1# Magic data for file(1) command.
2# Format is described in magic(files), where:
3# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID.
4# Don't edit this file, edit /etc/magic or send your magic improvements
5# to the maintainers, at file@mx.gw.com
6
7#------------------------------------------------------------------------------
8# Localstuff:  file(1) magic for locally observed files
9#
10# $File: Localstuff,v 1.4 2003/03/23 04:17:27 christos Exp $
11# Add any locally observed files here.  Remember:
12# text if readable, executable if runnable binary, data if unreadable.
13
14#------------------------------------------------------------------------------
15# $File$
16# acorn:  file(1) magic for files found on Acorn systems
17#
18
19# RISC OS Chunk File Format
20# From RISC OS Programmer's Reference Manual, Appendix D
21# We guess the file type from the type of the first chunk.
220	lelong		0xc3cbc6c5	RISC OS Chunk data
23>12	string		OBJ_		\b, AOF object
24>12	string		LIB_		\b, ALF library
25
26# RISC OS AIF, contains "SWI OS_Exit" at offset 16.
2716	lelong		0xef000011	RISC OS AIF executable
28
29# RISC OS Draw files
30# From RISC OS Programmer's Reference Manual, Appendix E
310	string 		Draw		RISC OS Draw file data
32
33# RISC OS new format font files
34# From RISC OS Programmer's Reference Manual, Appendix E
350	string		FONT\0		RISC OS outline font data,
36>5	byte		x		version %d
370	string		FONT\1		RISC OS 1bpp font data,
38>5	byte		x		version %d
390	string		FONT\4		RISC OS 4bpp font data
40>5	byte		x		version %d
41
42# RISC OS Music files
43# From RISC OS Programmer's Reference Manual, Appendix E
440	string		Maestro\r	RISC OS music file
45>8	byte		x		version %d
46
47>8	byte		x		type %d
48
49# Digital Symphony data files
50# From: Bernard Jungen (bern8817@euphonynet.be)
510		string	\x02\x01\x13\x13\x13\x01\x0d\x10	Digital Symphony sound sample (RISC OS),
52>8		byte	x	version %d,
53>9		pstring	x	named "%s",
54>(9.b+19)	byte	=0	8-bit logarithmic
55>(9.b+19)	byte	=1	LZW-compressed linear
56>(9.b+19)	byte	=2	8-bit linear signed
57>(9.b+19)	byte	=3	16-bit linear signed
58>(9.b+19)	byte	=4	SigmaDelta-compressed linear
59>(9.b+19)	byte	=5	SigmaDelta-compressed logarithmic
60>(9.b+19)	byte	>5	unknown format
61
620	string	\x02\x01\x13\x13\x14\x12\x01\x0b	Digital Symphony song (RISC OS),
63>8	byte	x	version %d,
64>9	byte	=1	1 voice,
65>9	byte	!1	%d voices,
66>10	leshort	=1	1 track,
67>10	leshort	!1	%d tracks,
68>12	leshort	=1	1 pattern
69>12	leshort	!1	%d patterns
70
710	string	\x02\x01\x13\x13\x10\x14\x12\x0e
72>9	byte	=0	Digital Symphony sequence (RISC OS),
73>>8	byte	x	version %d,
74>>10	byte	=1	1 line,
75>>10	byte	!1	%d lines,
76>>11	leshort	=1	1 position
77>>11	leshort	!1	%d positions
78>9	byte	=1	Digital Symphony pattern data (RISC OS),
79>>8	byte	x	version %d,
80>>10	leshort	=1	1 pattern
81>>10	leshort	!1	%d patterns
82
83#------------------------------------------------------------------------------
84# $File$
85# adi: file(1) magic for ADi's objects
86# From Gregory McGarry <g.mcgarry@ieee.org>
87#
880	leshort		0x521c		COFF DSP21k
89>18	lelong		&02		executable,
90>18	lelong		^02
91>>18	lelong		&01		static object,
92>>18	lelong		^01		relocatable object,
93>18	lelong		&010		stripped
94>18	lelong		^010		not stripped
95
96#------------------------------------------------------------------------------
97# $File: adventure,v 1.13 2010/12/31 16:32:54 christos Exp $
98# adventure: file(1) magic for Adventure game files
99#
100# from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
101# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998
102# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
103#
104# ALAN
105# I assume there are other, lower versions, but these are the only ones I
106# saw in the archive.
1070	beshort	0x0206	ALAN game data
108>2	byte	<10	version 2.6%d
109
110
111# Infocom (see z-machine)
112#------------------------------------------------------------------------------
113# Z-machine:  file(1) magic for Z-machine binaries.
114# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
115#
116#http://www.gnelson.demon.co.uk/zspec/sect11.html
117#http://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt
118#http://en.wikipedia.org/wiki/Z-machine
119# The first byte is the Z-machine revision; it is always between 1 and 8. We
120# had false matches (for instance, inbig5.ocp from the Omega TeX extension as
121# well as an occasional MP3 file), so we sanity-check the version number.
122#
123# It might be possible to sanity-check the release number as well, as it seems
124# (at least in classic Infocom games) to always be a relatively small number,
125# always under 150 or so, but as this isn't rigorous, we'll wait on that until
126# it becomes clear that it's needed.
127#
1280	ubyte			>0
129>0	ubyte			<9
130>>16	belong&0xfe00f0f0	0x3030
131>>>0	ubyte			< 10
132>>>>2	ubeshort		< 10
133>>>>>18	regex			[0-9][0-9][0-9][0-9][0-9][0-9]
134>>>>>>0	ubyte			< 10	Infocom (Z-machine %d,
135>>>>>>>2	ubeshort	< 10 	Release %d /
136>>>>>>>>18	string		>\0	Serial %.6s)
137!:strength + 40
138
139#------------------------------------------------------------------------------
140# Glulx:  file(1) magic for Glulx binaries.
141#
142# I haven't checked for false matches yet.
143#
1440	string			Glul	Glulx game data
145>4	beshort			x	(Version %d
146>>6	byte			x	\b.%d
147>>8	byte			x	\b.%d)
148>36	string			Info	Compiled by Inform
149
150
151
152# For Quetzal and blorb magic see iff
153
154
155# TADS (Text Adventure Development System) version 2
156#  All files are machine-independent (games compile to byte-code) and are tagged
157#  with a version string of the form "V2.<digit>.<digit>\0".
158#  Game files start with "TADS2 bin\n\r\032\0" then the compiler version.
1590	string	TADS2\ bin	TADS
160>9	belong  !0x0A0D1A00	game data, CORRUPTED
161>9	belong	 0x0A0D1A00
162>>13	string	>\0		%s game data
163#  Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version.
1640	string	TADS2\ rsc	TADS
165>9	belong  !0x0A0D1A00	resource data, CORRUPTED
166>9	belong	 0x0A0D1A00
167>>13	string	>\0		%s resource data
168#  Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
169#  2-byte length N, the N-char name of the game file *without* a NUL (darn!),
170# "TADS2 save\n\r\032\0" and the interpreter version.
1710	string	TADS2\ save/g	TADS
172>12	belong	!0x0A0D1A00	saved game data, CORRUPTED
173>12	belong	 0x0A0D1A00
174>>(16.s+32) string >\0		%s saved game data
175#  Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter
176#  version.
1770	string	TADS2\ save	TADS
178>10	belong	!0x0A0D1A00	saved game data, CORRUPTED
179>10	belong	 0x0A0D1A00
180>>14	string	>\0		%s saved game data
181
182# TADS (Text Adventure Development System) version 3
183#  Game files start with "T3-image\015\012\032"
1840	string	T3-image\015\012\032
185>11	leshort	x		TADS 3 game data (format version %d)
186#  Saved game files start with "T3-state-v####\015\012\032"
187#  where #### is a format version number
1880	string	T3-state-v
189>14	string	\015\012\032	TADS 3 saved game data (format version
190>>10	byte	x		%c
191>>11	byte	x		\b%c
192>>12	byte	x		\b%c
193>>13	byte	x		\b%c)
194
195# Danny Milosavljevic <danny.milo@gmx.net>
196# this are adrift (adventure game standard) game files, extension .taf
197# depending on version magic continues with 0x93453E6139FA (V 4.0)
198# 0x9445376139FA (V 3.90)
199# 0x9445366139FA (V 3.80)
200# this is from source (http://www.adrift.org.uk/) and I have some taf
201# files, and checked them.
202#0	belong	0x3C423FC9
203#>4	belong	0x6A87C2CF	Adrift game file
204#!:mime	application/x-adrift
205
206#------------------------------------------------------------------------------
207# $File$
208# allegro:  file(1) magic for Allegro datafiles
209# Toby Deshane <hac@shoelace.digivill.net>
210#
2110 belong 0x736C6821   Allegro datafile (packed)
2120 belong 0x736C682E   Allegro datafile (not packed/autodetect)
2130 belong 0x736C682B   Allegro datafile (appended exe data)
214
215#------------------------------------------------------------------------------
216# $File$
217# alliant:  file(1) magic for Alliant FX series a.out files
218#
219# If the FX series is the one that had a processor with a 68K-derived
220# instruction set, the "short" should probably become "beshort" and the
221# "long" should probably become "belong".
222# If it's the i860-based one, they should probably become either the
223# big-endian or little-endian versions, depending on the mode they ran
224# the 860 in....
225#
2260	short		0420		0420 Alliant virtual executable
227>2	short		&0x0020		common library
228>16	long		>0		not stripped
2290	short		0421		0421 Alliant compact executable
230>2	short		&0x0020		common library
231>16	long		>0		not stripped
232
233#------------------------------------------------------------------------------
234# $File$
235# alpha architecture description
236#
237
2380	leshort		0603		COFF format alpha
239>22	leshort&030000	!020000		executable
240>24	leshort		0410		pure
241>24	leshort		0413		paged
242>22	leshort&020000	!0		dynamically linked
243>16	lelong		!0		not stripped
244>16	lelong		0		stripped
245>22	leshort&030000	020000		shared library
246>24	leshort		0407		object
247>27	byte		x		- version %d
248>26	byte		x		.%d
249>28	byte		x		-%d
250
251# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
252#
253# The actual magic number is just "Core", followed by a 2-byte version
254# number; however, treating any file that begins with "Core" as a Digital
255# UNIX core dump file may produce too many false hits, so we include one
256# byte of the version number as well; DU 5.0 appears only to be up to
257# version 2.
258#
2590	string		Core\001	Alpha COFF format core dump (Digital UNIX)
260>24	string		>\0		\b, from '%s'
2610	string		Core\002	Alpha COFF format core dump (Digital UNIX)
262>24	string		>\0		\b, from '%s'
263
264
265#------------------------------------------------------------------------------
266# $File$
267# amanda:  file(1) magic for amanda file format
268#
2690	string	AMANDA:\ 		AMANDA
270>8	string	TAPESTART\ DATE		tape header file,
271>>23	string	X
272>>>25	string	>\ 			Unused %s
273>>23	string	>\ 			DATE %s
274>8	string	FILE\ 			dump file,
275>>13	string	>\ 			DATE %s
276
277#------------------------------------------------------------------------------
278# $File: amigaos,v 1.14 2009/09/19 16:28:07 christos Exp $
279# amigaos:  file(1) magic for AmigaOS binary formats:
280
281#
282# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
283#
2840	belong		0x000003fa	AmigaOS shared library
2850	belong		0x000003f3	AmigaOS loadseg()ble executable/binary
2860	belong		0x000003e7	AmigaOS object/library data
287#
2880	beshort		0xe310		Amiga Workbench
289>2	beshort		1
290>>48	byte		1		disk icon
291>>48	byte		2		drawer icon
292>>48	byte		3		tool icon
293>>48	byte		4		project icon
294>>48	byte		5		garbage icon
295>>48	byte		6		device icon
296>>48	byte		7		kickstart icon
297>>48	byte		8		workbench application icon
298>2	beshort		>1		icon, vers. %d
299#
300# various sound formats from the Amiga
301# G=F6tz Waschk <waschk@informatik.uni-rostock.de>
302#
3030	string		FC14		Future Composer 1.4 Module sound file
3040	string		SMOD		Future Composer 1.3 Module sound file
3050	string		AON4artofnoise	Art Of Noise Module sound file
3061	string		MUGICIAN/SOFTEYES Mugician Module sound file
30758	string		SIDMON\ II\ -\ THE	Sidmon 2.0 Module sound file
3080	string		Synth4.0	Synthesis Module sound file
3090	string		ARP.		The Holy Noise Module sound file
3100	string		BeEp\0		JamCracker Module sound file
3110	string		COSO\0		Hippel-COSO Module sound file
312# Too simple (short, pure ASCII, deep), MPi
313#26	string		V.3		Brian Postma's Soundmon Module sound file v3
314#26	string		BPSM		Brian Postma's Soundmon Module sound file v3
315#26	string		V.2		Brian Postma's Soundmon Module sound file v2
316
317# The following are from: "Stefan A. Haubenthal" <polluks@web.de>
3180	beshort		0x0f00		AmigaOS bitmap font
3190	beshort		0x0f03		AmigaOS outline font
3200	belong		0x80001001	AmigaOS outline tag
3210	string		##\ version	catalog translation
3220	string		EMOD\0		Amiga E module
3238	string		ECXM\0		ECX module
3240	string/c	@database	AmigaGuide file
325
326# Amiga disk types
327#
3280	string		RDSK		Rigid Disk Block
329>160	string		x		on %.24s
3300	string		DOS\0		Amiga DOS disk
3310	string		DOS\1		Amiga FFS disk
3320	string		DOS\2		Amiga Inter DOS disk
3330	string		DOS\3		Amiga Inter FFS disk
3340	string		DOS\4		Amiga Fastdir DOS disk
3350	string		DOS\5		Amiga Fastdir FFS disk
3360	string		KICK		Kickstart disk
337
338# From: Alex Beregszaszi <alex@fsn.hu>
3390	string		LZX		LZX compressed archive (Amiga)
340
341# From: Przemek Kramarczyk <pkramarczyk@gmail.com>
3420	string 		.KEY		AmigaDOS script
3430	string 		.key		AmigaDOS script
344
345#------------------------------------------------------------
346# $File: android,v 1.6 2014/08/04 06:00:36 christos Exp $
347# Various android related magic entries
348#------------------------------------------------------------
349
350# Dalvik .dex format. http://retrodev.com/android/dexformat.html
351# From <mkf@google.com> "Mike Fleming"
352# Fixed to avoid regexec 17 errors on some dex files
353# From <diff@lookout.com> "Tim Strazzere"
3540	string	dex\n
355>0	regex	dex\n[0-9]{2}\0	Dalvik dex file
356>4	string	>000			version %s
3570	string	dey\n
358>0	regex	dey\n[0-9]{2}\0	Dalvik dex file (optimized for host)
359>4	string	>000			version %s
360
361# Android bootimg format
362# From https://android.googlesource.com/\
363# platform/system/core/+/master/mkbootimg/bootimg.h
3640		string	ANDROID!	Android bootimg
365>1024	string	LOKI\01		\b, LOKI'd
366>8		lelong	>0			\b, kernel
367>>12	lelong	>0			\b (0x%x)
368>16		lelong	>0			\b, ramdisk
369>>20	lelong	>0			\b (0x%x)
370>24		lelong	>0			\b, second stage
371>>28	lelong	>0			\b (0x%x)
372>36		lelong	>0			\b, page size: %d
373>38		string	>0			\b, name: %s
374>64		string	>0		 	\b, cmdline (%s)
375
376# Android Backup archive
377# From: Ariel Shkedi
378# File extension: .ab
379# No mime-type defined
380# URL: https://github.com/android/platform_frameworks_base/blob/\
381# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\
382# android/server/BackupManagerService.java#L2367
383# After the header comes a tar file
384# If compressed, the entire tar file is compressed with JAVA deflate
385#
386# Include the version number hardcoded with the magic string to avoid
387# false positives
3880	string/b	ANDROID\ BACKUP\n1\n	Android Backup
389>17	string		0\n			\b, Not-Compressed
390>17	string		1\n			\b, Compressed
391# any string as long as it's not the word none (which is matched below)
392>>19    regex/1l	\^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).*	\b, Encrypted (%s)
393>>19	string		none\n			\b, Not-Encrypted
394# Commented out because they don't seem useful to print
395# (but they are part of the header - the tar file comes after them):
396#>>>&1		regex/1l .*	\b, Password salt: %s
397#>>>>&1		regex/1l .*	\b, Master salt: %s
398#>>>>>&1	regex/1l .*	\b, PBKDF2 rounds: %s
399#>>>>>>&1	regex/1l .*	\b, IV: %s
400#>>>>>>>&1	regex/1l .*	\b, Key: %s
401
402# *.pit files by Joerg Jenderek
403# http://forum.xda-developers.com/showthread.php?p=9122369
404# http://forum.xda-developers.com/showthread.php?t=816449
405# Partition Information Table for Samsung's smartphone with Android
406# used by flash software Odin
4070		ulelong			0x12349876
408# 1st pit entry marker
409>0x01C	ulequad&0xFFFFFFFCFFFFFFFC	=0x0000000000000000
410# minimal 13 and maximal 18 PIT entries found
411>>4		ulelong			<128	Partition Information Table for Samsung smartphone
412>>>4		ulelong			x	\b, %d entries
413# 1. pit entry
414>>>4		ulelong			>0	\b; #1
415>>>0x01C	use				PIT-entry
416>>>4		ulelong			>1	\b; #2
417>>>0x0A0	use				PIT-entry
418>>>4		ulelong			>2	\b; #3
419>>>0x124	use				PIT-entry
420>>>4		ulelong			>3	\b; #4
421>>>0x1A8	use				PIT-entry
422>>>4		ulelong			>4	\b; #5
423>>>0x22C	use				PIT-entry
424>>>4		ulelong			>5	\b; #6
425>>>0x2B0	use				PIT-entry
426>>>4		ulelong			>6	\b; #7
427>>>0x334	use				PIT-entry
428>>>4		ulelong			>7 	\b; #8
429>>>0x3B8	use				PIT-entry
430>>>4		ulelong			>8 	\b; #9
431>>>0x43C	use				PIT-entry
432>>>4		ulelong			>9	\b; #10
433>>>0x4C0	use				PIT-entry
434>>>4		ulelong			>10	\b; #11
435>>>0x544	use				PIT-entry
436>>>4		ulelong			>11	\b; #12
437>>>0x5C8	use				PIT-entry
438>>>4		ulelong			>12	\b; #13
439>>>>0x64C	use				PIT-entry
440# 14. pit entry
441>>>4		ulelong			>13	\b; #14
442>>>>0x6D0	use				PIT-entry
443>>>4		ulelong			>14	\b; #15
444>>>0x754	use				PIT-entry
445>>>4		ulelong			>15	\b; #16
446>>>0x7D8	use				PIT-entry
447>>>4		ulelong			>16	\b; #17
448>>>0x85C	use				PIT-entry
449# 18. pit entry
450>>>4		ulelong			>17	\b; #18
451>>>0x8E0	use				PIT-entry
452
4530	name			PIT-entry
454# garbage value implies end of pit entries
455>0x00		ulequad&0xFFFFFFFCFFFFFFFC	=0x0000000000000000
456# skip empty partition name
457>>0x24		ubyte				!0
458# partition name
459>>>0x24		string				>\0			%-.32s
460# flags
461>>>0x0C		ulelong&0x00000002		2			\b+RW
462# partition ID:
463# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~KENREl,RECOVER,misc;7~RECOVER
464# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW
465>>>0x08	ulelong		x			(0x%x)
466# filename
467>>>0x44		string				>\0			"%-.64s"
468#>>>0x18	ulelong				>0
469# blocksize in 512 byte units ?
470#>>>>0x18	ulelong				x			\b, %db
471# partition size in blocks ?
472#>>>>0x22	ulelong				x			\b*%d
473
474# Android bootimg format
475# From https://android.googlesource.com/\
476# platform/system/core/+/master/libsparse/sparse_format.h
4770		lelong	0xed26ff3a		Android sparse image
478>4		leshort	x			\b, version: %d
479>6		leshort	x			\b.%d
480>16		lelong	x			\b, Total of %d
481>12		lelong	x			\b %d-byte output blocks in
482>20		lelong	x			\b %d input chunks.
483
484#------------------------------------------------------------------------------
485# $File: animation,v 1.55 2014/09/13 14:29:51 christos Exp $
486# animation:  file(1) magic for animation/movie formats
487#
488# animation formats
489# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
490# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
491
492# SGI and Apple formats
4930	string		MOVI		Silicon Graphics movie file
494!:mime	video/x-sgi-movie
4954       string          moov            Apple QuickTime
496!:mime	video/quicktime
497>12     string          mvhd            \b movie (fast start)
498>12     string          mdra            \b URL
499>12     string          cmov            \b movie (fast start, compressed header)
500>12     string          rmra            \b multiple URLs
5014       string          mdat            Apple QuickTime movie (unoptimized)
502!:mime	video/quicktime
503#4       string          wide            Apple QuickTime movie (unoptimized)
504#!:mime	video/quicktime
505#4       string          skip            Apple QuickTime movie (modified)
506#!:mime	video/quicktime
507#4       string          free            Apple QuickTime movie (modified)
508#!:mime	video/quicktime
5094       string          idsc            Apple QuickTime image (fast start)
510!:mime	image/x-quicktime
511#4       string          idat            Apple QuickTime image (unoptimized)
512#!:mime	image/x-quicktime
5134       string          pckg            Apple QuickTime compressed archive
514!:mime	application/x-quicktime-player
5154	string/W	jP		JPEG 2000 image
516!:mime	image/jp2
517# http://www.ftyps.com/ with local additions
5184	string		ftyp		ISO Media
519>8	string		3g2		\b, MPEG v4 system, 3GPP2
520!:mime	video/3gpp2
521>>11	byte		4		\b v4 (H.263/AMR GSM 6.10)
522>>11	byte		5		\b v5 (H.263/AMR GSM 6.10)
523>>11	byte		6		\b v6 (ITU H.264/AMR GSM 6.10)
524>>11	byte		a		\b C.S0050-0 V1.0
525>>11	byte		b		\b C.S0050-0-A V1.0.0
526>>11	byte		c		\b C.S0050-0-B V1.0
527>8	string		3ge		\b, MPEG v4 system, 3GPP
528!:mime	video/3gpp
529>>11	byte		6		\b, Release 6 MBMS Extended Presentations
530>>11	byte		7		\b, Release 7 MBMS Extended Presentations
531>8	string		3gg		\b, MPEG v4 system, 3GPP
532>11	byte		6		\b, Release 6 General Profile
533!:mime	video/3gpp
534>8	string		3gp		\b, MPEG v4 system, 3GPP
535>11	byte		1		\b, Release %d (non existent)
536>11	byte		2		\b, Release %d (non existent)
537>11	byte		3		\b, Release %d (non existent)
538>11	byte		4		\b, Release %d
539>11	byte		5		\b, Release %d
540>11	byte		6		\b, Release %d
541>11	byte		7		\b, Release %d Streaming Servers
542!:mime	video/3gpp
543>8	string		3gs		\b, MPEG v4 system, 3GPP
544>11	byte		7		\b, Release %d Streaming Servers
545!:mime	video/3gpp
546>8	string		avc1		\b, MPEG v4 system, 3GPP JVT AVC [ISO 14496-12:2005]
547!:mime	video/mp4
548>8	string/W	qt		\b, Apple QuickTime movie
549!:mime	video/quicktime
550>8	string		CAEP		\b, Canon Digital Camera
551>8	string		caqv		\b, Casio Digital Camera
552>8	string		CDes		\b, Convergent Design
553>8	string		da0a		\b, DMB MAF w/ MPEG Layer II aud, MOT slides, DLS, JPG/PNG/MNG
554>8	string		da0b		\b, DMB MAF, ext DA0A, with 3GPP timed text, DID, TVA, REL, IPMP
555>8	string		da1a		\b, DMB MAF audio with ER-BSAC audio, JPG/PNG/MNG images
556>8	string		da1b		\b, DMB MAF, ext da1a, with 3GPP timed text, DID, TVA, REL, IPMP
557>8	string		da2a		\b, DMB MAF aud w/ HE-AAC v2 aud, MOT slides, DLS, JPG/PNG/MNG
558>8	string		da2b		\b, DMB MAF, ext da2a, with 3GPP timed text, DID, TVA, REL, IPMP
559>8	string		da3a		\b, DMB MAF aud with HE-AAC aud, JPG/PNG/MNG images
560>8	string		da3b		\b, DMB MAF, ext da3a w/ BIFS, 3GPP, DID, TVA, REL, IPMP
561>8	string		dmb1		\b, DMB MAF supporting all the components defined in the spec
562>8	string		dmpf		\b, Digital Media Project
563>8	string		drc1		\b, Dirac (wavelet compression), encap in ISO base media (MP4)
564>8	string		dv1a		\b, DMB MAF vid w/ AVC vid, ER-BSAC aud, BIFS, JPG/PNG/MNG, TS
565>8	string		dv1b		\b, DMB MAF, ext dv1a, with 3GPP timed text, DID, TVA, REL, IPMP
566>8	string		dv2a		\b, DMB MAF vid w/ AVC vid, HE-AAC v2 aud, BIFS, JPG/PNG/MNG, TS
567>8	string		dv2b		\b, DMB MAF, ext dv2a, with 3GPP timed text, DID, TVA, REL, IPMP
568>8	string		dv3a		\b, DMB MAF vid w/ AVC vid, HE-AAC aud, BIFS, JPG/PNG/MNG, TS
569>8	string		dv3b		\b, DMB MAF, ext dv3a, with 3GPP timed text, DID, TVA, REL, IPMP
570>8	string		dvr1		\b, DVB (.DVB) over RTP
571!:mime	video/vnd.dvb.file
572>8	string		dvt1		\b, DVB (.DVB) over MPEG-2 Transport Stream
573!:mime	video/vnd.dvb.file
574>8	string		F4V		\b, Video for Adobe Flash Player 9+ (.F4V)
575!:mime	video/mp4
576>8	string		F4P		\b, Protected Video for Adobe Flash Player 9+ (.F4P)
577!:mime	video/mp4
578>8	string		F4A		\b, Audio for Adobe Flash Player 9+ (.F4A)
579!:mime	audio/mp4
580>8	string		F4B		\b, Audio Book for Adobe Flash Player 9+ (.F4B)
581!:mime	audio/mp4
582>8	string		isc2		\b, ISMACryp 2.0 Encrypted File
583#	?/enc-isoff-generic
584>8	string		iso2		\b, MP4 Base Media v2 [ISO 14496-12:2005]
585!:mime	video/mp4
586>8	string		isom		\b, MP4 Base Media v1 [IS0 14496-12:2003]
587!:mime	video/mp4
588>8	string/W	jp2		\b, JPEG 2000
589!:mime	image/jp2
590>8	string		JP2		\b, JPEG 2000 Image (.JP2) [ISO 15444-1 ?]
591!:mime	image/jp2
592>8	string		JP20		\b, Unknown, from GPAC samples (prob non-existent)
593>8	string		jpm		\b, JPEG 2000 Compound Image (.JPM) [ISO 15444-6]
594!:mime	image/jpm
595>8	string		jpx		\b, JPEG 2000 w/ extensions (.JPX) [ISO 15444-2]
596!:mime	image/jpx
597>8	string		KDDI		\b, 3GPP2 EZmovie for KDDI 3G cellphones
598!:mime	video/3gpp2
599>8	string		M4A 		\b, Apple iTunes ALAC/AAC-LC (.M4A) Audio
600!:mime	audio/x-m4a
601>8	string		M4B 		\b, Apple iTunes ALAC/AAC-LC (.M4B) Audio Book
602!:mime	audio/mp4
603>8	string		M4P 		\b, Apple iTunes ALAC/AAC-LC (.M4P) AES Protected Audio
604!:mime	video/mp4
605>8	string		M4V 		\b, Apple iTunes Video (.M4V) Video
606!:mime	video/x-m4v
607>8	string		M4VH		\b, Apple TV (.M4V)
608!:mime	video/x-m4v
609>8	string		M4VP		\b, Apple iPhone (.M4V)
610!:mime	video/x-m4v
611>8	string		mj2s		\b, Motion JPEG 2000 [ISO 15444-3] Simple Profile
612!:mime	video/mj2
613>8	string		mjp2		\b, Motion JPEG 2000 [ISO 15444-3] General Profile
614!:mime	video/mj2
615>8	string		mmp4		\b, MPEG-4/3GPP Mobile Profile (.MP4 / .3GP) (for NTT)
616!:mime	video/mp4
617>8	string		mobi		\b, MPEG-4, MOBI format
618!:mime	video/mp4
619>8	string		mp21		\b, MPEG-21 [ISO/IEC 21000-9]
620>8	string		mp41		\b, MP4 v1 [ISO 14496-1:ch13]
621!:mime	video/mp4
622>8	string		mp42		\b, MP4 v2 [ISO 14496-14]
623!:mime	video/mp4
624>8	string		mp71		\b, MP4 w/ MPEG-7 Metadata [per ISO 14496-12]
625>8	string		mp7t		\b, MPEG v4 system, MPEG v7 XML
626>8	string		mp7b		\b, MPEG v4 system, MPEG v7 binary XML
627>8	string		mmp4		\b, MPEG v4 system, 3GPP Mobile
628!:mime	video/mp4
629>8	string		MPPI		\b, Photo Player, MAF [ISO/IEC 23000-3]
630>8	string		mqt		\b, Sony / Mobile QuickTime (.MQV) US Pat 7,477,830
631!:mime	video/quicktime
632>8	string		MSNV		\b, MPEG-4 (.MP4) for SonyPSP
633!:mime	audio/mp4
634>8	string		NDAS		\b, MP4 v2 [ISO 14496-14] Nero Digital AAC Audio
635!:mime	audio/mp4
636>8	string		NDSC		\b, MPEG-4 (.MP4) Nero Cinema Profile
637!:mime	video/mp4
638>8	string		NDSH		\b, MPEG-4 (.MP4) Nero HDTV Profile
639!:mime	video/mp4
640>8	string		NDSM		\b, MPEG-4 (.MP4) Nero Mobile Profile
641!:mime	video/mp4
642>8	string		NDSP		\b, MPEG-4 (.MP4) Nero Portable Profile
643!:mime	video/mp4
644>8	string		NDSS		\b, MPEG-4 (.MP4) Nero Standard Profile
645!:mime	video/mp4
646>8	string		NDXC		\b, H.264/MPEG-4 AVC (.MP4) Nero Cinema Profile
647!:mime	video/mp4
648>8	string		NDXH		\b, H.264/MPEG-4 AVC (.MP4) Nero HDTV Profile
649!:mime	video/mp4
650>8	string		NDXM		\b, H.264/MPEG-4 AVC (.MP4) Nero Mobile Profile
651!:mime	video/mp4
652>8	string		NDXP		\b, H.264/MPEG-4 AVC (.MP4) Nero Portable Profile
653!:mime	video/mp4
654>8	string		NDXS		\b, H.264/MPEG-4 AVC (.MP4) Nero Standard Profile
655!:mime	video/mp4
656>8	string		odcf  		\b, OMA DCF DRM Format 2.0 (OMA-TS-DRM-DCF-V2_0-20060303-A)
657>8	string		opf2 		\b, OMA PDCF DRM Format 2.1 (OMA-TS-DRM-DCF-V2_1-20070724-C)
658>8	string		opx2  		\b, OMA PDCF DRM + XBS ext (OMA-TS-DRM_XBS-V1_0-20070529-C)
659>8	string		pana		\b, Panasonic Digital Camera
660>8	string		qt  		\b, Apple QuickTime (.MOV/QT)
661!:mime	video/quicktime
662>8	string		ROSS		\b, Ross Video
663>8	string		sdv		\b, SD Memory Card Video
664>8	string		ssc1		\b, Samsung stereo, single stream (patent pending)
665>8	string		ssc2		\b, Samsung stereo, dual stream (patent pending)
666
667# MPEG sequences
668# Scans for all common MPEG header start codes
6690	 belong		    0x00000001
670>4	 byte&0x1F	    0x07	   JVT NAL sequence, H.264 video
671>>5      byte               66             \b, baseline
672>>5      byte               77             \b, main
673>>5      byte               88             \b, extended
674>>7      byte               x              \b @ L %u
6750        belong&0xFFFFFF00  0x00000100
676>3       byte               0xBA           MPEG sequence
677!:mime  video/mpeg
678>>4      byte               &0x40          \b, v2, program multiplex
679>>4      byte               ^0x40          \b, v1, system multiplex
680>3       byte               0xBB           MPEG sequence, v1/2, multiplex (missing pack header)
681>3       byte&0x1F          0x07           MPEG sequence, H.264 video
682>>4      byte               66             \b, baseline
683>>4      byte               77             \b, main
684>>4      byte               88             \b, extended
685>>6      byte               x              \b @ L %u
686# GRR too general as it catches also FoxPro Memo example NG.FPT
687>3       byte               0xB0           MPEG sequence, v4
688# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000
689#>>4      byte               !0             MPEG sequence, v4
690!:mime  video/mpeg4-generic
691>>5      belong             0x000001B5
692>>>9     byte               &0x80
693>>>>10   byte&0xF0          16             \b, video
694>>>>10   byte&0xF0          32             \b, still texture
695>>>>10   byte&0xF0          48             \b, mesh
696>>>>10   byte&0xF0          64             \b, face
697>>>9     byte&0xF8          8              \b, video
698>>>9     byte&0xF8          16             \b, still texture
699>>>9     byte&0xF8          24             \b, mesh
700>>>9     byte&0xF8          32             \b, face
701>>4      byte               1              \b, simple @ L1
702>>4      byte               2              \b, simple @ L2
703>>4      byte               3              \b, simple @ L3
704>>4      byte               4              \b, simple @ L0
705>>4      byte               17             \b, simple scalable @ L1
706>>4      byte               18             \b, simple scalable @ L2
707>>4      byte               33             \b, core @ L1
708>>4      byte               34             \b, core @ L2
709>>4      byte               50             \b, main @ L2
710>>4      byte               51             \b, main @ L3
711>>4      byte               53             \b, main @ L4
712>>4      byte               66             \b, n-bit @ L2
713>>4      byte               81             \b, scalable texture @ L1
714>>4      byte               97             \b, simple face animation @ L1
715>>4      byte               98             \b, simple face animation @ L2
716>>4      byte               99             \b, simple face basic animation @ L1
717>>4      byte               100            \b, simple face basic animation @ L2
718>>4      byte               113            \b, basic animation text @ L1
719>>4      byte               114            \b, basic animation text @ L2
720>>4      byte               129            \b, hybrid @ L1
721>>4      byte               130            \b, hybrid @ L2
722>>4      byte               145            \b, advanced RT simple @ L!
723>>4      byte               146            \b, advanced RT simple @ L2
724>>4      byte               147            \b, advanced RT simple @ L3
725>>4      byte               148            \b, advanced RT simple @ L4
726>>4      byte               161            \b, core scalable @ L1
727>>4      byte               162            \b, core scalable @ L2
728>>4      byte               163            \b, core scalable @ L3
729>>4      byte               177            \b, advanced coding efficiency @ L1
730>>4      byte               178            \b, advanced coding efficiency @ L2
731>>4      byte               179            \b, advanced coding efficiency @ L3
732>>4      byte               180            \b, advanced coding efficiency @ L4
733>>4      byte               193            \b, advanced core @ L1
734>>4      byte               194            \b, advanced core @ L2
735>>4      byte               209            \b, advanced scalable texture @ L1
736>>4      byte               210            \b, advanced scalable texture @ L2
737>>4      byte               211            \b, advanced scalable texture @ L3
738>>4      byte               225            \b, simple studio @ L1
739>>4      byte               226            \b, simple studio @ L2
740>>4      byte               227            \b, simple studio @ L3
741>>4      byte               228            \b, simple studio @ L4
742>>4      byte               229            \b, core studio @ L1
743>>4      byte               230            \b, core studio @ L2
744>>4      byte               231            \b, core studio @ L3
745>>4      byte               232            \b, core studio @ L4
746>>4      byte               240            \b, advanced simple @ L0
747>>4      byte               241            \b, advanced simple @ L1
748>>4      byte               242            \b, advanced simple @ L2
749>>4      byte               243            \b, advanced simple @ L3
750>>4      byte               244            \b, advanced simple @ L4
751>>4      byte               245            \b, advanced simple @ L5
752>>4      byte               247            \b, advanced simple @ L3b
753>>4      byte               248            \b, FGS @ L0
754>>4      byte               249            \b, FGS @ L1
755>>4      byte               250            \b, FGS @ L2
756>>4      byte               251            \b, FGS @ L3
757>>4      byte               252            \b, FGS @ L4
758>>4      byte               253            \b, FGS @ L5
759>3       byte               0xB5           MPEG sequence, v4
760!:mime  video/mpeg4-generic
761>>4      byte               &0x80
762>>>5     byte&0xF0          16             \b, video (missing profile header)
763>>>5     byte&0xF0          32             \b, still texture (missing profile header)
764>>>5     byte&0xF0          48             \b, mesh (missing profile header)
765>>>5     byte&0xF0          64             \b, face (missing profile header)
766>>4      byte&0xF8          8              \b, video (missing profile header)
767>>4      byte&0xF8          16             \b, still texture (missing profile header)
768>>4      byte&0xF8          24             \b, mesh (missing profile header)
769>>4      byte&0xF8          32             \b, face (missing profile header)
770>3       byte               0xB3           MPEG sequence
771!:mime  video/mpeg
772>>12     belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
773>>12     belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
774>>12     belong             0x000001B5     \b, v2,
775>>>16    byte&0x0F          1              \b HP
776>>>16    byte&0x0F          2              \b Spt
777>>>16    byte&0x0F          3              \b SNR
778>>>16    byte&0x0F          4              \b MP
779>>>16    byte&0x0F          5              \b SP
780>>>17    byte&0xF0          64             \b@HL
781>>>17    byte&0xF0          96             \b@H-14
782>>>17    byte&0xF0          128            \b@ML
783>>>17    byte&0xF0          160            \b@LL
784>>>17    byte               &0x08          \b progressive
785>>>17    byte               ^0x08          \b interlaced
786>>>17    byte&0x06          2              \b Y'CbCr 4:2:0 video
787>>>17    byte&0x06          4              \b Y'CbCr 4:2:2 video
788>>>17    byte&0x06          6              \b Y'CbCr 4:4:4 video
789>>11     byte               &0x02
790>>>75    byte               &0x01
791>>>>140  belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
792>>>>140  belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
793>>>>140  belong             0x000001B5     \b, v2,
794>>>>>144 byte&0x0F          1              \b HP
795>>>>>144 byte&0x0F          2              \b Spt
796>>>>>144 byte&0x0F          3              \b SNR
797>>>>>144 byte&0x0F          4              \b MP
798>>>>>144 byte&0x0F          5              \b SP
799>>>>>145 byte&0xF0          64             \b@HL
800>>>>>145 byte&0xF0          96             \b@H-14
801>>>>>145 byte&0xF0          128            \b@ML
802>>>>>145 byte&0xF0          160            \b@LL
803>>>>>145 byte               &0x08          \b progressive
804>>>>>145 byte               ^0x08          \b interlaced
805>>>>>145 byte&0x06          2              \b Y'CbCr 4:2:0 video
806>>>>>145 byte&0x06          4              \b Y'CbCr 4:2:2 video
807>>>>>145 byte&0x06          6              \b Y'CbCr 4:4:4 video
808>>76    belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
809>>76    belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
810>>76    belong             0x000001B5     \b, v2,
811>>>80   byte&0x0F          1              \b HP
812>>>80   byte&0x0F          2              \b Spt
813>>>80   byte&0x0F          3              \b SNR
814>>>80   byte&0x0F          4              \b MP
815>>>80   byte&0x0F          5              \b SP
816>>>81   byte&0xF0          64             \b@HL
817>>>81   byte&0xF0          96             \b@H-14
818>>>81   byte&0xF0          128            \b@ML
819>>>81   byte&0xF0          160            \b@LL
820>>>81   byte               &0x08          \b progressive
821>>>81   byte               ^0x08          \b interlaced
822>>>81   byte&0x06          2              \b Y'CbCr 4:2:0 video
823>>>81   byte&0x06          4              \b Y'CbCr 4:2:2 video
824>>>81   byte&0x06          6              \b Y'CbCr 4:4:4 video
825>>4      belong&0xFFFFFF00  0x78043800     \b, HD-TV 1920P
826>>>7     byte&0xF0          0x10           \b, 16:9
827>>4      belong&0xFFFFFF00  0x50002D00     \b, SD-TV 1280I
828>>>7     byte&0xF0          0x10           \b, 16:9
829>>4      belong&0xFFFFFF00  0x30024000     \b, PAL Capture
830>>>7     byte&0xF0          0x10           \b, 4:3
831>>4      beshort&0xFFF0     0x2C00         \b, 4CIF
832>>>5     beshort&0x0FFF     0x01E0         \b NTSC
833>>>5     beshort&0x0FFF     0x0240         \b PAL
834>>>7     byte&0xF0          0x20           \b, 4:3
835>>>7     byte&0xF0          0x30           \b, 16:9
836>>>7     byte&0xF0          0x40           \b, 11:5
837>>>7     byte&0xF0          0x80           \b, PAL 4:3
838>>>7     byte&0xF0          0xC0           \b, NTSC 4:3
839>>4      belong&0xFFFFFF00  0x2801E000     \b, LD-TV 640P
840>>>7     byte&0xF0          0x10           \b, 4:3
841>>4      belong&0xFFFFFF00  0x1400F000     \b, 320x240
842>>>7     byte&0xF0          0x10           \b, 4:3
843>>4      belong&0xFFFFFF00  0x0F00A000     \b, 240x160
844>>>7     byte&0xF0          0x10           \b, 4:3
845>>4      belong&0xFFFFFF00  0x0A007800     \b, 160x120
846>>>7     byte&0xF0          0x10           \b, 4:3
847>>4      beshort&0xFFF0     0x1600         \b, CIF
848>>>5     beshort&0x0FFF     0x00F0         \b NTSC
849>>>5     beshort&0x0FFF     0x0120         \b PAL
850>>>7     byte&0xF0          0x20           \b, 4:3
851>>>7     byte&0xF0          0x30           \b, 16:9
852>>>7     byte&0xF0          0x40           \b, 11:5
853>>>7     byte&0xF0          0x80           \b, PAL 4:3
854>>>7     byte&0xF0          0xC0           \b, NTSC 4:3
855>>>5     beshort&0x0FFF     0x0240         \b PAL 625
856>>>>7    byte&0xF0          0x20           \b, 4:3
857>>>>7    byte&0xF0          0x30           \b, 16:9
858>>>>7    byte&0xF0          0x40           \b, 11:5
859>>4      beshort&0xFFF0     0x2D00         \b, CCIR/ITU
860>>>5     beshort&0x0FFF     0x01E0         \b NTSC 525
861>>>5     beshort&0x0FFF     0x0240         \b PAL 625
862>>>7     byte&0xF0          0x20           \b, 4:3
863>>>7     byte&0xF0          0x30           \b, 16:9
864>>>7     byte&0xF0          0x40           \b, 11:5
865>>4      beshort&0xFFF0     0x1E00         \b, SVCD
866>>>5     beshort&0x0FFF     0x01E0         \b NTSC 525
867>>>5     beshort&0x0FFF     0x0240         \b PAL 625
868>>>7     byte&0xF0          0x20           \b, 4:3
869>>>7     byte&0xF0          0x30           \b, 16:9
870>>>7     byte&0xF0          0x40           \b, 11:5
871>>7      byte&0x0F          1              \b, 23.976 fps
872>>7      byte&0x0F          2              \b, 24 fps
873>>7      byte&0x0F          3              \b, 25 fps
874>>7      byte&0x0F          4              \b, 29.97 fps
875>>7      byte&0x0F          5              \b, 30 fps
876>>7      byte&0x0F          6              \b, 50 fps
877>>7      byte&0x0F          7              \b, 59.94 fps
878>>7      byte&0x0F          8              \b, 60 fps
879>>11     byte               &0x04          \b, Constrained
880
881# MPEG ADTS Audio (*.mpx/mxa/aac)
882# from dreesen@math.fu-berlin.de
883# modified to fully support MPEG ADTS
884
885# MP3, M1A
886# modified by Joerg Jenderek
887# GRR the original test are too common for many DOS files
888# so don't accept as MP3 until we've tested the rate
8890       beshort&0xFFFE  0xFFFA
890# rates
891>2      byte&0xF0       0x10           MPEG ADTS, layer III, v1,  32 kbps
892!:mime	audio/mpeg
893>2      byte&0xF0       0x20           MPEG ADTS, layer III, v1,  40 kbps
894!:mime	audio/mpeg
895>2      byte&0xF0       0x30           MPEG ADTS, layer III, v1,  48 kbps
896!:mime	audio/mpeg
897>2      byte&0xF0       0x40           MPEG ADTS, layer III, v1,  56 kbps
898!:mime	audio/mpeg
899>2      byte&0xF0       0x50           MPEG ADTS, layer III, v1,  64 kbps
900!:mime	audio/mpeg
901>2      byte&0xF0       0x60           MPEG ADTS, layer III, v1,  80 kbps
902!:mime	audio/mpeg
903>2      byte&0xF0       0x70           MPEG ADTS, layer III, v1,  96 kbps
904!:mime	audio/mpeg
905>2      byte&0xF0       0x80           MPEG ADTS, layer III, v1, 112 kbps
906!:mime	audio/mpeg
907>2      byte&0xF0       0x90           MPEG ADTS, layer III, v1, 128 kbps
908!:mime	audio/mpeg
909>2      byte&0xF0       0xA0           MPEG ADTS, layer III, v1, 160 kbps
910!:mime	audio/mpeg
911>2      byte&0xF0       0xB0           MPEG ADTS, layer III, v1, 192 kbps
912!:mime	audio/mpeg
913>2      byte&0xF0       0xC0           MPEG ADTS, layer III, v1, 224 kbps
914!:mime	audio/mpeg
915>2      byte&0xF0       0xD0           MPEG ADTS, layer III, v1, 256 kbps
916!:mime	audio/mpeg
917>2      byte&0xF0       0xE0           MPEG ADTS, layer III, v1, 320 kbps
918!:mime	audio/mpeg
919# timing
920>2      byte&0x0C       0x00           \b, 44.1 kHz
921>2      byte&0x0C       0x04           \b, 48 kHz
922>2      byte&0x0C       0x08           \b, 32 kHz
923# channels/options
924>3      byte&0xC0       0x00           \b, Stereo
925>3      byte&0xC0       0x40           \b, JntStereo
926>3      byte&0xC0       0x80           \b, 2x Monaural
927>3      byte&0xC0       0xC0           \b, Monaural
928#>1     byte            ^0x01          \b, Data Verify
929#>2     byte            &0x02          \b, Packet Pad
930#>2     byte            &0x01          \b, Custom Flag
931#>3     byte            &0x08          \b, Copyrighted
932#>3     byte            &0x04          \b, Original Source
933#>3     byte&0x03       1              \b, NR: 50/15 ms
934#>3     byte&0x03       3              \b, NR: CCIT J.17
935
936# MP2, M1A
9370       beshort&0xFFFE  0xFFFC         MPEG ADTS, layer II, v1
938!:mime	audio/mpeg
939# rates
940>2      byte&0xF0       0x10           \b,  32 kbps
941>2      byte&0xF0       0x20           \b,  48 kbps
942>2      byte&0xF0       0x30           \b,  56 kbps
943>2      byte&0xF0       0x40           \b,  64 kbps
944>2      byte&0xF0       0x50           \b,  80 kbps
945>2      byte&0xF0       0x60           \b,  96 kbps
946>2      byte&0xF0       0x70           \b, 112 kbps
947>2      byte&0xF0       0x80           \b, 128 kbps
948>2      byte&0xF0       0x90           \b, 160 kbps
949>2      byte&0xF0       0xA0           \b, 192 kbps
950>2      byte&0xF0       0xB0           \b, 224 kbps
951>2      byte&0xF0       0xC0           \b, 256 kbps
952>2      byte&0xF0       0xD0           \b, 320 kbps
953>2      byte&0xF0       0xE0           \b, 384 kbps
954# timing
955>2      byte&0x0C       0x00           \b, 44.1 kHz
956>2      byte&0x0C       0x04           \b, 48 kHz
957>2      byte&0x0C       0x08           \b, 32 kHz
958# channels/options
959>3      byte&0xC0       0x00           \b, Stereo
960>3      byte&0xC0       0x40           \b, JntStereo
961>3      byte&0xC0       0x80           \b, 2x Monaural
962>3      byte&0xC0       0xC0           \b, Monaural
963#>1     byte            ^0x01          \b, Data Verify
964#>2     byte            &0x02          \b, Packet Pad
965#>2     byte            &0x01          \b, Custom Flag
966#>3     byte            &0x08          \b, Copyrighted
967#>3     byte            &0x04          \b, Original Source
968#>3     byte&0x03       1              \b, NR: 50/15 ms
969#>3     byte&0x03       3              \b, NR: CCIT J.17
970
971# MPA, M1A
972# updated by Joerg Jenderek
973# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448
974# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE)
975# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries
976#0	beshort&0xFFFE		0xFFFE
977#>2	ubyte&0xF0	>0x0F
978#>>2	ubyte&0xF0	<0xE1		MPEG ADTS, layer I, v1
979## rate
980#>>>2      byte&0xF0       0x10           \b,  32 kbps
981#>>>2      byte&0xF0       0x20           \b,  64 kbps
982#>>>2      byte&0xF0       0x30           \b,  96 kbps
983#>>>2      byte&0xF0       0x40           \b, 128 kbps
984#>>>2      byte&0xF0       0x50           \b, 160 kbps
985#>>>2      byte&0xF0       0x60           \b, 192 kbps
986#>>>2      byte&0xF0       0x70           \b, 224 kbps
987#>>>2      byte&0xF0       0x80           \b, 256 kbps
988#>>>2      byte&0xF0       0x90           \b, 288 kbps
989#>>>2      byte&0xF0       0xA0           \b, 320 kbps
990#>>>2      byte&0xF0       0xB0           \b, 352 kbps
991#>>>2      byte&0xF0       0xC0           \b, 384 kbps
992#>>>2      byte&0xF0       0xD0           \b, 416 kbps
993#>>>2      byte&0xF0       0xE0           \b, 448 kbps
994## timing
995#>>>2      byte&0x0C       0x00           \b, 44.1 kHz
996#>>>2      byte&0x0C       0x04           \b, 48 kHz
997#>>>2      byte&0x0C       0x08           \b, 32 kHz
998## channels/options
999#>>>3      byte&0xC0       0x00           \b, Stereo
1000#>>>3      byte&0xC0       0x40           \b, JntStereo
1001#>>>3      byte&0xC0       0x80           \b, 2x Monaural
1002#>>>3      byte&0xC0       0xC0           \b, Monaural
1003##>1     byte            ^0x01          \b, Data Verify
1004##>2     byte            &0x02          \b, Packet Pad
1005##>2     byte            &0x01          \b, Custom Flag
1006##>3     byte            &0x08          \b, Copyrighted
1007##>3     byte            &0x04          \b, Original Source
1008##>3     byte&0x03       1              \b, NR: 50/15 ms
1009##>3     byte&0x03       3              \b, NR: CCIT J.17
1010
1011# MP3, M2A
10120       beshort&0xFFFE  0xFFF2         MPEG ADTS, layer III, v2
1013!:mime	audio/mpeg
1014# rate
1015>2      byte&0xF0       0x10           \b,   8 kbps
1016>2      byte&0xF0       0x20           \b,  16 kbps
1017>2      byte&0xF0       0x30           \b,  24 kbps
1018>2      byte&0xF0       0x40           \b,  32 kbps
1019>2      byte&0xF0       0x50           \b,  40 kbps
1020>2      byte&0xF0       0x60           \b,  48 kbps
1021>2      byte&0xF0       0x70           \b,  56 kbps
1022>2      byte&0xF0       0x80           \b,  64 kbps
1023>2      byte&0xF0       0x90           \b,  80 kbps
1024>2      byte&0xF0       0xA0           \b,  96 kbps
1025>2      byte&0xF0       0xB0           \b, 112 kbps
1026>2      byte&0xF0       0xC0           \b, 128 kbps
1027>2      byte&0xF0       0xD0           \b, 144 kbps
1028>2      byte&0xF0       0xE0           \b, 160 kbps
1029# timing
1030>2      byte&0x0C       0x00           \b, 22.05 kHz
1031>2      byte&0x0C       0x04           \b, 24 kHz
1032>2      byte&0x0C       0x08           \b, 16 kHz
1033# channels/options
1034>3      byte&0xC0       0x00           \b, Stereo
1035>3      byte&0xC0       0x40           \b, JntStereo
1036>3      byte&0xC0       0x80           \b, 2x Monaural
1037>3      byte&0xC0       0xC0           \b, Monaural
1038#>1     byte            ^0x01          \b, Data Verify
1039#>2     byte            &0x02          \b, Packet Pad
1040#>2     byte            &0x01          \b, Custom Flag
1041#>3     byte            &0x08          \b, Copyrighted
1042#>3     byte            &0x04          \b, Original Source
1043#>3     byte&0x03       1              \b, NR: 50/15 ms
1044#>3     byte&0x03       3              \b, NR: CCIT J.17
1045
1046# MP2, M2A
10470       beshort&0xFFFE  0xFFF4         MPEG ADTS, layer II, v2
1048!:mime	audio/mpeg
1049# rate
1050>2      byte&0xF0       0x10           \b,   8 kbps
1051>2      byte&0xF0       0x20           \b,  16 kbps
1052>2      byte&0xF0       0x30           \b,  24 kbps
1053>2      byte&0xF0       0x40           \b,  32 kbps
1054>2      byte&0xF0       0x50           \b,  40 kbps
1055>2      byte&0xF0       0x60           \b,  48 kbps
1056>2      byte&0xF0       0x70           \b,  56 kbps
1057>2      byte&0xF0       0x80           \b,  64 kbps
1058>2      byte&0xF0       0x90           \b,  80 kbps
1059>2      byte&0xF0       0xA0           \b,  96 kbps
1060>2      byte&0xF0       0xB0           \b, 112 kbps
1061>2      byte&0xF0       0xC0           \b, 128 kbps
1062>2      byte&0xF0       0xD0           \b, 144 kbps
1063>2      byte&0xF0       0xE0           \b, 160 kbps
1064# timing
1065>2      byte&0x0C       0x00           \b, 22.05 kHz
1066>2      byte&0x0C       0x04           \b, 24 kHz
1067>2      byte&0x0C       0x08           \b, 16 kHz
1068# channels/options
1069>3      byte&0xC0       0x00           \b, Stereo
1070>3      byte&0xC0       0x40           \b, JntStereo
1071>3      byte&0xC0       0x80           \b, 2x Monaural
1072>3      byte&0xC0       0xC0           \b, Monaural
1073#>1     byte            ^0x01          \b, Data Verify
1074#>2     byte            &0x02          \b, Packet Pad
1075#>2     byte            &0x01          \b, Custom Flag
1076#>3     byte            &0x08          \b, Copyrighted
1077#>3     byte            &0x04          \b, Original Source
1078#>3     byte&0x03       1              \b, NR: 50/15 ms
1079#>3     byte&0x03       3              \b, NR: CCIT J.17
1080
1081# MPA, M2A
10820       beshort&0xFFFE  0xFFF6         MPEG ADTS, layer I, v2
1083!:mime	audio/mpeg
1084# rate
1085>2      byte&0xF0       0x10           \b,  32 kbps
1086>2      byte&0xF0       0x20           \b,  48 kbps
1087>2      byte&0xF0       0x30           \b,  56 kbps
1088>2      byte&0xF0       0x40           \b,  64 kbps
1089>2      byte&0xF0       0x50           \b,  80 kbps
1090>2      byte&0xF0       0x60           \b,  96 kbps
1091>2      byte&0xF0       0x70           \b, 112 kbps
1092>2      byte&0xF0       0x80           \b, 128 kbps
1093>2      byte&0xF0       0x90           \b, 144 kbps
1094>2      byte&0xF0       0xA0           \b, 160 kbps
1095>2      byte&0xF0       0xB0           \b, 176 kbps
1096>2      byte&0xF0       0xC0           \b, 192 kbps
1097>2      byte&0xF0       0xD0           \b, 224 kbps
1098>2      byte&0xF0       0xE0           \b, 256 kbps
1099# timing
1100>2      byte&0x0C       0x00           \b, 22.05 kHz
1101>2      byte&0x0C       0x04           \b, 24 kHz
1102>2      byte&0x0C       0x08           \b, 16 kHz
1103# channels/options
1104>3      byte&0xC0       0x00           \b, Stereo
1105>3      byte&0xC0       0x40           \b, JntStereo
1106>3      byte&0xC0       0x80           \b, 2x Monaural
1107>3      byte&0xC0       0xC0           \b, Monaural
1108#>1     byte            ^0x01          \b, Data Verify
1109#>2     byte            &0x02          \b, Packet Pad
1110#>2     byte            &0x01          \b, Custom Flag
1111#>3     byte            &0x08          \b, Copyrighted
1112#>3     byte            &0x04          \b, Original Source
1113#>3     byte&0x03       1              \b, NR: 50/15 ms
1114#>3     byte&0x03       3              \b, NR: CCIT J.17
1115
1116# MP3, M25A
11170       beshort&0xFFFE  0xFFE2         MPEG ADTS, layer III,  v2.5
1118!:mime	audio/mpeg
1119# rate
1120>2      byte&0xF0       0x10           \b,   8 kbps
1121>2      byte&0xF0       0x20           \b,  16 kbps
1122>2      byte&0xF0       0x30           \b,  24 kbps
1123>2      byte&0xF0       0x40           \b,  32 kbps
1124>2      byte&0xF0       0x50           \b,  40 kbps
1125>2      byte&0xF0       0x60           \b,  48 kbps
1126>2      byte&0xF0       0x70           \b,  56 kbps
1127>2      byte&0xF0       0x80           \b,  64 kbps
1128>2      byte&0xF0       0x90           \b,  80 kbps
1129>2      byte&0xF0       0xA0           \b,  96 kbps
1130>2      byte&0xF0       0xB0           \b, 112 kbps
1131>2      byte&0xF0       0xC0           \b, 128 kbps
1132>2      byte&0xF0       0xD0           \b, 144 kbps
1133>2      byte&0xF0       0xE0           \b, 160 kbps
1134# timing
1135>2      byte&0x0C       0x00           \b, 11.025 kHz
1136>2      byte&0x0C       0x04           \b, 12 kHz
1137>2      byte&0x0C       0x08           \b, 8 kHz
1138# channels/options
1139>3      byte&0xC0       0x00           \b, Stereo
1140>3      byte&0xC0       0x40           \b, JntStereo
1141>3      byte&0xC0       0x80           \b, 2x Monaural
1142>3      byte&0xC0       0xC0           \b, Monaural
1143#>1     byte            ^0x01          \b, Data Verify
1144#>2     byte            &0x02          \b, Packet Pad
1145#>2     byte            &0x01          \b, Custom Flag
1146#>3     byte            &0x08          \b, Copyrighted
1147#>3     byte            &0x04          \b, Original Source
1148#>3     byte&0x03       1              \b, NR: 50/15 ms
1149#>3     byte&0x03       3              \b, NR: CCIT J.17
1150
1151# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio
1152
1153# Stored AAC streams (instead of the MP4 format)
11540       string          ADIF           MPEG ADIF, AAC
1155!:mime	audio/x-hx-aac-adif
1156>4      byte            &0x80
1157>>13    byte            &0x10          \b, VBR
1158>>13    byte            ^0x10          \b, CBR
1159>>16    byte&0x1E       0x02           \b, single stream
1160>>16    byte&0x1E       0x04           \b, 2 streams
1161>>16    byte&0x1E       0x06           \b, 3 streams
1162>>16    byte            &0x08          \b, 4 or more streams
1163>>16    byte            &0x10          \b, 8 or more streams
1164>>4    byte            &0x80          \b, Copyrighted
1165>>13   byte            &0x40          \b, Original Source
1166>>13   byte            &0x20          \b, Home Flag
1167>4      byte            ^0x80
1168>>4     byte            &0x10          \b, VBR
1169>>4     byte            ^0x10          \b, CBR
1170>>7     byte&0x1E       0x02           \b, single stream
1171>>7     byte&0x1E       0x04           \b, 2 streams
1172>>7     byte&0x1E       0x06           \b, 3 streams
1173>>7     byte            &0x08          \b, 4 or more streams
1174>>7     byte            &0x10          \b, 8 or more streams
1175>>4    byte            &0x40          \b, Original Stream(s)
1176>>4    byte            &0x20          \b, Home Source
1177
1178# Live or stored single AAC stream (used with MPEG-2 systems)
11790       beshort&0xFFF6  0xFFF0         MPEG ADTS, AAC
1180!:mime	audio/x-hx-aac-adts
1181>1      byte            &0x08          \b, v2
1182>1      byte            ^0x08          \b, v4
1183# profile
1184>>2     byte            &0xC0          \b LTP
1185>2      byte&0xc0       0x00           \b Main
1186>2      byte&0xc0       0x40           \b LC
1187>2      byte&0xc0       0x80           \b SSR
1188# timing
1189>2      byte&0x3c       0x00           \b, 96 kHz
1190>2      byte&0x3c       0x04           \b, 88.2 kHz
1191>2      byte&0x3c       0x08           \b, 64 kHz
1192>2      byte&0x3c       0x0c           \b, 48 kHz
1193>2      byte&0x3c       0x10           \b, 44.1 kHz
1194>2      byte&0x3c       0x14           \b, 32 kHz
1195>2      byte&0x3c       0x18           \b, 24 kHz
1196>2      byte&0x3c       0x1c           \b, 22.05 kHz
1197>2      byte&0x3c       0x20           \b, 16 kHz
1198>2      byte&0x3c       0x24           \b, 12 kHz
1199>2      byte&0x3c       0x28           \b, 11.025 kHz
1200>2      byte&0x3c       0x2c           \b, 8 kHz
1201# channels
1202>2      beshort&0x01c0  0x0040         \b, monaural
1203>2      beshort&0x01c0  0x0080         \b, stereo
1204>2      beshort&0x01c0  0x00c0         \b, stereo + center
1205>2      beshort&0x01c0  0x0100         \b, stereo+center+LFE
1206>2      beshort&0x01c0  0x0140         \b, surround
1207>2      beshort&0x01c0  0x0180         \b, surround + LFE
1208>2      beshort         &0x01C0        \b, surround + side
1209#>1     byte            ^0x01           \b, Data Verify
1210#>2     byte            &0x02           \b, Custom Flag
1211#>3     byte            &0x20           \b, Original Stream
1212#>3     byte            &0x10           \b, Home Source
1213#>3     byte            &0x08           \b, Copyrighted
1214
1215# Live MPEG-4 audio streams (instead of RTP FlexMux)
12160       beshort&0xFFE0  0x56E0         MPEG-4 LOAS
1217!:mime	audio/x-mp4a-latm
1218#>1     beshort&0x1FFF  x              \b, %hu byte packet
1219>3      byte&0xE0       0x40
1220>>4     byte&0x3C       0x04           \b, single stream
1221>>4     byte&0x3C       0x08           \b, 2 streams
1222>>4     byte&0x3C       0x0C           \b, 3 streams
1223>>4     byte            &0x08          \b, 4 or more streams
1224>>4     byte            &0x20          \b, 8 or more streams
1225>3      byte&0xC0       0
1226>>4     byte&0x78       0x08           \b, single stream
1227>>4     byte&0x78       0x10           \b, 2 streams
1228>>4     byte&0x78       0x18           \b, 3 streams
1229>>4     byte            &0x20          \b, 4 or more streams
1230>>4     byte            &0x40          \b, 8 or more streams
1231# This magic isn't strong enough (matches plausible ISO-8859-1 text)
1232#0       beshort         0x4DE1         MPEG-4 LO-EP audio stream
1233#!:mime	audio/x-mp4a-latm
1234
1235# Summary: FLI animation format
1236# Created by: Daniel Quinlan <quinlan@yggdrasil.com>
1237# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
12384	leshort		0xAF11
1239# standard FLI always has 320x200 resolution and 8 bit color
1240>8	leshort		320
1241>>10	leshort		200
1242>>>12	leshort		8			FLI animation, 320x200x8
1243!:mime	video/x-fli
1244>>>>6	leshort		x			\b, %d frames
1245# frame speed is multiple of 1/70s
1246>>>>16	leshort		x			\b, %d/70s per frame
1247
1248# Summary: FLC animation format
1249# Created by: Daniel Quinlan <quinlan@yggdrasil.com>
1250# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
12514	leshort		0xAF12
1252# standard FLC always use 8 bit color
1253>12	leshort		8			FLC animation
1254!:mime	video/x-flc
1255>>8	leshort		x			\b, %d
1256>>10	leshort		x			\bx%dx8
1257>>6	uleshort	x			\b, %d frames
1258>>16	uleshort	x			\b, %dms per frame
1259
1260# DL animation format
1261# XXX - collision with most `mips' magic
1262#
1263# I couldn't find a real magic number for these, however, this
1264# -appears- to work.  Note that it might catch other files, too, so be
1265# careful!
1266#
1267# Note that title and author appear in the two 20-byte chunks
1268# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
1269# 255 (hex FF)!  The DL format is really bad.
1270#
1271#0	byte	1	DL version 1, medium format (160x100, 4 images/screen)
1272#!:mime	video/x-unknown
1273#>42	byte	x	- %d screens,
1274#>43	byte	x	%d commands
1275#0	byte	2	DL version 2
1276#!:mime	video/x-unknown
1277#>1	byte	1	- large format (320x200,1 image/screen),
1278#>1	byte	2	- medium format (160x100,4 images/screen),
1279#>1	byte	>2	- unknown format,
1280#>42	byte	x	%d screens,
1281#>43	byte	x	%d commands
1282# Based on empirical evidence, DL version 3 have several nulls following the
1283# \003.  Most of them start with non-null values at hex offset 0x34 or so.
1284#0	string	\3\0\0\0\0\0\0\0\0\0\0\0	DL version 3
1285
1286# iso 13818 transport stream
1287#
1288# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
1289# syncbyte      8 bit	0x47
1290# error_ind     1 bit	-
1291# payload_start 1 bit	1
1292# priority      1 bit	-
1293# PID          13 bit	0x0000
1294# scrambling    2 bit	-
1295# adaptfld_ctrl 2 bit	1 or 3
1296# conti_count   4 bit	-
12970	belong&0xFF5FFF10	0x47400010
1298>188	byte			0x47		MPEG transport stream data
1299
1300# DIF digital video file format <mpruett@sgi.com>
13010	belong&0xffffff00	0x1f070000      DIF
1302>4	byte			&0x01		(DVCPRO) movie file
1303>4	byte			^0x01		(DV) movie file
1304>3	byte			&0x80		(PAL)
1305>3	byte			^0x80		(NTSC)
1306
1307# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com>
13080	belong			0x3026b275	Microsoft ASF
1309!:mime  video/x-ms-asf
1310
1311# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
13120	string			\x8aMNG		MNG video data,
1313!:mime	video/x-mng
1314>4	belong			!0x0d0a1a0a	CORRUPTED,
1315>4	belong			0x0d0a1a0a
1316>>16    belong	x				%d x
1317>>20    belong	x				%d
1318
1319# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
13200	string			\x8bJNG		JNG video data,
1321!:mime	video/x-jng
1322>4	belong			!0x0d0a1a0a	CORRUPTED,
1323>4	belong			0x0d0a1a0a
1324>>16    belong	x				%d x
1325>>20    belong	x				%d
1326
1327# Vivo video (Wolfram Kleff)
13283	string		\x0D\x0AVersion:Vivo	Vivo video data
1329
1330# VRML (Virtual Reality Modelling Language)
13310       string/w        #VRML\ V1.0\ ascii	VRML 1 file
1332!:mime	model/vrml
13330	string/w	#VRML\ V2.0\ utf8	ISO/IEC 14772 VRML 97 file
1334!:mime	model/vrml
1335
1336# X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd]
1337# From Michel Briand <michelbriand@free.fr>
13380	string/t		\<?xml\ version="
1339!:strength +1
1340>20	search/1000/cw  \<!DOCTYPE\ X3D		X3D (Extensible 3D) model xml text
1341!:mime model/x3d
1342
1343#---------------------------------------------------------------------------
1344# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
1345# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03
1346#
13470	string		HVQM4		%s
1348>6	string		>\0		v%s
1349>0	byte		x		GameCube movie,
1350>0x34	ubeshort	x		%d x
1351>0x36	ubeshort	x		%d,
1352>0x26	ubeshort	x		%dus,
1353>0x42	ubeshort	0		no audio
1354>0x42	ubeshort	>0		%dHz audio
1355
1356# From: "Stefan A. Haubenthal" <polluks@web.de>
13570	string		DVDVIDEO-VTS	Video title set,
1358>0x21	byte		x		v%x
13590	string		DVDVIDEO-VMG	Video manager,
1360>0x21	byte		x		v%x
1361
1362# From: Behan Webster <behanw@websterwood.com>
1363# NuppelVideo used by Mythtv (*.nuv)
1364# Note: there are two identical stanzas here differing only in the
1365# initial string matched. It used to be done with a regex, but we're
1366# trying to get rid of those.
13670	string		NuppelVideo	MythTV NuppelVideo
1368>12	string		x		v%s
1369>20	lelong		x		(%d
1370>24	lelong		x		\bx%d),
1371>36	string		P		\bprogressive,
1372>36	string		I		\binterlaced,
1373>40	ledouble	x		\baspect:%.2f,
1374>48	ledouble	x		\bfps:%.2f
13750	string		MythTV		MythTV NuppelVideo
1376>12	string		x		v%s
1377>20	lelong		x		(%d
1378>24	lelong		x		\bx%d),
1379>36	string		P		\bprogressive,
1380>36	string		I		\binterlaced,
1381>40	ledouble	x		\baspect:%.2f,
1382>48	ledouble	x		\bfps:%.2f
1383
1384#						MPEG file
1385# MPEG sequences
1386# FIXME: This section is from the old magic.mime file and needs
1387# integrating with the rest
1388#0       belong             0x000001BA
1389#>4      byte               &0x40
1390#!:mime	video/mp2p
1391#>4      byte               ^0x40
1392#!:mime	video/mpeg
1393#0       belong             0x000001BB
1394#!:mime	video/mpeg
1395#0       belong             0x000001B0
1396#!:mime	video/mp4v-es
1397#0       belong             0x000001B5
1398#!:mime	video/mp4v-es
1399#0       belong             0x000001B3
1400#!:mime	video/mpv
1401#0       belong&0xFF5FFF10  0x47400010
1402#!:mime	video/mp2t
1403#0       belong             0x00000001
1404#>4      byte&0x1F	   0x07
1405#!:mime	video/h264
1406
1407# Type: Bink Video
1408# Extension: .bik
1409# URL:  http://wiki.multimedia.cx/index.php?title=Bink_Container
1410# From: <hoehle@users.sourceforge.net>  2008-07-18
14110	string		BIK	Bink Video
1412>3	regex		=[a-z]	rev.%s
1413#>4	ulelong		x	size %d
1414>20	ulelong		x	\b, %d
1415>24	ulelong		x	\bx%d
1416>8	ulelong		x	\b, %d frames
1417>32	ulelong		x	at rate %d/
1418>28	ulelong		>1	\b%d
1419>40	ulelong		=0	\b, no audio
1420>40	ulelong		!0	\b, %d audio track
1421>>40	ulelong		!1	\bs
1422# follow properties of the first audio track only
1423>>48	uleshort	x	%dHz
1424>>51	byte&0x20	0	mono
1425>>51	byte&0x20	!0	stereo
1426#>>51	byte&0x10	0	FFT
1427#>>51	byte&0x10	!0	DCT
1428
1429# Type:	NUT Container
1430# URL:	http://wiki.multimedia.cx/index.php?title=NUT
1431# From:	Adam Buchbinder <adam.buchbinder@gmail.com>
14320	string	nut/multimedia\ container\0	NUT multimedia container
1433
1434# Type: Nullsoft Video (NSV)
1435# URL:  http://wiki.multimedia.cx/index.php?title=Nullsoft_Video
1436# From: Mike Melanson <mike@multimedia.cx>
14370	string	NSVf	Nullsoft Video
1438
1439# Type: REDCode Video
1440# URL:  http://www.red.com/ ; http://wiki.multimedia.cx/index.php?title=REDCode
1441# From: Mike Melanson <mike@multimedia.cx>
14424	string	RED1	REDCode Video
1443
1444# Type: MTV Multimedia File
1445# URL:  http://wiki.multimedia.cx/index.php?title=MTV
1446# From: Mike Melanson <mike@multimedia.cx>
14470	string	AMVS	MTV Multimedia File
1448
1449# Type: ARMovie
1450# URL:  http://wiki.multimedia.cx/index.php?title=ARMovie
1451# From: Mike Melanson <mike@multimedia.cx>
14520	string	ARMovie\012	ARMovie
1453
1454# Type: Interplay MVE Movie
1455# URL:  http://wiki.multimedia.cx/index.php?title=Interplay_MVE
1456# From: Mike Melanson <mike@multimedia.cx>
14570	string	Interplay\040MVE\040File\032	Interplay MVE Movie
1458
1459# Type: Windows Television DVR File
1460# URL:  http://wiki.multimedia.cx/index.php?title=WTV
1461# From: Mike Melanson <mike@mutlimedia.cx>
1462# This takes the form of a Windows-style GUID
14630	bequad	0xB7D800203749DA11
1464>8	bequad	0xA64E0007E95EAD8D	Windows Television DVR Media
1465
1466# Type: Sega FILM/CPK Multimedia
1467# URL:  http://wiki.multimedia.cx/index.php?title=Sega_FILM
1468# From: Mike Melanson <mike@multimedia.cx>
14690	string	FILM	Sega FILM/CPK Multimedia,
1470>32	belong	x	%d x
1471>28	belong	x	%d
1472
1473# Type: Nintendo THP Multimedia
1474# URL:  http://wiki.multimedia.cx/index.php?title=THP
1475# From: Mike Melanson <mike@multimedia.cx>
14760	string	THP\0	Nintendo THP Multimedia
1477
1478# Type: BBC Dirac Video
1479# URL:  http://wiki.multimedia.cx/index.php?title=Dirac
1480# From: Mike Melanson <mike@multimedia.cx>
14810	string	BBCD	BBC Dirac Video
1482
1483# Type: RAD Game Tools Smacker Multimedia
1484# URL:  http://wiki.multimedia.cx/index.php?title=Smacker
1485# From: Mike Melanson <mike@multimedia.cx>
14860	string	SMK	RAD Game Tools Smacker Multimedia
1487>3	byte	x	version %c,
1488>4	lelong	x	%d x
1489>8	lelong	x	%d,
1490>12	lelong	x	%d frames
1491
1492#------------------------------------------------------------------------------
1493# $File$
1494# aout:  file(1) magic for a.out executable/object/etc entries that
1495# handle executables on multiple platforms.
1496#
1497
1498#
1499# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from
1500# BSDI), netbsd, and vax (for UNIX/32V and BSD)
1501#
1502# XXX - is there anything we can look at to distinguish BSD/OS 386 from
1503# NetBSD 386 from various VAX binaries?  The BSD/OS shared library flag
1504# works only for binaries using shared libraries.  Grabbing the entry
1505# point from the a.out header, using it to find the first code executed
1506# in the program, and looking at that might help.
1507#
15080	lelong		0407		a.out little-endian 32-bit executable
1509>16	lelong		>0		not stripped
1510>32	byte		0x6a		(uses BSD/OS shared libs)
1511
15120	lelong		0410		a.out little-endian 32-bit pure executable
1513>16	lelong		>0		not stripped
1514>32	byte		0x6a		(uses BSD/OS shared libs)
1515
15160	lelong		0413		a.out little-endian 32-bit demand paged pure executable
1517>16	lelong		>0		not stripped
1518>32	byte		0x6a		(uses BSD/OS shared libs)
1519
1520#
1521# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out),
1522# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out).
1523#
1524# XXX - is there anything we can look at to distinguish old SunOS 68010
1525# from old 68020 IRIX from old NetBSD?  Again, I guess we could look at
1526# the first instruction or instructions in the program.
1527#
15280	belong		0407		a.out big-endian 32-bit executable
1529>16	belong		>0		not stripped
1530
15310	belong		0410		a.out big-endian 32-bit pure executable
1532>16	belong		>0		not stripped
1533
15340	belong		0413		a.out big-endian 32-bit demand paged executable
1535>16	belong		>0		not stripped
1536
1537
1538#------------------------------------------------------------------------------
1539# $File$
1540# apl:  file(1) magic for APL (see also "pdp" and "vax" for other APL
1541#       workspaces)
1542#
15430	long		0100554		APL workspace (Ken's original?)
1544
1545#------------------------------------------------------------------------------
1546# $File: apple,v 1.28 2014/04/28 12:04:50 christos Exp $
1547# apple:  file(1) magic for Apple file formats
1548#
15490	search/1/t	FiLeStArTfIlEsTaRt	binscii (apple ][) text
15500	string		\x0aGL			Binary II (apple ][) data
15510	string		\x76\xff		Squeezed (apple ][) data
15520	string		NuFile			NuFile archive (apple ][) data
15530	string		N\xf5F\xe9l\xe5		NuFile archive (apple ][) data
15540	belong		0x00051600		AppleSingle encoded Macintosh file
15550	belong		0x00051607		AppleDouble encoded Macintosh file
1556
1557# Type: Apple Emulator 2IMG format
1558# From: Radek Vokal <rvokal@redhat.com>
15590	string		2IMG	Apple ][ 2IMG Disk Image
1560>4	string		XGS!	\b, XGS
1561>4	string		CTKG	\b, Catakig
1562>4	string		ShIm	\b, Sheppy's ImageMaker
1563>4	string		WOOF	\b, Sweet 16
1564>4	string		B2TR	\b, Bernie ][ the Rescue
1565>4	string		!nfc	\b, ASIMOV2
1566>4	string		x	\b, Unknown Format
1567>0xc	byte		00	\b, DOS 3.3 sector order
1568>>0x10	byte		00	\b, Volume 254
1569>>0x10	byte&0x7f	x	\b, Volume %u
1570>0xc	byte		01	\b, ProDOS sector order
1571>>0x14	short		x	\b, %u Blocks
1572>0xc	byte		02	\b, NIB data
1573
1574# magic for Newton PDA package formats
1575# from Ruda Moura <ruda@helllabs.org>
15760	string	package0	Newton package, NOS 1.x,
1577>12	belong	&0x80000000	AutoRemove,
1578>12	belong	&0x40000000	CopyProtect,
1579>12	belong	&0x10000000	NoCompression,
1580>12	belong	&0x04000000	Relocation,
1581>12	belong	&0x02000000	UseFasterCompression,
1582>16	belong	x		version %d
1583
15840	string	package1	Newton package, NOS 2.x,
1585>12	belong	&0x80000000	AutoRemove,
1586>12	belong	&0x40000000	CopyProtect,
1587>12	belong	&0x10000000	NoCompression,
1588>12	belong	&0x04000000	Relocation,
1589>12	belong	&0x02000000	UseFasterCompression,
1590>16	belong	x		version %d
1591
15920	string	package4	Newton package,
1593>8	byte	8		NOS 1.x,
1594>8	byte	9		NOS 2.x,
1595>12	belong	&0x80000000	AutoRemove,
1596>12	belong	&0x40000000	CopyProtect,
1597>12	belong	&0x10000000	NoCompression,
1598
1599# The following entries for the Apple II are for files that have
1600# been transferred as raw binary data from an Apple, without having
1601# been encapsulated by any of the above archivers.
1602#
1603# In general, Apple II formats are hard to identify because Apple DOS
1604# and especially Apple ProDOS have strong typing in the file system and
1605# therefore programmers never felt much need to include type information
1606# in the files themselves.
1607#
1608# Eric Fischer <enf@pobox.com>
1609
1610# AppleWorks word processor:
1611#
1612# This matches the standard tab stops for an AppleWorks file, but if
1613# a file has a tab stop set in the first four columns this will fail.
1614#
1615# The "O" is really the magic number, but that's so common that it's
1616# necessary to check the tab stops that follow it to avoid false positives.
1617
16184       string          O====   AppleWorks word processor data
1619>85     byte&0x01       >0      \b, zoomed
1620>90     byte&0x01       >0      \b, paginated
1621>92     byte&0x01       >0      \b, with mail merge
1622#>91    byte            x       \b, left margin %d
1623
1624# AppleWorks database:
1625#
1626# This isn't really a magic number, but it's the closest thing to one
1627# that I could find.  The 1 and 2 really mean "order in which you defined
1628# categories" and "left to right, top to bottom," respectively; the D and R
1629# mean that the cursor should move either down or right when you press Return.
1630
1631#30	string		\x01D	AppleWorks database data
1632#30	string		\x02D	AppleWorks database data
1633#30	string		\x01R	AppleWorks database data
1634#30	string		\x02R	AppleWorks database data
1635
1636# AppleWorks spreadsheet:
1637#
1638# Likewise, this isn't really meant as a magic number.  The R or C means
1639# row- or column-order recalculation; the A or M means automatic or manual
1640# recalculation.
1641
1642#131	string		RA	AppleWorks spreadsheet data
1643#131	string		RM	AppleWorks spreadsheet data
1644#131	string		CA	AppleWorks spreadsheet data
1645#131	string		CM	AppleWorks spreadsheet data
1646
1647# Applesoft BASIC:
1648#
1649# This is incredibly sloppy, but will be true if the program was
1650# written at its usual memory location of 2048 and its first line
1651# number is less than 256.  Yuck.
1652# update by Joerg Jenderek at Feb 2013
1653
1654# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
1655#0       belong&0xff00ff 0x80000 Applesoft BASIC program data
16560	belong&0x00ff00ff	0x00080000
1657# assuming that line number must be positive
1658>2	leshort			>0		Applesoft BASIC program data, first line number %d
1659#>2     leshort         x       \b, first line number %d
1660
1661# ORCA/EZ assembler:
1662#
1663# This will not identify ORCA/M source files, since those have
1664# some sort of date code instead of the two zero bytes at 6 and 7
1665# XXX Conflicts with ELF
1666#4       belong&0xff00ffff       0x01000000      ORCA/EZ assembler source data
1667#>5      byte                    x               \b, build number %d
1668
1669# Broderbund Fantavision
1670#
1671# I don't know what these values really mean, but they seem to recur.
1672# Will they cause too many conflicts?
1673
1674# Probably :-)
1675#2	belong&0xFF00FF		0x040008	Fantavision movie data
1676
1677# Some attempts at images.
1678#
1679# These are actually just bit-for-bit dumps of the frame buffer, so
1680# there's really no reasonably way to distinguish them except for their
1681# address (if preserved) -- 8192 or 16384 -- and their length -- 8192
1682# or, occasionally, 8184.
1683#
1684# Nevertheless this will manage to catch a lot of images that happen
1685# to have a solid-colored line at the bottom of the screen.
1686
1687# GRR: Magic too weak
1688#8144	string	\x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F	Apple II image with white background
1689#8144	string	\x55\x2A\x55\x2A\x55\x2A\x55\x2A	Apple II image with purple background
1690#8144	string	\x2A\x55\x2A\x55\x2A\x55\x2A\x55	Apple II image with green background
1691#8144	string	\xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA	Apple II image with blue background
1692#8144	string	\xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5	Apple II image with orange background
1693
1694# Beagle Bros. Apple Mechanic fonts
1695
16960	belong&0xFF00FFFF	0x6400D000	Apple Mechanic font
1697
1698# Apple Universal Disk Image Format (UDIF) - dmg files.
1699# From Johan Gade.
1700# These entries are disabled for now until we fix the following issues.
1701#
1702# Note there might be some problems with the "VAX COFF executable"
1703# entry. Note this entry should be placed before the mac filesystem section,
1704# particularly the "Apple Partition data" entry.
1705#
1706# The intended meaning of these tests is, that the file is only of the
1707# specified type if both of the lines are correct - i.e. if the first
1708# line matches and the second doesn't then it is not of that type.
1709#
1710#0	long	0x7801730d
1711#>4	long	0x62626060	UDIF read-only zlib-compressed image (UDZO)
1712#
1713# Note that this entry is recognized correctly by the "Apple Partition
1714# data" entry - however since this entry is more specific - this
1715# information seems to be more useful.
1716#0	long	0x45520200
1717#>0x410	string	disk\ image	UDIF read/write image (UDRW)
1718
1719# From: Toby Peterson <toby@apple.com>
17200	string	bplist00	Apple binary property list
1721
1722# Apple binary property list (bplist)
1723#  Assumes version bytes are hex.
1724#  Provides content hints for version 0 files. Assumes that the root
1725#  object is the first object (true for CoreFoundation implementation).
1726# From: David Remahl <dremahl@apple.com>
17270		string	bplist
1728>6		byte	x	\bCoreFoundation binary property list data, version 0x%c
1729>>7		byte	x	\b%c
1730>6		string		00		\b
1731>>8		byte&0xF0	0x00	\b
1732>>>8	byte&0x0F	0x00	\b, root type: null
1733>>>8	byte&0x0F	0x08	\b, root type: false boolean
1734>>>8	byte&0x0F	0x09	\b, root type: true boolean
1735>>8		byte&0xF0	0x10	\b, root type: integer
1736>>8		byte&0xF0	0x20	\b, root type: real
1737>>8		byte&0xF0	0x30	\b, root type: date
1738>>8		byte&0xF0	0x40    \b, root type: data
1739>>8		byte&0xF0	0x50	\b, root type: ascii string
1740>>8		byte&0xF0	0x60	\b, root type: unicode string
1741>>8		byte&0xF0	0x80	\b, root type: uid (CORRUPT)
1742>>8		byte&0xF0	0xa0	\b, root type: array
1743>>8		byte&0xF0	0xd0	\b, root type: dictionary
1744
1745# Apple/NeXT typedstream data
1746#  Serialization format used by NeXT and Apple for various
1747#  purposes in YellowStep/Cocoa, including some nib files.
1748# From: David Remahl <dremahl@apple.com>
17492		string		typedstream	NeXT/Apple typedstream data, big endian
1750>0		byte		x		\b, version %d
1751>0		byte		<5		\b
1752>>13	byte		0x81	\b
1753>>>14	ubeshort	x		\b, system %d
17542		string		streamtyped NeXT/Apple typedstream data, little endian
1755>0		byte		x		\b, version %d
1756>0		byte		<5		\b
1757>>13	byte		0x81	\b
1758>>>14	uleshort	x		\b, system %d
1759
1760#------------------------------------------------------------------------------
1761# CAF: Apple CoreAudio File Format
1762#
1763# Container format for high-end audio purposes.
1764# From: David Remahl <dremahl@apple.com>
1765#
17660	string		caff		CoreAudio Format audio file
1767>4	beshort		<10		version %d
1768>6	beshort		x
1769
1770
1771#------------------------------------------------------------------------------
1772# Keychain database files
17730	string		kych		Mac OS X Keychain File
1774
1775#------------------------------------------------------------------------------
1776# Code Signing related file types
17770	belong		0xfade0c00	Mac OS X Code Requirement
1778>8	belong		1			(opExpr)
1779>4	belong		x			- %d bytes
1780
17810	belong		0xfade0c01	Mac OS X Code Requirement Set
1782>8	belong		>1			containing %d items
1783>4	belong		x			- %d bytes
1784
17850	belong		0xfade0c02	Mac OS X Code Directory
1786>8	belong		x			version %x
1787>12	belong		>0			flags 0x%x
1788>4	belong		x			- %d bytes
1789
17900	belong		0xfade0cc0	Mac OS X Detached Code Signature (non-executable)
1791>4	belong		x			- %d bytes
1792
17930	belong		0xfade0cc1	Mac OS X Detached Code Signature
1794>8	belong		>1			(%d elements)
1795>4	belong		x			- %d bytes
1796
1797# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
1798# .vdi
17994	string innotek\ VirtualBox\ Disk\ Image %s
1800
1801# Apple disk partition stuff, strengthen the magic using byte 4
18020	beshort	0x4552
1803>4	byte	0			Apple Driver Map
1804>>2	beshort	x			\b, blocksize %d
1805>>4	belong	x			\b, blockcount %d
1806>>10	beshort	x			\b, devtype %d
1807>>12	beshort	x			\b, devid %d
1808>>20	beshort x			\b, descriptors %d
1809# Assume 	8 partitions each at a multiple of the sector size.
1810# We could glean this from the partition descriptors, but they are empty!?!?
1811>>(2.S*1)	indirect		\b, contains[@0x%x]:
1812>>(2.S*2)	indirect		\b, contains[@0x%x]:
1813>>(2.S*3)	indirect		\b, contains[@0x%x]:
1814>>(2.S*4)	indirect		\b, contains[@0x%x]:
1815>>(2.S*5)	indirect		\b, contains[@0x%x]:
1816>>(2.S*6)	indirect		\b, contains[@0x%x]:
1817>>(2.S*7)	indirect		\b, contains[@0x%x]:
1818>>(2.S*8)	indirect		\b, contains[@0x%x]:
1819
1820# Yes, the 3rd and 4th bytes are reserved, but we use them to make the
1821# magic stronger.
18220	belong	0x504d0000		Apple Partition Map
1823>4	belong	x			\b, map block count %d
1824>8	belong	x			\b, start block %d
1825>12	belong	x			\b, block count %d
1826>16	string >0			\b, name %s
1827>48	string >0			\b, type %s
1828>124	string >0			\b, processor %s
1829>140	string >0			\b, boot arguments %s
1830>92	belong	& 1			\b, valid
1831>92	belong	& 2			\b, allocated
1832>92	belong	& 4			\b, in use
1833>92	belong	& 8			\b, has boot info
1834>92	belong	& 16			\b, readable
1835>92	belong	& 32			\b, writable
1836>92	belong	& 64			\b, pic boot code
1837>92	belong	& 128			\b, chain compatible driver
1838>92	belong	& 256			\b, real driver
1839>92	belong	& 512			\b, chain driver
1840>92	belong	& 1024			\b, mount at startup
1841>92	belong	& 2048			\b, is the startup partition
1842
1843#http://wiki.mozilla.org/DS_Store_File_Format`
1844#http://en.wikipedia.org/wiki/.DS_Store
18450	string	\0\0\0\1Bud1\0		Apple Desktop Services Store
1846
1847#------------------------------------------------------------------------------
1848# $File$
1849# applix:  file(1) magic for Applixware
1850# From: Peter Soos <sp@osb.hu>
1851#
18520	string		*BEGIN		Applixware
1853>7	string		WORDS			Words Document
1854>7	string		GRAPHICS		Graphic
1855>7	string		RASTER			Bitmap
1856>7	string		SPREADSHEETS		Spreadsheet
1857>7	string		MACRO			Macro
1858>7	string		BUILDER			Builder Object
1859#------------------------------------------------------------------------------
1860# $File: archive,v 1.87 2014/06/03 19:15:58 christos Exp $
1861# archive:  file(1) magic for archive formats (see also "msdos" for self-
1862#           extracting compressed archives)
1863#
1864# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
1865# pre-POSIX "tar" archives are handled in the C code.
1866
1867# POSIX tar archives
1868257	string		ustar\0		POSIX tar archive
1869!:mime	application/x-tar # encoding: posix
1870257	string		ustar\040\040\0	GNU tar archive
1871!:mime	application/x-tar # encoding: gnu
1872
1873# Incremental snapshot gnu-tar format from:
1874# http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
18750	string		GNU\ tar-	GNU tar incremental snapshot data
1876>&0	regex		[0-9]\.[0-9]+-[0-9]+	version %s
1877
1878# cpio archives
1879#
1880# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
1881# The idea is to indicate archives produced on machines with the same
1882# byte order as the machine running "file" with "cpio archive", and
1883# to indicate archives produced on machines with the opposite byte order
1884# from the machine running "file" with "byte-swapped cpio archive".
1885#
1886# The SVR4 "cpio(4)" hints that there are additional formats, but they
1887# are defined as "short"s; I think all the new formats are
1888# character-header formats and thus are strings, not numbers.
18890	short		070707		cpio archive
1890!:mime	application/x-cpio
18910	short		0143561		byte-swapped cpio archive
1892!:mime	application/x-cpio # encoding: swapped
18930	string		070707		ASCII cpio archive (pre-SVR4 or odc)
18940	string		070701		ASCII cpio archive (SVR4 with no CRC)
18950	string		070702		ASCII cpio archive (SVR4 with CRC)
1896
1897#
1898# Various archive formats used by various versions of the "ar"
1899# command.
1900#
1901
1902#
1903# Original UNIX archive formats.
1904# They were written with binary values in host byte order, and
1905# the magic number was a host "int", which might have been 16 bits
1906# or 32 bits.  We don't say "PDP-11" or "VAX", as there might have
1907# been ports to little-endian 16-bit-int or 32-bit-int platforms
1908# (x86?) using some of those formats; if none existed, feel free
1909# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian
1910# 32-bit.  There might have been big-endian ports of that sort as
1911# well.
1912#
19130	leshort		0177555		very old 16-bit-int little-endian archive
19140	beshort		0177555		very old 16-bit-int big-endian archive
19150	lelong		0177555		very old 32-bit-int little-endian archive
19160	belong		0177555		very old 32-bit-int big-endian archive
1917
19180	leshort		0177545		old 16-bit-int little-endian archive
1919>2	string		__.SYMDEF	random library
19200	beshort		0177545		old 16-bit-int big-endian archive
1921>2	string		__.SYMDEF	random library
19220	lelong		0177545		old 32-bit-int little-endian archive
1923>4	string		__.SYMDEF	random library
19240	belong		0177545		old 32-bit-int big-endian archive
1925>4	string		__.SYMDEF	random library
1926
1927#
1928# From "pdp" (but why a 4-byte quantity?)
1929#
19300	lelong		0x39bed		PDP-11 old archive
19310	lelong		0x39bee		PDP-11 4.0 archive
1932
1933#
1934# XXX - what flavor of APL used this, and was it a variant of
1935# some ar archive format?  It's similar to, but not the same
1936# as, the APL workspace magic numbers in pdp.
1937#
19380	long		0100554		apl workspace
1939
1940#
1941# System V Release 1 portable(?) archive format.
1942#
19430	string		=<ar>		System V Release 1 ar archive
1944!:mime	application/x-archive
1945
1946#
1947# Debian package; it's in the portable archive format, and needs to go
1948# before the entry for regular portable archives, as it's recognized as
1949# a portable archive whose first member has a name beginning with
1950# "debian".
1951#
19520	string		=!<arch>\ndebian
1953>8	string		debian-split	part of multipart Debian package
1954!:mime	application/vnd.debian.binary-package
1955>8	string		debian-binary	Debian binary package
1956!:mime	application/vnd.debian.binary-package
1957>8	string		!debian
1958>68	string		>\0		(format %s)
1959# These next two lines do not work, because a bzip2 Debian archive
1960# still uses gzip for the control.tar (first in the archive).  Only
1961# data.tar varies, and the location of its filename varies too.
1962# file/libmagic does not current have support for ascii-string based
1963# (offsets) as of 2005-09-15.
1964#>81	string		bz2		\b, uses bzip2 compression
1965#>84	string		gz		\b, uses gzip compression
1966#>136	ledate		x		created: %s
1967
1968#
1969# MIPS archive; they're in the portable archive format, and need to go
1970# before the entry for regular portable archives, as it's recognized as
1971# a portable archive whose first member has a name beginning with
1972# "__________E".
1973#
19740	string	=!<arch>\n__________E	MIPS archive
1975!:mime	application/x-archive
1976>20	string	U			with MIPS Ucode members
1977>21	string	L			with MIPSEL members
1978>21	string	B			with MIPSEB members
1979>19	string	L			and an EL hash table
1980>19	string	B			and an EB hash table
1981>22	string	X			-- out of date
1982
19830	search/1	-h-		Software Tools format archive text
1984
1985#
1986# BSD/SVR2-and-later portable archive formats.
1987#
19880	string		=!<arch>		current ar archive
1989!:mime	application/x-archive
1990>8	string		__.SYMDEF	random library
1991>68	string		__.SYMDEF\ SORTED	random library
1992
1993#
1994# "Thin" archive, as can be produced by GNU ar.
1995#
19960	string		=!<thin>\n	thin archive with
1997>68	belong		0		no symbol entries
1998>68	belong		1		%d symbol entry
1999>68	belong		>1		%d symbol entries
2000
2001# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
2002#
2003# The first byte is the magic (0x1a), byte 2 is the compression type for
2004# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
2005# filename of the first file (null terminated).  Since some types collide
2006# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
2007# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%).  0x01 collides with terminfo.
20080	lelong&0x8080ffff	0x0000081a	ARC archive data, dynamic LZW
2009!:mime	application/x-arc
20100	lelong&0x8080ffff	0x0000091a	ARC archive data, squashed
2011!:mime	application/x-arc
20120	lelong&0x8080ffff	0x0000021a	ARC archive data, uncompressed
2013!:mime	application/x-arc
20140	lelong&0x8080ffff	0x0000031a	ARC archive data, packed
2015!:mime	application/x-arc
20160	lelong&0x8080ffff	0x0000041a	ARC archive data, squeezed
2017!:mime	application/x-arc
20180	lelong&0x8080ffff	0x0000061a	ARC archive data, crunched
2019!:mime	application/x-arc
2020# [JW] stuff taken from idarc, obviously ARC successors:
20210	lelong&0x8080ffff	0x00000a1a	PAK archive data
2022!:mime	application/x-arc
20230	lelong&0x8080ffff	0x0000141a	ARC+ archive data
2024!:mime	application/x-arc
20250	lelong&0x8080ffff	0x0000481a	HYP archive data
2026!:mime	application/x-arc
2027
2028# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
2029# I can't create either SPARK or ArcFS archives so I have not tested this stuff
2030# [GRR:  the original entries collide with ARC, above; replaced with combined
2031#  version (not tested)]
2032#0	byte		0x1a		RISC OS archive (spark format)
20330	string		\032archive	RISC OS archive (ArcFS format)
20340       string          Archive\000     RISC OS archive (ArcFS format)
2035
2036# All these were taken from idarc, many could not be verified. Unfortunately,
2037# there were many low-quality sigs, i.e. easy to trigger false positives.
2038# Please notify me of any real-world fishy/ambiguous signatures and I'll try
2039# to get my hands on the actual archiver and see if I find something better. [JW]
2040# probably many can be enhanced by finding some 0-byte or control char near the start
2041
2042# idarc calls this Crush/Uncompressed... *shrug*
20430	string	CRUSH Crush archive data
2044# Squeeze It (.sqz)
20450	string	HLSQZ Squeeze It archive data
2046# SQWEZ
20470	string	SQWEZ SQWEZ archive data
2048# HPack (.hpk)
20490	string	HPAK HPack archive data
2050# HAP
20510	string	\x91\x33HF HAP archive data
2052# MD/MDCD
20530	string	MDmd MDCD archive data
2054# LIM
20550	string	LIM\x1a LIM archive data
2056# SAR
20573	string	LH5 SAR archive data
2058# BSArc/BS2
20590	string	\212\3SB\020\0	BSArc/BS2 archive data
2060# Bethesda Softworks Archive (Oblivion)
20610	string	BSA\0 		BSArc archive data
2062>4	lelong	x		version %d
2063# MAR
20642	string	=-ah MAR archive data
2065# ACB
2066#0	belong&0x00f800ff	0x00800000 ACB archive data
2067# CPZ
2068# TODO, this is what idarc says: 0	string	\0\0\0 CPZ archive data
2069# JRC
20700	string	JRchive JRC archive data
2071# Quantum
20720	string	DS\0 Quantum archive data
2073# ReSOF
20740	string	PK\3\6 ReSOF archive data
2075# QuArk
20760	string	7\4 QuArk archive data
2077# YAC
207814	string	YC YAC archive data
2079# X1
20800	string	X1 X1 archive data
20810	string	XhDr X1 archive data
2082# CDC Codec (.dqt)
20830	belong&0xffffe000	0x76ff2000 CDC Codec archive data
2084# AMGC
20850	string	\xad6" AMGC archive data
2086# NuLIB
20870	string	N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data
2088# PakLeo
20890	string	LEOLZW PAKLeo archive data
2090# ChArc
20910	string	SChF ChArc archive data
2092# PSA
20930	string	PSA PSA archive data
2094# CrossePAC
20950	string	DSIGDCC CrossePAC archive data
2096# Freeze
20970	string	\x1f\x9f\x4a\x10\x0a Freeze archive data
2098# KBoom
20990	string	\xc2\xa8MP\xc2\xa8 KBoom archive data
2100# NSQ, must go after CDC Codec
21010	string	\x76\xff NSQ archive data
2102# DPA
21030	string	Dirk\ Paehl DPA archive data
2104# BA
2105# TODO: idarc says "bytes 0-2 == bytes 3-5"
2106# TTComp
21070	string	\0\6 TTComp archive data
2108# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
21090	string	ESP ESP archive data
2110# ZPack
21110	string	\1ZPK\1 ZPack archive data
2112# Sky
21130	string	\xbc\x40 Sky archive data
2114# UFA
21150	string	UFA UFA archive data
2116# Dry
21170	string	=-H2O DRY archive data
2118# FoxSQZ
21190	string	FOXSQZ FoxSQZ archive data
2120# AR7
21210	string	,AR7 AR7 archive data
2122# PPMZ
21230	string	PPMZ PPMZ archive data
2124# MS Compress
21254	string	\x88\xf0\x27 MS Compress archive data
2126# updated by Joerg Jenderek
2127>9	string	\0
2128>>0	string	KWAJ
2129>>>7	string	\321\003	MS Compress archive data
2130>>>>14	ulong	>0		\b, original size: %d bytes
2131>>>>18		ubyte	>0x65
2132>>>>>18		string	x       \b, was %.8s
2133>>>>>(10.b-4)	string	x       \b.%.3s
2134# MP3 (archiver, not lossy audio compression)
21350	string	MP3\x1a MP3-Archiver archive data
2136# ZET
21370	string	OZ\xc3\x9d ZET archive data
2138# TSComp
21390	string	\x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
2140# ARQ
21410	string	gW\4\1 ARQ archive data
2142# Squash
21433	string	OctSqu Squash archive data
2144# Terse
21450	string	\5\1\1\0 Terse archive data
2146# PUCrunch
21470	string	\x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
2148# UHarc
21490	string	UHA UHarc archive data
2150# ABComp
21510	string	\2AB ABComp archive data
21520	string	\3AB2 ABComp archive data
2153# CMP
21540	string	CO\0 CMP archive data
2155# Splint
21560	string	\x93\xb9\x06 Splint archive data
2157# InstallShield
21580	string	\x13\x5d\x65\x8c InstallShield Z archive Data
2159# Gather
21601	string	GTH Gather archive data
2161# BOA
21620	string	BOA BOA archive data
2163# RAX
21640	string	ULEB\xa RAX archive data
2165# Xtreme
21660	string	ULEB\0 Xtreme archive data
2167# Pack Magic
21680	string	@\xc3\xa2\1\0 Pack Magic archive data
2169# BTS
21700	belong&0xfeffffff	0x1a034465 BTS archive data
2171# ELI 5750
21720	string	Ora\  ELI 5750 archive data
2173# QFC
21740	string	\x1aFC\x1a QFC archive data
21750	string	\x1aQF\x1a QFC archive data
2176# PRO-PACK
21770	string	RNC PRO-PACK archive data
2178# 777
21790	string	777 777 archive data
2180# LZS221
21810	string	sTaC LZS221 archive data
2182# HPA
21830	string	HPA HPA archive data
2184# Arhangel
21850	string	LG Arhangel archive data
2186# EXP1, uses bzip2
21870	string	0123456789012345BZh EXP1 archive data
2188# IMP
21890	string	IMP\xa IMP archive data
2190# NRV
21910	string	\x00\x9E\x6E\x72\x76\xFF NRV archive data
2192# Squish
21930	string	\x73\xb2\x90\xf4 Squish archive data
2194# Par
21950	string	PHILIPP Par archive data
21960	string	PAR Par archive data
2197# HIT
21980	string	UB HIT archive data
2199# SBX
22000	belong&0xfffff000	0x53423000 SBX archive data
2201# NaShrink
22020	string	NSK NaShrink archive data
2203# SAPCAR
22040	string	#\ CAR\ archive\ header SAPCAR archive data
22050	string	CAR\ 2.00RG SAPCAR archive data
2206# Disintegrator
22070	string	DST Disintegrator archive data
2208# ASD
22090	string	ASD ASD archive data
2210# InstallShield CAB
22110	string	ISc( InstallShield CAB
2212# TOP4
22130	string	T4\x1a TOP4 archive data
2214# BatComp left out: sig looks like COM executable
2215# so TODO: get real 4dos batcomp file and find sig
2216# BlakHole
22170	string	BH\5\7 BlakHole archive data
2218# BIX
22190	string	BIX0 BIX archive data
2220# ChiefLZA
22210	string	ChfLZ ChiefLZA archive data
2222# Blink
22230	string	Blink Blink archive data
2224# Logitech Compress
22250	string	\xda\xfa Logitech Compress archive data
2226# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
22271	string	(C)\ STEPANYUK ARS-Sfx archive data
2228# AKT/AKT32
22290	string	AKT32 AKT32 archive data
22300	string	AKT AKT archive data
2231# NPack
22320	string	MSTSM NPack archive data
2233# PFT
22340	string	\0\x50\0\x14 PFT archive data
2235# SemOne
22360	string	SEM SemOne archive data
2237# PPMD
22380	string	\x8f\xaf\xac\x84 PPMD archive data
2239# FIZ
22400	string	FIZ FIZ archive data
2241# MSXiE
22420	belong&0xfffff0f0	0x4d530000 MSXiE archive data
2243# DeepFreezer
22440	belong&0xfffffff0	0x797a3030 DeepFreezer archive data
2245# DC
22460	string	=<DC- DC archive data
2247# TPac
22480	string	\4TPAC\3 TPac archive data
2249# Ai
22500	string	Ai\1\1\0 Ai archive data
22510	string	Ai\1\0\0 Ai archive data
2252# Ai32
22530	string	Ai\2\0 Ai32 archive data
22540	string	Ai\2\1 Ai32 archive data
2255# SBC
22560	string	SBC SBC archive data
2257# Ybs
22580	string	YBS Ybs archive data
2259# DitPack
22600	string	\x9e\0\0 DitPack archive data
2261# DMS
22620	string	DMS! DMS archive data
2263# EPC
22640	string	\x8f\xaf\xac\x8c EPC archive data
2265# VSARC
22660	string	VS\x1a VSARC archive data
2267# PDZ
22680	string	PDZ PDZ archive data
2269# ReDuq
22700	string	rdqx ReDuq archive data
2271# GCA
22720	string	GCAX GCA archive data
2273# PPMN
22740	string	pN PPMN archive data
2275# WinImage
22763	string	WINIMAGE WinImage archive data
2277# Compressia
22780	string	CMP0CMP Compressia archive data
2279# UHBC
22800	string	UHB UHBC archive data
2281# WinHKI
22820	string	\x61\x5C\x04\x05 WinHKI archive data
2283# WWPack data file
22840	string	WWP WWPack archive data
2285# BSN (BSA, PTS-DOS)
22860	string	\xffBSG BSN archive data
22871	string	\xffBSG BSN archive data
22883	string	\xffBSG BSN archive data
22891	string	\0\xae\2 BSN archive data
22901	string	\0\xae\3 BSN archive data
22911	string	\0\xae\7 BSN archive data
2292# AIN
22930	string	\x33\x18 AIN archive data
22940	string	\x33\x17 AIN archive data
2295# XPA32
22960	string	xpa\0\1 XPA32 archive data
2297# SZip (TODO: doesn't catch all versions)
22980	string	SZ\x0a\4 SZip archive data
2299# XPack DiskImage
23000	string	jm XPack DiskImage archive data
2301# XPack Data
23020	string	xpa XPack archive data
2303# XPack Single Data
23040	string	\xc3\x8d\ jm XPack single archive data
2305
2306# TODO: missing due to unknown magic/magic at end of file:
2307#DWC
2308#ARG
2309#ZAR
2310#PC/3270
2311#InstallIt
2312#RKive
2313#RK
2314#XPack Diskimage
2315
2316# These were inspired by idarc, but actually verified
2317# Dzip archiver (.dz)
23180	string	DZ Dzip archive data
2319>2	byte	x \b, version %i
2320>3	byte	x \b.%i
2321# ZZip archiver (.zz)
23220	string	ZZ\ \0\0 ZZip archive data
23230	string	ZZ0 ZZip archive data
2324# PAQ archiver (.paq)
23250	string	\xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
23260	string	PAQ PAQ archive data
2327>3	byte&0xf0	0x30
2328>>3	byte	x (v%c)
2329# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
23300xe	string	\x1aJar\x1b JAR (ARJ Software, Inc.) archive data
23310	string	JARCS JAR (ARJ Software, Inc.) archive data
2332
2333# ARJ archiver (jason@jarthur.Claremont.EDU)
23340	leshort		0xea60		ARJ archive data
2335!:mime	application/x-arj
2336>5	byte		x		\b, v%d,
2337>8	byte		&0x04		multi-volume,
2338>8	byte		&0x10		slash-switched,
2339>8	byte		&0x20		backup,
2340>34	string		x		original name: %s,
2341>7	byte		0		os: MS-DOS
2342>7	byte		1		os: PRIMOS
2343>7	byte		2		os: Unix
2344>7	byte		3		os: Amiga
2345>7	byte		4		os: Macintosh
2346>7	byte		5		os: OS/2
2347>7	byte		6		os: Apple ][ GS
2348>7	byte		7		os: Atari ST
2349>7	byte		8		os: NeXT
2350>7	byte		9		os: VAX/VMS
2351>3	byte		>0		%d]
2352# [JW] idarc says this is also possible
23532	leshort		0xea60		ARJ archive data
2354
2355# HA archiver (Greg Roelofs, newt@uchicago.edu)
2356# This is a really bad format. A file containing HAWAII will match this...
2357#0	string		HA		HA archive data,
2358#>2	leshort		=1		1 file,
2359#>2	leshort		>1		%hu files,
2360#>4	byte&0x0f	=0		first is type CPY
2361#>4	byte&0x0f	=1		first is type ASC
2362#>4	byte&0x0f	=2		first is type HSC
2363#>4	byte&0x0f	=0x0e		first is type DIR
2364#>4	byte&0x0f	=0x0f		first is type SPECIAL
2365# suggestion: at least identify small archives (<1024 files)
23660  belong&0xffff00fc 0x48410000 HA archive data
2367>2	leshort		=1		1 file,
2368>2	leshort		>1		%u files,
2369>4	byte&0x0f	=0		first is type CPY
2370>4	byte&0x0f	=1		first is type ASC
2371>4	byte&0x0f	=2		first is type HSC
2372>4	byte&0x0f	=0x0e		first is type DIR
2373>4	byte&0x0f	=0x0f		first is type SPECIAL
2374
2375# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
23760	string		HPAK		HPACK archive data
2377
2378# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
23790	string		\351,\001JAM\ 		JAM archive,
2380>7	string		>\0			version %.4s
2381>0x26	byte		=0x27			-
2382>>0x2b	string          >\0			label %.11s,
2383>>0x27	lelong		x			serial %08x,
2384>>0x36	string		>\0			fstype %.8s
2385
2386# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
23872	string		-lh0-		LHarc 1.x/ARX archive data [lh0]
2388!:mime	application/x-lharc
23892	string		-lh1-		LHarc 1.x/ARX archive data [lh1]
2390!:mime	application/x-lharc
23912	string		-lz4-		LHarc 1.x archive data [lz4]
2392!:mime	application/x-lharc
23932	string		-lz5-		LHarc 1.x archive data [lz5]
2394!:mime	application/x-lharc
2395#	[never seen any but the last; -lh4- reported in comp.compression:]
23962	string		-lzs-		LHa/LZS archive data [lzs]
2397!:mime	application/x-lha
23982	string		-lh\40-		LHa 2.x? archive data [lh ]
2399!:mime	application/x-lha
24002	string		-lhd-		LHa 2.x? archive data [lhd]
2401!:mime	application/x-lha
24022	string		-lh2-		LHa 2.x? archive data [lh2]
2403!:mime	application/x-lha
24042	string		-lh3-		LHa 2.x? archive data [lh3]
2405!:mime	application/x-lha
24062	string		-lh4-		LHa (2.x) archive data [lh4]
2407!:mime	application/x-lha
24082	string		-lh5-		LHa (2.x) archive data [lh5]
2409!:mime	application/x-lha
24102	string		-lh6-		LHa (2.x) archive data [lh6]
2411!:mime	application/x-lha
24122	string		-lh7-		LHa (2.x)/LHark archive data [lh7]
2413!:mime	application/x-lha
2414>20	byte		x		- header level %d
2415# taken from idarc [JW]
24162   string      -lZ         PUT archive data
24172   string      -lz         LZS archive data
24182   string      -sw1-       Swag archive data
2419
2420# RAR archiver (Greg Roelofs, newt@uchicago.edu)
24210	string		Rar!		RAR archive data,
2422!:mime	application/x-rar
2423>44	byte		x		v%0x,
2424>10	byte		>0		flags:
2425>>10	byte		&0x01		Archive volume,
2426>>10	byte		&0x02		Commented,
2427>>10	byte		&0x04		Locked,
2428>>10	byte		&0x08		Solid,
2429>>10	byte		&0x20		Authenticated,
2430>35	byte		0		os: MS-DOS
2431>35	byte		1		os: OS/2
2432>35	byte		2		os: Win32
2433>35	byte		3		os: Unix
2434# some old version? idarc says:
24350   string      RE\x7e\x5e  RAR archive data
2436
2437# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
24380	string		SQSH		squished archive data (Acorn RISCOS)
2439
2440# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
2441# [JW] see exe section for self-extracting version
24420	string		UC2\x1a		UC2 archive data
2443
2444# PKZIP multi-volume archive
24450	string		PK\x07\x08PK\x03\x04	Zip multi-volume archive data, at least PKZIP v2.50 to extract
2446!:mime	application/zip
2447
2448# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
24490	string		PK\005\006	Zip archive data (empty)
24500	string		PK\003\004
2451
2452# Specialised zip formats which start with a member named 'mimetype'
2453# (stored uncompressed, with no 'extra field') containing the file's MIME type.
2454# Check for have 8-byte name, 0-byte extra field, name "mimetype", and
2455#  contents starting with "application/":
2456>26	string		\x8\0\0\0mimetypeapplication/
2457
2458#  KOffice / OpenOffice & StarOffice / OpenDocument formats
2459#    From: Abel Cheung <abel@oaka.org>
2460
2461#   KOffice (1.2 or above) formats
2462#    (mimetype contains "application/vnd.kde.<SUBTYPE>")
2463>>50	string	vnd.kde.		KOffice (>=1.2)
2464>>>58	string	karbon			Karbon document
2465>>>58	string	kchart			KChart document
2466>>>58	string	kformula		KFormula document
2467>>>58	string	kivio			Kivio document
2468>>>58	string	kontour			Kontour document
2469>>>58	string	kpresenter		KPresenter document
2470>>>58	string	kspread			KSpread document
2471>>>58	string	kword			KWord document
2472
2473#   OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
2474#    (mimetype contains "application/vnd.sun.xml.<SUBTYPE>")
2475>>50	string	vnd.sun.xml.		OpenOffice.org 1.x
2476>>>62	string	writer			Writer
2477>>>>68	byte	!0x2e			document
2478>>>>68	string	.template		template
2479>>>>68	string	.global			global document
2480>>>62	string	calc			Calc
2481>>>>66	byte	!0x2e			spreadsheet
2482>>>>66	string	.template		template
2483>>>62	string	draw			Draw
2484>>>>66	byte	!0x2e			document
2485>>>>66	string	.template		template
2486>>>62	string	impress			Impress
2487>>>>69	byte	!0x2e			presentation
2488>>>>69	string	.template		template
2489>>>62	string	math			Math document
2490>>>62	string	base			Database file
2491
2492#   OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
2493#    http://lists.oasis-open.org/archives/office/200505/msg00006.html
2494#    (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>")
2495>>50	string	vnd.oasis.opendocument.	OpenDocument
2496>>>73	string	text
2497>>>>77	byte	!0x2d			Text
2498!:mime	application/vnd.oasis.opendocument.text
2499>>>>77	string	-template		Text Template
2500!:mime	application/vnd.oasis.opendocument.text-template
2501>>>>77	string	-web			HTML Document Template
2502!:mime	application/vnd.oasis.opendocument.text-web
2503>>>>77	string	-master			Master Document
2504!:mime	application/vnd.oasis.opendocument.text-master
2505>>>73	string	graphics
2506>>>>81	byte	!0x2d			Drawing
2507!:mime	application/vnd.oasis.opendocument.graphics
2508>>>>81	string	-template		Template
2509!:mime	application/vnd.oasis.opendocument.graphics-template
2510>>>73	string	presentation
2511>>>>85	byte	!0x2d			Presentation
2512!:mime	application/vnd.oasis.opendocument.presentation
2513>>>>85	string	-template		Template
2514!:mime	application/vnd.oasis.opendocument.presentation-template
2515>>>73	string	spreadsheet
2516>>>>84	byte	!0x2d			Spreadsheet
2517!:mime	application/vnd.oasis.opendocument.spreadsheet
2518>>>>84	string	-template		Template
2519!:mime	application/vnd.oasis.opendocument.spreadsheet-template
2520>>>73	string	chart
2521>>>>78	byte	!0x2d			Chart
2522!:mime	application/vnd.oasis.opendocument.chart
2523>>>>78	string	-template		Template
2524!:mime	application/vnd.oasis.opendocument.chart-template
2525>>>73	string	formula
2526>>>>80	byte	!0x2d			Formula
2527!:mime	application/vnd.oasis.opendocument.formula
2528>>>>80	string	-template		Template
2529!:mime	application/vnd.oasis.opendocument.formula-template
2530>>>73	string	database		Database
2531!:mime	application/vnd.oasis.opendocument.database
2532>>>73	string	image
2533>>>>78	byte	!0x2d			Image
2534!:mime	application/vnd.oasis.opendocument.image
2535>>>>78	string	-template		Template
2536!:mime	application/vnd.oasis.opendocument.image-template
2537
2538#  EPUB (OEBPS) books using OCF (OEBPS Container Format)
2539#    http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4.
2540#    From: Ralf Brown <ralf.brown@gmail.com>
2541>>50	string	epub+zip	EPUB document
2542!:mime application/epub+zip
2543
2544#  Catch other ZIP-with-mimetype formats
2545#	In a ZIP file, the bytes immediately after a member's contents are
2546#	always "PK". The 2 regex rules here print the "mimetype" member's
2547#	contents up to the first 'P'. Luckily, most MIME types don't contain
2548#	any capital 'P's. This is a kludge.
2549#    (mimetype contains "application/<OTHER>")
2550>>50		string	!epub+zip
2551>>>50		string	!vnd.oasis.opendocument.
2552>>>>50		string	!vnd.sun.xml.
2553>>>>>50		string	!vnd.kde.
2554>>>>>>38	regex	[!-OQ-~]+		Zip data (MIME type "%s"?)
2555!:mime	application/zip
2556#    (mimetype contents other than "application/*")
2557>26		string	\x8\0\0\0mimetype
2558>>38		string	!application/
2559>>>38		regex	[!-OQ-~]+		Zip data (MIME type "%s"?)
2560!:mime	application/zip
2561
2562# Java Jar files
2563>(26.s+30)	leshort	0xcafe		Java archive data (JAR)
2564!:mime	application/java-archive
2565
2566# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
2567#   Next line excludes specialized formats:
2568>(26.s+30)	leshort	!0xcafe
2569>>26    string          !\x8\0\0\0mimetype	Zip archive data
2570!:mime	application/zip
2571>>>4	byte		0x09		\b, at least v0.9 to extract
2572>>>4	byte		0x0a		\b, at least v1.0 to extract
2573>>>4	byte		0x0b		\b, at least v1.1 to extract
2574>>>4	byte		0x14		\b, at least v2.0 to extract
2575>>>4	byte		0x2d		\b, at least v3.0 to extract
2576>>>0x161	string		WINZIP		\b, WinZIP self-extracting
2577
2578# StarView Metafile
2579# From Pierre Ducroquet <pinaraf@pinaraf.info>
25800	string	VCLMTF	StarView MetaFile
2581>6	beshort	x	\b, version %d
2582>8	belong	x	\b, size %d
2583
2584# Zoo archiver
258520	lelong		0xfdc4a7dc	Zoo archive data
2586!:mime	application/x-zoo
2587>4	byte		>48		\b, v%c.
2588>>6	byte		>47		\b%c
2589>>>7	byte		>47		\b%c
2590>32	byte		>0		\b, modify: v%d
2591>>33	byte		x		\b.%d+
2592>42	lelong		0xfdc4a7dc	\b,
2593>>70	byte		>0		extract: v%d
2594>>>71	byte		x		\b.%d+
2595
2596# Shell archives
259710	string		#\ This\ is\ a\ shell\ archive	shell archive text
2598!:mime	application/octet-stream
2599
2600#
2601# LBR. NB: May conflict with the questionable
2602#          "binary Computer Graphics Metafile" format.
2603#
26040       string  \0\ \ \ \ \ \ \ \ \ \ \ \0\0    LBR archive data
2605#
2606# PMA (CP/M derivative of LHA)
2607#
26082       string          -pm0-           PMarc archive data [pm0]
26092       string          -pm1-           PMarc archive data [pm1]
26102       string          -pm2-           PMarc archive data [pm2]
26112       string          -pms-           PMarc SFX archive (CP/M, DOS)
26125       string          -pc1-           PopCom compressed executable (CP/M)
2613
2614# From Rafael Laboissiere <rafael@laboissiere.net>
2615# The Project Revision Control System (see
2616# http://prcs.sourceforge.net) generates a packaged project
2617# file which is recognized by the following entry:
26180	leshort		0xeb81	PRCS packaged project
2619
2620# Microsoft cabinets
2621# by David Necas (Yeti) <yeti@physics.muni.cz>
2622#0	string	MSCF\0\0\0\0	Microsoft cabinet file data,
2623#>25	byte	x		v%d
2624#>24	byte	x		\b.%d
2625# MPi: All CABs have version 1.3, so this is pointless.
2626# Better magic in debian-additions.
2627
2628# GTKtalog catalogs
2629# by David Necas (Yeti) <yeti@physics.muni.cz>
26304	string	gtktalog\ 	GTKtalog catalog data,
2631>13	string	3		version 3
2632>>14	beshort	0x677a		(gzipped)
2633>>14	beshort	!0x677a		(not gzipped)
2634>13	string	>3		version %s
2635
2636############################################################################
2637# Parity archive reconstruction file, the 'par' file format now used on Usenet.
26380       string          PAR\0	PARity archive data
2639>48	leshort		=0	- Index file
2640>48	leshort		>0	- file number %d
2641
2642# Felix von Leitner <felix-file@fefe.de>
26430	string	d8:announce	BitTorrent file
2644!:mime	application/x-bittorrent
2645
2646# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
26470	beshort 0x0e0f		Atari MSA archive data
2648>2	beshort x		\b, %d sectors per track
2649>4	beshort 0		\b, 1 sided
2650>4	beshort 1		\b, 2 sided
2651>6	beshort x		\b, starting track: %d
2652>8	beshort x		\b, ending track: %d
2653
2654# Alternate ZIP string (amc@arwen.cs.berkeley.edu)
26550	string	PK00PK\003\004	Zip archive data
2656
2657# ACE archive (from http://www.wotsit.org/download.asp?f=ace)
2658# by Stefan `Sec` Zehl <sec@42.org>
26597	string		**ACE**		ACE archive data
2660>15	byte	>0		version %d
2661>16	byte	=0x00		\b, from MS-DOS
2662>16	byte	=0x01		\b, from OS/2
2663>16	byte	=0x02		\b, from Win/32
2664>16	byte	=0x03		\b, from Unix
2665>16	byte	=0x04		\b, from MacOS
2666>16	byte	=0x05		\b, from WinNT
2667>16	byte	=0x06		\b, from Primos
2668>16	byte	=0x07		\b, from AppleGS
2669>16	byte	=0x08		\b, from Atari
2670>16	byte	=0x09		\b, from Vax/VMS
2671>16	byte	=0x0A		\b, from Amiga
2672>16	byte	=0x0B		\b, from Next
2673>14	byte	x		\b, version %d to extract
2674>5	leshort &0x0080		\b, multiple volumes,
2675>>17	byte	x		\b (part %d),
2676>5	leshort &0x0002		\b, contains comment
2677>5	leshort	&0x0200		\b, sfx
2678>5	leshort	&0x0400		\b, small dictionary
2679>5	leshort	&0x0800		\b, multi-volume
2680>5	leshort	&0x1000		\b, contains AV-String
2681>>30	string	\x16*UNREGISTERED\x20VERSION*	(unregistered)
2682>5	leshort &0x2000		\b, with recovery record
2683>5	leshort &0x4000		\b, locked
2684>5	leshort &0x8000		\b, solid
2685# Date in MS-DOS format (whatever that is)
2686#>18	lelong	x		Created on
2687
2688# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
2689# <doj@cubic.org>
26900x1A	string	sfArk		sfArk compressed Soundfont
2691>0x15	string	2
2692>>0x1	string	>\0		Version %s
2693>>0x2A	string	>\0		: %s
2694
2695# DR-DOS 7.03 Packed File *.??_
26960	string	Packed\ File\ 	Personal NetWare Packed File
2697>12	string	x		\b, was "%.12s"
2698
2699# EET archive
2700# From: Tilman Sauerbeck <tilman@code-monkey.de>
27010	belong	0x1ee7ff00	EET archive
2702!:mime	application/x-eet
2703
2704# rzip archives
27050	string	RZIP		rzip compressed data
2706>4	byte	x		- version %d
2707>5	byte	x		\b.%d
2708>6	belong	x		(%d bytes)
2709
2710# From: "Robert Dale" <robdale@gmail.com>
27110	belong	123		dar archive,
2712>4	belong	x		label "%.8x
2713>>8	belong	x		%.8x
2714>>>12	beshort	x		%.4x"
2715>14	byte	0x54		end slice
2716>14	beshort	0x4e4e		multi-part
2717>14	beshort	0x4e53		multi-part, with -S
2718
2719# Symbian installation files
2720#  http://www.thouky.co.uk/software/psifs/sis.html
2721#  http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
27228	lelong	0x10000419	Symbian installation file
2723!:mime	application/vnd.symbian.install
2724>4	lelong	0x1000006D	(EPOC release 3/4/5)
2725>4	lelong	0x10003A12	(EPOC release 6)
27260	lelong	0x10201A7A	Symbian installation file (Symbian OS 9.x)
2727!:mime	x-epoc/x-sisx-app
2728
2729# From "Nelson A. de Oliveira" <naoliv@gmail.com>
27300	string	MPQ\032		MoPaQ (MPQ) archive
2731
2732# From: Dirk Jagdmann <doj@cubic.org>
2733# xar archive format: http://code.google.com/p/xar/
27340	string	xar!		xar archive
2735>6	beshort	x		- version %d
2736
2737# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
2738# .kgb
27390	string KGB_arch		KGB Archiver file
2740>10	string x		with compression level %.1s
2741
2742# xar (eXtensible ARchiver) archive
2743# From: "David Remahl" <dremahl@apple.com>
27440	string	xar!		xar archive
2745#>4	beshort	x		header size %d
2746>6	beshort	x		version %d,
2747#>8	quad	x		compressed TOC: %d,
2748#>16	quad	x		uncompressed TOC: %d,
2749>24	belong	0		no checksum
2750>24	belong	1		SHA-1 checksum
2751>24	belong	2		MD5 checksum
2752
2753# Type: Parity Archive
2754# From: Daniel van Eeden <daniel_e@dds.nl>
27550	string	PAR2		Parity Archive Volume Set
2756
2757# Bacula volume format. (Volumes always start with a block header.)
2758# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html
2759# From: Adam Buchbinder <adam.buchbinder@gmail.com>
276012	string	BB02		Bacula volume
2761>20	bedate	x		\b, started %s
2762
2763# ePub is XHTML + XML inside a ZIP archive.  The first member of the
2764#   archive must be an uncompressed file called 'mimetype' with contents
2765#   'application/epub+zip'
2766
2767
2768# From: "Michael Gorny" <mgorny@gentoo.org>
2769# ZPAQ: http://mattmahoney.net/dc/zpaq.html
27700	string	zPQ	ZPAQ stream
2771>3	byte	x	\b, level %d
2772
2773# BBeB ebook, unencrypted (LRF format)
2774# URL: http://www.sven.de/librie/Librie/LrfFormat
2775# From: Adam Buchbinder <adam.buchbinder@gmail.com>
27760	string	L\0R\0F\0\0\0	BBeB ebook data, unencrypted
2777>8	beshort	x		\b, version %d
2778>36	byte	1		\b, front-to-back
2779>36	byte	16		\b, back-to-front
2780>42	beshort	x		\b, (%dx,
2781>44	beshort	x		%d)
2782
2783# Symantec GHOST image by Joerg Jenderek at May 2014
2784# http://us.norton.com/ghost/
2785# http://www.garykessler.net/library/file_sigs.html
27860		ubelong&0xFFFFf7f0	0xFEEF0100	Norton GHost image
2787# *.GHO
2788>2		ubyte&0x08		0x00		\b, first file
2789# *.GHS or *.[0-9] with cns program option
2790>2		ubyte&0x08		0x08		\b, split file
2791# part of split index interesting for *.ghs
2792>>4		ubyte			x		id=0x%x
2793# compression tag minus one equals numeric compression command line switch z[1-9]
2794>3		ubyte			0		\b, no compression
2795>3		ubyte			2		\b, fast compression (Z1)
2796>3		ubyte			3		\b, medium compression (Z2)
2797>3		ubyte			>3
2798>>3		ubyte			<11		\b, compression (Z%d-1)
2799>2		ubyte&0x08		0x00
2800# ~ 30 byte password field only for *.gho
2801>>12		ubequad			!0		\b, password protected
2802>>44		ubyte			!1
2803# 1~Image All, sector-by-sector only for *.gho
2804>>>10		ubyte			1		\b, sector copy
2805# 1~Image Boot track only for *.gho
2806>>>43		ubyte			1		\b, boot track
2807# 1~Image Disc only for *.gho implies Image Boot track and sector copy
2808>>44		ubyte			1		\b, disc sector copy
2809# optional image description only *.gho
2810>>0xff		string			>\0		"%-.254s"
2811# look for DOS sector end sequence
2812>0xE08	search/7776		\x55\xAA
2813>>&-512	indirect		x		\b; contains
2814
2815#------------------------------------------------------------------------------
2816# $File: assembler,v 1.5 2013/09/17 17:33:36 christos Exp $
2817# make:  file(1) magic for assembler source
2818#
28190	regex	\^[\040\t]{0,50}\\.asciiz		assembler source text
2820!:mime	text/x-asm
28210	regex	\^[\040\t]{0,50}\\.byte		assembler source text
2822!:mime	text/x-asm
28230	regex	\^[\040\t]{0,50}\\.even		assembler source text
2824!:mime	text/x-asm
28250	regex	\^[\040\t]{0,50}\\.globl		assembler source text
2826!:mime	text/x-asm
28270	regex	\^[\040\t]{0,50}\\.text		assembler source text
2828!:mime	text/x-asm
28290	regex	\^[\040\t]{0,50}\\.file		assembler source text
2830!:mime	text/x-asm
28310	regex	\^[\040\t]{0,50}\\.type		assembler source text
2832!:mime	text/x-asm
2833
2834#------------------------------------------------------------------------------
2835# $File$
2836# asterix:  file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
2837# strings as "long" - we assume they're just strings:
2838# From: guy@netapp.com (Guy Harris)
2839#
28400	string		*STA		Aster*x
2841>7	string		WORD			Words Document
2842>7	string		GRAP			Graphic
2843>7	string		SPRE			Spreadsheet
2844>7	string		MACR			Macro
28450	string		2278		Aster*x Version 2
2846>29	byte		0x36			Words Document
2847>29	byte		0x35			Graphic
2848>29	byte		0x32			Spreadsheet
2849>29	byte		0x38			Macro
2850
2851
2852#------------------------------------------------------------------------------
2853# $File: att3b,v 1.8 2009/09/19 16:28:08 christos Exp $
2854# att3b:  file(1) magic for AT&T 3B machines
2855#
2856# The `versions' should be un-commented if they work for you.
2857# (Was the problem just one of endianness?)
2858#
2859# 3B20
2860#
2861# The 3B20 conflicts with SCCS.
2862#0	beshort		0550		3b20 COFF executable
2863#>12	belong		>0		not stripped
2864#>22	beshort		>0		- version %d
2865#0	beshort		0551		3b20 COFF executable (TV)
2866#>12	belong		>0		not stripped
2867#>22	beshort		>0		- version %d
2868#
2869# WE32K
2870#
28710	beshort		0560		WE32000 COFF
2872>18	beshort		^00000020	object
2873>18	beshort		&00000020	executable
2874>12	belong		>0		not stripped
2875>18	beshort		^00010000	N/A on 3b2/300 w/paging
2876>18	beshort		&00020000	32100 required
2877>18	beshort		&00040000	and MAU hardware required
2878>20	beshort		0407		(impure)
2879>20	beshort		0410		(pure)
2880>20	beshort		0413		(demand paged)
2881>20	beshort		0443		(target shared library)
2882>22	beshort		>0		- version %d
28830	beshort		0561		WE32000 COFF executable (TV)
2884>12	belong		>0		not stripped
2885#>18	beshort		&00020000	- 32100 required
2886#>18	beshort		&00040000	and MAU hardware required
2887#>22	beshort		>0		- version %d
2888#
2889# core file for 3b2
28900	string		\000\004\036\212\200	3b2 core file
2891>364	string		>\0		of '%s'
2892
2893#------------------------------------------------------------------------------
2894# $File: audio,v 1.71 2014/05/14 23:30:28 christos Exp $
2895# audio:  file(1) magic for sound formats (see also "iff")
2896#
2897# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
2898# and others
2899#
2900
2901# Sun/NeXT audio data
29020	string		.snd		Sun/NeXT audio data:
2903>12	belong		1		8-bit ISDN mu-law,
2904!:mime	audio/basic
2905>12	belong		2		8-bit linear PCM [REF-PCM],
2906!:mime	audio/basic
2907>12	belong		3		16-bit linear PCM,
2908!:mime	audio/basic
2909>12	belong		4		24-bit linear PCM,
2910!:mime	audio/basic
2911>12	belong		5		32-bit linear PCM,
2912!:mime	audio/basic
2913>12	belong		6		32-bit IEEE floating point,
2914!:mime	audio/basic
2915>12	belong		7		64-bit IEEE floating point,
2916!:mime	audio/basic
2917>12	belong		8		Fragmented sample data,
2918>12	belong		10		DSP program,
2919>12	belong		11		8-bit fixed point,
2920>12	belong		12		16-bit fixed point,
2921>12	belong		13		24-bit fixed point,
2922>12	belong		14		32-bit fixed point,
2923>12	belong		18		16-bit linear with emphasis,
2924>12	belong		19		16-bit linear compressed,
2925>12	belong		20		16-bit linear with emphasis and compression,
2926>12	belong		21		Music kit DSP commands,
2927>12	belong		23		8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
2928!:mime  audio/x-adpcm
2929>12	belong		24		compressed (8-bit CCITT G.722 ADPCM)
2930>12	belong		25		compressed (3-bit CCITT G.723.3 ADPCM),
2931>12	belong		26		compressed (5-bit CCITT G.723.5 ADPCM),
2932>12	belong		27		8-bit A-law (CCITT G.711),
2933>20	belong		1		mono,
2934>20	belong		2		stereo,
2935>20	belong		4		quad,
2936>16	belong		>0		%d Hz
2937
2938# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
2939# that uses little-endian encoding and has a different magic number
29400	lelong		0x0064732E	DEC audio data:
2941>12	lelong		1		8-bit ISDN mu-law,
2942!:mime	audio/x-dec-basic
2943>12	lelong		2		8-bit linear PCM [REF-PCM],
2944!:mime	audio/x-dec-basic
2945>12	lelong		3		16-bit linear PCM,
2946!:mime	audio/x-dec-basic
2947>12	lelong		4		24-bit linear PCM,
2948!:mime	audio/x-dec-basic
2949>12	lelong		5		32-bit linear PCM,
2950!:mime	audio/x-dec-basic
2951>12	lelong		6		32-bit IEEE floating point,
2952!:mime	audio/x-dec-basic
2953>12	lelong		7		64-bit IEEE floating point,
2954!:mime	audio/x-dec-basic
2955>12	belong		8		Fragmented sample data,
2956>12	belong		10		DSP program,
2957>12	belong		11		8-bit fixed point,
2958>12	belong		12		16-bit fixed point,
2959>12	belong		13		24-bit fixed point,
2960>12	belong		14		32-bit fixed point,
2961>12	belong		18		16-bit linear with emphasis,
2962>12	belong		19		16-bit linear compressed,
2963>12	belong		20		16-bit linear with emphasis and compression,
2964>12	belong		21		Music kit DSP commands,
2965>12	lelong		23		8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
2966!:mime	audio/x-dec-basic
2967>12	belong		24		compressed (8-bit CCITT G.722 ADPCM)
2968>12	belong		25		compressed (3-bit CCITT G.723.3 ADPCM),
2969>12	belong		26		compressed (5-bit CCITT G.723.5 ADPCM),
2970>12	belong		27		8-bit A-law (CCITT G.711),
2971>20	lelong		1		mono,
2972>20	lelong		2		stereo,
2973>20	lelong		4		quad,
2974>16	lelong		>0		%d Hz
2975
2976# Creative Labs AUDIO stuff
29770	string	MThd			Standard MIDI data
2978!:mime	audio/midi
2979>8 	beshort	x			(format %d)
2980>10	beshort	x			using %d track
2981>10	beshort		>1		\bs
2982>12	beshort&0x7fff	x		at 1/%d
2983>12	beshort&0x8000	>0		SMPTE
2984
29850	string	CTMF			Creative Music (CMF) data
2986!:mime	audio/x-unknown
29870	string	SBI			SoundBlaster instrument data
2988!:mime	audio/x-unknown
29890	string	Creative\ Voice\ File	Creative Labs voice data
2990!:mime	audio/x-unknown
2991# is this next line right?  it came this way...
2992>19	byte	0x1A
2993>23	byte	>0			- version %d
2994>22	byte	>0			\b.%d
2995
2996# first entry is also the string "NTRK"
29970	belong		0x4e54524b	MultiTrack sound data
2998>4	belong		x		- version %d
2999
3000# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
3001# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
30020	string		EMOD		Extended MOD sound data,
3003>4	byte&0xf0	x		version %d
3004>4	byte&0x0f	x		\b.%d,
3005>45	byte		x		%d instruments
3006>83	byte		0		(module)
3007>83	byte		1		(song)
3008
3009# Real Audio (Magic .ra\0375)
30100	belong		0x2e7261fd	RealAudio sound file
3011!:mime	audio/x-pn-realaudio
30120	string		.RMF\0\0\0	RealMedia file
3013!:mime	application/vnd.rn-realmedia
3014#video/x-pn-realvideo
3015#video/vnd.rn-realvideo
3016#application/vnd.rn-realmedia
3017#	sigh, there are many mimes for that but the above are the most common.
3018
3019# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
3020# Oct 31, 1995
3021# fixed by <doj@cubic.org> 2003-06-24
3022# Too short...
3023#0	string		MTM		MultiTracker Module sound file
3024#0	string		if		Composer 669 Module sound data
3025#0	string		JN		Composer 669 Module sound data (extended format)
30260	string		MAS_U		ULT(imate) Module sound data
3027
3028#0	string		FAR		Module sound data
3029#>4	string		>\15		Title: "%s"
3030
30310x2c	string		SCRM		ScreamTracker III Module sound data
3032>0	string		>\0		Title: "%s"
3033
3034# Gravis UltraSound patches
3035# From <ache@nagual.ru>
3036
30370	string		GF1PATCH110\0ID#000002\0	GUS patch
30380	string		GF1PATCH100\0ID#000002\0	Old GUS	patch
3039
3040# mime types according to http://www.geocities.com/nevilo/mod.htm:
3041#	audio/it	.it
3042#	audio/x-zipped-it	.itz
3043#	audio/xm	fasttracker modules
3044#	audio/x-s3m	screamtracker modules
3045#	audio/s3m	screamtracker modules
3046#	audio/x-zipped-mod	mdz
3047#	audio/mod	mod
3048#	audio/x-mod	All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z)
3049
3050#
3051# Taken from loader code from mikmod version 2.14
3052# by Steve McIntyre (stevem@chiark.greenend.org.uk)
3053# <doj@cubic.org> added title printing on 2003-06-24
30540	string	MAS_UTrack_V00
3055>14	string	>/0		ultratracker V1.%.1s module sound data
3056!:mime	audio/x-mod
3057#audio/x-tracker-module
3058
30590	string	UN05		MikMod UNI format module sound data
3060
30610	string	Extended\ Module: Fasttracker II module sound data
3062!:mime	audio/x-mod
3063#audio/x-tracker-module
3064>17	string	>\0		Title: "%s"
3065
306621	string/c	=!SCREAM!	Screamtracker 2 module sound data
3067!:mime	audio/x-mod
3068#audio/x-screamtracker-module
306921	string	BMOD2STM	Screamtracker 2 module sound data
3070!:mime	audio/x-mod
3071#audio/x-screamtracker-module
30721080	string	M.K.		4-channel Protracker module sound data
3073!:mime	audio/x-mod
3074#audio/x-protracker-module
3075>0	string	>\0		Title: "%s"
30761080	string	M!K!		4-channel Protracker module sound data
3077!:mime	audio/x-mod
3078#audio/x-protracker-module
3079>0	string	>\0		Title: "%s"
30801080	string	FLT4		4-channel Startracker module sound data
3081!:mime	audio/x-mod
3082#audio/x-startracker-module
3083>0	string	>\0		Title: "%s"
30841080	string	FLT8		8-channel Startracker module sound data
3085!:mime	audio/x-mod
3086#audio/x-startracker-module
3087>0	string	>\0		Title: "%s"
30881080	string	4CHN		4-channel Fasttracker module sound data
3089!:mime	audio/x-mod
3090#audio/x-fasttracker-module
3091>0	string	>\0		Title: "%s"
30921080	string	6CHN		6-channel Fasttracker module sound data
3093!:mime	audio/x-mod
3094#audio/x-fasttracker-module
3095>0	string	>\0		Title: "%s"
30961080	string	8CHN		8-channel Fasttracker module sound data
3097!:mime	audio/x-mod
3098#audio/x-fasttracker-module
3099>0	string	>\0		Title: "%s"
31001080	string	CD81		8-channel Octalyser module sound data
3101!:mime	audio/x-mod
3102#audio/x-octalysertracker-module
3103>0	string	>\0		Title: "%s"
31041080	string	OKTA		8-channel Octalyzer module sound data
3105!:mime	audio/x-mod
3106#audio/x-octalysertracker-module
3107>0	string	>\0		Title: "%s"
3108# Not good enough.
3109#1082	string	CH
3110#>1080	string	>/0		%.2s-channel Fasttracker "oktalyzer" module sound data
31111080	string	16CN		16-channel Taketracker module sound data
3112!:mime	audio/x-mod
3113#audio/x-taketracker-module
3114>0	string	>\0		Title: "%s"
31151080	string	32CN		32-channel Taketracker module sound data
3116!:mime	audio/x-mod
3117#audio/x-taketracker-module
3118>0	string	>\0		Title: "%s"
3119
3120# TOC sound files -Trevor Johnson <trevor@jpj.net>
3121#
31220       string          TOC             TOC sound file
3123
3124# sidfiles <pooka@iki.fi>
3125# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24
31260	string		SIDPLAY\ INFOFILE	Sidplay info file
3127
31280	string		PSID			PlaySID v2.2+ (AMIGA) sidtune
3129>4	beshort		>0			w/ header v%d,
3130>14	beshort		=1			single song,
3131>14	beshort		>1			%d songs,
3132>16	beshort		>0			default song: %d
3133>0x16	string		>\0			name: "%s"
3134>0x36	string		>\0			author: "%s"
3135>0x56	string		>\0			copyright: "%s"
3136
31370	string		RSID			RSID sidtune PlaySID compatible
3138>4	beshort		>0			w/ header v%d,
3139>14	beshort		=1			single song,
3140>14	beshort		>1			%d songs,
3141>16	beshort		>0			default song: %d
3142>0x16	string		>\0			name: "%s"
3143>0x36	string		>\0			author: "%s"
3144>0x56	string		>\0			copyright: "%s"
3145
3146# IRCAM sound files - Michael Pruett <michael@68k.org>
3147# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html
31480	belong		0x64a30100		IRCAM file (VAX little-endian)
31490	belong		0x0001a364		IRCAM file (VAX big-endian)
31500	belong		0x64a30200		IRCAM file (Sun big-endian)
31510	belong		0x0002a364		IRCAM file (Sun little-endian)
31520	belong		0x64a30300		IRCAM file (MIPS little-endian)
31530	belong		0x0003a364		IRCAM file (MIPS big-endian)
31540	belong		0x64a30400		IRCAM file (NeXT big-endian)
31550	belong		0x64a30400		IRCAM file (NeXT big-endian)
31560	belong		0x0004a364		IRCAM file (NeXT little-endian)
3157
3158# NIST SPHERE <mpruett@sgi.com>
31590	string		NIST_1A\n\ \ \ 1024\n	NIST SPHERE file
3160
3161# Sample Vision <mpruett@sgi.com>
31620	string		SOUND\ SAMPLE\ DATA\ 	Sample Vision file
3163
3164# Audio Visual Research <tonigonenstein@users.sourceforge.net>
31650	string		2BIT			Audio Visual Research file,
3166>12	beshort		=0			mono,
3167>12	beshort		=-1			stereo,
3168>14	beshort		x			%d bits
3169>16	beshort		=0			unsigned,
3170>16	beshort		=-1			signed,
3171>22	belong&0x00ffffff	x		%d Hz,
3172>18	beshort		=0			no loop,
3173>18	beshort		=-1			loop,
3174>21	ubyte		<128			note %d,
3175>22	byte		=0			replay 5.485 KHz
3176>22	byte		=1			replay 8.084 KHz
3177>22	byte		=2			replay 10.971 KHz
3178>22	byte		=3			replay 16.168 KHz
3179>22	byte		=4			replay 21.942 KHz
3180>22	byte		=5			replay 32.336 KHz
3181>22	byte		=6			replay 43.885 KHz
3182>22	byte		=7			replay 47.261 KHz
3183
3184# SGI SoundTrack <mpruett@sgi.com>
31850	string		_SGI_SoundTrack		SGI SoundTrack project file
3186# ID3 version 2 tags <waschk@informatik.uni-rostock.de>
31870	string		ID3	Audio file with ID3 version 2
3188>3	byte		x	\b.%d
3189>4	byte		x	\b.%d
3190>>5	byte		&0x80	\b, unsynchronized frames
3191>>5	byte		&0x40	\b, extended header
3192>>5	byte		&0x20	\b, experimental
3193>>5	byte		&0x10	\b, footer present
3194>(6.I+10)	indirect	x	\b, contains:
3195
3196# NSF (NES sound file) magic
31970	string		NESM\x1a	NES Sound File
3198>14	string		>\0		("%s" by
3199>46	string		>\0		%s, copyright
3200>78	string		>\0		%s),
3201>5	byte		x		version %d,
3202>6	byte		x		%d tracks,
3203>122	byte&0x2	=1		dual PAL/NTSC
3204>122	byte&0x1	=1		PAL
3205>122	byte&0x1	=0		NTSC
3206
3207# Type: SNES SPC700 sound files
3208# From: Josh Triplett <josh@freedesktop.org>
32090	string	SNES-SPC700\ Sound\ File\ Data\ v	SNES SPC700 sound file
3210>&0	string	0.30					\b, version %s
3211>>0x23	byte	0x1B					\b, without ID666 tag
3212>>0x23	byte	0x1A					\b, with ID666 tag
3213>>>0x2E	string	>\0					\b, song "%.32s"
3214>>>0x4E	string	>\0					\b, game "%.32s"
3215
3216# Impulse tracker module (audio/x-it)
32170	string		IMPM		Impulse Tracker module sound data -
3218!:mime	audio/x-mod
3219>4	string		>\0		"%s"
3220>40	leshort		!0		compatible w/ITv%x
3221>42	leshort		!0		created w/ITv%x
3222
3223# Imago Orpheus module (audio/x-imf)
322460	string		IM10		Imago Orpheus module sound data -
3225>0	string		>\0		"%s"
3226
3227# From <collver1@attbi.com>
3228# These are the /etc/magic entries to decode modules, instruments, and
3229# samples in Impulse Tracker's native format.
3230
32310	string		IMPS		Impulse Tracker Sample
3232>18	byte		&2		16 bit
3233>18	byte		^2		8 bit
3234>18	byte		&4		stereo
3235>18	byte		^4		mono
32360	string		IMPI		Impulse Tracker Instrument
3237>28	leshort		!0		ITv%x
3238>30	byte		!0		%d samples
3239
3240# Yamaha TX Wave:  file(1) magic for Yamaha TX Wave audio files
3241# From <collver1@attbi.com>
32420	string		LM8953		Yamaha TX Wave
3243>22	byte		0x49		looped
3244>22	byte		0xC9		non-looped
3245>23	byte		1		33kHz
3246>23	byte		2		50kHz
3247>23	byte		3		16kHz
3248
3249# scream tracker:  file(1) magic for Scream Tracker sample files
3250#
3251# From <collver1@attbi.com>
325276	string		SCRS		Scream Tracker Sample
3253>0	byte		1		sample
3254>0	byte		2		adlib melody
3255>0	byte		>2		adlib drum
3256>31	byte		&2		stereo
3257>31	byte		^2		mono
3258>31	byte		&4		16bit little endian
3259>31	byte		^4		8bit
3260>30	byte		0		unpacked
3261>30	byte		1		packed
3262
3263# audio
3264# From: Cory Dikkers <cdikkers@swbell.net>
32650	string		MMD0		MED music file, version 0
32660	string		MMD1		OctaMED Pro music file, version 1
32670	string		MMD3		OctaMED Soundstudio music file, version 3
32680	string		OctaMEDCmpr	OctaMED Soundstudio compressed file
32690	string		MED		MED_Song
32700	string		SymM		Symphonie SymMOD music file
3271#
32720	string		THX		AHX version
3273>3	byte		=0		1 module data
3274>3	byte		=1		2 module data
3275#
32760	string		OKTASONG	Oktalyzer module data
3277#
32780	string		DIGI\ Booster\ module\0	%s
3279>20	byte		>0		%c
3280>>21	byte		>0		\b%c
3281>>>22	byte		>0		\b%c
3282>>>>23	byte		>0		\b%c
3283>610	string		>\0		\b, "%s"
3284#
32850	string		DBM0	   	DIGI Booster Pro Module
3286>4	byte		>0		V%X.
3287>>5	byte		x		\b%02X
3288>16	string		>\0		\b, "%s"
3289#
32900	string		FTMN		FaceTheMusic module
3291>16	string		>\0d		\b, "%s"
3292
3293# From: <doj@cubic.org> 2003-06-24
32940	string		AMShdr\32	Velvet Studio AMS Module v2.2
32950	string		Extreme		Extreme Tracker AMS Module v1.3
32960	string		DDMF		Xtracker DMF Module
3297>4	byte		x		v%i
3298>0xD	string		>\0		Title: "%s"
3299>0x2B	string		>\0		Composer: "%s"
33000	string		DSM\32		Dynamic Studio Module DSM
33010	string		SONG		DigiTrekker DTM Module
33020	string		DMDL		DigiTrakker MDL Module
33030	string		PSM\32		Protracker Studio PSM Module
330444	string		PTMF		Poly Tracker PTM Module
3305>0	string		>\32		Title: "%s"
33060	string		MT20		MadTracker 2.0 Module MT2
33070	string		RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD
33080	string		RTMM		RTM Module
33090x426	string		MaDoKaN96	XMS Adlib Module
3310>0	string		>\0		Composer: "%s"
33110	string		AMF		AMF Module
3312>4	string		>\0		Title: "%s"
33130	string		MODINFO1	Open Cubic Player Module Inforation MDZ
33140	string		Extended\40Instrument: Fast Tracker II Instrument
3315
3316# From: Takeshi Hamasaki <hma@syd.odn.ne.jp>
3317# NOA Nancy Codec file
33180	string		\210NOA\015\012\032	NOA Nancy Codec Movie file
3319# Yamaha SMAF format
33200	string		MMMD		Yamaha SMAF file
3321# Sharp Jisaku Melody format for PDC
33220	string		\001Sharp\040JisakuMelody	SHARP Cell-Phone ringing Melody
3323>20	string		Ver01.00	Ver. 1.00
3324>>32	byte		x		, %d tracks
3325
3326# Free lossless audio codec <http://flac.sourceforge.net>
3327# From: Przemyslaw Augustyniak <silvathraec@rpg.pl>
33280	string			fLaC		FLAC audio bitstream data
3329!:mime	audio/x-flac
3330>4	byte&0x7f		>0		\b, unknown version
3331>4	byte&0x7f		0		\b
3332# some common bits/sample values
3333>>20	beshort&0x1f0		0x030		\b, 4 bit
3334>>20	beshort&0x1f0		0x050		\b, 6 bit
3335>>20	beshort&0x1f0		0x070		\b, 8 bit
3336>>20	beshort&0x1f0		0x0b0		\b, 12 bit
3337>>20	beshort&0x1f0		0x0f0		\b, 16 bit
3338>>20	beshort&0x1f0		0x170		\b, 24 bit
3339>>20	byte&0xe		0x0		\b, mono
3340>>20	byte&0xe		0x2		\b, stereo
3341>>20	byte&0xe		0x4		\b, 3 channels
3342>>20	byte&0xe		0x6		\b, 4 channels
3343>>20	byte&0xe		0x8		\b, 5 channels
3344>>20	byte&0xe		0xa		\b, 6 channels
3345>>20	byte&0xe		0xc		\b, 7 channels
3346>>20	byte&0xe		0xe		\b, 8 channels
3347# some common sample rates
3348>>17	belong&0xfffff0		0x0ac440	\b, 44.1 kHz
3349>>17	belong&0xfffff0		0x0bb800	\b, 48 kHz
3350>>17	belong&0xfffff0		0x07d000	\b, 32 kHz
3351>>17	belong&0xfffff0		0x056220	\b, 22.05 kHz
3352>>17	belong&0xfffff0		0x05dc00	\b, 24 kHz
3353>>17	belong&0xfffff0		0x03e800	\b, 16 kHz
3354>>17	belong&0xfffff0		0x02b110	\b, 11.025 kHz
3355>>17	belong&0xfffff0		0x02ee00	\b, 12 kHz
3356>>17	belong&0xfffff0		0x01f400	\b, 8 kHz
3357>>17	belong&0xfffff0		0x177000	\b, 96 kHz
3358>>17	belong&0xfffff0		0x0fa000	\b, 64 kHz
3359>>21	byte&0xf		>0		\b, >4G samples
3360>>21	byte&0xf		0		\b
3361>>>22	belong			>0		\b, %u samples
3362>>>22	belong			0		\b, length unknown
3363
3364# (ISDN) VBOX voice message file (Wolfram Kleff)
33650       string          VBOX            VBOX voice message data
3366
3367# ReBorn Song Files (.rbs)
3368# David J. Singer <doc@deadvirgins.org.uk>
33698       string          RB40             RBS Song file
3370>29     string          ReBorn           created by ReBorn
3371>37     string          Propellerhead    created by ReBirth
3372
3373# Synthesizer Generator and Kimwitu share their file format
33740	string		A#S#C#S#S#L#V#3	    Synthesizer Generator or Kimwitu data
3375# Kimwitu++ uses a slightly different magic
33760	string		A#S#C#S#S#L#HUB	    Kimwitu++ data
3377
3378# From "Simon Hosie
33790       string  TFMX-SONG       TFMX module sound data
3380
3381# Monkey's Audio compressed audio format (.ape)
3382# From danny.milo@gmx.net (Danny Milosavljevic)
3383# New version from Abel Cheung <abel (@) oaka.org>
33840		string		MAC\040		Monkey's Audio compressed format
3385!:mime audio/x-ape
3386>4		uleshort	>0x0F8B		version %d
3387>>(0x08.l)	uleshort	=1000		with fast compression
3388>>(0x08.l)	uleshort	=2000		with normal compression
3389>>(0x08.l)	uleshort	=3000		with high compression
3390>>(0x08.l)	uleshort	=4000		with extra high compression
3391>>(0x08.l)	uleshort	=5000		with insane compression
3392>>(0x08.l+18)	uleshort	=1		\b, mono
3393>>(0x08.l+18)	uleshort	=2		\b, stereo
3394>>(0x08.l+20)	ulelong		x		\b, sample rate %d
3395>4		uleshort	<0x0F8C		version %d
3396>>6		uleshort	=1000		with fast compression
3397>>6		uleshort	=2000		with normal compression
3398>>6		uleshort	=3000		with high compression
3399>>6		uleshort	=4000		with extra high compression
3400>>6		uleshort	=5000		with insane compression
3401>>10		uleshort	=1		\b, mono
3402>>10		uleshort	=2		\b, stereo
3403>>12		ulelong		x		\b, sample rate %d
3404
3405# adlib sound files
3406# From Gurkan Sengun <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu
34070    	string		RAWADATA	RdosPlay RAW
3408
34091068	string		RoR		AMUSIC Adlib Tracker
3410
34110	string		JCH		EdLib
3412
34130	string		mpu401tr	MPU-401 Trakker
3414
34150	string		SAdT		Surprise! Adlib Tracker
3416>4	byte		x		Version %d
3417
34180	string		XAD!		eXotic ADlib
3419
34200	string		ofTAZ!		eXtra Simple Music
3421
3422# Spectrum 128 tunes (.ay files).
3423# From: Emanuel Haupt <ehaupt@critical.ch>
34240	string		ZXAYEMUL	Spectrum 128 tune
3425
34260	string		\0BONK		BONK,
3427#>5	byte		x		version %d
3428>14	byte		x		%d channel(s),
3429>15	byte		=1		lossless,
3430>15	byte		=0		lossy,
3431>16	byte		x		mid-side
3432
3433384	string		LockStream	LockStream Embedded file (mostly MP3 on old Nokia phones)
3434
3435# format VQF (proprietary codec for sound)
3436# some infos on the header file available at :
3437# http://www.twinvq.org/english/technology_format.html
34380	string		TWIN97012000	VQF data
3439>27	short		0		\b, Mono
3440>27	short		1		\b, Stereo
3441>31	short 		>0		\b, %d kbit/s
3442>35	short 		>0		\b, %d kHz
3443
3444# Nelson A. de Oliveira (naoliv@gmail.com)
3445# .eqf
34460	string	Winamp\ EQ\ library\ file	%s
3447# it will match only versions like v<digit>.<digit>
3448# Since I saw only eqf files with version v1.1 I think that it's OK
3449>23	string	x	\b%.4s
3450# .preset
34510	string	[Equalizer\ preset]	XMMS equalizer preset
3452# .m3u
34530	search/1	#EXTM3U 	M3U playlist text
3454# .pls
34550	search/1	[playlist]	PLS playlist text
3456# licq.conf
34571	string	[licq]			LICQ configuration file
3458
3459# Atari ST audio files by Dirk Jagdmann <doj@cubic.org>
34600	string		ICE!		SNDH Atari ST music
34610	string		SC68\ Music-file\ /\ (c)\ (BeN)jami	sc68 Atari ST music
3462
3463# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com>
34640       string          MP+     Musepack audio
3465!:mime	audio/x-musepack
3466>3      byte            255     \b, SV pre8
3467>3      byte&0xF        0x6     \b, SV 6
3468>3      byte&0xF        0x8     \b, SV 8
3469>3      byte&0xF        0x7     \b, SV 7
3470>>3     byte&0xF0       0x0     \b.0
3471>>3     byte&0xF0       0x10    \b.1
3472>>3     byte&0xF0       240     \b.15
3473>>10    byte&0xF0       0x0     \b, no profile
3474>>10    byte&0xF0       0x10    \b, profile 'Unstable/Experimental'
3475>>10    byte&0xF0       0x50    \b, quality 0
3476>>10    byte&0xF0       0x60    \b, quality 1
3477>>10    byte&0xF0       0x70    \b, quality 2 (Telephone)
3478>>10    byte&0xF0       0x80    \b, quality 3 (Thumb)
3479>>10    byte&0xF0       0x90    \b, quality 4 (Radio)
3480>>10    byte&0xF0       0xA0    \b, quality 5 (Standard)
3481>>10    byte&0xF0       0xB0    \b, quality 6 (Xtreme)
3482>>10    byte&0xF0       0xC0    \b, quality 7 (Insane)
3483>>10    byte&0xF0       0xD0    \b, quality 8 (BrainDead)
3484>>10    byte&0xF0       0xE0    \b, quality 9
3485>>10    byte&0xF0       0xF0    \b, quality 10
3486>>27    byte            0x0     \b, Buschmann 1.7.0-9, Klemm 0.90-1.05
3487>>27    byte            102     \b, Beta 1.02
3488>>27    byte            104     \b, Beta 1.04
3489>>27    byte            105     \b, Alpha 1.05
3490>>27    byte            106     \b, Beta 1.06
3491>>27    byte            110     \b, Release 1.1
3492>>27    byte            111     \b, Alpha 1.11
3493>>27    byte            112     \b, Beta 1.12
3494>>27    byte            113     \b, Alpha 1.13
3495>>27    byte            114     \b, Beta 1.14
3496>>27    byte            115     \b, Alpha 1.15
3497
3498# IMY
3499# from http://filext.com/detaillist.php?extdetail=IMY
3500# http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm
3501# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html
3502# http://www.wx800.com/msg/download/irda/iMelody.pdf
35030	string	BEGIN:IMELODY	iMelody Ringtone Format
3504
3505# From: "Mateus Caruccio" <mateus@caruccio.com>
3506# guitar pro v3,4,5 from http://filext.com/file-extension/gp3
35070	string	\030FICHIER\ GUITAR\ PRO\ v3.	Guitar Pro Ver. 3 Tablature
3508
3509# From: "Leslie P. Polzer" <leslie.polzer@gmx.net>
351060	string	SONG		SoundFX Module sound file
3511
3512# Type: Adaptive Multi-Rate Codec
3513# URL:  http://filext.com/detaillist.php?extdetail=AMR
3514# From: Russell Coker <russell@coker.com.au>
35150	string	#!AMR		Adaptive Multi-Rate Codec (GSM telephony)
3516
3517# Type: SuperCollider 3 Synth Definition File Format
3518# From: Mario Lang <mlang@debian.org>
35190	string	SCgf	SuperCollider3 Synth Definition file,
3520>4	belong	x	version %d
3521
3522# Type: True Audio Lossless Audio
3523# URL:  http://wiki.multimedia.cx/index.php?title=True_Audio
3524# From: Mike Melanson <mike@multimedia.cx>
35250	string	TTA1	True Audio Lossless Audio
3526
3527# Type: WavPack Lossless Audio
3528# URL:  http://wiki.multimedia.cx/index.php?title=WavPack
3529# From: Mike Melanson <mike@multimedia.cx>
35300	string	wvpk	WavPack Lossless Audio
3531
3532# From Fabio R. Schmidlin <frs@pop.com.br>
3533# VGM music file
35340	string		Vgm\
3535>9	ubyte		>0	VGM Video Game Music dump v
3536>>9	ubyte/16	>0	\b%d
3537>>9	ubyte&0x0F	x	\b%d
3538>>8	ubyte/16	x	\b.%d
3539>>8	ubyte&0x0F	>0	\b%d
3540#Get soundchips
3541>>8	ubyte		x	\b, soundchip(s)=
3542>>0x0C	ulelong		>0	SN76489,
3543>>0x10	ulelong		>0	YM2413,
3544>>0x2C	ulelong		>0	YM2612,
3545>>0x30	ulelong		>0	YM2151,
3546>>0x38	ulelong		>0	Sega PCM,
3547>>0x34	ulelong		>0xC
3548>>>0x40	ulelong		>0	RF5C68,
3549>>0x34	ulelong		>0x10
3550>>>0x44	ulelong		>0	YM2203,
3551>>0x34	ulelong		>0x14
3552>>>0x48	ulelong		>0	YM2608,
3553>>0x34	ulelong		>0x18
3554>>>0x4C	lelong		>0	YM2610,
3555>>>0x4C	lelong		<0	YM2610B,
3556>>0x34	ulelong		>0x1C
3557>>>0x50	ulelong		>0	YM3812,
3558>>0x34	ulelong		>0x20
3559>>>0x54	ulelong		>0	YM3526,
3560>>0x34	ulelong		>0x24
3561>>>0x58	ulelong		>0	Y8950,
3562>>0x34	ulelong		>0x28
3563>>>0x5C	ulelong		>0	YMF262,
3564>>0x34	ulelong		>0x2C
3565>>>0x60	ulelong		>0	YMF278B,
3566>>0x34	ulelong		>0x30
3567>>>0x64	ulelong		>0	YMF271,
3568>>0x34	ulelong		>0x34
3569>>>0x68	ulelong		>0	YMZ280B,
3570>>0x34	ulelong		>0x38
3571>>>0x6C	ulelong		>0	RF5C164,
3572>>0x34	ulelong		>0x3C
3573>>>0x70	ulelong		>0	PWM,
3574>>0x34	ulelong		>0x40
3575>>>0x74	ulelong		>0
3576>>>>0x78 ubyte		0x00	AY-3-8910,
3577>>>>0x78 ubyte		0x01	AY-3-8912,
3578>>>>0x78 ubyte		0x02	AY-3-8913,
3579>>>>0x78 ubyte		0x03	AY-3-8930,
3580>>>>0x78 ubyte		0x10	YM2149,
3581>>>>0x78 ubyte		0x11	YM3439,
3582
3583# GVOX Encore file format
3584# Since this is a proprietary file format and there is no publicly available
3585# format specification, this is just based on induction
3586#
35870	string	SCOW
3588>4	byte	0xc4	GVOX Encore music, version 5.0 or above
3589>4	byte	0xc2	GVOX Encore music, version < 5.0
3590
35910	string	ZBOT
3592>4	byte	0xc5	GVOX Encore music, version < 5.0
3593
3594
3595#----------------------------------------------------------------
3596# $File$
3597# basis: file(1) magic for BBx/Pro5-files
3598#      Oliver Dammer <dammer@olida.de>	 2005/11/07
3599# http://www.basis.com business-basic-files.
3600#
36010	string		\074\074bbx\076\076	BBx
3602>7	string		\000			indexed file
3603>7	string		\001			serial file
3604>7	string		\002			keyed file
3605>>13	short		0			(sort)
3606>7	string		\004			program
3607>>18	byte		x			(LEVEL %d)
3608>>>23	string		>\000			psaved
3609>7	string		\006			mkeyed file
3610>>13	short		0			(sort)
3611>>8	string		\000			(mkey)
3612
3613#------------------------------------------------------------------------------
3614# $File: bflt,v 1.4 2009/09/19 16:28:08 christos Exp $
3615# bFLT: file(1) magic for BFLT uclinux binary files
3616#
3617# From Philippe De Muyter <phdm@macqel.be>
3618#
36190	string		bFLT		BFLT executable
3620>4	belong		x		- version %d
3621>4	belong		4
3622>>36	belong&0x1	0x1		ram
3623>>36	belong&0x2	0x2		gotpic
3624>>36	belong&0x4	0x4		gzip
3625>>36	belong&0x8	0x8		gzdata
3626
3627#------------------------------------------------------------------------------
3628# $File: apple,v 1.27 2013/03/09 22:36:00 christos Exp $
3629# blackberry:  file(1) magic for BlackBerry file formats
3630#
36315	belong	0
3632>8	belong  010010010	BlackBerry RIM ETP file
3633>>22	string	x		\b for %s
3634# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files
3635# http://ftg.lbl.gov/checkpoint
36360	string	C\0\0\0R\0\0\0	BLCR
3637>16	lelong	1	x86
3638>16	lelong	3	alpha
3639>16	lelong	5	x86-64
3640>16	lelong	7	ARM
3641>8	lelong	x	context data (little endian, version %d)
3642# Uncomment the following only of your "file" program supports "search"
3643#>0	search/1024	VMA\06	for kernel
3644#>>&1	byte	x	%d.
3645#>>&2	byte	x	%d.
3646#>>&3	byte	x	%d
36470	string	\0\0\0C\0\0\0R	BLCR
3648>16	belong	2	SPARC
3649>16	belong	4	ppc
3650>16	belong	6	ppc64
3651>16	belong	7	ARMEB
3652>16	belong	8	SPARC64
3653>8	belong	x	context data (big endian, version %d)
3654# Uncomment the following only of your "file" program supports "search"
3655#>0	search/1024	VMA\06	for kernel
3656#>>&1	byte	x	%d.
3657#>>&2	byte	x	\b%d.
3658#>>&3	byte	x	\b%d
3659
3660#------------------------------------------------------------------------------
3661# $File: blender,v 1.5 2009/09/19 16:28:08 christos Exp $
3662# blender: file(1) magic for Blender 3D related files
3663#
3664# Native format rule v1.2. For questions use the developers list
3665# http://lists.blender.org/mailman/listinfo/bf-committers
3666# GLOB chunk was moved near start and provides subversion info since 2.42
3667
36680		string	=BLENDER	Blender3D,
3669>7		string	=_		saved as 32-bits
3670>>8		string	=v		little endian
3671>>>9		byte	x		with version %c.
3672>>>10		byte	x		\b%c
3673>>>11		byte	x		\b%c
3674>>>0x40		string	=GLOB		\b.
3675>>>>0x58	leshort	x		\b%.4d
3676>>8		string	=V		big endian
3677>>>9		byte	x		with version %c.
3678>>>10		byte	x		\b%c
3679>>>11		byte	x		\b%c
3680>>>0x40		string	=GLOB		\b.
3681>>>>0x58	beshort	x		\b%.4d
3682>7		string	=-		saved as 64-bits
3683>>8		string	=v		little endian
3684>>9		byte	x		with version %c.
3685>>10		byte	x		\b%c
3686>>11		byte	x		\b%c
3687>>0x44		string	=GLOB		\b.
3688>>>0x60		leshort	x		\b%.4d
3689>>8		string	=V		big endian
3690>>>9		byte	x		with version %c.
3691>>>10		byte	x		\b%c
3692>>>11		byte	x		\b%c
3693>>>0x44		string	=GLOB		\b.
3694>>>>0x60	beshort	x		\b%.4d
3695
3696# Scripts that run in the embedded Python interpreter
36970		string	#!BPY		Blender3D BPython script
3698
3699#------------------------------------------------------------------------------
3700# $File$
3701# blit:  file(1) magic for 68K Blit stuff as seen from 680x0 machine
3702#
3703# Note that this 0407 conflicts with several other a.out formats...
3704#
3705# XXX - should this be redone with "be" and "le", so that it works on
3706# little-endian machines as well?  If so, what's the deal with
3707# "VAX-order" and "VAX-order2"?
3708#
3709#0	long		0407		68K Blit (standalone) executable
3710#0	short		0407		VAX-order2 68K Blit (standalone) executable
37110	short		03401		VAX-order 68K Blit (standalone) executable
37120	long		0406		68k Blit mpx/mux executable
37130	short		0406		VAX-order2 68k Blit mpx/mux executable
37140	short		03001		VAX-order 68k Blit mpx/mux executable
3715# Need more values for WE32 DMD executables.
3716# Note that 0520 is the same as COFF
3717#0	short		0520		tty630 layers executable
3718
3719#------------------------------------------------------------------------------
3720# $File$
3721# i80960 b.out objects and archives
3722#
37230	long		0x10d		i960 b.out relocatable object
3724>16	long		>0		not stripped
3725#
3726# b.out archive (hp-rt on i960)
37270	string		=!<bout>	b.out archive
3728>8	string		__.SYMDEF	random library
3729
3730#------------------------------------------------------------------------------
3731# $File: bsdi,v 1.6 2013/01/09 22:37:24 christos Exp $
3732# bsdi:  file(1) magic for BSD/OS (from BSDI) objects
3733# Some object/executable formats use the same magic numbers as are used
3734# in other OSes; those are handled by entries in aout.
3735#
3736
37370	lelong		0314		386 compact demand paged pure executable
3738>16	lelong		>0		not stripped
3739>32	byte		0x6a		(uses shared libs)
3740
3741# same as in SunOS 4.x, except for static shared libraries
37420	belong&077777777	0600413		SPARC demand paged
3743>0	byte		&0x80
3744>>20	belong		<4096		shared library
3745>>20	belong		=4096		dynamically linked executable
3746>>20	belong		>4096		dynamically linked executable
3747>0	byte		^0x80		executable
3748>16	belong		>0		not stripped
3749>36	belong		0xb4100001	(uses shared libs)
3750
37510	belong&077777777	0600410		SPARC pure
3752>0	byte		&0x80		dynamically linked executable
3753>0	byte		^0x80		executable
3754>16	belong		>0		not stripped
3755>36	belong		0xb4100001	(uses shared libs)
3756
37570	belong&077777777	0600407		SPARC
3758>0	byte		&0x80		dynamically linked executable
3759>0	byte		^0x80		executable
3760>16	belong		>0		not stripped
3761>36	belong		0xb4100001	(uses shared libs)
3762# Chiasmus is a encryption standard developed by the German Federal
3763# Office for Information Security (Bundesamt fuer Sicherheit in der
3764# Informationstechnik).
3765
3766# Extension: .xia
37670	string	XIA1	Chiasmus encrypted data
3768
3769# Extension: .xis
37700	string	XIS	Chiasmus key
3771
3772#------------------------------------------------------------------------------
3773# $File$
3774# BTSnoop:  file(1) magic for BTSnoop files
3775#
3776# From <marcel@holtmann.org>
37770	string		btsnoop\0		BTSnoop
3778>8	belong		x			version %d,
3779>12	belong		1001			Unencapsulated HCI
3780>12	belong		1002			HCI UART (H4)
3781>12	belong		1003			HCI BCSP
3782>12	belong		1004			HCI Serial (H5)
3783>>12	belong		x			type %d
3784
3785#------------------------------------------------------------------------------
3786# $File$
3787# c64:  file(1) magic for various commodore 64 related files
3788#
3789# From: Dirk Jagdmann <doj@cubic.org>
3790
37910x16500	belong		0x12014100	D64 Image
37920x16500	belong		0x12014180	D71 Image
37930x61800 belong		0x28034400	D81 Image
37940	string		C64\40CARTRIDGE	CCS C64 Emultar Cartridge Image
37950	belong		0x43154164	X64 Image
3796
37970	string		GCR-1541	GCR Image
3798>8	byte		x		version: %i
3799>9	byte		x		tracks: %i
3800
38019	string		PSUR		ARC archive (c64)
38022	string		-LH1-		LHA archive (c64)
3803
38040	string		C64File		PC64 Emulator file
3805>8	string		>\0		"%s"
38060	string		C64Image	PC64 Freezer Image
3807
38080	beshort		0x38CD		C64 PCLink Image
38090	string		CBM\144\0\0	Power 64 C64 Emulator Snapshot
3810
38110	belong		0xFF424CFF	WRAptor packer (c64)
3812
38130	string		C64S\x20tape\x20file	T64 tape Image
3814>32	leshort		x		Version:0x%x
3815>36	leshort		!0		Entries:%i
3816>40	string		x		Name:%.24s
3817
38180	string		C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0	T64 tape Image
3819>32	leshort		x		Version:0x%x
3820>36	leshort		!0		Entries:%i
3821>40	string		x		Name:%.24s
3822
38230	string		C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0	T64 tape Image
3824>32	leshort		x		Version:0x%x
3825>36	leshort		!0		Entries:%i
3826>40	string		x		Name:%.24s
3827
3828#------------------------------------------------------------------------------
3829# $File: cad,v 1.12 2013/07/04 15:24:37 christos Exp $
3830# autocad:  file(1) magic for cad files
3831#
3832
3833# Microstation DGN/CIT Files (www.bentley.com)
3834# Last updated July 29, 2005 by Lester Hightower
3835# DGN is the default file extension of Microstation/Intergraph CAD files.
3836# CIT is the proprietary raster format (similar to TIFF) used to attach
3837# raster underlays to Microstation DGN (vector) drawings.
3838#
3839# http://www.wotsit.org/search.asp
3840# http://filext.com/detaillist.php?extdetail=DGN
3841# http://filext.com/detaillist.php?extdetail=CIT
3842#
3843# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
3844# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
3845# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
3846# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
38470	string	\010\011\376			Microstation
3848>3	string	\002
3849>>30	string	\026\105			DGNFile
3850>>30	string	\034\105			DGNFile
3851>>30	string	\073\107			DGNFile
3852>>30	string	\073\110			DGNFile
3853>>30	string	\106\107			DGNFile
3854>>30	string	\110\103			DGNFile
3855>>30	string	\120\104			DGNFile
3856>>30	string	\172\104			DGNFile
3857>>30	string	\172\105			DGNFile
3858>>30	string	\172\106			DGNFile
3859>>30	string	\234\106			DGNFile
3860>>30	string	\273\105			DGNFile
3861>>30	string	\306\106			DGNFile
3862>>30	string	\310\104			DGNFile
3863>>30	string	\341\104			DGNFile
3864>>30	string	\372\103			DGNFile
3865>>30	string	\372\104			DGNFile
3866>>30	string	\372\106			DGNFile
3867>>30	string	\376\103			DGNFile
3868>4	string	\030\000\000			CITFile
3869>4	string	\030\000\003			CITFile
3870
3871# AutoCAD
3872# Merge of the different contributions and updates from http://en.wikipedia.org/wiki/Dwg
3873# and http://www.iana.org/assignments/media-types/image/vnd.dwg
38740	string	MC0.0	DWG AutoDesk AutoCAD Release 1.0
3875!:mime image/vnd.dwg
38760	string	AC1.2	DWG AutoDesk AutoCAD Release 1.2
3877!:mime image/vnd.dwg
38780	string	AC1.3	DWG AutoDesk AutoCAD Release 1.3
3879!:mime image/vnd.dwg
38800	string	AC1.40	DWG AutoDesk AutoCAD Release 1.40
3881!:mime image/vnd.dwg
38820	string	AC1.50	DWG AutoDesk AutoCAD Release 2.05
3883!:mime image/vnd.dwg
38840	string	AC2.10	DWG AutoDesk AutoCAD Release 2.10
3885!:mime image/vnd.dwg
38860	string	AC2.21	DWG AutoDesk AutoCAD Release 2.21
3887!:mime image/vnd.dwg
38880	string	AC2.22	DWG AutoDesk AutoCAD Release 2.22
3889!:mime image/vnd.dwg
38900	string	AC1001	DWG AutoDesk AutoCAD Release 2.22
3891!:mime image/vnd.dwg
38920	string	AC1002	DWG AutoDesk AutoCAD Release 2.50
3893!:mime image/vnd.dwg
38940	string	AC1003	DWG AutoDesk AutoCAD Release 2.60
3895!:mime image/vnd.dwg
38960	string	AC1004	DWG AutoDesk AutoCAD Release 9
3897!:mime image/vnd.dwg
38980	string	AC1006	DWG AutoDesk AutoCAD Release 10
3899!:mime image/vnd.dwg
39000	string	AC1009	DWG AutoDesk AutoCAD Release 11/12
3901!:mime image/vnd.dwg
3902# AutoCAD DWG versions R13/R14 (www.autodesk.com)
3903# Written December 01, 2003 by Lester Hightower
3904# Based on the DWG File Format Specifications at http://www.opendwg.org/
3905# AutoCad, from Nahuel Greco
3906# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com)
39070	string	AC1012	DWG AutoDesk AutoCAD Release 13
3908!:mime image/vnd.dwg
39090	string	AC1014	DWG AutoDesk AutoCAD Release 14
3910!:mime image/vnd.dwg
39110	string	AC1015	DWG AutoDesk AutoCAD 2000/2002
3912!:mime image/vnd.dwg
3913
3914# A new version of AutoCAD DWG
3915# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
3916# ICQ 358572321)
3917# From various sources like:
3918# http://autodesk.blogs.com/between_the_lines/autocad-release-history.html
39190	string	AC1018	DWG AutoDesk AutoCAD 2004/2005/2006
3920!:mime image/vnd.dwg
39210	string	AC1021	DWG AutoDesk AutoCAD 2007/2008/2009
3922!:mime image/vnd.dwg
39230	string	AC1024	DWG AutoDesk AutoCAD 2010/2011/2012
3924!:mime image/vnd.dwg
39250	string	AC1027	DWG AutoDesk AutoCAD 2013/2014
3926!:mime image/vnd.dwg
3927
3928# KOMPAS 2D drawing from ASCON
3929# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor
3930# gathered nor specification
3931# ASCON http://ascon.net/main/ in English,
3932#	http://ascon.ru/ main site in Russian
3933# Extension is CDW for drawing and FRW for fragment of drawing
3934# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
3935# ICQ 358572321, http://vkontakte.ru/id16076543)
3936# From:
3937# http://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292
3938# (in russian) and my experiments
39390	string	KF
3940>2	belong	0x4E00000C	Kompas drawing 12.0 SP1
3941>2	belong	0x4D00000C	Kompas drawing 12.0
3942>2	belong	0x3200000B	Kompas drawing 11.0 SP1
3943>2	belong	0x3100000B	Kompas drawing 11.0
3944>2	belong	0x2310000A	Kompas drawing 10.0 SP1
3945>2	belong	0x2110000A	Kompas drawing 10.0
3946>2	belong	0x08000009	Kompas drawing 9.0 SP1
3947>2	belong	0x05000009	Kompas drawing 9.0
3948>2	belong	0x33010008	Kompas drawing 8+
3949>2	belong	0x1A000008	Kompas drawing 8.0
3950>2	belong	0x2C010107	Kompas drawing 7+
3951>2	belong	0x05000007	Kompas drawing 7.0
3952>2	belong	0x32000006	Kompas drawing 6+
3953>2	belong	0x09000006	Kompas drawing 6.0
3954>2	belong	0x5C009005	Kompas drawing 5.11R03
3955>2	belong	0x54009005	Kompas drawing 5.11R02
3956>2	belong	0x51009005	Kompas drawing 5.11R01
3957>2	belong	0x22009005	Kompas drawing 5.10R03
3958>2	belong	0x22009005	Kompas drawing 5.10R02 mar
3959>2	belong	0x21009005	Kompas drawing 5.10R02 febr
3960>2	belong	0x19009005	Kompas drawing 5.10R01
3961>2	belong	0xF4008005	Kompas drawing 5.9R01.003
3962>2	belong	0x1C008005	Kompas drawing 5.9R01.002
3963>2	belong	0x11008005	Kompas drawing 5.8R01.003
3964
3965# CAD: file(1) magic for computer aided design files
3966# Phillip Griffith <phillip dot griffith at gmail dot com>
3967# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications.
3968#
39690	belong	0x08051700	Bentley/Intergraph MicroStation DGN cell library
39700	belong	0x0809fe02	Bentley/Intergraph MicroStation DGN vector CAD
39710	belong	0xc809fe02	Bentley/Intergraph MicroStation DGN vector CAD
39720	beshort	0x0809		Bentley/Intergraph MicroStation
3973>0x02	byte	0xfe
3974>>0x04	beshort	0x1800		CIT raster CAD
3975
3976# 3DS (3d Studio files) Conflicts with diff output 0x3d '='
3977#16	beshort		0x3d3d		image/x-3ds
3978
3979# MegaCAD 2D/3D drawing (.prt)
3980# http://megacad.de/
3981# From: Markus Heidelberg <markus.heidelberg@web.de>
39820	string	MegaCad23\0	MegaCAD 2D/3D drawing
3983
3984#------------------------------------------------------------------------------
3985# $File: cafebabe,v 1.17 2015/01/01 17:07:00 christos Exp $
3986# Cafe Babes unite!
3987#
3988# Since Java bytecode and Mach-O universal binaries have the same magic number,
3989# the test must be performed in the same "magic" sequence to get both right.
3990# The long at offset 4 in a Mach-O universal binary tells the number of
3991# architectures; the short at offset 4 in a Java bytecode file is the JVM minor
3992# version and the short at offset 6 is the JVM major version.  Since there are only
3993# only 18 labeled Mach-O architectures at current, and the first released
3994# Java class format was version 43.0, we can safely choose any number
3995# between 18 and 39 to test the number of architectures against
3996# (and use as a hack). Let's not use 18, because the Mach-O people
3997# might add another one or two as time goes by...
3998#
3999### JAVA START ###
40000	belong		0xcafebabe
4001>4	belong		>30		compiled Java class data,
4002!:mime	application/x-java-applet
4003>>6	beshort		x	        version %d.
4004>>4	beshort		x       	\b%d
4005# Which is which?
4006#>>4	belong		0x032d		(Java 1.0)
4007#>>4	belong		0x032d		(Java 1.1)
4008>>4	belong		0x002e		(Java 1.2)
4009>>4	belong		0x002f		(Java 1.3)
4010>>4	belong		0x0030		(Java 1.4)
4011>>4	belong		0x0031		(Java 1.5)
4012>>4	belong		0x0032		(Java 1.6)
4013>>4	belong		0x0033		(Java 1.7)
4014>>4	belong		0x0034		(Java 1.8)
4015
40160	belong		0xcafed00d	JAR compressed with pack200,
4017>5	byte		x		version %d.
4018>4	byte		x		\b%d
4019!:mime	application/x-java-pack200
4020
4021
40220	belong		0xcafed00d	JAR compressed with pack200,
4023>5	byte		x		version %d.
4024>4	byte		x		\b%d
4025!:mime	application/x-java-pack200
4026
4027### JAVA END ###
4028### MACH-O START ###
4029
40300	name		mach-o		\b [
4031>0	use		mach-o-cpu	\b
4032>(8.L)	indirect			\b:
4033>0	belong		x		\b]
4034
40350	belong		0xcafebabe
4036>4	belong		1		Mach-O universal binary with 1 architecture:
4037>>8	use		mach-o		\b
4038>4	belong		>1
4039>>4	belong		<20		Mach-O universal binary with %d architectures:
4040>>>8	use		mach-o		\b
4041>>>28	use		mach-o		\b
4042>>4	belong		>2
4043>>>48	use		mach-o		\b
4044>>4	belong		>3
4045>>>68	use		mach-o		\b
4046
4047### MACH-O END ###
4048
4049#------------------------------------------------------------------------------
4050# $File: elf,v 1.68 2014/09/19 19:05:57 christos Exp $
4051# cbor:  file(1) magic for CBOR files as defined in RFC 7049
4052
40530	string	\xd9\xd9\xf7 Concise Binary Object Representation (CBOR) container
4054!:mime	application/cbor
4055>3	ubyte	<0x20	(positive integer)
4056>3	ubyte	<0x40
4057>>3	ubyte	>0x1f	(negative integer)
4058>3	ubyte	<0x60
4059>>3	ubyte	>0x3f	(byte string)
4060>3	ubyte	<0x80
4061>>3	ubyte	>0x5f	(text string)
4062>3	ubyte	<0xa0
4063>3	ubyte	>0x7f	(array)
4064>3	ubyte	<0xc0
4065>>3	ubyte	>0x9f	(map)
4066>3	ubyte	<0xe0
4067>>3	ubyte	>0xbf	(tagged)
4068>3	ubyte	>0xdf	(other)
4069
4070#------------------------------------------------------------------------------
4071# $File$
4072# CDDB: file(1) magic for CDDB(tm) format CD text data files
4073#
4074# From <steve@gracenote.com>
4075#
4076# This is the /etc/magic entry to decode datafiles as used by
4077# CDDB-enabled CD player applications.
4078#
4079
40800	search/1/w	#\040xmcd	CDDB(tm) format CD text data
4081
4082#------------------------------------------------------------------------------
4083# $File: chord,v 1.4 2009/09/19 16:28:08 christos Exp $
4084# chord: file(1) magic for Chord music sheet typesetting utility input files
4085#
4086# From Philippe De Muyter <phdm@macqel.be>
4087# File format is actually free, but many distributed files begin with `{title'
4088#
40890	string		{title		Chord text file
4090
4091# Type:	PowerTab file format
4092# URL:	http://www.power-tab.net/
4093# From:	Jelmer Vernooij <jelmer@samba.org>
40940	string		ptab\003\000	Power-Tab v3 Tablature File
40950	string		ptab\004\000	Power-Tab v4 Tablature File
4096
4097#------------------------------------------------------------------------------
4098# $File$
4099# cisco:  file(1) magic for cisco Systems routers
4100#
4101# Most cisco file-formats are covered by the generic elf code
4102#
4103# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
41040	belong&0xffffff00	0x85011400  cisco IOS microcode
4105>7	string		>\0		    for '%s'
41060	belong&0xffffff00	0x8501cb00  cisco IOS experimental microcode
4107>7	string		>\0		    for '%s'
4108
4109#------------------------------------------------------------------------------
4110# $File$
4111# citrus locale declaration
4112#
4113
41140	string		RuneCT		Citrus locale declaration for LC_CTYPE
4115
4116#------------------------------------------------------------------------------
4117# $File: c-lang,v 1.18 2013/08/14 13:06:43 christos Exp $
4118# c-lang:  file(1) magic for C and related languages programs
4119#
4120
4121# BCPL
41220	search/8192	"libhdr"	BCPL source text
4123!:mime	text/x-bcpl
41240	search/8192	"LIBHDR"	BCPL source text
4125!:mime	text/x-bcpl
4126
4127# C
41280	regex	\^#include	C source text
4129!:mime	text/x-c
41300	regex	\^char[\ \t\n]+	C source text
4131!:mime	text/x-c
41320	regex	\^double[\ \t\n]+		C source text
4133!:mime	text/x-c
41340	regex	\^extern[\ \t\n]+		C source text
4135!:mime	text/x-c
41360	regex	\^float[\ \t\n]+		C source text
4137!:mime	text/x-c
41380	regex	\^struct[\ \t\n]+		C source text
4139!:mime	text/x-c
41400	regex	\^union[\ \t\n]+		C source text
4141!:mime	text/x-c
41420	search/8192	main(		C source text
4143!:mime	text/x-c
4144
4145# C++
4146# The strength of these rules is increased so they beat the C rules above
41470	regex	\^template[\ \t\n]+	C++ source text
4148!:strength + 5
4149!:mime	text/x-c++
41500	regex	\^virtual[\ \t\n]+		C++ source text
4151!:strength + 5
4152!:mime	text/x-c++
41530	regex	\^class[\ \t\n]+		C++ source text
4154!:strength + 5
4155!:mime	text/x-c++
41560	regex	\^public:		C++ source text
4157!:strength + 5
4158!:mime	text/x-c++
41590	regex	\^private:		C++ source text
4160!:strength + 5
4161!:mime	text/x-c++
4162
4163# From: Mikhail Teterin <mi@aldan.algebra.com>
41640	string		cscope		cscope reference data
4165>7	string		x		version %.2s
4166# We skip the path here, because it is often long (so file will
4167# truncate it) and mostly redundant.
4168# The inverted index functionality was added some time between
4169# versions 11 and 15, so look for -q if version is above 14:
4170>7	string		>14
4171>>10	search/100	\ -q\ 		with inverted index
4172>10	search/100	\ -c\ 		text (non-compressed)
4173
4174#------------------------------------------------------------------------------
4175# $File: clarion,v 1.4 2009/09/19 16:28:08 christos Exp $
4176# clarion:  file(1) magic for # Clarion Personal/Professional Developer
4177# (v2 and above)
4178# From: Julien Blache <jb@jblache.org>
4179
4180# Database files
4181# signature
41820	leshort	0x3343	Clarion Developer (v2 and above) data file
4183# attributes
4184>2	leshort	&0x0001	\b, locked
4185>2	leshort	&0x0004	\b, encrypted
4186>2	leshort	&0x0008	\b, memo file exists
4187>2	leshort	&0x0010	\b, compressed
4188>2	leshort	&0x0040	\b, read only
4189# number of records
4190>5	lelong	x	\b, %d records
4191
4192# Memo files
41930	leshort	0x334d	Clarion Developer (v2 and above) memo data
4194
4195# Key/Index files
4196# No magic? :(
4197
4198# Help files
41990	leshort	0x49e0	Clarion Developer (v2 and above) help data
4200
4201#------------------------------------------------------------------------------
4202# $File: claris,v 1.6 2012/06/20 21:19:05 christos Exp $
4203# claris:  file(1) magic for claris
4204# "H. Nanosecond" <aldomel@ix.netcom.com>
4205# Claris Works a word processor, etc.
4206# Version 3.0
4207
4208# .pct claris works clip art files
4209#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
4210#*
4211#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
4212#null to byte 1000 octal
4213514	string	\377\377\377\377\000
4214>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	Claris clip art
4215514	string	\377\377\377\377\001
4216>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	Claris clip art
4217
4218# Claris works files
4219# .cwk
42200	string	\002\000\210\003\102\117\102\117\000\001\206 Claris works document
4221# .plt
42220	string	\020\341\000\000\010\010	Claris Works palette files .plt
4223
4224# .msp a dictionary file I am not sure about this I have only one .msp file
42250	string	\002\271\262\000\040\002\000\164	Claris works dictionary
4226
4227# .usp are user dictionary bits
4228# I am not sure about a magic header:
4229#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
4230#        soh   S   p   f   8   U   D  sp   ^   S  cr  nl   p   o   d   i
4231#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
4232#          a   t   r   i   s   t  sp   ^   S  cr  nl   d   i   v  sp   #
4233
4234# .mth Thesaurus
4235# starts with \0 but no magic header
4236
4237# .chy Hyphenation file
4238# I am not sure: 000 210 034 000 000
4239
4240# other claris files
4241#./windows/claris/useng.ndx: data
4242#./windows/claris/xtndtran.l32: data
4243#./windows/claris/xtndtran.lst: data
4244#./windows/claris/clworks.lbl: data
4245#./windows/claris/clworks.prf: data
4246#./windows/claris/userd.spl: data
4247
4248#------------------------------------------------------------------------------
4249# $File: clipper,v 1.6 2009/09/19 16:28:08 christos Exp $
4250# clipper:  file(1) magic for Intergraph (formerly Fairchild) Clipper.
4251#
4252# XXX - what byte order does the Clipper use?
4253#
4254# XXX - what's the "!" stuff:
4255#
4256# >18	short		!074000,000000	C1 R1
4257# >18	short		!074000,004000	C2 R1
4258# >18	short		!074000,010000	C3 R1
4259# >18	short		!074000,074000	TEST
4260#
4261# I shall assume it's ANDing the field with the first value and
4262# comparing it with the second, and rewrite it as:
4263#
4264# >18	short&074000	000000		C1 R1
4265# >18	short&074000	004000		C2 R1
4266# >18	short&074000	010000		C3 R1
4267# >18	short&074000	074000		TEST
4268#
4269# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
4270# sort, nor does SunOS 4.x, so either it's something Intergraph added
4271# in CLIX, or something AT&T added in SVR3.2 or later, or something
4272# somebody else thought was a good idea; it's not documented in the
4273# man page for this version of "magic", nor does it appear to be
4274# implemented (at least not after I blew off the bogus code to turn
4275# old-style "&"s into new-style "&"s, which just didn't work at all).
4276#
42770	short		0575		CLIPPER COFF executable (VAX #)
4278>20	short		0407		(impure)
4279>20	short		0410		(5.2 compatible)
4280>20	short		0411		(pure)
4281>20	short		0413		(demand paged)
4282>20	short		0443		(target shared library)
4283>12	long		>0		not stripped
4284>22	short		>0		- version %d
42850	short		0577		CLIPPER COFF executable
4286>18	short&074000	000000		C1 R1
4287>18	short&074000	004000		C2 R1
4288>18	short&074000	010000		C3 R1
4289>18	short&074000	074000		TEST
4290>20	short		0407		(impure)
4291>20	short		0410		(pure)
4292>20	short		0411		(separate I&D)
4293>20	short		0413		(paged)
4294>20	short		0443		(target shared library)
4295>12	long		>0		not stripped
4296>22	short		>0		- version %d
4297>48	long&01		01		alignment trap enabled
4298>52	byte		1		-Ctnc
4299>52	byte		2		-Ctsw
4300>52	byte		3		-Ctpw
4301>52	byte		4		-Ctcb
4302>53	byte		1		-Cdnc
4303>53	byte		2		-Cdsw
4304>53	byte		3		-Cdpw
4305>53	byte		4		-Cdcb
4306>54	byte		1		-Csnc
4307>54	byte		2		-Cssw
4308>54	byte		3		-Cspw
4309>54	byte		4		-Cscb
43104	string		pipe		CLIPPER instruction trace
43114	string		prof		CLIPPER instruction profile
4312
4313#------------------------------------------------------------------------------
4314# $File: commands,v 1.50 2014/05/30 16:48:44 christos Exp $
4315# commands:  file(1) magic for various shells and interpreters
4316#
4317#0	string/w	:			shell archive or script for antique kernel text
43180	string/wt	#!\ /bin/sh		POSIX shell script text executable
4319!:mime	text/x-shellscript
43200	string/wb	#!\ /bin/sh		POSIX shell script executable (binary data)
4321!:mime	text/x-shellscript
4322
43230	string/wt	#!\ /bin/csh		C shell script text executable
4324!:mime	text/x-shellscript
4325
4326# korn shell magic, sent by George Wu, gwu@clyde.att.com
43270	string/wt	#!\ /bin/ksh		Korn shell script text executable
4328!:mime	text/x-shellscript
43290	string/wb	#!\ /bin/ksh		Korn shell script executable (binary data)
4330!:mime	text/x-shellscript
4331
43320	string/wt 	#!\ /bin/tcsh		Tenex C shell script text executable
4333!:mime	text/x-shellscript
43340	string/wt	#!\ /usr/bin/tcsh	Tenex C shell script text executable
4335!:mime	text/x-shellscript
43360	string/wt 	#!\ /usr/local/tcsh	Tenex C shell script text executable
4337!:mime	text/x-shellscript
43380	string/wt	#!\ /usr/local/bin/tcsh	Tenex C shell script text executable
4339!:mime	text/x-shellscript
4340
4341#
4342# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
43430	string/wt	#!\ /bin/zsh		Paul Falstad's zsh script text executable
4344!:mime	text/x-shellscript
43450	string/wt	#!\ /usr/bin/zsh	Paul Falstad's zsh script text executable
4346!:mime	text/x-shellscript
43470	string/wt	#!\ /usr/local/bin/zsh	Paul Falstad's zsh script text executable
4348!:mime	text/x-shellscript
43490	string/wt	#!\ /usr/local/bin/ash	Neil Brown's ash script text executable
4350!:mime	text/x-shellscript
43510	string/wt	#!\ /usr/local/bin/ae	Neil Brown's ae script text executable
4352!:mime	text/x-shellscript
43530	string/wt	#!\ /bin/nawk		new awk script text executable
4354!:mime	text/x-nawk
43550	string/wt	#!\ /usr/bin/nawk	new awk script text executable
4356!:mime	text/x-nawk
43570	string/wt	#!\ /usr/local/bin/nawk	new awk script text executable
4358!:mime	text/x-nawk
43590	string/wt	#!\ /bin/gawk		GNU awk script text executable
4360!:mime	text/x-gawk
43610	string/wt	#!\ /usr/bin/gawk	GNU awk script text executable
4362!:mime	text/x-gawk
43630	string/wt	#!\ /usr/local/bin/gawk	GNU awk script text executable
4364!:mime	text/x-gawk
4365#
43660	string/wt	#!\ /bin/awk		awk script text executable
4367!:mime	text/x-awk
43680	string/wt	#!\ /usr/bin/awk	awk script text executable
4369!:mime	text/x-awk
43700	regex/4096	=^\\s{0,100}BEGIN\\s{0,100}[{]	awk or perl script text
4371
4372# AT&T Bell Labs' Plan 9 shell
43730	string/wt	#!\ /bin/rc	Plan 9 rc shell script text executable
4374
4375# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
43760	string/wt	#!\ /bin/bash	Bourne-Again shell script text executable
4377!:mime	text/x-shellscript
43780	string/wb	#!\ /bin/bash	Bourne-Again shell script executable (binary data)
4379!:mime	text/x-shellscript
43800	string/wt	#!\ /usr/bin/bash	Bourne-Again shell script text executable
4381!:mime	text/x-shellscript
43820	string/wb	#!\ /usr/bin/bash	Bourne-Again shell script executable (binary data)
4383!:mime	text/x-shellscript
43840	string/wt	#!\ /usr/local/bash	Bourne-Again shell script text executable
4385!:mime	text/x-shellscript
43860	string/wb	#!\ /usr/local/bash	Bourne-Again shell script executable (binary data)
4387!:mime	text/x-shellscript
43880	string/wt	#!\ /usr/local/bin/bash	Bourne-Again shell script text executable
4389!:mime	text/x-shellscript
43900	string/wb	#!\ /usr/local/bin/bash	Bourne-Again shell script executable (binary data)
4391!:mime	text/x-shellscript
4392
4393# PHP scripts
4394# Ulf Harnhammar <ulfh@update.uu.se>
43950	search/1/c	=<?php			PHP script text
4396!:strength + 10
4397!:mime	text/x-php
43980	search/1	=<?\n			PHP script text
4399!:mime	text/x-php
44000	search/1	=<?\r			PHP script text
4401!:mime	text/x-php
44020	search/1/w	#!\ /usr/local/bin/php	PHP script text executable
4403!:strength + 10
4404!:mime	text/x-php
44050	search/1/w	#!\ /usr/bin/php	PHP script text executable
4406!:strength + 10
4407!:mime	text/x-php
4408# Smarty compiled template, http://www.smarty.net/
4409# Elan Ruusamae <glen@delfi.ee>
44100	string	=<?php\ /*\ Smarty\ version	Smarty compiled template
4411>24	regex	[0-9.]+				\b, version %s
4412!:mime	text/x-php
4413
44140	string		Zend\x00		PHP script Zend Optimizer data
4415
44160	string/t	$!			DCL command file
4417
4418# Type: Pdmenu
4419# URL:  http://packages.debian.org/pdmenu
4420# From: Edward Betts <edward@debian.org>
44210	string		#!/usr/bin/pdmenu	Pdmenu configuration file text
4422
4423#----------------------------------------------------------------------------
4424# $File$
4425# communication
4426
4427# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3.
4428# It is used for conformance testing of communication protocols.
4429# Added by W. Borgert <debacle@debian.org>.
44300	string		$Suite			TTCN Abstract Test Suite
4431>&1	string		$SuiteId
4432>>&1	string		>\n			%s
4433>&2	string		$SuiteId
4434>>&1	string		>\n			%s
4435>&3	string		$SuiteId
4436>>&1	string		>\n			%s
4437
4438# MSC (message sequence charts) are a formal description technique,
4439# described in ITU-T Z.120, mainly used for communication protocols.
4440# Added by W. Borgert <debacle@debian.org>.
44410	string		mscdocument	Message Sequence Chart (document)
44420	string		msc		Message Sequence Chart (chart)
44430	string		submsc		Message Sequence Chart (subchart)
4444#------------------------------------------------------------------------------
4445# $File: compress,v 1.61 2014/09/12 20:57:45 christos Exp $
4446# compress:  file(1) magic for pure-compression formats (no archives)
4447#
4448# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
4449#
4450# Formats for various forms of compressed data
4451# Formats for "compress" proper have been moved into "compress.c",
4452# because it tries to uncompress it to figure out what's inside.
4453
4454# standard unix compress
44550	string		\037\235	compress'd data
4456!:mime	application/x-compress
4457!:apple	LZIVZIVU
4458>2	byte&0x80	>0		block compressed
4459>2	byte&0x1f	x		%d bits
4460
4461# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
4462#   Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
4463#	* Original filename is only at offset 10 if "extra field" absent
4464#	* Produce shorter output - notably, only report compression methods
4465#         other than 8 ("deflate", the only method defined in RFC 1952).
44660       string          \037\213        gzip compressed data
4467!:mime	application/x-gzip
4468!:strength * 2
4469>2	byte		<8		\b, reserved method
4470>2	byte		>8		\b, unknown method
4471>3	byte		&0x01		\b, ASCII
4472>3	byte		&0x02		\b, has CRC
4473>3	byte		&0x04		\b, extra field
4474>3	byte&0xC	=0x08
4475>>10	string		x		\b, was "%s"
4476>3	byte		&0x10		\b, has comment
4477>3	byte		&0x20		\b, encrypted
4478>4	ledate		>0		\b, last modified: %s
4479>8	byte		2		\b, max compression
4480>8	byte		4		\b, max speed
4481>9	byte		=0x00		\b, from FAT filesystem (MS-DOS, OS/2, NT)
4482>9	byte		=0x01		\b, from Amiga
4483>9	byte		=0x02		\b, from VMS
4484>9	byte		=0x03		\b, from Unix
4485>9	byte		=0x04		\b, from VM/CMS
4486>9	byte		=0x05		\b, from Atari
4487>9	byte		=0x06		\b, from HPFS filesystem (OS/2, NT)
4488>9	byte		=0x07		\b, from MacOS
4489>9	byte		=0x08		\b, from Z-System
4490>9	byte		=0x09		\b, from CP/M
4491>9	byte		=0x0A		\b, from TOPS/20
4492>9	byte		=0x0B		\b, from NTFS filesystem (NT)
4493>9	byte		=0x0C		\b, from QDOS
4494>9	byte		=0x0D		\b, from Acorn RISCOS
4495
4496# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
44970	string		\037\036	packed data
4498!:mime	application/octet-stream
4499>2	belong		>1		\b, %d characters originally
4500>2	belong		=1		\b, %d character originally
4501#
4502# This magic number is byte-order-independent.
45030	short		0x1f1f		old packed data
4504!:mime	application/octet-stream
4505
4506# XXX - why *two* entries for "compacted data", one of which is
4507# byte-order independent, and one of which is byte-order dependent?
4508#
45090	short		0x1fff		compacted data
4510!:mime	application/octet-stream
4511# This string is valid for SunOS (BE) and a matching "short" is listed
4512# in the Ultrix (LE) magic file.
45130	string		\377\037	compacted data
4514!:mime	application/octet-stream
45150	short		0145405		huf output
4516!:mime	application/octet-stream
4517
4518# bzip2
45190	string		BZh		bzip2 compressed data
4520!:mime	application/x-bzip2
4521>3	byte		>47		\b, block size = %c00k
4522
4523# lzip
45240	string		LZIP		lzip compressed data
4525!:mime application/x-lzip
4526>4	byte		x		\b, version: %d
4527
4528# squeeze and crunch
4529# Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
45300	beshort		0x76FF		squeezed data,
4531>4	string		x		original name %s
45320	beshort		0x76FE		crunched data,
4533>2	string		x		original name %s
45340	beshort		0x76FD		LZH compressed data,
4535>2	string		x		original name %s
4536
4537# Freeze
45380	string		\037\237	frozen file 2.1
45390	string		\037\236	frozen file 1.0 (or gzip 0.5)
4540
4541# SCO compress -H (LZH)
45420	string		\037\240	SCO compress -H (LZH) data
4543
4544# European GSM 06.10 is a provisional standard for full-rate speech
4545# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
4546# excitation/long term prediction) coding at 13 kbit/s.
4547#
4548# There's only a magic nibble (4 bits); that nibble repeats every 33
4549# bytes.  This isn't suited for use, but maybe we can use it someday.
4550#
4551# This will cause very short GSM files to be declared as data and
4552# mismatches to be declared as data too!
4553#0	byte&0xF0	0xd0		data
4554#>33	byte&0xF0	0xd0
4555#>66	byte&0xF0	0xd0
4556#>99	byte&0xF0	0xd0
4557#>132	byte&0xF0	0xd0		GSM 06.10 compressed audio
4558
4559# bzip	a block-sorting file compressor
4560#	by Julian Seward <sewardj@cs.man.ac.uk> and others
4561#
4562#0	string		BZ		bzip compressed data
4563#>2	byte		x		\b, version: %c
4564#>3	string		=1		\b, compression block size 100k
4565#>3	string		=2		\b, compression block size 200k
4566#>3	string		=3		\b, compression block size 300k
4567#>3	string		=4		\b, compression block size 400k
4568#>3	string		=5		\b, compression block size 500k
4569#>3	string		=6		\b, compression block size 600k
4570#>3	string		=7		\b, compression block size 700k
4571#>3	string		=8		\b, compression block size 800k
4572#>3	string		=9		\b, compression block size 900k
4573
4574# lzop from <markus.oberhumer@jk.uni-linz.ac.at>
45750	string		\x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a	lzop compressed data
4576>9	beshort		<0x0940
4577>>9	byte&0xf0	=0x00		- version 0.
4578>>9	beshort&0x0fff	x		\b%03x,
4579>>13	byte		1		LZO1X-1,
4580>>13	byte		2		LZO1X-1(15),
4581>>13	byte		3		LZO1X-999,
4582## >>22	bedate		>0		last modified: %s,
4583>>14	byte		=0x00		os: MS-DOS
4584>>14	byte		=0x01		os: Amiga
4585>>14	byte		=0x02		os: VMS
4586>>14	byte		=0x03		os: Unix
4587>>14	byte		=0x05		os: Atari
4588>>14	byte		=0x06		os: OS/2
4589>>14	byte		=0x07		os: MacOS
4590>>14	byte		=0x0A		os: Tops/20
4591>>14	byte		=0x0B		os: WinNT
4592>>14	byte		=0x0E		os: Win32
4593>9	beshort		>0x0939
4594>>9	byte&0xf0	=0x00		- version 0.
4595>>9	byte&0xf0	=0x10		- version 1.
4596>>9	byte&0xf0	=0x20		- version 2.
4597>>9	beshort&0x0fff	x		\b%03x,
4598>>15	byte		1		LZO1X-1,
4599>>15	byte		2		LZO1X-1(15),
4600>>15	byte		3		LZO1X-999,
4601## >>25	bedate		>0		last modified: %s,
4602>>17	byte		=0x00		os: MS-DOS
4603>>17	byte		=0x01		os: Amiga
4604>>17	byte		=0x02		os: VMS
4605>>17	byte		=0x03		os: Unix
4606>>17	byte		=0x05		os: Atari
4607>>17	byte		=0x06		os: OS/2
4608>>17	byte		=0x07		os: MacOS
4609>>17	byte		=0x0A		os: Tops/20
4610>>17	byte		=0x0B		os: WinNT
4611>>17	byte		=0x0E		os: Win32
4612
4613# 4.3BSD-Quasijarus Strong Compression
4614# http://minnie.tuhs.org/Quasijarus/compress.html
46150	string		\037\241	Quasijarus strong compressed data
4616
4617# From: Cory Dikkers <cdikkers@swbell.net>
46180	string		XPKF		Amiga xpkf.library compressed data
46190	string		PP11		Power Packer 1.1 compressed data
46200	string		PP20		Power Packer 2.0 compressed data,
4621>4	belong		0x09090909	fast compression
4622>4	belong		0x090A0A0A	mediocre compression
4623>4	belong		0x090A0B0B	good compression
4624>4	belong		0x090A0C0C	very good compression
4625>4	belong		0x090A0C0D	best compression
4626
4627# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
4628# http://www.7-zip.org or DOC/7zFormat.txt
4629#
46300	string		7z\274\257\047\034	7-zip archive data,
4631>6	byte		x			version %d
4632>7	byte		x			\b.%d
4633!:mime	application/x-7z-compressed
4634
4635# Type: LZMA
46360	lelong&0xffffff	=0x5d
4637>12	leshort		0xff			LZMA compressed data,
4638!:mime	application/x-lzma
4639>>5	lequad		=0xffffffffffffffff	streamed
4640>>5	lequad		!0xffffffffffffffff	non-streamed, size %lld
4641>12	leshort		0			LZMA compressed data,
4642>>5	lequad		=0xffffffffffffffff	streamed
4643>>5	lequad		!0xffffffffffffffff	non-streamed, size %lld
4644
4645# http://tukaani.org/xz/xz-file-format.txt
46460	ustring		\xFD7zXZ\x00		XZ compressed data
4647!:mime	application/x-xz
4648
4649# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt
46500	string		LRZI			LRZIP compressed data
4651>4	byte		x			- version %d
4652>5	byte		x			\b.%d
4653!:mime	application/x-lrzip
4654
4655# http://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html
46560	lelong		0x184d2204	LZ4 compressed data (v1.4+)
4657!:mime	application/x-lz4
4658# Added by osm0sis@xda-developers.com
46590 	lelong		0x184c2103	LZ4 compressed data (v1.0-v1.3)
4660!:mime	application/x-lz4
46610	lelong		0x184c2102	LZ4 compressed data (v0.1-v0.9)
4662!:mime	application/x-lz4
4663
4664# AFX compressed files (Wolfram Kleff)
46652	string		-afx-		AFX compressed file data
4666
4667# Supplementary magic data for the file(1) command to support
4668# rzip(1).  The format is described in magic(5).
4669#
4670# Copyright (C) 2003 by Andrew Tridgell.  You may do whatever you want with
4671# this file.
4672#
46730	string		RZIP		rzip compressed data
4674>4	byte		x		- version %d
4675>5	byte		x		\b.%d
4676>6	belong		x		(%d bytes)
4677
46780	string		ArC\x01		FreeArc archive <http://freearc.org>
4679
4680# Type:	DACT compressed files
46810	long	0x444354C3	DACT compressed data
4682>4	byte	>-1		(version %i.
4683>5	byte	>-1		%i.
4684>6	byte	>-1		%i)
4685>7	long	>0		, original size: %i bytes
4686>15	long	>30		, block size: %i bytes
4687
4688# Valve Pack (VPK) files
46890	lelong	0x55aa1234	Valve Pak file
4690>0x4	lelong	x		\b, version %u
4691>0x8	lelong	x		\b, %u entries
4692
4693# Snappy framing format
4694# http://code.google.com/p/snappy/source/browse/trunk/framing_format.txt
46950	string	\377\006\0\0sNaPpY	snappy framed data
4696!:mime	application/x-snappy-framed
4697
4698# qpress, http://www.quicklz.com/
46990	string	qpress10	qpress compressed data
4700!:mime	application/x-qpress
4701
4702# Zlib https://www.ietf.org/rfc/rfc6713.txt
47030	beshort%31	=0
4704>0	byte&0xf	=8
4705>>0	byte&0x80 	=0	zlib compressed data
4706!:mime	application/zlib
4707
4708#------------------------------------------------------------------------------
4709# $File: console,v 1.18 2010/09/20 19:19:17 rrt Exp $
4710# Console game magic
4711# Toby Deshane <hac@shoelace.digivill.net>
4712#    ines:  file(1) magic for Marat's iNES Nintendo Entertainment System
4713#           ROM dump format
4714
47150 string NES\032 iNES ROM dump,
4716>4 byte  x     %dx16k PRG
4717>5 byte  x     \b, %dx8k CHR
4718>6 byte&0x01  =0x1  \b, [Vert.]
4719>6 byte&0x01  =0x0  \b, [Horiz.]
4720>6 byte&0x02  =0x2  \b, [SRAM]
4721>6 byte&0x04  =0x4  \b, [Trainer]
4722>6 byte&0x04  =0x8  \b, [4-Scr]
4723
4724#------------------------------------------------------------------------------
4725# gameboy:  file(1) magic for the Nintendo (Color) Gameboy raw ROM format
4726#
47270x104 belong 0xCEED6666 Gameboy ROM:
4728>0x134 string >\0 "%.16s"
4729>0x146 byte 0x03  \b,[SGB]
4730>0x147 byte 0x00  \b, [ROM ONLY]
4731>0x147 byte 0x01  \b, [ROM+MBC1]
4732>0x147 byte 0x02  \b, [ROM+MBC1+RAM]
4733>0x147 byte 0x03  \b, [ROM+MBC1+RAM+BATT]
4734>0x147 byte 0x05  \b, [ROM+MBC2]
4735>0x147 byte 0x06  \b, [ROM+MBC2+BATTERY]
4736>0x147 byte 0x08  \b, [ROM+RAM]
4737>0x147 byte 0x09  \b, [ROM+RAM+BATTERY]
4738>0x147 byte 0x0B  \b, [ROM+MMM01]
4739>0x147 byte 0x0C  \b, [ROM+MMM01+SRAM]
4740>0x147 byte 0x0D  \b, [ROM+MMM01+SRAM+BATT]
4741>0x147 byte 0x0F  \b, [ROM+MBC3+TIMER+BATT]
4742>0x147 byte 0x10  \b, [ROM+MBC3+TIMER+RAM+BATT]
4743>0x147 byte 0x11  \b, [ROM+MBC3]
4744>0x147 byte 0x12  \b, [ROM+MBC3+RAM]
4745>0x147 byte 0x13  \b, [ROM+MBC3+RAM+BATT]
4746>0x147 byte 0x19  \b, [ROM+MBC5]
4747>0x147 byte 0x1A  \b, [ROM+MBC5+RAM]
4748>0x147 byte 0x1B  \b, [ROM+MBC5+RAM+BATT]
4749>0x147 byte 0x1C  \b, [ROM+MBC5+RUMBLE]
4750>0x147 byte 0x1D  \b, [ROM+MBC5+RUMBLE+SRAM]
4751>0x147 byte 0x1E  \b, [ROM+MBC5+RUMBLE+SRAM+BATT]
4752>0x147 byte 0x1F  \b, [Pocket Camera]
4753>0x147 byte 0xFD  \b, [Bandai TAMA5]
4754>0x147 byte 0xFE  \b, [Hudson HuC-3]
4755>0x147 byte 0xFF  \b, [Hudson HuC-1]
4756
4757>0x148 byte 0     \b, ROM: 256Kbit
4758>0x148 byte 1     \b, ROM: 512Kbit
4759>0x148 byte 2     \b, ROM: 1Mbit
4760>0x148 byte 3     \b, ROM: 2Mbit
4761>0x148 byte 4     \b, ROM: 4Mbit
4762>0x148 byte 5     \b, ROM: 8Mbit
4763>0x148 byte 6     \b, ROM: 16Mbit
4764>0x148 byte 0x52  \b, ROM: 9Mbit
4765>0x148 byte 0x53  \b, ROM: 10Mbit
4766>0x148 byte 0x54  \b, ROM: 12Mbit
4767
4768>0x149 byte 1     \b, RAM: 16Kbit
4769>0x149 byte 2     \b, RAM: 64Kbit
4770>0x149 byte 3     \b, RAM: 128Kbit
4771>0x149 byte 4     \b, RAM: 1Mbit
4772
4773#>0x14e long  x     \b, CRC: %x
4774
4775#------------------------------------------------------------------------------
4776# genesis:  file(1) magic for the Sega MegaDrive/Genesis raw ROM format
4777#
47780x100 string SEGA  Sega MegaDrive/Genesis raw ROM dump
4779>0x120 string >\0 Name: "%.16s"
4780>0x110 string >\0 %.16s
4781>0x1B0 string RA with SRAM
4782
4783#------------------------------------------------------------------------------
4784# genesis:  file(1) magic for the Super MegaDrive ROM dump format
4785#
47860x280 string EAGN  Super MagicDrive ROM dump
4787>0 byte x %dx16k blocks
4788>2 byte 0 \b, last in series or standalone
4789>2 byte >0 \b, split ROM
4790>8 byte 0xAA
4791>9 byte 0xBB
4792
4793#------------------------------------------------------------------------------
4794# genesis:  file(1) alternate magic for the Super MegaDrive ROM dump format
4795#
47960x280 string EAMG  Super MagicDrive ROM dump
4797>0 byte x %dx16k blocks
4798>2 byte x \b, last in series or standalone
4799>8 byte 0xAA
4800>9 byte 0xBB
4801
4802#------------------------------------------------------------------------------
4803# smsgg:  file(1) magic for Sega Master System and Game Gear ROM dumps
4804#
4805# Does not detect all images.  Very preliminary guesswork.  Need more data
4806# on format.
4807#
4808# FIXME: need a little more info...;P
4809#
4810#0 byte 0xF3
4811#>1 byte 0xED  Sega Master System/Game Gear ROM dump
4812#>1 byte 0x31  Sega Master System/Game Gear ROM dump
4813#>1 byte 0xDB  Sega Master System/Game Gear ROM dump
4814#>1 byte 0xAF  Sega Master System/Game Gear ROM dump
4815#>1 byte 0xC3  Sega Master System/Game Gear ROM dump
4816
4817#------------------------------------------------------------------------------
4818# dreamcast:  file(1) uncertain magic for the Sega Dreamcast VMU image format
4819#
48200 belong 0x21068028   Sega Dreamcast VMU game image
48210 string LCDi         Dream Animator file
4822
4823#------------------------------------------------------------------------------
4824# v64: file(1) uncertain magic for the V64 format N64 ROM dumps
4825#
48260 belong 0x37804012    V64 Nintendo 64 ROM dump
4827
4828# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
4829# Nintendo .nds
4830192	string	\044\377\256Qi\232	Nintendo DS Game ROM Image
4831# Nintendo .gba
48320	string	\056\000\000\352$\377\256Qi	Nintendo Game Boy Advance ROM Image
4833
4834#------------------------------------------------------------------------------
4835# msx: file(1) magic for MSX game cartridge dumps
4836# Too simple - MPi
4837#0 beshort 0x4142 MSX game cartridge dump
4838
4839#------------------------------------------------------------------------------
4840# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
48410	string	PS-X\ EXE	Sony Playstation executable
4842#  Area:
4843>113	string	x		(%s)
4844
4845#------------------------------------------------------------------------------
4846# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>)
48470       string          XBEH            XBE, Microsoft Xbox executable
4848# probabilistic checks whether signed or not
4849>0x0004 ulelong =0x0
4850>>&2    ulelong =0x0
4851>>>&2   ulelong =0x0  \b, not signed
4852>0x0004 ulelong >0
4853>>&2    ulelong >0
4854>>>&2   ulelong >0    \b, signed
4855# expect base address of 0x10000
4856>0x0104               ulelong =0x10000
4857>>(0x0118-0x0FF60)    ulelong&0x80000007  0x80000007 \b, all regions
4858>>(0x0118-0x0FF60)    ulelong&0x80000007  !0x80000007
4859>>>(0x0118-0x0FF60)   ulelong >0           (regions:
4860>>>>(0x0118-0x0FF60)  ulelong &0x00000001  NA
4861>>>>(0x0118-0x0FF60)  ulelong &0x00000002  Japan
4862>>>>(0x0118-0x0FF60)  ulelong &0x00000004  Rest_of_World
4863>>>>(0x0118-0x0FF60)  ulelong &0x80000000  Manufacturer
4864>>>(0x0118-0x0FF60)   ulelong >0           \b)
4865
4866# --------------------------------
4867# Microsoft Xbox data file formats
48680       string          XIP0            XIP, Microsoft Xbox data
48690       string          XTF0            XTF, Microsoft Xbox data
4870
4871# Atari Lynx cartridge dump (EXE/BLL header)
4872# From: "Stefan A. Haubenthal" <polluks@web.de>
4873
4874# Double-check that the image type matches too, 0x8008 conflicts with
4875# 8 character OMF-86 object file headers.
48760	beshort		0x8008
4877>6	string		BS93		Lynx homebrew cartridge
4878>>2	beshort		x		\b, RAM start $%04x
4879>6	string		LYNX		Lynx cartridge
4880>>2	beshort		x		\b, RAM start $%04x
4881
4882# Opera file system that is used on the 3DO console
4883# From: Serge van den Boom <svdb@stack.nl>
48840	string		\x01ZZZZZ\x01	3DO "Opera" file system
4885
4886# From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
48870	string		GBS		Nintendo Gameboy Music/Audio Data
488812	string		GameBoy\ Music\ Module	Nintendo Gameboy Music Module
4889
4890# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at>
48910	string	PPF30			Playstation Patch File version 3.0
4892>5	byte	0			\b, PPF 1.0 patch
4893>5	byte	1			\b, PPF 2.0 patch
4894>5	byte	2			\b, PPF 3.0 patch
4895>>56	byte	0			\b, Imagetype BIN (any)
4896>>56	byte	1			\b, Imagetype GI (PrimoDVD)
4897>>57	byte	0			\b, Blockcheck disabled
4898>>57	byte	1			\b, Blockcheck enabled
4899>>58	byte	0			\b, Undo data not available
4900>>58	byte	1			\b, Undo data available
4901>6	string	x			\b, description: %s
4902
49030	string	PPF20			Playstation Patch File version 2.0
4904>5	byte	0			\b, PPF 1.0 patch
4905>5	byte	1			\b, PPF 2.0 patch
4906>>56	lelong	>0			\b, size of file to patch %d
4907>6	string	x			\b, description: %s
4908
49090	string	PPF10			Playstation Patch File version 1.0
4910>5	byte	0			\b, Simple Encoding
4911>6	string	x			\b, description: %s
4912
4913# From: Daniel Dawson <ddawson@icehouse.net>
4914# SNES9x .smv "movie" file format.
49150		string		SMV\x1A	SNES9x input recording
4916>0x4		lelong		x	\b, version %d
4917# version 4 is latest so far
4918>0x4		lelong		<5
4919>>0x8		ledate		x	\b, recorded at %s
4920>>0xc		lelong		>0	\b, rerecorded %d times
4921>>0x10		lelong		x	\b, %d frames long
4922>>0x14		byte		>0	\b, data for controller(s):
4923>>>0x14		byte		&0x1	#1
4924>>>0x14		byte		&0x2	#2
4925>>>0x14		byte		&0x4	#3
4926>>>0x14		byte		&0x8	#4
4927>>>0x14		byte		&0x10	#5
4928>>0x15		byte		^0x1	\b, begins from snapshot
4929>>0x15		byte		&0x1	\b, begins from reset
4930>>0x15		byte		^0x2	\b, NTSC standard
4931>>0x15		byte		&0x2	\b, PAL standard
4932>>0x17		byte		&0x1    \b, settings:
4933# WIP1Timing not used as of version 4
4934>>>0x4		lelong		<4
4935>>>>0x17	byte		&0x2	WIP1Timing
4936>>>0x17		byte		&0x4	Left+Right
4937>>>0x17		byte		&0x8	VolumeEnvX
4938>>>0x17		byte		&0x10	FakeMute
4939>>>0x17		byte		&0x20	SyncSound
4940# New flag as of version 4
4941>>>0x4		lelong		>3
4942>>>>0x17	byte		&0x80	NoCPUShutdown
4943>>0x4		lelong		<4
4944>>>0x18		lelong		>0x23
4945>>>>0x20	leshort		!0
4946>>>>>0x20	lestring16	x	\b, metadata: "%s"
4947>>0x4		lelong		>3
4948>>>0x24		byte		>0	\b, port 1:
4949>>>>0x24	byte		1	joypad
4950>>>>0x24	byte		2	mouse
4951>>>>0x24	byte		3	SuperScope
4952>>>>0x24	byte		4	Justifier
4953>>>>0x24	byte		5	multitap
4954>>>0x24		byte		>0	\b, port 2:
4955>>>>0x25	byte		1	joypad
4956>>>>0x25	byte		2	mouse
4957>>>>0x25	byte		3	SuperScope
4958>>>>0x25	byte		4	Justifier
4959>>>>0x25	byte		5	multitap
4960>>>0x18		lelong		>0x43
4961>>>>0x40	leshort		!0
4962>>>>>0x40	lestring16	x	\b, metadata: "%s"
4963>>0x17		byte		&0x40   \b, ROM:
4964>>>(0x18.l-26)	lelong		x	CRC32 0x%08x
4965>>>(0x18.l-23)	string		x	"%s"
4966
4967# Type: scummVM savegame files
4968# From: Sven Hartge <debian@ds9.argh.org>
49690	string	SCVM	ScummVM savegame
4970>12	string	>\0	"%s"
4971
4972#------------------------------------------------------------------------------
4973# $File: convex,v 1.7 2009/09/19 16:28:08 christos Exp $
4974# convex:  file(1) magic for Convex boxes
4975#
4976# Convexes are big-endian.
4977#
4978# /*\
4979#  * Below are the magic numbers and tests added for Convex.
4980#  * Added at beginning, because they are expected to be used most.
4981# \*/
49820	belong	0507	Convex old-style object
4983>16	belong	>0	not stripped
49840	belong	0513	Convex old-style demand paged executable
4985>16	belong	>0	not stripped
49860	belong	0515	Convex old-style pre-paged executable
4987>16	belong	>0	not stripped
49880	belong	0517	Convex old-style pre-paged, non-swapped executable
4989>16	belong	>0	not stripped
49900	belong	0x011257	Core file
4991#
4992# The following are a series of dump format magic numbers.  Each one
4993# corresponds to a drastically different dump format.  The first on is
4994# the original dump format on a 4.1 BSD or earlier file system.  The
4995# second marks the change between the 4.1 file system and the 4.2 file
4996# system.  The Third marks the changing of the block size from 1K
4997# to 2K to be compatible with an IDC file system.  The fourth indicates
4998# a dump that is dependent on Convex Storage Manager, because data in
4999# secondary storage is not physically contained within the dump.
5000# The restore program uses these number to determine how the data is
5001# to be extracted.
5002#
500324	belong	=60013	dump format, 4.2 or 4.3 BSD (IDC compatible)
500424	belong	=60014	dump format, Convex Storage Manager by-reference dump
5005#
5006# what follows is a bunch of bit-mask checks on the flags field of the opthdr.
5007# If there is no `=' sign, assume just checking for whether the bit is set?
5008#
50090	belong	0601		Convex SOFF
5010>88	belong&0x000f0000	=0x00000000	c1
5011>88	belong			&0x00010000	c2
5012>88	belong			&0x00020000	c2mp
5013>88	belong			&0x00040000	parallel
5014>88	belong			&0x00080000	intrinsic
5015>88	belong			&0x00000001	demand paged
5016>88	belong			&0x00000002	pre-paged
5017>88	belong			&0x00000004	non-swapped
5018>88	belong			&0x00000008	POSIX
5019#
5020>84	belong			&0x80000000	executable
5021>84	belong			&0x40000000	object
5022>84	belong&0x20000000	=0		not stripped
5023>84	belong&0x18000000	=0x00000000	native fpmode
5024>84	belong&0x18000000	=0x10000000	ieee fpmode
5025>84	belong&0x18000000	=0x18000000	undefined fpmode
5026#
50270	belong			0605		Convex SOFF core
5028#
50290	belong			0607		Convex SOFF checkpoint
5030>88	belong&0x000f0000	=0x00000000	c1
5031>88	belong			&0x00010000	c2
5032>88	belong			&0x00020000	c2mp
5033>88	belong			&0x00040000	parallel
5034>88	belong			&0x00080000	intrinsic
5035>88	belong			&0x00000008	POSIX
5036#
5037>84	belong&0x18000000	=0x00000000	native fpmode
5038>84	belong&0x18000000	=0x10000000	ieee fpmode
5039>84	belong&0x18000000	=0x18000000	undefined fpmode
5040
5041#------------------------------------------------------------------------------
5042# $File$
5043# cracklib:  file (1) magic for cracklib v2.7
5044
50450	lelong	0x70775631	Cracklib password index, little endian
5046>4	long	>0		(%i words)
5047>4	long	0		("64-bit")
5048>>8	long	>-1		(%i words)
50490	belong	0x70775631	Cracklib password index, big endian
5050>4	belong	>-1		(%i words)
5051# really bellong 0x0000000070775631
50520	search/1	\0\0\0\0pwV1	Cracklib password index, big endian ("64-bit")
5053>12	belong	>0		(%i words)
5054
5055# ----------------------------------------------------------------------------
5056# $File$
5057# ctags:  file (1) magic for Exuberant Ctags files
5058# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de>
50590	search/1	=!_TAG	Exuberant Ctags tag file text
5060
5061#--------------------------------------------------------------
5062# ctf:  file(1) magic for CTF (Common Trace Format) trace files
5063#
5064# Specs. available here: <http://www.efficios.com/ctf>
5065#--------------------------------------------------------------
5066
5067# CTF trace data
50680	lelong	0xc1fc1fc1	Common Trace Format (CTF) trace data (LE)
50690	belong	0xc1fc1fc1	Common Trace Format (CTF) trace data (BE)
5070
5071# CTF metadata (packetized)
50720	lelong	0x75d11d57	Common Trace Format (CTF) packetized metadata (LE)
5073>35	byte	x		\b, v%d
5074>36	byte	x		\b.%d
50750	belong	0x75d11d57	Common Trace Format (CTF) packetized metadata (BE)
5076>35	byte	x		\b, v%d
5077>36	byte	x		\b.%d
5078
5079# CTF metadata (plain text)
50800	string	/*\x20CTF\x20   Common Trace Format (CTF) plain text metadata
5081!:strength + 5			# this is to make sure we beat C
5082>&0	regex	[0-9]+\.[0-9]+	\b, v%s
5083
5084#------------------------------------------------------------------------------
5085# $File: cubemaps,v 1.0 2011/12/22 09:01:05 christos Exp $
5086# file(1) magic(5) data for cubemaps  Martin Erik Werner <martinerikwerner@gmail.com>
5087#
50880	string	ACMP	Map file for the AssaultCube FPS game
50890	string	CUBE	Map file for cube and cube2 engine games
50900	string	MAPZ)	Map file for the Blood Frontier/Red Eclipse FPS games
5091
5092#------------------------------------------------------------------------------
5093# $File: cups,v 1.2 2012/11/02 21:50:29 christos Exp $
5094# Cups: file(1) magic for the cups raster file format
5095# From: Laurent Martelli <martellilaurent@gmail.com>
5096# http://www.cups.org/documentation.php/spec-raster.html
5097#
5098
50990	name		cups-le
5100>280	lelong		x		\b, %d
5101>284	lelong		x		\bx%d dpi
5102>376	lelong		x		\b, %dx
5103>380	lelong		x		\b%d pixels
5104>388	lelong		x		%d bits/color
5105>392	lelong		x		%d bits/pixel
5106>400	lelong		0		ColorOrder=Chunky
5107>400	lelong		1		ColorOrder=Banded
5108>400	lelong		2		ColorOrder=Planar
5109>404	lelong		0		ColorSpace=gray
5110>404	lelong		1		ColorSpace=RGB
5111>404	lelong		2		ColorSpace=RGBA
5112>404	lelong		3		ColorSpace=black
5113>404	lelong		4		ColorSpace=CMY
5114>404	lelong		5		ColorSpace=YMC
5115>404	lelong		6		ColorSpace=CMYK
5116>404	lelong		7		ColorSpace=YMCK
5117>404	lelong		8		ColorSpace=KCMY
5118>404	lelong		9		ColorSpace=KCMYcm
5119>404	lelong		10		ColorSpace=GMCK
5120>404	lelong		11		ColorSpace=GMCS
5121>404	lelong		12		ColorSpace=WHITE
5122>404	lelong		13		ColorSpace=GOLD
5123>404	lelong		14		ColorSpace=SILVER
5124>404	lelong		15		ColorSpace=CIE XYZ
5125>404	lelong		16		ColorSpace=CIE Lab
5126>404	lelong		17		ColorSpace=RGBW
5127>404	lelong		18		ColorSpace=sGray
5128>404	lelong		19		ColorSpace=sRGB
5129>404	lelong		20		ColorSpace=AdobeRGB
5130
5131# Cups Raster image format, Big Endian
51320	string		RaS
5133>3	string		t		Cups Raster version 1, Big Endian
5134>3	string		2		Cups Raster version 2, Big Endian
5135>3	string		3		Cups Raster version 3, Big Endian
5136!:mime	application/vnd.cups-raster
5137>0	use		^cups-le
5138
5139
5140# Cups Raster image format, Little Endian
51411	string		SaR
5142>0	string		t		Cups Raster version 1, Little Endian
5143>0	string		2		Cups Raster version 2, Little Endian
5144>0	string		3		Cups Raster version 3, Little Endian
5145!:mime	application/vnd.cups-raster
5146>0	use		cups-le
5147
5148#------------------------------------------------------------------------------
5149# $File$
5150# dact:  file(1) magic for DACT compressed files
5151#
51520	long		0x444354C3	DACT compressed data
5153>4	byte		>-1		(version %i.
5154>5	byte		>-1		$BS%i.
5155>6	byte		>-1		$BS%i)
5156>7	long		>0		$BS, original size: %i bytes
5157>15	long		>30		$BS, block size: %i bytes
5158
5159#------------------------------------------------------------------------------
5160# $File: database,v 1.42 2014/08/19 14:18:04 christos Exp $
5161# database:  file(1) magic for various databases
5162#
5163# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
5164#
5165#
5166# GDBM magic numbers
5167#  Will be maintained as part of the GDBM distribution in the future.
5168#  <downsj@teeny.org>
51690	belong	0x13579acd	GNU dbm 1.x or ndbm database, big endian, 32-bit
5170!:mime	application/x-gdbm
51710	belong	0x13579ace	GNU dbm 1.x or ndbm database, big endian, old
5172!:mime	application/x-gdbm
51730	belong	0x13579acf	GNU dbm 1.x or ndbm database, big endian, 64-bit
5174!:mime	application/x-gdbm
51750	lelong	0x13579acd	GNU dbm 1.x or ndbm database, little endian, 32-bit
5176!:mime	application/x-gdbm
51770	lelong	0x13579ace	GNU dbm 1.x or ndbm database, little endian, old
5178!:mime	application/x-gdbm
51790	lelong	0x13579acf	GNU dbm 1.x or ndbm database, little endian, 64-bit
5180!:mime	application/x-gdbm
51810	string	GDBM		GNU dbm 2.x database
5182!:mime	application/x-gdbm
5183#
5184# Berkeley DB
5185#
5186# Ian Darwin's file /etc/magic files: big/little-endian version.
5187#
5188# Hash 1.85/1.86 databases store metadata in network byte order.
5189# Btree 1.85/1.86 databases store the metadata in host byte order.
5190# Hash and Btree 2.X and later databases store the metadata in host byte order.
5191
51920	long	0x00061561	Berkeley DB
5193!:mime	application/x-dbm
5194>8	belong	4321
5195>>4	belong	>2		1.86
5196>>4	belong	<3		1.85
5197>>4	belong	>0		(Hash, version %d, native byte-order)
5198>8	belong	1234
5199>>4	belong	>2		1.86
5200>>4	belong	<3		1.85
5201>>4	belong	>0		(Hash, version %d, little-endian)
5202
52030	belong	0x00061561	Berkeley DB
5204>8	belong	4321
5205>>4	belong	>2		1.86
5206>>4	belong	<3		1.85
5207>>4	belong	>0		(Hash, version %d, big-endian)
5208>8	belong	1234
5209>>4	belong	>2		1.86
5210>>4	belong	<3		1.85
5211>>4	belong	>0		(Hash, version %d, native byte-order)
5212
52130	long	0x00053162	Berkeley DB 1.85/1.86
5214>4	long	>0		(Btree, version %d, native byte-order)
52150	belong	0x00053162	Berkeley DB 1.85/1.86
5216>4	belong	>0		(Btree, version %d, big-endian)
52170	lelong	0x00053162	Berkeley DB 1.85/1.86
5218>4	lelong	>0		(Btree, version %d, little-endian)
5219
522012	long	0x00061561	Berkeley DB
5221>16	long	>0		(Hash, version %d, native byte-order)
522212	belong	0x00061561	Berkeley DB
5223>16	belong	>0		(Hash, version %d, big-endian)
522412	lelong	0x00061561	Berkeley DB
5225>16	lelong	>0		(Hash, version %d, little-endian)
5226
522712	long	0x00053162	Berkeley DB
5228>16	long	>0		(Btree, version %d, native byte-order)
522912	belong	0x00053162	Berkeley DB
5230>16	belong	>0		(Btree, version %d, big-endian)
523112	lelong	0x00053162	Berkeley DB
5232>16	lelong	>0		(Btree, version %d, little-endian)
5233
523412	long	0x00042253	Berkeley DB
5235>16	long	>0		(Queue, version %d, native byte-order)
523612	belong	0x00042253	Berkeley DB
5237>16	belong	>0		(Queue, version %d, big-endian)
523812	lelong	0x00042253	Berkeley DB
5239>16	lelong	>0		(Queue, version %d, little-endian)
5240
5241# From Max Bowsher.
524212	long	0x00040988	Berkeley DB
5243>16	long	>0		(Log, version %d, native byte-order)
524412	belong	0x00040988	Berkeley DB
5245>16	belong	>0		(Log, version %d, big-endian)
524612	lelong	0x00040988	Berkeley DB
5247>16	lelong	>0		(Log, version %d, little-endian)
5248
5249#
5250#
5251# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
52520	string/b	RRD\0		RRDTool DB
5253>4	string/b	x		version %s
5254
5255>>10	short		!0		16bit aligned
5256>>>10	bedouble	8.642135e+130	big-endian
5257>>>>18	short		x		32bit long (m68k)
5258
5259>>10	short		0
5260>>>12	long		!0		32bit aligned
5261>>>>12	bedouble	8.642135e+130	big-endian
5262>>>>>20 long		0		64bit long
5263>>>>>20 long		!0		32bit long
5264>>>>12	ledouble	8.642135e+130	little-endian
5265>>>>>24 long		0		64bit long
5266>>>>>24 long		!0		32bit long (i386)
5267>>>>12	string		\x43\x2b\x1f\x5b\x2f\x25\xc0\xc7	middle-endian
5268>>>>>24 short		!0		32bit long (arm)
5269
5270>>8	quad		0		64bit aligned
5271>>>16	bedouble	8.642135e+130	big-endian
5272>>>>24	long		0		64bit long (s390x)
5273>>>>24	long		!0		32bit long (hppa/mips/ppc/s390/SPARC)
5274>>>16	ledouble	8.642135e+130	little-endian
5275>>>>28	long		0		64bit long (alpha/amd64/ia64)
5276>>>>28	long		!0		32bit long (armel/mipsel)
5277
5278#----------------------------------------------------------------------
5279# ROOT: file(1) magic for ROOT databases
5280#
52810       string  root\0  ROOT file
5282>4      belong  x       Version %d
5283>33     belong  x       (Compression: %d)
5284
5285# XXX: Weak magic.
5286# Alex Ott <ott@jet.msk.su>
5287## Paradox file formats
5288#2	  leshort	0x0800	Paradox
5289#>0x39	  byte		3	v. 3.0
5290#>0x39	  byte		4	v. 3.5
5291#>0x39	  byte		9	v. 4.x
5292#>0x39	  byte		10	v. 5.x
5293#>0x39	  byte		11	v. 5.x
5294#>0x39	  byte		12	v. 7.x
5295#>>0x04	  byte		0	indexed .DB data file
5296#>>0x04	  byte		1	primary index .PX file
5297#>>0x04	  byte		2	non-indexed .DB data file
5298#>>0x04	  byte		3	non-incrementing secondary index .Xnn file
5299#>>0x04	  byte		4	secondary index .Ynn file
5300#>>0x04	  byte		5	incrementing secondary index .Xnn file
5301#>>0x04	  byte		6	non-incrementing secondary index .XGn file
5302#>>0x04	  byte		7	secondary index .YGn file
5303#>>>0x04	  byte		8	incrementing secondary index .XGn file
5304
5305## XBase database files
5306# updated by Joerg Jenderek at Feb 2013
5307# http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
5308# http://www.clicketyclick.dk/databases/xbase/format/dbf.html
5309# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm
5310# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
53110	ubelong&0x0000FFFF		<0x00000C20
5312# skip Infocom game Z-machine
5313>2		ubyte			>0
5314# skip Androids *.xml
5315>>3		ubyte			>0
5316>>>3		ubyte			<32
5317# 1 < version VV
5318>>>>0		ubyte			>1
5319# skip HELP.CA3 by test for reserved byte ( NULL )
5320>>>>>27		ubyte			0
5321# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
5322#>>>>>30		ubeshort     		x		30NULL?%x
5323# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
5324>>>>>>24	ubelong&0xffFFFFff	>0x01302000
5325# .DBF or .MDX
5326>>>>>>24	ubelong&0xffFFFFff	<0x01302001
5327# for Xbase Database file (*.DBF) reserved (NULL) for multi-user
5328>>>>>>>24	ubelong&0xffFFFFff	=0
5329# test for 2 reserved NULL bytes,transaction and encryption byte flag
5330>>>>>>>>12	ubelong&0xFFFFfEfE	0
5331# test for MDX flag
5332>>>>>>>>>28	ubyte			x
5333>>>>>>>>>28	ubyte&0xf8		0
5334# header size >= 32
5335>>>>>>>>>>8	uleshort		>31
5336# skip PIC15736.PCX by test for language driver name or field name
5337>>>>>>>>>>>32	ubyte			>0
5338#!:mime	application/x-dbf; charset=unknown-8bit ??
5339#!:mime	application/x-dbase
5340>>>>>>>>>>>>0	use			xbase-type
5341# database file
5342>>>>>>>>>>>>0	ubyte			x		\b DBF
5343>>>>>>>>>>>>4	lelong			0		\b, no records
5344>>>>>>>>>>>>4	lelong			>0		\b, %d record
5345# plural s appended
5346>>>>>>>>>>>>>4	lelong			>1		\bs
5347# http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
5348# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000)
5349>>>>>>>>>>>>10	uleshort		x		* %d
5350# file size = records * record size + header size
5351>>>>>>>>>>>>1	ubyte			x		\b, update-date
5352>>>>>>>>>>>>1	use			xbase-date
5353# http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
5354#>>>>>>>>>>>>29	ubyte			=0		\b, codepage ID=0x%x
5355# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ?
5356>>>>>>>>>>>>29	ubyte			>0		\b, codepage ID=0x%x
5357#>>>>>>>>>>>>28	ubyte&0x01		0		\b, no index file
5358>>>>>>>>>>>>28	ubyte&0x01		1		\b, with index file .MDX
5359>>>>>>>>>>>>28	ubyte&0x02		2		\b, with memo .FPT
5360>>>>>>>>>>>>28	ubyte&0x04		4		\b, DataBaseContainer
5361# 1st record offset + 1 = header size
5362>>>>>>>>>>>>8	uleshort		>0
5363>>>>>>>>>>>>(8.s+1)	ubyte		>0
5364>>>>>>>>>>>>>8		uleshort	>0		\b, at offset %d
5365>>>>>>>>>>>>>(8.s+1)	ubyte		>0
5366>>>>>>>>>>>>>>&-1	string		>\0		1st record "%s"
5367# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL)
5368>>>>>>>24	ubelong&0x0133f7ff	>0
5369# test for reserved NULL byte
5370>>>>>>>>47	ubyte			0
5371# test for valid TAG key format (0x10 or 0)
5372>>>>>>>>>559	ubyte&0xeF		0
5373# test MM <= 12
5374>>>>>>>>>>45	ubeshort		<0x0C20
5375>>>>>>>>>>>45	ubyte			>0
5376>>>>>>>>>>>>46	ubyte			<32
5377>>>>>>>>>>>>>46	ubyte			>0
5378#!:mime	application/x-mdx
5379>>>>>>>>>>>>>>0		use		xbase-type
5380>>>>>>>>>>>>>>0		ubyte		x		\b MDX
5381>>>>>>>>>>>>>>1		ubyte		x		\b, creation-date
5382>>>>>>>>>>>>>>1		use		xbase-date
5383>>>>>>>>>>>>>>44	ubyte		x		\b, update-date
5384>>>>>>>>>>>>>>44	use		xbase-date
5385# No.of tags in use (1,2,5,12)
5386>>>>>>>>>>>>>>28	uleshort	x		\b, %d
5387# No. of entries in tag (0x30)
5388>>>>>>>>>>>>>>25	ubyte		x		\b/%d tags
5389#  Length of tag
5390>>>>>>>>>>>>>>26	ubyte		x		* %d
5391# 1st tag name_
5392>>>>>>>>>>>>>548	string		x		\b, 1st tag "%.11s"
5393# 2nd tag name
5394#>>>>>>>>>>>>(26.b+548)	string		x		\b, 2nd tag "%.11s"
5395#
5396#		Print the xBase names of different version variants
53970	name				xbase-type
5398>0	ubyte		<2
5399# 1 < version
5400>0	ubyte		>1
5401>>0	ubyte		0x02		FoxBase
5402# FoxBase+/dBaseIII+, no memo
5403>>0	ubyte		0x03		FoxBase+/dBase III
5404!:mime	application/x-dbf
5405# dBASE IV no memo file
5406>>0	ubyte		0x04		dBase IV
5407!:mime	application/x-dbf
5408# dBASE V no memo file
5409>>0	ubyte		0x05		dBase V
5410!:mime	application/x-dbf
5411>>0	ubyte		0x30		Visual FoxPro
5412!:mime	application/x-dbf
5413>>0	ubyte		0x31		Visual FoxPro, autoincrement
5414!:mime	application/x-dbf
5415# Visual FoxPro, with field type Varchar or Varbinary
5416>>0	ubyte		0x32		Visual FoxPro, with field type Varchar
5417!:mime	application/x-dbf
5418# dBASE IV SQL, no memo;dbv memo var size (Flagship)
5419>>0	ubyte		0x43		dBase IV, with SQL table
5420!:mime	application/x-dbf
5421# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
5422#>>0	ubyte		0x62		dBase IV, with SQL table
5423#!:mime	application/x-dbf
5424# dBASE IV, with memo!!
5425>>0	ubyte		0x7b		dBase IV, with memo
5426!:mime	application/x-dbf
5427# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
5428#>>0	ubyte		0x82		dBase IV, with SQL system
5429#!:mime	application/x-dbf
5430# FoxBase+/dBaseIII+ with memo .DBT!
5431>>0	ubyte		0x83		FoxBase+/dBase III, with memo .DBT
5432!:mime	application/x-dbf
5433# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file
5434>>0	ubyte		0x87		VISUAL OBJECTS, with memo file
5435!:mime	application/x-dbf
5436# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
5437#>>0	ubyte		0x8A		FoxBase+/dBase III, with memo .DBT
5438#!:mime	application/x-dbf
5439# dBASE IV with memo!
5440>>0	ubyte		0x8B		dBase IV, with memo .DBT
5441!:mime	application/x-dbf
5442# dBase IV with SQL Table,no memo?
5443>>0	ubyte		0x8E		dBase IV, with SQL table
5444!:mime	application/x-dbf
5445# .dbv and .dbt memo (Flagship)?
5446>>0	ubyte		0xB3		Flagship
5447# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
5448#>>0	ubyte		0xCA		dBase IV with memo .DBT
5449#!:mime	application/x-dbf
5450# dBASE IV with SQL table, with memo .DBT
5451>>0	ubyte		0xCB		dBase IV with SQL table, with memo .DBT
5452!:mime	application/x-dbf
5453# HiPer-Six format;Clipper SIX, with SMT memo file
5454>>0	ubyte		0xE5		Clipper SIX with memo
5455!:mime	application/x-dbf
5456# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
5457#>>0	ubyte		0xF4		dBase IV, with SQL table, with memo
5458#!:mime	application/x-dbf
5459>>0	ubyte		0xF5		FoxPro with memo
5460!:mime	application/x-dbf
5461# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
5462#>>0	ubyte		0xFA		FoxPro 2.x, with memo
5463#!:mime	application/x-dbf
5464# unknown version (should not happen)
5465>>0	default		x		xBase
5466!:mime	application/x-dbf
5467>>>0	ubyte		x		(0x%x)
5468# flags in version byte
5469# DBT flag (with dBASE III memo .DBT)!!
5470# >>0	ubyte&0x80	>0		DBT_FLAG=%x
5471# memo flag ??
5472# >>0	ubyte&0x08	>0		MEMO_FLAG=%x
5473# SQL flag ??
5474# >>0	ubyte&0x70	>0		SQL_FLAG=%x
5475#		test and print the date of xBase .DBF .MDX
54760	name				xbase-date
5477# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
5478>0	ubelong		x
5479>1	ubyte		<13
5480>>1	ubyte		>0
5481>>>2	ubyte		>0
5482>>>>2	ubyte		<32
5483>>>>>0	ubyte		x
5484# YY is interpreted as 20YY or 19YY
5485>>>>>>0	ubyte		<100		\b %.2d
5486# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
5487>>>>>>0	ubyte		>99		\b %d
5488>>>>>1	ubyte		x		\b-%d
5489>>>>>2	ubyte		x		\b-%d
5490
5491#	dBase memo files .DBT or .FPT
5492# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
549316		ubyte		<4
5494>16		ubyte		!2
5495>>16		ubyte		!1
5496# next free block index is positive
5497>>>0		ulelong		>0
5498# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
5499>>>>17		ubelong&0xFFfdFE00	0x00000000
5500# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
5501>>>>>20		ubelong&0xFF01209B	0x00000000
5502# dBASE III
5503>>>>>>16	ubyte		3
5504# dBASE III DBT
5505>>>>>>>0	use		dbase3-memo-print
5506# dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage
5507>>>>>>16	ubyte		0
5508# unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT ,  or garbage PCX DBF
5509>>>>>>>20	uleshort	0
5510# FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage
5511>>>>>>>>8	ulong		=0
5512>>>>>>>>>6	ubeshort	>0
5513# skip emacs.PIF
5514>>>>>>>>>>4	ushort		0
5515>>>>>>>>>>>0	use		foxpro-memo-print
5516# dBASE III DBT , garbage
5517>>>>>>>>>6	ubeshort	0
5518# skip MM*DD*.bin by test for for reserved NULL byte
5519>>>>>>>>>>510	ubeshort	0
5520# skip TK-DOS11.img image by looking for memo text
5521>>>>>>>>>>>512	ubelong		<0xfeffff03
5522# skip EFI executables by looking for memo text
5523>>>>>>>>>>>>512	ubelong		>0x1F202020
5524>>>>>>>>>>>>>513 ubyte		>0
5525# unusual dBASE III DBT like adressen.dbt
5526>>>>>>>>>>>>>>0	use		dbase3-memo-print
5527# dBASE III DBT like angest.dbt, or garbage PCX DBF
5528>>>>>>>>8	ubelong		!0
5529# skip PCX and some DBF by test for for reserved NULL bytes
5530>>>>>>>>>510	ubeshort	0
5531# skip some DBF by test of invalid version
5532>>>>>>>>>>0	ubyte		>5
5533>>>>>>>>>>>0	ubyte		<48
5534>>>>>>>>>>>>0	use		dbase3-memo-print
5535# dBASE IV DBT with positive block size
5536>>>>>>>20	uleshort	>0
5537>>>>>>>>0	use		dbase4-memo-print
5538
5539#		Print the information of dBase III DBT memo file
55400	name				dbase3-memo-print
5541>0	ubyte			x		dBase III DBT
5542# instead 3 as version number 0 for unusual examples like biblio.dbt
5543>16	ubyte			!3		\b, version number %u
5544# Number of next available block for appending data
5545#>0	lelong			=0		\b, next free block index %u
5546>0	lelong			!0		\b, next free block index %u
5547# no positiv block length
5548#>20	uleshort		=0		\b, block length %u
5549>20	uleshort		!0		\b, block length %u
5550# dBase III memo field terminated by \032\032
5551>512	string			>\0		\b, 1st item "%s"
5552#		Print the information of dBase IV DBT memo file
55530	name				dbase4-memo-print
5554>0		lelong		x		dBase IV DBT
5555# 8 character shorted main name of coresponding dBASE IV DBF file
5556>8		ubelong		>0x20000000
5557# skip unusual like for angest.dbt
5558>>20		uleshort	>0
5559>>>8		string		>\0		\b of %-.8s.DBF
5560# value 0 implies 512 as size
5561#>4		ulelong		=0		\b, blocks size %u
5562# size of blocks not reliable like 0x2020204C in angest.dbt
5563>4		ulelong		!0
5564>>4		ulelong&0x0000003f	0	\b, blocks size %u
5565# dBase IV DBT with positive block length (found 512 , 1024)
5566>20		uleshort	>0		\b, block length %u
5567# next available block
5568#>0		lelong		=0		\b, next free block index %u
5569>0		lelong		!0		\b, next free block index %u
5570>20		uleshort	>0
5571>>(20.s)	ubelong		x
5572>>>&-4		use		dbase4-memofield-print
5573# unusual dBase IV DBT without block length (implies 512 as length)
5574>20		uleshort	=0
5575>>512		ubelong		x
5576>>>&-4		use				dbase4-memofield-print
5577#		Print the information of dBase IV memo field
55780	name			dbase4-memofield-print
5579# free dBase IV memo field
5580>0		ubelong		!0xFFFF0800
5581>>0		lelong		x		\b, next free block %u
5582>>4		lelong		x		\b, next used block %u
5583# used dBase IV memo field
5584>0		ubelong		=0xFFFF0800
5585# length of memo field
5586>>4		lelong		x		\b, field length %d
5587>>>8		string		>\0		\b, 1st used item "%s"
5588#		Print the information of FoxPro FPT memo file
55890	name				foxpro-memo-print
5590>0		belong		x		FoxPro FPT
5591# Size of blocks for FoxPro ( 64,256 )
5592>6		ubeshort	x		\b, blocks size %u
5593# next available block
5594#>0		belong		=0		\b, next free block index %u
5595>0		belong		!0		\b, next free block index %u
5596# field type ( 0~picture, 1~memo, 2~object )
5597>512		ubelong		<3		\b, field type %u
5598# length of memo field
5599>512		ubelong		1
5600>>516		belong		>0		\b, field length %d
5601>>>520		string		>\0		\b, 1st item "%s"
5602
5603# TODO:
5604# DBASE index file *.NDX
5605# DBASE Compound Index file *.CDX
5606# dBASE IV Printer Driver *.PRF
5607## End of XBase database stuff
5608
5609# MS Access database
56104	string	Standard\ Jet\ DB	Microsoft Access Database
5611!:mime	application/x-msaccess
56124	string	Standard\ ACE\ DB	Microsoft Access Database
5613!:mime	application/x-msaccess
5614
5615# TDB database from Samba et al - Martin Pool <mbp@samba.org>
56160	string	TDB\ file		TDB database
5617>32	lelong	0x2601196D		version 6, little-endian
5618>>36	lelong	x			hash size %d bytes
5619
5620# SE Linux policy database
56210       lelong  0xf97cff8c      SE Linux policy
5622>16     lelong  x               v%d
5623>20     lelong  1      MLS
5624>24     lelong  x       %d symbols
5625>28     lelong  x       %d ocons
5626
5627# ICE authority file data (Wolfram Kleff)
56282	string		ICE		ICE authority data
5629
5630# X11 Xauthority file (Wolfram Kleff)
563110	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
563211	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
563312	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
563413	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
563514	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
563615	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
563716	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
563817	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
563918	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
5640
5641# From: Maxime Henrion <mux@FreeBSD.org>
5642# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org>
56430	string		PGDMP		PostgreSQL custom database dump
5644>5	byte		x		- v%d
5645>6	byte		x		\b.%d
5646>5	beshort		<0x101		\b-0
5647>5	beshort		>0x100
5648>>7	byte		x		\b-%d
5649
5650# Type: Advanced Data Format (ADF) database
5651# URL:  http://www.grc.nasa.gov/WWW/cgns/adf/
5652# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr>
56530	string	@(#)ADF\ Database	CGNS Advanced Data Format
5654
5655# Tokyo Cabinet magic data
5656# http://tokyocabinet.sourceforge.net/index.html
56570	string		ToKyO\ CaBiNeT\n	Tokyo Cabinet
5658>14	string		x			\b (%s)
5659>32	byte		0			\b, Hash
5660!:mime	application/x-tokyocabinet-hash
5661>32	byte		1			\b, B+ tree
5662!:mime	application/x-tokyocabinet-btree
5663>32	byte		2			\b, Fixed-length
5664!:mime	application/x-tokyocabinet-fixed
5665>32	byte		3			\b, Table
5666!:mime	application/x-tokyocabinet-table
5667>33	byte		&1			\b, [open]
5668>33	byte		&2			\b, [fatal]
5669>34	byte		x			\b, apow=%d
5670>35	byte		x			\b, fpow=%d
5671>36	byte		&0x01			\b, [large]
5672>36	byte		&0x02			\b, [deflate]
5673>36	byte		&0x04			\b, [bzip]
5674>36	byte		&0x08			\b, [tcbs]
5675>36	byte		&0x10			\b, [excodec]
5676>40	lequad		x			\b, bnum=%lld
5677>48	lequad		x			\b, rnum=%lld
5678>56	lequad		x			\b, fsiz=%lld
5679
5680# Type:	QDBM Quick Database Manager
5681# From:	Benoit Sibaud <bsibaud@april.org>
56820	string		\\[depot\\]\n\f		Quick Database Manager, little endian
56830	string		\\[DEPOT\\]\n\f		Quick Database Manager, big endian
5684
5685# Type:	TokyoCabinet database
5686# URL:	http://tokyocabinet.sourceforge.net/
5687# From:	Benoit Sibaud <bsibaud@april.org>
56880	string		ToKyO\ CaBiNeT\n	TokyoCabinet database
5689>14	string		x			(version %s)
5690
5691# From:  Stephane Blondon http://www.yaal.fr
5692# Database file for Zope (done by FileStorage)
56930	string		FS21	Zope Object Database File Storage (data)
5694# Cache file for the database of Zope (done by ClientStorage)
56950	string		ZEC3	Zope Object Database Client Cache File (data)
5696
5697# IDA (Interactive Disassembler) database
56980	string		IDA1	IDA (Interactive Disassembler) database
5699
5700#------------------------------------------------------------------------------
5701# $File$
5702# diamond:  file(1) magic for Diamond system
5703#
5704# ... diamond is a multi-media mail and electronic conferencing system....
5705#
5706# XXX - I think it was either renamed Slate, or replaced by Slate....
5707#
5708#	The full deal is too long...
5709#0	string	<list>\n<protocol\ bbn-multimedia-format>	Diamond Multimedia Document
57100	string	=<list>\n<protocol\ bbn-m	Diamond Multimedia Document
5711
5712#------------------------------------------------------------------------------
5713# $File: diff,v 1.13 2012/06/16 14:43:36 christos Exp $
5714# diff:  file(1) magic for diff(1) output
5715#
57160	search/1	diff\ 		diff output text
5717!:mime	text/x-diff
57180	search/1	***\ 		diff output text
5719!:mime	text/x-diff
57200	search/1	Only\ in\ 	diff output text
5721!:mime	text/x-diff
57220	search/1	Common\ subdirectories:\ 	diff output text
5723!:mime	text/x-diff
5724
57250	search/1	Index:		RCS/CVS diff output text
5726!:mime	text/x-diff
5727
5728# bsdiff:  file(1) magic for bsdiff(1) output
57290	string/b		BSDIFF40	bsdiff(1) patch file
5730
5731
5732# unified diff
57330	search/4096	---\
5734>&0	search/1024 \n
5735>>&0	search/1 +++\
5736>>>&0	search/1024 \n
5737>>>>&0	search/1 @@	unified diff output text
5738!:mime	text/x-diff
5739!:strength + 90
5740
5741# librsync -- the library for network deltas
5742#
5743# Copyright (C) 2001 by Martin Pool.  You may do whatever you want with
5744# this file.
5745#
57460	belong		0x72730236	rdiff network-delta data
5747
57480	belong		0x72730136	rdiff network-delta signature data
5749>4	belong		x		(block length=%d,
5750>8	belong		x		signature strength=%d)
5751
5752#------------------------------------------------------------------------------
5753# $File: digital,v 1.10 2011/05/03 01:44:17 christos Exp $
5754#  Digital UNIX - Info
5755#
57560	string	=!<arch>\n________64E	Alpha archive
5757>22	string	X			-- out of date
5758#
5759
57600	leshort		0603
5761>24	leshort		0410		COFF format alpha pure
5762>24	leshort		0413		COFF format alpha demand paged
5763>>22	leshort&030000	!020000		executable
5764>>22	leshort&020000	!0		dynamically linked
5765>>16	lelong		!0		not stripped
5766>>16	lelong		0		stripped
5767>>27	byte		x		- version %d
5768>>26	byte		x		\b.%d
5769>>28	byte		x		\b-%d
5770>24	leshort		0407		COFF format alpha object
5771>>22	leshort&030000	020000		shared library
5772>>27	byte		x		- version %d
5773>>26	byte		x		\b.%d
5774>>28	byte		x		\b-%d
5775
5776# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
5777#
5778# The actual magic number is just "Core", followed by a 2-byte version
5779# number; however, treating any file that begins with "Core" as a Digital
5780# UNIX core dump file may produce too many false hits, so we include one
5781# byte of the version number as well; DU 5.0 appears only to be up to
5782# version 2.
5783#
57840	string		Core\001	Alpha COFF format core dump (Digital UNIX)
5785>24	string		>\0		\b, from '%s'
57860	string		Core\002	Alpha COFF format core dump (Digital UNIX)
5787>24	string		>\0		\b, from '%s'
5788#
5789# The next is incomplete, we could tell more about this format,
5790# but its not worth it.
57910	leshort		0x188	Alpha compressed COFF
57920	leshort		0x18f	Alpha u-code object
5793#
5794#
5795# Some other interesting Digital formats,
57960	string	\377\377\177		ddis/ddif
57970	string	\377\377\174		ddis/dots archive
57980	string	\377\377\176		ddis/dtif table data
57990	string	\033c\033		LN03 output
58000	long	04553207		X image
5801#
58020	string	=!<PDF>!\n		profiling data file
5803#
5804# Locale data tables (MIPS and Alpha).
5805#
58060	short		0x0501		locale data table
5807>6	short		0x24		for MIPS
5808>6	short		0x40		for Alpha
5809
5810#------------------------------------------------------------------------------
5811# $File: dolby,v 1.6 2012/10/31 13:39:42 christos Exp $
5812# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
5813# from http://www.atsc.org/standards/a_52a.pdf
5814# corrections, additions, etc. are always welcome!
5815#
5816# syncword
58170	beshort		0x0b77	ATSC A/52 aka AC-3 aka Dolby Digital stream,
5818# Proposed audio/ac3 RFC/4184
5819!:mime	audio/vnd.dolby.dd-raw
5820# fscod
5821>4	byte&0xc0 = 0x00	48 kHz,
5822>4	byte&0xc0 = 0x40	44.1 kHz,
5823>4	byte&0xc0 = 0x80	32 kHz,
5824# is this one used for 96 kHz?
5825>4	byte&0xc0 = 0xc0	reserved frequency,
5826#
5827>5	byte&0x07 = 0x00	\b, complete main (CM)
5828>5	byte&0x07 = 0x01	\b, music and effects (ME)
5829>5	byte&0x07 = 0x02	\b, visually impaired (VI)
5830>5	byte&0x07 = 0x03	\b, hearing impaired (HI)
5831>5	byte&0x07 = 0x04	\b, dialogue (D)
5832>5	byte&0x07 = 0x05	\b, commentary (C)
5833>5	byte&0x07 = 0x06	\b, emergency (E)
5834>5	beshort&0x07e0  0x0720	\b, voiceover (VO)
5835>5	beshort&0x07e0 >0x0720	\b, karaoke
5836# acmod
5837>6	byte&0xe0 = 0x00	1+1 front,
5838>>6	byte&0x10 = 0x10	LFE on,
5839>6	byte&0xe0 = 0x20	1 front/0 rear,
5840>>6	byte&0x10 = 0x10	LFE on,
5841>6	byte&0xe0 = 0x40	2 front/0 rear,
5842# dsurmod (for stereo only)
5843>>6	byte&0x18 = 0x00	Dolby Surround not indicated
5844>>6	byte&0x18 = 0x08	not Dolby Surround encoded
5845>>6	byte&0x18 = 0x10	Dolby Surround encoded
5846>>6	byte&0x18 = 0x18	reserved Dolby Surround mode
5847>>6	byte&0x04 = 0x04	LFE on,
5848>6	byte&0xe0 = 0x60	3 front/0 rear,
5849>>6	byte&0x04 = 0x04	LFE on,
5850>6	byte&0xe0 = 0x80	2 front/1 rear,
5851>>6	byte&0x04 = 0x04	LFE on,
5852>6	byte&0xe0 = 0xa0	3 front/1 rear,
5853>>6	byte&0x01 = 0x01	LFE on,
5854>6	byte&0xe0 = 0xc0	2 front/2 rear,
5855>>6	byte&0x04 = 0x04	LFE on,
5856>6	byte&0xe0 = 0xe0	3 front/2 rear,
5857>>6	byte&0x01 = 0x01	LFE on,
5858#
5859>4	byte&0x3e = 0x00	\b, 32 kbit/s
5860>4	byte&0x3e = 0x02	\b, 40 kbit/s
5861>4	byte&0x3e = 0x04	\b, 48 kbit/s
5862>4	byte&0x3e = 0x06	\b, 56 kbit/s
5863>4	byte&0x3e = 0x08	\b, 64 kbit/s
5864>4	byte&0x3e = 0x0a	\b, 80 kbit/s
5865>4	byte&0x3e = 0x0c	\b, 96 kbit/s
5866>4	byte&0x3e = 0x0e	\b, 112 kbit/s
5867>4	byte&0x3e = 0x10	\b, 128 kbit/s
5868>4	byte&0x3e = 0x12	\b, 160 kbit/s
5869>4	byte&0x3e = 0x14	\b, 192 kbit/s
5870>4	byte&0x3e = 0x16	\b, 224 kbit/s
5871>4	byte&0x3e = 0x18	\b, 256 kbit/s
5872>4	byte&0x3e = 0x1a	\b, 320 kbit/s
5873>4	byte&0x3e = 0x1c	\b, 384 kbit/s
5874>4	byte&0x3e = 0x1e	\b, 448 kbit/s
5875>4	byte&0x3e = 0x20	\b, 512 kbit/s
5876>4	byte&0x3e = 0x22	\b, 576 kbit/s
5877>4	byte&0x3e = 0x24	\b, 640 kbit/s
5878
5879#------------------------------------------------------------------------------
5880# $File: dump,v 1.12 2012/11/01 04:26:40 christos Exp $
5881# dump:  file(1) magic for dump file format--for new and old dump filesystems
5882#
5883# We specify both byte orders in order to recognize byte-swapped dumps.
5884#
58850	name	new-dump-be
5886>4	bedate	x		Previous dump %s,
5887>8	bedate	x		This dump %s,
5888>12	belong	>0		Volume %d,
5889>692	belong	0		Level zero, type:
5890>692	belong	>0		Level %d, type:
5891>0	belong	1		tape header,
5892>0	belong	2		beginning of file record,
5893>0	belong	3		map of inodes on tape,
5894>0	belong	4		continuation of file record,
5895>0	belong	5		end of volume,
5896>0	belong	6		map of inodes deleted,
5897>0	belong	7		end of medium (for floppy),
5898>676	string	>\0		Label %s,
5899>696	string	>\0		Filesystem %s,
5900>760	string	>\0		Device %s,
5901>824	string	>\0		Host %s,
5902>888	belong	>0		Flags %x
5903
59040	name	old-dump-be
5905#>4	bedate	x		Previous dump %s,
5906#>8	bedate	x		This dump %s,
5907>12	belong	>0		Volume %d,
5908>692	belong	0		Level zero, type:
5909>692	belong	>0		Level %d, type:
5910>0	belong	1		tape header,
5911>0	belong	2		beginning of file record,
5912>0	belong	3		map of inodes on tape,
5913>0	belong	4		continuation of file record,
5914>0	belong	5		end of volume,
5915>0	belong	6		map of inodes deleted,
5916>0	belong	7		end of medium (for floppy),
5917>676	string	>\0		Label %s,
5918>696	string	>\0		Filesystem %s,
5919>760	string	>\0		Device %s,
5920>824	string	>\0		Host %s,
5921>888	belong	>0		Flags %x
5922
59230	name	ufs2-dump-be
5924>896	beqdate	x		Previous dump %s,
5925>904	beqdate	x		This dump %s,
5926>12	belong	>0		Volume %d,
5927>692	belong	0		Level zero, type:
5928>692	belong	>0		Level %d, type:
5929>0	belong	1		tape header,
5930>0	belong	2		beginning of file record,
5931>0	belong	3		map of inodes on tape,
5932>0	belong	4		continuation of file record,
5933>0	belong	5		end of volume,
5934>0	belong	6		map of inodes deleted,
5935>0	belong	7		end of medium (for floppy),
5936>676	string	>\0		Label %s,
5937>696	string	>\0		Filesystem %s,
5938>760	string	>\0		Device %s,
5939>824	string	>\0		Host %s,
5940>888	belong	>0		Flags %x
5941
594224	belong	60012		new-fs dump file (big endian),
5943>0	use	new-dump-be
5944
594524	belong	60011		old-fs dump file (big endian),
5946>0	use	old-dump-be
5947
594824	lelong	60012		new-fs dump file (little endian),
5949>0	use	\^new-dump-be
5950
595124	lelong	60011		old-fs dump file (little endian),
5952>0	use	\^old-dump-be
5953
5954
595524	belong	0x19540119	new-fs dump file (ufs2, big endian),
5956>0	use	ufs2-dump-be
5957
595824	lelong	0x19540119	new-fs dump file (ufs2, little endian),
5959>0	use	\^ufs2-dump-be
5960
596118	leshort	60011		old-fs dump file (16-bit, assuming PDP-11 endianness),
5962>2	medate	x		Previous dump %s,
5963>6	medate	x		This dump %s,
5964>10	leshort	>0		Volume %d,
5965>0	leshort	1		tape header.
5966>0	leshort	2		beginning of file record.
5967>0	leshort	3		map of inodes on tape.
5968>0	leshort	4		continuation of file record.
5969>0	leshort	5		end of volume.
5970>0	leshort	6		map of inodes deleted.
5971>0	leshort	7		end of medium (for floppy).
5972
5973#------------------------------------------------------------------------------
5974# $File: dyadic,v 1.5 2010/09/20 18:55:20 rrt Exp $
5975# Dyadic: file(1) magic for Dyalog APL.
5976#
5977# updated by Joerg Jenderek at Oct 2013
5978# http://en.wikipedia.org/wiki/Dyalog_APL
5979# http://www.dyalog.com/
5980# .DXV Dyalog APL External Variable
5981# .DIN Dyalog APL Input Table
5982# .DOT Dyalog APL Output Table
5983# .DFT Dyalog APL Format File
59840	ubeshort&0xFF60	0xaa00
5985# skip biblio.dbt
5986>1	byte		!4
5987# real Dyalog APL have non zero version numbers like 7.3 or 13.4
5988>>2	ubeshort	>0x0000		Dyalog APL
5989>>>1	byte		0x00		aplcore
5990#>>>1	byte		0x00		incomplete workspace
5991# *.DCF Dyalog APL Component File
5992>>>1	byte		0x01		component file 32-bit non-journaled non-checksummed
5993#>>>1	byte		0x01		component file
5994>>>1	byte		0x02		external variable exclusive
5995#>>>1	byte		0x02		external variable
5996# *.DWS Dyalog APL Workspace
5997>>>1	byte		0x03		workspace
5998>>>>7	byte&0x28	0x00		32-bit
5999>>>>7	byte&0x28	0x20		64-bit
6000>>>>7	byte&0x0c	0x00		classic
6001>>>>7	byte&0x0c	0x04		unicode
6002>>>>7	byte&0x88	0x00		big-endian
6003>>>>7	byte&0x88	0x80		little-endian
6004>>>1	byte		0x06		external variable shared
6005# *.DSE Dyalog APL Session , *.DLF Dyalog APL Session Log File
6006>>>1	byte		0x07		session
6007>>>1	byte		0x08		mapped file 32-bit
6008>>>1	byte		0x09		component file 64-bit non-journaled non-checksummed
6009>>>1	byte		0x0a		mapped file 64-bit
6010>>>1	byte		0x0b		component file 32-bit level 1 journaled non-checksummed
6011>>>1	byte		0x0c		component file 64-bit level 1 journaled non-checksummed
6012>>>1	byte		0x0d		component file 32-bit level 1 journaled checksummed
6013>>>1	byte		0x0e		component file 64-bit level 1 journaled checksummed
6014>>>1	byte		0x0f		component file 32-bit level 2 journaled checksummed
6015>>>1	byte		0x10		component file 64-bit level 2 journaled checksummed
6016>>>1	byte		0x11		component file 32-bit level 3 journaled checksummed
6017>>>1	byte		0x12		component file 64-bit level 3 journaled checksummed
6018>>>1	byte		0x13		component file 32-bit non-journaled checksummed
6019>>>1	byte		0x14		component file 64-bit non-journaled checksummed
6020>>>1	byte		0x80		DDB
6021>>>2	byte		x		version %d
6022>>>3	byte		x		\b.%d
6023#>>>2	byte		x		type %d
6024#>>>3	byte		x		subtype %d
6025
6026# *.DXF Dyalog APL Transfer File
60270	short		0x6060		Dyalog APL transfer
6028
6029#------------------------------------------------------------------------------
6030# $File$
6031# ebml:  file(1) magic for various Extensible Binary Meta Language
6032# http://www.matroska.org/technical/specs/index.html#track
60330	belong	0x1a45dfa3	EBML file
6034>4	search/b/100	\102\202
6035>>&1	string	x		\b, creator %.8s
6036
6037#------------------------------------------------------------------------------
6038# $File$
6039# T602 editor documents
6040# by David Necas <yeti@physics.muni.cz>
60410	string	@CT\ 	T602 document data,
6042>4	string	0	Kamenicky
6043>4	string	1	CP 852
6044>4	string	2	KOI8-CS
6045>4	string	>2	unknown encoding
6046
6047# Vi IMproved Encrypted file
6048# by David Necas <yeti@physics.muni.cz>
60490	string	VimCrypt~	Vim encrypted file data
6050# Vi IMproved Swap file
6051# by Sven Wegener <swegener@gentoo.org>
60520	string	b0VIM\ 		Vim swap file
6053>&0	string	>\0		\b, version %s
6054
6055#------------------------------------------------------------------------------
6056# $File: efi,v 1.4 2009/09/19 16:28:09 christos Exp $
6057# efi:  file(1) magic for Universal EFI binaries
6058
60590	lelong	0x0ef1fab9
6060>4	lelong	1		Universal EFI binary with 1 architecture
6061>>&0	lelong	7		\b, i386
6062>>&0	lelong	0x01000007	\b, x86_64
6063>4	lelong	2		Universal EFI binary with 2 architectures
6064>>&0	lelong	7		\b, i386
6065>>&0	lelong	0x01000007	\b, x86_64
6066>>&20	lelong	7		\b, i386
6067>>&20	lelong	0x01000007	\b, x86_64
6068>4	lelong	>2		Universal EFI binary with %d architectures
6069
6070#------------------------------------------------------------------------------
6071# $File: elf,v 1.67 2014/06/12 13:52:48 christos Exp $
6072# elf:  file(1) magic for ELF executables
6073#
6074# We have to check the byte order flag to see what byte order all the
6075# other stuff in the header is in.
6076#
6077# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
6078#
6079# Created by: unknown
6080# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com>
6081# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support)
6082# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support)
6083# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium)
6084# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures)
6085
60860	name		elf-le
6087>16	leshort		0		no file type,
6088!:mime	application/octet-stream
6089>16	leshort		1		relocatable,
6090!:mime	application/x-object
6091>16	leshort		2		executable,
6092!:mime	application/x-executable
6093>16	leshort		3		shared object,
6094!:mime	application/x-sharedlib
6095>16	leshort		4		core file
6096!:mime	application/x-coredump
6097# Core file detection is not reliable.
6098#>>>(0x38+0xcc) string	>\0		of '%s'
6099#>>>(0x38+0x10) lelong	>0		(signal %d),
6100>16	leshort		&0xff00		processor-specific,
6101>18	clear		x
6102>18	leshort		0		no machine,
6103>18	leshort		1		AT&T WE32100,
6104>18	leshort		2		SPARC,
6105>18	leshort		3		Intel 80386,
6106>18	leshort		4		Motorola m68k,
6107>>4	byte		1
6108>>>36	lelong		&0x01000000	68000,
6109>>>36	lelong		&0x00810000	CPU32,
6110>>>36	lelong		0		68020,
6111>18	leshort		5		Motorola m88k,
6112>18	leshort		6		Intel 80486,
6113>18	leshort		7		Intel 80860,
6114# The official e_machine number for MIPS is now #8, regardless of endianness.
6115# The second number (#10) will be deprecated later. For now, we still
6116# say something if #10 is encountered, but only gory details for #8.
6117>18	leshort		8		MIPS,
6118>>4	byte		1
6119>>>36	lelong		&0x20		N32
6120>18	leshort		10		MIPS,
6121>>4	byte		1
6122>>>36	lelong		&0x20		N32
6123>18	leshort		8
6124# only for 32-bit
6125>>4	byte		1
6126>>>36  lelong&0xf0000000	0x00000000	MIPS-I
6127>>>36  lelong&0xf0000000	0x10000000	MIPS-II
6128>>>36  lelong&0xf0000000	0x20000000	MIPS-III
6129>>>36  lelong&0xf0000000	0x30000000	MIPS-IV
6130>>>36  lelong&0xf0000000	0x40000000	MIPS-V
6131>>>36  lelong&0xf0000000	0x50000000	MIPS32
6132>>>36  lelong&0xf0000000	0x60000000	MIPS64
6133>>>36  lelong&0xf0000000	0x70000000	MIPS32 rel2
6134>>>36  lelong&0xf0000000	0x80000000	MIPS64 rel2
6135# only for 64-bit
6136>>4	byte		2
6137>>>48  lelong&0xf0000000	0x00000000	MIPS-I
6138>>>48  lelong&0xf0000000	0x10000000	MIPS-II
6139>>>48  lelong&0xf0000000	0x20000000	MIPS-III
6140>>>48  lelong&0xf0000000	0x30000000	MIPS-IV
6141>>>48  lelong&0xf0000000	0x40000000	MIPS-V
6142>>>48  lelong&0xf0000000	0x50000000	MIPS32
6143>>>48  lelong&0xf0000000	0x60000000	MIPS64
6144>>>48  lelong&0xf0000000	0x70000000	MIPS32 rel2
6145>>>48  lelong&0xf0000000	0x80000000	MIPS64 rel2
6146>18	leshort		9		Amdahl,
6147>18	leshort		10		MIPS (deprecated),
6148>18	leshort		11		RS6000,
6149>18	leshort		15		PA-RISC,
6150# only for 32-bit
6151>>4	byte		1
6152>>>38	leshort		0x0214		2.0
6153>>>36	leshort		&0x0008		(LP64)
6154# only for 64-bit
6155>>4	byte		2
6156>>>50	leshort		0x0214		2.0
6157>>>48	leshort		&0x0008		(LP64)
6158>18	leshort		16		nCUBE,
6159>18	leshort		17		Fujitsu VPP500,
6160>18	leshort		18		SPARC32PLUS,
6161# only for 32-bit
6162>>4	byte		1
6163>>>36	lelong&0xffff00	0x000100	V8+ Required,
6164>>>36	lelong&0xffff00	0x000200	Sun UltraSPARC1 Extensions Required,
6165>>>36	lelong&0xffff00	0x000400	HaL R1 Extensions Required,
6166>>>36	lelong&0xffff00	0x000800	Sun UltraSPARC3 Extensions Required,
6167>18	leshort		19		Intel 80960,
6168>18	leshort		20		PowerPC or cisco 4500,
6169>18	leshort		21		64-bit PowerPC or cisco 7500,
6170>18	leshort		22		IBM S/390,
6171>18	leshort		23		Cell SPU,
6172>18	leshort		24		cisco SVIP,
6173>18	leshort		25		cisco 7200,
6174>18	leshort		36		NEC V800 or cisco 12000,
6175>18	leshort		37		Fujitsu FR20,
6176>18	leshort		38		TRW RH-32,
6177>18	leshort		39		Motorola RCE,
6178>18	leshort		40		ARM,
6179>>4	byte		1
6180>>>36	lelong&0xff000000	0x04000000	EABI4
6181>>>36	lelong&0xff000000	0x05000000	EABI5
6182>>>36	lelong		&0x00800000	BE8
6183>>>36	lelong		&0x00400000	LE8
6184>18	leshort		41		Alpha,
6185>18	leshort		42		Renesas SH,
6186>18	leshort		43		SPARC V9,
6187>>4	byte		2
6188>>>48	lelong&0xffff00	0x000200	Sun UltraSPARC1 Extensions Required,
6189>>>48	lelong&0xffff00	0x000400	HaL R1 Extensions Required,
6190>>>48	lelong&0xffff00	0x000800	Sun UltraSPARC3 Extensions Required,
6191>>>48	lelong&0x3	0		total store ordering,
6192>>>48	lelong&0x3	1		partial store ordering,
6193>>>48	lelong&0x3	2		relaxed memory ordering,
6194>18	leshort		44		Siemens Tricore Embedded Processor,
6195>18	leshort		45		Argonaut RISC Core, Argonaut Technologies Inc.,
6196>18	leshort		46		Renesas H8/300,
6197>18	leshort		47		Renesas H8/300H,
6198>18	leshort		48		Renesas H8S,
6199>18	leshort		49		Renesas H8/500,
6200>18	leshort		50		IA-64,
6201>18	leshort		51		Stanford MIPS-X,
6202>18	leshort		52		Motorola Coldfire,
6203>18	leshort		53		Motorola M68HC12,
6204>18	leshort		54		Fujitsu MMA,
6205>18	leshort		55		Siemens PCP,
6206>18	leshort		56		Sony nCPU,
6207>18	leshort		57		Denso NDR1,
6208>18	leshort		58		Start*Core,
6209>18	leshort		59		Toyota ME16,
6210>18	leshort		60		ST100,
6211>18	leshort		61		Tinyj emb.,
6212>18	leshort		62		x86-64,
6213>18	leshort		63		Sony DSP,
6214>18	leshort		64		DEC PDP-10,
6215>18	leshort		65		DEC PDP-11,
6216>18	leshort		66		FX66,
6217>18	leshort		67		ST9+ 8/16 bit,
6218>18	leshort		68		ST7 8 bit,
6219>18	leshort		69		MC68HC16,
6220>18	leshort		70		MC68HC11,
6221>18	leshort		71		MC68HC08,
6222>18	leshort		72		MC68HC05,
6223>18	leshort		73		SGI SVx or Cray NV1,
6224>18	leshort		74		ST19 8 bit,
6225>18	leshort		75		Digital VAX,
6226>18	leshort		76		Axis cris,
6227>18	leshort		77		Infineon 32-bit embedded,
6228>18	leshort		78		Element 14 64-bit DSP,
6229>18	leshort		79		LSI Logic 16-bit DSP,
6230>18	leshort		80		MMIX,
6231>18	leshort		81		Harvard machine-independent,
6232>18	leshort		82		SiTera Prism,
6233>18	leshort		83		Atmel AVR 8-bit,
6234>18	leshort		84		Fujitsu FR30,
6235>18	leshort		85		Mitsubishi D10V,
6236>18	leshort		86		Mitsubishi D30V,
6237>18	leshort		87		NEC v850,
6238>18	leshort		88		Renesas M32R,
6239>18	leshort		89		Matsushita MN10300,
6240>18	leshort		90		Matsushita MN10200,
6241>18	leshort		91		picoJava,
6242>18	leshort		92		OpenRISC,
6243>18	leshort		93		ARC Cores Tangent-A5,
6244>18	leshort		94		Tensilica Xtensa,
6245>18	leshort		95		Alphamosaic VideoCore,
6246>18	leshort		96		Thompson Multimedia,
6247>18	leshort		97		NatSemi 32k,
6248>18	leshort		98		Tenor Network TPC,
6249>18	leshort		99		Trebia SNP 1000,
6250>18	leshort		100		STMicroelectronics ST200,
6251>18	leshort		101		Ubicom IP2022,
6252>18	leshort		102		MAX Processor,
6253>18	leshort		103		NatSemi CompactRISC,
6254>18	leshort		104		Fujitsu F2MC16,
6255>18	leshort		105		TI msp430,
6256>18	leshort		106		Analog Devices Blackfin,
6257>18	leshort		107		S1C33 Family of Seiko Epson,
6258>18	leshort		108		Sharp embedded,
6259>18	leshort		109		Arca RISC,
6260>18	leshort		110		PKU-Unity Ltd.,
6261>18	leshort		111		eXcess: 16/32/64-bit,
6262>18	leshort		112		Icera Deep Execution Processor,
6263>18	leshort		113		Altera Nios II,
6264>18	leshort		114		NatSemi CRX,
6265>18	leshort		115		Motorola XGATE,
6266>18	leshort		116		Infineon C16x/XC16x,
6267>18	leshort		117		Renesas M16C series,
6268>18	leshort		118		Microchip dsPIC30F,
6269>18	leshort		119		Freescale RISC core,
6270>18	leshort		120		Renesas M32C series,
6271>18	leshort		131		Altium TSK3000 core,
6272>18	leshort		132		Freescale RS08,
6273>18	leshort		134		Cyan Technology eCOG2,
6274>18	leshort		135		Sunplus S+core7 RISC,
6275>18	leshort		136		New Japan Radio (NJR) 24-bit DSP,
6276>18	leshort		137		Broadcom VideoCore III,
6277>18	leshort		138		LatticeMico32,
6278>18	leshort		139		Seiko Epson C17 family,
6279>18	leshort		140		TI TMS320C6000 DSP family,
6280>18	leshort		141		TI TMS320C2000 DSP family,
6281>18	leshort		142		TI TMS320C55x DSP family,
6282>18	leshort		160		STMicroelectronics 64bit VLIW DSP,
6283>18	leshort		161		Cypress M8C,
6284>18	leshort		162		Renesas R32C series,
6285>18	leshort		163		NXP TriMedia family,
6286>18	leshort		164		QUALCOMM DSP6,
6287>18	leshort		165		Intel 8051 and variants,
6288>18	leshort		166		STMicroelectronics STxP7x family,
6289>18	leshort		167		Andes embedded RISC,
6290>18	leshort		168		Cyan eCOG1X family,
6291>18	leshort		169		Dallas MAXQ30,
6292>18	leshort		170		New Japan Radio (NJR) 16-bit DSP,
6293>18	leshort		171		M2000 Reconfigurable RISC,
6294>18	leshort		172		Cray NV2 vector architecture,
6295>18	leshort		173		Renesas RX family,
6296>18	leshort		174		META,
6297>18	leshort		175		MCST Elbrus,
6298>18	leshort		176		Cyan Technology eCOG16 family,
6299>18	leshort		177		NatSemi CompactRISC,
6300>18	leshort		178		Freescale Extended Time Processing Unit,
6301>18	leshort		179		Infineon SLE9X,
6302>18	leshort		180		Intel L1OM,
6303>18	leshort		181		Intel K1OM,
6304>18	leshort		183		ARM aarch64,
6305>18	leshort		185		Atmel 32-bit family,
6306>18	leshort		186		STMicroeletronics STM8 8-bit,
6307>18	leshort		187		Tilera TILE64,
6308>18	leshort		188		Tilera TILEPro,
6309>18	leshort		189		Xilinx MicroBlaze 32-bit RISC,
6310>18	leshort		190		NVIDIA CUDA architecture,
6311>18	leshort		191		Tilera TILE-Gx,
6312>18	leshort		197		Renesas RL78 family,
6313>18	leshort		199		Renesas 78K0R,
6314>18	leshort		200		Freescale 56800EX,
6315>18	leshort		201		Beyond BA1,
6316>18	leshort		202		Beyond BA2,
6317>18	leshort		203		XMOS xCORE,
6318>18	leshort		204		Microchip 8-bit PIC(r),
6319>18	leshort		210		KM211 KM32,
6320>18	leshort		211		KM211 KMX32,
6321>18	leshort		212		KM211 KMX16,
6322>18	leshort		213		KM211 KMX8,
6323>18	leshort		214		KM211 KVARC,
6324>18	leshort		215		Paneve CDP,
6325>18	leshort		216		Cognitive Smart Memory,
6326>18	leshort		217		iCelero CoolEngine,
6327>18	leshort		218		Nanoradio Optimized RISC,
6328>18	leshort		243		UCB RISC-V,
6329>18	leshort		0x1057		AVR (unofficial),
6330>18	leshort		0x1059		MSP430 (unofficial),
6331>18	leshort		0x1223		Adapteva Epiphany (unofficial),
6332>18	leshort		0x2530		Morpho MT (unofficial),
6333>18	leshort		0x3330		FR30 (unofficial),
6334>18	leshort		0x3426		OpenRISC (obsolete),
6335>18	leshort		0x4688		Infineon C166 (unofficial),
6336>18	leshort		0x5441		Cygnus FRV (unofficial),
6337>18	leshort		0x5aa5		DLX (unofficial),
6338>18	leshort		0x7650		Cygnus D10V (unofficial),
6339>18	leshort		0x7676		Cygnus D30V (unofficial),
6340>18	leshort		0x8217		Ubicom IP2xxx (unofficial),
6341>18	leshort		0x8472		OpenRISC (obsolete),
6342>18	leshort		0x9025		Cygnus PowerPC (unofficial),
6343>18	leshort		0x9026		Alpha (unofficial),
6344>18	leshort		0x9041		Cygnus M32R (unofficial),
6345>18	leshort		0x9080		Cygnus V850 (unofficial),
6346>18	leshort		0xa390		IBM S/390 (obsolete),
6347>18	leshort		0xabc7		Old Xtensa (unofficial),
6348>18	leshort		0xad45		xstormy16 (unofficial),
6349>18	leshort		0xbaab		Old MicroBlaze (unofficial),,
6350>18	leshort		0xbeef		Cygnus MN10300 (unofficial),
6351>18	leshort		0xdead		Cygnus MN10200 (unofficial),
6352>18	leshort		0xf00d		Toshiba MeP (unofficial),
6353>18	leshort		0xfeb0		Renesas M32C (unofficial),
6354>18	leshort		0xfeba		Vitesse IQ2000 (unofficial),
6355>18	leshort		0xfebb		NIOS (unofficial),
6356>18	leshort		0xfeed		Moxie (unofficial),
6357>18	default		x
6358>>18	leshort		x		*unknown arch 0x%x*
6359>20	lelong		0		invalid version
6360>20	lelong		1		version 1
6361
63620	string		\177ELF		ELF
6363!:strength *2
6364>4	byte		0		invalid class
6365>4	byte		1		32-bit
6366>4	byte		2		64-bit
6367>5	byte		0		invalid byte order
6368>5	byte		1		LSB
6369>>0	use		elf-le
6370>5	byte		2		MSB
6371>>0	use		\^elf-le
6372# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
6373# like proper ELF, but extracting the string had bad results.
6374>4      byte            <0x80
6375>>8	string		>\0		(%s)
6376>8	string		\0
6377>>7	byte		0		(SYSV)
6378>>7	byte		1		(HP-UX)
6379>>7	byte		2		(NetBSD)
6380>>7	byte		3		(GNU/Linux)
6381>>7	byte		4		(GNU/Hurd)
6382>>7	byte		5		(86Open)
6383>>7	byte		6		(Solaris)
6384>>7	byte		7		(Monterey)
6385>>7	byte		8		(IRIX)
6386>>7	byte		9		(FreeBSD)
6387>>7	byte		10		(Tru64)
6388>>7	byte		11		(Novell Modesto)
6389>>7	byte		12		(OpenBSD)
6390>8      string          \2
6391>>7     byte            13              (OpenVMS)
6392>>7	byte		97		(ARM)
6393>>7	byte		255		(embedded)
6394
6395#------------------------------------------------------------------------------
6396# $File: encore,v 1.6 2009/09/19 16:28:09 christos Exp $
6397# encore:  file(1) magic for Encore machines
6398#
6399# XXX - needs to have the byte order specified (NS32K was little-endian,
6400# dunno whether they run the 88K in little-endian mode or not).
6401#
64020	short		0x154		Encore
6403>20	short		0x107		executable
6404>20	short		0x108		pure executable
6405>20	short		0x10b		demand-paged executable
6406>20	short		0x10f		unsupported executable
6407>12	long		>0		not stripped
6408>22	short		>0		- version %d
6409>22	short		0		-
6410#>4	date		x		stamp %s
64110	short		0x155		Encore unsupported executable
6412>12	long		>0		not stripped
6413>22	short		>0		- version %d
6414>22	short		0		-
6415#>4	date		x		stamp %s
6416
6417#------------------------------------------------------------------------------
6418# $File: epoc,v 1.8 2012/06/16 14:43:36 christos Exp $
6419# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1]
6420# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de>
6421# Useful information for improving this file can be found at:
6422# http://software.frodo.looijaard.name/psiconv/formats/Index.html
6423#------------------------------------------------------------------------------
64240	lelong		0x10000037	Psion Series 5
6425>4	lelong		0x10000039	font file
6426>4	lelong		0x1000003A	printer driver
6427>4	lelong		0x1000003B	clipboard
6428>4	lelong		0x10000042	multi-bitmap image
6429!:mime image/x-epoc-mbm
6430>4	lelong		0x1000006A	application information file
6431>4	lelong		0x1000006D
6432>>8	lelong		0x1000007D	Sketch image
6433!:mime image/x-epoc-sketch
6434>>8	lelong		0x1000007E	voice note
6435>>8	lelong		0x1000007F	Word file
6436!:mime application/x-epoc-word
6437>>8	lelong		0x10000085	OPL program (TextEd)
6438!:mime application/x-epoc-opl
6439>>8	lelong		0x10000087	Comms settings
6440>>8	lelong		0x10000088	Sheet file
6441!:mime application/x-epoc-sheet
6442>>8	lelong		0x100001C4	EasyFax initialisation file
6443>4	lelong		0x10000073	OPO module
6444!:mime application/x-epoc-opo
6445>4	lelong		0x10000074	OPL application
6446!:mime application/x-epoc-app
6447>4	lelong		0x1000008A	exported multi-bitmap image
6448>4	lelong		0x1000016D
6449>>8	lelong		0x10000087	Comms names
6450
64510	lelong		0x10000041	Psion Series 5 ROM multi-bitmap image
6452
64530	lelong		0x10000050	Psion Series 5
6454>4	lelong		0x1000006D	database
6455>>8	lelong		0x10000084	Agenda file
6456!:mime application/x-epoc-agenda
6457>>8	lelong		0x10000086	Data file
6458!:mime application/x-epoc-data
6459>>8	lelong		0x10000CEA	Jotter file
6460!:mime application/x-epoc-jotter
6461>4	lelong		0x100000E4	ini file
6462
64630	lelong		0x10000079	Psion Series 5 binary:
6464>4	lelong		0x00000000	DLL
6465>4	lelong		0x10000049	comms hardware library
6466>4	lelong		0x1000004A	comms protocol library
6467>4	lelong		0x1000005D	OPX
6468>4	lelong		0x1000006C	application
6469>4	lelong		0x1000008D	DLL
6470>4	lelong		0x100000AC	logical device driver
6471>4	lelong		0x100000AD	physical device driver
6472>4	lelong		0x100000E5	file transfer protocol
6473>4	lelong		0x100000E5	file transfer protocol
6474>4	lelong		0x10000140	printer definition
6475>4	lelong		0x10000141	printer definition
6476
64770	lelong		0x1000007A	Psion Series 5 executable
6478
6479#------------------------------------------------------------------------------
6480# $File: erlang,v 1.5 2009/09/19 16:28:09 christos Exp $
6481# erlang:  file(1) magic for Erlang JAM and BEAM files
6482# URL:  http://www.erlang.org/faq/x779.html#AEN812
6483
6484# OTP R3-R4
64850	string	\0177BEAM!	Old Erlang BEAM file
6486>6	short	>0		- version %d
6487
6488# OTP R5 and onwards
64890	string	FOR1
6490>8	string	BEAM		Erlang BEAM file
6491
6492# 4.2 version may have a copyright notice!
64934	string	Tue\ Jan\ 22\ 14:32:44\ MET\ 1991	Erlang JAM file - version 4.2
649479	string	Tue\ Jan\ 22\ 14:32:44\ MET\ 1991	Erlang JAM file - version 4.2
6495
64964	string	1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995	Erlang JAM file - version 4.3
6497
64980	bequad	0x0000000000ABCDEF	Erlang DETS file
6499
6500#------------------------------------------------------------------------------
6501# $File$
6502# ESRI Shapefile format (.shp .shx .dbf=DBaseIII)
6503# Based on info from
6504# <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf>
65050	belong	9994	ESRI Shapefile
6506>4	belong	=0
6507>8	belong	=0
6508>12	belong	=0
6509>16	belong	=0
6510>20	belong	=0
6511>28	lelong	x	version %d
6512>24	belong	x	length %d
6513>32	lelong	=0	type Null Shape
6514>32	lelong	=1	type Point
6515>32	lelong	=3	type PolyLine
6516>32	lelong	=5	type Polygon
6517>32	lelong	=8	type MultiPoint
6518>32	lelong	=11	type PointZ
6519>32	lelong	=13	type PolyLineZ
6520>32	lelong	=15	type PolygonZ
6521>32	lelong	=18	type MultiPointZ
6522>32	lelong	=21	type PointM
6523>32	lelong	=23	type PolyLineM
6524>32	lelong	=25	type PolygonM
6525>32	lelong	=28	type MultiPointM
6526>32	lelong	=31	type MultiPatch
6527
6528#------------------------------------------------------------------------------
6529# $File$
6530# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files
6531# From Roger Leigh <roger@whinlatter.uklinux.net>
65320       string          FCS1.0          Flow Cytometry Standard (FCS) data, version 1.0
65330       string          FCS2.0          Flow Cytometry Standard (FCS) data, version 2.0
65340       string          FCS3.0          Flow Cytometry Standard (FCS) data, version 3.0
6535
6536#------------------------------------------------------------------------------
6537# $File: filesystems,v 1.108 2015/01/01 17:43:47 christos Exp $
6538# filesystems:  file(1) magic for different filesystems
6539#
65400	name	partid
6541>0	ubyte	0x00	Unused
6542>0	ubyte	0x01	12-bit FAT
6543>0	ubyte	0x02	XENIX /
6544>0	ubyte	0x03	XENIX /usr
6545>0	ubyte	0x04	16-bit FAT, less than 32M
6546>0	ubyte	0x05	extended partition
6547>0	ubyte	0x06	16-bit FAT, more than 32M
6548>0	ubyte	0x07	OS/2 HPFS, NTFS, QNX2, Adv. UNIX
6549>0	ubyte	0x08	AIX or os, or etc.
6550>0	ubyte	0x09	AIX boot partition or Coherent
6551>0	ubyte	0x0a	O/2 boot manager or Coherent swap
6552>0	ubyte	0x0b	32-bit FAT
6553>0	ubyte	0x0c	32-bit FAT, LBA-mapped
6554>0	ubyte	0x0d	7XXX, LBA-mapped
6555>0	ubyte	0x0e	16-bit FAT, LBA-mapped
6556>0	ubyte	0x0f	extended partition, LBA-mapped
6557>0	ubyte	0x10	OPUS
6558>0	ubyte	0x11 	OS/2 DOS 12-bit FAT
6559>0	ubyte	0x12 	Compaq diagnostics
6560>0	ubyte	0x14 	OS/2 DOS 16-bit FAT <32M
6561>0	ubyte	0x16 	OS/2 DOS 16-bit FAT >=32M
6562>0	ubyte	0x17 	OS/2 hidden IFS
6563>0	ubyte	0x18 	AST Windows swapfile
6564>0	ubyte	0x19 	Willowtech Photon coS
6565>0	ubyte	0x1b 	hidden win95 fat 32
6566>0	ubyte	0x1c 	hidden win95 fat 32 lba
6567>0	ubyte	0x1d	hidden win95 fat 16 lba
6568>0	ubyte	0x20 	Willowsoft OFS1
6569>0	ubyte	0x21 	reserved
6570>0	ubyte	0x23 	reserved
6571>0	ubyte	0x24	NEC DOS
6572>0	ubyte	0x26 	reserved
6573>0	ubyte	0x31 	reserved
6574>0	ubyte	0x32	Alien Internet Services NOS
6575>0	ubyte	0x33 	reserved
6576>0	ubyte	0x34 	reserved
6577>0	ubyte	0x35 	JFS on OS2
6578>0	ubyte	0x36 	reserved
6579>0	ubyte	0x38 	Theos
6580>0	ubyte	0x39 	Plan 9, or Theos spanned
6581>0	ubyte	0x3a 	Theos ver 4 4gb partition
6582>0	ubyte	0x3b 	Theos ve 4 extended partition
6583>0	ubyte	0x3c 	PartitionMagic recovery
6584>0	ubyte	0x3d 	Hidden Netware
6585>0	ubyte	0x40 	VENIX 286 or LynxOS
6586>0	ubyte	0x41	PReP
6587>0	ubyte	0x42	linux swap sharing DRDOS disk
6588>0	ubyte	0x43	linux sharing DRDOS disk
6589>0	ubyte	0x44	GoBack change utility
6590>0	ubyte	0x45	Boot US Boot manager
6591>0	ubyte	0x46	EUMEL/Elan or Ergos 3
6592>0	ubyte	0x47	EUMEL/Elan or Ergos 3
6593>0	ubyte	0x48	EUMEL/Elan or Ergos 3
6594>0	ubyte	0x4a	ALFX/THIN filesystem for DOS
6595>0	ubyte	0x4c	Oberon partition
6596>0	ubyte	0x4d 	QNX4.x
6597>0	ubyte	0x4e 	QNX4.x 2nd part
6598>0	ubyte	0x4f 	QNX4.x 3rd part
6599>0	ubyte	0x50 	DM (disk manager)
6600>0	ubyte	0x51 	DM6 Aux1 (or Novell)
6601>0	ubyte	0x52 	CP/M or Microport SysV/AT
6602>0	ubyte	0x53 	DM6 Aux3
6603>0	ubyte	0x54	DM6 DDO
6604>0	ubyte	0x55	EZ-Drive (disk manager)
6605>0	ubyte	0x56	Golden Bow (disk manager)
6606>0	ubyte	0x57	Drive PRO
6607>0	ubyte	0x5c	Priam Edisk (disk manager)
6608>0	ubyte	0x61	SpeedStor
6609>0	ubyte	0x63	GNU HURD or Mach or Sys V/386
6610>0	ubyte	0x64	Novell Netware 2.xx or Speedstore
6611>0	ubyte	0x65	Novell Netware 3.xx
6612>0	ubyte	0x66	Novell 386 Netware
6613>0	ubyte	0x67	Novell
6614>0	ubyte	0x68	Novell
6615>0	ubyte	0x69	Novell
6616>0	ubyte	0x70	DiskSecure Multi-Boot
6617>0	ubyte	0x71	reserved
6618>0	ubyte	0x73	reserved
6619>0	ubyte	0x74	reserved
6620>0	ubyte	0x75	PC/IX
6621>0	ubyte	0x76	reserved
6622>0	ubyte	0x77	M2FS/M2CS partition
6623>0	ubyte	0x78	XOSL boot loader filesystem
6624>0	ubyte	0x80	MINIX until 1.4a
6625>0	ubyte	0x81	MINIX since 1.4b
6626>0	ubyte	0x82	Linux swap or Solaris
6627>0	ubyte	0x83	Linux native
6628>0	ubyte	0x84	OS/2 hidden C: drive
6629>0	ubyte	0x85	Linux extended partition
6630>0	ubyte	0x86	NT FAT volume set
6631>0	ubyte	0x87	NTFS volume set or HPFS mirrored
6632>0	ubyte	0x8a	Linux Kernel AiR-BOOT partition
6633>0	ubyte	0x8b	Legacy Fault tolerant FAT32
6634>0	ubyte	0x8c	Legacy Fault tolerant FAT32 ext
6635>0	ubyte	0x8d	Hidden free FDISK FAT12
6636>0	ubyte	0x8e	Linux Logical Volume Manager
6637>0	ubyte	0x90	Hidden free FDISK FAT16
6638>0	ubyte	0x91	Hidden free FDISK DOS EXT
6639>0	ubyte	0x92	Hidden free FDISK FAT16 Big
6640>0	ubyte	0x93	Amoeba filesystem
6641>0	ubyte	0x94	Amoeba bad block table
6642>0	ubyte	0x95	MIT EXOPC native partitions
6643>0	ubyte	0x97	Hidden free FDISK FAT32
6644>0	ubyte	0x98	Datalight ROM-DOS Super-Boot
6645>0	ubyte	0x99	Mylex EISA SCSI
6646>0	ubyte	0x9a	Hidden free FDISK FAT16 LBA
6647>0	ubyte	0x9b	Hidden free FDISK EXT LBA
6648>0	ubyte	0x9f	BSDI?
6649>0	ubyte	0xa0	IBM Thinkpad hibernation
6650>0	ubyte	0xa1	HP Volume expansion (SpeedStor)
6651>0	ubyte	0xa3	HP Volume expansion (SpeedStor)
6652>0	ubyte	0xa4	HP Volume expansion (SpeedStor)
6653>0	ubyte	0xa5	386BSD partition type
6654>0	ubyte	0xa6	OpenBSD partition type
6655>0	ubyte	0xa7	NeXTSTEP 486
6656>0	ubyte	0xa8	Apple UFS
6657>0	ubyte	0xa9	NetBSD partition type
6658>0	ubyte	0xaa	Olivetty Fat12 1.44MB Service part
6659>0	ubyte	0xab	Apple Boot
6660>0	ubyte	0xae	SHAG OS filesystem
6661>0	ubyte	0xaf	Apple HFS
6662>0	ubyte	0xb0	BootStar Dummy
6663>0	ubyte	0xb1	reserved
6664>0	ubyte	0xb3	reserved
6665>0	ubyte	0xb4	reserved
6666>0	ubyte	0xb6	reserved
6667>0	ubyte	0xb7	BSDI BSD/386 filesystem
6668>0	ubyte	0xb8	BSDI BSD/386 swap
6669>0	ubyte	0xbb	Boot Wizard Hidden
6670>0	ubyte	0xbe	Solaris 8 partition type
6671>0	ubyte	0xbf	Solaris partition type
6672>0	ubyte	0xc0 	CTOS
6673>0	ubyte	0xc1 	DRDOS/sec (FAT-12)
6674>0	ubyte	0xc2 	Hidden Linux
6675>0	ubyte	0xc3 	Hidden Linux swap
6676>0	ubyte	0xc4 	DRDOS/sec (FAT-16, < 32M)
6677>0	ubyte	0xc5 	DRDOS/sec (EXT)
6678>0	ubyte	0xc6 	DRDOS/sec (FAT-16, >= 32M)
6679>0	ubyte	0xc7 	Syrinx (Cyrnix?) or HPFS disabled
6680>0	ubyte	0xc8 	Reserved for DR-DOS 8.0+
6681>0	ubyte	0xc9 	Reserved for DR-DOS 8.0+
6682>0	ubyte	0xca 	Reserved for DR-DOS 8.0+
6683>0	ubyte	0xcb 	DR-DOS 7.04+ Secured FAT32 CHS
6684>0	ubyte	0xcc 	DR-DOS 7.04+ Secured FAT32 LBA
6685>0	ubyte	0xcd	CTOS Memdump
6686>0	ubyte	0xce 	DR-DOS 7.04+ FAT16X LBA
6687>0	ubyte	0xcf 	DR-DOS 7.04+ EXT LBA
6688>0	ubyte	0xd0 	REAL/32 secure big partition
6689>0	ubyte	0xd1 	Old Multiuser DOS FAT12
6690>0	ubyte	0xd4 	Old Multiuser DOS FAT16 Small
6691>0	ubyte	0xd5 	Old Multiuser DOS Extended
6692>0	ubyte	0xd6 	Old Multiuser DOS FAT16 Big
6693>0	ubyte	0xd8 	CP/M 86
6694>0	ubyte	0xdb 	CP/M or Concurrent CP/M
6695>0	ubyte	0xdd 	Hidden CTOS Memdump
6696>0	ubyte	0xde 	Dell PowerEdge Server utilities
6697>0	ubyte	0xdf 	DG/UX virtual disk manager
6698>0	ubyte	0xe0 	STMicroelectronics ST AVFS
6699>0	ubyte	0xe1 	DOS access or SpeedStor 12-bit
6700>0	ubyte	0xe3 	DOS R/O or Storage Dimensions
6701>0	ubyte	0xe4 	SpeedStor 16-bit FAT < 1024 cyl.
6702>0	ubyte	0xe5	reserved
6703>0	ubyte	0xe6	reserved
6704>0	ubyte	0xeb 	BeOS
6705>0	ubyte	0xee	GPT Protective MBR
6706>0	ubyte	0xef	EFI system partition
6707>0	ubyte	0xf0 	Linux PA-RISC boot loader
6708>0	ubyte	0xf1 	SpeedStor or Storage Dimensions
6709>0	ubyte	0xf2 	DOS 3.3+ Secondary
6710>0	ubyte	0xf3	reserved
6711>0	ubyte	0xf4	SpeedStor large partition
6712>0	ubyte	0xf5	Prologue multi-volumen partition
6713>0	ubyte	0xf6 	reserved
6714>0	ubyte	0xf9 	pCache: ext2/ext3 persistent cache
6715>0	ubyte	0xfa 	Bochs x86 emulator
6716>0	ubyte	0xfb 	VMware File System
6717>0	ubyte	0xfc 	VMware Swap
6718>0	ubyte	0xfd 	Linux RAID partition persistent sb
6719>0	ubyte	0xfe	LANstep or IBM PS/2 IML
6720>0	ubyte	0xff 	Xenix Bad Block Table
6721
67220	string	\366\366\366\366	PC formatted floppy with no filesystem
6723# Sun disk labels
6724# From /usr/include/sun/dklabel.h:
67250774	beshort		0xdabe
6726# modified by Joerg Jenderek, because original test
6727# succeeds for Cabinet archive dao360.dl_ with negative blocks
6728>0770	long		>0		Sun disk label
6729>>0	string		x		'%s
6730>>>31	string		>\0		\b%s
6731>>>>63	string		>\0		\b%s
6732>>>>>95	string		>\0		\b%s
6733>>0	string		x		\b'
6734>>0734	short		>0		%d rpm,
6735>>0736	short		>0		%d phys cys,
6736>>0740	short		>0		%d alts/cyl,
6737>>0746	short		>0		%d interleave,
6738>>0750	short		>0		%d data cyls,
6739>>0752	short		>0		%d alt cyls,
6740>>0754	short		>0		%d heads/partition,
6741>>0756	short		>0		%d sectors/track,
6742>>0764	long		>0		start cyl %d,
6743>>0770	long		x		%d blocks
6744# Is there a boot block written 1 sector in?
6745>512    belong&077777777	0600407	\b, boot block present
6746
6747# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk
6748# (http://btmgr.sourceforge.net/docs/user-guide-3.html)
67490		string	SBMBAKUP_	Smart Boot Manager backup file
6750>9		string	x		\b, version %-5.5s
6751>>14		string	=_
6752>>>15		string	x		%-.1s
6753>>>>16		string	=_		\b.
6754>>>>>17		string	x		\b%-.1s
6755>>>>>>18	string	=_		\b.
6756>>>>>>>19	string	x		\b%-.1s
6757>>>22		ubyte	0
6758>>>>21		ubyte	x		\b, from drive 0x%x
6759>>>22		ubyte	>0
6760>>>>21		string	x		\b, from drive %s
6761>>>535		search/17	\x55\xAA
6762>>>>&-512	indirect	x	\b; contains
6763
6764# updated by Joerg Jenderek at Nov 2012
6765# DOS Emulator image is 128 byte, null right padded header + harddisc image
67660	string	DOSEMU\0
6767>0x27E	leshort	0xAA55
6768#offset is 128
6769>>19	ubyte	128
6770>>>(19.b-1)	ubyte	0x0	DOS Emulator image
6771>>>>7	ulelong	>0		\b, %u heads
6772>>>>11	ulelong	>0		\b, %d sectors/track
6773>>>>15	ulelong	>0		\b, %d cylinders
6774>>>>128	indirect	x	\b; contains
6775
6776# added by Joerg Jenderek at Nov 2012
6777# http://www.thenakedpc.com/articles/v04/08/0408-05.html
6778# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data
67790	string	PNCIHISK\0		Norton Utilities disc image data
6780# real x86 boot sector with jump instruction
6781>509	search/1026	\x55\xAA\xeb
6782>>&-1	indirect	x		\b; contains
6783# http://file-extension.net/seeker/file_extension_dat
67840	string	PNCIUNDO		Norton Disk Doctor UnDo file
6785#
6786
6787# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013
6788# for any allowed sector sizes
678930		search/481	\x55\xAA
6790# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
6791# DOS BPB information (70) and after DOS floppy (120) like in previous file version
6792!:strength +65
6793# for sector sizes < 512 Bytes
6794>11		uleshort	<512
6795>>(11.s-2)	uleshort	0xAA55		DOS/MBR boot sector
6796# for sector sizes with 512 or more Bytes
6797>0x1FE		leshort		0xAA55		DOS/MBR boot sector
6798
6799# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying
6800# only for sector sizes with 512 or more Bytes
68010x1FE          leshort         0xAA55         	DOS/MBR boot sector
6802#
6803# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
6804!:strength +65
6805>2		string		OSBS		OS/BS MBR
6806# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
6807# and http://en.wikipedia.org/wiki/Master_Boot_Record
6808# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
6809# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00
6810>0	search/2	\x33\xc0\x8e\xd0\xbc\x00\x7c	MS-MBR
6811# Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm )
6812# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld
6813>>8	ubequad		0x8bf45007501ffbfc
6814# http://thestarman.pcministry.com/asm/mbr/200MBR.htm
6815>>>0x16	ubyte		0xF3				\b,DOS 2
6816>>>>219	regex		Author\ -\ 			Author:
6817# found "David Litton" , "A Pehrsson  "
6818>>>>>&0	string		x				"%s"
6819>>>0x16	ubyte		0xF2
6820# NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm
6821# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz
6822>>>>0x22	ubequad	0xbf7c07813d5aa575		\b,NEC 3.3
6823# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111)
6824>>>>0x22	default	x				\b,D0S version 3.3-7.0
6825# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...)
6826# where nn is string offset varying for different languages
6827# "Invalid partition table"				nn=0x8b for english version
6828>>>>>(0x49.b)	string		Invalid\ partition\ table		english
6829>>>>>(0x49.b)	string		Ung\201ltige\ Partitionstabelle		german
6830>>>>>(0x49.b)	string		Table\ de\ partition\ invalide		french
6831>>>>>(0x49.b)	string		Tabela\ de\ parti\207ao\ inv\240lida	portuguese
6832>>>>>(0x49.b)	string		Tabla\ de\ partici\242n\ no\ v\240lida	spanish
6833>>>>>(0x49.b)	string		Tavola\ delle\ partizioni\ non\ valida	italian
6834>>>>>0x49	ubyte		>0			at offset 0x%x
6835>>>>>>(0x49.b)	string		>\0			"%s"
6836# "Error loading operating system"			nn=0xa3 for english version
6837# "Fehler beim Laden des Betriebssystems"		nn=0xa7 for german version
6838# "Erreur en chargeant syst\212me d'exploitation"	nn=0xa7 for french version
6839# "Erro na inicializa\207ao do sistema operacional"	nn=0xa7 for portuguese Brazilian version
6840# "Error al cargar sistema operativo"			nn=0xa8 for spanish version
6841# "Errore durante il caricamento del sistema operativo"	nn=0xae for italian version
6842>>>>>0x74	ubyte		>0			at offset 0x%x
6843>>>>>>(0x74.b)	string		>\0			"%s"
6844# "Missing operating system"				nn=0xc2 for english version
6845# "Betriebssystem fehlt"				nn=0xcd for german version
6846# "Syst\212me d'exploitation absent"			nn=0xd2 for french version
6847# "Sistema operacional nao encontrado"			nn=0xd4 for portuguese Brazilian version
6848# "Falta sistema operativo"				nn=0xca for spanish version
6849# "Sistema operativo mancante"				nn=0xe2 for italian version
6850>>>>>0x79	ubyte		>0			at offset 0x%x
6851>>>>>>(0x79.b)	string		>\0			"%s"
6852# Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
6853# assembler instructions: push ax;pop es;push  ax;pop ds;cld;mov si,7c1b
6854>>8	ubequad		0x5007501ffcbe1b7c
6855# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04
6856>>>24		ubequad	0xf3a4cbbebe07b104		9M
6857# "Invalid partition table"				nn=0x10F for english version
6858# "Ung\201ltige Partitionstabelle"				nn=0x10F for german version
6859# "Table de partition erron\202e"				nn=0x10F for french version
6860# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240"	nn=0x10F for russian version
6861>>>>(0x3C.b+0x0FF)	string	Invalid\ partition\ table		english
6862>>>>(0x3C.b+0x0FF)	string	Ung\201ltige\ Partitionstabelle		german
6863>>>>(0x3C.b+0x0FF)	string	Table\ de\ partition\ erron\202e	french
6864>>>>(0x3C.b+0x0FF)	string	\215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240	russian
6865>>>>0x3C		ubyte	x			at offset 0x%x+0xFF
6866>>>>(0x3C.b+0x0FF)	string	>\0			"%s"
6867# "Error loading operating system"			nn=0x127 for english version
6868# "Fehler beim Laden des Betriebssystems"		nn=0x12b for german version
6869# "Erreur lors du chargement du syst\212me d'exploitation"	nn=0x12a for french version
6870# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353"	nn=0x12d for russian version
6871>>>>0xBD		ubyte	x			at offset 0x1%x
6872>>>>(0xBD.b+0x100)	string	>\0			"%s"
6873# "Missing operating system"				nn=0x146 for english version
6874# "Betriebssystem fehlt"				nn=0x151 for german version
6875# "Syst\212me d'exploitation manquant"			nn=0x15e for french version
6876# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240"	nn=0x156 for russian version
6877>>>>0xA9		ubyte	x			at offset 0x1%x
6878>>>>(0xA9.b+0x100)	string	>\0			"%s"
6879# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm
6880# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04
6881>>>24		ubequad	0xf3a4cbbdbe07b104		XP
6882# where xxyyzz are lower bits from offsets of error messages varying for different languages
6883>>>>0x1B4	ubelong&0x00FFFFFF	0x002c4463	english
6884>>>>0x1B4	ubelong&0x00FFFFFF	0x002c486e	german
6885# "Invalid partition table"				xx=0x12C for english version
6886# "Ung\201ltige Partitionstabelle"				xx=0x12C for german version
6887>>>>0x1b5	ubyte		>0			at offset 0x1%x
6888>>>>(0x1b5.b+0x100)	string	>\0			"%s"
6889# "Error loading operating system"			yy=0x144 for english version
6890# "Fehler beim Laden des Betriebssystems"		yy=0x148 for german version
6891>>>>0x1b6	ubyte		>0			at offset 0x1%x
6892>>>>(0x1b6.b+0x100)	string	>\0			"%s"
6893# "Missing operating system"				zz=0x163 for english version
6894# "Betriebssystem nicht vorhanden"			zz=0x16e for german version
6895>>>>0x1b7	ubyte		>0			at offset 0x1%x
6896>>>>(0x1b7.b+0x100)	string	>\0			"%s"
6897# Microsoft Windows Vista or 7
6898# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00
6899>>8	ubequad		0xc08ed8be007cbf00
6900# Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm)
6901# assembler instructions: jnz 0729;cmp ebx,"TCPA"
6902>>>0xEC		ubequad	0x753b6681fb544350		Vista
6903# where xxyyzz are lower bits from offsets of error messages varying for different languages
6904>>>>0x1B4	ubelong&0x00FFFFFF	0x00627a99	english
6905#>>>>0x1B4	ubelong&0x00FFFFFF	?		german
6906# "Invalid partition table"				xx=0x162 for english version
6907# "Ung\201ltige Partitionstabelle"				xx=0x1?? for german version
6908>>>>0x1b5	ubyte		>0			at offset 0x1%x
6909>>>>(0x1b5.b+0x100)	string	>\0			"%s"
6910# "Error loading operating system"			yy=0x17a for english version
6911# "Fehler beim Laden des Betriebssystems"		yy= 0x1?? for german version
6912>>>>0x1b6	ubyte		>0			at offset 0x1%x
6913>>>>(0x1b6.b+0x100)	string	>\0			"%s"
6914# "Missing operating system"				zz=0x199 for english version
6915# "Betriebssystem nicht vorhanden"			zz=0x1?? for german version
6916>>>>0x1b7	ubyte		>0			at offset 0x1%x
6917>>>>(0x1b7.b+0x100)	string	>\0			"%s"
6918# Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm)
6919# assembler instructions: cmp ebx,"TCPA";cmp
6920>>>0xEC		ubequad	0x6681fb5443504175		Windows 7
6921# where xxyyzz are lower bits from offsets of error messages varying for different languages
6922>>>>0x1B4	ubelong&0x00FFFFFF	0x00637b9a	english
6923#>>>>0x1B4	ubelong&0x00FFFFFF	?		german
6924# "Invalid partition table"				xx=0x163 for english version
6925# "Ung\201ltige Partitionstabelle"				xx=0x1?? for german version
6926>>>>0x1b5	ubyte		>0			at offset 0x1%x
6927>>>>(0x1b5.b+0x100)	string	>\0			"%s"
6928# "Error loading operating system"			yy=0x17b for english version
6929# "Fehler beim Laden des Betriebssystems"		yy=0x1?? for german version
6930>>>>0x1b6	ubyte		>0			at offset 0x1%x
6931>>>>(0x1b6.b+0x100)	string	>\0			"%s"
6932# "Missing operating system"				zz=0x19a for english version
6933# "Betriebssystem nicht vorhanden"			zz=0x1?? for german version
6934>>>>0x1b7	ubyte		>0			at offset 0x1%x
6935>>>>(0x1b7.b+0x100)	string	>\0			"%s"
6936# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs
6937# http://en.wikipedia.org/wiki/MBR_disk_signature#ID
6938>>0x1b8	ulelong		>0				\b, disk signature 0x%-.4x
6939# driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm
6940>>0xDA	uleshort		0
6941>>>0xDC 	ulelong		>0			\b, created
6942# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive
6943>>>>0xDC	ubyte		x			with driveID 0x%x
6944# hours, minutes and seconds
6945>>>>0xDf	ubyte		x			at %x
6946>>>>0xDe	ubyte		x			\b:%x
6947>>>>0xDd	ubyte		x			\b:%x
6948# special case for Microsoft MS-DOS 3.21 spanish
6949# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov
6950>0	ubequad		0xfab830008ed0bc00
6951# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov
6952>>8	ubequad		0x1fbfcb800008ed8		MS-MBR,D0S version 3.21 spanish
6953# Microsoft MBR IPL end
6954
6955# dr-dos with some upper-, lowercase variants
6956>0x9D	string	Invalid\ partition\ table$
6957>>181	string	No\ Operating\ System$
6958>>>201	string	Operating\ System\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
6959>0x9D	string	Invalid\ partition\ table$
6960>>181	string	No\ operating\ system$
6961>>>201	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
6962>342	string	Invalid\ partition\ table$
6963>>366	string	No\ operating\ system$
6964>>>386	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, version 7.01 to 7.03
6965>295	string	NEWLDR\0
6966>>302	string	Bad\ PT\ $
6967>>>310	string	No\ OS\ $
6968>>>>317	string	OS\ load\ err$
6969>>>>>329	string	Moved\ or\ missing\ IBMBIO.LDR\n\r
6970>>>>>>358	string	Press\ any\ key\ to\ continue.\n\r$
6971>>>>>>>387	string	Copyright\ (c)\ 1984,1998
6972>>>>>>>>411	string	Caldera\ Inc.\0		\b, DR-DOS MBR (IBMBIO.LDR)
6973#
6974# tests for different MS-DOS Master Boot Records (MBR) moved and merged
6975#
6976#>0x145	string	Default:\ F				\b, FREE-DOS MBR
6977#>0x14B	string	Default:\ F				\b, FREE-DOS 1.0 MBR
6978>0x145	search/7	Default:\ F			\b, FREE-DOS MBR
6979#>>313		string	F0\ .\ .\ .
6980#>>>322		string	disk\ 1
6981#>>>>382	string	FAT3
6982>64	string	no\ active\ partition\ found
6983>>96	string	read\ error\ while\ reading\ drive	\b, FREE-DOS Beta 0.9 MBR
6984# Ranish Partition Manager http://www.ranish.com/part/
6985>387	search/4	\0\ Error!\r
6986>>378	search/7	Virus!
6987>>>397	search/4	Booting\
6988>>>>408	search/4	HD1/\0	 			\b, Ranish MBR (
6989>>>>>416	string	Writing\ changes...		\b2.37
6990>>>>>>438	ubyte		x			\b,0x%x dots
6991>>>>>>440	ubyte		>0			\b,virus check
6992>>>>>>441	ubyte		>0			\b,partition %c
6993#2.38,2.42,2.44
6994>>>>>416	string	!Writing\ changes...		\b
6995>>>>>>418	ubyte	1				\bvirus check,
6996>>>>>>419	ubyte	x				\b0x%x seconds
6997>>>>>>420	ubyte&0x0F	>0			\b,partition
6998>>>>>>>420	ubyte&0x0F	<5			\b %x
6999>>>>>>>420	ubyte&0x0F	0Xf			\b ask
7000>>>>>420	ubyte		x			\b)
7001#
7002# SYSLINUX MBR moved
7003# http://www.acronis.de/
7004>362	string	MBR\ Error\ \0\r
7005>>376	string	ress\ any\ key\ to\
7006>>>392	string	boot\ from\ floppy...\0			\b, Acronis MBR
7007# added by Joerg Jenderek
7008# http://www.visopsys.org/
7009# http://partitionlogic.org.uk/
7010>309	string	No\ bootable\ partition\ found\r
7011>>339	string	I/O\ Error\ reading\ boot\ sector\r	\b, Visopsys MBR
7012>349	string	No\ bootable\ partition\ found\r
7013>>379	string	I/O\ Error\ reading\ boot\ sector\r	\b, simple Visopsys MBR
7014# bootloader, bootmanager
7015>0x40	string	SBML
7016# label with 11 characters of FAT 12 bit filesystem
7017>>43	string	SMART\ BTMGR
7018>>>430	string	SBMK\ Bad!\r			\b, Smart Boot Manager
7019# OEM-ID not always "SBM"
7020#>>>>3	strings	SBM
7021>>>>6	string	>\0                             \b, version %s
7022>382	string	XOSLLOADXCF			\b, eXtended Operating System Loader
7023>6	string	LILO				\b, LInux i386 boot LOader
7024>>120	string	LILO				\b, version 22.3.4 SuSe
7025>>172	string	LILO				\b, version 22.5.8 Debian
7026# updated by Joerg Jenderek at Oct 2008
7027# variables according to grub-0.97/stage1/stage1.S or
7028# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
7029# usual values are marked with comments to get only informations of strange GRUB loaders
7030>342		search/60	\0Geom\0
7031#>0		ulelong		x		%x=0x009048EB ,	0x2a9048EB  0
7032>>0x41		ubyte		<2
7033>>>0x3E		ubyte		>2		\b; GRand Unified Bootloader
7034# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
7035>>>>0x3E	ubyte		x		\b, stage1 version 0x%x
7036#If it is 0xFF, use a drive passed by BIOS
7037>>>>0x40	ubyte		<0xFF		\b, boot drive 0x%x
7038# in most case 0,1,0x2e for GRUB 0.5.95
7039>>>>0x41	ubyte		>0		\b, LBA flag 0x%x
7040>>>>0x42	uleshort	<0x8000		\b, stage2 address 0x%x
7041#>>>>0x42	uleshort	=0x8000		\b, stage2 address 0x%x (usual)
7042>>>>0x42	uleshort	>0x8000		\b, stage2 address 0x%x
7043#>>>>0x44	ulelong		=1		\b, 1st sector stage2 0x%x (default)
7044>>>>0x44	ulelong		>1		\b, 1st sector stage2 0x%x
7045>>>>0x48	uleshort	<0x800		\b, stage2 segment 0x%x
7046#>>>>0x48	uleshort	=0x800		\b, stage2 segment 0x%x (usual)
7047>>>>0x48	uleshort	>0x800		\b, stage2 segment 0x%x
7048>>>>402		string	Geom\0Hard\ Disk\0Read\0\ Error\0
7049>>>>>394	string	stage1			\b, GRUB version 0.5.95
7050>>>>382		string	Geom\0Hard\ Disk\0Read\0\ Error\0
7051>>>>>376	string	GRUB\ \0		\b, GRUB version 0.93 or 1.94
7052>>>>383		string	Geom\0Hard\ Disk\0Read\0\ Error\0
7053>>>>>377	string	GRUB\ \0		\b, GRUB version 0.94
7054>>>>385		string	Geom\0Hard\ Disk\0Read\0\ Error\0
7055>>>>>379	string	GRUB\ \0		\b, GRUB version 0.95 or 0.96
7056>>>>391		string	Geom\0Hard\ Disk\0Read\0\ Error\0
7057>>>>>385	string	GRUB\ \0		\b, GRUB version 0.97
7058# unknown version
7059>>>343		string	Geom\0Read\0\ Error\0
7060>>>>321		string	Loading\ stage1.5	\b, GRUB version x.y
7061>>>380		string	Geom\0Hard\ Disk\0Read\0\ Error\0
7062>>>>374		string	GRUB\ \0		\b, GRUB version n.m
7063# SYSLINUX bootloader moved
7064>395	string	chksum\0\ ERROR!\0		\b, Gujin bootloader
7065# http://www.bcdwb.de/bcdw/index_e.htm
7066>3	string	BCDL
7067>>498	string	BCDL\ \ \ \ BIN			\b, Bootable CD Loader (1.50Z)
7068# mbr partition table entries updated by Joerg Jenderek at Sep 2013
7069# skip Norton Utilities disc image data
7070>3		string		!IHISK
7071# skip Linux style boot sector starting with assember instructions mov 0x7c0,ax;
7072>>0		belong		!0xb8c0078e
7073# not Linux kernel
7074>>>514		string		!HdrS
7075# not BeOS
7076>>>>422		string		!Be\ Boot\ Loader
7077>>>>>32769	string    CD001
7078>>>>>>0	use cdrom
7079# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr
7080>>>>>0		ubelong&0xFD000000	=0xE9000000
7081# AdvanceMAME mbr
7082>>>>>>(1.b+2)	ubequad		0xfa31c08ed88ec08e
7083>>>>>>>446	use		partition-table
7084# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader
7085>>>>>0		ubelong&0xFD000000	!0xE9000000
7086# skip FSInfosector
7087>>>>>>0		string		!RRaA
7088# skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX,
7089# http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm
7090>>>>>>>0	ubequad		!0xfa660fb64610668b
7091# skip 13rd sector of MS x86 bootloader
7092>>>>>>>>0	ubequad		!0x660fb64610668b4e
7093# skip sector starting with DOS new line
7094>>>>>>>>>0	string		!\r\n
7095# allowed active flag 0,80h-FFh
7096>>>>>>>>>>446	ubyte		0
7097>>>>>>>>>>>446	use		partition-table
7098>>>>>>>>>>446	ubyte		>0x7F
7099>>>>>>>>>>>446	use		partition-table
7100# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries
7101# mbr partition table entries end
7102# http://www.acronis.de/
7103#FAT label=ACRONIS\ SZ
7104#OEM-ID=BOOTWIZ0
7105>442	string	Non-system\ disk,\
7106>>459	string	press\ any\ key...\x7\0		\b, Acronis Startup Recovery Loader
7107# updated by Joerg Jenderek at Nov 2012, Sep 2013
7108# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
7109# display 1 space
7110>>>447	ubyte	x		\b
7111>>>477	use	DOS-filename
7112#
7113>185	string	FDBOOT\ Version\
7114>>204	string	\rNo\ Systemdisk.\
7115>>>220	string	Booting\ from\ harddisk.\n\r
7116>>>245	string	Cannot\ load\ from\ harddisk.\n\r
7117>>>>273 string	Insert\ Systemdisk\
7118>>>>>291 string and\ press\ any\ key.\n\r		\b, FDBOOT harddisk Bootloader
7119>>>>>>200 string	>\0                             \b, version %-3s
7120>242	string	Bootsector\ from\ C.H.\ Hochst\204
7121# http://freecode.com/projects/dosfstools	dosfstools-n.m/src/mkdosfs.c
7122# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string
7123# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut
7124>242	search/127	Bootsector\ from\ C.H.\ Hochst
7125>>278	search/127	No\ Systemdisk.\ Booting\ from\ harddisk
7126# followed by variants with point,CR-NL or NL-CR
7127>>>208	search/261	Cannot\ load\ from\ harddisk.
7128# followed by variants CR-NL or NL-CR
7129>>>>236	search/235	Insert\ Systemdisk\ and\ press\ any\ key.
7130# followed by variants with point,CR-NL or NL-CR
7131>>>>>180	search/96	Disk\ formatted\ with\ WinImage\ 	\b, WinImage harddisk Bootloader
7132# followed by string like "6.50 (c) 1993-2004 Gilles Vollant"
7133>>>>>>&0	string		x 					\b, version %-4.4s
7134>(1.b+2)	ubyte		0xe
7135>>(1.b+3)	ubyte		0x1f
7136>>>(1.b+4)	ubyte		0xbe
7137# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others
7138>>>>(1.b+5)	ubyte&0xd3	0x53
7139>>>>>(1.b+6)	ubyte		0x7c
7140# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah,
7141>>>>>>(1.b+7)	ubyte		0xac
7142>>>>>>>(1.b+8)	ubyte		0x22
7143>>>>>>>>(1.b+9)	ubyte		0xc0
7144>>>>>>>>>(1.b+10)	ubyte	0x74
7145>>>>>>>>>>(1.b+11)	ubyte	0x0b
7146>>>>>>>>>>>(1.b+12)	ubyte	0x56
7147>>>>>>>>>>>>(1.b+13)	ubyte	0xb4			\b, mkdosfs boot message display
7148# FAT1X version
7149>>>>>>>>>>>>>(1.b+5)	ubyte	0x5b
7150>>>>>>>>>>>>>>0x5b	string	>\0			"%-s"
7151# FAT32 version
7152>>>>>>>>>>>>>(1.b+5)	ubyte	0x77
7153>>>>>>>>>>>>>>0x77	string	>\0			"%-s"
7154>214	string	Please\ try\ to\ install\ FreeDOS\ 	\b, DOS Emulator boot message display
7155#>>244	string	from\ dosemu-freedos-*-bin.tgz\r
7156#>>>170	string	Sorry,\ could\ not\ load\ an\
7157#>>>>195	string	operating\ system.\r\n
7158#
7159>103	string	This\ is\ not\ a\ bootable\ disk.\
7160>>132	string	Please\ insert\ a\ bootable\
7161>>>157	string	floppy\ and\r\n
7162>>>>169	string	press\ any\ key\ to\ try\ again...\r	\b, FREE-DOS message display
7163#
7164>66	string	Solaris\ Boot\ Sector
7165>>99	string	Incomplete\ MDBoot\ load.
7166>>>89	string	Version 				\b, Sun Solaris Bootloader
7167>>>>97	byte	x					version %c
7168#
7169>408	string	OS/2\ !!\ SYS01475\r\0
7170>>429	string	OS/2\ !!\ SYS02025\r\0
7171>>>450	string	OS/2\ !!\ SYS02027\r\0
7172>>>469	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp bootloader
7173#
7174>409	string	OS/2\ !!\ SYS01475\r\0
7175>>430	string	OS/2\ !!\ SYS02025\r\0
7176>>>451	string	OS/2\ !!\ SYS02027\r\0
7177>>>470	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp Bootloader
7178>112		string	This\ disk\ is\ not\ bootable\r
7179>>142		string	If\ you\ wish\ to\ make\ it\ bootable
7180>>>176		string	run\ the\ DOS\ program\ SYS\
7181>>>200		string	after\ the\r
7182>>>>216		string	system\ has\ been\ loaded\r\n
7183>>>>>242	string	Please\ insert\ a\ DOS\ diskette\
7184>>>>>271	string	into\r\n\ the\ drive\ and\
7185>>>>>>292	string	strike\ any\ key...\0		\b, IBM OS/2 Warp message display
7186# XP
7187>430	string	NTLDR\ is\ missing\xFF\r\n
7188>>449	string	Disk\ error\xFF\r\n
7189>>>462	string	Press\ any\ key\ to\ restart\r		\b, Microsoft Windows XP Bootloader
7190# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
7191>>>>417		ubyte&0xDF	>0
7192>>>>>417	string		x			%-.5s
7193>>>>>>422	ubyte&0xDF	>0
7194>>>>>>>422	string		x 			\b%-.3s
7195>>>>>425	ubyte&0xDF	>0
7196>>>>>>425	string		>\ 			\b.%-.3s
7197#
7198>>>>371		ubyte		>0x20
7199>>>>>368	ubyte&0xDF	>0
7200>>>>>>368	string		x 			%-.5s
7201>>>>>>>373	ubyte&0xDF	>0
7202>>>>>>>>373	string		x 			\b%-.3s
7203>>>>>>376	ubyte&0xDF	>0
7204>>>>>>>376	string		x 			\b.%-.3s
7205#
7206>430	string	NTLDR\ nicht\ gefunden\xFF\r\n
7207>>453	string	Datentr\204gerfehler\xFF\r\n
7208>>>473	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (german)
7209>>>>417		ubyte&0xDF	>0
7210>>>>>417	string		x			%-.5s
7211>>>>>>422	ubyte&0xDF	>0
7212>>>>>>>422	string		x 			\b%-.3s
7213>>>>>425	ubyte&0xDF	>0
7214>>>>>>425	string		>\ 			\b.%-.3s
7215# offset variant
7216>>>>379	string	\0
7217>>>>>368	ubyte&0xDF	>0
7218>>>>>>368	string		x 			%-.5s
7219>>>>>>>373	ubyte&0xDF	>0
7220>>>>>>>>373	string		x 			\b%-.3s
7221#
7222>430	string	NTLDR\ fehlt\xFF\r\n
7223>>444	string	Datentr\204gerfehler\xFF\r\n
7224>>>464	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (2.german)
7225>>>>417		ubyte&0xDF	>0
7226>>>>>417	string		x			%-.5s
7227>>>>>>422	ubyte&0xDF	>0
7228>>>>>>>422	string		x 			\b%-.3s
7229>>>>>425	ubyte&0xDF	>0
7230>>>>>>425	string		>\ 			\b.%-.3s
7231# variant
7232>>>>371		ubyte		>0x20
7233>>>>>368	ubyte&0xDF	>0
7234>>>>>>368	string		x 			%-.5s
7235>>>>>>>373	ubyte&0xDF	>0
7236>>>>>>>>373	string		x 			\b%-.3s
7237>>>>>>376	ubyte&0xDF	>0
7238>>>>>>>376	string		x 			\b.%-.3s
7239#
7240>430	string	NTLDR\ fehlt\xFF\r\n
7241>>444	string	Medienfehler\xFF\r\n
7242>>>459	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (3.german)
7243>>>>371		ubyte		>0x20
7244>>>>>368	ubyte&0xDF	>0
7245>>>>>>368	string		x 			%-.5s
7246>>>>>>>373	ubyte&0xDF	>0
7247>>>>>>>>373	string		x 			\b%-.3s
7248>>>>>>376	ubyte&0xDF	>0
7249>>>>>>>376	string		x 			\b.%-.3s
7250# variant
7251>>>>417		ubyte&0xDF	>0
7252>>>>>417	string		x			%-.5s
7253>>>>>>422	ubyte&0xDF	>0
7254>>>>>>>422	string		x 			\b%-.3s
7255>>>>>425	ubyte&0xDF	>0
7256>>>>>>425	string		>\ 			\b.%-.3s
7257#
7258>430	string	Datentr\204ger\ entfernen\xFF\r\n
7259>>454	string	Medienfehler\xFF\r\n
7260>>>469	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (4.german)
7261>>>>379		string		\0
7262>>>>>368	ubyte&0xDF	>0
7263>>>>>>368	string		x 			%-.5s
7264>>>>>>>373	ubyte&0xDF	>0
7265>>>>>>>>373	string		x 			\b%-.3s
7266>>>>>>376	ubyte&0xDF	>0
7267>>>>>>>376	string		x 			\b.%-.3s
7268# variant
7269>>>>417		ubyte&0xDF	>0
7270>>>>>417	string		x			%-.5s
7271>>>>>>422	ubyte&0xDF	>0
7272>>>>>>>422	string		x 			\b%-.3s
7273>>>>>425	ubyte&0xDF	>0
7274>>>>>>425	string		>\ 			\b.%-.3s
7275#
7276
7277#>3	string	NTFS\ \ \ \
7278>389	string	Fehler\ beim\ Lesen\
7279>>407	string	des\ Datentr\204gers
7280>>>426	string	NTLDR\ fehlt
7281>>>>440	string	NTLDR\ ist\ komprimiert
7282>>>>>464 string	Neustart\ mit\ Strg+Alt+Entf\r		\b, Microsoft Windows XP Bootloader NTFS (german)
7283#>3	string	NTFS\ \ \ \
7284>313	string	A\ disk\ read\ error\ occurred.\r
7285>>345	string	A\ kernel\ file\ is\ missing\
7286>>>370	string	from\ the\ disk.\r
7287>>>>484	string	NTLDR\ is\ compressed
7288>>>>>429 string	Insert\ a\ system\ diskette\
7289>>>>>>454 string and\ restart\r\nthe\ system.\r		\b, Microsoft Windows XP Bootloader NTFS
7290# DOS loader variants different languages,offsets
7291>472	ubyte&0xDF	>0
7292>>389	string	Invalid\ system\ disk\xFF\r\n
7293>>>411	string	Disk\ I/O\ error
7294>>>>428	string	Replace\ the\ disk,\ and\
7295>>>>>455 string	press\ any\ key				\b, Microsoft Windows 98 Bootloader
7296#IO.SYS
7297>>>>>>472	ubyte&0xDF	>0
7298>>>>>>>472	string		x 			\b %-.2s
7299>>>>>>>>474	ubyte&0xDF	>0
7300>>>>>>>>>474	string		x 			\b%-.5s
7301>>>>>>>>>>479	ubyte&0xDF	>0
7302>>>>>>>>>>>479 string		x 			\b%-.1s
7303>>>>>>>480	ubyte&0xDF	>0
7304>>>>>>>>480	string		x 			\b.%-.3s
7305#MSDOS.SYS
7306>>>>>>>483	ubyte&0xDF	>0			\b+
7307>>>>>>>>483	string		x 			\b%-.5s
7308>>>>>>>>>488	ubyte&0xDF	>0
7309>>>>>>>>>>488	string		x 			\b%-.3s
7310>>>>>>>>491	ubyte&0xDF	>0
7311>>>>>>>>>491	string		x 			\b.%-.3s
7312#
7313>>390	string	Invalid\ system\ disk\xFF\r\n
7314>>>412	string	Disk\ I/O\ error\xFF\r\n
7315>>>>429	string	Replace\ the\ disk,\ and\
7316>>>>>451 string	then\ press\ any\ key\r			\b, Microsoft Windows 98 Bootloader
7317>>388	string	Ungueltiges\ System\ \xFF\r\n
7318>>>410	string	E/A-Fehler\ \ \ \ \xFF\r\n
7319>>>>427	string	Datentraeger\ wechseln\ und\
7320>>>>>453 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (german)
7321#WINBOOT.SYS only not spaces (0xDF)
7322>>>>>>497	ubyte&0xDF	>0
7323>>>>>>>497	string		x 			%-.5s
7324>>>>>>>>502	ubyte&0xDF	>0
7325>>>>>>>>>502	string		x 			\b%-.1s
7326>>>>>>>>>>503	ubyte&0xDF	>0
7327>>>>>>>>>>>503	string		x 			\b%-.1s
7328>>>>>>>>>>>>504	ubyte&0xDF	>0
7329>>>>>>>>>>>>>504 string		x 			\b%-.1s
7330>>>>>>505	ubyte&0xDF	>0
7331>>>>>>>505	string		x 			\b.%-.3s
7332#IO.SYS
7333>>>>>>472	ubyte&0xDF	>0			or
7334>>>>>>>472	string		x 			\b %-.2s
7335>>>>>>>>474	ubyte&0xDF	>0
7336>>>>>>>>>474	string		x 			\b%-.5s
7337>>>>>>>>>>479	ubyte&0xDF	>0
7338>>>>>>>>>>>479 string		x 			\b%-.1s
7339>>>>>>>480	ubyte&0xDF	>0
7340>>>>>>>>480	string		x 			\b.%-.3s
7341#MSDOS.SYS
7342>>>>>>>483	ubyte&0xDF	>0			\b+
7343>>>>>>>>483	string		x 			\b%-.5s
7344>>>>>>>>>488	ubyte&0xDF	>0
7345>>>>>>>>>>488	string		x 			\b%-.3s
7346>>>>>>>>491	ubyte&0xDF	>0
7347>>>>>>>>>491	string		x 			\b.%-.3s
7348#
7349>>390	string	Ungueltiges\ System\ \xFF\r\n
7350>>>412	string	E/A-Fehler\ \ \ \ \xFF\r\n
7351>>>>429	string	Datentraeger\ wechseln\ und\
7352>>>>>455 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (German)
7353#WINBOOT.SYS only not spaces (0xDF)
7354>>>>>>497	ubyte&0xDF	>0
7355>>>>>>>497	string		x 			%-.7s
7356>>>>>>>>504	ubyte&0xDF	>0
7357>>>>>>>>>504	string		x 			\b%-.1s
7358>>>>>>505	ubyte&0xDF	>0
7359>>>>>>>505	string		x 			\b.%-.3s
7360#IO.SYS
7361>>>>>>472	ubyte&0xDF	>0			or
7362>>>>>>>472	string		x 			\b %-.2s
7363>>>>>>>>474	ubyte&0xDF	>0
7364>>>>>>>>>474	string		x 			\b%-.6s
7365>>>>>>>480	ubyte&0xDF	>0
7366>>>>>>>>480	string		x 			\b.%-.3s
7367#MSDOS.SYS
7368>>>>>>>483	ubyte&0xDF	>0			\b+
7369>>>>>>>>483	string		x 			\b%-.5s
7370>>>>>>>>>488	ubyte&0xDF	>0
7371>>>>>>>>>>488	string		x 			\b%-.3s
7372>>>>>>>>491	ubyte&0xDF	>0
7373>>>>>>>>>491	string		x 			\b.%-.3s
7374#
7375>>389	string	Ungueltiges\ System\ \xFF\r\n
7376>>>411	string	E/A-Fehler\ \ \ \ \xFF\r\n
7377>>>>428	string	Datentraeger\ wechseln\ und\
7378>>>>>454 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
7379# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
7380>>>>>>472	string		x 			%-.2s
7381>>>>>>>474	ubyte&0xDF	>0
7382>>>>>>>>474	string		x 			\b%-.5s
7383>>>>>>>>479	ubyte&0xDF	>0
7384>>>>>>>>>479	string		x 			\b%-.1s
7385>>>>>>480	ubyte&0xDF	>0
7386>>>>>>>480	string		x 			\b.%-.3s
7387>>>>>>483	ubyte&0xDF	>0			\b+
7388>>>>>>>483	string		x 			\b%-.5s
7389>>>>>>>488	ubyte&0xDF	>0
7390>>>>>>>>488	string		x 			\b%-.2s
7391>>>>>>>>490	ubyte&0xDF	>0
7392>>>>>>>>>490	string		x 			\b%-.1s
7393>>>>>>>491	ubyte&0xDF	>0
7394>>>>>>>>491	string		x 			\b.%-.3s
7395>479	ubyte&0xDF	>0
7396>>416	string	Kein\ System\ oder\
7397>>>433	string	Laufwerksfehler
7398>>>>450	string	Wechseln\ und\ Taste\ dr\201cken	\b, Microsoft DOS Bootloader (german)
7399#IO.SYS
7400>>>>>479	string		x 			\b %-.2s
7401>>>>>>481	ubyte&0xDF	>0
7402>>>>>>>481	string		x 			\b%-.6s
7403>>>>>487	ubyte&0xDF	>0
7404>>>>>>487	string		x 			\b.%-.3s
7405#MSDOS.SYS
7406>>>>>>490	ubyte&0xDF	>0			\b+
7407>>>>>>>490	string		x 			\b%-.5s
7408>>>>>>>>495	ubyte&0xDF	>0
7409>>>>>>>>>495	string		x 			\b%-.3s
7410>>>>>>>498	ubyte&0xDF	>0
7411>>>>>>>>498	string		x 			\b.%-.3s
7412#
7413>376	search/41	Non-System\ disk\ or\
7414>>395	search/41	disk\ error\r
7415>>>407	search/41	Replace\ and\
7416>>>>419	search/41	press\ 				\b,
7417>>>>419	search/41	strike\ 			\b, old
7418>>>>426	search/41	any\ key\ when\ ready\r		MS or PC-DOS bootloader
7419#449			Disk\ Boot\ failure\r		MS 3.21
7420#466			Boot\ Failure\r			MS 3.30
7421>>>>>468 search/18	\0
7422#IO.SYS,IBMBIO.COM
7423>>>>>>&0	string		x 			\b %-.2s
7424>>>>>>>&-20	ubyte&0xDF	>0
7425>>>>>>>>&-1	string		x 			\b%-.4s
7426>>>>>>>>>&-16	ubyte&0xDF	>0
7427>>>>>>>>>>&-1	string		x 			\b%-.2s
7428>>>>>>&8	ubyte&0xDF	>0			\b.
7429>>>>>>>&-1	string		x 			\b%-.3s
7430#MSDOS.SYS,IBMDOS.COM
7431>>>>>>&11	ubyte&0xDF	>0			\b+
7432>>>>>>>&-1	string		x 			\b%-.5s
7433>>>>>>>>&-6	ubyte&0xDF	>0
7434>>>>>>>>>&-1	string		x 			\b%-.1s
7435>>>>>>>>>>&-5	ubyte&0xDF	>0
7436>>>>>>>>>>>&-1	string		x 			\b%-.2s
7437>>>>>>>&7	ubyte&0xDF	>0			\b.
7438>>>>>>>>&-1	string		x 			\b%-.3s
7439>441	string	Cannot\ load\ from\ harddisk.\n\r
7440>>469	string	Insert\ Systemdisk\
7441>>>487	string	and\ press\ any\ key.\n\r		\b, MS (2.11) DOS bootloader
7442#>43	string	\224R-LOADER\ \ SYS			=label
7443>54	string	SYS
7444>>324	string	VASKK
7445>>>495	string	NEWLDR\0				\b, DR-DOS Bootloader (LOADER.SYS)
7446#
7447>98	string	Press\ a\ key\ to\ retry\0\r
7448>>120	string	Cannot\ find\ file\ \0\r
7449>>>139	string	Disk\ read\ error\0\r
7450>>>>156	string	Loading\ ...\0				\b, DR-DOS (3.41) Bootloader
7451#DRBIOS.SYS
7452>>>>>44		ubyte&0xDF	>0
7453>>>>>>44	string		x			\b %-.6s
7454>>>>>>>50	ubyte&0xDF	>0
7455>>>>>>>>50	string		x 			\b%-.2s
7456>>>>>>52	ubyte&0xDF	>0
7457>>>>>>>52	string		x 			\b.%-.3s
7458#
7459>70	string	IBMBIO\ \ COM
7460>>472	string	Cannot\ load\ DOS!\
7461>>>489	string	Any\ key\ to\ retry			\b, DR-DOS Bootloader
7462>>471	string	Cannot\ load\ DOS\
7463>>487	string	press\ key\ to\ retry			\b, Open-DOS Bootloader
7464#??
7465>444	string	KERNEL\ \ SYS
7466>>314	string	BOOT\ error!				\b, FREE-DOS Bootloader
7467>499	string	KERNEL\ \ SYS
7468>>305	string	BOOT\ err!\0				\b, Free-DOS Bootloader
7469>449	string	KERNEL\ \ SYS
7470>>319	string	BOOT\ error!				\b, FREE-DOS 0.5 Bootloader
7471#
7472>449	string	Loading\ FreeDOS
7473>>0x1AF		ulelong		>0			\b, FREE-DOS 0.95,1.0 Bootloader
7474>>>497		ubyte&0xDF	>0
7475>>>>497		string		x 			\b %-.6s
7476>>>>>503	ubyte&0xDF	>0
7477>>>>>>503	string		x 			\b%-.1s
7478>>>>>>>504	ubyte&0xDF	>0
7479>>>>>>>>504	string		x 			\b%-.1s
7480>>>>505		ubyte&0xDF	>0
7481>>>>>505	string		x 			\b.%-.3s
7482#
7483>331	string	Error!.0				\b, FREE-DOS 1.0 bootloader
7484#
7485>125	string	Loading\ FreeDOS...\r
7486>>311	string	BOOT\ error!\r				\b, FREE-DOS bootloader
7487>>>441		ubyte&0xDF	>0
7488>>>>441		string		x 			\b %-.6s
7489>>>>>447	ubyte&0xDF	>0
7490>>>>>>447	string		x 			\b%-.1s
7491>>>>>>>448	ubyte&0xDF	>0
7492>>>>>>>>448	string		x 			\b%-.1s
7493>>>>449		ubyte&0xDF	>0
7494>>>>>449	string		x 			\b.%-.3s
7495>124	string	FreeDOS\0
7496>>331	string	\ err\0					\b, FREE-DOS BETa 0.9 Bootloader
7497# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
7498>>>497		ubyte&0xDF	>0
7499>>>>497		string		x 			\b %-.6s
7500>>>>>503	ubyte&0xDF	>0
7501>>>>>>503	string		x 			\b%-.1s
7502>>>>>>>504	ubyte&0xDF	>0
7503>>>>>>>>504	string		x 			\b%-.1s
7504>>>>505		ubyte&0xDF	>0
7505>>>>>505	string		x 			\b.%-.3s
7506>>333	string	\ err\0					\b, FREE-DOS BEta 0.9 Bootloader
7507>>>497		ubyte&0xDF	>0
7508>>>>497		string		x 			\b %-.6s
7509>>>>>503	ubyte&0xDF	>0
7510>>>>>>503	string		x 			\b%-.1s
7511>>>>>>>504	ubyte&0xDF	>0
7512>>>>>>>>504	string		x 			\b%-.1s
7513>>>>505		ubyte&0xDF	>0
7514>>>>>505	string		x 			\b.%-.3s
7515>>334	string	\ err\0					\b, FREE-DOS Beta 0.9 Bootloader
7516>>>497		ubyte&0xDF	>0
7517>>>>497		string		x 			\b %-.6s
7518>>>>>503	ubyte&0xDF	>0
7519>>>>>>503	string		x 			\b%-.1s
7520>>>>>>>504	ubyte&0xDF	>0
7521>>>>>>>>504	string		x 			\b%-.1s
7522>>>>505		ubyte&0xDF	>0
7523>>>>>505	string		x 			\b.%-.3s
7524>336	string	Error!\
7525>>343	string	Hit\ a\ key\ to\ reboot.		\b, FREE-DOS Beta 0.9sr1 Bootloader
7526>>>497		ubyte&0xDF	>0
7527>>>>497		string		x 			\b %-.6s
7528>>>>>503	ubyte&0xDF	>0
7529>>>>>>503	string		x 			\b%-.1s
7530>>>>>>>504	ubyte&0xDF	>0
7531>>>>>>>>504	string		x 			\b%-.1s
7532>>>>505		ubyte&0xDF	>0
7533>>>>>505	string		x 			\b.%-.3s
7534# added by Joerg Jenderek
7535# http://www.visopsys.org/
7536# http://partitionlogic.org.uk/
7537# OEM-ID=Visopsys
7538>478		ulelong	0
7539>>(1.b+326)	string	I/O\ Error\ reading\
7540>>>(1.b+344)	string	Visopsys\ loader\r
7541>>>>(1.b+361)	string	Press\ any\ key\ to\ continue.\r	\b, Visopsys loader
7542# http://alexfru.chat.ru/epm.html#bootprog
7543>494	ubyte	>0x4D
7544>>495	string	>E
7545>>>495	string	<S
7546#OEM-ID is not reliable
7547>>>>3	string	BootProg
7548# It just looks for a program file name at the root directory
7549# and loads corresponding file with following execution.
7550# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
7551>>>>499			ubyte&0xDF	>0		\b, COM/EXE Bootloader
7552>>>>>499		use		DOS-filename
7553#If the boot sector fails to read any other sector,
7554#it prints a very short message ("RE") to the screen and hangs the computer.
7555#If the boot sector fails to find needed program in the root directory,
7556#it also hangs with another message ("NF").
7557>>>>>492		string		RENF		\b, FAT (12 bit)
7558>>>>>495		string		RENF		\b, FAT (16 bit)
7559#If the boot sector fails to read any other sector,
7560#it prints a very short message ("RE") to the screen and hangs the computer.
7561# x86 bootloader end
7562
7563# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
7564# and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
7565>0		string		RRaA
7566>>0x1E4		string		rrAa		\b, FSInfosector
7567#>>0x1FC	uleshort	=0		SHOULD BE ZERO
7568>>>0x1E8	ulelong		<0xffffffff	\b, %u free clusters
7569>>>0x1EC	ulelong		<0xffffffff	\b, last allocated cluster %u
7570
7571# updated by Joerg Jenderek at Sep 2007
7572>3	ubyte	0
7573#no active flag
7574>>446	ubyte	0
7575# partition 1 not empty
7576>>>450	ubyte	>0
7577# partitions 3,4 empty
7578>>>>482		ubyte	0
7579>>>>>498	ubyte	0
7580# partition 2 ID=0,5,15
7581>>>>>>466	ubyte	<0x10
7582>>>>>>>466	ubyte	0x05			\b, extended partition table
7583>>>>>>>466	ubyte	0x0F			\b, extended partition table (LBA)
7584>>>>>>>466	ubyte	0x0			\b, extended partition table (last)
7585
7586# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
7587
7588>0x200	lelong	0x82564557		\b, BSD disklabel
7589
7590# by Joerg Jenderek at Apr 2013
7591#	Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension
7592#	like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS
75930	name			DOS-filename
7594# space=0x20 (00100000b) means empty
7595>0			ubyte&0xDF	>0
7596>>0			ubyte		x 		\b%c
7597>>>1			ubyte&0xDF	>0
7598>>>>1			ubyte		x 		\b%c
7599>>>>>2			ubyte&0xDF	>0
7600>>>>>>2			ubyte		x 		\b%c
7601>>>>>>>3		ubyte&0xDF	>0
7602>>>>>>>>3		ubyte		x 		\b%c
7603>>>>>>>>>4		ubyte&0xDF	>0
7604>>>>>>>>>>4		ubyte		x 		\b%c
7605>>>>>>>>>>>5		ubyte&0xDF	>0
7606>>>>>>>>>>>>5		ubyte		x 		\b%c
7607>>>>>>>>>>>>>6		ubyte&0xDF	>0
7608>>>>>>>>>>>>>>6		ubyte		x 		\b%c
7609>>>>>>>>>>>>>>>7	ubyte&0xDF	>0
7610>>>>>>>>>>>>>>>>7	ubyte		x 		\b%c
7611# DOS filename extension
7612>>8			ubyte&0xDF	>0		\b.
7613>>>8			ubyte		x 		\b%c
7614>>>>9			ubyte&0xDF	>0
7615>>>>>9			ubyte		x 		\b%c
7616>>>>>>10		ubyte&0xDF	>0
7617>>>>>>>10		ubyte		x 		\b%c
7618#	Print 2 following DOS filenames from directory entry form
7619#	like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com
76200	name			2xDOS-filename
7621# display 1 space
7622>0			ubyte		x		\b
7623>0			use		DOS-filename
7624>11			ubyte		x		\b+
7625>11			use		DOS-filename
7626
7627# http://en.wikipedia.org/wiki/Master_boot_record#PTE
7628# display standard partition table
76290	name				partition-table
7630#>0		ubyte		x	PARTITION-TABLE
7631# test and display 1st til 4th partition table entry
7632>0		use			partition-entry-test
7633>16		use			partition-entry-test
7634>32		use			partition-entry-test
7635>48		use			partition-entry-test
7636#		test for entry of partition table
76370	name				partition-entry-test
7638# partition type ID > 0
7639>4		ubyte		>0
7640# active flag 0
7641>>0		ubyte		0
7642>>>0		use		partition-entry
7643# active flag 0x80, 0x81, ...
7644>>0		ubyte		>0x7F
7645>>>0		use		partition-entry
7646#		Print entry of partition table
76470	name				partition-entry
7648# partition type ID > 0
7649>4		ubyte		>0	\b; partition
7650>>64		leshort		0xAA55	1
7651>>48		leshort		0xAA55	2
7652>>32		leshort		0xAA55	3
7653>>16		leshort		0xAA55	4
7654>>4		ubyte		x	: ID=0x%x
7655>>0		ubyte&0x80	0x80	\b, active
7656>>0		ubyte		>0x80	0x%x
7657>>1		ubyte		x	\b, start-CHS (
7658>>1		use		partition-chs
7659>>5		ubyte		x	\b), end-CHS (
7660>>5		use		partition-chs
7661>>8		ulelong		x	\b), startsector %u
7662>>12		ulelong		x	\b, %u sectors
7663#		Print cylinder,head,sector (CHS) of partition entry
76640	name				partition-chs
7665# cylinder
7666>1		ubyte		x	\b0x
7667>1		ubyte&0xC0	0x40	\b1
7668>1		ubyte&0xC0	0x80	\b2
7669>1		ubyte&0xC0	0xC0	\b3
7670>2		ubyte		x	\b%x
7671# head
7672>0		ubyte		x	\b,%u
7673# sector
7674>1		ubyte&0x3F	x	\b,%u
7675
7676# FATX
76770		string		FATX		FATX filesystem data
7678
7679# romfs filesystems - Juan Cespedes <cespedes@debian.org>
76800	string		-rom1fs-	romfs filesystem, version 1
7681>8	belong	x			%d bytes,
7682>16	string	x			named %s.
7683
7684# netboot image - Juan Cespedes <cespedes@debian.org>
76850	lelong		0x1b031336L	Netboot image,
7686>4	lelong&0xFFFFFF00	0
7687>>4	lelong&0x100	0x000		mode 2
7688>>4	lelong&0x100	0x100		mode 3
7689>4	lelong&0xFFFFFF00	!0	unknown mode
7690
76910x18b	string	OS/2	OS/2 Boot Manager
7692
7693# updated by Joerg Jenderek at Oct 2008 and Sep 2012
7694# http://syslinux.zytor.com/iso.php
7695# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
7696# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
76970	ulequad&0x909000007cc0eafa	0x909000007c40eafa
7698>631	search/689	ISOLINUX\ 	isolinux Loader
7699>>&0	string		x		(version %-4.4s)
7700# http://syslinux.zytor.com/pxe.php
7701# assembler instructions: jmp 7C05
77020	ulelong	0x007c05ea		pxelinux loader (version 2.13 or older)
7703# assembler instructions: pushfd;pushad
77040	ulelong	0x60669c66		pxelinux loader
7705# assembler instructions: jmp 05
77060	ulelong	0xc00005ea		pxelinux loader (version 3.70 or newer)
7707# http://syslinux.zytor.com/wiki/index.php/SYSLINUX
77080	string	LDLINUX\ SYS\ 		SYSLINUX loader
7709>12	string	x			(older version %-4.4s)
77100	string	\r\nSYSLINUX\ 		SYSLINUX loader
7711>11	string	x			(version %-4.4s)
7712# syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
7713# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX"
77140	ulelong&0x80909bEB	0x009018EB
7715# OEM-ID not always "SYSLINUX"
7716>434	search/47	Boot\ failed
7717# followed by \r\n\0 or :\
7718>>482	search/132	\0LDLINUX\ SYS		Syslinux bootloader (version 2.13 or older)
7719>>1	ubyte		0x58			Syslinux bootloader (version 3.0-3.9)
7720>459	search/30	Boot\ error\r\n\0
7721>>1	ubyte		0x58			Syslinux bootloader (version 3.10 or newer)
7722# SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
7723# assembler instructions: mov di,0600h;mov cx,0100h
772416	search/4	\xbf\x00\x06\xb9\x00\x01
7725# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21)
7726!:strength +36
7727>94	search/249	Missing\ operating\ system
7728# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other
7729# skip Ranish MBR
7730>>408	search/4	HD1/\0
7731>>408	default		x
7732>>>250	search/118	\0Operating\ system\ load		SYSLINUX MBR
7733# followed by "ing " or space
7734>>>>292	search/98	error
7735>>>>>&0	string		\r		    			(version 3.35 or older)
7736>>>>>&0	string		.\r					(version 3.52 or newer)
7737>>>>>&0	default		x					(version 3.36-3.51 )
7738>368	search/106	\0Disk\ error\ on\ boot\r\n		SYSLINUX GPT-MBR
7739>>156	search/10	\0Boot\ partition\ not\ found\r\n
7740>>>270	search/10	\0OS\ not\ bootable\r\n			(version 3.86 or older)
7741>>174	search/10	\0Missing\ OS\r\n
7742>>>189	search/10	\0Multiple\ active\ partitions\r\n	(version 4.00 or newer)
7743# SYSLINUX END
7744
7745# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012
7746# assembler instructions: xor ax,ax;mov	ax,ss;mov sp,0x7c00;mov	ax,
77470	ubequad		0x31c08ed0bc007c8e
7748# mbr_bootsel magic before partition table not reliable with small ipl fragments
7749#>444	uleshort	0xb5e1
7750>0004	uleshort	x
7751# ERRorTeXT
7752>>181	search/166		Error\ \0\r\n				NetBSD mbr
7753# NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
7754>>>0x1B8	ubelong		>0					\b,Serial 0x%-.8x
7755# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
7756>>>0xbb		search/71	\xcd\x13\x5a\x52\x52			\b,bootselector
7757# BOOT_EXTENDED definitions contains assembler instructions:
7758# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13
7759>>>0x96	search/1	\x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13	\b,boot extended
7760# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al
7761>>>0x130	search/55	\xee\x80\xc2\x05\xec\xa8\x40		\b,serial IO
7762# not TERSE_ERROR
7763>>>196		search/106	No\ active\ partition\0
7764>>>>&0		string		Disk\ read\ error\0
7765>>>>>&0		string		No\ operating\ system\0			\b,verbose
7766# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13
7767>>>0x7d		search/7	\x5a\x52\xb4\x08\xcd\x13		\b,CHS
7768# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop	dx;push	dx;int 0x13
7769>>>0xa4		search/84	\xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13	\b,LBA-check
7770# assembler instructions: movw nametab,bx
7771>>>0x26	    search/21	\xBB\x94\x07
7772# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf
7773>>>>&-9	ubequad&0xBE00f0E800febb94	0xBE0000E80000bb94
7774>>>>>181	search/166		Error\ \0
7775# "a: disk" , "Fn: diskn" or "NetBSD MBR boot"
7776>>>>>>&3	string			x				\b,"%s"
7777>>>446	use		partition-table
7778# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
7779# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
7780# assembler instructions: jmp short 0x58;nop;ASCII
77810	ubequad&0xeb58908000000000	0xeb58900000000000
7782# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss,
7783>(1.b+2)	ubequad			0xfa31c08ed88ec08e
7784# Error messages at end of code
7785>>376		string	No\ operating\ system\r\n\0
7786>>>398		string	Disk\ error\r\n\0FDD\0HDD\0
7787>>>>419		string	\ EBIOS\r\n\0				AdvanceMAME mbr
7788
7789# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/
7790# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
7791# for 1st version assembler instructions:	cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
7792# or  	  	  	    			cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
77930	ulequad&0xcE1b40D48EC031FC	0x8E0000D08EC031FC
7794# pointer to the data starting with Neil Turton signature string
7795>(0x1BC.s)		string		NDTmbr
7796>>&-14			string		1234F\0			Turton mbr (
7797# parameters also viewed by install-mbr --list
7798>>>(0x1BC.s+7)		ubyte		x			\b%u<=
7799>>>(0x1BC.s+9)		ubyte		x			\bVersion<=%u
7800#>>>(0x1BC.s+8)		ubyte		x			asm_flag_%x
7801>>>(0x1BC.s+8)		ubyte&1		1			\b,Y2K-Fix
7802# variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode
7803>>>(0x1BC.s+8)		ubyte&2		2			\b,TestDisk
7804#0x1~1,..,0x8~4,0x10~F,0x80~A enabled
7805#>>>(0x1BC.s+10)		ubyte		x			\b,flags 0x%x
7806#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
7807#>>>(0x1BC.s+11)		ubyte		x			\b,cfg_def 0x%x
7808# for older versions
7809>>>(0x1BC.s+9)		ubyte		<2
7810#>>>>(0x1BC.s+12)	ubyte		18			\b,%hhu/18 seconds
7811>>>>(0x1BC.s+12)	ubyte		!18			\b,%u/18 seconds
7812# floppy A: or B:
7813>>>>(0x1BC.s+13)	ubyte		<2			\b,floppy 0x%x
7814>>>>(0x1BC.s+13)	ubyte		>1
7815# 1st hard disc
7816#>>>>>(0x1BC.s+13)	ubyte		0x80			\b,drive 0x%x
7817# not 1st hard disc
7818>>>>>(0x1BC.s+13)	ubyte		!0x80			\b,drive 0x%x
7819# for version >= 2 maximal timeout can be 65534
7820>>>(0x1BC.s+9)		ubyte		>1
7821#>>>>(0x1BC.s+12)	uleshort	18			\b,%u/18 seconds
7822>>>>(0x1BC.s+12)	uleshort	!18			\b,%u/18 seconds
7823# floppy A: or B:
7824>>>>(0x1BC.s+14)	ubyte		<2			\b,floppy 0x%x
7825>>>>(0x1BC.s+14)	ubyte		>1
7826# 1st hard disc
7827#>>>>>(0x1BC.s+14)	ubyte		0x80			\b,drive 0x%x
7828# not 1st hard disc
7829>>>>>(0x1BC.s+14)	ubyte		!0x80			\b,drive 0x%x
7830>>>0	ubyte		x					\b)
7831
7832# added by Joerg Jenderek
7833# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
7834# grub-1.94/kern/i386/pc/startup.S
7835# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
7836# usual values are marked with comments to get only informations of strange GRUB loaders
78370x200	uleshort		0x70EA
7838# found only version 3.{1,2}
7839>0x206		ubeshort	>0x0300
7840# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
7841>>0x212 	ubyte		>0x29
7842>>>0x213 	ubyte		>0x29
7843# not iso9660_stage1_5
7844#>>>0	ulelong&0x00BE5652	0x00BE5652
7845>>>>0x213 	ubyte		>0x29		GRand Unified Bootloader
7846# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
7847>>>>0x217 	ubyte		0xFF		stage1_5
7848>>>>0x217 	ubyte		<0xFF		stage2
7849>>>>0x206	ubyte		x		\b version %u
7850>>>>0x207	ubyte		x		\b.%u
7851# module_size for 1.94
7852>>>>0x208	ulelong		<0xffffff	\b, installed partition %u
7853#>>>>0x208	ulelong		=0xffffff	\b, %lu (default)
7854>>>>0x208	ulelong		>0xffffff	\b, installed partition %u
7855# GRUB 0.5.95 unofficial
7856>>>>0x20C	ulelong&0x2E300000 0x2E300000
7857# 0=stage2	1=ffs	2=e2fs	3=fat	4=minix	5=reiserfs
7858>>>>>0x20C	ubyte		x		\b, identifier 0x%x
7859#>>>>>0x20D	ubyte		=0		\b, LBA flag 0x%x (default)
7860>>>>>0x20D	ubyte		>0		\b, LBA flag 0x%x
7861# GRUB version as string
7862>>>>>0x20E 	string		>\0		\b, GRUB version %-s
7863# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
7864>>>>>>0x215 	ulong		0xffffffff
7865>>>>>>>0x219 	string		>\0		\b, configuration file %-s
7866>>>>>>0x215 	ulong		!0xffffffff
7867>>>>>>>0x215 	string		>\0		\b, configuration file %-s
7868# newer GRUB versions
7869>>>>0x20C	ulelong&0x2E300000 !0x2E300000
7870##>>>>>0x20C	ulelong		=0		\b, saved entry %d (usual)
7871>>>>>0x20C	ulelong		>0		\b, saved entry %d
7872# for 1.94 contains kernel image size
7873# for 0.93,0.94,0.96,0.97
7874# 0=stage2	1=ffs	2=e2fs	3=fat	4=minix	5=reiserfs	6=vstafs	7=jfs	8=xfs	9=iso9660	a=ufs2
7875>>>>>0x210	ubyte		x		\b, identifier 0x%x
7876# The flag for LBA forcing is in most cases 0
7877#>>>>>0x211	ubyte		=0		\b, LBA flag 0x%x (default)
7878>>>>>0x211	ubyte		>0		\b, LBA flag 0x%x
7879# GRUB version as string
7880>>>>>0x212 	string		>\0		\b, GRUB version %-s
7881# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
7882>>>>>0x217 	ulong		0xffffffff
7883>>>>>>0x21b 	string		>\0		\b, configuration file %-s
7884>>>>>0x217 	ulong		!0xffffffff
7885>>>>>>0x217 	string		>\0		\b, configuration file %-s
7886
7887# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
7888# JuMP short     bootcodeoffset NOP assembler instructions will usually be EB xx 90
7889# over BIOS parameter block (BPB)
7890# http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD
7891# older drives may use Near JuMP instruction E9 xx xx
7892# minimal short forward jump found 0x29 for bootloaders or 0x0
7893# maximal short forward jump is 0x7f
7894# OEM-ID is empty or contain readable bytes
78950		ulelong&0x804000E9	0x000000E9
7896!:strength	+60
7897# mtools-3.9.8/msdos.h
7898# usual values are marked with comments to get only informations of strange FAT systems
7899# valid sectorsize must be a power of 2 from 32 to 32768
7900>11		uleshort&0x001f	0
7901>>11		uleshort	<32769
7902>>>11		uleshort	>31
7903>>>>21		ubyte&0xf0	0xF0
7904>>>>>0		ubyte		0xEB		DOS/MBR boot sector
7905>>>>>>1		ubyte		x		\b, code offset 0x%x+2
7906>>>>>0		ubyte		0xE9
7907>>>>>>1		uleshort	x		\b, code offset 0x%x+3
7908>>>>>3		string		>\0		\b, OEM-ID "%-.8s"
7909#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
7910>>>>>>8		string		IHC		\b cached by Windows 9M
7911>>>>>11		uleshort	>512		\b, Bytes/sector %u
7912#>>>>>11	uleshort	=512		\b, Bytes/sector %u=512 (usual)
7913>>>>>11		uleshort	<512		\b, Bytes/sector %u
7914>>>>>13		ubyte		>1		\b, sectors/cluster %u
7915#>>>>>13	ubyte		=1		\b, sectors/cluster %u (usual on Floppies)
7916# for lazy FAT32 implementation like Transcend digital photo frame PF830
7917>>>>>82		string/c	fat32
7918>>>>>>14	uleshort	!32		\b, reserved sectors %u
7919#>>>>>>14	uleshort	=32		\b, reserved sectors %u (usual Fat32)
7920>>>>>82		string/c	!fat32
7921>>>>>>14	uleshort	>1		\b, reserved sectors %u
7922#>>>>>>14	uleshort	=1		\b, reserved sectors %u (usual FAT12,FAT16)
7923#>>>>>>14	uleshort	0		\b, reserved sectors %u (usual NTFS)
7924>>>>>16		ubyte		>2		\b, FATs %u
7925#>>>>>16	ubyte		=2		\b, FATs %u (usual)
7926>>>>>16		ubyte		=1		\b, FAT  %u
7927>>>>>16		ubyte		>0
7928>>>>>17		uleshort	>0		\b, root entries %u
7929#>>>>>17	uleshort	=0		\b, root entries %hu=0 (usual Fat32)
7930>>>>>19		uleshort	>0		\b, sectors %u (volumes <=32 MB)
7931#>>>>>19	uleshort	=0		\b, sectors %hu=0 (usual Fat32)
7932>>>>>21		ubyte		>0xF0		\b, Media descriptor 0x%x
7933#>>>>>21	ubyte		=0xF0		\b, Media descriptor 0x%x (usual floppy)
7934>>>>>21		ubyte		<0xF0		\b, Media descriptor 0x%x
7935>>>>>22		uleshort	>0		\b, sectors/FAT %u
7936#>>>>>22	uleshort	=0		\b, sectors/FAT %hu=0 (usual Fat32)
7937>>>>>24		uleshort	x		\b, sectors/track %u
7938>>>>>26		ubyte		>2		\b, heads %u
7939#>>>>>26	ubyte		=2		\b, heads %u (usual floppy)
7940>>>>>26		ubyte		=1		\b, heads %u
7941# valid only for sector sizes with more then 32 Bytes
7942>>>>>11		uleshort	>32
7943# http://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block
7944# skip for values 2,2Ah,70h,73h,DFh
7945# and continue for extended boot signature values 0,28h,29h,80h
7946>>>>>>38	ubyte&0x56	=0
7947>>>>>>>28	ulelong		>0		\b, hidden sectors %u
7948#>>>>>>>28	ulelong		=0		\b, hidden sectors %u (usual floppy)
7949>>>>>>>32	ulelong		>0		\b, sectors %u (volumes > 32 MB)
7950#>>>>>>>32	ulelong		=0		\b, sectors %u (volumes > 32 MB)
7951# FAT<32 bit specific
7952>>>>>>>82	string/c	!fat32
7953#>>>>>>>>36	ubyte		0x80		\b, physical drive 0x%x=0x80 (usual harddisk)
7954#>>>>>>>>36	ubyte		0		\b, physical drive 0x%x=0 (usual floppy)
7955>>>>>>>>36	ubyte		!0x80
7956>>>>>>>>>36	ubyte		!0		\b, physical drive 0x%x
7957# VGA-copy CRC or
7958# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
7959>>>>>>>>37	ubyte		>0		\b, reserved 0x%x
7960#>>>>>>>>37	ubyte		=0		\b, reserved 0x%x
7961# extended boot signatur value is 0x80 for NTFS, 0x28 or 0x29 for others
7962>>>>>>>>38	ubyte		!0x29		\b, dos < 4.0 BootSector (0x%x)
7963>>>>>>>>38	ubyte&0xFE	=0x28
7964>>>>>>>>>39	ulelong		x		\b, serial number 0x%x
7965>>>>>>>>38	ubyte		=0x29
7966>>>>>>>>>43	string		<NO\ NAME	\b, label: "%11.11s"
7967>>>>>>>>>43	string		>NO\ NAME	\b, label: "%11.11s"
7968>>>>>>>>>43	string		=NO\ NAME	\b, unlabeled
7969# there exist some old floppies without word FAT at offset 54
7970# a word like "FATnm   " is only a hint for a FAT size on nm-bits
7971# Normally the number of clusters is calculated by the values of BPP.
7972# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
7973# otherwise FAT is 16 bit.
7974# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
7975>>>>>82		string/c	!fat32
7976>>>>>>54	string		FAT12		\b, FAT (12 bit)
7977>>>>>>54	string		FAT16		\b, FAT (16 bit)
7978>>>>>>54	default		x
7979# determinate FAT bit size by media descriptor
7980# small floppies implies FAT12
7981>>>>>>>21	ubyte		<0xF0		\b, FAT (12 bit by descriptor)
7982# with media descriptor F0h floppy or maybe superfloppy with FAT16
7983>>>>>>>21	ubyte		=0xF0
7984# superfloppy (many sectors) implies FAT16
7985>>>>>>>>32	ulelong		>0xFFFF		\b, FAT (16 bit by descriptor+sectors)
7986# no superfloppy with media descriptor F0h implies FAT12
7987>>>>>>>>32	default		x		\b, FAT (12 bit by descriptor+sectors)
7988# with media descriptor F8h floppy or hard disc with FAT12 or FAT16
7989>>>>>>>21	ubyte		=0xF8
7990# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12
7991>>>>>>>>19	ubequad	0xd002f80300090001	\b, FAT (12 bit by descriptor+geometry)
7992# hard disc with FAT12 or FAT16
7993>>>>>>>>19	default		x		\b, FAT (1Y bit by descriptor)
7994# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc
7995>>>>>>>21	ubyte		=0xFA
7996# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12
7997>>>>>>>>19	ubequad	0x8002fa0200080001	\b, FAT (12 bit by descriptor+geometry)
7998# RAM disc with FAT12 or FAT16 or Tandy hard disc
7999>>>>>>>>19	default		x		\b, FAT (1Y bit by descriptor)
8000# others are floppy
8001>>>>>>>21	default		x		\b, FAT (12 bit by descriptor)
8002# FAT32 bit specific
8003>>>>>82		string/c	fat32		\b, FAT (32 bit)
8004>>>>>>36	ulelong		x		\b, sectors/FAT %u
8005# http://technet.microsoft.com/en-us/library/cc977221.aspx
8006>>>>>>40	uleshort	>0		\b, extension flags 0x%x
8007#>>>>>>40	uleshort	=0		\b, extension flags %hu
8008>>>>>>42	uleshort	>0		\b, fsVersion %u
8009#>>>>>>42	uleshort	=0		\b, fsVersion %u (usual)
8010>>>>>>44	ulelong		>2		\b, rootdir cluster %u
8011#>>>>>>44	ulelong		=2		\b, rootdir cluster %u
8012#>>>>>>44	ulelong		=1		\b, rootdir cluster %u
8013>>>>>>48	uleshort	>1		\b, infoSector %u
8014#>>>>>>48	uleshort	=1		\b, infoSector %u (usual)
8015>>>>>>48	uleshort	<1		\b, infoSector %u
8016# 0 or 0xFFFF instead of usual 6 means no backup sector
8017>>>>>>50	uleshort	=0xFFFF		\b, no Backup boot sector
8018>>>>>>50	uleshort	=0		\b, no Backup boot sector
8019#>>>>>>50	uleshort	=6		\b, Backup boot sector %u (usual)
8020>>>>>>50	default		x
8021>>>>>>>50	uleshort	x		\b, Backup boot sector %u
8022# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
8023>>>>>>52	ulelong		>0		\b, reserved1 0x%x
8024>>>>>>56	ulelong		>0		\b, reserved2 0x%x
8025>>>>>>60	ulelong		>0		\b, reserved3 0x%x
8026# same structure as FAT1X
8027#>>>>>>64	ubyte		=0x80		\b, physical drive 0x%x=80 (usual harddisk)
8028#>>>>>>64	ubyte		=0		\b, physical drive 0x%x=0 (usual floppy)
8029>>>>>>64	ubyte		!0x80
8030>>>>>>>64	ubyte		>0		\b, physical drive 0x%x
8031# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
8032>>>>>>65	ubyte		>0		\b, reserved 0x%x
8033>>>>>>66	ubyte		!0x29		\b, dos < 4.0 BootSector (0x%x)
8034>>>>>>66	ubyte		=0x29
8035>>>>>>>67	ulelong		x		\b, serial number 0x%x
8036>>>>>>>71	string		<NO\ NAME	\b, label: "%11.11s"
8037>>>>>>>71	string		>NO\ NAME	\b, label: "%11.11s"
8038>>>>>>>71	string		=NO\ NAME	\b, unlabeled
8039# additional tests for floppy image added by Joerg Jenderek
8040# no fixed disk
8041>>>>>21		ubyte		!0xF8
8042# floppy media with 12 bit FAT
8043>>>>>>54	string		!FAT16
8044# test for FAT after bootsector
8045>>>>>>>(11.s)	ulelong&0x00ffffF0	0x00ffffF0	\b, followed by FAT
8046# floppy image
8047!:mime application/x-ima
8048# NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
8049# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
8050# 0 FATs
8051>>>>>16	ubyte		=0
8052# 0 root entries
8053>>>>>>17	uleshort	=0
8054# 0 DOS sectors
8055>>>>>>>19	uleshort	=0
8056# 0 sectors/FAT
8057# dos < 4.0 BootSector value found is 0x80
8058#38	ubyte		=0x80			\b, dos < 4.0 BootSector (0x%x)
8059>>>>>>>>22	uleshort	=0		\b; NTFS
8060>>>>>>>>>24	uleshort	>0		\b, sectors/track %u
8061>>>>>>>>>36	ulelong		!0x800080	\b, physical drive 0x%x
8062>>>>>>>>>40	ulequad		>0		\b, sectors %lld
8063>>>>>>>>>48	ulequad		>0		\b, $MFT start cluster %lld
8064>>>>>>>>>56	ulequad		>0		\b, $MFTMirror start cluster %lld
8065# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters.
8066# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
8067>>>>>>>>>64	lelong		<256
8068>>>>>>>>>>64	lelong		<128		\b, clusters/RecordSegment %d
8069>>>>>>>>>>64	ubyte		>127		\b, bytes/RecordSegment 2^(-1*%i)
8070# Values 0 to 127 represent index block sizes of 0 to 127 clusters.
8071# Values 128 to 255 represent index block sizes of 2^(256-N) byte
8072>>>>>>>>>68	ulelong		<256
8073>>>>>>>>>>68	ulelong		<128		\b, clusters/index block %d
8074#>>>>>>>>>>68	ulelong		>127		\b, bytes/index block 2^(256-%d)
8075>>>>>>>>>>68	ubyte		>127		\b, bytes/index block 2^(-1*%i)
8076>>>>>>>>>72	ulequad		x		\b, serial number 0%llx
8077>>>>>>>>>80	ulelong		>0		\b, checksum 0x%x
8078#>>>>>>>>>80	ulelong		=0		\b, checksum 0x%x=0 (usual)
8079>>>>>>>>>0x258	ulelong&0x00009090	=0x00009090
8080>>>>>>>>>>&-92		indirect	x	\b; contains
8081# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013
8082# http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
8083# unused assembler instructions JMP y2;NOP;NOP
80840x056		ulelong&0xFFFF0FFF	0x909002EB
8085# unicode loadername terminated by CTRL-D
8086>(0.s*2)	ulelong&0xFFFFFF00	0x00040000
8087# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR
8088>>0x002		lestring16	x	Microsoft Windows XP/VISTA bootloader %-5.5s
8089>>0x12		string		$
8090>>>0x0c		lestring16	x	\b%-2.2s
8091### DOS,NTFS boot sectors end
8092
80939564	lelong		0x00011954	Unix Fast File system [v1] (little-endian),
8094>8404	string		x		last mounted on %s,
8095#>9504	ledate		x		last checked at %s,
8096>8224	ledate		x		last written at %s,
8097>8401	byte		x		clean flag %d,
8098>8228	lelong		x		number of blocks %d,
8099>8232	lelong		x		number of data blocks %d,
8100>8236	lelong		x		number of cylinder groups %d,
8101>8240	lelong		x		block size %d,
8102>8244	lelong		x		fragment size %d,
8103>8252	lelong		x		minimum percentage of free blocks %d,
8104>8256	lelong		x		rotational delay %dms,
8105>8260	lelong		x		disk rotational speed %drps,
8106>8320	lelong		0		TIME optimization
8107>8320	lelong		1		SPACE optimization
8108
810942332	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
8110>&-1164	string		x		last mounted on %s,
8111>&-696	string		>\0		volume name %s,
8112>&-304	leqldate	x		last written at %s,
8113>&-1167	byte		x		clean flag %d,
8114>&-1168	byte		x		readonly flag %d,
8115>&-296	lequad		x		number of blocks %lld,
8116>&-288	lequad		x		number of data blocks %lld,
8117>&-1332	lelong		x		number of cylinder groups %d,
8118>&-1328	lelong		x		block size %d,
8119>&-1324	lelong		x		fragment size %d,
8120>&-180	lelong		x		average file size %d,
8121>&-176	lelong		x		average number of files in dir %d,
8122>&-272	lequad		x		pending blocks to free %lld,
8123>&-264	lelong		x		pending inodes to free %d,
8124>&-664	lequad		x		system-wide uuid %0llx,
8125>&-1316	lelong		x		minimum percentage of free blocks %d,
8126>&-1248	lelong		0		TIME optimization
8127>&-1248	lelong		1		SPACE optimization
8128
812966908	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
8130>&-1164	string		x		last mounted on %s,
8131>&-696	string		>\0		volume name %s,
8132>&-304	leqldate	x		last written at %s,
8133>&-1167	byte		x		clean flag %d,
8134>&-1168	byte		x		readonly flag %d,
8135>&-296	lequad		x		number of blocks %lld,
8136>&-288	lequad		x		number of data blocks %lld,
8137>&-1332	lelong		x		number of cylinder groups %d,
8138>&-1328	lelong		x		block size %d,
8139>&-1324	lelong		x		fragment size %d,
8140>&-180	lelong		x		average file size %d,
8141>&-176	lelong		x		average number of files in dir %d,
8142>&-272	lequad		x		pending blocks to free %lld,
8143>&-264	lelong		x		pending inodes to free %d,
8144>&-664	lequad		x		system-wide uuid %0llx,
8145>&-1316	lelong		x		minimum percentage of free blocks %d,
8146>&-1248	lelong		0		TIME optimization
8147>&-1248	lelong		1		SPACE optimization
8148
81499564	belong		0x00011954	Unix Fast File system [v1] (big-endian),
8150>7168   belong		0x4c41424c	Apple UFS Volume
8151>>7186  string		x		named %s,
8152>>7176  belong		x		volume label version %d,
8153>>7180  bedate		x		created on %s,
8154>8404	string		x		last mounted on %s,
8155#>9504	bedate		x		last checked at %s,
8156>8224	bedate		x		last written at %s,
8157>8401	byte		x		clean flag %d,
8158>8228	belong		x		number of blocks %d,
8159>8232	belong		x		number of data blocks %d,
8160>8236	belong		x		number of cylinder groups %d,
8161>8240	belong		x		block size %d,
8162>8244	belong		x		fragment size %d,
8163>8252	belong		x		minimum percentage of free blocks %d,
8164>8256	belong		x		rotational delay %dms,
8165>8260	belong		x		disk rotational speed %drps,
8166>8320	belong		0		TIME optimization
8167>8320	belong		1		SPACE optimization
8168
816942332	belong		0x19540119	Unix Fast File system [v2] (big-endian)
8170>&-1164	string		x		last mounted on %s,
8171>&-696	string		>\0		volume name %s,
8172>&-304	beqldate	x		last written at %s,
8173>&-1167	byte		x		clean flag %d,
8174>&-1168	byte		x		readonly flag %d,
8175>&-296	bequad		x		number of blocks %lld,
8176>&-288	bequad		x		number of data blocks %lld,
8177>&-1332	belong		x		number of cylinder groups %d,
8178>&-1328	belong		x		block size %d,
8179>&-1324	belong		x		fragment size %d,
8180>&-180	belong		x		average file size %d,
8181>&-176	belong		x		average number of files in dir %d,
8182>&-272	bequad		x		pending blocks to free %lld,
8183>&-264	belong		x		pending inodes to free %d,
8184>&-664	bequad		x		system-wide uuid %0llx,
8185>&-1316	belong		x		minimum percentage of free blocks %d,
8186>&-1248	belong		0		TIME optimization
8187>&-1248	belong		1		SPACE optimization
8188
818966908	belong		0x19540119	Unix Fast File system [v2] (big-endian)
8190>&-1164	string		x		last mounted on %s,
8191>&-696	string		>\0		volume name %s,
8192>&-304	beqldate	x		last written at %s,
8193>&-1167	byte		x		clean flag %d,
8194>&-1168	byte		x		readonly flag %d,
8195>&-296	bequad		x		number of blocks %lld,
8196>&-288	bequad		x		number of data blocks %lld,
8197>&-1332	belong		x		number of cylinder groups %d,
8198>&-1328	belong		x		block size %d,
8199>&-1324	belong		x		fragment size %d,
8200>&-180	belong		x		average file size %d,
8201>&-176	belong		x		average number of files in dir %d,
8202>&-272	bequad		x		pending blocks to free %lld,
8203>&-264	belong		x		pending inodes to free %d,
8204>&-664	bequad		x		system-wide uuid %0llx,
8205>&-1316	belong		x		minimum percentage of free blocks %d,
8206>&-1248	belong		0		TIME optimization
8207>&-1248	belong		1		SPACE optimization
8208
8209# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
8210# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
8211# volume label and UUID Russell Coker
8212# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
82130x438   leshort         0xEF53          Linux
8214>0x44c  lelong          x               rev %d
8215>0x43e  leshort         x               \b.%d
8216# No journal?  ext2
8217>0x45c  lelong          ^0x0000004      ext2 filesystem data
8218>>0x43a leshort         ^0x0000001      (mounted or unclean)
8219# Has a journal?  ext3 or ext4
8220>0x45c  lelong          &0x0000004
8221#  and small INCOMPAT?
8222>>0x460 lelong          <0x0000040
8223#   and small RO_COMPAT?
8224>>>0x464 lelong         <0x0000008      ext3 filesystem data
8225#   else large RO_COMPAT?
8226>>>0x464 lelong         >0x0000007      ext4 filesystem data
8227#  else large INCOMPAT?
8228>>0x460	lelong          >0x000003f      ext4 filesystem data
8229>0x468	belong		x		\b, UUID=%08x
8230>0x46c	beshort		x		\b-%04x
8231>0x46e	beshort		x		\b-%04x
8232>0x470	beshort		x		\b-%04x
8233>0x472	belong		x		\b-%08x
8234>0x476	beshort		x		\b%04x
8235>0x478	string		>0		\b, volume name "%s"
8236# General flags for any ext* fs
8237>0x460	lelong          &0x0000004      (needs journal recovery)
8238>0x43a	leshort         &0x0000002      (errors)
8239# INCOMPAT flags
8240>0x460	lelong          &0x0000001      (compressed)
8241#>0x460	lelong          &0x0000002      (filetype)
8242#>0x460	lelong          &0x0000010      (meta bg)
8243>0x460	lelong          &0x0000040      (extents)
8244>0x460	lelong          &0x0000080      (64bit)
8245#>0x460	lelong          &0x0000100      (mmp)
8246#>0x460	lelong          &0x0000200      (flex bg)
8247# RO_INCOMPAT flags
8248#>0x464	lelong          &0x0000001      (sparse super)
8249>0x464	lelong          &0x0000002      (large files)
8250>0x464	lelong          &0x0000008      (huge files)
8251#>0x464	lelong          &0x0000010      (gdt checksum)
8252#>0x464	lelong          &0x0000020      (many subdirs)
8253#>0x463	lelong          &0x0000040      (extra isize)
8254
8255# Minix filesystems - Juan Cespedes <cespedes@debian.org>
82560x410	leshort		0x137f
8257!:strength / 2
8258>0x402	beshort		< 100
8259>0x402	beshort		> -1		Minix filesystem, V1, %d zones
8260>0x1e	string		minix		\b, bootable
82610x410	beshort		0x137f
8262!:strength / 2
8263>0x402	beshort		< 100
8264>0x402	beshort		> -1		Minix filesystem, V1 (big endian), %d zones
8265>0x1e	string		minix		\b, bootable
82660x410	leshort		0x138f
8267!:strength / 2
8268>0x402	beshort		< 100
8269>0x402	beshort		> -1		Minix filesystem, V1, 30 char names, %d zones
8270>0x1e	string		minix		\b, bootable
82710x410	beshort		0x138f
8272!:strength / 2
8273>0x402	beshort		< 100
8274>0x402	beshort		> -1		Minix filesystem, V1, 30 char names (big endian), %d zones
8275>0x1e	string		minix		\b, bootable
82760x410	leshort		0x2468
8277>0x402	beshort		< 100
8278>>0x402	beshort		> -1		Minix filesystem, V2, %d zones
8279>0x1e	string		minix		\b, bootable
82800x410	beshort		0x2468
8281>0x402	beshort		< 100
8282>0x402	beshort		> -1		Minix filesystem, V2 (big endian), %d zones
8283>0x1e	string		minix		\b, bootable
8284
82850x410	leshort		0x2478
8286>0x402	beshort		< 100
8287>0x402	beshort		> -1		Minix filesystem, V2, 30 char names, %d zones
8288>0x1e	string		minix		\b, bootable
82890x410	leshort		0x2478
8290>0x402	beshort		< 100
8291>0x402	beshort		> -1		Minix filesystem, V2, 30 char names, %d zones
8292>0x1e	string		minix		\b, bootable
82930x410	beshort		0x2478
8294>0x402	beshort		!0		Minix filesystem, V2, 30 char names (big endian), %d zones
8295>0x1e	string		minix		\b, bootable
82960x410	leshort		0x4d5a
8297>0x402	beshort		!0		Minix filesystem, V3, %d zones
8298>0x1e	string		minix		\b, bootable
8299
8300# SGI disk labels - Nathan Scott <nathans@debian.org>
83010	belong		0x0BE5A941	SGI disk label (volume header)
8302
8303# SGI XFS filesystem - Nathan Scott <nathans@debian.org>
83040	belong		0x58465342	SGI XFS filesystem data
8305>0x4	belong		x		(blksz %d,
8306>0x68	beshort		x		inosz %d,
8307>0x64	beshort		^0x2004		v1 dirs)
8308>0x64	beshort		&0x2004		v2 dirs)
8309
8310############################################################################
8311# Minix-ST kernel floppy
83120x800	belong		0x46fc2700	Atari-ST Minix kernel image
8313# http://en.wikipedia.org/wiki/BIOS_parameter_block
8314# floppies with valid BPB and any instruction at beginning
8315>19	string		\240\005\371\005\0\011\0\2\0	\b, 720k floppy
8316>19	string		\320\002\370\005\0\011\0\1\0	\b, 360k floppy
8317
8318############################################################################
8319# Hmmm, is this a better way of detecting _standard_ floppy images ?
832019	string		\320\002\360\003\0\011\0\1\0	DOS floppy 360k
8321>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
832219	string		\240\005\371\003\0\011\0\2\0	DOS floppy 720k
8323>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
832419	string		\100\013\360\011\0\022\0\2\0	DOS floppy 1440k
8325>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
8326
832719	string		\240\005\371\005\0\011\0\2\0	DOS floppy 720k, IBM
8328>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
832919	string		\100\013\371\005\0\011\0\2\0	DOS floppy 1440k, mkdosfs
8330>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
8331
833219	string		\320\002\370\005\0\011\0\1\0	Atari-ST floppy 360k
833319	string		\240\005\371\005\0\011\0\2\0	Atari-ST floppy 720k
8334#			|       |   |     |     |
8335#			|       |   |     |     heads
8336#			|       |   |     sectors/track
8337#			|       |   sectors/FAT
8338#			|       media descriptor
8339#		BPB:	sectors
8340
8341#  Valid media descriptor bytes for MS-DOS:
8342#
8343#     Byte   Capacity   Media Size and Type
8344#     -------------------------------------------------
8345#
8346#     F0     2.88 MB    3.5-inch, 2-sided, 36-sector
8347#     F0     1.44 MB    3.5-inch, 2-sided, 18-sector
8348#     F9     720K       3.5-inch, 2-sided, 9-sector
8349#     F9     1.2 MB     5.25-inch, 2-sided, 15-sector
8350#     FD     360K       5.25-inch, 2-sided, 9-sector
8351#     FF     320K       5.25-inch, 2-sided, 8-sector
8352#     FC     180K       5.25-inch, 1-sided, 9-sector
8353#     FE     160K       5.25-inch, 1-sided, 8-sector
8354#     FE     250K       8-inch, 1-sided, single-density
8355#     FD     500K       8-inch, 2-sided, single-density
8356#     FE     1.2 MB     8-inch, 2-sided, double-density
8357#     F8     -----      Fixed disk
8358#
8359#     FC     xxxK       Apricot 70x1x9 boot disk.
8360#
8361# Originally a bitmap:
8362#  xxxxxxx0	Not two sided
8363#  xxxxxxx1	Double sided
8364#  xxxxxx0x	Not 8 SPT
8365#  xxxxxx1x	8 SPT
8366#  xxxxx0xx	Not Removable drive
8367#  xxxxx1xx	Removable drive
8368#  11111xxx	Must be one.
8369#
8370# But now it's rather random:
8371#  111111xx	Low density disk
8372#        00	SS, Not 8 SPT
8373#        01	DS, Not 8 SPT
8374#        10	SS, 8 SPT
8375#        11	DS, 8 SPT
8376#
8377#  11111001	Double density 3 1/2 floppy disk, high density 5 1/4
8378#  11110000	High density 3 1/2 floppy disk
8379#  11111000	Hard disk any format
8380#
8381
8382# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013
8383# http://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions
8384# Too Weak.
8385#512		ubelong&0xE0ffff00	0xE0ffff00
8386# without valid Media descriptor in place of BPB, cases with are done at other places
8387#>21		ubyte			<0xE5			floppy with old FAT filesystem
8388# but valid Media descriptor at begin of FAT
8389#>>512		ubyte			=0xed			720k
8390#>>512		ubyte			=0xf0			1440k
8391#>>512		ubyte			=0xf8			720k
8392#>>512		ubyte			=0xf9			1220k
8393#>>512		ubyte			=0xfa			320k
8394#>>512		ubyte			=0xfb			640k
8395#>>512		ubyte			=0xfc			180k
8396# look like an an old DOS directory entry
8397#>>>0xA0E	ubequad			0
8398#>>>>0xA00	ubequad			!0
8399#!:mime application/x-ima
8400#>>512		ubyte			=0xfd
8401# look for 2nd FAT at different location to distinguish between 360k and 500k
8402#>>>0x600	ubelong&0xE0ffff00	0xE0ffff00		360k
8403#>>>0x500	ubelong&0xE0ffff00	0xE0ffff00		500k
8404#>>>0xA0E	ubequad			0
8405#!:mime application/x-ima
8406#>>512		ubyte			=0xfe
8407#>>>0x400	ubelong&0xE0ffff00	0xE0ffff00		160k
8408#>>>>0x60E	ubequad			0
8409#>>>>>0x600	ubequad			!0
8410#!:mime application/x-ima
8411#>>>0xC00	ubelong&0xE0ffff00	0xE0ffff00		1200k
8412#>>512		ubyte			=0xff			320k
8413#>>>0x60E	ubequad			0
8414#>>>>0x600	ubequad			!0
8415#!:mime application/x-ima
8416#>>512		ubyte			x			\b, Media descriptor 0x%x
8417# without x86 jump instruction
8418#>>0		ulelong&0x804000E9	!0x000000E9
8419# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV
8420#>>>0	ubequad				0xfabce701b8c0078e	\b, MS-DOS 1.12 bootloader
8421# IOSYS.COM+MSDOS.COM
8422#>>>>0xc4	use			2xDOS-filename
8423#>>0		ulelong&0x804000E9	=0x000000E9
8424# only x86 short jump instruction found
8425#>>>0		ubyte			=0xEB
8426#>>>>1		ubyte			x			\b, code offset 0x%x+2
8427# http://thestarman.pcministry.com/DOS/ibm100/Boot.htm
8428# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0
8429#>>>>(1.b+2)	ubequad			0xfa8cc88ed8ba0000	\b, PC-DOS 1.0 bootloader
8430# ibmbio.com+ibmdos.com
8431#>>>>>0x176	use			DOS-filename
8432#>>>>>0x181	ubyte			x			\b+
8433#>>>>>0x182	use			DOS-filename
8434# http://thestarman.pcministry.com/DOS/ibm110/Boot.htm
8435# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV
8436#>>>>(1.b+2)	ubequad			0xfa8cc88ed833d28e	\b, PC-DOS 1.1 bootloader
8437# ibmbio.com+ibmdos.com
8438#>>>>>0x18b	use			DOS-filename
8439#>>>>>0x196	ubyte			x			\b+
8440#>>>>>0x197	use			DOS-filename
8441# http://en.wikipedia.org/wiki/Zenith_Data_Systems
8442# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6
8443#>>>>(1.b+2)	ubequad			0xbbc0078ed3bcc601	\b, Zenith Data Systems MS-DOS 1.25 bootloader
8444# IO.SYS+MSDOS.SYS
8445#>>>>>0x20	use			2xDOS-filename
8446# http://en.wikipedia.org/wiki/Corona_Data_Systems
8447# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX;
8448#>>>>(1.b+2)	ubequad			0x8cc88ed8fa8ed0bc	\b, MS-DOS 1.25 bootloader
8449# IO.SYS+MSDOS.SYS
8450#>>>>>0x69	use			2xDOS-filename
8451# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00;
8452#>>>>(1.b+2)	ubequad			0xfa0e17bc007cb860	\b, MS-DOS 2.11 bootloader
8453# defect IO.SYS+MSDOS.SYS ?
8454#>>>>>0x162	use			2xDOS-filename
8455
84560	name				cdrom
8457>38913	string   !NSR0      ISO 9660 CD-ROM filesystem data
8458!:mime	application/x-iso9660-image
8459>38913	string    NSR0      UDF filesystem data
8460!:mime	application/x-iso9660-image
8461>>38917	string    1         (version 1.0)
8462>>38917	string    2         (version 1.5)
8463>>38917	string    3         (version 2.0)
8464>>38917	byte     >0x33      (unknown version, ID 0x%X)
8465>>38917	byte     <0x31      (unknown version, ID 0x%X)
8466>0x1FE	leshort  0xAA55     (DOS/MBR boot sector)
8467# "application id" which appears to be used as a volume label
8468>32808	string/T  >\0       '%s'
8469>34816	string    \000CD001\001EL\ TORITO\ SPECIFICATION    (bootable)
847037633	string    CD001     ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
8471!:mime	application/x-iso9660-image
847232777	string    CDROM     High Sierra CD-ROM filesystem data
8473
8474# CDROM Filesystems
8475# https://en.wikipedia.org/wiki/ISO_9660
8476# Modified for UDF by gerardo.cacciari@gmail.com
847732769	string    CD001
8478# mime line at that position does not work
8479# to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51)
8480!:strength -11
8481# to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51)
8482# does not work
8483#!:strength +33
8484>0	use cdrom
8485
8486# .cso files
84870    string    CISO	Compressed ISO CD image
8488
8489# cramfs filesystem - russell@coker.com.au
84900       lelong    0x28cd3d45      Linux Compressed ROM File System data, little endian
8491>4      lelong  x size %u
8492>8      lelong  &1 version #2
8493>8      lelong  &2 sorted_dirs
8494>8      lelong  &4 hole_support
8495>32     lelong  x CRC 0x%x,
8496>36     lelong  x edition %u,
8497>40     lelong  x %u blocks,
8498>44     lelong  x %u files
8499
85000       belong    0x28cd3d45      Linux Compressed ROM File System data, big endian
8501>4      belong  x size %u
8502>8      belong  &1 version #2
8503>8      belong  &2 sorted_dirs
8504>8      belong  &4 hole_support
8505>32     belong  x CRC 0x%x,
8506>36     belong  x edition %u,
8507>40     belong  x %u blocks,
8508>44     belong  x %u files
8509
8510# reiserfs - russell@coker.com.au
85110x10034		string	ReIsErFs	ReiserFS V3.5
85120x10034		string	ReIsEr2Fs	ReiserFS V3.6
85130x10034		string	ReIsEr3Fs	ReiserFS V3.6.19
8514>0x1002c 	leshort	x		block size %d
8515>0x10032	leshort	&2		(mounted or unclean)
8516>0x10000	lelong	x		num blocks %d
8517>0x10040	lelong	1		tea hash
8518>0x10040	lelong	2		yura hash
8519>0x10040	lelong	3		r5 hash
8520
8521# JFFS - russell@coker.com.au
85220	lelong	0x34383931	Linux Journalled Flash File system, little endian
85230	belong	0x34383931	Linux Journalled Flash File system, big endian
8524
8525# EST flat binary format (which isn't, but anyway)
8526# From: Mark Brown <broonie@sirena.org.uk>
85270	string	ESTFBINR	EST flat binary
8528
8529# Aculab VoIP firmware
8530# From: Mark Brown <broonie@sirena.org.uk>
85310	string	VoIP\ Startup\ and	Aculab VoIP firmware
8532>35	string	x	format %s
8533
8534# From: Mark Brown <broonie@sirena.org.uk> [old]
8535# From: Behan Webster <behanw@websterwood.com>
85360	belong	0x27051956	u-boot legacy uImage,
8537>32	string	x		%s,
8538>28	byte	0		Invalid os/
8539>28	byte	1		OpenBSD/
8540>28	byte	2		NetBSD/
8541>28	byte	3		FreeBSD/
8542>28	byte	4		4.4BSD/
8543>28	byte	5		Linux/
8544>28	byte	6		SVR4/
8545>28	byte	7		Esix/
8546>28	byte	8		Solaris/
8547>28	byte	9		Irix/
8548>28	byte	10		SCO/
8549>28	byte	11		Dell/
8550>28	byte	12		NCR/
8551>28	byte	13		LynxOS/
8552>28	byte	14		VxWorks/
8553>28	byte	15		pSOS/
8554>28	byte	16		QNX/
8555>28	byte	17		Firmware/
8556>28	byte	18		RTEMS/
8557>28	byte	19		ARTOS/
8558>28	byte	20		Unity OS/
8559>28	byte	21		INTEGRITY/
8560>29	byte	0		\bInvalid CPU,
8561>29	byte	1		\bAlpha,
8562>29	byte	2		\bARM,
8563>29	byte	3		\bIntel x86,
8564>29	byte	4		\bIA64,
8565>29	byte	5		\bMIPS,
8566>29	byte	6		\bMIPS 64-bit,
8567>29	byte	7		\bPowerPC,
8568>29	byte	8		\bIBM S390,
8569>29	byte	9		\bSuperH,
8570>29	byte	10		\bSparc,
8571>29	byte	11		\bSparc 64-bit,
8572>29	byte	12		\bM68K,
8573>29	byte	13		\bNios-32,
8574>29	byte	14		\bMicroBlaze,
8575>29	byte	15		\bNios-II,
8576>29	byte	16		\bBlackfin,
8577>29	byte	17		\bAVR32,
8578>29	byte	18		\bSTMicroelectronics ST200,
8579>30	byte	0		Invalid Image
8580>30	byte	1		Standalone Program
8581>30	byte	2		OS Kernel Image
8582>30	byte	3		RAMDisk Image
8583>30	byte	4		Multi-File Image
8584>30	byte	5		Firmware Image
8585>30	byte	6		Script File
8586>30	byte	7		Filesystem Image (any type)
8587>30	byte	8		Binary Flat Device Tree BLOB
8588>31	byte	0		(Not compressed),
8589>31	byte	1		(gzip),
8590>31	byte	2		(bzip2),
8591>31	byte	3		(lzma),
8592>12	belong	x		%d bytes,
8593>8	bedate	x		%s,
8594>16	belong	x		Load Address: 0x%08X,
8595>20	belong	x		Entry Point: 0x%08X,
8596>4	belong	x		Header CRC: 0x%08X,
8597>24	belong	x		Data CRC: 0x%08X
8598
8599# JFFS2 file system
86000	leshort	0x1984		Linux old jffs2 filesystem data little endian
86010	leshort	0x1985		Linux jffs2 filesystem data little endian
8602
8603# Squashfs
86040	string	sqsh	Squashfs filesystem, big endian,
8605>28	beshort	x	version %d.
8606>30	beshort x	\b%d,
8607>28	beshort <3
8608>>8	belong	x	%d bytes,
8609>28	beshort >2
8610>>28 beshort <4
8611>>>63	bequad x	%lld bytes,
8612>>28 beshort >3
8613>>>40	bequad x	%lld bytes,
8614#>>67	belong	x	%d bytes,
8615>4	belong	x	%d inodes,
8616>28	beshort <2
8617>>32	beshort	x	blocksize: %d bytes,
8618>28	beshort >1
8619>>28 beshort <4
8620>>>51	belong	x	blocksize: %d bytes,
8621>>28 beshort >3
8622>>>12	belong	x	blocksize: %d bytes,
8623>28 beshort <4
8624>>39	bedate	x	created: %s
8625>28 beshort >3
8626>>8	bedate	x	created: %s
86270	string	hsqs	Squashfs filesystem, little endian,
8628>28	leshort	x	version %d.
8629>30	leshort	x	\b%d,
8630>28	leshort <3
8631>>8	lelong	x	%d bytes,
8632>28	leshort >2
8633>>28 leshort <4
8634>>>63	lequad x	%lld bytes,
8635>>28 leshort >3
8636>>>40	lequad x	%lld bytes,
8637#>>63	lelong	x	%d bytes,
8638>4	lelong	x	%d inodes,
8639>28	leshort <2
8640>>32	leshort	x	blocksize: %d bytes,
8641>28	leshort >1
8642>>28 leshort <4
8643>>>51	lelong	x	blocksize: %d bytes,
8644>>28 leshort >3
8645>>>12	lelong	x	blocksize: %d bytes,
8646>28 leshort <4
8647>>39	ledate	x	created: %s
8648>28 leshort >3
8649>>8	ledate	x	created: %s
8650
8651# AFS Dump Magic
8652# From: Ty Sarna <tsarna@sarna.org>
86530       string                  \x01\xb3\xa1\x13\x22    AFS Dump
8654>&0     belong                  x                       (v%d)
8655>>&0    byte                    0x76
8656>>>&0   belong                  x                       Vol %d,
8657>>>>&0  byte                    0x6e
8658>>>>>&0 string                  x                       %s
8659>>>>>>&1        byte            0x74
8660>>>>>>>&0       beshort         2
8661>>>>>>>>&4      bedate          x                       on: %s
8662>>>>>>>>&0      bedate          =0                      full dump
8663>>>>>>>>&0      bedate          !0                      incremental since: %s
8664
8665#----------------------------------------------------------
8666#delta ISO    Daniel Novotny (dnovotny@redhat.com)
86670	string  DISO	Delta ISO data
8668!:strength +50
8669>4	belong  x	version %d
8670
8671# VMS backup savesets - gerardo.cacciari@gmail.com
8672#
86734            string  \x01\x00\x01\x00\x01\x00
8674>(0.s+16)    string  \x01\x01
8675>>&(&0.b+8)  byte    0x42       OpenVMS backup saveset data
8676>>>40        lelong  x          (block size %d,
8677>>>49        string  >\0        original name '%s',
8678>>>2         short   1024       VAX generated)
8679>>>2         short   2048       AXP generated)
8680>>>2         short   4096       I64 generated)
8681
8682# Summary: Oracle Clustered Filesystem
8683# Created by: Aaron Botsis <redhat@digitalmafia.org>
86848	string		OracleCFS	Oracle Clustered Filesystem,
8685>4	long		x		rev %d
8686>0	long		x		\b.%d,
8687>560	string		x		label: %.64s,
8688>136	string		x		mountpoint: %.128s
8689
8690# Summary: Oracle ASM tagged volume
8691# Created by: Aaron Botsis <redhat@digitalmafia.org>
869232	string		ORCLDISK	Oracle ASM Volume,
8693>40	string		x		Disk Name: %0.12s
869432	string		ORCLCLRD	Oracle ASM Volume (cleared),
8695>40	string		x		Disk Name: %0.12s
8696
8697# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org>
86988	string		OracleCFS	Oracle Clustered Filesystem,
8699>4	long		x		rev %d
8700>0	long		x		\b.%d,
8701>560	string		x		label: %.64s,
8702>136	string		x		mountpoint: %.128s
8703
8704# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org>
870532	string		ORCLDISK	Oracle ASM Volume,
8706>40	string		x		Disk Name: %0.12s
870732	string		ORCLCLRD	Oracle ASM Volume (cleared),
8708>40	string		x		Disk Name: %0.12s
8709
8710# Compaq/HP RILOE floppy image
8711# From: Dirk Jagdmann <doj@cubic.org>
87120	string	CPQRFBLO	Compaq/HP RILOE floppy image
8713
8714#------------------------------------------------------------------------------
8715# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours).
8716# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes,
8717# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com
8718#
87191008    string          DECFILE11       Files-11 On-Disk Structure
8720>525    byte            x               (ODS-%d);
8721>1017   string          A               RSX-11, VAX/VMS or OpenVMS VAX file system;
8722>1017   string          B
8723>>525   byte            2               VAX/VMS or OpenVMS file system;
8724>>525   byte            5               OpenVMS Alpha or Itanium file system;
8725>984    string          x               volume label is '%-12.12s'
8726
8727# From: Thomas Klausner <wiz@NetBSD.org>
8728# http://filext.com/file-extension/DAA
8729# describes the daa file format. The magic would be:
87300	string		DAA\x0\x0\x0\x0\x0	PowerISO Direct-Access-Archive
8731
8732# From Albert Cahalan <acahalan@gmail.com>
8733# really le32 operation,destination,payloadsize (but quite predictable)
8734# 01 00 00 00 00 00 00 c0 00 02 00 00
87350	string		\1\0\0\0\0\0\0\300\0\2\0\0	Marvell Libertas firmware
8736
8737# From Eric Sandeen
8738# GFS2
87390x10000         belong          0x01161970
8740>0x10018        belong          0x0000051d      GFS1 Filesystem
8741>>0x10024        belong          x               (blocksize %d,
8742>>0x10060        string          >\0             lockproto %s)
8743>0x10018        belong          0x00000709      GFS2 Filesystem
8744>>0x10024        belong          x               (blocksize %d,
8745>>0x10060        string          >\0             lockproto %s)
8746
8747# BTRFS
87480x10040         string          _BHRfS_M        BTRFS Filesystem
8749>0x1012b        string          >\0             (label "%s",
8750>0x10090        lelong          x               sectorsize %d,
8751>0x10094        lelong          x               nodesize %d,
8752>0x10098        lelong          x               leafsize %d)
8753
8754
8755# dvdisaster's .ecc
8756# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
87570	string	*dvdisaster*	dvdisaster error correction file
8758
8759# xfs metadump image
8760# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
8761# but can we do the << ?  For now it's always 512 (0x200) anyway.
87620	string XFSM
8763>0x200	string XFSB	XFS filesystem metadump image
8764
8765# Type:	CROM filesystem
8766# From:	Werner Fink <werner@suse.de>
87670	string	CROMFS	CROMFS
8768>6	string	>\0	\b version %2.2s,
8769>8	ulequad	>0	\b block data at %lld,
8770>16	ulequad	>0	\b fblock table at %lld,
8771>24	ulequad	>0	\b inode table at %lld,
8772>32	ulequad	>0	\b root at %lld,
8773>40	ulelong	>0	\b fblock size = %d,
8774>44	ulelong	>0	\b block size = %d,
8775>48	ulequad	>0	\b bytes = %lld
8776
8777# Type:	xfs metadump image
8778# From:	Daniel Novotny <dnovotny@redhat.com>
8779# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
8780# but can we do the << ? For now it's always 512 (0x200) anyway.
87810	string	XFSM
8782>0x200	string	XFSB	XFS filesystem metadump image
8783
8784# Type:	delta ISO
8785# From:	Daniel Novotny <dnovotny@redhat.com>
87860	string	DISO	Delta ISO data,
8787>4	belong	x	version %d
8788
8789# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.)
8790# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags.
8791# From: Adam Buchbinder <adam.buchbinder@gmail.com>
87920x8000	string	JFS1
8793# Because it's text-only magic, check a binary value (version) to be sure.
8794# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be
8795# mountable.
8796>&0	lelong	<3	JFS2 filesystem image
8797# Label is followed by a UUID; we have to limit string length to avoid
8798# appending the UUID in the case of a 16-byte label.
8799>>&144	regex	[\x20-\x7E]{1,16}	(label "%s")
8800>>&0	lequad	x	\b, %lld blocks
8801>>&8	lelong	x	\b, blocksize %d
8802>>&32	lelong&0x00000006	>0	(dirty)
8803>>&36	lelong	>0	(compressed)
8804
8805# LFS
88060	lelong	0x070162	LFS filesystem image
8807>4	lelong	1		version 1,
8808>>8	lelong	x		\b blocks %u,
8809>>12	lelong	x		\b blocks per segment %u,
8810>4	lelong	2		version 2,
8811>>8	lelong	x		\b fragments %u,
8812>>12	lelong	x		\b bytes per segment %u,
8813>16	lelong	x		\b disk blocks %u,
8814>20	lelong	x		\b block size %u,
8815>24	lelong	x		\b fragment size %u,
8816>28	lelong	x		\b fragments per block %u,
8817>32	lelong	x		\b start for free list %u,
8818>36	lelong	x		\b number of free blocks %d,
8819>40	lelong	x		\b number of files %u,
8820>44	lelong	x		\b blocks available for writing %d,
8821>48	lelong	x		\b inodes in cache %d,
8822>52	lelong	x		\b inode file disk address 0x%x,
8823>56	lelong	x		\b inode file inode number %u,
8824>60	lelong	x		\b address of last segment written 0x%x,
8825>64	lelong	x		\b address of next segment to write 0x%x,
8826>68	lelong	x		\b address of current segment written 0x%x
8827
88280	string	td\000		floppy image data (TeleDisk, compressed)
88290	string	TD\000		floppy image data (TeleDisk)
8830
88310	string	CQ\024		floppy image data (CopyQM,
8832>16	leshort	x		%d sectors,
8833>18	leshort	x		%d heads.)
8834
88350	string	ACT\020Apricot\020disk\020image\032\004	floppy image data (ApriDisk)
8836
88370	beshort	0xAA58		floppy image data (IBM SaveDskF, old)
88380	beshort	0xAA59		floppy image data (IBM SaveDskF)
88390	beshort	0xAA5A		floppy image data (IBM SaveDskF, compressed)
8840
88410	string	\074CPM_Disk\076	disk image data (YAZE)
8842
8843# ReFS
8844# Richard W.M. Jones <rjones@redhat.com>
88450	string	\0\0\0ReFS\0	ReFS filesystem image
8846
8847# EFW encase image file format:
8848# Gregoire Passault
8849# http://www.forensicswiki.org/wiki/Encase_image_file_format
88500	string	EVF\x09\x0d\x0a\xff\x00	EWF/Expert Witness/EnCase image file format
8851
8852# UBIfs
8853# Linux kernel sources: fs/ubifs/ubifs-media.h
88540	lelong	0x06101831
8855>0x16	leshort	0		UBIfs image
8856>0x08	lequad	x		\b, sequence number %llu
8857>0x10	leshort x		\b, length %u
8858>0x04	lelong	x		\b, CRC 0x%08x
8859
88600	lelong	0x23494255
8861>0x04	leshort	<2
8862>0x05	string	\0\0\0
8863>0x1c	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
8864>0x04	leshort	x		UBI image, version %u
8865
8866# NEC PC-88 2D disk image
8867# From Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
88680x20		ulelong&0xFFFFFEFF	0x2A0
8869>0x10		string			\0\0\0\0\0\0\0\0\0\0
8870>>0x280		string			\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
8871>>>0x1A		ubyte&0xEF		0
8872>>>>0x1B	ubyte&0x8F		0
8873>>>>>0x1B	ubyte&70		<0x40
8874>>>>>>0x1C	ulelong			>0x21
8875>>>>>>>0	regex	[[:print:]]*	NEC PC-88 disk image, name=%s
8876>>>>>>>>0x1B	ubyte	0		\b, media=2D
8877>>>>>>>>0x1B	ubyte	0x10		\b, media=2DD
8878>>>>>>>>0x1B	ubyte	0x20		\b, media=2HD
8879>>>>>>>>0x1B	ubyte	0x30		\b, media=1D
8880>>>>>>>>0x1B	ubyte	0x40		\b, media=1DD
8881>>>>>>>>0x1A	ubyte	0x10		\b, write-protected
8882
8883#------------------------------------------------------------------------------
8884# $File: flash,v 1.10 2014/03/06 16:07:24 christos Exp $
8885# flash:	file(1) magic for Macromedia Flash file format
8886#
8887# See
8888#
8889#	http://www.macromedia.com/software/flash/open/
8890#	http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\
8891#	en/devnet/swf/pdf/swf-file-format-spec.pdf page 27
8892#
8893
88940   name        swf-details
8895>0	string		F		Macromedia Flash data
8896!:mime	application/x-shockwave-flash
8897>0	string		C		Macromedia Flash data (compressed)
8898!:mime	application/x-shockwave-flash
8899>0	string		Z		Macromedia Flash data (lzma compressed)
8900!:mime	application/x-shockwave-flash
8901>3   byte        x      \b, version %d
8902
89031   string      WS
8904>4  lelong      !0
8905>>3 byte        255 Suspicious
8906>>>0    use     swf-details
8907
8908>>3 ubyte       <32
8909>>>3 ubyte      !0
8910>>>>0   use     swf-details
8911
8912# From: Cal Peake <cp@absolutedigital.net>
89130	string		FLV\x01		Macromedia Flash Video
8914!:mime	video/x-flv
8915
8916#
8917# Yosu Gomez
89180       string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document
89190       string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document
8920# From Dave Wilson
89210	string AGD4\xbe\xb8\xbb\xcb\x00	Macromedia Freehand 9 Document
8922
8923#------------------------------------------------------------------------------
8924# $File: fonts,v 1.26 2013/03/09 22:36:00 christos Exp $
8925# fonts:  file(1) magic for font data
8926#
89270	search/1	FONT		ASCII vfont text
89280	short		0436		Berkeley vfont data
89290	short		017001		byte-swapped Berkeley vfont data
8930
8931# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
89320	string		%!PS-AdobeFont-1.	PostScript Type 1 font text
8933>20	string		>\0			(%s)
89346	string		%!PS-AdobeFont-1.	PostScript Type 1 font program data
89350	string		%!FontType1	PostScript Type 1 font program data
89366	string		%!FontType1	PostScript Type 1 font program data
89370	string		%!PS-Adobe-3.0\ Resource-Font	PostScript Type 1 font text
8938
8939# X11 font files in SNF (Server Natural Format) format
8940# updated by Joerg Jenderek at Feb 2013
8941# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm
89420	belong		00000004		X11 SNF font data, MSB first
8943#>104	belong		00000004		X11 SNF font data, MSB first
8944!:mime	application/x-font-sfn
8945# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX
89460	lelong		00000004
8947>104	lelong		00000004		X11 SNF font data, LSB first
8948!:mime	application/x-font-sfn
8949
8950# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
89510	search/1	STARTFONT\ 		X11 BDF font text
8952
8953# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
8954# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
89550	string		\001fcp			X11 Portable Compiled Font data
8956>12	byte		0x02			\b, LSB first
8957>12	byte		0x0a			\b, MSB first
89580	string		D1.0\015		X11 Speedo font data
8959
8960#------------------------------------------------------------------------------
8961# FIGlet fonts and controlfiles
8962# From figmagic supplied with Figlet version 2.2
8963# "David E. O'Brien" <obrien@FreeBSD.ORG>
89640	string		flf		FIGlet font
8965>3	string		>2a		version %-2.2s
89660	string		flc		FIGlet controlfile
8967>3	string		>2a		version %-2.2s
8968
8969# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
8970# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
89710	belong		0x14025919	libGrx font data,
8972>8	leshort		x		%dx
8973>10	leshort		x		\b%d
8974>40	string		x		%s
8975# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
89760	belong		0xff464f4e	DOS code page font data collection
89777	belong		0x00454741	DOS code page font data
89787	belong		0x00564944	DOS code page font data (from Linux?)
89794098	string		DOSFONT		DOSFONT2 encrypted font data
8980
8981# downloadable fonts for browser (prints type) anthon@mnt.org
89820	string		PFR1		PFR1 font
8983>102	string		>0		\b: %s
8984
8985# True Type fonts
89860	string	\000\001\000\000\000	TrueType font data
8987!:mime application/x-font-ttf
8988
89890	string		\007\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font
89900	string		\012\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font
8991
8992# TrueType/OpenType font collections (.ttc)
8993# http://www.microsoft.com/typography/otspec/otff.htm
89940	string		ttcf		TrueType font collection data
8995>4	belong		0x00010000	\b, 1.0
8996>>8	belong		>0		\b, %d fonts
8997>4	belong		0x00020000	\b, 2.0
8998>>8	belong		>0		\b, %d fonts
8999# 0x44454947 = 'DSIG'
9000>>>16	belong		0x44534947	\b, digitally signed
9001
9002# Opentype font data from Avi Bercovich
90030	string		OTTO		OpenType font data
9004!:mime application/vnd.ms-opentype
9005
9006# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
90070	string		SplineFontDB:	Spline Font Database
9008!:mime application/vnd.font-fontforge-sfd
9009>14	string		x		version %s
9010
9011# EOT
901234	string		LP		Embedded OpenType (EOT)
9013!:mime application/vnd.ms-fontobject
9014
9015# Web Open Font Format (.woff)
9016# http://www.w3.org/TR/WOFF/
90170	string		wOFF	Web Open Font Format
9018>4	belong		x	\b, flavor %d
9019>8	belong		x	\b, length %d
9020>20	beshort		x	\b, version %d
9021>22	beshort		x	\b.%d
9022
9023#------------------------------------------------------------------------------
9024# $File: fortran,v 1.7 2012/06/21 01:55:02 christos Exp $
9025# FORTRAN source
90260	regex/100l	\^[Cc][\ \t]	FORTRAN program
9027!:mime	text/x-fortran
9028!:strength - 5
9029
9030#------------------------------------------------------------------------------
9031# $File$
9032# frame:  file(1) magic for FrameMaker files
9033#
9034# This stuff came on a FrameMaker demo tape, most of which is
9035# copyright, but this file is "published" as witness the following:
9036#
9037# Note that this is the Framemaker Maker Interchange Format, not the
9038# Normal format which would be application/vnd.framemaker.
9039#
90400	string		\<MakerFile	FrameMaker document
9041!:mime	application/x-mif
9042>11	string		5.5		 (5.5
9043>11	string		5.0		 (5.0
9044>11	string		4.0		 (4.0
9045>11	string		3.0		 (3.0
9046>11	string		2.0		 (2.0
9047>11	string		1.0		 (1.0
9048>14	byte		x		  %c)
90490	string		\<MIFFile	FrameMaker MIF (ASCII) file
9050!:mime	application/x-mif
9051>9	string		4.0		 (4.0)
9052>9	string		3.0		 (3.0)
9053>9	string		2.0		 (2.0)
9054>9	string		1.0		 (1.x)
90550	search/1	\<MakerDictionary	FrameMaker Dictionary text
9056!:mime	application/x-mif
9057>17	string		3.0		 (3.0)
9058>17	string		2.0		 (2.0)
9059>17	string		1.0		 (1.x)
90600	string		\<MakerScreenFont	FrameMaker Font file
9061!:mime	application/x-mif
9062>17	string		1.01		 (%s)
90630	string		\<MML		FrameMaker MML file
9064!:mime	application/x-mif
90650	string		\<BookFile	FrameMaker Book file
9066!:mime	application/x-mif
9067>10	string		3.0		 (3.0
9068>10	string		2.0		 (2.0
9069>10	string		1.0		 (1.0
9070>13	byte		x		  %c)
9071# XXX - this book entry should be verified, if you find one, uncomment this
9072#0	string		\<Book\ 	FrameMaker Book (ASCII) file
9073#!:mime	application/x-mif
9074#>6	string		3.0		 (3.0)
9075#>6	string		2.0		 (2.0)
9076#>6	string		1.0		 (1.0)
90770	string		\<Maker	Intermediate Print File	FrameMaker IPL file
9078!:mime	application/x-mif
9079
9080#------------------------------------------------------------------------------
9081# $File$
9082# freebsd:  file(1) magic for FreeBSD objects
9083#
9084# All new-style FreeBSD magic numbers are in host byte order (i.e.,
9085# little-endian on x86).
9086#
9087# XXX - this comes from the file "freebsd" in a recent FreeBSD version of
9088# "file"; it, and the NetBSD stuff in "netbsd", appear to use different
9089# schemes for distinguishing between executable images, shared libraries,
9090# and object files.
9091#
9092# FreeBSD says:
9093#
9094#    Regardless of whether it's pure, demand-paged, or none of the
9095#    above:
9096#
9097#	if the entry point is < 4096, then it's a shared library if
9098#	the "has run-time loader information" bit is set, and is
9099#	position-independent if the "is position-independent" bit
9100#	is set;
9101#
9102#	if the entry point is >= 4096 (or >4095, same thing), then it's
9103#	an executable, and is dynamically-linked if the "has run-time
9104#	loader information" bit is set.
9105#
9106# On x86, NetBSD says:
9107#
9108#    If it's neither pure nor demand-paged:
9109#
9110#	if it has the "has run-time loader information" bit set, it's
9111#	a dynamically-linked executable;
9112#
9113#	if it doesn't have that bit set, then:
9114#
9115#	    if it has the "is position-independent" bit set, it's
9116#	    position-independent;
9117#
9118#	    if the entry point is non-zero, it's an executable, otherwise
9119#	    it's an object file.
9120#
9121#    If it's pure:
9122#
9123#	if it has the "has run-time loader information" bit set, it's
9124#	a dynamically-linked executable, otherwise it's just an
9125#	executable.
9126#
9127#    If it's demand-paged:
9128#
9129#	if it has the "has run-time loader information" bit set,
9130#	then:
9131#
9132#	    if the entry point is < 4096, it's a shared library;
9133#
9134#	    if the entry point is = 4096 or > 4096 (i.e., >= 4096),
9135#	    it's a dynamically-linked executable);
9136#
9137#	if it doesn't have the "has run-time loader information" bit
9138#	set, then it's just an executable.
9139#
9140# (On non-x86, NetBSD does much the same thing, except that it uses
9141# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
9142# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
9143# had 8K pages; dunno about MIPS.)
9144#
9145# I suspect the two will differ only in perverse and uninteresting cases
9146# ("shared" libraries that aren't demand-paged and whose pages probably
9147# won't actually be shared, executables with entry points <4096).
9148#
9149# I leave it to those more familiar with FreeBSD and NetBSD to figure out
9150# what the right answer is (although using ">4095", FreeBSD-style, is
9151# probably better than separately checking for "=4096" and ">4096",
9152# NetBSD-style).  (The old "netbsd" file analyzed FreeBSD demand paged
9153# executables using the NetBSD technique.)
9154#
91550	lelong&0377777777	041400407	FreeBSD/i386
9156>20	lelong			<4096
9157>>3	byte&0xC0		&0x80		shared library
9158>>3	byte&0xC0		0x40		PIC object
9159>>3	byte&0xC0		0x00		object
9160>20	lelong			>4095
9161>>3	byte&0x80		0x80		dynamically linked executable
9162>>3	byte&0x80		0x00		executable
9163>16	lelong			>0		not stripped
9164
91650	lelong&0377777777	041400410	FreeBSD/i386 pure
9166>20	lelong			<4096
9167>>3	byte&0xC0		&0x80		shared library
9168>>3	byte&0xC0		0x40		PIC object
9169>>3	byte&0xC0		0x00		object
9170>20	lelong			>4095
9171>>3	byte&0x80		0x80		dynamically linked executable
9172>>3	byte&0x80		0x00		executable
9173>16	lelong			>0		not stripped
9174
91750	lelong&0377777777	041400413	FreeBSD/i386 demand paged
9176>20	lelong			<4096
9177>>3	byte&0xC0		&0x80		shared library
9178>>3	byte&0xC0		0x40		PIC object
9179>>3	byte&0xC0		0x00		object
9180>20	lelong			>4095
9181>>3	byte&0x80		0x80		dynamically linked executable
9182>>3	byte&0x80		0x00		executable
9183>16	lelong			>0		not stripped
9184
91850	lelong&0377777777	041400314	FreeBSD/i386 compact demand paged
9186>20	lelong			<4096
9187>>3	byte&0xC0		&0x80		shared library
9188>>3	byte&0xC0		0x40		PIC object
9189>>3	byte&0xC0		0x00		object
9190>20	lelong			>4095
9191>>3	byte&0x80		0x80		dynamically linked executable
9192>>3	byte&0x80		0x00		executable
9193>16	lelong			>0		not stripped
9194
9195# XXX gross hack to identify core files
9196# cores start with a struct tss; we take advantage of the following:
9197# byte 7:     highest byte of the kernel stack pointer, always 0xfe
9198#      8/9:   kernel (ring 0) ss value, always 0x0010
9199#      10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
9200#      28:    low order byte of the current PTD entry, always 0 since the
9201#             PTD is page-aligned
9202#
92037	string	\357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	FreeBSD/i386 a.out core file
9204>1039	string	>\0	from '%s'
9205
9206# /var/run/ld.so.hints
9207# What are you laughing about?
92080	lelong			011421044151	ld.so hints file (Little Endian
9209>4	lelong			>0		\b, version %d)
9210>4	belong			<1		\b)
92110	belong			011421044151	ld.so hints file (Big Endian
9212>4	belong			>0		\b, version %d)
9213>4	belong			<1		\b)
9214
9215#
9216# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
9217#
92180	string	SCRSHOT_	scrshot(1) screenshot,
9219>8	byte	x		version %d,
9220>9	byte	2		%d bytes in header,
9221>>10	byte	x		%d chars wide by
9222>>11	byte	x		%d chars high
9223
9224#------------------------------------------------------------------------------
9225# $File: fsav,v 1.12 2013/03/23 14:15:30 christos Exp $
9226# fsav:  file(1) magic for datafellows fsav virus definition files
9227# Anthon van der Neut (anthon@mnt.org)
9228
9229# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def}
92300	beshort		0x1575		fsav macro virus signatures
9231>8	leshort		>0		(%d-
9232>11	byte		>0		\b%02d-
9233>10	byte		>0		\b%02d)
9234# ftp://ftp.f-prot.com/pub/sign.zip
9235#10	ubyte		<12
9236#>9	ubyte		<32
9237#>>8	ubyte		0x0a
9238#>>>12	ubyte		0x07
9239#>>>>11	uleshort	>0		fsav DOS/Windows virus signatures (%d-
9240#>>>>10	byte		0		\b01-
9241#>>>>10	byte		1		\b02-
9242#>>>>10	byte		2		\b03-
9243#>>>>10	byte		3		\b04-
9244#>>>>10	byte		4		\b05-
9245#>>>>10	byte		5		\b06-
9246#>>>>10	byte		6		\b07-
9247#>>>>10	byte		7		\b08-
9248#>>>>10	byte		8		\b09-
9249#>>>>10	byte		9		\b10-
9250#>>>>10	byte		10		\b11-
9251#>>>>10	byte		11		\b12-
9252#>>>>9	ubyte		>0		\b%02d)
9253# ftp://ftp.f-prot.com/pub/sign2.zip
9254#0	ubyte		0x62
9255#>1	ubyte		0xF5
9256#>>2	ubyte		0x1
9257#>>>3	ubyte		0x1
9258#>>>>4	ubyte		0x0e
9259#>>>>>13		ubyte	>0		fsav virus signatures
9260#>>>>>>11	ubyte	x		size 0x%02x
9261#>>>>>>12	ubyte	x		\b%02x
9262#>>>>>>13	ubyte	x		\b%02x bytes
9263
9264# Joerg Jenderek: joerg dot jenderek at web dot de
9265# http://www.clamav.net/doc/latest/html/node45.html
9266# .cvd files start with a 512 bytes colon separated header
9267# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
9268# + gzipped tarball files
92690	string		ClamAV-VDB:
9270>11	string		>\0		Clam AntiVirus database %-.23s
9271>>34	string		:
9272>>>35		string		!:	\b, version
9273>>>>35		string		x 	\b%-.1s
9274>>>>>36		string 		!:
9275>>>>>>36	string		x 	\b%-.1s
9276>>>>>>>37	string		!:
9277>>>>>>>>37	string		x 	\b%-.1s
9278>>>>>>>>>38	string		!:
9279>>>>>>>>>>38	string		x 	\b%-.1s
9280>512	string		\037\213	\b, gzipped
9281>769	string		ustar\0		\b, tarred
9282
9283# Type: Grisoft AVG AntiVirus
9284# From: David Newgas <david@newgas.net>
92850	string	AVG7_ANTIVIRUS_VAULT_FILE	AVG 7 Antivirus vault file data
9286
92870	string	X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR
9288>33	string	-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*	EICAR virus test files
9289
9290#------------------------------------------------------------------------------
9291# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $
9292# fusecompress:   file(1) magic for fusecompress
92930	string	\037\135\211	FuseCompress(ed) data
9294>3	byte	0x00	(none format)
9295>3	byte	0x01	(bz2 format)
9296>3	byte	0x02	(gz format)
9297>3	byte	0x03	(lzo format)
9298>3	byte	0x04	(xor format)
9299>3	byte	>0x04	(unknown format)
9300>4	long	x	uncompressed size: %d
9301
9302#------------------------------------------------------------------------------
9303# $File: games,v 1.13 2012/02/13 22:50:50 christos Exp $
9304# games:  file(1) for games
9305
9306# Fabio Bonelli <fabiobonelli@libero.it>
9307# Quake II - III data files
93080       string  IDP2        	Quake II 3D Model file,
9309>20     long    x               %u skin(s),
9310>8      long    x               (%u x
9311>12     long    x 		%u),
9312>40     long    x               %u frame(s),
9313>16     long    x               Frame size %u bytes,
9314>24     long  	x               %u vertices/frame,
9315>28     long    x            	%u texture coordinates,
9316>32     long    x               %u triangles/frame
9317
93180       string  IBSP            Quake
9319>4      long    0x26            II Map file (BSP)
9320>4      long    0x2E      	III Map file (BSP)
9321
93220       string  IDS2            Quake II SP2 sprite file
9323
9324#---------------------------------------------------------------------------
9325# Doom and Quake
9326# submitted by Nicolas Patrois
9327
93280       string  \xcb\x1dBoom\xe6\xff\x03\x01    Boom or linuxdoom demo
9329# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01
9330
933124      string  LxD\ 203        Linuxdoom save
9332>0      string  x       , name=%s
9333>44     string  x       , world=%s
9334
9335# Quake
9336
93370       string  PACK    Quake I or II world or extension
9338>8	lelong	>0	\b, %d entries
9339
9340#0       string  -1\x0a  Quake I demo
9341#>30     string  x        version %.4s
9342#>61     string  x        level %s
9343
9344#0       string  5\x0a   Quake I save
9345
9346# The levels
9347
9348# Quake 1
9349
93500	string	5\x0aIntroduction             Quake I save: start Introduction
93510	string	5\x0athe_Slipgate_Complex     Quake I save: e1m1 The slipgate complex
93520	string	5\x0aCastle_of_the_Damned     Quake I save: e1m2 Castle of the damned
93530	string	5\x0athe_Necropolis           Quake I save: e1m3 The necropolis
93540	string	5\x0athe_Grisly_Grotto        Quake I save: e1m4 The grisly grotto
93550	string	5\x0aZiggurat_Vertigo         Quake I save: e1m8 Ziggurat vertigo (secret)
93560	string	5\x0aGloom_Keep               Quake I save: e1m5 Gloom keep
93570	string	5\x0aThe_Door_To_Chthon       Quake I save: e1m6 The door to Chthon
93580	string	5\x0aThe_House_of_Chthon      Quake I save: e1m7 The house of Chthon
93590	string	5\x0athe_Installation         Quake I save: e2m1 The installation
93600	string	5\x0athe_Ogre_Citadel         Quake I save: e2m2 The ogre citadel
93610	string	5\x0athe_Crypt_of_Decay       Quake I save: e2m3 The crypt of decay (dopefish lives!)
93620	string	5\x0aUnderearth               Quake I save: e2m7 Underearth (secret)
93630	string	5\x0athe_Ebon_Fortress        Quake I save: e2m4 The ebon fortress
93640	string	5\x0athe_Wizard's_Manse       Quake I save: e2m5 The wizard's manse
93650	string	5\x0athe_Dismal_Oubliette     Quake I save: e2m6 The dismal oubliette
93660	string	5\x0aTermination_Central      Quake I save: e3m1 Termination central
93670	string	5\x0aVaults_of_Zin            Quake I save: e3m2 Vaults of Zin
93680	string	5\x0athe_Tomb_of_Terror       Quake I save: e3m3 The tomb of terror
93690	string	5\x0aSatan's_Dark_Delight     Quake I save: e3m4 Satan's dark delight
93700	string	5\x0athe_Haunted_Halls        Quake I save: e3m7 The haunted halls (secret)
93710	string	5\x0aWind_Tunnels             Quake I save: e3m5 Wind tunnels
93720	string	5\x0aChambers_of_Torment      Quake I save: e3m6 Chambers of torment
93730	string	5\x0athe_Sewage_System        Quake I save: e4m1 The sewage system
93740	string	5\x0aThe_Tower_of_Despair     Quake I save: e4m2 The tower of despair
93750	string	5\x0aThe_Elder_God_Shrine     Quake I save: e4m3 The elder god shrine
93760	string	5\x0athe_Palace_of_Hate       Quake I save: e4m4 The palace of hate
93770	string	5\x0aHell's_Atrium            Quake I save: e4m5 Hell's atrium
93780	string	5\x0athe_Nameless_City        Quake I save: e4m8 The nameless city (secret)
93790	string	5\x0aThe_Pain_Maze            Quake I save: e4m6 The pain maze
93800	string	5\x0aAzure_Agony              Quake I save: e4m7 Azure agony
93810	string	5\x0aShub-Niggurath's_Pit     Quake I save: end Shub-Niggurath's pit
9382
9383# Quake DeathMatch levels
9384
93850	string	5\x0aPlace_of_Two_Deaths	 Quake I save: dm1 Place of two deaths
93860	string	5\x0aClaustrophobopolis		 Quake I save: dm2 Claustrophobopolis
93870	string	5\x0aThe_Abandoned_Base		 Quake I save: dm3 The abandoned base
93880	string	5\x0aThe_Bad_Place		 Quake I save: dm4 The bad place
93890	string	5\x0aThe_Cistern		 Quake I save: dm5 The cistern
93900	string	5\x0aThe_Dark_Zone		 Quake I save: dm6 The dark zone
9391
9392# Scourge of Armagon
9393
93940	string	5\x0aCommand_HQ               Quake I save: start Command HQ
93950	string	5\x0aThe_Pumping_Station      Quake I save: hip1m1 The pumping station
93960	string	5\x0aStorage_Facility         Quake I save: hip1m2 Storage facility
93970	string	5\x0aMilitary_Complex         Quake I save: hip1m5 Military complex (secret)
93980	string	5\x0athe_Lost_Mine            Quake I save: hip1m3 The lost mine
93990	string	5\x0aResearch_Facility        Quake I save: hip1m4 Research facility
94000	string	5\x0aAncient_Realms           Quake I save: hip2m1 Ancient realms
94010	string	5\x0aThe_Gremlin's_Domain     Quake I save: hip2m6 The gremlin's domain (secret)
94020	string	5\x0aThe_Black_Cathedral      Quake I save: hip2m2 The black cathedral
94030	string	5\x0aThe_Catacombs            Quake I save: hip2m3 The catacombs
94040	string	5\x0athe_Crypt__              Quake I save: hip2m4 The crypt
94050	string	5\x0aMortum's_Keep            Quake I save: hip2m5 Mortum's keep
94060	string	5\x0aTur_Torment              Quake I save: hip3m1 Tur torment
94070	string	5\x0aPandemonium              Quake I save: hip3m2 Pandemonium
94080	string	5\x0aLimbo                    Quake I save: hip3m3 Limbo
94090	string	5\x0athe_Edge_of_Oblivion     Quake I save: hipdm1 The edge of oblivion (secret)
94100	string	5\x0aThe_Gauntlet             Quake I save: hip3m4 The gauntlet
94110	string	5\x0aArmagon's_Lair           Quake I save: hipend Armagon's lair
9412
9413# Malice
9414
94150	string	5\x0aThe_Academy      Quake I save: start The academy
94160	string	5\x0aThe_Lab          Quake I save: d1 The lab
94170	string	5\x0aArea_33          Quake I save: d1b Area 33
94180	string	5\x0aSECRET_MISSIONS  Quake I save: d3b Secret missions
94190	string	5\x0aThe_Hospital     Quake I save: d10 The hospital (secret)
94200	string	5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)
94210	string	5\x0aBACK_2_MALICE    Quake I save: d4b Back to Malice
94220	string	5\x0aArea44           Quake I save: d1c Area 44
94230	string	5\x0aTakahiro_Towers  Quake I save: d2 Takahiro towers
94240	string	5\x0aA_Rat's_Life     Quake I save: d3 A rat's life
94250	string	5\x0aInto_The_Flood   Quake I save: d4 Into the flood
94260	string	5\x0aThe_Flood        Quake I save: d5 The flood
94270	string	5\x0aNuclear_Plant    Quake I save: d6 Nuclear plant
94280	string	5\x0aThe_Incinerator_Plant    Quake I save: d7 The incinerator plant
94290	string	5\x0aThe_Foundry              Quake I save: d7b The foundry
94300	string	5\x0aThe_Underwater_Base      Quake I save: d8 The underwater base
94310	string	5\x0aTakahiro_Base            Quake I save: d9 Takahiro base
94320	string	5\x0aTakahiro_Laboratories    Quake I save: d12 Takahiro laboratories
94330	string	5\x0aStayin'_Alive    Quake I save: d13 Stayin' alive
94340	string	5\x0aB.O.S.S._HQ      Quake I save: d14 B.O.S.S. HQ
94350	string	5\x0aSHOWDOWN!        Quake I save: d15 Showdown!
9436
9437# Malice DeathMatch levels
9438
94390	string	5\x0aThe_Seventh_Precinct	 Quake I save: ddm1 The seventh precinct
94400	string	5\x0aSub_Station		 Quake I save: ddm2 Sub station
94410	string	5\x0aCrazy_Eights!		 Quake I save: ddm3 Crazy eights!
94420	string	5\x0aEast_Side_Invertationa	 Quake I save: ddm4 East side invertationa
94430	string	5\x0aSlaughterhouse		 Quake I save: ddm5 Slaughterhouse
94440	string	5\x0aDOMINO			 Quake I save: ddm6 Domino
94450	string	5\x0aSANDRA'S_LADDER		 Quake I save: ddm7 Sandra's ladder
9446
9447
94480	string	MComprHD	MAME CHD compressed hard disk image,
9449>12	belong	x		version %u
9450
9451# doom - submitted by Jon Dowland
9452
94530	string	=IWAD		doom main IWAD data
9454>4	lelong	x		containing %d lumps
94550	string	=PWAD		doom patch PWAD data
9456>4	lelong	x		containing %d lumps
9457
9458# Build engine group files (Duke Nukem, Shadow Warrior, ...)
9459# Extension: .grp
9460# Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org>
94610	string	KenSilverman	Build engine group file
9462>12	lelong	x		containing %d files
9463
9464# Summary: Warcraft 3 save
9465# Extension: .w3g
9466# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
94670	string		Warcraft\ III\ recorded\ game	%s
9468
9469
9470# Summary: Warcraft 3 map
9471# Extension: .w3m
9472# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
94730	string		HM3W		Warcraft III map file
9474
9475
9476# Summary: SGF Smart Game Format
9477# Extension: .sgf
9478# Reference: http://www.red-bean.com/sgf/
9479# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
9480# Modified by (1): Abel Cheung (regex, more game format)
9481# FIXME: Some games don't have GM (game type)
94820	regex		\\(;.*GM\\[[0-9]{1,2}\\]	Smart Game Format
9483>2	search/0x200/b	GM[
9484>>&0	string		1]	(Go)
9485>>&0	string		2]	(Othello)
9486>>&0	string		3]	(chess)
9487>>&0	string		4]	(Gomoku+Renju)
9488>>&0	string		5]	(Nine Men's Morris)
9489>>&0	string		6]	(Backgammon)
9490>>&0	string		7]	(Chinese chess)
9491>>&0	string		8]	(Shogi)
9492>>&0	string		9]	(Lines of Action)
9493>>&0	string		10]	(Ataxx)
9494>>&0	string		11]	(Hex)
9495>>&0	string		12]	(Jungle)
9496>>&0	string		13]	(Neutron)
9497>>&0	string		14]	(Philosopher's Football)
9498>>&0	string		15]	(Quadrature)
9499>>&0	string		16]	(Trax)
9500>>&0	string		17]	(Tantrix)
9501>>&0	string		18]	(Amazons)
9502>>&0	string		19]	(Octi)
9503>>&0	string		20]	(Gess)
9504>>&0	string		21]	(Twixt)
9505>>&0	string		22]	(Zertz)
9506>>&0	string		23]	(Plateau)
9507>>&0	string		24]	(Yinsh)
9508>>&0	string		25]	(Punct)
9509>>&0	string		26]	(Gobblet)
9510>>&0	string		27]	(hive)
9511>>&0	string		28]	(Exxit)
9512>>&0	string		29]	(Hnefatal)
9513>>&0	string		30]	(Kuba)
9514>>&0	string		31]	(Tripples)
9515>>&0	string		32]	(Chase)
9516>>&0	string		33]	(Tumbling Down)
9517>>&0	string		34]	(Sahara)
9518>>&0	string		35]	(Byte)
9519>>&0	string		36]	(Focus)
9520>>&0	string		37]	(Dvonn)
9521>>&0	string		38]	(Tamsk)
9522>>&0	string		39]	(Gipf)
9523>>&0	string		40]	(Kropki)
9524
9525##############################################
9526# NetImmerse/Gamebryo game engine entries
9527
9528# Summary: Gamebryo game engine file
9529# Extension: .nif, .kf
9530# Created by: Abel Cheung <abelcheung@gmail.com>
95310		string		Gamebryo\ File\ Format,\ Version\ 	Gamebryo game engine file
9532>&0		regex		[0-9a-z.]+				\b, version %s
9533
9534# Summary: Gamebryo game engine file
9535# Extension: .kfm
9536# Created by: Abel Cheung <abelcheung@gmail.com>
95370		string		;Gamebryo\ KFM\ File\ Version\ 		Gamebryo game engine animation File
9538>&0		regex		[0-9a-z.]+				\b, version %s
9539
9540# Summary: NetImmerse game engine file
9541# Extension .nif
9542# Created by: Abel Cheung <abelcheung@gmail.com>
95430		string		NetImmerse\ File\ Format,\ Versio
9544>&0		string		n\ 					NetImmerse game engine file
9545>>&0		regex		[0-9a-z.]+				\b, version %s
9546
9547# Type:	SGF Smart Game Format
9548# URL:	http://www.red-bean.com/sgf/
9549# From:	Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
95502	regex/c	\\(;.*GM\\[[0-9]{1,2}\\]	Smart Game Format
9551>2	regex/c	GM\\[1\\]			- Go Game
9552>2	regex/c	GM\\[6\\]			- BackGammon Game
9553>2	regex/c	GM\\[11\\]			- Hex Game
9554>2	regex/c	GM\\[18\\]			- Amazons Game
9555>2	regex/c	GM\\[19\\]			- Octi Game
9556>2	regex/c	GM\\[20\\]			- Gess Game
9557>2	regex/c	GM\\[21\\]			- twix Game
9558
9559# Epic Games/Unreal Engine Package
9560#
95610	lelong		0x9E2A83C1	Unreal Engine Package,
9562>4	leshort		x		version: %i
9563>12	lelong		!0		\b, names: %i
9564>28	lelong		!0		\b, imports: %i
9565>20	lelong		!0		\b, exports: %i
9566
9567#------------------------------------------------------------------------------
9568# $File$
9569# gcc:  file(1) magic for GCC special files
9570#
95710	string		gpch		GCC precompiled header
9572
9573# The version field is annoying.  It's 3 characters, not zero-terminated.
9574>5	byte		x			(version %c
9575>6	byte		x			\b%c
9576>7	byte		x			\b%c)
9577
9578# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'
9579>4	byte		67			for C
9580>4	byte		111			for Objective C
9581>4	byte		43			for C++
9582>4	byte		79			for Objective C++
9583
9584#------------------------------------------------------------------------------
9585# $File: geo,v 1.2 2013/01/02 15:27:53 christos Exp $
9586# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu>
9587
9588######################################################################
9589#
9590# Acoustic Doppler Current Profilers (ADCP)
9591#
9592######################################################################
9593
95940	beshort	0x7f7f	RDI Acoustic Doppler Current Profiler (ADCP)
9595
9596######################################################################
9597#
9598# Metadata
9599#
9600######################################################################
9601
96020	string	Identification_Information	FGDC ASCII metadata
9603
9604######################################################################
9605#
9606# Seimsic / Subbottom
9607#
9608######################################################################
9609
9610# Knudsen subbottom chirp profiler - Binary File Format: B9
9611# KEB D409-03167 V1.75 Huffman
96120	string	KEB\ 	Knudsen seismic KEL binary (KEB) -
9613>4	regex	[-A-Z0-9]*	Software: %s
9614>>&1	regex	V[0-9]*\.[0-9]*	version %s
9615
9616######################################################################
9617#
9618# LIDAR - Laser altimetry or bathy
9619#
9620######################################################################
9621
9622
9623# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data
96240	string	HCA	LADS Caris Ascii Format (CAF) bathymetric lidar
9625>4	regex [0-9]*\.[0-9]*	version %s
9626
96270	string	HCB	LADS Caris Binary Format (CBF) bathymetric lidar waveform data
9628>3      byte    x	version %d .
9629>4	byte	x	%d
9630
9631
9632######################################################################
9633#
9634# MULTIBEAM SONARS http://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/
9635#
9636######################################################################
9637
9638# GeoAcoustics - GeoSwath Plus
96394	beshort	0x2002	GeoSwath RDF
96400	string	Start:-	GeoSwatch auf text file
9641
9642# Seabeam 2100
9643# mbsystem code mb41
96440	string SB2100	SeaBeam 2100 multibeam sonar
96450	string SB2100DR	SeaBeam 2100 DR multibeam sonar
96460	string SB2100PR SeaBeam 2100 PR multibeam sonar
9647
9648# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor
9649# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR.
96500    string $HSF    XSE multibeam
9651
9652# mb121 http://www.saic.com/maritime/gsf/
96538	string	GSF-v	SAIC generic sensor format (GSF) sonar data,
9654>&0	regex [0-9]*\.[0-9]*	version %s
9655
9656# MGD77 - http://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm
9657# mb161
96589	string MGD77	MGD77 Header, Marine Geophysical Data Exchange Format
9659
9660# MBSystem processing caches the mbinfo output
96611	string	Swath\ Data\ File:	mbsystem info cache
9662
9663# Caris John Hughes Clark format
96640	string	HDCS	Caris multibeam sonar related data
96651	string	Start/Stop\ parameter\ header:	Caris ASCII project summary
9666
9667######################################################################
9668#
9669# Visualization and 3D modeling
9670#
9671######################################################################
9672
9673# IVS - IVS3d.com Tagged Data Represetation
96740	string	%%\ TDR\ 2.0	IVS Fledermaus TDR file
9675
9676# http://www.ecma-international.org/publications/standards/Ecma-363.htm
9677# 3D in PDFs
96780	string	U3D	ECMA-363, Universal 3D
9679
9680######################################################################
9681#
9682# Support files
9683#
9684######################################################################
9685
9686# https://midas.psi.ch/elog/
96870	string	$@MID@$	elog journal entry
9688
9689# Geospatial Designs http://www.geospatialdesigns.com/surfer6_format.htm
96900	string		DSBB	Surfer 6 binary grid file
9691>4	leshort		x	\b, %d
9692>6	leshort		x	\bx%d
9693>8	ledouble	x	\b, minx=%g
9694>16	ledouble	x	\b, maxx=%g
9695>24	ledouble	x	\b, miny=%g
9696>32	ledouble	x	\b, maxy=%g
9697>40	ledouble	x	\b, minz=%g
9698>48	ledouble	x	\b, maxz=%g
9699
9700
9701#------------------------------------------------------------------------------
9702# $File$
9703# GEOS files (Vidar Madsen, vidar@gimp.org)
9704# semi-commonly used in embedded and handheld systems.
97050	belong	0xc745c153	GEOS
9706>40	byte	1	executable
9707>40	byte	2	VMFile
9708>40	byte	3	binary
9709>40	byte	4	directory label
9710>40	byte	<1	unknown
9711>40	byte	>4	unknown
9712>4	string	>\0	\b, name "%s"
9713#>44	short	x	\b, version %d
9714#>46	short	x	\b.%d
9715#>48	short	x	\b, rev %d
9716#>50	short	x	\b.%d
9717#>52	short	x	\b, proto %d
9718#>54	short	x	\br%d
9719#>168	string	>\0	\b, copyright "%s"
9720
9721#------------------------------------------------------------------------------
9722# $File: gimp,v 1.8 2013/12/21 14:29:45 christos Exp $
9723# GIMP Gradient: file(1) magic for the GIMP's gradient data files (.ggr)
9724# by Federico Mena <federico@nuclecu.unam.mx>
9725
97260       string/t        GIMP\ Gradient  GIMP gradient data
9727
9728# GIMP palette (.gpl)
9729# From: Markus Heidelberg <markus.heidelberg@web.de>
97300       string/t        GIMP\ Palette   GIMP palette data
9731
9732#------------------------------------------------------------------------------
9733# XCF:  file(1) magic for the XCF image format used in the GIMP (.xcf) developed
9734#       by Spencer Kimball and Peter Mattis
9735#       ('Bucky' LaDieu, nega@vt.edu)
9736
97370	string		gimp\ xcf	GIMP XCF image data,
9738!:mime	image/x-xcf
9739>9	string		file		version 0,
9740>9	string		v		version
9741>>10	string		>\0		%s,
9742>14	belong		x		%u x
9743>18	belong		x		%u,
9744>22     belong          0               RGB Color
9745>22     belong          1               Greyscale
9746>22     belong          2               Indexed Color
9747>22	belong		>2		Unknown Image Type.
9748
9749#------------------------------------------------------------------------------
9750# XCF:  file(1) magic for the patterns used in the GIMP (.pat), developed
9751#       by Spencer Kimball and Peter Mattis
9752#       ('Bucky' LaDieu, nega@vt.edu)
9753
975420      string          GPAT            GIMP pattern data,
9755>24     string          x               %s
9756
9757#------------------------------------------------------------------------------
9758# XCF:  file(1) magic for the brushes used in the GIMP (.gbr), developed
9759#       by Spencer Kimball and Peter Mattis
9760#       ('Bucky' LaDieu, nega@vt.edu)
9761
976220      string          GIMP            GIMP brush data
9763
9764# GIMP Curves File
9765# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
97660	string	#\040GIMP\040Curves\040File	GIMP curve file
9767
9768#------------------------------------------------------------------------------
9769# $File: gnome,v 1.4 2014/04/28 12:04:50 christos Exp $
9770# GNOME related files
9771
9772# Contributed by Josh Triplett
9773# FIXME: Could be simplified if pstring supported two-byte counts
97740         string   GnomeKeyring\n\r\0\n GNOME keyring
9775>&0       ubyte    0                    \b, major version 0
9776>>&0      ubyte    0                    \b, minor version 0
9777>>>&0     ubyte    0                    \b, crypto type 0 (AES)
9778>>>&0     ubyte    >0                   \b, crypto type %u (unknown)
9779>>>&1     ubyte    0                    \b, hash type 0 (MD5)
9780>>>&1     ubyte    >0                   \b, hash type %u (unknown)
9781>>>&2     ubelong  0xFFFFFFFF           \b, name NULL
9782>>>&2     ubelong  !0xFFFFFFFF
9783>>>>&-4   ubelong  >255                 \b, name too long for file's pstring type
9784>>>>&-4   ubelong  <256
9785>>>>>&-1  pstring  x                    \b, name "%s"
9786>>>>>>&0  ubeqdate x                    \b, last modified %s
9787>>>>>>&8  ubeqdate x                    \b, created %s
9788>>>>>>&16 ubelong  &1
9789>>>>>>>&0 ubelong  x                    \b, locked if idle for %u seconds
9790>>>>>>&16 ubelong  ^1                   \b, not locked if idle
9791>>>>>>&24 ubelong  x                    \b, hash iterations %u
9792>>>>>>&28 ubequad  x                    \b, salt %llu
9793>>>>>>&52 ubelong  x                    \b, %u item(s)
9794
9795# From: Alex Beregszaszi <alex@fsn.hu>
97964	string	gtktalog		GNOME Catalogue (gtktalog)
9797>13	string	>\0			version %s
9798
9799# Summary: GStreamer binary registry
9800# Extension: .bin
9801# Submitted by: Josh Triplett <josh@joshtriplett.org>
98020	belong	0xc0def00d		GStreamer binary registry
9803>4	string	x			\b, version %s
9804
9805# GVariant Database file
9806# By Elan Ruusamae <glen@delfi.ee>
9807# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h
9808# It's always "GVariant", it's byte swapped on incompatible archs
9809# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c
9810# file_builder_serialise()
9811# http://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant
98120	string	GVariant	GVariant Database file,
9813# version is never filled. probably future extension
9814>8	lelong	x		version %d
9815# not sure are these usable, so commented out
9816#>>16	lelong	x		start %d,
9817#>>>20	lelong	x		end %d
9818
9819# G-IR database made by gobject-introspect toolset,
9820# http://live.gnome.org/GObjectIntrospection
98210	string		GOBJ\nMETADATA\r\n\032	G-IR binary database
9822>16	byte		x			\b, v%d
9823>17	byte		x			\b.%d
9824>20	leshort		x			\b, %d entries
9825>22	leshort		x			\b/%d local
9826
9827#------------------------------------------------------------------------------
9828# $File: gnu,v 1.14 2012/10/03 23:38:12 christos Exp $
9829# gnu:  file(1) magic for various GNU tools
9830#
9831# GNU nlsutils message catalog file format
9832#
9833# GNU message catalog (.mo and .gmo files)
9834
98350	string		\336\22\4\225	GNU message catalog (little endian),
9836>6	leshort		x		revision %d.
9837>4	leshort		>0		\b%d,
9838>>8	lelong		x		%d messages,
9839>>36	lelong		x		%d sysdep messages
9840>4	leshort		=0		\b%d,
9841>>8	lelong		x		%d messages
9842
98430	string		\225\4\22\336	GNU message catalog (big endian),
9844>4	beshort		x		revision %d.
9845>6	beshort		>0		\b%d,
9846>>8	belong		x		%d messages,
9847>>36	belong		x		%d sysdep messages
9848>6	beshort		=0		\b%d,
9849>>8	belong		x		%d messages
9850
9851
9852# GnuPG
9853# The format is very similar to pgp
98540	string          \001gpg                 GPG key trust database
9855>4	byte            x                       version %d
9856# Note: magic.mime had 0x8501 for the next line instead of 0x8502
98570	beshort		0x8502			GPG encrypted data
9858!:mime	text/PGP # encoding: data
9859
9860# This magic is not particularly good, as the keyrings don't have true
9861# magic. Nevertheless, it covers many keyrings.
98620       beshort         0x9901                  GPG key public ring
9863!:mime	application/x-gnupg-keyring
9864
9865# Symmetric encryption
98660	leshort		0x0d8c
9867>4	leshort		0x0203
9868>>2	leshort		0x0204		GPG symmetrically encrypted data (3DES cipher)
9869>>2	leshort		0x0304		GPG symmetrically encrypted data (CAST5 cipher)
9870>>2	leshort		0x0404		GPG symmetrically encrypted data (BLOWFISH cipher)
9871>>2	leshort		0x0704		GPG symmetrically encrypted data (AES cipher)
9872>>2	leshort		0x0804		GPG symmetrically encrypted data (AES192 cipher)
9873>>2	leshort		0x0904		GPG symmetrically encrypted data (AES256 cipher)
9874>>2	leshort		0x0a04		GPG symmetrically encrypted data (TWOFISH cipher)
9875>>2	leshort		0x0b04		GPG symmetrically encrypted data (CAMELLIA128 cipher)
9876>>2	leshort		0x0c04		GPG symmetrically encrypted data (CAMELLIA192 cipher)
9877>>2	leshort		0x0d04		GPG symmetrically encrypted data (CAMELLIA256 cipher)
9878
9879
9880# GnuPG Keybox file
9881# <http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD>
9882# From: Philipp Hahn <hahn@univention.de>
98830	belong	32
9884>4	byte	1
9885>>8	string	KBXf	GPG keybox database
9886>>>5	byte	1	version %d
9887>>>16	bedate	x	\b, created-at %s
9888>>>20	bedate	x	\b, last-maintained %s
9889
9890
9891# Gnumeric spreadsheet
9892# This entry is only semi-helpful, as Gnumeric compresses its files, so
9893# they will ordinarily reported as "compressed", but at least -z helps
989439      string          =<gmr:Workbook           Gnumeric spreadsheet
9895
9896# From: James Youngman <jay@gnu.org>
9897# gnu find magic
98980	string	\0LOCATE	GNU findutils locate database data
9899>7	string	>\0		\b, format %s
9900>7	string	02		\b (frcode)
9901
9902# Files produced by GNU gettext
99030	long	0xDE120495		GNU-format message catalog data
99040	long	0x950412DE		GNU-format message catalog data
9905
9906# gettext message catalogue
99070	regex	\^msgid\ 		GNU gettext message catalogue text
9908!:mime text/x-po
9909
9910#------------------------------------------------------------------------------
9911# $File$
9912# gnumeric:  file(1) magic for Gnumeric spreadsheet
9913# This entry is only semi-helpful, as Gnumeric compresses its files, so
9914# they will ordinarily reported as "compressed", but at least -z helps
991539	string	=<gmr:Workbook	Gnumeric spreadsheet
9916!:mime	application/x-gnumeric
9917
9918#------------------------------------------------------------------------------
9919# $File: gpt,v 1.2 2014/04/28 12:04:50 christos Exp $
9920#
9921# GPT Partition table patterns.
9922# Author: Rogier Goossens (goossens.rogier@gmail.com)
9923# Note that a GPT-formatted disk must contain an MBR as well.
9924#
9925
9926# The initial segment (up to >>>>>>>>422) was copied from the X86
9927# partition table code (aka MBR).
9928# This is kept separate, so that MBR partitions are not reported as well.
9929# (use -k if you do want them as well)
9930
9931# First, detect the MBR partiton table
9932# If more than one GPT protective MBR partition exists, don't print anything
9933# (the other MBR detection code will then just print the MBR partition table)
99340x1FE			leshort		0xAA55
9935>3			string		!MS
9936>>3			string		!SYSLINUX
9937>>>3			string		!MTOOL
9938>>>>3			string		!NEWLDR
9939>>>>>5			string		!DOS
9940# not FAT (32 bit)
9941>>>>>>82		string		!FAT32
9942#not Linux kernel
9943>>>>>>>514		string		!HdrS
9944#not BeOS
9945>>>>>>>>422		string		!Be\ Boot\ Loader
9946# GPT with protective MBR entry in partition 1 (only)
9947>>>>>>>>>450		ubyte		0xee
9948>>>>>>>>>>466		ubyte		!0xee
9949>>>>>>>>>>>482		ubyte		!0xee
9950>>>>>>>>>>>>498		ubyte		!0xee
9951#>>>>>>>>>>>>>446	use		gpt-mbr-partition
9952>>>>>>>>>>>>>(454.l*8192)	string		EFI\ PART	GPT partition table
9953>>>>>>>>>>>>>>0			use		gpt-mbr-type
9954>>>>>>>>>>>>>>&-8		use		gpt-table
9955>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
9956>>>>>>>>>>>>>(454.l*8192)	string		!EFI\ PART
9957>>>>>>>>>>>>>>(454.l*4096)	string		EFI\ PART	GPT partition table
9958>>>>>>>>>>>>>>>0		use		gpt-mbr-type
9959>>>>>>>>>>>>>>>&-8		use		gpt-table
9960>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
9961>>>>>>>>>>>>>>(454.l*4096)	string		!EFI\ PART
9962>>>>>>>>>>>>>>>(454.l*2048)	string		EFI\ PART	GPT partition table
9963>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
9964>>>>>>>>>>>>>>>>&-8		use		gpt-table
9965>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
9966>>>>>>>>>>>>>>>(454.l*2048)	string		!EFI\ PART
9967>>>>>>>>>>>>>>>>(454.l*1024)	string		EFI\ PART	GPT partition table
9968>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
9969>>>>>>>>>>>>>>>>>&-8		use		gpt-table
9970>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
9971>>>>>>>>>>>>>>>>(454.l*1024)	string		!EFI\ PART
9972>>>>>>>>>>>>>>>>>(454.l*512)	string		EFI\ PART	GPT partition table
9973>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
9974>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
9975>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
9976# GPT with protective MBR entry in partition 2 (only)
9977>>>>>>>>>450		ubyte		!0xee
9978>>>>>>>>>>466		ubyte		0xee
9979>>>>>>>>>>>482		ubyte		!0xee
9980>>>>>>>>>>>>498		ubyte		!0xee
9981#>>>>>>>>>>>>>462	use		gpt-mbr-partition
9982>>>>>>>>>>>>>(470.l*8192)	string		EFI\ PART	GPT partition table
9983>>>>>>>>>>>>>>0			use		gpt-mbr-type
9984>>>>>>>>>>>>>>&-8		use		gpt-table
9985>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
9986>>>>>>>>>>>>>(470.l*8192)	string		!EFI\ PART
9987>>>>>>>>>>>>>>(470.l*4096)	string		EFI\ PART	GPT partition table
9988>>>>>>>>>>>>>>>0		use		gpt-mbr-type
9989>>>>>>>>>>>>>>>&-8		use		gpt-table
9990>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
9991>>>>>>>>>>>>>>(470.l*4096)	string		!EFI\ PART
9992>>>>>>>>>>>>>>>(470.l*2048)	string		EFI\ PART	GPT partition table
9993>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
9994>>>>>>>>>>>>>>>>&-8		use		gpt-table
9995>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
9996>>>>>>>>>>>>>>>(470.l*2048)	string		!EFI\ PART
9997>>>>>>>>>>>>>>>>(470.l*1024)	string		EFI\ PART	GPT partition table
9998>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
9999>>>>>>>>>>>>>>>>>&-8		use		gpt-table
10000>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
10001>>>>>>>>>>>>>>>>(470.l*1024)	string		!EFI\ PART
10002>>>>>>>>>>>>>>>>>(470.l*512)	string		EFI\ PART	GPT partition table
10003>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
10004>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
10005>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
10006# GPT with protective MBR entry in partition 3 (only)
10007>>>>>>>>>450		ubyte		!0xee
10008>>>>>>>>>>466		ubyte		!0xee
10009>>>>>>>>>>>482		ubyte		0xee
10010>>>>>>>>>>>>498		ubyte		!0xee
10011#>>>>>>>>>>>>>478	use		gpt-mbr-partition
10012>>>>>>>>>>>>>(486.l*8192)	string		EFI\ PART	GPT partition table
10013>>>>>>>>>>>>>>0			use		gpt-mbr-type
10014>>>>>>>>>>>>>>&-8		use		gpt-table
10015>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
10016>>>>>>>>>>>>>(486.l*8192)	string		!EFI\ PART
10017>>>>>>>>>>>>>>(486.l*4096)	string		EFI\ PART	GPT partition table
10018>>>>>>>>>>>>>>>0		use		gpt-mbr-type
10019>>>>>>>>>>>>>>>&-8		use		gpt-table
10020>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
10021>>>>>>>>>>>>>>(486.l*4096)	string		!EFI\ PART
10022>>>>>>>>>>>>>>>(486.l*2048)	string		EFI\ PART	GPT partition table
10023>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
10024>>>>>>>>>>>>>>>>&-8		use		gpt-table
10025>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
10026>>>>>>>>>>>>>>>(486.l*2048)	string		!EFI\ PART
10027>>>>>>>>>>>>>>>>(486.l*1024)	string		EFI\ PART	GPT partition table
10028>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
10029>>>>>>>>>>>>>>>>>&-8		use		gpt-table
10030>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
10031>>>>>>>>>>>>>>>>(486.l*1024)	string		!EFI\ PART
10032>>>>>>>>>>>>>>>>>(486.l*512)	string		EFI\ PART	GPT partition table
10033>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
10034>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
10035>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
10036# GPT with protective MBR entry in partition 4 (only)
10037>>>>>>>>>450		ubyte		!0xee
10038>>>>>>>>>>466		ubyte		!0xee
10039>>>>>>>>>>>482		ubyte		!0xee
10040>>>>>>>>>>>>498		ubyte		0xee
10041#>>>>>>>>>>>>>494	use		gpt-mbr-partition
10042>>>>>>>>>>>>>(502.l*8192)	string		EFI\ PART	GPT partition table
10043>>>>>>>>>>>>>>0			use		gpt-mbr-type
10044>>>>>>>>>>>>>>&-8		use		gpt-table
10045>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
10046>>>>>>>>>>>>>(502.l*8192)	string		!EFI\ PART
10047>>>>>>>>>>>>>>(502.l*4096)	string		EFI\ PART	GPT partition table
10048>>>>>>>>>>>>>>>0		use		gpt-mbr-type
10049>>>>>>>>>>>>>>>&-8		use		gpt-table
10050>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
10051>>>>>>>>>>>>>>(502.l*4096)	string		!EFI\ PART
10052>>>>>>>>>>>>>>>(502.l*2048)	string		EFI\ PART	GPT partition table
10053>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
10054>>>>>>>>>>>>>>>>&-8		use		gpt-table
10055>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
10056>>>>>>>>>>>>>>>(502.l*2048)	string		!EFI\ PART
10057>>>>>>>>>>>>>>>>(502.l*1024)	string		EFI\ PART	GPT partition table
10058>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
10059>>>>>>>>>>>>>>>>>&-8		use		gpt-table
10060>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
10061>>>>>>>>>>>>>>>>(502.l*1024)	string		!EFI\ PART
10062>>>>>>>>>>>>>>>>>(502.l*512)	string		EFI\ PART	GPT partition table
10063>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
10064>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
10065>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
10066
10067# The following code does GPT detection and processing, including
10068# sector size detection.
10069# It has to be duplicated above because the top-level pattern
10070# (i.e. not called using 'use') must print *something* for file
10071# to count it as a match. Text only printed in named patterns is
10072# not counted, and causes file to continue, and try and match
10073# other patterns.
10074#
10075# Unfortunately, when assuming sector sizes >=16k, if the sector size
10076# happens to be 512 instead, we may find confusing data after the GPT
10077# table...  If the GPT table has less than 128 entries, this may even
10078# happen for assumed sector sizes as small as 4k
10079# This could be solved by checking for the presence of the backup GPT
10080# header as well, but that makes the logic extremely complex
10081##0		name		gpt-mbr-partition
10082##>(8.l*8192)	string		EFI\ PART
10083##>>(8.l*8192)	use		gpt-mbr-type
10084##>>&-8		use		gpt-table
10085##>>0		ubyte		x		of 8192 bytes
10086##>(8.l*8192)	string		!EFI\ PART
10087##>>(8.l*4096)	string		EFI\ PART	GPT partition table
10088##>>>0		use		gpt-mbr-type
10089##>>>&-8		use		gpt-table
10090##>>>0		ubyte		x		of 4096 bytes
10091##>>(8.l*4096)	string		!EFI\ PART
10092##>>>(8.l*2048)	string		EFI\ PART	GPT partition table
10093##>>>>0		use		gpt-mbr-type
10094##>>>>&-8		use		gpt-table
10095##>>>>0		ubyte		x		of 2048 bytes
10096##>>>(8.l*2048)	string		!EFI\ PART
10097##>>>>(8.l*1024)	string		EFI\ PART	GPT partition table
10098##>>>>>0		use		gpt-mbr-type
10099##>>>>>&-8	use		gpt-table
10100##>>>>>0		ubyte		x		of 1024 bytes
10101##>>>>(8.l*1024)	string		!EFI\ PART
10102##>>>>>(8.l*512)	string		EFI\ PART	GPT partition table
10103##>>>>>>0		use		gpt-mbr-type
10104##>>>>>>&-8	use		gpt-table
10105##>>>>>>0		ubyte		x		of 512 bytes
10106
10107# Print details of MBR type for a GPT-disk
10108# Calling code ensures that there is only one 0xee partition.
101090		name		gpt-mbr-type
10110# GPT with protective MBR entry in partition 1
10111>450		ubyte		0xee
10112>>454		ulelong		1
10113>>>462		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
10114>>454		ulelong		!1													\b (nonstandard: not at LBA 1)
10115# GPT with protective MBR entry in partition 2
10116>466		ubyte		0xee
10117>>470		ulelong		1
10118>>>478		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
10119>>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0					\b (with hybrid MBR)
10120>>>478		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
10121>>470		ulelong		!1									\b (nonstandard: not at LBA 1)
10122# GPT with protective MBR entry in partition 3
10123>482		ubyte		0xee
10124>>486		ulelong		1
10125>>>494		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
10126>>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
10127>>>494		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0					\b (with hybrid MBR)
10128>>486		ulelong		!1									\b (nonstandard: not at LBA 1)
10129# GPT with protective MBR entry in partition 4
10130>498		ubyte		0xee
10131>>502		ulelong		1
10132>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
10133>>502		ulelong		!1													\b (nonstandard: not at LBA 1)
10134
10135# Print the information from a GPT partition table structure
101360		name		gpt-table
10137>10		uleshort	x		\b, version %u
10138>8		uleshort	x		\b.%u
10139>56		ulelong		x		\b, GUID: %08x
10140>60		uleshort	x		\b-%04x
10141>62		uleshort	x		\b-%04x
10142>64		ubeshort	x		\b-%04x
10143>66		ubeshort	x		\b-%04x
10144>68		ubelong		x		\b%08x
10145#>80		uleshort	x		\b, %d partition entries
10146>32		ulequad+1	x		\b, disk size: %lld sectors
10147
10148# In case a GPT data-structure is at LBA 0, report it as well
10149# This covers systems which are not GPT-aware, and which show
10150# and allow access to the protective partition. This code will
10151# detect the contents of such a partition.
101520		string		EFI\ PART	GPT data structure (nonstandard: at LBA 0)
10153>0		use		gpt-table
10154>0		ubyte		x		(sector size unknown)
10155
10156
10157
10158#------------------------------------------------------------------------------
10159# $File$
10160# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
10161#
10162# ACE/gr binary
101630	string	\000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003		old ACE/gr binary file
10164>39	byte	>0			- version %c
10165# ACE/gr ascii
101660	string	#\ xvgr\ parameter\ file	ACE/gr ascii file
101670	string	#\ xmgr\ parameter\ file	ACE/gr ascii file
101680	string	#\ ACE/gr\ parameter\ file	ACE/gr ascii file
10169# Grace projects
101700	string	#\ Grace\ project\ file		Grace project file
10171>23	string	@version\  			(version
10172>>32	byte	>0 				%c
10173>>33	string	>\0 				\b.%.2s
10174>>35	string	>\0 				\b.%.2s)
10175# ACE/gr fit description files
101760	string	#\ ACE/gr\ fit\ description\ 	ACE/gr fit description file
10177# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
10178
10179#------------------------------------------------------------------------------
10180# $File: graphviz,v 1.7 2009/09/19 16:28:09 christos Exp $
10181# graphviz:  file(1) magic for http://www.graphviz.org/
10182
10183# FIXME: These patterns match too generally. For example, the first
10184# line matches a LaTeX file containing the word "graph" (with a {
10185# following later) and the second line matches this file.
10186#0	regex/100l	[\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{	graphviz graph text
10187#!:mime	text/vnd.graphviz
10188#0	regex/100l	[\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{	graphviz digraph text
10189#!:mime	text/vnd.graphviz
10190
10191#------------------------------------------------------------------------------
10192# $File$
10193# gringotts:  file(1) magic for Gringotts
10194# http://devel.pluto.linux.it/projects/Gringotts/
10195# author: Germano Rizzo <mano@pluto.linux.it>
10196#GRG3????Y
101970	string	GRG		Gringotts data file
10198#file format 1
10199>3	string		1		v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
10200#file format 2
10201>3	string		2		v.2, MCRYPT S2K,
10202>>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
10203>>8	byte&0x70	0x10		SERPENT crypt,
10204>>8	byte&0x70	0x20		TWOFISH crypt,
10205>>8	byte&0x70	0x30		CAST-256 crypt,
10206>>8	byte&0x70	0x40		SAFER+ crypt,
10207>>8	byte&0x70	0x50		LOKI97 crypt,
10208>>8	byte&0x70	0x60		3DES crypt,
10209>>8	byte&0x70	0x70		RIJNDAEL-256 crypt,
10210>>8	byte&0x08	0x00		SHA1 hash,
10211>>8	byte&0x08	0x08		RIPEMD-160 hash,
10212>>8	byte&0x04	0x00		ZLib
10213>>8	byte&0x04	0x04		BZip2
10214>>8	byte&0x03	0x00		lvl.0
10215>>8	byte&0x03	0x01		lvl.3
10216>>8	byte&0x03	0x02		lvl.6
10217>>8	byte&0x03	0x03		lvl.9
10218#file format 3
10219>3	string		3		v.3, OpenPGP S2K,
10220>>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
10221>>8	byte&0x70	0x10		SERPENT crypt,
10222>>8	byte&0x70	0x20		TWOFISH crypt,
10223>>8	byte&0x70	0x30		CAST-256 crypt,
10224>>8	byte&0x70	0x40		SAFER+ crypt,
10225>>8	byte&0x70	0x50		LOKI97 crypt,
10226>>8	byte&0x70	0x60		3DES crypt,
10227>>8	byte&0x70	0x70		RIJNDAEL-256 crypt,
10228>>8	byte&0x08	0x00		SHA1 hash,
10229>>8	byte&0x08	0x08		RIPEMD-160 hash,
10230>>8	byte&0x04	0x00		ZLib
10231>>8	byte&0x04	0x04		BZip2
10232>>8	byte&0x03	0x00		lvl.0
10233>>8	byte&0x03	0x01		lvl.3
10234>>8	byte&0x03	0x02		lvl.6
10235>>8	byte&0x03	0x03		lvl.9
10236#file format >3
10237>3	string		>3		v.%.1s (unknown details)
10238
10239#------------------------------------------------------------------------------
10240# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $
10241# Guile file magic from <dalepsmith@gmail.com>
10242# http://www.gnu.org/s/guile/
10243# http://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250
10244
102450	string	GOOF----	Guile Object
10246>8	string	LE		\b, little endian
10247>8	string	BE		\b, big endian
10248>11	string	4		\b, 32bit
10249>11	string	8		\b, 64bit
10250>13	regex	.\..		\b, bytecode v%s
10251
10252#------------------------------------------------------------------------------
10253# $File: hitachi-sh,v 1.5 2009/09/19 16:28:09 christos Exp $
10254# hitach-sh: file(1) magic for Hitachi Super-H
10255#
10256# Super-H COFF
10257#
10258# below test line conflicts with 2nd NTFS filesystem sector
102590	beshort		0x0500		Hitachi SH big-endian COFF
10260# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR
10261#0	ubelong&0xFFFFNMPQ	0x0500NMPQ     Hitachi SH big-endian COFF
10262>18	beshort&0x0002	=0x0000		object
10263>18	beshort&0x0002	=0x0002		executable
10264>18	beshort&0x0008	=0x0008		\b, stripped
10265>18	beshort&0x0008	=0x0000		\b, not stripped
10266#
102670	leshort		0x0550		Hitachi SH little-endian COFF
10268>18	leshort&0x0002	=0x0000		object
10269>18	leshort&0x0002	=0x0002		executable
10270>18	leshort&0x0008	=0x0008		\b, stripped
10271>18	leshort&0x0008	=0x0000		\b, not stripped
10272
10273
10274#------------------------------------------------------------------------------
10275# $File: hp,v 1.23 2009/09/19 16:28:09 christos Exp $
10276# hp:  file(1) magic for Hewlett Packard machines (see also "printer")
10277#
10278# XXX - somebody should figure out whether any byte order needs to be
10279# applied to the "TML" stuff; I'm assuming the Apollo stuff is
10280# big-endian as it was mostly 68K-based.
10281#
10282# I think the 500 series was the old stack-based machines, running a
10283# UNIX environment atop the "SUN kernel"; dunno whether it was
10284# big-endian or little-endian.
10285#
10286# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
10287# hp300 are 68020+68881 based; hp400 are also 68k.  The following basic
10288# HP magic is useful for reference, but using "long" magic is a better
10289# practice in order to avoid collisions.
10290#
10291# Guy Harris (guy@netapp.com): some additions to this list came from
10292# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
10293# 1.2, and 2.0).  The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
10294# "/etc/magic", though, except for the "archive file relocatable library"
10295# stuff, and the 68030 and 68040 stuff isn't there at all - are they not
10296# used in executables, or have they just not yet updated "/etc/magic"
10297# completely?
10298#
10299# 0	beshort		200		hp200 (68010) BSD binary
10300# 0	beshort		300		hp300 (68020+68881) BSD binary
10301# 0	beshort		0x20c		hp200/300 HP-UX binary
10302# 0	beshort		0x20d		hp400 (68030) HP-UX binary
10303# 0	beshort		0x20e		hp400 (68040?) HP-UX binary
10304# 0	beshort		0x20b		PA-RISC1.0 HP-UX binary
10305# 0	beshort		0x210		PA-RISC1.1 HP-UX binary
10306# 0	beshort		0x211		PA-RISC1.2 HP-UX binary
10307# 0	beshort		0x214		PA-RISC2.0 HP-UX binary
10308
10309#
10310# The "misc" stuff needs a byte order; the archives look suspiciously
10311# like the old 177545 archives (0xff65 = 0177545).
10312#
10313#### Old Apollo stuff
103140	beshort		0627		Apollo m68k COFF executable
10315>18	beshort		^040000		not stripped
10316>22	beshort		>0		- version %d
103170	beshort		0624		apollo a88k COFF executable
10318>18	beshort		^040000		not stripped
10319>22	beshort		>0		- version %d
103200       long            01203604016     TML 0123 byte-order format
103210       long            01702407010     TML 1032 byte-order format
103220       long            01003405017     TML 2301 byte-order format
103230       long            01602007412     TML 3210 byte-order format
10324#### PA-RISC 1.1
103250	belong 		0x02100106	PA-RISC1.1 relocatable object
103260	belong 		0x02100107	PA-RISC1.1 executable
10327>168	belong		&0x00000004	dynamically linked
10328>(144)	belong		0x054ef630	dynamically linked
10329>96	belong		>0		- not stripped
10330
103310	belong 		0x02100108	PA-RISC1.1 shared executable
10332>168	belong&0x4	0x4		dynamically linked
10333>(144)	belong		0x054ef630	dynamically linked
10334>96	belong		>0		- not stripped
10335
103360	belong 		0x0210010b	PA-RISC1.1 demand-load executable
10337>168	belong&0x4	0x4		dynamically linked
10338>(144)	belong		0x054ef630	dynamically linked
10339>96	belong		>0		- not stripped
10340
103410	belong 		0x0210010e	PA-RISC1.1 shared library
10342>96	belong		>0		- not stripped
10343
103440	belong 		0x0210010d	PA-RISC1.1 dynamic load library
10345>96	belong		>0		- not stripped
10346
10347#### PA-RISC 2.0
103480	belong		0x02140106	PA-RISC2.0 relocatable object
10349
103500       belong		0x02140107	PA-RISC2.0 executable
10351>168	belong		&0x00000004	dynamically linked
10352>(144)	belong		0x054ef630	dynamically linked
10353>96	belong		>0		- not stripped
10354
103550       belong		0x02140108	PA-RISC2.0 shared executable
10356>168	belong		&0x00000004	dynamically linked
10357>(144)	belong		0x054ef630	dynamically linked
10358>96	belong		>0		- not stripped
10359
103600       belong		0x0214010b	PA-RISC2.0 demand-load executable
10361>168	belong		&0x00000004	dynamically linked
10362>(144)	belong		0x054ef630	dynamically linked
10363>96	belong		>0		- not stripped
10364
103650       belong		0x0214010e	PA-RISC2.0 shared library
10366>96	belong		>0		- not stripped
10367
103680       belong		0x0214010d	PA-RISC2.0 dynamic load library
10369>96	belong		>0		- not stripped
10370
10371#### 800
103720	belong 		0x020b0106	PA-RISC1.0 relocatable object
10373
103740	belong 		0x020b0107	PA-RISC1.0 executable
10375>168	belong&0x4	0x4		dynamically linked
10376>(144)	belong		0x054ef630	dynamically linked
10377>96	belong		>0		- not stripped
10378
103790	belong 		0x020b0108	PA-RISC1.0 shared executable
10380>168	belong&0x4	0x4		dynamically linked
10381>(144)	belong		0x054ef630	dynamically linked
10382>96	belong		>0		- not stripped
10383
103840	belong 		0x020b010b	PA-RISC1.0 demand-load executable
10385>168	belong&0x4	0x4		dynamically linked
10386>(144)	belong		0x054ef630	dynamically linked
10387>96	belong		>0		- not stripped
10388
103890	belong 		0x020b010e	PA-RISC1.0 shared library
10390>96	belong		>0		- not stripped
10391
103920	belong 		0x020b010d	PA-RISC1.0 dynamic load library
10393>96	belong		>0		- not stripped
10394
103950	belong		0x213c6172	archive file
10396>68	belong 		0x020b0619	- PA-RISC1.0 relocatable library
10397>68	belong	 	0x02100619	- PA-RISC1.1 relocatable library
10398>68	belong 		0x02110619	- PA-RISC1.2 relocatable library
10399>68	belong 		0x02140619	- PA-RISC2.0 relocatable library
10400
10401#### 500
104020	long		0x02080106	HP s500 relocatable executable
10403>16	long		>0		- version %d
10404
104050	long		0x02080107	HP s500 executable
10406>16	long		>0		- version %d
10407
104080	long		0x02080108	HP s500 pure executable
10409>16	long		>0		- version %d
10410
10411#### 200
104120	belong 		0x020c0108	HP s200 pure executable
10413>4	beshort		>0		- version %d
10414>8	belong		&0x80000000	save fp regs
10415>8	belong		&0x40000000	dynamically linked
10416>8	belong		&0x20000000	debuggable
10417>36	belong		>0		not stripped
10418
104190	belong		0x020c0107	HP s200 executable
10420>4	beshort		>0		- version %d
10421>8	belong		&0x80000000	save fp regs
10422>8	belong		&0x40000000	dynamically linked
10423>8	belong		&0x20000000	debuggable
10424>36	belong		>0		not stripped
10425
104260	belong		0x020c010b	HP s200 demand-load executable
10427>4	beshort		>0		- version %d
10428>8	belong		&0x80000000	save fp regs
10429>8	belong		&0x40000000	dynamically linked
10430>8	belong		&0x20000000	debuggable
10431>36	belong		>0		not stripped
10432
104330	belong		0x020c0106	HP s200 relocatable executable
10434>4	beshort		>0		- version %d
10435>6	beshort		>0		- highwater %d
10436>8	belong		&0x80000000	save fp regs
10437>8	belong		&0x20000000	debuggable
10438>8	belong		&0x10000000	PIC
10439
104400	belong 		0x020a0108	HP s200 (2.x release) pure executable
10441>4	beshort		>0		- version %d
10442>36	belong		>0		not stripped
10443
104440	belong		0x020a0107	HP s200 (2.x release) executable
10445>4	beshort		>0		- version %d
10446>36	belong		>0		not stripped
10447
104480	belong		0x020c010e	HP s200 shared library
10449>4	beshort		>0		- version %d
10450>6	beshort		>0		- highwater %d
10451>36	belong		>0		not stripped
10452
104530	belong		0x020c010d	HP s200 dynamic load library
10454>4	beshort		>0		- version %d
10455>6	beshort		>0		- highwater %d
10456>36	belong		>0		not stripped
10457
10458#### MISC
104590	long		0x0000ff65	HP old archive
104600	long		0x020aff65	HP s200 old archive
104610	long		0x020cff65	HP s200 old archive
104620	long		0x0208ff65	HP s500 old archive
10463
104640	long		0x015821a6	HP core file
10465
104660	long		0x4da7eee8	HP-WINDOWS font
10467>8	byte		>0		- version %d
104680	string		Bitmapfile	HP Bitmapfile
10469
104700	string		IMGfile	CIS 	compimg HP Bitmapfile
10471# XXX - see "lif"
10472#0	short		0x8000		lif file
104730	long		0x020c010c	compiled Lisp
10474
104750	string		msgcat01	HP NLS message catalog,
10476>8	long		>0		%d messages
10477
10478# Summary: HP-48/49 calculator
10479# Created by: phk@data.fls.dk
10480# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk>
10481# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support)
104820	string		HPHP		HP
10483>4	string		48		48 binary
10484>4	string		49		49 binary
10485>7	byte		>64		- Rev %c
10486>8	leshort		0x2911		(ADR)
10487>8	leshort		0x2933		(REAL)
10488>8	leshort		0x2955		(LREAL)
10489>8	leshort		0x2977		(COMPLX)
10490>8	leshort		0x299d		(LCOMPLX)
10491>8	leshort		0x29bf		(CHAR)
10492>8	leshort		0x29e8		(ARRAY)
10493>8	leshort		0x2a0a		(LNKARRAY)
10494>8	leshort		0x2a2c		(STRING)
10495>8	leshort		0x2a4e		(HXS)
10496>8	leshort		0x2a74		(LIST)
10497>8	leshort		0x2a96		(DIR)
10498>8	leshort		0x2ab8		(ALG)
10499>8	leshort		0x2ada		(UNIT)
10500>8	leshort		0x2afc		(TAGGED)
10501>8	leshort		0x2b1e		(GROB)
10502>8	leshort		0x2b40		(LIB)
10503>8	leshort		0x2b62		(BACKUP)
10504>8	leshort		0x2b88		(LIBDATA)
10505>8	leshort		0x2d9d		(PROG)
10506>8	leshort		0x2dcc		(CODE)
10507>8	leshort		0x2e48		(GNAME)
10508>8	leshort		0x2e6d		(LNAME)
10509>8	leshort		0x2e92		(XLIB)
10510
105110	string		%%HP:		HP text
10512>6	string		T(0)		- T(0)
10513>6	string		T(1)		- T(1)
10514>6	string		T(2)		- T(2)
10515>6	string		T(3)		- T(3)
10516>10	string		A(D)		A(D)
10517>10	string		A(R)		A(R)
10518>10	string		A(G)		A(G)
10519>14	string		F(.)		F(.);
10520>14	string		F(,)		F(,);
10521
10522
10523# Summary: HP-38/39 calculator
10524# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
105250	string		HP3
10526>3	string		8		HP 38
10527>3	string		9		HP 39
10528>4	string		Bin		binary
10529>4	string		Asc		ASCII
10530>7	string		A		(Directory List)
10531>7	string		B		(Zaplet)
10532>7	string		C		(Note)
10533>7	string		D		(Program)
10534>7	string		E		(Variable)
10535>7	string		F		(List)
10536>7	string		G		(Matrix)
10537>7	string		H		(Library)
10538>7	string		I		(Target List)
10539>7	string		J		(ASCII Vector specification)
10540>7	string		K		(wildcard)
10541
10542# Summary: HP-38/39 calculator
10543# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
105440	string		HP3
10545>3	string		8		HP 38
10546>3	string		9		HP 39
10547>4	string		Bin		binary
10548>4	string		Asc		ASCII
10549>7	string		A		(Directory List)
10550>7	string		B		(Zaplet)
10551>7	string		C		(Note)
10552>7	string		D		(Program)
10553>7	string		E		(Variable)
10554>7	string		F		(List)
10555>7	string		G		(Matrix)
10556>7	string		H		(Library)
10557>7	string		I		(Target List)
10558>7	string		J		(ASCII Vector specification)
10559>7	string		K		(wildcard)
10560
10561# hpBSD magic numbers
105620	beshort		200		hp200 (68010) BSD
10563>2	beshort		0407		impure binary
10564>2	beshort		0410		read-only binary
10565>2	beshort		0413		demand paged binary
105660	beshort		300		hp300 (68020+68881) BSD
10567>2	beshort		0407		impure binary
10568>2	beshort		0410		read-only binary
10569>2	beshort		0413		demand paged binary
10570#
10571# From David Gero <dgero@nortelnetworks.com>
10572# HP-UX 10.20 core file format from /usr/include/sys/core.h
10573# Unfortunately, HP-UX uses corehead blocks without specifying the order
10574# There are four we care about:
10575#     CORE_KERNEL, which starts with the string "HP-UX"
10576#     CORE_EXEC, which contains the name of the command
10577#     CORE_PROC, which contains the signal number that caused the core dump
10578#     CORE_FORMAT, which contains the version of the core file format (== 1)
10579# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC
10580# but we include all 6 variations of the order of the first 3, and
10581# assume that PROC will always be last
10582# Order 1: KERNEL, EXEC, FORMAT, PROC
105830x10		string	HP-UX
10584>0		belong	2
10585>>0xC		belong	0x3C
10586>>>0x4C		belong	0x100
10587>>>>0x58	belong	0x44
10588>>>>>0xA0	belong	1
10589>>>>>>0xAC	belong	4
10590>>>>>>>0xB0	belong	1
10591>>>>>>>>0xB4	belong	4		core file
10592>>>>>>>>>0x90	string	>\0		from '%s'
10593>>>>>>>>>0xC4	belong	3		- received SIGQUIT
10594>>>>>>>>>0xC4	belong	4		- received SIGILL
10595>>>>>>>>>0xC4	belong	5		- received SIGTRAP
10596>>>>>>>>>0xC4	belong	6		- received SIGABRT
10597>>>>>>>>>0xC4	belong	7		- received SIGEMT
10598>>>>>>>>>0xC4	belong	8		- received SIGFPE
10599>>>>>>>>>0xC4	belong	10		- received SIGBUS
10600>>>>>>>>>0xC4	belong	11		- received SIGSEGV
10601>>>>>>>>>0xC4	belong	12		- received SIGSYS
10602>>>>>>>>>0xC4	belong	33		- received SIGXCPU
10603>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
10604# Order 2: KERNEL, FORMAT, EXEC, PROC
10605>>>0x4C		belong	1
10606>>>>0x58	belong	4
10607>>>>>0x5C	belong	1
10608>>>>>>0x60	belong	0x100
10609>>>>>>>0x6C	belong	0x44
10610>>>>>>>>0xB4	belong	4		core file
10611>>>>>>>>>0xA4	string	>\0		from '%s'
10612>>>>>>>>>0xC4	belong	3		- received SIGQUIT
10613>>>>>>>>>0xC4	belong	4		- received SIGILL
10614>>>>>>>>>0xC4	belong	5		- received SIGTRAP
10615>>>>>>>>>0xC4	belong	6		- received SIGABRT
10616>>>>>>>>>0xC4	belong	7		- received SIGEMT
10617>>>>>>>>>0xC4	belong	8		- received SIGFPE
10618>>>>>>>>>0xC4	belong	10		- received SIGBUS
10619>>>>>>>>>0xC4	belong	11		- received SIGSEGV
10620>>>>>>>>>0xC4	belong	12		- received SIGSYS
10621>>>>>>>>>0xC4	belong	33		- received SIGXCPU
10622>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
10623# Order 3: FORMAT, KERNEL, EXEC, PROC
106240x24		string	HP-UX
10625>0		belong	1
10626>>0xC		belong	4
10627>>>0x10		belong	1
10628>>>>0x14	belong	2
10629>>>>>0x20	belong	0x3C
10630>>>>>>0x60	belong	0x100
10631>>>>>>>0x6C	belong	0x44
10632>>>>>>>>0xB4	belong	4		core file
10633>>>>>>>>>0xA4	string	>\0		from '%s'
10634>>>>>>>>>0xC4	belong	3		- received SIGQUIT
10635>>>>>>>>>0xC4	belong	4		- received SIGILL
10636>>>>>>>>>0xC4	belong	5		- received SIGTRAP
10637>>>>>>>>>0xC4	belong	6		- received SIGABRT
10638>>>>>>>>>0xC4	belong	7		- received SIGEMT
10639>>>>>>>>>0xC4	belong	8		- received SIGFPE
10640>>>>>>>>>0xC4	belong	10		- received SIGBUS
10641>>>>>>>>>0xC4	belong	11		- received SIGSEGV
10642>>>>>>>>>0xC4	belong	12		- received SIGSYS
10643>>>>>>>>>0xC4	belong	33		- received SIGXCPU
10644>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
10645# Order 4: EXEC, KERNEL, FORMAT, PROC
106460x64		string	HP-UX
10647>0		belong	0x100
10648>>0xC		belong	0x44
10649>>>0x54		belong	2
10650>>>>0x60	belong	0x3C
10651>>>>>0xA0	belong	1
10652>>>>>>0xAC	belong	4
10653>>>>>>>0xB0	belong	1
10654>>>>>>>>0xB4	belong	4		core file
10655>>>>>>>>>0x44	string	>\0		from '%s'
10656>>>>>>>>>0xC4	belong	3		- received SIGQUIT
10657>>>>>>>>>0xC4	belong	4		- received SIGILL
10658>>>>>>>>>0xC4	belong	5		- received SIGTRAP
10659>>>>>>>>>0xC4	belong	6		- received SIGABRT
10660>>>>>>>>>0xC4	belong	7		- received SIGEMT
10661>>>>>>>>>0xC4	belong	8		- received SIGFPE
10662>>>>>>>>>0xC4	belong	10		- received SIGBUS
10663>>>>>>>>>0xC4	belong	11		- received SIGSEGV
10664>>>>>>>>>0xC4	belong	12		- received SIGSYS
10665>>>>>>>>>0xC4	belong	33		- received SIGXCPU
10666>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
10667# Order 5: FORMAT, EXEC, KERNEL, PROC
106680x78		string	HP-UX
10669>0		belong	1
10670>>0xC		belong	4
10671>>>0x10		belong	1
10672>>>>0x14	belong	0x100
10673>>>>>0x20	belong	0x44
10674>>>>>>0x68	belong	2
10675>>>>>>>0x74	belong	0x3C
10676>>>>>>>>0xB4	belong	4		core file
10677>>>>>>>>>0x58	string	>\0		from '%s'
10678>>>>>>>>>0xC4	belong	3		- received SIGQUIT
10679>>>>>>>>>0xC4	belong	4		- received SIGILL
10680>>>>>>>>>0xC4	belong	5		- received SIGTRAP
10681>>>>>>>>>0xC4	belong	6		- received SIGABRT
10682>>>>>>>>>0xC4	belong	7		- received SIGEMT
10683>>>>>>>>>0xC4	belong	8		- received SIGFPE
10684>>>>>>>>>0xC4	belong	10		- received SIGBUS
10685>>>>>>>>>0xC4	belong	11		- received SIGSEGV
10686>>>>>>>>>0xC4	belong	12		- received SIGSYS
10687>>>>>>>>>0xC4	belong	33		- received SIGXCPU
10688>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
10689# Order 6: EXEC, FORMAT, KERNEL, PROC
10690>0		belong	0x100
10691>>0xC		belong	0x44
10692>>>0x54		belong	1
10693>>>>0x60	belong	4
10694>>>>>0x64	belong	1
10695>>>>>>0x68	belong	2
10696>>>>>>>0x74	belong	0x2C
10697>>>>>>>>0xB4	belong	4		core file
10698>>>>>>>>>0x44	string	>\0		from '%s'
10699>>>>>>>>>0xC4	belong	3		- received SIGQUIT
10700>>>>>>>>>0xC4	belong	4		- received SIGILL
10701>>>>>>>>>0xC4	belong	5		- received SIGTRAP
10702>>>>>>>>>0xC4	belong	6		- received SIGABRT
10703>>>>>>>>>0xC4	belong	7		- received SIGEMT
10704>>>>>>>>>0xC4	belong	8		- received SIGFPE
10705>>>>>>>>>0xC4	belong	10		- received SIGBUS
10706>>>>>>>>>0xC4	belong	11		- received SIGSEGV
10707>>>>>>>>>0xC4	belong	12		- received SIGSYS
10708>>>>>>>>>0xC4	belong	33		- received SIGXCPU
10709>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
10710
10711
10712
10713#------------------------------------------------------------------------------
10714# $File$
10715# human68k:  file(1) magic for Human68k (X680x0 DOS) binary formats
10716# Magic too short!
10717#0		string	HU		Human68k
10718#>68		string	LZX		LZX compressed
10719#>>72		string	>\0		(version %s)
10720#>(8.L+74)	string	LZX		LZX compressed
10721#>>(8.L+78)	string	>\0		(version %s)
10722#>60		belong	>0		binded
10723#>(8.L+66)	string	#HUPAIR		hupair
10724#>0		string	HU		X executable
10725#>(8.L+74)	string	#LIBCV1		- linked PD LIBC ver 1
10726#>4		belong	>0		- base address 0x%x
10727#>28		belong	>0		not stripped
10728#>32		belong	>0		with debug information
10729#0		beshort	0x601a		Human68k Z executable
10730#0		beshort	0x6000		Human68k object file
10731#0		belong	0xd1000000	Human68k ar binary archive
10732#0		belong	0xd1010000	Human68k ar ascii archive
10733#0		beshort	0x0068		Human68k lib archive
10734#4		string	LZX		Human68k LZX compressed
10735#>8		string	>\0		(version %s)
10736#>4		string	LZX		R executable
10737#2		string	#HUPAIR		Human68k hupair R executable
10738
10739#------------------------------------------------------------------------------
10740# $File: ibm370,v 1.8 2009/09/19 16:28:09 christos Exp $
10741# ibm370:  file(1) magic for IBM 370 and compatibles.
10742#
10743# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
10744# What the heck *is* "USS/370"?
10745# AIX 4.1's "/etc/magic" has
10746#
10747#	0	short		0535		370 sysV executable
10748#	>12	long		>0		not stripped
10749#	>22	short		>0		- version %d
10750#	>30	long		>0		- 5.2 format
10751#	0	short		0530		370 sysV pure executable
10752#	>12	long		>0		not stripped
10753#	>22	short		>0		- version %d
10754#	>30	long		>0		- 5.2 format
10755#
10756# instead of the "USS/370" versions of the same magic numbers.
10757#
107580	beshort		0537		370 XA sysV executable
10759>12	belong		>0		not stripped
10760>22	beshort		>0		- version %d
10761>30	belong		>0		- 5.2 format
107620	beshort		0532		370 XA sysV pure executable
10763>12	belong		>0		not stripped
10764>22	beshort		>0		- version %d
10765>30	belong		>0		- 5.2 format
107660	beshort		054001		370 sysV pure executable
10767>12	belong		>0		not stripped
107680	beshort		055001		370 XA sysV pure executable
10769>12	belong		>0		not stripped
107700	beshort		056401		370 sysV executable
10771>12	belong		>0		not stripped
107720	beshort		057401		370 XA sysV executable
10773>12	belong		>0		not stripped
107740       beshort		0531		SVR2 executable (Amdahl-UTS)
10775>12	belong		>0		not stripped
10776>24     belong		>0		- version %d
107770	beshort		0534		SVR2 pure executable (Amdahl-UTS)
10778>12	belong		>0		not stripped
10779>24	belong		>0		- version %d
107800	beshort		0530		SVR2 pure executable (USS/370)
10781>12	belong		>0		not stripped
10782>24	belong		>0		- version %d
107830	beshort		0535		SVR2 executable (USS/370)
10784>12	belong		>0		not stripped
10785>24	belong		>0		- version %d
10786
10787#------------------------------------------------------------------------------
10788# $File: ibm6000,v 1.11 2013/01/08 20:13:01 christos Exp $
10789# ibm6000:  file(1) magic for RS/6000 and the RT PC.
10790#
107910	beshort		0x01df		executable (RISC System/6000 V3.1) or obj module
10792>12	belong		>0		not stripped
10793# Breaks sun4 statically linked execs.
10794#0      beshort		0x0103		executable (RT Version 2) or obj module
10795#>2	byte		0x50		pure
10796#>28	belong		>0		not stripped
10797#>6	beshort		>0		- version %ld
107980	beshort		0x0104		shared library
107990	beshort		0x0105		ctab data
108000	beshort		0xfe04		structured file
108010	string		0xabcdef	AIX message catalog
108020	belong		0x000001f9	AIX compiled message catalog
108030	string		\<aiaff>	archive
108040	string		\<bigaf>	archive (big format)
10805
108060	beshort		0x01f7		64-bit XCOFF executable or object module
10807>20	belong		0		not stripped
10808# GRR: this test is still too general as it catches also many FATs of DOS filesystems
108094	belong		&0x0feeddb0
10810# real core dump could not be 32-bit and 64-bit together
10811>7	byte&0x03	!3		AIX core file
10812>>1	byte		&0x01		fulldump
10813>>7	byte		&0x01		32-bit
10814>>>0x6e0	string	>\0		\b, %s
10815>>7	byte		&0x02		64-bit
10816>>>0x524	string	>\0		\b, %s
10817
10818#------------------------------------------------------------------------------
10819# $File$
10820# icc:  file(1) magic for International Color Consortium file formats
10821
10822#
10823# Color profiles as per the ICC's "Image technology colour management -
10824# Architecture, profile format, and data structure" specification.
10825# See
10826#
10827#	http://www.color.org/specification/ICC1v43_2010-12.pdf
10828#
10829# for Specification ICC.1:2010 (Profile version 4.3.0.0).
10830#
10831# Bytes 36 to 39 contain a generic profile file signature of "acsp";
10832# bytes 40 to 43 "may be used to identify the primary platform/operating
10833# system framework for which the profile was created".
10834#
10835# There are other fields that might be worth dumping as well.
10836#
10837
10838# This appears to be what's used for Apple ColorSync profiles.
10839# Instead of adding that, Apple just changed the generic "acsp" entry
10840# to be for "ColorSync ICC Color Profile" rather than "Kodak Color
10841# Management System, ICC Profile".
10842# Yes, it's "APPL", not "AAPL"; see the spec.
1084336	string		acspAPPL	ColorSync ICC Profile
10844!:mime	application/vnd.iccprofile
10845
10846# Microsoft ICM color profile
1084736	string		acspMSFT	Microsoft ICM Color Profile
10848!:mime	application/vnd.iccprofile
10849
10850# Yes, that's a blank after "SGI".
1085136	string		acspSGI\ 	SGI ICC Profile
10852!:mime	application/vnd.iccprofile
10853
10854# XXX - is this what's used for the Sun KCMS or not?  The standard file
10855# uses just "acsp" for that, but Apple's file uses it for "ColorSync",
10856# and there *is* an identified "primary platform" value of SUNW.
1085736	string		acspSUNW	Sun KCMS ICC Profile
10858!:mime	application/vnd.iccprofile
10859
10860# Any other profile.
10861# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles,
10862# and use "acsp" for everything else and dump the "primary platform"
10863# string in those cases?
1086436	string		acsp		ICC Profile
10865!:mime	application/vnd.iccprofile
10866
10867
10868
10869#------------------------------------------------------------------------------
10870# $File: iff,v 1.12 2009/09/19 16:28:09 christos Exp $
10871# iff:	file(1) magic for Interchange File Format (see also "audio" & "images")
10872#
10873# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
10874# Arts for file interchange.  It has also been used by Apple, SGI, and
10875# especially Commodore-Amiga.
10876#
10877# IFF files begin with an 8 byte FORM header, followed by a 4 character
10878# FORM type, which is followed by the first chunk in the FORM.
10879
108800	string		FORM		IFF data
10881#>4	belong		x		\b, FORM is %d bytes long
10882# audio formats
10883>8	string		AIFF		\b, AIFF audio
10884!:mime	audio/x-aiff
10885>8	string		AIFC		\b, AIFF-C compressed audio
10886!:mime	audio/x-aiff
10887>8	string		8SVX		\b, 8SVX 8-bit sampled sound voice
10888!:mime	audio/x-aiff
10889>8	string		16SV		\b, 16SV 16-bit sampled sound voice
10890>8	string		SAMP		\b, SAMP sampled audio
10891>8	string		MAUD		\b, MAUD MacroSystem audio
10892>8	string		SMUS		\b, SMUS simple music
10893>8	string		CMUS		\b, CMUS complex music
10894# image formats
10895>8	string		ILBMBMHD	\b, ILBM interleaved image
10896>>20	beshort		x		\b, %d x
10897>>22	beshort		x		%d
10898>8	string		RGBN		\b, RGBN 12-bit RGB image
10899>8	string		RGB8		\b, RGB8 24-bit RGB image
10900>8	string		DEEP		\b, DEEP TVPaint/XiPaint image
10901>8	string		DR2D		\b, DR2D 2-D object
10902>8	string		TDDD		\b, TDDD 3-D rendering
10903>8	string		LWOB		\b, LWOB 3-D object
10904>8	string		LWO2		\b, LWO2 3-D object, v2
10905>8	string		LWLO		\b, LWLO 3-D layered object
10906>8	string		REAL		\b, REAL Real3D rendering
10907>8	string		MC4D		\b, MC4D MaxonCinema4D rendering
10908>8	string		ANIM		\b, ANIM animation
10909>8	string		YAFA		\b, YAFA animation
10910>8	string		SSA\ 		\b, SSA super smooth animation
10911>8	string		ACBM		\b, ACBM continuous image
10912>8	string		FAXX		\b, FAXX fax image
10913# other formats
10914>8	string		FTXT		\b, FTXT formatted text
10915>8	string		CTLG		\b, CTLG message catalog
10916>8	string		PREF		\b, PREF preferences
10917>8	string		DTYP		\b, DTYP datatype description
10918>8	string		PTCH		\b, PTCH binary patch
10919>8	string		AMFF		\b, AMFF AmigaMetaFile format
10920>8	string		WZRD		\b, WZRD StormWIZARD resource
10921>8	string		DOC\ 		\b, DOC desktop publishing document
10922>8	string		WVQA 		\b, Westwood Studios VQA Multimedia,
10923>>24	leshort		x		%d video frames,
10924>>26	leshort		x		%d x
10925>>28	leshort		x		%d
10926>8	string		MOVE		\b, Wing Commander III Video
10927>>12	string		_PC_		\b, PC version
10928>>12	string		3DO_		\b, 3DO version
10929
10930# These go at the end of the iff rules
10931#
10932# I don't see why these might collide with anything else.
10933#
10934# Interactive Fiction related formats
10935#
10936>8	string		IFRS		\b, Blorb Interactive Fiction
10937>>24	string		Exec		with executable chunk
10938>8	string          IFZS		\b, Z-machine or Glulx saved game file (Quetzal)
10939
10940#------------------------------------------------------------------------------
10941# $File: images,v 1.105 2015/02/14 17:30:03 christos Exp $
10942# images:  file(1) magic for image formats (see also "iff", and "c-lang" for
10943# XPM bitmaps)
10944#
10945# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
10946# additions by janl@ifi.uio.no as well as others. Jan also suggested
10947# merging several one- and two-line files into here.
10948#
10949# little magic: PCX (first byte is 0x0a)
10950
10951# Targa - matches `povray', `ppmtotga' and `xv' outputs
10952# by Philippe De Muyter <phdm@macqel.be>
10953# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
10954# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
10955# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs
10956# `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
10957# `tgatoppm' recognizes a superset (Index may be anything)
109581	belong&0xfff7ffff	0x01010000	Targa image data - Map
10959!:strength + 2
10960>2	byte&8			8		- RLE
10961>12	leshort			>0		%d x
10962>14	leshort			>0		%d
109631	belong&0xfff7ffff	0x00020000	Targa image data - RGB
10964!:strength + 2
10965>2	byte&8			8		- RLE
10966>12	leshort			>0		%d x
10967>14	leshort			>0		%d
109681	belong&0xfff7ffff	0x00030000	Targa image data - Mono
10969!:strength + 2
10970>2	byte&8			8		- RLE
10971>12	leshort			>0		%d x
10972>14	leshort			>0		%d
10973
10974# PBMPLUS images
10975# The next byte following the magic is always whitespace.
10976# strength is changed to try these patterns before "x86 boot sector"
109770	name		netpbm
10978>3	regex/s		=[0-9]{1,50}\ [0-9]{1,50}	Netpbm PPM image data
10979>>&0	regex		=[0-9]{1,50} 			\b, size = %s x
10980>>>&0	regex		=[0-9]{1,50}			\b %s
10981
109820	search/1	P1
10983>0	use		netpbm
10984>>0	string		x	\b, bitmap
10985!:strength + 45
10986!:mime	image/x-portable-bitmap
10987
109880	search/1	P2
10989>0	use		netpbm
10990>>0	string		x	\b, greymap
10991!:strength + 45
10992!:mime	image/x-portable-greymap
10993
109940	search/1	P3
10995>0	use		netpbm
10996>>0	string		x	\b, pixmap
10997!:strength + 45
10998!:mime	image/x-portable-pixmap
10999
11000
110010	string		P4
11002>0	use		netpbm
11003>>0	string		x	\b, rawbits, bitmap
11004!:strength + 45
11005!:mime	image/x-portable-bitmap
11006
110070	string		P5
11008>0	use		netpbm
11009>>0	string		x	\b, rawbits, greymap
11010!:strength + 45
11011!:mime	image/x-portable-greymap
11012
110130	string		P6
11014>0	use		netpbm
11015>>0	string		x	\b, rawbits, pixmap
11016!:strength + 45
11017!:mime	image/x-portable-pixmap
11018
110190	string		P7		Netpbm PAM image file
11020!:mime	image/x-portable-pixmap
11021
11022# From: bryanh@giraffe-data.com (Bryan Henderson)
110230	string		\117\072	Solitaire Image Recorder format
11024>4	string		\013		MGI Type 11
11025>4	string		\021		MGI Type 17
110260	string		.MDA		MicroDesign data
11027>21	byte		48		version 2
11028>21	byte		51		version 3
110290	string		.MDP		MicroDesign page data
11030>21	byte		48		version 2
11031>21	byte		51		version 3
11032
11033# NIFF (Navy Interchange File Format, a modification of TIFF) images
11034# [GRR:  this *must* go before TIFF]
110350	string		IIN1		NIFF image data
11036!:mime	image/x-niff
11037
11038# Canon RAW version 1 (CRW) files are a type of Canon Image File Format
11039# (CIFF) file. These are apparently all little-endian.
11040# From: Adam Buchbinder <adam.buchbinder@gmail.com>
11041# URL: http://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html
110420	string		II\x1a\0\0\0HEAPCCDR	Canon CIFF raw image data
11043!:mime	image/x-canon-crw
11044>16	leshort		x	\b, version %d.
11045>14	leshort		x	\b%d
11046
11047# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic
11048# number. Put this above the TIFF test to make sure we detect them.
11049# These are apparently all little-endian.
11050# From: Adam Buchbinder <adam.buchbinder@gmail.com>
11051# URL: http://libopenraw.freedesktop.org/wiki/Canon_CR2
110520	string		II\x2a\0\x10\0\0\0CR	Canon CR2 raw image data
11053!:mime	image/x-canon-cr2
11054>10	byte		x	\b, version %d.
11055>11	byte		x	\b%d
11056
11057# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
11058# The second word of TIFF files is the TIFF version number, 42, which has
11059# never changed.  The TIFF specification recommends testing for it.
110600	string		MM\x00\x2a	TIFF image data, big-endian
11061!:mime	image/tiff
11062>(4.L)	use		\^tiff_ifd
110630	string		II\x2a\x00	TIFF image data, little-endian
11064!:mime	image/tiff
11065>(4.l)	use		tiff_ifd
11066
110670	name		tiff_ifd
11068>0	leshort		x		\b, direntries=%d
11069>2	use		tiff_entry
11070
110710	name		tiff_entry
11072# NewSubFileType
11073>0	leshort		0xfe
11074>>12	use		tiff_entry
11075>0	leshort		0x100
11076>>4	lelong		1
11077>>>12	use		tiff_entry
11078>>>8	leshort		x		\b, width=%d
11079>0	leshort		0x101
11080>>4	lelong		1
11081>>>8	leshort		x		\b, height=%d
11082>>>12	use		tiff_entry
11083>0	leshort		0x102
11084>>8	leshort		x		\b, bps=%d
11085>>12	use		tiff_entry
11086>0	leshort		0x103
11087>>4	lelong		1		\b, compression=
11088>>>8	leshort		1		\bnone
11089>>>8	leshort		2		\bhuffman
11090>>>8	leshort		3		\bbi-level group 3
11091>>>8	leshort		4		\bbi-level group 4
11092>>>8	leshort		5		\bLZW
11093>>>8	leshort		6		\bJPEG (old)
11094>>>8	leshort		7		\bJPEG
11095>>>8	leshort		8		\bdeflate
11096>>>8	leshort		9		\bJBIG, ITU-T T.85
11097>>>8	leshort		0xa		\bJBIG, ITU-T T.43
11098>>>8	leshort		0x7ffe		\bNeXT RLE 2-bit
11099>>>8	leshort		0x8005		\bPackBits (Macintosh RLE)
11100>>>8	leshort		0x8029		\bThunderscan RLE
11101>>>8	leshort		0x807f		\bRasterPadding (CT or MP)
11102>>>8	leshort		0x8080		\bRLE (Line Work)
11103>>>8	leshort		0x8081		\bRLE (High-Res Cont-Tone)
11104>>>8	leshort		0x8082		\bRLE (Binary Line Work)
11105>>>8	leshort		0x80b2		\bDeflate (PKZIP)
11106>>>8	leshort		0x80b3		\bKodak DCS
11107>>>8	leshort		0x8765		\bJBIG
11108>>>8	leshort		0x8798		\bJPEG2000
11109>>>8	leshort		0x8799		\bNikon NEF Compressed
11110>>>8	default		x
11111>>>>8	leshort		x		\b(unknown 0x%x)
11112>>>12	use		tiff_entry
11113>0	leshort		0x106		\b, PhotometricIntepretation=
11114>>8	clear		x
11115>>8	leshort		0		\bWhiteIsZero
11116>>8	leshort		1		\bBlackIsZero
11117>>8	leshort		2		\bRGB
11118>>8	leshort		3		\bRGB Palette
11119>>8	leshort		4		\bTransparency Mask
11120>>8	leshort		5		\bCMYK
11121>>8	leshort		6		\bYCbCr
11122>>8	leshort		8		\bCIELab
11123>>8	default		x
11124>>>8	leshort		x		\b(unknown=0x%x)
11125>>12	use		tiff_entry
11126# FillOrder
11127>0	leshort		0x10a
11128>>4	lelong		1
11129>>>12	use		tiff_entry
11130# DocumentName
11131>0	leshort		0x10d
11132>>(8.l)	string		x		\b, name=%s
11133>>>12	use		tiff_entry
11134# ImageDescription
11135>0	leshort		0x10e
11136>>(8.l)	string		x		\b, description=%s
11137>>>12	use		tiff_entry
11138# Make
11139>0	leshort		0x10f
11140>>(8.l)	string		x		\b, manufacturer=%s
11141>>>12	use		tiff_entry
11142# Model
11143>0	leshort		0x110
11144>>(8.l)	string		x		\b, model=%s
11145>>>12	use		tiff_entry
11146# StripOffsets
11147>0	leshort		0x111
11148>>12	use		tiff_entry
11149# Orientation
11150>0	leshort		0x112		\b, orientation=
11151>>8	leshort		1		\bupper-left
11152>>8	leshort		3		\blower-right
11153>>8	leshort		6		\bupper-right
11154>>8	leshort		8		\blower-left
11155>>8	leshort		9		\bundefined
11156>>8	default		x
11157>>>8	leshort		x		\b[*%d*]
11158>>12	use		tiff_entry
11159# XResolution
11160>0	leshort		0x11a
11161>>8	lelong		x		\b, xresolution=%d
11162>>12	use		tiff_entry
11163# YResolution
11164>0	leshort		0x11b
11165>>8	lelong		x		\b, yresolution=%d
11166>>12	use		tiff_entry
11167# ResolutionUnit
11168>0	leshort		0x128
11169>>8	leshort		x		\b, resolutionunit=%d
11170>>12	use		tiff_entry
11171# Software
11172>0	leshort		0x131
11173>>(8.l)	string		x		\b, software=%s
11174>>12	use		tiff_entry
11175# Datetime
11176>0	leshort		0x132
11177>>(8.l)	string		x		\b, datetime=%s
11178>>12	use		tiff_entry
11179# HostComputer
11180>0	leshort		0x13c
11181>>(8.l)	string		x		\b, hostcomputer=%s
11182>>12	use		tiff_entry
11183# WhitePoint
11184>0	leshort		0x13e
11185>>12	use		tiff_entry
11186# PrimaryChromaticities
11187>0	leshort		0x13f
11188>>12	use		tiff_entry
11189# YCbCrCoefficients
11190>0	leshort		0x211
11191>>12	use		tiff_entry
11192# YCbCrPositioning
11193>0	leshort		0x213
11194>>12	use		tiff_entry
11195# ReferenceBlackWhite
11196>0	leshort		0x214
11197>>12	use		tiff_entry
11198# Copyright
11199>0	leshort		0x8298
11200>>(8.l)	string		x		\b, copyright=%s
11201>>12	use		tiff_entry
11202# ExifOffset
11203>0	leshort		0x8769
11204>>12	use		tiff_entry
11205# GPS IFD
11206>0	leshort		0x8825		\b, GPS-Data
11207>>12	use		tiff_entry
11208
11209#>0	leshort		x		\b, unknown=0x%x
11210#>>12	use		tiff_entry
11211
112120	string		MM\x00\x2b	Big TIFF image data, big-endian
11213!:mime	image/tiff
112140	string		II\x2b\x00	Big TIFF image data, little-endian
11215!:mime	image/tiff
11216
11217# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
11218# (Greg Roelofs, newt@uchicago.edu)
11219# (Albert Cahalan, acahalan@cs.uml.edu)
11220#
11221# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
11222#
112230	string		\x89PNG\x0d\x0a\x1a\x0a		PNG image data
11224!:mime	image/png
11225>16	belong		x		\b, %d x
11226>20	belong		x		%d,
11227>24	byte		x		%d-bit
11228>25	byte		0		grayscale,
11229>25	byte		2		\b/color RGB,
11230>25	byte		3		colormap,
11231>25	byte		4		gray+alpha,
11232>25	byte		6		\b/color RGBA,
11233#>26	byte		0		deflate/32K,
11234>28	byte		0		non-interlaced
11235>28	byte		1		interlaced
11236
11237# possible GIF replacements; none yet released!
11238# (Greg Roelofs, newt@uchicago.edu)
11239#
11240# GRR 950115:  this was mine ("Zip GIF"):
112410	string		GIF94z		ZIF image (GIF+deflate alpha)
11242!:mime	image/x-unknown
11243#
11244# GRR 950115:  this is Jeremy Wohl's Free Graphics Format (better):
11245#
112460	string		FGF95a		FGF image (GIF+deflate beta)
11247!:mime	image/x-unknown
11248#
11249# GRR 950115:  this is Thomas Boutell's Portable Bitmap Format proposal
11250# (best; not yet implemented):
11251#
112520	string		PBF		PBF image (deflate compression)
11253!:mime	image/x-unknown
11254
11255# GIF
112560	string		GIF8		GIF image data
11257!:mime	image/gif
11258!:apple	8BIMGIFf
11259>4	string		7a		\b, version 8%s,
11260>4	string		9a		\b, version 8%s,
11261>6	leshort		>0		%d x
11262>8	leshort		>0		%d
11263#>10	byte		&0x80		color mapped,
11264#>10	byte&0x07	=0x00		2 colors
11265#>10	byte&0x07	=0x01		4 colors
11266#>10	byte&0x07	=0x02		8 colors
11267#>10	byte&0x07	=0x03		16 colors
11268#>10	byte&0x07	=0x04		32 colors
11269#>10	byte&0x07	=0x05		64 colors
11270#>10	byte&0x07	=0x06		128 colors
11271#>10	byte&0x07	=0x07		256 colors
11272
11273# ITC (CMU WM) raster files.  It is essentially a byte-reversed Sun raster,
11274# 1 plane, no encoding.
112750	string		\361\0\100\273	CMU window manager raster image data
11276>4	lelong		>0		%d x
11277>8	lelong		>0		%d,
11278>12	lelong		>0		%d-bit
11279
11280# Magick Image File Format
112810	string		id=ImageMagick	MIFF image data
11282
11283# Artisan
112840	long		1123028772	Artisan image data
11285>4	long		1		\b, rectangular 24-bit
11286>4	long		2		\b, rectangular 8-bit with colormap
11287>4	long		3		\b, rectangular 32-bit (24-bit with matte)
11288
11289# FIG (Facility for Interactive Generation of figures), an object-based format
112900	search/1	#FIG		FIG image text
11291>5	string		x		\b, version %.3s
11292
11293# PHIGS
112940	string		ARF_BEGARF		PHIGS clear text archive
112950	string		@(#)SunPHIGS		SunPHIGS
11296# version number follows, in the form m.n
11297>40	string		SunBin			binary
11298>32	string		archive			archive
11299
11300# GKS (Graphics Kernel System)
113010	string		GKSM		GKS Metafile
11302>24	string		SunGKS		\b, SunGKS
11303
11304# CGM image files
113050	string		BEGMF		clear text Computer Graphics Metafile
11306
11307# MGR bitmaps  (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
113080	string	yz	MGR bitmap, modern format, 8-bit aligned
113090	string	zz	MGR bitmap, old format, 1-bit deep, 16-bit aligned
113100	string	xz	MGR bitmap, old format, 1-bit deep, 32-bit aligned
113110	string	yx	MGR bitmap, modern format, squeezed
11312
11313# Fuzzy Bitmap (FBM) images
113140	string		%bitmap\0	FBM image data
11315>30	long		0x31		\b, mono
11316>30	long		0x33		\b, color
11317
11318# facsimile data
113191	string		PC\ Research,\ Inc	group 3 fax data
11320>29	byte		0		\b, normal resolution (204x98 DPI)
11321>29	byte		1		\b, fine resolution (204x196 DPI)
11322# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at>
113230	string		Sfff		structured fax file
11324
11325# From: Joerg Jenderek <joerg.jen.der.ek@gmx.net>
11326# most files with the extension .EPA and some with .BMP
113270	string		\x11\x06	Award BIOS Logo, 136 x 84
11328!:mime	image/x-award-bioslogo
113290	string		\x11\x09	Award BIOS Logo, 136 x 126
11330!:mime	image/x-award-bioslogo
11331#0	string		\x07\x1f	BIOS Logo corrupted?
11332# http://www.blackfiveservices.co.uk/awbmtools.shtml
11333# http://biosgfx.narod.ru/v3/
11334# http://biosgfx.narod.ru/abr-2/
113350	string		AWBM
11336>4	leshort		<1981		Award BIOS bitmap
11337!:mime	image/x-award-bmp
11338# image width is a multiple of 4
11339>>4	leshort&0x0003	0
11340>>>4		leshort	x		\b, %d
11341>>>6		leshort	x		x %d
11342>>4	leshort&0x0003	>0		\b,
11343>>>4	leshort&0x0003	=1
11344>>>>4		leshort	x		%d+3
11345>>>4	leshort&0x0003	=2
11346>>>>4		leshort	x		%d+2
11347>>>4	leshort&0x0003	=3
11348>>>>4		leshort	x		%d+1
11349>>>6		leshort	x		x %d
11350# at offset 8 starts imagedata followed by "RGB " marker
11351
11352# PC bitmaps (OS/2, Windows BMP files)  (Greg Roelofs, newt@uchicago.edu)
11353# http://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\
11354# 28bitmap_information_header.29
113550	string		BM
11356>14	leshort		12		PC bitmap, OS/2 1.x format
11357!:mime	image/x-ms-bmp
11358>>18	leshort		x		\b, %d x
11359>>20	leshort		x		%d
11360>14	leshort		64		PC bitmap, OS/2 2.x format
11361!:mime	image/x-ms-bmp
11362>>18	leshort		x		\b, %d x
11363>>20	leshort		x		%d
11364>14	leshort		40		PC bitmap, Windows 3.x format
11365!:mime	image/x-ms-bmp
11366>>18	lelong		x		\b, %d x
11367>>22	lelong		x		%d x
11368>>28	leshort		x		%d
11369>14	leshort		124		PC bitmap, Windows 98/2000 and newer format
11370!:mime	image/x-ms-bmp
11371>>18	lelong		x		\b, %d x
11372>>22	lelong		x		%d x
11373>>28	leshort		x		%d
11374>14	leshort		108		PC bitmap, Windows 95/NT4 and newer format
11375!:mime	image/x-ms-bmp
11376>>18	lelong		x		\b, %d x
11377>>22	lelong		x		%d x
11378>>28	leshort		x		%d
11379>14	leshort		128		PC bitmap, Windows NT/2000 format
11380!:mime	image/x-ms-bmp
11381>>18	lelong		x		\b, %d x
11382>>22	lelong		x		%d x
11383>>28	leshort		x		%d
11384# Too simple - MPi
11385#0	string		IC		PC icon data
11386#0	string		PI		PC pointer image data
11387#0	string		CI		PC color icon data
11388#0	string		CP		PC color pointer image data
11389# Conflicts with other entries [BABYL]
11390#0	string		BA		PC bitmap array data
11391
11392# XPM icons (Greg Roelofs, newt@uchicago.edu)
113930	search/1	/*\ XPM\ */	X pixmap image text
11394!:mime	image/x-xpmi
11395
11396# Utah Raster Toolkit RLE images (janl@ifi.uio.no)
113970	leshort		0xcc52		RLE image data,
11398>6	leshort		x		%d x
11399>8	leshort		x		%d
11400>2	leshort		>0		\b, lower left corner: %d
11401>4	leshort		>0		\b, lower right corner: %d
11402>10	byte&0x1	=0x1		\b, clear first
11403>10	byte&0x2	=0x2		\b, no background
11404>10	byte&0x4	=0x4		\b, alpha channel
11405>10	byte&0x8	=0x8		\b, comment
11406>11	byte		>0		\b, %d color channels
11407>12	byte		>0		\b, %d bits per pixel
11408>13	byte		>0		\b, %d color map channels
11409
11410# image file format (Robert Potter, potter@cs.rochester.edu)
114110	string		Imagefile\ version-	iff image data
11412# this adds the whole header (inc. version number), informative but longish
11413>10	string		>\0		%s
11414
11415# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
114160	belong		0x59a66a95	Sun raster image data
11417>4	belong		>0		\b, %d x
11418>8	belong		>0		%d,
11419>12	belong		>0		%d-bit,
11420#>16	belong		>0		%d bytes long,
11421>20	belong		0		old format,
11422#>20	belong		1		standard,
11423>20	belong		2		compressed,
11424>20	belong		3		RGB,
11425>20	belong		4		TIFF,
11426>20	belong		5		IFF,
11427>20	belong		0xffff		reserved for testing,
11428>24	belong		0		no colormap
11429>24	belong		1		RGB colormap
11430>24	belong		2		raw colormap
11431#>28	belong		>0		colormap is %d bytes long
11432
11433# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
11434#
11435# See
11436#	http://reality.sgi.com/grafica/sgiimage.html
11437#
114380	beshort		474		SGI image data
11439#>2	byte		0		\b, verbatim
11440>2	byte		1		\b, RLE
11441#>3	byte		1		\b, normal precision
11442>3	byte		2		\b, high precision
11443>4	beshort		x		\b, %d-D
11444>6	beshort		x		\b, %d x
11445>8	beshort		x		%d
11446>10	beshort		x		\b, %d channel
11447>10	beshort		!1		\bs
11448>80	string		>0		\b, "%s"
11449
114500	string		IT01		FIT image data
11451>4	belong		x		\b, %d x
11452>8	belong		x		%d x
11453>12	belong		x		%d
11454#
114550	string		IT02		FIT image data
11456>4	belong		x		\b, %d x
11457>8	belong		x		%d x
11458>12	belong		x		%d
11459#
114602048	string		PCD_IPI		Kodak Photo CD image pack file
11461>0xe02	byte&0x03	0x00		, landscape mode
11462>0xe02	byte&0x03	0x01		, portrait mode
11463>0xe02	byte&0x03	0x02		, landscape mode
11464>0xe02	byte&0x03	0x03		, portrait mode
114650	string		PCD_OPA		Kodak Photo CD overview pack file
11466
11467# FITS format.  Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
11468# FITS is the Flexible Image Transport System, the de facto standard for
11469# data and image transfer, storage, etc., for the astronomical community.
11470# (FITS floating point formats are big-endian.)
114710	string	SIMPLE\ \ =	FITS image data
11472>109	string	8		\b, 8-bit, character or unsigned binary integer
11473>108	string	16		\b, 16-bit, two's complement binary integer
11474>107	string	\ 32		\b, 32-bit, two's complement binary integer
11475>107	string	-32		\b, 32-bit, floating point, single precision
11476>107	string	-64		\b, 64-bit, floating point, double precision
11477
11478# other images
114790	string	This\ is\ a\ BitMap\ file	Lisp Machine bit-array-file
11480
11481# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
11482# stuff.
11483#
114840	beshort		0x1010		PEX Binary Archive
11485
11486# DICOM medical imaging data
11487128	string	DICM			DICOM medical imaging data
11488!:mime	application/dicom
11489
11490# XWD - X Window Dump file.
11491#   As described in /usr/X11R6/include/X11/XWDFile.h
11492#   used by the xwd program.
11493#   Bradford Castalia, idaeim, 1/01
11494#   updated by Adam Buchbinder, 2/09
11495# The following assumes version 7 of the format; the first long is the length
11496# of the header, which is at least 25 4-byte longs, and the one at offset 8
11497# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth,
11498# which is a maximum of 32.
114990	belong	>100
11500>8	belong	<3
11501>>12	belong	<33
11502>>>4	belong	7			XWD X Window Dump image data
11503!:mime	image/x-xwindowdump
11504>>>>100	string	>\0			\b, "%s"
11505>>>>16	belong	x			\b, %dx
11506>>>>20	belong	x			\b%dx
11507>>>>12	belong	x			\b%d
11508
11509# PDS - Planetary Data System
11510#   These files use Parameter Value Language in the header section.
11511#   Unfortunately, there is no certain magic, but the following
11512#   strings have been found to be most likely.
115130	string	NJPL1I00		PDS (JPL) image data
115142	string	NJPL1I			PDS (JPL) image data
115150	string	CCSD3ZF			PDS (CCSD) image data
115162	string	CCSD3Z			PDS (CCSD) image data
115170	string	PDS_			PDS image data
115180	string	LBLSIZE=		PDS (VICAR) image data
11519
11520# pM8x: ATARI STAD compressed bitmap format
11521#
11522# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001
11523# p M 8 5/6 xx yy zz data...
11524# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed.
11525# bytes either run horizontally (pM85) or vertically (pM86). yy is the
11526# most frequent byte, xx and zz are runlength escape codes, where xx is
11527# used for runs of yy.
11528#
115290	string	pM85		Atari ST STAD bitmap image data (hor)
11530>5	byte	0x00		(white background)
11531>5	byte	0xFF		(black background)
115320	string	pM86		Atari ST STAD bitmap image data (vert)
11533>5	byte	0x00		(white background)
11534>5	byte	0xFF		(black background)
11535
11536# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
11537# http://www.atarimax.com/jindroush.atari.org/afmtatr.html
115380	leshort	0x0296		Atari ATR image
11539
11540# XXX:
11541# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other
11542# magic.
11543# SGI RICE image file <mpruett@sgi.com>
11544#0	beshort	0x5249		RICE image
11545#>2	beshort	x		v%d
11546#>4	beshort	x		(%d x
11547#>6	beshort	x		%d)
11548#>8	beshort	0		8 bit
11549#>8	beshort	1		10 bit
11550#>8	beshort	2		12 bit
11551#>8	beshort	3		13 bit
11552#>10	beshort	0		4:2:2
11553#>10	beshort	1		4:2:2:4
11554#>10	beshort	2		4:4:4
11555#>10	beshort	3		4:4:4:4
11556#>12	beshort	1		RGB
11557#>12	beshort	2		CCIR601
11558#>12	beshort	3		RP175
11559#>12	beshort	4		YUV
11560
11561# PCX image files
11562# From: Dan Fandrich <dan@coneharvesters.com>
11563# updated by Joerg Jenderek at Feb 2013 by http://de.wikipedia.org/wiki/PCX
11564# http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
11565# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000
11566# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT
115670	ubelong&0xffF8fe00	0x0a000000
11568# for PCX bit depth > 0
11569>3	ubyte		>0
11570# test for valid versions
11571>>1	ubyte		<6
11572>>>1	ubyte		!1	PCX
11573!:mime	image/x-pcx
11574#!:mime	image/pcx
11575>>>>1	ubyte		0	ver. 2.5 image data
11576>>>>1	ubyte		2	ver. 2.8 image data, with palette
11577>>>>1	ubyte		3	ver. 2.8 image data, without palette
11578>>>>1	ubyte		4	for Windows image data
11579>>>>1	ubyte		5	ver. 3.0 image data
11580>>>>4	uleshort	x	bounding box [%d,
11581>>>>6	uleshort	x	%d] -
11582>>>>8	uleshort	x	[%d,
11583>>>>10	uleshort	x	%d],
11584>>>>65	ubyte		>1	%d planes each of
11585>>>>3	ubyte		x	%d-bit
11586>>>>68	byte		1	colour,
11587>>>>68	byte		2	grayscale,
11588# this should not happen
11589>>>>68	default		x	image,
11590>>>>12	leshort		>0	%d x
11591>>>>>14	uleshort	x	%d dpi,
11592>>>>2	byte		0	uncompressed
11593>>>>2	byte		1	RLE compressed
11594
11595# Adobe Photoshop
11596# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
115970	string		8BPS Adobe Photoshop Image
11598!:mime	image/vnd.adobe.photoshop
11599>4   beshort 2 (PSB)
11600>18  belong  x \b, %d x
11601>14  belong  x %d,
11602>24  beshort 0 bitmap
11603>24  beshort 1 grayscale
11604>>12 beshort 2 with alpha
11605>24  beshort 2 indexed
11606>24  beshort 3 RGB
11607>>12 beshort 4 \bA
11608>24  beshort 4 CMYK
11609>>12 beshort 5 \bA
11610>24  beshort 7 multichannel
11611>24  beshort 8 duotone
11612>24  beshort 9 lab
11613>12  beshort > 1
11614>>12  beshort x \b, %dx
11615>12  beshort 1 \b,
11616>22  beshort x %d-bit channel
11617>12  beshort > 1 \bs
11618
11619# XV thumbnail indicator (ThMO)
116200	string		P7\ 332		XV thumbnail image data
11621
11622# NITF is defined by United States MIL-STD-2500A
116230	string	NITF	National Imagery Transmission Format
11624>25	string	>\0	dated %.14s
11625
11626# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
11627# Format variations from: Bernd Nuernberger <bernd.nuernberger@web.de>
11628# See http://fileformats.archiveteam.org/wiki/GEM_Raster
11629# For variations, also see:
11630#    http://www.seasip.info/Gem/ff_img.html (Ventura)
11631#    http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT)
11632#    http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT)
11633#    http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG)
116340       beshort     0x0001
11635>2      beshort     0x0008      GEM Image data
11636>>0     use gem_info
11637>2      beshort     0x0009      GEM Image data (Ventura)
11638>>0     use gem_info
1163916      string      XIMG\0      GEM XIMG Image data
11640>0      use gem_info
1164116      string      STTT\0\x10  GEM STTT Image data
11642>0      use gem_info
1164316      string      TIMG\0      GEM TIMG Image data
11644>0      use gem_info
11645
116460   name        gem_info
11647>12	beshort		x		%d x
11648>14	beshort		x		%d,
11649>4	beshort		x		%d planes,
11650>8	beshort		x		%d x
11651>10	beshort		x		%d pixelsize
11652
11653# GEM Metafile (Wolfram Kleff)
116540	lelong		0x0018FFFF	GEM Metafile data
11655>4	leshort		x		version %d
11656
11657#
11658# SMJPEG. A custom Motion JPEG format used by Loki Entertainment
11659# Software Torbjorn Andersson <d91tan@Update.UU.SE>.
11660#
116610	string	\0\nSMJPEG	SMJPEG
11662>8	belong	x		%d.x data
11663# According to the specification you could find any number of _TXT
11664# headers here, but I can't think of any way of handling that. None of
11665# the SMJPEG files I tried it on used this feature. Even if such a
11666# file is encountered the output should still be reasonable.
11667>16	string	_SND		\b,
11668>>24	beshort	>0		%d Hz
11669>>26	byte	8		8-bit
11670>>26	byte	16		16-bit
11671>>28	string	NONE		uncompressed
11672# >>28	string	APCM		ADPCM compressed
11673>>27	byte	1		mono
11674>>28	byte	2		stereo
11675# Help! Isn't there any way to avoid writing this part twice?
11676>>32	string	_VID		\b,
11677# >>>48	string	JFIF		JPEG
11678>>>40	belong	>0		%d frames
11679>>>44	beshort	>0		(%d x
11680>>>46	beshort	>0		%d)
11681>16	string	_VID		\b,
11682# >>32	string	JFIF		JPEG
11683>>24	belong	>0		%d frames
11684>>28	beshort	>0		(%d x
11685>>30	beshort	>0		%d)
11686
116870	string	Paint\ Shop\ Pro\ Image\ File	Paint Shop Pro Image File
11688
11689# "thumbnail file" (icon)
11690# descended from "xv", but in use by other applications as well (Wolfram Kleff)
116910       string          P7\ 332         XV "thumbnail file" (icon) data
11692
11693# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?)
116940       string          KiSS            KISS/GS
11695>4      byte            16              color
11696>>5     byte            x               %d bit
11697>>8     leshort         x               %d colors
11698>>10    leshort         x               %d groups
11699>4      byte            32              cell
11700>>5     byte            x               %d bit
11701>>8     leshort         x               %d x
11702>>10    leshort         x               %d
11703>>12    leshort         x               +%d
11704>>14    leshort         x               +%d
11705
11706# Webshots (www.webshots.com), by John Harrison
117070       string          C\253\221g\230\0\0\0 Webshots Desktop .wbz file
11708
11709# Hercules DASD image files
11710# From Jan Jaeger <jj@septa.nl>
117110       string  CKD_P370        Hercules CKD DASD image file
11712>8      long    x               \b, %d heads per cylinder
11713>12     long    x               \b, track size %d bytes
11714>16     byte    x               \b, device type 33%2.2X
11715
117160       string  CKD_C370        Hercules compressed CKD DASD image file
11717>8      long    x               \b, %d heads per cylinder
11718>12     long    x               \b, track size %d bytes
11719>16     byte    x               \b, device type 33%2.2X
11720
117210       string  CKD_S370        Hercules CKD DASD shadow file
11722>8      long    x               \b, %d heads per cylinder
11723>12     long    x               \b, track size %d bytes
11724>16     byte    x               \b, device type 33%2.2X
11725
11726# Squeak images and programs - etoffi@softhome.net
117270	string		\146\031\0\0	Squeak image data
117280	search/1	'From\040Squeak	Squeak program text
11729
11730# partimage: file(1) magic for PartImage files (experimental, incomplete)
11731# Author: Hans-Joachim Baader <hjb@pro-linux.de>
117320		string	PaRtImAgE-VoLuMe	PartImage
11733>0x0020		string	0.6.1		file version %s
11734>>0x0060	lelong	>-1		volume %d
11735#>>0x0064 8 byte identifier
11736#>>0x007c reserved
11737>>0x0200	string	>\0		type %s
11738>>0x1400	string	>\0		device %s,
11739>>0x1600	string	>\0		original filename %s,
11740# Some fields omitted
11741>>0x2744	lelong	0		not compressed
11742>>0x2744	lelong	1		gzip compressed
11743>>0x2744	lelong	2		bzip2 compressed
11744>>0x2744	lelong	>2		compressed with unknown algorithm
11745>0x0020		string	>0.6.1		file version %s
11746>0x0020		string	<0.6.1		file version %s
11747
11748# DCX is multi-page PCX, using a simple header of up to 1024
11749# offsets for the respective PCX components.
11750# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de>
117510	lelong	987654321	DCX multi-page PCX image data
11752
11753# Simon Walton <simonw@matteworld.com>
11754# Kodak Cineon format for scanned negatives
11755# http://www.kodak.com/US/en/motion/support/dlad/
117560	lelong  0xd75f2a80	Cineon image data
11757>200	belong  >0		\b, %d x
11758>204	belong  >0		%d
11759
11760
11761# Bio-Rad .PIC is an image format used by microscope control systems
11762# and related image processing software used by biologists.
11763# From: Vebjorn Ljosa <vebjorn@ljosa.com>
11764# BOOL values are two-byte integers; use them to rule out false positives.
11765# http://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt
11766# Samples: http://www.loci.wisc.edu/software/sample-data
1176714	leshort <2
11768>62	leshort <2
11769>>54	leshort 12345		Bio-Rad .PIC Image File
11770>>>0	leshort >0		%d x
11771>>>2	leshort >0		%d,
11772>>>4	leshort =1		1 image in file
11773>>>4	leshort >1		%d images in file
11774
11775# From Jan "Yenya" Kasprzak <kas@fi.muni.cz>
11776# The description of *.mrw format can be found at
11777# http://www.dalibor.cz/minolta/raw_file_format.htm
117780	string	\000MRM			Minolta Dimage camera raw image data
11779
11780# Summary: DjVu image / document
11781# Extension: .djvu
11782# Reference: http://djvu.org/docs/DjVu3Spec.djvu
11783# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr>
11784# Modified by (1): Abel Cheung <abelcheung@gmail.com>
117850	string	AT&TFORM
11786>12	string	DJVM		DjVu multiple page document
11787!:mime	image/vnd.djvu
11788>12	string	DJVU		DjVu image or single page document
11789!:mime	image/vnd.djvu
11790>12	string	DJVI		DjVu shared document
11791!:mime	image/vnd.djvu
11792>12	string	THUM		DjVu page thumbnails
11793!:mime	image/vnd.djvu
11794
11795# Originally by Marc Espie
11796# Modified by Robert Minsk <robertminsk at yahoo.com>
11797# http://www.openexr.com/openexrfilelayout.pdf
117980	lelong		20000630	OpenEXR image data,
11799!:mime image/x-exr
11800>4	lelong&0x000000ff x		version %d,
11801>4	lelong		^0x00000200	storage: scanline
11802>4	lelong		&0x00000200	storage: tiled
11803>8	search/0x1000	compression\0	\b, compression:
11804>>&16	byte		0		none
11805>>&16	byte		1		rle
11806>>&16	byte		2		zips
11807>>&16	byte		3		zip
11808>>&16	byte		4		piz
11809>>&16	byte		5		pxr24
11810>>&16	byte		6		b44
11811>>&16	byte		7		b44a
11812>>&16	byte		>7		unknown
11813>8	 search/0x1000	dataWindow\0	\b, dataWindow:
11814>>&10	lelong		x		(%d
11815>>&14	lelong		x		%d)-
11816>>&18	lelong		x		\b(%d
11817>>&22	lelong		x		%d)
11818>8	search/0x1000	displayWindow\0	\b, displayWindow:
11819>>&10	lelong		x		(%d
11820>>&14	lelong		x		%d)-
11821>>&18	lelong		x		\b(%d
11822>>&22	lelong		x		%d)
11823>8	search/0x1000	lineOrder\0	 \b, lineOrder:
11824>>&14	byte		0		increasing y
11825>>&14	byte		1		decreasing y
11826>>&14	byte		2		random y
11827>>&14	byte		>2		unknown
11828
11829# SMPTE Digital Picture Exchange Format, SMPTE DPX
11830#
11831# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital
11832# Moving-Picture Exchange (DPX), v1.0, 18 February 1994
11833# Robert Minsk <robertminsk at yahoo.com>
118340	string		SDPX	DPX image data, big-endian,
11835!:mime image/x-dpx
11836>768	beshort		<4
11837>>772	belong		x	%dx
11838>>776	belong		x	\b%d,
11839>768	beshort		>3
11840>>776	belong		x	%dx
11841>>772	belong		x	\b%d,
11842>768	beshort		0	left to right/top to bottom
11843>768	beshort		1	right to left/top to bottom
11844>768	beshort		2	left to right/bottom to top
11845>768	beshort		3	right to left/bottom to top
11846>768	beshort		4	top to bottom/left to right
11847>768	beshort		5	top to bottom/right to left
11848>768	leshort		6	bottom to top/left to right
11849>768	leshort		7	bottom to top/right to left
11850
11851# From: Tom Hilinski <tom.hilinski@comcast.net>
11852# http://www.unidata.ucar.edu/packages/netcdf/
118530	string	CDF\001			NetCDF Data Format data
11854
11855#-----------------------------------------------------------------------
11856# Hierarchical Data Format, used to facilitate scientific data exchange
11857# specifications at http://hdf.ncsa.uiuc.edu/
118580	belong	0x0e031301	Hierarchical Data Format (version 4) data
11859!:mime	application/x-hdf
118600	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) data
11861!:mime	application/x-hdf
11862512	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 512 bytes user block
11863!:mime	application/x-hdf
118641024	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 1k user block
11865!:mime	application/x-hdf
118662048	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 2k user block
11867!:mime	application/x-hdf
118684096	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 4k user block
11869!:mime	application/x-hdf
11870
11871
11872# From: Tobias Burnus <burnus@net-b.de>
11873# Xara (for a while: Corel Xara) is a graphic package, see
11874# http://www.xara.com/ for Windows and as GPL application for Linux
118750	string	XARA\243\243	Xara graphics file
11876
11877# http://www.cartesianinc.com/Tech/
118780	string	CPC\262		Cartesian Perceptual Compression image
11879!:mime	image/x-cpi
11880
11881# From Albert Cahalan <acahalan@gmail.com>
11882# puredigital used it for the CVS disposable camcorder
11883#8       lelong  4       ZBM bitmap image data
11884#>4      leshort x       %u x
11885#>6      leshort x       %u
11886
11887# From Albert Cahalan <acahalan@gmail.com>
11888# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons
118890       string C565     OLPC firmware icon image data
11890>4      leshort x       %u x
11891>6      leshort x       %u
11892
11893# Applied Images - Image files from Cytovision
11894# Gustavo Junior Alves <gjalves@gjalves.com.br>
118950	string	\xce\xda\xde\xfa	Cytovision Metaphases file
118960	string	\xed\xad\xef\xac	Cytovision Karyotype file
118970	string	\x0b\x00\x03\x00	Cytovision FISH Probe file
118980	string	\xed\xfe\xda\xbe	Cytovision FLEX file
118990	string	\xed\xab\xed\xfe	Cytovision FLEX file
119000	string	\xad\xfd\xea\xad	Cytovision RATS file
11901
11902# Wavelet Scalar Quantization format used in gray-scale fingerprint images
11903# From Tano M Fotang <mfotang@quanteq.com>
119040	string	\xff\xa0\xff\xa8\x00	Wavelet Scalar Quantization image data
11905
11906# Type:		PCO B16 image files
11907# URL:		http://www.pco.de/fileadmin/user_upload/db/download/MA_CWDCOPIE_0412b.pdf
11908# From:		Florian Philipp <florian.philipp@binarywings.net>
11909# Extension:	.b16
11910# Description:	Pixel image format produced by PCO Camware, typically used
11911#		together with PCO cameras.
11912# Note:		Different versions exist for e.g. 8 bit and 16 bit images.
11913#		Documentation is incomplete.
119140	string/b	PCO-	PCO B16 image data
11915>12	lelong		x	\b, %dx
11916>16	lelong		x	\b%d
11917>20	lelong		0	\b, short header
11918>20	lelong		-1	\b, extended header
11919>>24	lelong		0	\b, grayscale
11920>>>36	lelong		0	linear LUT
11921>>>36	lelong		1	logarithmic LUT
11922>>>28	lelong		x	[%d
11923>>>32	lelong		x	\b,%d]
11924>>24	lelong		1	\b, color
11925>>>64	lelong		0	linear LUT
11926>>>64	lelong		1	logarithmic LUT
11927>>>40	lelong		x	r[%d
11928>>>44	lelong		x	\b,%d]
11929>>>48	lelong		x	g[%d
11930>>>52	lelong		x	\b,%d]
11931>>>56	lelong		x	b[%d
11932>>>60	lelong		x	\b,%d]
11933
11934# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches
11935# From: Markus Heidelberg <markus.heidelberg at web.de>
119360	string/t	[BitmapInfo2]	Polar Monitor Bitmap text
11937!:mime	image/x-polar-monitor-bitmap
11938
11939# From: Rick Richardson <rickrich@gmail.com>
119400	string	GARMIN\ BITMAP\ 01	Garmin Bitmap file
11941
11942# Type:	Ulead Photo Explorer5 (.pe5)
11943# URL:	http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese)
11944# From:	Simon Horman <horms@debian.org>
119450	string	IIO2H			Ulead Photo Explorer5
11946
11947# Type:	X11 cursor
11948# URL:	http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup
11949# From:	Mathias Brodala <info@noctus.net>
119500	string	Xcur			X11 cursor
11951
11952# Type:	Olympus ORF raw images.
11953# URL:	http://libopenraw.freedesktop.org/wiki/Olympus_ORF
11954# From:	Adam Buchbinder <adam.buchbinder@gmail.com>
119550	string		MMOR		Olympus ORF raw image data, big-endian
11956!:mime	image/x-olympus-orf
119570	string		IIRO		Olympus ORF raw image data, little-endian
11958!:mime	image/x-olympus-orf
119590	string		IIRS		Olympus ORF raw image data, little-endian
11960!:mime	image/x-olympus-orf
11961
11962# Type: files used in modern AVCHD camcoders to store clip information
11963# Extension: .cpi
11964# From: Alexander Danilov <alexander.a.danilov@gmail.com>
119650	string	HDMV0100	AVCHD Clip Information
11966
11967# From: Adam Buchbinder <adam.buchbinder@gmail.com>
11968# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/
11969# Radiance HDR; usually has .pic or .hdr extension.
119700	string	#?RADIANCE\n	Radiance HDR image data
11971#!mime	image/vnd.radiance
11972
11973# From: Adam Buchbinder <adam.buchbinder@gmail.com>
11974# URL: http://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf
11975# Used by the pfstools packages. The regex matches for the image size could
11976# probably use some work. The MIME type is made up; if there's one in
11977# actual common use, it should replace the one below.
119780	string	PFS1\x0a	PFS HDR image data
11979#!mime	image/x-pfs
11980>1	regex	[0-9]*\ 		\b, %s
11981>>1	regex	\ [0-9]{4}		\bx%s
11982
11983# Type: Foveon X3F
11984# URL:  http://www.photofo.com/downloads/x3f-raw-format.pdf
11985# From: Adam Buchbinder <adam.buchbinder@gmail.com>
11986# Note that the MIME type isn't defined anywhere that I can find; if
11987# there's a canonical type for this format, it should replace this one.
119880	string	FOVb	Foveon X3F raw image data
11989!:mime	image/x-x3f
11990>6	leshort	x	\b, version %d.
11991>4	leshort	x	\b%d
11992>28	lelong	x	\b, %dx
11993>32	lelong	x	\b%d
11994
11995# Paint.NET file
11996# From Adam Buchbinder <adam.buchbinder@gmail.com>
119970	string	PDN3	Paint.NET image data
11998!:mime	image/x-paintnet
11999
12000# Not really an image.
12001# From: "Tano M. Fotang" <mfotang@quanteq.com>
120020	string	\x46\x4d\x52\x00	ISO/IEC 19794-2 Format Minutiae Record (FMR)
12003
12004# doc: http://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip
12005# example: http://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip
1200690	bequad		0x574D50484F544F00	JPEG-XR Image
12007>98	byte&0x08	=0x08			\b, hard tiling
12008>99	byte&0x80	=0x80			\b, tiling present
12009>99	byte&0x40	=0x40			\b, codestream present
12010>99	byte&0x38	x			\b, spatial xform=
12011>99	byte&0x38	0x00			\bTL
12012>99	byte&0x38	0x08			\bBL
12013>99	byte&0x38	0x10			\bTR
12014>99	byte&0x38	0x18			\bBR
12015>99	byte&0x38	0x20			\bBT
12016>99	byte&0x38	0x28			\bRB
12017>99	byte&0x38	0x30			\bLT
12018>99	byte&0x38	0x38			\bLB
12019>100	byte&0x80	=0x80			\b, short header
12020>>102	beshort+1	x			\b, %d
12021>>104	beshort+1	x			\bx%d
12022>100	byte&0x80	=0x00			\b, long header
12023>>102	belong+1	x			\b, %x
12024>>106	belong+1	x			\bx%x
12025>101	beshort&0xf	x			\b, bitdepth=
12026>>101	beshort&0xf	0x0			\b1-WHITE=1
12027>>101	beshort&0xf	0x1			\b8
12028>>101	beshort&0xf	0x2			\b16
12029>>101	beshort&0xf	0x3			\b16-SIGNED
12030>>101	beshort&0xf	0x4			\b16-FLOAT
12031>>101	beshort&0xf	0x5			\b(reserved 5)
12032>>101	beshort&0xf	0x6			\b32-SIGNED
12033>>101	beshort&0xf	0x7			\b32-FLOAT
12034>>101	beshort&0xf	0x8			\b5
12035>>101	beshort&0xf	0x9			\b10
12036>>101	beshort&0xf	0xa			\b5-6-5
12037>>101	beshort&0xf	0xb			\b(reserved %d)
12038>>101	beshort&0xf	0xc			\b(reserved %d)
12039>>101	beshort&0xf	0xd			\b(reserved %d)
12040>>101	beshort&0xf	0xe			\b(reserved %d)
12041>>101	beshort&0xf	0xf			\b1-BLACK=1
12042>101	beshort&0xf0	x			\b, colorfmt=
12043>>101	beshort&0xf0	0x00			\bYONLY
12044>>101	beshort&0xf0	0x10			\bYUV240
12045>>101	beshort&0xf0	0x20			\bYWV422
12046>>101	beshort&0xf0	0x30			\bYWV444
12047>>101	beshort&0xf0	0x40			\bCMYK
12048>>101	beshort&0xf0	0x50			\bCMYKDIRECT
12049>>101	beshort&0xf0	0x60			\bNCOMPONENT
12050>>101	beshort&0xf0	0x70			\bRGB
12051>>101	beshort&0xf0	0x80			\bRGBE
12052>>101	beshort&0xf0	>0x80			\b(reserved 0x%x)
12053
12054# From: Johan van der Knijff <johan.vanderknijff@kb.nl>
12055#
12056# BPG (Better Portable Graphics) format
12057# http://bellard.org/bpg/
12058# http://fileformats.archiveteam.org/wiki/BPG
12059#
120600	string	\x42\x50\x47\xFB	BPG (Better Portable Graphics)
12061!:mime  image/bpg
12062
12063#------------------------------------------------------------------------------
12064# $File$
12065# inform:  file(1) magic for Inform interactive fiction language
12066
12067# URL:  http://www.inform-fiction.org/
12068# From: Reuben Thomas <rrt@sc3d.org>
12069
120700	search/100/cW	constant\ story		Inform source text
12071
12072#------------------------------------------------------------------------------
12073# $File: intel,v 1.11 2013/02/06 14:18:52 christos Exp $
12074# intel:  file(1) magic for x86 Unix
12075#
12076# Various flavors of x86 UNIX executable/object (other than Xenix, which
12077# is in "microsoft").  DOS is in "msdos"; the ambitious soul can do
12078# Windows as well.
12079#
12080# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
12081# whatever comes next (HP-PA Hummingbird?).  OS/2 may also go elsewhere
12082# as well, if, as, and when IBM makes it portable.
12083#
12084# The `versions' should be un-commented if they work for you.
12085# (Was the problem just one of endianness?)
12086#
120870	leshort		0502		basic-16 executable
12088>12	lelong		>0		not stripped
12089#>22	leshort		>0		- version %d
120900	leshort		0503		basic-16 executable (TV)
12091>12	lelong		>0		not stripped
12092#>22	leshort		>0		- version %d
120930	leshort		0510		x86 executable
12094>12	lelong		>0		not stripped
120950	leshort		0511		x86 executable (TV)
12096>12	lelong		>0		not stripped
120970	leshort		=0512		iAPX 286 executable small model (COFF)
12098>12	lelong		>0		not stripped
12099#>22	leshort		>0		- version %d
121000	leshort		=0522		iAPX 286 executable large model (COFF)
12101>12	lelong		>0		not stripped
12102#>22	leshort		>0		- version %d
12103# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
121040	leshort		=0514		80386 COFF executable
12105>12	lelong		>0		not stripped
12106>22	leshort		>0		- version %d
12107
12108# rom: file(1) magic for BIOS ROM Extensions found in intel machines
12109#      mapped into memory between 0xC0000 and 0xFFFFF
12110# From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
121110        beshort         0x55AA       BIOS (ia32) ROM Ext.
12112>5       string          USB          USB
12113>7       string          LDR          UNDI image
12114>30      string          IBM          IBM comp. Video
12115>26      string          Adaptec      Adaptec
12116>28      string          Adaptec      Adaptec
12117>42      string          PROMISE      Promise
12118>2       byte            x            (%d*512)
12119
12120# Flash descriptors for Intel SPI flash roms.
12121# From Dr. Jesus <j@hug.gs>
121220	lelong		0x0ff0a55a	Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step
1212316	lelong		0x0ff0a55a	Intel serial flash for PCH ROM
12124
12125#------------------------------------------------------------------------------
12126# $File$
12127# interleaf:  file(1) magic for InterLeaf TPS:
12128#
121290	string		=\210OPS	Interleaf saved data
121300	string		=<!OPS		Interleaf document text
12131>5	string		,\ Version\ =	\b, version
12132>>17	string		>\0		%.3s
12133
12134#------------------------------------------------------------------------------
12135# $File$
12136# island:  file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
12137# "/etc/magic":
12138# From: guy@netapp.com (Guy Harris)
12139#
121404	string		pgscriptver	IslandWrite document
1214113	string		DrawFile	IslandDraw document
12142
12143
12144#------------------------------------------------------------------------------
12145# $File$
12146# ispell:  file(1) magic for ispell
12147#
12148# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602.  This magic
12149# will match 0x9600 through 0x9603 in *both* little endian and big endian.
12150# (No other current magic entries collide.)
12151#
12152# Updated by Daniel Quinlan (quinlan@yggdrasil.com)
12153#
121540	leshort&0xFFFC	0x9600		little endian ispell
12155>0	byte		0		hash file (?),
12156>0	byte		1		3.0 hash file,
12157>0	byte		2		3.1 hash file,
12158>0	byte		3		hash file (?),
12159>2	leshort		0x00		8-bit, no capitalization, 26 flags
12160>2	leshort		0x01		7-bit, no capitalization, 26 flags
12161>2	leshort		0x02		8-bit, capitalization, 26 flags
12162>2	leshort		0x03		7-bit, capitalization, 26 flags
12163>2	leshort		0x04		8-bit, no capitalization, 52 flags
12164>2	leshort		0x05		7-bit, no capitalization, 52 flags
12165>2	leshort		0x06		8-bit, capitalization, 52 flags
12166>2	leshort		0x07		7-bit, capitalization, 52 flags
12167>2	leshort		0x08		8-bit, no capitalization, 128 flags
12168>2	leshort		0x09		7-bit, no capitalization, 128 flags
12169>2	leshort		0x0A		8-bit, capitalization, 128 flags
12170>2	leshort		0x0B		7-bit, capitalization, 128 flags
12171>2	leshort		0x0C		8-bit, no capitalization, 256 flags
12172>2	leshort		0x0D		7-bit, no capitalization, 256 flags
12173>2	leshort		0x0E		8-bit, capitalization, 256 flags
12174>2	leshort		0x0F		7-bit, capitalization, 256 flags
12175>4	leshort		>0		and %d string characters
121760	beshort&0xFFFC	0x9600		big endian ispell
12177>1	byte		0		hash file (?),
12178>1	byte		1		3.0 hash file,
12179>1	byte		2		3.1 hash file,
12180>1	byte		3		hash file (?),
12181>2	beshort		0x00		8-bit, no capitalization, 26 flags
12182>2	beshort		0x01		7-bit, no capitalization, 26 flags
12183>2	beshort		0x02		8-bit, capitalization, 26 flags
12184>2	beshort		0x03		7-bit, capitalization, 26 flags
12185>2	beshort		0x04		8-bit, no capitalization, 52 flags
12186>2	beshort		0x05		7-bit, no capitalization, 52 flags
12187>2	beshort		0x06		8-bit, capitalization, 52 flags
12188>2	beshort		0x07		7-bit, capitalization, 52 flags
12189>2	beshort		0x08		8-bit, no capitalization, 128 flags
12190>2	beshort		0x09		7-bit, no capitalization, 128 flags
12191>2	beshort		0x0A		8-bit, capitalization, 128 flags
12192>2	beshort		0x0B		7-bit, capitalization, 128 flags
12193>2	beshort		0x0C		8-bit, no capitalization, 256 flags
12194>2	beshort		0x0D		7-bit, no capitalization, 256 flags
12195>2	beshort		0x0E		8-bit, capitalization, 256 flags
12196>2	beshort		0x0F		7-bit, capitalization, 256 flags
12197>4	beshort		>0		and %d string characters
12198# ispell 4.0 hash files  kromJx <kromJx@crosswinds.net>
12199# Ispell 4.0
122000       string          ISPL            ispell
12201>4      long            x               hash file version %d,
12202>8      long            x               lexletters %d,
12203>12     long            x               lexsize %d,
12204>16     long            x               hashsize %d,
12205>20     long            x               stblsize %d
12206
12207#------------------------------------------------------------------------------
12208# $File: isz,v 1.2 2014/04/28 12:04:50 christos Exp $
12209# ISO Zipped file format
12210# http://www.ezbsystems.com/isz/iszspec.txt
122110	string	IsZ!	ISO Zipped file
12212>4	byte	x	\b, header size %u
12213>5	byte	x	\b, version %u
12214>8	lelong	x	\b, serial %u
12215#12	leshort	x	\b, sector size %u
12216#>16	lelong	x	\b, total sectors %u
12217>17	byte	>0	\b, password protected
12218#>24	lequad	x	\b, segment size %llu
12219#>32	lelong	x	\b, blocks %u
12220#>36	lelong	x	\b, block size %u
12221
12222#------------------------------------------------------------
12223# $File: java,v 1.15 2013/08/14 09:10:36 christos Exp $
12224# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
12225# same magic number, 0xcafebabe, so they are both handled
12226# in the entry called "cafebabe".
12227#------------------------------------------------------------
12228# Java serialization
12229# From Martin Pool (m.pool@pharos.com.au)
122300	beshort		0xaced		Java serialization data
12231>2	beshort		>0x0004		\b, version %d
12232
122330	belong		0xfeedfeed	Java KeyStore
12234!:mime	application/x-java-keystore
122350	belong		0xcececece	Java JCE KeyStore
12236!:mime	application/x-java-jce-keystore
12237
12238# Java source
122390	regex	^import.*;$	Java source
12240!:mime	text/x-java
12241
12242#------------------------------------------------------------------------------
12243# $File: $
12244# javascript:  magic for javascript and node.js scripts.
12245#
122460	search/1/w	#!/bin/node		Node.js script text executable
12247!:mime application/javascript
122480	search/1/w	#!/usr/bin/node		Node.js script text executable
12249!:mime application/javascript
122500	search/1/w	#!/bin/nodejs		Node.js script text executable
12251!:mime application/javascript
122520	search/1/w	#!/usr/bin/nodejs	Node.js script text executable
12253!:mime application/javascript
122540	search/1	#!/usr/bin/env\ node	Node.js script text executable
12255!:mime application/javascript
122560	search/1	#!/usr/bin/env\ nodejs	Node.js script text executable
12257!:mime application/javascript
12258
12259#------------------------------------------------------------------------------
12260# $File: jpeg,v 1.26 2015/01/02 22:40:27 christos Exp $
12261# JPEG images
12262# SunOS 5.5.1 had
12263#
12264#	0	string		\377\330\377\340	JPEG file
12265#	0	string		\377\330\377\356	JPG file
12266#
12267# both of which turn into "JPEG image data" here.
12268#
122690	beshort		0xffd8		JPEG image data
12270!:mime	image/jpeg
12271!:apple	8BIMJPEG
12272!:strength *3
12273>6	string		JFIF		\b, JFIF standard
12274# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
12275# in a vain attempt to add image size reporting for JFIF.  Note that these
12276# tests are not fool-proof since some perfectly valid JPEGs are currently
12277# impossible to specify in magic(4) format.
12278# First, a little JFIF version info:
12279>>11	byte		x		\b %d.
12280>>12	byte		x		\b%02d
12281# Next, the resolution or aspect ratio of the image:
12282>>13	byte		0		\b, aspect ratio
12283>>13	byte		1		\b, resolution (DPI)
12284>>13	byte		2		\b, resolution (DPCM)
12285>>14	beshort		x		\b, density %dx
12286>>16	beshort		x		\b%d
12287>>4	beshort		x		\b, segment length %d
12288# Next, show thumbnail info, if it exists:
12289>>18	byte		!0		\b, thumbnail %dx
12290>>>19	byte		x		\b%d
12291>6	string		Exif		\b, Exif standard: [
12292>>12	indirect/r	x
12293>>12	string		x		\b]
12294
12295# Jump to the first segment
12296>(4.S+4)	use		jpeg_segment
12297
12298# This uses recursion...
122990		name		jpeg_segment
12300>0	beshort		0xFFFE
12301# Recursion handled by FFE0
12302#>>(2.S+2)	use			jpeg_segment
12303>>2	pstring/HJ	x		\b, comment: "%s"
12304
12305>0	beshort		0xFFC0
12306>>(2.S+2)	use			jpeg_segment
12307>>4	byte		x		\b, baseline, precision %d
12308>>7	beshort		x		\b, %dx
12309>>5	beshort		x		\b%d
12310>>9	byte		x		\b, frames %d
12311
12312>0	beshort		0xFFC1
12313>>(2.S+2)	use			jpeg_segment
12314>>4	byte		x		\b, extended sequential, precision %d
12315>>7	beshort		x		\b, %dx
12316>>5	beshort		x		\b%d
12317>>9	byte		x		\b, frames %d
12318
12319>0	beshort		0xFFC2
12320>>(2.S+2)	use			jpeg_segment
12321>>4	byte		x		\b, progressive, precision %d
12322>>7	beshort		x		\b, %dx
12323>>5	beshort		x		\b%d
12324>>9	byte		x		\b, frames %d
12325
12326# Define Huffman Tables
12327>0	beshort		0xFFC4
12328>>(2.S+2)	use			jpeg_segment
12329
12330>0	beshort		0xFFE1
12331# Recursion handled by FFE0
12332#>>(2.S+2)	use			jpeg_segment
12333>>4	string		Exif		\b, Exif Standard: [
12334>>>10	indirect/r	x
12335>>>10	string		x		\b]
12336
12337# Application specific markers
12338>0	beshort&0xFFE0	=0xFFE0
12339>>(2.S+2)	use			jpeg_segment
12340
12341# DB: Define Quantization tables
12342# DD: Define Restart interval [XXX: wrong here, it is 4 bytes]
12343# D8: Start of image
12344# D9: End of image
12345# Dn: Restart
12346>0	beshort&0xFFD0	=0xFFD0
12347>>0	beshort&0xFFE0	!0xFFE0
12348>>>(2.S+2)	use			jpeg_segment
12349
12350#>0	beshort		x		unknown 0x%x
12351#>>(2.S+2)	use			jpeg_segment
12352
12353# HSI is Handmade Software's proprietary JPEG encoding scheme
123540	string		hsi1		JPEG image data, HSI proprietary
12355
12356# From: David Santinoli <david@santinoli.com>
123570	string		\x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A	JPEG 2000
12358# From: Johan van der Knijff <johan.vanderknijff@kb.nl>
12359# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes
12360# https://github.com/bitsgalore/jp2kMagic
12361#
12362# Now read value of 'Brand' field, which yields a few possibilities:
12363>20	string		\x6a\x70\x32\x20	Part 1 (JP2)
12364!:mime	image/jp2
12365>20	string		\x6a\x70\x78\x20	Part 2 (JPX)
12366!:mime	image/jpx
12367>20	string		\x6a\x70\x6d\x20	Part 6 (JPM)
12368!:mime	image/jpm
12369>20	string		\x6d\x6a\x70\x32	Part 3 (MJ2)
12370!:mime	video/mj2
12371
12372# Type: JPEG 2000 codesream
12373# From: Mathieu Malaterre <mathieu.malaterre@gmail.com>
123740	belong		0xff4fff51						JPEG 2000 codestream
1237545	beshort		0xff52
12376
12377#------------------------------------------------------------------------------
12378# $File: karma,v 1.6 2009/09/19 16:28:10 christos Exp $
12379# karma:  file(1) magic for Karma data files
12380#
12381# From <rgooch@atnf.csiro.au>
12382
123830	string		KarmaRHD Version	Karma Data Structure Version
12384>16	belong		x		%u
12385
12386#------------------------------------------------------------------------------
12387# $File: kde,v 1.4 2009/09/19 16:28:10 christos Exp $
12388# kde:  file(1) magic for KDE
12389
123900		string/t	[KDE\ Desktop\ Entry]	KDE desktop entry
12391!:mime	application/x-kdelnk
123920		string/t	#\ KDE\ Config\ File	KDE config file
12393!:mime	application/x-kdelnk
123940		string/t	#\ xmcd	xmcd database file for kscd
12395!:mime	text/x-xmcd
12396
12397#------------------------------------------------------------------------------
12398# $File: kml,v 1.3 2010/11/25 15:00:12 christos Exp $
12399# keepass: file(1) magic for KeePass file
12400#
12401# Keepass Password Safe:
12402#  * original one: http://keepass.info/
12403#  * *nix port:    http://www.keepassx.org/
12404#  * android port: http://code.google.com/p/keepassdroid/
12405
124060	lelong		0x9AA2D903	Keepass password database
12407>4	lelong		0xB54BFB65	1.x KDB
12408>>48	lelong		>0		\b, %d groups
12409>>52	lelong		>0		\b, %d entries
12410>>8	lelong&0x0f	1		\b, SHA-256
12411>>8	lelong&0x0f	2		\b, AES
12412>>8	lelong&0x0f	4		\b, RC4
12413>>8	lelong&0x0f	8		\b, Twofish
12414>>120	lelong		>0		\b, %d key transformation rounds
12415>4	lelong		0xB54BFB67	2.x KDBX
12416
12417#------------------------------------------------------------------------------
12418# $File: map,v 1.1 2014/06/03 18:22:25 christos Exp $
12419# kerberos: MIT kerberos file binary formats
12420#
12421
12422# This magic entry is for demonstration purposes and could be improved
12423# if the following features were implemented in file:
12424#
12425# Strings inside [[ .. ]] in the descriptions have special meanings and
12426# are not printed.
12427#
12428# 	- Provide some form of iteration in number of components
12429#		[[${counter}=%d]] in the description
12430#		then append
12431#		[${counter}--] in the offset of the entries
12432#	- Provide a way to round the next offset
12433#		Add [R:4] after the offset?
12434#	- Provide a way to have optional entries
12435#		XXX: Syntax:
12436#	- Provide a way to "save" entries to print them later.
12437#		if the description is [[${name}=%s]], then nothing is
12438#		printed and a subsequent entry in the same magic file
12439#		can refer to ${name}
12440#	- Provide a way to format strings as hex values
12441#
12442# http://www.gnu.org/software/shishi/manual/html_node/\
12443#	The-Keytab-Binary-File-Format.html
12444#
12445
124460		name		keytab_entry
12447#>0		beshort		x		\b, size=%d
12448#>2		beshort		x		\b, components=%d
12449>4		pstring/H	x		\b, realm=%s
12450>>&0		pstring/H	x		\b, principal=%s/
12451>>>&0		pstring/H	x		\b%s
12452>>>>&0		belong		x		\b, type=%d
12453>>>>>&0		bedate		x		\b, date=%s
12454>>>>>>&0	byte		x		\b, kvno=%u
12455#>>>>>>>&0	pstring/H	x
12456#>>>>>>>>&0	belong		x
12457#>>>>>>>>>>&0	use		keytab_entry
12458
124590		belong		0x05020000	Kerberos Keytab file
12460>4		use		keytab_entry
12461
12462#------------------------------------------------------------------------------
12463# $File: kml,v 1.2 2009/09/19 16:28:10 christos Exp $
12464# Type: Google KML, formerly Keyhole Markup Language
12465# Future development of this format has been handed
12466# over to the Open Geospatial Consortium.
12467# http://www.opengeospatial.org/standards/kml/
12468# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
124690 string/t    \<?xml
12470>20  search/400 \ xmlns=
12471>>&0 regex ['"]http://earth.google.com/kml Google KML document
12472!:mime application/vnd.google-earth.kml+xml
12473>>>&1 string 2.0' \b, version 2.0
12474>>>&1 string 2.1' \b, version 2.1
12475>>>&1 string 2.2' \b, version 2.2
12476
12477#------------------------------------------------------------------------------
12478# Type: OpenGIS KML, formerly Keyhole Markup Language
12479# This standard is maintained by the
12480# Open Geospatial Consortium.
12481# http://www.opengeospatial.org/standards/kml/
12482# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
12483>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document
12484!:mime application/vnd.google-earth.kml+xml
12485>>>&1 string/t 2.2 \b, version 2.2
12486
12487#------------------------------------------------------------------------------
12488# Type: Google KML Archive (ZIP based)
12489# http://code.google.com/apis/kml/documentation/kml_tut.html
12490# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
124910 string    PK\003\004
12492>4  byte    0x14
12493>>30  string doc.kml Compressed Google KML Document, including resources.
12494!:mime application/vnd.google-earth.kmz
12495
12496#------------------------------------------------------------------------------
12497# $File$
12498# DEC SRC Virtual Paper: Lectern files
12499# Karl M. Hegbloom <karlheg@inetarena.com>
125000	string	lect	DEC SRC Virtual Paper Lectern file
12501
12502#------------------------------------------------------------------------------
12503# $File$
12504# lex:  file(1) magic for lex
12505#
12506#	derived empirically, your offsets may vary!
125070	search/100	yyprevious	C program text (from lex)
12508>3	search/1	>\0		 for %s
12509# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
125100	search/100	generated\ by\ flex	C program text (from flex)
12511# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
125120	search/1	%{		lex description text
12513
12514#------------------------------------------------------------------------------
12515# $File$
12516# lif:  file(1) magic for lif
12517#
12518# (Daniel Quinlan <quinlan@yggdrasil.com>)
12519#
125200	beshort		0x8000		lif file
12521
12522#------------------------------------------------------------------------------
12523# $File: linux,v 1.58 2014/08/04 06:21:30 christos Exp $
12524# linux:  file(1) magic for Linux files
12525#
12526# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
12527# The following basic Linux magic is useful for reference, but using
12528# "long" magic is a better practice in order to avoid collisions.
12529#
12530# 2	leshort		100		Linux/i386
12531# >0	leshort		0407		impure executable (OMAGIC)
12532# >0	leshort		0410		pure executable (NMAGIC)
12533# >0	leshort		0413		demand-paged executable (ZMAGIC)
12534# >0	leshort		0314		demand-paged executable (QMAGIC)
12535#
125360	lelong		0x00640107	Linux/i386 impure executable (OMAGIC)
12537>16	lelong		0		\b, stripped
125380	lelong		0x00640108	Linux/i386 pure executable (NMAGIC)
12539>16	lelong		0		\b, stripped
125400	lelong		0x0064010b	Linux/i386 demand-paged executable (ZMAGIC)
12541>16	lelong		0		\b, stripped
125420	lelong		0x006400cc	Linux/i386 demand-paged executable (QMAGIC)
12543>16	lelong		0		\b, stripped
12544#
125450	string		\007\001\000	Linux/i386 object file
12546>20	lelong		>0x1020		\b, DLL library
12547# Linux-8086 stuff:
125480	string		\01\03\020\04	Linux-8086 impure executable
12549>28	long		!0		not stripped
125500	string		\01\03\040\04	Linux-8086 executable
12551>28	long		!0		not stripped
12552#
125530	string		\243\206\001\0	Linux-8086 object file
12554#
125550	string		\01\03\020\20	Minix-386 impure executable
12556>28	long		!0		not stripped
125570	string		\01\03\040\20	Minix-386 executable
12558>28	long		!0		not stripped
125590	string		\01\03\04\20	Minix-386 NSYM/GNU executable
12560>28	long		!0		not stripped
12561# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
12562216	lelong		0421		Linux/i386 core file
12563!:strength / 2
12564>220	string		>\0		of '%s'
12565>200	lelong		>0		(signal %d)
12566#
12567# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
12568# this can be overridden by the DOS executable (COM) entry
125692	string		LILO		Linux/i386 LILO boot/chain loader
12570#
12571# Linux make config build file, from Ole Aamot <oka@oka.no>
12572# Updated by Ken Sharp
1257328	string		make\ config		Linux make config build file (old)
1257449	search/70	Kernel\ Configuration	Linux make config build file
12575
12576#
12577# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
12578# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
12579# See: http://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html
125800	leshort		0x0436		Linux/i386 PC Screen Font v1 data,
12581>2	byte&0x01	0		256 characters,
12582>2	byte&0x01	!0		512 characters,
12583>2	byte&0x02	0		no directory,
12584>2	byte&0x02	!0		Unicode directory,
12585>3	byte		>0		8x%d
125860	string		\x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data,
12587>16	lelong		x		%d characters,
12588>12	lelong&0x01	0		no directory,
12589>12	lelong&0x01	!0		Unicode directory,
12590>24	lelong		x		%d
12591>28	lelong		x		\bx%d
12592
12593# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
125944086	string		SWAP-SPACE	Linux/i386 swap file
12595# From: Jeff Bailey <jbailey@ubuntu.com>
12596# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com>
125974076	string		SWAPSPACE2S1SUSPEND	Linux/i386 swap file (new style) with SWSUSP1 image
12598# From: James Hunt <james.hunt@ubuntu.com>
125994076    string          SWAPSPACE2LINHIB0001    Linux/i386 swap file (new style) (compressed hibernate)
12600# according to man page of mkswap (8) March 1999
12601# volume label and UUID Russell Coker
12602# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
126034086	string		SWAPSPACE2	Linux/i386 swap file (new style),
12604>0x400	long		x		version %d (4K pages),
12605>0x404	long		x		size %d pages,
12606>1052	string		\0		no label,
12607>1052	string		>\0		LABEL=%s,
12608>0x40c	belong		x		UUID=%08x
12609>0x410	beshort		x		\b-%04x
12610>0x412	beshort		x		\b-%04x
12611>0x414	beshort		x		\b-%04x
12612>0x416	belong		x		\b-%08x
12613>0x41a	beshort		x		\b%04x
12614# From Daniel Novotny <dnovotny@redhat.com>
12615# swap file for PowerPC
1261665526	string		SWAPSPACE2	Linux/ppc swap file
1261716374	string		SWAPSPACE2	Linux/ia64 swap file
12618#
12619# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
12620# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
12621# and Nicolas Lichtmaier <nick@debian.org>
12622# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
12623# Linux kernel boot images (i386 arch) (Wolfram Kleff)
12624514	string		HdrS		Linux kernel
12625!:strength + 55
12626>510	leshort		0xAA55		x86 boot executable
12627>>518	leshort		>0x1ff
12628>>>529	byte		0		zImage,
12629>>>529	byte		1		bzImage,
12630>>>526	lelong		>0
12631>>>>(526.s+0x200) string	>\0	version %s,
12632>>498	leshort		1		RO-rootFS,
12633>>498	leshort		0		RW-rootFS,
12634>>508	leshort		>0		root_dev 0x%X,
12635>>502	leshort		>0		swap_dev 0x%X,
12636>>504	leshort		>0		RAMdisksize %u KB,
12637>>506	leshort		0xFFFF		Normal VGA
12638>>506	leshort		0xFFFE		Extended VGA
12639>>506	leshort		0xFFFD		Prompt for Videomode
12640>>506	leshort		>0		Video mode %d
12641# This also matches new kernels, which were caught above by "HdrS".
126420		belong	0xb8c0078e	Linux kernel
12643>0x1e3		string	Loading		version 1.3.79 or older
12644>0x1e9		string	Loading		from prehistoric times
12645
12646# System.map files - Nicolas Lichtmaier <nick@debian.org>
126478	search/1	\ A\ _text	Linux kernel symbol map text
12648
12649# LSM entries - Nicolas Lichtmaier <nick@debian.org>
126500	search/1	Begin3	Linux Software Map entry text
126510	search/1	Begin4	Linux Software Map entry text (new format)
12652
12653# From Matt Zimmerman, enhanced for v3 by Matthew Palmer
126540	belong	0x4f4f4f4d	User-mode Linux COW file
12655>4	belong	<3		\b, version %d
12656>>8	string	>\0		\b, backing file %s
12657>4	belong	>2		\b, version %d
12658>>32	string	>\0		\b, backing file %s
12659
12660############################################################################
12661# Linux kernel versions
12662
126630		string		\xb8\xc0\x07\x8e\xd8\xb8\x00\x90	Linux
12664>497		leshort		0		x86 boot sector
12665>>514		belong		0x8e	of a kernel from the dawn of time!
12666>>514		belong		0x908ed8b4	version 0.99-1.1.42
12667>>514		belong		0x908ed8b8	for memtest86
12668
12669>497		leshort		!0		x86 kernel
12670>>504		leshort		>0		RAMdisksize=%u KB
12671>>502		leshort		>0		swap=0x%X
12672>>508		leshort		>0		root=0x%X
12673>>>498		leshort		1		\b-ro
12674>>>498		leshort		0		\b-rw
12675>>506		leshort		0xFFFF		vga=normal
12676>>506		leshort		0xFFFE		vga=extended
12677>>506		leshort		0xFFFD		vga=ask
12678>>506		leshort		>0		vga=%d
12679>>514		belong		0x908ed881	version 1.1.43-1.1.45
12680>>514		belong		0x15b281cd
12681>>>0xa8e	belong		0x55AA5a5a	version 1.1.46-1.2.13,1.3.0
12682>>>0xa99	belong		0x55AA5a5a	version 1.3.1,2
12683>>>0xaa3	belong		0x55AA5a5a	version 1.3.3-1.3.30
12684>>>0xaa6	belong		0x55AA5a5a	version 1.3.31-1.3.41
12685>>>0xb2b	belong		0x55AA5a5a	version 1.3.42-1.3.45
12686>>>0xaf7	belong		0x55AA5a5a	version 1.3.46-1.3.72
12687>>514		string		HdrS
12688>>>518		leshort		>0x1FF
12689>>>>529		byte		0		\b, zImage
12690>>>>529		byte		1		\b, bzImage
12691>>>>(526.s+0x200) string 	>\0		\b, version %s
12692
12693# Linux boot sector thefts.
126940		belong		0xb8c0078e	Linux
12695>0x1e6		belong		0x454c4b53	ELKS Kernel
12696>0x1e6		belong		!0x454c4b53	style boot sector
12697
12698############################################################################
12699# Linux S390 kernel image
12700# Created by: Jan Kaluza <jkaluza@redhat.com>
127018 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390
12702>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc
12703# 64bit
12704>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel
12705>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel
12706>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel
12707>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel
12708# 32bit
12709>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel
12710>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel
12711>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel
12712>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel
12713
12714# Linux ARM compressed kernel image
12715# From: Kevin Cernekee <cernekee@gmail.com>
1271636	lelong	0x016f2818	Linux kernel ARM boot executable zImage (little-endian)
1271736	belong	0x016f2818	Linux kernel ARM boot executable zImage (big-endian)
12718
12719############################################################################
12720# Linux 8086 executable
127210	lelong&0xFF0000FF 0xC30000E9	Linux-Dev86 executable, headerless
12722>5	string		.
12723>>4	string		>\0		\b, libc version %s
12724
127250	lelong&0xFF00FFFF 0x4000301	Linux-8086 executable
12726>2	byte&0x01	!0		\b, unmapped zero page
12727>2	byte&0x20	0		\b, impure
12728>2	byte&0x20	!0
12729>>2	byte&0x10	!0		\b, A_EXEC
12730>2	byte&0x02	!0		\b, A_PAL
12731>2	byte&0x04	!0		\b, A_NSYM
12732>2	byte&0x08	!0		\b, A_STAND
12733>2	byte&0x40	!0		\b, A_PURE
12734>2	byte&0x80	!0		\b, A_TOVLY
12735>28     long            !0              \b, not stripped
12736>37	string		.
12737>>36	string		>\0		\b, libc version %s
12738
12739# 0	lelong&0xFF00FFFF 0x10000301	ld86 I80386 executable
12740# 0	lelong&0xFF00FFFF 0xB000301	ld86 M68K executable
12741# 0	lelong&0xFF00FFFF 0xC000301	ld86 NS16K executable
12742# 0	lelong&0xFF00FFFF 0x17000301	ld86 SPARC executable
12743
12744# SYSLINUX boot logo files (from 'ppmtolss16' sources)
12745# http://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename:
12746# file extension .lss .16
127470	lelong	=0x1413f33d		SYSLINUX' LSS16 image data
12748# syslinux-4.05/mime/image/x-lss16.xml
12749!:mime image/x-lss16
12750>4	leshort	x			\b, width %d
12751>6	leshort	x			\b, height %d
12752
127530	string	OOOM			User-Mode-Linux's Copy-On-Write disk image
12754>4	belong	x			version %d
12755
12756# SE Linux policy database
12757# From: Mike Frysinger <vapier@gentoo.org>
127580	lelong	0xf97cff8c		SE Linux policy
12759>16	lelong	x			v%d
12760>20	lelong	1			MLS
12761>24	lelong	x			%d symbols
12762>28	lelong	x			%d ocons
12763
12764# Linux Logical Volume Manager (LVM)
12765# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net>
12766#
12767# System ID, UUID and volume group name are 128 bytes long
12768# but they should never be full and initialized with zeros...
12769#
12770# LVM1
12771#
127720x0	string	HM\001		LVM1 (Linux Logical Volume Manager), version 1
12773>0x12c	string	>\0		, System ID: %s
12774
127750x0	string	HM\002		LVM1 (Linux Logical Volume Manager), version 2
12776>0x12c	string	>\0		, System ID: %s
12777
12778#  LVM2
12779#
12780# It seems that the label header can be in one the four first sector
12781# of the disk... (from _find_labeller in lib/label/label.c of LVM2)
12782#
12783# 0x200 seems to be the common case
12784
127850x218           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
12786# read the offset to add to the start of the header, and the header
12787# start in 0x200
12788>&(&-12.l-0x21) byte    x
12789# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
12790>>&0x0          string  >\x2f          \b, UUID: %.6s
12791>>&0x6          string  >\x2f          \b-%.4s
12792>>&0xa          string  >\x2f          \b-%.4s
12793>>&0xe          string  >\x2f          \b-%.4s
12794>>&0x12         string  >\x2f          \b-%.4s
12795>>&0x16         string  >\x2f          \b-%.4s
12796>>&0x1a         string  >\x2f          \b-%.6s
12797>>&0x20         lequad  x              \b, size: %lld
12798
127990x018           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
12800>&(&-12.l-0x21) byte    x
12801# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
12802>>&0x0          string  >\x2f          \b, UUID: %.6s
12803>>&0x6          string  >\x2f          \b-%.4s
12804>>&0xa          string  >\x2f          \b-%.4s
12805>>&0xe          string  >\x2f          \b-%.4s
12806>>&0x12         string  >\x2f          \b-%.4s
12807>>&0x16         string  >\x2f          \b-%.4s
12808>>&0x1a         string  >\x2f          \b-%.6s
12809>>&0x20         lequad  x              \b, size: %lld
12810
128110x418           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
12812>&(&-12.l-0x21) byte    x
12813# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
12814>>&0x0          string  >\x2f          \b, UUID: %.6s
12815>>&0x6          string  >\x2f          \b-%.4s
12816>>&0xa          string  >\x2f          \b-%.4s
12817>>&0xe          string  >\x2f          \b-%.4s
12818>>&0x12         string  >\x2f          \b-%.4s
12819>>&0x16         string  >\x2f          \b-%.4s
12820>>&0x1a         string  >\x2f          \b-%.6s
12821>>&0x20         lequad  x              \b, size: %lld
12822
128230x618           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
12824>&(&-12.l-0x21) byte    x
12825# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
12826>>&0x0          string  >\x2f          \b, UUID: %.6s
12827>>&0x6          string  >\x2f          \b-%.4s
12828>>&0xa          string  >\x2f          \b-%.4s
12829>>&0xe          string  >\x2f          \b-%.4s
12830>>&0x12         string  >\x2f          \b-%.4s
12831>>&0x16         string  >\x2f          \b-%.4s
12832>>&0x1a         string  >\x2f          \b-%.6s
12833>>&0x20         lequad  x              \b, size: %lld
12834
12835# LVM snapshot
12836# from Jason Farrel
128370	string	SnAp	LVM Snapshot (CopyOnWrite store)
12838>4	lelong	!0	- valid,
12839>4	lelong	0	- invalid,
12840>8	lelong	x	version %d,
12841>12	lelong	x	chunk_size %d
12842
12843# SE Linux policy database
128440	lelong	0xf97cff8c		SE Linux policy
12845>16	lelong	x			v%d
12846>20	lelong	1			MLS
12847>24	lelong	x			%d symbols
12848>28	lelong	x			%d ocons
12849
12850# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec
12851# Anthon van der Neut (anthon@mnt.org)
128520	string	LUKS\xba\xbe	LUKS encrypted file,
12853>6	beshort x		ver %d
12854>8	string	x		[%s,
12855>40	string	x		%s,
12856>72	string	x		%s]
12857>168	string	x		UUID: %s
12858
12859
12860# Summary: Xen saved domain file
12861# Created by: Radek Vokal <rvokal@redhat.com>
128620	string		LinuxGuestRecord	Xen saved domain
12863>20	search/256	(name
12864>>&1	string		x			(name %s)
12865
12866# Type: Xen, the virtual machine monitor
12867# From: Radek Vokal <rvokal@redhat.com>
128680	string		LinuxGuestRecord	Xen saved domain
12869#>2	regex		\(name\ [^)]*\)		%s
12870>20	search/256	(name			(name
12871>>&1	string		x			%s...)
12872
12873# Systemd journald files
12874# See http://www.freedesktop.org/wiki/Software/systemd/journal-files/.
12875# From: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl>
12876
12877# check magic
128780	string	LPKSHHRH
12879# check that state is one of known values
12880>16		ubyte&252	0
12881# check that each half of three unique id128s is non-zero
12882>>24		ubequad		>0
12883>>>32		ubequad		>0
12884>>>>40		ubequad		>0
12885>>>>>48		ubequad		>0
12886>>>>>>56	ubequad		>0
12887>>>>>>>64	ubequad		>0	Journal file
12888!:mime application/octet-stream
12889# provide more info
12890>>>>>>>>184	leqdate		0	empty
12891>>>>>>>>16	ubyte		0	\b, offline
12892>>>>>>>>16	ubyte		1	\b, online
12893>>>>>>>>16	ubyte		2	\b, archived
12894>>>>>>>>8	ulelong&1	1	\b, sealed
12895>>>>>>>>12	ulelong&1	1	\b, compressed
12896
12897# BCache backing and cache devices
12898# From: Gabriel de Perthuis <g2p.code@gmail.com>
128990x1008		lequad		8
12900>0x1018		string		\xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81	BCache
12901>>0x1010	ulequad		0	cache device
12902>>0x1010	ulequad		1	backing device
12903>>0x1010	ulequad		3	cache device
12904>>0x1010	ulequad		4	backing device
12905>>0x1048	string		>0	\b, label "%.32s"
12906>>0x1028	ubelong		x	\b, uuid %08x
12907>>0x102c	ubeshort	x	\b-%04x
12908>>0x102e	ubeshort	x	\b-%04x
12909>>0x1030	ubeshort	x	\b-%04x
12910>>0x1032	ubelong		x	\b-%08x
12911>>0x1036	ubeshort	x	\b%04x
12912>>0x1038	ubelong		x	\b, set uuid %08x
12913>>0x103c	ubeshort	x	\b-%04x
12914>>0x103e	ubeshort	x	\b-%04x
12915>>0x1040	ubeshort	x	\b-%04x
12916>>0x1042	ubelong		x	\b-%08x
12917>>0x1046	ubeshort	x	\b%04x
12918
12919# Linux device tree:
12920# File format description can be found in the Linux kernel sources at
12921# Documentation/devicetree/booting-without-of.txt
12922# From Christoph Biedl
129230		belong		0xd00dfeed
12924# structure and strings must be within blob
12925>&(8.L)		byte		x
12926>>&(12.L)	byte		x
12927>>>20		belong		>1	Device Tree Blob version %d
12928>>>>4		belong		x	\b, size=%d
12929>>>>20		belong		>1
12930>>>>>28		belong		x	\b, boot CPU=%d
12931>>>>20		belong		>2
12932>>>>>32		belong		x	\b, string block size=%d
12933>>>>20		belong		>16
12934>>>>>36		belong		x	\b, DT structure block size=%d
12935
12936# glibc locale archive as defined in glibc locale/locarchive.h
129370		lelong		0xde020109	locale archive
12938>24		lelong		x		%d strings
12939
12940# Summary:     Database file for mlocate
12941# Description: A database file as used by mlocate, a fast implementation
12942#              of locate/updatedb. It uses merging to reuse the existing
12943#              database and avoid rereading most of the filesystem. It's
12944#              the default version of locate on Arch Linux (and others).
12945# File path:   /var/lib/mlocate/mlocate.db by default (but configurable)
12946# Site:        https://fedorahosted.org/mlocate/
12947# Format docs: http://linux.die.net/man/5/mlocate.db
12948# Type: mlocate database file
12949# URL:  https://fedorahosted.org/mlocate/
12950# From: Wander Nauta <info@wandernauta.nl>
129510		string		\0mlocate	mlocate database
12952>12		byte		x		\b, version %d
12953>13		byte		1		\b, require visibility
12954>16		string		x		\b, root %s
12955
12956#------------------------------------------------------------------------------
12957# $File$
12958# lisp:  file(1) magic for lisp programs
12959#
12960# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
12961
12962# updated by Joerg Jenderek
12963# GRR: This lot is too weak
12964#0	string	;;
12965# windows INF files often begin with semicolon and use CRLF as line end
12966# lisp files are mainly created on unix system with LF as line end
12967#>2	search/4096	!\r		Lisp/Scheme program text
12968#>2	search/4096	\r		Windows INF file
12969
129700	search/4096	(setq\ 			Lisp/Scheme program text
12971!:mime	text/x-lisp
129720	search/4096	(defvar\ 		Lisp/Scheme program text
12973!:mime	text/x-lisp
129740	search/4096	(defparam\ 		Lisp/Scheme program text
12975!:mime	text/x-lisp
129760	search/4096	(defun\  		Lisp/Scheme program text
12977!:mime	text/x-lisp
129780	search/4096	(autoload\ 		Lisp/Scheme program text
12979!:mime	text/x-lisp
129800	search/4096	(custom-set-variables\ 	Lisp/Scheme program text
12981!:mime	text/x-lisp
12982
12983# Emacs 18 - this is always correct, but not very magical.
129840	string	\012(			Emacs v18 byte-compiled Lisp data
12985!:mime	application/x-elc
12986# Emacs 19+ - ver. recognition added by Ian Springer
12987# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs
12988# - Chris Chittleborough <cchittleborough@yahoo.com.au>
129890	string	;ELC
12990>4	byte	>18
12991>4	byte    <32			Emacs/XEmacs v%d byte-compiled Lisp data
12992!:mime	application/x-elc
12993
12994# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
129950	string	(SYSTEM::VERSION\040'	CLISP byte-compiled Lisp program (pre 2004-03-27)
129960	string	(|SYSTEM|::|VERSION|\040'	CLISP byte-compiled Lisp program text
12997
129980	long	0x70768BD2		CLISP memory image data
129990	long	0xD28B7670		CLISP memory image data, other endian
13000
13001#.com and .bin for MIT scheme
130020	string	\372\372\372\372	MIT scheme (library?)
13003
13004# From: David Allouche <david@allouche.net>
130050	search/1	\<TeXmacs|	TeXmacs document text
13006!:mime	text/texmacs
13007
13008#------------------------------------------------------------------------------
13009# $File: llvm,v 1.7 2013/01/08 01:34:38 christos Exp $
13010# llvm:  file(1) magic for LLVM byte-codes
13011# URL:  http://llvm.org/docs/BitCodeFormat.html
13012# From: Al Stone <ahs3@fc.hp.com>
13013
130140	string	llvm	LLVM byte-codes, uncompressed
130150	string	llvc0	LLVM byte-codes, null compression
130160	string	llvc1	LLVM byte-codes, gzip compression
130170	string	llvc2	LLVM byte-codes, bzip2 compression
13018
130190	lelong	0x0b17c0de	LLVM bitcode, wrapper
13020# Are these Mach-O ABI values?  They appear to be.
13021>16	lelong	0x01000007	x86_64
13022>16	lelong	0x00000007	i386
13023>16	lelong	0x00000012	ppc
13024>16	lelong	0x01000012	ppc64
13025>16	lelong 	0x0000000c	arm
13026
130270	string	BC\xc0\xde	LLVM IR bitcode
13028
13029#------------------------------------------------------------------------------
13030# $File: lua,v 1.5 2009/09/19 16:28:10 christos Exp $
13031# lua:  file(1) magic for Lua scripting language
13032# URL:  http://www.lua.org/
13033# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
13034
13035# Lua scripts
130360	search/1/w	#!\ /usr/bin/lua	Lua script text executable
13037!:mime	text/x-lua
130380	search/1/w	#!\ /usr/local/bin/lua	Lua script text executable
13039!:mime	text/x-lua
130400	search/1	#!/usr/bin/env\ lua	Lua script text executable
13041!:mime	text/x-lua
130420	search/1	#!\ /usr/bin/env\ lua	Lua script text executable
13043!:mime	text/x-lua
13044
13045# Lua bytecode
130460	string		\033Lua			Lua bytecode,
13047>4	byte		0x50			version 5.0
13048>4	byte		0x51			version 5.1
13049>4	byte		0x52			version 5.2
13050
13051#------------------------------------------------------------------------------
13052# $File$
13053# luks:  file(1) magic for Linux Unified Key Setup
13054# URL:	http://luks.endorphin.org/spec
13055# From:	Anthon van der Neut <anthon@mnt.org>
13056
130570	string		LUKS\xba\xbe	LUKS encrypted file,
13058>6	beshort		x		ver %d
13059>8	string		x		[%s,
13060>40	string		x		%s,
13061>72	string		x		%s]
13062>168	string		x		UUID: %s
13063#------------------------------------------------------------------------------
13064# $File$
13065# make:  file(1) magic for M4 scripts
13066#
130670	regex	\^dnl\ 		M4 macro processor script text
13068!:mime	text/x-m4
13069
13070#------------------------------------------------------------
13071# $File: mach,v 1.18 2014/03/29 15:40:34 christos Exp $
13072# Mach has two magic numbers, 0xcafebabe and 0xfeedface.
13073# Unfortunately the first, cafebabe, is shared with
13074# Java ByteCode, so they are both handled in the file "cafebabe".
13075# The "feedface" ones are handled herein.
13076#------------------------------------------------------------
13077# if set, it's for the 64-bit version of the architecture
13078# yes, this is separate from the low-order magic number bit
13079# it's also separate from the "64-bit libraries" bit in the
13080# upper 8 bits of the CPU subtype
13081
130820	name	mach-o-cpu
13083>0	belong&0x01000000	0
13084#
13085# 32-bit ABIs.
13086#
13087#				1	vax
13088>>0	belong&0x00ffffff	1
13089>>>4		belong&0x00ffffff	0	vax
13090>>>4		belong&0x00ffffff	1	vax11/780
13091>>>4		belong&0x00ffffff	2	vax11/785
13092>>>4		belong&0x00ffffff	3	vax11/750
13093>>>4		belong&0x00ffffff	4	vax11/730
13094>>>4		belong&0x00ffffff	5	uvaxI
13095>>>4		belong&0x00ffffff	6	uvaxII
13096>>>4		belong&0x00ffffff	7	vax8200
13097>>>4		belong&0x00ffffff	8	vax8500
13098>>>4		belong&0x00ffffff	9	vax8600
13099>>>4		belong&0x00ffffff	10	vax8650
13100>>>4		belong&0x00ffffff	11	vax8800
13101>>>4		belong&0x00ffffff	12	uvaxIII
13102>>>4		belong&0x00ffffff	>12	vax subarchitecture=%d
13103>>0	belong&0x00ffffff	2	romp
13104>>0	belong&0x00ffffff	3	architecture=3
13105>>0	belong&0x00ffffff	4	ns32032
13106>>0	belong&0x00ffffff	5	ns32332
13107>>0	belong&0x00ffffff	6	m68k
13108#				7	x86
13109>>0	belong&0x00ffffff	7
13110>>>4	belong&0x0000000f	3		i386
13111>>>4	belong&0x0000000f	4		i486
13112>>>>4	belong&0x00fffff0	0
13113>>>>4	belong&0x00fffff0	0x80		\bsx
13114>>>4	belong&0x0000000f	5		i586
13115>>>4	belong&0x0000000f	6
13116>>>>4	belong&0x00fffff0	0		p6
13117>>>>4	belong&0x00fffff0	0x10		pentium_pro
13118>>>>4	belong&0x00fffff0	0x20		pentium_2_m0x20
13119>>>>4	belong&0x00fffff0	0x30		pentium_2_m3
13120>>>>4	belong&0x00fffff0	0x40		pentium_2_m0x40
13121>>>>4	belong&0x00fffff0	0x50		pentium_2_m5
13122>>>>4	belong&0x00fffff0	>0x50		pentium_2_m0x%x
13123>>>4	belong&0x0000000f	7		celeron
13124>>>>4	belong&0x00fffff0	0x00		\b_m0x%x
13125>>>>4	belong&0x00fffff0	0x10		\b_m0x%x
13126>>>>4	belong&0x00fffff0	0x20		\b_m0x%x
13127>>>>4	belong&0x00fffff0	0x30		\b_m0x%x
13128>>>>4	belong&0x00fffff0	0x40		\b_m0x%x
13129>>>>4	belong&0x00fffff0	0x50		\b_m0x%x
13130>>>>4	belong&0x00fffff0	0x60
13131>>>>4	belong&0x00fffff0	0x70		\b_mobile
13132>>>>4	belong&0x00fffff0	>0x70		\b_m0x%x
13133>>>4	belong&0x0000000f	8		pentium_3
13134>>>>4	belong&0x00fffff0	0x00
13135>>>>4	belong&0x00fffff0	0x10		\b_m
13136>>>>4	belong&0x00fffff0	0x20		\b_xeon
13137>>>>4	belong&0x00fffff0	>0x20		\b_m0x%x
13138>>>4	belong&0x0000000f	9		pentiumM
13139>>>>4	belong&0x00fffff0	0x00
13140>>>>4	belong&0x00fffff0	>0x00		\b_m0x%x
13141>>>4	belong&0x0000000f	10		pentium_4
13142>>>>4	belong&0x00fffff0	0x00
13143>>>>4	belong&0x00fffff0	0x10		\b_m
13144>>>>4	belong&0x00fffff0	>0x10		\b_m0x%x
13145>>>4	belong&0x0000000f	11		itanium
13146>>>>4	belong&0x00fffff0	0x00
13147>>>>4	belong&0x00fffff0	0x10		\b_2
13148>>>>4	belong&0x00fffff0	>0x10		\b_m0x%x
13149>>>4	belong&0x0000000f	12		xeon
13150>>>>4	belong&0x00fffff0	0x00
13151>>>>4	belong&0x00fffff0	0x10		\b_mp
13152>>>>4	belong&0x00fffff0	>0x10		\b_m0x%x
13153>>>4	belong&0x0000000f	>12		ia32 family=%d
13154>>>>4	belong&0x00fffff0	0x00
13155>>>>4	belong&0x00fffff0	>0x00		model=%x
13156>>0	belong&0x00ffffff	8	mips
13157>>>4		belong&0x00ffffff	1	R2300
13158>>>4		belong&0x00ffffff	2	R2600
13159>>>4		belong&0x00ffffff	3	R2800
13160>>>4		belong&0x00ffffff	4	R2000a
13161>>>4		belong&0x00ffffff	5	R2000
13162>>>4		belong&0x00ffffff	6	R3000a
13163>>>4		belong&0x00ffffff	7	R3000
13164>>>4		belong&0x00ffffff	>7	subarchitecture=%d
13165>>0	belong&0x00ffffff	9	ns32532
13166>>0	belong&0x00ffffff	10	mc98000
13167>>0	belong&0x00ffffff	11	hppa
13168>>>4		belong&0x00ffffff	0	7100
13169>>>4		belong&0x00ffffff	1	7100LC
13170>>>4		belong&0x00ffffff	>1	subarchitecture=%d
13171>>0	belong&0x00ffffff	12	arm
13172>>>4		belong&0x00ffffff	0
13173>>>4		belong&0x00ffffff	1	subarchitecture=%d
13174>>>4		belong&0x00ffffff	2	subarchitecture=%d
13175>>>4		belong&0x00ffffff	3	subarchitecture=%d
13176>>>4		belong&0x00ffffff	4	subarchitecture=%d
13177>>>4		belong&0x00ffffff	5	\b_v4t
13178>>>4		belong&0x00ffffff	6	\b_v6
13179>>>4		belong&0x00ffffff	7	\b_v5tej
13180>>>4		belong&0x00ffffff	8	\b_xscale
13181>>>4		belong&0x00ffffff	9	\b_v7
13182>>>4		belong&0x00ffffff	10	\b_v7f
13183>>>4		belong&0x00ffffff	11	subarchitecture=%d
13184>>>4		belong&0x00ffffff	12	\b_v7k
13185>>>4		belong&0x00ffffff	>12	subarchitecture=%d
13186#				13	m88k
13187>>0	belong&0x00ffffff	13
13188>>>4		belong&0x00ffffff	0	mc88000
13189>>>4		belong&0x00ffffff	1	mc88100
13190>>>4		belong&0x00ffffff	2	mc88110
13191>>>4		belong&0x00ffffff	>2	mc88000 subarchitecture=%d
13192>>0	belong&0x00ffffff	14	SPARC
13193>>0	belong&0x00ffffff	15	i860g
13194>>0	belong&0x00ffffff	16	alpha
13195>>0	belong&0x00ffffff	17	rs6000
13196>>0	belong&0x00ffffff	18	ppc
13197>>>4		belong&0x00ffffff	0
13198>>>4		belong&0x00ffffff	1	\b_601
13199>>>4		belong&0x00ffffff	2	\b_602
13200>>>4		belong&0x00ffffff	3	\b_603
13201>>>4		belong&0x00ffffff	4	\b_603e
13202>>>4		belong&0x00ffffff	5	\b_603ev
13203>>>4		belong&0x00ffffff	6	\b_604
13204>>>4		belong&0x00ffffff	7	\b_604e
13205>>>4		belong&0x00ffffff	8	\b_620
13206>>>4		belong&0x00ffffff	9	\b_650
13207>>>4		belong&0x00ffffff	10	\b_7400
13208>>>4		belong&0x00ffffff	11	\b_7450
13209>>>4		belong&0x00ffffff	100	\b_970
13210>>>4		belong&0x00ffffff	>100	subarchitecture=%d
13211>>0	belong&0x00ffffff	>18	architecture=%d
13212>0	belong&0x01000000	0x01000000
13213#
13214# 64-bit ABIs.
13215#
13216>>0	belong&0x00ffffff	0	64-bit architecture=%d
13217>>0	belong&0x00ffffff	1	64-bit architecture=%d
13218>>0	belong&0x00ffffff	2	64-bit architecture=%d
13219>>0	belong&0x00ffffff	3	64-bit architecture=%d
13220>>0	belong&0x00ffffff	4	64-bit architecture=%d
13221>>0	belong&0x00ffffff	5	64-bit architecture=%d
13222>>0	belong&0x00ffffff	6	64-bit architecture=%d
13223>>0	belong&0x00ffffff	7	x86_64
13224>>>4		belong&0x00ffffff	0	subarchitecture=%d
13225>>>4		belong&0x00ffffff	1	subarchitecture=%d
13226>>>4		belong&0x00ffffff	2	subarchitecture=%d
13227>>>4		belong&0x00ffffff	3
13228>>>4		belong&0x00ffffff	4	\b_arch1
13229>>>4		belong&0x00ffffff	>4	subarchitecture=%d
13230>>0	belong&0x00ffffff	8	64-bit architecture=%d
13231>>0	belong&0x00ffffff	9	64-bit architecture=%d
13232>>0	belong&0x00ffffff	10	64-bit architecture=%d
13233>>0	belong&0x00ffffff	11	64-bit architecture=%d
13234>>0	belong&0x00ffffff	12	64-bit architecture=%d
13235>>0	belong&0x00ffffff	13	64-bit architecture=%d
13236>>0	belong&0x00ffffff	14	64-bit architecture=%d
13237>>0	belong&0x00ffffff	15	64-bit architecture=%d
13238>>0	belong&0x00ffffff	16	64-bit architecture=%d
13239>>0	belong&0x00ffffff	17	64-bit architecture=%d
13240>>0	belong&0x00ffffff	18	ppc64
13241>>>4		belong&0x00ffffff	0
13242>>>4		belong&0x00ffffff	1		\b_601
13243>>>4		belong&0x00ffffff	2		\b_602
13244>>>4		belong&0x00ffffff	3		\b_603
13245>>>4		belong&0x00ffffff	4		\b_603e
13246>>>4		belong&0x00ffffff	5		\b_603ev
13247>>>4		belong&0x00ffffff	6		\b_604
13248>>>4		belong&0x00ffffff	7		\b_604e
13249>>>4		belong&0x00ffffff	8		\b_620
13250>>>4		belong&0x00ffffff	9		\b_650
13251>>>4		belong&0x00ffffff	10		\b_7400
13252>>>4		belong&0x00ffffff	11		\b_7450
13253>>>4		belong&0x00ffffff	100		\b_970
13254>>>4		belong&0x00ffffff	>100		subarchitecture=%d
13255>>0	belong&0x00ffffff	>18	64-bit architecture=%d
13256
13257
132580	name		mach-o-be
13259>0	byte		0xcf		64-bit
13260>4	use		mach-o-cpu
13261>12	belong		1		object
13262>12	belong		2		executable
13263>12	belong		3		fixed virtual memory shared library
13264>12	belong		4		core
13265>12	belong		5		preload executable
13266>12	belong		6		dynamically linked shared library
13267>12	belong		7		dynamic linker
13268>12	belong		8		bundle
13269>12	belong		9		dynamically linked shared library stub
13270>12	belong		10		dSYM companion file
13271>12	belong		11		kext bundle
13272>12	belong		>11
13273>>12	belong		x		filetype=%d
13274
13275#
132760	lelong&0xfffffffe	0xfeedface	Mach-O
13277!:strength +1
13278>0	use	\^mach-o-be
13279
132800	belong&0xfffffffe	0xfeedface	Mach-O
13281!:strength +1
13282>0	use	mach-o-be
13283
13284#------------------------------------------------------------------------------
13285# $File: macintosh,v 1.24 2014/08/30 08:34:17 christos Exp $
13286# macintosh description
13287#
13288# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
13289# Daniel Quinlan, quinlan@yggdrasil.com
1329011	string	must\ be\ converted\ with\ BinHex	BinHex binary text
13291!:mime	application/mac-binhex40
13292>41	string	x					\b, version %.3s
13293
13294# Stuffit archives are the de facto standard of compression for Macintosh
13295# files obtained from most archives. (franklsm@tuns.ca)
132960	string		SIT!			StuffIt Archive (data)
13297!:mime	application/x-stuffit
13298!:apple	SIT!SIT!
13299>2	string		x			: %s
133000	string		SITD			StuffIt Deluxe (data)
13301>2	string		x			: %s
133020	string		Seg			StuffIt Deluxe Segment (data)
13303>2	string		x			: %s
13304
13305# Newer StuffIt archives (grant@netbsd.org)
133060	string		StuffIt			StuffIt Archive
13307!:mime	application/x-stuffit
13308!:apple	SIT!SIT!
13309#>162	string		>0			: %s
13310
13311# Macintosh Applications and Installation binaries (franklsm@tuns.ca)
13312# GRR: Too weak
13313#0	string		APPL			Macintosh Application (data)
13314#>2	string		x			\b: %s
13315
13316# Macintosh System files (franklsm@tuns.ca)
13317# GRR: Too weak
13318#0	string		zsys			Macintosh System File (data)
13319#0	string		FNDR			Macintosh Finder (data)
13320#0	string		libr			Macintosh Library (data)
13321#>2	string		x			: %s
13322#0	string		shlb			Macintosh Shared Library (data)
13323#>2	string		x			: %s
13324#0	string		cdev			Macintosh Control Panel (data)
13325#>2	string		x			: %s
13326#0	string		INIT			Macintosh Extension (data)
13327#>2	string		x			: %s
13328#0	string		FFIL			Macintosh Truetype Font (data)
13329#>2	string		x			: %s
13330#0	string		LWFN			Macintosh Postscript Font (data)
13331#>2	string		x			: %s
13332
13333# Additional Macintosh Files (franklsm@tuns.ca)
13334# GRR: Too weak
13335#0	string		PACT			Macintosh Compact Pro Archive (data)
13336#>2	string		x			: %s
13337#0	string		ttro			Macintosh TeachText File (data)
13338#>2	string		x			: %s
13339#0	string		TEXT			Macintosh TeachText File (data)
13340#>2	string		x			: %s
13341#0	string		PDF			Macintosh PDF File (data)
13342#>2	string		x			: %s
13343
13344# MacBinary format (Eric Fischer, enf@pobox.com)
13345#
13346# Unfortunately MacBinary doesn't really have a magic number prior
13347# to the MacBinary III format.  The checksum is really the way to
13348# do it, but the magic file format isn't up to the challenge.
13349#
13350# 0	byte		0
13351# 1	byte				# filename length
13352# 2	string				# filename
13353# 65    string				# file type
13354# 69	string				# file creator
13355# 73	byte				# Finder flags
13356# 74	byte		0
13357# 75	beshort				# vertical posn in window
13358# 77	beshort				# horiz posn in window
13359# 79	beshort				# window or folder ID
13360# 81    byte				# protected?
13361# 82	byte		0
13362# 83	belong				# length of data segment
13363# 87	belong				# length of resource segment
13364# 91	belong				# file creation date
13365# 95	belong				# file modification date
13366# 99	beshort				# length of comment after resource
13367# 101	byte				# new Finder flags
13368# 102	string		mBIN		# (only in MacBinary III)
13369# 106	byte				# char. code of file name
13370# 107	byte				# still more Finder flags
13371# 116	belong				# total file length
13372# 120	beshort				# length of add'l header
13373# 122	byte		129		# for MacBinary II
13374# 122	byte		130		# for MacBinary III
13375# 123	byte		129		# minimum version that can read fmt
13376# 124	beshort				# checksum
13377#
13378# This attempts to use the version numbers as a magic number, requiring
13379# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second
13380# be 0x81.  This works for the files I have, but maybe not for everyone's.
13381
13382# Unfortunately, this magic is quite weak - MPi
13383#122	beshort&0xFCFF	0x8081		Macintosh MacBinary data
13384
13385# MacBinary I doesn't have the version number field at all, but MacBinary II
13386# has been in use since 1987 so I hope there aren't many really old files
13387# floating around that this will miss.  The original spec calls for using
13388# the nulls in 0, 74, and 82 as the magic number.
13389#
13390# Another possibility, that would also work for MacBinary I, is to use
13391# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
13392# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
13393# and that 74 will be 0.  So something like
13394#
13395# 71 	belong&0x80804EFF 0x00000000 	Macintosh MacBinary data
13396#
13397# >73	byte&0x01	0x01		\b, inited
13398# >73	byte&0x02	0x02		\b, changed
13399# >73	byte&0x04	0x04		\b, busy
13400# >73	byte&0x08	0x08		\b, bozo
13401# >73	byte&0x10	0x10		\b, system
13402# >73	byte&0x10	0x20		\b, bundle
13403# >73	byte&0x10	0x40		\b, invisible
13404# >73	byte&0x10	0x80		\b, locked
13405
13406#>65	string		x		\b, type "%4.4s"
13407
13408#>65	string		8BIM		(PhotoShop)
13409#>65	string		ALB3		(PageMaker 3)
13410#>65	string		ALB4		(PageMaker 4)
13411#>65	string		ALT3		(PageMaker 3)
13412#>65	string		APPL		(application)
13413#>65	string		AWWP		(AppleWorks word processor)
13414#>65	string		CIRC		(simulated circuit)
13415#>65	string		DRWG		(MacDraw)
13416#>65	string		EPSF		(Encapsulated PostScript)
13417#>65	string		FFIL		(font suitcase)
13418#>65	string		FKEY		(function key)
13419#>65	string		FNDR		(Macintosh Finder)
13420#>65	string		GIFf		(GIF image)
13421#>65	string		Gzip		(GNU gzip)
13422#>65	string		INIT		(system extension)
13423#>65	string		LIB\ 		(library)
13424#>65	string		LWFN		(PostScript font)
13425#>65	string		MSBC		(Microsoft BASIC)
13426#>65	string		PACT		(Compact Pro archive)
13427#>65	string		PDF\ 		(Portable Document Format)
13428#>65	string		PICT		(picture)
13429#>65	string		PNTG		(MacPaint picture)
13430#>65	string		PREF		(preferences)
13431#>65	string		PROJ		(Think C project)
13432#>65	string		QPRJ		(Think Pascal project)
13433#>65	string		SCFL		(Defender scores)
13434#>65	string		SCRN		(startup screen)
13435#>65	string		SITD		(StuffIt Deluxe)
13436#>65	string		SPn3		(SuperPaint)
13437#>65	string		STAK		(HyperCard stack)
13438#>65	string		Seg\ 		(StuffIt segment)
13439#>65	string		TARF		(Unix tar archive)
13440#>65	string		TEXT		(ASCII)
13441#>65	string		TIFF		(TIFF image)
13442#>65	string		TOVF		(Eudora table of contents)
13443#>65	string		WDBN		(Microsoft Word word processor)
13444#>65	string		WORD		(MacWrite word processor)
13445#>65	string		XLS\ 		(Microsoft Excel)
13446#>65	string		ZIVM		(compress (.Z))
13447#>65	string		ZSYS		(Pre-System 7 system file)
13448#>65	string		acf3		(Aldus FreeHand)
13449#>65	string		cdev		(control panel)
13450#>65	string		dfil		(Desk Accessory suitcase)
13451#>65	string		libr		(library)
13452#>65	string		nX^d		(WriteNow word processor)
13453#>65	string		nX^w		(WriteNow dictionary)
13454#>65	string		rsrc		(resource)
13455#>65	string		scbk		(Scrapbook)
13456#>65	string		shlb		(shared library)
13457#>65	string		ttro		(SimpleText read-only)
13458#>65	string		zsys		(system file)
13459
13460#>69	string		x		\b, creator "%4.4s"
13461
13462# Somewhere, Apple has a repository of registered Creator IDs.  These are
13463# just the ones that I happened to have files from and was able to identify.
13464
13465#>69	string		8BIM		(Adobe Photoshop)
13466#>69	string		ALD3		(PageMaker 3)
13467#>69	string		ALD4		(PageMaker 4)
13468#>69	string		ALFA		(Alpha editor)
13469#>69	string		APLS		(Apple Scanner)
13470#>69	string		APSC		(Apple Scanner)
13471#>69	string		BRKL		(Brickles)
13472#>69	string		BTFT		(BitFont)
13473#>69	string		CCL2 		(Common Lisp 2)
13474#>69	string		CCL\ 		(Common Lisp)
13475#>69	string		CDmo		(The Talking Moose)
13476#>69	string		CPCT		(Compact Pro)
13477#>69	string		CSOm		(Eudora)
13478#>69	string		DMOV		(Font/DA Mover)
13479#>69	string		DSIM		(DigSim)
13480#>69	string		EDIT		(Macintosh Edit)
13481#>69	string		ERIK		(Macintosh Finder)
13482#>69	string		EXTR		(self-extracting archive)
13483#>69	string		Gzip		(GNU gzip)
13484#>69	string		KAHL		(Think C)
13485#>69	string		LWFU		(LaserWriter Utility)
13486#>69	string		LZIV		(compress)
13487#>69	string		MACA		(MacWrite)
13488#>69	string		MACS		(Macintosh operating system)
13489#>69	string		MAcK		(MacKnowledge terminal emulator)
13490#>69	string		MLND		(Defender)
13491#>69	string		MPNT		(MacPaint)
13492#>69	string		MSBB		(Microsoft BASIC (binary))
13493#>69	string		MSWD		(Microsoft Word)
13494#>69	string		NCSA		(NCSA Telnet)
13495#>69	string		PJMM		(Think Pascal)
13496#>69	string		PSAL		(Hunt the Wumpus)
13497#>69	string		PSI2		(Apple File Exchange)
13498#>69	string		R*ch		(BBEdit)
13499#>69	string		RMKR		(Resource Maker)
13500#>69	string		RSED		(Resource Editor)
13501#>69	string		Rich		(BBEdit)
13502#>69	string		SIT!		(StuffIt)
13503#>69	string		SPNT		(SuperPaint)
13504#>69	string		Unix		(NeXT Mac filesystem)
13505#>69	string		VIM!		(Vim editor)
13506#>69	string		WILD		(HyperCard)
13507#>69	string		XCEL		(Microsoft Excel)
13508#>69	string		aCa2		(Fontographer)
13509#>69	string		aca3		(Aldus FreeHand)
13510#>69	string		dosa		(Macintosh MS-DOS file system)
13511#>69	string		movr		(Font/DA Mover)
13512#>69	string		nX^n		(WriteNow)
13513#>69	string		pdos		(Apple ProDOS file system)
13514#>69	string		scbk		(Scrapbook)
13515#>69	string		ttxt		(SimpleText)
13516#>69	string		ufox		(Foreign File Access)
13517
13518# Just in case...
13519
13520102	string		mBIN		MacBinary III data with surprising version number
13521
13522# sas magic from Bruce Foster (bef@nwu.edu)
13523#
13524#0	string		SAS		SAS
13525#>8	string		x		%s
135260	string		SAS		SAS
13527>24	string		DATA		data file
13528>24	string		CATALOG		catalog
13529>24	string		INDEX		data file index
13530>24	string		VIEW		data view
13531# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
13532#
135330x54    string          SAS             SAS 7+
13534>0x9C   string          DATA            data file
13535>0x9C   string          CATALOG         catalog
13536>0x9C   string          INDEX           data file index
13537>0x9C   string          VIEW            data view
13538
13539# spss magic for SPSS system and portable files,
13540#	 from Bruce Foster (bef@nwu.edu).
13541
135420	long		0xc1e2c3c9	SPSS Portable File
13543>40	string 		x		%s
13544
135450	string		$FL2		SPSS System File
13546>24	string		x		%s
13547
135480	string		$FL3		SPSS System File
13549>24	string		x		%s
13550
13551# Macintosh filesystem data
13552# From "Tom N Harris" <telliamed@mac.com>
13553# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
13554# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
13555# entries depend on the data arithmetic added after v.35
13556# There's also some Pascal strings in here, ditto...
13557
13558# The boot block signature, according to IM:Files, is
13559# "for HFS volumes, this field always contains the value 0x4C4B."
13560# But if this is true for MFS or HFS+ volumes, I don't know.
13561# Alternatively, the boot block is supposed to be zeroed if it's
13562# unused, so a simply >0 should suffice.
13563
135640x400	beshort			0xD2D7		Macintosh MFS data
13565>0	beshort			0x4C4B		(bootable)
13566>0x40a	beshort			&0x8000		(locked)
13567>0x402	beldate-0x7C25B080	x		created: %s,
13568>0x406	beldate-0x7C25B080	>0		last backup: %s,
13569>0x414	belong			x		block size: %d,
13570>0x412	beshort			x		number of blocks: %d,
13571>0x424	pstring			x		volume name: %s
13572
13573# *.hfs updated by Joerg Jenderek
13574# http://en.wikipedia.org/wiki/Hierarchical_File_System
13575# "BD" gives many false positives
135760x400	beshort			0x4244
13577# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h
13578# first block of volume bit map (always 3)
13579>0x40e	ubeshort		0x0003
13580# maximal length of volume name is 27
13581>>0x424		ubyte			<28	Macintosh HFS data
13582#!:mime	application/octet-stream
13583# these mime and apple types are not sure
13584!:mime	application/x-apple-diskimage
13585#!:apple	hfsdINIT
13586#!:apple	MACSdisk
13587>>>0		beshort			0x4C4B	(bootable)
13588#>>>0		beshort			0x0000	(not bootable)
13589>>>0x40a	beshort			&0x8000	(locked)
13590>>>0x40a	beshort			^0x0100	(mounted)
13591>>>0x40a	beshort			&0x0200	(spared blocks)
13592>>>0x40a	beshort			&0x0800	(unclean)
13593>>>0x47C	beshort			0x482B	(Embedded HFS+ Volume)
13594# http://www.epochconverter.com/
13595# 0x7C245F00 seconds	~ 2082758400	~ 01 Jan 2036 00:00:00	~ 66 years to 1970
13596# 0x7C25B080 seconds	~ 2082844800	~ 02 Jan 2036 00:00:00
13597# construct not working
13598#>>>0x402	beldate-0x7C25B080	x	created: %s,
13599#>>>0x406	beldate-0x7C25B080	x	last modified: %s,
13600#>>>0x440	beldate-0x7C25B080	>0	last backup: %s,
13601# found block sizes 200h,1200h,2800h
13602>>>0x414	belong			x	block size: %d,
13603>>>0x412	beshort			x	number of blocks: %d,
13604>>>0x424	pstring			x	volume name: %s
13605
136060x400	beshort			0x482B		Macintosh HFS Extended
13607>&0	beshort			x		version %d data
13608>0	beshort			0x4C4B		(bootable)
13609>0x404	belong			^0x00000100	(mounted)
13610>&2	belong			&0x00000200	(spared blocks)
13611>&2	belong			&0x00000800	(unclean)
13612>&2	belong			&0x00008000	(locked)
13613>&6	string			x		last mounted by: '%.4s',
13614# really, that should be treated as a belong and we print a string
13615# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
13616>&14	beldate-0x7C25B080	x		created: %s,
13617# only the creation date is local time, all other timestamps in HFS+ are UTC.
13618>&18	bedate-0x7C25B080	x		last modified: %s,
13619>&22	bedate-0x7C25B080	>0		last backup: %s,
13620>&26	bedate-0x7C25B080	>0		last checked: %s,
13621>&38	belong			x		block size: %d,
13622>&42	belong			x		number of blocks: %d,
13623>&46	belong			x		free blocks: %d
13624
13625## AFAIK, only the signature is different
13626# same as Apple Partition Map
13627# GRR: This magic is too weak, it is just "TS"
13628#0x200		beshort		0x5453		Apple Old Partition data
13629#>0x2		beshort		x		block size: %d,
13630#>0x230		string		x		first type: %s,
13631#>0x210		string		x		name: %s,
13632#>0x254		belong		x		number of blocks: %d,
13633#>0x400		beshort		0x504D
13634#>>0x430		string		x		second type: %s,
13635#>>0x410		string		x		name: %s,
13636#>>0x454		belong		x		number of blocks: %d,
13637#>>0x800		beshort		0x504D
13638#>>>0x830	string		x		third type: %s,
13639#>>>0x810	string		x		name: %s,
13640#>>>0x854	belong		x		number of blocks: %d,
13641#>>>0xa00	beshort		0x504D
13642#>>>>0xa30	string		x		fourth type: %s,
13643#>>>>0xa10	string		x		name: %s,
13644#>>>>0xa54	belong		x		number of blocks: %d
13645
13646# From: Remi Mommsen <mommsen@slac.stanford.edu>
136470		string		BOMStore	Mac OS X bill of materials (BOM) file
13648
13649# From: Adam Buchbinder <adam.buchbinder@gmail.com>
13650# URL: http://en.wikipedia.org/wiki/Datafork_TrueType
13651# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
13652# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
13653# don't know what they mean.
136540	belong	0x100
13655>(0x4.L+24)	beshort	x
13656>>&4	belong	0x73666e74	Mac OSX datafork font, TrueType
13657>>&4	belong	0x464f4e54	Mac OSX datafork font, 'FONT'
13658>>&4	belong	0x4e464e54	Mac OSX datafork font, 'NFNT'
13659>>&4	belong	0x504f5354	Mac OSX datafork font, PostScript
13660
13661#------------------------------------------------------------------------------
13662# $File: cups,v 1.2 2012/11/02 21:50:29 christos Exp $
13663# MacOS files
13664#
13665
136660	string		book\0\0\0\0mark\0\0\0\0	MacOS Alias file
13667
13668#------------------------------------------------------------------------------
13669# $File: magic,v 1.9 2009/09/19 16:28:10 christos Exp $
13670# magic:  file(1) magic for magic files
13671#
136720	string/t		#\ Magic	magic text file for file(1) cmd
136730	lelong		0xF11E041C	magic binary file for file(1) cmd
13674>4	lelong		x		(version %d) (little endian)
136750	belong		0xF11E041C	magic binary file for file(1) cmd
13676>4	belong		x		(version %d) (big endian)
13677#------------------------------------------------------------------------------
13678# $File: mail.news,v 1.21 2012/06/21 01:44:52 christos Exp $
13679# mail.news:  file(1) magic for mail and news
13680#
13681# Unfortunately, saved netnews also has From line added in some news software.
13682#0	string		From 		mail text
136830	string/t		Relay-Version: 	old news text
13684!:mime	message/rfc822
136850	string/t		#!\ rnews	batched news text
13686!:mime	message/rfc822
136870	string/t		N#!\ rnews	mailed, batched news text
13688!:mime	message/rfc822
136890	string/t		Forward\ to 	mail forwarding text
13690!:mime	message/rfc822
136910	string/t		Pipe\ to 	mail piping text
13692!:mime	message/rfc822
136930	string/tc		delivered-to:	SMTP mail text
13694!:mime	message/rfc822
136950	string/tc		return-path:	SMTP mail text
13696!:mime	message/rfc822
136970	string/t		Path:		news text
13698!:mime	message/news
136990	string/t		Xref:		news text
13700!:mime	message/news
137010	string/t		From:		news or mail text
13702!:mime	message/rfc822
137030	string/t		Article 	saved news text
13704!:mime	message/news
137050	string/t		BABYL		Emacs RMAIL text
137060	string/t		Received:	RFC 822 mail text
13707!:mime	message/rfc822
137080	string/t		MIME-Version:	MIME entity text
13709#0	string/t		Content-	MIME entity text
13710
13711# TNEF files...
137120	lelong		0x223E9F78	Transport Neutral Encapsulation Format
13713!:mime	application/vnd.ms-tnef
13714
13715# From: Kevin Sullivan <ksulliva@psc.edu>
137160	string		*mbx*		MBX mail folder
13717
13718# From: Simon Matter <simon.matter@invoca.ch>
137190	string		\241\002\213\015skiplist\ file\0\0\0	Cyrus skiplist DB
13720
13721# JAM(mbp) Fidonet message area databases
13722# JHR file
137230	string	JAM\0			JAM message area header file
13724>12	leshort >0			(%d messages)
13725
13726# Squish Fidonet message area databases
13727# SQD file (requires at least one message in the area)
13728# XXX: Weak magic
13729#256	leshort	0xAFAE4453		Squish message area data file
13730#>4	leshort	>0			(%d messages)
13731
13732#0	string		\<!--\ MHonArc		text/html; x-type=mhonarc
13733
13734# Cyrus: file(1) magic for compiled Cyrus sieve scripts
13735# URL: http://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php
13736# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master
13737# From: Philipp Hahn <hahn@univention.de>
13738
13739# Compiled Cyrus sieve script
137400       string CyrSBytecode     Cyrus sieve bytecode data,
13741>12     belong =1       version 1, big-endian
13742>12     lelong =1       version 1, little-endian
13743>12     belong x        version %d, network-endian
13744#------------------------------------------------------------------------------
13745# $File$
13746# make:  file(1) magic for makefiles
13747#
137480	regex	\^CFLAGS	makefile script text
13749!:mime	text/x-makefile
137500	regex	\^LDFLAGS	makefile script text
13751!:mime	text/x-makefile
137520	regex	\^all:	makefile script text
13753!:mime	text/x-makefile
137540	regex	\^.PRECIOUS	makefile script text
13755!:mime	text/x-makefile
13756
137570	regex	\^SUBDIRS	automake makefile script text
13758!:mime	text/x-makefile
13759
13760
13761#------------------------------------------------------------------------------
13762# $File: msdos,v 1.99 2014/06/03 01:40:24 christos Exp $
13763# map:  file(1) magic for Map data
13764#
13765
13766# Garmin .FIT files http://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
137678	string	.FIT		FIT Map data
13768>15	byte	0
13769>>35	belong	x		\b, unit id %d
13770# 20 years after unix epoch
13771>>39	lelong	x		\b, serial %u
13772>>43	ledate/631152000 x	\b, %s
13773
13774>>47	leshort x		\b, manufacturer %d
13775>>47	leshort	1		\b (garmin)
13776>>49	leshort x		\b, product %d
13777>>53	byte	x		\b, type %d
13778>>53	byte	1		\b (Device)
13779>>53	byte	2		\b (Settings)
13780>>53	byte	3		\b (Sports/Cycling)
13781>>53	byte	4		\b (Activity)
13782>>53	byte	8		\b (Elevations)
13783>>53	byte	10		\b (Totals)
13784
13785#------------------------------------------------------------------------------
13786# $File: maple,v 1.6 2009/09/19 16:28:10 christos Exp $
13787# maple:  file(1) magic for maple files
13788# "H. Nanosecond" <aldomel@ix.netcom.com>
13789# Maple V release 4, a multi-purpose math program
13790#
13791
13792# maple library .lib
137930	string	\000MVR4\nI	MapleVr4 library
13794
13795# .ind
13796# no magic for these :-(
13797# they are compiled indexes for maple files
13798
13799# .hdb
138000	string	\000\004\000\000	Maple help database
13801
13802# .mhp
13803# this has the form <PACKAGE=name>
138040	string	\<PACKAGE=	Maple help file
138050	string	\<HELP\ NAME=	Maple help file
138060	string	\n\<HELP\ NAME=	Maple help file with extra carriage return at start (yuck)
13807#0	string	#\ Newton	Maple help file, old style
138080	string	#\ daub	Maple help file, old style
13809#0	string	#===========	Maple help file, old style
13810
13811# .mws
138120	string	\000\000\001\044\000\221	Maple worksheet
13813#this is anomalous
138140	string	WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000	Maple worksheet, but weird
13815# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n
13816# that is {VERSION major_version miunor_version computer_type version_string}
138170	string	{VERSION\ 	Maple worksheet
13818>9	string	>\0	version %.1s.
13819>>11	string	>\0	%.1s
13820
13821# .mps
138220	string	\0\0\001$	Maple something
13823# from byte 4 it is either 'nul E' or 'soh R'
13824# I think 'nul E' means a file that was saved as  a different name
13825# a sort of revision marking
13826# 'soh R' means new
13827>4	string	\000\105	An old revision
13828>4	string	\001\122	The latest save
13829
13830# .mpl
13831# some of these are the same as .mps above
13832#0000000 000 000 001 044 000 105 same as .mps
13833#0000000 000 000 001 044 001 122 same as .mps
13834
138350	string	#\n##\ <SHAREFILE=	Maple something
138360	string	\n#\n##\ <SHAREFILE=	Maple something
138370	string	##\ <SHAREFILE=	Maple something
138380	string	#\r##\ <SHAREFILE=	Maple something
138390	string	\r#\r##\ <SHAREFILE=	Maple something
138400	string	#\ \r##\ <DESCRIBE>	Maple something anomalous.
13841#--------------------------------------------
13842# marc21: file(1) magic for MARC 21 Format
13843#
13844# Kevin Ford (kefo@loc.gov)
13845#
13846# MARC21 formats are for the representation and communication
13847# of bibliographic and related information in machine-readable
13848# form.  For more info, see http://www.loc.gov/marc/
13849
13850
13851# leader position 20-21 must be 45
1385220	string	45
13853
13854# leader starts with 5 digits, followed by codes specific to MARC format
13855>0	regex/1l	(^[0-9]{5})[acdnp][^bhlnqsu-z]	MARC21 Bibliographic
13856!:mime	application/marc
13857>0	regex/1l	(^[0-9]{5})[acdnosx][z]	MARC21 Authority
13858!:mime	application/marc
13859>0	regex/1l	(^[0-9]{5})[cdn][uvxy]	MARC21 Holdings
13860!:mime	application/marc
138610	regex/1l	(^[0-9]{5})[acdn][w]	MARC21 Classification
13862!:mime	application/marc
13863>0	regex/1l	(^[0-9]{5})[cdn][q]	MARC21 Community
13864!:mime	application/marc
13865
13866# leader position 22-23, should be "00" but is it?
13867>0	regex/1l	(^.{21})([^0]{2})	(non-conforming)
13868!:mime	application/marc
13869
13870#------------------------------------------------------------------------------
13871# $File$
13872# mathcad:  file(1) magic for Mathcad documents
13873# URL:	http://www.mathsoft.com/
13874# From:	Josh Triplett <josh@freedesktop.org>
13875
138760	string	.MCAD\t		Mathcad document
13877
13878#------------------------------------------------------------------------------
13879# $File$
13880# mathematica:  file(1) magic for mathematica files
13881# "H. Nanosecond" <aldomel@ix.netcom.com>
13882# Mathematica a multi-purpose math program
13883# versions 2.2 and 3.0
13884
13885#mathematica .mb
138860	string	\064\024\012\000\035\000\000\000	Mathematica version 2 notebook
138870	string	\064\024\011\000\035\000\000\000	Mathematica version 2 notebook
13888
13889# .ma
13890# multiple possibilites:
13891
138920	string	(*^\n\n::[\011frontEndVersion\ =\ 	Mathematica notebook
13893#>41	string	>\0	%s
13894
13895#0	string	(*^\n\n::[\011palette	Mathematica notebook version 2.x
13896
13897#0	string	(*^\n\n::[\011Information	Mathematica notebook version 2.x
13898#>675	string	>\0	%s #doesn't work well
13899
13900# there may be 'cr' instread of 'nl' in some does this matter?
13901
13902# generic:
139030	string	(*^\r\r::[\011	Mathematica notebook version 2.x
139040	string	(*^\r\n\r\n::[\011	Mathematica notebook version 2.x
139050	string	(*^\015			Mathematica notebook version 2.x
139060	string	(*^\n\r\n\r::[\011	Mathematica notebook version 2.x
139070	string	(*^\r::[\011	Mathematica notebook version 2.x
139080	string	(*^\r\n::[\011	Mathematica notebook version 2.x
139090	string	(*^\n\n::[\011	Mathematica notebook version 2.x
139100	string	(*^\n::[\011	Mathematica notebook version 2.x
13911
13912
13913# Mathematica .mx files
13914
13915#0	string	(*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*)	Mathematica binary file
139160	string	(*This\ is\ a\ Mathematica\ binary\ 	Mathematica binary file
13917#>71	string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
13918# >71... is optional
13919>88	string	>\0	from %s
13920
13921
13922# Mathematica files PBF:
13923# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000
139240	string	MMAPBF\000\001\000\000\000\203\000\001\000	Mathematica PBF (fonts I think)
13925
13926# .ml files  These are menu resources I think
13927# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
13928# how to put that into a magic rule?
139294	string	\ A~	MAthematica .ml file
13930
13931# .nb files
13932#too long 0	string	(***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook	Mathematica 3.0 notebook
139330	string	(***********************	Mathematica 3.0 notebook
13934
13935# other (* matches it is a comment start in these langs
13936# GRR: Too weak; also matches other languages e.g. ML
13937#0	string	(*	Mathematica, or Pascal, Modula-2 or 3 code text
13938
13939#########################
13940# MatLab v5
139410       string  MATLAB  Matlab v5 mat-file
13942>126    short   0x494d  (big endian)
13943>>124   beshort x       version 0x%04x
13944>126    short   0x4d49  (little endian)
13945>>124   leshort x       version 0x%04x
13946
13947
13948#------------------------------------------------------------------------------
13949# $File: matroska,v 1.7 2012/08/26 10:06:15 christos Exp $
13950# matroska:  file(1) magic for Matroska files
13951#
13952# See http://www.matroska.org/
13953#
13954
13955# EBML id:
139560		belong		0x1a45dfa3
13957# DocType id:
13958>4		search/4096 	\x42\x82
13959# DocType contents:
13960>>&1		string		webm		WebM
13961!:mime  video/webm
13962>>&1		string		matroska	Matroska data
13963!:mime  video/x-matroska
13964
13965#------------------------------------------------------------------------------
13966# $File$
13967# Mavroyanopoulos Nikos <nmav@hellug.gr>
13968# mcrypt:   file(1) magic for mcrypt 2.2.x;
139690	string		\0m\3		mcrypt 2.5 encrypted data,
13970>4	string		>\0		algorithm: %s,
13971>>&1	leshort		>0		keysize: %d bytes,
13972>>>&0	string		>\0		mode: %s,
13973
139740	string		\0m\2		mcrypt 2.2 encrypted data,
13975>3	byte		0		algorithm: blowfish-448,
13976>3	byte		1		algorithm: DES,
13977>3	byte		2		algorithm: 3DES,
13978>3	byte		3		algorithm: 3-WAY,
13979>3	byte		4		algorithm: GOST,
13980>3	byte		6		algorithm: SAFER-SK64,
13981>3	byte		7		algorithm: SAFER-SK128,
13982>3	byte		8		algorithm: CAST-128,
13983>3	byte		9		algorithm: xTEA,
13984>3	byte		10		algorithm: TWOFISH-128,
13985>3	byte		11		algorithm: RC2,
13986>3	byte		12		algorithm: TWOFISH-192,
13987>3	byte		13		algorithm: TWOFISH-256,
13988>3	byte		14		algorithm: blowfish-128,
13989>3	byte		15		algorithm: blowfish-192,
13990>3	byte		16		algorithm: blowfish-256,
13991>3	byte		100		algorithm: RC6,
13992>3	byte		101		algorithm: IDEA,
13993>4	byte		0		mode: CBC,
13994>4	byte		1		mode: ECB,
13995>4	byte		2		mode: CFB,
13996>4	byte		3		mode: OFB,
13997>4	byte		4		mode: nOFB,
13998>5	byte		0		keymode: 8bit
13999>5	byte		1		keymode: 4bit
14000>5	byte		2		keymode: SHA-1 hash
14001>5	byte		3		keymode: MD5 hash
14002
14003#------------------------------------------------------------------------------
14004# $File$
14005# mercurial:  file(1) magic for Mercurial changeset bundles
14006# http://www.selenic.com/mercurial/wiki/
14007#
14008# Jesse Glick (jesse.glick@sun.com)
14009#
14010
140110	string		HG10		Mercurial changeset bundle
14012>4	string		UN		(uncompressed)
14013>4	string		GZ		(gzip compressed)
14014>4	string		BZ		(bzip2 compressed)
14015
14016#------------------------------------------------------------------------------
14017# $File: mathematica,v 1.7 2009/09/19 16:28:10 christos Exp $
14018# metastore:  file(1) magic for metastore files
14019# From: Thomas Wissen
14020# see http://david.hardeman.nu/software.php#metastore
140210	string		MeTaSt00r3	Metastore data file,
14022>10	bequad		x		version %0llx
14023
14024#------------------------------------------------------------------------------
14025# $File: rinex,v 1.4 2011/05/03 01:44:17 christos Exp $
14026# rinex:  file(1) magic for RINEX files
14027# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
14028# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf
14029# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data
1403060	string		RINEX
14031>80	search/256	XXRINEXB	RINEX Data, GEO SBAS Broadcast
14032>>&32	string		x		\b, date %15.15s
14033>>5	string		x		\b, version %6.6s
14034!:mime	rinex/broadcast
14035>80	search/256	XXRINEXD	RINEX Data, Observation (Hatanaka comp)
14036>>&32	string		x		\b, date %15.15s
14037>>5	string		x		\b, version %6.6s
14038!:mime	rinex/observation
14039>80	search/256	XXRINEXC	RINEX Data, Clock
14040>>&32	string		x		\b, date %15.15s
14041>>5	string		x		\b, version %6.6s
14042!:mime	rinex/clock
14043>80	search/256	XXRINEXH	RINEX Data, GEO SBAS Navigation
14044>>&32	string		x		\b, date %15.15s
14045>>5	string		x		\b, version %6.6s
14046!:mime	rinex/navigation
14047>80	search/256	XXRINEXG	RINEX Data, GLONASS Navigation
14048>>&32	string		x		\b, date %15.15s
14049>>5	string		x		\b, version %6.6s
14050!:mime	rinex/navigation
14051>80	search/256	XXRINEXL	RINEX Data, Galileo Navigation
14052>>&32	string		x		\b, date %15.15s
14053>>5	string		x		\b, version %6.6s
14054!:mime	rinex/navigation
14055>80	search/256	XXRINEXM	RINEX Data, Meteorological
14056>>&32	string		x		\b, date %15.15s
14057>>5	string		x		\b, version %6.6s
14058!:mime	rinex/meteorological
14059>80	search/256	XXRINEXN	RINEX Data, Navigation
14060>>&32	string		x		\b, date %15.15s
14061>>5	string		x		\b, version %6.6s
14062!:mime	rinex/navigation
14063>80	search/256	XXRINEXO	RINEX Data, Observation
14064>>&32	string		x		\b, date %15.15s
14065>>5	string		x		\b, version %6.6s
14066!:mime	rinex/observation
14067
14068# https://en.wikipedia.org/wiki/GRIB
140690	string	GRIB
14070>7	byte	=1	Gridded binary (GRIB) version 1
14071>7	byte	=2	Gridded binary (GRIB) version 2
14072
14073#------------------------------------------------------------------------------
14074# $File: mime,v 1.5 2009/09/19 16:28:10 christos Exp $
14075# mime:  file(1) magic for MIME encoded files
14076#
140770	string/t		Content-Type:\
14078>14	string		>\0		%s
140790	string/t		Content-Type:
14080>13	string		>\0		%s
14081
14082#------------------------------------------------------------------------------
14083# $File: mips,v 1.9 2013/01/12 03:09:51 christos Exp $
14084# mips:  file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX
14085# and DEC Ultrix
14086#
140870	beshort	0x0160		MIPSEB ECOFF executable
14088>20	beshort	0407		(impure)
14089>20	beshort	0410		(swapped)
14090>20	beshort	0413		(paged)
14091>8	belong	>0		not stripped
14092>8	belong	0		stripped
14093>22	byte	x		- version %d
14094>23	byte	x		\b.%d
14095#
140960	beshort	0x0162		MIPSEL-BE ECOFF executable
14097>20	beshort	0407		(impure)
14098>20	beshort	0410		(swapped)
14099>20	beshort	0413		(paged)
14100>8	belong	>0		not stripped
14101>8	belong	0		stripped
14102>23	byte	x		- version %d
14103>22	byte	x		\b.%d
14104#
141050	beshort	0x6001		MIPSEB-LE ECOFF executable
14106>20	beshort	03401		(impure)
14107>20	beshort	04001		(swapped)
14108>20	beshort	05401		(paged)
14109>8	belong	>0		not stripped
14110>8	belong	0		stripped
14111>23	byte	x		- version %d
14112>22	byte	x		\b.%d
14113#
141140	beshort	0x6201		MIPSEL ECOFF executable
14115>20	beshort	03401		(impure)
14116>20	beshort	04001		(swapped)
14117>20	beshort	05401		(paged)
14118>8	belong	>0		not stripped
14119>8	belong	0		stripped
14120>23	byte	x		- version %d
14121>22	byte	x		\b.%d
14122#
14123# MIPS 2 additions
14124#
141250	beshort	0x0163		MIPSEB MIPS-II ECOFF executable
14126>20	beshort	0407		(impure)
14127>20	beshort	0410		(swapped)
14128>20	beshort	0413		(paged)
14129>8	belong	>0		not stripped
14130>8	belong	0		stripped
14131>22	byte	x		- version %d
14132>23	byte	x		\b.%d
14133#
141340	beshort	0x0166		MIPSEL-BE MIPS-II ECOFF executable
14135>20	beshort	0407		(impure)
14136>20	beshort	0410		(swapped)
14137>20	beshort	0413		(paged)
14138>8	belong	>0		not stripped
14139>8	belong	0		stripped
14140>22	byte	x		- version %d
14141>23	byte	x		\b.%d
14142#
141430	beshort	0x6301		MIPSEB-LE MIPS-II ECOFF executable
14144>20	beshort	03401		(impure)
14145>20	beshort	04001		(swapped)
14146>20	beshort	05401		(paged)
14147>8	belong	>0		not stripped
14148>8	belong	0		stripped
14149>23	byte	x		- version %d
14150>22	byte	x		\b.%d
14151#
141520	beshort	0x6601		MIPSEL MIPS-II ECOFF executable
14153>20	beshort	03401		(impure)
14154>20	beshort	04001		(swapped)
14155>20	beshort	05401		(paged)
14156>8	belong	>0		not stripped
14157>8	belong	0		stripped
14158>23	byte	x		- version %d
14159>22	byte	x		\b.%d
14160#
14161# MIPS 3 additions
14162#
141630	beshort	0x0140		MIPSEB MIPS-III ECOFF executable
14164>20	beshort	0407		(impure)
14165>20	beshort	0410		(swapped)
14166>20	beshort	0413		(paged)
14167>8	belong	>0		not stripped
14168>8	belong	0		stripped
14169>22	byte	x		- version %d
14170>23	byte	x		\b.%d
14171#
141720	beshort	0x0142		MIPSEL-BE MIPS-III ECOFF executable
14173>20	beshort	0407		(impure)
14174>20	beshort	0410		(swapped)
14175>20	beshort	0413		(paged)
14176>8	belong	>0		not stripped
14177>8	belong	0		stripped
14178>22	byte	x		- version %d
14179>23	byte	x		\b.%d
14180#
141810	beshort	0x4001		MIPSEB-LE MIPS-III ECOFF executable
14182>20	beshort	03401		(impure)
14183>20	beshort	04001		(swapped)
14184>20	beshort	05401		(paged)
14185>8	belong	>0		not stripped
14186>8	belong	0		stripped
14187>23	byte	x		- version %d
14188>22	byte	x		\b.%d
14189#
141900	beshort	0x4201		MIPSEL MIPS-III ECOFF executable
14191>20	beshort	03401		(impure)
14192>20	beshort	04001		(swapped)
14193>20	beshort	05401		(paged)
14194>8	belong	>0		not stripped
14195>8	belong	0		stripped
14196>23	byte	x		- version %d
14197>22	byte	x		\b.%d
14198#
141990	beshort	0x180		MIPSEB Ucode
142000	beshort	0x182		MIPSEL-BE Ucode
14201
14202#------------------------------------------------------------------------------
14203# $File$
14204# mirage:  file(1) magic for Mirage executables
14205#
14206# XXX - byte order?
14207#
142080	long	31415		Mirage Assembler m.out executable
14209
14210#-----------------------------------------------------------------------------
14211# $File: misctools,v 1.13 2013/01/16 13:53:10 christos Exp $
14212# misctools:  file(1) magic for miscellaneous UNIX tools.
14213#
142140	search/1	%%!!			X-Post-It-Note text
142150	string/c	BEGIN:VCALENDAR		vCalendar calendar file
14216!:mime	text/calendar
142170	string/c	BEGIN:VCARD		vCard visiting card
14218!:mime	text/x-vcard
14219
14220# Summary: Libtool library file
14221# Extension: .la
14222# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl>
142230	search/80	.la\ -\ a\ libtool\ library\ file	libtool library file
14224
14225# Summary: Libtool object file
14226# Extension: .lo
14227# Submitted by: Abel Cheung <abelcheung@gmail.com>
142280	search/80	.lo\ -\ a\ libtool\ object\ file	libtool object file
14229
14230# From: Daniel Novotny <dnovotny@redhat.com>
142310	string		MDMP\x93\xA7				MDMP crash report data
14232
14233# Summary: abook addressbook file
14234# Submitted by: Mark Schreiber <mark7@alumni.cmu.edu>
142350	string	#\x20abook\x20addressbook\x20file abook address book
14236!:mime application/x-abook-addressbook
14237
14238#------------------------------------------------------------------------------
14239# $File$
14240# mkid:  file(1) magic for mkid(1) databases
14241#
14242# ID is the binary tags database produced by mkid(1).
14243#
14244# XXX - byte order?
14245#
142460	string		\311\304	ID tags data
14247>2	short		>0		version %d
14248
14249#------------------------------------------------------------------------------
14250# $File$
14251# mlssa: file(1) magic for MLSSA datafiles
14252#
142530		lelong		0xffffabcd	MLSSA datafile,
14254>4		leshort		x		algorithm %d,
14255>10		lelong		x		%d samples
14256
14257#------------------------------------------------------------------------------
14258# $File$
14259# mmdf:  file(1) magic for MMDF mail files
14260#
142610	string	\001\001\001\001	MMDF mailbox
14262
14263#------------------------------------------------------------------------------
14264# $File: modem,v 1.5 2010/09/20 18:55:20 rrt Exp $
14265# modem:  file(1) magic for modem programs
14266#
14267# From: Florian La Roche <florian@knorke.saar.de>
142681	string		PC\ Research,\ Inc	Digifax-G3-File
14269>29	byte		1			\b, fine resolution
14270>29	byte		0			\b, normal resolution
14271
142720	short		0x0100		raw G3 data, byte-padded
142730	short		0x1400		raw G3 data
14274#
14275# Magic data for vgetty voice formats
14276# (Martin Seine & Marc Eberhard)
14277
14278#
14279# raw modem data version 1
14280#
142810    string    RMD1      raw modem data
14282>4   string    >\0       (%s /
14283>20  short     >0        compression type 0x%04x)
14284
14285#
14286# portable voice format 1
14287#
142880    string    PVF1\n         portable voice format
14289>5   string    >\0       (binary %s)
14290
14291#
14292# portable voice format 2
14293#
142940    string    PVF2\n         portable voice format
14295>5   string >\0          (ascii %s)
14296
14297# From: Bernd Nuernberger <bernd.nuernberger@web.de>
14298# Brooktrout G3 fax data incl. 128 byte header
14299# Common suffixes: 3??, BRK, BRT, BTR
143000	leshort		0x01bb
14301>2	leshort		0x0100		Brooktrout 301 fax image,
14302>>9	leshort		x		%d x
14303>>0x2d	leshort		x		%d
14304>>6	leshort		200		\b, fine resolution
14305>>6	leshort		100		\b, normal resolution
14306>>11	byte		1		\b, G3 compression
14307>>11	byte		2		\b, G32D compression
14308
14309#------------------------------------------------------------------------------
14310# $File: motorola,v 1.10 2009/09/19 16:28:11 christos Exp $
14311# motorola:  file(1) magic for Motorola 68K and 88K binaries
14312#
14313# 68K
14314#
143150	beshort		0520		mc68k COFF
14316>18	beshort		^00000020	object
14317>18	beshort		&00000020	executable
14318>12	belong		>0		not stripped
14319>168	string		.lowmem		Apple toolbox
14320>20	beshort		0407		(impure)
14321>20	beshort		0410		(pure)
14322>20	beshort		0413		(demand paged)
14323>20	beshort		0421		(standalone)
143240	beshort		0521		mc68k executable (shared)
14325>12	belong		>0		not stripped
143260	beshort		0522		mc68k executable (shared demand paged)
14327>12	belong		>0		not stripped
14328#
14329# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
14330#
143310	beshort		0554		68K BCS executable
14332#
14333# 88K
14334#
14335# Motorola/88Open BCS
14336#
143370	beshort		0555		88K BCS executable
14338#
14339# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
143400   string      S0          Motorola S-Record; binary data in text format
14341
14342# ATARI ST relocatable PRG
14343#
14344# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001
14345# (according to Roland Waldi, Oct 21, 1987)
14346# besides the magic 0x601a, the text segment size is checked to be
14347# not larger than 1 MB (which is a lot on ST).
14348# The additional 0x601b distinction I took from Doug Lee's magic.
143490	belong&0xFFFFFFF0	0x601A0000	Atari ST M68K contiguous executable
14350>2	belong			x		(txt=%d,
14351>6	belong			x		dat=%d,
14352>10	belong			x		bss=%d,
14353>14	belong			x		sym=%d)
143540	belong&0xFFFFFFF0	0x601B0000	Atari ST M68K non-contig executable
14355>2	belong			x		(txt=%d,
14356>6	belong			x		dat=%d,
14357>10	belong			x		bss=%d,
14358>14	belong			x		sym=%d)
14359
14360# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>)
143610       beshort         0x601A          Atari 68xxx executable,
14362>2      belong          x               text len %u,
14363>6      belong          x               data len %u,
14364>10     belong          x               BSS len %u,
14365>14     belong          x               symboltab len %u,
14366>18     belong          0
14367>22     belong          &0x01           fastload flag,
14368>22     belong          &0x02           may be loaded to alternate RAM,
14369>22     belong          &0x04           malloc may be from alternate RAM,
14370>22     belong          x               flags: 0x%X,
14371>26     beshort         0               no relocation tab
14372>26     beshort         !0              + relocation tab
14373>30     string          SFX             [Self-Extracting LZH SFX archive]
14374>38     string          SFX             [Self-Extracting LZH SFX archive]
14375>44     string          ZIP!            [Self-Extracting ZIP SFX archive]
14376
143770       beshort         0x0064          Atari 68xxx CPX file
14378>8      beshort         x               (version %04x)
14379
14380#------------------------------------------------------------------------------
14381# $File: mozilla,v 1.5 2015/01/24 15:48:42 christos Exp $
14382# mozilla:  file(1) magic for Mozilla XUL fastload files
14383# (XUL.mfasl and XPC.mfasl)
14384# URL:	http://www.mozilla.org/
14385# From:	Josh Triplett <josh@freedesktop.org>
14386
143870	string	XPCOM\nMozFASL\r\n\x1A		Mozilla XUL fastload data
143880	string	mozLz4a				Mozilla lz4 compressed bookmark data
14389
14390#------------------------------------------------------------------------------
14391# $File: msdos,v 1.99 2014/06/03 01:40:24 christos Exp $
14392# msdos:  file(1) magic for MS-DOS files
14393#
14394
14395# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
14396# updated by Joerg Jenderek at Oct 2008,Apr 2011
143970	string/t	@
14398>1	string/cW	\ echo\ off	DOS batch file text
14399!:mime	text/x-msdos-batch
14400>1	string/cW	echo\ off	DOS batch file text
14401!:mime	text/x-msdos-batch
14402>1	string/cW	rem		DOS batch file text
14403!:mime	text/x-msdos-batch
14404>1	string/cW	set\ 		DOS batch file text
14405!:mime	text/x-msdos-batch
14406
14407
14408# OS/2 batch files are REXX. the second regex is a bit generic, oh well
14409# the matched commands seem to be common in REXX and uncommon elsewhere
14410100	search/0xffff   rxfuncadd
14411>100	regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc	OS/2 REXX batch file text
14412100	search/0xffff   say
14413>100	regex/c =^[\ \t]{0,10}say\ ['"]			OS/2 REXX batch file text
14414
144150	leshort		0x14c	MS Windows COFF Intel 80386 object file
14416#>4	ledate		x	stamp %s
144170	leshort		0x166	MS Windows COFF MIPS R4000 object file
14418#>4	ledate		x	stamp %s
144190	leshort		0x184	MS Windows COFF Alpha object file
14420#>4	ledate		x	stamp %s
144210	leshort		0x268	MS Windows COFF Motorola 68000 object file
14422#>4	ledate		x	stamp %s
144230	leshort		0x1f0	MS Windows COFF PowerPC object file
14424#>4	ledate		x	stamp %s
144250	leshort		0x290	MS Windows COFF PA-RISC object file
14426#>4	ledate		x	stamp %s
14427
14428# Tests for various EXE types.
14429#
14430# Many of the compressed formats were extraced from IDARC 1.23 source code.
14431#
144320	string/b	MZ
14433# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file.
14434>0x18	leshort <0x40 MS-DOS executable
14435!:mime	application/x-dosexec
14436# These traditional tests usually work but not always.  When test quality support is
14437# implemented these can be turned on.
14438#>>0x18	leshort	0x1c	(Borland compiler)
14439#>>0x18	leshort	0x1e	(MS compiler)
14440
14441# If the relocation table is 0x40 or more bytes into the file, it's definitely
14442# not a DOS EXE.
14443>0x18  leshort >0x3f
14444
14445# Maybe it's a PE?
14446>>(0x3c.l) string PE\0\0 PE
14447!:mime	application/x-dosexec
14448>>>(0x3c.l+24)	leshort		0x010b	\b32 executable
14449>>>(0x3c.l+24)	leshort		0x020b	\b32+ executable
14450>>>(0x3c.l+24)	leshort		0x0107	ROM image
14451>>>(0x3c.l+24)	default		x	Unknown PE signature
14452>>>>&0 		leshort		x	0x%x
14453>>>(0x3c.l+22)	leshort&0x2000	>0	(DLL)
14454>>>(0x3c.l+92)	leshort		1	(native)
14455>>>(0x3c.l+92)	leshort		2	(GUI)
14456>>>(0x3c.l+92)	leshort		3	(console)
14457>>>(0x3c.l+92)	leshort		7	(POSIX)
14458>>>(0x3c.l+92)	leshort		9	(Windows CE)
14459>>>(0x3c.l+92)	leshort		10	(EFI application)
14460>>>(0x3c.l+92)	leshort		11	(EFI boot service driver)
14461>>>(0x3c.l+92)	leshort		12	(EFI runtime driver)
14462>>>(0x3c.l+92)	leshort		13	(EFI ROM)
14463>>>(0x3c.l+92)	leshort		14	(XBOX)
14464>>>(0x3c.l+92)	leshort		15	(Windows boot application)
14465>>>(0x3c.l+92)	default		x	(Unknown subsystem
14466>>>>&0		leshort		x	0x%x)
14467>>>(0x3c.l+4)	leshort		0x14c	Intel 80386
14468>>>(0x3c.l+4)	leshort		0x166	MIPS R4000
14469>>>(0x3c.l+4)	leshort		0x168	MIPS R10000
14470>>>(0x3c.l+4)	leshort		0x184	Alpha
14471>>>(0x3c.l+4)	leshort		0x1a2	Hitachi SH3
14472>>>(0x3c.l+4)	leshort		0x1a6	Hitachi SH4
14473>>>(0x3c.l+4)	leshort		0x1c0	ARM
14474>>>(0x3c.l+4)	leshort		0x1c2	ARM Thumb
14475>>>(0x3c.l+4)	leshort		0x1c4	ARMv7 Thumb
14476>>>(0x3c.l+4)	leshort		0x1f0	PowerPC
14477>>>(0x3c.l+4)	leshort		0x200	Intel Itanium
14478>>>(0x3c.l+4)	leshort		0x266	MIPS16
14479>>>(0x3c.l+4)	leshort		0x268	Motorola 68000
14480>>>(0x3c.l+4)	leshort		0x290	PA-RISC
14481>>>(0x3c.l+4)	leshort		0x366	MIPSIV
14482>>>(0x3c.l+4)	leshort		0x466	MIPS16 with FPU
14483>>>(0x3c.l+4)	leshort		0xebc	EFI byte code
14484>>>(0x3c.l+4)	leshort		0x8664	x86-64
14485>>>(0x3c.l+4)	leshort		0xc0ee	MSIL
14486>>>(0x3c.l+4)	default		x	Unknown processor type
14487>>>>&0		leshort		x	0x%x
14488>>>(0x3c.l+22)	leshort&0x0200	>0	(stripped to external PDB)
14489>>>(0x3c.l+22)	leshort&0x1000	>0	system file
14490>>>(0x3c.l+24)	leshort		0x010b
14491>>>>(0x3c.l+232) lelong	>0	Mono/.Net assembly
14492>>>(0x3c.l+24)	leshort		0x020b
14493>>>>(0x3c.l+248) lelong	>0	Mono/.Net assembly
14494
14495# hooray, there's a DOS extender using the PE format, with a valid PE
14496# executable inside (which just prints a message and exits if run in win)
14497>>>(8.s*16)		string		32STUB	\b, 32rtm DOS extender
14498>>>(8.s*16)		string		!32STUB	\b, for MS Windows
14499>>>(0x3c.l+0xf8)	string		UPX0 \b, UPX compressed
14500>>>(0x3c.l+0xf8)	search/0x140	PEC2 \b, PECompact2 compressed
14501>>>(0x3c.l+0xf8)	search/0x140	UPX2
14502>>>>(&0x10.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
14503>>>(0x3c.l+0xf8)	search/0x140	.idata
14504>>>>(&0xe.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
14505>>>>(&0xe.l+(-4))	string		ZZ0 \b, ZZip self-extracting archive
14506>>>>(&0xe.l+(-4))	string		ZZ1 \b, ZZip self-extracting archive
14507>>>(0x3c.l+0xf8)	search/0x140	.rsrc
14508>>>>(&0x0f.l+(-4))	string		a\\\4\5 \b, WinHKI self-extracting archive
14509>>>>(&0x0f.l+(-4))	string		Rar! \b, RAR self-extracting archive
14510>>>>(&0x0f.l+(-4))	search/0x3000	MSCF \b, InstallShield self-extracting archive
14511>>>>(&0x0f.l+(-4))	search/32	Nullsoft \b, Nullsoft Installer self-extracting archive
14512>>>(0x3c.l+0xf8)	search/0x140	.data
14513>>>>(&0x0f.l)		string		WEXTRACT \b, MS CAB-Installer self-extracting archive
14514>>>(0x3c.l+0xf8)	search/0x140	.petite\0 \b, Petite compressed
14515>>>>(0x3c.l+0xf7)	byte		x
14516>>>>>(&0x104.l+(-4))	string		=!sfx! \b, ACE self-extracting archive
14517>>>(0x3c.l+0xf8)	search/0x140	.WISE \b, WISE installer self-extracting archive
14518>>>(0x3c.l+0xf8)	search/0x140	.dz\0\0\0 \b, Dzip self-extracting archive
14519>>>&(0x3c.l+0xf8)	search/0x100	_winzip_ \b, ZIP self-extracting archive (WinZip)
14520>>>&(0x3c.l+0xf8)	search/0x100	SharedD \b, Microsoft Installer self-extracting archive
14521>>>0x30			string		Inno \b, InnoSetup self-extracting archive
14522
14523# Hmm, not a PE but the relocation table is too high for a traditional DOS exe,
14524# must be one of the unusual subformats.
14525>>(0x3c.l) string !PE\0\0 MS-DOS executable
14526!:mime	application/x-dosexec
14527
14528>>(0x3c.l)		string		NE \b, NE
14529!:mime	application/x-dosexec
14530>>>(0x3c.l+0x36)	byte		1 for OS/2 1.x
14531>>>(0x3c.l+0x36)	byte		2 for MS Windows 3.x
14532>>>(0x3c.l+0x36)	byte		3 for MS-DOS
14533>>>(0x3c.l+0x36)	byte		4 for Windows 386
14534>>>(0x3c.l+0x36)	byte		5 for Borland Operating System Services
14535>>>(0x3c.l+0x36)	default		x
14536>>>>(0x3c.l+0x36)	byte		x (unknown OS %x)
14537>>>(0x3c.l+0x36)	byte		0x81 for MS-DOS, Phar Lap DOS extender
14538>>>(0x3c.l+0x0c)	leshort&0x8003	0x8002 (DLL)
14539>>>(0x3c.l+0x0c)	leshort&0x8003	0x8001 (driver)
14540>>>&(&0x24.s-1)		string		ARJSFX \b, ARJ self-extracting archive
14541>>>(0x3c.l+0x70)	search/0x80	WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
14542
14543>>(0x3c.l)		string		LX\0\0 \b, LX
14544!:mime	application/x-dosexec
14545>>>(0x3c.l+0x0a)	leshort		<1 (unknown OS)
14546>>>(0x3c.l+0x0a)	leshort		1 for OS/2
14547>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
14548>>>(0x3c.l+0x0a)	leshort		3 for DOS
14549>>>(0x3c.l+0x0a)	leshort		>3 (unknown OS)
14550>>>(0x3c.l+0x10)	lelong&0x28000	=0x8000 (DLL)
14551>>>(0x3c.l+0x10)	lelong&0x20000	>0 (device driver)
14552>>>(0x3c.l+0x10)	lelong&0x300	0x300 (GUI)
14553>>>(0x3c.l+0x10)	lelong&0x28300	<0x300 (console)
14554>>>(0x3c.l+0x08)	leshort		1 i80286
14555>>>(0x3c.l+0x08)	leshort		2 i80386
14556>>>(0x3c.l+0x08)	leshort		3 i80486
14557>>>(8.s*16)		string		emx \b, emx
14558>>>>&1			string		x %s
14559>>>&(&0x54.l-3)		string		arjsfx \b, ARJ self-extracting archive
14560
14561# MS Windows system file, supposedly a collection of LE executables
14562>>(0x3c.l)		string		W3 \b, W3 for MS Windows
14563!:mime	application/x-dosexec
14564
14565>>(0x3c.l)		string		LE\0\0 \b, LE executable
14566!:mime	application/x-dosexec
14567>>>(0x3c.l+0x0a)	leshort		1
14568# some DOS extenders use LE files with OS/2 header
14569>>>>0x240		search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
14570>>>>0x240		search/0x200	WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
14571>>>>0x440		search/0x100	CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
14572>>>>0x40		search/0x40	PMODE/W for MS-DOS, PMODE/W DOS extender
14573>>>>0x40		search/0x40	STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
14574>>>>0x40		search/0x80	STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
14575>>>>0x40		search/0x80	DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
14576# this is a wild guess; hopefully it is a specific signature
14577>>>>&0x24		lelong		<0x50
14578>>>>>(&0x4c.l)		string		\xfc\xb8WATCOM
14579>>>>>>&0		search/8	3\xdbf\xb9 \b, 32Lite compressed
14580# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP
14581#>>>>(0x3c.l+0x1c)	lelong		>0x10000 for OS/2
14582# fails with DOS-Extenders.
14583>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
14584>>>(0x3c.l+0x0a)	leshort		3 for DOS
14585>>>(0x3c.l+0x0a)	leshort		4 for MS Windows (VxD)
14586>>>(&0x7c.l+0x26)	string		UPX \b, UPX compressed
14587>>>&(&0x54.l-3)		string		UNACE \b, ACE self-extracting archive
14588
14589# looks like ASCII, probably some embedded copyright message.
14590# and definitely not NE/LE/LX/PE
14591>>0x3c		lelong	>0x20000000
14592>>>(4.s*512)	leshort !0x014c \b, MZ for MS-DOS
14593!:mime	application/x-dosexec
14594# header data too small for extended executable
14595>2		long	!0
14596>>0x18		leshort <0x40
14597>>>(4.s*512)	leshort !0x014c
14598
14599>>>>&(2.s-514)	string	!LE
14600>>>>>&-2	string	!BW \b, MZ for MS-DOS
14601!:mime	application/x-dosexec
14602>>>>&(2.s-514)	string	LE \b, LE
14603>>>>>0x240	search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
14604# educated guess since indirection is still not capable enough for complex offset
14605# calculations (next embedded executable would be at &(&2*512+&0-2)
14606# I suspect there are only LE executables in these multi-exe files
14607>>>>&(2.s-514)	string	BW
14608>>>>>0x240	search/0x100	DOS/4G	\b, LE for MS-DOS, DOS4GW DOS extender (embedded)
14609>>>>>0x240	search/0x100	!DOS/4G	\b, BW collection for MS-DOS
14610
14611# This sequence skips to the first COFF segment, usually .text
14612>(4.s*512)	leshort		0x014c \b, COFF
14613!:mime	application/x-dosexec
14614>>(8.s*16)	string		go32stub for MS-DOS, DJGPP go32 DOS extender
14615>>(8.s*16)	string		emx
14616>>>&1		string		x for DOS, Win or OS/2, emx %s
14617>>&(&0x42.l-3)	byte		x
14618>>>&0x26	string		UPX \b, UPX compressed
14619# and yet another guess: small .text, and after large .data is unusal, could be 32lite
14620>>&0x2c		search/0xa0	.text
14621>>>&0x0b	lelong		<0x2000
14622>>>>&0		lelong		>0x6000 \b, 32lite compressed
14623
14624>(8.s*16) string $WdX \b, WDos/X DOS extender
14625
14626# By now an executable type should have been printed out.  The executable
14627# may be a self-uncompressing archive, so look for evidence of that and
14628# print it out.
14629#
14630# Some signatures below from Greg Roelofs, newt@uchicago.edu.
14631#
14632>0x35	string	\x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
14633>0xe7	string	LH/2\ 	Self-Extract \b, %s
14634>0x1c	string	UC2X	\b, UCEXE compressed
14635>0x1c	string	WWP\ 	\b, WWPACK compressed
14636>0x1c	string	RJSX 	\b, ARJ self-extracting archive
14637>0x1c	string	diet 	\b, diet compressed
14638>0x1c	string	LZ09 	\b, LZEXE v0.90 compressed
14639>0x1c	string	LZ91 	\b, LZEXE v0.91 compressed
14640>0x1c	string	tz 	\b, TinyProg compressed
14641>0x1e	string	Copyright\ 1989-1990\ PKWARE\ Inc.	Self-extracting PKZIP archive
14642!:mime	application/zip
14643# Yes, this really is "Copr", not "Corp."
14644>0x1e	string	PKLITE\ Copr.	Self-extracting PKZIP archive
14645!:mime	application/zip
14646# winarj stores a message in the stub instead of the sig in the MZ header
14647>0x20	search/0xe0	aRJsfX \b, ARJ self-extracting archive
14648>0x20	string AIN
14649>>0x23	string 2	\b, AIN 2.x compressed
14650>>0x23	string <2	\b, AIN 1.x compressed
14651>>0x23	string >2	\b, AIN 1.x compressed
14652>0x24	string	LHa's\ SFX \b, LHa self-extracting archive
14653!:mime	application/x-lha
14654>0x24	string	LHA's\ SFX \b, LHa self-extracting archive
14655!:mime	application/x-lha
14656>0x24	string	\ $ARX \b, ARX self-extracting archive
14657>0x24	string	\ $LHarc \b, LHarc self-extracting archive
14658>0x20	string	SFX\ by\ LARC \b, LARC self-extracting archive
14659>0x40	string aPKG \b, aPackage self-extracting archive
14660>0x64	string	W\ Collis\0\0 \b, Compack compressed
14661>0x7a	string		Windows\ self-extracting\ ZIP	\b, ZIP self-extracting archive
14662>>&0xf4 search/0x140 \x0\x40\x1\x0
14663>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
14664>1638	string	-lh5- \b, LHa self-extracting archive v2.13S
14665>0x17888 string Rar! \b, RAR self-extracting archive
14666
14667# Skip to the end of the EXE.  This will usually work fine in the PE case
14668# because the MZ image is hardcoded into the toolchain and almost certainly
14669# won't match any of these signatures.
14670>(4.s*512)	long	x
14671>>&(2.s-517)	byte	x
14672>>>&0	string		PK\3\4 \b, ZIP self-extracting archive
14673>>>&0	string		Rar! \b, RAR self-extracting archive
14674>>>&0	string		=!\x11 \b, AIN 2.x self-extracting archive
14675>>>&0	string		=!\x12 \b, AIN 2.x self-extracting archive
14676>>>&0	string		=!\x17 \b, AIN 1.x self-extracting archive
14677>>>&0	string		=!\x18 \b, AIN 1.x self-extracting archive
14678>>>&7	search/400	**ACE** \b, ACE self-extracting archive
14679>>>&0	search/0x480	UC2SFX\ Header \b, UC2 self-extracting archive
14680
14681# a few unknown ZIP sfxes, no idea if they are needed or if they are
14682# already captured by the generic patterns above
14683>(8.s*16)	search/0x20	PKSFX \b, ZIP self-extracting archive (PKZIP)
14684# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive
14685#
14686
14687# TELVOX Teleinformatica CODEC self-extractor for OS/2:
14688>49801	string	\x79\xff\x80\xff\x76\xff	\b, CODEC archive v3.21
14689>>49824 leshort		=1			\b, 1 file
14690>>49824 leshort		>1			\b, %u files
14691
14692# added by Joerg Jenderek of http://www.freedos.org/software/?prog=kc
14693# and http://www.freedos.org/software/?prog=kpdos
14694# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD
146950	string/b	KCF		FreeDOS KEYBoard Layout collection
14696# only version=0x100 found
14697>3	uleshort	x		\b, version 0x%x
14698# length of string containing author,info and special characters
14699>6	ubyte		>0
14700#>>6	pstring		x		\b, name=%s
14701>>7	string		>\0		\b, author=%-.14s
14702>>7	search/254	\xff		\b, info=
14703#>>>&0	string		x		\b%-s
14704>>>&0	string		x		\b%-.15s
14705# for FreeDOS *.KL files
147060	string/b	KLF		FreeDOS KEYBoard Layout file
14707# only version=0x100 or 0x101 found
14708>3	uleshort	x		\b, version 0x%x
14709# stringlength
14710>5	ubyte		>0
14711>>8	string		x		\b, name=%-.2s
147120	string	\xffKEYB\ \ \ \0\0\0\0
14713>12	string	\0\0\0\0`\004\360	MS-DOS KEYBoard Layout file
14714
14715# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
14716# Uncommenting only the first two lines will cover about 2/3 of COM files,
14717# but it isn't feasible to match all COM files since there must be at least
14718# two dozen different one-byte "magics".
14719# test too generic ?
147200	byte		0xe9		DOS executable (COM)
14721>0x1FE leshort		0xAA55		\b, boot code
14722>6	string		SFX\ of\ LHarc	(%s)
14723
14724# DOS device driver updated by Joerg Jenderek at May 2011
14725# http://maben.homeip.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
147260	ulequad&0x07a0ffffffff		0xffffffff		DOS executable (
14727>40	search/7			UPX!			\bUPX compressed
14728# DOS device driver attributes
14729>4	uleshort&0x8000			0x0000			\bblock device driver
14730# character device
14731>4	uleshort&0x8000			0x8000			\b
14732>>4	uleshort&0x0008			0x0008			\bclock
14733# fast video output by int 29h
14734>>4	uleshort&0x0010			0x0010			\bfast
14735# standard input/output device
14736>>4	uleshort&0x0003			>0			\bstandard
14737>>>4	uleshort&0x0001			0x0001			\binput
14738>>>4	uleshort&0x0003			0x0003			\b/
14739>>>4	uleshort&0x0002			0x0002			\boutput
14740>>4	uleshort&0x8000			0x8000			\bcharacter device driver
14741>0	ubyte				x
14742# upx compressed device driver has garbage instead of real in name field of header
14743>>40	search/7			UPX!
14744>>40	default				x
14745# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped
14746>>>12		ubyte			>0x27			\b
14747>>>>10		ubyte			>0x20
14748>>>>>10		ubyte			!0x2E
14749>>>>>>10	ubyte			!0x2A			\b%c
14750>>>>11		ubyte			>0x20
14751>>>>>11		ubyte			!0x2E			\b%c
14752>>>>12		ubyte			>0x20
14753>>>>>12		ubyte			!0x39
14754>>>>>>12	ubyte			!0x2E			\b%c
14755>>>13		ubyte			>0x20
14756>>>>13		ubyte			!0x2E			\b%c
14757>>>>14		ubyte			>0x20
14758>>>>>14		ubyte			!0x2E			\b%c
14759>>>>15		ubyte			>0x20
14760>>>>>15		ubyte			!0x2E			\b%c
14761>>>>16		ubyte			>0x20
14762>>>>>16		ubyte			!0x2E
14763>>>>>>16	ubyte			<0xCB			\b%c
14764>>>>17		ubyte			>0x20
14765>>>>>17		ubyte			!0x2E
14766>>>>>>17	ubyte			<0x90			\b%c
14767# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field
14768>>>4		uleshort&0x8000		0x8000
14769>>>>12		ubyte			<0x2F
14770# they have their real name at offset 22
14771>>>>>22		string			>\0			\b%-.5s
14772>4	uleshort&0x8000			0x0000
14773# 32 bit sector addressing ( > 32 MB) for block devices
14774>>4	uleshort&0x0002			0x0002			\b,32-bit sector-
14775# support by driver functions 13h, 17h, 18h
14776>4	uleshort&0x0040			0x0040			\b,IOCTL-
14777# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh
14778>4	uleshort&0x0800			0x0800			\b,close media-
14779# output until busy support by int 10h for character device driver
14780>4	uleshort&0x8000			0x8000
14781>>4	uleshort&0x2000			0x2000			\b,until busy-
14782# direct read/write support by driver functions 03h,0Ch
14783>4	uleshort&0x4000			0x4000			\b,control strings-
14784>4	uleshort&0x8000			0x8000
14785>>4	uleshort&0x6840			>0			\bsupport
14786>4	uleshort&0x8000			0x0000
14787>>4	uleshort&0x4842			>0			\bsupport
14788>0	ubyte				x			\b)
14789# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
14790# Too weak, matches files that only contain 0's
14791#0	ulequad&0x000007a0ffffffed	0x0000000000000000	DOS-executable (
14792#>4	uleshort&0x8000			0x8000			\bcharacter device driver
14793#>>10	string				x			%-.8s
14794#>4	uleshort&0x4000			0x4000			\b,control strings-support)
14795
14796# test too generic ?
147970	byte		0x8c		DOS executable (COM)
14798# updated by Joerg Jenderek at Oct 2008
147990	ulelong		0xffff10eb	DR-DOS executable (COM)
14800# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb
148010	ubeshort&0xeb8d	>0xeb00
14802# DR-DOS STACKER.COM SCREATE.SYS missed
14803>0	byte		0xeb
14804>>0x1FE leshort		0xAA55		DOS executable (COM), boot code
14805>>85	string		UPX		DOS executable (COM), UPX compressed
14806>>4	string		\ $ARX		DOS executable (COM), ARX self-extracting archive
14807>>4	string		\ $LHarc	DOS executable (COM), LHarc self-extracting archive
14808>>0x20e string		SFX\ by\ LARC	DOS executable (COM), LARC self-extracting archive
14809# updated by Joerg Jenderek at Oct 2008
14810#0	byte		0xb8		COM executable
148110	uleshort&0x80ff	0x00b8
14812# modified by Joerg Jenderek
14813>1	lelong		!0x21cd4cff	COM executable for DOS
14814# http://syslinux.zytor.com/comboot.php
14815# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
14816# start with assembler instructions mov eax,21cd4cffh
148170	uleshort&0xc0ff	0xc0b8
14818>1	lelong		0x21cd4cff	COM executable (32-bit COMBOOT)
14819# syslinux:doc/comboot.txt
14820# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov
14821# eax,21cd4cfeh) as a magic number.
148220       string/b	\xb8\xfe\x4c\xcd\x21	COM executable (COM32R)
14823# start with assembler instructions mov eax,21cd4cfeh
148240	uleshort&0xc0ff	0xc0b8
14825>1	lelong		0x21cd4cfe	COM executable (32-bit COMBOOT, relocatable)
148260	string/b	\x81\xfc
14827>4	string	\x77\x02\xcd\x20\xb9
14828>>36	string	UPX!			FREE-DOS executable (COM), UPX compressed
14829252	string Must\ have\ DOS\ version DR-DOS executable (COM)
14830# added by Joerg Jenderek at Oct 2008
14831# GRR search is not working
14832#34	search/2	UPX!		FREE-DOS executable (COM), UPX compressed
1483334	string	UPX!			FREE-DOS executable (COM), UPX compressed
1483435	string	UPX!			FREE-DOS executable (COM), UPX compressed
14835# GRR search is not working
14836#2	search/28	\xcd\x21	COM executable for MS-DOS
14837#WHICHFAT.cOM
148382	string	\xcd\x21		COM executable for DOS
14839#DELTREE.cOM DELTREE2.cOM
148404	string	\xcd\x21		COM executable for DOS
14841#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
148425	string	\xcd\x21		COM executable for DOS
14843#DELTMP.COm HASFAT32.cOM
148447	string	\xcd\x21
14845>0	byte	!0xb8			COM executable for DOS
14846#COMP.cOM MORE.COm
1484710	string	\xcd\x21
14848>5	string	!\xcd\x21		COM executable for DOS
14849#comecho.com
1485013	string	\xcd\x21		COM executable for DOS
14851#HELP.COm EDIT.coM
1485218	string	\xcd\x21		COM executable for MS-DOS
14853#NWRPLTRM.COm
1485423	string	\xcd\x21		COM executable for MS-DOS
14855#LOADFIX.cOm LOADFIX.cOm
1485630	string	\xcd\x21		COM executable for MS-DOS
14857#syslinux.com 3.11
1485870	string	\xcd\x21		COM executable for DOS
14859# many compressed/converted COMs start with a copy loop instead of a jump
148600x6	search/0xa	\xfc\x57\xf3\xa5\xc3	COM executable for MS-DOS
148610x6	search/0xa	\xfc\x57\xf3\xa4\xc3	COM executable for DOS
14862>0x18	search/0x10	\x50\xa4\xff\xd5\x73	\b, aPack compressed
148630x3c	string		W\ Collis\0\0		COM executable for MS-DOS, Compack compressed
14864# FIXME: missing diet .com compression
14865
14866# miscellaneous formats
148670	string/b	LZ		MS-DOS executable (built-in)
14868#0	byte		0xf0		MS-DOS program library data
14869#
14870
14871# AAF files:
14872# <stuartc@rd.bbc.co.uk> Stuart Cunningham
148730	string/b	\320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377			AAF legacy file using MS Structured Storage
14874>30	byte	9		(512B sectors)
14875>30	byte	12		(4kB sectors)
148760	string/b	\320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001			AAF file using MS Structured Storage
14877>30	byte	9		(512B sectors)
14878>30	byte	12		(4kB sectors)
14879
14880# Popular applications
148812080	string	Microsoft\ Word\ 6.0\ Document	%s
14882!:mime	application/msword
148832080	string	Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
14884!:mime	application/msword
14885# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
148862112	string	MSWordDoc			Microsoft Word document data
14887!:mime	application/msword
14888#
148890	belong	0x31be0000			Microsoft Word Document
14890!:mime	application/msword
14891#
148920	string/b	PO^Q`				Microsoft Word 6.0 Document
14893!:mime	application/msword
14894#
148950	string/b	\376\067\0\043			Microsoft Office Document
14896!:mime	application/msword
148970	string/b	\333\245-\0\0\0			Microsoft Office Document
14898!:mime	application/msword
14899512	string/b	\354\245\301			Microsoft Word Document
14900!:mime	application/msword
14901
14902#
149030	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
14904!:mime application/msword
14905#
149062080	string	Microsoft\ Excel\ 5.0\ Worksheet	%s
14907!:mime	application/vnd.ms-excel
14908#
149090	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
14910!:mime application/msword
14911
149122080	string	Foglio\ di\ lavoro\ Microsoft\ Exce	%s
14913!:mime	application/vnd.ms-excel
14914#
14915# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
149162114	string	Biff5		Microsoft Excel 5.0 Worksheet
14917!:mime	application/vnd.ms-excel
14918# Italian MS-Excel
149192121	string	Biff5		Microsoft Excel 5.0 Worksheet
14920!:mime	application/vnd.ms-excel
149210	string/b	\x09\x04\x06\x00\x00\x00\x10\x00	Microsoft Excel Worksheet
14922!:mime	application/vnd.ms-excel
14923#
149240	belong	0x00001a00	Lotus 1-2-3
14925!:mime	application/x-123
14926>4	belong	0x00100400	wk3 document data
14927>4	belong	0x02100400	wk4 document data
14928>4	belong	0x07800100	fm3 or fmb document data
14929>4	belong	0x07800000	fm3 or fmb document data
14930#
149310	belong	0x00000200	Lotus 1-2-3
14932!:mime	application/x-123
14933>4	belong	0x06040600	wk1 document data
14934>4	belong	0x06800200	fmt document data
149350	string/b		WordPro\0	Lotus WordPro
14936!:mime	application/vnd.lotus-wordpro
149370	string/b		WordPro\r\373	Lotus WordPro
14938!:mime	application/vnd.lotus-wordpro
14939
14940
14941# Summary: Script used by InstallScield to uninstall applications
14942# Extension: .isu
14943# Submitted by: unknown
14944# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry)
149450		string		\x71\xa8\x00\x00\x01\x02
14946>12		string		Stirling\ Technologies,		InstallShield Uninstall Script
14947
14948# Winamp .avs
14949#0	string	Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
149500	string/b	Nullsoft\ AVS\ Preset\ 	Winamp plug in
14951
14952# Windows Metafont .WMF
149530	string/b	\327\315\306\232	ms-windows metafont .wmf
149540	string/b	\002\000\011\000	ms-windows metafont .wmf
149550	string/b	\001\000\011\000	ms-windows metafont .wmf
14956
14957#tz3 files whatever that is (MS Works files)
149580	string/b	\003\001\001\004\070\001\000\000	tz3 ms-works file
149590	string/b	\003\002\001\004\070\001\000\000	tz3 ms-works file
149600	string/b	\003\003\001\004\070\001\000\000	tz3 ms-works file
14961
14962# PGP sig files .sig
14963#0 string \211\000\077\003\005\000\063\237\127 065 to  \027\266\151\064\005\045\101\233\021\002 PGP sig
149640 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
149650 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
149660 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
149670 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
149680 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
149690 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
14970
14971# windows zips files .dmf
149720	string/b	MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
14973
14974
14975#ico files
149760	string/b	\102\101\050\000\000\000\056\000\000\000\000\000\000\000	Icon for MS Windows
14977
14978# Windows icons
149790   name    ico-dir
14980# not entirely accurate, the number of icons is part of the header
14981>0  byte    1   - 1 icon
14982>0  ubyte   >1  - %d icons
14983>2  byte    0   \b, 256x
14984>2  byte    !0  \b, %dx
14985>3  byte    0   \b256
14986>3  byte    !0  \b%d
14987>4  ubyte   !0  \b, %d colors
14988
149890   belong  0x00000100
14990>9  byte    0
14991>>0 byte    x           MS Windows icon resource
14992!:mime	image/x-icon
14993>>4 use     ico-dir
14994>9  ubyte   0xff
14995>>0 byte    x           MS Windows icon resource
14996!:mime	image/x-icon
14997>>4 use     ico-dir
14998
14999# Windows non-animated cursors
150000   name    cur-dir
15001# not entirely accurate, the number of icons is part of the header
15002>0  byte        1   - 1 icon
15003>0  ubyte       >1  - %d icons
15004>2  byte        0   \b, 256x
15005>2  byte        !0  \b, %dx
15006>3  byte        0   \b256
15007>3  byte        !0  \b%d
15008>6  uleshort    x   \b, hotspot @%dx
15009>8  uleshort    x   \b%d
15010
150110   belong  0x00000200
15012>9  byte    0
15013>>0 byte    x           MS Windows cursor resource
15014!:mime image/x-cur
15015>>4 use     cur-dir
15016>9  ubyte   0xff
15017>>0 byte    x           MS Windows cursor resource
15018!:mime image/x-cur
15019>>4 use     cur-dir
15020
15021# .chr files
150220	string/b	PK\010\010BGI	Borland font
15023>4	string	>\0	%s
15024# then there is a copyright notice
15025
15026
15027# .bgi files
150280	string/b	pk\010\010BGI	Borland device
15029>4	string	>\0	%s
15030# then there is a copyright notice
15031
15032
15033# Windows Recycle Bin record file (named INFO2)
15034# By Abel Cheung (abelcheung AT gmail dot com)
15035# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes
15036# Since Vista uses another structure, INFO2 structure probably won't change
15037# anymore. Detailed analysis in:
15038# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf
150390	lelong		0x00000004
15040>12	lelong		0x00000118	Windows Recycle Bin INFO2 file (Win98 or below)
15041
150420	lelong		0x00000005
15043>12	lelong		0x00000320	Windows Recycle Bin INFO2 file (Win2k - WinXP)
15044
15045
15046##### put in Either Magic/font or Magic/news
15047# Acroread or something	 files wrongly identified as G3	 .pfm
15048# these have the form \000 \001 any? \002 \000 \000
15049# or \000 \001 any? \022 \000 \000
150500	belong&0xffff00ff	0x00010012	PFM data
15051>4	string			\000\000
15052>6	string			>\060		- %s
15053
150540	belong&0xffff00ff	0x00010002	PFM data
15055>4	string			\000\000
15056>6	string			>\060		- %s
15057#0	string	\000\001 pfm?
15058#>3	string	\022\000\000Copyright\	yes
15059#>3	string	\002\000\000Copyright\	yes
15060#>3	string	>\0	oops, not a font file. Cancel that.
15061#it clashes with ttf files so put it lower down.
15062
15063# From Doug Lee via a FreeBSD pr
150649	string		GERBILDOC	First Choice document
150659	string		GERBILDB	First Choice database
150669	string		GERBILCLIP	First Choice database
150670	string		GERBIL		First Choice device file
150689	string		RABBITGRAPH	RabbitGraph file
150690	string		DCU1		Borland Delphi .DCU file
150700	string		=!<spell>	MKS Spell hash list (old format)
150710	string		=!<spell2>	MKS Spell hash list
15072# Too simple - MPi
15073#0	string		AH		Halo(TM) bitmapped font file
150740	lelong		0x08086b70	TurboC BGI file
150750	lelong		0x08084b50	TurboC Font file
15076
15077# Debian#712046: The magic below identifies "Delphi compiled form data".
15078# An additional source of information is available at:
15079# http://www.woodmann.com/fravia/dafix_t1.htm
150800	string		TPF0
15081>4	pstring		>\0		Delphi compiled form '%s'
15082
15083# tests for DBase files moved, updated and merged to database
15084
150850	string		PMCC		Windows 3.x .GRP file
150861	string		RDC-meg		MegaDots
15087>8	byte		>0x2F		version %c
15088>9	byte		>0x2F		\b.%c file
150890	lelong		0x4C
15090>4	lelong		0x00021401	Windows shortcut file
15091
15092# .PIF files added by Joerg Jenderek from http://smsoft.ru/en/pifdoc.htm
15093# only for windows versions equal or greater 3.0
150940x171	string	MICROSOFT\ PIFEX\0	Windows Program Information File
15095!:mime	application/x-dosexec
15096#>2	string	 	>\0		\b, Title:%.30s
15097>0x24	string		>\0		\b for %.63s
15098>0x65	string		>\0		\b, directory=%.64s
15099>0xA5	string		>\0		\b, parameters=%.64s
15100#>0x181	leshort	x	\b, offset %x
15101#>0x183	leshort	x	\b, offsetdata %x
15102#>0x185	leshort	x	\b, section length %x
15103>0x187	search/0xB55	WINDOWS\ VMM\ 4.0\0
15104>>&0x5e		ubyte	>0
15105>>>&-1		string	<PIFMGR.DLL		\b, icon=%s
15106#>>>&-1		string	PIFMGR.DLL		\b, icon=%s
15107>>>&-1		string	>PIFMGR.DLL		\b, icon=%s
15108>>&0xF0		ubyte	>0
15109>>>&-1		string	<Terminal		\b, font=%.32s
15110#>>>&-1		string	=Terminal		\b, font=%.32s
15111>>>&-1		string	>Terminal		\b, font=%.32s
15112>>&0x110	ubyte	>0
15113>>>&-1		string	<Lucida\ Console	\b, TrueTypeFont=%.32s
15114#>>>&-1		string	=Lucida\ Console	\b, TrueTypeFont=%.32s
15115>>>&-1		string	>Lucida\ Console	\b, TrueTypeFont=%.32s
15116#>0x187	search/0xB55	WINDOWS\ 286\ 3.0\0	\b, Windows 3.X standard mode-style
15117#>0x187	search/0xB55	WINDOWS\ 386\ 3.0\0	\b, Windows 3.X enhanced mode-style
15118>0x187	search/0xB55	WINDOWS\ NT\ \ 3.1\0	\b, Windows NT-style
15119#>0x187	search/0xB55	WINDOWS\ NT\ \ 4.0\0	\b, Windows NT-style
15120>0x187	search/0xB55	CONFIG\ \ SYS\ 4.0\0	\b +CONFIG.SYS
15121#>>&06		string	x			\b:%s
15122>0x187	search/0xB55	AUTOEXECBAT\ 4.0\0	\b +AUTOEXEC.BAT
15123#>>&06		string	x			\b:%s
15124
15125# DOS EPS Binary File Header
15126# From: Ed Sznyter <ews@Black.Market.NET>
151270	belong		0xC5D0D3C6	DOS EPS Binary File
15128>4	long		>0		Postscript starts at byte %d
15129>>8	long		>0		length %d
15130>>>12	long		>0		Metafile starts at byte %d
15131>>>>16	long		>0		length %d
15132>>>20	long		>0		TIFF starts at byte %d
15133>>>>24	long		>0		length %d
15134
15135# TNEF magic From "Joomy" <joomy@se-ed.net>
15136# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
151370	leshort		0x223e9f78	TNEF
15138!:mime	application/vnd.ms-tnef
15139
15140# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C
15141# of http://www.davep.org/norton-guides/ng2h-105.tgz
15142# http://en.wikipedia.org/wiki/Norton_Guides
151430	string		NG\0\001
15144# only value 0x100 found at offset 2
15145>2	ulelong		0x00000100	Norton Guide
15146# Title[40]
15147>>8	string		>\0		"%-.40s"
15148#>>6	uleshort	x		\b, MenuCount=%u
15149# szCredits[5][66]
15150>>48	string		>\0		\b, %-.66s
15151>>114	string		>\0		%-.66s
15152
15153# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
15154# of http://www.4dos.info/
15155# pointer,HelpID[8]=4DHnnnmm
151560	ulelong	0x48443408		4DOS help file
15157>4	string	x			\b, version %-4.4s
15158
15159# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp
151600	ulequad	0x3a000000024e4c	MS Advisor help file
15161
15162# HtmlHelp files (.chm)
151630	string/b	ITSF\003\000\000\000\x60\000\000\000\001\000\000\000	MS Windows HtmlHelp Data
15164
15165# GFA-BASIC (Wolfram Kleff)
151662	string/b	GFA-BASIC3	GFA-BASIC 3 data
15167
15168#------------------------------------------------------------------------------
15169# From Stuart Caie <kyzer@4u.net> (developer of cabextract)
15170# Microsoft Cabinet files
151710	string/b	MSCF\0\0\0\0	Microsoft Cabinet archive data
15172!:mime application/vnd.ms-cab-compressed
15173>8	lelong		x		\b, %u bytes
15174>28	leshort		1		\b, 1 file
15175>28	leshort		>1		\b, %u files
15176
15177# InstallShield Cabinet files
151780	string/b	ISc(		InstallShield Cabinet archive data
15179>5	byte&0xf0	=0x60		version 6,
15180>5	byte&0xf0	!0x60		version 4/5,
15181>(12.l+40)	lelong	x		%u files
15182
15183# Windows CE package files
151840	string/b	MSCE\0\0\0\0	Microsoft WinCE install header
15185>20	lelong		0		\b, architecture-independent
15186>20	lelong		103		\b, Hitachi SH3
15187>20	lelong		104		\b, Hitachi SH4
15188>20	lelong		0xA11		\b, StrongARM
15189>20	lelong		4000		\b, MIPS R4000
15190>20	lelong		10003		\b, Hitachi SH3
15191>20	lelong		10004		\b, Hitachi SH3E
15192>20	lelong		10005		\b, Hitachi SH4
15193>20	lelong		70001		\b, ARM 7TDMI
15194>52	leshort		1		\b, 1 file
15195>52	leshort		>1		\b, %u files
15196>56	leshort		1		\b, 1 registry entry
15197>56	leshort		>1		\b, %u registry entries
15198
15199
15200# Windows Enhanced Metafile (EMF)
15201# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
15202# for further information.
152030	ulelong 1
15204>40	string	\ EMF		Windows Enhanced Metafile (EMF) image data
15205>>44	ulelong x		version 0x%x
15206
15207# from http://filext.com by Derek M Jones <derek@knosof.co.uk>
15208# False positive with PPT (also currently this string is too long)
15209#0	string/b	\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06	Microsoft Installer
152100	string/b	\320\317\021\340\241\261\032\341	Microsoft Office Document
15211#>48	byte	0x1B					Excel Document
15212#!:mime application/vnd.ms-excel
15213>546	string	bjbj			Microsoft Word Document
15214!:mime	application/msword
15215>546	string	jbjb			Microsoft Word Document
15216!:mime	application/msword
15217
152180	string/b	\224\246\056		Microsoft Word Document
15219!:mime	application/msword
15220
15221512	string	R\0o\0o\0t\0\ \0E\0n\0t\0r\0y	Microsoft Word Document
15222!:mime	application/msword
15223
15224# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
15225# Magic type for Dell's BIOS .hdr files
15226# Dell's .hdr
152270	string/b $RBU
15228>23	string Dell			%s system BIOS
15229>5	byte   2
15230>>48	byte   x			version %d.
15231>>49	byte   x			\b%d.
15232>>50	byte   x			\b%d
15233>5	byte   <2
15234>>48	string x			version %.3s
15235
15236# Type: Microsoft DirectDraw Surface
15237# URL:	http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
15238# From: Morten Hustveit <morten@debian.org>
152390	string/b	DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS),
15240>16	lelong	>0			%d x
15241>12	lelong	>0			%d,
15242>84	string	x			%.4s
15243
15244# Type: Microsoft Document Imaging Format (.mdi)
15245# URL:	http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
15246# From: Daniele Sempione <scrows@oziosi.org>
152470	short	0x5045			Microsoft Document Imaging Format
15248
15249# MS eBook format (.lit)
152500	string/b	ITOLITLS		Microsoft Reader eBook Data
15251>8	lelong	x			\b, version %u
15252!:mime					application/x-ms-reader
15253
15254# Windows CE Binary Image Data Format
15255# From: Dr. Jesus <j@hug.gs>
152560	string/b	B000FF\n	Windows Embedded CE binary image
15257
15258# Windows Imaging (WIM) Image
152590	string/b	MSWIM\000\000\000	Windows imaging (WIM) image
15260
15261# The second byte of these signatures is a file version; I don't know what,
15262# if anything, produced files with version numbers 0-2.
15263# From: John Elliott <johne@seasip.demon.co.uk>
152640	string	\xfc\x03\x00	Mallard BASIC program data (v1.11)
152650	string	\xfc\x04\x00	Mallard BASIC program data (v1.29+)
152660	string	\xfc\x03\x01	Mallard BASIC protected program data (v1.11)
152670	string	\xfc\x04\x01	Mallard BASIC protected program data (v1.29+)
15268
152690	string	MIOPEN		Mallard BASIC Jetsam data
152700	string	Jetsam0		Mallard BASIC Jetsam index data
15271
15272
15273#------------------------------------------------------------------------------
15274# $File: msooxml,v 1.4 2014/01/06 18:16:24 rrt Exp $
15275# msooxml:  file(1) magic for Microsoft Office XML
15276# From: Ralf Brown <ralf.brown@gmail.com>
15277
15278# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP
15279#   archive.  The first member file is normally "[Content_Types].xml".
15280#   but some libreoffice generated files put this later. Perhaps skip
15281#   the "[Content_Types].xml" test?
15282# Since MSOOXML doesn't have anything like the uncompressed "mimetype"
15283#   file of ePub or OpenDocument, we'll have to scan for a filename
15284#   which can distinguish between the three types
15285
15286# start by checking for ZIP local file header signature
152870		string		PK\003\004
15288!:strength +10
15289# make sure the first file is correct
15290>0x1E		regex		\\[Content_Types\\]\\.xml|_rels/\\.rels
15291# skip to the second local file header
15292# since some documents include a 520-byte extra field following the file
15293# header, we need to scan for the next header
15294>>(18.l+49)	search/2000	PK\003\004
15295# now skip to the *third* local file header; again, we need to scan due to a
15296# 520-byte extra field following the file header
15297>>>&26		search/1000	PK\003\004
15298# and check the subdirectory name to determine which type of OOXML
15299# file we have.  Correct the mimetype with the registered ones:
15300# http://technet.microsoft.com/en-us/library/cc179224.aspx
15301>>>>&26		string		word/		Microsoft Word 2007+
15302!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document
15303>>>>&26		string		ppt/		Microsoft PowerPoint 2007+
15304!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation
15305>>>>&26		string		xl/		Microsoft Excel 2007+
15306!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
15307>>>>&26		default		x		Microsoft OOXML
15308
15309#------------------------------------------------------------------------------
15310# $File$
15311# msvc:  file(1) magic for msvc
15312# "H. Nanosecond" <aldomel@ix.netcom.com>
15313# Microsoft visual C
15314#
15315# I have version 1.0
15316
15317# .aps
153180	string	HWB\000\377\001\000\000\000	Microsoft Visual C .APS file
15319
15320# .ide
15321#too long 0	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316	MSVC .ide
153220	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157	MSVC .ide
15323
15324# .res
153250	string	\000\000\000\000\040\000\000\000\377	MSVC .res
153260	string	\377\003\000\377\001\000\020\020\350	MSVC .res
153270	string	\377\003\000\377\001\000\060\020\350	MSVC .res
15328
15329#.lib
153300	string	\360\015\000\000	Microsoft Visual C library
153310	string	\360\075\000\000	Microsoft Visual C library
153320	string	\360\175\000\000	Microsoft Visual C library
15333
15334#.pch
153350	string	DTJPCH0\000\022\103\006\200	Microsoft Visual C .pch
15336
15337# .pdb
15338# too long 0	string	Microsoft\ C/C++\ program\ database\
153390	string	Microsoft\ C/C++\ 	MSVC program database
15340>18	string	program\ database\
15341>33	string	>\0	ver %s
15342
15343#.sbr
153440	string	\000\002\000\007\000	MSVC .sbr
15345>5	string 	>\0	%s
15346
15347#.bsc
153480	string	\002\000\002\001	MSVC .bsc
15349
15350#.wsp
153510	string	1.00\ .0000.0000\000\003	MSVC .wsp version 1.0000.0000
15352# these seem to start with the version and contain menus
15353
15354#------------------------------------------------------------------------------
15355# msx:  file(1) magic for the MSX Home Computer
15356# v1.1
15357# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
15358
15359############## MSX Music file formats ##############
15360
15361# Gigamix MGSDRV music file
153620	string		MGS	MSX Gigamix MGSDRV3 music file,
15363>6	ubeshort	0x0D0A
15364>>3	byte		x	\bv%c
15365>>4	byte		x	\b.%c
15366>>5	byte		x	\b%c
15367>>8	string		>\0	\b, title: %s
15368
153691	string		mgs2\ 	MSX Gigamix MGSDRV2 music file
15370>6	uleshort	0x80
15371>>0x2E	uleshort	0
15372>>>0x30	string		>\0	\b, title: %s
15373
15374# KSS music file
153750	string		KSCC	KSS music file v1.03
15376>0xE	byte		0
15377>>0xF	byte&0x02	0	\b, soundchips: AY-3-8910, SCC(+)
15378>>0xF	byte&0x02	2	\b, soundchip(s): SN76489
15379>>>0xF	byte&0x04	4	stereo
15380>>0xF	byte&0x01	1	\b, YM2413
15381>>0xF	byte&0x08	8	\b, Y8950
15382
153830	string		KSSX	KSS music file v1.20
15384>0xE	byte&0xEF	0
15385>>0xF	byte&0x40	0x00	\b, 60Hz
15386>>0xF	byte&0x40	0x40	\b, 50Hz
15387>>0xF	byte&0x02	0	\b, soundchips: AY-3-8910, SCC(+)
15388>>0xF	byte&0x02	0x02	\b, soundchips: SN76489
15389>>>0xF	byte&0x04	0x04	stereo
15390>>0xF	byte&0x01	0x01	\b,
15391>>>0xF	byte&0x18	0x00	\bYM2413
15392>>>0xF	byte&0x18	0x08	\bYM2413, Y8950
15393>>>0xF	byte&0x18	0x18	\bYM2413+Y8950 pseudostereo
15394>>0xF	byte&0x18	0x10	\b, Majyutsushi DAC
15395
15396# Moonblaster for Moonsound
153970	string		MBMS
15398>4	byte		0x10	MSX Moonblaster for MoonSound music
15399
15400# Music Player K-kaz
154010	string		MPK	MSX Music Player K-kaz song
15402>6	ubeshort	0x0D0A
15403>>3	byte		x	v%c
15404>>4	byte		x	\b.%c
15405>>5	byte		x	\b%c
15406
15407# I don't know why these don't work
15408#0	search/0xFFFF	\r\n.FM9
15409#>0	search/0xFFFF	\r\n#FORMAT	MSX Music Player K-kaz source MML file
15410#0	search/0xFFFF	\r\nFM1\ \=
15411#>0	search/0xFFFF	\r\nPSG1\=
15412#>>0	search/0xFFFF	\r\nSCC1\=		MSX MuSiCa MML source file
15413
15414# OPX Music file
154150x35	beshort		0x0d0a
15416>0x7B	beshort		0x0d0a
15417>>0x7D	byte		0x1a
15418>>>0x87	uleshort	0		MSX OPX Music file
15419>>>>0x86	byte		0		v1.5
15420>>>>>0	string		>\32		\b, title: %s
15421>>>>0x86	byte		1		v2.4
15422>>>>>0	string		>\32		\b, title: %s
15423
15424# SCMD music file
154250x8B	string		SCMD
15426>0xCE	uleshort	0	MSX SCMD Music file
15427#>>-2	uleshort	0x6a71	; The file must end with this value. How to code this here?
15428>>0x8F	string		>\0		\b, title: %s
15429
154300	search/0xFFFF	\r\n@title
15431>&0	search/0xFFFF	\r\n@m=[	MSX SCMD source MML file
15432
15433
15434############## MSX image file formats ##############
15435
15436# MSX raw VRAM dump
154370	ubyte		0xFE
15438>1	uleshort	0
15439>>5	uleshort	0
15440>>>3	uleshort	0x37FF		MSX SC2/GRP raw image
15441>>>3	uleshort	0x6A00		MSX Graph Saurus SR5 raw image
15442>>>3	uleshort	>0x769E
15443>>>>3	uleshort	<0x8000		MSX GE5/GE6 raw image
15444>>>>>3	uleshort	0x7FFF		\b, with sprite patterns
15445>>>3	uleshort	0xD3FF		MSX screen 7-12 raw image
15446>>>3	uleshort	0xD400		MSX Graph Saurus SR7/SR8/SRS raw image
15447
15448# Graph Saurus compressed images
154490	ubyte		0xFD
15450>1	uleshort	0
15451>>5	uleshort	0
15452>>>3	uleshort	>0x013D		MSX Graph Saurus compressed image
15453
15454# Maki-chan Graphic format
154550	string		MAKI02\ \ 	Maki-chan image,
15456>8	byte		x		system ID: %c
15457>9	byte		x		\b%c
15458>10	byte		x		\b%c
15459>11	byte		x		\b%c,
15460>13	search/0x200	\x1A
15461# >>&3	ubyte		0		, video mode: PC-98 400 lines, 16 analog colors
15462# >>&3	ubyte		1		, video mode: MSX SC7, 16 analog colors
15463# >>&3	ubyte		2		, video mode: VM-98 400 lines, 8 analog colors
15464# >>&3	ubyte		3		, video mode: PC-88 analog, 200 lines, 8 analog colors
15465# >>&3	ubyte		4		, video mode: 400 lines, 16 digital colors
15466# >>&3	ubyte		5		, video mode: 200 lines, 16 digital colors
15467# >>&3	ubyte		6		, video mode: old PC-98 digital 400 lines, 8 colors
15468# >>&3	ubyte		7		, video mode: PC-88 400 lines, 8 digital colors
15469>>&8	uleshort+1	x		%dx
15470>>&10	uleshort+1	x		\b%d,
15471>>&3	ubyte&0x82	0x80		256 colors
15472>>&3	ubyte&0x82	0x00		16 colors
15473>>&3	ubyte&0x82	0x01		8 colors
15474>>&3	ubyte&0x04	4		digital
15475>>&3	ubyte&0x04	0		analog
15476>>&3	ubyte&0x01	1		\b, 2:1 dot aspect ratio
15477
15478# Japanese PIC file
154790	string		PIC\x1A
15480>4	lelong		0		Japanese PIC image file
15481
15482# MSX G9B image file
154830	string		G9B
15484>1	uleshort	11
15485>>3	uleshort	>10
15486>>>5	ubyte		>0		MSX G9B image, depth=%d
15487>>>>8	uleshort	x		\b, %dx
15488>>>>10	uleshort	x		\b%d
15489>>>>5	ubyte		<9
15490>>>>>6	ubyte		0
15491>>>>>>7	ubyte		x		\b, codec=%d RGB color palettes
15492>>>>>6	ubyte		64		\b, codec=RGB fixed color
15493>>>>>6	ubyte		128		\b, codec=YJK
15494>>>>>6	ubyte		192		\b, codec=YUV
15495>>>>5	ubyte		>8		codec=RGB fixed color
15496>>>>12	ubyte		0		\b, raw
15497>>>>12	ubyte		1		\b, bitbuster compression
15498
15499############## Other MSX file formats ##############
15500
15501# MSX ROMs
155020	string		AB
15503>2	uleshort	0x0010			MSX ROM
15504>>2	uleshort	x			\b, init=0x%4x
15505>>4	uleshort	>0			\b, stat=0x%4x
15506>>6	uleshort	>0			\b, dev=0x%4x
15507>>8	uleshort	>0			\b, bas=0x%4x
15508>2	uleshort	0x4010			MSX ROM
15509>>2	uleshort	x			\b, init=0x%04x
15510>>4	uleshort	>0			\b, stat=0x%04x
15511>>6	uleshort	>0			\b, dev=0x%04x
15512>>8	uleshort	>0			\b, bas=0x%04x
15513>2	uleshort	0x8010			MSX ROM
15514>>2	uleshort	x			\b, init=0x%04x
15515>>4	uleshort	>0			\b, stat=0x%04x
15516>>6	uleshort	>0			\b, dev=0x%04x
15517>>8	uleshort	>0			\b, bas=0x%04x
15518
155190	string		AB
15520#>2	string		5JSuperLAYDOCK		MSX Super Laydock ROM
15521#>3	string		@HYDLIDE3MSX		MSX Hydlide-3 ROM
15522#>3	string		@3\x80IA862		Golvellius MSX1 ROM
15523>2	uleshort	>10
15524>>10	string		\0\0\0\0\0\0		MSX ROM
15525>>>0x10	string		YZ\0\0\0\0		Konami Game Master 2 MSX ROM
15526>>>0x10	string		CD			\b, Konami RC-
15527>>>>0x12	ubyte		x			\b%d
15528>>>>0x13	ubyte/16	x			\b%d
15529>>>>0x13	ubyte&0xF	x			\b%d
15530>>>0x10	string		EF			\b, Konami RC-
15531>>>>0x12	ubyte		x			\b%d
15532>>>>0x13	ubyte/16	x			\b%d
15533>>>>0x13	ubyte&0xF	x			\b%d
15534>>>2	uleshort	x			\b, init=0x%04x
15535>>>4	uleshort	>0			\b, stat=0x%04x
15536>>>6	uleshort	>0			\b, dev=0x%04x
15537>>>8	uleshort	>0			\b, bas=0x%04x
15538>2	uleshort	0
15539>>4	uleshort	0
15540>>>6	uleshort	0
15541>>>>8	uleshort	>0			MSX BASIC program in ROM, bas=0x%04x
15542
155430x4000	string		AB
15544>0x4002	uleshort	>0x4010
15545>>0x400A	string		\0\0\0\0\0\0	MSX MegaROM with nonstandard page order
15546>>0x4002	uleshort	x			\b, init=0x%04x
15547>>0x4004	uleshort	>0			\b, stat=0x%04x
15548>>0x4006	uleshort	>0			\b, dev=0x%04x
15549>>0x4008	uleshort	>0			\b, bas=0x%04x
15550
155510x8000	string		AB
15552>0x8002	uleshort	>0x4010
15553>>0x800A	string		\0\0\0\0\0\0	MSX MegaROM with nonstandard page order
15554>>0x8002	uleshort	x			\b, init=0x%04x
15555>>0x8004	uleshort	>0			\b, stat=0x%04x
15556>>0x8006	uleshort	>0			\b, dev=0x%04x
15557>>0x8008	uleshort	>0			\b, bas=0x%04x
15558
15559
155600x3C000	string		AB
15561>0x3C008	string		\0\0\0\0\0\0\0\0	MSX MegaROM with nonstandard page order
15562>>0x3C002	uleshort	x			\b, init=0x%04x
15563>>0x3C004	uleshort	>0			\b, stat=0x%04x
15564>>0x3C006	uleshort	>0			\b, dev=0x%04x
15565>>0x3C008	uleshort	>0			\b, bas=0x%04x
15566
15567# MSX BIN file
15568#0	byte		0xFE
15569#>1	uleshort	>0x8000
15570#>>3	uleshort	>0x8004
15571#>>>5	uleshort	>0x8000			MSX BIN file
15572
15573# MSX-BASIC file
155740	byte		0xFF
15575>3	uleshort	0x000A
15576>>1	uleshort	>0x8000			MSX-BASIC program
15577
15578# MSX .CAS file
155790	string	\x1F\xA6\xDE\xBA\xCC\x13\x7D\x74	MSX cassette archive
15580
15581# Mega-Assembler file
155820	byte		0xFE
15583>1	uleshort	0x0001
15584>>5	uleshort	0xffff
15585>>>6	byte		0x0A		MSX Mega-Assembler source
15586
15587# Execrom Patchfile
155880	string		ExecROM\ patchfile\x1A	MSX ExecROM patchfile
15589>0x12	ubyte/16	x		v%d
15590>0x12	ubyte&0xF	x		\b.%d
15591>0x13	ubyte		x		\b, contains %d patches
15592
15593# Konami's King's Valley-2 custom stage (ELG file)
155944	uleshort	0x0900
15595>0xF	byte		1
15596>>0x14	byte		0
15597>>>0x1E	string		\ \ \
15598>>>>0x23	byte	1
15599>>>>>0x25	byte	0
15600>>>>>>0x15	string	>\x30
15601>>>>>>>0x15	string	<\x5A		Konami King's Valley-2 custom stage, title: "%-8.8s"
15602>>>>>>>>0x1D	byte	<32	\b, theme: %d
15603
15604# Metal Gear 1 savegame
15605#0x4F	string	\x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF
15606#>>0x60	string	\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF
15607#>>>0x7B	string	\0x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00	Metal Gear 1 savegame
15608
15609# ------------------------------------------------------------------------
15610# $File$
15611# mup: file(1) magic for Mup (Music Publisher) input file.
15612#
15613# From: Abel Cheung <abel (@) oaka.org>
15614#
15615# NOTE: This header is mainly proposed in the Arkkra mailing list,
15616# and is not a mandatory header because of old mup input file
15617# compatibility. Noteedit also use mup format, but is not forcing
15618# user to use any header as well.
15619#
156200		search/1	//!Mup		Mup music publication program input text
15621>6		string		-Arkkra		(Arkkra)
15622>>13		string		-
15623>>>16		string		.
15624>>>>14		string		x		\b, need V%.4s
15625>>>15		string		.
15626>>>>14		string		x		\b, need V%.3s
15627>6		string		-
15628>>9		string		.
15629>>>7		string		x		\b, need V%.4s
15630>>8		string		.
15631>>>7		string		x		\b, need V%.3s
15632#------------------------------------------------------------------------------
15633# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $
15634# music:  file (1) magic for music formats
15635
15636# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks
15637# and Bagpipe Writer by Doug Wickstrom
15638#
156390	string		Bagpipe		Bagpipe
15640>8	string		Reader		Reader
15641>>15	string		>\0		(version %.3s)
15642>8	string		Music\ Writer	Music Writer
15643>>20	string		:
15644>>>21	string		>\0		(version %.3s)
15645>>21	string		Gold		Gold
15646>>>25	string		:
15647>>>>26	string		>\0		(version %.3s)
15648
15649
15650#-----------------------------------------------------------------------------
15651# $File: natinst,v 1.5 2013/02/06 14:18:52 christos Exp $
15652# natinst:  file(1) magic for National Instruments Code Files
15653
15654#
15655# From <egamez@fcfm.buap.mx> Enrique Gamez-Flores
15656# version 1
15657# Many formats still missing, we use, for the moment LabVIEW
15658# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing
15659#
156600       string          RSRC            National Instruments,
15661# Check if it's a LabVIEW File
15662>8      string          LV              LabVIEW File,
15663# Check which kind of file it is
15664>>10    string          SB              Code Resource File, data
15665>>10    string          IN              Virtual Instrument Program, data
15666>>10    string          AR              VI Library, data
15667# This is for Menu Libraries
15668>8      string          LMNULBVW        Portable File Names, data
15669# This is for General Resources
15670>8      string          rsc             Resources File, data
15671# This is for VXI Package
156720       string          VMAP            National Instruments, VXI File, data
15673
15674#------------------------------------------------------------------------------
15675# $File: ncr,v 1.7 2009/09/19 16:28:11 christos Exp $
15676# ncr:  file(1) magic for NCR Tower objects
15677#
15678# contributed by
15679# Michael R. Wayne  ***  TMC & Associates  ***  INTERNET: wayne@ford-vax.arpa
15680# uucp: {philabs | pyramid} !fmsrl7!wayne   OR   wayne@fmsrl7.UUCP
15681#
156820	beshort		000610	Tower/XP rel 2 object
15683>12	   belong		>0	not stripped
15684>20	   beshort		0407	executable
15685>20	   beshort		0410	pure executable
15686>22	   beshort		>0	- version %d
156870	beshort		000615	Tower/XP rel 2 object
15688>12	   belong		>0	not stripped
15689>20	   beshort		0407	executable
15690>20	   beshort		0410	pure executable
15691>22	   beshort		>0	- version %d
156920	beshort		000620	Tower/XP rel 3 object
15693>12	   belong		>0	not stripped
15694>20	   beshort		0407	executable
15695>20	   beshort		0410	pure executable
15696>22	   beshort		>0	- version %d
156970	beshort		000625	Tower/XP rel 3 object
15698>12	   belong		>0	not stripped
15699>20	   beshort		0407	executable
15700>20	   beshort		0410	pure executable
15701>22	   beshort		>0	- version %d
157020	beshort		000630	Tower32/600/400 68020 object
15703>12	   belong		>0	not stripped
15704>20	   beshort		0407	executable
15705>20	   beshort		0410	pure executable
15706>22	   beshort		>0	- version %d
157070	beshort		000640	Tower32/800 68020
15708>18	   beshort		&020000	w/68881 object
15709>18	   beshort		&040000	compatible object
15710>18	   beshort		&060000	object
15711>20	   beshort		0407	executable
15712>20	   beshort		0413	pure executable
15713>12	   belong		>0	not stripped
15714>22	   beshort		>0	- version %d
157150	beshort		000645	Tower32/800 68010
15716>18	   beshort		&040000	compatible object
15717>18	   beshort		&060000 object
15718>20	   beshort		0407	executable
15719>20	   beshort		0413	pure executable
15720>12	   belong		>0	not stripped
15721>22	   beshort		>0	- version %d
15722
15723#------------------------------------------------------------
15724# $File: java,v 1.12 2009/09/19 16:28:10 christos Exp $
15725
15726# From: Mikhail Gusarov <dottedmag@dottedmag.net>
15727# NekoVM (http://nekovm.org/) bytecode
157280	string		NEKO	NekoVM bytecode
15729>4	lelong		x	(%d global symbols,
15730>8	lelong		x	%d global fields,
15731>12	lelong		x	%d bytecode ops)
15732!:mime	application/x-nekovm-bytecode
15733
15734
15735#------------------------------------------------------------------------------
15736# $File: netbsd,v 1.21 2014/03/29 15:40:34 christos Exp $
15737# netbsd:  file(1) magic for NetBSD objects
15738#
15739# All new-style magic numbers are in network byte order.
15740# The old-style magic numbers are indistinguishable from the same magic
15741# numbers used in other systems, and are handled, for all those systems,
15742# in aout.
15743#
15744
157450	belong&0377777777	041400413	a.out NetBSD/i386 demand paged
15746>0	byte			&0x80
15747>>20	lelong			<4096		shared library
15748>>20	lelong			=4096		dynamically linked executable
15749>>20	lelong			>4096		dynamically linked executable
15750>0	byte			^0x80		executable
15751>16	lelong			>0		not stripped
157520	belong&0377777777	041400410	a.out NetBSD/i386 pure
15753>0	byte			&0x80		dynamically linked executable
15754>0	byte			^0x80		executable
15755>16	lelong			>0		not stripped
157560	belong&0377777777	041400407	a.out NetBSD/i386
15757>0	byte			&0x80		dynamically linked executable
15758>0	byte			^0x80
15759>>0	byte			&0x40		position independent
15760>>20	lelong			!0		executable
15761>>20	lelong			=0		object file
15762>16	lelong			>0		not stripped
157630	belong&0377777777	041400507	a.out NetBSD/i386 core
15764>12	string			>\0		from '%s'
15765>32	lelong			!0		(signal %d)
15766
157670	belong&0377777777	041600413	a.out NetBSD/m68k demand paged
15768>0	byte			&0x80
15769>>20	belong			<8192		shared library
15770>>20	belong			=8192		dynamically linked executable
15771>>20	belong			>8192		dynamically linked executable
15772>0	byte			^0x80		executable
15773>16	belong			>0		not stripped
157740	belong&0377777777	041600410	a.out NetBSD/m68k pure
15775>0	byte			&0x80		dynamically linked executable
15776>0	byte			^0x80		executable
15777>16	belong			>0		not stripped
157780	belong&0377777777	041600407	a.out NetBSD/m68k
15779>0	byte			&0x80		dynamically linked executable
15780>0	byte			^0x80
15781>>0	byte			&0x40		position independent
15782>>20	belong			!0		executable
15783>>20	belong			=0		object file
15784>16	belong			>0		not stripped
157850	belong&0377777777	041600507	a.out NetBSD/m68k core
15786>12	string			>\0		from '%s'
15787>32	belong			!0		(signal %d)
15788
157890	belong&0377777777	042000413	a.out NetBSD/m68k4k demand paged
15790>0	byte			&0x80
15791>>20	belong			<4096		shared library
15792>>20	belong			=4096		dynamically linked executable
15793>>20	belong			>4096		dynamically linked executable
15794>0	byte			^0x80		executable
15795>16	belong			>0		not stripped
157960	belong&0377777777	042000410	a.out NetBSD/m68k4k pure
15797>0	byte			&0x80		dynamically linked executable
15798>0	byte			^0x80		executable
15799>16	belong			>0		not stripped
158000	belong&0377777777	042000407	a.out NetBSD/m68k4k
15801>0	byte			&0x80		dynamically linked executable
15802>0	byte			^0x80
15803>>0	byte			&0x40		position independent
15804>>20	belong			!0		executable
15805>>20	belong			=0		object file
15806>16	belong			>0		not stripped
158070	belong&0377777777	042000507	a.out NetBSD/m68k4k core
15808>12	string			>\0		from '%s'
15809>32	belong			!0		(signal %d)
15810
158110	belong&0377777777	042200413	a.out NetBSD/ns32532 demand paged
15812>0	byte			&0x80
15813>>20	lelong			<4096		shared library
15814>>20	lelong			=4096		dynamically linked executable
15815>>20	lelong			>4096		dynamically linked executable
15816>0	byte			^0x80		executable
15817>16	lelong			>0		not stripped
158180	belong&0377777777	042200410	a.out NetBSD/ns32532 pure
15819>0	byte			&0x80		dynamically linked executable
15820>0	byte			^0x80		executable
15821>16	lelong			>0		not stripped
158220	belong&0377777777	042200407	a.out NetBSD/ns32532
15823>0	byte			&0x80		dynamically linked executable
15824>0	byte			^0x80
15825>>0	byte			&0x40		position independent
15826>>20	lelong			!0		executable
15827>>20	lelong			=0		object file
15828>16	lelong			>0		not stripped
158290	belong&0377777777	042200507	a.out NetBSD/ns32532 core
15830>12	string			>\0		from '%s'
15831>32	lelong			!0		(signal %d)
15832
158330	belong&0377777777	045200507	a.out NetBSD/powerpc core
15834>12	string			>\0		from '%s'
15835
158360	belong&0377777777	042400413	a.out NetBSD/SPARC demand paged
15837>0	byte			&0x80
15838>>20	belong			<8192		shared library
15839>>20	belong			=8192		dynamically linked executable
15840>>20	belong			>8192		dynamically linked executable
15841>0	byte			^0x80		executable
15842>16	belong			>0		not stripped
158430	belong&0377777777	042400410	a.out NetBSD/SPARC pure
15844>0	byte			&0x80		dynamically linked executable
15845>0	byte			^0x80		executable
15846>16	belong			>0		not stripped
158470	belong&0377777777	042400407	a.out NetBSD/SPARC
15848>0	byte			&0x80		dynamically linked executable
15849>0	byte			^0x80
15850>>0	byte			&0x40		position independent
15851>>20	belong			!0		executable
15852>>20	belong			=0		object file
15853>16	belong			>0		not stripped
158540	belong&0377777777	042400507	a.out NetBSD/SPARC core
15855>12	string			>\0		from '%s'
15856>32	belong			!0		(signal %d)
15857
158580	belong&0377777777	042600413	a.out NetBSD/pmax demand paged
15859>0	byte			&0x80
15860>>20	lelong			<4096		shared library
15861>>20	lelong			=4096		dynamically linked executable
15862>>20	lelong			>4096		dynamically linked executable
15863>0	byte			^0x80		executable
15864>16	lelong			>0		not stripped
158650	belong&0377777777	042600410	a.out NetBSD/pmax pure
15866>0	byte			&0x80		dynamically linked executable
15867>0	byte			^0x80		executable
15868>16	lelong			>0		not stripped
158690	belong&0377777777	042600407	a.out NetBSD/pmax
15870>0	byte			&0x80		dynamically linked executable
15871>0	byte			^0x80
15872>>0	byte			&0x40		position independent
15873>>20	lelong			!0		executable
15874>>20	lelong			=0		object file
15875>16	lelong			>0		not stripped
158760	belong&0377777777	042600507	a.out NetBSD/pmax core
15877>12	string			>\0		from '%s'
15878>32	lelong			!0		(signal %d)
15879
158800	belong&0377777777	043000413	a.out NetBSD/vax 1k demand paged
15881>0	byte			&0x80
15882>>20	lelong			<4096		shared library
15883>>20	lelong			=4096		dynamically linked executable
15884>>20	lelong			>4096		dynamically linked executable
15885>0	byte			^0x80		executable
15886>16	lelong			>0		not stripped
158870	belong&0377777777	043000410	a.out NetBSD/vax 1k pure
15888>0	byte			&0x80		dynamically linked executable
15889>0	byte			^0x80		executable
15890>16	lelong			>0		not stripped
158910	belong&0377777777	043000407	a.out NetBSD/vax 1k
15892>0	byte			&0x80		dynamically linked executable
15893>0	byte			^0x80
15894>>0	byte			&0x40		position independent
15895>>20	lelong			!0		executable
15896>>20	lelong			=0		object file
15897>16	lelong			>0		not stripped
158980	belong&0377777777	043000507	a.out NetBSD/vax 1k core
15899>12	string			>\0		from '%s'
15900>32	lelong			!0		(signal %d)
15901
159020	belong&0377777777	045400413	a.out NetBSD/vax 4k demand paged
15903>0	byte			&0x80
15904>>20	lelong			<4096		shared library
15905>>20	lelong			=4096		dynamically linked executable
15906>>20	lelong			>4096		dynamically linked executable
15907>0	byte			^0x80		executable
15908>16	lelong			>0		not stripped
159090	belong&0377777777	045400410	a.out NetBSD/vax 4k pure
15910>0	byte			&0x80		dynamically linked executable
15911>0	byte			^0x80		executable
15912>16	lelong			>0		not stripped
159130	belong&0377777777	045400407	a.out NetBSD/vax 4k
15914>0	byte			&0x80		dynamically linked executable
15915>0	byte			^0x80
15916>>0	byte			&0x40		position independent
15917>>20	lelong			!0		executable
15918>>20	lelong			=0		object file
15919>16	lelong			>0		not stripped
159200	belong&0377777777	045400507	a.out NetBSD/vax 4k core
15921>12	string			>\0		from '%s'
15922>32	lelong			!0		(signal %d)
15923
15924# NetBSD/alpha does not support (and has never supported) a.out objects,
15925# so no rules are provided for them.  NetBSD/alpha ELF objects are
15926# dealt with in "elf".
159270	lelong		0x00070185		ECOFF NetBSD/alpha binary
15928>10	leshort		0x0001			not stripped
15929>10	leshort		0x0000			stripped
159300	belong&0377777777	043200507	a.out NetBSD/alpha core
15931>12	string			>\0		from '%s'
15932>32	lelong			!0		(signal %d)
15933
159340	belong&0377777777	043400413	a.out NetBSD/mips demand paged
15935>0	byte			&0x80
15936>>20	belong			<8192		shared library
15937>>20	belong			=8192		dynamically linked executable
15938>>20	belong			>8192		dynamically linked executable
15939>0	byte			^0x80		executable
15940>16	belong			>0		not stripped
159410	belong&0377777777	043400410	a.out NetBSD/mips pure
15942>0	byte			&0x80		dynamically linked executable
15943>0	byte			^0x80		executable
15944>16	belong			>0		not stripped
159450	belong&0377777777	043400407	a.out NetBSD/mips
15946>0	byte			&0x80		dynamically linked executable
15947>0	byte			^0x80
15948>>0	byte			&0x40		position independent
15949>>20	belong			!0		executable
15950>>20	belong			=0		object file
15951>16	belong			>0		not stripped
159520	belong&0377777777	043400507	a.out NetBSD/mips core
15953>12	string			>\0		from '%s'
15954>32	belong			!0		(signal %d)
15955
159560	belong&0377777777	043600413	a.out NetBSD/arm32 demand paged
15957>0	byte			&0x80
15958>>20	lelong			<4096		shared library
15959>>20	lelong			=4096		dynamically linked executable
15960>>20	lelong			>4096		dynamically linked executable
15961>0	byte			^0x80		executable
15962>16	lelong			>0		not stripped
159630	belong&0377777777	043600410	a.out NetBSD/arm32 pure
15964>0	byte			&0x80		dynamically linked executable
15965>0	byte			^0x80		executable
15966>16	lelong			>0		not stripped
159670	belong&0377777777	043600407	a.out NetBSD/arm32
15968>0	byte			&0x80		dynamically linked executable
15969>0	byte			^0x80
15970>>0	byte			&0x40		position independent
15971>>20	lelong			!0		executable
15972>>20	lelong			=0		object file
15973>16	lelong			>0		not stripped
15974# NetBSD/arm26 has always used ELF objects, but it shares a core file
15975# format with NetBSD/arm32.
159760	belong&0377777777	043600507	a.out NetBSD/arm core
15977>12	string			>\0		from '%s'
15978>32	lelong			!0		(signal %d)
15979
15980# Kernel core dump format
159810	belong&0x0000ffff 0x00008fca	NetBSD kernel core file
15982>0	belong&0x03ff0000 0x00000000	\b, Unknown
15983>0	belong&0x03ff0000 0x00010000	\b, sun 68010/68020
15984>0	belong&0x03ff0000 0x00020000	\b, sun 68020
15985>0	belong&0x03ff0000 0x00640000	\b, 386 PC
15986>0	belong&0x03ff0000 0x00860000	\b, i386 BSD
15987>0	belong&0x03ff0000 0x00870000	\b, m68k BSD (8K pages)
15988>0	belong&0x03ff0000 0x00880000	\b, m68k BSD (4K pages)
15989>0	belong&0x03ff0000 0x00890000	\b, ns32532 BSD
15990>0	belong&0x03ff0000 0x008a0000	\b, SPARC/32 BSD
15991>0	belong&0x03ff0000 0x008b0000	\b, pmax BSD
15992>0	belong&0x03ff0000 0x008c0000	\b, vax BSD (1K pages)
15993>0	belong&0x03ff0000 0x008d0000	\b, alpha BSD
15994>0	belong&0x03ff0000 0x008e0000	\b, mips BSD (Big Endian)
15995>0	belong&0x03ff0000 0x008f0000	\b, arm6 BSD
15996>0	belong&0x03ff0000 0x00900000	\b, m68k BSD (2K pages)
15997>0	belong&0x03ff0000 0x00910000	\b, sh3 BSD
15998>0	belong&0x03ff0000 0x00950000	\b, ppc BSD (Big Endian)
15999>0	belong&0x03ff0000 0x00960000	\b, vax BSD (4K pages)
16000>0	belong&0x03ff0000 0x00970000	\b, mips1 BSD
16001>0	belong&0x03ff0000 0x00980000	\b, mips2 BSD
16002>0	belong&0x03ff0000 0x00990000	\b, m88k BSD
16003>0	belong&0x03ff0000 0x00920000	\b, parisc BSD
16004>0	belong&0x03ff0000 0x009b0000	\b, sh5/64 BSD
16005>0	belong&0x03ff0000 0x009c0000	\b, SPARC/64 BSD
16006>0	belong&0x03ff0000 0x009d0000	\b, amd64 BSD
16007>0	belong&0x03ff0000 0x009e0000	\b, sh5/32 BSD
16008>0	belong&0x03ff0000 0x009f0000	\b, ia64 BSD
16009>0	belong&0x03ff0000 0x00b70000	\b, aarch64 BSD
16010>0	belong&0x03ff0000 0x00b80000	\b, or1k BSD
16011>0	belong&0x03ff0000 0x00b90000	\b, Risk-V BSD
16012>0	belong&0x03ff0000 0x00c80000	\b, hp200 BSD
16013>0	belong&0x03ff0000 0x012c0000	\b, hp300 BSD
16014>0	belong&0x03ff0000 0x020b0000	\b, hp800 HP-UX
16015>0	belong&0x03ff0000 0x020c0000	\b, hp200/hp300 HP-UX
16016>0	belong&0xfc000000 0x04000000	\b, CPU
16017>0	belong&0xfc000000 0x08000000	\b, DATA
16018>0	belong&0xfc000000 0x10000000	\b, STACK
16019>4	leshort	x			\b, (headersize = %d
16020>6	leshort	x			\b, segmentsize = %d
16021>6	lelong	x			\b, segments = %d)
16022
16023#------------------------------------------------------------------------------
16024# $File$
16025# netscape:  file(1) magic for Netscape files
16026# "H. Nanosecond" <aldomel@ix.netcom.com>
16027# version 3 and 4 I think
16028#
16029
16030# Netscape Address book  .nab
160310	string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book
16032
16033# Netscape Communicator address book
160340   string   \000\017\102\111 Netscape Communicator address book
16035
16036# .snm Caches
160370	string		#\ Netscape\ folder\ cache	Netscape folder cache
160380	string	\000\036\204\220\000	Netscape folder cache
16039# .n2p
16040# Net 2 Phone
16041#0	string	123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
160420	string	SX961999	Net2phone
16043
16044#
16045#This is files ending in .art, FIXME add more rules
160460       string          JG\004\016\0\0\0\0      ART
16047
16048#------------------------------------------------------------------------------
16049# $File$
16050# netware:  file(1) magic for NetWare Loadable Modules (NLMs)
16051# From: Mads Martin Joergensen <mmj@suse.de>
16052
160530	string	NetWare\ Loadable\ Module	NetWare Loadable Module
16054
16055#------------------------------------------------------------------------------
16056# $File$
16057# news:  file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
16058#
160590	string		StartFontMetrics	ASCII font metrics
160600	string		StartFont	ASCII font bits
160610	belong		0x137A2944	NeWS bitmap font
160620	belong		0x137A2947	NeWS font family
160630	belong		0x137A2950	scalable OpenFont binary
160640	belong		0x137A2951	encrypted scalable OpenFont binary
160658	belong		0x137A2B45	X11/NeWS bitmap font
160668	belong		0x137A2B48	X11/NeWS font family
16067
16068#------------------------------------------------------------------------------
16069# $File: nitpicker,v 1.5 2014/04/28 12:04:50 christos Exp $
16070# nitpicker:  file(1) magic for Flowfiles.
16071# From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de
160720	string	NPFF	NItpicker Flow File
16073>4	byte	x	V%d.
16074>5	byte	x	%d
16075>6	bedate	x	started: %s
16076>10	bedate	x	stopped: %s
16077>14	belong	x	Bytes: %u
16078>18	belong	x	Bytes1: %u
16079>22	belong	x	Flows: %u
16080>26	belong	x	Pkts: %u
16081
16082#------------------------------------------------------------------------------
16083# $File: oasis,v 1.1 2011/03/15 02:09:38 christos Exp $
16084# OASIS
16085# Summary: OASIS stream file
16086# Long description: Open Artwork System Interchange Standard
16087# File extension: .oas
16088# Full name:	Ben Cowley (bcowley@broadcom.com)
16089#		Philip Dixon (pdixon@broadcom.com)
16090# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf
16091#		(see page 3)
160920	string	%SEMI-OASIS\r\n		OASIS Stream file
16093
16094#------------------------------------------------------------------------------
16095# $File: ocaml,v 1.4 2009/09/19 16:28:11 christos Exp $
16096# ocaml: file(1) magic for Objective Caml files.
160970	string	Caml1999	OCaml
16098>8	string	X		exec file
16099>8	string	I		interface file (.cmi)
16100>8	string	O		object file (.cmo)
16101>8	string	A		library file (.cma)
16102>8	string	Y		native object file (.cmx)
16103>8	string	Z		native library file (.cmxa)
16104>8	string	M		abstract syntax tree implementation file
16105>8	string	N		abstract syntax tree interface file
16106>9	string	>\0		(Version %3.3s)
16107
16108#------------------------------------------------------------------------------
16109# $File$
16110# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org>
161110	string		Octave-1-L	Octave binary data (little endian)
161120	string		Octave-1-B	Octave binary data (big endian)
16113
16114#------------------------------------------------------------------------------
16115# $File$
16116# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
16117# storage (http://en.wikipedia.org/wiki/Structured_Storage)
16118# Additional tests for OLE 2 Compound Documents should be under this recipe.
16119
161200   string  \320\317\021\340\241\261\032\341      OLE 2 Compound Document
16121# - Microstation V8 DGN files (www.bentley.com)
16122#   Last update on 10/23/2006 by Lester Hightower
16123> 0x480  string  D\000g\000n\000~\000H                : Microstation V8 DGN
16124# - Visio documents
16125#   Last update on 10/23/2006 by Lester Hightower
16126> 0x480  string  V\000i\000s\000i\000o\000D\000o\000c : Visio Document
16127
16128#------------------------------------------------------------------------------
16129# $File$
16130# olf:  file(1) magic for OLF executables
16131#
16132# We have to check the byte order flag to see what byte order all the
16133# other stuff in the header is in.
16134#
16135# MIPS R3000 may also be for MIPS R2000.
16136# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
16137#
16138# Created by Erik Theisen <etheisen@openbsd.org>
16139# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com>
161400	string		\177OLF		OLF
16141>4	byte		0		invalid class
16142>4	byte		1		32-bit
16143>4	byte		2		64-bit
16144>7	byte		0		invalid os
16145>7	byte		1		OpenBSD
16146>7	byte		2		NetBSD
16147>7	byte		3		FreeBSD
16148>7	byte		4		4.4BSD
16149>7	byte		5		Linux
16150>7	byte		6		SVR4
16151>7	byte		7		esix
16152>7	byte		8		Solaris
16153>7	byte		9		Irix
16154>7	byte		10		SCO
16155>7	byte		11		Dell
16156>7	byte		12		NCR
16157>5	byte		0		invalid byte order
16158>5	byte		1		LSB
16159>>16	leshort		0		no file type,
16160>>16	leshort		1		relocatable,
16161>>16	leshort		2		executable,
16162>>16	leshort		3		shared object,
16163# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
16164# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
16165>>16	leshort		4		core file
16166>>>(0x38+0xcc) string	>\0		of '%s'
16167>>>(0x38+0x10) lelong	>0		(signal %d),
16168>>16	leshort		&0xff00		processor-specific,
16169>>18	leshort		0		no machine,
16170>>18	leshort		1		AT&T WE32100 - invalid byte order,
16171>>18	leshort		2		SPARC - invalid byte order,
16172>>18	leshort		3		Intel 80386,
16173>>18	leshort		4		Motorola 68000 - invalid byte order,
16174>>18	leshort		5		Motorola 88000 - invalid byte order,
16175>>18	leshort		6		Intel 80486,
16176>>18	leshort		7		Intel 80860,
16177>>18	leshort		8		MIPS R3000_BE - invalid byte order,
16178>>18	leshort		9		Amdahl - invalid byte order,
16179>>18	leshort		10		MIPS R3000_LE,
16180>>18	leshort		11		RS6000 - invalid byte order,
16181>>18	leshort		15		PA-RISC - invalid byte order,
16182>>18	leshort		16		nCUBE,
16183>>18	leshort		17		VPP500,
16184>>18	leshort		18		SPARC32PLUS,
16185>>18	leshort		20		PowerPC,
16186>>18	leshort		0x9026		Alpha,
16187>>20	lelong		0		invalid version
16188>>20	lelong		1		version 1
16189>>36	lelong		1		MathCoPro/FPU/MAU Required
16190>8	string		>\0		(%s)
16191>5	byte		2		MSB
16192>>16	beshort		0		no file type,
16193>>16	beshort		1		relocatable,
16194>>16	beshort		2		executable,
16195>>16	beshort		3		shared object,
16196>>16	beshort		4		core file,
16197>>>(0x38+0xcc) string	>\0		of '%s'
16198>>>(0x38+0x10) belong	>0		(signal %d),
16199>>16	beshort		&0xff00		processor-specific,
16200>>18	beshort		0		no machine,
16201>>18	beshort		1		AT&T WE32100,
16202>>18	beshort		2		SPARC,
16203>>18	beshort		3		Intel 80386 - invalid byte order,
16204>>18	beshort		4		Motorola 68000,
16205>>18	beshort		5		Motorola 88000,
16206>>18	beshort		6		Intel 80486 - invalid byte order,
16207>>18	beshort		7		Intel 80860,
16208>>18	beshort		8		MIPS R3000_BE,
16209>>18	beshort		9		Amdahl,
16210>>18	beshort		10		MIPS R3000_LE - invalid byte order,
16211>>18	beshort		11		RS6000,
16212>>18	beshort		15		PA-RISC,
16213>>18	beshort		16		nCUBE,
16214>>18	beshort		17		VPP500,
16215>>18	beshort		18		SPARC32PLUS,
16216>>18	beshort		20		PowerPC or cisco 4500,
16217>>18	beshort		21		cisco 7500,
16218>>18	beshort		24		cisco SVIP,
16219>>18	beshort		25		cisco 7200,
16220>>18	beshort		36		cisco 12000,
16221>>18	beshort		0x9026		Alpha,
16222>>20	belong		0		invalid version
16223>>20	belong		1		version 1
16224>>36	belong		1		MathCoPro/FPU/MAU Required
16225
16226#------------------------------------------------------------------------------
16227# $File: os2,v 1.7 2009/09/19 16:28:11 christos Exp $
16228# os2:  file(1) magic for OS/2 files
16229#
16230
16231# Provided 1998/08/22 by
16232# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
162331	search/1	InternetShortcut	MS Windows 95 Internet shortcut text
16234>17	search/100	URL= 			(URL=<
16235>>&0	string		x			\b%s>)
16236
16237# OS/2 URL objects
16238# Provided 1998/08/22 by
16239# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
16240#0	string	http:			OS/2 URL object text
16241#>5	string	>\			(WWW) <http:%s>
16242#0	string	mailto:			OS/2 URL object text
16243#>7	string	>\			(email) <%s>
16244#0	string	news:			OS/2 URL object text
16245#>5	string	>\			(Usenet) <%s>
16246#0	string	ftp:			OS/2 URL object text
16247#>4	string	>\			(FTP) <ftp:%s>
16248#0	string	file:			OS/2 URL object text
16249#>5	string	>\			(Local file) <%s>
16250
16251# >>>>> OS/2 INF/HLP <<<<<  (source: Daniel Dissett ddissett@netcom.com)
16252# Carl Hauser (chauser.parc@xerox.com) and
16253# Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
16254# list the following header format in inf02a.doc:
16255#
16256#  int16 ID;           // ID magic word (5348h = "HS")
16257#  int8  unknown1;     // unknown purpose, could be third letter of ID
16258#  int8  flags;        // probably a flag word...
16259#                      //  bit 0: set if INF style file
16260#                      //  bit 4: set if HLP style file
16261#                      // patching this byte allows reading HLP files
16262#                      // using the VIEW command, while help files
16263#                      // seem to work with INF settings here as well.
16264#  int16 hdrsize;      // total size of header
16265#  int16 unknown2;     // unknown purpose
16266#
162670   string  HSP\x01\x9b\x00 OS/2 INF
16268>107 string >0                      (%s)
162690   string  HSP\x10\x9b\x00     OS/2 HLP
16270>107 string >0                      (%s)
16271
16272# OS/2 INI (this is a guess)
162730  string   \xff\xff\xff\xff\x14\0\0\0  OS/2 INI
16274
16275#------------------------------------------------------------------------------
16276# $File$
16277# os400:  file(1) magic for IBM OS/400 files
16278#
16279# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com
16280# In spite of its quite variable format (due to internal memory page
16281# length differences between CISC and RISC versions of the OS) the
16282# SAVF structure hasn't suitable offsets to identify the catalog
16283# header in the first descriptor where there are some useful infos,
16284# so we must search in a somewhat large area for a particular string
16285# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore
16286# descriptor space) preceded by a two byte constant.
16287#
162881090	 search/7393	\x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data
16289>&212	 byte		0x01			 \b, created with SAVOBJ
16290>&212	 byte		0x02			 \b, created with SAVLIB
16291>&212	 byte		0x07			 \b, created with SAVCFG
16292>&212	 byte		0x08			 \b, created with SAVSECDTA
16293>&212	 byte		0x0A			 \b, created with SAVSECDTA
16294>&212	 byte		0x0B			 \b, created with SAVDLO
16295>&212	 byte		0x0D			 \b, created with SAVLICPGM
16296>&212	 byte		0x11			 \b, created with SAVCHGOBJ
16297>&213	 byte		0x44			 \b, at least V5R4 to open
16298>&213	 byte		0x43			 \b, at least V5R3 to open
16299>&213	 byte		0x42			 \b, at least V5R2 to open
16300>&213	 byte		0x41			 \b, at least V5R1 to open
16301>&213	 byte		0x40			 \b, at least V4R5 to open
16302>&213	 byte		0x3F			 \b, at least V4R4 to open
16303>&213	 byte		0x3E			 \b, at least V4R3 to open
16304>&213	 byte		0x3C			 \b, at least V4R2 to open
16305>&213	 byte		0x3D			 \b, at least V4R1M4 to open
16306>&213	 byte		0x3B			 \b, at least V4R1 to open
16307>&213	 byte		0x3A			 \b, at least V3R7 to open
16308>&213	 byte		0x35			 \b, at least V3R6 to open
16309>&213	 byte		0x36			 \b, at least V3R2 to open
16310>&213	 byte		0x34			 \b, at least V3R1 to open
16311>&213	 byte		0x31			 \b, at least V3R0M5 to open
16312>&213	 byte		0x30			 \b, at least V2R3 to open
16313
16314#------------------------------------------------------------------------------
16315# $File: os9,v 1.6 2009/09/19 16:28:11 christos Exp $
16316#
16317# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
16318#
16319# Redistribution and use in source and binary forms, with or without
16320# modification, are permitted provided that the following conditions
16321# are met:
16322# 1. Redistributions of source code must retain the above copyright
16323#    notice, this list of conditions and the following disclaimer.
16324# 2. Redistributions in binary form must reproduce the above copyright
16325#    notice, this list of conditions and the following disclaimer in the
16326#    documentation and/or other materials provided with the distribution.
16327#
16328# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16329# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16330# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16331# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
16332# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
16333# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
16334# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
16335# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
16336# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
16337# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
16338#
16339#
16340#
16341# OS9/6809 module descriptions:
16342#
163430	beshort		0x87CD	OS9/6809 module:
16344#
16345>6	byte&0x0f	0x00	non-executable
16346>6	byte&0x0f	0x01	machine language
16347>6	byte&0x0f	0x02	BASIC I-code
16348>6	byte&0x0f	0x03	Pascal P-code
16349>6	byte&0x0f	0x04	C I-code
16350>6	byte&0x0f	0x05	COBOL I-code
16351>6	byte&0x0f	0x06	Fortran I-code
16352#
16353>6	byte&0xf0	0x10	program executable
16354>6	byte&0xf0	0x20	subroutine
16355>6	byte&0xf0	0x30	multi-module
16356>6	byte&0xf0	0x40	data module
16357#
16358>6	byte&0xf0	0xC0	system module
16359>6	byte&0xf0	0xD0	file manager
16360>6	byte&0xf0	0xE0	device driver
16361>6	byte&0xf0	0xF0	device descriptor
16362#
16363# OS9/m68k stuff (to be continued)
16364#
163650	beshort		0x4AFC	OS9/68K module:
16366#
16367# attr
16368>0x14	byte&0x80	0x80	re-entrant
16369>0x14	byte&0x40	0x40	ghost
16370>0x14	byte&0x20	0x20	system-state
16371#
16372# lang:
16373#
16374>0x13	byte		1	machine language
16375>0x13	byte		2	BASIC I-code
16376>0x13	byte		3	Pascal P-code
16377>0x13	byte		4	C I-code
16378>0x13	byte		5	COBOL I-code
16379>0x13	byte		6	Fortran I-code
16380#
16381#
16382# type:
16383#
16384>0x12	byte		1	program executable
16385>0x12	byte		2	subroutine
16386>0x12	byte		3	multi-module
16387>0x12	byte		4	data module
16388>0x12	byte		11	trap library
16389>0x12	byte		12	system module
16390>0x12	byte		13	file manager
16391>0x12	byte		14	device driver
16392>0x12	byte		15	device descriptor
16393
16394#------------------------------------------------------------------------------
16395# $File$
16396#
16397# Mach magic number info
16398#
163990	long		0xefbe	OSF/Rose object
16400# I386 magic number info
16401#
164020	short		0565	i386 COFF object
16403
16404#------------------------------------------------------------------------------
16405# $File: palm,v 1.12 2014/03/28 19:11:40 christos Exp $
16406# palm:	 file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
16407#
16408# Brian Lalor <blalor@hcirisc.cs.binghamton.edu>
16409
16410# These are weak, byte 59 is not guaranteed to be 0 and there are
16411# 8 character identifiers at byte 60, one I found for appl is BIGb.
16412# What are the possibilities and where is this documented?
16413
16414# The common header format for PalmOS .pdb/.prc files is
16415# {
16416#         char            name[ 32 ];
16417#         Word            attributes;
16418#         Word            version;
16419#         DWord           creationDate;
16420#         DWord           modificationDate;
16421#         DWord           lastBackupDate;
16422#         DWord           modificationNumber;
16423#         DWord           appInfoID;
16424#         DWord           sortInfoID;
16425#         char            type[4];
16426#         char            creator[4];
16427#         DWord           uniqueIDSeed;
16428#         RecordListType  recordList;
16429# };
16430#
16431# Datestamps are unsigned seconds since the MacOS epoch (Jan 1, 1904),
16432# or Unix/POSIX time + 2082844800.
16433
164340		name		aportisdoc
16435# date is supposed to be big-endian seconds since 1 Jan 1904, but many
16436# files contain the timestamp in little-endian or a completely
16437# nonsensical value...
16438#>36		bedate-2082844800	>0	\b, created %s
16439# compression: 1=uncomp, 2=orig, 0x4448=HuffDic
16440>(78.L)		beshort		=1		\b, uncompressed
16441# compressed
16442>(78.L)		beshort		>1
16443>>(78.L+4)	belong		x		\b, %d bytes uncompressed
16444
16445# appl
16446#60		string		appl		PalmOS application
16447#>0		string		>\0		"%s"
16448
16449# HACK
16450#60		string		HACK		HackMaster hack
16451#>0		string		>\0		"%s"
16452
16453# iSiloX e-book
1645460		string		SDocSilX	iSiloX E-book
16455>0		string		>\0		"%s"
16456
16457# Mobipocket (www.mobipocket.com), donated by Carl Witty
16458# expanded by Ralf Brown
1645960		string	 	BOOKMOBI	Mobipocket E-book
16460# MobiPocket stores a full title, pointed at by the belong at offset
16461# 0x54 in its header at (78.L), with length given by the belong at
16462# offset 0x58.
16463# there's no guarantee that the title string is null-terminated, but
16464# we currently can't specify a variable-length string where the length
16465# field is not at the start of the string; in practice, the data
16466# following the string always seems to start with a zero byte
16467>(78.L)		belong		x
16468>>&(&0x50.L-4)	string		>\0		"%s"
16469>0		use		aportisdoc
16470>>(78.L+0x68)	belong		>0		\b, version %d
16471>>(78.L+0x1C)	belong		!0		\b, codepage %d
16472>>(78.L+0x0C)	beshort	 	>0		\b, encrypted (type %d)
16473
16474# AportisDoc/PalmDOC
1647560		string		TEXtREAd	AportisDoc/PalmDOC E-book
16476>0		string		>\0		"%s"
16477>0		use		aportisdoc
16478
16479# Variety of PalmOS document types
16480# Michael-John Turner <mj@debian.org>
16481# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType
1648260	string			BVokBDIC	BDicty PalmOS document
16483>0	string			>\0		"%s"
1648460	string			DB99DBOS	DB PalmOS document
16485>0	string			>\0		"%s"
1648660	string			vIMGView	FireViewer/ImageViewer PalmOS document
16487>0	string			>\0		"%s"
1648860	string			PmDBPmDB	HanDBase PalmOS document
16489>0	string			>\0		"%s"
1649060	string			InfoINDB	InfoView PalmOS document
16491>0	string			>\0		"%s"
1649260	string			ToGoToGo	iSilo PalmOS document
16493>0	string			>\0		"%s"
1649460	string			JfDbJBas	JFile PalmOS document
16495>0	string			>\0		"%s"
1649660	string			JfDbJFil	JFile Pro PalmOS document
16497>0	string			>\0		"%s"
1649860	string			DATALSdb	List PalmOS document
16499>0	string			>\0		"%s"
1650060	string			Mdb1Mdb1	MobileDB PalmOS document
16501>0	string			>\0		"%s"
1650260	string			PNRdPPrs	PeanutPress PalmOS document
16503>0	string			>\0		"%s"
1650460	string			DataPlkr	Plucker PalmOS document
16505>0	string			>\0		"%s"
1650660	string			DataSprd	QuickSheet PalmOS document
16507>0	string			>\0		"%s"
1650860	string			SM01SMem	SuperMemo PalmOS document
16509>0	string			>\0		"%s"
1651060	string			TEXtTlDc	TealDoc PalmOS document
16511>0	string			>\0		"%s"
1651260	string			InfoTlIf	TealInfo PalmOS document
16513>0	string			>\0		"%s"
1651460	string			DataTlMl	TealMeal PalmOS document
16515>0	string			>\0		"%s"
1651660	string			DataTlPt	TealPaint PalmOS document
16517>0	string			>\0		"%s"
1651860	string			dataTDBP	ThinkDB PalmOS document
16519>0	string			>\0		"%s"
1652060	string			TdatTide	Tides PalmOS document
16521>0	string			>\0		"%s"
1652260	string			ToRaTRPW	TomeRaider PalmOS document
16523>0	string			>\0		"%s"
16524
16525# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net)
16526# For version 1.xx zTXTs, outputs version and numbers of bookmarks and
16527#   annotations.
16528# For other versions, just outputs version.
16529#
1653060		string		zTXT		A GutenPalm zTXT e-book
16531>0		string		>\0		"%s"
16532>(0x4E.L)	byte		0
16533>>(0x4E.L+1)	byte		x		(v0.%02d)
16534>(0x4E.L)	byte		1
16535>>(0x4E.L+1)	byte		x		(v1.%02d)
16536>>>(0x4E.L+10)	beshort		>0
16537>>>>(0x4E.L+10) beshort		<2		- 1 bookmark
16538>>>>(0x4E.L+10) beshort		>1		- %d bookmarks
16539>>>(0x4E.L+14)	beshort		>0
16540>>>>(0x4E.L+14) beshort		<2		- 1 annotation
16541>>>>(0x4E.L+14) beshort		>1		- %d annotations
16542>(0x4E.L)	byte		>1		(v%d.
16543>>(0x4E.L+1)	byte		x		%02d)
16544
16545# Palm OS .prc file types
1654660		string		libr
16547# flags, only bit 0 or bit 6
16548# http://en.wikipedia.org/wiki/PRC_%28Palm_OS%29
16549# http://web.mit.edu/tytso/www/pilot/prc-format.html
16550>0x20		beshort&0xffbe	0
16551>>0		string		>\0		Palm OS dynamic library data "%s"
1655260		string		ptch		Palm OS operating system patch data
16553>0		string		>\0		"%s"
16554
16555# Mobipocket (www.mobipocket.com), donated by Carl Witty
1655660	string			BOOKMOBI	Mobipocket E-book
16557>0	string			>\0		"%s"
16558
16559#------------------------------------------------------------------------------
16560# $File$
16561#
16562# Parix COFF executables
16563# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de>
16564#
165650	beshort&0xfff	0xACE	PARIX
16566>0	byte&0xf0	0x80	T800
16567>0	byte&0xf0	0x90	T9000
16568>19	byte&0x02	0x02	executable
16569>19	byte&0x02	0x00	object
16570>19	byte&0x0c	0x00	not stripped
16571#------------------------------------------------------------------------------
16572# $File$
16573# parrot: file(1) magic for Parrot Virtual Machine
16574# URL:	http://www.lua.org/
16575# From: Lubomir Rintel <lkundrak@v3.sk>
16576
16577# Compiled Parrot byte code
165780	string	\376PBC\r\n\032\n	Parrot bytecode
16579>64	byte	x			%d.
16580>72	byte	x			\b%d,
16581>8	byte	>0			%d byte words,
16582>16	byte	0			little-endian,
16583>16	byte	1			big-endian,
16584>32	byte	0			IEEE-754 8 byte double floats,
16585>32	byte	1			x86 12 byte long double floats,
16586>32	byte	2			IEEE-754 16 byte long double floats,
16587>32	byte	3			MIPS 16 byte long double floats,
16588>32	byte	4			AIX 16 byte long double floats,
16589>32	byte	5			4-byte floats,
16590>40	byte	x			Parrot %d.
16591>48	byte	x			\b%d.
16592>56	byte	x			\b%d
16593#------------------------------------------------------------------------------
16594# $File: pascal,v 1.1 2011/12/08 12:12:46 rrt Exp $
16595# pascal:  file(1) magic for Pascal source
16596#
165970	search/8192	(input,		Pascal source text
16598!:mime	text/x-pascal
16599#0	regex		\^program	Pascal source text
16600#!:mime	text/x-pascal
16601#0	regex           	\^record		Pascal source text
16602#!:mime	text/x-pascal
16603
16604#------------------------------------------------------------------------------
16605# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $
16606# file(1) magic(5) data for OpenStreetMap
16607
16608# OpenStreetMap Protocolbuffer Binary Format (.osm.pbf)
16609# http://wiki.openstreetmap.org/wiki/PBF_Format
16610# From: Markus Heidelberg <markus.heidelberg@web.de>
166110	belong		0x0000000D
16612>4	beshort		0x0A09
16613>>6	string		OSMHeader	OpenStreetMap Protocolbuffer Binary Format
16614
16615#------------------------------------------------------------------------------
16616# $File$
16617# pbm:  file(1) magic for Portable Bitmap files
16618#
16619# XXX - byte order?
16620#
166210	short	0x2a17	"compact bitmap" format (Poskanzer)
16622
16623#------------------------------------------------------------------------------
16624# $File: pdf,v 1.7 2013/08/22 07:47:26 christos Exp $
16625# pdf:  file(1) magic for Portable Document Format
16626#
16627
166280	string		%PDF-		PDF document
16629!:mime	application/pdf
16630>5	byte		x		\b, version %c
16631>7	byte		x		\b.%c
16632
166330	string		\012%PDF-	PDF document
16634!:mime	application/pdf
16635>6	byte		x		\b, version %c
16636>8	byte		x		\b.%c
16637
16638# From: Nick Schmalenberger <nick@schmalenberger.us>
16639# Forms Data Format
166400       string          %FDF-           FDF document
16641!:mime application/vnd.fdf
16642>5      byte            x               \b, version %c
16643>7      byte            x               \b.%c
16644
16645#------------------------------------------------------------------------------
16646# $File: pdp,v 1.9 2013/04/19 20:11:43 christos Exp $
16647# pdp:  file(1) magic for PDP-11 executable/object and APL workspace
16648#
166490	lelong		0101555		PDP-11 single precision APL workspace
166500	lelong		0101554		PDP-11 double precision APL workspace
16651#
16652# PDP-11 a.out
16653#
166540	leshort		0407		PDP-11 executable
16655>8	leshort		>0		not stripped
16656>15	byte		>0		- version %d
16657
16658# updated by Joerg Jenderek at Mar 2013
16659# GRR: line below too general as it catches also Windows precompiled setup information *.PNF
166600	leshort		0401
16661# skip *.PNF with WinDirPathOffset 58h
16662>68	ulelong		!0x00000058	PDP-11 UNIX/RT ldp
16663# skip *.PNF with high byte of InfVersionDatumCount zero
16664#>>15	byte		!0		PDP-11 UNIX/RT ldp
166650	leshort		0405		PDP-11 old overlay
16666
166670	leshort		0410		PDP-11 pure executable
16668>8	leshort		>0		not stripped
16669>15	byte		>0		- version %d
16670
166710	leshort		0411		PDP-11 separate I&D executable
16672>8	leshort		>0		not stripped
16673>15	byte		>0		- version %d
16674
166750	leshort		0437		PDP-11 kernel overlay
16676
16677# These last three are derived from 2.11BSD file(1)
166780	leshort		0413		PDP-11 demand-paged pure executable
16679>8	leshort		>0		not stripped
16680
166810	leshort		0430		PDP-11 overlaid pure executable
16682>8	leshort		>0		not stripped
16683
166840	leshort		0431		PDP-11 overlaid separate executable
16685>8	leshort		>0		not stripped
16686#------------------------------------------------------------------------------
16687# $File: perl,v 1.22 2014/04/28 12:04:35 christos Exp $
16688# perl:  file(1) magic for Larry Wall's perl language.
16689#
16690# The `eval' lines recognizes an outrageously clever hack.
16691# Keith Waclena <keith@cerberus.uchicago.edu>
16692# Send additions to <perl5-porters@perl.org>
166930	search/1	eval\ "exec\ /bin/perl		Perl script text
16694!:mime	text/x-perl
166950	search/1	eval\ "exec\ /usr/bin/perl	Perl script text
16696!:mime	text/x-perl
166970	search/1	eval\ "exec\ /usr/local/bin/perl	Perl script text
16698!:mime	text/x-perl
166990	search/1	eval\ '(exit\ $?0)'\ &&\ eval\ 'exec	Perl script text
16700!:mime	text/x-perl
167010	search/1	#!/usr/bin/env\ perl	Perl script text executable
16702!:mime	text/x-perl
167030	search/1	#!\ /usr/bin/env\ perl	Perl script text executable
16704!:mime	text/x-perl
167050	search/1	#!
16706>0	regex	\^#!.*/bin/perl([[:space:]].*)*$	Perl script text executable
16707!:mime	text/x-perl
16708
16709# by Dmitry V. Levin and Alexey Tourbin
16710# check the first line
167110	search/1	package
16712>0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;	Perl5 module source text
16713!:strength + 10
16714# not 'p', check other lines
167150	search/1	!p
16716>0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;
16717>>0	regex		\^1\ *;|\^(use|sub|my)\ .*[(;{=]	Perl5 module source text
16718!:strength + 10
16719
16720# Perl POD documents
16721# From: Tom Hukins <tom@eborcom.com>
167220	search/1/W	\=pod\n		Perl POD document text
167230	search/1/W	\n\=pod\n	Perl POD document text
167240	search/1/W	\=head1\ 	Perl POD document text
167250	search/1/W	\n\=head1\ 	Perl POD document text
167260	search/1/W	\=head2\ 	Perl POD document text
167270	search/1/W	\n\=head2\ 	Perl POD document text
167280	search/1/W	\=encoding\ 	Perl POD document text
167290	search/1/W	\n\=encoding\ 	Perl POD document text
16730
16731
16732# Perl Storable data files.
167330	string	perl-store	perl Storable (v0.6) data
16734>4	byte	>0	(net-order %d)
16735>>4	byte	&01	(network-ordered)
16736>>4	byte	=3	(major 1)
16737>>4	byte	=2	(major 1)
16738
167390	string	pst0	perl Storable (v0.7) data
16740>4	byte	>0
16741>>4	byte	&01	(network-ordered)
16742>>4	byte	=5	(major 2)
16743>>4	byte	=4	(major 2)
16744>>5	byte	>0	(minor %d)
16745
16746# This is Debian #742949 by Zefram <zefram@fysh.org>:
16747# -----------------------------------------------------------
16748# The Perl module Hash::SharedMem
16749# <https://metacpan.org/release/Hash-SharedMem> defines a file format
16750# for a key/value store.  Details of the file format are in the "DESIGN"
16751# file in the module distribution.  Magic:
167520	bequad	=0xa58afd185cbf5af7	Hash::SharedMem master file, big-endian
16753>8	bequad	<0x1000000
16754>>15	byte	>2	\b, line size 2^%d byte
16755>>14	byte	>2	\b, page size 2^%d byte
16756>>13	byte	&1
16757>>>13	byte	>1	\b, max fanout %d
167580	lequad	=0xa58afd185cbf5af7	Hash::SharedMem master file, little-endian
16759>8	lequad	<0x1000000
16760>>8	byte	>2	\b, line size 2^%d byte
16761>>9	byte	>2	\b, page size 2^%d byte
16762>>10	byte	&1
16763>>>10	byte	>1	\b, max fanout %d
167640	bequad	=0xc693dac5ed5e47c2	Hash::SharedMem data file, big-endian
16765>8	bequad	<0x1000000
16766>>15	byte	>2	\b, line size 2^%d byte
16767>>14	byte	>2	\b, page size 2^%d byte
16768>>13	byte	&1
16769>>>13	byte	>1	\b, max fanout %d
167700	lequad	=0xc693dac5ed5e47c2	Hash::SharedMem data file, little-endian
16771>8	lequad	<0x1000000
16772>>8	byte	>2	\b, line size 2^%d byte
16773>>9	byte	>2	\b, page size 2^%d byte
16774>>10	byte	&1
16775>>>10	byte	>1	\b, max fanout %d
16776
16777#------------------------------------------------------------------------------
16778# $File: matroska,v 1.8 2013/02/08 17:25:16 christos Exp $
16779# pgf: file(1) magic for Progressive Graphics File (PGF)
16780#
16781# <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf>
16782# 2013 by Philipp Hahn <pmhahn debian org>
167830 string PGF Progressive Graphics image data,
16784!:mime image/x-pgf
16785>3	string	2	version %s,
16786>3	string	4	version %s,
16787>3	string	5	version %s,
16788>3	string	6	version %s,
16789#	PGFPreHeader
16790#>>4	lelong	x	header size %d,
16791#	PGFHeader
16792>>8	lelong	x	%d x
16793>>12	lelong	x	%d,
16794>>16	byte	x	%d levels,
16795>>17	byte	x	compression level %d,
16796>>18	byte	x	%d bpp,
16797>>19	byte	x	%d channels,
16798>>20	clear	x
16799>>20	byte	0	bitmap,
16800>>20	byte	1	gray scale,
16801>>20	byte	2	indexed color,
16802>>20	byte	3	RGB color,
16803>>20	byte	4	CYMK color,
16804>>20	byte	5	HSL color,
16805>>20	byte	6	HSB color,
16806>>20	byte	7	multi-channel,
16807>>20	byte	8	duo tone,
16808>>20	byte	9	LAB color,
16809>>20	byte	10	gray scale 16,
16810>>20	byte	11	RGB color 48,
16811>>20	byte	12	LAB color 48,
16812>>20	byte	13	CYMK color 64,
16813>>20	byte	14	deep multi-channel,
16814>>20	byte	15	duo tone 16,
16815>>20	byte	17	RGBA color,
16816>>20	byte	18	gray scale 32,
16817>>20	byte	19	RGB color 12,
16818>>20	byte	20	RGB color 16,
16819>>20	byte	255	unknown format,
16820>>20	default	x	format
16821>>>20	byte	x	\b %d,
16822>>21	byte	x	%d bpc
16823#	PGFPostHeader
16824#	Level-Sizes
16825#>>(4.l+4)	lelong x level 0 size: %d
16826#>>(4.l+8)	lelong x level 1 size: %d
16827#>>(4.l+12)	lelong x level 2 size: %d
16828
16829#------------------------------------------------------------------------------
16830# $File: pgp,v 1.10 2014/10/14 16:50:37 christos Exp $
16831# pgp:  file(1) magic for Pretty Good Privacy
16832# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
16833#
168340       beshort         0x9900                  PGP key public ring
16835!:mime	application/x-pgp-keyring
168360       beshort         0x9501                  PGP key security ring
16837!:mime	application/x-pgp-keyring
168380       beshort         0x9500                  PGP key security ring
16839!:mime	application/x-pgp-keyring
168400	beshort		0xa600			PGP encrypted data
16841#!:mime	application/pgp-encrypted
16842#0	string		-----BEGIN\040PGP	text/PGP armored data
16843!:mime	text/PGP # encoding: armored data
16844#>15	string	PUBLIC\040KEY\040BLOCK-	public key block
16845#>15	string	MESSAGE-		message
16846#>15	string	SIGNED\040MESSAGE-	signed message
16847#>15	string	PGP\040SIGNATURE-	signature
16848
168492	string	---BEGIN\ PGP\ PUBLIC\ KEY\ BLOCK-	PGP public key block
16850!:mime	application/pgp-keys
16851>10	search/100	\n\n
16852>>&0	use		pgp
168530	string	-----BEGIN\040PGP\40MESSAGE-		PGP message
16854!:mime	application/pgp
16855>10	search/100	\n\n
16856>>&0	use		pgp
168570	string	-----BEGIN\040PGP\40SIGNATURE-		PGP signature
16858!:mime	application/pgp-signature
16859>10	search/100	\n\n
16860>>&0	use		pgp
16861
16862# Decode the type of the packet based on it's base64 encoding.
16863# Idea from Mark Martinec
16864# The specification is in RFC 4880, section 4.2 and 4.3:
16865# http://tools.ietf.org/html/rfc4880#section-4.2
16866
168670	name		pgp
16868>0	byte		0x67		Reserved (old)
16869>0	byte		0x68		Public-Key Encrypted Session Key (old)
16870>0	byte		0x69		Signature (old)
16871>0	byte		0x6a		Symmetric-Key Encrypted Session Key (old)
16872>0	byte		0x6b		One-Pass Signature (old)
16873>0	byte		0x6c		Secret-Key (old)
16874>0	byte		0x6d		Public-Key (old)
16875>0	byte		0x6e		Secret-Subkey (old)
16876>0	byte		0x6f		Compressed Data (old)
16877>0	byte		0x70		Symmetrically Encrypted Data (old)
16878>0	byte		0x71		Marker (old)
16879>0	byte		0x72		Literal Data (old)
16880>0	byte		0x73		Trust (old)
16881>0	byte		0x74		User ID (old)
16882>0	byte		0x75		Public-Subkey (old)
16883>0	byte		0x76		Unused (old)
16884>0	byte		0x77
16885>>1	byte&0xc0	0x00		Reserved
16886>>1	byte&0xc0	0x40		Public-Key Encrypted Session Key
16887>>1	byte&0xc0	0x80		Signature
16888>>1	byte&0xc0	0xc0		Symmetric-Key Encrypted Session Key
16889>0	byte		0x78
16890>>1	byte&0xc0	0x00		One-Pass Signature
16891>>1	byte&0xc0	0x40		Secret-Key
16892>>1	byte&0xc0	0x80		Public-Key
16893>>1	byte&0xc0	0xc0		Secret-Subkey
16894>0	byte		0x79
16895>>1	byte&0xc0	0x00		Compressed Data
16896>>1	byte&0xc0	0x40		Symmetrically Encrypted Data
16897>>1	byte&0xc0	0x80		Marker
16898>>1	byte&0xc0	0xc0		Literal Data
16899>0	byte		0x7a
16900>>1	byte&0xc0	0x00		Trust
16901>>1	byte&0xc0	0x40		User ID
16902>>1	byte&0xc0	0x80		Public-Subkey
16903>>1	byte&0xc0	0xc0		Unused [z%x]
16904>0	byte		0x30
16905>>1	byte&0xc0	0x00		Unused [0%x]
16906>>1	byte&0xc0	0x40		User Attribute
16907>>1	byte&0xc0	0x80		Sym. Encrypted and Integrity Protected Data
16908>>1	byte&0xc0	0xc0		Modification Detection Code
16909
16910# magic signatures to detect PGP crypto material (from stef)
16911# detects and extracts metadata from:
16912#  - symmetric encrypted packet header
16913#  - RSA (e=65537) secret (sub-)keys
16914
16915# 1024b RSA encrypted data
16916
169170	string	\x84\x8c\x03		PGP RSA encrypted session key -
16918>3	lelong	x			keyid: %X
16919>7	lelong	x			%X
16920>11	byte	0x01			RSA (Encrypt or Sign) 1024b
16921>11	byte	0x02			RSA Encrypt-Only 1024b
16922>12	string	\x04\x00
16923>12	string	\x03\xff
16924>12	string	\x03\xfe
16925>12	string	\x03\xfd
16926>12	string	\x03\xfc
16927>12	string	\x03\xfb
16928>12	string	\x03\xfa
16929>12	string	\x03\xf9
16930>142	byte	0xd2			.
16931
16932# 2048b RSA encrypted data
16933
169340	string	\x85\x01\x0c\x03	PGP RSA encrypted session key -
16935>4	lelong	x			keyid: %X
16936>8	lelong	x			%X
16937>12	byte	0x01			RSA (Encrypt or Sign) 2048b
16938>12	byte	0x02			RSA Encrypt-Only 2048b
16939>13	string	\x08\x00
16940>13	string	\x07\xff
16941>13	string	\x07\xfe
16942>13	string	\x07\xfd
16943>13	string	\x07\xfc
16944>13	string	\x07\xfb
16945>13	string	\x07\xfa
16946>13	string	\x07\xf9
16947>271	byte	0xd2			.
16948
16949# 3072b RSA encrypted data
16950
169510	string	\x85\x01\x8c\x03	PGP RSA encrypted session key -
16952>4	lelong	x			keyid: %X
16953>8	lelong	x			%X
16954>12	byte	0x01			RSA (Encrypt or Sign) 3072b
16955>12	byte	0x02			RSA Encrypt-Only 3072b
16956>13	string	\x0c\x00
16957>13	string	\x0b\xff
16958>13	string	\x0b\xfe
16959>13	string	\x0b\xfd
16960>13	string	\x0b\xfc
16961>13	string	\x0b\xfb
16962>13	string	\x0b\xfa
16963>13	string	\x0b\xf9
16964>399	byte	0xd2			.
16965
16966# 3072b RSA encrypted data
16967
169680	string	\x85\x02\x0c\x03	PGP RSA encrypted session key -
16969>4	lelong	x			keyid: %X
16970>8	lelong	x			%X
16971>12	byte	0x01			RSA (Encrypt or Sign) 4096b
16972>12	byte	0x02			RSA Encrypt-Only 4096b
16973>13	string	\x10\x00
16974>13	string	\x0f\xff
16975>13	string	\x0f\xfe
16976>13	string	\x0f\xfd
16977>13	string	\x0f\xfc
16978>13	string	\x0f\xfb
16979>13	string	\x0f\xfa
16980>13	string	\x0f\xf9
16981>527	byte	0xd2			.
16982
16983# 4096b RSA encrypted data
16984
169850	string	\x85\x04\x0c\x03	PGP RSA encrypted session key -
16986>4	lelong	x			keyid: %X
16987>8	lelong	x			%X
16988>12	byte	0x01			RSA (Encrypt or Sign) 8129b
16989>12	byte	0x02			RSA Encrypt-Only 8129b
16990>13	string	\x20\x00
16991>13	string	\x1f\xff
16992>13	string	\x1f\xfe
16993>13	string	\x1f\xfd
16994>13	string	\x1f\xfc
16995>13	string	\x1f\xfb
16996>13	string	\x1f\xfa
16997>13	string	\x1f\xf9
16998>1039	byte	0xd2			.
16999
17000# crypto algo mapper
17001
170020	name	crypto
17003>0	byte	0x00			Plaintext or unencrypted data
17004>0	byte	0x01			IDEA
17005>0	byte	0x02			TripleDES
17006>0	byte	0x03			CAST5 (128 bit key)
17007>0	byte	0x04			Blowfish (128 bit key, 16 rounds)
17008>0	byte	0x07			AES with 128-bit key
17009>0	byte	0x08			AES with 192-bit key
17010>0	byte	0x09			AES with 256-bit key
17011>0	byte	0x0a			Twofish with 256-bit key
17012
17013# hash algo mapper
17014
170150	name	hash
17016>0	byte	0x01			MD5
17017>0	byte	0x02			SHA-1
17018>0	byte	0x03			RIPE-MD/160
17019>0	byte	0x08			SHA256
17020>0	byte	0x09			SHA384
17021>0	byte	0x0a			SHA512
17022>0	byte	0x0b			SHA224
17023
17024# pgp symmetric encrypted data
17025
170260	byte	0x8c			PGP symmetric key encrypted data -
17027>1	byte	0x0d
17028>1	byte	0x0c
17029>2	byte	0x04
17030>3	use	crypto
17031>4	byte	0x01			salted -
17032>>5	use	hash
17033>>14	byte	0xd2			.
17034>>14	byte	0xc9			.
17035>4	byte	0x03			salted & iterated -
17036>>5	use	hash
17037>>15	byte	0xd2			.
17038>>15	byte	0xc9			.
17039
17040# encrypted keymaterial needs s2k & can be checksummed/hashed
17041
170420	name	chkcrypto
17043>0	use	crypto
17044>1	byte	0x00			Simple S2K
17045>1	byte	0x01			Salted S2K
17046>1	byte	0x03			Salted&Iterated S2K
17047>2	use	hash
17048
17049# all PGP keys start with this prolog
17050# containing version, creation date, and purpose
17051
170520	name	keyprolog
17053>0	byte	0x04
17054>1	beldate	x			created on %s -
17055>5	byte	0x01			RSA (Encrypt or Sign)
17056>5	byte	0x02			RSA Encrypt-Only
17057
17058# end of secret keys known signature
17059# contains e=65537 and the prolog to
17060# the encrypted parameters
17061
170620	name	keyend
17063>0	string	\x00\x11\x01\x00\x01	e=65537
17064>5	use	crypto
17065>5	byte	0xff			checksummed
17066>>6	use	chkcrypto
17067>5	byte	0xfe			hashed
17068>>6	use	chkcrypto
17069
17070# PGP secret keys contain also the public parts
17071# these vary by bitsize of the key
17072
170730	name	x1024
17074>0	use	keyprolog
17075>6	string	\x03\xfe
17076>6	string	\x03\xff
17077>6	string	\x04\x00
17078>136	use	keyend
17079
170800	name	x2048
17081>0	use	keyprolog
17082>6	string	\x80\x00
17083>6	string	\x07\xfe
17084>6	string	\x07\xff
17085>264	use	keyend
17086
170870	name	x3072
17088>0	use	keyprolog
17089>6	string	\x0b\xfe
17090>6	string	\x0b\xff
17091>6	string	\x0c\x00
17092>392	use	keyend
17093
170940	name	x4096
17095>0	use	keyprolog
17096>6	string	\x10\x00
17097>6	string	\x0f\xfe
17098>6	string	\x0f\xff
17099>520	use	keyend
17100
17101# \x00|\x1f[\xfe\xff]).{1024})'
171020	name	x8192
17103>0	use	keyprolog
17104>6	string	\x20\x00
17105>6	string	\x1f\xfe
17106>6	string	\x1f\xff
17107>1032	use	keyend
17108
17109# depending on the size of the pkt
17110# we branch into the proper key size
17111# signatures defined as x{keysize}
17112
17113>0	name	pgpkey
17114>0	string	\x01\xd8	1024b
17115>>2	use	x1024
17116>0	string	\x01\xeb	1024b
17117>>2	use	x1024
17118>0	string	\x01\xfb	1024b
17119>>2	use	x1024
17120>0	string	\x01\xfd	1024b
17121>>2	use	x1024
17122>0	string	\x01\xf3	1024b
17123>>2	use	x1024
17124>0	string	\x01\xee	1024b
17125>>2	use	x1024
17126>0	string	\x01\xfe	1024b
17127>>2	use	x1024
17128>0	string	\x01\xf4	1024b
17129>>2	use	x1024
17130>0	string	\x02\x0d	1024b
17131>>2	use	x1024
17132>0	string	\x02\x03	1024b
17133>>2	use	x1024
17134>0	string	\x02\x05	1024b
17135>>2	use	x1024
17136>0	string	\x02\x15	1024b
17137>>2	use	x1024
17138>0	string	\x02\x00	1024b
17139>>2	use	x1024
17140>0	string	\x02\x10	1024b
17141>>2	use	x1024
17142>0	string	\x02\x04	1024b
17143>>2	use	x1024
17144>0	string	\x02\x06	1024b
17145>>2	use	x1024
17146>0	string	\x02\x16	1024b
17147>>2	use	x1024
17148>0	string	\x03\x98	2048b
17149>>2	use	x2048
17150>0	string	\x03\xab	2048b
17151>>2	use	x2048
17152>0	string	\x03\xbb	2048b
17153>>2	use	x2048
17154>0	string	\x03\xbd	2048b
17155>>2	use	x2048
17156>0	string	\x03\xcd	2048b
17157>>2	use	x2048
17158>0	string	\x03\xb3	2048b
17159>>2	use	x2048
17160>0	string	\x03\xc3	2048b
17161>>2	use	x2048
17162>0	string	\x03\xc5	2048b
17163>>2	use	x2048
17164>0	string	\x03\xd5	2048b
17165>>2	use	x2048
17166>0	string	\x03\xae	2048b
17167>>2	use	x2048
17168>0	string	\x03\xbe	2048b
17169>>2	use	x2048
17170>0	string	\x03\xc0	2048b
17171>>2	use	x2048
17172>0	string	\x03\xd0	2048b
17173>>2	use	x2048
17174>0	string	\x03\xb4	2048b
17175>>2	use	x2048
17176>0	string	\x03\xc4	2048b
17177>>2	use	x2048
17178>0	string	\x03\xc6	2048b
17179>>2	use	x2048
17180>0	string	\x03\xd6	2048b
17181>>2	use	x2048
17182>0	string	\x05X		3072b
17183>>2	use	x3072
17184>0	string	\x05k		3072b
17185>>2	use	x3072
17186>0	string	\x05{		3072b
17187>>2	use	x3072
17188>0	string	\x05}		3072b
17189>>2	use	x3072
17190>0	string	\x05\x8d	3072b
17191>>2	use	x3072
17192>0	string	\x05s		3072b
17193>>2	use	x3072
17194>0	string	\x05\x83	3072b
17195>>2	use	x3072
17196>0	string	\x05\x85	3072b
17197>>2	use	x3072
17198>0	string	\x05\x95	3072b
17199>>2	use	x3072
17200>0	string	\x05n		3072b
17201>>2	use	x3072
17202>0	string	\x05\x7e	3072b
17203>>2	use	x3072
17204>0	string	\x05\x80	3072b
17205>>2	use	x3072
17206>0	string	\x05\x90	3072b
17207>>2	use	x3072
17208>0	string	\x05t		3072b
17209>>2	use	x3072
17210>0	string	\x05\x84	3072b
17211>>2	use	x3072
17212>0	string	\x05\x86	3072b
17213>>2	use	x3072
17214>0	string	\x05\x96	3072b
17215>>2	use	x3072
17216>0	string	\x07[		4096b
17217>>2	use	x4096
17218>0	string	\x07\x18	4096b
17219>>2	use	x4096
17220>0	string	\x07+		4096b
17221>>2	use	x4096
17222>0	string	\x07;		4096b
17223>>2	use	x4096
17224>0	string	\x07=		4096b
17225>>2	use	x4096
17226>0	string	\x07M		4096b
17227>>2	use	x4096
17228>0	string	\x073		4096b
17229>>2	use	x4096
17230>0	string	\x07C		4096b
17231>>2	use	x4096
17232>0	string	\x07E		4096b
17233>>2	use	x4096
17234>0	string	\x07U		4096b
17235>>2	use	x4096
17236>0	string	\x07.		4096b
17237>>2	use	x4096
17238>0	string	\x07>		4096b
17239>>2	use	x4096
17240>0	string	\x07@		4096b
17241>>2	use	x4096
17242>0	string	\x07P		4096b
17243>>2	use	x4096
17244>0	string	\x074		4096b
17245>>2	use	x4096
17246>0	string	\x07D		4096b
17247>>2	use	x4096
17248>0	string	\x07F		4096b
17249>>2	use	x4096
17250>0	string	\x07V		4096b
17251>>2	use	x4096
17252>0	string	\x0e[		8192b
17253>>2	use	x8192
17254>0	string	\x0e\x18	8192b
17255>>2	use	x8192
17256>0	string	\x0e+		8192b
17257>>2	use	x8192
17258>0	string	\x0e;		8192b
17259>>2	use	x8192
17260>0	string	\x0e=		8192b
17261>>2	use	x8192
17262>0	string	\x0eM		8192b
17263>>2	use	x8192
17264>0	string	\x0e3		8192b
17265>>2	use	x8192
17266>0	string	\x0eC		8192b
17267>>2	use	x8192
17268>0	string	\x0eE		8192b
17269>>2	use	x8192
17270>0	string	\x0eU		8192b
17271>>2	use	x8192
17272>0	string	\x0e.		8192b
17273>>2	use	x8192
17274>0	string	\x0e>		8192b
17275>>2	use	x8192
17276>0	string	\x0e@		8192b
17277>>2	use	x8192
17278>0	string	\x0eP		8192b
17279>>2	use	x8192
17280>0	string	\x0e4		8192b
17281>>2	use	x8192
17282>0	string	\x0eD		8192b
17283>>2	use	x8192
17284>0	string	\x0eF		8192b
17285>>2	use	x8192
17286>0	string	\x0eV		8192b
17287>>2	use	x8192
17288
17289# PGP RSA (e=65537) secret (sub-)key header
17290
172910	byte	0x95			PGP	Secret Key -
17292>1	use	pgpkey
172930	byte	0x97			PGP	Secret Sub-key -
17294>1	use	pgpkey
172950	byte	0x9d			PGP	Secret Sub-key -
17296>1	use	pgpkey
17297
17298#------------------------------------------------------------------------------
17299# $File$
17300# pkgadd:  file(1) magic for SysV R4 PKG Datastreams
17301#
173020       string          #\ PaCkAgE\ DaTaStReAm  pkg Datastream (SVR4)
17303!:mime	application/x-svr4-package
17304
17305#------------------------------------------------------------------------------
17306# $File$
17307# plan9:  file(1) magic for AT&T Bell Labs' Plan 9 executables
17308# From: "Stefan A. Haubenthal" <polluks@web.de>
17309#
173100	belong		0x00000107	Plan 9 executable, Motorola 68k
173110	belong		0x000001EB	Plan 9 executable, Intel 386
173120	belong		0x00000247	Plan 9 executable, Intel 960
173130	belong		0x000002AB	Plan 9 executable, SPARC
173140	belong		0x00000407	Plan 9 executable, MIPS R3000
173150	belong		0x0000048B	Plan 9 executable, AT&T DSP 3210
173160	belong		0x00000517	Plan 9 executable, MIPS R4000 BE
173170	belong		0x000005AB	Plan 9 executable, AMD 29000
173180	belong		0x00000647	Plan 9 executable, ARM 7-something
173190	belong		0x000006EB	Plan 9 executable, PowerPC
173200	belong		0x00000797	Plan 9 executable, MIPS R4000 LE
173210	belong		0x0000084B	Plan 9 executable, DEC Alpha
17322
17323#------------------------------------------------------------------------------
17324# $File$
17325# plus5:  file(1) magic for Plus Five's UNIX MUMPS
17326#
17327# XXX - byte order?  Paging Hokey....
17328#
173290	short		0x259		mumps avl global
17330>2	byte		>0		(V%d)
17331>6	byte		>0		with %d byte name
17332>7	byte		>0		and %d byte data cells
173330	short		0x25a		mumps blt global
17334>2	byte		>0		(V%d)
17335>8	short		>0		- %d byte blocks
17336>15	byte		0x00		- P/D format
17337>15	byte		0x01		- P/K/D format
17338>15	byte		0x02		- K/D format
17339>15	byte		>0x02		- Bad Flags
17340
17341#------------------------------------------------------------------------------
17342# $File: printer,v 1.25 2011/05/20 23:31:46 christos Exp $
17343# printer:  file(1) magic for printer-formatted files
17344#
17345
17346# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
173470	string		%!		PostScript document text
17348!:mime	application/postscript
17349!:apple	ASPSTEXT
17350>2	string		PS-Adobe-	conforming
17351>>11	string		>\0		DSC level %.3s
17352>>>15	string		EPS		\b, type %s
17353>>>15	string		Query		\b, type %s
17354>>>15	string		ExitServer	\b, type %s
17355>>>15   search/1000		%%LanguageLevel:\
17356>>>>&0	string		>\0		\b, Level %s
17357# Some PCs have the annoying habit of adding a ^D as a document separator
173580	string		\004%!		PostScript document text
17359!:mime	application/postscript
17360!:apple	ASPSTEXT
17361>3	string		PS-Adobe-	conforming
17362>>12	string		>\0		DSC level %.3s
17363>>>16	string		EPS		\b, type %s
17364>>>16	string		Query		\b, type %s
17365>>>16	string		ExitServer	\b, type %s
17366>>>16   search/1000		%%LanguageLevel:\
17367>>>>&0	string		>\0		\b, Level %s
173680	string		\033%-12345X%!PS	PostScript document
17369
17370# DOS EPS Binary File Header
17371# From: Ed Sznyter <ews@Black.Market.NET>
173720       belong          0xC5D0D3C6      DOS EPS Binary File
17373>4      long            >0              Postscript starts at byte %d
17374>>8     long            >0              length %d
17375>>>12   long            >0              Metafile starts at byte %d
17376>>>>16  long            >0              length %d
17377>>>20   long            >0              TIFF starts at byte %d
17378>>>>24  long            >0              length %d
17379
17380# Summary: Adobe's PostScript Printer Description File
17381# Extension: .ppd
17382# Reference: http://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8
17383# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr>
17384#
173850	string		*PPD-Adobe:\x20	PPD file
17386>&0	string		x		\b, version %s
17387
17388# HP Printer Job Language
173890	string		\033%-12345X@PJL	HP Printer Job Language data
17390# HP Printer Job Language
17391# The header found on Win95 HP plot files is the "Silliest Thing possible"
17392# (TM)
17393# Every driver puts the language at some random position, with random case
17394# (LANGUAGE and Language)
17395# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
17396# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
17397#
173980	string		\033%-12345X@PJL	HP Printer Job Language data
17399>&0	string		>\0			%s
17400>>&0	string		>\0			%s
17401>>>&0	string		>\0			%s
17402>>>>&0	string		>\0			%s
17403#>15	string		\ ENTER\ LANGUAGE\ =
17404#>31	string		PostScript		PostScript
17405
17406# From: Stefan Thurner <thurners@nicsys.de>
174070	string		\033%-12345X@PJL
17408>&0	search/10000	%!			PJL encapsulated PostScript document text
17409
17410# Rick Richardson <rickrich@gmail.com>
17411
17412# For Fuji-Xerox Printers - HBPL stands for Host Based Printer Language
17413# For Oki Data Printers - HIPERC
17414# For Konica Minolta Printers - LAVAFLOW
17415# For Samsung Printers - QPDL
17416# For HP Printers - ZJS stands for Zenographics ZJStream
174170	string		\033%-12345X@PJL	HP Printer Job Language data
17418>0	search/10000	@PJL\ ENTER\ LANGUAGE=HBPL	- HBPL
17419>0	search/10000	@PJL\ ENTER\ LANGUAGE=HIPERC	- Oki Data HIPERC
17420>0	search/10000	@PJL\ ENTER\ LANGUAGE=LAVAFLOW	- Konica Minolta LAVAFLOW
17421>0	search/10000	@PJL\ ENTER\ LANGUAGE=QPDL	- Samsung QPDL
17422>0	search/10000	@PJL\ ENTER\ LANGUAGE\ =\ QPDL	- Samsung QPDL
17423>0	search/10000	@PJL\ ENTER\ LANGUAGE=ZJS	- HP ZJS
17424
17425
17426# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
174270	string		\033E\033	HP PCL printer data
17428>3	string		\&l0A		- default page size
17429>3	string		\&l1A		- US executive page size
17430>3	string		\&l2A		- US letter page size
17431>3	string		\&l3A		- US legal page size
17432>3	string		\&l26A		- A4 page size
17433>3	string		\&l80A		- Monarch envelope size
17434>3	string		\&l81A		- No. 10 envelope size
17435>3	string		\&l90A		- Intl. DL envelope size
17436>3	string		\&l91A		- Intl. C5 envelope size
17437>3	string		\&l100A		- Intl. B5 envelope size
17438>3	string		\&l-81A		- No. 10 envelope size (landscape)
17439>3	string		\&l-90A		- Intl. DL envelope size (landscape)
17440
17441# IMAGEN printer-ready files:
174420	string	@document(		Imagen printer
17443# this only works if "language xxx" is first item in Imagen header.
17444>10	string	language\ impress	(imPRESS data)
17445>10	string	language\ daisy		(daisywheel text)
17446>10	string	language\ diablo	(daisywheel text)
17447>10	string	language\ printer	(line printer emulation)
17448>10	string	language\ tektronix	(Tektronix 4014 emulation)
17449# Add any other languages that your Imagen uses - remember
17450# to keep the word `text' if the file is human-readable.
17451# [GRR 950115:  missing "postscript" or "ultrascript" (whatever it was called)]
17452#
17453# Now magic for IMAGEN font files...
174540	string		Rast		RST-format raster font data
17455>45	string		>0		face %s
17456# From Jukka Ukkonen
174570	string		\033[K\002\0\0\017\033(a\001\0\001\033(g	Canon Bubble Jet BJC formatted data
17458
17459# From <mike@flyn.org>
17460# These are the /etc/magic entries to decode data sent to an Epson printer.
174610       string          \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P        Epson Stylus Color 460 data
17462
17463
17464#------------------------------------------------------------------------------
17465# zenographics:  file(1) magic for Zenographics ZjStream printer data
17466# Rick Richardson <rickrich@gmail.com>
174670	string		JZJZ
17468>0x12	string		ZZ		Zenographics ZjStream printer data (big-endian)
174690	string		ZJZJ
17470>0x12	string		ZZ		Zenographics ZjStream printer data (little-endian)
17471
17472
17473#------------------------------------------------------------------------------
17474# Oak Technologies printer stream
17475# Rick Richardson <rickrich@gmail.com>
174760       string          OAK
17477>0x07	byte		0
17478>0x0b	byte		0	Oak Technologies printer stream
17479
17480# This would otherwise be recognized as PostScript - nick@debian.org
174810	string		%!VMF 		SunClock's Vector Map Format data
17482
17483#------------------------------------------------------------------------------
17484# HP LaserJet 1000 series downloadable firmware file
174850	string	\xbe\xefABCDEFGH	HP LaserJet 1000 series downloadable firmware
17486
17487# From: Paolo <oopla@users.sf.net>
17488# Epson ESC/Page, ESC/PageColor
174890	string	\x1b\x01@EJL	Epson ESC/Page language printer data
17490
17491#------------------------------------------------------------------------------
17492# $File$
17493# project:  file(1) magic for Project management
17494#
17495# Magic strings for ftnchek project files. Alexander Mai
174960	string	FTNCHEK_\ P	project file for ftnchek
17497>10	string	1		version 2.7
17498>10	string	2		version 2.8 to 2.10
17499>10	string	3		version 2.11 or later
17500
17501#------------------------------------------------------------------------------
17502# $File$
17503# psdbms:  file(1) magic for psdatabase
17504#
175050	belong&0xff00ffff	0x56000000	ps database
17506>1	string	>\0	version %s
17507>4	string	>\0	from kernel %s
17508
17509#------------------------------------------------------------------------------
17510# $File$
17511# pulsar:  file(1) magic for Pulsar POP3 daemon binary files
17512#
17513# http://pulsar.sourceforge.net
17514# mailto:rok.papez@lugos.si
17515#
17516
175170	belong	0x1ee7f11e	Pulsar POP3 daemon mailbox cache file.
17518>4	ubelong	x		Version: %d.
17519>8	ubelong	x		\b%d
17520
17521
17522#------------------------------------------------------------------------------
17523# $File: vax,v 1.7 2009/09/19 16:28:13 christos Exp $
17524# pwsafe: file(1) magic for passwordsafe file
17525#
17526# Password Safe
17527# http://passwordsafe.sourceforge.net/
17528# file format specs
17529# http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt
17530# V2 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt
17531# V1 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt
17532# V2 and V1 have no easy identifier that I can find
17533# .psafe3
175340	string	PWS3	Password Safe V3 database
17535
17536#------------------------------------------------------------------------------
17537# $File$
17538# pyramid:  file(1) magic for Pyramids
17539#
17540# XXX - byte order?
17541#
175420	long		0x50900107	Pyramid 90x family executable
175430	long		0x50900108	Pyramid 90x family pure executable
17544>16	long		>0		not stripped
175450	long		0x5090010b	Pyramid 90x family demand paged pure executable
17546>16	long		>0		not stripped
17547
17548#------------------------------------------------------------------------------
17549# $File: python,v 1.25 2014/05/06 16:08:32 christos Exp $
17550# python:  file(1) magic for python
17551#
17552# Outlook puts """ too for urgent messages
17553# From: David Necas <yeti@physics.muni.cz>
17554# often the module starts with a multiline string
175550	string/t	"""	Python script text executable
17556# MAGIC as specified in Python/import.c (1.5 to 2.7a0 and 3.1a0, assuming
17557# that Py_UnicodeFlag is off for Python 2)
17558# 20121  ( YEAR - 1995 ) + MONTH  + DAY (little endian followed by "\r\n"
175590	belong		0x994e0d0a	python 1.5/1.6 byte-compiled
175600	belong		0x87c60d0a	python 2.0 byte-compiled
175610	belong		0x2aeb0d0a	python 2.1 byte-compiled
175620	belong		0x2ded0d0a	python 2.2 byte-compiled
175630	belong		0x3bf20d0a	python 2.3 byte-compiled
175640	belong		0x6df20d0a	python 2.4 byte-compiled
175650	belong		0xb3f20d0a	python 2.5 byte-compiled
175660	belong		0xd1f20d0a	python 2.6 byte-compiled
175670	belong		0x03f30d0a	python 2.7 byte-compiled
175680	belong		0x3b0c0d0a	python 3.0 byte-compiled
175690	belong		0x4f0c0d0a	python 3.1 byte-compiled
175700	belong		0x6c0c0d0a	python 3.2 byte-compiled
175710	belong		0x9e0c0d0a	python 3.3 byte-compiled
175720	belong		0xee0c0d0a	python 3.4 byte-compiled
17573
175740	search/1/w	#!\ /usr/bin/python	Python script text executable
17575!:mime text/x-python
175760	search/1/w	#!\ /usr/local/bin/python	Python script text executable
17577!:mime text/x-python
175780	search/1	#!/usr/bin/env\ python	Python script text executable
17579!:mime text/x-python
175800	search/1	#!\ /usr/bin/env\ python	Python script text executable
17581!:mime text/x-python
17582
17583
17584# from module.submodule import func1, func2
175850	regex	\^from\\s+(\\w|\\.)+\\s+import.*$	Python script text executable
17586!:mime text/x-python
17587
17588# def __init__ (self, ...):
175890	search/4096	def\ __init__
17590>&0	search/64 self	Python script text executable
17591!:mime text/x-python
17592
17593# comments
17594#0	search/4096	'''
17595#>&0	regex	.*'''$	Python script text executable
17596#!:mime text/x-python
17597
17598#0	search/4096	"""
17599#>&0	regex	.*"""$	Python script text executable
17600#!:mime text/x-python
17601
17602# try:
17603# except: or finally:
17604# block
176050	search/4096	try:
17606>&0	regex	\^\\s*except.*:	Python script text executable
17607!:mime text/x-python
17608>&0	search/4096	finally:	Python script text executable
17609!:mime text/x-python
17610
17611# def name(args, args):
176120	regex	 \^(\ |\\t){0,50}def\ {1,50}[a-zA-Z]{1,100}
17613>&0	regex	\ {0,50}\\(([a-zA-Z]|,|\ ){1,255}\\):$ Python script text executable
17614!:mime text/x-python
17615
17616#------------------------------------------------------------------------------
17617# $File: qt,v 1.1 2014/12/12 16:48:39 christos Exp $
17618# qt:  file(1) magic for Qt
17619
17620# http://doc.qt.io/qt-5/resources.html
176210	string		\<!DOCTYPE\040RCC\>	Qt Resource Collection file
17622
17623# https://qt.gitorious.org/qt/qtbase/source/\
17624# 5367fa356233da4c0f28172a8f817791525f5457:\
17625# src/tools/rcc/rcc.cpp#L840
176260	string		qres\0\0		Qt Binary Resource file
176270	search/1024	The\040Resource\040Compiler\040for\040Qt	Qt C-code resource file
17628
17629# https://qt.gitorious.org/qt/qtbase/source/\
17630# 5367fa356233da4c0f28172a8f817791525f5457:\
17631# src/corelib/kernel/qtranslator.cpp#L62
176320	string		\x3c\xb8\x64\x18\xca\xef\x9c\x95
17633>8	string		\xcd\x21\x1c\xbf\x60\xa1\xbd\xdd	Qt Translation file
17634
17635#------------------------------------------------------------------------------
17636# $File: revision,v 1.8 2010/11/25 15:00:12 christos Exp $
17637# file(1) magic for revision control files
17638# From Hendrik Scholz <hendrik@scholz.net>
176390	string/t	/1\ :pserver:	cvs password text file
17640
17641# Conary changesets
17642# From: Jonathan Smith <smithj@rpath.com>
176430	belong	0xea3f81bb	Conary changeset data
17644
17645# Type: Git bundles (git-bundle)
17646# From: Josh Triplett <josh@freedesktop.org>
176470	string	#\ v2\ git\ bundle\n	Git bundle
17648
17649# Type: Git pack
17650# From: Adam Buchbinder <adam.buchbinder@gmail.com>
17651# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However,
17652# those have a little-endian offset immediately following the magic 'PACK',
17653# the first byte of which is never 0, while the first byte of the Git pack
17654# version, since it's a tiny number stored in big-endian format, is always 0.
176550	string	PACK\0		Git pack
17656>4	belong	>0		\b, version %d
17657>>8	belong	>0		\b, %d objects
17658
17659# Type: Git pack index
17660# From: Adam Buchbinder <adam.buchbinder@gmail.com>
176610	string	\377tOc		Git pack index
17662>4	belong	=2		\b, version 2
17663
17664# Type: Git index file
17665# From: Frederic Briare <fbriere@fbriere.net>
176660	string	DIRC		Git index
17667>4	belong	>0		\b, version %d
17668>>8	belong	>0		\b, %d entries
17669
17670# Type:	Mercurial bundles
17671# From:	Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
176720	string	HG10		Mercurial bundle,
17673>4	string	UN		uncompressed
17674>4	string	BZ		bzip2 compressed
17675
17676# Type:	Subversion (SVN) dumps
17677# From:	Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de>
176780	string	SVN-fs-dump-format-version:	Subversion dumpfile
17679>28	string	>\0				(version: %s)
17680
17681# Type:	Bazaar revision bundles and merge requests
17682# URL:	http://www.bazaar-vcs.org/
17683# From:	Jelmer Vernooij <jelmer@samba.org>
176840	string	#\ Bazaar\ revision\ bundle\ v Bazaar Bundle
176850	string	#\ Bazaar\ merge\ directive\ format Bazaar merge directive
17686
17687#------------------------------------------------------------------------------
17688# $File: riff,v 1.30 2014/09/23 17:02:12 christos Exp $
17689# riff:  file(1) magic for RIFF format
17690# See
17691#
17692#	http://www.seanet.com/users/matts/riffmci/riffmci.htm
17693#
17694
17695# audio format tag. Assume limits: max 1024 bit, 128 channels, 1 MHz
176960   name    riff-wave
17697>0	leshort		1		\b, Microsoft PCM
17698>>14	leshort		>0
17699>>>14	leshort		<1024	\b, %d bit
17700>0	leshort		2		\b, Microsoft ADPCM
17701>0	leshort		6		\b, ITU G.711 A-law
17702>0	leshort		7		\b, ITU G.711 mu-law
17703>0	leshort		8		\b, Microsoft DTS
17704>0	leshort		17		\b, IMA ADPCM
17705>0	leshort		20		\b, ITU G.723 ADPCM (Yamaha)
17706>0	leshort		49		\b, GSM 6.10
17707>0	leshort		64		\b, ITU G.721 ADPCM
17708>0	leshort		80		\b, MPEG
17709>0	leshort		85		\b, MPEG Layer 3
17710>0	leshort		0x2001		\b, DTS
17711>2	leshort		=1		\b, mono
17712>2	leshort		=2		\b, stereo
17713>2	leshort		>2
17714>>2	leshort		<128	\b, %d channels
17715>4	lelong		>0
17716>>4	lelong		<1000000	%d Hz
17717
17718# try to find "fmt "
177190   name    riff-walk
17720>0  string  fmt\x20
17721>>4 lelong  <0x80
17722>>>8 use    riff-wave
17723>0  string  LIST
17724>>&(4.l+4)  use riff-walk
17725>0  string  DISP
17726>>&(4.l+4)  use riff-walk
17727>0  string  bext
17728>>&(4.l+4)  use riff-walk
17729>0  string  Fake
17730>>&(4.l+4)  use riff-walk
17731>0  string  fact
17732>>&(4.l+4)  use riff-walk
17733>0  string  VP8
17734>>11		byte		0x9d
17735>>>12		byte		0x01
17736>>>>13		byte		0x2a	\b, VP8 encoding
17737>>>>>14		leshort&0x3fff	x	\b, %d
17738>>>>>16		leshort&0x3fff	x	\bx%d, Scaling:
17739>>>>>14		leshort&0xc000	0x0000	\b [none]
17740>>>>>14		leshort&0xc000	0x1000	\b [5/4]
17741>>>>>14		leshort&0xc000	0x2000	\b [5/3]
17742>>>>>14		leshort&0xc000	0x3000	\b [2]
17743>>>>>14		leshort&0xc000	0x0000	\bx[none]
17744>>>>>14		leshort&0xc000	0x1000	\bx[5/4]
17745>>>>>14		leshort&0xc000	0x2000	\bx[5/3]
17746>>>>>14		leshort&0xc000	0x3000	\bx[2]
17747>>>>>15		byte&0x80	=0x00	\b, YUV color
17748>>>>>15		byte&0x80	=0x80	\b, bad color specification
17749>>>>>15		byte&0x40	=0x40	\b, no clamping required
17750>>>>>15		byte&0x40	=0x00	\b, decoders should clamp
17751#>0  string  x		we got %s
17752#>>&(4.l+4)  use riff-walk
17753
17754# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi>
17755#
177560	string		RIFF		RIFF (little-endian) data
17757# RIFF Palette format
17758>8	string		PAL		\b, palette
17759>>16	leshort		x		\b, version %d
17760>>18	leshort		x		\b, %d entries
17761# RIFF Device Independent Bitmap format
17762>8	string		RDIB		\b, device-independent bitmap
17763>>16	string		BM
17764>>>30	leshort		12		\b, OS/2 1.x format
17765>>>>34	leshort		x		\b, %d x
17766>>>>36	leshort		x		%d
17767>>>30	leshort		64		\b, OS/2 2.x format
17768>>>>34	leshort		x		\b, %d x
17769>>>>36	leshort		x		%d
17770>>>30	leshort		40		\b, Windows 3.x format
17771>>>>34	lelong		x		\b, %d x
17772>>>>38	lelong		x		%d x
17773>>>>44	leshort		x		%d
17774# RIFF MIDI format
17775>8	string		RMID		\b, MIDI
17776# RIFF Multimedia Movie File format
17777>8	string		RMMP		\b, multimedia movie
17778# RIFF wrapper for MP3
17779>8	string		RMP3		\b, MPEG Layer 3 audio
17780# Microsoft WAVE format (*.wav)
17781>8	string		WAVE		\b, WAVE audio
17782!:mime	audio/x-wav
17783>>12    string  >\0
17784>>>12   use     riff-walk
17785# Corel Draw Picture
17786>8	string		CDRA		\b, Corel Draw Picture
17787!:mime	image/x-coreldraw
17788>8	string		CDR6		\b, Corel Draw Picture, version 6
17789!:mime	image/x-coreldraw
17790>8	string		NUNDROOT	\b, Steinberg CuBase
17791# AVI == Audio Video Interleave
17792>8	string		AVI\040		\b, AVI
17793!:mime	video/x-msvideo
17794>>12    string          LIST
17795>>>20   string          hdrlavih
17796>>>>&36 lelong          x               \b, %u x
17797>>>>&40 lelong          x               %u,
17798>>>>&4  lelong          >1000000        <1 fps,
17799>>>>&4  lelong          1000000         1.00 fps,
17800>>>>&4  lelong          500000          2.00 fps,
17801>>>>&4  lelong          333333          3.00 fps,
17802>>>>&4  lelong          250000          4.00 fps,
17803>>>>&4  lelong          200000          5.00 fps,
17804>>>>&4  lelong          166667          6.00 fps,
17805>>>>&4  lelong          142857          7.00 fps,
17806>>>>&4  lelong          125000          8.00 fps,
17807>>>>&4  lelong          111111          9.00 fps,
17808>>>>&4  lelong          100000          10.00 fps,
17809# ]9.9,10.1[
17810>>>>&4  lelong          <101010
17811>>>>>&-4        lelong  >99010
17812>>>>>>&-4       lelong  !100000         ~10 fps,
17813>>>>&4  lelong          83333           12.00 fps,
17814# ]11.9,12.1[
17815>>>>&4  lelong          <84034
17816>>>>>&-4        lelong  >82645
17817>>>>>>&-4       lelong  !83333          ~12 fps,
17818>>>>&4  lelong          66667           15.00 fps,
17819# ]14.9,15.1[
17820>>>>&4  lelong          <67114
17821>>>>>&-4        lelong  >66225
17822>>>>>>&-4       lelong  !66667          ~15 fps,
17823>>>>&4  lelong          50000           20.00 fps,
17824>>>>&4  lelong          41708           23.98 fps,
17825>>>>&4  lelong          41667           24.00 fps,
17826# ]23.9,24.1[
17827>>>>&4  lelong          <41841
17828>>>>>&-4        lelong  >41494
17829>>>>>>&-4       lelong  !41708
17830>>>>>>>&-4      lelong  !41667          ~24 fps,
17831>>>>&4  lelong          40000           25.00 fps,
17832# ]24.9,25.1[
17833>>>>&4  lelong          <40161
17834>>>>>&-4        lelong  >39841
17835>>>>>>&-4       lelong  !40000          ~25 fps,
17836>>>>&4  lelong          33367           29.97 fps,
17837>>>>&4  lelong          33333           30.00 fps,
17838# ]29.9,30.1[
17839>>>>&4  lelong          <33445
17840>>>>>&-4        lelong  >33223
17841>>>>>>&-4       lelong  !33367
17842>>>>>>>&-4      lelong  !33333          ~30 fps,
17843>>>>&4  lelong          <32224          >30 fps,
17844##>>>>&4  lelong          x               (%lu)
17845##>>>>&20 lelong          x               %lu frames,
17846# Note: The tests below assume that the AVI has 1 or 2 streams,
17847#       "vids" optionally followed by "auds".
17848#       (Should cover 99.9% of all AVIs.)
17849# assuming avih length = 56
17850>>>88   string  LIST
17851>>>>96  string  strlstrh
17852>>>>>108        string  vids    video:
17853>>>>>>&0        lelong  0               uncompressed
17854# skip past vids strh
17855>>>>>>(104.l+108)       string  strf
17856>>>>>>>(104.l+132)      lelong          1       RLE 8bpp
17857>>>>>>>(104.l+132)      string/c        cvid    Cinepak
17858>>>>>>>(104.l+132)      string/c        i263    Intel I.263
17859>>>>>>>(104.l+132)      string/c        iv32    Indeo 3.2
17860>>>>>>>(104.l+132)      string/c        iv41    Indeo 4.1
17861>>>>>>>(104.l+132)      string/c        iv50    Indeo 5.0
17862>>>>>>>(104.l+132)      string/c        mp42    Microsoft MPEG-4 v2
17863>>>>>>>(104.l+132)      string/c        mp43    Microsoft MPEG-4 v3
17864>>>>>>>(104.l+132)      string/c        fmp4    FFMpeg MPEG-4
17865>>>>>>>(104.l+132)      string/c        mjpg    Motion JPEG
17866>>>>>>>(104.l+132)      string/c        div3    DivX 3
17867>>>>>>>>112             string/c        div3    Low-Motion
17868>>>>>>>>112             string/c        div4    Fast-Motion
17869>>>>>>>(104.l+132)      string/c        divx    DivX 4
17870>>>>>>>(104.l+132)      string/c        dx50    DivX 5
17871>>>>>>>(104.l+132)      string/c        xvid    XviD
17872>>>>>>>(104.l+132)	string/c	h264	H.264
17873>>>>>>>(104.l+132)      string/c        wmv3    Windows Media Video 9
17874>>>>>>>(104.l+132)      string/c        h264    X.264 or H.264
17875>>>>>>>(104.l+132)      lelong  0
17876##>>>>>>>(104.l+132)      string  x       (%.4s)
17877# skip past first (video) LIST
17878>>>>(92.l+96)   string  LIST
17879>>>>>(92.l+104) string  strlstrh
17880>>>>>>(92.l+116)        string          auds    \b, audio:
17881# auds strh length = 56:
17882>>>>>>>(92.l+172)       string          strf
17883>>>>>>>>(92.l+180)      leshort 0x0001  uncompressed PCM
17884>>>>>>>>(92.l+180)      leshort 0x0002  ADPCM
17885>>>>>>>>(92.l+180)      leshort 0x0006  aLaw
17886>>>>>>>>(92.l+180)      leshort 0x0007  uLaw
17887>>>>>>>>(92.l+180)      leshort 0x0050  MPEG-1 Layer 1 or 2
17888>>>>>>>>(92.l+180)      leshort 0x0055  MPEG-1 Layer 3
17889>>>>>>>>(92.l+180)      leshort 0x2000  Dolby AC3
17890>>>>>>>>(92.l+180)      leshort 0x0161  DivX
17891##>>>>>>>>(92.l+180)      leshort x       (0x%.4x)
17892>>>>>>>>(92.l+182)      leshort 1       (mono,
17893>>>>>>>>(92.l+182)      leshort 2       (stereo,
17894>>>>>>>>(92.l+182)      leshort >2      (%d channels,
17895>>>>>>>>(92.l+184)      lelong  x       %d Hz)
17896# auds strh length = 64:
17897>>>>>>>(92.l+180)       string          strf
17898>>>>>>>>(92.l+188)      leshort 0x0001  uncompressed PCM
17899>>>>>>>>(92.l+188)      leshort 0x0002  ADPCM
17900>>>>>>>>(92.l+188)      leshort 0x0055  MPEG-1 Layer 3
17901>>>>>>>>(92.l+188)      leshort 0x2000  Dolby AC3
17902>>>>>>>>(92.l+188)      leshort 0x0161  DivX
17903##>>>>>>>>(92.l+188)      leshort x       (0x%.4x)
17904>>>>>>>>(92.l+190)      leshort 1       (mono,
17905>>>>>>>>(92.l+190)      leshort 2       (stereo,
17906>>>>>>>>(92.l+190)      leshort >2      (%d channels,
17907>>>>>>>>(92.l+192)      lelong  x       %d Hz)
17908# Animated Cursor format
17909>8	string		ACON		\b, animated cursor
17910# SoundFont 2 <mpruett@sgi.com>
17911>8	string		sfbk		SoundFont/Bank
17912# MPEG-1 wrapped in a RIFF, apparently
17913>8      string          CDXA            \b, wrapped MPEG-1 (CDXA)
17914>8	string		4XMV		\b, 4X Movie file
17915# AMV-type AVI file: http://wiki.multimedia.cx/index.php?title=AMV
17916>8	string		AMV\040		\b, AMV
17917>8      string          WEBP            \b, Web/P image
17918!:mime	image/webp
17919>>12	use		riff-walk
17920
17921#
17922# XXX - some of the below may only appear in little-endian form.
17923#
17924# Also "MV93" appears to be for one form of Macromedia Director
17925# files, and "GDMF" appears to be another multimedia format.
17926#
179270	string		RIFX		RIFF (big-endian) data
17928# RIFF Palette format
17929>8	string		PAL		\b, palette
17930>>16	beshort		x		\b, version %d
17931>>18	beshort		x		\b, %d entries
17932# RIFF Device Independent Bitmap format
17933>8	string		RDIB		\b, device-independent bitmap
17934>>16	string		BM
17935>>>30	beshort		12		\b, OS/2 1.x format
17936>>>>34	beshort		x		\b, %d x
17937>>>>36	beshort		x		%d
17938>>>30	beshort		64		\b, OS/2 2.x format
17939>>>>34	beshort		x		\b, %d x
17940>>>>36	beshort		x		%d
17941>>>30	beshort		40		\b, Windows 3.x format
17942>>>>34	belong		x		\b, %d x
17943>>>>38	belong		x		%d x
17944>>>>44	beshort		x		%d
17945# RIFF MIDI format
17946>8	string		RMID		\b, MIDI
17947# RIFF Multimedia Movie File format
17948>8	string		RMMP		\b, multimedia movie
17949# Microsoft WAVE format (*.wav)
17950>8	string		WAVE		\b, WAVE audio
17951>>20	leshort		1		\b, Microsoft PCM
17952>>>34	leshort		>0		\b, %d bit
17953>>22	beshort		=1		\b, mono
17954>>22	beshort		=2		\b, stereo
17955>>22	beshort		>2		\b, %d channels
17956>>24	belong		>0		%d Hz
17957# Corel Draw Picture
17958>8	string		CDRA		\b, Corel Draw Picture
17959>8	string		CDR6		\b, Corel Draw Picture, version 6
17960# AVI == Audio Video Interleave
17961>8	string		AVI\040		\b, AVI
17962# Animated Cursor format
17963>8	string		ACON		\b, animated cursor
17964# Notation Interchange File Format (big-endian only)
17965>8	string		NIFF		\b, Notation Interchange File Format
17966# SoundFont 2 <mpruett@sgi.com>
17967>8	string		sfbk		SoundFont/Bank
17968
17969#------------------------------------------------------------------------------
17970# Sony Wave64
17971# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf
17972# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian
179730	string	riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00		Sony Wave64 RIFF data
17974# 128 bit + total file size (64 bits) so 24 bytes
17975# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A }
17976>24	string		wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A		\b, WAVE 64 audio
17977!:mime	audio/x-w64
17978# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A }
17979>>40	search/256	fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A		\b
17980>>>&10	leshort		=1		\b, mono
17981>>>&10	leshort		=2		\b, stereo
17982>>>&10	leshort		>2		\b, %d channels
17983>>>&12	lelong		>0		%d Hz
17984
17985#------------------------------------------------------------------------------
17986# MBWF/RF64
17987# see EBU TECH 3306 http://tech.ebu.ch/docs/tech/tech3306-2009.pdf
179880	string	RF64\xff\xff\xff\xffWAVEds64		MBWF/RF64 audio
17989!:mime	audio/x-wav
17990>40	search/256	fmt\x20		\b
17991>>&6	leshort		=1		\b, mono
17992>>&6	leshort		=2		\b, stereo
17993>>&6	leshort		>2		\b, %d channels
17994>>&8	lelong		>0		%d Hz
17995
17996#------------------------------------------------------------------------------
17997# $File: rinex,v 1.3 2011/04/04 21:12:03 christos Exp $
17998# rinex:  file(1) magic for RINEX files
17999# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
18000# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf
18001# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data
1800260	string		RINEX
18003>80	search/256	XXRINEXB	RINEX Data, GEO SBAS Broadcast
18004>>&32	string		x		\b, date %15.15s
18005>>5	string		x		\b, version %6.6s
18006!:mime	rinex/broadcast
18007>80	search/256	XXRINEXD	RINEX Data, Observation (Hatanaka comp)
18008>>&32	string		x		\b, date %15.15s
18009>>5	string		x		\b, version %6.6s
18010!:mime	rinex/observation
18011>80	search/256	XXRINEXC	RINEX Data, Clock
18012>>&32	string		x		\b, date %15.15s
18013>>5	string		x		\b, version %6.6s
18014!:mime	rinex/clock
18015>80	search/256	XXRINEXH	RINEX Data, GEO SBAS Navigation
18016>>&32	string		x		\b, date %15.15s
18017>>5	string		x		\b, version %6.6s
18018!:mime	rinex/navigation
18019>80	search/256	XXRINEXG	RINEX Data, GLONASS Navigation
18020>>&32	string		x		\b, date %15.15s
18021>>5	string		x		\b, version %6.6s
18022!:mime	rinex/navigation
18023>80	search/256	XXRINEXL	RINEX Data, Galileo Navigation
18024>>&32	string		x		\b, date %15.15s
18025>>5	string		x		\b, version %6.6s
18026!:mime	rinex/navigation
18027>80	search/256	XXRINEXM	RINEX Data, Meteorological
18028>>&32	string		x		\b, date %15.15s
18029>>5	string		x		\b, version %6.6s
18030!:mime	rinex/meteorological
18031>80	search/256	XXRINEXN	RINEX Data, Navigation
18032>>&32	string		x		\b, date %15.15s
18033>>5	string		x		\b, version %6.6s
18034!:mime	rinex/navigation
18035>80	search/256	XXRINEXO	RINEX Data, Observation
18036>>&32	string		x		\b, date %15.15s
18037>>5	string		x		\b, version %6.6s
18038!:mime	rinex/observation
18039
18040#------------------------------------------------------------------------------
18041# $File: rpm,v 1.11 2011/06/14 12:47:41 christos Exp $
18042#
18043# RPM: file(1) magic for Red Hat Packages   Erik Troan (ewt@redhat.com)
18044#
180450	belong		0xedabeedb	RPM
18046!:mime	application/x-rpm
18047>4	byte		x		v%d
18048>5	byte		x		\b.%d
18049>6	beshort		1		src
18050>6	beshort		0		bin
18051>>8	beshort		1		i386/x86_64
18052>>8	beshort		2		Alpha/Sparc64
18053>>8	beshort		3		Sparc
18054>>8	beshort		4		MIPS
18055>>8	beshort		5		PowerPC
18056>>8	beshort		6		68000
18057>>8	beshort		7		SGI
18058>>8	beshort		8		RS6000
18059>>8	beshort		9		IA64
18060>>8	beshort		10		Sparc64
18061>>8	beshort		11		MIPSel
18062>>8	beshort		12		ARM
18063>>8	beshort		13		MiNT
18064>>8	beshort		14		S/390
18065>>8	beshort		15		S/390x
18066>>8	beshort		16		PowerPC64
18067>>8	beshort		17		SuperH
18068>>8	beshort		18		Xtensa
18069>>8	beshort		255		noarch
18070
18071#delta RPM    Daniel Novotny (dnovotny@redhat.com)
180720	string		drpm		Delta RPM
18073!:mime  application/x-rpm
18074>12	string 	x	%s
18075>>8	beshort		11		MIPSel
18076>>8	beshort		12		ARM
18077>>8	beshort		13		MiNT
18078>>8	beshort		14		S/390
18079>>8	beshort		15		S/390x
18080>>8	beshort		16		PowerPC64
18081>>8	beshort		17		SuperH
18082>>8	beshort		18		Xtensa
18083>>10	string		x		%s
18084
18085#------------------------------------------------------------------------------
18086# $File$
18087# rtf:	file(1) magic for Rich Text Format (RTF)
18088#
18089# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
18090#
180910	string		{\\rtf		Rich Text Format data,
18092!:mime	text/rtf
18093>5	string		1		version 1,
18094>>6	string		\\ansi		ANSI
18095>>6	string		\\mac		Apple Macintosh
18096>>6	string		\\pc		IBM PC, code page 437
18097>>6	string		\\pca		IBM PS/2, code page 850
18098>>6	default		x		unknown character set
18099>5	default		x		unknown version
18100
18101#------------------------------------------------------------------------------
18102# $File: ruby,v 1.4 2010/07/08 20:24:13 christos Exp $
18103# ruby:  file(1) magic for Ruby scripting language
18104# URL:  http://www.ruby-lang.org/
18105# From: Reuben Thomas <rrt@sc3d.org>
18106
18107# Ruby scripts
181080	search/1/w	#!\ /usr/bin/ruby	Ruby script text executable
18109!:mime text/x-ruby
181100	search/1/w	#!\ /usr/local/bin/ruby	Ruby script text executable
18111!:mime text/x-ruby
181120	search/1	#!/usr/bin/env\ ruby	Ruby script text executable
18113!:mime text/x-ruby
181140	search/1	#!\ /usr/bin/env\ ruby	Ruby script text executable
18115!:mime text/x-ruby
18116
18117# What looks like ruby, but does not have a shebang
18118# (modules and such)
18119# From: Lubomir Rintel <lkundrak@v3.sk>
181200	regex		\^[\ \t]*require[\ \t]'[A-Za-z_/]+'
18121>0	regex		include\ [A-Z]|def\ [a-z]|\ do$
18122>>0	regex		\^[\ \t]*end([\ \t]*[;#].*)?$		Ruby script text
18123!:mime	text/x-ruby
181240	regex		\^[\ \t]*(class|module)[\ \t][A-Z]
18125>0	regex		(modul|includ)e\ [A-Z]|def\ [a-z]
18126>>0	regex		\^[\ \t]*end([\ \t]*[;#].*)?$		Ruby module source text
18127!:mime	text/x-ruby
18128
18129#------------------------------------------------------------------------------
18130# $File$
18131# sc:  file(1) magic for "sc" spreadsheet
18132#
1813338	string		Spreadsheet	sc spreadsheet file
18134!:mime	application/x-sc
18135
18136#------------------------------------------------------------------------------
18137# $File$
18138# sccs:  file(1) magic for SCCS archives
18139#
18140# SCCS archive structure:
18141# \001h01207
18142# \001s 00276/00000/00000
18143# \001d D 1.1 87/09/23 08:09:20 ian 1 0
18144# \001c date and time created 87/09/23 08:09:20 by ian
18145# \001e
18146# \001u
18147# \001U
18148# ... etc.
18149# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
18150# *Sigh*. And these both came from various parts of the USG.
18151# Maybe we should just switch everybody from SCCS to RCS!
18152# Further, you can't just say '\001h0', because the five-digit number
18153# is a checksum that could (presumably) have any leading digit,
18154# and we don't have regular expression matching yet.
18155# Hence the following official kludge:
181568	string		\001s\ 			SCCS archive data
18157
18158#------------------------------------------------------------------------------
18159# $File: scientific,v 1.8 2014/01/06 17:46:23 rrt Exp $
18160# scientific:  file(1) magic for scientific formats
18161#
18162# From: Joe Krahn <krahn@niehs.nih.gov>
18163
18164########################################################
18165# CCP4 data and plot files:
181660	string		MTZ\040		MTZ reflection file
18167
1816892	string		PLOT%%84	Plot84 plotting file
18169>52	byte		1		, Little-endian
18170>55	byte		1		, Big-endian
18171
18172########################################################
18173# Electron density MAP/MASK formats
18174
181750	string		EZD_MAP	NEWEZD Electron Density Map
18176109	string		MAP\040(  Old EZD Electron Density Map
18177
181780	string/c	:-)\040Origin	BRIX Electron Density Map
18179>170	string		>0	, Sigma:%.12s
18180#>4	string		>0	%.178s
18181#>4	addr		x	%.178s
18182
181837	string		18\040!NTITLE	XPLOR ASCII Electron Density Map
181849	string		\040!NTITLE\012\040REMARK	CNS ASCII electron density map
18185
18186208	string		MAP\040	CCP4 Electron Density Map
18187# Assumes same stamp for float and double (normal case)
18188>212	byte		17	\b, Big-endian
18189>212	byte		34	\b, VAX format
18190>212	byte		68	\b, Little-endian
18191>212	byte		85	\b, Convex native
18192
18193############################################################
18194# X-Ray Area Detector images
181950	string	R-AXIS4\ \ \ 	R-Axis Area Detector Image:
18196>796	lelong	<20		Little-endian, IP #%d,
18197>>768	lelong	>0		Size=%dx
18198>>772	lelong	>0		\b%d
18199>796	belong	<20		Big-endian, IP #%d,
18200>>768	belong	>0		Size=%dx
18201>>772	belong	>0		\b%d
18202
182030	string	RAXIS\ \ \ \ \ 	R-Axis Area Detector Image, Win32:
18204>796	lelong	<20		Little-endian, IP #%d,
18205>>768	lelong	>0		Size=%dx
18206>>772	lelong	>0		\b%d
18207>796	belong	<20		Big-endian, IP #%d,
18208>>768	belong	>0		Size=%dx
18209>>772	belong	>0		\b%d
18210
18211
182121028	string	MMX\000\000\000\000\000\000\000\000\000\000\000\000\000	MAR Area Detector Image,
18213>1072	ulong	>1		Compressed(%d),
18214>1100	ulong	>1		%d headers,
18215>1104	ulong	>0		%d x
18216>1108	ulong	>0		%d,
18217>1120	ulong	>0		%d bits/pixel
18218
18219# Type: GEDCOM genealogical (family history) data
18220# From: Giuseppe Bilotta
182210       search/1/c	0\ HEAD         GEDCOM genealogy text
18222>&0     search		1\ GEDC
18223>>&0    search		2\ VERS         version
18224>>>&1   string		>\0		%s
18225# From: Phil Endecott <phil05@chezphil.org>
182260	string	\000\060\000\040\000\110\000\105\000\101\000\104		GEDCOM data
182270	string	\060\000\040\000\110\000\105\000\101\000\104\000		GEDCOM data
182280	string	\376\377\000\060\000\040\000\110\000\105\000\101\000\104	GEDCOM data
182290	string	\377\376\060\000\040\000\110\000\105\000\101\000\104\000	GEDCOM data
18230
18231# PDB: Protein Data Bank files
18232# Adam Buchbinder <adam.buchbinder@gmail.com>
18233#
18234# http://www.wwpdb.org/documentation/format32/sect2.html
18235# http://www.ch.ic.ac.uk/chemime/
18236#
18237# The PDB file format is fixed-field, 80 columns. From the spec:
18238#
18239# COLS        DATA
18240#  1 -  6      "HEADER"
18241#  11 - 50     String(40)
18242#  51 - 59     Date
18243#  63 - 66     IDcode
18244#
18245# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the
18246# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and
18247# uppercase letters. However, examples have been seen without the date string,
18248# e.g., the example on the chemime site.
182490	string	HEADER\ \ \ \
18250>&0	regex/1l	\^.{40}
18251>>&0	regex/1l	[0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3}
18252>>>&0	regex/1ls	[A-Z0-9]{4}.{14}$
18253>>>>&0	regex/1l	[A-Z0-9]{4}	Protein Data Bank data, ID Code %s
18254!:mime	chemical/x-pdb
18255>>>>0	regex/1l	[0-9]{2}-[A-Z]{3}-[0-9]{2}	\b, %s
18256
18257# Type:	GDSII Stream file
182580	belong	0x00060002	GDSII Stream file
18259>4	byte	0x00
18260>>5	byte	x		version %d.0
18261>4	byte	>0x00		version %d
18262>>5	byte	x		\b.%d
18263
18264#------------------------------------------------------------------------------
18265# $File$
182660	search/1		-----BEGIN\ CERTIFICATE------	RFC1421 Security Certificate text
182670	search/1		-----BEGIN\ NEW\ CERTIFICATE	RFC1421 Security Certificate Signing Request text
182680	belong	0xedfeedfe	Sun 'jks' Java Keystore File data
18269# Type:	SE Linux policy modules *.pp reference policy
18270#	for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny.
18271# URL:	http://doc.coker.com.au/computers/selinux-magic
18272# From:	Russell Coker <russell@coker.com.au>
18273
182740		lelong	0xf97cff8f	SE Linux modular policy
18275>4		lelong	x		version %d,
18276>8		lelong	x		%d sections,
18277>>(12.l)	lelong	0xf97cff8d
18278>>>(12.l+27)	lelong	x		mod version %d,
18279>>>(12.l+31)	lelong	0		Not MLS,
18280>>>(12.l+31)	lelong	1		MLS,
18281>>>(12.l+23)	lelong	2
18282>>>>(12.l+47)	string	>\0		module name %s
18283>>>(12.l+23)	lelong	1		base
18284
182851	string	policy_module(	SE Linux policy module source
182862	string	policy_module(	SE Linux policy module source
18287
182880	string	##\ <summary>	SE Linux policy interface source
18289
18290#0	search	gen_context(	SE Linux policy file contexts
18291
18292#0	search	gen_sens(	SE Linux policy MLS constraints source
18293
18294#------------------------------------------------------------------------------
18295# $File$
18296# sendmail:  file(1) magic for sendmail config files
18297#
18298# XXX - byte order?
18299#
183000	byte	046	  Sendmail frozen configuration
18301>16	string	>\0	  - version %s
183020	short	0x271c	  Sendmail frozen configuration
18303>16	string	>\0	  - version %s
18304
18305#------------------------------------------------------------------------------
18306# sendmail:  file(1) magic for sendmail m4(1) files
18307#
18308# From Hendrik Scholz <hendrik@scholz.net>
18309# i.e. files in /usr/share/sendmail/cf/
18310#
183110   string  divert(-1)\n    sendmail m4 text file
18312
18313
18314#------------------------------------------------------------------------------
18315# $File: sequent,v 1.11 2014/06/02 19:27:54 christos Exp $
18316# sequent:  file(1) magic for Sequent machines
18317#
18318# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
18319# For Sequent's multiprocessor systems (incomplete).
183200	lelong	0x00ea        	BALANCE NS32000 .o
18321>16	lelong	>0		not stripped
18322>124	lelong	>0		version %d
183230	lelong	0x10ea        	BALANCE NS32000 executable (0 @ 0)
18324>16	lelong  >0            	not stripped
18325>124	lelong	>0		version %d
183260	lelong	0x20ea        	BALANCE NS32000 executable (invalid @ 0)
18327>16	lelong  >0            	not stripped
18328>124	lelong	>0		version %d
183290	lelong	0x30ea        	BALANCE NS32000 standalone executable
18330>16	lelong  >0          	not stripped
18331>124	lelong	>0		version %d
18332#
18333# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
18334# Symmetry magic nums will not be reached if DOS COM comes before them;
18335# byte 0xeb is matched before these get a chance.
183360	leshort	0x12eb		SYMMETRY i386 .o
18337>16	lelong	>0		not stripped
18338>124	lelong	>0		version %d
183390	leshort	0x22eb		SYMMETRY i386 executable (0 @ 0)
18340>16	lelong	>0		not stripped
18341>124	lelong	>0		version %d
183420	leshort	0x32eb		SYMMETRY i386 executable (invalid @ 0)
18343>16	lelong	>0		not stripped
18344>124	lelong	>0		version %d
18345# http://en.wikipedia.org/wiki/Sequent_Computer_Systems
18346# below test line conflicts with MS-DOS 2.11 floppies and Acronis loader
18347#0	leshort	0x42eb		SYMMETRY i386 standalone executable
183480	leshort	0x42eb
18349# skip unlike negative version
18350>124	lelong	>-1
18351# assuming version 28867614 is very low probable
18352>>124	lelong	!28867614	SYMMETRY i386 standalone executable
18353>>>16	lelong	>0		not stripped
18354>>>124	lelong	>0		version %d
18355
18356#------------------------------------------------------------------------------
18357# $File: sereal,v 1.2 2014/11/11 20:10:49 christos Exp $
18358# sereal: file(1) magic the Sereal binary serialization format
18359#
18360# From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
18361#
18362# See the specification of the format at
18363# https://github.com/Sereal/Sereal/blob/master/sereal_spec.pod#document-header-format
18364#
18365# I'd have liked to do the byte&0xF0 matching against 0, 1, 2 ... by
18366# doing (byte&0xF0)>>4 here, but unfortunately that's not
18367# supported. So when we print out a message about an unknown format
18368# we'll print out e.g. 0x30 instead of the more human-readable
18369# 0x30>>4.
18370#
18371# See https://github.com/Sereal/Sereal/commit/35372ae01d in the
18372# Sereal.git repository for test Sereal data.
183730	name		sereal
18374>4	byte&0x0F	x		(version %d,
18375>4	byte&0xF0	0x00		uncompressed)
18376>4	byte&0xF0	0x10		compressed with non-incremental Snappy)
18377>4	byte&0xF0	0x20		compressed with incremental Snappy)
18378>4	byte&0xF0	>0x20		unknown subformat, flag: %d>>4)
18379
183800	string/b	\=srl		Sereal data packet
18381!:mime application/sereal
18382>&0	use		sereal
183830	string/b	\=\xF3rl	Sereal data packet
18384!:mime application/sereal
18385>&0	use		sereal
183860	string/b	\=\xC3\xB3rl	Sereal data packet, UTF-8 encoded
18387!:mime application/sereal
18388>&0	use		sereal
18389
18390
18391#------------------------------------------------------------------------------
18392# $File: sgi,v 1.20 2014/03/10 00:53:38 christos Exp $
18393# sgi:  file(1) magic for Silicon Graphics operating systems and applications
18394#
18395# Executable images are handled either in aout (for old-style a.out
18396# files for 68K; they are indistinguishable from other big-endian 32-bit
18397# a.out files) or in mips (for MIPS ECOFF and Ucode files)
18398#
18399
18400# kbd file definitions
184010	string	kbd!map		kbd map file
18402>8	byte	>0		Ver %d:
18403>10	short	>0		with %d table(s)
18404
184050	beshort	0x8765		disk quotas file
18406
184070	beshort	0x0506		IRIS Showcase file
18408>2	byte	0x49		-
18409>3	byte	x		- version %d
184100	beshort	0x0226		IRIS Showcase template
18411>2	byte	0x63		-
18412>3	byte	x		- version %d
184130	belong	0x5343464d	IRIS Showcase file
18414>4	byte	x		- version %d
184150	belong	0x5443464d	IRIS Showcase template
18416>4	byte	x		- version %d
184170	belong	0xdeadbabe	IRIX Parallel Arena
18418>8	belong	>0		- version %d
18419
18420# core files
18421#
18422# 32bit core file
184230	belong	0xdeadadb0	IRIX core dump
18424>4	belong	1		of
18425>16	string	>\0		'%s'
18426# 64bit core file
184270	belong	0xdeadad40	IRIX 64-bit core dump
18428>4	belong	1		of
18429>16	string	>\0		'%s'
18430# N32bit core file
184310       belong	0xbabec0bb	IRIX N32 core dump
18432>4      belong	1               of
18433>16     string	>\0             '%s'
18434# New style crash dump file
184350	string	\x43\x72\x73\x68\x44\x75\x6d\x70	IRIX vmcore dump of
18436>36	string	>\0					'%s'
18437
18438# Trusted IRIX info
184390	string	SGIAUDIT	SGI Audit file
18440>8	byte	x		- version %d
18441>9	byte	x		\b.%d
18442#
184430	string	WNGZWZSC	Wingz compiled script
184440	string	WNGZWZSS	Wingz spreadsheet
184450	string	WNGZWZHP	Wingz help file
18446#
184470	string	#Inventor V	IRIS Inventor 1.0 file
184480	string	#Inventor V2	Open Inventor 2.0 file
18449# GLF is OpenGL stream encoding
184500	string	glfHeadMagic();		GLF_TEXT
184514	belong	0x7d000000		GLF_BINARY_LSB_FIRST
18452!:strength -30
184534	belong	0x0000007d		GLF_BINARY_MSB_FIRST
18454!:strength -30
18455# GLS is OpenGL stream encoding; GLS is the successor of GLF
184560	string	glsBeginGLS(		GLS_TEXT
184574	belong	0x10000000		GLS_BINARY_LSB_FIRST
18458!:strength -30
184594	belong	0x00000010		GLS_BINARY_MSB_FIRST
18460!:strength -30
18461
18462#
18463#
18464# Performance Co-Pilot file types
184650	string	PmNs				PCP compiled namespace (V.0)
184660	string	PmN				PCP compiled namespace
18467>3	string	>\0				(V.%1.1s)
18468#3	lelong	0x84500526			PCP archive
184693	belong	0x84500526			PCP archive
18470>7	byte	x				(V.%d)
18471#>20	lelong	-2				temporal index
18472#>20	lelong	-1				metadata
18473#>20	lelong	0				log volume #0
18474#>20	lelong	>0				log volume #%d
18475>20	belong	-2				temporal index
18476>20	belong	-1				metadata
18477>20	belong	0				log volume #0
18478>20	belong	>0				log volume #%d
18479>24	string	>\0				host: %s
184800	string	PCPFolio			PCP
18481>9	string	Version:			Archive Folio
18482>18	string	>\0				(V.%s)
184830	string	#pmchart			PCP pmchart view
18484>9	string	Version
18485>17	string	>\0				(V%-3.3s)
184860	string	#kmchart			PCP kmchart view
18487>9	string	Version
18488>17	string	>\0				(V.%s)
184890	string	pmview				PCP pmview config
18490>7	string	Version
18491>15	string	>\0				(V%-3.3s)
184920	string	#pmlogger			PCP pmlogger config
18493>10	string	Version
18494>18	string	>\0				(V%1.1s)
184950	string	#pmdahotproc			PCP pmdahotproc config
18496>13	string	Version
18497>21	string	>\0				(V%-3.3s)
184980	string	PcPh				PCP Help
18499>4	string	1				Index
18500>4	string	2				Text
18501>5	string	>\0				(V.%1.1s)
185020	string	#pmieconf-rules			PCP pmieconf rules
18503>16	string	>\0				(V.%1.1s)
185043	string	pmieconf-pmie			PCP pmie config
18505>17	string	>\0				(V.%1.1s)
18506
18507# SpeedShop data files
185080	lelong	0x13130303			SpeedShop data file
18509
18510# mdbm files
185110	lelong	0x01023962			mdbm file, version 0 (obsolete)
185120	string	mdbm				mdbm file,
18513>5	byte	x				version %d,
18514>6	byte	x				2^%d pages,
18515>7	byte	x				pagesize 2^%d,
18516>17	byte	x				hash %d,
18517>11	byte	x				dataformat %d
18518
18519# Alias Maya files
185200	string/t	//Maya\040ASCII	Alias Maya Ascii File,
18521>13	string	>\0	version %s
185228	string	MAYAFOR4	Alias Maya Binary File,
18523>32	string	>\0	version %s scene
185248	string	MayaFOR4	Alias Maya Binary File,
18525>32	string	>\0	version %s scene
185268	string	CIMG		Alias Maya Image File
185278	string	DEEP		Alias Maya Image File
18528#------------------------------------------------------------------------------
18529# $File: sgml,v 1.29 2012/08/26 10:25:41 christos Exp $
18530# Type:	SVG Vectorial Graphics
18531# From:	Noel Torres <tecnico@ejerciciosresueltos.com>
185320	string		\<?xml\ version="
18533>15	string		>\0
18534>>19	search/4096	\<svg			SVG Scalable Vector Graphics image
18535!:mime	image/svg+xml
18536>>19	search/4096	\<gnc-v2		GnuCash file
18537!:mime	application/x-gnucash
18538
18539# Sitemap file
185400	string/t		\<?xml\ version="
18541>15	string		>\0
18542>>19	search/4096	\<urlset		XML Sitemap document text
18543!:mime	application/xml-sitemap
18544
18545# OpenStreetMap XML (.osm)
18546# http://wiki.openstreetmap.org/wiki/OSM_XML
18547# From: Markus Heidelberg <markus.heidelberg@web.de>
185480	string		\<?xml\ version="
18549>15	string		>\0
18550>>19	search/4096	\<osm			OpenStreetMap XML data
18551
18552# xhtml
185530	string/t		\<?xml\ version="
18554>15	string		>\0
18555>>19	search/4096/cWbt	\<!doctype\ html	XHTML document text
18556!:mime	text/html
185570	string/t		\<?xml\ version='
18558>15	string		>\0
18559>>19	search/4096/cWbt	\<!doctype\ html	XHTML document text
18560!:mime	text/html
185610	string/t		\<?xml\ version="
18562>15	string		>\0
18563>>19	search/4096/cWbt	\<html	broken XHTML document text
18564!:mime	text/html
18565
18566#------------------------------------------------------------------------------
18567# sgml:  file(1) magic for Standard Generalized Markup Language
18568# HyperText Markup Language (HTML) is an SGML document type,
18569# from Daniel Quinlan (quinlan@yggdrasil.com)
18570# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org)
185710	search/4096/cWt	\<!doctype\ html	HTML document text
18572!:mime	text/html
18573!:strength + 5
185740	search/4096/cwt	\<head			HTML document text
18575!:mime	text/html
18576!:strength + 5
185770	search/4096/cwt	\<title			HTML document text
18578!:mime	text/html
18579!:strength + 5
185800	search/4096/cwt	\<html			HTML document text
18581!:mime	text/html
18582!:strength + 5
185830	search/4096/cwt	\<script 		HTML document text
18584!:mime	text/html
18585!:strength + 5
185860	search/4096/cwt	\<style 		HTML document text
18587!:mime	text/html
18588!:strength + 5
185890	search/4096/cwt	\<table			HTML document text
18590!:mime	text/html
18591!:strength + 5
185920	search/4096/cwt	\<a\ href=		HTML document text
18593!:mime	text/html
18594!:strength + 5
18595
18596# Extensible markup language (XML), a subset of SGML
18597# from Marc Prud'hommeaux (marc@apocalypse.org)
185980	search/1/cwt	\<?xml			XML document text
18599!:mime	application/xml
18600!:strength + 5
186010	string/t		\<?xml\ version\ "	XML
18602!:mime	application/xml
18603!:strength + 5
186040	string/t		\<?xml\ version="	XML
18605!:mime	application/xml
18606!:strength + 5
18607>15	string/t	>\0			%.3s document text
18608>>23	search/1	\<xsl:stylesheet	(XSL stylesheet)
18609>>24	search/1	\<xsl:stylesheet	(XSL stylesheet)
186100	string		\<?xml\ version='	XML
18611!:mime	application/xml
18612!:strength + 5
18613>15	string/t	>\0			%.3s document text
18614>>23	search/1	\<xsl:stylesheet	(XSL stylesheet)
18615>>24	search/1	\<xsl:stylesheet	(XSL stylesheet)
186160	search/1/wbt	\<?xml			XML document text
18617!:mime	application/xml
18618!:strength - 10
186190	search/1/wt	\<?XML			broken XML document text
18620!:mime	application/xml
18621!:strength - 10
18622
18623
18624# SGML, mostly from rph@sq
186250	search/4096/cwt	\<!doctype		exported SGML document text
186260	search/4096/cwt	\<!subdoc		exported SGML subdocument text
186270	search/4096/cwt	\<!--			exported SGML document text
18628!:strength - 10
18629
18630# Web browser cookie files
18631# (Mozilla, Galeon, Netscape 4, Konqueror..)
18632# Ulf Harnhammar <ulfh@update.uu.se>
186330	search/1	#\ HTTP\ Cookie\ File	Web browser cookie text
186340	search/1	#\ Netscape\ HTTP\ Cookie\ File	Netscape cookie text
186350	search/1	#\ KDE\ Cookie\ File	Konqueror cookie text
18636
18637#------------------------------------------------------------------------
18638# $File: sharc,v 1.6 2009/09/19 16:28:12 christos Exp $
18639# file(1) magic for sharc files
18640#
18641# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
18642# FutureGroove Music (dsp@futuregroove.de)
18643
18644#------------------------------------------------------------------------
18645#0	string			Draw		RiscOS Drawfile
18646#0	string			PACK		RiscOS PackdDir archive
18647
18648#------------------------------------------------------------------------
18649# SHARC DSP stuff (based on the FGM SHARC DSP SDK)
18650
18651#0	string			=!		Assembler source
18652#0	string			Analog		ADi asm listing file
186530	string			.SYSTEM		SHARC architecture file
186540	string			.system		SHARC architecture file
18655
186560	leshort			0x521C		SHARC COFF binary
18657>2	leshort			>1		, %d sections
18658>>12	lelong			>0		, not stripped
18659
18660#------------------------------------------------------------------------------
18661# $File$
18662# sinclair:  file(1) sinclair QL
18663
18664# additions to /etc/magic by Thomas M. Ott (ThMO)
18665
18666# Sinclair QL floppy disk formats (ThMO)
186670	string	=QL5		QL disk dump data,
18668>3	string	=A		720 KB,
18669>3	string	=B		1.44 MB,
18670>3	string	=C		3.2 MB,
18671>4	string	>\0		label:%.10s
18672
18673# Sinclair QL OS dump (ThMO)
18674# (NOTE: if `file' would be able to use indirect references in a endian format
18675#	 differing from the natural host format, this could be written more
18676#	 reliably and faster...)
18677#
18678# we *can't* lookup QL OS code dumps, because `file' is UNABLE to read more
18679# than the first 8K of a file... #-(
18680#
18681#0		belong	=0x30000
18682#>49124		belong	<47104
18683#>>49128		belong	<47104
18684#>>>49132	belong	<47104
18685#>>>>49136	belong	<47104	QL OS dump data,
18686#>>>>>49148	string	>\0	type %.3s,
18687#>>>>>49142	string	>\0	version %.4s
18688
18689# Sinclair QL firmware executables (ThMO)
186900	string	NqNqNq`\004	QL firmware executable (BCPL)
18691
18692# Sinclair QL libraries (was ThMO)
186930	beshort	0xFB01		QDOS object
18694>2	pstring	x		'%s'
18695
18696# Sinclair QL executables (was ThMO)
186974	belong	0x4AFB		QDOS executable
18698>9	pstring	x		'%s'
18699
18700# Sinclair QL ROM (ThMO)
187010	belong	=0x4AFB0001	QL plugin-ROM data,
18702>9	pstring	=\0		un-named
18703>9	pstring	>\0		named: %s
18704# Type: SiSU Markup Language
18705# URL:  http://www.sisudoc.org/
18706# From: Ralph Amissah <ralph.amissah@gmail.com>
18707
187080	regex	\^%?[\ \t]*SiSU[\ \t]+insert	SiSU text insert
18709>5	regex	[0-9.]+				%s
18710
187110	regex	\^%[\ \t]+SiSU[\ \t]+master	SiSU text master
18712>5	regex	[0-9.]+				%s
18713
187140	regex	\^%?[\ \t]*SiSU[\ \t]+text	SiSU text
18715>5	regex	[0-9.]+				%s
18716
187170	regex	\^%?[\ \t]*SiSU[\ \t][0-9.]+	SiSU text
18718>5	regex	[0-9.]+				%s
18719
187200	regex	\^%*[\ \t]*sisu-[0-9.]+		SiSU text
18721>5	regex	[0-9.]+				%s
18722
18723#------------------------------------------------------------------------------
18724# $File$
18725# Sketch Drawings: http://sketch.sourceforge.net/
18726# From: Edwin Mons <e@ik.nu>
187270	search/1	##Sketch	Sketch document text
18728
18729#-----------------------------------------------
18730# $File$
18731# GNU Smalltalk image, starting at version 1.6.2
18732# From: catull_us@yahoo.com
18733#
187340	string	GSTIm\0\0	GNU SmallTalk
18735# little-endian
18736>7	byte&1	=0		LE image version
18737>>10	byte	x		%d.
18738>>9	byte	x		\b%d.
18739>>8	byte	x		\b%d
18740#>>12	lelong	x		, data: %ld
18741#>>16	lelong	x		, table: %ld
18742#>>20	lelong	x		, memory: %ld
18743# big-endian
18744>7	byte&1	=1		BE image version
18745>>8	byte	x		%d.
18746>>9	byte	x		\b%d.
18747>>10	byte	x		\b%d
18748#>>12	belong	x		, data: %ld
18749#>>16	belong	x		, table: %ld
18750#>>20	belong	x		, memory: %ld
18751
18752
18753
18754#------------------------------------------------------------------------------
18755# $File$
18756# smile:  file(1) magic for Smile serialization
18757#
18758# The Smile serialization format uses a 4-byte header:
18759#
18760#   Constant byte #0: 0x3A (ASCII ':')
18761#   Constant byte #1: 0x29 (ASCII ')')
18762#   Constant byte #2: 0x0A (ASCII linefeed, '\n')
18763#   Variable byte #3, consisting of bits:
18764#     Bits 4-7 (4 MSB): 4-bit version number
18765#     Bits 3: Reserved
18766#     Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content
18767#     Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false
18768#     Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true
18769#
18770# Reference: http://wiki.fasterxml.com/SmileFormatSpec
18771# Created by: Pierre-Alexandre Meyer <pierre@mouraf.org>
18772
18773# Detection
187740	string		:)\n	Smile binary data
18775
18776# Versioning
18777>3	byte&0xF0	x		version %d:
18778
18779# Properties
18780>3	byte&0x04	0x04		binary raw,
18781>3	byte&0x04	0x00		binary encoded,
18782>3	byte&0x02	0x02		shared String values enabled,
18783>3	byte&0x02	0x00		shared String values disabled,
18784>3	byte&0x01	0x01		shared field names enabled
18785>3	byte&0x01	0x00		shared field names disabled
18786
18787
18788#------------------------------------------------------------------------------
18789# $File: sniffer,v 1.18 2011/08/08 08:49:27 christos Exp $
18790# sniffer:  file(1) magic for packet capture files
18791#
18792# From: guy@alum.mit.edu (Guy Harris)
18793#
18794
18795#
18796# Microsoft Network Monitor 1.x capture files.
18797#
187980	string		RTSS		NetMon capture file
18799>5	byte		x		- version %d
18800>4	byte		x		\b.%d
18801>6	leshort		0		(Unknown)
18802>6	leshort		1		(Ethernet)
18803>6	leshort		2		(Token Ring)
18804>6	leshort		3		(FDDI)
18805>6	leshort		4		(ATM)
18806>6	leshort		>4		(type %d)
18807
18808#
18809# Microsoft Network Monitor 2.x capture files.
18810#
188110	string		GMBU		NetMon capture file
18812>5	byte		x		- version %d
18813>4	byte		x		\b.%d
18814>6	leshort		0		(Unknown)
18815>6	leshort		1		(Ethernet)
18816>6	leshort		2		(Token Ring)
18817>6	leshort		3		(FDDI)
18818>6	leshort		4		(ATM)
18819>6	leshort		5		(IP-over-IEEE 1394)
18820>6	leshort		6		(802.11)
18821>6	leshort		7		(Raw IP)
18822>6	leshort		8		(Raw IP)
18823>6	leshort		9		(Raw IP)
18824>6	leshort		>9		(type %d)
18825
18826#
18827# Network General Sniffer capture files.
18828# Sorry, make that "Network Associates Sniffer capture files."
18829# Sorry, make that "Network General old DOS Sniffer capture files."
18830#
188310	string		TRSNIFF\ data\ \ \ \ \032	Sniffer capture file
18832>33	byte		2		(compressed)
18833>23	leshort		x		- version %d
18834>25	leshort		x		\b.%d
18835>32	byte		0		(Token Ring)
18836>32	byte		1		(Ethernet)
18837>32	byte		2		(ARCNET)
18838>32	byte		3		(StarLAN)
18839>32	byte		4		(PC Network broadband)
18840>32	byte		5		(LocalTalk)
18841>32	byte		6		(Znet)
18842>32	byte		7		(Internetwork Analyzer)
18843>32	byte		9		(FDDI)
18844>32	byte		10		(ATM)
18845
18846#
18847# Cinco Networks NetXRay capture files.
18848# Sorry, make that "Network General Sniffer Basic capture files."
18849# Sorry, make that "Network Associates Sniffer Basic capture files."
18850# Sorry, make that "Network Associates Sniffer Basic, and Windows
18851# Sniffer Pro", capture files."
18852# Sorry, make that "Network General Sniffer capture files."
18853# Sorry, make that "NetScout Sniffer capture files."
18854#
188550	string		XCP\0		NetXRay capture file
18856>4	string		>\0		- version %s
18857>44	leshort		0		(Ethernet)
18858>44	leshort		1		(Token Ring)
18859>44	leshort		2		(FDDI)
18860>44	leshort		3		(WAN)
18861>44	leshort		8		(ATM)
18862>44	leshort		9		(802.11)
18863
18864#
18865# "libpcap" capture files.
18866# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
18867# the main program that uses that format, but there are other programs
18868# that use "libpcap", or that use the same capture file format.)
18869#
188700	name		pcap-be
18871>4	beshort		x		- version %d
18872>6	beshort		x		\b.%d
18873>20	belong		0		(No link-layer encapsulation
18874>20	belong		1		(Ethernet
18875>20	belong		2		(3Mb Ethernet
18876>20	belong		3		(AX.25
18877>20	belong		4		(ProNET
18878>20	belong		5		(CHAOS
18879>20	belong		6		(Token Ring
18880>20	belong		7		(BSD ARCNET
18881>20	belong		8		(SLIP
18882>20	belong		9		(PPP
18883>20	belong		10		(FDDI
18884>20	belong		11		(RFC 1483 ATM
18885>20	belong		12		(raw IP
18886>20	belong		13		(BSD/OS SLIP
18887>20	belong		14		(BSD/OS PPP
18888>20	belong		19		(Linux ATM Classical IP
18889>20	belong		50		(PPP or Cisco HDLC
18890>20	belong		51		(PPP-over-Ethernet
18891>20	belong		99		(Symantec Enterprise Firewall
18892>20	belong		100		(RFC 1483 ATM
18893>20	belong		101		(raw IP
18894>20	belong		102		(BSD/OS SLIP
18895>20	belong		103		(BSD/OS PPP
18896>20	belong		104		(BSD/OS Cisco HDLC
18897>20	belong		105		(802.11
18898>20	belong		106		(Linux Classical IP over ATM
18899>20	belong		107		(Frame Relay
18900>20	belong		108		(OpenBSD loopback
18901>20	belong		109		(OpenBSD IPsec encrypted
18902>20	belong		112		(Cisco HDLC
18903>20	belong		113		(Linux "cooked"
18904>20	belong		114		(LocalTalk
18905>20	belong		117		(OpenBSD PFLOG
18906>20	belong		119		(802.11 with Prism header
18907>20	belong		122		(RFC 2625 IP over Fibre Channel
18908>20	belong		123		(SunATM
18909>20	belong		127		(802.11 with radiotap header
18910>20	belong		129		(Linux ARCNET
18911>20	belong		138		(Apple IP over IEEE 1394
18912>20	belong		139		(MTP2 with pseudo-header
18913>20	belong		140		(MTP2
18914>20	belong		141		(MTP3
18915>20	belong		142		(SCCP
18916>20	belong		143		(DOCSIS
18917>20	belong		144		(IrDA
18918>20	belong		147		(Private use 0
18919>20	belong		148		(Private use 1
18920>20	belong		149		(Private use 2
18921>20	belong		150		(Private use 3
18922>20	belong		151		(Private use 4
18923>20	belong		152		(Private use 5
18924>20	belong		153		(Private use 6
18925>20	belong		154		(Private use 7
18926>20	belong		155		(Private use 8
18927>20	belong		156		(Private use 9
18928>20	belong		157		(Private use 10
18929>20	belong		158		(Private use 11
18930>20	belong		159		(Private use 12
18931>20	belong		160		(Private use 13
18932>20	belong		161		(Private use 14
18933>20	belong		162		(Private use 15
18934>20	belong		163		(802.11 with AVS header
18935>20	belong		165		(BACnet MS/TP
18936>20	belong		166		(PPPD
18937>20	belong		169		(GPRS LLC
18938>20	belong		177		(Linux LAPD
18939>20	belong		187		(Bluetooth HCI H4
18940>20	belong		189		(Linux USB
18941>20	belong		192		(PPI
18942>20	belong		195		(802.15.4
18943>20	belong		196		(SITA
18944>20	belong		197		(Endace ERF
18945>20	belong		201		(Bluetooth HCI H4 with pseudo-header
18946>20	belong		202		(AX.25 with KISS header
18947>20	belong		203		(LAPD
18948>20	belong		204		(PPP with direction pseudo-header
18949>20	belong		205		(Cisco HDLC with direction pseudo-header
18950>20	belong		206		(Frame Relay with direction pseudo-header
18951>20	belong		209		(Linux IPMB
18952>20	belong		215		(802.15.4 with non-ASK PHY header
18953>20	belong		220		(Memory-mapped Linux USB
18954>20	belong		224		(Fibre Channel FC-2
18955>20	belong		225		(Fibre Channel FC-2 with frame delimiters
18956>20	belong		226		(Solaris IPNET
18957>20	belong		227		(SocketCAN
18958>20	belong		228		(Raw IPv4
18959>20	belong		229		(Raw IPv6
18960>20	belong		230		(802.15.4 without FCS
18961>20	belong		231		(D-Bus messages
18962>20	belong		235		(DVB-CI
18963>20	belong		236		(MUX27010
18964>20	belong		237		(STANAG 5066 D_PDUs
18965>20	belong		239		(Linux netlink NFLOG messages
18966>20	belong		240		(Hilscher netAnalyzer
18967>20	belong		241		(Hilscher netAnalyzer with delimiters
18968>20	belong		242		(IP-over-Infiniband
18969>20	belong		243		(MPEG-2 Transport Stream packets
18970>20	belong		244		(ng4t ng40
18971>20	belong		245		(NFC LLCP
18972>20	belong		247		(Infiniband
18973>20	belong		248		(SCTP
18974>16	belong		x		\b, capture length %d)
18975
189760	ubelong		0xa1b2c3d4	tcpdump capture file (big-endian)
18977!:mime	application/vnd.tcpdump.pcap
18978>0	use	pcap-be
189790	ulelong		0xa1b2c3d4	tcpdump capture file (little-endian)
18980!:mime	application/vnd.tcpdump.pcap
18981>0	use	\^pcap-be
18982
18983#
18984# "libpcap"-with-Alexey-Kuznetsov's-patches capture files.
18985# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
18986# the main program that uses that format, but there are other programs
18987# that use "libpcap", or that use the same capture file format.)
18988#
189890	ubelong		0xa1b2cd34	extended tcpdump capture file (big-endian)
18990>0	use	pcap-be
189910	ulelong		0xa1b2cd34	extended tcpdump capture file (little-endian)
18992>0	use	\^pcap-be
18993
18994#
18995# "pcap-ng" capture files.
18996# http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html
18997# Pcap-ng files can contain multiple sections. Printing the endianness,
18998# snaplen, or other information from the first SHB may be misleading.
18999#
190000	ubelong		0x0a0d0d0a
19001>8	ubelong		0x1a2b3c4d	pcap-ng capture file
19002>>12	beshort		x		- version %d
19003>>14	beshort		x		\b.%d
190040	ulelong		0x0a0d0d0a
19005>8	ulelong		0x1a2b3c4d	pcap-ng capture file
19006>>12	leshort		x		- version %d
19007>>14	leshort		x		\b.%d
19008
19009#
19010# AIX "iptrace" capture files.
19011#
190120	string		iptrace\ 1.0	"iptrace" capture file
190130	string		iptrace\ 2.0	"iptrace" capture file
19014
19015#
19016# Novell LANalyzer capture files.
19017#
190180	leshort		0x1001		LANalyzer capture file
190190	leshort		0x1007		LANalyzer capture file
19020
19021#
19022# HP-UX "nettl" capture files.
19023#
190240	string		\x54\x52\x00\x64\x00	"nettl" capture file
19025
19026#
19027# RADCOM WAN/LAN Analyzer capture files.
19028#
190290	string		\x42\xd2\x00\x34\x12\x66\x22\x88	RADCOM WAN/LAN Analyzer capture file
19030
19031#
19032# NetStumbler log files.  Not really packets, per se, but about as
19033# close as you can get.  These are log files from NetStumbler, a
19034# Windows program, that scans for 802.11b networks.
19035#
190360	string		NetS		NetStumbler log file
19037>8	lelong		x		\b, %d stations found
19038
19039#
19040# *Peek tagged capture files.
19041#
190420	string		\177ver		EtherPeek/AiroPeek/OmniPeek capture file
19043
19044#
19045# Visual Networks traffic capture files.
19046#
190470	string		\x05VNF		Visual Networks traffic capture file
19048
19049#
19050# Network Instruments Observer capture files.
19051#
190520	string		ObserverPktBuffe	Network Instruments Observer capture file
19053
19054#
19055# Files from Accellent Group's 5View products.
19056#
190570	string		\xaa\xaa\xaa\xaa	5View capture file
19058
19059#------------------------------------------------------------------------------
19060# $File$
19061# softquad:  file(1) magic for SoftQuad Publishing Software
19062#
19063# Author/Editor and RulesBuilder
19064#
19065# XXX - byte order?
19066#
190670	string		\<!SQ\ DTD>	Compiled SGML rules file
19068>9	string		>\0		 Type %s
190690	string		\<!SQ\ A/E>	A/E SGML Document binary
19070>9	string		>\0		 Type %s
190710	string		\<!SQ\ STS>	A/E SGML binary styles file
19072>9	string		>\0		 Type %s
190730	short		0xc0de		Compiled PSI (v1) data
190740	short		0xc0da		Compiled PSI (v2) data
19075>3	string		>\0		(%s)
19076# Binary sqtroff font/desc files...
190770	short		0125252		SoftQuad DESC or font file binary
19078>2	short		>0		- version %d
19079# Bitmaps...
190800	search/1	SQ\ BITMAP1	SoftQuad Raster Format text
19081#0	string		SQ\ BITMAP2	SoftQuad Raster Format data
19082# sqtroff intermediate language (replacement for ditroff int. lang.)
190830	string		X\ 		SoftQuad troff Context intermediate
19084>2	string		495		for AT&T 495 laser printer
19085>2	string		hp		for Hewlett-Packard LaserJet
19086>2	string		impr		for IMAGEN imPRESS
19087>2	string		ps		for PostScript
19088
19089# From: Michael Piefel <piefel@debian.org>
19090# sqtroff intermediate language (replacement for ditroff int. lang.)
190910	string		X\ 495		SoftQuad troff Context intermediate for AT&T 495 laser printer
190920	string		X\ hp		SoftQuad troff Context intermediate for HP LaserJet
190930	string		X\ impr		SoftQuad troff Context intermediate for IMAGEN imPRESS
190940	string		X\ ps		SoftQuad troff Context intermediate for PostScript
19095
19096#------------------------------------------------------------------------------
19097# $File$
19098# spec:  file(1) magic for SPEC raw results (*.raw, *.rsf)
19099#
19100# Cloyce D. Spradling <cloyce@headgear.org>
19101
191020	string	spec			SPEC
19103>4	string	.cpu			CPU
19104>>8	string	<:			\b%.4s
19105>>12	string	.			raw result text
19106
1910717	string	version=SPECjbb		SPECjbb
19108>32	string	<:			\b%.4s
19109>>37	string	<:			v%.4s raw result text
19110
191110	string	BEGIN\040SPECWEB	SPECweb
19112>13	string	<:			\b%.2s
19113>>15	string	_SSL			\b_SSL
19114>>>20	string	<:			v%.4s raw result text
19115>>16	string	<:			v%.4s raw result text
19116
19117#------------------------------------------------------------------------------
19118# $File: spectrum,v 1.6 2009/09/19 16:28:12 christos Exp $
19119# spectrum:  file(1) magic for Spectrum emulator files.
19120#
19121# John Elliott <jce@seasip.demon.co.uk>
19122
19123#
19124# Spectrum +3DOS header
19125#
191260       string          PLUS3DOS\032    Spectrum +3 data
19127>15     byte            0               - BASIC program
19128>15     byte            1               - number array
19129>15     byte            2               - character array
19130>15     byte            3               - memory block
19131>>16    belong          0x001B0040      (screen)
19132>15     byte            4               - Tasword document
19133>15     string          TAPEFILE        - ZXT tapefile
19134#
19135# Tape file. This assumes the .TAP starts with a Spectrum-format header,
19136# which nearly all will.
19137#
19138# Update: Sanity-check string contents to be printable.
19139#  -Adam Buchbinder <adam.buchbinder@gmail.com>
19140#
191410       string          \023\000\000
19142>4      string          >\0
19143>>4     string          <\177           Spectrum .TAP data "%-10.10s"
19144>>>3    byte            0               - BASIC program
19145>>>3    byte            1               - number array
19146>>>3    byte            2               - character array
19147>>>3    byte            3               - memory block
19148>>>>14  belong          0x001B0040      (screen)
19149
19150# The following three blocks are from pak21-spectrum@srcf.ucam.org
19151# TZX tape images
191520      string          ZXTape!\x1a     Spectrum .TZX data
19153>8     byte            x               version %d
19154>9     byte            x               \b.%d
19155
19156# RZX input recording files
191570      string          RZX!            Spectrum .RZX data
19158>4     byte            x               version %d
19159>5     byte            x               \b.%d
19160
19161# Floppy disk images
191620      string          MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data
191630      string          MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data
191640      string          EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data
191650      string          SINCLAIR        Spectrum .SCL Betadisk image
19166
19167# Hard disk images
191680      string          RS-IDE\x1a      Spectrum .HDF hard disk image
19169>7     byte            x               \b, version 0x%02x
19170
19171#------------------------------------------------------------------------------
19172# $File: sql,v 1.14 2014/04/28 12:04:50 christos Exp $
19173# sql:  file(1) magic for SQL files
19174#
19175# From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
19176# Recognize some MySQL files.
19177# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures
19178# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic
19179#
191800	beshort			0xfe01		MySQL table definition file
19181>2	byte			x		Version %d
191820	belong&0xffffff00	0xfefe0700	MySQL MyISAM index file
19183>3	byte			x		Version %d
191840	belong&0xffffff00	0xfefe0800	MySQL MyISAM compressed data file
19185>3	byte			x		Version %d
191860	belong&0xffffff00	0xfefe0900	MySQL Maria index file
19187>3	byte			x		Version %d
191880	belong&0xffffff00	0xfefe0A00	MySQL Maria compressed data file
19189>3	byte			x		Version %d
191900	belong&0xffffff00	0xfefe0500	MySQL ISAM index file
19191>3	byte			x		Version %d
191920	belong&0xffffff00	0xfefe0600	MySQL ISAM compressed data file
19193>3	byte			x		Version %d
191940	string			\376bin		MySQL replication log
191950	belong&0xffffff00	0xfefe0b00
19196>4	string			MARIALOG	MySQL Maria transaction log file
19197>>3	byte			x		Version %d
191980	belong&0xffffff00	0xfefe0c00
19199>4	string			MACF		MySQL Maria control file
19200>>3	byte			x		Version %d
19201
19202#------------------------------------------------------------------------------
19203# iRiver H Series database file
19204# From Ken Guest <ken@linux.ie>
19205# As observed from iRivNavi.iDB and unencoded firmware
19206#
192070   string		iRivDB	iRiver Database file
19208>11  string	>\0	Version %s
19209>39  string		iHP-100	[H Series]
19210
19211#------------------------------------------------------------------------------
19212# SQLite database files
19213# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg
19214#
19215# Version 1 used GDBM internally; its files cannot be distinguished
19216# from other GDBM files.
19217#
19218# Version 2 used this format:
192190	string	**\ This\ file\ contains\ an\ SQLite  SQLite 2.x database
19220
19221# Version 3 of SQLite allows applications to embed their own "user version"
19222# number in the database at offset 60.  Later, SQLite added an "application id"
19223# at offset 68 that is preferred over "user version" for indicating the
19224# associated application.
19225#
192260   string  SQLite\ format\ 3
19227>60 belong  =0x5f4d544e  Monotone source repository - SQLite3 database
19228>68 belong  =0x0f055112  Fossil checkout - SQLite3 database
19229>68 belong  =0x0f055113  Fossil global configuration - SQLite3 database
19230>68 belong  =0x0f055111  Fossil repository - SQLite3 database
19231>68 belong  =0x42654462  Bentley Systems BeSQLite Database - SQLite3 database
19232>68 belong  =0x42654c6e  Bentley Systems Localization File - SQLite3 database
19233>68 belong  =0x47504b47  OGC GeoPackage file - SQLite3 database
19234>68 default x            SQLite 3.x database
19235>>68 belong  !0          \b, application id %u
19236>>60 belong  !0          \b, user version %d
19237
19238# SQLite Write-Ahead Log from SQLite version >= 3.7.0
19239# http://www.sqlite.org/fileformat.html#walformat
192400	belong&0xfffffffe	0x377f0682	SQLite Write-Ahead Log,
19241>4	belong	x	version %d
19242
19243# SQLite Rollback Journal
19244# http://www.sqlite.org/fileformat.html#rollbackjournal
192450	string	\xd9\xd5\x05\xf9\x20\xa1\x63\xd7	SQLite Rollback Journal
19246
19247# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek
19248# http://www.ullrich.es/job/service-menue/panasonic/panasonic-sendersortierung-sat-am-pc/
19249# pceditor_V2003.jar
192500	string		PSDB\0			Panasonic channel list database
19251>126	string		SQLite\ format\ 3
19252>>&-15	indirect	x			\b; contains
19253# Type:	OpenSSH key files
19254# From:	Nicolas Collignon <tsointsoin@gmail.com>
19255
192560	string	SSH\ PRIVATE\ KEY	OpenSSH RSA1 private key,
19257>28	string	>\0			version %s
192580	string	-----BEGIN\ OPENSSH\ PRIVATE\ KEY-----	OpenSSH private key
19259
192600	string	ssh-dss\ 		OpenSSH DSA public key
192610	string	ssh-rsa\ 		OpenSSH RSA public key
192620	string	ecdsa-sha2-nistp256	OpenSSH ECDSA public key
192630	string	ecdsa-sha2-nistp384	OpenSSH ECDSA public key
192640	string	ecdsa-sha2-nistp521	OpenSSH ECDSA public key
192650	string	ssh-ed25519		OpenSSH ED25519 public key
19266# Type: OpenSSL certificates/key files
19267# From: Nicolas Collignon <tsointsoin@gmail.com>
19268
192690	string	-----BEGIN\ CERTIFICATE-----	PEM certificate
192700	string	-----BEGIN\ CERTIFICATE\ REQ	PEM certificate request
192710	string	-----BEGIN\ RSA\ PRIVATE	PEM RSA private key
192720	string	-----BEGIN\ DSA\ PRIVATE	PEM DSA private key
192730	string	-----BEGIN\ EC\ PRIVATE	PEM EC private key
19274
19275#------------------------------------------------------------------------------
19276# $File: sun,v 1.26 2014/03/29 15:40:34 christos Exp $
19277# sun:  file(1) magic for Sun machines
19278#
19279# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
19280# releases.  (5.x uses ELF.)  Entries for executables without an
19281# architecture type, used before the 68020-based Sun-3's came out,
19282# are in aout, as they're indistinguishable from other big-endian
19283# 32-bit a.out files.
19284#
192850	belong&077777777	0600413		a.out SunOS SPARC demand paged
19286>0	byte		&0x80
19287>>20	belong		<4096		shared library
19288>>20	belong		=4096		dynamically linked executable
19289>>20	belong		>4096		dynamically linked executable
19290>0	byte		^0x80		executable
19291>16	belong		>0		not stripped
19292
192930	belong&077777777	0600410		a.out SunOS SPARC pure
19294>0	byte		&0x80		dynamically linked executable
19295>0	byte		^0x80		executable
19296>16	belong		>0		not stripped
19297
192980	belong&077777777	0600407		a.out SunOS SPARC
19299>0	byte		&0x80		dynamically linked executable
19300>0	byte		^0x80		executable
19301>16	belong		>0		not stripped
19302
193030	belong&077777777	0400413		a.out SunOS mc68020 demand paged
19304>0	byte		&0x80
19305>>20	belong		<4096		shared library
19306>>20	belong		=4096		dynamically linked executable
19307>>20	belong		>4096		dynamically linked executable
19308>0	byte		^0x80		executable
19309>16	belong		>0		not stripped
19310
193110	belong&077777777	0400410		a.out SunOS mc68020 pure
19312>0	byte		&0x80		dynamically linked executable
19313>0	byte		^0x80		executable
19314>16	belong		>0		not stripped
19315
193160	belong&077777777	0400407		a.out SunOS mc68020
19317>0	byte		&0x80		dynamically linked executable
19318>0	byte		^0x80		executable
19319>16	belong		>0		not stripped
19320
193210	belong&077777777	0200413		a.out SunOS mc68010 demand paged
19322>0	byte		&0x80
19323>>20	belong		<4096		shared library
19324>>20	belong		=4096		dynamically linked executable
19325>>20	belong		>4096		dynamically linked executable
19326>0	byte		^0x80		executable
19327>16	belong		>0		not stripped
19328
193290	belong&077777777	0200410		a.out SunOS mc68010 pure
19330>0	byte		&0x80		dynamically linked executable
19331>0	byte		^0x80		executable
19332>16	belong		>0		not stripped
19333
193340	belong&077777777	0200407		a.out SunOS mc68010
19335>0	byte		&0x80		dynamically linked executable
19336>0	byte		^0x80		executable
19337>16	belong		>0		not stripped
19338
19339#
19340# Core files.  "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
19341# binary executed in compatibility mode under SunOS 5.x".
19342#
193430	belong		0x080456	SunOS core file
19344>4	belong		432		(SPARC)
19345>>132	string		>\0		from '%s'
19346>>116	belong		=3		(quit)
19347>>116	belong		=4		(illegal instruction)
19348>>116	belong		=5		(trace trap)
19349>>116	belong		=6		(abort)
19350>>116	belong		=7		(emulator trap)
19351>>116	belong		=8		(arithmetic exception)
19352>>116	belong		=9		(kill)
19353>>116	belong		=10		(bus error)
19354>>116	belong		=11		(segmentation violation)
19355>>116	belong		=12		(bad argument to system call)
19356>>116	belong		=29		(resource lost)
19357>>120	belong		x		(T=%dK,
19358>>124	belong		x		D=%dK,
19359>>128	belong		x		S=%dK)
19360>4	belong		826		(68K)
19361>>128	string		>\0		from '%s'
19362>4	belong		456		(SPARC 4.x BCP)
19363>>152	string		>\0		from '%s'
19364# Sun SunPC
193650	long		0xfa33c08e	SunPC 4.0 Hard Disk
193660	string		#SUNPC_CONFIG	SunPC 4.0 Properties Values
19367# Sun snoop (see RFC 1761, which describes the capture file format,
19368# RFC 3827, which describes some additional datalink types, and
19369# http://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml,
19370# which is the IANA registry of Snoop datalink types)
19371#
193720	string		snoop		Snoop capture file
19373>8	belong		>0		- version %d
19374>12	belong		0		(IEEE 802.3)
19375>12	belong		1		(IEEE 802.4)
19376>12	belong		2		(IEEE 802.5)
19377>12	belong		3		(IEEE 802.6)
19378>12	belong		4		(Ethernet)
19379>12	belong		5		(HDLC)
19380>12	belong		6		(Character synchronous)
19381>12	belong		7		(IBM channel-to-channel adapter)
19382>12	belong		8		(FDDI)
19383>12	belong		9		(Other)
19384>12	belong		10		(type %d)
19385>12	belong		11		(type %d)
19386>12	belong		12		(type %d)
19387>12	belong		13		(type %d)
19388>12	belong		14		(type %d)
19389>12	belong		15		(type %d)
19390>12	belong		16		(Fibre Channel)
19391>12	belong		17		(ATM)
19392>12	belong		18		(ATM Classical IP)
19393>12	belong		19		(type %d)
19394>12	belong		20		(type %d)
19395>12	belong		21		(type %d)
19396>12	belong		22		(type %d)
19397>12	belong		23		(type %d)
19398>12	belong		24		(type %d)
19399>12	belong		25		(type %d)
19400>12	belong		26		(IP over Infiniband)
19401>12	belong		>26		(type %d)
19402
19403#---------------------------------------------------------------------------
19404# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a
19405# lead Sun/Cobalt developer) who agrees that they are good and worthy of
19406# inclusion.
19407
19408# Boot ROM images for Sun/Cobalt Linux server appliances
194090       string  Cobalt\ Networks\ Inc.\nFirmware\ v     Paged COBALT boot rom
19410>38     string x        V%.4s
19411
19412# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code
19413# at the very end where file(1) can't get it.
194140       string CRfs     COBALT boot rom data (Flat boot rom or file system)
19415
19416#------------------------------------------------------------------------------
19417# msx:  file(1) magic for the SymbOS operating system
19418# http://www.symbos.de
19419# Fabio R. Schmidlin <frs@pop.com.br>
19420
19421# SymbOS EXE file
194220x30	string		SymExe		SymbOS executable
19423>0x36	ubyte		x		v%c
19424>0x37	ubyte		x		\b.%c
19425>0xF	string		x		\b, name: %s
19426
19427# SymbOS DOX document
194280	string		INFOq\0		SymbOS DOX document
19429
19430# Symbos driver
194310	string		SMD1		SymbOS driver
19432>19	byte		x		\b, name: %c
19433>20	byte		x		\b%c
19434>21	byte		x		\b%c
19435>22	byte		x		\b%c
19436>23	byte		x		\b%c
19437>24	byte		x		\b%c
19438>25	byte		x		\b%c
19439>26	byte		x		\b%c
19440>27	byte		x		\b%c
19441>28	byte		x		\b%c
19442>29	byte		x		\b%c
19443>30	byte		x		\b%c
19444>31	byte		x		\b%c
19445
19446# Symbos video
194470	string		SymVid		SymbOS video
19448>6	ubyte		x		v%c
19449>7	ubyte		x		\b.%c
19450
19451# Soundtrakker 128 ST2 music
194520	byte		0
19453>0xC	string		\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x40\x00	Soundtrakker 128 ST2 music,
19454>>1	string		x		name: %s
19455
19456
19457
19458#------------------------------------------------------------------------
19459# $File: sysex,v 1.7 2013/09/16 15:12:42 christos Exp $
19460# sysex: file(1) magic for MIDI sysex files
19461#
19462# GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems
19463# where real SYStem EXclusive messages at offset 1 are limited to seven bits
19464# http://en.wikipedia.org/wiki/MIDI
194650	ubeshort&0xFF80		0xF000		SysEx File -
19466
19467# North American Group
19468>1	byte			0x01		Sequential
19469>1	byte			0x02		IDP
19470>1	byte			0x03		OctavePlateau
19471>1	byte			0x04		Moog
19472>1	byte			0x05		Passport
19473>1	byte			0x06		Lexicon
19474>1	byte			0x07		Kurzweil/Future Retro
19475>>3	byte			0x77		777
19476>>4	byte			0x00		Bank
19477>>4	byte			0x01		Song
19478>>5	byte			0x0f		16
19479>>5	byte			0x0e		15
19480>>5	byte			0x0d		14
19481>>5	byte			0x0c		13
19482>>5	byte			0x0b		12
19483>>5	byte			0x0a		11
19484>>5	byte			0x09		10
19485>>5	byte			0x08		9
19486>>5	byte			0x07		8
19487>>5	byte			0x06		7
19488>>5	byte			0x05		6
19489>>5	byte			0x04		5
19490>>5	byte			0x03		4
19491>>5	byte			0x02		3
19492>>5	byte			0x01		2
19493>>5	byte			0x00		1
19494>>5	byte			0x10		(ALL)
19495>>2	byte			x			\b, Channel %d
19496>1	byte			0x08		Fender
19497>1	byte			0x09		Gulbransen
19498>1	byte			0x0a		AKG
19499>1	byte			0x0b		Voyce
19500>1	byte			0x0c		Waveframe
19501>1	byte			0x0d		ADA
19502>1	byte			0x0e		Garfield
19503>1	byte			0x0f		Ensoniq
19504>1	byte			0x10		Oberheim
19505>>2	byte			0x06		Matrix 6 series
19506>>3	byte			0x0A		Dump (All)
19507>>3	byte			0x01		Dump (Bank)
19508>>4 belong			0x0002040E		Matrix 1000
19509>>>11 byte			<2			User bank %d
19510>>>11 byte			>1			Preset bank %d
19511>1	byte			0x11		Apple
19512>1	byte			0x12		GreyMatter
19513>1	byte			0x14		PalmTree
19514>1	byte			0x15		JLCooper
19515>1	byte			0x16		Lowrey
19516>1	byte			0x17		AdamsSmith
19517>1	byte			0x18		E-mu
19518>1	byte			0x19		Harmony
19519>1	byte			0x1a		ART
19520>1	byte			0x1b		Baldwin
19521>1	byte			0x1c		Eventide
19522>1	byte			0x1d		Inventronics
19523>1	byte			0x1f		Clarity
19524
19525# European Group
19526>1	byte			0x21		SIEL
19527>1	byte			0x22		Synthaxe
19528>1	byte			0x24		Hohner
19529>1	byte			0x25		Twister
19530>1	byte			0x26		Solton
19531>1	byte			0x27		Jellinghaus
19532>1	byte			0x28		Southworth
19533>1	byte			0x29		PPG
19534>1	byte			0x2a		JEN
19535>1	byte			0x2b		SSL
19536>1	byte			0x2c		AudioVertrieb
19537
19538>1	byte			0x2f		ELKA
19539>>3	byte			0x09		EK-44
19540
19541>1	byte			0x30		Dynacord
19542>1	byte			0x31		Jomox
19543>1	byte			0x33		Clavia
19544>1	byte			0x39		Soundcraft
19545# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs
19546>1	byte			0x3e		Waldorf
19547>>2	byte			0x00		microWave
19548>>2	byte			0x0E		microwave2 / XT
19549>>2	byte			0x0F		Q / Q+
19550>>3	byte			=0			(default id)
19551>>3 byte			>0			(
19552>>>3 byte			<0x7F		\bdevice %d)
19553>>>3 byte			=0x7F		\bbroadcast id)
19554>>3	byte			0x7f		Microwave I
19555>>>4	byte			0x00		SNDR (Sound Request)
19556>>>4	byte			0x10		SNDD (Sound Dump)
19557>>>4	byte			0x20		SNDP (Sound Parameter Change)
19558>>>4	byte			0x30		SNDQ (Sound Parameter Inquiry)
19559>>>4	byte			0x70		BOOT (Sound Reserved)
19560>>>4	byte			0x01		MULR (Multi Request)
19561>>>4	byte			0x11		MULD (Multi Dump)
19562>>>4	byte			0x21		MULP (Multi Parameter Change)
19563>>>4	byte			0x31		MULQ (Multi Parameter Inquiry)
19564>>>4	byte			0x71		OS (Multi Reserved)
19565>>>4	byte			0x02		DRMR (Drum Map Request)
19566>>>4	byte			0x12		DRMD (Drum Map Dump)
19567>>>4	byte			0x22		DRMP (Drum Map Parameter Change)
19568>>>4	byte			0x32		DRMQ (Drum Map Parameter Inquiry)
19569>>>4	byte			0x72		BIN (Drum Map Reserved)
19570>>>4	byte			0x03		PATR (Sequencer Pattern Request)
19571>>>4	byte			0x13		PATD (Sequencer Pattern Dump)
19572>>>4	byte			0x23		PATP (Sequencer Pattern Parameter Change)
19573>>>4	byte			0x33		PATQ (Sequencer Pattern Parameter Inquiry)
19574>>>4	byte			0x73		AFM (Sequencer Pattern Reserved)
19575>>>4	byte			0x04		GLBR (Global Parameter Request)
19576>>>4	byte			0x14		GLBD (Global Parameter Dump)
19577>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
19578>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
19579>>>4	byte			0x07		MODR (Mode Parameter Request)
19580>>>4	byte			0x17		MODD (Mode Parameter Dump)
19581>>>4	byte			0x27		MODP (Mode Parameter Parameter Change)
19582>>>4	byte			0x37		MODQ (Mode Parameter Parameter Inquiry)
19583>>2	byte			0x10		microQ
19584>>>4	byte			0x00		SNDR (Sound Request)
19585>>>4	byte			0x10		SNDD (Sound Dump)
19586>>>4	byte			0x20		SNDP (Sound Parameter Change)
19587>>>4	byte			0x30		SNDQ (Sound Parameter Inquiry)
19588>>>4	byte			0x70		(Sound Reserved)
19589>>>4	byte			0x01		MULR (Multi Request)
19590>>>4	byte			0x11		MULD (Multi Dump)
19591>>>4	byte			0x21		MULP (Multi Parameter Change)
19592>>>4	byte			0x31		MULQ (Multi Parameter Inquiry)
19593>>>4	byte			0x71		OS (Multi Reserved)
19594>>>4	byte			0x02		DRMR (Drum Map Request)
19595>>>4	byte			0x12		DRMD (Drum Map Dump)
19596>>>4	byte			0x22		DRMP (Drum Map Parameter Change)
19597>>>4	byte			0x32		DRMQ (Drum Map Parameter Inquiry)
19598>>>4	byte			0x72		BIN (Drum Map Reserved)
19599>>>4	byte			0x04		GLBR (Global Parameter Request)
19600>>>4	byte			0x14		GLBD (Global Parameter Dump)
19601>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
19602>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
19603>>2	byte			0x11		rackAttack
19604>>>4	byte			0x00		SNDR (Sound Parameter Request)
19605>>>4	byte			0x10		SNDD (Sound Parameter Dump)
19606>>>4	byte			0x20		SNDP (Sound Parameter Parameter Change)
19607>>>4	byte			0x30		SNDQ (Sound Parameter Parameter Inquiry)
19608>>>4	byte			0x01		PRGR (Program Parameter Request)
19609>>>4	byte			0x11		PRGD (Program Parameter Dump)
19610>>>4	byte			0x21		PRGP (Program Parameter Parameter Change)
19611>>>4	byte			0x31		PRGQ (Program Parameter Parameter Inquiry)
19612>>>4	byte			0x71		OS (Program Parameter Reserved)
19613>>>4	byte			0x03		PATR (Pattern Parameter Request)
19614>>>4	byte			0x13		PATD (Pattern Parameter Dump)
19615>>>4	byte			0x23		PATP (Pattern Parameter Parameter Change)
19616>>>4	byte			0x33		PATQ (Pattern Parameter Parameter Inquiry)
19617>>>4	byte			0x04		GLBR (Global Parameter Request)
19618>>>4	byte			0x14		GLBD (Global Parameter Dump)
19619>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
19620>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
19621>>>4	byte			0x05		EFXR (FX Parameter Request)
19622>>>4	byte			0x15		EFXD (FX Parameter Dump)
19623>>>4	byte			0x25		EFXP (FX Parameter Parameter Change)
19624>>>4	byte			0x35		EFXQ (FX Parameter Parameter Inquiry)
19625>>>4	byte			0x07		MODR (Mode Command Request)
19626>>>4	byte			0x17		MODD (Mode Command Dump)
19627>>>4	byte			0x27		MODP (Mode Command Parameter Change)
19628>>>4	byte			0x37		MODQ (Mode Command Parameter Inquiry)
19629>>2	byte			0x03		Wave
19630>>>4	byte			0x00		SBPR (Soundprogram)
19631>>>4	byte			0x01		SAPR (Performance)
19632>>>4	byte			0x02		SWAVE (Wave)
19633>>>4	byte			0x03		SWTBL (Wave control table)
19634>>>4	byte			0x04		SVT (Velocity Curve)
19635>>>4	byte			0x05		STT (Tuning Table)
19636>>>4	byte			0x06		SGLB (Global Parameters)
19637>>>4	byte			0x07		SARRMAP (Performance Program Change Map)
19638>>>4	byte			0x08		SBPRMAP (Sound Program Change Map)
19639>>>4	byte			0x09		SBPRPAR (Sound Parameter)
19640>>>4	byte			0x0A		SARRPAR (Performance Parameter)
19641>>>4	byte			0x0B		SINSPAR (Instrument/External Parameter)
19642>>>4	byte			0x0F		SBULK (Bulk Switch on/off)
19643
19644# Japanese Group
19645>1	byte			0x40		Kawai
19646>>3	byte			0x20		K1
19647>>3	byte			0x22		K4
19648
19649>1	byte			0x41		Roland
19650>>3	byte			0x14		D-50
19651>>3	byte			0x2b		U-220
19652>>3	byte			0x02		TR-707
19653
19654>1	byte			0x42		Korg
19655>>3	byte			0x19		M1
19656
19657>1	byte			0x43		Yamaha
19658>1	byte			0x44		Casio
19659>1	byte			0x46		Kamiya
19660>1	byte			0x47		Akai
19661>1	byte			0x48		Victor
19662>1	byte			0x49		Mesosha
19663>1	byte			0x4b		Fujitsu
19664>1	byte			0x4c		Sony
19665>1	byte			0x4e		Teac
19666>1	byte			0x50		Matsushita
19667>1	byte			0x51		Fostex
19668>1	byte			0x52		Zoom
19669>1	byte			0x54		Matsushita
19670>1	byte			0x57		Acoustic tech. lab.
19671# http://www.midi.org/techspecs/manid.php
19672>1	belong&0xffffff00	0x00007400	Ta Horng
19673>1	belong&0xffffff00	0x00007500	e-Tek
19674>1	belong&0xffffff00	0x00007600	E-Voice
19675>1	belong&0xffffff00	0x00007700	Midisoft
19676>1	belong&0xffffff00	0x00007800	Q-Sound
19677>1	belong&0xffffff00	0x00007900	Westrex
19678>1	belong&0xffffff00	0x00007a00	Nvidia*
19679>1	belong&0xffffff00	0x00007b00	ESS
19680>1	belong&0xffffff00	0x00007c00	Mediatrix
19681>1	belong&0xffffff00	0x00007d00	Brooktree
19682>1	belong&0xffffff00	0x00007e00	Otari
19683>1	belong&0xffffff00	0x00007f00	Key Electronics
19684>1	belong&0xffffff00	0x00010000	Shure
19685>1	belong&0xffffff00	0x00010100	AuraSound
19686>1	belong&0xffffff00	0x00010200	Crystal
19687>1	belong&0xffffff00	0x00010300	Rockwell
19688>1	belong&0xffffff00	0x00010400	Silicon Graphics
19689>1	belong&0xffffff00	0x00010500	Midiman
19690>1	belong&0xffffff00	0x00010600	PreSonus
19691>1	belong&0xffffff00	0x00010800	Topaz
19692>1	belong&0xffffff00	0x00010900	Cast Lightning
19693>1	belong&0xffffff00	0x00010a00	Microsoft
19694>1	belong&0xffffff00	0x00010b00	Sonic Foundry
19695>1	belong&0xffffff00	0x00010c00	Line 6
19696>1	belong&0xffffff00	0x00010d00	Beatnik Inc.
19697>1	belong&0xffffff00	0x00010e00	Van Koerving
19698>1	belong&0xffffff00	0x00010f00	Altech Systems
19699>1	belong&0xffffff00	0x00011000	S & S Research
19700>1	belong&0xffffff00	0x00011100	VLSI Technology
19701>1	belong&0xffffff00	0x00011200	Chromatic
19702>1	belong&0xffffff00	0x00011300	Sapphire
19703>1	belong&0xffffff00	0x00011400	IDRC
19704>1	belong&0xffffff00	0x00011500	Justonic Tuning
19705>1	belong&0xffffff00	0x00011600	TorComp
19706>1	belong&0xffffff00	0x00011700	Newtek Inc.
19707>1	belong&0xffffff00	0x00011800	Sound Sculpture
19708>1	belong&0xffffff00	0x00011900	Walker Technical
19709>1	belong&0xffffff00	0x00011a00	Digital Harmony
19710>1	belong&0xffffff00	0x00011b00	InVision
19711>1	belong&0xffffff00	0x00011c00	T-Square
19712>1	belong&0xffffff00	0x00011d00	Nemesys
19713>1	belong&0xffffff00	0x00011e00	DBX
19714>1	belong&0xffffff00	0x00011f00	Syndyne
19715>1	belong&0xffffff00	0x00012000	Bitheadz
19716>1	belong&0xffffff00	0x00012100	Cakewalk
19717>1	belong&0xffffff00	0x00012200	Staccato
19718>1	belong&0xffffff00	0x00012300	National Semicon.
19719>1	belong&0xffffff00	0x00012400	Boom Theory
19720>1	belong&0xffffff00	0x00012500	Virtual DSP Corp
19721>1	belong&0xffffff00	0x00012600	Antares
19722>1	belong&0xffffff00	0x00012700	Angel Software
19723>1	belong&0xffffff00	0x00012800	St Louis Music
19724>1	belong&0xffffff00	0x00012900	Lyrrus dba G-VOX
19725>1	belong&0xffffff00	0x00012a00	Ashley Audio
19726>1	belong&0xffffff00	0x00012b00	Vari-Lite
19727>1	belong&0xffffff00	0x00012c00	Summit Audio
19728>1	belong&0xffffff00	0x00012d00	Aureal Semicon.
19729>1	belong&0xffffff00	0x00012e00	SeaSound
19730>1	belong&0xffffff00	0x00012f00	U.S. Robotics
19731>1	belong&0xffffff00	0x00013000	Aurisis
19732>1	belong&0xffffff00	0x00013100	Nearfield Multimedia
19733>1	belong&0xffffff00	0x00013200	FM7 Inc.
19734>1	belong&0xffffff00	0x00013300	Swivel Systems
19735>1	belong&0xffffff00	0x00013400	Hyperactive
19736>1	belong&0xffffff00	0x00013500	MidiLite
19737>1	belong&0xffffff00	0x00013600	Radical
19738>1	belong&0xffffff00	0x00013700	Roger Linn
19739>1	belong&0xffffff00	0x00013800	Helicon
19740>1	belong&0xffffff00	0x00013900	Event
19741>1	belong&0xffffff00	0x00013a00	Sonic Network
19742>1	belong&0xffffff00	0x00013b00	Realtime Music
19743>1	belong&0xffffff00	0x00013c00	Apogee Digital
19744
19745>1	belong&0xffffff00	0x00202b00	Medeli Electronics
19746>1	belong&0xffffff00	0x00202c00	Charlie Lab
19747>1	belong&0xffffff00	0x00202d00	Blue Chip Music
19748>1	belong&0xffffff00	0x00202e00	BEE OH Corp
19749>1	belong&0xffffff00	0x00202f00	LG Semicon America
19750>1	belong&0xffffff00	0x00203000	TESI
19751>1	belong&0xffffff00	0x00203100	EMAGIC
19752>1	belong&0xffffff00	0x00203200	Behringer
19753>1	belong&0xffffff00	0x00203300	Access Music
19754>1	belong&0xffffff00	0x00203400	Synoptic
19755>1	belong&0xffffff00	0x00203500	Hanmesoft Corp
19756>1	belong&0xffffff00	0x00203600	Terratec
19757>1	belong&0xffffff00	0x00203700	Proel SpA
19758>1	belong&0xffffff00	0x00203800	IBK MIDI
19759>1	belong&0xffffff00	0x00203900	IRCAM
19760>1	belong&0xffffff00	0x00203a00	Propellerhead Software
19761>1	belong&0xffffff00	0x00203b00	Red Sound Systems
19762>1	belong&0xffffff00	0x00203c00	Electron ESI AB
19763>1	belong&0xffffff00	0x00203d00	Sintefex Audio
19764>1	belong&0xffffff00	0x00203e00	Music and More
19765>1	belong&0xffffff00	0x00203f00	Amsaro
19766>1	belong&0xffffff00	0x00204000	CDS Advanced Technology
19767>1	belong&0xffffff00	0x00204100	Touched by Sound
19768>1	belong&0xffffff00	0x00204200	DSP Arts
19769>1	belong&0xffffff00	0x00204300	Phil Rees Music
19770>1	belong&0xffffff00	0x00204400	Stamer Musikanlagen GmbH
19771>1	belong&0xffffff00	0x00204500	Soundart
19772>1	belong&0xffffff00	0x00204600	C-Mexx Software
19773>1	belong&0xffffff00	0x00204700	Klavis Tech.
19774>1	belong&0xffffff00	0x00204800	Noteheads AB
19775
197760	string			T707		Roland TR-707 Data
19777#------------------------------------------------------------------------------
19778# file:  file(1) magic for Tcl scripting language
19779# URL:  http://www.tcl.tk/
19780# From: gustaf neumann
19781
19782# Tcl scripts
197830	search/1/w	#!\ /usr/bin/tcl	Tcl script text executable
19784!:mime	text/x-tcl
197850	search/1/w	#!\ /usr/local/bin/tcl	Tcl script text executable
19786!:mime	text/x-tcl
197870	search/1	#!/usr/bin/env\ tcl	Tcl script text executable
19788!:mime	text/x-tcl
197890	search/1	#!\ /usr/bin/env\ tcl	Tcl script text executable
19790!:mime	text/x-tcl
197910	search/1/w	#!\ /usr/bin/wish	Tcl/Tk script text executable
19792!:mime	text/x-tcl
197930	search/1/w	#!\ /usr/local/bin/wish	Tcl/Tk script text executable
19794!:mime	text/x-tcl
197950	search/1	#!/usr/bin/env\ wish	Tcl/Tk script text executable
19796!:mime	text/x-tcl
197970	search/1	#!\ /usr/bin/env\ wish	Tcl/Tk script text executable
19798!:mime	text/x-tcl
19799
19800# check the first line
198010	search/1	package\ req
19802>0	regex		\^package[\ \t]+req	Tcl script
19803# not 'p', check other lines
198040	search/1	!p
19805>0	regex		\^package[\ \t]+req	Tcl script
19806
19807#------------------------------------------------------------------------------
19808# $File$
19809# teapot:  file(1) magic for "teapot" spreadsheet
19810#
198110       string          #!teapot\012xdr      teapot work sheet (XDR format)
19812
19813#------------------------------------------------------------------------------
19814# $File$
19815# terminfo:  file(1) magic for terminfo
19816#
19817# XXX - byte order for screen images?
19818#
198190	string		\032\001	Compiled terminfo entry
198200	short		0433		Curses screen image
198210	short		0434		Curses screen image
19822
19823#------------------------------------------------------------------------------
19824# $File: tex,v 1.19 2013/09/17 17:39:16 christos Exp $
19825# tex:  file(1) magic for TeX files
19826#
19827# XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
19828#
19829# From <conklin@talisman.kaleida.com>
19830
19831# Although we may know the offset of certain text fields in TeX DVI
19832# and font files, we can't use them reliably because they are not
19833# zero terminated. [but we do anyway, christos]
198340	string		\367\002	TeX DVI file
19835!:mime	application/x-dvi
19836>16	string		>\0		(%s)
198370	string		\367\203	TeX generic font data
198380	string		\367\131	TeX packed font data
19839>3	string		>\0		(%s)
198400	string		\367\312	TeX virtual font data
198410	search/1	This\ is\ TeX,	TeX transcript text
198420	search/1	This\ is\ METAFONT,	METAFONT transcript text
19843
19844# There is no way to detect TeX Font Metric (*.tfm) files without
19845# breaking them apart and reading the data.  The following patterns
19846# match most *.tfm files generated by METAFONT or afm2tfm.
198472	string		\000\021	TeX font metric data
19848!:mime	application/x-tex-tfm
19849>33	string		>\0		(%s)
198502	string		\000\022	TeX font metric data
19851!:mime	application/x-tex-tfm
19852>33	string		>\0		(%s)
19853
19854# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
198550	search/1	\\input\ texinfo	Texinfo source text
19856!:mime	text/x-texinfo
198570	search/1	This\ is\ Info\ file	GNU Info text
19858!:mime	text/x-info
19859
19860# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
198610	search/4096	\\input		TeX document text
19862!:mime	text/x-tex
19863!:strength + 15
198640	search/4096	\\begin		LaTeX document text
19865!:mime	text/x-tex
19866!:strength + 15
198670	search/4096	\\section	LaTeX document text
19868!:mime	text/x-tex
19869!:strength + 18
198700	search/4096	\\setlength	LaTeX document text
19871!:mime	text/x-tex
19872!:strength + 15
198730	search/4096	\\documentstyle	LaTeX document text
19874!:mime	text/x-tex
19875!:strength + 18
198760	search/4096	\\chapter	LaTeX document text
19877!:mime	text/x-tex
19878!:strength + 18
198790	search/4096	\\documentclass	LaTeX 2e document text
19880!:mime	text/x-tex
19881!:strength + 15
198820	search/4096	\\relax		LaTeX auxiliary file
19883!:mime	text/x-tex
19884!:strength + 15
198850	search/4096	\\contentsline	LaTeX table of contents
19886!:mime	text/x-tex
19887!:strength + 15
198880	search/4096	%\ -*-latex-*-	LaTeX document text
19889!:mime	text/x-tex
19890
19891# Tex document, from Hendrik Scholz <hendrik@scholz.net>
198920   	search/1	\\ifx		TeX document text
19893
19894# Index and glossary files
198950	search/4096	\\indexentry	LaTeX raw index file
198960	search/4096	\\begin{theindex}	LaTeX sorted index
198970	search/4096	\\glossaryentry	LaTeX raw glossary
198980	search/4096	\\begin{theglossary}	LaTeX sorted glossary
198990	search/4096	This\ is\ makeindex	Makeindex log file
19900
19901# End of TeX
19902
19903#------------------------------------------------------------------------------
19904# file(1) magic for BibTex text files
19905# From Hendrik Scholz <hendrik@scholz.net>
19906
199070	search/1/c	@article{	BibTeX text file
199080	search/1/c	@book{		BibTeX text file
199090	search/1/c	@inbook{	BibTeX text file
199100	search/1/c	@incollection{	BibTeX text file
199110	search/1/c	@inproceedings{	BibTeX text file
199120	search/1/c	@manual{	BibTeX text file
199130	search/1/c	@misc{		BibTeX text file
199140	search/1/c	@preamble{	BibTeX text file
199150	search/1/c	@phdthesis{	BibTeX text file
199160	search/1/c	@techreport{	BibTeX text file
199170	search/1/c	@unpublished{	BibTeX text file
19918
1991973	search/1	%%%\ \ 		BibTeX-file{ BibTex text file (with full header)
19920
1992173	search/1	%%%\ \ @BibTeX-style-file{   BibTeX style text file (with full header)
19922
199230	search/1	%\ BibTeX\ standard\ bibliography\ 	BibTeX standard bibliography style text file
19924
199250	search/1	%\ BibTeX\ `	BibTeX custom bibliography style text file
19926
199270	search/1	@c\ @mapfile{	TeX font aliases text file
19928
199290	string		#LyX		LyX document text
19930
19931# ConTeXt documents
19932#	http://wiki.contextgarden.net/
199330	search/4096	\\setupcolors[		ConTeXt document text
19934!:strength + 15
199350	search/4096	\\definecolor[		ConTeXt document text
19936!:strength + 15
199370	search/4096	\\setupinteraction[	ConTeXt document text
19938!:strength + 15
199390	search/4096	\\useURL[		ConTeXt document text
19940!:strength + 15
199410	search/4096	\\setuppapersize[	ConTeXt document text
19942!:strength + 15
199430	search/4096	\\setuplayout[		ConTeXt document text
19944!:strength + 15
199450	search/4096	\\setupfooter[		ConTeXt document text
19946!:strength + 15
199470	search/4096	\\setupfootertexts[	ConTeXt document text
19948!:strength + 15
199490	search/4096	\\setuppagenumbering[	ConTeXt document text
19950!:strength + 15
199510	search/4096	\\setupbodyfont[	ConTeXt document text
19952!:strength + 15
199530	search/4096	\\setuphead[		ConTeXt document text
19954!:strength + 15
199550	search/4096	\\setupitemize[		ConTeXt document text
19956!:strength + 15
199570	search/4096	\\setupwhitespace[	ConTeXt document text
19958!:strength + 15
199590	search/4096	\\setupindenting[	ConTeXt document text
19960!:strength + 15
19961
19962#------------------------------------------------------------------------------
19963# $File: tgif,v 1.6 2010/09/20 18:55:20 rrt Exp $
19964# file(1) magic for tgif(1) files
19965# From Hendrik Scholz <hendrik@scholz.net>
199660	string	%TGIF\ 			Tgif file version
19967>6	string	x			%s
19968
19969#------------------------------------------------------------------------------
19970# $File: ti-8x,v 1.6 2009/09/19 16:28:12 christos Exp $
19971# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators.
19972#
19973# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us).
19974#
19975# Update: Romain Lievin (roms@lpg.ticalc.org).
19976#
19977# NOTE: This list is not complete.
19978# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the
19979# program/group magic numbers in here because I cannot find any.
199800		string		**TI80**	TI-80 Graphing Calculator File.
199810		string		**TI81**	TI-81 Graphing Calculator File.
19982#
19983# Magic Numbers for the TI-73
19984#
199850		string		**TI73**	TI-73 Graphing Calculator
19986>0x00003B	byte		0x00		(real number)
19987>0x00003B	byte		0x01		(list)
19988>0x00003B	byte		0x02		(matrix)
19989>0x00003B	byte		0x03		(equation)
19990>0x00003B	byte		0x04		(string)
19991>0x00003B	byte		0x05		(program)
19992>0x00003B	byte		0x06		(assembly program)
19993>0x00003B	byte		0x07		(picture)
19994>0x00003B	byte		0x08		(gdb)
19995>0x00003B	byte		0x0C		(complex number)
19996>0x00003B	byte		0x0F		(window settings)
19997>0x00003B	byte		0x10		(zoom)
19998>0x00003B	byte		0x11		(table setup)
19999>0x00003B	byte		0x13		(backup)
20000
20001# Magic Numbers for the TI-82
20002#
200030		string		**TI82**	TI-82 Graphing Calculator
20004>0x00003B	byte		0x00		(real)
20005>0x00003B	byte		0x01		(list)
20006>0x00003B	byte		0x02		(matrix)
20007>0x00003B	byte		0x03		(Y-variable)
20008>0x00003B	byte		0x05		(program)
20009>0x00003B	byte		0x06		(protected prgm)
20010>0x00003B	byte		0x07		(picture)
20011>0x00003B	byte		0x08		(gdb)
20012>0x00003B	byte		0x0B		(window settings)
20013>0x00003B	byte		0x0C		(window settings)
20014>0x00003B	byte		0x0D		(table setup)
20015>0x00003B	byte		0x0E		(screenshot)
20016>0x00003B	byte		0x0F		(backup)
20017#
20018# Magic Numbers for the TI-83
20019#
200200		string		**TI83**	TI-83 Graphing Calculator
20021>0x00003B	byte		0x00		(real)
20022>0x00003B	byte		0x01		(list)
20023>0x00003B	byte		0x02		(matrix)
20024>0x00003B	byte		0x03		(Y-variable)
20025>0x00003B	byte		0x04		(string)
20026>0x00003B	byte		0x05		(program)
20027>0x00003B	byte		0x06		(protected prgm)
20028>0x00003B	byte		0x07		(picture)
20029>0x00003B	byte		0x08		(gdb)
20030>0x00003B	byte		0x0B		(window settings)
20031>0x00003B	byte		0x0C		(window settings)
20032>0x00003B	byte		0x0D		(table setup)
20033>0x00003B	byte		0x0E		(screenshot)
20034>0x00003B	byte		0x13		(backup)
20035#
20036# Magic Numbers for the TI-83+
20037#
200380		string		**TI83F*	TI-83+ Graphing Calculator
20039>0x00003B	byte		0x00		(real number)
20040>0x00003B	byte		0x01		(list)
20041>0x00003B	byte		0x02		(matrix)
20042>0x00003B	byte		0x03		(equation)
20043>0x00003B	byte		0x04		(string)
20044>0x00003B	byte		0x05		(program)
20045>0x00003B	byte		0x06		(assembly program)
20046>0x00003B	byte		0x07		(picture)
20047>0x00003B	byte		0x08		(gdb)
20048>0x00003B	byte		0x0C		(complex number)
20049>0x00003B	byte		0x0F		(window settings)
20050>0x00003B	byte		0x10		(zoom)
20051>0x00003B	byte		0x11		(table setup)
20052>0x00003B	byte		0x13		(backup)
20053>0x00003B	byte		0x15		(application variable)
20054>0x00003B	byte		0x17		(group of variable)
20055
20056#
20057# Magic Numbers for the TI-85
20058#
200590		string		**TI85**	TI-85 Graphing Calculator
20060>0x00003B	byte		0x00		(real number)
20061>0x00003B	byte		0x01		(complex number)
20062>0x00003B	byte		0x02		(real vector)
20063>0x00003B	byte		0x03		(complex vector)
20064>0x00003B	byte		0x04		(real list)
20065>0x00003B	byte		0x05		(complex list)
20066>0x00003B	byte		0x06		(real matrix)
20067>0x00003B	byte		0x07		(complex matrix)
20068>0x00003B	byte		0x08		(real constant)
20069>0x00003B	byte		0x09		(complex constant)
20070>0x00003B	byte		0x0A		(equation)
20071>0x00003B	byte		0x0C		(string)
20072>0x00003B	byte		0x0D		(function GDB)
20073>0x00003B	byte		0x0E		(polar GDB)
20074>0x00003B	byte		0x0F		(parametric GDB)
20075>0x00003B	byte		0x10		(diffeq GDB)
20076>0x00003B	byte		0x11		(picture)
20077>0x00003B	byte		0x12		(program)
20078>0x00003B	byte		0x13		(range)
20079>0x00003B	byte		0x17		(window settings)
20080>0x00003B	byte		0x18		(window settings)
20081>0x00003B	byte		0x19		(window settings)
20082>0x00003B	byte		0x1A		(window settings)
20083>0x00003B	byte		0x1B		(zoom)
20084>0x00003B	byte		0x1D		(backup)
20085>0x00003B	byte		0x1E		(unknown)
20086>0x00003B	byte		0x2A		(equation)
20087>0x000032	string		ZS4		- ZShell Version 4 File.
20088>0x000032	string		ZS3		- ZShell Version 3 File.
20089#
20090# Magic Numbers for the TI-86
20091#
200920		string		**TI86**	TI-86 Graphing Calculator
20093>0x00003B	byte		0x00		(real number)
20094>0x00003B	byte		0x01		(complex number)
20095>0x00003B	byte		0x02		(real vector)
20096>0x00003B	byte		0x03		(complex vector)
20097>0x00003B	byte		0x04		(real list)
20098>0x00003B	byte		0x05		(complex list)
20099>0x00003B	byte		0x06		(real matrix)
20100>0x00003B	byte		0x07		(complex matrix)
20101>0x00003B	byte		0x08		(real constant)
20102>0x00003B	byte		0x09		(complex constant)
20103>0x00003B	byte		0x0A		(equation)
20104>0x00003B	byte		0x0C		(string)
20105>0x00003B	byte		0x0D		(function GDB)
20106>0x00003B	byte		0x0E		(polar GDB)
20107>0x00003B	byte		0x0F		(parametric GDB)
20108>0x00003B	byte		0x10		(diffeq GDB)
20109>0x00003B	byte		0x11		(picture)
20110>0x00003B	byte		0x12		(program)
20111>0x00003B	byte		0x13		(range)
20112>0x00003B	byte		0x17		(window settings)
20113>0x00003B	byte		0x18		(window settings)
20114>0x00003B	byte		0x19		(window settings)
20115>0x00003B	byte		0x1A		(window settings)
20116>0x00003B	byte		0x1B		(zoom)
20117>0x00003B	byte		0x1D		(backup)
20118>0x00003B	byte		0x1E		(unknown)
20119>0x00003B	byte		0x2A		(equation)
20120#
20121# Magic Numbers for the TI-89
20122#
201230		string		**TI89**	TI-89 Graphing Calculator
20124>0x000048	byte		0x00		(expression)
20125>0x000048	byte		0x04		(list)
20126>0x000048	byte		0x06		(matrix)
20127>0x000048	byte		0x0A		(data)
20128>0x000048	byte		0x0B		(text)
20129>0x000048	byte		0x0C		(string)
20130>0x000048	byte		0x0D		(graphic data base)
20131>0x000048	byte		0x0E		(figure)
20132>0x000048	byte		0x10		(picture)
20133>0x000048	byte		0x12		(program)
20134>0x000048	byte		0x13		(function)
20135>0x000048	byte		0x14		(macro)
20136>0x000048	byte		0x1C		(zipped)
20137>0x000048	byte		0x21		(assembler)
20138#
20139# Magic Numbers for the TI-92
20140#
201410		string		**TI92**	TI-92 Graphing Calculator
20142>0x000048	byte		0x00		(expression)
20143>0x000048	byte		0x04		(list)
20144>0x000048	byte		0x06		(matrix)
20145>0x000048	byte		0x0A		(data)
20146>0x000048	byte		0x0B		(text)
20147>0x000048	byte		0x0C		(string)
20148>0x000048	byte		0x0D		(graphic data base)
20149>0x000048	byte		0x0E		(figure)
20150>0x000048	byte		0x10		(picture)
20151>0x000048	byte		0x12		(program)
20152>0x000048	byte		0x13		(function)
20153>0x000048	byte		0x14		(macro)
20154>0x000048	byte		0x1D		(backup)
20155#
20156# Magic Numbers for the TI-92+/V200
20157#
201580		string		**TI92P*	TI-92+/V200 Graphing Calculator
20159>0x000048	byte		0x00		(expression)
20160>0x000048	byte		0x04		(list)
20161>0x000048	byte		0x06		(matrix)
20162>0x000048	byte		0x0A		(data)
20163>0x000048	byte		0x0B		(text)
20164>0x000048	byte		0x0C		(string)
20165>0x000048	byte		0x0D		(graphic data base)
20166>0x000048	byte		0x0E		(figure)
20167>0x000048	byte		0x10		(picture)
20168>0x000048	byte		0x12		(program)
20169>0x000048	byte		0x13		(function)
20170>0x000048	byte		0x14		(macro)
20171>0x000048	byte		0x1C		(zipped)
20172>0x000048	byte		0x21		(assembler)
20173#
20174# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades
20175#
201760x0000016	string		Advanced	TI-XX Graphing Calculator (FLASH)
201770		string		**TIFL**	TI-XX Graphing Calculator (FLASH)
20178>8		byte		>0		- Revision %d
20179>>9 		byte		x		\b.%d,
20180>12		byte		>0		Revision date %02x
20181>>13		byte		x		\b/%02x
20182>>14		beshort		x		\b/%04x,
20183>17		string		>/0		name: '%s',
20184>48		byte		0x74		device: TI-73,
20185>48		byte		0x73		device: TI-83+,
20186>48		byte		0x98		device: TI-89,
20187>48		byte		0x88		device: TI-92+,
20188>49		byte		0x23		type: OS upgrade,
20189>49		byte		0x24		type: application,
20190>49		byte		0x25		type: certificate,
20191>49		byte		0x3e		type: license,
20192>74		lelong		>0		size: %d bytes
20193
20194# VTi & TiEmu skins (TI Graphing Calculators).
20195# From: Romain Lievin (roms@lpg.ticalc.org).
20196# Magic Numbers for the VTi skins
201970               string          VTI		Virtual TI skin
20198>3		string		v		- Version
20199>>4		byte		>0		\b %c
20200>>6		byte		x		\b.%c
20201# Magic Numbers for the TiEmu skins
202020		string		TiEmu		TiEmu skin
20203>6              string          v               - Version
20204>>7             byte            >0              \b %c
20205>>9             byte            x               \b.%c
20206>>10		byte		x		\b%c
20207
20208#------------------------------------------------------------------------------
20209# $File$
20210# timezone:  file(1) magic for timezone data
20211#
20212# from Daniel Quinlan (quinlan@yggdrasil.com)
20213# this should work on Linux, SunOS, and maybe others
20214# Added new official magic number for recent versions of the Olson code
202150	string	TZif	timezone data
20216>4	byte	0	\b, old version
20217>4	byte	>0	\b, version %c
20218>20	belong	0	\b, no gmt time flags
20219>20	belong	1	\b, 1 gmt time flag
20220>20	belong	>1	\b, %d gmt time flags
20221>24	belong	0	\b, no std time flags
20222>20	belong	1	\b, 1 std time flag
20223>24	belong	>1	\b, %d std time flags
20224>28	belong	0	\b, no leap seconds
20225>28	belong	1	\b, 1 leap second
20226>28	belong  >1	\b, %d leap seconds
20227>32	belong	0	\b, no transition times
20228>32	belong	1	\b, 1 transition time
20229>32	belong  >1	\b, %d transition times
20230>36	belong	0	\b, no abbreviation chars
20231>36	belong	1	\b, 1 abbreviation char
20232>36	belong	>1	\b, %d abbreviation chars
202330	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0	old timezone data
202340	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0	old timezone data
202350	string  \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0	old timezone data
202360	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0	old timezone data
202370	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0	old timezone data
202380	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0	old timezone data
20239
20240#------------------------------------------------------------------------------
20241# $File: troff,v 1.10 2009/09/19 16:28:12 christos Exp $
20242# troff:  file(1) magic for *roff
20243#
20244# updated by Daniel Quinlan (quinlan@yggdrasil.com)
20245
20246# troff input
202470	search/1	.\\"		troff or preprocessor input text
20248!:mime	text/troff
202490	search/1	'\\"		troff or preprocessor input text
20250!:mime	text/troff
202510	search/1	'.\\"		troff or preprocessor input text
20252!:mime	text/troff
202530	search/1	\\"		troff or preprocessor input text
20254!:mime	text/troff
202550	search/1	'''		troff or preprocessor input text
20256!:mime	text/troff
202570	regex/20l	\^\\.[A-Za-z0-9][A-Za-z0-9][\ \t]	troff or preprocessor input text
20258!:mime	text/troff
202590	regex/20l	\^\\.[A-Za-z0-9][A-Za-z0-9]$	troff or preprocessor input text
20260!:mime	text/troff
20261
20262# ditroff intermediate output text
202630	search/1	x\ T		ditroff output text
20264>4	search/1	cat		for the C/A/T phototypesetter
20265>4	search/1	ps		for PostScript
20266>4	search/1	dvi		for DVI
20267>4	search/1	ascii		for ASCII
20268>4	search/1	lj4		for LaserJet 4
20269>4	search/1	latin1		for ISO 8859-1 (Latin 1)
20270>4	search/1	X75		for xditview at 75dpi
20271>>7	search/1	-12		(12pt)
20272>4	search/1	X100		for xditview at 100dpi
20273>>8	search/1	-12		(12pt)
20274
20275# output data formats
202760	string		\100\357	very old (C/A/T) troff output data
20277
20278#------------------------------------------------------------------------------
20279# $File$
20280# tuxedo:	file(1) magic for BEA TUXEDO data files
20281#
20282# from Ian Springer <ispringer@hotmail.com>
20283#
202840	string		\0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0	BEA TUXEDO DES mask data
20285
20286#------------------------------------------------------------------------------
20287# $File$
20288# typeset:  file(1) magic for other typesetting
20289#
202900	string		Interpress/Xerox	Xerox InterPress data
20291>16	string		/			(version
20292>>17	string		>\0			%s)
20293
20294#------------------------------------------------------------------------------
20295# $File: unicode,v 1.5 2009/09/19 16:28:13 christos Exp $
20296# Unicode:  BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp>
20297# GRR: These types should be recognised in file_ascmagic so these
20298# encodings can be treated by text patterns.
20299# Missing types are already dealt with internally.
20300#
203010	string	+/v8			Unicode text, UTF-7
203020	string	+/v9			Unicode text, UTF-7
203030	string	+/v+			Unicode text, UTF-7
203040	string	+/v/			Unicode text, UTF-7
203050	string	\335\163\146\163	Unicode text, UTF-8-EBCDIC
203060	string	\000\000\376\377	Unicode text, UTF-32, big-endian
203070	string	\377\376\000\000	Unicode text, UTF-32, little-endian
203080	string	\016\376\377		Unicode text, SCSU (Standard Compression Scheme for Unicode)
20309
20310#------------------------------------------------------------------------------
20311# $File: unknown,v 1.7 2009/09/19 16:28:13 christos Exp $
20312# unknown:  file(1) magic for unknown machines
20313#
20314# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11
20315# (executable, pure, and split I&D, respectively), but the PDP-11 version
20316# doesn't have the "version %ld", which may be a bogus COFFism (I don't
20317# think there was ever COFF for the PDP-11).
20318#
20319# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
20320# long, as it would be on a VAX.  In any case, that could collide with
20321# VAX demand-paged files, as the magic number is little-endian on those
20322# binaries, so the first 16 bits of the file would contain 0x10B.
20323#
20324# Therefore, those entries are commented out.
20325#
20326# 0x10C is 0414 and 0x10E is 0416; those *are* unknown.
20327#
20328#0	short		0x107		unknown machine executable
20329#>8	short		>0		not stripped
20330#>15	byte		>0		- version %ld
20331#0	short		0x108		unknown pure executable
20332#>8	short		>0		not stripped
20333#>15	byte		>0		- version %ld
20334#0	short		0x109		PDP-11 separate I&D
20335#>8	short		>0		not stripped
20336#>15	byte		>0		- version %ld
20337#0	short		0x10b		unknown pure executable
20338#>8	short		>0		not stripped
20339#>15	byte		>0		- version %ld
203400	long		0x10c		unknown demand paged pure executable
20341>16	long		>0		not stripped
203420	long		0x10e		unknown readable demand paged pure executable
20343
20344#------------------------------------------------------------------------------
20345# $File: uterus,v 1.2 2014/04/28 12:04:50 christos Exp $
20346# file(1) magic for uterus files
20347# http://freecode.com/projects/uterus
20348#
203490	string		UTE+	uterus file
20350>4	string		v	\b, version
20351>5	byte		x	%c
20352>6	string		.	\b.
20353>7	byte		x	\b%c
20354>8	string		\<\>	\b, big-endian
20355>>16	belong		>0	\b, slut size %u
20356>8	string		\>\<	\b, litte-endian
20357>>16	lelong		>0	\b, slut size %u
20358>10	byte		&8	\b, compressed
20359
20360#------------------------------------------------------------------------------
20361# $File$
20362# uuencode:  file(1) magic for ASCII-encoded files
20363#
20364
20365# GRR:  the first line of xxencoded files is identical to that in uuencoded
20366# files, but the first character in most subsequent lines is 'h' instead of
20367# 'M'.  (xxencoding uses lowercase letters in place of most of uuencode's
20368# punctuation and survives BITNET gateways better.)  If regular expressions
20369# were supported, this entry could possibly be split into two with
20370# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
203710	search/1	begin\ 		uuencoded or xxencoded text
20372
20373# btoa(1) is an alternative to uuencode that requires less space.
203740	search/1	xbtoa\ Begin	btoa'd text
20375
20376# ship(1) is another, much cooler alternative to uuencode.
20377# Greg Roelofs, newt@uchicago.edu
203780	search/1	$\012ship	ship'd binary text
20379
20380# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
20381# Greg Roelofs, newt@uchicago.edu
203820	search/1	Decode\ the\ following\ with\ bdeco	bencoded News text
20383
20384# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
20385# Daniel Quinlan, quinlan@yggdrasil.com
2038611	search/1	must\ be\ converted\ with\ BinHex	BinHex binary text
20387>41	search/1	x					\b, version %.3s
20388
20389# GRR: handle BASE64
20390
20391#------------------------------------------------------------------------------
20392# $File: varied.out,v 1.22 2010/07/02 00:06:27 christos Exp $
20393# varied.out:  file(1) magic for various USG systems
20394#
20395#	Herewith many of the object file formats used by USG systems.
20396#	Most have been moved to files for a particular processor,
20397#	and deleted if they duplicate other entries.
20398#
203990	short		0610		Perkin-Elmer executable
20400# AMD 29K
204010	beshort		0572		amd 29k coff noprebar executable
204020	beshort		01572		amd 29k coff prebar executable
204030	beshort		0160007		amd 29k coff archive
20404# Cray
204056	beshort		0407		unicos (cray) executable
20406# Ultrix 4.3
20407596	string		\130\337\377\377	Ultrix core file
20408>600	string		>\0		from '%s'
20409# BeOS and MAcOS PEF executables
20410# From: hplus@zilker.net (Jon Watte)
204110	string		Joy!peffpwpc	header for PowerPC PEF executable
20412#
20413# ava assembler/linker Uros Platise <uros.platise@ijs.si>
204140       string          avaobj  AVR assembler object code
20415>7      string          >\0     version '%s'
20416# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr>
204170	string		gmon		GNU prof performance data
20418>4	long		x		- version %d
20419# From: Dave Pearson <davep@davep.org>
20420# Harbour <URL:http://harbour-project.org/> HRB files.
204210	string		\xc0HRB		Harbour HRB file
20422>4	leshort		x		version %d
20423# Harbour HBV files
204240	string		\xc0HBV		Harbour variable dump file
20425>4	leshort		x		version %d
20426
20427# From: Alex Beregszaszi <alex@fsn.hu>
20428# 0	string		exec 		BugOS executable
20429# 0	string		pack		BugOS archive
20430
20431# From: Jason Spence <jspence@lightconsulting.com>
20432# Generated by the "examples" in STM's ST40 devkit, and derived code.
204330	lelong		0x13a9f17e	ST40 component image format
20434>4	string		>\0		\b, name '%s'
20435
20436#------------------------------------------------------------------------------
20437# $File: varied.script,v 1.9 2011/12/16 16:32:48 rrt Exp $
20438# varied.script:  file(1) magic for various interpreter scripts
20439
204400	string/t		#!\ /			a
20441>3	string		>\0			%s script text executable
20442!:strength / 2
20443
204440	string/b		#!\ /			a
20445>3	string		>\0			%s script executable (binary data)
20446!:strength / 2
20447
204480	string/t		#!\t/			a
20449>3	string		>\0			%s script text executable
20450!:strength / 2
20451
204520	string/b		#!\t/			a
20453>3	string		>\0			%s script executable (binary data)
20454!:strength / 2
20455
204560	string/t		#!/			a
20457>2	string		>\0			%s script text executable
20458!:strength / 2
20459
204600	string/b		#!/			a
20461>2	string		>\0			%s script executable (binary data)
20462!:strength / 2
20463
204640	string/t		#!\ 			script text executable
20465>3	string		>\0			for %s
20466!:strength / 3
20467
204680	string/b		#!\ 			script executable
20469>3	string		>\0			for %s (binary data)
20470!:strength / 3
20471
20472# using env
204730	string/t	#!/usr/bin/env		a
20474>15	string/t	>\0			%s script text executable
20475!:strength / 10
20476
204770	string/b	#!/usr/bin/env		a
20478>15	string/b	>\0			%s script executable (binary data)
20479!:strength / 10
20480
204810	string/t	#!\ /usr/bin/env	a
20482>16	string/t	>\0			%s script text executable
20483!:strength / 10
20484
204850	string/b	#!\ /usr/bin/env	a
20486>16	string/b	>\0			%s script executable (binary data)
20487!:strength / 10
20488
20489# From: arno <arenevier@fdn.fr>
20490# mozilla xpconnect typelib
20491# see http://www.mozilla.org/scriptable/typelib_file.html
204920	string 		XPCOM\nTypeLib\r\n\032		XPConnect Typelib
20493>0x10  byte        x       version %d
20494>>0x11 byte        x      \b.%d
20495
20496#------------------------------------------------------------------------------
20497# $File: vax,v 1.8 2013/01/09 22:37:24 christos Exp $
20498# vax:  file(1) magic for VAX executable/object and APL workspace
20499#
205000	lelong		0101557		VAX single precision APL workspace
205010	lelong		0101556		VAX double precision APL workspace
20502
20503#
20504# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian
20505# executables, and are handled in aout)
20506#
205070	lelong		0420		a.out VAX demand paged (first page unmapped) pure executable
20508>16	lelong		>0		not stripped
20509
20510#
20511# VAX COFF
20512#
20513# The `versions' were commented out, but have been un-commented out.
20514# (Was the problem just one of endianness?)
20515#
205160	leshort		0570		VAX COFF executable
20517>12	lelong		>0		not stripped
20518>22	leshort		>0		- version %d
205190	leshort		0575		VAX COFF pure executable
20520>12	lelong		>0		not stripped
20521>22	leshort		>0		- version %d
20522
20523#------------------------------------------------------------------------------
20524# $File$
20525# vicar:  file(1) magic for VICAR files.
20526#
20527# From: Ossama Othman <othman@astrosun.tn.cornell.edu
20528# VICAR is JPL's in-house spacecraft image processing program
20529# VICAR image
205300	string	LBLSIZE=	VICAR image data
20531>32	string	BYTE		\b, 8 bits  = VAX byte
20532>32	string	HALF		\b, 16 bits = VAX word     = Fortran INTEGER*2
20533>32	string	FULL		\b, 32 bits = VAX longword = Fortran INTEGER*4
20534>32	string	REAL		\b, 32 bits = VAX longword = Fortran REAL*4
20535>32	string	DOUB		\b, 64 bits = VAX quadword = Fortran REAL*8
20536>32	string	COMPLEX		\b, 64 bits = VAX quadword = Fortran COMPLEX*8
20537# VICAR label file
2053843	string	SFDU_LABEL	VICAR label file
20539
20540#------------------------------------------------------------------------------
20541# $File: virtual,v 1.5 2014/04/30 21:41:02 christos Exp $
20542# From: James Nobis <quel@quelrod.net>
20543# Microsoft hard disk images for:
20544# Virtual Server
20545# Virtual PC
20546# http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx
20547# .vhd
205480	string	conectix	Microsoft Disk Image, Virtual Server or Virtual PC
20549
20550# libvirt
20551# From: Philipp Hahn <hahn@univention.de>
205520	string	LibvirtQemudSave	Libvirt QEMU Suspend Image
20553>0x10	lelong	x	\b, version %u
20554>0x14	lelong	x	\b, XML length %u
20555>0x18	lelong	1	\b, running
20556>0x1c	lelong	1	\b, compressed
20557
205580	string	LibvirtQemudPart	Libvirt QEMU partial Suspend Image
20559# From: Alex Beregszaszi <alex@fsn.hu>
205600	string/b	COWD		VMWare3
20561>4	byte	3		disk image
20562>>32	lelong	x		(%d/
20563>>36	lelong	x		\b%d/
20564>>40	lelong	x		\b%d)
20565>4	byte	2		undoable disk image
20566>>32	string	>\0		(%s)
20567
205680	string/b	VMDK		 VMware4 disk image
205690	string/b	KDMV		 VMware4 disk image
20570
20571#--------------------------------------------------------------------
20572# Qemu Emulator Images
20573# Lines written by Friedrich Schwittay (f.schwittay@yousable.de)
20574# Updated by Adam Buchbinder (adam.buchbinder@gmail.com)
20575# Made by reading sources, reading documentation, and doing trial and error
20576# on existing QCOW files
205770	string/b	QFI\xFB	QEMU QCOW Image
20578
20579# Uncomment the following line to display Magic (only used for debugging
20580# this magic number)
20581#>0	string/b	x	, Magic: %s
20582
20583# There are currently 2 Versions: "1" and "2".
20584# http://www.gnome.org/~markmc/qcow-image-format-version-1.html
20585>4	belong	1	(v1)
20586
20587# Using the existence of the Backing File Offset to determine whether
20588# to read Backing File Information
20589>>12	belong	 >0	 \b, has backing file (
20590# Note that this isn't a null-terminated string; the length is actually
20591# (16.L). Assuming a null-terminated string happens to work usually, but it
20592# may spew junk until it reaches a \0 in some cases.
20593>>>(12.L)	 string >\0	\bpath %s
20594
20595# Modification time of the Backing File
20596# Really useful if you want to know if your backing
20597# file is still usable together with this image
20598>>>>20	bedate >0	\b, mtime %s)
20599>>>>20	default x	\b)
20600
20601# Size is stored in bytes in a big-endian u64.
20602>>24	bequad	x	 \b, %lld bytes
20603
20604# 1 for AES encryption, 0 for none.
20605>>36	belong	1	\b, AES-encrypted
20606
20607# http://www.gnome.org/~markmc/qcow-image-format.html
20608>4	belong	2	(v2)
20609# Using the existence of the Backing File Offset to determine whether
20610# to read Backing File Information
20611>>8	bequad  >0	 \b, has backing file
20612# Note that this isn't a null-terminated string; the length is actually
20613# (16.L). Assuming a null-terminated string happens to work usually, but it
20614# may spew junk until it reaches a \0 in some cases. Also, since there's no
20615# .Q modifier, we just use the bottom four bytes as an offset. Note that if
20616# the file is over 4G, and the backing file path is stored after the first 4G,
20617# the wrong filename will be printed. (This should be (8.Q), when that syntax
20618# is introduced.)
20619>>>(12.L)	 string >\0	(path %s)
20620>>24	bequad	x	\b, %lld bytes
20621>>32	belong	1	\b, AES-encrypted
20622
20623>4	belong	3	(v3)
20624# Using the existence of the Backing File Offset to determine whether
20625# to read Backing File Information
20626>>8	bequad  >0	 \b, has backing file
20627# Note that this isn't a null-terminated string; the length is actually
20628# (16.L). Assuming a null-terminated string happens to work usually, but it
20629# may spew junk until it reaches a \0 in some cases. Also, since there's no
20630# .Q modifier, we just use the bottom four bytes as an offset. Note that if
20631# the file is over 4G, and the backing file path is stored after the first 4G,
20632# the wrong filename will be printed. (This should be (8.Q), when that syntax
20633# is introduced.)
20634>>>(12.L)	 string >\0	(path %s)
20635>>24	bequad	x	\b, %lld bytes
20636>>32	belong	1	\b, AES-encrypted
20637
20638>4	default x	(unknown version)
20639
206400	string/b	QEVM		QEMU suspend to disk image
20641
20642# QEMU QED Image
20643# http://wiki.qemu.org/Features/QED/Specification
206440	string/b	QED\0		QEMU QED Image
20645
20646# VDI Image
20647# Sun xVM VirtualBox Disk Image
20648# From: Richard W.M. Jones <rich@annexia.org>
20649# VirtualBox Disk Image
206500x40	ulelong		0xbeda107f	VirtualBox Disk Image
20651>0x44	uleshort	>0		\b, major %u
20652>0x46	uleshort	>0		\b, minor %u
20653>0	string		>\0		(%s)
20654>368	lequad		x		 \b, %lld bytes
20655
206560	string/b	Bochs\ Virtual\ HD\ Image	Bochs disk image,
20657>32	string	x				type %s,
20658>48	string	x				subtype %s
20659
206600	lelong	0x02468ace			Bochs Sparse disk image
20661
20662
20663#------------------------------------------------------------------------------
20664# $File$
20665# Virtutech Compressed Random Access File Format
20666#
20667# From <gustav@virtutech.com>
206680      string          \211\277\036\203        Virtutech CRAFF
20669>4     belong          x               v%d
20670>20    belong          0               uncompressed
20671>20    belong          1               bzipp2ed
20672>20    belong          2               gzipped
20673>24    belong          0               not clean
20674
20675#------------------------------------------------------------------------------
20676# $File$
20677# visx:  file(1) magic for Visx format files
20678#
206790	short		0x5555		VISX image file
20680>2	byte		0		(zero)
20681>2	byte		1		(unsigned char)
20682>2	byte		2		(short integer)
20683>2	byte		3		(float 32)
20684>2	byte		4		(float 64)
20685>2	byte		5		(signed char)
20686>2	byte		6		(bit-plane)
20687>2	byte		7		(classes)
20688>2	byte		8		(statistics)
20689>2	byte		10		(ascii text)
20690>2	byte		15		(image segments)
20691>2	byte		100		(image set)
20692>2	byte		101		(unsigned char vector)
20693>2	byte		102		(short integer vector)
20694>2	byte		103		(float 32 vector)
20695>2	byte		104		(float 64 vector)
20696>2	byte		105		(signed char vector)
20697>2	byte		106		(bit plane vector)
20698>2	byte		121		(feature vector)
20699>2	byte		122		(feature vector library)
20700>2	byte		124		(chain code)
20701>2	byte		126		(bit vector)
20702>2	byte		130		(graph)
20703>2	byte		131		(adjacency graph)
20704>2	byte		132		(adjacency graph library)
20705>2	string		.VISIX		(ascii text)
20706
20707#------------------------------------------------------------------------------
20708# $File: vms,v 1.8 2014/08/17 12:58:54 christos Exp $
20709# vms:  file(1) magic for VMS executables (experimental)
20710#
20711# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
20712
20713# GRR 950122:  I'm just guessing on these, based on inspection of the headers
20714# of three executables each for Alpha and VAX architectures.  The VAX files
20715# all had headers similar to this:
20716#
20717#   00000  b0 00 30 00 44 00 60 00  00 00 00 00 30 32 30 35  ..0.D.`.....0205
20718#   00010  01 01 00 00 ff ff ff ff  ff ff ff ff 00 00 00 00  ................
20719#
207200	string	\xb0\0\x30\0	VMS VAX executable
20721>44032	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
20722#
20723# The AXP files all looked like this, except that the byte at offset 0x22
20724# was 06 in some of them and 07 in others:
20725#
20726#   00000  03 00 00 00 00 00 00 00  ec 02 00 00 10 01 00 00  ................
20727#   00010  68 00 00 00 98 00 00 00  b8 00 00 00 00 00 00 00  h...............
20728#   00020  00 00 07 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
20729#   00030  00 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  ................
20730#   00040  00 00 00 00 ff ff ff ff  ff ff ff ff 02 00 00 00  ................
20731#
20732# GRR this test is still too general as it catches example adressen.dbt
207330	belong	0x03000000
20734>8	ubelong	0xec020000	VMS Alpha executable
20735>>75264	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
20736
20737#------------------------------------------------------------------------------
20738# $File$
20739# VMware specific files (deducted from version 1.1 and log file entries)
20740# Anthon van der Neut (anthon@mnt.org)
207410	belong	0x4d52564e	VMware nvram
20742
20743#------------------------------------------------------------------------------
20744# $File: vorbis,v 1.20 2014/09/23 16:35:08 christos Exp $
20745# vorbis:  file(1) magic for Ogg/Vorbis files
20746#
20747# From Felix von Leitner <leitner@fefe.de>
20748# Extended by Beni Cherniavsky <cben@crosswinds.net>
20749# Further extended by Greg Wooledge <greg@wooledge.org>
20750#
20751# Most (everything but the number of channels and bitrate) is commented
20752# out with `##' as it's not interesting to the average user.  The most
20753# probable things advanced users would want to uncomment are probably
20754# the number of comments and the encoder version.
20755#
20756# FIXME: The first match has been made a search, so that it can skip
20757# over prepended ID3 tags. This will work for MIME type detection, but
20758# won't work for detecting other properties of the file (they all need
20759# to be made relative to the search). In any case, if the file has ID3
20760# tags, the ID3 information will be printed, not the Ogg information,
20761# so until that's fixed, this doesn't matter.
20762# FIXME[2]: Disable the above for now, since search assumes text mode.
20763#
20764# --- Ogg Framing ---
20765#0		search/1000	OggS		Ogg data
207660		string	OggS		Ogg data
20767>4		byte		!0		UNKNOWN REVISION %u
20768##>4		byte		0		revision 0
20769>4		byte		0
20770##>>14		lelong		x		(Serial %lX)
20771# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net)
20772>>28		string		\x7fFLAC	\b, FLAC audio
20773# non-Vorbis content: Theora
20774!:mime		audio/ogg
20775>>28		string		\x80theora	\b, Theora video
20776!:mime		video/ogg
20777# non-Vorbis content: Kate
20778>>28		string		\x80kate\0\0\0\0	\b, Kate (Karaoke and Text)
20779!:mime		application/ogg
20780>>>37		ubyte		x		v%u
20781>>>38		ubyte		x		\b.%u,
20782>>>40		byte		0		utf8 encoding,
20783>>>40		byte		!0		unknown character encoding,
20784>>>60		string		>\0		language %s,
20785>>>60		string		\0		no language set,
20786>>>76		string		>\0		category %s
20787>>>76		string		\0		no category set
20788# non-Vorbis content: Skeleton
20789>>28		string		fishead\0	\b, Skeleton
20790!:mime		video/ogg
20791>>>36		leshort		x		v%u
20792>>>40		leshort		x		\b.%u
20793# non-Vorbis content: Speex
20794>>28		string		Speex\ \ \ 	\b, Speex audio
20795!:mime		audio/ogg
20796# non-Vorbis content: OGM
20797>>28		string		\x01video\0\0\0	\b, OGM video
20798!:mime		video/ogg
20799>>>37		string/c	div3		(DivX 3)
20800>>>37		string/c	divx		(DivX 4)
20801>>>37		string/c	dx50		(DivX 5)
20802>>>37		string/c	xvid		(XviD)
20803# --- First vorbis packet - general header ---
20804>>28		string		\x01vorbis	\b, Vorbis audio,
20805!:mime		audio/ogg
20806>>>35		lelong		!0		UNKNOWN VERSION %u,
20807##>>>35		lelong		0		version 0,
20808>>>35		lelong		0
20809>>>>39		ubyte		1		mono,
20810>>>>39		ubyte		2		stereo,
20811>>>>39		ubyte		>2		%u channels,
20812>>>>40		lelong		x		%u Hz
20813# Minimal, nominal and maximal bitrates specified when encoding
20814>>>>48		string		<\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	\b,
20815# The above tests if at least one of these is specified:
20816>>>>>52		lelong		!-1
20817# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields
20818# instead of -1.
20819# Vorbis 1.0 uses 0 instead of -1.
20820>>>>>>52	lelong		!0
20821>>>>>>>52	lelong		!-1000
20822>>>>>>>>52	lelong		x		<%u
20823>>>>>48		lelong		!-1
20824>>>>>>48	lelong		x		~%u
20825>>>>>44		lelong		!-1
20826>>>>>>44	lelong		!-1000
20827>>>>>>>44	lelong		!0
20828>>>>>>>>44	lelong		x		>%u
20829>>>>>48		string		<\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	bps
20830# -- Second vorbis header packet - the comments
20831# A kludge to read the vendor string.  It's a counted string, not a
20832# zero-terminated one, so file(1) can't read it in a generic way.
20833# libVorbis is the only one existing currently, so I detect specifically
20834# it.  The interesting value is the cvs date (8 digits decimal).
20835# Post-RC1 Ogg files have the second header packet (and thus the version)
20836# in a different place, so we must use an indirect offset.
20837>>>(84.b+85)		string		\x03vorbis
20838>>>>(84.b+96)		string/c	Xiphophorus\ libVorbis\ I	\b, created by: Xiphophorus libVorbis I
20839>>>>>(84.b+120)		string		>00000000
20840# Map to beta version numbers:
20841>>>>>>(84.b+120)	string		<20000508	(<beta1, prepublic)
20842>>>>>>(84.b+120)	string		20000508	(1.0 beta 1 or beta 2)
20843>>>>>>(84.b+120)	string		>20000508
20844>>>>>>>(84.b+120)	string		<20001031	(beta2-3)
20845>>>>>>(84.b+120)	string		20001031	(1.0 beta 3)
20846>>>>>>(84.b+120)	string		>20001031
20847>>>>>>>(84.b+120)	string		<20010225	(beta3-4)
20848>>>>>>(84.b+120)	string		20010225	(1.0 beta 4)
20849>>>>>>(84.b+120)	string		>20010225
20850>>>>>>>(84.b+120)	string		<20010615	(beta4-RC1)
20851>>>>>>(84.b+120)	string		20010615	(1.0 RC1)
20852>>>>>>(84.b+120)	string		20010813	(1.0 RC2)
20853>>>>>>(84.b+120)	string		20010816	(RC2 - Garf tuned v1)
20854>>>>>>(84.b+120)	string		20011014	(RC2 - Garf tuned v2)
20855>>>>>>(84.b+120)	string		20011217	(1.0 RC3)
20856>>>>>>(84.b+120)	string		20011231	(1.0 RC3)
20857# Some pre-1.0 CVS snapshots still had "Xiphphorus"...
20858>>>>>>(84.b+120)	string		>20011231	(pre-1.0 CVS)
20859# For the 1.0 release, Xiphophorus is replaced by Xiph.Org
20860>>>>(84.b+96)		string/c	Xiph.Org\ libVorbis\ I	\b, created by: Xiph.Org libVorbis I
20861>>>>>(84.b+117)		string		>00000000
20862>>>>>>(84.b+117)	string		<20020717	(pre-1.0 CVS)
20863>>>>>>(84.b+117)	string		20020717	(1.0)
20864>>>>>>(84.b+117)	string		20030909	(1.0.1)
20865>>>>>>(84.b+117)	string		20040629	(1.1.0 RC1)
20866
20867#------------------------------------------------------------------------------
20868# $File$
20869# VXL: file(1) magic for VXL binary IO data files
20870#
20871# from Ian Scott <scottim@sf.net>
20872#
20873# VXL is a collection of C++ libraries for Computer Vision.
20874# See the vsl chapter in the VXL Book for more info
20875# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html
20876# http:/vxl.sf.net
20877
208782	lelong	0x472b2c4e	VXL data file,
20879>0	leshort	>0		schema version no %d
20880
20881#------------------------------------------------------------------------------
20882# $File: warc,v 1.2 2009/09/19 16:28:13 christos Exp $
20883# warc:  file(1) magic for WARC files
20884
208850	string	WARC/	WARC Archive
20886>5	string	x	version %.4s
20887!:mime application/warc
20888
20889#------------------------------------------------------------------------------
20890# Arc File Format from Internet Archive
20891# see http://www.archive.org/web/researcher/ArcFileFormat.php
208920      string          filedesc://     Internet Archive File
20893!:mime application/x-ia-arc
20894>11    search/256      \x0A    \b
20895>>&0   ubyte   >0      \b version %c
20896
20897#------------------------------------------------------------------------------
20898# weak:  file(1) magic for very weak magic entries, disabled by default
20899#
20900# These entries are so weak that they might interfere identification of
20901# other formats. Example include:
20902# - Only identify for 1 or 2 bytes
20903# - Match against very wide range of values
20904# - Match against generic word in some spoken languages (e.g. English)
20905
20906# Summary: Computer Graphics Metafile
20907# Extension: .cgm
20908#0	beshort&0xffe0	0x0020		binary Computer Graphics Metafile
20909#0	beshort		0x3020		character Computer Graphics Metafile
20910
20911#0	string		=!!		Bennet Yee's "face" format
20912
20913#------------------------------------------------------------------------------
20914# $File: windows,v 1.9 2014/09/23 23:42:44 christos Exp $
20915# windows:  file(1) magic for Microsoft Windows
20916#
20917# This file is mainly reserved for files where programs
20918# using them are run almost always on MS Windows 3.x or
20919# above, or files only used exclusively in Windows OS,
20920# where there is no better category to allocate for.
20921# For example, even though WinZIP almost run on Windows
20922# only, it is better to treat them as "archive" instead.
20923# For format usable in DOS, such as generic executable
20924# format, please specify under "msdos" file.
20925#
20926
20927
20928# Summary: Outlook Express DBX file
20929# Extension: .dbx
20930# Created by: Christophe Monniez
209310	string	\xCF\xAD\x12\xFE	MS Outlook Express DBX file
20932>4	byte	=0xC5			\b, message database
20933>4	byte	=0xC6			\b, folder database
20934>4	byte	=0xC7			\b, account information
20935>4	byte	=0x30			\b, offline database
20936
20937
20938# Summary: Windows crash dump
20939# Extension: .dmp
20940# Created by: Andreas Schuster (http://computer.forensikblog.de/)
20941# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html
20942# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only)
209430	string		PAGE
20944>4	string		DUMP		MS Windows 32bit crash dump
20945>>0x05c	byte            0		\b, no PAE
20946>>0x05c	byte            1		\b, PAE
20947>>0xf88	lelong		1		\b, full dump
20948>>0xf88	lelong		2		\b, kernel dump
20949>>0xf88	lelong		3		\b, small dump
20950>>0x068	lelong		x		\b, %d pages
20951>4	string		DU64		MS Windows 64bit crash dump
20952>>0xf98	lelong		1		\b, full dump
20953>>0xf98	lelong		2		\b, kernel dump
20954>>0xf98	lelong		3		\b, small dump
20955>>0x090	lequad		x		\b, %lld pages
20956
20957
20958# Summary: Vista Event Log
20959# Extension: .evtx
20960# Created by: Andreas Schuster (http://computer.forensikblog.de/)
20961# Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html
209620	string		ElfFile\0	MS Windows Vista Event Log
20963>0x2a	leshort		x		\b, %d chunks
20964>>0x10	lelong		x		\b (no. %d in use)
20965>0x18	lelong		>1		\b, next record no. %d
20966>0x18	lelong		=1		\b, empty
20967>0x78	lelong		&1		\b, DIRTY
20968>0x78	lelong		&2		\b, FULL
20969
20970
20971# Summary: Windows 3.1 group files
20972# Extension: .grp
20973# Created by: unknown
209740	string		\120\115\103\103	MS Windows 3.1 group files
20975
20976
20977# Summary: Old format help files
20978# Extension: .hlp
20979# Created by: Dirk Jagdmann <doj@cubic.org>
209800	lelong		0x00035f3f		MS Windows 3.x help file
20981
20982
20983# Summary: Hyper terminal
20984# Extension: .ht
20985# Created by: unknown
209860	string		HyperTerminal\
20987>15	string		1.0\ --\ HyperTerminal\ data\ file	MS Windows HyperTerminal profile
20988
20989# http://ithreats.files.wordpress.com/2009/05/\
20990# lnk_the_windows_shortcut_file_format.pdf
20991# Summary: Windows shortcut
20992# Extension: .lnk
20993# Created by: unknown
20994# 'L' + GUUID
209950	string		\114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106	MS Windows shortcut
20996>20	lelong&1	1	\b, Item id list present
20997>20	lelong&2	2	\b, Points to a file or directory
20998>20	lelong&4	4	\b, Has Description string
20999>20	lelong&8	8	\b, Has Relative path
21000>20	lelong&16	16	\b, Has Working directory
21001>20	lelong&32	32	\b, Has command line arguments
21002>20	lelong&64	64	\b, Icon
21003>>56	lelong			\b number=%d
21004>24	lelong&1	1	\b, Read-Only
21005>24	lelong&2	2	\b, Hidden
21006>24	lelong&4	4	\b, System
21007>24	lelong&8	8	\b, Volume Label
21008>24	lelong&16	16	\b, Directory
21009>24	lelong&32	32	\b, Archive
21010>24	lelong&64	64	\b, Encrypted
21011>24	lelong&128	128	\b, Normal
21012>24	lelong&256	256	\b, Temporary
21013>24	lelong&512	512	\b, Sparse
21014>24	lelong&1024	1024	\b, Reparse point
21015>24	lelong&2048	2048	\b, Compressed
21016>24	lelong&4096	4096	\b, Offline
21017>28	leqwdate	x	\b, ctime=%s
21018>36	leqwdate	x	\b, mtime=%s
21019>44	leqwdate	x	\b, atime=%s
21020>52	lelong		x	\b, length=%u, window=
21021>60	lelong&1	1	\bhide
21022>60	lelong&2	2	\bnormal
21023>60	lelong&4	4	\bshowminimized
21024>60	lelong&8	8	\bshowmaximized
21025>60	lelong&16	16	\bshownoactivate
21026>60	lelong&32	32	\bminimize
21027>60	lelong&64	64	\bshowminnoactive
21028>60	lelong&128	128	\bshowna
21029>60	lelong&256	256	\brestore
21030>60	lelong&512	512	\bshowdefault
21031#>20	lelong&1	0
21032#>>20	lelong&2	2
21033#>>>(72.l-64)	pstring/h	x	\b [%s]
21034#>20	lelong&1	1
21035#>>20	lelong&2	2
21036#>>>(72.s)	leshort	x
21037#>>>&75	pstring/h	x	\b [%s]
21038
21039# Summary: Outlook Personal Folders
21040# Created by: unknown
210410	lelong		0x4E444221	Microsoft Outlook email folder
21042>10	leshort		0x0e		(<=2002)
21043>10	leshort		0x17		(>=2003)
21044
21045
21046# Summary: Windows help cache
21047# Created by: unknown
210480	string		\164\146\115\122\012\000\000\000\001\000\000\000	MS Windows help cache
21049
21050
21051# Summary: IE cache file
21052# Created by: Christophe Monniez
210530	string	Client\ UrlCache\ MMF 	Internet Explorer cache file
21054>20	string	>\0			version %s
21055
21056
21057# Summary: Registry files
21058# Created by: unknown
21059# Modified by (1): Joerg Jenderek
210600	string		regf		MS Windows registry file, NT/2000 or above
210610	string		CREG		MS Windows 95/98/ME registry file
210620	string		SHCC3		MS Windows 3.1 registry file
21063
21064
21065# Summary: Windows Registry text
21066# Extension: .reg
21067# Submitted by: Abel Cheung <abelcheung@gmail.com>
210680	string		REGEDIT4\r\n\r\n	Windows Registry text (Win95 or above)
210690	string		Windows\ Registry\ Editor\
21070>&0	string		Version\ 5.00\r\n\r\n	Windows Registry text (Win2K or above)
21071
21072# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013
21073# empty ,comment , section
21074# PR/383: remove unicode BOM because it is not portable across regex impls
210750	regex/s		\\`(\\r\\n|;|[[])
21076# left bracket in section line
21077>&0	search/8192	[
21078# http://en.wikipedia.org/wiki/Autorun.inf
21079# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx
21080>>&0	regex/c		\^(autorun)]\r\n
21081>>>&0	ubyte		=0x5b						INItialization configuration
21082!:mime application/x-wine-extension-ini
21083# From: Pal Tamas <folti@balabit.hu>
21084# Autorun File
21085>>>&0	ubyte		!0x5b						Microsoft Windows Autorun file
21086!:mime application/x-setupscript
21087# http://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx
21088# version strings ASCII coded case-independent for Windows setup information script file
21089>>&0	regex/c		\^(version|strings)]				Windows setup INFormation
21090!:mime	application/x-setupscript
21091#!:mime application/inf
21092#!:mime application/x-wine-extension-inf
21093>>&0	regex/c		\^(WinsockCRCList|OEMCPL)]			Windows setup INFormation
21094!:mime	text/inf
21095# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm
21096# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx
21097# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent
21098>>&0	regex/c	\^(\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)]	Windows desktop.ini
21099!:mime application/x-wine-extension-ini
21100#!:mime text/plain
21101# http://support.microsoft.com/kb/84709/
21102>>&0	regex/c		\^(don't\ load)]				Windows CONTROL.INI
21103!:mime application/x-wine-extension-ini
21104>>&0	regex/c		\^(ndishlp\\$|protman\\$|NETBEUI\\$)]		Windows PROTOCOL.INI
21105!:mime application/x-wine-extension-ini
21106# http://technet.microsoft.com/en-us/library/cc722567.aspx
21107# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm
21108>>&0	regex/c		\^(windows|Compatibility|embedding)]		Windows WIN.INI
21109!:mime application/x-wine-extension-ini
21110# http://en.wikipedia.org/wiki/SYSTEM.INI
21111>>&0	regex/c		\^(boot|386enh|drivers)]			Windows SYSTEM.INI
21112!:mime application/x-wine-extension-ini
21113# http://www.mdgx.com/newtip6.htm
21114>>&0	regex/c		\^(SafeList)]					Windows IOS.INI
21115!:mime application/x-wine-extension-ini
21116# http://en.wikipedia.org/wiki/NTLDR	Windows Boot Loader information
21117>>&0	regex/c		\^(boot\x20loader)]				Windows boot.ini
21118!:mime application/x-wine-extension-ini
21119>>>&0	ubyte		x
21120# http://en.wikipedia.org/wiki/CONFIG.SYS
21121>>&0	regex/c		\^(menu)]\r\n					MS-DOS CONFIG.SYS
21122# http://support.microsoft.com/kb/118579/
21123>>&0	regex/c		\^(Paths)]\r\n					MS-DOS MSDOS.SYS
21124# VERS string unicoded case-independent
21125>>&0	ubequad&0xFFdfFFdfFFdfFFdf	0x0056004500520053
21126# ION] string unicoded case-independent
21127>>>&0	ubequad&0xFFdfFFdfFFdfFFff	0x0049004f004e005d		Windows setup INFormation
21128!:mime application/x-setupscript
21129# STRI string unicoded case-independent
21130>>&0	ubequad&0xFFdfFFdfFFdfFFdf	0x0053005400520049
21131# NGS] string unicoded case-independent
21132>>>&0	ubequad&0xFFdfFFdfFFdfFFff	0x004e00470053005D		Windows setup INFormation
21133!:mime application/x-setupscript
21134# unknown keyword after opening bracket
21135>>&0	default				x
21136>>>&0	search/8192			[
21137# version Strings FileIdentification
21138>>>>&0	string/c			version				Windows setup INFormation
21139!:mime application/x-setupscript
21140# VERS string unicoded case-independent
21141>>>>&0	ubequad&0xFFdfFFdfFFdfFFdf	0x0056004500520053
21142# ION] string unicoded case-independent
21143>>>>>&0	ubequad&0xFFdfFFdfFFdfFFff	0x0049004f004e005d		Windows setup INFormation
21144!:mime application/x-setupscript
21145# http://en.wikipedia.org/wiki/Initialization_file	Windows Initialization File or other
21146#>>>>&0	default				x				Generic INItialization configuration
21147#!:mime application/x-wine-extension-ini
21148
21149# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h
21150# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm
21151# GRR: line below too general as it catches also PDP-11 UNIX/RT ldp
211520		leshort&0xFeFe	0x0000
21153# test for unused null bits in PNF_FLAGs
21154>4	ulelong&0xFCffFe00	0x00000000
21155# only found 58h for Offset of WinDirPath immediately after _PNF_HEADER structure
21156>>68		ulelong		>0x57
21157# test for zero high byte of InfValueBlockSize, followed by WinDirPath like
21158# C:\WINDOWS (ASCII 0x433a5c.. , unicode 0x43003a005c..) or X:\MININT
21159>>>(68.l-1)	ubelong&0xffE0C519	=0x00400018	Windows Precompiled iNF
21160!:mime	application/x-pnf
21161# currently only found Major Version=1 and Minor Version=1
21162#>>>>0		uleshort	=0x0101
21163#>>>>>1		ubyte		x		\b, version %u
21164#>>>>>0		ubyte		x		\b.%u
21165>>>>0		uleshort	!0x0101
21166>>>>>1		ubyte		x		\b, version %u
21167>>>>>0		ubyte		x		\b.%u
21168# 1 ,2 (windows 98 SE)
21169#>>>>2		uleshort	=2		\b, InfStyle %u
21170>>>>2		uleshort	!2		\b, InfStyle %u
21171#	PNF_FLAG_IS_UNICODE		0x00000001
21172#	PNF_FLAG_HAS_STRINGS		0x00000002
21173#	PNF_FLAG_SRCPATH_IS_URL		0x00000004
21174#	PNF_FLAG_HAS_VOLATILE_DIRIDS	0x00000008
21175#	PNF_FLAG_INF_VERIFIED		0x00000010
21176#	PNF_FLAG_INF_DIGITALLY_SIGNED	0x00000020
21177#	??				0x00000100
21178#	??				0x01000000
21179#	??				0x02000000
21180>>>>4	ulelong&0x00000001	0x00000001	\b, unicoded
21181>>>>4	ulelong&0x00000020	0x00000020	\b, digitally signed
21182#>>>>8		ulelong		x		\b, InfSubstValueListOffset 0x%x
21183# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF
21184#>>>>12		uleshort	x		\b, InfSubstValueCount 0x%x
21185# only < 9 found
21186#>>>>14		uleshort	x		\b, InfVersionDatumCount 0x%x
21187# only found values lower 0x0000ffff
21188#>>>>16		ulelong		x		\b, InfVersionDataSize 0x%x
21189# only found positive values lower 0x00ffFFff for InfVersionDataOffset
21190>>>>20		ulelong		x		\b, at 0x%x
21191>>>>4	ulelong&0x00000001	=0x00000001
21192# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature
21193>>>>>(20.l)	lestring16	x		"%s"
21194>>>>4	ulelong&0x00000001	!0x00000001
21195>>>>>(20.l)	string		x		"%s"
21196# FILETIME is number of 100-nanosecond intervals since 1 January 1601
21197#>>>>24		ulequad		x		\b, InfVersionLastWriteTime %16.16llx
21198# only found values lower 0x00ffFFff
21199#>>>>32		ulelong		x		\b, StringTableBlockOffset 0x%x
21200#>>>>36		ulelong		x		\b, StringTableBlockSize 0x%x
21201#>>>>40		ulelong		x		\b, InfSectionCount 0x%x
21202#>>>>44		ulelong		x		\b, InfSectionBlockOffset 0x%x
21203#>>>>48		ulelong		x		\b, InfSectionBlockSize 0x%x
21204#>>>>52		ulelong		x		\b, InfLineBlockOffset 0x%x
21205#>>>>56		ulelong		x		\b, InfLineBlockSize 0x%x
21206#>>>>60		ulelong		x		\b, InfValueBlockOffset 0x%x
21207#>>>>64		ulelong		x		\b, InfValueBlockSize 0x%x
21208# WinDirPathOffset
21209#>>>>68		ulelong		x		\b, at 0x%x
21210>>>>68		ulelong		>0x57
21211>>>>>4	ulelong&0x00000001	=0x00000001
21212>>>>>>(68.l)	ubequad		=0x43003a005c005700
21213# normally unicoded C:\Windows
21214#>>>>>>>(68.l)	lestring16	x		\b, WinDirPath "%s"
21215>>>>>>(68.l)	ubequad		!0x43003a005c005700
21216>>>>>>>(68.l)	lestring16	x		\b, WinDirPath "%s"
21217>>>>>4	ulelong&0x00000001	!0x00000001
21218# normally ASCII C:\WINDOWS
21219#>>>>>>(68.l)	string		=C:\\WINDOWS	\b, WinDirPath "%s"
21220>>>>>>(68.l)	string		!C:\\WINDOWS	\b, WinDirPath "%s"
21221# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF
21222#>>>>72		ulelong		>0		\b, at 0x%x
21223>>>>72		ulelong		>0		\b,
21224>>>>>4	ulelong&0x00000001	=0x00000001
21225>>>>>>(72.l)	lestring16	x		OsLoaderPath "%s"
21226>>>>>4	ulelong&0x00000001	!0x00000001
21227# seldom C:\ instead empty
21228>>>>>>(72.l)	string		x		OsLoaderPath "%s"
21229# 1fdh
21230#>>>>76		uleshort	x		\b, StringTableHashBucketCount 0x%x
21231>>>>78		uleshort	!0x407		\b, LanguageId %x
21232# only 407h found
21233#>>>>78		uleshort	=0x407		\b, LanguageId %x
21234# InfSourcePathOffset often 0
21235#>>>>80		ulelong		>0		\b, at 0x%x
21236>>>>80		ulelong		>0		\b,
21237>>>>>4	ulelong&0x00000001	=0x00000001
21238>>>>>>(80.l)	lestring16	x		SourcePath "%s"
21239>>>>>4	ulelong&0x00000001	!0x00000001
21240>>>>>>(80.l)	string		>\0		SourcePath "%s"
21241# OriginalInfNameOffset often 0
21242#>>>>84		ulelong		>0		\b, at 0x%x
21243>>>>84		ulelong		>0		\b,
21244>>>>>4	ulelong&0x00000001	=0x00000001
21245>>>>>>(84.l)	lestring16	x		InfName "%s"
21246>>>>>4	ulelong&0x00000001	!0x00000001
21247>>>>>>(84.l)	string		>\0		InfName "%s"
21248
21249
21250#------------------------------------------------------------------------------
21251# $File$
21252# wireless-regdb:        file(1) magic for CRDA wireless-regdb file format
21253#
212540	string	RGDB	CRDA wireless regulatory database file
21255>4	belong	19	(Version 1)
21256
21257#------------------------------------------------------------------------------
21258# $File: wordprocessors,v 1.17 2013/02/06 14:18:52 christos Exp $
21259# wordprocessors:  file(1) magic fo word processors.
21260#
21261####### PWP file format used on Smith Corona Personal Word Processors:
212622	string	\040\040\040\040\040\040\040\040\040\040\040ML4D\040'92	Smith Corona PWP
21263>24	byte	2	\b, single spaced
21264>24	byte	3	\b, 1.5 spaced
21265>24	byte	4	\b, double spaced
21266>25	byte	0x42	\b, letter
21267>25	byte	0x54	\b, legal
21268>26	byte	0x46	\b, A4
21269
21270#WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
212710	string	\377WPC\020\000\000\000\022\012\001\001\000\000\000\000	(WP) loadable file
21272>15	byte	0	Optimized for Intel
21273>15	byte	1	Optimized for Non-Intel
212741	string	WPC	(Corel/WP)
21275>8	short	257	WordPerfect macro
21276>8	short	258	WordPerfect help file
21277>8	short	259	WordPerfect keyboard file
21278>8	short	266	WordPerfect document
21279>8	short	267	WordPerfect dictionary
21280>8	short	268	WordPerfect thesaurus
21281>8	short	269	WordPerfect block
21282>8	short	270	WordPerfect rectangular block
21283>8	short	271	WordPerfect column block
21284>8	short	272	WordPerfect printer data
21285>8	short	275	WordPerfect printer data
21286>8	short	276	WordPerfect driver resource data
21287>8	short	279	WordPerfect hyphenation code
21288>8	short	280	WordPerfect hyphenation data
21289>8	short	281	WordPerfect macro resource data
21290>8	short	283	WordPerfect hyphenation lex
21291>8	short	285	WordPerfect wordlist
21292>8	short	286	WordPerfect equation resource data
21293>8	short	289	WordPerfect spell rules
21294>8	short	290	WordPerfect dictionary rules
21295>8	short	295	WordPerfect spell rules (Microlytics)
21296>8	short	299	WordPerfect settings file
21297>8	short	301	WordPerfect 4.2 document
21298>8	short	325	WordPerfect dialog file
21299>8	short	332	WordPerfect button bar
21300>8	short	513	Shell macro
21301>8	short	522	Shell definition
21302>8	short	769	Notebook macro
21303>8	short	770	Notebook help file
21304>8	short	771	Notebook keyboard file
21305>8	short	778	Notebook definition
21306>8	short	1026	Calculator help file
21307>8	short 	1538	Calendar help file
21308>8	short 	1546	Calendar data file
21309>8	short	1793	Editor macro
21310>8	short	1794	Editor help file
21311>8	short	1795	Editor keyboard file
21312>8	short	1817	Editor macro resource file
21313>8	short 	2049	Macro editor macro
21314>8	short 	2050	Macro editor help file
21315>8	short	2051	Macro editor keyboard file
21316>8	short	2305	PlanPerfect macro
21317>8	short	2306	PlanPerfect help file
21318>8	short	2307	PlanPerfect keyboard file
21319>8	short	2314	PlanPerfect worksheet
21320>8	short	2319	PlanPerfect printer definition
21321>8	short	2322	PlanPerfect graphic definition
21322>8	short	2323	PlanPerfect data
21323>8	short	2324	PlanPerfect temporary printer
21324>8	short	2329	PlanPerfect macro resource data
21325>8	byte	11	Mail
21326>8	short	2818	help file
21327>8	short	2821	distribution list
21328>8	short	2826	out box
21329>8	short	2827	in box
21330>8	short	2836	users archived mailbox
21331>8	short	2837	archived message database
21332>8	short	2838	archived attachments
21333>8	short	3083	Printer temporary file
21334>8	short	3330	Scheduler help file
21335>8	short	3338	Scheduler in file
21336>8	short	3339	Scheduler out file
21337>8	short	3594	GroupWise settings file
21338>8	short	3601	GroupWise directory services
21339>8	short	3627	GroupWise settings file
21340>8	short	4362	Terminal resource data
21341>8	short	4363	Terminal resource data
21342>8	short	4395	Terminal resource data
21343>8	short	4619	GUI loadable text
21344>8	short	4620	graphics resource data
21345>8	short	4621	printer settings file
21346>8	short	4622	port definition file
21347>8	short	4623	print queue parameters
21348>8	short	4624	compressed file
21349>8	short	5130	Network service msg file
21350>8	short	5131	Network service msg file
21351>8	short	5132	Async gateway login msg
21352>8	short	5134	GroupWise message file
21353>8	short	7956	GroupWise admin domain database
21354>8	short	7957	GroupWise admin host database
21355>8	short	7959	GroupWise admin remote host database
21356>8	short	7960	GroupWise admin ADS deferment data file
21357>8	short	8458	IntelliTAG (SGML) compiled DTD
21358>8	long	18219264	WordPerfect graphic image (1.0)
21359>8	long	18219520	WordPerfect graphic image (2.0)
21360#end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
21361
21362# Hangul (Korean) Word Processor File
213630	string	HWP\ Document\ File	Hangul (Korean) Word Processor File 3.0
21364# From: Won-Kyu Park <wkpark@kldp.org>
21365512	string		R\0o\0o\0t\0	Hangul (Korean) Word Processor File 2000
21366!:mime	application/x-hwp
21367
21368# CosmicBook, from Benoit Rouits
213690       string  CSBK    Ted Neslson's CosmicBook hypertext file
21370
213712       string  EYWR    AmigaWriter file
21372
21373# chi:  file(1) magic for ChiWriter files
213740       string          \\1cw\          ChiWriter file
21375>5      string          >\0             version %s
213760       string          \\1cw           ChiWriter file
21377
21378# Quark Express from http://www.garykessler.net/library/file_sigs.html
213792	string	IIXPR3			Intel Quark Express Document (English)
213802	string	IIXPRa			Intel Quark Express Document (Korean)
213812	string	MMXPR3			Motorola Quark Express Document (English)
21382!:mime	application/x-quark-xpress-3
213832	string	MMXPRa			Motorola Quark Express Document (Korean)
21384
21385# adobe indesign (document, whatever...) from querkan
213860	belong	0x0606edf5		Adobe InDesign
21387>16	string	DOCUMENT		Document
21388
21389#------------------------------------------------------------------------------
21390# ichitaro456: file(1) magic for Just System Word Processor Ichitaro
21391#
21392# Contributor kenzo-:
21393# Reversed-engineered JS Ichitaro magic numbers
21394#
21395
213960	string		DOC
21397>43	byte		0x14	Just System Word Processor Ichitaro v4
21398!:mime	application/x-ichitaro4
21399>144	string	JDASH		application/x-ichitaro4
21400
214010	string		DOC
21402>43	byte		0x15	Just System Word Processor Ichitaro v5
21403!:mime	application/x-ichitaro5
21404
214050	string		DOC
21406>43	byte		0x16	Just System Word Processor Ichitaro v6
21407!:mime	application/x-ichitaro6
21408
21409# Type: Freemind mindmap documents
21410# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk>
214110	string/w	\<map\ version	Freemind document
21412!:mime	application/x-freemind
21413
21414# Type: Freeplane mindmap documents
21415# From: Felix Natter <fnatter@gmx.net>
214160       string/w        \<map\ version="freeplane  Freeplane document
21417!:mime  application/x-freeplane
21418
21419# Type:        Scribus
21420# From:        Werner Fink <werner@suse.de>
214210	string	\<SCRIBUSUTF8\ Version		Scribus Document
214220	string	\<SCRIBUSUTF8NEW\ Version	Scribus Document
21423!:mime	application/x-scribus
21424
21425# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek
21426# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14
214270	ulelong&0x8080FFFF	0x00001204	gfxboot compiled html help file
21428
21429#------------------------------------------------------------------------------
21430# $File: wsdl,v 1.2 2013/02/05 15:20:47 christos Exp $
21431# wsdl: PHP WSDL Cache, http://www.php.net/manual/en/book.soap.php
21432# Cache format extracted from source:
21433# http://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup
21434# Requires file >= 5.05, see http://mx.gw.com/pipermail/file/2010/000683.html
21435# By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011
214360		string		wsdl		PHP WSDL cache,
21437>4		byte		x		version 0x%02x
21438>6		ledate		x		\b, created %s
21439
21440# uri
21441>10		lelong		<0x7fffffff
21442>>10		pstring/l	x		\b, uri: "%s"
21443
21444# source
21445>>>&0		lelong		<0x7fffffff
21446>>>>&-4		pstring/l	x		\b, source: "%s"
21447
21448# target_ns
21449>>>>>&0		lelong		<0x7fffffff
21450>>>>>>&-4	pstring/l	x		\b, target_ns: "%s"
21451
21452#------------------------------------------------------------------------------
21453# $File: xdelta,v 1.4 2009/09/19 16:28:13 christos Exp $
21454# file(1) magic(5) data for xdelta  Josh MacDonald <jmacd@CS.Berkeley.EDU>
21455#
214560	string	%XDELTA%	XDelta binary patch file 0.14
214570	string	%XDZ000%	XDelta binary patch file 0.18
214580	string	%XDZ001%	XDelta binary patch file 0.20
214590	string	%XDZ002%	XDelta binary patch file 1.0
214600	string	%XDZ003%	XDelta binary patch file 1.0.4
214610	string	%XDZ004%	XDelta binary patch file 1.1
21462
214630	string \xD6\xC3\xC4\x00	VCDIFF binary diff
21464
21465#------------------------------------------------------------------------------
21466# $File$
21467# xenix:  file(1) magic for Microsoft Xenix
21468#
21469# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
21470# model" lifted from "magic.xenix", with comment "derived empirically;
21471# treat as folklore until proven"
21472#
21473# "small model", "large model", "huge model" stuff lifted from XXX
21474#
21475# XXX - "x.out" collides with PDP-11 archives
21476#
214770	string		core		core file (Xenix)
214780	byte		0x80		8086 relocatable (Microsoft)
214790	leshort		0xff65		x.out
21480>2	string		__.SYMDEF	 randomized
21481>0	byte		x		archive
214820	leshort		0x206		Microsoft a.out
21483>8	leshort		1		Middle model
21484>0x1e	leshort		&0x10		overlay
21485>0x1e	leshort		&0x2		separate
21486>0x1e	leshort		&0x4		pure
21487>0x1e	leshort		&0x800		segmented
21488>0x1e	leshort		&0x400		standalone
21489>0x1e	leshort		&0x8		fixed-stack
21490>0x1c	byte		&0x80		byte-swapped
21491>0x1c	byte		&0x40		word-swapped
21492>0x10	lelong		>0		not-stripped
21493>0x1e	leshort		^0xc000		pre-SysV
21494>0x1e	leshort		&0x4000		V2.3
21495>0x1e	leshort		&0x8000		V3.0
21496>0x1c	byte		&0x4		86
21497>0x1c	byte		&0xb		186
21498>0x1c	byte		&0x9		286
21499>0x1c	byte		&0xa		386
21500>0x1f	byte		<0x040		small model
21501>0x1f	byte		=0x048		large model
21502>0x1f	byte		=0x049		huge model
21503>0x1e	leshort		&0x1		executable
21504>0x1e	leshort		^0x1		object file
21505>0x1e	leshort		&0x40		Large Text
21506>0x1e	leshort		&0x20		Large Data
21507>0x1e	leshort		&0x120		Huge Objects Enabled
21508>0x10	lelong		>0		not stripped
21509
215100	leshort		0x140		old Microsoft 8086 x.out
21511>0x3	byte		&0x4		separate
21512>0x3	byte		&0x2		pure
21513>0	byte		&0x1		executable
21514>0	byte		^0x1		relocatable
21515>0x14	lelong		>0		not stripped
21516
215170	lelong		0x206		b.out
21518>0x1e	leshort		&0x10		overlay
21519>0x1e	leshort		&0x2		separate
21520>0x1e	leshort		&0x4		pure
21521>0x1e	leshort		&0x800		segmented
21522>0x1e	leshort		&0x400		standalone
21523>0x1e	leshort		&0x1		executable
21524>0x1e	leshort		^0x1		object file
21525>0x1e	leshort		&0x4000		V2.3
21526>0x1e	leshort		&0x8000		V3.0
21527>0x1c	byte		&0x4		86
21528>0x1c	byte		&0xb		186
21529>0x1c	byte		&0x9		286
21530>0x1c	byte		&0x29		286
21531>0x1c	byte		&0xa		386
21532>0x1e	leshort		&0x4		Large Text
21533>0x1e	leshort		&0x2		Large Data
21534>0x1e	leshort		&0x102		Huge Objects Enabled
21535
215360	leshort		0x580		XENIX 8086 relocatable or 80286 small model
21537
21538#------------------------------------------------------------------------------
21539# $File: xilinx,v 1.6 2013/11/19 23:15:13 christos Exp $
21540# This is Aaron's attempt at a MAGIC file for Xilinx .bit files.
21541# Xilinx-Magic@RevRagnarok.com
21542# Got the info from FPGA-FAQ 0026
21543#
21544# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth,
21545# fixes at least reading of bitfiles from Spartan 2, 3, 6.
21546# http://www.fpga-faq.com/FAQ_Pages/0026_Tell_me_about_bit_files.htm
21547#
21548# First there is the sync header and its length
215490	beshort 0x0009
21550>2 	belong	=0x0ff00ff0
21551>>&0	belong  =0x0ff00ff0
21552>>>&0	byte    =0x00
21553>>>&1   beshort =0x0001
21554>>>&3	string	a	Xilinx BIT data
21555# Next is a Pascal-style string with the NCD name. We want to capture that.
21556>>>>&0	   pstring/H	x	- from %s
21557# And then 'b'
21558>>>>>&1    string b
21559# Then the model / part number:
21560>>>>>>&0   pstring/H    x       - for %s
21561# Then 'c'
21562>>>>>>>&1 string c
21563# Then the build-date
21564>>>>>>>>&0 pstring/H    x       - built %s
21565# Then 'd'
21566>>>>>>>>>&1   string d
21567# Then the build-time
21568>>>>>>>>>>&0  pstring/H x        \b(%s)
21569# Then 'e'
21570>>>>>>>>>>>&1  string e
21571# And length of data
21572>>>>>>>>>>>>&0 belong x          - data length 0x%x
21573
21574# Raw bitstream files
215750      long    0xffffffff
21576>&0    belong  0xaa995566      Xilinx RAW bitstream (.BIN)
21577
21578#------------------------------------------------------------------------------
21579# $File$
21580# xo65 object files
21581# From: "Ullrich von Bassewitz" <uz@cc65.org>
21582#
215830	string		\x55\x7A\x6E\x61	xo65 object,
21584>4	leshort		x			version %d,
21585>6	leshort&0x0001 =0x0001			with debug info
21586>6	leshort&0x0001 =0x0000			no debug info
21587
21588# xo65 library files
215890	string		\x6E\x61\x55\x7A	xo65 library,
21590>4	leshort		x			version %d
21591
21592# o65 object files
215930	string		\x01\x00\x6F\x36\x35	o65
21594>6	leshort&0x1000	=0x0000			executable,
21595>6	leshort&0x1000	=0x1000			object,
21596>5	byte		x			version %d,
21597>6	leshort&0x8000	=0x8000			65816,
21598>6	leshort&0x8000	=0x0000			6502,
21599>6	leshort&0x2000	=0x2000			32 bit,
21600>6	leshort&0x2000	=0x0000			16 bit,
21601>6	leshort&0x4000	=0x4000			page reloc,
21602>6	leshort&0x4000	=0x0000			byte reloc,
21603>6	leshort&0x0003	=0x0000			alignment 1
21604>6	leshort&0x0003	=0x0001			alignment 2
21605>6	leshort&0x0003	=0x0002			alignment 4
21606>6	leshort&0x0003	=0x0003			alignment 256
21607
21608#------------------------------------------------------------------------------
21609# $File: xwindows,v 1.8 2013/02/08 17:25:57 christos Exp $
21610# xwindows:  file(1) magic for various X/Window system file formats.
21611
21612# Compiled X Keymap
21613# XKM (compiled X keymap) files (including version and byte ordering)
216141	string	mkx				Compiled XKB Keymap: lsb,
21615>0	byte	>0				version %d
21616>0	byte	=0				obsolete
216170	string	xkm				Compiled XKB Keymap: msb,
21618>3	byte	>0				version %d
21619>3	byte	=0				obsolete
21620
21621# xfsdump archive
216220	string	xFSdump0			xfsdump archive
21623>8	belong	x	(version %d)
21624
21625# Jaleo XFS files
216260	long	395726				Jaleo XFS file
21627>4	long	x				- version %d
21628>8	long	x				- [%d -
21629>20	long	x				\b%dx
21630>24	long	x				\b%dx
21631>28	long	1008				\bYUV422]
21632>28	long	1000				\bRGB24]
21633
21634# Xcursor data
21635# X11 mouse cursor format defined in libXcursor, see
21636# http://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html
21637# http://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h
216380	string		Xcur		Xcursor data
21639!:mime	image/x-xcursor
21640>10	leshort		x		version %d
21641>>8	leshort		x		\b.%d
21642#------------------------------------------------------------------------------
21643# zfs:	file(1) magic for ZFS dumps
21644#
21645# From <rea-fbsd@codelabs.ru>
21646# ZFS dump header has the following structure (as per zfs_ioctl.h
21647# in FreeBSD with drr_type is set to DRR_BEGIN)
21648#
21649#   enum {
21650#	DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS,
21651#	DRR_WRITE, DRR_FREE, DRR_END,
21652#   } drr_type;
21653#   uint32_t drr_pad;
21654#   uint64_t drr_magic;
21655#   uint64_t drr_version;
21656#   uint64_t drr_creation_time;
21657#   dmu_objset_type_t drr_type;
21658#   uint32_t drr_pad;
21659#   uint64_t drr_toguid;
21660#   uint64_t drr_fromguid;
21661#   char drr_toname[MAXNAMELEN];
21662#
21663# Backup magic is 0x00000002f5bacbac (quad word)
21664# The drr_type is defined as
21665#   typedef enum dmu_objset_type {
21666#	  DMU_OST_NONE,
21667#	  DMU_OST_META,
21668#	  DMU_OST_ZFS,
21669#	  DMU_OST_ZVOL,
21670#	  DMU_OST_OTHER,		  /* For testing only! */
21671#	  DMU_OST_ANY,			  /* Be careful! */
21672#	  DMU_OST_NUMTYPES
21673#  } dmu_objset_type_t;
21674#
21675# Almost all uint64_t fields are printed as the 32-bit ones (with high
21676# 32 bits zeroed), because there is no simple way to print them as the
21677# full 64-bit values.
21678
21679# Big-endian values
216808	string	\000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine),
21681>20	belong	x	version %u,
21682>32	belong	0	type: NONE,
21683>32	belong	1	type: META,
21684>32	belong	2	type: ZFS,
21685>32	belong	3	type: ZVOL,
21686>32	belong	4	type: OTHER,
21687>32	belong	5	type: ANY,
21688>32	belong	>5	type: UNKNOWN (%u),
21689>40	byte	x	destination GUID: %02X
21690>41	byte	x	%02X
21691>42	byte	x	%02X
21692>43	byte	x	%02X
21693>44	byte	x	%02X
21694>45	byte	x	%02X
21695>46	byte	x	%02X
21696>47	byte	x	%02X,
21697>48	ulong	>0
21698>>52	ulong	>0
21699>>>48	byte	x	source GUID: %02X
21700>>>49	byte	x	%02X
21701>>>50	byte	x	%02X
21702>>>51	byte	x	%02X
21703>>>52	byte	x	%02X
21704>>>53	byte	x	%02X
21705>>>54	byte	x	%02X
21706>>>55	byte	x	%02X,
21707>56	string	>\0	name: '%s'
21708
21709# Little-endian values
217108	string	\254\313\272\365\002\000\000\000	ZFS shapshot (little-endian machine),
21711>16	lelong	x	version %u,
21712>32	lelong	0	type: NONE,
21713>32	lelong	1	type: META,
21714>32	lelong	2	type: ZFS,
21715>32	lelong	3	type: ZVOL,
21716>32	lelong	4	type: OTHER,
21717>32	lelong	5	type: ANY,
21718>32	lelong	>5	type: UNKNOWN (%u),
21719>47	byte	x	destination GUID: %02X
21720>46	byte	x	%02X
21721>45	byte	x	%02X
21722>44	byte	x	%02X
21723>43	byte	x	%02X
21724>42	byte	x	%02X
21725>41	byte	x	%02X
21726>40	byte	x	%02X,
21727>48	ulong	>0
21728>>52	ulong	>0
21729>>>55	byte	x	source GUID: %02X
21730>>>54	byte	x	%02X
21731>>>53	byte	x	%02X
21732>>>52	byte	x	%02X
21733>>>51	byte	x	%02X
21734>>>50	byte	x	%02X
21735>>>49	byte	x	%02X
21736>>>48	byte	x	%02X,
21737>56	string	>\0	name: '%s'
21738
21739#------------------------------------------------------------------------------
21740# $File$
21741# zilog:  file(1) magic for Zilog Z8000.
21742#
21743# Was it big-endian or little-endian?  My Product Specification doesn't
21744# say.
21745#
217460	long		0xe807		object file (z8000 a.out)
217470	long		0xe808		pure object file (z8000 a.out)
217480	long		0xe809		separate object file (z8000 a.out)
217490	long		0xe805		overlay object file (z8000 a.out)
21750
21751#------------------------------------------------------------------------------
21752# $File$
21753# zyxel:  file(1) magic for ZyXEL modems
21754#
21755# From <rob@pe1chl.ampr.org>
21756# These are the /etc/magic entries to decode datafiles as used for the
21757# ZyXEL U-1496E DATA/FAX/VOICE modems.  (This header conforms to a
21758# ZyXEL-defined standard)
21759
217600	string		ZyXEL\002	ZyXEL voice data
21761>10	byte		0		- CELP encoding
21762>10	byte&0x0B	1		- ADPCM2 encoding
21763>10	byte&0x0B	2		- ADPCM3 encoding
21764>10	byte&0x0B	3		- ADPCM4 encoding
21765>10	byte&0x0B	8		- New ADPCM3 encoding
21766>10	byte&0x04	4		with resync
21767