xref: /PHP-5.4/ext/fileinfo/tests/magic (revision 35101e9e)
1# Magic data for file(1) command.
2# Format is described in magic(files), where:
3# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID.
4# Don't edit this file, edit /etc/magic or send your magic improvements
5# to the maintainers, at file@mx.gw.com
6
7#------------------------------------------------------------------------------
8# Localstuff:  file(1) magic for locally observed files
9#
10# $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $
11# Add any locally observed files here.  Remember:
12# text if readable, executable if runnable binary, data if unreadable.
13
14#------------------------------------------------------------------------------
15# $File: acorn,v 1.5 2009/09/19 16:28:07 christos Exp $
16# acorn:  file(1) magic for files found on Acorn systems
17#
18
19# RISC OS Chunk File Format
20# From RISC OS Programmer's Reference Manual, Appendix D
21# We guess the file type from the type of the first chunk.
220	lelong		0xc3cbc6c5	RISC OS Chunk data
23>12	string		OBJ_		\b, AOF object
24>12	string		LIB_		\b, ALF library
25
26# RISC OS AIF, contains "SWI OS_Exit" at offset 16.
2716	lelong		0xef000011	RISC OS AIF executable
28
29# RISC OS Draw files
30# From RISC OS Programmer's Reference Manual, Appendix E
310	string 		Draw		RISC OS Draw file data
32
33# RISC OS new format font files
34# From RISC OS Programmer's Reference Manual, Appendix E
350	string		FONT\0		RISC OS outline font data,
36>5	byte		x		version %d
370	string		FONT\1		RISC OS 1bpp font data,
38>5	byte		x		version %d
390	string		FONT\4		RISC OS 4bpp font data
40>5	byte		x		version %d
41
42# RISC OS Music files
43# From RISC OS Programmer's Reference Manual, Appendix E
440	string		Maestro\r	RISC OS music file
45>8	byte		x		version %d
46
47>8	byte		x		type %d
48
49# Digital Symphony data files
50# From: Bernard Jungen (bern8817@euphonynet.be)
510		string	\x02\x01\x13\x13\x13\x01\x0d\x10	Digital Symphony sound sample (RISC OS),
52>8		byte	x	version %d,
53>9		pstring	x	named "%s",
54>(9.b+19)	byte	=0	8-bit logarithmic
55>(9.b+19)	byte	=1	LZW-compressed linear
56>(9.b+19)	byte	=2	8-bit linear signed
57>(9.b+19)	byte	=3	16-bit linear signed
58>(9.b+19)	byte	=4	SigmaDelta-compressed linear
59>(9.b+19)	byte	=5	SigmaDelta-compressed logarithmic
60>(9.b+19)	byte	>5	unknown format
61
620	string	\x02\x01\x13\x13\x14\x12\x01\x0b	Digital Symphony song (RISC OS),
63>8	byte	x	version %d,
64>9	byte	=1	1 voice,
65>9	byte	!1	%d voices,
66>10	leshort	=1	1 track,
67>10	leshort	!1	%d tracks,
68>12	leshort	=1	1 pattern
69>12	leshort	!1	%d patterns
70
710	string	\x02\x01\x13\x13\x10\x14\x12\x0e
72>9	byte	=0	Digital Symphony sequence (RISC OS),
73>>8	byte	x	version %d,
74>>10	byte	=1	1 line,
75>>10	byte	!1	%d lines,
76>>11	leshort	=1	1 position
77>>11	leshort	!1	%d positions
78>9	byte	=1	Digital Symphony pattern data (RISC OS),
79>>8	byte	x	version %d,
80>>10	leshort	=1	1 pattern
81>>10	leshort	!1	%d patterns
82
83#------------------------------------------------------------------------------
84# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $
85# adi: file(1) magic for ADi's objects
86# From Gregory McGarry <g.mcgarry@ieee.org>
87#
880	leshort		0x521c		COFF DSP21k
89>18	lelong		&02		executable,
90>18	lelong		^02
91>>18	lelong		&01		static object,
92>>18	lelong		^01		relocatable object,
93>18	lelong		&010		stripped
94>18	lelong		^010		not stripped
95
96#------------------------------------------------------------------------------
97# $File: adventure,v 1.14 2012/06/21 01:32:26 christos Exp $
98# adventure: file(1) magic for Adventure game files
99#
100# from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
101# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998
102# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
103#
104# ALAN
105# I assume there are other, lower versions, but these are the only ones I
106# saw in the archive.
1070	beshort	0x0206	ALAN game data
108>2	byte	<10	version 2.6%d
109
110
111# Infocom (see z-machine)
112#------------------------------------------------------------------------------
113# Z-machine:  file(1) magic for Z-machine binaries.
114# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
115#
116#http://www.gnelson.demon.co.uk/zspec/sect11.html
117#http://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt
118#http://en.wikipedia.org/wiki/Z-machine
119# The first byte is the Z-machine revision; it is always between 1 and 8. We
120# had false matches (for instance, inbig5.ocp from the Omega TeX extension as
121# well as an occasional MP3 file), so we sanity-check the version number.
122#
123# It might be possible to sanity-check the release number as well, as it seems
124# (at least in classic Infocom games) to always be a relatively small number,
125# always under 150 or so, but as this isn't rigorous, we'll wait on that until
126# it becomes clear that it's needed.
127#
1280	ubyte			>0
129>0	ubyte			<9
130>>16	belong&0xfe00f0f0	0x3030
131>>>0	ubyte			< 10
132>>>>2	ubeshort		< 10
133>>>>>18	regex			[0-9][0-9][0-9][0-9][0-9][0-9]
134>>>>>>0	ubyte			< 10	Infocom (Z-machine %d,
135>>>>>>>2	ubeshort	< 10 	Release %d /
136>>>>>>>>18	string		>\0	Serial %.6s)
137!:strength + 40
138
139#------------------------------------------------------------------------------
140# Glulx:  file(1) magic for Glulx binaries.
141#
142# I haven't checked for false matches yet.
143#
1440	string			Glul	Glulx game data
145>4	beshort			x	(Version %d
146>>6	byte			x	\b.%d
147>>8	byte			x	\b.%d)
148>36	string			Info	Compiled by Inform
149
150
151
152# For Quetzal and blorb magic see iff
153
154
155# TADS (Text Adventure Development System) version 2
156#  All files are machine-independent (games compile to byte-code) and are tagged
157#  with a version string of the form "V2.<digit>.<digit>\0".
158#  Game files start with "TADS2 bin\n\r\032\0" then the compiler version.
1590	string	TADS2\ bin	TADS
160>9	belong  !0x0A0D1A00	game data, CORRUPTED
161>9	belong	 0x0A0D1A00
162>>13	string	>\0		%s game data
163#  Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version.
1640	string	TADS2\ rsc	TADS
165>9	belong  !0x0A0D1A00	resource data, CORRUPTED
166>9	belong	 0x0A0D1A00
167>>13	string	>\0		%s resource data
168#  Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
169#  2-byte length N, the N-char name of the game file *without* a NUL (darn!),
170# "TADS2 save\n\r\032\0" and the interpreter version.
1710	string	TADS2\ save/g	TADS
172>12	belong	!0x0A0D1A00	saved game data, CORRUPTED
173>12	belong	 0x0A0D1A00
174>>(16.s+32) string >\0		%s saved game data
175#  Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter
176#  version.
1770	string	TADS2\ save	TADS
178>10	belong	!0x0A0D1A00	saved game data, CORRUPTED
179>10	belong	 0x0A0D1A00
180>>14	string	>\0		%s saved game data
181
182# TADS (Text Adventure Development System) version 3
183#  Game files start with "T3-image\015\012\032"
1840	string	T3-image\015\012\032
185>11	leshort	x		TADS 3 game data (format version %d)
186#  Saved game files start with "T3-state-v####\015\012\032"
187#  where #### is a format version number
1880	string	T3-state-v
189>14	string	\015\012\032	TADS 3 saved game data (format version
190>>10	byte	x		%c
191>>11	byte	x		\b%c
192>>12	byte	x		\b%c
193>>13	byte	x		\b%c)
194
195# Danny Milosavljevic <danny.milo@gmx.net>
196# this are adrift (adventure game standard) game files, extension .taf
197# depending on version magic continues with 0x93453E6139FA (V 4.0)
198# 0x9445376139FA (V 3.90)
199# 0x9445366139FA (V 3.80)
200# this is from source (http://www.adrift.org.uk/) and I have some taf
201# files, and checked them.
202#0	belong	0x3C423FC9
203#>4	belong	0x6A87C2CF	Adrift game file
204#!:mime	application/x-adrift
205
206#------------------------------------------------------------------------------
207# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $
208# allegro:  file(1) magic for Allegro datafiles
209# Toby Deshane <hac@shoelace.digivill.net>
210#
2110 belong 0x736C6821   Allegro datafile (packed)
2120 belong 0x736C682E   Allegro datafile (not packed/autodetect)
2130 belong 0x736C682B   Allegro datafile (appended exe data)
214
215#------------------------------------------------------------------------------
216# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $
217# alliant:  file(1) magic for Alliant FX series a.out files
218#
219# If the FX series is the one that had a processor with a 68K-derived
220# instruction set, the "short" should probably become "beshort" and the
221# "long" should probably become "belong".
222# If it's the i860-based one, they should probably become either the
223# big-endian or little-endian versions, depending on the mode they ran
224# the 860 in....
225#
2260	short		0420		0420 Alliant virtual executable
227>2	short		&0x0020		common library
228>16	long		>0		not stripped
2290	short		0421		0421 Alliant compact executable
230>2	short		&0x0020		common library
231>16	long		>0		not stripped
232
233#------------------------------------------------------------------------------
234# $File: amanda,v 1.5 2009/09/19 16:28:07 christos Exp $
235# amanda:  file(1) magic for amanda file format
236#
2370	string	AMANDA:\ 		AMANDA
238>8	string	TAPESTART\ DATE		tape header file,
239>>23	string	X
240>>>25	string	>\ 			Unused %s
241>>23	string	>\ 			DATE %s
242>8	string	FILE\ 			dump file,
243>>13	string	>\ 			DATE %s
244
245#------------------------------------------------------------------------------
246# $File: amigaos,v 1.15 2012/06/21 01:13:59 christos Exp $
247# amigaos:  file(1) magic for AmigaOS binary formats:
248
249#
250# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
251#
2520	belong		0x000003fa	AmigaOS shared library
2530	belong		0x000003f3	AmigaOS loadseg()ble executable/binary
2540	belong		0x000003e7	AmigaOS object/library data
255#
2560	beshort		0xe310		Amiga Workbench
257>2	beshort		1
258>>48	byte		1		disk icon
259>>48	byte		2		drawer icon
260>>48	byte		3		tool icon
261>>48	byte		4		project icon
262>>48	byte		5		garbage icon
263>>48	byte		6		device icon
264>>48	byte		7		kickstart icon
265>>48	byte		8		workbench application icon
266>2	beshort		>1		icon, vers. %d
267#
268# various sound formats from the Amiga
269# G=F6tz Waschk <waschk@informatik.uni-rostock.de>
270#
2710	string		FC14		Future Composer 1.4 Module sound file
2720	string		SMOD		Future Composer 1.3 Module sound file
2730	string		AON4artofnoise	Art Of Noise Module sound file
2741	string		MUGICIAN/SOFTEYES Mugician Module sound file
27558	string		SIDMON\ II\ -\ THE	Sidmon 2.0 Module sound file
2760	string		Synth4.0	Synthesis Module sound file
2770	string		ARP.		The Holy Noise Module sound file
2780	string		BeEp\0		JamCracker Module sound file
2790	string		COSO\0		Hippel-COSO Module sound file
280# Too simple (short, pure ASCII, deep), MPi
281#26	string		V.3		Brian Postma's Soundmon Module sound file v3
282#26	string		BPSM		Brian Postma's Soundmon Module sound file v3
283#26	string		V.2		Brian Postma's Soundmon Module sound file v2
284
285# The following are from: "Stefan A. Haubenthal" <polluks@web.de>
2860	beshort		0x0f00		AmigaOS bitmap font
2870	beshort		0x0f03		AmigaOS outline font
2880	belong		0x80001001	AmigaOS outline tag
2890	string		##\ version	catalog translation
2900	string		EMOD\0		Amiga E module
2918	string		ECXM\0		ECX module
2920	string/c	@database	AmigaGuide file
293
294# Amiga disk types
295#
2960	string		RDSK		Rigid Disk Block
297>160	string		x		on %.24s
2980	string		DOS\0		Amiga DOS disk
2990	string		DOS\1		Amiga FFS disk
3000	string		DOS\2		Amiga Inter DOS disk
3010	string		DOS\3		Amiga Inter FFS disk
3020	string		DOS\4		Amiga Fastdir DOS disk
3030	string		DOS\5		Amiga Fastdir FFS disk
3040	string		KICK		Kickstart disk
305
306# From: Alex Beregszaszi <alex@fsn.hu>
3070	string		LZX		LZX compressed archive (Amiga)
308
309# From: Przemek Kramarczyk <pkramarczyk@gmail.com>
3100	string 		.KEY		AmigaDOS script
3110	string 		.key		AmigaDOS script
312
313#------------------------------------------------------------------------------
314# $File: animation,v 1.48 2013/03/09 22:36:00 christos Exp $
315# animation:  file(1) magic for animation/movie formats
316#
317# animation formats
318# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
319# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
320
321# SGI and Apple formats
3220	string		MOVI		Silicon Graphics movie file
323!:mime	video/x-sgi-movie
3244       string          moov            Apple QuickTime
325!:mime	video/quicktime
326>12     string          mvhd            \b movie (fast start)
327>12     string          mdra            \b URL
328>12     string          cmov            \b movie (fast start, compressed header)
329>12     string          rmra            \b multiple URLs
3304       string          mdat            Apple QuickTime movie (unoptimized)
331!:mime	video/quicktime
332#4       string          wide            Apple QuickTime movie (unoptimized)
333#!:mime	video/quicktime
334#4       string          skip            Apple QuickTime movie (modified)
335#!:mime	video/quicktime
336#4       string          free            Apple QuickTime movie (modified)
337#!:mime	video/quicktime
3384       string          idsc            Apple QuickTime image (fast start)
339!:mime	image/x-quicktime
340#4       string          idat            Apple QuickTime image (unoptimized)
341#!:mime	image/x-quicktime
3424       string          pckg            Apple QuickTime compressed archive
343!:mime	application/x-quicktime-player
3444	string/W	jP		JPEG 2000 image
345!:mime	image/jp2
3464	string		ftyp		ISO Media
347>8	string		isom		\b, MPEG v4 system, version 1
348!:mime	video/mp4
349>8	string		iso2		\b, MPEG v4 system, part 12 revision
350>8	string		mp41		\b, MPEG v4 system, version 1
351!:mime	video/mp4
352>8	string		mp42		\b, MPEG v4 system, version 2
353!:mime	video/mp4
354>8	string		mp7t		\b, MPEG v4 system, MPEG v7 XML
355>8	string		mp7b		\b, MPEG v4 system, MPEG v7 binary XML
356>8	string/W	jp2		\b, JPEG 2000
357!:mime	image/jp2
358>8	string		3ge		\b, MPEG v4 system, 3GPP
359!:mime	video/3gpp
360>8	string		3gg		\b, MPEG v4 system, 3GPP
361!:mime	video/3gpp
362>8	string		3gp		\b, MPEG v4 system, 3GPP
363!:mime	video/3gpp
364>8	string		3gs		\b, MPEG v4 system, 3GPP
365!:mime	video/3gpp
366>8	string		3g2		\b, MPEG v4 system, 3GPP2
367!:mime	video/3gpp2
368>>11	byte		4		\b v4 (H.263/AMR GSM 6.10)
369>>11	byte		5		\b v5 (H.263/AMR GSM 6.10)
370>>11	byte		6		\b v6 (ITU H.264/AMR GSM 6.10)
371>8	string		mmp4		\b, MPEG v4 system, 3GPP Mobile
372!:mime	video/mp4
373>8	string		avc1		\b, MPEG v4 system, 3GPP JVT AVC
374!:mime	video/3gpp
375>8	string/W	M4A		\b, MPEG v4 system, iTunes AAC-LC
376!:mime	audio/mp4
377>8	string/W	M4V		\b, MPEG v4 system, iTunes AVC-LC
378!:mime	video/mp4
379>8	string/W	M4P		\b, MPEG v4 system, iTunes AES encrypted
380>8	string/W	M4B		\b, MPEG v4 system, iTunes bookmarked
381>8	string/W	qt		\b, Apple QuickTime movie
382!:mime	video/quicktime
383
384# MPEG sequences
385# Scans for all common MPEG header start codes
3860	 belong		    0x00000001
387>4	 byte&0x1F	    0x07	   JVT NAL sequence, H.264 video
388>>5      byte               66             \b, baseline
389>>5      byte               77             \b, main
390>>5      byte               88             \b, extended
391>>7      byte               x              \b @ L %u
3920        belong&0xFFFFFF00  0x00000100
393>3       byte               0xBA           MPEG sequence
394!:mime  video/mpeg
395>>4      byte               &0x40          \b, v2, program multiplex
396>>4      byte               ^0x40          \b, v1, system multiplex
397>3       byte               0xBB           MPEG sequence, v1/2, multiplex (missing pack header)
398>3       byte&0x1F          0x07           MPEG sequence, H.264 video
399>>4      byte               66             \b, baseline
400>>4      byte               77             \b, main
401>>4      byte               88             \b, extended
402>>6      byte               x              \b @ L %u
403# GRR too general as it catches also FoxPro Memo example NG.FPT
404>3       byte               0xB0           MPEG sequence, v4
405# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000
406#>>4      byte               !0             MPEG sequence, v4
407!:mime  video/mpeg4-generic
408>>5      belong             0x000001B5
409>>>9     byte               &0x80
410>>>>10   byte&0xF0          16             \b, video
411>>>>10   byte&0xF0          32             \b, still texture
412>>>>10   byte&0xF0          48             \b, mesh
413>>>>10   byte&0xF0          64             \b, face
414>>>9     byte&0xF8          8              \b, video
415>>>9     byte&0xF8          16             \b, still texture
416>>>9     byte&0xF8          24             \b, mesh
417>>>9     byte&0xF8          32             \b, face
418>>4      byte               1              \b, simple @ L1
419>>4      byte               2              \b, simple @ L2
420>>4      byte               3              \b, simple @ L3
421>>4      byte               4              \b, simple @ L0
422>>4      byte               17             \b, simple scalable @ L1
423>>4      byte               18             \b, simple scalable @ L2
424>>4      byte               33             \b, core @ L1
425>>4      byte               34             \b, core @ L2
426>>4      byte               50             \b, main @ L2
427>>4      byte               51             \b, main @ L3
428>>4      byte               53             \b, main @ L4
429>>4      byte               66             \b, n-bit @ L2
430>>4      byte               81             \b, scalable texture @ L1
431>>4      byte               97             \b, simple face animation @ L1
432>>4      byte               98             \b, simple face animation @ L2
433>>4      byte               99             \b, simple face basic animation @ L1
434>>4      byte               100            \b, simple face basic animation @ L2
435>>4      byte               113            \b, basic animation text @ L1
436>>4      byte               114            \b, basic animation text @ L2
437>>4      byte               129            \b, hybrid @ L1
438>>4      byte               130            \b, hybrid @ L2
439>>4      byte               145            \b, advanced RT simple @ L!
440>>4      byte               146            \b, advanced RT simple @ L2
441>>4      byte               147            \b, advanced RT simple @ L3
442>>4      byte               148            \b, advanced RT simple @ L4
443>>4      byte               161            \b, core scalable @ L1
444>>4      byte               162            \b, core scalable @ L2
445>>4      byte               163            \b, core scalable @ L3
446>>4      byte               177            \b, advanced coding efficiency @ L1
447>>4      byte               178            \b, advanced coding efficiency @ L2
448>>4      byte               179            \b, advanced coding efficiency @ L3
449>>4      byte               180            \b, advanced coding efficiency @ L4
450>>4      byte               193            \b, advanced core @ L1
451>>4      byte               194            \b, advanced core @ L2
452>>4      byte               209            \b, advanced scalable texture @ L1
453>>4      byte               210            \b, advanced scalable texture @ L2
454>>4      byte               211            \b, advanced scalable texture @ L3
455>>4      byte               225            \b, simple studio @ L1
456>>4      byte               226            \b, simple studio @ L2
457>>4      byte               227            \b, simple studio @ L3
458>>4      byte               228            \b, simple studio @ L4
459>>4      byte               229            \b, core studio @ L1
460>>4      byte               230            \b, core studio @ L2
461>>4      byte               231            \b, core studio @ L3
462>>4      byte               232            \b, core studio @ L4
463>>4      byte               240            \b, advanced simple @ L0
464>>4      byte               241            \b, advanced simple @ L1
465>>4      byte               242            \b, advanced simple @ L2
466>>4      byte               243            \b, advanced simple @ L3
467>>4      byte               244            \b, advanced simple @ L4
468>>4      byte               245            \b, advanced simple @ L5
469>>4      byte               247            \b, advanced simple @ L3b
470>>4      byte               248            \b, FGS @ L0
471>>4      byte               249            \b, FGS @ L1
472>>4      byte               250            \b, FGS @ L2
473>>4      byte               251            \b, FGS @ L3
474>>4      byte               252            \b, FGS @ L4
475>>4      byte               253            \b, FGS @ L5
476>3       byte               0xB5           MPEG sequence, v4
477!:mime  video/mpeg4-generic
478>>4      byte               &0x80
479>>>5     byte&0xF0          16             \b, video (missing profile header)
480>>>5     byte&0xF0          32             \b, still texture (missing profile header)
481>>>5     byte&0xF0          48             \b, mesh (missing profile header)
482>>>5     byte&0xF0          64             \b, face (missing profile header)
483>>4      byte&0xF8          8              \b, video (missing profile header)
484>>4      byte&0xF8          16             \b, still texture (missing profile header)
485>>4      byte&0xF8          24             \b, mesh (missing profile header)
486>>4      byte&0xF8          32             \b, face (missing profile header)
487>3       byte               0xB3           MPEG sequence
488!:mime  video/mpeg
489>>12     belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
490>>12     belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
491>>12     belong             0x000001B5     \b, v2,
492>>>16    byte&0x0F          1              \b HP
493>>>16    byte&0x0F          2              \b Spt
494>>>16    byte&0x0F          3              \b SNR
495>>>16    byte&0x0F          4              \b MP
496>>>16    byte&0x0F          5              \b SP
497>>>17    byte&0xF0          64             \b@HL
498>>>17    byte&0xF0          96             \b@H-14
499>>>17    byte&0xF0          128            \b@ML
500>>>17    byte&0xF0          160            \b@LL
501>>>17    byte               &0x08          \b progressive
502>>>17    byte               ^0x08          \b interlaced
503>>>17    byte&0x06          2              \b Y'CbCr 4:2:0 video
504>>>17    byte&0x06          4              \b Y'CbCr 4:2:2 video
505>>>17    byte&0x06          6              \b Y'CbCr 4:4:4 video
506>>11     byte               &0x02
507>>>75    byte               &0x01
508>>>>140  belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
509>>>>140  belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
510>>>>140  belong             0x000001B5     \b, v2,
511>>>>>144 byte&0x0F          1              \b HP
512>>>>>144 byte&0x0F          2              \b Spt
513>>>>>144 byte&0x0F          3              \b SNR
514>>>>>144 byte&0x0F          4              \b MP
515>>>>>144 byte&0x0F          5              \b SP
516>>>>>145 byte&0xF0          64             \b@HL
517>>>>>145 byte&0xF0          96             \b@H-14
518>>>>>145 byte&0xF0          128            \b@ML
519>>>>>145 byte&0xF0          160            \b@LL
520>>>>>145 byte               &0x08          \b progressive
521>>>>>145 byte               ^0x08          \b interlaced
522>>>>>145 byte&0x06          2              \b Y'CbCr 4:2:0 video
523>>>>>145 byte&0x06          4              \b Y'CbCr 4:2:2 video
524>>>>>145 byte&0x06          6              \b Y'CbCr 4:4:4 video
525>>76    belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
526>>76    belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
527>>76    belong             0x000001B5     \b, v2,
528>>>80   byte&0x0F          1              \b HP
529>>>80   byte&0x0F          2              \b Spt
530>>>80   byte&0x0F          3              \b SNR
531>>>80   byte&0x0F          4              \b MP
532>>>80   byte&0x0F          5              \b SP
533>>>81   byte&0xF0          64             \b@HL
534>>>81   byte&0xF0          96             \b@H-14
535>>>81   byte&0xF0          128            \b@ML
536>>>81   byte&0xF0          160            \b@LL
537>>>81   byte               &0x08          \b progressive
538>>>81   byte               ^0x08          \b interlaced
539>>>81   byte&0x06          2              \b Y'CbCr 4:2:0 video
540>>>81   byte&0x06          4              \b Y'CbCr 4:2:2 video
541>>>81   byte&0x06          6              \b Y'CbCr 4:4:4 video
542>>4      belong&0xFFFFFF00  0x78043800     \b, HD-TV 1920P
543>>>7     byte&0xF0          0x10           \b, 16:9
544>>4      belong&0xFFFFFF00  0x50002D00     \b, SD-TV 1280I
545>>>7     byte&0xF0          0x10           \b, 16:9
546>>4      belong&0xFFFFFF00  0x30024000     \b, PAL Capture
547>>>7     byte&0xF0          0x10           \b, 4:3
548>>4      beshort&0xFFF0     0x2C00         \b, 4CIF
549>>>5     beshort&0x0FFF     0x01E0         \b NTSC
550>>>5     beshort&0x0FFF     0x0240         \b PAL
551>>>7     byte&0xF0          0x20           \b, 4:3
552>>>7     byte&0xF0          0x30           \b, 16:9
553>>>7     byte&0xF0          0x40           \b, 11:5
554>>>7     byte&0xF0          0x80           \b, PAL 4:3
555>>>7     byte&0xF0          0xC0           \b, NTSC 4:3
556>>4      belong&0xFFFFFF00  0x2801E000     \b, LD-TV 640P
557>>>7     byte&0xF0          0x10           \b, 4:3
558>>4      belong&0xFFFFFF00  0x1400F000     \b, 320x240
559>>>7     byte&0xF0          0x10           \b, 4:3
560>>4      belong&0xFFFFFF00  0x0F00A000     \b, 240x160
561>>>7     byte&0xF0          0x10           \b, 4:3
562>>4      belong&0xFFFFFF00  0x0A007800     \b, 160x120
563>>>7     byte&0xF0          0x10           \b, 4:3
564>>4      beshort&0xFFF0     0x1600         \b, CIF
565>>>5     beshort&0x0FFF     0x00F0         \b NTSC
566>>>5     beshort&0x0FFF     0x0120         \b PAL
567>>>7     byte&0xF0          0x20           \b, 4:3
568>>>7     byte&0xF0          0x30           \b, 16:9
569>>>7     byte&0xF0          0x40           \b, 11:5
570>>>7     byte&0xF0          0x80           \b, PAL 4:3
571>>>7     byte&0xF0          0xC0           \b, NTSC 4:3
572>>>5     beshort&0x0FFF     0x0240         \b PAL 625
573>>>>7    byte&0xF0          0x20           \b, 4:3
574>>>>7    byte&0xF0          0x30           \b, 16:9
575>>>>7    byte&0xF0          0x40           \b, 11:5
576>>4      beshort&0xFFF0     0x2D00         \b, CCIR/ITU
577>>>5     beshort&0x0FFF     0x01E0         \b NTSC 525
578>>>5     beshort&0x0FFF     0x0240         \b PAL 625
579>>>7     byte&0xF0          0x20           \b, 4:3
580>>>7     byte&0xF0          0x30           \b, 16:9
581>>>7     byte&0xF0          0x40           \b, 11:5
582>>4      beshort&0xFFF0     0x1E00         \b, SVCD
583>>>5     beshort&0x0FFF     0x01E0         \b NTSC 525
584>>>5     beshort&0x0FFF     0x0240         \b PAL 625
585>>>7     byte&0xF0          0x20           \b, 4:3
586>>>7     byte&0xF0          0x30           \b, 16:9
587>>>7     byte&0xF0          0x40           \b, 11:5
588>>7      byte&0x0F          1              \b, 23.976 fps
589>>7      byte&0x0F          2              \b, 24 fps
590>>7      byte&0x0F          3              \b, 25 fps
591>>7      byte&0x0F          4              \b, 29.97 fps
592>>7      byte&0x0F          5              \b, 30 fps
593>>7      byte&0x0F          6              \b, 50 fps
594>>7      byte&0x0F          7              \b, 59.94 fps
595>>7      byte&0x0F          8              \b, 60 fps
596>>11     byte               &0x04          \b, Constrained
597
598# MPEG ADTS Audio (*.mpx/mxa/aac)
599# from dreesen@math.fu-berlin.de
600# modified to fully support MPEG ADTS
601
602# MP3, M1A
603# modified by Joerg Jenderek
604# GRR the original test are too common for many DOS files
605# so don't accept as MP3 until we've tested the rate
6060       beshort&0xFFFE  0xFFFA
607# rates
608>2      byte&0xF0       0x10           MPEG ADTS, layer III, v1,  32 kbps
609!:mime	audio/mpeg
610>2      byte&0xF0       0x20           MPEG ADTS, layer III, v1,  40 kbps
611!:mime	audio/mpeg
612>2      byte&0xF0       0x30           MPEG ADTS, layer III, v1,  48 kbps
613!:mime	audio/mpeg
614>2      byte&0xF0       0x40           MPEG ADTS, layer III, v1,  56 kbps
615!:mime	audio/mpeg
616>2      byte&0xF0       0x50           MPEG ADTS, layer III, v1,  64 kbps
617!:mime	audio/mpeg
618>2      byte&0xF0       0x60           MPEG ADTS, layer III, v1,  80 kbps
619!:mime	audio/mpeg
620>2      byte&0xF0       0x70           MPEG ADTS, layer III, v1,  96 kbps
621!:mime	audio/mpeg
622>2      byte&0xF0       0x80           MPEG ADTS, layer III, v1, 112 kbps
623!:mime	audio/mpeg
624>2      byte&0xF0       0x90           MPEG ADTS, layer III, v1, 128 kbps
625!:mime	audio/mpeg
626>2      byte&0xF0       0xA0           MPEG ADTS, layer III, v1, 160 kbps
627!:mime	audio/mpeg
628>2      byte&0xF0       0xB0           MPEG ADTS, layer III, v1, 192 kbps
629!:mime	audio/mpeg
630>2      byte&0xF0       0xC0           MPEG ADTS, layer III, v1, 224 kbps
631!:mime	audio/mpeg
632>2      byte&0xF0       0xD0           MPEG ADTS, layer III, v1, 256 kbps
633!:mime	audio/mpeg
634>2      byte&0xF0       0xE0           MPEG ADTS, layer III, v1, 320 kbps
635!:mime	audio/mpeg
636# timing
637>2      byte&0x0C       0x00           \b, 44.1 kHz
638>2      byte&0x0C       0x04           \b, 48 kHz
639>2      byte&0x0C       0x08           \b, 32 kHz
640# channels/options
641>3      byte&0xC0       0x00           \b, Stereo
642>3      byte&0xC0       0x40           \b, JntStereo
643>3      byte&0xC0       0x80           \b, 2x Monaural
644>3      byte&0xC0       0xC0           \b, Monaural
645#>1     byte            ^0x01          \b, Data Verify
646#>2     byte            &0x02          \b, Packet Pad
647#>2     byte            &0x01          \b, Custom Flag
648#>3     byte            &0x08          \b, Copyrighted
649#>3     byte            &0x04          \b, Original Source
650#>3     byte&0x03       1              \b, NR: 50/15 ms
651#>3     byte&0x03       3              \b, NR: CCIT J.17
652
653# MP2, M1A
6540       beshort&0xFFFE  0xFFFC         MPEG ADTS, layer II, v1
655!:mime	audio/mpeg
656# rates
657>2      byte&0xF0       0x10           \b,  32 kbps
658>2      byte&0xF0       0x20           \b,  48 kbps
659>2      byte&0xF0       0x30           \b,  56 kbps
660>2      byte&0xF0       0x40           \b,  64 kbps
661>2      byte&0xF0       0x50           \b,  80 kbps
662>2      byte&0xF0       0x60           \b,  96 kbps
663>2      byte&0xF0       0x70           \b, 112 kbps
664>2      byte&0xF0       0x80           \b, 128 kbps
665>2      byte&0xF0       0x90           \b, 160 kbps
666>2      byte&0xF0       0xA0           \b, 192 kbps
667>2      byte&0xF0       0xB0           \b, 224 kbps
668>2      byte&0xF0       0xC0           \b, 256 kbps
669>2      byte&0xF0       0xD0           \b, 320 kbps
670>2      byte&0xF0       0xE0           \b, 384 kbps
671# timing
672>2      byte&0x0C       0x00           \b, 44.1 kHz
673>2      byte&0x0C       0x04           \b, 48 kHz
674>2      byte&0x0C       0x08           \b, 32 kHz
675# channels/options
676>3      byte&0xC0       0x00           \b, Stereo
677>3      byte&0xC0       0x40           \b, JntStereo
678>3      byte&0xC0       0x80           \b, 2x Monaural
679>3      byte&0xC0       0xC0           \b, Monaural
680#>1     byte            ^0x01          \b, Data Verify
681#>2     byte            &0x02          \b, Packet Pad
682#>2     byte            &0x01          \b, Custom Flag
683#>3     byte            &0x08          \b, Copyrighted
684#>3     byte            &0x04          \b, Original Source
685#>3     byte&0x03       1              \b, NR: 50/15 ms
686#>3     byte&0x03       3              \b, NR: CCIT J.17
687
688# MPA, M1A
689# updated by Joerg Jenderek
690# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448
691# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE)
692# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries
693#0	beshort&0xFFFE		0xFFFE
694#>2	ubyte&0xF0	>0x0F
695#>>2	ubyte&0xF0	<0xE1		MPEG ADTS, layer I, v1
696## rate
697#>>>2      byte&0xF0       0x10           \b,  32 kbps
698#>>>2      byte&0xF0       0x20           \b,  64 kbps
699#>>>2      byte&0xF0       0x30           \b,  96 kbps
700#>>>2      byte&0xF0       0x40           \b, 128 kbps
701#>>>2      byte&0xF0       0x50           \b, 160 kbps
702#>>>2      byte&0xF0       0x60           \b, 192 kbps
703#>>>2      byte&0xF0       0x70           \b, 224 kbps
704#>>>2      byte&0xF0       0x80           \b, 256 kbps
705#>>>2      byte&0xF0       0x90           \b, 288 kbps
706#>>>2      byte&0xF0       0xA0           \b, 320 kbps
707#>>>2      byte&0xF0       0xB0           \b, 352 kbps
708#>>>2      byte&0xF0       0xC0           \b, 384 kbps
709#>>>2      byte&0xF0       0xD0           \b, 416 kbps
710#>>>2      byte&0xF0       0xE0           \b, 448 kbps
711## timing
712#>>>2      byte&0x0C       0x00           \b, 44.1 kHz
713#>>>2      byte&0x0C       0x04           \b, 48 kHz
714#>>>2      byte&0x0C       0x08           \b, 32 kHz
715## channels/options
716#>>>3      byte&0xC0       0x00           \b, Stereo
717#>>>3      byte&0xC0       0x40           \b, JntStereo
718#>>>3      byte&0xC0       0x80           \b, 2x Monaural
719#>>>3      byte&0xC0       0xC0           \b, Monaural
720##>1     byte            ^0x01          \b, Data Verify
721##>2     byte            &0x02          \b, Packet Pad
722##>2     byte            &0x01          \b, Custom Flag
723##>3     byte            &0x08          \b, Copyrighted
724##>3     byte            &0x04          \b, Original Source
725##>3     byte&0x03       1              \b, NR: 50/15 ms
726##>3     byte&0x03       3              \b, NR: CCIT J.17
727
728# MP3, M2A
7290       beshort&0xFFFE  0xFFF2         MPEG ADTS, layer III, v2
730!:mime	audio/mpeg
731# rate
732>2      byte&0xF0       0x10           \b,   8 kbps
733>2      byte&0xF0       0x20           \b,  16 kbps
734>2      byte&0xF0       0x30           \b,  24 kbps
735>2      byte&0xF0       0x40           \b,  32 kbps
736>2      byte&0xF0       0x50           \b,  40 kbps
737>2      byte&0xF0       0x60           \b,  48 kbps
738>2      byte&0xF0       0x70           \b,  56 kbps
739>2      byte&0xF0       0x80           \b,  64 kbps
740>2      byte&0xF0       0x90           \b,  80 kbps
741>2      byte&0xF0       0xA0           \b,  96 kbps
742>2      byte&0xF0       0xB0           \b, 112 kbps
743>2      byte&0xF0       0xC0           \b, 128 kbps
744>2      byte&0xF0       0xD0           \b, 144 kbps
745>2      byte&0xF0       0xE0           \b, 160 kbps
746# timing
747>2      byte&0x0C       0x00           \b, 22.05 kHz
748>2      byte&0x0C       0x04           \b, 24 kHz
749>2      byte&0x0C       0x08           \b, 16 kHz
750# channels/options
751>3      byte&0xC0       0x00           \b, Stereo
752>3      byte&0xC0       0x40           \b, JntStereo
753>3      byte&0xC0       0x80           \b, 2x Monaural
754>3      byte&0xC0       0xC0           \b, Monaural
755#>1     byte            ^0x01          \b, Data Verify
756#>2     byte            &0x02          \b, Packet Pad
757#>2     byte            &0x01          \b, Custom Flag
758#>3     byte            &0x08          \b, Copyrighted
759#>3     byte            &0x04          \b, Original Source
760#>3     byte&0x03       1              \b, NR: 50/15 ms
761#>3     byte&0x03       3              \b, NR: CCIT J.17
762
763# MP2, M2A
7640       beshort&0xFFFE  0xFFF4         MPEG ADTS, layer II, v2
765# rate
766>2      byte&0xF0       0x10           \b,   8 kbps
767>2      byte&0xF0       0x20           \b,  16 kbps
768>2      byte&0xF0       0x30           \b,  24 kbps
769>2      byte&0xF0       0x40           \b,  32 kbps
770>2      byte&0xF0       0x50           \b,  40 kbps
771>2      byte&0xF0       0x60           \b,  48 kbps
772>2      byte&0xF0       0x70           \b,  56 kbps
773>2      byte&0xF0       0x80           \b,  64 kbps
774>2      byte&0xF0       0x90           \b,  80 kbps
775>2      byte&0xF0       0xA0           \b,  96 kbps
776>2      byte&0xF0       0xB0           \b, 112 kbps
777>2      byte&0xF0       0xC0           \b, 128 kbps
778>2      byte&0xF0       0xD0           \b, 144 kbps
779>2      byte&0xF0       0xE0           \b, 160 kbps
780# timing
781>2      byte&0x0C       0x00           \b, 22.05 kHz
782>2      byte&0x0C       0x04           \b, 24 kHz
783>2      byte&0x0C       0x08           \b, 16 kHz
784# channels/options
785>3      byte&0xC0       0x00           \b, Stereo
786>3      byte&0xC0       0x40           \b, JntStereo
787>3      byte&0xC0       0x80           \b, 2x Monaural
788>3      byte&0xC0       0xC0           \b, Monaural
789#>1     byte            ^0x01          \b, Data Verify
790#>2     byte            &0x02          \b, Packet Pad
791#>2     byte            &0x01          \b, Custom Flag
792#>3     byte            &0x08          \b, Copyrighted
793#>3     byte            &0x04          \b, Original Source
794#>3     byte&0x03       1              \b, NR: 50/15 ms
795#>3     byte&0x03       3              \b, NR: CCIT J.17
796
797# MPA, M2A
7980       beshort&0xFFFE  0xFFF6         MPEG ADTS, layer I, v2
799!:mime	audio/mpeg
800# rate
801>2      byte&0xF0       0x10           \b,  32 kbps
802>2      byte&0xF0       0x20           \b,  48 kbps
803>2      byte&0xF0       0x30           \b,  56 kbps
804>2      byte&0xF0       0x40           \b,  64 kbps
805>2      byte&0xF0       0x50           \b,  80 kbps
806>2      byte&0xF0       0x60           \b,  96 kbps
807>2      byte&0xF0       0x70           \b, 112 kbps
808>2      byte&0xF0       0x80           \b, 128 kbps
809>2      byte&0xF0       0x90           \b, 144 kbps
810>2      byte&0xF0       0xA0           \b, 160 kbps
811>2      byte&0xF0       0xB0           \b, 176 kbps
812>2      byte&0xF0       0xC0           \b, 192 kbps
813>2      byte&0xF0       0xD0           \b, 224 kbps
814>2      byte&0xF0       0xE0           \b, 256 kbps
815# timing
816>2      byte&0x0C       0x00           \b, 22.05 kHz
817>2      byte&0x0C       0x04           \b, 24 kHz
818>2      byte&0x0C       0x08           \b, 16 kHz
819# channels/options
820>3      byte&0xC0       0x00           \b, Stereo
821>3      byte&0xC0       0x40           \b, JntStereo
822>3      byte&0xC0       0x80           \b, 2x Monaural
823>3      byte&0xC0       0xC0           \b, Monaural
824#>1     byte            ^0x01          \b, Data Verify
825#>2     byte            &0x02          \b, Packet Pad
826#>2     byte            &0x01          \b, Custom Flag
827#>3     byte            &0x08          \b, Copyrighted
828#>3     byte            &0x04          \b, Original Source
829#>3     byte&0x03       1              \b, NR: 50/15 ms
830#>3     byte&0x03       3              \b, NR: CCIT J.17
831
832# MP3, M25A
8330       beshort&0xFFFE  0xFFE2         MPEG ADTS, layer III,  v2.5
834!:mime	audio/mpeg
835# rate
836>2      byte&0xF0       0x10           \b,   8 kbps
837>2      byte&0xF0       0x20           \b,  16 kbps
838>2      byte&0xF0       0x30           \b,  24 kbps
839>2      byte&0xF0       0x40           \b,  32 kbps
840>2      byte&0xF0       0x50           \b,  40 kbps
841>2      byte&0xF0       0x60           \b,  48 kbps
842>2      byte&0xF0       0x70           \b,  56 kbps
843>2      byte&0xF0       0x80           \b,  64 kbps
844>2      byte&0xF0       0x90           \b,  80 kbps
845>2      byte&0xF0       0xA0           \b,  96 kbps
846>2      byte&0xF0       0xB0           \b, 112 kbps
847>2      byte&0xF0       0xC0           \b, 128 kbps
848>2      byte&0xF0       0xD0           \b, 144 kbps
849>2      byte&0xF0       0xE0           \b, 160 kbps
850# timing
851>2      byte&0x0C       0x00           \b, 11.025 kHz
852>2      byte&0x0C       0x04           \b, 12 kHz
853>2      byte&0x0C       0x08           \b, 8 kHz
854# channels/options
855>3      byte&0xC0       0x00           \b, Stereo
856>3      byte&0xC0       0x40           \b, JntStereo
857>3      byte&0xC0       0x80           \b, 2x Monaural
858>3      byte&0xC0       0xC0           \b, Monaural
859#>1     byte            ^0x01          \b, Data Verify
860#>2     byte            &0x02          \b, Packet Pad
861#>2     byte            &0x01          \b, Custom Flag
862#>3     byte            &0x08          \b, Copyrighted
863#>3     byte            &0x04          \b, Original Source
864#>3     byte&0x03       1              \b, NR: 50/15 ms
865#>3     byte&0x03       3              \b, NR: CCIT J.17
866
867# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio
868
869# Stored AAC streams (instead of the MP4 format)
8700       string          ADIF           MPEG ADIF, AAC
871!:mime	audio/x-hx-aac-adif
872>4      byte            &0x80
873>>13    byte            &0x10          \b, VBR
874>>13    byte            ^0x10          \b, CBR
875>>16    byte&0x1E       0x02           \b, single stream
876>>16    byte&0x1E       0x04           \b, 2 streams
877>>16    byte&0x1E       0x06           \b, 3 streams
878>>16    byte            &0x08          \b, 4 or more streams
879>>16    byte            &0x10          \b, 8 or more streams
880>>4    byte            &0x80          \b, Copyrighted
881>>13   byte            &0x40          \b, Original Source
882>>13   byte            &0x20          \b, Home Flag
883>4      byte            ^0x80
884>>4     byte            &0x10          \b, VBR
885>>4     byte            ^0x10          \b, CBR
886>>7     byte&0x1E       0x02           \b, single stream
887>>7     byte&0x1E       0x04           \b, 2 streams
888>>7     byte&0x1E       0x06           \b, 3 streams
889>>7     byte            &0x08          \b, 4 or more streams
890>>7     byte            &0x10          \b, 8 or more streams
891>>4    byte            &0x40          \b, Original Stream(s)
892>>4    byte            &0x20          \b, Home Source
893
894# Live or stored single AAC stream (used with MPEG-2 systems)
8950       beshort&0xFFF6  0xFFF0         MPEG ADTS, AAC
896!:mime	audio/x-hx-aac-adts
897>1      byte            &0x08          \b, v2
898>1      byte            ^0x08          \b, v4
899# profile
900>>2     byte            &0xC0          \b LTP
901>2      byte&0xc0       0x00           \b Main
902>2      byte&0xc0       0x40           \b LC
903>2      byte&0xc0       0x80           \b SSR
904# timing
905>2      byte&0x3c       0x00           \b, 96 kHz
906>2      byte&0x3c       0x04           \b, 88.2 kHz
907>2      byte&0x3c       0x08           \b, 64 kHz
908>2      byte&0x3c       0x0c           \b, 48 kHz
909>2      byte&0x3c       0x10           \b, 44.1 kHz
910>2      byte&0x3c       0x14           \b, 32 kHz
911>2      byte&0x3c       0x18           \b, 24 kHz
912>2      byte&0x3c       0x1c           \b, 22.05 kHz
913>2      byte&0x3c       0x20           \b, 16 kHz
914>2      byte&0x3c       0x24           \b, 12 kHz
915>2      byte&0x3c       0x28           \b, 11.025 kHz
916>2      byte&0x3c       0x2c           \b, 8 kHz
917# channels
918>2      beshort&0x01c0  0x0040         \b, monaural
919>2      beshort&0x01c0  0x0080         \b, stereo
920>2      beshort&0x01c0  0x00c0         \b, stereo + center
921>2      beshort&0x01c0  0x0100         \b, stereo+center+LFE
922>2      beshort&0x01c0  0x0140         \b, surround
923>2      beshort&0x01c0  0x0180         \b, surround + LFE
924>2      beshort         &0x01C0        \b, surround + side
925#>1     byte            ^0x01           \b, Data Verify
926#>2     byte            &0x02           \b, Custom Flag
927#>3     byte            &0x20           \b, Original Stream
928#>3     byte            &0x10           \b, Home Source
929#>3     byte            &0x08           \b, Copyrighted
930
931# Live MPEG-4 audio streams (instead of RTP FlexMux)
9320       beshort&0xFFE0  0x56E0         MPEG-4 LOAS
933!:mime	audio/x-mp4a-latm
934#>1     beshort&0x1FFF  x              \b, %u byte packet
935>3      byte&0xE0       0x40
936>>4     byte&0x3C       0x04           \b, single stream
937>>4     byte&0x3C       0x08           \b, 2 streams
938>>4     byte&0x3C       0x0C           \b, 3 streams
939>>4     byte            &0x08          \b, 4 or more streams
940>>4     byte            &0x20          \b, 8 or more streams
941>3      byte&0xC0       0
942>>4     byte&0x78       0x08           \b, single stream
943>>4     byte&0x78       0x10           \b, 2 streams
944>>4     byte&0x78       0x18           \b, 3 streams
945>>4     byte            &0x20          \b, 4 or more streams
946>>4     byte            &0x40          \b, 8 or more streams
947# This magic isn't strong enough (matches plausible ISO-8859-1 text)
948#0       beshort         0x4DE1         MPEG-4 LO-EP audio stream
949#!:mime	audio/x-mp4a-latm
950
951# Summary: FLI animation format
952# Created by: Daniel Quinlan <quinlan@yggdrasil.com>
953# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
9544	leshort		0xAF11
955# standard FLI always has 320x200 resolution and 8 bit color
956>8	leshort		320
957>>10	leshort		200
958>>>12	leshort		8			FLI animation, 320x200x8
959!:mime	video/x-fli
960>>>>6	leshort		x			\b, %d frames
961# frame speed is multiple of 1/70s
962>>>>16	leshort		x			\b, %d/70s per frame
963
964# Summary: FLC animation format
965# Created by: Daniel Quinlan <quinlan@yggdrasil.com>
966# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
9674	leshort		0xAF12
968# standard FLC always use 8 bit color
969>12	leshort		8			FLC animation
970!:mime	video/x-flc
971>>8	leshort		x			\b, %d
972>>10	leshort		x			\bx%dx8
973>>6	uleshort	x			\b, %d frames
974>>16	uleshort	x			\b, %dms per frame
975
976# DL animation format
977# XXX - collision with most `mips' magic
978#
979# I couldn't find a real magic number for these, however, this
980# -appears- to work.  Note that it might catch other files, too, so be
981# careful!
982#
983# Note that title and author appear in the two 20-byte chunks
984# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
985# 255 (hex FF)!  The DL format is really bad.
986#
987#0	byte	1	DL version 1, medium format (160x100, 4 images/screen)
988#!:mime	video/x-unknown
989#>42	byte	x	- %d screens,
990#>43	byte	x	%d commands
991#0	byte	2	DL version 2
992#!:mime	video/x-unknown
993#>1	byte	1	- large format (320x200,1 image/screen),
994#>1	byte	2	- medium format (160x100,4 images/screen),
995#>1	byte	>2	- unknown format,
996#>42	byte	x	%d screens,
997#>43	byte	x	%d commands
998# Based on empirical evidence, DL version 3 have several nulls following the
999# \003.  Most of them start with non-null values at hex offset 0x34 or so.
1000#0	string	\3\0\0\0\0\0\0\0\0\0\0\0	DL version 3
1001
1002# iso 13818 transport stream
1003#
1004# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
1005# syncbyte      8 bit	0x47
1006# error_ind     1 bit	-
1007# payload_start 1 bit	1
1008# priority      1 bit	-
1009# PID          13 bit	0x0000
1010# scrambling    2 bit	-
1011# adaptfld_ctrl 2 bit	1 or 3
1012# conti_count   4 bit	-
10130	belong&0xFF5FFF10	0x47400010
1014>188	byte			0x47		MPEG transport stream data
1015
1016# DIF digital video file format <mpruett@sgi.com>
10170	belong&0xffffff00	0x1f070000      DIF
1018>4	byte			&0x01		(DVCPRO) movie file
1019>4	byte			^0x01		(DV) movie file
1020>3	byte			&0x80		(PAL)
1021>3	byte			^0x80		(NTSC)
1022
1023# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com>
10240	belong			0x3026b275	Microsoft ASF
1025!:mime  video/x-ms-asf
1026
1027# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
10280	string			\x8aMNG		MNG video data,
1029!:mime	video/x-mng
1030>4	belong			!0x0d0a1a0a	CORRUPTED,
1031>4	belong			0x0d0a1a0a
1032>>16    belong	x				%ld x
1033>>20    belong	x				%ld
1034
1035# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
10360	string			\x8bJNG		JNG video data,
1037!:mime	video/x-jng
1038>4	belong			!0x0d0a1a0a	CORRUPTED,
1039>4	belong			0x0d0a1a0a
1040>>16    belong	x				%ld x
1041>>20    belong	x				%ld
1042
1043# Vivo video (Wolfram Kleff)
10443	string		\x0D\x0AVersion:Vivo	Vivo video data
1045
1046# VRML (Virtual Reality Modelling Language)
10470       string/w        #VRML\ V1.0\ ascii	VRML 1 file
1048!:mime	model/vrml
10490	string/w	#VRML\ V2.0\ utf8	ISO/IEC 14772 VRML 97 file
1050!:mime	model/vrml
1051
1052# X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd]
1053# From Michel Briand <michelbriand@free.fr>
10540	string/t		\<?xml\ version="
1055!:strength +1
1056>20	search/1000/cw  \<!DOCTYPE\ X3D		X3D (Extensible 3D) model xml text
1057!:mime model/x3d
1058
1059#---------------------------------------------------------------------------
1060# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
1061# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03
1062#
10630	string		HVQM4		%s
1064>6	string		>\0		v%s
1065>0	byte		x		GameCube movie,
1066>0x34	ubeshort	x		%d x
1067>0x36	ubeshort	x		%d,
1068>0x26	ubeshort	x		%dus,
1069>0x42	ubeshort	0		no audio
1070>0x42	ubeshort	>0		%dHz audio
1071
1072# From: "Stefan A. Haubenthal" <polluks@web.de>
10730	string		DVDVIDEO-VTS	Video title set,
1074>0x21	byte		x		v%x
10750	string		DVDVIDEO-VMG	Video manager,
1076>0x21	byte		x		v%x
1077
1078# From: Behan Webster <behanw@websterwood.com>
1079# NuppelVideo used by Mythtv (*.nuv)
1080# Note: there are two identical stanzas here differing only in the
1081# initial string matched. It used to be done with a regex, but we're
1082# trying to get rid of those.
10830	string		NuppelVideo	MythTV NuppelVideo
1084>12	string		x		v%s
1085>20	lelong		x		(%d
1086>24	lelong		x		\bx%d),
1087>36	string		P		\bprogressive,
1088>36	string		I		\binterlaced,
1089>40	ledouble	x		\baspect:%.2f,
1090>48	ledouble	x		\bfps:%.2f
10910	string		MythTV		MythTV NuppelVideo
1092>12	string		x		v%s
1093>20	lelong		x		(%d
1094>24	lelong		x		\bx%d),
1095>36	string		P		\bprogressive,
1096>36	string		I		\binterlaced,
1097>40	ledouble	x		\baspect:%.2f,
1098>48	ledouble	x		\bfps:%.2f
1099
1100#						MPEG file
1101# MPEG sequences
1102# FIXME: This section is from the old magic.mime file and needs integrating with the rest
11030       belong             0x000001BA
1104>4      byte               &0x40
1105!:mime	video/mp2p
1106>4      byte               ^0x40
1107!:mime	video/mpeg
11080       belong             0x000001BB
1109!:mime	video/mpeg
11100       belong             0x000001B0
1111!:mime	video/mp4v-es
11120       belong             0x000001B5
1113!:mime	video/mp4v-es
11140       belong             0x000001B3
1115!:mime	video/mpv
11160       belong&0xFF5FFF1F  0x47400010
1117!:mime	video/mp2t
11180       belong             0x00000001
1119>4      byte&0x1F	   0x07
1120!:mime	video/h264
1121
1122# Type: Bink Video
1123# Extension: .bik
1124# URL:  http://wiki.multimedia.cx/index.php?title=Bink_Container
1125# From: <hoehle@users.sourceforge.net>  2008-07-18
11260	string		BIK	Bink Video
1127>3	regex		=[a-z]	rev.%s
1128#>4	ulelong		x	size %d
1129>20	ulelong		x	\b, %d
1130>24	ulelong		x	\bx%d
1131>8	ulelong		x	\b, %d frames
1132>32	ulelong		x	at rate %d/
1133>28	ulelong		>1	\b%d
1134>40	ulelong		=0	\b, no audio
1135>40	ulelong		!0	\b, %d audio track
1136>>40	ulelong		!1	\bs
1137# follow properties of the first audio track only
1138>>48	uleshort	x	%dHz
1139>>51	byte&0x20	0	mono
1140>>51	byte&0x20	!0	stereo
1141#>>51	byte&0x10	0	FFT
1142#>>51	byte&0x10	!0	DCT
1143
1144# Type:	NUT Container
1145# URL:	http://wiki.multimedia.cx/index.php?title=NUT
1146# From:	Adam Buchbinder <adam.buchbinder@gmail.com>
11470	string	nut/multimedia\ container\0	NUT multimedia container
1148
1149# Type: Nullsoft Video (NSV)
1150# URL:  http://wiki.multimedia.cx/index.php?title=Nullsoft_Video
1151# From: Mike Melanson <mike@multimedia.cx>
11520	string	NSVf	Nullsoft Video
1153
1154# Type: REDCode Video
1155# URL:  http://www.red.com/ ; http://wiki.multimedia.cx/index.php?title=REDCode
1156# From: Mike Melanson <mike@multimedia.cx>
11574	string	RED1	REDCode Video
1158
1159# Type: MTV Multimedia File
1160# URL:  http://wiki.multimedia.cx/index.php?title=MTV
1161# From: Mike Melanson <mike@multimedia.cx>
11620	string	AMVS	MTV Multimedia File
1163
1164# Type: ARMovie
1165# URL:  http://wiki.multimedia.cx/index.php?title=ARMovie
1166# From: Mike Melanson <mike@multimedia.cx>
11670	string	ARMovie\012	ARMovie
1168
1169# Type: Interplay MVE Movie
1170# URL:  http://wiki.multimedia.cx/index.php?title=Interplay_MVE
1171# From: Mike Melanson <mike@multimedia.cx>
11720	string	Interplay\040MVE\040File\032	Interplay MVE Movie
1173
1174# Type: Windows Television DVR File
1175# URL:  http://wiki.multimedia.cx/index.php?title=WTV
1176# From: Mike Melanson <mike@mutlimedia.cx>
1177# This takes the form of a Windows-style GUID
11780	bequad	0xB7D800203749DA11
1179>8	bequad	0xA64E0007E95EAD8D	Windows Television DVR Media
1180
1181# Type: Sega FILM/CPK Multimedia
1182# URL:  http://wiki.multimedia.cx/index.php?title=Sega_FILM
1183# From: Mike Melanson <mike@multimedia.cx>
11840	string	FILM	Sega FILM/CPK Multimedia,
1185>32	belong	x	%d x
1186>28	belong	x	%d
1187
1188# Type: Nintendo THP Multimedia
1189# URL:  http://wiki.multimedia.cx/index.php?title=THP
1190# From: Mike Melanson <mike@multimedia.cx>
11910	string	THP\0	Nintendo THP Multimedia
1192
1193# Type: BBC Dirac Video
1194# URL:  http://wiki.multimedia.cx/index.php?title=Dirac
1195# From: Mike Melanson <mike@multimedia.cx>
11960	string	BBCD	BBC Dirac Video
1197
1198# Type: RAD Game Tools Smacker Multimedia
1199# URL:  http://wiki.multimedia.cx/index.php?title=Smacker
1200# From: Mike Melanson <mike@multimedia.cx>
12010	string	SMK	RAD Game Tools Smacker Multimedia
1202>3	byte	x	version %c,
1203>4	lelong	x	%d x
1204>8	lelong	x	%d,
1205>12	lelong	x	%d frames
1206
1207#------------------------------------------------------------------------------
1208# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $
1209# aout:  file(1) magic for a.out executable/object/etc entries that
1210# handle executables on multiple platforms.
1211#
1212
1213#
1214# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from
1215# BSDI), netbsd, and vax (for UNIX/32V and BSD)
1216#
1217# XXX - is there anything we can look at to distinguish BSD/OS 386 from
1218# NetBSD 386 from various VAX binaries?  The BSD/OS shared library flag
1219# works only for binaries using shared libraries.  Grabbing the entry
1220# point from the a.out header, using it to find the first code executed
1221# in the program, and looking at that might help.
1222#
12230	lelong		0407		a.out little-endian 32-bit executable
1224>16	lelong		>0		not stripped
1225>32	byte		0x6a		(uses BSD/OS shared libs)
1226
12270	lelong		0410		a.out little-endian 32-bit pure executable
1228>16	lelong		>0		not stripped
1229>32	byte		0x6a		(uses BSD/OS shared libs)
1230
12310	lelong		0413		a.out little-endian 32-bit demand paged pure executable
1232>16	lelong		>0		not stripped
1233>32	byte		0x6a		(uses BSD/OS shared libs)
1234
1235#
1236# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out),
1237# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out).
1238#
1239# XXX - is there anything we can look at to distinguish old SunOS 68010
1240# from old 68020 IRIX from old NetBSD?  Again, I guess we could look at
1241# the first instruction or instructions in the program.
1242#
12430	belong		0407		a.out big-endian 32-bit executable
1244>16	belong		>0		not stripped
1245
12460	belong		0410		a.out big-endian 32-bit pure executable
1247>16	belong		>0		not stripped
1248
12490	belong		0413		a.out big-endian 32-bit demand paged executable
1250>16	belong		>0		not stripped
1251
1252
1253#------------------------------------------------------------------------------
1254# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $
1255# apl:  file(1) magic for APL (see also "pdp" and "vax" for other APL
1256#       workspaces)
1257#
12580	long		0100554		APL workspace (Ken's original?)
1259
1260#------------------------------------------------------------------------------
1261# $File: apple,v 1.27 2013/03/09 22:36:00 christos Exp $
1262# apple:  file(1) magic for Apple file formats
1263#
12640	search/1/t	FiLeStArTfIlEsTaRt	binscii (apple ][) text
12650	string		\x0aGL			Binary II (apple ][) data
12660	string		\x76\xff		Squeezed (apple ][) data
12670	string		NuFile			NuFile archive (apple ][) data
12680	string		N\xf5F\xe9l\xe5		NuFile archive (apple ][) data
12690	belong		0x00051600		AppleSingle encoded Macintosh file
12700	belong		0x00051607		AppleDouble encoded Macintosh file
1271
1272# Type: Apple Emulator 2IMG format
1273# From: Radek Vokal <rvokal@redhat.com>
12740	string		2IMG	Apple ][ 2IMG Disk Image
1275>4	string		XGS!	\b, XGS
1276>4	string		CTKG	\b, Catakig
1277>4	string		ShIm	\b, Sheppy's ImageMaker
1278>4	string		WOOF	\b, Sweet 16
1279>4	string		B2TR	\b, Bernie ][ the Rescue
1280>4	string		!nfc	\b, ASIMOV2
1281>4	string		x	\b, Unknown Format
1282>0xc	byte		00	\b, DOS 3.3 sector order
1283>>0x10	byte		00	\b, Volume 254
1284>>0x10	byte&0x7f	x	\b, Volume %u
1285>0xc	byte		01	\b, ProDOS sector order
1286>>0x14	short		x	\b, %u Blocks
1287>0xc	byte		02	\b, NIB data
1288
1289# magic for Newton PDA package formats
1290# from Ruda Moura <ruda@helllabs.org>
12910	string	package0	Newton package, NOS 1.x,
1292>12	belong	&0x80000000	AutoRemove,
1293>12	belong	&0x40000000	CopyProtect,
1294>12	belong	&0x10000000	NoCompression,
1295>12	belong	&0x04000000	Relocation,
1296>12	belong	&0x02000000	UseFasterCompression,
1297>16	belong	x		version %d
1298
12990	string	package1	Newton package, NOS 2.x,
1300>12	belong	&0x80000000	AutoRemove,
1301>12	belong	&0x40000000	CopyProtect,
1302>12	belong	&0x10000000	NoCompression,
1303>12	belong	&0x04000000	Relocation,
1304>12	belong	&0x02000000	UseFasterCompression,
1305>16	belong	x		version %d
1306
13070	string	package4	Newton package,
1308>8	byte	8		NOS 1.x,
1309>8	byte	9		NOS 2.x,
1310>12	belong	&0x80000000	AutoRemove,
1311>12	belong	&0x40000000	CopyProtect,
1312>12	belong	&0x10000000	NoCompression,
1313
1314# The following entries for the Apple II are for files that have
1315# been transferred as raw binary data from an Apple, without having
1316# been encapsulated by any of the above archivers.
1317#
1318# In general, Apple II formats are hard to identify because Apple DOS
1319# and especially Apple ProDOS have strong typing in the file system and
1320# therefore programmers never felt much need to include type information
1321# in the files themselves.
1322#
1323# Eric Fischer <enf@pobox.com>
1324
1325# AppleWorks word processor:
1326#
1327# This matches the standard tab stops for an AppleWorks file, but if
1328# a file has a tab stop set in the first four columns this will fail.
1329#
1330# The "O" is really the magic number, but that's so common that it's
1331# necessary to check the tab stops that follow it to avoid false positives.
1332
13334       string          O====   AppleWorks word processor data
1334>85     byte&0x01       >0      \b, zoomed
1335>90     byte&0x01       >0      \b, paginated
1336>92     byte&0x01       >0      \b, with mail merge
1337#>91    byte            x       \b, left margin %d
1338
1339# AppleWorks database:
1340#
1341# This isn't really a magic number, but it's the closest thing to one
1342# that I could find.  The 1 and 2 really mean "order in which you defined
1343# categories" and "left to right, top to bottom," respectively; the D and R
1344# mean that the cursor should move either down or right when you press Return.
1345
1346#30	string		\x01D	AppleWorks database data
1347#30	string		\x02D	AppleWorks database data
1348#30	string		\x01R	AppleWorks database data
1349#30	string		\x02R	AppleWorks database data
1350
1351# AppleWorks spreadsheet:
1352#
1353# Likewise, this isn't really meant as a magic number.  The R or C means
1354# row- or column-order recalculation; the A or M means automatic or manual
1355# recalculation.
1356
1357#131	string		RA	AppleWorks spreadsheet data
1358#131	string		RM	AppleWorks spreadsheet data
1359#131	string		CA	AppleWorks spreadsheet data
1360#131	string		CM	AppleWorks spreadsheet data
1361
1362# Applesoft BASIC:
1363#
1364# This is incredibly sloppy, but will be true if the program was
1365# written at its usual memory location of 2048 and its first line
1366# number is less than 256.  Yuck.
1367# update by Joerg Jenderek at Feb 2013
1368
1369# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
1370#0       belong&0xff00ff 0x80000 Applesoft BASIC program data
13710	belong&0x00ff00ff	0x00080000
1372# assuming that line number must be positive
1373>2	leshort			>0		Applesoft BASIC program data, first line number %d
1374#>2     leshort         x       \b, first line number %d
1375
1376# ORCA/EZ assembler:
1377#
1378# This will not identify ORCA/M source files, since those have
1379# some sort of date code instead of the two zero bytes at 6 and 7
1380# XXX Conflicts with ELF
1381#4       belong&0xff00ffff       0x01000000      ORCA/EZ assembler source data
1382#>5      byte                    x               \b, build number %d
1383
1384# Broderbund Fantavision
1385#
1386# I don't know what these values really mean, but they seem to recur.
1387# Will they cause too many conflicts?
1388
1389# Probably :-)
1390#2	belong&0xFF00FF		0x040008	Fantavision movie data
1391
1392# Some attempts at images.
1393#
1394# These are actually just bit-for-bit dumps of the frame buffer, so
1395# there's really no reasonably way to distinguish them except for their
1396# address (if preserved) -- 8192 or 16384 -- and their length -- 8192
1397# or, occasionally, 8184.
1398#
1399# Nevertheless this will manage to catch a lot of images that happen
1400# to have a solid-colored line at the bottom of the screen.
1401
1402# GRR: Magic too weak
1403#8144	string	\x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F	Apple II image with white background
1404#8144	string	\x55\x2A\x55\x2A\x55\x2A\x55\x2A	Apple II image with purple background
1405#8144	string	\x2A\x55\x2A\x55\x2A\x55\x2A\x55	Apple II image with green background
1406#8144	string	\xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA	Apple II image with blue background
1407#8144	string	\xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5	Apple II image with orange background
1408
1409# Beagle Bros. Apple Mechanic fonts
1410
14110	belong&0xFF00FFFF	0x6400D000	Apple Mechanic font
1412
1413# Apple Universal Disk Image Format (UDIF) - dmg files.
1414# From Johan Gade.
1415# These entries are disabled for now until we fix the following issues.
1416#
1417# Note there might be some problems with the "VAX COFF executable"
1418# entry. Note this entry should be placed before the mac filesystem section,
1419# particularly the "Apple Partition data" entry.
1420#
1421# The intended meaning of these tests is, that the file is only of the
1422# specified type if both of the lines are correct - i.e. if the first
1423# line matches and the second doesn't then it is not of that type.
1424#
1425#0	long	0x7801730d
1426#>4	long	0x62626060	UDIF read-only zlib-compressed image (UDZO)
1427#
1428# Note that this entry is recognized correctly by the "Apple Partition
1429# data" entry - however since this entry is more specific - this
1430# information seems to be more useful.
1431#0	long	0x45520200
1432#>0x410	string	disk\ image	UDIF read/write image (UDRW)
1433
1434# From: Toby Peterson <toby@apple.com>
14350	string	bplist00	Apple binary property list
1436
1437# Apple binary property list (bplist)
1438#  Assumes version bytes are hex.
1439#  Provides content hints for version 0 files. Assumes that the root
1440#  object is the first object (true for CoreFoundation implementation).
1441# From: David Remahl <dremahl@apple.com>
14420		string	bplist
1443>6		byte	x	\bCoreFoundation binary property list data, version 0x%c
1444>>7		byte	x	\b%c
1445>6		string		00		\b
1446>>8		byte&0xF0	0x00	\b
1447>>>8	byte&0x0F	0x00	\b, root type: null
1448>>>8	byte&0x0F	0x08	\b, root type: false boolean
1449>>>8	byte&0x0F	0x09	\b, root type: true boolean
1450>>8		byte&0xF0	0x10	\b, root type: integer
1451>>8		byte&0xF0	0x20	\b, root type: real
1452>>8		byte&0xF0	0x30	\b, root type: date
1453>>8		byte&0xF0	0x40    \b, root type: data
1454>>8		byte&0xF0	0x50	\b, root type: ascii string
1455>>8		byte&0xF0	0x60	\b, root type: unicode string
1456>>8		byte&0xF0	0x80	\b, root type: uid (CORRUPT)
1457>>8		byte&0xF0	0xa0	\b, root type: array
1458>>8		byte&0xF0	0xd0	\b, root type: dictionary
1459
1460# Apple/NeXT typedstream data
1461#  Serialization format used by NeXT and Apple for various
1462#  purposes in YellowStep/Cocoa, including some nib files.
1463# From: David Remahl <dremahl@apple.com>
14642		string		typedstream	NeXT/Apple typedstream data, big endian
1465>0		byte		x		\b, version %hhd
1466>0		byte		<5		\b
1467>>13	byte		0x81	\b
1468>>>14	ubeshort	x		\b, system %hd
14692		string		streamtyped NeXT/Apple typedstream data, little endian
1470>0		byte		x		\b, version %hhd
1471>0		byte		<5		\b
1472>>13	byte		0x81	\b
1473>>>14	uleshort	x		\b, system %hd
1474
1475#------------------------------------------------------------------------------
1476# CAF: Apple CoreAudio File Format
1477#
1478# Container format for high-end audio purposes.
1479# From: David Remahl <dremahl@apple.com>
1480#
14810	string		caff		CoreAudio Format audio file
1482>4	beshort		<10		version %d
1483>6	beshort		x
1484
1485
1486#------------------------------------------------------------------------------
1487# Keychain database files
14880	string		kych		Mac OS X Keychain File
1489
1490#------------------------------------------------------------------------------
1491# Code Signing related file types
14920	belong		0xfade0c00	Mac OS X Code Requirement
1493>8	belong		1			(opExpr)
1494>4	belong		x			- %d bytes
1495
14960	belong		0xfade0c01	Mac OS X Code Requirement Set
1497>8	belong		>1			containing %d items
1498>4	belong		x			- %d bytes
1499
15000	belong		0xfade0c02	Mac OS X Code Directory
1501>8	belong		x			version %x
1502>12	belong		>0			flags 0x%x
1503>4	belong		x			- %d bytes
1504
15050	belong		0xfade0cc0	Mac OS X Detached Code Signature (non-executable)
1506>4	belong		x			- %d bytes
1507
15080	belong		0xfade0cc1	Mac OS X Detached Code Signature
1509>8	belong		>1			(%d elements)
1510>4	belong		x			- %d bytes
1511
1512# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
1513# .vdi
15144	string innotek\ VirtualBox\ Disk\ Image %s
1515
1516# Apple disk partition stuff, strengthen the magic using byte 4
15170	beshort	0x4552
1518>4	byte	0			Apple Driver Map
1519>>2	beshort	x			\b, blocksize %d
1520>>4	belong	x			\b, blockcount %d
1521>>10	beshort	x			\b, devtype %d
1522>>12	beshort	x			\b, devid %d
1523>>20	beshort x			\b, descriptors %d
1524# Assume 	8 partitions each at a multiple of the sector size.
1525# We could glean this from the partition descriptors, but they are empty!?!?
1526>>(2.S*1)	indirect		\b, contains[@0x%x]:
1527>>(2.S*2)	indirect		\b, contains[@0x%x]:
1528>>(2.S*3)	indirect		\b, contains[@0x%x]:
1529>>(2.S*4)	indirect		\b, contains[@0x%x]:
1530>>(2.S*5)	indirect		\b, contains[@0x%x]:
1531>>(2.S*6)	indirect		\b, contains[@0x%x]:
1532>>(2.S*7)	indirect		\b, contains[@0x%x]:
1533>>(2.S*8)	indirect		\b, contains[@0x%x]:
1534
1535# Yes, the 3rd and 4th bytes are reserved, but we use them to make the
1536# magic stronger.
15370	belong	0x504d0000		Apple Partition Map
1538>4	belong	x			\b, map block count %d
1539>8	belong	x			\b, start block %d
1540>12	belong	x			\b, block count %d
1541>16	string >0			\b, name %s
1542>48	string >0			\b, type %s
1543>124	string >0			\b, processor %s
1544>140	string >0			\b, boot arguments %s
1545>92	belong	& 1			\b, valid
1546>92	belong	& 2			\b, allocated
1547>92	belong	& 4			\b, in use
1548>92	belong	& 8			\b, has boot info
1549>92	belong	& 16			\b, readable
1550>92	belong	& 32			\b, writable
1551>92	belong	& 64			\b, pic boot code
1552>92	belong	& 128			\b, chain compatible driver
1553>92	belong	& 256			\b, real driver
1554>92	belong	& 512			\b, chain driver
1555>92	belong	& 1024			\b, mount at startup
1556>92	belong	& 2048			\b, is the startup partition
1557
1558#http://wiki.mozilla.org/DS_Store_File_Format`
1559#http://en.wikipedia.org/wiki/.DS_Store
15600	string	\0\0\0\1Bud1\0		Apple Desktop Services Store
1561
1562#------------------------------------------------------------------------------
1563# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $
1564# applix:  file(1) magic for Applixware
1565# From: Peter Soos <sp@osb.hu>
1566#
15670	string		*BEGIN		Applixware
1568>7	string		WORDS			Words Document
1569>7	string		GRAPHICS		Graphic
1570>7	string		RASTER			Bitmap
1571>7	string		SPREADSHEETS		Spreadsheet
1572>7	string		MACRO			Macro
1573>7	string		BUILDER			Builder Object
1574#------------------------------------------------------------------------------
1575# $File: archive,v 1.79 2013/02/08 17:24:06 christos Exp $
1576# archive:  file(1) magic for archive formats (see also "msdos" for self-
1577#           extracting compressed archives)
1578#
1579# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
1580# pre-POSIX "tar" archives are handled in the C code.
1581
1582# POSIX tar archives
1583257	string		ustar\0		POSIX tar archive
1584!:mime	application/x-tar # encoding: posix
1585257	string		ustar\040\040\0	GNU tar archive
1586!:mime	application/x-tar # encoding: gnu
1587
1588# Incremental snapshot gnu-tar format from:
1589# http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
15900	string		GNU\ tar-	GNU tar incremental snapshot data
1591>&0	regex		[0-9]\.[0-9]+-[0-9]+	version %s
1592
1593# cpio archives
1594#
1595# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
1596# The idea is to indicate archives produced on machines with the same
1597# byte order as the machine running "file" with "cpio archive", and
1598# to indicate archives produced on machines with the opposite byte order
1599# from the machine running "file" with "byte-swapped cpio archive".
1600#
1601# The SVR4 "cpio(4)" hints that there are additional formats, but they
1602# are defined as "short"s; I think all the new formats are
1603# character-header formats and thus are strings, not numbers.
16040	short		070707		cpio archive
1605!:mime	application/x-cpio
16060	short		0143561		byte-swapped cpio archive
1607!:mime	application/x-cpio # encoding: swapped
16080	string		070707		ASCII cpio archive (pre-SVR4 or odc)
16090	string		070701		ASCII cpio archive (SVR4 with no CRC)
16100	string		070702		ASCII cpio archive (SVR4 with CRC)
1611
1612#
1613# Various archive formats used by various versions of the "ar"
1614# command.
1615#
1616
1617#
1618# Original UNIX archive formats.
1619# They were written with binary values in host byte order, and
1620# the magic number was a host "int", which might have been 16 bits
1621# or 32 bits.  We don't say "PDP-11" or "VAX", as there might have
1622# been ports to little-endian 16-bit-int or 32-bit-int platforms
1623# (x86?) using some of those formats; if none existed, feel free
1624# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian
1625# 32-bit.  There might have been big-endian ports of that sort as
1626# well.
1627#
16280	leshort		0177555		very old 16-bit-int little-endian archive
16290	beshort		0177555		very old 16-bit-int big-endian archive
16300	lelong		0177555		very old 32-bit-int little-endian archive
16310	belong		0177555		very old 32-bit-int big-endian archive
1632
16330	leshort		0177545		old 16-bit-int little-endian archive
1634>2	string		__.SYMDEF	random library
16350	beshort		0177545		old 16-bit-int big-endian archive
1636>2	string		__.SYMDEF	random library
16370	lelong		0177545		old 32-bit-int little-endian archive
1638>4	string		__.SYMDEF	random library
16390	belong		0177545		old 32-bit-int big-endian archive
1640>4	string		__.SYMDEF	random library
1641
1642#
1643# From "pdp" (but why a 4-byte quantity?)
1644#
16450	lelong		0x39bed		PDP-11 old archive
16460	lelong		0x39bee		PDP-11 4.0 archive
1647
1648#
1649# XXX - what flavor of APL used this, and was it a variant of
1650# some ar archive format?  It's similar to, but not the same
1651# as, the APL workspace magic numbers in pdp.
1652#
16530	long		0100554		apl workspace
1654
1655#
1656# System V Release 1 portable(?) archive format.
1657#
16580	string		=<ar>		System V Release 1 ar archive
1659!:mime	application/x-archive
1660
1661#
1662# Debian package; it's in the portable archive format, and needs to go
1663# before the entry for regular portable archives, as it's recognized as
1664# a portable archive whose first member has a name beginning with
1665# "debian".
1666#
16670	string		=!<arch>\ndebian
1668!:mime	application/x-debian-package
1669>8	string		debian-split	part of multipart Debian package
1670>8	string		debian-binary	Debian binary package
1671>8	string		!debian
1672>68	string		>\0		(format %s)
1673# These next two lines do not work, because a bzip2 Debian archive
1674# still uses gzip for the control.tar (first in the archive).  Only
1675# data.tar varies, and the location of its filename varies too.
1676# file/libmagic does not current have support for ascii-string based
1677# (offsets) as of 2005-09-15.
1678#>81	string		bz2		\b, uses bzip2 compression
1679#>84	string		gz		\b, uses gzip compression
1680#>136	ledate		x		created: %s
1681
1682#
1683# MIPS archive; they're in the portable archive format, and need to go
1684# before the entry for regular portable archives, as it's recognized as
1685# a portable archive whose first member has a name beginning with
1686# "__________E".
1687#
16880	string	=!<arch>\n__________E	MIPS archive
1689!:mime	application/x-archive
1690>20	string	U			with MIPS Ucode members
1691>21	string	L			with MIPSEL members
1692>21	string	B			with MIPSEB members
1693>19	string	L			and an EL hash table
1694>19	string	B			and an EB hash table
1695>22	string	X			-- out of date
1696
16970	search/1	-h-		Software Tools format archive text
1698
1699#
1700# BSD/SVR2-and-later portable archive formats.
1701#
17020	string		=!<arch>		current ar archive
1703!:mime	application/x-archive
1704>8	string		__.SYMDEF	random library
1705>68	string		__.SYMDEF\ SORTED	random library
1706
1707#
1708# "Thin" archive, as can be produced by GNU ar.
1709#
17100	string		=!<thin>\n	thin archive with
1711>68	belong		0		no symbol entries
1712>68	belong		1		%d symbol entry
1713>68	belong		>1		%d symbol entries
1714
1715# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
1716#
1717# The first byte is the magic (0x1a), byte 2 is the compression type for
1718# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
1719# filename of the first file (null terminated).  Since some types collide
1720# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
1721# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%).  0x01 collides with terminfo.
17220	lelong&0x8080ffff	0x0000081a	ARC archive data, dynamic LZW
1723!:mime	application/x-arc
17240	lelong&0x8080ffff	0x0000091a	ARC archive data, squashed
1725!:mime	application/x-arc
17260	lelong&0x8080ffff	0x0000021a	ARC archive data, uncompressed
1727!:mime	application/x-arc
17280	lelong&0x8080ffff	0x0000031a	ARC archive data, packed
1729!:mime	application/x-arc
17300	lelong&0x8080ffff	0x0000041a	ARC archive data, squeezed
1731!:mime	application/x-arc
17320	lelong&0x8080ffff	0x0000061a	ARC archive data, crunched
1733!:mime	application/x-arc
1734# [JW] stuff taken from idarc, obviously ARC successors:
17350	lelong&0x8080ffff	0x00000a1a	PAK archive data
1736!:mime	application/x-arc
17370	lelong&0x8080ffff	0x0000141a	ARC+ archive data
1738!:mime	application/x-arc
17390	lelong&0x8080ffff	0x0000481a	HYP archive data
1740!:mime	application/x-arc
1741
1742# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
1743# I can't create either SPARK or ArcFS archives so I have not tested this stuff
1744# [GRR:  the original entries collide with ARC, above; replaced with combined
1745#  version (not tested)]
1746#0	byte		0x1a		RISC OS archive (spark format)
17470	string		\032archive	RISC OS archive (ArcFS format)
17480       string          Archive\000     RISC OS archive (ArcFS format)
1749
1750# All these were taken from idarc, many could not be verified. Unfortunately,
1751# there were many low-quality sigs, i.e. easy to trigger false positives.
1752# Please notify me of any real-world fishy/ambiguous signatures and I'll try
1753# to get my hands on the actual archiver and see if I find something better. [JW]
1754# probably many can be enhanced by finding some 0-byte or control char near the start
1755
1756# idarc calls this Crush/Uncompressed... *shrug*
17570	string	CRUSH Crush archive data
1758# Squeeze It (.sqz)
17590	string	HLSQZ Squeeze It archive data
1760# SQWEZ
17610	string	SQWEZ SQWEZ archive data
1762# HPack (.hpk)
17630	string	HPAK HPack archive data
1764# HAP
17650	string	\x91\x33HF HAP archive data
1766# MD/MDCD
17670	string	MDmd MDCD archive data
1768# LIM
17690	string	LIM\x1a LIM archive data
1770# SAR
17713	string	LH5 SAR archive data
1772# BSArc/BS2
17730	string	\212\3SB\020\0	BSArc/BS2 archive data
1774# Bethesda Softworks Archive (Oblivion)
17750	string	BSA\0 		BSArc archive data
1776>4	lelong	x		version %d
1777# MAR
17782	string	=-ah MAR archive data
1779# ACB
1780#0	belong&0x00f800ff	0x00800000 ACB archive data
1781# CPZ
1782# TODO, this is what idarc says: 0	string	\0\0\0 CPZ archive data
1783# JRC
17840	string	JRchive JRC archive data
1785# Quantum
17860	string	DS\0 Quantum archive data
1787# ReSOF
17880	string	PK\3\6 ReSOF archive data
1789# QuArk
17900	string	7\4 QuArk archive data
1791# YAC
179214	string	YC YAC archive data
1793# X1
17940	string	X1 X1 archive data
17950	string	XhDr X1 archive data
1796# CDC Codec (.dqt)
17970	belong&0xffffe000	0x76ff2000 CDC Codec archive data
1798# AMGC
17990	string	\xad6" AMGC archive data
1800# NuLIB
18010	string	N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data
1802# PakLeo
18030	string	LEOLZW PAKLeo archive data
1804# ChArc
18050	string	SChF ChArc archive data
1806# PSA
18070	string	PSA PSA archive data
1808# CrossePAC
18090	string	DSIGDCC CrossePAC archive data
1810# Freeze
18110	string	\x1f\x9f\x4a\x10\x0a Freeze archive data
1812# KBoom
18130	string	\xc2\xa8MP\xc2\xa8 KBoom archive data
1814# NSQ, must go after CDC Codec
18150	string	\x76\xff NSQ archive data
1816# DPA
18170	string	Dirk\ Paehl DPA archive data
1818# BA
1819# TODO: idarc says "bytes 0-2 == bytes 3-5"
1820# TTComp
18210	string	\0\6 TTComp archive data
1822# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
18230	string	ESP ESP archive data
1824# ZPack
18250	string	\1ZPK\1 ZPack archive data
1826# Sky
18270	string	\xbc\x40 Sky archive data
1828# UFA
18290	string	UFA UFA archive data
1830# Dry
18310	string	=-H2O DRY archive data
1832# FoxSQZ
18330	string	FOXSQZ FoxSQZ archive data
1834# AR7
18350	string	,AR7 AR7 archive data
1836# PPMZ
18370	string	PPMZ PPMZ archive data
1838# MS Compress
18394	string	\x88\xf0\x27 MS Compress archive data
1840# updated by Joerg Jenderek
1841>9	string	\0
1842>>0	string	KWAJ
1843>>>7	string	\321\003	MS Compress archive data
1844>>>>14	ulong	>0		\b, original size: %ld bytes
1845>>>>18		ubyte	>0x65
1846>>>>>18		string	x       \b, was %.8s
1847>>>>>(10.b-4)	string	x       \b.%.3s
1848# MP3 (archiver, not lossy audio compression)
18490	string	MP3\x1a MP3-Archiver archive data
1850# ZET
18510	string	OZ\xc3\x9d ZET archive data
1852# TSComp
18530	string	\x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
1854# ARQ
18550	string	gW\4\1 ARQ archive data
1856# Squash
18573	string	OctSqu Squash archive data
1858# Terse
18590	string	\5\1\1\0 Terse archive data
1860# PUCrunch
18610	string	\x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
1862# UHarc
18630	string	UHA UHarc archive data
1864# ABComp
18650	string	\2AB ABComp archive data
18660	string	\3AB2 ABComp archive data
1867# CMP
18680	string	CO\0 CMP archive data
1869# Splint
18700	string	\x93\xb9\x06 Splint archive data
1871# InstallShield
18720	string	\x13\x5d\x65\x8c InstallShield Z archive Data
1873# Gather
18741	string	GTH Gather archive data
1875# BOA
18760	string	BOA BOA archive data
1877# RAX
18780	string	ULEB\xa RAX archive data
1879# Xtreme
18800	string	ULEB\0 Xtreme archive data
1881# Pack Magic
18820	string	@\xc3\xa2\1\0 Pack Magic archive data
1883# BTS
18840	belong&0xfeffffff	0x1a034465 BTS archive data
1885# ELI 5750
18860	string	Ora\  ELI 5750 archive data
1887# QFC
18880	string	\x1aFC\x1a QFC archive data
18890	string	\x1aQF\x1a QFC archive data
1890# PRO-PACK
18910	string	RNC PRO-PACK archive data
1892# 777
18930	string	777 777 archive data
1894# LZS221
18950	string	sTaC LZS221 archive data
1896# HPA
18970	string	HPA HPA archive data
1898# Arhangel
18990	string	LG Arhangel archive data
1900# EXP1, uses bzip2
19010	string	0123456789012345BZh EXP1 archive data
1902# IMP
19030	string	IMP\xa IMP archive data
1904# NRV
19050	string	\x00\x9E\x6E\x72\x76\xFF NRV archive data
1906# Squish
19070	string	\x73\xb2\x90\xf4 Squish archive data
1908# Par
19090	string	PHILIPP Par archive data
19100	string	PAR Par archive data
1911# HIT
19120	string	UB HIT archive data
1913# SBX
19140	belong&0xfffff000	0x53423000 SBX archive data
1915# NaShrink
19160	string	NSK NaShrink archive data
1917# SAPCAR
19180	string	#\ CAR\ archive\ header SAPCAR archive data
19190	string	CAR\ 2.00RG SAPCAR archive data
1920# Disintegrator
19210	string	DST Disintegrator archive data
1922# ASD
19230	string	ASD ASD archive data
1924# InstallShield CAB
19250	string	ISc( InstallShield CAB
1926# TOP4
19270	string	T4\x1a TOP4 archive data
1928# BatComp left out: sig looks like COM executable
1929# so TODO: get real 4dos batcomp file and find sig
1930# BlakHole
19310	string	BH\5\7 BlakHole archive data
1932# BIX
19330	string	BIX0 BIX archive data
1934# ChiefLZA
19350	string	ChfLZ ChiefLZA archive data
1936# Blink
19370	string	Blink Blink archive data
1938# Logitech Compress
19390	string	\xda\xfa Logitech Compress archive data
1940# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
19411	string	(C)\ STEPANYUK ARS-Sfx archive data
1942# AKT/AKT32
19430	string	AKT32 AKT32 archive data
19440	string	AKT AKT archive data
1945# NPack
19460	string	MSTSM NPack archive data
1947# PFT
19480	string	\0\x50\0\x14 PFT archive data
1949# SemOne
19500	string	SEM SemOne archive data
1951# PPMD
19520	string	\x8f\xaf\xac\x84 PPMD archive data
1953# FIZ
19540	string	FIZ FIZ archive data
1955# MSXiE
19560	belong&0xfffff0f0	0x4d530000 MSXiE archive data
1957# DeepFreezer
19580	belong&0xfffffff0	0x797a3030 DeepFreezer archive data
1959# DC
19600	string	=<DC- DC archive data
1961# TPac
19620	string	\4TPAC\3 TPac archive data
1963# Ai
19640	string	Ai\1\1\0 Ai archive data
19650	string	Ai\1\0\0 Ai archive data
1966# Ai32
19670	string	Ai\2\0 Ai32 archive data
19680	string	Ai\2\1 Ai32 archive data
1969# SBC
19700	string	SBC SBC archive data
1971# Ybs
19720	string	YBS Ybs archive data
1973# DitPack
19740	string	\x9e\0\0 DitPack archive data
1975# DMS
19760	string	DMS! DMS archive data
1977# EPC
19780	string	\x8f\xaf\xac\x8c EPC archive data
1979# VSARC
19800	string	VS\x1a VSARC archive data
1981# PDZ
19820	string	PDZ PDZ archive data
1983# ReDuq
19840	string	rdqx ReDuq archive data
1985# GCA
19860	string	GCAX GCA archive data
1987# PPMN
19880	string	pN PPMN archive data
1989# WinImage
19903	string	WINIMAGE WinImage archive data
1991# Compressia
19920	string	CMP0CMP Compressia archive data
1993# UHBC
19940	string	UHB UHBC archive data
1995# WinHKI
19960	string	\x61\x5C\x04\x05 WinHKI archive data
1997# WWPack data file
19980	string	WWP WWPack archive data
1999# BSN (BSA, PTS-DOS)
20000	string	\xffBSG BSN archive data
20011	string	\xffBSG BSN archive data
20023	string	\xffBSG BSN archive data
20031	string	\0\xae\2 BSN archive data
20041	string	\0\xae\3 BSN archive data
20051	string	\0\xae\7 BSN archive data
2006# AIN
20070	string	\x33\x18 AIN archive data
20080	string	\x33\x17 AIN archive data
2009# XPA32
20100	string	xpa\0\1 XPA32 archive data
2011# SZip (TODO: doesn't catch all versions)
20120	string	SZ\x0a\4 SZip archive data
2013# XPack DiskImage
20140	string	jm XPack DiskImage archive data
2015# XPack Data
20160	string	xpa XPack archive data
2017# XPack Single Data
20180	string	\xc3\x8d\ jm XPack single archive data
2019
2020# TODO: missing due to unknown magic/magic at end of file:
2021#DWC
2022#ARG
2023#ZAR
2024#PC/3270
2025#InstallIt
2026#RKive
2027#RK
2028#XPack Diskimage
2029
2030# These were inspired by idarc, but actually verified
2031# Dzip archiver (.dz)
20320	string	DZ Dzip archive data
2033>2	byte	x \b, version %i
2034>3	byte	x \b.%i
2035# ZZip archiver (.zz)
20360	string	ZZ\ \0\0 ZZip archive data
20370	string	ZZ0 ZZip archive data
2038# PAQ archiver (.paq)
20390	string	\xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
20400	string	PAQ PAQ archive data
2041>3	byte&0xf0	0x30
2042>>3	byte	x (v%c)
2043# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
20440xe	string	\x1aJar\x1b JAR (ARJ Software, Inc.) archive data
20450	string	JARCS JAR (ARJ Software, Inc.) archive data
2046
2047# ARJ archiver (jason@jarthur.Claremont.EDU)
20480	leshort		0xea60		ARJ archive data
2049!:mime	application/x-arj
2050>5	byte		x		\b, v%d,
2051>8	byte		&0x04		multi-volume,
2052>8	byte		&0x10		slash-switched,
2053>8	byte		&0x20		backup,
2054>34	string		x		original name: %s,
2055>7	byte		0		os: MS-DOS
2056>7	byte		1		os: PRIMOS
2057>7	byte		2		os: Unix
2058>7	byte		3		os: Amiga
2059>7	byte		4		os: Macintosh
2060>7	byte		5		os: OS/2
2061>7	byte		6		os: Apple ][ GS
2062>7	byte		7		os: Atari ST
2063>7	byte		8		os: NeXT
2064>7	byte		9		os: VAX/VMS
2065>3	byte		>0		%d]
2066# [JW] idarc says this is also possible
20672	leshort		0xea60		ARJ archive data
2068
2069# HA archiver (Greg Roelofs, newt@uchicago.edu)
2070# This is a really bad format. A file containing HAWAII will match this...
2071#0	string		HA		HA archive data,
2072#>2	leshort		=1		1 file,
2073#>2	leshort		>1		%u files,
2074#>4	byte&0x0f	=0		first is type CPY
2075#>4	byte&0x0f	=1		first is type ASC
2076#>4	byte&0x0f	=2		first is type HSC
2077#>4	byte&0x0f	=0x0e		first is type DIR
2078#>4	byte&0x0f	=0x0f		first is type SPECIAL
2079# suggestion: at least identify small archives (<1024 files)
20800  belong&0xffff00fc 0x48410000 HA archive data
2081>2	leshort		=1		1 file,
2082>2	leshort		>1		%u files,
2083>4	byte&0x0f	=0		first is type CPY
2084>4	byte&0x0f	=1		first is type ASC
2085>4	byte&0x0f	=2		first is type HSC
2086>4	byte&0x0f	=0x0e		first is type DIR
2087>4	byte&0x0f	=0x0f		first is type SPECIAL
2088
2089# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
20900	string		HPAK		HPACK archive data
2091
2092# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
20930	string		\351,\001JAM\ 		JAM archive,
2094>7	string		>\0			version %.4s
2095>0x26	byte		=0x27			-
2096>>0x2b	string          >\0			label %.11s,
2097>>0x27	lelong		x			serial %08x,
2098>>0x36	string		>\0			fstype %.8s
2099
2100# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
21012	string		-lh0-		LHarc 1.x/ARX archive data [lh0]
2102!:mime	application/x-lharc
21032	string		-lh1-		LHarc 1.x/ARX archive data [lh1]
2104!:mime	application/x-lharc
21052	string		-lz4-		LHarc 1.x archive data [lz4]
2106!:mime	application/x-lharc
21072	string		-lz5-		LHarc 1.x archive data [lz5]
2108!:mime	application/x-lharc
2109#	[never seen any but the last; -lh4- reported in comp.compression:]
21102	string		-lzs-		LHa/LZS archive data [lzs]
2111!:mime	application/x-lha
21122	string		-lh\40-		LHa 2.x? archive data [lh ]
2113!:mime	application/x-lha
21142	string		-lhd-		LHa 2.x? archive data [lhd]
2115!:mime	application/x-lha
21162	string		-lh2-		LHa 2.x? archive data [lh2]
2117!:mime	application/x-lha
21182	string		-lh3-		LHa 2.x? archive data [lh3]
2119!:mime	application/x-lha
21202	string		-lh4-		LHa (2.x) archive data [lh4]
2121!:mime	application/x-lha
21222	string		-lh5-		LHa (2.x) archive data [lh5]
2123!:mime	application/x-lha
21242	string		-lh6-		LHa (2.x) archive data [lh6]
2125!:mime	application/x-lha
21262	string		-lh7-		LHa (2.x)/LHark archive data [lh7]
2127!:mime	application/x-lha
2128>20	byte		x		- header level %d
2129# taken from idarc [JW]
21302   string      -lZ         PUT archive data
21312   string      -lz         LZS archive data
21322   string      -sw1-       Swag archive data
2133
2134# RAR archiver (Greg Roelofs, newt@uchicago.edu)
21350	string		Rar!		RAR archive data,
2136!:mime	application/x-rar
2137>44	byte		x		v%0x,
2138>10	byte		>0		flags:
2139>>10	byte		&0x01		Archive volume,
2140>>10	byte		&0x02		Commented,
2141>>10	byte		&0x04		Locked,
2142>>10	byte		&0x08		Solid,
2143>>10	byte		&0x20		Authenticated,
2144>35	byte		0		os: MS-DOS
2145>35	byte		1		os: OS/2
2146>35	byte		2		os: Win32
2147>35	byte		3		os: Unix
2148# some old version? idarc says:
21490   string      RE\x7e\x5e  RAR archive data
2150
2151# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
21520	string		SQSH		squished archive data (Acorn RISCOS)
2153
2154# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
2155# [JW] see exe section for self-extracting version
21560	string		UC2\x1a		UC2 archive data
2157
2158# PKZIP multi-volume archive
21590	string		PK\x07\x08PK\x03\x04	Zip multi-volume archive data, at least PKZIP v2.50 to extract
2160!:mime	application/zip
2161
2162# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
21630	string		PK\005\006	Zip archive data (empty)
21640	string		PK\003\004
2165
2166# Specialised zip formats which start with a member named 'mimetype'
2167# (stored uncompressed, with no 'extra field') containing the file's MIME type.
2168# Check for have 8-byte name, 0-byte extra field, name "mimetype", and
2169#  contents starting with "application/":
2170>26	string		\x8\0\0\0mimetypeapplication/
2171
2172#  KOffice / OpenOffice & StarOffice / OpenDocument formats
2173#    From: Abel Cheung <abel@oaka.org>
2174
2175#   KOffice (1.2 or above) formats
2176#    (mimetype contains "application/vnd.kde.<SUBTYPE>")
2177>>50	string	vnd.kde.		KOffice (>=1.2)
2178>>>58	string	karbon			Karbon document
2179>>>58	string	kchart			KChart document
2180>>>58	string	kformula		KFormula document
2181>>>58	string	kivio			Kivio document
2182>>>58	string	kontour			Kontour document
2183>>>58	string	kpresenter		KPresenter document
2184>>>58	string	kspread			KSpread document
2185>>>58	string	kword			KWord document
2186
2187#   OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
2188#    (mimetype contains "application/vnd.sun.xml.<SUBTYPE>")
2189>>50	string	vnd.sun.xml.		OpenOffice.org 1.x
2190>>>62	string	writer			Writer
2191>>>>68	byte	!0x2e			document
2192>>>>68	string	.template		template
2193>>>>68	string	.global			global document
2194>>>62	string	calc			Calc
2195>>>>66	byte	!0x2e			spreadsheet
2196>>>>66	string	.template		template
2197>>>62	string	draw			Draw
2198>>>>66	byte	!0x2e			document
2199>>>>66	string	.template		template
2200>>>62	string	impress			Impress
2201>>>>69	byte	!0x2e			presentation
2202>>>>69	string	.template		template
2203>>>62	string	math			Math document
2204>>>62	string	base			Database file
2205
2206#   OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
2207#    http://lists.oasis-open.org/archives/office/200505/msg00006.html
2208#    (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>")
2209>>50	string	vnd.oasis.opendocument.	OpenDocument
2210>>>73	string	text
2211>>>>77	byte	!0x2d			Text
2212!:mime	application/vnd.oasis.opendocument.text
2213>>>>77	string	-template		Text Template
2214!:mime	application/vnd.oasis.opendocument.text-template
2215>>>>77	string	-web			HTML Document Template
2216!:mime	application/vnd.oasis.opendocument.text-web
2217>>>>77	string	-master			Master Document
2218!:mime	application/vnd.oasis.opendocument.text-master
2219>>>73	string	graphics
2220>>>>81	byte	!0x2d			Drawing
2221!:mime	application/vnd.oasis.opendocument.graphics
2222>>>>81	string	-template		Template
2223!:mime	application/vnd.oasis.opendocument.graphics-template
2224>>>73	string	presentation
2225>>>>85	byte	!0x2d			Presentation
2226!:mime	application/vnd.oasis.opendocument.presentation
2227>>>>85	string	-template		Template
2228!:mime	application/vnd.oasis.opendocument.presentation-template
2229>>>73	string	spreadsheet
2230>>>>84	byte	!0x2d			Spreadsheet
2231!:mime	application/vnd.oasis.opendocument.spreadsheet
2232>>>>84	string	-template		Template
2233!:mime	application/vnd.oasis.opendocument.spreadsheet-template
2234>>>73	string	chart
2235>>>>78	byte	!0x2d			Chart
2236!:mime	application/vnd.oasis.opendocument.chart
2237>>>>78	string	-template		Template
2238!:mime	application/vnd.oasis.opendocument.chart-template
2239>>>73	string	formula
2240>>>>80	byte	!0x2d			Formula
2241!:mime	application/vnd.oasis.opendocument.formula
2242>>>>80	string	-template		Template
2243!:mime	application/vnd.oasis.opendocument.formula-template
2244>>>73	string	database		Database
2245!:mime	application/vnd.oasis.opendocument.database
2246>>>73	string	image
2247>>>>78	byte	!0x2d			Image
2248!:mime	application/vnd.oasis.opendocument.image
2249>>>>78	string	-template		Template
2250!:mime	application/vnd.oasis.opendocument.image-template
2251
2252#  EPUB (OEBPS) books using OCF (OEBPS Container Format)
2253#    http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4.
2254#    From: Ralf Brown <ralf.brown@gmail.com>
2255>0x1E	string	mimetypeapplication/epub+zip	EPUB document
2256!:mime application/epub+zip
2257
2258#  Catch other ZIP-with-mimetype formats
2259#	In a ZIP file, the bytes immediately after a member's contents are
2260#	always "PK". The 2 regex rules here print the "mimetype" member's
2261#	contents up to the first 'P'. Luckily, most MIME types don't contain
2262#	any capital 'P's. This is a kludge.
2263#    (mimetype contains "application/<OTHER>")
2264>>50		string	!epub+zip
2265>>>50		string	!vnd.oasis.opendocument.
2266>>>>50		string	!vnd.sun.xml.
2267>>>>>50		string	!vnd.kde.
2268>>>>>>38	regex	[!-OQ-~]+		Zip data (MIME type "%s"?)
2269!:mime	application/zip
2270#    (mimetype contents other than "application/*")
2271>26		string	\x8\0\0\0mimetype
2272>>38		string	!application/
2273>>>38		regex	[!-OQ-~]+		Zip data (MIME type "%s"?)
2274!:mime	application/zip
2275
2276# Java Jar files
2277>(26.s+30)	leshort	0xcafe		Java Jar file data (zip)
2278!:mime	application/jar
2279
2280# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
2281#   Next line excludes specialized formats:
2282>(26.s+30)	leshort	!0xcafe
2283>>26    string          !\x8\0\0\0mimetype	Zip archive data
2284!:mime	application/zip
2285>>>4	byte		0x09		\b, at least v0.9 to extract
2286>>>4	byte		0x0a		\b, at least v1.0 to extract
2287>>>4	byte		0x0b		\b, at least v1.1 to extract
2288>>>4	byte		0x14		\b, at least v2.0 to extract
2289>>>4	byte		0x2d		\b, at least v3.0 to extract
2290>>>0x161	string		WINZIP		\b, WinZIP self-extracting
2291
2292# StarView Metafile
2293# From Pierre Ducroquet <pinaraf@pinaraf.info>
22940	string	VCLMTF	StarView MetaFile
2295>6	beshort	x	\b, version %d
2296>8	belong	x	\b, size %d
2297
2298# Zoo archiver
229920	lelong		0xfdc4a7dc	Zoo archive data
2300!:mime	application/x-zoo
2301>4	byte		>48		\b, v%c.
2302>>6	byte		>47		\b%c
2303>>>7	byte		>47		\b%c
2304>32	byte		>0		\b, modify: v%d
2305>>33	byte		x		\b.%d+
2306>42	lelong		0xfdc4a7dc	\b,
2307>>70	byte		>0		extract: v%d
2308>>>71	byte		x		\b.%d+
2309
2310# Shell archives
231110	string		#\ This\ is\ a\ shell\ archive	shell archive text
2312!:mime	application/octet-stream
2313
2314#
2315# LBR. NB: May conflict with the questionable
2316#          "binary Computer Graphics Metafile" format.
2317#
23180       string  \0\ \ \ \ \ \ \ \ \ \ \ \0\0    LBR archive data
2319#
2320# PMA (CP/M derivative of LHA)
2321#
23222       string          -pm0-           PMarc archive data [pm0]
23232       string          -pm1-           PMarc archive data [pm1]
23242       string          -pm2-           PMarc archive data [pm2]
23252       string          -pms-           PMarc SFX archive (CP/M, DOS)
23265       string          -pc1-           PopCom compressed executable (CP/M)
2327
2328# From Rafael Laboissiere <rafael@laboissiere.net>
2329# The Project Revision Control System (see
2330# http://prcs.sourceforge.net) generates a packaged project
2331# file which is recognized by the following entry:
23320	leshort		0xeb81	PRCS packaged project
2333
2334# Microsoft cabinets
2335# by David Necas (Yeti) <yeti@physics.muni.cz>
2336#0	string	MSCF\0\0\0\0	Microsoft cabinet file data,
2337#>25	byte	x		v%d
2338#>24	byte	x		\b.%d
2339# MPi: All CABs have version 1.3, so this is pointless.
2340# Better magic in debian-additions.
2341
2342# GTKtalog catalogs
2343# by David Necas (Yeti) <yeti@physics.muni.cz>
23444	string	gtktalog\ 	GTKtalog catalog data,
2345>13	string	3		version 3
2346>>14	beshort	0x677a		(gzipped)
2347>>14	beshort	!0x677a		(not gzipped)
2348>13	string	>3		version %s
2349
2350############################################################################
2351# Parity archive reconstruction file, the 'par' file format now used on Usenet.
23520       string          PAR\0	PARity archive data
2353>48	leshort		=0	- Index file
2354>48	leshort		>0	- file number %d
2355
2356# Felix von Leitner <felix-file@fefe.de>
23570	string	d8:announce	BitTorrent file
2358!:mime	application/x-bittorrent
2359
2360# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
23610	beshort 0x0e0f		Atari MSA archive data
2362>2	beshort x		\b, %d sectors per track
2363>4	beshort 0		\b, 1 sided
2364>4	beshort 1		\b, 2 sided
2365>6	beshort x		\b, starting track: %d
2366>8	beshort x		\b, ending track: %d
2367
2368# Alternate ZIP string (amc@arwen.cs.berkeley.edu)
23690	string	PK00PK\003\004	Zip archive data
2370
2371# ACE archive (from http://www.wotsit.org/download.asp?f=ace)
2372# by Stefan `Sec` Zehl <sec@42.org>
23737	string		**ACE**		ACE archive data
2374>15	byte	>0		version %d
2375>16	byte	=0x00		\b, from MS-DOS
2376>16	byte	=0x01		\b, from OS/2
2377>16	byte	=0x02		\b, from Win/32
2378>16	byte	=0x03		\b, from Unix
2379>16	byte	=0x04		\b, from MacOS
2380>16	byte	=0x05		\b, from WinNT
2381>16	byte	=0x06		\b, from Primos
2382>16	byte	=0x07		\b, from AppleGS
2383>16	byte	=0x08		\b, from Atari
2384>16	byte	=0x09		\b, from Vax/VMS
2385>16	byte	=0x0A		\b, from Amiga
2386>16	byte	=0x0B		\b, from Next
2387>14	byte	x		\b, version %d to extract
2388>5	leshort &0x0080		\b, multiple volumes,
2389>>17	byte	x		\b (part %d),
2390>5	leshort &0x0002		\b, contains comment
2391>5	leshort	&0x0200		\b, sfx
2392>5	leshort	&0x0400		\b, small dictionary
2393>5	leshort	&0x0800		\b, multi-volume
2394>5	leshort	&0x1000		\b, contains AV-String
2395>>30	string	\x16*UNREGISTERED\x20VERSION*	(unregistered)
2396>5	leshort &0x2000		\b, with recovery record
2397>5	leshort &0x4000		\b, locked
2398>5	leshort &0x8000		\b, solid
2399# Date in MS-DOS format (whatever that is)
2400#>18	lelong	x		Created on
2401
2402# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
2403# <doj@cubic.org>
24040x1A	string	sfArk		sfArk compressed Soundfont
2405>0x15	string	2
2406>>0x1	string	>\0		Version %s
2407>>0x2A	string	>\0		: %s
2408
2409# DR-DOS 7.03 Packed File *.??_
24100	string	Packed\ File\ 	Personal NetWare Packed File
2411>12	string	x		\b, was "%.12s"
2412
2413# EET archive
2414# From: Tilman Sauerbeck <tilman@code-monkey.de>
24150	belong	0x1ee7ff00	EET archive
2416!:mime	application/x-eet
2417
2418# rzip archives
24190	string	RZIP		rzip compressed data
2420>4	byte	x		- version %d
2421>5	byte	x		\b.%d
2422>6	belong	x		(%d bytes)
2423
2424# From: "Robert Dale" <robdale@gmail.com>
24250	belong	123		dar archive,
2426>4	belong	x		label "%.8x
2427>>8	belong	x		%.8x
2428>>>12	beshort	x		%.4x"
2429>14	byte	0x54		end slice
2430>14	beshort	0x4e4e		multi-part
2431>14	beshort	0x4e53		multi-part, with -S
2432
2433# Symbian installation files
2434#  http://www.thouky.co.uk/software/psifs/sis.html
2435#  http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
24368	lelong	0x10000419	Symbian installation file
2437!:mime	application/vnd.symbian.install
2438>4	lelong	0x1000006D	(EPOC release 3/4/5)
2439>4	lelong	0x10003A12	(EPOC release 6)
24400	lelong	0x10201A7A	Symbian installation file (Symbian OS 9.x)
2441!:mime	x-epoc/x-sisx-app
2442
2443# From "Nelson A. de Oliveira" <naoliv@gmail.com>
24440	string	MPQ\032		MoPaQ (MPQ) archive
2445
2446# From: Dirk Jagdmann <doj@cubic.org>
2447# xar archive format: http://code.google.com/p/xar/
24480	string	xar!		xar archive
2449>6	beshort	x		- version %ld
2450
2451# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
2452# .kgb
24530	string KGB_arch		KGB Archiver file
2454>10	string x		with compression level %.1s
2455
2456# xar (eXtensible ARchiver) archive
2457# From: "David Remahl" <dremahl@apple.com>
24580	string	xar!		xar archive
2459#>4	beshort	x		header size %d
2460>6	beshort	x		version %d,
2461#>8	quad	x		compressed TOC: %d,
2462#>16	quad	x		uncompressed TOC: %d,
2463>24	belong	0		no checksum
2464>24	belong	1		SHA-1 checksum
2465>24	belong	2		MD5 checksum
2466
2467# Type: Parity Archive
2468# From: Daniel van Eeden <daniel_e@dds.nl>
24690	string	PAR2		Parity Archive Volume Set
2470
2471# Bacula volume format. (Volumes always start with a block header.)
2472# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html
2473# From: Adam Buchbinder <adam.buchbinder@gmail.com>
247412	string	BB02		Bacula volume
2475>20	bedate	x		\b, started %s
2476
2477# ePub is XHTML + XML inside a ZIP archive.  The first member of the
2478#   archive must be an uncompressed file called 'mimetype' with contents
2479#   'application/epub+zip'
2480
2481
2482# From: "Michael Gorny" <mgorny@gentoo.org>
2483# ZPAQ: http://mattmahoney.net/dc/zpaq.html
24840	string	zPQ	ZPAQ stream
2485>3	byte	x	\b, level %d
2486
2487# BBeB ebook, unencrypted (LRF format)
2488# URL: http://www.sven.de/librie/Librie/LrfFormat
2489# From: Adam Buchbinder <adam.buchbinder@gmail.com>
24900	string	L\0R\0F\0\0\0	BBeB ebook data, unencrypted
2491>8	beshort	x		\b, version %d
2492>36	byte	1		\b, front-to-back
2493>36	byte	16		\b, back-to-front
2494>42	beshort	x		\b, (%dx,
2495>44	beshort	x		%d)
2496#------------------------------------------------------------------------------
2497# $File: assembler,v 1.4 2013/01/04 23:31:11 christos Exp $
2498# make:  file(1) magic for assembler source
2499#
25000	regex	\^[\020\t]*\\.asciiz		assembler source text
2501!:mime	text/x-asm
25020	regex	\^[\020\t]*\\.byte		assembler source text
2503!:mime	text/x-asm
25040	regex	\^[\020\t]*\\.even		assembler source text
2505!:mime	text/x-asm
25060	regex	\^[\020\t]*\\.globl		assembler source text
2507!:mime	text/x-asm
25080	regex	\^[\020\t]*\\.text		assembler source text
2509!:mime	text/x-asm
25100	regex	\^[\020\t]*\\.file		assembler source text
2511!:mime	text/x-asm
25120	regex	\^[\020\t]*\\.type		assembler source text
2513!:mime	text/x-asm
2514
2515#------------------------------------------------------------------------------
2516# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $
2517# asterix:  file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
2518# strings as "long" - we assume they're just strings:
2519# From: guy@netapp.com (Guy Harris)
2520#
25210	string		*STA		Aster*x
2522>7	string		WORD			Words Document
2523>7	string		GRAP			Graphic
2524>7	string		SPRE			Spreadsheet
2525>7	string		MACR			Macro
25260	string		2278		Aster*x Version 2
2527>29	byte		0x36			Words Document
2528>29	byte		0x35			Graphic
2529>29	byte		0x32			Spreadsheet
2530>29	byte		0x38			Macro
2531
2532
2533#------------------------------------------------------------------------------
2534# $File: att3b,v 1.8 2009/09/19 16:28:08 christos Exp $
2535# att3b:  file(1) magic for AT&T 3B machines
2536#
2537# The `versions' should be un-commented if they work for you.
2538# (Was the problem just one of endianness?)
2539#
2540# 3B20
2541#
2542# The 3B20 conflicts with SCCS.
2543#0	beshort		0550		3b20 COFF executable
2544#>12	belong		>0		not stripped
2545#>22	beshort		>0		- version %ld
2546#0	beshort		0551		3b20 COFF executable (TV)
2547#>12	belong		>0		not stripped
2548#>22	beshort		>0		- version %ld
2549#
2550# WE32K
2551#
25520	beshort		0560		WE32000 COFF
2553>18	beshort		^00000020	object
2554>18	beshort		&00000020	executable
2555>12	belong		>0		not stripped
2556>18	beshort		^00010000	N/A on 3b2/300 w/paging
2557>18	beshort		&00020000	32100 required
2558>18	beshort		&00040000	and MAU hardware required
2559>20	beshort		0407		(impure)
2560>20	beshort		0410		(pure)
2561>20	beshort		0413		(demand paged)
2562>20	beshort		0443		(target shared library)
2563>22	beshort		>0		- version %ld
25640	beshort		0561		WE32000 COFF executable (TV)
2565>12	belong		>0		not stripped
2566#>18	beshort		&00020000	- 32100 required
2567#>18	beshort		&00040000	and MAU hardware required
2568#>22	beshort		>0		- version %ld
2569#
2570# core file for 3b2
25710	string		\000\004\036\212\200	3b2 core file
2572>364	string		>\0		of '%s'
2573
2574#------------------------------------------------------------------------------
2575# $File: audio,v 1.66 2013/02/06 14:18:52 christos Exp $
2576# audio:  file(1) magic for sound formats (see also "iff")
2577#
2578# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
2579# and others
2580#
2581
2582# Sun/NeXT audio data
25830	string		.snd		Sun/NeXT audio data:
2584>12	belong		1		8-bit ISDN mu-law,
2585!:mime	audio/basic
2586>12	belong		2		8-bit linear PCM [REF-PCM],
2587!:mime	audio/basic
2588>12	belong		3		16-bit linear PCM,
2589!:mime	audio/basic
2590>12	belong		4		24-bit linear PCM,
2591!:mime	audio/basic
2592>12	belong		5		32-bit linear PCM,
2593!:mime	audio/basic
2594>12	belong		6		32-bit IEEE floating point,
2595!:mime	audio/basic
2596>12	belong		7		64-bit IEEE floating point,
2597!:mime	audio/basic
2598>12	belong		8		Fragmented sample data,
2599>12	belong		10		DSP program,
2600>12	belong		11		8-bit fixed point,
2601>12	belong		12		16-bit fixed point,
2602>12	belong		13		24-bit fixed point,
2603>12	belong		14		32-bit fixed point,
2604>12	belong		18		16-bit linear with emphasis,
2605>12	belong		19		16-bit linear compressed,
2606>12	belong		20		16-bit linear with emphasis and compression,
2607>12	belong		21		Music kit DSP commands,
2608>12	belong		23		8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
2609!:mime  audio/x-adpcm
2610>12	belong		24		compressed (8-bit CCITT G.722 ADPCM)
2611>12	belong		25		compressed (3-bit CCITT G.723.3 ADPCM),
2612>12	belong		26		compressed (5-bit CCITT G.723.5 ADPCM),
2613>12	belong		27		8-bit A-law (CCITT G.711),
2614>20	belong		1		mono,
2615>20	belong		2		stereo,
2616>20	belong		4		quad,
2617>16	belong		>0		%d Hz
2618
2619# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
2620# that uses little-endian encoding and has a different magic number
26210	lelong		0x0064732E	DEC audio data:
2622>12	lelong		1		8-bit ISDN mu-law,
2623!:mime	audio/x-dec-basic
2624>12	lelong		2		8-bit linear PCM [REF-PCM],
2625!:mime	audio/x-dec-basic
2626>12	lelong		3		16-bit linear PCM,
2627!:mime	audio/x-dec-basic
2628>12	lelong		4		24-bit linear PCM,
2629!:mime	audio/x-dec-basic
2630>12	lelong		5		32-bit linear PCM,
2631!:mime	audio/x-dec-basic
2632>12	lelong		6		32-bit IEEE floating point,
2633!:mime	audio/x-dec-basic
2634>12	lelong		7		64-bit IEEE floating point,
2635!:mime	audio/x-dec-basic
2636>12	belong		8		Fragmented sample data,
2637>12	belong		10		DSP program,
2638>12	belong		11		8-bit fixed point,
2639>12	belong		12		16-bit fixed point,
2640>12	belong		13		24-bit fixed point,
2641>12	belong		14		32-bit fixed point,
2642>12	belong		18		16-bit linear with emphasis,
2643>12	belong		19		16-bit linear compressed,
2644>12	belong		20		16-bit linear with emphasis and compression,
2645>12	belong		21		Music kit DSP commands,
2646>12	lelong		23		8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
2647!:mime	audio/x-dec-basic
2648>12	belong		24		compressed (8-bit CCITT G.722 ADPCM)
2649>12	belong		25		compressed (3-bit CCITT G.723.3 ADPCM),
2650>12	belong		26		compressed (5-bit CCITT G.723.5 ADPCM),
2651>12	belong		27		8-bit A-law (CCITT G.711),
2652>20	lelong		1		mono,
2653>20	lelong		2		stereo,
2654>20	lelong		4		quad,
2655>16	lelong		>0		%d Hz
2656
2657# Creative Labs AUDIO stuff
26580	string	MThd			Standard MIDI data
2659!:mime	audio/midi
2660>8 	beshort	x			(format %d)
2661>10	beshort	x			using %d track
2662>10	beshort		>1		\bs
2663>12	beshort&0x7fff	x		at 1/%d
2664>12	beshort&0x8000	>0		SMPTE
2665
26660	string	CTMF			Creative Music (CMF) data
2667!:mime	audio/x-unknown
26680	string	SBI			SoundBlaster instrument data
2669!:mime	audio/x-unknown
26700	string	Creative\ Voice\ File	Creative Labs voice data
2671!:mime	audio/x-unknown
2672# is this next line right?  it came this way...
2673>19	byte	0x1A
2674>23	byte	>0			- version %d
2675>22	byte	>0			\b.%d
2676
2677# first entry is also the string "NTRK"
26780	belong		0x4e54524b	MultiTrack sound data
2679>4	belong		x		- version %ld
2680
2681# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
2682# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
26830	string		EMOD		Extended MOD sound data,
2684>4	byte&0xf0	x		version %d
2685>4	byte&0x0f	x		\b.%d,
2686>45	byte		x		%d instruments
2687>83	byte		0		(module)
2688>83	byte		1		(song)
2689
2690# Real Audio (Magic .ra\0375)
26910	belong		0x2e7261fd	RealAudio sound file
2692!:mime	audio/x-pn-realaudio
26930	string		.RMF\0\0\0	RealMedia file
2694!:mime	application/vnd.rn-realmedia
2695#video/x-pn-realvideo
2696#video/vnd.rn-realvideo
2697#application/vnd.rn-realmedia
2698#	sigh, there are many mimes for that but the above are the most common.
2699
2700# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
2701# Oct 31, 1995
2702# fixed by <doj@cubic.org> 2003-06-24
2703# Too short...
2704#0	string		MTM		MultiTracker Module sound file
2705#0	string		if		Composer 669 Module sound data
2706#0	string		JN		Composer 669 Module sound data (extended format)
27070	string		MAS_U		ULT(imate) Module sound data
2708
2709#0	string		FAR		Module sound data
2710#>4	string		>\15		Title: "%s"
2711
27120x2c	string		SCRM		ScreamTracker III Module sound data
2713>0	string		>\0		Title: "%s"
2714
2715# Gravis UltraSound patches
2716# From <ache@nagual.ru>
2717
27180	string		GF1PATCH110\0ID#000002\0	GUS patch
27190	string		GF1PATCH100\0ID#000002\0	Old GUS	patch
2720
2721# mime types according to http://www.geocities.com/nevilo/mod.htm:
2722#	audio/it	.it
2723#	audio/x-zipped-it	.itz
2724#	audio/xm	fasttracker modules
2725#	audio/x-s3m	screamtracker modules
2726#	audio/s3m	screamtracker modules
2727#	audio/x-zipped-mod	mdz
2728#	audio/mod	mod
2729#	audio/x-mod	All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z)
2730
2731#
2732# Taken from loader code from mikmod version 2.14
2733# by Steve McIntyre (stevem@chiark.greenend.org.uk)
2734# <doj@cubic.org> added title printing on 2003-06-24
27350	string	MAS_UTrack_V00
2736>14	string	>/0		ultratracker V1.%.1s module sound data
2737!:mime	audio/x-mod
2738#audio/x-tracker-module
2739
27400	string	UN05		MikMod UNI format module sound data
2741
27420	string	Extended\ Module: Fasttracker II module sound data
2743!:mime	audio/x-mod
2744#audio/x-tracker-module
2745>17	string	>\0		Title: "%s"
2746
274721	string/c	=!SCREAM!	Screamtracker 2 module sound data
2748!:mime	audio/x-mod
2749#audio/x-screamtracker-module
275021	string	BMOD2STM	Screamtracker 2 module sound data
2751!:mime	audio/x-mod
2752#audio/x-screamtracker-module
27531080	string	M.K.		4-channel Protracker module sound data
2754!:mime	audio/x-mod
2755#audio/x-protracker-module
2756>0	string	>\0		Title: "%s"
27571080	string	M!K!		4-channel Protracker module sound data
2758!:mime	audio/x-mod
2759#audio/x-protracker-module
2760>0	string	>\0		Title: "%s"
27611080	string	FLT4		4-channel Startracker module sound data
2762!:mime	audio/x-mod
2763#audio/x-startracker-module
2764>0	string	>\0		Title: "%s"
27651080	string	FLT8		8-channel Startracker module sound data
2766!:mime	audio/x-mod
2767#audio/x-startracker-module
2768>0	string	>\0		Title: "%s"
27691080	string	4CHN		4-channel Fasttracker module sound data
2770!:mime	audio/x-mod
2771#audio/x-fasttracker-module
2772>0	string	>\0		Title: "%s"
27731080	string	6CHN		6-channel Fasttracker module sound data
2774!:mime	audio/x-mod
2775#audio/x-fasttracker-module
2776>0	string	>\0		Title: "%s"
27771080	string	8CHN		8-channel Fasttracker module sound data
2778!:mime	audio/x-mod
2779#audio/x-fasttracker-module
2780>0	string	>\0		Title: "%s"
27811080	string	CD81		8-channel Octalyser module sound data
2782!:mime	audio/x-mod
2783#audio/x-octalysertracker-module
2784>0	string	>\0		Title: "%s"
27851080	string	OKTA		8-channel Octalyzer module sound data
2786!:mime	audio/x-mod
2787#audio/x-octalysertracker-module
2788>0	string	>\0		Title: "%s"
2789# Not good enough.
2790#1082	string	CH
2791#>1080	string	>/0		%.2s-channel Fasttracker "oktalyzer" module sound data
27921080	string	16CN		16-channel Taketracker module sound data
2793!:mime	audio/x-mod
2794#audio/x-taketracker-module
2795>0	string	>\0		Title: "%s"
27961080	string	32CN		32-channel Taketracker module sound data
2797!:mime	audio/x-mod
2798#audio/x-taketracker-module
2799>0	string	>\0		Title: "%s"
2800
2801# TOC sound files -Trevor Johnson <trevor@jpj.net>
2802#
28030       string          TOC             TOC sound file
2804
2805# sidfiles <pooka@iki.fi>
2806# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24
28070	string		SIDPLAY\ INFOFILE	Sidplay info file
2808
28090	string		PSID			PlaySID v2.2+ (AMIGA) sidtune
2810>4	beshort		>0			w/ header v%d,
2811>14	beshort		=1			single song,
2812>14	beshort		>1			%d songs,
2813>16	beshort		>0			default song: %d
2814>0x16	string		>\0			name: "%s"
2815>0x36	string		>\0			author: "%s"
2816>0x56	string		>\0			copyright: "%s"
2817
28180	string		RSID			RSID sidtune PlaySID compatible
2819>4	beshort		>0			w/ header v%d,
2820>14	beshort		=1			single song,
2821>14	beshort		>1			%d songs,
2822>16	beshort		>0			default song: %d
2823>0x16	string		>\0			name: "%s"
2824>0x36	string		>\0			author: "%s"
2825>0x56	string		>\0			copyright: "%s"
2826
2827# IRCAM sound files - Michael Pruett <michael@68k.org>
2828# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html
28290	belong		0x64a30100		IRCAM file (VAX little-endian)
28300	belong		0x0001a364		IRCAM file (VAX big-endian)
28310	belong		0x64a30200		IRCAM file (Sun big-endian)
28320	belong		0x0002a364		IRCAM file (Sun little-endian)
28330	belong		0x64a30300		IRCAM file (MIPS little-endian)
28340	belong		0x0003a364		IRCAM file (MIPS big-endian)
28350	belong		0x64a30400		IRCAM file (NeXT big-endian)
28360	belong		0x64a30400		IRCAM file (NeXT big-endian)
28370	belong		0x0004a364		IRCAM file (NeXT little-endian)
2838
2839# NIST SPHERE <mpruett@sgi.com>
28400	string		NIST_1A\n\ \ \ 1024\n	NIST SPHERE file
2841
2842# Sample Vision <mpruett@sgi.com>
28430	string		SOUND\ SAMPLE\ DATA\ 	Sample Vision file
2844
2845# Audio Visual Research <tonigonenstein@users.sourceforge.net>
28460	string		2BIT			Audio Visual Research file,
2847>12	beshort		=0			mono,
2848>12	beshort		=-1			stereo,
2849>14	beshort		x			%d bits
2850>16	beshort		=0			unsigned,
2851>16	beshort		=-1			signed,
2852>22	belong&0x00ffffff	x		%d Hz,
2853>18	beshort		=0			no loop,
2854>18	beshort		=-1			loop,
2855>21	ubyte		<128			note %d,
2856>22	byte		=0			replay 5.485 KHz
2857>22	byte		=1			replay 8.084 KHz
2858>22	byte		=2			replay 10.971 KHz
2859>22	byte		=3			replay 16.168 KHz
2860>22	byte		=4			replay 21.942 KHz
2861>22	byte		=5			replay 32.336 KHz
2862>22	byte		=6			replay 43.885 KHz
2863>22	byte		=7			replay 47.261 KHz
2864
2865# SGI SoundTrack <mpruett@sgi.com>
28660	string		_SGI_SoundTrack		SGI SoundTrack project file
2867# ID3 version 2 tags <waschk@informatik.uni-rostock.de>
28680	string		ID3	Audio file with ID3 version 2
2869>3	byte		x	\b.%d
2870>4	byte		x	\b.%d
2871>>5	byte		&0x80	\b, unsynchronized frames
2872>>5	byte		&0x40	\b, extended header
2873>>5	byte		&0x20	\b, experimental
2874>>5	byte		&0x10	\b, footer present
2875>(6.I)	indirect	x	\b, contains:
2876
2877# NSF (NES sound file) magic
28780	string		NESM\x1a	NES Sound File
2879>14	string		>\0		("%s" by
2880>46	string		>\0		%s, copyright
2881>78	string		>\0		%s),
2882>5	byte		x		version %d,
2883>6	byte		x		%d tracks,
2884>122	byte&0x2	=1		dual PAL/NTSC
2885>122	byte&0x1	=1		PAL
2886>122	byte&0x1	=0		NTSC
2887
2888# Type: SNES SPC700 sound files
2889# From: Josh Triplett <josh@freedesktop.org>
28900	string	SNES-SPC700\ Sound\ File\ Data\ v	SNES SPC700 sound file
2891>&0	string	0.30					\b, version %s
2892>>0x23	byte	0x1B					\b, without ID666 tag
2893>>0x23	byte	0x1A					\b, with ID666 tag
2894>>>0x2E	string	>\0					\b, song "%.32s"
2895>>>0x4E	string	>\0					\b, game "%.32s"
2896
2897# Impulse tracker module (audio/x-it)
28980	string		IMPM		Impulse Tracker module sound data -
2899!:mime	audio/x-mod
2900>4	string		>\0		"%s"
2901>40	leshort		!0		compatible w/ITv%x
2902>42	leshort		!0		created w/ITv%x
2903
2904# Imago Orpheus module (audio/x-imf)
290560	string		IM10		Imago Orpheus module sound data -
2906>0	string		>\0		"%s"
2907
2908# From <collver1@attbi.com>
2909# These are the /etc/magic entries to decode modules, instruments, and
2910# samples in Impulse Tracker's native format.
2911
29120	string		IMPS		Impulse Tracker Sample
2913>18	byte		&2		16 bit
2914>18	byte		^2		8 bit
2915>18	byte		&4		stereo
2916>18	byte		^4		mono
29170	string		IMPI		Impulse Tracker Instrument
2918>28	leshort		!0		ITv%x
2919>30	byte		!0		%d samples
2920
2921# Yamaha TX Wave:  file(1) magic for Yamaha TX Wave audio files
2922# From <collver1@attbi.com>
29230	string		LM8953		Yamaha TX Wave
2924>22	byte		0x49		looped
2925>22	byte		0xC9		non-looped
2926>23	byte		1		33kHz
2927>23	byte		2		50kHz
2928>23	byte		3		16kHz
2929
2930# scream tracker:  file(1) magic for Scream Tracker sample files
2931#
2932# From <collver1@attbi.com>
293376	string		SCRS		Scream Tracker Sample
2934>0	byte		1		sample
2935>0	byte		2		adlib melody
2936>0	byte		>2		adlib drum
2937>31	byte		&2		stereo
2938>31	byte		^2		mono
2939>31	byte		&4		16bit little endian
2940>31	byte		^4		8bit
2941>30	byte		0		unpacked
2942>30	byte		1		packed
2943
2944# audio
2945# From: Cory Dikkers <cdikkers@swbell.net>
29460	string		MMD0		MED music file, version 0
29470	string		MMD1		OctaMED Pro music file, version 1
29480	string		MMD3		OctaMED Soundstudio music file, version 3
29490	string		OctaMEDCmpr	OctaMED Soundstudio compressed file
29500	string		MED		MED_Song
29510	string		SymM		Symphonie SymMOD music file
2952#
29530	string		THX		AHX version
2954>3	byte		=0		1 module data
2955>3	byte		=1		2 module data
2956#
29570	string		OKTASONG	Oktalyzer module data
2958#
29590	string		DIGI\ Booster\ module\0	%s
2960>20	byte		>0		%c
2961>>21	byte		>0		\b%c
2962>>>22	byte		>0		\b%c
2963>>>>23	byte		>0		\b%c
2964>610	string		>\0		\b, "%s"
2965#
29660	string		DBM0	   	DIGI Booster Pro Module
2967>4	byte		>0		V%X.
2968>>5	byte		x		\b%02X
2969>16	string		>\0		\b, "%s"
2970#
29710	string		FTMN		FaceTheMusic module
2972>16	string		>\0d		\b, "%s"
2973
2974# From: <doj@cubic.org> 2003-06-24
29750	string		AMShdr\32	Velvet Studio AMS Module v2.2
29760	string		Extreme		Extreme Tracker AMS Module v1.3
29770	string		DDMF		Xtracker DMF Module
2978>4	byte		x		v%i
2979>0xD	string		>\0		Title: "%s"
2980>0x2B	string		>\0		Composer: "%s"
29810	string		DSM\32		Dynamic Studio Module DSM
29820	string		SONG		DigiTrekker DTM Module
29830	string		DMDL		DigiTrakker MDL Module
29840	string		PSM\32		Protracker Studio PSM Module
298544	string		PTMF		Poly Tracker PTM Module
2986>0	string		>\32		Title: "%s"
29870	string		MT20		MadTracker 2.0 Module MT2
29880	string		RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD
29890	string		RTMM		RTM Module
29900x426	string		MaDoKaN96	XMS Adlib Module
2991>0	string		>\0		Composer: "%s"
29920	string		AMF		AMF Module
2993>4	string		>\0		Title: "%s"
29940	string		MODINFO1	Open Cubic Player Module Inforation MDZ
29950	string		Extended\40Instrument: Fast Tracker II Instrument
2996
2997# From: Takeshi Hamasaki <hma@syd.odn.ne.jp>
2998# NOA Nancy Codec file
29990	string		\210NOA\015\012\032	NOA Nancy Codec Movie file
3000# Yamaha SMAF format
30010	string		MMMD		Yamaha SMAF file
3002# Sharp Jisaku Melody format for PDC
30030	string		\001Sharp\040JisakuMelody	SHARP Cell-Phone ringing Melody
3004>20	string		Ver01.00	Ver. 1.00
3005>>32	byte		x		, %d tracks
3006
3007# Free lossless audio codec <http://flac.sourceforge.net>
3008# From: Przemyslaw Augustyniak <silvathraec@rpg.pl>
30090	string			fLaC		FLAC audio bitstream data
3010!:mime	audio/x-flac
3011>4	byte&0x7f		>0		\b, unknown version
3012>4	byte&0x7f		0		\b
3013# some common bits/sample values
3014>>20	beshort&0x1f0		0x030		\b, 4 bit
3015>>20	beshort&0x1f0		0x050		\b, 6 bit
3016>>20	beshort&0x1f0		0x070		\b, 8 bit
3017>>20	beshort&0x1f0		0x0b0		\b, 12 bit
3018>>20	beshort&0x1f0		0x0f0		\b, 16 bit
3019>>20	beshort&0x1f0		0x170		\b, 24 bit
3020>>20	byte&0xe		0x0		\b, mono
3021>>20	byte&0xe		0x2		\b, stereo
3022>>20	byte&0xe		0x4		\b, 3 channels
3023>>20	byte&0xe		0x6		\b, 4 channels
3024>>20	byte&0xe		0x8		\b, 5 channels
3025>>20	byte&0xe		0xa		\b, 6 channels
3026>>20	byte&0xe		0xc		\b, 7 channels
3027>>20	byte&0xe		0xe		\b, 8 channels
3028# some common sample rates
3029>>17	belong&0xfffff0		0x0ac440	\b, 44.1 kHz
3030>>17	belong&0xfffff0		0x0bb800	\b, 48 kHz
3031>>17	belong&0xfffff0		0x07d000	\b, 32 kHz
3032>>17	belong&0xfffff0		0x056220	\b, 22.05 kHz
3033>>17	belong&0xfffff0		0x05dc00	\b, 24 kHz
3034>>17	belong&0xfffff0		0x03e800	\b, 16 kHz
3035>>17	belong&0xfffff0		0x02b110	\b, 11.025 kHz
3036>>17	belong&0xfffff0		0x02ee00	\b, 12 kHz
3037>>17	belong&0xfffff0		0x01f400	\b, 8 kHz
3038>>17	belong&0xfffff0		0x177000	\b, 96 kHz
3039>>17	belong&0xfffff0		0x0fa000	\b, 64 kHz
3040>>21	byte&0xf		>0		\b, >4G samples
3041>>21	byte&0xf		0		\b
3042>>>22	belong			>0		\b, %u samples
3043>>>22	belong			0		\b, length unknown
3044
3045# (ISDN) VBOX voice message file (Wolfram Kleff)
30460       string          VBOX            VBOX voice message data
3047
3048# ReBorn Song Files (.rbs)
3049# David J. Singer <doc@deadvirgins.org.uk>
30508       string          RB40             RBS Song file
3051>29     string          ReBorn           created by ReBorn
3052>37     string          Propellerhead    created by ReBirth
3053
3054# Synthesizer Generator and Kimwitu share their file format
30550	string		A#S#C#S#S#L#V#3	    Synthesizer Generator or Kimwitu data
3056# Kimwitu++ uses a slightly different magic
30570	string		A#S#C#S#S#L#HUB	    Kimwitu++ data
3058
3059# From "Simon Hosie
30600       string  TFMX-SONG       TFMX module sound data
3061
3062# Monkey's Audio compressed audio format (.ape)
3063# From danny.milo@gmx.net (Danny Milosavljevic)
3064# New version from Abel Cheung <abel (@) oaka.org>
30650		string		MAC\040		Monkey's Audio compressed format
3066!:mime audio/x-ape
3067>4		uleshort	>0x0F8B		version %d
3068>>(0x08.l)	uleshort	=1000		with fast compression
3069>>(0x08.l)	uleshort	=2000		with normal compression
3070>>(0x08.l)	uleshort	=3000		with high compression
3071>>(0x08.l)	uleshort	=4000		with extra high compression
3072>>(0x08.l)	uleshort	=5000		with insane compression
3073>>(0x08.l+18)	uleshort	=1		\b, mono
3074>>(0x08.l+18)	uleshort	=2		\b, stereo
3075>>(0x08.l+20)	ulelong		x		\b, sample rate %d
3076>4		uleshort	<0x0F8C		version %d
3077>>6		uleshort	=1000		with fast compression
3078>>6		uleshort	=2000		with normal compression
3079>>6		uleshort	=3000		with high compression
3080>>6		uleshort	=4000		with extra high compression
3081>>6		uleshort	=5000		with insane compression
3082>>10		uleshort	=1		\b, mono
3083>>10		uleshort	=2		\b, stereo
3084>>12		ulelong		x		\b, sample rate %d
3085
3086# adlib sound files
3087# From Gurkan Sengun <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu
30880    	string		RAWADATA	RdosPlay RAW
3089
30901068	string		RoR		AMUSIC Adlib Tracker
3091
30920	string		JCH		EdLib
3093
30940	string		mpu401tr	MPU-401 Trakker
3095
30960	string		SAdT		Surprise! Adlib Tracker
3097>4	byte		x		Version %d
3098
30990	string		XAD!		eXotic ADlib
3100
31010	string		ofTAZ!		eXtra Simple Music
3102
3103# Spectrum 128 tunes (.ay files).
3104# From: Emanuel Haupt <ehaupt@critical.ch>
31050	string		ZXAYEMUL	Spectrum 128 tune
3106
31070	string		\0BONK		BONK,
3108#>5	byte		x		version %d
3109>14	byte		x		%d channel(s),
3110>15	byte		=1		lossless,
3111>15	byte		=0		lossy,
3112>16	byte		x		mid-side
3113
3114384	string		LockStream	LockStream Embedded file (mostly MP3 on old Nokia phones)
3115
3116# format VQF (proprietary codec for sound)
3117# some infos on the header file available at :
3118# http://www.twinvq.org/english/technology_format.html
31190	string		TWIN97012000	VQF data
3120>27	short		0		\b, Mono
3121>27	short		1		\b, Stereo
3122>31	short 		>0		\b, %d kbit/s
3123>35	short 		>0		\b, %d kHz
3124
3125# Nelson A. de Oliveira (naoliv@gmail.com)
3126# .eqf
31270	string	Winamp\ EQ\ library\ file	%s
3128# it will match only versions like v<digit>.<digit>
3129# Since I saw only eqf files with version v1.1 I think that it's OK
3130>23	string	x	\b%.4s
3131# .preset
31320	string	[Equalizer\ preset]	XMMS equalizer preset
3133# .m3u
31340	search/1	#EXTM3U 	M3U playlist text
3135# .pls
31360	search/1	[playlist]	PLS playlist text
3137# licq.conf
31381	string	[licq]			LICQ configuration file
3139
3140# Atari ST audio files by Dirk Jagdmann <doj@cubic.org>
31410	string		ICE!		SNDH Atari ST music
31420	string		SC68\ Music-file\ /\ (c)\ (BeN)jami	sc68 Atari ST music
3143
3144# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com>
31450       string          MP+     Musepack audio
3146!:mime	audio/x-musepack
3147>3      byte            255     \b, SV pre8
3148>3      byte&0xF        0x6     \b, SV 6
3149>3      byte&0xF        0x8     \b, SV 8
3150>3      byte&0xF        0x7     \b, SV 7
3151>>3     byte&0xF0       0x0     \b.0
3152>>3     byte&0xF0       0x10    \b.1
3153>>3     byte&0xF0       240     \b.15
3154>>10    byte&0xF0       0x0     \b, no profile
3155>>10    byte&0xF0       0x10    \b, profile 'Unstable/Experimental'
3156>>10    byte&0xF0       0x50    \b, quality 0
3157>>10    byte&0xF0       0x60    \b, quality 1
3158>>10    byte&0xF0       0x70    \b, quality 2 (Telephone)
3159>>10    byte&0xF0       0x80    \b, quality 3 (Thumb)
3160>>10    byte&0xF0       0x90    \b, quality 4 (Radio)
3161>>10    byte&0xF0       0xA0    \b, quality 5 (Standard)
3162>>10    byte&0xF0       0xB0    \b, quality 6 (Xtreme)
3163>>10    byte&0xF0       0xC0    \b, quality 7 (Insane)
3164>>10    byte&0xF0       0xD0    \b, quality 8 (BrainDead)
3165>>10    byte&0xF0       0xE0    \b, quality 9
3166>>10    byte&0xF0       0xF0    \b, quality 10
3167>>27    byte            0x0     \b, Buschmann 1.7.0-9, Klemm 0.90-1.05
3168>>27    byte            102     \b, Beta 1.02
3169>>27    byte            104     \b, Beta 1.04
3170>>27    byte            105     \b, Alpha 1.05
3171>>27    byte            106     \b, Beta 1.06
3172>>27    byte            110     \b, Release 1.1
3173>>27    byte            111     \b, Alpha 1.11
3174>>27    byte            112     \b, Beta 1.12
3175>>27    byte            113     \b, Alpha 1.13
3176>>27    byte            114     \b, Beta 1.14
3177>>27    byte            115     \b, Alpha 1.15
3178
3179# IMY
3180# from http://filext.com/detaillist.php?extdetail=IMY
3181# http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm
3182# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html
3183# http://www.wx800.com/msg/download/irda/iMelody.pdf
31840	string	BEGIN:IMELODY	iMelody Ringtone Format
3185
3186# From: "Mateus Caruccio" <mateus@caruccio.com>
3187# guitar pro v3,4,5 from http://filext.com/file-extension/gp3
31880	string	\030FICHIER\ GUITAR\ PRO\ v3.	Guitar Pro Ver. 3 Tablature
3189
3190# From: "Leslie P. Polzer" <leslie.polzer@gmx.net>
319160	string	SONG		SoundFX Module sound file
3192
3193# Type: Adaptive Multi-Rate Codec
3194# URL:  http://filext.com/detaillist.php?extdetail=AMR
3195# From: Russell Coker <russell@coker.com.au>
31960	string	#!AMR		Adaptive Multi-Rate Codec (GSM telephony)
3197
3198# Type: SuperCollider 3 Synth Definition File Format
3199# From: Mario Lang <mlang@debian.org>
32000	string	SCgf	SuperCollider3 Synth Definition file,
3201>4	belong	x	version %d
3202
3203# Type: True Audio Lossless Audio
3204# URL:  http://wiki.multimedia.cx/index.php?title=True_Audio
3205# From: Mike Melanson <mike@multimedia.cx>
32060	string	TTA1	True Audio Lossless Audio
3207
3208# Type: WavPack Lossless Audio
3209# URL:  http://wiki.multimedia.cx/index.php?title=WavPack
3210# From: Mike Melanson <mike@multimedia.cx>
32110	string	wvpk	WavPack Lossless Audio
3212
3213#----------------------------------------------------------------
3214# $File: basis,v 1.4 2009/09/19 16:28:08 christos Exp $
3215# basis: file(1) magic for BBx/Pro5-files
3216#      Oliver Dammer <dammer@olida.de>	 2005/11/07
3217# http://www.basis.com business-basic-files.
3218#
32190	string		\074\074bbx\076\076	BBx
3220>7	string		\000			indexed file
3221>7	string		\001			serial file
3222>7	string		\002			keyed file
3223>>13	short		0			(sort)
3224>7	string		\004			program
3225>>18	byte		x			(LEVEL %d)
3226>>>23	string		>\000			psaved
3227>7	string		\006			mkeyed file
3228>>13	short		0			(sort)
3229>>8	string		\000			(mkey)
3230
3231#------------------------------------------------------------------------------
3232# $File: bflt,v 1.4 2009/09/19 16:28:08 christos Exp $
3233# bFLT: file(1) magic for BFLT uclinux binary files
3234#
3235# From Philippe De Muyter <phdm@macqel.be>
3236#
32370	string		bFLT		BFLT executable
3238>4	belong		x		- version %ld
3239>4	belong		4
3240>>36	belong&0x1	0x1		ram
3241>>36	belong&0x2	0x2		gotpic
3242>>36	belong&0x4	0x4		gzip
3243>>36	belong&0x8	0x8		gzdata
3244# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files
3245# http://ftg.lbl.gov/checkpoint
32460	string	C\0\0\0R\0\0\0	BLCR
3247>16	lelong	1	x86
3248>16	lelong	3	alpha
3249>16	lelong	5	x86-64
3250>16	lelong	7	ARM
3251>8	lelong	x	context data (little endian, version %d)
3252# Uncomment the following only of your "file" program supports "search"
3253#>0	search/1024	VMA\06	for kernel
3254#>>&1	byte	x	%d.
3255#>>&2	byte	x	%d.
3256#>>&3	byte	x	%d
32570	string	\0\0\0C\0\0\0R	BLCR
3258>16	belong	2	SPARC
3259>16	belong	4	ppc
3260>16	belong	6	ppc64
3261>16	belong	7	ARMEB
3262>16	belong	8	SPARC64
3263>8	belong	x	context data (big endian, version %d)
3264# Uncomment the following only of your "file" program supports "search"
3265#>0	search/1024	VMA\06	for kernel
3266#>>&1	byte	x	%d.
3267#>>&2	byte	x	\b%d.
3268#>>&3	byte	x	\b%d
3269
3270#------------------------------------------------------------------------------
3271# $File: blender,v 1.5 2009/09/19 16:28:08 christos Exp $
3272# blender: file(1) magic for Blender 3D related files
3273#
3274# Native format rule v1.2. For questions use the developers list
3275# http://lists.blender.org/mailman/listinfo/bf-committers
3276# GLOB chunk was moved near start and provides subversion info since 2.42
3277
32780		string	=BLENDER	Blender3D,
3279>7		string	=_		saved as 32-bits
3280>>8		string	=v		little endian
3281>>>9		byte	x		with version %c.
3282>>>10		byte	x		\b%c
3283>>>11		byte	x		\b%c
3284>>>0x40		string	=GLOB		\b.
3285>>>>0x58	leshort	x		\b%.4d
3286>>8		string	=V		big endian
3287>>>9		byte	x		with version %c.
3288>>>10		byte	x		\b%c
3289>>>11		byte	x		\b%c
3290>>>0x40		string	=GLOB		\b.
3291>>>>0x58	beshort	x		\b%.4d
3292>7		string	=-		saved as 64-bits
3293>>8		string	=v		little endian
3294>>9		byte	x		with version %c.
3295>>10		byte	x		\b%c
3296>>11		byte	x		\b%c
3297>>0x44		string	=GLOB		\b.
3298>>>0x60		leshort	x		\b%.4d
3299>>8		string	=V		big endian
3300>>>9		byte	x		with version %c.
3301>>>10		byte	x		\b%c
3302>>>11		byte	x		\b%c
3303>>>0x44		string	=GLOB		\b.
3304>>>>0x60	beshort	x		\b%.4d
3305
3306# Scripts that run in the embedded Python interpreter
33070		string	#!BPY		Blender3D BPython script
3308
3309#------------------------------------------------------------------------------
3310# $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $
3311# blit:  file(1) magic for 68K Blit stuff as seen from 680x0 machine
3312#
3313# Note that this 0407 conflicts with several other a.out formats...
3314#
3315# XXX - should this be redone with "be" and "le", so that it works on
3316# little-endian machines as well?  If so, what's the deal with
3317# "VAX-order" and "VAX-order2"?
3318#
3319#0	long		0407		68K Blit (standalone) executable
3320#0	short		0407		VAX-order2 68K Blit (standalone) executable
33210	short		03401		VAX-order 68K Blit (standalone) executable
33220	long		0406		68k Blit mpx/mux executable
33230	short		0406		VAX-order2 68k Blit mpx/mux executable
33240	short		03001		VAX-order 68k Blit mpx/mux executable
3325# Need more values for WE32 DMD executables.
3326# Note that 0520 is the same as COFF
3327#0	short		0520		tty630 layers executable
3328
3329#------------------------------------------------------------------------------
3330# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $
3331# i80960 b.out objects and archives
3332#
33330	long		0x10d		i960 b.out relocatable object
3334>16	long		>0		not stripped
3335#
3336# b.out archive (hp-rt on i960)
33370	string		=!<bout>	b.out archive
3338>8	string		__.SYMDEF	random library
3339
3340#------------------------------------------------------------------------------
3341# $File: bsdi,v 1.6 2013/01/09 22:37:24 christos Exp $
3342# bsdi:  file(1) magic for BSD/OS (from BSDI) objects
3343# Some object/executable formats use the same magic numbers as are used
3344# in other OSes; those are handled by entries in aout.
3345#
3346
33470	lelong		0314		386 compact demand paged pure executable
3348>16	lelong		>0		not stripped
3349>32	byte		0x6a		(uses shared libs)
3350
3351# same as in SunOS 4.x, except for static shared libraries
33520	belong&077777777	0600413		sparc demand paged
3353>0	byte		&0x80
3354>>20	belong		<4096		shared library
3355>>20	belong		=4096		dynamically linked executable
3356>>20	belong		>4096		dynamically linked executable
3357>0	byte		^0x80		executable
3358>16	belong		>0		not stripped
3359>36	belong		0xb4100001	(uses shared libs)
3360
33610	belong&077777777	0600410		sparc pure
3362>0	byte		&0x80		dynamically linked executable
3363>0	byte		^0x80		executable
3364>16	belong		>0		not stripped
3365>36	belong		0xb4100001	(uses shared libs)
3366
33670	belong&077777777	0600407		sparc
3368>0	byte		&0x80		dynamically linked executable
3369>0	byte		^0x80		executable
3370>16	belong		>0		not stripped
3371>36	belong		0xb4100001	(uses shared libs)
3372# Chiasmus is a encryption standard developed by the German Federal
3373# Office for Information Security (Bundesamt fuer Sicherheit in der
3374# Informationstechnik).
3375
3376# Extension: .xia
33770	string	XIA1	Chiasmus encrypted data
3378
3379# Extension: .xis
33800	string	XIS	Chiasmus key
3381
3382#------------------------------------------------------------------------------
3383# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $
3384# BTSnoop:  file(1) magic for BTSnoop files
3385#
3386# From <marcel@holtmann.org>
33870	string		btsnoop\0		BTSnoop
3388>8	belong		x			version %d,
3389>12	belong		1001			Unencapsulated HCI
3390>12	belong		1002			HCI UART (H4)
3391>12	belong		1003			HCI BCSP
3392>12	belong		1004			HCI Serial (H5)
3393>>12	belong		x			type %d
3394
3395#------------------------------------------------------------------------------
3396# $File: c64,v 1.5 2009/09/19 16:28:08 christos Exp $
3397# c64:  file(1) magic for various commodore 64 related files
3398#
3399# From: Dirk Jagdmann <doj@cubic.org>
3400
34010x16500	belong		0x12014100	D64 Image
34020x16500	belong		0x12014180	D71 Image
34030x61800 belong		0x28034400	D81 Image
34040	string		C64\40CARTRIDGE	CCS C64 Emultar Cartridge Image
34050	belong		0x43154164	X64 Image
3406
34070	string		GCR-1541	GCR Image
3408>8	byte		x		version: %i
3409>9	byte		x		tracks: %i
3410
34119	string		PSUR		ARC archive (c64)
34122	string		-LH1-		LHA archive (c64)
3413
34140	string		C64File		PC64 Emulator file
3415>8	string		>\0		"%s"
34160	string		C64Image	PC64 Freezer Image
3417
34180	beshort		0x38CD		C64 PCLink Image
34190	string		CBM\144\0\0	Power 64 C64 Emulator Snapshot
3420
34210	belong		0xFF424CFF	WRAptor packer (c64)
3422
34230	string		C64S\x20tape\x20file	T64 tape Image
3424>32	leshort		x		Version:0x%x
3425>36	leshort		!0		Entries:%i
3426>40	string		x		Name:%.24s
3427
34280	string		C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0	T64 tape Image
3429>32	leshort		x		Version:0x%x
3430>36	leshort		!0		Entries:%i
3431>40	string		x		Name:%.24s
3432
34330	string		C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0	T64 tape Image
3434>32	leshort		x		Version:0x%x
3435>36	leshort		!0		Entries:%i
3436>40	string		x		Name:%.24s
3437
3438#------------------------------------------------------------------------------
3439# $File: cad,v 1.11 2011/12/08 12:12:46 rrt Exp $
3440# autocad:  file(1) magic for cad files
3441#
3442
3443# AutoCAD DWG versions R13/R14 (www.autodesk.com)
3444# Written December 01, 2003 by Lester Hightower
3445# Based on the DWG File Format Specifications at http://www.opendwg.org/
34460	string	       \101\103\061\060\061		   AutoCAD
3447>5	string	       \062\000\000\000\000		   DWG ver. R13
3448>5	string	       \064\000\000\000\000		   DWG ver. R14
3449
3450# Microstation DGN/CIT Files (www.bentley.com)
3451# Last updated July 29, 2005 by Lester Hightower
3452# DGN is the default file extension of Microstation/Intergraph CAD files.
3453# CIT is the proprietary raster format (similar to TIFF) used to attach
3454# raster underlays to Microstation DGN (vector) drawings.
3455#
3456# http://www.wotsit.org/search.asp
3457# http://filext.com/detaillist.php?extdetail=DGN
3458# http://filext.com/detaillist.php?extdetail=CIT
3459#
3460# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
3461# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
3462# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
3463# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
34640	string	\010\011\376			Microstation
3465>3	string	\002
3466>>30	string	\026\105			DGNFile
3467>>30	string	\034\105			DGNFile
3468>>30	string	\073\107			DGNFile
3469>>30	string	\073\110			DGNFile
3470>>30	string	\106\107			DGNFile
3471>>30	string	\110\103			DGNFile
3472>>30	string	\120\104			DGNFile
3473>>30	string	\172\104			DGNFile
3474>>30	string	\172\105			DGNFile
3475>>30	string	\172\106			DGNFile
3476>>30	string	\234\106			DGNFile
3477>>30	string	\273\105			DGNFile
3478>>30	string	\306\106			DGNFile
3479>>30	string	\310\104			DGNFile
3480>>30	string	\341\104			DGNFile
3481>>30	string	\372\103			DGNFile
3482>>30	string	\372\104			DGNFile
3483>>30	string	\372\106			DGNFile
3484>>30	string	\376\103			DGNFile
3485>4	string	\030\000\000			CITFile
3486>4	string	\030\000\003			CITFile
3487
3488# AutoCad, from Nahuel Greco
3489# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com)
34900	string	AC1012		DWG AutoDesk AutoCad (release 12)
34910	string	AC1013		DWG AutoDesk AutoCad (release 13)
34920	string	AC1014		DWG AutoDesk AutoCad (release 14)
3493# A new version of AutoCAD DWG
3494# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
3495# ICQ 358572321)
3496# From various sources like:
3497# http://autodesk.blogs.com/between_the_lines/autocad-release-history.html
34980	string	AC1018 		DWG AutoDesk AutoCAD 2004/2005/2006
34990	string	AC1021 		DWG AutoDesk AutoCAD 2007/2008/2009
35000	string	AC1024 		DWG AutoDesk AutoCAD 2010/2011
3501
3502# KOMPAS 2D drawing from ASCON
3503# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor
3504# gathered nor specification
3505# ASCON http://ascon.net/main/ in English,
3506#	http://ascon.ru/ main site in Russian
3507# Extension is CDW for drawing and FRW for fragment of drawing
3508# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
3509# ICQ 358572321, http://vkontakte.ru/id16076543)
3510# From:
3511# http://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292
3512# (in russian) and my experiments
35130	string	KF
3514>2	belong	0x4E00000C	Kompas drawing 12.0 SP1
3515>2	belong	0x4D00000C	Kompas drawing 12.0
3516>2	belong	0x3200000B	Kompas drawing 11.0 SP1
3517>2	belong	0x3100000B	Kompas drawing 11.0
3518>2	belong	0x2310000A	Kompas drawing 10.0 SP1
3519>2	belong	0x2110000A	Kompas drawing 10.0
3520>2	belong	0x08000009	Kompas drawing 9.0 SP1
3521>2	belong	0x05000009	Kompas drawing 9.0
3522>2	belong	0x33010008	Kompas drawing 8+
3523>2	belong	0x1A000008	Kompas drawing 8.0
3524>2	belong	0x2C010107	Kompas drawing 7+
3525>2	belong	0x05000007	Kompas drawing 7.0
3526>2	belong	0x32000006	Kompas drawing 6+
3527>2	belong	0x09000006	Kompas drawing 6.0
3528>2	belong	0x5C009005	Kompas drawing 5.11R03
3529>2	belong	0x54009005	Kompas drawing 5.11R02
3530>2	belong	0x51009005	Kompas drawing 5.11R01
3531>2	belong	0x22009005	Kompas drawing 5.10R03
3532>2	belong	0x22009005	Kompas drawing 5.10R02 mar
3533>2	belong	0x21009005	Kompas drawing 5.10R02 febr
3534>2	belong	0x19009005	Kompas drawing 5.10R01
3535>2	belong	0xF4008005	Kompas drawing 5.9R01.003
3536>2	belong	0x1C008005	Kompas drawing 5.9R01.002
3537>2	belong	0x11008005	Kompas drawing 5.8R01.003
3538
3539# CAD: file(1) magic for computer aided design files
3540# Phillip Griffith <phillip dot griffith at gmail dot com>
3541# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications.
3542#
35430	belong	0x08051700	Bentley/Intergraph MicroStation DGN cell library
35440	belong	0x0809fe02	Bentley/Intergraph MicroStation DGN vector CAD
35450	belong	0xc809fe02	Bentley/Intergraph MicroStation DGN vector CAD
35460	beshort	0x0809		Bentley/Intergraph MicroStation
3547>0x02	byte	0xfe
3548>>0x04	beshort	0x1800		CIT raster CAD
35490	string	AC1012		AutoDesk AutoCAD R13
35500	string	AC1014		AutoDesk AutoCAD R14
35510	string	AC1015		AutoDesk AutoCAD R2000
3552
3553# 3DS (3d Studio files) Conflicts with diff output 0x3d '='
3554#16	beshort		0x3d3d		image/x-3ds
3555
3556#------------------------------------------------------------------------------
3557# $File: cafebabe,v 1.14 2013/02/27 16:59:59 christos Exp $
3558# Cafe Babes unite!
3559#
3560# Since Java bytecode and Mach-O universal binaries have the same magic number,
3561# the test must be performed in the same "magic" sequence to get both right.
3562# The long at offset 4 in a Mach-O universal binary tells the number of
3563# architectures; the short at offset 4 in a Java bytecode file is the JVM minor
3564# version and the short at offset 6 is the JVM major version.  Since there are only
3565# only 18 labeled Mach-O architectures at current, and the first released
3566# Java class format was version 43.0, we can safely choose any number
3567# between 18 and 39 to test the number of architectures against
3568# (and use as a hack). Let's not use 18, because the Mach-O people
3569# might add another one or two as time goes by...
3570#
3571### JAVA START ###
35720	belong		0xcafebabe
3573!:mime	application/x-java-applet
3574>4	belong		>30		compiled Java class data,
3575>>6	beshort		x	        version %d.
3576>>4	beshort		x       	\b%d
3577# Which is which?
3578#>>4	belong		0x032d		(Java 1.0)
3579#>>4	belong		0x032d		(Java 1.1)
3580>>4	belong		0x002e		(Java 1.2)
3581>>4	belong		0x002f		(Java 1.3)
3582>>4	belong		0x0030		(Java 1.4)
3583>>4	belong		0x0031		(Java 1.5)
3584>>4	belong		0x0032		(Java 1.6)
3585
35860	belong		0xcafed00d	JAR compressed with pack200,
3587>5	byte		x		version %d.
3588>4	byte		x		\b%d
3589!:mime	application/x-java-pack200
3590
3591
35920	belong		0xcafed00d	JAR compressed with pack200,
3593>5	byte		x		version %d.
3594>4	byte		x		\b%d
3595!:mime	application/x-java-pack200
3596
3597### JAVA END ###
3598### MACH-O START ###
3599
36000	name		mach-o		\b [
3601>0	use		mach-o-cpu	\b
3602>&(8.L)	indirect			\b:
3603>0	belong		x		\b]
3604
36050	belong		0xcafebabe
3606>4	belong		1		Mach-O universal binary with 1 architecture:
3607>>8	use		mach-o		\b
3608>4	belong		>1
3609>>4	belong		<20		Mach-O universal binary with %ld architectures:
3610>>>8	use		mach-o		\b
3611>>>28	use		mach-o		\b
3612>>4	belong		>2
3613>>>48	use		mach-o		\b
3614>>4	belong		>3
3615>>>68	use		mach-o		\b
3616
3617### MACH-O END ###
3618
3619#------------------------------------------------------------------------------
3620# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $
3621# CDDB: file(1) magic for CDDB(tm) format CD text data files
3622#
3623# From <steve@gracenote.com>
3624#
3625# This is the /etc/magic entry to decode datafiles as used by
3626# CDDB-enabled CD player applications.
3627#
3628
36290	search/1/w	#\040xmcd	CDDB(tm) format CD text data
3630
3631#------------------------------------------------------------------------------
3632# $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $
3633# chord: file(1) magic for Chord music sheet typesetting utility input files
3634#
3635# From Philippe De Muyter <phdm@macqel.be>
3636# File format is actually free, but many distributed files begin with `{title'
3637#
36380	string		{title		Chord text file
3639
3640# Type:	PowerTab file format
3641# URL:	http://www.power-tab.net/
3642# From:	Jelmer Vernooij <jelmer@samba.org>
36430	string		ptab\003\000	Power-Tab v3 Tablature File
36440	string		ptab\004\000	Power-Tab v4 Tablature File
3645
3646#------------------------------------------------------------------------------
3647# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $
3648# cisco:  file(1) magic for cisco Systems routers
3649#
3650# Most cisco file-formats are covered by the generic elf code
3651#
3652# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
36530	belong&0xffffff00	0x85011400  cisco IOS microcode
3654>7	string		>\0		    for '%s'
36550	belong&0xffffff00	0x8501cb00  cisco IOS experimental microcode
3656>7	string		>\0		    for '%s'
3657
3658#------------------------------------------------------------------------------
3659# $File: citrus,v 1.4 2009/09/19 16:28:08 christos Exp $
3660# citrus locale declaration
3661#
3662
36630	string		RuneCT		Citrus locale declaration for LC_CTYPE
3664
3665#------------------------------------------------------------------------------
3666# $File: c-lang,v 1.17 2012/04/28 21:20:26 christos Exp $
3667# c-lang:  file(1) magic for C and related languages programs
3668#
3669
3670# BCPL
36710	search/8192	"libhdr"	BCPL source text
3672!:mime	text/x-bcpl
36730	search/8192	"LIBHDR"	BCPL source text
3674!:mime	text/x-bcpl
3675
3676# C
36770	regex	\^#include	C source text
3678!:mime	text/x-c
36790	regex	\^char		C source text
3680!:mime	text/x-c
36810	regex	\^double		C source text
3682!:mime	text/x-c
36830	regex	\^extern		C source text
3684!:mime	text/x-c
36850	regex	\^float		C source text
3686!:mime	text/x-c
36870	regex	\^struct		C source text
3688!:mime	text/x-c
36890	regex	\^union		C source text
3690!:mime	text/x-c
36910	search/8192	main(		C source text
3692!:mime	text/x-c
3693
3694# C++
3695# The strength of these rules is increased so they beat the C rules above
36960	regex	\^template	C++ source text
3697!:strength + 5
3698!:mime	text/x-c++
36990	regex	\^virtual		C++ source text
3700!:strength + 5
3701!:mime	text/x-c++
37020	regex	\^class		C++ source text
3703!:strength + 5
3704!:mime	text/x-c++
37050	regex	\^public:		C++ source text
3706!:strength + 5
3707!:mime	text/x-c++
37080	regex	\^private:		C++ source text
3709!:strength + 5
3710!:mime	text/x-c++
3711
3712# From: Mikhail Teterin <mi@aldan.algebra.com>
37130	string		cscope		cscope reference data
3714>7	string		x		version %.2s
3715# We skip the path here, because it is often long (so file will
3716# truncate it) and mostly redundant.
3717# The inverted index functionality was added some time betwen
3718# versions 11 and 15, so look for -q if version is above 14:
3719>7	string		>14
3720>>10	search/100	\ -q\ 		with inverted index
3721>10	search/100	\ -c\ 		text (non-compressed)
3722
3723#------------------------------------------------------------------------------
3724# $File: clarion,v 1.4 2009/09/19 16:28:08 christos Exp $
3725# clarion:  file(1) magic for # Clarion Personal/Professional Developer
3726# (v2 and above)
3727# From: Julien Blache <jb@jblache.org>
3728
3729# Database files
3730# signature
37310	leshort	0x3343	Clarion Developer (v2 and above) data file
3732# attributes
3733>2	leshort	&0x0001	\b, locked
3734>2	leshort	&0x0004	\b, encrypted
3735>2	leshort	&0x0008	\b, memo file exists
3736>2	leshort	&0x0010	\b, compressed
3737>2	leshort	&0x0040	\b, read only
3738# number of records
3739>5	lelong	x	\b, %ld records
3740
3741# Memo files
37420	leshort	0x334d	Clarion Developer (v2 and above) memo data
3743
3744# Key/Index files
3745# No magic? :(
3746
3747# Help files
37480	leshort	0x49e0	Clarion Developer (v2 and above) help data
3749
3750#------------------------------------------------------------------------------
3751# $File: claris,v 1.6 2012/06/20 21:19:05 christos Exp $
3752# claris:  file(1) magic for claris
3753# "H. Nanosecond" <aldomel@ix.netcom.com>
3754# Claris Works a word processor, etc.
3755# Version 3.0
3756
3757# .pct claris works clip art files
3758#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
3759#*
3760#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
3761#null to byte 1000 octal
3762514	string	\377\377\377\377\000
3763>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	Claris clip art
3764514	string	\377\377\377\377\001
3765>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	Claris clip art
3766
3767# Claris works files
3768# .cwk
37690	string	\002\000\210\003\102\117\102\117\000\001\206 Claris works document
3770# .plt
37710	string	\020\341\000\000\010\010	Claris Works pallete files .plt
3772
3773# .msp a dictionary file I am not sure about this I have only one .msp file
37740	string	\002\271\262\000\040\002\000\164	Claris works dictionary
3775
3776# .usp are user dictionary bits
3777# I am not sure about a magic header:
3778#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
3779#        soh   S   p   f   8   U   D  sp   ^   S  cr  nl   p   o   d   i
3780#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
3781#          a   t   r   i   s   t  sp   ^   S  cr  nl   d   i   v  sp   #
3782
3783# .mth Thesaurus
3784# starts with \0 but no magic header
3785
3786# .chy Hyphenation file
3787# I am not sure: 000 210 034 000 000
3788
3789# other claris files
3790#./windows/claris/useng.ndx: data
3791#./windows/claris/xtndtran.l32: data
3792#./windows/claris/xtndtran.lst: data
3793#./windows/claris/clworks.lbl: data
3794#./windows/claris/clworks.prf: data
3795#./windows/claris/userd.spl: data
3796
3797#------------------------------------------------------------------------------
3798# $File: clipper,v 1.6 2009/09/19 16:28:08 christos Exp $
3799# clipper:  file(1) magic for Intergraph (formerly Fairchild) Clipper.
3800#
3801# XXX - what byte order does the Clipper use?
3802#
3803# XXX - what's the "!" stuff:
3804#
3805# >18	short		!074000,000000	C1 R1
3806# >18	short		!074000,004000	C2 R1
3807# >18	short		!074000,010000	C3 R1
3808# >18	short		!074000,074000	TEST
3809#
3810# I shall assume it's ANDing the field with the first value and
3811# comparing it with the second, and rewrite it as:
3812#
3813# >18	short&074000	000000		C1 R1
3814# >18	short&074000	004000		C2 R1
3815# >18	short&074000	010000		C3 R1
3816# >18	short&074000	074000		TEST
3817#
3818# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
3819# sort, nor does SunOS 4.x, so either it's something Intergraph added
3820# in CLIX, or something AT&T added in SVR3.2 or later, or something
3821# somebody else thought was a good idea; it's not documented in the
3822# man page for this version of "magic", nor does it appear to be
3823# implemented (at least not after I blew off the bogus code to turn
3824# old-style "&"s into new-style "&"s, which just didn't work at all).
3825#
38260	short		0575		CLIPPER COFF executable (VAX #)
3827>20	short		0407		(impure)
3828>20	short		0410		(5.2 compatible)
3829>20	short		0411		(pure)
3830>20	short		0413		(demand paged)
3831>20	short		0443		(target shared library)
3832>12	long		>0		not stripped
3833>22	short		>0		- version %ld
38340	short		0577		CLIPPER COFF executable
3835>18	short&074000	000000		C1 R1
3836>18	short&074000	004000		C2 R1
3837>18	short&074000	010000		C3 R1
3838>18	short&074000	074000		TEST
3839>20	short		0407		(impure)
3840>20	short		0410		(pure)
3841>20	short		0411		(separate I&D)
3842>20	short		0413		(paged)
3843>20	short		0443		(target shared library)
3844>12	long		>0		not stripped
3845>22	short		>0		- version %ld
3846>48	long&01		01		alignment trap enabled
3847>52	byte		1		-Ctnc
3848>52	byte		2		-Ctsw
3849>52	byte		3		-Ctpw
3850>52	byte		4		-Ctcb
3851>53	byte		1		-Cdnc
3852>53	byte		2		-Cdsw
3853>53	byte		3		-Cdpw
3854>53	byte		4		-Cdcb
3855>54	byte		1		-Csnc
3856>54	byte		2		-Cssw
3857>54	byte		3		-Cspw
3858>54	byte		4		-Cscb
38594	string		pipe		CLIPPER instruction trace
38604	string		prof		CLIPPER instruction profile
3861
3862#------------------------------------------------------------------------------
3863# $File: commands,v 1.45 2013/02/06 14:18:52 christos Exp $
3864# commands:  file(1) magic for various shells and interpreters
3865#
3866#0	string/w	:			shell archive or script for antique kernel text
38670	string/wt	#!\ /bin/sh		POSIX shell script text executable
3868!:mime	text/x-shellscript
38690	string/wt	#!\ /bin/csh		C shell script text executable
3870!:mime	text/x-shellscript
3871# korn shell magic, sent by George Wu, gwu@clyde.att.com
38720	string/wt	#!\ /bin/ksh		Korn shell script text executable
3873!:mime	text/x-shellscript
38740	string/wt 	#!\ /bin/tcsh		Tenex C shell script text executable
3875!:mime	text/x-shellscript
38760	string/wt	#!\ /usr/bin/tcsh	Tenex C shell script text executable
3877!:mime	text/x-shellscript
38780	string/wt 	#!\ /usr/local/tcsh	Tenex C shell script text executable
3879!:mime	text/x-shellscript
38800	string/wt	#!\ /usr/local/bin/tcsh	Tenex C shell script text executable
3881!:mime	text/x-shellscript
3882
3883#
3884# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
38850	string/wt	#!\ /bin/zsh		Paul Falstad's zsh script text executable
3886!:mime	text/x-shellscript
38870	string/wt	#!\ /usr/bin/zsh	Paul Falstad's zsh script text executable
3888!:mime	text/x-shellscript
38890	string/wt	#!\ /usr/local/bin/zsh	Paul Falstad's zsh script text executable
3890!:mime	text/x-shellscript
38910	string/wt	#!\ /usr/local/bin/ash	Neil Brown's ash script text executable
3892!:mime	text/x-shellscript
38930	string/wt	#!\ /usr/local/bin/ae	Neil Brown's ae script text executable
3894!:mime	text/x-shellscript
38950	string/wt	#!\ /bin/nawk		new awk script text executable
3896!:mime	text/x-nawk
38970	string/wt	#!\ /usr/bin/nawk	new awk script text executable
3898!:mime	text/x-nawk
38990	string/wt	#!\ /usr/local/bin/nawk	new awk script text executable
3900!:mime	text/x-nawk
39010	string/wt	#!\ /bin/gawk		GNU awk script text executable
3902!:mime	text/x-gawk
39030	string/wt	#!\ /usr/bin/gawk	GNU awk script text executable
3904!:mime	text/x-gawk
39050	string/wt	#!\ /usr/local/bin/gawk	GNU awk script text executable
3906!:mime	text/x-gawk
3907#
39080	string/wt	#!\ /bin/awk		awk script text executable
3909!:mime	text/x-awk
39100	string/wt	#!\ /usr/bin/awk	awk script text executable
3911!:mime	text/x-awk
39120	regex		=^\\s*BEGIN\\s*[{]	awk script text
3913
3914# AT&T Bell Labs' Plan 9 shell
39150	string/wt	#!\ /bin/rc	Plan 9 rc shell script text executable
3916
3917# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
39180	string/wt	#!\ /bin/bash	Bourne-Again shell script text executable
3919!:mime	text/x-shellscript
39200	string/wt	#!\ /usr/bin/bash	Bourne-Again shell script text executable
3921!:mime	text/x-shellscript
39220	string/wt	#!\ /usr/local/bash	Bourne-Again shell script text executable
3923!:mime	text/x-shellscript
39240	string/wt	#!\ /usr/local/bin/bash	Bourne-Again shell script text executable
3925!:mime	text/x-shellscript
3926
3927# PHP scripts
3928# Ulf Harnhammar <ulfh@update.uu.se>
39290	search/1/c	=<?php			PHP script text
3930!:strength + 10
3931!:mime	text/x-php
39320	search/1	=<?\n			PHP script text
3933!:mime	text/x-php
39340	search/1	=<?\r			PHP script text
3935!:mime	text/x-php
39360	search/1/w	#!\ /usr/local/bin/php	PHP script text executable
3937!:strength + 10
3938!:mime	text/x-php
39390	search/1/w	#!\ /usr/bin/php	PHP script text executable
3940!:strength + 10
3941!:mime	text/x-php
3942# Smarty compiled template, http://www.smarty.net/
3943# Elan Ruusamae <glen@delfi.ee>
39440	string	=<?php\ /*\ Smarty\ version	Smarty compiled template
3945>24	regex	[0-9.]+				\b, version %s
3946!:mime	text/x-php
3947
39480	string		Zend\x00		PHP script Zend Optimizer data
3949
39500	string/t	$!			DCL command file
3951
3952# Type: Pdmenu
3953# URL:  http://packages.debian.org/pdmenu
3954# From: Edward Betts <edward@debian.org>
39550	string		#!/usr/bin/pdmenu	Pdmenu configuration file text
3956
3957#----------------------------------------------------------------------------
3958# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $
3959# communication
3960
3961# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3.
3962# It is used for conformance testing of communication protocols.
3963# Added by W. Borgert <debacle@debian.org>.
39640	string		$Suite			TTCN Abstract Test Suite
3965>&1	string		$SuiteId
3966>>&1	string		>\n			%s
3967>&2	string		$SuiteId
3968>>&1	string		>\n			%s
3969>&3	string		$SuiteId
3970>>&1	string		>\n			%s
3971
3972# MSC (message sequence charts) are a formal description technique,
3973# described in ITU-T Z.120, mainly used for communication protocols.
3974# Added by W. Borgert <debacle@debian.org>.
39750	string		mscdocument	Message Sequence Chart (document)
39760	string		msc		Message Sequence Chart (chart)
39770	string		submsc		Message Sequence Chart (subchart)
3978#------------------------------------------------------------------------------
3979# $File: compress,v 1.49 2011/12/07 22:04:27 christos Exp $
3980# compress:  file(1) magic for pure-compression formats (no archives)
3981#
3982# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
3983#
3984# Formats for various forms of compressed data
3985# Formats for "compress" proper have been moved into "compress.c",
3986# because it tries to uncompress it to figure out what's inside.
3987
3988# standard unix compress
39890	string		\037\235	compress'd data
3990!:mime	application/x-compress
3991!:apple	LZIVZIVU
3992>2	byte&0x80	>0		block compressed
3993>2	byte&0x1f	x		%d bits
3994
3995# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
3996#   Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
3997#	* Original filename is only at offset 10 if "extra field" absent
3998#	* Produce shorter output - notably, only report compression methods
3999#         other than 8 ("deflate", the only method defined in RFC 1952).
40000       string          \037\213        gzip compressed data
4001!:mime	application/x-gzip
4002>2	byte		<8		\b, reserved method
4003>2	byte		>8		\b, unknown method
4004>3	byte		&0x01		\b, ASCII
4005>3	byte		&0x02		\b, has CRC
4006>3	byte		&0x04		\b, extra field
4007>3	byte&0xC	=0x08
4008>>10	string		x		\b, was "%s"
4009>3	byte		&0x10		\b, has comment
4010>9	byte		=0x00		\b, from FAT filesystem (MS-DOS, OS/2, NT)
4011>9	byte		=0x01		\b, from Amiga
4012>9	byte		=0x02		\b, from VMS
4013>9	byte		=0x03		\b, from Unix
4014>9	byte		=0x04		\b, from VM/CMS
4015>9	byte		=0x05		\b, from Atari
4016>9	byte		=0x06		\b, from HPFS filesystem (OS/2, NT)
4017>9	byte		=0x07		\b, from MacOS
4018>9	byte		=0x08		\b, from Z-System
4019>9	byte		=0x09		\b, from CP/M
4020>9	byte		=0x0A		\b, from TOPS/20
4021>9	byte		=0x0B		\b, from NTFS filesystem (NT)
4022>9	byte		=0x0C		\b, from QDOS
4023>9	byte		=0x0D		\b, from Acorn RISCOS
4024>3	byte		&0x10		\b, comment
4025>3	byte		&0x20		\b, encrypted
4026>4	ledate		>0		\b, last modified: %s
4027>8	byte		2		\b, max compression
4028>8	byte		4		\b, max speed
4029
4030# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
40310	string		\037\036	packed data
4032!:mime	application/octet-stream
4033>2	belong		>1		\b, %d characters originally
4034>2	belong		=1		\b, %d character originally
4035#
4036# This magic number is byte-order-independent.
40370	short		0x1f1f		old packed data
4038!:mime	application/octet-stream
4039
4040# XXX - why *two* entries for "compacted data", one of which is
4041# byte-order independent, and one of which is byte-order dependent?
4042#
40430	short		0x1fff		compacted data
4044!:mime	application/octet-stream
4045# This string is valid for SunOS (BE) and a matching "short" is listed
4046# in the Ultrix (LE) magic file.
40470	string		\377\037	compacted data
4048!:mime	application/octet-stream
40490	short		0145405		huf output
4050!:mime	application/octet-stream
4051
4052# bzip2
40530	string		BZh		bzip2 compressed data
4054!:mime	application/x-bzip2
4055>3	byte		>47		\b, block size = %c00k
4056
4057# lzip
40580	string		LZIP		lzip compressed data
4059!:mime application/x-lzip
4060>4	byte		x		\b, version: %d
4061
4062# squeeze and crunch
4063# Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
40640	beshort		0x76FF		squeezed data,
4065>4	string		x		original name %s
40660	beshort		0x76FE		crunched data,
4067>2	string		x		original name %s
40680	beshort		0x76FD		LZH compressed data,
4069>2	string		x		original name %s
4070
4071# Freeze
40720	string		\037\237	frozen file 2.1
40730	string		\037\236	frozen file 1.0 (or gzip 0.5)
4074
4075# SCO compress -H (LZH)
40760	string		\037\240	SCO compress -H (LZH) data
4077
4078# European GSM 06.10 is a provisional standard for full-rate speech
4079# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
4080# excitation/long term prediction) coding at 13 kbit/s.
4081#
4082# There's only a magic nibble (4 bits); that nibble repeats every 33
4083# bytes.  This isn't suited for use, but maybe we can use it someday.
4084#
4085# This will cause very short GSM files to be declared as data and
4086# mismatches to be declared as data too!
4087#0	byte&0xF0	0xd0		data
4088#>33	byte&0xF0	0xd0
4089#>66	byte&0xF0	0xd0
4090#>99	byte&0xF0	0xd0
4091#>132	byte&0xF0	0xd0		GSM 06.10 compressed audio
4092
4093# bzip	a block-sorting file compressor
4094#	by Julian Seward <sewardj@cs.man.ac.uk> and others
4095#
4096#0	string		BZ		bzip compressed data
4097#>2	byte		x		\b, version: %c
4098#>3	string		=1		\b, compression block size 100k
4099#>3	string		=2		\b, compression block size 200k
4100#>3	string		=3		\b, compression block size 300k
4101#>3	string		=4		\b, compression block size 400k
4102#>3	string		=5		\b, compression block size 500k
4103#>3	string		=6		\b, compression block size 600k
4104#>3	string		=7		\b, compression block size 700k
4105#>3	string		=8		\b, compression block size 800k
4106#>3	string		=9		\b, compression block size 900k
4107
4108# lzop from <markus.oberhumer@jk.uni-linz.ac.at>
41090	string		\x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a	lzop compressed data
4110>9	beshort		<0x0940
4111>>9	byte&0xf0	=0x00		- version 0.
4112>>9	beshort&0x0fff	x		\b%03x,
4113>>13	byte		1		LZO1X-1,
4114>>13	byte		2		LZO1X-1(15),
4115>>13	byte		3		LZO1X-999,
4116## >>22	bedate		>0		last modified: %s,
4117>>14	byte		=0x00		os: MS-DOS
4118>>14	byte		=0x01		os: Amiga
4119>>14	byte		=0x02		os: VMS
4120>>14	byte		=0x03		os: Unix
4121>>14	byte		=0x05		os: Atari
4122>>14	byte		=0x06		os: OS/2
4123>>14	byte		=0x07		os: MacOS
4124>>14	byte		=0x0A		os: Tops/20
4125>>14	byte		=0x0B		os: WinNT
4126>>14	byte		=0x0E		os: Win32
4127>9	beshort		>0x0939
4128>>9	byte&0xf0	=0x00		- version 0.
4129>>9	byte&0xf0	=0x10		- version 1.
4130>>9	byte&0xf0	=0x20		- version 2.
4131>>9	beshort&0x0fff	x		\b%03x,
4132>>15	byte		1		LZO1X-1,
4133>>15	byte		2		LZO1X-1(15),
4134>>15	byte		3		LZO1X-999,
4135## >>25	bedate		>0		last modified: %s,
4136>>17	byte		=0x00		os: MS-DOS
4137>>17	byte		=0x01		os: Amiga
4138>>17	byte		=0x02		os: VMS
4139>>17	byte		=0x03		os: Unix
4140>>17	byte		=0x05		os: Atari
4141>>17	byte		=0x06		os: OS/2
4142>>17	byte		=0x07		os: MacOS
4143>>17	byte		=0x0A		os: Tops/20
4144>>17	byte		=0x0B		os: WinNT
4145>>17	byte		=0x0E		os: Win32
4146
4147# 4.3BSD-Quasijarus Strong Compression
4148# http://minnie.tuhs.org/Quasijarus/compress.html
41490	string		\037\241	Quasijarus strong compressed data
4150
4151# From: Cory Dikkers <cdikkers@swbell.net>
41520	string		XPKF		Amiga xpkf.library compressed data
41530	string		PP11		Power Packer 1.1 compressed data
41540	string		PP20		Power Packer 2.0 compressed data,
4155>4	belong		0x09090909	fast compression
4156>4	belong		0x090A0A0A	mediocre compression
4157>4	belong		0x090A0B0B	good compression
4158>4	belong		0x090A0C0C	very good compression
4159>4	belong		0x090A0C0D	best compression
4160
4161# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
4162# http://www.7-zip.org or DOC/7zFormat.txt
4163#
41640	string		7z\274\257\047\034	7-zip archive data,
4165>6	byte		x			version %d
4166>7	byte		x			\b.%d
4167!:mime	application/x-7z-compressed
4168
4169# Type: LZMA
41700	lelong&0xffffff	=0x5d
4171>12	leshort		=0xff			LZMA compressed data,
4172>>5	lequad		=0xffffffffffffffff	streamed
4173>>5	lequad		!0xffffffffffffffff	non-streamed, size %lld
4174!:mime	application/x-lzma
4175
4176# http://tukaani.org/xz/xz-file-format.txt
41770	ustring		\xFD7zXZ\x00		XZ compressed data
4178!:mime	application/x-xz
4179
4180# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt
41810	string		LRZI			LRZIP compressed data
4182>4	byte		x			- version %d
4183>5	byte		x			\b.%d
4184!:mime	application/x-lrzip
4185
4186# AFX compressed files (Wolfram Kleff)
41872	string		-afx-		AFX compressed file data
4188
4189# Supplementary magic data for the file(1) command to support
4190# rzip(1).  The format is described in magic(5).
4191#
4192# Copyright (C) 2003 by Andrew Tridgell.  You may do whatever you want with
4193# this file.
4194#
41950	string		RZIP		rzip compressed data
4196>4	byte		x		- version %d
4197>5	byte		x		\b.%d
4198>6	belong		x		(%d bytes)
4199
42000	string		ArC\x01		FreeArc archive <http://freearc.org>
4201
4202# Type:	DACT compressed files
42030	long	0x444354C3	DACT compressed data
4204>4	byte	>-1		(version %i.
4205>5	byte	>-1		%i.
4206>6	byte	>-1		%i)
4207>7	long	>0		, original size: %i bytes
4208>15	long	>30		, block size: %i bytes
4209
4210#------------------------------------------------------------------------------
4211# $File: console,v 1.19 2013/02/06 14:18:52 christos Exp $
4212# Console game magic
4213# Toby Deshane <hac@shoelace.digivill.net>
4214#    ines:  file(1) magic for Marat's iNES Nintendo Entertainment System
4215#           ROM dump format
4216
42170 string NES\032 iNES ROM dump,
4218>4 byte  x     %dx16k PRG
4219>5 byte  x     \b, %dx8k CHR
4220>6 byte&0x01  =0x1  \b, [Vert.]
4221>6 byte&0x01  =0x0  \b, [Horiz.]
4222>6 byte&0x02  =0x2  \b, [SRAM]
4223>6 byte&0x04  =0x4  \b, [Trainer]
4224>6 byte&0x04  =0x8  \b, [4-Scr]
4225
4226#------------------------------------------------------------------------------
4227# gameboy:  file(1) magic for the Nintendo (Color) Gameboy raw ROM format
4228#
42290x104 belong 0xCEED6666 Gameboy ROM:
4230>0x134 string >\0 "%.16s"
4231>0x146 byte 0x03  \b,[SGB]
4232>0x147 byte 0x00  \b, [ROM ONLY]
4233>0x147 byte 0x01  \b, [ROM+MBC1]
4234>0x147 byte 0x02  \b, [ROM+MBC1+RAM]
4235>0x147 byte 0x03  \b, [ROM+MBC1+RAM+BATT]
4236>0x147 byte 0x05  \b, [ROM+MBC2]
4237>0x147 byte 0x06  \b, [ROM+MBC2+BATTERY]
4238>0x147 byte 0x08  \b, [ROM+RAM]
4239>0x147 byte 0x09  \b, [ROM+RAM+BATTERY]
4240>0x147 byte 0x0B  \b, [ROM+MMM01]
4241>0x147 byte 0x0C  \b, [ROM+MMM01+SRAM]
4242>0x147 byte 0x0D  \b, [ROM+MMM01+SRAM+BATT]
4243>0x147 byte 0x0F  \b, [ROM+MBC3+TIMER+BATT]
4244>0x147 byte 0x10  \b, [ROM+MBC3+TIMER+RAM+BATT]
4245>0x147 byte 0x11  \b, [ROM+MBC3]
4246>0x147 byte 0x12  \b, [ROM+MBC3+RAM]
4247>0x147 byte 0x13  \b, [ROM+MBC3+RAM+BATT]
4248>0x147 byte 0x19  \b, [ROM+MBC5]
4249>0x147 byte 0x1A  \b, [ROM+MBC5+RAM]
4250>0x147 byte 0x1B  \b, [ROM+MBC5+RAM+BATT]
4251>0x147 byte 0x1C  \b, [ROM+MBC5+RUMBLE]
4252>0x147 byte 0x1D  \b, [ROM+MBC5+RUMBLE+SRAM]
4253>0x147 byte 0x1E  \b, [ROM+MBC5+RUMBLE+SRAM+BATT]
4254>0x147 byte 0x1F  \b, [Pocket Camera]
4255>0x147 byte 0xFD  \b, [Bandai TAMA5]
4256>0x147 byte 0xFE  \b, [Hudson HuC-3]
4257>0x147 byte 0xFF  \b, [Hudson HuC-1]
4258
4259>0x148 byte 0     \b, ROM: 256Kbit
4260>0x148 byte 1     \b, ROM: 512Kbit
4261>0x148 byte 2     \b, ROM: 1Mbit
4262>0x148 byte 3     \b, ROM: 2Mbit
4263>0x148 byte 4     \b, ROM: 4Mbit
4264>0x148 byte 5     \b, ROM: 8Mbit
4265>0x148 byte 6     \b, ROM: 16Mbit
4266>0x148 byte 0x52  \b, ROM: 9Mbit
4267>0x148 byte 0x53  \b, ROM: 10Mbit
4268>0x148 byte 0x54  \b, ROM: 12Mbit
4269
4270>0x149 byte 1     \b, RAM: 16Kbit
4271>0x149 byte 2     \b, RAM: 64Kbit
4272>0x149 byte 3     \b, RAM: 128Kbit
4273>0x149 byte 4     \b, RAM: 1Mbit
4274
4275#>0x14e long  x     \b, CRC: %x
4276
4277#------------------------------------------------------------------------------
4278# genesis:  file(1) magic for the Sega MegaDrive/Genesis raw ROM format
4279#
42800x100 string SEGA  Sega MegaDrive/Genesis raw ROM dump
4281>0x120 string >\0 Name: "%.16s"
4282>0x110 string >\0 %.16s
4283>0x1B0 string RA with SRAM
4284
4285#------------------------------------------------------------------------------
4286# genesis:  file(1) magic for the Super MegaDrive ROM dump format
4287#
42880x280 string EAGN  Super MagicDrive ROM dump
4289>0 byte x %dx16k blocks
4290>2 byte 0 \b, last in series or standalone
4291>2 byte >0 \b, split ROM
4292>8 byte 0xAA
4293>9 byte 0xBB
4294
4295#------------------------------------------------------------------------------
4296# genesis:  file(1) alternate magic for the Super MegaDrive ROM dump format
4297#
42980x280 string EAMG  Super MagicDrive ROM dump
4299>0 byte x %dx16k blocks
4300>2 byte x \b, last in series or standalone
4301>8 byte 0xAA
4302>9 byte 0xBB
4303
4304#------------------------------------------------------------------------------
4305# smsgg:  file(1) magic for Sega Master System and Game Gear ROM dumps
4306#
4307# Does not detect all images.  Very preliminary guesswork.  Need more data
4308# on format.
4309#
4310# FIXME: need a little more info...;P
4311#
4312#0 byte 0xF3
4313#>1 byte 0xED  Sega Master System/Game Gear ROM dump
4314#>1 byte 0x31  Sega Master System/Game Gear ROM dump
4315#>1 byte 0xDB  Sega Master System/Game Gear ROM dump
4316#>1 byte 0xAF  Sega Master System/Game Gear ROM dump
4317#>1 byte 0xC3  Sega Master System/Game Gear ROM dump
4318
4319#------------------------------------------------------------------------------
4320# dreamcast:  file(1) uncertain magic for the Sega Dreamcast VMU image format
4321#
43220 belong 0x21068028   Sega Dreamcast VMU game image
43230 string LCDi         Dream Animator file
4324
4325#------------------------------------------------------------------------------
4326# v64: file(1) uncertain magic for the V64 format N64 ROM dumps
4327#
43280 belong 0x37804012    V64 Nintendo 64 ROM dump
4329
4330# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
4331# Nintendo .nds
4332192	string	\044\377\256Qi\232	Nintendo DS Game ROM Image
4333# Nintendo .gba
43340	string	\056\000\000\352$\377\256Qi	Nintendo Game Boy Advance ROM Image
4335
4336#------------------------------------------------------------------------------
4337# msx: file(1) magic for MSX game cartridge dumps
4338# Too simple - MPi
4339#0 beshort 0x4142 MSX game cartridge dump
4340
4341#------------------------------------------------------------------------------
4342# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
43430	string	PS-X\ EXE	Sony Playstation executable
4344#  Area:
4345>113	string	x		(%s)
4346
4347#------------------------------------------------------------------------------
4348# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>)
43490       string          XBEH            XBE, Microsoft Xbox executable
4350# probabilistic checks whether signed or not
4351>0x0004 ulelong =0x0
4352>>&2    ulelong =0x0
4353>>>&2   ulelong =0x0  \b, not signed
4354>0x0004 ulelong >0
4355>>&2    ulelong >0
4356>>>&2   ulelong >0    \b, signed
4357# expect base address of 0x10000
4358>0x0104               ulelong =0x10000
4359>>(0x0118-0x0FF60)    ulelong&0x80000007  0x80000007 \b, all regions
4360>>(0x0118-0x0FF60)    ulelong&0x80000007  !0x80000007
4361>>>(0x0118-0x0FF60)   ulelong >0           (regions:
4362>>>>(0x0118-0x0FF60)  ulelong &0x00000001  NA
4363>>>>(0x0118-0x0FF60)  ulelong &0x00000002  Japan
4364>>>>(0x0118-0x0FF60)  ulelong &0x00000004  Rest_of_World
4365>>>>(0x0118-0x0FF60)  ulelong &0x80000000  Manufacturer
4366>>>(0x0118-0x0FF60)   ulelong >0           \b)
4367
4368# --------------------------------
4369# Microsoft Xbox data file formats
43700       string          XIP0            XIP, Microsoft Xbox data
43710       string          XTF0            XTF, Microsoft Xbox data
4372
4373# Atari Lynx cartridge dump (EXE/BLL header)
4374# From: "Stefan A. Haubenthal" <polluks@web.de>
4375
4376# Double-check that the image type matches too, 0x8008 conflicts with
4377# 8 character OMF-86 object file headers.
43780	beshort		0x8008
4379>6	string		BS93		Lynx homebrew cartridge
4380>>2	beshort		x		\b, RAM start $%04x
4381>6	string		LYNX		Lynx cartridge
4382>>2	beshort		x		\b, RAM start $%04x
4383
4384# Opera file system that is used on the 3DO console
4385# From: Serge van den Boom <svdb@stack.nl>
43860	string		\x01ZZZZZ\x01	3DO "Opera" file system
4387
4388# From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
43890	string		GBS		Nintendo Gameboy Music/Audio Data
439012	string		GameBoy\ Music\ Module	Nintendo Gameboy Music Module
4391
4392# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at>
43930	string	PPF30			Playstation Patch File version 3.0
4394>5	byte	0			\b, PPF 1.0 patch
4395>5	byte	1			\b, PPF 2.0 patch
4396>5	byte	2			\b, PPF 3.0 patch
4397>>56	byte	0			\b, Imagetype BIN (any)
4398>>56	byte	1			\b, Imagetype GI (PrimoDVD)
4399>>57	byte	0			\b, Blockcheck disabled
4400>>57	byte	1			\b, Blockcheck enabled
4401>>58	byte	0			\b, Undo data not available
4402>>58	byte	1			\b, Undo data available
4403>6	string	x			\b, description: %s
4404
44050	string	PPF20			Playstation Patch File version 2.0
4406>5	byte	0			\b, PPF 1.0 patch
4407>5	byte	1			\b, PPF 2.0 patch
4408>>56	lelong	>0			\b, size of file to patch %d
4409>6	string	x			\b, description: %s
4410
44110	string	PPF10			Playstation Patch File version 1.0
4412>5	byte	0			\b, Simple Encoding
4413>6	string	x			\b, description: %s
4414
4415# From: Daniel Dawson <ddawson@icehouse.net>
4416# SNES9x .smv "movie" file format.
44170		string		SMV\x1A	SNES9x input recording
4418>0x4		lelong		x	\b, version %d
4419# version 4 is latest so far
4420>0x4		lelong		<5
4421>>0x8		ledate		x	\b, recorded at %s
4422>>0xc		lelong		>0	\b, rerecorded %d times
4423>>0x10		lelong		x	\b, %d frames long
4424>>0x14		byte		>0	\b, data for controller(s):
4425>>>0x14		byte		&0x1	#1
4426>>>0x14		byte		&0x2	#2
4427>>>0x14		byte		&0x4	#3
4428>>>0x14		byte		&0x8	#4
4429>>>0x14		byte		&0x10	#5
4430>>0x15		byte		^0x1	\b, begins from snapshot
4431>>0x15		byte		&0x1	\b, begins from reset
4432>>0x15		byte		^0x2	\b, NTSC standard
4433>>0x15		byte		&0x2	\b, PAL standard
4434>>0x17		byte		&0x1    \b, settings:
4435# WIP1Timing not used as of version 4
4436>>>0x4		lelong		<4
4437>>>>0x17	byte		&0x2	WIP1Timing
4438>>>0x17		byte		&0x4	Left+Right
4439>>>0x17		byte		&0x8	VolumeEnvX
4440>>>0x17		byte		&0x10	FakeMute
4441>>>0x17		byte		&0x20	SyncSound
4442# New flag as of version 4
4443>>>0x4		lelong		>3
4444>>>>0x17	byte		&0x80	NoCPUShutdown
4445>>0x4		lelong		<4
4446>>>0x18		lelong		>0x23
4447>>>>0x20	leshort		!0
4448>>>>>0x20	lestring16	x	\b, metadata: "%s"
4449>>0x4		lelong		>3
4450>>>0x24		byte		>0	\b, port 1:
4451>>>>0x24	byte		1	joypad
4452>>>>0x24	byte		2	mouse
4453>>>>0x24	byte		3	SuperScope
4454>>>>0x24	byte		4	Justifier
4455>>>>0x24	byte		5	multitap
4456>>>0x24		byte		>0	\b, port 2:
4457>>>>0x25	byte		1	joypad
4458>>>>0x25	byte		2	mouse
4459>>>>0x25	byte		3	SuperScope
4460>>>>0x25	byte		4	Justifier
4461>>>>0x25	byte		5	multitap
4462>>>0x18		lelong		>0x43
4463>>>>0x40	leshort		!0
4464>>>>>0x40	lestring16	x	\b, metadata: "%s"
4465>>0x17		byte		&0x40   \b, ROM:
4466>>>(0x18.l-26)	lelong		x	CRC32 0x%08x
4467>>>(0x18.l-23)	string		x	"%s"
4468
4469# Type: scummVM savegame files
4470# From: Sven Hartge <debian@ds9.argh.org>
44710	string	SCVM	ScummVM savegame
4472>12	string	>\0	"%s"
4473
4474#------------------------------------------------------------------------------
4475# $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $
4476# convex:  file(1) magic for Convex boxes
4477#
4478# Convexes are big-endian.
4479#
4480# /*\
4481#  * Below are the magic numbers and tests added for Convex.
4482#  * Added at beginning, because they are expected to be used most.
4483# \*/
44840	belong	0507	Convex old-style object
4485>16	belong	>0	not stripped
44860	belong	0513	Convex old-style demand paged executable
4487>16	belong	>0	not stripped
44880	belong	0515	Convex old-style pre-paged executable
4489>16	belong	>0	not stripped
44900	belong	0517	Convex old-style pre-paged, non-swapped executable
4491>16	belong	>0	not stripped
44920	belong	0x011257	Core file
4493#
4494# The following are a series of dump format magic numbers.  Each one
4495# corresponds to a drastically different dump format.  The first on is
4496# the original dump format on a 4.1 BSD or earlier file system.  The
4497# second marks the change between the 4.1 file system and the 4.2 file
4498# system.  The Third marks the changing of the block size from 1K
4499# to 2K to be compatible with an IDC file system.  The fourth indicates
4500# a dump that is dependent on Convex Storage Manager, because data in
4501# secondary storage is not physically contained within the dump.
4502# The restore program uses these number to determine how the data is
4503# to be extracted.
4504#
450524	belong	=60013	dump format, 4.2 or 4.3 BSD (IDC compatible)
450624	belong	=60014	dump format, Convex Storage Manager by-reference dump
4507#
4508# what follows is a bunch of bit-mask checks on the flags field of the opthdr.
4509# If there is no `=' sign, assume just checking for whether the bit is set?
4510#
45110	belong	0601		Convex SOFF
4512>88	belong&0x000f0000	=0x00000000	c1
4513>88	belong			&0x00010000	c2
4514>88	belong			&0x00020000	c2mp
4515>88	belong			&0x00040000	parallel
4516>88	belong			&0x00080000	intrinsic
4517>88	belong			&0x00000001	demand paged
4518>88	belong			&0x00000002	pre-paged
4519>88	belong			&0x00000004	non-swapped
4520>88	belong			&0x00000008	POSIX
4521#
4522>84	belong			&0x80000000	executable
4523>84	belong			&0x40000000	object
4524>84	belong&0x20000000	=0		not stripped
4525>84	belong&0x18000000	=0x00000000	native fpmode
4526>84	belong&0x18000000	=0x10000000	ieee fpmode
4527>84	belong&0x18000000	=0x18000000	undefined fpmode
4528#
45290	belong			0605		Convex SOFF core
4530#
45310	belong			0607		Convex SOFF checkpoint
4532>88	belong&0x000f0000	=0x00000000	c1
4533>88	belong			&0x00010000	c2
4534>88	belong			&0x00020000	c2mp
4535>88	belong			&0x00040000	parallel
4536>88	belong			&0x00080000	intrinsic
4537>88	belong			&0x00000008	POSIX
4538#
4539>84	belong&0x18000000	=0x00000000	native fpmode
4540>84	belong&0x18000000	=0x10000000	ieee fpmode
4541>84	belong&0x18000000	=0x18000000	undefined fpmode
4542
4543#------------------------------------------------------------------------------
4544# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $
4545# cracklib:  file (1) magic for cracklib v2.7
4546
45470	lelong	0x70775631	Cracklib password index, little endian
4548>4	long	>0		(%i words)
4549>4	long	0		("64-bit")
4550>>8	long	>-1		(%i words)
45510	belong	0x70775631	Cracklib password index, big endian
4552>4	belong	>-1		(%i words)
4553# really bellong 0x0000000070775631
45540	search/1	\0\0\0\0pwV1	Cracklib password index, big endian ("64-bit")
4555>12	belong	>0		(%i words)
4556
4557# ----------------------------------------------------------------------------
4558# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $
4559# ctags:  file (1) magic for Exuberant Ctags files
4560# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de>
45610	search/1	=!_TAG	Exuberant Ctags tag file text
4562
4563#------------------------------------------------------------------------------
4564# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $
4565# file(1) magic(5) data for cubemaps  Martin Erik Werner <martinerikwerner@gmail.com>
4566#
45670	string	ACMP	Map file for the AssaultCube FPS game
45680	string	CUBE	Map file for cube and cube2 engine games
45690	string	MAPZ)	Map file for the Blood Frontier/Red Eclipse FPS games
4570
4571#------------------------------------------------------------------------------
4572# $File: cups,v 1.2 2012/11/02 21:50:29 christos Exp $
4573# Cups: file(1) magic for the cups raster file format
4574# From: Laurent Martelli <martellilaurent@gmail.com>
4575# http://www.cups.org/documentation.php/spec-raster.html
4576#
4577
45780	name		cups-be
4579>280	lelong		x		\b, %d
4580>284	lelong		x		\bx%d dpi
4581>376	lelong		x		\b, %dx
4582>380	lelong		x		\b%d pixels
4583>388	lelong		x		%d bits/color
4584>392	lelong		x		%d bits/pixel
4585>400	lelong		0		ColorOrder=Chunky
4586>400	lelong		1		ColorOrder=Banded
4587>400	lelong		2		ColorOrder=Planar
4588>404	lelong		0		ColorSpace=gray
4589>404	lelong		1		ColorSpace=RGB
4590>404	lelong		2		ColorSpace=RGBA
4591>404	lelong		3		ColorSpace=black
4592>404	lelong		4		ColorSpace=CMY
4593>404	lelong		5		ColorSpace=YMC
4594>404	lelong		6		ColorSpace=CMYK
4595>404	lelong		7		ColorSpace=YMCK
4596>404	lelong		8		ColorSpace=KCMY
4597>404	lelong		9		ColorSpace=KCMYcm
4598>404	lelong		10		ColorSpace=GMCK
4599>404	lelong		11		ColorSpace=GMCS
4600>404	lelong		12		ColorSpace=WHITE
4601>404	lelong		13		ColorSpace=GOLD
4602>404	lelong		14		ColorSpace=SILVER
4603>404	lelong		15		ColorSpace=CIE XYZ
4604>404	lelong		16		ColorSpace=CIE Lab
4605>404	lelong		17		ColorSpace=RGBW
4606>404	lelong		18		ColorSpace=sGray
4607>404	lelong		19		ColorSpace=sRGB
4608>404	lelong		20		ColorSpace=AdobeRGB
4609
4610# Cups Raster image format, Big Endian
46110	string		RaS
4612>3	string		t		Cups Raster version 1, Big Endian
4613>3	string		2		Cups Raster version 2, Big Endian
4614>3	string		3		Cups Raster version 3, Big Endian
4615!:mime	application/vnd.cups-raster
4616>0	use		^cups-be
4617
4618
4619# Cups Raster image format, Little Endian
46201	string		SaR
4621>0	string		t		Cups Raster version 1, Little Endian
4622>0	string		2		Cups Raster version 2, Little Endian
4623>0	string		3		Cups Raster version 3, Little Endian
4624!:mime	application/vnd.cups-raster
4625>0	use		\^cups-be
4626
4627#------------------------------------------------------------------------------
4628# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $
4629# dact:  file(1) magic for DACT compressed files
4630#
46310	long		0x444354C3	DACT compressed data
4632>4	byte		>-1		(version %i.
4633>5	byte		>-1		$BS%i.
4634>6	byte		>-1		$BS%i)
4635>7	long		>0		$BS, original size: %i bytes
4636>15	long		>30		$BS, block size: %i bytes
4637
4638#------------------------------------------------------------------------------
4639# $File: database,v 1.33 2013/03/09 22:36:00 christos Exp $
4640# database:  file(1) magic for various databases
4641#
4642# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
4643#
4644#
4645# GDBM magic numbers
4646#  Will be maintained as part of the GDBM distribution in the future.
4647#  <downsj@teeny.org>
46480	belong	0x13579ace	GNU dbm 1.x or ndbm database, big endian
4649!:mime	application/x-gdbm
46500	lelong	0x13579ace	GNU dbm 1.x or ndbm database, little endian
4651!:mime	application/x-gdbm
46520	string	GDBM		GNU dbm 2.x database
4653!:mime	application/x-gdbm
4654#
4655# Berkeley DB
4656#
4657# Ian Darwin's file /etc/magic files: big/little-endian version.
4658#
4659# Hash 1.85/1.86 databases store metadata in network byte order.
4660# Btree 1.85/1.86 databases store the metadata in host byte order.
4661# Hash and Btree 2.X and later databases store the metadata in host byte order.
4662
46630	long	0x00061561	Berkeley DB
4664!:mime	application/x-dbm
4665>8	belong	4321
4666>>4	belong	>2		1.86
4667>>4	belong	<3		1.85
4668>>4	belong	>0		(Hash, version %d, native byte-order)
4669>8	belong	1234
4670>>4	belong	>2		1.86
4671>>4	belong	<3		1.85
4672>>4	belong	>0		(Hash, version %d, little-endian)
4673
46740	belong	0x00061561	Berkeley DB
4675>8	belong	4321
4676>>4	belong	>2		1.86
4677>>4	belong	<3		1.85
4678>>4	belong	>0		(Hash, version %d, big-endian)
4679>8	belong	1234
4680>>4	belong	>2		1.86
4681>>4	belong	<3		1.85
4682>>4	belong	>0		(Hash, version %d, native byte-order)
4683
46840	long	0x00053162	Berkeley DB 1.85/1.86
4685>4	long	>0		(Btree, version %d, native byte-order)
46860	belong	0x00053162	Berkeley DB 1.85/1.86
4687>4	belong	>0		(Btree, version %d, big-endian)
46880	lelong	0x00053162	Berkeley DB 1.85/1.86
4689>4	lelong	>0		(Btree, version %d, little-endian)
4690
469112	long	0x00061561	Berkeley DB
4692>16	long	>0		(Hash, version %d, native byte-order)
469312	belong	0x00061561	Berkeley DB
4694>16	belong	>0		(Hash, version %d, big-endian)
469512	lelong	0x00061561	Berkeley DB
4696>16	lelong	>0		(Hash, version %d, little-endian)
4697
469812	long	0x00053162	Berkeley DB
4699>16	long	>0		(Btree, version %d, native byte-order)
470012	belong	0x00053162	Berkeley DB
4701>16	belong	>0		(Btree, version %d, big-endian)
470212	lelong	0x00053162	Berkeley DB
4703>16	lelong	>0		(Btree, version %d, little-endian)
4704
470512	long	0x00042253	Berkeley DB
4706>16	long	>0		(Queue, version %d, native byte-order)
470712	belong	0x00042253	Berkeley DB
4708>16	belong	>0		(Queue, version %d, big-endian)
470912	lelong	0x00042253	Berkeley DB
4710>16	lelong	>0		(Queue, version %d, little-endian)
4711
4712# From Max Bowsher.
471312	long	0x00040988	Berkeley DB
4714>16	long	>0		(Log, version %d, native byte-order)
471512	belong	0x00040988	Berkeley DB
4716>16	belong	>0		(Log, version %d, big-endian)
471712	lelong	0x00040988	Berkeley DB
4718>16	lelong	>0		(Log, version %d, little-endian)
4719
4720#
4721#
4722# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
47230	string	RRD		RRDTool DB
4724>4	string	x		version %s
4725#----------------------------------------------------------------------
4726# ROOT: file(1) magic for ROOT databases
4727#
47280       string  root\0  ROOT file
4729>4      belong  x       Version %d
4730>33     belong  x       (Compression: %d)
4731
4732# XXX: Weak magic.
4733# Alex Ott <ott@jet.msk.su>
4734## Paradox file formats
4735#2	  leshort	0x0800	Paradox
4736#>0x39	  byte		3	v. 3.0
4737#>0x39	  byte		4	v. 3.5
4738#>0x39	  byte		9	v. 4.x
4739#>0x39	  byte		10	v. 5.x
4740#>0x39	  byte		11	v. 5.x
4741#>0x39	  byte		12	v. 7.x
4742#>>0x04	  byte		0	indexed .DB data file
4743#>>0x04	  byte		1	primary index .PX file
4744#>>0x04	  byte		2	non-indexed .DB data file
4745#>>0x04	  byte		3	non-incrementing secondary index .Xnn file
4746#>>0x04	  byte		4	secondary index .Ynn file
4747#>>0x04	  byte		5	incrementing secondary index .Xnn file
4748#>>0x04	  byte		6	non-incrementing secondary index .XGn file
4749#>>0x04	  byte		7	secondary index .YGn file
4750#>>>0x04	  byte		8	incrementing secondary index .XGn file
4751
4752## XBase database files
4753# updated by Joerg Jenderek at Feb 2013
4754# http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
4755# http://www.clicketyclick.dk/databases/xbase/format/dbf.html
4756# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm
4757# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
47580	ubelong&0x0000FFFF		<0x00000C20
4759# skip Infocom game Z-machine
4760>2		ubyte			>0
4761# skip Androids *.xml
4762>>3		ubyte			>0
4763>>>3		ubyte			<32
4764# 1 < version VV
4765>>>>0		ubyte			>1
4766# skip HELP.CA3 by test for reserved byte ( NULL )
4767>>>>>27		ubyte			0
4768# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
4769#>>>>>30		ubeshort     		x		30NULL?%x
4770# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
4771>>>>>>24	ubelong&0xffFFFFff	>0x01302000
4772# .DBF or .MDX
4773>>>>>>24	ubelong&0xffFFFFff	<0x01302001
4774# for Xbase Database file (*.DBF) reserved (NULL) for multi-user
4775>>>>>>>24	ubelong&0xffFFFFff	=0
4776# test for 2 reserved NULL bytes,transaction and encryption byte flag
4777>>>>>>>>12	ubelong&0xFFFFfEfE	0
4778# test for MDX flag
4779>>>>>>>>>28	ubyte			x
4780>>>>>>>>>28	ubyte&0xf8		0
4781# header size >= 32
4782>>>>>>>>>>8	uleshort		>31
4783# skip PIC15736.PCX by test for language driver name or field name
4784>>>>>>>>>>>32	ubyte			>0
4785!:mime	application/x-dbf
4786#!:mime	application/x-dbf; charset=unknown-8bit ??
4787#!:mime	application/x-dbase
4788>>>>>>>>>>>>0	use			xbase-type
4789# database file
4790>>>>>>>>>>>>0	ubyte			x		\b DBF
4791>>>>>>>>>>>>4	lelong			0		\b, no records
4792>>>>>>>>>>>>4	lelong			>0		\b, %ld record
4793# plural s appended
4794>>>>>>>>>>>>>4	lelong			>1		\bs
4795# http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
4796# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000)
4797>>>>>>>>>>>>10	uleshort		x		* %d
4798# file size = records * record size + header size
4799>>>>>>>>>>>>1	ubyte			x		\b, update-date
4800>>>>>>>>>>>>1	use			xbase-date
4801# http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
4802#>>>>>>>>>>>>29	ubyte			=0		\b, codepage ID=0x%x
4803# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ?
4804>>>>>>>>>>>>29	ubyte			>0		\b, codepage ID=0x%x
4805#>>>>>>>>>>>>28	ubyte&0x01		0		\b, no index file
4806>>>>>>>>>>>>28	ubyte&0x01		1		\b, with index file .MDX
4807>>>>>>>>>>>>28	ubyte&0x02		2		\b, with memo .FPT
4808>>>>>>>>>>>>28	ubyte&0x04		4		\b, DataBaseContainer
4809# 1st record offset + 1 = header size
4810>>>>>>>>>>>>8	uleshort		>0
4811>>>>>>>>>>>>(8.s+1)	ubyte		>0
4812>>>>>>>>>>>>>8		uleshort	>0		\b, at offset %d
4813>>>>>>>>>>>>>(8.s+1)	ubyte		>0
4814>>>>>>>>>>>>>>&-1	string		>\0		1st record "%s"
4815# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL)
4816>>>>>>>24	ubelong&0x0133f7ff	>0
4817# test for reserved NULL byte
4818>>>>>>>>47	ubyte			x
4819# test for valid TAG key format (0x10 or 0)
4820>>>>>>>>>559	ubyte&0xeF		0
4821# test MM <= 12
4822>>>>>>>>>45	ubeshort		<0x0C20
4823>>>>>>>>>>45	ubyte			>0
4824>>>>>>>>>>>46	ubyte			<32
4825>>>>>>>>>>>>46	ubyte			>0
4826#!:mime	application/x-mdx
4827>>>>>>>>>>>>>0	use			xbase-type
4828>>>>>>>>>>>>>0	ubyte			x		\b MDX
4829>>>>>>>>>>>>>1	ubyte			x		\b, creation-date
4830>>>>>>>>>>>>>1	use			xbase-date
4831>>>>>>>>>>>>>44	ubyte			x		\b, update-date
4832>>>>>>>>>>>>>44	use			xbase-date
4833# No.of tags in use (1,2,5,12)
4834>>>>>>>>>>>>>28	uleshort		x		\b, %d
4835# No. of entries in tag (0x30)
4836>>>>>>>>>>>>>25	ubyte			x		\b/%d tags
4837#  Length of tag
4838>>>>>>>>>>>>>26	ubyte			x		* %d
4839# 1st tag name_
4840>>>>>>>>>>>>>548	string		x		\b, 1st tag "%.11s"
4841# 2nd tag name
4842#>>>>>>>>>>>>(26.b+548)	string		x		\b, 2nd tag "%.11s"
4843#
4844#		Print the xBase names of different version variants
48450	name				xbase-type
4846>0	ubyte		<2
4847# 1 < version
4848>0	ubyte		>1
4849>>0	ubyte		0x02		FoxBase
4850# FoxBase+/dBaseIII+, no memo
4851>>0	ubyte		0x03		FoxBase+/dBase III
4852# dBASE IV no memo file
4853>>0	ubyte		0x04		dBase IV
4854# dBASE V no memo file
4855>>0	ubyte		0x05		dBase V
4856>>0	ubyte		0x30		Visual FoxPro
4857>>0	ubyte		0x31		Visual FoxPro, autoincrement
4858# Visual FoxPro, with field type Varchar or Varbinary
4859>>0	ubyte		0x32		Visual FoxPro, with field type Varchar
4860# dBASE IV SQL, no memo;dbv memo var size (Flagship)
4861>>0	ubyte		0x43		dBase IV, with SQL table
4862# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
4863#>>0	ubyte		0x62		dBase IV, with SQL table
4864# dBASE IV, with memo!!
4865>>0	ubyte		0x7b		dBase IV, with memo
4866# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
4867#>>0	ubyte		0x82		dBase IV, with SQL system
4868# FoxBase+/dBaseIII+ with memo .DBT!
4869>>0	ubyte		0x83		FoxBase+/dBase III, with memo .DBT
4870# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file
4871>>0	ubyte		0x87		VISUAL OBJECTS, with memo file
4872# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
4873#>>0	ubyte		0x8A		FoxBase+/dBase III, with memo .DBT
4874# dBASE IV with memo!
4875>>0	ubyte		0x8B		dBase IV, with memo .DBT
4876# dBase IV with SQL Table,no memo?
4877>>0	ubyte		0x8E		dBase IV, with SQL table
4878# .dbv and .dbt memo (Flagship)?
4879>>0	ubyte		0xB3		Flagship
4880# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
4881#>>0	ubyte		0xCA		dBase IV with memo .DBT
4882# dBASE IV with SQL table, with memo .DBT
4883>>0	ubyte		0xCB		dBase IV with SQL table, with memo .DBT
4884# HiPer-Six format;Clipper SIX, with SMT memo file
4885>>0	ubyte		0xE5		Clipper SIX with memo
4886# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
4887#>>0	ubyte		0xF4		dBase IV, with SQL table, with memo
4888>>0	ubyte		0xF5		FoxPro with memo
4889# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
4890#>>0	ubyte		0xFA		FoxPro 2.x, with memo
4891# unknown version (should not happen)
4892>>0	default		x		xBase
4893>>>0	ubyte		x		(0x%x)
4894# flags in version byte
4895# DBT flag (with dBASE III memo .DBT)!!
4896# >>0	ubyte&0x80	>0		DBT_FLAG=%x
4897# memo flag ??
4898# >>0	ubyte&0x08	>0		MEMO_FLAG=%x
4899# SQL flag ??
4900# >>0	ubyte&0x70	>0		SQL_FLAG=%x
4901#		test and print the date of xBase .DBF .MDX
49020	name				xbase-date
4903# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
4904>0	ubelong		x
4905>1	ubyte		<13
4906>>1	ubyte		>0
4907>>>2	ubyte		>0
4908>>>>2	ubyte		<32
4909>>>>>0	ubyte		x
4910# YY is interpreted as 20YY or 19YY
4911>>>>>>0	ubyte		<100		\b %.2d
4912# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
4913>>>>>>0	ubyte		>99		\b %d
4914>>>>>1	ubyte		x		\b-%d
4915>>>>>2	ubyte		x		\b-%d
4916
4917#	dBase memo files .DBT or .FPT
4918# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
491916		ubyte		<4
4920>16		ubyte		!2
4921>>16		ubyte		!1
4922# next free block index is positive
4923>>>0		ulelong		>0
4924# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
4925>>>>17		ubelong&0xFFfdFE00	0x00000000
4926# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
4927>>>>>20		ubelong&0xFF01209B	0x00000000
4928# dBASE III
4929>>>>>>16	ubyte		3
4930# dBASE III DBT
4931>>>>>>>0	use		xbase-memo-print
4932# dBASE IV DBT , FoxPro FPT or many PNG , ZIP , DBF garbage
4933>>>>>>16	ubyte		0
4934# dBASE IV DBT with DBF name or DBF garbage
4935>>>>>>>8	ubelong		>0x40000000
4936# skip DBF and catch dBASE IV DBT with DBF name and with non big index of next free block
4937>>>>>>>>0	ulelong		<0x01010002
4938>>>>>>>>>0	use		xbase-memo-print
4939>>>>>>>8	ubelong		0
4940# skip MM*DD*.bin by test for for reserved NULL byte
4941>>>>>>>>508	ubelong		0
4942>>>>>>>>>0	use		xbase-memo-print
4943# garbage PCX , ZIP , JAR , XPI
4944>>>>>>>8	default		x
4945
4946#		Print the information of dBase DBT or FoxPro FPT memo files
49470	name				xbase-memo-print
4948>0	ubyte			x
4949# test version
4950# memo file
4951>>16	ubyte			3		dBase III DBT
4952>>16	ubyte			0
4953>>>512	ubelong			<0x00000003	FoxPro FPT
4954# Size of blocks for FoxPro
4955>>>>6	ubeshort		x		\b, blocks size %lu
4956# Number of next available block for appending data for FoxPro
4957>>>>0	ubelong			=0		\b, next free block index %lu
4958>>>>0	ubelong			!0		\b, next free block index %lu
4959>>>512	default			x		dBase IV DBT
4960# DBF file name without extension
4961>>>>8	string			>\0		\b of %-.8s.DBF
4962# size of blocks  ; not reliable 0x2020204C
4963#>>>>4	ulelong			=0		\b, blocks size %lu
4964>>>>4	ulelong			!0		\b, blocks size %lu
4965# Block length found 0 , 512
4966#>>>>20	uleshort		=0		\b, block length %u
4967>>>>20	uleshort		!0		\b, block length %u
4968# Number of next available block for appending data
4969>>>>0	ulelong			=0		\b, next free block index %lu
4970>>>>0	ulelong			!0		\b, next free block index %lu
4971>>512	ubelong			x
4972>>>512	ubelong			=0xFFFF0800
4973>>>>520	string			>\0		\b, 1st used item "%s"
4974# FoxPro
4975>>>512	ubelong			<3
4976# FoxPro memo
4977>>>>512	ubelong			=1
4978>>>>520	string			>\0		\b, 1st used item "%s"
4979>>>512	default			x
4980# may be deleted memo field
4981>>>>512	string			>\0		\b, 1st item "%s"
4982
4983# TODO:
4984# DBASE index file *.NDX
4985# DBASE Compound Index file *.CDX
4986# dBASE IV Printer Driver *.PRF
4987## End of XBase database stuff
4988
4989# MS Access database
49904	string	Standard\ Jet\ DB	Microsoft Access Database
4991!:mime	application/x-msaccess
49924	string	Standard\ ACE\ DB	Microsoft Access Database
4993!:mime	application/x-msaccess
4994
4995# TDB database from Samba et al - Martin Pool <mbp@samba.org>
49960	string	TDB\ file		TDB database
4997>32	lelong	0x2601196D		version 6, little-endian
4998>>36	lelong	x			hash size %d bytes
4999
5000# SE Linux policy database
50010       lelong  0xf97cff8c      SE Linux policy
5002>16     lelong  x               v%d
5003>20     lelong  1      MLS
5004>24     lelong  x       %d symbols
5005>28     lelong  x       %d ocons
5006
5007# ICE authority file data (Wolfram Kleff)
50082	string		ICE		ICE authority data
5009
5010# X11 Xauthority file (Wolfram Kleff)
501110	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
501211	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
501312	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
501413	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
501514	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
501615	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
501716	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
501817	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
501918	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
5020
5021# From: Maxime Henrion <mux@FreeBSD.org>
5022# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org>
50230	string		PGDMP		PostgreSQL custom database dump
5024>5	byte		x		- v%d
5025>6	byte		x		\b.%d
5026>5	beshort		<0x101		\b-0
5027>5	beshort		>0x100
5028>>7	byte		x		\b-%d
5029
5030# Type: Advanced Data Format (ADF) database
5031# URL:  http://www.grc.nasa.gov/WWW/cgns/adf/
5032# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr>
50330	string	@(#)ADF\ Database	CGNS Advanced Data Format
5034
5035# Tokyo Cabinet magic data
5036# http://tokyocabinet.sourceforge.net/index.html
50370	string		ToKyO\ CaBiNeT\n	Tokyo Cabinet
5038>14	string		x			\b (%s)
5039>32	byte		0			\b, Hash
5040!:mime	application/x-tokyocabinet-hash
5041>32	byte		1			\b, B+ tree
5042!:mime	application/x-tokyocabinet-btree
5043>32	byte		2			\b, Fixed-length
5044!:mime	application/x-tokyocabinet-fixed
5045>32	byte		3			\b, Table
5046!:mime	application/x-tokyocabinet-table
5047>33	byte		&1			\b, [open]
5048>33	byte		&2			\b, [fatal]
5049>34	byte		x			\b, apow=%d
5050>35	byte		x			\b, fpow=%d
5051>36	byte		&0x01			\b, [large]
5052>36	byte		&0x02			\b, [deflate]
5053>36	byte		&0x04			\b, [bzip]
5054>36	byte		&0x08			\b, [tcbs]
5055>36	byte		&0x10			\b, [excodec]
5056>40	lequad		x			\b, bnum=%lld
5057>48	lequad		x			\b, rnum=%lld
5058>56	lequad		x			\b, fsiz=%lld
5059
5060# Type:	QDBM Quick Database Manager
5061# From:	Benoit Sibaud <bsibaud@april.org>
50620	string		\\[depot\\]\n\f		Quick Database Manager, little endian
50630	string		\\[DEPOT\\]\n\f		Quick Database Manager, big endian
5064
5065# Type:	TokyoCabinet database
5066# URL:	http://tokyocabinet.sourceforge.net/
5067# From:	Benoit Sibaud <bsibaud@april.org>
50680	string		ToKyO\ CaBiNeT\n	TokyoCabinet database
5069>14	string		x			(version %s)
5070
5071# From:  Stephane Blondon http://www.yaal.fr
5072# Database file for Zope (done by FileStorage)
50730	string		FS21	Zope Object Database File Storage (data)
5074# Cache file for the database of Zope (done by ClientStorage)
50750	string		ZEC3	Zope Object Database Client Cache File (data)
5076
5077# IDA (Interactive Disassembler) database
50780	string		IDA1	IDA (Interactive Disassembler) database
5079
5080#------------------------------------------------------------------------------
5081# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $
5082# diamond:  file(1) magic for Diamond system
5083#
5084# ... diamond is a multi-media mail and electronic conferencing system....
5085#
5086# XXX - I think it was either renamed Slate, or replaced by Slate....
5087#
5088#	The full deal is too long...
5089#0	string	<list>\n<protocol\ bbn-multimedia-format>	Diamond Multimedia Document
50900	string	=<list>\n<protocol\ bbn-m	Diamond Multimedia Document
5091
5092#------------------------------------------------------------------------------
5093# $File: diff,v 1.14 2012/09/16 23:08:54 christos Exp $
5094# diff:  file(1) magic for diff(1) output
5095#
50960	search/1	diff\ 		diff output text
5097!:mime	text/x-diff
50980	search/1	***\ 		diff output text
5099!:mime	text/x-diff
51000	search/1	Only\ in\ 	diff output text
5101!:mime	text/x-diff
51020	search/1	Common\ subdirectories:\ 	diff output text
5103!:mime	text/x-diff
5104
51050	search/1	Index:		RCS/CVS diff output text
5106!:mime	text/x-diff
5107
5108# bsdiff:  file(1) magic for bsdiff(1) output
51090	string/b		BSDIFF40	bsdiff(1) patch file
5110
5111
5112# unified diff
51130	search/4096	---\
5114>&0	search/1024 \n
5115>>&0	search/1 +++\
5116>>>&0	search/1024 \n
5117>>>>&0	search/1 @@	unified diff output text
5118!:mime	text/x-diff
5119!:strength + 90
5120
5121# librsync -- the library for network deltas
5122#
5123# Copyright (C) 2001 by Martin Pool.  You may do whatever you want with
5124# this file.
5125#
51260	belong		0x72730236	rdiff network-delta data
5127
51280	belong		0x72730136	rdiff network-delta signature data
5129>4	belong		x		(block length=%d,
5130>8	belong		x		signature strength=%d)
5131
5132#------------------------------------------------------------------------------
5133# $File: digital,v 1.11 2013/01/11 16:45:23 christos Exp $
5134#  Digital UNIX - Info
5135#
51360	string	=!<arch>\n________64E	Alpha archive
5137>22	string	X			-- out of date
5138#
5139
51400	leshort		0603
5141>24	leshort		0410		COFF format alpha pure
5142>24	leshort		0413		COFF format alpha demand paged
5143>>22	leshort&030000	!020000		executable
5144>>22	leshort&020000	!0		dynamically linked
5145>>16	lelong		!0		not stripped
5146>>16	lelong		0		stripped
5147>>27	byte		x		- version %d
5148>>26	byte		x		\b.%d
5149>>28	byte		x		\b-%d
5150>24	leshort		0407		COFF format alpha object
5151>>22	leshort&030000	020000		shared library
5152>>27	byte		x		- version %d
5153>>26	byte		x		\b.%d
5154>>28	byte		x		\b-%d
5155
5156# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
5157#
5158# The actual magic number is just "Core", followed by a 2-byte version
5159# number; however, treating any file that begins with "Core" as a Digital
5160# UNIX core dump file may produce too many false hits, so we include one
5161# byte of the version number as well; DU 5.0 appears only to be up to
5162# version 2.
5163#
51640	string		Core\001	Alpha COFF format core dump (Digital UNIX)
5165>24	string		>\0		\b, from '%s'
51660	string		Core\002	Alpha COFF format core dump (Digital UNIX)
5167>24	string		>\0		\b, from '%s'
5168#
5169# The next is incomplete, we could tell more about this format,
5170# but its not worth it.
51710	leshort		0x188	Alpha compressed COFF
51720	leshort		0x18f	Alpha u-code object
5173#
5174#
5175# Some other interesting Digital formats,
51760	string	\377\377\177		ddis/ddif
51770	string	\377\377\174		ddis/dots archive
51780	string	\377\377\176		ddis/dtif table data
51790	string	\033c\033		LN03 output
51800	long	04553207		X image
5181#
51820	string	=!<PDF>!\n		profiling data file
5183#
5184# Locale data tables (MIPS and Alpha).
5185#
51860	short		0x0501		locale data table
5187>6	short		0x24		for MIPS
5188>6	short		0x40		for Alpha
5189
5190#------------------------------------------------------------------------------
5191# $File: dolby,v 1.6 2012/10/31 13:39:42 christos Exp $
5192# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
5193# from http://www.atsc.org/standards/a_52a.pdf
5194# corrections, additions, etc. are always welcome!
5195#
5196# syncword
51970       beshort         0x0b77  ATSC A/52 aka AC-3 aka Dolby Digital stream,
5198!:mime	audio/vnd.dolby.dd-raw
5199# fscod
5200>4      byte&0xc0       0x00    48 kHz,
5201>4      byte&0xc0       0x40    44.1 kHz,
5202>4      byte&0xc0       0x80    32 kHz,
5203# is this one used for 96 kHz?
5204>4      byte&0xc0       0xc0    reserved frequency,
5205#
5206>5	byte&7 = 0		\b, complete main (CM)
5207>5	byte&7 = 1		\b, music and effects (ME)
5208>5	byte&7 = 2		\b, visually impaired (VI)
5209>5	byte&7 = 3		\b, hearing impaired (HI)
5210>5	byte&7 = 4		\b, dialogue (D)
5211>5	byte&7 = 5		\b, commentary (C)
5212>5	byte&7 = 6		\b, emergency (E)
5213# acmod
5214>6      byte&0xe0       0x00    1+1 front,
5215>6      byte&0xe0       0x20    1 front/0 rear,
5216>6      byte&0xe0       0x40    2 front/0 rear,
5217>6      byte&0xe0       0x60    3 front/0 rear,
5218>6      byte&0xe0       0x80    2 front/1 rear,
5219>6      byte&0xe0       0xa0    3 front/1 rear,
5220>6      byte&0xe0       0xc0    2 front/2 rear,
5221>6      byte&0xe0       0xe0    3 front/2 rear,
5222# lfeon (these may be incorrect)
5223>7      byte&0x40       0x00    LFE off,
5224>7      byte&0x40       0x40    LFE on,
5225#
5226>4	byte&0x3e = 0x00	\b, 32 kbit/s
5227>4	byte&0x3e = 0x02        \b, 40 kbit/s
5228>4	byte&0x3e = 0x04        \b, 48 kbit/s
5229>4	byte&0x3e = 0x06        \b, 56 kbit/s
5230>4	byte&0x3e = 0x08        \b, 64 kbit/s
5231>4	byte&0x3e = 0x0a        \b, 80 kbit/s
5232>4	byte&0x3e = 0x0c        \b, 96 kbit/s
5233>4	byte&0x3e = 0x0e        \b, 112 kbit/s
5234>4	byte&0x3e = 0x10        \b, 128 kbit/s
5235>4	byte&0x3e = 0x12        \b, 160 kbit/s
5236>4	byte&0x3e = 0x14        \b, 192 kbit/s
5237>4	byte&0x3e = 0x16        \b, 224 kbit/s
5238>4	byte&0x3e = 0x18        \b, 256 kbit/s
5239>4	byte&0x3e = 0x1a        \b, 320 kbit/s
5240>4	byte&0x3e = 0x1c        \b, 384 kbit/s
5241>4	byte&0x3e = 0x1e        \b, 448 kbit/s
5242>4	byte&0x3e = 0x20        \b, 512 kbit/s
5243>4	byte&0x3e = 0x22        \b, 576 kbit/s
5244>4	byte&0x3e = 0x24        \b, 640 kbit/s
5245# dsurmod (these may be incorrect)
5246>6      beshort&0x0180  0x0000  Dolby Surround not indicated
5247>6      beshort&0x0180  0x0080  not Dolby Surround encoded
5248>6      beshort&0x0180  0x0100  Dolby Surround encoded
5249>6      beshort&0x0180  0x0180  reserved Dolby Surround mode
5250
5251#------------------------------------------------------------------------------
5252# $File: dump,v 1.12 2012/11/01 04:26:40 christos Exp $
5253# dump:  file(1) magic for dump file format--for new and old dump filesystems
5254#
5255# We specify both byte orders in order to recognize byte-swapped dumps.
5256#
52570	name	new-dump-be
5258>4	bedate	x		Previous dump %s,
5259>8	bedate	x		This dump %s,
5260>12	belong	>0		Volume %ld,
5261>692	belong	0		Level zero, type:
5262>692	belong	>0		Level %d, type:
5263>0	belong	1		tape header,
5264>0	belong	2		beginning of file record,
5265>0	belong	3		map of inodes on tape,
5266>0	belong	4		continuation of file record,
5267>0	belong	5		end of volume,
5268>0	belong	6		map of inodes deleted,
5269>0	belong	7		end of medium (for floppy),
5270>676	string	>\0		Label %s,
5271>696	string	>\0		Filesystem %s,
5272>760	string	>\0		Device %s,
5273>824	string	>\0		Host %s,
5274>888	belong	>0		Flags %x
5275
52760	name	old-dump-be
5277#>4	bedate	x		Previous dump %s,
5278#>8	bedate	x		This dump %s,
5279>12	belong	>0		Volume %ld,
5280>692	belong	0		Level zero, type:
5281>692	belong	>0		Level %d, type:
5282>0	belong	1		tape header,
5283>0	belong	2		beginning of file record,
5284>0	belong	3		map of inodes on tape,
5285>0	belong	4		continuation of file record,
5286>0	belong	5		end of volume,
5287>0	belong	6		map of inodes deleted,
5288>0	belong	7		end of medium (for floppy),
5289>676	string	>\0		Label %s,
5290>696	string	>\0		Filesystem %s,
5291>760	string	>\0		Device %s,
5292>824	string	>\0		Host %s,
5293>888	belong	>0		Flags %x
5294
52950	name	ufs2-dump-be
5296>896	beqdate	x		Previous dump %s,
5297>904	beqdate	x		This dump %s,
5298>12	belong	>0		Volume %ld,
5299>692	belong	0		Level zero, type:
5300>692	belong	>0		Level %d, type:
5301>0	belong	1		tape header,
5302>0	belong	2		beginning of file record,
5303>0	belong	3		map of inodes on tape,
5304>0	belong	4		continuation of file record,
5305>0	belong	5		end of volume,
5306>0	belong	6		map of inodes deleted,
5307>0	belong	7		end of medium (for floppy),
5308>676	string	>\0		Label %s,
5309>696	string	>\0		Filesystem %s,
5310>760	string	>\0		Device %s,
5311>824	string	>\0		Host %s,
5312>888	belong	>0		Flags %x
5313
531424	belong	60012		new-fs dump file (big endian),
5315>0	use	new-dump-be
5316
531724	belong	60011		old-fs dump file (big endian),
5318>0	use	old-dump-be
5319
532024	lelong	60012		new-fs dump file (little endian),
5321>0	use	\^new-dump-be
5322
532324	lelong	60011		old-fs dump file (little endian),
5324>0	use	\^old-dump-be
5325
5326
532724	belong	0x19540119	new-fs dump file (ufs2, big endian),
5328>0	use	ufs2-dump-be
5329
533024	lelong	0x19540119	new-fs dump file (ufs2, little endian),
5331>0	use	\^ufs2-dump-be
5332
533318	leshort	60011		old-fs dump file (16-bit, assuming PDP-11 endianness),
5334>2	medate	x		Previous dump %s,
5335>6	medate	x		This dump %s,
5336>10	leshort	>0		Volume %ld,
5337>0	leshort	1		tape header.
5338>0	leshort	2		beginning of file record.
5339>0	leshort	3		map of inodes on tape.
5340>0	leshort	4		continuation of file record.
5341>0	leshort	5		end of volume.
5342>0	leshort	6		map of inodes deleted.
5343>0	leshort	7		end of medium (for floppy).
5344
5345#------------------------------------------------------------------------------
5346# $File: dyadic,v 1.5 2010/09/20 18:55:20 rrt Exp $
5347# Dyadic: file(1) magic for Dyalog APL.
5348#
53490	byte	0xaa
5350>1	byte	<4		Dyalog APL
5351>>1	byte	0x00		incomplete workspace
5352>>1	byte	0x01		component file
5353>>1	byte	0x02		external variable
5354>>1	byte	0x03		workspace
5355>>2	byte	x		version %d
5356>>3	byte	x		.%d
5357
53580	beshort		0xaa03		Dyalog APL
5359>2	byte		x		workspace type %d
5360>3	byte		x		subtype %d
5361>7	byte&0x28	0x00		32-bit
5362>7	byte&0x28	0x20		64-bit
5363>7	byte&0x0c	0x00		classic
5364>7	byte&0x0c	0x04		unicode
5365>7	byte&0x88	0x00		big-endian
5366>7	byte&0x88	0x80		little-endian
5367
53680	byte		0xaa		Dyalog APL
5369>1	byte		0x00		aplcore
5370>1	byte		0x01		component file 32-bit non-journaled non-checksummed
5371>1	byte		0x02		external variable exclusive
5372>1	byte		0x06		external variable shared
5373>1	byte		0x07		session
5374>1	byte		0x08		mapped file 32-bit
5375>1	byte		0x09		component file 64-bit non-journaled non-checksummed
5376>1	byte		0x0a		mapped file 64-bit
5377>1	byte		0x0b		component file 32-bit level 1 journaled non-checksummed
5378>1	byte		0x0c		component file 64-bit level 1 journaled non-checksummed
5379>1	byte		0x0d		component file 32-bit level 1 journaled checksummed
5380>1	byte		0x0e		component file 64-bit level 1 journaled checksummed
5381>1	byte		0x0f		component file 32-bit level 2 journaled checksummed
5382>1	byte		0x10		component file 64-bit level 2 journaled checksummed
5383>1	byte		0x11		component file 32-bit level 3 journaled checksummed
5384>1	byte		0x12		component file 64-bit level 3 journaled checksummed
5385>1	byte		0x13		component file 32-bit non-journaled checksummed
5386>1	byte		0x14		component file 64-bit non-journaled checksummed
5387>1	byte		0x80		DDB
5388
53890	short		0x6060		Dyalog APL transfer
5390
5391#------------------------------------------------------------------------------
5392# $File: ebml,v 1.1 2010/07/02 00:07:03 christos Exp $
5393# ebml:  file(1) magic for various Extensible Binary Meta Language
5394# http://www.matroska.org/technical/specs/index.html#track
53950	belong	0x1a45dfa3	EBML file
5396>4	search/b/100	\102\202
5397>>&1	string	x		\b, creator %.8s
5398
5399#------------------------------------------------------------------------------
5400# $File: editors,v 1.8 2009/09/19 16:28:09 christos Exp $
5401# T602 editor documents
5402# by David Necas <yeti@physics.muni.cz>
54030	string	@CT\ 	T602 document data,
5404>4	string	0	Kamenicky
5405>4	string	1	CP 852
5406>4	string	2	KOI8-CS
5407>4	string	>2	unknown encoding
5408
5409# Vi IMproved Encrypted file
5410# by David Necas <yeti@physics.muni.cz>
54110	string	VimCrypt~	Vim encrypted file data
5412# Vi IMproved Swap file
5413# by Sven Wegener <swegener@gentoo.org>
54140	string	b0VIM\ 		Vim swap file
5415>&0	string	>\0		\b, version %s
5416
5417#------------------------------------------------------------------------------
5418# $File: efi,v 1.4 2009/09/19 16:28:09 christos Exp $
5419# efi:  file(1) magic for Universal EFI binaries
5420
54210	lelong	0x0ef1fab9
5422>4	lelong	1		Universal EFI binary with 1 architecture
5423>>&0	lelong	7		\b, i386
5424>>&0	lelong	0x01000007	\b, x86_64
5425>4	lelong	2		Universal EFI binary with 2 architectures
5426>>&0	lelong	7		\b, i386
5427>>&0	lelong	0x01000007	\b, x86_64
5428>>&20	lelong	7		\b, i386
5429>>&20	lelong	0x01000007	\b, x86_64
5430>4	lelong	>2		Universal EFI binary with %ld architectures
5431
5432#------------------------------------------------------------------------------
5433# $File: elf,v 1.59 2013/03/21 17:50:02 christos Exp $
5434# elf:  file(1) magic for ELF executables
5435#
5436# We have to check the byte order flag to see what byte order all the
5437# other stuff in the header is in.
5438#
5439# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
5440#
5441# Created by: unknown
5442# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com>
5443# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support)
5444# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support)
5445# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium)
5446# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures)
5447
54480	name		elf-le
5449>16	leshort		0		no file type,
5450!:mime	application/octet-stream
5451>16	leshort		1		relocatable,
5452!:mime	application/x-object
5453>16	leshort		2		executable,
5454!:mime	application/x-executable
5455>16	leshort		3		shared object,
5456!:mime	application/x-sharedlib
5457>16	leshort		4		core file
5458!:mime	application/x-coredump
5459# Core file detection is not reliable.
5460#>>>(0x38+0xcc) string	>\0		of '%s'
5461#>>>(0x38+0x10) lelong	>0		(signal %d),
5462>16	leshort		&0xff00		processor-specific,
5463>18	leshort		0		no machine,
5464>18	leshort		1		AT&T WE32100
5465>18	leshort		2		SPARC
5466>18	leshort		3		Intel 80386,
5467>18	leshort		4		Motorola
5468>>4	byte		1
5469>>>36	lelong		&0x01000000	68000 - invalid byte order,
5470>>>36	lelong		&0x00810000	CPU32 - invalid byte order,
5471>>>36	lelong		0		68020 - invalid byte order,
5472>18	leshort		5		Motorola 88000 - invalid byte order,
5473>18	leshort		6		Intel 80486,
5474>18	leshort		7		Intel 80860,
5475# The official e_machine number for MIPS is now #8, regardless of endianness.
5476# The second number (#10) will be deprecated later. For now, we still
5477# say something if #10 is encountered, but only gory details for #8.
5478>18	leshort		8		MIPS,
5479>>4	byte		1
5480>>>36	lelong		&0x20		N32
5481>18	leshort		10		MIPS,
5482>>4	byte		1
5483>>>36	lelong		&0x20		N32
5484>18	leshort		8
5485# only for 32-bit
5486>>4	byte		1
5487>>>36  lelong&0xf0000000	0x00000000	MIPS-I
5488>>>36  lelong&0xf0000000	0x10000000	MIPS-II
5489>>>36  lelong&0xf0000000	0x20000000	MIPS-III
5490>>>36  lelong&0xf0000000	0x30000000	MIPS-IV
5491>>>36  lelong&0xf0000000	0x40000000	MIPS-V
5492>>>36  lelong&0xf0000000	0x50000000	MIPS32
5493>>>36  lelong&0xf0000000	0x60000000	MIPS64
5494>>>36  lelong&0xf0000000	0x70000000	MIPS32 rel2
5495>>>36  lelong&0xf0000000	0x80000000	MIPS64 rel2
5496# only for 64-bit
5497>>4	byte		2
5498>>>48  lelong&0xf0000000	0x00000000	MIPS-I
5499>>>48  lelong&0xf0000000	0x10000000	MIPS-II
5500>>>48  lelong&0xf0000000	0x20000000	MIPS-III
5501>>>48  lelong&0xf0000000	0x30000000	MIPS-IV
5502>>>48  lelong&0xf0000000	0x40000000	MIPS-V
5503>>>48  lelong&0xf0000000	0x50000000	MIPS32
5504>>>48  lelong&0xf0000000	0x60000000	MIPS64
5505>>>48  lelong&0xf0000000	0x70000000	MIPS32 rel2
5506>>>48  lelong&0xf0000000	0x80000000	MIPS64 rel2
5507>18	leshort		9		Amdahl - invalid byte order,
5508>18	leshort		10		MIPS (deprecated),
5509>18	leshort		11		RS6000 - invalid byte order,
5510>18	leshort		15		PA-RISC - invalid byte order,
5511# only for 32-bit
5512>>4	byte		1
5513>>>38	leshort		0x0214		2.0
5514>>>36	leshort		&0x0008		(LP64)
5515# only for 64-bit
5516>>4	byte		2
5517>>>50	leshort		0x0214		2.0
5518>>>48	leshort		&0x0008		(LP64)
5519>18	leshort		16		nCUBE,
5520>18	leshort		17		Fujitsu VPP500,
5521>18	leshort		18		SPARC32PLUS,
5522# only for 32-bit
5523>>4	byte		1
5524>>>36	lelong&0xffff00	0x000100	V8+ Required,
5525>>>36	lelong&0xffff00	0x000200	Sun UltraSPARC1 Extensions Required,
5526>>>36	lelong&0xffff00	0x000400	HaL R1 Extensions Required,
5527>>>36	lelong&0xffff00	0x000800	Sun UltraSPARC3 Extensions Required,
5528>18	leshort		20		PowerPC or cisco 4500,
5529>18	leshort		21		64-bit PowerPC or cisco 7500,
5530>18	leshort		22		IBM S/390,
5531>18	leshort		23		Cell SPU,
5532>18	leshort		24		cisco SVIP,
5533>18	leshort		25		cisco 7200,
5534>18	leshort		36		NEC V800 or cisco 12000,
5535>18	leshort		37		Fujitsu FR20,
5536>18	leshort		38		TRW RH-32,
5537>18	leshort		39		Motorola RCE,
5538>18	leshort		40		ARM,
5539>>4	byte		1
5540>>>36	lelong&0xff000000	0x04000000	EABI4
5541>>>36	lelong&0xff000000	0x05000000	EABI5
5542>18	leshort		41		Alpha,
5543>18	leshort		0xa390		IBM S/390 (obsolete),
5544>18	leshort		42		Renesas SH,
5545>18	leshort		43		SPARC V9,
5546>>4	byte		2
5547>>>48	lelong&0xffff00	0x000200	Sun UltraSPARC1 Extensions Required,
5548>>>48	lelong&0xffff00	0x000400	HaL R1 Extensions Required,
5549>>>48	lelong&0xffff00	0x000800	Sun UltraSPARC3 Extensions Required,
5550>>>48	lelong&0x3	0		total store ordering,
5551>>>48	lelong&0x3	1		partial store ordering,
5552>>>48	lelong&0x3	2		relaxed memory ordering,
5553>18	leshort		44		Siemens Tricore Embedded Processor,
5554>18	leshort		45		Argonaut RISC Core, Argonaut Technologies Inc.,
5555>18	leshort		46		Renesas H8/300,
5556>18	leshort		47		Renesas H8/300H,
5557>18	leshort		48		Renesas H8S,
5558>18	leshort		49		Renesas H8/500,
5559>18	leshort		50		IA-64,
5560>18	leshort		51		Stanford MIPS-X,
5561>18	leshort		52		Motorola Coldfire,
5562>18	leshort		53		Motorola M68HC12,
5563>18	leshort		54		Fujitsu MMA,
5564>18	leshort		55		Siemens PCP,
5565>18	leshort		56		Sony nCPU,
5566>18	leshort		57		Denso NDR1,
5567>18	leshort		58		Start*Core,
5568>18	leshort		59		Toyota ME16,
5569>18	leshort		60		ST100,
5570>18	leshort		61		Tinyj emb.,
5571>18	leshort		62		x86-64,
5572>18	leshort		63		Sony DSP,
5573>18	leshort		66		FX66,
5574>18	leshort		67		ST9+ 8/16 bit,
5575>18	leshort		68		ST7 8 bit,
5576>18	leshort		69		MC68HC16,
5577>18	leshort		70		MC68HC11,
5578>18	leshort		71		MC68HC08,
5579>18	leshort		72		MC68HC05,
5580>18	leshort		73		SGI SVx or Cray NV1,
5581>18	leshort		74		ST19 8 bit,
5582>18	leshort		75		Digital VAX,
5583>18	leshort		76		Axis cris,
5584>18	leshort		77		Infineon 32-bit embedded,
5585>18	leshort		78		Element 14 64-bit DSP,
5586>18	leshort		79		LSI Logic 16-bit DSP,
5587>18	leshort		80		MMIX,
5588>18	leshort		81		Harvard machine-independent,
5589>18	leshort		82		SiTera Prism,
5590>18	leshort		83		Atmel AVR 8-bit,
5591>18	leshort		84		Fujitsu FR30,
5592>18	leshort		85		Mitsubishi D10V,
5593>18	leshort		86		Mitsubishi D30V,
5594>18	leshort		87		NEC v850,
5595>18	leshort		88		Renesas M32R,
5596>18	leshort		89		Matsushita MN10300,
5597>18	leshort		90		Matsushita MN10200,
5598>18	leshort		91		picoJava,
5599>18	leshort		92		OpenRISC,
5600>18	leshort		93		ARC Cores Tangent-A5,
5601>18	leshort		94		Tensilica Xtensa,
5602>18	leshort		97		NatSemi 32k,
5603>18	leshort		106		Analog Devices Blackfin,
5604>18	leshort		113		Altera Nios II,
5605>18	leshort		174		META,
5606>18	leshort		183		ARM aarch64,
5607>18	leshort		187		Tilera TILE64,
5608>18	leshort		188		Tilera TILEPro,
5609>18	leshort		191		Tilera TILE-Gx,
5610>18	leshort		0x3426		OpenRISC (obsolete),
5611>18	leshort		0x8472		OpenRISC (obsolete),
5612>18	leshort		0x9026		Alpha (unofficial),
5613>20	lelong		0		invalid version
5614>20	lelong		1		version 1
5615
56160	string		\177ELF		ELF
5617!:strength *2
5618>4	byte		0		invalid class
5619>4	byte		1		32-bit
5620>4	byte		2		64-bit
5621>5	byte		0		invalid byte order
5622>5	byte		1		LSB
5623>>0	use		elf-le
5624>5	byte		2		MSB
5625>>0	use		\^elf-le
5626# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
5627# like proper ELF, but extracting the string had bad results.
5628>4      byte            <0x80
5629>>8	string		>\0		(%s)
5630>8	string		\0
5631>>7	byte		0		(SYSV)
5632>>7	byte		1		(HP-UX)
5633>>7	byte		2		(NetBSD)
5634>>7	byte		3		(GNU/Linux)
5635>>7	byte		4		(GNU/Hurd)
5636>>7	byte		5		(86Open)
5637>>7	byte		6		(Solaris)
5638>>7	byte		7		(Monterey)
5639>>7	byte		8		(IRIX)
5640>>7	byte		9		(FreeBSD)
5641>>7	byte		10		(Tru64)
5642>>7	byte		11		(Novell Modesto)
5643>>7	byte		12		(OpenBSD)
5644>8      string          \2
5645>>7     byte            13              (OpenVMS)
5646>>7	byte		97		(ARM)
5647>>7	byte		255		(embedded)
5648
5649#------------------------------------------------------------------------------
5650# $File: encore,v 1.6 2009/09/19 16:28:09 christos Exp $
5651# encore:  file(1) magic for Encore machines
5652#
5653# XXX - needs to have the byte order specified (NS32K was little-endian,
5654# dunno whether they run the 88K in little-endian mode or not).
5655#
56560	short		0x154		Encore
5657>20	short		0x107		executable
5658>20	short		0x108		pure executable
5659>20	short		0x10b		demand-paged executable
5660>20	short		0x10f		unsupported executable
5661>12	long		>0		not stripped
5662>22	short		>0		- version %ld
5663>22	short		0		-
5664#>4	date		x		stamp %s
56650	short		0x155		Encore unsupported executable
5666>12	long		>0		not stripped
5667>22	short		>0		- version %ld
5668>22	short		0		-
5669#>4	date		x		stamp %s
5670
5671#------------------------------------------------------------------------------
5672# $File: epoc,v 1.8 2012/06/16 14:43:36 christos Exp $
5673# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1]
5674# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de>
5675# Useful information for improving this file can be found at:
5676# http://software.frodo.looijaard.name/psiconv/formats/Index.html
5677#------------------------------------------------------------------------------
56780	lelong		0x10000037	Psion Series 5
5679>4	lelong		0x10000039	font file
5680>4	lelong		0x1000003A	printer driver
5681>4	lelong		0x1000003B	clipboard
5682>4	lelong		0x10000042	multi-bitmap image
5683!:mime image/x-epoc-mbm
5684>4	lelong		0x1000006A	application information file
5685>4	lelong		0x1000006D
5686>>8	lelong		0x1000007D	Sketch image
5687!:mime image/x-epoc-sketch
5688>>8	lelong		0x1000007E	voice note
5689>>8	lelong		0x1000007F	Word file
5690!:mime application/x-epoc-word
5691>>8	lelong		0x10000085	OPL program (TextEd)
5692!:mime application/x-epoc-opl
5693>>8	lelong		0x10000087	Comms settings
5694>>8	lelong		0x10000088	Sheet file
5695!:mime application/x-epoc-sheet
5696>>8	lelong		0x100001C4	EasyFax initialisation file
5697>4	lelong		0x10000073	OPO module
5698!:mime application/x-epoc-opo
5699>4	lelong		0x10000074	OPL application
5700!:mime application/x-epoc-app
5701>4	lelong		0x1000008A	exported multi-bitmap image
5702>4	lelong		0x1000016D
5703>>8	lelong		0x10000088	Comms names
5704
57050	lelong		0x10000041	Psion Series 5 ROM multi-bitmap image
5706
57070	lelong		0x10000050	Psion Series 5
5708>4	lelong		0x1000006D	database
5709>>8	lelong		0x10000084	Agenda file
5710!:mime application/x-epoc-agenda
5711>>8	lelong		0x10000086	Data file
5712!:mime application/x-epoc-data
5713>>8	lelong		0x10000CEA	Jotter file
5714!:mime application/x-epoc-jotter
5715>4	lelong		0x100000E4	ini file
5716
57170	lelong		0x10000079	Psion Series 5 binary:
5718>4	lelong		0x00000000	DLL
5719>4	lelong		0x10000049	comms hardware library
5720>4	lelong		0x1000004A	comms protocol library
5721>4	lelong		0x1000005D	OPX
5722>4	lelong		0x1000006C	application
5723>4	lelong		0x1000008D	DLL
5724>4	lelong		0x100000AC	logical device driver
5725>4	lelong		0x100000AD	physical device driver
5726>4	lelong		0x100000E5	file transfer protocol
5727>4	lelong		0x100000E5	file transfer protocol
5728>4	lelong		0x10000140	printer definition
5729>4	lelong		0x10000141	printer definition
5730
57310	lelong		0x1000007A	Psion Series 5 executable
5732
5733#------------------------------------------------------------------------------
5734# $File: erlang,v 1.6 2010/09/20 19:19:17 rrt Exp $
5735# erlang:  file(1) magic for Erlang JAM and BEAM files
5736# URL:  http://www.erlang.org/faq/x779.html#AEN812
5737
5738# OTP R3-R4
57390	string	\0177BEAM!	Old Erlang BEAM file
5740>6	short	>0		- version %d
5741
5742# OTP R5 and onwards
57430	string	FOR1
5744>8	string	BEAM		Erlang BEAM file
5745
5746# 4.2 version may have a copyright notice!
57474	string	Tue\ Jan\ 22\ 14:32:44\ MET\ 1991	Erlang JAM file - version 4.2
574879	string	Tue\ Jan\ 22\ 14:32:44\ MET\ 1991	Erlang JAM file - version 4.2
5749
57504	string	1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995	Erlang JAM file - version 4.3
5751
57520	bequad	0x0000000000ABCDEF	Erlang DETS file
5753
5754#------------------------------------------------------------------------------
5755# $File: esri,v 1.4 2009/09/19 16:28:09 christos Exp $
5756# ESRI Shapefile format (.shp .shx .dbf=DBaseIII)
5757# Based on info from
5758# <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf>
57590	belong	9994	ESRI Shapefile
5760>4	belong	=0
5761>8	belong	=0
5762>12	belong	=0
5763>16	belong	=0
5764>20	belong	=0
5765>28	lelong	x	version %d
5766>24	belong	x	length %d
5767>32	lelong	=0	type Null Shape
5768>32	lelong	=1	type Point
5769>32	lelong	=3	type PolyLine
5770>32	lelong	=5	type Polygon
5771>32	lelong	=8	type MultiPoint
5772>32	lelong	=11	type PointZ
5773>32	lelong	=13	type PolyLineZ
5774>32	lelong	=15	type PolygonZ
5775>32	lelong	=18	type MultiPointZ
5776>32	lelong	=21	type PointM
5777>32	lelong	=23	type PolyLineM
5778>32	lelong	=25	type PolygonM
5779>32	lelong	=28	type MultiPointM
5780>32	lelong	=31	type MultiPatch
5781
5782#------------------------------------------------------------------------------
5783# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $
5784# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files
5785# From Roger Leigh <roger@whinlatter.uklinux.net>
57860       string          FCS1.0          Flow Cytometry Standard (FCS) data, version 1.0
57870       string          FCS2.0          Flow Cytometry Standard (FCS) data, version 2.0
57880       string          FCS3.0          Flow Cytometry Standard (FCS) data, version 3.0
5789
5790
5791#------------------------------------------------------------------------------
5792# $File: filesystems,v 1.77 2013/03/14 01:38:30 christos Exp $
5793# filesystems:  file(1) magic for different filesystems
5794#
57950	string	\366\366\366\366	PC formatted floppy with no filesystem
5796# Sun disk labels
5797# From /usr/include/sun/dklabel.h:
57980774	beshort		0xdabe
5799# modified by Joerg Jenderek, because original test
5800# succeeds for Cabinet archive dao360.dl_ with negative blocks
5801>0770	long		>0		Sun disk label
5802>>0	string		x		'%s
5803>>>31	string		>\0		\b%s
5804>>>>63	string		>\0		\b%s
5805>>>>>95	string		>\0		\b%s
5806>>0	string		x		\b'
5807>>0734	short		>0		%d rpm,
5808>>0736	short		>0		%d phys cys,
5809>>0740	short		>0		%d alts/cyl,
5810>>0746	short		>0		%d interleave,
5811>>0750	short		>0		%d data cyls,
5812>>0752	short		>0		%d alt cyls,
5813>>0754	short		>0		%d heads/partition,
5814>>0756	short		>0		%d sectors/track,
5815>>0764	long		>0		start cyl %ld,
5816>>0770	long		x		%ld blocks
5817# Is there a boot block written 1 sector in?
5818>512    belong&077777777	0600407	\b, boot block present
5819
5820# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk
5821# (http://btmgr.sourceforge.net/docs/user-guide-3.html)
58220		string	SBMBAKUP_	Smart Boot Manager backup file
5823>9		string	x		\b, version %-5.5s
5824>>14		string	=_
5825>>>15		string	x		%-.1s
5826>>>>16		string	=_		\b.
5827>>>>>17		string	x		\b%-.1s
5828>>>>>>18	string	=_		\b.
5829>>>>>>>19	string	x		\b%-.1s
5830>>>22		ubyte	0
5831>>>>21		ubyte	x		\b, from drive 0x%x
5832>>>22		ubyte	>0
5833>>>>21		string	x		\b, from drive %s
5834>>>535		search/17	\x55\xAA
5835>>>>&-512	indirect	x	\b; contains
5836
5837# updated by Joerg Jenderek at Nov 2012
5838# DOS Emulator image is 128 byte, null right padded header + harddisc image
58390	string	DOSEMU\0
5840>0x27E	leshort	0xAA55
5841#offset is 128
5842>>19	ubyte	128
5843>>>(19.b-1)	ubyte	0x0	DOS Emulator image
5844>>>>7	ulelong	>0		\b, %u heads
5845>>>>11	ulelong	>0		\b, %d sectors/track
5846>>>>15	ulelong	>0		\b, %d cylinders
5847>>>>128	indirect	x	\b; contains
5848
5849# x86 boot sector updated by Joerg Jenderek at Sep 2007,May 2011
5850# for any allowed sector sizes
585130		search/481	\x55\xAA
5852# to display x86 boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
5853# DOS BPB information (70) and after DOS floppy (120) like in previous file version
5854!:strength +72
5855# for sector sizes < 512 Bytes
5856>11		uleshort	<512
5857>>(11.s-2)	uleshort	0xAA55		x86 boot sector
5858# for sector sizes with 512 or more Bytes
5859>0x1FE		leshort		0xAA55		x86 boot sector
5860# keep old x86 boot sector as dummy for mbr and bootloader displaying
5861# only for sector sizes with 512 or more Bytes
58620x1FE	leshort	0xAA55
5863# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
5864!:strength +21
5865>2	string	OSBS			\b, OS/BS MBR
5866# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
5867# and http://en.wikipedia.org/wiki/Master_Boot_Record
5868# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
5869# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00
5870>0	search/2	\x33\xc0\x8e\xd0\xbc\x00\x7c	MS-MBR
5871# Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm )
5872# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld
5873>>8	ubequad		0x8bf45007501ffbfc
5874# http://thestarman.pcministry.com/asm/mbr/200MBR.htm
5875>>>0x16	ubyte		0xF3				\b,DOS 2
5876>>>>219	regex		Author\ -\ 			Author:
5877# found "David Litton" , "A Pehrsson  "
5878>>>>>&0	string		x				"%s"
5879>>>0x16	ubyte		0xF2
5880# NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm
5881# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz
5882>>>>0x22	ubequad	0xbf7c07813d5aa575		\b,NEC 3.3
5883# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111)
5884>>>>0x22	default	x				\b,D0S version 3.3-7.0
5885# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...)
5886# where nn is string offset varying for different languages
5887# "Invalid partition table"				nn=0x8b for english version
5888>>>>>(0x49.b)	string		Invalid\ partition\ table		english
5889>>>>>(0x49.b)	string		Ung\201ltige\ Partitionstabelle		german
5890>>>>>(0x49.b)	string		Table\ de\ partition\ invalide		french
5891>>>>>(0x49.b)	string		Tabela\ de\ parti\207ao\ inv\240lida	portuguese
5892>>>>>(0x49.b)	string		Tabla\ de\ partici\242n\ no\ v\240lida	spanish
5893>>>>>(0x49.b)	string		Tavola\ delle\ partizioni\ non\ valida	italian
5894>>>>>0x49	ubyte		>0			at offset 0x%x
5895>>>>>>(0x49.b)	string		>\0			"%s"
5896# "Error loading operating system"			nn=0xa3 for english version
5897# "Fehler beim Laden des Betriebssystems"		nn=0xa7 for german version
5898# "Erreur en chargeant syst\212me d'exploitation"	nn=0xa7 for french version
5899# "Erro na inicializa\207ao do sistema operacional"	nn=0xa7 for portuguese Brazilian version
5900# "Error al cargar sistema operativo"			nn=0xa8 for spanish version
5901# "Errore durante il caricamento del sistema operativo"	nn=0xae for italian version
5902>>>>>0x74	ubyte		>0			at offset 0x%x
5903>>>>>>(0x74.b)	string		>\0			"%s"
5904# "Missing operating system"				nn=0xc2 for english version
5905# "Betriebssystem fehlt"				nn=0xcd for german version
5906# "Syst\212me d'exploitation absent"			nn=0xd2 for french version
5907# "Sistema operacional nao encontrado"			nn=0xd4 for portuguese Brazilian version
5908# "Falta sistema operativo"				nn=0xca for spanish version
5909# "Sistema operativo mancante"				nn=0xe2 for italian version
5910>>>>>0x79	ubyte		>0			at offset 0x%x
5911>>>>>>(0x79.b)	string		>\0			"%s"
5912# Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
5913# assembler instructions: push ax;pop es;push  ax;pop ds;cld;mov si,7c1b
5914>>8	ubequad		0x5007501ffcbe1b7c
5915# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04
5916>>>24		ubequad	0xf3a4cbbebe07b104		9M
5917# "Invalid partition table"				nn=0x10F for english version
5918# "Ungültige Partitionstabelle"				nn=0x10F for german version
5919# "Table de partition erronée"				nn=0x10F for french version
5920# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240"	nn=0x10F for russian version
5921>>>>(0x3C.b+0x0FF)	string	Invalid\ partition\ table		english
5922>>>>(0x3C.b+0x0FF)	string	Ung\201ltige\ Partitionstabelle		german
5923>>>>(0x3C.b+0x0FF)	string	Table\ de\ partition\ erron\202e	french
5924>>>>(0x3C.b+0x0FF)	string	\215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240	russian
5925>>>>0x3C		ubyte	x			at offset 0x%x+0xFF
5926>>>>(0x3C.b+0x0FF)	string	>\0			"%s"
5927# "Error loading operating system"			nn=0x127 for english version
5928# "Fehler beim Laden des Betriebssystems"		nn=0x12b for german version
5929# "Erreur lors du chargement du système d'exploitation"	nn=0x12a for french version
5930# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353"	nn=0x12d for russian version
5931>>>>0xBD		ubyte	x			at offset 0x1%x
5932>>>>(0xBD.b+0x100)	string	>\0			"%s"
5933# "Missing operating system"				nn=0x146 for english version
5934# "Betriebssystem fehlt"				nn=0x151 for german version
5935# "Système d'exploitation manquant"			nn=0x15e for french version
5936# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240"	nn=0x156 for russian version
5937>>>>0xA9		ubyte	x			at offset 0x1%x
5938>>>>(0xA9.b+0x100)	string	>\0			"%s"
5939# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm
5940# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04
5941>>>24		ubequad	0xf3a4cbbdbe07b104		XP
5942# where xxyyzz are lower bits from offsets of error messages varying for different languages
5943>>>>0x1B4	ubelong&0x00FFFFFF	0x002c4463	english
5944>>>>0x1B4	ubelong&0x00FFFFFF	0x002c486e	german
5945# "Invalid partition table"				xx=0x12C for english version
5946# "Ungültige Partitionstabelle"				xx=0x12C for german version
5947>>>>0x1b5	ubyte		>0			at offset 0x1%x
5948>>>>(0x1b5.b+0x100)	string	>\0			"%s"
5949# "Error loading operating system"			yy=0x144 for english version
5950# "Fehler beim Laden des Betriebssystems"		yy=0x148 for german version
5951>>>>0x1b6	ubyte		>0			at offset 0x1%x
5952>>>>(0x1b6.b+0x100)	string	>\0			"%s"
5953# "Missing operating system"				zz=0x163 for english version
5954# "Betriebssystem nicht vorhanden"			zz=0x16e for german version
5955>>>>0x1b7	ubyte		>0			at offset 0x1%x
5956>>>>(0x1b7.b+0x100)	string	>\0			"%s"
5957# Microsoft Windows Vista or 7
5958# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00
5959>>8	ubequad		0xc08ed8be007cbf00
5960# Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm)
5961# assembler instructions: jnz 0729;cmp ebx,"TCPA"
5962>>>0xEC		ubequad	0x753b6681fb544350		Vista
5963# where xxyyzz are lower bits from offsets of error messages varying for different languages
5964>>>>0x1B4	ubelong&0x00FFFFFF	0x00627a99	english
5965#>>>>0x1B4	ubelong&0x00FFFFFF	?		german
5966# "Invalid partition table"				xx=0x162 for english version
5967# "Ungültige Partitionstabelle"				xx=0x1?? for german version
5968>>>>0x1b5	ubyte		>0			at offset 0x1%x
5969>>>>(0x1b5.b+0x100)	string	>\0			"%s"
5970# "Error loading operating system"			yy=0x17a for english version
5971# "Fehler beim Laden des Betriebssystems"		yy= 0x1?? for german version
5972>>>>0x1b6	ubyte		>0			at offset 0x1%x
5973>>>>(0x1b6.b+0x100)	string	>\0			"%s"
5974# "Missing operating system"				zz=0x199 for english version
5975# "Betriebssystem nicht vorhanden"			zz=0x1?? for german version
5976>>>>0x1b7	ubyte		>0			at offset 0x1%x
5977>>>>(0x1b7.b+0x100)	string	>\0			"%s"
5978# Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm)
5979# assembler instructions: cmp ebx,"TCPA";cmp
5980>>>0xEC		ubequad	0x6681fb5443504175		Windows 7
5981# where xxyyzz are lower bits from offsets of error messages varying for different languages
5982>>>>0x1B4	ubelong&0x00FFFFFF	0x00637b9a	english
5983#>>>>0x1B4	ubelong&0x00FFFFFF	?		german
5984# "Invalid partition table"				xx=0x163 for english version
5985# "Ungültige Partitionstabelle"				xx=0x1?? for german version
5986>>>>0x1b5	ubyte		>0			at offset 0x1%x
5987>>>>(0x1b5.b+0x100)	string	>\0			"%s"
5988# "Error loading operating system"			yy=0x17b for english version
5989# "Fehler beim Laden des Betriebssystems"		yy=0x1?? for german version
5990>>>>0x1b6	ubyte		>0			at offset 0x1%x
5991>>>>(0x1b6.b+0x100)	string	>\0			"%s"
5992# "Missing operating system"				zz=0x19a for english version
5993# "Betriebssystem nicht vorhanden"			zz=0x1?? for german version
5994>>>>0x1b7	ubyte		>0			at offset 0x1%x
5995>>>>(0x1b7.b+0x100)	string	>\0			"%s"
5996# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs
5997# http://en.wikipedia.org/wiki/MBR_disk_signature#ID
5998>>0x1b8	ulelong		>0				\b, disk signature 0x%-.4x
5999# driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm
6000>>0xDA	uleshort		0
6001>>>0xDC 	ulelong		>0			\b, created
6002# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive
6003>>>>0xDC	ubyte		x			with driveID 0x%x
6004# hours, minutes and seconds
6005>>>>0xDf	ubyte		x			at %x
6006>>>>0xDe	ubyte		x			\b:%x
6007>>>>0xDd	ubyte		x			\b:%x
6008# special case for Microsoft MS-DOS 3.21 spanish
6009# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov
6010>0	ubequad		0xfab830008ed0bc00
6011# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov
6012>>8	ubequad		0x1fbfcb800008ed8		MS-MBR,D0S version 3.21 spanish
6013# Microsoft MBR IPL end
6014
6015# dr-dos with some upper-, lowercase variants
6016>0x9D	string	Invalid\ partition\ table$
6017>>181	string	No\ Operating\ System$
6018>>>201	string	Operating\ System\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
6019>0x9D	string	Invalid\ partition\ table$
6020>>181	string	No\ operating\ system$
6021>>>201	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
6022>342	string	Invalid\ partition\ table$
6023>>366	string	No\ operating\ system$
6024>>>386	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, version 7.01 to 7.03
6025>295	string	NEWLDR\0
6026>>302	string	Bad\ PT\ $
6027>>>310	string	No\ OS\ $
6028>>>>317	string	OS\ load\ err$
6029>>>>>329	string	Moved\ or\ missing\ IBMBIO.LDR\n\r
6030>>>>>>358	string	Press\ any\ key\ to\ continue.\n\r$
6031>>>>>>>387	string	Copyright\ (c)\ 1984,1998
6032>>>>>>>>411	string	Caldera\ Inc.\0		\b, DR-DOS MBR (IBMBIO.LDR)
6033#
6034# tests for different MS-DOS Master Boot Records (MBR) moved and merged
6035#
6036#>0x145	string	Default:\ F				\b, FREE-DOS MBR
6037#>0x14B	string	Default:\ F				\b, FREE-DOS 1.0 MBR
6038>0x145	search/7	Default:\ F			\b, FREE-DOS MBR
6039#>>313		string	F0\ .\ .\ .
6040#>>>322		string	disk\ 1
6041#>>>>382	string	FAT3
6042>64	string	no\ active\ partition\ found
6043>>96	string	read\ error\ while\ reading\ drive	\b, FREE-DOS Beta 0.9 MBR
6044# Ranish Partition Manager http://www.ranish.com/part/
6045>387	search/4	\0\ Error!\r
6046>>378	search/7	Virus!
6047>>>397	search/4	Booting\
6048>>>>408	search/4	HD1/\0	 			\b, Ranish MBR (
6049>>>>>416	string	Writing\ changes...		\b2.37
6050>>>>>>438	ubyte		x			\b,0x%x dots
6051>>>>>>440	ubyte		>0			\b,virus check
6052>>>>>>441	ubyte		>0			\b,partition %c
6053#2.38,2.42,2.44
6054>>>>>416	string	!Writing\ changes...		\b
6055>>>>>>418	ubyte	1				\bvirus check,
6056>>>>>>419	ubyte	x				\b0x%x seconds
6057>>>>>>420	ubyte&0x0F	>0			\b,partition
6058>>>>>>>420	ubyte&0x0F	<5			\b %x
6059>>>>>>>420	ubyte&0x0F	0Xf			\b ask
6060>>>>>420	ubyte		x			\b)
6061#
6062# SYSLINUX MBR moved
6063# http://www.acronis.de/
6064>362	string	MBR\ Error\ \0\r
6065>>376	string	ress\ any\ key\ to\
6066>>>392	string	boot\ from\ floppy...\0			\b, Acronis MBR
6067# added by Joerg Jenderek
6068# http://www.visopsys.org/
6069# http://partitionlogic.org.uk/
6070>309	string	No\ bootable\ partition\ found\r
6071>>339	string	I/O\ Error\ reading\ boot\ sector\r	\b, Visopsys MBR
6072>349	string	No\ bootable\ partition\ found\r
6073>>379	string	I/O\ Error\ reading\ boot\ sector\r	\b, simple Visopsys MBR
6074# bootloader, bootmanager
6075>0x40	string	SBML
6076# label with 11 characters of FAT 12 bit filesystem
6077>>43	string	SMART\ BTMGR
6078>>>430	string	SBMK\ Bad!\r			\b, Smart Boot Manager
6079# OEM-ID not always "SBM"
6080#>>>>3	strings	SBM
6081>>>>6	string	>\0                             \b, version %s
6082>382	string	XOSLLOADXCF			\b, eXtended Operating System Loader
6083>6	string	LILO				\b, LInux i386 boot LOader
6084>>120	string	LILO				\b, version 22.3.4 SuSe
6085>>172	string	LILO				\b, version 22.5.8 Debian
6086# updated by Joerg Jenderek at Oct 2008
6087# variables according to grub-0.97/stage1/stage1.S or
6088# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
6089# usual values are marked with comments to get only informations of strange GRUB loaders
6090>342		search/60	\0Geom\0
6091#>0		ulelong		x		%x=0x009048EB ,	0x2a9048EB  0
6092>>0x41		ubyte		<2
6093>>>0x3E		ubyte		>2		\b; GRand Unified Bootloader
6094# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
6095>>>>0x3E	ubyte		x		\b, stage1 version 0x%x
6096#If it is 0xFF, use a drive passed by BIOS
6097>>>>0x40	ubyte		<0xFF		\b, boot drive 0x%x
6098# in most case 0,1,0x2e for GRUB 0.5.95
6099>>>>0x41	ubyte		>0		\b, LBA flag 0x%x
6100>>>>0x42	uleshort	<0x8000		\b, stage2 address 0x%x
6101#>>>>0x42	uleshort	=0x8000		\b, stage2 address 0x%x (usual)
6102>>>>0x42	uleshort	>0x8000		\b, stage2 address 0x%x
6103#>>>>0x44	ulelong		=1		\b, 1st sector stage2 0x%x (default)
6104>>>>0x44	ulelong		>1		\b, 1st sector stage2 0x%x
6105>>>>0x48	uleshort	<0x800		\b, stage2 segment 0x%x
6106#>>>>0x48	uleshort	=0x800		\b, stage2 segment 0x%x (usual)
6107>>>>0x48	uleshort	>0x800		\b, stage2 segment 0x%x
6108>>>>402		string	Geom\0Hard\ Disk\0Read\0\ Error\0
6109>>>>>394	string	stage1			\b, GRUB version 0.5.95
6110>>>>382		string	Geom\0Hard\ Disk\0Read\0\ Error\0
6111>>>>>376	string	GRUB\ \0		\b, GRUB version 0.93 or 1.94
6112>>>>383		string	Geom\0Hard\ Disk\0Read\0\ Error\0
6113>>>>>377	string	GRUB\ \0		\b, GRUB version 0.94
6114>>>>385		string	Geom\0Hard\ Disk\0Read\0\ Error\0
6115>>>>>379	string	GRUB\ \0		\b, GRUB version 0.95 or 0.96
6116>>>>391		string	Geom\0Hard\ Disk\0Read\0\ Error\0
6117>>>>>385	string	GRUB\ \0		\b, GRUB version 0.97
6118#unknown version
6119>>>343		string	Geom\0Read\0\ Error\0
6120>>>>321		string	Loading\ stage1.5	\b, GRUB version x.y
6121>>>380		string	Geom\0Hard\ Disk\0Read\0\ Error\0
6122>>>>374		string	GRUB\ \0		\b, GRUB version n.m
6123# SYSLINUX bootloader moved
6124>395	string	chksum\0\ ERROR!\0		\b, Gujin bootloader
6125# http://www.bcdwb.de/bcdw/index_e.htm
6126>3	string	BCDL
6127>>498	string	BCDL\ \ \ \ BIN			\b, Bootable CD Loader (1.50Z)
6128# mbr partition table entries
6129# OEM-ID does not contain MicroSoft,NEWLDR,DOS,SYSLINUX,or MTOOLs
6130>3			string		!MS
6131>>3			string		!SYSLINUX
6132>>>3			string		!MTOOL
6133>>>>3			string		!NEWLDR
6134>>>>>5			string		!DOS
6135# not FAT (32 bit)
6136>>>>>>82		string		!FAT32
6137#not Linux kernel
6138>>>>>>>514		string		!HdrS
6139#not BeOS
6140>>>>>>>>422		string		!Be\ Boot\ Loader
6141# active flag 0 or 0x80 and type > 0
6142>>>>>>>>>446		ubyte		<0x81
6143>>>>>>>>>>446		ubyte&0x7F	0
6144>>>>>>>>>>>450		ubyte		>0	\b; partition 1: ID=0x%x
6145>>>>>>>>>>>>446		ubyte		0x80	\b, active
6146>>>>>>>>>>>>447		ubyte		x	\b, starthead %u
6147#>>>>>>>>>>>>448		ubyte		x	\b, start C_S: 0x%x
6148#>>>>>>>>>>>>448		ubeshort&1023	x	\b, startcylinder? %d
6149>>>>>>>>>>>>454		ulelong		x	\b, startsector %u
6150>>>>>>>>>>>>458		ulelong		x	\b, %u sectors
6151#
6152>>>>>>>>>462		ubyte		<0x81
6153>>>>>>>>>>462		ubyte&0x7F	0
6154>>>>>>>>>>>466		ubyte		>0	\b; partition 2: ID=0x%x
6155>>>>>>>>>>>>462		ubyte		0x80	\b, active
6156>>>>>>>>>>>>463		ubyte		x	\b, starthead %u
6157#>>>>>>>>>>>>464		ubyte		x	\b, start C_S: 0x%x
6158#>>>>>>>>>>>>464		ubeshort&1023	x	\b, startcylinder? %d
6159>>>>>>>>>>>>470		ulelong		x	\b, startsector %u
6160>>>>>>>>>>>>474		ulelong		x	\b, %u sectors
6161#
6162>>>>>>>>>478		ubyte		<0x81
6163>>>>>>>>>>478		ubyte&0x7F	0
6164>>>>>>>>>>>482		ubyte		>0	\b; partition 3: ID=0x%x
6165>>>>>>>>>>>>478		ubyte		0x80	\b, active
6166>>>>>>>>>>>>479		ubyte		x	\b, starthead %u
6167#>>>>>>>>>>>>480		ubyte		x	\b, start C_S: 0x%x
6168#>>>>>>>>>>>>481		ubyte		x	\b, start C2S: 0x%x
6169#>>>>>>>>>>>>480		ubeshort&1023	x	\b, startcylinder? %d
6170>>>>>>>>>>>>486		ulelong		x	\b, startsector %u
6171>>>>>>>>>>>>490		ulelong		x	\b, %u sectors
6172#
6173>>>>>>>>>494		ubyte		<0x81
6174>>>>>>>>>>494		ubyte&0x7F	0
6175>>>>>>>>>>>498		ubyte		>0	\b; partition 4: ID=0x%x
6176>>>>>>>>>>>>494		ubyte		0x80	\b, active
6177>>>>>>>>>>>>495		ubyte		x	\b, starthead %u
6178#>>>>>>>>>>>>496		ubyte		x	\b, start C_S: 0x%x
6179#>>>>>>>>>>>>496		ubeshort&1023	x	\b, startcylinder? %d
6180>>>>>>>>>>>>502		ulelong		x	\b, startsector %u
6181>>>>>>>>>>>>506		ulelong		x	\b, %u sectors
6182# mbr partition table entries end
6183# http://www.acronis.de/
6184#FAT label=ACRONIS\ SZ
6185#OEM-ID=BOOTWIZ0
6186>442	string	Non-system\ disk,\
6187>>459	string	press\ any\ key...\x7\0		\b, Acronis Startup Recovery Loader
6188# updated by Joerg Jenderek at Nov 2012
6189# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
6190>>>477		ubyte&0xDF	>0
6191>>>>477		string		x 		\b %-.3s
6192>>>>>480	ubyte&0xDF	>0
6193>>>>>>480	string		x 		\b%-.4s
6194>>>>>>>484	ubyte&0xDF	>0
6195>>>>>>>>484	string		x 		\b%-.1s
6196>>>>485		ubyte&0xDF	>0
6197>>>>>485	string		x 		\b.%-.3s
6198#
6199>185	string	FDBOOT\ Version\
6200>>204	string	\rNo\ Systemdisk.\
6201>>>220	string	Booting\ from\ harddisk.\n\r
6202>>>245	string	Cannot\ load\ from\ harddisk.\n\r
6203>>>>273 string	Insert\ Systemdisk\
6204>>>>>291 string and\ press\ any\ key.\n\r		\b, FDBOOT harddisk Bootloader
6205>>>>>>200 string	>\0                             \b, version %-3s
6206>242	string	Bootsector\ from\ C.H.\ Hochst\204
6207# http://freecode.com/projects/dosfstools	dosfstools-n.m/src/mkdosfs.c
6208# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string
6209# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut
6210>242	search/127	Bootsector\ from\ C.H.\ Hochst
6211>>278	search/127	No\ Systemdisk.\ Booting\ from\ harddisk
6212# followed by variants with point,CR-NL or NL-CR
6213>>>208	search/261	Cannot\ load\ from\ harddisk.
6214# followed by variants CR-NL or NL-CR
6215>>>>236	search/235	Insert\ Systemdisk\ and\ press\ any\ key.
6216# followed by variants with point,CR-NL or NL-CR
6217>>>>>180	search/96	Disk\ formatted\ with\ WinImage\ 	\b, WinImage harddisk Bootloader
6218# followed by string like "6.50 (c) 1993-2004 Gilles Vollant"
6219>>>>>>&0	string		x 					\b, version %-4.4s
6220>(1.b+2)	ubyte		0xe
6221>>(1.b+3)	ubyte		0x1f
6222>>>(1.b+4)	ubyte		0xbe
6223# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others
6224>>>>(1.b+5)	ubyte&0xd3	0x53
6225>>>>>(1.b+6)	ubyte		0x7c
6226# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah,
6227>>>>>>(1.b+7)	ubyte		0xac
6228>>>>>>>(1.b+8)	ubyte		0x22
6229>>>>>>>>(1.b+9)	ubyte		0xc0
6230>>>>>>>>>(1.b+10)	ubyte	0x74
6231>>>>>>>>>>(1.b+11)	ubyte	0x0b
6232>>>>>>>>>>>(1.b+12)	ubyte	0x56
6233>>>>>>>>>>>>(1.b+13)	ubyte	0xb4			\b, mkdosfs boot message display
6234# FAT1X version
6235>>>>>>>>>>>>>(1.b+5)	ubyte	0x5b
6236>>>>>>>>>>>>>>0x5b	string	>\0			"%-s"
6237# FAT32 version
6238>>>>>>>>>>>>>(1.b+5)	ubyte	0x77
6239>>>>>>>>>>>>>>0x77	string	>\0			"%-s"
6240>214	string	Please\ try\ to\ install\ FreeDOS\ 	\b, DOS Emulator boot message display
6241#>>244	string	from\ dosemu-freedos-*-bin.tgz\r
6242#>>>170	string	Sorry,\ could\ not\ load\ an\
6243#>>>>195	string	operating\ system.\r\n
6244#
6245>103	string	This\ is\ not\ a\ bootable\ disk.\
6246>>132	string	Please\ insert\ a\ bootable\
6247>>>157	string	floppy\ and\r\n
6248>>>>169	string	press\ any\ key\ to\ try\ again...\r	\b, FREE-DOS message display
6249#
6250>66	string	Solaris\ Boot\ Sector
6251>>99	string	Incomplete\ MDBoot\ load.
6252>>>89	string	Version 				\b, Sun Solaris Bootloader
6253>>>>97	byte	x					version %c
6254#
6255>408	string	OS/2\ !!\ SYS01475\r\0
6256>>429	string	OS/2\ !!\ SYS02025\r\0
6257>>>450	string	OS/2\ !!\ SYS02027\r\0
6258>>>469	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp bootloader
6259#
6260>409	string	OS/2\ !!\ SYS01475\r\0
6261>>430	string	OS/2\ !!\ SYS02025\r\0
6262>>>451	string	OS/2\ !!\ SYS02027\r\0
6263>>>470	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp Bootloader
6264>112		string	This\ disk\ is\ not\ bootable\r
6265>>142		string	If\ you\ wish\ to\ make\ it\ bootable
6266>>>176		string	run\ the\ DOS\ program\ SYS\
6267>>>200		string	after\ the\r
6268>>>>216		string	system\ has\ been\ loaded\r\n
6269>>>>>242	string	Please\ insert\ a\ DOS\ diskette\
6270>>>>>271	string	into\r\n\ the\ drive\ and\
6271>>>>>>292	string	strike\ any\ key...\0		\b, IBM OS/2 Warp message display
6272# XP
6273>430	string	NTLDR\ is\ missing\xFF\r\n
6274>>449	string	Disk\ error\xFF\r\n
6275>>>462	string	Press\ any\ key\ to\ restart\r		\b, Microsoft Windows XP Bootloader
6276# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
6277>>>>417		ubyte&0xDF	>0
6278>>>>>417	string		x			%-.5s
6279>>>>>>422	ubyte&0xDF	>0
6280>>>>>>>422	string		x 			\b%-.3s
6281>>>>>425	ubyte&0xDF	>0
6282>>>>>>425	string		>\ 			\b.%-.3s
6283#
6284>>>>371		ubyte		>0x20
6285>>>>>368	ubyte&0xDF	>0
6286>>>>>>368	string		x 			%-.5s
6287>>>>>>>373	ubyte&0xDF	>0
6288>>>>>>>>373	string		x 			\b%-.3s
6289>>>>>>376	ubyte&0xDF	>0
6290>>>>>>>376	string		x 			\b.%-.3s
6291#
6292>430	string	NTLDR\ nicht\ gefunden\xFF\r\n
6293>>453	string	Datentr\204gerfehler\xFF\r\n
6294>>>473	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (german)
6295>>>>417		ubyte&0xDF	>0
6296>>>>>417	string		x			%-.5s
6297>>>>>>422	ubyte&0xDF	>0
6298>>>>>>>422	string		x 			\b%-.3s
6299>>>>>425	ubyte&0xDF	>0
6300>>>>>>425	string		>\ 			\b.%-.3s
6301# offset variant
6302>>>>379	string	\0
6303>>>>>368	ubyte&0xDF	>0
6304>>>>>>368	string		x 			%-.5s
6305>>>>>>>373	ubyte&0xDF	>0
6306>>>>>>>>373	string		x 			\b%-.3s
6307#
6308>430	string	NTLDR\ fehlt\xFF\r\n
6309>>444	string	Datentr\204gerfehler\xFF\r\n
6310>>>464	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (2.german)
6311>>>>417		ubyte&0xDF	>0
6312>>>>>417	string		x			%-.5s
6313>>>>>>422	ubyte&0xDF	>0
6314>>>>>>>422	string		x 			\b%-.3s
6315>>>>>425	ubyte&0xDF	>0
6316>>>>>>425	string		>\ 			\b.%-.3s
6317# variant
6318>>>>371		ubyte		>0x20
6319>>>>>368	ubyte&0xDF	>0
6320>>>>>>368	string		x 			%-.5s
6321>>>>>>>373	ubyte&0xDF	>0
6322>>>>>>>>373	string		x 			\b%-.3s
6323>>>>>>376	ubyte&0xDF	>0
6324>>>>>>>376	string		x 			\b.%-.3s
6325#
6326>430	string	NTLDR\ fehlt\xFF\r\n
6327>>444	string	Medienfehler\xFF\r\n
6328>>>459	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (3.german)
6329>>>>371		ubyte		>0x20
6330>>>>>368	ubyte&0xDF	>0
6331>>>>>>368	string		x 			%-.5s
6332>>>>>>>373	ubyte&0xDF	>0
6333>>>>>>>>373	string		x 			\b%-.3s
6334>>>>>>376	ubyte&0xDF	>0
6335>>>>>>>376	string		x 			\b.%-.3s
6336# variant
6337>>>>417		ubyte&0xDF	>0
6338>>>>>417	string		x			%-.5s
6339>>>>>>422	ubyte&0xDF	>0
6340>>>>>>>422	string		x 			\b%-.3s
6341>>>>>425	ubyte&0xDF	>0
6342>>>>>>425	string		>\ 			\b.%-.3s
6343#
6344>430	string	Datentr\204ger\ entfernen\xFF\r\n
6345>>454	string	Medienfehler\xFF\r\n
6346>>>469	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (4.german)
6347>>>>379		string		\0
6348>>>>>368	ubyte&0xDF	>0
6349>>>>>>368	string		x 			%-.5s
6350>>>>>>>373	ubyte&0xDF	>0
6351>>>>>>>>373	string		x 			\b%-.3s
6352>>>>>>376	ubyte&0xDF	>0
6353>>>>>>>376	string		x 			\b.%-.3s
6354# variant
6355>>>>417		ubyte&0xDF	>0
6356>>>>>417	string		x			%-.5s
6357>>>>>>422	ubyte&0xDF	>0
6358>>>>>>>422	string		x 			\b%-.3s
6359>>>>>425	ubyte&0xDF	>0
6360>>>>>>425	string		>\ 			\b.%-.3s
6361#
6362
6363#>3	string	NTFS\ \ \ \
6364>389	string	Fehler\ beim\ Lesen\
6365>>407	string	des\ Datentr\204gers
6366>>>426	string	NTLDR\ fehlt
6367>>>>440	string	NTLDR\ ist\ komprimiert
6368>>>>>464 string	Neustart\ mit\ Strg+Alt+Entf\r		\b, Microsoft Windows XP Bootloader NTFS (german)
6369#>3	string	NTFS\ \ \ \
6370>313	string	A\ disk\ read\ error\ occurred.\r
6371>>345	string	A\ kernel\ file\ is\ missing\
6372>>>370	string	from\ the\ disk.\r
6373>>>>484	string	NTLDR\ is\ compressed
6374>>>>>429 string	Insert\ a\ system\ diskette\
6375>>>>>>454 string and\ restart\r\nthe\ system.\r		\b, Microsoft Windows XP Bootloader NTFS
6376# DOS loader variants different languages,offsets
6377>472	ubyte&0xDF	>0
6378>>389	string	Invalid\ system\ disk\xFF\r\n
6379>>>411	string	Disk\ I/O\ error
6380>>>>428	string	Replace\ the\ disk,\ and\
6381>>>>>455 string	press\ any\ key				\b, Microsoft Windows 98 Bootloader
6382#IO.SYS
6383>>>>>>472	ubyte&0xDF	>0
6384>>>>>>>472	string		x 			\b %-.2s
6385>>>>>>>>474	ubyte&0xDF	>0
6386>>>>>>>>>474	string		x 			\b%-.5s
6387>>>>>>>>>>479	ubyte&0xDF	>0
6388>>>>>>>>>>>479 string		x 			\b%-.1s
6389>>>>>>>480	ubyte&0xDF	>0
6390>>>>>>>>480	string		x 			\b.%-.3s
6391#MSDOS.SYS
6392>>>>>>>483	ubyte&0xDF	>0			\b+
6393>>>>>>>>483	string		x 			\b%-.5s
6394>>>>>>>>>488	ubyte&0xDF	>0
6395>>>>>>>>>>488	string		x 			\b%-.3s
6396>>>>>>>>491	ubyte&0xDF	>0
6397>>>>>>>>>491	string		x 			\b.%-.3s
6398#
6399>>390	string	Invalid\ system\ disk\xFF\r\n
6400>>>412	string	Disk\ I/O\ error\xFF\r\n
6401>>>>429	string	Replace\ the\ disk,\ and\
6402>>>>>451 string	then\ press\ any\ key\r			\b, Microsoft Windows 98 Bootloader
6403>>388	string	Ungueltiges\ System\ \xFF\r\n
6404>>>410	string	E/A-Fehler\ \ \ \ \xFF\r\n
6405>>>>427	string	Datentraeger\ wechseln\ und\
6406>>>>>453 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (german)
6407#WINBOOT.SYS only not spaces (0xDF)
6408>>>>>>497	ubyte&0xDF	>0
6409>>>>>>>497	string		x 			%-.5s
6410>>>>>>>>502	ubyte&0xDF	>0
6411>>>>>>>>>502	string		x 			\b%-.1s
6412>>>>>>>>>>503	ubyte&0xDF	>0
6413>>>>>>>>>>>503	string		x 			\b%-.1s
6414>>>>>>>>>>>>504	ubyte&0xDF	>0
6415>>>>>>>>>>>>>504 string		x 			\b%-.1s
6416>>>>>>505	ubyte&0xDF	>0
6417>>>>>>>505	string		x 			\b.%-.3s
6418#IO.SYS
6419>>>>>>472	ubyte&0xDF	>0			or
6420>>>>>>>472	string		x 			\b %-.2s
6421>>>>>>>>474	ubyte&0xDF	>0
6422>>>>>>>>>474	string		x 			\b%-.5s
6423>>>>>>>>>>479	ubyte&0xDF	>0
6424>>>>>>>>>>>479 string		x 			\b%-.1s
6425>>>>>>>480	ubyte&0xDF	>0
6426>>>>>>>>480	string		x 			\b.%-.3s
6427#MSDOS.SYS
6428>>>>>>>483	ubyte&0xDF	>0			\b+
6429>>>>>>>>483	string		x 			\b%-.5s
6430>>>>>>>>>488	ubyte&0xDF	>0
6431>>>>>>>>>>488	string		x 			\b%-.3s
6432>>>>>>>>491	ubyte&0xDF	>0
6433>>>>>>>>>491	string		x 			\b.%-.3s
6434#
6435>>390	string	Ungueltiges\ System\ \xFF\r\n
6436>>>412	string	E/A-Fehler\ \ \ \ \xFF\r\n
6437>>>>429	string	Datentraeger\ wechseln\ und\
6438>>>>>455 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (German)
6439#WINBOOT.SYS only not spaces (0xDF)
6440>>>>>>497	ubyte&0xDF	>0
6441>>>>>>>497	string		x 			%-.7s
6442>>>>>>>>504	ubyte&0xDF	>0
6443>>>>>>>>>504	string		x 			\b%-.1s
6444>>>>>>505	ubyte&0xDF	>0
6445>>>>>>>505	string		x 			\b.%-.3s
6446#IO.SYS
6447>>>>>>472	ubyte&0xDF	>0			or
6448>>>>>>>472	string		x 			\b %-.2s
6449>>>>>>>>474	ubyte&0xDF	>0
6450>>>>>>>>>474	string		x 			\b%-.6s
6451>>>>>>>480	ubyte&0xDF	>0
6452>>>>>>>>480	string		x 			\b.%-.3s
6453#MSDOS.SYS
6454>>>>>>>483	ubyte&0xDF	>0			\b+
6455>>>>>>>>483	string		x 			\b%-.5s
6456>>>>>>>>>488	ubyte&0xDF	>0
6457>>>>>>>>>>488	string		x 			\b%-.3s
6458>>>>>>>>491	ubyte&0xDF	>0
6459>>>>>>>>>491	string		x 			\b.%-.3s
6460#
6461>>389	string	Ungueltiges\ System\ \xFF\r\n
6462>>>411	string	E/A-Fehler\ \ \ \ \xFF\r\n
6463>>>>428	string	Datentraeger\ wechseln\ und\
6464>>>>>454 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
6465# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
6466>>>>>>472	string		x 			%-.2s
6467>>>>>>>474	ubyte&0xDF	>0
6468>>>>>>>>474	string		x 			\b%-.5s
6469>>>>>>>>479	ubyte&0xDF	>0
6470>>>>>>>>>479	string		x 			\b%-.1s
6471>>>>>>480	ubyte&0xDF	>0
6472>>>>>>>480	string		x 			\b.%-.3s
6473>>>>>>483	ubyte&0xDF	>0			\b+
6474>>>>>>>483	string		x 			\b%-.5s
6475>>>>>>>488	ubyte&0xDF	>0
6476>>>>>>>>488	string		x 			\b%-.2s
6477>>>>>>>>490	ubyte&0xDF	>0
6478>>>>>>>>>490	string		x 			\b%-.1s
6479>>>>>>>491	ubyte&0xDF	>0
6480>>>>>>>>491	string		x 			\b.%-.3s
6481>479	ubyte&0xDF	>0
6482>>416	string	Kein\ System\ oder\
6483>>>433	string	Laufwerksfehler
6484>>>>450	string	Wechseln\ und\ Taste\ dr\201cken	\b, Microsoft DOS Bootloader (german)
6485#IO.SYS
6486>>>>>479	string		x 			\b %-.2s
6487>>>>>>481	ubyte&0xDF	>0
6488>>>>>>>481	string		x 			\b%-.6s
6489>>>>>487	ubyte&0xDF	>0
6490>>>>>>487	string		x 			\b.%-.3s
6491#MSDOS.SYS
6492>>>>>>490	ubyte&0xDF	>0			\b+
6493>>>>>>>490	string		x 			\b%-.5s
6494>>>>>>>>495	ubyte&0xDF	>0
6495>>>>>>>>>495	string		x 			\b%-.3s
6496>>>>>>>498	ubyte&0xDF	>0
6497>>>>>>>>498	string		x 			\b.%-.3s
6498#
6499>376	search/41	Non-System\ disk\ or\
6500>>395	search/41	disk\ error\r
6501>>>407	search/41	Replace\ and\
6502>>>>419	search/41	press\ 				\b,
6503>>>>419	search/41	strike\ 			\b, old
6504>>>>426	search/41	any\ key\ when\ ready\r		MS or PC-DOS bootloader
6505#449			Disk\ Boot\ failure\r		MS 3.21
6506#466			Boot\ Failure\r			MS 3.30
6507>>>>>468 search/18	\0
6508#IO.SYS,IBMBIO.COM
6509>>>>>>&0	string		x 			\b %-.2s
6510>>>>>>>&-20	ubyte&0xDF	>0
6511>>>>>>>>&-1	string		x 			\b%-.4s
6512>>>>>>>>>&-16	ubyte&0xDF	>0
6513>>>>>>>>>>&-1	string		x 			\b%-.2s
6514>>>>>>&8	ubyte&0xDF	>0			\b.
6515>>>>>>>&-1	string		x 			\b%-.3s
6516#MSDOS.SYS,IBMDOS.COM
6517>>>>>>&11	ubyte&0xDF	>0			\b+
6518>>>>>>>&-1	string		x 			\b%-.5s
6519>>>>>>>>&-6	ubyte&0xDF	>0
6520>>>>>>>>>&-1	string		x 			\b%-.1s
6521>>>>>>>>>>&-5	ubyte&0xDF	>0
6522>>>>>>>>>>>&-1	string		x 			\b%-.2s
6523>>>>>>>&7	ubyte&0xDF	>0			\b.
6524>>>>>>>>&-1	string		x 			\b%-.3s
6525>441	string	Cannot\ load\ from\ harddisk.\n\r
6526>>469	string	Insert\ Systemdisk\
6527>>>487	string	and\ press\ any\ key.\n\r		\b, MS (2.11) DOS bootloader
6528#>43	string	\224R-LOADER\ \ SYS			=label
6529>54	string	SYS
6530>>324	string	VASKK
6531>>>495	string	NEWLDR\0				\b, DR-DOS Bootloader (LOADER.SYS)
6532#
6533>98	string	Press\ a\ key\ to\ retry\0\r
6534>>120	string	Cannot\ find\ file\ \0\r
6535>>>139	string	Disk\ read\ error\0\r
6536>>>>156	string	Loading\ ...\0				\b, DR-DOS (3.41) Bootloader
6537#DRBIOS.SYS
6538>>>>>44		ubyte&0xDF	>0
6539>>>>>>44	string		x			\b %-.6s
6540>>>>>>>50	ubyte&0xDF	>0
6541>>>>>>>>50	string		x 			\b%-.2s
6542>>>>>>52	ubyte&0xDF	>0
6543>>>>>>>52	string		x 			\b.%-.3s
6544#
6545>70	string	IBMBIO\ \ COM
6546>>472	string	Cannot\ load\ DOS!\
6547>>>489	string	Any\ key\ to\ retry			\b, DR-DOS Bootloader
6548>>471	string	Cannot\ load\ DOS\
6549>>487	string	press\ key\ to\ retry			\b, Open-DOS Bootloader
6550#??
6551>444	string	KERNEL\ \ SYS
6552>>314	string	BOOT\ error!				\b, FREE-DOS Bootloader
6553>499	string	KERNEL\ \ SYS
6554>>305	string	BOOT\ err!\0				\b, Free-DOS Bootloader
6555>449	string	KERNEL\ \ SYS
6556>>319	string	BOOT\ error!				\b, FREE-DOS 0.5 Bootloader
6557#
6558>449	string	Loading\ FreeDOS
6559>>0x1AF		ulelong		>0			\b, FREE-DOS 0.95,1.0 Bootloader
6560>>>497		ubyte&0xDF	>0
6561>>>>497		string		x 			\b %-.6s
6562>>>>>503	ubyte&0xDF	>0
6563>>>>>>503	string		x 			\b%-.1s
6564>>>>>>>504	ubyte&0xDF	>0
6565>>>>>>>>504	string		x 			\b%-.1s
6566>>>>505		ubyte&0xDF	>0
6567>>>>>505	string		x 			\b.%-.3s
6568#
6569>331	string	Error!.0				\b, FREE-DOS 1.0 bootloader
6570#
6571>125	string	Loading\ FreeDOS...\r
6572>>311	string	BOOT\ error!\r				\b, FREE-DOS bootloader
6573>>>441		ubyte&0xDF	>0
6574>>>>441		string		x 			\b %-.6s
6575>>>>>447	ubyte&0xDF	>0
6576>>>>>>447	string		x 			\b%-.1s
6577>>>>>>>448	ubyte&0xDF	>0
6578>>>>>>>>448	string		x 			\b%-.1s
6579>>>>449		ubyte&0xDF	>0
6580>>>>>449	string		x 			\b.%-.3s
6581>124	string	FreeDOS\0
6582>>331	string	\ err\0					\b, FREE-DOS BETa 0.9 Bootloader
6583# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
6584>>>497		ubyte&0xDF	>0
6585>>>>497		string		x 			\b %-.6s
6586>>>>>503	ubyte&0xDF	>0
6587>>>>>>503	string		x 			\b%-.1s
6588>>>>>>>504	ubyte&0xDF	>0
6589>>>>>>>>504	string		x 			\b%-.1s
6590>>>>505		ubyte&0xDF	>0
6591>>>>>505	string		x 			\b.%-.3s
6592>>333	string	\ err\0					\b, FREE-DOS BEta 0.9 Bootloader
6593>>>497		ubyte&0xDF	>0
6594>>>>497		string		x 			\b %-.6s
6595>>>>>503	ubyte&0xDF	>0
6596>>>>>>503	string		x 			\b%-.1s
6597>>>>>>>504	ubyte&0xDF	>0
6598>>>>>>>>504	string		x 			\b%-.1s
6599>>>>505		ubyte&0xDF	>0
6600>>>>>505	string		x 			\b.%-.3s
6601>>334	string	\ err\0					\b, FREE-DOS Beta 0.9 Bootloader
6602>>>497		ubyte&0xDF	>0
6603>>>>497		string		x 			\b %-.6s
6604>>>>>503	ubyte&0xDF	>0
6605>>>>>>503	string		x 			\b%-.1s
6606>>>>>>>504	ubyte&0xDF	>0
6607>>>>>>>>504	string		x 			\b%-.1s
6608>>>>505		ubyte&0xDF	>0
6609>>>>>505	string		x 			\b.%-.3s
6610>336	string	Error!\
6611>>343	string	Hit\ a\ key\ to\ reboot.		\b, FREE-DOS Beta 0.9sr1 Bootloader
6612>>>497		ubyte&0xDF	>0
6613>>>>497		string		x 			\b %-.6s
6614>>>>>503	ubyte&0xDF	>0
6615>>>>>>503	string		x 			\b%-.1s
6616>>>>>>>504	ubyte&0xDF	>0
6617>>>>>>>>504	string		x 			\b%-.1s
6618>>>>505		ubyte&0xDF	>0
6619>>>>>505	string		x 			\b.%-.3s
6620# added by Joerg Jenderek
6621# http://www.visopsys.org/
6622# http://partitionlogic.org.uk/
6623# OEM-ID=Visopsys
6624>478		ulelong	0
6625>>(1.b+326)	string	I/O\ Error\ reading\
6626>>>(1.b+344)	string	Visopsys\ loader\r
6627>>>>(1.b+361)	string	Press\ any\ key\ to\ continue.\r	\b, Visopsys loader
6628# http://alexfru.chat.ru/epm.html#bootprog
6629>494	ubyte	>0x4D
6630>>495	string	>E
6631>>>495	string	<S
6632#OEM-ID is not reliable
6633>>>>3	string	BootProg
6634# It just looks for a program file name at the root directory
6635# and loads corresponding file with following execution.
6636# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
6637>>>>499			ubyte&0xDF	>0		\b, COM/EXE Bootloader
6638>>>>>499		string		x 		\b %-.1s
6639>>>>>>500		ubyte&0xDF	>0
6640>>>>>>>500		string		x 		\b%-.1s
6641>>>>>>>>501		ubyte&0xDF	>0
6642>>>>>>>>>501		string		x 		\b%-.1s
6643>>>>>>>>>>502		ubyte&0xDF	>0
6644>>>>>>>>>>>502		string		x 		\b%-.1s
6645>>>>>>>>>>>>503		ubyte&0xDF	>0
6646>>>>>>>>>>>>>503	string		x 		\b%-.1s
6647>>>>>>>>>>>>>>504	ubyte&0xDF	>0
6648>>>>>>>>>>>>>>>504	string		x 		\b%-.1s
6649>>>>>>>>>>>>>>>>505	ubyte&0xDF	>0
6650>>>>>>>>>>>>>>>>>505	string		x 		\b%-.1s
6651>>>>>>>>>>>>>>>>>>506	ubyte&0xDF	>0
6652>>>>>>>>>>>>>>>>>>>506	string		x 		\b%-.1s
6653#name extension
6654>>>>>507		ubyte&0xDF	>0		\b.
6655>>>>>>507		string		x 		\b%-.1s
6656>>>>>>>508		ubyte&0xDF	>0
6657>>>>>>>>508		string		x 		\b%-.1s
6658>>>>>>>>>509		ubyte&0xDF	>0
6659>>>>>>>>>>509		string		x 		\b%-.1s
6660#If the boot sector fails to read any other sector,
6661#it prints a very short message ("RE") to the screen and hangs the computer.
6662#If the boot sector fails to find needed program in the root directory,
6663#it also hangs with another message ("NF").
6664>>>>>492		string		RENF		\b, FAT (12 bit)
6665>>>>>495		string		RENF		\b, FAT (16 bit)
6666# http://alexfru.chat.ru/epm.html#bootprog
6667>494	ubyte	>0x4D
6668>>495	string	>E
6669>>>495	string	<S
6670#OEM-ID is not reliable
6671>>>>3	string	BootProg
6672# It just looks for a program file name at the root directory
6673# and loads corresponding file with following execution.
6674# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
6675>>>>499			ubyte&0xDF	>0		\b, COM/EXE Bootloader
6676>>>>>499		string		x 		\b %-.1s
6677>>>>>>500		ubyte&0xDF	>0
6678>>>>>>>500		string		x 		\b%-.1s
6679>>>>>>>>501		ubyte&0xDF	>0
6680>>>>>>>>>501		string		x 		\b%-.1s
6681>>>>>>>>>>502		ubyte&0xDF	>0
6682>>>>>>>>>>>502		string		x 		\b%-.1s
6683>>>>>>>>>>>>503		ubyte&0xDF	>0
6684>>>>>>>>>>>>>503	string		x 		\b%-.1s
6685>>>>>>>>>>>>>>504	ubyte&0xDF	>0
6686>>>>>>>>>>>>>>>504	string		x 		\b%-.1s
6687>>>>>>>>>>>>>>>>505	ubyte&0xDF	>0
6688>>>>>>>>>>>>>>>>>505	string		x 		\b%-.1s
6689>>>>>>>>>>>>>>>>>>506	ubyte&0xDF	>0
6690>>>>>>>>>>>>>>>>>>>506	string		x 		\b%-.1s
6691#name extension
6692>>>>>507		ubyte&0xDF	>0		\b.
6693>>>>>>507		string		x 		\b%-.1s
6694>>>>>>>508		ubyte&0xDF	>0
6695>>>>>>>>508		string		x 		\b%-.1s
6696>>>>>>>>>509		ubyte&0xDF	>0
6697>>>>>>>>>>509		string		x 		\b%-.1s
6698#If the boot sector fails to read any other sector,
6699#it prints a very short message ("RE") to the screen and hangs the computer.
6700#If the boot sector fails to find needed program in the root directory,
6701#it also hangs with another message ("NF").
6702>>>>>492		string		RENF		\b, FAT (12 bit)
6703>>>>>495		string		RENF		\b, FAT (16 bit)
6704# x86 bootloader end
6705
6706# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
6707# and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
6708>0		string		RRaA
6709>>0x1E4		string		rrAa		\b, FSInfosector
6710#>>0x1FC	uleshort	=0		SHOULD BE ZERO
6711>>>0x1E8	ulelong		<0xffffffff	\b, %u free clusters
6712>>>0x1EC	ulelong		<0xffffffff	\b, last allocated cluster %u
6713
6714# added by Joerg Jenderek at Nov 2012
6715# http://www.thenakedpc.com/articles/v04/08/0408-05.html
6716# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data
67170	string	PNCIHISK\0		Norton Utilities disc image data
6718# real x86 boot sector with jump instruction
6719>509	search/1026	\x55\xAA\xeb
6720>>&-1	indirect	x		\b; contains
6721# http://file-extension.net/seeker/file_extension_dat
67220	string	PNCIUNDO		Norton Disk Doctor UnDo file
6723#
6724
6725# updated by Joerg Jenderek at Sep 2007
6726>3	ubyte	0
6727#no active flag
6728>>446	ubyte	0
6729# partition 1 not empty
6730>>>450	ubyte	>0
6731# partitions 3,4 empty
6732>>>>482		ubyte	0
6733>>>>>498	ubyte	0
6734# partition 2 ID=0,5,15
6735>>>>>>466	ubyte	<0x10
6736>>>>>>>466	ubyte	0x05			\b, extended partition table
6737>>>>>>>466	ubyte	0x0F			\b, extended partition table (LBA)
6738>>>>>>>466	ubyte	0x0			\b, extended partition table (last)
6739
6740# DOS x86 sector separated and moved from "x86 boot sector" by Joerg Jenderek at May 2011
6741
6742>0x200	lelong	0x82564557		\b, BSD disklabel
6743# FATX
67440		string		FATX		FATX filesystem data
6745
6746# romfs filesystems - Juan Cespedes <cespedes@debian.org>
67470	string		-rom1fs-	romfs filesystem, version 1
6748>8	belong	x			%d bytes,
6749>16	string	x			named %s.
6750
6751# netboot image - Juan Cespedes <cespedes@debian.org>
67520	lelong		0x1b031336L	Netboot image,
6753>4	lelong&0xFFFFFF00	0
6754>>4	lelong&0x100	0x000		mode 2
6755>>4	lelong&0x100	0x100		mode 3
6756>4	lelong&0xFFFFFF00	!0	unknown mode
6757
67580x18b	string	OS/2	OS/2 Boot Manager
6759
6760# updated by Joerg Jenderek at Oct 2008 and Sep 2012
6761# http://syslinux.zytor.com/iso.php
6762# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
6763# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
67640	ulequad&0x909000007cc0eafa	0x909000007c40eafa
6765>631	search/689	ISOLINUX\ 	isolinux Loader
6766>>&0	string		x		(version %-4.4s)
6767# http://syslinux.zytor.com/pxe.php
6768# assembler instructions: jmp 7C05
67690	ulelong	0x007c05ea		pxelinux loader (version 2.13 or older)
6770# assembler instructions: pushfd;pushad
67710	ulelong	0x60669c66		pxelinux loader
6772# assembler instructions: jmp 05
67730	ulelong	0xc00005ea		pxelinux loader (version 3.70 or newer)
6774# http://syslinux.zytor.com/wiki/index.php/SYSLINUX
67750	string	LDLINUX\ SYS\ 		SYSLINUX loader
6776>12	string	x			(older version %-4.4s)
67770	string	\r\nSYSLINUX\ 		SYSLINUX loader
6778>11	string	x			(version %-4.4s)
6779# syslinux updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012
6780# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX"
67810	ulelong&0x80909bEB	0x009018EB
6782# OEM-ID not always "SYSLINUX"
6783>434	search/47	Boot\ failed
6784# followed by \r\n\0 or :\
6785>>482	search/132	\0LDLINUX\ SYS		Syslinux bootloader (version 2.13 or older)
6786>>1	ubyte		0x58			Syslinux bootloader (version 3.0-3.9)
6787>459	search/30	Boot\ error\r\n\0
6788>>1	ubyte		0x58			Syslinux bootloader (version 3.10 or newer)
6789# SYSLINUX MBR updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012
6790# assembler instructions: mov di,0600h;mov cx,0100h
679116	search/4	\xbf\x00\x06\xb9\x00\x01
6792# to display SYSLINUX MBR (36) before old x86 boot sector one with partition table (strength=50+21)
6793!:strength +36
6794>94	search/249	Missing\ operating\ system
6795# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other
6796# skip Ranish MBR
6797>>408	search/4	HD1/\0
6798>>408	default		x
6799>>>250	search/118	\0Operating\ system\ load		SYSLINUX MBR
6800# followed by "ing " or space
6801>>>>292	search/98	error
6802>>>>>&0	string		\r		    			(version 3.35 or older)
6803>>>>>&0	string		.\r					(version 3.52 or newer)
6804>>>>>&0	default		x					(version 3.36-3.51 )
6805>368	search/106	\0Disk\ error\ on\ boot\r\n		SYSLINUX GPT-MBR
6806>>156	search/10	\0Boot\ partition\ not\ found\r\n
6807>>>270	search/10	\0OS\ not\ bootable\r\n			(version 3.86 or older)
6808>>174	search/10	\0Missing\ OS\r\n
6809>>>189	search/10	\0Multiple\ active\ partitions\r\n	(version 4.00 or newer)
6810# SYSLINUX END
6811
6812# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012
6813# assembler instructions: xor ax,ax;mov	ax,ss;mov sp,0x7c00;mov	ax,
68140	ubequad		0x31c08ed0bc007c8e
6815# mbr_bootsel magic before partition table not reliable with small ipl fragments
6816#>444	uleshort	0xb5e1
6817>0004	uleshort	x
6818# ERRorTeXT
6819>>181	search/166		Error\ \0\r\n				NetBSD mbr
6820# NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
6821>>>0x1B8	ubelong		>0					\b,Serial 0x%-.8x
6822# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
6823>>>0xbb		search/71	\xcd\x13\x5a\x52\x52			\b,bootselector
6824# BOOT_EXTENDED definitions contains assembler instructions:
6825# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13
6826>>>0x96	search/1	\x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13	\b,boot extended
6827# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al
6828>>>0x130	search/55	\xee\x80\xc2\x05\xec\xa8\x40		\b,serial IO
6829# not TERSE_ERROR
6830>>>196		search/106	No\ active\ partition\0
6831>>>>&0		string		Disk\ read\ error\0
6832>>>>>&0		string		No\ operating\ system\0			\b,verbose
6833# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13
6834>>>0x7d		search/7	\x5a\x52\xb4\x08\xcd\x13		\b,CHS
6835# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop	dx;push	dx;int 0x13
6836>>>0xa4		search/84	\xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13	\b,LBA-check
6837# assembler instructions: movw nametab,bx
6838>>>0x26	    search/21	\xBB\x94\x07
6839# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf
6840>>>>&-9	ubequad&0xBE00f0E800febb94	0xBE0000E80000bb94
6841>>>>>181	search/166		Error\ \0
6842# "a: disk" , "Fn: diskn" or "NetBSD MBR boot"
6843>>>>>>&3	string			x				\b,"%s"
6844# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
6845# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
6846# assembler instructions: jmp short 0x58;nop;ASCII
68470	ubequad&0xeb58908000000000	0xeb58900000000000
6848# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss,
6849>(1.b+2)	ubequad			0xfa31c08ed88ec08e
6850# Error messages at end of code
6851>>376		string	No\ operating\ system\r\n\0
6852>>>398		string	Disk\ error\r\n\0FDD\0HDD\0
6853>>>>419		string	\ EBIOS\r\n\0				AdvanceMAME mbr
6854
6855# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/
6856# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
6857# for 1st version assembler instructions:	cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
6858# or  	  	  	    			cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
68590	ulequad&0xcE1b40D48EC031FC	0x8E0000D08EC031FC
6860# pointer to the data starting with Neil Turton signature string
6861>(0x1BC.s)		string		NDTmbr
6862>>&-14			string		1234F\0			Turton mbr (
6863# parameters also viewed by install-mbr --list
6864>>>(0x1BC.s+7)		ubyte		x			\b%u<=
6865>>>(0x1BC.s+9)		ubyte		x			\bVersion<=%u
6866#>>>(0x1BC.s+8)		ubyte		x			asm_flag_%x
6867>>>(0x1BC.s+8)		ubyte&1		1			\b,Y2K-Fix
6868# variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode
6869>>>(0x1BC.s+8)		ubyte&2		2			\b,TestDisk
6870#0x1~1,..,0x8~4,0x10~F,0x80~A enabled
6871#>>>(0x1BC.s+10)		ubyte		x			\b,flags 0x%x
6872#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
6873#>>>(0x1BC.s+11)		ubyte		x			\b,cfg_def 0x%x
6874# for older versions
6875>>>(0x1BC.s+9)		ubyte		<2
6876#>>>>(0x1BC.s+12)	ubyte		18			\b,%u/18 seconds
6877>>>>(0x1BC.s+12)	ubyte		!18			\b,%u/18 seconds
6878# floppy A: or B:
6879>>>>(0x1BC.s+13)	ubyte		<2			\b,floppy 0x%x
6880>>>>(0x1BC.s+13)	ubyte		>1
6881# 1st hard disc
6882#>>>>>(0x1BC.s+13)	ubyte		0x80			\b,drive 0x%x
6883# not 1st hard disc
6884>>>>>(0x1BC.s+13)	ubyte		!0x80			\b,drive 0x%x
6885# for version >= 2 maximal timeout can be 65534
6886>>>(0x1BC.s+9)		ubyte		>1
6887#>>>>(0x1BC.s+12)	uleshort	18			\b,%u/18 seconds
6888>>>>(0x1BC.s+12)	uleshort	!18			\b,%u/18 seconds
6889# floppy A: or B:
6890>>>>(0x1BC.s+14)	ubyte		<2			\b,floppy 0x%x
6891>>>>(0x1BC.s+14)	ubyte		>1
6892# 1st hard disc
6893#>>>>>(0x1BC.s+14)	ubyte		0x80			\b,drive 0x%x
6894# not 1st hard disc
6895>>>>>(0x1BC.s+14)	ubyte		!0x80			\b,drive 0x%x
6896>>>0	ubyte		x					\b)
6897
6898# added by Joerg Jenderek
6899# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
6900# grub-1.94/kern/i386/pc/startup.S
6901# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
6902# usual values are marked with comments to get only informations of strange GRUB loaders
69030x200	uleshort		0x70EA
6904# found only version 3.{1,2}
6905>0x206		ubeshort	>0x0300
6906# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
6907>>0x212 	ubyte		>0x29
6908>>>0x213 	ubyte		>0x29
6909# not iso9660_stage1_5
6910#>>>0	ulelong&0x00BE5652	0x00BE5652
6911>>>>0x213 	ubyte		>0x29		GRand Unified Bootloader
6912# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
6913>>>>0x217 	ubyte		0xFF		stage1_5
6914>>>>0x217 	ubyte		<0xFF		stage2
6915>>>>0x206	ubyte		x		\b version %u
6916>>>>0x207	ubyte		x		\b.%u
6917# module_size for 1.94
6918>>>>0x208	ulelong		<0xffffff	\b, installed partition %u
6919#>>>>0x208	ulelong		=0xffffff	\b, %u (default)
6920>>>>0x208	ulelong		>0xffffff	\b, installed partition %u
6921# GRUB 0.5.95 unofficial
6922>>>>0x20C	ulelong&0x2E300000 0x2E300000
6923# 0=stage2	1=ffs	2=e2fs	3=fat	4=minix	5=reiserfs
6924>>>>>0x20C	ubyte		x		\b, identifier 0x%x
6925#>>>>>0x20D	ubyte		=0		\b, LBA flag 0x%x (default)
6926>>>>>0x20D	ubyte		>0		\b, LBA flag 0x%x
6927# GRUB version as string
6928>>>>>0x20E 	string		>\0		\b, GRUB version %-s
6929# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
6930>>>>>>0x215 	ulong		0xffffffff
6931>>>>>>>0x219 	string		>\0		\b, configuration file %-s
6932>>>>>>0x215 	ulong		!0xffffffff
6933>>>>>>>0x215 	string		>\0		\b, configuration file %-s
6934# newer GRUB versions
6935>>>>0x20C	ulelong&0x2E300000 !0x2E300000
6936##>>>>>0x20C	ulelong		=0		\b, saved entry %d (usual)
6937>>>>>0x20C	ulelong		>0		\b, saved entry %d
6938# for 1.94 contains kernel image size
6939# for 0.93,0.94,0.96,0.97
6940# 0=stage2	1=ffs	2=e2fs	3=fat	4=minix	5=reiserfs	6=vstafs	7=jfs	8=xfs	9=iso9660	a=ufs2
6941>>>>>0x210	ubyte		x		\b, identifier 0x%x
6942# The flag for LBA forcing is in most cases 0
6943#>>>>>0x211	ubyte		=0		\b, LBA flag 0x%x (default)
6944>>>>>0x211	ubyte		>0		\b, LBA flag 0x%x
6945# GRUB version as string
6946>>>>>0x212 	string		>\0		\b, GRUB version %-s
6947# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
6948>>>>>0x217 	ulong		0xffffffff
6949>>>>>>0x21b 	string		>\0		\b, configuration file %-s
6950>>>>>0x217 	ulong		!0xffffffff
6951>>>>>>0x217 	string		>\0		\b, configuration file %-s
6952
6953# DOS x86 sector updated and separated from "x86 boot sector" by Joerg Jenderek at May 2011
6954# JuMP short     bootcodeoffset NOP assembler instructions will usually be EB xx 90
6955# over BIOS parameter block (BPB)
6956# http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD
6957# older drives may use Near JuMP instruction E9 xx xx
6958# minimal short forward jump found 0x29 for bootloaders or 0x0
6959# maximal short forward jump is 0x7f
6960# OEM-ID is empty or contain readable bytes
69610		ulelong&0x804000E9	0x000000E9
6962# mtools-3.9.8/msdos.h
6963# usual values are marked with comments to get only informations of strange FAT systems
6964# valid sectorsize must be a power of 2 from 32 to 32768
6965>11		uleshort&0xf001f	0
6966>>11		uleshort	<32769
6967>>>11		uleshort	>31
6968>>>>21		ubyte&0xf0	0xF0
6969>>>>>0		ubyte		0xEB
6970>>>>>>1		ubyte		x		\b, code offset 0x%x+2
6971>>>>>0		ubyte		0xE9
6972>>>>>>1		uleshort	x		\b, code offset 0x%x+2
6973>>>>>3		string		>\0		\b, OEM-ID "%-.8s"
6974#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
6975>>>>>>8		string		IHC		\b cached by Windows 9M
6976>>>>>11		uleshort	>512		\b, Bytes/sector %u
6977#>>>>>11	uleshort	=512		\b, Bytes/sector %u=512 (usual)
6978>>>>>11		uleshort	<512		\b, Bytes/sector %u
6979>>>>>13		ubyte		>1		\b, sectors/cluster %u
6980#>>>>>13	ubyte		=1		\b, sectors/cluster %u (usual on Floppies)
6981>>>>>82		string		FAT32
6982>>>>>>14	uleshort	!32		\b, reserved sectors %u
6983#>>>>>>14	uleshort	=32		\b, reserved sectors %u (usual Fat32)
6984>>>>>82		string		!FAT32
6985>>>>>>14	uleshort	>1		\b, reserved sectors %u
6986#>>>>>>14	uleshort	=1		\b, reserved sectors %u (usual FAT12,FAT16)
6987#>>>>>>14	uleshort	0		\b, reserved sectors %u (usual NTFS)
6988>>>>>16		ubyte		>2		\b, FATs %u
6989#>>>>>16	ubyte		=2		\b, FATs %u (usual)
6990>>>>>16		ubyte		=1		\b, FAT  %u
6991>>>>>16		ubyte		>0
6992>>>>>17		uleshort	>0		\b, root entries %u
6993#>>>>>17	uleshort	=0		\b, root entries %u=0 (usual Fat32)
6994>>>>>19		uleshort	>0		\b, sectors %u (volumes <=32 MB)
6995#>>>>>19	uleshort	=0		\b, sectors %u=0 (usual Fat32)
6996>>>>>21		ubyte		>0xF0		\b, Media descriptor 0x%x
6997#>>>>>21	ubyte		=0xF0		\b, Media descriptor 0x%x (usual floppy)
6998>>>>>21		ubyte		<0xF0		\b, Media descriptor 0x%x
6999>>>>>22		uleshort	>0		\b, sectors/FAT %u
7000#>>>>>22	uleshort	=0		\b, sectors/FAT %u=0 (usual Fat32)
7001>>>>>24		uleshort	x		\b, sectors/track %u
7002>>>>>26		ubyte		>2		\b, heads %u
7003#>>>>>26	ubyte		=2		\b, heads %u (usual floppy)
7004>>>>>26		ubyte		=1		\b, heads %u
7005# valid only for sector sizes with more then 32 Bytes
7006>>>>>11		uleshort	>32
7007# skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk
7008>>>>>>38	ubyte		!0x70
7009>>>>>>>28	ulelong		>0		\b, hidden sectors %u
7010#>>>>>>>28	ulelong		=0		\b, hidden sectors %u (usual floppy)
7011>>>>>>>32	ulelong		>0		\b, sectors %u (volumes > 32 MB)
7012#>>>>>>>32	ulelong		=0		\b, sectors %u (volumes > 32 MB)
7013# FAT<32 bit specific
7014>>>>>>>82	string		!FAT32
7015#>>>>>>>>36	ubyte		0x80		\b, physical drive 0x%x=0x80 (usual harddisk)
7016#>>>>>>>>36	ubyte		0		\b, physical drive 0x%x=0 (usual floppy)
7017>>>>>>>>36	ubyte		!0x80
7018>>>>>>>>>36	ubyte		!0		\b, physical drive 0x%x
7019>>>>>>>>37	ubyte		>0		\b, reserved 0x%x
7020#>>>>>>>>37	ubyte		=0		\b, reserved 0x%x
7021# value is 0x80 for NTFS
7022>>>>>>>>38	ubyte		!0x29		\b, dos < 4.0 BootSector (0x%x)
7023>>>>>>>>38	ubyte		=0x29
7024>>>>>>>>>39	ulelong		x		\b, serial number 0x%x
7025>>>>>>>>>43	string		<NO\ NAME	\b, label: "%11.11s"
7026>>>>>>>>>43	string		>NO\ NAME	\b, label: "%11.11s"
7027>>>>>>>>>43	string		=NO\ NAME	\b, unlabeled
7028# there exist some old floppies without word FAT at offset 54
7029# a word like "FATnm   " is only a hint for a FAT size on nm-bits
7030# Normally the number of clusters is calculated by the values of BPP.
7031# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
7032# otherwise FAT is 16 bit.
7033# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
7034>>>>>>54	string		FAT		\b, FAT
7035>>>>>>>54	string		FAT12		\b (12 bit)
7036>>>>>>>54	string		FAT16		\b (16 bit)
7037# FAT32 bit specific
7038>>>>>82		string		FAT32		\b, FAT (32 bit)
7039>>>>>>36	ulelong		x		\b, sectors/FAT %u
7040# http://technet.microsoft.com/en-us/library/cc977221.aspx
7041>>>>>>40	uleshort	>0		\b, extension flags 0x%x
7042#>>>>>>40	uleshort	=0		\b, extension flags %u
7043>>>>>>42	uleshort	>0		\b, fsVersion %u
7044#>>>>>>42	uleshort	=0		\b, fsVersion %u (usual)
7045>>>>>>44	ulelong		>2		\b, rootdir cluster %u
7046#>>>>>>44	ulelong		=2		\b, rootdir cluster %u
7047#>>>>>>44	ulelong		=1		\b, rootdir cluster %u
7048>>>>>>48	uleshort	>1		\b, infoSector %u
7049#>>>>>>48	uleshort	=1		\b, infoSector %u (usual)
7050>>>>>>48	uleshort	<1		\b, infoSector %u
7051>>>>>>50	uleshort	>6		\b, Backup boot sector %u
7052#>>>>>>50	uleshort	=6		\b, Backup boot sector %u (usual)
7053>>>>>>50	uleshort	<6		\b, Backup boot sector %u
7054# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
7055>>>>>>52	ulelong		>0		\b, reserved1 0x%x
7056>>>>>>56	ulelong		>0		\b, reserved2 0x%x
7057>>>>>>60	ulelong		>0		\b, reserved3 0x%x
7058# same structure as FAT1X
7059#>>>>>>64	ubyte		=0x80		\b, physical drive 0x%x=80 (usual harddisk)
7060#>>>>>>64	ubyte		=0		\b, physical drive 0x%x=0 (usual floppy)
7061>>>>>>64	ubyte		!0x80
7062>>>>>>>64	ubyte		>0		\b, physical drive 0x%x
7063# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
7064>>>>>>65	ubyte		>0		\b, reserved 0x%x
7065>>>>>>66	ubyte		!0x29		\b, dos < 4.0 BootSector (0x%x)
7066>>>>>>66	ubyte		=0x29
7067>>>>>>>67	ulelong		x		\b, serial number 0x%x
7068>>>>>>>71	string		<NO\ NAME	\b, label: "%11.11s"
7069>>>>>>>71	string		>NO\ NAME	\b, label: "%11.11s"
7070>>>>>>>71	string		=NO\ NAME	\b, unlabeled
7071# additional tests for floppy image added by Joerg Jenderek
7072# no fixed disk
7073>>>>>21		ubyte		!0xF8
7074# floppy media with 12 bit FAT
7075>>>>>>54	string		!FAT16
7076# test for FAT after bootsector
7077>>>>>>>(11.s)	ulelong&0x00ffffF0	0x00ffffF0	\b, followed by FAT
7078# floppy image
7079!:mime application/x-ima
7080# NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
7081# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
7082# 0 FATs
7083>>>>>16	ubyte		=0
7084# 0 root entries
7085>>>>>>17	uleshort	=0
7086# 0 DOS sectors
7087>>>>>>>19	uleshort	=0
7088# 0 sectors/FAT
7089# dos < 4.0 BootSector value found is 0x80
7090#38	ubyte		=0x80			\b, dos < 4.0 BootSector (0x%x)
7091>>>>>>>>22	uleshort	=0		\b; NTFS
7092>>>>>>>>>24	uleshort	>0		\b, sectors/track %u
7093>>>>>>>>>36	ulelong		!0x800080	\b, physical drive 0x%x
7094>>>>>>>>>40	ulequad		>0		\b, sectors %lld
7095>>>>>>>>>48	ulequad		>0		\b, $MFT start cluster %lld
7096>>>>>>>>>56	ulequad		>0		\b, $MFTMirror start cluster %lld
7097# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters.
7098# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
7099>>>>>>>>>64	lelong		<256
7100>>>>>>>>>>64	lelong		<128		\b, clusters/RecordSegment %d
7101>>>>>>>>>>64	ubyte		>127		\b, bytes/RecordSegment 2^(-1*%hhi)
7102# Values 0 to 127 represent index block sizes of 0 to 127 clusters.
7103# Values 128 to 255 represent index block sizes of 2^(256-N) byte
7104>>>>>>>>>68	ulelong		<256
7105>>>>>>>>>>68	ulelong		<128		\b, clusters/index block %d
7106#>>>>>>>>>>68	ulelong		>127		\b, bytes/index block 2^(256-%d)
7107>>>>>>>>>>68	ubyte		>127		\b, bytes/index block 2^(-1*%hhi)
7108>>>>>>>>>72	ulequad		x		\b, serial number 0%llx
7109>>>>>>>>>80	ulelong		>0		\b, checksum 0x%x
7110#>>>>>>>>>80	ulelong		=0		\b, checksum 0x%x=0 (usual)
7111>>>>>>>>>0x258	ulelong&0x00009090	=0x00009090
7112>>>>>>>>>>&-92		indirect	x	\b; contains
7113# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013
7114# http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
7115# unused assembler instructions JMP y2;NOP;NOP
71160x056		ulelong&0xFFFF0FFF	0x909002EB
7117# unicode loadername terminated by CTRL-D
7118>(0.s*2)	ulelong&0xFFFFFF00	0x00040000
7119# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR
7120>>0x002		lestring16	x	Microsoft Windows XP/VISTA bootloader %-5.5s
7121>>0x12		string		$
7122>>>0x0c		lestring16	x	\b%-2.2s
7123### DOS,NTFS boot sectors end
7124
71259564	lelong		0x00011954	Unix Fast File system [v1] (little-endian),
7126>8404	string		x		last mounted on %s,
7127#>9504	ledate		x		last checked at %s,
7128>8224	ledate		x		last written at %s,
7129>8401	byte		x		clean flag %d,
7130>8228	lelong		x		number of blocks %d,
7131>8232	lelong		x		number of data blocks %d,
7132>8236	lelong		x		number of cylinder groups %d,
7133>8240	lelong		x		block size %d,
7134>8244	lelong		x		fragment size %d,
7135>8252	lelong		x		minimum percentage of free blocks %d,
7136>8256	lelong		x		rotational delay %dms,
7137>8260	lelong		x		disk rotational speed %drps,
7138>8320	lelong		0		TIME optimization
7139>8320	lelong		1		SPACE optimization
7140
714142332	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
7142>&-1164	string		x		last mounted on %s,
7143>&-696	string		>\0		volume name %s,
7144>&-304	leqldate	x		last written at %s,
7145>&-1167	byte		x		clean flag %d,
7146>&-1168	byte		x		readonly flag %d,
7147>&-296	lequad		x		number of blocks %lld,
7148>&-288	lequad		x		number of data blocks %lld,
7149>&-1332	lelong		x		number of cylinder groups %d,
7150>&-1328	lelong		x		block size %d,
7151>&-1324	lelong		x		fragment size %d,
7152>&-180	lelong		x		average file size %d,
7153>&-176	lelong		x		average number of files in dir %d,
7154>&-272	lequad		x		pending blocks to free %lld,
7155>&-264	lelong		x		pending inodes to free %ld,
7156>&-664	lequad		x		system-wide uuid %0llx,
7157>&-1316	lelong		x		minimum percentage of free blocks %d,
7158>&-1248	lelong		0		TIME optimization
7159>&-1248	lelong		1		SPACE optimization
7160
716166908	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
7162>&-1164	string		x		last mounted on %s,
7163>&-696	string		>\0		volume name %s,
7164>&-304	leqldate	x		last written at %s,
7165>&-1167	byte		x		clean flag %d,
7166>&-1168	byte		x		readonly flag %d,
7167>&-296	lequad		x		number of blocks %lld,
7168>&-288	lequad		x		number of data blocks %lld,
7169>&-1332	lelong		x		number of cylinder groups %d,
7170>&-1328	lelong		x		block size %d,
7171>&-1324	lelong		x		fragment size %d,
7172>&-180	lelong		x		average file size %d,
7173>&-176	lelong		x		average number of files in dir %d,
7174>&-272	lequad		x		pending blocks to free %lld,
7175>&-264	lelong		x		pending inodes to free %ld,
7176>&-664	lequad		x		system-wide uuid %0llx,
7177>&-1316	lelong		x		minimum percentage of free blocks %d,
7178>&-1248	lelong		0		TIME optimization
7179>&-1248	lelong		1		SPACE optimization
7180
71819564	belong		0x00011954	Unix Fast File system [v1] (big-endian),
7182>7168   belong		0x4c41424c	Apple UFS Volume
7183>>7186  string		x		named %s,
7184>>7176  belong		x		volume label version %d,
7185>>7180  bedate		x		created on %s,
7186>8404	string		x		last mounted on %s,
7187#>9504	bedate		x		last checked at %s,
7188>8224	bedate		x		last written at %s,
7189>8401	byte		x		clean flag %d,
7190>8228	belong		x		number of blocks %d,
7191>8232	belong		x		number of data blocks %d,
7192>8236	belong		x		number of cylinder groups %d,
7193>8240	belong		x		block size %d,
7194>8244	belong		x		fragment size %d,
7195>8252	belong		x		minimum percentage of free blocks %d,
7196>8256	belong		x		rotational delay %dms,
7197>8260	belong		x		disk rotational speed %drps,
7198>8320	belong		0		TIME optimization
7199>8320	belong		1		SPACE optimization
7200
720142332	belong		0x19540119	Unix Fast File system [v2] (big-endian)
7202>&-1164	string		x		last mounted on %s,
7203>&-696	string		>\0		volume name %s,
7204>&-304	beqldate	x		last written at %s,
7205>&-1167	byte		x		clean flag %d,
7206>&-1168	byte		x		readonly flag %d,
7207>&-296	bequad		x		number of blocks %lld,
7208>&-288	bequad		x		number of data blocks %lld,
7209>&-1332	belong		x		number of cylinder groups %d,
7210>&-1328	belong		x		block size %d,
7211>&-1324	belong		x		fragment size %d,
7212>&-180	belong		x		average file size %d,
7213>&-176	belong		x		average number of files in dir %d,
7214>&-272	bequad		x		pending blocks to free %lld,
7215>&-264	belong		x		pending inodes to free %ld,
7216>&-664	bequad		x		system-wide uuid %0llx,
7217>&-1316	belong		x		minimum percentage of free blocks %d,
7218>&-1248	belong		0		TIME optimization
7219>&-1248	belong		1		SPACE optimization
7220
722166908	belong		0x19540119	Unix Fast File system [v2] (big-endian)
7222>&-1164	string		x		last mounted on %s,
7223>&-696	string		>\0		volume name %s,
7224>&-304	beqldate	x		last written at %s,
7225>&-1167	byte		x		clean flag %d,
7226>&-1168	byte		x		readonly flag %d,
7227>&-296	bequad		x		number of blocks %lld,
7228>&-288	bequad		x		number of data blocks %lld,
7229>&-1332	belong		x		number of cylinder groups %d,
7230>&-1328	belong		x		block size %d,
7231>&-1324	belong		x		fragment size %d,
7232>&-180	belong		x		average file size %d,
7233>&-176	belong		x		average number of files in dir %d,
7234>&-272	bequad		x		pending blocks to free %lld,
7235>&-264	belong		x		pending inodes to free %ld,
7236>&-664	bequad		x		system-wide uuid %0llx,
7237>&-1316	belong		x		minimum percentage of free blocks %d,
7238>&-1248	belong		0		TIME optimization
7239>&-1248	belong		1		SPACE optimization
7240
7241# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
7242# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
7243# volume label and UUID Russell Coker
7244# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
72450x438   leshort         0xEF53          Linux
7246>0x44c  lelong          x               rev %d
7247>0x43e  leshort         x               \b.%d
7248# No journal?  ext2
7249>0x45c  lelong          ^0x0000004      ext2 filesystem data
7250>>0x43a leshort         ^0x0000001      (mounted or unclean)
7251# Has a journal?  ext3 or ext4
7252>0x45c  lelong          &0x0000004
7253#  and small INCOMPAT?
7254>>0x460 lelong          <0x0000040
7255#   and small RO_COMPAT?
7256>>>0x464 lelong         <0x0000008      ext3 filesystem data
7257#   else large RO_COMPAT?
7258>>>0x464 lelong         >0x0000007      ext4 filesystem data
7259#  else large INCOMPAT?
7260>>0x460	lelong          >0x000003f      ext4 filesystem data
7261>0x468	belong		x		\b, UUID=%08x
7262>0x46c	beshort		x		\b-%04x
7263>0x46e	beshort		x		\b-%04x
7264>0x470	beshort		x		\b-%04x
7265>0x472	belong		x		\b-%08x
7266>0x476	beshort		x		\b%04x
7267>0x478	string		>0		\b, volume name "%s"
7268# General flags for any ext* fs
7269>0x460	lelong          &0x0000004      (needs journal recovery)
7270>0x43a	leshort         &0x0000002      (errors)
7271# INCOMPAT flags
7272>0x460	lelong          &0x0000001      (compressed)
7273#>0x460	lelong          &0x0000002      (filetype)
7274#>0x460	lelong          &0x0000010      (meta bg)
7275>0x460	lelong          &0x0000040      (extents)
7276>0x460	lelong          &0x0000080      (64bit)
7277#>0x460	lelong          &0x0000100      (mmp)
7278#>0x460	lelong          &0x0000200      (flex bg)
7279# RO_INCOMPAT flags
7280#>0x464	lelong          &0x0000001      (sparse super)
7281>0x464	lelong          &0x0000002      (large files)
7282>0x464	lelong          &0x0000008      (huge files)
7283#>0x464	lelong          &0x0000010      (gdt checksum)
7284#>0x464	lelong          &0x0000020      (many subdirs)
7285#>0x463	lelong          &0x0000040      (extra isize)
7286
7287# Minix filesystems - Juan Cespedes <cespedes@debian.org>
72880x410	leshort		0x137f
7289!:strength / 2
7290>0x402	beshort		< 100
7291>0x402	beshort		> -1		Minix filesystem, V1, %d zones
7292>0x1e	string		minix		\b, bootable
72930x410	beshort		0x137f
7294!:strength / 2
7295>0x402	beshort		< 100
7296>0x402	beshort		> -1		Minix filesystem, V1 (big endian), %d zones
7297>0x1e	string		minix		\b, bootable
72980x410	leshort		0x138f
7299!:strength / 2
7300>0x402	beshort		< 100
7301>0x402	beshort		> -1		Minix filesystem, V1, 30 char names, %d zones
7302>0x1e	string		minix		\b, bootable
73030x410	beshort		0x138f
7304!:strength / 2
7305>0x402	beshort		< 100
7306>0x402	beshort		> -1		Minix filesystem, V1, 30 char names (big endian), %d zones
7307>0x1e	string		minix		\b, bootable
73080x410	leshort		0x2468
7309>0x402	beshort		< 100
7310>>0x402	beshort		> -1		Minix filesystem, V2, %d zones
7311>0x1e	string		minix		\b, bootable
73120x410	beshort		0x2468
7313>0x402	beshort		< 100
7314>0x402	beshort		> -1		Minix filesystem, V2 (big endian), %d zones
7315>0x1e	string		minix		\b, bootable
7316
73170x410	leshort		0x2478
7318>0x402	beshort		< 100
7319>0x402	beshort		> -1		Minix filesystem, V2, 30 char names, %d zones
7320>0x1e	string		minix		\b, bootable
73210x410	leshort		0x2478
7322>0x402	beshort		< 100
7323>0x402	beshort		> -1		Minix filesystem, V2, 30 char names, %d zones
7324>0x1e	string		minix		\b, bootable
73250x410	beshort		0x2478
7326>0x402	beshort		!0		Minix filesystem, V2, 30 char names (big endian), %d zones
7327>0x1e	string		minix		\b, bootable
73280x410	leshort		0x4d5a
7329>0x402	beshort		!0		Minix filesystem, V3, %d zones
7330>0x1e	string		minix		\b, bootable
7331
7332# SGI disk labels - Nathan Scott <nathans@debian.org>
73330	belong		0x0BE5A941	SGI disk label (volume header)
7334
7335# SGI XFS filesystem - Nathan Scott <nathans@debian.org>
73360	belong		0x58465342	SGI XFS filesystem data
7337>0x4	belong		x		(blksz %d,
7338>0x68	beshort		x		inosz %d,
7339>0x64	beshort		^0x2004		v1 dirs)
7340>0x64	beshort		&0x2004		v2 dirs)
7341
7342############################################################################
7343# Minix-ST kernel floppy
73440x800	belong		0x46fc2700	Atari-ST Minix kernel image
7345>19	string		\240\5\371\5\0\011\0\2\0	\b, 720k floppy
7346>19	string		\320\2\370\5\0\011\0\1\0	\b, 360k floppy
7347
7348############################################################################
7349# Hmmm, is this a better way of detecting _standard_ floppy images ?
735019	string		\320\2\360\3\0\011\0\1\0	DOS floppy 360k
7351>0x1FE	leshort		0xAA55		\b, x86 hard disk boot sector
735219	string		\240\5\371\3\0\011\0\2\0	DOS floppy 720k
7353>0x1FE	leshort		0xAA55		\b, x86 hard disk boot sector
735419	string		\100\013\360\011\0\022\0\2\0	DOS floppy 1440k
7355>0x1FE	leshort		0xAA55		\b, x86 hard disk boot sector
7356
735719	string		\240\5\371\5\0\011\0\2\0	DOS floppy 720k, IBM
7358>0x1FE	leshort		0xAA55		\b, x86 hard disk boot sector
735919	string		\100\013\371\5\0\011\0\2\0	DOS floppy 1440k, mkdosfs
7360>0x1FE	leshort		0xAA55		\b, x86 hard disk boot sector
7361
736219	string		\320\2\370\5\0\011\0\1\0	Atari-ST floppy 360k
736319	string		\240\5\371\5\0\011\0\2\0	Atari-ST floppy 720k
7364
7365#  Valid media descriptor bytes for MS-DOS:
7366#
7367#     Byte   Capacity   Media Size and Type
7368#     -------------------------------------------------
7369#
7370#     F0     2.88 MB    3.5-inch, 2-sided, 36-sector
7371#     F0     1.44 MB    3.5-inch, 2-sided, 18-sector
7372#     F9     720K       3.5-inch, 2-sided, 9-sector
7373#     F9     1.2 MB     5.25-inch, 2-sided, 15-sector
7374#     FD     360K       5.25-inch, 2-sided, 9-sector
7375#     FF     320K       5.25-inch, 2-sided, 8-sector
7376#     FC     180K       5.25-inch, 1-sided, 9-sector
7377#     FE     160K       5.25-inch, 1-sided, 8-sector
7378#     FE     250K       8-inch, 1-sided, single-density
7379#     FD     500K       8-inch, 2-sided, single-density
7380#     FE     1.2 MB     8-inch, 2-sided, double-density
7381#     F8     -----      Fixed disk
7382#
7383#     FC     xxxK       Apricot 70x1x9 boot disk.
7384#
7385# Originally a bitmap:
7386#  xxxxxxx0	Not two sided
7387#  xxxxxxx1	Double sided
7388#  xxxxxx0x	Not 8 SPT
7389#  xxxxxx1x	8 SPT
7390#  xxxxx0xx	Not Removable drive
7391#  xxxxx1xx	Removable drive
7392#  11111xxx	Must be one.
7393#
7394# But now it's rather random:
7395#  111111xx	Low density disk
7396#        00	SS, Not 8 SPT
7397#        01	DS, Not 8 SPT
7398#        10	SS, 8 SPT
7399#        11	DS, 8 SPT
7400#
7401#  11111001	Double density 3 1/2 floppy disk, high density 5 1/4
7402#  11110000	High density 3 1/2 floppy disk
7403#  11111000	Hard disk any format
7404#
7405
7406# CDROM Filesystems
7407# Modified for UDF by gerardo.cacciari@gmail.com
740832769	string    CD001     #
7409!:mime	application/x-iso9660-image
7410>38913	string   !NSR0      ISO 9660 CD-ROM filesystem data
7411>38913	string    NSR0      UDF filesystem data
7412>>38917	string    1         (version 1.0)
7413>>38917	string    2         (version 1.5)
7414>>38917	string    3         (version 2.0)
7415>>38917	byte     >0x33      (unknown version, ID 0x%X)
7416>>38917	byte     <0x31      (unknown version, ID 0x%X)
7417# "application id" which appears to be used as a volume label
7418>32808	string/T  >\0       '%s'
7419>34816	string    \000CD001\001EL\ TORITO\ SPECIFICATION    (bootable)
742037633	string    CD001     ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
7421!:mime	application/x-iso9660-image
742232776	string    CDROM     High Sierra CD-ROM filesystem data
7423
7424# .cso files
74250    string    CISO	Compressed ISO CD image
7426
7427# cramfs filesystem - russell@coker.com.au
74280       lelong    0x28cd3d45      Linux Compressed ROM File System data, little endian
7429>4      lelong  x size %lu
7430>8      lelong  &1 version #2
7431>8      lelong  &2 sorted_dirs
7432>8      lelong  &4 hole_support
7433>32     lelong  x CRC 0x%x,
7434>36     lelong  x edition %lu,
7435>40     lelong  x %lu blocks,
7436>44     lelong  x %lu files
7437
74380       belong    0x28cd3d45      Linux Compressed ROM File System data, big endian
7439>4      belong  x size %lu
7440>8      belong  &1 version #2
7441>8      belong  &2 sorted_dirs
7442>8      belong  &4 hole_support
7443>32     belong  x CRC 0x%x,
7444>36     belong  x edition %lu,
7445>40     belong  x %lu blocks,
7446>44     belong  x %lu files
7447
7448# reiserfs - russell@coker.com.au
74490x10034		string	ReIsErFs	ReiserFS V3.5
74500x10034		string	ReIsEr2Fs	ReiserFS V3.6
74510x10034		string	ReIsEr3Fs	ReiserFS V3.6.19
7452>0x1002c 	leshort	x		block size %d
7453>0x10032	leshort	&2		(mounted or unclean)
7454>0x10000	lelong	x		num blocks %d
7455>0x10040	lelong	1		tea hash
7456>0x10040	lelong	2		yura hash
7457>0x10040	lelong	3		r5 hash
7458
7459# JFFS - russell@coker.com.au
74600	lelong	0x34383931	Linux Journalled Flash File system, little endian
74610	belong	0x34383931	Linux Journalled Flash File system, big endian
7462
7463# EST flat binary format (which isn't, but anyway)
7464# From: Mark Brown <broonie@sirena.org.uk>
74650	string	ESTFBINR	EST flat binary
7466
7467# Aculab VoIP firmware
7468# From: Mark Brown <broonie@sirena.org.uk>
74690	string	VoIP\ Startup\ and	Aculab VoIP firmware
7470>35	string	x	format %s
7471
7472# From: Mark Brown <broonie@sirena.org.uk> [old]
7473# From: Behan Webster <behanw@websterwood.com>
74740	belong	0x27051956	u-boot legacy uImage,
7475>32	string	x		%s,
7476>28	byte	0		Invalid os/
7477>28	byte	1		OpenBSD/
7478>28	byte	2		NetBSD/
7479>28	byte	3		FreeBSD/
7480>28	byte	4		4.4BSD/
7481>28	byte	5		Linux/
7482>28	byte	6		SVR4/
7483>28	byte	7		Esix/
7484>28	byte	8		Solaris/
7485>28	byte	9		Irix/
7486>28	byte	10		SCO/
7487>28	byte	11		Dell/
7488>28	byte	12		NCR/
7489>28	byte	13		LynxOS/
7490>28	byte	14		VxWorks/
7491>28	byte	15		pSOS/
7492>28	byte	16		QNX/
7493>28	byte	17		Firmware/
7494>28	byte	18		RTEMS/
7495>28	byte	19		ARTOS/
7496>28	byte	20		Unity OS/
7497>28	byte	21		INTEGRITY/
7498>29	byte	0		\bInvalid CPU,
7499>29	byte	1		\bAlpha,
7500>29	byte	2		\bARM,
7501>29	byte	3		\bIntel x86,
7502>29	byte	4		\bIA64,
7503>29	byte	5		\bMIPS,
7504>29	byte	6		\bMIPS 64-bit,
7505>29	byte	7		\bPowerPC,
7506>29	byte	8		\bIBM S390,
7507>29	byte	9		\bSuperH,
7508>29	byte	10		\bSparc,
7509>29	byte	11		\bSparc 64-bit,
7510>29	byte	12		\bM68K,
7511>29	byte	13		\bNios-32,
7512>29	byte	14		\bMicroBlaze,
7513>29	byte	15		\bNios-II,
7514>29	byte	16		\bBlackfin,
7515>29	byte	17		\bAVR32,
7516>29	byte	18		\bSTMicroelectronics ST200,
7517>30	byte	0		Invalid Image
7518>30	byte	1		Standalone Program
7519>30	byte	2		OS Kernel Image
7520>30	byte	3		RAMDisk Image
7521>30	byte	4		Multi-File Image
7522>30	byte	5		Firmware Image
7523>30	byte	6		Script File
7524>30	byte	7		Filesystem Image (any type)
7525>30	byte	8		Binary Flat Device Tree BLOB
7526>31	byte	0		(Not compressed),
7527>31	byte	1		(gzip),
7528>31	byte	2		(bzip2),
7529>31	byte	3		(lzma),
7530>12	belong	x		%d bytes,
7531>8	bedate	x		%s,
7532>16	belong	x		Load Address: 0x%08X,
7533>20	belong	x		Entry Point: 0x%08X,
7534>4	belong	x		Header CRC: 0x%08X,
7535>24	belong	x		Data CRC: 0x%08X
7536
7537# JFFS2 file system
75380	leshort	0x1984		Linux old jffs2 filesystem data little endian
75390	leshort	0x1985		Linux jffs2 filesystem data little endian
7540
7541# Squashfs
75420	string	sqsh	Squashfs filesystem, big endian,
7543>28	beshort	x	version %d.
7544>30	beshort x	\b%d,
7545>28	beshort <3
7546>>8	belong	x	%d bytes,
7547>28	beshort >2
7548>>28 beshort <4
7549>>>63	bequad x	%lld bytes,
7550>>28 beshort >3
7551>>>40	bequad x	%lld bytes,
7552#>>67	belong	x	%d bytes,
7553>4	belong	x	%d inodes,
7554>28	beshort <2
7555>>32	beshort	x	blocksize: %d bytes,
7556>28	beshort >1
7557>>28 beshort <4
7558>>>51	belong	x	blocksize: %d bytes,
7559>>28 beshort >3
7560>>>12	belong	x	blocksize: %d bytes,
7561>28 beshort <4
7562>>39	bedate	x	created: %s
7563>28 beshort >3
7564>>8	bedate	x	created: %s
75650	string	hsqs	Squashfs filesystem, little endian,
7566>28	leshort	x	version %d.
7567>30	leshort	x	\b%d,
7568>28	leshort <3
7569>>8	lelong	x	%d bytes,
7570>28	leshort >2
7571>>28 leshort <4
7572>>>63	lequad x	%lld bytes,
7573>>28 leshort >3
7574>>>40	lequad x	%lld bytes,
7575#>>63	lelong	x	%d bytes,
7576>4	lelong	x	%d inodes,
7577>28	leshort <2
7578>>32	leshort	x	blocksize: %d bytes,
7579>28	leshort >1
7580>>28 leshort <4
7581>>>51	lelong	x	blocksize: %d bytes,
7582>>28 leshort >3
7583>>>12	lelong	x	blocksize: %d bytes,
7584>28 leshort <4
7585>>39	ledate	x	created: %s
7586>28 leshort >3
7587>>8	ledate	x	created: %s
7588
7589# AFS Dump Magic
7590# From: Ty Sarna <tsarna@sarna.org>
75910       string                  \x01\xb3\xa1\x13\x22    AFS Dump
7592>&0     belong                  x                       (v%d)
7593>>&0    byte                    0x76
7594>>>&0   belong                  x                       Vol %d,
7595>>>>&0  byte                    0x6e
7596>>>>>&0 string                  x                       %s
7597>>>>>>&1        byte            0x74
7598>>>>>>>&0       beshort         2
7599>>>>>>>>&4      bedate          x                       on: %s
7600>>>>>>>>&0      bedate          =0                      full dump
7601>>>>>>>>&0      bedate          !0                      incremental since: %s
7602
7603#----------------------------------------------------------
7604#delta ISO    Daniel Novotny (dnovotny@redhat.com)
76050	string  DISO	Delta ISO data
7606>4	belong  x	version %d
7607
7608# VMS backup savesets - gerardo.cacciari@gmail.com
7609#
76104            string  \x01\x00\x01\x00\x01\x00
7611>(0.s+16)    string  \x01\x01
7612>>&(&0.b+8)  byte    0x42       OpenVMS backup saveset data
7613>>>40        lelong  x          (block size %d,
7614>>>49        string  >\0        original name '%s',
7615>>>2         short   1024       VAX generated)
7616>>>2         short   2048       AXP generated)
7617>>>2         short   4096       I64 generated)
7618
7619# Summary: Oracle Clustered Filesystem
7620# Created by: Aaron Botsis <redhat@digitalmafia.org>
76218	string		OracleCFS	Oracle Clustered Filesystem,
7622>4	long		x		rev %d
7623>0	long		x		\b.%d,
7624>560	string		x		label: %.64s,
7625>136	string		x		mountpoint: %.128s
7626
7627# Summary: Oracle ASM tagged volume
7628# Created by: Aaron Botsis <redhat@digitalmafia.org>
762932	string		ORCLDISK	Oracle ASM Volume,
7630>40	string		x		Disk Name: %0.12s
763132	string		ORCLCLRD	Oracle ASM Volume (cleared),
7632>40	string		x		Disk Name: %0.12s
7633
7634# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org>
76358	string		OracleCFS	Oracle Clustered Filesystem,
7636>4	long		x		rev %d
7637>0	long		x		\b.%d,
7638>560	string		x		label: %.64s,
7639>136	string		x		mountpoint: %.128s
7640
7641# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org>
764232	string		ORCLDISK	Oracle ASM Volume,
7643>40	string		x		Disk Name: %0.12s
764432	string		ORCLCLRD	Oracle ASM Volume (cleared),
7645>40	string		x		Disk Name: %0.12s
7646
7647# Compaq/HP RILOE floppy image
7648# From: Dirk Jagdmann <doj@cubic.org>
76490	string	CPQRFBLO	Compaq/HP RILOE floppy image
7650
7651#------------------------------------------------------------------------------
7652# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours).
7653# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes,
7654# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com
7655#
76561008    string          DECFILE11       Files-11 On-Disk Structure
7657>525    byte            x               Level %d
7658>525    byte            x               (ODS-%d);
7659>1017   string          A               RSX-11, VAX/VMS or OpenVMS VAX file system;
7660>1017   string          B
7661>>525   byte            2               VAX/VMS or OpenVMS file system;
7662>>525   byte            5               OpenVMS Alpha or Itanium file system;
7663>984    string          x               volume label is '%-12.12s'
7664
7665# From: Thomas Klausner <wiz@NetBSD.org>
7666# http://filext.com/file-extension/DAA
7667# describes the daa file format. The magic would be:
76680	string		DAA\x0\x0\x0\x0\x0	PowerISO Direct-Access-Archive
7669
7670# From Albert Cahalan <acahalan@gmail.com>
7671# really le32 operation,destination,payloadsize (but quite predictable)
7672# 01 00 00 00 00 00 00 c0 00 02 00 00
76730	string		\1\0\0\0\0\0\0\300\0\2\0\0	Marvell Libertas firmware
7674
7675# From Eric Sandeen
7676# GFS2
76770x10000         belong          0x01161970
7678>0x10018        belong          0x0000051d      GFS1 Filesystem
7679>>0x10024        belong          x               (blocksize %d,
7680>>0x10060        string          >\0             lockproto %s)
7681>0x10018        belong          0x00000709      GFS2 Filesystem
7682>>0x10024        belong          x               (blocksize %d,
7683>>0x10060        string          >\0             lockproto %s)
7684
7685# BTRFS
76860x10040         string          _BHRfS_M        BTRFS Filesystem
7687>0x1012b        string          >\0             (label "%s",
7688>0x10090        lelong          x               sectorsize %d,
7689>0x10094        lelong          x               nodesize %d,
7690>0x10098        lelong          x               leafsize %d)
7691
7692
7693# dvdisaster's .ecc
7694# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
76950	string	*dvdisaster*	dvdisaster error correction file
7696
7697# xfs metadump image
7698# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
7699# but can we do the << ?  For now it's always 512 (0x200) anyway.
77000	string XFSM
7701>0x200	string XFSB	XFS filesystem metadump image
7702
7703# Type:	CROM filesystem
7704# From:	Werner Fink <werner@suse.de>
77050	string	CROMFS	CROMFS
7706>6	string	>\0	\b version %2.2s,
7707>8	ulequad	>0	\b block data at %lld,
7708>16	ulequad	>0	\b fblock table at %lld,
7709>24	ulequad	>0	\b inode table at %lld,
7710>32	ulequad	>0	\b root at %lld,
7711>40	ulelong	>0	\b fblock size = %ld,
7712>44	ulelong	>0	\b block size = %ld,
7713>48	ulequad	>0	\b bytes = %lld
7714
7715# Type:	xfs metadump image
7716# From:	Daniel Novotny <dnovotny@redhat.com>
7717# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
7718# but can we do the << ? For now it's always 512 (0x200) anyway.
77190	string	XFSM
7720>0x200	string	XFSB	XFS filesystem metadump image
7721
7722# Type:	delta ISO
7723# From:	Daniel Novotny <dnovotny@redhat.com>
77240	string	DISO	Delta ISO data,
7725>4	belong	x	version %d
7726
7727# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.)
7728# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags.
7729# From: Adam Buchbinder <adam.buchbinder@gmail.com>
77300x8000	string	JFS1
7731# Because it's text-only magic, check a binary value (version) to be sure.
7732# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be
7733# mountable.
7734>&0	lelong	<3	JFS2 filesystem image
7735# Label is followed by a UUID; we have to limit string length to avoid
7736# appending the UUID in the case of a 16-byte label.
7737>>&144	regex	[\x20-\x7E]{1,16}	(label "%s")
7738>>&0	lequad	x	\b, %lld blocks
7739>>&8	lelong	x	\b, blocksize %d
7740>>&32	lelong&0x00000006	>0	(dirty)
7741>>&36	lelong	>0	(compressed)
7742
7743# LFS
77440	lelong	0x070162	LFS filesystem image
7745>4	lelong	1		version 1,
7746>>8	lelong	x		\b blocks %u,
7747>>12	lelong	x		\b blocks per segment %u,
7748>4	lelong	2		version 2,
7749>>8	lelong	x		\b fragments %u,
7750>>12	lelong	x		\b bytes per segment %u,
7751>16	lelong	x		\b disk blocks %u,
7752>20	lelong	x		\b block size %u,
7753>24	lelong	x		\b fragment size %u,
7754>28	lelong	x		\b fragments per block %u,
7755>32	lelong	x		\b start for free list %u,
7756>36	lelong	x		\b number of free blocks %d,
7757>40	lelong	x		\b number of files %u,
7758>44	lelong	x		\b blocks available for writing %d,
7759>48	lelong	x		\b inodes in cache %d,
7760>52	lelong	x		\b inode file disk address 0x%x,
7761>56	lelong	x		\b inode file inode number %u,
7762>60	lelong	x		\b address of last segment written 0x%x,
7763>64	lelong	x		\b address of next segment to write 0x%x,
7764>68	lelong	x		\b address of current segment written 0x%x
7765
77660	string	td\000		floppy image data (TeleDisk, compressed)
77670	string	TD\000		floppy image data (TeleDisk)
7768
77690	string	CQ\024		floppy image data (CopyQM,
7770>16	leshort	x		%d sectors,
7771>18	leshort	x		%d heads.)
7772
77730	string	ACT\020Apricot\020disk\020image\032\004	floppy image data (ApriDisk)
7774
77750	beshort	0xAA58		floppy image data (IBM SaveDskF, old)
77760	beshort	0xAA59		floppy image data (IBM SaveDskF)
77770	beshort	0xAA5A		floppy image data (IBM SaveDskF, compressed)
7778
77790	string	\074CPM_Disk\076	disk image data (YAZE)
7780
7781#------------------------------------------------------------------------------
7782# $File: flash,v 1.9 2009/11/08 01:30:01 christos Exp $
7783# flash:	file(1) magic for Macromedia Flash file format
7784#
7785# See
7786#
7787#	http://www.macromedia.com/software/flash/open/
7788#
77890	string		FWS		Macromedia Flash data,
7790>3	byte		x		version %d
7791!:mime	application/x-shockwave-flash
77920	string		CWS		Macromedia Flash data (compressed),
7793!:mime	application/x-shockwave-flash
7794>3	byte		x		version %d
7795# From: Cal Peake <cp@absolutedigital.net>
77960	string		FLV		Macromedia Flash Video
7797!:mime	video/x-flv
7798
7799#
7800# Yosu Gomez
78010       string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document
78020       string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document
7803# From Dave Wilson
78040	string AGD4\xbe\xb8\xbb\xcb\x00	Macromedia Freehand 9 Document
7805
7806#------------------------------------------------------------------------------
7807# $File: fonts,v 1.26 2013/03/09 22:36:00 christos Exp $
7808# fonts:  file(1) magic for font data
7809#
78100	search/1	FONT		ASCII vfont text
78110	short		0436		Berkeley vfont data
78120	short		017001		byte-swapped Berkeley vfont data
7813
7814# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
78150	string		%!PS-AdobeFont-1.	PostScript Type 1 font text
7816>20	string		>\0			(%s)
78176	string		%!PS-AdobeFont-1.	PostScript Type 1 font program data
78180	string		%!FontType1	PostScript Type 1 font program data
78196	string		%!FontType1	PostScript Type 1 font program data
78200	string		%!PS-Adobe-3.0\ Resource-Font	PostScript Type 1 font text
7821
7822# X11 font files in SNF (Server Natural Format) format
7823# updated by Joerg Jenderek at Feb 2013
7824# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm
78250	belong		00000004		X11 SNF font data, MSB first
7826#>104	belong		00000004		X11 SNF font data, MSB first
7827!:mime	application/x-font-sfn
7828# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX
78290	lelong		00000004
7830>104	lelong		00000004		X11 SNF font data, LSB first
7831!:mime	application/x-font-sfn
7832
7833# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
78340	search/1	STARTFONT\ 		X11 BDF font text
7835
7836# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
7837# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
78380	string		\001fcp			X11 Portable Compiled Font data
7839>12	byte		0x02			\b, LSB first
7840>12	byte		0x0a			\b, MSB first
78410	string		D1.0\015		X11 Speedo font data
7842
7843#------------------------------------------------------------------------------
7844# FIGlet fonts and controlfiles
7845# From figmagic supplied with Figlet version 2.2
7846# "David E. O'Brien" <obrien@FreeBSD.ORG>
78470	string		flf		FIGlet font
7848>3	string		>2a		version %-2.2s
78490	string		flc		FIGlet controlfile
7850>3	string		>2a		version %-2.2s
7851
7852# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
7853# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
78540	belong		0x14025919	libGrx font data,
7855>8	leshort		x		%dx
7856>10	leshort		x		\b%d
7857>40	string		x		%s
7858# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
78590	belong		0xff464f4e	DOS code page font data collection
78607	belong		0x00454741	DOS code page font data
78617	belong		0x00564944	DOS code page font data (from Linux?)
78624098	string		DOSFONT		DOSFONT2 encrypted font data
7863
7864# downloadable fonts for browser (prints type) anthon@mnt.org
78650	string		PFR1		PFR1 font
7866>102	string		>0		\b: %s
7867
7868# True Type fonts
78690	string	\000\001\000\000\000	TrueType font data
7870!:mime application/x-font-ttf
7871
78720	string		\007\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font
78730	string		\012\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font
7874
7875# TrueType/OpenType font collections (.ttc)
7876# http://www.microsoft.com/typography/otspec/otff.htm
78770	string		ttcf		TrueType font collection data
7878>4	belong		0x00010000	\b, 1.0
7879>>8	belong		>0		\b, %d fonts
7880>4	belong		0x00020000	\b, 2.0
7881>>8	belong		>0		\b, %d fonts
7882# 0x44454947 = 'DSIG'
7883>>>16	belong		0x44534947	\b, digitally signed
7884
7885# Opentype font data from Avi Bercovich
78860	string		OTTO		OpenType font data
7887!:mime application/vnd.ms-opentype
7888
7889# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
78900	string		SplineFontDB:	Spline Font Database
7891!:mime application/vnd.font-fontforge-sfd
7892>14	string		x		version %s
7893
7894# EOT
789534	string		LP		Embedded OpenType (EOT)
7896!:mime application/vnd.ms-fontobject
7897
7898# Web Open Font Format (.woff)
7899# http://www.w3.org/TR/WOFF/
79000	string		wOFF	Web Open Font Format
7901>4	belong		x	\b, flavor %d
7902>8	belong		x	\b, length %d
7903>20	beshort		x	\b, version %hd
7904>22	beshort		x	\b.%hd
7905
7906#------------------------------------------------------------------------------
7907# $File: fortran,v 1.7 2012/06/21 01:55:02 christos Exp $
7908# FORTRAN source
79090	regex/100	\^[Cc][\ \t]	FORTRAN program
7910!:mime	text/x-fortran
7911!:strength - 5
7912
7913#------------------------------------------------------------------------------
7914# $File: frame,v 1.12 2009/09/19 16:28:09 christos Exp $
7915# frame:  file(1) magic for FrameMaker files
7916#
7917# This stuff came on a FrameMaker demo tape, most of which is
7918# copyright, but this file is "published" as witness the following:
7919#
7920# Note that this is the Framemaker Maker Interchange Format, not the
7921# Normal format which would be application/vnd.framemaker.
7922#
79230	string		\<MakerFile	FrameMaker document
7924!:mime	application/x-mif
7925>11	string		5.5		 (5.5
7926>11	string		5.0		 (5.0
7927>11	string		4.0		 (4.0
7928>11	string		3.0		 (3.0
7929>11	string		2.0		 (2.0
7930>11	string		1.0		 (1.0
7931>14	byte		x		  %c)
79320	string		\<MIFFile	FrameMaker MIF (ASCII) file
7933!:mime	application/x-mif
7934>9	string		4.0		 (4.0)
7935>9	string		3.0		 (3.0)
7936>9	string		2.0		 (2.0)
7937>9	string		1.0		 (1.x)
79380	search/1	\<MakerDictionary	FrameMaker Dictionary text
7939!:mime	application/x-mif
7940>17	string		3.0		 (3.0)
7941>17	string		2.0		 (2.0)
7942>17	string		1.0		 (1.x)
79430	string		\<MakerScreenFont	FrameMaker Font file
7944!:mime	application/x-mif
7945>17	string		1.01		 (%s)
79460	string		\<MML		FrameMaker MML file
7947!:mime	application/x-mif
79480	string		\<BookFile	FrameMaker Book file
7949!:mime	application/x-mif
7950>10	string		3.0		 (3.0
7951>10	string		2.0		 (2.0
7952>10	string		1.0		 (1.0
7953>13	byte		x		  %c)
7954# XXX - this book entry should be verified, if you find one, uncomment this
7955#0	string		\<Book\ 	FrameMaker Book (ASCII) file
7956#!:mime	application/x-mif
7957#>6	string		3.0		 (3.0)
7958#>6	string		2.0		 (2.0)
7959#>6	string		1.0		 (1.0)
79600	string		\<Maker	Intermediate Print File	FrameMaker IPL file
7961!:mime	application/x-mif
7962
7963#------------------------------------------------------------------------------
7964# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $
7965# freebsd:  file(1) magic for FreeBSD objects
7966#
7967# All new-style FreeBSD magic numbers are in host byte order (i.e.,
7968# little-endian on x86).
7969#
7970# XXX - this comes from the file "freebsd" in a recent FreeBSD version of
7971# "file"; it, and the NetBSD stuff in "netbsd", appear to use different
7972# schemes for distinguishing between executable images, shared libraries,
7973# and object files.
7974#
7975# FreeBSD says:
7976#
7977#    Regardless of whether it's pure, demand-paged, or none of the
7978#    above:
7979#
7980#	if the entry point is < 4096, then it's a shared library if
7981#	the "has run-time loader information" bit is set, and is
7982#	position-independent if the "is position-independent" bit
7983#	is set;
7984#
7985#	if the entry point is >= 4096 (or >4095, same thing), then it's
7986#	an executable, and is dynamically-linked if the "has run-time
7987#	loader information" bit is set.
7988#
7989# On x86, NetBSD says:
7990#
7991#    If it's neither pure nor demand-paged:
7992#
7993#	if it has the "has run-time loader information" bit set, it's
7994#	a dynamically-linked executable;
7995#
7996#	if it doesn't have that bit set, then:
7997#
7998#	    if it has the "is position-independent" bit set, it's
7999#	    position-independent;
8000#
8001#	    if the entry point is non-zero, it's an executable, otherwise
8002#	    it's an object file.
8003#
8004#    If it's pure:
8005#
8006#	if it has the "has run-time loader information" bit set, it's
8007#	a dynamically-linked executable, otherwise it's just an
8008#	executable.
8009#
8010#    If it's demand-paged:
8011#
8012#	if it has the "has run-time loader information" bit set,
8013#	then:
8014#
8015#	    if the entry point is < 4096, it's a shared library;
8016#
8017#	    if the entry point is = 4096 or > 4096 (i.e., >= 4096),
8018#	    it's a dynamically-linked executable);
8019#
8020#	if it doesn't have the "has run-time loader information" bit
8021#	set, then it's just an executable.
8022#
8023# (On non-x86, NetBSD does much the same thing, except that it uses
8024# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
8025# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
8026# had 8K pages; dunno about MIPS.)
8027#
8028# I suspect the two will differ only in perverse and uninteresting cases
8029# ("shared" libraries that aren't demand-paged and whose pages probably
8030# won't actually be shared, executables with entry points <4096).
8031#
8032# I leave it to those more familiar with FreeBSD and NetBSD to figure out
8033# what the right answer is (although using ">4095", FreeBSD-style, is
8034# probably better than separately checking for "=4096" and ">4096",
8035# NetBSD-style).  (The old "netbsd" file analyzed FreeBSD demand paged
8036# executables using the NetBSD technique.)
8037#
80380	lelong&0377777777	041400407	FreeBSD/i386
8039>20	lelong			<4096
8040>>3	byte&0xC0		&0x80		shared library
8041>>3	byte&0xC0		0x40		PIC object
8042>>3	byte&0xC0		0x00		object
8043>20	lelong			>4095
8044>>3	byte&0x80		0x80		dynamically linked executable
8045>>3	byte&0x80		0x00		executable
8046>16	lelong			>0		not stripped
8047
80480	lelong&0377777777	041400410	FreeBSD/i386 pure
8049>20	lelong			<4096
8050>>3	byte&0xC0		&0x80		shared library
8051>>3	byte&0xC0		0x40		PIC object
8052>>3	byte&0xC0		0x00		object
8053>20	lelong			>4095
8054>>3	byte&0x80		0x80		dynamically linked executable
8055>>3	byte&0x80		0x00		executable
8056>16	lelong			>0		not stripped
8057
80580	lelong&0377777777	041400413	FreeBSD/i386 demand paged
8059>20	lelong			<4096
8060>>3	byte&0xC0		&0x80		shared library
8061>>3	byte&0xC0		0x40		PIC object
8062>>3	byte&0xC0		0x00		object
8063>20	lelong			>4095
8064>>3	byte&0x80		0x80		dynamically linked executable
8065>>3	byte&0x80		0x00		executable
8066>16	lelong			>0		not stripped
8067
80680	lelong&0377777777	041400314	FreeBSD/i386 compact demand paged
8069>20	lelong			<4096
8070>>3	byte&0xC0		&0x80		shared library
8071>>3	byte&0xC0		0x40		PIC object
8072>>3	byte&0xC0		0x00		object
8073>20	lelong			>4095
8074>>3	byte&0x80		0x80		dynamically linked executable
8075>>3	byte&0x80		0x00		executable
8076>16	lelong			>0		not stripped
8077
8078# XXX gross hack to identify core files
8079# cores start with a struct tss; we take advantage of the following:
8080# byte 7:     highest byte of the kernel stack pointer, always 0xfe
8081#      8/9:   kernel (ring 0) ss value, always 0x0010
8082#      10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
8083#      28:    low order byte of the current PTD entry, always 0 since the
8084#             PTD is page-aligned
8085#
80867	string	\357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	FreeBSD/i386 a.out core file
8087>1039	string	>\0	from '%s'
8088
8089# /var/run/ld.so.hints
8090# What are you laughing about?
80910	lelong			011421044151	ld.so hints file (Little Endian
8092>4	lelong			>0		\b, version %d)
8093>4	belong			<1		\b)
80940	belong			011421044151	ld.so hints file (Big Endian
8095>4	belong			>0		\b, version %d)
8096>4	belong			<1		\b)
8097
8098#
8099# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
8100#
81010	string	SCRSHOT_	scrshot(1) screenshot,
8102>8	byte	x		version %d,
8103>9	byte	2		%d bytes in header,
8104>>10	byte	x		%d chars wide by
8105>>11	byte	x		%d chars high
8106
8107#------------------------------------------------------------------------------
8108# $File: fsav,v 1.11 2009/09/19 16:28:09 christos Exp $
8109# fsav:  file(1) magic for datafellows fsav virus definition files
8110# Anthon van der Neut (anthon@mnt.org)
8111
8112# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def}
81130	beshort		0x1575		fsav macro virus signatures
8114>8	leshort		>0		(%d-
8115>11	byte		>0		\b%02d-
8116>10	byte		>0		\b%02d)
8117# ftp://ftp.f-prot.com/pub/sign.zip
8118#10	ubyte		<12
8119#>9	ubyte		<32
8120#>>8	ubyte		0x0a
8121#>>>12	ubyte		0x07
8122#>>>>11	uleshort	>0		fsav DOS/Windows virus signatures (%d-
8123#>>>>10	byte		0		\b01-
8124#>>>>10	byte		1		\b02-
8125#>>>>10	byte		2		\b03-
8126#>>>>10	byte		3		\b04-
8127#>>>>10	byte		4		\b05-
8128#>>>>10	byte		5		\b06-
8129#>>>>10	byte		6		\b07-
8130#>>>>10	byte		7		\b08-
8131#>>>>10	byte		8		\b09-
8132#>>>>10	byte		9		\b10-
8133#>>>>10	byte		10		\b11-
8134#>>>>10	byte		11		\b12-
8135#>>>>9	ubyte		>0		\b%02d)
8136# ftp://ftp.f-prot.com/pub/sign2.zip
8137#0	ubyte		0x62
8138#>1	ubyte		0xF5
8139#>>2	ubyte		0x1
8140#>>>3	ubyte		0x1
8141#>>>>4	ubyte		0x0e
8142#>>>>>13		ubyte	>0		fsav virus signatures
8143#>>>>>>11	ubyte	x		size 0x%02x
8144#>>>>>>12	ubyte	x		\b%02x
8145#>>>>>>13	ubyte	x		\b%02x bytes
8146
8147# Joerg Jenderek: joerg dot jenderek at web dot de
8148# http://www.clamav.net/doc/latest/html/node45.html
8149# .cvd files start with a 512 bytes colon separated header
8150# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
8151# + gzipped tarball files
81520	string		ClamAV-VDB:
8153>11	string		>\0		Clam AntiVirus database %-.23s
8154>>34	string		:
8155>>>35		string		!:	\b, version
8156>>>>35		string		x 	\b%-.1s
8157>>>>>36		string 		!:
8158>>>>>>36	string		x 	\b%-.1s
8159>>>>>>>37	string		!:
8160>>>>>>>>37	string		x 	\b%-.1s
8161>>>>>>>>>38	string		!:
8162>>>>>>>>>>38	string		x 	\b%-.1s
8163>512	string		\037\213	\b, gzipped
8164>769	string		ustar\0		\b, tarred
8165
8166# Type: Grisoft AVG AntiVirus
8167# From: David Newgas <david@newgas.net>
81680	string	AVG7_ANTIVIRUS_VAULT_FILE	AVG 7 Antivirus vault file data
8169
8170#------------------------------------------------------------------------------
8171# $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $
8172# fusecompress:   file(1) magic for fusecompress
81730	string	\037\135\211	FuseCompress(ed) data
8174>3	byte	0x00	(none format)
8175>3	byte	0x01	(bz2 format)
8176>3	byte	0x02	(gz format)
8177>3	byte	0x03	(lzo format)
8178>3	byte	0x04	(xor format)
8179>3	byte	>0x04	(unknown format)
8180>4	long	x	uncompressed size: %d
8181
8182#------------------------------------------------------------------------------
8183# $File: games,v 1.13 2012/02/13 22:50:50 christos Exp $
8184# games:  file(1) for games
8185
8186# Fabio Bonelli <fabiobonelli@libero.it>
8187# Quake II - III data files
81880       string  IDP2        	Quake II 3D Model file,
8189>20     long    x               %lu skin(s),
8190>8      long    x               (%lu x
8191>12     long    x 		%lu),
8192>40     long    x               %lu frame(s),
8193>16     long    x               Frame size %lu bytes,
8194>24     long  	x               %lu vertices/frame,
8195>28     long    x            	%lu texture coordinates,
8196>32     long    x               %lu triangles/frame
8197
81980       string  IBSP            Quake
8199>4      long    0x26            II Map file (BSP)
8200>4      long    0x2E      	III Map file (BSP)
8201
82020       string  IDS2            Quake II SP2 sprite file
8203
8204#---------------------------------------------------------------------------
8205# Doom and Quake
8206# submitted by Nicolas Patrois
8207
82080       string  \xcb\x1dBoom\xe6\xff\x03\x01    Boom or linuxdoom demo
8209# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01
8210
821124      string  LxD\ 203        Linuxdoom save
8212>0      string  x       , name=%s
8213>44     string  x       , world=%s
8214
8215# Quake
8216
82170       string  PACK    Quake I or II world or extension
8218>8	lelong	>0	\b, %d entries
8219
8220#0       string  -1\x0a  Quake I demo
8221#>30     string  x        version %.4s
8222#>61     string  x        level %s
8223
8224#0       string  5\x0a   Quake I save
8225
8226# The levels
8227
8228# Quake 1
8229
82300	string	5\x0aIntroduction             Quake I save: start Introduction
82310	string	5\x0athe_Slipgate_Complex     Quake I save: e1m1 The slipgate complex
82320	string	5\x0aCastle_of_the_Damned     Quake I save: e1m2 Castle of the damned
82330	string	5\x0athe_Necropolis           Quake I save: e1m3 The necropolis
82340	string	5\x0athe_Grisly_Grotto        Quake I save: e1m4 The grisly grotto
82350	string	5\x0aZiggurat_Vertigo         Quake I save: e1m8 Ziggurat vertigo (secret)
82360	string	5\x0aGloom_Keep               Quake I save: e1m5 Gloom keep
82370	string	5\x0aThe_Door_To_Chthon       Quake I save: e1m6 The door to Chthon
82380	string	5\x0aThe_House_of_Chthon      Quake I save: e1m7 The house of Chthon
82390	string	5\x0athe_Installation         Quake I save: e2m1 The installation
82400	string	5\x0athe_Ogre_Citadel         Quake I save: e2m2 The ogre citadel
82410	string	5\x0athe_Crypt_of_Decay       Quake I save: e2m3 The crypt of decay (dopefish lives!)
82420	string	5\x0aUnderearth               Quake I save: e2m7 Underearth (secret)
82430	string	5\x0athe_Ebon_Fortress        Quake I save: e2m4 The ebon fortress
82440	string	5\x0athe_Wizard's_Manse       Quake I save: e2m5 The wizard's manse
82450	string	5\x0athe_Dismal_Oubliette     Quake I save: e2m6 The dismal oubliette
82460	string	5\x0aTermination_Central      Quake I save: e3m1 Termination central
82470	string	5\x0aVaults_of_Zin            Quake I save: e3m2 Vaults of Zin
82480	string	5\x0athe_Tomb_of_Terror       Quake I save: e3m3 The tomb of terror
82490	string	5\x0aSatan's_Dark_Delight     Quake I save: e3m4 Satan's dark delight
82500	string	5\x0athe_Haunted_Halls        Quake I save: e3m7 The haunted halls (secret)
82510	string	5\x0aWind_Tunnels             Quake I save: e3m5 Wind tunnels
82520	string	5\x0aChambers_of_Torment      Quake I save: e3m6 Chambers of torment
82530	string	5\x0athe_Sewage_System        Quake I save: e4m1 The sewage system
82540	string	5\x0aThe_Tower_of_Despair     Quake I save: e4m2 The tower of despair
82550	string	5\x0aThe_Elder_God_Shrine     Quake I save: e4m3 The elder god shrine
82560	string	5\x0athe_Palace_of_Hate       Quake I save: e4m4 The palace of hate
82570	string	5\x0aHell's_Atrium            Quake I save: e4m5 Hell's atrium
82580	string	5\x0athe_Nameless_City        Quake I save: e4m8 The nameless city (secret)
82590	string	5\x0aThe_Pain_Maze            Quake I save: e4m6 The pain maze
82600	string	5\x0aAzure_Agony              Quake I save: e4m7 Azure agony
82610	string	5\x0aShub-Niggurath's_Pit     Quake I save: end Shub-Niggurath's pit
8262
8263# Quake DeathMatch levels
8264
82650	string	5\x0aPlace_of_Two_Deaths	 Quake I save: dm1 Place of two deaths
82660	string	5\x0aClaustrophobopolis		 Quake I save: dm2 Claustrophobopolis
82670	string	5\x0aThe_Abandoned_Base		 Quake I save: dm3 The abandoned base
82680	string	5\x0aThe_Bad_Place		 Quake I save: dm4 The bad place
82690	string	5\x0aThe_Cistern		 Quake I save: dm5 The cistern
82700	string	5\x0aThe_Dark_Zone		 Quake I save: dm6 The dark zone
8271
8272# Scourge of Armagon
8273
82740	string	5\x0aCommand_HQ               Quake I save: start Command HQ
82750	string	5\x0aThe_Pumping_Station      Quake I save: hip1m1 The pumping station
82760	string	5\x0aStorage_Facility         Quake I save: hip1m2 Storage facility
82770	string	5\x0aMilitary_Complex         Quake I save: hip1m5 Military complex (secret)
82780	string	5\x0athe_Lost_Mine            Quake I save: hip1m3 The lost mine
82790	string	5\x0aResearch_Facility        Quake I save: hip1m4 Research facility
82800	string	5\x0aAncient_Realms           Quake I save: hip2m1 Ancient realms
82810	string	5\x0aThe_Gremlin's_Domain     Quake I save: hip2m6 The gremlin's domain (secret)
82820	string	5\x0aThe_Black_Cathedral      Quake I save: hip2m2 The black cathedral
82830	string	5\x0aThe_Catacombs            Quake I save: hip2m3 The catacombs
82840	string	5\x0athe_Crypt__              Quake I save: hip2m4 The crypt
82850	string	5\x0aMortum's_Keep            Quake I save: hip2m5 Mortum's keep
82860	string	5\x0aTur_Torment              Quake I save: hip3m1 Tur torment
82870	string	5\x0aPandemonium              Quake I save: hip3m2 Pandemonium
82880	string	5\x0aLimbo                    Quake I save: hip3m3 Limbo
82890	string	5\x0athe_Edge_of_Oblivion     Quake I save: hipdm1 The edge of oblivion (secret)
82900	string	5\x0aThe_Gauntlet             Quake I save: hip3m4 The gauntlet
82910	string	5\x0aArmagon's_Lair           Quake I save: hipend Armagon's lair
8292
8293# Malice
8294
82950	string	5\x0aThe_Academy      Quake I save: start The academy
82960	string	5\x0aThe_Lab          Quake I save: d1 The lab
82970	string	5\x0aArea_33          Quake I save: d1b Area 33
82980	string	5\x0aSECRET_MISSIONS  Quake I save: d3b Secret missions
82990	string	5\x0aThe_Hospital     Quake I save: d10 The hospital (secret)
83000	string	5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)
83010	string	5\x0aBACK_2_MALICE    Quake I save: d4b Back to Malice
83020	string	5\x0aArea44           Quake I save: d1c Area 44
83030	string	5\x0aTakahiro_Towers  Quake I save: d2 Takahiro towers
83040	string	5\x0aA_Rat's_Life     Quake I save: d3 A rat's life
83050	string	5\x0aInto_The_Flood   Quake I save: d4 Into the flood
83060	string	5\x0aThe_Flood        Quake I save: d5 The flood
83070	string	5\x0aNuclear_Plant    Quake I save: d6 Nuclear plant
83080	string	5\x0aThe_Incinerator_Plant    Quake I save: d7 The incinerator plant
83090	string	5\x0aThe_Foundry              Quake I save: d7b The foundry
83100	string	5\x0aThe_Underwater_Base      Quake I save: d8 The underwater base
83110	string	5\x0aTakahiro_Base            Quake I save: d9 Takahiro base
83120	string	5\x0aTakahiro_Laboratories    Quake I save: d12 Takahiro laboratories
83130	string	5\x0aStayin'_Alive    Quake I save: d13 Stayin' alive
83140	string	5\x0aB.O.S.S._HQ      Quake I save: d14 B.O.S.S. HQ
83150	string	5\x0aSHOWDOWN!        Quake I save: d15 Showdown!
8316
8317# Malice DeathMatch levels
8318
83190	string	5\x0aThe_Seventh_Precinct	 Quake I save: ddm1 The seventh precinct
83200	string	5\x0aSub_Station		 Quake I save: ddm2 Sub station
83210	string	5\x0aCrazy_Eights!		 Quake I save: ddm3 Crazy eights!
83220	string	5\x0aEast_Side_Invertationa	 Quake I save: ddm4 East side invertationa
83230	string	5\x0aSlaughterhouse		 Quake I save: ddm5 Slaughterhouse
83240	string	5\x0aDOMINO			 Quake I save: ddm6 Domino
83250	string	5\x0aSANDRA'S_LADDER		 Quake I save: ddm7 Sandra's ladder
8326
8327
83280	string	MComprHD	MAME CHD compressed hard disk image,
8329>12	belong	x		version %lu
8330
8331# doom - submitted by Jon Dowland
8332
83330	string	=IWAD		doom main IWAD data
8334>4	lelong	x		containing %d lumps
83350	string	=PWAD		doom patch PWAD data
8336>4	lelong	x		containing %d lumps
8337
8338# Build engine group files (Duke Nukem, Shadow Warrior, ...)
8339# Extension: .grp
8340# Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org>
83410	string	KenSilverman	Build engine group file
8342>12	lelong	x		containing %d files
8343
8344# Summary: Warcraft 3 save
8345# Extension: .w3g
8346# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
83470	string		Warcraft\ III\ recorded\ game	%s
8348
8349
8350# Summary: Warcraft 3 map
8351# Extension: .w3m
8352# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
83530	string		HM3W		Warcraft III map file
8354
8355
8356# Summary: SGF Smart Game Format
8357# Extension: .sgf
8358# Reference: http://www.red-bean.com/sgf/
8359# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
8360# Modified by (1): Abel Cheung (regex, more game format)
8361# FIXME: Some games don't have GM (game type)
83620	regex		\\(;.*GM\\[[0-9]{1,2}\\]	Smart Game Format
8363>2	search/0x200/b	GM[
8364>>&0	string		1]	(Go)
8365>>&0	string		2]	(Othello)
8366>>&0	string		3]	(chess)
8367>>&0	string		4]	(Gomoku+Renju)
8368>>&0	string		5]	(Nine Men's Morris)
8369>>&0	string		6]	(Backgammon)
8370>>&0	string		7]	(Chinese chess)
8371>>&0	string		8]	(Shogi)
8372>>&0	string		9]	(Lines of Action)
8373>>&0	string		10]	(Ataxx)
8374>>&0	string		11]	(Hex)
8375>>&0	string		12]	(Jungle)
8376>>&0	string		13]	(Neutron)
8377>>&0	string		14]	(Philosopher's Football)
8378>>&0	string		15]	(Quadrature)
8379>>&0	string		16]	(Trax)
8380>>&0	string		17]	(Tantrix)
8381>>&0	string		18]	(Amazons)
8382>>&0	string		19]	(Octi)
8383>>&0	string		20]	(Gess)
8384>>&0	string		21]	(Twixt)
8385>>&0	string		22]	(Zertz)
8386>>&0	string		23]	(Plateau)
8387>>&0	string		24]	(Yinsh)
8388>>&0	string		25]	(Punct)
8389>>&0	string		26]	(Gobblet)
8390>>&0	string		27]	(hive)
8391>>&0	string		28]	(Exxit)
8392>>&0	string		29]	(Hnefatal)
8393>>&0	string		30]	(Kuba)
8394>>&0	string		31]	(Tripples)
8395>>&0	string		32]	(Chase)
8396>>&0	string		33]	(Tumbling Down)
8397>>&0	string		34]	(Sahara)
8398>>&0	string		35]	(Byte)
8399>>&0	string		36]	(Focus)
8400>>&0	string		37]	(Dvonn)
8401>>&0	string		38]	(Tamsk)
8402>>&0	string		39]	(Gipf)
8403>>&0	string		40]	(Kropki)
8404
8405##############################################
8406# NetImmerse/Gamebryo game engine entries
8407
8408# Summary: Gamebryo game engine file
8409# Extension: .nif, .kf
8410# Created by: Abel Cheung <abelcheung@gmail.com>
84110		string		Gamebryo\ File\ Format,\ Version\ 	Gamebryo game engine file
8412>&0		regex		[0-9a-z.]+				\b, version %s
8413
8414# Summary: Gamebryo game engine file
8415# Extension: .kfm
8416# Created by: Abel Cheung <abelcheung@gmail.com>
84170		string		;Gamebryo\ KFM\ File\ Version\ 		Gamebryo game engine animation File
8418>&0		regex		[0-9a-z.]+				\b, version %s
8419
8420# Summary: NetImmerse game engine file
8421# Extension .nif
8422# Created by: Abel Cheung <abelcheung@gmail.com>
84230		string		NetImmerse\ File\ Format,\ Versio
8424>&0		string		n\ 					NetImmerse game engine file
8425>>&0		regex		[0-9a-z.]+				\b, version %s
8426
8427# Type:	SGF Smart Game Format
8428# URL:	http://www.red-bean.com/sgf/
8429# From:	Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
84302	regex/c	\\(;.*GM\\[[0-9]{1,2}\\]	Smart Game Format
8431>2	regex/c	GM\\[1\\]			- Go Game
8432>2	regex/c	GM\\[6\\]			- BackGammon Game
8433>2	regex/c	GM\\[11\\]			- Hex Game
8434>2	regex/c	GM\\[18\\]			- Amazons Game
8435>2	regex/c	GM\\[19\\]			- Octi Game
8436>2	regex/c	GM\\[20\\]			- Gess Game
8437>2	regex/c	GM\\[21\\]			- twix Game
8438
8439# Epic Games/Unreal Engine Package
8440#
84410	lelong		0x9E2A83C1	Unreal Engine Package,
8442>4	leshort		x		version: %i
8443>12	lelong		!0		\b, names: %i
8444>28	lelong		!0		\b, imports: %i
8445>20	lelong		!0		\b, exports: %i
8446
8447#------------------------------------------------------------------------------
8448# $File: gcc,v 1.4 2009/09/19 16:28:09 christos Exp $
8449# gcc:  file(1) magic for GCC special files
8450#
84510	string		gpch		GCC precompiled header
8452
8453# The version field is annoying.  It's 3 characters, not zero-terminated.
8454>5	byte		x			(version %c
8455>6	byte		x			\b%c
8456>7	byte		x			\b%c)
8457
8458# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'
8459>4	byte		67			for C
8460>4	byte		111			for Objective C
8461>4	byte		43			for C++
8462>4	byte		79			for Objective C++
8463
8464#------------------------------------------------------------------------------
8465# $File: geo,v 1.3 2013/01/04 00:47:02 christos Exp $
8466# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu>
8467
8468######################################################################
8469#
8470# Acoustic Doppler Current Profilers (ADCP)
8471#
8472######################################################################
8473
84740	beshort	0x7f7f	RDI Acoustic Doppler Current Profiler (ADCP)
8475
8476######################################################################
8477#
8478# Metadata
8479#
8480######################################################################
8481
84820	string	Identification_Information	FGDC ASCII metadata
8483
8484######################################################################
8485#
8486# Seimsic / Subbottom
8487#
8488######################################################################
8489
8490# Knudsen subbottom chirp profiler - Binary File Format: B9
8491# KEB D409-03167 V1.75 Huffman
84920	string	KEB\ 	Knudsen seismic KEL binary (KEB) -
8493>4	regex	[-A-Z0-9]*	Software: %s
8494>>&1	regex	V[0-9]*\.[0-9]*	version %s
8495
8496######################################################################
8497#
8498# LIDAR - Laser altimetry or bathy
8499#
8500######################################################################
8501
8502
8503# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data
85040	string	HCA	LADS Caris Ascii Format (CAF) bathymetric lidar
8505>4	regex [0-9]*\.[0-9]*	version %s
8506
85070	string	HCB	LADS Caris Binary Format (CBF) bathymetric lidar waveform data
8508>3      byte    x	version %d .
8509>4	byte	x	%d
8510
8511
8512######################################################################
8513#
8514# MULTIBEAM SONARS http://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/
8515#
8516######################################################################
8517
8518# GeoAcoustics - GeoSwath Plus
85194	beshort	0x2002	GeoSwath RDF
85200	string	Start:-	GeoSwatch auf text file
8521
8522# Seabeam 2100
8523# mbsystem code mb41
85240	string SB2100	SeaBeam 2100 multibeam sonar
85250	string SB2100DR	SeaBeam 2100 DR multibeam sonar
85260	string SB2100PR SeaBeam 2100 PR multibeam sonar
8527
8528# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor
8529# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR.
85300    string $HSF    XSE multibeam
8531
8532# mb121 http://www.saic.com/maritime/gsf/
85338	string	GSF-v	SAIC generic sensor format (GSF) sonar data,
8534>&0	regex [0-9]*\.[0-9]*	version %s
8535
8536# MGD77 - http://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm
8537# mb161
85389	string MGD77	MGD77 Header, Marine Geophysical Data Exchange Format
8539
8540# MBSystem processing caches the mbinfo output
85411	string	Swath\ Data\ File:	mbsystem info cache
8542
8543# Caris John Hughes Clark format
85440	string	HDCS	Caris multibeam sonar related data
85451	string	Start/Stop\ parameter\ header:	Caris ASCII project summary
8546
8547######################################################################
8548#
8549# Visualization and 3D modeling
8550#
8551######################################################################
8552
8553# IVS - IVS3d.com Tagged Data Represetation
85540	string	%%\ TDR\ 2.0	IVS Fledermaus TDR file
8555
8556# http://www.ecma-international.org/publications/standards/Ecma-363.htm
8557# 3D in PDFs
85580	string	U3D	ECMA-363, Universal 3D
8559
8560######################################################################
8561#
8562# Support files
8563#
8564######################################################################
8565
8566# https://midas.psi.ch/elog/
85670	string	$@MID@$	elog journal entry
8568
8569# Geospatial Designs http://www.geospatialdesigns.com/surfer6_format.htm
85700	string		DSBB	Surfer 6 binary grid file
8571>4	leshort		x	\b, %d
8572>6	leshort		x	\bx%d
8573>8	ledouble	x	\b, minx=%g
8574>16	ledouble	x	\b, maxx=%g
8575>24	ledouble	x	\b, miny=%g
8576>32	ledouble	x	\b, maxy=%g
8577>40	ledouble	x	\b, minz=%g
8578>48	ledouble	x	\b, maxz=%g
8579
8580
8581#------------------------------------------------------------------------------
8582# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $
8583# GEOS files (Vidar Madsen, vidar@gimp.org)
8584# semi-commonly used in embedded and handheld systems.
85850	belong	0xc745c153	GEOS
8586>40	byte	1	executable
8587>40	byte	2	VMFile
8588>40	byte	3	binary
8589>40	byte	4	directory label
8590>40	byte	<1	unknown
8591>40	byte	>4	unknown
8592>4	string	>\0	\b, name "%s"
8593#>44	short	x	\b, version %d
8594#>46	short	x	\b.%d
8595#>48	short	x	\b, rev %d
8596#>50	short	x	\b.%d
8597#>52	short	x	\b, proto %d
8598#>54	short	x	\br%d
8599#>168	string	>\0	\b, copyright "%s"
8600
8601#------------------------------------------------------------------------------
8602# $File: gimp,v 1.7 2010/09/20 18:55:20 rrt Exp $
8603# GIMP Gradient: file(1) magic for the GIMP's gradient data files
8604# by Federico Mena <federico@nuclecu.unam.mx>
8605
86060       string          GIMP\ Gradient  GIMP gradient data
8607
8608#------------------------------------------------------------------------------
8609# XCF:  file(1) magic for the XCF image format used in the GIMP developed
8610#       by Spencer Kimball and Peter Mattis
8611#       ('Bucky' LaDieu, nega@vt.edu)
8612
86130	string		gimp\ xcf	GIMP XCF image data,
8614!:mime	image/x-xcf
8615>9	string		file		version 0,
8616>9	string		v		version
8617>>10	string		>\0		%s,
8618>14	belong		x		%lu x
8619>18	belong		x		%lu,
8620>22     belong          0               RGB Color
8621>22     belong          1               Greyscale
8622>22     belong          2               Indexed Color
8623>22	belong		>2		Unknown Image Type.
8624
8625#------------------------------------------------------------------------------
8626# XCF:  file(1) magic for the patterns used in the GIMP, developed
8627#       by Spencer Kimball and Peter Mattis
8628#       ('Bucky' LaDieu, nega@vt.edu)
8629
863020      string          GPAT            GIMP pattern data,
8631>24     string          x               %s
8632
8633#------------------------------------------------------------------------------
8634# XCF:  file(1) magic for the brushes used in the GIMP, developed
8635#       by Spencer Kimball and Peter Mattis
8636#       ('Bucky' LaDieu, nega@vt.edu)
8637
863820      string          GIMP            GIMP brush data
8639
8640# GIMP Curves File
8641# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
86420	string	#\040GIMP\040Curves\040File	GIMP curve file
8643
8644#------------------------------------------------------------------------------
8645# $File: gnome,v 1.3 2013/02/05 15:20:47 christos Exp $
8646# GNOME related files
8647
8648# Contributed by Josh Triplett
8649# FIXME: Could be simplified if pstring supported two-byte counts
86500         string   GnomeKeyring\n\r\0\n GNOME keyring
8651>&0       ubyte    0                    \b, major version 0
8652>>&0      ubyte    0                    \b, minor version 0
8653>>>&0     ubyte    0                    \b, crypto type 0 (AES)
8654>>>&0     ubyte    >0                   \b, crypto type %hhu (unknown)
8655>>>&1     ubyte    0                    \b, hash type 0 (MD5)
8656>>>&1     ubyte    >0                   \b, hash type %hhu (unknown)
8657>>>&2     ubelong  0xFFFFFFFF           \b, name NULL
8658>>>&2     ubelong  !0xFFFFFFFF
8659>>>>&-4   ubelong  >255                 \b, name too long for file's pstring type
8660>>>>&-4   ubelong  <256
8661>>>>>&-1  pstring  x                    \b, name "%s"
8662>>>>>>&0  ubeqdate x                    \b, last modified %s
8663>>>>>>&8  ubeqdate x                    \b, created %s
8664>>>>>>&16 ubelong  &1
8665>>>>>>>&0 ubelong  x                    \b, locked if idle for %u seconds
8666>>>>>>&16 ubelong  ^1                   \b, not locked if idle
8667>>>>>>&24 ubelong  x                    \b, hash iterations %u
8668>>>>>>&28 ubequad  x                    \b, salt %llu
8669>>>>>>&52 ubelong  x                    \b, %u item(s)
8670
8671# From: Alex Beregszaszi <alex@fsn.hu>
86724	string	gtktalog		GNOME Catalogue (gtktalog)
8673>13	string	>\0			version %s
8674
8675# Summary: GStreamer binary registry
8676# Extension: .bin
8677# Submitted by: Josh Triplett <josh@joshtriplett.org>
86780	belong	0xc0def00d		GStreamer binary registry
8679>4	string	x			\b, version %s
8680
8681# GVariant Database file
8682# By Elan Ruusamae <glen@delfi.ee>
8683# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h
8684# It's always "GVariant", it's byte swapped on incompatible archs
8685# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c
8686# file_builder_serialise()
8687# http://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant
86880	string	GVariant	GVariant Database file,
8689# version is never filled. probably future extension
8690>8	lelong	x		version %d
8691# not sure are these usable, so commented out
8692#>>16	lelong	x		start %d,
8693#>>>20	lelong	x		end %d
8694
8695# G-IR database made by gobject-introspect toolset,
8696# http://live.gnome.org/GObjectIntrospection
86970	string		GOBJ\nMETADATA\r\n\032	G-IR binary database
8698>16	byte		x			\b, v%d
8699>17	byte		x			\b.%d
8700>20	leshort		x			\b, %d entries
8701>22	leshort		x			\b/%d local
8702
8703#------------------------------------------------------------------------------
8704# $File: gnu,v 1.14 2012/10/03 23:38:12 christos Exp $
8705# gnu:  file(1) magic for various GNU tools
8706#
8707# GNU nlsutils message catalog file format
8708#
8709# GNU message catalog (.mo and .gmo files)
8710
87110	string		\336\22\4\225	GNU message catalog (little endian),
8712>6	leshort		x		revision %d.
8713>4	leshort		>0		\b%d,
8714>>8	lelong		x		%d messages,
8715>>36	lelong		x		%d sysdep messages
8716>4	leshort		=0		\b%d,
8717>>8	lelong		x		%d messages
8718
87190	string		\225\4\22\336	GNU message catalog (big endian),
8720>4	beshort		x		revision %d.
8721>6	beshort		>0		\b%d,
8722>>8	belong		x		%d messages,
8723>>36	belong		x		%d sysdep messages
8724>6	beshort		=0		\b%d,
8725>>8	belong		x		%d messages
8726
8727
8728# GnuPG
8729# The format is very similar to pgp
87300	string          \001gpg                 GPG key trust database
8731>4	byte            x                       version %d
8732# Note: magic.mime had 0x8501 for the next line instead of 0x8502
87330	beshort		0x8502			GPG encrypted data
8734!:mime	text/PGP # encoding: data
8735
8736# This magic is not particularly good, as the keyrings don't have true
8737# magic. Nevertheless, it covers many keyrings.
87380       beshort         0x9901                  GPG key public ring
8739!:mime	application/x-gnupg-keyring
8740
8741# Symmetric encryption
87420	leshort		0x0d8c
8743>4	leshort		0x0203
8744>>2	leshort		0x0204		GPG symmetrically encrypted data (3DES cipher)
8745>>2	leshort		0x0304		GPG symmetrically encrypted data (CAST5 cipher)
8746>>2	leshort		0x0404		GPG symmetrically encrypted data (BLOWFISH cipher)
8747>>2	leshort		0x0704		GPG symmetrically encrypted data (AES cipher)
8748>>2	leshort		0x0804		GPG symmetrically encrypted data (AES192 cipher)
8749>>2	leshort		0x0904		GPG symmetrically encrypted data (AES256 cipher)
8750>>2	leshort		0x0a04		GPG symmetrically encrypted data (TWOFISH cipher)
8751>>2	leshort		0x0b04		GPG symmetrically encrypted data (CAMELLIA128 cipher)
8752>>2	leshort		0x0c04		GPG symmetrically encrypted data (CAMELLIA192 cipher)
8753>>2	leshort		0x0d04		GPG symmetrically encrypted data (CAMELLIA256 cipher)
8754
8755
8756# Gnumeric spreadsheet
8757# This entry is only semi-helpful, as Gnumeric compresses its files, so
8758# they will ordinarily reported as "compressed", but at least -z helps
875939      string          =<gmr:Workbook           Gnumeric spreadsheet
8760
8761# From: James Youngman <jay@gnu.org>
8762# gnu find magic
87630	string	\0LOCATE	GNU findutils locate database data
8764>7	string	>\0		\b, format %s
8765>7	string	02		\b (frcode)
8766
8767# Files produced by GNU gettext
87680	long	0xDE120495		GNU-format message catalog data
87690	long	0x950412DE		GNU-format message catalog data
8770
8771# gettext message catalogue
87720	regex	\^msgid\ 		GNU gettext message catalogue text
8773!:mime text/x-po
8774
8775#------------------------------------------------------------------------------
8776# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $
8777# gnumeric:  file(1) magic for Gnumeric spreadsheet
8778# This entry is only semi-helpful, as Gnumeric compresses its files, so
8779# they will ordinarily reported as "compressed", but at least -z helps
878039	string	=<gmr:Workbook	Gnumeric spreadsheet
8781!:mime	application/x-gnumeric
8782
8783#------------------------------------------------------------------------------
8784# $File: gpt,v 1.1 2013/02/18 18:31:09 christos Exp $
8785#
8786# GPT Partition table patterns.
8787# Author: Rogier Goossens (goossens.rogier@gmail.com)
8788# Note that a GPT-formatted disk must contain an MBR as well.
8789#
8790
8791# The initial segment (up to >>>>>>>>422) was copied from the X86
8792# partition table code (aka MBR).
8793# This is kept separate, so that MBR partitions are not reported as well.
8794# (use -k if you do want them as well)
8795
8796# First, detect the MBR partiton table
8797# If more than one GPT protective MBR partition exists, don't print anything
8798# (the other MBR detection code will then just print the MBR partition table)
87990x1FE			leshort		0xAA55
8800>3			string		!MS
8801>>3			string		!SYSLINUX
8802>>>3			string		!MTOOL
8803>>>>3			string		!NEWLDR
8804>>>>>5			string		!DOS
8805# not FAT (32 bit)
8806>>>>>>82		string		!FAT32
8807#not Linux kernel
8808>>>>>>>514		string		!HdrS
8809#not BeOS
8810>>>>>>>>422		string		!Be\ Boot\ Loader
8811# GPT with protective MBR entry in partition 1 (only)
8812>>>>>>>>>450		ubyte		0xee
8813>>>>>>>>>>466		ubyte		!0xee
8814>>>>>>>>>>>482		ubyte		!0xee
8815>>>>>>>>>>>>498		ubyte		!0xee
8816#>>>>>>>>>>>>>446	use		gpt-mbr-partition
8817>>>>>>>>>>>>>(454.l*8192)	string		EFI\ PART	GPT partition table
8818>>>>>>>>>>>>>>0			use		gpt-mbr-type
8819>>>>>>>>>>>>>>&-8		use		gpt-table
8820>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
8821>>>>>>>>>>>>>(454.l*8192)	string		!EFI\ PART
8822>>>>>>>>>>>>>>(454.l*4096)	string		EFI\ PART	GPT partition table
8823>>>>>>>>>>>>>>>0		use		gpt-mbr-type
8824>>>>>>>>>>>>>>>&-8		use		gpt-table
8825>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
8826>>>>>>>>>>>>>>(454.l*4096)	string		!EFI\ PART
8827>>>>>>>>>>>>>>>(454.l*2048)	string		EFI\ PART	GPT partition table
8828>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
8829>>>>>>>>>>>>>>>>&-8		use		gpt-table
8830>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
8831>>>>>>>>>>>>>>>(454.l*2048)	string		!EFI\ PART
8832>>>>>>>>>>>>>>>>(454.l*1024)	string		EFI\ PART	GPT partition table
8833>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
8834>>>>>>>>>>>>>>>>>&-8		use		gpt-table
8835>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
8836>>>>>>>>>>>>>>>>(454.l*1024)	string		!EFI\ PART
8837>>>>>>>>>>>>>>>>>(454.l*512)	string		EFI\ PART	GPT partition table
8838>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
8839>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
8840>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
8841# GPT with protective MBR entry in partition 2 (only)
8842>>>>>>>>>450		ubyte		!0xee
8843>>>>>>>>>>466		ubyte		0xee
8844>>>>>>>>>>>482		ubyte		!0xee
8845>>>>>>>>>>>>498		ubyte		!0xee
8846#>>>>>>>>>>>>>462	use		gpt-mbr-partition
8847>>>>>>>>>>>>>(470.l*8192)	string		EFI\ PART	GPT partition table
8848>>>>>>>>>>>>>>0			use		gpt-mbr-type
8849>>>>>>>>>>>>>>&-8		use		gpt-table
8850>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
8851>>>>>>>>>>>>>(470.l*8192)	string		!EFI\ PART
8852>>>>>>>>>>>>>>(470.l*4096)	string		EFI\ PART	GPT partition table
8853>>>>>>>>>>>>>>>0		use		gpt-mbr-type
8854>>>>>>>>>>>>>>>&-8		use		gpt-table
8855>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
8856>>>>>>>>>>>>>>(470.l*4096)	string		!EFI\ PART
8857>>>>>>>>>>>>>>>(470.l*2048)	string		EFI\ PART	GPT partition table
8858>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
8859>>>>>>>>>>>>>>>>&-8		use		gpt-table
8860>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
8861>>>>>>>>>>>>>>>(470.l*2048)	string		!EFI\ PART
8862>>>>>>>>>>>>>>>>(470.l*1024)	string		EFI\ PART	GPT partition table
8863>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
8864>>>>>>>>>>>>>>>>>&-8		use		gpt-table
8865>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
8866>>>>>>>>>>>>>>>>(470.l*1024)	string		!EFI\ PART
8867>>>>>>>>>>>>>>>>>(470.l*512)	string		EFI\ PART	GPT partition table
8868>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
8869>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
8870>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
8871# GPT with protective MBR entry in partition 3 (only)
8872>>>>>>>>>450		ubyte		!0xee
8873>>>>>>>>>>466		ubyte		!0xee
8874>>>>>>>>>>>482		ubyte		0xee
8875>>>>>>>>>>>>498		ubyte		!0xee
8876#>>>>>>>>>>>>>478	use		gpt-mbr-partition
8877>>>>>>>>>>>>>(486.l*8192)	string		EFI\ PART	GPT partition table
8878>>>>>>>>>>>>>>0			use		gpt-mbr-type
8879>>>>>>>>>>>>>>&-8		use		gpt-table
8880>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
8881>>>>>>>>>>>>>(486.l*8192)	string		!EFI\ PART
8882>>>>>>>>>>>>>>(486.l*4096)	string		EFI\ PART	GPT partition table
8883>>>>>>>>>>>>>>>0		use		gpt-mbr-type
8884>>>>>>>>>>>>>>>&-8		use		gpt-table
8885>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
8886>>>>>>>>>>>>>>(486.l*4096)	string		!EFI\ PART
8887>>>>>>>>>>>>>>>(486.l*2048)	string		EFI\ PART	GPT partition table
8888>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
8889>>>>>>>>>>>>>>>>&-8		use		gpt-table
8890>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
8891>>>>>>>>>>>>>>>(486.l*2048)	string		!EFI\ PART
8892>>>>>>>>>>>>>>>>(486.l*1024)	string		EFI\ PART	GPT partition table
8893>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
8894>>>>>>>>>>>>>>>>>&-8		use		gpt-table
8895>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
8896>>>>>>>>>>>>>>>>(486.l*1024)	string		!EFI\ PART
8897>>>>>>>>>>>>>>>>>(486.l*512)	string		EFI\ PART	GPT partition table
8898>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
8899>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
8900>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
8901# GPT with protective MBR entry in partition 4 (only)
8902>>>>>>>>>450		ubyte		!0xee
8903>>>>>>>>>>466		ubyte		!0xee
8904>>>>>>>>>>>482		ubyte		!0xee
8905>>>>>>>>>>>>498		ubyte		0xee
8906#>>>>>>>>>>>>>494	use		gpt-mbr-partition
8907>>>>>>>>>>>>>(502.l*8192)	string		EFI\ PART	GPT partition table
8908>>>>>>>>>>>>>>0			use		gpt-mbr-type
8909>>>>>>>>>>>>>>&-8		use		gpt-table
8910>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
8911>>>>>>>>>>>>>(502.l*8192)	string		!EFI\ PART
8912>>>>>>>>>>>>>>(502.l*4096)	string		EFI\ PART	GPT partition table
8913>>>>>>>>>>>>>>>0		use		gpt-mbr-type
8914>>>>>>>>>>>>>>>&-8		use		gpt-table
8915>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
8916>>>>>>>>>>>>>>(502.l*4096)	string		!EFI\ PART
8917>>>>>>>>>>>>>>>(502.l*2048)	string		EFI\ PART	GPT partition table
8918>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
8919>>>>>>>>>>>>>>>>&-8		use		gpt-table
8920>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
8921>>>>>>>>>>>>>>>(502.l*2048)	string		!EFI\ PART
8922>>>>>>>>>>>>>>>>(502.l*1024)	string		EFI\ PART	GPT partition table
8923>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
8924>>>>>>>>>>>>>>>>>&-8		use		gpt-table
8925>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
8926>>>>>>>>>>>>>>>>(502.l*1024)	string		!EFI\ PART
8927>>>>>>>>>>>>>>>>>(502.l*512)	string		EFI\ PART	GPT partition table
8928>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
8929>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
8930>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
8931
8932# The following code does GPT detection and processing, including
8933# sector size detection.
8934# It has to be duplicated above because the top-level pattern
8935# (i.e. not called using 'use') must print *something* for file
8936# to count it as a match. Text only printed in named patterns is
8937# not counted, and causes file to continue, and try and match
8938# other patterns.
8939#
8940# Unfortunately, when assuming sector sizes >=16k, if the sector size
8941# happens to be 512 instead, we may find confusing data after the GPT
8942# table...  If the GPT table has less than 128 entries, this may even
8943# happen for assumed sector sizes as small as 4k
8944# This could be solved by checking for the presence of the backup GPT
8945# header as well, but that makes the logic extremely complex
8946##0		name		gpt-mbr-partition
8947##>(8.l*8192)	string		EFI\ PART
8948##>>(8.l*8192)	use		gpt-mbr-type
8949##>>&-8		use		gpt-table
8950##>>0		ubyte		x		of 8192 bytes
8951##>(8.l*8192)	string		!EFI\ PART
8952##>>(8.l*4096)	string		EFI\ PART	GPT partition table
8953##>>>0		use		gpt-mbr-type
8954##>>>&-8		use		gpt-table
8955##>>>0		ubyte		x		of 4096 bytes
8956##>>(8.l*4096)	string		!EFI\ PART
8957##>>>(8.l*2048)	string		EFI\ PART	GPT partition table
8958##>>>>0		use		gpt-mbr-type
8959##>>>>&-8		use		gpt-table
8960##>>>>0		ubyte		x		of 2048 bytes
8961##>>>(8.l*2048)	string		!EFI\ PART
8962##>>>>(8.l*1024)	string		EFI\ PART	GPT partition table
8963##>>>>>0		use		gpt-mbr-type
8964##>>>>>&-8	use		gpt-table
8965##>>>>>0		ubyte		x		of 1024 bytes
8966##>>>>(8.l*1024)	string		!EFI\ PART
8967##>>>>>(8.l*512)	string		EFI\ PART	GPT partition table
8968##>>>>>>0		use		gpt-mbr-type
8969##>>>>>>&-8	use		gpt-table
8970##>>>>>>0		ubyte		x		of 512 bytes
8971
8972# Print details of MBR type for a GPT-disk
8973# Calling code ensures that there is only one 0xee partition.
89740		name		gpt-mbr-type
8975# GPT with protective MBR entry in partition 1
8976>450		ubyte		0xee
8977>>454		ulelong		1
8978>>>462		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
8979>>454		ulelong		!1													\b (nonstandard: not at LBA 1)
8980# GPT with protective MBR entry in partition 2
8981>466		ubyte		0xee
8982>>470		ulelong		1
8983>>>478		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
8984>>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0					\b (with hybrid MBR)
8985>>>478		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
8986>>470		ulelong		!1									\b (nonstandard: not at LBA 1)
8987# GPT with protective MBR entry in partition 3
8988>482		ubyte		0xee
8989>>486		ulelong		1
8990>>>494		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
8991>>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
8992>>>494		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0					\b (with hybrid MBR)
8993>>486		ulelong		!1									\b (nonstandard: not at LBA 1)
8994# GPT with protective MBR entry in partition 4
8995>498		ubyte		0xee
8996>>502		ulelong		1
8997>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
8998>>502		ulelong		!1													\b (nonstandard: not at LBA 1)
8999
9000# Print the information from a GPT partition table structure
90010		name		gpt-table
9002>10		uleshort	x		\b, version %u
9003>8		uleshort	x		\b.%u
9004# a GUID is just like a UUID, except it's displayed mixed-endian.
9005>56		ulelong		x		\b, GUID: %08x
9006>60		uleshort	x		\b-%04x
9007>62		uleshort	x		\b-%04x
9008>64		ubeshort	x		\b-%04x
9009>66		ubeshort	x		\b-%04x
9010>68		ubelong		x		\b%08x
9011#>80		uleshort	x		\b, %d partition entries
9012>32		ulequad+1	x		\b, disk size: %lld sectors
9013
9014# In case a GPT data-structure is at LBA 0, report it as well
9015# This covers systems which are not GPT-aware, and which show
9016# and allow access to the protective partition. This code will
9017# detect the contents of such a partition.
90180		string		EFI\ PART	GPT data structure (nonstandard: at LBA 0)
9019>0		use		gpt-table
9020>0		ubyte		x		(sector size unknown)
9021
9022
9023
9024#------------------------------------------------------------------------------
9025# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $
9026# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
9027#
9028# ACE/gr binary
90290	string	\000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003		old ACE/gr binary file
9030>39	byte	>0			- version %c
9031# ACE/gr ascii
90320	string	#\ xvgr\ parameter\ file	ACE/gr ascii file
90330	string	#\ xmgr\ parameter\ file	ACE/gr ascii file
90340	string	#\ ACE/gr\ parameter\ file	ACE/gr ascii file
9035# Grace projects
90360	string	#\ Grace\ project\ file		Grace project file
9037>23	string	@version\  			(version
9038>>32	byte	>0 				%c
9039>>33	string	>\0 				\b.%.2s
9040>>35	string	>\0 				\b.%.2s)
9041# ACE/gr fit description files
90420	string	#\ ACE/gr\ fit\ description\ 	ACE/gr fit description file
9043# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
9044
9045#------------------------------------------------------------------------------
9046# $File: graphviz,v 1.7 2009/09/19 16:28:09 christos Exp $
9047# graphviz:  file(1) magic for http://www.graphviz.org/
9048
9049# FIXME: These patterns match too generally. For example, the first
9050# line matches a LaTeX file containing the word "graph" (with a {
9051# following later) and the second line matches this file.
9052#0	regex/100	[\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{	graphviz graph text
9053#!:mime	text/vnd.graphviz
9054#0	regex/100	[\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{	graphviz digraph text
9055#!:mime	text/vnd.graphviz
9056
9057#------------------------------------------------------------------------------
9058# $File: gringotts,v 1.5 2009/09/19 16:28:09 christos Exp $
9059# gringotts:  file(1) magic for Gringotts
9060# http://devel.pluto.linux.it/projects/Gringotts/
9061# author: Germano Rizzo <mano@pluto.linux.it>
9062#GRG3????Y
90630	string	GRG		Gringotts data file
9064#file format 1
9065>3	string		1		v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
9066#file format 2
9067>3	string		2		v.2, MCRYPT S2K,
9068>>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
9069>>8	byte&0x70	0x10		SERPENT crypt,
9070>>8	byte&0x70	0x20		TWOFISH crypt,
9071>>8	byte&0x70	0x30		CAST-256 crypt,
9072>>8	byte&0x70	0x40		SAFER+ crypt,
9073>>8	byte&0x70	0x50		LOKI97 crypt,
9074>>8	byte&0x70	0x60		3DES crypt,
9075>>8	byte&0x70	0x70		RIJNDAEL-256 crypt,
9076>>8	byte&0x08	0x00		SHA1 hash,
9077>>8	byte&0x08	0x08		RIPEMD-160 hash,
9078>>8	byte&0x04	0x00		ZLib
9079>>8	byte&0x04	0x04		BZip2
9080>>8	byte&0x03	0x00		lvl.0
9081>>8	byte&0x03	0x01		lvl.3
9082>>8	byte&0x03	0x02		lvl.6
9083>>8	byte&0x03	0x03		lvl.9
9084#file format 3
9085>3	string		3		v.3, OpenPGP S2K,
9086>>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
9087>>8	byte&0x70	0x10		SERPENT crypt,
9088>>8	byte&0x70	0x20		TWOFISH crypt,
9089>>8	byte&0x70	0x30		CAST-256 crypt,
9090>>8	byte&0x70	0x40		SAFER+ crypt,
9091>>8	byte&0x70	0x50		LOKI97 crypt,
9092>>8	byte&0x70	0x60		3DES crypt,
9093>>8	byte&0x70	0x70		RIJNDAEL-256 crypt,
9094>>8	byte&0x08	0x00		SHA1 hash,
9095>>8	byte&0x08	0x08		RIPEMD-160 hash,
9096>>8	byte&0x04	0x00		ZLib
9097>>8	byte&0x04	0x04		BZip2
9098>>8	byte&0x03	0x00		lvl.0
9099>>8	byte&0x03	0x01		lvl.3
9100>>8	byte&0x03	0x02		lvl.6
9101>>8	byte&0x03	0x03		lvl.9
9102#file format >3
9103>3	string		>3		v.%.1s (unknown details)
9104
9105#------------------------------------------------------------------------------
9106# $File: guile,v 1.1 2011/12/16 17:44:33 christos Exp $
9107# Guile file magic from <dalepsmith@gmail.com>
9108# http://www.gnu.org/s/guile/
9109# http://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250
9110
91110	string	GOOF----	Guile Object
9112>8	string	LE		\b, little endian
9113>8	string	BE		\b, big endian
9114>11	string	4		\b, 32bit
9115>11	string	8		\b, 64bit
9116>13	regex	.\..		\b, bytecode v%s
9117
9118#------------------------------------------------------------------------------
9119# $File: hitachi-sh,v 1.6 2013/01/29 19:31:33 christos Exp $
9120# hitach-sh: file(1) magic for Hitachi Super-H
9121#
9122# Super-H COFF
9123#
9124# below test line conflicts with 2nd NTFS filesystem sector
91250	beshort		0x0500		Hitachi SH big-endian COFF
9126# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR
9127#0	ubelong&0xFFFFNMPQ	0x0500NMPQ     Hitachi SH big-endian COFF
9128>18	beshort&0x0002	=0x0000		object
9129>18	beshort&0x0002	=0x0002		executable
9130>18	beshort&0x0008	=0x0008		\b, stripped
9131>18	beshort&0x0008	=0x0000		\b, not stripped
9132#
91330	leshort		0x0550		Hitachi SH little-endian COFF
9134>18	leshort&0x0002	=0x0000		object
9135>18	leshort&0x0002	=0x0002		executable
9136>18	leshort&0x0008	=0x0008		\b, stripped
9137>18	leshort&0x0008	=0x0000		\b, not stripped
9138
9139
9140#------------------------------------------------------------------------------
9141# $File: hp,v 1.23 2009/09/19 16:28:09 christos Exp $
9142# hp:  file(1) magic for Hewlett Packard machines (see also "printer")
9143#
9144# XXX - somebody should figure out whether any byte order needs to be
9145# applied to the "TML" stuff; I'm assuming the Apollo stuff is
9146# big-endian as it was mostly 68K-based.
9147#
9148# I think the 500 series was the old stack-based machines, running a
9149# UNIX environment atop the "SUN kernel"; dunno whether it was
9150# big-endian or little-endian.
9151#
9152# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
9153# hp300 are 68020+68881 based; hp400 are also 68k.  The following basic
9154# HP magic is useful for reference, but using "long" magic is a better
9155# practice in order to avoid collisions.
9156#
9157# Guy Harris (guy@netapp.com): some additions to this list came from
9158# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
9159# 1.2, and 2.0).  The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
9160# "/etc/magic", though, except for the "archive file relocatable library"
9161# stuff, and the 68030 and 68040 stuff isn't there at all - are they not
9162# used in executables, or have they just not yet updated "/etc/magic"
9163# completely?
9164#
9165# 0	beshort		200		hp200 (68010) BSD binary
9166# 0	beshort		300		hp300 (68020+68881) BSD binary
9167# 0	beshort		0x20c		hp200/300 HP-UX binary
9168# 0	beshort		0x20d		hp400 (68030) HP-UX binary
9169# 0	beshort		0x20e		hp400 (68040?) HP-UX binary
9170# 0	beshort		0x20b		PA-RISC1.0 HP-UX binary
9171# 0	beshort		0x210		PA-RISC1.1 HP-UX binary
9172# 0	beshort		0x211		PA-RISC1.2 HP-UX binary
9173# 0	beshort		0x214		PA-RISC2.0 HP-UX binary
9174
9175#
9176# The "misc" stuff needs a byte order; the archives look suspiciously
9177# like the old 177545 archives (0xff65 = 0177545).
9178#
9179#### Old Apollo stuff
91800	beshort		0627		Apollo m68k COFF executable
9181>18	beshort		^040000		not stripped
9182>22	beshort		>0		- version %ld
91830	beshort		0624		apollo a88k COFF executable
9184>18	beshort		^040000		not stripped
9185>22	beshort		>0		- version %ld
91860       long            01203604016     TML 0123 byte-order format
91870       long            01702407010     TML 1032 byte-order format
91880       long            01003405017     TML 2301 byte-order format
91890       long            01602007412     TML 3210 byte-order format
9190#### PA-RISC 1.1
91910	belong 		0x02100106	PA-RISC1.1 relocatable object
91920	belong 		0x02100107	PA-RISC1.1 executable
9193>168	belong		&0x00000004	dynamically linked
9194>(144)	belong		0x054ef630	dynamically linked
9195>96	belong		>0		- not stripped
9196
91970	belong 		0x02100108	PA-RISC1.1 shared executable
9198>168	belong&0x4	0x4		dynamically linked
9199>(144)	belong		0x054ef630	dynamically linked
9200>96	belong		>0		- not stripped
9201
92020	belong 		0x0210010b	PA-RISC1.1 demand-load executable
9203>168	belong&0x4	0x4		dynamically linked
9204>(144)	belong		0x054ef630	dynamically linked
9205>96	belong		>0		- not stripped
9206
92070	belong 		0x0210010e	PA-RISC1.1 shared library
9208>96	belong		>0		- not stripped
9209
92100	belong 		0x0210010d	PA-RISC1.1 dynamic load library
9211>96	belong		>0		- not stripped
9212
9213#### PA-RISC 2.0
92140	belong		0x02140106	PA-RISC2.0 relocatable object
9215
92160       belong		0x02140107	PA-RISC2.0 executable
9217>168	belong		&0x00000004	dynamically linked
9218>(144)	belong		0x054ef630	dynamically linked
9219>96	belong		>0		- not stripped
9220
92210       belong		0x02140108	PA-RISC2.0 shared executable
9222>168	belong		&0x00000004	dynamically linked
9223>(144)	belong		0x054ef630	dynamically linked
9224>96	belong		>0		- not stripped
9225
92260       belong		0x0214010b	PA-RISC2.0 demand-load executable
9227>168	belong		&0x00000004	dynamically linked
9228>(144)	belong		0x054ef630	dynamically linked
9229>96	belong		>0		- not stripped
9230
92310       belong		0x0214010e	PA-RISC2.0 shared library
9232>96	belong		>0		- not stripped
9233
92340       belong		0x0214010d	PA-RISC2.0 dynamic load library
9235>96	belong		>0		- not stripped
9236
9237#### 800
92380	belong 		0x020b0106	PA-RISC1.0 relocatable object
9239
92400	belong 		0x020b0107	PA-RISC1.0 executable
9241>168	belong&0x4	0x4		dynamically linked
9242>(144)	belong		0x054ef630	dynamically linked
9243>96	belong		>0		- not stripped
9244
92450	belong 		0x020b0108	PA-RISC1.0 shared executable
9246>168	belong&0x4	0x4		dynamically linked
9247>(144)	belong		0x054ef630	dynamically linked
9248>96	belong		>0		- not stripped
9249
92500	belong 		0x020b010b	PA-RISC1.0 demand-load executable
9251>168	belong&0x4	0x4		dynamically linked
9252>(144)	belong		0x054ef630	dynamically linked
9253>96	belong		>0		- not stripped
9254
92550	belong 		0x020b010e	PA-RISC1.0 shared library
9256>96	belong		>0		- not stripped
9257
92580	belong 		0x020b010d	PA-RISC1.0 dynamic load library
9259>96	belong		>0		- not stripped
9260
92610	belong		0x213c6172	archive file
9262>68	belong 		0x020b0619	- PA-RISC1.0 relocatable library
9263>68	belong	 	0x02100619	- PA-RISC1.1 relocatable library
9264>68	belong 		0x02110619	- PA-RISC1.2 relocatable library
9265>68	belong 		0x02140619	- PA-RISC2.0 relocatable library
9266
9267#### 500
92680	long		0x02080106	HP s500 relocatable executable
9269>16	long		>0		- version %ld
9270
92710	long		0x02080107	HP s500 executable
9272>16	long		>0		- version %ld
9273
92740	long		0x02080108	HP s500 pure executable
9275>16	long		>0		- version %ld
9276
9277#### 200
92780	belong 		0x020c0108	HP s200 pure executable
9279>4	beshort		>0		- version %ld
9280>8	belong		&0x80000000	save fp regs
9281>8	belong		&0x40000000	dynamically linked
9282>8	belong		&0x20000000	debuggable
9283>36	belong		>0		not stripped
9284
92850	belong		0x020c0107	HP s200 executable
9286>4	beshort		>0		- version %ld
9287>8	belong		&0x80000000	save fp regs
9288>8	belong		&0x40000000	dynamically linked
9289>8	belong		&0x20000000	debuggable
9290>36	belong		>0		not stripped
9291
92920	belong		0x020c010b	HP s200 demand-load executable
9293>4	beshort		>0		- version %ld
9294>8	belong		&0x80000000	save fp regs
9295>8	belong		&0x40000000	dynamically linked
9296>8	belong		&0x20000000	debuggable
9297>36	belong		>0		not stripped
9298
92990	belong		0x020c0106	HP s200 relocatable executable
9300>4	beshort		>0		- version %ld
9301>6	beshort		>0		- highwater %d
9302>8	belong		&0x80000000	save fp regs
9303>8	belong		&0x20000000	debuggable
9304>8	belong		&0x10000000	PIC
9305
93060	belong 		0x020a0108	HP s200 (2.x release) pure executable
9307>4	beshort		>0		- version %ld
9308>36	belong		>0		not stripped
9309
93100	belong		0x020a0107	HP s200 (2.x release) executable
9311>4	beshort		>0		- version %ld
9312>36	belong		>0		not stripped
9313
93140	belong		0x020c010e	HP s200 shared library
9315>4	beshort		>0		- version %ld
9316>6	beshort		>0		- highwater %d
9317>36	belong		>0		not stripped
9318
93190	belong		0x020c010d	HP s200 dynamic load library
9320>4	beshort		>0		- version %ld
9321>6	beshort		>0		- highwater %d
9322>36	belong		>0		not stripped
9323
9324#### MISC
93250	long		0x0000ff65	HP old archive
93260	long		0x020aff65	HP s200 old archive
93270	long		0x020cff65	HP s200 old archive
93280	long		0x0208ff65	HP s500 old archive
9329
93300	long		0x015821a6	HP core file
9331
93320	long		0x4da7eee8	HP-WINDOWS font
9333>8	byte		>0		- version %ld
93340	string		Bitmapfile	HP Bitmapfile
9335
93360	string		IMGfile	CIS 	compimg HP Bitmapfile
9337# XXX - see "lif"
9338#0	short		0x8000		lif file
93390	long		0x020c010c	compiled Lisp
9340
93410	string		msgcat01	HP NLS message catalog,
9342>8	long		>0		%d messages
9343
9344# Summary: HP-48/49 calculator
9345# Created by: phk@data.fls.dk
9346# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk>
9347# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support)
93480	string		HPHP		HP
9349>4	string		48		48 binary
9350>4	string		49		49 binary
9351>7	byte		>64		- Rev %c
9352>8	leshort		0x2911		(ADR)
9353>8	leshort		0x2933		(REAL)
9354>8	leshort		0x2955		(LREAL)
9355>8	leshort		0x2977		(COMPLX)
9356>8	leshort		0x299d		(LCOMPLX)
9357>8	leshort		0x29bf		(CHAR)
9358>8	leshort		0x29e8		(ARRAY)
9359>8	leshort		0x2a0a		(LNKARRAY)
9360>8	leshort		0x2a2c		(STRING)
9361>8	leshort		0x2a4e		(HXS)
9362>8	leshort		0x2a74		(LIST)
9363>8	leshort		0x2a96		(DIR)
9364>8	leshort		0x2ab8		(ALG)
9365>8	leshort		0x2ada		(UNIT)
9366>8	leshort		0x2afc		(TAGGED)
9367>8	leshort		0x2b1e		(GROB)
9368>8	leshort		0x2b40		(LIB)
9369>8	leshort		0x2b62		(BACKUP)
9370>8	leshort		0x2b88		(LIBDATA)
9371>8	leshort		0x2d9d		(PROG)
9372>8	leshort		0x2dcc		(CODE)
9373>8	leshort		0x2e48		(GNAME)
9374>8	leshort		0x2e6d		(LNAME)
9375>8	leshort		0x2e92		(XLIB)
9376
93770	string		%%HP:		HP text
9378>6	string		T(0)		- T(0)
9379>6	string		T(1)		- T(1)
9380>6	string		T(2)		- T(2)
9381>6	string		T(3)		- T(3)
9382>10	string		A(D)		A(D)
9383>10	string		A(R)		A(R)
9384>10	string		A(G)		A(G)
9385>14	string		F(.)		F(.);
9386>14	string		F(,)		F(,);
9387
9388
9389# Summary: HP-38/39 calculator
9390# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
93910	string		HP3
9392>3	string		8		HP 38
9393>3	string		9		HP 39
9394>4	string		Bin		binary
9395>4	string		Asc		ASCII
9396>7	string		A		(Directory List)
9397>7	string		B		(Zaplet)
9398>7	string		C		(Note)
9399>7	string		D		(Program)
9400>7	string		E		(Variable)
9401>7	string		F		(List)
9402>7	string		G		(Matrix)
9403>7	string		H		(Library)
9404>7	string		I		(Target List)
9405>7	string		J		(ASCII Vector specification)
9406>7	string		K		(wildcard)
9407
9408# Summary: HP-38/39 calculator
9409# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
94100	string		HP3
9411>3	string		8		HP 38
9412>3	string		9		HP 39
9413>4	string		Bin		binary
9414>4	string		Asc		ASCII
9415>7	string		A		(Directory List)
9416>7	string		B		(Zaplet)
9417>7	string		C		(Note)
9418>7	string		D		(Program)
9419>7	string		E		(Variable)
9420>7	string		F		(List)
9421>7	string		G		(Matrix)
9422>7	string		H		(Library)
9423>7	string		I		(Target List)
9424>7	string		J		(ASCII Vector specification)
9425>7	string		K		(wildcard)
9426
9427# hpBSD magic numbers
94280	beshort		200		hp200 (68010) BSD
9429>2	beshort		0407		impure binary
9430>2	beshort		0410		read-only binary
9431>2	beshort		0413		demand paged binary
94320	beshort		300		hp300 (68020+68881) BSD
9433>2	beshort		0407		impure binary
9434>2	beshort		0410		read-only binary
9435>2	beshort		0413		demand paged binary
9436#
9437# From David Gero <dgero@nortelnetworks.com>
9438# HP-UX 10.20 core file format from /usr/include/sys/core.h
9439# Unfortunately, HP-UX uses corehead blocks without specifying the order
9440# There are four we care about:
9441#     CORE_KERNEL, which starts with the string "HP-UX"
9442#     CORE_EXEC, which contains the name of the command
9443#     CORE_PROC, which contains the signal number that caused the core dump
9444#     CORE_FORMAT, which contains the version of the core file format (== 1)
9445# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC
9446# but we include all 6 variations of the order of the first 3, and
9447# assume that PROC will always be last
9448# Order 1: KERNEL, EXEC, FORMAT, PROC
94490x10		string	HP-UX
9450>0		belong	2
9451>>0xC		belong	0x3C
9452>>>0x4C		belong	0x100
9453>>>>0x58	belong	0x44
9454>>>>>0xA0	belong	1
9455>>>>>>0xAC	belong	4
9456>>>>>>>0xB0	belong	1
9457>>>>>>>>0xB4	belong	4		core file
9458>>>>>>>>>0x90	string	>\0		from '%s'
9459>>>>>>>>>0xC4	belong	3		- received SIGQUIT
9460>>>>>>>>>0xC4	belong	4		- received SIGILL
9461>>>>>>>>>0xC4	belong	5		- received SIGTRAP
9462>>>>>>>>>0xC4	belong	6		- received SIGABRT
9463>>>>>>>>>0xC4	belong	7		- received SIGEMT
9464>>>>>>>>>0xC4	belong	8		- received SIGFPE
9465>>>>>>>>>0xC4	belong	10		- received SIGBUS
9466>>>>>>>>>0xC4	belong	11		- received SIGSEGV
9467>>>>>>>>>0xC4	belong	12		- received SIGSYS
9468>>>>>>>>>0xC4	belong	33		- received SIGXCPU
9469>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
9470# Order 2: KERNEL, FORMAT, EXEC, PROC
9471>>>0x4C		belong	1
9472>>>>0x58	belong	4
9473>>>>>0x5C	belong	1
9474>>>>>>0x60	belong	0x100
9475>>>>>>>0x6C	belong	0x44
9476>>>>>>>>0xB4	belong	4		core file
9477>>>>>>>>>0xA4	string	>\0		from '%s'
9478>>>>>>>>>0xC4	belong	3		- received SIGQUIT
9479>>>>>>>>>0xC4	belong	4		- received SIGILL
9480>>>>>>>>>0xC4	belong	5		- received SIGTRAP
9481>>>>>>>>>0xC4	belong	6		- received SIGABRT
9482>>>>>>>>>0xC4	belong	7		- received SIGEMT
9483>>>>>>>>>0xC4	belong	8		- received SIGFPE
9484>>>>>>>>>0xC4	belong	10		- received SIGBUS
9485>>>>>>>>>0xC4	belong	11		- received SIGSEGV
9486>>>>>>>>>0xC4	belong	12		- received SIGSYS
9487>>>>>>>>>0xC4	belong	33		- received SIGXCPU
9488>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
9489# Order 3: FORMAT, KERNEL, EXEC, PROC
94900x24		string	HP-UX
9491>0		belong	1
9492>>0xC		belong	4
9493>>>0x10		belong	1
9494>>>>0x14	belong	2
9495>>>>>0x20	belong	0x3C
9496>>>>>>0x60	belong	0x100
9497>>>>>>>0x6C	belong	0x44
9498>>>>>>>>0xB4	belong	4		core file
9499>>>>>>>>>0xA4	string	>\0		from '%s'
9500>>>>>>>>>0xC4	belong	3		- received SIGQUIT
9501>>>>>>>>>0xC4	belong	4		- received SIGILL
9502>>>>>>>>>0xC4	belong	5		- received SIGTRAP
9503>>>>>>>>>0xC4	belong	6		- received SIGABRT
9504>>>>>>>>>0xC4	belong	7		- received SIGEMT
9505>>>>>>>>>0xC4	belong	8		- received SIGFPE
9506>>>>>>>>>0xC4	belong	10		- received SIGBUS
9507>>>>>>>>>0xC4	belong	11		- received SIGSEGV
9508>>>>>>>>>0xC4	belong	12		- received SIGSYS
9509>>>>>>>>>0xC4	belong	33		- received SIGXCPU
9510>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
9511# Order 4: EXEC, KERNEL, FORMAT, PROC
95120x64		string	HP-UX
9513>0		belong	0x100
9514>>0xC		belong	0x44
9515>>>0x54		belong	2
9516>>>>0x60	belong	0x3C
9517>>>>>0xA0	belong	1
9518>>>>>>0xAC	belong	4
9519>>>>>>>0xB0	belong	1
9520>>>>>>>>0xB4	belong	4		core file
9521>>>>>>>>>0x44	string	>\0		from '%s'
9522>>>>>>>>>0xC4	belong	3		- received SIGQUIT
9523>>>>>>>>>0xC4	belong	4		- received SIGILL
9524>>>>>>>>>0xC4	belong	5		- received SIGTRAP
9525>>>>>>>>>0xC4	belong	6		- received SIGABRT
9526>>>>>>>>>0xC4	belong	7		- received SIGEMT
9527>>>>>>>>>0xC4	belong	8		- received SIGFPE
9528>>>>>>>>>0xC4	belong	10		- received SIGBUS
9529>>>>>>>>>0xC4	belong	11		- received SIGSEGV
9530>>>>>>>>>0xC4	belong	12		- received SIGSYS
9531>>>>>>>>>0xC4	belong	33		- received SIGXCPU
9532>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
9533# Order 5: FORMAT, EXEC, KERNEL, PROC
95340x78		string	HP-UX
9535>0		belong	1
9536>>0xC		belong	4
9537>>>0x10		belong	1
9538>>>>0x14	belong	0x100
9539>>>>>0x20	belong	0x44
9540>>>>>>0x68	belong	2
9541>>>>>>>0x74	belong	0x3C
9542>>>>>>>>0xB4	belong	4		core file
9543>>>>>>>>>0x58	string	>\0		from '%s'
9544>>>>>>>>>0xC4	belong	3		- received SIGQUIT
9545>>>>>>>>>0xC4	belong	4		- received SIGILL
9546>>>>>>>>>0xC4	belong	5		- received SIGTRAP
9547>>>>>>>>>0xC4	belong	6		- received SIGABRT
9548>>>>>>>>>0xC4	belong	7		- received SIGEMT
9549>>>>>>>>>0xC4	belong	8		- received SIGFPE
9550>>>>>>>>>0xC4	belong	10		- received SIGBUS
9551>>>>>>>>>0xC4	belong	11		- received SIGSEGV
9552>>>>>>>>>0xC4	belong	12		- received SIGSYS
9553>>>>>>>>>0xC4	belong	33		- received SIGXCPU
9554>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
9555# Order 6: EXEC, FORMAT, KERNEL, PROC
9556>0		belong	0x100
9557>>0xC		belong	0x44
9558>>>0x54		belong	1
9559>>>>0x60	belong	4
9560>>>>>0x64	belong	1
9561>>>>>>0x68	belong	2
9562>>>>>>>0x74	belong	0x2C
9563>>>>>>>>0xB4	belong	4		core file
9564>>>>>>>>>0x44	string	>\0		from '%s'
9565>>>>>>>>>0xC4	belong	3		- received SIGQUIT
9566>>>>>>>>>0xC4	belong	4		- received SIGILL
9567>>>>>>>>>0xC4	belong	5		- received SIGTRAP
9568>>>>>>>>>0xC4	belong	6		- received SIGABRT
9569>>>>>>>>>0xC4	belong	7		- received SIGEMT
9570>>>>>>>>>0xC4	belong	8		- received SIGFPE
9571>>>>>>>>>0xC4	belong	10		- received SIGBUS
9572>>>>>>>>>0xC4	belong	11		- received SIGSEGV
9573>>>>>>>>>0xC4	belong	12		- received SIGSYS
9574>>>>>>>>>0xC4	belong	33		- received SIGXCPU
9575>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
9576
9577
9578
9579#------------------------------------------------------------------------------
9580# $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $
9581# human68k:  file(1) magic for Human68k (X680x0 DOS) binary formats
9582# Magic too short!
9583#0		string	HU		Human68k
9584#>68		string	LZX		LZX compressed
9585#>>72		string	>\0		(version %s)
9586#>(8.L+74)	string	LZX		LZX compressed
9587#>>(8.L+78)	string	>\0		(version %s)
9588#>60		belong	>0		binded
9589#>(8.L+66)	string	#HUPAIR		hupair
9590#>0		string	HU		X executable
9591#>(8.L+74)	string	#LIBCV1		- linked PD LIBC ver 1
9592#>4		belong	>0		- base address 0x%x
9593#>28		belong	>0		not stripped
9594#>32		belong	>0		with debug information
9595#0		beshort	0x601a		Human68k Z executable
9596#0		beshort	0x6000		Human68k object file
9597#0		belong	0xd1000000	Human68k ar binary archive
9598#0		belong	0xd1010000	Human68k ar ascii archive
9599#0		beshort	0x0068		Human68k lib archive
9600#4		string	LZX		Human68k LZX compressed
9601#>8		string	>\0		(version %s)
9602#>4		string	LZX		R executable
9603#2		string	#HUPAIR		Human68k hupair R executable
9604
9605#------------------------------------------------------------------------------
9606# $File: ibm370,v 1.8 2009/09/19 16:28:09 christos Exp $
9607# ibm370:  file(1) magic for IBM 370 and compatibles.
9608#
9609# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
9610# What the heck *is* "USS/370"?
9611# AIX 4.1's "/etc/magic" has
9612#
9613#	0	short		0535		370 sysV executable
9614#	>12	long		>0		not stripped
9615#	>22	short		>0		- version %d
9616#	>30	long		>0		- 5.2 format
9617#	0	short		0530		370 sysV pure executable
9618#	>12	long		>0		not stripped
9619#	>22	short		>0		- version %d
9620#	>30	long		>0		- 5.2 format
9621#
9622# instead of the "USS/370" versions of the same magic numbers.
9623#
96240	beshort		0537		370 XA sysV executable
9625>12	belong		>0		not stripped
9626>22	beshort		>0		- version %d
9627>30	belong		>0		- 5.2 format
96280	beshort		0532		370 XA sysV pure executable
9629>12	belong		>0		not stripped
9630>22	beshort		>0		- version %d
9631>30	belong		>0		- 5.2 format
96320	beshort		054001		370 sysV pure executable
9633>12	belong		>0		not stripped
96340	beshort		055001		370 XA sysV pure executable
9635>12	belong		>0		not stripped
96360	beshort		056401		370 sysV executable
9637>12	belong		>0		not stripped
96380	beshort		057401		370 XA sysV executable
9639>12	belong		>0		not stripped
96400       beshort		0531		SVR2 executable (Amdahl-UTS)
9641>12	belong		>0		not stripped
9642>24     belong		>0		- version %ld
96430	beshort		0534		SVR2 pure executable (Amdahl-UTS)
9644>12	belong		>0		not stripped
9645>24	belong		>0		- version %ld
96460	beshort		0530		SVR2 pure executable (USS/370)
9647>12	belong		>0		not stripped
9648>24	belong		>0		- version %ld
96490	beshort		0535		SVR2 executable (USS/370)
9650>12	belong		>0		not stripped
9651>24	belong		>0		- version %ld
9652
9653#------------------------------------------------------------------------------
9654# $File: ibm6000,v 1.11 2013/01/08 20:13:01 christos Exp $
9655# ibm6000:  file(1) magic for RS/6000 and the RT PC.
9656#
96570	beshort		0x01df		executable (RISC System/6000 V3.1) or obj module
9658>12	belong		>0		not stripped
9659# Breaks sun4 statically linked execs.
9660#0      beshort		0x0103		executable (RT Version 2) or obj module
9661#>2	byte		0x50		pure
9662#>28	belong		>0		not stripped
9663#>6	beshort		>0		- version %ld
96640	beshort		0x0104		shared library
96650	beshort		0x0105		ctab data
96660	beshort		0xfe04		structured file
96670	string		0xabcdef	AIX message catalog
96680	belong		0x000001f9	AIX compiled message catalog
96690	string		\<aiaff>	archive
96700	string		\<bigaf>	archive (big format)
9671
96720	beshort		0x01f7		64-bit XCOFF executable or object module
9673>20	belong		0		not stripped
96744	belong		&0x0feeddb0	AIX core file
9675>1	byte		&0x01		fulldump
9676>7	byte		&0x01		32-bit
9677>>0x6e0 string		>\0		\b, %s
9678>7	byte		&0x02		64-bit
9679>>0x524 string		>\0		\b, %s
9680
9681#------------------------------------------------------------------------------
9682# $File: icc,v 1.1 2013/01/08 01:43:18 christos Exp $
9683# icc:  file(1) magic for International Color Consortium file formats
9684
9685#
9686# Color profiles as per the ICC's "Image technology colour management -
9687# Architecture, profile format, and data structure" specification.
9688# See
9689#
9690#	http://www.color.org/specification/ICC1v43_2010-12.pdf
9691#
9692# for Specification ICC.1:2010 (Profile version 4.3.0.0).
9693#
9694# Bytes 36 to 39 contain a generic profile file signature of "acsp";
9695# bytes 40 to 43 "may be used to identify the primary platform/operating
9696# system framework for which the profile was created".
9697#
9698# There are other fields that might be worth dumping as well.
9699#
9700
9701# This appears to be what's used for Apple ColorSync profiles.
9702# Instead of adding that, Apple just changed the generic "acsp" entry
9703# to be for "ColorSync ICC Color Profile" rather than "Kodak Color
9704# Management System, ICC Profile".
9705# Yes, it's "APPL", not "AAPL"; see the spec.
970636	string		acspAPPL	ColorSync ICC Profile
9707!:mime	application/vnd.iccprofile
9708
9709# Microsoft ICM color profile
971036	string		acspMSFT	Microsoft ICM Color Profile
9711!:mime	application/vnd.iccprofile
9712
9713# Yes, that's a blank after "SGI".
971436	string		acspSGI\ 	SGI ICC Profile
9715!:mime	application/vnd.iccprofile
9716
9717# XXX - is this what's used for the Sun KCMS or not?  The standard file
9718# uses just "acsp" for that, but Apple's file uses it for "ColorSync",
9719# and there *is* an identified "primary platform" value of SUNW.
972036	string		acspSUNW	Sun KCMS ICC Profile
9721!:mime	application/vnd.iccprofile
9722
9723# Any other profile.
9724# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles,
9725# and use "acsp" for everything else and dump the "primary platform"
9726# string in those cases?
972736	string		acsp		ICC Profile
9728!:mime	application/vnd.iccprofile
9729
9730
9731
9732#------------------------------------------------------------------------------
9733# $File: iff,v 1.13 2011/09/06 11:00:06 christos Exp $
9734# iff:	file(1) magic for Interchange File Format (see also "audio" & "images")
9735#
9736# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
9737# Arts for file interchange.  It has also been used by Apple, SGI, and
9738# especially Commodore-Amiga.
9739#
9740# IFF files begin with an 8 byte FORM header, followed by a 4 character
9741# FORM type, which is followed by the first chunk in the FORM.
9742
97430	string		FORM		IFF data
9744#>4	belong		x		\b, FORM is %d bytes long
9745# audio formats
9746>8	string		AIFF		\b, AIFF audio
9747!:mime	audio/x-aiff
9748>8	string		AIFC		\b, AIFF-C compressed audio
9749!:mime	audio/x-aiff
9750>8	string		8SVX		\b, 8SVX 8-bit sampled sound voice
9751!:mime	audio/x-aiff
9752>8	string		16SV		\b, 16SV 16-bit sampled sound voice
9753>8	string		SAMP		\b, SAMP sampled audio
9754>8	string		MAUD		\b, MAUD MacroSystem audio
9755>8	string		SMUS		\b, SMUS simple music
9756>8	string		CMUS		\b, CMUS complex music
9757# image formats
9758>8	string		ILBMBMHD	\b, ILBM interleaved image
9759>>20	beshort		x		\b, %d x
9760>>22	beshort		x		%d
9761>8	string		RGBN		\b, RGBN 12-bit RGB image
9762>8	string		RGB8		\b, RGB8 24-bit RGB image
9763>8	string		DEEP		\b, DEEP TVPaint/XiPaint image
9764>8	string		DR2D		\b, DR2D 2-D object
9765>8	string		TDDD		\b, TDDD 3-D rendering
9766>8	string		LWOB		\b, LWOB 3-D object
9767>8	string		LWO2		\b, LWO2 3-D object, v2
9768>8	string		LWLO		\b, LWLO 3-D layered object
9769>8	string		REAL		\b, REAL Real3D rendering
9770>8	string		MC4D		\b, MC4D MaxonCinema4D rendering
9771>8	string		ANIM		\b, ANIM animation
9772>8	string		YAFA		\b, YAFA animation
9773>8	string		SSA\ 		\b, SSA super smooth animation
9774>8	string		ACBM		\b, ACBM continuous image
9775>8	string		FAXX		\b, FAXX fax image
9776# other formats
9777>8	string		FTXT		\b, FTXT formatted text
9778>8	string		CTLG		\b, CTLG message catalog
9779>8	string		PREF		\b, PREF preferences
9780>8	string		DTYP		\b, DTYP datatype description
9781>8	string		PTCH		\b, PTCH binary patch
9782>8	string		AMFF		\b, AMFF AmigaMetaFile format
9783>8	string		WZRD		\b, WZRD StormWIZARD resource
9784>8	string		DOC\ 		\b, DOC desktop publishing document
9785>8	string		WVQA 		\b, Westwood Studios VQA Multimedia,
9786>>24	leshort		x		%d video frames,
9787>>26	leshort		x		%d x
9788>>28	leshort		x		%d
9789>8	string		MOVE		\b, Wing Commander III Video
9790>>12	string		_PC_		\b, PC version
9791>>12	string		3DO_		\b, 3DO version
9792
9793# These go at the end of the iff rules
9794#
9795# I don't see why these might collide with anything else.
9796#
9797# Interactive Fiction related formats
9798#
9799>8	string		IFRS		\b, Blorb Interactive Fiction
9800>>24	string		Exec		with executable chunk
9801>8	string          IFZS		\b, Z-machine or Glulx saved game file (Quetzal)
9802
9803#------------------------------------------------------------------------------
9804# $File: images,v 1.81 2013/03/09 22:36:00 christos Exp $
9805# images:  file(1) magic for image formats (see also "iff", and "c-lang" for
9806# XPM bitmaps)
9807#
9808# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
9809# additions by janl@ifi.uio.no as well as others. Jan also suggested
9810# merging several one- and two-line files into here.
9811#
9812# little magic: PCX (first byte is 0x0a)
9813
9814# Targa - matches `povray', `ppmtotga' and `xv' outputs
9815# by Philippe De Muyter <phdm@macqel.be>
9816# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
9817# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
9818# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs
9819# `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
9820# `tgatoppm' recognizes a superset (Index may be anything)
98211	belong&0xfff7ffff	0x01010000	Targa image data - Map
9822>2	byte&8			8		- RLE
9823>12	leshort			>0		%hd x
9824>14	leshort			>0		%hd
98251	belong&0xfff7ffff	0x00020000	Targa image data - RGB
9826>2	byte&8			8		- RLE
9827>12	leshort			>0		%hd x
9828>14	leshort			>0		%hd
98291	belong&0xfff7ffff	0x00030000	Targa image data - Mono
9830>2	byte&8			8		- RLE
9831>12	leshort			>0		%hd x
9832>14	leshort			>0		%hd
9833
9834# PBMPLUS images
9835# The next byte following the magic is always whitespace.
9836# strength is changed to try these patterns before "x86 boot sector"
98370	search/1	P1
9838>3	regex		=[0-9]*\ [0-9]*		Netpbm PBM image text
9839>3	regex		=[0-9]+\ 		\b, size = %sx
9840>>3	regex		=\ [0-9]+	\b%s
9841!:strength + 45
9842!:mime	image/x-portable-bitmap
98430	search/1	P2
9844>3	regex		=[0-9]*\ [0-9]*		Netpbm PGM image text
9845>3	regex		=[0-9]+\ 		\b, size = %sx
9846>>3	regex		=\ [0-9]+	\b%s
9847!:strength + 45
9848!:mime	image/x-portable-greymap
98490	search/1	P3		Netpbm PPM image text
9850>3	regex		=[0-9]*\ [0-9]*		Netpbm PPM image text
9851>3	regex		=[0-9]+\ 		\b, size = %sx
9852>>3	regex		=\ [0-9]+	\b%s
9853!:strength + 45
9854!:mime	image/x-portable-pixmap
98550	string		P4
9856>3	regex		=[0-9]*\ [0-9]*		Netpbm PBM "rawbits" image data
9857>3	regex		=[0-9]+\ 		\b, size = %sx
9858>>3	regex		=\ [0-9]+	\b%s
9859!:strength + 45
9860!:mime	image/x-portable-bitmap
98610	string		P5
9862>3	regex		=[0-9]*\ [0-9]*		Netpbm PGM "rawbits" image data
9863>3	regex		=[0-9]+\ 		\b, size = %sx
9864>>3	regex		=\ [0-9]+	\b%s
9865!:strength + 45
9866!:mime	image/x-portable-greymap
98670	string		P6
9868>3	regex		=[0-9]*\ [0-9]*		Netpbm PPM "rawbits" image data
9869>3	regex		=[0-9]+\ 		\b, size = %sx
9870>>3	regex		=\ [0-9]+	\b%s
9871!:strength + 45
9872!:mime	image/x-portable-pixmap
98730	string		P7		Netpbm PAM image file
9874!:mime	image/x-portable-pixmap
9875
9876# From: bryanh@giraffe-data.com (Bryan Henderson)
98770	string		\117\072	Solitaire Image Recorder format
9878>4	string		\013		MGI Type 11
9879>4	string		\021		MGI Type 17
98800	string		.MDA		MicroDesign data
9881>21	byte		48		version 2
9882>21	byte		51		version 3
98830	string		.MDP		MicroDesign page data
9884>21	byte		48		version 2
9885>21	byte		51		version 3
9886
9887# NIFF (Navy Interchange File Format, a modification of TIFF) images
9888# [GRR:  this *must* go before TIFF]
98890	string		IIN1		NIFF image data
9890!:mime	image/x-niff
9891
9892# Canon RAW version 1 (CRW) files are a type of Canon Image File Format
9893# (CIFF) file. These are apparently all little-endian.
9894# From: Adam Buchbinder <adam.buchbinder@gmail.com>
9895# URL: http://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html
98960	string		II\x1a\0\0\0HEAPCCDR	Canon CIFF raw image data
9897!:mime	image/x-canon-crw
9898>16	leshort		x	\b, version %d.
9899>14	leshort		x	\b%d
9900
9901# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic
9902# number. Put this above the TIFF test to make sure we detect them.
9903# These are apparently all little-endian.
9904# From: Adam Buchbinder <adam.buchbinder@gmail.com>
9905# URL: http://libopenraw.freedesktop.org/wiki/Canon_CR2
99060	string		II\x2a\0\x10\0\0\0CR	Canon CR2 raw image data
9907!:mime	image/x-canon-cr2
9908>10	byte		x	\b, version %d.
9909>11	byte		x	\b%d
9910
9911# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
9912# The second word of TIFF files is the TIFF version number, 42, which has
9913# never changed.  The TIFF specification recommends testing for it.
99140	string		MM\x00\x2a	TIFF image data, big-endian
9915!:mime	image/tiff
99160	string		II\x2a\x00	TIFF image data, little-endian
9917!:mime	image/tiff
9918
99190	string		MM\x00\x2b	Big TIFF image data, big-endian
9920!:mime	image/tiff
99210	string		II\x2b\x00	Big TIFF image data, little-endian
9922!:mime	image/tiff
9923
9924# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
9925# (Greg Roelofs, newt@uchicago.edu)
9926# (Albert Cahalan, acahalan@cs.uml.edu)
9927#
9928# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
9929#
99300	string		\x89PNG\x0d\x0a\x1a\x0a		PNG image data
9931!:mime	image/png
9932>16	belong		x		\b, %ld x
9933>20	belong		x		%ld,
9934>24	byte		x		%d-bit
9935>25	byte		0		grayscale,
9936>25	byte		2		\b/color RGB,
9937>25	byte		3		colormap,
9938>25	byte		4		gray+alpha,
9939>25	byte		6		\b/color RGBA,
9940#>26	byte		0		deflate/32K,
9941>28	byte		0		non-interlaced
9942>28	byte		1		interlaced
9943
9944# possible GIF replacements; none yet released!
9945# (Greg Roelofs, newt@uchicago.edu)
9946#
9947# GRR 950115:  this was mine ("Zip GIF"):
99480	string		GIF94z		ZIF image (GIF+deflate alpha)
9949!:mime	image/x-unknown
9950#
9951# GRR 950115:  this is Jeremy Wohl's Free Graphics Format (better):
9952#
99530	string		FGF95a		FGF image (GIF+deflate beta)
9954!:mime	image/x-unknown
9955#
9956# GRR 950115:  this is Thomas Boutell's Portable Bitmap Format proposal
9957# (best; not yet implemented):
9958#
99590	string		PBF		PBF image (deflate compression)
9960!:mime	image/x-unknown
9961
9962# GIF
99630	string		GIF8		GIF image data
9964!:mime	image/gif
9965!:apple	8BIMGIFf
9966>4	string		7a		\b, version 8%s,
9967>4	string		9a		\b, version 8%s,
9968>6	leshort		>0		%hd x
9969>8	leshort		>0		%hd
9970#>10	byte		&0x80		color mapped,
9971#>10	byte&0x07	=0x00		2 colors
9972#>10	byte&0x07	=0x01		4 colors
9973#>10	byte&0x07	=0x02		8 colors
9974#>10	byte&0x07	=0x03		16 colors
9975#>10	byte&0x07	=0x04		32 colors
9976#>10	byte&0x07	=0x05		64 colors
9977#>10	byte&0x07	=0x06		128 colors
9978#>10	byte&0x07	=0x07		256 colors
9979
9980# ITC (CMU WM) raster files.  It is essentially a byte-reversed Sun raster,
9981# 1 plane, no encoding.
99820	string		\361\0\100\273	CMU window manager raster image data
9983>4	lelong		>0		%d x
9984>8	lelong		>0		%d,
9985>12	lelong		>0		%d-bit
9986
9987# Magick Image File Format
99880	string		id=ImageMagick	MIFF image data
9989
9990# Artisan
99910	long		1123028772	Artisan image data
9992>4	long		1		\b, rectangular 24-bit
9993>4	long		2		\b, rectangular 8-bit with colormap
9994>4	long		3		\b, rectangular 32-bit (24-bit with matte)
9995
9996# FIG (Facility for Interactive Generation of figures), an object-based format
99970	search/1	#FIG		FIG image text
9998>5	string		x		\b, version %.3s
9999
10000# PHIGS
100010	string		ARF_BEGARF		PHIGS clear text archive
100020	string		@(#)SunPHIGS		SunPHIGS
10003# version number follows, in the form m.n
10004>40	string		SunBin			binary
10005>32	string		archive			archive
10006
10007# GKS (Graphics Kernel System)
100080	string		GKSM		GKS Metafile
10009>24	string		SunGKS		\b, SunGKS
10010
10011# CGM image files
100120	string		BEGMF		clear text Computer Graphics Metafile
10013
10014# MGR bitmaps  (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
100150	string	yz	MGR bitmap, modern format, 8-bit aligned
100160	string	zz	MGR bitmap, old format, 1-bit deep, 16-bit aligned
100170	string	xz	MGR bitmap, old format, 1-bit deep, 32-bit aligned
100180	string	yx	MGR bitmap, modern format, squeezed
10019
10020# Fuzzy Bitmap (FBM) images
100210	string		%bitmap\0	FBM image data
10022>30	long		0x31		\b, mono
10023>30	long		0x33		\b, color
10024
10025# facsimile data
100261	string		PC\ Research,\ Inc	group 3 fax data
10027>29	byte		0		\b, normal resolution (204x98 DPI)
10028>29	byte		1		\b, fine resolution (204x196 DPI)
10029# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at>
100300	string		Sfff		structured fax file
10031
10032# From: Joerg Jenderek <joerg.jen.der.ek@gmx.net>
10033# most files with the extension .EPA and some with .BMP
100340	string		\x11\x06	Award BIOS Logo, 136 x 84
10035!:mime	image/x-award-bioslogo
100360	string		\x11\x09	Award BIOS Logo, 136 x 126
10037!:mime	image/x-award-bioslogo
10038#0	string		\x07\x1f	BIOS Logo corrupted?
10039# http://www.blackfiveservices.co.uk/awbmtools.shtml
10040# http://biosgfx.narod.ru/v3/
10041# http://biosgfx.narod.ru/abr-2/
100420	string		AWBM
10043>4	leshort		<1981		Award BIOS bitmap
10044!:mime	image/x-award-bmp
10045# image width is a multiple of 4
10046>>4	leshort&0x0003	0
10047>>>4		leshort	x		\b, %d
10048>>>6		leshort	x		x %d
10049>>4	leshort&0x0003	>0		\b,
10050>>>4	leshort&0x0003	=1
10051>>>>4		leshort	x		%d+3
10052>>>4	leshort&0x0003	=2
10053>>>>4		leshort	x		%d+2
10054>>>4	leshort&0x0003	=3
10055>>>>4		leshort	x		%d+1
10056>>>6		leshort	x		x %d
10057# at offset 8 starts imagedata followed by "RGB " marker
10058
10059# PC bitmaps (OS/2, Windows BMP files)  (Greg Roelofs, newt@uchicago.edu)
100600	string		BM
10061>14	leshort		12		PC bitmap, OS/2 1.x format
10062!:mime	image/x-ms-bmp
10063>>18	leshort		x		\b, %d x
10064>>20	leshort		x		%d
10065>14	leshort		64		PC bitmap, OS/2 2.x format
10066!:mime	image/x-ms-bmp
10067>>18	leshort		x		\b, %d x
10068>>20	leshort		x		%d
10069>14	leshort		40		PC bitmap, Windows 3.x format
10070!:mime	image/x-ms-bmp
10071>>18	lelong		x		\b, %d x
10072>>22	lelong		x		%d x
10073>>28	leshort		x		%d
10074>14	leshort		128		PC bitmap, Windows NT/2000 format
10075!:mime	image/x-ms-bmp
10076>>18	lelong		x		\b, %d x
10077>>22	lelong		x		%d x
10078>>28	leshort		x		%d
10079# Too simple - MPi
10080#0	string		IC		PC icon data
10081#0	string		PI		PC pointer image data
10082#0	string		CI		PC color icon data
10083#0	string		CP		PC color pointer image data
10084# Conflicts with other entries [BABYL]
10085#0	string		BA		PC bitmap array data
10086
10087# XPM icons (Greg Roelofs, newt@uchicago.edu)
100880	search/1	/*\ XPM\ */	X pixmap image text
10089!:mime	image/x-xpmi
10090
10091# Utah Raster Toolkit RLE images (janl@ifi.uio.no)
100920	leshort		0xcc52		RLE image data,
10093>6	leshort		x		%d x
10094>8	leshort		x		%d
10095>2	leshort		>0		\b, lower left corner: %d
10096>4	leshort		>0		\b, lower right corner: %d
10097>10	byte&0x1	=0x1		\b, clear first
10098>10	byte&0x2	=0x2		\b, no background
10099>10	byte&0x4	=0x4		\b, alpha channel
10100>10	byte&0x8	=0x8		\b, comment
10101>11	byte		>0		\b, %d color channels
10102>12	byte		>0		\b, %d bits per pixel
10103>13	byte		>0		\b, %d color map channels
10104
10105# image file format (Robert Potter, potter@cs.rochester.edu)
101060	string		Imagefile\ version-	iff image data
10107# this adds the whole header (inc. version number), informative but longish
10108>10	string		>\0		%s
10109
10110# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
101110	belong		0x59a66a95	Sun raster image data
10112>4	belong		>0		\b, %d x
10113>8	belong		>0		%d,
10114>12	belong		>0		%d-bit,
10115#>16	belong		>0		%d bytes long,
10116>20	belong		0		old format,
10117#>20	belong		1		standard,
10118>20	belong		2		compressed,
10119>20	belong		3		RGB,
10120>20	belong		4		TIFF,
10121>20	belong		5		IFF,
10122>20	belong		0xffff		reserved for testing,
10123>24	belong		0		no colormap
10124>24	belong		1		RGB colormap
10125>24	belong		2		raw colormap
10126#>28	belong		>0		colormap is %d bytes long
10127
10128# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
10129#
10130# See
10131#	http://reality.sgi.com/grafica/sgiimage.html
10132#
101330	beshort		474		SGI image data
10134#>2	byte		0		\b, verbatim
10135>2	byte		1		\b, RLE
10136#>3	byte		1		\b, normal precision
10137>3	byte		2		\b, high precision
10138>4	beshort		x		\b, %d-D
10139>6	beshort		x		\b, %d x
10140>8	beshort		x		%d
10141>10	beshort		x		\b, %d channel
10142>10	beshort		!1		\bs
10143>80	string		>0		\b, "%s"
10144
101450	string		IT01		FIT image data
10146>4	belong		x		\b, %d x
10147>8	belong		x		%d x
10148>12	belong		x		%d
10149#
101500	string		IT02		FIT image data
10151>4	belong		x		\b, %d x
10152>8	belong		x		%d x
10153>12	belong		x		%d
10154#
101552048	string		PCD_IPI		Kodak Photo CD image pack file
10156>0xe02	byte&0x03	0x00		, landscape mode
10157>0xe02	byte&0x03	0x01		, portrait mode
10158>0xe02	byte&0x03	0x02		, landscape mode
10159>0xe02	byte&0x03	0x03		, portrait mode
101600	string		PCD_OPA		Kodak Photo CD overview pack file
10161
10162# FITS format.  Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
10163# FITS is the Flexible Image Transport System, the de facto standard for
10164# data and image transfer, storage, etc., for the astronomical community.
10165# (FITS floating point formats are big-endian.)
101660	string	SIMPLE\ \ =	FITS image data
10167>109	string	8		\b, 8-bit, character or unsigned binary integer
10168>108	string	16		\b, 16-bit, two's complement binary integer
10169>107	string	\ 32		\b, 32-bit, two's complement binary integer
10170>107	string	-32		\b, 32-bit, floating point, single precision
10171>107	string	-64		\b, 64-bit, floating point, double precision
10172
10173# other images
101740	string	This\ is\ a\ BitMap\ file	Lisp Machine bit-array-file
10175
10176# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
10177# stuff.
10178#
101790	beshort		0x1010		PEX Binary Archive
10180
10181# DICOM medical imaging data
10182128	string	DICM			DICOM medical imaging data
10183!:mime	application/dicom
10184
10185# XWD - X Window Dump file.
10186#   As described in /usr/X11R6/include/X11/XWDFile.h
10187#   used by the xwd program.
10188#   Bradford Castalia, idaeim, 1/01
10189#   updated by Adam Buchbinder, 2/09
10190# The following assumes version 7 of the format; the first long is the length
10191# of the header, which is at least 25 4-byte longs, and the one at offset 8
10192# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth,
10193# which is a maximum of 32.
101940	belong	>100
10195>8	belong	<3
10196>>12	belong	<33
10197>>>4	belong	7			XWD X Window Dump image data
10198!:mime	image/x-xwindowdump
10199>>>>100	string	>\0			\b, "%s"
10200>>>>16	belong	x			\b, %dx
10201>>>>20	belong	x			\b%dx
10202>>>>12	belong	x			\b%d
10203
10204# PDS - Planetary Data System
10205#   These files use Parameter Value Language in the header section.
10206#   Unfortunately, there is no certain magic, but the following
10207#   strings have been found to be most likely.
102080	string	NJPL1I00		PDS (JPL) image data
102092	string	NJPL1I			PDS (JPL) image data
102100	string	CCSD3ZF			PDS (CCSD) image data
102112	string	CCSD3Z			PDS (CCSD) image data
102120	string	PDS_			PDS image data
102130	string	LBLSIZE=		PDS (VICAR) image data
10214
10215# pM8x: ATARI STAD compressed bitmap format
10216#
10217# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001
10218# p M 8 5/6 xx yy zz data...
10219# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed.
10220# bytes either run horizontally (pM85) or vertically (pM86). yy is the
10221# most frequent byte, xx and zz are runlength escape codes, where xx is
10222# used for runs of yy.
10223#
102240	string	pM85		Atari ST STAD bitmap image data (hor)
10225>5	byte	0x00		(white background)
10226>5	byte	0xFF		(black background)
102270	string	pM86		Atari ST STAD bitmap image data (vert)
10228>5	byte	0x00		(white background)
10229>5	byte	0xFF		(black background)
10230
10231# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
10232# http://www.atarimax.com/jindroush.atari.org/afmtatr.html
102330	leshort	0x0296		Atari ATR image
10234
10235# XXX:
10236# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other
10237# magic.
10238# SGI RICE image file <mpruett@sgi.com>
10239#0	beshort	0x5249		RICE image
10240#>2	beshort	x		v%d
10241#>4	beshort	x		(%d x
10242#>6	beshort	x		%d)
10243#>8	beshort	0		8 bit
10244#>8	beshort	1		10 bit
10245#>8	beshort	2		12 bit
10246#>8	beshort	3		13 bit
10247#>10	beshort	0		4:2:2
10248#>10	beshort	1		4:2:2:4
10249#>10	beshort	2		4:4:4
10250#>10	beshort	3		4:4:4:4
10251#>12	beshort	1		RGB
10252#>12	beshort	2		CCIR601
10253#>12	beshort	3		RP175
10254#>12	beshort	4		YUV
10255
10256# PCX image files
10257# From: Dan Fandrich <dan@coneharvesters.com>
10258# updated by Joerg Jenderek at Feb 2013 by http://de.wikipedia.org/wiki/PCX
10259# http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
10260# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000
10261# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT
102620	ubelong&0xffF8fe00	0x0a000000
10263# for PCX bit depth > 0
10264>3	ubyte		>0
10265# test for valid versions
10266>>1	ubyte		<6
10267>>>1	ubyte		!1	PCX
10268!:mime	image/x-pcx
10269#!:mime	image/pcx
10270>>>>1	ubyte		0	ver. 2.5 image data
10271>>>>1	ubyte		2	ver. 2.8 image data, with palette
10272>>>>1	ubyte		3	ver. 2.8 image data, without palette
10273>>>>1	ubyte		4	for Windows image data
10274>>>>1	ubyte		5	ver. 3.0 image data
10275>>>>4	uleshort	x	bounding box [%hd,
10276>>>>6	uleshort	x	%d] -
10277>>>>8	uleshort	x	[%d,
10278>>>>10	uleshort	x	%d],
10279>>>>65	ubyte		>1	%d planes each of
10280>>>>3	ubyte		x	%d-bit
10281>>>>68	byte		1	colour,
10282>>>>68	byte		2	grayscale,
10283# this should not happen
10284>>>>68	default		x	image,
10285>>>>12	leshort		>0	%d x
10286>>>>>14	uleshort	x	%d dpi,
10287>>>>2	byte		0	uncompressed
10288>>>>2	byte		1	RLE compressed
10289
10290# Adobe Photoshop
10291# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
102920	string		8BPS Adobe Photoshop Image
10293!:mime	image/vnd.adobe.photoshop
10294>4   beshort 2 (PSB)
10295>18  belong  x \b, %d x
10296>14  belong  x %d,
10297>24  beshort 0 bitmap
10298>24  beshort 1 grayscale
10299>>12 beshort 2 with alpha
10300>24  beshort 2 indexed
10301>24  beshort 3 RGB
10302>>12 beshort 4 \bA
10303>24  beshort 4 CMYK
10304>>12 beshort 5 \bA
10305>24  beshort 7 multichannel
10306>24  beshort 8 duotone
10307>24  beshort 9 lab
10308>12  beshort > 1
10309>>12  beshort x \b, %dx
10310>12  beshort 1 \b,
10311>22  beshort x %d-bit channel
10312>12  beshort > 1 \bs
10313
10314# XV thumbnail indicator (ThMO)
103150	string		P7\ 332		XV thumbnail image data
10316
10317# NITF is defined by United States MIL-STD-2500A
103180	string	NITF	National Imagery Transmission Format
10319>25	string	>\0	dated %.14s
10320
10321# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
103220	belong		0x00010008	GEM Image data
10323>12	beshort		x		%d x
10324>14	beshort		x		%d,
10325>4	beshort		x		%d planes,
10326>8	beshort		x		%d x
10327>10	beshort		x		%d pixelsize
10328
10329# GEM Metafile (Wolfram Kleff)
103300	lelong		0x0018FFFF	GEM Metafile data
10331>4	leshort		x		version %d
10332
10333#
10334# SMJPEG. A custom Motion JPEG format used by Loki Entertainment
10335# Software Torbjorn Andersson <d91tan@Update.UU.SE>.
10336#
103370	string	\0\nSMJPEG	SMJPEG
10338>8	belong	x		%d.x data
10339# According to the specification you could find any number of _TXT
10340# headers here, but I can't think of any way of handling that. None of
10341# the SMJPEG files I tried it on used this feature. Even if such a
10342# file is encountered the output should still be reasonable.
10343>16	string	_SND		\b,
10344>>24	beshort	>0		%d Hz
10345>>26	byte	8		8-bit
10346>>26	byte	16		16-bit
10347>>28	string	NONE		uncompressed
10348# >>28	string	APCM		ADPCM compressed
10349>>27	byte	1		mono
10350>>28	byte	2		stereo
10351# Help! Isn't there any way to avoid writing this part twice?
10352>>32	string	_VID		\b,
10353# >>>48	string	JFIF		JPEG
10354>>>40	belong	>0		%d frames
10355>>>44	beshort	>0		(%d x
10356>>>46	beshort	>0		%d)
10357>16	string	_VID		\b,
10358# >>32	string	JFIF		JPEG
10359>>24	belong	>0		%d frames
10360>>28	beshort	>0		(%d x
10361>>30	beshort	>0		%d)
10362
103630	string	Paint\ Shop\ Pro\ Image\ File	Paint Shop Pro Image File
10364
10365# "thumbnail file" (icon)
10366# descended from "xv", but in use by other applications as well (Wolfram Kleff)
103670       string          P7\ 332         XV "thumbnail file" (icon) data
10368
10369# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?)
103700       string          KiSS            KISS/GS
10371>4      byte            16              color
10372>>5     byte            x               %d bit
10373>>8     leshort         x               %d colors
10374>>10    leshort         x               %d groups
10375>4      byte            32              cell
10376>>5     byte            x               %d bit
10377>>8     leshort         x               %d x
10378>>10    leshort         x               %d
10379>>12    leshort         x               +%d
10380>>14    leshort         x               +%d
10381
10382# Webshots (www.webshots.com), by John Harrison
103830       string          C\253\221g\230\0\0\0 Webshots Desktop .wbz file
10384
10385# Hercules DASD image files
10386# From Jan Jaeger <jj@septa.nl>
103870       string  CKD_P370        Hercules CKD DASD image file
10388>8      long    x               \b, %d heads per cylinder
10389>12     long    x               \b, track size %d bytes
10390>16     byte    x               \b, device type 33%2.2X
10391
103920       string  CKD_C370        Hercules compressed CKD DASD image file
10393>8      long    x               \b, %d heads per cylinder
10394>12     long    x               \b, track size %d bytes
10395>16     byte    x               \b, device type 33%2.2X
10396
103970       string  CKD_S370        Hercules CKD DASD shadow file
10398>8      long    x               \b, %d heads per cylinder
10399>12     long    x               \b, track size %d bytes
10400>16     byte    x               \b, device type 33%2.2X
10401
10402# Squeak images and programs - etoffi@softhome.net
104030	string		\146\031\0\0	Squeak image data
104040	search/1	'From\040Squeak	Squeak program text
10405
10406# partimage: file(1) magic for PartImage files (experimental, incomplete)
10407# Author: Hans-Joachim Baader <hjb@pro-linux.de>
104080		string	PaRtImAgE-VoLuMe	PartImage
10409>0x0020		string	0.6.1		file version %s
10410>>0x0060	lelong	>-1		volume %ld
10411#>>0x0064 8 byte identifier
10412#>>0x007c reserved
10413>>0x0200	string	>\0		type %s
10414>>0x1400	string	>\0		device %s,
10415>>0x1600	string	>\0		original filename %s,
10416# Some fields omitted
10417>>0x2744	lelong	0		not compressed
10418>>0x2744	lelong	1		gzip compressed
10419>>0x2744	lelong	2		bzip2 compressed
10420>>0x2744	lelong	>2		compressed with unknown algorithm
10421>0x0020		string	>0.6.1		file version %s
10422>0x0020		string	<0.6.1		file version %s
10423
10424# DCX is multi-page PCX, using a simple header of up to 1024
10425# offsets for the respective PCX components.
10426# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de>
104270	lelong	987654321	DCX multi-page PCX image data
10428
10429# Simon Walton <simonw@matteworld.com>
10430# Kodak Cineon format for scanned negatives
10431# http://www.kodak.com/US/en/motion/support/dlad/
104320	lelong  0xd75f2a80	Cineon image data
10433>200	belong  >0		\b, %ld x
10434>204	belong  >0		%ld
10435
10436
10437# Bio-Rad .PIC is an image format used by microscope control systems
10438# and related image processing software used by biologists.
10439# From: Vebjorn Ljosa <vebjorn@ljosa.com>
10440# BOOL values are two-byte integers; use them to rule out false positives.
10441# http://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt
10442# Samples: http://www.loci.wisc.edu/software/sample-data
1044314	leshort <2
10444>62	leshort <2
10445>>54	leshort 12345		Bio-Rad .PIC Image File
10446>>>0	leshort >0		%hd x
10447>>>2	leshort >0		%hd,
10448>>>4	leshort =1		1 image in file
10449>>>4	leshort >1		%hd images in file
10450
10451# From Jan "Yenya" Kasprzak <kas@fi.muni.cz>
10452# The description of *.mrw format can be found at
10453# http://www.dalibor.cz/minolta/raw_file_format.htm
104540	string	\000MRM			Minolta Dimage camera raw image data
10455
10456# Summary: DjVu image / document
10457# Extension: .djvu
10458# Reference: http://djvu.org/docs/DjVu3Spec.djvu
10459# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr>
10460# Modified by (1): Abel Cheung <abelcheung@gmail.com>
104610	string	AT&TFORM
10462>12	string	DJVM		DjVu multiple page document
10463!:mime	image/vnd.djvu
10464>12	string	DJVU		DjVu image or single page document
10465!:mime	image/vnd.djvu
10466>12	string	DJVI		DjVu shared document
10467!:mime	image/vnd.djvu
10468>12	string	THUM		DjVu page thumbnails
10469!:mime	image/vnd.djvu
10470
10471# Originally by Marc Espie
10472# Modified by Robert Minsk <robertminsk at yahoo.com>
10473# http://www.openexr.com/openexrfilelayout.pdf
104740	lelong		20000630	OpenEXR image data,
10475!:mime image/x-exr
10476>4	lelong&0x000000ff x		version %d,
10477>4	lelong		^0x00000200	storage: scanline
10478>4	lelong		&0x00000200	storage: tiled
10479>8	search/0x1000	compression\0	\b, compression:
10480>>&16	byte		0		none
10481>>&16	byte		1		rle
10482>>&16	byte		2		zips
10483>>&16	byte		3		zip
10484>>&16	byte		4		piz
10485>>&16	byte		5		pxr24
10486>>&16	byte		6		b44
10487>>&16	byte		7		b44a
10488>>&16	byte		>7		unknown
10489>8	 search/0x1000	dataWindow\0	\b, dataWindow:
10490>>&10	lelong		x		(%d
10491>>&14	lelong		x		%d)-
10492>>&18	lelong		x		\b(%d
10493>>&22	lelong		x		%d)
10494>8	search/0x1000	displayWindow\0	\b, displayWindow:
10495>>&10	lelong		x		(%d
10496>>&14	lelong		x		%d)-
10497>>&18	lelong		x		\b(%d
10498>>&22	lelong		x		%d)
10499>8	search/0x1000	lineOrder\0	 \b, lineOrder:
10500>>&14	byte		0		increasing y
10501>>&14	byte		1		decreasing y
10502>>&14	byte		2		random y
10503>>&14	byte		>2		unknown
10504
10505# SMPTE Digital Picture Exchange Format, SMPTE DPX
10506#
10507# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital
10508# Moving-Picture Exchange (DPX), v1.0, 18 February 1994
10509# Robert Minsk <robertminsk at yahoo.com>
105100	string		SDPX	DPX image data, big-endian,
10511!:mime image/x-dpx
10512>768	beshort		<4
10513>>772	belong		x	%dx
10514>>776	belong		x	\b%d,
10515>768	beshort		>3
10516>>776	belong		x	%dx
10517>>772	belong		x	\b%d,
10518>768	beshort		0	left to right/top to bottom
10519>768	beshort		1	right to left/top to bottom
10520>768	beshort		2	left to right/bottom to top
10521>768	beshort		3	right to left/bottom to top
10522>768	beshort		4	top to bottom/left to right
10523>768	beshort		5	top to bottom/right to left
10524>768	leshort		6	bottom to top/left to right
10525>768	leshort		7	bottom to top/right to left
10526
10527# From: Tom Hilinski <tom.hilinski@comcast.net>
10528# http://www.unidata.ucar.edu/packages/netcdf/
105290	string	CDF\001			NetCDF Data Format data
10530
10531#-----------------------------------------------------------------------
10532# Hierarchical Data Format, used to facilitate scientific data exchange
10533# specifications at http://hdf.ncsa.uiuc.edu/
105340	belong	0x0e031301	Hierarchical Data Format (version 4) data
10535!:mime	application/x-hdf
105360	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) data
10537!:mime	application/x-hdf
10538
10539# From: Tobias Burnus <burnus@net-b.de>
10540# Xara (for a while: Corel Xara) is a graphic package, see
10541# http://www.xara.com/ for Windows and as GPL application for Linux
105420	string	XARA\243\243	Xara graphics file
10543
10544# http://www.cartesianinc.com/Tech/
105450	string	CPC\262		Cartesian Perceptual Compression image
10546!:mime	image/x-cpi
10547
10548# From Albert Cahalan <acahalan@gmail.com>
10549# puredigital used it for the CVS disposable camcorder
10550#8       lelong  4       ZBM bitmap image data
10551#>4      leshort x       %u x
10552#>6      leshort x       %u
10553
10554# From Albert Cahalan <acahalan@gmail.com>
10555# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons
105560       string C565     OLPC firmware icon image data
10557>4      leshort x       %u x
10558>6      leshort x       %u
10559
10560# Applied Images - Image files from Cytovision
10561# Gustavo Junior Alves <gjalves@gjalves.com.br>
105620	string	\xce\xda\xde\xfa	Cytovision Metaphases file
105630	string	\xed\xad\xef\xac	Cytovision Karyotype file
105640	string	\x0b\x00\x03\x00	Cytovision FISH Probe file
105650	string	\xed\xfe\xda\xbe	Cytovision FLEX file
105660	string	\xed\xab\xed\xfe	Cytovision FLEX file
105670	string	\xad\xfd\xea\xad	Cytovision RATS file
10568
10569# Wavelet Scalar Quantization format used in gray-scale fingerprint images
10570# From Tano M Fotang <mfotang@quanteq.com>
105710	string	\xff\xa0\xff\xa8\x00	Wavelet Scalar Quantization image data
10572
10573# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches
10574# From: Markus Heidelberg <markus.heidelberg at web.de>
105750	string/t	[BitmapInfo2]	Polar Monitor Bitmap text
10576!:mime	image/x-polar-monitor-bitmap
10577
10578# From: Rick Richardson <rick.richardson@comcast.net>
105790	string	GARMIN\ BITMAP\ 01	Garmin Bitmap file
10580
10581# Type:	Ulead Photo Explorer5 (.pe5)
10582# URL:	http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese)
10583# From:	Simon Horman <horms@debian.org>
105840	string	IIO2H			Ulead Photo Explorer5
10585
10586# Type:	X11 cursor
10587# URL:	http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup
10588# From:	Mathias Brodala <info@noctus.net>
105890	string	Xcur			X11 cursor
10590
10591# Type:	Olympus ORF raw images.
10592# URL:	http://libopenraw.freedesktop.org/wiki/Olympus_ORF
10593# From:	Adam Buchbinder <adam.buchbinder@gmail.com>
105940	string		MMOR		Olympus ORF raw image data, big-endian
10595!:mime	image/x-olympus-orf
105960	string		IIRO		Olympus ORF raw image data, little-endian
10597!:mime	image/x-olympus-orf
105980	string		IIRS		Olympus ORF raw image data, little-endian
10599!:mime	image/x-olympus-orf
10600
10601# Type: files used in modern AVCHD camcoders to store clip information
10602# Extension: .cpi
10603# From: Alexander Danilov <alexander.a.danilov@gmail.com>
106040	string	HDMV0100	AVCHD Clip Information
10605
10606# From: Adam Buchbinder <adam.buchbinder@gmail.com>
10607# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/
10608# Radiance HDR; usually has .pic or .hdr extension.
106090	string	#?RADIANCE\n	Radiance HDR image data
10610#!mime	image/vnd.radiance
10611
10612# From: Adam Buchbinder <adam.buchbinder@gmail.com>
10613# URL: http://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf
10614# Used by the pfstools packages. The regex matches for the image size could
10615# probably use some work. The MIME type is made up; if there's one in
10616# actual common use, it should replace the one below.
106170	string	PFS1\x0a	PFS HDR image data
10618#!mime	image/x-pfs
10619>1	regex	[0-9]*\ 		\b, %s
10620>>1	regex	\ [0-9]{4}		\bx%s
10621
10622# Type: Foveon X3F
10623# URL:  http://www.photofo.com/downloads/x3f-raw-format.pdf
10624# From: Adam Buchbinder <adam.buchbinder@gmail.com>
10625# Note that the MIME type isn't defined anywhere that I can find; if
10626# there's a canonical type for this format, it should replace this one.
106270	string	FOVb	Foveon X3F raw image data
10628!:mime	image/x-x3f
10629>6	leshort	x	\b, version %d.
10630>4	leshort	x	\b%d
10631>28	lelong	x	\b, %dx
10632>32	lelong	x	\b%d
10633
10634# Paint.NET file
10635# From Adam Buchbinder <adam.buchbinder@gmail.com>
106360	string	PDN3	Paint.NET image data
10637!:mime	image/x-paintnet
10638
10639# Not really an image.
10640# From: "Tano M. Fotang" <mfotang@quanteq.com>
106410	string	\x46\x4d\x52\x00	ISO/IEC 19794-2 Format Minutiae Record (FMR)
10642
10643#------------------------------------------------------------------------------
10644# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $
10645# inform:  file(1) magic for Inform interactive fiction language
10646
10647# URL:  http://www.inform-fiction.org/
10648# From: Reuben Thomas <rrt@sc3d.org>
10649
106500	search/100/cW	constant\ story		Inform source text
10651
10652#------------------------------------------------------------------------------
10653# $File: intel,v 1.11 2013/02/06 14:18:52 christos Exp $
10654# intel:  file(1) magic for x86 Unix
10655#
10656# Various flavors of x86 UNIX executable/object (other than Xenix, which
10657# is in "microsoft").  DOS is in "msdos"; the ambitious soul can do
10658# Windows as well.
10659#
10660# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
10661# whatever comes next (HP-PA Hummingbird?).  OS/2 may also go elsewhere
10662# as well, if, as, and when IBM makes it portable.
10663#
10664# The `versions' should be un-commented if they work for you.
10665# (Was the problem just one of endianness?)
10666#
106670	leshort		0502		basic-16 executable
10668>12	lelong		>0		not stripped
10669#>22	leshort		>0		- version %ld
106700	leshort		0503		basic-16 executable (TV)
10671>12	lelong		>0		not stripped
10672#>22	leshort		>0		- version %ld
106730	leshort		0510		x86 executable
10674>12	lelong		>0		not stripped
106750	leshort		0511		x86 executable (TV)
10676>12	lelong		>0		not stripped
106770	leshort		=0512		iAPX 286 executable small model (COFF)
10678>12	lelong		>0		not stripped
10679#>22	leshort		>0		- version %ld
106800	leshort		=0522		iAPX 286 executable large model (COFF)
10681>12	lelong		>0		not stripped
10682#>22	leshort		>0		- version %ld
10683# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
106840	leshort		=0514		80386 COFF executable
10685>12	lelong		>0		not stripped
10686>22	leshort		>0		- version %ld
10687
10688# rom: file(1) magic for BIOS ROM Extensions found in intel machines
10689#      mapped into memory between 0xC0000 and 0xFFFFF
10690# From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
106910        beshort         0x55AA       BIOS (ia32) ROM Ext.
10692>5       string          USB          USB
10693>7       string          LDR          UNDI image
10694>30      string          IBM          IBM comp. Video
10695>26      string          Adaptec      Adaptec
10696>28      string          Adaptec      Adaptec
10697>42      string          PROMISE      Promise
10698>2       byte            x            (%d*512)
10699
10700# Flash descriptors for Intel SPI flash roms.
10701# From Dr. Jesus <j@hug.gs>
107020	lelong		0x0ff0a55a	Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step
1070316	lelong		0x0ff0a55a	Intel serial flash for PCH ROM
10704
10705#------------------------------------------------------------------------------
10706# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $
10707# interleaf:  file(1) magic for InterLeaf TPS:
10708#
107090	string		=\210OPS	Interleaf saved data
107100	string		=<!OPS		Interleaf document text
10711>5	string		,\ Version\ =	\b, version
10712>>17	string		>\0		%.3s
10713
10714#------------------------------------------------------------------------------
10715# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $
10716# island:  file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
10717# "/etc/magic":
10718# From: guy@netapp.com (Guy Harris)
10719#
107204	string		pgscriptver	IslandWrite document
1072113	string		DrawFile	IslandDraw document
10722
10723
10724#------------------------------------------------------------------------------
10725# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $
10726# ispell:  file(1) magic for ispell
10727#
10728# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602.  This magic
10729# will match 0x9600 through 0x9603 in *both* little endian and big endian.
10730# (No other current magic entries collide.)
10731#
10732# Updated by Daniel Quinlan (quinlan@yggdrasil.com)
10733#
107340	leshort&0xFFFC	0x9600		little endian ispell
10735>0	byte		0		hash file (?),
10736>0	byte		1		3.0 hash file,
10737>0	byte		2		3.1 hash file,
10738>0	byte		3		hash file (?),
10739>2	leshort		0x00		8-bit, no capitalization, 26 flags
10740>2	leshort		0x01		7-bit, no capitalization, 26 flags
10741>2	leshort		0x02		8-bit, capitalization, 26 flags
10742>2	leshort		0x03		7-bit, capitalization, 26 flags
10743>2	leshort		0x04		8-bit, no capitalization, 52 flags
10744>2	leshort		0x05		7-bit, no capitalization, 52 flags
10745>2	leshort		0x06		8-bit, capitalization, 52 flags
10746>2	leshort		0x07		7-bit, capitalization, 52 flags
10747>2	leshort		0x08		8-bit, no capitalization, 128 flags
10748>2	leshort		0x09		7-bit, no capitalization, 128 flags
10749>2	leshort		0x0A		8-bit, capitalization, 128 flags
10750>2	leshort		0x0B		7-bit, capitalization, 128 flags
10751>2	leshort		0x0C		8-bit, no capitalization, 256 flags
10752>2	leshort		0x0D		7-bit, no capitalization, 256 flags
10753>2	leshort		0x0E		8-bit, capitalization, 256 flags
10754>2	leshort		0x0F		7-bit, capitalization, 256 flags
10755>4	leshort		>0		and %d string characters
107560	beshort&0xFFFC	0x9600		big endian ispell
10757>1	byte		0		hash file (?),
10758>1	byte		1		3.0 hash file,
10759>1	byte		2		3.1 hash file,
10760>1	byte		3		hash file (?),
10761>2	beshort		0x00		8-bit, no capitalization, 26 flags
10762>2	beshort		0x01		7-bit, no capitalization, 26 flags
10763>2	beshort		0x02		8-bit, capitalization, 26 flags
10764>2	beshort		0x03		7-bit, capitalization, 26 flags
10765>2	beshort		0x04		8-bit, no capitalization, 52 flags
10766>2	beshort		0x05		7-bit, no capitalization, 52 flags
10767>2	beshort		0x06		8-bit, capitalization, 52 flags
10768>2	beshort		0x07		7-bit, capitalization, 52 flags
10769>2	beshort		0x08		8-bit, no capitalization, 128 flags
10770>2	beshort		0x09		7-bit, no capitalization, 128 flags
10771>2	beshort		0x0A		8-bit, capitalization, 128 flags
10772>2	beshort		0x0B		7-bit, capitalization, 128 flags
10773>2	beshort		0x0C		8-bit, no capitalization, 256 flags
10774>2	beshort		0x0D		7-bit, no capitalization, 256 flags
10775>2	beshort		0x0E		8-bit, capitalization, 256 flags
10776>2	beshort		0x0F		7-bit, capitalization, 256 flags
10777>4	beshort		>0		and %d string characters
10778# ispell 4.0 hash files  kromJx <kromJx@crosswinds.net>
10779# Ispell 4.0
107800       string          ISPL            ispell
10781>4      long            x               hash file version %d,
10782>8      long            x               lexletters %d,
10783>12     long            x               lexsize %d,
10784>16     long            x               hashsize %d,
10785>20     long            x               stblsize %d
10786
10787#------------------------------------------------------------------------------
10788# $File: isz,v 1.1 2010/03/27 16:17:09 christos Exp $
10789# ISO Zipped file format
10790# http://www.ezbsystems.com/isz/iszspec.txt
107910	string	IsZ!	ISO Zipped file
10792>4	byte	x	\b, header size %u
10793>5	byte	x	\b, version %u
10794>8	lelong	x	\b, serial %u
10795#12	leshort	x	\b, sector size %u
10796#>16	lelong	x	\b, total sectors %u
10797>17	byte	>0	\b, password protected
10798#>24	lequad	x	\b, segment size %llu
10799#>32	lelong	x	\b, blocks %u
10800#>36	lelong	x	\b, block size %u
10801
10802#------------------------------------------------------------
10803# $File: java,v 1.14 2013/02/08 16:54:45 christos Exp $
10804# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
10805# same magic number, 0xcafebabe, so they are both handled
10806# in the entry called "cafebabe".
10807#------------------------------------------------------------
10808# Java serialization
10809# From Martin Pool (m.pool@pharos.com.au)
108100	beshort		0xaced		Java serialization data
10811>2	beshort		>0x0004		\b, version %d
10812
108130	belong		0xfeedfeed	Java KeyStore
10814!:mime	application/x-java-keystore
108150	belong		0xcececece	Java JCE KeyStore
10816!:mime	application/x-java-jce-keystore
10817
10818# Dalvik .dex format. http://retrodev.com/android/dexformat.html
10819# From <mkf@google.com> "Mike Fleming"
108200	string	dex\n
10821>0	regex	dex\n[0-9][0-9][0-9]\0	Dalvik dex file
10822>4	string	>000			version %s
108230	string	dey\n
10824>0	regex	dey\n[0-9][0-9][0-9]\0	Dalvik dex file (optimized for host)
10825>4	string	>000			version %s
10826
10827# Java source
108280	regex	^import.*;$	Java source
10829!:mime	text/x-java
10830
10831# http://android.stackexchange.com/questions/23357/\
10832# is-there-a-way-to-look-inside-and-modify-an-adb-backup-created-file/\
10833# 23608#23608
108340	string	ANDROID\040BACKUP\n	Android Backup
10835>15	string	1\n			\b, version 1
10836>17	string	0\n			\b, uncompressed
10837>17	string	1\n			\b, compressed
10838>19	string	none\n			\b, unencrypted
10839>19	string	AES-256\n		\b, encrypted AES-256
10840
10841#------------------------------------------------------------------------------
10842# $File: javascript,v 1.1 2012/06/16 13:30:36 christos Exp $
10843# javascript:  magic for javascript and node.js scripts.
10844#
108450	search/1/w	#!/bin/node		Node.js script text executable
10846!:mime application/javascript
108470	search/1/w	#!/usr/bin/node		Node.js script text executable
10848!:mime application/javascript
108490	search/1/w	#!/bin/nodejs		Node.js script text executable
10850!:mime application/javascript
108510	search/1/w	#!/usr/bin/nodejs	Node.js script text executable
10852!:mime application/javascript
108530	search/1	#!/usr/bin/env\ node	Node.js script text executable
10854!:mime application/javascript
108550	search/1	#!/usr/bin/env\ nodejs	Node.js script text executable
10856!:mime application/javascript
10857
10858#------------------------------------------------------------------------------
10859# $File: jpeg,v 1.19 2013/02/04 15:50:03 christos Exp $
10860# JPEG images
10861# SunOS 5.5.1 had
10862#
10863#	0	string		\377\330\377\340	JPEG file
10864#	0	string		\377\330\377\356	JPG file
10865#
10866# both of which turn into "JPEG image data" here.
10867#
108680	beshort		0xffd8		JPEG image data
10869!:mime	image/jpeg
10870!:apple	8BIMJPEG
10871!:strength +2
10872>6	string		JFIF		\b, JFIF standard
10873# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
10874# in a vain attempt to add image size reporting for JFIF.  Note that these
10875# tests are not fool-proof since some perfectly valid JPEGs are currently
10876# impossible to specify in magic(4) format.
10877# First, a little JFIF version info:
10878>>11	byte		x		\b %d.
10879>>12	byte		x		\b%02d
10880# Next, the resolution or aspect ratio of the image:
10881#>>13	byte		0		\b, aspect ratio
10882#>>13	byte		1		\b, resolution (DPI)
10883#>>13	byte		2		\b, resolution (DPCM)
10884#>>4	beshort		x		\b, segment length %d
10885# Next, show thumbnail info, if it exists:
10886>>18	byte		!0		\b, thumbnail %dx
10887>>>19	byte		x		\b%d
10888
10889# EXIF moved down here to avoid reporting a bogus version number,
10890# and EXIF version number printing added.
10891#   - Patrik R=E5dman <patrik+file-magic@iki.fi>
10892>6	string		Exif		\b, EXIF standard
10893# Look for EXIF IFD offset in IFD 0, and then look for EXIF version tag in EXIF IFD.
10894# All possible combinations of entries have to be enumerated, since no looping
10895# is possible. And both endians are possible...
10896# The combinations included below are from real-world JPEGs.
10897# Little-endian
10898>>12	string		II
10899# IFD 0 Entry #5:
10900>>>70	leshort		0x8769
10901# EXIF IFD Entry #1:
10902>>>>(78.l+14)	leshort	0x9000
10903>>>>>(78.l+23)	byte	x		%c
10904>>>>>(78.l+24)	byte	x		\b.%c
10905>>>>>(78.l+25)	byte	!0x30		\b%c
10906# IFD 0 Entry #9:
10907>>>118	leshort		0x8769
10908# EXIF IFD Entry #3:
10909>>>>(126.l+38)	leshort	0x9000
10910>>>>>(126.l+47)	byte	x		%c
10911>>>>>(126.l+48)	byte	x		\b.%c
10912>>>>>(126.l+49)	byte	!0x30		\b%c
10913# IFD 0 Entry #10
10914>>>130	leshort		0x8769
10915# EXIF IFD Entry #3:
10916>>>>(138.l+38)	leshort	0x9000
10917>>>>>(138.l+47)	byte	x		%c
10918>>>>>(138.l+48)	byte	x		\b.%c
10919>>>>>(138.l+49)	byte	!0x30		\b%c
10920# EXIF IFD Entry #4:
10921>>>>(138.l+50)	leshort	0x9000
10922>>>>>(138.l+59)	byte	x		%c
10923>>>>>(138.l+60)	byte	x		\b.%c
10924>>>>>(138.l+61)	byte	!0x30		\b%c
10925# EXIF IFD Entry #5:
10926>>>>(138.l+62)	leshort	0x9000
10927>>>>>(138.l+71)	byte	x		%c
10928>>>>>(138.l+72)	byte	x		\b.%c
10929>>>>>(138.l+73)	byte	!0x30		\b%c
10930# IFD 0 Entry #11
10931>>>142	leshort		0x8769
10932# EXIF IFD Entry #3:
10933>>>>(150.l+38)	leshort	0x9000
10934>>>>>(150.l+47)	byte	x		%c
10935>>>>>(150.l+48)	byte	x		\b.%c
10936>>>>>(150.l+49)	byte	!0x30		\b%c
10937# EXIF IFD Entry #4:
10938>>>>(150.l+50)	leshort	0x9000
10939>>>>>(150.l+59)	byte	x		%c
10940>>>>>(150.l+60)	byte	x		\b.%c
10941>>>>>(150.l+61)	byte	!0x30		\b%c
10942# EXIF IFD Entry #5:
10943>>>>(150.l+62)	leshort	0x9000
10944>>>>>(150.l+71)	byte	x		%c
10945>>>>>(150.l+72)	byte	x		\b.%c
10946>>>>>(150.l+73)	byte	!0x30		\b%c
10947# Big-endian
10948>>12	string		MM
10949# IFD 0 Entry #9:
10950>>>118	beshort		0x8769
10951# EXIF IFD Entry #1:
10952>>>>(126.L+14)	beshort	0x9000
10953>>>>>(126.L+23)	byte	x		%c
10954>>>>>(126.L+24)	byte	x		\b.%c
10955>>>>>(126.L+25)	byte	!0x30		\b%c
10956# EXIF IFD Entry #3:
10957>>>>(126.L+38)	beshort	0x9000
10958>>>>>(126.L+47)	byte	x		%c
10959>>>>>(126.L+48)	byte	x		\b.%c
10960>>>>>(126.L+49)	byte	!0x30		\b%c
10961# IFD 0 Entry #10
10962>>>130	beshort		0x8769
10963# EXIF IFD Entry #3:
10964>>>>(138.L+38)	beshort	0x9000
10965>>>>>(138.L+47)	byte	x		%c
10966>>>>>(138.L+48)	byte	x		\b.%c
10967>>>>>(138.L+49)	byte	!0x30		\b%c
10968# EXIF IFD Entry #5:
10969>>>>(138.L+62)	beshort	0x9000
10970>>>>>(138.L+71)	byte	x		%c
10971>>>>>(138.L+72)	byte	x		\b.%c
10972>>>>>(138.L+73)	byte	!0x30		\b%c
10973# IFD 0 Entry #11
10974>>>142	beshort		0x8769
10975# EXIF IFD Entry #4:
10976>>>>(150.L+50)	beshort	0x9000
10977>>>>>(150.L+59)	byte	x		%c
10978>>>>>(150.L+60)	byte	x		\b.%c
10979>>>>>(150.L+61)	byte	!0x30		\b%c
10980# Here things get sticky.  We can do ONE MORE marker segment with
10981# indirect addressing, and that's all.  It would be great if we could
10982# do pointer arithemetic like in an assembler language.  Christos?
10983# And if there was some sort of looping construct to do searches, plus a few
10984# named accumulators, it would be even more effective...
10985# At least we can show a comment if no other segments got inserted before:
10986>(4.S+5)	byte		0xFE		\b, comment:
10987>>(4.S+6)	pstring/HJ	x		"%s"
10988# Or, we can show the encoding type (I've included only the three most common)
10989# and image dimensions if we are lucky and the SOFn (image segment) is here:
10990>(4.S+5)	byte		0xC0		\b, baseline
10991>>(4.S+6)	byte		x		\b, precision %d
10992>>(4.S+7)	beshort		x		\b, %dx
10993>>(4.S+9)	beshort		x		\b%d
10994>(4.S+5)	byte		0xC1		\b, extended sequential
10995>>(4.S+6)	byte		x		\b, precision %d
10996>>(4.S+7)	beshort		x		\b, %dx
10997>>(4.S+9)	beshort		x		\b%d
10998>(4.S+5)	byte		0xC2		\b, progressive
10999>>(4.S+6)	byte		x		\b, precision %d
11000>>(4.S+7)	beshort		x		\b, %dx
11001>>(4.S+9)	beshort		x		\b%d
11002# I've commented-out quantisation table reporting.  I doubt anyone cares yet.
11003#>(4.S+5)	byte		0xDB		\b, quantisation table
11004#>>(4.S+6)	beshort		x		\b length=%d
11005#>14	beshort		x		\b, %d x
11006#>16	beshort		x		\b %d
11007
11008# HSI is Handmade Software's proprietary JPEG encoding scheme
110090	string		hsi1		JPEG image data, HSI proprietary
11010
11011# From: David Santinoli <david@santinoli.com>
110120	string		\x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A	JPEG 2000
11013# From: Johan van der Knijff <johan.vanderknijff@kb.nl>
11014# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes
11015# https://github.com/bitsgalore/jp2kMagic
11016#
11017# Now read value of 'Brand' field, which yields a few possibilities:
11018>20	string		\x6a\x70\x32\x20	Part 1 (JP2)
11019!:mime	image/jp2
11020>20	string		\x6a\x70\x78\x20	Part 2 (JPX)
11021!:mime	image/jpx
11022>20	string		\x6a\x70\x6d\x20	Part 6 (JPM)
11023!:mime	image/jpm
11024>20	string		\x6d\x6a\x70\x32	Part 3 (MJ2)
11025!:mime	video/mj2
11026
11027# Type: JPEG 2000 codesream
11028# From: Mathieu Malaterre <mathieu.malaterre@gmail.com>
110290	belong		0xff4fff51						JPEG 2000 codestream
1103045	beshort		0xff52
11031
11032#------------------------------------------------------------------------------
11033# $File: karma,v 1.6 2009/09/19 16:28:10 christos Exp $
11034# karma:  file(1) magic for Karma data files
11035#
11036# From <rgooch@atnf.csiro.au>
11037
110380	string		KarmaRHD Version	Karma Data Structure Version
11039>16	belong		x		%lu
11040
11041#------------------------------------------------------------------------------
11042# $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $
11043# kde:  file(1) magic for KDE
11044
110450		string/t	[KDE\ Desktop\ Entry]	KDE desktop entry
11046!:mime	application/x-kdelnk
110470		string/t	#\ KDE\ Config\ File	KDE config file
11048!:mime	application/x-kdelnk
110490		string/t	#\ xmcd	xmcd database file for kscd
11050!:mime	text/x-xmcd
11051
11052#------------------------------------------------------------------------------
11053# $File: keepass,v 1.1 2012/12/24 22:14:56 christos Exp $
11054# keepass: file(1) magic for KeePass file
11055#
11056# Keepass Password Safe:
11057#  * original one: http://keepass.info/
11058#  * *nix port:    http://www.keepassx.org/
11059#  * android port: http://code.google.com/p/keepassdroid/
11060
110610	lelong		0x9AA2D903	Keepass password database
11062>4	lelong		0xB54BFB65	1.x KDB
11063>>48	lelong		>0		\b, %d groups
11064>>52	lelong		>0		\b, %d entries
11065>>8	lelong&0x0f	1		\b, SHA-256
11066>>8	lelong&0x0f	2		\b, AES
11067>>8	lelong&0x0f	4		\b, RC4
11068>>8	lelong&0x0f	8		\b, Twofish
11069>>120	lelong		>0		\b, %d key transformation rounds
11070>4	lelong		0xB54BFB67	2.x KDBX
11071
11072#------------------------------------------------------------------------------
11073# $File: kml,v 1.3 2010/11/25 15:00:12 christos Exp $
11074# Type: Google KML, formerly Keyhole Markup Language
11075# Future development of this format has been handed
11076# over to the Open Geospatial Consortium.
11077# http://www.opengeospatial.org/standards/kml/
11078# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
110790 string/t    \<?xml
11080>20  search/400 \ xmlns=
11081>>&0 regex ['"]http://earth.google.com/kml Google KML document
11082!:mime application/vnd.google-earth.kml+xml
11083>>>&1 string 2.0' \b, version 2.0
11084>>>&1 string 2.1' \b, version 2.1
11085>>>&1 string 2.2' \b, version 2.2
11086
11087#------------------------------------------------------------------------------
11088# Type: OpenGIS KML, formerly Keyhole Markup Language
11089# This standard is maintained by the
11090# Open Geospatial Consortium.
11091# http://www.opengeospatial.org/standards/kml/
11092# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
11093>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document
11094!:mime application/vnd.google-earth.kml+xml
11095>>>&1 string/t 2.2 \b, version 2.2
11096
11097#------------------------------------------------------------------------------
11098# Type: Google KML Archive (ZIP based)
11099# http://code.google.com/apis/kml/documentation/kml_tut.html
11100# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
111010 string    PK\003\004
11102>4  byte    0x14
11103>>30  string doc.kml Compressed Google KML Document, including resources.
11104!:mime application/vnd.google-earth.kmz
11105
11106#------------------------------------------------------------------------------
11107# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $
11108# DEC SRC Virtual Paper: Lectern files
11109# Karl M. Hegbloom <karlheg@inetarena.com>
111100	string	lect	DEC SRC Virtual Paper Lectern file
11111
11112#------------------------------------------------------------------------------
11113# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $
11114# lex:  file(1) magic for lex
11115#
11116#	derived empirically, your offsets may vary!
111170	search/100	yyprevious	C program text (from lex)
11118>3	search/1	>\0		 for %s
11119# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
111200	search/100	generated\ by\ flex	C program text (from flex)
11121# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
111220	search/1	%{		lex description text
11123
11124#------------------------------------------------------------------------------
11125# $File: lif,v 1.8 2009/09/19 16:28:10 christos Exp $
11126# lif:  file(1) magic for lif
11127#
11128# (Daniel Quinlan <quinlan@yggdrasil.com>)
11129#
111300	beshort		0x8000		lif file
11131
11132#------------------------------------------------------------------------------
11133# $File: linux,v 1.47 2013/02/06 14:18:52 christos Exp $
11134# linux:  file(1) magic for Linux files
11135#
11136# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
11137# The following basic Linux magic is useful for reference, but using
11138# "long" magic is a better practice in order to avoid collisions.
11139#
11140# 2	leshort		100		Linux/i386
11141# >0	leshort		0407		impure executable (OMAGIC)
11142# >0	leshort		0410		pure executable (NMAGIC)
11143# >0	leshort		0413		demand-paged executable (ZMAGIC)
11144# >0	leshort		0314		demand-paged executable (QMAGIC)
11145#
111460	lelong		0x00640107	Linux/i386 impure executable (OMAGIC)
11147>16	lelong		0		\b, stripped
111480	lelong		0x00640108	Linux/i386 pure executable (NMAGIC)
11149>16	lelong		0		\b, stripped
111500	lelong		0x0064010b	Linux/i386 demand-paged executable (ZMAGIC)
11151>16	lelong		0		\b, stripped
111520	lelong		0x006400cc	Linux/i386 demand-paged executable (QMAGIC)
11153>16	lelong		0		\b, stripped
11154#
111550	string		\007\001\000	Linux/i386 object file
11156>20	lelong		>0x1020		\b, DLL library
11157# Linux-8086 stuff:
111580	string		\01\03\020\04	Linux-8086 impure executable
11159>28	long		!0		not stripped
111600	string		\01\03\040\04	Linux-8086 executable
11161>28	long		!0		not stripped
11162#
111630	string		\243\206\001\0	Linux-8086 object file
11164#
111650	string		\01\03\020\20	Minix-386 impure executable
11166>28	long		!0		not stripped
111670	string		\01\03\040\20	Minix-386 executable
11168>28	long		!0		not stripped
111690	string		\01\03\04\20	Minix-386 NSYM/GNU executable
11170>28	long		!0		not stripped
11171# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
11172216	lelong		0421		Linux/i386 core file
11173>220	string		>\0		of '%s'
11174>200	lelong		>0		(signal %d)
11175#
11176# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
11177# this can be overridden by the DOS executable (COM) entry
111782	string		LILO		Linux/i386 LILO boot/chain loader
11179#
11180# Linux make config build file, from Ole Aamot <oka@oka.no>
1118128 	string		make\ config	Linux make config build file
11182#
11183# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
11184# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
11185# See: http://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html
111860	leshort		0x0436		Linux/i386 PC Screen Font v1 data,
11187>2	byte&0x01	0		256 characters,
11188>2	byte&0x01	!0		512 characters,
11189>2	byte&0x02	0		no directory,
11190>2	byte&0x02	!0		Unicode directory,
11191>3	byte		>0		8x%d
111920	string		\x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data,
11193>16	lelong		x		%d characters,
11194>12	lelong&0x01	0		no directory,
11195>12	lelong&0x01	!0		Unicode directory,
11196>24	lelong		x		%d
11197>28	lelong		x		\bx%d
11198
11199# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
112004086	string		SWAP-SPACE	Linux/i386 swap file
11201# From: Jeff Bailey <jbailey@ubuntu.com>
11202# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com>
112034076	string		SWAPSPACE2S1SUSPEND	Linux/i386 swap file (new style) with SWSUSP1 image
11204# From: James Hunt <james.hunt@ubuntu.com>
112054076    string          SWAPSPACE2LINHIB0001    Linux/i386 swap file (new style) (compressed hibernate)
11206# according to man page of mkswap (8) March 1999
11207# volume label and UUID Russell Coker
11208# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
112094086	string		SWAPSPACE2	Linux/i386 swap file (new style),
11210>0x400	long		x		version %d (4K pages),
11211>0x404	long		x		size %d pages,
11212>1052	string		\0		no label,
11213>1052	string		>\0		LABEL=%s,
11214>0x40c	belong		x		UUID=%08x
11215>0x410	beshort		x		\b-%04x
11216>0x412	beshort		x		\b-%04x
11217>0x414	beshort		x		\b-%04x
11218>0x416	belong		x		\b-%08x
11219>0x41a	beshort		x		\b%04x
11220# From Daniel Novotny <dnovotny@redhat.com>
11221# swap file for PowerPC
1122265526	string		SWAPSPACE2	Linux/ppc swap file
1122316374	string		SWAPSPACE2	Linux/ia64 swap file
11224#
11225# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
11226# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
11227# and Nicolas Lichtmaier <nick@debian.org>
11228# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
11229# Linux kernel boot images (i386 arch) (Wolfram Kleff)
11230514	string		HdrS		Linux kernel
11231!:strength + 5
11232>510	leshort		0xAA55		x86 boot executable
11233>>518	leshort		>0x1ff
11234>>>529	byte		0		zImage,
11235>>>529	byte		1		bzImage,
11236>>>(526.s+0x200) string	>\0		version %s,
11237>>498	leshort		1		RO-rootFS,
11238>>498	leshort		0		RW-rootFS,
11239>>508	leshort		>0		root_dev 0x%X,
11240>>502	leshort		>0		swap_dev 0x%X,
11241>>504	leshort		>0		RAMdisksize %u KB,
11242>>506	leshort		0xFFFF		Normal VGA
11243>>506	leshort		0xFFFE		Extended VGA
11244>>506	leshort		0xFFFD		Prompt for Videomode
11245>>506	leshort		>0		Video mode %d
11246# This also matches new kernels, which were caught above by "HdrS".
112470		belong	0xb8c0078e	Linux kernel
11248>0x1e3		string	Loading		version 1.3.79 or older
11249>0x1e9		string	Loading		from prehistoric times
11250
11251# System.map files - Nicolas Lichtmaier <nick@debian.org>
112528	search/1	\ A\ _text	Linux kernel symbol map text
11253
11254# LSM entries - Nicolas Lichtmaier <nick@debian.org>
112550	search/1	Begin3	Linux Software Map entry text
112560	search/1	Begin4	Linux Software Map entry text (new format)
11257
11258# From Matt Zimmerman, enhanced for v3 by Matthew Palmer
112590	belong	0x4f4f4f4d	User-mode Linux COW file
11260>4	belong	<3		\b, version %d
11261>>8	string	>\0		\b, backing file %s
11262>4	belong	>2		\b, version %d
11263>>32	string	>\0		\b, backing file %s
11264
11265############################################################################
11266# Linux kernel versions
11267
112680		string		\xb8\xc0\x07\x8e\xd8\xb8\x00\x90	Linux
11269>497		leshort		0		x86 boot sector
11270>>514		belong		0x8e	of a kernel from the dawn of time!
11271>>514		belong		0x908ed8b4	version 0.99-1.1.42
11272>>514		belong		0x908ed8b8	for memtest86
11273
11274>497		leshort		!0		x86 kernel
11275>>504		leshort		>0		RAMdisksize=%u KB
11276>>502		leshort		>0		swap=0x%X
11277>>508		leshort		>0		root=0x%X
11278>>>498		leshort		1		\b-ro
11279>>>498		leshort		0		\b-rw
11280>>506		leshort		0xFFFF		vga=normal
11281>>506		leshort		0xFFFE		vga=extended
11282>>506		leshort		0xFFFD		vga=ask
11283>>506		leshort		>0		vga=%d
11284>>514		belong		0x908ed881	version 1.1.43-1.1.45
11285>>514		belong		0x15b281cd
11286>>>0xa8e	belong		0x55AA5a5a	version 1.1.46-1.2.13,1.3.0
11287>>>0xa99	belong		0x55AA5a5a	version 1.3.1,2
11288>>>0xaa3	belong		0x55AA5a5a	version 1.3.3-1.3.30
11289>>>0xaa6	belong		0x55AA5a5a	version 1.3.31-1.3.41
11290>>>0xb2b	belong		0x55AA5a5a	version 1.3.42-1.3.45
11291>>>0xaf7	belong		0x55AA5a5a	version 1.3.46-1.3.72
11292>>514		string		HdrS
11293>>>518		leshort		>0x1FF
11294>>>>529		byte		0		\b, zImage
11295>>>>529		byte		1		\b, bzImage
11296>>>>(526.s+0x200) string 	>\0		\b, version %s
11297
11298# Linux boot sector thefts.
112990		belong		0xb8c0078e	Linux
11300>0x1e6		belong		0x454c4b53	ELKS Kernel
11301>0x1e6		belong		!0x454c4b53	style boot sector
11302
11303############################################################################
11304# Linux S390 kernel image
11305# Created by: Jan Kaluza <jkaluza@redhat.com>
113068 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390
11307>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc
11308# 64bit
11309>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel
11310>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel
11311>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel
11312>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel
11313# 32bit
11314>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel
11315>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel
11316>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel
11317>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel
11318
11319# Linux ARM compressed kernel image
11320# From: Kevin Cernekee <cernekee@gmail.com>
1132136	lelong	0x016f2818	Linux kernel ARM boot executable zImage (little-endian)
1132236	belong	0x016f2818	Linux kernel ARM boot executable zImage (big-endian)
11323
11324############################################################################
11325# Linux 8086 executable
113260	lelong&0xFF0000FF 0xC30000E9	Linux-Dev86 executable, headerless
11327>5	string		.
11328>>4	string		>\0		\b, libc version %s
11329
113300	lelong&0xFF00FFFF 0x4000301	Linux-8086 executable
11331>2	byte&0x01	!0		\b, unmapped zero page
11332>2	byte&0x20	0		\b, impure
11333>2	byte&0x20	!0
11334>>2	byte&0x10	!0		\b, A_EXEC
11335>2	byte&0x02	!0		\b, A_PAL
11336>2	byte&0x04	!0		\b, A_NSYM
11337>2	byte&0x08	!0		\b, A_STAND
11338>2	byte&0x40	!0		\b, A_PURE
11339>2	byte&0x80	!0		\b, A_TOVLY
11340>28     long            !0              \b, not stripped
11341>37	string		.
11342>>36	string		>\0		\b, libc version %s
11343
11344# 0	lelong&0xFF00FFFF 0x10000301	ld86 I80386 executable
11345# 0	lelong&0xFF00FFFF 0xB000301	ld86 M68K executable
11346# 0	lelong&0xFF00FFFF 0xC000301	ld86 NS16K executable
11347# 0	lelong&0xFF00FFFF 0x17000301	ld86 SPARC executable
11348
11349# SYSLINUX boot logo files (from 'ppmtolss16' sources)
11350# http://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename:
11351# file extension .lss .16
113520	lelong	=0x1413f33d		SYSLINUX' LSS16 image data
11353# syslinux-4.05/mime/image/x-lss16.xml
11354!:mime image/x-lss16
11355>4	leshort	x			\b, width %d
11356>6	leshort	x			\b, height %d
11357
113580	string	OOOM			User-Mode-Linux's Copy-On-Write disk image
11359>4	belong	x			version %d
11360
11361# SE Linux policy database
11362# From: Mike Frysinger <vapier@gentoo.org>
113630	lelong	0xf97cff8c		SE Linux policy
11364>16	lelong	x			v%d
11365>20	lelong	1			MLS
11366>24	lelong	x			%d symbols
11367>28	lelong	x			%d ocons
11368
11369# Linux Logical Volume Manager (LVM)
11370# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net>
11371#
11372# System ID, UUID and volume group name are 128 bytes long
11373# but they should never be full and initialized with zeros...
11374#
11375# LVM1
11376#
113770x0	string	HM\001		LVM1 (Linux Logical Volume Manager), version 1
11378>0x12c	string	>\0		, System ID: %s
11379
113800x0	string	HM\002		LVM1 (Linux Logical Volume Manager), version 2
11381>0x12c	string	>\0		, System ID: %s
11382
11383#  LVM2
11384#
11385# It seems that the label header can be in one the four first sector
11386# of the disk... (from _find_labeller in lib/label/label.c of LVM2)
11387#
11388# 0x200 seems to be the common case
11389
113900x218           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
11391# read the offset to add to the start of the header, and the header
11392# start in 0x200
11393>&(&-12.l-0x21) byte    x
11394# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
11395>>&0x0          string  >\x2f          \b, UUID: %.6s
11396>>&0x6          string  >\x2f          \b-%.4s
11397>>&0xa          string  >\x2f          \b-%.4s
11398>>&0xe          string  >\x2f          \b-%.4s
11399>>&0x12         string  >\x2f          \b-%.4s
11400>>&0x16         string  >\x2f          \b-%.4s
11401>>&0x1a         string  >\x2f          \b-%.6s
11402>>&0x20         lequad  x              \b, size: %lld
11403
114040x018           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
11405>&(&-12.l-0x21) byte    x
11406# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
11407>>&0x0          string  >\x2f          \b, UUID: %.6s
11408>>&0x6          string  >\x2f          \b-%.4s
11409>>&0xa          string  >\x2f          \b-%.4s
11410>>&0xe          string  >\x2f          \b-%.4s
11411>>&0x12         string  >\x2f          \b-%.4s
11412>>&0x16         string  >\x2f          \b-%.4s
11413>>&0x1a         string  >\x2f          \b-%.6s
11414>>&0x20         lequad  x              \b, size: %lld
11415
114160x418           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
11417>&(&-12.l-0x21) byte    x
11418# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
11419>>&0x0          string  >\x2f          \b, UUID: %.6s
11420>>&0x6          string  >\x2f          \b-%.4s
11421>>&0xa          string  >\x2f          \b-%.4s
11422>>&0xe          string  >\x2f          \b-%.4s
11423>>&0x12         string  >\x2f          \b-%.4s
11424>>&0x16         string  >\x2f          \b-%.4s
11425>>&0x1a         string  >\x2f          \b-%.6s
11426>>&0x20         lequad  x              \b, size: %lld
11427
114280x618           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
11429>&(&-12.l-0x21) byte    x
11430# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
11431>>&0x0          string  >\x2f          \b, UUID: %.6s
11432>>&0x6          string  >\x2f          \b-%.4s
11433>>&0xa          string  >\x2f          \b-%.4s
11434>>&0xe          string  >\x2f          \b-%.4s
11435>>&0x12         string  >\x2f          \b-%.4s
11436>>&0x16         string  >\x2f          \b-%.4s
11437>>&0x1a         string  >\x2f          \b-%.6s
11438>>&0x20         lequad  x              \b, size: %lld
11439
11440# LVM snapshot
11441# from Jason Farrel
114420	string	SnAp	LVM Snapshot (CopyOnWrite store)
11443>4	lelong	!0	- valid,
11444>4	lelong	0	- invalid,
11445>8	lelong	x	version %d,
11446>12	lelong	x	chunk_size %d
11447
11448# SE Linux policy database
114490	lelong	0xf97cff8c		SE Linux policy
11450>16	lelong	x			v%d
11451>20	lelong	1			MLS
11452>24	lelong	x			%d symbols
11453>28	lelong	x			%d ocons
11454
11455# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec
11456# Anthon van der Neut (anthon@mnt.org)
114570	string	LUKS\xba\xbe	LUKS encrypted file,
11458>6	beshort x		ver %d
11459>8	string	x		[%s,
11460>40	string	x		%s,
11461>72	string	x		%s]
11462>168	string	x		UUID: %s
11463
11464
11465# Summary: Xen saved domain file
11466# Created by: Radek Vokal <rvokal@redhat.com>
114670	string		LinuxGuestRecord	Xen saved domain
11468>20	search/256	(name
11469>>&1	string		x			(name %s)
11470
11471# Type: Xen, the virtual machine monitor
11472# From: Radek Vokal <rvokal@redhat.com>
114730	string		LinuxGuestRecord	Xen saved domain
11474#>2	regex		\(name\ [^)]*\)		%s
11475>20	search/256	(name			(name
11476>>&1	string		x			%s...)
11477
11478#------------------------------------------------------------------------------
11479# $File: lisp,v 1.23 2009/09/19 16:28:10 christos Exp $
11480# lisp:  file(1) magic for lisp programs
11481#
11482# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
11483
11484# updated by Joerg Jenderek
11485# GRR: This lot is too weak
11486#0	string	;;
11487# windows INF files often begin with semicolon and use CRLF as line end
11488# lisp files are mainly created on unix system with LF as line end
11489#>2	search/4096	!\r		Lisp/Scheme program text
11490#>2	search/4096	\r		Windows INF file
11491
114920	search/4096	(setq\ 			Lisp/Scheme program text
11493!:mime	text/x-lisp
114940	search/4096	(defvar\ 		Lisp/Scheme program text
11495!:mime	text/x-lisp
114960	search/4096	(defparam\ 		Lisp/Scheme program text
11497!:mime	text/x-lisp
114980	search/4096	(defun\  		Lisp/Scheme program text
11499!:mime	text/x-lisp
115000	search/4096	(autoload\ 		Lisp/Scheme program text
11501!:mime	text/x-lisp
115020	search/4096	(custom-set-variables\ 	Lisp/Scheme program text
11503!:mime	text/x-lisp
11504
11505# Emacs 18 - this is always correct, but not very magical.
115060	string	\012(			Emacs v18 byte-compiled Lisp data
11507!:mime	application/x-elc
11508# Emacs 19+ - ver. recognition added by Ian Springer
11509# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs
11510# - Chris Chittleborough <cchittleborough@yahoo.com.au>
115110	string	;ELC
11512>4	byte	>18
11513>4	byte    <32			Emacs/XEmacs v%d byte-compiled Lisp data
11514!:mime	application/x-elc
11515
11516# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
115170	string	(SYSTEM::VERSION\040'	CLISP byte-compiled Lisp program (pre 2004-03-27)
115180	string	(|SYSTEM|::|VERSION|\040'	CLISP byte-compiled Lisp program text
11519
115200	long	0x70768BD2		CLISP memory image data
115210	long	0xD28B7670		CLISP memory image data, other endian
11522
11523#.com and .bin for MIT scheme
115240	string	\372\372\372\372	MIT scheme (library?)
11525
11526# From: David Allouche <david@allouche.net>
115270	search/1	\<TeXmacs|	TeXmacs document text
11528!:mime	text/texmacs
11529
11530#------------------------------------------------------------------------------
11531# $File: llvm,v 1.8 2013/01/12 03:09:51 christos Exp $
11532# llvm:  file(1) magic for LLVM byte-codes
11533# URL:  http://llvm.org/docs/BitCodeFormat.html
11534# From: Al Stone <ahs3@fc.hp.com>
11535
115360	string	llvm	LLVM byte-codes, uncompressed
115370	string	llvc0	LLVM byte-codes, null compression
115380	string	llvc1	LLVM byte-codes, gzip compression
115390	string	llvc2	LLVM byte-codes, bzip2 compression
11540
115410	lelong	0x0b17c0de	LLVM bitcode, wrapper
11542# Are these Mach-O ABI values?  They appear to be.
11543>16	lelong	0x01000007	x86_64
11544>16	lelong	0x00000007	i386
11545>16	lelong	0x00000012	ppc
11546>16	lelong	0x01000012	ppc64
11547>16	lelong 	0x0000000c	arm
11548
115490	string	BC\xc0\xde	LLVM IR bitcode
11550
11551#------------------------------------------------------------------------------
11552# $File: lua,v 1.6 2013/01/09 16:23:17 christos Exp $
11553# lua:  file(1) magic for Lua scripting language
11554# URL:  http://www.lua.org/
11555# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
11556
11557# Lua scripts
115580	search/1/w	#!\ /usr/bin/lua	Lua script text executable
11559!:mime	text/x-lua
115600	search/1/w	#!\ /usr/local/bin/lua	Lua script text executable
11561!:mime	text/x-lua
115620	search/1	#!/usr/bin/env\ lua	Lua script text executable
11563!:mime	text/x-lua
115640	search/1	#!\ /usr/bin/env\ lua	Lua script text executable
11565!:mime	text/x-lua
11566
11567# Lua bytecode
115680	string		\033Lua			Lua bytecode,
11569>4	byte		0x50			version 5.0
11570>4	byte		0x51			version 5.1
11571>4	byte		0x52			version 5.2
11572
11573#------------------------------------------------------------------------------
11574# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $
11575# luks:  file(1) magic for Linux Unified Key Setup
11576# URL:	http://luks.endorphin.org/spec
11577# From:	Anthon van der Neut <anthon@mnt.org>
11578
115790	string		LUKS\xba\xbe	LUKS encrypted file,
11580>6	beshort		x		ver %d
11581>8	string		x		[%s,
11582>40	string		x		%s,
11583>72	string		x		%s]
11584>168	string		x		UUID: %s
11585#------------------------------------------------------------------------------
11586# $File: m4,v 1.1 2011/12/08 12:12:46 rrt Exp $
11587# make:  file(1) magic for M4 scripts
11588#
115890	regex	\^dnl\ 		M4 macro processor script text
11590!:mime	text/x-m4
11591
11592#------------------------------------------------------------
11593# $File: mach,v 1.17 2013/03/07 02:22:52 christos Exp $
11594# Mach has two magic numbers, 0xcafebabe and 0xfeedface.
11595# Unfortunately the first, cafebabe, is shared with
11596# Java ByteCode, so they are both handled in the file "cafebabe".
11597# The "feedface" ones are handled herein.
11598#------------------------------------------------------------
11599# if set, it's for the 64-bit version of the architecture
11600# yes, this is separate from the low-order magic number bit
11601# it's also separate from the "64-bit libraries" bit in the
11602# upper 8 bits of the CPU subtype
11603
116040	name	mach-o-cpu
11605>0	belong&0x01000000	0
11606#
11607# 32-bit ABIs.
11608#
11609#				1	vax
11610>>0	belong&0x00ffffff	1
11611>>>4		belong&0x00ffffff	0	vax
11612>>>4		belong&0x00ffffff	1	vax11/780
11613>>>4		belong&0x00ffffff	2	vax11/785
11614>>>4		belong&0x00ffffff	3	vax11/750
11615>>>4		belong&0x00ffffff	4	vax11/730
11616>>>4		belong&0x00ffffff	5	uvaxI
11617>>>4		belong&0x00ffffff	6	uvaxII
11618>>>4		belong&0x00ffffff	7	vax8200
11619>>>4		belong&0x00ffffff	8	vax8500
11620>>>4		belong&0x00ffffff	9	vax8600
11621>>>4		belong&0x00ffffff	10	vax8650
11622>>>4		belong&0x00ffffff	11	vax8800
11623>>>4		belong&0x00ffffff	12	uvaxIII
11624>>>4		belong&0x00ffffff	>12	vax subarchitecture=%ld
11625>>0	belong&0x00ffffff	2	romp
11626>>0	belong&0x00ffffff	3	architecture=3
11627>>0	belong&0x00ffffff	4	ns32032
11628>>0	belong&0x00ffffff	5	ns32332
11629>>0	belong&0x00ffffff	6	m68k
11630#				7	x86
11631>>0	belong&0x00ffffff	7
11632>>>4	belong&0x0000000f	3		i386
11633>>>4	belong&0x0000000f	4		i486
11634>>>>4	belong&0x00fffff0	0
11635>>>>4	belong&0x00fffff0	0x80		\bsx
11636>>>4	belong&0x0000000f	5		i586
11637>>>4	belong&0x0000000f	6
11638>>>>4	belong&0x00fffff0	0		p6
11639>>>>4	belong&0x00fffff0	0x10		pentium_pro
11640>>>>4	belong&0x00fffff0	0x20		pentium_2_m0x20
11641>>>>4	belong&0x00fffff0	0x30		pentium_2_m3
11642>>>>4	belong&0x00fffff0	0x40		pentium_2_m0x40
11643>>>>4	belong&0x00fffff0	0x50		pentium_2_m5
11644>>>>4	belong&0x00fffff0	>0x50		pentium_2_m0x%lx
11645>>>4	belong&0x0000000f	7		celeron
11646>>>>4	belong&0x00fffff0	0x00		\b_m0x%lx
11647>>>>4	belong&0x00fffff0	0x10		\b_m0x%lx
11648>>>>4	belong&0x00fffff0	0x20		\b_m0x%lx
11649>>>>4	belong&0x00fffff0	0x30		\b_m0x%lx
11650>>>>4	belong&0x00fffff0	0x40		\b_m0x%lx
11651>>>>4	belong&0x00fffff0	0x50		\b_m0x%lx
11652>>>>4	belong&0x00fffff0	0x60
11653>>>>4	belong&0x00fffff0	0x70		\b_mobile
11654>>>>4	belong&0x00fffff0	>0x70		\b_m0x%lx
11655>>>4	belong&0x0000000f	8		pentium_3
11656>>>>4	belong&0x00fffff0	0x00
11657>>>>4	belong&0x00fffff0	0x10		\b_m
11658>>>>4	belong&0x00fffff0	0x20		\b_xeon
11659>>>>4	belong&0x00fffff0	>0x20		\b_m0x%lx
11660>>>4	belong&0x0000000f	9		pentiumM
11661>>>>4	belong&0x00fffff0	0x00
11662>>>>4	belong&0x00fffff0	>0x00		\b_m0x%lx
11663>>>4	belong&0x0000000f	10		pentium_4
11664>>>>4	belong&0x00fffff0	0x00
11665>>>>4	belong&0x00fffff0	0x10		\b_m
11666>>>>4	belong&0x00fffff0	>0x10		\b_m0x%lx
11667>>>4	belong&0x0000000f	11		itanium
11668>>>>4	belong&0x00fffff0	0x00
11669>>>>4	belong&0x00fffff0	0x10		\b_2
11670>>>>4	belong&0x00fffff0	>0x10		\b_m0x%lx
11671>>>4	belong&0x0000000f	12		xeon
11672>>>>4	belong&0x00fffff0	0x00
11673>>>>4	belong&0x00fffff0	0x10		\b_mp
11674>>>>4	belong&0x00fffff0	>0x10		\b_m0x%lx
11675>>>4	belong&0x0000000f	>12		ia32 family=%ld
11676>>>>4	belong&0x00fffff0	0x00
11677>>>>4	belong&0x00fffff0	>0x00		model=%lx
11678>>0	belong&0x00ffffff	8	mips
11679>>>4		belong&0x00ffffff	1	R2300
11680>>>4		belong&0x00ffffff	2	R2600
11681>>>4		belong&0x00ffffff	3	R2800
11682>>>4		belong&0x00ffffff	4	R2000a
11683>>>4		belong&0x00ffffff	5	R2000
11684>>>4		belong&0x00ffffff	6	R3000a
11685>>>4		belong&0x00ffffff	7	R3000
11686>>>4		belong&0x00ffffff	>7	subarchitecture=%ld
11687>>0	belong&0x00ffffff	9	ns32532
11688>>0	belong&0x00ffffff	10	mc98000
11689>>0	belong&0x00ffffff	11	hppa
11690>>>4		belong&0x00ffffff	0	7100
11691>>>4		belong&0x00ffffff	1	7100LC
11692>>>4		belong&0x00ffffff	>1	subarchitecture=%ld
11693>>0	belong&0x00ffffff	12	arm
11694>>>4		belong&0x00ffffff	0
11695>>>4		belong&0x00ffffff	1	subarchitecture=%ld
11696>>>4		belong&0x00ffffff	2	subarchitecture=%ld
11697>>>4		belong&0x00ffffff	3	subarchitecture=%ld
11698>>>4		belong&0x00ffffff	4	subarchitecture=%ld
11699>>>4		belong&0x00ffffff	5	\b_v4t
11700>>>4		belong&0x00ffffff	6	\b_v6
11701>>>4		belong&0x00ffffff	7	\b_v5tej
11702>>>4		belong&0x00ffffff	8	\b_xscale
11703>>>4		belong&0x00ffffff	9	\b_v7
11704>>>4		belong&0x00ffffff	10	\b_v7f
11705>>>4		belong&0x00ffffff	11	subarchitecture=%ld
11706>>>4		belong&0x00ffffff	12	\b_v7k
11707>>>4		belong&0x00ffffff	>12	subarchitecture=%ld
11708#				13	m88k
11709>>0	belong&0x00ffffff	13
11710>>>4		belong&0x00ffffff	0	mc88000
11711>>>4		belong&0x00ffffff	1	mc88100
11712>>>4		belong&0x00ffffff	2	mc88110
11713>>>4		belong&0x00ffffff	>2	mc88000 subarchitecture=%ld
11714>>0	belong&0x00ffffff	14	sparc
11715>>0	belong&0x00ffffff	15	i860g
11716>>0	belong&0x00ffffff	16	alpha
11717>>0	belong&0x00ffffff	17	rs6000
11718>>0	belong&0x00ffffff	18	ppc
11719>>>4		belong&0x00ffffff	0
11720>>>4		belong&0x00ffffff	1	\b_601
11721>>>4		belong&0x00ffffff	2	\b_602
11722>>>4		belong&0x00ffffff	3	\b_603
11723>>>4		belong&0x00ffffff	4	\b_603e
11724>>>4		belong&0x00ffffff	5	\b_603ev
11725>>>4		belong&0x00ffffff	6	\b_604
11726>>>4		belong&0x00ffffff	7	\b_604e
11727>>>4		belong&0x00ffffff	8	\b_620
11728>>>4		belong&0x00ffffff	9	\b_650
11729>>>4		belong&0x00ffffff	10	\b_7400
11730>>>4		belong&0x00ffffff	11	\b_7450
11731>>>4		belong&0x00ffffff	100	\b_970
11732>>>4		belong&0x00ffffff	>100	subarchitecture=%ld
11733>>0	belong&0x00ffffff	>18	architecture=%ld
11734>0	belong&0x01000000	0x01000000
11735#
11736# 64-bit ABIs.
11737#
11738>>0	belong&0x00ffffff	0	64-bit architecture=%ld
11739>>0	belong&0x00ffffff	1	64-bit architecture=%ld
11740>>0	belong&0x00ffffff	2	64-bit architecture=%ld
11741>>0	belong&0x00ffffff	3	64-bit architecture=%ld
11742>>0	belong&0x00ffffff	4	64-bit architecture=%ld
11743>>0	belong&0x00ffffff	5	64-bit architecture=%ld
11744>>0	belong&0x00ffffff	6	64-bit architecture=%ld
11745>>0	belong&0x00ffffff	7	x86_64
11746>>>4		belong&0x00ffffff	0	subarchitecture=%ld
11747>>>4		belong&0x00ffffff	1	subarchitecture=%ld
11748>>>4		belong&0x00ffffff	2	subarchitecture=%ld
11749>>>4		belong&0x00ffffff	3
11750>>>4		belong&0x00ffffff	4	\b_arch1
11751>>>4		belong&0x00ffffff	>4	subarchitecture=%ld
11752>>0	belong&0x00ffffff	8	64-bit architecture=%ld
11753>>0	belong&0x00ffffff	9	64-bit architecture=%ld
11754>>0	belong&0x00ffffff	10	64-bit architecture=%ld
11755>>0	belong&0x00ffffff	11	64-bit architecture=%ld
11756>>0	belong&0x00ffffff	12	64-bit architecture=%ld
11757>>0	belong&0x00ffffff	13	64-bit architecture=%ld
11758>>0	belong&0x00ffffff	14	64-bit architecture=%ld
11759>>0	belong&0x00ffffff	15	64-bit architecture=%ld
11760>>0	belong&0x00ffffff	16	64-bit architecture=%ld
11761>>0	belong&0x00ffffff	17	64-bit architecture=%ld
11762>>0	belong&0x00ffffff	18	ppc64
11763>>>4		belong&0x00ffffff	0
11764>>>4		belong&0x00ffffff	1		\b_601
11765>>>4		belong&0x00ffffff	2		\b_602
11766>>>4		belong&0x00ffffff	3		\b_603
11767>>>4		belong&0x00ffffff	4		\b_603e
11768>>>4		belong&0x00ffffff	5		\b_603ev
11769>>>4		belong&0x00ffffff	6		\b_604
11770>>>4		belong&0x00ffffff	7		\b_604e
11771>>>4		belong&0x00ffffff	8		\b_620
11772>>>4		belong&0x00ffffff	9		\b_650
11773>>>4		belong&0x00ffffff	10		\b_7400
11774>>>4		belong&0x00ffffff	11		\b_7450
11775>>>4		belong&0x00ffffff	100		\b_970
11776>>>4		belong&0x00ffffff	>100		subarchitecture=%ld
11777>>0	belong&0x00ffffff	>18	64-bit architecture=%ld
11778
11779
117800	name		mach-o-be
11781>0	byte		0xcf		64-bit
11782>4	use		mach-o-cpu
11783>12	belong		1		object
11784>12	belong		2		executable
11785>12	belong		3		fixed virtual memory shared library
11786>12	belong		4		core
11787>12	belong		5		preload executable
11788>12	belong		6		dynamically linked shared library
11789>12	belong		7		dynamic linker
11790>12	belong		8		bundle
11791>12	belong		9		dynamically linked shared library stub
11792>12	belong		10		dSYM companion file
11793>12	belong		11		kext bundle
11794>12	belong		>11
11795>>12	belong		x		filetype=%ld
11796
11797#
117980	lelong&0xfffffffe	0xfeedface	Mach-O
11799!:strength +1
11800>0	use	\^mach-o-be
11801
118020	belong&0xfffffffe	0xfeedface	Mach-O
11803!:strength +1
11804>0	use	mach-o-be
11805
11806#------------------------------------------------------------------------------
11807# $File: macintosh,v 1.22 2011/05/17 17:40:31 rrt Exp $
11808# macintosh description
11809#
11810# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
11811# Daniel Quinlan, quinlan@yggdrasil.com
1181211	string	must\ be\ converted\ with\ BinHex	BinHex binary text
11813!:mime	application/mac-binhex40
11814>41	string	x					\b, version %.3s
11815
11816# Stuffit archives are the de facto standard of compression for Macintosh
11817# files obtained from most archives. (franklsm@tuns.ca)
118180	string		SIT!			StuffIt Archive (data)
11819!:mime	application/x-stuffit
11820!:apple	SIT!SIT!
11821>2	string		x			: %s
118220	string		SITD			StuffIt Deluxe (data)
11823>2	string		x			: %s
118240	string		Seg			StuffIt Deluxe Segment (data)
11825>2	string		x			: %s
11826
11827# Newer StuffIt archives (grant@netbsd.org)
118280	string		StuffIt			StuffIt Archive
11829!:mime	application/x-stuffit
11830!:apple	SIT!SIT!
11831#>162	string		>0			: %s
11832
11833# Macintosh Applications and Installation binaries (franklsm@tuns.ca)
11834# GRR: Too weak
11835#0	string		APPL			Macintosh Application (data)
11836#>2	string		x			\b: %s
11837
11838# Macintosh System files (franklsm@tuns.ca)
11839# GRR: Too weak
11840#0	string		zsys			Macintosh System File (data)
11841#0	string		FNDR			Macintosh Finder (data)
11842#0	string		libr			Macintosh Library (data)
11843#>2	string		x			: %s
11844#0	string		shlb			Macintosh Shared Library (data)
11845#>2	string		x			: %s
11846#0	string		cdev			Macintosh Control Panel (data)
11847#>2	string		x			: %s
11848#0	string		INIT			Macintosh Extension (data)
11849#>2	string		x			: %s
11850#0	string		FFIL			Macintosh Truetype Font (data)
11851#>2	string		x			: %s
11852#0	string		LWFN			Macintosh Postscript Font (data)
11853#>2	string		x			: %s
11854
11855# Additional Macintosh Files (franklsm@tuns.ca)
11856# GRR: Too weak
11857#0	string		PACT			Macintosh Compact Pro Archive (data)
11858#>2	string		x			: %s
11859#0	string		ttro			Macintosh TeachText File (data)
11860#>2	string		x			: %s
11861#0	string		TEXT			Macintosh TeachText File (data)
11862#>2	string		x			: %s
11863#0	string		PDF			Macintosh PDF File (data)
11864#>2	string		x			: %s
11865
11866# MacBinary format (Eric Fischer, enf@pobox.com)
11867#
11868# Unfortunately MacBinary doesn't really have a magic number prior
11869# to the MacBinary III format.  The checksum is really the way to
11870# do it, but the magic file format isn't up to the challenge.
11871#
11872# 0	byte		0
11873# 1	byte				# filename length
11874# 2	string				# filename
11875# 65    string				# file type
11876# 69	string				# file creator
11877# 73	byte				# Finder flags
11878# 74	byte		0
11879# 75	beshort				# vertical posn in window
11880# 77	beshort				# horiz posn in window
11881# 79	beshort				# window or folder ID
11882# 81    byte				# protected?
11883# 82	byte		0
11884# 83	belong				# length of data segment
11885# 87	belong				# length of resource segment
11886# 91	belong				# file creation date
11887# 95	belong				# file modification date
11888# 99	beshort				# length of comment after resource
11889# 101	byte				# new Finder flags
11890# 102	string		mBIN		# (only in MacBinary III)
11891# 106	byte				# char. code of file name
11892# 107	byte				# still more Finder flags
11893# 116	belong				# total file length
11894# 120	beshort				# length of add'l header
11895# 122	byte		129		# for MacBinary II
11896# 122	byte		130		# for MacBinary III
11897# 123	byte		129		# minimum version that can read fmt
11898# 124	beshort				# checksum
11899#
11900# This attempts to use the version numbers as a magic number, requiring
11901# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second
11902# be 0x81.  This works for the files I have, but maybe not for everyone's.
11903
11904# Unfortunately, this magic is quite weak - MPi
11905#122	beshort&0xFCFF	0x8081		Macintosh MacBinary data
11906
11907# MacBinary I doesn't have the version number field at all, but MacBinary II
11908# has been in use since 1987 so I hope there aren't many really old files
11909# floating around that this will miss.  The original spec calls for using
11910# the nulls in 0, 74, and 82 as the magic number.
11911#
11912# Another possibility, that would also work for MacBinary I, is to use
11913# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
11914# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
11915# and that 74 will be 0.  So something like
11916#
11917# 71 	belong&0x80804EFF 0x00000000 	Macintosh MacBinary data
11918#
11919# >73	byte&0x01	0x01		\b, inited
11920# >73	byte&0x02	0x02		\b, changed
11921# >73	byte&0x04	0x04		\b, busy
11922# >73	byte&0x08	0x08		\b, bozo
11923# >73	byte&0x10	0x10		\b, system
11924# >73	byte&0x10	0x20		\b, bundle
11925# >73	byte&0x10	0x40		\b, invisible
11926# >73	byte&0x10	0x80		\b, locked
11927
11928#>65	string		x		\b, type "%4.4s"
11929
11930#>65	string		8BIM		(PhotoShop)
11931#>65	string		ALB3		(PageMaker 3)
11932#>65	string		ALB4		(PageMaker 4)
11933#>65	string		ALT3		(PageMaker 3)
11934#>65	string		APPL		(application)
11935#>65	string		AWWP		(AppleWorks word processor)
11936#>65	string		CIRC		(simulated circuit)
11937#>65	string		DRWG		(MacDraw)
11938#>65	string		EPSF		(Encapsulated PostScript)
11939#>65	string		FFIL		(font suitcase)
11940#>65	string		FKEY		(function key)
11941#>65	string		FNDR		(Macintosh Finder)
11942#>65	string		GIFf		(GIF image)
11943#>65	string		Gzip		(GNU gzip)
11944#>65	string		INIT		(system extension)
11945#>65	string		LIB\ 		(library)
11946#>65	string		LWFN		(PostScript font)
11947#>65	string		MSBC		(Microsoft BASIC)
11948#>65	string		PACT		(Compact Pro archive)
11949#>65	string		PDF\ 		(Portable Document Format)
11950#>65	string		PICT		(picture)
11951#>65	string		PNTG		(MacPaint picture)
11952#>65	string		PREF		(preferences)
11953#>65	string		PROJ		(Think C project)
11954#>65	string		QPRJ		(Think Pascal project)
11955#>65	string		SCFL		(Defender scores)
11956#>65	string		SCRN		(startup screen)
11957#>65	string		SITD		(StuffIt Deluxe)
11958#>65	string		SPn3		(SuperPaint)
11959#>65	string		STAK		(HyperCard stack)
11960#>65	string		Seg\ 		(StuffIt segment)
11961#>65	string		TARF		(Unix tar archive)
11962#>65	string		TEXT		(ASCII)
11963#>65	string		TIFF		(TIFF image)
11964#>65	string		TOVF		(Eudora table of contents)
11965#>65	string		WDBN		(Microsoft Word word processor)
11966#>65	string		WORD		(MacWrite word processor)
11967#>65	string		XLS\ 		(Microsoft Excel)
11968#>65	string		ZIVM		(compress (.Z))
11969#>65	string		ZSYS		(Pre-System 7 system file)
11970#>65	string		acf3		(Aldus FreeHand)
11971#>65	string		cdev		(control panel)
11972#>65	string		dfil		(Desk Accessory suitcase)
11973#>65	string		libr		(library)
11974#>65	string		nX^d		(WriteNow word processor)
11975#>65	string		nX^w		(WriteNow dictionary)
11976#>65	string		rsrc		(resource)
11977#>65	string		scbk		(Scrapbook)
11978#>65	string		shlb		(shared library)
11979#>65	string		ttro		(SimpleText read-only)
11980#>65	string		zsys		(system file)
11981
11982#>69	string		x		\b, creator "%4.4s"
11983
11984# Somewhere, Apple has a repository of registered Creator IDs.  These are
11985# just the ones that I happened to have files from and was able to identify.
11986
11987#>69	string		8BIM		(Adobe Photoshop)
11988#>69	string		ALD3		(PageMaker 3)
11989#>69	string		ALD4		(PageMaker 4)
11990#>69	string		ALFA		(Alpha editor)
11991#>69	string		APLS		(Apple Scanner)
11992#>69	string		APSC		(Apple Scanner)
11993#>69	string		BRKL		(Brickles)
11994#>69	string		BTFT		(BitFont)
11995#>69	string		CCL2 		(Common Lisp 2)
11996#>69	string		CCL\ 		(Common Lisp)
11997#>69	string		CDmo		(The Talking Moose)
11998#>69	string		CPCT		(Compact Pro)
11999#>69	string		CSOm		(Eudora)
12000#>69	string		DMOV		(Font/DA Mover)
12001#>69	string		DSIM		(DigSim)
12002#>69	string		EDIT		(Macintosh Edit)
12003#>69	string		ERIK		(Macintosh Finder)
12004#>69	string		EXTR		(self-extracting archive)
12005#>69	string		Gzip		(GNU gzip)
12006#>69	string		KAHL		(Think C)
12007#>69	string		LWFU		(LaserWriter Utility)
12008#>69	string		LZIV		(compress)
12009#>69	string		MACA		(MacWrite)
12010#>69	string		MACS		(Macintosh operating system)
12011#>69	string		MAcK		(MacKnowledge terminal emulator)
12012#>69	string		MLND		(Defender)
12013#>69	string		MPNT		(MacPaint)
12014#>69	string		MSBB		(Microsoft BASIC (binary))
12015#>69	string		MSWD		(Microsoft Word)
12016#>69	string		NCSA		(NCSA Telnet)
12017#>69	string		PJMM		(Think Pascal)
12018#>69	string		PSAL		(Hunt the Wumpus)
12019#>69	string		PSI2		(Apple File Exchange)
12020#>69	string		R*ch		(BBEdit)
12021#>69	string		RMKR		(Resource Maker)
12022#>69	string		RSED		(Resource Editor)
12023#>69	string		Rich		(BBEdit)
12024#>69	string		SIT!		(StuffIt)
12025#>69	string		SPNT		(SuperPaint)
12026#>69	string		Unix		(NeXT Mac filesystem)
12027#>69	string		VIM!		(Vim editor)
12028#>69	string		WILD		(HyperCard)
12029#>69	string		XCEL		(Microsoft Excel)
12030#>69	string		aCa2		(Fontographer)
12031#>69	string		aca3		(Aldus FreeHand)
12032#>69	string		dosa		(Macintosh MS-DOS file system)
12033#>69	string		movr		(Font/DA Mover)
12034#>69	string		nX^n		(WriteNow)
12035#>69	string		pdos		(Apple ProDOS file system)
12036#>69	string		scbk		(Scrapbook)
12037#>69	string		ttxt		(SimpleText)
12038#>69	string		ufox		(Foreign File Access)
12039
12040# Just in case...
12041
12042102	string		mBIN		MacBinary III data with surprising version number
12043
12044# sas magic from Bruce Foster (bef@nwu.edu)
12045#
12046#0	string		SAS		SAS
12047#>8	string		x		%s
120480	string		SAS		SAS
12049>24	string		DATA		data file
12050>24	string		CATALOG		catalog
12051>24	string		INDEX		data file index
12052>24	string		VIEW		data view
12053# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
12054#
120550x54    string          SAS             SAS 7+
12056>0x9C   string          DATA            data file
12057>0x9C   string          CATALOG         catalog
12058>0x9C   string          INDEX           data file index
12059>0x9C   string          VIEW            data view
12060
12061# spss magic for SPSS system and portable files,
12062#	 from Bruce Foster (bef@nwu.edu).
12063
120640	long		0xc1e2c3c9	SPSS Portable File
12065>40	string 		x		%s
12066
120670	string		$FL2		SPSS System File
12068>24	string		x		%s
12069
12070# Macintosh filesystem data
12071# From "Tom N Harris" <telliamed@mac.com>
12072# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
12073# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
12074# entries depend on the data arithmetic added after v.35
12075# There's also some Pascal strings in here, ditto...
12076
12077# The boot block signature, according to IM:Files, is
12078# "for HFS volumes, this field always contains the value 0x4C4B."
12079# But if this is true for MFS or HFS+ volumes, I don't know.
12080# Alternatively, the boot block is supposed to be zeroed if it's
12081# unused, so a simply >0 should suffice.
12082
120830x400	beshort			0xD2D7		Macintosh MFS data
12084>0	beshort			0x4C4B		(bootable)
12085>0x40a	beshort			&0x8000		(locked)
12086>0x402	beldate-0x7C25B080	x		created: %s,
12087>0x406	beldate-0x7C25B080	>0		last backup: %s,
12088>0x414	belong			x		block size: %d,
12089>0x412	beshort			x		number of blocks: %d,
12090>0x424	pstring			x		volume name: %s
12091
12092# "BD" gives many false positives
12093#0x400	beshort			0x4244		Macintosh HFS data
12094#>0	beshort			0x4C4B		(bootable)
12095#>0x40a	beshort			&0x8000		(locked)
12096#>0x40a	beshort			^0x0100		(mounted)
12097#>0x40a	beshort			&0x0200		(spared blocks)
12098#>0x40a	beshort			&0x0800		(unclean)
12099#>0x47C	beshort			0x482B		(Embedded HFS+ Volume)
12100#>0x402	beldate-0x7C25B080	x		created: %s,
12101#>0x406	beldate-0x7C25B080	x		last modified: %s,
12102#>0x440	beldate-0x7C25B080	>0		last backup: %s,
12103#>0x414	belong			x		block size: %d,
12104#>0x412	beshort			x		number of blocks: %d,
12105#>0x424	pstring			x		volume name: %s
12106
121070x400	beshort			0x482B		Macintosh HFS Extended
12108>&0	beshort			x		version %d data
12109>0	beshort			0x4C4B		(bootable)
12110>0x404	belong			^0x00000100	(mounted)
12111>&2	belong			&0x00000200	(spared blocks)
12112>&2	belong			&0x00000800	(unclean)
12113>&2	belong			&0x00008000	(locked)
12114>&6	string			x		last mounted by: '%.4s',
12115# really, that should be treated as a belong and we print a string
12116# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
12117>&14	beldate-0x7C25B080	x		created: %s,
12118# only the creation date is local time, all other timestamps in HFS+ are UTC.
12119>&18	bedate-0x7C25B080	x		last modified: %s,
12120>&22	bedate-0x7C25B080	>0		last backup: %s,
12121>&26	bedate-0x7C25B080	>0		last checked: %s,
12122>&38	belong			x		block size: %d,
12123>&42	belong			x		number of blocks: %d,
12124>&46	belong			x		free blocks: %d
12125
12126# I don't think this is really necessary since it doesn't do much and
12127# anything with a valid driver descriptor will also have a valid
12128# partition map
12129#0		beshort		0x4552		Apple Device Driver data
12130#>&24		beshort		=1		\b, MacOS
12131
12132# Is that the partition type a cstring or a pstring? Well, IM says "strings
12133# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a
12134# cstring. Of course, partitions can contain more than four entries, but
12135# what're you gonna do?
12136# GRR: This magic is too weak, it is just "PM"
12137#0x200		beshort		0x504D		Apple Partition data
12138#>0x2		beshort		x		(block size: %d):
12139#>0x230		string		x		first type: %s,
12140#>0x210		string		x		name: %s,
12141#>0x254		belong		x		number of blocks: %d,
12142#>0x400		beshort		0x504D
12143#>>0x430		string		x		second type: %s,
12144#>>0x410		string		x		name: %s,
12145#>>0x454		belong		x		number of blocks: %d,
12146#>>0x600		beshort		0x504D
12147#>>>0x630	string		x		third type: %s,
12148#>>>0x610	string		x		name: %s,
12149#>>>0x654	belong		x		number of blocks: %d,
12150#>>0x800		beshort		0x504D
12151#>>>0x830	string		x		fourth type: %s,
12152#>>>0x810	string		x		name: %s,
12153#>>>0x854	belong		x		number of blocks: %d,
12154#>>>0xa00	beshort		0x504D
12155#>>>>0xa30	string		x		fifth type: %s,
12156#>>>>0xa10	string		x		name: %s,
12157#>>>>0xa54	belong		x		number of blocks: %d
12158#>>>0xc00	beshort		0x504D
12159#>>>>0xc30	string		x		sixth type: %s,
12160#>>>>0xc10	string		x		name: %s,
12161#>>>>0xc54	belong		x		number of blocks: %d
12162## AFAIK, only the signature is different
12163#0x200		beshort		0x5453		Apple Old Partition data
12164#>0x2		beshort		x		block size: %d,
12165#>0x230		string		x		first type: %s,
12166#>0x210		string		x		name: %s,
12167#>0x254		belong		x		number of blocks: %d,
12168#>0x400		beshort		0x504D
12169#>>0x430		string		x		second type: %s,
12170#>>0x410		string		x		name: %s,
12171#>>0x454		belong		x		number of blocks: %d,
12172#>>0x800		beshort		0x504D
12173#>>>0x830	string		x		third type: %s,
12174#>>>0x810	string		x		name: %s,
12175#>>>0x854	belong		x		number of blocks: %d,
12176#>>>0xa00	beshort		0x504D
12177#>>>>0xa30	string		x		fourth type: %s,
12178#>>>>0xa10	string		x		name: %s,
12179#>>>>0xa54	belong		x		number of blocks: %d
12180
12181# From: Remi Mommsen <mommsen@slac.stanford.edu>
121820		string		BOMStore	Mac OS X bill of materials (BOM) file
12183
12184# From: Adam Buchbinder <adam.buchbinder@gmail.com>
12185# URL: http://en.wikipedia.org/wiki/Datafork_TrueType
12186# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
12187# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
12188# don't know what they mean.
121890	belong	0x100
12190>(0x4.L+24)	beshort	x
12191>>&4	belong	0x73666e74	Mac OSX datafork font, TrueType
12192>>&4	belong	0x464f4e54	Mac OSX datafork font, 'FONT'
12193>>&4	belong	0x4e464e54	Mac OSX datafork font, 'NFNT'
12194>>&4	belong	0x504f5354	Mac OSX datafork font, PostScript
12195
12196#------------------------------------------------------------------------------
12197# $File: macos,v 1.1 2012/12/21 16:41:07 christos Exp $
12198# MacOS files
12199#
12200
122010	string		book\0\0\0\0mark\0\0\0\0	MacOS Alias file
12202
12203#------------------------------------------------------------------------------
12204# $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $
12205# magic:  file(1) magic for magic files
12206#
122070	string/t		#\ Magic	magic text file for file(1) cmd
122080	lelong		0xF11E041C	magic binary file for file(1) cmd
12209>4	lelong		x		(version %d) (little endian)
122100	belong		0xF11E041C	magic binary file for file(1) cmd
12211>4	belong		x		(version %d) (big endian)
12212#------------------------------------------------------------------------------
12213# $File: mail.news,v 1.22 2013/01/04 14:22:07 christos Exp $
12214# mail.news:  file(1) magic for mail and news
12215#
12216# Unfortunately, saved netnews also has From line added in some news software.
12217#0	string		From 		mail text
122180	string/t		Relay-Version: 	old news text
12219!:mime	message/rfc822
122200	string/t		#!\ rnews	batched news text
12221!:mime	message/rfc822
122220	string/t		N#!\ rnews	mailed, batched news text
12223!:mime	message/rfc822
122240	string/t		Forward\ to 	mail forwarding text
12225!:mime	message/rfc822
122260	string/t		Pipe\ to 	mail piping text
12227!:mime	message/rfc822
122280	string/tc		delivered-to:	SMTP mail text
12229!:mime	message/rfc822
122300	string/tc		return-path:	SMTP mail text
12231!:mime	message/rfc822
122320	string/t		Path:		news text
12233!:mime	message/news
122340	string/t		Xref:		news text
12235!:mime	message/news
122360	string/t		From:		news or mail text
12237!:mime	message/rfc822
122380	string/t		Article 	saved news text
12239!:mime	message/news
122400	string/t		BABYL		Emacs RMAIL text
122410	string/t		Received:	RFC 822 mail text
12242!:mime	message/rfc822
122430	string/t		MIME-Version:	MIME entity text
12244#0	string/t		Content-	MIME entity text
12245
12246# TNEF files...
122470	lelong		0x223E9F78	Transport Neutral Encapsulation Format
12248!:mime	application/vnd.ms-tnef
12249
12250# From: Kevin Sullivan <ksulliva@psc.edu>
122510	string		*mbx*		MBX mail folder
12252
12253# From: Simon Matter <simon.matter@invoca.ch>
122540	string		\241\002\213\015skiplist\ file\0\0\0	Cyrus skiplist DB
12255
12256# JAM(mbp) Fidonet message area databases
12257# JHR file
122580	string	JAM\0			JAM message area header file
12259>12	leshort >0			(%d messages)
12260
12261# Squish Fidonet message area databases
12262# SQD file (requires at least one message in the area)
12263# XXX: Weak magic
12264#256	leshort	0xAFAE4453		Squish message area data file
12265#>4	leshort	>0			(%d messages)
12266
12267#0	string		\<!--\ MHonArc		text/html; x-type=mhonarc
12268
12269# Cyrus: file(1) magic for compiled Cyrus sieve scripts
12270# URL: http://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php
12271# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master
12272# From: Philipp Hahn <hahn@univention.de>
12273
12274# Compiled Cyrus sieve script
122750       string CyrSBytecode     Cyrus sieve bytecode data,
12276>12     belong =1       version 1, big-endian
12277>12     lelong =1       version 1, little-endian
12278>12     belong x        version %d, network-endian
12279#------------------------------------------------------------------------------
12280# $File: make,v 1.1 2011/12/08 12:12:46 rrt Exp $
12281# make:  file(1) magic for makefiles
12282#
122830	regex	\^CFLAGS	makefile script text
12284!:mime	text/x-makefile
122850	regex	\^LDFLAGS	makefile script text
12286!:mime	text/x-makefile
122870	regex	\^all:	makefile script text
12288!:mime	text/x-makefile
122890	regex	\^.PRECIOUS	makefile script text
12290!:mime	text/x-makefile
12291
122920	regex	\^SUBDIRS	automake makefile script text
12293!:mime	text/x-makefile
12294
12295#------------------------------------------------------------------------------
12296# $File: maple,v 1.7 2013/01/11 16:45:23 christos Exp $
12297# maple:  file(1) magic for maple files
12298# "H. Nanosecond" <aldomel@ix.netcom.com>
12299# Maple V release 4, a multi-purpose math program
12300#
12301
12302# maple library .lib
123030	string	\000MVR4\nI	MapleVr4 library
12304
12305# .ind
12306# no magic for these :-(
12307# they are compiled indexes for maple files
12308
12309# .hdb
123100	string	\000\004\000\000	Maple help database
12311
12312# .mhp
12313# this has the form <PACKAGE=name>
123140	string	\<PACKAGE=	Maple help file
123150	string	\<HELP\ NAME=	Maple help file
123160	string	\n\<HELP\ NAME=	Maple help file with extra carriage return at start (yuck)
12317#0	string	#\ Newton	Maple help file, old style
123180	string	#\ daub	Maple help file, old style
12319#0	string	#===========	Maple help file, old style
12320
12321# .mws
123220	string	\000\000\001\044\000\221	Maple worksheet
12323#this is anomalous
123240	string	WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000	Maple worksheet, but weird
12325# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n
12326# that is {VERSION major_version miunor_version computer_type version_string}
123270	string	{VERSION\ 	Maple worksheet
12328>9	string	>\0	version %.1s.
12329>>11	string	>\0	%.1s
12330
12331# .mps
123320	string	\0\0\001$	Maple something
12333# from byte 4 it is either 'nul E' or 'soh R'
12334# I think 'nul E' means a file that was saved as  a different name
12335# a sort of revision marking
12336# 'soh R' means new
12337>4	string	\000\105	An old revision
12338>4	string	\001\122	The latest save
12339
12340# .mpl
12341# some of these are the same as .mps above
12342#0000000 000 000 001 044 000 105 same as .mps
12343#0000000 000 000 001 044 001 122 same as .mps
12344
123450	string	#\n##\ <SHAREFILE=	Maple something
123460	string	\n#\n##\ <SHAREFILE=	Maple something
123470	string	##\ <SHAREFILE=	Maple something
123480	string	#\r##\ <SHAREFILE=	Maple something
123490	string	\r#\r##\ <SHAREFILE=	Maple something
123500	string	#\ \r##\ <DESCRIBE>	Maple something anomalous.
12351#--------------------------------------------
12352# marc21: file(1) magic for MARC 21 Format
12353#
12354# Kevin Ford (kefo@loc.gov)
12355#
12356# MARC21 formats are for the representation and communication
12357# of bibliographic and related information in machine-readable
12358# form.  For more info, see http://www.loc.gov/marc/
12359
12360
12361# leader position 20-21 must be 45
1236220	string	45
12363
12364# leader starts with 5 digits, followed by codes specific to MARC format
12365>0	regex/1	(^[0-9]{5})[acdnp][^bhlnqsu-z]	MARC21 Bibliographic
12366!:mime	application/marc
12367>0	regex/1	(^[0-9]{5})[acdnosx][z]	MARC21 Authority
12368!:mime	application/marc
12369>0	regex/1	(^[0-9]{5})[cdn][uvxy]	MARC21 Holdings
12370!:mime	application/marc
123710	regex/1	(^[0-9]{5})[acdn][w]	MARC21 Classification
12372!:mime	application/marc
12373>0	regex/1	(^[0-9]{5})[cdn][q]	MARC21 Community
12374!:mime	application/marc
12375
12376# leader position 22-23, should be "00" but is it?
12377>0	regex/1	(^.{21})([^0]{2})	(non-conforming)
12378!:mime	application/marc
12379
12380#------------------------------------------------------------------------------
12381# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $
12382# mathcad:  file(1) magic for Mathcad documents
12383# URL:	http://www.mathsoft.com/
12384# From:	Josh Triplett <josh@freedesktop.org>
12385
123860	string	.MCAD\t		Mathcad document
12387
12388#------------------------------------------------------------------------------
12389# $File: mathematica,v 1.7 2009/09/19 16:28:10 christos Exp $
12390# mathematica:  file(1) magic for mathematica files
12391# "H. Nanosecond" <aldomel@ix.netcom.com>
12392# Mathematica a multi-purpose math program
12393# versions 2.2 and 3.0
12394
12395#mathematica .mb
123960	string	\064\024\012\000\035\000\000\000	Mathematica version 2 notebook
123970	string	\064\024\011\000\035\000\000\000	Mathematica version 2 notebook
12398
12399# .ma
12400# multiple possibilites:
12401
124020	string	(*^\n\n::[\011frontEndVersion\ =\ 	Mathematica notebook
12403#>41	string	>\0	%s
12404
12405#0	string	(*^\n\n::[\011palette	Mathematica notebook version 2.x
12406
12407#0	string	(*^\n\n::[\011Information	Mathematica notebook version 2.x
12408#>675	string	>\0	%s #doesn't work well
12409
12410# there may be 'cr' instread of 'nl' in some does this matter?
12411
12412# generic:
124130	string	(*^\r\r::[\011	Mathematica notebook version 2.x
124140	string	(*^\r\n\r\n::[\011	Mathematica notebook version 2.x
124150	string	(*^\015			Mathematica notebook version 2.x
124160	string	(*^\n\r\n\r::[\011	Mathematica notebook version 2.x
124170	string	(*^\r::[\011	Mathematica notebook version 2.x
124180	string	(*^\r\n::[\011	Mathematica notebook version 2.x
124190	string	(*^\n\n::[\011	Mathematica notebook version 2.x
124200	string	(*^\n::[\011	Mathematica notebook version 2.x
12421
12422
12423# Mathematica .mx files
12424
12425#0	string	(*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*)	Mathematica binary file
124260	string	(*This\ is\ a\ Mathematica\ binary\ 	Mathematica binary file
12427#>71	string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
12428# >71... is optional
12429>88	string	>\0	from %s
12430
12431
12432# Mathematica files PBF:
12433# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000
124340	string	MMAPBF\000\001\000\000\000\203\000\001\000	Mathematica PBF (fonts I think)
12435
12436# .ml files  These are menu resources I think
12437# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
12438# how to put that into a magic rule?
124394	string	\ A~	MAthematica .ml file
12440
12441# .nb files
12442#too long 0	string	(***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook	Mathematica 3.0 notebook
124430	string	(***********************	Mathematica 3.0 notebook
12444
12445# other (* matches it is a comment start in these langs
12446# GRR: Too weak; also matches other languages e.g. ML
12447#0	string	(*	Mathematica, or Pascal, Modula-2 or 3 code text
12448
12449#########################
12450# MatLab v5
124510       string  MATLAB  Matlab v5 mat-file
12452>126    short   0x494d  (big endian)
12453>>124   beshort x       version 0x%04x
12454>126    short   0x4d49  (little endian)
12455>>124   leshort x       version 0x%04x
12456
12457
12458#------------------------------------------------------------------------------
12459# $File: matroska,v 1.8 2013/02/08 17:25:16 christos Exp $
12460# matroska:  file(1) magic for Matroska files
12461#
12462# See http://www.matroska.org/
12463#
12464
12465# EBML id:
124660		belong		0x1a45dfa3
12467# DocType id:
12468>4		search/4096 	\x42\x82
12469# DocType contents:
12470>>&1		string		webm		WebM
12471!:mime  video/webm
12472>>&1		string		matroska	Matroska data
12473!:mime  video/x-matroska
12474
12475#------------------------------------------------------------------------------
12476# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $
12477# Mavroyanopoulos Nikos <nmav@hellug.gr>
12478# mcrypt:   file(1) magic for mcrypt 2.2.x;
124790	string		\0m\3		mcrypt 2.5 encrypted data,
12480>4	string		>\0		algorithm: %s,
12481>>&1	leshort		>0		keysize: %d bytes,
12482>>>&0	string		>\0		mode: %s,
12483
124840	string		\0m\2		mcrypt 2.2 encrypted data,
12485>3	byte		0		algorithm: blowfish-448,
12486>3	byte		1		algorithm: DES,
12487>3	byte		2		algorithm: 3DES,
12488>3	byte		3		algorithm: 3-WAY,
12489>3	byte		4		algorithm: GOST,
12490>3	byte		6		algorithm: SAFER-SK64,
12491>3	byte		7		algorithm: SAFER-SK128,
12492>3	byte		8		algorithm: CAST-128,
12493>3	byte		9		algorithm: xTEA,
12494>3	byte		10		algorithm: TWOFISH-128,
12495>3	byte		11		algorithm: RC2,
12496>3	byte		12		algorithm: TWOFISH-192,
12497>3	byte		13		algorithm: TWOFISH-256,
12498>3	byte		14		algorithm: blowfish-128,
12499>3	byte		15		algorithm: blowfish-192,
12500>3	byte		16		algorithm: blowfish-256,
12501>3	byte		100		algorithm: RC6,
12502>3	byte		101		algorithm: IDEA,
12503>4	byte		0		mode: CBC,
12504>4	byte		1		mode: ECB,
12505>4	byte		2		mode: CFB,
12506>4	byte		3		mode: OFB,
12507>4	byte		4		mode: nOFB,
12508>5	byte		0		keymode: 8bit
12509>5	byte		1		keymode: 4bit
12510>5	byte		2		keymode: SHA-1 hash
12511>5	byte		3		keymode: MD5 hash
12512
12513#------------------------------------------------------------------------------
12514# $File: mercurial,v 1.4 2009/09/19 16:28:10 christos Exp $
12515# mercurial:  file(1) magic for Mercurial changeset bundles
12516# http://www.selenic.com/mercurial/wiki/
12517#
12518# Jesse Glick (jesse.glick@sun.com)
12519#
12520
125210	string		HG10		Mercurial changeset bundle
12522>4	string		UN		(uncompressed)
12523>4	string		GZ		(gzip compressed)
12524>4	string		BZ		(bzip2 compressed)
12525
12526#------------------------------------------------------------------------------
12527# $File: metastore,v 1.1 2011/04/06 12:37:44 christos Exp $
12528# metastore:  file(1) magic for metastore files
12529# From: Thomas Wissen
12530# see http://david.hardeman.nu/software.php#metastore
125310	string		MeTaSt00r3	Metastore data file,
12532>10	bequad		x		version %0llx
12533
12534#------------------------------------------------------------------------------
12535# $File: mime,v 1.6 2010/11/25 15:00:12 christos Exp $
12536# mime:  file(1) magic for MIME encoded files
12537#
125380	string/t		Content-Type:\
12539>14	string		>\0		%s
125400	string/t		Content-Type:
12541>13	string		>\0		%s
12542
12543#------------------------------------------------------------------------------
12544# $File: mips,v 1.9 2013/01/12 03:09:51 christos Exp $
12545# mips:  file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX
12546# and DEC Ultrix
12547#
125480	beshort	0x0160		MIPSEB ECOFF executable
12549>20	beshort	0407		(impure)
12550>20	beshort	0410		(swapped)
12551>20	beshort	0413		(paged)
12552>8	belong	>0		not stripped
12553>8	belong	0		stripped
12554>22	byte	x		- version %ld
12555>23	byte	x		\b.%ld
12556#
125570	beshort	0x0162		MIPSEL-BE ECOFF executable
12558>20	beshort	0407		(impure)
12559>20	beshort	0410		(swapped)
12560>20	beshort	0413		(paged)
12561>8	belong	>0		not stripped
12562>8	belong	0		stripped
12563>23	byte	x		- version %d
12564>22	byte	x		\b.%ld
12565#
125660	beshort	0x6001		MIPSEB-LE ECOFF executable
12567>20	beshort	03401		(impure)
12568>20	beshort	04001		(swapped)
12569>20	beshort	05401		(paged)
12570>8	belong	>0		not stripped
12571>8	belong	0		stripped
12572>23	byte	x		- version %d
12573>22	byte	x		\b.%ld
12574#
125750	beshort	0x6201		MIPSEL ECOFF executable
12576>20	beshort	03401		(impure)
12577>20	beshort	04001		(swapped)
12578>20	beshort	05401		(paged)
12579>8	belong	>0		not stripped
12580>8	belong	0		stripped
12581>23	byte	x		- version %ld
12582>22	byte	x		\b.%ld
12583#
12584# MIPS 2 additions
12585#
125860	beshort	0x0163		MIPSEB MIPS-II ECOFF executable
12587>20	beshort	0407		(impure)
12588>20	beshort	0410		(swapped)
12589>20	beshort	0413		(paged)
12590>8	belong	>0		not stripped
12591>8	belong	0		stripped
12592>22	byte	x		- version %ld
12593>23	byte	x		\b.%ld
12594#
125950	beshort	0x0166		MIPSEL-BE MIPS-II ECOFF executable
12596>20	beshort	0407		(impure)
12597>20	beshort	0410		(swapped)
12598>20	beshort	0413		(paged)
12599>8	belong	>0		not stripped
12600>8	belong	0		stripped
12601>22	byte	x		- version %ld
12602>23	byte	x		\b.%ld
12603#
126040	beshort	0x6301		MIPSEB-LE MIPS-II ECOFF executable
12605>20	beshort	03401		(impure)
12606>20	beshort	04001		(swapped)
12607>20	beshort	05401		(paged)
12608>8	belong	>0		not stripped
12609>8	belong	0		stripped
12610>23	byte	x		- version %ld
12611>22	byte	x		\b.%ld
12612#
126130	beshort	0x6601		MIPSEL MIPS-II ECOFF executable
12614>20	beshort	03401		(impure)
12615>20	beshort	04001		(swapped)
12616>20	beshort	05401		(paged)
12617>8	belong	>0		not stripped
12618>8	belong	0		stripped
12619>23	byte	x		- version %ld
12620>22	byte	x		\b.%ld
12621#
12622# MIPS 3 additions
12623#
126240	beshort	0x0140		MIPSEB MIPS-III ECOFF executable
12625>20	beshort	0407		(impure)
12626>20	beshort	0410		(swapped)
12627>20	beshort	0413		(paged)
12628>8	belong	>0		not stripped
12629>8	belong	0		stripped
12630>22	byte	x		- version %ld
12631>23	byte	x		\b.%ld
12632#
126330	beshort	0x0142		MIPSEL-BE MIPS-III ECOFF executable
12634>20	beshort	0407		(impure)
12635>20	beshort	0410		(swapped)
12636>20	beshort	0413		(paged)
12637>8	belong	>0		not stripped
12638>8	belong	0		stripped
12639>22	byte	x		- version %ld
12640>23	byte	x		\b.%ld
12641#
126420	beshort	0x4001		MIPSEB-LE MIPS-III ECOFF executable
12643>20	beshort	03401		(impure)
12644>20	beshort	04001		(swapped)
12645>20	beshort	05401		(paged)
12646>8	belong	>0		not stripped
12647>8	belong	0		stripped
12648>23	byte	x		- version %ld
12649>22	byte	x		\b.%ld
12650#
126510	beshort	0x4201		MIPSEL MIPS-III ECOFF executable
12652>20	beshort	03401		(impure)
12653>20	beshort	04001		(swapped)
12654>20	beshort	05401		(paged)
12655>8	belong	>0		not stripped
12656>8	belong	0		stripped
12657>23	byte	x		- version %ld
12658>22	byte	x		\b.%ld
12659#
126600	beshort	0x180		MIPSEB Ucode
126610	beshort	0x182		MIPSEL-BE Ucode
12662
12663#------------------------------------------------------------------------------
12664# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $
12665# mirage:  file(1) magic for Mirage executables
12666#
12667# XXX - byte order?
12668#
126690	long	31415		Mirage Assembler m.out executable
12670
12671#-----------------------------------------------------------------------------
12672# $File: misctools,v 1.13 2013/01/16 13:53:10 christos Exp $
12673# misctools:  file(1) magic for miscellaneous UNIX tools.
12674#
126750	search/1	%%!!			X-Post-It-Note text
126760	string/c	BEGIN:VCALENDAR		vCalendar calendar file
12677!:mime	text/calendar
126780	string/c	BEGIN:VCARD		vCard visiting card
12679!:mime	text/x-vcard
12680
12681# Summary: Libtool library file
12682# Extension: .la
12683# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl>
126840	search/80	.la\ -\ a\ libtool\ library\ file	libtool library file
12685
12686# Summary: Libtool object file
12687# Extension: .lo
12688# Submitted by: Abel Cheung <abelcheung@gmail.com>
126890	search/80	.lo\ -\ a\ libtool\ object\ file	libtool object file
12690
12691# From: Daniel Novotny <dnovotny@redhat.com>
126920	string		MDMP\x93\xA7				MDMP crash report data
12693
12694#------------------------------------------------------------------------------
12695# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $
12696# mkid:  file(1) magic for mkid(1) databases
12697#
12698# ID is the binary tags database produced by mkid(1).
12699#
12700# XXX - byte order?
12701#
127020	string		\311\304	ID tags data
12703>2	short		>0		version %d
12704
12705#------------------------------------------------------------------------------
12706# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $
12707# mlssa: file(1) magic for MLSSA datafiles
12708#
127090		lelong		0xffffabcd	MLSSA datafile,
12710>4		leshort		x		algorithm %d,
12711>10		lelong		x		%d samples
12712
12713#------------------------------------------------------------------------------
12714# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $
12715# mmdf:  file(1) magic for MMDF mail files
12716#
127170	string	\001\001\001\001	MMDF mailbox
12718
12719#------------------------------------------------------------------------------
12720# $File: modem,v 1.5 2010/09/20 18:55:20 rrt Exp $
12721# modem:  file(1) magic for modem programs
12722#
12723# From: Florian La Roche <florian@knorke.saar.de>
127241	string		PC\ Research,\ Inc	Digifax-G3-File
12725>29	byte		1			\b, fine resolution
12726>29	byte		0			\b, normal resolution
12727
127280	short		0x0100		raw G3 data, byte-padded
127290	short		0x1400		raw G3 data
12730#
12731# Magic data for vgetty voice formats
12732# (Martin Seine & Marc Eberhard)
12733
12734#
12735# raw modem data version 1
12736#
127370    string    RMD1      raw modem data
12738>4   string    >\0       (%s /
12739>20  short     >0        compression type 0x%04x)
12740
12741#
12742# portable voice format 1
12743#
127440    string    PVF1\n         portable voice format
12745>5   string    >\0       (binary %s)
12746
12747#
12748# portable voice format 2
12749#
127500    string    PVF2\n         portable voice format
12751>5   string >\0          (ascii %s)
12752
12753
12754#------------------------------------------------------------------------------
12755# $File: motorola,v 1.10 2009/09/19 16:28:11 christos Exp $
12756# motorola:  file(1) magic for Motorola 68K and 88K binaries
12757#
12758# 68K
12759#
127600	beshort		0520		mc68k COFF
12761>18	beshort		^00000020	object
12762>18	beshort		&00000020	executable
12763>12	belong		>0		not stripped
12764>168	string		.lowmem		Apple toolbox
12765>20	beshort		0407		(impure)
12766>20	beshort		0410		(pure)
12767>20	beshort		0413		(demand paged)
12768>20	beshort		0421		(standalone)
127690	beshort		0521		mc68k executable (shared)
12770>12	belong		>0		not stripped
127710	beshort		0522		mc68k executable (shared demand paged)
12772>12	belong		>0		not stripped
12773#
12774# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
12775#
127760	beshort		0554		68K BCS executable
12777#
12778# 88K
12779#
12780# Motorola/88Open BCS
12781#
127820	beshort		0555		88K BCS executable
12783#
12784# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
127850   string      S0          Motorola S-Record; binary data in text format
12786
12787# ATARI ST relocatable PRG
12788#
12789# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001
12790# (according to Roland Waldi, Oct 21, 1987)
12791# besides the magic 0x601a, the text segment size is checked to be
12792# not larger than 1 MB (which is a lot on ST).
12793# The additional 0x601b distinction I took from Doug Lee's magic.
127940	belong&0xFFFFFFF0	0x601A0000	Atari ST M68K contiguous executable
12795>2	belong			x		(txt=%ld,
12796>6	belong			x		dat=%ld,
12797>10	belong			x		bss=%ld,
12798>14	belong			x		sym=%ld)
127990	belong&0xFFFFFFF0	0x601B0000	Atari ST M68K non-contig executable
12800>2	belong			x		(txt=%ld,
12801>6	belong			x		dat=%ld,
12802>10	belong			x		bss=%ld,
12803>14	belong			x		sym=%ld)
12804
12805# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>)
128060       beshort         0x601A          Atari 68xxx executable,
12807>2      belong          x               text len %lu,
12808>6      belong          x               data len %lu,
12809>10     belong          x               BSS len %lu,
12810>14     belong          x               symboltab len %lu,
12811>18     belong          0
12812>22     belong          &0x01           fastload flag,
12813>22     belong          &0x02           may be loaded to alternate RAM,
12814>22     belong          &0x04           malloc may be from alternate RAM,
12815>22     belong          x               flags: 0x%lX,
12816>26     beshort         0               no relocation tab
12817>26     beshort         !0              + relocation tab
12818>30     string          SFX             [Self-Extracting LZH SFX archive]
12819>38     string          SFX             [Self-Extracting LZH SFX archive]
12820>44     string          ZIP!            [Self-Extracting ZIP SFX archive]
12821
128220       beshort         0x0064          Atari 68xxx CPX file
12823>8      beshort         x               (version %04lx)
12824
12825#------------------------------------------------------------------------------
12826# $File: mozilla,v 1.4 2009/09/19 16:28:11 christos Exp $
12827# mozilla:  file(1) magic for Mozilla XUL fastload files
12828# (XUL.mfasl and XPC.mfasl)
12829# URL:	http://www.mozilla.org/
12830# From:	Josh Triplett <josh@freedesktop.org>
12831
128320	string	XPCOM\nMozFASL\r\n\x1A		Mozilla XUL fastload data
12833
12834#------------------------------------------------------------------------------
12835# $File: msdos,v 1.85 2013/03/09 22:36:00 christos Exp $
12836# msdos:  file(1) magic for MS-DOS files
12837#
12838
12839# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
12840# updated by Joerg Jenderek at Oct 2008,Apr 2011
128410	string/t	@
12842>1	string/cW	\ echo\ off	DOS batch file text
12843!:mime	text/x-msdos-batch
12844>1	string/cW	echo\ off	DOS batch file text
12845!:mime	text/x-msdos-batch
12846>1	string/cW	rem		DOS batch file text
12847!:mime	text/x-msdos-batch
12848>1	string/cW	set\ 		DOS batch file text
12849!:mime	text/x-msdos-batch
12850
12851
12852# OS/2 batch files are REXX. the second regex is a bit generic, oh well
12853# the matched commands seem to be common in REXX and uncommon elsewhere
12854100	search/0xffff   rxfuncadd
12855>100	regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc	OS/2 REXX batch file text
12856100	search/0xffff   say
12857>100	regex/c =^[\ \t]{0,10}say\ ['"]			OS/2 REXX batch file text
12858
128590	leshort		0x14c	MS Windows COFF Intel 80386 object file
12860#>4	ledate		x	stamp %s
128610	leshort		0x166	MS Windows COFF MIPS R4000 object file
12862#>4	ledate		x	stamp %s
128630	leshort		0x184	MS Windows COFF Alpha object file
12864#>4	ledate		x	stamp %s
128650	leshort		0x268	MS Windows COFF Motorola 68000 object file
12866#>4	ledate		x	stamp %s
128670	leshort		0x1f0	MS Windows COFF PowerPC object file
12868#>4	ledate		x	stamp %s
128690	leshort		0x290	MS Windows COFF PA-RISC object file
12870#>4	ledate		x	stamp %s
12871
12872# Tests for various EXE types.
12873#
12874# Many of the compressed formats were extraced from IDARC 1.23 source code.
12875#
128760	string/b	MZ
12877!:mime	application/x-dosexec
12878# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file.
12879>0x18	leshort <0x40 MS-DOS executable
12880# These traditional tests usually work but not always.  When test quality support is
12881# implemented these can be turned on.
12882#>>0x18	leshort	0x1c	(Borland compiler)
12883#>>0x18	leshort	0x1e	(MS compiler)
12884
12885# If the relocation table is 0x40 or more bytes into the file, it's definitely
12886# not a DOS EXE.
12887>0x18  leshort >0x3f
12888
12889# Maybe it's a PE?
12890>>(0x3c.l) string PE\0\0 PE
12891>>>(0x3c.l+24)	leshort		0x010b	\b32 executable
12892>>>(0x3c.l+24)	leshort		0x020b	\b32+ executable
12893>>>(0x3c.l+24)	leshort		0x0107	ROM image
12894>>>(0x3c.l+24)	default		x	Unknown PE signature
12895>>>>&0 		leshort		x	0x%x
12896>>>(0x3c.l+22)	leshort&0x2000	>0	(DLL)
12897>>>(0x3c.l+92)	leshort		1	(native)
12898>>>(0x3c.l+92)	leshort		2	(GUI)
12899>>>(0x3c.l+92)	leshort		3	(console)
12900>>>(0x3c.l+92)	leshort		7	(POSIX)
12901>>>(0x3c.l+92)	leshort		9	(Windows CE)
12902>>>(0x3c.l+92)	leshort		10	(EFI application)
12903>>>(0x3c.l+92)	leshort		11	(EFI boot service driver)
12904>>>(0x3c.l+92)	leshort		12	(EFI runtime driver)
12905>>>(0x3c.l+92)	leshort		13	(EFI ROM)
12906>>>(0x3c.l+92)	leshort		14	(XBOX)
12907>>>(0x3c.l+92)	leshort		15	(Windows boot application)
12908>>>(0x3c.l+92)	default		x	(Unknown subsystem
12909>>>>&0		leshort		x	0x%x)
12910>>>(0x3c.l+4)	leshort		0x14c	Intel 80386
12911>>>(0x3c.l+4)	leshort		0x166	MIPS R4000
12912>>>(0x3c.l+4)	leshort		0x168	MIPS R10000
12913>>>(0x3c.l+4)	leshort		0x184	Alpha
12914>>>(0x3c.l+4)	leshort		0x1a2	Hitachi SH3
12915>>>(0x3c.l+4)	leshort		0x1a6	Hitachi SH4
12916>>>(0x3c.l+4)	leshort		0x1c0	ARM
12917>>>(0x3c.l+4)	leshort		0x1c2	ARM Thumb
12918>>>(0x3c.l+4)	leshort		0x1c4	ARMv7 Thumb
12919>>>(0x3c.l+4)	leshort		0x1f0	PowerPC
12920>>>(0x3c.l+4)	leshort		0x200	Intel Itanium
12921>>>(0x3c.l+4)	leshort		0x266	MIPS16
12922>>>(0x3c.l+4)	leshort		0x268	Motorola 68000
12923>>>(0x3c.l+4)	leshort		0x290	PA-RISC
12924>>>(0x3c.l+4)	leshort		0x366	MIPSIV
12925>>>(0x3c.l+4)	leshort		0x466	MIPS16 with FPU
12926>>>(0x3c.l+4)	leshort		0xebc	EFI byte code
12927>>>(0x3c.l+4)	leshort		0x8664	x86-64
12928>>>(0x3c.l+4)	leshort		0xc0ee	MSIL
12929>>>(0x3c.l+4)	default		x	Unknown processor type
12930>>>>&0		leshort		x	0x%x
12931>>>(0x3c.l+22)	leshort&0x0200	>0	(stripped to external PDB)
12932>>>(0x3c.l+22)	leshort&0x1000	>0	system file
12933>>>(0x3c.l+24)	leshort		0x010b
12934>>>>(0x3c.l+232) lelong	>0	Mono/.Net assembly
12935>>>(0x3c.l+24)	leshort		0x020b
12936>>>>(0x3c.l+248) lelong	>0	Mono/.Net assembly
12937
12938# hooray, there's a DOS extender using the PE format, with a valid PE
12939# executable inside (which just prints a message and exits if run in win)
12940>>>(8.s*16)		string		32STUB	\b, 32rtm DOS extender
12941>>>(8.s*16)		string		!32STUB	\b, for MS Windows
12942>>>(0x3c.l+0xf8)	string		UPX0 \b, UPX compressed
12943>>>(0x3c.l+0xf8)	search/0x140	PEC2 \b, PECompact2 compressed
12944>>>(0x3c.l+0xf8)	search/0x140	UPX2
12945>>>>(&0x10.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
12946>>>(0x3c.l+0xf8)	search/0x140	.idata
12947>>>>(&0xe.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
12948>>>>(&0xe.l+(-4))	string		ZZ0 \b, ZZip self-extracting archive
12949>>>>(&0xe.l+(-4))	string		ZZ1 \b, ZZip self-extracting archive
12950>>>(0x3c.l+0xf8)	search/0x140	.rsrc
12951>>>>(&0x0f.l+(-4))	string		a\\\4\5 \b, WinHKI self-extracting archive
12952>>>>(&0x0f.l+(-4))	string		Rar! \b, RAR self-extracting archive
12953>>>>(&0x0f.l+(-4))	search/0x3000	MSCF \b, InstallShield self-extracting archive
12954>>>>(&0x0f.l+(-4))	search/32	Nullsoft \b, Nullsoft Installer self-extracting archive
12955>>>(0x3c.l+0xf8)	search/0x140	.data
12956>>>>(&0x0f.l)		string		WEXTRACT \b, MS CAB-Installer self-extracting archive
12957>>>(0x3c.l+0xf8)	search/0x140	.petite\0 \b, Petite compressed
12958>>>>(0x3c.l+0xf7)	byte		x
12959>>>>>(&0x104.l+(-4))	string		=!sfx! \b, ACE self-extracting archive
12960>>>(0x3c.l+0xf8)	search/0x140	.WISE \b, WISE installer self-extracting archive
12961>>>(0x3c.l+0xf8)	search/0x140	.dz\0\0\0 \b, Dzip self-extracting archive
12962>>>&(0x3c.l+0xf8)	search/0x100	_winzip_ \b, ZIP self-extracting archive (WinZip)
12963>>>&(0x3c.l+0xf8)	search/0x100	SharedD \b, Microsoft Installer self-extracting archive
12964>>>0x30			string		Inno \b, InnoSetup self-extracting archive
12965
12966# Hmm, not a PE but the relocation table is too high for a traditional DOS exe,
12967# must be one of the unusual subformats.
12968>>(0x3c.l) string !PE\0\0 MS-DOS executable
12969
12970>>(0x3c.l)		string		NE \b, NE
12971>>>(0x3c.l+0x36)	byte		1 for OS/2 1.x
12972>>>(0x3c.l+0x36)	byte		2 for MS Windows 3.x
12973>>>(0x3c.l+0x36)	byte		3 for MS-DOS
12974>>>(0x3c.l+0x36)	byte		4 for Windows 386
12975>>>(0x3c.l+0x36)	byte		5 for Borland Operating System Services
12976>>>(0x3c.l+0x36)	default		x
12977>>>>(0x3c.l+0x36)	byte		x (unknown OS %x)
12978>>>(0x3c.l+0x36)	byte		0x81 for MS-DOS, Phar Lap DOS extender
12979>>>(0x3c.l+0x0c)	leshort&0x8003	0x8002 (DLL)
12980>>>(0x3c.l+0x0c)	leshort&0x8003	0x8001 (driver)
12981>>>&(&0x24.s-1)		string		ARJSFX \b, ARJ self-extracting archive
12982>>>(0x3c.l+0x70)	search/0x80	WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
12983
12984>>(0x3c.l)		string		LX\0\0 \b, LX
12985>>>(0x3c.l+0x0a)	leshort		<1 (unknown OS)
12986>>>(0x3c.l+0x0a)	leshort		1 for OS/2
12987>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
12988>>>(0x3c.l+0x0a)	leshort		3 for DOS
12989>>>(0x3c.l+0x0a)	leshort		>3 (unknown OS)
12990>>>(0x3c.l+0x10)	lelong&0x28000	=0x8000 (DLL)
12991>>>(0x3c.l+0x10)	lelong&0x20000	>0 (device driver)
12992>>>(0x3c.l+0x10)	lelong&0x300	0x300 (GUI)
12993>>>(0x3c.l+0x10)	lelong&0x28300	<0x300 (console)
12994>>>(0x3c.l+0x08)	leshort		1 i80286
12995>>>(0x3c.l+0x08)	leshort		2 i80386
12996>>>(0x3c.l+0x08)	leshort		3 i80486
12997>>>(8.s*16)		string		emx \b, emx
12998>>>>&1			string		x %s
12999>>>&(&0x54.l-3)		string		arjsfx \b, ARJ self-extracting archive
13000
13001# MS Windows system file, supposedly a collection of LE executables
13002>>(0x3c.l)		string		W3 \b, W3 for MS Windows
13003
13004>>(0x3c.l)		string		LE\0\0 \b, LE executable
13005>>>(0x3c.l+0x0a)	leshort		1
13006# some DOS extenders use LE files with OS/2 header
13007>>>>0x240		search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
13008>>>>0x240		search/0x200	WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
13009>>>>0x440		search/0x100	CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
13010>>>>0x40		search/0x40	PMODE/W for MS-DOS, PMODE/W DOS extender
13011>>>>0x40		search/0x40	STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
13012>>>>0x40		search/0x80	STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
13013>>>>0x40		search/0x80	DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
13014# this is a wild guess; hopefully it is a specific signature
13015>>>>&0x24		lelong		<0x50
13016>>>>>(&0x4c.l)		string		\xfc\xb8WATCOM
13017>>>>>>&0		search/8	3\xdbf\xb9 \b, 32Lite compressed
13018# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP
13019#>>>>(0x3c.l+0x1c)	lelong		>0x10000 for OS/2
13020# fails with DOS-Extenders.
13021>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
13022>>>(0x3c.l+0x0a)	leshort		3 for DOS
13023>>>(0x3c.l+0x0a)	leshort		4 for MS Windows (VxD)
13024>>>(&0x7c.l+0x26)	string		UPX \b, UPX compressed
13025>>>&(&0x54.l-3)		string		UNACE \b, ACE self-extracting archive
13026
13027# looks like ASCII, probably some embedded copyright message.
13028# and definitely not NE/LE/LX/PE
13029>>0x3c		lelong	>0x20000000
13030>>>(4.s*512)	leshort !0x014c \b, MZ for MS-DOS
13031# header data too small for extended executable
13032>2		long	!0
13033>>0x18		leshort <0x40
13034>>>(4.s*512)	leshort !0x014c
13035
13036>>>>&(2.s-514)	string	!LE
13037>>>>>&-2	string	!BW \b, MZ for MS-DOS
13038>>>>&(2.s-514)	string	LE \b, LE
13039>>>>>0x240	search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
13040# educated guess since indirection is still not capable enough for complex offset
13041# calculations (next embedded executable would be at &(&2*512+&0-2)
13042# I suspect there are only LE executables in these multi-exe files
13043>>>>&(2.s-514)	string	BW
13044>>>>>0x240	search/0x100	DOS/4G ,\b LE for MS-DOS, DOS4GW DOS extender (embedded)
13045>>>>>0x240	search/0x100	!DOS/4G ,\b BW collection for MS-DOS
13046
13047# This sequence skips to the first COFF segment, usually .text
13048>(4.s*512)	leshort		0x014c \b, COFF
13049>>(8.s*16)	string		go32stub for MS-DOS, DJGPP go32 DOS extender
13050>>(8.s*16)	string		emx
13051>>>&1		string		x for DOS, Win or OS/2, emx %s
13052>>&(&0x42.l-3)	byte		x
13053>>>&0x26	string		UPX \b, UPX compressed
13054# and yet another guess: small .text, and after large .data is unusal, could be 32lite
13055>>&0x2c		search/0xa0	.text
13056>>>&0x0b	lelong		<0x2000
13057>>>>&0		lelong		>0x6000 \b, 32lite compressed
13058
13059>(8.s*16) string $WdX \b, WDos/X DOS extender
13060
13061# By now an executable type should have been printed out.  The executable
13062# may be a self-uncompressing archive, so look for evidence of that and
13063# print it out.
13064#
13065# Some signatures below from Greg Roelofs, newt@uchicago.edu.
13066#
13067>0x35	string	\x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
13068>0xe7	string	LH/2\ 	Self-Extract \b, %s
13069>0x1c	string	UC2X	\b, UCEXE compressed
13070>0x1c	string	WWP\ 	\b, WWPACK compressed
13071>0x1c	string	RJSX 	\b, ARJ self-extracting archive
13072>0x1c	string	diet 	\b, diet compressed
13073>0x1c	string	LZ09 	\b, LZEXE v0.90 compressed
13074>0x1c	string	LZ91 	\b, LZEXE v0.91 compressed
13075>0x1c	string	tz 	\b, TinyProg compressed
13076>0x1e	string	Copyright\ 1989-1990\ PKWARE\ Inc.	Self-extracting PKZIP archive
13077!:mime	application/zip
13078# Yes, this really is "Copr", not "Corp."
13079>0x1e	string	PKLITE\ Copr.	Self-extracting PKZIP archive
13080!:mime	application/zip
13081# winarj stores a message in the stub instead of the sig in the MZ header
13082>0x20	search/0xe0	aRJsfX \b, ARJ self-extracting archive
13083>0x20	string AIN
13084>>0x23	string 2	\b, AIN 2.x compressed
13085>>0x23	string <2	\b, AIN 1.x compressed
13086>>0x23	string >2	\b, AIN 1.x compressed
13087>0x24	string	LHa's\ SFX \b, LHa self-extracting archive
13088!:mime	application/x-lha
13089>0x24	string	LHA's\ SFX \b, LHa self-extracting archive
13090!:mime	application/x-lha
13091>0x24	string	\ $ARX \b, ARX self-extracting archive
13092>0x24	string	\ $LHarc \b, LHarc self-extracting archive
13093>0x20	string	SFX\ by\ LARC \b, LARC self-extracting archive
13094>0x40	string aPKG \b, aPackage self-extracting archive
13095>0x64	string	W\ Collis\0\0 \b, Compack compressed
13096>0x7a	string		Windows\ self-extracting\ ZIP	\b, ZIP self-extracting archive
13097>>&0xf4 search/0x140 \x0\x40\x1\x0
13098>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
13099>1638	string	-lh5- \b, LHa self-extracting archive v2.13S
13100>0x17888 string Rar! \b, RAR self-extracting archive
13101
13102# Skip to the end of the EXE.  This will usually work fine in the PE case
13103# because the MZ image is hardcoded into the toolchain and almost certainly
13104# won't match any of these signatures.
13105>(4.s*512)	long	x
13106>>&(2.s-517)	byte	x
13107>>>&0	string		PK\3\4 \b, ZIP self-extracting archive
13108>>>&0	string		Rar! \b, RAR self-extracting archive
13109>>>&0	string		=!\x11 \b, AIN 2.x self-extracting archive
13110>>>&0	string		=!\x12 \b, AIN 2.x self-extracting archive
13111>>>&0	string		=!\x17 \b, AIN 1.x self-extracting archive
13112>>>&0	string		=!\x18 \b, AIN 1.x self-extracting archive
13113>>>&7	search/400	**ACE** \b, ACE self-extracting archive
13114>>>&0	search/0x480	UC2SFX\ Header \b, UC2 self-extracting archive
13115
13116# a few unknown ZIP sfxes, no idea if they are needed or if they are
13117# already captured by the generic patterns above
13118>(8.s*16)	search/0x20	PKSFX \b, ZIP self-extracting archive (PKZIP)
13119# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive
13120#
13121
13122# TELVOX Teleinformatica CODEC self-extractor for OS/2:
13123>49801	string	\x79\xff\x80\xff\x76\xff	\b, CODEC archive v3.21
13124>>49824 leshort		=1			\b, 1 file
13125>>49824 leshort		>1			\b, %u files
13126
13127# added by Joerg Jenderek of http://www.freedos.org/software/?prog=kc
13128# and http://www.freedos.org/software/?prog=kpdos
13129# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD
131300	string/b	KCF		FreeDOS KEYBoard Layout collection
13131# only version=0x100 found
13132>3	uleshort	x		\b, version 0x%x
13133# length of string containing author,info and special characters
13134>6	ubyte		>0
13135#>>6	pstring		x		\b, name=%s
13136>>7	string		>\0		\b, author=%-.14s
13137>>7	search/254	\xff		\b, info=
13138#>>>&0	string		x		\b%-s
13139>>>&0	string		x		\b%-.15s
13140# for FreeDOS *.KL files
131410	string/b	KLF		FreeDOS KEYBoard Layout file
13142# only version=0x100 or 0x101 found
13143>3	uleshort	x		\b, version 0x%x
13144# stringlength
13145>5	ubyte		>0
13146>>8	string		x		\b, name=%-.2s
131470	string	\xffKEYB\ \ \ \0\0\0\0
13148>12	string	\0\0\0\0`\004\360	MS-DOS KEYBoard Layout file
13149
13150# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
13151# Uncommenting only the first two lines will cover about 2/3 of COM files,
13152# but it isn't feasible to match all COM files since there must be at least
13153# two dozen different one-byte "magics".
13154# test too generic ?
131550	byte		0xe9		DOS executable (COM)
13156>0x1FE leshort		0xAA55		\b, boot code
13157>6	string		SFX\ of\ LHarc	(%s)
13158
13159# DOS device driver updated by Joerg Jenderek at May 2011
13160# http://maben.homeip.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
131610	ulequad&0x07a0ffffffff		0xffffffff		DOS executable (
13162>40	search/7			UPX!			\bUPX compressed
13163# DOS device driver attributes
13164>4	uleshort&0x8000			0x0000			\bblock device driver
13165# character device
13166>4	uleshort&0x8000			0x8000			\b
13167>>4	uleshort&0x0008			0x0008			\bclock
13168# fast video output by int 29h
13169>>4	uleshort&0x0010			0x0010			\bfast
13170# standard input/output device
13171>>4	uleshort&0x0003			>0			\bstandard
13172>>>4	uleshort&0x0001			0x0001			\binput
13173>>>4	uleshort&0x0003			0x0003			\b/
13174>>>4	uleshort&0x0002			0x0002			\boutput
13175>>4	uleshort&0x8000			0x8000			\bcharacter device driver
13176>0	ubyte				x
13177# upx compressed device driver has garbage instead of real in name field of header
13178>>40	search/7			UPX!
13179>>40	default				x
13180# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped
13181>>>12		ubyte			>0x27			\b
13182>>>>10		ubyte			>0x20
13183>>>>>10		ubyte			!0x2E
13184>>>>>>10	ubyte			!0x2A			\b%c
13185>>>>11		ubyte			>0x20
13186>>>>>11		ubyte			!0x2E			\b%c
13187>>>>12		ubyte			>0x20
13188>>>>>12		ubyte			!0x39
13189>>>>>>12	ubyte			!0x2E			\b%c
13190>>>13		ubyte			>0x20
13191>>>>13		ubyte			!0x2E			\b%c
13192>>>>14		ubyte			>0x20
13193>>>>>14		ubyte			!0x2E			\b%c
13194>>>>15		ubyte			>0x20
13195>>>>>15		ubyte			!0x2E			\b%c
13196>>>>16		ubyte			>0x20
13197>>>>>16		ubyte			!0x2E
13198>>>>>>16	ubyte			<0xCB			\b%c
13199>>>>17		ubyte			>0x20
13200>>>>>17		ubyte			!0x2E
13201>>>>>>17	ubyte			<0x90			\b%c
13202# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field
13203>>>4		uleshort&0x8000		0x8000
13204>>>>12		ubyte			<0x2F
13205# they have their real name at offset 22
13206>>>>>22		string			>\0			\b%-.5s
13207>4	uleshort&0x8000			0x0000
13208# 32 bit sector addressing ( > 32 MB) for block devices
13209>>4	uleshort&0x0002			0x0002			\b,32-bit sector-
13210# support by driver functions 13h, 17h, 18h
13211>4	uleshort&0x0040			0x0040			\b,IOCTL-
13212# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh
13213>4	uleshort&0x0800			0x0800			\b,close media-
13214# output until busy support by int 10h for character device driver
13215>4	uleshort&0x8000			0x8000
13216>>4	uleshort&0x2000			0x2000			\b,until busy-
13217# direct read/write support by driver functions 03h,0Ch
13218>4	uleshort&0x4000			0x4000			\b,control strings-
13219>4	uleshort&0x8000			0x8000
13220>>4	uleshort&0x6840			>0			\bsupport
13221>4	uleshort&0x8000			0x0000
13222>>4	uleshort&0x4842			>0			\bsupport
13223>0	ubyte				x			\b)
13224# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
13225# Too weak, matches files that only contain 0's
13226#0	ulequad&0x000007a0ffffffed	0x0000000000000000	DOS-executable (
13227#>4	uleshort&0x8000			0x8000			\bcharacter device driver
13228#>>10	string				x			%-.8s
13229#>4	uleshort&0x4000			0x4000			\b,control strings-support)
13230
13231# test too generic ?
132320	byte		0x8c		DOS executable (COM)
13233# updated by Joerg Jenderek at Oct 2008
132340	ulelong		0xffff10eb	DR-DOS executable (COM)
13235# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb
132360	ubeshort&0xeb8d	>0xeb00
13237# DR-DOS STACKER.COM SCREATE.SYS missed
13238>0	byte		0xeb
13239>>0x1FE leshort		0xAA55		DOS executable (COM), boot code
13240>>85	string		UPX		DOS executable (COM), UPX compressed
13241>>4	string		\ $ARX		DOS executable (COM), ARX self-extracting archive
13242>>4	string		\ $LHarc	DOS executable (COM), LHarc self-extracting archive
13243>>0x20e string		SFX\ by\ LARC	DOS executable (COM), LARC self-extracting archive
13244# updated by Joerg Jenderek at Oct 2008
13245#0	byte		0xb8		COM executable
132460	uleshort&0x80ff	0x00b8
13247# modified by Joerg Jenderek
13248>1	lelong		!0x21cd4cff	COM executable for DOS
13249# http://syslinux.zytor.com/comboot.php
13250# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
13251# start with assembler instructions mov eax,21cd4cffh
132520	uleshort&0xc0ff	0xc0b8
13253>1	lelong		0x21cd4cff	COM executable (32-bit COMBOOT)
13254# syslinux:doc/comboot.txt
13255# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov
13256# eax,21cd4cfeh) as a magic number.
132570       string/b	\xb8\xfe\x4c\xcd\x21	COM executable (COM32R)
13258# start with assembler instructions mov eax,21cd4cfeh
132590	uleshort&0xc0ff	0xc0b8
13260>1	lelong		0x21cd4cfe	COM executable (32-bit COMBOOT, relocatable)
132610	string/b	\x81\xfc
13262>4	string	\x77\x02\xcd\x20\xb9
13263>>36	string	UPX!			FREE-DOS executable (COM), UPX compressed
13264252	string Must\ have\ DOS\ version DR-DOS executable (COM)
13265# added by Joerg Jenderek at Oct 2008
13266# GRR search is not working
13267#34	search/2	UPX!		FREE-DOS executable (COM), UPX compressed
1326834	string	UPX!			FREE-DOS executable (COM), UPX compressed
1326935	string	UPX!			FREE-DOS executable (COM), UPX compressed
13270# GRR search is not working
13271#2	search/28	\xcd\x21	COM executable for MS-DOS
13272#WHICHFAT.cOM
132732	string	\xcd\x21		COM executable for DOS
13274#DELTREE.cOM DELTREE2.cOM
132754	string	\xcd\x21		COM executable for DOS
13276#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
132775	string	\xcd\x21		COM executable for DOS
13278#DELTMP.COm HASFAT32.cOM
132797	string	\xcd\x21
13280>0	byte	!0xb8			COM executable for DOS
13281#COMP.cOM MORE.COm
1328210	string	\xcd\x21
13283>5	string	!\xcd\x21		COM executable for DOS
13284#comecho.com
1328513	string	\xcd\x21		COM executable for DOS
13286#HELP.COm EDIT.coM
1328718	string	\xcd\x21		COM executable for MS-DOS
13288#NWRPLTRM.COm
1328923	string	\xcd\x21		COM executable for MS-DOS
13290#LOADFIX.cOm LOADFIX.cOm
1329130	string	\xcd\x21		COM executable for MS-DOS
13292#syslinux.com 3.11
1329370	string	\xcd\x21		COM executable for DOS
13294# many compressed/converted COMs start with a copy loop instead of a jump
132950x6	search/0xa	\xfc\x57\xf3\xa5\xc3	COM executable for MS-DOS
132960x6	search/0xa	\xfc\x57\xf3\xa4\xc3	COM executable for DOS
13297>0x18	search/0x10	\x50\xa4\xff\xd5\x73	\b, aPack compressed
132980x3c	string		W\ Collis\0\0		COM executable for MS-DOS, Compack compressed
13299# FIXME: missing diet .com compression
13300
13301# miscellaneous formats
133020	string/b	LZ		MS-DOS executable (built-in)
13303#0	byte		0xf0		MS-DOS program library data
13304#
13305
13306# AAF files:
13307# <stuartc@rd.bbc.co.uk> Stuart Cunningham
133080	string/b	\320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377			AAF legacy file using MS Structured Storage
13309>30	byte	9		(512B sectors)
13310>30	byte	12		(4kB sectors)
133110	string/b	\320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001			AAF file using MS Structured Storage
13312>30	byte	9		(512B sectors)
13313>30	byte	12		(4kB sectors)
13314
13315# Popular applications
133162080	string	Microsoft\ Word\ 6.0\ Document	%s
13317!:mime	application/msword
133182080	string	Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
13319!:mime	application/msword
13320# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
133212112	string	MSWordDoc			Microsoft Word document data
13322!:mime	application/msword
13323#
133240	belong	0x31be0000			Microsoft Word Document
13325!:mime	application/msword
13326#
133270	string/b	PO^Q`				Microsoft Word 6.0 Document
13328!:mime	application/msword
13329#
133300	string/b	\376\067\0\043			Microsoft Office Document
13331!:mime	application/msword
133320	string/b	\333\245-\0\0\0			Microsoft Office Document
13333!:mime	application/msword
13334512	string/b	\354\245\301			Microsoft Word Document
13335!:mime	application/msword
13336
13337#
133380	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
13339!:mime application/msword
13340#
133412080	string	Microsoft\ Excel\ 5.0\ Worksheet	%s
13342!:mime	application/vnd.ms-excel
13343#
133440	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
13345!:mime application/msword
13346
133472080	string	Foglio\ di\ lavoro\ Microsoft\ Exce	%s
13348!:mime	application/vnd.ms-excel
13349#
13350# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
133512114	string	Biff5		Microsoft Excel 5.0 Worksheet
13352!:mime	application/vnd.ms-excel
13353# Italian MS-Excel
133542121	string	Biff5		Microsoft Excel 5.0 Worksheet
13355!:mime	application/vnd.ms-excel
133560	string/b	\x09\x04\x06\x00\x00\x00\x10\x00	Microsoft Excel Worksheet
13357!:mime	application/vnd.ms-excel
13358#
133590	belong	0x00001a00	Lotus 1-2-3
13360!:mime	application/x-123
13361>4	belong	0x00100400	wk3 document data
13362>4	belong	0x02100400	wk4 document data
13363>4	belong	0x07800100	fm3 or fmb document data
13364>4	belong	0x07800000	fm3 or fmb document data
13365#
133660	belong	0x00000200	Lotus 1-2-3
13367!:mime	application/x-123
13368>4	belong	0x06040600	wk1 document data
13369>4	belong	0x06800200	fmt document data
133700	string/b		WordPro\0	Lotus WordPro
13371!:mime	application/vnd.lotus-wordpro
133720	string/b		WordPro\r\373	Lotus WordPro
13373!:mime	application/vnd.lotus-wordpro
13374
13375
13376# Summary: Script used by InstallScield to uninstall applications
13377# Extension: .isu
13378# Submitted by: unknown
13379# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry)
133800		string		\x71\xa8\x00\x00\x01\x02
13381>12		string		Stirling\ Technologies,		InstallShield Uninstall Script
13382
13383# Winamp .avs
13384#0	string	Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
133850	string/b	Nullsoft\ AVS\ Preset\ 	Winamp plug in
13386
13387# Windows Metafont .WMF
133880	string/b	\327\315\306\232	ms-windows metafont .wmf
133890	string/b	\002\000\011\000	ms-windows metafont .wmf
133900	string/b	\001\000\011\000	ms-windows metafont .wmf
13391
13392#tz3 files whatever that is (MS Works files)
133930	string/b	\003\001\001\004\070\001\000\000	tz3 ms-works file
133940	string/b	\003\002\001\004\070\001\000\000	tz3 ms-works file
133950	string/b	\003\003\001\004\070\001\000\000	tz3 ms-works file
13396
13397# PGP sig files .sig
13398#0 string \211\000\077\003\005\000\063\237\127 065 to  \027\266\151\064\005\045\101\233\021\002 PGP sig
133990 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
134000 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
134010 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
134020 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
134030 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
134040 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
13405
13406# windows zips files .dmf
134070	string/b	MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
13408
13409
13410#ico files
134110	string/b	\102\101\050\000\000\000\056\000\000\000\000\000\000\000	Icon for MS Windows
13412
13413# Windows icons (Ian Springer <ips@fpk.hp.com>)
134140	string/b	\000\000\001\000	MS Windows icon resource
13415!:mime	image/x-icon
13416>4	byte	1			- 1 icon
13417>4	byte	>1			- %d icons
13418>>6	byte	>0			\b, %dx
13419>>>7	byte	>0			\b%d
13420>>8	byte	0			\b, 256-colors
13421>>8	byte	>0			\b, %d-colors
13422
13423
13424# .chr files
134250	string/b	PK\010\010BGI	Borland font
13426>4	string	>\0	%s
13427# then there is a copyright notice
13428
13429
13430# .bgi files
134310	string/b	pk\010\010BGI	Borland device
13432>4	string	>\0	%s
13433# then there is a copyright notice
13434
13435
13436# Windows Recycle Bin record file (named INFO2)
13437# By Abel Cheung (abelcheung AT gmail dot com)
13438# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes
13439# Since Vista uses another structure, INFO2 structure probably won't change
13440# anymore. Detailed analysis in:
13441# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf
134420	lelong		0x00000004
13443>12	lelong		0x00000118	Windows Recycle Bin INFO2 file (Win98 or below)
13444
134450	lelong		0x00000005
13446>12	lelong		0x00000320	Windows Recycle Bin INFO2 file (Win2k - WinXP)
13447
13448
13449##### put in Either Magic/font or Magic/news
13450# Acroread or something	 files wrongly identified as G3	 .pfm
13451# these have the form \000 \001 any? \002 \000 \000
13452# or \000 \001 any? \022 \000 \000
134530	belong&0xffff00ff	0x00010012	PFM data
13454>4	string			\000\000
13455>6	string			>\060		- %s
13456
134570	belong&0xffff00ff	0x00010002	PFM data
13458>4	string			\000\000
13459>6	string			>\060		- %s
13460#0	string	\000\001 pfm?
13461#>3	string	\022\000\000Copyright\	yes
13462#>3	string	\002\000\000Copyright\	yes
13463#>3	string	>\0	oops, not a font file. Cancel that.
13464#it clashes with ttf files so put it lower down.
13465
13466# From Doug Lee via a FreeBSD pr
134679	string		GERBILDOC	First Choice document
134689	string		GERBILDB	First Choice database
134699	string		GERBILCLIP	First Choice database
134700	string		GERBIL		First Choice device file
134719	string		RABBITGRAPH	RabbitGraph file
134720	string		DCU1		Borland Delphi .DCU file
134730	string		=!<spell>	MKS Spell hash list (old format)
134740	string		=!<spell2>	MKS Spell hash list
13475# Too simple - MPi
13476#0	string		AH		Halo(TM) bitmapped font file
134770	lelong		0x08086b70	TurboC BGI file
134780	lelong		0x08084b50	TurboC Font file
13479
13480# tests for DBase files moved, updated and merged to database
13481
134820	string		PMCC		Windows 3.x .GRP file
134831	string		RDC-meg		MegaDots
13484>8	byte		>0x2F		version %c
13485>9	byte		>0x2F		\b.%c file
134860	lelong		0x4C
13487>4	lelong		0x00021401	Windows shortcut file
13488
13489# .PIF files added by Joerg Jenderek from http://smsoft.ru/en/pifdoc.htm
13490# only for windows versions equal or greater 3.0
134910x171	string	MICROSOFT\ PIFEX\0	Windows Program Information File
13492!:mime	application/x-dosexec
13493#>2	string	 	>\0		\b, Title:%.30s
13494>0x24	string		>\0		\b for %.63s
13495>0x65	string		>\0		\b, directory=%.64s
13496>0xA5	string		>\0		\b, parameters=%.64s
13497#>0x181	leshort	x	\b, offset %x
13498#>0x183	leshort	x	\b, offsetdata %x
13499#>0x185	leshort	x	\b, section length %x
13500>0x187	search/0xB55	WINDOWS\ VMM\ 4.0\0
13501>>&0x5e		ubyte	>0
13502>>>&-1		string	<PIFMGR.DLL		\b, icon=%s
13503#>>>&-1		string	PIFMGR.DLL		\b, icon=%s
13504>>>&-1		string	>PIFMGR.DLL		\b, icon=%s
13505>>&0xF0		ubyte	>0
13506>>>&-1		string	<Terminal		\b, font=%.32s
13507#>>>&-1		string	=Terminal		\b, font=%.32s
13508>>>&-1		string	>Terminal		\b, font=%.32s
13509>>&0x110	ubyte	>0
13510>>>&-1		string	<Lucida\ Console	\b, TrueTypeFont=%.32s
13511#>>>&-1		string	=Lucida\ Console	\b, TrueTypeFont=%.32s
13512>>>&-1		string	>Lucida\ Console	\b, TrueTypeFont=%.32s
13513#>0x187	search/0xB55	WINDOWS\ 286\ 3.0\0	\b, Windows 3.X standard mode-style
13514#>0x187	search/0xB55	WINDOWS\ 386\ 3.0\0	\b, Windows 3.X enhanced mode-style
13515>0x187	search/0xB55	WINDOWS\ NT\ \ 3.1\0	\b, Windows NT-style
13516#>0x187	search/0xB55	WINDOWS\ NT\ \ 4.0\0	\b, Windows NT-style
13517>0x187	search/0xB55	CONFIG\ \ SYS\ 4.0\0	\b +CONFIG.SYS
13518#>>&06		string	x			\b:%s
13519>0x187	search/0xB55	AUTOEXECBAT\ 4.0\0	\b +AUTOEXEC.BAT
13520#>>&06		string	x			\b:%s
13521
13522# DOS EPS Binary File Header
13523# From: Ed Sznyter <ews@Black.Market.NET>
135240	belong		0xC5D0D3C6	DOS EPS Binary File
13525>4	long		>0		Postscript starts at byte %d
13526>>8	long		>0		length %d
13527>>>12	long		>0		Metafile starts at byte %d
13528>>>>16	long		>0		length %d
13529>>>20	long		>0		TIFF starts at byte %d
13530>>>>24	long		>0		length %d
13531
13532# TNEF magic From "Joomy" <joomy@se-ed.net>
13533# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
135340	leshort		0x223e9f78	TNEF
13535!:mime	application/vnd.ms-tnef
13536
13537# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
13538# of http://www.4dos.info/
13539# pointer,HelpID[8]=4DHnnnmm
135400	ulelong	0x48443408		4DOS help file
13541>4	string	x			\b, version %-4.4s
13542
13543# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp
135440	ulequad	0x3a000000024e4c	MS Advisor help file
13545
13546# HtmlHelp files (.chm)
135470	string/b	ITSF\003\000\000\000\x60\000\000\000\001\000\000\000	MS Windows HtmlHelp Data
13548
13549# GFA-BASIC (Wolfram Kleff)
135502	string/b	GFA-BASIC3	GFA-BASIC 3 data
13551
13552#------------------------------------------------------------------------------
13553# From Stuart Caie <kyzer@4u.net> (developer of cabextract)
13554# Microsoft Cabinet files
135550	string/b	MSCF\0\0\0\0	Microsoft Cabinet archive data
13556!:mime application/vnd.ms-cab-compressed
13557>8	lelong		x		\b, %u bytes
13558>28	leshort		1		\b, 1 file
13559>28	leshort		>1		\b, %u files
13560
13561# InstallShield Cabinet files
135620	string/b	ISc(		InstallShield Cabinet archive data
13563>5	byte&0xf0	=0x60		version 6,
13564>5	byte&0xf0	!0x60		version 4/5,
13565>(12.l+40)	lelong	x		%u files
13566
13567# Windows CE package files
135680	string/b	MSCE\0\0\0\0	Microsoft WinCE install header
13569>20	lelong		0		\b, architecture-independent
13570>20	lelong		103		\b, Hitachi SH3
13571>20	lelong		104		\b, Hitachi SH4
13572>20	lelong		0xA11		\b, StrongARM
13573>20	lelong		4000		\b, MIPS R4000
13574>20	lelong		10003		\b, Hitachi SH3
13575>20	lelong		10004		\b, Hitachi SH3E
13576>20	lelong		10005		\b, Hitachi SH4
13577>20	lelong		70001		\b, ARM 7TDMI
13578>52	leshort		1		\b, 1 file
13579>52	leshort		>1		\b, %u files
13580>56	leshort		1		\b, 1 registry entry
13581>56	leshort		>1		\b, %u registry entries
13582
13583
13584# Windows Enhanced Metafile (EMF)
13585# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
13586# for further information.
135870	ulelong 1
13588>40	string	\ EMF		Windows Enhanced Metafile (EMF) image data
13589>>44	ulelong x		version 0x%x
13590
13591# From: Alex Beregszaszi <alex@fsn.hu>
135920	string/b	COWD		VMWare3
13593>4	byte	3		disk image
13594>>32	lelong	x		(%d/
13595>>36	lelong	x		\b%d/
13596>>40	lelong	x		\b%d)
13597>4	byte	2		undoable disk image
13598>>32	string	>\0		(%s)
13599
136000	string/b	VMDK		 VMware4 disk image
136010	string/b	KDMV		 VMware4 disk image
13602
13603#--------------------------------------------------------------------
13604# Qemu Emulator Images
13605# Lines written by Friedrich Schwittay (f.schwittay@yousable.de)
13606# Updated by Adam Buchbinder (adam.buchbinder@gmail.com)
13607# Made by reading sources, reading documentation, and doing trial and error
13608# on existing QCOW files
136090	string/b	QFI\xFB	QEMU QCOW Image
13610
13611# Uncomment the following line to display Magic (only used for debugging
13612# this magic number)
13613#>0	string/b	x	, Magic: %s
13614
13615# There are currently 2 Versions: "1" and "2".
13616# http://www.gnome.org/~markmc/qcow-image-format-version-1.html
13617>4	belong	1	(v1)
13618
13619# Using the existence of the Backing File Offset to determine whether
13620# to read Backing File Information
13621>>12	belong	 >0	 \b, has backing file (
13622# Note that this isn't a null-terminated string; the length is actually
13623# (16.L). Assuming a null-terminated string happens to work usually, but it
13624# may spew junk until it reaches a \0 in some cases.
13625>>>(12.L)	 string >\0	\bpath %s
13626
13627# Modification time of the Backing File
13628# Really useful if you want to know if your backing
13629# file is still usable together with this image
13630>>>>20	bedate >0	\b, mtime %s)
13631>>>>20	default x	\b)
13632
13633# Size is stored in bytes in a big-endian u64.
13634>>24	bequad	x	 \b, %lld bytes
13635
13636# 1 for AES encryption, 0 for none.
13637>>36	belong	1	\b, AES-encrypted
13638
13639# http://www.gnome.org/~markmc/qcow-image-format.html
13640>4	belong	2	(v2)
13641# Using the existence of the Backing File Offset to determine whether
13642# to read Backing File Information
13643>>8	bequad  >0	 \b, has backing file
13644# Note that this isn't a null-terminated string; the length is actually
13645# (16.L). Assuming a null-terminated string happens to work usually, but it
13646# may spew junk until it reaches a \0 in some cases. Also, since there's no
13647# .Q modifier, we just use the bottom four bytes as an offset. Note that if
13648# the file is over 4G, and the backing file path is stored after the first 4G,
13649# the wrong filename will be printed. (This should be (8.Q), when that syntax
13650# is introduced.)
13651>>>(12.L)	 string >\0	(path %s)
13652>>24	bequad	x	\b, %lld bytes
13653>>32	belong	1	\b, AES-encrypted
13654
13655>4	default x	(unknown version)
13656
136570	string/b	QEVM		QEMU suspend to disk image
13658
13659# QEMU QED Image
13660# http://wiki.qemu.org/Features/QED/Specification
136610	string/b	QED\0		QEMU QED Image
13662
13663# VDI Image
1366464	string/b	\x7f\x10\xda\xbe	VDI Image
13665>68	string/b	\x01\x00\x01\x00	version 1.1
13666>0	string		>\0			(%s)
13667>368	lequad		x			 \b, %lld bytes
13668
136690	string/b	Bochs\ Virtual\ HD\ Image	Bochs disk image,
13670>32	string	x				type %s,
13671>48	string	x				subtype %s
13672
136730	lelong	0x02468ace			Bochs Sparse disk image
13674
13675# from http://filext.com by Derek M Jones <derek@knosof.co.uk>
13676# False positive with PPT (also currently this string is too long)
13677#0	string/b	\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06	Microsoft Installer
136780	string/b	\320\317\021\340\241\261\032\341	Microsoft Office Document
13679#>48	byte	0x1B					Excel Document
13680#!:mime application/vnd.ms-excel
13681>546	string	bjbj			Microsoft Word Document
13682!:mime	application/msword
13683>546	string	jbjb			Microsoft Word Document
13684!:mime	application/msword
13685
136860	string/b	\224\246\056		Microsoft Word Document
13687!:mime	application/msword
13688
13689512	string	R\0o\0o\0t\0\ \0E\0n\0t\0r\0y	Microsoft Word Document
13690!:mime	application/msword
13691
13692# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
13693# Magic type for Dell's BIOS .hdr files
13694# Dell's .hdr
136950	string/b $RBU
13696>23	string Dell			%s system BIOS
13697>5	byte   2
13698>>48	byte   x			version %d.
13699>>49	byte   x			\b%d.
13700>>50	byte   x			\b%d
13701>5	byte   <2
13702>>48	string x			version %.3s
13703
13704# Type: Microsoft DirectDraw Surface
13705# URL:	http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
13706# From: Morten Hustveit <morten@debian.org>
137070	string/b	DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS),
13708>16	lelong	>0			%hd x
13709>12	lelong	>0			%hd,
13710>84	string	x			%.4s
13711
13712# Type: Microsoft Document Imaging Format (.mdi)
13713# URL:	http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
13714# From: Daniele Sempione <scrows@oziosi.org>
137150	short	0x5045			Microsoft Document Imaging Format
13716
13717# MS eBook format (.lit)
137180	string/b	ITOLITLS		Microsoft Reader eBook Data
13719>8	lelong	x			\b, version %u
13720!:mime					application/x-ms-reader
13721
13722# Windows CE Binary Image Data Format
13723# From: Dr. Jesus <j@hug.gs>
137240	string/b	B000FF\n	Windows Embedded CE binary image
13725
13726# Windows Imaging (WIM) Image
137270	string/b	MSWIM\000\000\000	Windows imaging (WIM) image
13728
13729# The second byte of these signatures is a file version; I don't know what,
13730# if anything, produced files with version numbers 0-2.
13731# From: John Elliott <johne@seasip.demon.co.uk>
137320	string	\xfc\x03\x00	Mallard BASIC program data (v1.11)
137330	string	\xfc\x04\x00	Mallard BASIC program data (v1.29+)
137340	string	\xfc\x03\x01	Mallard BASIC protected program data (v1.11)
137350	string	\xfc\x04\x01	Mallard BASIC protected program data (v1.29+)
13736
137370	string	MIOPEN		Mallard BASIC Jetsam data
137380	string	Jetsam0		Mallard BASIC Jetsam index data
13739
13740
13741#------------------------------------------------------------------------------
13742# $File: msooxml,v 1.2 2013/01/25 23:04:37 christos Exp $
13743# msooxml:  file(1) magic for Microsoft Office XML
13744# From: Ralf Brown <ralf.brown@gmail.com>
13745
13746# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP
13747#   archive.  The first member file is normally "[Content_Types].xml".
13748# Since MSOOXML doesn't have anything like the uncompressed "mimetype"
13749#   file of ePub or OpenDocument, we'll have to scan for a filename
13750#   which can distinguish between the three types
13751
13752# start by checking for ZIP local file header signature
137530               string          PK\003\004
13754# make sure the first file is correct
13755>0x1E           string          [Content_Types].xml
13756# skip to the second local file header
13757#   since some documents include a 520-byte extra field following the file
13758#   header,  we need to scan for the next header
13759>>(18.l+49)     search/2000     PK\003\004
13760# now skip to the *third* local file header; again, we need to scan due to a
13761#   520-byte extra field following the file header
13762>>>&26          search/1000     PK\003\004
13763# and check the subdirectory name to determine which type of OOXML
13764#   file we have
13765#   Correct the mimetype with the registered ones:
13766#     http://technet.microsoft.com/en-us/library/cc179224.aspx
13767>>>>&26         string          word/           Microsoft Word 2007+
13768!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document
13769>>>>&26         string          ppt/            Microsoft PowerPoint 2007+
13770!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation
13771>>>>&26         string          xl/             Microsoft Excel 2007+
13772!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
13773>>>>&26         default         x               Microsoft OOXML
13774!:strength +10
13775
13776#------------------------------------------------------------------------------
13777# $File: msvc,v 1.5 2009/09/19 16:28:11 christos Exp $
13778# msvc:  file(1) magic for msvc
13779# "H. Nanosecond" <aldomel@ix.netcom.com>
13780# Microsoft visual C
13781#
13782# I have version 1.0
13783
13784# .aps
137850	string	HWB\000\377\001\000\000\000	Microsoft Visual C .APS file
13786
13787# .ide
13788#too long 0	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316	MSVC .ide
137890	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157	MSVC .ide
13790
13791# .res
137920	string	\000\000\000\000\040\000\000\000\377	MSVC .res
137930	string	\377\003\000\377\001\000\020\020\350	MSVC .res
137940	string	\377\003\000\377\001\000\060\020\350	MSVC .res
13795
13796#.lib
137970	string	\360\015\000\000	Microsoft Visual C library
137980	string	\360\075\000\000	Microsoft Visual C library
137990	string	\360\175\000\000	Microsoft Visual C library
13800
13801#.pch
138020	string	DTJPCH0\000\022\103\006\200	Microsoft Visual C .pch
13803
13804# .pdb
13805# too long 0	string	Microsoft\ C/C++\ program\ database\
138060	string	Microsoft\ C/C++\ 	MSVC program database
13807>18	string	program\ database\
13808>33	string	>\0	ver %s
13809
13810#.sbr
138110	string	\000\002\000\007\000	MSVC .sbr
13812>5	string 	>\0	%s
13813
13814#.bsc
138150	string	\002\000\002\001	MSVC .bsc
13816
13817#.wsp
138180	string	1.00\ .0000.0000\000\003	MSVC .wsp version 1.0000.0000
13819# these seem to start with the version and contain menus
13820
13821# ------------------------------------------------------------------------
13822# $File: mup,v 1.4 2009/09/19 16:28:11 christos Exp $
13823# mup: file(1) magic for Mup (Music Publisher) input file.
13824#
13825# From: Abel Cheung <abel (@) oaka.org>
13826#
13827# NOTE: This header is mainly proposed in the Arkkra mailing list,
13828# and is not a mandatory header because of old mup input file
13829# compatibility. Noteedit also use mup format, but is not forcing
13830# user to use any header as well.
13831#
138320		search/1	//!Mup		Mup music publication program input text
13833>6		string		-Arkkra		(Arkkra)
13834>>13		string		-
13835>>>16		string		.
13836>>>>14		string		x		\b, need V%.4s
13837>>>15		string		.
13838>>>>14		string		x		\b, need V%.3s
13839>6		string		-
13840>>9		string		.
13841>>>7		string		x		\b, need V%.4s
13842>>8		string		.
13843>>>7		string		x		\b, need V%.3s
13844#------------------------------------------------------------------------------
13845# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $
13846# music:  file (1) magic for music formats
13847
13848# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks
13849# and Bagpipe Writer by Doug Wickstrom
13850#
138510	string		Bagpipe		Bagpipe
13852>8	string		Reader		Reader
13853>>15	string		>\0		(version %.3s)
13854>8	string		Music\ Writer	Music Writer
13855>>20	string		:
13856>>>21	string		>\0		(version %.3s)
13857>>21	string		Gold		Gold
13858>>>25	string		:
13859>>>>26	string		>\0		(version %.3s)
13860
13861
13862#-----------------------------------------------------------------------------
13863# $File: natinst,v 1.5 2013/02/06 14:18:52 christos Exp $
13864# natinst:  file(1) magic for National Instruments Code Files
13865
13866#
13867# From <egamez@fcfm.buap.mx> Enrique Gamez-Flores
13868# version 1
13869# Many formats still missing, we use, for the moment LabVIEW
13870# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing
13871#
138720       string          RSRC            National Instruments,
13873# Check if it's a LabVIEW File
13874>8      string          LV              LabVIEW File,
13875# Check wich kind of file is
13876>>10    string          SB              Code Resource File, data
13877>>10    string          IN              Virtual Instrument Program, data
13878>>10    string          AR              VI Library, data
13879# This is for Menu Libraries
13880>8      string          LMNULBVW        Portable File Names, data
13881# This is for General Resources
13882>8      string          rsc             Resources File, data
13883# This is for VXI Package
138840       string          VMAP            National Instruments, VXI File, data
13885
13886#------------------------------------------------------------------------------
13887# $File: ncr,v 1.7 2009/09/19 16:28:11 christos Exp $
13888# ncr:  file(1) magic for NCR Tower objects
13889#
13890# contributed by
13891# Michael R. Wayne  ***  TMC & Associates  ***  INTERNET: wayne@ford-vax.arpa
13892# uucp: {philabs | pyramid} !fmsrl7!wayne   OR   wayne@fmsrl7.UUCP
13893#
138940	beshort		000610	Tower/XP rel 2 object
13895>12	   belong		>0	not stripped
13896>20	   beshort		0407	executable
13897>20	   beshort		0410	pure executable
13898>22	   beshort		>0	- version %ld
138990	beshort		000615	Tower/XP rel 2 object
13900>12	   belong		>0	not stripped
13901>20	   beshort		0407	executable
13902>20	   beshort		0410	pure executable
13903>22	   beshort		>0	- version %ld
139040	beshort		000620	Tower/XP rel 3 object
13905>12	   belong		>0	not stripped
13906>20	   beshort		0407	executable
13907>20	   beshort		0410	pure executable
13908>22	   beshort		>0	- version %ld
139090	beshort		000625	Tower/XP rel 3 object
13910>12	   belong		>0	not stripped
13911>20	   beshort		0407	executable
13912>20	   beshort		0410	pure executable
13913>22	   beshort		>0	- version %ld
139140	beshort		000630	Tower32/600/400 68020 object
13915>12	   belong		>0	not stripped
13916>20	   beshort		0407	executable
13917>20	   beshort		0410	pure executable
13918>22	   beshort		>0	- version %ld
139190	beshort		000640	Tower32/800 68020
13920>18	   beshort		&020000	w/68881 object
13921>18	   beshort		&040000	compatible object
13922>18	   beshort		&060000	object
13923>20	   beshort		0407	executable
13924>20	   beshort		0413	pure executable
13925>12	   belong		>0	not stripped
13926>22	   beshort		>0	- version %ld
139270	beshort		000645	Tower32/800 68010
13928>18	   beshort		&040000	compatible object
13929>18	   beshort		&060000 object
13930>20	   beshort		0407	executable
13931>20	   beshort		0413	pure executable
13932>12	   belong		>0	not stripped
13933>22	   beshort		>0	- version %ld
13934
13935#------------------------------------------------------------------------------
13936# $File: netbsd,v 1.20 2013/01/09 22:37:24 christos Exp $
13937# netbsd:  file(1) magic for NetBSD objects
13938#
13939# All new-style magic numbers are in network byte order.
13940# The old-style magic numbers are indistinguishable from the same magic
13941# numbers used in other systems, and are handled, for all those systems,
13942# in aout.
13943#
13944
139450	belong&0377777777	041400413	a.out NetBSD/i386 demand paged
13946>0	byte			&0x80
13947>>20	lelong			<4096		shared library
13948>>20	lelong			=4096		dynamically linked executable
13949>>20	lelong			>4096		dynamically linked executable
13950>0	byte			^0x80		executable
13951>16	lelong			>0		not stripped
139520	belong&0377777777	041400410	a.out NetBSD/i386 pure
13953>0	byte			&0x80		dynamically linked executable
13954>0	byte			^0x80		executable
13955>16	lelong			>0		not stripped
139560	belong&0377777777	041400407	a.out NetBSD/i386
13957>0	byte			&0x80		dynamically linked executable
13958>0	byte			^0x80
13959>>0	byte			&0x40		position independent
13960>>20	lelong			!0		executable
13961>>20	lelong			=0		object file
13962>16	lelong			>0		not stripped
139630	belong&0377777777	041400507	a.out NetBSD/i386 core
13964>12	string			>\0		from '%s'
13965>32	lelong			!0		(signal %d)
13966
139670	belong&0377777777	041600413	a.out NetBSD/m68k demand paged
13968>0	byte			&0x80
13969>>20	belong			<8192		shared library
13970>>20	belong			=8192		dynamically linked executable
13971>>20	belong			>8192		dynamically linked executable
13972>0	byte			^0x80		executable
13973>16	belong			>0		not stripped
139740	belong&0377777777	041600410	a.out NetBSD/m68k pure
13975>0	byte			&0x80		dynamically linked executable
13976>0	byte			^0x80		executable
13977>16	belong			>0		not stripped
139780	belong&0377777777	041600407	a.out NetBSD/m68k
13979>0	byte			&0x80		dynamically linked executable
13980>0	byte			^0x80
13981>>0	byte			&0x40		position independent
13982>>20	belong			!0		executable
13983>>20	belong			=0		object file
13984>16	belong			>0		not stripped
139850	belong&0377777777	041600507	a.out NetBSD/m68k core
13986>12	string			>\0		from '%s'
13987>32	belong			!0		(signal %d)
13988
139890	belong&0377777777	042000413	a.out NetBSD/m68k4k demand paged
13990>0	byte			&0x80
13991>>20	belong			<4096		shared library
13992>>20	belong			=4096		dynamically linked executable
13993>>20	belong			>4096		dynamically linked executable
13994>0	byte			^0x80		executable
13995>16	belong			>0		not stripped
139960	belong&0377777777	042000410	a.out NetBSD/m68k4k pure
13997>0	byte			&0x80		dynamically linked executable
13998>0	byte			^0x80		executable
13999>16	belong			>0		not stripped
140000	belong&0377777777	042000407	a.out NetBSD/m68k4k
14001>0	byte			&0x80		dynamically linked executable
14002>0	byte			^0x80
14003>>0	byte			&0x40		position independent
14004>>20	belong			!0		executable
14005>>20	belong			=0		object file
14006>16	belong			>0		not stripped
140070	belong&0377777777	042000507	a.out NetBSD/m68k4k core
14008>12	string			>\0		from '%s'
14009>32	belong			!0		(signal %d)
14010
140110	belong&0377777777	042200413	a.out NetBSD/ns32532 demand paged
14012>0	byte			&0x80
14013>>20	lelong			<4096		shared library
14014>>20	lelong			=4096		dynamically linked executable
14015>>20	lelong			>4096		dynamically linked executable
14016>0	byte			^0x80		executable
14017>16	lelong			>0		not stripped
140180	belong&0377777777	042200410	a.out NetBSD/ns32532 pure
14019>0	byte			&0x80		dynamically linked executable
14020>0	byte			^0x80		executable
14021>16	lelong			>0		not stripped
140220	belong&0377777777	042200407	a.out NetBSD/ns32532
14023>0	byte			&0x80		dynamically linked executable
14024>0	byte			^0x80
14025>>0	byte			&0x40		position independent
14026>>20	lelong			!0		executable
14027>>20	lelong			=0		object file
14028>16	lelong			>0		not stripped
140290	belong&0377777777	042200507	a.out NetBSD/ns32532 core
14030>12	string			>\0		from '%s'
14031>32	lelong			!0		(signal %d)
14032
140330	belong&0377777777	045200507	a.out NetBSD/powerpc core
14034>12	string			>\0		from '%s'
14035
140360	belong&0377777777	042400413	a.out NetBSD/sparc demand paged
14037>0	byte			&0x80
14038>>20	belong			<8192		shared library
14039>>20	belong			=8192		dynamically linked executable
14040>>20	belong			>8192		dynamically linked executable
14041>0	byte			^0x80		executable
14042>16	belong			>0		not stripped
140430	belong&0377777777	042400410	a.out NetBSD/sparc pure
14044>0	byte			&0x80		dynamically linked executable
14045>0	byte			^0x80		executable
14046>16	belong			>0		not stripped
140470	belong&0377777777	042400407	a.out NetBSD/sparc
14048>0	byte			&0x80		dynamically linked executable
14049>0	byte			^0x80
14050>>0	byte			&0x40		position independent
14051>>20	belong			!0		executable
14052>>20	belong			=0		object file
14053>16	belong			>0		not stripped
140540	belong&0377777777	042400507	a.out NetBSD/sparc core
14055>12	string			>\0		from '%s'
14056>32	belong			!0		(signal %d)
14057
140580	belong&0377777777	042600413	a.out NetBSD/pmax demand paged
14059>0	byte			&0x80
14060>>20	lelong			<4096		shared library
14061>>20	lelong			=4096		dynamically linked executable
14062>>20	lelong			>4096		dynamically linked executable
14063>0	byte			^0x80		executable
14064>16	lelong			>0		not stripped
140650	belong&0377777777	042600410	a.out NetBSD/pmax pure
14066>0	byte			&0x80		dynamically linked executable
14067>0	byte			^0x80		executable
14068>16	lelong			>0		not stripped
140690	belong&0377777777	042600407	a.out NetBSD/pmax
14070>0	byte			&0x80		dynamically linked executable
14071>0	byte			^0x80
14072>>0	byte			&0x40		position independent
14073>>20	lelong			!0		executable
14074>>20	lelong			=0		object file
14075>16	lelong			>0		not stripped
140760	belong&0377777777	042600507	a.out NetBSD/pmax core
14077>12	string			>\0		from '%s'
14078>32	lelong			!0		(signal %d)
14079
140800	belong&0377777777	043000413	a.out NetBSD/vax 1k demand paged
14081>0	byte			&0x80
14082>>20	lelong			<4096		shared library
14083>>20	lelong			=4096		dynamically linked executable
14084>>20	lelong			>4096		dynamically linked executable
14085>0	byte			^0x80		executable
14086>16	lelong			>0		not stripped
140870	belong&0377777777	043000410	a.out NetBSD/vax 1k pure
14088>0	byte			&0x80		dynamically linked executable
14089>0	byte			^0x80		executable
14090>16	lelong			>0		not stripped
140910	belong&0377777777	043000407	a.out NetBSD/vax 1k
14092>0	byte			&0x80		dynamically linked executable
14093>0	byte			^0x80
14094>>0	byte			&0x40		position independent
14095>>20	lelong			!0		executable
14096>>20	lelong			=0		object file
14097>16	lelong			>0		not stripped
140980	belong&0377777777	043000507	a.out NetBSD/vax 1k core
14099>12	string			>\0		from '%s'
14100>32	lelong			!0		(signal %d)
14101
141020	belong&0377777777	045400413	a.out NetBSD/vax 4k demand paged
14103>0	byte			&0x80
14104>>20	lelong			<4096		shared library
14105>>20	lelong			=4096		dynamically linked executable
14106>>20	lelong			>4096		dynamically linked executable
14107>0	byte			^0x80		executable
14108>16	lelong			>0		not stripped
141090	belong&0377777777	045400410	a.out NetBSD/vax 4k pure
14110>0	byte			&0x80		dynamically linked executable
14111>0	byte			^0x80		executable
14112>16	lelong			>0		not stripped
141130	belong&0377777777	045400407	a.out NetBSD/vax 4k
14114>0	byte			&0x80		dynamically linked executable
14115>0	byte			^0x80
14116>>0	byte			&0x40		position independent
14117>>20	lelong			!0		executable
14118>>20	lelong			=0		object file
14119>16	lelong			>0		not stripped
141200	belong&0377777777	045400507	a.out NetBSD/vax 4k core
14121>12	string			>\0		from '%s'
14122>32	lelong			!0		(signal %d)
14123
14124# NetBSD/alpha does not support (and has never supported) a.out objects,
14125# so no rules are provided for them.  NetBSD/alpha ELF objects are
14126# dealt with in "elf".
141270	lelong		0x00070185		ECOFF NetBSD/alpha binary
14128>10	leshort		0x0001			not stripped
14129>10	leshort		0x0000			stripped
141300	belong&0377777777	043200507	a.out NetBSD/alpha core
14131>12	string			>\0		from '%s'
14132>32	lelong			!0		(signal %d)
14133
141340	belong&0377777777	043400413	a.out NetBSD/mips demand paged
14135>0	byte			&0x80
14136>>20	belong			<8192		shared library
14137>>20	belong			=8192		dynamically linked executable
14138>>20	belong			>8192		dynamically linked executable
14139>0	byte			^0x80		executable
14140>16	belong			>0		not stripped
141410	belong&0377777777	043400410	a.out NetBSD/mips pure
14142>0	byte			&0x80		dynamically linked executable
14143>0	byte			^0x80		executable
14144>16	belong			>0		not stripped
141450	belong&0377777777	043400407	a.out NetBSD/mips
14146>0	byte			&0x80		dynamically linked executable
14147>0	byte			^0x80
14148>>0	byte			&0x40		position independent
14149>>20	belong			!0		executable
14150>>20	belong			=0		object file
14151>16	belong			>0		not stripped
141520	belong&0377777777	043400507	a.out NetBSD/mips core
14153>12	string			>\0		from '%s'
14154>32	belong			!0		(signal %d)
14155
141560	belong&0377777777	043600413	a.out NetBSD/arm32 demand paged
14157>0	byte			&0x80
14158>>20	lelong			<4096		shared library
14159>>20	lelong			=4096		dynamically linked executable
14160>>20	lelong			>4096		dynamically linked executable
14161>0	byte			^0x80		executable
14162>16	lelong			>0		not stripped
141630	belong&0377777777	043600410	a.out NetBSD/arm32 pure
14164>0	byte			&0x80		dynamically linked executable
14165>0	byte			^0x80		executable
14166>16	lelong			>0		not stripped
141670	belong&0377777777	043600407	a.out NetBSD/arm32
14168>0	byte			&0x80		dynamically linked executable
14169>0	byte			^0x80
14170>>0	byte			&0x40		position independent
14171>>20	lelong			!0		executable
14172>>20	lelong			=0		object file
14173>16	lelong			>0		not stripped
14174# NetBSD/arm26 has always used ELF objects, but it shares a core file
14175# format with NetBSD/arm32.
141760	belong&0377777777	043600507	a.out NetBSD/arm core
14177>12	string			>\0		from '%s'
14178>32	lelong			!0		(signal %d)
14179
14180# Kernel core dump format
141810	belong&0x0000ffff 0x00008fca	NetBSD kernel core file
14182>0	belong&0x03ff0000 0x00000000	\b, Unknown
14183>0	belong&0x03ff0000 0x00001000	\b, sun 68010/68020
14184>0	belong&0x03ff0000 0x00020000	\b, sun 68020
14185>0	belong&0x03ff0000 0x00640000	\b, 386 PC
14186>0	belong&0x03ff0000 0x00860000	\b, i386 BSD
14187>0	belong&0x03ff0000 0x00870000	\b, m68k BSD (8K pages)
14188>0	belong&0x03ff0000 0x00880000	\b, m68k BSD (4K pages)
14189>0	belong&0x03ff0000 0x00890000	\b, ns32532 BSD
14190>0	belong&0x03ff0000 0x008a0000	\b, sparc/32 BSD
14191>0	belong&0x03ff0000 0x008b0000	\b, pmax BSD
14192>0	belong&0x03ff0000 0x008c0000	\b, vax BSD (1K pages)
14193>0	belong&0x03ff0000 0x008d0000	\b, alpha BSD
14194>0	belong&0x03ff0000 0x008e0000	\b, mips BSD (Big Endian)
14195>0	belong&0x03ff0000 0x008f0000	\b, arm6 BSD
14196>0	belong&0x03ff0000 0x00900000	\b, m68k BSD (2K pages)
14197>0	belong&0x03ff0000 0x00910000	\b, sh3 BSD
14198>0	belong&0x03ff0000 0x00920000	\b, ppc BSD (Big Endian)
14199>0	belong&0x03ff0000 0x00930000	\b, vax BSD (4K pages)
14200>0	belong&0x03ff0000 0x00940000	\b, mips1 BSD
14201>0	belong&0x03ff0000 0x00950000	\b, mips2 BSD
14202>0	belong&0x03ff0000 0x00960000	\b, parisc BSD
14203>0	belong&0x03ff0000 0x00970000	\b, sh5/64 BSD
14204>0	belong&0x03ff0000 0x00980000	\b, sparc/64 BSD
14205>0	belong&0x03ff0000 0x00990000	\b, amd64 BSD
14206>0	belong&0x03ff0000 0x009a0000	\b, hp200 (68010) BSD
14207>0	belong&0x03ff0000 0x009b0000	\b, hp300 (68020+68881) BSD
14208>0	belong&0x03ff0000 0x009b0000	\b, hp300 (68020+68881) BSD
14209>0	belong&0x03ff0000 0x00c80000	\b, hp200
14210>0	belong&0x03ff0000 0x020b0000	\b, hp300 (68020+68881) HP-UX
14211>0	belong&0x03ff0000 0x020c0000	\b, hp300 (68020+68881) HP-UX
14212>0	belong&0xfc000000 0x04000000	\b, CPU
14213>0	belong&0xfc000000 0x08000000	\b, DATA
14214>0	belong&0xfc000000 0x10000000	\b, STACK
14215>4	leshort	x			\b, (headersize = %d
14216>6	leshort	x			\b, segmentsize = %d
14217>6	lelong	x			\b, segments = %d)
14218
14219#------------------------------------------------------------------------------
14220# $File: netscape,v 1.6 2009/09/19 16:28:11 christos Exp $
14221# netscape:  file(1) magic for Netscape files
14222# "H. Nanosecond" <aldomel@ix.netcom.com>
14223# version 3 and 4 I think
14224#
14225
14226# Netscape Address book  .nab
142270	string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book
14228
14229# Netscape Communicator address book
142300   string   \000\017\102\111 Netscape Communicator address book
14231
14232# .snm Caches
142330	string		#\ Netscape\ folder\ cache	Netscape folder cache
142340	string	\000\036\204\220\000	Netscape folder cache
14235# .n2p
14236# Net 2 Phone
14237#0	string	123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
142380	string	SX961999	Net2phone
14239
14240#
14241#This is files ending in .art, FIXME add more rules
142420       string          JG\004\016\0\0\0\0      ART
14243
14244#------------------------------------------------------------------------------
14245# $File: netware,v 1.4 2009/09/19 16:28:11 christos Exp $
14246# netware:  file(1) magic for NetWare Loadable Modules (NLMs)
14247# From: Mads Martin Joergensen <mmj@suse.de>
14248
142490	string	NetWare\ Loadable\ Module	NetWare Loadable Module
14250
14251#------------------------------------------------------------------------------
14252# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $
14253# news:  file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
14254#
142550	string		StartFontMetrics	ASCII font metrics
142560	string		StartFont	ASCII font bits
142570	belong		0x137A2944	NeWS bitmap font
142580	belong		0x137A2947	NeWS font family
142590	belong		0x137A2950	scalable OpenFont binary
142600	belong		0x137A2951	encrypted scalable OpenFont binary
142618	belong		0x137A2B45	X11/NeWS bitmap font
142628	belong		0x137A2B48	X11/NeWS font family
14263
14264#------------------------------------------------------------------------------
14265# $File: nitpicker,v 1.4 2009/09/19 16:28:11 christos Exp $
14266# nitpicker:  file(1) magic for Flowfiles.
14267# From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de
142680	string	NPFF	NItpicker Flow File
14269>4	byte	x	V%d.
14270>5	byte	x	%d
14271>6	bedate	x	started: %s
14272>10	bedate	x	stopped: %s
14273>14	belong	x	Bytes: %u
14274>18	belong	x	Bytes1: %u
14275>22	belong	x	Flows: %u
14276>26	belong	x	Pkts: %u
14277
14278#------------------------------------------------------------------------------
14279# $File: oasis,v 1.1 2011/03/15 02:09:38 christos Exp $
14280# OASIS
14281# Summary: OASIS stream file
14282# Long descripton: Open Artwork System Interchange Standard
14283# File extension: .oas
14284# Full name:	Ben Cowley (bcowley@broadcom.com)
14285#		Philip Dixon (pdixon@broadcom.com)
14286# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf
14287#		(see page 3)
142880	string	%SEMI-OASIS\r\n		OASIS Stream file
14289
14290#------------------------------------------------------------------------------
14291# $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $
14292# ocaml: file(1) magic for Objective Caml files.
142930	string	Caml1999	OCaml
14294>8	string	X		exec file
14295>8	string	I		interface file (.cmi)
14296>8	string	O		object file (.cmo)
14297>8	string	A		library file (.cma)
14298>8	string	Y		native object file (.cmx)
14299>8	string	Z		native library file (.cmxa)
14300>8	string	M		abstract syntax tree implementation file
14301>8	string	N		abstract syntax tree interface file
14302>9	string	>\0		(Version %3.3s)
14303
14304#------------------------------------------------------------------------------
14305# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $
14306# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org>
143070	string		Octave-1-L	Octave binary data (little endian)
143080	string		Octave-1-B	Octave binary data (big endian)
14309
14310#------------------------------------------------------------------------------
14311# $File: ole2compounddocs,v 1.4 2009/09/19 16:28:11 christos Exp $
14312# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
14313# storage (http://en.wikipedia.org/wiki/Structured_Storage)
14314# Additional tests for OLE 2 Compound Documents should be under this recipe.
14315
143160   string  \320\317\021\340\241\261\032\341      OLE 2 Compound Document
14317# - Microstation V8 DGN files (www.bentley.com)
14318#   Last update on 10/23/2006 by Lester Hightower
14319> 0x480  string  D\000g\000n\000~\000H                : Microstation V8 DGN
14320# - Visio documents
14321#   Last update on 10/23/2006 by Lester Hightower
14322> 0x480  string  V\000i\000s\000i\000o\000D\000o\000c : Visio Document
14323
14324#------------------------------------------------------------------------------
14325# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $
14326# olf:  file(1) magic for OLF executables
14327#
14328# We have to check the byte order flag to see what byte order all the
14329# other stuff in the header is in.
14330#
14331# MIPS R3000 may also be for MIPS R2000.
14332# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
14333#
14334# Created by Erik Theisen <etheisen@openbsd.org>
14335# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com>
143360	string		\177OLF		OLF
14337>4	byte		0		invalid class
14338>4	byte		1		32-bit
14339>4	byte		2		64-bit
14340>7	byte		0		invalid os
14341>7	byte		1		OpenBSD
14342>7	byte		2		NetBSD
14343>7	byte		3		FreeBSD
14344>7	byte		4		4.4BSD
14345>7	byte		5		Linux
14346>7	byte		6		SVR4
14347>7	byte		7		esix
14348>7	byte		8		Solaris
14349>7	byte		9		Irix
14350>7	byte		10		SCO
14351>7	byte		11		Dell
14352>7	byte		12		NCR
14353>5	byte		0		invalid byte order
14354>5	byte		1		LSB
14355>>16	leshort		0		no file type,
14356>>16	leshort		1		relocatable,
14357>>16	leshort		2		executable,
14358>>16	leshort		3		shared object,
14359# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
14360# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
14361>>16	leshort		4		core file
14362>>>(0x38+0xcc) string	>\0		of '%s'
14363>>>(0x38+0x10) lelong	>0		(signal %d),
14364>>16	leshort		&0xff00		processor-specific,
14365>>18	leshort		0		no machine,
14366>>18	leshort		1		AT&T WE32100 - invalid byte order,
14367>>18	leshort		2		SPARC - invalid byte order,
14368>>18	leshort		3		Intel 80386,
14369>>18	leshort		4		Motorola 68000 - invalid byte order,
14370>>18	leshort		5		Motorola 88000 - invalid byte order,
14371>>18	leshort		6		Intel 80486,
14372>>18	leshort		7		Intel 80860,
14373>>18	leshort		8		MIPS R3000_BE - invalid byte order,
14374>>18	leshort		9		Amdahl - invalid byte order,
14375>>18	leshort		10		MIPS R3000_LE,
14376>>18	leshort		11		RS6000 - invalid byte order,
14377>>18	leshort		15		PA-RISC - invalid byte order,
14378>>18	leshort		16		nCUBE,
14379>>18	leshort		17		VPP500,
14380>>18	leshort		18		SPARC32PLUS,
14381>>18	leshort		20		PowerPC,
14382>>18	leshort		0x9026		Alpha,
14383>>20	lelong		0		invalid version
14384>>20	lelong		1		version 1
14385>>36	lelong		1		MathCoPro/FPU/MAU Required
14386>8	string		>\0		(%s)
14387>5	byte		2		MSB
14388>>16	beshort		0		no file type,
14389>>16	beshort		1		relocatable,
14390>>16	beshort		2		executable,
14391>>16	beshort		3		shared object,
14392>>16	beshort		4		core file,
14393>>>(0x38+0xcc) string	>\0		of '%s'
14394>>>(0x38+0x10) belong	>0		(signal %d),
14395>>16	beshort		&0xff00		processor-specific,
14396>>18	beshort		0		no machine,
14397>>18	beshort		1		AT&T WE32100,
14398>>18	beshort		2		SPARC,
14399>>18	beshort		3		Intel 80386 - invalid byte order,
14400>>18	beshort		4		Motorola 68000,
14401>>18	beshort		5		Motorola 88000,
14402>>18	beshort		6		Intel 80486 - invalid byte order,
14403>>18	beshort		7		Intel 80860,
14404>>18	beshort		8		MIPS R3000_BE,
14405>>18	beshort		9		Amdahl,
14406>>18	beshort		10		MIPS R3000_LE - invalid byte order,
14407>>18	beshort		11		RS6000,
14408>>18	beshort		15		PA-RISC,
14409>>18	beshort		16		nCUBE,
14410>>18	beshort		17		VPP500,
14411>>18	beshort		18		SPARC32PLUS,
14412>>18	beshort		20		PowerPC or cisco 4500,
14413>>18	beshort		21		cisco 7500,
14414>>18	beshort		24		cisco SVIP,
14415>>18	beshort		25		cisco 7200,
14416>>18	beshort		36		cisco 12000,
14417>>18	beshort		0x9026		Alpha,
14418>>20	belong		0		invalid version
14419>>20	belong		1		version 1
14420>>36	belong		1		MathCoPro/FPU/MAU Required
14421
14422#------------------------------------------------------------------------------
14423# $File: os2,v 1.7 2009/09/19 16:28:11 christos Exp $
14424# os2:  file(1) magic for OS/2 files
14425#
14426
14427# Provided 1998/08/22 by
14428# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
144291	search/1	InternetShortcut	MS Windows 95 Internet shortcut text
14430>24	search/1	>\ 			(URL=<%s>)
14431
14432# OS/2 URL objects
14433# Provided 1998/08/22 by
14434# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
14435#0	string	http:			OS/2 URL object text
14436#>5	string	>\			(WWW) <http:%s>
14437#0	string	mailto:			OS/2 URL object text
14438#>7	string	>\			(email) <%s>
14439#0	string	news:			OS/2 URL object text
14440#>5	string	>\			(Usenet) <%s>
14441#0	string	ftp:			OS/2 URL object text
14442#>4	string	>\			(FTP) <ftp:%s>
14443#0	string	file:			OS/2 URL object text
14444#>5	string	>\			(Local file) <%s>
14445
14446# >>>>> OS/2 INF/HLP <<<<<  (source: Daniel Dissett ddissett@netcom.com)
14447# Carl Hauser (chauser.parc@xerox.com) and
14448# Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
14449# list the following header format in inf02a.doc:
14450#
14451#  int16 ID;           // ID magic word (5348h = "HS")
14452#  int8  unknown1;     // unknown purpose, could be third letter of ID
14453#  int8  flags;        // probably a flag word...
14454#                      //  bit 0: set if INF style file
14455#                      //  bit 4: set if HLP style file
14456#                      // patching this byte allows reading HLP files
14457#                      // using the VIEW command, while help files
14458#                      // seem to work with INF settings here as well.
14459#  int16 hdrsize;      // total size of header
14460#  int16 unknown2;     // unknown purpose
14461#
144620   string  HSP\x01\x9b\x00 OS/2 INF
14463>107 string >0                      (%s)
144640   string  HSP\x10\x9b\x00     OS/2 HLP
14465>107 string >0                      (%s)
14466
14467# OS/2 INI (this is a guess)
144680  string   \xff\xff\xff\xff\x14\0\0\0  OS/2 INI
14469
14470#------------------------------------------------------------------------------
14471# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $
14472# os400:  file(1) magic for IBM OS/400 files
14473#
14474# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com
14475# In spite of its quite variable format (due to internal memory page
14476# length differences between CISC and RISC versions of the OS) the
14477# SAVF structure hasn't suitable offsets to identify the catalog
14478# header in the first descriptor where there are some useful infos,
14479# so we must search in a somewhat large area for a particular string
14480# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore
14481# descriptor space) preceded by a two byte constant.
14482#
144831090	 search/7393	\x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data
14484>&212	 byte		0x01			 \b, created with SAVOBJ
14485>&212	 byte		0x02			 \b, created with SAVLIB
14486>&212	 byte		0x07			 \b, created with SAVCFG
14487>&212	 byte		0x08			 \b, created with SAVSECDTA
14488>&212	 byte		0x0A			 \b, created with SAVSECDTA
14489>&212	 byte		0x0B			 \b, created with SAVDLO
14490>&212	 byte		0x0D			 \b, created with SAVLICPGM
14491>&212	 byte		0x11			 \b, created with SAVCHGOBJ
14492>&213	 byte		0x44			 \b, at least V5R4 to open
14493>&213	 byte		0x43			 \b, at least V5R3 to open
14494>&213	 byte		0x42			 \b, at least V5R2 to open
14495>&213	 byte		0x41			 \b, at least V5R1 to open
14496>&213	 byte		0x40			 \b, at least V4R5 to open
14497>&213	 byte		0x3F			 \b, at least V4R4 to open
14498>&213	 byte		0x3E			 \b, at least V4R3 to open
14499>&213	 byte		0x3C			 \b, at least V4R2 to open
14500>&213	 byte		0x3D			 \b, at least V4R1M4 to open
14501>&213	 byte		0x3B			 \b, at least V4R1 to open
14502>&213	 byte		0x3A			 \b, at least V3R7 to open
14503>&213	 byte		0x35			 \b, at least V3R6 to open
14504>&213	 byte		0x36			 \b, at least V3R2 to open
14505>&213	 byte		0x34			 \b, at least V3R1 to open
14506>&213	 byte		0x31			 \b, at least V3R0M5 to open
14507>&213	 byte		0x30			 \b, at least V2R3 to open
14508
14509#------------------------------------------------------------------------------
14510# $File: os9,v 1.7 2011/05/13 22:15:54 christos Exp $
14511#
14512# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
14513#
14514# Redistribution and use in source and binary forms, with or without
14515# modification, are permitted provided that the following conditions
14516# are met:
14517# 1. Redistributions of source code must retain the above copyright
14518#    notice, this list of conditions and the following disclaimer.
14519# 2. Redistributions in binary form must reproduce the above copyright
14520#    notice, this list of conditions and the following disclaimer in the
14521#    documentation and/or other materials provided with the distribution.
14522#
14523# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14524# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
14525# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
14526# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
14527# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
14528# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
14529# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
14530# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
14531# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
14532# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
14533#
14534#
14535#
14536# OS9/6809 module descriptions:
14537#
145380	beshort		0x87CD	OS9/6809 module:
14539#
14540>6	byte&0x0f	0x00	non-executable
14541>6	byte&0x0f	0x01	machine language
14542>6	byte&0x0f	0x02	BASIC I-code
14543>6	byte&0x0f	0x03	Pascal P-code
14544>6	byte&0x0f	0x04	C I-code
14545>6	byte&0x0f	0x05	COBOL I-code
14546>6	byte&0x0f	0x06	Fortran I-code
14547#
14548>6	byte&0xf0	0x10	program executable
14549>6	byte&0xf0	0x20	subroutine
14550>6	byte&0xf0	0x30	multi-module
14551>6	byte&0xf0	0x40	data module
14552#
14553>6	byte&0xf0	0xC0	system module
14554>6	byte&0xf0	0xD0	file manager
14555>6	byte&0xf0	0xE0	device driver
14556>6	byte&0xf0	0xF0	device descriptor
14557#
14558# OS9/m68k stuff (to be continued)
14559#
145600	beshort		0x4AFC	OS9/68K module:
14561#
14562# attr
14563>0x14	byte&0x80	0x80	re-entrant
14564>0x14	byte&0x40	0x40	ghost
14565>0x14	byte&0x20	0x20	system-state
14566#
14567# lang:
14568#
14569>0x13	byte		1	machine language
14570>0x13	byte		2	BASIC I-code
14571>0x13	byte		3	Pascal P-code
14572>0x13	byte		4	C I-code
14573>0x13	byte		5	COBOL I-code
14574>0x13	byte		6	Fortran I-code
14575#
14576#
14577# type:
14578#
14579>0x12	byte		1	program executable
14580>0x12	byte		2	subroutine
14581>0x12	byte		3	multi-module
14582>0x12	byte		4	data module
14583>0x12	byte		11	trap library
14584>0x12	byte		12	system module
14585>0x12	byte		13	file manager
14586>0x12	byte		14	device driver
14587>0x12	byte		15	device descriptor
14588
14589#------------------------------------------------------------------------------
14590# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $
14591#
14592# Mach magic number info
14593#
145940	long		0xefbe	OSF/Rose object
14595# I386 magic number info
14596#
145970	short		0565	i386 COFF object
14598
14599#------------------------------------------------------------------------------
14600# $File: palm,v 1.9 2012/01/16 15:16:43 christos Exp $
14601# palm:	 file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
14602#
14603# Brian Lalor <blalor@hcirisc.cs.binghamton.edu>
14604
14605# These are weak, byte 59 is not guaranteed to be 0 and there are
14606# 8 character identifiers at byte 60, one I found for appl is BIGb.
14607# What are the possibilities and where is this documented?
14608
14609# appl
14610#59	byte			\0
14611#>60	string			appl		PalmOS application
14612#>0	string			>\0		"%s"
14613# TEXt
14614#59	byte			\0
14615#>60	belong			TEXt		AportisDoc file
14616#>0	string			>\0		"%s"
14617# HACK
14618#59	byte			\0
14619#>60	string			HACK		HackMaster hack
14620#>0	string			>\0		"%s"
14621
14622# Variety of PalmOS document types
14623# Michael-John Turner <mj@debian.org>
14624# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType
1462560	string			BVokBDIC	BDicty PalmOS document
14626>0	string			>\0		"%s"
1462760	string			DB99DBOS	DB PalmOS document
14628>0	string			>\0		"%s"
1462960	string			vIMGView	FireViewer/ImageViewer PalmOS document
14630>0	string			>\0		"%s"
1463160	string			PmDBPmDB	HanDBase PalmOS document
14632>0	string			>\0		"%s"
1463360	string			InfoINDB	InfoView PalmOS document
14634>0	string			>\0		"%s"
1463560	string			ToGoToGo	iSilo PalmOS document
14636>0	string			>\0		"%s"
1463760	string			JfDbJBas	JFile PalmOS document
14638>0	string			>\0		"%s"
1463960	string			JfDbJFil	JFile Pro PalmOS document
14640>0	string			>\0		"%s"
1464160	string			DATALSdb	List PalmOS document
14642>0	string			>\0		"%s"
1464360	string			Mdb1Mdb1	MobileDB PalmOS document
14644>0	string			>\0		"%s"
1464560	string			PNRdPPrs	PeanutPress PalmOS document
14646>0	string			>\0		"%s"
1464760	string			DataPlkr	Plucker PalmOS document
14648>0	string			>\0		"%s"
1464960	string			DataSprd	QuickSheet PalmOS document
14650>0	string			>\0		"%s"
1465160	string			SM01SMem	SuperMemo PalmOS document
14652>0	string			>\0		"%s"
1465360	string			TEXtTlDc	TealDoc PalmOS document
14654>0	string			>\0		"%s"
1465560	string			InfoTlIf	TealInfo PalmOS document
14656>0	string			>\0		"%s"
1465760	string			DataTlMl	TealMeal PalmOS document
14658>0	string			>\0		"%s"
1465960	string			DataTlPt	TealPaint PalmOS document
14660>0	string			>\0		"%s"
1466160	string			dataTDBP	ThinkDB PalmOS document
14662>0	string			>\0		"%s"
1466360	string			TdatTide	Tides PalmOS document
14664>0	string			>\0		"%s"
1466560	string			ToRaTRPW	TomeRaider PalmOS document
14666>0	string			>\0		"%s"
14667
14668# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net)
14669# For version 1.xx zTXTs, outputs version and numbers of bookmarks and
14670#   annotations.
14671# For other versions, just outputs version.
14672#
1467360		string		zTXT		A GutenPalm zTXT e-book
14674>0		string		>\0		"%s"
14675>(0x4E.L)	byte		0
14676>>(0x4E.L+1)	byte		x		(v0.%02d)
14677>(0x4E.L)	byte		1
14678>>(0x4E.L+1)	byte		x		(v1.%02d)
14679>>>(0x4E.L+10)	beshort		>0
14680>>>>(0x4E.L+10) beshort		<2		- 1 bookmark
14681>>>>(0x4E.L+10) beshort		>1		- %d bookmarks
14682>>>(0x4E.L+14)	beshort		>0
14683>>>>(0x4E.L+14) beshort		<2		- 1 annotation
14684>>>>(0x4E.L+14) beshort		>1		- %d annotations
14685>(0x4E.L)	byte		>1		(v%d.
14686>>(0x4E.L+1)	byte		x		%02d)
14687
14688# Palm OS .prc file types
1468960		string		libr		Palm OS dynamic library data
14690>0		string		>\0		"%s"
1469160		string		ptch		Palm OS operating system patch data
14692>0		string		>\0		"%s"
14693
14694# Mobipocket (www.mobipocket.com), donated by Carl Witty
1469560	string			BOOKMOBI	Mobipocket E-book
14696>0	string			>\0		"%s"
14697
14698#------------------------------------------------------------------------------
14699# $File: parix,v 1.4 2009/09/19 16:28:11 christos Exp $
14700#
14701# Parix COFF executables
14702# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de>
14703#
147040	beshort&0xfff	0xACE	PARIX
14705>0	byte&0xf0	0x80	T800
14706>0	byte&0xf0	0x90	T9000
14707>19	byte&0x02	0x02	executable
14708>19	byte&0x02	0x00	object
14709>19	byte&0x0c	0x00	not stripped
14710#------------------------------------------------------------------------------
14711# $File: parrot,v 1.1 2010/07/08 20:18:40 christos Exp $
14712# parrot: file(1) magic for Parrot Virtual Machine
14713# URL:	http://www.lua.org/
14714# From: Lubomir Rintel <lkundrak@v3.sk>
14715
14716# Compiled Parrot byte code
147170	string	\376PBC\r\n\032\n	Parrot bytecode
14718>64	byte	x			%d.
14719>72	byte	x			\b%d,
14720>8	byte	>0			%d byte words,
14721>16	byte	0			little-endian,
14722>16	byte	1			big-endian,
14723>32	byte	0			IEEE-754 8 byte double floats,
14724>32	byte	1			x86 12 byte long double floats,
14725>32	byte	2			IEEE-754 16 byte long double floats,
14726>32	byte	3			MIPS 16 byte long double floats,
14727>32	byte	4			AIX 16 byte long double floats,
14728>32	byte	5			4-byte floats,
14729>40	byte	x			Parrot %d.
14730>48	byte	x			\b%d.
14731>56	byte	x			\b%d
14732#------------------------------------------------------------------------------
14733# $File: pascal,v 1.1 2011/12/08 12:12:46 rrt Exp $
14734# pascal:  file(1) magic for Pascal source
14735#
147360	search/8192	(input,		Pascal source text
14737!:mime	text/x-pascal
147380	regex		\^program	Pascal source text
14739!:mime	text/x-pascal
147400	regex           	\^record		Pascal source text
14741!:mime	text/x-pascal
14742
14743#------------------------------------------------------------------------------
14744# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $
14745# pbm:  file(1) magic for Portable Bitmap files
14746#
14747# XXX - byte order?
14748#
147490	short	0x2a17	"compact bitmap" format (Poskanzer)
14750
14751#------------------------------------------------------------------------------
14752# $File: pdf,v 1.6 2009/09/19 16:28:11 christos Exp $
14753# pdf:  file(1) magic for Portable Document Format
14754#
14755
147560	string		%PDF-		PDF document
14757!:mime	application/pdf
14758>5	byte		x		\b, version %c
14759>7	byte		x		\b.%c
14760
14761# From: Nick Schmalenberger <nick@schmalenberger.us>
14762# Forms Data Format
147630       string          %FDF-           FDF document
14764>5      byte            x               \b, version %c
14765>7      byte            x               \b.%c
14766
14767#------------------------------------------------------------------------------
14768# $File: pdp,v 1.8 2009/09/19 16:28:11 christos Exp $
14769# pdp:  file(1) magic for PDP-11 executable/object and APL workspace
14770#
147710	lelong		0101555		PDP-11 single precision APL workspace
147720	lelong		0101554		PDP-11 double precision APL workspace
14773#
14774# PDP-11 a.out
14775#
147760	leshort		0407		PDP-11 executable
14777>8	leshort		>0		not stripped
14778>15	byte		>0		- version %ld
14779
147800	leshort		0401		PDP-11 UNIX/RT ldp
147810	leshort		0405		PDP-11 old overlay
14782
147830	leshort		0410		PDP-11 pure executable
14784>8	leshort		>0		not stripped
14785>15	byte		>0		- version %ld
14786
147870	leshort		0411		PDP-11 separate I&D executable
14788>8	leshort		>0		not stripped
14789>15	byte		>0		- version %ld
14790
147910	leshort		0437		PDP-11 kernel overlay
14792
14793# These last three are derived from 2.11BSD file(1)
147940	leshort		0413		PDP-11 demand-paged pure executable
14795>8	leshort		>0		not stripped
14796
147970	leshort		0430		PDP-11 overlaid pure executable
14798>8	leshort		>0		not stripped
14799
148000	leshort		0431		PDP-11 overlaid separate executable
14801>8	leshort		>0		not stripped
14802#------------------------------------------------------------------------------
14803# $File: perl,v 1.20 2012/06/21 01:16:49 christos Exp $
14804# perl:  file(1) magic for Larry Wall's perl language.
14805#
14806# The `eval' lines recognizes an outrageously clever hack.
14807# Keith Waclena <keith@cerberus.uchicago.edu>
14808# Send additions to <perl5-porters@perl.org>
148090	search/1/w	#!\ /bin/perl			Perl script text executable
14810!:mime	text/x-perl
148110	search/1	eval\ "exec\ /bin/perl		Perl script text
14812!:mime	text/x-perl
148130	search/1/w	#!\ /usr/bin/perl		Perl script text executable
14814!:mime	text/x-perl
148150	search/1	eval\ "exec\ /usr/bin/perl	Perl script text
14816!:mime	text/x-perl
148170	search/1/w	#!\ /usr/local/bin/perl		Perl script text executable
14818!:mime	text/x-perl
148190	search/1	eval\ "exec\ /usr/local/bin/perl	Perl script text
14820!:mime	text/x-perl
148210	search/1	eval\ '(exit\ $?0)'\ &&\ eval\ 'exec	Perl script text
14822!:mime	text/x-perl
148230	search/1	#!/usr/bin/env\ perl	Perl script text executable
14824!:mime	text/x-perl
148250	search/1	#!\ /usr/bin/env\ perl	Perl script text executable
14826!:mime	text/x-perl
14827
14828# by Dmitry V. Levin and Alexey Tourbin
14829# check the first line
148300	search/1	package
14831>0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;	Perl5 module source text
14832!:strength + 10
14833# not 'p', check other lines
148340	search/1	!p
14835>0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;
14836>>0	regex		\^1\ *;|\^(use|sub|my)\ .*[(;{=]	Perl5 module source text
14837!:strength + 10
14838
14839# Perl POD documents
14840# From: Tom Hukins <tom@eborcom.com>
148410	search/1/W	\=pod\n		Perl POD document text
148420	search/1/W	\n\=pod\n	Perl POD document text
148430	search/1/W	\=head1\ 	Perl POD document text
148440	search/1/W	\n\=head1\ 	Perl POD document text
148450	search/1/W	\=head2\ 	Perl POD document text
148460	search/1/W	\n\=head2\ 	Perl POD document text
148470	search/1/W	\=encoding\ 	Perl POD document text
148480	search/1/W	\n\=encoding\ 	Perl POD document text
14849
14850
14851# Perl Storable data files.
148520	string	perl-store	perl Storable (v0.6) data
14853>4	byte	>0	(net-order %d)
14854>>4	byte	&01	(network-ordered)
14855>>4	byte	=3	(major 1)
14856>>4	byte	=2	(major 1)
14857
148580	string	pst0	perl Storable (v0.7) data
14859>4	byte	>0
14860>>4	byte	&01	(network-ordered)
14861>>4	byte	=5	(major 2)
14862>>4	byte	=4	(major 2)
14863>>5	byte	>0	(minor %d)
14864
14865#------------------------------------------------------------------------------
14866# $File: pgp,v 1.9 2009/09/19 16:28:11 christos Exp $
14867# pgp:  file(1) magic for Pretty Good Privacy
14868# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
14869#
148700       beshort         0x9900                  PGP key public ring
14871!:mime	application/x-pgp-keyring
148720       beshort         0x9501                  PGP key security ring
14873!:mime	application/x-pgp-keyring
148740       beshort         0x9500                  PGP key security ring
14875!:mime	application/x-pgp-keyring
148760	beshort		0xa600			PGP encrypted data
14877#!:mime	application/pgp-encrypted
14878#0	string		-----BEGIN\040PGP	text/PGP armored data
14879!:mime	text/PGP # encoding: armored data
14880#>15	string	PUBLIC\040KEY\040BLOCK-	public key block
14881#>15	string	MESSAGE-		message
14882#>15	string	SIGNED\040MESSAGE-	signed message
14883#>15	string	PGP\040SIGNATURE-	signature
14884
148852	string	---BEGIN\ PGP\ PUBLIC\ KEY\ BLOCK-	PGP public key block
14886!:mime	application/pgp-keys
148870	string	-----BEGIN\040PGP\40MESSAGE-		PGP message
14888!:mime	application/pgp
148890	string	-----BEGIN\040PGP\40SIGNATURE-		PGP signature
14890!:mime	application/pgp-signature
14891
14892#------------------------------------------------------------------------------
14893# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $
14894# pkgadd:  file(1) magic for SysV R4 PKG Datastreams
14895#
148960       string          #\ PaCkAgE\ DaTaStReAm  pkg Datastream (SVR4)
14897!:mime	application/x-svr4-package
14898
14899#------------------------------------------------------------------------------
14900# $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $
14901# plan9:  file(1) magic for AT&T Bell Labs' Plan 9 executables
14902# From: "Stefan A. Haubenthal" <polluks@web.de>
14903#
149040	belong		0x00000107	Plan 9 executable, Motorola 68k
149050	belong		0x000001EB	Plan 9 executable, Intel 386
149060	belong		0x00000247	Plan 9 executable, Intel 960
149070	belong		0x000002AB	Plan 9 executable, SPARC
149080	belong		0x00000407	Plan 9 executable, MIPS R3000
149090	belong		0x0000048B	Plan 9 executable, AT&T DSP 3210
149100	belong		0x00000517	Plan 9 executable, MIPS R4000 BE
149110	belong		0x000005AB	Plan 9 executable, AMD 29000
149120	belong		0x00000647	Plan 9 executable, ARM 7-something
149130	belong		0x000006EB	Plan 9 executable, PowerPC
149140	belong		0x00000797	Plan 9 executable, MIPS R4000 LE
149150	belong		0x0000084B	Plan 9 executable, DEC Alpha
14916
14917#------------------------------------------------------------------------------
14918# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $
14919# plus5:  file(1) magic for Plus Five's UNIX MUMPS
14920#
14921# XXX - byte order?  Paging Hokey....
14922#
149230	short		0x259		mumps avl global
14924>2	byte		>0		(V%d)
14925>6	byte		>0		with %d byte name
14926>7	byte		>0		and %d byte data cells
149270	short		0x25a		mumps blt global
14928>2	byte		>0		(V%d)
14929>8	short		>0		- %d byte blocks
14930>15	byte		0x00		- P/D format
14931>15	byte		0x01		- P/K/D format
14932>15	byte		0x02		- K/D format
14933>15	byte		>0x02		- Bad Flags
14934
14935#------------------------------------------------------------------------------
14936# $File: printer,v 1.25 2011/05/20 23:31:46 christos Exp $
14937# printer:  file(1) magic for printer-formatted files
14938#
14939
14940# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
149410	string		%!		PostScript document text
14942!:mime	application/postscript
14943!:apple	ASPSTEXT
14944>2	string		PS-Adobe-	conforming
14945>>11	string		>\0		DSC level %.3s
14946>>>15	string		EPS		\b, type %s
14947>>>15	string		Query		\b, type %s
14948>>>15	string		ExitServer	\b, type %s
14949>>>15   search/1000		%%LanguageLevel:\
14950>>>>&0	string		>\0		\b, Level %s
14951# Some PCs have the annoying habit of adding a ^D as a document separator
149520	string		\004%!		PostScript document text
14953!:mime	application/postscript
14954!:apple	ASPSTEXT
14955>3	string		PS-Adobe-	conforming
14956>>12	string		>\0		DSC level %.3s
14957>>>16	string		EPS		\b, type %s
14958>>>16	string		Query		\b, type %s
14959>>>16	string		ExitServer	\b, type %s
14960>>>16   search/1000		%%LanguageLevel:\
14961>>>>&0	string		>\0		\b, Level %s
149620	string		\033%-12345X%!PS	PostScript document
14963
14964# DOS EPS Binary File Header
14965# From: Ed Sznyter <ews@Black.Market.NET>
149660       belong          0xC5D0D3C6      DOS EPS Binary File
14967>4      long            >0              Postscript starts at byte %d
14968>>8     long            >0              length %d
14969>>>12   long            >0              Metafile starts at byte %d
14970>>>>16  long            >0              length %d
14971>>>20   long            >0              TIFF starts at byte %d
14972>>>>24  long            >0              length %d
14973
14974# Summary: Adobe's PostScript Printer Description File
14975# Extension: .ppd
14976# Reference: http://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8
14977# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr>
14978#
149790	string		*PPD-Adobe:\x20	PPD file
14980>&0	string		x		\b, version %s
14981
14982# HP Printer Job Language
149830	string		\033%-12345X@PJL	HP Printer Job Language data
14984# HP Printer Job Language
14985# The header found on Win95 HP plot files is the "Silliest Thing possible"
14986# (TM)
14987# Every driver puts the language at some random position, with random case
14988# (LANGUAGE and Language)
14989# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
14990# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
14991#
149920	string		\033%-12345X@PJL	HP Printer Job Language data
14993>&0	string		>\0			%s
14994>>&0	string		>\0			%s
14995>>>&0	string		>\0			%s
14996>>>>&0	string		>\0			%s
14997#>15	string		\ ENTER\ LANGUAGE\ =
14998#>31	string		PostScript		PostScript
14999
15000# From: Stefan Thurner <thurners@nicsys.de>
150010	string		\033%-12345X@PJL
15002>&0	search/10000	%!			PJL encapsulated PostScript document text
15003
15004# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
150050	string		\033E\033	HP PCL printer data
15006>3	string		\&l0A		- default page size
15007>3	string		\&l1A		- US executive page size
15008>3	string		\&l2A		- US letter page size
15009>3	string		\&l3A		- US legal page size
15010>3	string		\&l26A		- A4 page size
15011>3	string		\&l80A		- Monarch envelope size
15012>3	string		\&l81A		- No. 10 envelope size
15013>3	string		\&l90A		- Intl. DL envelope size
15014>3	string		\&l91A		- Intl. C5 envelope size
15015>3	string		\&l100A		- Intl. B5 envelope size
15016>3	string		\&l-81A		- No. 10 envelope size (landscape)
15017>3	string		\&l-90A		- Intl. DL envelope size (landscape)
15018
15019# IMAGEN printer-ready files:
150200	string	@document(		Imagen printer
15021# this only works if "language xxx" is first item in Imagen header.
15022>10	string	language\ impress	(imPRESS data)
15023>10	string	language\ daisy		(daisywheel text)
15024>10	string	language\ diablo	(daisywheel text)
15025>10	string	language\ printer	(line printer emulation)
15026>10	string	language\ tektronix	(Tektronix 4014 emulation)
15027# Add any other languages that your Imagen uses - remember
15028# to keep the word `text' if the file is human-readable.
15029# [GRR 950115:  missing "postscript" or "ultrascript" (whatever it was called)]
15030#
15031# Now magic for IMAGEN font files...
150320	string		Rast		RST-format raster font data
15033>45	string		>0		face %s
15034# From Jukka Ukkonen
150350	string		\033[K\002\0\0\017\033(a\001\0\001\033(g	Canon Bubble Jet BJC formatted data
15036
15037# From <mike@flyn.org>
15038# These are the /etc/magic entries to decode data sent to an Epson printer.
150390       string          \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P        Epson Stylus Color 460 data
15040
15041
15042#------------------------------------------------------------------------------
15043# zenographics:  file(1) magic for Zenographics ZjStream printer data
15044# Rick Richardson  rickr@mn.rr.com
150450	string		JZJZ
15046>0x12	string		ZZ		Zenographics ZjStream printer data (big-endian)
150470	string		ZJZJ
15048>0x12	string		ZZ		Zenographics ZjStream printer data (little-endian)
15049
15050
15051#------------------------------------------------------------------------------
15052# Oak Technologies printer stream
15053# Rick Richardson <rickr@mn.rr.com>
150540       string          OAK
15055>0x07	byte		0
15056>0x0b	byte		0	Oak Technologies printer stream
15057
15058# This would otherwise be recognized as PostScript - nick@debian.org
150590	string		%!VMF 		SunClock's Vector Map Format data
15060
15061#------------------------------------------------------------------------------
15062# HP LaserJet 1000 series downloadable firmware file
150630	string	\xbe\xefABCDEFGH	HP LaserJet 1000 series downloadable firmware
15064
15065# From: Paolo <oopla@users.sf.net>
15066# Epson ESC/Page, ESC/PageColor
150670	string	\x1b\x01@EJL	Epson ESC/Page language printer data
15068
15069#------------------------------------------------------------------------------
15070# $File: project,v 1.4 2009/09/19 16:28:11 christos Exp $
15071# project:  file(1) magic for Project management
15072#
15073# Magic strings for ftnchek project files. Alexander Mai
150740	string	FTNCHEK_\ P	project file for ftnchek
15075>10	string	1		version 2.7
15076>10	string	2		version 2.8 to 2.10
15077>10	string	3		version 2.11 or later
15078
15079#------------------------------------------------------------------------------
15080# $File: psdbms,v 1.6 2009/09/19 16:28:11 christos Exp $
15081# psdbms:  file(1) magic for psdatabase
15082#
150830	belong&0xff00ffff	0x56000000	ps database
15084>1	string	>\0	version %s
15085>4	string	>\0	from kernel %s
15086
15087#------------------------------------------------------------------------------
15088# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $
15089# pulsar:  file(1) magic for Pulsar POP3 daemon binary files
15090#
15091# http://pulsar.sourceforge.net
15092# mailto:rok.papez@lugos.si
15093#
15094
150950	belong	0x1ee7f11e	Pulsar POP3 daemon mailbox cache file.
15096>4	ubelong	x		Version: %d.
15097>8	ubelong	x		\b%d
15098
15099
15100#------------------------------------------------------------------------------
15101# $File: pwsafe,v 1.1 2012/10/25 00:12:19 christos Exp $
15102# pwsafe: file(1) magic for passwordsafe file
15103#
15104# Password Safe
15105# http://passwordsafe.sourceforge.net/
15106# file format specs
15107# http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt
15108# V2 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt
15109# V1 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt
15110# V2 and V1 have no easy identifier that I can find
15111# .psafe3
151120	string	PWS3	Password Safe V3 database
15113
15114#------------------------------------------------------------------------------
15115# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $
15116# pyramid:  file(1) magic for Pyramids
15117#
15118# XXX - byte order?
15119#
151200	long		0x50900107	Pyramid 90x family executable
151210	long		0x50900108	Pyramid 90x family pure executable
15122>16	long		>0		not stripped
151230	long		0x5090010b	Pyramid 90x family demand paged pure executable
15124>16	long		>0		not stripped
15125
15126#------------------------------------------------------------------------------
15127# $File: python,v 1.22 2013/03/18 12:49:55 christos Exp $
15128# python:  file(1) magic for python
15129#
15130# Outlook puts """ too for urgent messages
15131# From: David Necas <yeti@physics.muni.cz>
15132# often the module starts with a multiline string
151330	string/t	"""	Python script text executable
15134# MAGIC as specified in Python/import.c (1.5 to 2.7a0 and 3.1a0, assuming
15135# that Py_UnicodeFlag is off for Python 2)
15136# 20121  ( YEAR - 1995 ) + MONTH  + DAY (little endian followed by "\r\n"
151370	belong		0x994e0d0a	python 1.5/1.6 byte-compiled
151380	belong		0x87c60d0a	python 2.0 byte-compiled
151390	belong		0x2aeb0d0a	python 2.1 byte-compiled
151400	belong		0x2ded0d0a	python 2.2 byte-compiled
151410	belong		0x3bf20d0a	python 2.3 byte-compiled
151420	belong		0x6df20d0a	python 2.4 byte-compiled
151430	belong		0xb3f20d0a	python 2.5 byte-compiled
151440	belong		0xd1f20d0a	python 2.6 byte-compiled
151450	belong		0x03f30d0a	python 2.7 byte-compiled
151460	belong		0x3b0c0d0a	python 3.0 byte-compiled
151470	belong		0x4f0c0d0a	python 3.1 byte-compiled
151480	belong		0x6c0c0d0a	python 3.2 byte-compiled
151490	belong		0x9e0c0d0a	python 3.3 byte-compiled
15150
151510	search/1/w	#!\ /usr/bin/python	Python script text executable
15152!:mime text/x-python
151530	search/1/w	#!\ /usr/local/bin/python	Python script text executable
15154!:mime text/x-python
151550	search/1	#!/usr/bin/env\ python	Python script text executable
15156!:mime text/x-python
151570	search/1	#!\ /usr/bin/env\ python	Python script text executable
15158!:mime text/x-python
15159
15160
15161# from module.submodule import func1, func2
151620	regex	\^from\\s+(\\w|\\.)+\\s+import.*$	Python script text executable
15163!:mime text/x-python
15164
15165# def __init__ (self, ...):
151660	search/4096	def\ __init__
15167>&0	search/64 self	Python script text executable
15168!:mime text/x-python
15169
15170# comments
151710	search/4096	'''
15172>&0	regex	.*'''$	Python script text executable
15173!:mime text/x-python
15174
151750	search/4096	"""
15176>&0	regex	.*"""$	Python script text executable
15177!:mime text/x-python
15178
15179# try:
15180# except: or finally:
15181# block
151820	search/4096	try:
15183>&0	regex	\^\\s*except.*:	Python script text executable
15184!:mime text/x-python
15185>&0	search/4096	finally:	Python script text executable
15186!:mime text/x-python
15187
15188# def name(args, args):
151890	regex	 \^(\ |\\t)*def\ +[a-zA-Z]+
15190>&0	regex	\ *\\(([a-zA-Z]|,|\ )*\\):$ Python script text executable
15191!:mime text/x-python
15192
15193#------------------------------------------------------------------------------
15194# $File: revision,v 1.9 2013/02/06 14:18:52 christos Exp $
15195# file(1) magic for revision control files
15196# From Hendrik Scholz <hendrik@scholz.net>
151970	string/t	/1\ :pserver:	cvs password text file
15198
15199# Conary changesets
15200# From: Jonathan Smith <smithj@rpath.com>
152010	belong	0xea3f81bb	Conary changeset data
15202
15203# Type: Git bundles (git-bundle)
15204# From: Josh Triplett <josh@freedesktop.org>
152050	string	#\ v2\ git\ bundle\n	Git bundle
15206
15207# Type: Git pack
15208# From: Adam Buchbinder <adam.buchbinder@gmail.com>
15209# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However,
15210# those have a little-endian offset immediately following the magic 'PACK',
15211# the first byte of which is never 0, while the first byte of the Git pack
15212# version, since it's a tiny number stored in big-endian format, is always 0.
152130	string	PACK\0		Git pack
15214>4	belong	>0		\b, version %d
15215>>8	belong	>0		\b, %d objects
15216
15217# Type: Git pack index
15218# From: Adam Buchbinder <adam.buchbinder@gmail.com>
152190	string	\377tOc		Git pack index
15220>4	belong	=2		\b, version 2
15221
15222# Type: Git index file
15223# From: Frederic Briare <fbriere@fbriere.net>
152240	string	DIRC		Git index
15225>4	belong	>0		\b, version %d
15226>>8	belong	>0		\b, %d entries
15227
15228# Type:	Mercurial bundles
15229# From:	Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
152300	string	HG10		Mercurial bundle,
15231>4	string	UN		uncompressed
15232>4	string	BZ		bzip2 compressed
15233
15234# Type:	Subversion (SVN) dumps
15235# From:	Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de>
152360	string	SVN-fs-dump-format-version:	Subversion dumpfile
15237>28	string	>\0				(version: %s)
15238
15239# Type:	Bazaar revision bundles and merge requests
15240# URL:	http://www.bazaar-vcs.org/
15241# From:	Jelmer Vernooij <jelmer@samba.org>
152420	string	#\ Bazaar\ revision\ bundle\ v Bazaar Bundle
152430	string	#\ Bazaar\ merge\ directive\ format Bazaar merge directive
15244
15245#------------------------------------------------------------------------------
15246# $File: riff,v 1.23 2013/02/06 14:18:52 christos Exp $
15247# riff:  file(1) magic for RIFF format
15248# See
15249#
15250#	http://www.seanet.com/users/matts/riffmci/riffmci.htm
15251#
15252# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi>
15253#
152540	string		RIFF		RIFF (little-endian) data
15255# RIFF Palette format
15256>8	string		PAL		\b, palette
15257>>16	leshort		x		\b, version %d
15258>>18	leshort		x		\b, %d entries
15259# RIFF Device Independent Bitmap format
15260>8	string		RDIB		\b, device-independent bitmap
15261>>16	string		BM
15262>>>30	leshort		12		\b, OS/2 1.x format
15263>>>>34	leshort		x		\b, %d x
15264>>>>36	leshort		x		%d
15265>>>30	leshort		64		\b, OS/2 2.x format
15266>>>>34	leshort		x		\b, %d x
15267>>>>36	leshort		x		%d
15268>>>30	leshort		40		\b, Windows 3.x format
15269>>>>34	lelong		x		\b, %d x
15270>>>>38	lelong		x		%d x
15271>>>>44	leshort		x		%d
15272# RIFF MIDI format
15273>8	string		RMID		\b, MIDI
15274# RIFF Multimedia Movie File format
15275>8	string		RMMP		\b, multimedia movie
15276# RIFF wrapper for MP3
15277>8	string		RMP3		\b, MPEG Layer 3 audio
15278# Microsoft WAVE format (*.wav)
15279>8	string		WAVE		\b, WAVE audio
15280!:mime	audio/x-wav
15281>>20	leshort		1		\b, Microsoft PCM
15282>>>34	leshort		>0		\b, %d bit
15283>>20	leshort		2		\b, Microsoft ADPCM
15284>>20	leshort		6		\b, ITU G.711 A-law
15285>>20	leshort		7		\b, ITU G.711 mu-law
15286>>20	leshort		8		\b, Microsoft DTS
15287>>20	leshort		17		\b, IMA ADPCM
15288>>20	leshort		20		\b, ITU G.723 ADPCM (Yamaha)
15289>>20	leshort		49		\b, GSM 6.10
15290>>20	leshort		64		\b, ITU G.721 ADPCM
15291>>20	leshort		80		\b, MPEG
15292>>20	leshort		85		\b, MPEG Layer 3
15293>>20	leshort		0x2001		\b, DTS
15294>>22	leshort		=1		\b, mono
15295>>22	leshort		=2		\b, stereo
15296>>22	leshort		>2		\b, %d channels
15297>>24	lelong		>0		%d Hz
15298# Corel Draw Picture
15299>8	string		CDRA		\b, Corel Draw Picture
15300!:mime	image/x-coreldraw
15301# AVI == Audio Video Interleave
15302>8	string		AVI\040		\b, AVI
15303!:mime	video/x-msvideo
15304>>12    string          LIST
15305>>>20   string          hdrlavih
15306>>>>&36 lelong          x               \b, %lu x
15307>>>>&40 lelong          x               %lu,
15308>>>>&4  lelong          >1000000        <1 fps,
15309>>>>&4  lelong          1000000         1.00 fps,
15310>>>>&4  lelong          500000          2.00 fps,
15311>>>>&4  lelong          333333          3.00 fps,
15312>>>>&4  lelong          250000          4.00 fps,
15313>>>>&4  lelong          200000          5.00 fps,
15314>>>>&4  lelong          166667          6.00 fps,
15315>>>>&4  lelong          142857          7.00 fps,
15316>>>>&4  lelong          125000          8.00 fps,
15317>>>>&4  lelong          111111          9.00 fps,
15318>>>>&4  lelong          100000          10.00 fps,
15319# ]9.9,10.1[
15320>>>>&4  lelong          <101010
15321>>>>>&-4        lelong  >99010
15322>>>>>>&-4       lelong  !100000         ~10 fps,
15323>>>>&4  lelong          83333           12.00 fps,
15324# ]11.9,12.1[
15325>>>>&4  lelong          <84034
15326>>>>>&-4        lelong  >82645
15327>>>>>>&-4       lelong  !83333          ~12 fps,
15328>>>>&4  lelong          66667           15.00 fps,
15329# ]14.9,15.1[
15330>>>>&4  lelong          <67114
15331>>>>>&-4        lelong  >66225
15332>>>>>>&-4       lelong  !66667          ~15 fps,
15333>>>>&4  lelong          50000           20.00 fps,
15334>>>>&4  lelong          41708           23.98 fps,
15335>>>>&4  lelong          41667           24.00 fps,
15336# ]23.9,24.1[
15337>>>>&4  lelong          <41841
15338>>>>>&-4        lelong  >41494
15339>>>>>>&-4       lelong  !41708
15340>>>>>>>&-4      lelong  !41667          ~24 fps,
15341>>>>&4  lelong          40000           25.00 fps,
15342# ]24.9,25.1[
15343>>>>&4  lelong          <40161
15344>>>>>&-4        lelong  >39841
15345>>>>>>&-4       lelong  !40000          ~25 fps,
15346>>>>&4  lelong          33367           29.97 fps,
15347>>>>&4  lelong          33333           30.00 fps,
15348# ]29.9,30.1[
15349>>>>&4  lelong          <33445
15350>>>>>&-4        lelong  >33223
15351>>>>>>&-4       lelong  !33367
15352>>>>>>>&-4      lelong  !33333          ~30 fps,
15353>>>>&4  lelong          <32224          >30 fps,
15354##>>>>&4  lelong          x               (%lu)
15355##>>>>&20 lelong          x               %lu frames,
15356# Note: The tests below assume that the AVI has 1 or 2 streams,
15357#       "vids" optionally followed by "auds".
15358#       (Should cover 99.9% of all AVIs.)
15359# assuming avih length = 56
15360>>>88   string  LIST
15361>>>>96  string  strlstrh
15362>>>>>108        string  vids    video:
15363>>>>>>&0        lelong  0               uncompressed
15364# skip past vids strh
15365>>>>>>(104.l+108)       string  strf
15366>>>>>>>(104.l+132)      lelong          1       RLE 8bpp
15367>>>>>>>(104.l+132)      string/c        cvid    Cinepak
15368>>>>>>>(104.l+132)      string/c        i263    Intel I.263
15369>>>>>>>(104.l+132)      string/c        iv32    Indeo 3.2
15370>>>>>>>(104.l+132)      string/c        iv41    Indeo 4.1
15371>>>>>>>(104.l+132)      string/c        iv50    Indeo 5.0
15372>>>>>>>(104.l+132)      string/c        mp42    Microsoft MPEG-4 v2
15373>>>>>>>(104.l+132)      string/c        mp43    Microsoft MPEG-4 v3
15374>>>>>>>(104.l+132)      string/c        fmp4    FFMpeg MPEG-4
15375>>>>>>>(104.l+132)      string/c        mjpg    Motion JPEG
15376>>>>>>>(104.l+132)      string/c        div3    DivX 3
15377>>>>>>>>112             string/c        div3    Low-Motion
15378>>>>>>>>112             string/c        div4    Fast-Motion
15379>>>>>>>(104.l+132)      string/c        divx    DivX 4
15380>>>>>>>(104.l+132)      string/c        dx50    DivX 5
15381>>>>>>>(104.l+132)      string/c        xvid    XviD
15382>>>>>>>(104.l+132)	string/c	h264	H.264
15383>>>>>>>(104.l+132)      string/c        wmv3    Windows Media Video 9
15384>>>>>>>(104.l+132)      string/c        h264    X.264 or H.264
15385>>>>>>>(104.l+132)      lelong  0
15386##>>>>>>>(104.l+132)      string  x       (%.4s)
15387# skip past first (video) LIST
15388>>>>(92.l+96)   string  LIST
15389>>>>>(92.l+104) string  strlstrh
15390>>>>>>(92.l+116)        string          auds    \b, audio:
15391# auds strh length = 56:
15392>>>>>>>(92.l+172)       string          strf
15393>>>>>>>>(92.l+180)      leshort 0x0001  uncompressed PCM
15394>>>>>>>>(92.l+180)      leshort 0x0002  ADPCM
15395>>>>>>>>(92.l+180)      leshort 0x0006  aLaw
15396>>>>>>>>(92.l+180)      leshort 0x0007  uLaw
15397>>>>>>>>(92.l+180)      leshort 0x0050  MPEG-1 Layer 1 or 2
15398>>>>>>>>(92.l+180)      leshort 0x0055  MPEG-1 Layer 3
15399>>>>>>>>(92.l+180)      leshort 0x2000  Dolby AC3
15400>>>>>>>>(92.l+180)      leshort 0x0161  DivX
15401##>>>>>>>>(92.l+180)      leshort x       (0x%.4x)
15402>>>>>>>>(92.l+182)      leshort 1       (mono,
15403>>>>>>>>(92.l+182)      leshort 2       (stereo,
15404>>>>>>>>(92.l+182)      leshort >2      (%d channels,
15405>>>>>>>>(92.l+184)      lelong  x       %d Hz)
15406# auds strh length = 64:
15407>>>>>>>(92.l+180)       string          strf
15408>>>>>>>>(92.l+188)      leshort 0x0001  uncompressed PCM
15409>>>>>>>>(92.l+188)      leshort 0x0002  ADPCM
15410>>>>>>>>(92.l+188)      leshort 0x0055  MPEG-1 Layer 3
15411>>>>>>>>(92.l+188)      leshort 0x2000  Dolby AC3
15412>>>>>>>>(92.l+188)      leshort 0x0161  DivX
15413##>>>>>>>>(92.l+188)      leshort x       (0x%.4x)
15414>>>>>>>>(92.l+190)      leshort 1       (mono,
15415>>>>>>>>(92.l+190)      leshort 2       (stereo,
15416>>>>>>>>(92.l+190)      leshort >2      (%d channels,
15417>>>>>>>>(92.l+192)      lelong  x       %d Hz)
15418# Animated Cursor format
15419>8	string		ACON		\b, animated cursor
15420# SoundFont 2 <mpruett@sgi.com>
15421>8	string		sfbk		SoundFont/Bank
15422# MPEG-1 wrapped in a RIFF, apparently
15423>8      string          CDXA            \b, wrapped MPEG-1 (CDXA)
15424>8	string		4XMV		\b, 4X Movie file
15425# AMV-type AVI file: http://wiki.multimedia.cx/index.php?title=AMV
15426>8	string		AMV\040		\b, AMV
15427
15428#
15429# XXX - some of the below may only appear in little-endian form.
15430#
15431# Also "MV93" appears to be for one form of Macromedia Director
15432# files, and "GDMF" appears to be another multimedia format.
15433#
154340	string		RIFX		RIFF (big-endian) data
15435# RIFF Palette format
15436>8	string		PAL		\b, palette
15437>>16	beshort		x		\b, version %d
15438>>18	beshort		x		\b, %d entries
15439# RIFF Device Independent Bitmap format
15440>8	string		RDIB		\b, device-independent bitmap
15441>>16	string		BM
15442>>>30	beshort		12		\b, OS/2 1.x format
15443>>>>34	beshort		x		\b, %d x
15444>>>>36	beshort		x		%d
15445>>>30	beshort		64		\b, OS/2 2.x format
15446>>>>34	beshort		x		\b, %d x
15447>>>>36	beshort		x		%d
15448>>>30	beshort		40		\b, Windows 3.x format
15449>>>>34	belong		x		\b, %d x
15450>>>>38	belong		x		%d x
15451>>>>44	beshort		x		%d
15452# RIFF MIDI format
15453>8	string		RMID		\b, MIDI
15454# RIFF Multimedia Movie File format
15455>8	string		RMMP		\b, multimedia movie
15456# Microsoft WAVE format (*.wav)
15457>8	string		WAVE		\b, WAVE audio
15458>>20	leshort		1		\b, Microsoft PCM
15459>>>34	leshort		>0		\b, %d bit
15460>>22	beshort		=1		\b, mono
15461>>22	beshort		=2		\b, stereo
15462>>22	beshort		>2		\b, %d channels
15463>>24	belong		>0		%d Hz
15464# Corel Draw Picture
15465>8	string		CDRA		\b, Corel Draw Picture
15466# AVI == Audio Video Interleave
15467>8	string		AVI\040		\b, AVI
15468# Animated Cursor format
15469>8	string		ACON		\b, animated cursor
15470# Notation Interchange File Format (big-endian only)
15471>8	string		NIFF		\b, Notation Interchange File Format
15472# SoundFont 2 <mpruett@sgi.com>
15473>8	string		sfbk		SoundFont/Bank
15474
15475#------------------------------------------------------------------------------
15476# Sony Wave64
15477# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf
15478# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian
154790	string	riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00		Sony Wave64 RIFF data
15480# 128 bit + total file size (64 bits) so 24 bytes
15481# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A }
15482>24	string		wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A		\b, WAVE 64 audio
15483!:mime	audio/x-w64
15484# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A }
15485>>40	search/256	fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A		\b
15486>>>&10	leshort		=1		\b, mono
15487>>>&10	leshort		=2		\b, stereo
15488>>>&10	leshort		>2		\b, %d channels
15489>>>&12	lelong		>0		%d Hz
15490
15491#------------------------------------------------------------------------------
15492# MBWF/RF64
15493# see EBU TECH 3306 http://tech.ebu.ch/docs/tech/tech3306-2009.pdf
154940	string	RF64\xff\xff\xff\xffWAVEds64		MBWF/RF64 audio
15495!:mime	audio/x-wav
15496>40	search/256	fmt\x20		\b
15497>>&6	leshort		=1		\b, mono
15498>>&6	leshort		=2		\b, stereo
15499>>&6	leshort		>2		\b, %d channels
15500>>&8	lelong		>0		%d Hz
15501
15502
15503#------------------------------------------------------------------------------
15504# $File: rinex,v 1.4 2011/05/03 01:44:17 christos Exp $
15505# rinex:  file(1) magic for RINEX files
15506# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
15507# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf
15508# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data
1550960	string		RINEX
15510>80	search/256	XXRINEXB	RINEX Data, GEO SBAS Broadcast
15511>>&32	string		x		\b, date %15.15s
15512>>5	string		x		\b, version %6.6s
15513!:mime	rinex/broadcast
15514>80	search/256	XXRINEXD	RINEX Data, Observation (Hatanaka comp)
15515>>&32	string		x		\b, date %15.15s
15516>>5	string		x		\b, version %6.6s
15517!:mime	rinex/observation
15518>80	search/256	XXRINEXC	RINEX Data, Clock
15519>>&32	string		x		\b, date %15.15s
15520>>5	string		x		\b, version %6.6s
15521!:mime	rinex/clock
15522>80	search/256	XXRINEXH	RINEX Data, GEO SBAS Navigation
15523>>&32	string		x		\b, date %15.15s
15524>>5	string		x		\b, version %6.6s
15525!:mime	rinex/navigation
15526>80	search/256	XXRINEXG	RINEX Data, GLONASS Navigation
15527>>&32	string		x		\b, date %15.15s
15528>>5	string		x		\b, version %6.6s
15529!:mime	rinex/navigation
15530>80	search/256	XXRINEXL	RINEX Data, Galileo Navigation
15531>>&32	string		x		\b, date %15.15s
15532>>5	string		x		\b, version %6.6s
15533!:mime	rinex/navigation
15534>80	search/256	XXRINEXM	RINEX Data, Meteorological
15535>>&32	string		x		\b, date %15.15s
15536>>5	string		x		\b, version %6.6s
15537!:mime	rinex/meteorological
15538>80	search/256	XXRINEXN	RINEX Data, Navigation
15539>>&32	string		x		\b, date %15.15s
15540>>5	string		x		\b, version %6.6s
15541!:mime	rinex/navigation
15542>80	search/256	XXRINEXO	RINEX Data, Observation
15543>>&32	string		x		\b, date %15.15s
15544>>5	string		x		\b, version %6.6s
15545!:mime	rinex/observation
15546
15547#------------------------------------------------------------------------------
15548# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $
15549#
15550# RPM: file(1) magic for Red Hat Packages   Erik Troan (ewt@redhat.com)
15551#
155520	belong		0xedabeedb	RPM
15553!:mime	application/x-rpm
15554>4	byte		x		v%d
15555>5	byte		x		\b.%d
15556>6	beshort		1		src
15557>6	beshort		0		bin
15558>>8	beshort		1		i386/x86_64
15559>>8	beshort		2		Alpha/Sparc64
15560>>8	beshort		3		Sparc
15561>>8	beshort		4		MIPS
15562>>8	beshort		5		PowerPC
15563>>8	beshort		6		68000
15564>>8	beshort		7		SGI
15565>>8	beshort		8		RS6000
15566>>8	beshort		9		IA64
15567>>8	beshort		10		Sparc64
15568>>8	beshort		11		MIPSel
15569>>8	beshort		12		ARM
15570>>8	beshort		13		MiNT
15571>>8	beshort		14		S/390
15572>>8	beshort		15		S/390x
15573>>8	beshort		16		PowerPC64
15574>>8	beshort		17		SuperH
15575>>8	beshort		18		Xtensa
15576>>8	beshort		255		noarch
15577
15578#delta RPM    Daniel Novotny (dnovotny@redhat.com)
155790	string		drpm		Delta RPM
15580!:mime  application/x-rpm
15581>12	string 	x	%s
15582>>8	beshort		11		MIPSel
15583>>8	beshort		12		ARM
15584>>8	beshort		13		MiNT
15585>>8	beshort		14		S/390
15586>>8	beshort		15		S/390x
15587>>8	beshort		16		PowerPC64
15588>>8	beshort		17		SuperH
15589>>8	beshort		18		Xtensa
15590>>10	string		x		%s
15591
15592#------------------------------------------------------------------------------
15593# $File: rtf,v 1.7 2009/09/19 16:28:12 christos Exp $
15594# rtf:	file(1) magic for Rich Text Format (RTF)
15595#
15596# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
15597#
155980	string		{\\rtf		Rich Text Format data,
15599!:mime	text/rtf
15600>5	string		1		version 1,
15601>>6	string		\\ansi		ANSI
15602>>6	string		\\mac		Apple Macintosh
15603>>6	string		\\pc		IBM PC, code page 437
15604>>6	string		\\pca		IBM PS/2, code page 850
15605>>6	default		x		unknown character set
15606>5	default		x		unknown version
15607
15608#------------------------------------------------------------------------------
15609# $File: ruby,v 1.5 2010/07/21 16:47:17 christos Exp $
15610# ruby:  file(1) magic for Ruby scripting language
15611# URL:  http://www.ruby-lang.org/
15612# From: Reuben Thomas <rrt@sc3d.org>
15613
15614# Ruby scripts
156150	search/1/w	#!\ /usr/bin/ruby	Ruby script text executable
15616!:mime text/x-ruby
156170	search/1/w	#!\ /usr/local/bin/ruby	Ruby script text executable
15618!:mime text/x-ruby
156190	search/1	#!/usr/bin/env\ ruby	Ruby script text executable
15620!:mime text/x-ruby
156210	search/1	#!\ /usr/bin/env\ ruby	Ruby script text executable
15622!:mime text/x-ruby
15623
15624# What looks like ruby, but does not have a shebang
15625# (modules and such)
15626# From: Lubomir Rintel <lkundrak@v3.sk>
156270	regex		\^[\ \t]*require[\ \t]'[A-Za-z_/]+'
15628>0	regex		include\ [A-Z]|def\ [a-z]|\ do$
15629>>0	regex		\^[\ \t]*end([\ \t]*[;#].*)?$		Ruby script text
15630!:mime	text/x-ruby
156310	regex		\^[\ \t]*(class|module)[\ \t][A-Z]
15632>0	regex		(modul|includ)e\ [A-Z]|def\ [a-z]
15633>>0	regex		\^[\ \t]*end([\ \t]*[;#].*)?$		Ruby module source text
15634!:mime	text/x-ruby
15635
15636#------------------------------------------------------------------------------
15637# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $
15638# sc:  file(1) magic for "sc" spreadsheet
15639#
1564038	string		Spreadsheet	sc spreadsheet file
15641!:mime	application/x-sc
15642
15643#------------------------------------------------------------------------------
15644# $File: sccs,v 1.6 2009/09/19 16:28:12 christos Exp $
15645# sccs:  file(1) magic for SCCS archives
15646#
15647# SCCS archive structure:
15648# \001h01207
15649# \001s 00276/00000/00000
15650# \001d D 1.1 87/09/23 08:09:20 ian 1 0
15651# \001c date and time created 87/09/23 08:09:20 by ian
15652# \001e
15653# \001u
15654# \001U
15655# ... etc.
15656# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
15657# *Sigh*. And these both came from various parts of the USG.
15658# Maybe we should just switch everybody from SCCS to RCS!
15659# Further, you can't just say '\001h0', because the five-digit number
15660# is a checksum that could (presumably) have any leading digit,
15661# and we don't have regular expression matching yet.
15662# Hence the following official kludge:
156638	string		\001s\ 			SCCS archive data
15664
15665#------------------------------------------------------------------------------
15666# $File: scientific,v 1.7 2010/09/20 19:19:17 rrt Exp $
15667# scientific:  file(1) magic for scientific formats
15668#
15669# From: Joe Krahn <krahn@niehs.nih.gov>
15670
15671########################################################
15672# CCP4 data and plot files:
156730	string		MTZ\040		MTZ reflection file
15674
1567592	string		PLOT%%84	Plot84 plotting file
15676>52	byte		1		, Little-endian
15677>55	byte		1		, Big-endian
15678
15679########################################################
15680# Electron density MAP/MASK formats
15681
156820	string		EZD_MAP	NEWEZD Electron Density Map
15683109	string		MAP\040(  Old EZD Electron Density Map
15684
156850	string/c	:-)\040Origin	BRIX Electron Density Map
15686>170	string		>0	, Sigma:%.12s
15687#>4	string		>0	%.178s
15688#>4	addr		x	%.178s
15689
156907	string		18\040!NTITLE	XPLOR ASCII Electron Density Map
156919	string		\040!NTITLE\012\040REMARK	CNS ASCII electron density map
15692
15693208	string		MAP\040	CCP4 Electron Density Map
15694# Assumes same stamp for float and double (normal case)
15695>212	byte		17	\b, Big-endian
15696>212	byte		34	\b, VAX format
15697>212	byte		68	\b, Little-endian
15698>212	byte		85	\b, Convex native
15699
15700############################################################
15701# X-Ray Area Detector images
157020	string	R-AXIS4\ \ \ 	R-Axis Area Detector Image:
15703>796	lelong	<20		Little-endian, IP #%d,
15704>>768	lelong	>0		Size=%dx
15705>>772	lelong	>0		\b%d
15706>796	belong	<20		Big-endian, IP #%d,
15707>>768	belong	>0		Size=%dx
15708>>772	belong	>0		\b%d
15709
157100	string	RAXIS\ \ \ \ \ 	R-Axis Area Detector Image, Win32:
15711>796	lelong	<20		Little-endian, IP #%d,
15712>>768	lelong	>0		Size=%dx
15713>>772	lelong	>0		\b%d
15714>796	belong	<20		Big-endian, IP #%d,
15715>>768	belong	>0		Size=%dx
15716>>772	belong	>0		\b%d
15717
15718
157191028	string	MMX\000\000\000\000\000\000\000\000\000\000\000\000\000	MAR Area Detector Image,
15720>1072	ulong	>1		Compressed(%d),
15721>1100	ulong	>1		%d headers,
15722>1104	ulong	>0		%d x
15723>1108	ulong	>0		%d,
15724>1120	ulong	>0		%d bits/pixel
15725
15726# Type: GEDCOM genealogical (family history) data
15727# From: Giuseppe Bilotta
157280       search/1/c	0\ HEAD         GEDCOM genealogy text
15729>&0     search		1\ GEDC
15730>>&0    search		2\ VERS         version
15731>>>&1   search/1	>\0		%s
15732# From: Phil Endecott <phil05@chezphil.org>
157330	string	\000\060\000\040\000\110\000\105\000\101\000\104		GEDCOM data
157340	string	\060\000\040\000\110\000\105\000\101\000\104\000		GEDCOM data
157350	string	\376\377\000\060\000\040\000\110\000\105\000\101\000\104	GEDCOM data
157360	string	\377\376\060\000\040\000\110\000\105\000\101\000\104\000	GEDCOM data
15737
15738# PDB: Protein Data Bank files
15739# Adam Buchbinder <adam.buchbinder@gmail.com>
15740#
15741# http://www.wwpdb.org/documentation/format32/sect2.html
15742# http://www.ch.ic.ac.uk/chemime/
15743#
15744# The PDB file format is fixed-field, 80 columns. From the spec:
15745#
15746# COLS        DATA
15747#  1 -  6      "HEADER"
15748#  11 - 50     String(40)
15749#  51 - 59     Date
15750#  63 - 66     IDcode
15751#
15752# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the
15753# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and
15754# uppercase letters. However, examples have been seen without the date string,
15755# e.g., the example on the chemime site.
157560	string	HEADER\ \ \ \
15757>&0	regex/1	\^.{40}
15758>>&0	regex/1	[0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3}
15759>>>&0	regex/1s	[A-Z0-9]{4}.{14}$
15760>>>>&0	regex/1	[A-Z0-9]{4}	Protein Data Bank data, ID Code %s
15761!:mime	chemical/x-pdb
15762>>>>0	regex/1	[0-9]{2}-[A-Z]{3}-[0-9]{2}	\b, %s
15763
15764# Type:	GDSII Stream file
157650	belong	0x00060002	GDSII Stream file
15766>4	byte	0x00
15767>>5	byte	x		version %d.0
15768>4	byte	>0x00		version %d
15769>>5	byte	x		\b.%d
15770
15771#------------------------------------------------------------------------------
15772# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $
157730	search/1		-----BEGIN\ CERTIFICATE------	RFC1421 Security Certificate text
157740	search/1		-----BEGIN\ NEW\ CERTIFICATE	RFC1421 Security Certificate Signing Request text
157750	belong	0xedfeedfe	Sun 'jks' Java Keystore File data
15776# Type:	SE Linux policy modules *.pp reference policy
15777#	for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny.
15778# URL:	http://doc.coker.com.au/computers/selinux-magic
15779# From:	Russell Coker <russell@coker.com.au>
15780
157810		lelong	0xf97cff8f	SE Linux modular policy
15782>4		lelong	x		version %d,
15783>8		lelong	x		%d sections,
15784>>(12.l)	lelong	0xf97cff8d
15785>>>(12.l+27)	lelong	x		mod version %d,
15786>>>(12.l+31)	lelong	0		Not MLS,
15787>>>(12.l+31)	lelong	1		MLS,
15788>>>(12.l+23)	lelong	2
15789>>>>(12.l+47)	string	>\0		module name %s
15790>>>(12.l+23)	lelong	1		base
15791
157921	string	policy_module(	SE Linux policy module source
157932	string	policy_module(	SE Linux policy module source
15794
157950	string	##\ <summary>	SE Linux policy interface source
15796
15797#0	search	gen_context(	SE Linux policy file contexts
15798
15799#0	search	gen_sens(	SE Linux policy MLS constraints source
15800
15801#------------------------------------------------------------------------------
15802# $File: sendmail,v 1.7 2009/09/19 16:28:12 christos Exp $
15803# sendmail:  file(1) magic for sendmail config files
15804#
15805# XXX - byte order?
15806#
158070	byte	046	  Sendmail frozen configuration
15808>16	string	>\0	  - version %s
158090	short	0x271c	  Sendmail frozen configuration
15810>16	string	>\0	  - version %s
15811
15812#------------------------------------------------------------------------------
15813# sendmail:  file(1) magic for sendmail m4(1) files
15814#
15815# From Hendrik Scholz <hendrik@scholz.net>
15816# i.e. files in /usr/share/sendmail/cf/
15817#
158180   string  divert(-1)\n    sendmail m4 text file
15819
15820
15821#------------------------------------------------------------------------------
15822# $File: sequent,v 1.8 2009/09/19 16:28:12 christos Exp $
15823# sequent:  file(1) magic for Sequent machines
15824#
15825# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
15826# For Sequent's multiprocessor systems (incomplete).
158270	lelong	0x00ea        	BALANCE NS32000 .o
15828>16	lelong	>0		not stripped
15829>124	lelong	>0		version %ld
158300	lelong	0x10ea        	BALANCE NS32000 executable (0 @ 0)
15831>16	lelong  >0            	not stripped
15832>124	lelong	>0		version %ld
158330	lelong	0x20ea        	BALANCE NS32000 executable (invalid @ 0)
15834>16	lelong  >0            	not stripped
15835>124	lelong	>0		version %ld
158360	lelong	0x30ea        	BALANCE NS32000 standalone executable
15837>16	lelong  >0          	not stripped
15838>124	lelong	>0		version %ld
15839#
15840# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
15841# Symmetry magic nums will not be reached if DOS COM comes before them;
15842# byte 0xeb is matched before these get a chance.
158430	leshort	0x12eb		SYMMETRY i386 .o
15844>16	lelong	>0		not stripped
15845>124	lelong	>0		version %ld
158460	leshort	0x22eb		SYMMETRY i386 executable (0 @ 0)
15847>16	lelong	>0		not stripped
15848>124	lelong	>0		version %ld
158490	leshort	0x32eb		SYMMETRY i386 executable (invalid @ 0)
15850>16	lelong	>0		not stripped
15851>124	lelong	>0		version %ld
158520	leshort	0x42eb		SYMMETRY i386 standalone executable
15853>16	lelong	>0		not stripped
15854>124	lelong	>0		version %ld
15855
15856#------------------------------------------------------------------------------
15857# $File: sgi,v 1.19 2013/01/12 03:09:51 christos Exp $
15858# sgi:  file(1) magic for Silicon Graphics operating systems and applications
15859#
15860# Executable images are handled either in aout (for old-style a.out
15861# files for 68K; they are indistinguishable from other big-endian 32-bit
15862# a.out files) or in mips (for MIPS ECOFF and Ucode files)
15863#
15864
15865# kbd file definitions
158660	string	kbd!map		kbd map file
15867>8	byte	>0		Ver %d:
15868>10	short	>0		with %d table(s)
15869
158700	beshort	0x8765		disk quotas file
15871
158720	beshort	0x0506		IRIS Showcase file
15873>2	byte	0x49		-
15874>3	byte	x		- version %ld
158750	beshort	0x0226		IRIS Showcase template
15876>2	byte	0x63		-
15877>3	byte	x		- version %ld
158780	belong	0x5343464d	IRIS Showcase file
15879>4	byte	x		- version %ld
158800	belong	0x5443464d	IRIS Showcase template
15881>4	byte	x		- version %ld
158820	belong	0xdeadbabe	IRIX Parallel Arena
15883>8	belong	>0		- version %ld
15884
15885# core files
15886#
15887# 32bit core file
158880	belong	0xdeadadb0	IRIX core dump
15889>4	belong	1		of
15890>16	string	>\0		'%s'
15891# 64bit core file
158920	belong	0xdeadad40	IRIX 64-bit core dump
15893>4	belong	1		of
15894>16	string	>\0		'%s'
15895# N32bit core file
158960       belong	0xbabec0bb	IRIX N32 core dump
15897>4      belong	1               of
15898>16     string	>\0             '%s'
15899# New style crash dump file
159000	string	\x43\x72\x73\x68\x44\x75\x6d\x70	IRIX vmcore dump of
15901>36	string	>\0					'%s'
15902
15903# Trusted IRIX info
159040	string	SGIAUDIT	SGI Audit file
15905>8	byte	x		- version %d
15906>9	byte	x		\b.%ld
15907#
159080	string	WNGZWZSC	Wingz compiled script
159090	string	WNGZWZSS	Wingz spreadsheet
159100	string	WNGZWZHP	Wingz help file
15911#
159120	string	#Inventor V	IRIS Inventor 1.0 file
159130	string	#Inventor V2	Open Inventor 2.0 file
15914# GLF is OpenGL stream encoding
159150	string	glfHeadMagic();		GLF_TEXT
159164	belong	0x7d000000		GLF_BINARY_LSB_FIRST
15917!:strength -30
159184	belong	0x0000007d		GLF_BINARY_MSB_FIRST
15919!:strength -30
15920# GLS is OpenGL stream encoding; GLS is the successor of GLF
159210	string	glsBeginGLS(		GLS_TEXT
159224	belong	0x10000000		GLS_BINARY_LSB_FIRST
15923!:strength -30
159244	belong	0x00000010		GLS_BINARY_MSB_FIRST
15925!:strength -30
15926
15927#
15928#
15929# Performance Co-Pilot file types
159300	string	PmNs				PCP compiled namespace (V.0)
159310	string	PmN				PCP compiled namespace
15932>3	string	>\0				(V.%1.1s)
15933#3	lelong	0x84500526			PCP archive
159343	belong	0x84500526			PCP archive
15935>7	byte	x				(V.%d)
15936#>20	lelong	-2				temporal index
15937#>20	lelong	-1				metadata
15938#>20	lelong	0				log volume #0
15939#>20	lelong	>0				log volume #%ld
15940>20	belong	-2				temporal index
15941>20	belong	-1				metadata
15942>20	belong	0				log volume #0
15943>20	belong	>0				log volume #%ld
15944>24	string	>\0				host: %s
159450	string	PCPFolio			PCP
15946>9	string	Version:			Archive Folio
15947>18	string	>\0				(V.%s)
159480	string	#pmchart			PCP pmchart view
15949>9	string	Version
15950>17	string	>\0				(V%-3.3s)
159510	string	#kmchart			PCP kmchart view
15952>9	string	Version
15953>17	string	>\0				(V.%s)
159540	string	pmview				PCP pmview config
15955>7	string	Version
15956>15	string	>\0				(V%-3.3s)
159570	string	#pmlogger			PCP pmlogger config
15958>10	string	Version
15959>18	string	>\0				(V%1.1s)
159600	string	#pmdahotproc			PCP pmdahotproc config
15961>13	string	Version
15962>21	string	>\0				(V%-3.3s)
159630	string	PcPh				PCP Help
15964>4	string	1				Index
15965>4	string	2				Text
15966>5	string	>\0				(V.%1.1s)
159670	string	#pmieconf-rules			PCP pmieconf rules
15968>16	string	>\0				(V.%1.1s)
159693	string	pmieconf-pmie			PCP pmie config
15970>17	string	>\0				(V.%1.1s)
15971
15972# SpeedShop data files
159730	lelong	0x13130303			SpeedShop data file
15974
15975# mdbm files
159760	lelong	0x01023962			mdbm file, version 0 (obsolete)
159770	string	mdbm				mdbm file,
15978>5	byte	x				version %d,
15979>6	byte	x				2^%d pages,
15980>7	byte	x				pagesize 2^%d,
15981>17	byte	x				hash %d,
15982>11	byte	x				dataformat %d
15983
15984# Alias Maya files
159850	string/t	//Maya ASCII	Alias Maya Ascii File,
15986>13	string	>\0	version %s
159878	string	MAYAFOR4	Alias Maya Binary File,
15988>32	string	>\0	version %s scene
159898	string	MayaFOR4	Alias Maya Binary File,
15990>32	string	>\0	version %s scene
159918	string	CIMG		Alias Maya Image File
159928	string	DEEP		Alias Maya Image File
15993#------------------------------------------------------------------------------
15994# $File: sgml,v 1.29 2012/08/26 10:25:41 christos Exp $
15995# Type:	SVG Vectorial Graphics
15996# From:	Noel Torres <tecnico@ejerciciosresueltos.com>
159970	string		\<?xml\ version="
15998>15	string		>\0
15999>>19	search/4096	\<svg			SVG Scalable Vector Graphics image
16000!:mime	image/svg+xml
16001>>19	search/4096	\<gnc-v2		GnuCash file
16002!:mime	application/x-gnucash
16003
16004# Sitemap file
160050	string/t		\<?xml\ version="
16006>15	string		>\0
16007>>19	search/4096	\<urlset		XML Sitemap document text
16008!:mime	application/xml-sitemap
16009
16010# xhtml
160110	string/t		\<?xml\ version="
16012>15	string		>\0
16013>>19	search/4096/cWbt	\<!doctype\ html	XHTML document text
16014!:mime	text/html
160150	string/t		\<?xml\ version='
16016>15	string		>\0
16017>>19	search/4096/cWbt	\<!doctype\ html	XHTML document text
16018!:mime	text/html
160190	string/t		\<?xml\ version="
16020>15	string		>\0
16021>>19	search/4096/cWbt	\<html	broken XHTML document text
16022!:mime	text/html
16023
16024#------------------------------------------------------------------------------
16025# sgml:  file(1) magic for Standard Generalized Markup Language
16026# HyperText Markup Language (HTML) is an SGML document type,
16027# from Daniel Quinlan (quinlan@yggdrasil.com)
16028# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org)
160290	search/4096/cWt	\<!doctype\ html	HTML document text
16030!:mime	text/html
16031!:strength + 5
160320	search/4096/cwt	\<head			HTML document text
16033!:mime	text/html
16034!:strength + 5
160350	search/4096/cwt	\<title			HTML document text
16036!:mime	text/html
16037!:strength + 5
160380	search/4096/cwt	\<html			HTML document text
16039!:mime	text/html
16040!:strength + 5
160410	search/4096/cwt	\<script 		HTML document text
16042!:mime	text/html
16043!:strength + 5
160440	search/4096/cwt	\<style 		HTML document text
16045!:mime	text/html
16046!:strength + 5
160470	search/4096/cwt	\<table			HTML document text
16048!:mime	text/html
16049!:strength + 5
160500	search/4096/cwt	\<a\ href=		HTML document text
16051!:mime	text/html
16052!:strength + 5
16053
16054# Extensible markup language (XML), a subset of SGML
16055# from Marc Prud'hommeaux (marc@apocalypse.org)
160560	search/1/cwt	\<?xml			XML document text
16057!:mime	application/xml
16058!:strength + 5
160590	string/t		\<?xml\ version\ "	XML
16060!:mime	application/xml
16061!:strength + 5
160620	string/t		\<?xml\ version="	XML
16063!:mime	application/xml
16064!:strength + 5
16065>15	string/t	>\0			%.3s document text
16066>>23	search/1	\<xsl:stylesheet	(XSL stylesheet)
16067>>24	search/1	\<xsl:stylesheet	(XSL stylesheet)
160680	string		\<?xml\ version='	XML
16069!:mime	application/xml
16070!:strength + 5
16071>15	string/t	>\0			%.3s document text
16072>>23	search/1	\<xsl:stylesheet	(XSL stylesheet)
16073>>24	search/1	\<xsl:stylesheet	(XSL stylesheet)
160740	search/1/wbt	\<?xml			XML document text
16075!:mime	application/xml
16076!:strength - 10
160770	search/1/wt	\<?XML			broken XML document text
16078!:mime	application/xml
16079!:strength - 10
16080
16081
16082# SGML, mostly from rph@sq
160830	search/4096/cwt	\<!doctype		exported SGML document text
160840	search/4096/cwt	\<!subdoc		exported SGML subdocument text
160850	search/4096/cwt	\<!--			exported SGML document text
16086!:strength - 10
16087
16088# Web browser cookie files
16089# (Mozilla, Galeon, Netscape 4, Konqueror..)
16090# Ulf Harnhammar <ulfh@update.uu.se>
160910	search/1	#\ HTTP\ Cookie\ File	Web browser cookie text
160920	search/1	#\ Netscape\ HTTP\ Cookie\ File	Netscape cookie text
160930	search/1	#\ KDE\ Cookie\ File	Konqueror cookie text
16094
16095#------------------------------------------------------------------------
16096# $File: sharc,v 1.6 2009/09/19 16:28:12 christos Exp $
16097# file(1) magic for sharc files
16098#
16099# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
16100# FutureGroove Music (dsp@futuregroove.de)
16101
16102#------------------------------------------------------------------------
16103#0	string			Draw		RiscOS Drawfile
16104#0	string			PACK		RiscOS PackdDir archive
16105
16106#------------------------------------------------------------------------
16107# SHARC DSP stuff (based on the FGM SHARC DSP SDK)
16108
16109#0	string			=!		Assembler source
16110#0	string			Analog		ADi asm listing file
161110	string			.SYSTEM		SHARC architecture file
161120	string			.system		SHARC architecture file
16113
161140	leshort			0x521C		SHARC COFF binary
16115>2	leshort			>1		, %hd sections
16116>>12	lelong			>0		, not stripped
16117
16118#------------------------------------------------------------------------------
16119# $File: sinclair,v 1.5 2009/09/19 16:28:12 christos Exp $
16120# sinclair:  file(1) sinclair QL
16121
16122# additions to /etc/magic by Thomas M. Ott (ThMO)
16123
16124# Sinclair QL floppy disk formats (ThMO)
161250	string	=QL5		QL disk dump data,
16126>3	string	=A		720 KB,
16127>3	string	=B		1.44 MB,
16128>3	string	=C		3.2 MB,
16129>4	string	>\0		label:%.10s
16130
16131# Sinclair QL OS dump (ThMO)
16132# (NOTE: if `file' would be able to use indirect references in a endian format
16133#	 differing from the natural host format, this could be written more
16134#	 reliably and faster...)
16135#
16136# we *can't* lookup QL OS code dumps, because `file' is UNABLE to read more
16137# than the first 8K of a file... #-(
16138#
16139#0		belong	=0x30000
16140#>49124		belong	<47104
16141#>>49128		belong	<47104
16142#>>>49132	belong	<47104
16143#>>>>49136	belong	<47104	QL OS dump data,
16144#>>>>>49148	string	>\0	type %.3s,
16145#>>>>>49142	string	>\0	version %.4s
16146
16147# Sinclair QL firmware executables (ThMO)
161480	string	NqNqNq`\004	QL firmware executable (BCPL)
16149
16150# Sinclair QL libraries (was ThMO)
161510	beshort	0xFB01		QDOS object
16152>2	pstring	x		'%s'
16153
16154# Sinclair QL executables (was ThMO)
161554	belong	0x4AFB		QDOS executable
16156>9	pstring	x		'%s'
16157
16158# Sinclair QL ROM (ThMO)
161590	belong	=0x4AFB0001	QL plugin-ROM data,
16160>9	pstring	=\0		un-named
16161>9	pstring	>\0		named: %s
16162# Type: SiSU Markup Language
16163# URL:  http://www.sisudoc.org/
16164# From: Ralph Amissah <ralph.amissah@gmail.com>
16165
161660	regex	\^%?[\ \t]*SiSU[\ \t]+insert	SiSU text insert
16167>5	regex	[0-9.]+				%s
16168
161690	regex	\^%[\ \t]+SiSU[\ \t]+master	SiSU text master
16170>5	regex	[0-9.]+				%s
16171
161720	regex	\^%?[\ \t]*SiSU[\ \t]+text	SiSU text
16173>5	regex	[0-9.]+				%s
16174
161750	regex	\^%?[\ \t]*SiSU[\ \t][0-9.]+	SiSU text
16176>5	regex	[0-9.]+				%s
16177
161780	regex	\^%*[\ \t]*sisu-[0-9.]+		SiSU text
16179>5	regex	[0-9.]+				%s
16180
16181#------------------------------------------------------------------------------
16182# $File: sketch,v 1.4 2009/09/19 16:28:12 christos Exp $
16183# Sketch Drawings: http://sketch.sourceforge.net/
16184# From: Edwin Mons <e@ik.nu>
161850	search/1	##Sketch	Sketch document text
16186
16187#-----------------------------------------------
16188# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $
16189# GNU Smalltalk image, starting at version 1.6.2
16190# From: catull_us@yahoo.com
16191#
161920	string	GSTIm\0\0	GNU SmallTalk
16193# little-endian
16194>7	byte&1	=0		LE image version
16195>>10	byte	x		%d.
16196>>9	byte	x		\b%d.
16197>>8	byte	x		\b%d
16198#>>12	lelong	x		, data: %ld
16199#>>16	lelong	x		, table: %ld
16200#>>20	lelong	x		, memory: %ld
16201# big-endian
16202>7	byte&1	=1		BE image version
16203>>8	byte	x		%d.
16204>>9	byte	x		\b%d.
16205>>10	byte	x		\b%d
16206#>>12	belong	x		, data: %ld
16207#>>16	belong	x		, table: %ld
16208#>>20	belong	x		, memory: %ld
16209
16210
16211
16212#------------------------------------------------------------------------------
16213# $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $
16214# smile:  file(1) magic for Smile serialization
16215#
16216# The Smile serialization format uses a 4-byte header:
16217#
16218#   Constant byte #0: 0x3A (ASCII ':')
16219#   Constant byte #1: 0x29 (ASCII ')')
16220#   Constant byte #2: 0x0A (ASCII linefeed, '\n')
16221#   Variable byte #3, consisting of bits:
16222#     Bits 4-7 (4 MSB): 4-bit version number
16223#     Bits 3: Reserved
16224#     Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content
16225#     Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false
16226#     Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true
16227#
16228# Reference: http://wiki.fasterxml.com/SmileFormatSpec
16229# Created by: Pierre-Alexandre Meyer <pierre@mouraf.org>
16230
16231# Detection
162320	string		:)\n	Smile binary data
16233
16234# Versioning
16235>3	byte&0xF0	x		version %d:
16236
16237# Properties
16238>3	byte&0x04	0x04		binary raw,
16239>3	byte&0x04	0x00		binary encoded,
16240>3	byte&0x02	0x02		shared String values enabled,
16241>3	byte&0x02	0x00		shared String values disabled,
16242>3	byte&0x01	0x01		shared field names enabled
16243>3	byte&0x01	0x00		shared field names disabled
16244
16245
16246#------------------------------------------------------------------------------
16247# $File: sniffer,v 1.19 2013/01/06 01:11:04 christos Exp $
16248# sniffer:  file(1) magic for packet capture files
16249#
16250# From: guy@alum.mit.edu (Guy Harris)
16251#
16252
16253#
16254# Microsoft Network Monitor 1.x capture files.
16255#
162560	string		RTSS		NetMon capture file
16257>5	byte		x		- version %d
16258>4	byte		x		\b.%d
16259>6	leshort		0		(Unknown)
16260>6	leshort		1		(Ethernet)
16261>6	leshort		2		(Token Ring)
16262>6	leshort		3		(FDDI)
16263>6	leshort		4		(ATM)
16264>6	leshort		>4		(type %d)
16265
16266#
16267# Microsoft Network Monitor 2.x capture files.
16268#
162690	string		GMBU		NetMon capture file
16270>5	byte		x		- version %d
16271>4	byte		x		\b.%d
16272>6	leshort		0		(Unknown)
16273>6	leshort		1		(Ethernet)
16274>6	leshort		2		(Token Ring)
16275>6	leshort		3		(FDDI)
16276>6	leshort		4		(ATM)
16277>6	leshort		5		(IP-over-IEEE 1394)
16278>6	leshort		6		(802.11)
16279>6	leshort		7		(Raw IP)
16280>6	leshort		8		(Raw IP)
16281>6	leshort		9		(Raw IP)
16282>6	leshort		>9		(type %d)
16283
16284#
16285# Network General Sniffer capture files.
16286# Sorry, make that "Network Associates Sniffer capture files."
16287# Sorry, make that "Network General old DOS Sniffer capture files."
16288#
162890	string		TRSNIFF\ data\ \ \ \ \032	Sniffer capture file
16290>33	byte		2		(compressed)
16291>23	leshort		x		- version %d
16292>25	leshort		x		\b.%d
16293>32	byte		0		(Token Ring)
16294>32	byte		1		(Ethernet)
16295>32	byte		2		(ARCNET)
16296>32	byte		3		(StarLAN)
16297>32	byte		4		(PC Network broadband)
16298>32	byte		5		(LocalTalk)
16299>32	byte		6		(Znet)
16300>32	byte		7		(Internetwork Analyzer)
16301>32	byte		9		(FDDI)
16302>32	byte		10		(ATM)
16303
16304#
16305# Cinco Networks NetXRay capture files.
16306# Sorry, make that "Network General Sniffer Basic capture files."
16307# Sorry, make that "Network Associates Sniffer Basic capture files."
16308# Sorry, make that "Network Associates Sniffer Basic, and Windows
16309# Sniffer Pro", capture files."
16310# Sorry, make that "Network General Sniffer capture files."
16311# Sorry, make that "NetScout Sniffer capture files."
16312#
163130	string		XCP\0		NetXRay capture file
16314>4	string		>\0		- version %s
16315>44	leshort		0		(Ethernet)
16316>44	leshort		1		(Token Ring)
16317>44	leshort		2		(FDDI)
16318>44	leshort		3		(WAN)
16319>44	leshort		8		(ATM)
16320>44	leshort		9		(802.11)
16321
16322#
16323# "libpcap" capture files.
16324# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
16325# the main program that uses that format, but there are other programs
16326# that use "libpcap", or that use the same capture file format.)
16327#
163280	name		pcap-be
16329>4	beshort		x		- version %d
16330>6	beshort		x		\b.%d
16331>20	belong		0		(No link-layer encapsulation
16332>20	belong		1		(Ethernet
16333>20	belong		2		(3Mb Ethernet
16334>20	belong		3		(AX.25
16335>20	belong		4		(ProNET
16336>20	belong		5		(CHAOS
16337>20	belong		6		(Token Ring
16338>20	belong		7		(BSD ARCNET
16339>20	belong		8		(SLIP
16340>20	belong		9		(PPP
16341>20	belong		10		(FDDI
16342>20	belong		11		(RFC 1483 ATM
16343>20	belong		12		(raw IP
16344>20	belong		13		(BSD/OS SLIP
16345>20	belong		14		(BSD/OS PPP
16346>20	belong		19		(Linux ATM Classical IP
16347>20	belong		50		(PPP or Cisco HDLC
16348>20	belong		51		(PPP-over-Ethernet
16349>20	belong		99		(Symantec Enterprise Firewall
16350>20	belong		100		(RFC 1483 ATM
16351>20	belong		101		(raw IP
16352>20	belong		102		(BSD/OS SLIP
16353>20	belong		103		(BSD/OS PPP
16354>20	belong		104		(BSD/OS Cisco HDLC
16355>20	belong		105		(802.11
16356>20	belong		106		(Linux Classical IP over ATM
16357>20	belong		107		(Frame Relay
16358>20	belong		108		(OpenBSD loopback
16359>20	belong		109		(OpenBSD IPsec encrypted
16360>20	belong		112		(Cisco HDLC
16361>20	belong		113		(Linux "cooked"
16362>20	belong		114		(LocalTalk
16363>20	belong		117		(OpenBSD PFLOG
16364>20	belong		119		(802.11 with Prism header
16365>20	belong		122		(RFC 2625 IP over Fibre Channel
16366>20	belong		123		(SunATM
16367>20	belong		127		(802.11 with radiotap header
16368>20	belong		129		(Linux ARCNET
16369>20	belong		138		(Apple IP over IEEE 1394
16370>20	belong		139		(MTP2 with pseudo-header
16371>20	belong		140		(MTP2
16372>20	belong		141		(MTP3
16373>20	belong		142		(SCCP
16374>20	belong		143		(DOCSIS
16375>20	belong		144		(IrDA
16376>20	belong		147		(Private use 0
16377>20	belong		148		(Private use 1
16378>20	belong		149		(Private use 2
16379>20	belong		150		(Private use 3
16380>20	belong		151		(Private use 4
16381>20	belong		152		(Private use 5
16382>20	belong		153		(Private use 6
16383>20	belong		154		(Private use 7
16384>20	belong		155		(Private use 8
16385>20	belong		156		(Private use 9
16386>20	belong		157		(Private use 10
16387>20	belong		158		(Private use 11
16388>20	belong		159		(Private use 12
16389>20	belong		160		(Private use 13
16390>20	belong		161		(Private use 14
16391>20	belong		162		(Private use 15
16392>20	belong		163		(802.11 with AVS header
16393>20	belong		165		(BACnet MS/TP
16394>20	belong		166		(PPPD
16395>20	belong		169		(GPRS LLC
16396>20	belong		177		(Linux LAPD
16397>20	belong		187		(Bluetooth HCI H4
16398>20	belong		189		(Linux USB
16399>20	belong		192		(PPI
16400>20	belong		195		(802.15.4
16401>20	belong		196		(SITA
16402>20	belong		197		(Endace ERF
16403>20	belong		201		(Bluetooth HCI H4 with pseudo-header
16404>20	belong		202		(AX.25 with KISS header
16405>20	belong		203		(LAPD
16406>20	belong		204		(PPP with direction pseudo-header
16407>20	belong		205		(Cisco HDLC with direction pseudo-header
16408>20	belong		206		(Frame Relay with direction pseudo-header
16409>20	belong		209		(Linux IPMB
16410>20	belong		215		(802.15.4 with non-ASK PHY header
16411>20	belong		220		(Memory-mapped Linux USB
16412>20	belong		224		(Fibre Channel FC-2
16413>20	belong		225		(Fibre Channel FC-2 with frame delimiters
16414>20	belong		226		(Solaris IPNET
16415>20	belong		227		(SocketCAN
16416>20	belong		228		(Raw IPv4
16417>20	belong		229		(Raw IPv6
16418>20	belong		230		(802.15.4 without FCS
16419>20	belong		231		(D-Bus messages
16420>20	belong		235		(DVB-CI
16421>20	belong		236		(MUX27010
16422>20	belong		237		(STANAG 5066 D_PDUs
16423>20	belong		239		(Linux netlink NFLOG messages
16424>20	belong		240		(Hilscher netAnalyzer
16425>20	belong		241		(Hilscher netAnalyzer with delimiters
16426>20	belong		242		(IP-over-Infiniband
16427>20	belong		243		(MPEG-2 Transport Stream packets
16428>20	belong		244		(ng4t ng40
16429>20	belong		245		(NFC LLCP
16430>20	belong		247		(Infiniband
16431>20	belong		248		(SCTP
16432>16	belong		x		\b, capture length %d)
16433
164340	ubelong		0xa1b2c3d4	tcpdump capture file (big-endian)
16435!:mime	application/vnd.tcpdump.pcap
16436>0	use	pcap-be
164370	ulelong		0xa1b2c3d4	tcpdump capture file (little-endian)
16438!:mime	application/vnd.tcpdump.pcap
16439>0	use	\^pcap-be
16440
16441#
16442# "libpcap"-with-Alexey-Kuznetsov's-patches capture files.
16443# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
16444# the main program that uses that format, but there are other programs
16445# that use "libpcap", or that use the same capture file format.)
16446#
164470	ubelong		0xa1b2cd34	extended tcpdump capture file (big-endian)
16448>0	use	pcap-be
164490	ulelong		0xa1b2cd34	extended tcpdump capture file (little-endian)
16450>0	use	\^pcap-be
16451
16452#
16453# "pcap-ng" capture files.
16454# http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html
16455# Pcap-ng files can contain multiple sections. Printing the endianness,
16456# snaplen, or other information from the first SHB may be misleading.
16457#
164580	ubelong		0x0a0d0d0a
16459>8	ubelong		0x1a2b3c4d	pcap-ng capture file
16460>>12	beshort		x		- version %d
16461>>14	beshort		x		\b.%d
164620	ulelong		0x0a0d0d0a
16463>8	ulelong		0x1a2b3c4d	pcap-ng capture file
16464>>12	leshort		x		- version %d
16465>>14	leshort		x		\b.%d
16466
16467#
16468# AIX "iptrace" capture files.
16469#
164700	string		iptrace\ 1.0	"iptrace" capture file
164710	string		iptrace\ 2.0	"iptrace" capture file
16472
16473#
16474# Novell LANalyzer capture files.
16475#
164760	leshort		0x1001		LANalyzer capture file
164770	leshort		0x1007		LANalyzer capture file
16478
16479#
16480# HP-UX "nettl" capture files.
16481#
164820	string		\x54\x52\x00\x64\x00	"nettl" capture file
16483
16484#
16485# RADCOM WAN/LAN Analyzer capture files.
16486#
164870	string		\x42\xd2\x00\x34\x12\x66\x22\x88	RADCOM WAN/LAN Analyzer capture file
16488
16489#
16490# NetStumbler log files.  Not really packets, per se, but about as
16491# close as you can get.  These are log files from NetStumbler, a
16492# Windows program, that scans for 802.11b networks.
16493#
164940	string		NetS		NetStumbler log file
16495>8	lelong		x		\b, %d stations found
16496
16497#
16498# *Peek tagged capture files.
16499#
165000	string		\177ver		EtherPeek/AiroPeek/OmniPeek capture file
16501
16502#
16503# Visual Networks traffic capture files.
16504#
165050	string		\x05VNF		Visual Networks traffic capture file
16506
16507#
16508# Network Instruments Observer capture files.
16509#
165100	string		ObserverPktBuffe	Network Instruments Observer capture file
16511
16512#
16513# Files from Accellent Group's 5View products.
16514#
165150	string		\xaa\xaa\xaa\xaa	5View capture file
16516
16517#------------------------------------------------------------------------------
16518# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $
16519# softquad:  file(1) magic for SoftQuad Publishing Software
16520#
16521# Author/Editor and RulesBuilder
16522#
16523# XXX - byte order?
16524#
165250	string		\<!SQ\ DTD>	Compiled SGML rules file
16526>9	string		>\0		 Type %s
165270	string		\<!SQ\ A/E>	A/E SGML Document binary
16528>9	string		>\0		 Type %s
165290	string		\<!SQ\ STS>	A/E SGML binary styles file
16530>9	string		>\0		 Type %s
165310	short		0xc0de		Compiled PSI (v1) data
165320	short		0xc0da		Compiled PSI (v2) data
16533>3	string		>\0		(%s)
16534# Binary sqtroff font/desc files...
165350	short		0125252		SoftQuad DESC or font file binary
16536>2	short		>0		- version %d
16537# Bitmaps...
165380	search/1	SQ\ BITMAP1	SoftQuad Raster Format text
16539#0	string		SQ\ BITMAP2	SoftQuad Raster Format data
16540# sqtroff intermediate language (replacement for ditroff int. lang.)
165410	string		X\ 		SoftQuad troff Context intermediate
16542>2	string		495		for AT&T 495 laser printer
16543>2	string		hp		for Hewlett-Packard LaserJet
16544>2	string		impr		for IMAGEN imPRESS
16545>2	string		ps		for PostScript
16546
16547# From: Michael Piefel <piefel@debian.org>
16548# sqtroff intermediate language (replacement for ditroff int. lang.)
165490	string		X\ 495		SoftQuad troff Context intermediate for AT&T 495 laser printer
165500	string		X\ hp		SoftQuad troff Context intermediate for HP LaserJet
165510	string		X\ impr		SoftQuad troff Context intermediate for IMAGEN imPRESS
165520	string		X\ ps		SoftQuad troff Context intermediate for PostScript
16553
16554#------------------------------------------------------------------------------
16555# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $
16556# spec:  file(1) magic for SPEC raw results (*.raw, *.rsf)
16557#
16558# Cloyce D. Spradling <cloyce@headgear.org>
16559
165600	string	spec			SPEC
16561>4	string	.cpu			CPU
16562>>8	string	<:			\b%.4s
16563>>12	string	.			raw result text
16564
1656517	string	version=SPECjbb		SPECjbb
16566>32	string	<:			\b%.4s
16567>>37	string	<:			v%.4s raw result text
16568
165690	string	BEGIN\040SPECWEB	SPECweb
16570>13	string	<:			\b%.2s
16571>>15	string	_SSL			\b_SSL
16572>>>20	string	<:			v%.4s raw result text
16573>>16	string	<:			v%.4s raw result text
16574
16575#------------------------------------------------------------------------------
16576# $File: spectrum,v 1.7 2010/09/20 18:55:20 rrt Exp $
16577# spectrum:  file(1) magic for Spectrum emulator files.
16578#
16579# John Elliott <jce@seasip.demon.co.uk>
16580
16581#
16582# Spectrum +3DOS header
16583#
165840       string          PLUS3DOS\032    Spectrum +3 data
16585>15     byte            0               - BASIC program
16586>15     byte            1               - number array
16587>15     byte            2               - character array
16588>15     byte            3               - memory block
16589>>16    belong          0x001B0040      (screen)
16590>15     byte            4               - Tasword document
16591>15     string          TAPEFILE        - ZXT tapefile
16592#
16593# Tape file. This assumes the .TAP starts with a Spectrum-format header,
16594# which nearly all will.
16595#
16596# Update: Sanity-check string contents to be printable.
16597#  -Adam Buchbinder <adam.buchbinder@gmail.com>
16598#
165990       string          \023\000\000
16600>4      string          >\0
16601>>4     string          <\177           Spectrum .TAP data "%-10.10s"
16602>>>3    byte            0               - BASIC program
16603>>>3    byte            1               - number array
16604>>>3    byte            2               - character array
16605>>>3    byte            3               - memory block
16606>>>>14  belong          0x001B0040      (screen)
16607
16608# The following three blocks are from pak21-spectrum@srcf.ucam.org
16609# TZX tape images
166100      string          ZXTape!\x1a     Spectrum .TZX data
16611>8     byte            x               version %d
16612>9     byte            x               \b.%d
16613
16614# RZX input recording files
166150      string          RZX!            Spectrum .RZX data
16616>4     byte            x               version %d
16617>5     byte            x               \b.%d
16618
16619# Floppy disk images
166200      string          MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data
166210      string          MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data
166220      string          EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data
166230      string          SINCLAIR        Spectrum .SCL Betadisk image
16624
16625# Hard disk images
166260      string          RS-IDE\x1a      Spectrum .HDF hard disk image
16627>7     byte            x               \b, version 0x%02x
16628
16629#------------------------------------------------------------------------------
16630# $File: sql,v 1.11 2013/02/21 15:27:01 christos Exp $
16631# sql:  file(1) magic for SQL files
16632#
16633# From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
16634# Recognize some MySQL files.
16635# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures
16636# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic
16637#
166380	beshort			0xfe01		MySQL table definition file
16639>2	byte			x		Version %d
166400	belong&0xffffff00	0xfefe0700	MySQL MyISAM index file
16641>3	byte			x		Version %d
166420	belong&0xffffff00	0xfefe0800	MySQL MyISAM compressed data file
16643>3	byte			x		Version %d
166440	belong&0xffffff00	0xfefe0900	MySQL Maria index file
16645>3	byte			x		Version %d
166460	belong&0xffffff00	0xfefe0A00	MySQL Maria compressed data file
16647>3	byte			x		Version %d
166480	belong&0xffffff00	0xfefe0500	MySQL ISAM index file
16649>3	byte			x		Version %d
166500	belong&0xffffff00	0xfefe0600	MySQL ISAM compressed data file
16651>3	byte			x		Version %d
166520	string			\376bin		MySQL replication log
166530	belong&0xffffff00	0xfefe0b00
16654>4	string			MARIALOG	MySQL Maria transaction log file
16655>>3	byte			x		Version %d
166560	belong&0xffffff00	0xfefe0c00
16657>4	string			MACF		MySQL Maria control file
16658>>3	byte			x		Version %d
16659
16660#------------------------------------------------------------------------------
16661# iRiver H Series database file
16662# From Ken Guest <ken@linux.ie>
16663# As observed from iRivNavi.iDB and unencoded firmware
16664#
166650   string		iRivDB	iRiver Database file
16666>11  string	>\0	Version %s
16667>39  string		iHP-100	[H Series]
16668
16669#------------------------------------------------------------------------------
16670# SQLite database files
16671# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg
16672#
16673# Version 1 used GDBM internally; its files cannot be distinguished
16674# from other GDBM files.
16675#
16676# Version 2 used this format:
166770	string	**\ This\ file\ contains\ an\ SQLite  SQLite 2.x database
16678
16679# Version 3 of SQLite allows applications to embed their own "user version"
16680# number in the database.  Detect this and distinguish those files.
16681
166820   string  SQLite\ format\ 3
16683>60 string  _MTN               Monotone source repository
16684>60 belong  !0                 SQLite 3.x database, user version %u
16685>60 belong  0                  SQLite 3.x database
16686
16687# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek
16688# http://www.ullrich.es/job/service-menue/panasonic/panasonic-sendersortierung-sat-am-pc/
16689# pceditor_V2003.jar
166900	string		PSDB\0			Panasonic channel list database
16691>126	string		SQLite\ format\ 3
16692>>&-15	indirect	x			\b; contains
16693# Type:	OpenSSH key files
16694# From:	Nicolas Collignon <tsointsoin@gmail.com>
16695
166960	string	SSH\ PRIVATE\ KEY	OpenSSH RSA1 private key,
16697>28	string	>\0			version %s
16698
166990	string	ssh-dss\ 		OpenSSH DSA public key
167000	string	ssh-rsa\ 		OpenSSH RSA public key
16701# Type: OpenSSL certificates/key files
16702# From: Nicolas Collignon <tsointsoin@gmail.com>
16703
167040	string	-----BEGIN\ CERTIFICATE-----	PEM certificate
167050	string	-----BEGIN\ CERTIFICATE\ REQ	PEM certificate request
167060	string	-----BEGIN\ RSA\ PRIVATE	PEM RSA private key
167070	string	-----BEGIN\ DSA\ PRIVATE	PEM DSA private key
16708
16709#------------------------------------------------------------------------------
16710# $File: sun,v 1.25 2013/01/09 22:37:24 christos Exp $
16711# sun:  file(1) magic for Sun machines
16712#
16713# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
16714# releases.  (5.x uses ELF.)  Entries for executables without an
16715# architecture type, used before the 68020-based Sun-3's came out,
16716# are in aout, as they're indistinguishable from other big-endian
16717# 32-bit a.out files.
16718#
167190	belong&077777777	0600413		a.out SunOS sparc demand paged
16720>0	byte		&0x80
16721>>20	belong		<4096		shared library
16722>>20	belong		=4096		dynamically linked executable
16723>>20	belong		>4096		dynamically linked executable
16724>0	byte		^0x80		executable
16725>16	belong		>0		not stripped
16726
167270	belong&077777777	0600410		a.out SunOS sparc pure
16728>0	byte		&0x80		dynamically linked executable
16729>0	byte		^0x80		executable
16730>16	belong		>0		not stripped
16731
167320	belong&077777777	0600407		a.out SunOS sparc
16733>0	byte		&0x80		dynamically linked executable
16734>0	byte		^0x80		executable
16735>16	belong		>0		not stripped
16736
167370	belong&077777777	0400413		a.out SunOS mc68020 demand paged
16738>0	byte		&0x80
16739>>20	belong		<4096		shared library
16740>>20	belong		=4096		dynamically linked executable
16741>>20	belong		>4096		dynamically linked executable
16742>0	byte		^0x80		executable
16743>16	belong		>0		not stripped
16744
167450	belong&077777777	0400410		a.out SunOS mc68020 pure
16746>0	byte		&0x80		dynamically linked executable
16747>0	byte		^0x80		executable
16748>16	belong		>0		not stripped
16749
167500	belong&077777777	0400407		a.out SunOS mc68020
16751>0	byte		&0x80		dynamically linked executable
16752>0	byte		^0x80		executable
16753>16	belong		>0		not stripped
16754
167550	belong&077777777	0200413		a.out SunOS mc68010 demand paged
16756>0	byte		&0x80
16757>>20	belong		<4096		shared library
16758>>20	belong		=4096		dynamically linked executable
16759>>20	belong		>4096		dynamically linked executable
16760>0	byte		^0x80		executable
16761>16	belong		>0		not stripped
16762
167630	belong&077777777	0200410		a.out SunOS mc68010 pure
16764>0	byte		&0x80		dynamically linked executable
16765>0	byte		^0x80		executable
16766>16	belong		>0		not stripped
16767
167680	belong&077777777	0200407		a.out SunOS mc68010
16769>0	byte		&0x80		dynamically linked executable
16770>0	byte		^0x80		executable
16771>16	belong		>0		not stripped
16772
16773#
16774# Core files.  "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
16775# binary executed in compatibility mode under SunOS 5.x".
16776#
167770	belong		0x080456	SunOS core file
16778>4	belong		432		(SPARC)
16779>>132	string		>\0		from '%s'
16780>>116	belong		=3		(quit)
16781>>116	belong		=4		(illegal instruction)
16782>>116	belong		=5		(trace trap)
16783>>116	belong		=6		(abort)
16784>>116	belong		=7		(emulator trap)
16785>>116	belong		=8		(arithmetic exception)
16786>>116	belong		=9		(kill)
16787>>116	belong		=10		(bus error)
16788>>116	belong		=11		(segmentation violation)
16789>>116	belong		=12		(bad argument to system call)
16790>>116	belong		=29		(resource lost)
16791>>120	belong		x		(T=%dK,
16792>>124	belong		x		D=%dK,
16793>>128	belong		x		S=%dK)
16794>4	belong		826		(68K)
16795>>128	string		>\0		from '%s'
16796>4	belong		456		(SPARC 4.x BCP)
16797>>152	string		>\0		from '%s'
16798# Sun SunPC
167990	long		0xfa33c08e	SunPC 4.0 Hard Disk
168000	string		#SUNPC_CONFIG	SunPC 4.0 Properties Values
16801# Sun snoop (see RFC 1761, which describes the capture file format,
16802# RFC 3827, which describes some additional datalink types, and
16803# http://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml,
16804# which is the IANA registry of Snoop datalink types)
16805#
168060	string		snoop		Snoop capture file
16807>8	belong		>0		- version %ld
16808>12	belong		0		(IEEE 802.3)
16809>12	belong		1		(IEEE 802.4)
16810>12	belong		2		(IEEE 802.5)
16811>12	belong		3		(IEEE 802.6)
16812>12	belong		4		(Ethernet)
16813>12	belong		5		(HDLC)
16814>12	belong		6		(Character synchronous)
16815>12	belong		7		(IBM channel-to-channel adapter)
16816>12	belong		8		(FDDI)
16817>12	belong		9		(Other)
16818>12	belong		10		(type %ld)
16819>12	belong		11		(type %ld)
16820>12	belong		12		(type %ld)
16821>12	belong		13		(type %ld)
16822>12	belong		14		(type %ld)
16823>12	belong		15		(type %ld)
16824>12	belong		16		(Fibre Channel)
16825>12	belong		17		(ATM)
16826>12	belong		18		(ATM Classical IP)
16827>12	belong		19		(type %ld)
16828>12	belong		20		(type %ld)
16829>12	belong		21		(type %ld)
16830>12	belong		22		(type %ld)
16831>12	belong		23		(type %ld)
16832>12	belong		24		(type %ld)
16833>12	belong		25		(type %ld)
16834>12	belong		26		(IP over Infiniband)
16835>12	belong		>26		(type %ld)
16836
16837#---------------------------------------------------------------------------
16838# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a
16839# lead Sun/Cobalt developer) who agrees that they are good and worthy of
16840# inclusion.
16841
16842# Boot ROM images for Sun/Cobalt Linux server appliances
168430       string  Cobalt\ Networks\ Inc.\nFirmware\ v     Paged COBALT boot rom
16844>38     string x        V%.4s
16845
16846# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code
16847# at the very end where file(1) can't get it.
168480       string CRfs     COBALT boot rom data (Flat boot rom or file system)
16849
16850#------------------------------------------------------------------------
16851# $File: sysex,v 1.6 2009/09/19 16:28:12 christos Exp $
16852# sysex: file(1) magic for MIDI sysex files
16853#
16854#
168550	byte			0xF0		SysEx File -
16856
16857# North American Group
16858>1	byte			0x01		Sequential
16859>1	byte			0x02		IDP
16860>1	byte			0x03		OctavePlateau
16861>1	byte			0x04		Moog
16862>1	byte			0x05		Passport
16863>1	byte			0x06		Lexicon
16864>1	byte			0x07		Kurzweil/Future Retro
16865>>3	byte			0x77		777
16866>>4	byte			0x00		Bank
16867>>4	byte			0x01		Song
16868>>5	byte			0x0f		16
16869>>5	byte			0x0e		15
16870>>5	byte			0x0d		14
16871>>5	byte			0x0c		13
16872>>5	byte			0x0b		12
16873>>5	byte			0x0a		11
16874>>5	byte			0x09		10
16875>>5	byte			0x08		9
16876>>5	byte			0x07		8
16877>>5	byte			0x06		7
16878>>5	byte			0x05		6
16879>>5	byte			0x04		5
16880>>5	byte			0x03		4
16881>>5	byte			0x02		3
16882>>5	byte			0x01		2
16883>>5	byte			0x00		1
16884>>5	byte			0x10		(ALL)
16885>>2	byte			x			\b, Channel %d
16886>1	byte			0x08		Fender
16887>1	byte			0x09		Gulbransen
16888>1	byte			0x0a		AKG
16889>1	byte			0x0b		Voyce
16890>1	byte			0x0c		Waveframe
16891>1	byte			0x0d		ADA
16892>1	byte			0x0e		Garfield
16893>1	byte			0x0f		Ensoniq
16894>1	byte			0x10		Oberheim
16895>>2	byte			0x06		Matrix 6 series
16896>>3	byte			0x0A		Dump (All)
16897>>3	byte			0x01		Dump (Bank)
16898>>4 belong			0x0002040E		Matrix 1000
16899>>>11 byte			<2			User bank %d
16900>>>11 byte			>1			Preset bank %d
16901>1	byte			0x11		Apple
16902>1	byte			0x12		GreyMatter
16903>1	byte			0x14		PalmTree
16904>1	byte			0x15		JLCooper
16905>1	byte			0x16		Lowrey
16906>1	byte			0x17		AdamsSmith
16907>1	byte			0x18		E-mu
16908>1	byte			0x19		Harmony
16909>1	byte			0x1a		ART
16910>1	byte			0x1b		Baldwin
16911>1	byte			0x1c		Eventide
16912>1	byte			0x1d		Inventronics
16913>1	byte			0x1f		Clarity
16914
16915# European Group
16916>1	byte			0x21		SIEL
16917>1	byte			0x22		Synthaxe
16918>1	byte			0x24		Hohner
16919>1	byte			0x25		Twister
16920>1	byte			0x26		Solton
16921>1	byte			0x27		Jellinghaus
16922>1	byte			0x28		Southworth
16923>1	byte			0x29		PPG
16924>1	byte			0x2a		JEN
16925>1	byte			0x2b		SSL
16926>1	byte			0x2c		AudioVertrieb
16927
16928>1	byte			0x2f		ELKA
16929>>3	byte			0x09		EK-44
16930
16931>1	byte			0x30		Dynacord
16932>1	byte			0x31		Jomox
16933>1	byte			0x33		Clavia
16934>1	byte			0x39		Soundcraft
16935# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs
16936>1	byte			0x3e		Waldorf
16937>>2	byte			0x00		microWave
16938>>2	byte			0x0E		microwave2 / XT
16939>>2	byte			0x0F		Q / Q+
16940>>3	byte			=0			(default id)
16941>>3 byte			>0			(
16942>>>3 byte			<0x7F		\bdevice %d)
16943>>>3 byte			=0x7F		\bbroadcast id)
16944>>3	byte			0x7f		Microwave I
16945>>>4	byte			0x00		SNDR (Sound Request)
16946>>>4	byte			0x10		SNDD (Sound Dump)
16947>>>4	byte			0x20		SNDP (Sound Parameter Change)
16948>>>4	byte			0x30		SNDQ (Sound Parameter Inquiry)
16949>>>4	byte			0x70		BOOT (Sound Reserved)
16950>>>4	byte			0x01		MULR (Multi Request)
16951>>>4	byte			0x11		MULD (Multi Dump)
16952>>>4	byte			0x21		MULP (Multi Parameter Change)
16953>>>4	byte			0x31		MULQ (Multi Parameter Inquiry)
16954>>>4	byte			0x71		OS (Multi Reserved)
16955>>>4	byte			0x02		DRMR (Drum Map Request)
16956>>>4	byte			0x12		DRMD (Drum Map Dump)
16957>>>4	byte			0x22		DRMP (Drum Map Parameter Change)
16958>>>4	byte			0x32		DRMQ (Drum Map Parameter Inquiry)
16959>>>4	byte			0x72		BIN (Drum Map Reserved)
16960>>>4	byte			0x03		PATR (Sequencer Pattern Request)
16961>>>4	byte			0x13		PATD (Sequencer Pattern Dump)
16962>>>4	byte			0x23		PATP (Sequencer Pattern Parameter Change)
16963>>>4	byte			0x33		PATQ (Sequencer Pattern Parameter Inquiry)
16964>>>4	byte			0x73		AFM (Sequencer Pattern Reserved)
16965>>>4	byte			0x04		GLBR (Global Parameter Request)
16966>>>4	byte			0x14		GLBD (Global Parameter Dump)
16967>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
16968>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
16969>>>4	byte			0x07		MODR (Mode Parameter Request)
16970>>>4	byte			0x17		MODD (Mode Parameter Dump)
16971>>>4	byte			0x27		MODP (Mode Parameter Parameter Change)
16972>>>4	byte			0x37		MODQ (Mode Parameter Parameter Inquiry)
16973>>2	byte			0x10		microQ
16974>>>4	byte			0x00		SNDR (Sound Request)
16975>>>4	byte			0x10		SNDD (Sound Dump)
16976>>>4	byte			0x20		SNDP (Sound Parameter Change)
16977>>>4	byte			0x30		SNDQ (Sound Parameter Inquiry)
16978>>>4	byte			0x70		(Sound Reserved)
16979>>>4	byte			0x01		MULR (Multi Request)
16980>>>4	byte			0x11		MULD (Multi Dump)
16981>>>4	byte			0x21		MULP (Multi Parameter Change)
16982>>>4	byte			0x31		MULQ (Multi Parameter Inquiry)
16983>>>4	byte			0x71		OS (Multi Reserved)
16984>>>4	byte			0x02		DRMR (Drum Map Request)
16985>>>4	byte			0x12		DRMD (Drum Map Dump)
16986>>>4	byte			0x22		DRMP (Drum Map Parameter Change)
16987>>>4	byte			0x32		DRMQ (Drum Map Parameter Inquiry)
16988>>>4	byte			0x72		BIN (Drum Map Reserved)
16989>>>4	byte			0x04		GLBR (Global Parameter Request)
16990>>>4	byte			0x14		GLBD (Global Parameter Dump)
16991>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
16992>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
16993>>2	byte			0x11		rackAttack
16994>>>4	byte			0x00		SNDR (Sound Parameter Request)
16995>>>4	byte			0x10		SNDD (Sound Parameter Dump)
16996>>>4	byte			0x20		SNDP (Sound Parameter Parameter Change)
16997>>>4	byte			0x30		SNDQ (Sound Parameter Parameter Inquiry)
16998>>>4	byte			0x01		PRGR (Program Parameter Request)
16999>>>4	byte			0x11		PRGD (Program Parameter Dump)
17000>>>4	byte			0x21		PRGP (Program Parameter Parameter Change)
17001>>>4	byte			0x31		PRGQ (Program Parameter Parameter Inquiry)
17002>>>4	byte			0x71		OS (Program Parameter Reserved)
17003>>>4	byte			0x03		PATR (Pattern Parameter Request)
17004>>>4	byte			0x13		PATD (Pattern Parameter Dump)
17005>>>4	byte			0x23		PATP (Pattern Parameter Parameter Change)
17006>>>4	byte			0x33		PATQ (Pattern Parameter Parameter Inquiry)
17007>>>4	byte			0x04		GLBR (Global Parameter Request)
17008>>>4	byte			0x14		GLBD (Global Parameter Dump)
17009>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
17010>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
17011>>>4	byte			0x05		EFXR (FX Parameter Request)
17012>>>4	byte			0x15		EFXD (FX Parameter Dump)
17013>>>4	byte			0x25		EFXP (FX Parameter Parameter Change)
17014>>>4	byte			0x35		EFXQ (FX Parameter Parameter Inquiry)
17015>>>4	byte			0x07		MODR (Mode Command Request)
17016>>>4	byte			0x17		MODD (Mode Command Dump)
17017>>>4	byte			0x27		MODP (Mode Command Parameter Change)
17018>>>4	byte			0x37		MODQ (Mode Command Parameter Inquiry)
17019>>2	byte			0x03		Wave
17020>>>4	byte			0x00		SBPR (Soundprogram)
17021>>>4	byte			0x01		SAPR (Performance)
17022>>>4	byte			0x02		SWAVE (Wave)
17023>>>4	byte			0x03		SWTBL (Wave control table)
17024>>>4	byte			0x04		SVT (Velocity Curve)
17025>>>4	byte			0x05		STT (Tuning Table)
17026>>>4	byte			0x06		SGLB (Global Parameters)
17027>>>4	byte			0x07		SARRMAP (Performance Program Change Map)
17028>>>4	byte			0x08		SBPRMAP (Sound Program Change Map)
17029>>>4	byte			0x09		SBPRPAR (Sound Parameter)
17030>>>4	byte			0x0A		SARRPAR (Performance Parameter)
17031>>>4	byte			0x0B		SINSPAR (Instrument/External Parameter)
17032>>>4	byte			0x0F		SBULK (Bulk Switch on/off)
17033
17034# Japanese Group
17035>1	byte			0x40		Kawai
17036>>3	byte			0x20		K1
17037>>3	byte			0x22		K4
17038
17039>1	byte			0x41		Roland
17040>>3	byte			0x14		D-50
17041>>3	byte			0x2b		U-220
17042>>3	byte			0x02		TR-707
17043
17044>1	byte			0x42		Korg
17045>>3	byte			0x19		M1
17046
17047>1	byte			0x43		Yamaha
17048>1	byte			0x44		Casio
17049>1	byte			0x46		Kamiya
17050>1	byte			0x47		Akai
17051>1	byte			0x48		Victor
17052>1	byte			0x49		Mesosha
17053>1	byte			0x4b		Fujitsu
17054>1	byte			0x4c		Sony
17055>1	byte			0x4e		Teac
17056>1	byte			0x50		Matsushita
17057>1	byte			0x51		Fostex
17058>1	byte			0x52		Zoom
17059>1	byte			0x54		Matsushita
17060>1	byte			0x57		Acoustic tech. lab.
17061
17062>1	belong&0xffffff00	0x00007400	Ta Horng
17063>1	belong&0xffffff00	0x00007500	e-Tek
17064>1	belong&0xffffff00	0x00007600	E-Voice
17065>1	belong&0xffffff00	0x00007700	Midisoft
17066>1	belong&0xffffff00	0x00007800	Q-Sound
17067>1	belong&0xffffff00	0x00007900	Westrex
17068>1	belong&0xffffff00	0x00007a00	Nvidia*
17069>1	belong&0xffffff00	0x00007b00	ESS
17070>1	belong&0xffffff00	0x00007c00	Mediatrix
17071>1	belong&0xffffff00	0x00007d00	Brooktree
17072>1	belong&0xffffff00	0x00007e00	Otari
17073>1	belong&0xffffff00	0x00007f00	Key Electronics
17074>1	belong&0xffffff00	0x00010000	Shure
17075>1	belong&0xffffff00	0x00010100	AuraSound
17076>1	belong&0xffffff00	0x00010200	Crystal
17077>1	belong&0xffffff00	0x00010300	Rockwell
17078>1	belong&0xffffff00	0x00010400	Silicon Graphics
17079>1	belong&0xffffff00	0x00010500	Midiman
17080>1	belong&0xffffff00	0x00010600	PreSonus
17081>1	belong&0xffffff00	0x00010800	Topaz
17082>1	belong&0xffffff00	0x00010900	Cast Lightning
17083>1	belong&0xffffff00	0x00010a00	Microsoft
17084>1	belong&0xffffff00	0x00010b00	Sonic Foundry
17085>1	belong&0xffffff00	0x00010c00	Line 6
17086>1	belong&0xffffff00	0x00010d00	Beatnik Inc.
17087>1	belong&0xffffff00	0x00010e00	Van Koerving
17088>1	belong&0xffffff00	0x00010f00	Altech Systems
17089>1	belong&0xffffff00	0x00011000	S & S Research
17090>1	belong&0xffffff00	0x00011100	VLSI Technology
17091>1	belong&0xffffff00	0x00011200	Chromatic
17092>1	belong&0xffffff00	0x00011300	Sapphire
17093>1	belong&0xffffff00	0x00011400	IDRC
17094>1	belong&0xffffff00	0x00011500	Justonic Tuning
17095>1	belong&0xffffff00	0x00011600	TorComp
17096>1	belong&0xffffff00	0x00011700	Newtek Inc.
17097>1	belong&0xffffff00	0x00011800	Sound Sculpture
17098>1	belong&0xffffff00	0x00011900	Walker Technical
17099>1	belong&0xffffff00	0x00011a00	Digital Harmony
17100>1	belong&0xffffff00	0x00011b00	InVision
17101>1	belong&0xffffff00	0x00011c00	T-Square
17102>1	belong&0xffffff00	0x00011d00	Nemesys
17103>1	belong&0xffffff00	0x00011e00	DBX
17104>1	belong&0xffffff00	0x00011f00	Syndyne
17105>1	belong&0xffffff00	0x00012000	Bitheadz
17106>1	belong&0xffffff00	0x00012100	Cakewalk
17107>1	belong&0xffffff00	0x00012200	Staccato
17108>1	belong&0xffffff00	0x00012300	National Semicon.
17109>1	belong&0xffffff00	0x00012400	Boom Theory
17110>1	belong&0xffffff00	0x00012500	Virtual DSP Corp
17111>1	belong&0xffffff00	0x00012600	Antares
17112>1	belong&0xffffff00	0x00012700	Angel Software
17113>1	belong&0xffffff00	0x00012800	St Louis Music
17114>1	belong&0xffffff00	0x00012900	Lyrrus dba G-VOX
17115>1	belong&0xffffff00	0x00012a00	Ashley Audio
17116>1	belong&0xffffff00	0x00012b00	Vari-Lite
17117>1	belong&0xffffff00	0x00012c00	Summit Audio
17118>1	belong&0xffffff00	0x00012d00	Aureal Semicon.
17119>1	belong&0xffffff00	0x00012e00	SeaSound
17120>1	belong&0xffffff00	0x00012f00	U.S. Robotics
17121>1	belong&0xffffff00	0x00013000	Aurisis
17122>1	belong&0xffffff00	0x00013100	Nearfield Multimedia
17123>1	belong&0xffffff00	0x00013200	FM7 Inc.
17124>1	belong&0xffffff00	0x00013300	Swivel Systems
17125>1	belong&0xffffff00	0x00013400	Hyperactive
17126>1	belong&0xffffff00	0x00013500	MidiLite
17127>1	belong&0xffffff00	0x00013600	Radical
17128>1	belong&0xffffff00	0x00013700	Roger Linn
17129>1	belong&0xffffff00	0x00013800	Helicon
17130>1	belong&0xffffff00	0x00013900	Event
17131>1	belong&0xffffff00	0x00013a00	Sonic Network
17132>1	belong&0xffffff00	0x00013b00	Realtime Music
17133>1	belong&0xffffff00	0x00013c00	Apogee Digital
17134
17135>1	belong&0xffffff00	0x00202b00	Medeli Electronics
17136>1	belong&0xffffff00	0x00202c00	Charlie Lab
17137>1	belong&0xffffff00	0x00202d00	Blue Chip Music
17138>1	belong&0xffffff00	0x00202e00	BEE OH Corp
17139>1	belong&0xffffff00	0x00202f00	LG Semicon America
17140>1	belong&0xffffff00	0x00203000	TESI
17141>1	belong&0xffffff00	0x00203100	EMAGIC
17142>1	belong&0xffffff00	0x00203200	Behringer
17143>1	belong&0xffffff00	0x00203300	Access Music
17144>1	belong&0xffffff00	0x00203400	Synoptic
17145>1	belong&0xffffff00	0x00203500	Hanmesoft Corp
17146>1	belong&0xffffff00	0x00203600	Terratec
17147>1	belong&0xffffff00	0x00203700	Proel SpA
17148>1	belong&0xffffff00	0x00203800	IBK MIDI
17149>1	belong&0xffffff00	0x00203900	IRCAM
17150>1	belong&0xffffff00	0x00203a00	Propellerhead Software
17151>1	belong&0xffffff00	0x00203b00	Red Sound Systems
17152>1	belong&0xffffff00	0x00203c00	Electron ESI AB
17153>1	belong&0xffffff00	0x00203d00	Sintefex Audio
17154>1	belong&0xffffff00	0x00203e00	Music and More
17155>1	belong&0xffffff00	0x00203f00	Amsaro
17156>1	belong&0xffffff00	0x00204000	CDS Advanced Technology
17157>1	belong&0xffffff00	0x00204100	Touched by Sound
17158>1	belong&0xffffff00	0x00204200	DSP Arts
17159>1	belong&0xffffff00	0x00204300	Phil Rees Music
17160>1	belong&0xffffff00	0x00204400	Stamer Musikanlagen GmbH
17161>1	belong&0xffffff00	0x00204500	Soundart
17162>1	belong&0xffffff00	0x00204600	C-Mexx Software
17163>1	belong&0xffffff00	0x00204700	Klavis Tech.
17164>1	belong&0xffffff00	0x00204800	Noteheads AB
17165
171660	string			T707		Roland TR-707 Data
17167#------------------------------------------------------------------------------
17168# file:  file(1) magic for Tcl scripting language
17169# URL:  http://www.tcl.tk/
17170# From: gustaf neumann
17171
17172# Tcl scripts
171730	search/1/w	#!\ /usr/bin/tcl	Tcl script text executable
17174!:mime	text/x-lua
171750	search/1/w	#!\ /usr/local/bin/tcl	Tcl script text executable
17176!:mime	text/x-tcl
171770	search/1	#!/usr/bin/env\ tcl	Tcl script text executable
17178!:mime	text/x-tcl
171790	search/1	#!\ /usr/bin/env\ tcl	Tcl script text executable
17180!:mime	text/x-tcl
171810	search/1/w	#!\ /usr/bin/wish	Tcl/Tk script text executable
17182!:mime	text/x-tcl
171830	search/1/w	#!\ /usr/local/bin/wish	Tcl/Tk script text executable
17184!:mime	text/x-tcl
171850	search/1	#!/usr/bin/env\ wish	Tcl/Tk script text executable
17186!:mime	text/x-tcl
171870	search/1	#!\ /usr/bin/env\ wish	Tcl/Tk script text executable
17188!:mime	text/x-tcl
17189
17190# check the first line
171910	search/1	package\ req
17192>0	regex		\^package[\ \t]+req	Tcl script
17193# not 'p', check other lines
171940	search/1	!p
17195>0	regex		\^package[\ \t]+req	Tcl script
17196
17197#------------------------------------------------------------------------------
17198# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $
17199# teapot:  file(1) magic for "teapot" spreadsheet
17200#
172010       string          #!teapot\012xdr      teapot work sheet (XDR format)
17202
17203#------------------------------------------------------------------------------
17204# $File: terminfo,v 1.6 2009/09/19 16:28:12 christos Exp $
17205# terminfo:  file(1) magic for terminfo
17206#
17207# XXX - byte order for screen images?
17208#
172090	string		\032\001	Compiled terminfo entry
172100	short		0433		Curses screen image
172110	short		0434		Curses screen image
17212
17213#------------------------------------------------------------------------------
17214# $File: tex,v 1.18 2011/02/08 13:45:15 christos Exp $
17215# tex:  file(1) magic for TeX files
17216#
17217# XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
17218#
17219# From <conklin@talisman.kaleida.com>
17220
17221# Although we may know the offset of certain text fields in TeX DVI
17222# and font files, we can't use them reliably because they are not
17223# zero terminated. [but we do anyway, christos]
172240	string		\367\002	TeX DVI file
17225!:mime	application/x-dvi
17226>16	string		>\0		(%s)
172270	string		\367\203	TeX generic font data
172280	string		\367\131	TeX packed font data
17229>3	string		>\0		(%s)
172300	string		\367\312	TeX virtual font data
172310	search/1	This\ is\ TeX,	TeX transcript text
172320	search/1	This\ is\ METAFONT,	METAFONT transcript text
17233
17234# There is no way to detect TeX Font Metric (*.tfm) files without
17235# breaking them apart and reading the data.  The following patterns
17236# match most *.tfm files generated by METAFONT or afm2tfm.
172372	string		\000\021	TeX font metric data
17238!:mime	application/x-tex-tfm
17239>33	string		>\0		(%s)
172402	string		\000\022	TeX font metric data
17241!:mime	application/x-tex-tfm
17242>33	string		>\0		(%s)
17243
17244# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
172450	search/1	\\input\ texinfo	Texinfo source text
17246!:mime	text/x-texinfo
172470	search/1	This\ is\ Info\ file	GNU Info text
17248!:mime	text/x-info
17249
17250# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
172510	search/4096	\\input		TeX document text
17252!:mime	text/x-tex
17253!:strength + 15
172540	search/4096	\\section	LaTeX document text
17255!:mime	text/x-tex
17256!:strength + 18
172570	search/4096	\\setlength	LaTeX document text
17258!:mime	text/x-tex
17259!:strength + 15
172600	search/4096	\\documentstyle	LaTeX document text
17261!:mime	text/x-tex
17262!:strength + 18
172630	search/4096	\\chapter	LaTeX document text
17264!:mime	text/x-tex
17265!:strength + 18
172660	search/4096	\\documentclass	LaTeX 2e document text
17267!:mime	text/x-tex
17268!:strength + 15
172690	search/4096	\\relax		LaTeX auxiliary file
17270!:mime	text/x-tex
17271!:strength + 15
172720	search/4096	\\contentsline	LaTeX table of contents
17273!:mime	text/x-tex
17274!:strength + 15
172750	search/4096	%\ -*-latex-*-	LaTeX document text
17276!:mime	text/x-tex
17277
17278# Tex document, from Hendrik Scholz <hendrik@scholz.net>
172790   	search/1	\\ifx		TeX document text
17280
17281# Index and glossary files
172820	search/4096	\\indexentry	LaTeX raw index file
172830	search/4096	\\begin{theindex}	LaTeX sorted index
172840	search/4096	\\glossaryentry	LaTeX raw glossary
172850	search/4096	\\begin{theglossary}	LaTeX sorted glossary
172860	search/4096	This\ is\ makeindex	Makeindex log file
17287
17288# End of TeX
17289
17290#------------------------------------------------------------------------------
17291# file(1) magic for BibTex text files
17292# From Hendrik Scholz <hendrik@scholz.net>
17293
172940	search/1/c	@article{	BibTeX text file
172950	search/1/c	@book{		BibTeX text file
172960	search/1/c	@inbook{	BibTeX text file
172970	search/1/c	@incollection{	BibTeX text file
172980	search/1/c	@inproceedings{	BibTeX text file
172990	search/1/c	@manual{	BibTeX text file
173000	search/1/c	@misc{		BibTeX text file
173010	search/1/c	@preamble{	BibTeX text file
173020	search/1/c	@phdthesis{	BibTeX text file
173030	search/1/c	@techreport{	BibTeX text file
173040	search/1/c	@unpublished{	BibTeX text file
17305
1730673	search/1	%%%\ \ 		BibTeX-file{ BibTex text file (with full header)
17307
1730873	search/1	%%%\ \ @BibTeX-style-file{   BibTeX style text file (with full header)
17309
173100	search/1	%\ BibTeX\ standard\ bibliography\ 	BibTeX standard bibliography style text file
17311
173120	search/1	%\ BibTeX\ `	BibTeX custom bibliography style text file
17313
173140	search/1	@c\ @mapfile{	TeX font aliases text file
17315
173160	string		#LyX		LyX document text
17317
17318#------------------------------------------------------------------------------
17319# $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $
17320# file(1) magic for tgif(1) files
17321# From Hendrik Scholz <hendrik@scholz.net>
173220	string	%TGIF\ 			Tgif file version
17323>6	string	x			%s
17324
17325#------------------------------------------------------------------------------
17326# $File: ti-8x,v 1.6 2009/09/19 16:28:12 christos Exp $
17327# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators.
17328#
17329# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us).
17330#
17331# Update: Romain Lievin (roms@lpg.ticalc.org).
17332#
17333# NOTE: This list is not complete.
17334# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the
17335# program/group magic numbers in here because I cannot find any.
173360		string		**TI80**	TI-80 Graphing Calculator File.
173370		string		**TI81**	TI-81 Graphing Calculator File.
17338#
17339# Magic Numbers for the TI-73
17340#
173410		string		**TI73**	TI-73 Graphing Calculator
17342>0x00003B	byte		0x00		(real number)
17343>0x00003B	byte		0x01		(list)
17344>0x00003B	byte		0x02		(matrix)
17345>0x00003B	byte		0x03		(equation)
17346>0x00003B	byte		0x04		(string)
17347>0x00003B	byte		0x05		(program)
17348>0x00003B	byte		0x06		(assembly program)
17349>0x00003B	byte		0x07		(picture)
17350>0x00003B	byte		0x08		(gdb)
17351>0x00003B	byte		0x0C		(complex number)
17352>0x00003B	byte		0x0F		(window settings)
17353>0x00003B	byte		0x10		(zoom)
17354>0x00003B	byte		0x11		(table setup)
17355>0x00003B	byte		0x13		(backup)
17356
17357# Magic Numbers for the TI-82
17358#
173590		string		**TI82**	TI-82 Graphing Calculator
17360>0x00003B	byte		0x00		(real)
17361>0x00003B	byte		0x01		(list)
17362>0x00003B	byte		0x02		(matrix)
17363>0x00003B	byte		0x03		(Y-variable)
17364>0x00003B	byte		0x05		(program)
17365>0x00003B	byte		0x06		(protected prgm)
17366>0x00003B	byte		0x07		(picture)
17367>0x00003B	byte		0x08		(gdb)
17368>0x00003B	byte		0x0B		(window settings)
17369>0x00003B	byte		0x0C		(window settings)
17370>0x00003B	byte		0x0D		(table setup)
17371>0x00003B	byte		0x0E		(screenshot)
17372>0x00003B	byte		0x0F		(backup)
17373#
17374# Magic Numbers for the TI-83
17375#
173760		string		**TI83**	TI-83 Graphing Calculator
17377>0x00003B	byte		0x00		(real)
17378>0x00003B	byte		0x01		(list)
17379>0x00003B	byte		0x02		(matrix)
17380>0x00003B	byte		0x03		(Y-variable)
17381>0x00003B	byte		0x04		(string)
17382>0x00003B	byte		0x05		(program)
17383>0x00003B	byte		0x06		(protected prgm)
17384>0x00003B	byte		0x07		(picture)
17385>0x00003B	byte		0x08		(gdb)
17386>0x00003B	byte		0x0B		(window settings)
17387>0x00003B	byte		0x0C		(window settings)
17388>0x00003B	byte		0x0D		(table setup)
17389>0x00003B	byte		0x0E		(screenshot)
17390>0x00003B	byte		0x13		(backup)
17391#
17392# Magic Numbers for the TI-83+
17393#
173940		string		**TI83F*	TI-83+ Graphing Calculator
17395>0x00003B	byte		0x00		(real number)
17396>0x00003B	byte		0x01		(list)
17397>0x00003B	byte		0x02		(matrix)
17398>0x00003B	byte		0x03		(equation)
17399>0x00003B	byte		0x04		(string)
17400>0x00003B	byte		0x05		(program)
17401>0x00003B	byte		0x06		(assembly program)
17402>0x00003B	byte		0x07		(picture)
17403>0x00003B	byte		0x08		(gdb)
17404>0x00003B	byte		0x0C		(complex number)
17405>0x00003B	byte		0x0F		(window settings)
17406>0x00003B	byte		0x10		(zoom)
17407>0x00003B	byte		0x11		(table setup)
17408>0x00003B	byte		0x13		(backup)
17409>0x00003B	byte		0x15		(application variable)
17410>0x00003B	byte		0x17		(group of variable)
17411
17412#
17413# Magic Numbers for the TI-85
17414#
174150		string		**TI85**	TI-85 Graphing Calculator
17416>0x00003B	byte		0x00		(real number)
17417>0x00003B	byte		0x01		(complex number)
17418>0x00003B	byte		0x02		(real vector)
17419>0x00003B	byte		0x03		(complex vector)
17420>0x00003B	byte		0x04		(real list)
17421>0x00003B	byte		0x05		(complex list)
17422>0x00003B	byte		0x06		(real matrix)
17423>0x00003B	byte		0x07		(complex matrix)
17424>0x00003B	byte		0x08		(real constant)
17425>0x00003B	byte		0x09		(complex constant)
17426>0x00003B	byte		0x0A		(equation)
17427>0x00003B	byte		0x0C		(string)
17428>0x00003B	byte		0x0D		(function GDB)
17429>0x00003B	byte		0x0E		(polar GDB)
17430>0x00003B	byte		0x0F		(parametric GDB)
17431>0x00003B	byte		0x10		(diffeq GDB)
17432>0x00003B	byte		0x11		(picture)
17433>0x00003B	byte		0x12		(program)
17434>0x00003B	byte		0x13		(range)
17435>0x00003B	byte		0x17		(window settings)
17436>0x00003B	byte		0x18		(window settings)
17437>0x00003B	byte		0x19		(window settings)
17438>0x00003B	byte		0x1A		(window settings)
17439>0x00003B	byte		0x1B		(zoom)
17440>0x00003B	byte		0x1D		(backup)
17441>0x00003B	byte		0x1E		(unknown)
17442>0x00003B	byte		0x2A		(equation)
17443>0x000032	string		ZS4		- ZShell Version 4 File.
17444>0x000032	string		ZS3		- ZShell Version 3 File.
17445#
17446# Magic Numbers for the TI-86
17447#
174480		string		**TI86**	TI-86 Graphing Calculator
17449>0x00003B	byte		0x00		(real number)
17450>0x00003B	byte		0x01		(complex number)
17451>0x00003B	byte		0x02		(real vector)
17452>0x00003B	byte		0x03		(complex vector)
17453>0x00003B	byte		0x04		(real list)
17454>0x00003B	byte		0x05		(complex list)
17455>0x00003B	byte		0x06		(real matrix)
17456>0x00003B	byte		0x07		(complex matrix)
17457>0x00003B	byte		0x08		(real constant)
17458>0x00003B	byte		0x09		(complex constant)
17459>0x00003B	byte		0x0A		(equation)
17460>0x00003B	byte		0x0C		(string)
17461>0x00003B	byte		0x0D		(function GDB)
17462>0x00003B	byte		0x0E		(polar GDB)
17463>0x00003B	byte		0x0F		(parametric GDB)
17464>0x00003B	byte		0x10		(diffeq GDB)
17465>0x00003B	byte		0x11		(picture)
17466>0x00003B	byte		0x12		(program)
17467>0x00003B	byte		0x13		(range)
17468>0x00003B	byte		0x17		(window settings)
17469>0x00003B	byte		0x18		(window settings)
17470>0x00003B	byte		0x19		(window settings)
17471>0x00003B	byte		0x1A		(window settings)
17472>0x00003B	byte		0x1B		(zoom)
17473>0x00003B	byte		0x1D		(backup)
17474>0x00003B	byte		0x1E		(unknown)
17475>0x00003B	byte		0x2A		(equation)
17476#
17477# Magic Numbers for the TI-89
17478#
174790		string		**TI89**	TI-89 Graphing Calculator
17480>0x000048	byte		0x00		(expression)
17481>0x000048	byte		0x04		(list)
17482>0x000048	byte		0x06		(matrix)
17483>0x000048	byte		0x0A		(data)
17484>0x000048	byte		0x0B		(text)
17485>0x000048	byte		0x0C		(string)
17486>0x000048	byte		0x0D		(graphic data base)
17487>0x000048	byte		0x0E		(figure)
17488>0x000048	byte		0x10		(picture)
17489>0x000048	byte		0x12		(program)
17490>0x000048	byte		0x13		(function)
17491>0x000048	byte		0x14		(macro)
17492>0x000048	byte		0x1C		(zipped)
17493>0x000048	byte		0x21		(assembler)
17494#
17495# Magic Numbers for the TI-92
17496#
174970		string		**TI92**	TI-92 Graphing Calculator
17498>0x000048	byte		0x00		(expression)
17499>0x000048	byte		0x04		(list)
17500>0x000048	byte		0x06		(matrix)
17501>0x000048	byte		0x0A		(data)
17502>0x000048	byte		0x0B		(text)
17503>0x000048	byte		0x0C		(string)
17504>0x000048	byte		0x0D		(graphic data base)
17505>0x000048	byte		0x0E		(figure)
17506>0x000048	byte		0x10		(picture)
17507>0x000048	byte		0x12		(program)
17508>0x000048	byte		0x13		(function)
17509>0x000048	byte		0x14		(macro)
17510>0x000048	byte		0x1D		(backup)
17511#
17512# Magic Numbers for the TI-92+/V200
17513#
175140		string		**TI92P*	TI-92+/V200 Graphing Calculator
17515>0x000048	byte		0x00		(expression)
17516>0x000048	byte		0x04		(list)
17517>0x000048	byte		0x06		(matrix)
17518>0x000048	byte		0x0A		(data)
17519>0x000048	byte		0x0B		(text)
17520>0x000048	byte		0x0C		(string)
17521>0x000048	byte		0x0D		(graphic data base)
17522>0x000048	byte		0x0E		(figure)
17523>0x000048	byte		0x10		(picture)
17524>0x000048	byte		0x12		(program)
17525>0x000048	byte		0x13		(function)
17526>0x000048	byte		0x14		(macro)
17527>0x000048	byte		0x1C		(zipped)
17528>0x000048	byte		0x21		(assembler)
17529#
17530# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades
17531#
175320x0000016	string		Advanced	TI-XX Graphing Calculator (FLASH)
175330		string		**TIFL**	TI-XX Graphing Calculator (FLASH)
17534>8		byte		>0		- Revision %d
17535>>9 		byte		x		\b.%d,
17536>12		byte		>0		Revision date %02x
17537>>13		byte		x		\b/%02x
17538>>14		beshort		x		\b/%04x,
17539>17		string		>/0		name: '%s',
17540>48		byte		0x74		device: TI-73,
17541>48		byte		0x73		device: TI-83+,
17542>48		byte		0x98		device: TI-89,
17543>48		byte		0x88		device: TI-92+,
17544>49		byte		0x23		type: OS upgrade,
17545>49		byte		0x24		type: application,
17546>49		byte		0x25		type: certificate,
17547>49		byte		0x3e		type: license,
17548>74		lelong		>0		size: %ld bytes
17549
17550# VTi & TiEmu skins (TI Graphing Calculators).
17551# From: Romain Lievin (roms@lpg.ticalc.org).
17552# Magic Numbers for the VTi skins
175530               string          VTI		Virtual TI skin
17554>3		string		v		- Version
17555>>4		byte		>0		\b %c
17556>>6		byte		x		\b.%c
17557# Magic Numbers for the TiEmu skins
175580		string		TiEmu		TiEmu skin
17559>6              string          v               - Version
17560>>7             byte            >0              \b %c
17561>>9             byte            x               \b.%c
17562>>10		byte		x		\b%c
17563
17564#------------------------------------------------------------------------------
17565# $File: timezone,v 1.11 2009/09/19 16:28:12 christos Exp $
17566# timezone:  file(1) magic for timezone data
17567#
17568# from Daniel Quinlan (quinlan@yggdrasil.com)
17569# this should work on Linux, SunOS, and maybe others
17570# Added new official magic number for recent versions of the Olson code
175710	string	TZif	timezone data
17572>4	byte	0	\b, old version
17573>4	byte	>0	\b, version %c
17574>20	belong	0	\b, no gmt time flags
17575>20	belong	1	\b, 1 gmt time flag
17576>20	belong	>1	\b, %d gmt time flags
17577>24	belong	0	\b, no std time flags
17578>20	belong	1	\b, 1 std time flag
17579>24	belong	>1	\b, %d std time flags
17580>28	belong	0	\b, no leap seconds
17581>28	belong	1	\b, 1 leap second
17582>28	belong  >1	\b, %d leap seconds
17583>32	belong	0	\b, no transition times
17584>32	belong	1	\b, 1 transition time
17585>32	belong  >1	\b, %d transition times
17586>36	belong	0	\b, no abbreviation chars
17587>36	belong	1	\b, 1 abbreviation char
17588>36	belong	>1	\b, %d abbreviation chars
175890	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0	old timezone data
175900	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0	old timezone data
175910	string  \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0	old timezone data
175920	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0	old timezone data
175930	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0	old timezone data
175940	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0	old timezone data
17595
17596#------------------------------------------------------------------------------
17597# $File: troff,v 1.10 2009/09/19 16:28:12 christos Exp $
17598# troff:  file(1) magic for *roff
17599#
17600# updated by Daniel Quinlan (quinlan@yggdrasil.com)
17601
17602# troff input
176030	search/1	.\\"		troff or preprocessor input text
17604!:mime	text/troff
176050	search/1	'\\"		troff or preprocessor input text
17606!:mime	text/troff
176070	search/1	'.\\"		troff or preprocessor input text
17608!:mime	text/troff
176090	search/1	\\"		troff or preprocessor input text
17610!:mime	text/troff
176110	search/1	'''		troff or preprocessor input text
17612!:mime	text/troff
176130	regex/20	\^\\.[A-Za-z0-9][A-Za-z0-9][\ \t]	troff or preprocessor input text
17614!:mime	text/troff
176150	regex/20	\^\\.[A-Za-z0-9][A-Za-z0-9]$	troff or preprocessor input text
17616!:mime	text/troff
17617
17618# ditroff intermediate output text
176190	search/1	x\ T		ditroff output text
17620>4	search/1	cat		for the C/A/T phototypesetter
17621>4	search/1	ps		for PostScript
17622>4	search/1	dvi		for DVI
17623>4	search/1	ascii		for ASCII
17624>4	search/1	lj4		for LaserJet 4
17625>4	search/1	latin1		for ISO 8859-1 (Latin 1)
17626>4	search/1	X75		for xditview at 75dpi
17627>>7	search/1	-12		(12pt)
17628>4	search/1	X100		for xditview at 100dpi
17629>>8	search/1	-12		(12pt)
17630
17631# output data formats
176320	string		\100\357	very old (C/A/T) troff output data
17633
17634#------------------------------------------------------------------------------
17635# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $
17636# tuxedo:	file(1) magic for BEA TUXEDO data files
17637#
17638# from Ian Springer <ispringer@hotmail.com>
17639#
176400	string		\0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0	BEA TUXEDO DES mask data
17641
17642#------------------------------------------------------------------------------
17643# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $
17644# typeset:  file(1) magic for other typesetting
17645#
176460	string		Interpress/Xerox	Xerox InterPress data
17647>16	string		/			(version
17648>>17	string		>\0			%s)
17649
17650#------------------------------------------------------------------------------
17651# $File: unicode,v 1.6 2010/09/20 18:55:20 rrt Exp $
17652# Unicode:  BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp>
17653# GRR: These types should be recognised in file_ascmagic so these
17654# encodings can be treated by text patterns.
17655# Missing types are already dealt with internally.
17656#
176570	string	+/v8			Unicode text, UTF-7
176580	string	+/v9			Unicode text, UTF-7
176590	string	+/v+			Unicode text, UTF-7
176600	string	+/v/			Unicode text, UTF-7
176610	string	\335\163\146\163	Unicode text, UTF-8-EBCDIC
176620	string	\000\000\376\377	Unicode text, UTF-32, big-endian
176630	string	\377\376\000\000	Unicode text, UTF-32, little-endian
176640	string	\016\376\377		Unicode text, SCSU (Standard Compression Scheme for Unicode)
17665
17666#------------------------------------------------------------------------------
17667# $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $
17668# unknown:  file(1) magic for unknown machines
17669#
17670# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11
17671# (executable, pure, and split I&D, respectively), but the PDP-11 version
17672# doesn't have the "version %ld", which may be a bogus COFFism (I don't
17673# think there was ever COFF for the PDP-11).
17674#
17675# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
17676# long, as it would be on a VAX.  In any case, that could collide with
17677# VAX demand-paged files, as the magic number is little-endian on those
17678# binaries, so the first 16 bits of the file would contain 0x10B.
17679#
17680# Therefore, those entries are commented out.
17681#
17682# 0x10C is 0414 and 0x10E is 0416; those *are* unknown.
17683#
17684#0	short		0x107		unknown machine executable
17685#>8	short		>0		not stripped
17686#>15	byte		>0		- version %ld
17687#0	short		0x108		unknown pure executable
17688#>8	short		>0		not stripped
17689#>15	byte		>0		- version %ld
17690#0	short		0x109		PDP-11 separate I&D
17691#>8	short		>0		not stripped
17692#>15	byte		>0		- version %ld
17693#0	short		0x10b		unknown pure executable
17694#>8	short		>0		not stripped
17695#>15	byte		>0		- version %ld
176960	long		0x10c		unknown demand paged pure executable
17697>16	long		>0		not stripped
176980	long		0x10e		unknown readable demand paged pure executable
17699
17700#------------------------------------------------------------------------------
17701# $File: uterus,v 1.1 2012/12/18 18:53:32 christos Exp $
17702# file(1) magic for uterus files
17703# http://freecode.com/projects/uterus
17704#
177050	string		UTE+	uterus file
17706>4	string		v	\b, version
17707>5	byte		x	%c
17708>6	string		.	\b.
17709>7	byte		x	\b%c
17710>8	string		\<\>	\b, big-endian
17711>>16	belong		>0	\b, slut size %u
17712>8	string		\>\<	\b, litte-endian
17713>>16	lelong		>0	\b, slut size %u
17714>10	byte		&8	\b, compressed
17715
17716#------------------------------------------------------------------------------
17717# $File: uuencode,v 1.7 2009/09/19 16:28:13 christos Exp $
17718# uuencode:  file(1) magic for ASCII-encoded files
17719#
17720
17721# GRR:  the first line of xxencoded files is identical to that in uuencoded
17722# files, but the first character in most subsequent lines is 'h' instead of
17723# 'M'.  (xxencoding uses lowercase letters in place of most of uuencode's
17724# punctuation and survives BITNET gateways better.)  If regular expressions
17725# were supported, this entry could possibly be split into two with
17726# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
177270	search/1	begin\ 		uuencoded or xxencoded text
17728
17729# btoa(1) is an alternative to uuencode that requires less space.
177300	search/1	xbtoa\ Begin	btoa'd text
17731
17732# ship(1) is another, much cooler alternative to uuencode.
17733# Greg Roelofs, newt@uchicago.edu
177340	search/1	$\012ship	ship'd binary text
17735
17736# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
17737# Greg Roelofs, newt@uchicago.edu
177380	search/1	Decode\ the\ following\ with\ bdeco	bencoded News text
17739
17740# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
17741# Daniel Quinlan, quinlan@yggdrasil.com
1774211	search/1	must\ be\ converted\ with\ BinHex	BinHex binary text
17743>41	search/1	x					\b, version %.3s
17744
17745# GRR: handle BASE64
17746
17747#------------------------------------------------------------------------------
17748# $File: varied.out,v 1.22 2010/07/02 00:06:27 christos Exp $
17749# varied.out:  file(1) magic for various USG systems
17750#
17751#	Herewith many of the object file formats used by USG systems.
17752#	Most have been moved to files for a particular processor,
17753#	and deleted if they duplicate other entries.
17754#
177550	short		0610		Perkin-Elmer executable
17756# AMD 29K
177570	beshort		0572		amd 29k coff noprebar executable
177580	beshort		01572		amd 29k coff prebar executable
177590	beshort		0160007		amd 29k coff archive
17760# Cray
177616	beshort		0407		unicos (cray) executable
17762# Ultrix 4.3
17763596	string		\130\337\377\377	Ultrix core file
17764>600	string		>\0		from '%s'
17765# BeOS and MAcOS PEF executables
17766# From: hplus@zilker.net (Jon Watte)
177670	string		Joy!peffpwpc	header for PowerPC PEF executable
17768#
17769# ava assembler/linker Uros Platise <uros.platise@ijs.si>
177700       string          avaobj  AVR assembler object code
17771>7      string          >\0     version '%s'
17772# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr>
177730	string		gmon		GNU prof performance data
17774>4	long		x		- version %ld
17775# From: Dave Pearson <davep@davep.org>
17776# Harbour <URL:http://harbour-project.org/> HRB files.
177770	string		\xc0HRB		Harbour HRB file
17778>4	leshort		x		version %d
17779# Harbour HBV files
177800	string		\xc0HBV		Harbour variable dump file
17781>4	leshort		x		version %d
17782
17783# From: Alex Beregszaszi <alex@fsn.hu>
17784# 0	string		exec 		BugOS executable
17785# 0	string		pack		BugOS archive
17786
17787# From: Jason Spence <jspence@lightconsulting.com>
17788# Generated by the "examples" in STM's ST40 devkit, and derived code.
177890	lelong		0x13a9f17e	ST40 component image format
17790>4	string		>\0		\b, name '%s'
17791
17792#------------------------------------------------------------------------------
17793# $File: varied.script,v 1.9 2011/12/16 16:32:48 rrt Exp $
17794# varied.script:  file(1) magic for various interpreter scripts
17795
177960	string/t		#!\ /			a
17797>3	string		>\0			%s script text executable
17798!:strength / 2
177990	string/t		#!\t/			a
17800>3	string		>\0			%s script text executable
17801!:strength / 2
178020	string/t		#!/			a
17803>2	string		>\0			%s script text executable
17804!:strength / 2
178050	string/t		#!\ 			script text executable
17806>3	string		>\0			for %s
17807!:strength / 3
17808
17809# using env
178100	string/t	#!/usr/bin/env		a
17811>15	string/t	>\0			%s script text executable
17812!:strength / 10
178130	string/t	#!\ /usr/bin/env	a
17814>16	string/t	>\0			%s script text executable
17815!:strength / 10
17816
17817# From: arno <arenevier@fdn.fr>
17818# mozilla xpconnect typelib
17819# see http://www.mozilla.org/scriptable/typelib_file.html
178200	string 		XPCOM\nTypeLib\r\n\032		XPConnect Typelib
17821>0x10  byte        x       version %d
17822>>0x11 byte        x      \b.%d
17823
17824#------------------------------------------------------------------------------
17825# $File: vax,v 1.8 2013/01/09 22:37:24 christos Exp $
17826# vax:  file(1) magic for VAX executable/object and APL workspace
17827#
178280	lelong		0101557		VAX single precision APL workspace
178290	lelong		0101556		VAX double precision APL workspace
17830
17831#
17832# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian
17833# executables, and are handled in aout)
17834#
178350	lelong		0420		a.out VAX demand paged (first page unmapped) pure executable
17836>16	lelong		>0		not stripped
17837
17838#
17839# VAX COFF
17840#
17841# The `versions' were commented out, but have been un-commented out.
17842# (Was the problem just one of endianness?)
17843#
178440	leshort		0570		VAX COFF executable
17845>12	lelong		>0		not stripped
17846>22	leshort		>0		- version %ld
178470	leshort		0575		VAX COFF pure executable
17848>12	lelong		>0		not stripped
17849>22	leshort		>0		- version %ld
17850
17851#------------------------------------------------------------------------------
17852# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $
17853# vicar:  file(1) magic for VICAR files.
17854#
17855# From: Ossama Othman <othman@astrosun.tn.cornell.edu
17856# VICAR is JPL's in-house spacecraft image processing program
17857# VICAR image
178580	string	LBLSIZE=	VICAR image data
17859>32	string	BYTE		\b, 8 bits  = VAX byte
17860>32	string	HALF		\b, 16 bits = VAX word     = Fortran INTEGER*2
17861>32	string	FULL		\b, 32 bits = VAX longword = Fortran INTEGER*4
17862>32	string	REAL		\b, 32 bits = VAX longword = Fortran REAL*4
17863>32	string	DOUB		\b, 64 bits = VAX quadword = Fortran REAL*8
17864>32	string	COMPLEX		\b, 64 bits = VAX quadword = Fortran COMPLEX*8
17865# VICAR label file
1786643	string	SFDU_LABEL	VICAR label file
17867
17868#------------------------------------------------------------------------------
17869# $File: virtual,v 1.2 2011/11/22 13:30:05 christos Exp $
17870# From: James Nobis <quel@quelrod.net>
17871# Microsoft hard disk images for:
17872# Virtual Server
17873# Virtual PC
17874# http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx
17875# .vhd
178760	string	conectix	Microsoft Disk Image, Virtual Server or Virtual PC
17877
17878# Sun xVM VirtualBox Disk Image
17879# From: Richard W.M. Jones <rich@annexia.org>
17880# VirtualBox Disk Image
178810x40	ulelong		0xbeda107f	VirtualBox Disk Image
17882>0x44	uleshort	>0		\b, major %u
17883>0x46	uleshort	>0		\b, minor %u
17884
17885#------------------------------------------------------------------------------
17886# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $
17887# Virtutech Compressed Random Access File Format
17888#
17889# From <gustav@virtutech.com>
178900      string          \211\277\036\203        Virtutech CRAFF
17891>4     belong          x               v%d
17892>20    belong          0               uncompressed
17893>20    belong          1               bzipp2ed
17894>20    belong          2               gzipped
17895>24    belong          0               not clean
17896
17897#------------------------------------------------------------------------------
17898# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $
17899# visx:  file(1) magic for Visx format files
17900#
179010	short		0x5555		VISX image file
17902>2	byte		0		(zero)
17903>2	byte		1		(unsigned char)
17904>2	byte		2		(short integer)
17905>2	byte		3		(float 32)
17906>2	byte		4		(float 64)
17907>2	byte		5		(signed char)
17908>2	byte		6		(bit-plane)
17909>2	byte		7		(classes)
17910>2	byte		8		(statistics)
17911>2	byte		10		(ascii text)
17912>2	byte		15		(image segments)
17913>2	byte		100		(image set)
17914>2	byte		101		(unsigned char vector)
17915>2	byte		102		(short integer vector)
17916>2	byte		103		(float 32 vector)
17917>2	byte		104		(float 64 vector)
17918>2	byte		105		(signed char vector)
17919>2	byte		106		(bit plane vector)
17920>2	byte		121		(feature vector)
17921>2	byte		122		(feature vector library)
17922>2	byte		124		(chain code)
17923>2	byte		126		(bit vector)
17924>2	byte		130		(graph)
17925>2	byte		131		(adjacency graph)
17926>2	byte		132		(adjacency graph library)
17927>2	string		.VISIX		(ascii text)
17928
17929#------------------------------------------------------------------------------
17930# $File: vms,v 1.7 2013/03/09 22:36:00 christos Exp $
17931# vms:  file(1) magic for VMS executables (experimental)
17932#
17933# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
17934
17935# GRR 950122:  I'm just guessing on these, based on inspection of the headers
17936# of three executables each for Alpha and VAX architectures.  The VAX files
17937# all had headers similar to this:
17938#
17939#   00000  b0 00 30 00 44 00 60 00  00 00 00 00 30 32 30 35  ..0.D.`.....0205
17940#   00010  01 01 00 00 ff ff ff ff  ff ff ff ff 00 00 00 00  ................
17941#
179420	string	\xb0\0\x30\0	VMS VAX executable
17943>44032	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
17944#
17945# The AXP files all looked like this, except that the byte at offset 0x22
17946# was 06 in some of them and 07 in others:
17947#
17948#   00000  03 00 00 00 00 00 00 00  ec 02 00 00 10 01 00 00  ................
17949#   00010  68 00 00 00 98 00 00 00  b8 00 00 00 00 00 00 00  h...............
17950#   00020  00 00 07 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
17951#   00030  00 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  ................
17952#   00040  00 00 00 00 ff ff ff ff  ff ff ff ff 02 00 00 00  ................
17953#
17954# GRR this test is still too general as it catches example addressen.dbt
179550	belong	0x03000000
17956>8	ubelong	0xec020000	VMS Alpha executable
17957>>75264	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
17958
17959#------------------------------------------------------------------------------
17960# $File: vmware,v 1.7 2009/09/19 16:28:13 christos Exp $
17961# VMware specific files (deducted from version 1.1 and log file entries)
17962# Anthon van der Neut (anthon@mnt.org)
179630	belong	0x4d52564e	VMware nvram
17964
17965#------------------------------------------------------------------------------
17966# $File: vorbis,v 1.16 2009/09/19 16:28:13 christos Exp $
17967# vorbis:  file(1) magic for Ogg/Vorbis files
17968#
17969# From Felix von Leitner <leitner@fefe.de>
17970# Extended by Beni Cherniavsky <cben@crosswinds.net>
17971# Further extended by Greg Wooledge <greg@wooledge.org>
17972#
17973# Most (everything but the number of channels and bitrate) is commented
17974# out with `##' as it's not interesting to the average user.  The most
17975# probable things advanced users would want to uncomment are probably
17976# the number of comments and the encoder version.
17977#
17978# FIXME: The first match has been made a search, so that it can skip
17979# over prepended ID3 tags. This will work for MIME type detection, but
17980# won't work for detecting other properties of the file (they all need
17981# to be made relative to the search). In any case, if the file has ID3
17982# tags, the ID3 information will be printed, not the Ogg information,
17983# so until that's fixed, this doesn't matter.
17984# FIXME[2]: Disable the above for now, since search assumes text mode.
17985#
17986# --- Ogg Framing ---
17987#0		search/1000	OggS		Ogg data
179880		string	OggS		Ogg data
17989!:mime		application/ogg
17990>4		byte		!0		UNKNOWN REVISION %u
17991##>4		byte		0		revision 0
17992>4		byte		0
17993##>>14		lelong		x		(Serial %lX)
17994# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net)
17995>>28		string		\x7fFLAC	\b, FLAC audio
17996# non-Vorbis content: Theora
17997>>28		string		\x80theora	\b, Theora video
17998# non-Vorbis content: Kate
17999>>28		string		\x80kate\0\0\0\0	\b, Kate
18000>>>37		ubyte		x		v%u
18001>>>38		ubyte		x		\b.%u,
18002>>>40		byte		0		utf8 encoding,
18003>>>40		byte		!0		unknown character encoding,
18004>>>60		string		>\0		language %s,
18005>>>60		string		\0		no language set,
18006>>>76		string		>\0		category %s
18007>>>76		string		\0		no category set
18008# non-Vorbis content: Skeleton
18009>>28		string		fishead\0	\b, Skeleton
18010>>>36		short		x		v%u
18011>>>40		short		x		\b.%u
18012# non-Vorbis content: Speex
18013>>28		string		Speex\ \ \ 	\b, Speex audio
18014# non-Vorbis content: OGM
18015>>28		string		\x01video\0\0\0	\b, OGM video
18016>>>37		string/c	div3		(DivX 3)
18017>>>37		string/c	divx		(DivX 4)
18018>>>37		string/c	dx50		(DivX 5)
18019>>>37		string/c	xvid		(XviD)
18020# --- First vorbis packet - general header ---
18021>>28		string		\x01vorbis	\b, Vorbis audio,
18022>>>35		lelong		!0		UNKNOWN VERSION %lu,
18023##>>>35		lelong		0		version 0,
18024>>>35		lelong		0
18025>>>>39		ubyte		1		mono,
18026>>>>39		ubyte		2		stereo,
18027>>>>39		ubyte		>2		%u channels,
18028>>>>40		lelong		x		%lu Hz
18029# Minimal, nominal and maximal bitrates specified when encoding
18030>>>>48		string		<\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	\b,
18031# The above tests if at least one of these is specified:
18032>>>>>52		lelong		!-1
18033# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields
18034# instead of -1.
18035# Vorbis 1.0 uses 0 instead of -1.
18036>>>>>>52	lelong		!0
18037>>>>>>>52	lelong		!-1000
18038>>>>>>>>52	lelong		x		<%lu
18039>>>>>48		lelong		!-1
18040>>>>>>48	lelong		x		~%lu
18041>>>>>44		lelong		!-1
18042>>>>>>44	lelong		!-1000
18043>>>>>>>44	lelong		!0
18044>>>>>>>>44	lelong		x		>%lu
18045>>>>>48		string		<\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	bps
18046# -- Second vorbis header packet - the comments
18047# A kludge to read the vendor string.  It's a counted string, not a
18048# zero-terminated one, so file(1) can't read it in a generic way.
18049# libVorbis is the only one existing currently, so I detect specifically
18050# it.  The interesting value is the cvs date (8 digits decimal).
18051# Post-RC1 Ogg files have the second header packet (and thus the version)
18052# in a different place, so we must use an indirect offset.
18053>>>(84.b+85)		string		\x03vorbis
18054>>>>(84.b+96)		string/c	Xiphophorus\ libVorbis\ I	\b, created by: Xiphophorus libVorbis I
18055>>>>>(84.b+120)		string		>00000000
18056# Map to beta version numbers:
18057>>>>>>(84.b+120)	string		<20000508	(<beta1, prepublic)
18058>>>>>>(84.b+120)	string		20000508	(1.0 beta 1 or beta 2)
18059>>>>>>(84.b+120)	string		>20000508
18060>>>>>>>(84.b+120)	string		<20001031	(beta2-3)
18061>>>>>>(84.b+120)	string		20001031	(1.0 beta 3)
18062>>>>>>(84.b+120)	string		>20001031
18063>>>>>>>(84.b+120)	string		<20010225	(beta3-4)
18064>>>>>>(84.b+120)	string		20010225	(1.0 beta 4)
18065>>>>>>(84.b+120)	string		>20010225
18066>>>>>>>(84.b+120)	string		<20010615	(beta4-RC1)
18067>>>>>>(84.b+120)	string		20010615	(1.0 RC1)
18068>>>>>>(84.b+120)	string		20010813	(1.0 RC2)
18069>>>>>>(84.b+120)	string		20010816	(RC2 - Garf tuned v1)
18070>>>>>>(84.b+120)	string		20011014	(RC2 - Garf tuned v2)
18071>>>>>>(84.b+120)	string		20011217	(1.0 RC3)
18072>>>>>>(84.b+120)	string		20011231	(1.0 RC3)
18073# Some pre-1.0 CVS snapshots still had "Xiphphorus"...
18074>>>>>>(84.b+120)	string		>20011231	(pre-1.0 CVS)
18075# For the 1.0 release, Xiphophorus is replaced by Xiph.Org
18076>>>>(84.b+96)		string/c	Xiph.Org\ libVorbis\ I	\b, created by: Xiph.Org libVorbis I
18077>>>>>(84.b+117)		string		>00000000
18078>>>>>>(84.b+117)	string		<20020717	(pre-1.0 CVS)
18079>>>>>>(84.b+117)	string		20020717	(1.0)
18080>>>>>>(84.b+117)	string		20030909	(1.0.1)
18081>>>>>>(84.b+117)	string		20040629	(1.1.0 RC1)
18082
18083#------------------------------------------------------------------------------
18084# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $
18085# VXL: file(1) magic for VXL binary IO data files
18086#
18087# from Ian Scott <scottim@sf.net>
18088#
18089# VXL is a collection of C++ libraries for Computer Vision.
18090# See the vsl chapter in the VXL Book for more info
18091# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html
18092# http:/vxl.sf.net
18093
180942	lelong	0x472b2c4e	VXL data file,
18095>0	leshort	>0		schema version no %d
18096
18097#------------------------------------------------------------------------------
18098# $File: warc,v 1.3 2010/11/25 15:05:43 christos Exp $
18099# warc:  file(1) magic for WARC files
18100
181010	string	WARC/	WARC Archive
18102>5	string	x	version %.4s
18103!:mime application/warc
18104
18105#------------------------------------------------------------------------------
18106# Arc File Format from Internet Archive
18107# see http://www.archive.org/web/researcher/ArcFileFormat.php
181080      string          filedesc://     Internet Archive File
18109!:mime application/x-ia-arc
18110>11    search/256      \x0A    \b
18111>>&0   ubyte   >0      \b version %c
18112
18113#------------------------------------------------------------------------------
18114# weak:  file(1) magic for very weak magic entries, disabled by default
18115#
18116# These entries are so weak that they might interfere identification of
18117# other formats. Example include:
18118# - Only identify for 1 or 2 bytes
18119# - Match against very wide range of values
18120# - Match against generic word in some spoken languages (e.g. English)
18121
18122# Summary: Computer Graphics Metafile
18123# Extension: .cgm
18124#0	beshort&0xffe0	0x0020		binary Computer Graphics Metafile
18125#0	beshort		0x3020		character Computer Graphics Metafile
18126
18127#0	string		=!!		Bennet Yee's "face" format
18128
18129#------------------------------------------------------------------------------
18130# $File: windows,v 1.5 2012/04/03 22:25:07 christos Exp $
18131# windows:  file(1) magic for Microsoft Windows
18132#
18133# This file is mainly reserved for files where programs
18134# using them are run almost always on MS Windows 3.x or
18135# above, or files only used exclusively in Windows OS,
18136# where there is no better category to allocate for.
18137# For example, even though WinZIP almost run on Windows
18138# only, it is better to treat them as "archive" instead.
18139# For format usable in DOS, such as generic executable
18140# format, please specify under "msdos" file.
18141#
18142
18143
18144# Summary: Outlook Express DBX file
18145# Extension: .dbx
18146# Created by: Christophe Monniez
181470	string	\xCF\xAD\x12\xFE	MS Outlook Express DBX file
18148>4	byte	=0xC5			\b, message database
18149>4	byte	=0xC6			\b, folder database
18150>4	byte	=0xC7			\b, account information
18151>4	byte	=0x30			\b, offline database
18152
18153
18154# Summary: Windows crash dump
18155# Extension: .dmp
18156# Created by: Andreas Schuster (http://computer.forensikblog.de/)
18157# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html
18158# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only)
181590	string		PAGE
18160>4	string		DUMP		MS Windows 32bit crash dump
18161>>0x05c	byte            0		\b, no PAE
18162>>0x05c	byte            1		\b, PAE
18163>>0xf88	lelong		1		\b, full dump
18164>>0xf88	lelong		2		\b, kernel dump
18165>>0xf88	lelong		3		\b, small dump
18166>>0x068	lelong		x		\b, %ld pages
18167>4	string		DU64		MS Windows 64bit crash dump
18168>>0xf98	lelong		1		\b, full dump
18169>>0xf98	lelong		2		\b, kernel dump
18170>>0xf98	lelong		3		\b, small dump
18171>>0x090	lequad		x		\b, %lld pages
18172
18173
18174# Summary: Vista Event Log
18175# Extension: .evtx
18176# Created by: Andreas Schuster (http://computer.forensikblog.de/)
18177# Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html
181780	string		ElfFile\0	MS Windows Vista Event Log
18179>0x2a	leshort		x		\b, %d chunks
18180>>0x10	lelong		x		\b (no. %d in use)
18181>0x18	lelong		>1		\b, next record no. %d
18182>0x18	lelong		=1		\b, empty
18183>0x78	lelong		&1		\b, DIRTY
18184>0x78	lelong		&2		\b, FULL
18185
18186
18187# Summary: Windows 3.1 group files
18188# Extension: .grp
18189# Created by: unknown
181900	string		\120\115\103\103	MS Windows 3.1 group files
18191
18192
18193# Summary: Old format help files
18194# Extension: .hlp
18195# Created by: Dirk Jagdmann <doj@cubic.org>
181960	lelong		0x00035f3f		MS Windows 3.x help file
18197
18198
18199# Summary: Hyper terminal
18200# Extension: .ht
18201# Created by: unknown
182020	string		HyperTerminal\
18203>15	string		1.0\ --\ HyperTerminal\ data\ file	MS Windows HyperTerminal profile
18204
18205# http://ithreats.files.wordpress.com/2009/05/\
18206# lnk_the_windows_shortcut_file_format.pdf
18207# Summary: Windows shortcut
18208# Extension: .lnk
18209# Created by: unknown
18210# 'L' + GUUID
182110	string		\114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106	MS Windows shortcut
18212>20	lelong&1	1	\b, Item id list present
18213>20	lelong&2	2	\b, Points to a file or directory
18214>20	lelong&4	4	\b, Has Description string
18215>20	lelong&8	8	\b, Has Relative path
18216>20	lelong&16	16	\b, Has Working directory
18217>20	lelong&32	32	\b, Has command line arguments
18218>20	lelong&64	64	\b, Icon
18219>>56	lelong			\b number=%d
18220>24	lelong&1	1	\b, Read-Only
18221>24	lelong&2	2	\b, Hidden
18222>24	lelong&4	4	\b, System
18223>24	lelong&8	8	\b, Volume Label
18224>24	lelong&16	16	\b, Directory
18225>24	lelong&32	32	\b, Archive
18226>24	lelong&64	64	\b, Encrypted
18227>24	lelong&128	128	\b, Normal
18228>24	lelong&256	256	\b, Temporary
18229>24	lelong&512	512	\b, Sparse
18230>24	lelong&1024	1024	\b, Reparse point
18231>24	lelong&2048	2048	\b, Compressed
18232>24	lelong&4096	4096	\b, Offline
18233>28	leqwdate	x	\b, ctime=%s
18234>36	leqwdate	x	\b, mtime=%s
18235>44	leqwdate	x	\b, atime=%s
18236>52	lelong		x	\b, length=%u, window=
18237>60	lelong&1	1	\bhide
18238>60	lelong&2	2	\bnormal
18239>60	lelong&4	4	\bshowminimized
18240>60	lelong&8	8	\bshowmaximized
18241>60	lelong&16	16	\bshownoactivate
18242>60	lelong&32	32	\bminimize
18243>60	lelong&64	64	\bshowminnoactive
18244>60	lelong&128	128	\bshowna
18245>60	lelong&256	256	\brestore
18246>60	lelong&512	512	\bshowdefault
18247#>20	lelong&1	0
18248#>>20	lelong&2	2
18249#>>>(72.l-64)	pstring/h	x	\b [%s]
18250#>20	lelong&1	1
18251#>>20	lelong&2	2
18252#>>>(72.s)	leshort	x
18253#>>>&75	pstring/h	x	\b [%s]
18254
18255# Summary: Outlook Personal Folders
18256# Created by: unknown
182570	lelong		0x4E444221	Microsoft Outlook email folder
18258>10	leshort		0x0e		(<=2002)
18259>10	leshort		0x17		(>=2003)
18260
18261
18262# Summary: Windows help cache
18263# Created by: unknown
182640	string		\164\146\115\122\012\000\000\000\001\000\000\000	MS Windows help cache
18265
18266
18267# Summary: IE cache file
18268# Created by: Christophe Monniez
182690	string	Client\ UrlCache\ MMF 	Internet Explorer cache file
18270>20	string	>\0			version %s
18271
18272
18273# Summary: Registry files
18274# Created by: unknown
18275# Modified by (1): Joerg Jenderek
182760	string		regf		MS Windows registry file, NT/2000 or above
182770	string		CREG		MS Windows 95/98/ME registry file
182780	string		SHCC3		MS Windows 3.1 registry file
18279
18280
18281# Summary: Windows Registry text
18282# Extension: .reg
18283# Submitted by: Abel Cheung <abelcheung@gmail.com>
182840	string		REGEDIT4\r\n\r\n	Windows Registry text (Win95 or above)
182850	string		Windows\ Registry\ Editor\
18286>&0	string		Version\ 5.00\r\n\r\n	Windows Registry text (Win2K or above)
18287
18288
18289# From: Pal Tamas <folti@balabit.hu>
18290# Autorun File
182910       string/c          [autorun]\r\n   Microsoft Windows Autorun file.
18292!:mime	application/x-setupscript.
18293
18294#------------------------------------------------------------------------------
18295# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $
18296# wireless-regdb:        file(1) magic for CRDA wireless-regdb file format
18297#
182980	string	RGDB	CRDA wireless regulatory database file
18299>4	belong	19	(Version 1)
18300
18301#------------------------------------------------------------------------------
18302# $File: wordprocessors,v 1.17 2013/02/06 14:18:52 christos Exp $
18303# wordprocessors:  file(1) magic fo word processors.
18304#
18305####### PWP file format used on Smith Corona Personal Word Processors:
183062	string	\040\040\040\040\040\040\040\040\040\040\040ML4D\040'92	Smith Corona PWP
18307>24	byte	2	\b, single spaced
18308>24	byte	3	\b, 1.5 spaced
18309>24	byte	4	\b, double spaced
18310>25	byte	0x42	\b, letter
18311>25	byte	0x54	\b, legal
18312>26	byte	0x46	\b, A4
18313
18314#WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
183150	string	\377WPC\020\000\000\000\022\012\001\001\000\000\000\000	(WP) loadable file
18316>15	byte	0	Optimized for Intel
18317>15	byte	1	Optimized for Non-Intel
183181	string	WPC	(Corel/WP)
18319>8	short	257	WordPerfect macro
18320>8	short	258	WordPerfect help file
18321>8	short	259	WordPerfect keyboard file
18322>8	short	266	WordPerfect document
18323>8	short	267	WordPerfect dictionary
18324>8	short	268	WordPerfect thesaurus
18325>8	short	269	WordPerfect block
18326>8	short	270	WordPerfect rectangular block
18327>8	short	271	WordPerfect column block
18328>8	short	272	WordPerfect printer data
18329>8	short	275	WordPerfect printer data
18330>8	short	276	WordPerfect driver resource data
18331>8	short	279	WordPerfect hyphenation code
18332>8	short	280	WordPerfect hyphenation data
18333>8	short	281	WordPerfect macro resource data
18334>8	short	283	WordPerfect hyphenation lex
18335>8	short	285	WordPerfect wordlist
18336>8	short	286	WordPerfect equation resource data
18337>8	short	289	WordPerfect spell rules
18338>8	short	290	WordPerfect dictionary rules
18339>8	short	295	WordPerfect spell rules (Microlytics)
18340>8	short	299	WordPerfect settings file
18341>8	short	301	WordPerfect 4.2 document
18342>8	short	325	WordPerfect dialog file
18343>8	short	332	WordPerfect button bar
18344>8	short	513	Shell macro
18345>8	short	522	Shell definition
18346>8	short	769	Notebook macro
18347>8	short	770	Notebook help file
18348>8	short	771	Notebook keyboard file
18349>8	short	778	Notebook definition
18350>8	short	1026	Calculator help file
18351>8	short 	1538	Calendar help file
18352>8	short 	1546	Calendar data file
18353>8	short	1793	Editor macro
18354>8	short	1794	Editor help file
18355>8	short	1795	Editor keyboard file
18356>8	short	1817	Editor macro resource file
18357>8	short 	2049	Macro editor macro
18358>8	short 	2050	Macro editor help file
18359>8	short	2051	Macro editor keyboard file
18360>8	short	2305	PlanPerfect macro
18361>8	short	2306	PlanPerfect help file
18362>8	short	2307	PlanPerfect keyboard file
18363>8	short	2314	PlanPerfect worksheet
18364>8	short	2319	PlanPerfect printer definition
18365>8	short	2322	PlanPerfect graphic definition
18366>8	short	2323	PlanPerfect data
18367>8	short	2324	PlanPerfect temporary printer
18368>8	short	2329	PlanPerfect macro resource data
18369>8	byte	11	Mail
18370>8	short	2818	help file
18371>8	short	2821	distribution list
18372>8	short	2826	out box
18373>8	short	2827	in box
18374>8	short	2836	users archived mailbox
18375>8	short	2837	archived message database
18376>8	short	2838	archived attachments
18377>8	short	3083	Printer temporary file
18378>8	short	3330	Scheduler help file
18379>8	short	3338	Scheduler in file
18380>8	short	3339	Scheduler out file
18381>8	short	3594	GroupWise settings file
18382>8	short	3601	GroupWise directory services
18383>8	short	3627	GroupWise settings file
18384>8	short	4362	Terminal resource data
18385>8	short	4363	Terminal resource data
18386>8	short	4395	Terminal resource data
18387>8	short	4619	GUI loadable text
18388>8	short	4620	graphics resource data
18389>8	short	4621	printer settings file
18390>8	short	4622	port definition file
18391>8	short	4623	print queue parameters
18392>8	short	4624	compressed file
18393>8	short	5130	Network service msg file
18394>8	short	5131	Network service msg file
18395>8	short	5132	Async gateway login msg
18396>8	short	5134	GroupWise message file
18397>8	short	7956	GroupWise admin domain database
18398>8	short	7957	GroupWise admin host database
18399>8	short	7959	GroupWise admin remote host database
18400>8	short	7960	GroupWise admin ADS deferment data file
18401>8	short	8458	IntelliTAG (SGML) compiled DTD
18402>8	long	18219264	WordPerfect graphic image (1.0)
18403>8	long	18219520	WordPerfect graphic image (2.0)
18404#end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
18405
18406# Hangul (Korean) Word Processor File
184070	string	HWP\ Document\ File	Hangul (Korean) Word Processor File 3.0
18408# From: Won-Kyu Park <wkpark@kldp.org>
18409512	string		R\0o\0o\0t\0	Hangul (Korean) Word Processor File 2000
18410!:mime	application/x-hwp
18411
18412# CosmicBook, from Benoit Rouits
184130       string  CSBK    Ted Neslson's CosmicBook hypertext file
18414
184152       string  EYWR    AmigaWriter file
18416
18417# chi:  file(1) magic for ChiWriter files
184180       string          \\1cw\          ChiWriter file
18419>5      string          >\0             version %s
184200       string          \\1cw           ChiWriter file
18421
18422# Quark Express from http://www.garykessler.net/library/file_sigs.html
184232	string	IIXPR3			Intel Quark Express Document (English)
184242	string	IIXPRa			Intel Quark Express Document (Korean)
184252	string	MMXPR3			Motorola Quark Express Document (English)
18426!:mime	application/x-quark-xpress-3
184272	string	MMXPRa			Motorola Quark Express Document (Korean)
18428
18429# adobe indesign (document, whatever...) from querkan
184300	belong	0x0606edf5		Adobe InDesign
18431>16	string	DOCUMENT		Document
18432
18433#------------------------------------------------------------------------------
18434# ichitaro456: file(1) magic for Just System Word Processor Ichitaro
18435#
18436# Contributor kenzo-:
18437# Reversed-engineered JS Ichitaro magic numbers
18438#
18439
184400	string		DOC
18441>43	byte		0x14	Just System Word Processor Ichitaro v4
18442!:mime	application/x-ichitaro4
18443>144	string	JDASH		application/x-ichitaro4
18444
184450	string		DOC
18446>43	byte		0x15	Just System Word Processor Ichitaro v5
18447!:mime	application/x-ichitaro5
18448
184490	string		DOC
18450>43	byte		0x16	Just System Word Processor Ichitaro v6
18451!:mime	application/x-ichitaro6
18452
18453# Type: Freemind mindmap documents
18454# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk>
184550	string/w	\<map\ version	Freemind document
18456!:mime	application/x-freemind
18457
18458# Type:        Scribus
18459# From:        Werner Fink <werner@suse.de>
184600	string	\<SCRIBUSUTF8\ Version		Scribus Document
184610	string	\<SCRIBUSUTF8NEW\ Version	Scribus Document
18462!:mime	application/x-scribus
18463
18464# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek
18465# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14
184660	ulelong&0x8080FFFF	0x00001204	gfxboot compiled html help file
18467
18468#------------------------------------------------------------------------------
18469# $File: wsdl,v 1.3 2013/02/06 14:18:52 christos Exp $
18470# wsdl: PHP WSDL Cache, http://www.php.net/manual/en/book.soap.php
18471# Cache format extracted from source:
18472# http://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup
18473# Requires file >= 5.05, see http://mx.gw.com/pipermail/file/2010/000683.html
18474# By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011
184750		string		wsdl		PHP WSDL cache,
18476>4		byte		x		version 0x%02x
18477>6		ledate		x		\b, created %s
18478
18479# uri
18480>10		lelong		<0x7fffffff
18481>>10		pstring/l	x		\b, uri: "%s"
18482
18483# source
18484>>>&0		lelong		<0x7fffffff
18485>>>>&-4		pstring/l	x		\b, source: "%s"
18486
18487# target_ns
18488>>>>>&0		lelong		<0x7fffffff
18489>>>>>>&-4	pstring/l	x		\b, target_ns: "%s"
18490
18491#------------------------------------------------------------------------------
18492# $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $
18493# file(1) magic(5) data for xdelta  Josh MacDonald <jmacd@CS.Berkeley.EDU>
18494#
184950	string	%XDELTA%	XDelta binary patch file 0.14
184960	string	%XDZ000%	XDelta binary patch file 0.18
184970	string	%XDZ001%	XDelta binary patch file 0.20
184980	string	%XDZ002%	XDelta binary patch file 1.0
184990	string	%XDZ003%	XDelta binary patch file 1.0.4
185000	string	%XDZ004%	XDelta binary patch file 1.1
18501
185020	string \xD6\xC3\xC4\x00	VCDIFF binary diff
18503
18504#------------------------------------------------------------------------------
18505# $File: xenix,v 1.9 2009/09/19 16:28:13 christos Exp $
18506# xenix:  file(1) magic for Microsoft Xenix
18507#
18508# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
18509# model" lifted from "magic.xenix", with comment "derived empirically;
18510# treat as folklore until proven"
18511#
18512# "small model", "large model", "huge model" stuff lifted from XXX
18513#
18514# XXX - "x.out" collides with PDP-11 archives
18515#
185160	string		core		core file (Xenix)
185170	byte		0x80		8086 relocatable (Microsoft)
185180	leshort		0xff65		x.out
18519>2	string		__.SYMDEF	 randomized
18520>0	byte		x		archive
185210	leshort		0x206		Microsoft a.out
18522>8	leshort		1		Middle model
18523>0x1e	leshort		&0x10		overlay
18524>0x1e	leshort		&0x2		separate
18525>0x1e	leshort		&0x4		pure
18526>0x1e	leshort		&0x800		segmented
18527>0x1e	leshort		&0x400		standalone
18528>0x1e	leshort		&0x8		fixed-stack
18529>0x1c	byte		&0x80		byte-swapped
18530>0x1c	byte		&0x40		word-swapped
18531>0x10	lelong		>0		not-stripped
18532>0x1e	leshort		^0xc000		pre-SysV
18533>0x1e	leshort		&0x4000		V2.3
18534>0x1e	leshort		&0x8000		V3.0
18535>0x1c	byte		&0x4		86
18536>0x1c	byte		&0xb		186
18537>0x1c	byte		&0x9		286
18538>0x1c	byte		&0xa		386
18539>0x1f	byte		<0x040		small model
18540>0x1f	byte		=0x048		large model
18541>0x1f	byte		=0x049		huge model
18542>0x1e	leshort		&0x1		executable
18543>0x1e	leshort		^0x1		object file
18544>0x1e	leshort		&0x40		Large Text
18545>0x1e	leshort		&0x20		Large Data
18546>0x1e	leshort		&0x120		Huge Objects Enabled
18547>0x10	lelong		>0		not stripped
18548
185490	leshort		0x140		old Microsoft 8086 x.out
18550>0x3	byte		&0x4		separate
18551>0x3	byte		&0x2		pure
18552>0	byte		&0x1		executable
18553>0	byte		^0x1		relocatable
18554>0x14	lelong		>0		not stripped
18555
185560	lelong		0x206		b.out
18557>0x1e	leshort		&0x10		overlay
18558>0x1e	leshort		&0x2		separate
18559>0x1e	leshort		&0x4		pure
18560>0x1e	leshort		&0x800		segmented
18561>0x1e	leshort		&0x400		standalone
18562>0x1e	leshort		&0x1		executable
18563>0x1e	leshort		^0x1		object file
18564>0x1e	leshort		&0x4000		V2.3
18565>0x1e	leshort		&0x8000		V3.0
18566>0x1c	byte		&0x4		86
18567>0x1c	byte		&0xb		186
18568>0x1c	byte		&0x9		286
18569>0x1c	byte		&0x29		286
18570>0x1c	byte		&0xa		386
18571>0x1e	leshort		&0x4		Large Text
18572>0x1e	leshort		&0x2		Large Data
18573>0x1e	leshort		&0x102		Huge Objects Enabled
18574
185750	leshort		0x580		XENIX 8086 relocatable or 80286 small model
18576
18577#------------------------------------------------------------------------------
18578# $File: xilinx,v 1.5 2013/01/08 03:06:50 christos Exp $
18579# This is Aaron's attempt at a MAGIC file for Xilinx .bit files.
18580# Xilinx-Magic@RevRagnarok.com
18581# Got the info from FPGA-FAQ 0026
18582#
18583# First there is the sync header and its length
185840	beshort 0x0009
18585>2 	belong	=0x0ff00ff0
18586>>&0	belong  =0x0ff00ff0
18587>>>&0	beshort =0x0000
18588>>>>&0	pstring	a	Xilinx BIT data
18589# Next is a Pascal-style string with the NCD name. We want to capture that.
18590>>>>0x0F	pstring	x	- from %s
18591# It is followed by a NUL
18592>>>>>&1	byte	0x00
18593# And then 'b'
18594>>>>>&2	string b
18595# With the part number:
18596#>>>>>&5 string	4v	(Virtex4)
18597#>>>>>&5 string  2v	(Virtex II
18598#>>>>>>&0	string	!p	\b)
18599#>>>>>>&0	string	p	Pro)
18600>>>>>&4	pstring x	- for %s
18601# And then NUL / 'c' / Build Data / NUL / 'd' / Date / NUL / 'e' / Data Length
18602>>>>>>&1	byte	0x00
18603>>>>>>&2	string	c
18604>>>>>>&4	pstring	x	- built %s
18605>>>>>>>&1	byte	0x00
18606>>>>>>>&2	string	d
18607>>>>>>>&4	pstring	x	\b(%s)
18608>>>>>>>>&1	byte	0x00
18609>>>>>>>>&2	string	e
18610>>>>>>>>&4	belong	x	- data length 0x%lx
18611# Raw bitstream files
186120	long	0xffffffff
18613>&0	belong	0xaa995566	Xilinx RAW bitstream (.BIN)
18614
18615#------------------------------------------------------------------------------
18616# $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $
18617# xo65 object files
18618# From: "Ullrich von Bassewitz" <uz@cc65.org>
18619#
186200	string		\x55\x7A\x6E\x61	xo65 object,
18621>4	leshort		x			version %d,
18622>6	leshort&0x0001 =0x0001			with debug info
18623>6	leshort&0x0001 =0x0000			no debug info
18624
18625# xo65 library files
186260	string		\x6E\x61\x55\x7A	xo65 library,
18627>4	leshort		x			version %d
18628
18629# o65 object files
186300	string		\x01\x00\x6F\x36\x35	o65
18631>6	leshort&0x1000	=0x0000			executable,
18632>6	leshort&0x1000	=0x1000			object,
18633>5	byte		x			version %d,
18634>6	leshort&0x8000	=0x8000			65816,
18635>6	leshort&0x8000	=0x0000			6502,
18636>6	leshort&0x2000	=0x2000			32 bit,
18637>6	leshort&0x2000	=0x0000			16 bit,
18638>6	leshort&0x4000	=0x4000			page reloc,
18639>6	leshort&0x4000	=0x0000			byte reloc,
18640>6	leshort&0x0003	=0x0000			alignment 1
18641>6	leshort&0x0003	=0x0001			alignment 2
18642>6	leshort&0x0003	=0x0002			alignment 4
18643>6	leshort&0x0003	=0x0003			alignment 256
18644
18645#------------------------------------------------------------------------------
18646# $File: xwindows,v 1.8 2013/02/08 17:25:57 christos Exp $
18647# xwindows:  file(1) magic for various X/Window system file formats.
18648
18649# Compiled X Keymap
18650# XKM (compiled X keymap) files (including version and byte ordering)
186511	string	mkx				Compiled XKB Keymap: lsb,
18652>0	byte	>0				version %d
18653>0	byte	=0				obsolete
186540	string	xkm				Compiled XKB Keymap: msb,
18655>3	byte	>0				version %d
18656>3	byte	=0				obsolete
18657
18658# xfsdump archive
186590	string	xFSdump0			xfsdump archive
18660>8	belong	x	(version %d)
18661
18662# Jaleo XFS files
186630	long	395726				Jaleo XFS file
18664>4	long	x				- version %ld
18665>8	long	x				- [%ld -
18666>20	long	x				\b%ldx
18667>24	long	x				\b%ldx
18668>28	long	1008				\bYUV422]
18669>28	long	1000				\bRGB24]
18670
18671# Xcursor data
18672# X11 mouse cursor format defined in libXcursor, see
18673# http://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html
18674# http://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h
186750	string		Xcur		Xcursor data
18676!:mime	image/x-xcursor
18677>10	leshort		x		version %hd
18678>>8	leshort		x		\b.%hd
18679#------------------------------------------------------------------------------
18680# zfs:	file(1) magic for ZFS dumps
18681#
18682# From <rea-fbsd@codelabs.ru>
18683# ZFS dump header has the following structure (as per zfs_ioctl.h
18684# in FreeBSD with drr_type is set to DRR_BEGIN)
18685#
18686#   enum {
18687#	DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS,
18688#	DRR_WRITE, DRR_FREE, DRR_END,
18689#   } drr_type;
18690#   uint32_t drr_pad;
18691#   uint64_t drr_magic;
18692#   uint64_t drr_version;
18693#   uint64_t drr_creation_time;
18694#   dmu_objset_type_t drr_type;
18695#   uint32_t drr_pad;
18696#   uint64_t drr_toguid;
18697#   uint64_t drr_fromguid;
18698#   char drr_toname[MAXNAMELEN];
18699#
18700# Backup magic is 0x00000002f5bacbac (quad word)
18701# The drr_type is defined as
18702#   typedef enum dmu_objset_type {
18703#	  DMU_OST_NONE,
18704#	  DMU_OST_META,
18705#	  DMU_OST_ZFS,
18706#	  DMU_OST_ZVOL,
18707#	  DMU_OST_OTHER,		  /* For testing only! */
18708#	  DMU_OST_ANY,			  /* Be careful! */
18709#	  DMU_OST_NUMTYPES
18710#  } dmu_objset_type_t;
18711#
18712# Almost all uint64_t fields are printed as the 32-bit ones (with high
18713# 32 bits zeroed), because there is no simple way to print them as the
18714# full 64-bit values.
18715
18716# Big-endian values
187178	string	\000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine),
18718>20	belong	x	version %lu,
18719>32	belong	0	type: NONE,
18720>32	belong	1	type: META,
18721>32	belong	2	type: ZFS,
18722>32	belong	3	type: ZVOL,
18723>32	belong	4	type: OTHER,
18724>32	belong	5	type: ANY,
18725>32	belong	>5	type: UNKNOWN (%lu),
18726>40	byte	x	destination GUID: %02X
18727>41	byte	x	%02X
18728>42	byte	x	%02X
18729>43	byte	x	%02X
18730>44	byte	x	%02X
18731>45	byte	x	%02X
18732>46	byte	x	%02X
18733>47	byte	x	%02X,
18734>48	ulong	>0
18735>>52	ulong	>0
18736>>>48	byte	x	source GUID: %02X
18737>>>49	byte	x	%02X
18738>>>50	byte	x	%02X
18739>>>51	byte	x	%02X
18740>>>52	byte	x	%02X
18741>>>53	byte	x	%02X
18742>>>54	byte	x	%02X
18743>>>55	byte	x	%02X,
18744>56	string	>\0	name: '%s'
18745
18746# Little-endian values
187478	string	\254\313\272\365\002\000\000\000	ZFS shapshot (little-endian machine),
18748>16	lelong	x	version %lu,
18749>32	lelong	0	type: NONE,
18750>32	lelong	1	type: META,
18751>32	lelong	2	type: ZFS,
18752>32	lelong	3	type: ZVOL,
18753>32	lelong	4	type: OTHER,
18754>32	lelong	5	type: ANY,
18755>32	lelong	>5	type: UNKNOWN (%lu),
18756>47	byte	x	destination GUID: %02X
18757>46	byte	x	%02X
18758>45	byte	x	%02X
18759>44	byte	x	%02X
18760>43	byte	x	%02X
18761>42	byte	x	%02X
18762>41	byte	x	%02X
18763>40	byte	x	%02X,
18764>48	ulong	>0
18765>>52	ulong	>0
18766>>>55	byte	x	source GUID: %02X
18767>>>54	byte	x	%02X
18768>>>53	byte	x	%02X
18769>>>52	byte	x	%02X
18770>>>51	byte	x	%02X
18771>>>50	byte	x	%02X
18772>>>49	byte	x	%02X
18773>>>48	byte	x	%02X,
18774>56	string	>\0	name: '%s'
18775
18776#------------------------------------------------------------------------------
18777# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $
18778# zilog:  file(1) magic for Zilog Z8000.
18779#
18780# Was it big-endian or little-endian?  My Product Specification doesn't
18781# say.
18782#
187830	long		0xe807		object file (z8000 a.out)
187840	long		0xe808		pure object file (z8000 a.out)
187850	long		0xe809		separate object file (z8000 a.out)
187860	long		0xe805		overlay object file (z8000 a.out)
18787
18788#------------------------------------------------------------------------------
18789# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $
18790# zyxel:  file(1) magic for ZyXEL modems
18791#
18792# From <rob@pe1chl.ampr.org>
18793# These are the /etc/magic entries to decode datafiles as used for the
18794# ZyXEL U-1496E DATA/FAX/VOICE modems.  (This header conforms to a
18795# ZyXEL-defined standard)
18796
187970	string		ZyXEL\002	ZyXEL voice data
18798>10	byte		0		- CELP encoding
18799>10	byte&0x0B	1		- ADPCM2 encoding
18800>10	byte&0x0B	2		- ADPCM3 encoding
18801>10	byte&0x0B	3		- ADPCM4 encoding
18802>10	byte&0x0B	8		- New ADPCM3 encoding
18803>10	byte&0x04	4		with resync
18804