60 lelong&512 512 \bshowdefault
+#>20 lelong&1 0
+#>>20 lelong&2 2
+#>>>(72.l-64) pstring/h x \b [%s]
+#>20 lelong&1 1
+#>>20 lelong&2 2
+#>>>(72.s) leshort x
+#>>>&75 pstring/h x \b [%s]
-
# Summary: Outlook Personal Folders
# Created by: unknown
0 lelong 0x4E444221 Microsoft Outlook email folder
@@ -16153,12 +19964,183 @@
0 string Windows\ Registry\ Editor\
>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above)
-
+# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013
+# emtpy ,comment , section , unicode line
+0 regex/s \\`(\r\n|;|[[]|\xFF\xFE)
+# left bracket in section line
+>&0 search/8192 [
+# http://en.wikipedia.org/wiki/Autorun.inf
+# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx
+>>&0 regex/c \^(autorun)]\r\n
+>>>&0 ubyte =0x5b INItialization configuration
+!:mime application/x-wine-extension-ini
# From: Pal Tamas <folti at balabit.hu>
# Autorun File
-0 string/c [autorun]\r\n Microsoft Windows Autorun file.
-!:mime application/x-setupscript.
+>>>&0 ubyte !0x5b Microsoft Windows Autorun file
+!:mime application/x-setupscript
+# http://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx
+# version strings ASCII coded case-independent for Windows setup information script file
+>>&0 regex/c \^(version|strings)] Windows setup INFormation
+!:mime application/x-setupscript
+#!:mime application/inf
+#!:mime application/x-wine-extension-inf
+>>&0 regex/c \^(WinsockCRCList|OEMCPL)] Windows setup INFormation
+!:mime text/inf
+# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm
+# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx
+# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent
+>>&0 regex/c \^(\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] Windows desktop.ini
+!:mime application/x-wine-extension-ini
+#!:mime text/plain
+# http://support.microsoft.com/kb/84709/
+>>&0 regex/c \^(don't\ load)] Windows CONTROL.INI
+!:mime application/x-wine-extension-ini
+>>&0 regex/c \^(ndishlp\\$|protman\\$|NETBEUI\\$)] Windows PROTOCOL.INI
+!:mime application/x-wine-extension-ini
+# http://technet.microsoft.com/en-us/library/cc722567.aspx
+# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm
+>>&0 regex/c \^(windows|Compatibility|embedding)] Windows WIN.INI
+!:mime application/x-wine-extension-ini
+# http://en.wikipedia.org/wiki/SYSTEM.INI
+>>&0 regex/c \^(boot|386enh|drivers)] Windows SYSTEM.INI
+!:mime application/x-wine-extension-ini
+# http://www.mdgx.com/newtip6.htm
+>>&0 regex/c \^(SafeList)] Windows IOS.INI
+!:mime application/x-wine-extension-ini
+# http://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information
+>>&0 regex/c \^(boot\x20loader)] Windows boot.ini
+!:mime application/x-wine-extension-ini
+>>>&0 ubyte x
+# http://en.wikipedia.org/wiki/CONFIG.SYS
+>>&0 regex/c \^(menu)]\r\n MS-DOS CONFIG.SYS
+# http://support.microsoft.com/kb/118579/
+>>&0 regex/c \^(Paths)]\r\n MS-DOS MSDOS.SYS
+# VERS string unicoded case-independent
+>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053
+# ION] string unicoded case-independent
+>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation
+!:mime application/x-setupscript
+# STRI string unicoded case-independent
+>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0053005400520049
+# NGS] string unicoded case-independent
+>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x004e00470053005D Windows setup INFormation
+!:mime application/x-setupscript
+# unknown keyword after opening bracket
+>>&0 default x
+>>>&0 search/8192 [
+# version Strings FileIdentification
+>>>>&0 string/c version Windows setup INFormation
+!:mime application/x-setupscript
+# VERS string unicoded case-independent
+>>>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053
+# ION] string unicoded case-independent
+>>>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation
+!:mime application/x-setupscript
+# http://en.wikipedia.org/wiki/Initialization_file Windows Initialization File or other
+#>>>>&0 default x Generic INItialization configuration
+#!:mime application/x-wine-extension-ini
+# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h
+# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm
+# GRR: line below too general as it catches also PDP-11 UNIX/RT ldp
+0 leshort&0xFeFe 0x0000
+# test for unused null bits in PNF_FLAGs
+>4 ulelong&0xFCffFe00 0x00000000
+# only found 58h for Offset of WinDirPath immediately after _PNF_HEADER structure
+>>68 ulelong >0x57
+# test for zero high byte of InfValueBlockSize, followed by WinDirPath like
+# C:\WINDOWS (ASCII 0x433a5c.. , unicode 0x43003a005c..) or X:\MININT
+>>>(68.l-1) ubelong&0xffE0C519 =0x00400018 Windows Precompiled iNF
+!:mime application/x-pnf
+# currently only found Major Version=1 and Minor Version=1
+#>>>>0 uleshort =0x0101
+#>>>>>1 ubyte x \b, version %u
+#>>>>>0 ubyte x \b.%u
+>>>>0 uleshort !0x0101
+>>>>>1 ubyte x \b, version %u
+>>>>>0 ubyte x \b.%u
+# 1 ,2 (windows 98 SE)
+#>>>>2 uleshort =2 \b, InfStyle %u
+>>>>2 uleshort !2 \b, InfStyle %u
+# PNF_FLAG_IS_UNICODE 0x00000001
+# PNF_FLAG_HAS_STRINGS 0x00000002
+# PNF_FLAG_SRCPATH_IS_URL 0x00000004
+# PNF_FLAG_HAS_VOLATILE_DIRIDS 0x00000008
+# PNF_FLAG_INF_VERIFIED 0x00000010
+# PNF_FLAG_INF_DIGITALLY_SIGNED 0x00000020
+# ?? 0x00000100
+# ?? 0x01000000
+# ?? 0x02000000
+>>>>4 ulelong&0x00000001 0x00000001 \b, unicoded
+>>>>4 ulelong&0x00000020 0x00000020 \b, digitally signed
+#>>>>8 ulelong x \b, InfSubstValueListOffset 0x%x
+# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF
+#>>>>12 uleshort x \b, InfSubstValueCount 0x%x
+# only < 9 found
+#>>>>14 uleshort x \b, InfVersionDatumCount 0x%x
+# only found values lower 0x0000ffff
+#>>>>16 ulelong x \b, InfVersionDataSize 0x%x
+# only found positive values lower 0x00ffFFff for InfVersionDataOffset
+>>>>20 ulelong x \b, at 0x%x
+>>>>4 ulelong&0x00000001 =0x00000001
+# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature
+>>>>>(20.l) lestring16 x "%s"
+>>>>4 ulelong&0x00000001 !0x00000001
+>>>>>(20.l) string x "%s"
+# FILETIME is number of 100-nanosecond intervals since 1 January 1601
+#>>>>24 ulequad x \b, InfVersionLastWriteTime %16.16llx
+# only found values lower 0x00ffFFff
+#>>>>32 ulelong x \b, StringTableBlockOffset 0x%x
+#>>>>36 ulelong x \b, StringTableBlockSize 0x%x
+#>>>>40 ulelong x \b, InfSectionCount 0x%x
+#>>>>44 ulelong x \b, InfSectionBlockOffset 0x%x
+#>>>>48 ulelong x \b, InfSectionBlockSize 0x%x
+#>>>>52 ulelong x \b, InfLineBlockOffset 0x%x
+#>>>>56 ulelong x \b, InfLineBlockSize 0x%x
+#>>>>60 ulelong x \b, InfValueBlockOffset 0x%x
+#>>>>64 ulelong x \b, InfValueBlockSize 0x%x
+# WinDirPathOffset
+#>>>>68 ulelong x \b, at 0x%x
+>>>>68 ulelong >0x57
+>>>>>4 ulelong&0x00000001 =0x00000001
+>>>>>>(68.l) ubequad =0x43003a005c005700
+# normally unicoded C:\Windows
+#>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s"
+>>>>>>(68.l) ubequad !0x43003a005c005700
+>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s"
+>>>>>4 ulelong&0x00000001 !0x00000001
+# normally ASCII C:\WINDOWS
+#>>>>>>(68.l) string =C:\\WINDOWS \b, WinDirPath "%s"
+>>>>>>(68.l) string !C:\\WINDOWS \b, WinDirPath "%s"
+# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF
+#>>>>72 ulelong >0 \b, at 0x%x
+>>>>72 ulelong >0 \b,
+>>>>>4 ulelong&0x00000001 =0x00000001
+>>>>>>(72.l) lestring16 x OsLoaderPath "%s"
+>>>>>4 ulelong&0x00000001 !0x00000001
+# seldom C:\ instead empty
+>>>>>>(72.l) string x OsLoaderPath "%s"
+# 1fdh
+#>>>>76 uleshort x \b, StringTableHashBucketCount 0x%x
+>>>>78 uleshort !0x407 \b, LanguageId %x
+# only 407h found
+#>>>>78 uleshort =0x407 \b, LanguageId %x
+# InfSourcePathOffset often 0
+#>>>>80 ulelong >0 \b, at 0x%x
+>>>>80 ulelong >0 \b,
+>>>>>4 ulelong&0x00000001 =0x00000001
+>>>>>>(80.l) lestring16 x SourcePath "%s"
+>>>>>4 ulelong&0x00000001 !0x00000001
+>>>>>>(80.l) string >\0 SourcePath "%s"
+# OriginalInfNameOffset often 0
+#>>>>84 ulelong >0 \b, at 0x%x
+>>>>84 ulelong >0 \b,
+>>>>>4 ulelong&0x00000001 =0x00000001
+>>>>>>(84.l) lestring16 x InfName "%s"
+>>>>>4 ulelong&0x00000001 !0x00000001
+>>>>>>(84.l) string >\0 InfName "%s"
+
+
#------------------------------------------------------------------------------
# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $
# wireless-regdb: file(1) magic for CRDA wireless-regdb file format
@@ -16167,7 +20149,7 @@
>4 belong 19 (Version 1)
#------------------------------------------------------------------------------
-# $File: wordprocessors,v 1.15 2010/09/20 19:19:17 rrt Exp $
+# $File: wordprocessors,v 1.18 2013/06/03 19:07:29 christos Exp $
# wordprocessors: file(1) magic fo word processors.
#
####### PWP file format used on Smith Corona Personal Word Processors:
@@ -16277,7 +20259,7 @@
512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000
!:mime application/x-hwp
-# CosmicBook, from Beno\xEEt Rouits
+# CosmicBook, from Benoit Rouits
0 string CSBK Ted Neslson's CosmicBook hypertext file
2 string EYWR AmigaWriter file
@@ -16323,6 +20305,11 @@
0 string/w \<map\ version Freemind document
!:mime application/x-freemind
+# Type: Freeplane mindmap documents
+# From: Felix Natter <fnatter at gmx.net>
+0 string/w \<map\ version="freeplane Freeplane document
+!:mime application/x-freeplane
+
# Type: Scribus
# From: Werner Fink <werner at suse.de>
0 string \<SCRIBUSUTF8\ Version Scribus Document
@@ -16329,8 +20316,35 @@
0 string \<SCRIBUSUTF8NEW\ Version Scribus Document
!:mime application/x-scribus
+# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek
+# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14
+0 ulelong&0x8080FFFF 0x00001204 gfxboot compiled html help file
+
#------------------------------------------------------------------------------
-# $File: xdelta,v 1.4 2009/09/19 16:28:13 christos Exp $
+# $File: wsdl,v 1.3 2013/02/06 14:18:52 christos Exp $
+# wsdl: PHP WSDL Cache, http://www.php.net/manual/en/book.soap.php
+# Cache format extracted from source:
+# http://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup
+# Requires file >= 5.05, see http://mx.gw.com/pipermail/file/2010/000683.html
+# By Elan Ruusamae <glen at delfi.ee>, Patryk Zawadzki <patrys at pld-linux.org>, 2010-2011
+0 string wsdl PHP WSDL cache,
+>4 byte x version 0x%02x
+>6 ledate x \b, created %s
+
+# uri
+>10 lelong <0x7fffffff
+>>10 pstring/l x \b, uri: "%s"
+
+# source
+>>>&0 lelong <0x7fffffff
+>>>>&-4 pstring/l x \b, source: "%s"
+
+# target_ns
+>>>>>&0 lelong <0x7fffffff
+>>>>>>&-4 pstring/l x \b, target_ns: "%s"
+
+#------------------------------------------------------------------------------
+# $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $
# file(1) magic(5) data for xdelta Josh MacDonald <jmacd at CS.Berkeley.EDU>
#
0 string %XDELTA% XDelta binary patch file 0.14
@@ -16340,6 +20354,8 @@
0 string %XDZ003% XDelta binary patch file 1.0.4
0 string %XDZ004% XDelta binary patch file 1.1
+0 string \xD6\xC3\xC4\x00 VCDIFF binary diff
+
#------------------------------------------------------------------------------
# $File: xenix,v 1.9 2009/09/19 16:28:13 christos Exp $
# xenix: file(1) magic for Microsoft Xenix
@@ -16414,40 +20430,45 @@
0 leshort 0x580 XENIX 8086 relocatable or 80286 small model
#------------------------------------------------------------------------------
-# $File: xilinx,v 1.4 2009/09/19 16:28:13 christos Exp $
+# $File: xilinx,v 1.7 2014/04/30 21:41:02 christos Exp $
# This is Aaron's attempt at a MAGIC file for Xilinx .bit files.
# Xilinx-Magic at RevRagnarok.com
# Got the info from FPGA-FAQ 0026
#
+# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth,
+# fixes at least reading of bitfiles from Spartan 2, 3, 6.
+# http://www.fpga-faq.com/FAQ_Pages/0026_Tell_me_about_bit_files.htm
+#
# First there is the sync header and its length
0 beshort 0x0009
>2 belong =0x0ff00ff0
>>&0 belong =0x0ff00ff0
->>>&0 beshort =0x0000
->>>>&0 pstring a Xilinx BIT data
+>>>&0 byte =0x00
+>>>&1 beshort =0x0001
+>>>&3 string a Xilinx BIT data
# Next is a Pascal-style string with the NCD name. We want to capture that.
->>>>0x0F pstring x - from %s
-# It is followed by a NUL
->>>>>&1 byte 0x00
+>>>>&0 pstring/H x - from %s
# And then 'b'
->>>>>&2 string b
-# With the part number:
-#>>>>>&5 string 4v (Virtex4)
-#>>>>>&5 string 2v (Virtex II
-#>>>>>>&0 string !p \b)
-#>>>>>>&0 string p Pro)
->>>>>&4 pstring x - for %s
-# And then NUL / 'c' / Build Data / NUL / 'd' / Date / NUL / 'e' / Data Length
->>>>>>&1 byte 0x00
->>>>>>&2 string c
->>>>>>&4 pstring x - built %s
->>>>>>>&1 byte 0x00
->>>>>>>&2 string d
->>>>>>>&4 pstring x \b(%s)
->>>>>>>>&1 byte 0x00
->>>>>>>>&2 string e
->>>>>>>>&4 belong x - data length 0x%lx
+>>>>>&1 string b
+# Then the model / part number:
+>>>>>>&0 pstring/H x - for %s
+# Then 'c'
+>>>>>>>&1 string c
+# Then the build-date
+>>>>>>>>&0 pstring/H x - built %s
+# Then 'd'
+>>>>>>>>>&1 string d
+# Then the build-time
+>>>>>>>>>>&0 pstring/H x \b(%s)
+# Then 'e'
+>>>>>>>>>>>&1 string e
+# And length of data
+>>>>>>>>>>>>&0 belong x - data length 0x%x
+# Raw bitstream files
+0 long 0xffffffff
+>&0 belong 0xaa995566 Xilinx RAW bitstream (.BIN)
+
#------------------------------------------------------------------------------
# $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $
# xo65 object files
@@ -16479,7 +20500,7 @@
>6 leshort&0x0003 =0x0003 alignment 256
#------------------------------------------------------------------------------
-# $File: xwindows,v 1.6 2009/09/19 16:28:13 christos Exp $
+# $File: xwindows,v 1.9 2014/04/30 21:41:02 christos Exp $
# xwindows: file(1) magic for various X/Window system file formats.
# Compiled X Keymap
@@ -16489,7 +20510,7 @@
>0 byte =0 obsolete
0 string xkm Compiled XKB Keymap: msb,
>3 byte >0 version %d
->0 byte =0 obsolete
+>3 byte =0 obsolete
# xfsdump archive
0 string xFSdump0 xfsdump archive
@@ -16497,12 +20518,12 @@
# Jaleo XFS files
0 long 395726 Jaleo XFS file
->4 long x - version %ld
->8 long x - [%ld -
->20 long x %ldx
->24 long x %ldx
->28 long 1008 YUV422]
->28 long 1000 RGB24]
+>4 long x - version %d
+>8 long x - [%d -
+>20 long x \b%dx
+>24 long x \b%dx
+>28 long 1008 \bYUV422]
+>28 long 1000 \bRGB24]
# Xcursor data
# X11 mouse cursor format defined in libXcursor, see
@@ -16510,9 +20531,105 @@
# http://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h
0 string Xcur Xcursor data
!:mime image/x-xcursor
->10 leshort x version %hd
->>8 leshort x \b.%hd
+>10 leshort x version %d
+>>8 leshort x \b.%d
+#------------------------------------------------------------------------------
+# zfs: file(1) magic for ZFS dumps
+#
+# From <rea-fbsd at codelabs.ru>
+# ZFS dump header has the following structure (as per zfs_ioctl.h
+# in FreeBSD with drr_type is set to DRR_BEGIN)
+#
+# enum {
+# DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS,
+# DRR_WRITE, DRR_FREE, DRR_END,
+# } drr_type;
+# uint32_t drr_pad;
+# uint64_t drr_magic;
+# uint64_t drr_version;
+# uint64_t drr_creation_time;
+# dmu_objset_type_t drr_type;
+# uint32_t drr_pad;
+# uint64_t drr_toguid;
+# uint64_t drr_fromguid;
+# char drr_toname[MAXNAMELEN];
+#
+# Backup magic is 0x00000002f5bacbac (quad word)
+# The drr_type is defined as
+# typedef enum dmu_objset_type {
+# DMU_OST_NONE,
+# DMU_OST_META,
+# DMU_OST_ZFS,
+# DMU_OST_ZVOL,
+# DMU_OST_OTHER, /* For testing only! */
+# DMU_OST_ANY, /* Be careful! */
+# DMU_OST_NUMTYPES
+# } dmu_objset_type_t;
+#
+# Almost all uint64_t fields are printed as the 32-bit ones (with high
+# 32 bits zeroed), because there is no simple way to print them as the
+# full 64-bit values.
+# Big-endian values
+8 string \000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine),
+>20 belong x version %u,
+>32 belong 0 type: NONE,
+>32 belong 1 type: META,
+>32 belong 2 type: ZFS,
+>32 belong 3 type: ZVOL,
+>32 belong 4 type: OTHER,
+>32 belong 5 type: ANY,
+>32 belong >5 type: UNKNOWN (%u),
+>40 byte x destination GUID: %02X
+>41 byte x %02X
+>42 byte x %02X
+>43 byte x %02X
+>44 byte x %02X
+>45 byte x %02X
+>46 byte x %02X
+>47 byte x %02X,
+>48 ulong >0
+>>52 ulong >0
+>>>48 byte x source GUID: %02X
+>>>49 byte x %02X
+>>>50 byte x %02X
+>>>51 byte x %02X
+>>>52 byte x %02X
+>>>53 byte x %02X
+>>>54 byte x %02X
+>>>55 byte x %02X,
+>56 string >\0 name: '%s'
+
+# Little-endian values
+8 string \254\313\272\365\002\000\000\000 ZFS shapshot (little-endian machine),
+>16 lelong x version %u,
+>32 lelong 0 type: NONE,
+>32 lelong 1 type: META,
+>32 lelong 2 type: ZFS,
+>32 lelong 3 type: ZVOL,
+>32 lelong 4 type: OTHER,
+>32 lelong 5 type: ANY,
+>32 lelong >5 type: UNKNOWN (%u),
+>47 byte x destination GUID: %02X
+>46 byte x %02X
+>45 byte x %02X
+>44 byte x %02X
+>43 byte x %02X
+>42 byte x %02X
+>41 byte x %02X
+>40 byte x %02X,
+>48 ulong >0
+>>52 ulong >0
+>>>55 byte x source GUID: %02X
+>>>54 byte x %02X
+>>>53 byte x %02X
+>>>52 byte x %02X
+>>>51 byte x %02X
+>>>50 byte x %02X
+>>>49 byte x %02X
+>>>48 byte x %02X,
+>56 string >\0 name: '%s'
+
#------------------------------------------------------------------------------
# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $
# zilog: file(1) magic for Zilog Z8000.
More information about the Midnightbsd-cvs
mailing list