1# Magic data for file(1) command. 2# Format is described in magic(files), where: 3# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID. 4# Don't edit this file, edit /etc/magic or send your magic improvements 5# to the maintainers, at file@mx.gw.com 6 7#------------------------------------------------------------------------------ 8# Localstuff: file(1) magic for locally observed files 9# 10# $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $ 11# Add any locally observed files here. Remember: 12# text if readable, executable if runnable binary, data if unreadable. 13 14#------------------------------------------------------------------------------ 15# $File: acorn,v 1.5 2009/09/19 16:28:07 christos Exp $ 16# acorn: file(1) magic for files found on Acorn systems 17# 18 19# RISC OS Chunk File Format 20# From RISC OS Programmer's Reference Manual, Appendix D 21# We guess the file type from the type of the first chunk. 220 lelong 0xc3cbc6c5 RISC OS Chunk data 23>12 string OBJ_ \b, AOF object 24>12 string LIB_ \b, ALF library 25 26# RISC OS AIF, contains "SWI OS_Exit" at offset 16. 2716 lelong 0xef000011 RISC OS AIF executable 28 29# RISC OS Draw files 30# From RISC OS Programmer's Reference Manual, Appendix E 310 string Draw RISC OS Draw file data 32 33# RISC OS new format font files 34# From RISC OS Programmer's Reference Manual, Appendix E 350 string FONT\0 RISC OS outline font data, 36>5 byte x version %d 370 string FONT\1 RISC OS 1bpp font data, 38>5 byte x version %d 390 string FONT\4 RISC OS 4bpp font data 40>5 byte x version %d 41 42# RISC OS Music files 43# From RISC OS Programmer's Reference Manual, Appendix E 440 string Maestro\r RISC OS music file 45>8 byte x version %d 46 47>8 byte x type %d 48 49# Digital Symphony data files 50# From: Bernard Jungen (bern8817@euphonynet.be) 510 string \x02\x01\x13\x13\x13\x01\x0d\x10 Digital Symphony sound sample (RISC OS), 52>8 byte x version %d, 53>9 pstring x named "%s", 54>(9.b+19) byte =0 8-bit logarithmic 55>(9.b+19) byte =1 LZW-compressed linear 56>(9.b+19) byte =2 8-bit linear signed 57>(9.b+19) byte =3 16-bit linear signed 58>(9.b+19) byte =4 SigmaDelta-compressed linear 59>(9.b+19) byte =5 SigmaDelta-compressed logarithmic 60>(9.b+19) byte >5 unknown format 61 620 string \x02\x01\x13\x13\x14\x12\x01\x0b Digital Symphony song (RISC OS), 63>8 byte x version %d, 64>9 byte =1 1 voice, 65>9 byte !1 %d voices, 66>10 leshort =1 1 track, 67>10 leshort !1 %d tracks, 68>12 leshort =1 1 pattern 69>12 leshort !1 %d patterns 70 710 string \x02\x01\x13\x13\x10\x14\x12\x0e 72>9 byte =0 Digital Symphony sequence (RISC OS), 73>>8 byte x version %d, 74>>10 byte =1 1 line, 75>>10 byte !1 %d lines, 76>>11 leshort =1 1 position 77>>11 leshort !1 %d positions 78>9 byte =1 Digital Symphony pattern data (RISC OS), 79>>8 byte x version %d, 80>>10 leshort =1 1 pattern 81>>10 leshort !1 %d patterns 82 83#------------------------------------------------------------------------------ 84# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $ 85# adi: file(1) magic for ADi's objects 86# From Gregory McGarry <g.mcgarry@ieee.org> 87# 880 leshort 0x521c COFF DSP21k 89>18 lelong &02 executable, 90>18 lelong ^02 91>>18 lelong &01 static object, 92>>18 lelong ^01 relocatable object, 93>18 lelong &010 stripped 94>18 lelong ^010 not stripped 95 96#------------------------------------------------------------------------------ 97# $File: adventure,v 1.14 2012/06/21 01:32:26 christos Exp $ 98# adventure: file(1) magic for Adventure game files 99# 100# from Allen Garvin <earendil@faeryland.tamu-commerce.edu> 101# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998 102# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 103# 104# ALAN 105# I assume there are other, lower versions, but these are the only ones I 106# saw in the archive. 1070 beshort 0x0206 ALAN game data 108>2 byte <10 version 2.6%d 109 110 111# Infocom (see z-machine) 112#------------------------------------------------------------------------------ 113# Z-machine: file(1) magic for Z-machine binaries. 114# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 115# 116#http://www.gnelson.demon.co.uk/zspec/sect11.html 117#http://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt 118#http://en.wikipedia.org/wiki/Z-machine 119# The first byte is the Z-machine revision; it is always between 1 and 8. We 120# had false matches (for instance, inbig5.ocp from the Omega TeX extension as 121# well as an occasional MP3 file), so we sanity-check the version number. 122# 123# It might be possible to sanity-check the release number as well, as it seems 124# (at least in classic Infocom games) to always be a relatively small number, 125# always under 150 or so, but as this isn't rigorous, we'll wait on that until 126# it becomes clear that it's needed. 127# 1280 ubyte >0 129>0 ubyte <9 130>>16 belong&0xfe00f0f0 0x3030 131>>>0 ubyte < 10 132>>>>2 ubeshort < 10 133>>>>>18 regex [0-9][0-9][0-9][0-9][0-9][0-9] 134>>>>>>0 ubyte < 10 Infocom (Z-machine %d, 135>>>>>>>2 ubeshort < 10 Release %d / 136>>>>>>>>18 string >\0 Serial %.6s) 137!:strength + 40 138 139#------------------------------------------------------------------------------ 140# Glulx: file(1) magic for Glulx binaries. 141# 142# I haven't checked for false matches yet. 143# 1440 string Glul Glulx game data 145>4 beshort x (Version %d 146>>6 byte x \b.%d 147>>8 byte x \b.%d) 148>36 string Info Compiled by Inform 149 150 151 152# For Quetzal and blorb magic see iff 153 154 155# TADS (Text Adventure Development System) version 2 156# All files are machine-independent (games compile to byte-code) and are tagged 157# with a version string of the form "V2.<digit>.<digit>\0". 158# Game files start with "TADS2 bin\n\r\032\0" then the compiler version. 1590 string TADS2\ bin TADS 160>9 belong !0x0A0D1A00 game data, CORRUPTED 161>9 belong 0x0A0D1A00 162>>13 string >\0 %s game data 163# Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version. 1640 string TADS2\ rsc TADS 165>9 belong !0x0A0D1A00 resource data, CORRUPTED 166>9 belong 0x0A0D1A00 167>>13 string >\0 %s resource data 168# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian 169# 2-byte length N, the N-char name of the game file *without* a NUL (darn!), 170# "TADS2 save\n\r\032\0" and the interpreter version. 1710 string TADS2\ save/g TADS 172>12 belong !0x0A0D1A00 saved game data, CORRUPTED 173>12 belong 0x0A0D1A00 174>>(16.s+32) string >\0 %s saved game data 175# Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter 176# version. 1770 string TADS2\ save TADS 178>10 belong !0x0A0D1A00 saved game data, CORRUPTED 179>10 belong 0x0A0D1A00 180>>14 string >\0 %s saved game data 181 182# TADS (Text Adventure Development System) version 3 183# Game files start with "T3-image\015\012\032" 1840 string T3-image\015\012\032 185>11 leshort x TADS 3 game data (format version %d) 186# Saved game files start with "T3-state-v####\015\012\032" 187# where #### is a format version number 1880 string T3-state-v 189>14 string \015\012\032 TADS 3 saved game data (format version 190>>10 byte x %c 191>>11 byte x \b%c 192>>12 byte x \b%c 193>>13 byte x \b%c) 194 195# Danny Milosavljevic <danny.milo@gmx.net> 196# this are adrift (adventure game standard) game files, extension .taf 197# depending on version magic continues with 0x93453E6139FA (V 4.0) 198# 0x9445376139FA (V 3.90) 199# 0x9445366139FA (V 3.80) 200# this is from source (http://www.adrift.org.uk/) and I have some taf 201# files, and checked them. 202#0 belong 0x3C423FC9 203#>4 belong 0x6A87C2CF Adrift game file 204#!:mime application/x-adrift 205 206#------------------------------------------------------------------------------ 207# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $ 208# allegro: file(1) magic for Allegro datafiles 209# Toby Deshane <hac@shoelace.digivill.net> 210# 2110 belong 0x736C6821 Allegro datafile (packed) 2120 belong 0x736C682E Allegro datafile (not packed/autodetect) 2130 belong 0x736C682B Allegro datafile (appended exe data) 214 215#------------------------------------------------------------------------------ 216# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $ 217# alliant: file(1) magic for Alliant FX series a.out files 218# 219# If the FX series is the one that had a processor with a 68K-derived 220# instruction set, the "short" should probably become "beshort" and the 221# "long" should probably become "belong". 222# If it's the i860-based one, they should probably become either the 223# big-endian or little-endian versions, depending on the mode they ran 224# the 860 in.... 225# 2260 short 0420 0420 Alliant virtual executable 227>2 short &0x0020 common library 228>16 long >0 not stripped 2290 short 0421 0421 Alliant compact executable 230>2 short &0x0020 common library 231>16 long >0 not stripped 232 233#------------------------------------------------------------------------------ 234# $File: amanda,v 1.5 2009/09/19 16:28:07 christos Exp $ 235# amanda: file(1) magic for amanda file format 236# 2370 string AMANDA:\ AMANDA 238>8 string TAPESTART\ DATE tape header file, 239>>23 string X 240>>>25 string >\ Unused %s 241>>23 string >\ DATE %s 242>8 string FILE\ dump file, 243>>13 string >\ DATE %s 244 245#------------------------------------------------------------------------------ 246# $File: amigaos,v 1.15 2012/06/21 01:13:59 christos Exp $ 247# amigaos: file(1) magic for AmigaOS binary formats: 248 249# 250# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis) 251# 2520 belong 0x000003fa AmigaOS shared library 2530 belong 0x000003f3 AmigaOS loadseg()ble executable/binary 2540 belong 0x000003e7 AmigaOS object/library data 255# 2560 beshort 0xe310 Amiga Workbench 257>2 beshort 1 258>>48 byte 1 disk icon 259>>48 byte 2 drawer icon 260>>48 byte 3 tool icon 261>>48 byte 4 project icon 262>>48 byte 5 garbage icon 263>>48 byte 6 device icon 264>>48 byte 7 kickstart icon 265>>48 byte 8 workbench application icon 266>2 beshort >1 icon, vers. %d 267# 268# various sound formats from the Amiga 269# G=F6tz Waschk <waschk@informatik.uni-rostock.de> 270# 2710 string FC14 Future Composer 1.4 Module sound file 2720 string SMOD Future Composer 1.3 Module sound file 2730 string AON4artofnoise Art Of Noise Module sound file 2741 string MUGICIAN/SOFTEYES Mugician Module sound file 27558 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file 2760 string Synth4.0 Synthesis Module sound file 2770 string ARP. The Holy Noise Module sound file 2780 string BeEp\0 JamCracker Module sound file 2790 string COSO\0 Hippel-COSO Module sound file 280# Too simple (short, pure ASCII, deep), MPi 281#26 string V.3 Brian Postma's Soundmon Module sound file v3 282#26 string BPSM Brian Postma's Soundmon Module sound file v3 283#26 string V.2 Brian Postma's Soundmon Module sound file v2 284 285# The following are from: "Stefan A. Haubenthal" <polluks@web.de> 2860 beshort 0x0f00 AmigaOS bitmap font 2870 beshort 0x0f03 AmigaOS outline font 2880 belong 0x80001001 AmigaOS outline tag 2890 string ##\ version catalog translation 2900 string EMOD\0 Amiga E module 2918 string ECXM\0 ECX module 2920 string/c @database AmigaGuide file 293 294# Amiga disk types 295# 2960 string RDSK Rigid Disk Block 297>160 string x on %.24s 2980 string DOS\0 Amiga DOS disk 2990 string DOS\1 Amiga FFS disk 3000 string DOS\2 Amiga Inter DOS disk 3010 string DOS\3 Amiga Inter FFS disk 3020 string DOS\4 Amiga Fastdir DOS disk 3030 string DOS\5 Amiga Fastdir FFS disk 3040 string KICK Kickstart disk 305 306# From: Alex Beregszaszi <alex@fsn.hu> 3070 string LZX LZX compressed archive (Amiga) 308 309# From: Przemek Kramarczyk <pkramarczyk@gmail.com> 3100 string .KEY AmigaDOS script 3110 string .key AmigaDOS script 312 313#------------------------------------------------------------------------------ 314# $File: animation,v 1.48 2013/03/09 22:36:00 christos Exp $ 315# animation: file(1) magic for animation/movie formats 316# 317# animation formats 318# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) 319# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) 320 321# SGI and Apple formats 3220 string MOVI Silicon Graphics movie file 323!:mime video/x-sgi-movie 3244 string moov Apple QuickTime 325!:mime video/quicktime 326>12 string mvhd \b movie (fast start) 327>12 string mdra \b URL 328>12 string cmov \b movie (fast start, compressed header) 329>12 string rmra \b multiple URLs 3304 string mdat Apple QuickTime movie (unoptimized) 331!:mime video/quicktime 332#4 string wide Apple QuickTime movie (unoptimized) 333#!:mime video/quicktime 334#4 string skip Apple QuickTime movie (modified) 335#!:mime video/quicktime 336#4 string free Apple QuickTime movie (modified) 337#!:mime video/quicktime 3384 string idsc Apple QuickTime image (fast start) 339!:mime image/x-quicktime 340#4 string idat Apple QuickTime image (unoptimized) 341#!:mime image/x-quicktime 3424 string pckg Apple QuickTime compressed archive 343!:mime application/x-quicktime-player 3444 string/W jP JPEG 2000 image 345!:mime image/jp2 3464 string ftyp ISO Media 347>8 string isom \b, MPEG v4 system, version 1 348!:mime video/mp4 349>8 string iso2 \b, MPEG v4 system, part 12 revision 350>8 string mp41 \b, MPEG v4 system, version 1 351!:mime video/mp4 352>8 string mp42 \b, MPEG v4 system, version 2 353!:mime video/mp4 354>8 string mp7t \b, MPEG v4 system, MPEG v7 XML 355>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML 356>8 string/W jp2 \b, JPEG 2000 357!:mime image/jp2 358>8 string 3ge \b, MPEG v4 system, 3GPP 359!:mime video/3gpp 360>8 string 3gg \b, MPEG v4 system, 3GPP 361!:mime video/3gpp 362>8 string 3gp \b, MPEG v4 system, 3GPP 363!:mime video/3gpp 364>8 string 3gs \b, MPEG v4 system, 3GPP 365!:mime video/3gpp 366>8 string 3g2 \b, MPEG v4 system, 3GPP2 367!:mime video/3gpp2 368>>11 byte 4 \b v4 (H.263/AMR GSM 6.10) 369>>11 byte 5 \b v5 (H.263/AMR GSM 6.10) 370>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10) 371>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile 372!:mime video/mp4 373>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC 374!:mime video/3gpp 375>8 string/W M4A \b, MPEG v4 system, iTunes AAC-LC 376!:mime audio/mp4 377>8 string/W M4V \b, MPEG v4 system, iTunes AVC-LC 378!:mime video/mp4 379>8 string/W M4P \b, MPEG v4 system, iTunes AES encrypted 380>8 string/W M4B \b, MPEG v4 system, iTunes bookmarked 381>8 string/W qt \b, Apple QuickTime movie 382!:mime video/quicktime 383 384# MPEG sequences 385# Scans for all common MPEG header start codes 3860 belong 0x00000001 387>4 byte&0x1F 0x07 JVT NAL sequence, H.264 video 388>>5 byte 66 \b, baseline 389>>5 byte 77 \b, main 390>>5 byte 88 \b, extended 391>>7 byte x \b @ L %u 3920 belong&0xFFFFFF00 0x00000100 393>3 byte 0xBA MPEG sequence 394!:mime video/mpeg 395>>4 byte &0x40 \b, v2, program multiplex 396>>4 byte ^0x40 \b, v1, system multiplex 397>3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header) 398>3 byte&0x1F 0x07 MPEG sequence, H.264 video 399>>4 byte 66 \b, baseline 400>>4 byte 77 \b, main 401>>4 byte 88 \b, extended 402>>6 byte x \b @ L %u 403# GRR too general as it catches also FoxPro Memo example NG.FPT 404>3 byte 0xB0 MPEG sequence, v4 405# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000 406#>>4 byte !0 MPEG sequence, v4 407!:mime video/mpeg4-generic 408>>5 belong 0x000001B5 409>>>9 byte &0x80 410>>>>10 byte&0xF0 16 \b, video 411>>>>10 byte&0xF0 32 \b, still texture 412>>>>10 byte&0xF0 48 \b, mesh 413>>>>10 byte&0xF0 64 \b, face 414>>>9 byte&0xF8 8 \b, video 415>>>9 byte&0xF8 16 \b, still texture 416>>>9 byte&0xF8 24 \b, mesh 417>>>9 byte&0xF8 32 \b, face 418>>4 byte 1 \b, simple @ L1 419>>4 byte 2 \b, simple @ L2 420>>4 byte 3 \b, simple @ L3 421>>4 byte 4 \b, simple @ L0 422>>4 byte 17 \b, simple scalable @ L1 423>>4 byte 18 \b, simple scalable @ L2 424>>4 byte 33 \b, core @ L1 425>>4 byte 34 \b, core @ L2 426>>4 byte 50 \b, main @ L2 427>>4 byte 51 \b, main @ L3 428>>4 byte 53 \b, main @ L4 429>>4 byte 66 \b, n-bit @ L2 430>>4 byte 81 \b, scalable texture @ L1 431>>4 byte 97 \b, simple face animation @ L1 432>>4 byte 98 \b, simple face animation @ L2 433>>4 byte 99 \b, simple face basic animation @ L1 434>>4 byte 100 \b, simple face basic animation @ L2 435>>4 byte 113 \b, basic animation text @ L1 436>>4 byte 114 \b, basic animation text @ L2 437>>4 byte 129 \b, hybrid @ L1 438>>4 byte 130 \b, hybrid @ L2 439>>4 byte 145 \b, advanced RT simple @ L! 440>>4 byte 146 \b, advanced RT simple @ L2 441>>4 byte 147 \b, advanced RT simple @ L3 442>>4 byte 148 \b, advanced RT simple @ L4 443>>4 byte 161 \b, core scalable @ L1 444>>4 byte 162 \b, core scalable @ L2 445>>4 byte 163 \b, core scalable @ L3 446>>4 byte 177 \b, advanced coding efficiency @ L1 447>>4 byte 178 \b, advanced coding efficiency @ L2 448>>4 byte 179 \b, advanced coding efficiency @ L3 449>>4 byte 180 \b, advanced coding efficiency @ L4 450>>4 byte 193 \b, advanced core @ L1 451>>4 byte 194 \b, advanced core @ L2 452>>4 byte 209 \b, advanced scalable texture @ L1 453>>4 byte 210 \b, advanced scalable texture @ L2 454>>4 byte 211 \b, advanced scalable texture @ L3 455>>4 byte 225 \b, simple studio @ L1 456>>4 byte 226 \b, simple studio @ L2 457>>4 byte 227 \b, simple studio @ L3 458>>4 byte 228 \b, simple studio @ L4 459>>4 byte 229 \b, core studio @ L1 460>>4 byte 230 \b, core studio @ L2 461>>4 byte 231 \b, core studio @ L3 462>>4 byte 232 \b, core studio @ L4 463>>4 byte 240 \b, advanced simple @ L0 464>>4 byte 241 \b, advanced simple @ L1 465>>4 byte 242 \b, advanced simple @ L2 466>>4 byte 243 \b, advanced simple @ L3 467>>4 byte 244 \b, advanced simple @ L4 468>>4 byte 245 \b, advanced simple @ L5 469>>4 byte 247 \b, advanced simple @ L3b 470>>4 byte 248 \b, FGS @ L0 471>>4 byte 249 \b, FGS @ L1 472>>4 byte 250 \b, FGS @ L2 473>>4 byte 251 \b, FGS @ L3 474>>4 byte 252 \b, FGS @ L4 475>>4 byte 253 \b, FGS @ L5 476>3 byte 0xB5 MPEG sequence, v4 477!:mime video/mpeg4-generic 478>>4 byte &0x80 479>>>5 byte&0xF0 16 \b, video (missing profile header) 480>>>5 byte&0xF0 32 \b, still texture (missing profile header) 481>>>5 byte&0xF0 48 \b, mesh (missing profile header) 482>>>5 byte&0xF0 64 \b, face (missing profile header) 483>>4 byte&0xF8 8 \b, video (missing profile header) 484>>4 byte&0xF8 16 \b, still texture (missing profile header) 485>>4 byte&0xF8 24 \b, mesh (missing profile header) 486>>4 byte&0xF8 32 \b, face (missing profile header) 487>3 byte 0xB3 MPEG sequence 488!:mime video/mpeg 489>>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 490>>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 491>>12 belong 0x000001B5 \b, v2, 492>>>16 byte&0x0F 1 \b HP 493>>>16 byte&0x0F 2 \b Spt 494>>>16 byte&0x0F 3 \b SNR 495>>>16 byte&0x0F 4 \b MP 496>>>16 byte&0x0F 5 \b SP 497>>>17 byte&0xF0 64 \b@HL 498>>>17 byte&0xF0 96 \b@H-14 499>>>17 byte&0xF0 128 \b@ML 500>>>17 byte&0xF0 160 \b@LL 501>>>17 byte &0x08 \b progressive 502>>>17 byte ^0x08 \b interlaced 503>>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video 504>>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video 505>>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video 506>>11 byte &0x02 507>>>75 byte &0x01 508>>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 509>>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 510>>>>140 belong 0x000001B5 \b, v2, 511>>>>>144 byte&0x0F 1 \b HP 512>>>>>144 byte&0x0F 2 \b Spt 513>>>>>144 byte&0x0F 3 \b SNR 514>>>>>144 byte&0x0F 4 \b MP 515>>>>>144 byte&0x0F 5 \b SP 516>>>>>145 byte&0xF0 64 \b@HL 517>>>>>145 byte&0xF0 96 \b@H-14 518>>>>>145 byte&0xF0 128 \b@ML 519>>>>>145 byte&0xF0 160 \b@LL 520>>>>>145 byte &0x08 \b progressive 521>>>>>145 byte ^0x08 \b interlaced 522>>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video 523>>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video 524>>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video 525>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 526>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 527>>76 belong 0x000001B5 \b, v2, 528>>>80 byte&0x0F 1 \b HP 529>>>80 byte&0x0F 2 \b Spt 530>>>80 byte&0x0F 3 \b SNR 531>>>80 byte&0x0F 4 \b MP 532>>>80 byte&0x0F 5 \b SP 533>>>81 byte&0xF0 64 \b@HL 534>>>81 byte&0xF0 96 \b@H-14 535>>>81 byte&0xF0 128 \b@ML 536>>>81 byte&0xF0 160 \b@LL 537>>>81 byte &0x08 \b progressive 538>>>81 byte ^0x08 \b interlaced 539>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video 540>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video 541>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video 542>>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P 543>>>7 byte&0xF0 0x10 \b, 16:9 544>>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I 545>>>7 byte&0xF0 0x10 \b, 16:9 546>>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture 547>>>7 byte&0xF0 0x10 \b, 4:3 548>>4 beshort&0xFFF0 0x2C00 \b, 4CIF 549>>>5 beshort&0x0FFF 0x01E0 \b NTSC 550>>>5 beshort&0x0FFF 0x0240 \b PAL 551>>>7 byte&0xF0 0x20 \b, 4:3 552>>>7 byte&0xF0 0x30 \b, 16:9 553>>>7 byte&0xF0 0x40 \b, 11:5 554>>>7 byte&0xF0 0x80 \b, PAL 4:3 555>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 556>>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P 557>>>7 byte&0xF0 0x10 \b, 4:3 558>>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240 559>>>7 byte&0xF0 0x10 \b, 4:3 560>>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160 561>>>7 byte&0xF0 0x10 \b, 4:3 562>>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120 563>>>7 byte&0xF0 0x10 \b, 4:3 564>>4 beshort&0xFFF0 0x1600 \b, CIF 565>>>5 beshort&0x0FFF 0x00F0 \b NTSC 566>>>5 beshort&0x0FFF 0x0120 \b PAL 567>>>7 byte&0xF0 0x20 \b, 4:3 568>>>7 byte&0xF0 0x30 \b, 16:9 569>>>7 byte&0xF0 0x40 \b, 11:5 570>>>7 byte&0xF0 0x80 \b, PAL 4:3 571>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 572>>>5 beshort&0x0FFF 0x0240 \b PAL 625 573>>>>7 byte&0xF0 0x20 \b, 4:3 574>>>>7 byte&0xF0 0x30 \b, 16:9 575>>>>7 byte&0xF0 0x40 \b, 11:5 576>>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU 577>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 578>>>5 beshort&0x0FFF 0x0240 \b PAL 625 579>>>7 byte&0xF0 0x20 \b, 4:3 580>>>7 byte&0xF0 0x30 \b, 16:9 581>>>7 byte&0xF0 0x40 \b, 11:5 582>>4 beshort&0xFFF0 0x1E00 \b, SVCD 583>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 584>>>5 beshort&0x0FFF 0x0240 \b PAL 625 585>>>7 byte&0xF0 0x20 \b, 4:3 586>>>7 byte&0xF0 0x30 \b, 16:9 587>>>7 byte&0xF0 0x40 \b, 11:5 588>>7 byte&0x0F 1 \b, 23.976 fps 589>>7 byte&0x0F 2 \b, 24 fps 590>>7 byte&0x0F 3 \b, 25 fps 591>>7 byte&0x0F 4 \b, 29.97 fps 592>>7 byte&0x0F 5 \b, 30 fps 593>>7 byte&0x0F 6 \b, 50 fps 594>>7 byte&0x0F 7 \b, 59.94 fps 595>>7 byte&0x0F 8 \b, 60 fps 596>>11 byte &0x04 \b, Constrained 597 598# MPEG ADTS Audio (*.mpx/mxa/aac) 599# from dreesen@math.fu-berlin.de 600# modified to fully support MPEG ADTS 601 602# MP3, M1A 603# modified by Joerg Jenderek 604# GRR the original test are too common for many DOS files 605# so don't accept as MP3 until we've tested the rate 6060 beshort&0xFFFE 0xFFFA 607# rates 608>2 byte&0xF0 0x10 MPEG ADTS, layer III, v1, 32 kbps 609!:mime audio/mpeg 610>2 byte&0xF0 0x20 MPEG ADTS, layer III, v1, 40 kbps 611!:mime audio/mpeg 612>2 byte&0xF0 0x30 MPEG ADTS, layer III, v1, 48 kbps 613!:mime audio/mpeg 614>2 byte&0xF0 0x40 MPEG ADTS, layer III, v1, 56 kbps 615!:mime audio/mpeg 616>2 byte&0xF0 0x50 MPEG ADTS, layer III, v1, 64 kbps 617!:mime audio/mpeg 618>2 byte&0xF0 0x60 MPEG ADTS, layer III, v1, 80 kbps 619!:mime audio/mpeg 620>2 byte&0xF0 0x70 MPEG ADTS, layer III, v1, 96 kbps 621!:mime audio/mpeg 622>2 byte&0xF0 0x80 MPEG ADTS, layer III, v1, 112 kbps 623!:mime audio/mpeg 624>2 byte&0xF0 0x90 MPEG ADTS, layer III, v1, 128 kbps 625!:mime audio/mpeg 626>2 byte&0xF0 0xA0 MPEG ADTS, layer III, v1, 160 kbps 627!:mime audio/mpeg 628>2 byte&0xF0 0xB0 MPEG ADTS, layer III, v1, 192 kbps 629!:mime audio/mpeg 630>2 byte&0xF0 0xC0 MPEG ADTS, layer III, v1, 224 kbps 631!:mime audio/mpeg 632>2 byte&0xF0 0xD0 MPEG ADTS, layer III, v1, 256 kbps 633!:mime audio/mpeg 634>2 byte&0xF0 0xE0 MPEG ADTS, layer III, v1, 320 kbps 635!:mime audio/mpeg 636# timing 637>2 byte&0x0C 0x00 \b, 44.1 kHz 638>2 byte&0x0C 0x04 \b, 48 kHz 639>2 byte&0x0C 0x08 \b, 32 kHz 640# channels/options 641>3 byte&0xC0 0x00 \b, Stereo 642>3 byte&0xC0 0x40 \b, JntStereo 643>3 byte&0xC0 0x80 \b, 2x Monaural 644>3 byte&0xC0 0xC0 \b, Monaural 645#>1 byte ^0x01 \b, Data Verify 646#>2 byte &0x02 \b, Packet Pad 647#>2 byte &0x01 \b, Custom Flag 648#>3 byte &0x08 \b, Copyrighted 649#>3 byte &0x04 \b, Original Source 650#>3 byte&0x03 1 \b, NR: 50/15 ms 651#>3 byte&0x03 3 \b, NR: CCIT J.17 652 653# MP2, M1A 6540 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 655!:mime audio/mpeg 656# rates 657>2 byte&0xF0 0x10 \b, 32 kbps 658>2 byte&0xF0 0x20 \b, 48 kbps 659>2 byte&0xF0 0x30 \b, 56 kbps 660>2 byte&0xF0 0x40 \b, 64 kbps 661>2 byte&0xF0 0x50 \b, 80 kbps 662>2 byte&0xF0 0x60 \b, 96 kbps 663>2 byte&0xF0 0x70 \b, 112 kbps 664>2 byte&0xF0 0x80 \b, 128 kbps 665>2 byte&0xF0 0x90 \b, 160 kbps 666>2 byte&0xF0 0xA0 \b, 192 kbps 667>2 byte&0xF0 0xB0 \b, 224 kbps 668>2 byte&0xF0 0xC0 \b, 256 kbps 669>2 byte&0xF0 0xD0 \b, 320 kbps 670>2 byte&0xF0 0xE0 \b, 384 kbps 671# timing 672>2 byte&0x0C 0x00 \b, 44.1 kHz 673>2 byte&0x0C 0x04 \b, 48 kHz 674>2 byte&0x0C 0x08 \b, 32 kHz 675# channels/options 676>3 byte&0xC0 0x00 \b, Stereo 677>3 byte&0xC0 0x40 \b, JntStereo 678>3 byte&0xC0 0x80 \b, 2x Monaural 679>3 byte&0xC0 0xC0 \b, Monaural 680#>1 byte ^0x01 \b, Data Verify 681#>2 byte &0x02 \b, Packet Pad 682#>2 byte &0x01 \b, Custom Flag 683#>3 byte &0x08 \b, Copyrighted 684#>3 byte &0x04 \b, Original Source 685#>3 byte&0x03 1 \b, NR: 50/15 ms 686#>3 byte&0x03 3 \b, NR: CCIT J.17 687 688# MPA, M1A 689# updated by Joerg Jenderek 690# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448 691# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE) 692# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries 693#0 beshort&0xFFFE 0xFFFE 694#>2 ubyte&0xF0 >0x0F 695#>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1 696## rate 697#>>>2 byte&0xF0 0x10 \b, 32 kbps 698#>>>2 byte&0xF0 0x20 \b, 64 kbps 699#>>>2 byte&0xF0 0x30 \b, 96 kbps 700#>>>2 byte&0xF0 0x40 \b, 128 kbps 701#>>>2 byte&0xF0 0x50 \b, 160 kbps 702#>>>2 byte&0xF0 0x60 \b, 192 kbps 703#>>>2 byte&0xF0 0x70 \b, 224 kbps 704#>>>2 byte&0xF0 0x80 \b, 256 kbps 705#>>>2 byte&0xF0 0x90 \b, 288 kbps 706#>>>2 byte&0xF0 0xA0 \b, 320 kbps 707#>>>2 byte&0xF0 0xB0 \b, 352 kbps 708#>>>2 byte&0xF0 0xC0 \b, 384 kbps 709#>>>2 byte&0xF0 0xD0 \b, 416 kbps 710#>>>2 byte&0xF0 0xE0 \b, 448 kbps 711## timing 712#>>>2 byte&0x0C 0x00 \b, 44.1 kHz 713#>>>2 byte&0x0C 0x04 \b, 48 kHz 714#>>>2 byte&0x0C 0x08 \b, 32 kHz 715## channels/options 716#>>>3 byte&0xC0 0x00 \b, Stereo 717#>>>3 byte&0xC0 0x40 \b, JntStereo 718#>>>3 byte&0xC0 0x80 \b, 2x Monaural 719#>>>3 byte&0xC0 0xC0 \b, Monaural 720##>1 byte ^0x01 \b, Data Verify 721##>2 byte &0x02 \b, Packet Pad 722##>2 byte &0x01 \b, Custom Flag 723##>3 byte &0x08 \b, Copyrighted 724##>3 byte &0x04 \b, Original Source 725##>3 byte&0x03 1 \b, NR: 50/15 ms 726##>3 byte&0x03 3 \b, NR: CCIT J.17 727 728# MP3, M2A 7290 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2 730!:mime audio/mpeg 731# rate 732>2 byte&0xF0 0x10 \b, 8 kbps 733>2 byte&0xF0 0x20 \b, 16 kbps 734>2 byte&0xF0 0x30 \b, 24 kbps 735>2 byte&0xF0 0x40 \b, 32 kbps 736>2 byte&0xF0 0x50 \b, 40 kbps 737>2 byte&0xF0 0x60 \b, 48 kbps 738>2 byte&0xF0 0x70 \b, 56 kbps 739>2 byte&0xF0 0x80 \b, 64 kbps 740>2 byte&0xF0 0x90 \b, 80 kbps 741>2 byte&0xF0 0xA0 \b, 96 kbps 742>2 byte&0xF0 0xB0 \b, 112 kbps 743>2 byte&0xF0 0xC0 \b, 128 kbps 744>2 byte&0xF0 0xD0 \b, 144 kbps 745>2 byte&0xF0 0xE0 \b, 160 kbps 746# timing 747>2 byte&0x0C 0x00 \b, 22.05 kHz 748>2 byte&0x0C 0x04 \b, 24 kHz 749>2 byte&0x0C 0x08 \b, 16 kHz 750# channels/options 751>3 byte&0xC0 0x00 \b, Stereo 752>3 byte&0xC0 0x40 \b, JntStereo 753>3 byte&0xC0 0x80 \b, 2x Monaural 754>3 byte&0xC0 0xC0 \b, Monaural 755#>1 byte ^0x01 \b, Data Verify 756#>2 byte &0x02 \b, Packet Pad 757#>2 byte &0x01 \b, Custom Flag 758#>3 byte &0x08 \b, Copyrighted 759#>3 byte &0x04 \b, Original Source 760#>3 byte&0x03 1 \b, NR: 50/15 ms 761#>3 byte&0x03 3 \b, NR: CCIT J.17 762 763# MP2, M2A 7640 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2 765# rate 766>2 byte&0xF0 0x10 \b, 8 kbps 767>2 byte&0xF0 0x20 \b, 16 kbps 768>2 byte&0xF0 0x30 \b, 24 kbps 769>2 byte&0xF0 0x40 \b, 32 kbps 770>2 byte&0xF0 0x50 \b, 40 kbps 771>2 byte&0xF0 0x60 \b, 48 kbps 772>2 byte&0xF0 0x70 \b, 56 kbps 773>2 byte&0xF0 0x80 \b, 64 kbps 774>2 byte&0xF0 0x90 \b, 80 kbps 775>2 byte&0xF0 0xA0 \b, 96 kbps 776>2 byte&0xF0 0xB0 \b, 112 kbps 777>2 byte&0xF0 0xC0 \b, 128 kbps 778>2 byte&0xF0 0xD0 \b, 144 kbps 779>2 byte&0xF0 0xE0 \b, 160 kbps 780# timing 781>2 byte&0x0C 0x00 \b, 22.05 kHz 782>2 byte&0x0C 0x04 \b, 24 kHz 783>2 byte&0x0C 0x08 \b, 16 kHz 784# channels/options 785>3 byte&0xC0 0x00 \b, Stereo 786>3 byte&0xC0 0x40 \b, JntStereo 787>3 byte&0xC0 0x80 \b, 2x Monaural 788>3 byte&0xC0 0xC0 \b, Monaural 789#>1 byte ^0x01 \b, Data Verify 790#>2 byte &0x02 \b, Packet Pad 791#>2 byte &0x01 \b, Custom Flag 792#>3 byte &0x08 \b, Copyrighted 793#>3 byte &0x04 \b, Original Source 794#>3 byte&0x03 1 \b, NR: 50/15 ms 795#>3 byte&0x03 3 \b, NR: CCIT J.17 796 797# MPA, M2A 7980 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2 799!:mime audio/mpeg 800# rate 801>2 byte&0xF0 0x10 \b, 32 kbps 802>2 byte&0xF0 0x20 \b, 48 kbps 803>2 byte&0xF0 0x30 \b, 56 kbps 804>2 byte&0xF0 0x40 \b, 64 kbps 805>2 byte&0xF0 0x50 \b, 80 kbps 806>2 byte&0xF0 0x60 \b, 96 kbps 807>2 byte&0xF0 0x70 \b, 112 kbps 808>2 byte&0xF0 0x80 \b, 128 kbps 809>2 byte&0xF0 0x90 \b, 144 kbps 810>2 byte&0xF0 0xA0 \b, 160 kbps 811>2 byte&0xF0 0xB0 \b, 176 kbps 812>2 byte&0xF0 0xC0 \b, 192 kbps 813>2 byte&0xF0 0xD0 \b, 224 kbps 814>2 byte&0xF0 0xE0 \b, 256 kbps 815# timing 816>2 byte&0x0C 0x00 \b, 22.05 kHz 817>2 byte&0x0C 0x04 \b, 24 kHz 818>2 byte&0x0C 0x08 \b, 16 kHz 819# channels/options 820>3 byte&0xC0 0x00 \b, Stereo 821>3 byte&0xC0 0x40 \b, JntStereo 822>3 byte&0xC0 0x80 \b, 2x Monaural 823>3 byte&0xC0 0xC0 \b, Monaural 824#>1 byte ^0x01 \b, Data Verify 825#>2 byte &0x02 \b, Packet Pad 826#>2 byte &0x01 \b, Custom Flag 827#>3 byte &0x08 \b, Copyrighted 828#>3 byte &0x04 \b, Original Source 829#>3 byte&0x03 1 \b, NR: 50/15 ms 830#>3 byte&0x03 3 \b, NR: CCIT J.17 831 832# MP3, M25A 8330 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5 834!:mime audio/mpeg 835# rate 836>2 byte&0xF0 0x10 \b, 8 kbps 837>2 byte&0xF0 0x20 \b, 16 kbps 838>2 byte&0xF0 0x30 \b, 24 kbps 839>2 byte&0xF0 0x40 \b, 32 kbps 840>2 byte&0xF0 0x50 \b, 40 kbps 841>2 byte&0xF0 0x60 \b, 48 kbps 842>2 byte&0xF0 0x70 \b, 56 kbps 843>2 byte&0xF0 0x80 \b, 64 kbps 844>2 byte&0xF0 0x90 \b, 80 kbps 845>2 byte&0xF0 0xA0 \b, 96 kbps 846>2 byte&0xF0 0xB0 \b, 112 kbps 847>2 byte&0xF0 0xC0 \b, 128 kbps 848>2 byte&0xF0 0xD0 \b, 144 kbps 849>2 byte&0xF0 0xE0 \b, 160 kbps 850# timing 851>2 byte&0x0C 0x00 \b, 11.025 kHz 852>2 byte&0x0C 0x04 \b, 12 kHz 853>2 byte&0x0C 0x08 \b, 8 kHz 854# channels/options 855>3 byte&0xC0 0x00 \b, Stereo 856>3 byte&0xC0 0x40 \b, JntStereo 857>3 byte&0xC0 0x80 \b, 2x Monaural 858>3 byte&0xC0 0xC0 \b, Monaural 859#>1 byte ^0x01 \b, Data Verify 860#>2 byte &0x02 \b, Packet Pad 861#>2 byte &0x01 \b, Custom Flag 862#>3 byte &0x08 \b, Copyrighted 863#>3 byte &0x04 \b, Original Source 864#>3 byte&0x03 1 \b, NR: 50/15 ms 865#>3 byte&0x03 3 \b, NR: CCIT J.17 866 867# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio 868 869# Stored AAC streams (instead of the MP4 format) 8700 string ADIF MPEG ADIF, AAC 871!:mime audio/x-hx-aac-adif 872>4 byte &0x80 873>>13 byte &0x10 \b, VBR 874>>13 byte ^0x10 \b, CBR 875>>16 byte&0x1E 0x02 \b, single stream 876>>16 byte&0x1E 0x04 \b, 2 streams 877>>16 byte&0x1E 0x06 \b, 3 streams 878>>16 byte &0x08 \b, 4 or more streams 879>>16 byte &0x10 \b, 8 or more streams 880>>4 byte &0x80 \b, Copyrighted 881>>13 byte &0x40 \b, Original Source 882>>13 byte &0x20 \b, Home Flag 883>4 byte ^0x80 884>>4 byte &0x10 \b, VBR 885>>4 byte ^0x10 \b, CBR 886>>7 byte&0x1E 0x02 \b, single stream 887>>7 byte&0x1E 0x04 \b, 2 streams 888>>7 byte&0x1E 0x06 \b, 3 streams 889>>7 byte &0x08 \b, 4 or more streams 890>>7 byte &0x10 \b, 8 or more streams 891>>4 byte &0x40 \b, Original Stream(s) 892>>4 byte &0x20 \b, Home Source 893 894# Live or stored single AAC stream (used with MPEG-2 systems) 8950 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC 896!:mime audio/x-hx-aac-adts 897>1 byte &0x08 \b, v2 898>1 byte ^0x08 \b, v4 899# profile 900>>2 byte &0xC0 \b LTP 901>2 byte&0xc0 0x00 \b Main 902>2 byte&0xc0 0x40 \b LC 903>2 byte&0xc0 0x80 \b SSR 904# timing 905>2 byte&0x3c 0x00 \b, 96 kHz 906>2 byte&0x3c 0x04 \b, 88.2 kHz 907>2 byte&0x3c 0x08 \b, 64 kHz 908>2 byte&0x3c 0x0c \b, 48 kHz 909>2 byte&0x3c 0x10 \b, 44.1 kHz 910>2 byte&0x3c 0x14 \b, 32 kHz 911>2 byte&0x3c 0x18 \b, 24 kHz 912>2 byte&0x3c 0x1c \b, 22.05 kHz 913>2 byte&0x3c 0x20 \b, 16 kHz 914>2 byte&0x3c 0x24 \b, 12 kHz 915>2 byte&0x3c 0x28 \b, 11.025 kHz 916>2 byte&0x3c 0x2c \b, 8 kHz 917# channels 918>2 beshort&0x01c0 0x0040 \b, monaural 919>2 beshort&0x01c0 0x0080 \b, stereo 920>2 beshort&0x01c0 0x00c0 \b, stereo + center 921>2 beshort&0x01c0 0x0100 \b, stereo+center+LFE 922>2 beshort&0x01c0 0x0140 \b, surround 923>2 beshort&0x01c0 0x0180 \b, surround + LFE 924>2 beshort &0x01C0 \b, surround + side 925#>1 byte ^0x01 \b, Data Verify 926#>2 byte &0x02 \b, Custom Flag 927#>3 byte &0x20 \b, Original Stream 928#>3 byte &0x10 \b, Home Source 929#>3 byte &0x08 \b, Copyrighted 930 931# Live MPEG-4 audio streams (instead of RTP FlexMux) 9320 beshort&0xFFE0 0x56E0 MPEG-4 LOAS 933!:mime audio/x-mp4a-latm 934#>1 beshort&0x1FFF x \b, %u byte packet 935>3 byte&0xE0 0x40 936>>4 byte&0x3C 0x04 \b, single stream 937>>4 byte&0x3C 0x08 \b, 2 streams 938>>4 byte&0x3C 0x0C \b, 3 streams 939>>4 byte &0x08 \b, 4 or more streams 940>>4 byte &0x20 \b, 8 or more streams 941>3 byte&0xC0 0 942>>4 byte&0x78 0x08 \b, single stream 943>>4 byte&0x78 0x10 \b, 2 streams 944>>4 byte&0x78 0x18 \b, 3 streams 945>>4 byte &0x20 \b, 4 or more streams 946>>4 byte &0x40 \b, 8 or more streams 947# This magic isn't strong enough (matches plausible ISO-8859-1 text) 948#0 beshort 0x4DE1 MPEG-4 LO-EP audio stream 949#!:mime audio/x-mp4a-latm 950 951# Summary: FLI animation format 952# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 953# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 9544 leshort 0xAF11 955# standard FLI always has 320x200 resolution and 8 bit color 956>8 leshort 320 957>>10 leshort 200 958>>>12 leshort 8 FLI animation, 320x200x8 959!:mime video/x-fli 960>>>>6 leshort x \b, %d frames 961# frame speed is multiple of 1/70s 962>>>>16 leshort x \b, %d/70s per frame 963 964# Summary: FLC animation format 965# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 966# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 9674 leshort 0xAF12 968# standard FLC always use 8 bit color 969>12 leshort 8 FLC animation 970!:mime video/x-flc 971>>8 leshort x \b, %d 972>>10 leshort x \bx%dx8 973>>6 uleshort x \b, %d frames 974>>16 uleshort x \b, %dms per frame 975 976# DL animation format 977# XXX - collision with most `mips' magic 978# 979# I couldn't find a real magic number for these, however, this 980# -appears- to work. Note that it might catch other files, too, so be 981# careful! 982# 983# Note that title and author appear in the two 20-byte chunks 984# at decimal offsets 2 and 22, respectively, but they are XOR'ed with 985# 255 (hex FF)! The DL format is really bad. 986# 987#0 byte 1 DL version 1, medium format (160x100, 4 images/screen) 988#!:mime video/x-unknown 989#>42 byte x - %d screens, 990#>43 byte x %d commands 991#0 byte 2 DL version 2 992#!:mime video/x-unknown 993#>1 byte 1 - large format (320x200,1 image/screen), 994#>1 byte 2 - medium format (160x100,4 images/screen), 995#>1 byte >2 - unknown format, 996#>42 byte x %d screens, 997#>43 byte x %d commands 998# Based on empirical evidence, DL version 3 have several nulls following the 999# \003. Most of them start with non-null values at hex offset 0x34 or so. 1000#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3 1001 1002# iso 13818 transport stream 1003# 1004# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1) 1005# syncbyte 8 bit 0x47 1006# error_ind 1 bit - 1007# payload_start 1 bit 1 1008# priority 1 bit - 1009# PID 13 bit 0x0000 1010# scrambling 2 bit - 1011# adaptfld_ctrl 2 bit 1 or 3 1012# conti_count 4 bit - 10130 belong&0xFF5FFF10 0x47400010 1014>188 byte 0x47 MPEG transport stream data 1015 1016# DIF digital video file format <mpruett@sgi.com> 10170 belong&0xffffff00 0x1f070000 DIF 1018>4 byte &0x01 (DVCPRO) movie file 1019>4 byte ^0x01 (DV) movie file 1020>3 byte &0x80 (PAL) 1021>3 byte ^0x80 (NTSC) 1022 1023# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com> 10240 belong 0x3026b275 Microsoft ASF 1025!:mime video/x-ms-asf 1026 1027# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 10280 string \x8aMNG MNG video data, 1029!:mime video/x-mng 1030>4 belong !0x0d0a1a0a CORRUPTED, 1031>4 belong 0x0d0a1a0a 1032>>16 belong x %ld x 1033>>20 belong x %ld 1034 1035# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 10360 string \x8bJNG JNG video data, 1037!:mime video/x-jng 1038>4 belong !0x0d0a1a0a CORRUPTED, 1039>4 belong 0x0d0a1a0a 1040>>16 belong x %ld x 1041>>20 belong x %ld 1042 1043# Vivo video (Wolfram Kleff) 10443 string \x0D\x0AVersion:Vivo Vivo video data 1045 1046# VRML (Virtual Reality Modelling Language) 10470 string/w #VRML\ V1.0\ ascii VRML 1 file 1048!:mime model/vrml 10490 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file 1050!:mime model/vrml 1051 1052# X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd] 1053# From Michel Briand <michelbriand@free.fr> 10540 string/t \<?xml\ version=" 1055!:strength +1 1056>20 search/1000/cw \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text 1057!:mime model/x3d 1058 1059#--------------------------------------------------------------------------- 1060# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube 1061# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03 1062# 10630 string HVQM4 %s 1064>6 string >\0 v%s 1065>0 byte x GameCube movie, 1066>0x34 ubeshort x %d x 1067>0x36 ubeshort x %d, 1068>0x26 ubeshort x %dus, 1069>0x42 ubeshort 0 no audio 1070>0x42 ubeshort >0 %dHz audio 1071 1072# From: "Stefan A. Haubenthal" <polluks@web.de> 10730 string DVDVIDEO-VTS Video title set, 1074>0x21 byte x v%x 10750 string DVDVIDEO-VMG Video manager, 1076>0x21 byte x v%x 1077 1078# From: Behan Webster <behanw@websterwood.com> 1079# NuppelVideo used by Mythtv (*.nuv) 1080# Note: there are two identical stanzas here differing only in the 1081# initial string matched. It used to be done with a regex, but we're 1082# trying to get rid of those. 10830 string NuppelVideo MythTV NuppelVideo 1084>12 string x v%s 1085>20 lelong x (%d 1086>24 lelong x \bx%d), 1087>36 string P \bprogressive, 1088>36 string I \binterlaced, 1089>40 ledouble x \baspect:%.2f, 1090>48 ledouble x \bfps:%.2f 10910 string MythTV MythTV NuppelVideo 1092>12 string x v%s 1093>20 lelong x (%d 1094>24 lelong x \bx%d), 1095>36 string P \bprogressive, 1096>36 string I \binterlaced, 1097>40 ledouble x \baspect:%.2f, 1098>48 ledouble x \bfps:%.2f 1099 1100# MPEG file 1101# MPEG sequences 1102# FIXME: This section is from the old magic.mime file and needs integrating with the rest 11030 belong 0x000001BA 1104>4 byte &0x40 1105!:mime video/mp2p 1106>4 byte ^0x40 1107!:mime video/mpeg 11080 belong 0x000001BB 1109!:mime video/mpeg 11100 belong 0x000001B0 1111!:mime video/mp4v-es 11120 belong 0x000001B5 1113!:mime video/mp4v-es 11140 belong 0x000001B3 1115!:mime video/mpv 11160 belong&0xFF5FFF1F 0x47400010 1117!:mime video/mp2t 11180 belong 0x00000001 1119>4 byte&0x1F 0x07 1120!:mime video/h264 1121 1122# Type: Bink Video 1123# Extension: .bik 1124# URL: http://wiki.multimedia.cx/index.php?title=Bink_Container 1125# From: <hoehle@users.sourceforge.net> 2008-07-18 11260 string BIK Bink Video 1127>3 regex =[a-z] rev.%s 1128#>4 ulelong x size %d 1129>20 ulelong x \b, %d 1130>24 ulelong x \bx%d 1131>8 ulelong x \b, %d frames 1132>32 ulelong x at rate %d/ 1133>28 ulelong >1 \b%d 1134>40 ulelong =0 \b, no audio 1135>40 ulelong !0 \b, %d audio track 1136>>40 ulelong !1 \bs 1137# follow properties of the first audio track only 1138>>48 uleshort x %dHz 1139>>51 byte&0x20 0 mono 1140>>51 byte&0x20 !0 stereo 1141#>>51 byte&0x10 0 FFT 1142#>>51 byte&0x10 !0 DCT 1143 1144# Type: NUT Container 1145# URL: http://wiki.multimedia.cx/index.php?title=NUT 1146# From: Adam Buchbinder <adam.buchbinder@gmail.com> 11470 string nut/multimedia\ container\0 NUT multimedia container 1148 1149# Type: Nullsoft Video (NSV) 1150# URL: http://wiki.multimedia.cx/index.php?title=Nullsoft_Video 1151# From: Mike Melanson <mike@multimedia.cx> 11520 string NSVf Nullsoft Video 1153 1154# Type: REDCode Video 1155# URL: http://www.red.com/ ; http://wiki.multimedia.cx/index.php?title=REDCode 1156# From: Mike Melanson <mike@multimedia.cx> 11574 string RED1 REDCode Video 1158 1159# Type: MTV Multimedia File 1160# URL: http://wiki.multimedia.cx/index.php?title=MTV 1161# From: Mike Melanson <mike@multimedia.cx> 11620 string AMVS MTV Multimedia File 1163 1164# Type: ARMovie 1165# URL: http://wiki.multimedia.cx/index.php?title=ARMovie 1166# From: Mike Melanson <mike@multimedia.cx> 11670 string ARMovie\012 ARMovie 1168 1169# Type: Interplay MVE Movie 1170# URL: http://wiki.multimedia.cx/index.php?title=Interplay_MVE 1171# From: Mike Melanson <mike@multimedia.cx> 11720 string Interplay\040MVE\040File\032 Interplay MVE Movie 1173 1174# Type: Windows Television DVR File 1175# URL: http://wiki.multimedia.cx/index.php?title=WTV 1176# From: Mike Melanson <mike@mutlimedia.cx> 1177# This takes the form of a Windows-style GUID 11780 bequad 0xB7D800203749DA11 1179>8 bequad 0xA64E0007E95EAD8D Windows Television DVR Media 1180 1181# Type: Sega FILM/CPK Multimedia 1182# URL: http://wiki.multimedia.cx/index.php?title=Sega_FILM 1183# From: Mike Melanson <mike@multimedia.cx> 11840 string FILM Sega FILM/CPK Multimedia, 1185>32 belong x %d x 1186>28 belong x %d 1187 1188# Type: Nintendo THP Multimedia 1189# URL: http://wiki.multimedia.cx/index.php?title=THP 1190# From: Mike Melanson <mike@multimedia.cx> 11910 string THP\0 Nintendo THP Multimedia 1192 1193# Type: BBC Dirac Video 1194# URL: http://wiki.multimedia.cx/index.php?title=Dirac 1195# From: Mike Melanson <mike@multimedia.cx> 11960 string BBCD BBC Dirac Video 1197 1198# Type: RAD Game Tools Smacker Multimedia 1199# URL: http://wiki.multimedia.cx/index.php?title=Smacker 1200# From: Mike Melanson <mike@multimedia.cx> 12010 string SMK RAD Game Tools Smacker Multimedia 1202>3 byte x version %c, 1203>4 lelong x %d x 1204>8 lelong x %d, 1205>12 lelong x %d frames 1206 1207#------------------------------------------------------------------------------ 1208# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $ 1209# aout: file(1) magic for a.out executable/object/etc entries that 1210# handle executables on multiple platforms. 1211# 1212 1213# 1214# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from 1215# BSDI), netbsd, and vax (for UNIX/32V and BSD) 1216# 1217# XXX - is there anything we can look at to distinguish BSD/OS 386 from 1218# NetBSD 386 from various VAX binaries? The BSD/OS shared library flag 1219# works only for binaries using shared libraries. Grabbing the entry 1220# point from the a.out header, using it to find the first code executed 1221# in the program, and looking at that might help. 1222# 12230 lelong 0407 a.out little-endian 32-bit executable 1224>16 lelong >0 not stripped 1225>32 byte 0x6a (uses BSD/OS shared libs) 1226 12270 lelong 0410 a.out little-endian 32-bit pure executable 1228>16 lelong >0 not stripped 1229>32 byte 0x6a (uses BSD/OS shared libs) 1230 12310 lelong 0413 a.out little-endian 32-bit demand paged pure executable 1232>16 lelong >0 not stripped 1233>32 byte 0x6a (uses BSD/OS shared libs) 1234 1235# 1236# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out), 1237# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out). 1238# 1239# XXX - is there anything we can look at to distinguish old SunOS 68010 1240# from old 68020 IRIX from old NetBSD? Again, I guess we could look at 1241# the first instruction or instructions in the program. 1242# 12430 belong 0407 a.out big-endian 32-bit executable 1244>16 belong >0 not stripped 1245 12460 belong 0410 a.out big-endian 32-bit pure executable 1247>16 belong >0 not stripped 1248 12490 belong 0413 a.out big-endian 32-bit demand paged executable 1250>16 belong >0 not stripped 1251 1252 1253#------------------------------------------------------------------------------ 1254# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $ 1255# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL 1256# workspaces) 1257# 12580 long 0100554 APL workspace (Ken's original?) 1259 1260#------------------------------------------------------------------------------ 1261# $File: apple,v 1.27 2013/03/09 22:36:00 christos Exp $ 1262# apple: file(1) magic for Apple file formats 1263# 12640 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text 12650 string \x0aGL Binary II (apple ][) data 12660 string \x76\xff Squeezed (apple ][) data 12670 string NuFile NuFile archive (apple ][) data 12680 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 12690 belong 0x00051600 AppleSingle encoded Macintosh file 12700 belong 0x00051607 AppleDouble encoded Macintosh file 1271 1272# Type: Apple Emulator 2IMG format 1273# From: Radek Vokal <rvokal@redhat.com> 12740 string 2IMG Apple ][ 2IMG Disk Image 1275>4 string XGS! \b, XGS 1276>4 string CTKG \b, Catakig 1277>4 string ShIm \b, Sheppy's ImageMaker 1278>4 string WOOF \b, Sweet 16 1279>4 string B2TR \b, Bernie ][ the Rescue 1280>4 string !nfc \b, ASIMOV2 1281>4 string x \b, Unknown Format 1282>0xc byte 00 \b, DOS 3.3 sector order 1283>>0x10 byte 00 \b, Volume 254 1284>>0x10 byte&0x7f x \b, Volume %u 1285>0xc byte 01 \b, ProDOS sector order 1286>>0x14 short x \b, %u Blocks 1287>0xc byte 02 \b, NIB data 1288 1289# magic for Newton PDA package formats 1290# from Ruda Moura <ruda@helllabs.org> 12910 string package0 Newton package, NOS 1.x, 1292>12 belong &0x80000000 AutoRemove, 1293>12 belong &0x40000000 CopyProtect, 1294>12 belong &0x10000000 NoCompression, 1295>12 belong &0x04000000 Relocation, 1296>12 belong &0x02000000 UseFasterCompression, 1297>16 belong x version %d 1298 12990 string package1 Newton package, NOS 2.x, 1300>12 belong &0x80000000 AutoRemove, 1301>12 belong &0x40000000 CopyProtect, 1302>12 belong &0x10000000 NoCompression, 1303>12 belong &0x04000000 Relocation, 1304>12 belong &0x02000000 UseFasterCompression, 1305>16 belong x version %d 1306 13070 string package4 Newton package, 1308>8 byte 8 NOS 1.x, 1309>8 byte 9 NOS 2.x, 1310>12 belong &0x80000000 AutoRemove, 1311>12 belong &0x40000000 CopyProtect, 1312>12 belong &0x10000000 NoCompression, 1313 1314# The following entries for the Apple II are for files that have 1315# been transferred as raw binary data from an Apple, without having 1316# been encapsulated by any of the above archivers. 1317# 1318# In general, Apple II formats are hard to identify because Apple DOS 1319# and especially Apple ProDOS have strong typing in the file system and 1320# therefore programmers never felt much need to include type information 1321# in the files themselves. 1322# 1323# Eric Fischer <enf@pobox.com> 1324 1325# AppleWorks word processor: 1326# 1327# This matches the standard tab stops for an AppleWorks file, but if 1328# a file has a tab stop set in the first four columns this will fail. 1329# 1330# The "O" is really the magic number, but that's so common that it's 1331# necessary to check the tab stops that follow it to avoid false positives. 1332 13334 string O==== AppleWorks word processor data 1334>85 byte&0x01 >0 \b, zoomed 1335>90 byte&0x01 >0 \b, paginated 1336>92 byte&0x01 >0 \b, with mail merge 1337#>91 byte x \b, left margin %d 1338 1339# AppleWorks database: 1340# 1341# This isn't really a magic number, but it's the closest thing to one 1342# that I could find. The 1 and 2 really mean "order in which you defined 1343# categories" and "left to right, top to bottom," respectively; the D and R 1344# mean that the cursor should move either down or right when you press Return. 1345 1346#30 string \x01D AppleWorks database data 1347#30 string \x02D AppleWorks database data 1348#30 string \x01R AppleWorks database data 1349#30 string \x02R AppleWorks database data 1350 1351# AppleWorks spreadsheet: 1352# 1353# Likewise, this isn't really meant as a magic number. The R or C means 1354# row- or column-order recalculation; the A or M means automatic or manual 1355# recalculation. 1356 1357#131 string RA AppleWorks spreadsheet data 1358#131 string RM AppleWorks spreadsheet data 1359#131 string CA AppleWorks spreadsheet data 1360#131 string CM AppleWorks spreadsheet data 1361 1362# Applesoft BASIC: 1363# 1364# This is incredibly sloppy, but will be true if the program was 1365# written at its usual memory location of 2048 and its first line 1366# number is less than 256. Yuck. 1367# update by Joerg Jenderek at Feb 2013 1368 1369# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000) 1370#0 belong&0xff00ff 0x80000 Applesoft BASIC program data 13710 belong&0x00ff00ff 0x00080000 1372# assuming that line number must be positive 1373>2 leshort >0 Applesoft BASIC program data, first line number %d 1374#>2 leshort x \b, first line number %d 1375 1376# ORCA/EZ assembler: 1377# 1378# This will not identify ORCA/M source files, since those have 1379# some sort of date code instead of the two zero bytes at 6 and 7 1380# XXX Conflicts with ELF 1381#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data 1382#>5 byte x \b, build number %d 1383 1384# Broderbund Fantavision 1385# 1386# I don't know what these values really mean, but they seem to recur. 1387# Will they cause too many conflicts? 1388 1389# Probably :-) 1390#2 belong&0xFF00FF 0x040008 Fantavision movie data 1391 1392# Some attempts at images. 1393# 1394# These are actually just bit-for-bit dumps of the frame buffer, so 1395# there's really no reasonably way to distinguish them except for their 1396# address (if preserved) -- 8192 or 16384 -- and their length -- 8192 1397# or, occasionally, 8184. 1398# 1399# Nevertheless this will manage to catch a lot of images that happen 1400# to have a solid-colored line at the bottom of the screen. 1401 1402# GRR: Magic too weak 1403#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background 1404#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background 1405#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background 1406#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background 1407#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background 1408 1409# Beagle Bros. Apple Mechanic fonts 1410 14110 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font 1412 1413# Apple Universal Disk Image Format (UDIF) - dmg files. 1414# From Johan Gade. 1415# These entries are disabled for now until we fix the following issues. 1416# 1417# Note there might be some problems with the "VAX COFF executable" 1418# entry. Note this entry should be placed before the mac filesystem section, 1419# particularly the "Apple Partition data" entry. 1420# 1421# The intended meaning of these tests is, that the file is only of the 1422# specified type if both of the lines are correct - i.e. if the first 1423# line matches and the second doesn't then it is not of that type. 1424# 1425#0 long 0x7801730d 1426#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) 1427# 1428# Note that this entry is recognized correctly by the "Apple Partition 1429# data" entry - however since this entry is more specific - this 1430# information seems to be more useful. 1431#0 long 0x45520200 1432#>0x410 string disk\ image UDIF read/write image (UDRW) 1433 1434# From: Toby Peterson <toby@apple.com> 14350 string bplist00 Apple binary property list 1436 1437# Apple binary property list (bplist) 1438# Assumes version bytes are hex. 1439# Provides content hints for version 0 files. Assumes that the root 1440# object is the first object (true for CoreFoundation implementation). 1441# From: David Remahl <dremahl@apple.com> 14420 string bplist 1443>6 byte x \bCoreFoundation binary property list data, version 0x%c 1444>>7 byte x \b%c 1445>6 string 00 \b 1446>>8 byte&0xF0 0x00 \b 1447>>>8 byte&0x0F 0x00 \b, root type: null 1448>>>8 byte&0x0F 0x08 \b, root type: false boolean 1449>>>8 byte&0x0F 0x09 \b, root type: true boolean 1450>>8 byte&0xF0 0x10 \b, root type: integer 1451>>8 byte&0xF0 0x20 \b, root type: real 1452>>8 byte&0xF0 0x30 \b, root type: date 1453>>8 byte&0xF0 0x40 \b, root type: data 1454>>8 byte&0xF0 0x50 \b, root type: ascii string 1455>>8 byte&0xF0 0x60 \b, root type: unicode string 1456>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) 1457>>8 byte&0xF0 0xa0 \b, root type: array 1458>>8 byte&0xF0 0xd0 \b, root type: dictionary 1459 1460# Apple/NeXT typedstream data 1461# Serialization format used by NeXT and Apple for various 1462# purposes in YellowStep/Cocoa, including some nib files. 1463# From: David Remahl <dremahl@apple.com> 14642 string typedstream NeXT/Apple typedstream data, big endian 1465>0 byte x \b, version %hhd 1466>0 byte <5 \b 1467>>13 byte 0x81 \b 1468>>>14 ubeshort x \b, system %hd 14692 string streamtyped NeXT/Apple typedstream data, little endian 1470>0 byte x \b, version %hhd 1471>0 byte <5 \b 1472>>13 byte 0x81 \b 1473>>>14 uleshort x \b, system %hd 1474 1475#------------------------------------------------------------------------------ 1476# CAF: Apple CoreAudio File Format 1477# 1478# Container format for high-end audio purposes. 1479# From: David Remahl <dremahl@apple.com> 1480# 14810 string caff CoreAudio Format audio file 1482>4 beshort <10 version %d 1483>6 beshort x 1484 1485 1486#------------------------------------------------------------------------------ 1487# Keychain database files 14880 string kych Mac OS X Keychain File 1489 1490#------------------------------------------------------------------------------ 1491# Code Signing related file types 14920 belong 0xfade0c00 Mac OS X Code Requirement 1493>8 belong 1 (opExpr) 1494>4 belong x - %d bytes 1495 14960 belong 0xfade0c01 Mac OS X Code Requirement Set 1497>8 belong >1 containing %d items 1498>4 belong x - %d bytes 1499 15000 belong 0xfade0c02 Mac OS X Code Directory 1501>8 belong x version %x 1502>12 belong >0 flags 0x%x 1503>4 belong x - %d bytes 1504 15050 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) 1506>4 belong x - %d bytes 1507 15080 belong 0xfade0cc1 Mac OS X Detached Code Signature 1509>8 belong >1 (%d elements) 1510>4 belong x - %d bytes 1511 1512# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 1513# .vdi 15144 string innotek\ VirtualBox\ Disk\ Image %s 1515 1516# Apple disk partition stuff, strengthen the magic using byte 4 15170 beshort 0x4552 1518>4 byte 0 Apple Driver Map 1519>>2 beshort x \b, blocksize %d 1520>>4 belong x \b, blockcount %d 1521>>10 beshort x \b, devtype %d 1522>>12 beshort x \b, devid %d 1523>>20 beshort x \b, descriptors %d 1524# Assume 8 partitions each at a multiple of the sector size. 1525# We could glean this from the partition descriptors, but they are empty!?!? 1526>>(2.S*1) indirect \b, contains[@0x%x]: 1527>>(2.S*2) indirect \b, contains[@0x%x]: 1528>>(2.S*3) indirect \b, contains[@0x%x]: 1529>>(2.S*4) indirect \b, contains[@0x%x]: 1530>>(2.S*5) indirect \b, contains[@0x%x]: 1531>>(2.S*6) indirect \b, contains[@0x%x]: 1532>>(2.S*7) indirect \b, contains[@0x%x]: 1533>>(2.S*8) indirect \b, contains[@0x%x]: 1534 1535# Yes, the 3rd and 4th bytes are reserved, but we use them to make the 1536# magic stronger. 15370 belong 0x504d0000 Apple Partition Map 1538>4 belong x \b, map block count %d 1539>8 belong x \b, start block %d 1540>12 belong x \b, block count %d 1541>16 string >0 \b, name %s 1542>48 string >0 \b, type %s 1543>124 string >0 \b, processor %s 1544>140 string >0 \b, boot arguments %s 1545>92 belong & 1 \b, valid 1546>92 belong & 2 \b, allocated 1547>92 belong & 4 \b, in use 1548>92 belong & 8 \b, has boot info 1549>92 belong & 16 \b, readable 1550>92 belong & 32 \b, writable 1551>92 belong & 64 \b, pic boot code 1552>92 belong & 128 \b, chain compatible driver 1553>92 belong & 256 \b, real driver 1554>92 belong & 512 \b, chain driver 1555>92 belong & 1024 \b, mount at startup 1556>92 belong & 2048 \b, is the startup partition 1557 1558#http://wiki.mozilla.org/DS_Store_File_Format` 1559#http://en.wikipedia.org/wiki/.DS_Store 15600 string \0\0\0\1Bud1\0 Apple Desktop Services Store 1561 1562#------------------------------------------------------------------------------ 1563# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $ 1564# applix: file(1) magic for Applixware 1565# From: Peter Soos <sp@osb.hu> 1566# 15670 string *BEGIN Applixware 1568>7 string WORDS Words Document 1569>7 string GRAPHICS Graphic 1570>7 string RASTER Bitmap 1571>7 string SPREADSHEETS Spreadsheet 1572>7 string MACRO Macro 1573>7 string BUILDER Builder Object 1574#------------------------------------------------------------------------------ 1575# $File: archive,v 1.79 2013/02/08 17:24:06 christos Exp $ 1576# archive: file(1) magic for archive formats (see also "msdos" for self- 1577# extracting compressed archives) 1578# 1579# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 1580# pre-POSIX "tar" archives are handled in the C code. 1581 1582# POSIX tar archives 1583257 string ustar\0 POSIX tar archive 1584!:mime application/x-tar # encoding: posix 1585257 string ustar\040\040\0 GNU tar archive 1586!:mime application/x-tar # encoding: gnu 1587 1588# Incremental snapshot gnu-tar format from: 1589# http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html 15900 string GNU\ tar- GNU tar incremental snapshot data 1591>&0 regex [0-9]\.[0-9]+-[0-9]+ version %s 1592 1593# cpio archives 1594# 1595# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 1596# The idea is to indicate archives produced on machines with the same 1597# byte order as the machine running "file" with "cpio archive", and 1598# to indicate archives produced on machines with the opposite byte order 1599# from the machine running "file" with "byte-swapped cpio archive". 1600# 1601# The SVR4 "cpio(4)" hints that there are additional formats, but they 1602# are defined as "short"s; I think all the new formats are 1603# character-header formats and thus are strings, not numbers. 16040 short 070707 cpio archive 1605!:mime application/x-cpio 16060 short 0143561 byte-swapped cpio archive 1607!:mime application/x-cpio # encoding: swapped 16080 string 070707 ASCII cpio archive (pre-SVR4 or odc) 16090 string 070701 ASCII cpio archive (SVR4 with no CRC) 16100 string 070702 ASCII cpio archive (SVR4 with CRC) 1611 1612# 1613# Various archive formats used by various versions of the "ar" 1614# command. 1615# 1616 1617# 1618# Original UNIX archive formats. 1619# They were written with binary values in host byte order, and 1620# the magic number was a host "int", which might have been 16 bits 1621# or 32 bits. We don't say "PDP-11" or "VAX", as there might have 1622# been ports to little-endian 16-bit-int or 32-bit-int platforms 1623# (x86?) using some of those formats; if none existed, feel free 1624# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian 1625# 32-bit. There might have been big-endian ports of that sort as 1626# well. 1627# 16280 leshort 0177555 very old 16-bit-int little-endian archive 16290 beshort 0177555 very old 16-bit-int big-endian archive 16300 lelong 0177555 very old 32-bit-int little-endian archive 16310 belong 0177555 very old 32-bit-int big-endian archive 1632 16330 leshort 0177545 old 16-bit-int little-endian archive 1634>2 string __.SYMDEF random library 16350 beshort 0177545 old 16-bit-int big-endian archive 1636>2 string __.SYMDEF random library 16370 lelong 0177545 old 32-bit-int little-endian archive 1638>4 string __.SYMDEF random library 16390 belong 0177545 old 32-bit-int big-endian archive 1640>4 string __.SYMDEF random library 1641 1642# 1643# From "pdp" (but why a 4-byte quantity?) 1644# 16450 lelong 0x39bed PDP-11 old archive 16460 lelong 0x39bee PDP-11 4.0 archive 1647 1648# 1649# XXX - what flavor of APL used this, and was it a variant of 1650# some ar archive format? It's similar to, but not the same 1651# as, the APL workspace magic numbers in pdp. 1652# 16530 long 0100554 apl workspace 1654 1655# 1656# System V Release 1 portable(?) archive format. 1657# 16580 string =<ar> System V Release 1 ar archive 1659!:mime application/x-archive 1660 1661# 1662# Debian package; it's in the portable archive format, and needs to go 1663# before the entry for regular portable archives, as it's recognized as 1664# a portable archive whose first member has a name beginning with 1665# "debian". 1666# 16670 string =!<arch>\ndebian 1668!:mime application/x-debian-package 1669>8 string debian-split part of multipart Debian package 1670>8 string debian-binary Debian binary package 1671>8 string !debian 1672>68 string >\0 (format %s) 1673# These next two lines do not work, because a bzip2 Debian archive 1674# still uses gzip for the control.tar (first in the archive). Only 1675# data.tar varies, and the location of its filename varies too. 1676# file/libmagic does not current have support for ascii-string based 1677# (offsets) as of 2005-09-15. 1678#>81 string bz2 \b, uses bzip2 compression 1679#>84 string gz \b, uses gzip compression 1680#>136 ledate x created: %s 1681 1682# 1683# MIPS archive; they're in the portable archive format, and need to go 1684# before the entry for regular portable archives, as it's recognized as 1685# a portable archive whose first member has a name beginning with 1686# "__________E". 1687# 16880 string =!<arch>\n__________E MIPS archive 1689!:mime application/x-archive 1690>20 string U with MIPS Ucode members 1691>21 string L with MIPSEL members 1692>21 string B with MIPSEB members 1693>19 string L and an EL hash table 1694>19 string B and an EB hash table 1695>22 string X -- out of date 1696 16970 search/1 -h- Software Tools format archive text 1698 1699# 1700# BSD/SVR2-and-later portable archive formats. 1701# 17020 string =!<arch> current ar archive 1703!:mime application/x-archive 1704>8 string __.SYMDEF random library 1705>68 string __.SYMDEF\ SORTED random library 1706 1707# 1708# "Thin" archive, as can be produced by GNU ar. 1709# 17100 string =!<thin>\n thin archive with 1711>68 belong 0 no symbol entries 1712>68 belong 1 %d symbol entry 1713>68 belong >1 %d symbol entries 1714 1715# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 1716# 1717# The first byte is the magic (0x1a), byte 2 is the compression type for 1718# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 1719# filename of the first file (null terminated). Since some types collide 1720# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 1721# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 17220 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 1723!:mime application/x-arc 17240 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 1725!:mime application/x-arc 17260 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 1727!:mime application/x-arc 17280 lelong&0x8080ffff 0x0000031a ARC archive data, packed 1729!:mime application/x-arc 17300 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 1731!:mime application/x-arc 17320 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 1733!:mime application/x-arc 1734# [JW] stuff taken from idarc, obviously ARC successors: 17350 lelong&0x8080ffff 0x00000a1a PAK archive data 1736!:mime application/x-arc 17370 lelong&0x8080ffff 0x0000141a ARC+ archive data 1738!:mime application/x-arc 17390 lelong&0x8080ffff 0x0000481a HYP archive data 1740!:mime application/x-arc 1741 1742# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 1743# I can't create either SPARK or ArcFS archives so I have not tested this stuff 1744# [GRR: the original entries collide with ARC, above; replaced with combined 1745# version (not tested)] 1746#0 byte 0x1a RISC OS archive (spark format) 17470 string \032archive RISC OS archive (ArcFS format) 17480 string Archive\000 RISC OS archive (ArcFS format) 1749 1750# All these were taken from idarc, many could not be verified. Unfortunately, 1751# there were many low-quality sigs, i.e. easy to trigger false positives. 1752# Please notify me of any real-world fishy/ambiguous signatures and I'll try 1753# to get my hands on the actual archiver and see if I find something better. [JW] 1754# probably many can be enhanced by finding some 0-byte or control char near the start 1755 1756# idarc calls this Crush/Uncompressed... *shrug* 17570 string CRUSH Crush archive data 1758# Squeeze It (.sqz) 17590 string HLSQZ Squeeze It archive data 1760# SQWEZ 17610 string SQWEZ SQWEZ archive data 1762# HPack (.hpk) 17630 string HPAK HPack archive data 1764# HAP 17650 string \x91\x33HF HAP archive data 1766# MD/MDCD 17670 string MDmd MDCD archive data 1768# LIM 17690 string LIM\x1a LIM archive data 1770# SAR 17713 string LH5 SAR archive data 1772# BSArc/BS2 17730 string \212\3SB\020\0 BSArc/BS2 archive data 1774# Bethesda Softworks Archive (Oblivion) 17750 string BSA\0 BSArc archive data 1776>4 lelong x version %d 1777# MAR 17782 string =-ah MAR archive data 1779# ACB 1780#0 belong&0x00f800ff 0x00800000 ACB archive data 1781# CPZ 1782# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 1783# JRC 17840 string JRchive JRC archive data 1785# Quantum 17860 string DS\0 Quantum archive data 1787# ReSOF 17880 string PK\3\6 ReSOF archive data 1789# QuArk 17900 string 7\4 QuArk archive data 1791# YAC 179214 string YC YAC archive data 1793# X1 17940 string X1 X1 archive data 17950 string XhDr X1 archive data 1796# CDC Codec (.dqt) 17970 belong&0xffffe000 0x76ff2000 CDC Codec archive data 1798# AMGC 17990 string \xad6" AMGC archive data 1800# NuLIB 18010 string N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data 1802# PakLeo 18030 string LEOLZW PAKLeo archive data 1804# ChArc 18050 string SChF ChArc archive data 1806# PSA 18070 string PSA PSA archive data 1808# CrossePAC 18090 string DSIGDCC CrossePAC archive data 1810# Freeze 18110 string \x1f\x9f\x4a\x10\x0a Freeze archive data 1812# KBoom 18130 string \xc2\xa8MP\xc2\xa8 KBoom archive data 1814# NSQ, must go after CDC Codec 18150 string \x76\xff NSQ archive data 1816# DPA 18170 string Dirk\ Paehl DPA archive data 1818# BA 1819# TODO: idarc says "bytes 0-2 == bytes 3-5" 1820# TTComp 18210 string \0\6 TTComp archive data 1822# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 18230 string ESP ESP archive data 1824# ZPack 18250 string \1ZPK\1 ZPack archive data 1826# Sky 18270 string \xbc\x40 Sky archive data 1828# UFA 18290 string UFA UFA archive data 1830# Dry 18310 string =-H2O DRY archive data 1832# FoxSQZ 18330 string FOXSQZ FoxSQZ archive data 1834# AR7 18350 string ,AR7 AR7 archive data 1836# PPMZ 18370 string PPMZ PPMZ archive data 1838# MS Compress 18394 string \x88\xf0\x27 MS Compress archive data 1840# updated by Joerg Jenderek 1841>9 string \0 1842>>0 string KWAJ 1843>>>7 string \321\003 MS Compress archive data 1844>>>>14 ulong >0 \b, original size: %ld bytes 1845>>>>18 ubyte >0x65 1846>>>>>18 string x \b, was %.8s 1847>>>>>(10.b-4) string x \b.%.3s 1848# MP3 (archiver, not lossy audio compression) 18490 string MP3\x1a MP3-Archiver archive data 1850# ZET 18510 string OZ\xc3\x9d ZET archive data 1852# TSComp 18530 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 1854# ARQ 18550 string gW\4\1 ARQ archive data 1856# Squash 18573 string OctSqu Squash archive data 1858# Terse 18590 string \5\1\1\0 Terse archive data 1860# PUCrunch 18610 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 1862# UHarc 18630 string UHA UHarc archive data 1864# ABComp 18650 string \2AB ABComp archive data 18660 string \3AB2 ABComp archive data 1867# CMP 18680 string CO\0 CMP archive data 1869# Splint 18700 string \x93\xb9\x06 Splint archive data 1871# InstallShield 18720 string \x13\x5d\x65\x8c InstallShield Z archive Data 1873# Gather 18741 string GTH Gather archive data 1875# BOA 18760 string BOA BOA archive data 1877# RAX 18780 string ULEB\xa RAX archive data 1879# Xtreme 18800 string ULEB\0 Xtreme archive data 1881# Pack Magic 18820 string @\xc3\xa2\1\0 Pack Magic archive data 1883# BTS 18840 belong&0xfeffffff 0x1a034465 BTS archive data 1885# ELI 5750 18860 string Ora\ ELI 5750 archive data 1887# QFC 18880 string \x1aFC\x1a QFC archive data 18890 string \x1aQF\x1a QFC archive data 1890# PRO-PACK 18910 string RNC PRO-PACK archive data 1892# 777 18930 string 777 777 archive data 1894# LZS221 18950 string sTaC LZS221 archive data 1896# HPA 18970 string HPA HPA archive data 1898# Arhangel 18990 string LG Arhangel archive data 1900# EXP1, uses bzip2 19010 string 0123456789012345BZh EXP1 archive data 1902# IMP 19030 string IMP\xa IMP archive data 1904# NRV 19050 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 1906# Squish 19070 string \x73\xb2\x90\xf4 Squish archive data 1908# Par 19090 string PHILIPP Par archive data 19100 string PAR Par archive data 1911# HIT 19120 string UB HIT archive data 1913# SBX 19140 belong&0xfffff000 0x53423000 SBX archive data 1915# NaShrink 19160 string NSK NaShrink archive data 1917# SAPCAR 19180 string #\ CAR\ archive\ header SAPCAR archive data 19190 string CAR\ 2.00RG SAPCAR archive data 1920# Disintegrator 19210 string DST Disintegrator archive data 1922# ASD 19230 string ASD ASD archive data 1924# InstallShield CAB 19250 string ISc( InstallShield CAB 1926# TOP4 19270 string T4\x1a TOP4 archive data 1928# BatComp left out: sig looks like COM executable 1929# so TODO: get real 4dos batcomp file and find sig 1930# BlakHole 19310 string BH\5\7 BlakHole archive data 1932# BIX 19330 string BIX0 BIX archive data 1934# ChiefLZA 19350 string ChfLZ ChiefLZA archive data 1936# Blink 19370 string Blink Blink archive data 1938# Logitech Compress 19390 string \xda\xfa Logitech Compress archive data 1940# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 19411 string (C)\ STEPANYUK ARS-Sfx archive data 1942# AKT/AKT32 19430 string AKT32 AKT32 archive data 19440 string AKT AKT archive data 1945# NPack 19460 string MSTSM NPack archive data 1947# PFT 19480 string \0\x50\0\x14 PFT archive data 1949# SemOne 19500 string SEM SemOne archive data 1951# PPMD 19520 string \x8f\xaf\xac\x84 PPMD archive data 1953# FIZ 19540 string FIZ FIZ archive data 1955# MSXiE 19560 belong&0xfffff0f0 0x4d530000 MSXiE archive data 1957# DeepFreezer 19580 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 1959# DC 19600 string =<DC- DC archive data 1961# TPac 19620 string \4TPAC\3 TPac archive data 1963# Ai 19640 string Ai\1\1\0 Ai archive data 19650 string Ai\1\0\0 Ai archive data 1966# Ai32 19670 string Ai\2\0 Ai32 archive data 19680 string Ai\2\1 Ai32 archive data 1969# SBC 19700 string SBC SBC archive data 1971# Ybs 19720 string YBS Ybs archive data 1973# DitPack 19740 string \x9e\0\0 DitPack archive data 1975# DMS 19760 string DMS! DMS archive data 1977# EPC 19780 string \x8f\xaf\xac\x8c EPC archive data 1979# VSARC 19800 string VS\x1a VSARC archive data 1981# PDZ 19820 string PDZ PDZ archive data 1983# ReDuq 19840 string rdqx ReDuq archive data 1985# GCA 19860 string GCAX GCA archive data 1987# PPMN 19880 string pN PPMN archive data 1989# WinImage 19903 string WINIMAGE WinImage archive data 1991# Compressia 19920 string CMP0CMP Compressia archive data 1993# UHBC 19940 string UHB UHBC archive data 1995# WinHKI 19960 string \x61\x5C\x04\x05 WinHKI archive data 1997# WWPack data file 19980 string WWP WWPack archive data 1999# BSN (BSA, PTS-DOS) 20000 string \xffBSG BSN archive data 20011 string \xffBSG BSN archive data 20023 string \xffBSG BSN archive data 20031 string \0\xae\2 BSN archive data 20041 string \0\xae\3 BSN archive data 20051 string \0\xae\7 BSN archive data 2006# AIN 20070 string \x33\x18 AIN archive data 20080 string \x33\x17 AIN archive data 2009# XPA32 20100 string xpa\0\1 XPA32 archive data 2011# SZip (TODO: doesn't catch all versions) 20120 string SZ\x0a\4 SZip archive data 2013# XPack DiskImage 20140 string jm XPack DiskImage archive data 2015# XPack Data 20160 string xpa XPack archive data 2017# XPack Single Data 20180 string \xc3\x8d\ jm XPack single archive data 2019 2020# TODO: missing due to unknown magic/magic at end of file: 2021#DWC 2022#ARG 2023#ZAR 2024#PC/3270 2025#InstallIt 2026#RKive 2027#RK 2028#XPack Diskimage 2029 2030# These were inspired by idarc, but actually verified 2031# Dzip archiver (.dz) 20320 string DZ Dzip archive data 2033>2 byte x \b, version %i 2034>3 byte x \b.%i 2035# ZZip archiver (.zz) 20360 string ZZ\ \0\0 ZZip archive data 20370 string ZZ0 ZZip archive data 2038# PAQ archiver (.paq) 20390 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 20400 string PAQ PAQ archive data 2041>3 byte&0xf0 0x30 2042>>3 byte x (v%c) 2043# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 20440xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 20450 string JARCS JAR (ARJ Software, Inc.) archive data 2046 2047# ARJ archiver (jason@jarthur.Claremont.EDU) 20480 leshort 0xea60 ARJ archive data 2049!:mime application/x-arj 2050>5 byte x \b, v%d, 2051>8 byte &0x04 multi-volume, 2052>8 byte &0x10 slash-switched, 2053>8 byte &0x20 backup, 2054>34 string x original name: %s, 2055>7 byte 0 os: MS-DOS 2056>7 byte 1 os: PRIMOS 2057>7 byte 2 os: Unix 2058>7 byte 3 os: Amiga 2059>7 byte 4 os: Macintosh 2060>7 byte 5 os: OS/2 2061>7 byte 6 os: Apple ][ GS 2062>7 byte 7 os: Atari ST 2063>7 byte 8 os: NeXT 2064>7 byte 9 os: VAX/VMS 2065>3 byte >0 %d] 2066# [JW] idarc says this is also possible 20672 leshort 0xea60 ARJ archive data 2068 2069# HA archiver (Greg Roelofs, newt@uchicago.edu) 2070# This is a really bad format. A file containing HAWAII will match this... 2071#0 string HA HA archive data, 2072#>2 leshort =1 1 file, 2073#>2 leshort >1 %u files, 2074#>4 byte&0x0f =0 first is type CPY 2075#>4 byte&0x0f =1 first is type ASC 2076#>4 byte&0x0f =2 first is type HSC 2077#>4 byte&0x0f =0x0e first is type DIR 2078#>4 byte&0x0f =0x0f first is type SPECIAL 2079# suggestion: at least identify small archives (<1024 files) 20800 belong&0xffff00fc 0x48410000 HA archive data 2081>2 leshort =1 1 file, 2082>2 leshort >1 %u files, 2083>4 byte&0x0f =0 first is type CPY 2084>4 byte&0x0f =1 first is type ASC 2085>4 byte&0x0f =2 first is type HSC 2086>4 byte&0x0f =0x0e first is type DIR 2087>4 byte&0x0f =0x0f first is type SPECIAL 2088 2089# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 20900 string HPAK HPACK archive data 2091 2092# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 20930 string \351,\001JAM\ JAM archive, 2094>7 string >\0 version %.4s 2095>0x26 byte =0x27 - 2096>>0x2b string >\0 label %.11s, 2097>>0x27 lelong x serial %08x, 2098>>0x36 string >\0 fstype %.8s 2099 2100# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 21012 string -lh0- LHarc 1.x/ARX archive data [lh0] 2102!:mime application/x-lharc 21032 string -lh1- LHarc 1.x/ARX archive data [lh1] 2104!:mime application/x-lharc 21052 string -lz4- LHarc 1.x archive data [lz4] 2106!:mime application/x-lharc 21072 string -lz5- LHarc 1.x archive data [lz5] 2108!:mime application/x-lharc 2109# [never seen any but the last; -lh4- reported in comp.compression:] 21102 string -lzs- LHa/LZS archive data [lzs] 2111!:mime application/x-lha 21122 string -lh\40- LHa 2.x? archive data [lh ] 2113!:mime application/x-lha 21142 string -lhd- LHa 2.x? archive data [lhd] 2115!:mime application/x-lha 21162 string -lh2- LHa 2.x? archive data [lh2] 2117!:mime application/x-lha 21182 string -lh3- LHa 2.x? archive data [lh3] 2119!:mime application/x-lha 21202 string -lh4- LHa (2.x) archive data [lh4] 2121!:mime application/x-lha 21222 string -lh5- LHa (2.x) archive data [lh5] 2123!:mime application/x-lha 21242 string -lh6- LHa (2.x) archive data [lh6] 2125!:mime application/x-lha 21262 string -lh7- LHa (2.x)/LHark archive data [lh7] 2127!:mime application/x-lha 2128>20 byte x - header level %d 2129# taken from idarc [JW] 21302 string -lZ PUT archive data 21312 string -lz LZS archive data 21322 string -sw1- Swag archive data 2133 2134# RAR archiver (Greg Roelofs, newt@uchicago.edu) 21350 string Rar! RAR archive data, 2136!:mime application/x-rar 2137>44 byte x v%0x, 2138>10 byte >0 flags: 2139>>10 byte &0x01 Archive volume, 2140>>10 byte &0x02 Commented, 2141>>10 byte &0x04 Locked, 2142>>10 byte &0x08 Solid, 2143>>10 byte &0x20 Authenticated, 2144>35 byte 0 os: MS-DOS 2145>35 byte 1 os: OS/2 2146>35 byte 2 os: Win32 2147>35 byte 3 os: Unix 2148# some old version? idarc says: 21490 string RE\x7e\x5e RAR archive data 2150 2151# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 21520 string SQSH squished archive data (Acorn RISCOS) 2153 2154# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 2155# [JW] see exe section for self-extracting version 21560 string UC2\x1a UC2 archive data 2157 2158# PKZIP multi-volume archive 21590 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract 2160!:mime application/zip 2161 2162# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 21630 string PK\005\006 Zip archive data (empty) 21640 string PK\003\004 2165 2166# Specialised zip formats which start with a member named 'mimetype' 2167# (stored uncompressed, with no 'extra field') containing the file's MIME type. 2168# Check for have 8-byte name, 0-byte extra field, name "mimetype", and 2169# contents starting with "application/": 2170>26 string \x8\0\0\0mimetypeapplication/ 2171 2172# KOffice / OpenOffice & StarOffice / OpenDocument formats 2173# From: Abel Cheung <abel@oaka.org> 2174 2175# KOffice (1.2 or above) formats 2176# (mimetype contains "application/vnd.kde.<SUBTYPE>") 2177>>50 string vnd.kde. KOffice (>=1.2) 2178>>>58 string karbon Karbon document 2179>>>58 string kchart KChart document 2180>>>58 string kformula KFormula document 2181>>>58 string kivio Kivio document 2182>>>58 string kontour Kontour document 2183>>>58 string kpresenter KPresenter document 2184>>>58 string kspread KSpread document 2185>>>58 string kword KWord document 2186 2187# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 2188# (mimetype contains "application/vnd.sun.xml.<SUBTYPE>") 2189>>50 string vnd.sun.xml. OpenOffice.org 1.x 2190>>>62 string writer Writer 2191>>>>68 byte !0x2e document 2192>>>>68 string .template template 2193>>>>68 string .global global document 2194>>>62 string calc Calc 2195>>>>66 byte !0x2e spreadsheet 2196>>>>66 string .template template 2197>>>62 string draw Draw 2198>>>>66 byte !0x2e document 2199>>>>66 string .template template 2200>>>62 string impress Impress 2201>>>>69 byte !0x2e presentation 2202>>>>69 string .template template 2203>>>62 string math Math document 2204>>>62 string base Database file 2205 2206# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 2207# http://lists.oasis-open.org/archives/office/200505/msg00006.html 2208# (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>") 2209>>50 string vnd.oasis.opendocument. OpenDocument 2210>>>73 string text 2211>>>>77 byte !0x2d Text 2212!:mime application/vnd.oasis.opendocument.text 2213>>>>77 string -template Text Template 2214!:mime application/vnd.oasis.opendocument.text-template 2215>>>>77 string -web HTML Document Template 2216!:mime application/vnd.oasis.opendocument.text-web 2217>>>>77 string -master Master Document 2218!:mime application/vnd.oasis.opendocument.text-master 2219>>>73 string graphics 2220>>>>81 byte !0x2d Drawing 2221!:mime application/vnd.oasis.opendocument.graphics 2222>>>>81 string -template Template 2223!:mime application/vnd.oasis.opendocument.graphics-template 2224>>>73 string presentation 2225>>>>85 byte !0x2d Presentation 2226!:mime application/vnd.oasis.opendocument.presentation 2227>>>>85 string -template Template 2228!:mime application/vnd.oasis.opendocument.presentation-template 2229>>>73 string spreadsheet 2230>>>>84 byte !0x2d Spreadsheet 2231!:mime application/vnd.oasis.opendocument.spreadsheet 2232>>>>84 string -template Template 2233!:mime application/vnd.oasis.opendocument.spreadsheet-template 2234>>>73 string chart 2235>>>>78 byte !0x2d Chart 2236!:mime application/vnd.oasis.opendocument.chart 2237>>>>78 string -template Template 2238!:mime application/vnd.oasis.opendocument.chart-template 2239>>>73 string formula 2240>>>>80 byte !0x2d Formula 2241!:mime application/vnd.oasis.opendocument.formula 2242>>>>80 string -template Template 2243!:mime application/vnd.oasis.opendocument.formula-template 2244>>>73 string database Database 2245!:mime application/vnd.oasis.opendocument.database 2246>>>73 string image 2247>>>>78 byte !0x2d Image 2248!:mime application/vnd.oasis.opendocument.image 2249>>>>78 string -template Template 2250!:mime application/vnd.oasis.opendocument.image-template 2251 2252# EPUB (OEBPS) books using OCF (OEBPS Container Format) 2253# http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. 2254# From: Ralf Brown <ralf.brown@gmail.com> 2255>0x1E string mimetypeapplication/epub+zip EPUB document 2256!:mime application/epub+zip 2257 2258# Catch other ZIP-with-mimetype formats 2259# In a ZIP file, the bytes immediately after a member's contents are 2260# always "PK". The 2 regex rules here print the "mimetype" member's 2261# contents up to the first 'P'. Luckily, most MIME types don't contain 2262# any capital 'P's. This is a kludge. 2263# (mimetype contains "application/<OTHER>") 2264>>50 string !epub+zip 2265>>>50 string !vnd.oasis.opendocument. 2266>>>>50 string !vnd.sun.xml. 2267>>>>>50 string !vnd.kde. 2268>>>>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 2269!:mime application/zip 2270# (mimetype contents other than "application/*") 2271>26 string \x8\0\0\0mimetype 2272>>38 string !application/ 2273>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 2274!:mime application/zip 2275 2276# Java Jar files 2277>(26.s+30) leshort 0xcafe Java Jar file data (zip) 2278!:mime application/jar 2279 2280# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 2281# Next line excludes specialized formats: 2282>(26.s+30) leshort !0xcafe 2283>>26 string !\x8\0\0\0mimetype Zip archive data 2284!:mime application/zip 2285>>>4 byte 0x09 \b, at least v0.9 to extract 2286>>>4 byte 0x0a \b, at least v1.0 to extract 2287>>>4 byte 0x0b \b, at least v1.1 to extract 2288>>>4 byte 0x14 \b, at least v2.0 to extract 2289>>>4 byte 0x2d \b, at least v3.0 to extract 2290>>>0x161 string WINZIP \b, WinZIP self-extracting 2291 2292# StarView Metafile 2293# From Pierre Ducroquet <pinaraf@pinaraf.info> 22940 string VCLMTF StarView MetaFile 2295>6 beshort x \b, version %d 2296>8 belong x \b, size %d 2297 2298# Zoo archiver 229920 lelong 0xfdc4a7dc Zoo archive data 2300!:mime application/x-zoo 2301>4 byte >48 \b, v%c. 2302>>6 byte >47 \b%c 2303>>>7 byte >47 \b%c 2304>32 byte >0 \b, modify: v%d 2305>>33 byte x \b.%d+ 2306>42 lelong 0xfdc4a7dc \b, 2307>>70 byte >0 extract: v%d 2308>>>71 byte x \b.%d+ 2309 2310# Shell archives 231110 string #\ This\ is\ a\ shell\ archive shell archive text 2312!:mime application/octet-stream 2313 2314# 2315# LBR. NB: May conflict with the questionable 2316# "binary Computer Graphics Metafile" format. 2317# 23180 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 2319# 2320# PMA (CP/M derivative of LHA) 2321# 23222 string -pm0- PMarc archive data [pm0] 23232 string -pm1- PMarc archive data [pm1] 23242 string -pm2- PMarc archive data [pm2] 23252 string -pms- PMarc SFX archive (CP/M, DOS) 23265 string -pc1- PopCom compressed executable (CP/M) 2327 2328# From Rafael Laboissiere <rafael@laboissiere.net> 2329# The Project Revision Control System (see 2330# http://prcs.sourceforge.net) generates a packaged project 2331# file which is recognized by the following entry: 23320 leshort 0xeb81 PRCS packaged project 2333 2334# Microsoft cabinets 2335# by David Necas (Yeti) <yeti@physics.muni.cz> 2336#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 2337#>25 byte x v%d 2338#>24 byte x \b.%d 2339# MPi: All CABs have version 1.3, so this is pointless. 2340# Better magic in debian-additions. 2341 2342# GTKtalog catalogs 2343# by David Necas (Yeti) <yeti@physics.muni.cz> 23444 string gtktalog\ GTKtalog catalog data, 2345>13 string 3 version 3 2346>>14 beshort 0x677a (gzipped) 2347>>14 beshort !0x677a (not gzipped) 2348>13 string >3 version %s 2349 2350############################################################################ 2351# Parity archive reconstruction file, the 'par' file format now used on Usenet. 23520 string PAR\0 PARity archive data 2353>48 leshort =0 - Index file 2354>48 leshort >0 - file number %d 2355 2356# Felix von Leitner <felix-file@fefe.de> 23570 string d8:announce BitTorrent file 2358!:mime application/x-bittorrent 2359 2360# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 23610 beshort 0x0e0f Atari MSA archive data 2362>2 beshort x \b, %d sectors per track 2363>4 beshort 0 \b, 1 sided 2364>4 beshort 1 \b, 2 sided 2365>6 beshort x \b, starting track: %d 2366>8 beshort x \b, ending track: %d 2367 2368# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 23690 string PK00PK\003\004 Zip archive data 2370 2371# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 2372# by Stefan `Sec` Zehl <sec@42.org> 23737 string **ACE** ACE archive data 2374>15 byte >0 version %d 2375>16 byte =0x00 \b, from MS-DOS 2376>16 byte =0x01 \b, from OS/2 2377>16 byte =0x02 \b, from Win/32 2378>16 byte =0x03 \b, from Unix 2379>16 byte =0x04 \b, from MacOS 2380>16 byte =0x05 \b, from WinNT 2381>16 byte =0x06 \b, from Primos 2382>16 byte =0x07 \b, from AppleGS 2383>16 byte =0x08 \b, from Atari 2384>16 byte =0x09 \b, from Vax/VMS 2385>16 byte =0x0A \b, from Amiga 2386>16 byte =0x0B \b, from Next 2387>14 byte x \b, version %d to extract 2388>5 leshort &0x0080 \b, multiple volumes, 2389>>17 byte x \b (part %d), 2390>5 leshort &0x0002 \b, contains comment 2391>5 leshort &0x0200 \b, sfx 2392>5 leshort &0x0400 \b, small dictionary 2393>5 leshort &0x0800 \b, multi-volume 2394>5 leshort &0x1000 \b, contains AV-String 2395>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 2396>5 leshort &0x2000 \b, with recovery record 2397>5 leshort &0x4000 \b, locked 2398>5 leshort &0x8000 \b, solid 2399# Date in MS-DOS format (whatever that is) 2400#>18 lelong x Created on 2401 2402# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 2403# <doj@cubic.org> 24040x1A string sfArk sfArk compressed Soundfont 2405>0x15 string 2 2406>>0x1 string >\0 Version %s 2407>>0x2A string >\0 : %s 2408 2409# DR-DOS 7.03 Packed File *.??_ 24100 string Packed\ File\ Personal NetWare Packed File 2411>12 string x \b, was "%.12s" 2412 2413# EET archive 2414# From: Tilman Sauerbeck <tilman@code-monkey.de> 24150 belong 0x1ee7ff00 EET archive 2416!:mime application/x-eet 2417 2418# rzip archives 24190 string RZIP rzip compressed data 2420>4 byte x - version %d 2421>5 byte x \b.%d 2422>6 belong x (%d bytes) 2423 2424# From: "Robert Dale" <robdale@gmail.com> 24250 belong 123 dar archive, 2426>4 belong x label "%.8x 2427>>8 belong x %.8x 2428>>>12 beshort x %.4x" 2429>14 byte 0x54 end slice 2430>14 beshort 0x4e4e multi-part 2431>14 beshort 0x4e53 multi-part, with -S 2432 2433# Symbian installation files 2434# http://www.thouky.co.uk/software/psifs/sis.html 2435# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 24368 lelong 0x10000419 Symbian installation file 2437!:mime application/vnd.symbian.install 2438>4 lelong 0x1000006D (EPOC release 3/4/5) 2439>4 lelong 0x10003A12 (EPOC release 6) 24400 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 2441!:mime x-epoc/x-sisx-app 2442 2443# From "Nelson A. de Oliveira" <naoliv@gmail.com> 24440 string MPQ\032 MoPaQ (MPQ) archive 2445 2446# From: Dirk Jagdmann <doj@cubic.org> 2447# xar archive format: http://code.google.com/p/xar/ 24480 string xar! xar archive 2449>6 beshort x - version %ld 2450 2451# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 2452# .kgb 24530 string KGB_arch KGB Archiver file 2454>10 string x with compression level %.1s 2455 2456# xar (eXtensible ARchiver) archive 2457# From: "David Remahl" <dremahl@apple.com> 24580 string xar! xar archive 2459#>4 beshort x header size %d 2460>6 beshort x version %d, 2461#>8 quad x compressed TOC: %d, 2462#>16 quad x uncompressed TOC: %d, 2463>24 belong 0 no checksum 2464>24 belong 1 SHA-1 checksum 2465>24 belong 2 MD5 checksum 2466 2467# Type: Parity Archive 2468# From: Daniel van Eeden <daniel_e@dds.nl> 24690 string PAR2 Parity Archive Volume Set 2470 2471# Bacula volume format. (Volumes always start with a block header.) 2472# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html 2473# From: Adam Buchbinder <adam.buchbinder@gmail.com> 247412 string BB02 Bacula volume 2475>20 bedate x \b, started %s 2476 2477# ePub is XHTML + XML inside a ZIP archive. The first member of the 2478# archive must be an uncompressed file called 'mimetype' with contents 2479# 'application/epub+zip' 2480 2481 2482# From: "Michael Gorny" <mgorny@gentoo.org> 2483# ZPAQ: http://mattmahoney.net/dc/zpaq.html 24840 string zPQ ZPAQ stream 2485>3 byte x \b, level %d 2486 2487# BBeB ebook, unencrypted (LRF format) 2488# URL: http://www.sven.de/librie/Librie/LrfFormat 2489# From: Adam Buchbinder <adam.buchbinder@gmail.com> 24900 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted 2491>8 beshort x \b, version %d 2492>36 byte 1 \b, front-to-back 2493>36 byte 16 \b, back-to-front 2494>42 beshort x \b, (%dx, 2495>44 beshort x %d) 2496#------------------------------------------------------------------------------ 2497# $File: assembler,v 1.4 2013/01/04 23:31:11 christos Exp $ 2498# make: file(1) magic for assembler source 2499# 25000 regex \^[\020\t]*\\.asciiz assembler source text 2501!:mime text/x-asm 25020 regex \^[\020\t]*\\.byte assembler source text 2503!:mime text/x-asm 25040 regex \^[\020\t]*\\.even assembler source text 2505!:mime text/x-asm 25060 regex \^[\020\t]*\\.globl assembler source text 2507!:mime text/x-asm 25080 regex \^[\020\t]*\\.text assembler source text 2509!:mime text/x-asm 25100 regex \^[\020\t]*\\.file assembler source text 2511!:mime text/x-asm 25120 regex \^[\020\t]*\\.type assembler source text 2513!:mime text/x-asm 2514 2515#------------------------------------------------------------------------------ 2516# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $ 2517# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character 2518# strings as "long" - we assume they're just strings: 2519# From: guy@netapp.com (Guy Harris) 2520# 25210 string *STA Aster*x 2522>7 string WORD Words Document 2523>7 string GRAP Graphic 2524>7 string SPRE Spreadsheet 2525>7 string MACR Macro 25260 string 2278 Aster*x Version 2 2527>29 byte 0x36 Words Document 2528>29 byte 0x35 Graphic 2529>29 byte 0x32 Spreadsheet 2530>29 byte 0x38 Macro 2531 2532 2533#------------------------------------------------------------------------------ 2534# $File: att3b,v 1.8 2009/09/19 16:28:08 christos Exp $ 2535# att3b: file(1) magic for AT&T 3B machines 2536# 2537# The `versions' should be un-commented if they work for you. 2538# (Was the problem just one of endianness?) 2539# 2540# 3B20 2541# 2542# The 3B20 conflicts with SCCS. 2543#0 beshort 0550 3b20 COFF executable 2544#>12 belong >0 not stripped 2545#>22 beshort >0 - version %ld 2546#0 beshort 0551 3b20 COFF executable (TV) 2547#>12 belong >0 not stripped 2548#>22 beshort >0 - version %ld 2549# 2550# WE32K 2551# 25520 beshort 0560 WE32000 COFF 2553>18 beshort ^00000020 object 2554>18 beshort &00000020 executable 2555>12 belong >0 not stripped 2556>18 beshort ^00010000 N/A on 3b2/300 w/paging 2557>18 beshort &00020000 32100 required 2558>18 beshort &00040000 and MAU hardware required 2559>20 beshort 0407 (impure) 2560>20 beshort 0410 (pure) 2561>20 beshort 0413 (demand paged) 2562>20 beshort 0443 (target shared library) 2563>22 beshort >0 - version %ld 25640 beshort 0561 WE32000 COFF executable (TV) 2565>12 belong >0 not stripped 2566#>18 beshort &00020000 - 32100 required 2567#>18 beshort &00040000 and MAU hardware required 2568#>22 beshort >0 - version %ld 2569# 2570# core file for 3b2 25710 string \000\004\036\212\200 3b2 core file 2572>364 string >\0 of '%s' 2573 2574#------------------------------------------------------------------------------ 2575# $File: audio,v 1.66 2013/02/06 14:18:52 christos Exp $ 2576# audio: file(1) magic for sound formats (see also "iff") 2577# 2578# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com), 2579# and others 2580# 2581 2582# Sun/NeXT audio data 25830 string .snd Sun/NeXT audio data: 2584>12 belong 1 8-bit ISDN mu-law, 2585!:mime audio/basic 2586>12 belong 2 8-bit linear PCM [REF-PCM], 2587!:mime audio/basic 2588>12 belong 3 16-bit linear PCM, 2589!:mime audio/basic 2590>12 belong 4 24-bit linear PCM, 2591!:mime audio/basic 2592>12 belong 5 32-bit linear PCM, 2593!:mime audio/basic 2594>12 belong 6 32-bit IEEE floating point, 2595!:mime audio/basic 2596>12 belong 7 64-bit IEEE floating point, 2597!:mime audio/basic 2598>12 belong 8 Fragmented sample data, 2599>12 belong 10 DSP program, 2600>12 belong 11 8-bit fixed point, 2601>12 belong 12 16-bit fixed point, 2602>12 belong 13 24-bit fixed point, 2603>12 belong 14 32-bit fixed point, 2604>12 belong 18 16-bit linear with emphasis, 2605>12 belong 19 16-bit linear compressed, 2606>12 belong 20 16-bit linear with emphasis and compression, 2607>12 belong 21 Music kit DSP commands, 2608>12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 2609!:mime audio/x-adpcm 2610>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 2611>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 2612>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 2613>12 belong 27 8-bit A-law (CCITT G.711), 2614>20 belong 1 mono, 2615>20 belong 2 stereo, 2616>20 belong 4 quad, 2617>16 belong >0 %d Hz 2618 2619# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format 2620# that uses little-endian encoding and has a different magic number 26210 lelong 0x0064732E DEC audio data: 2622>12 lelong 1 8-bit ISDN mu-law, 2623!:mime audio/x-dec-basic 2624>12 lelong 2 8-bit linear PCM [REF-PCM], 2625!:mime audio/x-dec-basic 2626>12 lelong 3 16-bit linear PCM, 2627!:mime audio/x-dec-basic 2628>12 lelong 4 24-bit linear PCM, 2629!:mime audio/x-dec-basic 2630>12 lelong 5 32-bit linear PCM, 2631!:mime audio/x-dec-basic 2632>12 lelong 6 32-bit IEEE floating point, 2633!:mime audio/x-dec-basic 2634>12 lelong 7 64-bit IEEE floating point, 2635!:mime audio/x-dec-basic 2636>12 belong 8 Fragmented sample data, 2637>12 belong 10 DSP program, 2638>12 belong 11 8-bit fixed point, 2639>12 belong 12 16-bit fixed point, 2640>12 belong 13 24-bit fixed point, 2641>12 belong 14 32-bit fixed point, 2642>12 belong 18 16-bit linear with emphasis, 2643>12 belong 19 16-bit linear compressed, 2644>12 belong 20 16-bit linear with emphasis and compression, 2645>12 belong 21 Music kit DSP commands, 2646>12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 2647!:mime audio/x-dec-basic 2648>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 2649>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 2650>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 2651>12 belong 27 8-bit A-law (CCITT G.711), 2652>20 lelong 1 mono, 2653>20 lelong 2 stereo, 2654>20 lelong 4 quad, 2655>16 lelong >0 %d Hz 2656 2657# Creative Labs AUDIO stuff 26580 string MThd Standard MIDI data 2659!:mime audio/midi 2660>8 beshort x (format %d) 2661>10 beshort x using %d track 2662>10 beshort >1 \bs 2663>12 beshort&0x7fff x at 1/%d 2664>12 beshort&0x8000 >0 SMPTE 2665 26660 string CTMF Creative Music (CMF) data 2667!:mime audio/x-unknown 26680 string SBI SoundBlaster instrument data 2669!:mime audio/x-unknown 26700 string Creative\ Voice\ File Creative Labs voice data 2671!:mime audio/x-unknown 2672# is this next line right? it came this way... 2673>19 byte 0x1A 2674>23 byte >0 - version %d 2675>22 byte >0 \b.%d 2676 2677# first entry is also the string "NTRK" 26780 belong 0x4e54524b MultiTrack sound data 2679>4 belong x - version %ld 2680 2681# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED 2682# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi] 26830 string EMOD Extended MOD sound data, 2684>4 byte&0xf0 x version %d 2685>4 byte&0x0f x \b.%d, 2686>45 byte x %d instruments 2687>83 byte 0 (module) 2688>83 byte 1 (song) 2689 2690# Real Audio (Magic .ra\0375) 26910 belong 0x2e7261fd RealAudio sound file 2692!:mime audio/x-pn-realaudio 26930 string .RMF\0\0\0 RealMedia file 2694!:mime application/vnd.rn-realmedia 2695#video/x-pn-realvideo 2696#video/vnd.rn-realvideo 2697#application/vnd.rn-realmedia 2698# sigh, there are many mimes for that but the above are the most common. 2699 2700# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net] 2701# Oct 31, 1995 2702# fixed by <doj@cubic.org> 2003-06-24 2703# Too short... 2704#0 string MTM MultiTracker Module sound file 2705#0 string if Composer 669 Module sound data 2706#0 string JN Composer 669 Module sound data (extended format) 27070 string MAS_U ULT(imate) Module sound data 2708 2709#0 string FAR Module sound data 2710#>4 string >\15 Title: "%s" 2711 27120x2c string SCRM ScreamTracker III Module sound data 2713>0 string >\0 Title: "%s" 2714 2715# Gravis UltraSound patches 2716# From <ache@nagual.ru> 2717 27180 string GF1PATCH110\0ID#000002\0 GUS patch 27190 string GF1PATCH100\0ID#000002\0 Old GUS patch 2720 2721# mime types according to http://www.geocities.com/nevilo/mod.htm: 2722# audio/it .it 2723# audio/x-zipped-it .itz 2724# audio/xm fasttracker modules 2725# audio/x-s3m screamtracker modules 2726# audio/s3m screamtracker modules 2727# audio/x-zipped-mod mdz 2728# audio/mod mod 2729# audio/x-mod All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z) 2730 2731# 2732# Taken from loader code from mikmod version 2.14 2733# by Steve McIntyre (stevem@chiark.greenend.org.uk) 2734# <doj@cubic.org> added title printing on 2003-06-24 27350 string MAS_UTrack_V00 2736>14 string >/0 ultratracker V1.%.1s module sound data 2737!:mime audio/x-mod 2738#audio/x-tracker-module 2739 27400 string UN05 MikMod UNI format module sound data 2741 27420 string Extended\ Module: Fasttracker II module sound data 2743!:mime audio/x-mod 2744#audio/x-tracker-module 2745>17 string >\0 Title: "%s" 2746 274721 string/c =!SCREAM! Screamtracker 2 module sound data 2748!:mime audio/x-mod 2749#audio/x-screamtracker-module 275021 string BMOD2STM Screamtracker 2 module sound data 2751!:mime audio/x-mod 2752#audio/x-screamtracker-module 27531080 string M.K. 4-channel Protracker module sound data 2754!:mime audio/x-mod 2755#audio/x-protracker-module 2756>0 string >\0 Title: "%s" 27571080 string M!K! 4-channel Protracker module sound data 2758!:mime audio/x-mod 2759#audio/x-protracker-module 2760>0 string >\0 Title: "%s" 27611080 string FLT4 4-channel Startracker module sound data 2762!:mime audio/x-mod 2763#audio/x-startracker-module 2764>0 string >\0 Title: "%s" 27651080 string FLT8 8-channel Startracker module sound data 2766!:mime audio/x-mod 2767#audio/x-startracker-module 2768>0 string >\0 Title: "%s" 27691080 string 4CHN 4-channel Fasttracker module sound data 2770!:mime audio/x-mod 2771#audio/x-fasttracker-module 2772>0 string >\0 Title: "%s" 27731080 string 6CHN 6-channel Fasttracker module sound data 2774!:mime audio/x-mod 2775#audio/x-fasttracker-module 2776>0 string >\0 Title: "%s" 27771080 string 8CHN 8-channel Fasttracker module sound data 2778!:mime audio/x-mod 2779#audio/x-fasttracker-module 2780>0 string >\0 Title: "%s" 27811080 string CD81 8-channel Octalyser module sound data 2782!:mime audio/x-mod 2783#audio/x-octalysertracker-module 2784>0 string >\0 Title: "%s" 27851080 string OKTA 8-channel Octalyzer module sound data 2786!:mime audio/x-mod 2787#audio/x-octalysertracker-module 2788>0 string >\0 Title: "%s" 2789# Not good enough. 2790#1082 string CH 2791#>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data 27921080 string 16CN 16-channel Taketracker module sound data 2793!:mime audio/x-mod 2794#audio/x-taketracker-module 2795>0 string >\0 Title: "%s" 27961080 string 32CN 32-channel Taketracker module sound data 2797!:mime audio/x-mod 2798#audio/x-taketracker-module 2799>0 string >\0 Title: "%s" 2800 2801# TOC sound files -Trevor Johnson <trevor@jpj.net> 2802# 28030 string TOC TOC sound file 2804 2805# sidfiles <pooka@iki.fi> 2806# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24 28070 string SIDPLAY\ INFOFILE Sidplay info file 2808 28090 string PSID PlaySID v2.2+ (AMIGA) sidtune 2810>4 beshort >0 w/ header v%d, 2811>14 beshort =1 single song, 2812>14 beshort >1 %d songs, 2813>16 beshort >0 default song: %d 2814>0x16 string >\0 name: "%s" 2815>0x36 string >\0 author: "%s" 2816>0x56 string >\0 copyright: "%s" 2817 28180 string RSID RSID sidtune PlaySID compatible 2819>4 beshort >0 w/ header v%d, 2820>14 beshort =1 single song, 2821>14 beshort >1 %d songs, 2822>16 beshort >0 default song: %d 2823>0x16 string >\0 name: "%s" 2824>0x36 string >\0 author: "%s" 2825>0x56 string >\0 copyright: "%s" 2826 2827# IRCAM sound files - Michael Pruett <michael@68k.org> 2828# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html 28290 belong 0x64a30100 IRCAM file (VAX little-endian) 28300 belong 0x0001a364 IRCAM file (VAX big-endian) 28310 belong 0x64a30200 IRCAM file (Sun big-endian) 28320 belong 0x0002a364 IRCAM file (Sun little-endian) 28330 belong 0x64a30300 IRCAM file (MIPS little-endian) 28340 belong 0x0003a364 IRCAM file (MIPS big-endian) 28350 belong 0x64a30400 IRCAM file (NeXT big-endian) 28360 belong 0x64a30400 IRCAM file (NeXT big-endian) 28370 belong 0x0004a364 IRCAM file (NeXT little-endian) 2838 2839# NIST SPHERE <mpruett@sgi.com> 28400 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file 2841 2842# Sample Vision <mpruett@sgi.com> 28430 string SOUND\ SAMPLE\ DATA\ Sample Vision file 2844 2845# Audio Visual Research <tonigonenstein@users.sourceforge.net> 28460 string 2BIT Audio Visual Research file, 2847>12 beshort =0 mono, 2848>12 beshort =-1 stereo, 2849>14 beshort x %d bits 2850>16 beshort =0 unsigned, 2851>16 beshort =-1 signed, 2852>22 belong&0x00ffffff x %d Hz, 2853>18 beshort =0 no loop, 2854>18 beshort =-1 loop, 2855>21 ubyte <128 note %d, 2856>22 byte =0 replay 5.485 KHz 2857>22 byte =1 replay 8.084 KHz 2858>22 byte =2 replay 10.971 KHz 2859>22 byte =3 replay 16.168 KHz 2860>22 byte =4 replay 21.942 KHz 2861>22 byte =5 replay 32.336 KHz 2862>22 byte =6 replay 43.885 KHz 2863>22 byte =7 replay 47.261 KHz 2864 2865# SGI SoundTrack <mpruett@sgi.com> 28660 string _SGI_SoundTrack SGI SoundTrack project file 2867# ID3 version 2 tags <waschk@informatik.uni-rostock.de> 28680 string ID3 Audio file with ID3 version 2 2869>3 byte x \b.%d 2870>4 byte x \b.%d 2871>>5 byte &0x80 \b, unsynchronized frames 2872>>5 byte &0x40 \b, extended header 2873>>5 byte &0x20 \b, experimental 2874>>5 byte &0x10 \b, footer present 2875>(6.I) indirect x \b, contains: 2876 2877# NSF (NES sound file) magic 28780 string NESM\x1a NES Sound File 2879>14 string >\0 ("%s" by 2880>46 string >\0 %s, copyright 2881>78 string >\0 %s), 2882>5 byte x version %d, 2883>6 byte x %d tracks, 2884>122 byte&0x2 =1 dual PAL/NTSC 2885>122 byte&0x1 =1 PAL 2886>122 byte&0x1 =0 NTSC 2887 2888# Type: SNES SPC700 sound files 2889# From: Josh Triplett <josh@freedesktop.org> 28900 string SNES-SPC700\ Sound\ File\ Data\ v SNES SPC700 sound file 2891>&0 string 0.30 \b, version %s 2892>>0x23 byte 0x1B \b, without ID666 tag 2893>>0x23 byte 0x1A \b, with ID666 tag 2894>>>0x2E string >\0 \b, song "%.32s" 2895>>>0x4E string >\0 \b, game "%.32s" 2896 2897# Impulse tracker module (audio/x-it) 28980 string IMPM Impulse Tracker module sound data - 2899!:mime audio/x-mod 2900>4 string >\0 "%s" 2901>40 leshort !0 compatible w/ITv%x 2902>42 leshort !0 created w/ITv%x 2903 2904# Imago Orpheus module (audio/x-imf) 290560 string IM10 Imago Orpheus module sound data - 2906>0 string >\0 "%s" 2907 2908# From <collver1@attbi.com> 2909# These are the /etc/magic entries to decode modules, instruments, and 2910# samples in Impulse Tracker's native format. 2911 29120 string IMPS Impulse Tracker Sample 2913>18 byte &2 16 bit 2914>18 byte ^2 8 bit 2915>18 byte &4 stereo 2916>18 byte ^4 mono 29170 string IMPI Impulse Tracker Instrument 2918>28 leshort !0 ITv%x 2919>30 byte !0 %d samples 2920 2921# Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files 2922# From <collver1@attbi.com> 29230 string LM8953 Yamaha TX Wave 2924>22 byte 0x49 looped 2925>22 byte 0xC9 non-looped 2926>23 byte 1 33kHz 2927>23 byte 2 50kHz 2928>23 byte 3 16kHz 2929 2930# scream tracker: file(1) magic for Scream Tracker sample files 2931# 2932# From <collver1@attbi.com> 293376 string SCRS Scream Tracker Sample 2934>0 byte 1 sample 2935>0 byte 2 adlib melody 2936>0 byte >2 adlib drum 2937>31 byte &2 stereo 2938>31 byte ^2 mono 2939>31 byte &4 16bit little endian 2940>31 byte ^4 8bit 2941>30 byte 0 unpacked 2942>30 byte 1 packed 2943 2944# audio 2945# From: Cory Dikkers <cdikkers@swbell.net> 29460 string MMD0 MED music file, version 0 29470 string MMD1 OctaMED Pro music file, version 1 29480 string MMD3 OctaMED Soundstudio music file, version 3 29490 string OctaMEDCmpr OctaMED Soundstudio compressed file 29500 string MED MED_Song 29510 string SymM Symphonie SymMOD music file 2952# 29530 string THX AHX version 2954>3 byte =0 1 module data 2955>3 byte =1 2 module data 2956# 29570 string OKTASONG Oktalyzer module data 2958# 29590 string DIGI\ Booster\ module\0 %s 2960>20 byte >0 %c 2961>>21 byte >0 \b%c 2962>>>22 byte >0 \b%c 2963>>>>23 byte >0 \b%c 2964>610 string >\0 \b, "%s" 2965# 29660 string DBM0 DIGI Booster Pro Module 2967>4 byte >0 V%X. 2968>>5 byte x \b%02X 2969>16 string >\0 \b, "%s" 2970# 29710 string FTMN FaceTheMusic module 2972>16 string >\0d \b, "%s" 2973 2974# From: <doj@cubic.org> 2003-06-24 29750 string AMShdr\32 Velvet Studio AMS Module v2.2 29760 string Extreme Extreme Tracker AMS Module v1.3 29770 string DDMF Xtracker DMF Module 2978>4 byte x v%i 2979>0xD string >\0 Title: "%s" 2980>0x2B string >\0 Composer: "%s" 29810 string DSM\32 Dynamic Studio Module DSM 29820 string SONG DigiTrekker DTM Module 29830 string DMDL DigiTrakker MDL Module 29840 string PSM\32 Protracker Studio PSM Module 298544 string PTMF Poly Tracker PTM Module 2986>0 string >\32 Title: "%s" 29870 string MT20 MadTracker 2.0 Module MT2 29880 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD 29890 string RTMM RTM Module 29900x426 string MaDoKaN96 XMS Adlib Module 2991>0 string >\0 Composer: "%s" 29920 string AMF AMF Module 2993>4 string >\0 Title: "%s" 29940 string MODINFO1 Open Cubic Player Module Inforation MDZ 29950 string Extended\40Instrument: Fast Tracker II Instrument 2996 2997# From: Takeshi Hamasaki <hma@syd.odn.ne.jp> 2998# NOA Nancy Codec file 29990 string \210NOA\015\012\032 NOA Nancy Codec Movie file 3000# Yamaha SMAF format 30010 string MMMD Yamaha SMAF file 3002# Sharp Jisaku Melody format for PDC 30030 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody 3004>20 string Ver01.00 Ver. 1.00 3005>>32 byte x , %d tracks 3006 3007# Free lossless audio codec <http://flac.sourceforge.net> 3008# From: Przemyslaw Augustyniak <silvathraec@rpg.pl> 30090 string fLaC FLAC audio bitstream data 3010!:mime audio/x-flac 3011>4 byte&0x7f >0 \b, unknown version 3012>4 byte&0x7f 0 \b 3013# some common bits/sample values 3014>>20 beshort&0x1f0 0x030 \b, 4 bit 3015>>20 beshort&0x1f0 0x050 \b, 6 bit 3016>>20 beshort&0x1f0 0x070 \b, 8 bit 3017>>20 beshort&0x1f0 0x0b0 \b, 12 bit 3018>>20 beshort&0x1f0 0x0f0 \b, 16 bit 3019>>20 beshort&0x1f0 0x170 \b, 24 bit 3020>>20 byte&0xe 0x0 \b, mono 3021>>20 byte&0xe 0x2 \b, stereo 3022>>20 byte&0xe 0x4 \b, 3 channels 3023>>20 byte&0xe 0x6 \b, 4 channels 3024>>20 byte&0xe 0x8 \b, 5 channels 3025>>20 byte&0xe 0xa \b, 6 channels 3026>>20 byte&0xe 0xc \b, 7 channels 3027>>20 byte&0xe 0xe \b, 8 channels 3028# some common sample rates 3029>>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz 3030>>17 belong&0xfffff0 0x0bb800 \b, 48 kHz 3031>>17 belong&0xfffff0 0x07d000 \b, 32 kHz 3032>>17 belong&0xfffff0 0x056220 \b, 22.05 kHz 3033>>17 belong&0xfffff0 0x05dc00 \b, 24 kHz 3034>>17 belong&0xfffff0 0x03e800 \b, 16 kHz 3035>>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz 3036>>17 belong&0xfffff0 0x02ee00 \b, 12 kHz 3037>>17 belong&0xfffff0 0x01f400 \b, 8 kHz 3038>>17 belong&0xfffff0 0x177000 \b, 96 kHz 3039>>17 belong&0xfffff0 0x0fa000 \b, 64 kHz 3040>>21 byte&0xf >0 \b, >4G samples 3041>>21 byte&0xf 0 \b 3042>>>22 belong >0 \b, %u samples 3043>>>22 belong 0 \b, length unknown 3044 3045# (ISDN) VBOX voice message file (Wolfram Kleff) 30460 string VBOX VBOX voice message data 3047 3048# ReBorn Song Files (.rbs) 3049# David J. Singer <doc@deadvirgins.org.uk> 30508 string RB40 RBS Song file 3051>29 string ReBorn created by ReBorn 3052>37 string Propellerhead created by ReBirth 3053 3054# Synthesizer Generator and Kimwitu share their file format 30550 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data 3056# Kimwitu++ uses a slightly different magic 30570 string A#S#C#S#S#L#HUB Kimwitu++ data 3058 3059# From "Simon Hosie 30600 string TFMX-SONG TFMX module sound data 3061 3062# Monkey's Audio compressed audio format (.ape) 3063# From danny.milo@gmx.net (Danny Milosavljevic) 3064# New version from Abel Cheung <abel (@) oaka.org> 30650 string MAC\040 Monkey's Audio compressed format 3066!:mime audio/x-ape 3067>4 uleshort >0x0F8B version %d 3068>>(0x08.l) uleshort =1000 with fast compression 3069>>(0x08.l) uleshort =2000 with normal compression 3070>>(0x08.l) uleshort =3000 with high compression 3071>>(0x08.l) uleshort =4000 with extra high compression 3072>>(0x08.l) uleshort =5000 with insane compression 3073>>(0x08.l+18) uleshort =1 \b, mono 3074>>(0x08.l+18) uleshort =2 \b, stereo 3075>>(0x08.l+20) ulelong x \b, sample rate %d 3076>4 uleshort <0x0F8C version %d 3077>>6 uleshort =1000 with fast compression 3078>>6 uleshort =2000 with normal compression 3079>>6 uleshort =3000 with high compression 3080>>6 uleshort =4000 with extra high compression 3081>>6 uleshort =5000 with insane compression 3082>>10 uleshort =1 \b, mono 3083>>10 uleshort =2 \b, stereo 3084>>12 ulelong x \b, sample rate %d 3085 3086# adlib sound files 3087# From Gurkan Sengun <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu 30880 string RAWADATA RdosPlay RAW 3089 30901068 string RoR AMUSIC Adlib Tracker 3091 30920 string JCH EdLib 3093 30940 string mpu401tr MPU-401 Trakker 3095 30960 string SAdT Surprise! Adlib Tracker 3097>4 byte x Version %d 3098 30990 string XAD! eXotic ADlib 3100 31010 string ofTAZ! eXtra Simple Music 3102 3103# Spectrum 128 tunes (.ay files). 3104# From: Emanuel Haupt <ehaupt@critical.ch> 31050 string ZXAYEMUL Spectrum 128 tune 3106 31070 string \0BONK BONK, 3108#>5 byte x version %d 3109>14 byte x %d channel(s), 3110>15 byte =1 lossless, 3111>15 byte =0 lossy, 3112>16 byte x mid-side 3113 3114384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones) 3115 3116# format VQF (proprietary codec for sound) 3117# some infos on the header file available at : 3118# http://www.twinvq.org/english/technology_format.html 31190 string TWIN97012000 VQF data 3120>27 short 0 \b, Mono 3121>27 short 1 \b, Stereo 3122>31 short >0 \b, %d kbit/s 3123>35 short >0 \b, %d kHz 3124 3125# Nelson A. de Oliveira (naoliv@gmail.com) 3126# .eqf 31270 string Winamp\ EQ\ library\ file %s 3128# it will match only versions like v<digit>.<digit> 3129# Since I saw only eqf files with version v1.1 I think that it's OK 3130>23 string x \b%.4s 3131# .preset 31320 string [Equalizer\ preset] XMMS equalizer preset 3133# .m3u 31340 search/1 #EXTM3U M3U playlist text 3135# .pls 31360 search/1 [playlist] PLS playlist text 3137# licq.conf 31381 string [licq] LICQ configuration file 3139 3140# Atari ST audio files by Dirk Jagdmann <doj@cubic.org> 31410 string ICE! SNDH Atari ST music 31420 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music 3143 3144# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com> 31450 string MP+ Musepack audio 3146!:mime audio/x-musepack 3147>3 byte 255 \b, SV pre8 3148>3 byte&0xF 0x6 \b, SV 6 3149>3 byte&0xF 0x8 \b, SV 8 3150>3 byte&0xF 0x7 \b, SV 7 3151>>3 byte&0xF0 0x0 \b.0 3152>>3 byte&0xF0 0x10 \b.1 3153>>3 byte&0xF0 240 \b.15 3154>>10 byte&0xF0 0x0 \b, no profile 3155>>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental' 3156>>10 byte&0xF0 0x50 \b, quality 0 3157>>10 byte&0xF0 0x60 \b, quality 1 3158>>10 byte&0xF0 0x70 \b, quality 2 (Telephone) 3159>>10 byte&0xF0 0x80 \b, quality 3 (Thumb) 3160>>10 byte&0xF0 0x90 \b, quality 4 (Radio) 3161>>10 byte&0xF0 0xA0 \b, quality 5 (Standard) 3162>>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme) 3163>>10 byte&0xF0 0xC0 \b, quality 7 (Insane) 3164>>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead) 3165>>10 byte&0xF0 0xE0 \b, quality 9 3166>>10 byte&0xF0 0xF0 \b, quality 10 3167>>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05 3168>>27 byte 102 \b, Beta 1.02 3169>>27 byte 104 \b, Beta 1.04 3170>>27 byte 105 \b, Alpha 1.05 3171>>27 byte 106 \b, Beta 1.06 3172>>27 byte 110 \b, Release 1.1 3173>>27 byte 111 \b, Alpha 1.11 3174>>27 byte 112 \b, Beta 1.12 3175>>27 byte 113 \b, Alpha 1.13 3176>>27 byte 114 \b, Beta 1.14 3177>>27 byte 115 \b, Alpha 1.15 3178 3179# IMY 3180# from http://filext.com/detaillist.php?extdetail=IMY 3181# http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm 3182# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html 3183# http://www.wx800.com/msg/download/irda/iMelody.pdf 31840 string BEGIN:IMELODY iMelody Ringtone Format 3185 3186# From: "Mateus Caruccio" <mateus@caruccio.com> 3187# guitar pro v3,4,5 from http://filext.com/file-extension/gp3 31880 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature 3189 3190# From: "Leslie P. Polzer" <leslie.polzer@gmx.net> 319160 string SONG SoundFX Module sound file 3192 3193# Type: Adaptive Multi-Rate Codec 3194# URL: http://filext.com/detaillist.php?extdetail=AMR 3195# From: Russell Coker <russell@coker.com.au> 31960 string #!AMR Adaptive Multi-Rate Codec (GSM telephony) 3197 3198# Type: SuperCollider 3 Synth Definition File Format 3199# From: Mario Lang <mlang@debian.org> 32000 string SCgf SuperCollider3 Synth Definition file, 3201>4 belong x version %d 3202 3203# Type: True Audio Lossless Audio 3204# URL: http://wiki.multimedia.cx/index.php?title=True_Audio 3205# From: Mike Melanson <mike@multimedia.cx> 32060 string TTA1 True Audio Lossless Audio 3207 3208# Type: WavPack Lossless Audio 3209# URL: http://wiki.multimedia.cx/index.php?title=WavPack 3210# From: Mike Melanson <mike@multimedia.cx> 32110 string wvpk WavPack Lossless Audio 3212 3213#---------------------------------------------------------------- 3214# $File: basis,v 1.4 2009/09/19 16:28:08 christos Exp $ 3215# basis: file(1) magic for BBx/Pro5-files 3216# Oliver Dammer <dammer@olida.de> 2005/11/07 3217# http://www.basis.com business-basic-files. 3218# 32190 string \074\074bbx\076\076 BBx 3220>7 string \000 indexed file 3221>7 string \001 serial file 3222>7 string \002 keyed file 3223>>13 short 0 (sort) 3224>7 string \004 program 3225>>18 byte x (LEVEL %d) 3226>>>23 string >\000 psaved 3227>7 string \006 mkeyed file 3228>>13 short 0 (sort) 3229>>8 string \000 (mkey) 3230 3231#------------------------------------------------------------------------------ 3232# $File: bflt,v 1.4 2009/09/19 16:28:08 christos Exp $ 3233# bFLT: file(1) magic for BFLT uclinux binary files 3234# 3235# From Philippe De Muyter <phdm@macqel.be> 3236# 32370 string bFLT BFLT executable 3238>4 belong x - version %ld 3239>4 belong 4 3240>>36 belong&0x1 0x1 ram 3241>>36 belong&0x2 0x2 gotpic 3242>>36 belong&0x4 0x4 gzip 3243>>36 belong&0x8 0x8 gzdata 3244# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files 3245# http://ftg.lbl.gov/checkpoint 32460 string C\0\0\0R\0\0\0 BLCR 3247>16 lelong 1 x86 3248>16 lelong 3 alpha 3249>16 lelong 5 x86-64 3250>16 lelong 7 ARM 3251>8 lelong x context data (little endian, version %d) 3252# Uncomment the following only of your "file" program supports "search" 3253#>0 search/1024 VMA\06 for kernel 3254#>>&1 byte x %d. 3255#>>&2 byte x %d. 3256#>>&3 byte x %d 32570 string \0\0\0C\0\0\0R BLCR 3258>16 belong 2 SPARC 3259>16 belong 4 ppc 3260>16 belong 6 ppc64 3261>16 belong 7 ARMEB 3262>16 belong 8 SPARC64 3263>8 belong x context data (big endian, version %d) 3264# Uncomment the following only of your "file" program supports "search" 3265#>0 search/1024 VMA\06 for kernel 3266#>>&1 byte x %d. 3267#>>&2 byte x \b%d. 3268#>>&3 byte x \b%d 3269 3270#------------------------------------------------------------------------------ 3271# $File: blender,v 1.5 2009/09/19 16:28:08 christos Exp $ 3272# blender: file(1) magic for Blender 3D related files 3273# 3274# Native format rule v1.2. For questions use the developers list 3275# http://lists.blender.org/mailman/listinfo/bf-committers 3276# GLOB chunk was moved near start and provides subversion info since 2.42 3277 32780 string =BLENDER Blender3D, 3279>7 string =_ saved as 32-bits 3280>>8 string =v little endian 3281>>>9 byte x with version %c. 3282>>>10 byte x \b%c 3283>>>11 byte x \b%c 3284>>>0x40 string =GLOB \b. 3285>>>>0x58 leshort x \b%.4d 3286>>8 string =V big endian 3287>>>9 byte x with version %c. 3288>>>10 byte x \b%c 3289>>>11 byte x \b%c 3290>>>0x40 string =GLOB \b. 3291>>>>0x58 beshort x \b%.4d 3292>7 string =- saved as 64-bits 3293>>8 string =v little endian 3294>>9 byte x with version %c. 3295>>10 byte x \b%c 3296>>11 byte x \b%c 3297>>0x44 string =GLOB \b. 3298>>>0x60 leshort x \b%.4d 3299>>8 string =V big endian 3300>>>9 byte x with version %c. 3301>>>10 byte x \b%c 3302>>>11 byte x \b%c 3303>>>0x44 string =GLOB \b. 3304>>>>0x60 beshort x \b%.4d 3305 3306# Scripts that run in the embedded Python interpreter 33070 string #!BPY Blender3D BPython script 3308 3309#------------------------------------------------------------------------------ 3310# $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $ 3311# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine 3312# 3313# Note that this 0407 conflicts with several other a.out formats... 3314# 3315# XXX - should this be redone with "be" and "le", so that it works on 3316# little-endian machines as well? If so, what's the deal with 3317# "VAX-order" and "VAX-order2"? 3318# 3319#0 long 0407 68K Blit (standalone) executable 3320#0 short 0407 VAX-order2 68K Blit (standalone) executable 33210 short 03401 VAX-order 68K Blit (standalone) executable 33220 long 0406 68k Blit mpx/mux executable 33230 short 0406 VAX-order2 68k Blit mpx/mux executable 33240 short 03001 VAX-order 68k Blit mpx/mux executable 3325# Need more values for WE32 DMD executables. 3326# Note that 0520 is the same as COFF 3327#0 short 0520 tty630 layers executable 3328 3329#------------------------------------------------------------------------------ 3330# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $ 3331# i80960 b.out objects and archives 3332# 33330 long 0x10d i960 b.out relocatable object 3334>16 long >0 not stripped 3335# 3336# b.out archive (hp-rt on i960) 33370 string =!<bout> b.out archive 3338>8 string __.SYMDEF random library 3339 3340#------------------------------------------------------------------------------ 3341# $File: bsdi,v 1.6 2013/01/09 22:37:24 christos Exp $ 3342# bsdi: file(1) magic for BSD/OS (from BSDI) objects 3343# Some object/executable formats use the same magic numbers as are used 3344# in other OSes; those are handled by entries in aout. 3345# 3346 33470 lelong 0314 386 compact demand paged pure executable 3348>16 lelong >0 not stripped 3349>32 byte 0x6a (uses shared libs) 3350 3351# same as in SunOS 4.x, except for static shared libraries 33520 belong&077777777 0600413 sparc demand paged 3353>0 byte &0x80 3354>>20 belong <4096 shared library 3355>>20 belong =4096 dynamically linked executable 3356>>20 belong >4096 dynamically linked executable 3357>0 byte ^0x80 executable 3358>16 belong >0 not stripped 3359>36 belong 0xb4100001 (uses shared libs) 3360 33610 belong&077777777 0600410 sparc pure 3362>0 byte &0x80 dynamically linked executable 3363>0 byte ^0x80 executable 3364>16 belong >0 not stripped 3365>36 belong 0xb4100001 (uses shared libs) 3366 33670 belong&077777777 0600407 sparc 3368>0 byte &0x80 dynamically linked executable 3369>0 byte ^0x80 executable 3370>16 belong >0 not stripped 3371>36 belong 0xb4100001 (uses shared libs) 3372# Chiasmus is a encryption standard developed by the German Federal 3373# Office for Information Security (Bundesamt fuer Sicherheit in der 3374# Informationstechnik). 3375 3376# Extension: .xia 33770 string XIA1 Chiasmus encrypted data 3378 3379# Extension: .xis 33800 string XIS Chiasmus key 3381 3382#------------------------------------------------------------------------------ 3383# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $ 3384# BTSnoop: file(1) magic for BTSnoop files 3385# 3386# From <marcel@holtmann.org> 33870 string btsnoop\0 BTSnoop 3388>8 belong x version %d, 3389>12 belong 1001 Unencapsulated HCI 3390>12 belong 1002 HCI UART (H4) 3391>12 belong 1003 HCI BCSP 3392>12 belong 1004 HCI Serial (H5) 3393>>12 belong x type %d 3394 3395#------------------------------------------------------------------------------ 3396# $File: c64,v 1.5 2009/09/19 16:28:08 christos Exp $ 3397# c64: file(1) magic for various commodore 64 related files 3398# 3399# From: Dirk Jagdmann <doj@cubic.org> 3400 34010x16500 belong 0x12014100 D64 Image 34020x16500 belong 0x12014180 D71 Image 34030x61800 belong 0x28034400 D81 Image 34040 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image 34050 belong 0x43154164 X64 Image 3406 34070 string GCR-1541 GCR Image 3408>8 byte x version: %i 3409>9 byte x tracks: %i 3410 34119 string PSUR ARC archive (c64) 34122 string -LH1- LHA archive (c64) 3413 34140 string C64File PC64 Emulator file 3415>8 string >\0 "%s" 34160 string C64Image PC64 Freezer Image 3417 34180 beshort 0x38CD C64 PCLink Image 34190 string CBM\144\0\0 Power 64 C64 Emulator Snapshot 3420 34210 belong 0xFF424CFF WRAptor packer (c64) 3422 34230 string C64S\x20tape\x20file T64 tape Image 3424>32 leshort x Version:0x%x 3425>36 leshort !0 Entries:%i 3426>40 string x Name:%.24s 3427 34280 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 3429>32 leshort x Version:0x%x 3430>36 leshort !0 Entries:%i 3431>40 string x Name:%.24s 3432 34330 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 3434>32 leshort x Version:0x%x 3435>36 leshort !0 Entries:%i 3436>40 string x Name:%.24s 3437 3438#------------------------------------------------------------------------------ 3439# $File: cad,v 1.11 2011/12/08 12:12:46 rrt Exp $ 3440# autocad: file(1) magic for cad files 3441# 3442 3443# AutoCAD DWG versions R13/R14 (www.autodesk.com) 3444# Written December 01, 2003 by Lester Hightower 3445# Based on the DWG File Format Specifications at http://www.opendwg.org/ 34460 string \101\103\061\060\061 AutoCAD 3447>5 string \062\000\000\000\000 DWG ver. R13 3448>5 string \064\000\000\000\000 DWG ver. R14 3449 3450# Microstation DGN/CIT Files (www.bentley.com) 3451# Last updated July 29, 2005 by Lester Hightower 3452# DGN is the default file extension of Microstation/Intergraph CAD files. 3453# CIT is the proprietary raster format (similar to TIFF) used to attach 3454# raster underlays to Microstation DGN (vector) drawings. 3455# 3456# http://www.wotsit.org/search.asp 3457# http://filext.com/detaillist.php?extdetail=DGN 3458# http://filext.com/detaillist.php?extdetail=CIT 3459# 3460# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2 3461# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928 3462# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 3463# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F 34640 string \010\011\376 Microstation 3465>3 string \002 3466>>30 string \026\105 DGNFile 3467>>30 string \034\105 DGNFile 3468>>30 string \073\107 DGNFile 3469>>30 string \073\110 DGNFile 3470>>30 string \106\107 DGNFile 3471>>30 string \110\103 DGNFile 3472>>30 string \120\104 DGNFile 3473>>30 string \172\104 DGNFile 3474>>30 string \172\105 DGNFile 3475>>30 string \172\106 DGNFile 3476>>30 string \234\106 DGNFile 3477>>30 string \273\105 DGNFile 3478>>30 string \306\106 DGNFile 3479>>30 string \310\104 DGNFile 3480>>30 string \341\104 DGNFile 3481>>30 string \372\103 DGNFile 3482>>30 string \372\104 DGNFile 3483>>30 string \372\106 DGNFile 3484>>30 string \376\103 DGNFile 3485>4 string \030\000\000 CITFile 3486>4 string \030\000\003 CITFile 3487 3488# AutoCad, from Nahuel Greco 3489# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com) 34900 string AC1012 DWG AutoDesk AutoCad (release 12) 34910 string AC1013 DWG AutoDesk AutoCad (release 13) 34920 string AC1014 DWG AutoDesk AutoCad (release 14) 3493# A new version of AutoCAD DWG 3494# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, 3495# ICQ 358572321) 3496# From various sources like: 3497# http://autodesk.blogs.com/between_the_lines/autocad-release-history.html 34980 string AC1018 DWG AutoDesk AutoCAD 2004/2005/2006 34990 string AC1021 DWG AutoDesk AutoCAD 2007/2008/2009 35000 string AC1024 DWG AutoDesk AutoCAD 2010/2011 3501 3502# KOMPAS 2D drawing from ASCON 3503# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor 3504# gathered nor specification 3505# ASCON http://ascon.net/main/ in English, 3506# http://ascon.ru/ main site in Russian 3507# Extension is CDW for drawing and FRW for fragment of drawing 3508# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, 3509# ICQ 358572321, http://vkontakte.ru/id16076543) 3510# From: 3511# http://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292 3512# (in russian) and my experiments 35130 string KF 3514>2 belong 0x4E00000C Kompas drawing 12.0 SP1 3515>2 belong 0x4D00000C Kompas drawing 12.0 3516>2 belong 0x3200000B Kompas drawing 11.0 SP1 3517>2 belong 0x3100000B Kompas drawing 11.0 3518>2 belong 0x2310000A Kompas drawing 10.0 SP1 3519>2 belong 0x2110000A Kompas drawing 10.0 3520>2 belong 0x08000009 Kompas drawing 9.0 SP1 3521>2 belong 0x05000009 Kompas drawing 9.0 3522>2 belong 0x33010008 Kompas drawing 8+ 3523>2 belong 0x1A000008 Kompas drawing 8.0 3524>2 belong 0x2C010107 Kompas drawing 7+ 3525>2 belong 0x05000007 Kompas drawing 7.0 3526>2 belong 0x32000006 Kompas drawing 6+ 3527>2 belong 0x09000006 Kompas drawing 6.0 3528>2 belong 0x5C009005 Kompas drawing 5.11R03 3529>2 belong 0x54009005 Kompas drawing 5.11R02 3530>2 belong 0x51009005 Kompas drawing 5.11R01 3531>2 belong 0x22009005 Kompas drawing 5.10R03 3532>2 belong 0x22009005 Kompas drawing 5.10R02 mar 3533>2 belong 0x21009005 Kompas drawing 5.10R02 febr 3534>2 belong 0x19009005 Kompas drawing 5.10R01 3535>2 belong 0xF4008005 Kompas drawing 5.9R01.003 3536>2 belong 0x1C008005 Kompas drawing 5.9R01.002 3537>2 belong 0x11008005 Kompas drawing 5.8R01.003 3538 3539# CAD: file(1) magic for computer aided design files 3540# Phillip Griffith <phillip dot griffith at gmail dot com> 3541# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications. 3542# 35430 belong 0x08051700 Bentley/Intergraph MicroStation DGN cell library 35440 belong 0x0809fe02 Bentley/Intergraph MicroStation DGN vector CAD 35450 belong 0xc809fe02 Bentley/Intergraph MicroStation DGN vector CAD 35460 beshort 0x0809 Bentley/Intergraph MicroStation 3547>0x02 byte 0xfe 3548>>0x04 beshort 0x1800 CIT raster CAD 35490 string AC1012 AutoDesk AutoCAD R13 35500 string AC1014 AutoDesk AutoCAD R14 35510 string AC1015 AutoDesk AutoCAD R2000 3552 3553# 3DS (3d Studio files) Conflicts with diff output 0x3d '=' 3554#16 beshort 0x3d3d image/x-3ds 3555 3556#------------------------------------------------------------------------------ 3557# $File: cafebabe,v 1.14 2013/02/27 16:59:59 christos Exp $ 3558# Cafe Babes unite! 3559# 3560# Since Java bytecode and Mach-O universal binaries have the same magic number, 3561# the test must be performed in the same "magic" sequence to get both right. 3562# The long at offset 4 in a Mach-O universal binary tells the number of 3563# architectures; the short at offset 4 in a Java bytecode file is the JVM minor 3564# version and the short at offset 6 is the JVM major version. Since there are only 3565# only 18 labeled Mach-O architectures at current, and the first released 3566# Java class format was version 43.0, we can safely choose any number 3567# between 18 and 39 to test the number of architectures against 3568# (and use as a hack). Let's not use 18, because the Mach-O people 3569# might add another one or two as time goes by... 3570# 3571### JAVA START ### 35720 belong 0xcafebabe 3573!:mime application/x-java-applet 3574>4 belong >30 compiled Java class data, 3575>>6 beshort x version %d. 3576>>4 beshort x \b%d 3577# Which is which? 3578#>>4 belong 0x032d (Java 1.0) 3579#>>4 belong 0x032d (Java 1.1) 3580>>4 belong 0x002e (Java 1.2) 3581>>4 belong 0x002f (Java 1.3) 3582>>4 belong 0x0030 (Java 1.4) 3583>>4 belong 0x0031 (Java 1.5) 3584>>4 belong 0x0032 (Java 1.6) 3585 35860 belong 0xcafed00d JAR compressed with pack200, 3587>5 byte x version %d. 3588>4 byte x \b%d 3589!:mime application/x-java-pack200 3590 3591 35920 belong 0xcafed00d JAR compressed with pack200, 3593>5 byte x version %d. 3594>4 byte x \b%d 3595!:mime application/x-java-pack200 3596 3597### JAVA END ### 3598### MACH-O START ### 3599 36000 name mach-o \b [ 3601>0 use mach-o-cpu \b 3602>&(8.L) indirect \b: 3603>0 belong x \b] 3604 36050 belong 0xcafebabe 3606>4 belong 1 Mach-O universal binary with 1 architecture: 3607>>8 use mach-o \b 3608>4 belong >1 3609>>4 belong <20 Mach-O universal binary with %ld architectures: 3610>>>8 use mach-o \b 3611>>>28 use mach-o \b 3612>>4 belong >2 3613>>>48 use mach-o \b 3614>>4 belong >3 3615>>>68 use mach-o \b 3616 3617### MACH-O END ### 3618 3619#------------------------------------------------------------------------------ 3620# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $ 3621# CDDB: file(1) magic for CDDB(tm) format CD text data files 3622# 3623# From <steve@gracenote.com> 3624# 3625# This is the /etc/magic entry to decode datafiles as used by 3626# CDDB-enabled CD player applications. 3627# 3628 36290 search/1/w #\040xmcd CDDB(tm) format CD text data 3630 3631#------------------------------------------------------------------------------ 3632# $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $ 3633# chord: file(1) magic for Chord music sheet typesetting utility input files 3634# 3635# From Philippe De Muyter <phdm@macqel.be> 3636# File format is actually free, but many distributed files begin with `{title' 3637# 36380 string {title Chord text file 3639 3640# Type: PowerTab file format 3641# URL: http://www.power-tab.net/ 3642# From: Jelmer Vernooij <jelmer@samba.org> 36430 string ptab\003\000 Power-Tab v3 Tablature File 36440 string ptab\004\000 Power-Tab v4 Tablature File 3645 3646#------------------------------------------------------------------------------ 3647# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $ 3648# cisco: file(1) magic for cisco Systems routers 3649# 3650# Most cisco file-formats are covered by the generic elf code 3651# 3652# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha. 36530 belong&0xffffff00 0x85011400 cisco IOS microcode 3654>7 string >\0 for '%s' 36550 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode 3656>7 string >\0 for '%s' 3657 3658#------------------------------------------------------------------------------ 3659# $File: citrus,v 1.4 2009/09/19 16:28:08 christos Exp $ 3660# citrus locale declaration 3661# 3662 36630 string RuneCT Citrus locale declaration for LC_CTYPE 3664 3665#------------------------------------------------------------------------------ 3666# $File: c-lang,v 1.17 2012/04/28 21:20:26 christos Exp $ 3667# c-lang: file(1) magic for C and related languages programs 3668# 3669 3670# BCPL 36710 search/8192 "libhdr" BCPL source text 3672!:mime text/x-bcpl 36730 search/8192 "LIBHDR" BCPL source text 3674!:mime text/x-bcpl 3675 3676# C 36770 regex \^#include C source text 3678!:mime text/x-c 36790 regex \^char C source text 3680!:mime text/x-c 36810 regex \^double C source text 3682!:mime text/x-c 36830 regex \^extern C source text 3684!:mime text/x-c 36850 regex \^float C source text 3686!:mime text/x-c 36870 regex \^struct C source text 3688!:mime text/x-c 36890 regex \^union C source text 3690!:mime text/x-c 36910 search/8192 main( C source text 3692!:mime text/x-c 3693 3694# C++ 3695# The strength of these rules is increased so they beat the C rules above 36960 regex \^template C++ source text 3697!:strength + 5 3698!:mime text/x-c++ 36990 regex \^virtual C++ source text 3700!:strength + 5 3701!:mime text/x-c++ 37020 regex \^class C++ source text 3703!:strength + 5 3704!:mime text/x-c++ 37050 regex \^public: C++ source text 3706!:strength + 5 3707!:mime text/x-c++ 37080 regex \^private: C++ source text 3709!:strength + 5 3710!:mime text/x-c++ 3711 3712# From: Mikhail Teterin <mi@aldan.algebra.com> 37130 string cscope cscope reference data 3714>7 string x version %.2s 3715# We skip the path here, because it is often long (so file will 3716# truncate it) and mostly redundant. 3717# The inverted index functionality was added some time betwen 3718# versions 11 and 15, so look for -q if version is above 14: 3719>7 string >14 3720>>10 search/100 \ -q\ with inverted index 3721>10 search/100 \ -c\ text (non-compressed) 3722 3723#------------------------------------------------------------------------------ 3724# $File: clarion,v 1.4 2009/09/19 16:28:08 christos Exp $ 3725# clarion: file(1) magic for # Clarion Personal/Professional Developer 3726# (v2 and above) 3727# From: Julien Blache <jb@jblache.org> 3728 3729# Database files 3730# signature 37310 leshort 0x3343 Clarion Developer (v2 and above) data file 3732# attributes 3733>2 leshort &0x0001 \b, locked 3734>2 leshort &0x0004 \b, encrypted 3735>2 leshort &0x0008 \b, memo file exists 3736>2 leshort &0x0010 \b, compressed 3737>2 leshort &0x0040 \b, read only 3738# number of records 3739>5 lelong x \b, %ld records 3740 3741# Memo files 37420 leshort 0x334d Clarion Developer (v2 and above) memo data 3743 3744# Key/Index files 3745# No magic? :( 3746 3747# Help files 37480 leshort 0x49e0 Clarion Developer (v2 and above) help data 3749 3750#------------------------------------------------------------------------------ 3751# $File: claris,v 1.6 2012/06/20 21:19:05 christos Exp $ 3752# claris: file(1) magic for claris 3753# "H. Nanosecond" <aldomel@ix.netcom.com> 3754# Claris Works a word processor, etc. 3755# Version 3.0 3756 3757# .pct claris works clip art files 3758#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 3759#* 3760#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000 3761#null to byte 1000 octal 3762514 string \377\377\377\377\000 3763>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art 3764514 string \377\377\377\377\001 3765>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art 3766 3767# Claris works files 3768# .cwk 37690 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document 3770# .plt 37710 string \020\341\000\000\010\010 Claris Works pallete files .plt 3772 3773# .msp a dictionary file I am not sure about this I have only one .msp file 37740 string \002\271\262\000\040\002\000\164 Claris works dictionary 3775 3776# .usp are user dictionary bits 3777# I am not sure about a magic header: 3778#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151 3779# soh S p f 8 U D sp ^ S cr nl p o d i 3780#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043 3781# a t r i s t sp ^ S cr nl d i v sp # 3782 3783# .mth Thesaurus 3784# starts with \0 but no magic header 3785 3786# .chy Hyphenation file 3787# I am not sure: 000 210 034 000 000 3788 3789# other claris files 3790#./windows/claris/useng.ndx: data 3791#./windows/claris/xtndtran.l32: data 3792#./windows/claris/xtndtran.lst: data 3793#./windows/claris/clworks.lbl: data 3794#./windows/claris/clworks.prf: data 3795#./windows/claris/userd.spl: data 3796 3797#------------------------------------------------------------------------------ 3798# $File: clipper,v 1.6 2009/09/19 16:28:08 christos Exp $ 3799# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper. 3800# 3801# XXX - what byte order does the Clipper use? 3802# 3803# XXX - what's the "!" stuff: 3804# 3805# >18 short !074000,000000 C1 R1 3806# >18 short !074000,004000 C2 R1 3807# >18 short !074000,010000 C3 R1 3808# >18 short !074000,074000 TEST 3809# 3810# I shall assume it's ANDing the field with the first value and 3811# comparing it with the second, and rewrite it as: 3812# 3813# >18 short&074000 000000 C1 R1 3814# >18 short&074000 004000 C2 R1 3815# >18 short&074000 010000 C3 R1 3816# >18 short&074000 074000 TEST 3817# 3818# as SVR3.1's "file" doesn't support anything of the "!074000,000000" 3819# sort, nor does SunOS 4.x, so either it's something Intergraph added 3820# in CLIX, or something AT&T added in SVR3.2 or later, or something 3821# somebody else thought was a good idea; it's not documented in the 3822# man page for this version of "magic", nor does it appear to be 3823# implemented (at least not after I blew off the bogus code to turn 3824# old-style "&"s into new-style "&"s, which just didn't work at all). 3825# 38260 short 0575 CLIPPER COFF executable (VAX #) 3827>20 short 0407 (impure) 3828>20 short 0410 (5.2 compatible) 3829>20 short 0411 (pure) 3830>20 short 0413 (demand paged) 3831>20 short 0443 (target shared library) 3832>12 long >0 not stripped 3833>22 short >0 - version %ld 38340 short 0577 CLIPPER COFF executable 3835>18 short&074000 000000 C1 R1 3836>18 short&074000 004000 C2 R1 3837>18 short&074000 010000 C3 R1 3838>18 short&074000 074000 TEST 3839>20 short 0407 (impure) 3840>20 short 0410 (pure) 3841>20 short 0411 (separate I&D) 3842>20 short 0413 (paged) 3843>20 short 0443 (target shared library) 3844>12 long >0 not stripped 3845>22 short >0 - version %ld 3846>48 long&01 01 alignment trap enabled 3847>52 byte 1 -Ctnc 3848>52 byte 2 -Ctsw 3849>52 byte 3 -Ctpw 3850>52 byte 4 -Ctcb 3851>53 byte 1 -Cdnc 3852>53 byte 2 -Cdsw 3853>53 byte 3 -Cdpw 3854>53 byte 4 -Cdcb 3855>54 byte 1 -Csnc 3856>54 byte 2 -Cssw 3857>54 byte 3 -Cspw 3858>54 byte 4 -Cscb 38594 string pipe CLIPPER instruction trace 38604 string prof CLIPPER instruction profile 3861 3862#------------------------------------------------------------------------------ 3863# $File: commands,v 1.45 2013/02/06 14:18:52 christos Exp $ 3864# commands: file(1) magic for various shells and interpreters 3865# 3866#0 string/w : shell archive or script for antique kernel text 38670 string/wt #!\ /bin/sh POSIX shell script text executable 3868!:mime text/x-shellscript 38690 string/wt #!\ /bin/csh C shell script text executable 3870!:mime text/x-shellscript 3871# korn shell magic, sent by George Wu, gwu@clyde.att.com 38720 string/wt #!\ /bin/ksh Korn shell script text executable 3873!:mime text/x-shellscript 38740 string/wt #!\ /bin/tcsh Tenex C shell script text executable 3875!:mime text/x-shellscript 38760 string/wt #!\ /usr/bin/tcsh Tenex C shell script text executable 3877!:mime text/x-shellscript 38780 string/wt #!\ /usr/local/tcsh Tenex C shell script text executable 3879!:mime text/x-shellscript 38800 string/wt #!\ /usr/local/bin/tcsh Tenex C shell script text executable 3881!:mime text/x-shellscript 3882 3883# 3884# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson) 38850 string/wt #!\ /bin/zsh Paul Falstad's zsh script text executable 3886!:mime text/x-shellscript 38870 string/wt #!\ /usr/bin/zsh Paul Falstad's zsh script text executable 3888!:mime text/x-shellscript 38890 string/wt #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable 3890!:mime text/x-shellscript 38910 string/wt #!\ /usr/local/bin/ash Neil Brown's ash script text executable 3892!:mime text/x-shellscript 38930 string/wt #!\ /usr/local/bin/ae Neil Brown's ae script text executable 3894!:mime text/x-shellscript 38950 string/wt #!\ /bin/nawk new awk script text executable 3896!:mime text/x-nawk 38970 string/wt #!\ /usr/bin/nawk new awk script text executable 3898!:mime text/x-nawk 38990 string/wt #!\ /usr/local/bin/nawk new awk script text executable 3900!:mime text/x-nawk 39010 string/wt #!\ /bin/gawk GNU awk script text executable 3902!:mime text/x-gawk 39030 string/wt #!\ /usr/bin/gawk GNU awk script text executable 3904!:mime text/x-gawk 39050 string/wt #!\ /usr/local/bin/gawk GNU awk script text executable 3906!:mime text/x-gawk 3907# 39080 string/wt #!\ /bin/awk awk script text executable 3909!:mime text/x-awk 39100 string/wt #!\ /usr/bin/awk awk script text executable 3911!:mime text/x-awk 39120 regex =^\\s*BEGIN\\s*[{] awk script text 3913 3914# AT&T Bell Labs' Plan 9 shell 39150 string/wt #!\ /bin/rc Plan 9 rc shell script text executable 3916 3917# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) 39180 string/wt #!\ /bin/bash Bourne-Again shell script text executable 3919!:mime text/x-shellscript 39200 string/wt #!\ /usr/bin/bash Bourne-Again shell script text executable 3921!:mime text/x-shellscript 39220 string/wt #!\ /usr/local/bash Bourne-Again shell script text executable 3923!:mime text/x-shellscript 39240 string/wt #!\ /usr/local/bin/bash Bourne-Again shell script text executable 3925!:mime text/x-shellscript 3926 3927# PHP scripts 3928# Ulf Harnhammar <ulfh@update.uu.se> 39290 search/1/c =<?php PHP script text 3930!:strength + 10 3931!:mime text/x-php 39320 search/1 =<?\n PHP script text 3933!:mime text/x-php 39340 search/1 =<?\r PHP script text 3935!:mime text/x-php 39360 search/1/w #!\ /usr/local/bin/php PHP script text executable 3937!:strength + 10 3938!:mime text/x-php 39390 search/1/w #!\ /usr/bin/php PHP script text executable 3940!:strength + 10 3941!:mime text/x-php 3942# Smarty compiled template, http://www.smarty.net/ 3943# Elan Ruusamae <glen@delfi.ee> 39440 string =<?php\ /*\ Smarty\ version Smarty compiled template 3945>24 regex [0-9.]+ \b, version %s 3946!:mime text/x-php 3947 39480 string Zend\x00 PHP script Zend Optimizer data 3949 39500 string/t $! DCL command file 3951 3952# Type: Pdmenu 3953# URL: http://packages.debian.org/pdmenu 3954# From: Edward Betts <edward@debian.org> 39550 string #!/usr/bin/pdmenu Pdmenu configuration file text 3956 3957#---------------------------------------------------------------------------- 3958# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $ 3959# communication 3960 3961# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3. 3962# It is used for conformance testing of communication protocols. 3963# Added by W. Borgert <debacle@debian.org>. 39640 string $Suite TTCN Abstract Test Suite 3965>&1 string $SuiteId 3966>>&1 string >\n %s 3967>&2 string $SuiteId 3968>>&1 string >\n %s 3969>&3 string $SuiteId 3970>>&1 string >\n %s 3971 3972# MSC (message sequence charts) are a formal description technique, 3973# described in ITU-T Z.120, mainly used for communication protocols. 3974# Added by W. Borgert <debacle@debian.org>. 39750 string mscdocument Message Sequence Chart (document) 39760 string msc Message Sequence Chart (chart) 39770 string submsc Message Sequence Chart (subchart) 3978#------------------------------------------------------------------------------ 3979# $File: compress,v 1.49 2011/12/07 22:04:27 christos Exp $ 3980# compress: file(1) magic for pure-compression formats (no archives) 3981# 3982# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc. 3983# 3984# Formats for various forms of compressed data 3985# Formats for "compress" proper have been moved into "compress.c", 3986# because it tries to uncompress it to figure out what's inside. 3987 3988# standard unix compress 39890 string \037\235 compress'd data 3990!:mime application/x-compress 3991!:apple LZIVZIVU 3992>2 byte&0x80 >0 block compressed 3993>2 byte&0x1f x %d bits 3994 3995# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver) 3996# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 3997# * Original filename is only at offset 10 if "extra field" absent 3998# * Produce shorter output - notably, only report compression methods 3999# other than 8 ("deflate", the only method defined in RFC 1952). 40000 string \037\213 gzip compressed data 4001!:mime application/x-gzip 4002>2 byte <8 \b, reserved method 4003>2 byte >8 \b, unknown method 4004>3 byte &0x01 \b, ASCII 4005>3 byte &0x02 \b, has CRC 4006>3 byte &0x04 \b, extra field 4007>3 byte&0xC =0x08 4008>>10 string x \b, was "%s" 4009>3 byte &0x10 \b, has comment 4010>9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT) 4011>9 byte =0x01 \b, from Amiga 4012>9 byte =0x02 \b, from VMS 4013>9 byte =0x03 \b, from Unix 4014>9 byte =0x04 \b, from VM/CMS 4015>9 byte =0x05 \b, from Atari 4016>9 byte =0x06 \b, from HPFS filesystem (OS/2, NT) 4017>9 byte =0x07 \b, from MacOS 4018>9 byte =0x08 \b, from Z-System 4019>9 byte =0x09 \b, from CP/M 4020>9 byte =0x0A \b, from TOPS/20 4021>9 byte =0x0B \b, from NTFS filesystem (NT) 4022>9 byte =0x0C \b, from QDOS 4023>9 byte =0x0D \b, from Acorn RISCOS 4024>3 byte &0x10 \b, comment 4025>3 byte &0x20 \b, encrypted 4026>4 ledate >0 \b, last modified: %s 4027>8 byte 2 \b, max compression 4028>8 byte 4 \b, max speed 4029 4030# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis 40310 string \037\036 packed data 4032!:mime application/octet-stream 4033>2 belong >1 \b, %d characters originally 4034>2 belong =1 \b, %d character originally 4035# 4036# This magic number is byte-order-independent. 40370 short 0x1f1f old packed data 4038!:mime application/octet-stream 4039 4040# XXX - why *two* entries for "compacted data", one of which is 4041# byte-order independent, and one of which is byte-order dependent? 4042# 40430 short 0x1fff compacted data 4044!:mime application/octet-stream 4045# This string is valid for SunOS (BE) and a matching "short" is listed 4046# in the Ultrix (LE) magic file. 40470 string \377\037 compacted data 4048!:mime application/octet-stream 40490 short 0145405 huf output 4050!:mime application/octet-stream 4051 4052# bzip2 40530 string BZh bzip2 compressed data 4054!:mime application/x-bzip2 4055>3 byte >47 \b, block size = %c00k 4056 4057# lzip 40580 string LZIP lzip compressed data 4059!:mime application/x-lzip 4060>4 byte x \b, version: %d 4061 4062# squeeze and crunch 4063# Michael Haardt <michael@cantor.informatik.rwth-aachen.de> 40640 beshort 0x76FF squeezed data, 4065>4 string x original name %s 40660 beshort 0x76FE crunched data, 4067>2 string x original name %s 40680 beshort 0x76FD LZH compressed data, 4069>2 string x original name %s 4070 4071# Freeze 40720 string \037\237 frozen file 2.1 40730 string \037\236 frozen file 1.0 (or gzip 0.5) 4074 4075# SCO compress -H (LZH) 40760 string \037\240 SCO compress -H (LZH) data 4077 4078# European GSM 06.10 is a provisional standard for full-rate speech 4079# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse 4080# excitation/long term prediction) coding at 13 kbit/s. 4081# 4082# There's only a magic nibble (4 bits); that nibble repeats every 33 4083# bytes. This isn't suited for use, but maybe we can use it someday. 4084# 4085# This will cause very short GSM files to be declared as data and 4086# mismatches to be declared as data too! 4087#0 byte&0xF0 0xd0 data 4088#>33 byte&0xF0 0xd0 4089#>66 byte&0xF0 0xd0 4090#>99 byte&0xF0 0xd0 4091#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio 4092 4093# bzip a block-sorting file compressor 4094# by Julian Seward <sewardj@cs.man.ac.uk> and others 4095# 4096#0 string BZ bzip compressed data 4097#>2 byte x \b, version: %c 4098#>3 string =1 \b, compression block size 100k 4099#>3 string =2 \b, compression block size 200k 4100#>3 string =3 \b, compression block size 300k 4101#>3 string =4 \b, compression block size 400k 4102#>3 string =5 \b, compression block size 500k 4103#>3 string =6 \b, compression block size 600k 4104#>3 string =7 \b, compression block size 700k 4105#>3 string =8 \b, compression block size 800k 4106#>3 string =9 \b, compression block size 900k 4107 4108# lzop from <markus.oberhumer@jk.uni-linz.ac.at> 41090 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data 4110>9 beshort <0x0940 4111>>9 byte&0xf0 =0x00 - version 0. 4112>>9 beshort&0x0fff x \b%03x, 4113>>13 byte 1 LZO1X-1, 4114>>13 byte 2 LZO1X-1(15), 4115>>13 byte 3 LZO1X-999, 4116## >>22 bedate >0 last modified: %s, 4117>>14 byte =0x00 os: MS-DOS 4118>>14 byte =0x01 os: Amiga 4119>>14 byte =0x02 os: VMS 4120>>14 byte =0x03 os: Unix 4121>>14 byte =0x05 os: Atari 4122>>14 byte =0x06 os: OS/2 4123>>14 byte =0x07 os: MacOS 4124>>14 byte =0x0A os: Tops/20 4125>>14 byte =0x0B os: WinNT 4126>>14 byte =0x0E os: Win32 4127>9 beshort >0x0939 4128>>9 byte&0xf0 =0x00 - version 0. 4129>>9 byte&0xf0 =0x10 - version 1. 4130>>9 byte&0xf0 =0x20 - version 2. 4131>>9 beshort&0x0fff x \b%03x, 4132>>15 byte 1 LZO1X-1, 4133>>15 byte 2 LZO1X-1(15), 4134>>15 byte 3 LZO1X-999, 4135## >>25 bedate >0 last modified: %s, 4136>>17 byte =0x00 os: MS-DOS 4137>>17 byte =0x01 os: Amiga 4138>>17 byte =0x02 os: VMS 4139>>17 byte =0x03 os: Unix 4140>>17 byte =0x05 os: Atari 4141>>17 byte =0x06 os: OS/2 4142>>17 byte =0x07 os: MacOS 4143>>17 byte =0x0A os: Tops/20 4144>>17 byte =0x0B os: WinNT 4145>>17 byte =0x0E os: Win32 4146 4147# 4.3BSD-Quasijarus Strong Compression 4148# http://minnie.tuhs.org/Quasijarus/compress.html 41490 string \037\241 Quasijarus strong compressed data 4150 4151# From: Cory Dikkers <cdikkers@swbell.net> 41520 string XPKF Amiga xpkf.library compressed data 41530 string PP11 Power Packer 1.1 compressed data 41540 string PP20 Power Packer 2.0 compressed data, 4155>4 belong 0x09090909 fast compression 4156>4 belong 0x090A0A0A mediocre compression 4157>4 belong 0x090A0B0B good compression 4158>4 belong 0x090A0C0C very good compression 4159>4 belong 0x090A0C0D best compression 4160 4161# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at) 4162# http://www.7-zip.org or DOC/7zFormat.txt 4163# 41640 string 7z\274\257\047\034 7-zip archive data, 4165>6 byte x version %d 4166>7 byte x \b.%d 4167!:mime application/x-7z-compressed 4168 4169# Type: LZMA 41700 lelong&0xffffff =0x5d 4171>12 leshort =0xff LZMA compressed data, 4172>>5 lequad =0xffffffffffffffff streamed 4173>>5 lequad !0xffffffffffffffff non-streamed, size %lld 4174!:mime application/x-lzma 4175 4176# http://tukaani.org/xz/xz-file-format.txt 41770 ustring \xFD7zXZ\x00 XZ compressed data 4178!:mime application/x-xz 4179 4180# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt 41810 string LRZI LRZIP compressed data 4182>4 byte x - version %d 4183>5 byte x \b.%d 4184!:mime application/x-lrzip 4185 4186# AFX compressed files (Wolfram Kleff) 41872 string -afx- AFX compressed file data 4188 4189# Supplementary magic data for the file(1) command to support 4190# rzip(1). The format is described in magic(5). 4191# 4192# Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with 4193# this file. 4194# 41950 string RZIP rzip compressed data 4196>4 byte x - version %d 4197>5 byte x \b.%d 4198>6 belong x (%d bytes) 4199 42000 string ArC\x01 FreeArc archive <http://freearc.org> 4201 4202# Type: DACT compressed files 42030 long 0x444354C3 DACT compressed data 4204>4 byte >-1 (version %i. 4205>5 byte >-1 %i. 4206>6 byte >-1 %i) 4207>7 long >0 , original size: %i bytes 4208>15 long >30 , block size: %i bytes 4209 4210#------------------------------------------------------------------------------ 4211# $File: console,v 1.19 2013/02/06 14:18:52 christos Exp $ 4212# Console game magic 4213# Toby Deshane <hac@shoelace.digivill.net> 4214# ines: file(1) magic for Marat's iNES Nintendo Entertainment System 4215# ROM dump format 4216 42170 string NES\032 iNES ROM dump, 4218>4 byte x %dx16k PRG 4219>5 byte x \b, %dx8k CHR 4220>6 byte&0x01 =0x1 \b, [Vert.] 4221>6 byte&0x01 =0x0 \b, [Horiz.] 4222>6 byte&0x02 =0x2 \b, [SRAM] 4223>6 byte&0x04 =0x4 \b, [Trainer] 4224>6 byte&0x04 =0x8 \b, [4-Scr] 4225 4226#------------------------------------------------------------------------------ 4227# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format 4228# 42290x104 belong 0xCEED6666 Gameboy ROM: 4230>0x134 string >\0 "%.16s" 4231>0x146 byte 0x03 \b,[SGB] 4232>0x147 byte 0x00 \b, [ROM ONLY] 4233>0x147 byte 0x01 \b, [ROM+MBC1] 4234>0x147 byte 0x02 \b, [ROM+MBC1+RAM] 4235>0x147 byte 0x03 \b, [ROM+MBC1+RAM+BATT] 4236>0x147 byte 0x05 \b, [ROM+MBC2] 4237>0x147 byte 0x06 \b, [ROM+MBC2+BATTERY] 4238>0x147 byte 0x08 \b, [ROM+RAM] 4239>0x147 byte 0x09 \b, [ROM+RAM+BATTERY] 4240>0x147 byte 0x0B \b, [ROM+MMM01] 4241>0x147 byte 0x0C \b, [ROM+MMM01+SRAM] 4242>0x147 byte 0x0D \b, [ROM+MMM01+SRAM+BATT] 4243>0x147 byte 0x0F \b, [ROM+MBC3+TIMER+BATT] 4244>0x147 byte 0x10 \b, [ROM+MBC3+TIMER+RAM+BATT] 4245>0x147 byte 0x11 \b, [ROM+MBC3] 4246>0x147 byte 0x12 \b, [ROM+MBC3+RAM] 4247>0x147 byte 0x13 \b, [ROM+MBC3+RAM+BATT] 4248>0x147 byte 0x19 \b, [ROM+MBC5] 4249>0x147 byte 0x1A \b, [ROM+MBC5+RAM] 4250>0x147 byte 0x1B \b, [ROM+MBC5+RAM+BATT] 4251>0x147 byte 0x1C \b, [ROM+MBC5+RUMBLE] 4252>0x147 byte 0x1D \b, [ROM+MBC5+RUMBLE+SRAM] 4253>0x147 byte 0x1E \b, [ROM+MBC5+RUMBLE+SRAM+BATT] 4254>0x147 byte 0x1F \b, [Pocket Camera] 4255>0x147 byte 0xFD \b, [Bandai TAMA5] 4256>0x147 byte 0xFE \b, [Hudson HuC-3] 4257>0x147 byte 0xFF \b, [Hudson HuC-1] 4258 4259>0x148 byte 0 \b, ROM: 256Kbit 4260>0x148 byte 1 \b, ROM: 512Kbit 4261>0x148 byte 2 \b, ROM: 1Mbit 4262>0x148 byte 3 \b, ROM: 2Mbit 4263>0x148 byte 4 \b, ROM: 4Mbit 4264>0x148 byte 5 \b, ROM: 8Mbit 4265>0x148 byte 6 \b, ROM: 16Mbit 4266>0x148 byte 0x52 \b, ROM: 9Mbit 4267>0x148 byte 0x53 \b, ROM: 10Mbit 4268>0x148 byte 0x54 \b, ROM: 12Mbit 4269 4270>0x149 byte 1 \b, RAM: 16Kbit 4271>0x149 byte 2 \b, RAM: 64Kbit 4272>0x149 byte 3 \b, RAM: 128Kbit 4273>0x149 byte 4 \b, RAM: 1Mbit 4274 4275#>0x14e long x \b, CRC: %x 4276 4277#------------------------------------------------------------------------------ 4278# genesis: file(1) magic for the Sega MegaDrive/Genesis raw ROM format 4279# 42800x100 string SEGA Sega MegaDrive/Genesis raw ROM dump 4281>0x120 string >\0 Name: "%.16s" 4282>0x110 string >\0 %.16s 4283>0x1B0 string RA with SRAM 4284 4285#------------------------------------------------------------------------------ 4286# genesis: file(1) magic for the Super MegaDrive ROM dump format 4287# 42880x280 string EAGN Super MagicDrive ROM dump 4289>0 byte x %dx16k blocks 4290>2 byte 0 \b, last in series or standalone 4291>2 byte >0 \b, split ROM 4292>8 byte 0xAA 4293>9 byte 0xBB 4294 4295#------------------------------------------------------------------------------ 4296# genesis: file(1) alternate magic for the Super MegaDrive ROM dump format 4297# 42980x280 string EAMG Super MagicDrive ROM dump 4299>0 byte x %dx16k blocks 4300>2 byte x \b, last in series or standalone 4301>8 byte 0xAA 4302>9 byte 0xBB 4303 4304#------------------------------------------------------------------------------ 4305# smsgg: file(1) magic for Sega Master System and Game Gear ROM dumps 4306# 4307# Does not detect all images. Very preliminary guesswork. Need more data 4308# on format. 4309# 4310# FIXME: need a little more info...;P 4311# 4312#0 byte 0xF3 4313#>1 byte 0xED Sega Master System/Game Gear ROM dump 4314#>1 byte 0x31 Sega Master System/Game Gear ROM dump 4315#>1 byte 0xDB Sega Master System/Game Gear ROM dump 4316#>1 byte 0xAF Sega Master System/Game Gear ROM dump 4317#>1 byte 0xC3 Sega Master System/Game Gear ROM dump 4318 4319#------------------------------------------------------------------------------ 4320# dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format 4321# 43220 belong 0x21068028 Sega Dreamcast VMU game image 43230 string LCDi Dream Animator file 4324 4325#------------------------------------------------------------------------------ 4326# v64: file(1) uncertain magic for the V64 format N64 ROM dumps 4327# 43280 belong 0x37804012 V64 Nintendo 64 ROM dump 4329 4330# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 4331# Nintendo .nds 4332192 string \044\377\256Qi\232 Nintendo DS Game ROM Image 4333# Nintendo .gba 43340 string \056\000\000\352$\377\256Qi Nintendo Game Boy Advance ROM Image 4335 4336#------------------------------------------------------------------------------ 4337# msx: file(1) magic for MSX game cartridge dumps 4338# Too simple - MPi 4339#0 beshort 0x4142 MSX game cartridge dump 4340 4341#------------------------------------------------------------------------------ 4342# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) : 43430 string PS-X\ EXE Sony Playstation executable 4344# Area: 4345>113 string x (%s) 4346 4347#------------------------------------------------------------------------------ 4348# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>) 43490 string XBEH XBE, Microsoft Xbox executable 4350# probabilistic checks whether signed or not 4351>0x0004 ulelong =0x0 4352>>&2 ulelong =0x0 4353>>>&2 ulelong =0x0 \b, not signed 4354>0x0004 ulelong >0 4355>>&2 ulelong >0 4356>>>&2 ulelong >0 \b, signed 4357# expect base address of 0x10000 4358>0x0104 ulelong =0x10000 4359>>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions 4360>>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007 4361>>>(0x0118-0x0FF60) ulelong >0 (regions: 4362>>>>(0x0118-0x0FF60) ulelong &0x00000001 NA 4363>>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan 4364>>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World 4365>>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer 4366>>>(0x0118-0x0FF60) ulelong >0 \b) 4367 4368# -------------------------------- 4369# Microsoft Xbox data file formats 43700 string XIP0 XIP, Microsoft Xbox data 43710 string XTF0 XTF, Microsoft Xbox data 4372 4373# Atari Lynx cartridge dump (EXE/BLL header) 4374# From: "Stefan A. Haubenthal" <polluks@web.de> 4375 4376# Double-check that the image type matches too, 0x8008 conflicts with 4377# 8 character OMF-86 object file headers. 43780 beshort 0x8008 4379>6 string BS93 Lynx homebrew cartridge 4380>>2 beshort x \b, RAM start $%04x 4381>6 string LYNX Lynx cartridge 4382>>2 beshort x \b, RAM start $%04x 4383 4384# Opera file system that is used on the 3DO console 4385# From: Serge van den Boom <svdb@stack.nl> 43860 string \x01ZZZZZ\x01 3DO "Opera" file system 4387 4388# From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu 43890 string GBS Nintendo Gameboy Music/Audio Data 439012 string GameBoy\ Music\ Module Nintendo Gameboy Music Module 4391 4392# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at> 43930 string PPF30 Playstation Patch File version 3.0 4394>5 byte 0 \b, PPF 1.0 patch 4395>5 byte 1 \b, PPF 2.0 patch 4396>5 byte 2 \b, PPF 3.0 patch 4397>>56 byte 0 \b, Imagetype BIN (any) 4398>>56 byte 1 \b, Imagetype GI (PrimoDVD) 4399>>57 byte 0 \b, Blockcheck disabled 4400>>57 byte 1 \b, Blockcheck enabled 4401>>58 byte 0 \b, Undo data not available 4402>>58 byte 1 \b, Undo data available 4403>6 string x \b, description: %s 4404 44050 string PPF20 Playstation Patch File version 2.0 4406>5 byte 0 \b, PPF 1.0 patch 4407>5 byte 1 \b, PPF 2.0 patch 4408>>56 lelong >0 \b, size of file to patch %d 4409>6 string x \b, description: %s 4410 44110 string PPF10 Playstation Patch File version 1.0 4412>5 byte 0 \b, Simple Encoding 4413>6 string x \b, description: %s 4414 4415# From: Daniel Dawson <ddawson@icehouse.net> 4416# SNES9x .smv "movie" file format. 44170 string SMV\x1A SNES9x input recording 4418>0x4 lelong x \b, version %d 4419# version 4 is latest so far 4420>0x4 lelong <5 4421>>0x8 ledate x \b, recorded at %s 4422>>0xc lelong >0 \b, rerecorded %d times 4423>>0x10 lelong x \b, %d frames long 4424>>0x14 byte >0 \b, data for controller(s): 4425>>>0x14 byte &0x1 #1 4426>>>0x14 byte &0x2 #2 4427>>>0x14 byte &0x4 #3 4428>>>0x14 byte &0x8 #4 4429>>>0x14 byte &0x10 #5 4430>>0x15 byte ^0x1 \b, begins from snapshot 4431>>0x15 byte &0x1 \b, begins from reset 4432>>0x15 byte ^0x2 \b, NTSC standard 4433>>0x15 byte &0x2 \b, PAL standard 4434>>0x17 byte &0x1 \b, settings: 4435# WIP1Timing not used as of version 4 4436>>>0x4 lelong <4 4437>>>>0x17 byte &0x2 WIP1Timing 4438>>>0x17 byte &0x4 Left+Right 4439>>>0x17 byte &0x8 VolumeEnvX 4440>>>0x17 byte &0x10 FakeMute 4441>>>0x17 byte &0x20 SyncSound 4442# New flag as of version 4 4443>>>0x4 lelong >3 4444>>>>0x17 byte &0x80 NoCPUShutdown 4445>>0x4 lelong <4 4446>>>0x18 lelong >0x23 4447>>>>0x20 leshort !0 4448>>>>>0x20 lestring16 x \b, metadata: "%s" 4449>>0x4 lelong >3 4450>>>0x24 byte >0 \b, port 1: 4451>>>>0x24 byte 1 joypad 4452>>>>0x24 byte 2 mouse 4453>>>>0x24 byte 3 SuperScope 4454>>>>0x24 byte 4 Justifier 4455>>>>0x24 byte 5 multitap 4456>>>0x24 byte >0 \b, port 2: 4457>>>>0x25 byte 1 joypad 4458>>>>0x25 byte 2 mouse 4459>>>>0x25 byte 3 SuperScope 4460>>>>0x25 byte 4 Justifier 4461>>>>0x25 byte 5 multitap 4462>>>0x18 lelong >0x43 4463>>>>0x40 leshort !0 4464>>>>>0x40 lestring16 x \b, metadata: "%s" 4465>>0x17 byte &0x40 \b, ROM: 4466>>>(0x18.l-26) lelong x CRC32 0x%08x 4467>>>(0x18.l-23) string x "%s" 4468 4469# Type: scummVM savegame files 4470# From: Sven Hartge <debian@ds9.argh.org> 44710 string SCVM ScummVM savegame 4472>12 string >\0 "%s" 4473 4474#------------------------------------------------------------------------------ 4475# $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $ 4476# convex: file(1) magic for Convex boxes 4477# 4478# Convexes are big-endian. 4479# 4480# /*\ 4481# * Below are the magic numbers and tests added for Convex. 4482# * Added at beginning, because they are expected to be used most. 4483# \*/ 44840 belong 0507 Convex old-style object 4485>16 belong >0 not stripped 44860 belong 0513 Convex old-style demand paged executable 4487>16 belong >0 not stripped 44880 belong 0515 Convex old-style pre-paged executable 4489>16 belong >0 not stripped 44900 belong 0517 Convex old-style pre-paged, non-swapped executable 4491>16 belong >0 not stripped 44920 belong 0x011257 Core file 4493# 4494# The following are a series of dump format magic numbers. Each one 4495# corresponds to a drastically different dump format. The first on is 4496# the original dump format on a 4.1 BSD or earlier file system. The 4497# second marks the change between the 4.1 file system and the 4.2 file 4498# system. The Third marks the changing of the block size from 1K 4499# to 2K to be compatible with an IDC file system. The fourth indicates 4500# a dump that is dependent on Convex Storage Manager, because data in 4501# secondary storage is not physically contained within the dump. 4502# The restore program uses these number to determine how the data is 4503# to be extracted. 4504# 450524 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible) 450624 belong =60014 dump format, Convex Storage Manager by-reference dump 4507# 4508# what follows is a bunch of bit-mask checks on the flags field of the opthdr. 4509# If there is no `=' sign, assume just checking for whether the bit is set? 4510# 45110 belong 0601 Convex SOFF 4512>88 belong&0x000f0000 =0x00000000 c1 4513>88 belong &0x00010000 c2 4514>88 belong &0x00020000 c2mp 4515>88 belong &0x00040000 parallel 4516>88 belong &0x00080000 intrinsic 4517>88 belong &0x00000001 demand paged 4518>88 belong &0x00000002 pre-paged 4519>88 belong &0x00000004 non-swapped 4520>88 belong &0x00000008 POSIX 4521# 4522>84 belong &0x80000000 executable 4523>84 belong &0x40000000 object 4524>84 belong&0x20000000 =0 not stripped 4525>84 belong&0x18000000 =0x00000000 native fpmode 4526>84 belong&0x18000000 =0x10000000 ieee fpmode 4527>84 belong&0x18000000 =0x18000000 undefined fpmode 4528# 45290 belong 0605 Convex SOFF core 4530# 45310 belong 0607 Convex SOFF checkpoint 4532>88 belong&0x000f0000 =0x00000000 c1 4533>88 belong &0x00010000 c2 4534>88 belong &0x00020000 c2mp 4535>88 belong &0x00040000 parallel 4536>88 belong &0x00080000 intrinsic 4537>88 belong &0x00000008 POSIX 4538# 4539>84 belong&0x18000000 =0x00000000 native fpmode 4540>84 belong&0x18000000 =0x10000000 ieee fpmode 4541>84 belong&0x18000000 =0x18000000 undefined fpmode 4542 4543#------------------------------------------------------------------------------ 4544# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $ 4545# cracklib: file (1) magic for cracklib v2.7 4546 45470 lelong 0x70775631 Cracklib password index, little endian 4548>4 long >0 (%i words) 4549>4 long 0 ("64-bit") 4550>>8 long >-1 (%i words) 45510 belong 0x70775631 Cracklib password index, big endian 4552>4 belong >-1 (%i words) 4553# really bellong 0x0000000070775631 45540 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit") 4555>12 belong >0 (%i words) 4556 4557# ---------------------------------------------------------------------------- 4558# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $ 4559# ctags: file (1) magic for Exuberant Ctags files 4560# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de> 45610 search/1 =!_TAG Exuberant Ctags tag file text 4562 4563#------------------------------------------------------------------------------ 4564# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $ 4565# file(1) magic(5) data for cubemaps Martin Erik Werner <martinerikwerner@gmail.com> 4566# 45670 string ACMP Map file for the AssaultCube FPS game 45680 string CUBE Map file for cube and cube2 engine games 45690 string MAPZ) Map file for the Blood Frontier/Red Eclipse FPS games 4570 4571#------------------------------------------------------------------------------ 4572# $File: cups,v 1.2 2012/11/02 21:50:29 christos Exp $ 4573# Cups: file(1) magic for the cups raster file format 4574# From: Laurent Martelli <martellilaurent@gmail.com> 4575# http://www.cups.org/documentation.php/spec-raster.html 4576# 4577 45780 name cups-be 4579>280 lelong x \b, %d 4580>284 lelong x \bx%d dpi 4581>376 lelong x \b, %dx 4582>380 lelong x \b%d pixels 4583>388 lelong x %d bits/color 4584>392 lelong x %d bits/pixel 4585>400 lelong 0 ColorOrder=Chunky 4586>400 lelong 1 ColorOrder=Banded 4587>400 lelong 2 ColorOrder=Planar 4588>404 lelong 0 ColorSpace=gray 4589>404 lelong 1 ColorSpace=RGB 4590>404 lelong 2 ColorSpace=RGBA 4591>404 lelong 3 ColorSpace=black 4592>404 lelong 4 ColorSpace=CMY 4593>404 lelong 5 ColorSpace=YMC 4594>404 lelong 6 ColorSpace=CMYK 4595>404 lelong 7 ColorSpace=YMCK 4596>404 lelong 8 ColorSpace=KCMY 4597>404 lelong 9 ColorSpace=KCMYcm 4598>404 lelong 10 ColorSpace=GMCK 4599>404 lelong 11 ColorSpace=GMCS 4600>404 lelong 12 ColorSpace=WHITE 4601>404 lelong 13 ColorSpace=GOLD 4602>404 lelong 14 ColorSpace=SILVER 4603>404 lelong 15 ColorSpace=CIE XYZ 4604>404 lelong 16 ColorSpace=CIE Lab 4605>404 lelong 17 ColorSpace=RGBW 4606>404 lelong 18 ColorSpace=sGray 4607>404 lelong 19 ColorSpace=sRGB 4608>404 lelong 20 ColorSpace=AdobeRGB 4609 4610# Cups Raster image format, Big Endian 46110 string RaS 4612>3 string t Cups Raster version 1, Big Endian 4613>3 string 2 Cups Raster version 2, Big Endian 4614>3 string 3 Cups Raster version 3, Big Endian 4615!:mime application/vnd.cups-raster 4616>0 use ^cups-be 4617 4618 4619# Cups Raster image format, Little Endian 46201 string SaR 4621>0 string t Cups Raster version 1, Little Endian 4622>0 string 2 Cups Raster version 2, Little Endian 4623>0 string 3 Cups Raster version 3, Little Endian 4624!:mime application/vnd.cups-raster 4625>0 use \^cups-be 4626 4627#------------------------------------------------------------------------------ 4628# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $ 4629# dact: file(1) magic for DACT compressed files 4630# 46310 long 0x444354C3 DACT compressed data 4632>4 byte >-1 (version %i. 4633>5 byte >-1 $BS%i. 4634>6 byte >-1 $BS%i) 4635>7 long >0 $BS, original size: %i bytes 4636>15 long >30 $BS, block size: %i bytes 4637 4638#------------------------------------------------------------------------------ 4639# $File: database,v 1.33 2013/03/09 22:36:00 christos Exp $ 4640# database: file(1) magic for various databases 4641# 4642# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) 4643# 4644# 4645# GDBM magic numbers 4646# Will be maintained as part of the GDBM distribution in the future. 4647# <downsj@teeny.org> 46480 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian 4649!:mime application/x-gdbm 46500 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian 4651!:mime application/x-gdbm 46520 string GDBM GNU dbm 2.x database 4653!:mime application/x-gdbm 4654# 4655# Berkeley DB 4656# 4657# Ian Darwin's file /etc/magic files: big/little-endian version. 4658# 4659# Hash 1.85/1.86 databases store metadata in network byte order. 4660# Btree 1.85/1.86 databases store the metadata in host byte order. 4661# Hash and Btree 2.X and later databases store the metadata in host byte order. 4662 46630 long 0x00061561 Berkeley DB 4664!:mime application/x-dbm 4665>8 belong 4321 4666>>4 belong >2 1.86 4667>>4 belong <3 1.85 4668>>4 belong >0 (Hash, version %d, native byte-order) 4669>8 belong 1234 4670>>4 belong >2 1.86 4671>>4 belong <3 1.85 4672>>4 belong >0 (Hash, version %d, little-endian) 4673 46740 belong 0x00061561 Berkeley DB 4675>8 belong 4321 4676>>4 belong >2 1.86 4677>>4 belong <3 1.85 4678>>4 belong >0 (Hash, version %d, big-endian) 4679>8 belong 1234 4680>>4 belong >2 1.86 4681>>4 belong <3 1.85 4682>>4 belong >0 (Hash, version %d, native byte-order) 4683 46840 long 0x00053162 Berkeley DB 1.85/1.86 4685>4 long >0 (Btree, version %d, native byte-order) 46860 belong 0x00053162 Berkeley DB 1.85/1.86 4687>4 belong >0 (Btree, version %d, big-endian) 46880 lelong 0x00053162 Berkeley DB 1.85/1.86 4689>4 lelong >0 (Btree, version %d, little-endian) 4690 469112 long 0x00061561 Berkeley DB 4692>16 long >0 (Hash, version %d, native byte-order) 469312 belong 0x00061561 Berkeley DB 4694>16 belong >0 (Hash, version %d, big-endian) 469512 lelong 0x00061561 Berkeley DB 4696>16 lelong >0 (Hash, version %d, little-endian) 4697 469812 long 0x00053162 Berkeley DB 4699>16 long >0 (Btree, version %d, native byte-order) 470012 belong 0x00053162 Berkeley DB 4701>16 belong >0 (Btree, version %d, big-endian) 470212 lelong 0x00053162 Berkeley DB 4703>16 lelong >0 (Btree, version %d, little-endian) 4704 470512 long 0x00042253 Berkeley DB 4706>16 long >0 (Queue, version %d, native byte-order) 470712 belong 0x00042253 Berkeley DB 4708>16 belong >0 (Queue, version %d, big-endian) 470912 lelong 0x00042253 Berkeley DB 4710>16 lelong >0 (Queue, version %d, little-endian) 4711 4712# From Max Bowsher. 471312 long 0x00040988 Berkeley DB 4714>16 long >0 (Log, version %d, native byte-order) 471512 belong 0x00040988 Berkeley DB 4716>16 belong >0 (Log, version %d, big-endian) 471712 lelong 0x00040988 Berkeley DB 4718>16 lelong >0 (Log, version %d, little-endian) 4719 4720# 4721# 4722# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch> 47230 string RRD RRDTool DB 4724>4 string x version %s 4725#---------------------------------------------------------------------- 4726# ROOT: file(1) magic for ROOT databases 4727# 47280 string root\0 ROOT file 4729>4 belong x Version %d 4730>33 belong x (Compression: %d) 4731 4732# XXX: Weak magic. 4733# Alex Ott <ott@jet.msk.su> 4734## Paradox file formats 4735#2 leshort 0x0800 Paradox 4736#>0x39 byte 3 v. 3.0 4737#>0x39 byte 4 v. 3.5 4738#>0x39 byte 9 v. 4.x 4739#>0x39 byte 10 v. 5.x 4740#>0x39 byte 11 v. 5.x 4741#>0x39 byte 12 v. 7.x 4742#>>0x04 byte 0 indexed .DB data file 4743#>>0x04 byte 1 primary index .PX file 4744#>>0x04 byte 2 non-indexed .DB data file 4745#>>0x04 byte 3 non-incrementing secondary index .Xnn file 4746#>>0x04 byte 4 secondary index .Ynn file 4747#>>0x04 byte 5 incrementing secondary index .Xnn file 4748#>>0x04 byte 6 non-incrementing secondary index .XGn file 4749#>>0x04 byte 7 secondary index .YGn file 4750#>>>0x04 byte 8 incrementing secondary index .XGn file 4751 4752## XBase database files 4753# updated by Joerg Jenderek at Feb 2013 4754# http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm 4755# http://www.clicketyclick.dk/databases/xbase/format/dbf.html 4756# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm 4757# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 47580 ubelong&0x0000FFFF <0x00000C20 4759# skip Infocom game Z-machine 4760>2 ubyte >0 4761# skip Androids *.xml 4762>>3 ubyte >0 4763>>>3 ubyte <32 4764# 1 < version VV 4765>>>>0 ubyte >1 4766# skip HELP.CA3 by test for reserved byte ( NULL ) 4767>>>>>27 ubyte 0 4768# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF) 4769#>>>>>30 ubeshort x 30NULL?%x 4770# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 4771>>>>>>24 ubelong&0xffFFFFff >0x01302000 4772# .DBF or .MDX 4773>>>>>>24 ubelong&0xffFFFFff <0x01302001 4774# for Xbase Database file (*.DBF) reserved (NULL) for multi-user 4775>>>>>>>24 ubelong&0xffFFFFff =0 4776# test for 2 reserved NULL bytes,transaction and encryption byte flag 4777>>>>>>>>12 ubelong&0xFFFFfEfE 0 4778# test for MDX flag 4779>>>>>>>>>28 ubyte x 4780>>>>>>>>>28 ubyte&0xf8 0 4781# header size >= 32 4782>>>>>>>>>>8 uleshort >31 4783# skip PIC15736.PCX by test for language driver name or field name 4784>>>>>>>>>>>32 ubyte >0 4785!:mime application/x-dbf 4786#!:mime application/x-dbf; charset=unknown-8bit ?? 4787#!:mime application/x-dbase 4788>>>>>>>>>>>>0 use xbase-type 4789# database file 4790>>>>>>>>>>>>0 ubyte x \b DBF 4791>>>>>>>>>>>>4 lelong 0 \b, no records 4792>>>>>>>>>>>>4 lelong >0 \b, %ld record 4793# plural s appended 4794>>>>>>>>>>>>>4 lelong >1 \bs 4795# http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF 4796# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000) 4797>>>>>>>>>>>>10 uleshort x * %d 4798# file size = records * record size + header size 4799>>>>>>>>>>>>1 ubyte x \b, update-date 4800>>>>>>>>>>>>1 use xbase-date 4801# http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx 4802#>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x 4803# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ? 4804>>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x 4805#>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file 4806>>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX 4807>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT 4808>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer 4809# 1st record offset + 1 = header size 4810>>>>>>>>>>>>8 uleshort >0 4811>>>>>>>>>>>>(8.s+1) ubyte >0 4812>>>>>>>>>>>>>8 uleshort >0 \b, at offset %d 4813>>>>>>>>>>>>>(8.s+1) ubyte >0 4814>>>>>>>>>>>>>>&-1 string >\0 1st record "%s" 4815# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL) 4816>>>>>>>24 ubelong&0x0133f7ff >0 4817# test for reserved NULL byte 4818>>>>>>>>47 ubyte x 4819# test for valid TAG key format (0x10 or 0) 4820>>>>>>>>>559 ubyte&0xeF 0 4821# test MM <= 12 4822>>>>>>>>>45 ubeshort <0x0C20 4823>>>>>>>>>>45 ubyte >0 4824>>>>>>>>>>>46 ubyte <32 4825>>>>>>>>>>>>46 ubyte >0 4826#!:mime application/x-mdx 4827>>>>>>>>>>>>>0 use xbase-type 4828>>>>>>>>>>>>>0 ubyte x \b MDX 4829>>>>>>>>>>>>>1 ubyte x \b, creation-date 4830>>>>>>>>>>>>>1 use xbase-date 4831>>>>>>>>>>>>>44 ubyte x \b, update-date 4832>>>>>>>>>>>>>44 use xbase-date 4833# No.of tags in use (1,2,5,12) 4834>>>>>>>>>>>>>28 uleshort x \b, %d 4835# No. of entries in tag (0x30) 4836>>>>>>>>>>>>>25 ubyte x \b/%d tags 4837# Length of tag 4838>>>>>>>>>>>>>26 ubyte x * %d 4839# 1st tag name_ 4840>>>>>>>>>>>>>548 string x \b, 1st tag "%.11s" 4841# 2nd tag name 4842#>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s" 4843# 4844# Print the xBase names of different version variants 48450 name xbase-type 4846>0 ubyte <2 4847# 1 < version 4848>0 ubyte >1 4849>>0 ubyte 0x02 FoxBase 4850# FoxBase+/dBaseIII+, no memo 4851>>0 ubyte 0x03 FoxBase+/dBase III 4852# dBASE IV no memo file 4853>>0 ubyte 0x04 dBase IV 4854# dBASE V no memo file 4855>>0 ubyte 0x05 dBase V 4856>>0 ubyte 0x30 Visual FoxPro 4857>>0 ubyte 0x31 Visual FoxPro, autoincrement 4858# Visual FoxPro, with field type Varchar or Varbinary 4859>>0 ubyte 0x32 Visual FoxPro, with field type Varchar 4860# dBASE IV SQL, no memo;dbv memo var size (Flagship) 4861>>0 ubyte 0x43 dBase IV, with SQL table 4862# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 4863#>>0 ubyte 0x62 dBase IV, with SQL table 4864# dBASE IV, with memo!! 4865>>0 ubyte 0x7b dBase IV, with memo 4866# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 4867#>>0 ubyte 0x82 dBase IV, with SQL system 4868# FoxBase+/dBaseIII+ with memo .DBT! 4869>>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT 4870# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file 4871>>0 ubyte 0x87 VISUAL OBJECTS, with memo file 4872# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 4873#>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT 4874# dBASE IV with memo! 4875>>0 ubyte 0x8B dBase IV, with memo .DBT 4876# dBase IV with SQL Table,no memo? 4877>>0 ubyte 0x8E dBase IV, with SQL table 4878# .dbv and .dbt memo (Flagship)? 4879>>0 ubyte 0xB3 Flagship 4880# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 4881#>>0 ubyte 0xCA dBase IV with memo .DBT 4882# dBASE IV with SQL table, with memo .DBT 4883>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT 4884# HiPer-Six format;Clipper SIX, with SMT memo file 4885>>0 ubyte 0xE5 Clipper SIX with memo 4886# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 4887#>>0 ubyte 0xF4 dBase IV, with SQL table, with memo 4888>>0 ubyte 0xF5 FoxPro with memo 4889# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 4890#>>0 ubyte 0xFA FoxPro 2.x, with memo 4891# unknown version (should not happen) 4892>>0 default x xBase 4893>>>0 ubyte x (0x%x) 4894# flags in version byte 4895# DBT flag (with dBASE III memo .DBT)!! 4896# >>0 ubyte&0x80 >0 DBT_FLAG=%x 4897# memo flag ?? 4898# >>0 ubyte&0x08 >0 MEMO_FLAG=%x 4899# SQL flag ?? 4900# >>0 ubyte&0x70 >0 SQL_FLAG=%x 4901# test and print the date of xBase .DBF .MDX 49020 name xbase-date 4903# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 4904>0 ubelong x 4905>1 ubyte <13 4906>>1 ubyte >0 4907>>>2 ubyte >0 4908>>>>2 ubyte <32 4909>>>>>0 ubyte x 4910# YY is interpreted as 20YY or 19YY 4911>>>>>>0 ubyte <100 \b %.2d 4912# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY 4913>>>>>>0 ubyte >99 \b %d 4914>>>>>1 ubyte x \b-%d 4915>>>>>2 ubyte x \b-%d 4916 4917# dBase memo files .DBT or .FPT 4918# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx 491916 ubyte <4 4920>16 ubyte !2 4921>>16 ubyte !1 4922# next free block index is positive 4923>>>0 ulelong >0 4924# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size 4925>>>>17 ubelong&0xFFfdFE00 0x00000000 4926# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h 4927>>>>>20 ubelong&0xFF01209B 0x00000000 4928# dBASE III 4929>>>>>>16 ubyte 3 4930# dBASE III DBT 4931>>>>>>>0 use xbase-memo-print 4932# dBASE IV DBT , FoxPro FPT or many PNG , ZIP , DBF garbage 4933>>>>>>16 ubyte 0 4934# dBASE IV DBT with DBF name or DBF garbage 4935>>>>>>>8 ubelong >0x40000000 4936# skip DBF and catch dBASE IV DBT with DBF name and with non big index of next free block 4937>>>>>>>>0 ulelong <0x01010002 4938>>>>>>>>>0 use xbase-memo-print 4939>>>>>>>8 ubelong 0 4940# skip MM*DD*.bin by test for for reserved NULL byte 4941>>>>>>>>508 ubelong 0 4942>>>>>>>>>0 use xbase-memo-print 4943# garbage PCX , ZIP , JAR , XPI 4944>>>>>>>8 default x 4945 4946# Print the information of dBase DBT or FoxPro FPT memo files 49470 name xbase-memo-print 4948>0 ubyte x 4949# test version 4950# memo file 4951>>16 ubyte 3 dBase III DBT 4952>>16 ubyte 0 4953>>>512 ubelong <0x00000003 FoxPro FPT 4954# Size of blocks for FoxPro 4955>>>>6 ubeshort x \b, blocks size %lu 4956# Number of next available block for appending data for FoxPro 4957>>>>0 ubelong =0 \b, next free block index %lu 4958>>>>0 ubelong !0 \b, next free block index %lu 4959>>>512 default x dBase IV DBT 4960# DBF file name without extension 4961>>>>8 string >\0 \b of %-.8s.DBF 4962# size of blocks ; not reliable 0x2020204C 4963#>>>>4 ulelong =0 \b, blocks size %lu 4964>>>>4 ulelong !0 \b, blocks size %lu 4965# Block length found 0 , 512 4966#>>>>20 uleshort =0 \b, block length %u 4967>>>>20 uleshort !0 \b, block length %u 4968# Number of next available block for appending data 4969>>>>0 ulelong =0 \b, next free block index %lu 4970>>>>0 ulelong !0 \b, next free block index %lu 4971>>512 ubelong x 4972>>>512 ubelong =0xFFFF0800 4973>>>>520 string >\0 \b, 1st used item "%s" 4974# FoxPro 4975>>>512 ubelong <3 4976# FoxPro memo 4977>>>>512 ubelong =1 4978>>>>520 string >\0 \b, 1st used item "%s" 4979>>>512 default x 4980# may be deleted memo field 4981>>>>512 string >\0 \b, 1st item "%s" 4982 4983# TODO: 4984# DBASE index file *.NDX 4985# DBASE Compound Index file *.CDX 4986# dBASE IV Printer Driver *.PRF 4987## End of XBase database stuff 4988 4989# MS Access database 49904 string Standard\ Jet\ DB Microsoft Access Database 4991!:mime application/x-msaccess 49924 string Standard\ ACE\ DB Microsoft Access Database 4993!:mime application/x-msaccess 4994 4995# TDB database from Samba et al - Martin Pool <mbp@samba.org> 49960 string TDB\ file TDB database 4997>32 lelong 0x2601196D version 6, little-endian 4998>>36 lelong x hash size %d bytes 4999 5000# SE Linux policy database 50010 lelong 0xf97cff8c SE Linux policy 5002>16 lelong x v%d 5003>20 lelong 1 MLS 5004>24 lelong x %d symbols 5005>28 lelong x %d ocons 5006 5007# ICE authority file data (Wolfram Kleff) 50082 string ICE ICE authority data 5009 5010# X11 Xauthority file (Wolfram Kleff) 501110 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 501211 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 501312 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 501413 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 501514 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 501615 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 501716 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 501817 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 501918 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 5020 5021# From: Maxime Henrion <mux@FreeBSD.org> 5022# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org> 50230 string PGDMP PostgreSQL custom database dump 5024>5 byte x - v%d 5025>6 byte x \b.%d 5026>5 beshort <0x101 \b-0 5027>5 beshort >0x100 5028>>7 byte x \b-%d 5029 5030# Type: Advanced Data Format (ADF) database 5031# URL: http://www.grc.nasa.gov/WWW/cgns/adf/ 5032# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr> 50330 string @(#)ADF\ Database CGNS Advanced Data Format 5034 5035# Tokyo Cabinet magic data 5036# http://tokyocabinet.sourceforge.net/index.html 50370 string ToKyO\ CaBiNeT\n Tokyo Cabinet 5038>14 string x \b (%s) 5039>32 byte 0 \b, Hash 5040!:mime application/x-tokyocabinet-hash 5041>32 byte 1 \b, B+ tree 5042!:mime application/x-tokyocabinet-btree 5043>32 byte 2 \b, Fixed-length 5044!:mime application/x-tokyocabinet-fixed 5045>32 byte 3 \b, Table 5046!:mime application/x-tokyocabinet-table 5047>33 byte &1 \b, [open] 5048>33 byte &2 \b, [fatal] 5049>34 byte x \b, apow=%d 5050>35 byte x \b, fpow=%d 5051>36 byte &0x01 \b, [large] 5052>36 byte &0x02 \b, [deflate] 5053>36 byte &0x04 \b, [bzip] 5054>36 byte &0x08 \b, [tcbs] 5055>36 byte &0x10 \b, [excodec] 5056>40 lequad x \b, bnum=%lld 5057>48 lequad x \b, rnum=%lld 5058>56 lequad x \b, fsiz=%lld 5059 5060# Type: QDBM Quick Database Manager 5061# From: Benoit Sibaud <bsibaud@april.org> 50620 string \\[depot\\]\n\f Quick Database Manager, little endian 50630 string \\[DEPOT\\]\n\f Quick Database Manager, big endian 5064 5065# Type: TokyoCabinet database 5066# URL: http://tokyocabinet.sourceforge.net/ 5067# From: Benoit Sibaud <bsibaud@april.org> 50680 string ToKyO\ CaBiNeT\n TokyoCabinet database 5069>14 string x (version %s) 5070 5071# From: Stephane Blondon http://www.yaal.fr 5072# Database file for Zope (done by FileStorage) 50730 string FS21 Zope Object Database File Storage (data) 5074# Cache file for the database of Zope (done by ClientStorage) 50750 string ZEC3 Zope Object Database Client Cache File (data) 5076 5077# IDA (Interactive Disassembler) database 50780 string IDA1 IDA (Interactive Disassembler) database 5079 5080#------------------------------------------------------------------------------ 5081# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $ 5082# diamond: file(1) magic for Diamond system 5083# 5084# ... diamond is a multi-media mail and electronic conferencing system.... 5085# 5086# XXX - I think it was either renamed Slate, or replaced by Slate.... 5087# 5088# The full deal is too long... 5089#0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document 50900 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document 5091 5092#------------------------------------------------------------------------------ 5093# $File: diff,v 1.14 2012/09/16 23:08:54 christos Exp $ 5094# diff: file(1) magic for diff(1) output 5095# 50960 search/1 diff\ diff output text 5097!:mime text/x-diff 50980 search/1 ***\ diff output text 5099!:mime text/x-diff 51000 search/1 Only\ in\ diff output text 5101!:mime text/x-diff 51020 search/1 Common\ subdirectories:\ diff output text 5103!:mime text/x-diff 5104 51050 search/1 Index: RCS/CVS diff output text 5106!:mime text/x-diff 5107 5108# bsdiff: file(1) magic for bsdiff(1) output 51090 string/b BSDIFF40 bsdiff(1) patch file 5110 5111 5112# unified diff 51130 search/4096 ---\ 5114>&0 search/1024 \n 5115>>&0 search/1 +++\ 5116>>>&0 search/1024 \n 5117>>>>&0 search/1 @@ unified diff output text 5118!:mime text/x-diff 5119!:strength + 90 5120 5121# librsync -- the library for network deltas 5122# 5123# Copyright (C) 2001 by Martin Pool. You may do whatever you want with 5124# this file. 5125# 51260 belong 0x72730236 rdiff network-delta data 5127 51280 belong 0x72730136 rdiff network-delta signature data 5129>4 belong x (block length=%d, 5130>8 belong x signature strength=%d) 5131 5132#------------------------------------------------------------------------------ 5133# $File: digital,v 1.11 2013/01/11 16:45:23 christos Exp $ 5134# Digital UNIX - Info 5135# 51360 string =!<arch>\n________64E Alpha archive 5137>22 string X -- out of date 5138# 5139 51400 leshort 0603 5141>24 leshort 0410 COFF format alpha pure 5142>24 leshort 0413 COFF format alpha demand paged 5143>>22 leshort&030000 !020000 executable 5144>>22 leshort&020000 !0 dynamically linked 5145>>16 lelong !0 not stripped 5146>>16 lelong 0 stripped 5147>>27 byte x - version %d 5148>>26 byte x \b.%d 5149>>28 byte x \b-%d 5150>24 leshort 0407 COFF format alpha object 5151>>22 leshort&030000 020000 shared library 5152>>27 byte x - version %d 5153>>26 byte x \b.%d 5154>>28 byte x \b-%d 5155 5156# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk> 5157# 5158# The actual magic number is just "Core", followed by a 2-byte version 5159# number; however, treating any file that begins with "Core" as a Digital 5160# UNIX core dump file may produce too many false hits, so we include one 5161# byte of the version number as well; DU 5.0 appears only to be up to 5162# version 2. 5163# 51640 string Core\001 Alpha COFF format core dump (Digital UNIX) 5165>24 string >\0 \b, from '%s' 51660 string Core\002 Alpha COFF format core dump (Digital UNIX) 5167>24 string >\0 \b, from '%s' 5168# 5169# The next is incomplete, we could tell more about this format, 5170# but its not worth it. 51710 leshort 0x188 Alpha compressed COFF 51720 leshort 0x18f Alpha u-code object 5173# 5174# 5175# Some other interesting Digital formats, 51760 string \377\377\177 ddis/ddif 51770 string \377\377\174 ddis/dots archive 51780 string \377\377\176 ddis/dtif table data 51790 string \033c\033 LN03 output 51800 long 04553207 X image 5181# 51820 string =!<PDF>!\n profiling data file 5183# 5184# Locale data tables (MIPS and Alpha). 5185# 51860 short 0x0501 locale data table 5187>6 short 0x24 for MIPS 5188>6 short 0x40 for Alpha 5189 5190#------------------------------------------------------------------------------ 5191# $File: dolby,v 1.6 2012/10/31 13:39:42 christos Exp $ 5192# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at> 5193# from http://www.atsc.org/standards/a_52a.pdf 5194# corrections, additions, etc. are always welcome! 5195# 5196# syncword 51970 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream, 5198!:mime audio/vnd.dolby.dd-raw 5199# fscod 5200>4 byte&0xc0 0x00 48 kHz, 5201>4 byte&0xc0 0x40 44.1 kHz, 5202>4 byte&0xc0 0x80 32 kHz, 5203# is this one used for 96 kHz? 5204>4 byte&0xc0 0xc0 reserved frequency, 5205# 5206>5 byte&7 = 0 \b, complete main (CM) 5207>5 byte&7 = 1 \b, music and effects (ME) 5208>5 byte&7 = 2 \b, visually impaired (VI) 5209>5 byte&7 = 3 \b, hearing impaired (HI) 5210>5 byte&7 = 4 \b, dialogue (D) 5211>5 byte&7 = 5 \b, commentary (C) 5212>5 byte&7 = 6 \b, emergency (E) 5213# acmod 5214>6 byte&0xe0 0x00 1+1 front, 5215>6 byte&0xe0 0x20 1 front/0 rear, 5216>6 byte&0xe0 0x40 2 front/0 rear, 5217>6 byte&0xe0 0x60 3 front/0 rear, 5218>6 byte&0xe0 0x80 2 front/1 rear, 5219>6 byte&0xe0 0xa0 3 front/1 rear, 5220>6 byte&0xe0 0xc0 2 front/2 rear, 5221>6 byte&0xe0 0xe0 3 front/2 rear, 5222# lfeon (these may be incorrect) 5223>7 byte&0x40 0x00 LFE off, 5224>7 byte&0x40 0x40 LFE on, 5225# 5226>4 byte&0x3e = 0x00 \b, 32 kbit/s 5227>4 byte&0x3e = 0x02 \b, 40 kbit/s 5228>4 byte&0x3e = 0x04 \b, 48 kbit/s 5229>4 byte&0x3e = 0x06 \b, 56 kbit/s 5230>4 byte&0x3e = 0x08 \b, 64 kbit/s 5231>4 byte&0x3e = 0x0a \b, 80 kbit/s 5232>4 byte&0x3e = 0x0c \b, 96 kbit/s 5233>4 byte&0x3e = 0x0e \b, 112 kbit/s 5234>4 byte&0x3e = 0x10 \b, 128 kbit/s 5235>4 byte&0x3e = 0x12 \b, 160 kbit/s 5236>4 byte&0x3e = 0x14 \b, 192 kbit/s 5237>4 byte&0x3e = 0x16 \b, 224 kbit/s 5238>4 byte&0x3e = 0x18 \b, 256 kbit/s 5239>4 byte&0x3e = 0x1a \b, 320 kbit/s 5240>4 byte&0x3e = 0x1c \b, 384 kbit/s 5241>4 byte&0x3e = 0x1e \b, 448 kbit/s 5242>4 byte&0x3e = 0x20 \b, 512 kbit/s 5243>4 byte&0x3e = 0x22 \b, 576 kbit/s 5244>4 byte&0x3e = 0x24 \b, 640 kbit/s 5245# dsurmod (these may be incorrect) 5246>6 beshort&0x0180 0x0000 Dolby Surround not indicated 5247>6 beshort&0x0180 0x0080 not Dolby Surround encoded 5248>6 beshort&0x0180 0x0100 Dolby Surround encoded 5249>6 beshort&0x0180 0x0180 reserved Dolby Surround mode 5250 5251#------------------------------------------------------------------------------ 5252# $File: dump,v 1.12 2012/11/01 04:26:40 christos Exp $ 5253# dump: file(1) magic for dump file format--for new and old dump filesystems 5254# 5255# We specify both byte orders in order to recognize byte-swapped dumps. 5256# 52570 name new-dump-be 5258>4 bedate x Previous dump %s, 5259>8 bedate x This dump %s, 5260>12 belong >0 Volume %ld, 5261>692 belong 0 Level zero, type: 5262>692 belong >0 Level %d, type: 5263>0 belong 1 tape header, 5264>0 belong 2 beginning of file record, 5265>0 belong 3 map of inodes on tape, 5266>0 belong 4 continuation of file record, 5267>0 belong 5 end of volume, 5268>0 belong 6 map of inodes deleted, 5269>0 belong 7 end of medium (for floppy), 5270>676 string >\0 Label %s, 5271>696 string >\0 Filesystem %s, 5272>760 string >\0 Device %s, 5273>824 string >\0 Host %s, 5274>888 belong >0 Flags %x 5275 52760 name old-dump-be 5277#>4 bedate x Previous dump %s, 5278#>8 bedate x This dump %s, 5279>12 belong >0 Volume %ld, 5280>692 belong 0 Level zero, type: 5281>692 belong >0 Level %d, type: 5282>0 belong 1 tape header, 5283>0 belong 2 beginning of file record, 5284>0 belong 3 map of inodes on tape, 5285>0 belong 4 continuation of file record, 5286>0 belong 5 end of volume, 5287>0 belong 6 map of inodes deleted, 5288>0 belong 7 end of medium (for floppy), 5289>676 string >\0 Label %s, 5290>696 string >\0 Filesystem %s, 5291>760 string >\0 Device %s, 5292>824 string >\0 Host %s, 5293>888 belong >0 Flags %x 5294 52950 name ufs2-dump-be 5296>896 beqdate x Previous dump %s, 5297>904 beqdate x This dump %s, 5298>12 belong >0 Volume %ld, 5299>692 belong 0 Level zero, type: 5300>692 belong >0 Level %d, type: 5301>0 belong 1 tape header, 5302>0 belong 2 beginning of file record, 5303>0 belong 3 map of inodes on tape, 5304>0 belong 4 continuation of file record, 5305>0 belong 5 end of volume, 5306>0 belong 6 map of inodes deleted, 5307>0 belong 7 end of medium (for floppy), 5308>676 string >\0 Label %s, 5309>696 string >\0 Filesystem %s, 5310>760 string >\0 Device %s, 5311>824 string >\0 Host %s, 5312>888 belong >0 Flags %x 5313 531424 belong 60012 new-fs dump file (big endian), 5315>0 use new-dump-be 5316 531724 belong 60011 old-fs dump file (big endian), 5318>0 use old-dump-be 5319 532024 lelong 60012 new-fs dump file (little endian), 5321>0 use \^new-dump-be 5322 532324 lelong 60011 old-fs dump file (little endian), 5324>0 use \^old-dump-be 5325 5326 532724 belong 0x19540119 new-fs dump file (ufs2, big endian), 5328>0 use ufs2-dump-be 5329 533024 lelong 0x19540119 new-fs dump file (ufs2, little endian), 5331>0 use \^ufs2-dump-be 5332 533318 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness), 5334>2 medate x Previous dump %s, 5335>6 medate x This dump %s, 5336>10 leshort >0 Volume %ld, 5337>0 leshort 1 tape header. 5338>0 leshort 2 beginning of file record. 5339>0 leshort 3 map of inodes on tape. 5340>0 leshort 4 continuation of file record. 5341>0 leshort 5 end of volume. 5342>0 leshort 6 map of inodes deleted. 5343>0 leshort 7 end of medium (for floppy). 5344 5345#------------------------------------------------------------------------------ 5346# $File: dyadic,v 1.5 2010/09/20 18:55:20 rrt Exp $ 5347# Dyadic: file(1) magic for Dyalog APL. 5348# 53490 byte 0xaa 5350>1 byte <4 Dyalog APL 5351>>1 byte 0x00 incomplete workspace 5352>>1 byte 0x01 component file 5353>>1 byte 0x02 external variable 5354>>1 byte 0x03 workspace 5355>>2 byte x version %d 5356>>3 byte x .%d 5357 53580 beshort 0xaa03 Dyalog APL 5359>2 byte x workspace type %d 5360>3 byte x subtype %d 5361>7 byte&0x28 0x00 32-bit 5362>7 byte&0x28 0x20 64-bit 5363>7 byte&0x0c 0x00 classic 5364>7 byte&0x0c 0x04 unicode 5365>7 byte&0x88 0x00 big-endian 5366>7 byte&0x88 0x80 little-endian 5367 53680 byte 0xaa Dyalog APL 5369>1 byte 0x00 aplcore 5370>1 byte 0x01 component file 32-bit non-journaled non-checksummed 5371>1 byte 0x02 external variable exclusive 5372>1 byte 0x06 external variable shared 5373>1 byte 0x07 session 5374>1 byte 0x08 mapped file 32-bit 5375>1 byte 0x09 component file 64-bit non-journaled non-checksummed 5376>1 byte 0x0a mapped file 64-bit 5377>1 byte 0x0b component file 32-bit level 1 journaled non-checksummed 5378>1 byte 0x0c component file 64-bit level 1 journaled non-checksummed 5379>1 byte 0x0d component file 32-bit level 1 journaled checksummed 5380>1 byte 0x0e component file 64-bit level 1 journaled checksummed 5381>1 byte 0x0f component file 32-bit level 2 journaled checksummed 5382>1 byte 0x10 component file 64-bit level 2 journaled checksummed 5383>1 byte 0x11 component file 32-bit level 3 journaled checksummed 5384>1 byte 0x12 component file 64-bit level 3 journaled checksummed 5385>1 byte 0x13 component file 32-bit non-journaled checksummed 5386>1 byte 0x14 component file 64-bit non-journaled checksummed 5387>1 byte 0x80 DDB 5388 53890 short 0x6060 Dyalog APL transfer 5390 5391#------------------------------------------------------------------------------ 5392# $File: ebml,v 1.1 2010/07/02 00:07:03 christos Exp $ 5393# ebml: file(1) magic for various Extensible Binary Meta Language 5394# http://www.matroska.org/technical/specs/index.html#track 53950 belong 0x1a45dfa3 EBML file 5396>4 search/b/100 \102\202 5397>>&1 string x \b, creator %.8s 5398 5399#------------------------------------------------------------------------------ 5400# $File: editors,v 1.8 2009/09/19 16:28:09 christos Exp $ 5401# T602 editor documents 5402# by David Necas <yeti@physics.muni.cz> 54030 string @CT\ T602 document data, 5404>4 string 0 Kamenicky 5405>4 string 1 CP 852 5406>4 string 2 KOI8-CS 5407>4 string >2 unknown encoding 5408 5409# Vi IMproved Encrypted file 5410# by David Necas <yeti@physics.muni.cz> 54110 string VimCrypt~ Vim encrypted file data 5412# Vi IMproved Swap file 5413# by Sven Wegener <swegener@gentoo.org> 54140 string b0VIM\ Vim swap file 5415>&0 string >\0 \b, version %s 5416 5417#------------------------------------------------------------------------------ 5418# $File: efi,v 1.4 2009/09/19 16:28:09 christos Exp $ 5419# efi: file(1) magic for Universal EFI binaries 5420 54210 lelong 0x0ef1fab9 5422>4 lelong 1 Universal EFI binary with 1 architecture 5423>>&0 lelong 7 \b, i386 5424>>&0 lelong 0x01000007 \b, x86_64 5425>4 lelong 2 Universal EFI binary with 2 architectures 5426>>&0 lelong 7 \b, i386 5427>>&0 lelong 0x01000007 \b, x86_64 5428>>&20 lelong 7 \b, i386 5429>>&20 lelong 0x01000007 \b, x86_64 5430>4 lelong >2 Universal EFI binary with %ld architectures 5431 5432#------------------------------------------------------------------------------ 5433# $File: elf,v 1.59 2013/03/21 17:50:02 christos Exp $ 5434# elf: file(1) magic for ELF executables 5435# 5436# We have to check the byte order flag to see what byte order all the 5437# other stuff in the header is in. 5438# 5439# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 5440# 5441# Created by: unknown 5442# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com> 5443# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support) 5444# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support) 5445# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium) 5446# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures) 5447 54480 name elf-le 5449>16 leshort 0 no file type, 5450!:mime application/octet-stream 5451>16 leshort 1 relocatable, 5452!:mime application/x-object 5453>16 leshort 2 executable, 5454!:mime application/x-executable 5455>16 leshort 3 shared object, 5456!:mime application/x-sharedlib 5457>16 leshort 4 core file 5458!:mime application/x-coredump 5459# Core file detection is not reliable. 5460#>>>(0x38+0xcc) string >\0 of '%s' 5461#>>>(0x38+0x10) lelong >0 (signal %d), 5462>16 leshort &0xff00 processor-specific, 5463>18 leshort 0 no machine, 5464>18 leshort 1 AT&T WE32100 5465>18 leshort 2 SPARC 5466>18 leshort 3 Intel 80386, 5467>18 leshort 4 Motorola 5468>>4 byte 1 5469>>>36 lelong &0x01000000 68000 - invalid byte order, 5470>>>36 lelong &0x00810000 CPU32 - invalid byte order, 5471>>>36 lelong 0 68020 - invalid byte order, 5472>18 leshort 5 Motorola 88000 - invalid byte order, 5473>18 leshort 6 Intel 80486, 5474>18 leshort 7 Intel 80860, 5475# The official e_machine number for MIPS is now #8, regardless of endianness. 5476# The second number (#10) will be deprecated later. For now, we still 5477# say something if #10 is encountered, but only gory details for #8. 5478>18 leshort 8 MIPS, 5479>>4 byte 1 5480>>>36 lelong &0x20 N32 5481>18 leshort 10 MIPS, 5482>>4 byte 1 5483>>>36 lelong &0x20 N32 5484>18 leshort 8 5485# only for 32-bit 5486>>4 byte 1 5487>>>36 lelong&0xf0000000 0x00000000 MIPS-I 5488>>>36 lelong&0xf0000000 0x10000000 MIPS-II 5489>>>36 lelong&0xf0000000 0x20000000 MIPS-III 5490>>>36 lelong&0xf0000000 0x30000000 MIPS-IV 5491>>>36 lelong&0xf0000000 0x40000000 MIPS-V 5492>>>36 lelong&0xf0000000 0x50000000 MIPS32 5493>>>36 lelong&0xf0000000 0x60000000 MIPS64 5494>>>36 lelong&0xf0000000 0x70000000 MIPS32 rel2 5495>>>36 lelong&0xf0000000 0x80000000 MIPS64 rel2 5496# only for 64-bit 5497>>4 byte 2 5498>>>48 lelong&0xf0000000 0x00000000 MIPS-I 5499>>>48 lelong&0xf0000000 0x10000000 MIPS-II 5500>>>48 lelong&0xf0000000 0x20000000 MIPS-III 5501>>>48 lelong&0xf0000000 0x30000000 MIPS-IV 5502>>>48 lelong&0xf0000000 0x40000000 MIPS-V 5503>>>48 lelong&0xf0000000 0x50000000 MIPS32 5504>>>48 lelong&0xf0000000 0x60000000 MIPS64 5505>>>48 lelong&0xf0000000 0x70000000 MIPS32 rel2 5506>>>48 lelong&0xf0000000 0x80000000 MIPS64 rel2 5507>18 leshort 9 Amdahl - invalid byte order, 5508>18 leshort 10 MIPS (deprecated), 5509>18 leshort 11 RS6000 - invalid byte order, 5510>18 leshort 15 PA-RISC - invalid byte order, 5511# only for 32-bit 5512>>4 byte 1 5513>>>38 leshort 0x0214 2.0 5514>>>36 leshort &0x0008 (LP64) 5515# only for 64-bit 5516>>4 byte 2 5517>>>50 leshort 0x0214 2.0 5518>>>48 leshort &0x0008 (LP64) 5519>18 leshort 16 nCUBE, 5520>18 leshort 17 Fujitsu VPP500, 5521>18 leshort 18 SPARC32PLUS, 5522# only for 32-bit 5523>>4 byte 1 5524>>>36 lelong&0xffff00 0x000100 V8+ Required, 5525>>>36 lelong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required, 5526>>>36 lelong&0xffff00 0x000400 HaL R1 Extensions Required, 5527>>>36 lelong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required, 5528>18 leshort 20 PowerPC or cisco 4500, 5529>18 leshort 21 64-bit PowerPC or cisco 7500, 5530>18 leshort 22 IBM S/390, 5531>18 leshort 23 Cell SPU, 5532>18 leshort 24 cisco SVIP, 5533>18 leshort 25 cisco 7200, 5534>18 leshort 36 NEC V800 or cisco 12000, 5535>18 leshort 37 Fujitsu FR20, 5536>18 leshort 38 TRW RH-32, 5537>18 leshort 39 Motorola RCE, 5538>18 leshort 40 ARM, 5539>>4 byte 1 5540>>>36 lelong&0xff000000 0x04000000 EABI4 5541>>>36 lelong&0xff000000 0x05000000 EABI5 5542>18 leshort 41 Alpha, 5543>18 leshort 0xa390 IBM S/390 (obsolete), 5544>18 leshort 42 Renesas SH, 5545>18 leshort 43 SPARC V9, 5546>>4 byte 2 5547>>>48 lelong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required, 5548>>>48 lelong&0xffff00 0x000400 HaL R1 Extensions Required, 5549>>>48 lelong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required, 5550>>>48 lelong&0x3 0 total store ordering, 5551>>>48 lelong&0x3 1 partial store ordering, 5552>>>48 lelong&0x3 2 relaxed memory ordering, 5553>18 leshort 44 Siemens Tricore Embedded Processor, 5554>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc., 5555>18 leshort 46 Renesas H8/300, 5556>18 leshort 47 Renesas H8/300H, 5557>18 leshort 48 Renesas H8S, 5558>18 leshort 49 Renesas H8/500, 5559>18 leshort 50 IA-64, 5560>18 leshort 51 Stanford MIPS-X, 5561>18 leshort 52 Motorola Coldfire, 5562>18 leshort 53 Motorola M68HC12, 5563>18 leshort 54 Fujitsu MMA, 5564>18 leshort 55 Siemens PCP, 5565>18 leshort 56 Sony nCPU, 5566>18 leshort 57 Denso NDR1, 5567>18 leshort 58 Start*Core, 5568>18 leshort 59 Toyota ME16, 5569>18 leshort 60 ST100, 5570>18 leshort 61 Tinyj emb., 5571>18 leshort 62 x86-64, 5572>18 leshort 63 Sony DSP, 5573>18 leshort 66 FX66, 5574>18 leshort 67 ST9+ 8/16 bit, 5575>18 leshort 68 ST7 8 bit, 5576>18 leshort 69 MC68HC16, 5577>18 leshort 70 MC68HC11, 5578>18 leshort 71 MC68HC08, 5579>18 leshort 72 MC68HC05, 5580>18 leshort 73 SGI SVx or Cray NV1, 5581>18 leshort 74 ST19 8 bit, 5582>18 leshort 75 Digital VAX, 5583>18 leshort 76 Axis cris, 5584>18 leshort 77 Infineon 32-bit embedded, 5585>18 leshort 78 Element 14 64-bit DSP, 5586>18 leshort 79 LSI Logic 16-bit DSP, 5587>18 leshort 80 MMIX, 5588>18 leshort 81 Harvard machine-independent, 5589>18 leshort 82 SiTera Prism, 5590>18 leshort 83 Atmel AVR 8-bit, 5591>18 leshort 84 Fujitsu FR30, 5592>18 leshort 85 Mitsubishi D10V, 5593>18 leshort 86 Mitsubishi D30V, 5594>18 leshort 87 NEC v850, 5595>18 leshort 88 Renesas M32R, 5596>18 leshort 89 Matsushita MN10300, 5597>18 leshort 90 Matsushita MN10200, 5598>18 leshort 91 picoJava, 5599>18 leshort 92 OpenRISC, 5600>18 leshort 93 ARC Cores Tangent-A5, 5601>18 leshort 94 Tensilica Xtensa, 5602>18 leshort 97 NatSemi 32k, 5603>18 leshort 106 Analog Devices Blackfin, 5604>18 leshort 113 Altera Nios II, 5605>18 leshort 174 META, 5606>18 leshort 183 ARM aarch64, 5607>18 leshort 187 Tilera TILE64, 5608>18 leshort 188 Tilera TILEPro, 5609>18 leshort 191 Tilera TILE-Gx, 5610>18 leshort 0x3426 OpenRISC (obsolete), 5611>18 leshort 0x8472 OpenRISC (obsolete), 5612>18 leshort 0x9026 Alpha (unofficial), 5613>20 lelong 0 invalid version 5614>20 lelong 1 version 1 5615 56160 string \177ELF ELF 5617!:strength *2 5618>4 byte 0 invalid class 5619>4 byte 1 32-bit 5620>4 byte 2 64-bit 5621>5 byte 0 invalid byte order 5622>5 byte 1 LSB 5623>>0 use elf-le 5624>5 byte 2 MSB 5625>>0 use \^elf-le 5626# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed 5627# like proper ELF, but extracting the string had bad results. 5628>4 byte <0x80 5629>>8 string >\0 (%s) 5630>8 string \0 5631>>7 byte 0 (SYSV) 5632>>7 byte 1 (HP-UX) 5633>>7 byte 2 (NetBSD) 5634>>7 byte 3 (GNU/Linux) 5635>>7 byte 4 (GNU/Hurd) 5636>>7 byte 5 (86Open) 5637>>7 byte 6 (Solaris) 5638>>7 byte 7 (Monterey) 5639>>7 byte 8 (IRIX) 5640>>7 byte 9 (FreeBSD) 5641>>7 byte 10 (Tru64) 5642>>7 byte 11 (Novell Modesto) 5643>>7 byte 12 (OpenBSD) 5644>8 string \2 5645>>7 byte 13 (OpenVMS) 5646>>7 byte 97 (ARM) 5647>>7 byte 255 (embedded) 5648 5649#------------------------------------------------------------------------------ 5650# $File: encore,v 1.6 2009/09/19 16:28:09 christos Exp $ 5651# encore: file(1) magic for Encore machines 5652# 5653# XXX - needs to have the byte order specified (NS32K was little-endian, 5654# dunno whether they run the 88K in little-endian mode or not). 5655# 56560 short 0x154 Encore 5657>20 short 0x107 executable 5658>20 short 0x108 pure executable 5659>20 short 0x10b demand-paged executable 5660>20 short 0x10f unsupported executable 5661>12 long >0 not stripped 5662>22 short >0 - version %ld 5663>22 short 0 - 5664#>4 date x stamp %s 56650 short 0x155 Encore unsupported executable 5666>12 long >0 not stripped 5667>22 short >0 - version %ld 5668>22 short 0 - 5669#>4 date x stamp %s 5670 5671#------------------------------------------------------------------------------ 5672# $File: epoc,v 1.8 2012/06/16 14:43:36 christos Exp $ 5673# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1] 5674# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de> 5675# Useful information for improving this file can be found at: 5676# http://software.frodo.looijaard.name/psiconv/formats/Index.html 5677#------------------------------------------------------------------------------ 56780 lelong 0x10000037 Psion Series 5 5679>4 lelong 0x10000039 font file 5680>4 lelong 0x1000003A printer driver 5681>4 lelong 0x1000003B clipboard 5682>4 lelong 0x10000042 multi-bitmap image 5683!:mime image/x-epoc-mbm 5684>4 lelong 0x1000006A application information file 5685>4 lelong 0x1000006D 5686>>8 lelong 0x1000007D Sketch image 5687!:mime image/x-epoc-sketch 5688>>8 lelong 0x1000007E voice note 5689>>8 lelong 0x1000007F Word file 5690!:mime application/x-epoc-word 5691>>8 lelong 0x10000085 OPL program (TextEd) 5692!:mime application/x-epoc-opl 5693>>8 lelong 0x10000087 Comms settings 5694>>8 lelong 0x10000088 Sheet file 5695!:mime application/x-epoc-sheet 5696>>8 lelong 0x100001C4 EasyFax initialisation file 5697>4 lelong 0x10000073 OPO module 5698!:mime application/x-epoc-opo 5699>4 lelong 0x10000074 OPL application 5700!:mime application/x-epoc-app 5701>4 lelong 0x1000008A exported multi-bitmap image 5702>4 lelong 0x1000016D 5703>>8 lelong 0x10000088 Comms names 5704 57050 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image 5706 57070 lelong 0x10000050 Psion Series 5 5708>4 lelong 0x1000006D database 5709>>8 lelong 0x10000084 Agenda file 5710!:mime application/x-epoc-agenda 5711>>8 lelong 0x10000086 Data file 5712!:mime application/x-epoc-data 5713>>8 lelong 0x10000CEA Jotter file 5714!:mime application/x-epoc-jotter 5715>4 lelong 0x100000E4 ini file 5716 57170 lelong 0x10000079 Psion Series 5 binary: 5718>4 lelong 0x00000000 DLL 5719>4 lelong 0x10000049 comms hardware library 5720>4 lelong 0x1000004A comms protocol library 5721>4 lelong 0x1000005D OPX 5722>4 lelong 0x1000006C application 5723>4 lelong 0x1000008D DLL 5724>4 lelong 0x100000AC logical device driver 5725>4 lelong 0x100000AD physical device driver 5726>4 lelong 0x100000E5 file transfer protocol 5727>4 lelong 0x100000E5 file transfer protocol 5728>4 lelong 0x10000140 printer definition 5729>4 lelong 0x10000141 printer definition 5730 57310 lelong 0x1000007A Psion Series 5 executable 5732 5733#------------------------------------------------------------------------------ 5734# $File: erlang,v 1.6 2010/09/20 19:19:17 rrt Exp $ 5735# erlang: file(1) magic for Erlang JAM and BEAM files 5736# URL: http://www.erlang.org/faq/x779.html#AEN812 5737 5738# OTP R3-R4 57390 string \0177BEAM! Old Erlang BEAM file 5740>6 short >0 - version %d 5741 5742# OTP R5 and onwards 57430 string FOR1 5744>8 string BEAM Erlang BEAM file 5745 5746# 4.2 version may have a copyright notice! 57474 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 574879 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 5749 57504 string 1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995 Erlang JAM file - version 4.3 5751 57520 bequad 0x0000000000ABCDEF Erlang DETS file 5753 5754#------------------------------------------------------------------------------ 5755# $File: esri,v 1.4 2009/09/19 16:28:09 christos Exp $ 5756# ESRI Shapefile format (.shp .shx .dbf=DBaseIII) 5757# Based on info from 5758# <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf> 57590 belong 9994 ESRI Shapefile 5760>4 belong =0 5761>8 belong =0 5762>12 belong =0 5763>16 belong =0 5764>20 belong =0 5765>28 lelong x version %d 5766>24 belong x length %d 5767>32 lelong =0 type Null Shape 5768>32 lelong =1 type Point 5769>32 lelong =3 type PolyLine 5770>32 lelong =5 type Polygon 5771>32 lelong =8 type MultiPoint 5772>32 lelong =11 type PointZ 5773>32 lelong =13 type PolyLineZ 5774>32 lelong =15 type PolygonZ 5775>32 lelong =18 type MultiPointZ 5776>32 lelong =21 type PointM 5777>32 lelong =23 type PolyLineM 5778>32 lelong =25 type PolygonM 5779>32 lelong =28 type MultiPointM 5780>32 lelong =31 type MultiPatch 5781 5782#------------------------------------------------------------------------------ 5783# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $ 5784# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files 5785# From Roger Leigh <roger@whinlatter.uklinux.net> 57860 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0 57870 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0 57880 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0 5789 5790 5791#------------------------------------------------------------------------------ 5792# $File: filesystems,v 1.77 2013/03/14 01:38:30 christos Exp $ 5793# filesystems: file(1) magic for different filesystems 5794# 57950 string \366\366\366\366 PC formatted floppy with no filesystem 5796# Sun disk labels 5797# From /usr/include/sun/dklabel.h: 57980774 beshort 0xdabe 5799# modified by Joerg Jenderek, because original test 5800# succeeds for Cabinet archive dao360.dl_ with negative blocks 5801>0770 long >0 Sun disk label 5802>>0 string x '%s 5803>>>31 string >\0 \b%s 5804>>>>63 string >\0 \b%s 5805>>>>>95 string >\0 \b%s 5806>>0 string x \b' 5807>>0734 short >0 %d rpm, 5808>>0736 short >0 %d phys cys, 5809>>0740 short >0 %d alts/cyl, 5810>>0746 short >0 %d interleave, 5811>>0750 short >0 %d data cyls, 5812>>0752 short >0 %d alt cyls, 5813>>0754 short >0 %d heads/partition, 5814>>0756 short >0 %d sectors/track, 5815>>0764 long >0 start cyl %ld, 5816>>0770 long x %ld blocks 5817# Is there a boot block written 1 sector in? 5818>512 belong&077777777 0600407 \b, boot block present 5819 5820# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk 5821# (http://btmgr.sourceforge.net/docs/user-guide-3.html) 58220 string SBMBAKUP_ Smart Boot Manager backup file 5823>9 string x \b, version %-5.5s 5824>>14 string =_ 5825>>>15 string x %-.1s 5826>>>>16 string =_ \b. 5827>>>>>17 string x \b%-.1s 5828>>>>>>18 string =_ \b. 5829>>>>>>>19 string x \b%-.1s 5830>>>22 ubyte 0 5831>>>>21 ubyte x \b, from drive 0x%x 5832>>>22 ubyte >0 5833>>>>21 string x \b, from drive %s 5834>>>535 search/17 \x55\xAA 5835>>>>&-512 indirect x \b; contains 5836 5837# updated by Joerg Jenderek at Nov 2012 5838# DOS Emulator image is 128 byte, null right padded header + harddisc image 58390 string DOSEMU\0 5840>0x27E leshort 0xAA55 5841#offset is 128 5842>>19 ubyte 128 5843>>>(19.b-1) ubyte 0x0 DOS Emulator image 5844>>>>7 ulelong >0 \b, %u heads 5845>>>>11 ulelong >0 \b, %d sectors/track 5846>>>>15 ulelong >0 \b, %d cylinders 5847>>>>128 indirect x \b; contains 5848 5849# x86 boot sector updated by Joerg Jenderek at Sep 2007,May 2011 5850# for any allowed sector sizes 585130 search/481 \x55\xAA 5852# to display x86 boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111) 5853# DOS BPB information (70) and after DOS floppy (120) like in previous file version 5854!:strength +72 5855# for sector sizes < 512 Bytes 5856>11 uleshort <512 5857>>(11.s-2) uleshort 0xAA55 x86 boot sector 5858# for sector sizes with 512 or more Bytes 5859>0x1FE leshort 0xAA55 x86 boot sector 5860# keep old x86 boot sector as dummy for mbr and bootloader displaying 5861# only for sector sizes with 512 or more Bytes 58620x1FE leshort 0xAA55 5863# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version 5864!:strength +21 5865>2 string OSBS \b, OS/BS MBR 5866# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/ 5867# and http://en.wikipedia.org/wiki/Master_Boot_Record 5868# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by 5869# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00 5870>0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR 5871# Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) 5872# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld 5873>>8 ubequad 0x8bf45007501ffbfc 5874# http://thestarman.pcministry.com/asm/mbr/200MBR.htm 5875>>>0x16 ubyte 0xF3 \b,DOS 2 5876>>>>219 regex Author\ -\ Author: 5877# found "David Litton" , "A Pehrsson " 5878>>>>>&0 string x "%s" 5879>>>0x16 ubyte 0xF2 5880# NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm 5881# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz 5882>>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3 5883# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111) 5884>>>>0x22 default x \b,D0S version 3.3-7.0 5885# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...) 5886# where nn is string offset varying for different languages 5887# "Invalid partition table" nn=0x8b for english version 5888>>>>>(0x49.b) string Invalid\ partition\ table english 5889>>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german 5890>>>>>(0x49.b) string Table\ de\ partition\ invalide french 5891>>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese 5892>>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish 5893>>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian 5894>>>>>0x49 ubyte >0 at offset 0x%x 5895>>>>>>(0x49.b) string >\0 "%s" 5896# "Error loading operating system" nn=0xa3 for english version 5897# "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version 5898# "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version 5899# "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version 5900# "Error al cargar sistema operativo" nn=0xa8 for spanish version 5901# "Errore durante il caricamento del sistema operativo" nn=0xae for italian version 5902>>>>>0x74 ubyte >0 at offset 0x%x 5903>>>>>>(0x74.b) string >\0 "%s" 5904# "Missing operating system" nn=0xc2 for english version 5905# "Betriebssystem fehlt" nn=0xcd for german version 5906# "Syst\212me d'exploitation absent" nn=0xd2 for french version 5907# "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version 5908# "Falta sistema operativo" nn=0xca for spanish version 5909# "Sistema operativo mancante" nn=0xe2 for italian version 5910>>>>>0x79 ubyte >0 at offset 0x%x 5911>>>>>>(0x79.b) string >\0 "%s" 5912# Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) 5913# assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b 5914>>8 ubequad 0x5007501ffcbe1b7c 5915# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04 5916>>>24 ubequad 0xf3a4cbbebe07b104 9M 5917# "Invalid partition table" nn=0x10F for english version 5918# "Ungültige Partitionstabelle" nn=0x10F for german version 5919# "Table de partition erronée" nn=0x10F for french version 5920# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version 5921>>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english 5922>>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german 5923>>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french 5924>>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian 5925>>>>0x3C ubyte x at offset 0x%x+0xFF 5926>>>>(0x3C.b+0x0FF) string >\0 "%s" 5927# "Error loading operating system" nn=0x127 for english version 5928# "Fehler beim Laden des Betriebssystems" nn=0x12b for german version 5929# "Erreur lors du chargement du système d'exploitation" nn=0x12a for french version 5930# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version 5931>>>>0xBD ubyte x at offset 0x1%x 5932>>>>(0xBD.b+0x100) string >\0 "%s" 5933# "Missing operating system" nn=0x146 for english version 5934# "Betriebssystem fehlt" nn=0x151 for german version 5935# "Système d'exploitation manquant" nn=0x15e for french version 5936# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version 5937>>>>0xA9 ubyte x at offset 0x1%x 5938>>>>(0xA9.b+0x100) string >\0 "%s" 5939# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm 5940# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04 5941>>>24 ubequad 0xf3a4cbbdbe07b104 XP 5942# where xxyyzz are lower bits from offsets of error messages varying for different languages 5943>>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english 5944>>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german 5945# "Invalid partition table" xx=0x12C for english version 5946# "Ungültige Partitionstabelle" xx=0x12C for german version 5947>>>>0x1b5 ubyte >0 at offset 0x1%x 5948>>>>(0x1b5.b+0x100) string >\0 "%s" 5949# "Error loading operating system" yy=0x144 for english version 5950# "Fehler beim Laden des Betriebssystems" yy=0x148 for german version 5951>>>>0x1b6 ubyte >0 at offset 0x1%x 5952>>>>(0x1b6.b+0x100) string >\0 "%s" 5953# "Missing operating system" zz=0x163 for english version 5954# "Betriebssystem nicht vorhanden" zz=0x16e for german version 5955>>>>0x1b7 ubyte >0 at offset 0x1%x 5956>>>>(0x1b7.b+0x100) string >\0 "%s" 5957# Microsoft Windows Vista or 7 5958# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00 5959>>8 ubequad 0xc08ed8be007cbf00 5960# Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) 5961# assembler instructions: jnz 0729;cmp ebx,"TCPA" 5962>>>0xEC ubequad 0x753b6681fb544350 Vista 5963# where xxyyzz are lower bits from offsets of error messages varying for different languages 5964>>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english 5965#>>>>0x1B4 ubelong&0x00FFFFFF ? german 5966# "Invalid partition table" xx=0x162 for english version 5967# "Ungültige Partitionstabelle" xx=0x1?? for german version 5968>>>>0x1b5 ubyte >0 at offset 0x1%x 5969>>>>(0x1b5.b+0x100) string >\0 "%s" 5970# "Error loading operating system" yy=0x17a for english version 5971# "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version 5972>>>>0x1b6 ubyte >0 at offset 0x1%x 5973>>>>(0x1b6.b+0x100) string >\0 "%s" 5974# "Missing operating system" zz=0x199 for english version 5975# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 5976>>>>0x1b7 ubyte >0 at offset 0x1%x 5977>>>>(0x1b7.b+0x100) string >\0 "%s" 5978# Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm) 5979# assembler instructions: cmp ebx,"TCPA";cmp 5980>>>0xEC ubequad 0x6681fb5443504175 Windows 7 5981# where xxyyzz are lower bits from offsets of error messages varying for different languages 5982>>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english 5983#>>>>0x1B4 ubelong&0x00FFFFFF ? german 5984# "Invalid partition table" xx=0x163 for english version 5985# "Ungültige Partitionstabelle" xx=0x1?? for german version 5986>>>>0x1b5 ubyte >0 at offset 0x1%x 5987>>>>(0x1b5.b+0x100) string >\0 "%s" 5988# "Error loading operating system" yy=0x17b for english version 5989# "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version 5990>>>>0x1b6 ubyte >0 at offset 0x1%x 5991>>>>(0x1b6.b+0x100) string >\0 "%s" 5992# "Missing operating system" zz=0x19a for english version 5993# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 5994>>>>0x1b7 ubyte >0 at offset 0x1%x 5995>>>>(0x1b7.b+0x100) string >\0 "%s" 5996# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs 5997# http://en.wikipedia.org/wiki/MBR_disk_signature#ID 5998>>0x1b8 ulelong >0 \b, disk signature 0x%-.4x 5999# driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm 6000>>0xDA uleshort 0 6001>>>0xDC ulelong >0 \b, created 6002# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive 6003>>>>0xDC ubyte x with driveID 0x%x 6004# hours, minutes and seconds 6005>>>>0xDf ubyte x at %x 6006>>>>0xDe ubyte x \b:%x 6007>>>>0xDd ubyte x \b:%x 6008# special case for Microsoft MS-DOS 3.21 spanish 6009# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov 6010>0 ubequad 0xfab830008ed0bc00 6011# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov 6012>>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish 6013# Microsoft MBR IPL end 6014 6015# dr-dos with some upper-, lowercase variants 6016>0x9D string Invalid\ partition\ table$ 6017>>181 string No\ Operating\ System$ 6018>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 6019>0x9D string Invalid\ partition\ table$ 6020>>181 string No\ operating\ system$ 6021>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 6022>342 string Invalid\ partition\ table$ 6023>>366 string No\ operating\ system$ 6024>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03 6025>295 string NEWLDR\0 6026>>302 string Bad\ PT\ $ 6027>>>310 string No\ OS\ $ 6028>>>>317 string OS\ load\ err$ 6029>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r 6030>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ 6031>>>>>>>387 string Copyright\ (c)\ 1984,1998 6032>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) 6033# 6034# tests for different MS-DOS Master Boot Records (MBR) moved and merged 6035# 6036#>0x145 string Default:\ F \b, FREE-DOS MBR 6037#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR 6038>0x145 search/7 Default:\ F \b, FREE-DOS MBR 6039#>>313 string F0\ .\ .\ . 6040#>>>322 string disk\ 1 6041#>>>>382 string FAT3 6042>64 string no\ active\ partition\ found 6043>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR 6044# Ranish Partition Manager http://www.ranish.com/part/ 6045>387 search/4 \0\ Error!\r 6046>>378 search/7 Virus! 6047>>>397 search/4 Booting\ 6048>>>>408 search/4 HD1/\0 \b, Ranish MBR ( 6049>>>>>416 string Writing\ changes... \b2.37 6050>>>>>>438 ubyte x \b,0x%x dots 6051>>>>>>440 ubyte >0 \b,virus check 6052>>>>>>441 ubyte >0 \b,partition %c 6053#2.38,2.42,2.44 6054>>>>>416 string !Writing\ changes... \b 6055>>>>>>418 ubyte 1 \bvirus check, 6056>>>>>>419 ubyte x \b0x%x seconds 6057>>>>>>420 ubyte&0x0F >0 \b,partition 6058>>>>>>>420 ubyte&0x0F <5 \b %x 6059>>>>>>>420 ubyte&0x0F 0Xf \b ask 6060>>>>>420 ubyte x \b) 6061# 6062# SYSLINUX MBR moved 6063# http://www.acronis.de/ 6064>362 string MBR\ Error\ \0\r 6065>>376 string ress\ any\ key\ to\ 6066>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR 6067# added by Joerg Jenderek 6068# http://www.visopsys.org/ 6069# http://partitionlogic.org.uk/ 6070>309 string No\ bootable\ partition\ found\r 6071>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR 6072>349 string No\ bootable\ partition\ found\r 6073>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR 6074# bootloader, bootmanager 6075>0x40 string SBML 6076# label with 11 characters of FAT 12 bit filesystem 6077>>43 string SMART\ BTMGR 6078>>>430 string SBMK\ Bad!\r \b, Smart Boot Manager 6079# OEM-ID not always "SBM" 6080#>>>>3 strings SBM 6081>>>>6 string >\0 \b, version %s 6082>382 string XOSLLOADXCF \b, eXtended Operating System Loader 6083>6 string LILO \b, LInux i386 boot LOader 6084>>120 string LILO \b, version 22.3.4 SuSe 6085>>172 string LILO \b, version 22.5.8 Debian 6086# updated by Joerg Jenderek at Oct 2008 6087# variables according to grub-0.97/stage1/stage1.S or 6088# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 6089# usual values are marked with comments to get only informations of strange GRUB loaders 6090>342 search/60 \0Geom\0 6091#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0 6092>>0x41 ubyte <2 6093>>>0x3E ubyte >2 \b; GRand Unified Bootloader 6094# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 6095>>>>0x3E ubyte x \b, stage1 version 0x%x 6096#If it is 0xFF, use a drive passed by BIOS 6097>>>>0x40 ubyte <0xFF \b, boot drive 0x%x 6098# in most case 0,1,0x2e for GRUB 0.5.95 6099>>>>0x41 ubyte >0 \b, LBA flag 0x%x 6100>>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x 6101#>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual) 6102>>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x 6103#>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default) 6104>>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x 6105>>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x 6106#>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual) 6107>>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x 6108>>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0 6109>>>>>394 string stage1 \b, GRUB version 0.5.95 6110>>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0 6111>>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94 6112>>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0 6113>>>>>377 string GRUB\ \0 \b, GRUB version 0.94 6114>>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 6115>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96 6116>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0 6117>>>>>385 string GRUB\ \0 \b, GRUB version 0.97 6118#unknown version 6119>>>343 string Geom\0Read\0\ Error\0 6120>>>>321 string Loading\ stage1.5 \b, GRUB version x.y 6121>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0 6122>>>>374 string GRUB\ \0 \b, GRUB version n.m 6123# SYSLINUX bootloader moved 6124>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader 6125# http://www.bcdwb.de/bcdw/index_e.htm 6126>3 string BCDL 6127>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) 6128# mbr partition table entries 6129# OEM-ID does not contain MicroSoft,NEWLDR,DOS,SYSLINUX,or MTOOLs 6130>3 string !MS 6131>>3 string !SYSLINUX 6132>>>3 string !MTOOL 6133>>>>3 string !NEWLDR 6134>>>>>5 string !DOS 6135# not FAT (32 bit) 6136>>>>>>82 string !FAT32 6137#not Linux kernel 6138>>>>>>>514 string !HdrS 6139#not BeOS 6140>>>>>>>>422 string !Be\ Boot\ Loader 6141# active flag 0 or 0x80 and type > 0 6142>>>>>>>>>446 ubyte <0x81 6143>>>>>>>>>>446 ubyte&0x7F 0 6144>>>>>>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x 6145>>>>>>>>>>>>446 ubyte 0x80 \b, active 6146>>>>>>>>>>>>447 ubyte x \b, starthead %u 6147#>>>>>>>>>>>>448 ubyte x \b, start C_S: 0x%x 6148#>>>>>>>>>>>>448 ubeshort&1023 x \b, startcylinder? %d 6149>>>>>>>>>>>>454 ulelong x \b, startsector %u 6150>>>>>>>>>>>>458 ulelong x \b, %u sectors 6151# 6152>>>>>>>>>462 ubyte <0x81 6153>>>>>>>>>>462 ubyte&0x7F 0 6154>>>>>>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x 6155>>>>>>>>>>>>462 ubyte 0x80 \b, active 6156>>>>>>>>>>>>463 ubyte x \b, starthead %u 6157#>>>>>>>>>>>>464 ubyte x \b, start C_S: 0x%x 6158#>>>>>>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d 6159>>>>>>>>>>>>470 ulelong x \b, startsector %u 6160>>>>>>>>>>>>474 ulelong x \b, %u sectors 6161# 6162>>>>>>>>>478 ubyte <0x81 6163>>>>>>>>>>478 ubyte&0x7F 0 6164>>>>>>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x 6165>>>>>>>>>>>>478 ubyte 0x80 \b, active 6166>>>>>>>>>>>>479 ubyte x \b, starthead %u 6167#>>>>>>>>>>>>480 ubyte x \b, start C_S: 0x%x 6168#>>>>>>>>>>>>481 ubyte x \b, start C2S: 0x%x 6169#>>>>>>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d 6170>>>>>>>>>>>>486 ulelong x \b, startsector %u 6171>>>>>>>>>>>>490 ulelong x \b, %u sectors 6172# 6173>>>>>>>>>494 ubyte <0x81 6174>>>>>>>>>>494 ubyte&0x7F 0 6175>>>>>>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x 6176>>>>>>>>>>>>494 ubyte 0x80 \b, active 6177>>>>>>>>>>>>495 ubyte x \b, starthead %u 6178#>>>>>>>>>>>>496 ubyte x \b, start C_S: 0x%x 6179#>>>>>>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d 6180>>>>>>>>>>>>502 ulelong x \b, startsector %u 6181>>>>>>>>>>>>506 ulelong x \b, %u sectors 6182# mbr partition table entries end 6183# http://www.acronis.de/ 6184#FAT label=ACRONIS\ SZ 6185#OEM-ID=BOOTWIZ0 6186>442 string Non-system\ disk,\ 6187>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader 6188# updated by Joerg Jenderek at Nov 2012 6189# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes 6190>>>477 ubyte&0xDF >0 6191>>>>477 string x \b %-.3s 6192>>>>>480 ubyte&0xDF >0 6193>>>>>>480 string x \b%-.4s 6194>>>>>>>484 ubyte&0xDF >0 6195>>>>>>>>484 string x \b%-.1s 6196>>>>485 ubyte&0xDF >0 6197>>>>>485 string x \b.%-.3s 6198# 6199>185 string FDBOOT\ Version\ 6200>>204 string \rNo\ Systemdisk.\ 6201>>>220 string Booting\ from\ harddisk.\n\r 6202>>>245 string Cannot\ load\ from\ harddisk.\n\r 6203>>>>273 string Insert\ Systemdisk\ 6204>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader 6205>>>>>>200 string >\0 \b, version %-3s 6206>242 string Bootsector\ from\ C.H.\ Hochst\204 6207# http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c 6208# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string 6209# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut 6210>242 search/127 Bootsector\ from\ C.H.\ Hochst 6211>>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk 6212# followed by variants with point,CR-NL or NL-CR 6213>>>208 search/261 Cannot\ load\ from\ harddisk. 6214# followed by variants CR-NL or NL-CR 6215>>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key. 6216# followed by variants with point,CR-NL or NL-CR 6217>>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader 6218# followed by string like "6.50 (c) 1993-2004 Gilles Vollant" 6219>>>>>>&0 string x \b, version %-4.4s 6220>(1.b+2) ubyte 0xe 6221>>(1.b+3) ubyte 0x1f 6222>>>(1.b+4) ubyte 0xbe 6223# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others 6224>>>>(1.b+5) ubyte&0xd3 0x53 6225>>>>>(1.b+6) ubyte 0x7c 6226# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah, 6227>>>>>>(1.b+7) ubyte 0xac 6228>>>>>>>(1.b+8) ubyte 0x22 6229>>>>>>>>(1.b+9) ubyte 0xc0 6230>>>>>>>>>(1.b+10) ubyte 0x74 6231>>>>>>>>>>(1.b+11) ubyte 0x0b 6232>>>>>>>>>>>(1.b+12) ubyte 0x56 6233>>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display 6234# FAT1X version 6235>>>>>>>>>>>>>(1.b+5) ubyte 0x5b 6236>>>>>>>>>>>>>>0x5b string >\0 "%-s" 6237# FAT32 version 6238>>>>>>>>>>>>>(1.b+5) ubyte 0x77 6239>>>>>>>>>>>>>>0x77 string >\0 "%-s" 6240>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display 6241#>>244 string from\ dosemu-freedos-*-bin.tgz\r 6242#>>>170 string Sorry,\ could\ not\ load\ an\ 6243#>>>>195 string operating\ system.\r\n 6244# 6245>103 string This\ is\ not\ a\ bootable\ disk.\ 6246>>132 string Please\ insert\ a\ bootable\ 6247>>>157 string floppy\ and\r\n 6248>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display 6249# 6250>66 string Solaris\ Boot\ Sector 6251>>99 string Incomplete\ MDBoot\ load. 6252>>>89 string Version \b, Sun Solaris Bootloader 6253>>>>97 byte x version %c 6254# 6255>408 string OS/2\ !!\ SYS01475\r\0 6256>>429 string OS/2\ !!\ SYS02025\r\0 6257>>>450 string OS/2\ !!\ SYS02027\r\0 6258>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader 6259# 6260>409 string OS/2\ !!\ SYS01475\r\0 6261>>430 string OS/2\ !!\ SYS02025\r\0 6262>>>451 string OS/2\ !!\ SYS02027\r\0 6263>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader 6264>112 string This\ disk\ is\ not\ bootable\r 6265>>142 string If\ you\ wish\ to\ make\ it\ bootable 6266>>>176 string run\ the\ DOS\ program\ SYS\ 6267>>>200 string after\ the\r 6268>>>>216 string system\ has\ been\ loaded\r\n 6269>>>>>242 string Please\ insert\ a\ DOS\ diskette\ 6270>>>>>271 string into\r\n\ the\ drive\ and\ 6271>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display 6272# XP 6273>430 string NTLDR\ is\ missing\xFF\r\n 6274>>449 string Disk\ error\xFF\r\n 6275>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader 6276# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes 6277>>>>417 ubyte&0xDF >0 6278>>>>>417 string x %-.5s 6279>>>>>>422 ubyte&0xDF >0 6280>>>>>>>422 string x \b%-.3s 6281>>>>>425 ubyte&0xDF >0 6282>>>>>>425 string >\ \b.%-.3s 6283# 6284>>>>371 ubyte >0x20 6285>>>>>368 ubyte&0xDF >0 6286>>>>>>368 string x %-.5s 6287>>>>>>>373 ubyte&0xDF >0 6288>>>>>>>>373 string x \b%-.3s 6289>>>>>>376 ubyte&0xDF >0 6290>>>>>>>376 string x \b.%-.3s 6291# 6292>430 string NTLDR\ nicht\ gefunden\xFF\r\n 6293>>453 string Datentr\204gerfehler\xFF\r\n 6294>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) 6295>>>>417 ubyte&0xDF >0 6296>>>>>417 string x %-.5s 6297>>>>>>422 ubyte&0xDF >0 6298>>>>>>>422 string x \b%-.3s 6299>>>>>425 ubyte&0xDF >0 6300>>>>>>425 string >\ \b.%-.3s 6301# offset variant 6302>>>>379 string \0 6303>>>>>368 ubyte&0xDF >0 6304>>>>>>368 string x %-.5s 6305>>>>>>>373 ubyte&0xDF >0 6306>>>>>>>>373 string x \b%-.3s 6307# 6308>430 string NTLDR\ fehlt\xFF\r\n 6309>>444 string Datentr\204gerfehler\xFF\r\n 6310>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) 6311>>>>417 ubyte&0xDF >0 6312>>>>>417 string x %-.5s 6313>>>>>>422 ubyte&0xDF >0 6314>>>>>>>422 string x \b%-.3s 6315>>>>>425 ubyte&0xDF >0 6316>>>>>>425 string >\ \b.%-.3s 6317# variant 6318>>>>371 ubyte >0x20 6319>>>>>368 ubyte&0xDF >0 6320>>>>>>368 string x %-.5s 6321>>>>>>>373 ubyte&0xDF >0 6322>>>>>>>>373 string x \b%-.3s 6323>>>>>>376 ubyte&0xDF >0 6324>>>>>>>376 string x \b.%-.3s 6325# 6326>430 string NTLDR\ fehlt\xFF\r\n 6327>>444 string Medienfehler\xFF\r\n 6328>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) 6329>>>>371 ubyte >0x20 6330>>>>>368 ubyte&0xDF >0 6331>>>>>>368 string x %-.5s 6332>>>>>>>373 ubyte&0xDF >0 6333>>>>>>>>373 string x \b%-.3s 6334>>>>>>376 ubyte&0xDF >0 6335>>>>>>>376 string x \b.%-.3s 6336# variant 6337>>>>417 ubyte&0xDF >0 6338>>>>>417 string x %-.5s 6339>>>>>>422 ubyte&0xDF >0 6340>>>>>>>422 string x \b%-.3s 6341>>>>>425 ubyte&0xDF >0 6342>>>>>>425 string >\ \b.%-.3s 6343# 6344>430 string Datentr\204ger\ entfernen\xFF\r\n 6345>>454 string Medienfehler\xFF\r\n 6346>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) 6347>>>>379 string \0 6348>>>>>368 ubyte&0xDF >0 6349>>>>>>368 string x %-.5s 6350>>>>>>>373 ubyte&0xDF >0 6351>>>>>>>>373 string x \b%-.3s 6352>>>>>>376 ubyte&0xDF >0 6353>>>>>>>376 string x \b.%-.3s 6354# variant 6355>>>>417 ubyte&0xDF >0 6356>>>>>417 string x %-.5s 6357>>>>>>422 ubyte&0xDF >0 6358>>>>>>>422 string x \b%-.3s 6359>>>>>425 ubyte&0xDF >0 6360>>>>>>425 string >\ \b.%-.3s 6361# 6362 6363#>3 string NTFS\ \ \ \ 6364>389 string Fehler\ beim\ Lesen\ 6365>>407 string des\ Datentr\204gers 6366>>>426 string NTLDR\ fehlt 6367>>>>440 string NTLDR\ ist\ komprimiert 6368>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) 6369#>3 string NTFS\ \ \ \ 6370>313 string A\ disk\ read\ error\ occurred.\r 6371>>345 string A\ kernel\ file\ is\ missing\ 6372>>>370 string from\ the\ disk.\r 6373>>>>484 string NTLDR\ is\ compressed 6374>>>>>429 string Insert\ a\ system\ diskette\ 6375>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS 6376# DOS loader variants different languages,offsets 6377>472 ubyte&0xDF >0 6378>>389 string Invalid\ system\ disk\xFF\r\n 6379>>>411 string Disk\ I/O\ error 6380>>>>428 string Replace\ the\ disk,\ and\ 6381>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader 6382#IO.SYS 6383>>>>>>472 ubyte&0xDF >0 6384>>>>>>>472 string x \b %-.2s 6385>>>>>>>>474 ubyte&0xDF >0 6386>>>>>>>>>474 string x \b%-.5s 6387>>>>>>>>>>479 ubyte&0xDF >0 6388>>>>>>>>>>>479 string x \b%-.1s 6389>>>>>>>480 ubyte&0xDF >0 6390>>>>>>>>480 string x \b.%-.3s 6391#MSDOS.SYS 6392>>>>>>>483 ubyte&0xDF >0 \b+ 6393>>>>>>>>483 string x \b%-.5s 6394>>>>>>>>>488 ubyte&0xDF >0 6395>>>>>>>>>>488 string x \b%-.3s 6396>>>>>>>>491 ubyte&0xDF >0 6397>>>>>>>>>491 string x \b.%-.3s 6398# 6399>>390 string Invalid\ system\ disk\xFF\r\n 6400>>>412 string Disk\ I/O\ error\xFF\r\n 6401>>>>429 string Replace\ the\ disk,\ and\ 6402>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader 6403>>388 string Ungueltiges\ System\ \xFF\r\n 6404>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n 6405>>>>427 string Datentraeger\ wechseln\ und\ 6406>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) 6407#WINBOOT.SYS only not spaces (0xDF) 6408>>>>>>497 ubyte&0xDF >0 6409>>>>>>>497 string x %-.5s 6410>>>>>>>>502 ubyte&0xDF >0 6411>>>>>>>>>502 string x \b%-.1s 6412>>>>>>>>>>503 ubyte&0xDF >0 6413>>>>>>>>>>>503 string x \b%-.1s 6414>>>>>>>>>>>>504 ubyte&0xDF >0 6415>>>>>>>>>>>>>504 string x \b%-.1s 6416>>>>>>505 ubyte&0xDF >0 6417>>>>>>>505 string x \b.%-.3s 6418#IO.SYS 6419>>>>>>472 ubyte&0xDF >0 or 6420>>>>>>>472 string x \b %-.2s 6421>>>>>>>>474 ubyte&0xDF >0 6422>>>>>>>>>474 string x \b%-.5s 6423>>>>>>>>>>479 ubyte&0xDF >0 6424>>>>>>>>>>>479 string x \b%-.1s 6425>>>>>>>480 ubyte&0xDF >0 6426>>>>>>>>480 string x \b.%-.3s 6427#MSDOS.SYS 6428>>>>>>>483 ubyte&0xDF >0 \b+ 6429>>>>>>>>483 string x \b%-.5s 6430>>>>>>>>>488 ubyte&0xDF >0 6431>>>>>>>>>>488 string x \b%-.3s 6432>>>>>>>>491 ubyte&0xDF >0 6433>>>>>>>>>491 string x \b.%-.3s 6434# 6435>>390 string Ungueltiges\ System\ \xFF\r\n 6436>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n 6437>>>>429 string Datentraeger\ wechseln\ und\ 6438>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) 6439#WINBOOT.SYS only not spaces (0xDF) 6440>>>>>>497 ubyte&0xDF >0 6441>>>>>>>497 string x %-.7s 6442>>>>>>>>504 ubyte&0xDF >0 6443>>>>>>>>>504 string x \b%-.1s 6444>>>>>>505 ubyte&0xDF >0 6445>>>>>>>505 string x \b.%-.3s 6446#IO.SYS 6447>>>>>>472 ubyte&0xDF >0 or 6448>>>>>>>472 string x \b %-.2s 6449>>>>>>>>474 ubyte&0xDF >0 6450>>>>>>>>>474 string x \b%-.6s 6451>>>>>>>480 ubyte&0xDF >0 6452>>>>>>>>480 string x \b.%-.3s 6453#MSDOS.SYS 6454>>>>>>>483 ubyte&0xDF >0 \b+ 6455>>>>>>>>483 string x \b%-.5s 6456>>>>>>>>>488 ubyte&0xDF >0 6457>>>>>>>>>>488 string x \b%-.3s 6458>>>>>>>>491 ubyte&0xDF >0 6459>>>>>>>>>491 string x \b.%-.3s 6460# 6461>>389 string Ungueltiges\ System\ \xFF\r\n 6462>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n 6463>>>>428 string Datentraeger\ wechseln\ und\ 6464>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) 6465# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes 6466>>>>>>472 string x %-.2s 6467>>>>>>>474 ubyte&0xDF >0 6468>>>>>>>>474 string x \b%-.5s 6469>>>>>>>>479 ubyte&0xDF >0 6470>>>>>>>>>479 string x \b%-.1s 6471>>>>>>480 ubyte&0xDF >0 6472>>>>>>>480 string x \b.%-.3s 6473>>>>>>483 ubyte&0xDF >0 \b+ 6474>>>>>>>483 string x \b%-.5s 6475>>>>>>>488 ubyte&0xDF >0 6476>>>>>>>>488 string x \b%-.2s 6477>>>>>>>>490 ubyte&0xDF >0 6478>>>>>>>>>490 string x \b%-.1s 6479>>>>>>>491 ubyte&0xDF >0 6480>>>>>>>>491 string x \b.%-.3s 6481>479 ubyte&0xDF >0 6482>>416 string Kein\ System\ oder\ 6483>>>433 string Laufwerksfehler 6484>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) 6485#IO.SYS 6486>>>>>479 string x \b %-.2s 6487>>>>>>481 ubyte&0xDF >0 6488>>>>>>>481 string x \b%-.6s 6489>>>>>487 ubyte&0xDF >0 6490>>>>>>487 string x \b.%-.3s 6491#MSDOS.SYS 6492>>>>>>490 ubyte&0xDF >0 \b+ 6493>>>>>>>490 string x \b%-.5s 6494>>>>>>>>495 ubyte&0xDF >0 6495>>>>>>>>>495 string x \b%-.3s 6496>>>>>>>498 ubyte&0xDF >0 6497>>>>>>>>498 string x \b.%-.3s 6498# 6499>376 search/41 Non-System\ disk\ or\ 6500>>395 search/41 disk\ error\r 6501>>>407 search/41 Replace\ and\ 6502>>>>419 search/41 press\ \b, 6503>>>>419 search/41 strike\ \b, old 6504>>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader 6505#449 Disk\ Boot\ failure\r MS 3.21 6506#466 Boot\ Failure\r MS 3.30 6507>>>>>468 search/18 \0 6508#IO.SYS,IBMBIO.COM 6509>>>>>>&0 string x \b %-.2s 6510>>>>>>>&-20 ubyte&0xDF >0 6511>>>>>>>>&-1 string x \b%-.4s 6512>>>>>>>>>&-16 ubyte&0xDF >0 6513>>>>>>>>>>&-1 string x \b%-.2s 6514>>>>>>&8 ubyte&0xDF >0 \b. 6515>>>>>>>&-1 string x \b%-.3s 6516#MSDOS.SYS,IBMDOS.COM 6517>>>>>>&11 ubyte&0xDF >0 \b+ 6518>>>>>>>&-1 string x \b%-.5s 6519>>>>>>>>&-6 ubyte&0xDF >0 6520>>>>>>>>>&-1 string x \b%-.1s 6521>>>>>>>>>>&-5 ubyte&0xDF >0 6522>>>>>>>>>>>&-1 string x \b%-.2s 6523>>>>>>>&7 ubyte&0xDF >0 \b. 6524>>>>>>>>&-1 string x \b%-.3s 6525>441 string Cannot\ load\ from\ harddisk.\n\r 6526>>469 string Insert\ Systemdisk\ 6527>>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader 6528#>43 string \224R-LOADER\ \ SYS =label 6529>54 string SYS 6530>>324 string VASKK 6531>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) 6532# 6533>98 string Press\ a\ key\ to\ retry\0\r 6534>>120 string Cannot\ find\ file\ \0\r 6535>>>139 string Disk\ read\ error\0\r 6536>>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader 6537#DRBIOS.SYS 6538>>>>>44 ubyte&0xDF >0 6539>>>>>>44 string x \b %-.6s 6540>>>>>>>50 ubyte&0xDF >0 6541>>>>>>>>50 string x \b%-.2s 6542>>>>>>52 ubyte&0xDF >0 6543>>>>>>>52 string x \b.%-.3s 6544# 6545>70 string IBMBIO\ \ COM 6546>>472 string Cannot\ load\ DOS!\ 6547>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader 6548>>471 string Cannot\ load\ DOS\ 6549>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader 6550#?? 6551>444 string KERNEL\ \ SYS 6552>>314 string BOOT\ error! \b, FREE-DOS Bootloader 6553>499 string KERNEL\ \ SYS 6554>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader 6555>449 string KERNEL\ \ SYS 6556>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader 6557# 6558>449 string Loading\ FreeDOS 6559>>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader 6560>>>497 ubyte&0xDF >0 6561>>>>497 string x \b %-.6s 6562>>>>>503 ubyte&0xDF >0 6563>>>>>>503 string x \b%-.1s 6564>>>>>>>504 ubyte&0xDF >0 6565>>>>>>>>504 string x \b%-.1s 6566>>>>505 ubyte&0xDF >0 6567>>>>>505 string x \b.%-.3s 6568# 6569>331 string Error!.0 \b, FREE-DOS 1.0 bootloader 6570# 6571>125 string Loading\ FreeDOS...\r 6572>>311 string BOOT\ error!\r \b, FREE-DOS bootloader 6573>>>441 ubyte&0xDF >0 6574>>>>441 string x \b %-.6s 6575>>>>>447 ubyte&0xDF >0 6576>>>>>>447 string x \b%-.1s 6577>>>>>>>448 ubyte&0xDF >0 6578>>>>>>>>448 string x \b%-.1s 6579>>>>449 ubyte&0xDF >0 6580>>>>>449 string x \b.%-.3s 6581>124 string FreeDOS\0 6582>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader 6583# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes 6584>>>497 ubyte&0xDF >0 6585>>>>497 string x \b %-.6s 6586>>>>>503 ubyte&0xDF >0 6587>>>>>>503 string x \b%-.1s 6588>>>>>>>504 ubyte&0xDF >0 6589>>>>>>>>504 string x \b%-.1s 6590>>>>505 ubyte&0xDF >0 6591>>>>>505 string x \b.%-.3s 6592>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader 6593>>>497 ubyte&0xDF >0 6594>>>>497 string x \b %-.6s 6595>>>>>503 ubyte&0xDF >0 6596>>>>>>503 string x \b%-.1s 6597>>>>>>>504 ubyte&0xDF >0 6598>>>>>>>>504 string x \b%-.1s 6599>>>>505 ubyte&0xDF >0 6600>>>>>505 string x \b.%-.3s 6601>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader 6602>>>497 ubyte&0xDF >0 6603>>>>497 string x \b %-.6s 6604>>>>>503 ubyte&0xDF >0 6605>>>>>>503 string x \b%-.1s 6606>>>>>>>504 ubyte&0xDF >0 6607>>>>>>>>504 string x \b%-.1s 6608>>>>505 ubyte&0xDF >0 6609>>>>>505 string x \b.%-.3s 6610>336 string Error!\ 6611>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader 6612>>>497 ubyte&0xDF >0 6613>>>>497 string x \b %-.6s 6614>>>>>503 ubyte&0xDF >0 6615>>>>>>503 string x \b%-.1s 6616>>>>>>>504 ubyte&0xDF >0 6617>>>>>>>>504 string x \b%-.1s 6618>>>>505 ubyte&0xDF >0 6619>>>>>505 string x \b.%-.3s 6620# added by Joerg Jenderek 6621# http://www.visopsys.org/ 6622# http://partitionlogic.org.uk/ 6623# OEM-ID=Visopsys 6624>478 ulelong 0 6625>>(1.b+326) string I/O\ Error\ reading\ 6626>>>(1.b+344) string Visopsys\ loader\r 6627>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader 6628# http://alexfru.chat.ru/epm.html#bootprog 6629>494 ubyte >0x4D 6630>>495 string >E 6631>>>495 string <S 6632#OEM-ID is not reliable 6633>>>>3 string BootProg 6634# It just looks for a program file name at the root directory 6635# and loads corresponding file with following execution. 6636# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 6637>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 6638>>>>>499 string x \b %-.1s 6639>>>>>>500 ubyte&0xDF >0 6640>>>>>>>500 string x \b%-.1s 6641>>>>>>>>501 ubyte&0xDF >0 6642>>>>>>>>>501 string x \b%-.1s 6643>>>>>>>>>>502 ubyte&0xDF >0 6644>>>>>>>>>>>502 string x \b%-.1s 6645>>>>>>>>>>>>503 ubyte&0xDF >0 6646>>>>>>>>>>>>>503 string x \b%-.1s 6647>>>>>>>>>>>>>>504 ubyte&0xDF >0 6648>>>>>>>>>>>>>>>504 string x \b%-.1s 6649>>>>>>>>>>>>>>>>505 ubyte&0xDF >0 6650>>>>>>>>>>>>>>>>>505 string x \b%-.1s 6651>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 6652>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s 6653#name extension 6654>>>>>507 ubyte&0xDF >0 \b. 6655>>>>>>507 string x \b%-.1s 6656>>>>>>>508 ubyte&0xDF >0 6657>>>>>>>>508 string x \b%-.1s 6658>>>>>>>>>509 ubyte&0xDF >0 6659>>>>>>>>>>509 string x \b%-.1s 6660#If the boot sector fails to read any other sector, 6661#it prints a very short message ("RE") to the screen and hangs the computer. 6662#If the boot sector fails to find needed program in the root directory, 6663#it also hangs with another message ("NF"). 6664>>>>>492 string RENF \b, FAT (12 bit) 6665>>>>>495 string RENF \b, FAT (16 bit) 6666# http://alexfru.chat.ru/epm.html#bootprog 6667>494 ubyte >0x4D 6668>>495 string >E 6669>>>495 string <S 6670#OEM-ID is not reliable 6671>>>>3 string BootProg 6672# It just looks for a program file name at the root directory 6673# and loads corresponding file with following execution. 6674# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 6675>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 6676>>>>>499 string x \b %-.1s 6677>>>>>>500 ubyte&0xDF >0 6678>>>>>>>500 string x \b%-.1s 6679>>>>>>>>501 ubyte&0xDF >0 6680>>>>>>>>>501 string x \b%-.1s 6681>>>>>>>>>>502 ubyte&0xDF >0 6682>>>>>>>>>>>502 string x \b%-.1s 6683>>>>>>>>>>>>503 ubyte&0xDF >0 6684>>>>>>>>>>>>>503 string x \b%-.1s 6685>>>>>>>>>>>>>>504 ubyte&0xDF >0 6686>>>>>>>>>>>>>>>504 string x \b%-.1s 6687>>>>>>>>>>>>>>>>505 ubyte&0xDF >0 6688>>>>>>>>>>>>>>>>>505 string x \b%-.1s 6689>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 6690>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s 6691#name extension 6692>>>>>507 ubyte&0xDF >0 \b. 6693>>>>>>507 string x \b%-.1s 6694>>>>>>>508 ubyte&0xDF >0 6695>>>>>>>>508 string x \b%-.1s 6696>>>>>>>>>509 ubyte&0xDF >0 6697>>>>>>>>>>509 string x \b%-.1s 6698#If the boot sector fails to read any other sector, 6699#it prints a very short message ("RE") to the screen and hangs the computer. 6700#If the boot sector fails to find needed program in the root directory, 6701#it also hangs with another message ("NF"). 6702>>>>>492 string RENF \b, FAT (12 bit) 6703>>>>>495 string RENF \b, FAT (16 bit) 6704# x86 bootloader end 6705 6706# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 6707# and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector 6708>0 string RRaA 6709>>0x1E4 string rrAa \b, FSInfosector 6710#>>0x1FC uleshort =0 SHOULD BE ZERO 6711>>>0x1E8 ulelong <0xffffffff \b, %u free clusters 6712>>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u 6713 6714# added by Joerg Jenderek at Nov 2012 6715# http://www.thenakedpc.com/articles/v04/08/0408-05.html 6716# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data 67170 string PNCIHISK\0 Norton Utilities disc image data 6718# real x86 boot sector with jump instruction 6719>509 search/1026 \x55\xAA\xeb 6720>>&-1 indirect x \b; contains 6721# http://file-extension.net/seeker/file_extension_dat 67220 string PNCIUNDO Norton Disk Doctor UnDo file 6723# 6724 6725# updated by Joerg Jenderek at Sep 2007 6726>3 ubyte 0 6727#no active flag 6728>>446 ubyte 0 6729# partition 1 not empty 6730>>>450 ubyte >0 6731# partitions 3,4 empty 6732>>>>482 ubyte 0 6733>>>>>498 ubyte 0 6734# partition 2 ID=0,5,15 6735>>>>>>466 ubyte <0x10 6736>>>>>>>466 ubyte 0x05 \b, extended partition table 6737>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) 6738>>>>>>>466 ubyte 0x0 \b, extended partition table (last) 6739 6740# DOS x86 sector separated and moved from "x86 boot sector" by Joerg Jenderek at May 2011 6741 6742>0x200 lelong 0x82564557 \b, BSD disklabel 6743# FATX 67440 string FATX FATX filesystem data 6745 6746# romfs filesystems - Juan Cespedes <cespedes@debian.org> 67470 string -rom1fs- romfs filesystem, version 1 6748>8 belong x %d bytes, 6749>16 string x named %s. 6750 6751# netboot image - Juan Cespedes <cespedes@debian.org> 67520 lelong 0x1b031336L Netboot image, 6753>4 lelong&0xFFFFFF00 0 6754>>4 lelong&0x100 0x000 mode 2 6755>>4 lelong&0x100 0x100 mode 3 6756>4 lelong&0xFFFFFF00 !0 unknown mode 6757 67580x18b string OS/2 OS/2 Boot Manager 6759 6760# updated by Joerg Jenderek at Oct 2008 and Sep 2012 6761# http://syslinux.zytor.com/iso.php 6762# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05 6763# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop 67640 ulequad&0x909000007cc0eafa 0x909000007c40eafa 6765>631 search/689 ISOLINUX\ isolinux Loader 6766>>&0 string x (version %-4.4s) 6767# http://syslinux.zytor.com/pxe.php 6768# assembler instructions: jmp 7C05 67690 ulelong 0x007c05ea pxelinux loader (version 2.13 or older) 6770# assembler instructions: pushfd;pushad 67710 ulelong 0x60669c66 pxelinux loader 6772# assembler instructions: jmp 05 67730 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer) 6774# http://syslinux.zytor.com/wiki/index.php/SYSLINUX 67750 string LDLINUX\ SYS\ SYSLINUX loader 6776>12 string x (older version %-4.4s) 67770 string \r\nSYSLINUX\ SYSLINUX loader 6778>11 string x (version %-4.4s) 6779# syslinux updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012 6780# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX" 67810 ulelong&0x80909bEB 0x009018EB 6782# OEM-ID not always "SYSLINUX" 6783>434 search/47 Boot\ failed 6784# followed by \r\n\0 or :\ 6785>>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older) 6786>>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9) 6787>459 search/30 Boot\ error\r\n\0 6788>>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer) 6789# SYSLINUX MBR updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012 6790# assembler instructions: mov di,0600h;mov cx,0100h 679116 search/4 \xbf\x00\x06\xb9\x00\x01 6792# to display SYSLINUX MBR (36) before old x86 boot sector one with partition table (strength=50+21) 6793!:strength +36 6794>94 search/249 Missing\ operating\ system 6795# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other 6796# skip Ranish MBR 6797>>408 search/4 HD1/\0 6798>>408 default x 6799>>>250 search/118 \0Operating\ system\ load SYSLINUX MBR 6800# followed by "ing " or space 6801>>>>292 search/98 error 6802>>>>>&0 string \r (version 3.35 or older) 6803>>>>>&0 string .\r (version 3.52 or newer) 6804>>>>>&0 default x (version 3.36-3.51 ) 6805>368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR 6806>>156 search/10 \0Boot\ partition\ not\ found\r\n 6807>>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older) 6808>>174 search/10 \0Missing\ OS\r\n 6809>>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer) 6810# SYSLINUX END 6811 6812# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012 6813# assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax, 68140 ubequad 0x31c08ed0bc007c8e 6815# mbr_bootsel magic before partition table not reliable with small ipl fragments 6816#>444 uleshort 0xb5e1 6817>0004 uleshort x 6818# ERRorTeXT 6819>>181 search/166 Error\ \0\r\n NetBSD mbr 6820# NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS 6821>>>0x1B8 ubelong >0 \b,Serial 0x%-.8x 6822# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx 6823>>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector 6824# BOOT_EXTENDED definitions contains assembler instructions: 6825# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13 6826>>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended 6827# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al 6828>>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO 6829# not TERSE_ERROR 6830>>>196 search/106 No\ active\ partition\0 6831>>>>&0 string Disk\ read\ error\0 6832>>>>>&0 string No\ operating\ system\0 \b,verbose 6833# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13 6834>>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS 6835# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13 6836>>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check 6837# assembler instructions: movw nametab,bx 6838>>>0x26 search/21 \xBB\x94\x07 6839# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf 6840>>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94 6841>>>>>181 search/166 Error\ \0 6842# "a: disk" , "Fn: diskn" or "NetBSD MBR boot" 6843>>>>>>&3 string x \b,"%s" 6844# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html 6845# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4 6846# assembler instructions: jmp short 0x58;nop;ASCII 68470 ubequad&0xeb58908000000000 0xeb58900000000000 6848# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss, 6849>(1.b+2) ubequad 0xfa31c08ed88ec08e 6850# Error messages at end of code 6851>>376 string No\ operating\ system\r\n\0 6852>>>398 string Disk\ error\r\n\0FDD\0HDD\0 6853>>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr 6854 6855# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/ 6856# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11 6857# for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI, 6858# or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS, 68590 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC 6860# pointer to the data starting with Neil Turton signature string 6861>(0x1BC.s) string NDTmbr 6862>>&-14 string 1234F\0 Turton mbr ( 6863# parameters also viewed by install-mbr --list 6864>>>(0x1BC.s+7) ubyte x \b%u<= 6865>>>(0x1BC.s+9) ubyte x \bVersion<=%u 6866#>>>(0x1BC.s+8) ubyte x asm_flag_%x 6867>>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix 6868# variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode 6869>>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk 6870#0x1~1,..,0x8~4,0x10~F,0x80~A enabled 6871#>>>(0x1BC.s+10) ubyte x \b,flags 0x%x 6872#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot 6873#>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x 6874# for older versions 6875>>>(0x1BC.s+9) ubyte <2 6876#>>>>(0x1BC.s+12) ubyte 18 \b,%u/18 seconds 6877>>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds 6878# floppy A: or B: 6879>>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x 6880>>>>(0x1BC.s+13) ubyte >1 6881# 1st hard disc 6882#>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x 6883# not 1st hard disc 6884>>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x 6885# for version >= 2 maximal timeout can be 65534 6886>>>(0x1BC.s+9) ubyte >1 6887#>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds 6888>>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds 6889# floppy A: or B: 6890>>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x 6891>>>>(0x1BC.s+14) ubyte >1 6892# 1st hard disc 6893#>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x 6894# not 1st hard disc 6895>>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x 6896>>>0 ubyte x \b) 6897 6898# added by Joerg Jenderek 6899# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or 6900# grub-1.94/kern/i386/pc/startup.S 6901# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 6902# usual values are marked with comments to get only informations of strange GRUB loaders 69030x200 uleshort 0x70EA 6904# found only version 3.{1,2} 6905>0x206 ubeshort >0x0300 6906# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00" 6907>>0x212 ubyte >0x29 6908>>>0x213 ubyte >0x29 6909# not iso9660_stage1_5 6910#>>>0 ulelong&0x00BE5652 0x00BE5652 6911>>>>0x213 ubyte >0x29 GRand Unified Bootloader 6912# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2" 6913>>>>0x217 ubyte 0xFF stage1_5 6914>>>>0x217 ubyte <0xFF stage2 6915>>>>0x206 ubyte x \b version %u 6916>>>>0x207 ubyte x \b.%u 6917# module_size for 1.94 6918>>>>0x208 ulelong <0xffffff \b, installed partition %u 6919#>>>>0x208 ulelong =0xffffff \b, %u (default) 6920>>>>0x208 ulelong >0xffffff \b, installed partition %u 6921# GRUB 0.5.95 unofficial 6922>>>>0x20C ulelong&0x2E300000 0x2E300000 6923# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6924>>>>>0x20C ubyte x \b, identifier 0x%x 6925#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default) 6926>>>>>0x20D ubyte >0 \b, LBA flag 0x%x 6927# GRUB version as string 6928>>>>>0x20E string >\0 \b, GRUB version %-s 6929# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 6930>>>>>>0x215 ulong 0xffffffff 6931>>>>>>>0x219 string >\0 \b, configuration file %-s 6932>>>>>>0x215 ulong !0xffffffff 6933>>>>>>>0x215 string >\0 \b, configuration file %-s 6934# newer GRUB versions 6935>>>>0x20C ulelong&0x2E300000 !0x2E300000 6936##>>>>>0x20C ulelong =0 \b, saved entry %d (usual) 6937>>>>>0x20C ulelong >0 \b, saved entry %d 6938# for 1.94 contains kernel image size 6939# for 0.93,0.94,0.96,0.97 6940# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 6941>>>>>0x210 ubyte x \b, identifier 0x%x 6942# The flag for LBA forcing is in most cases 0 6943#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default) 6944>>>>>0x211 ubyte >0 \b, LBA flag 0x%x 6945# GRUB version as string 6946>>>>>0x212 string >\0 \b, GRUB version %-s 6947# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 6948>>>>>0x217 ulong 0xffffffff 6949>>>>>>0x21b string >\0 \b, configuration file %-s 6950>>>>>0x217 ulong !0xffffffff 6951>>>>>>0x217 string >\0 \b, configuration file %-s 6952 6953# DOS x86 sector updated and separated from "x86 boot sector" by Joerg Jenderek at May 2011 6954# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 6955# over BIOS parameter block (BPB) 6956# http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD 6957# older drives may use Near JuMP instruction E9 xx xx 6958# minimal short forward jump found 0x29 for bootloaders or 0x0 6959# maximal short forward jump is 0x7f 6960# OEM-ID is empty or contain readable bytes 69610 ulelong&0x804000E9 0x000000E9 6962# mtools-3.9.8/msdos.h 6963# usual values are marked with comments to get only informations of strange FAT systems 6964# valid sectorsize must be a power of 2 from 32 to 32768 6965>11 uleshort&0xf001f 0 6966>>11 uleshort <32769 6967>>>11 uleshort >31 6968>>>>21 ubyte&0xf0 0xF0 6969>>>>>0 ubyte 0xEB 6970>>>>>>1 ubyte x \b, code offset 0x%x+2 6971>>>>>0 ubyte 0xE9 6972>>>>>>1 uleshort x \b, code offset 0x%x+2 6973>>>>>3 string >\0 \b, OEM-ID "%-.8s" 6974#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC 6975>>>>>>8 string IHC \b cached by Windows 9M 6976>>>>>11 uleshort >512 \b, Bytes/sector %u 6977#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) 6978>>>>>11 uleshort <512 \b, Bytes/sector %u 6979>>>>>13 ubyte >1 \b, sectors/cluster %u 6980#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) 6981>>>>>82 string FAT32 6982>>>>>>14 uleshort !32 \b, reserved sectors %u 6983#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) 6984>>>>>82 string !FAT32 6985>>>>>>14 uleshort >1 \b, reserved sectors %u 6986#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) 6987#>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS) 6988>>>>>16 ubyte >2 \b, FATs %u 6989#>>>>>16 ubyte =2 \b, FATs %u (usual) 6990>>>>>16 ubyte =1 \b, FAT %u 6991>>>>>16 ubyte >0 6992>>>>>17 uleshort >0 \b, root entries %u 6993#>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32) 6994>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) 6995#>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32) 6996>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x 6997#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) 6998>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x 6999>>>>>22 uleshort >0 \b, sectors/FAT %u 7000#>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32) 7001>>>>>24 uleshort x \b, sectors/track %u 7002>>>>>26 ubyte >2 \b, heads %u 7003#>>>>>26 ubyte =2 \b, heads %u (usual floppy) 7004>>>>>26 ubyte =1 \b, heads %u 7005# valid only for sector sizes with more then 32 Bytes 7006>>>>>11 uleshort >32 7007# skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk 7008>>>>>>38 ubyte !0x70 7009>>>>>>>28 ulelong >0 \b, hidden sectors %u 7010#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) 7011>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) 7012#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) 7013# FAT<32 bit specific 7014>>>>>>>82 string !FAT32 7015#>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) 7016#>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) 7017>>>>>>>>36 ubyte !0x80 7018>>>>>>>>>36 ubyte !0 \b, physical drive 0x%x 7019>>>>>>>>37 ubyte >0 \b, reserved 0x%x 7020#>>>>>>>>37 ubyte =0 \b, reserved 0x%x 7021# value is 0x80 for NTFS 7022>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 7023>>>>>>>>38 ubyte =0x29 7024>>>>>>>>>39 ulelong x \b, serial number 0x%x 7025>>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s" 7026>>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" 7027>>>>>>>>>43 string =NO\ NAME \b, unlabeled 7028# there exist some old floppies without word FAT at offset 54 7029# a word like "FATnm " is only a hint for a FAT size on nm-bits 7030# Normally the number of clusters is calculated by the values of BPP. 7031# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit, 7032# otherwise FAT is 16 bit. 7033# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html 7034>>>>>>54 string FAT \b, FAT 7035>>>>>>>54 string FAT12 \b (12 bit) 7036>>>>>>>54 string FAT16 \b (16 bit) 7037# FAT32 bit specific 7038>>>>>82 string FAT32 \b, FAT (32 bit) 7039>>>>>>36 ulelong x \b, sectors/FAT %u 7040# http://technet.microsoft.com/en-us/library/cc977221.aspx 7041>>>>>>40 uleshort >0 \b, extension flags 0x%x 7042#>>>>>>40 uleshort =0 \b, extension flags %u 7043>>>>>>42 uleshort >0 \b, fsVersion %u 7044#>>>>>>42 uleshort =0 \b, fsVersion %u (usual) 7045>>>>>>44 ulelong >2 \b, rootdir cluster %u 7046#>>>>>>44 ulelong =2 \b, rootdir cluster %u 7047#>>>>>>44 ulelong =1 \b, rootdir cluster %u 7048>>>>>>48 uleshort >1 \b, infoSector %u 7049#>>>>>>48 uleshort =1 \b, infoSector %u (usual) 7050>>>>>>48 uleshort <1 \b, infoSector %u 7051>>>>>>50 uleshort >6 \b, Backup boot sector %u 7052#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) 7053>>>>>>50 uleshort <6 \b, Backup boot sector %u 7054# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 7055>>>>>>52 ulelong >0 \b, reserved1 0x%x 7056>>>>>>56 ulelong >0 \b, reserved2 0x%x 7057>>>>>>60 ulelong >0 \b, reserved3 0x%x 7058# same structure as FAT1X 7059#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) 7060#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) 7061>>>>>>64 ubyte !0x80 7062>>>>>>>64 ubyte >0 \b, physical drive 0x%x 7063# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 7064>>>>>>65 ubyte >0 \b, reserved 0x%x 7065>>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 7066>>>>>>66 ubyte =0x29 7067>>>>>>>67 ulelong x \b, serial number 0x%x 7068>>>>>>>71 string <NO\ NAME \b, label: "%11.11s" 7069>>>>>>>71 string >NO\ NAME \b, label: "%11.11s" 7070>>>>>>>71 string =NO\ NAME \b, unlabeled 7071# additional tests for floppy image added by Joerg Jenderek 7072# no fixed disk 7073>>>>>21 ubyte !0xF8 7074# floppy media with 12 bit FAT 7075>>>>>>54 string !FAT16 7076# test for FAT after bootsector 7077>>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT 7078# floppy image 7079!:mime application/x-ima 7080# NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm 7081# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html 7082# 0 FATs 7083>>>>>16 ubyte =0 7084# 0 root entries 7085>>>>>>17 uleshort =0 7086# 0 DOS sectors 7087>>>>>>>19 uleshort =0 7088# 0 sectors/FAT 7089# dos < 4.0 BootSector value found is 0x80 7090#38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x) 7091>>>>>>>>22 uleshort =0 \b; NTFS 7092>>>>>>>>>24 uleshort >0 \b, sectors/track %u 7093>>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x 7094>>>>>>>>>40 ulequad >0 \b, sectors %lld 7095>>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld 7096>>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld 7097# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters. 7098# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes. 7099>>>>>>>>>64 lelong <256 7100>>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d 7101>>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%hhi) 7102# Values 0 to 127 represent index block sizes of 0 to 127 clusters. 7103# Values 128 to 255 represent index block sizes of 2^(256-N) byte 7104>>>>>>>>>68 ulelong <256 7105>>>>>>>>>>68 ulelong <128 \b, clusters/index block %d 7106#>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d) 7107>>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%hhi) 7108>>>>>>>>>72 ulequad x \b, serial number 0%llx 7109>>>>>>>>>80 ulelong >0 \b, checksum 0x%x 7110#>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual) 7111>>>>>>>>>0x258 ulelong&0x00009090 =0x00009090 7112>>>>>>>>>>&-92 indirect x \b; contains 7113# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013 7114# http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm 7115# unused assembler instructions JMP y2;NOP;NOP 71160x056 ulelong&0xFFFF0FFF 0x909002EB 7117# unicode loadername terminated by CTRL-D 7118>(0.s*2) ulelong&0xFFFFFF00 0x00040000 7119# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR 7120>>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s 7121>>0x12 string $ 7122>>>0x0c lestring16 x \b%-2.2s 7123### DOS,NTFS boot sectors end 7124 71259564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), 7126>8404 string x last mounted on %s, 7127#>9504 ledate x last checked at %s, 7128>8224 ledate x last written at %s, 7129>8401 byte x clean flag %d, 7130>8228 lelong x number of blocks %d, 7131>8232 lelong x number of data blocks %d, 7132>8236 lelong x number of cylinder groups %d, 7133>8240 lelong x block size %d, 7134>8244 lelong x fragment size %d, 7135>8252 lelong x minimum percentage of free blocks %d, 7136>8256 lelong x rotational delay %dms, 7137>8260 lelong x disk rotational speed %drps, 7138>8320 lelong 0 TIME optimization 7139>8320 lelong 1 SPACE optimization 7140 714142332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 7142>&-1164 string x last mounted on %s, 7143>&-696 string >\0 volume name %s, 7144>&-304 leqldate x last written at %s, 7145>&-1167 byte x clean flag %d, 7146>&-1168 byte x readonly flag %d, 7147>&-296 lequad x number of blocks %lld, 7148>&-288 lequad x number of data blocks %lld, 7149>&-1332 lelong x number of cylinder groups %d, 7150>&-1328 lelong x block size %d, 7151>&-1324 lelong x fragment size %d, 7152>&-180 lelong x average file size %d, 7153>&-176 lelong x average number of files in dir %d, 7154>&-272 lequad x pending blocks to free %lld, 7155>&-264 lelong x pending inodes to free %ld, 7156>&-664 lequad x system-wide uuid %0llx, 7157>&-1316 lelong x minimum percentage of free blocks %d, 7158>&-1248 lelong 0 TIME optimization 7159>&-1248 lelong 1 SPACE optimization 7160 716166908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 7162>&-1164 string x last mounted on %s, 7163>&-696 string >\0 volume name %s, 7164>&-304 leqldate x last written at %s, 7165>&-1167 byte x clean flag %d, 7166>&-1168 byte x readonly flag %d, 7167>&-296 lequad x number of blocks %lld, 7168>&-288 lequad x number of data blocks %lld, 7169>&-1332 lelong x number of cylinder groups %d, 7170>&-1328 lelong x block size %d, 7171>&-1324 lelong x fragment size %d, 7172>&-180 lelong x average file size %d, 7173>&-176 lelong x average number of files in dir %d, 7174>&-272 lequad x pending blocks to free %lld, 7175>&-264 lelong x pending inodes to free %ld, 7176>&-664 lequad x system-wide uuid %0llx, 7177>&-1316 lelong x minimum percentage of free blocks %d, 7178>&-1248 lelong 0 TIME optimization 7179>&-1248 lelong 1 SPACE optimization 7180 71819564 belong 0x00011954 Unix Fast File system [v1] (big-endian), 7182>7168 belong 0x4c41424c Apple UFS Volume 7183>>7186 string x named %s, 7184>>7176 belong x volume label version %d, 7185>>7180 bedate x created on %s, 7186>8404 string x last mounted on %s, 7187#>9504 bedate x last checked at %s, 7188>8224 bedate x last written at %s, 7189>8401 byte x clean flag %d, 7190>8228 belong x number of blocks %d, 7191>8232 belong x number of data blocks %d, 7192>8236 belong x number of cylinder groups %d, 7193>8240 belong x block size %d, 7194>8244 belong x fragment size %d, 7195>8252 belong x minimum percentage of free blocks %d, 7196>8256 belong x rotational delay %dms, 7197>8260 belong x disk rotational speed %drps, 7198>8320 belong 0 TIME optimization 7199>8320 belong 1 SPACE optimization 7200 720142332 belong 0x19540119 Unix Fast File system [v2] (big-endian) 7202>&-1164 string x last mounted on %s, 7203>&-696 string >\0 volume name %s, 7204>&-304 beqldate x last written at %s, 7205>&-1167 byte x clean flag %d, 7206>&-1168 byte x readonly flag %d, 7207>&-296 bequad x number of blocks %lld, 7208>&-288 bequad x number of data blocks %lld, 7209>&-1332 belong x number of cylinder groups %d, 7210>&-1328 belong x block size %d, 7211>&-1324 belong x fragment size %d, 7212>&-180 belong x average file size %d, 7213>&-176 belong x average number of files in dir %d, 7214>&-272 bequad x pending blocks to free %lld, 7215>&-264 belong x pending inodes to free %ld, 7216>&-664 bequad x system-wide uuid %0llx, 7217>&-1316 belong x minimum percentage of free blocks %d, 7218>&-1248 belong 0 TIME optimization 7219>&-1248 belong 1 SPACE optimization 7220 722166908 belong 0x19540119 Unix Fast File system [v2] (big-endian) 7222>&-1164 string x last mounted on %s, 7223>&-696 string >\0 volume name %s, 7224>&-304 beqldate x last written at %s, 7225>&-1167 byte x clean flag %d, 7226>&-1168 byte x readonly flag %d, 7227>&-296 bequad x number of blocks %lld, 7228>&-288 bequad x number of data blocks %lld, 7229>&-1332 belong x number of cylinder groups %d, 7230>&-1328 belong x block size %d, 7231>&-1324 belong x fragment size %d, 7232>&-180 belong x average file size %d, 7233>&-176 belong x average number of files in dir %d, 7234>&-272 bequad x pending blocks to free %lld, 7235>&-264 belong x pending inodes to free %ld, 7236>&-664 bequad x system-wide uuid %0llx, 7237>&-1316 belong x minimum percentage of free blocks %d, 7238>&-1248 belong 0 TIME optimization 7239>&-1248 belong 1 SPACE optimization 7240 7241# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca> 7242# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net> 7243# volume label and UUID Russell Coker 7244# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 72450x438 leshort 0xEF53 Linux 7246>0x44c lelong x rev %d 7247>0x43e leshort x \b.%d 7248# No journal? ext2 7249>0x45c lelong ^0x0000004 ext2 filesystem data 7250>>0x43a leshort ^0x0000001 (mounted or unclean) 7251# Has a journal? ext3 or ext4 7252>0x45c lelong &0x0000004 7253# and small INCOMPAT? 7254>>0x460 lelong <0x0000040 7255# and small RO_COMPAT? 7256>>>0x464 lelong <0x0000008 ext3 filesystem data 7257# else large RO_COMPAT? 7258>>>0x464 lelong >0x0000007 ext4 filesystem data 7259# else large INCOMPAT? 7260>>0x460 lelong >0x000003f ext4 filesystem data 7261>0x468 belong x \b, UUID=%08x 7262>0x46c beshort x \b-%04x 7263>0x46e beshort x \b-%04x 7264>0x470 beshort x \b-%04x 7265>0x472 belong x \b-%08x 7266>0x476 beshort x \b%04x 7267>0x478 string >0 \b, volume name "%s" 7268# General flags for any ext* fs 7269>0x460 lelong &0x0000004 (needs journal recovery) 7270>0x43a leshort &0x0000002 (errors) 7271# INCOMPAT flags 7272>0x460 lelong &0x0000001 (compressed) 7273#>0x460 lelong &0x0000002 (filetype) 7274#>0x460 lelong &0x0000010 (meta bg) 7275>0x460 lelong &0x0000040 (extents) 7276>0x460 lelong &0x0000080 (64bit) 7277#>0x460 lelong &0x0000100 (mmp) 7278#>0x460 lelong &0x0000200 (flex bg) 7279# RO_INCOMPAT flags 7280#>0x464 lelong &0x0000001 (sparse super) 7281>0x464 lelong &0x0000002 (large files) 7282>0x464 lelong &0x0000008 (huge files) 7283#>0x464 lelong &0x0000010 (gdt checksum) 7284#>0x464 lelong &0x0000020 (many subdirs) 7285#>0x463 lelong &0x0000040 (extra isize) 7286 7287# Minix filesystems - Juan Cespedes <cespedes@debian.org> 72880x410 leshort 0x137f 7289!:strength / 2 7290>0x402 beshort < 100 7291>0x402 beshort > -1 Minix filesystem, V1, %d zones 7292>0x1e string minix \b, bootable 72930x410 beshort 0x137f 7294!:strength / 2 7295>0x402 beshort < 100 7296>0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones 7297>0x1e string minix \b, bootable 72980x410 leshort 0x138f 7299!:strength / 2 7300>0x402 beshort < 100 7301>0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones 7302>0x1e string minix \b, bootable 73030x410 beshort 0x138f 7304!:strength / 2 7305>0x402 beshort < 100 7306>0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones 7307>0x1e string minix \b, bootable 73080x410 leshort 0x2468 7309>0x402 beshort < 100 7310>>0x402 beshort > -1 Minix filesystem, V2, %d zones 7311>0x1e string minix \b, bootable 73120x410 beshort 0x2468 7313>0x402 beshort < 100 7314>0x402 beshort > -1 Minix filesystem, V2 (big endian), %d zones 7315>0x1e string minix \b, bootable 7316 73170x410 leshort 0x2478 7318>0x402 beshort < 100 7319>0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones 7320>0x1e string minix \b, bootable 73210x410 leshort 0x2478 7322>0x402 beshort < 100 7323>0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones 7324>0x1e string minix \b, bootable 73250x410 beshort 0x2478 7326>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones 7327>0x1e string minix \b, bootable 73280x410 leshort 0x4d5a 7329>0x402 beshort !0 Minix filesystem, V3, %d zones 7330>0x1e string minix \b, bootable 7331 7332# SGI disk labels - Nathan Scott <nathans@debian.org> 73330 belong 0x0BE5A941 SGI disk label (volume header) 7334 7335# SGI XFS filesystem - Nathan Scott <nathans@debian.org> 73360 belong 0x58465342 SGI XFS filesystem data 7337>0x4 belong x (blksz %d, 7338>0x68 beshort x inosz %d, 7339>0x64 beshort ^0x2004 v1 dirs) 7340>0x64 beshort &0x2004 v2 dirs) 7341 7342############################################################################ 7343# Minix-ST kernel floppy 73440x800 belong 0x46fc2700 Atari-ST Minix kernel image 7345>19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy 7346>19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy 7347 7348############################################################################ 7349# Hmmm, is this a better way of detecting _standard_ floppy images ? 735019 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k 7351>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 735219 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k 7353>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 735419 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k 7355>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 7356 735719 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM 7358>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 735919 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs 7360>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 7361 736219 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k 736319 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k 7364 7365# Valid media descriptor bytes for MS-DOS: 7366# 7367# Byte Capacity Media Size and Type 7368# ------------------------------------------------- 7369# 7370# F0 2.88 MB 3.5-inch, 2-sided, 36-sector 7371# F0 1.44 MB 3.5-inch, 2-sided, 18-sector 7372# F9 720K 3.5-inch, 2-sided, 9-sector 7373# F9 1.2 MB 5.25-inch, 2-sided, 15-sector 7374# FD 360K 5.25-inch, 2-sided, 9-sector 7375# FF 320K 5.25-inch, 2-sided, 8-sector 7376# FC 180K 5.25-inch, 1-sided, 9-sector 7377# FE 160K 5.25-inch, 1-sided, 8-sector 7378# FE 250K 8-inch, 1-sided, single-density 7379# FD 500K 8-inch, 2-sided, single-density 7380# FE 1.2 MB 8-inch, 2-sided, double-density 7381# F8 ----- Fixed disk 7382# 7383# FC xxxK Apricot 70x1x9 boot disk. 7384# 7385# Originally a bitmap: 7386# xxxxxxx0 Not two sided 7387# xxxxxxx1 Double sided 7388# xxxxxx0x Not 8 SPT 7389# xxxxxx1x 8 SPT 7390# xxxxx0xx Not Removable drive 7391# xxxxx1xx Removable drive 7392# 11111xxx Must be one. 7393# 7394# But now it's rather random: 7395# 111111xx Low density disk 7396# 00 SS, Not 8 SPT 7397# 01 DS, Not 8 SPT 7398# 10 SS, 8 SPT 7399# 11 DS, 8 SPT 7400# 7401# 11111001 Double density 3 1/2 floppy disk, high density 5 1/4 7402# 11110000 High density 3 1/2 floppy disk 7403# 11111000 Hard disk any format 7404# 7405 7406# CDROM Filesystems 7407# Modified for UDF by gerardo.cacciari@gmail.com 740832769 string CD001 # 7409!:mime application/x-iso9660-image 7410>38913 string !NSR0 ISO 9660 CD-ROM filesystem data 7411>38913 string NSR0 UDF filesystem data 7412>>38917 string 1 (version 1.0) 7413>>38917 string 2 (version 1.5) 7414>>38917 string 3 (version 2.0) 7415>>38917 byte >0x33 (unknown version, ID 0x%X) 7416>>38917 byte <0x31 (unknown version, ID 0x%X) 7417# "application id" which appears to be used as a volume label 7418>32808 string/T >\0 '%s' 7419>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) 742037633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) 7421!:mime application/x-iso9660-image 742232776 string CDROM High Sierra CD-ROM filesystem data 7423 7424# .cso files 74250 string CISO Compressed ISO CD image 7426 7427# cramfs filesystem - russell@coker.com.au 74280 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian 7429>4 lelong x size %lu 7430>8 lelong &1 version #2 7431>8 lelong &2 sorted_dirs 7432>8 lelong &4 hole_support 7433>32 lelong x CRC 0x%x, 7434>36 lelong x edition %lu, 7435>40 lelong x %lu blocks, 7436>44 lelong x %lu files 7437 74380 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian 7439>4 belong x size %lu 7440>8 belong &1 version #2 7441>8 belong &2 sorted_dirs 7442>8 belong &4 hole_support 7443>32 belong x CRC 0x%x, 7444>36 belong x edition %lu, 7445>40 belong x %lu blocks, 7446>44 belong x %lu files 7447 7448# reiserfs - russell@coker.com.au 74490x10034 string ReIsErFs ReiserFS V3.5 74500x10034 string ReIsEr2Fs ReiserFS V3.6 74510x10034 string ReIsEr3Fs ReiserFS V3.6.19 7452>0x1002c leshort x block size %d 7453>0x10032 leshort &2 (mounted or unclean) 7454>0x10000 lelong x num blocks %d 7455>0x10040 lelong 1 tea hash 7456>0x10040 lelong 2 yura hash 7457>0x10040 lelong 3 r5 hash 7458 7459# JFFS - russell@coker.com.au 74600 lelong 0x34383931 Linux Journalled Flash File system, little endian 74610 belong 0x34383931 Linux Journalled Flash File system, big endian 7462 7463# EST flat binary format (which isn't, but anyway) 7464# From: Mark Brown <broonie@sirena.org.uk> 74650 string ESTFBINR EST flat binary 7466 7467# Aculab VoIP firmware 7468# From: Mark Brown <broonie@sirena.org.uk> 74690 string VoIP\ Startup\ and Aculab VoIP firmware 7470>35 string x format %s 7471 7472# From: Mark Brown <broonie@sirena.org.uk> [old] 7473# From: Behan Webster <behanw@websterwood.com> 74740 belong 0x27051956 u-boot legacy uImage, 7475>32 string x %s, 7476>28 byte 0 Invalid os/ 7477>28 byte 1 OpenBSD/ 7478>28 byte 2 NetBSD/ 7479>28 byte 3 FreeBSD/ 7480>28 byte 4 4.4BSD/ 7481>28 byte 5 Linux/ 7482>28 byte 6 SVR4/ 7483>28 byte 7 Esix/ 7484>28 byte 8 Solaris/ 7485>28 byte 9 Irix/ 7486>28 byte 10 SCO/ 7487>28 byte 11 Dell/ 7488>28 byte 12 NCR/ 7489>28 byte 13 LynxOS/ 7490>28 byte 14 VxWorks/ 7491>28 byte 15 pSOS/ 7492>28 byte 16 QNX/ 7493>28 byte 17 Firmware/ 7494>28 byte 18 RTEMS/ 7495>28 byte 19 ARTOS/ 7496>28 byte 20 Unity OS/ 7497>28 byte 21 INTEGRITY/ 7498>29 byte 0 \bInvalid CPU, 7499>29 byte 1 \bAlpha, 7500>29 byte 2 \bARM, 7501>29 byte 3 \bIntel x86, 7502>29 byte 4 \bIA64, 7503>29 byte 5 \bMIPS, 7504>29 byte 6 \bMIPS 64-bit, 7505>29 byte 7 \bPowerPC, 7506>29 byte 8 \bIBM S390, 7507>29 byte 9 \bSuperH, 7508>29 byte 10 \bSparc, 7509>29 byte 11 \bSparc 64-bit, 7510>29 byte 12 \bM68K, 7511>29 byte 13 \bNios-32, 7512>29 byte 14 \bMicroBlaze, 7513>29 byte 15 \bNios-II, 7514>29 byte 16 \bBlackfin, 7515>29 byte 17 \bAVR32, 7516>29 byte 18 \bSTMicroelectronics ST200, 7517>30 byte 0 Invalid Image 7518>30 byte 1 Standalone Program 7519>30 byte 2 OS Kernel Image 7520>30 byte 3 RAMDisk Image 7521>30 byte 4 Multi-File Image 7522>30 byte 5 Firmware Image 7523>30 byte 6 Script File 7524>30 byte 7 Filesystem Image (any type) 7525>30 byte 8 Binary Flat Device Tree BLOB 7526>31 byte 0 (Not compressed), 7527>31 byte 1 (gzip), 7528>31 byte 2 (bzip2), 7529>31 byte 3 (lzma), 7530>12 belong x %d bytes, 7531>8 bedate x %s, 7532>16 belong x Load Address: 0x%08X, 7533>20 belong x Entry Point: 0x%08X, 7534>4 belong x Header CRC: 0x%08X, 7535>24 belong x Data CRC: 0x%08X 7536 7537# JFFS2 file system 75380 leshort 0x1984 Linux old jffs2 filesystem data little endian 75390 leshort 0x1985 Linux jffs2 filesystem data little endian 7540 7541# Squashfs 75420 string sqsh Squashfs filesystem, big endian, 7543>28 beshort x version %d. 7544>30 beshort x \b%d, 7545>28 beshort <3 7546>>8 belong x %d bytes, 7547>28 beshort >2 7548>>28 beshort <4 7549>>>63 bequad x %lld bytes, 7550>>28 beshort >3 7551>>>40 bequad x %lld bytes, 7552#>>67 belong x %d bytes, 7553>4 belong x %d inodes, 7554>28 beshort <2 7555>>32 beshort x blocksize: %d bytes, 7556>28 beshort >1 7557>>28 beshort <4 7558>>>51 belong x blocksize: %d bytes, 7559>>28 beshort >3 7560>>>12 belong x blocksize: %d bytes, 7561>28 beshort <4 7562>>39 bedate x created: %s 7563>28 beshort >3 7564>>8 bedate x created: %s 75650 string hsqs Squashfs filesystem, little endian, 7566>28 leshort x version %d. 7567>30 leshort x \b%d, 7568>28 leshort <3 7569>>8 lelong x %d bytes, 7570>28 leshort >2 7571>>28 leshort <4 7572>>>63 lequad x %lld bytes, 7573>>28 leshort >3 7574>>>40 lequad x %lld bytes, 7575#>>63 lelong x %d bytes, 7576>4 lelong x %d inodes, 7577>28 leshort <2 7578>>32 leshort x blocksize: %d bytes, 7579>28 leshort >1 7580>>28 leshort <4 7581>>>51 lelong x blocksize: %d bytes, 7582>>28 leshort >3 7583>>>12 lelong x blocksize: %d bytes, 7584>28 leshort <4 7585>>39 ledate x created: %s 7586>28 leshort >3 7587>>8 ledate x created: %s 7588 7589# AFS Dump Magic 7590# From: Ty Sarna <tsarna@sarna.org> 75910 string \x01\xb3\xa1\x13\x22 AFS Dump 7592>&0 belong x (v%d) 7593>>&0 byte 0x76 7594>>>&0 belong x Vol %d, 7595>>>>&0 byte 0x6e 7596>>>>>&0 string x %s 7597>>>>>>&1 byte 0x74 7598>>>>>>>&0 beshort 2 7599>>>>>>>>&4 bedate x on: %s 7600>>>>>>>>&0 bedate =0 full dump 7601>>>>>>>>&0 bedate !0 incremental since: %s 7602 7603#---------------------------------------------------------- 7604#delta ISO Daniel Novotny (dnovotny@redhat.com) 76050 string DISO Delta ISO data 7606>4 belong x version %d 7607 7608# VMS backup savesets - gerardo.cacciari@gmail.com 7609# 76104 string \x01\x00\x01\x00\x01\x00 7611>(0.s+16) string \x01\x01 7612>>&(&0.b+8) byte 0x42 OpenVMS backup saveset data 7613>>>40 lelong x (block size %d, 7614>>>49 string >\0 original name '%s', 7615>>>2 short 1024 VAX generated) 7616>>>2 short 2048 AXP generated) 7617>>>2 short 4096 I64 generated) 7618 7619# Summary: Oracle Clustered Filesystem 7620# Created by: Aaron Botsis <redhat@digitalmafia.org> 76218 string OracleCFS Oracle Clustered Filesystem, 7622>4 long x rev %d 7623>0 long x \b.%d, 7624>560 string x label: %.64s, 7625>136 string x mountpoint: %.128s 7626 7627# Summary: Oracle ASM tagged volume 7628# Created by: Aaron Botsis <redhat@digitalmafia.org> 762932 string ORCLDISK Oracle ASM Volume, 7630>40 string x Disk Name: %0.12s 763132 string ORCLCLRD Oracle ASM Volume (cleared), 7632>40 string x Disk Name: %0.12s 7633 7634# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org> 76358 string OracleCFS Oracle Clustered Filesystem, 7636>4 long x rev %d 7637>0 long x \b.%d, 7638>560 string x label: %.64s, 7639>136 string x mountpoint: %.128s 7640 7641# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org> 764232 string ORCLDISK Oracle ASM Volume, 7643>40 string x Disk Name: %0.12s 764432 string ORCLCLRD Oracle ASM Volume (cleared), 7645>40 string x Disk Name: %0.12s 7646 7647# Compaq/HP RILOE floppy image 7648# From: Dirk Jagdmann <doj@cubic.org> 76490 string CPQRFBLO Compaq/HP RILOE floppy image 7650 7651#------------------------------------------------------------------------------ 7652# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours). 7653# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes, 7654# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com 7655# 76561008 string DECFILE11 Files-11 On-Disk Structure 7657>525 byte x Level %d 7658>525 byte x (ODS-%d); 7659>1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system; 7660>1017 string B 7661>>525 byte 2 VAX/VMS or OpenVMS file system; 7662>>525 byte 5 OpenVMS Alpha or Itanium file system; 7663>984 string x volume label is '%-12.12s' 7664 7665# From: Thomas Klausner <wiz@NetBSD.org> 7666# http://filext.com/file-extension/DAA 7667# describes the daa file format. The magic would be: 76680 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive 7669 7670# From Albert Cahalan <acahalan@gmail.com> 7671# really le32 operation,destination,payloadsize (but quite predictable) 7672# 01 00 00 00 00 00 00 c0 00 02 00 00 76730 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware 7674 7675# From Eric Sandeen 7676# GFS2 76770x10000 belong 0x01161970 7678>0x10018 belong 0x0000051d GFS1 Filesystem 7679>>0x10024 belong x (blocksize %d, 7680>>0x10060 string >\0 lockproto %s) 7681>0x10018 belong 0x00000709 GFS2 Filesystem 7682>>0x10024 belong x (blocksize %d, 7683>>0x10060 string >\0 lockproto %s) 7684 7685# BTRFS 76860x10040 string _BHRfS_M BTRFS Filesystem 7687>0x1012b string >\0 (label "%s", 7688>0x10090 lelong x sectorsize %d, 7689>0x10094 lelong x nodesize %d, 7690>0x10098 lelong x leafsize %d) 7691 7692 7693# dvdisaster's .ecc 7694# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 76950 string *dvdisaster* dvdisaster error correction file 7696 7697# xfs metadump image 7698# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 7699# but can we do the << ? For now it's always 512 (0x200) anyway. 77000 string XFSM 7701>0x200 string XFSB XFS filesystem metadump image 7702 7703# Type: CROM filesystem 7704# From: Werner Fink <werner@suse.de> 77050 string CROMFS CROMFS 7706>6 string >\0 \b version %2.2s, 7707>8 ulequad >0 \b block data at %lld, 7708>16 ulequad >0 \b fblock table at %lld, 7709>24 ulequad >0 \b inode table at %lld, 7710>32 ulequad >0 \b root at %lld, 7711>40 ulelong >0 \b fblock size = %ld, 7712>44 ulelong >0 \b block size = %ld, 7713>48 ulequad >0 \b bytes = %lld 7714 7715# Type: xfs metadump image 7716# From: Daniel Novotny <dnovotny@redhat.com> 7717# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 7718# but can we do the << ? For now it's always 512 (0x200) anyway. 77190 string XFSM 7720>0x200 string XFSB XFS filesystem metadump image 7721 7722# Type: delta ISO 7723# From: Daniel Novotny <dnovotny@redhat.com> 77240 string DISO Delta ISO data, 7725>4 belong x version %d 7726 7727# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.) 7728# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags. 7729# From: Adam Buchbinder <adam.buchbinder@gmail.com> 77300x8000 string JFS1 7731# Because it's text-only magic, check a binary value (version) to be sure. 7732# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be 7733# mountable. 7734>&0 lelong <3 JFS2 filesystem image 7735# Label is followed by a UUID; we have to limit string length to avoid 7736# appending the UUID in the case of a 16-byte label. 7737>>&144 regex [\x20-\x7E]{1,16} (label "%s") 7738>>&0 lequad x \b, %lld blocks 7739>>&8 lelong x \b, blocksize %d 7740>>&32 lelong&0x00000006 >0 (dirty) 7741>>&36 lelong >0 (compressed) 7742 7743# LFS 77440 lelong 0x070162 LFS filesystem image 7745>4 lelong 1 version 1, 7746>>8 lelong x \b blocks %u, 7747>>12 lelong x \b blocks per segment %u, 7748>4 lelong 2 version 2, 7749>>8 lelong x \b fragments %u, 7750>>12 lelong x \b bytes per segment %u, 7751>16 lelong x \b disk blocks %u, 7752>20 lelong x \b block size %u, 7753>24 lelong x \b fragment size %u, 7754>28 lelong x \b fragments per block %u, 7755>32 lelong x \b start for free list %u, 7756>36 lelong x \b number of free blocks %d, 7757>40 lelong x \b number of files %u, 7758>44 lelong x \b blocks available for writing %d, 7759>48 lelong x \b inodes in cache %d, 7760>52 lelong x \b inode file disk address 0x%x, 7761>56 lelong x \b inode file inode number %u, 7762>60 lelong x \b address of last segment written 0x%x, 7763>64 lelong x \b address of next segment to write 0x%x, 7764>68 lelong x \b address of current segment written 0x%x 7765 77660 string td\000 floppy image data (TeleDisk, compressed) 77670 string TD\000 floppy image data (TeleDisk) 7768 77690 string CQ\024 floppy image data (CopyQM, 7770>16 leshort x %d sectors, 7771>18 leshort x %d heads.) 7772 77730 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk) 7774 77750 beshort 0xAA58 floppy image data (IBM SaveDskF, old) 77760 beshort 0xAA59 floppy image data (IBM SaveDskF) 77770 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed) 7778 77790 string \074CPM_Disk\076 disk image data (YAZE) 7780 7781#------------------------------------------------------------------------------ 7782# $File: flash,v 1.9 2009/11/08 01:30:01 christos Exp $ 7783# flash: file(1) magic for Macromedia Flash file format 7784# 7785# See 7786# 7787# http://www.macromedia.com/software/flash/open/ 7788# 77890 string FWS Macromedia Flash data, 7790>3 byte x version %d 7791!:mime application/x-shockwave-flash 77920 string CWS Macromedia Flash data (compressed), 7793!:mime application/x-shockwave-flash 7794>3 byte x version %d 7795# From: Cal Peake <cp@absolutedigital.net> 77960 string FLV Macromedia Flash Video 7797!:mime video/x-flv 7798 7799# 7800# Yosu Gomez 78010 string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document 78020 string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document 7803# From Dave Wilson 78040 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document 7805 7806#------------------------------------------------------------------------------ 7807# $File: fonts,v 1.26 2013/03/09 22:36:00 christos Exp $ 7808# fonts: file(1) magic for font data 7809# 78100 search/1 FONT ASCII vfont text 78110 short 0436 Berkeley vfont data 78120 short 017001 byte-swapped Berkeley vfont data 7813 7814# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com 78150 string %!PS-AdobeFont-1. PostScript Type 1 font text 7816>20 string >\0 (%s) 78176 string %!PS-AdobeFont-1. PostScript Type 1 font program data 78180 string %!FontType1 PostScript Type 1 font program data 78196 string %!FontType1 PostScript Type 1 font program data 78200 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text 7821 7822# X11 font files in SNF (Server Natural Format) format 7823# updated by Joerg Jenderek at Feb 2013 7824# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm 78250 belong 00000004 X11 SNF font data, MSB first 7826#>104 belong 00000004 X11 SNF font data, MSB first 7827!:mime application/x-font-sfn 7828# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX 78290 lelong 00000004 7830>104 lelong 00000004 X11 SNF font data, LSB first 7831!:mime application/x-font-sfn 7832 7833# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com) 78340 search/1 STARTFONT\ X11 BDF font text 7835 7836# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) 7837# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides) 78380 string \001fcp X11 Portable Compiled Font data 7839>12 byte 0x02 \b, LSB first 7840>12 byte 0x0a \b, MSB first 78410 string D1.0\015 X11 Speedo font data 7842 7843#------------------------------------------------------------------------------ 7844# FIGlet fonts and controlfiles 7845# From figmagic supplied with Figlet version 2.2 7846# "David E. O'Brien" <obrien@FreeBSD.ORG> 78470 string flf FIGlet font 7848>3 string >2a version %-2.2s 78490 string flc FIGlet controlfile 7850>3 string >2a version %-2.2s 7851 7852# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu) 7853# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++ 78540 belong 0x14025919 libGrx font data, 7855>8 leshort x %dx 7856>10 leshort x \b%d 7857>40 string x %s 7858# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu) 78590 belong 0xff464f4e DOS code page font data collection 78607 belong 0x00454741 DOS code page font data 78617 belong 0x00564944 DOS code page font data (from Linux?) 78624098 string DOSFONT DOSFONT2 encrypted font data 7863 7864# downloadable fonts for browser (prints type) anthon@mnt.org 78650 string PFR1 PFR1 font 7866>102 string >0 \b: %s 7867 7868# True Type fonts 78690 string \000\001\000\000\000 TrueType font data 7870!:mime application/x-font-ttf 7871 78720 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 78730 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 7874 7875# TrueType/OpenType font collections (.ttc) 7876# http://www.microsoft.com/typography/otspec/otff.htm 78770 string ttcf TrueType font collection data 7878>4 belong 0x00010000 \b, 1.0 7879>>8 belong >0 \b, %d fonts 7880>4 belong 0x00020000 \b, 2.0 7881>>8 belong >0 \b, %d fonts 7882# 0x44454947 = 'DSIG' 7883>>>16 belong 0x44534947 \b, digitally signed 7884 7885# Opentype font data from Avi Bercovich 78860 string OTTO OpenType font data 7887!:mime application/vnd.ms-opentype 7888 7889# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu 78900 string SplineFontDB: Spline Font Database 7891!:mime application/vnd.font-fontforge-sfd 7892>14 string x version %s 7893 7894# EOT 789534 string LP Embedded OpenType (EOT) 7896!:mime application/vnd.ms-fontobject 7897 7898# Web Open Font Format (.woff) 7899# http://www.w3.org/TR/WOFF/ 79000 string wOFF Web Open Font Format 7901>4 belong x \b, flavor %d 7902>8 belong x \b, length %d 7903>20 beshort x \b, version %hd 7904>22 beshort x \b.%hd 7905 7906#------------------------------------------------------------------------------ 7907# $File: fortran,v 1.7 2012/06/21 01:55:02 christos Exp $ 7908# FORTRAN source 79090 regex/100 \^[Cc][\ \t] FORTRAN program 7910!:mime text/x-fortran 7911!:strength - 5 7912 7913#------------------------------------------------------------------------------ 7914# $File: frame,v 1.12 2009/09/19 16:28:09 christos Exp $ 7915# frame: file(1) magic for FrameMaker files 7916# 7917# This stuff came on a FrameMaker demo tape, most of which is 7918# copyright, but this file is "published" as witness the following: 7919# 7920# Note that this is the Framemaker Maker Interchange Format, not the 7921# Normal format which would be application/vnd.framemaker. 7922# 79230 string \<MakerFile FrameMaker document 7924!:mime application/x-mif 7925>11 string 5.5 (5.5 7926>11 string 5.0 (5.0 7927>11 string 4.0 (4.0 7928>11 string 3.0 (3.0 7929>11 string 2.0 (2.0 7930>11 string 1.0 (1.0 7931>14 byte x %c) 79320 string \<MIFFile FrameMaker MIF (ASCII) file 7933!:mime application/x-mif 7934>9 string 4.0 (4.0) 7935>9 string 3.0 (3.0) 7936>9 string 2.0 (2.0) 7937>9 string 1.0 (1.x) 79380 search/1 \<MakerDictionary FrameMaker Dictionary text 7939!:mime application/x-mif 7940>17 string 3.0 (3.0) 7941>17 string 2.0 (2.0) 7942>17 string 1.0 (1.x) 79430 string \<MakerScreenFont FrameMaker Font file 7944!:mime application/x-mif 7945>17 string 1.01 (%s) 79460 string \<MML FrameMaker MML file 7947!:mime application/x-mif 79480 string \<BookFile FrameMaker Book file 7949!:mime application/x-mif 7950>10 string 3.0 (3.0 7951>10 string 2.0 (2.0 7952>10 string 1.0 (1.0 7953>13 byte x %c) 7954# XXX - this book entry should be verified, if you find one, uncomment this 7955#0 string \<Book\ FrameMaker Book (ASCII) file 7956#!:mime application/x-mif 7957#>6 string 3.0 (3.0) 7958#>6 string 2.0 (2.0) 7959#>6 string 1.0 (1.0) 79600 string \<Maker Intermediate Print File FrameMaker IPL file 7961!:mime application/x-mif 7962 7963#------------------------------------------------------------------------------ 7964# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $ 7965# freebsd: file(1) magic for FreeBSD objects 7966# 7967# All new-style FreeBSD magic numbers are in host byte order (i.e., 7968# little-endian on x86). 7969# 7970# XXX - this comes from the file "freebsd" in a recent FreeBSD version of 7971# "file"; it, and the NetBSD stuff in "netbsd", appear to use different 7972# schemes for distinguishing between executable images, shared libraries, 7973# and object files. 7974# 7975# FreeBSD says: 7976# 7977# Regardless of whether it's pure, demand-paged, or none of the 7978# above: 7979# 7980# if the entry point is < 4096, then it's a shared library if 7981# the "has run-time loader information" bit is set, and is 7982# position-independent if the "is position-independent" bit 7983# is set; 7984# 7985# if the entry point is >= 4096 (or >4095, same thing), then it's 7986# an executable, and is dynamically-linked if the "has run-time 7987# loader information" bit is set. 7988# 7989# On x86, NetBSD says: 7990# 7991# If it's neither pure nor demand-paged: 7992# 7993# if it has the "has run-time loader information" bit set, it's 7994# a dynamically-linked executable; 7995# 7996# if it doesn't have that bit set, then: 7997# 7998# if it has the "is position-independent" bit set, it's 7999# position-independent; 8000# 8001# if the entry point is non-zero, it's an executable, otherwise 8002# it's an object file. 8003# 8004# If it's pure: 8005# 8006# if it has the "has run-time loader information" bit set, it's 8007# a dynamically-linked executable, otherwise it's just an 8008# executable. 8009# 8010# If it's demand-paged: 8011# 8012# if it has the "has run-time loader information" bit set, 8013# then: 8014# 8015# if the entry point is < 4096, it's a shared library; 8016# 8017# if the entry point is = 4096 or > 4096 (i.e., >= 4096), 8018# it's a dynamically-linked executable); 8019# 8020# if it doesn't have the "has run-time loader information" bit 8021# set, then it's just an executable. 8022# 8023# (On non-x86, NetBSD does much the same thing, except that it uses 8024# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K 8025# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's 8026# had 8K pages; dunno about MIPS.) 8027# 8028# I suspect the two will differ only in perverse and uninteresting cases 8029# ("shared" libraries that aren't demand-paged and whose pages probably 8030# won't actually be shared, executables with entry points <4096). 8031# 8032# I leave it to those more familiar with FreeBSD and NetBSD to figure out 8033# what the right answer is (although using ">4095", FreeBSD-style, is 8034# probably better than separately checking for "=4096" and ">4096", 8035# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged 8036# executables using the NetBSD technique.) 8037# 80380 lelong&0377777777 041400407 FreeBSD/i386 8039>20 lelong <4096 8040>>3 byte&0xC0 &0x80 shared library 8041>>3 byte&0xC0 0x40 PIC object 8042>>3 byte&0xC0 0x00 object 8043>20 lelong >4095 8044>>3 byte&0x80 0x80 dynamically linked executable 8045>>3 byte&0x80 0x00 executable 8046>16 lelong >0 not stripped 8047 80480 lelong&0377777777 041400410 FreeBSD/i386 pure 8049>20 lelong <4096 8050>>3 byte&0xC0 &0x80 shared library 8051>>3 byte&0xC0 0x40 PIC object 8052>>3 byte&0xC0 0x00 object 8053>20 lelong >4095 8054>>3 byte&0x80 0x80 dynamically linked executable 8055>>3 byte&0x80 0x00 executable 8056>16 lelong >0 not stripped 8057 80580 lelong&0377777777 041400413 FreeBSD/i386 demand paged 8059>20 lelong <4096 8060>>3 byte&0xC0 &0x80 shared library 8061>>3 byte&0xC0 0x40 PIC object 8062>>3 byte&0xC0 0x00 object 8063>20 lelong >4095 8064>>3 byte&0x80 0x80 dynamically linked executable 8065>>3 byte&0x80 0x00 executable 8066>16 lelong >0 not stripped 8067 80680 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged 8069>20 lelong <4096 8070>>3 byte&0xC0 &0x80 shared library 8071>>3 byte&0xC0 0x40 PIC object 8072>>3 byte&0xC0 0x00 object 8073>20 lelong >4095 8074>>3 byte&0x80 0x80 dynamically linked executable 8075>>3 byte&0x80 0x00 executable 8076>16 lelong >0 not stripped 8077 8078# XXX gross hack to identify core files 8079# cores start with a struct tss; we take advantage of the following: 8080# byte 7: highest byte of the kernel stack pointer, always 0xfe 8081# 8/9: kernel (ring 0) ss value, always 0x0010 8082# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0 8083# 28: low order byte of the current PTD entry, always 0 since the 8084# PTD is page-aligned 8085# 80867 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file 8087>1039 string >\0 from '%s' 8088 8089# /var/run/ld.so.hints 8090# What are you laughing about? 80910 lelong 011421044151 ld.so hints file (Little Endian 8092>4 lelong >0 \b, version %d) 8093>4 belong <1 \b) 80940 belong 011421044151 ld.so hints file (Big Endian 8095>4 belong >0 \b, version %d) 8096>4 belong <1 \b) 8097 8098# 8099# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities 8100# 81010 string SCRSHOT_ scrshot(1) screenshot, 8102>8 byte x version %d, 8103>9 byte 2 %d bytes in header, 8104>>10 byte x %d chars wide by 8105>>11 byte x %d chars high 8106 8107#------------------------------------------------------------------------------ 8108# $File: fsav,v 1.11 2009/09/19 16:28:09 christos Exp $ 8109# fsav: file(1) magic for datafellows fsav virus definition files 8110# Anthon van der Neut (anthon@mnt.org) 8111 8112# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def} 81130 beshort 0x1575 fsav macro virus signatures 8114>8 leshort >0 (%d- 8115>11 byte >0 \b%02d- 8116>10 byte >0 \b%02d) 8117# ftp://ftp.f-prot.com/pub/sign.zip 8118#10 ubyte <12 8119#>9 ubyte <32 8120#>>8 ubyte 0x0a 8121#>>>12 ubyte 0x07 8122#>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d- 8123#>>>>10 byte 0 \b01- 8124#>>>>10 byte 1 \b02- 8125#>>>>10 byte 2 \b03- 8126#>>>>10 byte 3 \b04- 8127#>>>>10 byte 4 \b05- 8128#>>>>10 byte 5 \b06- 8129#>>>>10 byte 6 \b07- 8130#>>>>10 byte 7 \b08- 8131#>>>>10 byte 8 \b09- 8132#>>>>10 byte 9 \b10- 8133#>>>>10 byte 10 \b11- 8134#>>>>10 byte 11 \b12- 8135#>>>>9 ubyte >0 \b%02d) 8136# ftp://ftp.f-prot.com/pub/sign2.zip 8137#0 ubyte 0x62 8138#>1 ubyte 0xF5 8139#>>2 ubyte 0x1 8140#>>>3 ubyte 0x1 8141#>>>>4 ubyte 0x0e 8142#>>>>>13 ubyte >0 fsav virus signatures 8143#>>>>>>11 ubyte x size 0x%02x 8144#>>>>>>12 ubyte x \b%02x 8145#>>>>>>13 ubyte x \b%02x bytes 8146 8147# Joerg Jenderek: joerg dot jenderek at web dot de 8148# http://www.clamav.net/doc/latest/html/node45.html 8149# .cvd files start with a 512 bytes colon separated header 8150# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime 8151# + gzipped tarball files 81520 string ClamAV-VDB: 8153>11 string >\0 Clam AntiVirus database %-.23s 8154>>34 string : 8155>>>35 string !: \b, version 8156>>>>35 string x \b%-.1s 8157>>>>>36 string !: 8158>>>>>>36 string x \b%-.1s 8159>>>>>>>37 string !: 8160>>>>>>>>37 string x \b%-.1s 8161>>>>>>>>>38 string !: 8162>>>>>>>>>>38 string x \b%-.1s 8163>512 string \037\213 \b, gzipped 8164>769 string ustar\0 \b, tarred 8165 8166# Type: Grisoft AVG AntiVirus 8167# From: David Newgas <david@newgas.net> 81680 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data 8169 8170#------------------------------------------------------------------------------ 8171# $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $ 8172# fusecompress: file(1) magic for fusecompress 81730 string \037\135\211 FuseCompress(ed) data 8174>3 byte 0x00 (none format) 8175>3 byte 0x01 (bz2 format) 8176>3 byte 0x02 (gz format) 8177>3 byte 0x03 (lzo format) 8178>3 byte 0x04 (xor format) 8179>3 byte >0x04 (unknown format) 8180>4 long x uncompressed size: %d 8181 8182#------------------------------------------------------------------------------ 8183# $File: games,v 1.13 2012/02/13 22:50:50 christos Exp $ 8184# games: file(1) for games 8185 8186# Fabio Bonelli <fabiobonelli@libero.it> 8187# Quake II - III data files 81880 string IDP2 Quake II 3D Model file, 8189>20 long x %lu skin(s), 8190>8 long x (%lu x 8191>12 long x %lu), 8192>40 long x %lu frame(s), 8193>16 long x Frame size %lu bytes, 8194>24 long x %lu vertices/frame, 8195>28 long x %lu texture coordinates, 8196>32 long x %lu triangles/frame 8197 81980 string IBSP Quake 8199>4 long 0x26 II Map file (BSP) 8200>4 long 0x2E III Map file (BSP) 8201 82020 string IDS2 Quake II SP2 sprite file 8203 8204#--------------------------------------------------------------------------- 8205# Doom and Quake 8206# submitted by Nicolas Patrois 8207 82080 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo 8209# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01 8210 821124 string LxD\ 203 Linuxdoom save 8212>0 string x , name=%s 8213>44 string x , world=%s 8214 8215# Quake 8216 82170 string PACK Quake I or II world or extension 8218>8 lelong >0 \b, %d entries 8219 8220#0 string -1\x0a Quake I demo 8221#>30 string x version %.4s 8222#>61 string x level %s 8223 8224#0 string 5\x0a Quake I save 8225 8226# The levels 8227 8228# Quake 1 8229 82300 string 5\x0aIntroduction Quake I save: start Introduction 82310 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex 82320 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned 82330 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis 82340 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto 82350 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret) 82360 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep 82370 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon 82380 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon 82390 string 5\x0athe_Installation Quake I save: e2m1 The installation 82400 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel 82410 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!) 82420 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret) 82430 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress 82440 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse 82450 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette 82460 string 5\x0aTermination_Central Quake I save: e3m1 Termination central 82470 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin 82480 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror 82490 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight 82500 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret) 82510 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels 82520 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment 82530 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system 82540 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair 82550 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine 82560 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate 82570 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium 82580 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret) 82590 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze 82600 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony 82610 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit 8262 8263# Quake DeathMatch levels 8264 82650 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths 82660 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis 82670 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base 82680 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place 82690 string 5\x0aThe_Cistern Quake I save: dm5 The cistern 82700 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone 8271 8272# Scourge of Armagon 8273 82740 string 5\x0aCommand_HQ Quake I save: start Command HQ 82750 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station 82760 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility 82770 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret) 82780 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine 82790 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility 82800 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms 82810 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret) 82820 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral 82830 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs 82840 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt 82850 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep 82860 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment 82870 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium 82880 string 5\x0aLimbo Quake I save: hip3m3 Limbo 82890 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret) 82900 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet 82910 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair 8292 8293# Malice 8294 82950 string 5\x0aThe_Academy Quake I save: start The academy 82960 string 5\x0aThe_Lab Quake I save: d1 The lab 82970 string 5\x0aArea_33 Quake I save: d1b Area 33 82980 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions 82990 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret) 83000 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret) 83010 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice 83020 string 5\x0aArea44 Quake I save: d1c Area 44 83030 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers 83040 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life 83050 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood 83060 string 5\x0aThe_Flood Quake I save: d5 The flood 83070 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant 83080 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant 83090 string 5\x0aThe_Foundry Quake I save: d7b The foundry 83100 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base 83110 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base 83120 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories 83130 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive 83140 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ 83150 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown! 8316 8317# Malice DeathMatch levels 8318 83190 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct 83200 string 5\x0aSub_Station Quake I save: ddm2 Sub station 83210 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights! 83220 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa 83230 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse 83240 string 5\x0aDOMINO Quake I save: ddm6 Domino 83250 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder 8326 8327 83280 string MComprHD MAME CHD compressed hard disk image, 8329>12 belong x version %lu 8330 8331# doom - submitted by Jon Dowland 8332 83330 string =IWAD doom main IWAD data 8334>4 lelong x containing %d lumps 83350 string =PWAD doom patch PWAD data 8336>4 lelong x containing %d lumps 8337 8338# Build engine group files (Duke Nukem, Shadow Warrior, ...) 8339# Extension: .grp 8340# Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org> 83410 string KenSilverman Build engine group file 8342>12 lelong x containing %d files 8343 8344# Summary: Warcraft 3 save 8345# Extension: .w3g 8346# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 83470 string Warcraft\ III\ recorded\ game %s 8348 8349 8350# Summary: Warcraft 3 map 8351# Extension: .w3m 8352# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 83530 string HM3W Warcraft III map file 8354 8355 8356# Summary: SGF Smart Game Format 8357# Extension: .sgf 8358# Reference: http://www.red-bean.com/sgf/ 8359# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 8360# Modified by (1): Abel Cheung (regex, more game format) 8361# FIXME: Some games don't have GM (game type) 83620 regex \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 8363>2 search/0x200/b GM[ 8364>>&0 string 1] (Go) 8365>>&0 string 2] (Othello) 8366>>&0 string 3] (chess) 8367>>&0 string 4] (Gomoku+Renju) 8368>>&0 string 5] (Nine Men's Morris) 8369>>&0 string 6] (Backgammon) 8370>>&0 string 7] (Chinese chess) 8371>>&0 string 8] (Shogi) 8372>>&0 string 9] (Lines of Action) 8373>>&0 string 10] (Ataxx) 8374>>&0 string 11] (Hex) 8375>>&0 string 12] (Jungle) 8376>>&0 string 13] (Neutron) 8377>>&0 string 14] (Philosopher's Football) 8378>>&0 string 15] (Quadrature) 8379>>&0 string 16] (Trax) 8380>>&0 string 17] (Tantrix) 8381>>&0 string 18] (Amazons) 8382>>&0 string 19] (Octi) 8383>>&0 string 20] (Gess) 8384>>&0 string 21] (Twixt) 8385>>&0 string 22] (Zertz) 8386>>&0 string 23] (Plateau) 8387>>&0 string 24] (Yinsh) 8388>>&0 string 25] (Punct) 8389>>&0 string 26] (Gobblet) 8390>>&0 string 27] (hive) 8391>>&0 string 28] (Exxit) 8392>>&0 string 29] (Hnefatal) 8393>>&0 string 30] (Kuba) 8394>>&0 string 31] (Tripples) 8395>>&0 string 32] (Chase) 8396>>&0 string 33] (Tumbling Down) 8397>>&0 string 34] (Sahara) 8398>>&0 string 35] (Byte) 8399>>&0 string 36] (Focus) 8400>>&0 string 37] (Dvonn) 8401>>&0 string 38] (Tamsk) 8402>>&0 string 39] (Gipf) 8403>>&0 string 40] (Kropki) 8404 8405############################################## 8406# NetImmerse/Gamebryo game engine entries 8407 8408# Summary: Gamebryo game engine file 8409# Extension: .nif, .kf 8410# Created by: Abel Cheung <abelcheung@gmail.com> 84110 string Gamebryo\ File\ Format,\ Version\ Gamebryo game engine file 8412>&0 regex [0-9a-z.]+ \b, version %s 8413 8414# Summary: Gamebryo game engine file 8415# Extension: .kfm 8416# Created by: Abel Cheung <abelcheung@gmail.com> 84170 string ;Gamebryo\ KFM\ File\ Version\ Gamebryo game engine animation File 8418>&0 regex [0-9a-z.]+ \b, version %s 8419 8420# Summary: NetImmerse game engine file 8421# Extension .nif 8422# Created by: Abel Cheung <abelcheung@gmail.com> 84230 string NetImmerse\ File\ Format,\ Versio 8424>&0 string n\ NetImmerse game engine file 8425>>&0 regex [0-9a-z.]+ \b, version %s 8426 8427# Type: SGF Smart Game Format 8428# URL: http://www.red-bean.com/sgf/ 8429# From: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 84302 regex/c \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 8431>2 regex/c GM\\[1\\] - Go Game 8432>2 regex/c GM\\[6\\] - BackGammon Game 8433>2 regex/c GM\\[11\\] - Hex Game 8434>2 regex/c GM\\[18\\] - Amazons Game 8435>2 regex/c GM\\[19\\] - Octi Game 8436>2 regex/c GM\\[20\\] - Gess Game 8437>2 regex/c GM\\[21\\] - twix Game 8438 8439# Epic Games/Unreal Engine Package 8440# 84410 lelong 0x9E2A83C1 Unreal Engine Package, 8442>4 leshort x version: %i 8443>12 lelong !0 \b, names: %i 8444>28 lelong !0 \b, imports: %i 8445>20 lelong !0 \b, exports: %i 8446 8447#------------------------------------------------------------------------------ 8448# $File: gcc,v 1.4 2009/09/19 16:28:09 christos Exp $ 8449# gcc: file(1) magic for GCC special files 8450# 84510 string gpch GCC precompiled header 8452 8453# The version field is annoying. It's 3 characters, not zero-terminated. 8454>5 byte x (version %c 8455>6 byte x \b%c 8456>7 byte x \b%c) 8457 8458# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O' 8459>4 byte 67 for C 8460>4 byte 111 for Objective C 8461>4 byte 43 for C++ 8462>4 byte 79 for Objective C++ 8463 8464#------------------------------------------------------------------------------ 8465# $File: geo,v 1.3 2013/01/04 00:47:02 christos Exp $ 8466# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu> 8467 8468###################################################################### 8469# 8470# Acoustic Doppler Current Profilers (ADCP) 8471# 8472###################################################################### 8473 84740 beshort 0x7f7f RDI Acoustic Doppler Current Profiler (ADCP) 8475 8476###################################################################### 8477# 8478# Metadata 8479# 8480###################################################################### 8481 84820 string Identification_Information FGDC ASCII metadata 8483 8484###################################################################### 8485# 8486# Seimsic / Subbottom 8487# 8488###################################################################### 8489 8490# Knudsen subbottom chirp profiler - Binary File Format: B9 8491# KEB D409-03167 V1.75 Huffman 84920 string KEB\ Knudsen seismic KEL binary (KEB) - 8493>4 regex [-A-Z0-9]* Software: %s 8494>>&1 regex V[0-9]*\.[0-9]* version %s 8495 8496###################################################################### 8497# 8498# LIDAR - Laser altimetry or bathy 8499# 8500###################################################################### 8501 8502 8503# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data 85040 string HCA LADS Caris Ascii Format (CAF) bathymetric lidar 8505>4 regex [0-9]*\.[0-9]* version %s 8506 85070 string HCB LADS Caris Binary Format (CBF) bathymetric lidar waveform data 8508>3 byte x version %d . 8509>4 byte x %d 8510 8511 8512###################################################################### 8513# 8514# MULTIBEAM SONARS http://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/ 8515# 8516###################################################################### 8517 8518# GeoAcoustics - GeoSwath Plus 85194 beshort 0x2002 GeoSwath RDF 85200 string Start:- GeoSwatch auf text file 8521 8522# Seabeam 2100 8523# mbsystem code mb41 85240 string SB2100 SeaBeam 2100 multibeam sonar 85250 string SB2100DR SeaBeam 2100 DR multibeam sonar 85260 string SB2100PR SeaBeam 2100 PR multibeam sonar 8527 8528# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor 8529# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR. 85300 string $HSF XSE multibeam 8531 8532# mb121 http://www.saic.com/maritime/gsf/ 85338 string GSF-v SAIC generic sensor format (GSF) sonar data, 8534>&0 regex [0-9]*\.[0-9]* version %s 8535 8536# MGD77 - http://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm 8537# mb161 85389 string MGD77 MGD77 Header, Marine Geophysical Data Exchange Format 8539 8540# MBSystem processing caches the mbinfo output 85411 string Swath\ Data\ File: mbsystem info cache 8542 8543# Caris John Hughes Clark format 85440 string HDCS Caris multibeam sonar related data 85451 string Start/Stop\ parameter\ header: Caris ASCII project summary 8546 8547###################################################################### 8548# 8549# Visualization and 3D modeling 8550# 8551###################################################################### 8552 8553# IVS - IVS3d.com Tagged Data Represetation 85540 string %%\ TDR\ 2.0 IVS Fledermaus TDR file 8555 8556# http://www.ecma-international.org/publications/standards/Ecma-363.htm 8557# 3D in PDFs 85580 string U3D ECMA-363, Universal 3D 8559 8560###################################################################### 8561# 8562# Support files 8563# 8564###################################################################### 8565 8566# https://midas.psi.ch/elog/ 85670 string $@MID@$ elog journal entry 8568 8569# Geospatial Designs http://www.geospatialdesigns.com/surfer6_format.htm 85700 string DSBB Surfer 6 binary grid file 8571>4 leshort x \b, %d 8572>6 leshort x \bx%d 8573>8 ledouble x \b, minx=%g 8574>16 ledouble x \b, maxx=%g 8575>24 ledouble x \b, miny=%g 8576>32 ledouble x \b, maxy=%g 8577>40 ledouble x \b, minz=%g 8578>48 ledouble x \b, maxz=%g 8579 8580 8581#------------------------------------------------------------------------------ 8582# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $ 8583# GEOS files (Vidar Madsen, vidar@gimp.org) 8584# semi-commonly used in embedded and handheld systems. 85850 belong 0xc745c153 GEOS 8586>40 byte 1 executable 8587>40 byte 2 VMFile 8588>40 byte 3 binary 8589>40 byte 4 directory label 8590>40 byte <1 unknown 8591>40 byte >4 unknown 8592>4 string >\0 \b, name "%s" 8593#>44 short x \b, version %d 8594#>46 short x \b.%d 8595#>48 short x \b, rev %d 8596#>50 short x \b.%d 8597#>52 short x \b, proto %d 8598#>54 short x \br%d 8599#>168 string >\0 \b, copyright "%s" 8600 8601#------------------------------------------------------------------------------ 8602# $File: gimp,v 1.7 2010/09/20 18:55:20 rrt Exp $ 8603# GIMP Gradient: file(1) magic for the GIMP's gradient data files 8604# by Federico Mena <federico@nuclecu.unam.mx> 8605 86060 string GIMP\ Gradient GIMP gradient data 8607 8608#------------------------------------------------------------------------------ 8609# XCF: file(1) magic for the XCF image format used in the GIMP developed 8610# by Spencer Kimball and Peter Mattis 8611# ('Bucky' LaDieu, nega@vt.edu) 8612 86130 string gimp\ xcf GIMP XCF image data, 8614!:mime image/x-xcf 8615>9 string file version 0, 8616>9 string v version 8617>>10 string >\0 %s, 8618>14 belong x %lu x 8619>18 belong x %lu, 8620>22 belong 0 RGB Color 8621>22 belong 1 Greyscale 8622>22 belong 2 Indexed Color 8623>22 belong >2 Unknown Image Type. 8624 8625#------------------------------------------------------------------------------ 8626# XCF: file(1) magic for the patterns used in the GIMP, developed 8627# by Spencer Kimball and Peter Mattis 8628# ('Bucky' LaDieu, nega@vt.edu) 8629 863020 string GPAT GIMP pattern data, 8631>24 string x %s 8632 8633#------------------------------------------------------------------------------ 8634# XCF: file(1) magic for the brushes used in the GIMP, developed 8635# by Spencer Kimball and Peter Mattis 8636# ('Bucky' LaDieu, nega@vt.edu) 8637 863820 string GIMP GIMP brush data 8639 8640# GIMP Curves File 8641# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 86420 string #\040GIMP\040Curves\040File GIMP curve file 8643 8644#------------------------------------------------------------------------------ 8645# $File: gnome,v 1.3 2013/02/05 15:20:47 christos Exp $ 8646# GNOME related files 8647 8648# Contributed by Josh Triplett 8649# FIXME: Could be simplified if pstring supported two-byte counts 86500 string GnomeKeyring\n\r\0\n GNOME keyring 8651>&0 ubyte 0 \b, major version 0 8652>>&0 ubyte 0 \b, minor version 0 8653>>>&0 ubyte 0 \b, crypto type 0 (AES) 8654>>>&0 ubyte >0 \b, crypto type %hhu (unknown) 8655>>>&1 ubyte 0 \b, hash type 0 (MD5) 8656>>>&1 ubyte >0 \b, hash type %hhu (unknown) 8657>>>&2 ubelong 0xFFFFFFFF \b, name NULL 8658>>>&2 ubelong !0xFFFFFFFF 8659>>>>&-4 ubelong >255 \b, name too long for file's pstring type 8660>>>>&-4 ubelong <256 8661>>>>>&-1 pstring x \b, name "%s" 8662>>>>>>&0 ubeqdate x \b, last modified %s 8663>>>>>>&8 ubeqdate x \b, created %s 8664>>>>>>&16 ubelong &1 8665>>>>>>>&0 ubelong x \b, locked if idle for %u seconds 8666>>>>>>&16 ubelong ^1 \b, not locked if idle 8667>>>>>>&24 ubelong x \b, hash iterations %u 8668>>>>>>&28 ubequad x \b, salt %llu 8669>>>>>>&52 ubelong x \b, %u item(s) 8670 8671# From: Alex Beregszaszi <alex@fsn.hu> 86724 string gtktalog GNOME Catalogue (gtktalog) 8673>13 string >\0 version %s 8674 8675# Summary: GStreamer binary registry 8676# Extension: .bin 8677# Submitted by: Josh Triplett <josh@joshtriplett.org> 86780 belong 0xc0def00d GStreamer binary registry 8679>4 string x \b, version %s 8680 8681# GVariant Database file 8682# By Elan Ruusamae <glen@delfi.ee> 8683# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h 8684# It's always "GVariant", it's byte swapped on incompatible archs 8685# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c 8686# file_builder_serialise() 8687# http://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant 86880 string GVariant GVariant Database file, 8689# version is never filled. probably future extension 8690>8 lelong x version %d 8691# not sure are these usable, so commented out 8692#>>16 lelong x start %d, 8693#>>>20 lelong x end %d 8694 8695# G-IR database made by gobject-introspect toolset, 8696# http://live.gnome.org/GObjectIntrospection 86970 string GOBJ\nMETADATA\r\n\032 G-IR binary database 8698>16 byte x \b, v%d 8699>17 byte x \b.%d 8700>20 leshort x \b, %d entries 8701>22 leshort x \b/%d local 8702 8703#------------------------------------------------------------------------------ 8704# $File: gnu,v 1.14 2012/10/03 23:38:12 christos Exp $ 8705# gnu: file(1) magic for various GNU tools 8706# 8707# GNU nlsutils message catalog file format 8708# 8709# GNU message catalog (.mo and .gmo files) 8710 87110 string \336\22\4\225 GNU message catalog (little endian), 8712>6 leshort x revision %d. 8713>4 leshort >0 \b%d, 8714>>8 lelong x %d messages, 8715>>36 lelong x %d sysdep messages 8716>4 leshort =0 \b%d, 8717>>8 lelong x %d messages 8718 87190 string \225\4\22\336 GNU message catalog (big endian), 8720>4 beshort x revision %d. 8721>6 beshort >0 \b%d, 8722>>8 belong x %d messages, 8723>>36 belong x %d sysdep messages 8724>6 beshort =0 \b%d, 8725>>8 belong x %d messages 8726 8727 8728# GnuPG 8729# The format is very similar to pgp 87300 string \001gpg GPG key trust database 8731>4 byte x version %d 8732# Note: magic.mime had 0x8501 for the next line instead of 0x8502 87330 beshort 0x8502 GPG encrypted data 8734!:mime text/PGP # encoding: data 8735 8736# This magic is not particularly good, as the keyrings don't have true 8737# magic. Nevertheless, it covers many keyrings. 87380 beshort 0x9901 GPG key public ring 8739!:mime application/x-gnupg-keyring 8740 8741# Symmetric encryption 87420 leshort 0x0d8c 8743>4 leshort 0x0203 8744>>2 leshort 0x0204 GPG symmetrically encrypted data (3DES cipher) 8745>>2 leshort 0x0304 GPG symmetrically encrypted data (CAST5 cipher) 8746>>2 leshort 0x0404 GPG symmetrically encrypted data (BLOWFISH cipher) 8747>>2 leshort 0x0704 GPG symmetrically encrypted data (AES cipher) 8748>>2 leshort 0x0804 GPG symmetrically encrypted data (AES192 cipher) 8749>>2 leshort 0x0904 GPG symmetrically encrypted data (AES256 cipher) 8750>>2 leshort 0x0a04 GPG symmetrically encrypted data (TWOFISH cipher) 8751>>2 leshort 0x0b04 GPG symmetrically encrypted data (CAMELLIA128 cipher) 8752>>2 leshort 0x0c04 GPG symmetrically encrypted data (CAMELLIA192 cipher) 8753>>2 leshort 0x0d04 GPG symmetrically encrypted data (CAMELLIA256 cipher) 8754 8755 8756# Gnumeric spreadsheet 8757# This entry is only semi-helpful, as Gnumeric compresses its files, so 8758# they will ordinarily reported as "compressed", but at least -z helps 875939 string =<gmr:Workbook Gnumeric spreadsheet 8760 8761# From: James Youngman <jay@gnu.org> 8762# gnu find magic 87630 string \0LOCATE GNU findutils locate database data 8764>7 string >\0 \b, format %s 8765>7 string 02 \b (frcode) 8766 8767# Files produced by GNU gettext 87680 long 0xDE120495 GNU-format message catalog data 87690 long 0x950412DE GNU-format message catalog data 8770 8771# gettext message catalogue 87720 regex \^msgid\ GNU gettext message catalogue text 8773!:mime text/x-po 8774 8775#------------------------------------------------------------------------------ 8776# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $ 8777# gnumeric: file(1) magic for Gnumeric spreadsheet 8778# This entry is only semi-helpful, as Gnumeric compresses its files, so 8779# they will ordinarily reported as "compressed", but at least -z helps 878039 string =<gmr:Workbook Gnumeric spreadsheet 8781!:mime application/x-gnumeric 8782 8783#------------------------------------------------------------------------------ 8784# $File: gpt,v 1.1 2013/02/18 18:31:09 christos Exp $ 8785# 8786# GPT Partition table patterns. 8787# Author: Rogier Goossens (goossens.rogier@gmail.com) 8788# Note that a GPT-formatted disk must contain an MBR as well. 8789# 8790 8791# The initial segment (up to >>>>>>>>422) was copied from the X86 8792# partition table code (aka MBR). 8793# This is kept separate, so that MBR partitions are not reported as well. 8794# (use -k if you do want them as well) 8795 8796# First, detect the MBR partiton table 8797# If more than one GPT protective MBR partition exists, don't print anything 8798# (the other MBR detection code will then just print the MBR partition table) 87990x1FE leshort 0xAA55 8800>3 string !MS 8801>>3 string !SYSLINUX 8802>>>3 string !MTOOL 8803>>>>3 string !NEWLDR 8804>>>>>5 string !DOS 8805# not FAT (32 bit) 8806>>>>>>82 string !FAT32 8807#not Linux kernel 8808>>>>>>>514 string !HdrS 8809#not BeOS 8810>>>>>>>>422 string !Be\ Boot\ Loader 8811# GPT with protective MBR entry in partition 1 (only) 8812>>>>>>>>>450 ubyte 0xee 8813>>>>>>>>>>466 ubyte !0xee 8814>>>>>>>>>>>482 ubyte !0xee 8815>>>>>>>>>>>>498 ubyte !0xee 8816#>>>>>>>>>>>>>446 use gpt-mbr-partition 8817>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table 8818>>>>>>>>>>>>>>0 use gpt-mbr-type 8819>>>>>>>>>>>>>>&-8 use gpt-table 8820>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 8821>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART 8822>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table 8823>>>>>>>>>>>>>>>0 use gpt-mbr-type 8824>>>>>>>>>>>>>>>&-8 use gpt-table 8825>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 8826>>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART 8827>>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table 8828>>>>>>>>>>>>>>>>0 use gpt-mbr-type 8829>>>>>>>>>>>>>>>>&-8 use gpt-table 8830>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 8831>>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART 8832>>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table 8833>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 8834>>>>>>>>>>>>>>>>>&-8 use gpt-table 8835>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 8836>>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART 8837>>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table 8838>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 8839>>>>>>>>>>>>>>>>>>&-8 use gpt-table 8840>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 8841# GPT with protective MBR entry in partition 2 (only) 8842>>>>>>>>>450 ubyte !0xee 8843>>>>>>>>>>466 ubyte 0xee 8844>>>>>>>>>>>482 ubyte !0xee 8845>>>>>>>>>>>>498 ubyte !0xee 8846#>>>>>>>>>>>>>462 use gpt-mbr-partition 8847>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table 8848>>>>>>>>>>>>>>0 use gpt-mbr-type 8849>>>>>>>>>>>>>>&-8 use gpt-table 8850>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 8851>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART 8852>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table 8853>>>>>>>>>>>>>>>0 use gpt-mbr-type 8854>>>>>>>>>>>>>>>&-8 use gpt-table 8855>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 8856>>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART 8857>>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table 8858>>>>>>>>>>>>>>>>0 use gpt-mbr-type 8859>>>>>>>>>>>>>>>>&-8 use gpt-table 8860>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 8861>>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART 8862>>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table 8863>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 8864>>>>>>>>>>>>>>>>>&-8 use gpt-table 8865>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 8866>>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART 8867>>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table 8868>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 8869>>>>>>>>>>>>>>>>>>&-8 use gpt-table 8870>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 8871# GPT with protective MBR entry in partition 3 (only) 8872>>>>>>>>>450 ubyte !0xee 8873>>>>>>>>>>466 ubyte !0xee 8874>>>>>>>>>>>482 ubyte 0xee 8875>>>>>>>>>>>>498 ubyte !0xee 8876#>>>>>>>>>>>>>478 use gpt-mbr-partition 8877>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table 8878>>>>>>>>>>>>>>0 use gpt-mbr-type 8879>>>>>>>>>>>>>>&-8 use gpt-table 8880>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 8881>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART 8882>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table 8883>>>>>>>>>>>>>>>0 use gpt-mbr-type 8884>>>>>>>>>>>>>>>&-8 use gpt-table 8885>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 8886>>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART 8887>>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table 8888>>>>>>>>>>>>>>>>0 use gpt-mbr-type 8889>>>>>>>>>>>>>>>>&-8 use gpt-table 8890>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 8891>>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART 8892>>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table 8893>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 8894>>>>>>>>>>>>>>>>>&-8 use gpt-table 8895>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 8896>>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART 8897>>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table 8898>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 8899>>>>>>>>>>>>>>>>>>&-8 use gpt-table 8900>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 8901# GPT with protective MBR entry in partition 4 (only) 8902>>>>>>>>>450 ubyte !0xee 8903>>>>>>>>>>466 ubyte !0xee 8904>>>>>>>>>>>482 ubyte !0xee 8905>>>>>>>>>>>>498 ubyte 0xee 8906#>>>>>>>>>>>>>494 use gpt-mbr-partition 8907>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table 8908>>>>>>>>>>>>>>0 use gpt-mbr-type 8909>>>>>>>>>>>>>>&-8 use gpt-table 8910>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 8911>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART 8912>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table 8913>>>>>>>>>>>>>>>0 use gpt-mbr-type 8914>>>>>>>>>>>>>>>&-8 use gpt-table 8915>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 8916>>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART 8917>>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table 8918>>>>>>>>>>>>>>>>0 use gpt-mbr-type 8919>>>>>>>>>>>>>>>>&-8 use gpt-table 8920>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 8921>>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART 8922>>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table 8923>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 8924>>>>>>>>>>>>>>>>>&-8 use gpt-table 8925>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 8926>>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART 8927>>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table 8928>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 8929>>>>>>>>>>>>>>>>>>&-8 use gpt-table 8930>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 8931 8932# The following code does GPT detection and processing, including 8933# sector size detection. 8934# It has to be duplicated above because the top-level pattern 8935# (i.e. not called using 'use') must print *something* for file 8936# to count it as a match. Text only printed in named patterns is 8937# not counted, and causes file to continue, and try and match 8938# other patterns. 8939# 8940# Unfortunately, when assuming sector sizes >=16k, if the sector size 8941# happens to be 512 instead, we may find confusing data after the GPT 8942# table... If the GPT table has less than 128 entries, this may even 8943# happen for assumed sector sizes as small as 4k 8944# This could be solved by checking for the presence of the backup GPT 8945# header as well, but that makes the logic extremely complex 8946##0 name gpt-mbr-partition 8947##>(8.l*8192) string EFI\ PART 8948##>>(8.l*8192) use gpt-mbr-type 8949##>>&-8 use gpt-table 8950##>>0 ubyte x of 8192 bytes 8951##>(8.l*8192) string !EFI\ PART 8952##>>(8.l*4096) string EFI\ PART GPT partition table 8953##>>>0 use gpt-mbr-type 8954##>>>&-8 use gpt-table 8955##>>>0 ubyte x of 4096 bytes 8956##>>(8.l*4096) string !EFI\ PART 8957##>>>(8.l*2048) string EFI\ PART GPT partition table 8958##>>>>0 use gpt-mbr-type 8959##>>>>&-8 use gpt-table 8960##>>>>0 ubyte x of 2048 bytes 8961##>>>(8.l*2048) string !EFI\ PART 8962##>>>>(8.l*1024) string EFI\ PART GPT partition table 8963##>>>>>0 use gpt-mbr-type 8964##>>>>>&-8 use gpt-table 8965##>>>>>0 ubyte x of 1024 bytes 8966##>>>>(8.l*1024) string !EFI\ PART 8967##>>>>>(8.l*512) string EFI\ PART GPT partition table 8968##>>>>>>0 use gpt-mbr-type 8969##>>>>>>&-8 use gpt-table 8970##>>>>>>0 ubyte x of 512 bytes 8971 8972# Print details of MBR type for a GPT-disk 8973# Calling code ensures that there is only one 0xee partition. 89740 name gpt-mbr-type 8975# GPT with protective MBR entry in partition 1 8976>450 ubyte 0xee 8977>>454 ulelong 1 8978>>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 8979>>454 ulelong !1 \b (nonstandard: not at LBA 1) 8980# GPT with protective MBR entry in partition 2 8981>466 ubyte 0xee 8982>>470 ulelong 1 8983>>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 8984>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 8985>>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 8986>>470 ulelong !1 \b (nonstandard: not at LBA 1) 8987# GPT with protective MBR entry in partition 3 8988>482 ubyte 0xee 8989>>486 ulelong 1 8990>>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 8991>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 8992>>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 8993>>486 ulelong !1 \b (nonstandard: not at LBA 1) 8994# GPT with protective MBR entry in partition 4 8995>498 ubyte 0xee 8996>>502 ulelong 1 8997>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 8998>>502 ulelong !1 \b (nonstandard: not at LBA 1) 8999 9000# Print the information from a GPT partition table structure 90010 name gpt-table 9002>10 uleshort x \b, version %u 9003>8 uleshort x \b.%u 9004# a GUID is just like a UUID, except it's displayed mixed-endian. 9005>56 ulelong x \b, GUID: %08x 9006>60 uleshort x \b-%04x 9007>62 uleshort x \b-%04x 9008>64 ubeshort x \b-%04x 9009>66 ubeshort x \b-%04x 9010>68 ubelong x \b%08x 9011#>80 uleshort x \b, %d partition entries 9012>32 ulequad+1 x \b, disk size: %lld sectors 9013 9014# In case a GPT data-structure is at LBA 0, report it as well 9015# This covers systems which are not GPT-aware, and which show 9016# and allow access to the protective partition. This code will 9017# detect the contents of such a partition. 90180 string EFI\ PART GPT data structure (nonstandard: at LBA 0) 9019>0 use gpt-table 9020>0 ubyte x (sector size unknown) 9021 9022 9023 9024#------------------------------------------------------------------------------ 9025# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $ 9026# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 9027# 9028# ACE/gr binary 90290 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file 9030>39 byte >0 - version %c 9031# ACE/gr ascii 90320 string #\ xvgr\ parameter\ file ACE/gr ascii file 90330 string #\ xmgr\ parameter\ file ACE/gr ascii file 90340 string #\ ACE/gr\ parameter\ file ACE/gr ascii file 9035# Grace projects 90360 string #\ Grace\ project\ file Grace project file 9037>23 string @version\ (version 9038>>32 byte >0 %c 9039>>33 string >\0 \b.%.2s 9040>>35 string >\0 \b.%.2s) 9041# ACE/gr fit description files 90420 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file 9043# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 9044 9045#------------------------------------------------------------------------------ 9046# $File: graphviz,v 1.7 2009/09/19 16:28:09 christos Exp $ 9047# graphviz: file(1) magic for http://www.graphviz.org/ 9048 9049# FIXME: These patterns match too generally. For example, the first 9050# line matches a LaTeX file containing the word "graph" (with a { 9051# following later) and the second line matches this file. 9052#0 regex/100 [\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{ graphviz graph text 9053#!:mime text/vnd.graphviz 9054#0 regex/100 [\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{ graphviz digraph text 9055#!:mime text/vnd.graphviz 9056 9057#------------------------------------------------------------------------------ 9058# $File: gringotts,v 1.5 2009/09/19 16:28:09 christos Exp $ 9059# gringotts: file(1) magic for Gringotts 9060# http://devel.pluto.linux.it/projects/Gringotts/ 9061# author: Germano Rizzo <mano@pluto.linux.it> 9062#GRG3????Y 90630 string GRG Gringotts data file 9064#file format 1 9065>3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9 9066#file format 2 9067>3 string 2 v.2, MCRYPT S2K, 9068>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 9069>>8 byte&0x70 0x10 SERPENT crypt, 9070>>8 byte&0x70 0x20 TWOFISH crypt, 9071>>8 byte&0x70 0x30 CAST-256 crypt, 9072>>8 byte&0x70 0x40 SAFER+ crypt, 9073>>8 byte&0x70 0x50 LOKI97 crypt, 9074>>8 byte&0x70 0x60 3DES crypt, 9075>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 9076>>8 byte&0x08 0x00 SHA1 hash, 9077>>8 byte&0x08 0x08 RIPEMD-160 hash, 9078>>8 byte&0x04 0x00 ZLib 9079>>8 byte&0x04 0x04 BZip2 9080>>8 byte&0x03 0x00 lvl.0 9081>>8 byte&0x03 0x01 lvl.3 9082>>8 byte&0x03 0x02 lvl.6 9083>>8 byte&0x03 0x03 lvl.9 9084#file format 3 9085>3 string 3 v.3, OpenPGP S2K, 9086>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 9087>>8 byte&0x70 0x10 SERPENT crypt, 9088>>8 byte&0x70 0x20 TWOFISH crypt, 9089>>8 byte&0x70 0x30 CAST-256 crypt, 9090>>8 byte&0x70 0x40 SAFER+ crypt, 9091>>8 byte&0x70 0x50 LOKI97 crypt, 9092>>8 byte&0x70 0x60 3DES crypt, 9093>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 9094>>8 byte&0x08 0x00 SHA1 hash, 9095>>8 byte&0x08 0x08 RIPEMD-160 hash, 9096>>8 byte&0x04 0x00 ZLib 9097>>8 byte&0x04 0x04 BZip2 9098>>8 byte&0x03 0x00 lvl.0 9099>>8 byte&0x03 0x01 lvl.3 9100>>8 byte&0x03 0x02 lvl.6 9101>>8 byte&0x03 0x03 lvl.9 9102#file format >3 9103>3 string >3 v.%.1s (unknown details) 9104 9105#------------------------------------------------------------------------------ 9106# $File: guile,v 1.1 2011/12/16 17:44:33 christos Exp $ 9107# Guile file magic from <dalepsmith@gmail.com> 9108# http://www.gnu.org/s/guile/ 9109# http://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250 9110 91110 string GOOF---- Guile Object 9112>8 string LE \b, little endian 9113>8 string BE \b, big endian 9114>11 string 4 \b, 32bit 9115>11 string 8 \b, 64bit 9116>13 regex .\.. \b, bytecode v%s 9117 9118#------------------------------------------------------------------------------ 9119# $File: hitachi-sh,v 1.6 2013/01/29 19:31:33 christos Exp $ 9120# hitach-sh: file(1) magic for Hitachi Super-H 9121# 9122# Super-H COFF 9123# 9124# below test line conflicts with 2nd NTFS filesystem sector 91250 beshort 0x0500 Hitachi SH big-endian COFF 9126# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR 9127#0 ubelong&0xFFFFNMPQ 0x0500NMPQ Hitachi SH big-endian COFF 9128>18 beshort&0x0002 =0x0000 object 9129>18 beshort&0x0002 =0x0002 executable 9130>18 beshort&0x0008 =0x0008 \b, stripped 9131>18 beshort&0x0008 =0x0000 \b, not stripped 9132# 91330 leshort 0x0550 Hitachi SH little-endian COFF 9134>18 leshort&0x0002 =0x0000 object 9135>18 leshort&0x0002 =0x0002 executable 9136>18 leshort&0x0008 =0x0008 \b, stripped 9137>18 leshort&0x0008 =0x0000 \b, not stripped 9138 9139 9140#------------------------------------------------------------------------------ 9141# $File: hp,v 1.23 2009/09/19 16:28:09 christos Exp $ 9142# hp: file(1) magic for Hewlett Packard machines (see also "printer") 9143# 9144# XXX - somebody should figure out whether any byte order needs to be 9145# applied to the "TML" stuff; I'm assuming the Apollo stuff is 9146# big-endian as it was mostly 68K-based. 9147# 9148# I think the 500 series was the old stack-based machines, running a 9149# UNIX environment atop the "SUN kernel"; dunno whether it was 9150# big-endian or little-endian. 9151# 9152# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based; 9153# hp300 are 68020+68881 based; hp400 are also 68k. The following basic 9154# HP magic is useful for reference, but using "long" magic is a better 9155# practice in order to avoid collisions. 9156# 9157# Guy Harris (guy@netapp.com): some additions to this list came from 9158# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1, 9159# 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0 9160# "/etc/magic", though, except for the "archive file relocatable library" 9161# stuff, and the 68030 and 68040 stuff isn't there at all - are they not 9162# used in executables, or have they just not yet updated "/etc/magic" 9163# completely? 9164# 9165# 0 beshort 200 hp200 (68010) BSD binary 9166# 0 beshort 300 hp300 (68020+68881) BSD binary 9167# 0 beshort 0x20c hp200/300 HP-UX binary 9168# 0 beshort 0x20d hp400 (68030) HP-UX binary 9169# 0 beshort 0x20e hp400 (68040?) HP-UX binary 9170# 0 beshort 0x20b PA-RISC1.0 HP-UX binary 9171# 0 beshort 0x210 PA-RISC1.1 HP-UX binary 9172# 0 beshort 0x211 PA-RISC1.2 HP-UX binary 9173# 0 beshort 0x214 PA-RISC2.0 HP-UX binary 9174 9175# 9176# The "misc" stuff needs a byte order; the archives look suspiciously 9177# like the old 177545 archives (0xff65 = 0177545). 9178# 9179#### Old Apollo stuff 91800 beshort 0627 Apollo m68k COFF executable 9181>18 beshort ^040000 not stripped 9182>22 beshort >0 - version %ld 91830 beshort 0624 apollo a88k COFF executable 9184>18 beshort ^040000 not stripped 9185>22 beshort >0 - version %ld 91860 long 01203604016 TML 0123 byte-order format 91870 long 01702407010 TML 1032 byte-order format 91880 long 01003405017 TML 2301 byte-order format 91890 long 01602007412 TML 3210 byte-order format 9190#### PA-RISC 1.1 91910 belong 0x02100106 PA-RISC1.1 relocatable object 91920 belong 0x02100107 PA-RISC1.1 executable 9193>168 belong &0x00000004 dynamically linked 9194>(144) belong 0x054ef630 dynamically linked 9195>96 belong >0 - not stripped 9196 91970 belong 0x02100108 PA-RISC1.1 shared executable 9198>168 belong&0x4 0x4 dynamically linked 9199>(144) belong 0x054ef630 dynamically linked 9200>96 belong >0 - not stripped 9201 92020 belong 0x0210010b PA-RISC1.1 demand-load executable 9203>168 belong&0x4 0x4 dynamically linked 9204>(144) belong 0x054ef630 dynamically linked 9205>96 belong >0 - not stripped 9206 92070 belong 0x0210010e PA-RISC1.1 shared library 9208>96 belong >0 - not stripped 9209 92100 belong 0x0210010d PA-RISC1.1 dynamic load library 9211>96 belong >0 - not stripped 9212 9213#### PA-RISC 2.0 92140 belong 0x02140106 PA-RISC2.0 relocatable object 9215 92160 belong 0x02140107 PA-RISC2.0 executable 9217>168 belong &0x00000004 dynamically linked 9218>(144) belong 0x054ef630 dynamically linked 9219>96 belong >0 - not stripped 9220 92210 belong 0x02140108 PA-RISC2.0 shared executable 9222>168 belong &0x00000004 dynamically linked 9223>(144) belong 0x054ef630 dynamically linked 9224>96 belong >0 - not stripped 9225 92260 belong 0x0214010b PA-RISC2.0 demand-load executable 9227>168 belong &0x00000004 dynamically linked 9228>(144) belong 0x054ef630 dynamically linked 9229>96 belong >0 - not stripped 9230 92310 belong 0x0214010e PA-RISC2.0 shared library 9232>96 belong >0 - not stripped 9233 92340 belong 0x0214010d PA-RISC2.0 dynamic load library 9235>96 belong >0 - not stripped 9236 9237#### 800 92380 belong 0x020b0106 PA-RISC1.0 relocatable object 9239 92400 belong 0x020b0107 PA-RISC1.0 executable 9241>168 belong&0x4 0x4 dynamically linked 9242>(144) belong 0x054ef630 dynamically linked 9243>96 belong >0 - not stripped 9244 92450 belong 0x020b0108 PA-RISC1.0 shared executable 9246>168 belong&0x4 0x4 dynamically linked 9247>(144) belong 0x054ef630 dynamically linked 9248>96 belong >0 - not stripped 9249 92500 belong 0x020b010b PA-RISC1.0 demand-load executable 9251>168 belong&0x4 0x4 dynamically linked 9252>(144) belong 0x054ef630 dynamically linked 9253>96 belong >0 - not stripped 9254 92550 belong 0x020b010e PA-RISC1.0 shared library 9256>96 belong >0 - not stripped 9257 92580 belong 0x020b010d PA-RISC1.0 dynamic load library 9259>96 belong >0 - not stripped 9260 92610 belong 0x213c6172 archive file 9262>68 belong 0x020b0619 - PA-RISC1.0 relocatable library 9263>68 belong 0x02100619 - PA-RISC1.1 relocatable library 9264>68 belong 0x02110619 - PA-RISC1.2 relocatable library 9265>68 belong 0x02140619 - PA-RISC2.0 relocatable library 9266 9267#### 500 92680 long 0x02080106 HP s500 relocatable executable 9269>16 long >0 - version %ld 9270 92710 long 0x02080107 HP s500 executable 9272>16 long >0 - version %ld 9273 92740 long 0x02080108 HP s500 pure executable 9275>16 long >0 - version %ld 9276 9277#### 200 92780 belong 0x020c0108 HP s200 pure executable 9279>4 beshort >0 - version %ld 9280>8 belong &0x80000000 save fp regs 9281>8 belong &0x40000000 dynamically linked 9282>8 belong &0x20000000 debuggable 9283>36 belong >0 not stripped 9284 92850 belong 0x020c0107 HP s200 executable 9286>4 beshort >0 - version %ld 9287>8 belong &0x80000000 save fp regs 9288>8 belong &0x40000000 dynamically linked 9289>8 belong &0x20000000 debuggable 9290>36 belong >0 not stripped 9291 92920 belong 0x020c010b HP s200 demand-load executable 9293>4 beshort >0 - version %ld 9294>8 belong &0x80000000 save fp regs 9295>8 belong &0x40000000 dynamically linked 9296>8 belong &0x20000000 debuggable 9297>36 belong >0 not stripped 9298 92990 belong 0x020c0106 HP s200 relocatable executable 9300>4 beshort >0 - version %ld 9301>6 beshort >0 - highwater %d 9302>8 belong &0x80000000 save fp regs 9303>8 belong &0x20000000 debuggable 9304>8 belong &0x10000000 PIC 9305 93060 belong 0x020a0108 HP s200 (2.x release) pure executable 9307>4 beshort >0 - version %ld 9308>36 belong >0 not stripped 9309 93100 belong 0x020a0107 HP s200 (2.x release) executable 9311>4 beshort >0 - version %ld 9312>36 belong >0 not stripped 9313 93140 belong 0x020c010e HP s200 shared library 9315>4 beshort >0 - version %ld 9316>6 beshort >0 - highwater %d 9317>36 belong >0 not stripped 9318 93190 belong 0x020c010d HP s200 dynamic load library 9320>4 beshort >0 - version %ld 9321>6 beshort >0 - highwater %d 9322>36 belong >0 not stripped 9323 9324#### MISC 93250 long 0x0000ff65 HP old archive 93260 long 0x020aff65 HP s200 old archive 93270 long 0x020cff65 HP s200 old archive 93280 long 0x0208ff65 HP s500 old archive 9329 93300 long 0x015821a6 HP core file 9331 93320 long 0x4da7eee8 HP-WINDOWS font 9333>8 byte >0 - version %ld 93340 string Bitmapfile HP Bitmapfile 9335 93360 string IMGfile CIS compimg HP Bitmapfile 9337# XXX - see "lif" 9338#0 short 0x8000 lif file 93390 long 0x020c010c compiled Lisp 9340 93410 string msgcat01 HP NLS message catalog, 9342>8 long >0 %d messages 9343 9344# Summary: HP-48/49 calculator 9345# Created by: phk@data.fls.dk 9346# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk> 9347# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support) 93480 string HPHP HP 9349>4 string 48 48 binary 9350>4 string 49 49 binary 9351>7 byte >64 - Rev %c 9352>8 leshort 0x2911 (ADR) 9353>8 leshort 0x2933 (REAL) 9354>8 leshort 0x2955 (LREAL) 9355>8 leshort 0x2977 (COMPLX) 9356>8 leshort 0x299d (LCOMPLX) 9357>8 leshort 0x29bf (CHAR) 9358>8 leshort 0x29e8 (ARRAY) 9359>8 leshort 0x2a0a (LNKARRAY) 9360>8 leshort 0x2a2c (STRING) 9361>8 leshort 0x2a4e (HXS) 9362>8 leshort 0x2a74 (LIST) 9363>8 leshort 0x2a96 (DIR) 9364>8 leshort 0x2ab8 (ALG) 9365>8 leshort 0x2ada (UNIT) 9366>8 leshort 0x2afc (TAGGED) 9367>8 leshort 0x2b1e (GROB) 9368>8 leshort 0x2b40 (LIB) 9369>8 leshort 0x2b62 (BACKUP) 9370>8 leshort 0x2b88 (LIBDATA) 9371>8 leshort 0x2d9d (PROG) 9372>8 leshort 0x2dcc (CODE) 9373>8 leshort 0x2e48 (GNAME) 9374>8 leshort 0x2e6d (LNAME) 9375>8 leshort 0x2e92 (XLIB) 9376 93770 string %%HP: HP text 9378>6 string T(0) - T(0) 9379>6 string T(1) - T(1) 9380>6 string T(2) - T(2) 9381>6 string T(3) - T(3) 9382>10 string A(D) A(D) 9383>10 string A(R) A(R) 9384>10 string A(G) A(G) 9385>14 string F(.) F(.); 9386>14 string F(,) F(,); 9387 9388 9389# Summary: HP-38/39 calculator 9390# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 93910 string HP3 9392>3 string 8 HP 38 9393>3 string 9 HP 39 9394>4 string Bin binary 9395>4 string Asc ASCII 9396>7 string A (Directory List) 9397>7 string B (Zaplet) 9398>7 string C (Note) 9399>7 string D (Program) 9400>7 string E (Variable) 9401>7 string F (List) 9402>7 string G (Matrix) 9403>7 string H (Library) 9404>7 string I (Target List) 9405>7 string J (ASCII Vector specification) 9406>7 string K (wildcard) 9407 9408# Summary: HP-38/39 calculator 9409# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 94100 string HP3 9411>3 string 8 HP 38 9412>3 string 9 HP 39 9413>4 string Bin binary 9414>4 string Asc ASCII 9415>7 string A (Directory List) 9416>7 string B (Zaplet) 9417>7 string C (Note) 9418>7 string D (Program) 9419>7 string E (Variable) 9420>7 string F (List) 9421>7 string G (Matrix) 9422>7 string H (Library) 9423>7 string I (Target List) 9424>7 string J (ASCII Vector specification) 9425>7 string K (wildcard) 9426 9427# hpBSD magic numbers 94280 beshort 200 hp200 (68010) BSD 9429>2 beshort 0407 impure binary 9430>2 beshort 0410 read-only binary 9431>2 beshort 0413 demand paged binary 94320 beshort 300 hp300 (68020+68881) BSD 9433>2 beshort 0407 impure binary 9434>2 beshort 0410 read-only binary 9435>2 beshort 0413 demand paged binary 9436# 9437# From David Gero <dgero@nortelnetworks.com> 9438# HP-UX 10.20 core file format from /usr/include/sys/core.h 9439# Unfortunately, HP-UX uses corehead blocks without specifying the order 9440# There are four we care about: 9441# CORE_KERNEL, which starts with the string "HP-UX" 9442# CORE_EXEC, which contains the name of the command 9443# CORE_PROC, which contains the signal number that caused the core dump 9444# CORE_FORMAT, which contains the version of the core file format (== 1) 9445# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC 9446# but we include all 6 variations of the order of the first 3, and 9447# assume that PROC will always be last 9448# Order 1: KERNEL, EXEC, FORMAT, PROC 94490x10 string HP-UX 9450>0 belong 2 9451>>0xC belong 0x3C 9452>>>0x4C belong 0x100 9453>>>>0x58 belong 0x44 9454>>>>>0xA0 belong 1 9455>>>>>>0xAC belong 4 9456>>>>>>>0xB0 belong 1 9457>>>>>>>>0xB4 belong 4 core file 9458>>>>>>>>>0x90 string >\0 from '%s' 9459>>>>>>>>>0xC4 belong 3 - received SIGQUIT 9460>>>>>>>>>0xC4 belong 4 - received SIGILL 9461>>>>>>>>>0xC4 belong 5 - received SIGTRAP 9462>>>>>>>>>0xC4 belong 6 - received SIGABRT 9463>>>>>>>>>0xC4 belong 7 - received SIGEMT 9464>>>>>>>>>0xC4 belong 8 - received SIGFPE 9465>>>>>>>>>0xC4 belong 10 - received SIGBUS 9466>>>>>>>>>0xC4 belong 11 - received SIGSEGV 9467>>>>>>>>>0xC4 belong 12 - received SIGSYS 9468>>>>>>>>>0xC4 belong 33 - received SIGXCPU 9469>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 9470# Order 2: KERNEL, FORMAT, EXEC, PROC 9471>>>0x4C belong 1 9472>>>>0x58 belong 4 9473>>>>>0x5C belong 1 9474>>>>>>0x60 belong 0x100 9475>>>>>>>0x6C belong 0x44 9476>>>>>>>>0xB4 belong 4 core file 9477>>>>>>>>>0xA4 string >\0 from '%s' 9478>>>>>>>>>0xC4 belong 3 - received SIGQUIT 9479>>>>>>>>>0xC4 belong 4 - received SIGILL 9480>>>>>>>>>0xC4 belong 5 - received SIGTRAP 9481>>>>>>>>>0xC4 belong 6 - received SIGABRT 9482>>>>>>>>>0xC4 belong 7 - received SIGEMT 9483>>>>>>>>>0xC4 belong 8 - received SIGFPE 9484>>>>>>>>>0xC4 belong 10 - received SIGBUS 9485>>>>>>>>>0xC4 belong 11 - received SIGSEGV 9486>>>>>>>>>0xC4 belong 12 - received SIGSYS 9487>>>>>>>>>0xC4 belong 33 - received SIGXCPU 9488>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 9489# Order 3: FORMAT, KERNEL, EXEC, PROC 94900x24 string HP-UX 9491>0 belong 1 9492>>0xC belong 4 9493>>>0x10 belong 1 9494>>>>0x14 belong 2 9495>>>>>0x20 belong 0x3C 9496>>>>>>0x60 belong 0x100 9497>>>>>>>0x6C belong 0x44 9498>>>>>>>>0xB4 belong 4 core file 9499>>>>>>>>>0xA4 string >\0 from '%s' 9500>>>>>>>>>0xC4 belong 3 - received SIGQUIT 9501>>>>>>>>>0xC4 belong 4 - received SIGILL 9502>>>>>>>>>0xC4 belong 5 - received SIGTRAP 9503>>>>>>>>>0xC4 belong 6 - received SIGABRT 9504>>>>>>>>>0xC4 belong 7 - received SIGEMT 9505>>>>>>>>>0xC4 belong 8 - received SIGFPE 9506>>>>>>>>>0xC4 belong 10 - received SIGBUS 9507>>>>>>>>>0xC4 belong 11 - received SIGSEGV 9508>>>>>>>>>0xC4 belong 12 - received SIGSYS 9509>>>>>>>>>0xC4 belong 33 - received SIGXCPU 9510>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 9511# Order 4: EXEC, KERNEL, FORMAT, PROC 95120x64 string HP-UX 9513>0 belong 0x100 9514>>0xC belong 0x44 9515>>>0x54 belong 2 9516>>>>0x60 belong 0x3C 9517>>>>>0xA0 belong 1 9518>>>>>>0xAC belong 4 9519>>>>>>>0xB0 belong 1 9520>>>>>>>>0xB4 belong 4 core file 9521>>>>>>>>>0x44 string >\0 from '%s' 9522>>>>>>>>>0xC4 belong 3 - received SIGQUIT 9523>>>>>>>>>0xC4 belong 4 - received SIGILL 9524>>>>>>>>>0xC4 belong 5 - received SIGTRAP 9525>>>>>>>>>0xC4 belong 6 - received SIGABRT 9526>>>>>>>>>0xC4 belong 7 - received SIGEMT 9527>>>>>>>>>0xC4 belong 8 - received SIGFPE 9528>>>>>>>>>0xC4 belong 10 - received SIGBUS 9529>>>>>>>>>0xC4 belong 11 - received SIGSEGV 9530>>>>>>>>>0xC4 belong 12 - received SIGSYS 9531>>>>>>>>>0xC4 belong 33 - received SIGXCPU 9532>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 9533# Order 5: FORMAT, EXEC, KERNEL, PROC 95340x78 string HP-UX 9535>0 belong 1 9536>>0xC belong 4 9537>>>0x10 belong 1 9538>>>>0x14 belong 0x100 9539>>>>>0x20 belong 0x44 9540>>>>>>0x68 belong 2 9541>>>>>>>0x74 belong 0x3C 9542>>>>>>>>0xB4 belong 4 core file 9543>>>>>>>>>0x58 string >\0 from '%s' 9544>>>>>>>>>0xC4 belong 3 - received SIGQUIT 9545>>>>>>>>>0xC4 belong 4 - received SIGILL 9546>>>>>>>>>0xC4 belong 5 - received SIGTRAP 9547>>>>>>>>>0xC4 belong 6 - received SIGABRT 9548>>>>>>>>>0xC4 belong 7 - received SIGEMT 9549>>>>>>>>>0xC4 belong 8 - received SIGFPE 9550>>>>>>>>>0xC4 belong 10 - received SIGBUS 9551>>>>>>>>>0xC4 belong 11 - received SIGSEGV 9552>>>>>>>>>0xC4 belong 12 - received SIGSYS 9553>>>>>>>>>0xC4 belong 33 - received SIGXCPU 9554>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 9555# Order 6: EXEC, FORMAT, KERNEL, PROC 9556>0 belong 0x100 9557>>0xC belong 0x44 9558>>>0x54 belong 1 9559>>>>0x60 belong 4 9560>>>>>0x64 belong 1 9561>>>>>>0x68 belong 2 9562>>>>>>>0x74 belong 0x2C 9563>>>>>>>>0xB4 belong 4 core file 9564>>>>>>>>>0x44 string >\0 from '%s' 9565>>>>>>>>>0xC4 belong 3 - received SIGQUIT 9566>>>>>>>>>0xC4 belong 4 - received SIGILL 9567>>>>>>>>>0xC4 belong 5 - received SIGTRAP 9568>>>>>>>>>0xC4 belong 6 - received SIGABRT 9569>>>>>>>>>0xC4 belong 7 - received SIGEMT 9570>>>>>>>>>0xC4 belong 8 - received SIGFPE 9571>>>>>>>>>0xC4 belong 10 - received SIGBUS 9572>>>>>>>>>0xC4 belong 11 - received SIGSEGV 9573>>>>>>>>>0xC4 belong 12 - received SIGSYS 9574>>>>>>>>>0xC4 belong 33 - received SIGXCPU 9575>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 9576 9577 9578 9579#------------------------------------------------------------------------------ 9580# $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $ 9581# human68k: file(1) magic for Human68k (X680x0 DOS) binary formats 9582# Magic too short! 9583#0 string HU Human68k 9584#>68 string LZX LZX compressed 9585#>>72 string >\0 (version %s) 9586#>(8.L+74) string LZX LZX compressed 9587#>>(8.L+78) string >\0 (version %s) 9588#>60 belong >0 binded 9589#>(8.L+66) string #HUPAIR hupair 9590#>0 string HU X executable 9591#>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1 9592#>4 belong >0 - base address 0x%x 9593#>28 belong >0 not stripped 9594#>32 belong >0 with debug information 9595#0 beshort 0x601a Human68k Z executable 9596#0 beshort 0x6000 Human68k object file 9597#0 belong 0xd1000000 Human68k ar binary archive 9598#0 belong 0xd1010000 Human68k ar ascii archive 9599#0 beshort 0x0068 Human68k lib archive 9600#4 string LZX Human68k LZX compressed 9601#>8 string >\0 (version %s) 9602#>4 string LZX R executable 9603#2 string #HUPAIR Human68k hupair R executable 9604 9605#------------------------------------------------------------------------------ 9606# $File: ibm370,v 1.8 2009/09/19 16:28:09 christos Exp $ 9607# ibm370: file(1) magic for IBM 370 and compatibles. 9608# 9609# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable". 9610# What the heck *is* "USS/370"? 9611# AIX 4.1's "/etc/magic" has 9612# 9613# 0 short 0535 370 sysV executable 9614# >12 long >0 not stripped 9615# >22 short >0 - version %d 9616# >30 long >0 - 5.2 format 9617# 0 short 0530 370 sysV pure executable 9618# >12 long >0 not stripped 9619# >22 short >0 - version %d 9620# >30 long >0 - 5.2 format 9621# 9622# instead of the "USS/370" versions of the same magic numbers. 9623# 96240 beshort 0537 370 XA sysV executable 9625>12 belong >0 not stripped 9626>22 beshort >0 - version %d 9627>30 belong >0 - 5.2 format 96280 beshort 0532 370 XA sysV pure executable 9629>12 belong >0 not stripped 9630>22 beshort >0 - version %d 9631>30 belong >0 - 5.2 format 96320 beshort 054001 370 sysV pure executable 9633>12 belong >0 not stripped 96340 beshort 055001 370 XA sysV pure executable 9635>12 belong >0 not stripped 96360 beshort 056401 370 sysV executable 9637>12 belong >0 not stripped 96380 beshort 057401 370 XA sysV executable 9639>12 belong >0 not stripped 96400 beshort 0531 SVR2 executable (Amdahl-UTS) 9641>12 belong >0 not stripped 9642>24 belong >0 - version %ld 96430 beshort 0534 SVR2 pure executable (Amdahl-UTS) 9644>12 belong >0 not stripped 9645>24 belong >0 - version %ld 96460 beshort 0530 SVR2 pure executable (USS/370) 9647>12 belong >0 not stripped 9648>24 belong >0 - version %ld 96490 beshort 0535 SVR2 executable (USS/370) 9650>12 belong >0 not stripped 9651>24 belong >0 - version %ld 9652 9653#------------------------------------------------------------------------------ 9654# $File: ibm6000,v 1.11 2013/01/08 20:13:01 christos Exp $ 9655# ibm6000: file(1) magic for RS/6000 and the RT PC. 9656# 96570 beshort 0x01df executable (RISC System/6000 V3.1) or obj module 9658>12 belong >0 not stripped 9659# Breaks sun4 statically linked execs. 9660#0 beshort 0x0103 executable (RT Version 2) or obj module 9661#>2 byte 0x50 pure 9662#>28 belong >0 not stripped 9663#>6 beshort >0 - version %ld 96640 beshort 0x0104 shared library 96650 beshort 0x0105 ctab data 96660 beshort 0xfe04 structured file 96670 string 0xabcdef AIX message catalog 96680 belong 0x000001f9 AIX compiled message catalog 96690 string \<aiaff> archive 96700 string \<bigaf> archive (big format) 9671 96720 beshort 0x01f7 64-bit XCOFF executable or object module 9673>20 belong 0 not stripped 96744 belong &0x0feeddb0 AIX core file 9675>1 byte &0x01 fulldump 9676>7 byte &0x01 32-bit 9677>>0x6e0 string >\0 \b, %s 9678>7 byte &0x02 64-bit 9679>>0x524 string >\0 \b, %s 9680 9681#------------------------------------------------------------------------------ 9682# $File: icc,v 1.1 2013/01/08 01:43:18 christos Exp $ 9683# icc: file(1) magic for International Color Consortium file formats 9684 9685# 9686# Color profiles as per the ICC's "Image technology colour management - 9687# Architecture, profile format, and data structure" specification. 9688# See 9689# 9690# http://www.color.org/specification/ICC1v43_2010-12.pdf 9691# 9692# for Specification ICC.1:2010 (Profile version 4.3.0.0). 9693# 9694# Bytes 36 to 39 contain a generic profile file signature of "acsp"; 9695# bytes 40 to 43 "may be used to identify the primary platform/operating 9696# system framework for which the profile was created". 9697# 9698# There are other fields that might be worth dumping as well. 9699# 9700 9701# This appears to be what's used for Apple ColorSync profiles. 9702# Instead of adding that, Apple just changed the generic "acsp" entry 9703# to be for "ColorSync ICC Color Profile" rather than "Kodak Color 9704# Management System, ICC Profile". 9705# Yes, it's "APPL", not "AAPL"; see the spec. 970636 string acspAPPL ColorSync ICC Profile 9707!:mime application/vnd.iccprofile 9708 9709# Microsoft ICM color profile 971036 string acspMSFT Microsoft ICM Color Profile 9711!:mime application/vnd.iccprofile 9712 9713# Yes, that's a blank after "SGI". 971436 string acspSGI\ SGI ICC Profile 9715!:mime application/vnd.iccprofile 9716 9717# XXX - is this what's used for the Sun KCMS or not? The standard file 9718# uses just "acsp" for that, but Apple's file uses it for "ColorSync", 9719# and there *is* an identified "primary platform" value of SUNW. 972036 string acspSUNW Sun KCMS ICC Profile 9721!:mime application/vnd.iccprofile 9722 9723# Any other profile. 9724# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles, 9725# and use "acsp" for everything else and dump the "primary platform" 9726# string in those cases? 972736 string acsp ICC Profile 9728!:mime application/vnd.iccprofile 9729 9730 9731 9732#------------------------------------------------------------------------------ 9733# $File: iff,v 1.13 2011/09/06 11:00:06 christos Exp $ 9734# iff: file(1) magic for Interchange File Format (see also "audio" & "images") 9735# 9736# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic 9737# Arts for file interchange. It has also been used by Apple, SGI, and 9738# especially Commodore-Amiga. 9739# 9740# IFF files begin with an 8 byte FORM header, followed by a 4 character 9741# FORM type, which is followed by the first chunk in the FORM. 9742 97430 string FORM IFF data 9744#>4 belong x \b, FORM is %d bytes long 9745# audio formats 9746>8 string AIFF \b, AIFF audio 9747!:mime audio/x-aiff 9748>8 string AIFC \b, AIFF-C compressed audio 9749!:mime audio/x-aiff 9750>8 string 8SVX \b, 8SVX 8-bit sampled sound voice 9751!:mime audio/x-aiff 9752>8 string 16SV \b, 16SV 16-bit sampled sound voice 9753>8 string SAMP \b, SAMP sampled audio 9754>8 string MAUD \b, MAUD MacroSystem audio 9755>8 string SMUS \b, SMUS simple music 9756>8 string CMUS \b, CMUS complex music 9757# image formats 9758>8 string ILBMBMHD \b, ILBM interleaved image 9759>>20 beshort x \b, %d x 9760>>22 beshort x %d 9761>8 string RGBN \b, RGBN 12-bit RGB image 9762>8 string RGB8 \b, RGB8 24-bit RGB image 9763>8 string DEEP \b, DEEP TVPaint/XiPaint image 9764>8 string DR2D \b, DR2D 2-D object 9765>8 string TDDD \b, TDDD 3-D rendering 9766>8 string LWOB \b, LWOB 3-D object 9767>8 string LWO2 \b, LWO2 3-D object, v2 9768>8 string LWLO \b, LWLO 3-D layered object 9769>8 string REAL \b, REAL Real3D rendering 9770>8 string MC4D \b, MC4D MaxonCinema4D rendering 9771>8 string ANIM \b, ANIM animation 9772>8 string YAFA \b, YAFA animation 9773>8 string SSA\ \b, SSA super smooth animation 9774>8 string ACBM \b, ACBM continuous image 9775>8 string FAXX \b, FAXX fax image 9776# other formats 9777>8 string FTXT \b, FTXT formatted text 9778>8 string CTLG \b, CTLG message catalog 9779>8 string PREF \b, PREF preferences 9780>8 string DTYP \b, DTYP datatype description 9781>8 string PTCH \b, PTCH binary patch 9782>8 string AMFF \b, AMFF AmigaMetaFile format 9783>8 string WZRD \b, WZRD StormWIZARD resource 9784>8 string DOC\ \b, DOC desktop publishing document 9785>8 string WVQA \b, Westwood Studios VQA Multimedia, 9786>>24 leshort x %d video frames, 9787>>26 leshort x %d x 9788>>28 leshort x %d 9789>8 string MOVE \b, Wing Commander III Video 9790>>12 string _PC_ \b, PC version 9791>>12 string 3DO_ \b, 3DO version 9792 9793# These go at the end of the iff rules 9794# 9795# I don't see why these might collide with anything else. 9796# 9797# Interactive Fiction related formats 9798# 9799>8 string IFRS \b, Blorb Interactive Fiction 9800>>24 string Exec with executable chunk 9801>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal) 9802 9803#------------------------------------------------------------------------------ 9804# $File: images,v 1.81 2013/03/09 22:36:00 christos Exp $ 9805# images: file(1) magic for image formats (see also "iff", and "c-lang" for 9806# XPM bitmaps) 9807# 9808# originally from jef@helios.ee.lbl.gov (Jef Poskanzer), 9809# additions by janl@ifi.uio.no as well as others. Jan also suggested 9810# merging several one- and two-line files into here. 9811# 9812# little magic: PCX (first byte is 0x0a) 9813 9814# Targa - matches `povray', `ppmtotga' and `xv' outputs 9815# by Philippe De Muyter <phdm@macqel.be> 9816# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11 9817# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise 9818# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs 9819# `xv' recognizes only a subset of the following (RGB with pixelsize = 24) 9820# `tgatoppm' recognizes a superset (Index may be anything) 98211 belong&0xfff7ffff 0x01010000 Targa image data - Map 9822>2 byte&8 8 - RLE 9823>12 leshort >0 %hd x 9824>14 leshort >0 %hd 98251 belong&0xfff7ffff 0x00020000 Targa image data - RGB 9826>2 byte&8 8 - RLE 9827>12 leshort >0 %hd x 9828>14 leshort >0 %hd 98291 belong&0xfff7ffff 0x00030000 Targa image data - Mono 9830>2 byte&8 8 - RLE 9831>12 leshort >0 %hd x 9832>14 leshort >0 %hd 9833 9834# PBMPLUS images 9835# The next byte following the magic is always whitespace. 9836# strength is changed to try these patterns before "x86 boot sector" 98370 search/1 P1 9838>3 regex =[0-9]*\ [0-9]* Netpbm PBM image text 9839>3 regex =[0-9]+\ \b, size = %sx 9840>>3 regex =\ [0-9]+ \b%s 9841!:strength + 45 9842!:mime image/x-portable-bitmap 98430 search/1 P2 9844>3 regex =[0-9]*\ [0-9]* Netpbm PGM image text 9845>3 regex =[0-9]+\ \b, size = %sx 9846>>3 regex =\ [0-9]+ \b%s 9847!:strength + 45 9848!:mime image/x-portable-greymap 98490 search/1 P3 Netpbm PPM image text 9850>3 regex =[0-9]*\ [0-9]* Netpbm PPM image text 9851>3 regex =[0-9]+\ \b, size = %sx 9852>>3 regex =\ [0-9]+ \b%s 9853!:strength + 45 9854!:mime image/x-portable-pixmap 98550 string P4 9856>3 regex =[0-9]*\ [0-9]* Netpbm PBM "rawbits" image data 9857>3 regex =[0-9]+\ \b, size = %sx 9858>>3 regex =\ [0-9]+ \b%s 9859!:strength + 45 9860!:mime image/x-portable-bitmap 98610 string P5 9862>3 regex =[0-9]*\ [0-9]* Netpbm PGM "rawbits" image data 9863>3 regex =[0-9]+\ \b, size = %sx 9864>>3 regex =\ [0-9]+ \b%s 9865!:strength + 45 9866!:mime image/x-portable-greymap 98670 string P6 9868>3 regex =[0-9]*\ [0-9]* Netpbm PPM "rawbits" image data 9869>3 regex =[0-9]+\ \b, size = %sx 9870>>3 regex =\ [0-9]+ \b%s 9871!:strength + 45 9872!:mime image/x-portable-pixmap 98730 string P7 Netpbm PAM image file 9874!:mime image/x-portable-pixmap 9875 9876# From: bryanh@giraffe-data.com (Bryan Henderson) 98770 string \117\072 Solitaire Image Recorder format 9878>4 string \013 MGI Type 11 9879>4 string \021 MGI Type 17 98800 string .MDA MicroDesign data 9881>21 byte 48 version 2 9882>21 byte 51 version 3 98830 string .MDP MicroDesign page data 9884>21 byte 48 version 2 9885>21 byte 51 version 3 9886 9887# NIFF (Navy Interchange File Format, a modification of TIFF) images 9888# [GRR: this *must* go before TIFF] 98890 string IIN1 NIFF image data 9890!:mime image/x-niff 9891 9892# Canon RAW version 1 (CRW) files are a type of Canon Image File Format 9893# (CIFF) file. These are apparently all little-endian. 9894# From: Adam Buchbinder <adam.buchbinder@gmail.com> 9895# URL: http://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html 98960 string II\x1a\0\0\0HEAPCCDR Canon CIFF raw image data 9897!:mime image/x-canon-crw 9898>16 leshort x \b, version %d. 9899>14 leshort x \b%d 9900 9901# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic 9902# number. Put this above the TIFF test to make sure we detect them. 9903# These are apparently all little-endian. 9904# From: Adam Buchbinder <adam.buchbinder@gmail.com> 9905# URL: http://libopenraw.freedesktop.org/wiki/Canon_CR2 99060 string II\x2a\0\x10\0\0\0CR Canon CR2 raw image data 9907!:mime image/x-canon-cr2 9908>10 byte x \b, version %d. 9909>11 byte x \b%d 9910 9911# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com) 9912# The second word of TIFF files is the TIFF version number, 42, which has 9913# never changed. The TIFF specification recommends testing for it. 99140 string MM\x00\x2a TIFF image data, big-endian 9915!:mime image/tiff 99160 string II\x2a\x00 TIFF image data, little-endian 9917!:mime image/tiff 9918 99190 string MM\x00\x2b Big TIFF image data, big-endian 9920!:mime image/tiff 99210 string II\x2b\x00 Big TIFF image data, little-endian 9922!:mime image/tiff 9923 9924# PNG [Portable Network Graphics, or "PNG's Not GIF"] images 9925# (Greg Roelofs, newt@uchicago.edu) 9926# (Albert Cahalan, acahalan@cs.uml.edu) 9927# 9928# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ... 9929# 99300 string \x89PNG\x0d\x0a\x1a\x0a PNG image data 9931!:mime image/png 9932>16 belong x \b, %ld x 9933>20 belong x %ld, 9934>24 byte x %d-bit 9935>25 byte 0 grayscale, 9936>25 byte 2 \b/color RGB, 9937>25 byte 3 colormap, 9938>25 byte 4 gray+alpha, 9939>25 byte 6 \b/color RGBA, 9940#>26 byte 0 deflate/32K, 9941>28 byte 0 non-interlaced 9942>28 byte 1 interlaced 9943 9944# possible GIF replacements; none yet released! 9945# (Greg Roelofs, newt@uchicago.edu) 9946# 9947# GRR 950115: this was mine ("Zip GIF"): 99480 string GIF94z ZIF image (GIF+deflate alpha) 9949!:mime image/x-unknown 9950# 9951# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better): 9952# 99530 string FGF95a FGF image (GIF+deflate beta) 9954!:mime image/x-unknown 9955# 9956# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal 9957# (best; not yet implemented): 9958# 99590 string PBF PBF image (deflate compression) 9960!:mime image/x-unknown 9961 9962# GIF 99630 string GIF8 GIF image data 9964!:mime image/gif 9965!:apple 8BIMGIFf 9966>4 string 7a \b, version 8%s, 9967>4 string 9a \b, version 8%s, 9968>6 leshort >0 %hd x 9969>8 leshort >0 %hd 9970#>10 byte &0x80 color mapped, 9971#>10 byte&0x07 =0x00 2 colors 9972#>10 byte&0x07 =0x01 4 colors 9973#>10 byte&0x07 =0x02 8 colors 9974#>10 byte&0x07 =0x03 16 colors 9975#>10 byte&0x07 =0x04 32 colors 9976#>10 byte&0x07 =0x05 64 colors 9977#>10 byte&0x07 =0x06 128 colors 9978#>10 byte&0x07 =0x07 256 colors 9979 9980# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster, 9981# 1 plane, no encoding. 99820 string \361\0\100\273 CMU window manager raster image data 9983>4 lelong >0 %d x 9984>8 lelong >0 %d, 9985>12 lelong >0 %d-bit 9986 9987# Magick Image File Format 99880 string id=ImageMagick MIFF image data 9989 9990# Artisan 99910 long 1123028772 Artisan image data 9992>4 long 1 \b, rectangular 24-bit 9993>4 long 2 \b, rectangular 8-bit with colormap 9994>4 long 3 \b, rectangular 32-bit (24-bit with matte) 9995 9996# FIG (Facility for Interactive Generation of figures), an object-based format 99970 search/1 #FIG FIG image text 9998>5 string x \b, version %.3s 9999 10000# PHIGS 100010 string ARF_BEGARF PHIGS clear text archive 100020 string @(#)SunPHIGS SunPHIGS 10003# version number follows, in the form m.n 10004>40 string SunBin binary 10005>32 string archive archive 10006 10007# GKS (Graphics Kernel System) 100080 string GKSM GKS Metafile 10009>24 string SunGKS \b, SunGKS 10010 10011# CGM image files 100120 string BEGMF clear text Computer Graphics Metafile 10013 10014# MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de) 100150 string yz MGR bitmap, modern format, 8-bit aligned 100160 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned 100170 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned 100180 string yx MGR bitmap, modern format, squeezed 10019 10020# Fuzzy Bitmap (FBM) images 100210 string %bitmap\0 FBM image data 10022>30 long 0x31 \b, mono 10023>30 long 0x33 \b, color 10024 10025# facsimile data 100261 string PC\ Research,\ Inc group 3 fax data 10027>29 byte 0 \b, normal resolution (204x98 DPI) 10028>29 byte 1 \b, fine resolution (204x196 DPI) 10029# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at> 100300 string Sfff structured fax file 10031 10032# From: Joerg Jenderek <joerg.jen.der.ek@gmx.net> 10033# most files with the extension .EPA and some with .BMP 100340 string \x11\x06 Award BIOS Logo, 136 x 84 10035!:mime image/x-award-bioslogo 100360 string \x11\x09 Award BIOS Logo, 136 x 126 10037!:mime image/x-award-bioslogo 10038#0 string \x07\x1f BIOS Logo corrupted? 10039# http://www.blackfiveservices.co.uk/awbmtools.shtml 10040# http://biosgfx.narod.ru/v3/ 10041# http://biosgfx.narod.ru/abr-2/ 100420 string AWBM 10043>4 leshort <1981 Award BIOS bitmap 10044!:mime image/x-award-bmp 10045# image width is a multiple of 4 10046>>4 leshort&0x0003 0 10047>>>4 leshort x \b, %d 10048>>>6 leshort x x %d 10049>>4 leshort&0x0003 >0 \b, 10050>>>4 leshort&0x0003 =1 10051>>>>4 leshort x %d+3 10052>>>4 leshort&0x0003 =2 10053>>>>4 leshort x %d+2 10054>>>4 leshort&0x0003 =3 10055>>>>4 leshort x %d+1 10056>>>6 leshort x x %d 10057# at offset 8 starts imagedata followed by "RGB " marker 10058 10059# PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu) 100600 string BM 10061>14 leshort 12 PC bitmap, OS/2 1.x format 10062!:mime image/x-ms-bmp 10063>>18 leshort x \b, %d x 10064>>20 leshort x %d 10065>14 leshort 64 PC bitmap, OS/2 2.x format 10066!:mime image/x-ms-bmp 10067>>18 leshort x \b, %d x 10068>>20 leshort x %d 10069>14 leshort 40 PC bitmap, Windows 3.x format 10070!:mime image/x-ms-bmp 10071>>18 lelong x \b, %d x 10072>>22 lelong x %d x 10073>>28 leshort x %d 10074>14 leshort 128 PC bitmap, Windows NT/2000 format 10075!:mime image/x-ms-bmp 10076>>18 lelong x \b, %d x 10077>>22 lelong x %d x 10078>>28 leshort x %d 10079# Too simple - MPi 10080#0 string IC PC icon data 10081#0 string PI PC pointer image data 10082#0 string CI PC color icon data 10083#0 string CP PC color pointer image data 10084# Conflicts with other entries [BABYL] 10085#0 string BA PC bitmap array data 10086 10087# XPM icons (Greg Roelofs, newt@uchicago.edu) 100880 search/1 /*\ XPM\ */ X pixmap image text 10089!:mime image/x-xpmi 10090 10091# Utah Raster Toolkit RLE images (janl@ifi.uio.no) 100920 leshort 0xcc52 RLE image data, 10093>6 leshort x %d x 10094>8 leshort x %d 10095>2 leshort >0 \b, lower left corner: %d 10096>4 leshort >0 \b, lower right corner: %d 10097>10 byte&0x1 =0x1 \b, clear first 10098>10 byte&0x2 =0x2 \b, no background 10099>10 byte&0x4 =0x4 \b, alpha channel 10100>10 byte&0x8 =0x8 \b, comment 10101>11 byte >0 \b, %d color channels 10102>12 byte >0 \b, %d bits per pixel 10103>13 byte >0 \b, %d color map channels 10104 10105# image file format (Robert Potter, potter@cs.rochester.edu) 101060 string Imagefile\ version- iff image data 10107# this adds the whole header (inc. version number), informative but longish 10108>10 string >\0 %s 10109 10110# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com) 101110 belong 0x59a66a95 Sun raster image data 10112>4 belong >0 \b, %d x 10113>8 belong >0 %d, 10114>12 belong >0 %d-bit, 10115#>16 belong >0 %d bytes long, 10116>20 belong 0 old format, 10117#>20 belong 1 standard, 10118>20 belong 2 compressed, 10119>20 belong 3 RGB, 10120>20 belong 4 TIFF, 10121>20 belong 5 IFF, 10122>20 belong 0xffff reserved for testing, 10123>24 belong 0 no colormap 10124>24 belong 1 RGB colormap 10125>24 belong 2 raw colormap 10126#>28 belong >0 colormap is %d bytes long 10127 10128# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com) 10129# 10130# See 10131# http://reality.sgi.com/grafica/sgiimage.html 10132# 101330 beshort 474 SGI image data 10134#>2 byte 0 \b, verbatim 10135>2 byte 1 \b, RLE 10136#>3 byte 1 \b, normal precision 10137>3 byte 2 \b, high precision 10138>4 beshort x \b, %d-D 10139>6 beshort x \b, %d x 10140>8 beshort x %d 10141>10 beshort x \b, %d channel 10142>10 beshort !1 \bs 10143>80 string >0 \b, "%s" 10144 101450 string IT01 FIT image data 10146>4 belong x \b, %d x 10147>8 belong x %d x 10148>12 belong x %d 10149# 101500 string IT02 FIT image data 10151>4 belong x \b, %d x 10152>8 belong x %d x 10153>12 belong x %d 10154# 101552048 string PCD_IPI Kodak Photo CD image pack file 10156>0xe02 byte&0x03 0x00 , landscape mode 10157>0xe02 byte&0x03 0x01 , portrait mode 10158>0xe02 byte&0x03 0x02 , landscape mode 10159>0xe02 byte&0x03 0x03 , portrait mode 101600 string PCD_OPA Kodak Photo CD overview pack file 10161 10162# FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu> 10163# FITS is the Flexible Image Transport System, the de facto standard for 10164# data and image transfer, storage, etc., for the astronomical community. 10165# (FITS floating point formats are big-endian.) 101660 string SIMPLE\ \ = FITS image data 10167>109 string 8 \b, 8-bit, character or unsigned binary integer 10168>108 string 16 \b, 16-bit, two's complement binary integer 10169>107 string \ 32 \b, 32-bit, two's complement binary integer 10170>107 string -32 \b, 32-bit, floating point, single precision 10171>107 string -64 \b, 64-bit, floating point, double precision 10172 10173# other images 101740 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file 10175 10176# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image 10177# stuff. 10178# 101790 beshort 0x1010 PEX Binary Archive 10180 10181# DICOM medical imaging data 10182128 string DICM DICOM medical imaging data 10183!:mime application/dicom 10184 10185# XWD - X Window Dump file. 10186# As described in /usr/X11R6/include/X11/XWDFile.h 10187# used by the xwd program. 10188# Bradford Castalia, idaeim, 1/01 10189# updated by Adam Buchbinder, 2/09 10190# The following assumes version 7 of the format; the first long is the length 10191# of the header, which is at least 25 4-byte longs, and the one at offset 8 10192# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth, 10193# which is a maximum of 32. 101940 belong >100 10195>8 belong <3 10196>>12 belong <33 10197>>>4 belong 7 XWD X Window Dump image data 10198!:mime image/x-xwindowdump 10199>>>>100 string >\0 \b, "%s" 10200>>>>16 belong x \b, %dx 10201>>>>20 belong x \b%dx 10202>>>>12 belong x \b%d 10203 10204# PDS - Planetary Data System 10205# These files use Parameter Value Language in the header section. 10206# Unfortunately, there is no certain magic, but the following 10207# strings have been found to be most likely. 102080 string NJPL1I00 PDS (JPL) image data 102092 string NJPL1I PDS (JPL) image data 102100 string CCSD3ZF PDS (CCSD) image data 102112 string CCSD3Z PDS (CCSD) image data 102120 string PDS_ PDS image data 102130 string LBLSIZE= PDS (VICAR) image data 10214 10215# pM8x: ATARI STAD compressed bitmap format 10216# 10217# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001 10218# p M 8 5/6 xx yy zz data... 10219# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed. 10220# bytes either run horizontally (pM85) or vertically (pM86). yy is the 10221# most frequent byte, xx and zz are runlength escape codes, where xx is 10222# used for runs of yy. 10223# 102240 string pM85 Atari ST STAD bitmap image data (hor) 10225>5 byte 0x00 (white background) 10226>5 byte 0xFF (black background) 102270 string pM86 Atari ST STAD bitmap image data (vert) 10228>5 byte 0x00 (white background) 10229>5 byte 0xFF (black background) 10230 10231# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu 10232# http://www.atarimax.com/jindroush.atari.org/afmtatr.html 102330 leshort 0x0296 Atari ATR image 10234 10235# XXX: 10236# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other 10237# magic. 10238# SGI RICE image file <mpruett@sgi.com> 10239#0 beshort 0x5249 RICE image 10240#>2 beshort x v%d 10241#>4 beshort x (%d x 10242#>6 beshort x %d) 10243#>8 beshort 0 8 bit 10244#>8 beshort 1 10 bit 10245#>8 beshort 2 12 bit 10246#>8 beshort 3 13 bit 10247#>10 beshort 0 4:2:2 10248#>10 beshort 1 4:2:2:4 10249#>10 beshort 2 4:4:4 10250#>10 beshort 3 4:4:4:4 10251#>12 beshort 1 RGB 10252#>12 beshort 2 CCIR601 10253#>12 beshort 3 RP175 10254#>12 beshort 4 YUV 10255 10256# PCX image files 10257# From: Dan Fandrich <dan@coneharvesters.com> 10258# updated by Joerg Jenderek at Feb 2013 by http://de.wikipedia.org/wiki/PCX 10259# http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt 10260# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000 10261# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT 102620 ubelong&0xffF8fe00 0x0a000000 10263# for PCX bit depth > 0 10264>3 ubyte >0 10265# test for valid versions 10266>>1 ubyte <6 10267>>>1 ubyte !1 PCX 10268!:mime image/x-pcx 10269#!:mime image/pcx 10270>>>>1 ubyte 0 ver. 2.5 image data 10271>>>>1 ubyte 2 ver. 2.8 image data, with palette 10272>>>>1 ubyte 3 ver. 2.8 image data, without palette 10273>>>>1 ubyte 4 for Windows image data 10274>>>>1 ubyte 5 ver. 3.0 image data 10275>>>>4 uleshort x bounding box [%hd, 10276>>>>6 uleshort x %d] - 10277>>>>8 uleshort x [%d, 10278>>>>10 uleshort x %d], 10279>>>>65 ubyte >1 %d planes each of 10280>>>>3 ubyte x %d-bit 10281>>>>68 byte 1 colour, 10282>>>>68 byte 2 grayscale, 10283# this should not happen 10284>>>>68 default x image, 10285>>>>12 leshort >0 %d x 10286>>>>>14 uleshort x %d dpi, 10287>>>>2 byte 0 uncompressed 10288>>>>2 byte 1 RLE compressed 10289 10290# Adobe Photoshop 10291# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 102920 string 8BPS Adobe Photoshop Image 10293!:mime image/vnd.adobe.photoshop 10294>4 beshort 2 (PSB) 10295>18 belong x \b, %d x 10296>14 belong x %d, 10297>24 beshort 0 bitmap 10298>24 beshort 1 grayscale 10299>>12 beshort 2 with alpha 10300>24 beshort 2 indexed 10301>24 beshort 3 RGB 10302>>12 beshort 4 \bA 10303>24 beshort 4 CMYK 10304>>12 beshort 5 \bA 10305>24 beshort 7 multichannel 10306>24 beshort 8 duotone 10307>24 beshort 9 lab 10308>12 beshort > 1 10309>>12 beshort x \b, %dx 10310>12 beshort 1 \b, 10311>22 beshort x %d-bit channel 10312>12 beshort > 1 \bs 10313 10314# XV thumbnail indicator (ThMO) 103150 string P7\ 332 XV thumbnail image data 10316 10317# NITF is defined by United States MIL-STD-2500A 103180 string NITF National Imagery Transmission Format 10319>25 string >\0 dated %.14s 10320 10321# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff) 103220 belong 0x00010008 GEM Image data 10323>12 beshort x %d x 10324>14 beshort x %d, 10325>4 beshort x %d planes, 10326>8 beshort x %d x 10327>10 beshort x %d pixelsize 10328 10329# GEM Metafile (Wolfram Kleff) 103300 lelong 0x0018FFFF GEM Metafile data 10331>4 leshort x version %d 10332 10333# 10334# SMJPEG. A custom Motion JPEG format used by Loki Entertainment 10335# Software Torbjorn Andersson <d91tan@Update.UU.SE>. 10336# 103370 string \0\nSMJPEG SMJPEG 10338>8 belong x %d.x data 10339# According to the specification you could find any number of _TXT 10340# headers here, but I can't think of any way of handling that. None of 10341# the SMJPEG files I tried it on used this feature. Even if such a 10342# file is encountered the output should still be reasonable. 10343>16 string _SND \b, 10344>>24 beshort >0 %d Hz 10345>>26 byte 8 8-bit 10346>>26 byte 16 16-bit 10347>>28 string NONE uncompressed 10348# >>28 string APCM ADPCM compressed 10349>>27 byte 1 mono 10350>>28 byte 2 stereo 10351# Help! Isn't there any way to avoid writing this part twice? 10352>>32 string _VID \b, 10353# >>>48 string JFIF JPEG 10354>>>40 belong >0 %d frames 10355>>>44 beshort >0 (%d x 10356>>>46 beshort >0 %d) 10357>16 string _VID \b, 10358# >>32 string JFIF JPEG 10359>>24 belong >0 %d frames 10360>>28 beshort >0 (%d x 10361>>30 beshort >0 %d) 10362 103630 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File 10364 10365# "thumbnail file" (icon) 10366# descended from "xv", but in use by other applications as well (Wolfram Kleff) 103670 string P7\ 332 XV "thumbnail file" (icon) data 10368 10369# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?) 103700 string KiSS KISS/GS 10371>4 byte 16 color 10372>>5 byte x %d bit 10373>>8 leshort x %d colors 10374>>10 leshort x %d groups 10375>4 byte 32 cell 10376>>5 byte x %d bit 10377>>8 leshort x %d x 10378>>10 leshort x %d 10379>>12 leshort x +%d 10380>>14 leshort x +%d 10381 10382# Webshots (www.webshots.com), by John Harrison 103830 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file 10384 10385# Hercules DASD image files 10386# From Jan Jaeger <jj@septa.nl> 103870 string CKD_P370 Hercules CKD DASD image file 10388>8 long x \b, %d heads per cylinder 10389>12 long x \b, track size %d bytes 10390>16 byte x \b, device type 33%2.2X 10391 103920 string CKD_C370 Hercules compressed CKD DASD image file 10393>8 long x \b, %d heads per cylinder 10394>12 long x \b, track size %d bytes 10395>16 byte x \b, device type 33%2.2X 10396 103970 string CKD_S370 Hercules CKD DASD shadow file 10398>8 long x \b, %d heads per cylinder 10399>12 long x \b, track size %d bytes 10400>16 byte x \b, device type 33%2.2X 10401 10402# Squeak images and programs - etoffi@softhome.net 104030 string \146\031\0\0 Squeak image data 104040 search/1 'From\040Squeak Squeak program text 10405 10406# partimage: file(1) magic for PartImage files (experimental, incomplete) 10407# Author: Hans-Joachim Baader <hjb@pro-linux.de> 104080 string PaRtImAgE-VoLuMe PartImage 10409>0x0020 string 0.6.1 file version %s 10410>>0x0060 lelong >-1 volume %ld 10411#>>0x0064 8 byte identifier 10412#>>0x007c reserved 10413>>0x0200 string >\0 type %s 10414>>0x1400 string >\0 device %s, 10415>>0x1600 string >\0 original filename %s, 10416# Some fields omitted 10417>>0x2744 lelong 0 not compressed 10418>>0x2744 lelong 1 gzip compressed 10419>>0x2744 lelong 2 bzip2 compressed 10420>>0x2744 lelong >2 compressed with unknown algorithm 10421>0x0020 string >0.6.1 file version %s 10422>0x0020 string <0.6.1 file version %s 10423 10424# DCX is multi-page PCX, using a simple header of up to 1024 10425# offsets for the respective PCX components. 10426# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de> 104270 lelong 987654321 DCX multi-page PCX image data 10428 10429# Simon Walton <simonw@matteworld.com> 10430# Kodak Cineon format for scanned negatives 10431# http://www.kodak.com/US/en/motion/support/dlad/ 104320 lelong 0xd75f2a80 Cineon image data 10433>200 belong >0 \b, %ld x 10434>204 belong >0 %ld 10435 10436 10437# Bio-Rad .PIC is an image format used by microscope control systems 10438# and related image processing software used by biologists. 10439# From: Vebjorn Ljosa <vebjorn@ljosa.com> 10440# BOOL values are two-byte integers; use them to rule out false positives. 10441# http://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt 10442# Samples: http://www.loci.wisc.edu/software/sample-data 1044314 leshort <2 10444>62 leshort <2 10445>>54 leshort 12345 Bio-Rad .PIC Image File 10446>>>0 leshort >0 %hd x 10447>>>2 leshort >0 %hd, 10448>>>4 leshort =1 1 image in file 10449>>>4 leshort >1 %hd images in file 10450 10451# From Jan "Yenya" Kasprzak <kas@fi.muni.cz> 10452# The description of *.mrw format can be found at 10453# http://www.dalibor.cz/minolta/raw_file_format.htm 104540 string \000MRM Minolta Dimage camera raw image data 10455 10456# Summary: DjVu image / document 10457# Extension: .djvu 10458# Reference: http://djvu.org/docs/DjVu3Spec.djvu 10459# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr> 10460# Modified by (1): Abel Cheung <abelcheung@gmail.com> 104610 string AT&TFORM 10462>12 string DJVM DjVu multiple page document 10463!:mime image/vnd.djvu 10464>12 string DJVU DjVu image or single page document 10465!:mime image/vnd.djvu 10466>12 string DJVI DjVu shared document 10467!:mime image/vnd.djvu 10468>12 string THUM DjVu page thumbnails 10469!:mime image/vnd.djvu 10470 10471# Originally by Marc Espie 10472# Modified by Robert Minsk <robertminsk at yahoo.com> 10473# http://www.openexr.com/openexrfilelayout.pdf 104740 lelong 20000630 OpenEXR image data, 10475!:mime image/x-exr 10476>4 lelong&0x000000ff x version %d, 10477>4 lelong ^0x00000200 storage: scanline 10478>4 lelong &0x00000200 storage: tiled 10479>8 search/0x1000 compression\0 \b, compression: 10480>>&16 byte 0 none 10481>>&16 byte 1 rle 10482>>&16 byte 2 zips 10483>>&16 byte 3 zip 10484>>&16 byte 4 piz 10485>>&16 byte 5 pxr24 10486>>&16 byte 6 b44 10487>>&16 byte 7 b44a 10488>>&16 byte >7 unknown 10489>8 search/0x1000 dataWindow\0 \b, dataWindow: 10490>>&10 lelong x (%d 10491>>&14 lelong x %d)- 10492>>&18 lelong x \b(%d 10493>>&22 lelong x %d) 10494>8 search/0x1000 displayWindow\0 \b, displayWindow: 10495>>&10 lelong x (%d 10496>>&14 lelong x %d)- 10497>>&18 lelong x \b(%d 10498>>&22 lelong x %d) 10499>8 search/0x1000 lineOrder\0 \b, lineOrder: 10500>>&14 byte 0 increasing y 10501>>&14 byte 1 decreasing y 10502>>&14 byte 2 random y 10503>>&14 byte >2 unknown 10504 10505# SMPTE Digital Picture Exchange Format, SMPTE DPX 10506# 10507# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital 10508# Moving-Picture Exchange (DPX), v1.0, 18 February 1994 10509# Robert Minsk <robertminsk at yahoo.com> 105100 string SDPX DPX image data, big-endian, 10511!:mime image/x-dpx 10512>768 beshort <4 10513>>772 belong x %dx 10514>>776 belong x \b%d, 10515>768 beshort >3 10516>>776 belong x %dx 10517>>772 belong x \b%d, 10518>768 beshort 0 left to right/top to bottom 10519>768 beshort 1 right to left/top to bottom 10520>768 beshort 2 left to right/bottom to top 10521>768 beshort 3 right to left/bottom to top 10522>768 beshort 4 top to bottom/left to right 10523>768 beshort 5 top to bottom/right to left 10524>768 leshort 6 bottom to top/left to right 10525>768 leshort 7 bottom to top/right to left 10526 10527# From: Tom Hilinski <tom.hilinski@comcast.net> 10528# http://www.unidata.ucar.edu/packages/netcdf/ 105290 string CDF\001 NetCDF Data Format data 10530 10531#----------------------------------------------------------------------- 10532# Hierarchical Data Format, used to facilitate scientific data exchange 10533# specifications at http://hdf.ncsa.uiuc.edu/ 105340 belong 0x0e031301 Hierarchical Data Format (version 4) data 10535!:mime application/x-hdf 105360 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) data 10537!:mime application/x-hdf 10538 10539# From: Tobias Burnus <burnus@net-b.de> 10540# Xara (for a while: Corel Xara) is a graphic package, see 10541# http://www.xara.com/ for Windows and as GPL application for Linux 105420 string XARA\243\243 Xara graphics file 10543 10544# http://www.cartesianinc.com/Tech/ 105450 string CPC\262 Cartesian Perceptual Compression image 10546!:mime image/x-cpi 10547 10548# From Albert Cahalan <acahalan@gmail.com> 10549# puredigital used it for the CVS disposable camcorder 10550#8 lelong 4 ZBM bitmap image data 10551#>4 leshort x %u x 10552#>6 leshort x %u 10553 10554# From Albert Cahalan <acahalan@gmail.com> 10555# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons 105560 string C565 OLPC firmware icon image data 10557>4 leshort x %u x 10558>6 leshort x %u 10559 10560# Applied Images - Image files from Cytovision 10561# Gustavo Junior Alves <gjalves@gjalves.com.br> 105620 string \xce\xda\xde\xfa Cytovision Metaphases file 105630 string \xed\xad\xef\xac Cytovision Karyotype file 105640 string \x0b\x00\x03\x00 Cytovision FISH Probe file 105650 string \xed\xfe\xda\xbe Cytovision FLEX file 105660 string \xed\xab\xed\xfe Cytovision FLEX file 105670 string \xad\xfd\xea\xad Cytovision RATS file 10568 10569# Wavelet Scalar Quantization format used in gray-scale fingerprint images 10570# From Tano M Fotang <mfotang@quanteq.com> 105710 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data 10572 10573# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches 10574# From: Markus Heidelberg <markus.heidelberg at web.de> 105750 string/t [BitmapInfo2] Polar Monitor Bitmap text 10576!:mime image/x-polar-monitor-bitmap 10577 10578# From: Rick Richardson <rick.richardson@comcast.net> 105790 string GARMIN\ BITMAP\ 01 Garmin Bitmap file 10580 10581# Type: Ulead Photo Explorer5 (.pe5) 10582# URL: http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese) 10583# From: Simon Horman <horms@debian.org> 105840 string IIO2H Ulead Photo Explorer5 10585 10586# Type: X11 cursor 10587# URL: http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup 10588# From: Mathias Brodala <info@noctus.net> 105890 string Xcur X11 cursor 10590 10591# Type: Olympus ORF raw images. 10592# URL: http://libopenraw.freedesktop.org/wiki/Olympus_ORF 10593# From: Adam Buchbinder <adam.buchbinder@gmail.com> 105940 string MMOR Olympus ORF raw image data, big-endian 10595!:mime image/x-olympus-orf 105960 string IIRO Olympus ORF raw image data, little-endian 10597!:mime image/x-olympus-orf 105980 string IIRS Olympus ORF raw image data, little-endian 10599!:mime image/x-olympus-orf 10600 10601# Type: files used in modern AVCHD camcoders to store clip information 10602# Extension: .cpi 10603# From: Alexander Danilov <alexander.a.danilov@gmail.com> 106040 string HDMV0100 AVCHD Clip Information 10605 10606# From: Adam Buchbinder <adam.buchbinder@gmail.com> 10607# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/ 10608# Radiance HDR; usually has .pic or .hdr extension. 106090 string #?RADIANCE\n Radiance HDR image data 10610#!mime image/vnd.radiance 10611 10612# From: Adam Buchbinder <adam.buchbinder@gmail.com> 10613# URL: http://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf 10614# Used by the pfstools packages. The regex matches for the image size could 10615# probably use some work. The MIME type is made up; if there's one in 10616# actual common use, it should replace the one below. 106170 string PFS1\x0a PFS HDR image data 10618#!mime image/x-pfs 10619>1 regex [0-9]*\ \b, %s 10620>>1 regex \ [0-9]{4} \bx%s 10621 10622# Type: Foveon X3F 10623# URL: http://www.photofo.com/downloads/x3f-raw-format.pdf 10624# From: Adam Buchbinder <adam.buchbinder@gmail.com> 10625# Note that the MIME type isn't defined anywhere that I can find; if 10626# there's a canonical type for this format, it should replace this one. 106270 string FOVb Foveon X3F raw image data 10628!:mime image/x-x3f 10629>6 leshort x \b, version %d. 10630>4 leshort x \b%d 10631>28 lelong x \b, %dx 10632>32 lelong x \b%d 10633 10634# Paint.NET file 10635# From Adam Buchbinder <adam.buchbinder@gmail.com> 106360 string PDN3 Paint.NET image data 10637!:mime image/x-paintnet 10638 10639# Not really an image. 10640# From: "Tano M. Fotang" <mfotang@quanteq.com> 106410 string \x46\x4d\x52\x00 ISO/IEC 19794-2 Format Minutiae Record (FMR) 10642 10643#------------------------------------------------------------------------------ 10644# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $ 10645# inform: file(1) magic for Inform interactive fiction language 10646 10647# URL: http://www.inform-fiction.org/ 10648# From: Reuben Thomas <rrt@sc3d.org> 10649 106500 search/100/cW constant\ story Inform source text 10651 10652#------------------------------------------------------------------------------ 10653# $File: intel,v 1.11 2013/02/06 14:18:52 christos Exp $ 10654# intel: file(1) magic for x86 Unix 10655# 10656# Various flavors of x86 UNIX executable/object (other than Xenix, which 10657# is in "microsoft"). DOS is in "msdos"; the ambitious soul can do 10658# Windows as well. 10659# 10660# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and 10661# whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere 10662# as well, if, as, and when IBM makes it portable. 10663# 10664# The `versions' should be un-commented if they work for you. 10665# (Was the problem just one of endianness?) 10666# 106670 leshort 0502 basic-16 executable 10668>12 lelong >0 not stripped 10669#>22 leshort >0 - version %ld 106700 leshort 0503 basic-16 executable (TV) 10671>12 lelong >0 not stripped 10672#>22 leshort >0 - version %ld 106730 leshort 0510 x86 executable 10674>12 lelong >0 not stripped 106750 leshort 0511 x86 executable (TV) 10676>12 lelong >0 not stripped 106770 leshort =0512 iAPX 286 executable small model (COFF) 10678>12 lelong >0 not stripped 10679#>22 leshort >0 - version %ld 106800 leshort =0522 iAPX 286 executable large model (COFF) 10681>12 lelong >0 not stripped 10682#>22 leshort >0 - version %ld 10683# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan 106840 leshort =0514 80386 COFF executable 10685>12 lelong >0 not stripped 10686>22 leshort >0 - version %ld 10687 10688# rom: file(1) magic for BIOS ROM Extensions found in intel machines 10689# mapped into memory between 0xC0000 and 0xFFFFF 10690# From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu 106910 beshort 0x55AA BIOS (ia32) ROM Ext. 10692>5 string USB USB 10693>7 string LDR UNDI image 10694>30 string IBM IBM comp. Video 10695>26 string Adaptec Adaptec 10696>28 string Adaptec Adaptec 10697>42 string PROMISE Promise 10698>2 byte x (%d*512) 10699 10700# Flash descriptors for Intel SPI flash roms. 10701# From Dr. Jesus <j@hug.gs> 107020 lelong 0x0ff0a55a Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step 1070316 lelong 0x0ff0a55a Intel serial flash for PCH ROM 10704 10705#------------------------------------------------------------------------------ 10706# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $ 10707# interleaf: file(1) magic for InterLeaf TPS: 10708# 107090 string =\210OPS Interleaf saved data 107100 string =<!OPS Interleaf document text 10711>5 string ,\ Version\ = \b, version 10712>>17 string >\0 %.3s 10713 10714#------------------------------------------------------------------------------ 10715# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $ 10716# island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1 10717# "/etc/magic": 10718# From: guy@netapp.com (Guy Harris) 10719# 107204 string pgscriptver IslandWrite document 1072113 string DrawFile IslandDraw document 10722 10723 10724#------------------------------------------------------------------------------ 10725# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $ 10726# ispell: file(1) magic for ispell 10727# 10728# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic 10729# will match 0x9600 through 0x9603 in *both* little endian and big endian. 10730# (No other current magic entries collide.) 10731# 10732# Updated by Daniel Quinlan (quinlan@yggdrasil.com) 10733# 107340 leshort&0xFFFC 0x9600 little endian ispell 10735>0 byte 0 hash file (?), 10736>0 byte 1 3.0 hash file, 10737>0 byte 2 3.1 hash file, 10738>0 byte 3 hash file (?), 10739>2 leshort 0x00 8-bit, no capitalization, 26 flags 10740>2 leshort 0x01 7-bit, no capitalization, 26 flags 10741>2 leshort 0x02 8-bit, capitalization, 26 flags 10742>2 leshort 0x03 7-bit, capitalization, 26 flags 10743>2 leshort 0x04 8-bit, no capitalization, 52 flags 10744>2 leshort 0x05 7-bit, no capitalization, 52 flags 10745>2 leshort 0x06 8-bit, capitalization, 52 flags 10746>2 leshort 0x07 7-bit, capitalization, 52 flags 10747>2 leshort 0x08 8-bit, no capitalization, 128 flags 10748>2 leshort 0x09 7-bit, no capitalization, 128 flags 10749>2 leshort 0x0A 8-bit, capitalization, 128 flags 10750>2 leshort 0x0B 7-bit, capitalization, 128 flags 10751>2 leshort 0x0C 8-bit, no capitalization, 256 flags 10752>2 leshort 0x0D 7-bit, no capitalization, 256 flags 10753>2 leshort 0x0E 8-bit, capitalization, 256 flags 10754>2 leshort 0x0F 7-bit, capitalization, 256 flags 10755>4 leshort >0 and %d string characters 107560 beshort&0xFFFC 0x9600 big endian ispell 10757>1 byte 0 hash file (?), 10758>1 byte 1 3.0 hash file, 10759>1 byte 2 3.1 hash file, 10760>1 byte 3 hash file (?), 10761>2 beshort 0x00 8-bit, no capitalization, 26 flags 10762>2 beshort 0x01 7-bit, no capitalization, 26 flags 10763>2 beshort 0x02 8-bit, capitalization, 26 flags 10764>2 beshort 0x03 7-bit, capitalization, 26 flags 10765>2 beshort 0x04 8-bit, no capitalization, 52 flags 10766>2 beshort 0x05 7-bit, no capitalization, 52 flags 10767>2 beshort 0x06 8-bit, capitalization, 52 flags 10768>2 beshort 0x07 7-bit, capitalization, 52 flags 10769>2 beshort 0x08 8-bit, no capitalization, 128 flags 10770>2 beshort 0x09 7-bit, no capitalization, 128 flags 10771>2 beshort 0x0A 8-bit, capitalization, 128 flags 10772>2 beshort 0x0B 7-bit, capitalization, 128 flags 10773>2 beshort 0x0C 8-bit, no capitalization, 256 flags 10774>2 beshort 0x0D 7-bit, no capitalization, 256 flags 10775>2 beshort 0x0E 8-bit, capitalization, 256 flags 10776>2 beshort 0x0F 7-bit, capitalization, 256 flags 10777>4 beshort >0 and %d string characters 10778# ispell 4.0 hash files kromJx <kromJx@crosswinds.net> 10779# Ispell 4.0 107800 string ISPL ispell 10781>4 long x hash file version %d, 10782>8 long x lexletters %d, 10783>12 long x lexsize %d, 10784>16 long x hashsize %d, 10785>20 long x stblsize %d 10786 10787#------------------------------------------------------------------------------ 10788# $File: isz,v 1.1 2010/03/27 16:17:09 christos Exp $ 10789# ISO Zipped file format 10790# http://www.ezbsystems.com/isz/iszspec.txt 107910 string IsZ! ISO Zipped file 10792>4 byte x \b, header size %u 10793>5 byte x \b, version %u 10794>8 lelong x \b, serial %u 10795#12 leshort x \b, sector size %u 10796#>16 lelong x \b, total sectors %u 10797>17 byte >0 \b, password protected 10798#>24 lequad x \b, segment size %llu 10799#>32 lelong x \b, blocks %u 10800#>36 lelong x \b, block size %u 10801 10802#------------------------------------------------------------ 10803# $File: java,v 1.14 2013/02/08 16:54:45 christos Exp $ 10804# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the 10805# same magic number, 0xcafebabe, so they are both handled 10806# in the entry called "cafebabe". 10807#------------------------------------------------------------ 10808# Java serialization 10809# From Martin Pool (m.pool@pharos.com.au) 108100 beshort 0xaced Java serialization data 10811>2 beshort >0x0004 \b, version %d 10812 108130 belong 0xfeedfeed Java KeyStore 10814!:mime application/x-java-keystore 108150 belong 0xcececece Java JCE KeyStore 10816!:mime application/x-java-jce-keystore 10817 10818# Dalvik .dex format. http://retrodev.com/android/dexformat.html 10819# From <mkf@google.com> "Mike Fleming" 108200 string dex\n 10821>0 regex dex\n[0-9][0-9][0-9]\0 Dalvik dex file 10822>4 string >000 version %s 108230 string dey\n 10824>0 regex dey\n[0-9][0-9][0-9]\0 Dalvik dex file (optimized for host) 10825>4 string >000 version %s 10826 10827# Java source 108280 regex ^import.*;$ Java source 10829!:mime text/x-java 10830 10831# http://android.stackexchange.com/questions/23357/\ 10832# is-there-a-way-to-look-inside-and-modify-an-adb-backup-created-file/\ 10833# 23608#23608 108340 string ANDROID\040BACKUP\n Android Backup 10835>15 string 1\n \b, version 1 10836>17 string 0\n \b, uncompressed 10837>17 string 1\n \b, compressed 10838>19 string none\n \b, unencrypted 10839>19 string AES-256\n \b, encrypted AES-256 10840 10841#------------------------------------------------------------------------------ 10842# $File: javascript,v 1.1 2012/06/16 13:30:36 christos Exp $ 10843# javascript: magic for javascript and node.js scripts. 10844# 108450 search/1/w #!/bin/node Node.js script text executable 10846!:mime application/javascript 108470 search/1/w #!/usr/bin/node Node.js script text executable 10848!:mime application/javascript 108490 search/1/w #!/bin/nodejs Node.js script text executable 10850!:mime application/javascript 108510 search/1/w #!/usr/bin/nodejs Node.js script text executable 10852!:mime application/javascript 108530 search/1 #!/usr/bin/env\ node Node.js script text executable 10854!:mime application/javascript 108550 search/1 #!/usr/bin/env\ nodejs Node.js script text executable 10856!:mime application/javascript 10857 10858#------------------------------------------------------------------------------ 10859# $File: jpeg,v 1.19 2013/02/04 15:50:03 christos Exp $ 10860# JPEG images 10861# SunOS 5.5.1 had 10862# 10863# 0 string \377\330\377\340 JPEG file 10864# 0 string \377\330\377\356 JPG file 10865# 10866# both of which turn into "JPEG image data" here. 10867# 108680 beshort 0xffd8 JPEG image data 10869!:mime image/jpeg 10870!:apple 8BIMJPEG 10871!:strength +2 10872>6 string JFIF \b, JFIF standard 10873# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06 10874# in a vain attempt to add image size reporting for JFIF. Note that these 10875# tests are not fool-proof since some perfectly valid JPEGs are currently 10876# impossible to specify in magic(4) format. 10877# First, a little JFIF version info: 10878>>11 byte x \b %d. 10879>>12 byte x \b%02d 10880# Next, the resolution or aspect ratio of the image: 10881#>>13 byte 0 \b, aspect ratio 10882#>>13 byte 1 \b, resolution (DPI) 10883#>>13 byte 2 \b, resolution (DPCM) 10884#>>4 beshort x \b, segment length %d 10885# Next, show thumbnail info, if it exists: 10886>>18 byte !0 \b, thumbnail %dx 10887>>>19 byte x \b%d 10888 10889# EXIF moved down here to avoid reporting a bogus version number, 10890# and EXIF version number printing added. 10891# - Patrik R=E5dman <patrik+file-magic@iki.fi> 10892>6 string Exif \b, EXIF standard 10893# Look for EXIF IFD offset in IFD 0, and then look for EXIF version tag in EXIF IFD. 10894# All possible combinations of entries have to be enumerated, since no looping 10895# is possible. And both endians are possible... 10896# The combinations included below are from real-world JPEGs. 10897# Little-endian 10898>>12 string II 10899# IFD 0 Entry #5: 10900>>>70 leshort 0x8769 10901# EXIF IFD Entry #1: 10902>>>>(78.l+14) leshort 0x9000 10903>>>>>(78.l+23) byte x %c 10904>>>>>(78.l+24) byte x \b.%c 10905>>>>>(78.l+25) byte !0x30 \b%c 10906# IFD 0 Entry #9: 10907>>>118 leshort 0x8769 10908# EXIF IFD Entry #3: 10909>>>>(126.l+38) leshort 0x9000 10910>>>>>(126.l+47) byte x %c 10911>>>>>(126.l+48) byte x \b.%c 10912>>>>>(126.l+49) byte !0x30 \b%c 10913# IFD 0 Entry #10 10914>>>130 leshort 0x8769 10915# EXIF IFD Entry #3: 10916>>>>(138.l+38) leshort 0x9000 10917>>>>>(138.l+47) byte x %c 10918>>>>>(138.l+48) byte x \b.%c 10919>>>>>(138.l+49) byte !0x30 \b%c 10920# EXIF IFD Entry #4: 10921>>>>(138.l+50) leshort 0x9000 10922>>>>>(138.l+59) byte x %c 10923>>>>>(138.l+60) byte x \b.%c 10924>>>>>(138.l+61) byte !0x30 \b%c 10925# EXIF IFD Entry #5: 10926>>>>(138.l+62) leshort 0x9000 10927>>>>>(138.l+71) byte x %c 10928>>>>>(138.l+72) byte x \b.%c 10929>>>>>(138.l+73) byte !0x30 \b%c 10930# IFD 0 Entry #11 10931>>>142 leshort 0x8769 10932# EXIF IFD Entry #3: 10933>>>>(150.l+38) leshort 0x9000 10934>>>>>(150.l+47) byte x %c 10935>>>>>(150.l+48) byte x \b.%c 10936>>>>>(150.l+49) byte !0x30 \b%c 10937# EXIF IFD Entry #4: 10938>>>>(150.l+50) leshort 0x9000 10939>>>>>(150.l+59) byte x %c 10940>>>>>(150.l+60) byte x \b.%c 10941>>>>>(150.l+61) byte !0x30 \b%c 10942# EXIF IFD Entry #5: 10943>>>>(150.l+62) leshort 0x9000 10944>>>>>(150.l+71) byte x %c 10945>>>>>(150.l+72) byte x \b.%c 10946>>>>>(150.l+73) byte !0x30 \b%c 10947# Big-endian 10948>>12 string MM 10949# IFD 0 Entry #9: 10950>>>118 beshort 0x8769 10951# EXIF IFD Entry #1: 10952>>>>(126.L+14) beshort 0x9000 10953>>>>>(126.L+23) byte x %c 10954>>>>>(126.L+24) byte x \b.%c 10955>>>>>(126.L+25) byte !0x30 \b%c 10956# EXIF IFD Entry #3: 10957>>>>(126.L+38) beshort 0x9000 10958>>>>>(126.L+47) byte x %c 10959>>>>>(126.L+48) byte x \b.%c 10960>>>>>(126.L+49) byte !0x30 \b%c 10961# IFD 0 Entry #10 10962>>>130 beshort 0x8769 10963# EXIF IFD Entry #3: 10964>>>>(138.L+38) beshort 0x9000 10965>>>>>(138.L+47) byte x %c 10966>>>>>(138.L+48) byte x \b.%c 10967>>>>>(138.L+49) byte !0x30 \b%c 10968# EXIF IFD Entry #5: 10969>>>>(138.L+62) beshort 0x9000 10970>>>>>(138.L+71) byte x %c 10971>>>>>(138.L+72) byte x \b.%c 10972>>>>>(138.L+73) byte !0x30 \b%c 10973# IFD 0 Entry #11 10974>>>142 beshort 0x8769 10975# EXIF IFD Entry #4: 10976>>>>(150.L+50) beshort 0x9000 10977>>>>>(150.L+59) byte x %c 10978>>>>>(150.L+60) byte x \b.%c 10979>>>>>(150.L+61) byte !0x30 \b%c 10980# Here things get sticky. We can do ONE MORE marker segment with 10981# indirect addressing, and that's all. It would be great if we could 10982# do pointer arithemetic like in an assembler language. Christos? 10983# And if there was some sort of looping construct to do searches, plus a few 10984# named accumulators, it would be even more effective... 10985# At least we can show a comment if no other segments got inserted before: 10986>(4.S+5) byte 0xFE \b, comment: 10987>>(4.S+6) pstring/HJ x "%s" 10988# Or, we can show the encoding type (I've included only the three most common) 10989# and image dimensions if we are lucky and the SOFn (image segment) is here: 10990>(4.S+5) byte 0xC0 \b, baseline 10991>>(4.S+6) byte x \b, precision %d 10992>>(4.S+7) beshort x \b, %dx 10993>>(4.S+9) beshort x \b%d 10994>(4.S+5) byte 0xC1 \b, extended sequential 10995>>(4.S+6) byte x \b, precision %d 10996>>(4.S+7) beshort x \b, %dx 10997>>(4.S+9) beshort x \b%d 10998>(4.S+5) byte 0xC2 \b, progressive 10999>>(4.S+6) byte x \b, precision %d 11000>>(4.S+7) beshort x \b, %dx 11001>>(4.S+9) beshort x \b%d 11002# I've commented-out quantisation table reporting. I doubt anyone cares yet. 11003#>(4.S+5) byte 0xDB \b, quantisation table 11004#>>(4.S+6) beshort x \b length=%d 11005#>14 beshort x \b, %d x 11006#>16 beshort x \b %d 11007 11008# HSI is Handmade Software's proprietary JPEG encoding scheme 110090 string hsi1 JPEG image data, HSI proprietary 11010 11011# From: David Santinoli <david@santinoli.com> 110120 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 11013# From: Johan van der Knijff <johan.vanderknijff@kb.nl> 11014# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes 11015# https://github.com/bitsgalore/jp2kMagic 11016# 11017# Now read value of 'Brand' field, which yields a few possibilities: 11018>20 string \x6a\x70\x32\x20 Part 1 (JP2) 11019!:mime image/jp2 11020>20 string \x6a\x70\x78\x20 Part 2 (JPX) 11021!:mime image/jpx 11022>20 string \x6a\x70\x6d\x20 Part 6 (JPM) 11023!:mime image/jpm 11024>20 string \x6d\x6a\x70\x32 Part 3 (MJ2) 11025!:mime video/mj2 11026 11027# Type: JPEG 2000 codesream 11028# From: Mathieu Malaterre <mathieu.malaterre@gmail.com> 110290 belong 0xff4fff51 JPEG 2000 codestream 1103045 beshort 0xff52 11031 11032#------------------------------------------------------------------------------ 11033# $File: karma,v 1.6 2009/09/19 16:28:10 christos Exp $ 11034# karma: file(1) magic for Karma data files 11035# 11036# From <rgooch@atnf.csiro.au> 11037 110380 string KarmaRHD Version Karma Data Structure Version 11039>16 belong x %lu 11040 11041#------------------------------------------------------------------------------ 11042# $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $ 11043# kde: file(1) magic for KDE 11044 110450 string/t [KDE\ Desktop\ Entry] KDE desktop entry 11046!:mime application/x-kdelnk 110470 string/t #\ KDE\ Config\ File KDE config file 11048!:mime application/x-kdelnk 110490 string/t #\ xmcd xmcd database file for kscd 11050!:mime text/x-xmcd 11051 11052#------------------------------------------------------------------------------ 11053# $File: keepass,v 1.1 2012/12/24 22:14:56 christos Exp $ 11054# keepass: file(1) magic for KeePass file 11055# 11056# Keepass Password Safe: 11057# * original one: http://keepass.info/ 11058# * *nix port: http://www.keepassx.org/ 11059# * android port: http://code.google.com/p/keepassdroid/ 11060 110610 lelong 0x9AA2D903 Keepass password database 11062>4 lelong 0xB54BFB65 1.x KDB 11063>>48 lelong >0 \b, %d groups 11064>>52 lelong >0 \b, %d entries 11065>>8 lelong&0x0f 1 \b, SHA-256 11066>>8 lelong&0x0f 2 \b, AES 11067>>8 lelong&0x0f 4 \b, RC4 11068>>8 lelong&0x0f 8 \b, Twofish 11069>>120 lelong >0 \b, %d key transformation rounds 11070>4 lelong 0xB54BFB67 2.x KDBX 11071 11072#------------------------------------------------------------------------------ 11073# $File: kml,v 1.3 2010/11/25 15:00:12 christos Exp $ 11074# Type: Google KML, formerly Keyhole Markup Language 11075# Future development of this format has been handed 11076# over to the Open Geospatial Consortium. 11077# http://www.opengeospatial.org/standards/kml/ 11078# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 110790 string/t \<?xml 11080>20 search/400 \ xmlns= 11081>>&0 regex ['"]http://earth.google.com/kml Google KML document 11082!:mime application/vnd.google-earth.kml+xml 11083>>>&1 string 2.0' \b, version 2.0 11084>>>&1 string 2.1' \b, version 2.1 11085>>>&1 string 2.2' \b, version 2.2 11086 11087#------------------------------------------------------------------------------ 11088# Type: OpenGIS KML, formerly Keyhole Markup Language 11089# This standard is maintained by the 11090# Open Geospatial Consortium. 11091# http://www.opengeospatial.org/standards/kml/ 11092# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 11093>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document 11094!:mime application/vnd.google-earth.kml+xml 11095>>>&1 string/t 2.2 \b, version 2.2 11096 11097#------------------------------------------------------------------------------ 11098# Type: Google KML Archive (ZIP based) 11099# http://code.google.com/apis/kml/documentation/kml_tut.html 11100# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 111010 string PK\003\004 11102>4 byte 0x14 11103>>30 string doc.kml Compressed Google KML Document, including resources. 11104!:mime application/vnd.google-earth.kmz 11105 11106#------------------------------------------------------------------------------ 11107# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $ 11108# DEC SRC Virtual Paper: Lectern files 11109# Karl M. Hegbloom <karlheg@inetarena.com> 111100 string lect DEC SRC Virtual Paper Lectern file 11111 11112#------------------------------------------------------------------------------ 11113# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $ 11114# lex: file(1) magic for lex 11115# 11116# derived empirically, your offsets may vary! 111170 search/100 yyprevious C program text (from lex) 11118>3 search/1 >\0 for %s 11119# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com> 111200 search/100 generated\ by\ flex C program text (from flex) 11121# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com> 111220 search/1 %{ lex description text 11123 11124#------------------------------------------------------------------------------ 11125# $File: lif,v 1.8 2009/09/19 16:28:10 christos Exp $ 11126# lif: file(1) magic for lif 11127# 11128# (Daniel Quinlan <quinlan@yggdrasil.com>) 11129# 111300 beshort 0x8000 lif file 11131 11132#------------------------------------------------------------------------------ 11133# $File: linux,v 1.47 2013/02/06 14:18:52 christos Exp $ 11134# linux: file(1) magic for Linux files 11135# 11136# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> 11137# The following basic Linux magic is useful for reference, but using 11138# "long" magic is a better practice in order to avoid collisions. 11139# 11140# 2 leshort 100 Linux/i386 11141# >0 leshort 0407 impure executable (OMAGIC) 11142# >0 leshort 0410 pure executable (NMAGIC) 11143# >0 leshort 0413 demand-paged executable (ZMAGIC) 11144# >0 leshort 0314 demand-paged executable (QMAGIC) 11145# 111460 lelong 0x00640107 Linux/i386 impure executable (OMAGIC) 11147>16 lelong 0 \b, stripped 111480 lelong 0x00640108 Linux/i386 pure executable (NMAGIC) 11149>16 lelong 0 \b, stripped 111500 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC) 11151>16 lelong 0 \b, stripped 111520 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC) 11153>16 lelong 0 \b, stripped 11154# 111550 string \007\001\000 Linux/i386 object file 11156>20 lelong >0x1020 \b, DLL library 11157# Linux-8086 stuff: 111580 string \01\03\020\04 Linux-8086 impure executable 11159>28 long !0 not stripped 111600 string \01\03\040\04 Linux-8086 executable 11161>28 long !0 not stripped 11162# 111630 string \243\206\001\0 Linux-8086 object file 11164# 111650 string \01\03\020\20 Minix-386 impure executable 11166>28 long !0 not stripped 111670 string \01\03\040\20 Minix-386 executable 11168>28 long !0 not stripped 111690 string \01\03\04\20 Minix-386 NSYM/GNU executable 11170>28 long !0 not stripped 11171# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov> 11172216 lelong 0421 Linux/i386 core file 11173>220 string >\0 of '%s' 11174>200 lelong >0 (signal %d) 11175# 11176# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com> 11177# this can be overridden by the DOS executable (COM) entry 111782 string LILO Linux/i386 LILO boot/chain loader 11179# 11180# Linux make config build file, from Ole Aamot <oka@oka.no> 1118128 string make\ config Linux make config build file 11182# 11183# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> 11184# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 11185# See: http://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html 111860 leshort 0x0436 Linux/i386 PC Screen Font v1 data, 11187>2 byte&0x01 0 256 characters, 11188>2 byte&0x01 !0 512 characters, 11189>2 byte&0x02 0 no directory, 11190>2 byte&0x02 !0 Unicode directory, 11191>3 byte >0 8x%d 111920 string \x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data, 11193>16 lelong x %d characters, 11194>12 lelong&0x01 0 no directory, 11195>12 lelong&0x01 !0 Unicode directory, 11196>24 lelong x %d 11197>28 lelong x \bx%d 11198 11199# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com> 112004086 string SWAP-SPACE Linux/i386 swap file 11201# From: Jeff Bailey <jbailey@ubuntu.com> 11202# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com> 112034076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image 11204# From: James Hunt <james.hunt@ubuntu.com> 112054076 string SWAPSPACE2LINHIB0001 Linux/i386 swap file (new style) (compressed hibernate) 11206# according to man page of mkswap (8) March 1999 11207# volume label and UUID Russell Coker 11208# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 112094086 string SWAPSPACE2 Linux/i386 swap file (new style), 11210>0x400 long x version %d (4K pages), 11211>0x404 long x size %d pages, 11212>1052 string \0 no label, 11213>1052 string >\0 LABEL=%s, 11214>0x40c belong x UUID=%08x 11215>0x410 beshort x \b-%04x 11216>0x412 beshort x \b-%04x 11217>0x414 beshort x \b-%04x 11218>0x416 belong x \b-%08x 11219>0x41a beshort x \b%04x 11220# From Daniel Novotny <dnovotny@redhat.com> 11221# swap file for PowerPC 1122265526 string SWAPSPACE2 Linux/ppc swap file 1122316374 string SWAPSPACE2 Linux/ia64 swap file 11224# 11225# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu> 11226# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de> 11227# and Nicolas Lichtmaier <nick@debian.org> 11228# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 11229# Linux kernel boot images (i386 arch) (Wolfram Kleff) 11230514 string HdrS Linux kernel 11231!:strength + 5 11232>510 leshort 0xAA55 x86 boot executable 11233>>518 leshort >0x1ff 11234>>>529 byte 0 zImage, 11235>>>529 byte 1 bzImage, 11236>>>(526.s+0x200) string >\0 version %s, 11237>>498 leshort 1 RO-rootFS, 11238>>498 leshort 0 RW-rootFS, 11239>>508 leshort >0 root_dev 0x%X, 11240>>502 leshort >0 swap_dev 0x%X, 11241>>504 leshort >0 RAMdisksize %u KB, 11242>>506 leshort 0xFFFF Normal VGA 11243>>506 leshort 0xFFFE Extended VGA 11244>>506 leshort 0xFFFD Prompt for Videomode 11245>>506 leshort >0 Video mode %d 11246# This also matches new kernels, which were caught above by "HdrS". 112470 belong 0xb8c0078e Linux kernel 11248>0x1e3 string Loading version 1.3.79 or older 11249>0x1e9 string Loading from prehistoric times 11250 11251# System.map files - Nicolas Lichtmaier <nick@debian.org> 112528 search/1 \ A\ _text Linux kernel symbol map text 11253 11254# LSM entries - Nicolas Lichtmaier <nick@debian.org> 112550 search/1 Begin3 Linux Software Map entry text 112560 search/1 Begin4 Linux Software Map entry text (new format) 11257 11258# From Matt Zimmerman, enhanced for v3 by Matthew Palmer 112590 belong 0x4f4f4f4d User-mode Linux COW file 11260>4 belong <3 \b, version %d 11261>>8 string >\0 \b, backing file %s 11262>4 belong >2 \b, version %d 11263>>32 string >\0 \b, backing file %s 11264 11265############################################################################ 11266# Linux kernel versions 11267 112680 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux 11269>497 leshort 0 x86 boot sector 11270>>514 belong 0x8e of a kernel from the dawn of time! 11271>>514 belong 0x908ed8b4 version 0.99-1.1.42 11272>>514 belong 0x908ed8b8 for memtest86 11273 11274>497 leshort !0 x86 kernel 11275>>504 leshort >0 RAMdisksize=%u KB 11276>>502 leshort >0 swap=0x%X 11277>>508 leshort >0 root=0x%X 11278>>>498 leshort 1 \b-ro 11279>>>498 leshort 0 \b-rw 11280>>506 leshort 0xFFFF vga=normal 11281>>506 leshort 0xFFFE vga=extended 11282>>506 leshort 0xFFFD vga=ask 11283>>506 leshort >0 vga=%d 11284>>514 belong 0x908ed881 version 1.1.43-1.1.45 11285>>514 belong 0x15b281cd 11286>>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0 11287>>>0xa99 belong 0x55AA5a5a version 1.3.1,2 11288>>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30 11289>>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41 11290>>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45 11291>>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72 11292>>514 string HdrS 11293>>>518 leshort >0x1FF 11294>>>>529 byte 0 \b, zImage 11295>>>>529 byte 1 \b, bzImage 11296>>>>(526.s+0x200) string >\0 \b, version %s 11297 11298# Linux boot sector thefts. 112990 belong 0xb8c0078e Linux 11300>0x1e6 belong 0x454c4b53 ELKS Kernel 11301>0x1e6 belong !0x454c4b53 style boot sector 11302 11303############################################################################ 11304# Linux S390 kernel image 11305# Created by: Jan Kaluza <jkaluza@redhat.com> 113068 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390 11307>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc 11308# 64bit 11309>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel 11310>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel 11311>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel 11312>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel 11313# 32bit 11314>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel 11315>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel 11316>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel 11317>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel 11318 11319# Linux ARM compressed kernel image 11320# From: Kevin Cernekee <cernekee@gmail.com> 1132136 lelong 0x016f2818 Linux kernel ARM boot executable zImage (little-endian) 1132236 belong 0x016f2818 Linux kernel ARM boot executable zImage (big-endian) 11323 11324############################################################################ 11325# Linux 8086 executable 113260 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless 11327>5 string . 11328>>4 string >\0 \b, libc version %s 11329 113300 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable 11331>2 byte&0x01 !0 \b, unmapped zero page 11332>2 byte&0x20 0 \b, impure 11333>2 byte&0x20 !0 11334>>2 byte&0x10 !0 \b, A_EXEC 11335>2 byte&0x02 !0 \b, A_PAL 11336>2 byte&0x04 !0 \b, A_NSYM 11337>2 byte&0x08 !0 \b, A_STAND 11338>2 byte&0x40 !0 \b, A_PURE 11339>2 byte&0x80 !0 \b, A_TOVLY 11340>28 long !0 \b, not stripped 11341>37 string . 11342>>36 string >\0 \b, libc version %s 11343 11344# 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable 11345# 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable 11346# 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable 11347# 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable 11348 11349# SYSLINUX boot logo files (from 'ppmtolss16' sources) 11350# http://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename: 11351# file extension .lss .16 113520 lelong =0x1413f33d SYSLINUX' LSS16 image data 11353# syslinux-4.05/mime/image/x-lss16.xml 11354!:mime image/x-lss16 11355>4 leshort x \b, width %d 11356>6 leshort x \b, height %d 11357 113580 string OOOM User-Mode-Linux's Copy-On-Write disk image 11359>4 belong x version %d 11360 11361# SE Linux policy database 11362# From: Mike Frysinger <vapier@gentoo.org> 113630 lelong 0xf97cff8c SE Linux policy 11364>16 lelong x v%d 11365>20 lelong 1 MLS 11366>24 lelong x %d symbols 11367>28 lelong x %d ocons 11368 11369# Linux Logical Volume Manager (LVM) 11370# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net> 11371# 11372# System ID, UUID and volume group name are 128 bytes long 11373# but they should never be full and initialized with zeros... 11374# 11375# LVM1 11376# 113770x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1 11378>0x12c string >\0 , System ID: %s 11379 113800x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2 11381>0x12c string >\0 , System ID: %s 11382 11383# LVM2 11384# 11385# It seems that the label header can be in one the four first sector 11386# of the disk... (from _find_labeller in lib/label/label.c of LVM2) 11387# 11388# 0x200 seems to be the common case 11389 113900x218 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 11391# read the offset to add to the start of the header, and the header 11392# start in 0x200 11393>&(&-12.l-0x21) byte x 11394# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 11395>>&0x0 string >\x2f \b, UUID: %.6s 11396>>&0x6 string >\x2f \b-%.4s 11397>>&0xa string >\x2f \b-%.4s 11398>>&0xe string >\x2f \b-%.4s 11399>>&0x12 string >\x2f \b-%.4s 11400>>&0x16 string >\x2f \b-%.4s 11401>>&0x1a string >\x2f \b-%.6s 11402>>&0x20 lequad x \b, size: %lld 11403 114040x018 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 11405>&(&-12.l-0x21) byte x 11406# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 11407>>&0x0 string >\x2f \b, UUID: %.6s 11408>>&0x6 string >\x2f \b-%.4s 11409>>&0xa string >\x2f \b-%.4s 11410>>&0xe string >\x2f \b-%.4s 11411>>&0x12 string >\x2f \b-%.4s 11412>>&0x16 string >\x2f \b-%.4s 11413>>&0x1a string >\x2f \b-%.6s 11414>>&0x20 lequad x \b, size: %lld 11415 114160x418 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 11417>&(&-12.l-0x21) byte x 11418# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 11419>>&0x0 string >\x2f \b, UUID: %.6s 11420>>&0x6 string >\x2f \b-%.4s 11421>>&0xa string >\x2f \b-%.4s 11422>>&0xe string >\x2f \b-%.4s 11423>>&0x12 string >\x2f \b-%.4s 11424>>&0x16 string >\x2f \b-%.4s 11425>>&0x1a string >\x2f \b-%.6s 11426>>&0x20 lequad x \b, size: %lld 11427 114280x618 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 11429>&(&-12.l-0x21) byte x 11430# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 11431>>&0x0 string >\x2f \b, UUID: %.6s 11432>>&0x6 string >\x2f \b-%.4s 11433>>&0xa string >\x2f \b-%.4s 11434>>&0xe string >\x2f \b-%.4s 11435>>&0x12 string >\x2f \b-%.4s 11436>>&0x16 string >\x2f \b-%.4s 11437>>&0x1a string >\x2f \b-%.6s 11438>>&0x20 lequad x \b, size: %lld 11439 11440# LVM snapshot 11441# from Jason Farrel 114420 string SnAp LVM Snapshot (CopyOnWrite store) 11443>4 lelong !0 - valid, 11444>4 lelong 0 - invalid, 11445>8 lelong x version %d, 11446>12 lelong x chunk_size %d 11447 11448# SE Linux policy database 114490 lelong 0xf97cff8c SE Linux policy 11450>16 lelong x v%d 11451>20 lelong 1 MLS 11452>24 lelong x %d symbols 11453>28 lelong x %d ocons 11454 11455# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec 11456# Anthon van der Neut (anthon@mnt.org) 114570 string LUKS\xba\xbe LUKS encrypted file, 11458>6 beshort x ver %d 11459>8 string x [%s, 11460>40 string x %s, 11461>72 string x %s] 11462>168 string x UUID: %s 11463 11464 11465# Summary: Xen saved domain file 11466# Created by: Radek Vokal <rvokal@redhat.com> 114670 string LinuxGuestRecord Xen saved domain 11468>20 search/256 (name 11469>>&1 string x (name %s) 11470 11471# Type: Xen, the virtual machine monitor 11472# From: Radek Vokal <rvokal@redhat.com> 114730 string LinuxGuestRecord Xen saved domain 11474#>2 regex \(name\ [^)]*\) %s 11475>20 search/256 (name (name 11476>>&1 string x %s...) 11477 11478#------------------------------------------------------------------------------ 11479# $File: lisp,v 1.23 2009/09/19 16:28:10 christos Exp $ 11480# lisp: file(1) magic for lisp programs 11481# 11482# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) 11483 11484# updated by Joerg Jenderek 11485# GRR: This lot is too weak 11486#0 string ;; 11487# windows INF files often begin with semicolon and use CRLF as line end 11488# lisp files are mainly created on unix system with LF as line end 11489#>2 search/4096 !\r Lisp/Scheme program text 11490#>2 search/4096 \r Windows INF file 11491 114920 search/4096 (setq\ Lisp/Scheme program text 11493!:mime text/x-lisp 114940 search/4096 (defvar\ Lisp/Scheme program text 11495!:mime text/x-lisp 114960 search/4096 (defparam\ Lisp/Scheme program text 11497!:mime text/x-lisp 114980 search/4096 (defun\ Lisp/Scheme program text 11499!:mime text/x-lisp 115000 search/4096 (autoload\ Lisp/Scheme program text 11501!:mime text/x-lisp 115020 search/4096 (custom-set-variables\ Lisp/Scheme program text 11503!:mime text/x-lisp 11504 11505# Emacs 18 - this is always correct, but not very magical. 115060 string \012( Emacs v18 byte-compiled Lisp data 11507!:mime application/x-elc 11508# Emacs 19+ - ver. recognition added by Ian Springer 11509# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs 11510# - Chris Chittleborough <cchittleborough@yahoo.com.au> 115110 string ;ELC 11512>4 byte >18 11513>4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data 11514!:mime application/x-elc 11515 11516# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr> 115170 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27) 115180 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text 11519 115200 long 0x70768BD2 CLISP memory image data 115210 long 0xD28B7670 CLISP memory image data, other endian 11522 11523#.com and .bin for MIT scheme 115240 string \372\372\372\372 MIT scheme (library?) 11525 11526# From: David Allouche <david@allouche.net> 115270 search/1 \<TeXmacs| TeXmacs document text 11528!:mime text/texmacs 11529 11530#------------------------------------------------------------------------------ 11531# $File: llvm,v 1.8 2013/01/12 03:09:51 christos Exp $ 11532# llvm: file(1) magic for LLVM byte-codes 11533# URL: http://llvm.org/docs/BitCodeFormat.html 11534# From: Al Stone <ahs3@fc.hp.com> 11535 115360 string llvm LLVM byte-codes, uncompressed 115370 string llvc0 LLVM byte-codes, null compression 115380 string llvc1 LLVM byte-codes, gzip compression 115390 string llvc2 LLVM byte-codes, bzip2 compression 11540 115410 lelong 0x0b17c0de LLVM bitcode, wrapper 11542# Are these Mach-O ABI values? They appear to be. 11543>16 lelong 0x01000007 x86_64 11544>16 lelong 0x00000007 i386 11545>16 lelong 0x00000012 ppc 11546>16 lelong 0x01000012 ppc64 11547>16 lelong 0x0000000c arm 11548 115490 string BC\xc0\xde LLVM IR bitcode 11550 11551#------------------------------------------------------------------------------ 11552# $File: lua,v 1.6 2013/01/09 16:23:17 christos Exp $ 11553# lua: file(1) magic for Lua scripting language 11554# URL: http://www.lua.org/ 11555# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 11556 11557# Lua scripts 115580 search/1/w #!\ /usr/bin/lua Lua script text executable 11559!:mime text/x-lua 115600 search/1/w #!\ /usr/local/bin/lua Lua script text executable 11561!:mime text/x-lua 115620 search/1 #!/usr/bin/env\ lua Lua script text executable 11563!:mime text/x-lua 115640 search/1 #!\ /usr/bin/env\ lua Lua script text executable 11565!:mime text/x-lua 11566 11567# Lua bytecode 115680 string \033Lua Lua bytecode, 11569>4 byte 0x50 version 5.0 11570>4 byte 0x51 version 5.1 11571>4 byte 0x52 version 5.2 11572 11573#------------------------------------------------------------------------------ 11574# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $ 11575# luks: file(1) magic for Linux Unified Key Setup 11576# URL: http://luks.endorphin.org/spec 11577# From: Anthon van der Neut <anthon@mnt.org> 11578 115790 string LUKS\xba\xbe LUKS encrypted file, 11580>6 beshort x ver %d 11581>8 string x [%s, 11582>40 string x %s, 11583>72 string x %s] 11584>168 string x UUID: %s 11585#------------------------------------------------------------------------------ 11586# $File: m4,v 1.1 2011/12/08 12:12:46 rrt Exp $ 11587# make: file(1) magic for M4 scripts 11588# 115890 regex \^dnl\ M4 macro processor script text 11590!:mime text/x-m4 11591 11592#------------------------------------------------------------ 11593# $File: mach,v 1.17 2013/03/07 02:22:52 christos Exp $ 11594# Mach has two magic numbers, 0xcafebabe and 0xfeedface. 11595# Unfortunately the first, cafebabe, is shared with 11596# Java ByteCode, so they are both handled in the file "cafebabe". 11597# The "feedface" ones are handled herein. 11598#------------------------------------------------------------ 11599# if set, it's for the 64-bit version of the architecture 11600# yes, this is separate from the low-order magic number bit 11601# it's also separate from the "64-bit libraries" bit in the 11602# upper 8 bits of the CPU subtype 11603 116040 name mach-o-cpu 11605>0 belong&0x01000000 0 11606# 11607# 32-bit ABIs. 11608# 11609# 1 vax 11610>>0 belong&0x00ffffff 1 11611>>>4 belong&0x00ffffff 0 vax 11612>>>4 belong&0x00ffffff 1 vax11/780 11613>>>4 belong&0x00ffffff 2 vax11/785 11614>>>4 belong&0x00ffffff 3 vax11/750 11615>>>4 belong&0x00ffffff 4 vax11/730 11616>>>4 belong&0x00ffffff 5 uvaxI 11617>>>4 belong&0x00ffffff 6 uvaxII 11618>>>4 belong&0x00ffffff 7 vax8200 11619>>>4 belong&0x00ffffff 8 vax8500 11620>>>4 belong&0x00ffffff 9 vax8600 11621>>>4 belong&0x00ffffff 10 vax8650 11622>>>4 belong&0x00ffffff 11 vax8800 11623>>>4 belong&0x00ffffff 12 uvaxIII 11624>>>4 belong&0x00ffffff >12 vax subarchitecture=%ld 11625>>0 belong&0x00ffffff 2 romp 11626>>0 belong&0x00ffffff 3 architecture=3 11627>>0 belong&0x00ffffff 4 ns32032 11628>>0 belong&0x00ffffff 5 ns32332 11629>>0 belong&0x00ffffff 6 m68k 11630# 7 x86 11631>>0 belong&0x00ffffff 7 11632>>>4 belong&0x0000000f 3 i386 11633>>>4 belong&0x0000000f 4 i486 11634>>>>4 belong&0x00fffff0 0 11635>>>>4 belong&0x00fffff0 0x80 \bsx 11636>>>4 belong&0x0000000f 5 i586 11637>>>4 belong&0x0000000f 6 11638>>>>4 belong&0x00fffff0 0 p6 11639>>>>4 belong&0x00fffff0 0x10 pentium_pro 11640>>>>4 belong&0x00fffff0 0x20 pentium_2_m0x20 11641>>>>4 belong&0x00fffff0 0x30 pentium_2_m3 11642>>>>4 belong&0x00fffff0 0x40 pentium_2_m0x40 11643>>>>4 belong&0x00fffff0 0x50 pentium_2_m5 11644>>>>4 belong&0x00fffff0 >0x50 pentium_2_m0x%lx 11645>>>4 belong&0x0000000f 7 celeron 11646>>>>4 belong&0x00fffff0 0x00 \b_m0x%lx 11647>>>>4 belong&0x00fffff0 0x10 \b_m0x%lx 11648>>>>4 belong&0x00fffff0 0x20 \b_m0x%lx 11649>>>>4 belong&0x00fffff0 0x30 \b_m0x%lx 11650>>>>4 belong&0x00fffff0 0x40 \b_m0x%lx 11651>>>>4 belong&0x00fffff0 0x50 \b_m0x%lx 11652>>>>4 belong&0x00fffff0 0x60 11653>>>>4 belong&0x00fffff0 0x70 \b_mobile 11654>>>>4 belong&0x00fffff0 >0x70 \b_m0x%lx 11655>>>4 belong&0x0000000f 8 pentium_3 11656>>>>4 belong&0x00fffff0 0x00 11657>>>>4 belong&0x00fffff0 0x10 \b_m 11658>>>>4 belong&0x00fffff0 0x20 \b_xeon 11659>>>>4 belong&0x00fffff0 >0x20 \b_m0x%lx 11660>>>4 belong&0x0000000f 9 pentiumM 11661>>>>4 belong&0x00fffff0 0x00 11662>>>>4 belong&0x00fffff0 >0x00 \b_m0x%lx 11663>>>4 belong&0x0000000f 10 pentium_4 11664>>>>4 belong&0x00fffff0 0x00 11665>>>>4 belong&0x00fffff0 0x10 \b_m 11666>>>>4 belong&0x00fffff0 >0x10 \b_m0x%lx 11667>>>4 belong&0x0000000f 11 itanium 11668>>>>4 belong&0x00fffff0 0x00 11669>>>>4 belong&0x00fffff0 0x10 \b_2 11670>>>>4 belong&0x00fffff0 >0x10 \b_m0x%lx 11671>>>4 belong&0x0000000f 12 xeon 11672>>>>4 belong&0x00fffff0 0x00 11673>>>>4 belong&0x00fffff0 0x10 \b_mp 11674>>>>4 belong&0x00fffff0 >0x10 \b_m0x%lx 11675>>>4 belong&0x0000000f >12 ia32 family=%ld 11676>>>>4 belong&0x00fffff0 0x00 11677>>>>4 belong&0x00fffff0 >0x00 model=%lx 11678>>0 belong&0x00ffffff 8 mips 11679>>>4 belong&0x00ffffff 1 R2300 11680>>>4 belong&0x00ffffff 2 R2600 11681>>>4 belong&0x00ffffff 3 R2800 11682>>>4 belong&0x00ffffff 4 R2000a 11683>>>4 belong&0x00ffffff 5 R2000 11684>>>4 belong&0x00ffffff 6 R3000a 11685>>>4 belong&0x00ffffff 7 R3000 11686>>>4 belong&0x00ffffff >7 subarchitecture=%ld 11687>>0 belong&0x00ffffff 9 ns32532 11688>>0 belong&0x00ffffff 10 mc98000 11689>>0 belong&0x00ffffff 11 hppa 11690>>>4 belong&0x00ffffff 0 7100 11691>>>4 belong&0x00ffffff 1 7100LC 11692>>>4 belong&0x00ffffff >1 subarchitecture=%ld 11693>>0 belong&0x00ffffff 12 arm 11694>>>4 belong&0x00ffffff 0 11695>>>4 belong&0x00ffffff 1 subarchitecture=%ld 11696>>>4 belong&0x00ffffff 2 subarchitecture=%ld 11697>>>4 belong&0x00ffffff 3 subarchitecture=%ld 11698>>>4 belong&0x00ffffff 4 subarchitecture=%ld 11699>>>4 belong&0x00ffffff 5 \b_v4t 11700>>>4 belong&0x00ffffff 6 \b_v6 11701>>>4 belong&0x00ffffff 7 \b_v5tej 11702>>>4 belong&0x00ffffff 8 \b_xscale 11703>>>4 belong&0x00ffffff 9 \b_v7 11704>>>4 belong&0x00ffffff 10 \b_v7f 11705>>>4 belong&0x00ffffff 11 subarchitecture=%ld 11706>>>4 belong&0x00ffffff 12 \b_v7k 11707>>>4 belong&0x00ffffff >12 subarchitecture=%ld 11708# 13 m88k 11709>>0 belong&0x00ffffff 13 11710>>>4 belong&0x00ffffff 0 mc88000 11711>>>4 belong&0x00ffffff 1 mc88100 11712>>>4 belong&0x00ffffff 2 mc88110 11713>>>4 belong&0x00ffffff >2 mc88000 subarchitecture=%ld 11714>>0 belong&0x00ffffff 14 sparc 11715>>0 belong&0x00ffffff 15 i860g 11716>>0 belong&0x00ffffff 16 alpha 11717>>0 belong&0x00ffffff 17 rs6000 11718>>0 belong&0x00ffffff 18 ppc 11719>>>4 belong&0x00ffffff 0 11720>>>4 belong&0x00ffffff 1 \b_601 11721>>>4 belong&0x00ffffff 2 \b_602 11722>>>4 belong&0x00ffffff 3 \b_603 11723>>>4 belong&0x00ffffff 4 \b_603e 11724>>>4 belong&0x00ffffff 5 \b_603ev 11725>>>4 belong&0x00ffffff 6 \b_604 11726>>>4 belong&0x00ffffff 7 \b_604e 11727>>>4 belong&0x00ffffff 8 \b_620 11728>>>4 belong&0x00ffffff 9 \b_650 11729>>>4 belong&0x00ffffff 10 \b_7400 11730>>>4 belong&0x00ffffff 11 \b_7450 11731>>>4 belong&0x00ffffff 100 \b_970 11732>>>4 belong&0x00ffffff >100 subarchitecture=%ld 11733>>0 belong&0x00ffffff >18 architecture=%ld 11734>0 belong&0x01000000 0x01000000 11735# 11736# 64-bit ABIs. 11737# 11738>>0 belong&0x00ffffff 0 64-bit architecture=%ld 11739>>0 belong&0x00ffffff 1 64-bit architecture=%ld 11740>>0 belong&0x00ffffff 2 64-bit architecture=%ld 11741>>0 belong&0x00ffffff 3 64-bit architecture=%ld 11742>>0 belong&0x00ffffff 4 64-bit architecture=%ld 11743>>0 belong&0x00ffffff 5 64-bit architecture=%ld 11744>>0 belong&0x00ffffff 6 64-bit architecture=%ld 11745>>0 belong&0x00ffffff 7 x86_64 11746>>>4 belong&0x00ffffff 0 subarchitecture=%ld 11747>>>4 belong&0x00ffffff 1 subarchitecture=%ld 11748>>>4 belong&0x00ffffff 2 subarchitecture=%ld 11749>>>4 belong&0x00ffffff 3 11750>>>4 belong&0x00ffffff 4 \b_arch1 11751>>>4 belong&0x00ffffff >4 subarchitecture=%ld 11752>>0 belong&0x00ffffff 8 64-bit architecture=%ld 11753>>0 belong&0x00ffffff 9 64-bit architecture=%ld 11754>>0 belong&0x00ffffff 10 64-bit architecture=%ld 11755>>0 belong&0x00ffffff 11 64-bit architecture=%ld 11756>>0 belong&0x00ffffff 12 64-bit architecture=%ld 11757>>0 belong&0x00ffffff 13 64-bit architecture=%ld 11758>>0 belong&0x00ffffff 14 64-bit architecture=%ld 11759>>0 belong&0x00ffffff 15 64-bit architecture=%ld 11760>>0 belong&0x00ffffff 16 64-bit architecture=%ld 11761>>0 belong&0x00ffffff 17 64-bit architecture=%ld 11762>>0 belong&0x00ffffff 18 ppc64 11763>>>4 belong&0x00ffffff 0 11764>>>4 belong&0x00ffffff 1 \b_601 11765>>>4 belong&0x00ffffff 2 \b_602 11766>>>4 belong&0x00ffffff 3 \b_603 11767>>>4 belong&0x00ffffff 4 \b_603e 11768>>>4 belong&0x00ffffff 5 \b_603ev 11769>>>4 belong&0x00ffffff 6 \b_604 11770>>>4 belong&0x00ffffff 7 \b_604e 11771>>>4 belong&0x00ffffff 8 \b_620 11772>>>4 belong&0x00ffffff 9 \b_650 11773>>>4 belong&0x00ffffff 10 \b_7400 11774>>>4 belong&0x00ffffff 11 \b_7450 11775>>>4 belong&0x00ffffff 100 \b_970 11776>>>4 belong&0x00ffffff >100 subarchitecture=%ld 11777>>0 belong&0x00ffffff >18 64-bit architecture=%ld 11778 11779 117800 name mach-o-be 11781>0 byte 0xcf 64-bit 11782>4 use mach-o-cpu 11783>12 belong 1 object 11784>12 belong 2 executable 11785>12 belong 3 fixed virtual memory shared library 11786>12 belong 4 core 11787>12 belong 5 preload executable 11788>12 belong 6 dynamically linked shared library 11789>12 belong 7 dynamic linker 11790>12 belong 8 bundle 11791>12 belong 9 dynamically linked shared library stub 11792>12 belong 10 dSYM companion file 11793>12 belong 11 kext bundle 11794>12 belong >11 11795>>12 belong x filetype=%ld 11796 11797# 117980 lelong&0xfffffffe 0xfeedface Mach-O 11799!:strength +1 11800>0 use \^mach-o-be 11801 118020 belong&0xfffffffe 0xfeedface Mach-O 11803!:strength +1 11804>0 use mach-o-be 11805 11806#------------------------------------------------------------------------------ 11807# $File: macintosh,v 1.22 2011/05/17 17:40:31 rrt Exp $ 11808# macintosh description 11809# 11810# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 11811# Daniel Quinlan, quinlan@yggdrasil.com 1181211 string must\ be\ converted\ with\ BinHex BinHex binary text 11813!:mime application/mac-binhex40 11814>41 string x \b, version %.3s 11815 11816# Stuffit archives are the de facto standard of compression for Macintosh 11817# files obtained from most archives. (franklsm@tuns.ca) 118180 string SIT! StuffIt Archive (data) 11819!:mime application/x-stuffit 11820!:apple SIT!SIT! 11821>2 string x : %s 118220 string SITD StuffIt Deluxe (data) 11823>2 string x : %s 118240 string Seg StuffIt Deluxe Segment (data) 11825>2 string x : %s 11826 11827# Newer StuffIt archives (grant@netbsd.org) 118280 string StuffIt StuffIt Archive 11829!:mime application/x-stuffit 11830!:apple SIT!SIT! 11831#>162 string >0 : %s 11832 11833# Macintosh Applications and Installation binaries (franklsm@tuns.ca) 11834# GRR: Too weak 11835#0 string APPL Macintosh Application (data) 11836#>2 string x \b: %s 11837 11838# Macintosh System files (franklsm@tuns.ca) 11839# GRR: Too weak 11840#0 string zsys Macintosh System File (data) 11841#0 string FNDR Macintosh Finder (data) 11842#0 string libr Macintosh Library (data) 11843#>2 string x : %s 11844#0 string shlb Macintosh Shared Library (data) 11845#>2 string x : %s 11846#0 string cdev Macintosh Control Panel (data) 11847#>2 string x : %s 11848#0 string INIT Macintosh Extension (data) 11849#>2 string x : %s 11850#0 string FFIL Macintosh Truetype Font (data) 11851#>2 string x : %s 11852#0 string LWFN Macintosh Postscript Font (data) 11853#>2 string x : %s 11854 11855# Additional Macintosh Files (franklsm@tuns.ca) 11856# GRR: Too weak 11857#0 string PACT Macintosh Compact Pro Archive (data) 11858#>2 string x : %s 11859#0 string ttro Macintosh TeachText File (data) 11860#>2 string x : %s 11861#0 string TEXT Macintosh TeachText File (data) 11862#>2 string x : %s 11863#0 string PDF Macintosh PDF File (data) 11864#>2 string x : %s 11865 11866# MacBinary format (Eric Fischer, enf@pobox.com) 11867# 11868# Unfortunately MacBinary doesn't really have a magic number prior 11869# to the MacBinary III format. The checksum is really the way to 11870# do it, but the magic file format isn't up to the challenge. 11871# 11872# 0 byte 0 11873# 1 byte # filename length 11874# 2 string # filename 11875# 65 string # file type 11876# 69 string # file creator 11877# 73 byte # Finder flags 11878# 74 byte 0 11879# 75 beshort # vertical posn in window 11880# 77 beshort # horiz posn in window 11881# 79 beshort # window or folder ID 11882# 81 byte # protected? 11883# 82 byte 0 11884# 83 belong # length of data segment 11885# 87 belong # length of resource segment 11886# 91 belong # file creation date 11887# 95 belong # file modification date 11888# 99 beshort # length of comment after resource 11889# 101 byte # new Finder flags 11890# 102 string mBIN # (only in MacBinary III) 11891# 106 byte # char. code of file name 11892# 107 byte # still more Finder flags 11893# 116 belong # total file length 11894# 120 beshort # length of add'l header 11895# 122 byte 129 # for MacBinary II 11896# 122 byte 130 # for MacBinary III 11897# 123 byte 129 # minimum version that can read fmt 11898# 124 beshort # checksum 11899# 11900# This attempts to use the version numbers as a magic number, requiring 11901# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second 11902# be 0x81. This works for the files I have, but maybe not for everyone's. 11903 11904# Unfortunately, this magic is quite weak - MPi 11905#122 beshort&0xFCFF 0x8081 Macintosh MacBinary data 11906 11907# MacBinary I doesn't have the version number field at all, but MacBinary II 11908# has been in use since 1987 so I hope there aren't many really old files 11909# floating around that this will miss. The original spec calls for using 11910# the nulls in 0, 74, and 82 as the magic number. 11911# 11912# Another possibility, that would also work for MacBinary I, is to use 11913# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will 11914# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset, 11915# and that 74 will be 0. So something like 11916# 11917# 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data 11918# 11919# >73 byte&0x01 0x01 \b, inited 11920# >73 byte&0x02 0x02 \b, changed 11921# >73 byte&0x04 0x04 \b, busy 11922# >73 byte&0x08 0x08 \b, bozo 11923# >73 byte&0x10 0x10 \b, system 11924# >73 byte&0x10 0x20 \b, bundle 11925# >73 byte&0x10 0x40 \b, invisible 11926# >73 byte&0x10 0x80 \b, locked 11927 11928#>65 string x \b, type "%4.4s" 11929 11930#>65 string 8BIM (PhotoShop) 11931#>65 string ALB3 (PageMaker 3) 11932#>65 string ALB4 (PageMaker 4) 11933#>65 string ALT3 (PageMaker 3) 11934#>65 string APPL (application) 11935#>65 string AWWP (AppleWorks word processor) 11936#>65 string CIRC (simulated circuit) 11937#>65 string DRWG (MacDraw) 11938#>65 string EPSF (Encapsulated PostScript) 11939#>65 string FFIL (font suitcase) 11940#>65 string FKEY (function key) 11941#>65 string FNDR (Macintosh Finder) 11942#>65 string GIFf (GIF image) 11943#>65 string Gzip (GNU gzip) 11944#>65 string INIT (system extension) 11945#>65 string LIB\ (library) 11946#>65 string LWFN (PostScript font) 11947#>65 string MSBC (Microsoft BASIC) 11948#>65 string PACT (Compact Pro archive) 11949#>65 string PDF\ (Portable Document Format) 11950#>65 string PICT (picture) 11951#>65 string PNTG (MacPaint picture) 11952#>65 string PREF (preferences) 11953#>65 string PROJ (Think C project) 11954#>65 string QPRJ (Think Pascal project) 11955#>65 string SCFL (Defender scores) 11956#>65 string SCRN (startup screen) 11957#>65 string SITD (StuffIt Deluxe) 11958#>65 string SPn3 (SuperPaint) 11959#>65 string STAK (HyperCard stack) 11960#>65 string Seg\ (StuffIt segment) 11961#>65 string TARF (Unix tar archive) 11962#>65 string TEXT (ASCII) 11963#>65 string TIFF (TIFF image) 11964#>65 string TOVF (Eudora table of contents) 11965#>65 string WDBN (Microsoft Word word processor) 11966#>65 string WORD (MacWrite word processor) 11967#>65 string XLS\ (Microsoft Excel) 11968#>65 string ZIVM (compress (.Z)) 11969#>65 string ZSYS (Pre-System 7 system file) 11970#>65 string acf3 (Aldus FreeHand) 11971#>65 string cdev (control panel) 11972#>65 string dfil (Desk Accessory suitcase) 11973#>65 string libr (library) 11974#>65 string nX^d (WriteNow word processor) 11975#>65 string nX^w (WriteNow dictionary) 11976#>65 string rsrc (resource) 11977#>65 string scbk (Scrapbook) 11978#>65 string shlb (shared library) 11979#>65 string ttro (SimpleText read-only) 11980#>65 string zsys (system file) 11981 11982#>69 string x \b, creator "%4.4s" 11983 11984# Somewhere, Apple has a repository of registered Creator IDs. These are 11985# just the ones that I happened to have files from and was able to identify. 11986 11987#>69 string 8BIM (Adobe Photoshop) 11988#>69 string ALD3 (PageMaker 3) 11989#>69 string ALD4 (PageMaker 4) 11990#>69 string ALFA (Alpha editor) 11991#>69 string APLS (Apple Scanner) 11992#>69 string APSC (Apple Scanner) 11993#>69 string BRKL (Brickles) 11994#>69 string BTFT (BitFont) 11995#>69 string CCL2 (Common Lisp 2) 11996#>69 string CCL\ (Common Lisp) 11997#>69 string CDmo (The Talking Moose) 11998#>69 string CPCT (Compact Pro) 11999#>69 string CSOm (Eudora) 12000#>69 string DMOV (Font/DA Mover) 12001#>69 string DSIM (DigSim) 12002#>69 string EDIT (Macintosh Edit) 12003#>69 string ERIK (Macintosh Finder) 12004#>69 string EXTR (self-extracting archive) 12005#>69 string Gzip (GNU gzip) 12006#>69 string KAHL (Think C) 12007#>69 string LWFU (LaserWriter Utility) 12008#>69 string LZIV (compress) 12009#>69 string MACA (MacWrite) 12010#>69 string MACS (Macintosh operating system) 12011#>69 string MAcK (MacKnowledge terminal emulator) 12012#>69 string MLND (Defender) 12013#>69 string MPNT (MacPaint) 12014#>69 string MSBB (Microsoft BASIC (binary)) 12015#>69 string MSWD (Microsoft Word) 12016#>69 string NCSA (NCSA Telnet) 12017#>69 string PJMM (Think Pascal) 12018#>69 string PSAL (Hunt the Wumpus) 12019#>69 string PSI2 (Apple File Exchange) 12020#>69 string R*ch (BBEdit) 12021#>69 string RMKR (Resource Maker) 12022#>69 string RSED (Resource Editor) 12023#>69 string Rich (BBEdit) 12024#>69 string SIT! (StuffIt) 12025#>69 string SPNT (SuperPaint) 12026#>69 string Unix (NeXT Mac filesystem) 12027#>69 string VIM! (Vim editor) 12028#>69 string WILD (HyperCard) 12029#>69 string XCEL (Microsoft Excel) 12030#>69 string aCa2 (Fontographer) 12031#>69 string aca3 (Aldus FreeHand) 12032#>69 string dosa (Macintosh MS-DOS file system) 12033#>69 string movr (Font/DA Mover) 12034#>69 string nX^n (WriteNow) 12035#>69 string pdos (Apple ProDOS file system) 12036#>69 string scbk (Scrapbook) 12037#>69 string ttxt (SimpleText) 12038#>69 string ufox (Foreign File Access) 12039 12040# Just in case... 12041 12042102 string mBIN MacBinary III data with surprising version number 12043 12044# sas magic from Bruce Foster (bef@nwu.edu) 12045# 12046#0 string SAS SAS 12047#>8 string x %s 120480 string SAS SAS 12049>24 string DATA data file 12050>24 string CATALOG catalog 12051>24 string INDEX data file index 12052>24 string VIEW data view 12053# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) 12054# 120550x54 string SAS SAS 7+ 12056>0x9C string DATA data file 12057>0x9C string CATALOG catalog 12058>0x9C string INDEX data file index 12059>0x9C string VIEW data view 12060 12061# spss magic for SPSS system and portable files, 12062# from Bruce Foster (bef@nwu.edu). 12063 120640 long 0xc1e2c3c9 SPSS Portable File 12065>40 string x %s 12066 120670 string $FL2 SPSS System File 12068>24 string x %s 12069 12070# Macintosh filesystem data 12071# From "Tom N Harris" <telliamed@mac.com> 12072# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> 12073# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these 12074# entries depend on the data arithmetic added after v.35 12075# There's also some Pascal strings in here, ditto... 12076 12077# The boot block signature, according to IM:Files, is 12078# "for HFS volumes, this field always contains the value 0x4C4B." 12079# But if this is true for MFS or HFS+ volumes, I don't know. 12080# Alternatively, the boot block is supposed to be zeroed if it's 12081# unused, so a simply >0 should suffice. 12082 120830x400 beshort 0xD2D7 Macintosh MFS data 12084>0 beshort 0x4C4B (bootable) 12085>0x40a beshort &0x8000 (locked) 12086>0x402 beldate-0x7C25B080 x created: %s, 12087>0x406 beldate-0x7C25B080 >0 last backup: %s, 12088>0x414 belong x block size: %d, 12089>0x412 beshort x number of blocks: %d, 12090>0x424 pstring x volume name: %s 12091 12092# "BD" gives many false positives 12093#0x400 beshort 0x4244 Macintosh HFS data 12094#>0 beshort 0x4C4B (bootable) 12095#>0x40a beshort &0x8000 (locked) 12096#>0x40a beshort ^0x0100 (mounted) 12097#>0x40a beshort &0x0200 (spared blocks) 12098#>0x40a beshort &0x0800 (unclean) 12099#>0x47C beshort 0x482B (Embedded HFS+ Volume) 12100#>0x402 beldate-0x7C25B080 x created: %s, 12101#>0x406 beldate-0x7C25B080 x last modified: %s, 12102#>0x440 beldate-0x7C25B080 >0 last backup: %s, 12103#>0x414 belong x block size: %d, 12104#>0x412 beshort x number of blocks: %d, 12105#>0x424 pstring x volume name: %s 12106 121070x400 beshort 0x482B Macintosh HFS Extended 12108>&0 beshort x version %d data 12109>0 beshort 0x4C4B (bootable) 12110>0x404 belong ^0x00000100 (mounted) 12111>&2 belong &0x00000200 (spared blocks) 12112>&2 belong &0x00000800 (unclean) 12113>&2 belong &0x00008000 (locked) 12114>&6 string x last mounted by: '%.4s', 12115# really, that should be treated as a belong and we print a string 12116# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" 12117>&14 beldate-0x7C25B080 x created: %s, 12118# only the creation date is local time, all other timestamps in HFS+ are UTC. 12119>&18 bedate-0x7C25B080 x last modified: %s, 12120>&22 bedate-0x7C25B080 >0 last backup: %s, 12121>&26 bedate-0x7C25B080 >0 last checked: %s, 12122>&38 belong x block size: %d, 12123>&42 belong x number of blocks: %d, 12124>&46 belong x free blocks: %d 12125 12126# I don't think this is really necessary since it doesn't do much and 12127# anything with a valid driver descriptor will also have a valid 12128# partition map 12129#0 beshort 0x4552 Apple Device Driver data 12130#>&24 beshort =1 \b, MacOS 12131 12132# Is that the partition type a cstring or a pstring? Well, IM says "strings 12133# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a 12134# cstring. Of course, partitions can contain more than four entries, but 12135# what're you gonna do? 12136# GRR: This magic is too weak, it is just "PM" 12137#0x200 beshort 0x504D Apple Partition data 12138#>0x2 beshort x (block size: %d): 12139#>0x230 string x first type: %s, 12140#>0x210 string x name: %s, 12141#>0x254 belong x number of blocks: %d, 12142#>0x400 beshort 0x504D 12143#>>0x430 string x second type: %s, 12144#>>0x410 string x name: %s, 12145#>>0x454 belong x number of blocks: %d, 12146#>>0x600 beshort 0x504D 12147#>>>0x630 string x third type: %s, 12148#>>>0x610 string x name: %s, 12149#>>>0x654 belong x number of blocks: %d, 12150#>>0x800 beshort 0x504D 12151#>>>0x830 string x fourth type: %s, 12152#>>>0x810 string x name: %s, 12153#>>>0x854 belong x number of blocks: %d, 12154#>>>0xa00 beshort 0x504D 12155#>>>>0xa30 string x fifth type: %s, 12156#>>>>0xa10 string x name: %s, 12157#>>>>0xa54 belong x number of blocks: %d 12158#>>>0xc00 beshort 0x504D 12159#>>>>0xc30 string x sixth type: %s, 12160#>>>>0xc10 string x name: %s, 12161#>>>>0xc54 belong x number of blocks: %d 12162## AFAIK, only the signature is different 12163#0x200 beshort 0x5453 Apple Old Partition data 12164#>0x2 beshort x block size: %d, 12165#>0x230 string x first type: %s, 12166#>0x210 string x name: %s, 12167#>0x254 belong x number of blocks: %d, 12168#>0x400 beshort 0x504D 12169#>>0x430 string x second type: %s, 12170#>>0x410 string x name: %s, 12171#>>0x454 belong x number of blocks: %d, 12172#>>0x800 beshort 0x504D 12173#>>>0x830 string x third type: %s, 12174#>>>0x810 string x name: %s, 12175#>>>0x854 belong x number of blocks: %d, 12176#>>>0xa00 beshort 0x504D 12177#>>>>0xa30 string x fourth type: %s, 12178#>>>>0xa10 string x name: %s, 12179#>>>>0xa54 belong x number of blocks: %d 12180 12181# From: Remi Mommsen <mommsen@slac.stanford.edu> 121820 string BOMStore Mac OS X bill of materials (BOM) file 12183 12184# From: Adam Buchbinder <adam.buchbinder@gmail.com> 12185# URL: http://en.wikipedia.org/wiki/Datafork_TrueType 12186# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is 12187# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I 12188# don't know what they mean. 121890 belong 0x100 12190>(0x4.L+24) beshort x 12191>>&4 belong 0x73666e74 Mac OSX datafork font, TrueType 12192>>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT' 12193>>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT' 12194>>&4 belong 0x504f5354 Mac OSX datafork font, PostScript 12195 12196#------------------------------------------------------------------------------ 12197# $File: macos,v 1.1 2012/12/21 16:41:07 christos Exp $ 12198# MacOS files 12199# 12200 122010 string book\0\0\0\0mark\0\0\0\0 MacOS Alias file 12202 12203#------------------------------------------------------------------------------ 12204# $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $ 12205# magic: file(1) magic for magic files 12206# 122070 string/t #\ Magic magic text file for file(1) cmd 122080 lelong 0xF11E041C magic binary file for file(1) cmd 12209>4 lelong x (version %d) (little endian) 122100 belong 0xF11E041C magic binary file for file(1) cmd 12211>4 belong x (version %d) (big endian) 12212#------------------------------------------------------------------------------ 12213# $File: mail.news,v 1.22 2013/01/04 14:22:07 christos Exp $ 12214# mail.news: file(1) magic for mail and news 12215# 12216# Unfortunately, saved netnews also has From line added in some news software. 12217#0 string From mail text 122180 string/t Relay-Version: old news text 12219!:mime message/rfc822 122200 string/t #!\ rnews batched news text 12221!:mime message/rfc822 122220 string/t N#!\ rnews mailed, batched news text 12223!:mime message/rfc822 122240 string/t Forward\ to mail forwarding text 12225!:mime message/rfc822 122260 string/t Pipe\ to mail piping text 12227!:mime message/rfc822 122280 string/tc delivered-to: SMTP mail text 12229!:mime message/rfc822 122300 string/tc return-path: SMTP mail text 12231!:mime message/rfc822 122320 string/t Path: news text 12233!:mime message/news 122340 string/t Xref: news text 12235!:mime message/news 122360 string/t From: news or mail text 12237!:mime message/rfc822 122380 string/t Article saved news text 12239!:mime message/news 122400 string/t BABYL Emacs RMAIL text 122410 string/t Received: RFC 822 mail text 12242!:mime message/rfc822 122430 string/t MIME-Version: MIME entity text 12244#0 string/t Content- MIME entity text 12245 12246# TNEF files... 122470 lelong 0x223E9F78 Transport Neutral Encapsulation Format 12248!:mime application/vnd.ms-tnef 12249 12250# From: Kevin Sullivan <ksulliva@psc.edu> 122510 string *mbx* MBX mail folder 12252 12253# From: Simon Matter <simon.matter@invoca.ch> 122540 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB 12255 12256# JAM(mbp) Fidonet message area databases 12257# JHR file 122580 string JAM\0 JAM message area header file 12259>12 leshort >0 (%d messages) 12260 12261# Squish Fidonet message area databases 12262# SQD file (requires at least one message in the area) 12263# XXX: Weak magic 12264#256 leshort 0xAFAE4453 Squish message area data file 12265#>4 leshort >0 (%d messages) 12266 12267#0 string \<!--\ MHonArc text/html; x-type=mhonarc 12268 12269# Cyrus: file(1) magic for compiled Cyrus sieve scripts 12270# URL: http://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php 12271# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master 12272# From: Philipp Hahn <hahn@univention.de> 12273 12274# Compiled Cyrus sieve script 122750 string CyrSBytecode Cyrus sieve bytecode data, 12276>12 belong =1 version 1, big-endian 12277>12 lelong =1 version 1, little-endian 12278>12 belong x version %d, network-endian 12279#------------------------------------------------------------------------------ 12280# $File: make,v 1.1 2011/12/08 12:12:46 rrt Exp $ 12281# make: file(1) magic for makefiles 12282# 122830 regex \^CFLAGS makefile script text 12284!:mime text/x-makefile 122850 regex \^LDFLAGS makefile script text 12286!:mime text/x-makefile 122870 regex \^all: makefile script text 12288!:mime text/x-makefile 122890 regex \^.PRECIOUS makefile script text 12290!:mime text/x-makefile 12291 122920 regex \^SUBDIRS automake makefile script text 12293!:mime text/x-makefile 12294 12295#------------------------------------------------------------------------------ 12296# $File: maple,v 1.7 2013/01/11 16:45:23 christos Exp $ 12297# maple: file(1) magic for maple files 12298# "H. Nanosecond" <aldomel@ix.netcom.com> 12299# Maple V release 4, a multi-purpose math program 12300# 12301 12302# maple library .lib 123030 string \000MVR4\nI MapleVr4 library 12304 12305# .ind 12306# no magic for these :-( 12307# they are compiled indexes for maple files 12308 12309# .hdb 123100 string \000\004\000\000 Maple help database 12311 12312# .mhp 12313# this has the form <PACKAGE=name> 123140 string \<PACKAGE= Maple help file 123150 string \<HELP\ NAME= Maple help file 123160 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck) 12317#0 string #\ Newton Maple help file, old style 123180 string #\ daub Maple help file, old style 12319#0 string #=========== Maple help file, old style 12320 12321# .mws 123220 string \000\000\001\044\000\221 Maple worksheet 12323#this is anomalous 123240 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird 12325# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n 12326# that is {VERSION major_version miunor_version computer_type version_string} 123270 string {VERSION\ Maple worksheet 12328>9 string >\0 version %.1s. 12329>>11 string >\0 %.1s 12330 12331# .mps 123320 string \0\0\001$ Maple something 12333# from byte 4 it is either 'nul E' or 'soh R' 12334# I think 'nul E' means a file that was saved as a different name 12335# a sort of revision marking 12336# 'soh R' means new 12337>4 string \000\105 An old revision 12338>4 string \001\122 The latest save 12339 12340# .mpl 12341# some of these are the same as .mps above 12342#0000000 000 000 001 044 000 105 same as .mps 12343#0000000 000 000 001 044 001 122 same as .mps 12344 123450 string #\n##\ <SHAREFILE= Maple something 123460 string \n#\n##\ <SHAREFILE= Maple something 123470 string ##\ <SHAREFILE= Maple something 123480 string #\r##\ <SHAREFILE= Maple something 123490 string \r#\r##\ <SHAREFILE= Maple something 123500 string #\ \r##\ <DESCRIBE> Maple something anomalous. 12351#-------------------------------------------- 12352# marc21: file(1) magic for MARC 21 Format 12353# 12354# Kevin Ford (kefo@loc.gov) 12355# 12356# MARC21 formats are for the representation and communication 12357# of bibliographic and related information in machine-readable 12358# form. For more info, see http://www.loc.gov/marc/ 12359 12360 12361# leader position 20-21 must be 45 1236220 string 45 12363 12364# leader starts with 5 digits, followed by codes specific to MARC format 12365>0 regex/1 (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic 12366!:mime application/marc 12367>0 regex/1 (^[0-9]{5})[acdnosx][z] MARC21 Authority 12368!:mime application/marc 12369>0 regex/1 (^[0-9]{5})[cdn][uvxy] MARC21 Holdings 12370!:mime application/marc 123710 regex/1 (^[0-9]{5})[acdn][w] MARC21 Classification 12372!:mime application/marc 12373>0 regex/1 (^[0-9]{5})[cdn][q] MARC21 Community 12374!:mime application/marc 12375 12376# leader position 22-23, should be "00" but is it? 12377>0 regex/1 (^.{21})([^0]{2}) (non-conforming) 12378!:mime application/marc 12379 12380#------------------------------------------------------------------------------ 12381# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $ 12382# mathcad: file(1) magic for Mathcad documents 12383# URL: http://www.mathsoft.com/ 12384# From: Josh Triplett <josh@freedesktop.org> 12385 123860 string .MCAD\t Mathcad document 12387 12388#------------------------------------------------------------------------------ 12389# $File: mathematica,v 1.7 2009/09/19 16:28:10 christos Exp $ 12390# mathematica: file(1) magic for mathematica files 12391# "H. Nanosecond" <aldomel@ix.netcom.com> 12392# Mathematica a multi-purpose math program 12393# versions 2.2 and 3.0 12394 12395#mathematica .mb 123960 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook 123970 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook 12398 12399# .ma 12400# multiple possibilites: 12401 124020 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook 12403#>41 string >\0 %s 12404 12405#0 string (*^\n\n::[\011palette Mathematica notebook version 2.x 12406 12407#0 string (*^\n\n::[\011Information Mathematica notebook version 2.x 12408#>675 string >\0 %s #doesn't work well 12409 12410# there may be 'cr' instread of 'nl' in some does this matter? 12411 12412# generic: 124130 string (*^\r\r::[\011 Mathematica notebook version 2.x 124140 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x 124150 string (*^\015 Mathematica notebook version 2.x 124160 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x 124170 string (*^\r::[\011 Mathematica notebook version 2.x 124180 string (*^\r\n::[\011 Mathematica notebook version 2.x 124190 string (*^\n\n::[\011 Mathematica notebook version 2.x 124200 string (*^\n::[\011 Mathematica notebook version 2.x 12421 12422 12423# Mathematica .mx files 12424 12425#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file 124260 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file 12427#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000 12428# >71... is optional 12429>88 string >\0 from %s 12430 12431 12432# Mathematica files PBF: 12433# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000 124340 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think) 12435 12436# .ml files These are menu resources I think 12437# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\ 12438# how to put that into a magic rule? 124394 string \ A~ MAthematica .ml file 12440 12441# .nb files 12442#too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook 124430 string (*********************** Mathematica 3.0 notebook 12444 12445# other (* matches it is a comment start in these langs 12446# GRR: Too weak; also matches other languages e.g. ML 12447#0 string (* Mathematica, or Pascal, Modula-2 or 3 code text 12448 12449######################### 12450# MatLab v5 124510 string MATLAB Matlab v5 mat-file 12452>126 short 0x494d (big endian) 12453>>124 beshort x version 0x%04x 12454>126 short 0x4d49 (little endian) 12455>>124 leshort x version 0x%04x 12456 12457 12458#------------------------------------------------------------------------------ 12459# $File: matroska,v 1.8 2013/02/08 17:25:16 christos Exp $ 12460# matroska: file(1) magic for Matroska files 12461# 12462# See http://www.matroska.org/ 12463# 12464 12465# EBML id: 124660 belong 0x1a45dfa3 12467# DocType id: 12468>4 search/4096 \x42\x82 12469# DocType contents: 12470>>&1 string webm WebM 12471!:mime video/webm 12472>>&1 string matroska Matroska data 12473!:mime video/x-matroska 12474 12475#------------------------------------------------------------------------------ 12476# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $ 12477# Mavroyanopoulos Nikos <nmav@hellug.gr> 12478# mcrypt: file(1) magic for mcrypt 2.2.x; 124790 string \0m\3 mcrypt 2.5 encrypted data, 12480>4 string >\0 algorithm: %s, 12481>>&1 leshort >0 keysize: %d bytes, 12482>>>&0 string >\0 mode: %s, 12483 124840 string \0m\2 mcrypt 2.2 encrypted data, 12485>3 byte 0 algorithm: blowfish-448, 12486>3 byte 1 algorithm: DES, 12487>3 byte 2 algorithm: 3DES, 12488>3 byte 3 algorithm: 3-WAY, 12489>3 byte 4 algorithm: GOST, 12490>3 byte 6 algorithm: SAFER-SK64, 12491>3 byte 7 algorithm: SAFER-SK128, 12492>3 byte 8 algorithm: CAST-128, 12493>3 byte 9 algorithm: xTEA, 12494>3 byte 10 algorithm: TWOFISH-128, 12495>3 byte 11 algorithm: RC2, 12496>3 byte 12 algorithm: TWOFISH-192, 12497>3 byte 13 algorithm: TWOFISH-256, 12498>3 byte 14 algorithm: blowfish-128, 12499>3 byte 15 algorithm: blowfish-192, 12500>3 byte 16 algorithm: blowfish-256, 12501>3 byte 100 algorithm: RC6, 12502>3 byte 101 algorithm: IDEA, 12503>4 byte 0 mode: CBC, 12504>4 byte 1 mode: ECB, 12505>4 byte 2 mode: CFB, 12506>4 byte 3 mode: OFB, 12507>4 byte 4 mode: nOFB, 12508>5 byte 0 keymode: 8bit 12509>5 byte 1 keymode: 4bit 12510>5 byte 2 keymode: SHA-1 hash 12511>5 byte 3 keymode: MD5 hash 12512 12513#------------------------------------------------------------------------------ 12514# $File: mercurial,v 1.4 2009/09/19 16:28:10 christos Exp $ 12515# mercurial: file(1) magic for Mercurial changeset bundles 12516# http://www.selenic.com/mercurial/wiki/ 12517# 12518# Jesse Glick (jesse.glick@sun.com) 12519# 12520 125210 string HG10 Mercurial changeset bundle 12522>4 string UN (uncompressed) 12523>4 string GZ (gzip compressed) 12524>4 string BZ (bzip2 compressed) 12525 12526#------------------------------------------------------------------------------ 12527# $File: metastore,v 1.1 2011/04/06 12:37:44 christos Exp $ 12528# metastore: file(1) magic for metastore files 12529# From: Thomas Wissen 12530# see http://david.hardeman.nu/software.php#metastore 125310 string MeTaSt00r3 Metastore data file, 12532>10 bequad x version %0llx 12533 12534#------------------------------------------------------------------------------ 12535# $File: mime,v 1.6 2010/11/25 15:00:12 christos Exp $ 12536# mime: file(1) magic for MIME encoded files 12537# 125380 string/t Content-Type:\ 12539>14 string >\0 %s 125400 string/t Content-Type: 12541>13 string >\0 %s 12542 12543#------------------------------------------------------------------------------ 12544# $File: mips,v 1.9 2013/01/12 03:09:51 christos Exp $ 12545# mips: file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX 12546# and DEC Ultrix 12547# 125480 beshort 0x0160 MIPSEB ECOFF executable 12549>20 beshort 0407 (impure) 12550>20 beshort 0410 (swapped) 12551>20 beshort 0413 (paged) 12552>8 belong >0 not stripped 12553>8 belong 0 stripped 12554>22 byte x - version %ld 12555>23 byte x \b.%ld 12556# 125570 beshort 0x0162 MIPSEL-BE ECOFF executable 12558>20 beshort 0407 (impure) 12559>20 beshort 0410 (swapped) 12560>20 beshort 0413 (paged) 12561>8 belong >0 not stripped 12562>8 belong 0 stripped 12563>23 byte x - version %d 12564>22 byte x \b.%ld 12565# 125660 beshort 0x6001 MIPSEB-LE ECOFF executable 12567>20 beshort 03401 (impure) 12568>20 beshort 04001 (swapped) 12569>20 beshort 05401 (paged) 12570>8 belong >0 not stripped 12571>8 belong 0 stripped 12572>23 byte x - version %d 12573>22 byte x \b.%ld 12574# 125750 beshort 0x6201 MIPSEL ECOFF executable 12576>20 beshort 03401 (impure) 12577>20 beshort 04001 (swapped) 12578>20 beshort 05401 (paged) 12579>8 belong >0 not stripped 12580>8 belong 0 stripped 12581>23 byte x - version %ld 12582>22 byte x \b.%ld 12583# 12584# MIPS 2 additions 12585# 125860 beshort 0x0163 MIPSEB MIPS-II ECOFF executable 12587>20 beshort 0407 (impure) 12588>20 beshort 0410 (swapped) 12589>20 beshort 0413 (paged) 12590>8 belong >0 not stripped 12591>8 belong 0 stripped 12592>22 byte x - version %ld 12593>23 byte x \b.%ld 12594# 125950 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable 12596>20 beshort 0407 (impure) 12597>20 beshort 0410 (swapped) 12598>20 beshort 0413 (paged) 12599>8 belong >0 not stripped 12600>8 belong 0 stripped 12601>22 byte x - version %ld 12602>23 byte x \b.%ld 12603# 126040 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable 12605>20 beshort 03401 (impure) 12606>20 beshort 04001 (swapped) 12607>20 beshort 05401 (paged) 12608>8 belong >0 not stripped 12609>8 belong 0 stripped 12610>23 byte x - version %ld 12611>22 byte x \b.%ld 12612# 126130 beshort 0x6601 MIPSEL MIPS-II ECOFF executable 12614>20 beshort 03401 (impure) 12615>20 beshort 04001 (swapped) 12616>20 beshort 05401 (paged) 12617>8 belong >0 not stripped 12618>8 belong 0 stripped 12619>23 byte x - version %ld 12620>22 byte x \b.%ld 12621# 12622# MIPS 3 additions 12623# 126240 beshort 0x0140 MIPSEB MIPS-III ECOFF executable 12625>20 beshort 0407 (impure) 12626>20 beshort 0410 (swapped) 12627>20 beshort 0413 (paged) 12628>8 belong >0 not stripped 12629>8 belong 0 stripped 12630>22 byte x - version %ld 12631>23 byte x \b.%ld 12632# 126330 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable 12634>20 beshort 0407 (impure) 12635>20 beshort 0410 (swapped) 12636>20 beshort 0413 (paged) 12637>8 belong >0 not stripped 12638>8 belong 0 stripped 12639>22 byte x - version %ld 12640>23 byte x \b.%ld 12641# 126420 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable 12643>20 beshort 03401 (impure) 12644>20 beshort 04001 (swapped) 12645>20 beshort 05401 (paged) 12646>8 belong >0 not stripped 12647>8 belong 0 stripped 12648>23 byte x - version %ld 12649>22 byte x \b.%ld 12650# 126510 beshort 0x4201 MIPSEL MIPS-III ECOFF executable 12652>20 beshort 03401 (impure) 12653>20 beshort 04001 (swapped) 12654>20 beshort 05401 (paged) 12655>8 belong >0 not stripped 12656>8 belong 0 stripped 12657>23 byte x - version %ld 12658>22 byte x \b.%ld 12659# 126600 beshort 0x180 MIPSEB Ucode 126610 beshort 0x182 MIPSEL-BE Ucode 12662 12663#------------------------------------------------------------------------------ 12664# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $ 12665# mirage: file(1) magic for Mirage executables 12666# 12667# XXX - byte order? 12668# 126690 long 31415 Mirage Assembler m.out executable 12670 12671#----------------------------------------------------------------------------- 12672# $File: misctools,v 1.13 2013/01/16 13:53:10 christos Exp $ 12673# misctools: file(1) magic for miscellaneous UNIX tools. 12674# 126750 search/1 %%!! X-Post-It-Note text 126760 string/c BEGIN:VCALENDAR vCalendar calendar file 12677!:mime text/calendar 126780 string/c BEGIN:VCARD vCard visiting card 12679!:mime text/x-vcard 12680 12681# Summary: Libtool library file 12682# Extension: .la 12683# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl> 126840 search/80 .la\ -\ a\ libtool\ library\ file libtool library file 12685 12686# Summary: Libtool object file 12687# Extension: .lo 12688# Submitted by: Abel Cheung <abelcheung@gmail.com> 126890 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file 12690 12691# From: Daniel Novotny <dnovotny@redhat.com> 126920 string MDMP\x93\xA7 MDMP crash report data 12693 12694#------------------------------------------------------------------------------ 12695# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $ 12696# mkid: file(1) magic for mkid(1) databases 12697# 12698# ID is the binary tags database produced by mkid(1). 12699# 12700# XXX - byte order? 12701# 127020 string \311\304 ID tags data 12703>2 short >0 version %d 12704 12705#------------------------------------------------------------------------------ 12706# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $ 12707# mlssa: file(1) magic for MLSSA datafiles 12708# 127090 lelong 0xffffabcd MLSSA datafile, 12710>4 leshort x algorithm %d, 12711>10 lelong x %d samples 12712 12713#------------------------------------------------------------------------------ 12714# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $ 12715# mmdf: file(1) magic for MMDF mail files 12716# 127170 string \001\001\001\001 MMDF mailbox 12718 12719#------------------------------------------------------------------------------ 12720# $File: modem,v 1.5 2010/09/20 18:55:20 rrt Exp $ 12721# modem: file(1) magic for modem programs 12722# 12723# From: Florian La Roche <florian@knorke.saar.de> 127241 string PC\ Research,\ Inc Digifax-G3-File 12725>29 byte 1 \b, fine resolution 12726>29 byte 0 \b, normal resolution 12727 127280 short 0x0100 raw G3 data, byte-padded 127290 short 0x1400 raw G3 data 12730# 12731# Magic data for vgetty voice formats 12732# (Martin Seine & Marc Eberhard) 12733 12734# 12735# raw modem data version 1 12736# 127370 string RMD1 raw modem data 12738>4 string >\0 (%s / 12739>20 short >0 compression type 0x%04x) 12740 12741# 12742# portable voice format 1 12743# 127440 string PVF1\n portable voice format 12745>5 string >\0 (binary %s) 12746 12747# 12748# portable voice format 2 12749# 127500 string PVF2\n portable voice format 12751>5 string >\0 (ascii %s) 12752 12753 12754#------------------------------------------------------------------------------ 12755# $File: motorola,v 1.10 2009/09/19 16:28:11 christos Exp $ 12756# motorola: file(1) magic for Motorola 68K and 88K binaries 12757# 12758# 68K 12759# 127600 beshort 0520 mc68k COFF 12761>18 beshort ^00000020 object 12762>18 beshort &00000020 executable 12763>12 belong >0 not stripped 12764>168 string .lowmem Apple toolbox 12765>20 beshort 0407 (impure) 12766>20 beshort 0410 (pure) 12767>20 beshort 0413 (demand paged) 12768>20 beshort 0421 (standalone) 127690 beshort 0521 mc68k executable (shared) 12770>12 belong >0 not stripped 127710 beshort 0522 mc68k executable (shared demand paged) 12772>12 belong >0 not stripped 12773# 12774# Motorola/UniSoft 68K Binary Compatibility Standard (BCS) 12775# 127760 beshort 0554 68K BCS executable 12777# 12778# 88K 12779# 12780# Motorola/88Open BCS 12781# 127820 beshort 0555 88K BCS executable 12783# 12784# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de> 127850 string S0 Motorola S-Record; binary data in text format 12786 12787# ATARI ST relocatable PRG 12788# 12789# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 12790# (according to Roland Waldi, Oct 21, 1987) 12791# besides the magic 0x601a, the text segment size is checked to be 12792# not larger than 1 MB (which is a lot on ST). 12793# The additional 0x601b distinction I took from Doug Lee's magic. 127940 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable 12795>2 belong x (txt=%ld, 12796>6 belong x dat=%ld, 12797>10 belong x bss=%ld, 12798>14 belong x sym=%ld) 127990 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable 12800>2 belong x (txt=%ld, 12801>6 belong x dat=%ld, 12802>10 belong x bss=%ld, 12803>14 belong x sym=%ld) 12804 12805# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>) 128060 beshort 0x601A Atari 68xxx executable, 12807>2 belong x text len %lu, 12808>6 belong x data len %lu, 12809>10 belong x BSS len %lu, 12810>14 belong x symboltab len %lu, 12811>18 belong 0 12812>22 belong &0x01 fastload flag, 12813>22 belong &0x02 may be loaded to alternate RAM, 12814>22 belong &0x04 malloc may be from alternate RAM, 12815>22 belong x flags: 0x%lX, 12816>26 beshort 0 no relocation tab 12817>26 beshort !0 + relocation tab 12818>30 string SFX [Self-Extracting LZH SFX archive] 12819>38 string SFX [Self-Extracting LZH SFX archive] 12820>44 string ZIP! [Self-Extracting ZIP SFX archive] 12821 128220 beshort 0x0064 Atari 68xxx CPX file 12823>8 beshort x (version %04lx) 12824 12825#------------------------------------------------------------------------------ 12826# $File: mozilla,v 1.4 2009/09/19 16:28:11 christos Exp $ 12827# mozilla: file(1) magic for Mozilla XUL fastload files 12828# (XUL.mfasl and XPC.mfasl) 12829# URL: http://www.mozilla.org/ 12830# From: Josh Triplett <josh@freedesktop.org> 12831 128320 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data 12833 12834#------------------------------------------------------------------------------ 12835# $File: msdos,v 1.85 2013/03/09 22:36:00 christos Exp $ 12836# msdos: file(1) magic for MS-DOS files 12837# 12838 12839# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) 12840# updated by Joerg Jenderek at Oct 2008,Apr 2011 128410 string/t @ 12842>1 string/cW \ echo\ off DOS batch file text 12843!:mime text/x-msdos-batch 12844>1 string/cW echo\ off DOS batch file text 12845!:mime text/x-msdos-batch 12846>1 string/cW rem DOS batch file text 12847!:mime text/x-msdos-batch 12848>1 string/cW set\ DOS batch file text 12849!:mime text/x-msdos-batch 12850 12851 12852# OS/2 batch files are REXX. the second regex is a bit generic, oh well 12853# the matched commands seem to be common in REXX and uncommon elsewhere 12854100 search/0xffff rxfuncadd 12855>100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text 12856100 search/0xffff say 12857>100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text 12858 128590 leshort 0x14c MS Windows COFF Intel 80386 object file 12860#>4 ledate x stamp %s 128610 leshort 0x166 MS Windows COFF MIPS R4000 object file 12862#>4 ledate x stamp %s 128630 leshort 0x184 MS Windows COFF Alpha object file 12864#>4 ledate x stamp %s 128650 leshort 0x268 MS Windows COFF Motorola 68000 object file 12866#>4 ledate x stamp %s 128670 leshort 0x1f0 MS Windows COFF PowerPC object file 12868#>4 ledate x stamp %s 128690 leshort 0x290 MS Windows COFF PA-RISC object file 12870#>4 ledate x stamp %s 12871 12872# Tests for various EXE types. 12873# 12874# Many of the compressed formats were extraced from IDARC 1.23 source code. 12875# 128760 string/b MZ 12877!:mime application/x-dosexec 12878# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file. 12879>0x18 leshort <0x40 MS-DOS executable 12880# These traditional tests usually work but not always. When test quality support is 12881# implemented these can be turned on. 12882#>>0x18 leshort 0x1c (Borland compiler) 12883#>>0x18 leshort 0x1e (MS compiler) 12884 12885# If the relocation table is 0x40 or more bytes into the file, it's definitely 12886# not a DOS EXE. 12887>0x18 leshort >0x3f 12888 12889# Maybe it's a PE? 12890>>(0x3c.l) string PE\0\0 PE 12891>>>(0x3c.l+24) leshort 0x010b \b32 executable 12892>>>(0x3c.l+24) leshort 0x020b \b32+ executable 12893>>>(0x3c.l+24) leshort 0x0107 ROM image 12894>>>(0x3c.l+24) default x Unknown PE signature 12895>>>>&0 leshort x 0x%x 12896>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) 12897>>>(0x3c.l+92) leshort 1 (native) 12898>>>(0x3c.l+92) leshort 2 (GUI) 12899>>>(0x3c.l+92) leshort 3 (console) 12900>>>(0x3c.l+92) leshort 7 (POSIX) 12901>>>(0x3c.l+92) leshort 9 (Windows CE) 12902>>>(0x3c.l+92) leshort 10 (EFI application) 12903>>>(0x3c.l+92) leshort 11 (EFI boot service driver) 12904>>>(0x3c.l+92) leshort 12 (EFI runtime driver) 12905>>>(0x3c.l+92) leshort 13 (EFI ROM) 12906>>>(0x3c.l+92) leshort 14 (XBOX) 12907>>>(0x3c.l+92) leshort 15 (Windows boot application) 12908>>>(0x3c.l+92) default x (Unknown subsystem 12909>>>>&0 leshort x 0x%x) 12910>>>(0x3c.l+4) leshort 0x14c Intel 80386 12911>>>(0x3c.l+4) leshort 0x166 MIPS R4000 12912>>>(0x3c.l+4) leshort 0x168 MIPS R10000 12913>>>(0x3c.l+4) leshort 0x184 Alpha 12914>>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3 12915>>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4 12916>>>(0x3c.l+4) leshort 0x1c0 ARM 12917>>>(0x3c.l+4) leshort 0x1c2 ARM Thumb 12918>>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb 12919>>>(0x3c.l+4) leshort 0x1f0 PowerPC 12920>>>(0x3c.l+4) leshort 0x200 Intel Itanium 12921>>>(0x3c.l+4) leshort 0x266 MIPS16 12922>>>(0x3c.l+4) leshort 0x268 Motorola 68000 12923>>>(0x3c.l+4) leshort 0x290 PA-RISC 12924>>>(0x3c.l+4) leshort 0x366 MIPSIV 12925>>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU 12926>>>(0x3c.l+4) leshort 0xebc EFI byte code 12927>>>(0x3c.l+4) leshort 0x8664 x86-64 12928>>>(0x3c.l+4) leshort 0xc0ee MSIL 12929>>>(0x3c.l+4) default x Unknown processor type 12930>>>>&0 leshort x 0x%x 12931>>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB) 12932>>>(0x3c.l+22) leshort&0x1000 >0 system file 12933>>>(0x3c.l+24) leshort 0x010b 12934>>>>(0x3c.l+232) lelong >0 Mono/.Net assembly 12935>>>(0x3c.l+24) leshort 0x020b 12936>>>>(0x3c.l+248) lelong >0 Mono/.Net assembly 12937 12938# hooray, there's a DOS extender using the PE format, with a valid PE 12939# executable inside (which just prints a message and exits if run in win) 12940>>>(8.s*16) string 32STUB \b, 32rtm DOS extender 12941>>>(8.s*16) string !32STUB \b, for MS Windows 12942>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed 12943>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed 12944>>>(0x3c.l+0xf8) search/0x140 UPX2 12945>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 12946>>>(0x3c.l+0xf8) search/0x140 .idata 12947>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 12948>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive 12949>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive 12950>>>(0x3c.l+0xf8) search/0x140 .rsrc 12951>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive 12952>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive 12953>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive 12954>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive 12955>>>(0x3c.l+0xf8) search/0x140 .data 12956>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive 12957>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed 12958>>>>(0x3c.l+0xf7) byte x 12959>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive 12960>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive 12961>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive 12962>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) 12963>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive 12964>>>0x30 string Inno \b, InnoSetup self-extracting archive 12965 12966# Hmm, not a PE but the relocation table is too high for a traditional DOS exe, 12967# must be one of the unusual subformats. 12968>>(0x3c.l) string !PE\0\0 MS-DOS executable 12969 12970>>(0x3c.l) string NE \b, NE 12971>>>(0x3c.l+0x36) byte 1 for OS/2 1.x 12972>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x 12973>>>(0x3c.l+0x36) byte 3 for MS-DOS 12974>>>(0x3c.l+0x36) byte 4 for Windows 386 12975>>>(0x3c.l+0x36) byte 5 for Borland Operating System Services 12976>>>(0x3c.l+0x36) default x 12977>>>>(0x3c.l+0x36) byte x (unknown OS %x) 12978>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender 12979>>>(0x3c.l+0x0c) leshort&0x8003 0x8002 (DLL) 12980>>>(0x3c.l+0x0c) leshort&0x8003 0x8001 (driver) 12981>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive 12982>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) 12983 12984>>(0x3c.l) string LX\0\0 \b, LX 12985>>>(0x3c.l+0x0a) leshort <1 (unknown OS) 12986>>>(0x3c.l+0x0a) leshort 1 for OS/2 12987>>>(0x3c.l+0x0a) leshort 2 for MS Windows 12988>>>(0x3c.l+0x0a) leshort 3 for DOS 12989>>>(0x3c.l+0x0a) leshort >3 (unknown OS) 12990>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL) 12991>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver) 12992>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI) 12993>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console) 12994>>>(0x3c.l+0x08) leshort 1 i80286 12995>>>(0x3c.l+0x08) leshort 2 i80386 12996>>>(0x3c.l+0x08) leshort 3 i80486 12997>>>(8.s*16) string emx \b, emx 12998>>>>&1 string x %s 12999>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive 13000 13001# MS Windows system file, supposedly a collection of LE executables 13002>>(0x3c.l) string W3 \b, W3 for MS Windows 13003 13004>>(0x3c.l) string LE\0\0 \b, LE executable 13005>>>(0x3c.l+0x0a) leshort 1 13006# some DOS extenders use LE files with OS/2 header 13007>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 13008>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender 13009>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender 13010>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender 13011>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub) 13012>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub) 13013>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded) 13014# this is a wild guess; hopefully it is a specific signature 13015>>>>&0x24 lelong <0x50 13016>>>>>(&0x4c.l) string \xfc\xb8WATCOM 13017>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed 13018# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP 13019#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 13020# fails with DOS-Extenders. 13021>>>(0x3c.l+0x0a) leshort 2 for MS Windows 13022>>>(0x3c.l+0x0a) leshort 3 for DOS 13023>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD) 13024>>>(&0x7c.l+0x26) string UPX \b, UPX compressed 13025>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive 13026 13027# looks like ASCII, probably some embedded copyright message. 13028# and definitely not NE/LE/LX/PE 13029>>0x3c lelong >0x20000000 13030>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS 13031# header data too small for extended executable 13032>2 long !0 13033>>0x18 leshort <0x40 13034>>>(4.s*512) leshort !0x014c 13035 13036>>>>&(2.s-514) string !LE 13037>>>>>&-2 string !BW \b, MZ for MS-DOS 13038>>>>&(2.s-514) string LE \b, LE 13039>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 13040# educated guess since indirection is still not capable enough for complex offset 13041# calculations (next embedded executable would be at &(&2*512+&0-2) 13042# I suspect there are only LE executables in these multi-exe files 13043>>>>&(2.s-514) string BW 13044>>>>>0x240 search/0x100 DOS/4G ,\b LE for MS-DOS, DOS4GW DOS extender (embedded) 13045>>>>>0x240 search/0x100 !DOS/4G ,\b BW collection for MS-DOS 13046 13047# This sequence skips to the first COFF segment, usually .text 13048>(4.s*512) leshort 0x014c \b, COFF 13049>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender 13050>>(8.s*16) string emx 13051>>>&1 string x for DOS, Win or OS/2, emx %s 13052>>&(&0x42.l-3) byte x 13053>>>&0x26 string UPX \b, UPX compressed 13054# and yet another guess: small .text, and after large .data is unusal, could be 32lite 13055>>&0x2c search/0xa0 .text 13056>>>&0x0b lelong <0x2000 13057>>>>&0 lelong >0x6000 \b, 32lite compressed 13058 13059>(8.s*16) string $WdX \b, WDos/X DOS extender 13060 13061# By now an executable type should have been printed out. The executable 13062# may be a self-uncompressing archive, so look for evidence of that and 13063# print it out. 13064# 13065# Some signatures below from Greg Roelofs, newt@uchicago.edu. 13066# 13067>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed 13068>0xe7 string LH/2\ Self-Extract \b, %s 13069>0x1c string UC2X \b, UCEXE compressed 13070>0x1c string WWP\ \b, WWPACK compressed 13071>0x1c string RJSX \b, ARJ self-extracting archive 13072>0x1c string diet \b, diet compressed 13073>0x1c string LZ09 \b, LZEXE v0.90 compressed 13074>0x1c string LZ91 \b, LZEXE v0.91 compressed 13075>0x1c string tz \b, TinyProg compressed 13076>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive 13077!:mime application/zip 13078# Yes, this really is "Copr", not "Corp." 13079>0x1e string PKLITE\ Copr. Self-extracting PKZIP archive 13080!:mime application/zip 13081# winarj stores a message in the stub instead of the sig in the MZ header 13082>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive 13083>0x20 string AIN 13084>>0x23 string 2 \b, AIN 2.x compressed 13085>>0x23 string <2 \b, AIN 1.x compressed 13086>>0x23 string >2 \b, AIN 1.x compressed 13087>0x24 string LHa's\ SFX \b, LHa self-extracting archive 13088!:mime application/x-lha 13089>0x24 string LHA's\ SFX \b, LHa self-extracting archive 13090!:mime application/x-lha 13091>0x24 string \ $ARX \b, ARX self-extracting archive 13092>0x24 string \ $LHarc \b, LHarc self-extracting archive 13093>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive 13094>0x40 string aPKG \b, aPackage self-extracting archive 13095>0x64 string W\ Collis\0\0 \b, Compack compressed 13096>0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive 13097>>&0xf4 search/0x140 \x0\x40\x1\x0 13098>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive 13099>1638 string -lh5- \b, LHa self-extracting archive v2.13S 13100>0x17888 string Rar! \b, RAR self-extracting archive 13101 13102# Skip to the end of the EXE. This will usually work fine in the PE case 13103# because the MZ image is hardcoded into the toolchain and almost certainly 13104# won't match any of these signatures. 13105>(4.s*512) long x 13106>>&(2.s-517) byte x 13107>>>&0 string PK\3\4 \b, ZIP self-extracting archive 13108>>>&0 string Rar! \b, RAR self-extracting archive 13109>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive 13110>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive 13111>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive 13112>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive 13113>>>&7 search/400 **ACE** \b, ACE self-extracting archive 13114>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive 13115 13116# a few unknown ZIP sfxes, no idea if they are needed or if they are 13117# already captured by the generic patterns above 13118>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) 13119# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive 13120# 13121 13122# TELVOX Teleinformatica CODEC self-extractor for OS/2: 13123>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 13124>>49824 leshort =1 \b, 1 file 13125>>49824 leshort >1 \b, %u files 13126 13127# added by Joerg Jenderek of http://www.freedos.org/software/?prog=kc 13128# and http://www.freedos.org/software/?prog=kpdos 13129# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD 131300 string/b KCF FreeDOS KEYBoard Layout collection 13131# only version=0x100 found 13132>3 uleshort x \b, version 0x%x 13133# length of string containing author,info and special characters 13134>6 ubyte >0 13135#>>6 pstring x \b, name=%s 13136>>7 string >\0 \b, author=%-.14s 13137>>7 search/254 \xff \b, info= 13138#>>>&0 string x \b%-s 13139>>>&0 string x \b%-.15s 13140# for FreeDOS *.KL files 131410 string/b KLF FreeDOS KEYBoard Layout file 13142# only version=0x100 or 0x101 found 13143>3 uleshort x \b, version 0x%x 13144# stringlength 13145>5 ubyte >0 13146>>8 string x \b, name=%-.2s 131470 string \xffKEYB\ \ \ \0\0\0\0 13148>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file 13149 13150# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com) 13151# Uncommenting only the first two lines will cover about 2/3 of COM files, 13152# but it isn't feasible to match all COM files since there must be at least 13153# two dozen different one-byte "magics". 13154# test too generic ? 131550 byte 0xe9 DOS executable (COM) 13156>0x1FE leshort 0xAA55 \b, boot code 13157>6 string SFX\ of\ LHarc (%s) 13158 13159# DOS device driver updated by Joerg Jenderek at May 2011 13160# http://maben.homeip.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009 131610 ulequad&0x07a0ffffffff 0xffffffff DOS executable ( 13162>40 search/7 UPX! \bUPX compressed 13163# DOS device driver attributes 13164>4 uleshort&0x8000 0x0000 \bblock device driver 13165# character device 13166>4 uleshort&0x8000 0x8000 \b 13167>>4 uleshort&0x0008 0x0008 \bclock 13168# fast video output by int 29h 13169>>4 uleshort&0x0010 0x0010 \bfast 13170# standard input/output device 13171>>4 uleshort&0x0003 >0 \bstandard 13172>>>4 uleshort&0x0001 0x0001 \binput 13173>>>4 uleshort&0x0003 0x0003 \b/ 13174>>>4 uleshort&0x0002 0x0002 \boutput 13175>>4 uleshort&0x8000 0x8000 \bcharacter device driver 13176>0 ubyte x 13177# upx compressed device driver has garbage instead of real in name field of header 13178>>40 search/7 UPX! 13179>>40 default x 13180# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped 13181>>>12 ubyte >0x27 \b 13182>>>>10 ubyte >0x20 13183>>>>>10 ubyte !0x2E 13184>>>>>>10 ubyte !0x2A \b%c 13185>>>>11 ubyte >0x20 13186>>>>>11 ubyte !0x2E \b%c 13187>>>>12 ubyte >0x20 13188>>>>>12 ubyte !0x39 13189>>>>>>12 ubyte !0x2E \b%c 13190>>>13 ubyte >0x20 13191>>>>13 ubyte !0x2E \b%c 13192>>>>14 ubyte >0x20 13193>>>>>14 ubyte !0x2E \b%c 13194>>>>15 ubyte >0x20 13195>>>>>15 ubyte !0x2E \b%c 13196>>>>16 ubyte >0x20 13197>>>>>16 ubyte !0x2E 13198>>>>>>16 ubyte <0xCB \b%c 13199>>>>17 ubyte >0x20 13200>>>>>17 ubyte !0x2E 13201>>>>>>17 ubyte <0x90 \b%c 13202# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field 13203>>>4 uleshort&0x8000 0x8000 13204>>>>12 ubyte <0x2F 13205# they have their real name at offset 22 13206>>>>>22 string >\0 \b%-.5s 13207>4 uleshort&0x8000 0x0000 13208# 32 bit sector addressing ( > 32 MB) for block devices 13209>>4 uleshort&0x0002 0x0002 \b,32-bit sector- 13210# support by driver functions 13h, 17h, 18h 13211>4 uleshort&0x0040 0x0040 \b,IOCTL- 13212# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh 13213>4 uleshort&0x0800 0x0800 \b,close media- 13214# output until busy support by int 10h for character device driver 13215>4 uleshort&0x8000 0x8000 13216>>4 uleshort&0x2000 0x2000 \b,until busy- 13217# direct read/write support by driver functions 03h,0Ch 13218>4 uleshort&0x4000 0x4000 \b,control strings- 13219>4 uleshort&0x8000 0x8000 13220>>4 uleshort&0x6840 >0 \bsupport 13221>4 uleshort&0x8000 0x0000 13222>>4 uleshort&0x4842 >0 \bsupport 13223>0 ubyte x \b) 13224# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header 13225# Too weak, matches files that only contain 0's 13226#0 ulequad&0x000007a0ffffffed 0x0000000000000000 DOS-executable ( 13227#>4 uleshort&0x8000 0x8000 \bcharacter device driver 13228#>>10 string x %-.8s 13229#>4 uleshort&0x4000 0x4000 \b,control strings-support) 13230 13231# test too generic ? 132320 byte 0x8c DOS executable (COM) 13233# updated by Joerg Jenderek at Oct 2008 132340 ulelong 0xffff10eb DR-DOS executable (COM) 13235# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb 132360 ubeshort&0xeb8d >0xeb00 13237# DR-DOS STACKER.COM SCREATE.SYS missed 13238>0 byte 0xeb 13239>>0x1FE leshort 0xAA55 DOS executable (COM), boot code 13240>>85 string UPX DOS executable (COM), UPX compressed 13241>>4 string \ $ARX DOS executable (COM), ARX self-extracting archive 13242>>4 string \ $LHarc DOS executable (COM), LHarc self-extracting archive 13243>>0x20e string SFX\ by\ LARC DOS executable (COM), LARC self-extracting archive 13244# updated by Joerg Jenderek at Oct 2008 13245#0 byte 0xb8 COM executable 132460 uleshort&0x80ff 0x00b8 13247# modified by Joerg Jenderek 13248>1 lelong !0x21cd4cff COM executable for DOS 13249# http://syslinux.zytor.com/comboot.php 13250# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode 13251# start with assembler instructions mov eax,21cd4cffh 132520 uleshort&0xc0ff 0xc0b8 13253>1 lelong 0x21cd4cff COM executable (32-bit COMBOOT) 13254# syslinux:doc/comboot.txt 13255# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov 13256# eax,21cd4cfeh) as a magic number. 132570 string/b \xb8\xfe\x4c\xcd\x21 COM executable (COM32R) 13258# start with assembler instructions mov eax,21cd4cfeh 132590 uleshort&0xc0ff 0xc0b8 13260>1 lelong 0x21cd4cfe COM executable (32-bit COMBOOT, relocatable) 132610 string/b \x81\xfc 13262>4 string \x77\x02\xcd\x20\xb9 13263>>36 string UPX! FREE-DOS executable (COM), UPX compressed 13264252 string Must\ have\ DOS\ version DR-DOS executable (COM) 13265# added by Joerg Jenderek at Oct 2008 13266# GRR search is not working 13267#34 search/2 UPX! FREE-DOS executable (COM), UPX compressed 1326834 string UPX! FREE-DOS executable (COM), UPX compressed 1326935 string UPX! FREE-DOS executable (COM), UPX compressed 13270# GRR search is not working 13271#2 search/28 \xcd\x21 COM executable for MS-DOS 13272#WHICHFAT.cOM 132732 string \xcd\x21 COM executable for DOS 13274#DELTREE.cOM DELTREE2.cOM 132754 string \xcd\x21 COM executable for DOS 13276#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM 132775 string \xcd\x21 COM executable for DOS 13278#DELTMP.COm HASFAT32.cOM 132797 string \xcd\x21 13280>0 byte !0xb8 COM executable for DOS 13281#COMP.cOM MORE.COm 1328210 string \xcd\x21 13283>5 string !\xcd\x21 COM executable for DOS 13284#comecho.com 1328513 string \xcd\x21 COM executable for DOS 13286#HELP.COm EDIT.coM 1328718 string \xcd\x21 COM executable for MS-DOS 13288#NWRPLTRM.COm 1328923 string \xcd\x21 COM executable for MS-DOS 13290#LOADFIX.cOm LOADFIX.cOm 1329130 string \xcd\x21 COM executable for MS-DOS 13292#syslinux.com 3.11 1329370 string \xcd\x21 COM executable for DOS 13294# many compressed/converted COMs start with a copy loop instead of a jump 132950x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS 132960x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS 13297>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed 132980x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed 13299# FIXME: missing diet .com compression 13300 13301# miscellaneous formats 133020 string/b LZ MS-DOS executable (built-in) 13303#0 byte 0xf0 MS-DOS program library data 13304# 13305 13306# AAF files: 13307# <stuartc@rd.bbc.co.uk> Stuart Cunningham 133080 string/b \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage 13309>30 byte 9 (512B sectors) 13310>30 byte 12 (4kB sectors) 133110 string/b \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage 13312>30 byte 9 (512B sectors) 13313>30 byte 12 (4kB sectors) 13314 13315# Popular applications 133162080 string Microsoft\ Word\ 6.0\ Document %s 13317!:mime application/msword 133182080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data 13319!:mime application/msword 13320# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word) 133212112 string MSWordDoc Microsoft Word document data 13322!:mime application/msword 13323# 133240 belong 0x31be0000 Microsoft Word Document 13325!:mime application/msword 13326# 133270 string/b PO^Q` Microsoft Word 6.0 Document 13328!:mime application/msword 13329# 133300 string/b \376\067\0\043 Microsoft Office Document 13331!:mime application/msword 133320 string/b \333\245-\0\0\0 Microsoft Office Document 13333!:mime application/msword 13334512 string/b \354\245\301 Microsoft Word Document 13335!:mime application/msword 13336 13337# 133380 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 13339!:mime application/msword 13340# 133412080 string Microsoft\ Excel\ 5.0\ Worksheet %s 13342!:mime application/vnd.ms-excel 13343# 133440 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 13345!:mime application/msword 13346 133472080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s 13348!:mime application/vnd.ms-excel 13349# 13350# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel) 133512114 string Biff5 Microsoft Excel 5.0 Worksheet 13352!:mime application/vnd.ms-excel 13353# Italian MS-Excel 133542121 string Biff5 Microsoft Excel 5.0 Worksheet 13355!:mime application/vnd.ms-excel 133560 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet 13357!:mime application/vnd.ms-excel 13358# 133590 belong 0x00001a00 Lotus 1-2-3 13360!:mime application/x-123 13361>4 belong 0x00100400 wk3 document data 13362>4 belong 0x02100400 wk4 document data 13363>4 belong 0x07800100 fm3 or fmb document data 13364>4 belong 0x07800000 fm3 or fmb document data 13365# 133660 belong 0x00000200 Lotus 1-2-3 13367!:mime application/x-123 13368>4 belong 0x06040600 wk1 document data 13369>4 belong 0x06800200 fmt document data 133700 string/b WordPro\0 Lotus WordPro 13371!:mime application/vnd.lotus-wordpro 133720 string/b WordPro\r\373 Lotus WordPro 13373!:mime application/vnd.lotus-wordpro 13374 13375 13376# Summary: Script used by InstallScield to uninstall applications 13377# Extension: .isu 13378# Submitted by: unknown 13379# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry) 133800 string \x71\xa8\x00\x00\x01\x02 13381>12 string Stirling\ Technologies, InstallShield Uninstall Script 13382 13383# Winamp .avs 13384#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 133850 string/b Nullsoft\ AVS\ Preset\ Winamp plug in 13386 13387# Windows Metafont .WMF 133880 string/b \327\315\306\232 ms-windows metafont .wmf 133890 string/b \002\000\011\000 ms-windows metafont .wmf 133900 string/b \001\000\011\000 ms-windows metafont .wmf 13391 13392#tz3 files whatever that is (MS Works files) 133930 string/b \003\001\001\004\070\001\000\000 tz3 ms-works file 133940 string/b \003\002\001\004\070\001\000\000 tz3 ms-works file 133950 string/b \003\003\001\004\070\001\000\000 tz3 ms-works file 13396 13397# PGP sig files .sig 13398#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig 133990 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig 134000 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig 134010 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig 134020 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig 134030 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig 134040 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig 13405 13406# windows zips files .dmf 134070 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file 13408 13409 13410#ico files 134110 string/b \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows 13412 13413# Windows icons (Ian Springer <ips@fpk.hp.com>) 134140 string/b \000\000\001\000 MS Windows icon resource 13415!:mime image/x-icon 13416>4 byte 1 - 1 icon 13417>4 byte >1 - %d icons 13418>>6 byte >0 \b, %dx 13419>>>7 byte >0 \b%d 13420>>8 byte 0 \b, 256-colors 13421>>8 byte >0 \b, %d-colors 13422 13423 13424# .chr files 134250 string/b PK\010\010BGI Borland font 13426>4 string >\0 %s 13427# then there is a copyright notice 13428 13429 13430# .bgi files 134310 string/b pk\010\010BGI Borland device 13432>4 string >\0 %s 13433# then there is a copyright notice 13434 13435 13436# Windows Recycle Bin record file (named INFO2) 13437# By Abel Cheung (abelcheung AT gmail dot com) 13438# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes 13439# Since Vista uses another structure, INFO2 structure probably won't change 13440# anymore. Detailed analysis in: 13441# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf 134420 lelong 0x00000004 13443>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below) 13444 134450 lelong 0x00000005 13446>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP) 13447 13448 13449##### put in Either Magic/font or Magic/news 13450# Acroread or something files wrongly identified as G3 .pfm 13451# these have the form \000 \001 any? \002 \000 \000 13452# or \000 \001 any? \022 \000 \000 134530 belong&0xffff00ff 0x00010012 PFM data 13454>4 string \000\000 13455>6 string >\060 - %s 13456 134570 belong&0xffff00ff 0x00010002 PFM data 13458>4 string \000\000 13459>6 string >\060 - %s 13460#0 string \000\001 pfm? 13461#>3 string \022\000\000Copyright\ yes 13462#>3 string \002\000\000Copyright\ yes 13463#>3 string >\0 oops, not a font file. Cancel that. 13464#it clashes with ttf files so put it lower down. 13465 13466# From Doug Lee via a FreeBSD pr 134679 string GERBILDOC First Choice document 134689 string GERBILDB First Choice database 134699 string GERBILCLIP First Choice database 134700 string GERBIL First Choice device file 134719 string RABBITGRAPH RabbitGraph file 134720 string DCU1 Borland Delphi .DCU file 134730 string =!<spell> MKS Spell hash list (old format) 134740 string =!<spell2> MKS Spell hash list 13475# Too simple - MPi 13476#0 string AH Halo(TM) bitmapped font file 134770 lelong 0x08086b70 TurboC BGI file 134780 lelong 0x08084b50 TurboC Font file 13479 13480# tests for DBase files moved, updated and merged to database 13481 134820 string PMCC Windows 3.x .GRP file 134831 string RDC-meg MegaDots 13484>8 byte >0x2F version %c 13485>9 byte >0x2F \b.%c file 134860 lelong 0x4C 13487>4 lelong 0x00021401 Windows shortcut file 13488 13489# .PIF files added by Joerg Jenderek from http://smsoft.ru/en/pifdoc.htm 13490# only for windows versions equal or greater 3.0 134910x171 string MICROSOFT\ PIFEX\0 Windows Program Information File 13492!:mime application/x-dosexec 13493#>2 string >\0 \b, Title:%.30s 13494>0x24 string >\0 \b for %.63s 13495>0x65 string >\0 \b, directory=%.64s 13496>0xA5 string >\0 \b, parameters=%.64s 13497#>0x181 leshort x \b, offset %x 13498#>0x183 leshort x \b, offsetdata %x 13499#>0x185 leshort x \b, section length %x 13500>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0 13501>>&0x5e ubyte >0 13502>>>&-1 string <PIFMGR.DLL \b, icon=%s 13503#>>>&-1 string PIFMGR.DLL \b, icon=%s 13504>>>&-1 string >PIFMGR.DLL \b, icon=%s 13505>>&0xF0 ubyte >0 13506>>>&-1 string <Terminal \b, font=%.32s 13507#>>>&-1 string =Terminal \b, font=%.32s 13508>>>&-1 string >Terminal \b, font=%.32s 13509>>&0x110 ubyte >0 13510>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s 13511#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s 13512>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s 13513#>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style 13514#>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style 13515>0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style 13516#>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style 13517>0x187 search/0xB55 CONFIG\ \ SYS\ 4.0\0 \b +CONFIG.SYS 13518#>>&06 string x \b:%s 13519>0x187 search/0xB55 AUTOEXECBAT\ 4.0\0 \b +AUTOEXEC.BAT 13520#>>&06 string x \b:%s 13521 13522# DOS EPS Binary File Header 13523# From: Ed Sznyter <ews@Black.Market.NET> 135240 belong 0xC5D0D3C6 DOS EPS Binary File 13525>4 long >0 Postscript starts at byte %d 13526>>8 long >0 length %d 13527>>>12 long >0 Metafile starts at byte %d 13528>>>>16 long >0 length %d 13529>>>20 long >0 TIFF starts at byte %d 13530>>>>24 long >0 length %d 13531 13532# TNEF magic From "Joomy" <joomy@se-ed.net> 13533# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF) 135340 leshort 0x223e9f78 TNEF 13535!:mime application/vnd.ms-tnef 13536 13537# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS 13538# of http://www.4dos.info/ 13539# pointer,HelpID[8]=4DHnnnmm 135400 ulelong 0x48443408 4DOS help file 13541>4 string x \b, version %-4.4s 13542 13543# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp 135440 ulequad 0x3a000000024e4c MS Advisor help file 13545 13546# HtmlHelp files (.chm) 135470 string/b ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data 13548 13549# GFA-BASIC (Wolfram Kleff) 135502 string/b GFA-BASIC3 GFA-BASIC 3 data 13551 13552#------------------------------------------------------------------------------ 13553# From Stuart Caie <kyzer@4u.net> (developer of cabextract) 13554# Microsoft Cabinet files 135550 string/b MSCF\0\0\0\0 Microsoft Cabinet archive data 13556!:mime application/vnd.ms-cab-compressed 13557>8 lelong x \b, %u bytes 13558>28 leshort 1 \b, 1 file 13559>28 leshort >1 \b, %u files 13560 13561# InstallShield Cabinet files 135620 string/b ISc( InstallShield Cabinet archive data 13563>5 byte&0xf0 =0x60 version 6, 13564>5 byte&0xf0 !0x60 version 4/5, 13565>(12.l+40) lelong x %u files 13566 13567# Windows CE package files 135680 string/b MSCE\0\0\0\0 Microsoft WinCE install header 13569>20 lelong 0 \b, architecture-independent 13570>20 lelong 103 \b, Hitachi SH3 13571>20 lelong 104 \b, Hitachi SH4 13572>20 lelong 0xA11 \b, StrongARM 13573>20 lelong 4000 \b, MIPS R4000 13574>20 lelong 10003 \b, Hitachi SH3 13575>20 lelong 10004 \b, Hitachi SH3E 13576>20 lelong 10005 \b, Hitachi SH4 13577>20 lelong 70001 \b, ARM 7TDMI 13578>52 leshort 1 \b, 1 file 13579>52 leshort >1 \b, %u files 13580>56 leshort 1 \b, 1 registry entry 13581>56 leshort >1 \b, %u registry entries 13582 13583 13584# Windows Enhanced Metafile (EMF) 13585# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp 13586# for further information. 135870 ulelong 1 13588>40 string \ EMF Windows Enhanced Metafile (EMF) image data 13589>>44 ulelong x version 0x%x 13590 13591# From: Alex Beregszaszi <alex@fsn.hu> 135920 string/b COWD VMWare3 13593>4 byte 3 disk image 13594>>32 lelong x (%d/ 13595>>36 lelong x \b%d/ 13596>>40 lelong x \b%d) 13597>4 byte 2 undoable disk image 13598>>32 string >\0 (%s) 13599 136000 string/b VMDK VMware4 disk image 136010 string/b KDMV VMware4 disk image 13602 13603#-------------------------------------------------------------------- 13604# Qemu Emulator Images 13605# Lines written by Friedrich Schwittay (f.schwittay@yousable.de) 13606# Updated by Adam Buchbinder (adam.buchbinder@gmail.com) 13607# Made by reading sources, reading documentation, and doing trial and error 13608# on existing QCOW files 136090 string/b QFI\xFB QEMU QCOW Image 13610 13611# Uncomment the following line to display Magic (only used for debugging 13612# this magic number) 13613#>0 string/b x , Magic: %s 13614 13615# There are currently 2 Versions: "1" and "2". 13616# http://www.gnome.org/~markmc/qcow-image-format-version-1.html 13617>4 belong 1 (v1) 13618 13619# Using the existence of the Backing File Offset to determine whether 13620# to read Backing File Information 13621>>12 belong >0 \b, has backing file ( 13622# Note that this isn't a null-terminated string; the length is actually 13623# (16.L). Assuming a null-terminated string happens to work usually, but it 13624# may spew junk until it reaches a \0 in some cases. 13625>>>(12.L) string >\0 \bpath %s 13626 13627# Modification time of the Backing File 13628# Really useful if you want to know if your backing 13629# file is still usable together with this image 13630>>>>20 bedate >0 \b, mtime %s) 13631>>>>20 default x \b) 13632 13633# Size is stored in bytes in a big-endian u64. 13634>>24 bequad x \b, %lld bytes 13635 13636# 1 for AES encryption, 0 for none. 13637>>36 belong 1 \b, AES-encrypted 13638 13639# http://www.gnome.org/~markmc/qcow-image-format.html 13640>4 belong 2 (v2) 13641# Using the existence of the Backing File Offset to determine whether 13642# to read Backing File Information 13643>>8 bequad >0 \b, has backing file 13644# Note that this isn't a null-terminated string; the length is actually 13645# (16.L). Assuming a null-terminated string happens to work usually, but it 13646# may spew junk until it reaches a \0 in some cases. Also, since there's no 13647# .Q modifier, we just use the bottom four bytes as an offset. Note that if 13648# the file is over 4G, and the backing file path is stored after the first 4G, 13649# the wrong filename will be printed. (This should be (8.Q), when that syntax 13650# is introduced.) 13651>>>(12.L) string >\0 (path %s) 13652>>24 bequad x \b, %lld bytes 13653>>32 belong 1 \b, AES-encrypted 13654 13655>4 default x (unknown version) 13656 136570 string/b QEVM QEMU suspend to disk image 13658 13659# QEMU QED Image 13660# http://wiki.qemu.org/Features/QED/Specification 136610 string/b QED\0 QEMU QED Image 13662 13663# VDI Image 1366464 string/b \x7f\x10\xda\xbe VDI Image 13665>68 string/b \x01\x00\x01\x00 version 1.1 13666>0 string >\0 (%s) 13667>368 lequad x \b, %lld bytes 13668 136690 string/b Bochs\ Virtual\ HD\ Image Bochs disk image, 13670>32 string x type %s, 13671>48 string x subtype %s 13672 136730 lelong 0x02468ace Bochs Sparse disk image 13674 13675# from http://filext.com by Derek M Jones <derek@knosof.co.uk> 13676# False positive with PPT (also currently this string is too long) 13677#0 string/b \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer 136780 string/b \320\317\021\340\241\261\032\341 Microsoft Office Document 13679#>48 byte 0x1B Excel Document 13680#!:mime application/vnd.ms-excel 13681>546 string bjbj Microsoft Word Document 13682!:mime application/msword 13683>546 string jbjb Microsoft Word Document 13684!:mime application/msword 13685 136860 string/b \224\246\056 Microsoft Word Document 13687!:mime application/msword 13688 13689512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document 13690!:mime application/msword 13691 13692# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 13693# Magic type for Dell's BIOS .hdr files 13694# Dell's .hdr 136950 string/b $RBU 13696>23 string Dell %s system BIOS 13697>5 byte 2 13698>>48 byte x version %d. 13699>>49 byte x \b%d. 13700>>50 byte x \b%d 13701>5 byte <2 13702>>48 string x version %.3s 13703 13704# Type: Microsoft DirectDraw Surface 13705# URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp 13706# From: Morten Hustveit <morten@debian.org> 137070 string/b DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS), 13708>16 lelong >0 %hd x 13709>12 lelong >0 %hd, 13710>84 string x %.4s 13711 13712# Type: Microsoft Document Imaging Format (.mdi) 13713# URL: http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format 13714# From: Daniele Sempione <scrows@oziosi.org> 137150 short 0x5045 Microsoft Document Imaging Format 13716 13717# MS eBook format (.lit) 137180 string/b ITOLITLS Microsoft Reader eBook Data 13719>8 lelong x \b, version %u 13720!:mime application/x-ms-reader 13721 13722# Windows CE Binary Image Data Format 13723# From: Dr. Jesus <j@hug.gs> 137240 string/b B000FF\n Windows Embedded CE binary image 13725 13726# Windows Imaging (WIM) Image 137270 string/b MSWIM\000\000\000 Windows imaging (WIM) image 13728 13729# The second byte of these signatures is a file version; I don't know what, 13730# if anything, produced files with version numbers 0-2. 13731# From: John Elliott <johne@seasip.demon.co.uk> 137320 string \xfc\x03\x00 Mallard BASIC program data (v1.11) 137330 string \xfc\x04\x00 Mallard BASIC program data (v1.29+) 137340 string \xfc\x03\x01 Mallard BASIC protected program data (v1.11) 137350 string \xfc\x04\x01 Mallard BASIC protected program data (v1.29+) 13736 137370 string MIOPEN Mallard BASIC Jetsam data 137380 string Jetsam0 Mallard BASIC Jetsam index data 13739 13740 13741#------------------------------------------------------------------------------ 13742# $File: msooxml,v 1.2 2013/01/25 23:04:37 christos Exp $ 13743# msooxml: file(1) magic for Microsoft Office XML 13744# From: Ralf Brown <ralf.brown@gmail.com> 13745 13746# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP 13747# archive. The first member file is normally "[Content_Types].xml". 13748# Since MSOOXML doesn't have anything like the uncompressed "mimetype" 13749# file of ePub or OpenDocument, we'll have to scan for a filename 13750# which can distinguish between the three types 13751 13752# start by checking for ZIP local file header signature 137530 string PK\003\004 13754# make sure the first file is correct 13755>0x1E string [Content_Types].xml 13756# skip to the second local file header 13757# since some documents include a 520-byte extra field following the file 13758# header, we need to scan for the next header 13759>>(18.l+49) search/2000 PK\003\004 13760# now skip to the *third* local file header; again, we need to scan due to a 13761# 520-byte extra field following the file header 13762>>>&26 search/1000 PK\003\004 13763# and check the subdirectory name to determine which type of OOXML 13764# file we have 13765# Correct the mimetype with the registered ones: 13766# http://technet.microsoft.com/en-us/library/cc179224.aspx 13767>>>>&26 string word/ Microsoft Word 2007+ 13768!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document 13769>>>>&26 string ppt/ Microsoft PowerPoint 2007+ 13770!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation 13771>>>>&26 string xl/ Microsoft Excel 2007+ 13772!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet 13773>>>>&26 default x Microsoft OOXML 13774!:strength +10 13775 13776#------------------------------------------------------------------------------ 13777# $File: msvc,v 1.5 2009/09/19 16:28:11 christos Exp $ 13778# msvc: file(1) magic for msvc 13779# "H. Nanosecond" <aldomel@ix.netcom.com> 13780# Microsoft visual C 13781# 13782# I have version 1.0 13783 13784# .aps 137850 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file 13786 13787# .ide 13788#too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide 137890 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide 13790 13791# .res 137920 string \000\000\000\000\040\000\000\000\377 MSVC .res 137930 string \377\003\000\377\001\000\020\020\350 MSVC .res 137940 string \377\003\000\377\001\000\060\020\350 MSVC .res 13795 13796#.lib 137970 string \360\015\000\000 Microsoft Visual C library 137980 string \360\075\000\000 Microsoft Visual C library 137990 string \360\175\000\000 Microsoft Visual C library 13800 13801#.pch 138020 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch 13803 13804# .pdb 13805# too long 0 string Microsoft\ C/C++\ program\ database\ 138060 string Microsoft\ C/C++\ MSVC program database 13807>18 string program\ database\ 13808>33 string >\0 ver %s 13809 13810#.sbr 138110 string \000\002\000\007\000 MSVC .sbr 13812>5 string >\0 %s 13813 13814#.bsc 138150 string \002\000\002\001 MSVC .bsc 13816 13817#.wsp 138180 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000 13819# these seem to start with the version and contain menus 13820 13821# ------------------------------------------------------------------------ 13822# $File: mup,v 1.4 2009/09/19 16:28:11 christos Exp $ 13823# mup: file(1) magic for Mup (Music Publisher) input file. 13824# 13825# From: Abel Cheung <abel (@) oaka.org> 13826# 13827# NOTE: This header is mainly proposed in the Arkkra mailing list, 13828# and is not a mandatory header because of old mup input file 13829# compatibility. Noteedit also use mup format, but is not forcing 13830# user to use any header as well. 13831# 138320 search/1 //!Mup Mup music publication program input text 13833>6 string -Arkkra (Arkkra) 13834>>13 string - 13835>>>16 string . 13836>>>>14 string x \b, need V%.4s 13837>>>15 string . 13838>>>>14 string x \b, need V%.3s 13839>6 string - 13840>>9 string . 13841>>>7 string x \b, need V%.4s 13842>>8 string . 13843>>>7 string x \b, need V%.3s 13844#------------------------------------------------------------------------------ 13845# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $ 13846# music: file (1) magic for music formats 13847 13848# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks 13849# and Bagpipe Writer by Doug Wickstrom 13850# 138510 string Bagpipe Bagpipe 13852>8 string Reader Reader 13853>>15 string >\0 (version %.3s) 13854>8 string Music\ Writer Music Writer 13855>>20 string : 13856>>>21 string >\0 (version %.3s) 13857>>21 string Gold Gold 13858>>>25 string : 13859>>>>26 string >\0 (version %.3s) 13860 13861 13862#----------------------------------------------------------------------------- 13863# $File: natinst,v 1.5 2013/02/06 14:18:52 christos Exp $ 13864# natinst: file(1) magic for National Instruments Code Files 13865 13866# 13867# From <egamez@fcfm.buap.mx> Enrique Gamez-Flores 13868# version 1 13869# Many formats still missing, we use, for the moment LabVIEW 13870# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing 13871# 138720 string RSRC National Instruments, 13873# Check if it's a LabVIEW File 13874>8 string LV LabVIEW File, 13875# Check wich kind of file is 13876>>10 string SB Code Resource File, data 13877>>10 string IN Virtual Instrument Program, data 13878>>10 string AR VI Library, data 13879# This is for Menu Libraries 13880>8 string LMNULBVW Portable File Names, data 13881# This is for General Resources 13882>8 string rsc Resources File, data 13883# This is for VXI Package 138840 string VMAP National Instruments, VXI File, data 13885 13886#------------------------------------------------------------------------------ 13887# $File: ncr,v 1.7 2009/09/19 16:28:11 christos Exp $ 13888# ncr: file(1) magic for NCR Tower objects 13889# 13890# contributed by 13891# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa 13892# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP 13893# 138940 beshort 000610 Tower/XP rel 2 object 13895>12 belong >0 not stripped 13896>20 beshort 0407 executable 13897>20 beshort 0410 pure executable 13898>22 beshort >0 - version %ld 138990 beshort 000615 Tower/XP rel 2 object 13900>12 belong >0 not stripped 13901>20 beshort 0407 executable 13902>20 beshort 0410 pure executable 13903>22 beshort >0 - version %ld 139040 beshort 000620 Tower/XP rel 3 object 13905>12 belong >0 not stripped 13906>20 beshort 0407 executable 13907>20 beshort 0410 pure executable 13908>22 beshort >0 - version %ld 139090 beshort 000625 Tower/XP rel 3 object 13910>12 belong >0 not stripped 13911>20 beshort 0407 executable 13912>20 beshort 0410 pure executable 13913>22 beshort >0 - version %ld 139140 beshort 000630 Tower32/600/400 68020 object 13915>12 belong >0 not stripped 13916>20 beshort 0407 executable 13917>20 beshort 0410 pure executable 13918>22 beshort >0 - version %ld 139190 beshort 000640 Tower32/800 68020 13920>18 beshort &020000 w/68881 object 13921>18 beshort &040000 compatible object 13922>18 beshort &060000 object 13923>20 beshort 0407 executable 13924>20 beshort 0413 pure executable 13925>12 belong >0 not stripped 13926>22 beshort >0 - version %ld 139270 beshort 000645 Tower32/800 68010 13928>18 beshort &040000 compatible object 13929>18 beshort &060000 object 13930>20 beshort 0407 executable 13931>20 beshort 0413 pure executable 13932>12 belong >0 not stripped 13933>22 beshort >0 - version %ld 13934 13935#------------------------------------------------------------------------------ 13936# $File: netbsd,v 1.20 2013/01/09 22:37:24 christos Exp $ 13937# netbsd: file(1) magic for NetBSD objects 13938# 13939# All new-style magic numbers are in network byte order. 13940# The old-style magic numbers are indistinguishable from the same magic 13941# numbers used in other systems, and are handled, for all those systems, 13942# in aout. 13943# 13944 139450 belong&0377777777 041400413 a.out NetBSD/i386 demand paged 13946>0 byte &0x80 13947>>20 lelong <4096 shared library 13948>>20 lelong =4096 dynamically linked executable 13949>>20 lelong >4096 dynamically linked executable 13950>0 byte ^0x80 executable 13951>16 lelong >0 not stripped 139520 belong&0377777777 041400410 a.out NetBSD/i386 pure 13953>0 byte &0x80 dynamically linked executable 13954>0 byte ^0x80 executable 13955>16 lelong >0 not stripped 139560 belong&0377777777 041400407 a.out NetBSD/i386 13957>0 byte &0x80 dynamically linked executable 13958>0 byte ^0x80 13959>>0 byte &0x40 position independent 13960>>20 lelong !0 executable 13961>>20 lelong =0 object file 13962>16 lelong >0 not stripped 139630 belong&0377777777 041400507 a.out NetBSD/i386 core 13964>12 string >\0 from '%s' 13965>32 lelong !0 (signal %d) 13966 139670 belong&0377777777 041600413 a.out NetBSD/m68k demand paged 13968>0 byte &0x80 13969>>20 belong <8192 shared library 13970>>20 belong =8192 dynamically linked executable 13971>>20 belong >8192 dynamically linked executable 13972>0 byte ^0x80 executable 13973>16 belong >0 not stripped 139740 belong&0377777777 041600410 a.out NetBSD/m68k pure 13975>0 byte &0x80 dynamically linked executable 13976>0 byte ^0x80 executable 13977>16 belong >0 not stripped 139780 belong&0377777777 041600407 a.out NetBSD/m68k 13979>0 byte &0x80 dynamically linked executable 13980>0 byte ^0x80 13981>>0 byte &0x40 position independent 13982>>20 belong !0 executable 13983>>20 belong =0 object file 13984>16 belong >0 not stripped 139850 belong&0377777777 041600507 a.out NetBSD/m68k core 13986>12 string >\0 from '%s' 13987>32 belong !0 (signal %d) 13988 139890 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged 13990>0 byte &0x80 13991>>20 belong <4096 shared library 13992>>20 belong =4096 dynamically linked executable 13993>>20 belong >4096 dynamically linked executable 13994>0 byte ^0x80 executable 13995>16 belong >0 not stripped 139960 belong&0377777777 042000410 a.out NetBSD/m68k4k pure 13997>0 byte &0x80 dynamically linked executable 13998>0 byte ^0x80 executable 13999>16 belong >0 not stripped 140000 belong&0377777777 042000407 a.out NetBSD/m68k4k 14001>0 byte &0x80 dynamically linked executable 14002>0 byte ^0x80 14003>>0 byte &0x40 position independent 14004>>20 belong !0 executable 14005>>20 belong =0 object file 14006>16 belong >0 not stripped 140070 belong&0377777777 042000507 a.out NetBSD/m68k4k core 14008>12 string >\0 from '%s' 14009>32 belong !0 (signal %d) 14010 140110 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged 14012>0 byte &0x80 14013>>20 lelong <4096 shared library 14014>>20 lelong =4096 dynamically linked executable 14015>>20 lelong >4096 dynamically linked executable 14016>0 byte ^0x80 executable 14017>16 lelong >0 not stripped 140180 belong&0377777777 042200410 a.out NetBSD/ns32532 pure 14019>0 byte &0x80 dynamically linked executable 14020>0 byte ^0x80 executable 14021>16 lelong >0 not stripped 140220 belong&0377777777 042200407 a.out NetBSD/ns32532 14023>0 byte &0x80 dynamically linked executable 14024>0 byte ^0x80 14025>>0 byte &0x40 position independent 14026>>20 lelong !0 executable 14027>>20 lelong =0 object file 14028>16 lelong >0 not stripped 140290 belong&0377777777 042200507 a.out NetBSD/ns32532 core 14030>12 string >\0 from '%s' 14031>32 lelong !0 (signal %d) 14032 140330 belong&0377777777 045200507 a.out NetBSD/powerpc core 14034>12 string >\0 from '%s' 14035 140360 belong&0377777777 042400413 a.out NetBSD/sparc demand paged 14037>0 byte &0x80 14038>>20 belong <8192 shared library 14039>>20 belong =8192 dynamically linked executable 14040>>20 belong >8192 dynamically linked executable 14041>0 byte ^0x80 executable 14042>16 belong >0 not stripped 140430 belong&0377777777 042400410 a.out NetBSD/sparc pure 14044>0 byte &0x80 dynamically linked executable 14045>0 byte ^0x80 executable 14046>16 belong >0 not stripped 140470 belong&0377777777 042400407 a.out NetBSD/sparc 14048>0 byte &0x80 dynamically linked executable 14049>0 byte ^0x80 14050>>0 byte &0x40 position independent 14051>>20 belong !0 executable 14052>>20 belong =0 object file 14053>16 belong >0 not stripped 140540 belong&0377777777 042400507 a.out NetBSD/sparc core 14055>12 string >\0 from '%s' 14056>32 belong !0 (signal %d) 14057 140580 belong&0377777777 042600413 a.out NetBSD/pmax demand paged 14059>0 byte &0x80 14060>>20 lelong <4096 shared library 14061>>20 lelong =4096 dynamically linked executable 14062>>20 lelong >4096 dynamically linked executable 14063>0 byte ^0x80 executable 14064>16 lelong >0 not stripped 140650 belong&0377777777 042600410 a.out NetBSD/pmax pure 14066>0 byte &0x80 dynamically linked executable 14067>0 byte ^0x80 executable 14068>16 lelong >0 not stripped 140690 belong&0377777777 042600407 a.out NetBSD/pmax 14070>0 byte &0x80 dynamically linked executable 14071>0 byte ^0x80 14072>>0 byte &0x40 position independent 14073>>20 lelong !0 executable 14074>>20 lelong =0 object file 14075>16 lelong >0 not stripped 140760 belong&0377777777 042600507 a.out NetBSD/pmax core 14077>12 string >\0 from '%s' 14078>32 lelong !0 (signal %d) 14079 140800 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged 14081>0 byte &0x80 14082>>20 lelong <4096 shared library 14083>>20 lelong =4096 dynamically linked executable 14084>>20 lelong >4096 dynamically linked executable 14085>0 byte ^0x80 executable 14086>16 lelong >0 not stripped 140870 belong&0377777777 043000410 a.out NetBSD/vax 1k pure 14088>0 byte &0x80 dynamically linked executable 14089>0 byte ^0x80 executable 14090>16 lelong >0 not stripped 140910 belong&0377777777 043000407 a.out NetBSD/vax 1k 14092>0 byte &0x80 dynamically linked executable 14093>0 byte ^0x80 14094>>0 byte &0x40 position independent 14095>>20 lelong !0 executable 14096>>20 lelong =0 object file 14097>16 lelong >0 not stripped 140980 belong&0377777777 043000507 a.out NetBSD/vax 1k core 14099>12 string >\0 from '%s' 14100>32 lelong !0 (signal %d) 14101 141020 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged 14103>0 byte &0x80 14104>>20 lelong <4096 shared library 14105>>20 lelong =4096 dynamically linked executable 14106>>20 lelong >4096 dynamically linked executable 14107>0 byte ^0x80 executable 14108>16 lelong >0 not stripped 141090 belong&0377777777 045400410 a.out NetBSD/vax 4k pure 14110>0 byte &0x80 dynamically linked executable 14111>0 byte ^0x80 executable 14112>16 lelong >0 not stripped 141130 belong&0377777777 045400407 a.out NetBSD/vax 4k 14114>0 byte &0x80 dynamically linked executable 14115>0 byte ^0x80 14116>>0 byte &0x40 position independent 14117>>20 lelong !0 executable 14118>>20 lelong =0 object file 14119>16 lelong >0 not stripped 141200 belong&0377777777 045400507 a.out NetBSD/vax 4k core 14121>12 string >\0 from '%s' 14122>32 lelong !0 (signal %d) 14123 14124# NetBSD/alpha does not support (and has never supported) a.out objects, 14125# so no rules are provided for them. NetBSD/alpha ELF objects are 14126# dealt with in "elf". 141270 lelong 0x00070185 ECOFF NetBSD/alpha binary 14128>10 leshort 0x0001 not stripped 14129>10 leshort 0x0000 stripped 141300 belong&0377777777 043200507 a.out NetBSD/alpha core 14131>12 string >\0 from '%s' 14132>32 lelong !0 (signal %d) 14133 141340 belong&0377777777 043400413 a.out NetBSD/mips demand paged 14135>0 byte &0x80 14136>>20 belong <8192 shared library 14137>>20 belong =8192 dynamically linked executable 14138>>20 belong >8192 dynamically linked executable 14139>0 byte ^0x80 executable 14140>16 belong >0 not stripped 141410 belong&0377777777 043400410 a.out NetBSD/mips pure 14142>0 byte &0x80 dynamically linked executable 14143>0 byte ^0x80 executable 14144>16 belong >0 not stripped 141450 belong&0377777777 043400407 a.out NetBSD/mips 14146>0 byte &0x80 dynamically linked executable 14147>0 byte ^0x80 14148>>0 byte &0x40 position independent 14149>>20 belong !0 executable 14150>>20 belong =0 object file 14151>16 belong >0 not stripped 141520 belong&0377777777 043400507 a.out NetBSD/mips core 14153>12 string >\0 from '%s' 14154>32 belong !0 (signal %d) 14155 141560 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged 14157>0 byte &0x80 14158>>20 lelong <4096 shared library 14159>>20 lelong =4096 dynamically linked executable 14160>>20 lelong >4096 dynamically linked executable 14161>0 byte ^0x80 executable 14162>16 lelong >0 not stripped 141630 belong&0377777777 043600410 a.out NetBSD/arm32 pure 14164>0 byte &0x80 dynamically linked executable 14165>0 byte ^0x80 executable 14166>16 lelong >0 not stripped 141670 belong&0377777777 043600407 a.out NetBSD/arm32 14168>0 byte &0x80 dynamically linked executable 14169>0 byte ^0x80 14170>>0 byte &0x40 position independent 14171>>20 lelong !0 executable 14172>>20 lelong =0 object file 14173>16 lelong >0 not stripped 14174# NetBSD/arm26 has always used ELF objects, but it shares a core file 14175# format with NetBSD/arm32. 141760 belong&0377777777 043600507 a.out NetBSD/arm core 14177>12 string >\0 from '%s' 14178>32 lelong !0 (signal %d) 14179 14180# Kernel core dump format 141810 belong&0x0000ffff 0x00008fca NetBSD kernel core file 14182>0 belong&0x03ff0000 0x00000000 \b, Unknown 14183>0 belong&0x03ff0000 0x00001000 \b, sun 68010/68020 14184>0 belong&0x03ff0000 0x00020000 \b, sun 68020 14185>0 belong&0x03ff0000 0x00640000 \b, 386 PC 14186>0 belong&0x03ff0000 0x00860000 \b, i386 BSD 14187>0 belong&0x03ff0000 0x00870000 \b, m68k BSD (8K pages) 14188>0 belong&0x03ff0000 0x00880000 \b, m68k BSD (4K pages) 14189>0 belong&0x03ff0000 0x00890000 \b, ns32532 BSD 14190>0 belong&0x03ff0000 0x008a0000 \b, sparc/32 BSD 14191>0 belong&0x03ff0000 0x008b0000 \b, pmax BSD 14192>0 belong&0x03ff0000 0x008c0000 \b, vax BSD (1K pages) 14193>0 belong&0x03ff0000 0x008d0000 \b, alpha BSD 14194>0 belong&0x03ff0000 0x008e0000 \b, mips BSD (Big Endian) 14195>0 belong&0x03ff0000 0x008f0000 \b, arm6 BSD 14196>0 belong&0x03ff0000 0x00900000 \b, m68k BSD (2K pages) 14197>0 belong&0x03ff0000 0x00910000 \b, sh3 BSD 14198>0 belong&0x03ff0000 0x00920000 \b, ppc BSD (Big Endian) 14199>0 belong&0x03ff0000 0x00930000 \b, vax BSD (4K pages) 14200>0 belong&0x03ff0000 0x00940000 \b, mips1 BSD 14201>0 belong&0x03ff0000 0x00950000 \b, mips2 BSD 14202>0 belong&0x03ff0000 0x00960000 \b, parisc BSD 14203>0 belong&0x03ff0000 0x00970000 \b, sh5/64 BSD 14204>0 belong&0x03ff0000 0x00980000 \b, sparc/64 BSD 14205>0 belong&0x03ff0000 0x00990000 \b, amd64 BSD 14206>0 belong&0x03ff0000 0x009a0000 \b, hp200 (68010) BSD 14207>0 belong&0x03ff0000 0x009b0000 \b, hp300 (68020+68881) BSD 14208>0 belong&0x03ff0000 0x009b0000 \b, hp300 (68020+68881) BSD 14209>0 belong&0x03ff0000 0x00c80000 \b, hp200 14210>0 belong&0x03ff0000 0x020b0000 \b, hp300 (68020+68881) HP-UX 14211>0 belong&0x03ff0000 0x020c0000 \b, hp300 (68020+68881) HP-UX 14212>0 belong&0xfc000000 0x04000000 \b, CPU 14213>0 belong&0xfc000000 0x08000000 \b, DATA 14214>0 belong&0xfc000000 0x10000000 \b, STACK 14215>4 leshort x \b, (headersize = %d 14216>6 leshort x \b, segmentsize = %d 14217>6 lelong x \b, segments = %d) 14218 14219#------------------------------------------------------------------------------ 14220# $File: netscape,v 1.6 2009/09/19 16:28:11 christos Exp $ 14221# netscape: file(1) magic for Netscape files 14222# "H. Nanosecond" <aldomel@ix.netcom.com> 14223# version 3 and 4 I think 14224# 14225 14226# Netscape Address book .nab 142270 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book 14228 14229# Netscape Communicator address book 142300 string \000\017\102\111 Netscape Communicator address book 14231 14232# .snm Caches 142330 string #\ Netscape\ folder\ cache Netscape folder cache 142340 string \000\036\204\220\000 Netscape folder cache 14235# .n2p 14236# Net 2 Phone 14237#0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060 142380 string SX961999 Net2phone 14239 14240# 14241#This is files ending in .art, FIXME add more rules 142420 string JG\004\016\0\0\0\0 ART 14243 14244#------------------------------------------------------------------------------ 14245# $File: netware,v 1.4 2009/09/19 16:28:11 christos Exp $ 14246# netware: file(1) magic for NetWare Loadable Modules (NLMs) 14247# From: Mads Martin Joergensen <mmj@suse.de> 14248 142490 string NetWare\ Loadable\ Module NetWare Loadable Module 14250 14251#------------------------------------------------------------------------------ 14252# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $ 14253# news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews") 14254# 142550 string StartFontMetrics ASCII font metrics 142560 string StartFont ASCII font bits 142570 belong 0x137A2944 NeWS bitmap font 142580 belong 0x137A2947 NeWS font family 142590 belong 0x137A2950 scalable OpenFont binary 142600 belong 0x137A2951 encrypted scalable OpenFont binary 142618 belong 0x137A2B45 X11/NeWS bitmap font 142628 belong 0x137A2B48 X11/NeWS font family 14263 14264#------------------------------------------------------------------------------ 14265# $File: nitpicker,v 1.4 2009/09/19 16:28:11 christos Exp $ 14266# nitpicker: file(1) magic for Flowfiles. 14267# From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de 142680 string NPFF NItpicker Flow File 14269>4 byte x V%d. 14270>5 byte x %d 14271>6 bedate x started: %s 14272>10 bedate x stopped: %s 14273>14 belong x Bytes: %u 14274>18 belong x Bytes1: %u 14275>22 belong x Flows: %u 14276>26 belong x Pkts: %u 14277 14278#------------------------------------------------------------------------------ 14279# $File: oasis,v 1.1 2011/03/15 02:09:38 christos Exp $ 14280# OASIS 14281# Summary: OASIS stream file 14282# Long descripton: Open Artwork System Interchange Standard 14283# File extension: .oas 14284# Full name: Ben Cowley (bcowley@broadcom.com) 14285# Philip Dixon (pdixon@broadcom.com) 14286# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf 14287# (see page 3) 142880 string %SEMI-OASIS\r\n OASIS Stream file 14289 14290#------------------------------------------------------------------------------ 14291# $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $ 14292# ocaml: file(1) magic for Objective Caml files. 142930 string Caml1999 OCaml 14294>8 string X exec file 14295>8 string I interface file (.cmi) 14296>8 string O object file (.cmo) 14297>8 string A library file (.cma) 14298>8 string Y native object file (.cmx) 14299>8 string Z native library file (.cmxa) 14300>8 string M abstract syntax tree implementation file 14301>8 string N abstract syntax tree interface file 14302>9 string >\0 (Version %3.3s) 14303 14304#------------------------------------------------------------------------------ 14305# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $ 14306# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org> 143070 string Octave-1-L Octave binary data (little endian) 143080 string Octave-1-B Octave binary data (big endian) 14309 14310#------------------------------------------------------------------------------ 14311# $File: ole2compounddocs,v 1.4 2009/09/19 16:28:11 christos Exp $ 14312# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured 14313# storage (http://en.wikipedia.org/wiki/Structured_Storage) 14314# Additional tests for OLE 2 Compound Documents should be under this recipe. 14315 143160 string \320\317\021\340\241\261\032\341 OLE 2 Compound Document 14317# - Microstation V8 DGN files (www.bentley.com) 14318# Last update on 10/23/2006 by Lester Hightower 14319> 0x480 string D\000g\000n\000~\000H : Microstation V8 DGN 14320# - Visio documents 14321# Last update on 10/23/2006 by Lester Hightower 14322> 0x480 string V\000i\000s\000i\000o\000D\000o\000c : Visio Document 14323 14324#------------------------------------------------------------------------------ 14325# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $ 14326# olf: file(1) magic for OLF executables 14327# 14328# We have to check the byte order flag to see what byte order all the 14329# other stuff in the header is in. 14330# 14331# MIPS R3000 may also be for MIPS R2000. 14332# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 14333# 14334# Created by Erik Theisen <etheisen@openbsd.org> 14335# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com> 143360 string \177OLF OLF 14337>4 byte 0 invalid class 14338>4 byte 1 32-bit 14339>4 byte 2 64-bit 14340>7 byte 0 invalid os 14341>7 byte 1 OpenBSD 14342>7 byte 2 NetBSD 14343>7 byte 3 FreeBSD 14344>7 byte 4 4.4BSD 14345>7 byte 5 Linux 14346>7 byte 6 SVR4 14347>7 byte 7 esix 14348>7 byte 8 Solaris 14349>7 byte 9 Irix 14350>7 byte 10 SCO 14351>7 byte 11 Dell 14352>7 byte 12 NCR 14353>5 byte 0 invalid byte order 14354>5 byte 1 LSB 14355>>16 leshort 0 no file type, 14356>>16 leshort 1 relocatable, 14357>>16 leshort 2 executable, 14358>>16 leshort 3 shared object, 14359# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> 14360# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> 14361>>16 leshort 4 core file 14362>>>(0x38+0xcc) string >\0 of '%s' 14363>>>(0x38+0x10) lelong >0 (signal %d), 14364>>16 leshort &0xff00 processor-specific, 14365>>18 leshort 0 no machine, 14366>>18 leshort 1 AT&T WE32100 - invalid byte order, 14367>>18 leshort 2 SPARC - invalid byte order, 14368>>18 leshort 3 Intel 80386, 14369>>18 leshort 4 Motorola 68000 - invalid byte order, 14370>>18 leshort 5 Motorola 88000 - invalid byte order, 14371>>18 leshort 6 Intel 80486, 14372>>18 leshort 7 Intel 80860, 14373>>18 leshort 8 MIPS R3000_BE - invalid byte order, 14374>>18 leshort 9 Amdahl - invalid byte order, 14375>>18 leshort 10 MIPS R3000_LE, 14376>>18 leshort 11 RS6000 - invalid byte order, 14377>>18 leshort 15 PA-RISC - invalid byte order, 14378>>18 leshort 16 nCUBE, 14379>>18 leshort 17 VPP500, 14380>>18 leshort 18 SPARC32PLUS, 14381>>18 leshort 20 PowerPC, 14382>>18 leshort 0x9026 Alpha, 14383>>20 lelong 0 invalid version 14384>>20 lelong 1 version 1 14385>>36 lelong 1 MathCoPro/FPU/MAU Required 14386>8 string >\0 (%s) 14387>5 byte 2 MSB 14388>>16 beshort 0 no file type, 14389>>16 beshort 1 relocatable, 14390>>16 beshort 2 executable, 14391>>16 beshort 3 shared object, 14392>>16 beshort 4 core file, 14393>>>(0x38+0xcc) string >\0 of '%s' 14394>>>(0x38+0x10) belong >0 (signal %d), 14395>>16 beshort &0xff00 processor-specific, 14396>>18 beshort 0 no machine, 14397>>18 beshort 1 AT&T WE32100, 14398>>18 beshort 2 SPARC, 14399>>18 beshort 3 Intel 80386 - invalid byte order, 14400>>18 beshort 4 Motorola 68000, 14401>>18 beshort 5 Motorola 88000, 14402>>18 beshort 6 Intel 80486 - invalid byte order, 14403>>18 beshort 7 Intel 80860, 14404>>18 beshort 8 MIPS R3000_BE, 14405>>18 beshort 9 Amdahl, 14406>>18 beshort 10 MIPS R3000_LE - invalid byte order, 14407>>18 beshort 11 RS6000, 14408>>18 beshort 15 PA-RISC, 14409>>18 beshort 16 nCUBE, 14410>>18 beshort 17 VPP500, 14411>>18 beshort 18 SPARC32PLUS, 14412>>18 beshort 20 PowerPC or cisco 4500, 14413>>18 beshort 21 cisco 7500, 14414>>18 beshort 24 cisco SVIP, 14415>>18 beshort 25 cisco 7200, 14416>>18 beshort 36 cisco 12000, 14417>>18 beshort 0x9026 Alpha, 14418>>20 belong 0 invalid version 14419>>20 belong 1 version 1 14420>>36 belong 1 MathCoPro/FPU/MAU Required 14421 14422#------------------------------------------------------------------------------ 14423# $File: os2,v 1.7 2009/09/19 16:28:11 christos Exp $ 14424# os2: file(1) magic for OS/2 files 14425# 14426 14427# Provided 1998/08/22 by 14428# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 144291 search/1 InternetShortcut MS Windows 95 Internet shortcut text 14430>24 search/1 >\ (URL=<%s>) 14431 14432# OS/2 URL objects 14433# Provided 1998/08/22 by 14434# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 14435#0 string http: OS/2 URL object text 14436#>5 string >\ (WWW) <http:%s> 14437#0 string mailto: OS/2 URL object text 14438#>7 string >\ (email) <%s> 14439#0 string news: OS/2 URL object text 14440#>5 string >\ (Usenet) <%s> 14441#0 string ftp: OS/2 URL object text 14442#>4 string >\ (FTP) <ftp:%s> 14443#0 string file: OS/2 URL object text 14444#>5 string >\ (Local file) <%s> 14445 14446# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com) 14447# Carl Hauser (chauser.parc@xerox.com) and 14448# Marcus Groeber (marcusg@ph-cip.uni-koeln.de) 14449# list the following header format in inf02a.doc: 14450# 14451# int16 ID; // ID magic word (5348h = "HS") 14452# int8 unknown1; // unknown purpose, could be third letter of ID 14453# int8 flags; // probably a flag word... 14454# // bit 0: set if INF style file 14455# // bit 4: set if HLP style file 14456# // patching this byte allows reading HLP files 14457# // using the VIEW command, while help files 14458# // seem to work with INF settings here as well. 14459# int16 hdrsize; // total size of header 14460# int16 unknown2; // unknown purpose 14461# 144620 string HSP\x01\x9b\x00 OS/2 INF 14463>107 string >0 (%s) 144640 string HSP\x10\x9b\x00 OS/2 HLP 14465>107 string >0 (%s) 14466 14467# OS/2 INI (this is a guess) 144680 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI 14469 14470#------------------------------------------------------------------------------ 14471# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $ 14472# os400: file(1) magic for IBM OS/400 files 14473# 14474# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com 14475# In spite of its quite variable format (due to internal memory page 14476# length differences between CISC and RISC versions of the OS) the 14477# SAVF structure hasn't suitable offsets to identify the catalog 14478# header in the first descriptor where there are some useful infos, 14479# so we must search in a somewhat large area for a particular string 14480# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore 14481# descriptor space) preceded by a two byte constant. 14482# 144831090 search/7393 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data 14484>&212 byte 0x01 \b, created with SAVOBJ 14485>&212 byte 0x02 \b, created with SAVLIB 14486>&212 byte 0x07 \b, created with SAVCFG 14487>&212 byte 0x08 \b, created with SAVSECDTA 14488>&212 byte 0x0A \b, created with SAVSECDTA 14489>&212 byte 0x0B \b, created with SAVDLO 14490>&212 byte 0x0D \b, created with SAVLICPGM 14491>&212 byte 0x11 \b, created with SAVCHGOBJ 14492>&213 byte 0x44 \b, at least V5R4 to open 14493>&213 byte 0x43 \b, at least V5R3 to open 14494>&213 byte 0x42 \b, at least V5R2 to open 14495>&213 byte 0x41 \b, at least V5R1 to open 14496>&213 byte 0x40 \b, at least V4R5 to open 14497>&213 byte 0x3F \b, at least V4R4 to open 14498>&213 byte 0x3E \b, at least V4R3 to open 14499>&213 byte 0x3C \b, at least V4R2 to open 14500>&213 byte 0x3D \b, at least V4R1M4 to open 14501>&213 byte 0x3B \b, at least V4R1 to open 14502>&213 byte 0x3A \b, at least V3R7 to open 14503>&213 byte 0x35 \b, at least V3R6 to open 14504>&213 byte 0x36 \b, at least V3R2 to open 14505>&213 byte 0x34 \b, at least V3R1 to open 14506>&213 byte 0x31 \b, at least V3R0M5 to open 14507>&213 byte 0x30 \b, at least V2R3 to open 14508 14509#------------------------------------------------------------------------------ 14510# $File: os9,v 1.7 2011/05/13 22:15:54 christos Exp $ 14511# 14512# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved. 14513# 14514# Redistribution and use in source and binary forms, with or without 14515# modification, are permitted provided that the following conditions 14516# are met: 14517# 1. Redistributions of source code must retain the above copyright 14518# notice, this list of conditions and the following disclaimer. 14519# 2. Redistributions in binary form must reproduce the above copyright 14520# notice, this list of conditions and the following disclaimer in the 14521# documentation and/or other materials provided with the distribution. 14522# 14523# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 14524# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 14525# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 14526# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 14527# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 14528# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; 14529# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 14530# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 14531# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 14532# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 14533# 14534# 14535# 14536# OS9/6809 module descriptions: 14537# 145380 beshort 0x87CD OS9/6809 module: 14539# 14540>6 byte&0x0f 0x00 non-executable 14541>6 byte&0x0f 0x01 machine language 14542>6 byte&0x0f 0x02 BASIC I-code 14543>6 byte&0x0f 0x03 Pascal P-code 14544>6 byte&0x0f 0x04 C I-code 14545>6 byte&0x0f 0x05 COBOL I-code 14546>6 byte&0x0f 0x06 Fortran I-code 14547# 14548>6 byte&0xf0 0x10 program executable 14549>6 byte&0xf0 0x20 subroutine 14550>6 byte&0xf0 0x30 multi-module 14551>6 byte&0xf0 0x40 data module 14552# 14553>6 byte&0xf0 0xC0 system module 14554>6 byte&0xf0 0xD0 file manager 14555>6 byte&0xf0 0xE0 device driver 14556>6 byte&0xf0 0xF0 device descriptor 14557# 14558# OS9/m68k stuff (to be continued) 14559# 145600 beshort 0x4AFC OS9/68K module: 14561# 14562# attr 14563>0x14 byte&0x80 0x80 re-entrant 14564>0x14 byte&0x40 0x40 ghost 14565>0x14 byte&0x20 0x20 system-state 14566# 14567# lang: 14568# 14569>0x13 byte 1 machine language 14570>0x13 byte 2 BASIC I-code 14571>0x13 byte 3 Pascal P-code 14572>0x13 byte 4 C I-code 14573>0x13 byte 5 COBOL I-code 14574>0x13 byte 6 Fortran I-code 14575# 14576# 14577# type: 14578# 14579>0x12 byte 1 program executable 14580>0x12 byte 2 subroutine 14581>0x12 byte 3 multi-module 14582>0x12 byte 4 data module 14583>0x12 byte 11 trap library 14584>0x12 byte 12 system module 14585>0x12 byte 13 file manager 14586>0x12 byte 14 device driver 14587>0x12 byte 15 device descriptor 14588 14589#------------------------------------------------------------------------------ 14590# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $ 14591# 14592# Mach magic number info 14593# 145940 long 0xefbe OSF/Rose object 14595# I386 magic number info 14596# 145970 short 0565 i386 COFF object 14598 14599#------------------------------------------------------------------------------ 14600# $File: palm,v 1.9 2012/01/16 15:16:43 christos Exp $ 14601# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks 14602# 14603# Brian Lalor <blalor@hcirisc.cs.binghamton.edu> 14604 14605# These are weak, byte 59 is not guaranteed to be 0 and there are 14606# 8 character identifiers at byte 60, one I found for appl is BIGb. 14607# What are the possibilities and where is this documented? 14608 14609# appl 14610#59 byte \0 14611#>60 string appl PalmOS application 14612#>0 string >\0 "%s" 14613# TEXt 14614#59 byte \0 14615#>60 belong TEXt AportisDoc file 14616#>0 string >\0 "%s" 14617# HACK 14618#59 byte \0 14619#>60 string HACK HackMaster hack 14620#>0 string >\0 "%s" 14621 14622# Variety of PalmOS document types 14623# Michael-John Turner <mj@debian.org> 14624# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType 1462560 string BVokBDIC BDicty PalmOS document 14626>0 string >\0 "%s" 1462760 string DB99DBOS DB PalmOS document 14628>0 string >\0 "%s" 1462960 string vIMGView FireViewer/ImageViewer PalmOS document 14630>0 string >\0 "%s" 1463160 string PmDBPmDB HanDBase PalmOS document 14632>0 string >\0 "%s" 1463360 string InfoINDB InfoView PalmOS document 14634>0 string >\0 "%s" 1463560 string ToGoToGo iSilo PalmOS document 14636>0 string >\0 "%s" 1463760 string JfDbJBas JFile PalmOS document 14638>0 string >\0 "%s" 1463960 string JfDbJFil JFile Pro PalmOS document 14640>0 string >\0 "%s" 1464160 string DATALSdb List PalmOS document 14642>0 string >\0 "%s" 1464360 string Mdb1Mdb1 MobileDB PalmOS document 14644>0 string >\0 "%s" 1464560 string PNRdPPrs PeanutPress PalmOS document 14646>0 string >\0 "%s" 1464760 string DataPlkr Plucker PalmOS document 14648>0 string >\0 "%s" 1464960 string DataSprd QuickSheet PalmOS document 14650>0 string >\0 "%s" 1465160 string SM01SMem SuperMemo PalmOS document 14652>0 string >\0 "%s" 1465360 string TEXtTlDc TealDoc PalmOS document 14654>0 string >\0 "%s" 1465560 string InfoTlIf TealInfo PalmOS document 14656>0 string >\0 "%s" 1465760 string DataTlMl TealMeal PalmOS document 14658>0 string >\0 "%s" 1465960 string DataTlPt TealPaint PalmOS document 14660>0 string >\0 "%s" 1466160 string dataTDBP ThinkDB PalmOS document 14662>0 string >\0 "%s" 1466360 string TdatTide Tides PalmOS document 14664>0 string >\0 "%s" 1466560 string ToRaTRPW TomeRaider PalmOS document 14666>0 string >\0 "%s" 14667 14668# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net) 14669# For version 1.xx zTXTs, outputs version and numbers of bookmarks and 14670# annotations. 14671# For other versions, just outputs version. 14672# 1467360 string zTXT A GutenPalm zTXT e-book 14674>0 string >\0 "%s" 14675>(0x4E.L) byte 0 14676>>(0x4E.L+1) byte x (v0.%02d) 14677>(0x4E.L) byte 1 14678>>(0x4E.L+1) byte x (v1.%02d) 14679>>>(0x4E.L+10) beshort >0 14680>>>>(0x4E.L+10) beshort <2 - 1 bookmark 14681>>>>(0x4E.L+10) beshort >1 - %d bookmarks 14682>>>(0x4E.L+14) beshort >0 14683>>>>(0x4E.L+14) beshort <2 - 1 annotation 14684>>>>(0x4E.L+14) beshort >1 - %d annotations 14685>(0x4E.L) byte >1 (v%d. 14686>>(0x4E.L+1) byte x %02d) 14687 14688# Palm OS .prc file types 1468960 string libr Palm OS dynamic library data 14690>0 string >\0 "%s" 1469160 string ptch Palm OS operating system patch data 14692>0 string >\0 "%s" 14693 14694# Mobipocket (www.mobipocket.com), donated by Carl Witty 1469560 string BOOKMOBI Mobipocket E-book 14696>0 string >\0 "%s" 14697 14698#------------------------------------------------------------------------------ 14699# $File: parix,v 1.4 2009/09/19 16:28:11 christos Exp $ 14700# 14701# Parix COFF executables 14702# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de> 14703# 147040 beshort&0xfff 0xACE PARIX 14705>0 byte&0xf0 0x80 T800 14706>0 byte&0xf0 0x90 T9000 14707>19 byte&0x02 0x02 executable 14708>19 byte&0x02 0x00 object 14709>19 byte&0x0c 0x00 not stripped 14710#------------------------------------------------------------------------------ 14711# $File: parrot,v 1.1 2010/07/08 20:18:40 christos Exp $ 14712# parrot: file(1) magic for Parrot Virtual Machine 14713# URL: http://www.lua.org/ 14714# From: Lubomir Rintel <lkundrak@v3.sk> 14715 14716# Compiled Parrot byte code 147170 string \376PBC\r\n\032\n Parrot bytecode 14718>64 byte x %d. 14719>72 byte x \b%d, 14720>8 byte >0 %d byte words, 14721>16 byte 0 little-endian, 14722>16 byte 1 big-endian, 14723>32 byte 0 IEEE-754 8 byte double floats, 14724>32 byte 1 x86 12 byte long double floats, 14725>32 byte 2 IEEE-754 16 byte long double floats, 14726>32 byte 3 MIPS 16 byte long double floats, 14727>32 byte 4 AIX 16 byte long double floats, 14728>32 byte 5 4-byte floats, 14729>40 byte x Parrot %d. 14730>48 byte x \b%d. 14731>56 byte x \b%d 14732#------------------------------------------------------------------------------ 14733# $File: pascal,v 1.1 2011/12/08 12:12:46 rrt Exp $ 14734# pascal: file(1) magic for Pascal source 14735# 147360 search/8192 (input, Pascal source text 14737!:mime text/x-pascal 147380 regex \^program Pascal source text 14739!:mime text/x-pascal 147400 regex \^record Pascal source text 14741!:mime text/x-pascal 14742 14743#------------------------------------------------------------------------------ 14744# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $ 14745# pbm: file(1) magic for Portable Bitmap files 14746# 14747# XXX - byte order? 14748# 147490 short 0x2a17 "compact bitmap" format (Poskanzer) 14750 14751#------------------------------------------------------------------------------ 14752# $File: pdf,v 1.6 2009/09/19 16:28:11 christos Exp $ 14753# pdf: file(1) magic for Portable Document Format 14754# 14755 147560 string %PDF- PDF document 14757!:mime application/pdf 14758>5 byte x \b, version %c 14759>7 byte x \b.%c 14760 14761# From: Nick Schmalenberger <nick@schmalenberger.us> 14762# Forms Data Format 147630 string %FDF- FDF document 14764>5 byte x \b, version %c 14765>7 byte x \b.%c 14766 14767#------------------------------------------------------------------------------ 14768# $File: pdp,v 1.8 2009/09/19 16:28:11 christos Exp $ 14769# pdp: file(1) magic for PDP-11 executable/object and APL workspace 14770# 147710 lelong 0101555 PDP-11 single precision APL workspace 147720 lelong 0101554 PDP-11 double precision APL workspace 14773# 14774# PDP-11 a.out 14775# 147760 leshort 0407 PDP-11 executable 14777>8 leshort >0 not stripped 14778>15 byte >0 - version %ld 14779 147800 leshort 0401 PDP-11 UNIX/RT ldp 147810 leshort 0405 PDP-11 old overlay 14782 147830 leshort 0410 PDP-11 pure executable 14784>8 leshort >0 not stripped 14785>15 byte >0 - version %ld 14786 147870 leshort 0411 PDP-11 separate I&D executable 14788>8 leshort >0 not stripped 14789>15 byte >0 - version %ld 14790 147910 leshort 0437 PDP-11 kernel overlay 14792 14793# These last three are derived from 2.11BSD file(1) 147940 leshort 0413 PDP-11 demand-paged pure executable 14795>8 leshort >0 not stripped 14796 147970 leshort 0430 PDP-11 overlaid pure executable 14798>8 leshort >0 not stripped 14799 148000 leshort 0431 PDP-11 overlaid separate executable 14801>8 leshort >0 not stripped 14802#------------------------------------------------------------------------------ 14803# $File: perl,v 1.20 2012/06/21 01:16:49 christos Exp $ 14804# perl: file(1) magic for Larry Wall's perl language. 14805# 14806# The `eval' lines recognizes an outrageously clever hack. 14807# Keith Waclena <keith@cerberus.uchicago.edu> 14808# Send additions to <perl5-porters@perl.org> 148090 search/1/w #!\ /bin/perl Perl script text executable 14810!:mime text/x-perl 148110 search/1 eval\ "exec\ /bin/perl Perl script text 14812!:mime text/x-perl 148130 search/1/w #!\ /usr/bin/perl Perl script text executable 14814!:mime text/x-perl 148150 search/1 eval\ "exec\ /usr/bin/perl Perl script text 14816!:mime text/x-perl 148170 search/1/w #!\ /usr/local/bin/perl Perl script text executable 14818!:mime text/x-perl 148190 search/1 eval\ "exec\ /usr/local/bin/perl Perl script text 14820!:mime text/x-perl 148210 search/1 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text 14822!:mime text/x-perl 148230 search/1 #!/usr/bin/env\ perl Perl script text executable 14824!:mime text/x-perl 148250 search/1 #!\ /usr/bin/env\ perl Perl script text executable 14826!:mime text/x-perl 14827 14828# by Dmitry V. Levin and Alexey Tourbin 14829# check the first line 148300 search/1 package 14831>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text 14832!:strength + 10 14833# not 'p', check other lines 148340 search/1 !p 14835>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; 14836>>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text 14837!:strength + 10 14838 14839# Perl POD documents 14840# From: Tom Hukins <tom@eborcom.com> 148410 search/1/W \=pod\n Perl POD document text 148420 search/1/W \n\=pod\n Perl POD document text 148430 search/1/W \=head1\ Perl POD document text 148440 search/1/W \n\=head1\ Perl POD document text 148450 search/1/W \=head2\ Perl POD document text 148460 search/1/W \n\=head2\ Perl POD document text 148470 search/1/W \=encoding\ Perl POD document text 148480 search/1/W \n\=encoding\ Perl POD document text 14849 14850 14851# Perl Storable data files. 148520 string perl-store perl Storable (v0.6) data 14853>4 byte >0 (net-order %d) 14854>>4 byte &01 (network-ordered) 14855>>4 byte =3 (major 1) 14856>>4 byte =2 (major 1) 14857 148580 string pst0 perl Storable (v0.7) data 14859>4 byte >0 14860>>4 byte &01 (network-ordered) 14861>>4 byte =5 (major 2) 14862>>4 byte =4 (major 2) 14863>>5 byte >0 (minor %d) 14864 14865#------------------------------------------------------------------------------ 14866# $File: pgp,v 1.9 2009/09/19 16:28:11 christos Exp $ 14867# pgp: file(1) magic for Pretty Good Privacy 14868# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html 14869# 148700 beshort 0x9900 PGP key public ring 14871!:mime application/x-pgp-keyring 148720 beshort 0x9501 PGP key security ring 14873!:mime application/x-pgp-keyring 148740 beshort 0x9500 PGP key security ring 14875!:mime application/x-pgp-keyring 148760 beshort 0xa600 PGP encrypted data 14877#!:mime application/pgp-encrypted 14878#0 string -----BEGIN\040PGP text/PGP armored data 14879!:mime text/PGP # encoding: armored data 14880#>15 string PUBLIC\040KEY\040BLOCK- public key block 14881#>15 string MESSAGE- message 14882#>15 string SIGNED\040MESSAGE- signed message 14883#>15 string PGP\040SIGNATURE- signature 14884 148852 string ---BEGIN\ PGP\ PUBLIC\ KEY\ BLOCK- PGP public key block 14886!:mime application/pgp-keys 148870 string -----BEGIN\040PGP\40MESSAGE- PGP message 14888!:mime application/pgp 148890 string -----BEGIN\040PGP\40SIGNATURE- PGP signature 14890!:mime application/pgp-signature 14891 14892#------------------------------------------------------------------------------ 14893# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $ 14894# pkgadd: file(1) magic for SysV R4 PKG Datastreams 14895# 148960 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4) 14897!:mime application/x-svr4-package 14898 14899#------------------------------------------------------------------------------ 14900# $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $ 14901# plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables 14902# From: "Stefan A. Haubenthal" <polluks@web.de> 14903# 149040 belong 0x00000107 Plan 9 executable, Motorola 68k 149050 belong 0x000001EB Plan 9 executable, Intel 386 149060 belong 0x00000247 Plan 9 executable, Intel 960 149070 belong 0x000002AB Plan 9 executable, SPARC 149080 belong 0x00000407 Plan 9 executable, MIPS R3000 149090 belong 0x0000048B Plan 9 executable, AT&T DSP 3210 149100 belong 0x00000517 Plan 9 executable, MIPS R4000 BE 149110 belong 0x000005AB Plan 9 executable, AMD 29000 149120 belong 0x00000647 Plan 9 executable, ARM 7-something 149130 belong 0x000006EB Plan 9 executable, PowerPC 149140 belong 0x00000797 Plan 9 executable, MIPS R4000 LE 149150 belong 0x0000084B Plan 9 executable, DEC Alpha 14916 14917#------------------------------------------------------------------------------ 14918# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $ 14919# plus5: file(1) magic for Plus Five's UNIX MUMPS 14920# 14921# XXX - byte order? Paging Hokey.... 14922# 149230 short 0x259 mumps avl global 14924>2 byte >0 (V%d) 14925>6 byte >0 with %d byte name 14926>7 byte >0 and %d byte data cells 149270 short 0x25a mumps blt global 14928>2 byte >0 (V%d) 14929>8 short >0 - %d byte blocks 14930>15 byte 0x00 - P/D format 14931>15 byte 0x01 - P/K/D format 14932>15 byte 0x02 - K/D format 14933>15 byte >0x02 - Bad Flags 14934 14935#------------------------------------------------------------------------------ 14936# $File: printer,v 1.25 2011/05/20 23:31:46 christos Exp $ 14937# printer: file(1) magic for printer-formatted files 14938# 14939 14940# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com) 149410 string %! PostScript document text 14942!:mime application/postscript 14943!:apple ASPSTEXT 14944>2 string PS-Adobe- conforming 14945>>11 string >\0 DSC level %.3s 14946>>>15 string EPS \b, type %s 14947>>>15 string Query \b, type %s 14948>>>15 string ExitServer \b, type %s 14949>>>15 search/1000 %%LanguageLevel:\ 14950>>>>&0 string >\0 \b, Level %s 14951# Some PCs have the annoying habit of adding a ^D as a document separator 149520 string \004%! PostScript document text 14953!:mime application/postscript 14954!:apple ASPSTEXT 14955>3 string PS-Adobe- conforming 14956>>12 string >\0 DSC level %.3s 14957>>>16 string EPS \b, type %s 14958>>>16 string Query \b, type %s 14959>>>16 string ExitServer \b, type %s 14960>>>16 search/1000 %%LanguageLevel:\ 14961>>>>&0 string >\0 \b, Level %s 149620 string \033%-12345X%!PS PostScript document 14963 14964# DOS EPS Binary File Header 14965# From: Ed Sznyter <ews@Black.Market.NET> 149660 belong 0xC5D0D3C6 DOS EPS Binary File 14967>4 long >0 Postscript starts at byte %d 14968>>8 long >0 length %d 14969>>>12 long >0 Metafile starts at byte %d 14970>>>>16 long >0 length %d 14971>>>20 long >0 TIFF starts at byte %d 14972>>>>24 long >0 length %d 14973 14974# Summary: Adobe's PostScript Printer Description File 14975# Extension: .ppd 14976# Reference: http://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8 14977# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr> 14978# 149790 string *PPD-Adobe:\x20 PPD file 14980>&0 string x \b, version %s 14981 14982# HP Printer Job Language 149830 string \033%-12345X@PJL HP Printer Job Language data 14984# HP Printer Job Language 14985# The header found on Win95 HP plot files is the "Silliest Thing possible" 14986# (TM) 14987# Every driver puts the language at some random position, with random case 14988# (LANGUAGE and Language) 14989# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10 14990# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de> 14991# 149920 string \033%-12345X@PJL HP Printer Job Language data 14993>&0 string >\0 %s 14994>>&0 string >\0 %s 14995>>>&0 string >\0 %s 14996>>>>&0 string >\0 %s 14997#>15 string \ ENTER\ LANGUAGE\ = 14998#>31 string PostScript PostScript 14999 15000# From: Stefan Thurner <thurners@nicsys.de> 150010 string \033%-12345X@PJL 15002>&0 search/10000 %! PJL encapsulated PostScript document text 15003 15004# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com) 150050 string \033E\033 HP PCL printer data 15006>3 string \&l0A - default page size 15007>3 string \&l1A - US executive page size 15008>3 string \&l2A - US letter page size 15009>3 string \&l3A - US legal page size 15010>3 string \&l26A - A4 page size 15011>3 string \&l80A - Monarch envelope size 15012>3 string \&l81A - No. 10 envelope size 15013>3 string \&l90A - Intl. DL envelope size 15014>3 string \&l91A - Intl. C5 envelope size 15015>3 string \&l100A - Intl. B5 envelope size 15016>3 string \&l-81A - No. 10 envelope size (landscape) 15017>3 string \&l-90A - Intl. DL envelope size (landscape) 15018 15019# IMAGEN printer-ready files: 150200 string @document( Imagen printer 15021# this only works if "language xxx" is first item in Imagen header. 15022>10 string language\ impress (imPRESS data) 15023>10 string language\ daisy (daisywheel text) 15024>10 string language\ diablo (daisywheel text) 15025>10 string language\ printer (line printer emulation) 15026>10 string language\ tektronix (Tektronix 4014 emulation) 15027# Add any other languages that your Imagen uses - remember 15028# to keep the word `text' if the file is human-readable. 15029# [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)] 15030# 15031# Now magic for IMAGEN font files... 150320 string Rast RST-format raster font data 15033>45 string >0 face %s 15034# From Jukka Ukkonen 150350 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data 15036 15037# From <mike@flyn.org> 15038# These are the /etc/magic entries to decode data sent to an Epson printer. 150390 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data 15040 15041 15042#------------------------------------------------------------------------------ 15043# zenographics: file(1) magic for Zenographics ZjStream printer data 15044# Rick Richardson rickr@mn.rr.com 150450 string JZJZ 15046>0x12 string ZZ Zenographics ZjStream printer data (big-endian) 150470 string ZJZJ 15048>0x12 string ZZ Zenographics ZjStream printer data (little-endian) 15049 15050 15051#------------------------------------------------------------------------------ 15052# Oak Technologies printer stream 15053# Rick Richardson <rickr@mn.rr.com> 150540 string OAK 15055>0x07 byte 0 15056>0x0b byte 0 Oak Technologies printer stream 15057 15058# This would otherwise be recognized as PostScript - nick@debian.org 150590 string %!VMF SunClock's Vector Map Format data 15060 15061#------------------------------------------------------------------------------ 15062# HP LaserJet 1000 series downloadable firmware file 150630 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware 15064 15065# From: Paolo <oopla@users.sf.net> 15066# Epson ESC/Page, ESC/PageColor 150670 string \x1b\x01@EJL Epson ESC/Page language printer data 15068 15069#------------------------------------------------------------------------------ 15070# $File: project,v 1.4 2009/09/19 16:28:11 christos Exp $ 15071# project: file(1) magic for Project management 15072# 15073# Magic strings for ftnchek project files. Alexander Mai 150740 string FTNCHEK_\ P project file for ftnchek 15075>10 string 1 version 2.7 15076>10 string 2 version 2.8 to 2.10 15077>10 string 3 version 2.11 or later 15078 15079#------------------------------------------------------------------------------ 15080# $File: psdbms,v 1.6 2009/09/19 16:28:11 christos Exp $ 15081# psdbms: file(1) magic for psdatabase 15082# 150830 belong&0xff00ffff 0x56000000 ps database 15084>1 string >\0 version %s 15085>4 string >\0 from kernel %s 15086 15087#------------------------------------------------------------------------------ 15088# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $ 15089# pulsar: file(1) magic for Pulsar POP3 daemon binary files 15090# 15091# http://pulsar.sourceforge.net 15092# mailto:rok.papez@lugos.si 15093# 15094 150950 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file. 15096>4 ubelong x Version: %d. 15097>8 ubelong x \b%d 15098 15099 15100#------------------------------------------------------------------------------ 15101# $File: pwsafe,v 1.1 2012/10/25 00:12:19 christos Exp $ 15102# pwsafe: file(1) magic for passwordsafe file 15103# 15104# Password Safe 15105# http://passwordsafe.sourceforge.net/ 15106# file format specs 15107# http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt 15108# V2 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt 15109# V1 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt 15110# V2 and V1 have no easy identifier that I can find 15111# .psafe3 151120 string PWS3 Password Safe V3 database 15113 15114#------------------------------------------------------------------------------ 15115# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $ 15116# pyramid: file(1) magic for Pyramids 15117# 15118# XXX - byte order? 15119# 151200 long 0x50900107 Pyramid 90x family executable 151210 long 0x50900108 Pyramid 90x family pure executable 15122>16 long >0 not stripped 151230 long 0x5090010b Pyramid 90x family demand paged pure executable 15124>16 long >0 not stripped 15125 15126#------------------------------------------------------------------------------ 15127# $File: python,v 1.22 2013/03/18 12:49:55 christos Exp $ 15128# python: file(1) magic for python 15129# 15130# Outlook puts """ too for urgent messages 15131# From: David Necas <yeti@physics.muni.cz> 15132# often the module starts with a multiline string 151330 string/t """ Python script text executable 15134# MAGIC as specified in Python/import.c (1.5 to 2.7a0 and 3.1a0, assuming 15135# that Py_UnicodeFlag is off for Python 2) 15136# 20121 ( YEAR - 1995 ) + MONTH + DAY (little endian followed by "\r\n" 151370 belong 0x994e0d0a python 1.5/1.6 byte-compiled 151380 belong 0x87c60d0a python 2.0 byte-compiled 151390 belong 0x2aeb0d0a python 2.1 byte-compiled 151400 belong 0x2ded0d0a python 2.2 byte-compiled 151410 belong 0x3bf20d0a python 2.3 byte-compiled 151420 belong 0x6df20d0a python 2.4 byte-compiled 151430 belong 0xb3f20d0a python 2.5 byte-compiled 151440 belong 0xd1f20d0a python 2.6 byte-compiled 151450 belong 0x03f30d0a python 2.7 byte-compiled 151460 belong 0x3b0c0d0a python 3.0 byte-compiled 151470 belong 0x4f0c0d0a python 3.1 byte-compiled 151480 belong 0x6c0c0d0a python 3.2 byte-compiled 151490 belong 0x9e0c0d0a python 3.3 byte-compiled 15150 151510 search/1/w #!\ /usr/bin/python Python script text executable 15152!:mime text/x-python 151530 search/1/w #!\ /usr/local/bin/python Python script text executable 15154!:mime text/x-python 151550 search/1 #!/usr/bin/env\ python Python script text executable 15156!:mime text/x-python 151570 search/1 #!\ /usr/bin/env\ python Python script text executable 15158!:mime text/x-python 15159 15160 15161# from module.submodule import func1, func2 151620 regex \^from\\s+(\\w|\\.)+\\s+import.*$ Python script text executable 15163!:mime text/x-python 15164 15165# def __init__ (self, ...): 151660 search/4096 def\ __init__ 15167>&0 search/64 self Python script text executable 15168!:mime text/x-python 15169 15170# comments 151710 search/4096 ''' 15172>&0 regex .*'''$ Python script text executable 15173!:mime text/x-python 15174 151750 search/4096 """ 15176>&0 regex .*"""$ Python script text executable 15177!:mime text/x-python 15178 15179# try: 15180# except: or finally: 15181# block 151820 search/4096 try: 15183>&0 regex \^\\s*except.*: Python script text executable 15184!:mime text/x-python 15185>&0 search/4096 finally: Python script text executable 15186!:mime text/x-python 15187 15188# def name(args, args): 151890 regex \^(\ |\\t)*def\ +[a-zA-Z]+ 15190>&0 regex \ *\\(([a-zA-Z]|,|\ )*\\):$ Python script text executable 15191!:mime text/x-python 15192 15193#------------------------------------------------------------------------------ 15194# $File: revision,v 1.9 2013/02/06 14:18:52 christos Exp $ 15195# file(1) magic for revision control files 15196# From Hendrik Scholz <hendrik@scholz.net> 151970 string/t /1\ :pserver: cvs password text file 15198 15199# Conary changesets 15200# From: Jonathan Smith <smithj@rpath.com> 152010 belong 0xea3f81bb Conary changeset data 15202 15203# Type: Git bundles (git-bundle) 15204# From: Josh Triplett <josh@freedesktop.org> 152050 string #\ v2\ git\ bundle\n Git bundle 15206 15207# Type: Git pack 15208# From: Adam Buchbinder <adam.buchbinder@gmail.com> 15209# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However, 15210# those have a little-endian offset immediately following the magic 'PACK', 15211# the first byte of which is never 0, while the first byte of the Git pack 15212# version, since it's a tiny number stored in big-endian format, is always 0. 152130 string PACK\0 Git pack 15214>4 belong >0 \b, version %d 15215>>8 belong >0 \b, %d objects 15216 15217# Type: Git pack index 15218# From: Adam Buchbinder <adam.buchbinder@gmail.com> 152190 string \377tOc Git pack index 15220>4 belong =2 \b, version 2 15221 15222# Type: Git index file 15223# From: Frederic Briare <fbriere@fbriere.net> 152240 string DIRC Git index 15225>4 belong >0 \b, version %d 15226>>8 belong >0 \b, %d entries 15227 15228# Type: Mercurial bundles 15229# From: Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 152300 string HG10 Mercurial bundle, 15231>4 string UN uncompressed 15232>4 string BZ bzip2 compressed 15233 15234# Type: Subversion (SVN) dumps 15235# From: Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de> 152360 string SVN-fs-dump-format-version: Subversion dumpfile 15237>28 string >\0 (version: %s) 15238 15239# Type: Bazaar revision bundles and merge requests 15240# URL: http://www.bazaar-vcs.org/ 15241# From: Jelmer Vernooij <jelmer@samba.org> 152420 string #\ Bazaar\ revision\ bundle\ v Bazaar Bundle 152430 string #\ Bazaar\ merge\ directive\ format Bazaar merge directive 15244 15245#------------------------------------------------------------------------------ 15246# $File: riff,v 1.23 2013/02/06 14:18:52 christos Exp $ 15247# riff: file(1) magic for RIFF format 15248# See 15249# 15250# http://www.seanet.com/users/matts/riffmci/riffmci.htm 15251# 15252# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi> 15253# 152540 string RIFF RIFF (little-endian) data 15255# RIFF Palette format 15256>8 string PAL \b, palette 15257>>16 leshort x \b, version %d 15258>>18 leshort x \b, %d entries 15259# RIFF Device Independent Bitmap format 15260>8 string RDIB \b, device-independent bitmap 15261>>16 string BM 15262>>>30 leshort 12 \b, OS/2 1.x format 15263>>>>34 leshort x \b, %d x 15264>>>>36 leshort x %d 15265>>>30 leshort 64 \b, OS/2 2.x format 15266>>>>34 leshort x \b, %d x 15267>>>>36 leshort x %d 15268>>>30 leshort 40 \b, Windows 3.x format 15269>>>>34 lelong x \b, %d x 15270>>>>38 lelong x %d x 15271>>>>44 leshort x %d 15272# RIFF MIDI format 15273>8 string RMID \b, MIDI 15274# RIFF Multimedia Movie File format 15275>8 string RMMP \b, multimedia movie 15276# RIFF wrapper for MP3 15277>8 string RMP3 \b, MPEG Layer 3 audio 15278# Microsoft WAVE format (*.wav) 15279>8 string WAVE \b, WAVE audio 15280!:mime audio/x-wav 15281>>20 leshort 1 \b, Microsoft PCM 15282>>>34 leshort >0 \b, %d bit 15283>>20 leshort 2 \b, Microsoft ADPCM 15284>>20 leshort 6 \b, ITU G.711 A-law 15285>>20 leshort 7 \b, ITU G.711 mu-law 15286>>20 leshort 8 \b, Microsoft DTS 15287>>20 leshort 17 \b, IMA ADPCM 15288>>20 leshort 20 \b, ITU G.723 ADPCM (Yamaha) 15289>>20 leshort 49 \b, GSM 6.10 15290>>20 leshort 64 \b, ITU G.721 ADPCM 15291>>20 leshort 80 \b, MPEG 15292>>20 leshort 85 \b, MPEG Layer 3 15293>>20 leshort 0x2001 \b, DTS 15294>>22 leshort =1 \b, mono 15295>>22 leshort =2 \b, stereo 15296>>22 leshort >2 \b, %d channels 15297>>24 lelong >0 %d Hz 15298# Corel Draw Picture 15299>8 string CDRA \b, Corel Draw Picture 15300!:mime image/x-coreldraw 15301# AVI == Audio Video Interleave 15302>8 string AVI\040 \b, AVI 15303!:mime video/x-msvideo 15304>>12 string LIST 15305>>>20 string hdrlavih 15306>>>>&36 lelong x \b, %lu x 15307>>>>&40 lelong x %lu, 15308>>>>&4 lelong >1000000 <1 fps, 15309>>>>&4 lelong 1000000 1.00 fps, 15310>>>>&4 lelong 500000 2.00 fps, 15311>>>>&4 lelong 333333 3.00 fps, 15312>>>>&4 lelong 250000 4.00 fps, 15313>>>>&4 lelong 200000 5.00 fps, 15314>>>>&4 lelong 166667 6.00 fps, 15315>>>>&4 lelong 142857 7.00 fps, 15316>>>>&4 lelong 125000 8.00 fps, 15317>>>>&4 lelong 111111 9.00 fps, 15318>>>>&4 lelong 100000 10.00 fps, 15319# ]9.9,10.1[ 15320>>>>&4 lelong <101010 15321>>>>>&-4 lelong >99010 15322>>>>>>&-4 lelong !100000 ~10 fps, 15323>>>>&4 lelong 83333 12.00 fps, 15324# ]11.9,12.1[ 15325>>>>&4 lelong <84034 15326>>>>>&-4 lelong >82645 15327>>>>>>&-4 lelong !83333 ~12 fps, 15328>>>>&4 lelong 66667 15.00 fps, 15329# ]14.9,15.1[ 15330>>>>&4 lelong <67114 15331>>>>>&-4 lelong >66225 15332>>>>>>&-4 lelong !66667 ~15 fps, 15333>>>>&4 lelong 50000 20.00 fps, 15334>>>>&4 lelong 41708 23.98 fps, 15335>>>>&4 lelong 41667 24.00 fps, 15336# ]23.9,24.1[ 15337>>>>&4 lelong <41841 15338>>>>>&-4 lelong >41494 15339>>>>>>&-4 lelong !41708 15340>>>>>>>&-4 lelong !41667 ~24 fps, 15341>>>>&4 lelong 40000 25.00 fps, 15342# ]24.9,25.1[ 15343>>>>&4 lelong <40161 15344>>>>>&-4 lelong >39841 15345>>>>>>&-4 lelong !40000 ~25 fps, 15346>>>>&4 lelong 33367 29.97 fps, 15347>>>>&4 lelong 33333 30.00 fps, 15348# ]29.9,30.1[ 15349>>>>&4 lelong <33445 15350>>>>>&-4 lelong >33223 15351>>>>>>&-4 lelong !33367 15352>>>>>>>&-4 lelong !33333 ~30 fps, 15353>>>>&4 lelong <32224 >30 fps, 15354##>>>>&4 lelong x (%lu) 15355##>>>>&20 lelong x %lu frames, 15356# Note: The tests below assume that the AVI has 1 or 2 streams, 15357# "vids" optionally followed by "auds". 15358# (Should cover 99.9% of all AVIs.) 15359# assuming avih length = 56 15360>>>88 string LIST 15361>>>>96 string strlstrh 15362>>>>>108 string vids video: 15363>>>>>>&0 lelong 0 uncompressed 15364# skip past vids strh 15365>>>>>>(104.l+108) string strf 15366>>>>>>>(104.l+132) lelong 1 RLE 8bpp 15367>>>>>>>(104.l+132) string/c cvid Cinepak 15368>>>>>>>(104.l+132) string/c i263 Intel I.263 15369>>>>>>>(104.l+132) string/c iv32 Indeo 3.2 15370>>>>>>>(104.l+132) string/c iv41 Indeo 4.1 15371>>>>>>>(104.l+132) string/c iv50 Indeo 5.0 15372>>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2 15373>>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3 15374>>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4 15375>>>>>>>(104.l+132) string/c mjpg Motion JPEG 15376>>>>>>>(104.l+132) string/c div3 DivX 3 15377>>>>>>>>112 string/c div3 Low-Motion 15378>>>>>>>>112 string/c div4 Fast-Motion 15379>>>>>>>(104.l+132) string/c divx DivX 4 15380>>>>>>>(104.l+132) string/c dx50 DivX 5 15381>>>>>>>(104.l+132) string/c xvid XviD 15382>>>>>>>(104.l+132) string/c h264 H.264 15383>>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9 15384>>>>>>>(104.l+132) string/c h264 X.264 or H.264 15385>>>>>>>(104.l+132) lelong 0 15386##>>>>>>>(104.l+132) string x (%.4s) 15387# skip past first (video) LIST 15388>>>>(92.l+96) string LIST 15389>>>>>(92.l+104) string strlstrh 15390>>>>>>(92.l+116) string auds \b, audio: 15391# auds strh length = 56: 15392>>>>>>>(92.l+172) string strf 15393>>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM 15394>>>>>>>>(92.l+180) leshort 0x0002 ADPCM 15395>>>>>>>>(92.l+180) leshort 0x0006 aLaw 15396>>>>>>>>(92.l+180) leshort 0x0007 uLaw 15397>>>>>>>>(92.l+180) leshort 0x0050 MPEG-1 Layer 1 or 2 15398>>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3 15399>>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3 15400>>>>>>>>(92.l+180) leshort 0x0161 DivX 15401##>>>>>>>>(92.l+180) leshort x (0x%.4x) 15402>>>>>>>>(92.l+182) leshort 1 (mono, 15403>>>>>>>>(92.l+182) leshort 2 (stereo, 15404>>>>>>>>(92.l+182) leshort >2 (%d channels, 15405>>>>>>>>(92.l+184) lelong x %d Hz) 15406# auds strh length = 64: 15407>>>>>>>(92.l+180) string strf 15408>>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM 15409>>>>>>>>(92.l+188) leshort 0x0002 ADPCM 15410>>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3 15411>>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3 15412>>>>>>>>(92.l+188) leshort 0x0161 DivX 15413##>>>>>>>>(92.l+188) leshort x (0x%.4x) 15414>>>>>>>>(92.l+190) leshort 1 (mono, 15415>>>>>>>>(92.l+190) leshort 2 (stereo, 15416>>>>>>>>(92.l+190) leshort >2 (%d channels, 15417>>>>>>>>(92.l+192) lelong x %d Hz) 15418# Animated Cursor format 15419>8 string ACON \b, animated cursor 15420# SoundFont 2 <mpruett@sgi.com> 15421>8 string sfbk SoundFont/Bank 15422# MPEG-1 wrapped in a RIFF, apparently 15423>8 string CDXA \b, wrapped MPEG-1 (CDXA) 15424>8 string 4XMV \b, 4X Movie file 15425# AMV-type AVI file: http://wiki.multimedia.cx/index.php?title=AMV 15426>8 string AMV\040 \b, AMV 15427 15428# 15429# XXX - some of the below may only appear in little-endian form. 15430# 15431# Also "MV93" appears to be for one form of Macromedia Director 15432# files, and "GDMF" appears to be another multimedia format. 15433# 154340 string RIFX RIFF (big-endian) data 15435# RIFF Palette format 15436>8 string PAL \b, palette 15437>>16 beshort x \b, version %d 15438>>18 beshort x \b, %d entries 15439# RIFF Device Independent Bitmap format 15440>8 string RDIB \b, device-independent bitmap 15441>>16 string BM 15442>>>30 beshort 12 \b, OS/2 1.x format 15443>>>>34 beshort x \b, %d x 15444>>>>36 beshort x %d 15445>>>30 beshort 64 \b, OS/2 2.x format 15446>>>>34 beshort x \b, %d x 15447>>>>36 beshort x %d 15448>>>30 beshort 40 \b, Windows 3.x format 15449>>>>34 belong x \b, %d x 15450>>>>38 belong x %d x 15451>>>>44 beshort x %d 15452# RIFF MIDI format 15453>8 string RMID \b, MIDI 15454# RIFF Multimedia Movie File format 15455>8 string RMMP \b, multimedia movie 15456# Microsoft WAVE format (*.wav) 15457>8 string WAVE \b, WAVE audio 15458>>20 leshort 1 \b, Microsoft PCM 15459>>>34 leshort >0 \b, %d bit 15460>>22 beshort =1 \b, mono 15461>>22 beshort =2 \b, stereo 15462>>22 beshort >2 \b, %d channels 15463>>24 belong >0 %d Hz 15464# Corel Draw Picture 15465>8 string CDRA \b, Corel Draw Picture 15466# AVI == Audio Video Interleave 15467>8 string AVI\040 \b, AVI 15468# Animated Cursor format 15469>8 string ACON \b, animated cursor 15470# Notation Interchange File Format (big-endian only) 15471>8 string NIFF \b, Notation Interchange File Format 15472# SoundFont 2 <mpruett@sgi.com> 15473>8 string sfbk SoundFont/Bank 15474 15475#------------------------------------------------------------------------------ 15476# Sony Wave64 15477# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf 15478# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian 154790 string riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00 Sony Wave64 RIFF data 15480# 128 bit + total file size (64 bits) so 24 bytes 15481# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A } 15482>24 string wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b, WAVE 64 audio 15483!:mime audio/x-w64 15484# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A } 15485>>40 search/256 fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b 15486>>>&10 leshort =1 \b, mono 15487>>>&10 leshort =2 \b, stereo 15488>>>&10 leshort >2 \b, %d channels 15489>>>&12 lelong >0 %d Hz 15490 15491#------------------------------------------------------------------------------ 15492# MBWF/RF64 15493# see EBU TECH 3306 http://tech.ebu.ch/docs/tech/tech3306-2009.pdf 154940 string RF64\xff\xff\xff\xffWAVEds64 MBWF/RF64 audio 15495!:mime audio/x-wav 15496>40 search/256 fmt\x20 \b 15497>>&6 leshort =1 \b, mono 15498>>&6 leshort =2 \b, stereo 15499>>&6 leshort >2 \b, %d channels 15500>>&8 lelong >0 %d Hz 15501 15502 15503#------------------------------------------------------------------------------ 15504# $File: rinex,v 1.4 2011/05/03 01:44:17 christos Exp $ 15505# rinex: file(1) magic for RINEX files 15506# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt 15507# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf 15508# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data 1550960 string RINEX 15510>80 search/256 XXRINEXB RINEX Data, GEO SBAS Broadcast 15511>>&32 string x \b, date %15.15s 15512>>5 string x \b, version %6.6s 15513!:mime rinex/broadcast 15514>80 search/256 XXRINEXD RINEX Data, Observation (Hatanaka comp) 15515>>&32 string x \b, date %15.15s 15516>>5 string x \b, version %6.6s 15517!:mime rinex/observation 15518>80 search/256 XXRINEXC RINEX Data, Clock 15519>>&32 string x \b, date %15.15s 15520>>5 string x \b, version %6.6s 15521!:mime rinex/clock 15522>80 search/256 XXRINEXH RINEX Data, GEO SBAS Navigation 15523>>&32 string x \b, date %15.15s 15524>>5 string x \b, version %6.6s 15525!:mime rinex/navigation 15526>80 search/256 XXRINEXG RINEX Data, GLONASS Navigation 15527>>&32 string x \b, date %15.15s 15528>>5 string x \b, version %6.6s 15529!:mime rinex/navigation 15530>80 search/256 XXRINEXL RINEX Data, Galileo Navigation 15531>>&32 string x \b, date %15.15s 15532>>5 string x \b, version %6.6s 15533!:mime rinex/navigation 15534>80 search/256 XXRINEXM RINEX Data, Meteorological 15535>>&32 string x \b, date %15.15s 15536>>5 string x \b, version %6.6s 15537!:mime rinex/meteorological 15538>80 search/256 XXRINEXN RINEX Data, Navigation 15539>>&32 string x \b, date %15.15s 15540>>5 string x \b, version %6.6s 15541!:mime rinex/navigation 15542>80 search/256 XXRINEXO RINEX Data, Observation 15543>>&32 string x \b, date %15.15s 15544>>5 string x \b, version %6.6s 15545!:mime rinex/observation 15546 15547#------------------------------------------------------------------------------ 15548# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $ 15549# 15550# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com) 15551# 155520 belong 0xedabeedb RPM 15553!:mime application/x-rpm 15554>4 byte x v%d 15555>5 byte x \b.%d 15556>6 beshort 1 src 15557>6 beshort 0 bin 15558>>8 beshort 1 i386/x86_64 15559>>8 beshort 2 Alpha/Sparc64 15560>>8 beshort 3 Sparc 15561>>8 beshort 4 MIPS 15562>>8 beshort 5 PowerPC 15563>>8 beshort 6 68000 15564>>8 beshort 7 SGI 15565>>8 beshort 8 RS6000 15566>>8 beshort 9 IA64 15567>>8 beshort 10 Sparc64 15568>>8 beshort 11 MIPSel 15569>>8 beshort 12 ARM 15570>>8 beshort 13 MiNT 15571>>8 beshort 14 S/390 15572>>8 beshort 15 S/390x 15573>>8 beshort 16 PowerPC64 15574>>8 beshort 17 SuperH 15575>>8 beshort 18 Xtensa 15576>>8 beshort 255 noarch 15577 15578#delta RPM Daniel Novotny (dnovotny@redhat.com) 155790 string drpm Delta RPM 15580!:mime application/x-rpm 15581>12 string x %s 15582>>8 beshort 11 MIPSel 15583>>8 beshort 12 ARM 15584>>8 beshort 13 MiNT 15585>>8 beshort 14 S/390 15586>>8 beshort 15 S/390x 15587>>8 beshort 16 PowerPC64 15588>>8 beshort 17 SuperH 15589>>8 beshort 18 Xtensa 15590>>10 string x %s 15591 15592#------------------------------------------------------------------------------ 15593# $File: rtf,v 1.7 2009/09/19 16:28:12 christos Exp $ 15594# rtf: file(1) magic for Rich Text Format (RTF) 15595# 15596# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk 15597# 155980 string {\\rtf Rich Text Format data, 15599!:mime text/rtf 15600>5 string 1 version 1, 15601>>6 string \\ansi ANSI 15602>>6 string \\mac Apple Macintosh 15603>>6 string \\pc IBM PC, code page 437 15604>>6 string \\pca IBM PS/2, code page 850 15605>>6 default x unknown character set 15606>5 default x unknown version 15607 15608#------------------------------------------------------------------------------ 15609# $File: ruby,v 1.5 2010/07/21 16:47:17 christos Exp $ 15610# ruby: file(1) magic for Ruby scripting language 15611# URL: http://www.ruby-lang.org/ 15612# From: Reuben Thomas <rrt@sc3d.org> 15613 15614# Ruby scripts 156150 search/1/w #!\ /usr/bin/ruby Ruby script text executable 15616!:mime text/x-ruby 156170 search/1/w #!\ /usr/local/bin/ruby Ruby script text executable 15618!:mime text/x-ruby 156190 search/1 #!/usr/bin/env\ ruby Ruby script text executable 15620!:mime text/x-ruby 156210 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable 15622!:mime text/x-ruby 15623 15624# What looks like ruby, but does not have a shebang 15625# (modules and such) 15626# From: Lubomir Rintel <lkundrak@v3.sk> 156270 regex \^[\ \t]*require[\ \t]'[A-Za-z_/]+' 15628>0 regex include\ [A-Z]|def\ [a-z]|\ do$ 15629>>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby script text 15630!:mime text/x-ruby 156310 regex \^[\ \t]*(class|module)[\ \t][A-Z] 15632>0 regex (modul|includ)e\ [A-Z]|def\ [a-z] 15633>>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby module source text 15634!:mime text/x-ruby 15635 15636#------------------------------------------------------------------------------ 15637# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $ 15638# sc: file(1) magic for "sc" spreadsheet 15639# 1564038 string Spreadsheet sc spreadsheet file 15641!:mime application/x-sc 15642 15643#------------------------------------------------------------------------------ 15644# $File: sccs,v 1.6 2009/09/19 16:28:12 christos Exp $ 15645# sccs: file(1) magic for SCCS archives 15646# 15647# SCCS archive structure: 15648# \001h01207 15649# \001s 00276/00000/00000 15650# \001d D 1.1 87/09/23 08:09:20 ian 1 0 15651# \001c date and time created 87/09/23 08:09:20 by ian 15652# \001e 15653# \001u 15654# \001U 15655# ... etc. 15656# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550). 15657# *Sigh*. And these both came from various parts of the USG. 15658# Maybe we should just switch everybody from SCCS to RCS! 15659# Further, you can't just say '\001h0', because the five-digit number 15660# is a checksum that could (presumably) have any leading digit, 15661# and we don't have regular expression matching yet. 15662# Hence the following official kludge: 156638 string \001s\ SCCS archive data 15664 15665#------------------------------------------------------------------------------ 15666# $File: scientific,v 1.7 2010/09/20 19:19:17 rrt Exp $ 15667# scientific: file(1) magic for scientific formats 15668# 15669# From: Joe Krahn <krahn@niehs.nih.gov> 15670 15671######################################################## 15672# CCP4 data and plot files: 156730 string MTZ\040 MTZ reflection file 15674 1567592 string PLOT%%84 Plot84 plotting file 15676>52 byte 1 , Little-endian 15677>55 byte 1 , Big-endian 15678 15679######################################################## 15680# Electron density MAP/MASK formats 15681 156820 string EZD_MAP NEWEZD Electron Density Map 15683109 string MAP\040( Old EZD Electron Density Map 15684 156850 string/c :-)\040Origin BRIX Electron Density Map 15686>170 string >0 , Sigma:%.12s 15687#>4 string >0 %.178s 15688#>4 addr x %.178s 15689 156907 string 18\040!NTITLE XPLOR ASCII Electron Density Map 156919 string \040!NTITLE\012\040REMARK CNS ASCII electron density map 15692 15693208 string MAP\040 CCP4 Electron Density Map 15694# Assumes same stamp for float and double (normal case) 15695>212 byte 17 \b, Big-endian 15696>212 byte 34 \b, VAX format 15697>212 byte 68 \b, Little-endian 15698>212 byte 85 \b, Convex native 15699 15700############################################################ 15701# X-Ray Area Detector images 157020 string R-AXIS4\ \ \ R-Axis Area Detector Image: 15703>796 lelong <20 Little-endian, IP #%d, 15704>>768 lelong >0 Size=%dx 15705>>772 lelong >0 \b%d 15706>796 belong <20 Big-endian, IP #%d, 15707>>768 belong >0 Size=%dx 15708>>772 belong >0 \b%d 15709 157100 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32: 15711>796 lelong <20 Little-endian, IP #%d, 15712>>768 lelong >0 Size=%dx 15713>>772 lelong >0 \b%d 15714>796 belong <20 Big-endian, IP #%d, 15715>>768 belong >0 Size=%dx 15716>>772 belong >0 \b%d 15717 15718 157191028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image, 15720>1072 ulong >1 Compressed(%d), 15721>1100 ulong >1 %d headers, 15722>1104 ulong >0 %d x 15723>1108 ulong >0 %d, 15724>1120 ulong >0 %d bits/pixel 15725 15726# Type: GEDCOM genealogical (family history) data 15727# From: Giuseppe Bilotta 157280 search/1/c 0\ HEAD GEDCOM genealogy text 15729>&0 search 1\ GEDC 15730>>&0 search 2\ VERS version 15731>>>&1 search/1 >\0 %s 15732# From: Phil Endecott <phil05@chezphil.org> 157330 string \000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 157340 string \060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 157350 string \376\377\000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 157360 string \377\376\060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 15737 15738# PDB: Protein Data Bank files 15739# Adam Buchbinder <adam.buchbinder@gmail.com> 15740# 15741# http://www.wwpdb.org/documentation/format32/sect2.html 15742# http://www.ch.ic.ac.uk/chemime/ 15743# 15744# The PDB file format is fixed-field, 80 columns. From the spec: 15745# 15746# COLS DATA 15747# 1 - 6 "HEADER" 15748# 11 - 50 String(40) 15749# 51 - 59 Date 15750# 63 - 66 IDcode 15751# 15752# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the 15753# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and 15754# uppercase letters. However, examples have been seen without the date string, 15755# e.g., the example on the chemime site. 157560 string HEADER\ \ \ \ 15757>&0 regex/1 \^.{40} 15758>>&0 regex/1 [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3} 15759>>>&0 regex/1s [A-Z0-9]{4}.{14}$ 15760>>>>&0 regex/1 [A-Z0-9]{4} Protein Data Bank data, ID Code %s 15761!:mime chemical/x-pdb 15762>>>>0 regex/1 [0-9]{2}-[A-Z]{3}-[0-9]{2} \b, %s 15763 15764# Type: GDSII Stream file 157650 belong 0x00060002 GDSII Stream file 15766>4 byte 0x00 15767>>5 byte x version %d.0 15768>4 byte >0x00 version %d 15769>>5 byte x \b.%d 15770 15771#------------------------------------------------------------------------------ 15772# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $ 157730 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text 157740 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text 157750 belong 0xedfeedfe Sun 'jks' Java Keystore File data 15776# Type: SE Linux policy modules *.pp reference policy 15777# for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny. 15778# URL: http://doc.coker.com.au/computers/selinux-magic 15779# From: Russell Coker <russell@coker.com.au> 15780 157810 lelong 0xf97cff8f SE Linux modular policy 15782>4 lelong x version %d, 15783>8 lelong x %d sections, 15784>>(12.l) lelong 0xf97cff8d 15785>>>(12.l+27) lelong x mod version %d, 15786>>>(12.l+31) lelong 0 Not MLS, 15787>>>(12.l+31) lelong 1 MLS, 15788>>>(12.l+23) lelong 2 15789>>>>(12.l+47) string >\0 module name %s 15790>>>(12.l+23) lelong 1 base 15791 157921 string policy_module( SE Linux policy module source 157932 string policy_module( SE Linux policy module source 15794 157950 string ##\ <summary> SE Linux policy interface source 15796 15797#0 search gen_context( SE Linux policy file contexts 15798 15799#0 search gen_sens( SE Linux policy MLS constraints source 15800 15801#------------------------------------------------------------------------------ 15802# $File: sendmail,v 1.7 2009/09/19 16:28:12 christos Exp $ 15803# sendmail: file(1) magic for sendmail config files 15804# 15805# XXX - byte order? 15806# 158070 byte 046 Sendmail frozen configuration 15808>16 string >\0 - version %s 158090 short 0x271c Sendmail frozen configuration 15810>16 string >\0 - version %s 15811 15812#------------------------------------------------------------------------------ 15813# sendmail: file(1) magic for sendmail m4(1) files 15814# 15815# From Hendrik Scholz <hendrik@scholz.net> 15816# i.e. files in /usr/share/sendmail/cf/ 15817# 158180 string divert(-1)\n sendmail m4 text file 15819 15820 15821#------------------------------------------------------------------------------ 15822# $File: sequent,v 1.8 2009/09/19 16:28:12 christos Exp $ 15823# sequent: file(1) magic for Sequent machines 15824# 15825# Sequent information updated by Don Dwiggins <atsun!dwiggins>. 15826# For Sequent's multiprocessor systems (incomplete). 158270 lelong 0x00ea BALANCE NS32000 .o 15828>16 lelong >0 not stripped 15829>124 lelong >0 version %ld 158300 lelong 0x10ea BALANCE NS32000 executable (0 @ 0) 15831>16 lelong >0 not stripped 15832>124 lelong >0 version %ld 158330 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0) 15834>16 lelong >0 not stripped 15835>124 lelong >0 version %ld 158360 lelong 0x30ea BALANCE NS32000 standalone executable 15837>16 lelong >0 not stripped 15838>124 lelong >0 version %ld 15839# 15840# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>. 15841# Symmetry magic nums will not be reached if DOS COM comes before them; 15842# byte 0xeb is matched before these get a chance. 158430 leshort 0x12eb SYMMETRY i386 .o 15844>16 lelong >0 not stripped 15845>124 lelong >0 version %ld 158460 leshort 0x22eb SYMMETRY i386 executable (0 @ 0) 15847>16 lelong >0 not stripped 15848>124 lelong >0 version %ld 158490 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0) 15850>16 lelong >0 not stripped 15851>124 lelong >0 version %ld 158520 leshort 0x42eb SYMMETRY i386 standalone executable 15853>16 lelong >0 not stripped 15854>124 lelong >0 version %ld 15855 15856#------------------------------------------------------------------------------ 15857# $File: sgi,v 1.19 2013/01/12 03:09:51 christos Exp $ 15858# sgi: file(1) magic for Silicon Graphics operating systems and applications 15859# 15860# Executable images are handled either in aout (for old-style a.out 15861# files for 68K; they are indistinguishable from other big-endian 32-bit 15862# a.out files) or in mips (for MIPS ECOFF and Ucode files) 15863# 15864 15865# kbd file definitions 158660 string kbd!map kbd map file 15867>8 byte >0 Ver %d: 15868>10 short >0 with %d table(s) 15869 158700 beshort 0x8765 disk quotas file 15871 158720 beshort 0x0506 IRIS Showcase file 15873>2 byte 0x49 - 15874>3 byte x - version %ld 158750 beshort 0x0226 IRIS Showcase template 15876>2 byte 0x63 - 15877>3 byte x - version %ld 158780 belong 0x5343464d IRIS Showcase file 15879>4 byte x - version %ld 158800 belong 0x5443464d IRIS Showcase template 15881>4 byte x - version %ld 158820 belong 0xdeadbabe IRIX Parallel Arena 15883>8 belong >0 - version %ld 15884 15885# core files 15886# 15887# 32bit core file 158880 belong 0xdeadadb0 IRIX core dump 15889>4 belong 1 of 15890>16 string >\0 '%s' 15891# 64bit core file 158920 belong 0xdeadad40 IRIX 64-bit core dump 15893>4 belong 1 of 15894>16 string >\0 '%s' 15895# N32bit core file 158960 belong 0xbabec0bb IRIX N32 core dump 15897>4 belong 1 of 15898>16 string >\0 '%s' 15899# New style crash dump file 159000 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of 15901>36 string >\0 '%s' 15902 15903# Trusted IRIX info 159040 string SGIAUDIT SGI Audit file 15905>8 byte x - version %d 15906>9 byte x \b.%ld 15907# 159080 string WNGZWZSC Wingz compiled script 159090 string WNGZWZSS Wingz spreadsheet 159100 string WNGZWZHP Wingz help file 15911# 159120 string #Inventor V IRIS Inventor 1.0 file 159130 string #Inventor V2 Open Inventor 2.0 file 15914# GLF is OpenGL stream encoding 159150 string glfHeadMagic(); GLF_TEXT 159164 belong 0x7d000000 GLF_BINARY_LSB_FIRST 15917!:strength -30 159184 belong 0x0000007d GLF_BINARY_MSB_FIRST 15919!:strength -30 15920# GLS is OpenGL stream encoding; GLS is the successor of GLF 159210 string glsBeginGLS( GLS_TEXT 159224 belong 0x10000000 GLS_BINARY_LSB_FIRST 15923!:strength -30 159244 belong 0x00000010 GLS_BINARY_MSB_FIRST 15925!:strength -30 15926 15927# 15928# 15929# Performance Co-Pilot file types 159300 string PmNs PCP compiled namespace (V.0) 159310 string PmN PCP compiled namespace 15932>3 string >\0 (V.%1.1s) 15933#3 lelong 0x84500526 PCP archive 159343 belong 0x84500526 PCP archive 15935>7 byte x (V.%d) 15936#>20 lelong -2 temporal index 15937#>20 lelong -1 metadata 15938#>20 lelong 0 log volume #0 15939#>20 lelong >0 log volume #%ld 15940>20 belong -2 temporal index 15941>20 belong -1 metadata 15942>20 belong 0 log volume #0 15943>20 belong >0 log volume #%ld 15944>24 string >\0 host: %s 159450 string PCPFolio PCP 15946>9 string Version: Archive Folio 15947>18 string >\0 (V.%s) 159480 string #pmchart PCP pmchart view 15949>9 string Version 15950>17 string >\0 (V%-3.3s) 159510 string #kmchart PCP kmchart view 15952>9 string Version 15953>17 string >\0 (V.%s) 159540 string pmview PCP pmview config 15955>7 string Version 15956>15 string >\0 (V%-3.3s) 159570 string #pmlogger PCP pmlogger config 15958>10 string Version 15959>18 string >\0 (V%1.1s) 159600 string #pmdahotproc PCP pmdahotproc config 15961>13 string Version 15962>21 string >\0 (V%-3.3s) 159630 string PcPh PCP Help 15964>4 string 1 Index 15965>4 string 2 Text 15966>5 string >\0 (V.%1.1s) 159670 string #pmieconf-rules PCP pmieconf rules 15968>16 string >\0 (V.%1.1s) 159693 string pmieconf-pmie PCP pmie config 15970>17 string >\0 (V.%1.1s) 15971 15972# SpeedShop data files 159730 lelong 0x13130303 SpeedShop data file 15974 15975# mdbm files 159760 lelong 0x01023962 mdbm file, version 0 (obsolete) 159770 string mdbm mdbm file, 15978>5 byte x version %d, 15979>6 byte x 2^%d pages, 15980>7 byte x pagesize 2^%d, 15981>17 byte x hash %d, 15982>11 byte x dataformat %d 15983 15984# Alias Maya files 159850 string/t //Maya ASCII Alias Maya Ascii File, 15986>13 string >\0 version %s 159878 string MAYAFOR4 Alias Maya Binary File, 15988>32 string >\0 version %s scene 159898 string MayaFOR4 Alias Maya Binary File, 15990>32 string >\0 version %s scene 159918 string CIMG Alias Maya Image File 159928 string DEEP Alias Maya Image File 15993#------------------------------------------------------------------------------ 15994# $File: sgml,v 1.29 2012/08/26 10:25:41 christos Exp $ 15995# Type: SVG Vectorial Graphics 15996# From: Noel Torres <tecnico@ejerciciosresueltos.com> 159970 string \<?xml\ version=" 15998>15 string >\0 15999>>19 search/4096 \<svg SVG Scalable Vector Graphics image 16000!:mime image/svg+xml 16001>>19 search/4096 \<gnc-v2 GnuCash file 16002!:mime application/x-gnucash 16003 16004# Sitemap file 160050 string/t \<?xml\ version=" 16006>15 string >\0 16007>>19 search/4096 \<urlset XML Sitemap document text 16008!:mime application/xml-sitemap 16009 16010# xhtml 160110 string/t \<?xml\ version=" 16012>15 string >\0 16013>>19 search/4096/cWbt \<!doctype\ html XHTML document text 16014!:mime text/html 160150 string/t \<?xml\ version=' 16016>15 string >\0 16017>>19 search/4096/cWbt \<!doctype\ html XHTML document text 16018!:mime text/html 160190 string/t \<?xml\ version=" 16020>15 string >\0 16021>>19 search/4096/cWbt \<html broken XHTML document text 16022!:mime text/html 16023 16024#------------------------------------------------------------------------------ 16025# sgml: file(1) magic for Standard Generalized Markup Language 16026# HyperText Markup Language (HTML) is an SGML document type, 16027# from Daniel Quinlan (quinlan@yggdrasil.com) 16028# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org) 160290 search/4096/cWt \<!doctype\ html HTML document text 16030!:mime text/html 16031!:strength + 5 160320 search/4096/cwt \<head HTML document text 16033!:mime text/html 16034!:strength + 5 160350 search/4096/cwt \<title HTML document text 16036!:mime text/html 16037!:strength + 5 160380 search/4096/cwt \<html HTML document text 16039!:mime text/html 16040!:strength + 5 160410 search/4096/cwt \<script HTML document text 16042!:mime text/html 16043!:strength + 5 160440 search/4096/cwt \<style HTML document text 16045!:mime text/html 16046!:strength + 5 160470 search/4096/cwt \<table HTML document text 16048!:mime text/html 16049!:strength + 5 160500 search/4096/cwt \<a\ href= HTML document text 16051!:mime text/html 16052!:strength + 5 16053 16054# Extensible markup language (XML), a subset of SGML 16055# from Marc Prud'hommeaux (marc@apocalypse.org) 160560 search/1/cwt \<?xml XML document text 16057!:mime application/xml 16058!:strength + 5 160590 string/t \<?xml\ version\ " XML 16060!:mime application/xml 16061!:strength + 5 160620 string/t \<?xml\ version=" XML 16063!:mime application/xml 16064!:strength + 5 16065>15 string/t >\0 %.3s document text 16066>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 16067>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 160680 string \<?xml\ version=' XML 16069!:mime application/xml 16070!:strength + 5 16071>15 string/t >\0 %.3s document text 16072>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 16073>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 160740 search/1/wbt \<?xml XML document text 16075!:mime application/xml 16076!:strength - 10 160770 search/1/wt \<?XML broken XML document text 16078!:mime application/xml 16079!:strength - 10 16080 16081 16082# SGML, mostly from rph@sq 160830 search/4096/cwt \<!doctype exported SGML document text 160840 search/4096/cwt \<!subdoc exported SGML subdocument text 160850 search/4096/cwt \<!-- exported SGML document text 16086!:strength - 10 16087 16088# Web browser cookie files 16089# (Mozilla, Galeon, Netscape 4, Konqueror..) 16090# Ulf Harnhammar <ulfh@update.uu.se> 160910 search/1 #\ HTTP\ Cookie\ File Web browser cookie text 160920 search/1 #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text 160930 search/1 #\ KDE\ Cookie\ File Konqueror cookie text 16094 16095#------------------------------------------------------------------------ 16096# $File: sharc,v 1.6 2009/09/19 16:28:12 christos Exp $ 16097# file(1) magic for sharc files 16098# 16099# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by 16100# FutureGroove Music (dsp@futuregroove.de) 16101 16102#------------------------------------------------------------------------ 16103#0 string Draw RiscOS Drawfile 16104#0 string PACK RiscOS PackdDir archive 16105 16106#------------------------------------------------------------------------ 16107# SHARC DSP stuff (based on the FGM SHARC DSP SDK) 16108 16109#0 string =! Assembler source 16110#0 string Analog ADi asm listing file 161110 string .SYSTEM SHARC architecture file 161120 string .system SHARC architecture file 16113 161140 leshort 0x521C SHARC COFF binary 16115>2 leshort >1 , %hd sections 16116>>12 lelong >0 , not stripped 16117 16118#------------------------------------------------------------------------------ 16119# $File: sinclair,v 1.5 2009/09/19 16:28:12 christos Exp $ 16120# sinclair: file(1) sinclair QL 16121 16122# additions to /etc/magic by Thomas M. Ott (ThMO) 16123 16124# Sinclair QL floppy disk formats (ThMO) 161250 string =QL5 QL disk dump data, 16126>3 string =A 720 KB, 16127>3 string =B 1.44 MB, 16128>3 string =C 3.2 MB, 16129>4 string >\0 label:%.10s 16130 16131# Sinclair QL OS dump (ThMO) 16132# (NOTE: if `file' would be able to use indirect references in a endian format 16133# differing from the natural host format, this could be written more 16134# reliably and faster...) 16135# 16136# we *can't* lookup QL OS code dumps, because `file' is UNABLE to read more 16137# than the first 8K of a file... #-( 16138# 16139#0 belong =0x30000 16140#>49124 belong <47104 16141#>>49128 belong <47104 16142#>>>49132 belong <47104 16143#>>>>49136 belong <47104 QL OS dump data, 16144#>>>>>49148 string >\0 type %.3s, 16145#>>>>>49142 string >\0 version %.4s 16146 16147# Sinclair QL firmware executables (ThMO) 161480 string NqNqNq`\004 QL firmware executable (BCPL) 16149 16150# Sinclair QL libraries (was ThMO) 161510 beshort 0xFB01 QDOS object 16152>2 pstring x '%s' 16153 16154# Sinclair QL executables (was ThMO) 161554 belong 0x4AFB QDOS executable 16156>9 pstring x '%s' 16157 16158# Sinclair QL ROM (ThMO) 161590 belong =0x4AFB0001 QL plugin-ROM data, 16160>9 pstring =\0 un-named 16161>9 pstring >\0 named: %s 16162# Type: SiSU Markup Language 16163# URL: http://www.sisudoc.org/ 16164# From: Ralph Amissah <ralph.amissah@gmail.com> 16165 161660 regex \^%?[\ \t]*SiSU[\ \t]+insert SiSU text insert 16167>5 regex [0-9.]+ %s 16168 161690 regex \^%[\ \t]+SiSU[\ \t]+master SiSU text master 16170>5 regex [0-9.]+ %s 16171 161720 regex \^%?[\ \t]*SiSU[\ \t]+text SiSU text 16173>5 regex [0-9.]+ %s 16174 161750 regex \^%?[\ \t]*SiSU[\ \t][0-9.]+ SiSU text 16176>5 regex [0-9.]+ %s 16177 161780 regex \^%*[\ \t]*sisu-[0-9.]+ SiSU text 16179>5 regex [0-9.]+ %s 16180 16181#------------------------------------------------------------------------------ 16182# $File: sketch,v 1.4 2009/09/19 16:28:12 christos Exp $ 16183# Sketch Drawings: http://sketch.sourceforge.net/ 16184# From: Edwin Mons <e@ik.nu> 161850 search/1 ##Sketch Sketch document text 16186 16187#----------------------------------------------- 16188# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $ 16189# GNU Smalltalk image, starting at version 1.6.2 16190# From: catull_us@yahoo.com 16191# 161920 string GSTIm\0\0 GNU SmallTalk 16193# little-endian 16194>7 byte&1 =0 LE image version 16195>>10 byte x %d. 16196>>9 byte x \b%d. 16197>>8 byte x \b%d 16198#>>12 lelong x , data: %ld 16199#>>16 lelong x , table: %ld 16200#>>20 lelong x , memory: %ld 16201# big-endian 16202>7 byte&1 =1 BE image version 16203>>8 byte x %d. 16204>>9 byte x \b%d. 16205>>10 byte x \b%d 16206#>>12 belong x , data: %ld 16207#>>16 belong x , table: %ld 16208#>>20 belong x , memory: %ld 16209 16210 16211 16212#------------------------------------------------------------------------------ 16213# $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $ 16214# smile: file(1) magic for Smile serialization 16215# 16216# The Smile serialization format uses a 4-byte header: 16217# 16218# Constant byte #0: 0x3A (ASCII ':') 16219# Constant byte #1: 0x29 (ASCII ')') 16220# Constant byte #2: 0x0A (ASCII linefeed, '\n') 16221# Variable byte #3, consisting of bits: 16222# Bits 4-7 (4 MSB): 4-bit version number 16223# Bits 3: Reserved 16224# Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content 16225# Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false 16226# Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true 16227# 16228# Reference: http://wiki.fasterxml.com/SmileFormatSpec 16229# Created by: Pierre-Alexandre Meyer <pierre@mouraf.org> 16230 16231# Detection 162320 string :)\n Smile binary data 16233 16234# Versioning 16235>3 byte&0xF0 x version %d: 16236 16237# Properties 16238>3 byte&0x04 0x04 binary raw, 16239>3 byte&0x04 0x00 binary encoded, 16240>3 byte&0x02 0x02 shared String values enabled, 16241>3 byte&0x02 0x00 shared String values disabled, 16242>3 byte&0x01 0x01 shared field names enabled 16243>3 byte&0x01 0x00 shared field names disabled 16244 16245 16246#------------------------------------------------------------------------------ 16247# $File: sniffer,v 1.19 2013/01/06 01:11:04 christos Exp $ 16248# sniffer: file(1) magic for packet capture files 16249# 16250# From: guy@alum.mit.edu (Guy Harris) 16251# 16252 16253# 16254# Microsoft Network Monitor 1.x capture files. 16255# 162560 string RTSS NetMon capture file 16257>5 byte x - version %d 16258>4 byte x \b.%d 16259>6 leshort 0 (Unknown) 16260>6 leshort 1 (Ethernet) 16261>6 leshort 2 (Token Ring) 16262>6 leshort 3 (FDDI) 16263>6 leshort 4 (ATM) 16264>6 leshort >4 (type %d) 16265 16266# 16267# Microsoft Network Monitor 2.x capture files. 16268# 162690 string GMBU NetMon capture file 16270>5 byte x - version %d 16271>4 byte x \b.%d 16272>6 leshort 0 (Unknown) 16273>6 leshort 1 (Ethernet) 16274>6 leshort 2 (Token Ring) 16275>6 leshort 3 (FDDI) 16276>6 leshort 4 (ATM) 16277>6 leshort 5 (IP-over-IEEE 1394) 16278>6 leshort 6 (802.11) 16279>6 leshort 7 (Raw IP) 16280>6 leshort 8 (Raw IP) 16281>6 leshort 9 (Raw IP) 16282>6 leshort >9 (type %d) 16283 16284# 16285# Network General Sniffer capture files. 16286# Sorry, make that "Network Associates Sniffer capture files." 16287# Sorry, make that "Network General old DOS Sniffer capture files." 16288# 162890 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file 16290>33 byte 2 (compressed) 16291>23 leshort x - version %d 16292>25 leshort x \b.%d 16293>32 byte 0 (Token Ring) 16294>32 byte 1 (Ethernet) 16295>32 byte 2 (ARCNET) 16296>32 byte 3 (StarLAN) 16297>32 byte 4 (PC Network broadband) 16298>32 byte 5 (LocalTalk) 16299>32 byte 6 (Znet) 16300>32 byte 7 (Internetwork Analyzer) 16301>32 byte 9 (FDDI) 16302>32 byte 10 (ATM) 16303 16304# 16305# Cinco Networks NetXRay capture files. 16306# Sorry, make that "Network General Sniffer Basic capture files." 16307# Sorry, make that "Network Associates Sniffer Basic capture files." 16308# Sorry, make that "Network Associates Sniffer Basic, and Windows 16309# Sniffer Pro", capture files." 16310# Sorry, make that "Network General Sniffer capture files." 16311# Sorry, make that "NetScout Sniffer capture files." 16312# 163130 string XCP\0 NetXRay capture file 16314>4 string >\0 - version %s 16315>44 leshort 0 (Ethernet) 16316>44 leshort 1 (Token Ring) 16317>44 leshort 2 (FDDI) 16318>44 leshort 3 (WAN) 16319>44 leshort 8 (ATM) 16320>44 leshort 9 (802.11) 16321 16322# 16323# "libpcap" capture files. 16324# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is 16325# the main program that uses that format, but there are other programs 16326# that use "libpcap", or that use the same capture file format.) 16327# 163280 name pcap-be 16329>4 beshort x - version %d 16330>6 beshort x \b.%d 16331>20 belong 0 (No link-layer encapsulation 16332>20 belong 1 (Ethernet 16333>20 belong 2 (3Mb Ethernet 16334>20 belong 3 (AX.25 16335>20 belong 4 (ProNET 16336>20 belong 5 (CHAOS 16337>20 belong 6 (Token Ring 16338>20 belong 7 (BSD ARCNET 16339>20 belong 8 (SLIP 16340>20 belong 9 (PPP 16341>20 belong 10 (FDDI 16342>20 belong 11 (RFC 1483 ATM 16343>20 belong 12 (raw IP 16344>20 belong 13 (BSD/OS SLIP 16345>20 belong 14 (BSD/OS PPP 16346>20 belong 19 (Linux ATM Classical IP 16347>20 belong 50 (PPP or Cisco HDLC 16348>20 belong 51 (PPP-over-Ethernet 16349>20 belong 99 (Symantec Enterprise Firewall 16350>20 belong 100 (RFC 1483 ATM 16351>20 belong 101 (raw IP 16352>20 belong 102 (BSD/OS SLIP 16353>20 belong 103 (BSD/OS PPP 16354>20 belong 104 (BSD/OS Cisco HDLC 16355>20 belong 105 (802.11 16356>20 belong 106 (Linux Classical IP over ATM 16357>20 belong 107 (Frame Relay 16358>20 belong 108 (OpenBSD loopback 16359>20 belong 109 (OpenBSD IPsec encrypted 16360>20 belong 112 (Cisco HDLC 16361>20 belong 113 (Linux "cooked" 16362>20 belong 114 (LocalTalk 16363>20 belong 117 (OpenBSD PFLOG 16364>20 belong 119 (802.11 with Prism header 16365>20 belong 122 (RFC 2625 IP over Fibre Channel 16366>20 belong 123 (SunATM 16367>20 belong 127 (802.11 with radiotap header 16368>20 belong 129 (Linux ARCNET 16369>20 belong 138 (Apple IP over IEEE 1394 16370>20 belong 139 (MTP2 with pseudo-header 16371>20 belong 140 (MTP2 16372>20 belong 141 (MTP3 16373>20 belong 142 (SCCP 16374>20 belong 143 (DOCSIS 16375>20 belong 144 (IrDA 16376>20 belong 147 (Private use 0 16377>20 belong 148 (Private use 1 16378>20 belong 149 (Private use 2 16379>20 belong 150 (Private use 3 16380>20 belong 151 (Private use 4 16381>20 belong 152 (Private use 5 16382>20 belong 153 (Private use 6 16383>20 belong 154 (Private use 7 16384>20 belong 155 (Private use 8 16385>20 belong 156 (Private use 9 16386>20 belong 157 (Private use 10 16387>20 belong 158 (Private use 11 16388>20 belong 159 (Private use 12 16389>20 belong 160 (Private use 13 16390>20 belong 161 (Private use 14 16391>20 belong 162 (Private use 15 16392>20 belong 163 (802.11 with AVS header 16393>20 belong 165 (BACnet MS/TP 16394>20 belong 166 (PPPD 16395>20 belong 169 (GPRS LLC 16396>20 belong 177 (Linux LAPD 16397>20 belong 187 (Bluetooth HCI H4 16398>20 belong 189 (Linux USB 16399>20 belong 192 (PPI 16400>20 belong 195 (802.15.4 16401>20 belong 196 (SITA 16402>20 belong 197 (Endace ERF 16403>20 belong 201 (Bluetooth HCI H4 with pseudo-header 16404>20 belong 202 (AX.25 with KISS header 16405>20 belong 203 (LAPD 16406>20 belong 204 (PPP with direction pseudo-header 16407>20 belong 205 (Cisco HDLC with direction pseudo-header 16408>20 belong 206 (Frame Relay with direction pseudo-header 16409>20 belong 209 (Linux IPMB 16410>20 belong 215 (802.15.4 with non-ASK PHY header 16411>20 belong 220 (Memory-mapped Linux USB 16412>20 belong 224 (Fibre Channel FC-2 16413>20 belong 225 (Fibre Channel FC-2 with frame delimiters 16414>20 belong 226 (Solaris IPNET 16415>20 belong 227 (SocketCAN 16416>20 belong 228 (Raw IPv4 16417>20 belong 229 (Raw IPv6 16418>20 belong 230 (802.15.4 without FCS 16419>20 belong 231 (D-Bus messages 16420>20 belong 235 (DVB-CI 16421>20 belong 236 (MUX27010 16422>20 belong 237 (STANAG 5066 D_PDUs 16423>20 belong 239 (Linux netlink NFLOG messages 16424>20 belong 240 (Hilscher netAnalyzer 16425>20 belong 241 (Hilscher netAnalyzer with delimiters 16426>20 belong 242 (IP-over-Infiniband 16427>20 belong 243 (MPEG-2 Transport Stream packets 16428>20 belong 244 (ng4t ng40 16429>20 belong 245 (NFC LLCP 16430>20 belong 247 (Infiniband 16431>20 belong 248 (SCTP 16432>16 belong x \b, capture length %d) 16433 164340 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian) 16435!:mime application/vnd.tcpdump.pcap 16436>0 use pcap-be 164370 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian) 16438!:mime application/vnd.tcpdump.pcap 16439>0 use \^pcap-be 16440 16441# 16442# "libpcap"-with-Alexey-Kuznetsov's-patches capture files. 16443# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is 16444# the main program that uses that format, but there are other programs 16445# that use "libpcap", or that use the same capture file format.) 16446# 164470 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian) 16448>0 use pcap-be 164490 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian) 16450>0 use \^pcap-be 16451 16452# 16453# "pcap-ng" capture files. 16454# http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html 16455# Pcap-ng files can contain multiple sections. Printing the endianness, 16456# snaplen, or other information from the first SHB may be misleading. 16457# 164580 ubelong 0x0a0d0d0a 16459>8 ubelong 0x1a2b3c4d pcap-ng capture file 16460>>12 beshort x - version %d 16461>>14 beshort x \b.%d 164620 ulelong 0x0a0d0d0a 16463>8 ulelong 0x1a2b3c4d pcap-ng capture file 16464>>12 leshort x - version %d 16465>>14 leshort x \b.%d 16466 16467# 16468# AIX "iptrace" capture files. 16469# 164700 string iptrace\ 1.0 "iptrace" capture file 164710 string iptrace\ 2.0 "iptrace" capture file 16472 16473# 16474# Novell LANalyzer capture files. 16475# 164760 leshort 0x1001 LANalyzer capture file 164770 leshort 0x1007 LANalyzer capture file 16478 16479# 16480# HP-UX "nettl" capture files. 16481# 164820 string \x54\x52\x00\x64\x00 "nettl" capture file 16483 16484# 16485# RADCOM WAN/LAN Analyzer capture files. 16486# 164870 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file 16488 16489# 16490# NetStumbler log files. Not really packets, per se, but about as 16491# close as you can get. These are log files from NetStumbler, a 16492# Windows program, that scans for 802.11b networks. 16493# 164940 string NetS NetStumbler log file 16495>8 lelong x \b, %d stations found 16496 16497# 16498# *Peek tagged capture files. 16499# 165000 string \177ver EtherPeek/AiroPeek/OmniPeek capture file 16501 16502# 16503# Visual Networks traffic capture files. 16504# 165050 string \x05VNF Visual Networks traffic capture file 16506 16507# 16508# Network Instruments Observer capture files. 16509# 165100 string ObserverPktBuffe Network Instruments Observer capture file 16511 16512# 16513# Files from Accellent Group's 5View products. 16514# 165150 string \xaa\xaa\xaa\xaa 5View capture file 16516 16517#------------------------------------------------------------------------------ 16518# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $ 16519# softquad: file(1) magic for SoftQuad Publishing Software 16520# 16521# Author/Editor and RulesBuilder 16522# 16523# XXX - byte order? 16524# 165250 string \<!SQ\ DTD> Compiled SGML rules file 16526>9 string >\0 Type %s 165270 string \<!SQ\ A/E> A/E SGML Document binary 16528>9 string >\0 Type %s 165290 string \<!SQ\ STS> A/E SGML binary styles file 16530>9 string >\0 Type %s 165310 short 0xc0de Compiled PSI (v1) data 165320 short 0xc0da Compiled PSI (v2) data 16533>3 string >\0 (%s) 16534# Binary sqtroff font/desc files... 165350 short 0125252 SoftQuad DESC or font file binary 16536>2 short >0 - version %d 16537# Bitmaps... 165380 search/1 SQ\ BITMAP1 SoftQuad Raster Format text 16539#0 string SQ\ BITMAP2 SoftQuad Raster Format data 16540# sqtroff intermediate language (replacement for ditroff int. lang.) 165410 string X\ SoftQuad troff Context intermediate 16542>2 string 495 for AT&T 495 laser printer 16543>2 string hp for Hewlett-Packard LaserJet 16544>2 string impr for IMAGEN imPRESS 16545>2 string ps for PostScript 16546 16547# From: Michael Piefel <piefel@debian.org> 16548# sqtroff intermediate language (replacement for ditroff int. lang.) 165490 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer 165500 string X\ hp SoftQuad troff Context intermediate for HP LaserJet 165510 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS 165520 string X\ ps SoftQuad troff Context intermediate for PostScript 16553 16554#------------------------------------------------------------------------------ 16555# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $ 16556# spec: file(1) magic for SPEC raw results (*.raw, *.rsf) 16557# 16558# Cloyce D. Spradling <cloyce@headgear.org> 16559 165600 string spec SPEC 16561>4 string .cpu CPU 16562>>8 string <: \b%.4s 16563>>12 string . raw result text 16564 1656517 string version=SPECjbb SPECjbb 16566>32 string <: \b%.4s 16567>>37 string <: v%.4s raw result text 16568 165690 string BEGIN\040SPECWEB SPECweb 16570>13 string <: \b%.2s 16571>>15 string _SSL \b_SSL 16572>>>20 string <: v%.4s raw result text 16573>>16 string <: v%.4s raw result text 16574 16575#------------------------------------------------------------------------------ 16576# $File: spectrum,v 1.7 2010/09/20 18:55:20 rrt Exp $ 16577# spectrum: file(1) magic for Spectrum emulator files. 16578# 16579# John Elliott <jce@seasip.demon.co.uk> 16580 16581# 16582# Spectrum +3DOS header 16583# 165840 string PLUS3DOS\032 Spectrum +3 data 16585>15 byte 0 - BASIC program 16586>15 byte 1 - number array 16587>15 byte 2 - character array 16588>15 byte 3 - memory block 16589>>16 belong 0x001B0040 (screen) 16590>15 byte 4 - Tasword document 16591>15 string TAPEFILE - ZXT tapefile 16592# 16593# Tape file. This assumes the .TAP starts with a Spectrum-format header, 16594# which nearly all will. 16595# 16596# Update: Sanity-check string contents to be printable. 16597# -Adam Buchbinder <adam.buchbinder@gmail.com> 16598# 165990 string \023\000\000 16600>4 string >\0 16601>>4 string <\177 Spectrum .TAP data "%-10.10s" 16602>>>3 byte 0 - BASIC program 16603>>>3 byte 1 - number array 16604>>>3 byte 2 - character array 16605>>>3 byte 3 - memory block 16606>>>>14 belong 0x001B0040 (screen) 16607 16608# The following three blocks are from pak21-spectrum@srcf.ucam.org 16609# TZX tape images 166100 string ZXTape!\x1a Spectrum .TZX data 16611>8 byte x version %d 16612>9 byte x \b.%d 16613 16614# RZX input recording files 166150 string RZX! Spectrum .RZX data 16616>4 byte x version %d 16617>5 byte x \b.%d 16618 16619# Floppy disk images 166200 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data 166210 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data 166220 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data 166230 string SINCLAIR Spectrum .SCL Betadisk image 16624 16625# Hard disk images 166260 string RS-IDE\x1a Spectrum .HDF hard disk image 16627>7 byte x \b, version 0x%02x 16628 16629#------------------------------------------------------------------------------ 16630# $File: sql,v 1.11 2013/02/21 15:27:01 christos Exp $ 16631# sql: file(1) magic for SQL files 16632# 16633# From: "Marty Leisner" <mleisner@eng.mc.xerox.com> 16634# Recognize some MySQL files. 16635# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures 16636# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic 16637# 166380 beshort 0xfe01 MySQL table definition file 16639>2 byte x Version %d 166400 belong&0xffffff00 0xfefe0700 MySQL MyISAM index file 16641>3 byte x Version %d 166420 belong&0xffffff00 0xfefe0800 MySQL MyISAM compressed data file 16643>3 byte x Version %d 166440 belong&0xffffff00 0xfefe0900 MySQL Maria index file 16645>3 byte x Version %d 166460 belong&0xffffff00 0xfefe0A00 MySQL Maria compressed data file 16647>3 byte x Version %d 166480 belong&0xffffff00 0xfefe0500 MySQL ISAM index file 16649>3 byte x Version %d 166500 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file 16651>3 byte x Version %d 166520 string \376bin MySQL replication log 166530 belong&0xffffff00 0xfefe0b00 16654>4 string MARIALOG MySQL Maria transaction log file 16655>>3 byte x Version %d 166560 belong&0xffffff00 0xfefe0c00 16657>4 string MACF MySQL Maria control file 16658>>3 byte x Version %d 16659 16660#------------------------------------------------------------------------------ 16661# iRiver H Series database file 16662# From Ken Guest <ken@linux.ie> 16663# As observed from iRivNavi.iDB and unencoded firmware 16664# 166650 string iRivDB iRiver Database file 16666>11 string >\0 Version %s 16667>39 string iHP-100 [H Series] 16668 16669#------------------------------------------------------------------------------ 16670# SQLite database files 16671# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg 16672# 16673# Version 1 used GDBM internally; its files cannot be distinguished 16674# from other GDBM files. 16675# 16676# Version 2 used this format: 166770 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database 16678 16679# Version 3 of SQLite allows applications to embed their own "user version" 16680# number in the database. Detect this and distinguish those files. 16681 166820 string SQLite\ format\ 3 16683>60 string _MTN Monotone source repository 16684>60 belong !0 SQLite 3.x database, user version %u 16685>60 belong 0 SQLite 3.x database 16686 16687# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek 16688# http://www.ullrich.es/job/service-menue/panasonic/panasonic-sendersortierung-sat-am-pc/ 16689# pceditor_V2003.jar 166900 string PSDB\0 Panasonic channel list database 16691>126 string SQLite\ format\ 3 16692>>&-15 indirect x \b; contains 16693# Type: OpenSSH key files 16694# From: Nicolas Collignon <tsointsoin@gmail.com> 16695 166960 string SSH\ PRIVATE\ KEY OpenSSH RSA1 private key, 16697>28 string >\0 version %s 16698 166990 string ssh-dss\ OpenSSH DSA public key 167000 string ssh-rsa\ OpenSSH RSA public key 16701# Type: OpenSSL certificates/key files 16702# From: Nicolas Collignon <tsointsoin@gmail.com> 16703 167040 string -----BEGIN\ CERTIFICATE----- PEM certificate 167050 string -----BEGIN\ CERTIFICATE\ REQ PEM certificate request 167060 string -----BEGIN\ RSA\ PRIVATE PEM RSA private key 167070 string -----BEGIN\ DSA\ PRIVATE PEM DSA private key 16708 16709#------------------------------------------------------------------------------ 16710# $File: sun,v 1.25 2013/01/09 22:37:24 christos Exp $ 16711# sun: file(1) magic for Sun machines 16712# 16713# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x 16714# releases. (5.x uses ELF.) Entries for executables without an 16715# architecture type, used before the 68020-based Sun-3's came out, 16716# are in aout, as they're indistinguishable from other big-endian 16717# 32-bit a.out files. 16718# 167190 belong&077777777 0600413 a.out SunOS sparc demand paged 16720>0 byte &0x80 16721>>20 belong <4096 shared library 16722>>20 belong =4096 dynamically linked executable 16723>>20 belong >4096 dynamically linked executable 16724>0 byte ^0x80 executable 16725>16 belong >0 not stripped 16726 167270 belong&077777777 0600410 a.out SunOS sparc pure 16728>0 byte &0x80 dynamically linked executable 16729>0 byte ^0x80 executable 16730>16 belong >0 not stripped 16731 167320 belong&077777777 0600407 a.out SunOS sparc 16733>0 byte &0x80 dynamically linked executable 16734>0 byte ^0x80 executable 16735>16 belong >0 not stripped 16736 167370 belong&077777777 0400413 a.out SunOS mc68020 demand paged 16738>0 byte &0x80 16739>>20 belong <4096 shared library 16740>>20 belong =4096 dynamically linked executable 16741>>20 belong >4096 dynamically linked executable 16742>0 byte ^0x80 executable 16743>16 belong >0 not stripped 16744 167450 belong&077777777 0400410 a.out SunOS mc68020 pure 16746>0 byte &0x80 dynamically linked executable 16747>0 byte ^0x80 executable 16748>16 belong >0 not stripped 16749 167500 belong&077777777 0400407 a.out SunOS mc68020 16751>0 byte &0x80 dynamically linked executable 16752>0 byte ^0x80 executable 16753>16 belong >0 not stripped 16754 167550 belong&077777777 0200413 a.out SunOS mc68010 demand paged 16756>0 byte &0x80 16757>>20 belong <4096 shared library 16758>>20 belong =4096 dynamically linked executable 16759>>20 belong >4096 dynamically linked executable 16760>0 byte ^0x80 executable 16761>16 belong >0 not stripped 16762 167630 belong&077777777 0200410 a.out SunOS mc68010 pure 16764>0 byte &0x80 dynamically linked executable 16765>0 byte ^0x80 executable 16766>16 belong >0 not stripped 16767 167680 belong&077777777 0200407 a.out SunOS mc68010 16769>0 byte &0x80 dynamically linked executable 16770>0 byte ^0x80 executable 16771>16 belong >0 not stripped 16772 16773# 16774# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC 16775# binary executed in compatibility mode under SunOS 5.x". 16776# 167770 belong 0x080456 SunOS core file 16778>4 belong 432 (SPARC) 16779>>132 string >\0 from '%s' 16780>>116 belong =3 (quit) 16781>>116 belong =4 (illegal instruction) 16782>>116 belong =5 (trace trap) 16783>>116 belong =6 (abort) 16784>>116 belong =7 (emulator trap) 16785>>116 belong =8 (arithmetic exception) 16786>>116 belong =9 (kill) 16787>>116 belong =10 (bus error) 16788>>116 belong =11 (segmentation violation) 16789>>116 belong =12 (bad argument to system call) 16790>>116 belong =29 (resource lost) 16791>>120 belong x (T=%dK, 16792>>124 belong x D=%dK, 16793>>128 belong x S=%dK) 16794>4 belong 826 (68K) 16795>>128 string >\0 from '%s' 16796>4 belong 456 (SPARC 4.x BCP) 16797>>152 string >\0 from '%s' 16798# Sun SunPC 167990 long 0xfa33c08e SunPC 4.0 Hard Disk 168000 string #SUNPC_CONFIG SunPC 4.0 Properties Values 16801# Sun snoop (see RFC 1761, which describes the capture file format, 16802# RFC 3827, which describes some additional datalink types, and 16803# http://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml, 16804# which is the IANA registry of Snoop datalink types) 16805# 168060 string snoop Snoop capture file 16807>8 belong >0 - version %ld 16808>12 belong 0 (IEEE 802.3) 16809>12 belong 1 (IEEE 802.4) 16810>12 belong 2 (IEEE 802.5) 16811>12 belong 3 (IEEE 802.6) 16812>12 belong 4 (Ethernet) 16813>12 belong 5 (HDLC) 16814>12 belong 6 (Character synchronous) 16815>12 belong 7 (IBM channel-to-channel adapter) 16816>12 belong 8 (FDDI) 16817>12 belong 9 (Other) 16818>12 belong 10 (type %ld) 16819>12 belong 11 (type %ld) 16820>12 belong 12 (type %ld) 16821>12 belong 13 (type %ld) 16822>12 belong 14 (type %ld) 16823>12 belong 15 (type %ld) 16824>12 belong 16 (Fibre Channel) 16825>12 belong 17 (ATM) 16826>12 belong 18 (ATM Classical IP) 16827>12 belong 19 (type %ld) 16828>12 belong 20 (type %ld) 16829>12 belong 21 (type %ld) 16830>12 belong 22 (type %ld) 16831>12 belong 23 (type %ld) 16832>12 belong 24 (type %ld) 16833>12 belong 25 (type %ld) 16834>12 belong 26 (IP over Infiniband) 16835>12 belong >26 (type %ld) 16836 16837#--------------------------------------------------------------------------- 16838# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a 16839# lead Sun/Cobalt developer) who agrees that they are good and worthy of 16840# inclusion. 16841 16842# Boot ROM images for Sun/Cobalt Linux server appliances 168430 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom 16844>38 string x V%.4s 16845 16846# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code 16847# at the very end where file(1) can't get it. 168480 string CRfs COBALT boot rom data (Flat boot rom or file system) 16849 16850#------------------------------------------------------------------------ 16851# $File: sysex,v 1.6 2009/09/19 16:28:12 christos Exp $ 16852# sysex: file(1) magic for MIDI sysex files 16853# 16854# 168550 byte 0xF0 SysEx File - 16856 16857# North American Group 16858>1 byte 0x01 Sequential 16859>1 byte 0x02 IDP 16860>1 byte 0x03 OctavePlateau 16861>1 byte 0x04 Moog 16862>1 byte 0x05 Passport 16863>1 byte 0x06 Lexicon 16864>1 byte 0x07 Kurzweil/Future Retro 16865>>3 byte 0x77 777 16866>>4 byte 0x00 Bank 16867>>4 byte 0x01 Song 16868>>5 byte 0x0f 16 16869>>5 byte 0x0e 15 16870>>5 byte 0x0d 14 16871>>5 byte 0x0c 13 16872>>5 byte 0x0b 12 16873>>5 byte 0x0a 11 16874>>5 byte 0x09 10 16875>>5 byte 0x08 9 16876>>5 byte 0x07 8 16877>>5 byte 0x06 7 16878>>5 byte 0x05 6 16879>>5 byte 0x04 5 16880>>5 byte 0x03 4 16881>>5 byte 0x02 3 16882>>5 byte 0x01 2 16883>>5 byte 0x00 1 16884>>5 byte 0x10 (ALL) 16885>>2 byte x \b, Channel %d 16886>1 byte 0x08 Fender 16887>1 byte 0x09 Gulbransen 16888>1 byte 0x0a AKG 16889>1 byte 0x0b Voyce 16890>1 byte 0x0c Waveframe 16891>1 byte 0x0d ADA 16892>1 byte 0x0e Garfield 16893>1 byte 0x0f Ensoniq 16894>1 byte 0x10 Oberheim 16895>>2 byte 0x06 Matrix 6 series 16896>>3 byte 0x0A Dump (All) 16897>>3 byte 0x01 Dump (Bank) 16898>>4 belong 0x0002040E Matrix 1000 16899>>>11 byte <2 User bank %d 16900>>>11 byte >1 Preset bank %d 16901>1 byte 0x11 Apple 16902>1 byte 0x12 GreyMatter 16903>1 byte 0x14 PalmTree 16904>1 byte 0x15 JLCooper 16905>1 byte 0x16 Lowrey 16906>1 byte 0x17 AdamsSmith 16907>1 byte 0x18 E-mu 16908>1 byte 0x19 Harmony 16909>1 byte 0x1a ART 16910>1 byte 0x1b Baldwin 16911>1 byte 0x1c Eventide 16912>1 byte 0x1d Inventronics 16913>1 byte 0x1f Clarity 16914 16915# European Group 16916>1 byte 0x21 SIEL 16917>1 byte 0x22 Synthaxe 16918>1 byte 0x24 Hohner 16919>1 byte 0x25 Twister 16920>1 byte 0x26 Solton 16921>1 byte 0x27 Jellinghaus 16922>1 byte 0x28 Southworth 16923>1 byte 0x29 PPG 16924>1 byte 0x2a JEN 16925>1 byte 0x2b SSL 16926>1 byte 0x2c AudioVertrieb 16927 16928>1 byte 0x2f ELKA 16929>>3 byte 0x09 EK-44 16930 16931>1 byte 0x30 Dynacord 16932>1 byte 0x31 Jomox 16933>1 byte 0x33 Clavia 16934>1 byte 0x39 Soundcraft 16935# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs 16936>1 byte 0x3e Waldorf 16937>>2 byte 0x00 microWave 16938>>2 byte 0x0E microwave2 / XT 16939>>2 byte 0x0F Q / Q+ 16940>>3 byte =0 (default id) 16941>>3 byte >0 ( 16942>>>3 byte <0x7F \bdevice %d) 16943>>>3 byte =0x7F \bbroadcast id) 16944>>3 byte 0x7f Microwave I 16945>>>4 byte 0x00 SNDR (Sound Request) 16946>>>4 byte 0x10 SNDD (Sound Dump) 16947>>>4 byte 0x20 SNDP (Sound Parameter Change) 16948>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 16949>>>4 byte 0x70 BOOT (Sound Reserved) 16950>>>4 byte 0x01 MULR (Multi Request) 16951>>>4 byte 0x11 MULD (Multi Dump) 16952>>>4 byte 0x21 MULP (Multi Parameter Change) 16953>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 16954>>>4 byte 0x71 OS (Multi Reserved) 16955>>>4 byte 0x02 DRMR (Drum Map Request) 16956>>>4 byte 0x12 DRMD (Drum Map Dump) 16957>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 16958>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 16959>>>4 byte 0x72 BIN (Drum Map Reserved) 16960>>>4 byte 0x03 PATR (Sequencer Pattern Request) 16961>>>4 byte 0x13 PATD (Sequencer Pattern Dump) 16962>>>4 byte 0x23 PATP (Sequencer Pattern Parameter Change) 16963>>>4 byte 0x33 PATQ (Sequencer Pattern Parameter Inquiry) 16964>>>4 byte 0x73 AFM (Sequencer Pattern Reserved) 16965>>>4 byte 0x04 GLBR (Global Parameter Request) 16966>>>4 byte 0x14 GLBD (Global Parameter Dump) 16967>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 16968>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 16969>>>4 byte 0x07 MODR (Mode Parameter Request) 16970>>>4 byte 0x17 MODD (Mode Parameter Dump) 16971>>>4 byte 0x27 MODP (Mode Parameter Parameter Change) 16972>>>4 byte 0x37 MODQ (Mode Parameter Parameter Inquiry) 16973>>2 byte 0x10 microQ 16974>>>4 byte 0x00 SNDR (Sound Request) 16975>>>4 byte 0x10 SNDD (Sound Dump) 16976>>>4 byte 0x20 SNDP (Sound Parameter Change) 16977>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 16978>>>4 byte 0x70 (Sound Reserved) 16979>>>4 byte 0x01 MULR (Multi Request) 16980>>>4 byte 0x11 MULD (Multi Dump) 16981>>>4 byte 0x21 MULP (Multi Parameter Change) 16982>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 16983>>>4 byte 0x71 OS (Multi Reserved) 16984>>>4 byte 0x02 DRMR (Drum Map Request) 16985>>>4 byte 0x12 DRMD (Drum Map Dump) 16986>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 16987>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 16988>>>4 byte 0x72 BIN (Drum Map Reserved) 16989>>>4 byte 0x04 GLBR (Global Parameter Request) 16990>>>4 byte 0x14 GLBD (Global Parameter Dump) 16991>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 16992>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 16993>>2 byte 0x11 rackAttack 16994>>>4 byte 0x00 SNDR (Sound Parameter Request) 16995>>>4 byte 0x10 SNDD (Sound Parameter Dump) 16996>>>4 byte 0x20 SNDP (Sound Parameter Parameter Change) 16997>>>4 byte 0x30 SNDQ (Sound Parameter Parameter Inquiry) 16998>>>4 byte 0x01 PRGR (Program Parameter Request) 16999>>>4 byte 0x11 PRGD (Program Parameter Dump) 17000>>>4 byte 0x21 PRGP (Program Parameter Parameter Change) 17001>>>4 byte 0x31 PRGQ (Program Parameter Parameter Inquiry) 17002>>>4 byte 0x71 OS (Program Parameter Reserved) 17003>>>4 byte 0x03 PATR (Pattern Parameter Request) 17004>>>4 byte 0x13 PATD (Pattern Parameter Dump) 17005>>>4 byte 0x23 PATP (Pattern Parameter Parameter Change) 17006>>>4 byte 0x33 PATQ (Pattern Parameter Parameter Inquiry) 17007>>>4 byte 0x04 GLBR (Global Parameter Request) 17008>>>4 byte 0x14 GLBD (Global Parameter Dump) 17009>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 17010>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 17011>>>4 byte 0x05 EFXR (FX Parameter Request) 17012>>>4 byte 0x15 EFXD (FX Parameter Dump) 17013>>>4 byte 0x25 EFXP (FX Parameter Parameter Change) 17014>>>4 byte 0x35 EFXQ (FX Parameter Parameter Inquiry) 17015>>>4 byte 0x07 MODR (Mode Command Request) 17016>>>4 byte 0x17 MODD (Mode Command Dump) 17017>>>4 byte 0x27 MODP (Mode Command Parameter Change) 17018>>>4 byte 0x37 MODQ (Mode Command Parameter Inquiry) 17019>>2 byte 0x03 Wave 17020>>>4 byte 0x00 SBPR (Soundprogram) 17021>>>4 byte 0x01 SAPR (Performance) 17022>>>4 byte 0x02 SWAVE (Wave) 17023>>>4 byte 0x03 SWTBL (Wave control table) 17024>>>4 byte 0x04 SVT (Velocity Curve) 17025>>>4 byte 0x05 STT (Tuning Table) 17026>>>4 byte 0x06 SGLB (Global Parameters) 17027>>>4 byte 0x07 SARRMAP (Performance Program Change Map) 17028>>>4 byte 0x08 SBPRMAP (Sound Program Change Map) 17029>>>4 byte 0x09 SBPRPAR (Sound Parameter) 17030>>>4 byte 0x0A SARRPAR (Performance Parameter) 17031>>>4 byte 0x0B SINSPAR (Instrument/External Parameter) 17032>>>4 byte 0x0F SBULK (Bulk Switch on/off) 17033 17034# Japanese Group 17035>1 byte 0x40 Kawai 17036>>3 byte 0x20 K1 17037>>3 byte 0x22 K4 17038 17039>1 byte 0x41 Roland 17040>>3 byte 0x14 D-50 17041>>3 byte 0x2b U-220 17042>>3 byte 0x02 TR-707 17043 17044>1 byte 0x42 Korg 17045>>3 byte 0x19 M1 17046 17047>1 byte 0x43 Yamaha 17048>1 byte 0x44 Casio 17049>1 byte 0x46 Kamiya 17050>1 byte 0x47 Akai 17051>1 byte 0x48 Victor 17052>1 byte 0x49 Mesosha 17053>1 byte 0x4b Fujitsu 17054>1 byte 0x4c Sony 17055>1 byte 0x4e Teac 17056>1 byte 0x50 Matsushita 17057>1 byte 0x51 Fostex 17058>1 byte 0x52 Zoom 17059>1 byte 0x54 Matsushita 17060>1 byte 0x57 Acoustic tech. lab. 17061 17062>1 belong&0xffffff00 0x00007400 Ta Horng 17063>1 belong&0xffffff00 0x00007500 e-Tek 17064>1 belong&0xffffff00 0x00007600 E-Voice 17065>1 belong&0xffffff00 0x00007700 Midisoft 17066>1 belong&0xffffff00 0x00007800 Q-Sound 17067>1 belong&0xffffff00 0x00007900 Westrex 17068>1 belong&0xffffff00 0x00007a00 Nvidia* 17069>1 belong&0xffffff00 0x00007b00 ESS 17070>1 belong&0xffffff00 0x00007c00 Mediatrix 17071>1 belong&0xffffff00 0x00007d00 Brooktree 17072>1 belong&0xffffff00 0x00007e00 Otari 17073>1 belong&0xffffff00 0x00007f00 Key Electronics 17074>1 belong&0xffffff00 0x00010000 Shure 17075>1 belong&0xffffff00 0x00010100 AuraSound 17076>1 belong&0xffffff00 0x00010200 Crystal 17077>1 belong&0xffffff00 0x00010300 Rockwell 17078>1 belong&0xffffff00 0x00010400 Silicon Graphics 17079>1 belong&0xffffff00 0x00010500 Midiman 17080>1 belong&0xffffff00 0x00010600 PreSonus 17081>1 belong&0xffffff00 0x00010800 Topaz 17082>1 belong&0xffffff00 0x00010900 Cast Lightning 17083>1 belong&0xffffff00 0x00010a00 Microsoft 17084>1 belong&0xffffff00 0x00010b00 Sonic Foundry 17085>1 belong&0xffffff00 0x00010c00 Line 6 17086>1 belong&0xffffff00 0x00010d00 Beatnik Inc. 17087>1 belong&0xffffff00 0x00010e00 Van Koerving 17088>1 belong&0xffffff00 0x00010f00 Altech Systems 17089>1 belong&0xffffff00 0x00011000 S & S Research 17090>1 belong&0xffffff00 0x00011100 VLSI Technology 17091>1 belong&0xffffff00 0x00011200 Chromatic 17092>1 belong&0xffffff00 0x00011300 Sapphire 17093>1 belong&0xffffff00 0x00011400 IDRC 17094>1 belong&0xffffff00 0x00011500 Justonic Tuning 17095>1 belong&0xffffff00 0x00011600 TorComp 17096>1 belong&0xffffff00 0x00011700 Newtek Inc. 17097>1 belong&0xffffff00 0x00011800 Sound Sculpture 17098>1 belong&0xffffff00 0x00011900 Walker Technical 17099>1 belong&0xffffff00 0x00011a00 Digital Harmony 17100>1 belong&0xffffff00 0x00011b00 InVision 17101>1 belong&0xffffff00 0x00011c00 T-Square 17102>1 belong&0xffffff00 0x00011d00 Nemesys 17103>1 belong&0xffffff00 0x00011e00 DBX 17104>1 belong&0xffffff00 0x00011f00 Syndyne 17105>1 belong&0xffffff00 0x00012000 Bitheadz 17106>1 belong&0xffffff00 0x00012100 Cakewalk 17107>1 belong&0xffffff00 0x00012200 Staccato 17108>1 belong&0xffffff00 0x00012300 National Semicon. 17109>1 belong&0xffffff00 0x00012400 Boom Theory 17110>1 belong&0xffffff00 0x00012500 Virtual DSP Corp 17111>1 belong&0xffffff00 0x00012600 Antares 17112>1 belong&0xffffff00 0x00012700 Angel Software 17113>1 belong&0xffffff00 0x00012800 St Louis Music 17114>1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX 17115>1 belong&0xffffff00 0x00012a00 Ashley Audio 17116>1 belong&0xffffff00 0x00012b00 Vari-Lite 17117>1 belong&0xffffff00 0x00012c00 Summit Audio 17118>1 belong&0xffffff00 0x00012d00 Aureal Semicon. 17119>1 belong&0xffffff00 0x00012e00 SeaSound 17120>1 belong&0xffffff00 0x00012f00 U.S. Robotics 17121>1 belong&0xffffff00 0x00013000 Aurisis 17122>1 belong&0xffffff00 0x00013100 Nearfield Multimedia 17123>1 belong&0xffffff00 0x00013200 FM7 Inc. 17124>1 belong&0xffffff00 0x00013300 Swivel Systems 17125>1 belong&0xffffff00 0x00013400 Hyperactive 17126>1 belong&0xffffff00 0x00013500 MidiLite 17127>1 belong&0xffffff00 0x00013600 Radical 17128>1 belong&0xffffff00 0x00013700 Roger Linn 17129>1 belong&0xffffff00 0x00013800 Helicon 17130>1 belong&0xffffff00 0x00013900 Event 17131>1 belong&0xffffff00 0x00013a00 Sonic Network 17132>1 belong&0xffffff00 0x00013b00 Realtime Music 17133>1 belong&0xffffff00 0x00013c00 Apogee Digital 17134 17135>1 belong&0xffffff00 0x00202b00 Medeli Electronics 17136>1 belong&0xffffff00 0x00202c00 Charlie Lab 17137>1 belong&0xffffff00 0x00202d00 Blue Chip Music 17138>1 belong&0xffffff00 0x00202e00 BEE OH Corp 17139>1 belong&0xffffff00 0x00202f00 LG Semicon America 17140>1 belong&0xffffff00 0x00203000 TESI 17141>1 belong&0xffffff00 0x00203100 EMAGIC 17142>1 belong&0xffffff00 0x00203200 Behringer 17143>1 belong&0xffffff00 0x00203300 Access Music 17144>1 belong&0xffffff00 0x00203400 Synoptic 17145>1 belong&0xffffff00 0x00203500 Hanmesoft Corp 17146>1 belong&0xffffff00 0x00203600 Terratec 17147>1 belong&0xffffff00 0x00203700 Proel SpA 17148>1 belong&0xffffff00 0x00203800 IBK MIDI 17149>1 belong&0xffffff00 0x00203900 IRCAM 17150>1 belong&0xffffff00 0x00203a00 Propellerhead Software 17151>1 belong&0xffffff00 0x00203b00 Red Sound Systems 17152>1 belong&0xffffff00 0x00203c00 Electron ESI AB 17153>1 belong&0xffffff00 0x00203d00 Sintefex Audio 17154>1 belong&0xffffff00 0x00203e00 Music and More 17155>1 belong&0xffffff00 0x00203f00 Amsaro 17156>1 belong&0xffffff00 0x00204000 CDS Advanced Technology 17157>1 belong&0xffffff00 0x00204100 Touched by Sound 17158>1 belong&0xffffff00 0x00204200 DSP Arts 17159>1 belong&0xffffff00 0x00204300 Phil Rees Music 17160>1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH 17161>1 belong&0xffffff00 0x00204500 Soundart 17162>1 belong&0xffffff00 0x00204600 C-Mexx Software 17163>1 belong&0xffffff00 0x00204700 Klavis Tech. 17164>1 belong&0xffffff00 0x00204800 Noteheads AB 17165 171660 string T707 Roland TR-707 Data 17167#------------------------------------------------------------------------------ 17168# file: file(1) magic for Tcl scripting language 17169# URL: http://www.tcl.tk/ 17170# From: gustaf neumann 17171 17172# Tcl scripts 171730 search/1/w #!\ /usr/bin/tcl Tcl script text executable 17174!:mime text/x-lua 171750 search/1/w #!\ /usr/local/bin/tcl Tcl script text executable 17176!:mime text/x-tcl 171770 search/1 #!/usr/bin/env\ tcl Tcl script text executable 17178!:mime text/x-tcl 171790 search/1 #!\ /usr/bin/env\ tcl Tcl script text executable 17180!:mime text/x-tcl 171810 search/1/w #!\ /usr/bin/wish Tcl/Tk script text executable 17182!:mime text/x-tcl 171830 search/1/w #!\ /usr/local/bin/wish Tcl/Tk script text executable 17184!:mime text/x-tcl 171850 search/1 #!/usr/bin/env\ wish Tcl/Tk script text executable 17186!:mime text/x-tcl 171870 search/1 #!\ /usr/bin/env\ wish Tcl/Tk script text executable 17188!:mime text/x-tcl 17189 17190# check the first line 171910 search/1 package\ req 17192>0 regex \^package[\ \t]+req Tcl script 17193# not 'p', check other lines 171940 search/1 !p 17195>0 regex \^package[\ \t]+req Tcl script 17196 17197#------------------------------------------------------------------------------ 17198# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $ 17199# teapot: file(1) magic for "teapot" spreadsheet 17200# 172010 string #!teapot\012xdr teapot work sheet (XDR format) 17202 17203#------------------------------------------------------------------------------ 17204# $File: terminfo,v 1.6 2009/09/19 16:28:12 christos Exp $ 17205# terminfo: file(1) magic for terminfo 17206# 17207# XXX - byte order for screen images? 17208# 172090 string \032\001 Compiled terminfo entry 172100 short 0433 Curses screen image 172110 short 0434 Curses screen image 17212 17213#------------------------------------------------------------------------------ 17214# $File: tex,v 1.18 2011/02/08 13:45:15 christos Exp $ 17215# tex: file(1) magic for TeX files 17216# 17217# XXX - needs byte-endian stuff (big-endian and little-endian DVI?) 17218# 17219# From <conklin@talisman.kaleida.com> 17220 17221# Although we may know the offset of certain text fields in TeX DVI 17222# and font files, we can't use them reliably because they are not 17223# zero terminated. [but we do anyway, christos] 172240 string \367\002 TeX DVI file 17225!:mime application/x-dvi 17226>16 string >\0 (%s) 172270 string \367\203 TeX generic font data 172280 string \367\131 TeX packed font data 17229>3 string >\0 (%s) 172300 string \367\312 TeX virtual font data 172310 search/1 This\ is\ TeX, TeX transcript text 172320 search/1 This\ is\ METAFONT, METAFONT transcript text 17233 17234# There is no way to detect TeX Font Metric (*.tfm) files without 17235# breaking them apart and reading the data. The following patterns 17236# match most *.tfm files generated by METAFONT or afm2tfm. 172372 string \000\021 TeX font metric data 17238!:mime application/x-tex-tfm 17239>33 string >\0 (%s) 172402 string \000\022 TeX font metric data 17241!:mime application/x-tex-tfm 17242>33 string >\0 (%s) 17243 17244# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com) 172450 search/1 \\input\ texinfo Texinfo source text 17246!:mime text/x-texinfo 172470 search/1 This\ is\ Info\ file GNU Info text 17248!:mime text/x-info 17249 17250# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com) 172510 search/4096 \\input TeX document text 17252!:mime text/x-tex 17253!:strength + 15 172540 search/4096 \\section LaTeX document text 17255!:mime text/x-tex 17256!:strength + 18 172570 search/4096 \\setlength LaTeX document text 17258!:mime text/x-tex 17259!:strength + 15 172600 search/4096 \\documentstyle LaTeX document text 17261!:mime text/x-tex 17262!:strength + 18 172630 search/4096 \\chapter LaTeX document text 17264!:mime text/x-tex 17265!:strength + 18 172660 search/4096 \\documentclass LaTeX 2e document text 17267!:mime text/x-tex 17268!:strength + 15 172690 search/4096 \\relax LaTeX auxiliary file 17270!:mime text/x-tex 17271!:strength + 15 172720 search/4096 \\contentsline LaTeX table of contents 17273!:mime text/x-tex 17274!:strength + 15 172750 search/4096 %\ -*-latex-*- LaTeX document text 17276!:mime text/x-tex 17277 17278# Tex document, from Hendrik Scholz <hendrik@scholz.net> 172790 search/1 \\ifx TeX document text 17280 17281# Index and glossary files 172820 search/4096 \\indexentry LaTeX raw index file 172830 search/4096 \\begin{theindex} LaTeX sorted index 172840 search/4096 \\glossaryentry LaTeX raw glossary 172850 search/4096 \\begin{theglossary} LaTeX sorted glossary 172860 search/4096 This\ is\ makeindex Makeindex log file 17287 17288# End of TeX 17289 17290#------------------------------------------------------------------------------ 17291# file(1) magic for BibTex text files 17292# From Hendrik Scholz <hendrik@scholz.net> 17293 172940 search/1/c @article{ BibTeX text file 172950 search/1/c @book{ BibTeX text file 172960 search/1/c @inbook{ BibTeX text file 172970 search/1/c @incollection{ BibTeX text file 172980 search/1/c @inproceedings{ BibTeX text file 172990 search/1/c @manual{ BibTeX text file 173000 search/1/c @misc{ BibTeX text file 173010 search/1/c @preamble{ BibTeX text file 173020 search/1/c @phdthesis{ BibTeX text file 173030 search/1/c @techreport{ BibTeX text file 173040 search/1/c @unpublished{ BibTeX text file 17305 1730673 search/1 %%%\ \ BibTeX-file{ BibTex text file (with full header) 17307 1730873 search/1 %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header) 17309 173100 search/1 %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file 17311 173120 search/1 %\ BibTeX\ ` BibTeX custom bibliography style text file 17313 173140 search/1 @c\ @mapfile{ TeX font aliases text file 17315 173160 string #LyX LyX document text 17317 17318#------------------------------------------------------------------------------ 17319# $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $ 17320# file(1) magic for tgif(1) files 17321# From Hendrik Scholz <hendrik@scholz.net> 173220 string %TGIF\ Tgif file version 17323>6 string x %s 17324 17325#------------------------------------------------------------------------------ 17326# $File: ti-8x,v 1.6 2009/09/19 16:28:12 christos Exp $ 17327# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators. 17328# 17329# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us). 17330# 17331# Update: Romain Lievin (roms@lpg.ticalc.org). 17332# 17333# NOTE: This list is not complete. 17334# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the 17335# program/group magic numbers in here because I cannot find any. 173360 string **TI80** TI-80 Graphing Calculator File. 173370 string **TI81** TI-81 Graphing Calculator File. 17338# 17339# Magic Numbers for the TI-73 17340# 173410 string **TI73** TI-73 Graphing Calculator 17342>0x00003B byte 0x00 (real number) 17343>0x00003B byte 0x01 (list) 17344>0x00003B byte 0x02 (matrix) 17345>0x00003B byte 0x03 (equation) 17346>0x00003B byte 0x04 (string) 17347>0x00003B byte 0x05 (program) 17348>0x00003B byte 0x06 (assembly program) 17349>0x00003B byte 0x07 (picture) 17350>0x00003B byte 0x08 (gdb) 17351>0x00003B byte 0x0C (complex number) 17352>0x00003B byte 0x0F (window settings) 17353>0x00003B byte 0x10 (zoom) 17354>0x00003B byte 0x11 (table setup) 17355>0x00003B byte 0x13 (backup) 17356 17357# Magic Numbers for the TI-82 17358# 173590 string **TI82** TI-82 Graphing Calculator 17360>0x00003B byte 0x00 (real) 17361>0x00003B byte 0x01 (list) 17362>0x00003B byte 0x02 (matrix) 17363>0x00003B byte 0x03 (Y-variable) 17364>0x00003B byte 0x05 (program) 17365>0x00003B byte 0x06 (protected prgm) 17366>0x00003B byte 0x07 (picture) 17367>0x00003B byte 0x08 (gdb) 17368>0x00003B byte 0x0B (window settings) 17369>0x00003B byte 0x0C (window settings) 17370>0x00003B byte 0x0D (table setup) 17371>0x00003B byte 0x0E (screenshot) 17372>0x00003B byte 0x0F (backup) 17373# 17374# Magic Numbers for the TI-83 17375# 173760 string **TI83** TI-83 Graphing Calculator 17377>0x00003B byte 0x00 (real) 17378>0x00003B byte 0x01 (list) 17379>0x00003B byte 0x02 (matrix) 17380>0x00003B byte 0x03 (Y-variable) 17381>0x00003B byte 0x04 (string) 17382>0x00003B byte 0x05 (program) 17383>0x00003B byte 0x06 (protected prgm) 17384>0x00003B byte 0x07 (picture) 17385>0x00003B byte 0x08 (gdb) 17386>0x00003B byte 0x0B (window settings) 17387>0x00003B byte 0x0C (window settings) 17388>0x00003B byte 0x0D (table setup) 17389>0x00003B byte 0x0E (screenshot) 17390>0x00003B byte 0x13 (backup) 17391# 17392# Magic Numbers for the TI-83+ 17393# 173940 string **TI83F* TI-83+ Graphing Calculator 17395>0x00003B byte 0x00 (real number) 17396>0x00003B byte 0x01 (list) 17397>0x00003B byte 0x02 (matrix) 17398>0x00003B byte 0x03 (equation) 17399>0x00003B byte 0x04 (string) 17400>0x00003B byte 0x05 (program) 17401>0x00003B byte 0x06 (assembly program) 17402>0x00003B byte 0x07 (picture) 17403>0x00003B byte 0x08 (gdb) 17404>0x00003B byte 0x0C (complex number) 17405>0x00003B byte 0x0F (window settings) 17406>0x00003B byte 0x10 (zoom) 17407>0x00003B byte 0x11 (table setup) 17408>0x00003B byte 0x13 (backup) 17409>0x00003B byte 0x15 (application variable) 17410>0x00003B byte 0x17 (group of variable) 17411 17412# 17413# Magic Numbers for the TI-85 17414# 174150 string **TI85** TI-85 Graphing Calculator 17416>0x00003B byte 0x00 (real number) 17417>0x00003B byte 0x01 (complex number) 17418>0x00003B byte 0x02 (real vector) 17419>0x00003B byte 0x03 (complex vector) 17420>0x00003B byte 0x04 (real list) 17421>0x00003B byte 0x05 (complex list) 17422>0x00003B byte 0x06 (real matrix) 17423>0x00003B byte 0x07 (complex matrix) 17424>0x00003B byte 0x08 (real constant) 17425>0x00003B byte 0x09 (complex constant) 17426>0x00003B byte 0x0A (equation) 17427>0x00003B byte 0x0C (string) 17428>0x00003B byte 0x0D (function GDB) 17429>0x00003B byte 0x0E (polar GDB) 17430>0x00003B byte 0x0F (parametric GDB) 17431>0x00003B byte 0x10 (diffeq GDB) 17432>0x00003B byte 0x11 (picture) 17433>0x00003B byte 0x12 (program) 17434>0x00003B byte 0x13 (range) 17435>0x00003B byte 0x17 (window settings) 17436>0x00003B byte 0x18 (window settings) 17437>0x00003B byte 0x19 (window settings) 17438>0x00003B byte 0x1A (window settings) 17439>0x00003B byte 0x1B (zoom) 17440>0x00003B byte 0x1D (backup) 17441>0x00003B byte 0x1E (unknown) 17442>0x00003B byte 0x2A (equation) 17443>0x000032 string ZS4 - ZShell Version 4 File. 17444>0x000032 string ZS3 - ZShell Version 3 File. 17445# 17446# Magic Numbers for the TI-86 17447# 174480 string **TI86** TI-86 Graphing Calculator 17449>0x00003B byte 0x00 (real number) 17450>0x00003B byte 0x01 (complex number) 17451>0x00003B byte 0x02 (real vector) 17452>0x00003B byte 0x03 (complex vector) 17453>0x00003B byte 0x04 (real list) 17454>0x00003B byte 0x05 (complex list) 17455>0x00003B byte 0x06 (real matrix) 17456>0x00003B byte 0x07 (complex matrix) 17457>0x00003B byte 0x08 (real constant) 17458>0x00003B byte 0x09 (complex constant) 17459>0x00003B byte 0x0A (equation) 17460>0x00003B byte 0x0C (string) 17461>0x00003B byte 0x0D (function GDB) 17462>0x00003B byte 0x0E (polar GDB) 17463>0x00003B byte 0x0F (parametric GDB) 17464>0x00003B byte 0x10 (diffeq GDB) 17465>0x00003B byte 0x11 (picture) 17466>0x00003B byte 0x12 (program) 17467>0x00003B byte 0x13 (range) 17468>0x00003B byte 0x17 (window settings) 17469>0x00003B byte 0x18 (window settings) 17470>0x00003B byte 0x19 (window settings) 17471>0x00003B byte 0x1A (window settings) 17472>0x00003B byte 0x1B (zoom) 17473>0x00003B byte 0x1D (backup) 17474>0x00003B byte 0x1E (unknown) 17475>0x00003B byte 0x2A (equation) 17476# 17477# Magic Numbers for the TI-89 17478# 174790 string **TI89** TI-89 Graphing Calculator 17480>0x000048 byte 0x00 (expression) 17481>0x000048 byte 0x04 (list) 17482>0x000048 byte 0x06 (matrix) 17483>0x000048 byte 0x0A (data) 17484>0x000048 byte 0x0B (text) 17485>0x000048 byte 0x0C (string) 17486>0x000048 byte 0x0D (graphic data base) 17487>0x000048 byte 0x0E (figure) 17488>0x000048 byte 0x10 (picture) 17489>0x000048 byte 0x12 (program) 17490>0x000048 byte 0x13 (function) 17491>0x000048 byte 0x14 (macro) 17492>0x000048 byte 0x1C (zipped) 17493>0x000048 byte 0x21 (assembler) 17494# 17495# Magic Numbers for the TI-92 17496# 174970 string **TI92** TI-92 Graphing Calculator 17498>0x000048 byte 0x00 (expression) 17499>0x000048 byte 0x04 (list) 17500>0x000048 byte 0x06 (matrix) 17501>0x000048 byte 0x0A (data) 17502>0x000048 byte 0x0B (text) 17503>0x000048 byte 0x0C (string) 17504>0x000048 byte 0x0D (graphic data base) 17505>0x000048 byte 0x0E (figure) 17506>0x000048 byte 0x10 (picture) 17507>0x000048 byte 0x12 (program) 17508>0x000048 byte 0x13 (function) 17509>0x000048 byte 0x14 (macro) 17510>0x000048 byte 0x1D (backup) 17511# 17512# Magic Numbers for the TI-92+/V200 17513# 175140 string **TI92P* TI-92+/V200 Graphing Calculator 17515>0x000048 byte 0x00 (expression) 17516>0x000048 byte 0x04 (list) 17517>0x000048 byte 0x06 (matrix) 17518>0x000048 byte 0x0A (data) 17519>0x000048 byte 0x0B (text) 17520>0x000048 byte 0x0C (string) 17521>0x000048 byte 0x0D (graphic data base) 17522>0x000048 byte 0x0E (figure) 17523>0x000048 byte 0x10 (picture) 17524>0x000048 byte 0x12 (program) 17525>0x000048 byte 0x13 (function) 17526>0x000048 byte 0x14 (macro) 17527>0x000048 byte 0x1C (zipped) 17528>0x000048 byte 0x21 (assembler) 17529# 17530# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades 17531# 175320x0000016 string Advanced TI-XX Graphing Calculator (FLASH) 175330 string **TIFL** TI-XX Graphing Calculator (FLASH) 17534>8 byte >0 - Revision %d 17535>>9 byte x \b.%d, 17536>12 byte >0 Revision date %02x 17537>>13 byte x \b/%02x 17538>>14 beshort x \b/%04x, 17539>17 string >/0 name: '%s', 17540>48 byte 0x74 device: TI-73, 17541>48 byte 0x73 device: TI-83+, 17542>48 byte 0x98 device: TI-89, 17543>48 byte 0x88 device: TI-92+, 17544>49 byte 0x23 type: OS upgrade, 17545>49 byte 0x24 type: application, 17546>49 byte 0x25 type: certificate, 17547>49 byte 0x3e type: license, 17548>74 lelong >0 size: %ld bytes 17549 17550# VTi & TiEmu skins (TI Graphing Calculators). 17551# From: Romain Lievin (roms@lpg.ticalc.org). 17552# Magic Numbers for the VTi skins 175530 string VTI Virtual TI skin 17554>3 string v - Version 17555>>4 byte >0 \b %c 17556>>6 byte x \b.%c 17557# Magic Numbers for the TiEmu skins 175580 string TiEmu TiEmu skin 17559>6 string v - Version 17560>>7 byte >0 \b %c 17561>>9 byte x \b.%c 17562>>10 byte x \b%c 17563 17564#------------------------------------------------------------------------------ 17565# $File: timezone,v 1.11 2009/09/19 16:28:12 christos Exp $ 17566# timezone: file(1) magic for timezone data 17567# 17568# from Daniel Quinlan (quinlan@yggdrasil.com) 17569# this should work on Linux, SunOS, and maybe others 17570# Added new official magic number for recent versions of the Olson code 175710 string TZif timezone data 17572>4 byte 0 \b, old version 17573>4 byte >0 \b, version %c 17574>20 belong 0 \b, no gmt time flags 17575>20 belong 1 \b, 1 gmt time flag 17576>20 belong >1 \b, %d gmt time flags 17577>24 belong 0 \b, no std time flags 17578>20 belong 1 \b, 1 std time flag 17579>24 belong >1 \b, %d std time flags 17580>28 belong 0 \b, no leap seconds 17581>28 belong 1 \b, 1 leap second 17582>28 belong >1 \b, %d leap seconds 17583>32 belong 0 \b, no transition times 17584>32 belong 1 \b, 1 transition time 17585>32 belong >1 \b, %d transition times 17586>36 belong 0 \b, no abbreviation chars 17587>36 belong 1 \b, 1 abbreviation char 17588>36 belong >1 \b, %d abbreviation chars 175890 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data 175900 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data 175910 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data 175920 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data 175930 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data 175940 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data 17595 17596#------------------------------------------------------------------------------ 17597# $File: troff,v 1.10 2009/09/19 16:28:12 christos Exp $ 17598# troff: file(1) magic for *roff 17599# 17600# updated by Daniel Quinlan (quinlan@yggdrasil.com) 17601 17602# troff input 176030 search/1 .\\" troff or preprocessor input text 17604!:mime text/troff 176050 search/1 '\\" troff or preprocessor input text 17606!:mime text/troff 176070 search/1 '.\\" troff or preprocessor input text 17608!:mime text/troff 176090 search/1 \\" troff or preprocessor input text 17610!:mime text/troff 176110 search/1 ''' troff or preprocessor input text 17612!:mime text/troff 176130 regex/20 \^\\.[A-Za-z0-9][A-Za-z0-9][\ \t] troff or preprocessor input text 17614!:mime text/troff 176150 regex/20 \^\\.[A-Za-z0-9][A-Za-z0-9]$ troff or preprocessor input text 17616!:mime text/troff 17617 17618# ditroff intermediate output text 176190 search/1 x\ T ditroff output text 17620>4 search/1 cat for the C/A/T phototypesetter 17621>4 search/1 ps for PostScript 17622>4 search/1 dvi for DVI 17623>4 search/1 ascii for ASCII 17624>4 search/1 lj4 for LaserJet 4 17625>4 search/1 latin1 for ISO 8859-1 (Latin 1) 17626>4 search/1 X75 for xditview at 75dpi 17627>>7 search/1 -12 (12pt) 17628>4 search/1 X100 for xditview at 100dpi 17629>>8 search/1 -12 (12pt) 17630 17631# output data formats 176320 string \100\357 very old (C/A/T) troff output data 17633 17634#------------------------------------------------------------------------------ 17635# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $ 17636# tuxedo: file(1) magic for BEA TUXEDO data files 17637# 17638# from Ian Springer <ispringer@hotmail.com> 17639# 176400 string \0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0 BEA TUXEDO DES mask data 17641 17642#------------------------------------------------------------------------------ 17643# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $ 17644# typeset: file(1) magic for other typesetting 17645# 176460 string Interpress/Xerox Xerox InterPress data 17647>16 string / (version 17648>>17 string >\0 %s) 17649 17650#------------------------------------------------------------------------------ 17651# $File: unicode,v 1.6 2010/09/20 18:55:20 rrt Exp $ 17652# Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp> 17653# GRR: These types should be recognised in file_ascmagic so these 17654# encodings can be treated by text patterns. 17655# Missing types are already dealt with internally. 17656# 176570 string +/v8 Unicode text, UTF-7 176580 string +/v9 Unicode text, UTF-7 176590 string +/v+ Unicode text, UTF-7 176600 string +/v/ Unicode text, UTF-7 176610 string \335\163\146\163 Unicode text, UTF-8-EBCDIC 176620 string \000\000\376\377 Unicode text, UTF-32, big-endian 176630 string \377\376\000\000 Unicode text, UTF-32, little-endian 176640 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode) 17665 17666#------------------------------------------------------------------------------ 17667# $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $ 17668# unknown: file(1) magic for unknown machines 17669# 17670# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11 17671# (executable, pure, and split I&D, respectively), but the PDP-11 version 17672# doesn't have the "version %ld", which may be a bogus COFFism (I don't 17673# think there was ever COFF for the PDP-11). 17674# 17675# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a 17676# long, as it would be on a VAX. In any case, that could collide with 17677# VAX demand-paged files, as the magic number is little-endian on those 17678# binaries, so the first 16 bits of the file would contain 0x10B. 17679# 17680# Therefore, those entries are commented out. 17681# 17682# 0x10C is 0414 and 0x10E is 0416; those *are* unknown. 17683# 17684#0 short 0x107 unknown machine executable 17685#>8 short >0 not stripped 17686#>15 byte >0 - version %ld 17687#0 short 0x108 unknown pure executable 17688#>8 short >0 not stripped 17689#>15 byte >0 - version %ld 17690#0 short 0x109 PDP-11 separate I&D 17691#>8 short >0 not stripped 17692#>15 byte >0 - version %ld 17693#0 short 0x10b unknown pure executable 17694#>8 short >0 not stripped 17695#>15 byte >0 - version %ld 176960 long 0x10c unknown demand paged pure executable 17697>16 long >0 not stripped 176980 long 0x10e unknown readable demand paged pure executable 17699 17700#------------------------------------------------------------------------------ 17701# $File: uterus,v 1.1 2012/12/18 18:53:32 christos Exp $ 17702# file(1) magic for uterus files 17703# http://freecode.com/projects/uterus 17704# 177050 string UTE+ uterus file 17706>4 string v \b, version 17707>5 byte x %c 17708>6 string . \b. 17709>7 byte x \b%c 17710>8 string \<\> \b, big-endian 17711>>16 belong >0 \b, slut size %u 17712>8 string \>\< \b, litte-endian 17713>>16 lelong >0 \b, slut size %u 17714>10 byte &8 \b, compressed 17715 17716#------------------------------------------------------------------------------ 17717# $File: uuencode,v 1.7 2009/09/19 16:28:13 christos Exp $ 17718# uuencode: file(1) magic for ASCII-encoded files 17719# 17720 17721# GRR: the first line of xxencoded files is identical to that in uuencoded 17722# files, but the first character in most subsequent lines is 'h' instead of 17723# 'M'. (xxencoding uses lowercase letters in place of most of uuencode's 17724# punctuation and survives BITNET gateways better.) If regular expressions 17725# were supported, this entry could possibly be split into two with 17726# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs). 177270 search/1 begin\ uuencoded or xxencoded text 17728 17729# btoa(1) is an alternative to uuencode that requires less space. 177300 search/1 xbtoa\ Begin btoa'd text 17731 17732# ship(1) is another, much cooler alternative to uuencode. 17733# Greg Roelofs, newt@uchicago.edu 177340 search/1 $\012ship ship'd binary text 17735 17736# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?) 17737# Greg Roelofs, newt@uchicago.edu 177380 search/1 Decode\ the\ following\ with\ bdeco bencoded News text 17739 17740# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 17741# Daniel Quinlan, quinlan@yggdrasil.com 1774211 search/1 must\ be\ converted\ with\ BinHex BinHex binary text 17743>41 search/1 x \b, version %.3s 17744 17745# GRR: handle BASE64 17746 17747#------------------------------------------------------------------------------ 17748# $File: varied.out,v 1.22 2010/07/02 00:06:27 christos Exp $ 17749# varied.out: file(1) magic for various USG systems 17750# 17751# Herewith many of the object file formats used by USG systems. 17752# Most have been moved to files for a particular processor, 17753# and deleted if they duplicate other entries. 17754# 177550 short 0610 Perkin-Elmer executable 17756# AMD 29K 177570 beshort 0572 amd 29k coff noprebar executable 177580 beshort 01572 amd 29k coff prebar executable 177590 beshort 0160007 amd 29k coff archive 17760# Cray 177616 beshort 0407 unicos (cray) executable 17762# Ultrix 4.3 17763596 string \130\337\377\377 Ultrix core file 17764>600 string >\0 from '%s' 17765# BeOS and MAcOS PEF executables 17766# From: hplus@zilker.net (Jon Watte) 177670 string Joy!peffpwpc header for PowerPC PEF executable 17768# 17769# ava assembler/linker Uros Platise <uros.platise@ijs.si> 177700 string avaobj AVR assembler object code 17771>7 string >\0 version '%s' 17772# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr> 177730 string gmon GNU prof performance data 17774>4 long x - version %ld 17775# From: Dave Pearson <davep@davep.org> 17776# Harbour <URL:http://harbour-project.org/> HRB files. 177770 string \xc0HRB Harbour HRB file 17778>4 leshort x version %d 17779# Harbour HBV files 177800 string \xc0HBV Harbour variable dump file 17781>4 leshort x version %d 17782 17783# From: Alex Beregszaszi <alex@fsn.hu> 17784# 0 string exec BugOS executable 17785# 0 string pack BugOS archive 17786 17787# From: Jason Spence <jspence@lightconsulting.com> 17788# Generated by the "examples" in STM's ST40 devkit, and derived code. 177890 lelong 0x13a9f17e ST40 component image format 17790>4 string >\0 \b, name '%s' 17791 17792#------------------------------------------------------------------------------ 17793# $File: varied.script,v 1.9 2011/12/16 16:32:48 rrt Exp $ 17794# varied.script: file(1) magic for various interpreter scripts 17795 177960 string/t #!\ / a 17797>3 string >\0 %s script text executable 17798!:strength / 2 177990 string/t #!\t/ a 17800>3 string >\0 %s script text executable 17801!:strength / 2 178020 string/t #!/ a 17803>2 string >\0 %s script text executable 17804!:strength / 2 178050 string/t #!\ script text executable 17806>3 string >\0 for %s 17807!:strength / 3 17808 17809# using env 178100 string/t #!/usr/bin/env a 17811>15 string/t >\0 %s script text executable 17812!:strength / 10 178130 string/t #!\ /usr/bin/env a 17814>16 string/t >\0 %s script text executable 17815!:strength / 10 17816 17817# From: arno <arenevier@fdn.fr> 17818# mozilla xpconnect typelib 17819# see http://www.mozilla.org/scriptable/typelib_file.html 178200 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib 17821>0x10 byte x version %d 17822>>0x11 byte x \b.%d 17823 17824#------------------------------------------------------------------------------ 17825# $File: vax,v 1.8 2013/01/09 22:37:24 christos Exp $ 17826# vax: file(1) magic for VAX executable/object and APL workspace 17827# 178280 lelong 0101557 VAX single precision APL workspace 178290 lelong 0101556 VAX double precision APL workspace 17830 17831# 17832# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian 17833# executables, and are handled in aout) 17834# 178350 lelong 0420 a.out VAX demand paged (first page unmapped) pure executable 17836>16 lelong >0 not stripped 17837 17838# 17839# VAX COFF 17840# 17841# The `versions' were commented out, but have been un-commented out. 17842# (Was the problem just one of endianness?) 17843# 178440 leshort 0570 VAX COFF executable 17845>12 lelong >0 not stripped 17846>22 leshort >0 - version %ld 178470 leshort 0575 VAX COFF pure executable 17848>12 lelong >0 not stripped 17849>22 leshort >0 - version %ld 17850 17851#------------------------------------------------------------------------------ 17852# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $ 17853# vicar: file(1) magic for VICAR files. 17854# 17855# From: Ossama Othman <othman@astrosun.tn.cornell.edu 17856# VICAR is JPL's in-house spacecraft image processing program 17857# VICAR image 178580 string LBLSIZE= VICAR image data 17859>32 string BYTE \b, 8 bits = VAX byte 17860>32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2 17861>32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4 17862>32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4 17863>32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8 17864>32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8 17865# VICAR label file 1786643 string SFDU_LABEL VICAR label file 17867 17868#------------------------------------------------------------------------------ 17869# $File: virtual,v 1.2 2011/11/22 13:30:05 christos Exp $ 17870# From: James Nobis <quel@quelrod.net> 17871# Microsoft hard disk images for: 17872# Virtual Server 17873# Virtual PC 17874# http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx 17875# .vhd 178760 string conectix Microsoft Disk Image, Virtual Server or Virtual PC 17877 17878# Sun xVM VirtualBox Disk Image 17879# From: Richard W.M. Jones <rich@annexia.org> 17880# VirtualBox Disk Image 178810x40 ulelong 0xbeda107f VirtualBox Disk Image 17882>0x44 uleshort >0 \b, major %u 17883>0x46 uleshort >0 \b, minor %u 17884 17885#------------------------------------------------------------------------------ 17886# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $ 17887# Virtutech Compressed Random Access File Format 17888# 17889# From <gustav@virtutech.com> 178900 string \211\277\036\203 Virtutech CRAFF 17891>4 belong x v%d 17892>20 belong 0 uncompressed 17893>20 belong 1 bzipp2ed 17894>20 belong 2 gzipped 17895>24 belong 0 not clean 17896 17897#------------------------------------------------------------------------------ 17898# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $ 17899# visx: file(1) magic for Visx format files 17900# 179010 short 0x5555 VISX image file 17902>2 byte 0 (zero) 17903>2 byte 1 (unsigned char) 17904>2 byte 2 (short integer) 17905>2 byte 3 (float 32) 17906>2 byte 4 (float 64) 17907>2 byte 5 (signed char) 17908>2 byte 6 (bit-plane) 17909>2 byte 7 (classes) 17910>2 byte 8 (statistics) 17911>2 byte 10 (ascii text) 17912>2 byte 15 (image segments) 17913>2 byte 100 (image set) 17914>2 byte 101 (unsigned char vector) 17915>2 byte 102 (short integer vector) 17916>2 byte 103 (float 32 vector) 17917>2 byte 104 (float 64 vector) 17918>2 byte 105 (signed char vector) 17919>2 byte 106 (bit plane vector) 17920>2 byte 121 (feature vector) 17921>2 byte 122 (feature vector library) 17922>2 byte 124 (chain code) 17923>2 byte 126 (bit vector) 17924>2 byte 130 (graph) 17925>2 byte 131 (adjacency graph) 17926>2 byte 132 (adjacency graph library) 17927>2 string .VISIX (ascii text) 17928 17929#------------------------------------------------------------------------------ 17930# $File: vms,v 1.7 2013/03/09 22:36:00 christos Exp $ 17931# vms: file(1) magic for VMS executables (experimental) 17932# 17933# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu) 17934 17935# GRR 950122: I'm just guessing on these, based on inspection of the headers 17936# of three executables each for Alpha and VAX architectures. The VAX files 17937# all had headers similar to this: 17938# 17939# 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205 17940# 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................ 17941# 179420 string \xb0\0\x30\0 VMS VAX executable 17943>44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 17944# 17945# The AXP files all looked like this, except that the byte at offset 0x22 17946# was 06 in some of them and 07 in others: 17947# 17948# 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................ 17949# 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h............... 17950# 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 17951# 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ 17952# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................ 17953# 17954# GRR this test is still too general as it catches example addressen.dbt 179550 belong 0x03000000 17956>8 ubelong 0xec020000 VMS Alpha executable 17957>>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 17958 17959#------------------------------------------------------------------------------ 17960# $File: vmware,v 1.7 2009/09/19 16:28:13 christos Exp $ 17961# VMware specific files (deducted from version 1.1 and log file entries) 17962# Anthon van der Neut (anthon@mnt.org) 179630 belong 0x4d52564e VMware nvram 17964 17965#------------------------------------------------------------------------------ 17966# $File: vorbis,v 1.16 2009/09/19 16:28:13 christos Exp $ 17967# vorbis: file(1) magic for Ogg/Vorbis files 17968# 17969# From Felix von Leitner <leitner@fefe.de> 17970# Extended by Beni Cherniavsky <cben@crosswinds.net> 17971# Further extended by Greg Wooledge <greg@wooledge.org> 17972# 17973# Most (everything but the number of channels and bitrate) is commented 17974# out with `##' as it's not interesting to the average user. The most 17975# probable things advanced users would want to uncomment are probably 17976# the number of comments and the encoder version. 17977# 17978# FIXME: The first match has been made a search, so that it can skip 17979# over prepended ID3 tags. This will work for MIME type detection, but 17980# won't work for detecting other properties of the file (they all need 17981# to be made relative to the search). In any case, if the file has ID3 17982# tags, the ID3 information will be printed, not the Ogg information, 17983# so until that's fixed, this doesn't matter. 17984# FIXME[2]: Disable the above for now, since search assumes text mode. 17985# 17986# --- Ogg Framing --- 17987#0 search/1000 OggS Ogg data 179880 string OggS Ogg data 17989!:mime application/ogg 17990>4 byte !0 UNKNOWN REVISION %u 17991##>4 byte 0 revision 0 17992>4 byte 0 17993##>>14 lelong x (Serial %lX) 17994# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net) 17995>>28 string \x7fFLAC \b, FLAC audio 17996# non-Vorbis content: Theora 17997>>28 string \x80theora \b, Theora video 17998# non-Vorbis content: Kate 17999>>28 string \x80kate\0\0\0\0 \b, Kate 18000>>>37 ubyte x v%u 18001>>>38 ubyte x \b.%u, 18002>>>40 byte 0 utf8 encoding, 18003>>>40 byte !0 unknown character encoding, 18004>>>60 string >\0 language %s, 18005>>>60 string \0 no language set, 18006>>>76 string >\0 category %s 18007>>>76 string \0 no category set 18008# non-Vorbis content: Skeleton 18009>>28 string fishead\0 \b, Skeleton 18010>>>36 short x v%u 18011>>>40 short x \b.%u 18012# non-Vorbis content: Speex 18013>>28 string Speex\ \ \ \b, Speex audio 18014# non-Vorbis content: OGM 18015>>28 string \x01video\0\0\0 \b, OGM video 18016>>>37 string/c div3 (DivX 3) 18017>>>37 string/c divx (DivX 4) 18018>>>37 string/c dx50 (DivX 5) 18019>>>37 string/c xvid (XviD) 18020# --- First vorbis packet - general header --- 18021>>28 string \x01vorbis \b, Vorbis audio, 18022>>>35 lelong !0 UNKNOWN VERSION %lu, 18023##>>>35 lelong 0 version 0, 18024>>>35 lelong 0 18025>>>>39 ubyte 1 mono, 18026>>>>39 ubyte 2 stereo, 18027>>>>39 ubyte >2 %u channels, 18028>>>>40 lelong x %lu Hz 18029# Minimal, nominal and maximal bitrates specified when encoding 18030>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b, 18031# The above tests if at least one of these is specified: 18032>>>>>52 lelong !-1 18033# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields 18034# instead of -1. 18035# Vorbis 1.0 uses 0 instead of -1. 18036>>>>>>52 lelong !0 18037>>>>>>>52 lelong !-1000 18038>>>>>>>>52 lelong x <%lu 18039>>>>>48 lelong !-1 18040>>>>>>48 lelong x ~%lu 18041>>>>>44 lelong !-1 18042>>>>>>44 lelong !-1000 18043>>>>>>>44 lelong !0 18044>>>>>>>>44 lelong x >%lu 18045>>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps 18046# -- Second vorbis header packet - the comments 18047# A kludge to read the vendor string. It's a counted string, not a 18048# zero-terminated one, so file(1) can't read it in a generic way. 18049# libVorbis is the only one existing currently, so I detect specifically 18050# it. The interesting value is the cvs date (8 digits decimal). 18051# Post-RC1 Ogg files have the second header packet (and thus the version) 18052# in a different place, so we must use an indirect offset. 18053>>>(84.b+85) string \x03vorbis 18054>>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I 18055>>>>>(84.b+120) string >00000000 18056# Map to beta version numbers: 18057>>>>>>(84.b+120) string <20000508 (<beta1, prepublic) 18058>>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2) 18059>>>>>>(84.b+120) string >20000508 18060>>>>>>>(84.b+120) string <20001031 (beta2-3) 18061>>>>>>(84.b+120) string 20001031 (1.0 beta 3) 18062>>>>>>(84.b+120) string >20001031 18063>>>>>>>(84.b+120) string <20010225 (beta3-4) 18064>>>>>>(84.b+120) string 20010225 (1.0 beta 4) 18065>>>>>>(84.b+120) string >20010225 18066>>>>>>>(84.b+120) string <20010615 (beta4-RC1) 18067>>>>>>(84.b+120) string 20010615 (1.0 RC1) 18068>>>>>>(84.b+120) string 20010813 (1.0 RC2) 18069>>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1) 18070>>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2) 18071>>>>>>(84.b+120) string 20011217 (1.0 RC3) 18072>>>>>>(84.b+120) string 20011231 (1.0 RC3) 18073# Some pre-1.0 CVS snapshots still had "Xiphphorus"... 18074>>>>>>(84.b+120) string >20011231 (pre-1.0 CVS) 18075# For the 1.0 release, Xiphophorus is replaced by Xiph.Org 18076>>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I 18077>>>>>(84.b+117) string >00000000 18078>>>>>>(84.b+117) string <20020717 (pre-1.0 CVS) 18079>>>>>>(84.b+117) string 20020717 (1.0) 18080>>>>>>(84.b+117) string 20030909 (1.0.1) 18081>>>>>>(84.b+117) string 20040629 (1.1.0 RC1) 18082 18083#------------------------------------------------------------------------------ 18084# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $ 18085# VXL: file(1) magic for VXL binary IO data files 18086# 18087# from Ian Scott <scottim@sf.net> 18088# 18089# VXL is a collection of C++ libraries for Computer Vision. 18090# See the vsl chapter in the VXL Book for more info 18091# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html 18092# http:/vxl.sf.net 18093 180942 lelong 0x472b2c4e VXL data file, 18095>0 leshort >0 schema version no %d 18096 18097#------------------------------------------------------------------------------ 18098# $File: warc,v 1.3 2010/11/25 15:05:43 christos Exp $ 18099# warc: file(1) magic for WARC files 18100 181010 string WARC/ WARC Archive 18102>5 string x version %.4s 18103!:mime application/warc 18104 18105#------------------------------------------------------------------------------ 18106# Arc File Format from Internet Archive 18107# see http://www.archive.org/web/researcher/ArcFileFormat.php 181080 string filedesc:// Internet Archive File 18109!:mime application/x-ia-arc 18110>11 search/256 \x0A \b 18111>>&0 ubyte >0 \b version %c 18112 18113#------------------------------------------------------------------------------ 18114# weak: file(1) magic for very weak magic entries, disabled by default 18115# 18116# These entries are so weak that they might interfere identification of 18117# other formats. Example include: 18118# - Only identify for 1 or 2 bytes 18119# - Match against very wide range of values 18120# - Match against generic word in some spoken languages (e.g. English) 18121 18122# Summary: Computer Graphics Metafile 18123# Extension: .cgm 18124#0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile 18125#0 beshort 0x3020 character Computer Graphics Metafile 18126 18127#0 string =!! Bennet Yee's "face" format 18128 18129#------------------------------------------------------------------------------ 18130# $File: windows,v 1.5 2012/04/03 22:25:07 christos Exp $ 18131# windows: file(1) magic for Microsoft Windows 18132# 18133# This file is mainly reserved for files where programs 18134# using them are run almost always on MS Windows 3.x or 18135# above, or files only used exclusively in Windows OS, 18136# where there is no better category to allocate for. 18137# For example, even though WinZIP almost run on Windows 18138# only, it is better to treat them as "archive" instead. 18139# For format usable in DOS, such as generic executable 18140# format, please specify under "msdos" file. 18141# 18142 18143 18144# Summary: Outlook Express DBX file 18145# Extension: .dbx 18146# Created by: Christophe Monniez 181470 string \xCF\xAD\x12\xFE MS Outlook Express DBX file 18148>4 byte =0xC5 \b, message database 18149>4 byte =0xC6 \b, folder database 18150>4 byte =0xC7 \b, account information 18151>4 byte =0x30 \b, offline database 18152 18153 18154# Summary: Windows crash dump 18155# Extension: .dmp 18156# Created by: Andreas Schuster (http://computer.forensikblog.de/) 18157# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html 18158# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) 181590 string PAGE 18160>4 string DUMP MS Windows 32bit crash dump 18161>>0x05c byte 0 \b, no PAE 18162>>0x05c byte 1 \b, PAE 18163>>0xf88 lelong 1 \b, full dump 18164>>0xf88 lelong 2 \b, kernel dump 18165>>0xf88 lelong 3 \b, small dump 18166>>0x068 lelong x \b, %ld pages 18167>4 string DU64 MS Windows 64bit crash dump 18168>>0xf98 lelong 1 \b, full dump 18169>>0xf98 lelong 2 \b, kernel dump 18170>>0xf98 lelong 3 \b, small dump 18171>>0x090 lequad x \b, %lld pages 18172 18173 18174# Summary: Vista Event Log 18175# Extension: .evtx 18176# Created by: Andreas Schuster (http://computer.forensikblog.de/) 18177# Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html 181780 string ElfFile\0 MS Windows Vista Event Log 18179>0x2a leshort x \b, %d chunks 18180>>0x10 lelong x \b (no. %d in use) 18181>0x18 lelong >1 \b, next record no. %d 18182>0x18 lelong =1 \b, empty 18183>0x78 lelong &1 \b, DIRTY 18184>0x78 lelong &2 \b, FULL 18185 18186 18187# Summary: Windows 3.1 group files 18188# Extension: .grp 18189# Created by: unknown 181900 string \120\115\103\103 MS Windows 3.1 group files 18191 18192 18193# Summary: Old format help files 18194# Extension: .hlp 18195# Created by: Dirk Jagdmann <doj@cubic.org> 181960 lelong 0x00035f3f MS Windows 3.x help file 18197 18198 18199# Summary: Hyper terminal 18200# Extension: .ht 18201# Created by: unknown 182020 string HyperTerminal\ 18203>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile 18204 18205# http://ithreats.files.wordpress.com/2009/05/\ 18206# lnk_the_windows_shortcut_file_format.pdf 18207# Summary: Windows shortcut 18208# Extension: .lnk 18209# Created by: unknown 18210# 'L' + GUUID 182110 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut 18212>20 lelong&1 1 \b, Item id list present 18213>20 lelong&2 2 \b, Points to a file or directory 18214>20 lelong&4 4 \b, Has Description string 18215>20 lelong&8 8 \b, Has Relative path 18216>20 lelong&16 16 \b, Has Working directory 18217>20 lelong&32 32 \b, Has command line arguments 18218>20 lelong&64 64 \b, Icon 18219>>56 lelong \b number=%d 18220>24 lelong&1 1 \b, Read-Only 18221>24 lelong&2 2 \b, Hidden 18222>24 lelong&4 4 \b, System 18223>24 lelong&8 8 \b, Volume Label 18224>24 lelong&16 16 \b, Directory 18225>24 lelong&32 32 \b, Archive 18226>24 lelong&64 64 \b, Encrypted 18227>24 lelong&128 128 \b, Normal 18228>24 lelong&256 256 \b, Temporary 18229>24 lelong&512 512 \b, Sparse 18230>24 lelong&1024 1024 \b, Reparse point 18231>24 lelong&2048 2048 \b, Compressed 18232>24 lelong&4096 4096 \b, Offline 18233>28 leqwdate x \b, ctime=%s 18234>36 leqwdate x \b, mtime=%s 18235>44 leqwdate x \b, atime=%s 18236>52 lelong x \b, length=%u, window= 18237>60 lelong&1 1 \bhide 18238>60 lelong&2 2 \bnormal 18239>60 lelong&4 4 \bshowminimized 18240>60 lelong&8 8 \bshowmaximized 18241>60 lelong&16 16 \bshownoactivate 18242>60 lelong&32 32 \bminimize 18243>60 lelong&64 64 \bshowminnoactive 18244>60 lelong&128 128 \bshowna 18245>60 lelong&256 256 \brestore 18246>60 lelong&512 512 \bshowdefault 18247#>20 lelong&1 0 18248#>>20 lelong&2 2 18249#>>>(72.l-64) pstring/h x \b [%s] 18250#>20 lelong&1 1 18251#>>20 lelong&2 2 18252#>>>(72.s) leshort x 18253#>>>&75 pstring/h x \b [%s] 18254 18255# Summary: Outlook Personal Folders 18256# Created by: unknown 182570 lelong 0x4E444221 Microsoft Outlook email folder 18258>10 leshort 0x0e (<=2002) 18259>10 leshort 0x17 (>=2003) 18260 18261 18262# Summary: Windows help cache 18263# Created by: unknown 182640 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache 18265 18266 18267# Summary: IE cache file 18268# Created by: Christophe Monniez 182690 string Client\ UrlCache\ MMF Internet Explorer cache file 18270>20 string >\0 version %s 18271 18272 18273# Summary: Registry files 18274# Created by: unknown 18275# Modified by (1): Joerg Jenderek 182760 string regf MS Windows registry file, NT/2000 or above 182770 string CREG MS Windows 95/98/ME registry file 182780 string SHCC3 MS Windows 3.1 registry file 18279 18280 18281# Summary: Windows Registry text 18282# Extension: .reg 18283# Submitted by: Abel Cheung <abelcheung@gmail.com> 182840 string REGEDIT4\r\n\r\n Windows Registry text (Win95 or above) 182850 string Windows\ Registry\ Editor\ 18286>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above) 18287 18288 18289# From: Pal Tamas <folti@balabit.hu> 18290# Autorun File 182910 string/c [autorun]\r\n Microsoft Windows Autorun file. 18292!:mime application/x-setupscript. 18293 18294#------------------------------------------------------------------------------ 18295# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $ 18296# wireless-regdb: file(1) magic for CRDA wireless-regdb file format 18297# 182980 string RGDB CRDA wireless regulatory database file 18299>4 belong 19 (Version 1) 18300 18301#------------------------------------------------------------------------------ 18302# $File: wordprocessors,v 1.17 2013/02/06 14:18:52 christos Exp $ 18303# wordprocessors: file(1) magic fo word processors. 18304# 18305####### PWP file format used on Smith Corona Personal Word Processors: 183062 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040'92 Smith Corona PWP 18307>24 byte 2 \b, single spaced 18308>24 byte 3 \b, 1.5 spaced 18309>24 byte 4 \b, double spaced 18310>25 byte 0x42 \b, letter 18311>25 byte 0x54 \b, legal 18312>26 byte 0x46 \b, A4 18313 18314#WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE 183150 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable file 18316>15 byte 0 Optimized for Intel 18317>15 byte 1 Optimized for Non-Intel 183181 string WPC (Corel/WP) 18319>8 short 257 WordPerfect macro 18320>8 short 258 WordPerfect help file 18321>8 short 259 WordPerfect keyboard file 18322>8 short 266 WordPerfect document 18323>8 short 267 WordPerfect dictionary 18324>8 short 268 WordPerfect thesaurus 18325>8 short 269 WordPerfect block 18326>8 short 270 WordPerfect rectangular block 18327>8 short 271 WordPerfect column block 18328>8 short 272 WordPerfect printer data 18329>8 short 275 WordPerfect printer data 18330>8 short 276 WordPerfect driver resource data 18331>8 short 279 WordPerfect hyphenation code 18332>8 short 280 WordPerfect hyphenation data 18333>8 short 281 WordPerfect macro resource data 18334>8 short 283 WordPerfect hyphenation lex 18335>8 short 285 WordPerfect wordlist 18336>8 short 286 WordPerfect equation resource data 18337>8 short 289 WordPerfect spell rules 18338>8 short 290 WordPerfect dictionary rules 18339>8 short 295 WordPerfect spell rules (Microlytics) 18340>8 short 299 WordPerfect settings file 18341>8 short 301 WordPerfect 4.2 document 18342>8 short 325 WordPerfect dialog file 18343>8 short 332 WordPerfect button bar 18344>8 short 513 Shell macro 18345>8 short 522 Shell definition 18346>8 short 769 Notebook macro 18347>8 short 770 Notebook help file 18348>8 short 771 Notebook keyboard file 18349>8 short 778 Notebook definition 18350>8 short 1026 Calculator help file 18351>8 short 1538 Calendar help file 18352>8 short 1546 Calendar data file 18353>8 short 1793 Editor macro 18354>8 short 1794 Editor help file 18355>8 short 1795 Editor keyboard file 18356>8 short 1817 Editor macro resource file 18357>8 short 2049 Macro editor macro 18358>8 short 2050 Macro editor help file 18359>8 short 2051 Macro editor keyboard file 18360>8 short 2305 PlanPerfect macro 18361>8 short 2306 PlanPerfect help file 18362>8 short 2307 PlanPerfect keyboard file 18363>8 short 2314 PlanPerfect worksheet 18364>8 short 2319 PlanPerfect printer definition 18365>8 short 2322 PlanPerfect graphic definition 18366>8 short 2323 PlanPerfect data 18367>8 short 2324 PlanPerfect temporary printer 18368>8 short 2329 PlanPerfect macro resource data 18369>8 byte 11 Mail 18370>8 short 2818 help file 18371>8 short 2821 distribution list 18372>8 short 2826 out box 18373>8 short 2827 in box 18374>8 short 2836 users archived mailbox 18375>8 short 2837 archived message database 18376>8 short 2838 archived attachments 18377>8 short 3083 Printer temporary file 18378>8 short 3330 Scheduler help file 18379>8 short 3338 Scheduler in file 18380>8 short 3339 Scheduler out file 18381>8 short 3594 GroupWise settings file 18382>8 short 3601 GroupWise directory services 18383>8 short 3627 GroupWise settings file 18384>8 short 4362 Terminal resource data 18385>8 short 4363 Terminal resource data 18386>8 short 4395 Terminal resource data 18387>8 short 4619 GUI loadable text 18388>8 short 4620 graphics resource data 18389>8 short 4621 printer settings file 18390>8 short 4622 port definition file 18391>8 short 4623 print queue parameters 18392>8 short 4624 compressed file 18393>8 short 5130 Network service msg file 18394>8 short 5131 Network service msg file 18395>8 short 5132 Async gateway login msg 18396>8 short 5134 GroupWise message file 18397>8 short 7956 GroupWise admin domain database 18398>8 short 7957 GroupWise admin host database 18399>8 short 7959 GroupWise admin remote host database 18400>8 short 7960 GroupWise admin ADS deferment data file 18401>8 short 8458 IntelliTAG (SGML) compiled DTD 18402>8 long 18219264 WordPerfect graphic image (1.0) 18403>8 long 18219520 WordPerfect graphic image (2.0) 18404#end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE 18405 18406# Hangul (Korean) Word Processor File 184070 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0 18408# From: Won-Kyu Park <wkpark@kldp.org> 18409512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000 18410!:mime application/x-hwp 18411 18412# CosmicBook, from Benoit Rouits 184130 string CSBK Ted Neslson's CosmicBook hypertext file 18414 184152 string EYWR AmigaWriter file 18416 18417# chi: file(1) magic for ChiWriter files 184180 string \\1cw\ ChiWriter file 18419>5 string >\0 version %s 184200 string \\1cw ChiWriter file 18421 18422# Quark Express from http://www.garykessler.net/library/file_sigs.html 184232 string IIXPR3 Intel Quark Express Document (English) 184242 string IIXPRa Intel Quark Express Document (Korean) 184252 string MMXPR3 Motorola Quark Express Document (English) 18426!:mime application/x-quark-xpress-3 184272 string MMXPRa Motorola Quark Express Document (Korean) 18428 18429# adobe indesign (document, whatever...) from querkan 184300 belong 0x0606edf5 Adobe InDesign 18431>16 string DOCUMENT Document 18432 18433#------------------------------------------------------------------------------ 18434# ichitaro456: file(1) magic for Just System Word Processor Ichitaro 18435# 18436# Contributor kenzo-: 18437# Reversed-engineered JS Ichitaro magic numbers 18438# 18439 184400 string DOC 18441>43 byte 0x14 Just System Word Processor Ichitaro v4 18442!:mime application/x-ichitaro4 18443>144 string JDASH application/x-ichitaro4 18444 184450 string DOC 18446>43 byte 0x15 Just System Word Processor Ichitaro v5 18447!:mime application/x-ichitaro5 18448 184490 string DOC 18450>43 byte 0x16 Just System Word Processor Ichitaro v6 18451!:mime application/x-ichitaro6 18452 18453# Type: Freemind mindmap documents 18454# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk> 184550 string/w \<map\ version Freemind document 18456!:mime application/x-freemind 18457 18458# Type: Scribus 18459# From: Werner Fink <werner@suse.de> 184600 string \<SCRIBUSUTF8\ Version Scribus Document 184610 string \<SCRIBUSUTF8NEW\ Version Scribus Document 18462!:mime application/x-scribus 18463 18464# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek 18465# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14 184660 ulelong&0x8080FFFF 0x00001204 gfxboot compiled html help file 18467 18468#------------------------------------------------------------------------------ 18469# $File: wsdl,v 1.3 2013/02/06 14:18:52 christos Exp $ 18470# wsdl: PHP WSDL Cache, http://www.php.net/manual/en/book.soap.php 18471# Cache format extracted from source: 18472# http://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup 18473# Requires file >= 5.05, see http://mx.gw.com/pipermail/file/2010/000683.html 18474# By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011 184750 string wsdl PHP WSDL cache, 18476>4 byte x version 0x%02x 18477>6 ledate x \b, created %s 18478 18479# uri 18480>10 lelong <0x7fffffff 18481>>10 pstring/l x \b, uri: "%s" 18482 18483# source 18484>>>&0 lelong <0x7fffffff 18485>>>>&-4 pstring/l x \b, source: "%s" 18486 18487# target_ns 18488>>>>>&0 lelong <0x7fffffff 18489>>>>>>&-4 pstring/l x \b, target_ns: "%s" 18490 18491#------------------------------------------------------------------------------ 18492# $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $ 18493# file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU> 18494# 184950 string %XDELTA% XDelta binary patch file 0.14 184960 string %XDZ000% XDelta binary patch file 0.18 184970 string %XDZ001% XDelta binary patch file 0.20 184980 string %XDZ002% XDelta binary patch file 1.0 184990 string %XDZ003% XDelta binary patch file 1.0.4 185000 string %XDZ004% XDelta binary patch file 1.1 18501 185020 string \xD6\xC3\xC4\x00 VCDIFF binary diff 18503 18504#------------------------------------------------------------------------------ 18505# $File: xenix,v 1.9 2009/09/19 16:28:13 christos Exp $ 18506# xenix: file(1) magic for Microsoft Xenix 18507# 18508# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small 18509# model" lifted from "magic.xenix", with comment "derived empirically; 18510# treat as folklore until proven" 18511# 18512# "small model", "large model", "huge model" stuff lifted from XXX 18513# 18514# XXX - "x.out" collides with PDP-11 archives 18515# 185160 string core core file (Xenix) 185170 byte 0x80 8086 relocatable (Microsoft) 185180 leshort 0xff65 x.out 18519>2 string __.SYMDEF randomized 18520>0 byte x archive 185210 leshort 0x206 Microsoft a.out 18522>8 leshort 1 Middle model 18523>0x1e leshort &0x10 overlay 18524>0x1e leshort &0x2 separate 18525>0x1e leshort &0x4 pure 18526>0x1e leshort &0x800 segmented 18527>0x1e leshort &0x400 standalone 18528>0x1e leshort &0x8 fixed-stack 18529>0x1c byte &0x80 byte-swapped 18530>0x1c byte &0x40 word-swapped 18531>0x10 lelong >0 not-stripped 18532>0x1e leshort ^0xc000 pre-SysV 18533>0x1e leshort &0x4000 V2.3 18534>0x1e leshort &0x8000 V3.0 18535>0x1c byte &0x4 86 18536>0x1c byte &0xb 186 18537>0x1c byte &0x9 286 18538>0x1c byte &0xa 386 18539>0x1f byte <0x040 small model 18540>0x1f byte =0x048 large model 18541>0x1f byte =0x049 huge model 18542>0x1e leshort &0x1 executable 18543>0x1e leshort ^0x1 object file 18544>0x1e leshort &0x40 Large Text 18545>0x1e leshort &0x20 Large Data 18546>0x1e leshort &0x120 Huge Objects Enabled 18547>0x10 lelong >0 not stripped 18548 185490 leshort 0x140 old Microsoft 8086 x.out 18550>0x3 byte &0x4 separate 18551>0x3 byte &0x2 pure 18552>0 byte &0x1 executable 18553>0 byte ^0x1 relocatable 18554>0x14 lelong >0 not stripped 18555 185560 lelong 0x206 b.out 18557>0x1e leshort &0x10 overlay 18558>0x1e leshort &0x2 separate 18559>0x1e leshort &0x4 pure 18560>0x1e leshort &0x800 segmented 18561>0x1e leshort &0x400 standalone 18562>0x1e leshort &0x1 executable 18563>0x1e leshort ^0x1 object file 18564>0x1e leshort &0x4000 V2.3 18565>0x1e leshort &0x8000 V3.0 18566>0x1c byte &0x4 86 18567>0x1c byte &0xb 186 18568>0x1c byte &0x9 286 18569>0x1c byte &0x29 286 18570>0x1c byte &0xa 386 18571>0x1e leshort &0x4 Large Text 18572>0x1e leshort &0x2 Large Data 18573>0x1e leshort &0x102 Huge Objects Enabled 18574 185750 leshort 0x580 XENIX 8086 relocatable or 80286 small model 18576 18577#------------------------------------------------------------------------------ 18578# $File: xilinx,v 1.5 2013/01/08 03:06:50 christos Exp $ 18579# This is Aaron's attempt at a MAGIC file for Xilinx .bit files. 18580# Xilinx-Magic@RevRagnarok.com 18581# Got the info from FPGA-FAQ 0026 18582# 18583# First there is the sync header and its length 185840 beshort 0x0009 18585>2 belong =0x0ff00ff0 18586>>&0 belong =0x0ff00ff0 18587>>>&0 beshort =0x0000 18588>>>>&0 pstring a Xilinx BIT data 18589# Next is a Pascal-style string with the NCD name. We want to capture that. 18590>>>>0x0F pstring x - from %s 18591# It is followed by a NUL 18592>>>>>&1 byte 0x00 18593# And then 'b' 18594>>>>>&2 string b 18595# With the part number: 18596#>>>>>&5 string 4v (Virtex4) 18597#>>>>>&5 string 2v (Virtex II 18598#>>>>>>&0 string !p \b) 18599#>>>>>>&0 string p Pro) 18600>>>>>&4 pstring x - for %s 18601# And then NUL / 'c' / Build Data / NUL / 'd' / Date / NUL / 'e' / Data Length 18602>>>>>>&1 byte 0x00 18603>>>>>>&2 string c 18604>>>>>>&4 pstring x - built %s 18605>>>>>>>&1 byte 0x00 18606>>>>>>>&2 string d 18607>>>>>>>&4 pstring x \b(%s) 18608>>>>>>>>&1 byte 0x00 18609>>>>>>>>&2 string e 18610>>>>>>>>&4 belong x - data length 0x%lx 18611# Raw bitstream files 186120 long 0xffffffff 18613>&0 belong 0xaa995566 Xilinx RAW bitstream (.BIN) 18614 18615#------------------------------------------------------------------------------ 18616# $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $ 18617# xo65 object files 18618# From: "Ullrich von Bassewitz" <uz@cc65.org> 18619# 186200 string \x55\x7A\x6E\x61 xo65 object, 18621>4 leshort x version %d, 18622>6 leshort&0x0001 =0x0001 with debug info 18623>6 leshort&0x0001 =0x0000 no debug info 18624 18625# xo65 library files 186260 string \x6E\x61\x55\x7A xo65 library, 18627>4 leshort x version %d 18628 18629# o65 object files 186300 string \x01\x00\x6F\x36\x35 o65 18631>6 leshort&0x1000 =0x0000 executable, 18632>6 leshort&0x1000 =0x1000 object, 18633>5 byte x version %d, 18634>6 leshort&0x8000 =0x8000 65816, 18635>6 leshort&0x8000 =0x0000 6502, 18636>6 leshort&0x2000 =0x2000 32 bit, 18637>6 leshort&0x2000 =0x0000 16 bit, 18638>6 leshort&0x4000 =0x4000 page reloc, 18639>6 leshort&0x4000 =0x0000 byte reloc, 18640>6 leshort&0x0003 =0x0000 alignment 1 18641>6 leshort&0x0003 =0x0001 alignment 2 18642>6 leshort&0x0003 =0x0002 alignment 4 18643>6 leshort&0x0003 =0x0003 alignment 256 18644 18645#------------------------------------------------------------------------------ 18646# $File: xwindows,v 1.8 2013/02/08 17:25:57 christos Exp $ 18647# xwindows: file(1) magic for various X/Window system file formats. 18648 18649# Compiled X Keymap 18650# XKM (compiled X keymap) files (including version and byte ordering) 186511 string mkx Compiled XKB Keymap: lsb, 18652>0 byte >0 version %d 18653>0 byte =0 obsolete 186540 string xkm Compiled XKB Keymap: msb, 18655>3 byte >0 version %d 18656>3 byte =0 obsolete 18657 18658# xfsdump archive 186590 string xFSdump0 xfsdump archive 18660>8 belong x (version %d) 18661 18662# Jaleo XFS files 186630 long 395726 Jaleo XFS file 18664>4 long x - version %ld 18665>8 long x - [%ld - 18666>20 long x \b%ldx 18667>24 long x \b%ldx 18668>28 long 1008 \bYUV422] 18669>28 long 1000 \bRGB24] 18670 18671# Xcursor data 18672# X11 mouse cursor format defined in libXcursor, see 18673# http://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html 18674# http://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h 186750 string Xcur Xcursor data 18676!:mime image/x-xcursor 18677>10 leshort x version %hd 18678>>8 leshort x \b.%hd 18679#------------------------------------------------------------------------------ 18680# zfs: file(1) magic for ZFS dumps 18681# 18682# From <rea-fbsd@codelabs.ru> 18683# ZFS dump header has the following structure (as per zfs_ioctl.h 18684# in FreeBSD with drr_type is set to DRR_BEGIN) 18685# 18686# enum { 18687# DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS, 18688# DRR_WRITE, DRR_FREE, DRR_END, 18689# } drr_type; 18690# uint32_t drr_pad; 18691# uint64_t drr_magic; 18692# uint64_t drr_version; 18693# uint64_t drr_creation_time; 18694# dmu_objset_type_t drr_type; 18695# uint32_t drr_pad; 18696# uint64_t drr_toguid; 18697# uint64_t drr_fromguid; 18698# char drr_toname[MAXNAMELEN]; 18699# 18700# Backup magic is 0x00000002f5bacbac (quad word) 18701# The drr_type is defined as 18702# typedef enum dmu_objset_type { 18703# DMU_OST_NONE, 18704# DMU_OST_META, 18705# DMU_OST_ZFS, 18706# DMU_OST_ZVOL, 18707# DMU_OST_OTHER, /* For testing only! */ 18708# DMU_OST_ANY, /* Be careful! */ 18709# DMU_OST_NUMTYPES 18710# } dmu_objset_type_t; 18711# 18712# Almost all uint64_t fields are printed as the 32-bit ones (with high 18713# 32 bits zeroed), because there is no simple way to print them as the 18714# full 64-bit values. 18715 18716# Big-endian values 187178 string \000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine), 18718>20 belong x version %lu, 18719>32 belong 0 type: NONE, 18720>32 belong 1 type: META, 18721>32 belong 2 type: ZFS, 18722>32 belong 3 type: ZVOL, 18723>32 belong 4 type: OTHER, 18724>32 belong 5 type: ANY, 18725>32 belong >5 type: UNKNOWN (%lu), 18726>40 byte x destination GUID: %02X 18727>41 byte x %02X 18728>42 byte x %02X 18729>43 byte x %02X 18730>44 byte x %02X 18731>45 byte x %02X 18732>46 byte x %02X 18733>47 byte x %02X, 18734>48 ulong >0 18735>>52 ulong >0 18736>>>48 byte x source GUID: %02X 18737>>>49 byte x %02X 18738>>>50 byte x %02X 18739>>>51 byte x %02X 18740>>>52 byte x %02X 18741>>>53 byte x %02X 18742>>>54 byte x %02X 18743>>>55 byte x %02X, 18744>56 string >\0 name: '%s' 18745 18746# Little-endian values 187478 string \254\313\272\365\002\000\000\000 ZFS shapshot (little-endian machine), 18748>16 lelong x version %lu, 18749>32 lelong 0 type: NONE, 18750>32 lelong 1 type: META, 18751>32 lelong 2 type: ZFS, 18752>32 lelong 3 type: ZVOL, 18753>32 lelong 4 type: OTHER, 18754>32 lelong 5 type: ANY, 18755>32 lelong >5 type: UNKNOWN (%lu), 18756>47 byte x destination GUID: %02X 18757>46 byte x %02X 18758>45 byte x %02X 18759>44 byte x %02X 18760>43 byte x %02X 18761>42 byte x %02X 18762>41 byte x %02X 18763>40 byte x %02X, 18764>48 ulong >0 18765>>52 ulong >0 18766>>>55 byte x source GUID: %02X 18767>>>54 byte x %02X 18768>>>53 byte x %02X 18769>>>52 byte x %02X 18770>>>51 byte x %02X 18771>>>50 byte x %02X 18772>>>49 byte x %02X 18773>>>48 byte x %02X, 18774>56 string >\0 name: '%s' 18775 18776#------------------------------------------------------------------------------ 18777# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $ 18778# zilog: file(1) magic for Zilog Z8000. 18779# 18780# Was it big-endian or little-endian? My Product Specification doesn't 18781# say. 18782# 187830 long 0xe807 object file (z8000 a.out) 187840 long 0xe808 pure object file (z8000 a.out) 187850 long 0xe809 separate object file (z8000 a.out) 187860 long 0xe805 overlay object file (z8000 a.out) 18787 18788#------------------------------------------------------------------------------ 18789# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $ 18790# zyxel: file(1) magic for ZyXEL modems 18791# 18792# From <rob@pe1chl.ampr.org> 18793# These are the /etc/magic entries to decode datafiles as used for the 18794# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a 18795# ZyXEL-defined standard) 18796 187970 string ZyXEL\002 ZyXEL voice data 18798>10 byte 0 - CELP encoding 18799>10 byte&0x0B 1 - ADPCM2 encoding 18800>10 byte&0x0B 2 - ADPCM3 encoding 18801>10 byte&0x0B 3 - ADPCM4 encoding 18802>10 byte&0x0B 8 - New ADPCM3 encoding 18803>10 byte&0x04 4 with resync 18804
