1# Magic data for file(1) command. 2# Format is described in magic(files), where: 3# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID. 4# Don't edit this file, edit /etc/magic or send your magic improvements 5# to the maintainers, at file@mx.gw.com 6 7#------------------------------------------------------------------------------ 8# Localstuff: file(1) magic for locally observed files 9# 10# $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $ 11# Add any locally observed files here. Remember: 12# text if readable, executable if runnable binary, data if unreadable. 13 14#------------------------------------------------------------------------------ 15# $File: acorn,v 1.6 2017/10/19 16:40:37 christos Exp $ 16# acorn: file(1) magic for files found on Acorn systems 17# 18 19# RISC OS Chunk File Format 20# From RISC OS Programmer's Reference Manual, Appendix D 21# We guess the file type from the type of the first chunk. 220 lelong 0xc3cbc6c5 RISC OS Chunk data 23>12 string OBJ_ \b, AOF object 24>12 string LIB_ \b, ALF library 25 26# RISC OS AIF, contains "SWI OS_Exit" at offset 16. 2716 lelong 0xef000011 RISC OS AIF executable 28 29# RISC OS Draw files 30# From RISC OS Programmer's Reference Manual, Appendix E 310 string Draw RISC OS Draw file data 32 33# RISC OS new format font files 34# From RISC OS Programmer's Reference Manual, Appendix E 350 string FONT\0 RISC OS outline font data, 36>5 byte x version %d 370 string FONT\1 RISC OS 1bpp font data, 38>5 byte x version %d 390 string FONT\4 RISC OS 4bpp font data 40>5 byte x version %d 41 42# RISC OS Music files 43# From RISC OS Programmer's Reference Manual, Appendix E 440 string Maestro\r RISC OS music file 45>8 byte x version %d 46 47>8 byte x type %d 48 49# Digital Symphony data files 50# From: Bernard Jungen (bern8817@euphonynet.be) 510 string \x02\x01\x13\x13\x13\x01\x0d\x10 Digital Symphony sound sample (RISC OS), 52>8 byte x version %d, 53>9 pstring x named "%s", 54>(9.b+19) byte =0 8-bit logarithmic 55>(9.b+19) byte =1 LZW-compressed linear 56>(9.b+19) byte =2 8-bit linear signed 57>(9.b+19) byte =3 16-bit linear signed 58>(9.b+19) byte =4 SigmaDelta-compressed linear 59>(9.b+19) byte =5 SigmaDelta-compressed logarithmic 60>(9.b+19) byte >5 unknown format 61 620 string \x02\x01\x13\x13\x14\x12\x01\x0b Digital Symphony song (RISC OS), 63>8 byte x version %d, 64>9 byte =1 1 voice, 65>9 byte !1 %d voices, 66>10 leshort =1 1 track, 67>10 leshort !1 %d tracks, 68>12 leshort =1 1 pattern 69>12 leshort !1 %d patterns 70 710 string \x02\x01\x13\x13\x10\x14\x12\x0e 72>9 byte =0 Digital Symphony sequence (RISC OS), 73>>8 byte x version %d, 74>>10 byte =1 1 line, 75>>10 byte !1 %d lines, 76>>11 leshort =1 1 position 77>>11 leshort !1 %d positions 78>9 byte =1 Digital Symphony pattern data (RISC OS), 79>>8 byte x version %d, 80>>10 leshort =1 1 pattern 81>>10 leshort !1 %d patterns 82 83# From: Joerg Jenderek 84# URL: https://www.kyzer.me.uk/pack/xad/#PackDir 85# reference: https://www.kyzer.me.uk/pack/xad/xad_PackDir.lha/PackDir.c 86# GRR: line below is too general as it matches also "Git pack" in ./revision 870 string PACK\0 88# check for valid compression method 0-4 89>5 ulelong <5 90# https://www.riscosopen.org/wiki/documentation/show/Introduction%20To%20Filing%20Systems 91# To skip "Git pack" version 0 test for root directory object like 92# ADFS::RPC.$.websitezip.FONTFIX 93>>9 string >ADFS\ PackDir archive (RISC OS) 94# TrID labels above as "Acorn PackDir compressed Archive" 95# compression mode y (0 - 4) for GIF LZW with a maximum n bits 96# (y~n,0~12,1~13,2~14,3~15,4~16) 97>>>5 ulelong+12 x \b, LZW %u-bits compression 98# http://www.filebase.org.uk/filetypes 99# !Packdir compressed archive has three hexadecimal digits code 68E 100!:mime application/x-acorn-68E 101!:ext pkd/bin 102# null terminated root directory object like IDEFS::IDE-4.$.Apps.GRAPHICS.!XFMPdemo 103>>>9 string x \b, root "%s" 104# load address 0xFFFtttdd, ttt is the object filetype and dddddddddd is time 105>>>>&1 ulelong x \b, load address 0x%x 106# execution address 0xdddddddd dddddddddd is 40 bit unsigned centiseconds since 1.1.1900 UTC 107>>>>&5 ulelong x \b, exec address 0x%x 108# attributes (bits: 0~owner read,1~owner write,3~no delete,4~public read,5~public write) 109>>>>&9 ulelong x \b, attributes 0x%x 110# number of entries in this directory. for root dir 0 111#>>>&13 ulelong x \b, entries 0x%x 112# the entries start here with object name 113>>>>&17 string x \b, 1st object "%s" 114 115 116#------------------------------------------------------------------------------ 117# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $ 118# adi: file(1) magic for ADi's objects 119# From Gregory McGarry <g.mcgarry@ieee.org> 120# 1210 leshort 0x521c COFF DSP21k 122>18 lelong &02 executable, 123>18 lelong ^02 124>>18 lelong &01 static object, 125>>18 lelong ^01 relocatable object, 126>18 lelong &010 stripped 127>18 lelong ^010 not stripped 128 129#------------------------------------------------------------------------------ 130# $File: adventure,v 1.17 2017/07/03 16:03:40 christos Exp $ 131# adventure: file(1) magic for Adventure game files 132# 133# from Allen Garvin <earendil@faeryland.tamu-commerce.edu> 134# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998 135# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 136# 137# ALAN 138# I assume there are other, lower versions, but these are the only ones I 139# saw in the archive. 1400 beshort 0x0206 ALAN game data 141>2 byte <10 version 2.6%d 142 143 144# Infocom (see z-machine) 145#------------------------------------------------------------------------------ 146# Z-machine: file(1) magic for Z-machine binaries. 147# Sanity checks by David Griffith <dave@661.org> 148# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 149# 150#http://www.gnelson.demon.co.uk/zspec/sect11.html 151#http://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt 152#http://en.wikipedia.org/wiki/Z-machine 153# The first byte is the Z-machine revision; it is always between 1 and 8. We 154# had false matches (for instance, inbig5.ocp from the Omega TeX extension as 155# well as an occasional MP3 file), so we sanity-check the version number. 156# 157# It might be possible to sanity-check the release number as well, as it seems 158# (at least in classic Infocom games) to always be a relatively small number, 159# always under 150 or so, but as this isn't rigorous, we'll wait on that until 160# it becomes clear that it's needed. 161# 1620 ubyte >0 163>0 ubyte <9 164>>16 belong&0xfe00f0f0 0x3030 165>>>0 ubyte < 10 166>>>>2 ubeshort x 167>>>>>18 regex [0-9][0-9][0-9][0-9][0-9][0-9] 168>>>>>>0 ubyte < 10 Infocom (Z-machine %d 169>>>>>>>2 ubeshort x \b, Release %d 170>>>>>>>>18 string >\0 \b, Serial %.6s 171>>>>>>>>18 string x \b) 172!:strength + 40 173!:mime application/x-zmachine 174 175#------------------------------------------------------------------------------ 176# Glulx: file(1) magic for Glulx binaries. 177# 178# David Griffith <dave@661.org> 179# I haven't checked for false matches yet. 180# 1810 string Glul Glulx game data 182>4 beshort x (Version %d 183>>6 byte x \b.%d 184>>8 byte x \b.%d) 185>36 string Info Compiled by Inform 186!:mime application/x-glulx 187 188 189# For Quetzal and blorb magic see iff 190 191 192# TADS (Text Adventure Development System) version 2 193# All files are machine-independent (games compile to byte-code) and are tagged 194# with a version string of the form "V2.<digit>.<digit>\0". 195# Game files start with "TADS2 bin\n\r\032\0" then the compiler version. 1960 string TADS2\ bin TADS 197>9 belong !0x0A0D1A00 game data, CORRUPTED 198>9 belong 0x0A0D1A00 199>>13 string >\0 %s game data 200!:mime application/x-tads 201# Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version. 2020 string TADS2\ rsc TADS 203>9 belong !0x0A0D1A00 resource data, CORRUPTED 204>9 belong 0x0A0D1A00 205>>13 string >\0 %s resource data 206!:mime application/x-tads 207# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian 208# 2-byte length N, the N-char name of the game file *without* a NUL (darn!), 209# "TADS2 save\n\r\032\0" and the interpreter version. 2100 string TADS2\ save/g TADS 211>12 belong !0x0A0D1A00 saved game data, CORRUPTED 212>12 belong 0x0A0D1A00 213>>(16.s+32) string >\0 %s saved game data 214!:mime application/x-tads 215# Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter 216# version. 2170 string TADS2\ save TADS 218>10 belong !0x0A0D1A00 saved game data, CORRUPTED 219>10 belong 0x0A0D1A00 220>>14 string >\0 %s saved game data 221!:mime application/x-tads 222 223# TADS (Text Adventure Development System) version 3 224# Game files start with "T3-image\015\012\032" 2250 string T3-image\015\012\032 226>11 leshort x TADS 3 game data (format version %d) 227# Saved game files start with "T3-state-v####\015\012\032" 228# where #### is a format version number 2290 string T3-state-v 230>14 string \015\012\032 TADS 3 saved game data (format version 231>>10 byte x %c 232>>11 byte x \b%c 233>>12 byte x \b%c 234>>13 byte x \b%c) 235!:mime application/x-t3vm-image 236 237# edited by David Griffith <dave@661.org> 238# Danny Milosavljevic <danny.milo@gmx.net> 239# These are ADRIFT (adventure game standard) game files, extension .taf 240# Checked from source at (http://www.adrift.co/) and various taf files 241# found at the Interactive Fiction Archive (http://ifarchive.org/) 2420 belong 0x3C423FC9 243>4 belong 0x6A87C2CF Adrift game file version 244>>8 belong 0x94453661 3.80 245>>8 belong 0x94453761 3.90 246>>8 belong 0x93453E61 4.0 247>>8 belong 0x92453E61 5.0 248>>8 default x unknown 249!:mime application/x-adrift 250 251#------------------------------------------------------------------------------ 252# $File: algol68,v 1.2 2016/10/17 14:17:48 christos Exp $ 253# algol68: file(1) magic for Algol 68 source 254# 2550 search/8192 (input, Algol 68 source text 256!:mime text/x-Algol68 2570 regex \^PROC Algol 68 source text 258!:mime text/x-Algol68 2590 regex MODE[\t\ ] Algol 68 source text 260!:mime text/x-Algol68 2610 regex REF[\t\ ] Algol 68 source text 262!:mime text/x-Algol68 2630 regex FLEX[\t\ ]\*\\[ Algol 68 source text 264!:mime text/x-Algol68 265#0 regex [\t\ ]OD Algol 68 source text 266#!:mime text/x-Algol68 267#0 regex [\t\ ]FI Algol 68 source text 268#!:mime text/x-Algol68 269 270#------------------------------------------------------------------------------ 271# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $ 272# allegro: file(1) magic for Allegro datafiles 273# Toby Deshane <hac@shoelace.digivill.net> 274# 2750 belong 0x736C6821 Allegro datafile (packed) 2760 belong 0x736C682E Allegro datafile (not packed/autodetect) 2770 belong 0x736C682B Allegro datafile (appended exe data) 278 279#------------------------------------------------------------------------------ 280# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $ 281# alliant: file(1) magic for Alliant FX series a.out files 282# 283# If the FX series is the one that had a processor with a 68K-derived 284# instruction set, the "short" should probably become "beshort" and the 285# "long" should probably become "belong". 286# If it's the i860-based one, they should probably become either the 287# big-endian or little-endian versions, depending on the mode they ran 288# the 860 in.... 289# 2900 short 0420 0420 Alliant virtual executable 291>2 short &0x0020 common library 292>16 long >0 not stripped 2930 short 0421 0421 Alliant compact executable 294>2 short &0x0020 common library 295>16 long >0 not stripped 296 297#------------------------------------------------------------------------------ 298# $File: amanda,v 1.6 2017/03/17 21:35:28 christos Exp $ 299# amanda: file(1) magic for amanda file format 300# 3010 string AMANDA:\ AMANDA 302>8 string TAPESTART\ DATE tape header file, 303>>23 string X 304>>>25 string >\ Unused %s 305>>23 string >\ DATE %s 306>8 string FILE\ dump file, 307>>13 string >\ DATE %s 308 309#------------------------------------------------------------------------------ 310# $File: amigaos,v 1.16 2017/03/17 21:35:28 christos Exp $ 311# amigaos: file(1) magic for AmigaOS binary formats: 312 313# 314# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis) 315# 3160 belong 0x000003fa AmigaOS shared library 3170 belong 0x000003f3 AmigaOS loadseg()ble executable/binary 3180 belong 0x000003e7 AmigaOS object/library data 319# 3200 beshort 0xe310 Amiga Workbench 321>2 beshort 1 322>>48 byte 1 disk icon 323>>48 byte 2 drawer icon 324>>48 byte 3 tool icon 325>>48 byte 4 project icon 326>>48 byte 5 garbage icon 327>>48 byte 6 device icon 328>>48 byte 7 kickstart icon 329>>48 byte 8 workbench application icon 330>2 beshort >1 icon, vers. %d 331# 332# various sound formats from the Amiga 333# G=F6tz Waschk <waschk@informatik.uni-rostock.de> 334# 3350 string FC14 Future Composer 1.4 Module sound file 3360 string SMOD Future Composer 1.3 Module sound file 3370 string AON4artofnoise Art Of Noise Module sound file 3381 string MUGICIAN/SOFTEYES Mugician Module sound file 33958 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file 3400 string Synth4.0 Synthesis Module sound file 3410 string ARP. The Holy Noise Module sound file 3420 string BeEp\0 JamCracker Module sound file 3430 string COSO\0 Hippel-COSO Module sound file 344# Too simple (short, pure ASCII, deep), MPi 345#26 string V.3 Brian Postma's Soundmon Module sound file v3 346#26 string BPSM Brian Postma's Soundmon Module sound file v3 347#26 string V.2 Brian Postma's Soundmon Module sound file v2 348 349# The following are from: "Stefan A. Haubenthal" <polluks@web.de> 3500 beshort 0x0f00 AmigaOS bitmap font 3510 beshort 0x0f03 AmigaOS outline font 3520 belong 0x80001001 AmigaOS outline tag 3530 string ##\ version catalog translation 3540 string EMOD\0 Amiga E module 3558 string ECXM\0 ECX module 3560 string/c @database AmigaGuide file 357 358# Amiga disk types 359# 3600 string RDSK Rigid Disk Block 361>160 string x on %.24s 3620 string DOS\0 Amiga DOS disk 3630 string DOS\1 Amiga FFS disk 3640 string DOS\2 Amiga Inter DOS disk 3650 string DOS\3 Amiga Inter FFS disk 3660 string DOS\4 Amiga Fastdir DOS disk 3670 string DOS\5 Amiga Fastdir FFS disk 3680 string KICK Kickstart disk 369 370# From: Alex Beregszaszi <alex@fsn.hu> 3710 string LZX LZX compressed archive (Amiga) 372 373# From: Przemek Kramarczyk <pkramarczyk@gmail.com> 3740 string .KEY AmigaDOS script 3750 string .key AmigaDOS script 376 377#------------------------------------------------------------ 378# $File: android,v 1.10 2017/03/17 21:35:28 christos Exp $ 379# Various android related magic entries 380#------------------------------------------------------------ 381 382# Dalvik .dex format. http://retrodev.com/android/dexformat.html 383# From <mkf@google.com> "Mike Fleming" 384# Fixed to avoid regexec 17 errors on some dex files 385# From <diff@lookout.com> "Tim Strazzere" 3860 string dex\n 387>0 regex dex\n[0-9]{2}\0 Dalvik dex file 388>4 string >000 version %s 3890 string dey\n 390>0 regex dey\n[0-9]{2}\0 Dalvik dex file (optimized for host) 391>4 string >000 version %s 392 393# Android bootimg format 394# From https://android.googlesource.com/\ 395# platform/system/core/+/master/mkbootimg/bootimg.h 3960 string ANDROID! Android bootimg 397>1024 string LOKI\01 \b, LOKI'd 398>8 lelong >0 \b, kernel 399>>12 lelong >0 \b (0x%x) 400>16 lelong >0 \b, ramdisk 401>>20 lelong >0 \b (0x%x) 402>24 lelong >0 \b, second stage 403>>28 lelong >0 \b (0x%x) 404>36 lelong >0 \b, page size: %d 405>38 string >0 \b, name: %s 406>64 string >0 \b, cmdline (%s) 407 408# Android Backup archive 409# From: Ariel Shkedi 410# File extension: .ab 411# No mime-type defined 412# URL: https://github.com/android/platform_frameworks_base/blob/\ 413# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\ 414# android/server/BackupManagerService.java#L2367 415# After the header comes a tar file 416# If compressed, the entire tar file is compressed with JAVA deflate 417# 418# Include the version number hardcoded with the magic string to avoid 419# false positives 4200 string/b ANDROID\ BACKUP\n1\n Android Backup 421>17 string 0\n \b, Not-Compressed 422>17 string 1\n \b, Compressed 423# any string as long as it's not the word none (which is matched below) 424>>19 regex/1l \^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).* \b, Encrypted (%s) 425>>19 string none\n \b, Not-Encrypted 426# Commented out because they don't seem useful to print 427# (but they are part of the header - the tar file comes after them): 428#>>>&1 regex/1l .* \b, Password salt: %s 429#>>>>&1 regex/1l .* \b, Master salt: %s 430#>>>>>&1 regex/1l .* \b, PBKDF2 rounds: %s 431#>>>>>>&1 regex/1l .* \b, IV: %s 432#>>>>>>>&1 regex/1l .* \b, Key: %s 433 434# *.pit files by Joerg Jenderek 435# http://forum.xda-developers.com/showthread.php?p=9122369 436# http://forum.xda-developers.com/showthread.php?t=816449 437# Partition Information Table for Samsung's smartphone with Android 438# used by flash software Odin 4390 ulelong 0x12349876 440# 1st pit entry marker 441>0x01C ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000 442# minimal 13 and maximal 18 PIT entries found 443>>4 ulelong <128 Partition Information Table for Samsung smartphone 444>>>4 ulelong x \b, %d entries 445# 1. pit entry 446>>>4 ulelong >0 \b; #1 447>>>0x01C use PIT-entry 448>>>4 ulelong >1 \b; #2 449>>>0x0A0 use PIT-entry 450>>>4 ulelong >2 \b; #3 451>>>0x124 use PIT-entry 452>>>4 ulelong >3 \b; #4 453>>>0x1A8 use PIT-entry 454>>>4 ulelong >4 \b; #5 455>>>0x22C use PIT-entry 456>>>4 ulelong >5 \b; #6 457>>>0x2B0 use PIT-entry 458>>>4 ulelong >6 \b; #7 459>>>0x334 use PIT-entry 460>>>4 ulelong >7 \b; #8 461>>>0x3B8 use PIT-entry 462>>>4 ulelong >8 \b; #9 463>>>0x43C use PIT-entry 464>>>4 ulelong >9 \b; #10 465>>>0x4C0 use PIT-entry 466>>>4 ulelong >10 \b; #11 467>>>0x544 use PIT-entry 468>>>4 ulelong >11 \b; #12 469>>>0x5C8 use PIT-entry 470>>>4 ulelong >12 \b; #13 471>>>>0x64C use PIT-entry 472# 14. pit entry 473>>>4 ulelong >13 \b; #14 474>>>>0x6D0 use PIT-entry 475>>>4 ulelong >14 \b; #15 476>>>0x754 use PIT-entry 477>>>4 ulelong >15 \b; #16 478>>>0x7D8 use PIT-entry 479>>>4 ulelong >16 \b; #17 480>>>0x85C use PIT-entry 481# 18. pit entry 482>>>4 ulelong >17 \b; #18 483>>>0x8E0 use PIT-entry 484 4850 name PIT-entry 486# garbage value implies end of pit entries 487>0x00 ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000 488# skip empty partition name 489>>0x24 ubyte !0 490# partition name 491>>>0x24 string >\0 %-.32s 492# flags 493>>>0x0C ulelong&0x00000002 2 \b+RW 494# partition ID: 495# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~KENREl,RECOVER,misc;7~RECOVER 496# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW 497>>>0x08 ulelong x (0x%x) 498# filename 499>>>0x44 string >\0 "%-.64s" 500#>>>0x18 ulelong >0 501# blocksize in 512 byte units ? 502#>>>>0x18 ulelong x \b, %db 503# partition size in blocks ? 504#>>>>0x22 ulelong x \b*%d 505 506# Android sparse img format 507# From https://android.googlesource.com/\ 508# platform/system/core/+/master/libsparse/sparse_format.h 5090 lelong 0xed26ff3a Android sparse image 510>4 leshort x \b, version: %d 511>6 leshort x \b.%d 512>16 lelong x \b, Total of %d 513>12 lelong x \b %d-byte output blocks in 514>20 lelong x \b %d input chunks. 515 516# Android binary XML magic 517# In include/androidfw/ResourceTypes.h: 518# RES_XML_TYPE = 0x0003 followed by the size of the header (ResXMLTree_header), 519# which is 8 bytes (2 bytes type + 2 bytes header size + 4 bytes size). 5200 lelong 0x00080003 Android binary XML 521 522#------------------------------------------------------------------------------ 523# $File: animation,v 1.68 2018/05/06 16:08:07 christos Exp $ 524# animation: file(1) magic for animation/movie formats 525# 526# animation formats 527# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) 528# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) 529 530# SGI and Apple formats 5310 string MOVI Silicon Graphics movie file 532!:mime video/x-sgi-movie 5334 string moov Apple QuickTime 534!:mime video/quicktime 535>12 string mvhd \b movie (fast start) 536>12 string mdra \b URL 537>12 string cmov \b movie (fast start, compressed header) 538>12 string rmra \b multiple URLs 5394 string mdat Apple QuickTime movie (unoptimized) 540!:mime video/quicktime 541#4 string wide Apple QuickTime movie (unoptimized) 542#!:mime video/quicktime 543#4 string skip Apple QuickTime movie (modified) 544#!:mime video/quicktime 545#4 string free Apple QuickTime movie (modified) 546#!:mime video/quicktime 5474 string idsc Apple QuickTime image (fast start) 548!:mime image/x-quicktime 549#4 string idat Apple QuickTime image (unoptimized) 550#!:mime image/x-quicktime 5514 string pckg Apple QuickTime compressed archive 552!:mime application/x-quicktime-player 5534 string/W jP JPEG 2000 image 554!:mime image/jp2 555# http://www.ftyps.com/ with local additions 5564 string ftyp ISO Media 557# http://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/ 558>8 string XAVC \b, MPEG v4 system, Sony XAVC Codec 559>>96 string x \b, Audio "%.4s" 560>>118 beshort x at %dHz 561>>140 string x \b, Video "%.4s" 562>>168 beshort x %d 563>>170 beshort x \bx%d 564>8 string 3g2 \b, MPEG v4 system, 3GPP2 565!:mime video/3gpp2 566>>11 byte 4 \b v4 (H.263/AMR GSM 6.10) 567>>11 byte 5 \b v5 (H.263/AMR GSM 6.10) 568>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10) 569# http://www.3gpp2.org/Public_html/Specs/C.S0050-B_v1.0_070521.pdf 570# Section 8.1.1, corresponds to a, b, c 571>>11 byte 0x61 \b C.S0050-0 V1.0 572>>11 byte 0x62 \b C.S0050-0-A V1.0.0 573>>11 byte 0x63 \b C.S0050-0-B V1.0 574>8 string 3ge \b, MPEG v4 system, 3GPP 575!:mime video/3gpp 576>>11 byte 6 \b, Release 6 MBMS Extended Presentations 577>>11 byte 7 \b, Release 7 MBMS Extended Presentations 578>8 string 3gg \b, MPEG v4 system, 3GPP 579!:mime video/3gpp 580>>11 byte 6 \b, Release 6 General Profile 581>8 string 3gp \b, MPEG v4 system, 3GPP 582!:mime video/3gpp 583>>11 byte 1 \b, Release %d (non existent) 584>>11 byte 2 \b, Release %d (non existent) 585>>11 byte 3 \b, Release %d (non existent) 586>>11 byte 4 \b, Release %d 587>>11 byte 5 \b, Release %d 588>>11 byte 6 \b, Release %d 589>>11 byte 7 \b, Release %d Streaming Servers 590>8 string 3gs \b, MPEG v4 system, 3GPP 591!:mime video/3gpp 592>>11 byte 7 \b, Release %d Streaming Servers 593>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC [ISO 14496-12:2005] 594!:mime video/mp4 595>8 string/W qt \b, Apple QuickTime movie 596!:mime video/quicktime 597>8 string CAEP \b, Canon Digital Camera 598>8 string caqv \b, Casio Digital Camera 599>8 string CDes \b, Convergent Design 600>8 string da0a \b, DMB MAF w/ MPEG Layer II aud, MOT slides, DLS, JPG/PNG/MNG 601>8 string da0b \b, DMB MAF, ext DA0A, with 3GPP timed text, DID, TVA, REL, IPMP 602>8 string da1a \b, DMB MAF audio with ER-BSAC audio, JPG/PNG/MNG images 603>8 string da1b \b, DMB MAF, ext da1a, with 3GPP timed text, DID, TVA, REL, IPMP 604>8 string da2a \b, DMB MAF aud w/ HE-AAC v2 aud, MOT slides, DLS, JPG/PNG/MNG 605>8 string da2b \b, DMB MAF, ext da2a, with 3GPP timed text, DID, TVA, REL, IPMP 606>8 string da3a \b, DMB MAF aud with HE-AAC aud, JPG/PNG/MNG images 607>8 string da3b \b, DMB MAF, ext da3a w/ BIFS, 3GPP, DID, TVA, REL, IPMP 608>8 string dash \b, MPEG v4 system, Dynamic Adaptive Streaming over HTTP 609!:mime video/mp4 610>8 string dmb1 \b, DMB MAF supporting all the components defined in the spec 611>8 string dmpf \b, Digital Media Project 612>8 string drc1 \b, Dirac (wavelet compression), encap in ISO base media (MP4) 613>8 string dv1a \b, DMB MAF vid w/ AVC vid, ER-BSAC aud, BIFS, JPG/PNG/MNG, TS 614>8 string dv1b \b, DMB MAF, ext dv1a, with 3GPP timed text, DID, TVA, REL, IPMP 615>8 string dv2a \b, DMB MAF vid w/ AVC vid, HE-AAC v2 aud, BIFS, JPG/PNG/MNG, TS 616>8 string dv2b \b, DMB MAF, ext dv2a, with 3GPP timed text, DID, TVA, REL, IPMP 617>8 string dv3a \b, DMB MAF vid w/ AVC vid, HE-AAC aud, BIFS, JPG/PNG/MNG, TS 618>8 string dv3b \b, DMB MAF, ext dv3a, with 3GPP timed text, DID, TVA, REL, IPMP 619>8 string dvr1 \b, DVB (.DVB) over RTP 620!:mime video/vnd.dvb.file 621>8 string dvt1 \b, DVB (.DVB) over MPEG-2 Transport Stream 622!:mime video/vnd.dvb.file 623>8 string F4V \b, Video for Adobe Flash Player 9+ (.F4V) 624!:mime video/mp4 625>8 string F4P \b, Protected Video for Adobe Flash Player 9+ (.F4P) 626!:mime video/mp4 627>8 string F4A \b, Audio for Adobe Flash Player 9+ (.F4A) 628!:mime audio/mp4 629>8 string F4B \b, Audio Book for Adobe Flash Player 9+ (.F4B) 630!:mime audio/mp4 631>8 string isc2 \b, ISMACryp 2.0 Encrypted File 632# ?/enc-isoff-generic 633>8 string iso2 \b, MP4 Base Media v2 [ISO 14496-12:2005] 634!:mime video/mp4 635>8 string isom \b, MP4 Base Media v1 [IS0 14496-12:2003] 636!:mime video/mp4 637>8 string/W jp2 \b, JPEG 2000 638!:mime image/jp2 639>8 string JP2 \b, JPEG 2000 Image (.JP2) [ISO 15444-1 ?] 640!:mime image/jp2 641>8 string JP20 \b, Unknown, from GPAC samples (prob non-existent) 642>8 string jpm \b, JPEG 2000 Compound Image (.JPM) [ISO 15444-6] 643!:mime image/jpm 644>8 string jpx \b, JPEG 2000 w/ extensions (.JPX) [ISO 15444-2] 645!:mime image/jpx 646>8 string KDDI \b, 3GPP2 EZmovie for KDDI 3G cellphones 647!:mime video/3gpp2 648>8 string M4A \b, Apple iTunes ALAC/AAC-LC (.M4A) Audio 649!:mime audio/x-m4a 650>8 string M4B \b, Apple iTunes ALAC/AAC-LC (.M4B) Audio Book 651!:mime audio/mp4 652>8 string M4P \b, Apple iTunes ALAC/AAC-LC (.M4P) AES Protected Audio 653!:mime video/mp4 654>8 string M4V \b, Apple iTunes Video (.M4V) Video 655!:mime video/x-m4v 656>8 string M4VH \b, Apple TV (.M4V) 657!:mime video/x-m4v 658>8 string M4VP \b, Apple iPhone (.M4V) 659!:mime video/x-m4v 660>8 string mj2s \b, Motion JPEG 2000 [ISO 15444-3] Simple Profile 661!:mime video/mj2 662>8 string mjp2 \b, Motion JPEG 2000 [ISO 15444-3] General Profile 663!:mime video/mj2 664>8 string mmp4 \b, MPEG-4/3GPP Mobile Profile (.MP4 / .3GP) (for NTT) 665!:mime video/mp4 666>8 string mobi \b, MPEG-4, MOBI format 667!:mime video/mp4 668>8 string mp21 \b, MPEG-21 [ISO/IEC 21000-9] 669>8 string mp41 \b, MP4 v1 [ISO 14496-1:ch13] 670!:mime video/mp4 671>8 string mp42 \b, MP4 v2 [ISO 14496-14] 672!:mime video/mp4 673>8 string mp71 \b, MP4 w/ MPEG-7 Metadata [per ISO 14496-12] 674>8 string mp7t \b, MPEG v4 system, MPEG v7 XML 675>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML 676>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile 677!:mime video/mp4 678>8 string MPPI \b, Photo Player, MAF [ISO/IEC 23000-3] 679>8 string mqt \b, Sony / Mobile QuickTime (.MQV) US Pat 7,477,830 680!:mime video/quicktime 681>8 string MSNV \b, MPEG-4 (.MP4) for SonyPSP 682!:mime audio/mp4 683>8 string NDAS \b, MP4 v2 [ISO 14496-14] Nero Digital AAC Audio 684!:mime audio/mp4 685>8 string NDSC \b, MPEG-4 (.MP4) Nero Cinema Profile 686!:mime video/mp4 687>8 string NDSH \b, MPEG-4 (.MP4) Nero HDTV Profile 688!:mime video/mp4 689>8 string NDSM \b, MPEG-4 (.MP4) Nero Mobile Profile 690!:mime video/mp4 691>8 string NDSP \b, MPEG-4 (.MP4) Nero Portable Profile 692!:mime video/mp4 693>8 string NDSS \b, MPEG-4 (.MP4) Nero Standard Profile 694!:mime video/mp4 695>8 string NDXC \b, H.264/MPEG-4 AVC (.MP4) Nero Cinema Profile 696!:mime video/mp4 697>8 string NDXH \b, H.264/MPEG-4 AVC (.MP4) Nero HDTV Profile 698!:mime video/mp4 699>8 string NDXM \b, H.264/MPEG-4 AVC (.MP4) Nero Mobile Profile 700!:mime video/mp4 701>8 string NDXP \b, H.264/MPEG-4 AVC (.MP4) Nero Portable Profile 702!:mime video/mp4 703>8 string NDXS \b, H.264/MPEG-4 AVC (.MP4) Nero Standard Profile 704!:mime video/mp4 705>8 string odcf \b, OMA DCF DRM Format 2.0 (OMA-TS-DRM-DCF-V2_0-20060303-A) 706>8 string opf2 \b, OMA PDCF DRM Format 2.1 (OMA-TS-DRM-DCF-V2_1-20070724-C) 707>8 string opx2 \b, OMA PDCF DRM + XBS ext (OMA-TS-DRM_XBS-V1_0-20070529-C) 708>8 string pana \b, Panasonic Digital Camera 709>8 string qt \b, Apple QuickTime (.MOV/QT) 710!:mime video/quicktime 711# HEIF image format 712# see https://nokiatech.github.io/heif/technical.html 713>8 string mif1 \b, HEIF Image 714!:mime image/heif 715>8 string msf1 \b, HEIF Image Sequence 716!:mime image/heif-sequence 717>8 string heic \b, HEIF Image HEVC Main or Main Still Picture Profile 718!:mime image/heic 719>8 string heix \b, HEIF Image HEVC Main 10 Profile 720!:mime image/heic 721>8 string hevc \b, HEIF Image Sequenz HEVC Main or Main Still Picture Profile 722!:mime image/heic-sequence 723>8 string hevx \b, HEIF Image Sequence HEVC Main 10 Profile 724!:mime image/heic-sequence 725# following HEIF brands are not mentioned in the heif technical info currently (Oct 2017) 726# but used in the reference implementation: 727# https://github.com/nokiatech/heif/blob/d5e9a21c8ba8df712bdf643021dd9f6518134776/Srcs/reader/hevcimagefilereader.cpp 728>8 string heim \b, HEIF Image L-HEVC 729!:mime image/heif 730>8 string heis \b, HEIF Image L-HEVC 731!:mime image/heif 732>8 string avic \b, HEIF Image AVC 733!:mime image/heif 734>8 string hevm \b, HEIF Image Sequence L-HEVC 735!:mime image/heif-sequence 736>8 string hevs \b, HEIF Image Sequence L-HEVC 737!:mime image/heif-sequence 738>8 string avcs \b, HEIF Image Sequence AVC 739!:mime image/heif-sequence 740 741>8 string ROSS \b, Ross Video 742>8 string sdv \b, SD Memory Card Video 743>8 string ssc1 \b, Samsung stereo, single stream (patent pending) 744>8 string ssc2 \b, Samsung stereo, dual stream (patent pending) 745 746# MPEG sequences 747# Scans for all common MPEG header start codes 7480 belong 0x00000001 749>4 byte&0x1F 0x07 JVT NAL sequence, H.264 video 750>>5 byte 66 \b, baseline 751>>5 byte 77 \b, main 752>>5 byte 88 \b, extended 753>>7 byte x \b @ L %u 7540 belong&0xFFFFFF00 0x00000100 755>3 byte 0xBA MPEG sequence 756!:mime video/mpeg 757>>4 byte &0x40 \b, v2, program multiplex 758>>4 byte ^0x40 \b, v1, system multiplex 759>3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header) 760>3 byte&0x1F 0x07 MPEG sequence, H.264 video 761>>4 byte 66 \b, baseline 762>>4 byte 77 \b, main 763>>4 byte 88 \b, extended 764>>6 byte x \b @ L %u 765# GRR too general as it catches also FoxPro Memo example NG.FPT 766>3 byte 0xB0 MPEG sequence, v4 767# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000 768#>>4 byte !0 MPEG sequence, v4 769!:mime video/mpeg4-generic 770>>5 belong 0x000001B5 771>>>9 byte &0x80 772>>>>10 byte&0xF0 16 \b, video 773>>>>10 byte&0xF0 32 \b, still texture 774>>>>10 byte&0xF0 48 \b, mesh 775>>>>10 byte&0xF0 64 \b, face 776>>>9 byte&0xF8 8 \b, video 777>>>9 byte&0xF8 16 \b, still texture 778>>>9 byte&0xF8 24 \b, mesh 779>>>9 byte&0xF8 32 \b, face 780>>4 byte 1 \b, simple @ L1 781>>4 byte 2 \b, simple @ L2 782>>4 byte 3 \b, simple @ L3 783>>4 byte 4 \b, simple @ L0 784>>4 byte 17 \b, simple scalable @ L1 785>>4 byte 18 \b, simple scalable @ L2 786>>4 byte 33 \b, core @ L1 787>>4 byte 34 \b, core @ L2 788>>4 byte 50 \b, main @ L2 789>>4 byte 51 \b, main @ L3 790>>4 byte 53 \b, main @ L4 791>>4 byte 66 \b, n-bit @ L2 792>>4 byte 81 \b, scalable texture @ L1 793>>4 byte 97 \b, simple face animation @ L1 794>>4 byte 98 \b, simple face animation @ L2 795>>4 byte 99 \b, simple face basic animation @ L1 796>>4 byte 100 \b, simple face basic animation @ L2 797>>4 byte 113 \b, basic animation text @ L1 798>>4 byte 114 \b, basic animation text @ L2 799>>4 byte 129 \b, hybrid @ L1 800>>4 byte 130 \b, hybrid @ L2 801>>4 byte 145 \b, advanced RT simple @ L! 802>>4 byte 146 \b, advanced RT simple @ L2 803>>4 byte 147 \b, advanced RT simple @ L3 804>>4 byte 148 \b, advanced RT simple @ L4 805>>4 byte 161 \b, core scalable @ L1 806>>4 byte 162 \b, core scalable @ L2 807>>4 byte 163 \b, core scalable @ L3 808>>4 byte 177 \b, advanced coding efficiency @ L1 809>>4 byte 178 \b, advanced coding efficiency @ L2 810>>4 byte 179 \b, advanced coding efficiency @ L3 811>>4 byte 180 \b, advanced coding efficiency @ L4 812>>4 byte 193 \b, advanced core @ L1 813>>4 byte 194 \b, advanced core @ L2 814>>4 byte 209 \b, advanced scalable texture @ L1 815>>4 byte 210 \b, advanced scalable texture @ L2 816>>4 byte 211 \b, advanced scalable texture @ L3 817>>4 byte 225 \b, simple studio @ L1 818>>4 byte 226 \b, simple studio @ L2 819>>4 byte 227 \b, simple studio @ L3 820>>4 byte 228 \b, simple studio @ L4 821>>4 byte 229 \b, core studio @ L1 822>>4 byte 230 \b, core studio @ L2 823>>4 byte 231 \b, core studio @ L3 824>>4 byte 232 \b, core studio @ L4 825>>4 byte 240 \b, advanced simple @ L0 826>>4 byte 241 \b, advanced simple @ L1 827>>4 byte 242 \b, advanced simple @ L2 828>>4 byte 243 \b, advanced simple @ L3 829>>4 byte 244 \b, advanced simple @ L4 830>>4 byte 245 \b, advanced simple @ L5 831>>4 byte 247 \b, advanced simple @ L3b 832>>4 byte 248 \b, FGS @ L0 833>>4 byte 249 \b, FGS @ L1 834>>4 byte 250 \b, FGS @ L2 835>>4 byte 251 \b, FGS @ L3 836>>4 byte 252 \b, FGS @ L4 837>>4 byte 253 \b, FGS @ L5 838>3 byte 0xB5 MPEG sequence, v4 839!:mime video/mpeg4-generic 840>>4 byte &0x80 841>>>5 byte&0xF0 16 \b, video (missing profile header) 842>>>5 byte&0xF0 32 \b, still texture (missing profile header) 843>>>5 byte&0xF0 48 \b, mesh (missing profile header) 844>>>5 byte&0xF0 64 \b, face (missing profile header) 845>>4 byte&0xF8 8 \b, video (missing profile header) 846>>4 byte&0xF8 16 \b, still texture (missing profile header) 847>>4 byte&0xF8 24 \b, mesh (missing profile header) 848>>4 byte&0xF8 32 \b, face (missing profile header) 849>3 byte 0xB3 MPEG sequence 850!:mime video/mpeg 851>>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 852>>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 853>>12 belong 0x000001B5 \b, v2, 854>>>16 byte&0x0F 1 \b HP 855>>>16 byte&0x0F 2 \b Spt 856>>>16 byte&0x0F 3 \b SNR 857>>>16 byte&0x0F 4 \b MP 858>>>16 byte&0x0F 5 \b SP 859>>>17 byte&0xF0 64 \b@HL 860>>>17 byte&0xF0 96 \b@H-14 861>>>17 byte&0xF0 128 \b@ML 862>>>17 byte&0xF0 160 \b@LL 863>>>17 byte &0x08 \b progressive 864>>>17 byte ^0x08 \b interlaced 865>>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video 866>>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video 867>>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video 868>>11 byte &0x02 869>>>75 byte &0x01 870>>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 871>>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 872>>>>140 belong 0x000001B5 \b, v2, 873>>>>>144 byte&0x0F 1 \b HP 874>>>>>144 byte&0x0F 2 \b Spt 875>>>>>144 byte&0x0F 3 \b SNR 876>>>>>144 byte&0x0F 4 \b MP 877>>>>>144 byte&0x0F 5 \b SP 878>>>>>145 byte&0xF0 64 \b@HL 879>>>>>145 byte&0xF0 96 \b@H-14 880>>>>>145 byte&0xF0 128 \b@ML 881>>>>>145 byte&0xF0 160 \b@LL 882>>>>>145 byte &0x08 \b progressive 883>>>>>145 byte ^0x08 \b interlaced 884>>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video 885>>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video 886>>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video 887>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 888>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 889>>76 belong 0x000001B5 \b, v2, 890>>>80 byte&0x0F 1 \b HP 891>>>80 byte&0x0F 2 \b Spt 892>>>80 byte&0x0F 3 \b SNR 893>>>80 byte&0x0F 4 \b MP 894>>>80 byte&0x0F 5 \b SP 895>>>81 byte&0xF0 64 \b@HL 896>>>81 byte&0xF0 96 \b@H-14 897>>>81 byte&0xF0 128 \b@ML 898>>>81 byte&0xF0 160 \b@LL 899>>>81 byte &0x08 \b progressive 900>>>81 byte ^0x08 \b interlaced 901>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video 902>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video 903>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video 904>>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P 905>>>7 byte&0xF0 0x10 \b, 16:9 906>>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I 907>>>7 byte&0xF0 0x10 \b, 16:9 908>>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture 909>>>7 byte&0xF0 0x10 \b, 4:3 910>>4 beshort&0xFFF0 0x2C00 \b, 4CIF 911>>>5 beshort&0x0FFF 0x01E0 \b NTSC 912>>>5 beshort&0x0FFF 0x0240 \b PAL 913>>>7 byte&0xF0 0x20 \b, 4:3 914>>>7 byte&0xF0 0x30 \b, 16:9 915>>>7 byte&0xF0 0x40 \b, 11:5 916>>>7 byte&0xF0 0x80 \b, PAL 4:3 917>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 918>>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P 919>>>7 byte&0xF0 0x10 \b, 4:3 920>>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240 921>>>7 byte&0xF0 0x10 \b, 4:3 922>>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160 923>>>7 byte&0xF0 0x10 \b, 4:3 924>>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120 925>>>7 byte&0xF0 0x10 \b, 4:3 926>>4 beshort&0xFFF0 0x1600 \b, CIF 927>>>5 beshort&0x0FFF 0x00F0 \b NTSC 928>>>5 beshort&0x0FFF 0x0120 \b PAL 929>>>7 byte&0xF0 0x20 \b, 4:3 930>>>7 byte&0xF0 0x30 \b, 16:9 931>>>7 byte&0xF0 0x40 \b, 11:5 932>>>7 byte&0xF0 0x80 \b, PAL 4:3 933>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 934>>>5 beshort&0x0FFF 0x0240 \b PAL 625 935>>>>7 byte&0xF0 0x20 \b, 4:3 936>>>>7 byte&0xF0 0x30 \b, 16:9 937>>>>7 byte&0xF0 0x40 \b, 11:5 938>>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU 939>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 940>>>5 beshort&0x0FFF 0x0240 \b PAL 625 941>>>7 byte&0xF0 0x20 \b, 4:3 942>>>7 byte&0xF0 0x30 \b, 16:9 943>>>7 byte&0xF0 0x40 \b, 11:5 944>>4 beshort&0xFFF0 0x1E00 \b, SVCD 945>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 946>>>5 beshort&0x0FFF 0x0240 \b PAL 625 947>>>7 byte&0xF0 0x20 \b, 4:3 948>>>7 byte&0xF0 0x30 \b, 16:9 949>>>7 byte&0xF0 0x40 \b, 11:5 950>>7 byte&0x0F 1 \b, 23.976 fps 951>>7 byte&0x0F 2 \b, 24 fps 952>>7 byte&0x0F 3 \b, 25 fps 953>>7 byte&0x0F 4 \b, 29.97 fps 954>>7 byte&0x0F 5 \b, 30 fps 955>>7 byte&0x0F 6 \b, 50 fps 956>>7 byte&0x0F 7 \b, 59.94 fps 957>>7 byte&0x0F 8 \b, 60 fps 958>>11 byte &0x04 \b, Constrained 959 960# MPEG ADTS Audio (*.mpx/mxa/aac) 961# from dreesen@math.fu-berlin.de 962# modified to fully support MPEG ADTS 963 964# MP3, M1A 965# modified by Joerg Jenderek 966# GRR the original test are too common for many DOS files 967# so don't accept as MP3 until we've tested the rate 9680 beshort&0xFFFE 0xFFFA 969# rates 970>2 byte&0xF0 0x10 MPEG ADTS, layer III, v1, 32 kbps 971!:mime audio/mpeg 972>2 byte&0xF0 0x20 MPEG ADTS, layer III, v1, 40 kbps 973!:mime audio/mpeg 974>2 byte&0xF0 0x30 MPEG ADTS, layer III, v1, 48 kbps 975!:mime audio/mpeg 976>2 byte&0xF0 0x40 MPEG ADTS, layer III, v1, 56 kbps 977!:mime audio/mpeg 978>2 byte&0xF0 0x50 MPEG ADTS, layer III, v1, 64 kbps 979!:mime audio/mpeg 980>2 byte&0xF0 0x60 MPEG ADTS, layer III, v1, 80 kbps 981!:mime audio/mpeg 982>2 byte&0xF0 0x70 MPEG ADTS, layer III, v1, 96 kbps 983!:mime audio/mpeg 984>2 byte&0xF0 0x80 MPEG ADTS, layer III, v1, 112 kbps 985!:mime audio/mpeg 986>2 byte&0xF0 0x90 MPEG ADTS, layer III, v1, 128 kbps 987!:mime audio/mpeg 988>2 byte&0xF0 0xA0 MPEG ADTS, layer III, v1, 160 kbps 989!:mime audio/mpeg 990>2 byte&0xF0 0xB0 MPEG ADTS, layer III, v1, 192 kbps 991!:mime audio/mpeg 992>2 byte&0xF0 0xC0 MPEG ADTS, layer III, v1, 224 kbps 993!:mime audio/mpeg 994>2 byte&0xF0 0xD0 MPEG ADTS, layer III, v1, 256 kbps 995!:mime audio/mpeg 996>2 byte&0xF0 0xE0 MPEG ADTS, layer III, v1, 320 kbps 997!:mime audio/mpeg 998# timing 999>2 byte&0x0C 0x00 \b, 44.1 kHz 1000>2 byte&0x0C 0x04 \b, 48 kHz 1001>2 byte&0x0C 0x08 \b, 32 kHz 1002# channels/options 1003>3 byte&0xC0 0x00 \b, Stereo 1004>3 byte&0xC0 0x40 \b, JntStereo 1005>3 byte&0xC0 0x80 \b, 2x Monaural 1006>3 byte&0xC0 0xC0 \b, Monaural 1007#>1 byte ^0x01 \b, Data Verify 1008#>2 byte &0x02 \b, Packet Pad 1009#>2 byte &0x01 \b, Custom Flag 1010#>3 byte &0x08 \b, Copyrighted 1011#>3 byte &0x04 \b, Original Source 1012#>3 byte&0x03 1 \b, NR: 50/15 ms 1013#>3 byte&0x03 3 \b, NR: CCIT J.17 1014 1015# MP2, M1A 10160 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 1017!:mime audio/mpeg 1018# rates 1019>2 byte&0xF0 0x10 \b, 32 kbps 1020>2 byte&0xF0 0x20 \b, 48 kbps 1021>2 byte&0xF0 0x30 \b, 56 kbps 1022>2 byte&0xF0 0x40 \b, 64 kbps 1023>2 byte&0xF0 0x50 \b, 80 kbps 1024>2 byte&0xF0 0x60 \b, 96 kbps 1025>2 byte&0xF0 0x70 \b, 112 kbps 1026>2 byte&0xF0 0x80 \b, 128 kbps 1027>2 byte&0xF0 0x90 \b, 160 kbps 1028>2 byte&0xF0 0xA0 \b, 192 kbps 1029>2 byte&0xF0 0xB0 \b, 224 kbps 1030>2 byte&0xF0 0xC0 \b, 256 kbps 1031>2 byte&0xF0 0xD0 \b, 320 kbps 1032>2 byte&0xF0 0xE0 \b, 384 kbps 1033# timing 1034>2 byte&0x0C 0x00 \b, 44.1 kHz 1035>2 byte&0x0C 0x04 \b, 48 kHz 1036>2 byte&0x0C 0x08 \b, 32 kHz 1037# channels/options 1038>3 byte&0xC0 0x00 \b, Stereo 1039>3 byte&0xC0 0x40 \b, JntStereo 1040>3 byte&0xC0 0x80 \b, 2x Monaural 1041>3 byte&0xC0 0xC0 \b, Monaural 1042#>1 byte ^0x01 \b, Data Verify 1043#>2 byte &0x02 \b, Packet Pad 1044#>2 byte &0x01 \b, Custom Flag 1045#>3 byte &0x08 \b, Copyrighted 1046#>3 byte &0x04 \b, Original Source 1047#>3 byte&0x03 1 \b, NR: 50/15 ms 1048#>3 byte&0x03 3 \b, NR: CCIT J.17 1049 1050# MPA, M1A 1051# updated by Joerg Jenderek 1052# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448 1053# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE) 1054# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries 1055#0 beshort&0xFFFE 0xFFFE 1056#>2 ubyte&0xF0 >0x0F 1057#>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1 1058## rate 1059#>>>2 byte&0xF0 0x10 \b, 32 kbps 1060#>>>2 byte&0xF0 0x20 \b, 64 kbps 1061#>>>2 byte&0xF0 0x30 \b, 96 kbps 1062#>>>2 byte&0xF0 0x40 \b, 128 kbps 1063#>>>2 byte&0xF0 0x50 \b, 160 kbps 1064#>>>2 byte&0xF0 0x60 \b, 192 kbps 1065#>>>2 byte&0xF0 0x70 \b, 224 kbps 1066#>>>2 byte&0xF0 0x80 \b, 256 kbps 1067#>>>2 byte&0xF0 0x90 \b, 288 kbps 1068#>>>2 byte&0xF0 0xA0 \b, 320 kbps 1069#>>>2 byte&0xF0 0xB0 \b, 352 kbps 1070#>>>2 byte&0xF0 0xC0 \b, 384 kbps 1071#>>>2 byte&0xF0 0xD0 \b, 416 kbps 1072#>>>2 byte&0xF0 0xE0 \b, 448 kbps 1073## timing 1074#>>>2 byte&0x0C 0x00 \b, 44.1 kHz 1075#>>>2 byte&0x0C 0x04 \b, 48 kHz 1076#>>>2 byte&0x0C 0x08 \b, 32 kHz 1077## channels/options 1078#>>>3 byte&0xC0 0x00 \b, Stereo 1079#>>>3 byte&0xC0 0x40 \b, JntStereo 1080#>>>3 byte&0xC0 0x80 \b, 2x Monaural 1081#>>>3 byte&0xC0 0xC0 \b, Monaural 1082##>1 byte ^0x01 \b, Data Verify 1083##>2 byte &0x02 \b, Packet Pad 1084##>2 byte &0x01 \b, Custom Flag 1085##>3 byte &0x08 \b, Copyrighted 1086##>3 byte &0x04 \b, Original Source 1087##>3 byte&0x03 1 \b, NR: 50/15 ms 1088##>3 byte&0x03 3 \b, NR: CCIT J.17 1089 1090# MP3, M2A 10910 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2 1092!:mime audio/mpeg 1093# rate 1094>2 byte&0xF0 0x10 \b, 8 kbps 1095>2 byte&0xF0 0x20 \b, 16 kbps 1096>2 byte&0xF0 0x30 \b, 24 kbps 1097>2 byte&0xF0 0x40 \b, 32 kbps 1098>2 byte&0xF0 0x50 \b, 40 kbps 1099>2 byte&0xF0 0x60 \b, 48 kbps 1100>2 byte&0xF0 0x70 \b, 56 kbps 1101>2 byte&0xF0 0x80 \b, 64 kbps 1102>2 byte&0xF0 0x90 \b, 80 kbps 1103>2 byte&0xF0 0xA0 \b, 96 kbps 1104>2 byte&0xF0 0xB0 \b, 112 kbps 1105>2 byte&0xF0 0xC0 \b, 128 kbps 1106>2 byte&0xF0 0xD0 \b, 144 kbps 1107>2 byte&0xF0 0xE0 \b, 160 kbps 1108# timing 1109>2 byte&0x0C 0x00 \b, 22.05 kHz 1110>2 byte&0x0C 0x04 \b, 24 kHz 1111>2 byte&0x0C 0x08 \b, 16 kHz 1112# channels/options 1113>3 byte&0xC0 0x00 \b, Stereo 1114>3 byte&0xC0 0x40 \b, JntStereo 1115>3 byte&0xC0 0x80 \b, 2x Monaural 1116>3 byte&0xC0 0xC0 \b, Monaural 1117#>1 byte ^0x01 \b, Data Verify 1118#>2 byte &0x02 \b, Packet Pad 1119#>2 byte &0x01 \b, Custom Flag 1120#>3 byte &0x08 \b, Copyrighted 1121#>3 byte &0x04 \b, Original Source 1122#>3 byte&0x03 1 \b, NR: 50/15 ms 1123#>3 byte&0x03 3 \b, NR: CCIT J.17 1124 1125# MP2, M2A 11260 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2 1127!:mime audio/mpeg 1128# rate 1129>2 byte&0xF0 0x10 \b, 8 kbps 1130>2 byte&0xF0 0x20 \b, 16 kbps 1131>2 byte&0xF0 0x30 \b, 24 kbps 1132>2 byte&0xF0 0x40 \b, 32 kbps 1133>2 byte&0xF0 0x50 \b, 40 kbps 1134>2 byte&0xF0 0x60 \b, 48 kbps 1135>2 byte&0xF0 0x70 \b, 56 kbps 1136>2 byte&0xF0 0x80 \b, 64 kbps 1137>2 byte&0xF0 0x90 \b, 80 kbps 1138>2 byte&0xF0 0xA0 \b, 96 kbps 1139>2 byte&0xF0 0xB0 \b, 112 kbps 1140>2 byte&0xF0 0xC0 \b, 128 kbps 1141>2 byte&0xF0 0xD0 \b, 144 kbps 1142>2 byte&0xF0 0xE0 \b, 160 kbps 1143# timing 1144>2 byte&0x0C 0x00 \b, 22.05 kHz 1145>2 byte&0x0C 0x04 \b, 24 kHz 1146>2 byte&0x0C 0x08 \b, 16 kHz 1147# channels/options 1148>3 byte&0xC0 0x00 \b, Stereo 1149>3 byte&0xC0 0x40 \b, JntStereo 1150>3 byte&0xC0 0x80 \b, 2x Monaural 1151>3 byte&0xC0 0xC0 \b, Monaural 1152#>1 byte ^0x01 \b, Data Verify 1153#>2 byte &0x02 \b, Packet Pad 1154#>2 byte &0x01 \b, Custom Flag 1155#>3 byte &0x08 \b, Copyrighted 1156#>3 byte &0x04 \b, Original Source 1157#>3 byte&0x03 1 \b, NR: 50/15 ms 1158#>3 byte&0x03 3 \b, NR: CCIT J.17 1159 1160# MPA, M2A 11610 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2 1162!:mime audio/mpeg 1163# rate 1164>2 byte&0xF0 0x10 \b, 32 kbps 1165>2 byte&0xF0 0x20 \b, 48 kbps 1166>2 byte&0xF0 0x30 \b, 56 kbps 1167>2 byte&0xF0 0x40 \b, 64 kbps 1168>2 byte&0xF0 0x50 \b, 80 kbps 1169>2 byte&0xF0 0x60 \b, 96 kbps 1170>2 byte&0xF0 0x70 \b, 112 kbps 1171>2 byte&0xF0 0x80 \b, 128 kbps 1172>2 byte&0xF0 0x90 \b, 144 kbps 1173>2 byte&0xF0 0xA0 \b, 160 kbps 1174>2 byte&0xF0 0xB0 \b, 176 kbps 1175>2 byte&0xF0 0xC0 \b, 192 kbps 1176>2 byte&0xF0 0xD0 \b, 224 kbps 1177>2 byte&0xF0 0xE0 \b, 256 kbps 1178# timing 1179>2 byte&0x0C 0x00 \b, 22.05 kHz 1180>2 byte&0x0C 0x04 \b, 24 kHz 1181>2 byte&0x0C 0x08 \b, 16 kHz 1182# channels/options 1183>3 byte&0xC0 0x00 \b, Stereo 1184>3 byte&0xC0 0x40 \b, JntStereo 1185>3 byte&0xC0 0x80 \b, 2x Monaural 1186>3 byte&0xC0 0xC0 \b, Monaural 1187#>1 byte ^0x01 \b, Data Verify 1188#>2 byte &0x02 \b, Packet Pad 1189#>2 byte &0x01 \b, Custom Flag 1190#>3 byte &0x08 \b, Copyrighted 1191#>3 byte &0x04 \b, Original Source 1192#>3 byte&0x03 1 \b, NR: 50/15 ms 1193#>3 byte&0x03 3 \b, NR: CCIT J.17 1194 1195# MP3, M25A 11960 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5 1197!:mime audio/mpeg 1198# rate 1199>2 byte&0xF0 0x10 \b, 8 kbps 1200>2 byte&0xF0 0x20 \b, 16 kbps 1201>2 byte&0xF0 0x30 \b, 24 kbps 1202>2 byte&0xF0 0x40 \b, 32 kbps 1203>2 byte&0xF0 0x50 \b, 40 kbps 1204>2 byte&0xF0 0x60 \b, 48 kbps 1205>2 byte&0xF0 0x70 \b, 56 kbps 1206>2 byte&0xF0 0x80 \b, 64 kbps 1207>2 byte&0xF0 0x90 \b, 80 kbps 1208>2 byte&0xF0 0xA0 \b, 96 kbps 1209>2 byte&0xF0 0xB0 \b, 112 kbps 1210>2 byte&0xF0 0xC0 \b, 128 kbps 1211>2 byte&0xF0 0xD0 \b, 144 kbps 1212>2 byte&0xF0 0xE0 \b, 160 kbps 1213# timing 1214>2 byte&0x0C 0x00 \b, 11.025 kHz 1215>2 byte&0x0C 0x04 \b, 12 kHz 1216>2 byte&0x0C 0x08 \b, 8 kHz 1217# channels/options 1218>3 byte&0xC0 0x00 \b, Stereo 1219>3 byte&0xC0 0x40 \b, JntStereo 1220>3 byte&0xC0 0x80 \b, 2x Monaural 1221>3 byte&0xC0 0xC0 \b, Monaural 1222#>1 byte ^0x01 \b, Data Verify 1223#>2 byte &0x02 \b, Packet Pad 1224#>2 byte &0x01 \b, Custom Flag 1225#>3 byte &0x08 \b, Copyrighted 1226#>3 byte &0x04 \b, Original Source 1227#>3 byte&0x03 1 \b, NR: 50/15 ms 1228#>3 byte&0x03 3 \b, NR: CCIT J.17 1229 1230# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio 1231 1232# Stored AAC streams (instead of the MP4 format) 12330 string ADIF MPEG ADIF, AAC 1234!:mime audio/x-hx-aac-adif 1235>4 byte &0x80 1236>>13 byte &0x10 \b, VBR 1237>>13 byte ^0x10 \b, CBR 1238>>16 byte&0x1E 0x02 \b, single stream 1239>>16 byte&0x1E 0x04 \b, 2 streams 1240>>16 byte&0x1E 0x06 \b, 3 streams 1241>>16 byte &0x08 \b, 4 or more streams 1242>>16 byte &0x10 \b, 8 or more streams 1243>>4 byte &0x80 \b, Copyrighted 1244>>13 byte &0x40 \b, Original Source 1245>>13 byte &0x20 \b, Home Flag 1246>4 byte ^0x80 1247>>4 byte &0x10 \b, VBR 1248>>4 byte ^0x10 \b, CBR 1249>>7 byte&0x1E 0x02 \b, single stream 1250>>7 byte&0x1E 0x04 \b, 2 streams 1251>>7 byte&0x1E 0x06 \b, 3 streams 1252>>7 byte &0x08 \b, 4 or more streams 1253>>7 byte &0x10 \b, 8 or more streams 1254>>4 byte &0x40 \b, Original Stream(s) 1255>>4 byte &0x20 \b, Home Source 1256 1257# Live or stored single AAC stream (used with MPEG-2 systems) 12580 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC 1259!:mime audio/x-hx-aac-adts 1260>1 byte &0x08 \b, v2 1261>1 byte ^0x08 \b, v4 1262# profile 1263>>2 byte &0xC0 \b LTP 1264>2 byte&0xc0 0x00 \b Main 1265>2 byte&0xc0 0x40 \b LC 1266>2 byte&0xc0 0x80 \b SSR 1267# timing 1268>2 byte&0x3c 0x00 \b, 96 kHz 1269>2 byte&0x3c 0x04 \b, 88.2 kHz 1270>2 byte&0x3c 0x08 \b, 64 kHz 1271>2 byte&0x3c 0x0c \b, 48 kHz 1272>2 byte&0x3c 0x10 \b, 44.1 kHz 1273>2 byte&0x3c 0x14 \b, 32 kHz 1274>2 byte&0x3c 0x18 \b, 24 kHz 1275>2 byte&0x3c 0x1c \b, 22.05 kHz 1276>2 byte&0x3c 0x20 \b, 16 kHz 1277>2 byte&0x3c 0x24 \b, 12 kHz 1278>2 byte&0x3c 0x28 \b, 11.025 kHz 1279>2 byte&0x3c 0x2c \b, 8 kHz 1280# channels 1281>2 beshort&0x01c0 0x0040 \b, monaural 1282>2 beshort&0x01c0 0x0080 \b, stereo 1283>2 beshort&0x01c0 0x00c0 \b, stereo + center 1284>2 beshort&0x01c0 0x0100 \b, stereo+center+LFE 1285>2 beshort&0x01c0 0x0140 \b, surround 1286>2 beshort&0x01c0 0x0180 \b, surround + LFE 1287>2 beshort &0x01C0 \b, surround + side 1288#>1 byte ^0x01 \b, Data Verify 1289#>2 byte &0x02 \b, Custom Flag 1290#>3 byte &0x20 \b, Original Stream 1291#>3 byte &0x10 \b, Home Source 1292#>3 byte &0x08 \b, Copyrighted 1293 1294# Live MPEG-4 audio streams (instead of RTP FlexMux) 12950 beshort&0xFFE0 0x56E0 MPEG-4 LOAS 1296!:mime audio/x-mp4a-latm 1297#>1 beshort&0x1FFF x \b, %hu byte packet 1298>3 byte&0xE0 0x40 1299>>4 byte&0x3C 0x04 \b, single stream 1300>>4 byte&0x3C 0x08 \b, 2 streams 1301>>4 byte&0x3C 0x0C \b, 3 streams 1302>>4 byte &0x08 \b, 4 or more streams 1303>>4 byte &0x20 \b, 8 or more streams 1304>3 byte&0xC0 0 1305>>4 byte&0x78 0x08 \b, single stream 1306>>4 byte&0x78 0x10 \b, 2 streams 1307>>4 byte&0x78 0x18 \b, 3 streams 1308>>4 byte &0x20 \b, 4 or more streams 1309>>4 byte &0x40 \b, 8 or more streams 1310# This magic isn't strong enough (matches plausible ISO-8859-1 text) 1311#0 beshort 0x4DE1 MPEG-4 LO-EP audio stream 1312#!:mime audio/x-mp4a-latm 1313 1314# Summary: FLI animation format 1315# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 1316# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 13174 leshort 0xAF11 1318# standard FLI always has 320x200 resolution and 8 bit color 1319>8 leshort 320 1320>>10 leshort 200 1321>>>12 leshort 8 FLI animation, 320x200x8 1322!:mime video/x-fli 1323>>>>6 leshort x \b, %d frames 1324# frame speed is multiple of 1/70s 1325>>>>16 leshort x \b, %d/70s per frame 1326 1327# Summary: FLC animation format 1328# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 1329# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 13304 leshort 0xAF12 1331# standard FLC always use 8 bit color 1332>12 leshort 8 FLC animation 1333!:mime video/x-flc 1334>>8 leshort x \b, %d 1335>>10 leshort x \bx%dx8 1336>>6 uleshort x \b, %d frames 1337>>16 uleshort x \b, %dms per frame 1338 1339# DL animation format 1340# XXX - collision with most `mips' magic 1341# 1342# I couldn't find a real magic number for these, however, this 1343# -appears- to work. Note that it might catch other files, too, so be 1344# careful! 1345# 1346# Note that title and author appear in the two 20-byte chunks 1347# at decimal offsets 2 and 22, respectively, but they are XOR'ed with 1348# 255 (hex FF)! The DL format is really bad. 1349# 1350#0 byte 1 DL version 1, medium format (160x100, 4 images/screen) 1351#!:mime video/x-unknown 1352#>42 byte x - %d screens, 1353#>43 byte x %d commands 1354#0 byte 2 DL version 2 1355#!:mime video/x-unknown 1356#>1 byte 1 - large format (320x200,1 image/screen), 1357#>1 byte 2 - medium format (160x100,4 images/screen), 1358#>1 byte >2 - unknown format, 1359#>42 byte x %d screens, 1360#>43 byte x %d commands 1361# Based on empirical evidence, DL version 3 have several nulls following the 1362# \003. Most of them start with non-null values at hex offset 0x34 or so. 1363#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3 1364 1365# iso 13818 transport stream 1366# 1367# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1) 1368# syncbyte 8 bit 0x47 1369# error_ind 1 bit - 1370# payload_start 1 bit 1 1371# priority 1 bit - 1372# PID 13 bit 0x0000 1373# scrambling 2 bit - 1374# adaptfld_ctrl 2 bit 1 or 3 1375# conti_count 4 bit - 13760 belong&0xFF5FFF10 0x47400010 1377>188 byte 0x47 MPEG transport stream data 1378 1379# DIF digital video file format <mpruett@sgi.com> 13800 belong&0xffffff00 0x1f070000 DIF 1381>4 byte &0x01 (DVCPRO) movie file 1382>4 byte ^0x01 (DV) movie file 1383>3 byte &0x80 (PAL) 1384>3 byte ^0x80 (NTSC) 1385 1386# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com> 13870 belong 0x3026b275 Microsoft ASF 1388!:mime video/x-ms-asf 1389 1390# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 13910 string \x8aMNG MNG video data, 1392!:mime video/x-mng 1393>4 belong !0x0d0a1a0a CORRUPTED, 1394>4 belong 0x0d0a1a0a 1395>>16 belong x %d x 1396>>20 belong x %d 1397 1398# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 13990 string \x8bJNG JNG video data, 1400!:mime video/x-jng 1401>4 belong !0x0d0a1a0a CORRUPTED, 1402>4 belong 0x0d0a1a0a 1403>>16 belong x %d x 1404>>20 belong x %d 1405 1406# Vivo video (Wolfram Kleff) 14073 string \x0D\x0AVersion:Vivo Vivo video data 1408 1409# VRML (Virtual Reality Modelling Language) 14100 string/w #VRML\ V1.0\ ascii VRML 1 file 1411!:mime model/vrml 14120 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file 1413!:mime model/vrml 1414 1415# X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd] 1416# From Michel Briand <michelbriand@free.fr> 1417# mimetype from https://www.iana.org/assignments/media-types/model/x3d+xml 1418# Example http://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d 14190 string/w \<?xml\ version= 1420!:strength + 5 1421>20 search/1000/w \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text 1422!:mime model/x3d+xml 1423 1424#--------------------------------------------------------------------------- 1425# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube 1426# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03 1427# 14280 string HVQM4 %s 1429>6 string >\0 v%s 1430>0 byte x GameCube movie, 1431>0x34 ubeshort x %d x 1432>0x36 ubeshort x %d, 1433>0x26 ubeshort x %dus, 1434>0x42 ubeshort 0 no audio 1435>0x42 ubeshort >0 %dHz audio 1436 1437# From: "Stefan A. Haubenthal" <polluks@web.de> 14380 string DVDVIDEO-VTS Video title set, 1439>0x21 byte x v%x 14400 string DVDVIDEO-VMG Video manager, 1441>0x21 byte x v%x 1442 1443# From: Behan Webster <behanw@websterwood.com> 1444# NuppelVideo used by Mythtv (*.nuv) 1445# Note: there are two identical stanzas here differing only in the 1446# initial string matched. It used to be done with a regex, but we're 1447# trying to get rid of those. 14480 string NuppelVideo MythTV NuppelVideo 1449>12 string x v%s 1450>20 lelong x (%d 1451>24 lelong x \bx%d), 1452>36 string P \bprogressive, 1453>36 string I \binterlaced, 1454>40 ledouble x \baspect:%.2f, 1455>48 ledouble x \bfps:%.2f 14560 string MythTV MythTV NuppelVideo 1457>12 string x v%s 1458>20 lelong x (%d 1459>24 lelong x \bx%d), 1460>36 string P \bprogressive, 1461>36 string I \binterlaced, 1462>40 ledouble x \baspect:%.2f, 1463>48 ledouble x \bfps:%.2f 1464 1465# MPEG file 1466# MPEG sequences 1467# FIXME: This section is from the old magic.mime file and needs 1468# integrating with the rest 1469#0 belong 0x000001BA 1470#>4 byte &0x40 1471#!:mime video/mp2p 1472#>4 byte ^0x40 1473#!:mime video/mpeg 1474#0 belong 0x000001BB 1475#!:mime video/mpeg 1476#0 belong 0x000001B0 1477#!:mime video/mp4v-es 1478#0 belong 0x000001B5 1479#!:mime video/mp4v-es 1480#0 belong 0x000001B3 1481#!:mime video/mpv 1482#0 belong&0xFF5FFF10 0x47400010 1483#!:mime video/mp2t 1484#0 belong 0x00000001 1485#>4 byte&0x1F 0x07 1486#!:mime video/h264 1487 1488# Type: Bink Video 1489# Extension: .bik 1490# URL: http://wiki.multimedia.cx/index.php?title=Bink_Container 1491# From: <hoehle@users.sourceforge.net> 2008-07-18 14920 string BIK Bink Video 1493>3 regex =[a-z] rev.%s 1494#>4 ulelong x size %d 1495>20 ulelong x \b, %d 1496>24 ulelong x \bx%d 1497>8 ulelong x \b, %d frames 1498>32 ulelong x at rate %d/ 1499>28 ulelong >1 \b%d 1500>40 ulelong =0 \b, no audio 1501>40 ulelong !0 \b, %d audio track 1502>>40 ulelong !1 \bs 1503# follow properties of the first audio track only 1504>>48 uleshort x %dHz 1505>>51 byte&0x20 0 mono 1506>>51 byte&0x20 !0 stereo 1507#>>51 byte&0x10 0 FFT 1508#>>51 byte&0x10 !0 DCT 1509 1510# Type: NUT Container 1511# URL: http://wiki.multimedia.cx/index.php?title=NUT 1512# From: Adam Buchbinder <adam.buchbinder@gmail.com> 15130 string nut/multimedia\ container\0 NUT multimedia container 1514 1515# Type: Nullsoft Video (NSV) 1516# URL: http://wiki.multimedia.cx/index.php?title=Nullsoft_Video 1517# From: Mike Melanson <mike@multimedia.cx> 15180 string NSVf Nullsoft Video 1519 1520# Type: REDCode Video 1521# URL: http://www.red.com/ ; http://wiki.multimedia.cx/index.php?title=REDCode 1522# From: Mike Melanson <mike@multimedia.cx> 15234 string RED1 REDCode Video 1524 1525# Type: MTV Multimedia File 1526# URL: http://wiki.multimedia.cx/index.php?title=MTV 1527# From: Mike Melanson <mike@multimedia.cx> 15280 string AMVS MTV Multimedia File 1529 1530# Type: ARMovie 1531# URL: http://wiki.multimedia.cx/index.php?title=ARMovie 1532# From: Mike Melanson <mike@multimedia.cx> 15330 string ARMovie\012 ARMovie 1534 1535# Type: Interplay MVE Movie 1536# URL: http://wiki.multimedia.cx/index.php?title=Interplay_MVE 1537# From: Mike Melanson <mike@multimedia.cx> 15380 string Interplay\040MVE\040File\032 Interplay MVE Movie 1539 1540# Type: Windows Television DVR File 1541# URL: http://wiki.multimedia.cx/index.php?title=WTV 1542# From: Mike Melanson <mike@mutlimedia.cx> 1543# This takes the form of a Windows-style GUID 15440 bequad 0xB7D800203749DA11 1545>8 bequad 0xA64E0007E95EAD8D Windows Television DVR Media 1546 1547# Type: Sega FILM/CPK Multimedia 1548# URL: http://wiki.multimedia.cx/index.php?title=Sega_FILM 1549# From: Mike Melanson <mike@multimedia.cx> 15500 string FILM Sega FILM/CPK Multimedia, 1551>32 belong x %d x 1552>28 belong x %d 1553 1554# Type: Nintendo THP Multimedia 1555# URL: http://wiki.multimedia.cx/index.php?title=THP 1556# From: Mike Melanson <mike@multimedia.cx> 15570 string THP\0 Nintendo THP Multimedia 1558 1559# Type: BBC Dirac Video 1560# URL: http://wiki.multimedia.cx/index.php?title=Dirac 1561# From: Mike Melanson <mike@multimedia.cx> 15620 string BBCD BBC Dirac Video 1563 1564# Type: RAD Game Tools Smacker Multimedia 1565# URL: http://wiki.multimedia.cx/index.php?title=Smacker 1566# From: Mike Melanson <mike@multimedia.cx> 15670 string SMK RAD Game Tools Smacker Multimedia 1568>3 byte x version %c, 1569>4 lelong x %d x 1570>8 lelong x %d, 1571>12 lelong x %d frames 1572 1573# Material Exchange Format 1574# More information: 1575# https://en.wikipedia.org/wiki/Material_Exchange_Format 1576# http://www.freemxf.org/ 15770 string \x06\x0e\x2b\x34\x02\x05\x01\x01\x0d\x01\x02\x01\x01\x02 Material exchange container format 1578!:ext mxf 1579!:mime application/mxf 1580 1581# Recognize LucasArts Smush video files (cf. 1582# https://wiki.multimedia.cx/index.php/Smush) 15830 string ANIM 1584>8 string AHDR LucasArts Smush Animation Format (SAN) video 15850 string SANM 1586>8 string SHDR LucasArts Smush v2 (SANM) video 1587 1588#------------------------------------------------------------------------------ 1589# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $ 1590# aout: file(1) magic for a.out executable/object/etc entries that 1591# handle executables on multiple platforms. 1592# 1593 1594# 1595# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from 1596# BSDI), netbsd, and vax (for UNIX/32V and BSD) 1597# 1598# XXX - is there anything we can look at to distinguish BSD/OS 386 from 1599# NetBSD 386 from various VAX binaries? The BSD/OS shared library flag 1600# works only for binaries using shared libraries. Grabbing the entry 1601# point from the a.out header, using it to find the first code executed 1602# in the program, and looking at that might help. 1603# 16040 lelong 0407 a.out little-endian 32-bit executable 1605>16 lelong >0 not stripped 1606>32 byte 0x6a (uses BSD/OS shared libs) 1607 16080 lelong 0410 a.out little-endian 32-bit pure executable 1609>16 lelong >0 not stripped 1610>32 byte 0x6a (uses BSD/OS shared libs) 1611 16120 lelong 0413 a.out little-endian 32-bit demand paged pure executable 1613>16 lelong >0 not stripped 1614>32 byte 0x6a (uses BSD/OS shared libs) 1615 1616# 1617# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out), 1618# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out). 1619# 1620# XXX - is there anything we can look at to distinguish old SunOS 68010 1621# from old 68020 IRIX from old NetBSD? Again, I guess we could look at 1622# the first instruction or instructions in the program. 1623# 16240 belong 0407 a.out big-endian 32-bit executable 1625>16 belong >0 not stripped 1626 16270 belong 0410 a.out big-endian 32-bit pure executable 1628>16 belong >0 not stripped 1629 16300 belong 0413 a.out big-endian 32-bit demand paged executable 1631>16 belong >0 not stripped 1632 1633 1634#------------------------------------------------------------------------------ 1635# $File: apache,v 1.1 2017/04/11 14:52:15 christos Exp $ 1636# apache: file(1) magic for Apache Big Data formats 1637 1638# Avro files 16390 string Obj Apache Avro 1640>3 byte x version %d 1641 1642# ORC files 1643# Important information is in file footer, which we can't index to :( 16440 string ORC Apache ORC 1645 1646# Parquet files 16470 string PAR1 Apache Parquet 1648 1649# Hive RC files 16500 string RCF Apache Hive RC file 1651>3 byte x version %d 1652 1653# Sequence files (and the careless first version of RC file) 1654 16550 string SEQ 1656>3 byte <6 Apache Hadoop Sequence file version %d 1657>3 byte >6 Apache Hadoop Sequence file version %d 1658>3 byte =6 1659>>5 string org.apache.hadoop.hive.ql.io.RCFile$KeyBuffer Apache Hive RC file version 0 1660>>3 default x Apache Hadoop Sequence file version 6 1661 1662#------------------------------------------------------------------------------ 1663# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $ 1664# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL 1665# workspaces) 1666# 16670 long 0100554 APL workspace (Ken's original?) 1668 1669#------------------------------------------------------------------------------ 1670# $File: apple,v 1.39 2018/03/02 15:26:39 christos Exp $ 1671# apple: file(1) magic for Apple file formats 1672# 16730 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text 16740 string \x0aGL Binary II (apple ][) data 16750 string \x76\xff Squeezed (apple ][) data 16760 string NuFile NuFile archive (apple ][) data 16770 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 16780 belong 0x00051600 AppleSingle encoded Macintosh file 16790 belong 0x00051607 AppleDouble encoded Macintosh file 1680 1681# Type: Apple Emulator 2IMG format 1682# From: Radek Vokal <rvokal@redhat.com> 16830 string 2IMG Apple ][ 2IMG Disk Image 1684>4 string XGS! \b, XGS 1685>4 string CTKG \b, Catakig 1686>4 string ShIm \b, Sheppy's ImageMaker 1687>4 string WOOF \b, Sweet 16 1688>4 string B2TR \b, Bernie ][ the Rescue 1689>4 string !nfc \b, ASIMOV2 1690>4 string x \b, Unknown Format 1691>0xc byte 00 \b, DOS 3.3 sector order 1692>>0x10 byte 00 \b, Volume 254 1693>>0x10 byte&0x7f x \b, Volume %u 1694>0xc byte 01 \b, ProDOS sector order 1695>>0x14 short x \b, %u Blocks 1696>0xc byte 02 \b, NIB data 1697 1698# magic for Newton PDA package formats 1699# from Ruda Moura <ruda@helllabs.org> 17000 string package0 Newton package, NOS 1.x, 1701>12 belong &0x80000000 AutoRemove, 1702>12 belong &0x40000000 CopyProtect, 1703>12 belong &0x10000000 NoCompression, 1704>12 belong &0x04000000 Relocation, 1705>12 belong &0x02000000 UseFasterCompression, 1706>16 belong x version %d 1707 17080 string package1 Newton package, NOS 2.x, 1709>12 belong &0x80000000 AutoRemove, 1710>12 belong &0x40000000 CopyProtect, 1711>12 belong &0x10000000 NoCompression, 1712>12 belong &0x04000000 Relocation, 1713>12 belong &0x02000000 UseFasterCompression, 1714>16 belong x version %d 1715 17160 string package4 Newton package, 1717>8 byte 8 NOS 1.x, 1718>8 byte 9 NOS 2.x, 1719>12 belong &0x80000000 AutoRemove, 1720>12 belong &0x40000000 CopyProtect, 1721>12 belong &0x10000000 NoCompression, 1722 1723# The following entries for the Apple II are for files that have 1724# been transferred as raw binary data from an Apple, without having 1725# been encapsulated by any of the above archivers. 1726# 1727# In general, Apple II formats are hard to identify because Apple DOS 1728# and especially Apple ProDOS have strong typing in the file system and 1729# therefore programmers never felt much need to include type information 1730# in the files themselves. 1731# 1732# Eric Fischer <enf@pobox.com> 1733 1734# AppleWorks word processor: 1735# URL: https://en.wikipedia.org/wiki/AppleWorks 1736# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx 1737# Update: Joerg Jenderek 1738# NOTE: 1739# The "O" is really the magic number, but that's so common that it's 1740# necessary to check the tab stops that follow it to avoid false positives. 1741# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge 1742# the newer AppleWorks is from claris with extension CWK 17434 string O 1744# test for unused bits of zoom- , paginated-boolean bytes 1745>84 ubequad ^0x00Fe00000000Fe00 1746# look for tabstop definitions "=" no tab, "|" no tab 1747# "<" left tab,"^" center tab,">" right tab, "." decimal tab, 1748# unofficial "!" other , "\x8a" other 1749# official only if SFMinVers is nonzero 1750>>5 regex/s [=.<>|!^\x8a]{79} AppleWorks Word Processor 1751# AppleWorks Word Processor File (Apple II) 1752# ./apple (version 5.25) labeled the entry as "AppleWorks word processor data" 1753# application/x-appleworks is mime type for claris version with cwk extension 1754!:mime application/x-appleworks3 1755# http://home.earthlink.net/~hughhood/appleiiworksenvoy/ 1756# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type') 1757# $70 $1A $F8 $FF is this the apple type ? 1758#:apple pdosp�� 1759!:ext awp 1760# minimum version needed to read this files. SFMinVers (0 , 30~3.0 ) 1761>>>183 ubyte 30 3.0 1762>>>183 ubyte !30 1763>>>>183 ubyte !0 0x%x 1764# usual tabstop start sequence "=====<" 1765>>>5 string x \b, tabstop ruler "%6.6s" 1766# tabstop ruler 1767#>>>5 string >\0 \b, tabstops "%-79s" 1768# zoom switch 1769>>>85 byte&0x01 >0 \b, zoomed 1770# whether paginated 1771>>>90 byte&0x01 >0 \b, paginated 1772# contains any mail-merge commands 1773>>>92 byte&0x01 >0 \b, with mail merge 1774# left margin in 1/10 inches ( normally 0 or 10 ) 1775>>>91 ubyte >0 1776>>>>91 ubyte x \b, %d/10 inch left margin 1777 1778# AppleWorks database: 1779# 1780# This isn't really a magic number, but it's the closest thing to one 1781# that I could find. The 1 and 2 really mean "order in which you defined 1782# categories" and "left to right, top to bottom," respectively; the D and R 1783# mean that the cursor should move either down or right when you press Return. 1784 1785#30 string \x01D AppleWorks database data 1786#30 string \x02D AppleWorks database data 1787#30 string \x01R AppleWorks database data 1788#30 string \x02R AppleWorks database data 1789 1790# AppleWorks spreadsheet: 1791# 1792# Likewise, this isn't really meant as a magic number. The R or C means 1793# row- or column-order recalculation; the A or M means automatic or manual 1794# recalculation. 1795 1796#131 string RA AppleWorks spreadsheet data 1797#131 string RM AppleWorks spreadsheet data 1798#131 string CA AppleWorks spreadsheet data 1799#131 string CM AppleWorks spreadsheet data 1800 1801# Applesoft BASIC: 1802# 1803# This is incredibly sloppy, but will be true if the program was 1804# written at its usual memory location of 2048 and its first line 1805# number is less than 256. Yuck. 1806# update by Joerg Jenderek at Feb 2013 1807 1808# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000) 1809#0 belong&0xff00ff 0x80000 Applesoft BASIC program data 18100 belong&0x00ff00ff 0x00080000 1811# assuming that line number must be positive 1812>2 leshort >0 Applesoft BASIC program data, first line number %d 1813#>2 leshort x \b, first line number %d 1814 1815# ORCA/EZ assembler: 1816# 1817# This will not identify ORCA/M source files, since those have 1818# some sort of date code instead of the two zero bytes at 6 and 7 1819# XXX Conflicts with ELF 1820#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data 1821#>5 byte x \b, build number %d 1822 1823# Broderbund Fantavision 1824# 1825# I don't know what these values really mean, but they seem to recur. 1826# Will they cause too many conflicts? 1827 1828# Probably :-) 1829#2 belong&0xFF00FF 0x040008 Fantavision movie data 1830 1831# Some attempts at images. 1832# 1833# These are actually just bit-for-bit dumps of the frame buffer, so 1834# there's really no reasonably way to distinguish them except for their 1835# address (if preserved) -- 8192 or 16384 -- and their length -- 8192 1836# or, occasionally, 8184. 1837# 1838# Nevertheless this will manage to catch a lot of images that happen 1839# to have a solid-colored line at the bottom of the screen. 1840 1841# GRR: Magic too weak 1842#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background 1843#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background 1844#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background 1845#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background 1846#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background 1847 1848# Beagle Bros. Apple Mechanic fonts 1849 18500 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font 1851 1852# Apple Universal Disk Image Format (UDIF) - dmg files. 1853# From Johan Gade. 1854# These entries are disabled for now until we fix the following issues. 1855# 1856# Note there might be some problems with the "VAX COFF executable" 1857# entry. Note this entry should be placed before the mac filesystem section, 1858# particularly the "Apple Partition data" entry. 1859# 1860# The intended meaning of these tests is, that the file is only of the 1861# specified type if both of the lines are correct - i.e. if the first 1862# line matches and the second doesn't then it is not of that type. 1863# 1864#0 long 0x7801730d 1865#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) 1866# 1867# Note that this entry is recognized correctly by the "Apple Partition 1868# data" entry - however since this entry is more specific - this 1869# information seems to be more useful. 1870#0 long 0x45520200 1871#>0x410 string disk\ image UDIF read/write image (UDRW) 1872 1873# From: Toby Peterson <toby@apple.com> 18740 string bplist00 Apple binary property list 1875 1876# Apple binary property list (bplist) 1877# Assumes version bytes are hex. 1878# Provides content hints for version 0 files. Assumes that the root 1879# object is the first object (true for CoreFoundation implementation). 1880# From: David Remahl <dremahl@apple.com> 18810 string bplist 1882>6 byte x \bCoreFoundation binary property list data, version 0x%c 1883>>7 byte x \b%c 1884>6 string 00 \b 1885>>8 byte&0xF0 0x00 \b 1886>>>8 byte&0x0F 0x00 \b, root type: null 1887>>>8 byte&0x0F 0x08 \b, root type: false boolean 1888>>>8 byte&0x0F 0x09 \b, root type: true boolean 1889>>8 byte&0xF0 0x10 \b, root type: integer 1890>>8 byte&0xF0 0x20 \b, root type: real 1891>>8 byte&0xF0 0x30 \b, root type: date 1892>>8 byte&0xF0 0x40 \b, root type: data 1893>>8 byte&0xF0 0x50 \b, root type: ascii string 1894>>8 byte&0xF0 0x60 \b, root type: unicode string 1895>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) 1896>>8 byte&0xF0 0xa0 \b, root type: array 1897>>8 byte&0xF0 0xd0 \b, root type: dictionary 1898 1899# Apple/NeXT typedstream data 1900# Serialization format used by NeXT and Apple for various 1901# purposes in YellowStep/Cocoa, including some nib files. 1902# From: David Remahl <dremahl@apple.com> 19032 string typedstream NeXT/Apple typedstream data, big endian 1904>0 byte x \b, version %d 1905>0 byte <5 \b 1906>>13 byte 0x81 \b 1907>>>14 ubeshort x \b, system %d 19082 string streamtyped NeXT/Apple typedstream data, little endian 1909>0 byte x \b, version %d 1910>0 byte <5 \b 1911>>13 byte 0x81 \b 1912>>>14 uleshort x \b, system %d 1913 1914#------------------------------------------------------------------------------ 1915# CAF: Apple CoreAudio File Format 1916# 1917# Container format for high-end audio purposes. 1918# From: David Remahl <dremahl@apple.com> 1919# 19200 string caff CoreAudio Format audio file 1921>4 beshort <10 version %d 1922>6 beshort x 1923 1924 1925#------------------------------------------------------------------------------ 1926# Keychain database files 19270 string kych Mac OS X Keychain File 1928 1929#------------------------------------------------------------------------------ 1930# Code Signing related file types 19310 belong 0xfade0c00 Mac OS X Code Requirement 1932>8 belong 1 (opExpr) 1933>4 belong x - %d bytes 1934 19350 belong 0xfade0c01 Mac OS X Code Requirement Set 1936>8 belong >1 containing %d items 1937>4 belong x - %d bytes 1938 19390 belong 0xfade0c02 Mac OS X Code Directory 1940>8 belong x version %x 1941>12 belong >0 flags 0x%x 1942>4 belong x - %d bytes 1943 19440 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) 1945>4 belong x - %d bytes 1946 19470 belong 0xfade0cc1 Mac OS X Detached Code Signature 1948>8 belong >1 (%d elements) 1949>4 belong x - %d bytes 1950 1951# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 1952# .vdi 19534 string innotek\ VirtualBox\ Disk\ Image %s 1954 1955# Apple disk partition stuff 1956# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map 1957# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h 1958# Update: Joerg Jenderek 1959# "ER" is APPLE_DRVR_MAP_MAGIC signature 19600 beshort 0x4552 1961# display Apple Driver Map (strength=50) after Syslinux bootloader (71) 1962#!:strength +0 1963# strengthen the magic by looking for used blocksizes 512 2048 1964>2 ubeshort&0xf1FF 0 Apple Driver Map 1965# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid 1966#>>504 ubequad&0x0000FFffFFff0000 0 1967!:mime application/x-apple-diskimage 1968!:apple ????devr 1969# https://en.wikipedia.org/wiki/Apple_Disk_Image 1970!:ext dmg/iso 1971# sbBlkSize for driver descriptor map 512 2048 1972>>2 beshort x \b, blocksize %d 1973# sbBlkCount sometimes garbish like 1974# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg 1975# 0xf2720100 for bunziped Firefox 48.0-2.dmg 1976# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso 1977# 0x00009090 by syslinux-6.03/utils/isohybrid.c 1978>>4 ubelong x \b, blockcount %u 1979# following device/driver information not very useful 1980# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 1981>>8 ubeshort x \b, devtype %u 1982# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 1983>>10 ubeshort x \b, devid %u 1984# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso) 1985>>12 ubelong >0 1986>>>12 ubelong x \b, driver data %u 1987# number of driver descriptors sbDrvrCount <= 61 1988# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 1989>>16 ubeshort x \b, driver count %u 1990# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map 1991# >>18 use apple-driver-map 1992# >>26 use apple-driver-map 1993# # ... 1994# >>500 use apple-driver-map 1995# number of partitions is always same in every partition (map block count) 1996#>>0x0204 ubelong x \b, %u partitions 1997>>0x0204 ubelong >0 \b, contains[@0x200]: 1998>>>0x0200 use apple-apm 1999>>0x0204 ubelong >1 \b, contains[@0x400]: 2000>>>0x0400 use apple-apm 2001>>0x0204 ubelong >2 \b, contains[@0x600]: 2002>>>0x0600 use apple-apm 2003>>0x0204 ubelong >3 \b, contains[@0x800]: 2004>>>0x0800 use apple-apm 2005>>0x0204 ubelong >4 \b, contains[@0xA00]: 2006>>>0x0A00 use apple-apm 2007>>0x0204 ubelong >5 \b, contains[@0xC00]: 2008>>>0x0C00 use apple-apm 2009>>0x0204 ubelong >6 \b, contains[@0xE00]: 2010>>>0x0E00 use apple-apm 2011>>0x0204 ubelong >7 \b, contains[@0x1000]: 2012>>>0x1000 use apple-apm 2013# display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type) 20140 name apple-driver-map 2015>0 ubequad !0 2016# descBlock first block of driver 2017>>0 ubelong x \b, driver start block %u 2018# descSize driver size in blocks 2019>>4 ubeshort x \b, size %u 2020# descType driver system type 1 701h F8FFh FFFFh 2021>>6 ubeshort x \b, type 0x%x 2022 2023# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map 2024# Reference: http://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h 2025# Update: Joerg Jenderek 2026# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the 2027# magic stronger. 2028# for apple partition map stored as a single file 20290 belong 0x504d0000 2030# to display Apple Partition Map (strength=70) after Syslinux bootloader (71) 2031#!:strength +0 2032>0 use apple-apm 2033# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type 2034# file: could not find any valid magic files! 2035#!:ext bin 2036# display apple partition map. Normally called after Apple driver map 20370 name apple-apm 2038>0 belong 0x504d0000 Apple Partition Map 2039# number of partitions 2040>>4 ubelong x \b, map block count %u 2041# logical block (512 bytes) start of partition 2042>>8 ubelong x \b, start block %u 2043>>12 ubelong x \b, block count %u 2044>>16 string >0 \b, name %s 2045>>48 string >0 \b, type %s 2046# processor type dpme_process_id[16] e.g. "68000" "68020" 2047>>120 string >0 \b, processor %s 2048# A/UX boot arguments BootArgs[128] 2049>>136 string >0 \b, boot arguments %s 2050# status of partition dpme_flags 2051>>88 belong & 1 \b, valid 2052>>88 belong & 2 \b, allocated 2053>>88 belong & 4 \b, in use 2054>>88 belong & 8 \b, has boot info 2055>>88 belong & 16 \b, readable 2056>>88 belong & 32 \b, writable 2057>>88 belong & 64 \b, pic boot code 2058>>88 belong & 128 \b, chain compatible driver 2059>>88 belong & 256 \b, real driver 2060>>88 belong & 512 \b, chain driver 2061# mount automatically at startup APPLE_PS_AUTO_MOUNT 2062>>88 ubelong &0x40000000 \b, mount at startup 2063# is the startup partition APPLE_PS_STARTUP 2064>>88 ubelong &0x80000000 \b, is the startup partition 2065 2066#http://wiki.mozilla.org/DS_Store_File_Format 2067#http://en.wikipedia.org/wiki/.DS_Store 20680 string \0\0\0\1Bud1\0 Apple Desktop Services Store 2069 2070# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015) 2071# Usually not in separate files, but have either filename rsrc with 2072# no extension, or a filename corresponding to another file, with 2073# extensions rsr/rsrc 20740 string \000\000\001\000 2075>4 leshort 0 2076>>16 lelong 0 Apple HFS/HFS+ resource fork 2077 2078#https://en.wikipedia.org/wiki/AppleScript 20790 string FasdUAS AppleScript compiled 2080 2081# AppleWorks/ClarisWorks 2082# https://github.com/joshenders/appleworks_format 2083# http://fileformats.archiveteam.org/wiki/AppleWorks 20840 name appleworks 2085>0 belong&0x00ffffff 0x07e100 AppleWorks CWK Document 2086>0 belong&0x00ffffff 0x008803 ClarisWorks CWK Document 2087>0 default x 2088>>0 belong x AppleWorks/ClarisWorks CWK Document 2089>0 byte x \b, version %d 2090>30 beshort x \b, %d 2091>32 beshort x \bx%d 2092!:ext cwk 2093 20944 string BOBO 2095>0 byte >4 2096>>12 belong 0 2097>>>26 belong 0 2098>>>>0 use appleworks 2099>0 belong 0x0481ad00 2100>>0 use appleworks 2101 2102# magic for Apple File System (APFS) 2103# from Alex Myczko <alex@aiei.ch> 210432 string NXSB Apple File System (APFS) 2105>36 ulelong x \b, blocksize %u 2106 2107# iTunes cover art (versions 1 and 2) 21084 string itch 2109>24 string artw 2110>>0x1e8 string data iTunes cover art 2111>>>0x1ed string PNG (PNG) 2112>>>0x1ec beshort 0xffd8 (JPEG) 2113 2114# MacPaint image 211565 string PNTGMPNT MacPaint image data 2116#0 belong 2 MacPaint image data 2117 2118#------------------------------------------------------------------------------ 2119# $File: application,v 1.1 2016/10/17 12:13:01 christos Exp $ 2120# application: file(1) magic for applications on small devices 2121# 2122# Pebble Application 21230 string PBLAPP\000\000 Pebble application 2124 2125#------------------------------------------------------------------------------ 2126# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $ 2127# applix: file(1) magic for Applixware 2128# From: Peter Soos <sp@osb.hu> 2129# 21300 string *BEGIN Applixware 2131>7 string WORDS Words Document 2132>7 string GRAPHICS Graphic 2133>7 string RASTER Bitmap 2134>7 string SPREADSHEETS Spreadsheet 2135>7 string MACRO Macro 2136>7 string BUILDER Builder Object 2137 2138#------------------------------------------------------------------------------ 2139# $File: apt,v 1.1 2016/10/17 19:51:57 christos Exp $ 2140# apt: file(1) magic for APT Cache files 2141# <http://www.fifi.org/doc/libapt-pkg-doc/cache.html/ch2.html> 2142# <https://anonscm.debian.org/cgit/apt/apt.git/tree/apt-pkg/pkgcache.h#n292> 2143 2144# before version 10 ("old format"), data was in arch-specific long/short 2145 2146# old format 64 bit 21470 name apt-cache-64bit-be 2148>12 beshort 1 \b, dirty 2149>40 bequad x \b, %llu packages 2150>48 bequad x \b, %llu versions 2151 2152# old format 32 bit 21530 name apt-cache-32bit-be 2154>8 beshort 1 \b, dirty 2155>40 belong x \b, %u packages 2156>44 belong x \b, %u versions 2157 2158# new format 21590 name apt-cache-be 2160>6 byte 1 \b, dirty 2161>24 belong x \b, %u packages 2162>28 belong x \b, %u versions 2163 21640 bequad 0x98FE76DC 2165>8 ubeshort <10 APT cache data, version %u 2166>>10 beshort x \b.%u, 64 bit big-endian 2167>>0 use apt-cache-64bit-be 2168 21690 lequad 0x98FE76DC 2170>8 uleshort <10 APT cache data, version %u 2171>>10 leshort x \b.%u, 64 bit little-endian 2172>>0 use \^apt-cache-64bit-be 2173 21740 belong 0x98FE76DC 2175>4 ubeshort <10 APT cache data, version %u 2176>>6 ubeshort x \b.%u, 32 bit big-endian 2177>>0 use apt-cache-32bit-be 2178>4 ubyte >9 APT cache data, version %u 2179>>5 ubyte x \b.%u, big-endian 2180>>0 use apt-cache-be 2181 21820 lelong 0x98FE76DC 2183>4 uleshort <10 APT cache data, version %u 2184>>6 uleshort x \b.%u, 32 bit little-endian 2185>>0 use \^apt-cache-32bit-be 2186>4 ubyte >9 APT cache data, version %u 2187>>5 ubyte x \b.%u, little-endian 2188>>0 use \^apt-cache-be 2189#------------------------------------------------------------------------------ 2190# $File: archive,v 1.119 2018/04/24 23:19:45 christos Exp $ 2191# archive: file(1) magic for archive formats (see also "msdos" for self- 2192# extracting compressed archives) 2193# 2194# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 2195# pre-POSIX "tar" archives are also handled in the C code ../../src/is_tar.c. 2196 2197# POSIX tar archives 2198# URL: https://en.wikipedia.org/wiki/Tar_(computing) 2199# Reference: https://www.freebsd.org/cgi/man.cgi?query=tar&sektion=5&manpath=FreeBSD+8-current 2200# header mainly padded with nul bytes 2201500 quad 0 2202!:strength /2 2203# filename or extended attribute printable strings in range space null til umlaut ue 2204>0 ubeshort >0x1F00 2205>>0 ubeshort <0xFCFD 2206# last 4 header bytes often null but tar\0 in gtarfail2.tar gtarfail.tar-bad 2207# at https://sourceforge.net/projects/s-tar/files/testscripts/ 2208>>>508 ubelong&0x8B9E8DFF 0 2209# nul, space or ascii digit 0-7 at start of mode 2210>>>>100 ubyte&0xC8 =0 2211>>>>>101 ubyte&0xC8 =0 2212# nul, space at end of check sum 2213>>>>>>155 ubyte&0xDF =0 2214# space or ascii digit 0 at start of check sum 2215>>>>>>>148 ubyte&0xEF =0x20 2216>>>>>>>>0 use tar-file 2217# minimal check and then display tar archive information which can also be 2218# embedded inside others like Android Backup, Clam AntiVirus database 22190 name tar-file 2220>257 string !ustar 2221# header padded with nuls 2222>>257 ulong =0 2223# GNU tar version 1.29 with non pax format option without refusing 2224# creates misleading V7 header for Long path, Multi-volume, Volume type 2225>>>156 ubyte 0x4c GNU tar archive 2226!:mime application/x-gtar 2227!:ext tar/gtar 2228>>>156 ubyte 0x4d GNU tar archive 2229!:mime application/x-gtar 2230!:ext tar/gtar 2231>>>156 ubyte 0x56 GNU tar archive 2232!:mime application/x-gtar 2233!:ext tar/gtar 2234>>>156 default x tar archive (V7) 2235!:mime application/x-tar 2236!:ext tar 2237# other stuff in padding 2238# some implementations add new fields to the blank area at the end of the header record 2239# created for example by DOS TAR 3.20g 1994 Tim V.Shapore with -j option 2240>>257 ulong !0 tar archive (old) 2241!:mime application/x-tar 2242!:ext tar 2243# magic in newer, GNU, posix variants 2244>257 string =ustar 2245# 2 last char of magic and UStar version because string expression does not work 2246# 2 space characters followed by a null for GNU variant 2247>>261 ubelong =0x72202000 POSIX tar archive (GNU) 2248!:mime application/x-gtar 2249!:ext tar/gtar 2250# UStar version with ASCII "00" 2251>>261 ubelong 0x72003030 POSIX 2252# gLOBAL and ExTENSION type only found in POSIX.1-2001 format 2253>>>156 ubyte 0x67 \b.1-2001 2254>>>156 ubyte 0x78 \b.1-2001 2255>>>156 ubyte x tar archive 2256!:mime application/x-ustar 2257!:ext tar/ustar 2258# version with 2 binary nuls embedded in Android Backup like com.android.settings.ab 2259>>261 ubelong 0x72000000 tar archive (ustar) 2260!:mime application/x-ustar 2261!:ext tar/ustar 2262# not seen ustar variant with garbish version 2263>>261 default x tar archive (unknown ustar) 2264!:mime application/x-ustar 2265!:ext tar/ustar 2266# type flag of 1st tar archive member 2267#>156 ubyte x \b, %c-type 2268>156 ubyte x 2269>>156 ubyte 0 \b, file 2270>>156 ubyte 0x30 \b, file 2271>>156 ubyte 0x31 \b, hard link 2272>>156 ubyte 0x32 \b, symlink 2273>>156 ubyte 0x33 \b, char device 2274>>156 ubyte 0x34 \b, block device 2275>>156 ubyte 0x35 \b, directory 2276>>156 ubyte 0x36 \b, fifo 2277>>156 ubyte 0x37 \b, reserved 2278>>156 ubyte 0x4c \b, long path 2279>>156 ubyte 0x4d \b, multi volume 2280>>156 ubyte 0x56 \b, volume 2281>>156 ubyte 0x67 \b, global 2282>>156 ubyte 0x78 \b, extension 2283>>156 default x \b, type 2284>>>156 ubyte x '%c' 2285# name[100] 2286>0 string >\0 %-.60s 2287# mode mainly stored as an octal number in ASCII null or space terminated 2288>100 string >\0 \b, mode %-.7s 2289# user id mainly as octal numbers in ASCII null or space terminated 2290>108 string >\0 \b, uid %-.7s 2291# group id mainly as octal numbers in ASCII null or space terminated 2292>116 string >\0 \b, gid %-.7s 2293# size mainly as octal number in ASCII 2294>124 ubyte <0x38 2295>>124 string >\0 \b, size %-.12s 2296# coding indicated by setting the high-order bit of the leftmost byte 2297>124 ubyte >0xEF \b, size 0x 2298>>124 ubyte !0xff \b%2.2x 2299>>125 ubyte !0xff \b%2.2x 2300>>126 ubyte !0xff \b%2.2x 2301>>127 ubyte !0xff \b%2.2x 2302>>128 ubyte !0xff \b%2.2x 2303>>129 ubyte !0xff \b%2.2x 2304>>130 ubyte !0xff \b%2.2x 2305>>131 ubyte !0xff \b%2.2x 2306>>132 ubyte !0xff \b%2.2x 2307>>133 ubyte !0xff \b%2.2x 2308>>134 ubyte !0xff \b%2.2x 2309>>135 ubyte !0xff \b%2.2x 2310# seconds since 0:0:0 1 jan 1970 UTC as octal number mainly in ASCII null or space terminated 2311>136 string >\0 \b, seconds %-.11s 2312# header checksum stored as an octal number in ASCII null or space terminated 2313#>148 string x \b, cksum %.7s 2314# linkname[100] 2315>157 string >\0 \b, linkname %-.40s 2316# additional fields for ustar 2317>257 string =ustar 2318# owner user name null terminated 2319>>265 string >\0 \b, user %-.32s 2320# group name null terminated 2321>>297 string >\0 \b, group %-.32s 2322# device major minor if not zero 2323>>329 ubequad&0xCFCFCFCFcFcFcFdf !0 2324>>>329 string x \b, devmaj %-.7s 2325>>337 ubequad&0xCFCFCFCFcFcFcFdf !0 2326>>>337 string x \b, devmin %-.7s 2327# prefix[155] 2328>>345 string >\0 \b, prefix %-.155s 2329# old non ustar/POSIX tar 2330>257 string !ustar 2331>>508 string =tar\0 2332# padding[255] in old star 2333>>>257 string >\0 \b, padding: %-.40s 2334>>508 default x 2335# padding[255] in old tar sometimes comment field 2336>>>257 string >\0 \b, comment: %-.40s 2337 2338# Incremental snapshot gnu-tar format from: 2339# http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html 23400 string GNU\ tar- GNU tar incremental snapshot data 2341>&0 regex [0-9]\.[0-9]+-[0-9]+ version %s 2342 2343# cpio archives 2344# 2345# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 2346# The idea is to indicate archives produced on machines with the same 2347# byte order as the machine running "file" with "cpio archive", and 2348# to indicate archives produced on machines with the opposite byte order 2349# from the machine running "file" with "byte-swapped cpio archive". 2350# 2351# The SVR4 "cpio(4)" hints that there are additional formats, but they 2352# are defined as "short"s; I think all the new formats are 2353# character-header formats and thus are strings, not numbers. 23540 short 070707 cpio archive 2355!:mime application/x-cpio 23560 short 0143561 byte-swapped cpio archive 2357!:mime application/x-cpio # encoding: swapped 23580 string 070707 ASCII cpio archive (pre-SVR4 or odc) 23590 string 070701 ASCII cpio archive (SVR4 with no CRC) 23600 string 070702 ASCII cpio archive (SVR4 with CRC) 2361 2362# 2363# Various archive formats used by various versions of the "ar" 2364# command. 2365# 2366 2367# 2368# Original UNIX archive formats. 2369# They were written with binary values in host byte order, and 2370# the magic number was a host "int", which might have been 16 bits 2371# or 32 bits. We don't say "PDP-11" or "VAX", as there might have 2372# been ports to little-endian 16-bit-int or 32-bit-int platforms 2373# (x86?) using some of those formats; if none existed, feel free 2374# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian 2375# 32-bit. There might have been big-endian ports of that sort as 2376# well. 2377# 23780 leshort 0177555 very old 16-bit-int little-endian archive 23790 beshort 0177555 very old 16-bit-int big-endian archive 23800 lelong 0177555 very old 32-bit-int little-endian archive 23810 belong 0177555 very old 32-bit-int big-endian archive 2382 23830 leshort 0177545 old 16-bit-int little-endian archive 2384>2 string __.SYMDEF random library 23850 beshort 0177545 old 16-bit-int big-endian archive 2386>2 string __.SYMDEF random library 23870 lelong 0177545 old 32-bit-int little-endian archive 2388>4 string __.SYMDEF random library 23890 belong 0177545 old 32-bit-int big-endian archive 2390>4 string __.SYMDEF random library 2391 2392# 2393# From "pdp" (but why a 4-byte quantity?) 2394# 23950 lelong 0x39bed PDP-11 old archive 23960 lelong 0x39bee PDP-11 4.0 archive 2397 2398# 2399# XXX - what flavor of APL used this, and was it a variant of 2400# some ar archive format? It's similar to, but not the same 2401# as, the APL workspace magic numbers in pdp. 2402# 24030 long 0100554 apl workspace 2404 2405# 2406# System V Release 1 portable(?) archive format. 2407# 24080 string =<ar> System V Release 1 ar archive 2409!:mime application/x-archive 2410 2411# 2412# Debian package; it's in the portable archive format, and needs to go 2413# before the entry for regular portable archives, as it's recognized as 2414# a portable archive whose first member has a name beginning with 2415# "debian". 2416# 24170 string =!<arch>\ndebian 2418>8 string debian-split part of multipart Debian package 2419!:mime application/vnd.debian.binary-package 2420>8 string debian-binary Debian binary package 2421!:mime application/vnd.debian.binary-package 2422>8 string !debian 2423>68 string >\0 (format %s) 2424# These next two lines do not work, because a bzip2 Debian archive 2425# still uses gzip for the control.tar (first in the archive). Only 2426# data.tar varies, and the location of its filename varies too. 2427# file/libmagic does not current have support for ascii-string based 2428# (offsets) as of 2005-09-15. 2429#>81 string bz2 \b, uses bzip2 compression 2430#>84 string gz \b, uses gzip compression 2431#>136 ledate x created: %s 2432 2433# 2434# MIPS archive; they're in the portable archive format, and need to go 2435# before the entry for regular portable archives, as it's recognized as 2436# a portable archive whose first member has a name beginning with 2437# "__________E". 2438# 24390 string =!<arch>\n__________E MIPS archive 2440!:mime application/x-archive 2441>20 string U with MIPS Ucode members 2442>21 string L with MIPSEL members 2443>21 string B with MIPSEB members 2444>19 string L and an EL hash table 2445>19 string B and an EB hash table 2446>22 string X -- out of date 2447 24480 search/1 -h- Software Tools format archive text 2449 2450# 2451# BSD/SVR2-and-later portable archive formats. 2452# 24530 string =!<arch>\n current ar archive 2454!:mime application/x-archive 2455>8 string __.SYMDEF random library 2456>68 string __.SYMDEF\ SORTED random library 2457 2458# 2459# "Thin" archive, as can be produced by GNU ar. 2460# 24610 string =!<thin>\n thin archive with 2462>68 belong 0 no symbol entries 2463>68 belong 1 %d symbol entry 2464>68 belong >1 %d symbol entries 2465 2466# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 2467# 2468# The first byte is the magic (0x1a), byte 2 is the compression type for 2469# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 2470# filename of the first file (null terminated). Since some types collide 2471# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 2472# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 24730 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 2474!:mime application/x-arc 24750 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 2476!:mime application/x-arc 24770 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 2478!:mime application/x-arc 24790 lelong&0x8080ffff 0x0000031a ARC archive data, packed 2480!:mime application/x-arc 24810 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 2482!:mime application/x-arc 24830 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 2484!:mime application/x-arc 2485# [JW] stuff taken from idarc, obviously ARC successors: 24860 lelong&0x8080ffff 0x00000a1a PAK archive data 2487!:mime application/x-arc 24880 lelong&0x8080ffff 0x0000141a ARC+ archive data 2489!:mime application/x-arc 24900 lelong&0x8080ffff 0x0000481a HYP archive data 2491!:mime application/x-arc 2492 2493# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 2494# I can't create either SPARK or ArcFS archives so I have not tested this stuff 2495# [GRR: the original entries collide with ARC, above; replaced with combined 2496# version (not tested)] 2497#0 byte 0x1a RISC OS archive (spark format) 24980 string \032archive RISC OS archive (ArcFS format) 24990 string Archive\000 RISC OS archive (ArcFS format) 2500 2501# All these were taken from idarc, many could not be verified. Unfortunately, 2502# there were many low-quality sigs, i.e. easy to trigger false positives. 2503# Please notify me of any real-world fishy/ambiguous signatures and I'll try 2504# to get my hands on the actual archiver and see if I find something better. [JW] 2505# probably many can be enhanced by finding some 0-byte or control char near the start 2506 2507# idarc calls this Crush/Uncompressed... *shrug* 25080 string CRUSH Crush archive data 2509# Squeeze It (.sqz) 25100 string HLSQZ Squeeze It archive data 2511# SQWEZ 25120 string SQWEZ SQWEZ archive data 2513# HPack (.hpk) 25140 string HPAK HPack archive data 2515# HAP 25160 string \x91\x33HF HAP archive data 2517# MD/MDCD 25180 string MDmd MDCD archive data 2519# LIM 25200 string LIM\x1a LIM archive data 2521# SAR 25223 string LH5 SAR archive data 2523# BSArc/BS2 25240 string \212\3SB\020\0 BSArc/BS2 archive data 2525# Bethesda Softworks Archive (Oblivion) 25260 string BSA\0 BSArc archive data 2527>4 lelong x version %d 2528# MAR 25292 string =-ah MAR archive data 2530# ACB 2531#0 belong&0x00f800ff 0x00800000 ACB archive data 2532# CPZ 2533# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 2534# JRC 25350 string JRchive JRC archive data 2536# Quantum 25370 string DS\0 Quantum archive data 2538# ReSOF 25390 string PK\3\6 ReSOF archive data 2540# QuArk 25410 string 7\4 QuArk archive data 2542# YAC 254314 string YC YAC archive data 2544# X1 25450 string X1 X1 archive data 25460 string XhDr X1 archive data 2547# CDC Codec (.dqt) 25480 belong&0xffffe000 0x76ff2000 CDC Codec archive data 2549# AMGC 25500 string \xad6" AMGC archive data 2551# NuLIB 25520 string N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data 2553# PakLeo 25540 string LEOLZW PAKLeo archive data 2555# ChArc 25560 string SChF ChArc archive data 2557# PSA 25580 string PSA PSA archive data 2559# CrossePAC 25600 string DSIGDCC CrossePAC archive data 2561# Freeze 25620 string \x1f\x9f\x4a\x10\x0a Freeze archive data 2563# KBoom 25640 string \xc2\xa8MP\xc2\xa8 KBoom archive data 2565# NSQ, must go after CDC Codec 25660 string \x76\xff NSQ archive data 2567# DPA 25680 string Dirk\ Paehl DPA archive data 2569# BA 2570# TODO: idarc says "bytes 0-2 == bytes 3-5" 2571# TTComp 2572# URL: http://fileformats.archiveteam.org/wiki/TTComp_archive 2573# Update: Joerg Jenderek 2574# GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", others 25750 string \0\6 2576# look for first keyword of Panorama database *.pan 2577>12 search/261 DESIGN 2578# skip keyword with low entropy 2579>12 default x TTComp archive, binary, 4K dictionary 2580# (version 5.25) labeled the above entry as "TTComp archive data" 2581# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 25820 string ESP ESP archive data 2583# ZPack 25840 string \1ZPK\1 ZPack archive data 2585# Sky 25860 string \xbc\x40 Sky archive data 2587# UFA 25880 string UFA UFA archive data 2589# Dry 25900 string =-H2O DRY archive data 2591# FoxSQZ 25920 string FOXSQZ FoxSQZ archive data 2593# AR7 25940 string ,AR7 AR7 archive data 2595# PPMZ 25960 string PPMZ PPMZ archive data 2597# MS Compress 2598# Update: Joerg Jenderek 2599# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression 2600# Reference: https://hwiegman.home.xs4all.nl/fileformats/compress/szdd_kwaj_format.html 2601# Note: use correct version of extracting tool like EXPAND, UNPACK, DECOMP or 7Z 26024 string \x88\xf0\x27 2603# KWAJ variant 2604>0 string KWAJ MS Compress archive data, KWAJ variant 2605!:mime application/x-ms-compress-kwaj 2606# extension not working in version 5.32 2607# magic/Magdir/archive, 284: Warning: EXTENSION type ` ??_' has bad char '?' 2608# file: line 284: Bad magic entry ' ??_' 2609!:ext ??_ 2610# compression method (0-4) 2611>>8 uleshort x \b, %u method 2612# offset of compressed data 2613>>10 uleshort x \b, 0x%x offset 2614#>>(10.s) uleshort x 2615#>>>&-6 string x \b, TEST extension %-.3s 2616# header flags to mark header extensions 2617>>12 uleshort >0 \b, 0x%x flags 2618# 4 bytes: decompressed length of file 2619>>12 uleshort &0x01 2620>>>14 ulelong x \b, original size: %u bytes 2621# 2 bytes: unknown purpose 2622# 2 bytes: length of unknown data + mentioned bytes 2623# 1-9 bytes: null-terminated file name 2624# 1-4 bytes: null-terminated file extension 2625>>12 uleshort &0x08 2626>>>12 uleshort ^0x01 2627>>>>12 uleshort ^0x02 2628>>>>>12 uleshort ^0x04 2629>>>>>>12 uleshort ^0x10 2630>>>>>>>14 string x \b, %-.8s 2631>>>>>>12 uleshort &0x10 2632>>>>>>>14 string x \b, %-.8s 2633>>>>>>>>&1 string x \b.%-.3s 2634>>>>>12 uleshort &0x04 2635>>>>>>12 uleshort ^0x10 2636>>>>>>>(14.s) uleshort x 2637>>>>>>>>&14 string x \b, %-.8s 2638>>>>>>12 uleshort &0x10 2639>>>>>>>(14.s) uleshort x 2640>>>>>>>>&14 string x \b, %-.8s 2641>>>>>>>>>&1 string x \b.%-.3s 2642>>>>12 uleshort &0x02 2643>>>>>12 uleshort ^0x04 2644>>>>>>12 uleshort ^0x10 2645>>>>>>>16 string x \b, %-.8s 2646>>>>>>12 uleshort &0x10 2647>>>>>>>16 string x \b, %-.8s 2648>>>>>>>>&1 string x \b.%-.3s 2649>>>>>12 uleshort &0x04 2650>>>>>>12 uleshort ^0x10 2651>>>>>>>(16.s) uleshort x 2652>>>>>>>>&16 string x \b, %-.8s 2653>>>>>>12 uleshort &0x10 2654>>>>>>>(16.s) uleshort x 2655>>>>>>>&16 string x %-.8s 2656>>>>>>>>&1 string x \b.%-.3s 2657>>>12 uleshort &0x01 2658>>>>12 uleshort ^0x02 2659>>>>>12 uleshort ^0x04 2660>>>>>>12 uleshort ^0x10 2661>>>>>>>18 string x \b, %-.8s 2662>>>>>>12 uleshort &0x10 2663>>>>>>>18 string x \b, %-.8s 2664>>>>>>>>&1 string x \b.%-.3s 2665>>>>>12 uleshort &0x04 2666>>>>>>12 uleshort ^0x10 2667>>>>>>>(18.s) uleshort x 2668>>>>>>>>&18 string x \b, %-.8s 2669>>>>>>12 uleshort &0x10 2670>>>>>>>(18.s) uleshort x 2671>>>>>>>>&18 string x \b, %-.8s 2672>>>>>>>>>&1 string x \b.%-.3s 2673>>>>12 uleshort &0x02 2674>>>>>12 uleshort ^0x04 2675>>>>>>12 uleshort ^0x10 2676>>>>>>>20 string x \b, %-.8s 2677>>>>>>12 uleshort &0x10 2678>>>>>>>20 string x \b, %-.8s 2679>>>>>>>>&1 string x \b.%-.3s 2680>>>>>12 uleshort &0x04 2681>>>>>>12 uleshort ^0x10 2682>>>>>>>(20.s) uleshort x 2683>>>>>>>>&20 string x \b, %-.8s 2684>>>>>>12 uleshort &0x10 2685>>>>>>>(20.s) uleshort x 2686>>>>>>>>&20 string x \b, %-.8s 2687>>>>>>>>>&1 string x \b.%-.3s 2688# 2 bytes: length of data + mentioned bytes 2689# 2690# SZDD variant Haruhiko Okumura's LZSS or 7z type MsLZ 2691>0 string SZDD MS Compress archive data, SZDD variant 2692!:mime application/x-ms-compress-szdd 2693!:ext ??_ 2694# The character missing from the end of the filename (0=unknown) 2695>>9 string >\0 \b, %-.1s is last character of original name 2696# https://www.betaarchive.com/forum/viewtopic.php?t=26161 2697# Compression mode: "A" (0x41) found but sometimes "B" in Windows 3.1 builds 026 and 034e 2698>>8 string !A \b, %-.1s method 2699>>10 ulelong >0 \b, original size: %u bytes 2700# QBasic SZDD variant 27013 string \x88\xf0\x27 2702>0 string SZ\x20 MS Compress archive data, QBasic variant 2703!:mime application/x-ms-compress-sz 2704!:ext ??$ 2705>>8 ulelong >0 \b, original size: %u bytes 2706 2707# MP3 (archiver, not lossy audio compression) 27080 string MP3\x1a MP3-Archiver archive data 2709# ZET 27100 string OZ\xc3\x9d ZET archive data 2711# TSComp 27120 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 2713# ARQ 27140 string gW\4\1 ARQ archive data 2715# Squash 27163 string OctSqu Squash archive data 2717# Terse 27180 string \5\1\1\0 Terse archive data 2719# PUCrunch 27200 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 2721# UHarc 27220 string UHA UHarc archive data 2723# ABComp 27240 string \2AB ABComp archive data 27250 string \3AB2 ABComp archive data 2726# CMP 27270 string CO\0 CMP archive data 2728# Splint 27290 string \x93\xb9\x06 Splint archive data 2730# InstallShield 27310 string \x13\x5d\x65\x8c InstallShield Z archive Data 2732# Gather 27331 string GTH Gather archive data 2734# BOA 27350 string BOA BOA archive data 2736# RAX 27370 string ULEB\xa RAX archive data 2738# Xtreme 27390 string ULEB\0 Xtreme archive data 2740# Pack Magic 27410 string @\xc3\xa2\1\0 Pack Magic archive data 2742# BTS 27430 belong&0xfeffffff 0x1a034465 BTS archive data 2744# ELI 5750 27450 string Ora\ ELI 5750 archive data 2746# QFC 27470 string \x1aFC\x1a QFC archive data 27480 string \x1aQF\x1a QFC archive data 2749# PRO-PACK 27500 string RNC PRO-PACK archive data 2751# 777 27520 string 777 777 archive data 2753# LZS221 27540 string sTaC LZS221 archive data 2755# HPA 27560 string HPA HPA archive data 2757# Arhangel 27580 string LG Arhangel archive data 2759# EXP1, uses bzip2 27600 string 0123456789012345BZh EXP1 archive data 2761# IMP 27620 string IMP\xa IMP archive data 2763# NRV 27640 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 2765# Squish 27660 string \x73\xb2\x90\xf4 Squish archive data 2767# Par 27680 string PHILIPP Par archive data 27690 string PAR Par archive data 2770# HIT 27710 string UB HIT archive data 2772# SBX 27730 belong&0xfffff000 0x53423000 SBX archive data 2774# NaShrink 27750 string NSK NaShrink archive data 2776# SAPCAR 27770 string #\ CAR\ archive\ header SAPCAR archive data 27780 string CAR\ 2.00RG SAPCAR archive data 2779# Disintegrator 27800 string DST Disintegrator archive data 2781# ASD 27820 string ASD ASD archive data 2783# InstallShield CAB 27840 string ISc( InstallShield CAB 2785# TOP4 27860 string T4\x1a TOP4 archive data 2787# BatComp left out: sig looks like COM executable 2788# so TODO: get real 4dos batcomp file and find sig 2789# BlakHole 27900 string BH\5\7 BlakHole archive data 2791# BIX 27920 string BIX0 BIX archive data 2793# ChiefLZA 27940 string ChfLZ ChiefLZA archive data 2795# Blink 27960 string Blink Blink archive data 2797# Logitech Compress 27980 string \xda\xfa Logitech Compress archive data 2799# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 28001 string (C)\ STEPANYUK ARS-Sfx archive data 2801# AKT/AKT32 28020 string AKT32 AKT32 archive data 28030 string AKT AKT archive data 2804# NPack 28050 string MSTSM NPack archive data 2806# PFT 28070 string \0\x50\0\x14 PFT archive data 2808# SemOne 28090 string SEM SemOne archive data 2810# PPMD 28110 string \x8f\xaf\xac\x84 PPMD archive data 2812# FIZ 28130 string FIZ FIZ archive data 2814# MSXiE 28150 belong&0xfffff0f0 0x4d530000 MSXiE archive data 2816# DeepFreezer 28170 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 2818# DC 28190 string =<DC- DC archive data 2820# TPac 28210 string \4TPAC\3 TPac archive data 2822# Ai 28230 string Ai\1\1\0 Ai archive data 28240 string Ai\1\0\0 Ai archive data 2825# Ai32 28260 string Ai\2\0 Ai32 archive data 28270 string Ai\2\1 Ai32 archive data 2828# SBC 28290 string SBC SBC archive data 2830# Ybs 28310 string YBS Ybs archive data 2832# DitPack 28330 string \x9e\0\0 DitPack archive data 2834# DMS 28350 string DMS! DMS archive data 2836# EPC 28370 string \x8f\xaf\xac\x8c EPC archive data 2838# VSARC 28390 string VS\x1a VSARC archive data 2840# PDZ 28410 string PDZ PDZ archive data 2842# ReDuq 28430 string rdqx ReDuq archive data 2844# GCA 28450 string GCAX GCA archive data 2846# PPMN 28470 string pN PPMN archive data 2848# WinImage 28493 string WINIMAGE WinImage archive data 2850# Compressia 28510 string CMP0CMP Compressia archive data 2852# UHBC 28530 string UHB UHBC archive data 2854# WinHKI 28550 string \x61\x5C\x04\x05 WinHKI archive data 2856# WWPack data file 28570 string WWP WWPack archive data 2858# BSN (BSA, PTS-DOS) 28590 string \xffBSG BSN archive data 28601 string \xffBSG BSN archive data 28613 string \xffBSG BSN archive data 28621 string \0\xae\2 BSN archive data 28631 string \0\xae\3 BSN archive data 28641 string \0\xae\7 BSN archive data 2865# AIN 28660 string \x33\x18 AIN archive data 28670 string \x33\x17 AIN archive data 2868# XPA32 test moved and merged with XPA by Joerg Jenderek at Sep 2015 2869# SZip (TODO: doesn't catch all versions) 28700 string SZ\x0a\4 SZip archive data 2871# XPack DiskImage 2872# *.XDI updated by Joerg Jenderek Sep 2015 2873# ftp://ftp.sac.sk/pub/sac/pack/0index.txt 2874# GRR: this test is still too general as it catches also text files starting with jm 28750 string jm 2876# only found examples with this additional characteristic 2 bytes 2877>2 string \x2\x4 Xpack DiskImage archive data 2878#!:ext xdi 2879# XPack Data 2880# *.xpa updated by Joerg Jenderek Sep 2015 2881# ftp://ftp.elf.stuba.sk/pub/pc/pack/ 28820 string xpa XPA 2883!:ext xpa 2884# XPA32 2885# ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip 2886# created by XPA32.EXE version 1.0.2 for Windows 2887>0 string xpa\0\1 \b32 archive data 2888# created by XPACK.COM version 1.67m or 1.67r with short 0x1800 2889>3 ubeshort !0x0001 \bck archive data 2890# XPack Single Data 2891# changed by Joerg Jenderek Sep 2015 back to like in version 5.12 2892# letter 'I'+ acute accent is equivalent to \xcd 28930 string \xcd\ jm Xpack single archive data 2894#!:mime application/x-xpa-compressed 2895!:ext xpa 2896 2897# TODO: missing due to unknown magic/magic at end of file: 2898#DWC 2899#ARG 2900#ZAR 2901#PC/3270 2902#InstallIt 2903#RKive 2904#RK 2905#XPack Diskimage 2906 2907# These were inspired by idarc, but actually verified 2908# Dzip archiver (.dz) 2909# Update: Joerg Jenderek 2910# URL: http://speeddemosarchive.com/dzip/ 2911# reference: http://speeddemosarchive.com/dzip/dz29src.zip/main.c 2912# GRR: line below is too general as it matches also ASCII texts like Doszip commander help dz.txt 29130 string DZ 2914# latest version is 2.9 dated 7 may 2003 2915>2 byte <4 Dzip archive data 2916!:mime application/x-dzip 2917!:ext dz 2918>>2 byte x \b, version %i 2919>>3 byte x \b.%i 2920>>4 ulelong x \b, offset 0x%x 2921>>8 ulelong x \b, %u files 2922# ZZip archiver (.zz) 29230 string ZZ\ \0\0 ZZip archive data 29240 string ZZ0 ZZip archive data 2925# PAQ archiver (.paq) 29260 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 29270 string PAQ PAQ archive data 2928>3 byte&0xf0 0x30 2929>>3 byte x (v%c) 2930# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 29310xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 29320 string JARCS JAR (ARJ Software, Inc.) archive data 2933 2934# ARJ archiver (jason@jarthur.Claremont.EDU) 29350 leshort 0xea60 ARJ archive data 2936!:mime application/x-arj 2937>5 byte x \b, v%d, 2938>8 byte &0x04 multi-volume, 2939>8 byte &0x10 slash-switched, 2940>8 byte &0x20 backup, 2941>34 string x original name: %s, 2942>7 byte 0 os: MS-DOS 2943>7 byte 1 os: PRIMOS 2944>7 byte 2 os: Unix 2945>7 byte 3 os: Amiga 2946>7 byte 4 os: Macintosh 2947>7 byte 5 os: OS/2 2948>7 byte 6 os: Apple ][ GS 2949>7 byte 7 os: Atari ST 2950>7 byte 8 os: NeXT 2951>7 byte 9 os: VAX/VMS 2952>3 byte >0 %d] 2953# [JW] idarc says this is also possible 29542 leshort 0xea60 ARJ archive data 2955 2956# HA archiver (Greg Roelofs, newt@uchicago.edu) 2957# This is a really bad format. A file containing HAWAII will match this... 2958#0 string HA HA archive data, 2959#>2 leshort =1 1 file, 2960#>2 leshort >1 %hu files, 2961#>4 byte&0x0f =0 first is type CPY 2962#>4 byte&0x0f =1 first is type ASC 2963#>4 byte&0x0f =2 first is type HSC 2964#>4 byte&0x0f =0x0e first is type DIR 2965#>4 byte&0x0f =0x0f first is type SPECIAL 2966# suggestion: at least identify small archives (<1024 files) 29670 belong&0xffff00fc 0x48410000 HA archive data 2968>2 leshort =1 1 file, 2969>2 leshort >1 %u files, 2970>4 byte&0x0f =0 first is type CPY 2971>4 byte&0x0f =1 first is type ASC 2972>4 byte&0x0f =2 first is type HSC 2973>4 byte&0x0f =0x0e first is type DIR 2974>4 byte&0x0f =0x0f first is type SPECIAL 2975 2976# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 29770 string HPAK HPACK archive data 2978 2979# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 29800 string \351,\001JAM\ JAM archive, 2981>7 string >\0 version %.4s 2982>0x26 byte =0x27 - 2983>>0x2b string >\0 label %.11s, 2984>>0x27 lelong x serial %08x, 2985>>0x36 string >\0 fstype %.8s 2986 2987# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 2988# Update: Joerg Jenderek 2989# URL: https://en.wikipedia.org/wiki/LHA_(file_format) 2990# Reference: http://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html 2991# 2992# check and display information of lharc (LHa,PMarc) file 29930 name lharc-file 2994# check 1st character of method id like -lz4- -lh5- or -pm2- 2995>2 string - 2996# check 5th character of method id 2997>>6 string - 2998# check header level 0 1 2 3 2999>>>20 ubyte <4 3000# check 2nd, 3th and 4th character of method id 3001>>>>3 regex \^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1) \b 3002!:mime application/x-lzh-compressed 3003# creator type "LHA " 3004!:apple ????LHA 3005# display archive type name like "LHa/LZS archive data" or "LArc archive" 3006>>>>>2 string -lz \b 3007!:ext lzs 3008# already known -lzs- -lz4- -lz5- with old names 3009>>>>>>2 string -lzs LHa/LZS archive data 3010>>>>>>3 regex \^lz[45] LHarc 1.x archive data 3011# missing -lz?- with wikipedia names 3012>>>>>>3 regex \^lz[2378] LArc archive 3013# display archive type name like "LHa (2.x) archive data" 3014>>>>>2 string -lh \b 3015# already known -lh0- -lh1- -lh2- -lh3- -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names 3016>>>>>>3 regex \^lh[01] LHarc 1.x/ARX archive data 3017# LHice archiver use ".ICE" as name extension instead usual one ".lzh" 3018# FOOBAR archiver use ".foo" as name extension instead usual one 3019# "Florain Orjanov's and Olga Bachetska's ARchiver" not found at the moment 3020>>>>>>>2 string -lh1 \b 3021!:ext lha/lzh/ice 3022>>>>>>3 regex \^lh[23d] LHa 2.x? archive data 3023>>>>>>3 regex \^lh[7] LHa (2.x)/LHark archive data 3024>>>>>>3 regex \^lh[456] LHa (2.x) archive data 3025>>>>>>>2 string -lh5 \b 3026# https://en.wikipedia.org/wiki/BIOS 3027# Some mainboard BIOS like Award use LHa compression. So archives with unusal extension are found like 3028# bios.rom , kd7_v14.bin, 1010.004, ... 3029!:ext lha/lzh/rom/bin 3030# missing -lh?- variants (Joe Jared) 3031>>>>>>3 regex \^lh[89a-ce] LHa (Joe Jared) archive 3032# UNLHA32 2.67a 3033>>>>>>2 string -lhx LHa (UNLHA32) archive 3034# lha archives with standard file name extensions ".lha" ".lzh" 3035>>>>>>3 regex !\^(lh1|lh5) \b 3036!:ext lha/lzh 3037# this should not happen if all -lh variants are described 3038>>>>>>2 default x LHa (unknown) archive 3039#!:ext lha 3040# PMarc 3041>>>>>3 regex \^pm[012] PMarc archive data 3042!:ext pma 3043# append method id without leading and trailing minus character 3044>>>>>3 string x [%3.3s] 3045>>>>>>0 use lharc-header 3046# 3047# check and display information of lharc header 30480 name lharc-header 3049# header size 0x4 , 0x1b-0x61 3050>0 ubyte x 3051# compressed data size != compressed file size 3052#>7 ulelong x \b, data size %d 3053# attribute: 0x2~?? 0x10~symlink|target 0x20~normal 3054#>19 ubyte x \b, 19_0x%x 3055# level identifier 0 1 2 3 3056#>20 ubyte x \b, level %d 3057# time stamp 3058#>15 ubelong x DATE 0x%8.8x 3059# OS ID for level 1 3060>20 ubyte 1 3061# 0x20 types find for *.rom files 3062>>(21.b+24) ubyte <0x21 \b, 0x%x OS 3063# ascii type like M for MSDOS 3064>>(21.b+24) ubyte >0x20 \b, '%c' OS 3065# OS ID for level 2 3066>20 ubyte 2 3067#>>23 ubyte x \b, OS ID 0x%x 3068>>23 ubyte <0x21 \b, 0x%x OS 3069>>23 ubyte >0x20 \b, '%c' OS 3070# filename only for level 0 and 1 3071>20 ubyte <2 3072# length of filename 3073>>21 ubyte >0 \b, with 3074# filename 3075>>>21 pstring x "%s" 3076# 3077#2 string -lh0- LHarc 1.x/ARX archive data [lh0] 3078#!:mime application/x-lharc 30792 string -lh0- 3080>0 use lharc-file 3081#2 string -lh1- LHarc 1.x/ARX archive data [lh1] 3082#!:mime application/x-lharc 30832 string -lh1- 3084>0 use lharc-file 3085# NEW -lz2- ... -lz8- 30862 string -lz2- 3087>0 use lharc-file 30882 string -lz3- 3089>0 use lharc-file 30902 string -lz4- 3091>0 use lharc-file 30922 string -lz5- 3093>0 use lharc-file 30942 string -lz7- 3095>0 use lharc-file 30962 string -lz8- 3097>0 use lharc-file 3098# [never seen any but the last; -lh4- reported in comp.compression:] 3099#2 string -lzs- LHa/LZS archive data [lzs] 31002 string -lzs- 3101>0 use lharc-file 3102# According to wikipedia and others such a version does not exist 3103#2 string -lh\40- LHa 2.x? archive data [lh ] 3104#2 string -lhd- LHa 2.x? archive data [lhd] 31052 string -lhd- 3106>0 use lharc-file 3107#2 string -lh2- LHa 2.x? archive data [lh2] 31082 string -lh2- 3109>0 use lharc-file 3110#2 string -lh3- LHa 2.x? archive data [lh3] 31112 string -lh3- 3112>0 use lharc-file 3113#2 string -lh4- LHa (2.x) archive data [lh4] 31142 string -lh4- 3115>0 use lharc-file 3116#2 string -lh5- LHa (2.x) archive data [lh5] 31172 string -lh5- 3118>0 use lharc-file 3119#2 string -lh6- LHa (2.x) archive data [lh6] 31202 string -lh6- 3121>0 use lharc-file 3122#2 string -lh7- LHa (2.x)/LHark archive data [lh7] 31232 string -lh7- 3124# !:mime application/x-lha 3125# >20 byte x - header level %d 3126>0 use lharc-file 3127# NEW -lh8- ... -lhe- , -lhx- 31282 string -lh8- 3129>0 use lharc-file 31302 string -lh9- 3131>0 use lharc-file 31322 string -lha- 3133>0 use lharc-file 31342 string -lhb- 3135>0 use lharc-file 31362 string -lhc- 3137>0 use lharc-file 31382 string -lhe- 3139>0 use lharc-file 31402 string -lhx- 3141>0 use lharc-file 3142# taken from idarc [JW] 31432 string -lZ PUT archive data 3144# already done by LHarc magics 3145# this should never happen if all sub types of LZS archive are identified 3146#2 string -lz LZS archive data 31472 string -sw1- Swag archive data 3148 31490 name rar-file-header 3150>24 byte 15 \b, v1.5 3151>24 byte 20 \b, v2.0 3152>24 byte 29 \b, v4 3153>15 byte 0 \b, os: MS-DOS 3154>15 byte 1 \b, os: OS/2 3155>15 byte 2 \b, os: Win32 3156>15 byte 3 \b, os: Unix 3157>15 byte 4 \b, os: Mac OS 3158>15 byte 5 \b, os: BeOS 3159 31600 name rar-archive-header 3161>3 leshort&0x1ff >0 \b, flags: 3162>>3 leshort &0x01 ArchiveVolume 3163>>3 leshort &0x02 Commented 3164>>3 leshort &0x04 Locked 3165>>3 leshort &0x10 NewVolumeNaming 3166>>3 leshort &0x08 Solid 3167>>3 leshort &0x20 Authenticated 3168>>3 leshort &0x40 RecoveryRecordPresent 3169>>3 leshort &0x80 EncryptedBlockHeader 3170>>3 leshort &0x100 FirstVolume 3171 3172# RAR (Roshal Archive) archive 31730 string Rar!\x1a\7\0 RAR archive data 3174!:mime application/x-rar 3175!:ext rar/cbr 3176# file header 3177>(0xc.l+9) byte 0x74 3178>>(0xc.l+7) use rar-file-header 3179# subblock seems to share information with file header 3180>(0xc.l+9) byte 0x7a 3181>>(0xc.l+7) use rar-file-header 3182>9 byte 0x73 3183>>7 use rar-archive-header 3184 31850 string Rar!\x1a\7\1\0 RAR archive data, v5 3186!:mime application/x-rar 3187!:ext rar 3188 3189# Very old RAR archive 3190# http://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf 31910 string RE\x7e\x5e RAR archive data (<v1.5) 3192!:mime application/x-rar 3193!:ext rar/cbr 3194 3195# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 31960 string SQSH squished archive data (Acorn RISCOS) 3197 3198# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 3199# [JW] see exe section for self-extracting version 32000 string UC2\x1a UC2 archive data 3201 3202# PKZIP multi-volume archive 32030 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract 3204!:mime application/zip 3205!:ext zip/cbz 3206 3207# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 32080 string PK\005\006 Zip archive data (empty) 3209!:mime application/zip 3210!:ext zip/cbz 32110 string PK\003\004 3212 3213# Specialised zip formats which start with a member named 'mimetype' 3214# (stored uncompressed, with no 'extra field') containing the file's MIME type. 3215# Check for have 8-byte name, 0-byte extra field, name "mimetype", and 3216# contents starting with "application/": 3217>26 string \x8\0\0\0mimetypeapplication/ 3218 3219# KOffice / OpenOffice & StarOffice / OpenDocument formats 3220# From: Abel Cheung <abel@oaka.org> 3221 3222# KOffice (1.2 or above) formats 3223# (mimetype contains "application/vnd.kde.<SUBTYPE>") 3224>>50 string vnd.kde. KOffice (>=1.2) 3225>>>58 string karbon Karbon document 3226>>>58 string kchart KChart document 3227>>>58 string kformula KFormula document 3228>>>58 string kivio Kivio document 3229>>>58 string kontour Kontour document 3230>>>58 string kpresenter KPresenter document 3231>>>58 string kspread KSpread document 3232>>>58 string kword KWord document 3233 3234# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 3235# (mimetype contains "application/vnd.sun.xml.<SUBTYPE>") 3236>>50 string vnd.sun.xml. OpenOffice.org 1.x 3237>>>62 string writer Writer 3238>>>>68 byte !0x2e document 3239>>>>68 string .template template 3240>>>>68 string .global global document 3241>>>62 string calc Calc 3242>>>>66 byte !0x2e spreadsheet 3243>>>>66 string .template template 3244>>>62 string draw Draw 3245>>>>66 byte !0x2e document 3246>>>>66 string .template template 3247>>>62 string impress Impress 3248>>>>69 byte !0x2e presentation 3249>>>>69 string .template template 3250>>>62 string math Math document 3251>>>62 string base Database file 3252 3253# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 3254# http://lists.oasis-open.org/archives/office/200505/msg00006.html 3255# (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>") 3256>>50 string vnd.oasis.opendocument. OpenDocument 3257>>>73 string text 3258>>>>77 byte !0x2d Text 3259!:mime application/vnd.oasis.opendocument.text 3260>>>>77 string -template Text Template 3261!:mime application/vnd.oasis.opendocument.text-template 3262>>>>77 string -web HTML Document Template 3263!:mime application/vnd.oasis.opendocument.text-web 3264>>>>77 string -master Master Document 3265!:mime application/vnd.oasis.opendocument.text-master 3266>>>73 string graphics 3267>>>>81 byte !0x2d Drawing 3268!:mime application/vnd.oasis.opendocument.graphics 3269>>>>81 string -template Template 3270!:mime application/vnd.oasis.opendocument.graphics-template 3271>>>73 string presentation 3272>>>>85 byte !0x2d Presentation 3273!:mime application/vnd.oasis.opendocument.presentation 3274>>>>85 string -template Template 3275!:mime application/vnd.oasis.opendocument.presentation-template 3276>>>73 string spreadsheet 3277>>>>84 byte !0x2d Spreadsheet 3278!:mime application/vnd.oasis.opendocument.spreadsheet 3279>>>>84 string -template Template 3280!:mime application/vnd.oasis.opendocument.spreadsheet-template 3281>>>73 string chart 3282>>>>78 byte !0x2d Chart 3283!:mime application/vnd.oasis.opendocument.chart 3284>>>>78 string -template Template 3285!:mime application/vnd.oasis.opendocument.chart-template 3286>>>73 string formula 3287>>>>80 byte !0x2d Formula 3288!:mime application/vnd.oasis.opendocument.formula 3289>>>>80 string -template Template 3290!:mime application/vnd.oasis.opendocument.formula-template 3291>>>73 string database Database 3292!:mime application/vnd.oasis.opendocument.database 3293# Valid for LibreOffice Base 6.0.1.1 at least 3294>>>73 string base Database 3295!:mime application/vnd.oasis.opendocument.base 3296>>>73 string image 3297>>>>78 byte !0x2d Image 3298!:mime application/vnd.oasis.opendocument.image 3299>>>>78 string -template Template 3300!:mime application/vnd.oasis.opendocument.image-template 3301 3302# EPUB (OEBPS) books using OCF (OEBPS Container Format) 3303# http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. 3304# From: Ralf Brown <ralf.brown@gmail.com> 3305>>50 string epub+zip EPUB document 3306!:mime application/epub+zip 3307 3308# Catch other ZIP-with-mimetype formats 3309# In a ZIP file, the bytes immediately after a member's contents are 3310# always "PK". The 2 regex rules here print the "mimetype" member's 3311# contents up to the first 'P'. Luckily, most MIME types don't contain 3312# any capital 'P's. This is a kludge. 3313# (mimetype contains "application/<OTHER>") 3314>>50 string !epub+zip 3315>>>50 string !vnd.oasis.opendocument. 3316>>>>50 string !vnd.sun.xml. 3317>>>>>50 string !vnd.kde. 3318>>>>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 3319!:mime application/zip 3320# (mimetype contents other than "application/*") 3321>26 string \x8\0\0\0mimetype 3322>>38 string !application/ 3323>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 3324!:mime application/zip 3325 3326# Java Jar files 3327>(26.s+30) leshort 0xcafe Java archive data (JAR) 3328!:mime application/java-archive 3329 3330# iOS App 3331>(26.s+30) leshort !0xcafe 3332>>26 string !\x8\0\0\0mimetype 3333>>>30 string Payload/ 3334>>>>38 search/64 .app/ iOS App 3335!:mime application/x-ios-app 3336 3337 3338# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 3339# Next line excludes specialized formats: 3340>(26.s+30) leshort !0xcafe 3341>>26 string !\x8\0\0\0mimetype Zip archive data 3342!:mime application/zip 3343>>>4 beshort x \b, at least 3344>>>4 use zipversion 3345>>>4 beshort x to extract 3346>>>0x161 string WINZIP \b, WinZIP self-extracting 3347 3348# StarView Metafile 3349# From Pierre Ducroquet <pinaraf@pinaraf.info> 33500 string VCLMTF StarView MetaFile 3351>6 beshort x \b, version %d 3352>8 belong x \b, size %d 3353 3354# Zoo archiver 335520 lelong 0xfdc4a7dc Zoo archive data 3356!:mime application/x-zoo 3357>4 byte >48 \b, v%c. 3358>>6 byte >47 \b%c 3359>>>7 byte >47 \b%c 3360>32 byte >0 \b, modify: v%d 3361>>33 byte x \b.%d+ 3362>42 lelong 0xfdc4a7dc \b, 3363>>70 byte >0 extract: v%d 3364>>>71 byte x \b.%d+ 3365 3366# Shell archives 336710 string #\ This\ is\ a\ shell\ archive shell archive text 3368!:mime application/octet-stream 3369 3370# 3371# LBR. NB: May conflict with the questionable 3372# "binary Computer Graphics Metafile" format. 3373# 33740 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 3375# 3376# PMA (CP/M derivative of LHA) 3377# Update: Joerg Jenderek 3378# URL: https://en.wikipedia.org/wiki/LHA_(file_format) 3379# 3380#2 string -pm0- PMarc archive data [pm0] 33812 string -pm0- 3382>0 use lharc-file 3383#2 string -pm1- PMarc archive data [pm1] 33842 string -pm1- 3385>0 use lharc-file 3386#2 string -pm2- PMarc archive data [pm2] 33872 string -pm2- 3388>0 use lharc-file 33892 string -pms- PMarc SFX archive (CP/M, DOS) 3390#!:mime application/x-foobar-exec 3391!:ext com 33925 string -pc1- PopCom compressed executable (CP/M) 3393#!:mime application/x- 3394#!:ext com 3395 3396# From Rafael Laboissiere <rafael@laboissiere.net> 3397# The Project Revision Control System (see 3398# http://prcs.sourceforge.net) generates a packaged project 3399# file which is recognized by the following entry: 34000 leshort 0xeb81 PRCS packaged project 3401 3402# Microsoft cabinets 3403# by David Necas (Yeti) <yeti@physics.muni.cz> 3404#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 3405#>25 byte x v%d 3406#>24 byte x \b.%d 3407# MPi: All CABs have version 1.3, so this is pointless. 3408# Better magic in debian-additions. 3409 3410# GTKtalog catalogs 3411# by David Necas (Yeti) <yeti@physics.muni.cz> 34124 string gtktalog\ GTKtalog catalog data, 3413>13 string 3 version 3 3414>>14 beshort 0x677a (gzipped) 3415>>14 beshort !0x677a (not gzipped) 3416>13 string >3 version %s 3417 3418############################################################################ 3419# Parity archive reconstruction file, the 'par' file format now used on Usenet. 34200 string PAR\0 PARity archive data 3421>48 leshort =0 - Index file 3422>48 leshort >0 - file number %d 3423 3424# Felix von Leitner <felix-file@fefe.de> 34250 string d8:announce BitTorrent file 3426!:mime application/x-bittorrent 3427# Durval Menezes, <jmgthbfile at durval dot com> 34280 string d13:announce-list BitTorrent file 3429!:mime application/x-bittorrent 3430 3431# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 34320 beshort 0x0e0f Atari MSA archive data 3433>2 beshort x \b, %d sectors per track 3434>4 beshort 0 \b, 1 sided 3435>4 beshort 1 \b, 2 sided 3436>6 beshort x \b, starting track: %d 3437>8 beshort x \b, ending track: %d 3438 3439# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 34400 string PK00PK\003\004 Zip archive data 3441!:mime application/zip 3442!:ext zip/cbz 3443 3444# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 3445# by Stefan `Sec` Zehl <sec@42.org> 34467 string **ACE** ACE archive data 3447>15 byte >0 version %d 3448>16 byte =0x00 \b, from MS-DOS 3449>16 byte =0x01 \b, from OS/2 3450>16 byte =0x02 \b, from Win/32 3451>16 byte =0x03 \b, from Unix 3452>16 byte =0x04 \b, from MacOS 3453>16 byte =0x05 \b, from WinNT 3454>16 byte =0x06 \b, from Primos 3455>16 byte =0x07 \b, from AppleGS 3456>16 byte =0x08 \b, from Atari 3457>16 byte =0x09 \b, from Vax/VMS 3458>16 byte =0x0A \b, from Amiga 3459>16 byte =0x0B \b, from Next 3460>14 byte x \b, version %d to extract 3461>5 leshort &0x0080 \b, multiple volumes, 3462>>17 byte x \b (part %d), 3463>5 leshort &0x0002 \b, contains comment 3464>5 leshort &0x0200 \b, sfx 3465>5 leshort &0x0400 \b, small dictionary 3466>5 leshort &0x0800 \b, multi-volume 3467>5 leshort &0x1000 \b, contains AV-String 3468>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 3469>5 leshort &0x2000 \b, with recovery record 3470>5 leshort &0x4000 \b, locked 3471>5 leshort &0x8000 \b, solid 3472# Date in MS-DOS format (whatever that is) 3473#>18 lelong x Created on 3474 3475# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 3476# <doj@cubic.org> 34770x1A string sfArk sfArk compressed Soundfont 3478>0x15 string 2 3479>>0x1 string >\0 Version %s 3480>>0x2A string >\0 : %s 3481 3482# DR-DOS 7.03 Packed File *.??_ 34830 string Packed\ File\ Personal NetWare Packed File 3484>12 string x \b, was "%.12s" 3485 3486# EET archive 3487# From: Tilman Sauerbeck <tilman@code-monkey.de> 34880 belong 0x1ee7ff00 EET archive 3489!:mime application/x-eet 3490 3491# rzip archives 34920 string RZIP rzip compressed data 3493>4 byte x - version %d 3494>5 byte x \b.%d 3495>6 belong x (%d bytes) 3496 3497# From: "Robert Dale" <robdale@gmail.com> 34980 belong 123 dar archive, 3499>4 belong x label "%.8x 3500>>8 belong x %.8x 3501>>>12 beshort x %.4x" 3502>14 byte 0x54 end slice 3503>14 beshort 0x4e4e multi-part 3504>14 beshort 0x4e53 multi-part, with -S 3505 3506# Symbian installation files 3507# http://www.thouky.co.uk/software/psifs/sis.html 3508# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 35098 lelong 0x10000419 Symbian installation file 3510!:mime application/vnd.symbian.install 3511>4 lelong 0x1000006D (EPOC release 3/4/5) 3512>4 lelong 0x10003A12 (EPOC release 6) 35130 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 3514!:mime x-epoc/x-sisx-app 3515 3516# From "Nelson A. de Oliveira" <naoliv@gmail.com> 35170 string MPQ\032 MoPaQ (MPQ) archive 3518 3519# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 3520# .kgb 35210 string KGB_arch KGB Archiver file 3522>10 string x with compression level %.1s 3523 3524# xar (eXtensible ARchiver) archive 3525# xar archive format: http://code.google.com/p/xar/ 3526# From: "David Remahl" <dremahl@apple.com> 35270 string xar! xar archive 3528!:mime application/x-xar 3529#>4 beshort x header size %d 3530>6 beshort x version %d, 3531#>8 quad x compressed TOC: %d, 3532#>16 quad x uncompressed TOC: %d, 3533>24 belong 0 no checksum 3534>24 belong 1 SHA-1 checksum 3535>24 belong 2 MD5 checksum 3536 3537# Type: Parity Archive 3538# From: Daniel van Eeden <daniel_e@dds.nl> 35390 string PAR2 Parity Archive Volume Set 3540 3541# Bacula volume format. (Volumes always start with a block header.) 3542# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html 3543# From: Adam Buchbinder <adam.buchbinder@gmail.com> 354412 string BB02 Bacula volume 3545>20 bedate x \b, started %s 3546 3547# ePub is XHTML + XML inside a ZIP archive. The first member of the 3548# archive must be an uncompressed file called 'mimetype' with contents 3549# 'application/epub+zip' 3550 3551 3552# From: "Michael Gorny" <mgorny@gentoo.org> 3553# ZPAQ: http://mattmahoney.net/dc/zpaq.html 35540 string zPQ ZPAQ stream 3555>3 byte x \b, level %d 3556# From: Barry Carter <carter.barry@gmail.com> 3557# http://encode.ru/threads/456-zpaq-updates/page32 35580 string 7kSt ZPAQ file 3559 3560# BBeB ebook, unencrypted (LRF format) 3561# URL: http://www.sven.de/librie/Librie/LrfFormat 3562# From: Adam Buchbinder <adam.buchbinder@gmail.com> 35630 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted 3564>8 beshort x \b, version %d 3565>36 byte 1 \b, front-to-back 3566>36 byte 16 \b, back-to-front 3567>42 beshort x \b, (%dx, 3568>44 beshort x %d) 3569 3570# Symantec GHOST image by Joerg Jenderek at May 2014 3571# http://us.norton.com/ghost/ 3572# http://www.garykessler.net/library/file_sigs.html 35730 ubelong&0xFFFFf7f0 0xFEEF0100 Norton GHost image 3574# *.GHO 3575>2 ubyte&0x08 0x00 \b, first file 3576# *.GHS or *.[0-9] with cns program option 3577>2 ubyte&0x08 0x08 \b, split file 3578# part of split index interesting for *.ghs 3579>>4 ubyte x id=0x%x 3580# compression tag minus one equals numeric compression command line switch z[1-9] 3581>3 ubyte 0 \b, no compression 3582>3 ubyte 2 \b, fast compression (Z1) 3583>3 ubyte 3 \b, medium compression (Z2) 3584>3 ubyte >3 3585>>3 ubyte <11 \b, compression (Z%d-1) 3586>2 ubyte&0x08 0x00 3587# ~ 30 byte password field only for *.gho 3588>>12 ubequad !0 \b, password protected 3589>>44 ubyte !1 3590# 1~Image All, sector-by-sector only for *.gho 3591>>>10 ubyte 1 \b, sector copy 3592# 1~Image Boot track only for *.gho 3593>>>43 ubyte 1 \b, boot track 3594# 1~Image Disc only for *.gho implies Image Boot track and sector copy 3595>>44 ubyte 1 \b, disc sector copy 3596# optional image description only *.gho 3597>>0xff string >\0 "%-.254s" 3598# look for DOS sector end sequence 3599>0xE08 search/7776 \x55\xAA 3600>>&-512 indirect x \b; contains 3601 3602# Google Chrome extensions 3603# https://developer.chrome.com/extensions/crx 3604# https://developer.chrome.com/extensions/hosting 36050 string Cr24 Google Chrome extension 3606!:mime application/x-chrome-extension 3607>4 ulong x \b, version %u 3608 3609# SeqBox - Sequenced container 3610# ext: sbx, seqbox 3611# Marco Pontello marcopon@gmail.com 3612# reference: https://github.com/MarcoPon/SeqBox 36130 string SBx SeqBox, 3614>3 byte x version %d 3615 3616# LyNX archive 361756 string USE\040LYNX\040TO\040DISSOLVE\040THIS\040FILE LyNX archive 3618#------------------------------------------------------------------------------ 3619# $File: assembler,v 1.6 2013/12/11 14:14:20 christos Exp $ 3620# make: file(1) magic for assembler source 3621# 36220 regex \^[\040\t]{0,50}\\.asciiz assembler source text 3623!:mime text/x-asm 36240 regex \^[\040\t]{0,50}\\.byte assembler source text 3625!:mime text/x-asm 36260 regex \^[\040\t]{0,50}\\.even assembler source text 3627!:mime text/x-asm 36280 regex \^[\040\t]{0,50}\\.globl assembler source text 3629!:mime text/x-asm 36300 regex \^[\040\t]{0,50}\\.text assembler source text 3631!:mime text/x-asm 36320 regex \^[\040\t]{0,50}\\.file assembler source text 3633!:mime text/x-asm 36340 regex \^[\040\t]{0,50}\\.type assembler source text 3635!:mime text/x-asm 3636 3637#------------------------------------------------------------------------------ 3638# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $ 3639# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character 3640# strings as "long" - we assume they're just strings: 3641# From: guy@netapp.com (Guy Harris) 3642# 36430 string *STA Aster*x 3644>7 string WORD Words Document 3645>7 string GRAP Graphic 3646>7 string SPRE Spreadsheet 3647>7 string MACR Macro 36480 string 2278 Aster*x Version 2 3649>29 byte 0x36 Words Document 3650>29 byte 0x35 Graphic 3651>29 byte 0x32 Spreadsheet 3652>29 byte 0x38 Macro 3653 3654 3655#------------------------------------------------------------------------------ 3656# $File: att3b,v 1.10 2017/03/17 21:35:28 christos Exp $ 3657# att3b: file(1) magic for AT&T 3B machines 3658# 3659# The `versions' should be un-commented if they work for you. 3660# (Was the problem just one of endianness?) 3661# 3662# 3B20 3663# 3664# The 3B20 conflicts with SCCS. 3665#0 beshort 0550 3b20 COFF executable 3666#>12 belong >0 not stripped 3667#>22 beshort >0 - version %d 3668#0 beshort 0551 3b20 COFF executable (TV) 3669#>12 belong >0 not stripped 3670#>22 beshort >0 - version %d 3671# 3672# WE32K 3673# 36740 beshort 0560 WE32000 COFF 3675>18 beshort ^00000020 object 3676>18 beshort &00000020 executable 3677>12 belong >0 not stripped 3678>18 beshort ^00010000 N/A on 3b2/300 w/paging 3679>18 beshort &00020000 32100 required 3680>18 beshort &00040000 and MAU hardware required 3681>20 beshort 0407 (impure) 3682>20 beshort 0410 (pure) 3683>20 beshort 0413 (demand paged) 3684>20 beshort 0443 (target shared library) 3685>22 beshort >0 - version %d 36860 beshort 0561 WE32000 COFF executable (TV) 3687>12 belong >0 not stripped 3688#>18 beshort &00020000 - 32100 required 3689#>18 beshort &00040000 and MAU hardware required 3690#>22 beshort >0 - version %d 3691# 3692# core file for 3b2 36930 string \000\004\036\212\200 3b2 core file 3694>364 string >\0 of '%s' 3695 3696#------------------------------------------------------------------------------ 3697# $File: audio,v 1.89 2018/07/03 20:55:37 christos Exp $ 3698# audio: file(1) magic for sound formats (see also "iff") 3699# 3700# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com), 3701# and others 3702# 3703 3704# Sun/NeXT audio data 37050 string .snd Sun/NeXT audio data: 3706>12 belong 1 8-bit ISDN mu-law, 3707!:mime audio/basic 3708>12 belong 2 8-bit linear PCM [REF-PCM], 3709!:mime audio/basic 3710>12 belong 3 16-bit linear PCM, 3711!:mime audio/basic 3712>12 belong 4 24-bit linear PCM, 3713!:mime audio/basic 3714>12 belong 5 32-bit linear PCM, 3715!:mime audio/basic 3716>12 belong 6 32-bit IEEE floating point, 3717!:mime audio/basic 3718>12 belong 7 64-bit IEEE floating point, 3719!:mime audio/basic 3720>12 belong 8 Fragmented sample data, 3721>12 belong 10 DSP program, 3722>12 belong 11 8-bit fixed point, 3723>12 belong 12 16-bit fixed point, 3724>12 belong 13 24-bit fixed point, 3725>12 belong 14 32-bit fixed point, 3726>12 belong 18 16-bit linear with emphasis, 3727>12 belong 19 16-bit linear compressed, 3728>12 belong 20 16-bit linear with emphasis and compression, 3729>12 belong 21 Music kit DSP commands, 3730>12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 3731!:mime audio/x-adpcm 3732>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 3733>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 3734>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 3735>12 belong 27 8-bit A-law (CCITT G.711), 3736>20 belong 1 mono, 3737>20 belong 2 stereo, 3738>20 belong 4 quad, 3739>16 belong >0 %d Hz 3740 3741# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format 3742# that uses little-endian encoding and has a different magic number 37430 lelong 0x0064732E DEC audio data: 3744>12 lelong 1 8-bit ISDN mu-law, 3745!:mime audio/x-dec-basic 3746>12 lelong 2 8-bit linear PCM [REF-PCM], 3747!:mime audio/x-dec-basic 3748>12 lelong 3 16-bit linear PCM, 3749!:mime audio/x-dec-basic 3750>12 lelong 4 24-bit linear PCM, 3751!:mime audio/x-dec-basic 3752>12 lelong 5 32-bit linear PCM, 3753!:mime audio/x-dec-basic 3754>12 lelong 6 32-bit IEEE floating point, 3755!:mime audio/x-dec-basic 3756>12 lelong 7 64-bit IEEE floating point, 3757!:mime audio/x-dec-basic 3758>12 belong 8 Fragmented sample data, 3759>12 belong 10 DSP program, 3760>12 belong 11 8-bit fixed point, 3761>12 belong 12 16-bit fixed point, 3762>12 belong 13 24-bit fixed point, 3763>12 belong 14 32-bit fixed point, 3764>12 belong 18 16-bit linear with emphasis, 3765>12 belong 19 16-bit linear compressed, 3766>12 belong 20 16-bit linear with emphasis and compression, 3767>12 belong 21 Music kit DSP commands, 3768>12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 3769!:mime audio/x-dec-basic 3770>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 3771>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 3772>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 3773>12 belong 27 8-bit A-law (CCITT G.711), 3774>20 lelong 1 mono, 3775>20 lelong 2 stereo, 3776>20 lelong 4 quad, 3777>16 lelong >0 %d Hz 3778 3779# Creative Labs AUDIO stuff 37800 string MThd Standard MIDI data 3781!:mime audio/midi 3782>8 beshort x (format %d) 3783>10 beshort x using %d track 3784>10 beshort >1 \bs 3785>12 beshort&0x7fff x at 1/%d 3786>12 beshort&0x8000 >0 SMPTE 3787 37880 string CTMF Creative Music (CMF) data 3789!:mime audio/x-unknown 37900 string SBI SoundBlaster instrument data 3791!:mime audio/x-unknown 37920 string Creative\ Voice\ File Creative Labs voice data 3793!:mime audio/x-unknown 3794# is this next line right? it came this way... 3795>19 byte 0x1A 3796>23 byte >0 - version %d 3797>22 byte >0 \b.%d 3798 3799# first entry is also the string "NTRK" 38000 belong 0x4e54524b MultiTrack sound data 3801>4 belong x - version %d 3802 3803# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED 3804# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi] 38050 string EMOD Extended MOD sound data, 3806>4 byte&0xf0 x version %d 3807>4 byte&0x0f x \b.%d, 3808>45 byte x %d instruments 3809>83 byte 0 (module) 3810>83 byte 1 (song) 3811 3812# Real Audio (Magic .ra\0375) 38130 belong 0x2e7261fd RealAudio sound file 3814!:mime audio/x-pn-realaudio 38150 string .RMF\0\0\0 RealMedia file 3816!:mime application/vnd.rn-realmedia 3817#video/x-pn-realvideo 3818#video/vnd.rn-realvideo 3819#application/vnd.rn-realmedia 3820# sigh, there are many mimes for that but the above are the most common. 3821 3822# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net] 3823# Oct 31, 1995 3824# fixed by <doj@cubic.org> 2003-06-24 3825# Too short... 3826#0 string MTM MultiTracker Module sound file 3827#0 string if Composer 669 Module sound data 3828#0 string JN Composer 669 Module sound data (extended format) 38290 string MAS_U ULT(imate) Module sound data 3830 3831#0 string FAR Module sound data 3832#>4 string >\15 Title: "%s" 3833 38340x2c string SCRM ScreamTracker III Module sound data 3835>0 string >\0 Title: "%s" 3836 3837# Gravis UltraSound patches 3838# From <ache@nagual.ru> 3839 38400 string GF1PATCH110\0ID#000002\0 GUS patch 38410 string GF1PATCH100\0ID#000002\0 Old GUS patch 3842 3843# mime types according to http://www.geocities.com/nevilo/mod.htm: 3844# audio/it .it 3845# audio/x-zipped-it .itz 3846# audio/xm fasttracker modules 3847# audio/x-s3m screamtracker modules 3848# audio/s3m screamtracker modules 3849# audio/x-zipped-mod mdz 3850# audio/mod mod 3851# audio/x-mod All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z) 3852 3853# 3854# Taken from loader code from mikmod version 2.14 3855# by Steve McIntyre (stevem@chiark.greenend.org.uk) 3856# <doj@cubic.org> added title printing on 2003-06-24 38570 string MAS_UTrack_V00 3858>14 string >/0 ultratracker V1.%.1s module sound data 3859!:mime audio/x-mod 3860#audio/x-tracker-module 3861 38620 string UN05 MikMod UNI format module sound data 3863 38640 string Extended\ Module: Fasttracker II module sound data 3865!:mime audio/x-mod 3866#audio/x-tracker-module 3867>17 string >\0 Title: "%s" 3868 386921 string/c =!SCREAM! Screamtracker 2 module sound data 3870!:mime audio/x-mod 3871#audio/x-screamtracker-module 387221 string BMOD2STM Screamtracker 2 module sound data 3873!:mime audio/x-mod 3874#audio/x-screamtracker-module 38751080 string M.K. 4-channel Protracker module sound data 3876!:mime audio/x-mod 3877#audio/x-protracker-module 3878>0 string >\0 Title: "%s" 38791080 string M!K! 4-channel Protracker module sound data 3880!:mime audio/x-mod 3881#audio/x-protracker-module 3882>0 string >\0 Title: "%s" 38831080 string FLT4 4-channel Startracker module sound data 3884!:mime audio/x-mod 3885#audio/x-startracker-module 3886>0 string >\0 Title: "%s" 38871080 string FLT8 8-channel Startracker module sound data 3888!:mime audio/x-mod 3889#audio/x-startracker-module 3890>0 string >\0 Title: "%s" 38911080 string 4CHN 4-channel Fasttracker module sound data 3892!:mime audio/x-mod 3893#audio/x-fasttracker-module 3894>0 string >\0 Title: "%s" 38951080 string 6CHN 6-channel Fasttracker module sound data 3896!:mime audio/x-mod 3897#audio/x-fasttracker-module 3898>0 string >\0 Title: "%s" 38991080 string 8CHN 8-channel Fasttracker module sound data 3900!:mime audio/x-mod 3901#audio/x-fasttracker-module 3902>0 string >\0 Title: "%s" 39031080 string CD81 8-channel Octalyser module sound data 3904!:mime audio/x-mod 3905#audio/x-octalysertracker-module 3906>0 string >\0 Title: "%s" 39071080 string OKTA 8-channel Octalyzer module sound data 3908!:mime audio/x-mod 3909#audio/x-octalysertracker-module 3910>0 string >\0 Title: "%s" 3911# Not good enough. 3912#1082 string CH 3913#>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data 39141080 string 16CN 16-channel Taketracker module sound data 3915!:mime audio/x-mod 3916#audio/x-taketracker-module 3917>0 string >\0 Title: "%s" 39181080 string 32CN 32-channel Taketracker module sound data 3919!:mime audio/x-mod 3920#audio/x-taketracker-module 3921>0 string >\0 Title: "%s" 3922 3923# TOC sound files -Trevor Johnson <trevor@jpj.net> 3924# 39250 string TOC TOC sound file 3926 3927# sidfiles <pooka@iki.fi> 3928# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24 39290 string SIDPLAY\ INFOFILE Sidplay info file 3930 39310 string PSID PlaySID v2.2+ (AMIGA) sidtune 3932>4 beshort >0 w/ header v%d, 3933>14 beshort =1 single song, 3934>14 beshort >1 %d songs, 3935>16 beshort >0 default song: %d 3936>0x16 string >\0 name: "%s" 3937>0x36 string >\0 author: "%s" 3938>0x56 string >\0 copyright: "%s" 3939 39400 string RSID RSID sidtune PlaySID compatible 3941>4 beshort >0 w/ header v%d, 3942>14 beshort =1 single song, 3943>14 beshort >1 %d songs, 3944>16 beshort >0 default song: %d 3945>0x16 string >\0 name: "%s" 3946>0x36 string >\0 author: "%s" 3947>0x56 string >\0 copyright: "%s" 3948 3949# IRCAM sound files - Michael Pruett <michael@68k.org> 3950# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html 39510 belong 0x64a30100 IRCAM file (VAX little-endian) 39520 belong 0x0001a364 IRCAM file (VAX big-endian) 39530 belong 0x64a30200 IRCAM file (Sun big-endian) 39540 belong 0x0002a364 IRCAM file (Sun little-endian) 39550 belong 0x64a30300 IRCAM file (MIPS little-endian) 39560 belong 0x0003a364 IRCAM file (MIPS big-endian) 39570 belong 0x64a30400 IRCAM file (NeXT big-endian) 39580 belong 0x64a30400 IRCAM file (NeXT big-endian) 39590 belong 0x0004a364 IRCAM file (NeXT little-endian) 3960 3961# NIST SPHERE <mpruett@sgi.com> 39620 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file 3963 3964# Sample Vision <mpruett@sgi.com> 39650 string SOUND\ SAMPLE\ DATA\ Sample Vision file 3966 3967# Audio Visual Research <tonigonenstein@users.sourceforge.net> 39680 string 2BIT Audio Visual Research file, 3969>12 beshort =0 mono, 3970>12 beshort =-1 stereo, 3971>14 beshort x %d bits 3972>16 beshort =0 unsigned, 3973>16 beshort =-1 signed, 3974>22 belong&0x00ffffff x %d Hz, 3975>18 beshort =0 no loop, 3976>18 beshort =-1 loop, 3977>21 ubyte <128 note %d, 3978>22 byte =0 replay 5.485 KHz 3979>22 byte =1 replay 8.084 KHz 3980>22 byte =2 replay 10.971 KHz 3981>22 byte =3 replay 16.168 KHz 3982>22 byte =4 replay 21.942 KHz 3983>22 byte =5 replay 32.336 KHz 3984>22 byte =6 replay 43.885 KHz 3985>22 byte =7 replay 47.261 KHz 3986 3987# SGI SoundTrack <mpruett@sgi.com> 39880 string _SGI_SoundTrack SGI SoundTrack project file 3989# ID3 version 2 tags <waschk@informatik.uni-rostock.de> 39900 string ID3 Audio file with ID3 version 2 3991>3 byte x \b.%d 3992>4 byte x \b.%d 3993>>5 byte &0x80 \b, unsynchronized frames 3994>>5 byte &0x40 \b, extended header 3995>>5 byte &0x20 \b, experimental 3996>>5 byte &0x10 \b, footer present 3997>(6.I+10) indirect x \b, contains: 3998 3999# NSF (NES sound file) magic 40000 string NESM\x1a NES Sound File 4001>14 string >\0 ("%s" by 4002>46 string >\0 %s, copyright 4003>78 string >\0 %s), 4004>5 byte x version %d, 4005>6 byte x %d tracks, 4006>122 byte&0x2 =1 dual PAL/NTSC 4007>122 byte&0x1 =1 PAL 4008>122 byte&0x1 =0 NTSC 4009 4010# NSFE (Extended NES sound file) magic 4011# http://slickproductions.org/docs/NSF/nsfespec.txt 4012# From: David Pflug <david@pflug.email> 40130 string NSFE Extended NES Sound File 4014>48 search/0x1000 auth 4015>>&0 string >\0 ("%s" 4016>>>&1 string >\0 by %s 4017>>>>&1 string >\0 \b, copyright %s 4018>>>>>&1 string >\0 \b, ripped by %s 4019>20 byte x \b), %d tracks, 4020>18 byte&0x2 =1 dual PAL/NTSC 4021>18 byte&0x2 =0 4022>>18 byte&0x1 =1 PAL 4023>>18 byte&0x1 =0 NTSC 4024 4025# Type: SNES SPC700 sound files 4026# From: Josh Triplett <josh@freedesktop.org> 40270 string SNES-SPC700\ Sound\ File\ Data\ v SNES SPC700 sound file 4028>&0 string 0.30 \b, version %s 4029>>0x23 byte 0x1B \b, without ID666 tag 4030>>0x23 byte 0x1A \b, with ID666 tag 4031>>>0x2E string >\0 \b, song "%.32s" 4032>>>0x4E string >\0 \b, game "%.32s" 4033 4034# Impulse tracker module (audio/x-it) 40350 string IMPM Impulse Tracker module sound data - 4036!:mime audio/x-mod 4037>4 string >\0 "%s" 4038>40 leshort !0 compatible w/ITv%x 4039>42 leshort !0 created w/ITv%x 4040 4041# Imago Orpheus module (audio/x-imf) 404260 string IM10 Imago Orpheus module sound data - 4043>0 string >\0 "%s" 4044 4045# From <collver1@attbi.com> 4046# These are the /etc/magic entries to decode modules, instruments, and 4047# samples in Impulse Tracker's native format. 4048 40490 string IMPS Impulse Tracker Sample 4050>18 byte &2 16 bit 4051>18 byte ^2 8 bit 4052>18 byte &4 stereo 4053>18 byte ^4 mono 40540 string IMPI Impulse Tracker Instrument 4055>28 leshort !0 ITv%x 4056>30 byte !0 %d samples 4057 4058# Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files 4059# From <collver1@attbi.com> 40600 string LM8953 Yamaha TX Wave 4061>22 byte 0x49 looped 4062>22 byte 0xC9 non-looped 4063>23 byte 1 33kHz 4064>23 byte 2 50kHz 4065>23 byte 3 16kHz 4066 4067# scream tracker: file(1) magic for Scream Tracker sample files 4068# 4069# From <collver1@attbi.com> 407076 string SCRS Scream Tracker Sample 4071>0 byte 1 sample 4072>0 byte 2 adlib melody 4073>0 byte >2 adlib drum 4074>31 byte &2 stereo 4075>31 byte ^2 mono 4076>31 byte &4 16bit little endian 4077>31 byte ^4 8bit 4078>30 byte 0 unpacked 4079>30 byte 1 packed 4080 4081# audio 4082# From: Cory Dikkers <cdikkers@swbell.net> 40830 string MMD0 MED music file, version 0 40840 string MMD1 OctaMED Pro music file, version 1 40850 string MMD3 OctaMED Soundstudio music file, version 3 40860 string OctaMEDCmpr OctaMED Soundstudio compressed file 40870 string MED MED_Song 40880 string SymM Symphonie SymMOD music file 4089# 40900 string THX AHX version 4091>3 byte =0 1 module data 4092>3 byte =1 2 module data 4093# 40940 string OKTASONG Oktalyzer module data 4095# 40960 string DIGI\ Booster\ module\0 %s 4097>20 byte >0 %c 4098>>21 byte >0 \b%c 4099>>>22 byte >0 \b%c 4100>>>>23 byte >0 \b%c 4101>610 string >\0 \b, "%s" 4102# 41030 string DBM0 DIGI Booster Pro Module 4104>4 byte >0 V%X. 4105>>5 byte x \b%02X 4106>16 string >\0 \b, "%s" 4107# 41080 string FTMN FaceTheMusic module 4109>16 string >\0d \b, "%s" 4110 4111# From: <doj@cubic.org> 2003-06-24 41120 string AMShdr\32 Velvet Studio AMS Module v2.2 41130 string Extreme Extreme Tracker AMS Module v1.3 41140 string DDMF Xtracker DMF Module 4115>4 byte x v%i 4116>0xD string >\0 Title: "%s" 4117>0x2B string >\0 Composer: "%s" 41180 string DSM\32 Dynamic Studio Module DSM 41190 string SONG DigiTrekker DTM Module 41200 string DMDL DigiTrakker MDL Module 41210 string PSM\32 Protracker Studio PSM Module 412244 string PTMF Poly Tracker PTM Module 4123>0 string >\32 Title: "%s" 41240 string MT20 MadTracker 2.0 Module MT2 41250 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD 41260 string RTMM RTM Module 41270x426 string MaDoKaN96 XMS Adlib Module 4128>0 string >\0 Composer: "%s" 41290 string AMF AMF Module 4130>4 string >\0 Title: "%s" 41310 string MODINFO1 Open Cubic Player Module Inforation MDZ 41320 string Extended\40Instrument: Fast Tracker II Instrument 4133 4134# From: Takeshi Hamasaki <hma@syd.odn.ne.jp> 4135# NOA Nancy Codec file 41360 string \210NOA\015\012\032 NOA Nancy Codec Movie file 4137# Yamaha SMAF format 41380 string MMMD Yamaha SMAF file 4139# Sharp Jisaku Melody format for PDC 41400 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody 4141>20 string Ver01.00 Ver. 1.00 4142>>32 byte x , %d tracks 4143 4144# Free lossless audio codec <http://flac.sourceforge.net> 4145# From: Przemyslaw Augustyniak <silvathraec@rpg.pl> 41460 string fLaC FLAC audio bitstream data 4147!:mime audio/flac 4148>4 byte&0x7f >0 \b, unknown version 4149>4 byte&0x7f 0 \b 4150# some common bits/sample values 4151>>20 beshort&0x1f0 0x030 \b, 4 bit 4152>>20 beshort&0x1f0 0x050 \b, 6 bit 4153>>20 beshort&0x1f0 0x070 \b, 8 bit 4154>>20 beshort&0x1f0 0x0b0 \b, 12 bit 4155>>20 beshort&0x1f0 0x0f0 \b, 16 bit 4156>>20 beshort&0x1f0 0x170 \b, 24 bit 4157>>20 byte&0xe 0x0 \b, mono 4158>>20 byte&0xe 0x2 \b, stereo 4159>>20 byte&0xe 0x4 \b, 3 channels 4160>>20 byte&0xe 0x6 \b, 4 channels 4161>>20 byte&0xe 0x8 \b, 5 channels 4162>>20 byte&0xe 0xa \b, 6 channels 4163>>20 byte&0xe 0xc \b, 7 channels 4164>>20 byte&0xe 0xe \b, 8 channels 4165# sample rates derived from known oscillator frequencies; 4166# 24.576 MHz (video/fs=48kHz), 22.5792 (audio/fs=44.1kHz) and 4167# 16.384 (other/fs=32kHz). 4168>>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz 4169>>17 belong&0xfffff0 0x03e800 \b, 16 kHz 4170>>17 belong&0xfffff0 0x056220 \b, 22.05 kHz 4171>>17 belong&0xfffff0 0x05dc00 \b, 24 kHz 4172>>17 belong&0xfffff0 0x07d000 \b, 32 kHz 4173>>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz 4174>>17 belong&0xfffff0 0x0bb800 \b, 48 kHz 4175>>17 belong&0xfffff0 0x0fa000 \b, 64 kHz 4176>>17 belong&0xfffff0 0x158880 \b, 88.2 kHz 4177>>17 belong&0xfffff0 0x177000 \b, 96 kHz 4178>>17 belong&0xfffff0 0x1f4000 \b, 128 kHz 4179>>17 belong&0xfffff0 0x2b1100 \b, 176.4 kHz 4180>>17 belong&0xfffff0 0x2ee000 \b, 192 kHz 4181>>17 belong&0xfffff0 0x3e8000 \b, 256 kHz 4182>>17 belong&0xfffff0 0x562200 \b, 352.8 kHz 4183>>17 belong&0xfffff0 0x5dc000 \b, 384 kHz 4184>>21 byte&0xf >0 \b, >4G samples 4185>>21 byte&0xf 0 \b 4186>>>22 belong >0 \b, %u samples 4187>>>22 belong 0 \b, length unknown 4188 4189# (ISDN) VBOX voice message file (Wolfram Kleff) 41900 string VBOX VBOX voice message data 4191 4192# ReBorn Song Files (.rbs) 4193# David J. Singer <doc@deadvirgins.org.uk> 41948 string RB40 RBS Song file 4195>29 string ReBorn created by ReBorn 4196>37 string Propellerhead created by ReBirth 4197 4198# Synthesizer Generator and Kimwitu share their file format 41990 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data 4200# Kimwitu++ uses a slightly different magic 42010 string A#S#C#S#S#L#HUB Kimwitu++ data 4202 4203# From "Simon Hosie 42040 string TFMX-SONG TFMX module sound data 4205 4206# Monkey's Audio compressed audio format (.ape) 4207# From danny.milo@gmx.net (Danny Milosavljevic) 4208# New version from Abel Cheung <abel (@) oaka.org> 42090 string MAC\040 Monkey's Audio compressed format 4210!:mime audio/x-ape 4211>4 uleshort >0x0F8B version %d 4212>>(0x08.l) uleshort =1000 with fast compression 4213>>(0x08.l) uleshort =2000 with normal compression 4214>>(0x08.l) uleshort =3000 with high compression 4215>>(0x08.l) uleshort =4000 with extra high compression 4216>>(0x08.l) uleshort =5000 with insane compression 4217>>(0x08.l+18) uleshort =1 \b, mono 4218>>(0x08.l+18) uleshort =2 \b, stereo 4219>>(0x08.l+20) ulelong x \b, sample rate %d 4220>4 uleshort <0x0F8C version %d 4221>>6 uleshort =1000 with fast compression 4222>>6 uleshort =2000 with normal compression 4223>>6 uleshort =3000 with high compression 4224>>6 uleshort =4000 with extra high compression 4225>>6 uleshort =5000 with insane compression 4226>>10 uleshort =1 \b, mono 4227>>10 uleshort =2 \b, stereo 4228>>12 ulelong x \b, sample rate %d 4229 4230# adlib sound files 4231# From: Alex Myczko <alex@aiei.ch> 42320 string RAWADATA RdosPlay RAW 4233 42341068 string RoR AMUSIC Adlib Tracker 4235 42360 string JCH EdLib 4237 42380 string mpu401tr MPU-401 Trakker 4239 42400 string SAdT Surprise! Adlib Tracker 4241>4 byte x Version %d 4242 42430 string XAD! eXotic ADlib 4244 42450 string ofTAZ! eXtra Simple Music 4246 4247# Spectrum 128 tunes (.ay files). 4248# From: Emanuel Haupt <ehaupt@critical.ch> 42490 string ZXAYEMUL Spectrum 128 tune 4250 42510 string \0BONK BONK, 4252#>5 byte x version %d 4253>14 byte x %d channel(s), 4254>15 byte =1 lossless, 4255>15 byte =0 lossy, 4256>16 byte x mid-side 4257 4258384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones) 4259 4260# format VQF (proprietary codec for sound) 4261# some infos on the header file available at : 4262# http://www.twinvq.org/english/technology_format.html 42630 string TWIN97012000 VQF data 4264>27 short 0 \b, Mono 4265>27 short 1 \b, Stereo 4266>31 short >0 \b, %d kbit/s 4267>35 short >0 \b, %d kHz 4268 4269# Nelson A. de Oliveira (naoliv@gmail.com) 4270# .eqf 42710 string Winamp\ EQ\ library\ file %s 4272# it will match only versions like v<digit>.<digit> 4273# Since I saw only eqf files with version v1.1 I think that it's OK 4274>23 string x \b%.4s 4275# .preset 42760 string [Equalizer\ preset] XMMS equalizer preset 4277# .m3u 42780 search/1 #EXTM3U M3U playlist text 4279# .pls 42800 search/1 [playlist] PLS playlist text 4281# licq.conf 42821 string [licq] LICQ configuration file 4283 4284# Atari ST audio files by Dirk Jagdmann <doj@cubic.org> 42850 string ICE! SNDH Atari ST music 42860 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music 4287 4288# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com> 42890 string MP+ Musepack audio (MP+) 4290!:mime audio/x-musepack 4291>3 byte 255 \b, SV pre8 4292>3 byte&0xF 0x6 \b, SV 6 4293>3 byte&0xF 0x8 \b, SV 8 4294>3 byte&0xF 0x7 \b, SV 7 4295>>3 byte&0xF0 0x0 \b.0 4296>>3 byte&0xF0 0x10 \b.1 4297>>3 byte&0xF0 240 \b.15 4298>>10 byte&0xF0 0x0 \b, no profile 4299>>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental' 4300>>10 byte&0xF0 0x50 \b, quality 0 4301>>10 byte&0xF0 0x60 \b, quality 1 4302>>10 byte&0xF0 0x70 \b, quality 2 (Telephone) 4303>>10 byte&0xF0 0x80 \b, quality 3 (Thumb) 4304>>10 byte&0xF0 0x90 \b, quality 4 (Radio) 4305>>10 byte&0xF0 0xA0 \b, quality 5 (Standard) 4306>>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme) 4307>>10 byte&0xF0 0xC0 \b, quality 7 (Insane) 4308>>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead) 4309>>10 byte&0xF0 0xE0 \b, quality 9 4310>>10 byte&0xF0 0xF0 \b, quality 10 4311>>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05 4312>>27 byte 102 \b, Beta 1.02 4313>>27 byte 104 \b, Beta 1.04 4314>>27 byte 105 \b, Alpha 1.05 4315>>27 byte 106 \b, Beta 1.06 4316>>27 byte 110 \b, Release 1.1 4317>>27 byte 111 \b, Alpha 1.11 4318>>27 byte 112 \b, Beta 1.12 4319>>27 byte 113 \b, Alpha 1.13 4320>>27 byte 114 \b, Beta 1.14 4321>>27 byte 115 \b, Alpha 1.15 4322 43230 string MPCK Musepack audio (MPCK) 4324!:mime audio/x-musepack 4325 4326# IMY 4327# from http://filext.com/detaillist.php?extdetail=IMY 4328# http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm 4329# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html 4330# http://www.wx800.com/msg/download/irda/iMelody.pdf 43310 string BEGIN:IMELODY iMelody Ringtone Format 4332 4333# From: "Mateus Caruccio" <mateus@caruccio.com> 4334# guitar pro v3,4,5 from http://filext.com/file-extension/gp3 43350 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature 4336 4337# From: "Leslie P. Polzer" <leslie.polzer@gmx.net> 433860 string SONG SoundFX Module sound file 4339 4340# Type: Adaptive Multi-Rate Codec 4341# URL: http://filext.com/detaillist.php?extdetail=AMR 4342# From: Russell Coker <russell@coker.com.au> 43430 string #!AMR Adaptive Multi-Rate Codec (GSM telephony) 4344 4345# Type: SuperCollider 3 Synth Definition File Format 4346# From: Mario Lang <mlang@debian.org> 43470 string SCgf SuperCollider3 Synth Definition file, 4348>4 belong x version %d 4349 4350# Type: True Audio Lossless Audio 4351# URL: http://wiki.multimedia.cx/index.php?title=True_Audio 4352# From: Mike Melanson <mike@multimedia.cx> 43530 string TTA1 True Audio Lossless Audio 4354 4355# Type: WavPack Lossless Audio 4356# URL: http://wiki.multimedia.cx/index.php?title=WavPack 4357# From: Mike Melanson <mike@multimedia.cx> 43580 string wvpk WavPack Lossless Audio 4359 4360# From Fabio R. Schmidlin <frs@pop.com.br> 4361# VGM music file 43620 string Vgm\040 4363>9 ubyte >0 VGM Video Game Music dump v 4364>>9 ubyte/16 >0 \b%d 4365>>9 ubyte&0x0F x \b%d 4366>>8 ubyte/16 x \b.%d 4367>>8 ubyte&0x0F >0 \b%d 4368#Get soundchips 4369>>8 ubyte x \b, soundchip(s)= 4370>>0x0C ulelong >0 SN76489, 4371>>0x10 ulelong >0 YM2413, 4372>>0x2C ulelong >0 YM2612, 4373>>0x30 ulelong >0 YM2151, 4374>>0x38 ulelong >0 Sega PCM, 4375>>0x34 ulelong >0xC 4376>>>0x40 ulelong >0 RF5C68, 4377>>0x34 ulelong >0x10 4378>>>0x44 ulelong >0 YM2203, 4379>>0x34 ulelong >0x14 4380>>>0x48 ulelong >0 YM2608, 4381>>0x34 ulelong >0x18 4382>>>0x4C lelong >0 YM2610, 4383>>>0x4C lelong <0 YM2610B, 4384>>0x34 ulelong >0x1C 4385>>>0x50 ulelong >0 YM3812, 4386>>0x34 ulelong >0x20 4387>>>0x54 ulelong >0 YM3526, 4388>>0x34 ulelong >0x24 4389>>>0x58 ulelong >0 Y8950, 4390>>0x34 ulelong >0x28 4391>>>0x5C ulelong >0 YMF262, 4392>>0x34 ulelong >0x2C 4393>>>0x60 ulelong >0 YMF278B, 4394>>0x34 ulelong >0x30 4395>>>0x64 ulelong >0 YMF271, 4396>>0x34 ulelong >0x34 4397>>>0x68 ulelong >0 YMZ280B, 4398>>0x34 ulelong >0x38 4399>>>0x6C ulelong >0 RF5C164, 4400>>0x34 ulelong >0x3C 4401>>>0x70 ulelong >0 PWM, 4402>>0x34 ulelong >0x40 4403>>>0x74 ulelong >0 4404>>>>0x78 ubyte 0x00 AY-3-8910, 4405>>>>0x78 ubyte 0x01 AY-3-8912, 4406>>>>0x78 ubyte 0x02 AY-3-8913, 4407>>>>0x78 ubyte 0x03 AY-3-8930, 4408>>>>0x78 ubyte 0x10 YM2149, 4409>>>>0x78 ubyte 0x11 YM3439, 4410 4411# GVOX Encore file format 4412# Since this is a proprietary file format and there is no publicly available 4413# format specification, this is just based on induction 4414# 44150 string SCOW 4416>4 byte 0xc4 GVOX Encore music, version 5.0 or above 4417>4 byte 0xc2 GVOX Encore music, version < 5.0 4418 44190 string ZBOT 4420>4 byte 0xc5 GVOX Encore music, version < 5.0 4421 4422# Summary: Garmin Voice Processing Module (WAVE audios) 4423# From: Joerg Jenderek 4424# URL: http://www.garmin.com/ 4425# Reference: http://turboccc.wikispaces.com/share/view/28622555 4426# NOTE: there exist 2 other Garmin VPM formats 44270 string AUDIMG 4428# skip text files starting with string "AUDIMG" 4429>13 ubyte <13 Garmin Voice Processing Module 4430!:mime audio/x-vpm-wav-garmin 4431!:ext vpm 4432# 3 bytes indicating the voice version (200,220) 4433>>6 string x \b, version %3.3s 4434# day of release (01-31) 4435>>12 ubyte x \b, %.2d 4436# month of release (01-12) 4437>>13 ubyte x \b.%.2d 4438# year of release (like 2006, 2007, 2008) 4439>>14 uleshort x \b.%.4d 4440# hour of release (0-23) 4441>>11 ubyte x %.2d 4442# minute of release (0-59) 4443>>10 ubyte x \b:%.2d 4444# second of release (0-59) 4445>>9 ubyte x \b:%.2d 4446# if you select a language like german on your garmin device 4447# you can only select voice modules with corresponding language byte ID like 1 4448>>18 ubyte x \b, language ID %d 4449# pointer to 1st audio WAV sample 4450>>16 uleshort >0 4451>>>(16.s) ulelong >0 \b, at offset 0x%x 4452# WAV length 4453>>>>(16.s+4) ulelong >0 %d Bytes 4454# look for magic 4455>>>>>(&-8.l) string RIFF 4456# determine type by ./riff 4457>>>>>>&-4 indirect x \b 4458# 2 - ~ 131 WAV samples following same way 4459 4460# From Martin Mueller Skarbiniks Pedersen 44610 string GDM 4462>0x3 byte 0xFE General Digital Music. 4463>0x4 string >\0 title: "%s" 4464>0x24 string >\0 musician: "%s" 4465>>0x44 beshort 0x0D0A 4466>>>0x46 byte 0x1A 4467>>>>0x47 string GMFS Version 4468>>>>0x4B byte x %d. 4469>>>>0x4C byte x \b%02d 4470>>>>0x4D beshort 0x000 (2GDM v 4471>>>>0x4F byte x \b%d. 4472>>>>>0x50 byte x \b%d) 4473 44740 string MTM Multitracker 4475>0x3 byte/16 x Version %d. 4476>0x3 byte&0x0F x \b%02d 4477>>0x4 string >\0 title: "%s" 4478 44790 string HVL 4480>3 byte <2 Hively Tracker Song 4481>3 byte 0 1 module data 4482>3 byte 1 2 module data 4483 44840 string MO3 4485>3 ubyte <6 MOdule with MP3 4486>>3 byte 0 Version 0 (With MP3 and lossless) 4487>>3 byte 1 Version 1 (With ogg and lossless) 4488>>3 byte 3 Version 2.2 4489>>3 byte 4 (With no LAME header) 4490>>3 byte 5 Version 2.4 4491 44920 string ADRVPACK AProSys module 4493 4494# ftp://ftp.modland.com/pub/documents/format_documentation/\ 4495# Art%20Of%20Noise%20(.aon).txt 44960 string AON 4497>4 string "ArtOfNoise by Bastian Spiegel(twice/lego)" 4498>0x2e string NAME Art of Noise Tracker Song 4499>3 string <9 4500>3 string 4 (4 voices) 4501>3 string 8 (8 voices) 4502>>0x36 string >\0 Title: "%s" 4503 45040 string FAR 4505>0x2c byte 0x0d 4506>0x2d byte 0x0a 4507>0x2e byte 0x1a 4508>>0x3 byte 0xFE Farandole Tracker Song 4509>>>0x31 byte/16 x Version %d. 4510>>>0x31 byte&0x0F x \b%02d 4511>>>>0x4 string >\0 \b, title: "%s" 4512 4513# magic for Klystrack, http://kometbomb.github.io/klystrack/ 4514# from Alex Myczko <alex@aiei.ch> 45150 string cyd!song Klystrack song 4516>8 byte >0 \b, version %u 4517>8 byte >26 4518#>>9 byte x \b, channels %u 4519#>>10 leshort x \b, time signature %u 4520#>>12 leshort x \b, sequence step %u 4521#>>14 byte x \b, instruments %u 4522#>>15 leshort x \b, patterns %u 4523#>>17 leshort x \b, sequences %u 4524#>>19 leshort x \b, length %u 4525#>>21 leshort x \b, loop point %u 4526#>>23 byte x \b, master volume %u 4527#>>24 byte x \b, song speed %u 4528#>>25 byte x \b, song speed2 %u 4529#>>26 byte x \b, song rate %u 4530#>>27 belong x \b, flags %#x 4531#>>31 byte x \b, multiplex period %u 4532#>>32 byte x \b, pitch inaccuracy %u 4533>>149 pstring x \b, title %s 4534 45350 string cyd!inst Klystrack instrument 4536 4537# magic for WOPL instrument files, https://github.com/Wohlstand/OPL3BankEditor 4538# see Specifications/WOPL-and-OPLI-Specification.txt 4539 45400 string WOPL3-INST\0 WOPL instrument 4541>11 leshort x \b, version %u 45420 string WOPL3-BANK\0 WOPL instrument bank 4543>11 leshort x \b, version %u 4544 4545# AdLib/OPL instrument files. Format specifications on 4546# http://www.shikadi.net/moddingwiki 45470 string Junglevision\ Patch\ File Junglevision instrument data 45480 string #OPL_II# DMX OP2 instrument data 45490 string IBK\x1a IBK instrument data 45500 string 2OP\x1a IBK instrument data, 2 operators 45510 string 4OP\x1a IBK instrument data, 4 operators 45522 string ADLIB- AdLib instrument data 4553>0 byte x \b, version %u 4554>1 byte x \b.%u 4555 4556# CRI ADX ADPCM audio 4557# Used by various Sega games. 4558# https://en.wikipedia.org/wiki/ADX_(file_format) 4559# https://wiki.multimedia.cx/index.php/CRI_ADX_file 4560# Added by David Korth <gerbilsoft@gerbilsoft.com> 45610x00 beshort 0x8000 4562>(2.S-2) string (c)CRI CRI ADX ADPCM audio 4563>>0x12 byte x v%u 4564>>0x04 byte 0x02 \b, pre-set prediction coefficients 4565>>0x04 byte 0x03 \b, standard ADX 4566>>0x04 byte 0x04 \b, exponential scale 4567>>0x04 byte 0x05 \b, AHX 4568>>0x08 belong x \b, %u Hz 4569>>0x12 byte 0x03 4570>>>0x02 beshort >0x2B 4571>>>>0x18 belong !0 \b, looping 4572>>0x12 byte 0x04 4573>>>0x02 beshort >0x37 4574>>>>0x24 belong !0 \b, looping 4575>>0x13 byte&0x08 0x08 \b, encrypted 4576 4577# Lossless audio (.la) (http://www.lossless-audio.com/) 45780 string LA 4579>2 string 03 Lossless audio version 0.3 4580>2 string 04 Lossless audio version 0.4 4581 4582# Sony PlayStation Audio (.xa) 45830 leshort 0x4158 Sony PlayStation Audio 4584 4585 4586#---------------------------------------------------------------- 4587# $File: basis,v 1.4 2009/09/19 16:28:08 christos Exp $ 4588# basis: file(1) magic for BBx/Pro5-files 4589# Oliver Dammer <dammer@olida.de> 2005/11/07 4590# http://www.basis.com business-basic-files. 4591# 45920 string \074\074bbx\076\076 BBx 4593>7 string \000 indexed file 4594>7 string \001 serial file 4595>7 string \002 keyed file 4596>>13 short 0 (sort) 4597>7 string \004 program 4598>>18 byte x (LEVEL %d) 4599>>>23 string >\000 psaved 4600>7 string \006 mkeyed file 4601>>13 short 0 (sort) 4602>>8 string \000 (mkey) 4603#------------------------------------------------------------------------------ 4604# $File: beetle,v 1.2 2018/02/05 23:42:17 rrt Exp $ 4605# beetle: file(1) magic for Beetle VM object files 4606# https://github.com/rrthomas/beetle/ 4607 4608# Beetle object module 46090 string BEETLE\000 Beetle VM object file 4610 4611#------------------------------------------------------------------------------ 4612# $File: ber,v 1.1 2016/06/05 00:21:30 christos Exp $ 4613# ber: file(1) magic for several BER formats used in the mobile 4614# telecommunications industry (Georg Sauthoff) 4615 4616# The file formats are standardized by the GSMA (GSM association). 4617# They are specified via ASN.1 schemas and some prose. Basic encoding 4618# rules (BER) is the used encoding. The formats are used for exchanging 4619# call data records (CDRs) between mobile operators and associated 4620# parties for roaming clearing purposes and fraud detection. 4621 4622# The magic file covers: 4623 4624# - TAP files (TD.57) - CDR batches and notifications 4625# - RAP files (TD.32) - return batches and acknowledgements 4626# - NRT files (TD.35) - CDR batches for 'near real time' processing 4627 4628# 4629# TAP 3 Files 4630# TAP -> Transferred Account Procedure 4631# cf. http://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf 4632# TransferBatch short tag 46330 byte 0x61 4634# BatchControlInfo short tag 4635>&1 search/b5 \x64 4636# Sender long tag #TAP 3.x (BER encoded) 4637>>&1 search/b8 \x5f\x81\x44 4638# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block 4639>>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01 4640>>>>&0 byte x TAP 3.%d Batch (TD.57, Transferred Account) 4641 4642# Notification short tag 46430 byte 0x62 4644# Sender long tag 4645>2 search/b8 \x5f\x81\x44 4646# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block 4647>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01 4648>>>&0 byte x TAP 3.%d Notification (TD.57, Transferred Account) 4649 4650 4651# NRT Files 4652# NRT a.k.a. NRTRDE 46530 byte 0x61 4654# <SpecificationVersionNumber>2</><ReleaseVersionNumber> block 4655>&1 search/b8 \x5f\x29\x01\x02\x5f\x25\x01 4656>>&0 byte x NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange) 4657 4658# RAP Files 4659# cf. http://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf 4660# Long ReturnBatch tag 46610 string \x7f\x84\x16 4662# Long RapBatchControlInfo tag 4663>&1 search/b8 \x7f\x84\x19 4664# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block 4665>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01 4666# <RapSpecificationVersionNumber>1</><RapReleaseVersionNumber> block 4667>>>&1 string/b \x5f\x84\x20\x01\x01\x5f\x84\x1f\x01 4668>>>>&0 byte x RAP 1.%d Batch (TD.32, Returned Account Procedure), 4669>>>&0 byte x TAP 3.%d 4670 4671# Long Acknowledgement tag 46720 string \x7f\x84\x17 4673# Long Sender tag 4674>&1 search/b5 \x5f\x81\x44 RAP Acknowledgement (TD.32, Returned Account Procedure) 4675 4676#------------------------------------------------------------------------------ 4677# $File: bflt,v 1.5 2014/04/30 21:41:02 christos Exp $ 4678# bFLT: file(1) magic for BFLT uclinux binary files 4679# 4680# From Philippe De Muyter <phdm@macqel.be> 4681# 46820 string bFLT BFLT executable 4683>4 belong x - version %d 4684>4 belong 4 4685>>36 belong&0x1 0x1 ram 4686>>36 belong&0x2 0x2 gotpic 4687>>36 belong&0x4 0x4 gzip 4688>>36 belong&0x8 0x8 gzdata 4689 4690#------------------------------------------------------------------------------ 4691# $File: bhl,v 1.1 2017/06/11 22:20:02 christos Exp $ 4692# BlockHashLoc 4693# ext: bhl 4694# Marco Pontello marcopon@gmail.com 4695# reference: https://github.com/MarcoPon/BlockHashLoc 46960 string BlockHashLoc\x1a BlockHashLoc recovery info, 4697>13 byte x version %d 4698!:ext bhl 4699 4700#------------------------------------------------------------------------------ 4701# $File: bioinformatics,v 1.4 2016/06/20 16:13:46 christos Exp $ 4702# bioinfomatics: file(1) magic for Bioinfomatics file formats 4703 4704############################################################################### 4705# BGZF (Blocked GNU Zip Format) - gzip compatible, but also indexable 4706# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml) 4707############################################################################### 47080 string \037\213 4709>3 byte &0x04 4710>>12 string BC 4711>>>14 leshort &0x02 Blocked GNU Zip Format (BGZF; gzip compatible) 4712>>>>16 leshort x \b, block length %d 4713!:mime application/x-gzip 4714 4715 4716############################################################################### 4717# Tabix index file 4718# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml) 4719############################################################################### 47200 string TBI\1 SAMtools TBI (Tabix index format) 4721>0x04 lelong =1 \b, with %d reference sequence 4722>0x04 lelong >1 \b, with %d reference sequences 4723>0x08 lelong &0x10000 \b, using half-closed-half-open coordinates (BED style) 4724>0x08 lelong ^0x10000 4725>>0x08 lelong =0 \b, using closed and one based coordinates (GFF style) 4726>>0x08 lelong =1 \b, using SAM format 4727>>0x08 lelong =2 \b, using VCF format 4728>0x0c lelong x \b, sequence name column: %d 4729>0x10 lelong x \b, region start column: %d 4730>0x08 lelong =0 4731>>0x14 lelong x \b, region end column: %d 4732>0x18 byte x \b, comment character: %c 4733>0x1c lelong x \b, skip line count: %d 4734 4735 4736############################################################################### 4737# BAM (Binary Sequence Alignment/Map format) 4738# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf) 4739# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 4740############################################################################### 47410 string BAM\1 SAMtools BAM (Binary Sequence Alignment/Map) 4742>0x04 lelong >0 4743>>&0x00 regex =^[@]HD\t.*VN: \b, with SAM header 4744>>>&0 regex =[0-9.]+ \b version %s 4745>>&(0x04) lelong >0 \b, with %d reference sequences 4746 4747 4748############################################################################### 4749# BAI (BAM indexing format) 4750# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf) 4751############################################################################### 47520 string BAI\1 SAMtools BAI (BAM indexing format) 4753>0x04 lelong >0 \b, with %d reference sequences 4754 4755 4756############################################################################### 4757# CRAM (Binary Sequence Alignment/Map format) 4758############################################################################### 47590 string CRAM CRAM 4760>0x04 byte >-1 version %d. 4761>0x05 byte >-1 \b%d 4762>0x06 string >\0 (identified as %s) 4763 4764 4765############################################################################### 4766# BCF (Binary Call Format), version 1 4767# used by SAMtools & VCFtools (http://vcftools.sourceforge.net/bcf.pdf) 4768# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 4769############################################################################### 47700 string BCF\4 4771# length of seqnm data in bytes is positive 4772>&0x00 lelong >0 4773# length of smpl data in bytes is positive 4774>>&(&-0x04) lelong >0 SAMtools BCF (Binary Call Format) 4775# length of meta in bytes 4776>>>&(&-0x04) lelong >0 4777# have meta text string 4778>>>>&0x00 search ##samtoolsVersion= 4779>>>>>&0x00 string x \b, generated by SAMtools version %s 4780 4781 4782############################################################################### 4783# BCF (Binary Call Format), version 2.1 4784# used by SAMtools (http://samtools.github.io/hts-specs/BCFv2_qref.pdf) 4785# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 4786############################################################################### 47870 string BCF\2\1 Binary Call Format (BCF) version 2.1 4788# length of header text 4789>&0x00 lelong >0 4790# have header string 4791>>&0x00 search ##samtoolsVersion= 4792>>>&0x00 string x \b, generated by SAMtools version %s 4793 4794 4795############################################################################### 4796# BCF (Binary Call Format), version 2.2 4797# used by SAMtools (http://samtools.github.io/hts-specs/BCFv2_qref.pdf) 4798# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 4799############################################################################### 48000 string BCF\2\2 Binary Call Format (BCF) version 2.2 4801# length of header text 4802>&0x00 lelong >0 4803# have header string 4804>>&0x00 search ##samtoolsVersion= 4805>>>&0x00 string x \b, generated by SAMtools version %s 4806 4807############################################################################### 4808# VCF (Variant Call Format) 4809# used by VCFtools (http://vcftools.sourceforge.net/) 4810############################################################################### 48110 search ##fileformat=VCFv Variant Call Format (VCF) 4812>&0 string x \b version %s 4813 4814############################################################################### 4815# FASTQ 4816# used by MAQ (http://maq.sourceforge.net/fastq.shtml) 4817############################################################################### 4818# XXX Broken? 4819# @<seqname> 4820#0 regex =^@[A-Za-z0-9_.:-]+\?\n 4821# <seq> 4822#>&1 regex =^[A-Za-z\n.~]++ 4823# +[<seqname>] 4824#>>&1 regex =^[A-Za-z0-9_.:-]*\?\n 4825# <qual> 4826#>>>&1 regex =^[!-~\n]+\n FASTQ 4827 4828############################################################################### 4829# FASTA 4830# used by FASTA (http://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf) 4831############################################################################### 4832#0 byte 0x3e 4833# q>0 regex =^[>][!-~\t\ ]+$ 4834# Amino Acid codes: [A-IK-Z*-]+ 4835#>>1 regex !=[!-'Jj;:=?@^`|~\\] FASTA 4836# IUPAC codes/gaps: [ACGTURYKMSWBDHVNX-]+ 4837# not in IUPAC codes/gaps: [EFIJLOPQZ] 4838#>>>1 regex !=[EFIJLOPQZefijlopqz] \b, with IUPAC nucleotide codes 4839#>>>1 regex =^[EFIJLOPQZefijlopqz]+$ \b, with Amino Acid codes 4840 4841############################################################################### 4842# SAM (Sequence Alignment/Map format) 4843# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf) 4844############################################################################### 4845# Short-cut version to recognise SAM files with (optional) header at beginning 4846############################################################################### 48470 string @HD\t 4848>4 search VN: Sequence Alignment/Map (SAM), with header 4849>>&0 regex [0-9.]+ \b version %s 4850############################################################################### 4851# Longer version to recognise SAM alignment lines using (many) regexes 4852############################################################################### 4853# SAM Alignment QNAME 48540 regex =^[!-?A-~]{1,255}(\t[^\t]+){11} 4855# SAM Alignment FLAG 4856>0 regex =^([^\t]+\t){1}[0-9]{1,5}\t 4857# SAM Alignment RNAME 4858>>0 regex =^([^\t]+\t){2}\\*|[^*=]*\t 4859# SAM Alignment POS 4860>>>0 regex =^([^\t]+\t){3}[0-9]{1,9}\t 4861# SAM Alignment MAPQ 4862>>>>0 regex =^([^\t]+\t){4}[0-9]{1,3}\t 4863# SAM Alignment CIGAR 4864>>>>>0 regex =\t(\\*|([0-9]+[MIDNSHPX=])+)\t 4865# SAM Alignment RNEXT 4866>>>>>>0 regex =\t(\\*|=|[!-()+->?-~][!-~]*)\t 4867# SAM Alignment PNEXT 4868>>>>>>>0 regex =^([^\t]+\t){7}[0-9]{1,9}\t 4869# SAM Alignment TLEN 4870>>>>>>>>0 regex =\t[+-]{0,1}[0-9]{1,9}\t.*\t 4871# SAM Alignment SEQ 4872>>>>>>>>>0 regex =^([^\t]+\t){9}(\\*|[A-Za-z=.]+)\t 4873# SAM Alignment QUAL 4874>>>>>>>>>>0 regex =^([^\t]+\t){10}[!-~]+ Sequence Alignment/Map (SAM) 4875>>>>>>>>>>>0 regex =^[@]HD\t.*VN: \b, with header 4876>>>>>>>>>>>>&0 regex =[0-9.]+ \b version %s 4877 4878#------------------------------------------------------------------------------ 4879# $File: blackberry,v 1.2 2017/03/17 21:35:28 christos Exp $ 4880# blackberry: file(1) magic for BlackBerry file formats 4881# 48825 belong 0 4883>8 belong 010010010 BlackBerry RIM ETP file 4884>>22 string x \b for %s 4885# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files 4886# http://ftg.lbl.gov/checkpoint 48870 string C\0\0\0R\0\0\0 BLCR 4888>16 lelong 1 x86 4889>16 lelong 3 alpha 4890>16 lelong 5 x86-64 4891>16 lelong 7 ARM 4892>8 lelong x context data (little endian, version %d) 4893# Uncomment the following only of your "file" program supports "search" 4894#>0 search/1024 VMA\06 for kernel 4895#>>&1 byte x %d. 4896#>>&2 byte x %d. 4897#>>&3 byte x %d 48980 string \0\0\0C\0\0\0R BLCR 4899>16 belong 2 SPARC 4900>16 belong 4 ppc 4901>16 belong 6 ppc64 4902>16 belong 7 ARMEB 4903>16 belong 8 SPARC64 4904>8 belong x context data (big endian, version %d) 4905# Uncomment the following only of your "file" program supports "search" 4906#>0 search/1024 VMA\06 for kernel 4907#>>&1 byte x %d. 4908#>>&2 byte x \b%d. 4909#>>&3 byte x \b%d 4910 4911#------------------------------------------------------------------------------ 4912# $File: blender,v 1.7 2017/03/17 21:35:28 christos Exp $ 4913# blender: file(1) magic for Blender 3D related files 4914# 4915# Native format rule v1.2. For questions use the developers list 4916# http://lists.blender.org/mailman/listinfo/bf-committers 4917# GLOB chunk was moved near start and provides subversion info since 2.42 4918 49190 string =BLENDER Blender3D, 4920>7 string =_ saved as 32-bits 4921>>8 string =v little endian 4922>>>9 byte x with version %c. 4923>>>10 byte x \b%c 4924>>>11 byte x \b%c 4925>>>0x40 string =GLOB \b. 4926>>>>0x58 leshort x \b%.4d 4927>>8 string =V big endian 4928>>>9 byte x with version %c. 4929>>>10 byte x \b%c 4930>>>11 byte x \b%c 4931>>>0x40 string =GLOB \b. 4932>>>>0x58 beshort x \b%.4d 4933>7 string =- saved as 64-bits 4934>>8 string =v little endian 4935>>9 byte x with version %c. 4936>>10 byte x \b%c 4937>>11 byte x \b%c 4938>>0x44 string =GLOB \b. 4939>>>0x60 leshort x \b%.4d 4940>>8 string =V big endian 4941>>>9 byte x with version %c. 4942>>>10 byte x \b%c 4943>>>11 byte x \b%c 4944>>>0x44 string =GLOB \b. 4945>>>>0x60 beshort x \b%.4d 4946 4947# Scripts that run in the embedded Python interpreter 49480 string #!BPY Blender3D BPython script 4949 4950#------------------------------------------------------------------------------ 4951# $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $ 4952# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine 4953# 4954# Note that this 0407 conflicts with several other a.out formats... 4955# 4956# XXX - should this be redone with "be" and "le", so that it works on 4957# little-endian machines as well? If so, what's the deal with 4958# "VAX-order" and "VAX-order2"? 4959# 4960#0 long 0407 68K Blit (standalone) executable 4961#0 short 0407 VAX-order2 68K Blit (standalone) executable 49620 short 03401 VAX-order 68K Blit (standalone) executable 49630 long 0406 68k Blit mpx/mux executable 49640 short 0406 VAX-order2 68k Blit mpx/mux executable 49650 short 03001 VAX-order 68k Blit mpx/mux executable 4966# Need more values for WE32 DMD executables. 4967# Note that 0520 is the same as COFF 4968#0 short 0520 tty630 layers executable 4969 4970#------------------------------------------------------------------------------ 4971# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $ 4972# i80960 b.out objects and archives 4973# 49740 long 0x10d i960 b.out relocatable object 4975>16 long >0 not stripped 4976# 4977# b.out archive (hp-rt on i960) 49780 string =!<bout> b.out archive 4979>8 string __.SYMDEF random library 4980 4981#------------------------------------------------------------------------------ 4982# $File: bsdi,v 1.7 2014/03/29 15:40:34 christos Exp $ 4983# bsdi: file(1) magic for BSD/OS (from BSDI) objects 4984# Some object/executable formats use the same magic numbers as are used 4985# in other OSes; those are handled by entries in aout. 4986# 4987 49880 lelong 0314 386 compact demand paged pure executable 4989>16 lelong >0 not stripped 4990>32 byte 0x6a (uses shared libs) 4991 4992# same as in SunOS 4.x, except for static shared libraries 49930 belong&077777777 0600413 SPARC demand paged 4994>0 byte &0x80 4995>>20 belong <4096 shared library 4996>>20 belong =4096 dynamically linked executable 4997>>20 belong >4096 dynamically linked executable 4998>0 byte ^0x80 executable 4999>16 belong >0 not stripped 5000>36 belong 0xb4100001 (uses shared libs) 5001 50020 belong&077777777 0600410 SPARC pure 5003>0 byte &0x80 dynamically linked executable 5004>0 byte ^0x80 executable 5005>16 belong >0 not stripped 5006>36 belong 0xb4100001 (uses shared libs) 5007 50080 belong&077777777 0600407 SPARC 5009>0 byte &0x80 dynamically linked executable 5010>0 byte ^0x80 executable 5011>16 belong >0 not stripped 5012>36 belong 0xb4100001 (uses shared libs) 5013# Chiasmus is a encryption standard developed by the German Federal 5014# Office for Information Security (Bundesamt fuer Sicherheit in der 5015# Informationstechnik). 5016 5017# Extension: .xia 50180 string XIA1 Chiasmus encrypted data 5019 5020# Extension: .xis 50210 string XIS Chiasmus key 5022 5023#------------------------------------------------------------------------------ 5024# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $ 5025# BTSnoop: file(1) magic for BTSnoop files 5026# 5027# From <marcel@holtmann.org> 50280 string btsnoop\0 BTSnoop 5029>8 belong x version %d, 5030>12 belong 1001 Unencapsulated HCI 5031>12 belong 1002 HCI UART (H4) 5032>12 belong 1003 HCI BCSP 5033>12 belong 1004 HCI Serial (H5) 5034>>12 belong x type %d 5035 5036#------------------------------------------------------------------------------ 5037# $File: c64,v 1.7 2017/11/15 12:19:06 christos Exp $ 5038# c64: file(1) magic for various commodore 64 related files 5039# 5040# From: Dirk Jagdmann <doj@cubic.org> 5041 50420x16500 belong 0x12014100 D64 Image 50430x16500 belong 0x12014180 D71 Image 50440x61800 belong 0x28034400 D81 Image 50450 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image 50460 belong 0x43154164 X64 Image 5047 50480 string GCR-1541 GCR Image 5049>8 byte x version: %i 5050>9 byte x tracks: %i 5051 50529 string PSUR ARC archive (c64) 50532 string -LH1- LHA archive (c64) 5054 50550 string C64File PC64 Emulator file 5056>8 string >\0 "%s" 50570 string C64Image PC64 Freezer Image 5058 50590 beshort 0x38CD C64 PCLink Image 50600 string CBM\144\0\0 Power 64 C64 Emulator Snapshot 5061 50620 belong 0xFF424CFF WRAptor packer (c64) 5063 50640 string C64S\x20tape\x20file T64 tape Image 5065>32 leshort x Version:0x%x 5066>36 leshort !0 Entries:%i 5067>40 string x Name:%.24s 5068 50690 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 5070>32 leshort x Version:0x%x 5071>36 leshort !0 Entries:%i 5072>40 string x Name:%.24s 5073 50740 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 5075>32 leshort x Version:0x%x 5076>36 leshort !0 Entries:%i 5077>40 string x Name:%.24s 5078 5079# Raw tape file format (.tap files) 5080# Esa Hyyti <esa@netlab.tkk.fi> 50810 string C64-TAPE-RAW C64 Raw Tape File (.tap), 5082>0x0c byte x Version:%u, 5083>0x10 lelong x Length:%u cycles 5084 5085# magic for Goattracker2, http://covertbitops.c64.org/ 5086# from Alex Myczko <alex@aiei.ch> 50870 string GTS5 GoatTracker 2 song 5088>4 string >\0 \b, "%s" 5089>36 string >\0 \b by %s 5090>68 string >\0 \b (C) %s 5091>100 byte >0 \b, %u subsong(s) 5092 5093 5094#------------------------------------------------------------------------------ 5095# $File: cad,v 1.16 2018/05/07 23:26:31 christos Exp $ 5096# autocad: file(1) magic for cad files 5097# 5098 5099# Microstation DGN/CIT Files (www.bentley.com) 5100# Last updated July 29, 2005 by Lester Hightower 5101# DGN is the default file extension of Microstation/Intergraph CAD files. 5102# CIT is the proprietary raster format (similar to TIFF) used to attach 5103# raster underlays to Microstation DGN (vector) drawings. 5104# 5105# http://www.wotsit.org/search.asp 5106# http://filext.com/detaillist.php?extdetail=DGN 5107# http://filext.com/detaillist.php?extdetail=CIT 5108# 5109# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2 5110# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928 5111# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 5112# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F 51130 string \010\011\376 Microstation 5114>3 string \002 5115>>30 string \026\105 DGNFile 5116>>30 string \034\105 DGNFile 5117>>30 string \073\107 DGNFile 5118>>30 string \073\110 DGNFile 5119>>30 string \106\107 DGNFile 5120>>30 string \110\103 DGNFile 5121>>30 string \120\104 DGNFile 5122>>30 string \172\104 DGNFile 5123>>30 string \172\105 DGNFile 5124>>30 string \172\106 DGNFile 5125>>30 string \234\106 DGNFile 5126>>30 string \273\105 DGNFile 5127>>30 string \306\106 DGNFile 5128>>30 string \310\104 DGNFile 5129>>30 string \341\104 DGNFile 5130>>30 string \372\103 DGNFile 5131>>30 string \372\104 DGNFile 5132>>30 string \372\106 DGNFile 5133>>30 string \376\103 DGNFile 5134>4 string \030\000\000 CITFile 5135>4 string \030\000\003 CITFile 5136 5137# AutoCAD 5138# Merge of the different contributions and updates from http://en.wikipedia.org/wiki/Dwg 5139# and http://www.iana.org/assignments/media-types/image/vnd.dwg 51400 string MC0.0 DWG AutoDesk AutoCAD Release 1.0 5141!:mime image/vnd.dwg 51420 string AC1.2 DWG AutoDesk AutoCAD Release 1.2 5143!:mime image/vnd.dwg 51440 string AC1.3 DWG AutoDesk AutoCAD Release 1.3 5145!:mime image/vnd.dwg 51460 string AC1.40 DWG AutoDesk AutoCAD Release 1.40 5147!:mime image/vnd.dwg 51480 string AC1.50 DWG AutoDesk AutoCAD Release 2.05 5149!:mime image/vnd.dwg 51500 string AC2.10 DWG AutoDesk AutoCAD Release 2.10 5151!:mime image/vnd.dwg 51520 string AC2.21 DWG AutoDesk AutoCAD Release 2.21 5153!:mime image/vnd.dwg 51540 string AC2.22 DWG AutoDesk AutoCAD Release 2.22 5155!:mime image/vnd.dwg 51560 string AC1001 DWG AutoDesk AutoCAD Release 2.22 5157!:mime image/vnd.dwg 51580 string AC1002 DWG AutoDesk AutoCAD Release 2.50 5159!:mime image/vnd.dwg 51600 string AC1003 DWG AutoDesk AutoCAD Release 2.60 5161!:mime image/vnd.dwg 51620 string AC1004 DWG AutoDesk AutoCAD Release 9 5163!:mime image/vnd.dwg 51640 string AC1006 DWG AutoDesk AutoCAD Release 10 5165!:mime image/vnd.dwg 51660 string AC1009 DWG AutoDesk AutoCAD Release 11/12 5167!:mime image/vnd.dwg 5168# AutoCAD DWG versions R13/R14 (www.autodesk.com) 5169# Written December 01, 2003 by Lester Hightower 5170# Based on the DWG File Format Specifications at http://www.opendwg.org/ 5171# AutoCad, from Nahuel Greco 5172# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com) 51730 string AC1012 DWG AutoDesk AutoCAD Release 13 5174!:mime image/vnd.dwg 51750 string AC1014 DWG AutoDesk AutoCAD Release 14 5176!:mime image/vnd.dwg 51770 string AC1015 DWG AutoDesk AutoCAD 2000/2002 5178!:mime image/vnd.dwg 5179 5180# A new version of AutoCAD DWG 5181# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, 5182# ICQ 358572321) 5183# From various sources like: 5184# http://autodesk.blogs.com/between_the_lines/autocad-release-history.html 51850 string AC1018 DWG AutoDesk AutoCAD 2004/2005/2006 5186!:mime image/vnd.dwg 51870 string AC1021 DWG AutoDesk AutoCAD 2007/2008/2009 5188!:mime image/vnd.dwg 51890 string AC1024 DWG AutoDesk AutoCAD 2010/2011/2012 5190!:mime image/vnd.dwg 51910 string AC1027 DWG AutoDesk AutoCAD 2013/2014 5192!:mime image/vnd.dwg 5193 5194# KOMPAS 2D drawing from ASCON 5195# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor 5196# gathered nor specification 5197# ASCON http://ascon.net/main/ in English, 5198# http://ascon.ru/ main site in Russian 5199# Extension is CDW for drawing and FRW for fragment of drawing 5200# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, 5201# ICQ 358572321, http://vkontakte.ru/id16076543) 5202# From: 5203# http://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292 5204# (in russian) and my experiments 52050 string KF 5206>2 belong 0x4E00000C Kompas drawing 12.0 SP1 5207>2 belong 0x4D00000C Kompas drawing 12.0 5208>2 belong 0x3200000B Kompas drawing 11.0 SP1 5209>2 belong 0x3100000B Kompas drawing 11.0 5210>2 belong 0x2310000A Kompas drawing 10.0 SP1 5211>2 belong 0x2110000A Kompas drawing 10.0 5212>2 belong 0x08000009 Kompas drawing 9.0 SP1 5213>2 belong 0x05000009 Kompas drawing 9.0 5214>2 belong 0x33010008 Kompas drawing 8+ 5215>2 belong 0x1A000008 Kompas drawing 8.0 5216>2 belong 0x2C010107 Kompas drawing 7+ 5217>2 belong 0x05000007 Kompas drawing 7.0 5218>2 belong 0x32000006 Kompas drawing 6+ 5219>2 belong 0x09000006 Kompas drawing 6.0 5220>2 belong 0x5C009005 Kompas drawing 5.11R03 5221>2 belong 0x54009005 Kompas drawing 5.11R02 5222>2 belong 0x51009005 Kompas drawing 5.11R01 5223>2 belong 0x22009005 Kompas drawing 5.10R03 5224>2 belong 0x22009005 Kompas drawing 5.10R02 mar 5225>2 belong 0x21009005 Kompas drawing 5.10R02 febr 5226>2 belong 0x19009005 Kompas drawing 5.10R01 5227>2 belong 0xF4008005 Kompas drawing 5.9R01.003 5228>2 belong 0x1C008005 Kompas drawing 5.9R01.002 5229>2 belong 0x11008005 Kompas drawing 5.8R01.003 5230 5231# CAD: file(1) magic for computer aided design files 5232# Phillip Griffith <phillip dot griffith at gmail dot com> 5233# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications. 5234# 52350 belong 0x08051700 Bentley/Intergraph MicroStation DGN cell library 52360 belong 0x0809fe02 Bentley/Intergraph MicroStation DGN vector CAD 52370 belong 0xc809fe02 Bentley/Intergraph MicroStation DGN vector CAD 52380 beshort 0x0809 Bentley/Intergraph MicroStation 5239>0x02 byte 0xfe 5240>>0x04 beshort 0x1800 CIT raster CAD 5241 5242# 3DS (3d Studio files) 52430 leshort 0x4d4d 5244>6 leshort 0x2 5245>>8 lelong 0xa 5246>>>16 leshort 0x3d3d 3D Studio model 5247!:mime image/x-3ds 5248!:ext 3ds 5249 5250# MegaCAD 2D/3D drawing (.prt) 5251# http://megacad.de/ 5252# From: Markus Heidelberg <markus.heidelberg@web.de> 52530 string MegaCad23\0 MegaCAD 2D/3D drawing 5254 5255# Hoops CAD files 5256# https://docs.techsoft3d.com/visualize/3df/latest/build/general/hsf/\ 5257# HSF_architecture.html 5258# Stephane Charette <stephane.charette@gmail.com> 52590 string ;;\020HSF\020V OpenHSF (Hoops Stream Format) 5260>7 regex/9 V[.0-9]{4,5}\020 %s 5261!:ext hsf 5262 5263#------------------------------------------------------------------------------ 5264# $File: cafebabe,v 1.23 2017/05/25 20:07:23 christos Exp $ 5265# Cafe Babes unite! 5266# 5267# Since Java bytecode and Mach-O universal binaries have the same magic number, 5268# the test must be performed in the same "magic" sequence to get both right. 5269# The long at offset 4 in a Mach-O universal binary tells the number of 5270# architectures; the short at offset 4 in a Java bytecode file is the JVM minor 5271# version and the short at offset 6 is the JVM major version. Since there are only 5272# only 18 labeled Mach-O architectures at current, and the first released 5273# Java class format was version 43.0, we can safely choose any number 5274# between 18 and 39 to test the number of architectures against 5275# (and use as a hack). Let's not use 18, because the Mach-O people 5276# might add another one or two as time goes by... 5277# 5278### JAVA START ### 52790 belong 0xcafebabe 5280>4 belong >30 compiled Java class data, 5281!:mime application/x-java-applet 5282>>6 beshort x version %d. 5283>>4 beshort x \b%d 5284# Which is which? 5285#>>4 belong 0x032d (Java 1.0) 5286#>>4 belong 0x032d (Java 1.1) 5287>>4 belong 0x002e (Java 1.2) 5288>>4 belong 0x002f (Java 1.3) 5289>>4 belong 0x0030 (Java 1.4) 5290>>4 belong 0x0031 (Java 1.5) 5291>>4 belong 0x0032 (Java 1.6) 5292>>4 belong 0x0033 (Java 1.7) 5293>>4 belong 0x0034 (Java 1.8) 5294 52950 belong 0xcafed00d JAR compressed with pack200, 5296>5 byte x version %d. 5297>4 byte x \b%d 5298!:mime application/x-java-pack200 5299 5300 53010 belong 0xcafed00d JAR compressed with pack200, 5302>5 byte x version %d. 5303>4 byte x \b%d 5304!:mime application/x-java-pack200 5305 5306### JAVA END ### 5307### MACH-O START ### 5308 53090 name mach-o \b [ 5310>0 use mach-o-cpu \b 5311>(8.L) indirect x \b: 5312>0 belong x \b] 5313 53140 belong 0xcafebabe 5315>4 belong 1 Mach-O universal binary with 1 architecture: 5316!:mime application/x-mach-binary 5317>>8 use mach-o \b 5318>4 belong >1 5319>>4 belong <20 Mach-O universal binary with %d architectures: 5320!:mime application/x-mach-binary 5321>>>8 use mach-o \b 5322>>4 belong 2 5323>>>28 use mach-o \b 5324>>4 belong 3 5325>>>48 use mach-o \b 5326>>4 belong 4 5327>>>68 use mach-o \b 5328>>4 belong 5 5329>>>88 use mach-o \b 5330>>4 belong 6 5331>>>108 use mach-o \b 5332 5333### MACH-O END ### 5334 5335#------------------------------------------------------------------------------ 5336# $File: cbor,v 1.1 2015/01/28 01:05:21 christos Exp $ 5337# cbor: file(1) magic for CBOR files as defined in RFC 7049 5338 53390 string \xd9\xd9\xf7 Concise Binary Object Representation (CBOR) container 5340!:mime application/cbor 5341>3 ubyte <0x20 (positive integer) 5342>3 ubyte <0x40 5343>>3 ubyte >0x1f (negative integer) 5344>3 ubyte <0x60 5345>>3 ubyte >0x3f (byte string) 5346>3 ubyte <0x80 5347>>3 ubyte >0x5f (text string) 5348>3 ubyte <0xa0 5349>3 ubyte >0x7f (array) 5350>3 ubyte <0xc0 5351>>3 ubyte >0x9f (map) 5352>3 ubyte <0xe0 5353>>3 ubyte >0xbf (tagged) 5354>3 ubyte >0xdf (other) 5355 5356#------------------------------------------------------------------------------ 5357# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $ 5358# CDDB: file(1) magic for CDDB(tm) format CD text data files 5359# 5360# From <steve@gracenote.com> 5361# 5362# This is the /etc/magic entry to decode datafiles as used by 5363# CDDB-enabled CD player applications. 5364# 5365 53660 search/1/w #\040xmcd CDDB(tm) format CD text data 5367 5368#------------------------------------------------------------------------------ 5369# $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $ 5370# chord: file(1) magic for Chord music sheet typesetting utility input files 5371# 5372# From Philippe De Muyter <phdm@macqel.be> 5373# File format is actually free, but many distributed files begin with `{title' 5374# 53750 string {title Chord text file 5376 5377# Type: PowerTab file format 5378# URL: http://www.power-tab.net/ 5379# From: Jelmer Vernooij <jelmer@samba.org> 53800 string ptab\003\000 Power-Tab v3 Tablature File 53810 string ptab\004\000 Power-Tab v4 Tablature File 5382 5383#------------------------------------------------------------------------------ 5384# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $ 5385# cisco: file(1) magic for cisco Systems routers 5386# 5387# Most cisco file-formats are covered by the generic elf code 5388# 5389# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha. 53900 belong&0xffffff00 0x85011400 cisco IOS microcode 5391>7 string >\0 for '%s' 53920 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode 5393>7 string >\0 for '%s' 5394 5395#------------------------------------------------------------------------------ 5396# $File: citrus,v 1.4 2009/09/19 16:28:08 christos Exp $ 5397# citrus locale declaration 5398# 5399 54000 string RuneCT Citrus locale declaration for LC_CTYPE 5401 5402#------------------------------------------------------------------------------ 5403# $File: c-lang,v 1.26 2017/08/14 07:40:38 christos Exp $ 5404# c-lang: file(1) magic for C and related languages programs 5405# 5406# The strength is to beat standard HTML 5407 5408# BCPL 54090 search/8192 "libhdr" BCPL source text 5410!:mime text/x-bcpl 54110 search/8192 "LIBHDR" BCPL source text 5412!:mime text/x-bcpl 5413 5414# C 5415# Check for class if include is found, otherwise class is beaten by include becouse of lowered strength 54160 regex \^#include C 5417>0 regex/4096 \^class[[:space:]]+ 5418>>&0 regex \\{[\.\*]\\}(;)?$ \b++ 5419>&0 clear x source text 5420!:strength + 13 5421!:mime text/x-c 54220 regex/4096 \^#[[:space:]]*pragma C source text 5423!:mime text/x-c 54240 regex/4096 \^#[[:space:]]*(if\|ifn)def 5425>&0 regex/4096 \^#[[:space:]]*endif$ C source text 5426!:mime text/x-c 54270 regex/4096 \^#[[:space:]]*(if\|ifn)def 5428>&0 regex/4096 \^#[[:space:]]*define C source text 5429!:mime text/x-c 54300 regex/4096 \^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text 5431!:mime text/x-c 54320 regex/4096 \^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text 5433!:mime text/x-c 54340 regex/4096 \^[[:space:]]*extern[[:space:]]+ C source text 5435!:mime text/x-c 54360 regex/4096 \^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text 5437!:mime text/x-c 54380 regex/4096 \^struct[[:space:]]+ C source text 5439!:mime text/x-c 54400 regex/4096 \^union[[:space:]]+ C source text 5441!:mime text/x-c 54420 search/8192 main( 5443>&0 regex/4096 \\)[[:space:]]*\\{ C source text 5444!:mime text/x-c 5445 5446# C++ 5447# The strength of these rules is increased so they beat the C rules above 54480 regex/4096 \^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{ C++ source text 5449!:strength + 30 5450!:mime text/x-c++ 5451# using namespace [namespace] or using std::[lib] 54520 regex/4096 \^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*; C++ source text 5453!:strength + 30 5454!:mime text/x-c++ 54550 regex/4096 \^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$ C++ source text 5456!:strength + 30 5457!:mime text/x-c++ 54580 regex/4096 \^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$ C++ source text 5459!:strength + 30 5460!:mime text/x-c++ 5461# But class alone is reduced to avoid beating php (Jens Schleusener) 54620 regex/4096 \^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$ C++ source text 5463!:strength + 13 5464!:mime text/x-c++ 54650 regex/4096 \^[[:space:]]*public: C++ source text 5466!:strength + 30 5467!:mime text/x-c++ 54680 regex/4096 \^[[:space:]]*private: C++ source text 5469!:strength + 30 5470!:mime text/x-c++ 54710 regex/4096 \^[[:space:]]*protected: C++ source text 5472!:strength + 30 5473!:mime text/x-c++ 5474 5475# Objective-C 54760 regex \^#import Objective-C source text 5477!:strength + 25 5478!:mime text/x-objective-c 5479 5480# From: Mikhail Teterin <mi@aldan.algebra.com> 54810 string cscope cscope reference data 5482>7 string x version %.2s 5483# We skip the path here, because it is often long (so file will 5484# truncate it) and mostly redundant. 5485# The inverted index functionality was added some time between 5486# versions 11 and 15, so look for -q if version is above 14: 5487>7 string >14 5488>>10 search/100 \ -q\ with inverted index 5489>10 search/100 \ -c\ text (non-compressed) 5490 5491#------------------------------------------------------------------------------ 5492# $File: clarion,v 1.5 2014/04/30 21:41:02 christos Exp $ 5493# clarion: file(1) magic for # Clarion Personal/Professional Developer 5494# (v2 and above) 5495# From: Julien Blache <jb@jblache.org> 5496 5497# Database files 5498# signature 54990 leshort 0x3343 Clarion Developer (v2 and above) data file 5500# attributes 5501>2 leshort &0x0001 \b, locked 5502>2 leshort &0x0004 \b, encrypted 5503>2 leshort &0x0008 \b, memo file exists 5504>2 leshort &0x0010 \b, compressed 5505>2 leshort &0x0040 \b, read only 5506# number of records 5507>5 lelong x \b, %d records 5508 5509# Memo files 55100 leshort 0x334d Clarion Developer (v2 and above) memo data 5511 5512# Key/Index files 5513# No magic? :( 5514 5515# Help files 55160 leshort 0x49e0 Clarion Developer (v2 and above) help data 5517 5518#------------------------------------------------------------------------------ 5519# $File: claris,v 1.8 2016/07/18 19:23:38 christos Exp $ 5520# claris: file(1) magic for claris 5521# "H. Nanosecond" <aldomel@ix.netcom.com> 5522# Claris Works a word processor, etc. 5523# Version 3.0 5524 5525# .pct claris works clip art files 5526#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 5527#* 5528#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000 5529#null to byte 1000 octal 5530514 string \377\377\377\377\000 5531>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art 5532514 string \377\377\377\377\001 5533>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art 5534 5535# Claris works files 5536# .cwk 5537# Moved to Apple AppleWorks document 5538#0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document 5539# .plt 55400 string \020\341\000\000\010\010 Claris Works palette files .plt 5541 5542# .msp a dictionary file I am not sure about this I have only one .msp file 55430 string \002\271\262\000\040\002\000\164 Claris works dictionary 5544 5545# .usp are user dictionary bits 5546# I am not sure about a magic header: 5547#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151 5548# soh S p f 8 U D sp ^ S cr nl p o d i 5549#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043 5550# a t r i s t sp ^ S cr nl d i v sp # 5551 5552# .mth Thesaurus 5553# starts with \0 but no magic header 5554 5555# .chy Hyphenation file 5556# I am not sure: 000 210 034 000 000 5557 5558# other claris files 5559#./windows/claris/useng.ndx: data 5560#./windows/claris/xtndtran.l32: data 5561#./windows/claris/xtndtran.lst: data 5562#./windows/claris/clworks.lbl: data 5563#./windows/claris/clworks.prf: data 5564#./windows/claris/userd.spl: data 5565 5566#------------------------------------------------------------------------------ 5567# $File: clipper,v 1.8 2017/03/17 21:35:28 christos Exp $ 5568# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper. 5569# 5570# XXX - what byte order does the Clipper use? 5571# 5572# XXX - what's the "!" stuff: 5573# 5574# >18 short !074000,000000 C1 R1 5575# >18 short !074000,004000 C2 R1 5576# >18 short !074000,010000 C3 R1 5577# >18 short !074000,074000 TEST 5578# 5579# I shall assume it's ANDing the field with the first value and 5580# comparing it with the second, and rewrite it as: 5581# 5582# >18 short&074000 000000 C1 R1 5583# >18 short&074000 004000 C2 R1 5584# >18 short&074000 010000 C3 R1 5585# >18 short&074000 074000 TEST 5586# 5587# as SVR3.1's "file" doesn't support anything of the "!074000,000000" 5588# sort, nor does SunOS 4.x, so either it's something Intergraph added 5589# in CLIX, or something AT&T added in SVR3.2 or later, or something 5590# somebody else thought was a good idea; it's not documented in the 5591# man page for this version of "magic", nor does it appear to be 5592# implemented (at least not after I blew off the bogus code to turn 5593# old-style "&"s into new-style "&"s, which just didn't work at all). 5594# 55950 short 0575 CLIPPER COFF executable (VAX #) 5596>20 short 0407 (impure) 5597>20 short 0410 (5.2 compatible) 5598>20 short 0411 (pure) 5599>20 short 0413 (demand paged) 5600>20 short 0443 (target shared library) 5601>12 long >0 not stripped 5602>22 short >0 - version %d 56030 short 0577 CLIPPER COFF executable 5604>18 short&074000 000000 C1 R1 5605>18 short&074000 004000 C2 R1 5606>18 short&074000 010000 C3 R1 5607>18 short&074000 074000 TEST 5608>20 short 0407 (impure) 5609>20 short 0410 (pure) 5610>20 short 0411 (separate I&D) 5611>20 short 0413 (paged) 5612>20 short 0443 (target shared library) 5613>12 long >0 not stripped 5614>22 short >0 - version %d 5615>48 long&01 01 alignment trap enabled 5616>52 byte 1 -Ctnc 5617>52 byte 2 -Ctsw 5618>52 byte 3 -Ctpw 5619>52 byte 4 -Ctcb 5620>53 byte 1 -Cdnc 5621>53 byte 2 -Cdsw 5622>53 byte 3 -Cdpw 5623>53 byte 4 -Cdcb 5624>54 byte 1 -Csnc 5625>54 byte 2 -Cssw 5626>54 byte 3 -Cspw 5627>54 byte 4 -Cscb 56284 string pipe CLIPPER instruction trace 56294 string prof CLIPPER instruction profile 5630 5631#------------------------------------------------------------------------------ 5632# $File: coff,v 1.2 2017/03/17 21:35:28 christos Exp $ 5633# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures 5634# 5635# COFF 5636# 5637# by Joerg Jenderek at Oct 2015 5638# https://en.wikipedia.org/wiki/COFF 5639# https://de.wikipedia.org/wiki/Common_Object_File_Format 5640# http://www.delorie.com/djgpp/doc/coff/filhdr.html 5641 5642# display name+variables+flags of Common Object Files Format (32bit) 5643# Maybe used also in adi,att3b,clipper,hitachi-sh,hp,ibm6000,intel, 5644# mips,motorola,msdos,osf1,sharc,varied.out,vax 56450 name display-coff 5646# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags 5647>18 uleshort&0x8E80 0 5648>>0 clear x 5649# f_magic - magic number 5650# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel) 5651>>0 uleshort 0x014C Intel 80386 5652# Hitachi SH big-endian COFF (./hitachi-sh) 5653>>0 uleshort 0x0500 Hitachi SH big-endian 5654# Hitachi SH little-endian COFF (./hitachi-sh) 5655>>0 uleshort 0x0550 Hitachi SH little-endian 5656# executable (RISC System/6000 V3.1) or obj module (./ibm6000) 5657#>>0 uleshort 0x01DF 5658# TODO for other COFFs 5659#>>0 uleshort 0xABCD COFF_TEMPLATE 5660>>0 default x 5661>>>0 uleshort x type 0x%04x 5662>>0 uleshort x COFF 5663# F_EXEC flag bit 5664>>18 leshort ^0x0002 object file 5665#!:mime application/x-coff 5666#!:ext cof/o/obj/lib 5667>>18 leshort &0x0002 executable 5668#!:mime application/x-coffexec 5669# F_RELFLG flag bit,static object 5670>>18 leshort &0x0001 \b, no relocation info 5671# F_LNNO flag bit 5672>>18 leshort &0x0004 \b, no line number info 5673# F_LSYMS flag bit 5674>>18 leshort &0x0008 \b, stripped 5675>>18 leshort ^0x0008 \b, not stripped 5676# flags in other COFF versions 5677#0x0010 F_FDPR_PROF 5678#0x0020 F_FDPR_OPTI 5679#0x0040 F_DSA 5680# F_AR32WR flag bit 5681#>>>18 leshort &0x0100 \b, 32 bit little endian 5682#0x1000 F_DYNLOAD 5683#0x2000 F_SHROBJ 5684#0x4000 F_LOADONLY 5685# f_nscns - number of sections 5686>>2 uleshort <2 \b, %d section 5687>>2 uleshort >1 \b, %d sections 5688# f_timdat - file time & date stamp only for little endian 5689#>>4 date x \b, %s 5690# f_symptr - symbol table pointer, only for not stripped 5691>>8 ulelong >0 \b, symbol offset=0x%x 5692# f_nsyms - number of symbols, only for not stripped 5693>>12 ulelong >0 \b, %d symbols 5694# f_opthdr - optional header size 5695>>16 uleshort >0 \b, optional header size %d 5696# at offset 20 can be optional header, extra bytes FILHSZ-20 because 5697# do not rely on sizeof(FILHDR) to give the correct size for header. 5698# or first section header 5699# additional variables for other COFF files 5700# >20 beshort 0407 (impure) 5701# >20 beshort 0410 (pure) 5702# >20 beshort 0413 (demand paged) 5703# >20 beshort 0421 (standalone) 5704# >22 leshort >0 - version %d 5705# >168 string .lowmem Apple toolbox 5706 5707 5708#------------------------------------------------------------------------------ 5709# $File: commands,v 1.59 2017/08/14 07:40:38 christos Exp $ 5710# commands: file(1) magic for various shells and interpreters 5711# 5712#0 string/w : shell archive or script for antique kernel text 57130 string/wt #!\ /bin/sh POSIX shell script text executable 5714!:mime text/x-shellscript 57150 string/wb #!\ /bin/sh POSIX shell script executable (binary data) 5716!:mime text/x-shellscript 5717 57180 string/wt #!\ /bin/csh C shell script text executable 5719!:mime text/x-shellscript 5720 5721# korn shell magic, sent by George Wu, gwu@clyde.att.com 57220 string/wt #!\ /bin/ksh Korn shell script text executable 5723!:mime text/x-shellscript 57240 string/wb #!\ /bin/ksh Korn shell script executable (binary data) 5725!:mime text/x-shellscript 5726 57270 string/wt #!\ /bin/tcsh Tenex C shell script text executable 5728!:mime text/x-shellscript 57290 string/wt #!\ /usr/bin/tcsh Tenex C shell script text executable 5730!:mime text/x-shellscript 57310 string/wt #!\ /usr/local/tcsh Tenex C shell script text executable 5732!:mime text/x-shellscript 57330 string/wt #!\ /usr/local/bin/tcsh Tenex C shell script text executable 5734!:mime text/x-shellscript 5735 5736# 5737# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson) 57380 string/wt #!\ /bin/zsh Paul Falstad's zsh script text executable 5739!:mime text/x-shellscript 57400 string/wt #!\ /usr/bin/zsh Paul Falstad's zsh script text executable 5741!:mime text/x-shellscript 57420 string/wt #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable 5743!:mime text/x-shellscript 57440 string/wt #!\ /usr/local/bin/ash Neil Brown's ash script text executable 5745!:mime text/x-shellscript 57460 string/wt #!\ /usr/local/bin/ae Neil Brown's ae script text executable 5747!:mime text/x-shellscript 57480 string/wt #!\ /bin/nawk new awk script text executable 5749!:mime text/x-nawk 57500 string/wt #!\ /usr/bin/nawk new awk script text executable 5751!:mime text/x-nawk 57520 string/wt #!\ /usr/local/bin/nawk new awk script text executable 5753!:mime text/x-nawk 57540 string/wt #!\ /bin/gawk GNU awk script text executable 5755!:mime text/x-gawk 57560 string/wt #!\ /usr/bin/gawk GNU awk script text executable 5757!:mime text/x-gawk 57580 string/wt #!\ /usr/local/bin/gawk GNU awk script text executable 5759!:mime text/x-gawk 5760# 57610 string/wt #!\ /bin/awk awk script text executable 5762!:mime text/x-awk 57630 string/wt #!\ /usr/bin/awk awk script text executable 5764!:mime text/x-awk 57650 regex/4096 =^[\040\t\f\r\n]{0,100}BEGIN[\040\t\f\r\n]{0,100}[{] awk or perl script text 5766 5767# AT&T Bell Labs' Plan 9 shell 57680 string/wt #!\ /bin/rc Plan 9 rc shell script text executable 5769 5770# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) 57710 string/wt #!\ /bin/bash Bourne-Again shell script text executable 5772!:mime text/x-shellscript 57730 string/wb #!\ /bin/bash Bourne-Again shell script executable (binary data) 5774!:mime text/x-shellscript 57750 string/wt #!\ /usr/bin/bash Bourne-Again shell script text executable 5776!:mime text/x-shellscript 57770 string/wb #!\ /usr/bin/bash Bourne-Again shell script executable (binary data) 5778!:mime text/x-shellscript 57790 string/wt #!\ /usr/local/bash Bourne-Again shell script text executable 5780!:mime text/x-shellscript 57810 string/wb #!\ /usr/local/bash Bourne-Again shell script executable (binary data) 5782!:mime text/x-shellscript 57830 string/wt #!\ /usr/local/bin/bash Bourne-Again shell script text executable 5784!:mime text/x-shellscript 57850 string/wb #!\ /usr/local/bin/bash Bourne-Again shell script executable (binary data) 5786!:mime text/x-shellscript 57870 string/wt #!\ /usr/bin/env\ bash Bourne-Again shell script text executable 5788!:mime text/x-shellscript 5789 5790# PHP scripts 5791# Ulf Harnhammar <ulfh@update.uu.se> 57920 search/1/c =<?php PHP script text 5793!:strength + 30 5794!:mime text/x-php 57950 search/1 =<?\n PHP script text 5796!:mime text/x-php 57970 search/1 =<?\r PHP script text 5798!:mime text/x-php 57990 search/1/w #!\ /usr/local/bin/php PHP script text executable 5800!:strength + 10 5801!:mime text/x-php 58020 search/1/w #!\ /usr/bin/php PHP script text executable 5803!:strength + 10 5804!:mime text/x-php 5805# Smarty compiled template, http://www.smarty.net/ 5806# Elan Ruusamae <glen@delfi.ee> 58070 string =<?php 5808>5 regex [\ \n] 5809>>6 string /*\ Smarty\ version Smarty compiled template 5810>>>24 regex [0-9.]+ \b, version %s 5811!:mime text/x-php 5812 58130 string Zend\x00 PHP script Zend Optimizer data 5814 58150 string/t $! DCL command file 5816 5817# Type: Pdmenu 5818# URL: http://packages.debian.org/pdmenu 5819# From: Edward Betts <edward@debian.org> 58200 string #!/usr/bin/pdmenu Pdmenu configuration file text 5821 5822# From Danny Weldon 58230 string \x0b\x13\x08\x00 5824>0x04 uleshort <4 ksh byte-code version %d 5825 5826#---------------------------------------------------------------------------- 5827# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $ 5828# communication 5829 5830# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3. 5831# It is used for conformance testing of communication protocols. 5832# Added by W. Borgert <debacle@debian.org>. 58330 string $Suite TTCN Abstract Test Suite 5834>&1 string $SuiteId 5835>>&1 string >\n %s 5836>&2 string $SuiteId 5837>>&1 string >\n %s 5838>&3 string $SuiteId 5839>>&1 string >\n %s 5840 5841# MSC (message sequence charts) are a formal description technique, 5842# described in ITU-T Z.120, mainly used for communication protocols. 5843# Added by W. Borgert <debacle@debian.org>. 58440 string mscdocument Message Sequence Chart (document) 58450 string msc Message Sequence Chart (chart) 58460 string submsc Message Sequence Chart (subchart) 5847#------------------------------------------------------------------------------ 5848# $File: compress,v 1.72 2018/03/27 23:26:41 christos Exp $ 5849# compress: file(1) magic for pure-compression formats (no archives) 5850# 5851# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc. 5852# 5853# Formats for various forms of compressed data 5854# Formats for "compress" proper have been moved into "compress.c", 5855# because it tries to uncompress it to figure out what's inside. 5856 5857# standard unix compress 58580 string \037\235 compress'd data 5859!:mime application/x-compress 5860!:apple LZIVZIVU 5861>2 byte&0x80 >0 block compressed 5862>2 byte&0x1f x %d bits 5863 5864# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver) 5865# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 5866# * Original filename is only at offset 10 if "extra field" absent 5867# * Produce shorter output - notably, only report compression methods 5868# other than 8 ("deflate", the only method defined in RFC 1952). 58690 string \037\213 gzip compressed data 5870!:mime application/x-gzip 5871!:strength * 2 5872>2 byte <8 \b, reserved method 5873>2 byte >8 \b, unknown method 5874>3 byte &0x01 \b, ASCII 5875>3 byte &0x02 \b, has CRC 5876>3 byte &0x04 \b, extra field 5877>3 byte&0xC =0x08 5878>>10 string x \b, was "%s" 5879>3 byte &0x10 \b, has comment 5880>3 byte &0x20 \b, encrypted 5881>4 ledate >0 \b, last modified: %s 5882>8 byte 2 \b, max compression 5883>8 byte 4 \b, max speed 5884>9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT) 5885>9 byte =0x01 \b, from Amiga 5886>9 byte =0x02 \b, from VMS 5887>9 byte =0x03 \b, from Unix 5888>9 byte =0x04 \b, from VM/CMS 5889>9 byte =0x05 \b, from Atari 5890>9 byte =0x06 \b, from HPFS filesystem (OS/2, NT) 5891>9 byte =0x07 \b, from MacOS 5892>9 byte =0x08 \b, from Z-System 5893>9 byte =0x09 \b, from CP/M 5894>9 byte =0x0A \b, from TOPS/20 5895>9 byte =0x0B \b, from NTFS filesystem (NT) 5896>9 byte =0x0C \b, from QDOS 5897>9 byte =0x0D \b, from Acorn RISCOS 5898>-4 lelong x \b, original size %d 5899 5900# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis 59010 string \037\036 packed data 5902!:mime application/octet-stream 5903>2 belong >1 \b, %d characters originally 5904>2 belong =1 \b, %d character originally 5905# 5906# This magic number is byte-order-independent. 59070 short 0x1f1f old packed data 5908!:mime application/octet-stream 5909 5910# XXX - why *two* entries for "compacted data", one of which is 5911# byte-order independent, and one of which is byte-order dependent? 5912# 59130 short 0x1fff compacted data 5914!:mime application/octet-stream 5915# This string is valid for SunOS (BE) and a matching "short" is listed 5916# in the Ultrix (LE) magic file. 59170 string \377\037 compacted data 5918!:mime application/octet-stream 59190 short 0145405 huf output 5920!:mime application/octet-stream 5921 5922# bzip2 59230 string BZh bzip2 compressed data 5924!:mime application/x-bzip2 5925>3 byte >47 \b, block size = %c00k 5926 5927# bzip a block-sorting file compressor 5928# by Julian Seward <sewardj@cs.man.ac.uk> and others 59290 string BZ0 bzip compressed data 5930!:mime application/x-bzip 5931>3 byte >47 \b, block size = %c00k 5932 5933# lzip 59340 string LZIP lzip compressed data 5935!:mime application/x-lzip 5936>4 byte x \b, version: %d 5937 5938# squeeze and crunch 5939# Michael Haardt <michael@cantor.informatik.rwth-aachen.de> 59400 beshort 0x76FF squeezed data, 5941>4 string x original name %s 59420 beshort 0x76FE crunched data, 5943>2 string x original name %s 59440 beshort 0x76FD LZH compressed data, 5945>2 string x original name %s 5946 5947# Freeze 59480 string \037\237 frozen file 2.1 59490 string \037\236 frozen file 1.0 (or gzip 0.5) 5950 5951# SCO compress -H (LZH) 59520 string \037\240 SCO compress -H (LZH) data 5953 5954# European GSM 06.10 is a provisional standard for full-rate speech 5955# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse 5956# excitation/long term prediction) coding at 13 kbit/s. 5957# 5958# There's only a magic nibble (4 bits); that nibble repeats every 33 5959# bytes. This isn't suited for use, but maybe we can use it someday. 5960# 5961# This will cause very short GSM files to be declared as data and 5962# mismatches to be declared as data too! 5963#0 byte&0xF0 0xd0 data 5964#>33 byte&0xF0 0xd0 5965#>66 byte&0xF0 0xd0 5966#>99 byte&0xF0 0xd0 5967#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio 5968 5969# lzop from <markus.oberhumer@jk.uni-linz.ac.at> 59700 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data 5971>9 beshort <0x0940 5972>>9 byte&0xf0 =0x00 - version 0. 5973>>9 beshort&0x0fff x \b%03x, 5974>>13 byte 1 LZO1X-1, 5975>>13 byte 2 LZO1X-1(15), 5976>>13 byte 3 LZO1X-999, 5977## >>22 bedate >0 last modified: %s, 5978>>14 byte =0x00 os: MS-DOS 5979>>14 byte =0x01 os: Amiga 5980>>14 byte =0x02 os: VMS 5981>>14 byte =0x03 os: Unix 5982>>14 byte =0x05 os: Atari 5983>>14 byte =0x06 os: OS/2 5984>>14 byte =0x07 os: MacOS 5985>>14 byte =0x0A os: Tops/20 5986>>14 byte =0x0B os: WinNT 5987>>14 byte =0x0E os: Win32 5988>9 beshort >0x0939 5989>>9 byte&0xf0 =0x00 - version 0. 5990>>9 byte&0xf0 =0x10 - version 1. 5991>>9 byte&0xf0 =0x20 - version 2. 5992>>9 beshort&0x0fff x \b%03x, 5993>>15 byte 1 LZO1X-1, 5994>>15 byte 2 LZO1X-1(15), 5995>>15 byte 3 LZO1X-999, 5996## >>25 bedate >0 last modified: %s, 5997>>17 byte =0x00 os: MS-DOS 5998>>17 byte =0x01 os: Amiga 5999>>17 byte =0x02 os: VMS 6000>>17 byte =0x03 os: Unix 6001>>17 byte =0x05 os: Atari 6002>>17 byte =0x06 os: OS/2 6003>>17 byte =0x07 os: MacOS 6004>>17 byte =0x0A os: Tops/20 6005>>17 byte =0x0B os: WinNT 6006>>17 byte =0x0E os: Win32 6007 6008# 4.3BSD-Quasijarus Strong Compression 6009# http://minnie.tuhs.org/Quasijarus/compress.html 60100 string \037\241 Quasijarus strong compressed data 6011 6012# From: Cory Dikkers <cdikkers@swbell.net> 60130 string XPKF Amiga xpkf.library compressed data 60140 string PP11 Power Packer 1.1 compressed data 60150 string PP20 Power Packer 2.0 compressed data, 6016>4 belong 0x09090909 fast compression 6017>4 belong 0x090A0A0A mediocre compression 6018>4 belong 0x090A0B0B good compression 6019>4 belong 0x090A0C0C very good compression 6020>4 belong 0x090A0C0D best compression 6021 6022# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at) 6023# http://www.7-zip.org or DOC/7zFormat.txt 6024# 60250 string 7z\274\257\047\034 7-zip archive data, 6026>6 byte x version %d 6027>7 byte x \b.%d 6028!:mime application/x-7z-compressed 6029!:ext 7z/cb7 6030 6031# Type: LZMA 60320 lelong&0xffffff =0x5d 6033>12 leshort 0xff LZMA compressed data, 6034!:mime application/x-lzma 6035>>5 lequad =0xffffffffffffffff streamed 6036>>5 lequad !0xffffffffffffffff non-streamed, size %lld 6037>12 leshort 0 LZMA compressed data, 6038>>5 lequad =0xffffffffffffffff streamed 6039>>5 lequad !0xffffffffffffffff non-streamed, size %lld 6040 6041# http://tukaani.org/xz/xz-file-format.txt 60420 ustring \xFD7zXZ\x00 XZ compressed data 6043!:strength * 2 6044!:mime application/x-xz 6045 6046# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt 60470 string LRZI LRZIP compressed data 6048>4 byte x - version %d 6049>5 byte x \b.%d 6050!:mime application/x-lrzip 6051 6052# http://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html 60530 lelong 0x184d2204 LZ4 compressed data (v1.4+) 6054!:mime application/x-lz4 6055# Added by osm0sis@xda-developers.com 60560 lelong 0x184c2103 LZ4 compressed data (v1.0-v1.3) 6057!:mime application/x-lz4 60580 lelong 0x184c2102 LZ4 compressed data (v0.1-v0.9) 6059!:mime application/x-lz4 6060 6061# Zstandard/LZ4 skippable frames 6062# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 60630 lelong&0xFFFFFFF0 0x184D2A50 6064>(4.l+8) indirect x 6065 6066# Zstandard Dictionary ID subroutine 60670 name zstd-dictionary-id 6068# Single Segment = True 6069>0 byte &0x20 \b, Dictionary ID: 6070>>0 byte&0x03 0 None 6071>>0 byte&0x03 1 6072>>>1 byte x %u 6073>>0 byte&0x03 2 6074>>>1 leshort x %u 6075>>0 byte&0x03 3 6076>>>1 lelong x %u 6077# Single Segment = False 6078>0 byte ^0x20 \b, Dictionary ID: 6079>>0 byte&0x03 0 None 6080>>0 byte&0x03 1 6081>>>2 byte x %u 6082>>0 byte&0x03 2 6083>>>2 leshort x %u 6084>>0 byte&0x03 3 6085>>>2 lelong x %u 6086 6087# Zstandard compressed data 6088# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 60890 lelong 0xFD2FB522 Zstandard compressed data (v0.2) 6090!:mime application/x-zstd 60910 lelong 0xFD2FB523 Zstandard compressed data (v0.3) 6092!:mime application/x-zstd 60930 lelong 0xFD2FB524 Zstandard compressed data (v0.4) 6094!:mime application/x-zstd 60950 lelong 0xFD2FB525 Zstandard compressed data (v0.5) 6096!:mime application/x-zstd 60970 lelong 0xFD2FB526 Zstandard compressed data (v0.6) 6098!:mime application/x-zstd 60990 lelong 0xFD2FB527 Zstandard compressed data (v0.7) 6100!:mime application/x-zstd 6101>4 use zstd-dictionary-id 61020 lelong 0xFD2FB528 Zstandard compressed data (v0.8+) 6103!:mime application/x-zstd 6104>4 use zstd-dictionary-id 6105 6106# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 61070 lelong 0xEC30A437 Zstandard dictionary 6108!:mime application/x-zstd-dictionary 6109>4 lelong x (ID %u) 6110 6111# AFX compressed files (Wolfram Kleff) 61122 string -afx- AFX compressed file data 6113 6114# Supplementary magic data for the file(1) command to support 6115# rzip(1). The format is described in magic(5). 6116# 6117# Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with 6118# this file. 6119# 61200 string RZIP rzip compressed data 6121>4 byte x - version %d 6122>5 byte x \b.%d 6123>6 belong x (%d bytes) 6124 61250 string ArC\x01 FreeArc archive <http://freearc.org> 6126 6127# Type: DACT compressed files 61280 long 0x444354C3 DACT compressed data 6129>4 byte >-1 (version %i. 6130>5 byte >-1 %i. 6131>6 byte >-1 %i) 6132>7 long >0 , original size: %i bytes 6133>15 long >30 , block size: %i bytes 6134 6135# Valve Pack (VPK) files 61360 lelong 0x55aa1234 Valve Pak file 6137>0x4 lelong x \b, version %u 6138>0x8 lelong x \b, %u entries 6139 6140# Snappy framing format 6141# http://code.google.com/p/snappy/source/browse/trunk/framing_format.txt 61420 string \377\006\0\0sNaPpY snappy framed data 6143!:mime application/x-snappy-framed 6144 6145# qpress, http://www.quicklz.com/ 61460 string qpress10 qpress compressed data 6147!:mime application/x-qpress 6148 6149# Zlib https://www.ietf.org/rfc/rfc6713.txt 61500 string/b x 6151>0 beshort%31 =0 6152>>0 byte&0xf =8 6153>>>0 byte&0x80 =0 zlib compressed data 6154!:mime application/zlib 6155 6156# BWC compression 61570 string BWC 6158>3 byte 0 BWC compressed data 6159 6160# UCL compression 61610 bequad 0x00e955434cff011a UCL compressed data 6162 6163# Softlib archive 61640 string SLIB Softlib archive 6165>4 leshort x \b, version %d 6166>6 leshort x (contains %d files) 6167 6168# URL: https://github.com/lzfse/lzfse/blob/master/src/lzfse_internal.h#L276 6169# From: Eric Hall <eric.hall@darkart.com> 61700 string bvx- lzfse encoded, no compression 61710 string bvx1 lzfse compressed, uncompressed tables 61720 string bvx2 lzfse compressed, compressed tables 61730 string bvxn lzfse encoded, lzvn compressed 6174 6175#------------------------------------------------------------------------------ 6176# $File: console,v 1.40 2018/06/23 16:40:40 christos Exp $ 6177# Console game magic 6178# Toby Deshane <hac@shoelace.digivill.net> 6179 6180# ines: file(1) magic for Marat's iNES Nintendo Entertainment System ROM dump format 6181# Updated by David Korth <gerbilsoft@gerbilsoft.com> 6182# References: 6183# - http://wiki.nesdev.com/w/index.php/INES 6184# - http://wiki.nesdev.com/w/index.php/NES_2.0 6185 6186# Common header for iNES, NES 2.0, and Wii U iNES. 61870 name nes-rom-image-ines 6188>7 byte&0x0C =0x8 (NES 2.0) 6189>4 byte x \b: %ux16k PRG 6190>5 byte x \b, %ux8k CHR 6191>6 byte&0x08 =0x8 [4-Scr] 6192>6 byte&0x09 =0x0 [H-mirror] 6193>6 byte&0x09 =0x1 [V-mirror] 6194>6 byte&0x02 =0x2 [SRAM] 6195>6 byte&0x04 =0x4 [Trainer] 6196>7 byte&0x03 =0x2 [PC10] 6197>7 byte&0x03 =0x1 [VS] 6198>>7 byte&0x0C =0x8 6199# NES 2.0: VS PPU 6200>>>13 byte&0x0F =0x0 \b, RP2C03B 6201>>>13 byte&0x0F =0x1 \b, RP2C03G 6202>>>13 byte&0x0F =0x2 \b, RP2C04-0001 6203>>>13 byte&0x0F =0x3 \b, RP2C04-0002 6204>>>13 byte&0x0F =0x4 \b, RP2C04-0003 6205>>>13 byte&0x0F =0x5 \b, RP2C04-0004 6206>>>13 byte&0x0F =0x6 \b, RP2C03B 6207>>>13 byte&0x0F =0x7 \b, RP2C03C 6208>>>13 byte&0x0F =0x8 \b, RP2C05-01 6209>>>13 byte&0x0F =0x9 \b, RP2C05-02 6210>>>13 byte&0x0F =0xA \b, RP2C05-03 6211>>>13 byte&0x0F =0xB \b, RP2C05-04 6212>>>13 byte&0x0F =0xC \b, RP2C05-05 6213# TODO: VS protection hardware? 6214>>7 byte x \b] 6215# NES 2.0-specific flags. 6216>7 byte&0x0C =0x8 6217>>12 byte&0x03 =0x0 [NTSC] 6218>>12 byte&0x03 =0x1 [PAL] 6219>>12 byte&0x02 =0x2 [NTSC+PAL] 6220 6221# Standard iNES ROM header. 62220 string NES\x1A NES ROM image (iNES) 6223!:mime application/x-nes-rom 6224>0 use nes-rom-image-ines 6225 6226# Wii U Virtual Console iNES ROM header. 62270 belong 0x4E455300 NES ROM image (Wii U Virtual Console) 6228!:mime application/x-nes-rom 6229>0 use nes-rom-image-ines 6230 6231#------------------------------------------------------------------------------ 6232# unif: file(1) magic for UNIF-format Nintendo Entertainment System ROM images 6233# Reference: http://wiki.nesdev.com/w/index.php/UNIF 6234# From: David Korth <gerbilsoft@gerbilsoft.com> 6235# 6236# NOTE: The UNIF format uses chunks instead of a fixed header, 6237# so most of the data isn't easily parseable. 6238# 62390 string UNIF 6240>4 lelong <16 NES ROM image (UNIF v%d format) 6241!:mime application/x-nes-rom 6242 6243#------------------------------------------------------------------------------ 6244# fds: file(1) magic for Famciom Disk System disk images 6245# Reference: http://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format 6246# From: David Korth <gerbilsoft@gerbilsoft.com> 6247# TODO: Check "Disk info block" and get info from that in addition to the optional header. 6248 6249# Disk info block. (block 1) 62500 name nintendo-fds-disk-info-block 6251>23 byte !1 FMC- 6252>23 byte 1 FSC- 6253>16 string x \b%.3s 6254>15 byte x \b, mfr %02X 6255>20 byte x (Rev.%02u) 6256 6257# Headered version. 62580 string FDS\x1A 6259>0x11 string *NINTENDO-HVC* Famicom Disk System disk image: 6260!:mime application/x-fds-disk 6261>>0x10 use nintendo-fds-disk-info-block 6262>4 byte 1 (%u side) 6263>4 byte !1 (%u sides) 6264 6265# Unheadered version. 62661 string *NINTENDO-HVC* Famicom Disk System disk image: 6267!:mime application/x-fds-disk 6268>0 use nintendo-fds-disk-info-block 6269 6270#------------------------------------------------------------------------------ 6271# tnes: file(1) magic for TNES-format Nintendo Entertainment System ROM images 6272# Used by Nintendo 3DS NES Virtual Console games. 6273# From: David Korth <gerbilsoft@gerbilsoft.com> 6274# 62750 string TNES NES ROM image (Nintendo 3DS Virtual Console) 6276!:mime application/x-nes-rom 6277>4 byte 100 \b: FDS, 6278>>0x2010 use nintendo-fds-disk-info-block 6279>4 byte !100 \b: TNES mapper %u 6280>>5 byte x \b, %ux8k PRG 6281>>6 byte x \b, %ux8k CHR 6282>>7 byte&0x08 =1 [WRAM] 6283>>8 byte&0x09 =1 [H-mirror] 6284>>8 byte&0x09 =2 [V-mirror] 6285>>8 byte&0x02 =3 [VRAM] 6286 6287#------------------------------------------------------------------------------ 6288# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format 6289# Reference: http://gbdev.gg8.se/wiki/articles/The_Cartridge_Header 6290# 62910x104 bequad 0xCEED6666CC0D000B Game Boy ROM image 6292# TODO: application/x-gameboy-color-rom for GBC. 6293!:mime application/x-gameboy-rom 6294>0x143 byte&0x80 0x80 6295>>0x134 string >\0 \b: "%.15s" 6296>0x143 byte&0x80 !0x80 6297>>0x134 string >\0 \b: "%.16s" 6298>0x14c byte x (Rev.%02u) 6299 6300# Machine type. (SGB, CGB, SGB+CGB) 6301>0x14b byte 0x33 6302>>0x146 byte 0x03 6303>>>0x143 byte&0x80 0x80 [SGB+CGB] 6304>>>0x143 byte&0x80 !0x80 [SGB] 6305>>0x146 byte !0x03 6306>>>0x143 byte&0xC0 0x80 [CGB] 6307>>>0x143 byte&0xC0 0xC0 [CGB ONLY] 6308>0x14b byte !0x33 6309 6310# Mapper. 6311>0x147 byte 0x00 [ROM ONLY] 6312>0x147 byte 0x01 [MBC1] 6313>0x147 byte 0x02 [MBC1+RAM] 6314>0x147 byte 0x03 [MBC1+RAM+BATT] 6315>0x147 byte 0x05 [MBC2] 6316>0x147 byte 0x06 [MBC2+BATTERY] 6317>0x147 byte 0x08 [ROM+RAM] 6318>0x147 byte 0x09 [ROM+RAM+BATTERY] 6319>0x147 byte 0x0B [MMM01] 6320>0x147 byte 0x0C [MMM01+SRAM] 6321>0x147 byte 0x0D [MMM01+SRAM+BATT] 6322>0x147 byte 0x0F [MBC3+TIMER+BATT] 6323>0x147 byte 0x10 [MBC3+TIMER+RAM+BATT] 6324>0x147 byte 0x11 [MBC3] 6325>0x147 byte 0x12 [MBC3+RAM] 6326>0x147 byte 0x13 [MBC3+RAM+BATT] 6327>0x147 byte 0x19 [MBC5] 6328>0x147 byte 0x1A [MBC5+RAM] 6329>0x147 byte 0x1B [MBC5+RAM+BATT] 6330>0x147 byte 0x1C [MBC5+RUMBLE] 6331>0x147 byte 0x1D [MBC5+RUMBLE+SRAM] 6332>0x147 byte 0x1E [MBC5+RUMBLE+SRAM+BATT] 6333>0x147 byte 0xFC [Pocket Camera] 6334>0x147 byte 0xFD [Bandai TAMA5] 6335>0x147 byte 0xFE [Hudson HuC-3] 6336>0x147 byte 0xFF [Hudson HuC-1] 6337 6338# ROM size. 6339>0x148 byte 0 \b, ROM: 256Kbit 6340>0x148 byte 1 \b, ROM: 512Kbit 6341>0x148 byte 2 \b, ROM: 1Mbit 6342>0x148 byte 3 \b, ROM: 2Mbit 6343>0x148 byte 4 \b, ROM: 4Mbit 6344>0x148 byte 5 \b, ROM: 8Mbit 6345>0x148 byte 6 \b, ROM: 16Mbit 6346>0x148 byte 7 \b, ROM: 32Mbit 6347>0x148 byte 0x52 \b, ROM: 9Mbit 6348>0x148 byte 0x53 \b, ROM: 10Mbit 6349>0x148 byte 0x54 \b, ROM: 12Mbit 6350 6351# RAM size. 6352>0x149 byte 1 \b, RAM: 16Kbit 6353>0x149 byte 2 \b, RAM: 64Kbit 6354>0x149 byte 3 \b, RAM: 128Kbit 6355>0x149 byte 4 \b, RAM: 1Mbit 6356>0x149 byte 5 \b, RAM: 512Kbit 6357 6358#------------------------------------------------------------------------------ 6359# genesis: file(1) magic for various Sega Mega Drive / Genesis ROM image and disc formats 6360# Updated by David Korth <gerbilsoft@gerbilsoft.com> 6361# References: 6362# - http://www.retrodev.com/segacd.html 6363# - http://devster.monkeeh.com/sega/32xguide1.txt 6364# 6365 6366# Common Sega Mega Drive header format. 6367# FIXME: Name fields are 48 bytes, but have spaces for padding instead of 00s. 63680 name sega-mega-drive-header 6369# ROM title. (Use domestic if present; if not, use international.) 6370>0x120 byte >0x20 6371>>0x120 string >\0 \b: "%.16s" 6372>0x120 byte <0x21 6373>>0x150 string >\0 \b: "%.16s" 6374# Other information. 6375>0x180 string >\0 (%.14s 6376>>0x110 string >\0 \b, %.16s 6377>0x180 byte 0 6378>>0x110 string >\0 (%.16s 6379>0 byte x \b) 6380 6381# TODO: Check for 32X CD? 6382# Sega Mega CD disc images: 2048-byte sectors. 63830 string SEGADISCSYSTEM\ \ Sega Mega CD disc image 6384!:mime application/x-sega-cd-rom 6385>0 use sega-mega-drive-header 6386>0 byte x \b, 2048-byte sectors 63870 string SEGABOOTDISC\ \ \ \ Sega Mega CD disc image 6388!:mime application/x-sega-cd-rom 6389>0 use sega-mega-drive-header 6390>0 byte x \b, 2048-byte sectors 6391# Sega Mega CD disc images: 2352-byte sectors. 63920x10 string SEGADISCSYSTEM\ \ Sega Mega CD disc image 6393!:mime application/x-sega-cd-rom 6394>0x10 use sega-mega-drive-header 6395>0 byte x \b, 2352-byte sectors 63960x10 string SEGABOOTDISC\ \ \ \ Sega Mega CD disc image 6397!:mime application/x-sega-cd-rom 6398>0x10 use sega-mega-drive-header 6399>0 byte x \b, 2352-byte sectors 6400 6401# Sega Mega Drive, 32X, Pico, and Mega CD Boot ROM images. 64020x100 string SEGA 6403>0x3C0 bequad 0x4D41525320434845 Sega 32X ROM image 6404!:mime application/x-genesis-32x-rom 6405>>0 use sega-mega-drive-header 6406>0x3C0 bequad !0x4D41525320434845 6407>>0x105 belong 0x5049434F Sega Pico ROM image 6408!:mime application/x-sega-pico-rom 6409>>>0 use sega-mega-drive-header 6410>>0x105 belong !0x5049434F 6411>>>0x180 beshort 0x4252 Sega Mega CD Boot ROM image 6412!:mime application/x-genesis-rom 6413>>>0x180 beshort !0x4252 Sega Mega Drive / Genesis ROM image 6414!:mime application/x-genesis-rom 6415>>>0 use sega-mega-drive-header 6416 6417#------------------------------------------------------------------------------ 6418# genesis: file(1) magic for the Super MegaDrive ROM dump format 6419# 6420 6421# NOTE: Due to interleaving, we can't display anything 6422# other than the copier header information. 64230 name sega-genesis-smd-header 6424>0 byte x %dx16k blocks 6425>2 byte 0 \b, last in series or standalone 6426>2 byte >0 \b, split ROM 6427 6428# "Sega Genesis" header. 64290x280 string EAGN 6430>8 beshort 0xAABB Sega Mega Drive / Genesis ROM image (SMD format): 6431!:mime application/x-genesis-rom 6432>>0 use sega-genesis-smd-header 6433 6434# "Sega Mega Drive" header. 64350x280 string EAMG 6436>8 beshort 0xAABB Sega Mega Drive / Genesis ROM image (SMD format): 6437!:mime application/x-genesis-rom 6438>>0 use sega-genesis-smd-header 6439 6440#------------------------------------------------------------------------------ 6441# smsgg: file(1) magic for Sega Master System and Game Gear ROM images 6442# Detects all Game Gear and export Sega Master System ROM images, 6443# and some Japanese Sega Master System ROM images. 6444# From: David Korth <gerbilsoft@gerbilsoft.com> 6445# Reference: http://www.smspower.org/Development/ROMHeader 6446# 6447 6448# General SMS header rule. 6449# The SMS boot ROM checks the header at three locations. 64500 name sega-master-system-rom-header 6451# Machine type. 6452>0x0F byte&0xF0 0x30 Sega Master System 6453!:mime application/x-sms-rom 6454>0x0F byte&0xF0 0x40 Sega Master System 6455!:mime application/x-sms-rom 6456>0x0F byte&0xF0 0x50 Sega Game Gear 6457!:mime application/x-gamegear-rom 6458>0x0F byte&0xF0 0x60 Sega Game Gear 6459!:mime application/x-gamegear-rom 6460>0x0F byte&0xF0 0x70 Sega Game Gear 6461!:mime application/x-gamegear-rom 6462>0x0F default x Sega Master System / Game Gear 6463!:mime application/x-sms-rom 6464>0 byte x ROM image: 6465# Product code. 6466>0x0E byte&0xF0 0x10 1 6467>0x0E byte&0xF0 0x20 2 6468>0x0E byte&0xF0 0x30 3 6469>0x0E byte&0xF0 0x40 4 6470>0x0E byte&0xF0 0x50 5 6471>0x0E byte&0xF0 0x60 6 6472>0x0E byte&0xF0 0x70 7 6473>0x0E byte&0xF0 0x80 8 6474>0x0E byte&0xF0 0x90 9 6475>0x0E byte&0xF0 0xA0 10 6476>0x0E byte&0xF0 0xB0 11 6477>0x0E byte&0xF0 0xC0 12 6478>0x0E byte&0xF0 0xD0 13 6479>0x0E byte&0xF0 0xE0 14 6480>0x0E byte&0xF0 0xF0 15 6481# If the product code is 5 digits, we'll need to backspace here. 6482>0x0E byte&0xF0 !0 6483>>0x0C leshort x \b%04x 6484>0x0E byte&0xF0 0 6485>>0x0C leshort x %04x 6486# Revision. 6487>0x0E byte&0x0F x (Rev.%02d) 6488# ROM size. (Used for the boot ROM checksum routine.) 6489>0x0F byte&0x0F 0x0A (8 KB) 6490>0x0F byte&0x0F 0x0B (16 KB) 6491>0x0F byte&0x0F 0x0C (32 KB) 6492>0x0F byte&0x0F 0x0D (48 KB) 6493>0x0F byte&0x0F 0x0E (64 KB) 6494>0x0F byte&0x0F 0x0F (128 KB) 6495>0x0F byte&0x0F 0x00 (256 KB) 6496>0x0F byte&0x0F 0x01 (512 KB) 6497>0x0F byte&0x0F 0x02 (1 MB) 6498 6499# SMS/GG header locations. 65000x7FF0 string TMR\ SEGA 6501>0x7FF0 use sega-master-system-rom-header 65020x3FF0 string TMR\ SEGA 6503>0x3FF0 use sega-master-system-rom-header 65040x1FF0 string TMR\ SEGA 6505>0x1FF0 use sega-master-system-rom-header 6506 6507#------------------------------------------------------------------------------ 6508# saturn: file(1) magic for the Sega Saturn disc image format. 6509# From: David Korth <gerbilsoft@gerbilsoft.com> 6510# 6511 6512# Common Sega Saturn disc header format. 6513# NOTE: Title is 112 bytes, but we're only showing 32 due to space padding. 6514# TODO: Release date, device information, region code, others? 65150 name sega-saturn-disc-header 6516>0x60 string >\0 \b: "%.32s" 6517>0x20 string >\0 (%.10s 6518>>0x2A string >\0 \b, %.6s) 6519>>0x2A byte 0 \b) 6520 6521# 2048-byte sector version. 65220 string SEGA\ SEGASATURN\ Sega Saturn disc image 6523!:mime application/x-saturn-rom 6524>0 use sega-saturn-disc-header 6525>0 byte x (2048-byte sectors) 6526# 2352-byte sector version. 65270x10 string SEGA\ SEGASATURN\ Sega Saturn disc image 6528!:mime application/x-saturn-rom 6529>0x10 use sega-saturn-disc-header 6530>0 byte x (2352-byte sectors) 6531 6532#------------------------------------------------------------------------------ 6533# dreamcast: file(1) magic for the Sega Dreamcast disc image format. 6534# From: David Korth <gerbilsoft@gerbilsoft.com> 6535# Reference: http://mc.pp.se/dc/ip0000.bin.html 6536# 6537 6538# Common Sega Dreamcast disc header format. 6539# NOTE: Title is 128 bytes, but we're only showing 32 due to space padding. 6540# TODO: Release date, device information, region code, others? 65410 name sega-dreamcast-disc-header 6542>0x80 string >\0 \b: "%.32s" 6543>0x40 string >\0 (%.10s 6544>>0x4A string >\0 \b, %.6s) 6545>>0x4A byte 0 \b) 6546 6547# 2048-byte sector version. 65480 string SEGA\ SEGAKATANA\ Sega Dreamcast disc image 6549!:mime application/x-dc-rom 6550>0 use sega-dreamcast-disc-header 6551>0 byte x (2048-byte sectors) 6552# 2352-byte sector version. 65530x10 string SEGA\ SEGAKATANA\ Sega Dreamcast disc image 6554!:mime application/x-dc-rom 6555>0x10 use sega-dreamcast-disc-header 6556>0 byte x (2352-byte sectors) 6557 6558#------------------------------------------------------------------------------ 6559# dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format 6560# 65610 belong 0x21068028 Sega Dreamcast VMU game image 65620 string LCDi Dream Animator file 6563 6564#------------------------------------------------------------------------------ 6565# z64: file(1) magic for the Z64 format N64 ROM dumps 6566# Reference: http://forum.pj64-emu.com/showthread.php?t=2239 6567# From: David Korth <gerbilsoft@gerbilsoft.com> 6568# 65690 bequad 0x803712400000000F Nintendo 64 ROM image 6570!:mime application/x-n64-rom 6571>0x20 string >\0 \b: "%.20s" 6572>0x3B string x (%.4s 6573>0x3F byte x \b, Rev.%02u) 6574 6575#------------------------------------------------------------------------------ 6576# v64: file(1) magic for the V64 format N64 ROM dumps 6577# Same as z64 format, but with 16-bit byteswapping. 6578# 65790 bequad 0x3780401200000F00 Nintendo 64 ROM image (V64) 6580!:mime application/x-n64-rom 6581 6582#------------------------------------------------------------------------------ 6583# n64-swap2: file(1) magic for the swap2 format N64 ROM dumps 6584# Same as z64 format, but with swapped 16-bit words. 6585# 65860 bequad 0x12408037000F0000 Nintendo 64 ROM image (wordswapped) 6587!:mime application/x-n64-rom 6588 6589#------------------------------------------------------------------------------ 6590# n64-le32: file(1) magic for the 32-bit byteswapped format N64 ROM dumps 6591# Same as z64 format, but with 32-bit byteswapping. 6592# 65930 bequad 0x401237800F000000 Nintendo 64 ROM image (32-bit byteswapped) 6594!:mime application/x-n64-rom 6595 6596#------------------------------------------------------------------------------ 6597# gba: file(1) magic for the Nintendo Game Boy Advance raw ROM format 6598# Reference: http://problemkaputt.de/gbatek.htm#gbacartridgeheader 6599# 6600# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com> 6601# Updated version from: David Korth <gerbilsoft@gerbilsoft.com> 6602# 66034 bequad 0x24FFAE51699AA221 Game Boy Advance ROM image 6604!:mime application/x-gba-rom 6605>0xA0 string >\0 \b: "%.12s" 6606>0xAC string x (%.6s 6607>0xBC byte x \b, Rev.%02u) 6608 6609#------------------------------------------------------------------------------ 6610# nds: file(1) magic for the Nintendo DS(i) raw ROM format 6611# Reference: http://problemkaputt.de/gbatek.htm#dscartridgeheader 6612# 6613# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com> 6614# Updated version from: David Korth <gerbilsoft@gerbilsoft.com> 6615# 66160xC0 bequad 0x24FFAE51699AA221 Nintendo DS ROM image 6617!:mime application/x-nintendo-ds-rom 6618>0x00 string >\0 \b: "%.12s" 6619>0x0C string x (%.6s 6620>0x1E byte x \b, Rev.%02u) 6621>0x12 byte 2 (DSi enhanced) 6622>0x12 byte 3 (DSi only) 6623# Secure Area check. 6624>0x20 lelong <0x4000 (homebrew) 6625>0x20 lelong >0x3FFF 6626>>0x4000 lequad 0x0000000000000000 (multiboot) 6627>>0x4000 lequad !0x0000000000000000 6628>>>0x4000 lequad 0xE7FFDEFFE7FFDEFF (decrypted) 6629>>>0x4000 lequad !0xE7FFDEFFE7FFDEFF 6630>>>>0x1000 lequad 0x0000000000000000 (encrypted) 6631>>>>0x1000 lequad !0x0000000000000000 (mask ROM) 6632 6633#------------------------------------------------------------------------------ 6634# nds_passme: file(1) magic for Nintendo DS ROM images for GBA cartridge boot. 6635# This is also used for loading .nds files using the MSET exploit on 3DS. 6636# Reference: https://github.com/devkitPro/ndstool/blob/master/source/ndscreate.cpp 66370xC0 bequad 0xC8604FE201708FE2 Nintendo DS Slot-2 ROM image (PassMe) 6638!:mime application/x-nintendo-ds-rom 6639 6640#------------------------------------------------------------------------------ 6641# ngp: file(1) magic for the Neo Geo Pocket (Color) raw ROM format. 6642# From: David Korth <gerbilsoft@gerbilsoft.com> 6643# References: 6644# - https://neogpc.googlecode.com/svn-history/r10/trunk/src/core/neogpc.cpp 6645# - http://www.devrs.com/ngp/files/ngpctech.txt 6646# 66470x0A string BY\ SNK\ CORPORATION Neo Geo Pocket 6648!:mime application/x-neo-geo-pocket-rom 6649>0x23 byte 0x10 Color 6650>0 byte x ROM image 6651>0x24 string >\0 \b: "%.12s" 6652>0x1F byte 0xFF (debug mode enabled) 6653 6654#------------------------------------------------------------------------------ 6655# msx: file(1) magic for MSX game cartridge dumps 6656# Too simple - MPi 6657#0 beshort 0x4142 MSX game cartridge dump 6658 6659#------------------------------------------------------------------------------ 6660# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) : 66610 string PS-X\ EXE Sony Playstation executable 6662>16 lelong x PC=0x%08x, 6663>20 lelong !0 GP=0x%08x, 6664>24 lelong !0 .text=[0x%08x, 6665>>28 lelong x \b0x%x], 6666>32 lelong !0 .data=[0x%08x, 6667>>36 lelong x \b0x%x], 6668>40 lelong !0 .bss=[0x%08x, 6669>>44 lelong x \b0x%x], 6670>48 lelong !0 Stack=0x%08x, 6671>48 lelong =0 No Stack!, 6672>52 lelong !0 StackSize=0x%x, 6673#>76 string >\0 (%s) 6674# Area: 6675>113 string x (%s) 6676 6677# CPE executables 66780 string CPE CPE executable 6679>3 byte x (version %d) 6680 6681#------------------------------------------------------------------------------ 6682# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>) 66830 string XBEH XBE, Microsoft Xbox executable 6684# probabilistic checks whether signed or not 6685>0x0004 ulelong =0x0 6686>>&2 ulelong =0x0 6687>>>&2 ulelong =0x0 \b, not signed 6688>0x0004 ulelong >0 6689>>&2 ulelong >0 6690>>>&2 ulelong >0 \b, signed 6691# expect base address of 0x10000 6692>0x0104 ulelong =0x10000 6693>>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions 6694>>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007 6695>>>(0x0118-0x0FF60) ulelong >0 (regions: 6696>>>>(0x0118-0x0FF60) ulelong &0x00000001 NA 6697>>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan 6698>>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World 6699>>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer 6700>>>(0x0118-0x0FF60) ulelong >0 \b) 6701 6702# -------------------------------- 6703# Microsoft Xbox data file formats 67040 string XIP0 XIP, Microsoft Xbox data 67050 string XTF0 XTF, Microsoft Xbox data 6706 6707# Atari Lynx cartridge dump (EXE/BLL header) 6708# From: "Stefan A. Haubenthal" <polluks@web.de> 6709 6710# Double-check that the image type matches too, 0x8008 conflicts with 6711# 8 character OMF-86 object file headers. 67120 beshort 0x8008 6713>6 string BS93 Lynx homebrew cartridge 6714!:mime application/x-atari-lynx-rom 6715>>2 beshort x \b, RAM start $%04x 6716>6 string LYNX Lynx cartridge 6717!:mime application/x-atari-lynx-rom 6718>>2 beshort x \b, RAM start $%04x 6719 6720# Opera file system that is used on the 3DO console 6721# From: Serge van den Boom <svdb@stack.nl> 67220 string \x01ZZZZZ\x01 3DO "Opera" file system 6723 6724# From: Alex Myczko <alex@aiei.ch> 6725# From: David Pflug <david@pflug.email> 6726# is the offset 12 or the offset 16 correct? 6727# GBS (Game Boy Sound) magic 6728# ftp://ftp.modland.com/pub/documents/format_documentation/\ 6729# Gameboy%20Sound%20System%20(.gbs).txt 67300 string GBS Nintendo Gameboy Music/Audio Data 6731#12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module 6732>16 string >\0 ("%.32s" by 6733>48 string >\0 %.32s, copyright 6734>80 string >\0 %.32s), 6735>3 byte x version %u, 6736>4 byte x %u tracks 6737 6738# IPS Patch Files from: From: Thomas Klausner <tk@giga.or.at> 6739# see http://zerosoft.zophar.net/ips.php 67400 string PATCH IPS patch file 6741 6742# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at> 67430 string PPF30 Playstation Patch File version 3.0 6744>5 byte 0 \b, PPF 1.0 patch 6745>5 byte 1 \b, PPF 2.0 patch 6746>5 byte 2 \b, PPF 3.0 patch 6747>>56 byte 0 \b, Imagetype BIN (any) 6748>>56 byte 1 \b, Imagetype GI (PrimoDVD) 6749>>57 byte 0 \b, Blockcheck disabled 6750>>57 byte 1 \b, Blockcheck enabled 6751>>58 byte 0 \b, Undo data not available 6752>>58 byte 1 \b, Undo data available 6753>6 string x \b, description: %s 6754 67550 string PPF20 Playstation Patch File version 2.0 6756>5 byte 0 \b, PPF 1.0 patch 6757>5 byte 1 \b, PPF 2.0 patch 6758>>56 lelong >0 \b, size of file to patch %d 6759>6 string x \b, description: %s 6760 67610 string PPF10 Playstation Patch File version 1.0 6762>5 byte 0 \b, Simple Encoding 6763>6 string x \b, description: %s 6764 6765# From: Daniel Dawson <ddawson@icehouse.net> 6766# SNES9x .smv "movie" file format. 67670 string SMV\x1A SNES9x input recording 6768>0x4 lelong x \b, version %d 6769# version 4 is latest so far 6770>0x4 lelong <5 6771>>0x8 ledate x \b, recorded at %s 6772>>0xc lelong >0 \b, rerecorded %d times 6773>>0x10 lelong x \b, %d frames long 6774>>0x14 byte >0 \b, data for controller(s): 6775>>>0x14 byte &0x1 #1 6776>>>0x14 byte &0x2 #2 6777>>>0x14 byte &0x4 #3 6778>>>0x14 byte &0x8 #4 6779>>>0x14 byte &0x10 #5 6780>>0x15 byte ^0x1 \b, begins from snapshot 6781>>0x15 byte &0x1 \b, begins from reset 6782>>0x15 byte ^0x2 \b, NTSC standard 6783>>0x15 byte &0x2 \b, PAL standard 6784>>0x17 byte &0x1 \b, settings: 6785# WIP1Timing not used as of version 4 6786>>>0x4 lelong <4 6787>>>>0x17 byte &0x2 WIP1Timing 6788>>>0x17 byte &0x4 Left+Right 6789>>>0x17 byte &0x8 VolumeEnvX 6790>>>0x17 byte &0x10 FakeMute 6791>>>0x17 byte &0x20 SyncSound 6792# New flag as of version 4 6793>>>0x4 lelong >3 6794>>>>0x17 byte &0x80 NoCPUShutdown 6795>>0x4 lelong <4 6796>>>0x18 lelong >0x23 6797>>>>0x20 leshort !0 6798>>>>>0x20 lestring16 x \b, metadata: "%s" 6799>>0x4 lelong >3 6800>>>0x24 byte >0 \b, port 1: 6801>>>>0x24 byte 1 joypad 6802>>>>0x24 byte 2 mouse 6803>>>>0x24 byte 3 SuperScope 6804>>>>0x24 byte 4 Justifier 6805>>>>0x24 byte 5 multitap 6806>>>0x24 byte >0 \b, port 2: 6807>>>>0x25 byte 1 joypad 6808>>>>0x25 byte 2 mouse 6809>>>>0x25 byte 3 SuperScope 6810>>>>0x25 byte 4 Justifier 6811>>>>0x25 byte 5 multitap 6812>>>0x18 lelong >0x43 6813>>>>0x40 leshort !0 6814>>>>>0x40 lestring16 x \b, metadata: "%s" 6815>>0x17 byte &0x40 \b, ROM: 6816>>>(0x18.l-26) lelong x CRC32 0x%08x 6817>>>(0x18.l-23) string x "%s" 6818 6819# Type: scummVM savegame files 6820# From: Sven Hartge <debian@ds9.argh.org> 68210 string SCVM ScummVM savegame 6822>12 string >\0 "%s" 6823 6824#------------------------------------------------------------------------------ 6825# Nintendo GameCube / Wii file formats. 6826# 6827 6828# Type: Nintendo GameCube/Wii common disc header data. 6829# From: David Korth <gerbilsoft@gerbilsoft.com> 6830# Reference: http://wiibrew.org/wiki/Wii_Disc 68310 name nintendo-gcn-disc-common 6832>0x20 string x "%.64s" 6833>0x00 string x (%.6s 6834>0x06 byte >0 6835>>0x06 byte 1 \b, Disc 2 6836>>0x06 byte 2 \b, Disc 3 6837>>0x06 byte 3 \b, Disc 4 6838>0x07 byte x \b, Rev.%02u) 6839>0x18 belong 0x5D1C9EA3 6840>>0x60 beshort 0x0101 \b (Unencrypted) 6841 6842# Type: Nintendo GameCube disc image 6843# From: David Korth <gerbilsoft@gerbilsoft.com> 6844# Reference: http://wiibrew.org/wiki/Wii_Disc 68450x1C belong 0xC2339F3D Nintendo GameCube disc image: 6846!:mime application/x-gamecube-rom 6847>0 use nintendo-gcn-disc-common 6848 6849# Type: Nintendo GameCube embedded disc image 6850# Commonly found on demo discs. 6851# From: David Korth <gerbilsoft@gerbilsoft.com> 6852# Reference: http://hitmen.c02.at/files/yagcd/yagcd/index.html#idx14.8 68530 belong 0xAE0F38A2 6854>0x0C belong 0x00100000 6855>>(8.L+0x1C) belong 0xC2339F3D Nintendo GameCube embedded disc image: 6856!:mime application/x-gamecube-rom 6857>>>(8.L) use nintendo-gcn-disc-common 6858 6859# Type: Nintendo Wii disc image 6860# From: David Korth <gerbilsoft@gerbilsoft.com> 6861# Reference: http://wiibrew.org/wiki/Wii_Disc 68620x18 belong 0x5D1C9EA3 Nintendo Wii disc image: 6863>0 use nintendo-gcn-disc-common 6864 6865# Type: Nintendo Wii disc image (WBFS format) 6866# From: David Korth <gerbilsoft@gerbilsoft.com> 6867# Reference: http://wiibrew.org/wiki/Wii_Disc 68680 string WBFS 6869>0x218 belong 0x5D1C9EA3 Nintendo Wii disc image (WBFS format): 6870!:mime application/x-wii-rom 6871>>0x200 use nintendo-gcn-disc-common 6872 6873# Type: Nintendo GameCube/Wii disc image (CISO format) 6874# NOTE: This is NOT the same as Compact ISO or PSP CISO, 6875# though it has the same magic number. 68760 string CISO 6877# Other fields are used to determine what type of CISO this is: 6878# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size) 6879# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size) 6880# - None of the above: Compact ISO. 6881>4 lelong 0x200000 6882>>8 byte 1 6883>>>0x801C belong 0xC2339F3D Nintendo GameCube disc image (CISO format): 6884!:mime application/x-wii-rom 6885>>>>0x8000 use nintendo-gcn-disc-common 6886>>>0x8018 belong 0x5D1C9EA3 Nintendo Wii disc image (CISO format): 6887!:mime application/x-wii-rom 6888>>>>0x8000 use nintendo-gcn-disc-common 6889 6890# Type: Nintendo GameCube/Wii disc image (GCZ format) 6891# Due to zlib compression, we can't get the actual disc information. 68920 lelong 0xB10BC001 6893>4 lelong 0 Nintendo GameCube disc image (GCZ format) 6894!:mime application/x-gamecube-rom 6895>4 lelong 1 Nintendo Wii disc image (GCZ format) 6896!:mime application/x-wii-rom 6897>4 default x Nintendo GameCube/Wii disc image (GCZ format) 6898 6899# Type: Nintendo GameCube/Wii disc image (WDF format) 69000 string WII\001DISC 6901>8 belong 1 6902# WDFv1 6903>>0x54 belong 0xC2339F3D Nintendo GameCube disc image (WDFv1 format): 6904!:mime application/x-gamecube-rom 6905>>>0x38 use nintendo-gcn-disc-common 6906>>0x58 belong 0x5D1C9EA3 Nintendo Wii disc image (WDFv1 format): 6907!:mime application/x-wii-rom 6908>>>0x38 use nintendo-gcn-disc-common 6909>8 belong 2 6910# WDFv2 6911>>(12.L+0x1C) belong 0xC2339F3D Nintendo GameCube disc image (WDFv2 format): 6912!:mime application/x-gamecube-rom 6913>>>(12.L) use nintendo-gcn-disc-common 6914>>(12.L+0x18) belong 0x5D1C9EA3 Nintendo Wii disc image (WDFv2 format): 6915!:mime application/x-wii-rom 6916>>>(12.L) use nintendo-gcn-disc-common 6917 6918# Type: Nintendo GameCube/Wii disc image (WIA format) 69190 string WIA\001 Nintendo 6920>0x48 belong 1 GameCube 6921!:mime application/x-gamecube-rom 6922>0x48 belong 2 Wii 6923!:mime application/x-wii-rom 6924>0x48 default x GameCube/Wii 6925>0x48 belong x disc image (WIA format): 6926>>0x58 use nintendo-gcn-disc-common 6927 6928# Type: Nintendo GameCube/Wii disc image (with SDK header) 6929# From: David Korth <gerbilsoft@gerbilsoft.com> 6930# Reference: http://wiibrew.org/wiki/Wii_Disc 69310 belong 0xFFFF0000 6932>0x18 belong 0x00000000 6933>>0x1C belong 0x00000000 6934>>>0x8018 belong 0x5D1C9EA3 Nintendo Wii SDK disc image: 6935>>>>0x8000 use nintendo-gcn-disc-common 6936>>>0x801C belong 0xC2339F3D Nintendo GameCube SDK disc image: 6937>>>>0x8000 use nintendo-gcn-disc-common 6938 6939#------------------------------------------------------------------------------ 6940# Nintendo 3DS file formats. 6941# 6942 6943# Type: Nintendo 3DS "NCSD" image. (game cards and eMMC) 6944# From: David Korth <gerbilsoft@gerbilsoft.com> 6945# Reference: https://www.3dbrew.org/wiki/NCSD 69460x100 string NCSD 6947>0x118 lequad 0 Nintendo 3DS Game Card image 6948# NCCH header for partition 0. (game data) 6949>>0x1150 string >\0 \b: "%.16s" 6950>>0x312 byte x (Rev.%02u) 6951>>0x118C byte 2 (New3DS only) 6952>>0x18D byte 0 (inner device) 6953>>0x18D byte 1 (Card1) 6954>>0x18D byte 2 (Card2) 6955>>0x18D byte 3 (extended device) 6956>0x118 bequad 0x0102020202000000 Nintendo 3DS eMMC dump (Old3DS) 6957>0x118 bequad 0x0102020203000000 Nintendo 3DS eMMC dump (New3DS) 6958 6959# Nintendo 3DS version code. 6960# Reference: https://www.3dbrew.org/wiki/Titles 6961# Format: leshort containing three fields: 6962# - 6-bit: Major 6963# - 6-bit: Minor 6964# - 4-bit: Revision 6965# NOTE: Only supporting major/minor versions from 0-15 right now. 6966# NOTE: Should be prefixed with "v". 69670 name nintendo-3ds-version-code 6968# Raw version. 6969>0 leshort x \b%u, 6970# Major version. 6971>0 leshort&0xFC00 0x0000 0 6972>0 leshort&0xFC00 0x0400 1 6973>0 leshort&0xFC00 0x0800 2 6974>0 leshort&0xFC00 0x0C00 3 6975>0 leshort&0xFC00 0x1000 4 6976>0 leshort&0xFC00 0x1400 5 6977>0 leshort&0xFC00 0x1800 6 6978>0 leshort&0xFC00 0x1C00 7 6979>0 leshort&0xFC00 0x2000 8 6980>0 leshort&0xFC00 0x2400 9 6981>0 leshort&0xFC00 0x2800 10 6982>0 leshort&0xFC00 0x2C00 11 6983>0 leshort&0xFC00 0x3000 12 6984>0 leshort&0xFC00 0x3400 13 6985>0 leshort&0xFC00 0x3800 14 6986>0 leshort&0xFC00 0x3C00 15 6987# Minor version. 6988>0 leshort&0x03F0 0x0000 \b.0 6989>0 leshort&0x03F0 0x0010 \b.1 6990>0 leshort&0x03F0 0x0020 \b.2 6991>0 leshort&0x03F0 0x0030 \b.3 6992>0 leshort&0x03F0 0x0040 \b.4 6993>0 leshort&0x03F0 0x0050 \b.5 6994>0 leshort&0x03F0 0x0060 \b.6 6995>0 leshort&0x03F0 0x0070 \b.7 6996>0 leshort&0x03F0 0x0080 \b.8 6997>0 leshort&0x03F0 0x0090 \b.9 6998>0 leshort&0x03F0 0x00A0 \b.10 6999>0 leshort&0x03F0 0x00B0 \b.11 7000>0 leshort&0x03F0 0x00C0 \b.12 7001>0 leshort&0x03F0 0x00D0 \b.13 7002>0 leshort&0x03F0 0x00E0 \b.14 7003>0 leshort&0x03F0 0x00F0 \b.15 7004# Revision. 7005>0 leshort&0x000F x \b.%u 7006 7007# Type: Nintendo 3DS "NCCH" container. 7008# https://www.3dbrew.org/wiki/NCCH 70090x100 string NCCH Nintendo 3DS 7010>0x18D byte&2 0 File Archive (CFA) 7011>0x18D byte&2 2 Executable Image (CXI) 7012>0x150 string >\0 \b: "%.16s" 7013>0x18D byte 0x05 7014>>0x10E leshort x (Old3DS System Update v 7015>>0x10E use nintendo-3ds-version-code 7016>>0x10E leshort x \b) 7017>0x18D byte 0x15 7018>>0x10E leshort x (New3DS System Update v 7019>>0x10E use nintendo-3ds-version-code 7020>>0x10E leshort x \b) 7021>0x18D byte !0x05 7022>>0x18D byte !0x15 7023>>>0x112 byte x (v 7024>>>0x112 use nintendo-3ds-version-code 7025>>>0x112 byte x \b) 7026>0x18C byte 2 (New3DS only) 7027 7028# Type: Nintendo 3DS "SMDH" file. (application description) 7029# From: David Korth <gerbilsoft@gerbilsoft.com> 7030# Reference: https://3dbrew.org/wiki/SMDH 70310 string SMDH Nintendo 3DS SMDH file 7032>0x208 leshort !0 7033>>0x208 lestring16 x \b: "%.128s" 7034>>0x388 leshort !0 7035>>>0x388 lestring16 x by %.128s 7036>0x208 leshort 0 7037>>0x008 leshort !0 7038>>>0x008 lestring16 x \b: "%.128s" 7039>>>0x188 leshort !0 7040>>>>0x188 lestring16 x by %.128s 7041 7042# Type: Nintendo 3DS Homebrew Application. 7043# From: David Korth <gerbilsoft@gerbilsoft.com> 7044# Reference: https://3dbrew.org/wiki/3DSX_Format 70450 string 3DSX Nintendo 3DS Homebrew Application (3DSX) 7046 7047#------------------------------------------------------------------------------ 7048# a7800: file(1) magic for the Atari 7800 raw ROM format. 7049# From: David Korth <gerbilsoft@gerbilsoft.com> 7050# Reference: https://sites.google.com/site/atari7800wiki/a78-header 7051 70520 byte >0 7053>0 byte <3 7054>>1 string ATARI7800 Atari 7800 ROM image 7055!:mime application/x-atari-7800-rom 7056>>>0x11 string >\0 \b: "%.32s" 7057# Display type. 7058>>>0x39 byte 0 (NTSC) 7059>>>0x39 byte 1 (PAL) 7060>>>0x36 byte&1 1 (POKEY) 7061 7062#------------------------------------------------------------------------------ 7063# vectrex: file(1) magic for the GCE Vectrex raw ROM format. 7064# From: David Korth <gerbilsoft@gerbilsoft.com> 7065# Reference: http://www.playvectrex.com/designit/chrissalo/hello1.htm 7066# 7067# NOTE: Title is terminated with 0x80, not 0. 7068# The header is terminated with a 0, so that will 7069# terminate the title as well. 7070# 70710 string g\ GCE Vectrex ROM image 7072>0x11 string >\0 \b: "%.16s" 7073 7074#------------------------------------------------------------------------------ 7075# amiibo: file(1) magic for Nintendo amiibo NFC dumps. 7076# From: David Korth <gerbilsoft@gerbilsoft.com> 7077# Reference: https://www.3dbrew.org/wiki/Amiibo 70780x00 byte 0x04 7079>0x0A beshort 0x0FE0 7080>>0x0C belong 0xF110FFEE 7081>>>0x208 beshort 0x0100 7082>>>>0x020A byte 0x0F 7083>>>>>0x020C bequad 0x000000045F000000 7084>>>>>>0x5B byte 0x02 7085>>>>>>>0x54 belong x Nintendo amiibo NFC dump - amiibo ID: %08X- 7086>>>>>>>0x58 belong x \b%08X 7087 7088#------------------------------------------------------------------------------ 7089# $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $ 7090# convex: file(1) magic for Convex boxes 7091# 7092# Convexes are big-endian. 7093# 7094# /*\ 7095# * Below are the magic numbers and tests added for Convex. 7096# * Added at beginning, because they are expected to be used most. 7097# \*/ 70980 belong 0507 Convex old-style object 7099>16 belong >0 not stripped 71000 belong 0513 Convex old-style demand paged executable 7101>16 belong >0 not stripped 71020 belong 0515 Convex old-style pre-paged executable 7103>16 belong >0 not stripped 71040 belong 0517 Convex old-style pre-paged, non-swapped executable 7105>16 belong >0 not stripped 71060 belong 0x011257 Core file 7107# 7108# The following are a series of dump format magic numbers. Each one 7109# corresponds to a drastically different dump format. The first on is 7110# the original dump format on a 4.1 BSD or earlier file system. The 7111# second marks the change between the 4.1 file system and the 4.2 file 7112# system. The Third marks the changing of the block size from 1K 7113# to 2K to be compatible with an IDC file system. The fourth indicates 7114# a dump that is dependent on Convex Storage Manager, because data in 7115# secondary storage is not physically contained within the dump. 7116# The restore program uses these number to determine how the data is 7117# to be extracted. 7118# 711924 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible) 712024 belong =60014 dump format, Convex Storage Manager by-reference dump 7121# 7122# what follows is a bunch of bit-mask checks on the flags field of the opthdr. 7123# If there is no `=' sign, assume just checking for whether the bit is set? 7124# 71250 belong 0601 Convex SOFF 7126>88 belong&0x000f0000 =0x00000000 c1 7127>88 belong &0x00010000 c2 7128>88 belong &0x00020000 c2mp 7129>88 belong &0x00040000 parallel 7130>88 belong &0x00080000 intrinsic 7131>88 belong &0x00000001 demand paged 7132>88 belong &0x00000002 pre-paged 7133>88 belong &0x00000004 non-swapped 7134>88 belong &0x00000008 POSIX 7135# 7136>84 belong &0x80000000 executable 7137>84 belong &0x40000000 object 7138>84 belong&0x20000000 =0 not stripped 7139>84 belong&0x18000000 =0x00000000 native fpmode 7140>84 belong&0x18000000 =0x10000000 ieee fpmode 7141>84 belong&0x18000000 =0x18000000 undefined fpmode 7142# 71430 belong 0605 Convex SOFF core 7144# 71450 belong 0607 Convex SOFF checkpoint 7146>88 belong&0x000f0000 =0x00000000 c1 7147>88 belong &0x00010000 c2 7148>88 belong &0x00020000 c2mp 7149>88 belong &0x00040000 parallel 7150>88 belong &0x00080000 intrinsic 7151>88 belong &0x00000008 POSIX 7152# 7153>84 belong&0x18000000 =0x00000000 native fpmode 7154>84 belong&0x18000000 =0x10000000 ieee fpmode 7155>84 belong&0x18000000 =0x18000000 undefined fpmode 7156 7157#------------------------------------------------------------------------------ 7158# $File: coverage,v 1.1 2016/06/05 00:26:32 christos Exp $ 7159# xoverage: file(1) magic for test coverage data 7160 7161# File formats used to store test coverage data 7162# 2016-05-21, Georg Sauthoff <mail@georg.so> 7163 7164 7165# - GCC gcno - written by GCC at compile time when compiling with 7166# gcc -ftest-coverage 7167# - GCC gcda - written by a program that was compiled with 7168# gcc -fprofile-arcs 7169# - LLVM raw profiles - generated by a program compiled with 7170# clang -fprofile-instr-generate -fcoverage-mapping ... 7171# - LLVM indexed profiles - generated by 7172# llvm-profdata 7173# - GCOV reports, i.e. the annotated source code 7174# - LCOV trace files, i.e. aggregated GCC profiles 7175# 7176# GCC coverage tracefiles 7177# .gcno file are created during compile time, 7178# while data collected during runtime is stored in .gcda files 7179# cf. gcov-io.h 7180# https://gcc.gnu.org/onlinedocs/gcc-5.3.0/gcc/Gcov-Data-Files.html 7181# Examples: 7182# Fedora 23/x86-64/gcc-5.3.1: 6f 6e 63 67 52 33 30 35 7183# Debian 8 PPC64/gcc-4.9.2 : 67 63 6e 6f 34 30 39 2a 71840 lelong 0x67636e6f GCC gcno coverage (-ftest-coverage), 7185>&3 byte x version %c. 7186>&1 byte x \b%c 7187 7188# big endian 71890 belong 0x67636e6f GCC gcno coverage (-ftest-coverage), 7190>&0 byte x version %c. 7191>&2 byte x \b%c (big-endian) 7192 7193# Examples: 7194# Fedora 23/x86-64/gcc-5.3.1: 61 64 63 67 52 33 30 35 7195# Debian 8 PPC64/gcc-4.9.2 : 67 63 64 61 34 30 39 2a 71960 lelong 0x67636461 GCC gcda coverage (-fprofile-arcs), 7197>&3 byte x version %c. 7198>&1 byte x \b%c 7199 7200# big endian 72010 belong 0x67636461 GCC gcda coverage (-fprofile-arcs), 7202>&0 byte x version %c. 7203>&2 byte x \b%c (big-endian) 7204 7205 7206# LCOV tracefiles 7207# cf. http://ltp.sourceforge.net/coverage/lcov/geninfo.1.php 72080 string TN: 7209>&0 search/64 \nSF:/ LCOV coverage tracefile 7210 7211 7212# Coverage reports generated by gcov 7213# i.e. source code annoted with coverage information 72140 string \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Source: 7215>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Graph: 7216>>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Data: GCOV coverage report 7217 7218 7219# LLVM coverage files 7220 7221# raw data after running a program compiled with: 7222# `clang -fprofile-instr-generate -fcoverage-mapping ...` 7223# default name: default.profraw 7224# magic is: \xFF lprofr \x81 7225# cf. http://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html 72260 lequad 0xff6c70726f667281 LLVM raw profile data, 7227>&0 byte x version %d 7228 7229# big endian 72300 bequad 0xff6c70726f667281 LLVM raw profile data, 7231>&7 byte x version %d (big-endian) 7232 7233 7234# LLVM indexed instruction profile (as generated by llvm-profdata) 7235# magic is: reverse(\xFF lprofi \x81) 7236# cf. http://llvm.org/docs/CoverageMappingFormat.html 7237# http://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html 7238# http://llvm.org/docs/CommandGuide/llvm-cov.html 7239# http://llvm.org/docs/CommandGuide/llvm-profdata.html 72400 lequad 0x8169666f72706cff LLVM indexed profile data, 7241>&0 byte x version %d 7242 7243# big endian 72440 bequad 0x8169666f72706cff LLVM indexed profile data, 7245>&7 byte x version %d (big-endian) 7246 7247 7248#------------------------------------------------------------------------------ 7249# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $ 7250# cracklib: file (1) magic for cracklib v2.7 7251 72520 lelong 0x70775631 Cracklib password index, little endian 7253>4 long >0 (%i words) 7254>4 long 0 ("64-bit") 7255>>8 long >-1 (%i words) 72560 belong 0x70775631 Cracklib password index, big endian 7257>4 belong >-1 (%i words) 7258# really bellong 0x0000000070775631 72590 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit") 7260>12 belong >0 (%i words) 7261 7262# ---------------------------------------------------------------------------- 7263# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $ 7264# ctags: file (1) magic for Exuberant Ctags files 7265# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de> 72660 search/1 =!_TAG Exuberant Ctags tag file text 7267 7268#-------------------------------------------------------------- 7269# ctf: file(1) magic for CTF (Common Trace Format) trace files 7270# 7271# Specs. available here: <http://www.efficios.com/ctf> 7272#-------------------------------------------------------------- 7273 7274# CTF trace data 72750 lelong 0xc1fc1fc1 Common Trace Format (CTF) trace data (LE) 72760 belong 0xc1fc1fc1 Common Trace Format (CTF) trace data (BE) 7277 7278# CTF metadata (packetized) 72790 lelong 0x75d11d57 Common Trace Format (CTF) packetized metadata (LE) 7280>35 byte x \b, v%d 7281>36 byte x \b.%d 72820 belong 0x75d11d57 Common Trace Format (CTF) packetized metadata (BE) 7283>35 byte x \b, v%d 7284>36 byte x \b.%d 7285 7286# CTF metadata (plain text) 72870 string /*\x20CTF\x20 Common Trace Format (CTF) plain text metadata 7288!:strength + 5 # this is to make sure we beat C 7289>&0 regex [0-9]+\.[0-9]+ \b, v%s 7290 7291#------------------------------------------------------------------------------ 7292# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $ 7293# file(1) magic(5) data for cubemaps Martin Erik Werner <martinerikwerner@gmail.com> 7294# 72950 string ACMP Map file for the AssaultCube FPS game 72960 string CUBE Map file for cube and cube2 engine games 72970 string MAPZ) Map file for the Blood Frontier/Red Eclipse FPS games 7298 7299#------------------------------------------------------------------------------ 7300# $File: cups,v 1.5 2017/03/17 21:35:28 christos Exp $ 7301# Cups: file(1) magic for the cups raster file format 7302# From: Laurent Martelli <martellilaurent@gmail.com> 7303# http://www.cups.org/documentation.php/spec-raster.html 7304# 7305 73060 name cups-le 7307>280 lelong x \b, %d 7308>284 lelong x \bx%d dpi 7309>376 lelong x \b, %dx 7310>380 lelong x \b%d pixels 7311>388 lelong x %d bits/color 7312>392 lelong x %d bits/pixel 7313>400 lelong 0 ColorOrder=Chunky 7314>400 lelong 1 ColorOrder=Banded 7315>400 lelong 2 ColorOrder=Planar 7316>404 lelong 0 ColorSpace=gray 7317>404 lelong 1 ColorSpace=RGB 7318>404 lelong 2 ColorSpace=RGBA 7319>404 lelong 3 ColorSpace=black 7320>404 lelong 4 ColorSpace=CMY 7321>404 lelong 5 ColorSpace=YMC 7322>404 lelong 6 ColorSpace=CMYK 7323>404 lelong 7 ColorSpace=YMCK 7324>404 lelong 8 ColorSpace=KCMY 7325>404 lelong 9 ColorSpace=KCMYcm 7326>404 lelong 10 ColorSpace=GMCK 7327>404 lelong 11 ColorSpace=GMCS 7328>404 lelong 12 ColorSpace=WHITE 7329>404 lelong 13 ColorSpace=GOLD 7330>404 lelong 14 ColorSpace=SILVER 7331>404 lelong 15 ColorSpace=CIE XYZ 7332>404 lelong 16 ColorSpace=CIE Lab 7333>404 lelong 17 ColorSpace=RGBW 7334>404 lelong 18 ColorSpace=sGray 7335>404 lelong 19 ColorSpace=sRGB 7336>404 lelong 20 ColorSpace=AdobeRGB 7337 7338# Cups Raster image format, Big Endian 73390 string RaS 7340>3 string t Cups Raster version 1, Big Endian 7341>3 string 2 Cups Raster version 2, Big Endian 7342>3 string 3 Cups Raster version 3, Big Endian 7343!:mime application/vnd.cups-raster 7344>0 use \^cups-le 7345 7346 7347# Cups Raster image format, Little Endian 73481 string SaR 7349>0 string t Cups Raster version 1, Little Endian 7350>0 string 2 Cups Raster version 2, Little Endian 7351>0 string 3 Cups Raster version 3, Little Endian 7352!:mime application/vnd.cups-raster 7353>0 use cups-le 7354 7355#------------------------------------------------------------------------------ 7356# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $ 7357# dact: file(1) magic for DACT compressed files 7358# 73590 long 0x444354C3 DACT compressed data 7360>4 byte >-1 (version %i. 7361>5 byte >-1 $BS%i. 7362>6 byte >-1 $BS%i) 7363>7 long >0 $BS, original size: %i bytes 7364>15 long >30 $BS, block size: %i bytes 7365 7366#------------------------------------------------------------------------------ 7367# $File: database,v 1.54 2018/06/23 16:37:21 christos Exp $ 7368# database: file(1) magic for various databases 7369# 7370# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) 7371# 7372# 7373# GDBM magic numbers 7374# Will be maintained as part of the GDBM distribution in the future. 7375# <downsj@teeny.org> 73760 belong 0x13579acd GNU dbm 1.x or ndbm database, big endian, 32-bit 7377!:mime application/x-gdbm 73780 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian, old 7379!:mime application/x-gdbm 73800 belong 0x13579acf GNU dbm 1.x or ndbm database, big endian, 64-bit 7381!:mime application/x-gdbm 73820 lelong 0x13579acd GNU dbm 1.x or ndbm database, little endian, 32-bit 7383!:mime application/x-gdbm 73840 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian, old 7385!:mime application/x-gdbm 73860 lelong 0x13579acf GNU dbm 1.x or ndbm database, little endian, 64-bit 7387!:mime application/x-gdbm 73880 string GDBM GNU dbm 2.x database 7389!:mime application/x-gdbm 7390# 7391# Berkeley DB 7392# 7393# Ian Darwin's file /etc/magic files: big/little-endian version. 7394# 7395# Hash 1.85/1.86 databases store metadata in network byte order. 7396# Btree 1.85/1.86 databases store the metadata in host byte order. 7397# Hash and Btree 2.X and later databases store the metadata in host byte order. 7398 73990 long 0x00061561 Berkeley DB 7400!:mime application/x-dbm 7401>8 belong 4321 7402>>4 belong >2 1.86 7403>>4 belong <3 1.85 7404>>4 belong >0 (Hash, version %d, native byte-order) 7405>8 belong 1234 7406>>4 belong >2 1.86 7407>>4 belong <3 1.85 7408>>4 belong >0 (Hash, version %d, little-endian) 7409 74100 belong 0x00061561 Berkeley DB 7411>8 belong 4321 7412>>4 belong >2 1.86 7413>>4 belong <3 1.85 7414>>4 belong >0 (Hash, version %d, big-endian) 7415>8 belong 1234 7416>>4 belong >2 1.86 7417>>4 belong <3 1.85 7418>>4 belong >0 (Hash, version %d, native byte-order) 7419 74200 long 0x00053162 Berkeley DB 1.85/1.86 7421>4 long >0 (Btree, version %d, native byte-order) 74220 belong 0x00053162 Berkeley DB 1.85/1.86 7423>4 belong >0 (Btree, version %d, big-endian) 74240 lelong 0x00053162 Berkeley DB 1.85/1.86 7425>4 lelong >0 (Btree, version %d, little-endian) 7426 742712 long 0x00061561 Berkeley DB 7428>16 long >0 (Hash, version %d, native byte-order) 742912 belong 0x00061561 Berkeley DB 7430>16 belong >0 (Hash, version %d, big-endian) 743112 lelong 0x00061561 Berkeley DB 7432>16 lelong >0 (Hash, version %d, little-endian) 7433 743412 long 0x00053162 Berkeley DB 7435>16 long >0 (Btree, version %d, native byte-order) 743612 belong 0x00053162 Berkeley DB 7437>16 belong >0 (Btree, version %d, big-endian) 743812 lelong 0x00053162 Berkeley DB 7439>16 lelong >0 (Btree, version %d, little-endian) 7440 744112 long 0x00042253 Berkeley DB 7442>16 long >0 (Queue, version %d, native byte-order) 744312 belong 0x00042253 Berkeley DB 7444>16 belong >0 (Queue, version %d, big-endian) 744512 lelong 0x00042253 Berkeley DB 7446>16 lelong >0 (Queue, version %d, little-endian) 7447 7448# From Max Bowsher. 744912 long 0x00040988 Berkeley DB 7450>16 long >0 (Log, version %d, native byte-order) 745112 belong 0x00040988 Berkeley DB 7452>16 belong >0 (Log, version %d, big-endian) 745312 lelong 0x00040988 Berkeley DB 7454>16 lelong >0 (Log, version %d, little-endian) 7455 7456# 7457# 7458# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch> 74590 string/b RRD\0 RRDTool DB 7460>4 string/b x version %s 7461 7462>>10 short !0 16bit aligned 7463>>>10 bedouble 8.642135e+130 big-endian 7464>>>>18 short x 32bit long (m68k) 7465 7466>>10 short 0 7467>>>12 long !0 32bit aligned 7468>>>>12 bedouble 8.642135e+130 big-endian 7469>>>>>20 long 0 64bit long 7470>>>>>20 long !0 32bit long 7471>>>>12 ledouble 8.642135e+130 little-endian 7472>>>>>24 long 0 64bit long 7473>>>>>24 long !0 32bit long (i386) 7474>>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian 7475>>>>>24 short !0 32bit long (arm) 7476 7477>>8 quad 0 64bit aligned 7478>>>16 bedouble 8.642135e+130 big-endian 7479>>>>24 long 0 64bit long (s390x) 7480>>>>24 long !0 32bit long (hppa/mips/ppc/s390/SPARC) 7481>>>16 ledouble 8.642135e+130 little-endian 7482>>>>28 long 0 64bit long (alpha/amd64/ia64) 7483>>>>28 long !0 32bit long (armel/mipsel) 7484 7485#---------------------------------------------------------------------- 7486# ROOT: file(1) magic for ROOT databases 7487# 74880 string root\0 ROOT file 7489>4 belong x Version %d 7490>33 belong x (Compression: %d) 7491 7492# XXX: Weak magic. 7493# Alex Ott <ott@jet.msk.su> 7494## Paradox file formats 7495#2 leshort 0x0800 Paradox 7496#>0x39 byte 3 v. 3.0 7497#>0x39 byte 4 v. 3.5 7498#>0x39 byte 9 v. 4.x 7499#>0x39 byte 10 v. 5.x 7500#>0x39 byte 11 v. 5.x 7501#>0x39 byte 12 v. 7.x 7502#>>0x04 byte 0 indexed .DB data file 7503#>>0x04 byte 1 primary index .PX file 7504#>>0x04 byte 2 non-indexed .DB data file 7505#>>0x04 byte 3 non-incrementing secondary index .Xnn file 7506#>>0x04 byte 4 secondary index .Ynn file 7507#>>0x04 byte 5 incrementing secondary index .Xnn file 7508#>>0x04 byte 6 non-incrementing secondary index .XGn file 7509#>>0x04 byte 7 secondary index .YGn file 7510#>>>0x04 byte 8 incrementing secondary index .XGn file 7511 7512## XBase database files 7513# updated by Joerg Jenderek at Feb 2013 7514# http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm 7515# http://www.clicketyclick.dk/databases/xbase/format/dbf.html 7516# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm 7517# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 75180 ubelong&0x0000FFFF <0x00000C20 7519# skip Infocom game Z-machine 7520>2 ubyte >0 7521# skip Androids *.xml 7522>>3 ubyte >0 7523>>>3 ubyte <32 7524# 1 < version VV 7525>>>>0 ubyte >1 7526# skip HELP.CA3 by test for reserved byte ( NULL ) 7527>>>>>27 ubyte 0 7528# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF) 7529#>>>>>30 ubeshort x 30NULL?%x 7530# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 7531>>>>>>24 ubelong&0xffFFFFff >0x01302000 7532# .DBF or .MDX 7533>>>>>>24 ubelong&0xffFFFFff <0x01302001 7534# for Xbase Database file (*.DBF) reserved (NULL) for multi-user 7535>>>>>>>24 ubelong&0xffFFFFff =0 7536# test for 2 reserved NULL bytes,transaction and encryption byte flag 7537>>>>>>>>12 ubelong&0xFFFFfEfE 0 7538# test for MDX flag 7539>>>>>>>>>28 ubyte x 7540>>>>>>>>>28 ubyte&0xf8 0 7541# header size >= 32 7542>>>>>>>>>>8 uleshort >31 7543# skip PIC15736.PCX by test for language driver name or field name 7544>>>>>>>>>>>32 ubyte >0 7545#!:mime application/x-dbf; charset=unknown-8bit ?? 7546#!:mime application/x-dbase 7547>>>>>>>>>>>>0 use xbase-type 7548# database file 7549>>>>>>>>>>>>0 ubyte x \b DBF 7550>>>>>>>>>>>>4 lelong 0 \b, no records 7551>>>>>>>>>>>>4 lelong >0 \b, %d record 7552# plural s appended 7553>>>>>>>>>>>>>4 lelong >1 \bs 7554# http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF 7555# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000) 7556>>>>>>>>>>>>10 uleshort x * %d 7557# file size = records * record size + header size 7558>>>>>>>>>>>>1 ubyte x \b, update-date 7559>>>>>>>>>>>>1 use xbase-date 7560# http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx 7561#>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x 7562# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ? 7563>>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x 7564#>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file 7565>>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX 7566>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT 7567>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer 7568# 1st record offset + 1 = header size 7569>>>>>>>>>>>>8 uleshort >0 7570>>>>>>>>>>>>(8.s+1) ubyte >0 7571>>>>>>>>>>>>>8 uleshort >0 \b, at offset %d 7572>>>>>>>>>>>>>(8.s+1) ubyte >0 7573>>>>>>>>>>>>>>&-1 string >\0 1st record "%s" 7574# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 7575>>>>>>>24 ubelong&0x0133f7ff >0 7576# test for reserved NULL byte 7577>>>>>>>>47 ubyte 0 7578# test for valid TAG key format (0x10 or 0) 7579>>>>>>>>>559 ubyte&0xeF 0 7580# test MM <= 12 7581>>>>>>>>>>45 ubeshort <0x0C20 7582>>>>>>>>>>>45 ubyte >0 7583>>>>>>>>>>>>46 ubyte <32 7584>>>>>>>>>>>>>46 ubyte >0 7585#!:mime application/x-mdx 7586>>>>>>>>>>>>>>0 use xbase-type 7587>>>>>>>>>>>>>>0 ubyte x \b MDX 7588>>>>>>>>>>>>>>1 ubyte x \b, creation-date 7589>>>>>>>>>>>>>>1 use xbase-date 7590>>>>>>>>>>>>>>44 ubyte x \b, update-date 7591>>>>>>>>>>>>>>44 use xbase-date 7592# No.of tags in use (1,2,5,12) 7593>>>>>>>>>>>>>>28 uleshort x \b, %d 7594# No. of entries in tag (0x30) 7595>>>>>>>>>>>>>>25 ubyte x \b/%d tags 7596# Length of tag 7597>>>>>>>>>>>>>>26 ubyte x * %d 7598# 1st tag name_ 7599>>>>>>>>>>>>>548 string x \b, 1st tag "%.11s" 7600# 2nd tag name 7601#>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s" 7602# 7603# Print the xBase names of different version variants 76040 name xbase-type 7605>0 ubyte <2 7606# 1 < version 7607>0 ubyte >1 7608>>0 ubyte 0x02 FoxBase 7609# FoxBase+/dBaseIII+, no memo 7610>>0 ubyte 0x03 FoxBase+/dBase III 7611!:mime application/x-dbf 7612# dBASE IV no memo file 7613>>0 ubyte 0x04 dBase IV 7614!:mime application/x-dbf 7615# dBASE V no memo file 7616>>0 ubyte 0x05 dBase V 7617!:mime application/x-dbf 7618>>0 ubyte 0x30 Visual FoxPro 7619!:mime application/x-dbf 7620>>0 ubyte 0x31 Visual FoxPro, autoincrement 7621!:mime application/x-dbf 7622# Visual FoxPro, with field type Varchar or Varbinary 7623>>0 ubyte 0x32 Visual FoxPro, with field type Varchar 7624!:mime application/x-dbf 7625# dBASE IV SQL, no memo;dbv memo var size (Flagship) 7626>>0 ubyte 0x43 dBase IV, with SQL table 7627!:mime application/x-dbf 7628# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 7629#>>0 ubyte 0x62 dBase IV, with SQL table 7630#!:mime application/x-dbf 7631# dBASE IV, with memo!! 7632>>0 ubyte 0x7b dBase IV, with memo 7633!:mime application/x-dbf 7634# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 7635#>>0 ubyte 0x82 dBase IV, with SQL system 7636#!:mime application/x-dbf 7637# FoxBase+/dBaseIII+ with memo .DBT! 7638>>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT 7639!:mime application/x-dbf 7640# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file 7641>>0 ubyte 0x87 VISUAL OBJECTS, with memo file 7642!:mime application/x-dbf 7643# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 7644#>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT 7645#!:mime application/x-dbf 7646# dBASE IV with memo! 7647>>0 ubyte 0x8B dBase IV, with memo .DBT 7648!:mime application/x-dbf 7649# dBase IV with SQL Table,no memo? 7650>>0 ubyte 0x8E dBase IV, with SQL table 7651!:mime application/x-dbf 7652# .dbv and .dbt memo (Flagship)? 7653>>0 ubyte 0xB3 Flagship 7654# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 7655#>>0 ubyte 0xCA dBase IV with memo .DBT 7656#!:mime application/x-dbf 7657# dBASE IV with SQL table, with memo .DBT 7658>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT 7659!:mime application/x-dbf 7660# HiPer-Six format;Clipper SIX, with SMT memo file 7661>>0 ubyte 0xE5 Clipper SIX with memo 7662!:mime application/x-dbf 7663# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 7664#>>0 ubyte 0xF4 dBase IV, with SQL table, with memo 7665#!:mime application/x-dbf 7666>>0 ubyte 0xF5 FoxPro with memo 7667!:mime application/x-dbf 7668# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 7669#>>0 ubyte 0xFA FoxPro 2.x, with memo 7670#!:mime application/x-dbf 7671# unknown version (should not happen) 7672>>0 default x xBase 7673!:mime application/x-dbf 7674>>>0 ubyte x (0x%x) 7675# flags in version byte 7676# DBT flag (with dBASE III memo .DBT)!! 7677# >>0 ubyte&0x80 >0 DBT_FLAG=%x 7678# memo flag ?? 7679# >>0 ubyte&0x08 >0 MEMO_FLAG=%x 7680# SQL flag ?? 7681# >>0 ubyte&0x70 >0 SQL_FLAG=%x 7682# test and print the date of xBase .DBF .MDX 76830 name xbase-date 7684# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 7685>0 ubelong x 7686>1 ubyte <13 7687>>1 ubyte >0 7688>>>2 ubyte >0 7689>>>>2 ubyte <32 7690>>>>>0 ubyte x 7691# YY is interpreted as 20YY or 19YY 7692>>>>>>0 ubyte <100 \b %.2d 7693# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY 7694>>>>>>0 ubyte >99 \b %d 7695>>>>>1 ubyte x \b-%d 7696>>>>>2 ubyte x \b-%d 7697 7698# dBase memo files .DBT or .FPT 7699# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx 770016 ubyte <4 7701>16 ubyte !2 7702>>16 ubyte !1 7703# next free block index is positive 7704>>>0 ulelong >0 7705# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size 7706>>>>17 ubelong&0xFFfdFE00 0x00000000 7707# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h 7708>>>>>20 ubelong&0xFF01209B 0x00000000 7709# dBASE III 7710>>>>>>16 ubyte 3 7711# dBASE III DBT 7712>>>>>>>0 use dbase3-memo-print 7713# dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage 7714>>>>>>16 ubyte 0 7715# unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT , or garbage PCX DBF 7716>>>>>>>20 uleshort 0 7717# FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage 7718>>>>>>>>8 ulong =0 7719>>>>>>>>>6 ubeshort >0 7720# skip emacs.PIF 7721>>>>>>>>>>4 ushort 0 7722>>>>>>>>>>>0 use foxpro-memo-print 7723# dBASE III DBT , garbage 7724>>>>>>>>>6 ubeshort 0 7725# skip MM*DD*.bin by test for for reserved NULL byte 7726>>>>>>>>>>510 ubeshort 0 7727# skip TK-DOS11.img image by looking for memo text 7728>>>>>>>>>>>512 ubelong <0xfeffff03 7729# skip EFI executables by looking for memo text 7730>>>>>>>>>>>>512 ubelong >0x1F202020 7731>>>>>>>>>>>>>513 ubyte >0 7732# unusual dBASE III DBT like adressen.dbt 7733>>>>>>>>>>>>>>0 use dbase3-memo-print 7734# dBASE III DBT like angest.dbt, or garbage PCX DBF 7735>>>>>>>>8 ubelong !0 7736# skip PCX and some DBF by test for for reserved NULL bytes 7737>>>>>>>>>510 ubeshort 0 7738# skip some DBF by test of invalid version 7739>>>>>>>>>>0 ubyte >5 7740>>>>>>>>>>>0 ubyte <48 7741>>>>>>>>>>>>0 use dbase3-memo-print 7742# dBASE IV DBT with positive block size 7743>>>>>>>20 uleshort >0 7744# dBASE IV DBT with valid block length like 512, 1024 7745# multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero 7746>>>>>>>>20 uleshort&0x800f 0 7747>>>>>>>>>0 use dbase4-memo-print 7748 7749# Print the information of dBase III DBT memo file 77500 name dbase3-memo-print 7751>0 ubyte x dBase III DBT 7752# instead 3 as version number 0 for unusual examples like biblio.dbt 7753>16 ubyte !3 \b, version number %u 7754# Number of next available block for appending data 7755#>0 lelong =0 \b, next free block index %u 7756>0 lelong !0 \b, next free block index %u 7757# no positiv block length 7758#>20 uleshort =0 \b, block length %u 7759>20 uleshort !0 \b, block length %u 7760# dBase III memo field terminated by \032\032 7761>512 string >\0 \b, 1st item "%s" 7762# Print the information of dBase IV DBT memo file 77630 name dbase4-memo-print 7764>0 lelong x dBase IV DBT 7765!:mime application/x-dbt 7766!:ext dbt 7767# 8 character shorted main name of coresponding dBASE IV DBF file 7768>8 ubelong >0x20000000 7769# skip unusual like for angest.dbt 7770>>20 uleshort >0 7771>>>8 string >\0 \b of %-.8s.DBF 7772# value 0 implies 512 as size 7773#>4 ulelong =0 \b, blocks size %u 7774# size of blocks not reliable like 0x2020204C in angest.dbt 7775>4 ulelong !0 7776>>4 ulelong&0x0000003f 0 \b, blocks size %u 7777# dBase IV DBT with positive block length (found 512 , 1024) 7778>20 uleshort >0 \b, block length %u 7779# next available block 7780#>0 lelong =0 \b, next free block index %u 7781>0 lelong !0 \b, next free block index %u 7782>20 uleshort >0 7783>>(20.s) ubelong x 7784>>>&-4 use dbase4-memofield-print 7785# unusual dBase IV DBT without block length (implies 512 as length) 7786>20 uleshort =0 7787>>512 ubelong x 7788>>>&-4 use dbase4-memofield-print 7789# Print the information of dBase IV memo field 77900 name dbase4-memofield-print 7791# free dBase IV memo field 7792>0 ubelong !0xFFFF0800 7793>>0 lelong x \b, next free block %u 7794>>4 lelong x \b, next used block %u 7795# used dBase IV memo field 7796>0 ubelong =0xFFFF0800 7797# length of memo field 7798>>4 lelong x \b, field length %d 7799>>>8 string >\0 \b, 1st used item "%s" 7800# Print the information of FoxPro FPT memo file 78010 name foxpro-memo-print 7802>0 belong x FoxPro FPT 7803# Size of blocks for FoxPro ( 64,256 ) 7804>6 ubeshort x \b, blocks size %u 7805# next available block 7806#>0 belong =0 \b, next free block index %u 7807>0 belong !0 \b, next free block index %u 7808# field type ( 0~picture, 1~memo, 2~object ) 7809>512 ubelong <3 \b, field type %u 7810# length of memo field 7811>512 ubelong 1 7812>>516 belong >0 \b, field length %d 7813>>>520 string >\0 \b, 1st item "%s" 7814 7815# TODO: 7816# DBASE index file *.NDX 7817# DBASE Compound Index file *.CDX 7818# dBASE IV Printer Driver *.PRF 7819## End of XBase database stuff 7820 7821# MS Access database 78224 string Standard\ Jet\ DB Microsoft Access Database 7823!:mime application/x-msaccess 78244 string Standard\ ACE\ DB Microsoft Access Database 7825!:mime application/x-msaccess 7826 7827# From: Joerg Jenderek 7828# URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine 7829# Reference: https://github.com/libyal/libesedb/archive/master.zip 7830# libesedb-master/documentation/ 7831# Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc 7832# Note: also known as "JET Blue". Used by numerous Windows components such as 7833# Windows Search, Mail, Exchange and Active Directory. 78344 ubelong 0xefcdab89 7835# unknown1 7836>132 ubelong 0 Extensible storage engine 7837!:mime application/x-ms-ese 7838# file_type 0~database 1~stream 7839>>12 ulelong 0 DataBase 7840# Security DataBase (sdb) 7841!:ext edb/sdb 7842>>12 ulelong 1 STreaMing 7843!:ext stm 7844# format_version 620h 7845>>8 uleshort x \b, version 0x%x 7846>>10 uleshort >0 revision 0x%4.4x 7847>>0 ubelong x \b, checksum 0x%8.8x 7848# Page size 4096 8192 32768 7849>>236 ulequad x \b, page size %lld 7850# database_state 7851>>52 ulelong 1 \b, JustCreated 7852>>52 ulelong 2 \b, DirtyShutdown 7853#>>52 ulelong 3 \b, CleanShutdown 7854>>52 ulelong 4 \b, BeingConverted 7855>>52 ulelong 5 \b, ForceDetach 7856# Windows�NT major version when the databases indexes were updated. 7857>>216 ulelong x \b, Windows version %d 7858# Windows�NT minor version 7859>>220 ulelong x \b.%d 7860 7861# From: Joerg Jenderek 7862# URL: http://forensicswiki.org/wiki/Windows_Application_Compatibility 7863# Note: files contain application compatibility fixes, application compatibility modes and application help messages. 78648 string sdbf 7865>7 ubyte 0 7866# TAG_TYPE_LIST+TAG_INDEXES 7867>>12 uleshort 0x7802 Windows application compatibility Shim DataBase 7868# version? 2 3 7869#>>>0 ulelong x \b, version %d 7870!:mime application/x-ms-sdb 7871!:ext sdb 7872 7873# TDB database from Samba et al - Martin Pool <mbp@samba.org> 78740 string TDB\ file TDB database 7875>32 lelong 0x2601196D version 6, little-endian 7876>>36 lelong x hash size %d bytes 7877 7878# SE Linux policy database 78790 lelong 0xf97cff8c SE Linux policy 7880>16 lelong x v%d 7881>20 lelong 1 MLS 7882>24 lelong x %d symbols 7883>28 lelong x %d ocons 7884 7885# ICE authority file data (Wolfram Kleff) 78862 string ICE ICE authority data 7887 7888# X11 Xauthority file (Wolfram Kleff) 788910 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 789011 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 789112 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 789213 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 789314 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 789415 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 789516 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 789617 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 789718 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 7898 7899# From: Maxime Henrion <mux@FreeBSD.org> 7900# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org> 79010 string PGDMP PostgreSQL custom database dump 7902>5 byte x - v%d 7903>6 byte x \b.%d 7904>5 beshort <0x101 \b-0 7905>5 beshort >0x100 7906>>7 byte x \b-%d 7907 7908# Type: Advanced Data Format (ADF) database 7909# URL: http://www.grc.nasa.gov/WWW/cgns/adf/ 7910# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr> 79110 string @(#)ADF\ Database CGNS Advanced Data Format 7912 7913# Tokyo Cabinet magic data 7914# http://tokyocabinet.sourceforge.net/index.html 79150 string ToKyO\ CaBiNeT\n Tokyo Cabinet 7916>14 string x \b (%s) 7917>32 byte 0 \b, Hash 7918!:mime application/x-tokyocabinet-hash 7919>32 byte 1 \b, B+ tree 7920!:mime application/x-tokyocabinet-btree 7921>32 byte 2 \b, Fixed-length 7922!:mime application/x-tokyocabinet-fixed 7923>32 byte 3 \b, Table 7924!:mime application/x-tokyocabinet-table 7925>33 byte &1 \b, [open] 7926>33 byte &2 \b, [fatal] 7927>34 byte x \b, apow=%d 7928>35 byte x \b, fpow=%d 7929>36 byte &0x01 \b, [large] 7930>36 byte &0x02 \b, [deflate] 7931>36 byte &0x04 \b, [bzip] 7932>36 byte &0x08 \b, [tcbs] 7933>36 byte &0x10 \b, [excodec] 7934>40 lequad x \b, bnum=%lld 7935>48 lequad x \b, rnum=%lld 7936>56 lequad x \b, fsiz=%lld 7937 7938# Type: QDBM Quick Database Manager 7939# From: Benoit Sibaud <bsibaud@april.org> 79400 string \\[depot\\]\n\f Quick Database Manager, little endian 79410 string \\[DEPOT\\]\n\f Quick Database Manager, big endian 7942 7943# Type: TokyoCabinet database 7944# URL: http://tokyocabinet.sourceforge.net/ 7945# From: Benoit Sibaud <bsibaud@april.org> 79460 string ToKyO\ CaBiNeT\n TokyoCabinet database 7947>14 string x (version %s) 7948 7949# From: Stephane Blondon http://www.yaal.fr 7950# Database file for Zope (done by FileStorage) 79510 string FS21 Zope Object Database File Storage v3 (data) 79520 string FS30 Zope Object Database File Storage v4 (data) 7953 7954# Cache file for the database of Zope (done by ClientStorage) 79550 string ZEC3 Zope Object Database Client Cache File (data) 7956 7957# IDA (Interactive Disassembler) database 79580 string IDA1 IDA (Interactive Disassembler) database 7959 7960# Hopper (reverse engineering tool) http://www.hopperapp.com/ 79610 string hopperdb Hopper database 7962 7963# URL: https://en.wikipedia.org/wiki/Panorama_(database_engine) 7964# Reference: http://www.provue.com/Panorama/ 7965# From: Joerg Jenderek 7966# NOTE: test only versions 4 and 6.0 with Windows 7967# length of Panorama database name 79685 ubyte >0 7969# look after database name for "some" null bits 7970>(5.B+7) ubelong&0xF3ffF000 0 7971# look for first keyword 7972>>&1 search/2 DESIGN Panorama database 7973#!:mime application/x-panorama-database 7974!:apple KASXZEPD 7975!:ext pan 7976# database name 7977>>>5 pstring x \b, "%s" 7978 7979# 7980# 7981# askSam Database by Stefan A. Haubenthal <polluks@web.de> 79820 string askw40\0 askSam DB 7983 7984# 7985# 7986# MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de> 79870 string MBSTV\040 MUIbase DB 7988>6 string x version %s 7989 7990# 7991# CDB database 79920 string NBCDB\012 NetBSD Constant Database 7993>7 byte x \b, version %d 7994>8 string x \b, for '%s' 7995>24 lelong x \b, datasize %d 7996>28 lelong x \b, entries %d 7997>32 lelong x \b, index %d 7998>36 lelong x \b, seed %#x 7999 8000# 8001# Redis RDB - https://redis.io/topics/persistence 80020 string REDIS Redis RDB file, 8003>5 regex [0-9][0-9][0-9][0-9] version %s 8004 8005# Mork database. 8006# Used by older versions of Mozilla Suite and Firefox, 8007# and current versions of Thunderbird. 8008# From: David Korth <gerbilsoft@gerbilsoft.com> 80090 string //\ <!--\ <mdb:mork:z\ v=" Mozilla Mork database 8010>23 string x \b, version %.3s 8011 8012#------------------------------------------------------------------------------ 8013# $File: dataone,v 1.1 2018/06/06 01:16:40 christos Exp $ 8014# 8015# DataONE- files from Dave Vieglais <dave.vieglais@gmail.com> & 8016# Pratik Shrivastava <pratikshrivastava23@gmail.com> 8017# 8018# file formats: https://cn.dataone.org/cn/v2/formats 8019#------------------------------------------------------------------------------ 8020 8021# EML (Ecological Metadata Language Format) 80220 string <?xml 8023>&0 regex (eml)-[0-9].[0-9].[0-9]+ eml://ecoinformatics.org/%s 8024 8025# onedcx (DataONE Dublin Core Extended v1.0) 8026>&0 regex (onedcx/v)[0-9].[0-9]+ http://ns.dataone.org/metadata/schema/onedcx/v1.0 8027 8028# FGDC-STD-001-1998 (Content Standard for Digital Geospatial Metadata, 8029# version 001-1998) 8030>&0 regex fgdc FGDC-STD-001-1998 8031 8032# Mercury (Oak Ridge National Lab Mercury Metadata version 1.0) 8033>&0 regex (mercury/terms/v)[0-9].[0-9] http://purl.org/ornl/schema/mercury/terms/v1.0 8034 8035# ISOTC211 (Geographic MetaData (GMD) Extensible Markup Language) 8036>&0 regex isotc211 8037>>&0 regex eng;USA http://www.isotc211.org/2005/gmd 8038 8039# ISOTC211 (NOAA Variant Geographic MetaData (GMD) Extensible Markup Language) 8040>>&0 regex gov.noaa.nodc:[0-9]+ http://www.isotc211.org/2005/gmd-noaa 8041 8042# ISOTC211 PANGAEA Variant Geographic MetaData (GMD) Extensible Markup Language 8043>>&0 regex pangaea.dataset[0-9][0-9][0-9][0-9][0-9][0-9]+ http://www.isotc211.org/2005/gmd-pangaea 8044!:mime text/xml 8045 8046 8047# Object Reuse and Exchange Vocabulary 80480 string <?xml 8049>&0 regex rdf 8050>>&0 regex openarchives http://www.openarchives.org/ore/terms 8051!:mime application/rdf+xml 8052 8053 8054# Dryad Metadata Application Profile Version 3.1 80550 string <DryadData 8056>&0 regex (dryad-bibo/v)[0-9].[0-9] http://datadryad.org/profile/v3.1 8057!:mime text/xml 8058 8059#------------------------------------------------------------------------------ 8060# $File: dbpf,v 1.2 2018/05/24 18:54:40 christos Exp $ 8061# dppf: Maxis Database Packed Files, the stored data file format used by all 8062# Maxis games after the Sims: http://wiki.niotso.org/DBPF 8063# http://www.wiki.sc4devotion.com/index.php?title=DBPF 8064# 13 Oct 2017, Kip Warner <kip at thevertigo dot com> 80650 string DBPF Maxis Database Packed File 8066>4 ulelong x \b, version: %u. 8067>>8 ulelong x \b%u 8068>>>36 ulelong x \b, files: %u 8069>>24 ledate !0 \b, created: %s 8070>>28 ledate !0 \b, modified: %s 8071!:ext dbpf/package/dat/sc4 8072!:mime application/x-maxis-dbpf 8073#------------------------------------------------------------------------------ 8074# $File: der,v 1.2 2017/03/17 21:35:28 christos Exp $ 8075# der: file(1) magic for DER encoded files 8076# 8077 8078# Certificate information piece 80790 name certinfo 8080>0 der seq 8081>>&0 der set 8082>>>&0 der seq 8083>>>>&0 der obj_id3=550406 8084>>>>&0 der prt_str=x \b, countryName=%s 8085>>&0 der set 8086>>>&0 der seq 8087>>>>&0 der obj_id3=550408 8088>>>>&0 der utf8_str=x \b, stateOrProvinceName=%s 8089>>&0 der set 8090>>>&0 der seq 8091>>>>&0 der obj_id3=55040a 8092>>>>&0 der utf8_str=x \b, organizationName=%s 8093>>&0 der set 8094>>>&0 der seq 8095>>>>&0 der obj_id3=550403 8096>>>>&0 der utf8_str=x \b, commonName=%s 8097>>&0 der seq 8098 8099# Certificate requests 81000 der seq 8101>&0 der seq 8102>>&0 der int1=00 DER Encoded Certificate request 8103>>&0 use certinfo 8104 8105# Key Pairs 81060 der seq 8107>&0 der int1=00 8108>&0 der int65=x 8109>&0 der int3=010001 DER Encoded Key Pair, 512 bits 8110 81110 der seq 8112>&0 der int1=00 8113>&0 der int129=x 8114>&0 der int3=010001 DER Encoded Key Pair, 1024 bits 8115 81160 der seq 8117>&0 der int1=00 8118>&0 der int257=x 8119>&0 der int3=010001 DER Encoded Key Pair, 2048 bits 8120 81210 der seq 8122>&0 der int1=00 8123>&0 der int513=x 8124>&0 der int3=010001 DER Encoded Key Pair, 4096 bits 8125 81260 der seq 8127>&0 der int1=00 8128>&0 der int1025=x 8129>&0 der int3=010001 DER Encoded Key Pair, 8192 bits 8130 81310 der seq 8132>&0 der int1=00 8133>&0 der int2049=x 8134>&0 der int3=010001 DER Encoded Key Pair, 16k bits 8135 81360 der seq 8137>&0 der int1=00 8138>&0 der int4097=x 8139>&0 der int3=010001 DER Encoded Key Pair, 32k bits 8140 8141# Certificates 81420 der seq 8143>&0 der seq 8144>>&0 der int2=0dfa DER Encoded Certificate, 512 bits 8145>>&0 der int2=0dfb DER Encoded Certificate, 1024 bits 8146>>&0 der int2=0dfc DER Encoded Certificate, 2048 bits 8147>>&0 der int2=0dfd DER Encoded Certificate, 4096 bits 8148>>&0 der int2=0dfe DER Encoded Certificate, 8192 bits 8149>>&0 der int2=0dff DER Encoded Certificate, 16k bits 8150>>&0 der int2=0e04 DER Encoded Certificate, 32k bits 8151>>&0 der int2=x DER Encoded Certificate, ? bits (%s) 8152>>&0 der seq 8153>>>&0 der obj_id9=2a864886f70d010105 \b, sha1WithRSAEncryption 8154>>>&0 der obj_id9=x \b, ? Encryption (%s) 8155>>>&0 der null 8156>>&0 der seq 8157>>>&0 der set 8158>>>>&0 der seq 8159>>>>>&0 der obj_id3=550406 8160>>>>>&0 der prt_str=x \b, countryName=%s 8161>>>&0 der set 8162>>>>&0 der seq 8163>>>>>&0 der obj_id3=550408 8164>>>>>&0 der prt_str=x \b, stateOrProvinceName=%s 8165>>>&0 der set 8166>>>>&0 der seq 8167>>>>>&0 der obj_id3=550407 8168>>>>>&0 der prt_str=x \b, localityName=%s 8169>>>&0 der set 8170>>>>&0 der seq 8171>>>>>&0 der obj_id3=55040a 8172>>>>>&0 der prt_str=x \b, organizationName=%s 8173>>>&0 der set 8174>>>>&0 der seq 8175>>>>>&0 der obj_id3=55040b 8176>>>>>&0 der prt_str=x \b, organizationUnitName=%s 8177>>>&0 der set 8178>>>>&0 der seq 8179>>>>>&0 der obj_id3=550403 8180>>>>>&0 der prt_str=x \b, commonName=%s 8181>>>&0 der set 8182>>>>&0 der seq 8183>>>>>&0 der obj_id9=2a864886f70d010901 8184>>>>>&0 der ia5_str=x \b, emailAddress=%s 8185>>&0 der seq 8186>>>&0 der utc_time=x \b, utcTime=%s 8187>>>&0 der utc_time=x \b, utcTime=%s 8188>>&0 use certinfo 8189 8190#------------------------------------------------------------------------------ 8191# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $ 8192# diamond: file(1) magic for Diamond system 8193# 8194# ... diamond is a multi-media mail and electronic conferencing system.... 8195# 8196# XXX - I think it was either renamed Slate, or replaced by Slate.... 8197# 8198# The full deal is too long... 8199#0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document 82000 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document 8201 8202#------------------------------------------------------------------------------ 8203# $File: diff,v 1.16 2017/03/17 22:20:22 christos Exp $ 8204# diff: file(1) magic for diff(1) output 8205# 82060 search/1 diff\040 diff output text 8207!:mime text/x-diff 82080 search/1 ***\040 diff output text 8209!:mime text/x-diff 82100 search/1 Only\040in\040 diff output text 8211!:mime text/x-diff 82120 search/1 Common\040subdirectories:\040 diff output text 8213!:mime text/x-diff 8214 82150 search/1 Index: RCS/CVS diff output text 8216!:mime text/x-diff 8217 8218# bsdiff: file(1) magic for bsdiff(1) output 82190 string/b BSDIFF40 bsdiff(1) patch file 8220 8221 8222# unified diff 82230 search/4096 ---\040 8224>&0 search/1024 \n 8225>>&0 search/1 +++\040 8226>>>&0 search/1024 \n 8227>>>>&0 search/1 @@ unified diff output text 8228!:mime text/x-diff 8229!:strength + 90 8230 8231# librsync -- the library for network deltas 8232# 8233# Copyright (C) 2001 by Martin Pool. You may do whatever you want with 8234# this file. 8235# 82360 belong 0x72730236 rdiff network-delta data 8237 82380 belong 0x72730136 rdiff network-delta signature data 8239>4 belong x (block length=%d, 8240>8 belong x signature strength=%d) 8241 8242#------------------------------------------------------------------------------ 8243# $File: digital,v 1.11 2013/01/11 16:45:23 christos Exp $ 8244# Digital UNIX - Info 8245# 82460 string =!<arch>\n________64E Alpha archive 8247>22 string X -- out of date 8248# 8249 82500 leshort 0603 8251>24 leshort 0410 COFF format alpha pure 8252>24 leshort 0413 COFF format alpha demand paged 8253>>22 leshort&030000 !020000 executable 8254>>22 leshort&020000 !0 dynamically linked 8255>>16 lelong !0 not stripped 8256>>16 lelong 0 stripped 8257>>27 byte x - version %d 8258>>26 byte x \b.%d 8259>>28 byte x \b-%d 8260>24 leshort 0407 COFF format alpha object 8261>>22 leshort&030000 020000 shared library 8262>>27 byte x - version %d 8263>>26 byte x \b.%d 8264>>28 byte x \b-%d 8265 8266# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk> 8267# 8268# The actual magic number is just "Core", followed by a 2-byte version 8269# number; however, treating any file that begins with "Core" as a Digital 8270# UNIX core dump file may produce too many false hits, so we include one 8271# byte of the version number as well; DU 5.0 appears only to be up to 8272# version 2. 8273# 82740 string Core\001 Alpha COFF format core dump (Digital UNIX) 8275>24 string >\0 \b, from '%s' 82760 string Core\002 Alpha COFF format core dump (Digital UNIX) 8277>24 string >\0 \b, from '%s' 8278# 8279# The next is incomplete, we could tell more about this format, 8280# but its not worth it. 82810 leshort 0x188 Alpha compressed COFF 82820 leshort 0x18f Alpha u-code object 8283# 8284# 8285# Some other interesting Digital formats, 82860 string \377\377\177 ddis/ddif 82870 string \377\377\174 ddis/dots archive 82880 string \377\377\176 ddis/dtif table data 82890 string \033c\033 LN03 output 82900 long 04553207 X image 8291# 82920 string =!<PDF>!\n profiling data file 8293# 8294# Locale data tables (MIPS and Alpha). 8295# 82960 short 0x0501 locale data table 8297>6 short 0x24 for MIPS 8298>6 short 0x40 for Alpha 8299 8300#------------------------------------------------------------------------------ 8301# $File: dolby,v 1.8 2017/03/17 21:35:28 christos Exp $ 8302# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at> 8303# from http://www.atsc.org/standards/a_52a.pdf 8304# corrections, additions, etc. are always welcome! 8305# 8306# syncword 83070 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream, 8308# Proposed audio/ac3 RFC/4184 8309!:mime audio/vnd.dolby.dd-raw 8310# fscod 8311>4 byte&0xc0 = 0x00 48 kHz, 8312>4 byte&0xc0 = 0x40 44.1 kHz, 8313>4 byte&0xc0 = 0x80 32 kHz, 8314# is this one used for 96 kHz? 8315>4 byte&0xc0 = 0xc0 reserved frequency, 8316# 8317>5 byte&0x07 = 0x00 \b, complete main (CM) 8318>5 byte&0x07 = 0x01 \b, music and effects (ME) 8319>5 byte&0x07 = 0x02 \b, visually impaired (VI) 8320>5 byte&0x07 = 0x03 \b, hearing impaired (HI) 8321>5 byte&0x07 = 0x04 \b, dialogue (D) 8322>5 byte&0x07 = 0x05 \b, commentary (C) 8323>5 byte&0x07 = 0x06 \b, emergency (E) 8324>5 beshort&0x07e0 0x0720 \b, voiceover (VO) 8325>5 beshort&0x07e0 >0x0720 \b, karaoke 8326# acmod 8327>6 byte&0xe0 = 0x00 1+1 front, 8328>>6 byte&0x10 = 0x10 LFE on, 8329>6 byte&0xe0 = 0x20 1 front/0 rear, 8330>>6 byte&0x10 = 0x10 LFE on, 8331>6 byte&0xe0 = 0x40 2 front/0 rear, 8332# dsurmod (for stereo only) 8333>>6 byte&0x18 = 0x00 Dolby Surround not indicated 8334>>6 byte&0x18 = 0x08 not Dolby Surround encoded 8335>>6 byte&0x18 = 0x10 Dolby Surround encoded 8336>>6 byte&0x18 = 0x18 reserved Dolby Surround mode 8337>>6 byte&0x04 = 0x04 LFE on, 8338>6 byte&0xe0 = 0x60 3 front/0 rear, 8339>>6 byte&0x04 = 0x04 LFE on, 8340>6 byte&0xe0 = 0x80 2 front/1 rear, 8341>>6 byte&0x04 = 0x04 LFE on, 8342>6 byte&0xe0 = 0xa0 3 front/1 rear, 8343>>6 byte&0x01 = 0x01 LFE on, 8344>6 byte&0xe0 = 0xc0 2 front/2 rear, 8345>>6 byte&0x04 = 0x04 LFE on, 8346>6 byte&0xe0 = 0xe0 3 front/2 rear, 8347>>6 byte&0x01 = 0x01 LFE on, 8348# 8349>4 byte&0x3e = 0x00 \b, 32 kbit/s 8350>4 byte&0x3e = 0x02 \b, 40 kbit/s 8351>4 byte&0x3e = 0x04 \b, 48 kbit/s 8352>4 byte&0x3e = 0x06 \b, 56 kbit/s 8353>4 byte&0x3e = 0x08 \b, 64 kbit/s 8354>4 byte&0x3e = 0x0a \b, 80 kbit/s 8355>4 byte&0x3e = 0x0c \b, 96 kbit/s 8356>4 byte&0x3e = 0x0e \b, 112 kbit/s 8357>4 byte&0x3e = 0x10 \b, 128 kbit/s 8358>4 byte&0x3e = 0x12 \b, 160 kbit/s 8359>4 byte&0x3e = 0x14 \b, 192 kbit/s 8360>4 byte&0x3e = 0x16 \b, 224 kbit/s 8361>4 byte&0x3e = 0x18 \b, 256 kbit/s 8362>4 byte&0x3e = 0x1a \b, 320 kbit/s 8363>4 byte&0x3e = 0x1c \b, 384 kbit/s 8364>4 byte&0x3e = 0x1e \b, 448 kbit/s 8365>4 byte&0x3e = 0x20 \b, 512 kbit/s 8366>4 byte&0x3e = 0x22 \b, 576 kbit/s 8367>4 byte&0x3e = 0x24 \b, 640 kbit/s 8368 8369#------------------------------------------------------------------------------ 8370# $File: dump,v 1.17 2018/06/26 01:07:17 christos Exp $ 8371# dump: file(1) magic for dump file format--for new and old dump filesystems 8372# 8373# We specify both byte orders in order to recognize byte-swapped dumps. 8374# 83750 name new-dump-be 8376>4 bedate x This dump %s, 8377>8 bedate x Previous dump %s, 8378>12 belong >0 Volume %d, 8379>692 belong 0 Level zero, type: 8380>692 belong >0 Level %d, type: 8381>0 belong 1 tape header, 8382>0 belong 2 beginning of file record, 8383>0 belong 3 map of inodes on tape, 8384>0 belong 4 continuation of file record, 8385>0 belong 5 end of volume, 8386>0 belong 6 map of inodes deleted, 8387>0 belong 7 end of medium (for floppy), 8388>676 string >\0 Label %s, 8389>696 string >\0 Filesystem %s, 8390>760 string >\0 Device %s, 8391>824 string >\0 Host %s, 8392>888 belong >0 Flags %x 8393 83940 name old-dump-be 8395#>4 bedate x This dump %s, 8396#>8 bedate x Previous dump %s, 8397>12 belong >0 Volume %d, 8398>692 belong 0 Level zero, type: 8399>692 belong >0 Level %d, type: 8400>0 belong 1 tape header, 8401>0 belong 2 beginning of file record, 8402>0 belong 3 map of inodes on tape, 8403>0 belong 4 continuation of file record, 8404>0 belong 5 end of volume, 8405>0 belong 6 map of inodes deleted, 8406>0 belong 7 end of medium (for floppy), 8407>676 string >\0 Label %s, 8408>696 string >\0 Filesystem %s, 8409>760 string >\0 Device %s, 8410>824 string >\0 Host %s, 8411>888 belong >0 Flags %x 8412 84130 name ufs2-dump-be 8414>896 beqdate x This dump %s, 8415>904 beqdate x Previous dump %s, 8416>12 belong >0 Volume %d, 8417>692 belong 0 Level zero, type: 8418>692 belong >0 Level %d, type: 8419>0 belong 1 tape header, 8420>0 belong 2 beginning of file record, 8421>0 belong 3 map of inodes on tape, 8422>0 belong 4 continuation of file record, 8423>0 belong 5 end of volume, 8424>0 belong 6 map of inodes deleted, 8425>0 belong 7 end of medium (for floppy), 8426>676 string >\0 Label %s, 8427>696 string >\0 Filesystem %s, 8428>760 string >\0 Device %s, 8429>824 string >\0 Host %s, 8430>888 belong >0 Flags %x 8431 843224 belong 60012 new-fs dump file (big endian), 8433>0 use new-dump-be 8434 843524 belong 60011 old-fs dump file (big endian), 8436>0 use old-dump-be 8437 843824 lelong 60012 new-fs dump file (little endian), 8439# to correctly recognize '*.mo' GNU message catalog (little endian) 8440!:strength - 15 8441>0 use \^new-dump-be 8442 844324 lelong 60011 old-fs dump file (little endian), 8444>0 use \^old-dump-be 8445 8446 844724 belong 0x19540119 new-fs dump file (ufs2, big endian), 8448>0 use ufs2-dump-be 8449 845024 lelong 0x19540119 new-fs dump file (ufs2, little endian), 8451>0 use \^ufs2-dump-be 8452 845318 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness), 8454>2 medate x Previous dump %s, 8455>6 medate x This dump %s, 8456>10 leshort >0 Volume %d, 8457>0 leshort 1 tape header. 8458>0 leshort 2 beginning of file record. 8459>0 leshort 3 map of inodes on tape. 8460>0 leshort 4 continuation of file record. 8461>0 leshort 5 end of volume. 8462>0 leshort 6 map of inodes deleted. 8463>0 leshort 7 end of medium (for floppy). 8464 8465#------------------------------------------------------------------------------ 8466# $File: dyadic,v 1.8 2017/03/17 21:35:28 christos Exp $ 8467# Dyadic: file(1) magic for Dyalog APL. 8468# 8469# updated by Joerg Jenderek at Oct 2013 8470# http://en.wikipedia.org/wiki/Dyalog_APL 8471# http://www.dyalog.com/ 8472# .DXV Dyalog APL External Variable 8473# .DIN Dyalog APL Input Table 8474# .DOT Dyalog APL Output Table 8475# .DFT Dyalog APL Format File 84760 ubeshort&0xFF60 0xaa00 8477# skip biblio.dbt 8478>1 byte !4 8479# real Dyalog APL have non zero version numbers like 7.3 or 13.4 8480>>2 ubeshort >0x0000 Dyalog APL 8481>>>1 byte 0x00 aplcore 8482#>>>1 byte 0x00 incomplete workspace 8483# *.DCF Dyalog APL Component File 8484>>>1 byte 0x01 component file 32-bit non-journaled non-checksummed 8485#>>>1 byte 0x01 component file 8486>>>1 byte 0x02 external variable exclusive 8487#>>>1 byte 0x02 external variable 8488# *.DWS Dyalog APL Workspace 8489>>>1 byte 0x03 workspace 8490>>>>7 byte&0x28 0x00 32-bit 8491>>>>7 byte&0x28 0x20 64-bit 8492>>>>7 byte&0x0c 0x00 classic 8493>>>>7 byte&0x0c 0x04 unicode 8494>>>>7 byte&0x88 0x00 big-endian 8495>>>>7 byte&0x88 0x80 little-endian 8496>>>1 byte 0x06 external variable shared 8497# *.DSE Dyalog APL Session , *.DLF Dyalog APL Session Log File 8498>>>1 byte 0x07 session 8499>>>1 byte 0x08 mapped file 32-bit 8500>>>1 byte 0x09 component file 64-bit non-journaled non-checksummed 8501>>>1 byte 0x0a mapped file 64-bit 8502>>>1 byte 0x0b component file 32-bit level 1 journaled non-checksummed 8503>>>1 byte 0x0c component file 64-bit level 1 journaled non-checksummed 8504>>>1 byte 0x0d component file 32-bit level 1 journaled checksummed 8505>>>1 byte 0x0e component file 64-bit level 1 journaled checksummed 8506>>>1 byte 0x0f component file 32-bit level 2 journaled checksummed 8507>>>1 byte 0x10 component file 64-bit level 2 journaled checksummed 8508>>>1 byte 0x11 component file 32-bit level 3 journaled checksummed 8509>>>1 byte 0x12 component file 64-bit level 3 journaled checksummed 8510>>>1 byte 0x13 component file 32-bit non-journaled checksummed 8511>>>1 byte 0x14 component file 64-bit non-journaled checksummed 8512>>>1 byte 0x15 component file under construction 8513>>>1 byte 0x16 DFS component file 64-bit level 1 journaled checksummed 8514>>>1 byte 0x17 DFS component file 64-bit level 2 journaled checksummed 8515>>>1 byte 0x18 DFS component file 64-bit level 3 journaled checksummed 8516>>>1 byte 0x19 external workspace 8517>>>1 byte 0x80 DDB 8518>>>2 byte x version %d 8519>>>3 byte x \b.%d 8520#>>>2 byte x type %d 8521#>>>3 byte x subtype %d 8522 8523# *.DXF Dyalog APL Transfer File 85240 short 0x6060 Dyalog APL transfer 8525 8526#------------------------------------------------------------------------------ 8527# $File: ebml,v 1.1 2010/07/02 00:07:03 christos Exp $ 8528# ebml: file(1) magic for various Extensible Binary Meta Language 8529# http://www.matroska.org/technical/specs/index.html#track 85300 belong 0x1a45dfa3 EBML file 8531>4 search/b/100 \102\202 8532>>&1 string x \b, creator %.8s 8533 8534#------------------------------------------------------------------------------ 8535# $File: editors,v 1.11 2017/03/17 21:35:28 christos Exp $ 8536# T602 editor documents 8537# by David Necas <yeti@physics.muni.cz> 85380 string @CT\ T602 document data, 8539>4 string 0 Kamenicky 8540>4 string 1 CP 852 8541>4 string 2 KOI8-CS 8542>4 string >2 unknown encoding 8543 8544# Vi IMproved Encrypted file 8545# by David Necas <yeti@physics.muni.cz> 85460 string VimCrypt~ Vim encrypted file data 8547 85480 name vimnanoswap 8549>67 byte 0 8550>>107 byte 0 8551#>>>2 string x %s swap file 8552>>>24 ulelong x \b, pid %d 8553>>>28 string >\0 \b, user %s 8554>>>68 string >\0 \b, host %s 8555>>>108 string >\0 \b, file %s 8556>>>1007 byte 0x55 \b, modified 8557 8558# Vi IMproved Swap file 8559# by Sven Wegener <swegener@gentoo.org> 85600 string b0VIM\ Vim swap file 8561>&0 string >\0 \b, version %s 8562>0 use vimnanoswap 8563 8564 8565# Lock/swap file for several editors, at least 8566# Vi IMproved and nano 85670 string b0nano Nano swap file 8568>0 use vimnanoswap 8569 8570# kate (K Advanced Text Editor) 85710 string \x00\x00\x00\x12Kate\ Swap\ File\ 2.0\x00 Kate swap file 8572 8573#------------------------------------------------------------------------------ 8574# $File: efi,v 1.5 2014/04/30 21:41:02 christos Exp $ 8575# efi: file(1) magic for Universal EFI binaries 8576 85770 lelong 0x0ef1fab9 8578>4 lelong 1 Universal EFI binary with 1 architecture 8579>>&0 lelong 7 \b, i386 8580>>&0 lelong 0x01000007 \b, x86_64 8581>4 lelong 2 Universal EFI binary with 2 architectures 8582>>&0 lelong 7 \b, i386 8583>>&0 lelong 0x01000007 \b, x86_64 8584>>&20 lelong 7 \b, i386 8585>>&20 lelong 0x01000007 \b, x86_64 8586>4 lelong >2 Universal EFI binary with %d architectures 8587 8588#------------------------------------------------------------------------------ 8589# $File: elf,v 1.74 2018/06/23 16:39:53 christos Exp $ 8590# elf: file(1) magic for ELF executables 8591# 8592# We have to check the byte order flag to see what byte order all the 8593# other stuff in the header is in. 8594# 8595# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 8596# 8597# Created by: unknown 8598# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com> 8599# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support) 8600# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support) 8601# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium) 8602# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures) 8603 86040 name elf-mips 8605>0 lelong&0xf0000000 0x00000000 MIPS-I 8606>0 lelong&0xf0000000 0x10000000 MIPS-II 8607>0 lelong&0xf0000000 0x20000000 MIPS-III 8608>0 lelong&0xf0000000 0x30000000 MIPS-IV 8609>0 lelong&0xf0000000 0x40000000 MIPS-V 8610>0 lelong&0xf0000000 0x50000000 MIPS32 8611>0 lelong&0xf0000000 0x60000000 MIPS64 8612>0 lelong&0xf0000000 0x70000000 MIPS32 rel2 8613>0 lelong&0xf0000000 0x80000000 MIPS64 rel2 8614>0 lelong&0xf0000000 0x90000000 MIPS32 rel6 8615>0 lelong&0xf0000000 0xa0000000 MIPS64 rel6 8616 86170 name elf-sparc 8618>0 lelong&0x00ffff00 0x00000100 V8+ Required, 8619>0 lelong&0x00ffff00 0x00000200 Sun UltraSPARC1 Extensions Required, 8620>0 lelong&0x00ffff00 0x00000400 HaL R1 Extensions Required, 8621>0 lelong&0x00ffff00 0x00000800 Sun UltraSPARC3 Extensions Required, 8622>0 lelong&0x3 0 total store ordering, 8623>0 lelong&0x3 1 partial store ordering, 8624>0 lelong&0x3 2 relaxed memory ordering, 8625 86260 name elf-pa-risc 8627>2 leshort 0x0214 2.0 8628>0 leshort &0x0008 (LP64) 8629 86300 name elf-le 8631>16 leshort 0 no file type, 8632!:mime application/octet-stream 8633>16 leshort 1 relocatable, 8634!:mime application/x-object 8635>16 leshort 2 executable, 8636!:mime application/x-executable 8637>16 leshort 3 ${x?pie executable:shared object}, 8638 8639!:mime application/x-${x?pie-executable:sharedlib} 8640>16 leshort 4 core file, 8641!:mime application/x-coredump 8642# OS-specific 8643>7 byte 202 8644>>16 leshort 0xFE01 executable, 8645!:mime application/x-executable 8646# Core file detection is not reliable. 8647#>>>(0x38+0xcc) string >\0 of '%s' 8648#>>>(0x38+0x10) lelong >0 (signal %d), 8649>16 leshort &0xff00 processor-specific, 8650>18 clear x 8651>18 leshort 0 no machine, 8652>18 leshort 1 AT&T WE32100, 8653>18 leshort 2 SPARC, 8654>18 leshort 3 Intel 80386, 8655>18 leshort 4 Motorola m68k, 8656>>4 byte 1 8657>>>36 lelong &0x01000000 68000, 8658>>>36 lelong &0x00810000 CPU32, 8659>>>36 lelong 0 68020, 8660>18 leshort 5 Motorola m88k, 8661>18 leshort 6 Intel 80486, 8662>18 leshort 7 Intel 80860, 8663# The official e_machine number for MIPS is now #8, regardless of endianness. 8664# The second number (#10) will be deprecated later. For now, we still 8665# say something if #10 is encountered, but only gory details for #8. 8666>18 leshort 8 MIPS, 8667>>4 byte 1 8668>>>36 lelong &0x20 N32 8669>18 leshort 10 MIPS, 8670>>4 byte 1 8671>>>36 lelong &0x20 N32 8672>18 leshort 8 8673# only for 32-bit 8674>>4 byte 1 8675>>>36 use elf-mips 8676# only for 64-bit 8677>>4 byte 2 8678>>>48 use elf-mips 8679>18 leshort 9 Amdahl, 8680>18 leshort 10 MIPS (deprecated), 8681>18 leshort 11 RS6000, 8682>18 leshort 15 PA-RISC, 8683# only for 32-bit 8684>>4 byte 1 8685>>>36 use elf-pa-risc 8686# only for 64-bit 8687>>4 byte 2 8688>>>48 use elf-pa-risc 8689>18 leshort 16 nCUBE, 8690>18 leshort 17 Fujitsu VPP500, 8691>18 leshort 18 SPARC32PLUS, 8692# only for 32-bit 8693>>4 byte 1 8694>>>36 use elf-sparc 8695>18 leshort 19 Intel 80960, 8696>18 leshort 20 PowerPC or cisco 4500, 8697>18 leshort 21 64-bit PowerPC or cisco 7500, 8698>18 leshort 22 IBM S/390, 8699>18 leshort 23 Cell SPU, 8700>18 leshort 24 cisco SVIP, 8701>18 leshort 25 cisco 7200, 8702>18 leshort 36 NEC V800 or cisco 12000, 8703>18 leshort 37 Fujitsu FR20, 8704>18 leshort 38 TRW RH-32, 8705>18 leshort 39 Motorola RCE, 8706>18 leshort 40 ARM, 8707>>4 byte 1 8708>>>36 lelong&0xff000000 0x04000000 EABI4 8709>>>36 lelong&0xff000000 0x05000000 EABI5 8710>>>36 lelong &0x00800000 BE8 8711>>>36 lelong &0x00400000 LE8 8712>18 leshort 41 Alpha, 8713>18 leshort 42 Renesas SH, 8714>18 leshort 43 SPARC V9, 8715>>4 byte 2 8716>>>48 use elf-sparc 8717>18 leshort 44 Siemens Tricore Embedded Processor, 8718>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc., 8719>18 leshort 46 Renesas H8/300, 8720>18 leshort 47 Renesas H8/300H, 8721>18 leshort 48 Renesas H8S, 8722>18 leshort 49 Renesas H8/500, 8723>18 leshort 50 IA-64, 8724>18 leshort 51 Stanford MIPS-X, 8725>18 leshort 52 Motorola Coldfire, 8726>18 leshort 53 Motorola M68HC12, 8727>18 leshort 54 Fujitsu MMA, 8728>18 leshort 55 Siemens PCP, 8729>18 leshort 56 Sony nCPU, 8730>18 leshort 57 Denso NDR1, 8731>18 leshort 58 Start*Core, 8732>18 leshort 59 Toyota ME16, 8733>18 leshort 60 ST100, 8734>18 leshort 61 Tinyj emb., 8735>18 leshort 62 x86-64, 8736>18 leshort 63 Sony DSP, 8737>18 leshort 64 DEC PDP-10, 8738>18 leshort 65 DEC PDP-11, 8739>18 leshort 66 FX66, 8740>18 leshort 67 ST9+ 8/16 bit, 8741>18 leshort 68 ST7 8 bit, 8742>18 leshort 69 MC68HC16, 8743>18 leshort 70 MC68HC11, 8744>18 leshort 71 MC68HC08, 8745>18 leshort 72 MC68HC05, 8746>18 leshort 73 SGI SVx or Cray NV1, 8747>18 leshort 74 ST19 8 bit, 8748>18 leshort 75 Digital VAX, 8749>18 leshort 76 Axis cris, 8750>18 leshort 77 Infineon 32-bit embedded, 8751>18 leshort 78 Element 14 64-bit DSP, 8752>18 leshort 79 LSI Logic 16-bit DSP, 8753>18 leshort 80 MMIX, 8754>18 leshort 81 Harvard machine-independent, 8755>18 leshort 82 SiTera Prism, 8756>18 leshort 83 Atmel AVR 8-bit, 8757>18 leshort 84 Fujitsu FR30, 8758>18 leshort 85 Mitsubishi D10V, 8759>18 leshort 86 Mitsubishi D30V, 8760>18 leshort 87 NEC v850, 8761>18 leshort 88 Renesas M32R, 8762>18 leshort 89 Matsushita MN10300, 8763>18 leshort 90 Matsushita MN10200, 8764>18 leshort 91 picoJava, 8765>18 leshort 92 OpenRISC, 8766>18 leshort 93 ARC Cores Tangent-A5, 8767>18 leshort 94 Tensilica Xtensa, 8768>18 leshort 95 Alphamosaic VideoCore, 8769>18 leshort 96 Thompson Multimedia, 8770>18 leshort 97 NatSemi 32k, 8771>18 leshort 98 Tenor Network TPC, 8772>18 leshort 99 Trebia SNP 1000, 8773>18 leshort 100 STMicroelectronics ST200, 8774>18 leshort 101 Ubicom IP2022, 8775>18 leshort 102 MAX Processor, 8776>18 leshort 103 NatSemi CompactRISC, 8777>18 leshort 104 Fujitsu F2MC16, 8778>18 leshort 105 TI msp430, 8779>18 leshort 106 Analog Devices Blackfin, 8780>18 leshort 107 S1C33 Family of Seiko Epson, 8781>18 leshort 108 Sharp embedded, 8782>18 leshort 109 Arca RISC, 8783>18 leshort 110 PKU-Unity Ltd., 8784>18 leshort 111 eXcess: 16/32/64-bit, 8785>18 leshort 112 Icera Deep Execution Processor, 8786>18 leshort 113 Altera Nios II, 8787>18 leshort 114 NatSemi CRX, 8788>18 leshort 115 Motorola XGATE, 8789>18 leshort 116 Infineon C16x/XC16x, 8790>18 leshort 117 Renesas M16C series, 8791>18 leshort 118 Microchip dsPIC30F, 8792>18 leshort 119 Freescale RISC core, 8793>18 leshort 120 Renesas M32C series, 8794>18 leshort 131 Altium TSK3000 core, 8795>18 leshort 132 Freescale RS08, 8796>18 leshort 134 Cyan Technology eCOG2, 8797>18 leshort 135 Sunplus S+core7 RISC, 8798>18 leshort 136 New Japan Radio (NJR) 24-bit DSP, 8799>18 leshort 137 Broadcom VideoCore III, 8800>18 leshort 138 LatticeMico32, 8801>18 leshort 139 Seiko Epson C17 family, 8802>18 leshort 140 TI TMS320C6000 DSP family, 8803>18 leshort 141 TI TMS320C2000 DSP family, 8804>18 leshort 142 TI TMS320C55x DSP family, 8805>18 leshort 160 STMicroelectronics 64bit VLIW DSP, 8806>18 leshort 161 Cypress M8C, 8807>18 leshort 162 Renesas R32C series, 8808>18 leshort 163 NXP TriMedia family, 8809>18 leshort 164 QUALCOMM DSP6, 8810>18 leshort 165 Intel 8051 and variants, 8811>18 leshort 166 STMicroelectronics STxP7x family, 8812>18 leshort 167 Andes embedded RISC, 8813>18 leshort 168 Cyan eCOG1X family, 8814>18 leshort 169 Dallas MAXQ30, 8815>18 leshort 170 New Japan Radio (NJR) 16-bit DSP, 8816>18 leshort 171 M2000 Reconfigurable RISC, 8817>18 leshort 172 Cray NV2 vector architecture, 8818>18 leshort 173 Renesas RX family, 8819>18 leshort 174 META, 8820>18 leshort 175 MCST Elbrus, 8821>18 leshort 176 Cyan Technology eCOG16 family, 8822>18 leshort 177 NatSemi CompactRISC, 8823>18 leshort 178 Freescale Extended Time Processing Unit, 8824>18 leshort 179 Infineon SLE9X, 8825>18 leshort 180 Intel L1OM, 8826>18 leshort 181 Intel K1OM, 8827>18 leshort 183 ARM aarch64, 8828>18 leshort 185 Atmel 32-bit family, 8829>18 leshort 186 STMicroeletronics STM8 8-bit, 8830>18 leshort 187 Tilera TILE64, 8831>18 leshort 188 Tilera TILEPro, 8832>18 leshort 189 Xilinx MicroBlaze 32-bit RISC, 8833>18 leshort 190 NVIDIA CUDA architecture, 8834>18 leshort 191 Tilera TILE-Gx, 8835>18 leshort 197 Renesas RL78 family, 8836>18 leshort 199 Renesas 78K0R, 8837>18 leshort 200 Freescale 56800EX, 8838>18 leshort 201 Beyond BA1, 8839>18 leshort 202 Beyond BA2, 8840>18 leshort 203 XMOS xCORE, 8841>18 leshort 204 Microchip 8-bit PIC(r), 8842>18 leshort 210 KM211 KM32, 8843>18 leshort 211 KM211 KMX32, 8844>18 leshort 212 KM211 KMX16, 8845>18 leshort 213 KM211 KMX8, 8846>18 leshort 214 KM211 KVARC, 8847>18 leshort 215 Paneve CDP, 8848>18 leshort 216 Cognitive Smart Memory, 8849>18 leshort 217 iCelero CoolEngine, 8850>18 leshort 218 Nanoradio Optimized RISC, 8851>18 leshort 243 UCB RISC-V, 8852>18 leshort 0x1057 AVR (unofficial), 8853>18 leshort 0x1059 MSP430 (unofficial), 8854>18 leshort 0x1223 Adapteva Epiphany (unofficial), 8855>18 leshort 0x2530 Morpho MT (unofficial), 8856>18 leshort 0x3330 FR30 (unofficial), 8857>18 leshort 0x3426 OpenRISC (obsolete), 8858>18 leshort 0x4688 Infineon C166 (unofficial), 8859>18 leshort 0x5441 Cygnus FRV (unofficial), 8860>18 leshort 0x5aa5 DLX (unofficial), 8861>18 leshort 0x7650 Cygnus D10V (unofficial), 8862>18 leshort 0x7676 Cygnus D30V (unofficial), 8863>18 leshort 0x8217 Ubicom IP2xxx (unofficial), 8864>18 leshort 0x8472 OpenRISC (obsolete), 8865>18 leshort 0x9025 Cygnus PowerPC (unofficial), 8866>18 leshort 0x9026 Alpha (unofficial), 8867>18 leshort 0x9041 Cygnus M32R (unofficial), 8868>18 leshort 0x9080 Cygnus V850 (unofficial), 8869>18 leshort 0xa390 IBM S/390 (obsolete), 8870>18 leshort 0xabc7 Old Xtensa (unofficial), 8871>18 leshort 0xad45 xstormy16 (unofficial), 8872>18 leshort 0xbaab Old MicroBlaze (unofficial),, 8873>18 leshort 0xbeef Cygnus MN10300 (unofficial), 8874>18 leshort 0xdead Cygnus MN10200 (unofficial), 8875>18 leshort 0xf00d Toshiba MeP (unofficial), 8876>18 leshort 0xfeb0 Renesas M32C (unofficial), 8877>18 leshort 0xfeba Vitesse IQ2000 (unofficial), 8878>18 leshort 0xfebb NIOS (unofficial), 8879>18 leshort 0xfeed Moxie (unofficial), 8880>18 default x 8881>>18 leshort x *unknown arch 0x%x* 8882>20 lelong 0 invalid version 8883>20 lelong 1 version 1 8884 88850 string \177ELF ELF 8886!:strength *2 8887>4 byte 0 invalid class 8888>4 byte 1 32-bit 8889>4 byte 2 64-bit 8890>5 byte 0 invalid byte order 8891>5 byte 1 LSB 8892>>0 use elf-le 8893>5 byte 2 MSB 8894>>0 use \^elf-le 8895>7 byte 0 (SYSV) 8896>7 byte 1 (HP-UX) 8897>7 byte 2 (NetBSD) 8898>7 byte 3 (GNU/Linux) 8899>7 byte 4 (GNU/Hurd) 8900>7 byte 5 (86Open) 8901>7 byte 6 (Solaris) 8902>7 byte 7 (Monterey) 8903>7 byte 8 (IRIX) 8904>7 byte 9 (FreeBSD) 8905>7 byte 10 (Tru64) 8906>7 byte 11 (Novell Modesto) 8907>7 byte 12 (OpenBSD) 8908>7 byte 13 (OpenVMS) 8909>7 byte 14 (HP NonStop Kernel) 8910>7 byte 15 (AROS Research Operating System) 8911>7 byte 16 (FenixOS) 8912>7 byte 17 (Nuxi CloudABI) 8913>7 byte 97 (ARM) 8914>7 byte 202 (Cafe OS) 8915>7 byte 255 (embedded) 8916 8917#------------------------------------------------------------------------------ 8918# $File: encore,v 1.7 2014/04/30 21:41:02 christos Exp $ 8919# encore: file(1) magic for Encore machines 8920# 8921# XXX - needs to have the byte order specified (NS32K was little-endian, 8922# dunno whether they run the 88K in little-endian mode or not). 8923# 89240 short 0x154 Encore 8925>20 short 0x107 executable 8926>20 short 0x108 pure executable 8927>20 short 0x10b demand-paged executable 8928>20 short 0x10f unsupported executable 8929>12 long >0 not stripped 8930>22 short >0 - version %d 8931>22 short 0 - 8932#>4 date x stamp %s 89330 short 0x155 Encore unsupported executable 8934>12 long >0 not stripped 8935>22 short >0 - version %d 8936>22 short 0 - 8937#>4 date x stamp %s 8938 8939#------------------------------------------------------------------------------ 8940# $File: epoc,v 1.9 2013/12/21 14:28:15 christos Exp $ 8941# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1] 8942# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de> 8943# Useful information for improving this file can be found at: 8944# http://software.frodo.looijaard.name/psiconv/formats/Index.html 8945#------------------------------------------------------------------------------ 89460 lelong 0x10000037 Psion Series 5 8947>4 lelong 0x10000039 font file 8948>4 lelong 0x1000003A printer driver 8949>4 lelong 0x1000003B clipboard 8950>4 lelong 0x10000042 multi-bitmap image 8951!:mime image/x-epoc-mbm 8952>4 lelong 0x1000006A application information file 8953>4 lelong 0x1000006D 8954>>8 lelong 0x1000007D Sketch image 8955!:mime image/x-epoc-sketch 8956>>8 lelong 0x1000007E voice note 8957>>8 lelong 0x1000007F Word file 8958!:mime application/x-epoc-word 8959>>8 lelong 0x10000085 OPL program (TextEd) 8960!:mime application/x-epoc-opl 8961>>8 lelong 0x10000087 Comms settings 8962>>8 lelong 0x10000088 Sheet file 8963!:mime application/x-epoc-sheet 8964>>8 lelong 0x100001C4 EasyFax initialisation file 8965>4 lelong 0x10000073 OPO module 8966!:mime application/x-epoc-opo 8967>4 lelong 0x10000074 OPL application 8968!:mime application/x-epoc-app 8969>4 lelong 0x1000008A exported multi-bitmap image 8970>4 lelong 0x1000016D 8971>>8 lelong 0x10000087 Comms names 8972 89730 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image 8974 89750 lelong 0x10000050 Psion Series 5 8976>4 lelong 0x1000006D database 8977>>8 lelong 0x10000084 Agenda file 8978!:mime application/x-epoc-agenda 8979>>8 lelong 0x10000086 Data file 8980!:mime application/x-epoc-data 8981>>8 lelong 0x10000CEA Jotter file 8982!:mime application/x-epoc-jotter 8983>4 lelong 0x100000E4 ini file 8984 89850 lelong 0x10000079 Psion Series 5 binary: 8986>4 lelong 0x00000000 DLL 8987>4 lelong 0x10000049 comms hardware library 8988>4 lelong 0x1000004A comms protocol library 8989>4 lelong 0x1000005D OPX 8990>4 lelong 0x1000006C application 8991>4 lelong 0x1000008D DLL 8992>4 lelong 0x100000AC logical device driver 8993>4 lelong 0x100000AD physical device driver 8994>4 lelong 0x100000E5 file transfer protocol 8995>4 lelong 0x100000E5 file transfer protocol 8996>4 lelong 0x10000140 printer definition 8997>4 lelong 0x10000141 printer definition 8998 89990 lelong 0x1000007A Psion Series 5 executable 9000 9001#------------------------------------------------------------------------------ 9002# $File: erlang,v 1.6 2010/09/20 19:19:17 rrt Exp $ 9003# erlang: file(1) magic for Erlang JAM and BEAM files 9004# URL: http://www.erlang.org/faq/x779.html#AEN812 9005 9006# OTP R3-R4 90070 string \0177BEAM! Old Erlang BEAM file 9008>6 short >0 - version %d 9009 9010# OTP R5 and onwards 90110 string FOR1 9012>8 string BEAM Erlang BEAM file 9013 9014# 4.2 version may have a copyright notice! 90154 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 901679 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 9017 90184 string 1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995 Erlang JAM file - version 4.3 9019 90200 bequad 0x0000000000ABCDEF Erlang DETS file 9021 9022#------------------------------------------------------------------------------ 9023# $File: esri,v 1.4 2009/09/19 16:28:09 christos Exp $ 9024# ESRI Shapefile format (.shp .shx .dbf=DBaseIII) 9025# Based on info from 9026# <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf> 90270 belong 9994 ESRI Shapefile 9028>4 belong =0 9029>8 belong =0 9030>12 belong =0 9031>16 belong =0 9032>20 belong =0 9033>28 lelong x version %d 9034>24 belong x length %d 9035>32 lelong =0 type Null Shape 9036>32 lelong =1 type Point 9037>32 lelong =3 type PolyLine 9038>32 lelong =5 type Polygon 9039>32 lelong =8 type MultiPoint 9040>32 lelong =11 type PointZ 9041>32 lelong =13 type PolyLineZ 9042>32 lelong =15 type PolygonZ 9043>32 lelong =18 type MultiPointZ 9044>32 lelong =21 type PointM 9045>32 lelong =23 type PolyLineM 9046>32 lelong =25 type PolygonM 9047>32 lelong =28 type MultiPointM 9048>32 lelong =31 type MultiPatch 9049 9050#------------------------------------------------------------------------------ 9051# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $ 9052# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files 9053# From Roger Leigh <roger@whinlatter.uklinux.net> 90540 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0 90550 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0 90560 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0 9057 9058#------------------------------------------------------------------------------ 9059# $File: filesystems,v 1.124 2018/01/12 12:35:30 christos Exp $ 9060# filesystems: file(1) magic for different filesystems 9061# 90620 name partid 9063>0 ubyte 0x00 Unused 9064>0 ubyte 0x01 12-bit FAT 9065>0 ubyte 0x02 XENIX / 9066>0 ubyte 0x03 XENIX /usr 9067>0 ubyte 0x04 16-bit FAT, less than 32M 9068>0 ubyte 0x05 extended partition 9069>0 ubyte 0x06 16-bit FAT, more than 32M 9070>0 ubyte 0x07 OS/2 HPFS, NTFS, QNX2, Adv. UNIX 9071>0 ubyte 0x08 AIX or os, or etc. 9072>0 ubyte 0x09 AIX boot partition or Coherent 9073>0 ubyte 0x0a O/2 boot manager or Coherent swap 9074>0 ubyte 0x0b 32-bit FAT 9075>0 ubyte 0x0c 32-bit FAT, LBA-mapped 9076>0 ubyte 0x0d 7XXX, LBA-mapped 9077>0 ubyte 0x0e 16-bit FAT, LBA-mapped 9078>0 ubyte 0x0f extended partition, LBA-mapped 9079>0 ubyte 0x10 OPUS 9080>0 ubyte 0x11 OS/2 DOS 12-bit FAT 9081>0 ubyte 0x12 Compaq diagnostics 9082>0 ubyte 0x14 OS/2 DOS 16-bit FAT <32M 9083>0 ubyte 0x16 OS/2 DOS 16-bit FAT >=32M 9084>0 ubyte 0x17 OS/2 hidden IFS 9085>0 ubyte 0x18 AST Windows swapfile 9086>0 ubyte 0x19 Willowtech Photon coS 9087>0 ubyte 0x1b hidden win95 fat 32 9088>0 ubyte 0x1c hidden win95 fat 32 lba 9089>0 ubyte 0x1d hidden win95 fat 16 lba 9090>0 ubyte 0x20 Willowsoft OFS1 9091>0 ubyte 0x21 reserved 9092>0 ubyte 0x23 reserved 9093>0 ubyte 0x24 NEC DOS 9094>0 ubyte 0x26 reserved 9095>0 ubyte 0x31 reserved 9096>0 ubyte 0x32 Alien Internet Services NOS 9097>0 ubyte 0x33 reserved 9098>0 ubyte 0x34 reserved 9099>0 ubyte 0x35 JFS on OS2 9100>0 ubyte 0x36 reserved 9101>0 ubyte 0x38 Theos 9102>0 ubyte 0x39 Plan 9, or Theos spanned 9103>0 ubyte 0x3a Theos ver 4 4gb partition 9104>0 ubyte 0x3b Theos ve 4 extended partition 9105>0 ubyte 0x3c PartitionMagic recovery 9106>0 ubyte 0x3d Hidden Netware 9107>0 ubyte 0x40 VENIX 286 or LynxOS 9108>0 ubyte 0x41 PReP 9109>0 ubyte 0x42 linux swap sharing DRDOS disk 9110>0 ubyte 0x43 linux sharing DRDOS disk 9111>0 ubyte 0x44 GoBack change utility 9112>0 ubyte 0x45 Boot US Boot manager 9113>0 ubyte 0x46 EUMEL/Elan or Ergos 3 9114>0 ubyte 0x47 EUMEL/Elan or Ergos 3 9115>0 ubyte 0x48 EUMEL/Elan or Ergos 3 9116>0 ubyte 0x4a ALFX/THIN filesystem for DOS 9117>0 ubyte 0x4c Oberon partition 9118>0 ubyte 0x4d QNX4.x 9119>0 ubyte 0x4e QNX4.x 2nd part 9120>0 ubyte 0x4f QNX4.x 3rd part 9121>0 ubyte 0x50 DM (disk manager) 9122>0 ubyte 0x51 DM6 Aux1 (or Novell) 9123>0 ubyte 0x52 CP/M or Microport SysV/AT 9124>0 ubyte 0x53 DM6 Aux3 9125>0 ubyte 0x54 DM6 DDO 9126>0 ubyte 0x55 EZ-Drive (disk manager) 9127>0 ubyte 0x56 Golden Bow (disk manager) 9128>0 ubyte 0x57 Drive PRO 9129>0 ubyte 0x5c Priam Edisk (disk manager) 9130>0 ubyte 0x61 SpeedStor 9131>0 ubyte 0x63 GNU HURD or Mach or Sys V/386 9132>0 ubyte 0x64 Novell Netware 2.xx or Speedstore 9133>0 ubyte 0x65 Novell Netware 3.xx 9134>0 ubyte 0x66 Novell 386 Netware 9135>0 ubyte 0x67 Novell 9136>0 ubyte 0x68 Novell 9137>0 ubyte 0x69 Novell 9138>0 ubyte 0x70 DiskSecure Multi-Boot 9139>0 ubyte 0x71 reserved 9140>0 ubyte 0x73 reserved 9141>0 ubyte 0x74 reserved 9142>0 ubyte 0x75 PC/IX 9143>0 ubyte 0x76 reserved 9144>0 ubyte 0x77 M2FS/M2CS partition 9145>0 ubyte 0x78 XOSL boot loader filesystem 9146>0 ubyte 0x80 MINIX until 1.4a 9147>0 ubyte 0x81 MINIX since 1.4b 9148>0 ubyte 0x82 Linux swap or Solaris 9149>0 ubyte 0x83 Linux native 9150>0 ubyte 0x84 OS/2 hidden C: drive 9151>0 ubyte 0x85 Linux extended partition 9152>0 ubyte 0x86 NT FAT volume set 9153>0 ubyte 0x87 NTFS volume set or HPFS mirrored 9154>0 ubyte 0x8a Linux Kernel AiR-BOOT partition 9155>0 ubyte 0x8b Legacy Fault tolerant FAT32 9156>0 ubyte 0x8c Legacy Fault tolerant FAT32 ext 9157>0 ubyte 0x8d Hidden free FDISK FAT12 9158>0 ubyte 0x8e Linux Logical Volume Manager 9159>0 ubyte 0x90 Hidden free FDISK FAT16 9160>0 ubyte 0x91 Hidden free FDISK DOS EXT 9161>0 ubyte 0x92 Hidden free FDISK FAT16 Big 9162>0 ubyte 0x93 Amoeba filesystem 9163>0 ubyte 0x94 Amoeba bad block table 9164>0 ubyte 0x95 MIT EXOPC native partitions 9165>0 ubyte 0x97 Hidden free FDISK FAT32 9166>0 ubyte 0x98 Datalight ROM-DOS Super-Boot 9167>0 ubyte 0x99 Mylex EISA SCSI 9168>0 ubyte 0x9a Hidden free FDISK FAT16 LBA 9169>0 ubyte 0x9b Hidden free FDISK EXT LBA 9170>0 ubyte 0x9f BSDI? 9171>0 ubyte 0xa0 IBM Thinkpad hibernation 9172>0 ubyte 0xa1 HP Volume expansion (SpeedStor) 9173>0 ubyte 0xa3 HP Volume expansion (SpeedStor) 9174>0 ubyte 0xa4 HP Volume expansion (SpeedStor) 9175>0 ubyte 0xa5 386BSD partition type 9176>0 ubyte 0xa6 OpenBSD partition type 9177>0 ubyte 0xa7 NeXTSTEP 486 9178>0 ubyte 0xa8 Apple UFS 9179>0 ubyte 0xa9 NetBSD partition type 9180>0 ubyte 0xaa Olivetty Fat12 1.44MB Service part 9181>0 ubyte 0xab Apple Boot 9182>0 ubyte 0xae SHAG OS filesystem 9183>0 ubyte 0xaf Apple HFS 9184>0 ubyte 0xb0 BootStar Dummy 9185>0 ubyte 0xb1 reserved 9186>0 ubyte 0xb3 reserved 9187>0 ubyte 0xb4 reserved 9188>0 ubyte 0xb6 reserved 9189>0 ubyte 0xb7 BSDI BSD/386 filesystem 9190>0 ubyte 0xb8 BSDI BSD/386 swap 9191>0 ubyte 0xbb Boot Wizard Hidden 9192>0 ubyte 0xbe Solaris 8 partition type 9193>0 ubyte 0xbf Solaris partition type 9194>0 ubyte 0xc0 CTOS 9195>0 ubyte 0xc1 DRDOS/sec (FAT-12) 9196>0 ubyte 0xc2 Hidden Linux 9197>0 ubyte 0xc3 Hidden Linux swap 9198>0 ubyte 0xc4 DRDOS/sec (FAT-16, < 32M) 9199>0 ubyte 0xc5 DRDOS/sec (EXT) 9200>0 ubyte 0xc6 DRDOS/sec (FAT-16, >= 32M) 9201>0 ubyte 0xc7 Syrinx (Cyrnix?) or HPFS disabled 9202>0 ubyte 0xc8 Reserved for DR-DOS 8.0+ 9203>0 ubyte 0xc9 Reserved for DR-DOS 8.0+ 9204>0 ubyte 0xca Reserved for DR-DOS 8.0+ 9205>0 ubyte 0xcb DR-DOS 7.04+ Secured FAT32 CHS 9206>0 ubyte 0xcc DR-DOS 7.04+ Secured FAT32 LBA 9207>0 ubyte 0xcd CTOS Memdump 9208>0 ubyte 0xce DR-DOS 7.04+ FAT16X LBA 9209>0 ubyte 0xcf DR-DOS 7.04+ EXT LBA 9210>0 ubyte 0xd0 REAL/32 secure big partition 9211>0 ubyte 0xd1 Old Multiuser DOS FAT12 9212>0 ubyte 0xd4 Old Multiuser DOS FAT16 Small 9213>0 ubyte 0xd5 Old Multiuser DOS Extended 9214>0 ubyte 0xd6 Old Multiuser DOS FAT16 Big 9215>0 ubyte 0xd8 CP/M 86 9216>0 ubyte 0xdb CP/M or Concurrent CP/M 9217>0 ubyte 0xdd Hidden CTOS Memdump 9218>0 ubyte 0xde Dell PowerEdge Server utilities 9219>0 ubyte 0xdf DG/UX virtual disk manager 9220>0 ubyte 0xe0 STMicroelectronics ST AVFS 9221>0 ubyte 0xe1 DOS access or SpeedStor 12-bit 9222>0 ubyte 0xe3 DOS R/O or Storage Dimensions 9223>0 ubyte 0xe4 SpeedStor 16-bit FAT < 1024 cyl. 9224>0 ubyte 0xe5 reserved 9225>0 ubyte 0xe6 reserved 9226>0 ubyte 0xeb BeOS 9227>0 ubyte 0xee GPT Protective MBR 9228>0 ubyte 0xef EFI system partition 9229>0 ubyte 0xf0 Linux PA-RISC boot loader 9230>0 ubyte 0xf1 SpeedStor or Storage Dimensions 9231>0 ubyte 0xf2 DOS 3.3+ Secondary 9232>0 ubyte 0xf3 reserved 9233>0 ubyte 0xf4 SpeedStor large partition 9234>0 ubyte 0xf5 Prologue multi-volumen partition 9235>0 ubyte 0xf6 reserved 9236>0 ubyte 0xf9 pCache: ext2/ext3 persistent cache 9237>0 ubyte 0xfa Bochs x86 emulator 9238>0 ubyte 0xfb VMware File System 9239>0 ubyte 0xfc VMware Swap 9240>0 ubyte 0xfd Linux RAID partition persistent sb 9241>0 ubyte 0xfe LANstep or IBM PS/2 IML 9242>0 ubyte 0xff Xenix Bad Block Table 9243 92440 string \366\366\366\366 PC formatted floppy with no filesystem 9245# Sun disk labels 9246# From /usr/include/sun/dklabel.h: 92470774 beshort 0xdabe 9248# modified by Joerg Jenderek, because original test 9249# succeeds for Cabinet archive dao360.dl_ with negative blocks 9250>0770 long >0 Sun disk label 9251>>0 string x '%s 9252>>>31 string >\0 \b%s 9253>>>>63 string >\0 \b%s 9254>>>>>95 string >\0 \b%s 9255>>0 string x \b' 9256>>0734 short >0 %d rpm, 9257>>0736 short >0 %d phys cys, 9258>>0740 short >0 %d alts/cyl, 9259>>0746 short >0 %d interleave, 9260>>0750 short >0 %d data cyls, 9261>>0752 short >0 %d alt cyls, 9262>>0754 short >0 %d heads/partition, 9263>>0756 short >0 %d sectors/track, 9264>>0764 long >0 start cyl %d, 9265>>0770 long x %d blocks 9266# Is there a boot block written 1 sector in? 9267>512 belong&077777777 0600407 \b, boot block present 9268 9269# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk 9270# (http://btmgr.sourceforge.net/docs/user-guide-3.html) 92710 string SBMBAKUP_ Smart Boot Manager backup file 9272>9 string x \b, version %-5.5s 9273>>14 string =_ 9274>>>15 string x %-.1s 9275>>>>16 string =_ \b. 9276>>>>>17 string x \b%-.1s 9277>>>>>>18 string =_ \b. 9278>>>>>>>19 string x \b%-.1s 9279>>>22 ubyte 0 9280>>>>21 ubyte x \b, from drive 0x%x 9281>>>22 ubyte >0 9282>>>>21 string x \b, from drive %s 9283>>>535 search/17 \x55\xAA 9284>>>>&-512 indirect x \b; contains 9285 9286# updated by Joerg Jenderek at Nov 2012 9287# DOS Emulator image is 128 byte, null right padded header + harddisc image 92880 string DOSEMU\0 9289>0x27E leshort 0xAA55 9290#offset is 128 9291>>19 ubyte 128 9292>>>(19.b-1) ubyte 0x0 DOS Emulator image 9293>>>>7 ulelong >0 \b, %u heads 9294>>>>11 ulelong >0 \b, %d sectors/track 9295>>>>15 ulelong >0 \b, %d cylinders 9296>>>>128 indirect x \b; contains 9297 9298# added by Joerg Jenderek at Nov 2012 9299# http://www.thenakedpc.com/articles/v04/08/0408-05.html 9300# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data 93010 string PNCIHISK\0 Norton Utilities disc image data 9302# real x86 boot sector with jump instruction 9303>509 search/1026 \x55\xAA\xeb 9304>>&-1 indirect x \b; contains 9305# http://file-extension.net/seeker/file_extension_dat 93060 string PNCIUNDO Norton Disk Doctor UnDo file 9307# 9308 9309# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013 9310# for any allowed sector sizes 931130 search/481 \x55\xAA 9312# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111) 9313# DOS BPB information (70) and after DOS floppy (120) like in previous file version 9314!:strength +65 9315# for sector sizes < 512 Bytes 9316>11 uleshort <512 9317>>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector 9318# for sector sizes with 512 or more Bytes 9319>0x1FE leshort 0xAA55 DOS/MBR boot sector 9320 9321# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying 9322# only for sector sizes with 512 or more Bytes 93230x1FE leshort 0xAA55 DOS/MBR boot sector 9324# 9325# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version 9326!:strength +65 9327>2 string OSBS OS/BS MBR 9328# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/ 9329# and http://en.wikipedia.org/wiki/Master_Boot_Record 9330# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by 9331# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00 9332>0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR 9333# Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) 9334# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld 9335>>8 ubequad 0x8bf45007501ffbfc 9336# http://thestarman.pcministry.com/asm/mbr/200MBR.htm 9337>>>0x16 ubyte 0xF3 \b,DOS 2 9338>>>>219 regex Author\ -\ Author: 9339# found "David Litton" , "A Pehrsson " 9340>>>>>&0 string x "%s" 9341>>>0x16 ubyte 0xF2 9342# NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm 9343# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz 9344>>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3 9345# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111) 9346>>>>0x22 default x \b,D0S version 3.3-7.0 9347# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...) 9348# where nn is string offset varying for different languages 9349# "Invalid partition table" nn=0x8b for english version 9350>>>>>(0x49.b) string Invalid\ partition\ table english 9351>>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german 9352>>>>>(0x49.b) string Table\ de\ partition\ invalide french 9353>>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese 9354>>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish 9355>>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian 9356>>>>>0x49 ubyte >0 at offset 0x%x 9357>>>>>>(0x49.b) string >\0 "%s" 9358# "Error loading operating system" nn=0xa3 for english version 9359# "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version 9360# "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version 9361# "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version 9362# "Error al cargar sistema operativo" nn=0xa8 for spanish version 9363# "Errore durante il caricamento del sistema operativo" nn=0xae for italian version 9364>>>>>0x74 ubyte >0 at offset 0x%x 9365>>>>>>(0x74.b) string >\0 "%s" 9366# "Missing operating system" nn=0xc2 for english version 9367# "Betriebssystem fehlt" nn=0xcd for german version 9368# "Syst\212me d'exploitation absent" nn=0xd2 for french version 9369# "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version 9370# "Falta sistema operativo" nn=0xca for spanish version 9371# "Sistema operativo mancante" nn=0xe2 for italian version 9372>>>>>0x79 ubyte >0 at offset 0x%x 9373>>>>>>(0x79.b) string >\0 "%s" 9374# Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) 9375# assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b 9376>>8 ubequad 0x5007501ffcbe1b7c 9377# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04 9378>>>24 ubequad 0xf3a4cbbebe07b104 9M 9379# "Invalid partition table" nn=0x10F for english version 9380# "Ung\201ltige Partitionstabelle" nn=0x10F for german version 9381# "Table de partition erron\202e" nn=0x10F for french version 9382# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version 9383>>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english 9384>>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german 9385>>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french 9386>>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian 9387>>>>0x3C ubyte x at offset 0x%x+0xFF 9388>>>>(0x3C.b+0x0FF) string >\0 "%s" 9389# "Error loading operating system" nn=0x127 for english version 9390# "Fehler beim Laden des Betriebssystems" nn=0x12b for german version 9391# "Erreur lors du chargement du syst\212me d'exploitation" nn=0x12a for french version 9392# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version 9393>>>>0xBD ubyte x at offset 0x1%x 9394>>>>(0xBD.b+0x100) string >\0 "%s" 9395# "Missing operating system" nn=0x146 for english version 9396# "Betriebssystem fehlt" nn=0x151 for german version 9397# "Syst\212me d'exploitation manquant" nn=0x15e for french version 9398# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version 9399>>>>0xA9 ubyte x at offset 0x1%x 9400>>>>(0xA9.b+0x100) string >\0 "%s" 9401# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm 9402# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04 9403>>>24 ubequad 0xf3a4cbbdbe07b104 XP 9404# where xxyyzz are lower bits from offsets of error messages varying for different languages 9405>>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english 9406>>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german 9407# "Invalid partition table" xx=0x12C for english version 9408# "Ung\201ltige Partitionstabelle" xx=0x12C for german version 9409>>>>0x1b5 ubyte >0 at offset 0x1%x 9410>>>>(0x1b5.b+0x100) string >\0 "%s" 9411# "Error loading operating system" yy=0x144 for english version 9412# "Fehler beim Laden des Betriebssystems" yy=0x148 for german version 9413>>>>0x1b6 ubyte >0 at offset 0x1%x 9414>>>>(0x1b6.b+0x100) string >\0 "%s" 9415# "Missing operating system" zz=0x163 for english version 9416# "Betriebssystem nicht vorhanden" zz=0x16e for german version 9417>>>>0x1b7 ubyte >0 at offset 0x1%x 9418>>>>(0x1b7.b+0x100) string >\0 "%s" 9419# Microsoft Windows Vista or 7 9420# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00 9421>>8 ubequad 0xc08ed8be007cbf00 9422# Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) 9423# assembler instructions: jnz 0729;cmp ebx,"TCPA" 9424>>>0xEC ubequad 0x753b6681fb544350 Vista 9425# where xxyyzz are lower bits from offsets of error messages varying for different languages 9426>>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english 9427#>>>>0x1B4 ubelong&0x00FFFFFF ? german 9428# "Invalid partition table" xx=0x162 for english version 9429# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version 9430>>>>0x1b5 ubyte >0 at offset 0x1%x 9431>>>>(0x1b5.b+0x100) string >\0 "%s" 9432# "Error loading operating system" yy=0x17a for english version 9433# "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version 9434>>>>0x1b6 ubyte >0 at offset 0x1%x 9435>>>>(0x1b6.b+0x100) string >\0 "%s" 9436# "Missing operating system" zz=0x199 for english version 9437# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 9438>>>>0x1b7 ubyte >0 at offset 0x1%x 9439>>>>(0x1b7.b+0x100) string >\0 "%s" 9440# Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm) 9441# assembler instructions: cmp ebx,"TCPA";cmp 9442>>>0xEC ubequad 0x6681fb5443504175 Windows 7 9443# where xxyyzz are lower bits from offsets of error messages varying for different languages 9444>>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english 9445#>>>>0x1B4 ubelong&0x00FFFFFF ? german 9446# "Invalid partition table" xx=0x163 for english version 9447# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version 9448>>>>0x1b5 ubyte >0 at offset 0x1%x 9449>>>>(0x1b5.b+0x100) string >\0 "%s" 9450# "Error loading operating system" yy=0x17b for english version 9451# "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version 9452>>>>0x1b6 ubyte >0 at offset 0x1%x 9453>>>>(0x1b6.b+0x100) string >\0 "%s" 9454# "Missing operating system" zz=0x19a for english version 9455# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 9456>>>>0x1b7 ubyte >0 at offset 0x1%x 9457>>>>(0x1b7.b+0x100) string >\0 "%s" 9458# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs 9459# http://en.wikipedia.org/wiki/MBR_disk_signature#ID 9460>>0x1b8 ulelong >0 \b, disk signature 0x%-.4x 9461# driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm 9462>>0xDA uleshort 0 9463>>>0xDC ulelong >0 \b, created 9464# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive 9465>>>>0xDC ubyte x with driveID 0x%x 9466# hours, minutes and seconds 9467>>>>0xDf ubyte x at %x 9468>>>>0xDe ubyte x \b:%x 9469>>>>0xDd ubyte x \b:%x 9470# special case for Microsoft MS-DOS 3.21 spanish 9471# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov 9472>0 ubequad 0xfab830008ed0bc00 9473# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov 9474>>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish 9475# Microsoft MBR IPL end 9476 9477# dr-dos with some upper-, lowercase variants 9478>0x9D string Invalid\ partition\ table$ 9479>>181 string No\ Operating\ System$ 9480>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 9481>0x9D string Invalid\ partition\ table$ 9482>>181 string No\ operating\ system$ 9483>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 9484>342 string Invalid\ partition\ table$ 9485>>366 string No\ operating\ system$ 9486>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03 9487>295 string NEWLDR\0 9488>>302 string Bad\ PT\ $ 9489>>>310 string No\ OS\ $ 9490>>>>317 string OS\ load\ err$ 9491>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r 9492>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ 9493>>>>>>>387 string Copyright\ (c)\ 1984,1998 9494>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) 9495# 9496# tests for different MS-DOS Master Boot Records (MBR) moved and merged 9497# 9498#>0x145 string Default:\ F \b, FREE-DOS MBR 9499#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR 9500>0x145 search/7 Default:\ F \b, FREE-DOS MBR 9501#>>313 string F0\ .\ .\ . 9502#>>>322 string disk\ 1 9503#>>>>382 string FAT3 9504>64 string no\ active\ partition\ found 9505>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR 9506# Ranish Partition Manager http://www.ranish.com/part/ 9507>387 search/4 \0\ Error!\r 9508>>378 search/7 Virus! 9509>>>397 search/4 Booting\040 9510>>>>408 search/4 HD1/\0 \b, Ranish MBR ( 9511>>>>>416 string Writing\ changes... \b2.37 9512>>>>>>438 ubyte x \b,0x%x dots 9513>>>>>>440 ubyte >0 \b,virus check 9514>>>>>>441 ubyte >0 \b,partition %c 9515#2.38,2.42,2.44 9516>>>>>416 string !Writing\ changes... \b 9517>>>>>>418 ubyte 1 \bvirus check, 9518>>>>>>419 ubyte x \b0x%x seconds 9519>>>>>>420 ubyte&0x0F >0 \b,partition 9520>>>>>>>420 ubyte&0x0F <5 \b %x 9521>>>>>>>420 ubyte&0x0F 0Xf \b ask 9522>>>>>420 ubyte x \b) 9523# 9524# SYSLINUX MBR moved 9525# http://www.acronis.de/ 9526>362 string MBR\ Error\ \0\r 9527>>376 string ress\ any\ key\ to\040 9528>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR 9529# added by Joerg Jenderek 9530# http://www.visopsys.org/ 9531# http://partitionlogic.org.uk/ 9532>309 string No\ bootable\ partition\ found\r 9533>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR 9534>349 string No\ bootable\ partition\ found\r 9535>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR 9536# bootloader, bootmanager 9537>0x40 string SBML 9538# label with 11 characters of FAT 12 bit filesystem 9539>>43 string SMART\ BTMGR 9540>>>430 string SBMK\ Bad!\r \b, Smart Boot Manager 9541# OEM-ID not always "SBM" 9542#>>>>3 strings SBM 9543>>>>6 string >\0 \b, version %s 9544>382 string XOSLLOADXCF \b, eXtended Operating System Loader 9545>6 string LILO \b, LInux i386 boot LOader 9546>>120 string LILO \b, version 22.3.4 SuSe 9547>>172 string LILO \b, version 22.5.8 Debian 9548# updated by Joerg Jenderek at Oct 2008 9549# variables according to grub-0.97/stage1/stage1.S or 9550# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 9551# usual values are marked with comments to get only informations of strange GRUB loaders 9552>342 search/60 \0Geom\0 9553#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0 9554>>0x41 ubyte <2 9555>>>0x3E ubyte >2 \b; GRand Unified Bootloader 9556# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 9557>>>>0x3E ubyte x \b, stage1 version 0x%x 9558#If it is 0xFF, use a drive passed by BIOS 9559>>>>0x40 ubyte <0xFF \b, boot drive 0x%x 9560# in most case 0,1,0x2e for GRUB 0.5.95 9561>>>>0x41 ubyte >0 \b, LBA flag 0x%x 9562>>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x 9563#>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual) 9564>>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x 9565#>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default) 9566>>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x 9567>>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x 9568#>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual) 9569>>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x 9570>>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0 9571>>>>>394 string stage1 \b, GRUB version 0.5.95 9572>>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0 9573>>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94 9574>>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0 9575>>>>>377 string GRUB\ \0 \b, GRUB version 0.94 9576>>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 9577>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96 9578>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0 9579>>>>>385 string GRUB\ \0 \b, GRUB version 0.97 9580# unknown version 9581>>>343 string Geom\0Read\0\ Error\0 9582>>>>321 string Loading\ stage1.5 \b, GRUB version x.y 9583>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0 9584>>>>374 string GRUB\ \0 \b, GRUB version n.m 9585# SYSLINUX bootloader moved 9586>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader 9587# http://www.bcdwb.de/bcdw/index_e.htm 9588>3 string BCDL 9589>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) 9590# mbr partition table entries updated by Joerg Jenderek at Sep 2013 9591# skip Norton Utilities disc image data 9592>3 string !IHISK 9593# skip Linux style boot sector starting with assember instructions mov 0x7c0,ax; 9594>>0 belong !0xb8c0078e 9595# not Linux kernel 9596>>>514 string !HdrS 9597# not BeOS 9598>>>>422 string !Be\ Boot\ Loader 9599# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr 9600>>>>>0 ubelong&0xFD000000 =0xE9000000 9601# AdvanceMAME mbr 9602>>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e 9603>>>>>>>446 use partition-table 9604# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader 9605>>>>>0 ubelong&0xFD000000 !0xE9000000 9606# skip FSInfosector 9607>>>>>>0 string !RRaA 9608# skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX, 9609# http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm 9610>>>>>>>0 ubequad !0xfa660fb64610668b 9611# skip 13rd sector of MS x86 bootloader 9612>>>>>>>>0 ubequad !0x660fb64610668b4e 9613# skip sector starting with DOS new line 9614>>>>>>>>>0 string !\r\n 9615# allowed active flag 0,80h-FFh 9616>>>>>>>>>>446 ubyte 0 9617>>>>>>>>>>>446 use partition-table 9618>>>>>>>>>>446 ubyte >0x7F 9619>>>>>>>>>>>446 use partition-table 9620# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries 9621# mbr partition table entries end 9622# http://www.acronis.de/ 9623#FAT label=ACRONIS\ SZ 9624#OEM-ID=BOOTWIZ0 9625>442 string Non-system\ disk,\040 9626>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader 9627# updated by Joerg Jenderek at Nov 2012, Sep 2013 9628# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes 9629# display 1 space 9630>>>447 ubyte x \b 9631>>>477 use DOS-filename 9632# 9633>185 string FDBOOT\ Version\040 9634>>204 string \rNo\ Systemdisk.\040 9635>>>220 string Booting\ from\ harddisk.\n\r 9636>>>245 string Cannot\ load\ from\ harddisk.\n\r 9637>>>>273 string Insert\ Systemdisk\040 9638>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader 9639>>>>>>200 string >\0 \b, version %-3s 9640>242 string Bootsector\ from\ C.H.\ Hochst\204 9641# http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c 9642# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string 9643# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut 9644>242 search/127 Bootsector\ from\ C.H.\ Hochst 9645>>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk 9646# followed by variants with point,CR-NL or NL-CR 9647>>>208 search/261 Cannot\ load\ from\ harddisk. 9648# followed by variants CR-NL or NL-CR 9649>>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key. 9650# followed by variants with point,CR-NL or NL-CR 9651>>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader 9652# followed by string like "6.50 (c) 1993-2004 Gilles Vollant" 9653>>>>>>&0 string x \b, version %-4.4s 9654>(1.b+2) ubyte 0xe 9655>>(1.b+3) ubyte 0x1f 9656>>>(1.b+4) ubyte 0xbe 9657# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others 9658>>>>(1.b+5) ubyte&0xd3 0x53 9659>>>>>(1.b+6) ubyte 0x7c 9660# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah, 9661>>>>>>(1.b+7) ubyte 0xac 9662>>>>>>>(1.b+8) ubyte 0x22 9663>>>>>>>>(1.b+9) ubyte 0xc0 9664>>>>>>>>>(1.b+10) ubyte 0x74 9665>>>>>>>>>>(1.b+11) ubyte 0x0b 9666>>>>>>>>>>>(1.b+12) ubyte 0x56 9667>>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display 9668# FAT1X version 9669>>>>>>>>>>>>>(1.b+5) ubyte 0x5b 9670>>>>>>>>>>>>>>0x5b string >\0 "%-s" 9671# FAT32 version 9672>>>>>>>>>>>>>(1.b+5) ubyte 0x77 9673>>>>>>>>>>>>>>0x77 string >\0 "%-s" 9674>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display 9675#>>244 string from\ dosemu-freedos-*-bin.tgz\r 9676#>>>170 string Sorry,\ could\ not\ load\ an\040 9677#>>>>195 string operating\ system.\r\n 9678# 9679>103 string This\ is\ not\ a\ bootable\ disk.\040 9680>>132 string Please\ insert\ a\ bootable\040 9681>>>157 string floppy\ and\r\n 9682>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display 9683# 9684>66 string Solaris\ Boot\ Sector 9685>>99 string Incomplete\ MDBoot\ load. 9686>>>89 string Version \b, Sun Solaris Bootloader 9687>>>>97 byte x version %c 9688# 9689>408 string OS/2\ !!\ SYS01475\r\0 9690>>429 string OS/2\ !!\ SYS02025\r\0 9691>>>450 string OS/2\ !!\ SYS02027\r\0 9692>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader 9693# 9694>409 string OS/2\ !!\ SYS01475\r\0 9695>>430 string OS/2\ !!\ SYS02025\r\0 9696>>>451 string OS/2\ !!\ SYS02027\r\0 9697>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader 9698>112 string This\ disk\ is\ not\ bootable\r 9699>>142 string If\ you\ wish\ to\ make\ it\ bootable 9700>>>176 string run\ the\ DOS\ program\ SYS\040 9701>>>200 string after\ the\r 9702>>>>216 string system\ has\ been\ loaded\r\n 9703>>>>>242 string Please\ insert\ a\ DOS\ diskette\040 9704>>>>>271 string into\r\n\ the\ drive\ and\040 9705>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display 9706# XP 9707>430 string NTLDR\ is\ missing\xFF\r\n 9708>>449 string Disk\ error\xFF\r\n 9709>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader 9710# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes 9711>>>>417 ubyte&0xDF >0 9712>>>>>417 string x %-.5s 9713>>>>>>422 ubyte&0xDF >0 9714>>>>>>>422 string x \b%-.3s 9715>>>>>425 ubyte&0xDF >0 9716>>>>>>425 string >\ \b.%-.3s 9717# 9718>>>>371 ubyte >0x20 9719>>>>>368 ubyte&0xDF >0 9720>>>>>>368 string x %-.5s 9721>>>>>>>373 ubyte&0xDF >0 9722>>>>>>>>373 string x \b%-.3s 9723>>>>>>376 ubyte&0xDF >0 9724>>>>>>>376 string x \b.%-.3s 9725# 9726>430 string NTLDR\ nicht\ gefunden\xFF\r\n 9727>>453 string Datentr\204gerfehler\xFF\r\n 9728>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) 9729>>>>417 ubyte&0xDF >0 9730>>>>>417 string x %-.5s 9731>>>>>>422 ubyte&0xDF >0 9732>>>>>>>422 string x \b%-.3s 9733>>>>>425 ubyte&0xDF >0 9734>>>>>>425 string >\ \b.%-.3s 9735# offset variant 9736>>>>379 string \0 9737>>>>>368 ubyte&0xDF >0 9738>>>>>>368 string x %-.5s 9739>>>>>>>373 ubyte&0xDF >0 9740>>>>>>>>373 string x \b%-.3s 9741# 9742>430 string NTLDR\ fehlt\xFF\r\n 9743>>444 string Datentr\204gerfehler\xFF\r\n 9744>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) 9745>>>>417 ubyte&0xDF >0 9746>>>>>417 string x %-.5s 9747>>>>>>422 ubyte&0xDF >0 9748>>>>>>>422 string x \b%-.3s 9749>>>>>425 ubyte&0xDF >0 9750>>>>>>425 string >\ \b.%-.3s 9751# variant 9752>>>>371 ubyte >0x20 9753>>>>>368 ubyte&0xDF >0 9754>>>>>>368 string x %-.5s 9755>>>>>>>373 ubyte&0xDF >0 9756>>>>>>>>373 string x \b%-.3s 9757>>>>>>376 ubyte&0xDF >0 9758>>>>>>>376 string x \b.%-.3s 9759# 9760>430 string NTLDR\ fehlt\xFF\r\n 9761>>444 string Medienfehler\xFF\r\n 9762>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) 9763>>>>371 ubyte >0x20 9764>>>>>368 ubyte&0xDF >0 9765>>>>>>368 string x %-.5s 9766>>>>>>>373 ubyte&0xDF >0 9767>>>>>>>>373 string x \b%-.3s 9768>>>>>>376 ubyte&0xDF >0 9769>>>>>>>376 string x \b.%-.3s 9770# variant 9771>>>>417 ubyte&0xDF >0 9772>>>>>417 string x %-.5s 9773>>>>>>422 ubyte&0xDF >0 9774>>>>>>>422 string x \b%-.3s 9775>>>>>425 ubyte&0xDF >0 9776>>>>>>425 string >\ \b.%-.3s 9777# 9778>430 string Datentr\204ger\ entfernen\xFF\r\n 9779>>454 string Medienfehler\xFF\r\n 9780>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) 9781>>>>379 string \0 9782>>>>>368 ubyte&0xDF >0 9783>>>>>>368 string x %-.5s 9784>>>>>>>373 ubyte&0xDF >0 9785>>>>>>>>373 string x \b%-.3s 9786>>>>>>376 ubyte&0xDF >0 9787>>>>>>>376 string x \b.%-.3s 9788# variant 9789>>>>417 ubyte&0xDF >0 9790>>>>>417 string x %-.5s 9791>>>>>>422 ubyte&0xDF >0 9792>>>>>>>422 string x \b%-.3s 9793>>>>>425 ubyte&0xDF >0 9794>>>>>>425 string >\ \b.%-.3s 9795# 9796 9797#>3 string NTFS\ \ \ \040 9798>389 string Fehler\ beim\ Lesen\040 9799>>407 string des\ Datentr\204gers 9800>>>426 string NTLDR\ fehlt 9801>>>>440 string NTLDR\ ist\ komprimiert 9802>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) 9803#>3 string NTFS\ \ \ \040 9804>313 string A\ disk\ read\ error\ occurred.\r 9805>>345 string A\ kernel\ file\ is\ missing\040 9806>>>370 string from\ the\ disk.\r 9807>>>>484 string NTLDR\ is\ compressed 9808>>>>>429 string Insert\ a\ system\ diskette\040 9809>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS 9810# DOS loader variants different languages,offsets 9811>472 ubyte&0xDF >0 9812>>389 string Invalid\ system\ disk\xFF\r\n 9813>>>411 string Disk\ I/O\ error 9814>>>>428 string Replace\ the\ disk,\ and\040 9815>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader 9816#IO.SYS 9817>>>>>>472 ubyte&0xDF >0 9818>>>>>>>472 string x \b %-.2s 9819>>>>>>>>474 ubyte&0xDF >0 9820>>>>>>>>>474 string x \b%-.5s 9821>>>>>>>>>>479 ubyte&0xDF >0 9822>>>>>>>>>>>479 string x \b%-.1s 9823>>>>>>>480 ubyte&0xDF >0 9824>>>>>>>>480 string x \b.%-.3s 9825#MSDOS.SYS 9826>>>>>>>483 ubyte&0xDF >0 \b+ 9827>>>>>>>>483 string x \b%-.5s 9828>>>>>>>>>488 ubyte&0xDF >0 9829>>>>>>>>>>488 string x \b%-.3s 9830>>>>>>>>491 ubyte&0xDF >0 9831>>>>>>>>>491 string x \b.%-.3s 9832# 9833>>390 string Invalid\ system\ disk\xFF\r\n 9834>>>412 string Disk\ I/O\ error\xFF\r\n 9835>>>>429 string Replace\ the\ disk,\ and\040 9836>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader 9837>>388 string Ungueltiges\ System\ \xFF\r\n 9838>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n 9839>>>>427 string Datentraeger\ wechseln\ und\040 9840>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) 9841#WINBOOT.SYS only not spaces (0xDF) 9842>>>>>>497 ubyte&0xDF >0 9843>>>>>>>497 string x %-.5s 9844>>>>>>>>502 ubyte&0xDF >0 9845>>>>>>>>>502 string x \b%-.1s 9846>>>>>>>>>>503 ubyte&0xDF >0 9847>>>>>>>>>>>503 string x \b%-.1s 9848>>>>>>>>>>>>504 ubyte&0xDF >0 9849>>>>>>>>>>>>>504 string x \b%-.1s 9850>>>>>>505 ubyte&0xDF >0 9851>>>>>>>505 string x \b.%-.3s 9852#IO.SYS 9853>>>>>>472 ubyte&0xDF >0 or 9854>>>>>>>472 string x \b %-.2s 9855>>>>>>>>474 ubyte&0xDF >0 9856>>>>>>>>>474 string x \b%-.5s 9857>>>>>>>>>>479 ubyte&0xDF >0 9858>>>>>>>>>>>479 string x \b%-.1s 9859>>>>>>>480 ubyte&0xDF >0 9860>>>>>>>>480 string x \b.%-.3s 9861#MSDOS.SYS 9862>>>>>>>483 ubyte&0xDF >0 \b+ 9863>>>>>>>>483 string x \b%-.5s 9864>>>>>>>>>488 ubyte&0xDF >0 9865>>>>>>>>>>488 string x \b%-.3s 9866>>>>>>>>491 ubyte&0xDF >0 9867>>>>>>>>>491 string x \b.%-.3s 9868# 9869>>390 string Ungueltiges\ System\ \xFF\r\n 9870>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n 9871>>>>429 string Datentraeger\ wechseln\ und\040 9872>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) 9873#WINBOOT.SYS only not spaces (0xDF) 9874>>>>>>497 ubyte&0xDF >0 9875>>>>>>>497 string x %-.7s 9876>>>>>>>>504 ubyte&0xDF >0 9877>>>>>>>>>504 string x \b%-.1s 9878>>>>>>505 ubyte&0xDF >0 9879>>>>>>>505 string x \b.%-.3s 9880#IO.SYS 9881>>>>>>472 ubyte&0xDF >0 or 9882>>>>>>>472 string x \b %-.2s 9883>>>>>>>>474 ubyte&0xDF >0 9884>>>>>>>>>474 string x \b%-.6s 9885>>>>>>>480 ubyte&0xDF >0 9886>>>>>>>>480 string x \b.%-.3s 9887#MSDOS.SYS 9888>>>>>>>483 ubyte&0xDF >0 \b+ 9889>>>>>>>>483 string x \b%-.5s 9890>>>>>>>>>488 ubyte&0xDF >0 9891>>>>>>>>>>488 string x \b%-.3s 9892>>>>>>>>491 ubyte&0xDF >0 9893>>>>>>>>>491 string x \b.%-.3s 9894# 9895>>389 string Ungueltiges\ System\ \xFF\r\n 9896>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n 9897>>>>428 string Datentraeger\ wechseln\ und\040 9898>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) 9899# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes 9900>>>>>>472 string x %-.2s 9901>>>>>>>474 ubyte&0xDF >0 9902>>>>>>>>474 string x \b%-.5s 9903>>>>>>>>479 ubyte&0xDF >0 9904>>>>>>>>>479 string x \b%-.1s 9905>>>>>>480 ubyte&0xDF >0 9906>>>>>>>480 string x \b.%-.3s 9907>>>>>>483 ubyte&0xDF >0 \b+ 9908>>>>>>>483 string x \b%-.5s 9909>>>>>>>488 ubyte&0xDF >0 9910>>>>>>>>488 string x \b%-.2s 9911>>>>>>>>490 ubyte&0xDF >0 9912>>>>>>>>>490 string x \b%-.1s 9913>>>>>>>491 ubyte&0xDF >0 9914>>>>>>>>491 string x \b.%-.3s 9915>479 ubyte&0xDF >0 9916>>416 string Kein\ System\ oder\040 9917>>>433 string Laufwerksfehler 9918>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) 9919#IO.SYS 9920>>>>>479 string x \b %-.2s 9921>>>>>>481 ubyte&0xDF >0 9922>>>>>>>481 string x \b%-.6s 9923>>>>>487 ubyte&0xDF >0 9924>>>>>>487 string x \b.%-.3s 9925#MSDOS.SYS 9926>>>>>>490 ubyte&0xDF >0 \b+ 9927>>>>>>>490 string x \b%-.5s 9928>>>>>>>>495 ubyte&0xDF >0 9929>>>>>>>>>495 string x \b%-.3s 9930>>>>>>>498 ubyte&0xDF >0 9931>>>>>>>>498 string x \b.%-.3s 9932# 9933>376 search/41 Non-System\ disk\ or\040 9934>>395 search/41 disk\ error\r 9935>>>407 search/41 Replace\ and\040 9936>>>>419 search/41 press\ \b, 9937>>>>419 search/41 strike\ \b, old 9938>>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader 9939#449 Disk\ Boot\ failure\r MS 3.21 9940#466 Boot\ Failure\r MS 3.30 9941>>>>>468 search/18 \0 9942#IO.SYS,IBMBIO.COM 9943>>>>>>&0 string x \b %-.2s 9944>>>>>>>&-20 ubyte&0xDF >0 9945>>>>>>>>&-1 string x \b%-.4s 9946>>>>>>>>>&-16 ubyte&0xDF >0 9947>>>>>>>>>>&-1 string x \b%-.2s 9948>>>>>>&8 ubyte&0xDF >0 \b. 9949>>>>>>>&-1 string x \b%-.3s 9950#MSDOS.SYS,IBMDOS.COM 9951>>>>>>&11 ubyte&0xDF >0 \b+ 9952>>>>>>>&-1 string x \b%-.5s 9953>>>>>>>>&-6 ubyte&0xDF >0 9954>>>>>>>>>&-1 string x \b%-.1s 9955>>>>>>>>>>&-5 ubyte&0xDF >0 9956>>>>>>>>>>>&-1 string x \b%-.2s 9957>>>>>>>&7 ubyte&0xDF >0 \b. 9958>>>>>>>>&-1 string x \b%-.3s 9959>441 string Cannot\ load\ from\ harddisk.\n\r 9960>>469 string Insert\ Systemdisk\040 9961>>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader 9962#>43 string \224R-LOADER\ \ SYS =label 9963>54 string SYS 9964>>324 string VASKK 9965>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) 9966# 9967>98 string Press\ a\ key\ to\ retry\0\r 9968>>120 string Cannot\ find\ file\ \0\r 9969>>>139 string Disk\ read\ error\0\r 9970>>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader 9971#DRBIOS.SYS 9972>>>>>44 ubyte&0xDF >0 9973>>>>>>44 string x \b %-.6s 9974>>>>>>>50 ubyte&0xDF >0 9975>>>>>>>>50 string x \b%-.2s 9976>>>>>>52 ubyte&0xDF >0 9977>>>>>>>52 string x \b.%-.3s 9978# 9979>70 string IBMBIO\ \ COM 9980>>472 string Cannot\ load\ DOS!\040 9981>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader 9982>>471 string Cannot\ load\ DOS\040 9983>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader 9984#?? 9985>444 string KERNEL\ \ SYS 9986>>314 string BOOT\ error! \b, FREE-DOS Bootloader 9987>499 string KERNEL\ \ SYS 9988>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader 9989>449 string KERNEL\ \ SYS 9990>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader 9991# 9992>449 string Loading\ FreeDOS 9993>>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader 9994>>>497 ubyte&0xDF >0 9995>>>>497 string x \b %-.6s 9996>>>>>503 ubyte&0xDF >0 9997>>>>>>503 string x \b%-.1s 9998>>>>>>>504 ubyte&0xDF >0 9999>>>>>>>>504 string x \b%-.1s 10000>>>>505 ubyte&0xDF >0 10001>>>>>505 string x \b.%-.3s 10002# 10003>331 string Error!.0 \b, FREE-DOS 1.0 bootloader 10004# 10005>125 string Loading\ FreeDOS...\r 10006>>311 string BOOT\ error!\r \b, FREE-DOS bootloader 10007>>>441 ubyte&0xDF >0 10008>>>>441 string x \b %-.6s 10009>>>>>447 ubyte&0xDF >0 10010>>>>>>447 string x \b%-.1s 10011>>>>>>>448 ubyte&0xDF >0 10012>>>>>>>>448 string x \b%-.1s 10013>>>>449 ubyte&0xDF >0 10014>>>>>449 string x \b.%-.3s 10015>124 string FreeDOS\0 10016>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader 10017# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes 10018>>>497 ubyte&0xDF >0 10019>>>>497 string x \b %-.6s 10020>>>>>503 ubyte&0xDF >0 10021>>>>>>503 string x \b%-.1s 10022>>>>>>>504 ubyte&0xDF >0 10023>>>>>>>>504 string x \b%-.1s 10024>>>>505 ubyte&0xDF >0 10025>>>>>505 string x \b.%-.3s 10026>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader 10027>>>497 ubyte&0xDF >0 10028>>>>497 string x \b %-.6s 10029>>>>>503 ubyte&0xDF >0 10030>>>>>>503 string x \b%-.1s 10031>>>>>>>504 ubyte&0xDF >0 10032>>>>>>>>504 string x \b%-.1s 10033>>>>505 ubyte&0xDF >0 10034>>>>>505 string x \b.%-.3s 10035>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader 10036>>>497 ubyte&0xDF >0 10037>>>>497 string x \b %-.6s 10038>>>>>503 ubyte&0xDF >0 10039>>>>>>503 string x \b%-.1s 10040>>>>>>>504 ubyte&0xDF >0 10041>>>>>>>>504 string x \b%-.1s 10042>>>>505 ubyte&0xDF >0 10043>>>>>505 string x \b.%-.3s 10044>336 string Error!\040 10045>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader 10046>>>497 ubyte&0xDF >0 10047>>>>497 string x \b %-.6s 10048>>>>>503 ubyte&0xDF >0 10049>>>>>>503 string x \b%-.1s 10050>>>>>>>504 ubyte&0xDF >0 10051>>>>>>>>504 string x \b%-.1s 10052>>>>505 ubyte&0xDF >0 10053>>>>>505 string x \b.%-.3s 10054# added by Joerg Jenderek 10055# http://www.visopsys.org/ 10056# http://partitionlogic.org.uk/ 10057# OEM-ID=Visopsys 10058>478 ulelong 0 10059>>(1.b+326) string I/O\ Error\ reading\040 10060>>>(1.b+344) string Visopsys\ loader\r 10061>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader 10062# http://alexfru.chat.ru/epm.html#bootprog 10063>494 ubyte >0x4D 10064>>495 string >E 10065>>>495 string <S 10066#OEM-ID is not reliable 10067>>>>3 string BootProg 10068# It just looks for a program file name at the root directory 10069# and loads corresponding file with following execution. 10070# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 10071>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 10072>>>>>499 use DOS-filename 10073#If the boot sector fails to read any other sector, 10074#it prints a very short message ("RE") to the screen and hangs the computer. 10075#If the boot sector fails to find needed program in the root directory, 10076#it also hangs with another message ("NF"). 10077>>>>>492 string RENF \b, FAT (12 bit) 10078>>>>>495 string RENF \b, FAT (16 bit) 10079#If the boot sector fails to read any other sector, 10080#it prints a very short message ("RE") to the screen and hangs the computer. 10081# x86 bootloader end 10082 10083# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 10084# and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector 10085>0 string RRaA 10086>>0x1E4 string rrAa \b, FSInfosector 10087#>>0x1FC uleshort =0 SHOULD BE ZERO 10088>>>0x1E8 ulelong <0xffffffff \b, %u free clusters 10089>>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u 10090 10091# updated by Joerg Jenderek at Sep 2007 10092>3 ubyte 0 10093#no active flag 10094>>446 ubyte 0 10095# partition 1 not empty 10096>>>450 ubyte >0 10097# partitions 3,4 empty 10098>>>>482 ubyte 0 10099>>>>>498 ubyte 0 10100# partition 2 ID=0,5,15 10101>>>>>>466 ubyte <0x10 10102>>>>>>>466 ubyte 0x05 \b, extended partition table 10103>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) 10104>>>>>>>466 ubyte 0x0 \b, extended partition table (last) 10105 10106# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 10107 10108>0x200 lelong 0x82564557 \b, BSD disklabel 10109 10110# by Joerg Jenderek at Apr 2013 10111# Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension 10112# like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS 101130 name DOS-filename 10114# space=0x20 (00100000b) means empty 10115>0 ubyte&0xDF >0 10116>>0 ubyte x \b%c 10117>>>1 ubyte&0xDF >0 10118>>>>1 ubyte x \b%c 10119>>>>>2 ubyte&0xDF >0 10120>>>>>>2 ubyte x \b%c 10121>>>>>>>3 ubyte&0xDF >0 10122>>>>>>>>3 ubyte x \b%c 10123>>>>>>>>>4 ubyte&0xDF >0 10124>>>>>>>>>>4 ubyte x \b%c 10125>>>>>>>>>>>5 ubyte&0xDF >0 10126>>>>>>>>>>>>5 ubyte x \b%c 10127>>>>>>>>>>>>>6 ubyte&0xDF >0 10128>>>>>>>>>>>>>>6 ubyte x \b%c 10129>>>>>>>>>>>>>>>7 ubyte&0xDF >0 10130>>>>>>>>>>>>>>>>7 ubyte x \b%c 10131# DOS filename extension 10132>>8 ubyte&0xDF >0 \b. 10133>>>8 ubyte x \b%c 10134>>>>9 ubyte&0xDF >0 10135>>>>>9 ubyte x \b%c 10136>>>>>>10 ubyte&0xDF >0 10137>>>>>>>10 ubyte x \b%c 10138# Print 2 following DOS filenames from directory entry form 10139# like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com 101400 name 2xDOS-filename 10141# display 1 space 10142>0 ubyte x \b 10143>0 use DOS-filename 10144>11 ubyte x \b+ 10145>11 use DOS-filename 10146 10147# http://en.wikipedia.org/wiki/Master_boot_record#PTE 10148# display standard partition table 101490 name partition-table 10150#>0 ubyte x PARTITION-TABLE 10151# test and display 1st til 4th partition table entry 10152>0 use partition-entry-test 10153>16 use partition-entry-test 10154>32 use partition-entry-test 10155>48 use partition-entry-test 10156# test for entry of partition table 101570 name partition-entry-test 10158# partition type ID > 0 10159>4 ubyte >0 10160# active flag 0 10161>>0 ubyte 0 10162>>>0 use partition-entry 10163# active flag 0x80, 0x81, ... 10164>>0 ubyte >0x7F 10165>>>0 use partition-entry 10166# Print entry of partition table 101670 name partition-entry 10168# partition type ID > 0 10169>4 ubyte >0 \b; partition 10170>>64 leshort 0xAA55 1 10171>>48 leshort 0xAA55 2 10172>>32 leshort 0xAA55 3 10173>>16 leshort 0xAA55 4 10174>>4 ubyte x : ID=0x%x 10175>>0 ubyte&0x80 0x80 \b, active 10176>>0 ubyte >0x80 0x%x 10177>>1 ubyte x \b, start-CHS ( 10178>>1 use partition-chs 10179>>5 ubyte x \b), end-CHS ( 10180>>5 use partition-chs 10181>>8 ulelong x \b), startsector %u 10182>>12 ulelong x \b, %u sectors 10183# Print cylinder,head,sector (CHS) of partition entry 101840 name partition-chs 10185# cylinder 10186>1 ubyte x \b0x 10187>1 ubyte&0xC0 0x40 \b1 10188>1 ubyte&0xC0 0x80 \b2 10189>1 ubyte&0xC0 0xC0 \b3 10190>2 ubyte x \b%x 10191# head 10192>0 ubyte x \b,%u 10193# sector 10194>1 ubyte&0x3F x \b,%u 10195 10196# FATX 101970 string FATX FATX filesystem data 10198 10199# romfs filesystems - Juan Cespedes <cespedes@debian.org> 102000 string -rom1fs- romfs filesystem, version 1 10201>8 belong x %d bytes, 10202>16 string x named %s. 10203 10204# netboot image - Juan Cespedes <cespedes@debian.org> 102050 lelong 0x1b031336L Netboot image, 10206>4 lelong&0xFFFFFF00 0 10207>>4 lelong&0x100 0x000 mode 2 10208>>4 lelong&0x100 0x100 mode 3 10209>4 lelong&0xFFFFFF00 !0 unknown mode 10210 102110x18b string OS/2 OS/2 Boot Manager 10212 10213# updated by Joerg Jenderek at Oct 2008 and Sep 2012 10214# http://syslinux.zytor.com/iso.php 10215# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05 10216# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop 102170 ulequad&0x909000007cc0eafa 0x909000007c40eafa 10218>631 search/689 ISOLINUX\ isolinux Loader 10219>>&0 string x (version %-4.4s) 10220# http://syslinux.zytor.com/pxe.php 10221# assembler instructions: jmp 7C05 102220 ulelong 0x007c05ea pxelinux loader (version 2.13 or older) 10223# assembler instructions: pushfd;pushad 102240 ulelong 0x60669c66 pxelinux loader 10225# assembler instructions: jmp 05 102260 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer) 10227# http://syslinux.zytor.com/wiki/index.php/SYSLINUX 102280 string LDLINUX\ SYS\ SYSLINUX loader 10229>12 string x (older version %-4.4s) 102300 string \r\nSYSLINUX\ SYSLINUX loader 10231>11 string x (version %-4.4s) 10232# syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 10233# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX" 102340 ulelong&0x80909bEB 0x009018EB 10235# OEM-ID not always "SYSLINUX" 10236>434 search/47 Boot\ failed 10237# followed by \r\n\0 or :\ 10238>>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older) 10239>>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9) 10240>459 search/30 Boot\ error\r\n\0 10241>>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer) 10242# SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 10243# assembler instructions: mov di,0600h;mov cx,0100h 1024416 search/4 \xbf\x00\x06\xb9\x00\x01 10245# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21) 10246!:strength +36 10247>94 search/249 Missing\ operating\ system 10248# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other 10249# skip Ranish MBR 10250>>408 search/4 HD1/\0 10251>>408 default x 10252>>>250 search/118 \0Operating\ system\ load SYSLINUX MBR 10253# followed by "ing " or space 10254>>>>292 search/98 error 10255>>>>>&0 string \r (version 3.35 or older) 10256>>>>>&0 string .\r (version 3.52 or newer) 10257>>>>>&0 default x (version 3.36-3.51 ) 10258>368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR 10259>>156 search/10 \0Boot\ partition\ not\ found\r\n 10260>>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older) 10261>>174 search/10 \0Missing\ OS\r\n 10262>>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer) 10263# SYSLINUX END 10264 10265# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012 10266# assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax, 102670 ubequad 0x31c08ed0bc007c8e 10268# mbr_bootsel magic before partition table not reliable with small ipl fragments 10269#>444 uleshort 0xb5e1 10270>0004 uleshort x 10271# ERRorTeXT 10272>>181 search/166 Error\ \0\r\n NetBSD mbr 10273# NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS 10274>>>0x1B8 ubelong >0 \b,Serial 0x%-.8x 10275# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx 10276>>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector 10277# BOOT_EXTENDED definitions contains assembler instructions: 10278# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13 10279>>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended 10280# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al 10281>>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO 10282# not TERSE_ERROR 10283>>>196 search/106 No\ active\ partition\0 10284>>>>&0 string Disk\ read\ error\0 10285>>>>>&0 string No\ operating\ system\0 \b,verbose 10286# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13 10287>>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS 10288# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13 10289>>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check 10290# assembler instructions: movw nametab,bx 10291>>>0x26 search/21 \xBB\x94\x07 10292# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf 10293>>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94 10294>>>>>181 search/166 Error\ \0 10295# "a: disk" , "Fn: diskn" or "NetBSD MBR boot" 10296>>>>>>&3 string x \b,"%s" 10297>>>446 use partition-table 10298# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html 10299# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4 10300# assembler instructions: jmp short 0x58;nop;ASCII 103010 ubequad&0xeb58908000000000 0xeb58900000000000 10302# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss, 10303>(1.b+2) ubequad 0xfa31c08ed88ec08e 10304# Error messages at end of code 10305>>376 string No\ operating\ system\r\n\0 10306>>>398 string Disk\ error\r\n\0FDD\0HDD\0 10307>>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr 10308 10309# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/ 10310# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11 10311# for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI, 10312# or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS, 103130 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC 10314# pointer to the data starting with Neil Turton signature string 10315>(0x1BC.s) string NDTmbr 10316>>&-14 string 1234F\0 Turton mbr ( 10317# parameters also viewed by install-mbr --list 10318>>>(0x1BC.s+7) ubyte x \b%u<= 10319>>>(0x1BC.s+9) ubyte x \bVersion<=%u 10320#>>>(0x1BC.s+8) ubyte x asm_flag_%x 10321>>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix 10322# variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode 10323>>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk 10324#0x1~1,..,0x8~4,0x10~F,0x80~A enabled 10325#>>>(0x1BC.s+10) ubyte x \b,flags 0x%x 10326#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot 10327#>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x 10328# for older versions 10329>>>(0x1BC.s+9) ubyte <2 10330#>>>>(0x1BC.s+12) ubyte 18 \b,%hhu/18 seconds 10331>>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds 10332# floppy A: or B: 10333>>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x 10334>>>>(0x1BC.s+13) ubyte >1 10335# 1st hard disc 10336#>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x 10337# not 1st hard disc 10338>>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x 10339# for version >= 2 maximal timeout can be 65534 10340>>>(0x1BC.s+9) ubyte >1 10341#>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds 10342>>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds 10343# floppy A: or B: 10344>>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x 10345>>>>(0x1BC.s+14) ubyte >1 10346# 1st hard disc 10347#>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x 10348# not 1st hard disc 10349>>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x 10350>>>0 ubyte x \b) 10351 10352# added by Joerg Jenderek 10353# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or 10354# grub-1.94/kern/i386/pc/startup.S 10355# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 10356# usual values are marked with comments to get only informations of strange GRUB loaders 103570x200 uleshort 0x70EA 10358# found only version 3.{1,2} 10359>0x206 ubeshort >0x0300 10360# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00" 10361>>0x212 ubyte >0x29 10362>>>0x213 ubyte >0x29 10363# not iso9660_stage1_5 10364#>>>0 ulelong&0x00BE5652 0x00BE5652 10365>>>>0x213 ubyte >0x29 GRand Unified Bootloader 10366# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2" 10367>>>>0x217 ubyte 0xFF stage1_5 10368>>>>0x217 ubyte <0xFF stage2 10369>>>>0x206 ubyte x \b version %u 10370>>>>0x207 ubyte x \b.%u 10371# module_size for 1.94 10372>>>>0x208 ulelong <0xffffff \b, installed partition %u 10373#>>>>0x208 ulelong =0xffffff \b, %lu (default) 10374>>>>0x208 ulelong >0xffffff \b, installed partition %u 10375# GRUB 0.5.95 unofficial 10376>>>>0x20C ulelong&0x2E300000 0x2E300000 10377# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 10378>>>>>0x20C ubyte x \b, identifier 0x%x 10379#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default) 10380>>>>>0x20D ubyte >0 \b, LBA flag 0x%x 10381# GRUB version as string 10382>>>>>0x20E string >\0 \b, GRUB version %-s 10383# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 10384>>>>>>0x215 ulong 0xffffffff 10385>>>>>>>0x219 string >\0 \b, configuration file %-s 10386>>>>>>0x215 ulong !0xffffffff 10387>>>>>>>0x215 string >\0 \b, configuration file %-s 10388# newer GRUB versions 10389>>>>0x20C ulelong&0x2E300000 !0x2E300000 10390##>>>>>0x20C ulelong =0 \b, saved entry %d (usual) 10391>>>>>0x20C ulelong >0 \b, saved entry %d 10392# for 1.94 contains kernel image size 10393# for 0.93,0.94,0.96,0.97 10394# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 10395>>>>>0x210 ubyte x \b, identifier 0x%x 10396# The flag for LBA forcing is in most cases 0 10397#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default) 10398>>>>>0x211 ubyte >0 \b, LBA flag 0x%x 10399# GRUB version as string 10400>>>>>0x212 string >\0 \b, GRUB version %-s 10401# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 10402>>>>>0x217 ulong 0xffffffff 10403>>>>>>0x21b string >\0 \b, configuration file %-s 10404>>>>>0x217 ulong !0xffffffff 10405>>>>>>0x217 string >\0 \b, configuration file %-s 10406 10407# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 10408# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 10409# over BIOS parameter block (BPB) 10410# http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD 10411# older drives may use Near JuMP instruction E9 xx xx 10412# minimal short forward jump found 0x29 for bootloaders or 0x0 10413# maximal short forward jump is 0x7f 10414# OEM-ID is empty or contain readable bytes 104150 ulelong&0x804000E9 0x000000E9 10416!:strength +60 10417# mtools-3.9.8/msdos.h 10418# usual values are marked with comments to get only informations of strange FAT systems 10419# valid sectorsize must be a power of 2 from 32 to 32768 10420>11 uleshort&0x001f 0 10421>>11 uleshort <32769 10422>>>11 uleshort >31 10423>>>>21 ubyte&0xf0 0xF0 10424>>>>>0 ubyte 0xEB DOS/MBR boot sector 10425>>>>>>1 ubyte x \b, code offset 0x%x+2 10426>>>>>0 ubyte 0xE9 10427>>>>>>1 uleshort x \b, code offset 0x%x+3 10428>>>>>3 string >\0 \b, OEM-ID "%-.8s" 10429#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC 10430>>>>>>8 string IHC \b cached by Windows 9M 10431>>>>>11 uleshort >512 \b, Bytes/sector %u 10432#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) 10433>>>>>11 uleshort <512 \b, Bytes/sector %u 10434>>>>>13 ubyte >1 \b, sectors/cluster %u 10435#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) 10436# for lazy FAT32 implementation like Transcend digital photo frame PF830 10437>>>>>82 string/c fat32 10438>>>>>>14 uleshort !32 \b, reserved sectors %u 10439#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) 10440>>>>>82 string/c !fat32 10441>>>>>>14 uleshort >1 \b, reserved sectors %u 10442#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) 10443#>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS) 10444>>>>>16 ubyte >2 \b, FATs %u 10445#>>>>>16 ubyte =2 \b, FATs %u (usual) 10446>>>>>16 ubyte =1 \b, FAT %u 10447>>>>>16 ubyte >0 10448>>>>>17 uleshort >0 \b, root entries %u 10449#>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32) 10450>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) 10451#>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32) 10452>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x 10453#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) 10454>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x 10455>>>>>22 uleshort >0 \b, sectors/FAT %u 10456#>>>>>22 uleshort =0 \b, sectors/FAT %hu=0 (usual Fat32) 10457>>>>>24 uleshort x \b, sectors/track %u 10458>>>>>26 ubyte >2 \b, heads %u 10459#>>>>>26 ubyte =2 \b, heads %u (usual floppy) 10460>>>>>26 ubyte =1 \b, heads %u 10461# valid only for sector sizes with more then 32 Bytes 10462>>>>>11 uleshort >32 10463# http://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block 10464# skip for values 2,2Ah,70h,73h,DFh 10465# and continue for extended boot signature values 0,28h,29h,80h 10466>>>>>>38 ubyte&0x56 =0 10467>>>>>>>28 ulelong >0 \b, hidden sectors %u 10468#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) 10469>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) 10470#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) 10471# FAT<32 bit specific 10472>>>>>>>82 string/c !fat32 10473#>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) 10474#>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) 10475>>>>>>>>36 ubyte !0x80 10476>>>>>>>>>36 ubyte !0 \b, physical drive 0x%x 10477# VGA-copy CRC or 10478# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 10479>>>>>>>>37 ubyte >0 \b, reserved 0x%x 10480#>>>>>>>>37 ubyte =0 \b, reserved 0x%x 10481# extended boot signatur value is 0x80 for NTFS, 0x28 or 0x29 for others 10482>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 10483>>>>>>>>38 ubyte&0xFE =0x28 10484>>>>>>>>>39 ulelong x \b, serial number 0x%x 10485>>>>>>>>38 ubyte =0x29 10486>>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s" 10487>>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" 10488>>>>>>>>>43 string =NO\ NAME \b, unlabeled 10489# there exist some old floppies without word FAT at offset 54 10490# a word like "FATnm " is only a hint for a FAT size on nm-bits 10491# Normally the number of clusters is calculated by the values of BPP. 10492# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit, 10493# otherwise FAT is 16 bit. 10494# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html 10495>>>>>82 string/c !fat32 10496>>>>>>54 string FAT12 \b, FAT (12 bit) 10497>>>>>>54 string FAT16 \b, FAT (16 bit) 10498>>>>>>54 default x 10499# determinate FAT bit size by media descriptor 10500# small floppies implies FAT12 10501>>>>>>>21 ubyte <0xF0 \b, FAT (12 bit by descriptor) 10502# with media descriptor F0h floppy or maybe superfloppy with FAT16 10503>>>>>>>21 ubyte =0xF0 10504# superfloppy (many sectors) implies FAT16 10505>>>>>>>>32 ulelong >0xFFFF \b, FAT (16 bit by descriptor+sectors) 10506# no superfloppy with media descriptor F0h implies FAT12 10507>>>>>>>>32 default x \b, FAT (12 bit by descriptor+sectors) 10508# with media descriptor F8h floppy or hard disc with FAT12 or FAT16 10509>>>>>>>21 ubyte =0xF8 10510# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12 10511>>>>>>>>19 ubequad 0xd002f80300090001 \b, FAT (12 bit by descriptor+geometry) 10512# hard disc with FAT12 or FAT16 10513>>>>>>>>19 default x \b, FAT (1Y bit by descriptor) 10514# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc 10515>>>>>>>21 ubyte =0xFA 10516# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12 10517>>>>>>>>19 ubequad 0x8002fa0200080001 \b, FAT (12 bit by descriptor+geometry) 10518# RAM disc with FAT12 or FAT16 or Tandy hard disc 10519>>>>>>>>19 default x \b, FAT (1Y bit by descriptor) 10520# others are floppy 10521>>>>>>>21 default x \b, FAT (12 bit by descriptor) 10522# FAT32 bit specific 10523>>>>>82 string/c fat32 \b, FAT (32 bit) 10524>>>>>>36 ulelong x \b, sectors/FAT %u 10525# http://technet.microsoft.com/en-us/library/cc977221.aspx 10526>>>>>>40 uleshort >0 \b, extension flags 0x%x 10527#>>>>>>40 uleshort =0 \b, extension flags %hu 10528>>>>>>42 uleshort >0 \b, fsVersion %u 10529#>>>>>>42 uleshort =0 \b, fsVersion %u (usual) 10530>>>>>>44 ulelong >2 \b, rootdir cluster %u 10531#>>>>>>44 ulelong =2 \b, rootdir cluster %u 10532#>>>>>>44 ulelong =1 \b, rootdir cluster %u 10533>>>>>>48 uleshort >1 \b, infoSector %u 10534#>>>>>>48 uleshort =1 \b, infoSector %u (usual) 10535>>>>>>48 uleshort <1 \b, infoSector %u 10536# 0 or 0xFFFF instead of usual 6 means no backup sector 10537>>>>>>50 uleshort =0xFFFF \b, no Backup boot sector 10538>>>>>>50 uleshort =0 \b, no Backup boot sector 10539#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) 10540>>>>>>50 default x 10541>>>>>>>50 uleshort x \b, Backup boot sector %u 10542# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 10543>>>>>>52 ulelong >0 \b, reserved1 0x%x 10544>>>>>>56 ulelong >0 \b, reserved2 0x%x 10545>>>>>>60 ulelong >0 \b, reserved3 0x%x 10546# same structure as FAT1X 10547#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) 10548#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) 10549>>>>>>64 ubyte !0x80 10550>>>>>>>64 ubyte >0 \b, physical drive 0x%x 10551# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 10552>>>>>>65 ubyte >0 \b, reserved 0x%x 10553>>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 10554>>>>>>66 ubyte =0x29 10555>>>>>>>67 ulelong x \b, serial number 0x%x 10556>>>>>>>71 string <NO\ NAME \b, label: "%11.11s" 10557>>>>>>>71 string >NO\ NAME \b, label: "%11.11s" 10558>>>>>>>71 string =NO\ NAME \b, unlabeled 10559# additional tests for floppy image added by Joerg Jenderek 10560# no fixed disk 10561>>>>>21 ubyte !0xF8 10562# floppy media with 12 bit FAT 10563>>>>>>54 string !FAT16 10564# test for FAT after bootsector 10565>>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT 10566# floppy image 10567!:mime application/x-ima 10568# NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm 10569# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html 10570# 0 FATs 10571>>>>>16 ubyte =0 10572# 0 root entries 10573>>>>>>17 uleshort =0 10574# 0 DOS sectors 10575>>>>>>>19 uleshort =0 10576# 0 sectors/FAT 10577# dos < 4.0 BootSector value found is 0x80 10578#38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x) 10579>>>>>>>>22 uleshort =0 \b; NTFS 10580>>>>>>>>>24 uleshort >0 \b, sectors/track %u 10581>>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x 10582>>>>>>>>>40 ulequad >0 \b, sectors %lld 10583>>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld 10584>>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld 10585# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters. 10586# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes. 10587>>>>>>>>>64 lelong <256 10588>>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d 10589>>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%i) 10590# Values 0 to 127 represent index block sizes of 0 to 127 clusters. 10591# Values 128 to 255 represent index block sizes of 2^(256-N) byte 10592>>>>>>>>>68 ulelong <256 10593>>>>>>>>>>68 ulelong <128 \b, clusters/index block %d 10594#>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d) 10595>>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%i) 10596>>>>>>>>>72 ulequad x \b, serial number 0%llx 10597>>>>>>>>>80 ulelong >0 \b, checksum 0x%x 10598#>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual) 10599>>>>>>>>>0x258 ulelong&0x00009090 =0x00009090 10600>>>>>>>>>>&-92 indirect x \b; contains 10601# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013 10602# http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm 10603# unused assembler instructions JMP y2;NOP;NOP 106040x056 ulelong&0xFFFF0FFF 0x909002EB 10605# unicode loadername terminated by CTRL-D 10606>(0.s*2) ulelong&0xFFFFFF00 0x00040000 10607# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR 10608>>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s 10609>>0x12 string $ 10610>>>0x0c lestring16 x \b%-2.2s 10611### DOS,NTFS boot sectors end 10612 10613# ntfsclone-image is a special save format for NTFS volumes, 10614# created and restored by the ntfsclone program 106150 string \0ntfsclone-image ntfsclone image, 10616>0x10 byte x version %d. 10617>0x11 byte x \b%d, 10618>0x12 lelong x cluster size %d, 10619>0x16 lequad x device size %lld, 10620>0x1e lequad x %lld total clusters, 10621>0x26 lequad x %lld clusters in use 10622 106239564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), 10624>8404 string x last mounted on %s, 10625#>9504 ledate x last checked at %s, 10626>8224 ledate x last written at %s, 10627>8401 byte x clean flag %d, 10628>8228 lelong x number of blocks %d, 10629>8232 lelong x number of data blocks %d, 10630>8236 lelong x number of cylinder groups %d, 10631>8240 lelong x block size %d, 10632>8244 lelong x fragment size %d, 10633>8252 lelong x minimum percentage of free blocks %d, 10634>8256 lelong x rotational delay %dms, 10635>8260 lelong x disk rotational speed %drps, 10636>8320 lelong 0 TIME optimization 10637>8320 lelong 1 SPACE optimization 10638 1063942332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 10640>&-1164 string x last mounted on %s, 10641>&-696 string >\0 volume name %s, 10642>&-304 leqldate x last written at %s, 10643>&-1167 byte x clean flag %d, 10644>&-1168 byte x readonly flag %d, 10645>&-296 lequad x number of blocks %lld, 10646>&-288 lequad x number of data blocks %lld, 10647>&-1332 lelong x number of cylinder groups %d, 10648>&-1328 lelong x block size %d, 10649>&-1324 lelong x fragment size %d, 10650>&-180 lelong x average file size %d, 10651>&-176 lelong x average number of files in dir %d, 10652>&-272 lequad x pending blocks to free %lld, 10653>&-264 lelong x pending inodes to free %d, 10654>&-664 lequad x system-wide uuid %0llx, 10655>&-1316 lelong x minimum percentage of free blocks %d, 10656>&-1248 lelong 0 TIME optimization 10657>&-1248 lelong 1 SPACE optimization 10658 1065966908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 10660>&-1164 string x last mounted on %s, 10661>&-696 string >\0 volume name %s, 10662>&-304 leqldate x last written at %s, 10663>&-1167 byte x clean flag %d, 10664>&-1168 byte x readonly flag %d, 10665>&-296 lequad x number of blocks %lld, 10666>&-288 lequad x number of data blocks %lld, 10667>&-1332 lelong x number of cylinder groups %d, 10668>&-1328 lelong x block size %d, 10669>&-1324 lelong x fragment size %d, 10670>&-180 lelong x average file size %d, 10671>&-176 lelong x average number of files in dir %d, 10672>&-272 lequad x pending blocks to free %lld, 10673>&-264 lelong x pending inodes to free %d, 10674>&-664 lequad x system-wide uuid %0llx, 10675>&-1316 lelong x minimum percentage of free blocks %d, 10676>&-1248 lelong 0 TIME optimization 10677>&-1248 lelong 1 SPACE optimization 10678 106799564 belong 0x00011954 Unix Fast File system [v1] (big-endian), 10680>7168 belong 0x4c41424c Apple UFS Volume 10681>>7186 string x named %s, 10682>>7176 belong x volume label version %d, 10683>>7180 bedate x created on %s, 10684>8404 string x last mounted on %s, 10685#>9504 bedate x last checked at %s, 10686>8224 bedate x last written at %s, 10687>8401 byte x clean flag %d, 10688>8228 belong x number of blocks %d, 10689>8232 belong x number of data blocks %d, 10690>8236 belong x number of cylinder groups %d, 10691>8240 belong x block size %d, 10692>8244 belong x fragment size %d, 10693>8252 belong x minimum percentage of free blocks %d, 10694>8256 belong x rotational delay %dms, 10695>8260 belong x disk rotational speed %drps, 10696>8320 belong 0 TIME optimization 10697>8320 belong 1 SPACE optimization 10698 1069942332 belong 0x19540119 Unix Fast File system [v2] (big-endian) 10700>&-1164 string x last mounted on %s, 10701>&-696 string >\0 volume name %s, 10702>&-304 beqldate x last written at %s, 10703>&-1167 byte x clean flag %d, 10704>&-1168 byte x readonly flag %d, 10705>&-296 bequad x number of blocks %lld, 10706>&-288 bequad x number of data blocks %lld, 10707>&-1332 belong x number of cylinder groups %d, 10708>&-1328 belong x block size %d, 10709>&-1324 belong x fragment size %d, 10710>&-180 belong x average file size %d, 10711>&-176 belong x average number of files in dir %d, 10712>&-272 bequad x pending blocks to free %lld, 10713>&-264 belong x pending inodes to free %d, 10714>&-664 bequad x system-wide uuid %0llx, 10715>&-1316 belong x minimum percentage of free blocks %d, 10716>&-1248 belong 0 TIME optimization 10717>&-1248 belong 1 SPACE optimization 10718 1071966908 belong 0x19540119 Unix Fast File system [v2] (big-endian) 10720>&-1164 string x last mounted on %s, 10721>&-696 string >\0 volume name %s, 10722>&-304 beqldate x last written at %s, 10723>&-1167 byte x clean flag %d, 10724>&-1168 byte x readonly flag %d, 10725>&-296 bequad x number of blocks %lld, 10726>&-288 bequad x number of data blocks %lld, 10727>&-1332 belong x number of cylinder groups %d, 10728>&-1328 belong x block size %d, 10729>&-1324 belong x fragment size %d, 10730>&-180 belong x average file size %d, 10731>&-176 belong x average number of files in dir %d, 10732>&-272 bequad x pending blocks to free %lld, 10733>&-264 belong x pending inodes to free %d, 10734>&-664 bequad x system-wide uuid %0llx, 10735>&-1316 belong x minimum percentage of free blocks %d, 10736>&-1248 belong 0 TIME optimization 10737>&-1248 belong 1 SPACE optimization 10738 107390 ulequad 0xc8414d4dc5523031 HAMMER filesystem (little-endian), 10740>0x90 lelong+1 x volume %d 10741>0x94 lelong x (of %d), 10742>0x50 string x name %s, 10743>0x98 ulelong x version %u, 10744>0xa0 ulelong x flags 0x%x 10745 10746# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca> 10747# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net> 10748# volume label and UUID Russell Coker 10749# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 107500x438 leshort 0xEF53 Linux 10751>0x44c lelong x rev %d 10752>0x43e leshort x \b.%d 10753# No journal? ext2 10754>0x45c lelong ^0x0000004 ext2 filesystem data 10755>>0x43a leshort ^0x0000001 (mounted or unclean) 10756# Has a journal? ext3 or ext4 10757>0x45c lelong &0x0000004 10758# and small INCOMPAT? 10759>>0x460 lelong <0x0000040 10760# and small RO_COMPAT? 10761>>>0x464 lelong <0x0000008 ext3 filesystem data 10762# else large RO_COMPAT? 10763>>>0x464 lelong >0x0000007 ext4 filesystem data 10764# else large INCOMPAT? 10765>>0x460 lelong >0x000003f ext4 filesystem data 10766>0x468 belong x \b, UUID=%08x 10767>0x46c beshort x \b-%04x 10768>0x46e beshort x \b-%04x 10769>0x470 beshort x \b-%04x 10770>0x472 belong x \b-%08x 10771>0x476 beshort x \b%04x 10772>0x478 string >0 \b, volume name "%s" 10773# General flags for any ext* fs 10774>0x460 lelong &0x0000004 (needs journal recovery) 10775>0x43a leshort &0x0000002 (errors) 10776# INCOMPAT flags 10777>0x460 lelong &0x0000001 (compressed) 10778#>0x460 lelong &0x0000002 (filetype) 10779#>0x460 lelong &0x0000010 (meta bg) 10780>0x460 lelong &0x0000040 (extents) 10781>0x460 lelong &0x0000080 (64bit) 10782#>0x460 lelong &0x0000100 (mmp) 10783#>0x460 lelong &0x0000200 (flex bg) 10784# RO_INCOMPAT flags 10785#>0x464 lelong &0x0000001 (sparse super) 10786>0x464 lelong &0x0000002 (large files) 10787>0x464 lelong &0x0000008 (huge files) 10788#>0x464 lelong &0x0000010 (gdt checksum) 10789#>0x464 lelong &0x0000020 (many subdirs) 10790#>0x463 lelong &0x0000040 (extra isize) 10791 10792# f2fs filesystem - Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi> 107930x400 lelong 0xF2F52010 F2FS filesystem 10794>0x46c belong x \b, UUID=%08x 10795>0x470 beshort x \b-%04x 10796>0x472 beshort x \b-%04x 10797>0x474 beshort x \b-%04x 10798>0x476 belong x \b-%08x 10799>0x47a beshort x \b%04x 10800>0x147c lestring16 x \b, volume name "%s" 10801 10802# Minix filesystems - Juan Cespedes <cespedes@debian.org> 108030x410 leshort 0x137f 10804!:strength / 2 10805>0x402 beshort < 100 10806>0x402 beshort > -1 Minix filesystem, V1, 14 char names, %d zones 10807>0x1e string minix \b, bootable 108080x410 beshort 0x137f 10809!:strength / 2 10810>0x402 beshort < 100 10811>0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones 10812>0x1e string minix \b, bootable 108130x410 leshort 0x138f 10814!:strength / 2 10815>0x402 beshort < 100 10816>0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones 10817>0x1e string minix \b, bootable 108180x410 beshort 0x138f 10819!:strength / 2 10820>0x402 beshort < 100 10821>0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones 10822>0x1e string minix \b, bootable 10823# Weak Magic: this is $x 10824#0x410 leshort 0x2468 10825#>0x402 beshort < 100 10826#>>0x402 beshort > -1 Minix filesystem, V2, 14 char names 10827#>0x1e string minix \b, bootable 10828#0x410 beshort 0x2468 10829#>0x402 beshort < 100 10830#>0x402 beshort > -1 Minix filesystem, V2 (big endian) 10831#>0x1e string minix \b, bootable 10832#0x410 leshort 0x2478 10833#>0x402 beshort < 100 10834#>0x402 beshort > -1 Minix filesystem, V2, 30 char names 10835#>0x1e string minix \b, bootable 10836#0x410 leshort 0x2478 10837#>0x402 beshort < 100 10838#>0x402 beshort > -1 Minix filesystem, V2, 30 char names 10839#>0x1e string minix \b, bootable 10840#0x410 beshort 0x2478 10841#>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian) 10842#>0x1e string minix \b, bootable 10843# Weak Magic! this is MD 10844#0x418 leshort 0x4d5a 10845#>0x402 beshort <100 10846#>>0x402 beshort > -1 Minix filesystem, V3, 60 char names 10847 10848# SGI disk labels - Nathan Scott <nathans@debian.org> 108490 belong 0x0BE5A941 SGI disk label (volume header) 10850 10851# SGI XFS filesystem - Nathan Scott <nathans@debian.org> 108520 belong 0x58465342 SGI XFS filesystem data 10853>0x4 belong x (blksz %d, 10854>0x68 beshort x inosz %d, 10855>0x64 beshort ^0x2004 v1 dirs) 10856>0x64 beshort &0x2004 v2 dirs) 10857 10858############################################################################ 10859# Minix-ST kernel floppy 108600x800 belong 0x46fc2700 Atari-ST Minix kernel image 10861# http://en.wikipedia.org/wiki/BIOS_parameter_block 10862# floppies with valid BPB and any instruction at beginning 10863>19 string \240\005\371\005\0\011\0\2\0 \b, 720k floppy 10864>19 string \320\002\370\005\0\011\0\1\0 \b, 360k floppy 10865 10866############################################################################ 10867# Hmmm, is this a better way of detecting _standard_ floppy images ? 1086819 string \320\002\360\003\0\011\0\1\0 DOS floppy 360k 10869>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1087019 string \240\005\371\003\0\011\0\2\0 DOS floppy 720k 10871>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1087219 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k 10873>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 10874 1087519 string \240\005\371\005\0\011\0\2\0 DOS floppy 720k, IBM 10876>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1087719 string \100\013\371\005\0\011\0\2\0 DOS floppy 1440k, mkdosfs 10878>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 10879 1088019 string \320\002\370\005\0\011\0\1\0 Atari-ST floppy 360k 1088119 string \240\005\371\005\0\011\0\2\0 Atari-ST floppy 720k 10882# | | | | | 10883# | | | | heads 10884# | | | sectors/track 10885# | | sectors/FAT 10886# | media descriptor 10887# BPB: sectors 10888 10889# Valid media descriptor bytes for MS-DOS: 10890# 10891# Byte Capacity Media Size and Type 10892# ------------------------------------------------- 10893# 10894# F0 2.88 MB 3.5-inch, 2-sided, 36-sector 10895# F0 1.44 MB 3.5-inch, 2-sided, 18-sector 10896# F9 720K 3.5-inch, 2-sided, 9-sector 10897# F9 1.2 MB 5.25-inch, 2-sided, 15-sector 10898# FD 360K 5.25-inch, 2-sided, 9-sector 10899# FF 320K 5.25-inch, 2-sided, 8-sector 10900# FC 180K 5.25-inch, 1-sided, 9-sector 10901# FE 160K 5.25-inch, 1-sided, 8-sector 10902# FE 250K 8-inch, 1-sided, single-density 10903# FD 500K 8-inch, 2-sided, single-density 10904# FE 1.2 MB 8-inch, 2-sided, double-density 10905# F8 ----- Fixed disk 10906# 10907# FC xxxK Apricot 70x1x9 boot disk. 10908# 10909# Originally a bitmap: 10910# xxxxxxx0 Not two sided 10911# xxxxxxx1 Double sided 10912# xxxxxx0x Not 8 SPT 10913# xxxxxx1x 8 SPT 10914# xxxxx0xx Not Removable drive 10915# xxxxx1xx Removable drive 10916# 11111xxx Must be one. 10917# 10918# But now it's rather random: 10919# 111111xx Low density disk 10920# 00 SS, Not 8 SPT 10921# 01 DS, Not 8 SPT 10922# 10 SS, 8 SPT 10923# 11 DS, 8 SPT 10924# 10925# 11111001 Double density 3 1/2 floppy disk, high density 5 1/4 10926# 11110000 High density 3 1/2 floppy disk 10927# 11111000 Hard disk any format 10928# 10929 10930# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013 10931# http://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions 10932# Too Weak. 10933#512 ubelong&0xE0ffff00 0xE0ffff00 10934# without valid Media descriptor in place of BPB, cases with are done at other places 10935#>21 ubyte <0xE5 floppy with old FAT filesystem 10936# but valid Media descriptor at begin of FAT 10937#>>512 ubyte =0xed 720k 10938#>>512 ubyte =0xf0 1440k 10939#>>512 ubyte =0xf8 720k 10940#>>512 ubyte =0xf9 1220k 10941#>>512 ubyte =0xfa 320k 10942#>>512 ubyte =0xfb 640k 10943#>>512 ubyte =0xfc 180k 10944# look like an an old DOS directory entry 10945#>>>0xA0E ubequad 0 10946#>>>>0xA00 ubequad !0 10947#!:mime application/x-ima 10948#>>512 ubyte =0xfd 10949# look for 2nd FAT at different location to distinguish between 360k and 500k 10950#>>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k 10951#>>>0x500 ubelong&0xE0ffff00 0xE0ffff00 500k 10952#>>>0xA0E ubequad 0 10953#!:mime application/x-ima 10954#>>512 ubyte =0xfe 10955#>>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k 10956#>>>>0x60E ubequad 0 10957#>>>>>0x600 ubequad !0 10958#!:mime application/x-ima 10959#>>>0xC00 ubelong&0xE0ffff00 0xE0ffff00 1200k 10960#>>512 ubyte =0xff 320k 10961#>>>0x60E ubequad 0 10962#>>>>0x600 ubequad !0 10963#!:mime application/x-ima 10964#>>512 ubyte x \b, Media descriptor 0x%x 10965# without x86 jump instruction 10966#>>0 ulelong&0x804000E9 !0x000000E9 10967# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV 10968#>>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader 10969# IOSYS.COM+MSDOS.COM 10970#>>>>0xc4 use 2xDOS-filename 10971#>>0 ulelong&0x804000E9 =0x000000E9 10972# only x86 short jump instruction found 10973#>>>0 ubyte =0xEB 10974#>>>>1 ubyte x \b, code offset 0x%x+2 10975# http://thestarman.pcministry.com/DOS/ibm100/Boot.htm 10976# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0 10977#>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader 10978# ibmbio.com+ibmdos.com 10979#>>>>>0x176 use DOS-filename 10980#>>>>>0x181 ubyte x \b+ 10981#>>>>>0x182 use DOS-filename 10982# http://thestarman.pcministry.com/DOS/ibm110/Boot.htm 10983# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV 10984#>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader 10985# ibmbio.com+ibmdos.com 10986#>>>>>0x18b use DOS-filename 10987#>>>>>0x196 ubyte x \b+ 10988#>>>>>0x197 use DOS-filename 10989# http://en.wikipedia.org/wiki/Zenith_Data_Systems 10990# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6 10991#>>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader 10992# IO.SYS+MSDOS.SYS 10993#>>>>>0x20 use 2xDOS-filename 10994# http://en.wikipedia.org/wiki/Corona_Data_Systems 10995# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX; 10996#>>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader 10997# IO.SYS+MSDOS.SYS 10998#>>>>>0x69 use 2xDOS-filename 10999# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00; 11000#>>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader 11001# defect IO.SYS+MSDOS.SYS ? 11002#>>>>>0x162 use 2xDOS-filename 11003 110040 name cdrom 11005>38913 string !NSR0 ISO 9660 CD-ROM filesystem data 11006!:mime application/x-iso9660-image 11007!:ext iso/iso9660 11008>38913 string NSR0 UDF filesystem data 11009!:mime application/x-iso9660-image 11010!:ext iso/udf 11011>>38917 string 1 (version 1.0) 11012>>38917 string 2 (version 1.5) 11013>>38917 string 3 (version 2.0) 11014>>38917 byte >0x33 (unknown version, ID 0x%X) 11015>>38917 byte <0x31 (unknown version, ID 0x%X) 11016# The next line is not necessary because the MBR staff is done looking for boot signature 11017>0x1FE leshort 0xAA55 (DOS/MBR boot sector) 11018# "application id" which appears to be used as a volume label 11019>32808 string/T >\0 '%s' 11020>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) 1102137633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) 11022!:mime application/x-iso9660-image 1102332777 string CDROM High Sierra CD-ROM filesystem data 11024 11025# CDROM Filesystems 11026# https://en.wikipedia.org/wiki/ISO_9660 11027# Modified for UDF by gerardo.cacciari@gmail.com 1102832769 string CD001 11029# mime line at that position does not work 11030# to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51) 11031#!:strength -11 11032# to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51) 11033!:strength +34 11034>0 use cdrom 11035 11036# URL: https://en.wikipedia.org/wiki/NRG_(file_format) 11037# Reference: https://dl.opendesktop.org/api/files/download/id/1460731811/ 11038# 11577-mount-iso-0.9.5.tar.bz2/mount-iso-0.9.5/install.sh 11039# From: Joerg Jenderek 11040# Note: Only for nero disc with once (DAO) type after 300 KB header 11041339969 string CD001 Nero CD image at 0x4B000 11042!:mime application/x-nrg 11043!:ext nrg 11044>307200 use cdrom 11045 11046# .cso files 11047# Reference: http://pismotec.com/ciso/ciso.h 11048# NOTE: There are two other formats with the same magic but 11049# completely incompatible specifications: 11050# - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h 11051# - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h 110520 string CISO 11053# Other fields are used to determine what type of CISO this is: 11054# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size) 11055# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size) 11056# - None of the above: Compact ISO. 11057>4 lelong !0 11058>>4 lelong !0x200000 11059>>>0x10 lelong !0x800 Compressed ISO CD image 11060 11061# cramfs filesystem - russell@coker.com.au 110620 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian 11063>4 lelong x size %u 11064>8 lelong &1 version #2 11065>8 lelong &2 sorted_dirs 11066>8 lelong &4 hole_support 11067>32 lelong x CRC 0x%x, 11068>36 lelong x edition %u, 11069>40 lelong x %u blocks, 11070>44 lelong x %u files 11071 110720 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian 11073>4 belong x size %u 11074>8 belong &1 version #2 11075>8 belong &2 sorted_dirs 11076>8 belong &4 hole_support 11077>32 belong x CRC 0x%x, 11078>36 belong x edition %u, 11079>40 belong x %u blocks, 11080>44 belong x %u files 11081 11082# reiserfs - russell@coker.com.au 110830x10034 string ReIsErFs ReiserFS V3.5 110840x10034 string ReIsEr2Fs ReiserFS V3.6 110850x10034 string ReIsEr3Fs ReiserFS V3.6.19 11086>0x1002c leshort x block size %d 11087>0x10032 leshort &2 (mounted or unclean) 11088>0x10000 lelong x num blocks %d 11089>0x10040 lelong 1 tea hash 11090>0x10040 lelong 2 yura hash 11091>0x10040 lelong 3 r5 hash 11092 11093# JFFS - russell@coker.com.au 110940 lelong 0x34383931 Linux Journalled Flash File system, little endian 110950 belong 0x34383931 Linux Journalled Flash File system, big endian 11096 11097# EST flat binary format (which isn't, but anyway) 11098# From: Mark Brown <broonie@sirena.org.uk> 110990 string ESTFBINR EST flat binary 11100 11101# Aculab VoIP firmware 11102# From: Mark Brown <broonie@sirena.org.uk> 111030 string VoIP\ Startup\ and Aculab VoIP firmware 11104>35 string x format %s 11105 11106# From: Mark Brown <broonie@sirena.org.uk> [old] 11107# From: Behan Webster <behanw@websterwood.com> 111080 belong 0x27051956 u-boot legacy uImage, 11109>32 string x %s, 11110>28 byte 0 Invalid os/ 11111>28 byte 1 OpenBSD/ 11112>28 byte 2 NetBSD/ 11113>28 byte 3 FreeBSD/ 11114>28 byte 4 4.4BSD/ 11115>28 byte 5 Linux/ 11116>28 byte 6 SVR4/ 11117>28 byte 7 Esix/ 11118>28 byte 8 Solaris/ 11119>28 byte 9 Irix/ 11120>28 byte 10 SCO/ 11121>28 byte 11 Dell/ 11122>28 byte 12 NCR/ 11123>28 byte 13 LynxOS/ 11124>28 byte 14 VxWorks/ 11125>28 byte 15 pSOS/ 11126>28 byte 16 QNX/ 11127>28 byte 17 Firmware/ 11128>28 byte 18 RTEMS/ 11129>28 byte 19 ARTOS/ 11130>28 byte 20 Unity OS/ 11131>28 byte 21 INTEGRITY/ 11132>29 byte 0 \bInvalid CPU, 11133>29 byte 1 \bAlpha, 11134>29 byte 2 \bARM, 11135>29 byte 3 \bIntel x86, 11136>29 byte 4 \bIA64, 11137>29 byte 5 \bMIPS, 11138>29 byte 6 \bMIPS 64-bit, 11139>29 byte 7 \bPowerPC, 11140>29 byte 8 \bIBM S390, 11141>29 byte 9 \bSuperH, 11142>29 byte 10 \bSparc, 11143>29 byte 11 \bSparc 64-bit, 11144>29 byte 12 \bM68K, 11145>29 byte 13 \bNios-32, 11146>29 byte 14 \bMicroBlaze, 11147>29 byte 15 \bNios-II, 11148>29 byte 16 \bBlackfin, 11149>29 byte 17 \bAVR32, 11150>29 byte 18 \bSTMicroelectronics ST200, 11151>29 byte 19 \bSandbox architecture, 11152>29 byte 20 \bANDES Technology NDS32, 11153>29 byte 21 \bOpenRISC 1000, 11154>29 byte 22 \bARM 64-bit, 11155>29 byte 23 \bDesignWare ARC, 11156>29 byte 24 \bx86_64, 11157>29 byte 25 \bXtensa, 11158>30 byte 0 Invalid Image 11159>30 byte 1 Standalone Program 11160>30 byte 2 OS Kernel Image 11161>30 byte 3 RAMDisk Image 11162>30 byte 4 Multi-File Image 11163>30 byte 5 Firmware Image 11164>30 byte 6 Script File 11165>30 byte 7 Filesystem Image (any type) 11166>30 byte 8 Binary Flat Device Tree BLOB 11167>31 byte 0 (Not compressed), 11168>31 byte 1 (gzip), 11169>31 byte 2 (bzip2), 11170>31 byte 3 (lzma), 11171>12 belong x %d bytes, 11172>8 bedate x %s, 11173>16 belong x Load Address: 0x%08X, 11174>20 belong x Entry Point: 0x%08X, 11175>4 belong x Header CRC: 0x%08X, 11176>24 belong x Data CRC: 0x%08X 11177 11178# JFFS2 file system 111790 leshort 0x1984 Linux old jffs2 filesystem data little endian 111800 leshort 0x1985 Linux jffs2 filesystem data little endian 11181 11182# Squashfs 111830 string sqsh Squashfs filesystem, big endian, 11184>28 beshort x version %d. 11185>30 beshort x \b%d, 11186>28 beshort <3 11187>>8 belong x %d bytes, 11188>28 beshort >2 11189>>28 beshort <4 11190>>>63 bequad x %lld bytes, 11191>>28 beshort >3 11192>>>40 bequad x %lld bytes, 11193#>>67 belong x %d bytes, 11194>4 belong x %d inodes, 11195>28 beshort <2 11196>>32 beshort x blocksize: %d bytes, 11197>28 beshort >1 11198>>28 beshort <4 11199>>>51 belong x blocksize: %d bytes, 11200>>28 beshort >3 11201>>>12 belong x blocksize: %d bytes, 11202>28 beshort <4 11203>>39 bedate x created: %s 11204>28 beshort >3 11205>>8 bedate x created: %s 112060 string hsqs Squashfs filesystem, little endian, 11207>28 leshort x version %d. 11208>30 leshort x \b%d, 11209>28 leshort <3 11210>>8 lelong x %d bytes, 11211>28 leshort >2 11212>>28 leshort <4 11213>>>63 lequad x %lld bytes, 11214>>28 leshort >3 11215>>>40 lequad x %lld bytes, 11216#>>63 lelong x %d bytes, 11217>4 lelong x %d inodes, 11218>28 leshort <2 11219>>32 leshort x blocksize: %d bytes, 11220>28 leshort >1 11221>>28 leshort <4 11222>>>51 lelong x blocksize: %d bytes, 11223>>28 leshort >3 11224>>>12 lelong x blocksize: %d bytes, 11225>28 leshort <4 11226>>39 ledate x created: %s 11227>28 leshort >3 11228>>8 ledate x created: %s 11229 11230# AFS Dump Magic 11231# From: Ty Sarna <tsarna@sarna.org> 112320 string \x01\xb3\xa1\x13\x22 AFS Dump 11233>&0 belong x (v%d) 11234>>&0 byte 0x76 11235>>>&0 belong x Vol %d, 11236>>>>&0 byte 0x6e 11237>>>>>&0 string x %s 11238>>>>>>&1 byte 0x74 11239>>>>>>>&0 beshort 2 11240>>>>>>>>&4 bedate x on: %s 11241>>>>>>>>&0 bedate =0 full dump 11242>>>>>>>>&0 bedate !0 incremental since: %s 11243 11244#---------------------------------------------------------- 11245#delta ISO Daniel Novotny (dnovotny@redhat.com) 112460 string DISO Delta ISO data 11247!:strength +50 11248>4 belong x version %d 11249 11250# VMS backup savesets - gerardo.cacciari@gmail.com 11251# 112524 string \x01\x00\x01\x00\x01\x00 11253>(0.s+16) string \x01\x01 11254>>&(&0.b+8) byte 0x42 OpenVMS backup saveset data 11255>>>40 lelong x (block size %d, 11256>>>49 string >\0 original name '%s', 11257>>>2 short 1024 VAX generated) 11258>>>2 short 2048 AXP generated) 11259>>>2 short 4096 I64 generated) 11260 11261# Summary: Oracle Clustered Filesystem 11262# Created by: Aaron Botsis <redhat@digitalmafia.org> 112638 string OracleCFS Oracle Clustered Filesystem, 11264>4 long x rev %d 11265>0 long x \b.%d, 11266>560 string x label: %.64s, 11267>136 string x mountpoint: %.128s 11268 11269# Summary: Oracle ASM tagged volume 11270# Created by: Aaron Botsis <redhat@digitalmafia.org> 1127132 string ORCLDISK Oracle ASM Volume, 11272>40 string x Disk Name: %0.12s 1127332 string ORCLCLRD Oracle ASM Volume (cleared), 11274>40 string x Disk Name: %0.12s 11275 11276# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org> 112778 string OracleCFS Oracle Clustered Filesystem, 11278>4 long x rev %d 11279>0 long x \b.%d, 11280>560 string x label: %.64s, 11281>136 string x mountpoint: %.128s 11282 11283# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org> 1128432 string ORCLDISK Oracle ASM Volume, 11285>40 string x Disk Name: %0.12s 1128632 string ORCLCLRD Oracle ASM Volume (cleared), 11287>40 string x Disk Name: %0.12s 11288 11289# Compaq/HP RILOE floppy image 11290# From: Dirk Jagdmann <doj@cubic.org> 112910 string CPQRFBLO Compaq/HP RILOE floppy image 11292 11293#------------------------------------------------------------------------------ 11294# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours). 11295# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes, 11296# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com 11297# 112981008 string DECFILE11 Files-11 On-Disk Structure 11299>525 byte x (ODS-%d); 11300>1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system; 11301>1017 string B 11302>>525 byte 2 VAX/VMS or OpenVMS file system; 11303>>525 byte 5 OpenVMS Alpha or Itanium file system; 11304>984 string x volume label is '%-12.12s' 11305 11306# From: Thomas Klausner <wiz@NetBSD.org> 11307# http://filext.com/file-extension/DAA 11308# describes the daa file format. The magic would be: 113090 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive 11310 11311# From Albert Cahalan <acahalan@gmail.com> 11312# really le32 operation,destination,payloadsize (but quite predictable) 11313# 01 00 00 00 00 00 00 c0 00 02 00 00 113140 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware 11315 11316# From Eric Sandeen 11317# GFS2 113180x10000 belong 0x01161970 11319>0x10018 belong 0x0000051d GFS1 Filesystem 11320>>0x10024 belong x (blocksize %d, 11321>>0x10060 string >\0 lockproto %s) 11322>0x10018 belong 0x00000709 GFS2 Filesystem 11323>>0x10024 belong x (blocksize %d, 11324>>0x10060 string >\0 lockproto %s) 11325 11326# Russell Coker <russell@coker.com.au> 113270x10040 string _BHRfS_M BTRFS Filesystem 11328>0x1012b string >\0 label "%s", 11329>0x10090 lelong x sectorsize %d, 11330>0x10094 lelong x nodesize %d, 11331>0x10098 lelong x leafsize %d, 11332>0x10020 belong x UUID=%08x- 11333>0x10024 beshort x \b%04x- 11334>0x10026 beshort x \b%04x- 11335>0x10028 beshort x \b%04x- 11336>0x1002a beshort x \b%04x 11337>0x1002c belong x \b%08x, 11338>0x10078 lequad x %lld/ 11339>0x10070 lequad x \b%lld bytes used, 11340>0x10088 lequad x %lld devices 11341 11342# dvdisaster's .ecc 11343# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 113440 string *dvdisaster* dvdisaster error correction file 11345 11346# xfs metadump image 11347# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 11348# but can we do the << ? For now it's always 512 (0x200) anyway. 113490 string XFSM 11350>0x200 string XFSB XFS filesystem metadump image 11351 11352# Type: CROM filesystem 11353# From: Werner Fink <werner@suse.de> 113540 string CROMFS CROMFS 11355>6 string >\0 \b version %2.2s, 11356>8 ulequad >0 \b block data at %lld, 11357>16 ulequad >0 \b fblock table at %lld, 11358>24 ulequad >0 \b inode table at %lld, 11359>32 ulequad >0 \b root at %lld, 11360>40 ulelong >0 \b fblock size = %d, 11361>44 ulelong >0 \b block size = %d, 11362>48 ulequad >0 \b bytes = %lld 11363 11364# Type: xfs metadump image 11365# From: Daniel Novotny <dnovotny@redhat.com> 11366# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 11367# but can we do the << ? For now it's always 512 (0x200) anyway. 113680 string XFSM 11369>0x200 string XFSB XFS filesystem metadump image 11370 11371# Type: delta ISO 11372# From: Daniel Novotny <dnovotny@redhat.com> 113730 string DISO Delta ISO data, 11374>4 belong x version %d 11375 11376# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.) 11377# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags. 11378# From: Adam Buchbinder <adam.buchbinder@gmail.com> 113790x8000 string JFS1 11380# Because it's text-only magic, check a binary value (version) to be sure. 11381# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be 11382# mountable. 11383>&0 lelong <3 JFS2 filesystem image 11384# Label is followed by a UUID; we have to limit string length to avoid 11385# appending the UUID in the case of a 16-byte label. 11386>>&144 regex [\x20-\x7E]{1,16} (label "%s") 11387>>&0 lequad x \b, %lld blocks 11388>>&8 lelong x \b, blocksize %d 11389>>&32 lelong&0x00000006 >0 (dirty) 11390>>&36 lelong >0 (compressed) 11391 11392# LFS 113930 lelong 0x070162 LFS filesystem image 11394>4 lelong 1 version 1, 11395>>8 lelong x \b blocks %u, 11396>>12 lelong x \b blocks per segment %u, 11397>4 lelong 2 version 2, 11398>>8 lelong x \b fragments %u, 11399>>12 lelong x \b bytes per segment %u, 11400>16 lelong x \b disk blocks %u, 11401>20 lelong x \b block size %u, 11402>24 lelong x \b fragment size %u, 11403>28 lelong x \b fragments per block %u, 11404>32 lelong x \b start for free list %u, 11405>36 lelong x \b number of free blocks %d, 11406>40 lelong x \b number of files %u, 11407>44 lelong x \b blocks available for writing %d, 11408>48 lelong x \b inodes in cache %d, 11409>52 lelong x \b inode file disk address 0x%x, 11410>56 lelong x \b inode file inode number %u, 11411>60 lelong x \b address of last segment written 0x%x, 11412>64 lelong x \b address of next segment to write 0x%x, 11413>68 lelong x \b address of current segment written 0x%x 11414 114150 string td\000 floppy image data (TeleDisk, compressed) 114160 string TD\000 floppy image data (TeleDisk) 11417 114180 string CQ\024 floppy image data (CopyQM, 11419>16 leshort x %d sectors, 11420>18 leshort x %d heads.) 11421 114220 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk) 11423 114240 beshort 0xAA58 floppy image data (IBM SaveDskF, old) 114250 beshort 0xAA59 floppy image data (IBM SaveDskF) 114260 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed) 11427 114280 string \074CPM_Disk\076 disk image data (YAZE) 11429 11430# ReFS 11431# Richard W.M. Jones <rjones@redhat.com> 114320 string \0\0\0ReFS\0 ReFS filesystem image 11433 11434# EFW encase image file format: 11435# Gregoire Passault 11436# http://www.forensicswiki.org/wiki/Encase_image_file_format 114370 string EVF\x09\x0d\x0a\xff\x00 EWF/Expert Witness/EnCase image file format 11438 11439# UBIfs 11440# Linux kernel sources: fs/ubifs/ubifs-media.h 114410 lelong 0x06101831 11442>0x16 leshort 0 UBIfs image 11443>0x08 lequad x \b, sequence number %llu 11444>0x10 leshort x \b, length %u 11445>0x04 lelong x \b, CRC 0x%08x 11446 114470 lelong 0x23494255 11448>0x04 leshort <2 11449>0x05 string \0\0\0 11450>0x1c string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 11451>0x04 leshort x UBI image, version %u 11452 11453# NEC PC-88 2D disk image 11454# From Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 114550x20 ulelong&0xFFFFFEFF 0x2A0 11456>0x10 string \0\0\0\0\0\0\0\0\0\0 11457>>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 11458>>>0x1A ubyte&0xEF 0 11459>>>>0x1B ubyte&0x8F 0 11460>>>>>0x1B ubyte&70 <0x40 11461>>>>>>0x1C ulelong >0x21 11462>>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s 11463>>>>>>>>0x1B ubyte 0 \b, media=2D 11464>>>>>>>>0x1B ubyte 0x10 \b, media=2DD 11465>>>>>>>>0x1B ubyte 0x20 \b, media=2HD 11466>>>>>>>>0x1B ubyte 0x30 \b, media=1D 11467>>>>>>>>0x1B ubyte 0x40 \b, media=1DD 11468>>>>>>>>0x1A ubyte 0x10 \b, write-protected 11469 11470# HDD Raw Copy Tool disk image, file extension: .imgc 11471# From Benjamin Vanheuverzwijn <bvanheu@gmail.com> 114720 pstring HDD\ Raw\ Copy\ Tool %s 11473>0x100 pstring x %s 11474>0x200 pstring x - HD model: %s 11475#>0x300 pstring x unknown %s 11476>0x400 pstring x serial: %s 11477#>0x500 pstring x unknown: %s 11478!:ext imgc 11479 11480#------------------------------------------------------------------------------ 11481# $File: finger,v 1.2 2015/10/07 02:37:57 christos Exp $ 11482# fingerprint: file(1) magic for fingerprint data 11483# XPM bitmaps) 11484# 11485 11486# http://cgit.freedesktop.org/libfprint/libfprint/tree/libfprint/data.c 11487 114880 string FP1 libfprint fingerprint data V1 11489>3 beshort x \b, driver_id %x 11490>5 belong x \b, devtype %x 11491 114920 string FP2 libfprint fingerprint data V2 11493>3 beshort x \b, driver_id %x 11494>5 belong x \b, devtype %x 11495 11496#------------------------------------------------------------------------------ 11497# $File: flash,v 1.14 2017/05/25 20:09:55 christos Exp $ 11498# flash: file(1) magic for Macromedia Flash file format 11499# 11500# See 11501# 11502# http://www.macromedia.com/software/flash/open/ 11503# http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\ 11504# en/devnet/swf/pdf/swf-file-format-spec.pdf page 27 11505# 11506 115070 name swf-details 11508 11509>0 string F 11510>>8 byte&0xfd 0x08 Macromedia Flash data 11511!:mime application/x-shockwave-flash 11512>>>3 byte x \b, version %d 11513>>8 byte&0xfe 0x10 Macromedia Flash data 11514!:mime application/x-shockwave-flash 11515>>>3 byte x \b, version %d 11516>>8 byte 0x18 Macromedia Flash data 11517!:mime application/x-shockwave-flash 11518>>>3 byte x \b, version %d 11519>>8 beshort&0xff87 0x2000 Macromedia Flash data 11520!:mime application/x-shockwave-flash 11521>>>3 byte x \b, version %d 11522>>8 beshort&0xffe0 0x3000 Macromedia Flash data 11523!:mime application/x-shockwave-flash 11524>>>3 byte x \b, version %d 11525>>8 byte&0x7 0 11526>>>8 ubyte >0x2f 11527>>>>9 ubyte <0x20 Macromedia Flash data 11528!:mime application/x-shockwave-flash 11529>>>>>3 byte x \b, version %d 11530 11531>0 string C 11532>>8 byte 0x78 Macromedia Flash data (compressed) 11533!:mime application/x-shockwave-flash 11534>>>3 byte x \b, version %d 11535 11536>0 string Z 11537>>8 byte 0x5d Macromedia Flash data (lzma compressed) 11538!:mime application/x-shockwave-flash 11539>>>3 byte x \b, version %d 11540 11541 115421 string WS 11543>4 ulelong >14 11544>>3 ubyte !0 11545>>>0 use swf-details 11546 11547# From: Cal Peake <cp@absolutedigital.net> 115480 string FLV\x01 Macromedia Flash Video 11549!:mime video/x-flv 11550 11551# 11552# Yosu Gomez 115530 string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document 115540 string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document 11555# From Dave Wilson 115560 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document 11557 11558#------------------------------------------------------------------------------ 11559# $File: flif,v 1.1 2015/11/23 22:04:36 christos Exp $ 11560# flif: Magic data for file(1) command. 11561# FLIF (Free Lossless Image Format) 11562 115630 string FLIF FLIF 11564>4 string <H image data 11565>>6 beshort x \b, %u 11566>>8 beshort x \bx%u 11567>>5 string 1 \b, 8-bit/color, 11568>>5 string 2 \b, 16-bit/color, 11569>>4 string 1 \b, grayscale, non-interlaced 11570>>4 string 3 \b, RGB, non-interlaced 11571>>4 string 4 \b, RGBA, non-interlaced 11572>>4 string A \b, grayscale 11573>>4 string C \b, RGB, interlaced 11574>>4 string D \b, RGBA, interlaced 11575>4 string >H \b, animation data 11576>>5 ubyte <255 \b, %i frames 11577>>>7 beshort x \b, %u 11578>>>9 beshort x \bx%u 11579>>>6 string =1 \b, 8-bit/color 11580>>>6 string =2 \b, 16-bit/color 11581>>5 ubyte 0xFF 11582>>>6 beshort x \b, %i frames, 11583>>>9 beshort x \b, %u 11584>>>11 beshort x \bx%u 11585>>>8 string =1 \b, 8-bit/color 11586>>>8 string =2 \b, 16-bit/color 11587>>4 string =Q \b, grayscale, non-interlaced 11588>>4 string =S \b, RGB, non-interlaced 11589>>4 string =T \b, RGBA, non-interlaced 11590>>4 string =a \b, grayscale 11591>>4 string =c \b, RGB, interlaced 11592>>4 string =d \b, RGBA, interlaced 11593 11594#------------------------------------------------------------------------------ 11595# $File: fonts,v 1.38 2017/11/14 15:48:36 christos Exp $ 11596# fonts: file(1) magic for font data 11597# 115980 search/1 FONT ASCII vfont text 115990 short 0436 Berkeley vfont data 116000 short 017001 byte-swapped Berkeley vfont data 11601 11602# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com 116030 string %!PS-AdobeFont-1. PostScript Type 1 font text 11604>20 string >\0 (%s) 116056 string %!PS-AdobeFont-1. PostScript Type 1 font program data 116060 string %!FontType1 PostScript Type 1 font program data 116076 string %!FontType1 PostScript Type 1 font program data 116080 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text 11609 11610# Summary: PostScript Type 1 Printer Font Metrics 11611# URL: https://en.wikipedia.org/wiki/PostScript_fonts 11612# Reference: http://partners.adobe.com/public/developer/en/font/5178.PFM.pdf 11613# Modified by: Joerg Jenderek 11614# Note: moved from ./msdos magic 11615# dfVersion 256=0100h 116160 uleshort 0x0100 11617# GRR: line above is too general as it catches also TrueType font, 11618# raw G3 data FAX, WhatsApp encrypted and Panorama database 11619# dfType 129=0081h 11620>66 uleshort 0x0081 11621# dfVertRes 300=012Ch not needed as additional test 11622#>>70 uleshort 0x012c 11623# dfHorizRes 300=012Ch 11624#>>>72 uleshort 0x012c 11625# dfDriverInfo points to postscript information section 11626>>(101.l) string/c Postscript Printer Font Metrics 11627# above labeled "PFM data" by ./msdos (version 5.28) or "Adobe Printer Font Metrics" by TrID 11628!:mime application/x-font-pfm 11629# AppleShare Print Server 11630#!:apple ASPS???? 11631!:ext pfm 11632# dfCopyright 60 byte null padded Copyright string. uncomment it to get old looking 11633#>>>6 string >\060 - %-.60s 11634# dfDriverInfo 11635>>>139 ulelong >0 11636# often abbreviated and same as filename 11637>>>>(139.l) string x %s 11638# dfSize 11639>>>2 ulelong x \b, %d bytes 11640# dfFace 210=D2h 9Eh 11641>>>105 ulelong >0 11642# Windows font name 11643>>>>(105.l) string x \b, %s 11644# dfItalic 11645>>>80 ubyte 1 italic 11646# dfUnderline 11647>>>81 ubyte 1 underline 11648# dfStrikeOut 11649>>>82 ubyte 1 strikeout 11650# dfWeight 400=0x0190 300=0x012c 500=0x01f4 600=0x0258 700=0x02bc 11651>>>83 uleshort >699 bold 11652# dfPitchAndFamily 16 17 48 49 64 65 11653>>>90 ubyte 16 serif 11654>>>90 ubyte 17 serif proportional 11655#>>>90 ubyte 48 other 11656>>>90 ubyte 49 proportional 11657>>>90 ubyte 64 script 11658>>>90 ubyte 65 script proportional 11659 11660# X11 font files in SNF (Server Natural Format) format 11661# updated by Joerg Jenderek at Feb 2013 11662# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm 116630 belong 00000004 X11 SNF font data, MSB first 11664#>104 belong 00000004 X11 SNF font data, MSB first 11665!:mime application/x-font-sfn 11666# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX 116670 lelong 00000004 11668>104 lelong 00000004 X11 SNF font data, LSB first 11669!:mime application/x-font-sfn 11670 11671# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com) 116720 search/1 STARTFONT\ X11 BDF font text 11673 11674# From: Joerg Jenderek 11675# URL: http://grub.gibibit.com/New_font_format 11676# Reference: util/grub-mkfont.c 11677# include/grub/fontformat.h 11678# FONT_FORMAT_SECTION_NAMES_FILE 116790 string FILE 11680# FONT_FORMAT_PFF2_MAGIC 11681>8 string PFF2 11682# leng 4 only at the moment 11683>>4 ubelong 4 11684# FONT_FORMAT_SECTION_NAMES_FONT_NAME 11685>>>12 string NAME GRUB2 font 11686!:mime application/x-font-pf2 11687!:ext pf2 11688# length of font_name 11689>>>>16 ubelong >0 11690# font_name 11691>>>>>20 string >\0 "%-s" 11692 11693# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) 11694# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides) 116950 string \001fcp X11 Portable Compiled Font data, 11696>12 lelong ^0x08 bit: LSB, 11697>12 lelong &0x08 bit: MSB, 11698>12 lelong ^0x04 byte: LSB first 11699>12 lelong &0x04 byte: MSB first 117000 string D1.0\015 X11 Speedo font data 11701 11702#------------------------------------------------------------------------------ 11703# FIGlet fonts and controlfiles 11704# From figmagic supplied with Figlet version 2.2 11705# "David E. O'Brien" <obrien@FreeBSD.ORG> 117060 string flf FIGlet font 11707>3 string >2a version %-2.2s 117080 string flc FIGlet controlfile 11709>3 string >2a version %-2.2s 11710 11711# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu) 11712# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++ 117130 belong 0x14025919 libGrx font data, 11714>8 leshort x %dx 11715>10 leshort x \b%d 11716>40 string x %s 11717# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu) 117180 belong 0xff464f4e DOS code page font data collection 117197 belong 0x00454741 DOS code page font data 117207 belong 0x00564944 DOS code page font data (from Linux?) 117214098 string DOSFONT DOSFONT2 encrypted font data 11722 11723# downloadable fonts for browser (prints type) anthon@mnt.org 11724# https://tools.ietf.org/html/rfc3073 117250 string PFR1 Portable Font Resource font data (new) 11726>102 string >0 \b: %s 117270 string PFR0 Portable Font Resource font data (old) 11728>4 beshort >0 version %d 11729 11730# True Type fonts 11731# Modified by: Joerg Jenderek 11732# URL: https://en.wikipedia.org/wiki/TrueType 11733# Reference: https://developer.apple.com/fonts/TrueType-Reference-Manual/ 11734# 11735# sfnt version "typ1" used by some Apple, but no example found 117360 string typ1 11737>0 use sfnt-font 11738>0 use sfnt-names 11739# sfnt version "true" used by some Apple 117400 string true 11741>0 use sfnt-font 11742>0 use sfnt-names 11743# GRR: below test is too general 11744# sfnt version often 0x00010000 117450 string \000\001\000\000 11746>0 use sfnt-font 11747>0 use sfnt-names 11748# validate and display sfnt font data like number of tables 117490 name sfnt-font 11750# file 5.30 version assumes 00FFh as maximal number of tables 11751#>4 ubeshort <0x0100 11752# maximal 27 tables found like in Skia.ttf 11753# 46 different table names mentioned on Apple specification 11754# skip 1st sequence of DOS 2 backup with path separator (\~92 or /~47) misinterpreted as table number 11755>4 ubeshort <47 11756# skip bad examples with garbage table names like in a5.show HYPERC MAC 11757# tag names consist of up to four characters padded with spaces at end like 11758# BASE DSIG OS/2 Zapf acnt glyf cvt vmtx xref ... 11759>>12 regex/4l \^[A-Za-z][A-Za-z][A-Za-z/][A-Za-z2\ ] 11760#>>>0 ubelong x \b, sfnt version 0x%x 11761>>>0 ubelong !0x4f54544f TrueType 11762!:mime application/font-sfnt 11763#!:mime font/ttf 11764!:apple ????tfil 11765# .ttf for TrueType font 11766# EUDC.tte created by privat character editor %WINDIR%\system32\eudcedit.exe 11767!:ext ttf/tte 11768# sfnt version 4F54544Fh~OTTO 11769>>>0 ubelong =0x4f54544f OpenType 11770!:mime application/font-sfnt 11771#!:mime font/otf 11772!:apple ????OTTO 11773!:ext otf 11774>>>0 ubelong x Font data 11775# DSIG=44454947h table name implies a digitally signed font 11776# search range = number of tables * 16 =< maximal number of tables * 16 = 27 * 16 = 432 11777>>>12 search/432 DSIG \b, digitally signed 11778>>>4 ubeshort x \b, %d tables 11779# minimal 9 tables found like in NISC18030.ttf 11780#>>>4 ubeshort <10 TMIN 11781#>>>4 ubeshort >24 TBIG 11782# table directory entries 11783>>>12 string x \b, 1st "%4.4s" 11784 11785# search and display 1st name in sfnt font which is often copyright text 11786# does not work inside font collections 117870 name sfnt-names 11788# search for naming table 11789>12 search/432/s name 11790# biggest offset 0x0100bd28 like Windows10 Fonts\simsunb.ttf 11791#>>>>&8 ubelong >0x0100bd27 BIGGEST OFFSET 11792>>&8 ubelong >0x00100000 11793# offset of name table 11794>>>&-4 ubelong x \b, name offset 0x%x 11795# GRR: pointer to name table only works if offset ~< FILE_BYTES_MAX = 100000h defined in src\file.h 11796>>&8 ubelong <0x00100000 11797>>>&-16 ubelong x 11798# name table 11799>>>>(&8.L) ubequad x 11800# invalid format selector 11801#>>>>>&-8 ubeshort !0 \b, invalid selector %x 11802# minimal 3 name records found like in c:\Program Files (x86)\Tesseract-OCR\tessdata\pdf.ttf 11803# maximal 1227 name records found like in Apple Chancery.ttf 11804#>>>>>&-6 ubeshort <0x4 mincount 11805#>>>>>&-6 ubeshort >130 maxcount 11806>>>>>&-6 ubeshort x \b, %d names 11807# offset to start of string storage from start of table 11808#>>>>>&-4 ubeshort x \b, record offset %d 11809# 1st name record 11810# string offset from start of storage area 11811#>>>>>&8 ubeshort x \b, string offset %d 11812# string length 11813#>>>>>&6 ubeshort x \b, string length %d 11814# minimal name string 7 like in c:\Program Files (x86)\Kodi\addons\webinterface.default\lib\video-js\font\VideoJS.ttf 11815# also found 0 like in SWZCONLN.TTF 11816#>>>>>&6 ubeshort <8 MIN STRING 11817# maximal name string 806 like in c:\Windows\Fonts\palabi.ttf 11818#>>>>>&6 ubeshort >805 MAX STRING 11819# platform identifier: 0~Apple Unicode, 1~Macintosh, 3~Microsoft 11820#>>>>>&-2 ubeshort >3 BAD PLATFORM 11821>>>>>&-2 ubeshort 0 \b, Unicode 11822>>>>>&-2 ubeshort 1 \b, Macintosh 11823>>>>>&-2 ubeshort 3 \b, Microsoft 11824# languageID (0~english Macintosh, 0409h~english Microsoft, ...) 11825>>>>>&2 ubeshort >0 \b, language 0x%x 11826# name identifiers 11827# often 0~copyright, 1~font, 2~font subfamily, 5~version, 13~license, 19~sample, ... 11828>>>>>&4 ubeshort >0 \b, type %d string 11829# platform specific encoding: 11830# 0~undefined character set, 1~UGL set with Unicode, 3~Unicode 2.0 BMP only, 4~Unicode 2.0 11831#>>>>>&0 ubeshort x \b, %d encoding 11832>>>>>&0 ubeshort 0 11833# handle only name string offset 0 because do not know how to add 2 relative offsets 11834>>>>>>&6 ubeshort 0 11835>>>>>>>&(&-14.S-18) ubyte !0 11836# GRR: instead 806 only first MAXstring = 96 characters are displayed as defined in src\file.h 11837# often copyright string that starts like \251 2006 The Monotype Corporation 11838>>>>>>>>&-1 string x \b, %-11.96s 11839# test for unicode string 11840>>>>>>>&(&-14.S-18) ubyte 0 11841>>>>>>>>&0 lestring16 x \b, %-11.96s 11842# unicode encoding 11843>>>>>&0 ubeshort >0 11844>>>>>>&6 ubeshort 0 11845>>>>>>>&(&-14.S-17) lestring16 x \b, %-11.96s 11846 118470 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 118480 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 11849 11850# TrueType/OpenType font collections (.ttc) 11851# URL: https://en.wikipedia.org/wiki/OpenType 11852# http://www.microsoft.com/typography/otspec/otff.htm 11853# Modified by: Joerg Jenderek 11854# Note: container for TrueType, OpenType font 118550 string ttcf 11856# skip ASCII text 11857>4 ubyte 0 11858# sfnt version often 0x00010000 of 1st table is TrueType 11859>>(12.L) ubelong !0x4f54544f TrueType 11860#!:mime font/ttf 11861!:apple ????tfil 11862!:ext ttc 11863# sfnt version 4F54544Fh~OTTO of 1st table is OpenType font 11864>>(12.L) ubelong =0x4f54544f OpenType 11865#!:mime font/otf 11866!:apple ????OTTO 11867# no example found for otc 11868!:ext ttc/otc 11869>>4 ubyte x font collection data 11870!:mime application/font-sfnt 11871#!:mime font/collection 11872# TCC version 11873>>4 belong 0x00010000 \b, 1.0 11874>>4 belong 0x00020000 \b, 2.0 11875>>8 ubelong >0 \b, %d fonts 11876# array offset size = fonts * offsetsize = fonts * 4 11877>>(8.L*4) ubequad x 11878# 0x44454947 = 'DSIG' 11879>>>&4 belong 0x44534947 \b, digitally signed 11880# offset to 1st font 11881>>12 ubelong x \b, at 0x%x 11882# point to 1st font that starts with sfnt version 11883>>(12.L) use sfnt-font 11884 11885# Opentype font data from Avi Bercovich 118860 string OTTO OpenType font data 11887!:mime application/vnd.ms-opentype 11888 11889# From: Alex Myczko <alex@aiei.ch> 118900 string SplineFontDB: Spline Font Database 11891!:mime application/vnd.font-fontforge-sfd 11892>14 string x version %s 11893 11894# EOT 118950x40 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 11896>0x22 string LP Embedded OpenType (EOT) 11897# workaround until there's lepstring16 11898# >>0x52 lepstring16/h >\0 \b, %s family 11899>>0x52 short !0 11900>>>0x54 lestring16 x \b, %s family 11901!:mime application/vnd.ms-fontobject 11902 11903# Web Open Font Format (.woff) 119040 name woff 11905>4 belong 0x00010000 \b, TrueType 11906>4 belong 0x4F54544F \b, CFF 11907>4 belong 0x74727565 \b, TrueType 11908>4 default x 11909>>4 belong x \b, flavor %d 11910>8 belong x \b, length %d 11911#>12 beshort x \b, numTables %d 11912#>14 beshort x \b, reserved %d 11913#>16 belong x \b, totalSfntSize %d 11914 11915# http://www.w3.org/TR/WOFF/ 119160 string wOFF Web Open Font Format 11917>0 use woff 11918>20 beshort x \b, version %d 11919>22 beshort x \b.%d 11920# http://www.w3.org/TR/WOFF2/ 119210 string wOF2 Web Open Font Format (Version 2) 11922>0 use woff 11923#>20 belong x \b, totalCompressedSize %d 11924>24 beshort x \b, version %d 11925>26 beshort x \b.%d 11926 11927#------------------------------------------------------------------------------ 11928# $File: fortran,v 1.10 2015/11/05 18:47:16 christos Exp $ 11929# FORTRAN source 11930# Check that the first 100 lines start with C or whitespace first. 119310 regex/100l !\^[^Cc\ \t].*$ 11932>0 regex/100l \^[Cc][\ \t] FORTRAN program text 11933!:mime text/x-fortran 11934!:strength - 5 11935 11936#------------------------------------------------------------------------------ 11937# $File: frame,v 1.13 2015/08/29 07:10:35 christos Exp $ 11938# frame: file(1) magic for FrameMaker files 11939# 11940# This stuff came on a FrameMaker demo tape, most of which is 11941# copyright, but this file is "published" as witness the following: 11942# 11943# Note that this is the Framemaker Maker Interchange Format, not the 11944# Normal format which would be application/vnd.framemaker. 11945# 119460 string \<MakerFile FrameMaker document 11947!:mime application/x-mif 11948>11 string 5.5 (5.5 11949>11 string 5.0 (5.0 11950>11 string 4.0 (4.0 11951>11 string 3.0 (3.0 11952>11 string 2.0 (2.0 11953>11 string 1.0 (1.0 11954>14 byte x %c) 119550 string \<MIFFile FrameMaker MIF (ASCII) file 11956!:mime application/x-mif 11957>9 string 4.0 (4.0) 11958>9 string 3.0 (3.0) 11959>9 string 2.0 (2.0) 11960>9 string 1.0 (1.x) 119610 search/1 \<MakerDictionary FrameMaker Dictionary text 11962!:mime application/x-mif 11963>17 string 3.0 (3.0) 11964>17 string 2.0 (2.0) 11965>17 string 1.0 (1.x) 119660 string \<MakerScreenFont FrameMaker Font file 11967!:mime application/x-mif 11968>17 string 1.01 (%s) 119690 string \<MML FrameMaker MML file 11970!:mime application/x-mif 119710 string \<BookFile FrameMaker Book file 11972!:mime application/x-mif 11973>10 string 3.0 (3.0 11974>10 string 2.0 (2.0 11975>10 string 1.0 (1.0 11976>13 byte x %c) 11977# XXX - this book entry should be verified, if you find one, uncomment this 11978#0 string \<Book\040 FrameMaker Book (ASCII) file 11979#!:mime application/x-mif 11980#>6 string 3.0 (3.0) 11981#>6 string 2.0 (2.0) 11982#>6 string 1.0 (1.0) 119830 string \<Maker\040Intermediate\040Print\040File FrameMaker IPL file 11984!:mime application/x-mif 11985 11986#------------------------------------------------------------------------------ 11987# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $ 11988# freebsd: file(1) magic for FreeBSD objects 11989# 11990# All new-style FreeBSD magic numbers are in host byte order (i.e., 11991# little-endian on x86). 11992# 11993# XXX - this comes from the file "freebsd" in a recent FreeBSD version of 11994# "file"; it, and the NetBSD stuff in "netbsd", appear to use different 11995# schemes for distinguishing between executable images, shared libraries, 11996# and object files. 11997# 11998# FreeBSD says: 11999# 12000# Regardless of whether it's pure, demand-paged, or none of the 12001# above: 12002# 12003# if the entry point is < 4096, then it's a shared library if 12004# the "has run-time loader information" bit is set, and is 12005# position-independent if the "is position-independent" bit 12006# is set; 12007# 12008# if the entry point is >= 4096 (or >4095, same thing), then it's 12009# an executable, and is dynamically-linked if the "has run-time 12010# loader information" bit is set. 12011# 12012# On x86, NetBSD says: 12013# 12014# If it's neither pure nor demand-paged: 12015# 12016# if it has the "has run-time loader information" bit set, it's 12017# a dynamically-linked executable; 12018# 12019# if it doesn't have that bit set, then: 12020# 12021# if it has the "is position-independent" bit set, it's 12022# position-independent; 12023# 12024# if the entry point is non-zero, it's an executable, otherwise 12025# it's an object file. 12026# 12027# If it's pure: 12028# 12029# if it has the "has run-time loader information" bit set, it's 12030# a dynamically-linked executable, otherwise it's just an 12031# executable. 12032# 12033# If it's demand-paged: 12034# 12035# if it has the "has run-time loader information" bit set, 12036# then: 12037# 12038# if the entry point is < 4096, it's a shared library; 12039# 12040# if the entry point is = 4096 or > 4096 (i.e., >= 4096), 12041# it's a dynamically-linked executable); 12042# 12043# if it doesn't have the "has run-time loader information" bit 12044# set, then it's just an executable. 12045# 12046# (On non-x86, NetBSD does much the same thing, except that it uses 12047# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K 12048# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's 12049# had 8K pages; dunno about MIPS.) 12050# 12051# I suspect the two will differ only in perverse and uninteresting cases 12052# ("shared" libraries that aren't demand-paged and whose pages probably 12053# won't actually be shared, executables with entry points <4096). 12054# 12055# I leave it to those more familiar with FreeBSD and NetBSD to figure out 12056# what the right answer is (although using ">4095", FreeBSD-style, is 12057# probably better than separately checking for "=4096" and ">4096", 12058# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged 12059# executables using the NetBSD technique.) 12060# 120610 lelong&0377777777 041400407 FreeBSD/i386 12062>20 lelong <4096 12063>>3 byte&0xC0 &0x80 shared library 12064>>3 byte&0xC0 0x40 PIC object 12065>>3 byte&0xC0 0x00 object 12066>20 lelong >4095 12067>>3 byte&0x80 0x80 dynamically linked executable 12068>>3 byte&0x80 0x00 executable 12069>16 lelong >0 not stripped 12070 120710 lelong&0377777777 041400410 FreeBSD/i386 pure 12072>20 lelong <4096 12073>>3 byte&0xC0 &0x80 shared library 12074>>3 byte&0xC0 0x40 PIC object 12075>>3 byte&0xC0 0x00 object 12076>20 lelong >4095 12077>>3 byte&0x80 0x80 dynamically linked executable 12078>>3 byte&0x80 0x00 executable 12079>16 lelong >0 not stripped 12080 120810 lelong&0377777777 041400413 FreeBSD/i386 demand paged 12082>20 lelong <4096 12083>>3 byte&0xC0 &0x80 shared library 12084>>3 byte&0xC0 0x40 PIC object 12085>>3 byte&0xC0 0x00 object 12086>20 lelong >4095 12087>>3 byte&0x80 0x80 dynamically linked executable 12088>>3 byte&0x80 0x00 executable 12089>16 lelong >0 not stripped 12090 120910 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged 12092>20 lelong <4096 12093>>3 byte&0xC0 &0x80 shared library 12094>>3 byte&0xC0 0x40 PIC object 12095>>3 byte&0xC0 0x00 object 12096>20 lelong >4095 12097>>3 byte&0x80 0x80 dynamically linked executable 12098>>3 byte&0x80 0x00 executable 12099>16 lelong >0 not stripped 12100 12101# XXX gross hack to identify core files 12102# cores start with a struct tss; we take advantage of the following: 12103# byte 7: highest byte of the kernel stack pointer, always 0xfe 12104# 8/9: kernel (ring 0) ss value, always 0x0010 12105# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0 12106# 28: low order byte of the current PTD entry, always 0 since the 12107# PTD is page-aligned 12108# 121097 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file 12110>1039 string >\0 from '%s' 12111 12112# /var/run/ld.so.hints 12113# What are you laughing about? 121140 lelong 011421044151 ld.so hints file (Little Endian 12115>4 lelong >0 \b, version %d) 12116>4 belong <1 \b) 121170 belong 011421044151 ld.so hints file (Big Endian 12118>4 belong >0 \b, version %d) 12119>4 belong <1 \b) 12120 12121# 12122# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities 12123# 121240 string SCRSHOT_ scrshot(1) screenshot, 12125>8 byte x version %d, 12126>9 byte 2 %d bytes in header, 12127>>10 byte x %d chars wide by 12128>>11 byte x %d chars high 12129 12130#------------------------------------------------------------------------------ 12131# $File: fsav,v 1.15 2018/07/16 12:30:41 christos Exp $ 12132# fsav: file(1) magic for datafellows fsav virus definition files 12133# Anthon van der Neut (anthon@mnt.org) 12134 12135# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def} 121360 beshort 0x1575 fsav macro virus signatures 12137>8 leshort >0 (%d- 12138>11 byte >0 \b%02d- 12139>10 byte >0 \b%02d) 12140# ftp://ftp.f-prot.com/pub/sign.zip 12141#10 ubyte <12 12142#>9 ubyte <32 12143#>>8 ubyte 0x0a 12144#>>>12 ubyte 0x07 12145#>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d- 12146#>>>>10 byte 0 \b01- 12147#>>>>10 byte 1 \b02- 12148#>>>>10 byte 2 \b03- 12149#>>>>10 byte 3 \b04- 12150#>>>>10 byte 4 \b05- 12151#>>>>10 byte 5 \b06- 12152#>>>>10 byte 6 \b07- 12153#>>>>10 byte 7 \b08- 12154#>>>>10 byte 8 \b09- 12155#>>>>10 byte 9 \b10- 12156#>>>>10 byte 10 \b11- 12157#>>>>10 byte 11 \b12- 12158#>>>>9 ubyte >0 \b%02d) 12159# ftp://ftp.f-prot.com/pub/sign2.zip 12160#0 ubyte 0x62 12161#>1 ubyte 0xF5 12162#>>2 ubyte 0x1 12163#>>>3 ubyte 0x1 12164#>>>>4 ubyte 0x0e 12165#>>>>>13 ubyte >0 fsav virus signatures 12166#>>>>>>11 ubyte x size 0x%02x 12167#>>>>>>12 ubyte x \b%02x 12168#>>>>>>13 ubyte x \b%02x bytes 12169 12170# Joerg Jenderek: joerg dot jenderek at web dot de 12171# http://www.clamav.net/doc/latest/html/node45.html 12172# .cvd files start with a 512 bytes colon separated header 12173# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime 12174# + gzipped tarball files 121750 string ClamAV-VDB: 12176>11 string >\0 Clam AntiVirus database %-.23s 12177>>34 string : 12178>>>35 string !: \b, version 12179>>>>35 string x \b %-.1s 12180>>>>>36 string !: 12181>>>>>>36 string x \b%-.1s 12182>>>>>>>37 string !: 12183>>>>>>>>37 string x \b%-.1s 12184>>>>>>>>>38 string !: 12185>>>>>>>>>>38 string x \b%-.1s 12186>>>>>>>>>>>39 string !: 12187>>>>>>>>>>>>39 string x \b%-.1s 12188>512 string \037\213 \b, gzipped 12189>769 string ustar\0 \b, tarred 12190 12191# Type: Grisoft AVG AntiVirus 12192# From: David Newgas <david@newgas.net> 121930 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data 12194 121950 string X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR 12196>33 string -STANDARD-ANTIVIRUS-TEST-FILE!$H+H* EICAR virus test files 12197 12198#------------------------------------------------------------------------------ 12199# $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $ 12200# fusecompress: file(1) magic for fusecompress 122010 string \037\135\211 FuseCompress(ed) data 12202>3 byte 0x00 (none format) 12203>3 byte 0x01 (bz2 format) 12204>3 byte 0x02 (gz format) 12205>3 byte 0x03 (lzo format) 12206>3 byte 0x04 (xor format) 12207>3 byte >0x04 (unknown format) 12208>4 long x uncompressed size: %d 12209 12210#------------------------------------------------------------------------------ 12211# $File: games,v 1.16 2017/10/19 16:40:37 christos Exp $ 12212# games: file(1) for games 12213 12214# Fabio Bonelli <fabiobonelli@libero.it> 12215# Quake II - III data files 122160 string IDP2 Quake II 3D Model file, 12217>20 long x %u skin(s), 12218>8 long x (%u x 12219>12 long x %u), 12220>40 long x %u frame(s), 12221>16 long x Frame size %u bytes, 12222>24 long x %u vertices/frame, 12223>28 long x %u texture coordinates, 12224>32 long x %u triangles/frame 12225 122260 string IBSP Quake 12227>4 long 0x26 II Map file (BSP) 12228>4 long 0x2E III Map file (BSP) 12229 122300 string IDS2 Quake II SP2 sprite file 12231 12232#--------------------------------------------------------------------------- 12233# Doom and Quake 12234# submitted by Nicolas Patrois 12235 122360 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo 12237# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01 12238 1223924 string LxD\ 203 Linuxdoom save 12240>0 string x , name=%s 12241>44 string x , world=%s 12242 12243# Quake 12244 12245# Update: Joerg Jenderek 12246# URL: http://fileformats.archiveteam.org/wiki/PAK 12247# reference: https://quakewiki.org/wiki/.pak 12248# GRR: line below is too general as it matches also Acorn PackDir compressed Archive 12249# and Git pack ./revision 122500 string PACK 12251# real Quake examples like pak0.pak have only some hundreds like 150 files 12252# So test for few files 12253>8 ulelong <0x01000000 12254# in file version 5.32 test for null terminator is only true for 12255# offset ~< FILE_BYTES_MAX = 1 MB defined in ../../src/file.h 12256# look for null terminator of 1st entry name 12257>>(4.l+55) ubyte 0 Quake I or II world or extension 12258!:mime application/x-dzip 12259!:ext pak 12260#>>>8 ulelong x \b, table size %u 12261# dividing this by entry size (64) gives number of files 12262>>>8 ulelong/64 x \b, %u files 12263# offset to the beginning of the file table 12264>>>4 ulelong x \b, offset 0x%x 12265# 1st file entry 12266>>>(4.l) use pak-entry 12267# 2nd file entry 12268#>>>4 ulelong+64 x \b, offset 0x%x 12269#>>>(4.l+64) use pak-entry 12270# 12271# display file table entry of Quake PAK archive 122720 name pak-entry 12273# normally entry start after header which implies offset 12 or higher 12274>56 ulelong >11 12275# the offset from the beginning of pak to beginning of this entry file contents 12276>>56 ulelong x at 0x%x 12277# the size of file for this entry 12278>>60 ulelong x %u bytes 12279# 56 byte null-terminated entry name string includes path like maps/e1m1.bsp 12280>>0 string x '%-.56s' 12281# inspect entry content by jumping to entry offset 12282>>(56) indirect x \b: 12283 12284#0 string -1\x0a Quake I demo 12285#>30 string x version %.4s 12286#>61 string x level %s 12287 12288#0 string 5\x0a Quake I save 12289 12290# The levels 12291 12292# Quake 1 12293 122940 string 5\x0aIntroduction Quake I save: start Introduction 122950 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex 122960 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned 122970 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis 122980 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto 122990 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret) 123000 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep 123010 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon 123020 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon 123030 string 5\x0athe_Installation Quake I save: e2m1 The installation 123040 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel 123050 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!) 123060 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret) 123070 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress 123080 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse 123090 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette 123100 string 5\x0aTermination_Central Quake I save: e3m1 Termination central 123110 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin 123120 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror 123130 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight 123140 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret) 123150 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels 123160 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment 123170 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system 123180 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair 123190 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine 123200 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate 123210 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium 123220 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret) 123230 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze 123240 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony 123250 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit 12326 12327# Quake DeathMatch levels 12328 123290 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths 123300 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis 123310 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base 123320 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place 123330 string 5\x0aThe_Cistern Quake I save: dm5 The cistern 123340 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone 12335 12336# Scourge of Armagon 12337 123380 string 5\x0aCommand_HQ Quake I save: start Command HQ 123390 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station 123400 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility 123410 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret) 123420 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine 123430 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility 123440 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms 123450 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret) 123460 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral 123470 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs 123480 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt 123490 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep 123500 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment 123510 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium 123520 string 5\x0aLimbo Quake I save: hip3m3 Limbo 123530 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret) 123540 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet 123550 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair 12356 12357# Malice 12358 123590 string 5\x0aThe_Academy Quake I save: start The academy 123600 string 5\x0aThe_Lab Quake I save: d1 The lab 123610 string 5\x0aArea_33 Quake I save: d1b Area 33 123620 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions 123630 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret) 123640 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret) 123650 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice 123660 string 5\x0aArea44 Quake I save: d1c Area 44 123670 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers 123680 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life 123690 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood 123700 string 5\x0aThe_Flood Quake I save: d5 The flood 123710 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant 123720 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant 123730 string 5\x0aThe_Foundry Quake I save: d7b The foundry 123740 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base 123750 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base 123760 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories 123770 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive 123780 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ 123790 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown! 12380 12381# Malice DeathMatch levels 12382 123830 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct 123840 string 5\x0aSub_Station Quake I save: ddm2 Sub station 123850 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights! 123860 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa 123870 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse 123880 string 5\x0aDOMINO Quake I save: ddm6 Domino 123890 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder 12390 12391 123920 string MComprHD MAME CHD compressed hard disk image, 12393>12 belong x version %u 12394 12395# doom - submitted by Jon Dowland 12396 123970 string =IWAD doom main IWAD data 12398>4 lelong x containing %d lumps 123990 string =PWAD doom patch PWAD data 12400>4 lelong x containing %d lumps 12401 12402# Build engine group files (Duke Nukem, Shadow Warrior, ...) 12403# Extension: .grp 12404# Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org> 124050 string KenSilverman Build engine group file 12406>12 lelong x containing %d files 12407 12408# Summary: Warcraft 3 save 12409# Extension: .w3g 12410# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 124110 string Warcraft\ III\ recorded\ game %s 12412 12413 12414# Summary: Warcraft 3 map 12415# Extension: .w3m 12416# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 124170 string HM3W Warcraft III map file 12418 12419 12420# Summary: SGF Smart Game Format 12421# Extension: .sgf 12422# Reference: http://www.red-bean.com/sgf/ 12423# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 12424# Modified by (1): Abel Cheung (regex, more game format) 12425# FIXME: Some games don't have GM (game type) 124260 regex \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 12427>2 search/0x200/b GM[ 12428>>&0 string 1] (Go) 12429>>&0 string 2] (Othello) 12430>>&0 string 3] (chess) 12431>>&0 string 4] (Gomoku+Renju) 12432>>&0 string 5] (Nine Men's Morris) 12433>>&0 string 6] (Backgammon) 12434>>&0 string 7] (Chinese chess) 12435>>&0 string 8] (Shogi) 12436>>&0 string 9] (Lines of Action) 12437>>&0 string 10] (Ataxx) 12438>>&0 string 11] (Hex) 12439>>&0 string 12] (Jungle) 12440>>&0 string 13] (Neutron) 12441>>&0 string 14] (Philosopher's Football) 12442>>&0 string 15] (Quadrature) 12443>>&0 string 16] (Trax) 12444>>&0 string 17] (Tantrix) 12445>>&0 string 18] (Amazons) 12446>>&0 string 19] (Octi) 12447>>&0 string 20] (Gess) 12448>>&0 string 21] (Twixt) 12449>>&0 string 22] (Zertz) 12450>>&0 string 23] (Plateau) 12451>>&0 string 24] (Yinsh) 12452>>&0 string 25] (Punct) 12453>>&0 string 26] (Gobblet) 12454>>&0 string 27] (hive) 12455>>&0 string 28] (Exxit) 12456>>&0 string 29] (Hnefatal) 12457>>&0 string 30] (Kuba) 12458>>&0 string 31] (Tripples) 12459>>&0 string 32] (Chase) 12460>>&0 string 33] (Tumbling Down) 12461>>&0 string 34] (Sahara) 12462>>&0 string 35] (Byte) 12463>>&0 string 36] (Focus) 12464>>&0 string 37] (Dvonn) 12465>>&0 string 38] (Tamsk) 12466>>&0 string 39] (Gipf) 12467>>&0 string 40] (Kropki) 12468 12469############################################## 12470# NetImmerse/Gamebryo game engine entries 12471 12472# Summary: Gamebryo game engine file 12473# Extension: .nif, .kf 12474# Created by: Abel Cheung <abelcheung@gmail.com> 124750 string Gamebryo\ File\ Format,\ Version\ Gamebryo game engine file 12476>&0 regex [0-9a-z.]+ \b, version %s 12477 12478# Summary: Gamebryo game engine file 12479# Extension: .kfm 12480# Created by: Abel Cheung <abelcheung@gmail.com> 124810 string ;Gamebryo\ KFM\ File\ Version\ Gamebryo game engine animation File 12482>&0 regex [0-9a-z.]+ \b, version %s 12483 12484# Summary: NetImmerse game engine file 12485# Extension .nif 12486# Created by: Abel Cheung <abelcheung@gmail.com> 124870 string NetImmerse\ File\ Format,\ Versio 12488>&0 string n\ NetImmerse game engine file 12489>>&0 regex [0-9a-z.]+ \b, version %s 12490 12491# Type: SGF Smart Game Format 12492# URL: http://www.red-bean.com/sgf/ 12493# From: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 124942 regex/c \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 12495>2 regex/c GM\\[1\\] - Go Game 12496>2 regex/c GM\\[6\\] - BackGammon Game 12497>2 regex/c GM\\[11\\] - Hex Game 12498>2 regex/c GM\\[18\\] - Amazons Game 12499>2 regex/c GM\\[19\\] - Octi Game 12500>2 regex/c GM\\[20\\] - Gess Game 12501>2 regex/c GM\\[21\\] - twix Game 12502 12503# Epic Games/Unreal Engine Package 12504# 125050 lelong 0x9E2A83C1 Unreal Engine Package, 12506>4 leshort x version: %i 12507>12 lelong !0 \b, names: %i 12508>28 lelong !0 \b, imports: %i 12509>20 lelong !0 \b, exports: %i 12510 12511#------------------------------------------------------------------------------ 12512# $File: gcc,v 1.5 2016/07/01 23:31:13 christos Exp $ 12513# gcc: file(1) magic for GCC special files 12514# 125150 string gpch GCC precompiled header 12516 12517# The version field is annoying. It's 3 characters, not zero-terminated. 12518>5 byte x (version %c 12519>6 byte x \b%c 12520>7 byte x \b%c) 12521 12522# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O' 12523>4 byte 67 for C 12524>4 byte 111 for Objective-C 12525>4 byte 43 for C++ 12526>4 byte 79 for Objective-C++ 12527 12528#------------------------------------------------------------------------------ 12529# $File: gconv 12530# gconv: file(1) magic for iconv/gconv module configuration cache 12531# 12532# Magic number defined in glibc/iconv/iconvconfig.h as GCONVCACHE_MAGIC 12533# 12534# From: Marek Cermak <macermak@redhat.com> 12535# 125360 lelong 0x20010324 gconv module configuration cache data 12537 12538#------------------------------------------------------------------------------ 12539# $File: geo,v 1.6 2018/03/11 00:48:16 christos Exp $ 12540# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu> 12541 12542###################################################################### 12543# 12544# Acoustic Doppler Current Profilers (ADCP) 12545# 12546###################################################################### 12547 125480 beshort 0x7f7f RDI Acoustic Doppler Current Profiler (ADCP) 12549 12550###################################################################### 12551# 12552# Metadata 12553# 12554###################################################################### 12555 125560 string Identification_Information FGDC ASCII metadata 12557 12558###################################################################### 12559# 12560# Seimsic / Subbottom 12561# 12562###################################################################### 12563 12564# Knudsen subbottom chirp profiler - Binary File Format: B9 12565# KEB D409-03167 V1.75 Huffman 125660 string KEB\ Knudsen seismic KEL binary (KEB) - 12567>4 regex [-A-Z0-9]* Software: %s 12568>>&1 regex V[0-9]*\.[0-9]* version %s 12569 12570###################################################################### 12571# 12572# LIDAR - Laser altimetry or bathy 12573# 12574###################################################################### 12575 12576 12577# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data 125780 string HCA LADS Caris Ascii Format (CAF) bathymetric lidar 12579>4 regex [0-9]*\.[0-9]* version %s 12580 125810 string HCB LADS Caris Binary Format (CBF) bathymetric lidar waveform data 12582>3 byte x version %d . 12583>4 byte x %d 12584 12585 12586###################################################################### 12587# 12588# MULTIBEAM SONARS http://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/ 12589# 12590###################################################################### 12591 12592# GeoAcoustics - GeoSwath Plus 125934 beshort 0x2002 GeoSwath RDF 125940 string Start:- GeoSwatch auf text file 12595 12596# Seabeam 2100 12597# mbsystem code mb41 125980 string SB2100 SeaBeam 2100 multibeam sonar 125990 string SB2100DR SeaBeam 2100 DR multibeam sonar 126000 string SB2100PR SeaBeam 2100 PR multibeam sonar 12601 12602# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor 12603# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR. 126040 string $HSF XSE multibeam 12605 12606# mb121 http://www.saic.com/maritime/gsf/ 126078 string GSF-v SAIC generic sensor format (GSF) sonar data, 12608>&0 regex [0-9]*\.[0-9]* version %s 12609 12610# MGD77 - http://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm 12611# mb161 126129 string MGD77 MGD77 Header, Marine Geophysical Data Exchange Format 12613 12614# MBSystem processing caches the mbinfo output 126151 string Swath\ Data\ File: mbsystem info cache 12616 12617# Caris John Hughes Clark format 126180 string HDCS Caris multibeam sonar related data 126191 string Start/Stop\ parameter\ header: Caris ASCII project summary 12620 12621###################################################################### 12622# 12623# Visualization and 3D modeling 12624# 12625###################################################################### 12626 12627# IVS - IVS3d.com Tagged Data Represetation 126280 string %%\ TDR\ 2.0 IVS Fledermaus TDR file 12629 12630# http://www.ecma-international.org/publications/standards/Ecma-363.htm 12631# 3D in PDFs 126320 string U3D ECMA-363, Universal 3D 12633 12634###################################################################### 12635# 12636# Support files 12637# 12638###################################################################### 12639 12640# https://midas.psi.ch/elog/ 126410 string $@MID@$ elog journal entry 12642 12643# Geospatial Designs http://www.geospatialdesigns.com/surfer6_format.htm 126440 string DSBB Surfer 6 binary grid file 12645>4 leshort x \b, %d 12646>6 leshort x \bx%d 12647>8 ledouble x \b, minx=%g 12648>16 ledouble x \b, maxx=%g 12649>24 ledouble x \b, miny=%g 12650>32 ledouble x \b, maxy=%g 12651>40 ledouble x \b, minz=%g 12652>48 ledouble x \b, maxz=%g 12653 12654# magic for LAS format files 12655# alex myczko <alex@aiei.ch> 12656# http://www.asprs.org/wp-content/uploads/2010/12/LAS_1_3_r11.pdf 126570 string LASF LIDAR point data records 12658>24 byte >0 \b, version %u 12659>25 byte >0 \b.%u 12660>26 string >\0 \b, SYSID %s 12661>58 string >\0 \b, Generating Software %s 12662 12663# magic for PCD format files 12664# alex myczko <alex@aiei.ch> 12665# http://pointclouds.org/documentation/tutorials/pcd_file_format.php 126660 string #\ .PCD Point Cloud Data 12667 12668#------------------------------------------------------------------------------ 12669# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $ 12670# GEOS files (Vidar Madsen, vidar@gimp.org) 12671# semi-commonly used in embedded and handheld systems. 126720 belong 0xc745c153 GEOS 12673>40 byte 1 executable 12674>40 byte 2 VMFile 12675>40 byte 3 binary 12676>40 byte 4 directory label 12677>40 byte <1 unknown 12678>40 byte >4 unknown 12679>4 string >\0 \b, name "%s" 12680#>44 short x \b, version %d 12681#>46 short x \b.%d 12682#>48 short x \b, rev %d 12683#>50 short x \b.%d 12684#>52 short x \b, proto %d 12685#>54 short x \br%d 12686#>168 string >\0 \b, copyright "%s" 12687 12688#------------------------------------------------------------------------------ 12689# $File: gimp,v 1.9 2014/04/30 21:41:02 christos Exp $ 12690# GIMP Gradient: file(1) magic for the GIMP's gradient data files (.ggr) 12691# by Federico Mena <federico@nuclecu.unam.mx> 12692 126930 string/t GIMP\ Gradient GIMP gradient data 12694 12695# GIMP palette (.gpl) 12696# From: Markus Heidelberg <markus.heidelberg@web.de> 126970 string/t GIMP\ Palette GIMP palette data 12698 12699#------------------------------------------------------------------------------ 12700# XCF: file(1) magic for the XCF image format used in the GIMP (.xcf) developed 12701# by Spencer Kimball and Peter Mattis 12702# ('Bucky' LaDieu, nega@vt.edu) 12703 127040 string gimp\ xcf GIMP XCF image data, 12705!:mime image/x-xcf 12706>9 string file version 0, 12707>9 string v version 12708>>10 string >\0 %s, 12709>14 belong x %u x 12710>18 belong x %u, 12711>22 belong 0 RGB Color 12712>22 belong 1 Greyscale 12713>22 belong 2 Indexed Color 12714>22 belong >2 Unknown Image Type. 12715 12716#------------------------------------------------------------------------------ 12717# XCF: file(1) magic for the patterns used in the GIMP (.pat), developed 12718# by Spencer Kimball and Peter Mattis 12719# ('Bucky' LaDieu, nega@vt.edu) 12720 1272120 string GPAT GIMP pattern data, 12722>24 string x %s 12723 12724#------------------------------------------------------------------------------ 12725# XCF: file(1) magic for the brushes used in the GIMP (.gbr), developed 12726# by Spencer Kimball and Peter Mattis 12727# ('Bucky' LaDieu, nega@vt.edu) 12728 1272920 string GIMP GIMP brush data 12730 12731# GIMP Curves File 12732# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 127330 string #\040GIMP\040Curves\040File GIMP curve file 12734 12735#------------------------------------------------------------------------------ 12736# $File: gnome,v 1.5 2014/04/30 21:41:02 christos Exp $ 12737# GNOME related files 12738 12739# Contributed by Josh Triplett 12740# FIXME: Could be simplified if pstring supported two-byte counts 127410 string GnomeKeyring\n\r\0\n GNOME keyring 12742>&0 ubyte 0 \b, major version 0 12743>>&0 ubyte 0 \b, minor version 0 12744>>>&0 ubyte 0 \b, crypto type 0 (AES) 12745>>>&0 ubyte >0 \b, crypto type %u (unknown) 12746>>>&1 ubyte 0 \b, hash type 0 (MD5) 12747>>>&1 ubyte >0 \b, hash type %u (unknown) 12748>>>&2 ubelong 0xFFFFFFFF \b, name NULL 12749>>>&2 ubelong !0xFFFFFFFF 12750>>>>&-4 ubelong >255 \b, name too long for file's pstring type 12751>>>>&-4 ubelong <256 12752>>>>>&-1 pstring x \b, name "%s" 12753>>>>>>&0 ubeqdate x \b, last modified %s 12754>>>>>>&8 ubeqdate x \b, created %s 12755>>>>>>&16 ubelong &1 12756>>>>>>>&0 ubelong x \b, locked if idle for %u seconds 12757>>>>>>&16 ubelong ^1 \b, not locked if idle 12758>>>>>>&24 ubelong x \b, hash iterations %u 12759>>>>>>&28 ubequad x \b, salt %llu 12760>>>>>>&52 ubelong x \b, %u item(s) 12761 12762# From: Alex Beregszaszi <alex@fsn.hu> 127634 string gtktalog GNOME Catalogue (gtktalog) 12764>13 string >\0 version %s 12765 12766# Summary: GStreamer binary registry 12767# Extension: .bin 12768# Submitted by: Josh Triplett <josh@joshtriplett.org> 127690 belong 0xc0def00d GStreamer binary registry 12770>4 string x \b, version %s 12771 12772# GVariant Database file 12773# By Elan Ruusamae <glen@delfi.ee> 12774# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h 12775# It's always "GVariant", it's byte swapped on incompatible archs 12776# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c 12777# file_builder_serialise() 12778# http://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant 127790 string GVariant GVariant Database file, 12780# version is never filled. probably future extension 12781>8 lelong x version %d 12782# not sure are these usable, so commented out 12783#>>16 lelong x start %d, 12784#>>>20 lelong x end %d 12785 12786# G-IR database made by gobject-introspect toolset, 12787# http://live.gnome.org/GObjectIntrospection 127880 string GOBJ\nMETADATA\r\n\032 G-IR binary database 12789>16 byte x \b, v%d 12790>17 byte x \b.%d 12791>20 leshort x \b, %d entries 12792>22 leshort x \b/%d local 12793 12794#------------------------------------------------------------------------------ 12795# $File: gnu,v 1.20 2018/02/24 16:11:23 christos Exp $ 12796# gnu: file(1) magic for various GNU tools 12797# 12798# GNU nlsutils message catalog file format 12799# 12800# GNU message catalog (.mo and .gmo files) 12801 12802# Update: Joerg Jenderek 12803# URL: https://www.gnu.org/software/gettext/manual/html_node/MO-Files.html 12804# Reference: ftp://ftp.gnu.org/pub/gnu/gettext/gettext-0.19.8.tar.gz/ 12805# gettext-0.19.8.1/gettext-runtime/intl/gmo.h 12806# Note: maybe call it like "GNU translation gettext machine object" 128070 string \336\22\4\225 GNU message catalog (little endian), 12808#0 ulelong 0x950412DE GNU-format message catalog data 12809# TODO: write lines in such a way that code can also be called for big endian variant 12810#>0 use gettext-object 12811#0 name gettext-object 12812>4 ulelong x revision 12813!:mime application/x-gettext-translation 12814# mo extension is also used for Easeus Partition Master PE32 executable module 12815# like ConvertFatToNTFS.mo 12816!:ext gmo/mo 12817# only found three revision combinations 0.0 0.1 1.1 as unsigned 32-bit 12818# major revision 12819>4 ulelong/0xFFff x %u. 12820# minor revision 12821>4 ulelong&0x0000FFff x \b%u 12822>>8 ulelong x \b, %u message 12823# plural s 12824>>8 ulelong >1 \bs 12825# size of hashing table 12826#>20 ulelong x \b, %u hash 12827#>20 ulelong >1 \bes 12828#>24 ulelong x at 0x%x 12829# for revsion x.0 offset of table with originals is 1Ch if directly after header 12830>4 ulelong&0x0000FFff =0 12831>>12 ulelong !0x1C \b, at 0x%x string table 12832# but for x.1 table offset i found is 30h. That means directly after bigger header 12833>4 ulelong&0x0000FFff >0 12834>>12 ulelong !0x30 \b, at 0x%x string table 12835# The following variables are only used in .mo files with minor revision >= 1 12836# number of system dependent segments 12837#>>28 ulelong x \b, %u segment 12838#>>28 ulelong >1 \bs 12839# offset of table describing system dependent segments 12840#>>32 ulelong x at 0x%x 12841# number of system dependent strings pairs 12842>>36 ulelong x \b, %u sysdep message 12843>>36 ulelong >1 \bs 12844# offset of table with start offsets of original sysdep strings 12845#>>40 ulelong x \b, at 0x%x sysdep strings 12846# offset of table with start offsets of translated sysdep strings 12847#>>44 ulelong x \b, at 0x%x sysdep translations 12848# >>(44.l) ulelong x 0x%x chars 12849# >>>&0 ulelong x at 0x%x 12850# >>>>(&-4) string x "%s" 12851# string table after big header 12852#>>48 ubequad x \b, string table 0x%llx 12853# 12854# 0th string length seems to be always 0 12855#>(12.l) ulelong x \b, %u chars 12856#>>&0 ulelong x at 0x%x 12857# if 1st string length positiv inspect offset and string 12858#>(12.l+8) ulelong >0 \b, %u chars 12859#>>&0 ulelong x at 0x%x 12860# if 2nd string length positiv inspect offset and string 12861# >(12.l+16) ulelong >0 \b, %u chars 12862# >>&0 ulelong x at 0x%x 12863# skip newline byte 12864#>>>(&-4) ubyte =0x0A 12865#>>>>&0 string x "%s" 12866#>>>(&-4) ubyte !0x0A 12867#>>>>&-1 string x '%s' 12868# offset of table with translation strings 12869#>16 ulelong x \b, at 0x%x translation table 12870# check translation 0 length and offset 12871>(16.l) ulelong >0 12872>>&0 ulelong x 12873# translation 0 seems to be often Project-Id with name and version 12874>>>(&-4) string x \b, %s 12875# trans. 1 with bytes >= 1 unlike icoutils-0.31.0\po\en@boldquot.gmo with 1 NL 12876>(16.l+8) ulelong >1 12877>>&0 ulelong x 12878>>>(&-4) ubyte !0x0A 12879>>>>&-1 string x '%s' 12880# 1 New Line like in tar-1.29\po\de.gmo 12881>>>(&-4) ubyte =0x0A 12882>>>>&0 ubyte !0x0A 12883>>>>>&-1 string x '%s' 12884# 2nd New Line like in parted-3.1\po\de.gmo 12885>>>>&0 ubyte =0x0A 12886>>>>>&0 string x '%s' 12887 128880 string \225\4\22\336 GNU message catalog (big endian), 12889#0 ubelong 0x950412DE GNU-format message catalog data 12890!:mime application/x-gettext-translation 12891!:ext gmo/mo 12892# TODO: for big endian use same code as for little endian 12893#>0 use \^gettext-object 12894# DEBUG code 12895#>16 ubelong x \b, at 0x%x translation table 12896#>(16.L) ubelong x 0x%x chars 12897#>>&0 ubelong x at 0x%x 12898# unexpected value HERE! 12899#>>>(&-4) ubequad x 0x%llx 12900# 12901>4 beshort x revision %d. 12902>6 beshort >0 \b%d, 12903>>8 belong x %d messages, 12904>>36 belong x %d sysdep messages 12905>6 beshort =0 \b%d, 12906>>8 belong x %d messages 12907 12908 12909# GnuPG 12910# The format is very similar to pgp 129110 string \001gpg GPG key trust database 12912>4 byte x version %d 12913# Note: magic.mime had 0x8501 for the next line instead of 0x8502 129140 beshort 0x8502 GPG encrypted data 12915!:mime text/PGP # encoding: data 12916 12917# Update: Joerg Jenderek 12918# Note: PGP and GPG use same data structure. 12919# So recognition is now done by ./pgp with start test for byte 0x99 12920# This magic is not particularly good, as the keyrings don't have true 12921# magic. Nevertheless, it covers many keyrings. 12922# 0 ubeshort-0x9901 <2 12923# >3 byte 4 12924# >>4 bedate x GPG key public ring, created %s 12925# !:mime application/x-gnupg-keyring 12926 12927# Symmetric encryption 129280 leshort 0x0d8c 12929>4 leshort 0x0203 12930>>2 leshort 0x0204 GPG symmetrically encrypted data (3DES cipher) 12931>>2 leshort 0x0304 GPG symmetrically encrypted data (CAST5 cipher) 12932>>2 leshort 0x0404 GPG symmetrically encrypted data (BLOWFISH cipher) 12933>>2 leshort 0x0704 GPG symmetrically encrypted data (AES cipher) 12934>>2 leshort 0x0804 GPG symmetrically encrypted data (AES192 cipher) 12935>>2 leshort 0x0904 GPG symmetrically encrypted data (AES256 cipher) 12936>>2 leshort 0x0a04 GPG symmetrically encrypted data (TWOFISH cipher) 12937>>2 leshort 0x0b04 GPG symmetrically encrypted data (CAMELLIA128 cipher) 12938>>2 leshort 0x0c04 GPG symmetrically encrypted data (CAMELLIA192 cipher) 12939>>2 leshort 0x0d04 GPG symmetrically encrypted data (CAMELLIA256 cipher) 12940 12941 12942# GnuPG Keybox file 12943# <http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD> 12944# From: Philipp Hahn <hahn@univention.de> 129450 belong 32 12946>4 byte 1 12947>>8 string KBXf GPG keybox database 12948>>>5 byte 1 version %d 12949>>>16 bedate x \b, created-at %s 12950>>>20 bedate x \b, last-maintained %s 12951 12952 12953# Gnumeric spreadsheet 12954# This entry is only semi-helpful, as Gnumeric compresses its files, so 12955# they will ordinarily reported as "compressed", but at least -z helps 1295639 string =<gmr:Workbook Gnumeric spreadsheet 12957 12958# From: James Youngman <jay@gnu.org> 12959# gnu find magic 129600 string \0LOCATE GNU findutils locate database data 12961>7 string >\0 \b, format %s 12962>7 string 02 \b (frcode) 12963 12964# Files produced by GNU gettext 12965 12966# gettext message catalogue 129670 search/1024 \nmsgid 12968>&0 search/1024 \nmsgstr GNU gettext message catalogue text 12969!:strength +100 12970!:mime text/x-po 12971 12972#------------------------------------------------------------------------------ 12973# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $ 12974# gnumeric: file(1) magic for Gnumeric spreadsheet 12975# This entry is only semi-helpful, as Gnumeric compresses its files, so 12976# they will ordinarily reported as "compressed", but at least -z helps 1297739 string =<gmr:Workbook Gnumeric spreadsheet 12978!:mime application/x-gnumeric 12979 12980#------------------------------------------------------------------------------ 12981# $File: gpt,v 1.4 2017/03/17 21:35:28 christos Exp $ 12982# 12983# GPT Partition table patterns. 12984# Author: Rogier Goossens (goossens.rogier@gmail.com) 12985# Note that a GPT-formatted disk must contain an MBR as well. 12986# 12987 12988# The initial segment (up to >>>>>>>>422) was copied from the X86 12989# partition table code (aka MBR). 12990# This is kept separate, so that MBR partitions are not reported as well. 12991# (use -k if you do want them as well) 12992 12993# First, detect the MBR partiton table 12994# If more than one GPT protective MBR partition exists, don't print anything 12995# (the other MBR detection code will then just print the MBR partition table) 129960x1FE leshort 0xAA55 12997>3 string !MS 12998>>3 string !SYSLINUX 12999>>>3 string !MTOOL 13000>>>>3 string !NEWLDR 13001>>>>>5 string !DOS 13002# not FAT (32 bit) 13003>>>>>>82 string !FAT32 13004#not Linux kernel 13005>>>>>>>514 string !HdrS 13006#not BeOS 13007>>>>>>>>422 string !Be\ Boot\ Loader 13008# GPT with protective MBR entry in partition 1 (only) 13009>>>>>>>>>450 ubyte 0xee 13010>>>>>>>>>>466 ubyte !0xee 13011>>>>>>>>>>>482 ubyte !0xee 13012>>>>>>>>>>>>498 ubyte !0xee 13013#>>>>>>>>>>>>>446 use gpt-mbr-partition 13014>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table 13015>>>>>>>>>>>>>>0 use gpt-mbr-type 13016>>>>>>>>>>>>>>&-8 use gpt-table 13017>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 13018>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART 13019>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table 13020>>>>>>>>>>>>>>>0 use gpt-mbr-type 13021>>>>>>>>>>>>>>>&-8 use gpt-table 13022>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 13023>>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART 13024>>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table 13025>>>>>>>>>>>>>>>>0 use gpt-mbr-type 13026>>>>>>>>>>>>>>>>&-8 use gpt-table 13027>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 13028>>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART 13029>>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table 13030>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 13031>>>>>>>>>>>>>>>>>&-8 use gpt-table 13032>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 13033>>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART 13034>>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table 13035>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 13036>>>>>>>>>>>>>>>>>>&-8 use gpt-table 13037>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 13038# GPT with protective MBR entry in partition 2 (only) 13039>>>>>>>>>450 ubyte !0xee 13040>>>>>>>>>>466 ubyte 0xee 13041>>>>>>>>>>>482 ubyte !0xee 13042>>>>>>>>>>>>498 ubyte !0xee 13043#>>>>>>>>>>>>>462 use gpt-mbr-partition 13044>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table 13045>>>>>>>>>>>>>>0 use gpt-mbr-type 13046>>>>>>>>>>>>>>&-8 use gpt-table 13047>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 13048>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART 13049>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table 13050>>>>>>>>>>>>>>>0 use gpt-mbr-type 13051>>>>>>>>>>>>>>>&-8 use gpt-table 13052>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 13053>>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART 13054>>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table 13055>>>>>>>>>>>>>>>>0 use gpt-mbr-type 13056>>>>>>>>>>>>>>>>&-8 use gpt-table 13057>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 13058>>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART 13059>>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table 13060>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 13061>>>>>>>>>>>>>>>>>&-8 use gpt-table 13062>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 13063>>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART 13064>>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table 13065>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 13066>>>>>>>>>>>>>>>>>>&-8 use gpt-table 13067>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 13068# GPT with protective MBR entry in partition 3 (only) 13069>>>>>>>>>450 ubyte !0xee 13070>>>>>>>>>>466 ubyte !0xee 13071>>>>>>>>>>>482 ubyte 0xee 13072>>>>>>>>>>>>498 ubyte !0xee 13073#>>>>>>>>>>>>>478 use gpt-mbr-partition 13074>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table 13075>>>>>>>>>>>>>>0 use gpt-mbr-type 13076>>>>>>>>>>>>>>&-8 use gpt-table 13077>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 13078>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART 13079>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table 13080>>>>>>>>>>>>>>>0 use gpt-mbr-type 13081>>>>>>>>>>>>>>>&-8 use gpt-table 13082>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 13083>>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART 13084>>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table 13085>>>>>>>>>>>>>>>>0 use gpt-mbr-type 13086>>>>>>>>>>>>>>>>&-8 use gpt-table 13087>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 13088>>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART 13089>>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table 13090>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 13091>>>>>>>>>>>>>>>>>&-8 use gpt-table 13092>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 13093>>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART 13094>>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table 13095>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 13096>>>>>>>>>>>>>>>>>>&-8 use gpt-table 13097>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 13098# GPT with protective MBR entry in partition 4 (only) 13099>>>>>>>>>450 ubyte !0xee 13100>>>>>>>>>>466 ubyte !0xee 13101>>>>>>>>>>>482 ubyte !0xee 13102>>>>>>>>>>>>498 ubyte 0xee 13103#>>>>>>>>>>>>>494 use gpt-mbr-partition 13104>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table 13105>>>>>>>>>>>>>>0 use gpt-mbr-type 13106>>>>>>>>>>>>>>&-8 use gpt-table 13107>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 13108>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART 13109>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table 13110>>>>>>>>>>>>>>>0 use gpt-mbr-type 13111>>>>>>>>>>>>>>>&-8 use gpt-table 13112>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 13113>>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART 13114>>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table 13115>>>>>>>>>>>>>>>>0 use gpt-mbr-type 13116>>>>>>>>>>>>>>>>&-8 use gpt-table 13117>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 13118>>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART 13119>>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table 13120>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 13121>>>>>>>>>>>>>>>>>&-8 use gpt-table 13122>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 13123>>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART 13124>>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table 13125>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 13126>>>>>>>>>>>>>>>>>>&-8 use gpt-table 13127>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 13128 13129# The following code does GPT detection and processing, including 13130# sector size detection. 13131# It has to be duplicated above because the top-level pattern 13132# (i.e. not called using 'use') must print *something* for file 13133# to count it as a match. Text only printed in named patterns is 13134# not counted, and causes file to continue, and try and match 13135# other patterns. 13136# 13137# Unfortunately, when assuming sector sizes >=16k, if the sector size 13138# happens to be 512 instead, we may find confusing data after the GPT 13139# table... If the GPT table has less than 128 entries, this may even 13140# happen for assumed sector sizes as small as 4k 13141# This could be solved by checking for the presence of the backup GPT 13142# header as well, but that makes the logic extremely complex 13143##0 name gpt-mbr-partition 13144##>(8.l*8192) string EFI\ PART 13145##>>(8.l*8192) use gpt-mbr-type 13146##>>&-8 use gpt-table 13147##>>0 ubyte x of 8192 bytes 13148##>(8.l*8192) string !EFI\ PART 13149##>>(8.l*4096) string EFI\ PART GPT partition table 13150##>>>0 use gpt-mbr-type 13151##>>>&-8 use gpt-table 13152##>>>0 ubyte x of 4096 bytes 13153##>>(8.l*4096) string !EFI\ PART 13154##>>>(8.l*2048) string EFI\ PART GPT partition table 13155##>>>>0 use gpt-mbr-type 13156##>>>>&-8 use gpt-table 13157##>>>>0 ubyte x of 2048 bytes 13158##>>>(8.l*2048) string !EFI\ PART 13159##>>>>(8.l*1024) string EFI\ PART GPT partition table 13160##>>>>>0 use gpt-mbr-type 13161##>>>>>&-8 use gpt-table 13162##>>>>>0 ubyte x of 1024 bytes 13163##>>>>(8.l*1024) string !EFI\ PART 13164##>>>>>(8.l*512) string EFI\ PART GPT partition table 13165##>>>>>>0 use gpt-mbr-type 13166##>>>>>>&-8 use gpt-table 13167##>>>>>>0 ubyte x of 512 bytes 13168 13169# Print details of MBR type for a GPT-disk 13170# Calling code ensures that there is only one 0xee partition. 131710 name gpt-mbr-type 13172# GPT with protective MBR entry in partition 1 13173>450 ubyte 0xee 13174>>454 ulelong 1 13175>>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 13176>>454 ulelong !1 \b (nonstandard: not at LBA 1) 13177# GPT with protective MBR entry in partition 2 13178>466 ubyte 0xee 13179>>470 ulelong 1 13180>>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 13181>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 13182>>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 13183>>470 ulelong !1 \b (nonstandard: not at LBA 1) 13184# GPT with protective MBR entry in partition 3 13185>482 ubyte 0xee 13186>>486 ulelong 1 13187>>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 13188>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 13189>>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 13190>>486 ulelong !1 \b (nonstandard: not at LBA 1) 13191# GPT with protective MBR entry in partition 4 13192>498 ubyte 0xee 13193>>502 ulelong 1 13194>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 13195>>502 ulelong !1 \b (nonstandard: not at LBA 1) 13196 13197# Print the information from a GPT partition table structure 131980 name gpt-table 13199>10 uleshort x \b, version %u 13200>8 uleshort x \b.%u 13201>56 ulelong x \b, GUID: %08x 13202>60 uleshort x \b-%04x 13203>62 uleshort x \b-%04x 13204>64 ubeshort x \b-%04x 13205>66 ubeshort x \b-%04x 13206>68 ubelong x \b%08x 13207#>80 uleshort x \b, %d partition entries 13208>32 ulequad+1 x \b, disk size: %lld sectors 13209 13210# In case a GPT data-structure is at LBA 0, report it as well 13211# This covers systems which are not GPT-aware, and which show 13212# and allow access to the protective partition. This code will 13213# detect the contents of such a partition. 132140 string EFI\ PART GPT data structure (nonstandard: at LBA 0) 13215>0 use gpt-table 13216>0 ubyte x (sector size unknown) 13217 13218 13219 13220#------------------------------------------------------------------------------ 13221# $File: gpu,v 1.2 2017/03/23 22:11:53 christos Exp $ 13222# gpu: file(1) magic for GPU input files 13223 13224# Standard Portable Intermediate Representation (SPIR) 13225# Documentation: https://www.khronos.org/spir 13226# Typical file extension: .spv 13227 132280 belong 0x07230203 Khronos SPIR-V binary, big-endian 13229>4 belong x \b, version 0x%08x 13230>8 belong x \b, generator 0x%08x 13231 132320 lelong 0x07230203 Khronos SPIR-V binary, little-endian 13233>4 lelong x \b, version 0x%08x 13234>8 lelong x \b, generator 0x%08x 13235 13236# Vulkan Trace file 13237# Documentation: 13238# https://github.com/LunarG/VulkanTools/blob/master/vktrace/vktrace_common/\ 13239# vktrace_trace_packet_identifiers.h 13240# Typical file extension: .vktrace 13241 132428 lequad 0xABADD068ADEAFD0C Vulkan trace file, little-endian 13243>0 leshort x \b, version %d 13244 132458 bequad 0xABADD068ADEAFD0C Vulkan trace file, big-endian 13246>0 beshort x \b, version %d 13247 13248#------------------------------------------------------------------------------ 13249# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $ 13250# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 13251# 13252# ACE/gr binary 132530 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file 13254>39 byte >0 - version %c 13255# ACE/gr ascii 132560 string #\ xvgr\ parameter\ file ACE/gr ascii file 132570 string #\ xmgr\ parameter\ file ACE/gr ascii file 132580 string #\ ACE/gr\ parameter\ file ACE/gr ascii file 13259# Grace projects 132600 string #\ Grace\ project\ file Grace project file 13261>23 string @version\ (version 13262>>32 byte >0 %c 13263>>33 string >\0 \b.%.2s 13264>>35 string >\0 \b.%.2s) 13265# ACE/gr fit description files 132660 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file 13267# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 13268 13269#------------------------------------------------------------------------------ 13270# $File: graphviz,v 1.8 2014/06/03 19:01:34 christos Exp $ 13271# graphviz: file(1) magic for http://www.graphviz.org/ 13272 13273# FIXME: These patterns match too generally. For example, the first 13274# line matches a LaTeX file containing the word "graph" (with a { 13275# following later) and the second line matches this file. 13276#0 regex/100l [\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{ graphviz graph text 13277#!:mime text/vnd.graphviz 13278#0 regex/100l [\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{ graphviz digraph text 13279#!:mime text/vnd.graphviz 13280 13281#------------------------------------------------------------------------------ 13282# $File: gringotts,v 1.6 2017/03/17 21:35:28 christos Exp $ 13283# gringotts: file(1) magic for Gringotts 13284# http://devel.pluto.linux.it/projects/Gringotts/ 13285# author: Germano Rizzo <mano@pluto.linux.it> 13286#GRG3????Y 132870 string GRG Gringotts data file 13288#file format 1 13289>3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9 13290#file format 2 13291>3 string 2 v.2, MCRYPT S2K, 13292>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 13293>>8 byte&0x70 0x10 SERPENT crypt, 13294>>8 byte&0x70 0x20 TWOFISH crypt, 13295>>8 byte&0x70 0x30 CAST-256 crypt, 13296>>8 byte&0x70 0x40 SAFER+ crypt, 13297>>8 byte&0x70 0x50 LOKI97 crypt, 13298>>8 byte&0x70 0x60 3DES crypt, 13299>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 13300>>8 byte&0x08 0x00 SHA1 hash, 13301>>8 byte&0x08 0x08 RIPEMD-160 hash, 13302>>8 byte&0x04 0x00 ZLib 13303>>8 byte&0x04 0x04 BZip2 13304>>8 byte&0x03 0x00 lvl.0 13305>>8 byte&0x03 0x01 lvl.3 13306>>8 byte&0x03 0x02 lvl.6 13307>>8 byte&0x03 0x03 lvl.9 13308#file format 3 13309>3 string 3 v.3, OpenPGP S2K, 13310>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 13311>>8 byte&0x70 0x10 SERPENT crypt, 13312>>8 byte&0x70 0x20 TWOFISH crypt, 13313>>8 byte&0x70 0x30 CAST-256 crypt, 13314>>8 byte&0x70 0x40 SAFER+ crypt, 13315>>8 byte&0x70 0x50 LOKI97 crypt, 13316>>8 byte&0x70 0x60 3DES crypt, 13317>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 13318>>8 byte&0x08 0x00 SHA1 hash, 13319>>8 byte&0x08 0x08 RIPEMD-160 hash, 13320>>8 byte&0x04 0x00 ZLib 13321>>8 byte&0x04 0x04 BZip2 13322>>8 byte&0x03 0x00 lvl.0 13323>>8 byte&0x03 0x01 lvl.3 13324>>8 byte&0x03 0x02 lvl.6 13325>>8 byte&0x03 0x03 lvl.9 13326#file format >3 13327>3 string >3 v.%.1s (unknown details) 13328 13329#------------------------------------------------------------------------------ 13330# $File: guile,v 1.1 2011/12/16 17:44:33 christos Exp $ 13331# Guile file magic from <dalepsmith@gmail.com> 13332# http://www.gnu.org/s/guile/ 13333# http://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250 13334 133350 string GOOF---- Guile Object 13336>8 string LE \b, little endian 13337>8 string BE \b, big endian 13338>11 string 4 \b, 32bit 13339>11 string 8 \b, 64bit 13340>13 regex .\.. \b, bytecode v%s 13341 13342#------------------------------------------------------------------------------ 13343# $File: hitachi-sh,v 1.8 2017/03/17 21:35:28 christos Exp $ 13344# hitach-sh: file(1) magic for Hitachi Super-H 13345# 13346# Super-H COFF 13347# 13348# updated by Joerg Jenderek at Oct 2015 13349# https://en.wikipedia.org/wiki/COFF 13350# https://de.wikipedia.org/wiki/Common_Object_File_Format 13351# http://www.delorie.com/djgpp/doc/coff/filhdr.html 13352# below test line conflicts with 2nd NTFS filesystem sector 13353# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR 13354# and Portable Gaming Notation Compressed format (*.WID http://pgn.freeservers.com/) 133550 beshort 0x0500 13356# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags 13357>18 ubeshort&0x8E80 0 13358# use big endian variant of subroutine to display name+variables+flags 13359# for common object formated files 13360>>0 use \^display-coff 13361 133620 leshort 0x0550 13363# test for unused flag bits in f_flags 13364>18 uleshort&0x8E80 0 13365# use little endian variant of subroutine to 13366# display name+variables+flags for common object formated files 13367>>0 use display-coff 13368 13369 13370#------------------------------------------------------------------------------ 13371# $File: hp,v 1.24 2014/04/30 21:41:02 christos Exp $ 13372# hp: file(1) magic for Hewlett Packard machines (see also "printer") 13373# 13374# XXX - somebody should figure out whether any byte order needs to be 13375# applied to the "TML" stuff; I'm assuming the Apollo stuff is 13376# big-endian as it was mostly 68K-based. 13377# 13378# I think the 500 series was the old stack-based machines, running a 13379# UNIX environment atop the "SUN kernel"; dunno whether it was 13380# big-endian or little-endian. 13381# 13382# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based; 13383# hp300 are 68020+68881 based; hp400 are also 68k. The following basic 13384# HP magic is useful for reference, but using "long" magic is a better 13385# practice in order to avoid collisions. 13386# 13387# Guy Harris (guy@netapp.com): some additions to this list came from 13388# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1, 13389# 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0 13390# "/etc/magic", though, except for the "archive file relocatable library" 13391# stuff, and the 68030 and 68040 stuff isn't there at all - are they not 13392# used in executables, or have they just not yet updated "/etc/magic" 13393# completely? 13394# 13395# 0 beshort 200 hp200 (68010) BSD binary 13396# 0 beshort 300 hp300 (68020+68881) BSD binary 13397# 0 beshort 0x20c hp200/300 HP-UX binary 13398# 0 beshort 0x20d hp400 (68030) HP-UX binary 13399# 0 beshort 0x20e hp400 (68040?) HP-UX binary 13400# 0 beshort 0x20b PA-RISC1.0 HP-UX binary 13401# 0 beshort 0x210 PA-RISC1.1 HP-UX binary 13402# 0 beshort 0x211 PA-RISC1.2 HP-UX binary 13403# 0 beshort 0x214 PA-RISC2.0 HP-UX binary 13404 13405# 13406# The "misc" stuff needs a byte order; the archives look suspiciously 13407# like the old 177545 archives (0xff65 = 0177545). 13408# 13409#### Old Apollo stuff 134100 beshort 0627 Apollo m68k COFF executable 13411>18 beshort ^040000 not stripped 13412>22 beshort >0 - version %d 134130 beshort 0624 apollo a88k COFF executable 13414>18 beshort ^040000 not stripped 13415>22 beshort >0 - version %d 134160 long 01203604016 TML 0123 byte-order format 134170 long 01702407010 TML 1032 byte-order format 134180 long 01003405017 TML 2301 byte-order format 134190 long 01602007412 TML 3210 byte-order format 13420#### PA-RISC 1.1 134210 belong 0x02100106 PA-RISC1.1 relocatable object 134220 belong 0x02100107 PA-RISC1.1 executable 13423>168 belong &0x00000004 dynamically linked 13424>(144) belong 0x054ef630 dynamically linked 13425>96 belong >0 - not stripped 13426 134270 belong 0x02100108 PA-RISC1.1 shared executable 13428>168 belong&0x4 0x4 dynamically linked 13429>(144) belong 0x054ef630 dynamically linked 13430>96 belong >0 - not stripped 13431 134320 belong 0x0210010b PA-RISC1.1 demand-load executable 13433>168 belong&0x4 0x4 dynamically linked 13434>(144) belong 0x054ef630 dynamically linked 13435>96 belong >0 - not stripped 13436 134370 belong 0x0210010e PA-RISC1.1 shared library 13438>96 belong >0 - not stripped 13439 134400 belong 0x0210010d PA-RISC1.1 dynamic load library 13441>96 belong >0 - not stripped 13442 13443#### PA-RISC 2.0 134440 belong 0x02140106 PA-RISC2.0 relocatable object 13445 134460 belong 0x02140107 PA-RISC2.0 executable 13447>168 belong &0x00000004 dynamically linked 13448>(144) belong 0x054ef630 dynamically linked 13449>96 belong >0 - not stripped 13450 134510 belong 0x02140108 PA-RISC2.0 shared executable 13452>168 belong &0x00000004 dynamically linked 13453>(144) belong 0x054ef630 dynamically linked 13454>96 belong >0 - not stripped 13455 134560 belong 0x0214010b PA-RISC2.0 demand-load executable 13457>168 belong &0x00000004 dynamically linked 13458>(144) belong 0x054ef630 dynamically linked 13459>96 belong >0 - not stripped 13460 134610 belong 0x0214010e PA-RISC2.0 shared library 13462>96 belong >0 - not stripped 13463 134640 belong 0x0214010d PA-RISC2.0 dynamic load library 13465>96 belong >0 - not stripped 13466 13467#### 800 134680 belong 0x020b0106 PA-RISC1.0 relocatable object 13469 134700 belong 0x020b0107 PA-RISC1.0 executable 13471>168 belong&0x4 0x4 dynamically linked 13472>(144) belong 0x054ef630 dynamically linked 13473>96 belong >0 - not stripped 13474 134750 belong 0x020b0108 PA-RISC1.0 shared executable 13476>168 belong&0x4 0x4 dynamically linked 13477>(144) belong 0x054ef630 dynamically linked 13478>96 belong >0 - not stripped 13479 134800 belong 0x020b010b PA-RISC1.0 demand-load executable 13481>168 belong&0x4 0x4 dynamically linked 13482>(144) belong 0x054ef630 dynamically linked 13483>96 belong >0 - not stripped 13484 134850 belong 0x020b010e PA-RISC1.0 shared library 13486>96 belong >0 - not stripped 13487 134880 belong 0x020b010d PA-RISC1.0 dynamic load library 13489>96 belong >0 - not stripped 13490 134910 belong 0x213c6172 archive file 13492>68 belong 0x020b0619 - PA-RISC1.0 relocatable library 13493>68 belong 0x02100619 - PA-RISC1.1 relocatable library 13494>68 belong 0x02110619 - PA-RISC1.2 relocatable library 13495>68 belong 0x02140619 - PA-RISC2.0 relocatable library 13496 13497#### 500 134980 long 0x02080106 HP s500 relocatable executable 13499>16 long >0 - version %d 13500 135010 long 0x02080107 HP s500 executable 13502>16 long >0 - version %d 13503 135040 long 0x02080108 HP s500 pure executable 13505>16 long >0 - version %d 13506 13507#### 200 135080 belong 0x020c0108 HP s200 pure executable 13509>4 beshort >0 - version %d 13510>8 belong &0x80000000 save fp regs 13511>8 belong &0x40000000 dynamically linked 13512>8 belong &0x20000000 debuggable 13513>36 belong >0 not stripped 13514 135150 belong 0x020c0107 HP s200 executable 13516>4 beshort >0 - version %d 13517>8 belong &0x80000000 save fp regs 13518>8 belong &0x40000000 dynamically linked 13519>8 belong &0x20000000 debuggable 13520>36 belong >0 not stripped 13521 135220 belong 0x020c010b HP s200 demand-load executable 13523>4 beshort >0 - version %d 13524>8 belong &0x80000000 save fp regs 13525>8 belong &0x40000000 dynamically linked 13526>8 belong &0x20000000 debuggable 13527>36 belong >0 not stripped 13528 135290 belong 0x020c0106 HP s200 relocatable executable 13530>4 beshort >0 - version %d 13531>6 beshort >0 - highwater %d 13532>8 belong &0x80000000 save fp regs 13533>8 belong &0x20000000 debuggable 13534>8 belong &0x10000000 PIC 13535 135360 belong 0x020a0108 HP s200 (2.x release) pure executable 13537>4 beshort >0 - version %d 13538>36 belong >0 not stripped 13539 135400 belong 0x020a0107 HP s200 (2.x release) executable 13541>4 beshort >0 - version %d 13542>36 belong >0 not stripped 13543 135440 belong 0x020c010e HP s200 shared library 13545>4 beshort >0 - version %d 13546>6 beshort >0 - highwater %d 13547>36 belong >0 not stripped 13548 135490 belong 0x020c010d HP s200 dynamic load library 13550>4 beshort >0 - version %d 13551>6 beshort >0 - highwater %d 13552>36 belong >0 not stripped 13553 13554#### MISC 135550 long 0x0000ff65 HP old archive 135560 long 0x020aff65 HP s200 old archive 135570 long 0x020cff65 HP s200 old archive 135580 long 0x0208ff65 HP s500 old archive 13559 135600 long 0x015821a6 HP core file 13561 135620 long 0x4da7eee8 HP-WINDOWS font 13563>8 byte >0 - version %d 135640 string Bitmapfile HP Bitmapfile 13565 135660 string IMGfile CIS compimg HP Bitmapfile 13567# XXX - see "lif" 13568#0 short 0x8000 lif file 135690 long 0x020c010c compiled Lisp 13570 135710 string msgcat01 HP NLS message catalog, 13572>8 long >0 %d messages 13573 13574# Summary: HP-48/49 calculator 13575# Created by: phk@data.fls.dk 13576# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk> 13577# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support) 135780 string HPHP HP 13579>4 string 48 48 binary 13580>4 string 49 49 binary 13581>7 byte >64 - Rev %c 13582>8 leshort 0x2911 (ADR) 13583>8 leshort 0x2933 (REAL) 13584>8 leshort 0x2955 (LREAL) 13585>8 leshort 0x2977 (COMPLX) 13586>8 leshort 0x299d (LCOMPLX) 13587>8 leshort 0x29bf (CHAR) 13588>8 leshort 0x29e8 (ARRAY) 13589>8 leshort 0x2a0a (LNKARRAY) 13590>8 leshort 0x2a2c (STRING) 13591>8 leshort 0x2a4e (HXS) 13592>8 leshort 0x2a74 (LIST) 13593>8 leshort 0x2a96 (DIR) 13594>8 leshort 0x2ab8 (ALG) 13595>8 leshort 0x2ada (UNIT) 13596>8 leshort 0x2afc (TAGGED) 13597>8 leshort 0x2b1e (GROB) 13598>8 leshort 0x2b40 (LIB) 13599>8 leshort 0x2b62 (BACKUP) 13600>8 leshort 0x2b88 (LIBDATA) 13601>8 leshort 0x2d9d (PROG) 13602>8 leshort 0x2dcc (CODE) 13603>8 leshort 0x2e48 (GNAME) 13604>8 leshort 0x2e6d (LNAME) 13605>8 leshort 0x2e92 (XLIB) 13606 136070 string %%HP: HP text 13608>6 string T(0) - T(0) 13609>6 string T(1) - T(1) 13610>6 string T(2) - T(2) 13611>6 string T(3) - T(3) 13612>10 string A(D) A(D) 13613>10 string A(R) A(R) 13614>10 string A(G) A(G) 13615>14 string F(.) F(.); 13616>14 string F(,) F(,); 13617 13618 13619# Summary: HP-38/39 calculator 13620# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 136210 string HP3 13622>3 string 8 HP 38 13623>3 string 9 HP 39 13624>4 string Bin binary 13625>4 string Asc ASCII 13626>7 string A (Directory List) 13627>7 string B (Zaplet) 13628>7 string C (Note) 13629>7 string D (Program) 13630>7 string E (Variable) 13631>7 string F (List) 13632>7 string G (Matrix) 13633>7 string H (Library) 13634>7 string I (Target List) 13635>7 string J (ASCII Vector specification) 13636>7 string K (wildcard) 13637 13638# Summary: HP-38/39 calculator 13639# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 136400 string HP3 13641>3 string 8 HP 38 13642>3 string 9 HP 39 13643>4 string Bin binary 13644>4 string Asc ASCII 13645>7 string A (Directory List) 13646>7 string B (Zaplet) 13647>7 string C (Note) 13648>7 string D (Program) 13649>7 string E (Variable) 13650>7 string F (List) 13651>7 string G (Matrix) 13652>7 string H (Library) 13653>7 string I (Target List) 13654>7 string J (ASCII Vector specification) 13655>7 string K (wildcard) 13656 13657# hpBSD magic numbers 136580 beshort 200 hp200 (68010) BSD 13659>2 beshort 0407 impure binary 13660>2 beshort 0410 read-only binary 13661>2 beshort 0413 demand paged binary 136620 beshort 300 hp300 (68020+68881) BSD 13663>2 beshort 0407 impure binary 13664>2 beshort 0410 read-only binary 13665>2 beshort 0413 demand paged binary 13666# 13667# From David Gero <dgero@nortelnetworks.com> 13668# HP-UX 10.20 core file format from /usr/include/sys/core.h 13669# Unfortunately, HP-UX uses corehead blocks without specifying the order 13670# There are four we care about: 13671# CORE_KERNEL, which starts with the string "HP-UX" 13672# CORE_EXEC, which contains the name of the command 13673# CORE_PROC, which contains the signal number that caused the core dump 13674# CORE_FORMAT, which contains the version of the core file format (== 1) 13675# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC 13676# but we include all 6 variations of the order of the first 3, and 13677# assume that PROC will always be last 13678# Order 1: KERNEL, EXEC, FORMAT, PROC 136790x10 string HP-UX 13680>0 belong 2 13681>>0xC belong 0x3C 13682>>>0x4C belong 0x100 13683>>>>0x58 belong 0x44 13684>>>>>0xA0 belong 1 13685>>>>>>0xAC belong 4 13686>>>>>>>0xB0 belong 1 13687>>>>>>>>0xB4 belong 4 core file 13688>>>>>>>>>0x90 string >\0 from '%s' 13689>>>>>>>>>0xC4 belong 3 - received SIGQUIT 13690>>>>>>>>>0xC4 belong 4 - received SIGILL 13691>>>>>>>>>0xC4 belong 5 - received SIGTRAP 13692>>>>>>>>>0xC4 belong 6 - received SIGABRT 13693>>>>>>>>>0xC4 belong 7 - received SIGEMT 13694>>>>>>>>>0xC4 belong 8 - received SIGFPE 13695>>>>>>>>>0xC4 belong 10 - received SIGBUS 13696>>>>>>>>>0xC4 belong 11 - received SIGSEGV 13697>>>>>>>>>0xC4 belong 12 - received SIGSYS 13698>>>>>>>>>0xC4 belong 33 - received SIGXCPU 13699>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 13700# Order 2: KERNEL, FORMAT, EXEC, PROC 13701>>>0x4C belong 1 13702>>>>0x58 belong 4 13703>>>>>0x5C belong 1 13704>>>>>>0x60 belong 0x100 13705>>>>>>>0x6C belong 0x44 13706>>>>>>>>0xB4 belong 4 core file 13707>>>>>>>>>0xA4 string >\0 from '%s' 13708>>>>>>>>>0xC4 belong 3 - received SIGQUIT 13709>>>>>>>>>0xC4 belong 4 - received SIGILL 13710>>>>>>>>>0xC4 belong 5 - received SIGTRAP 13711>>>>>>>>>0xC4 belong 6 - received SIGABRT 13712>>>>>>>>>0xC4 belong 7 - received SIGEMT 13713>>>>>>>>>0xC4 belong 8 - received SIGFPE 13714>>>>>>>>>0xC4 belong 10 - received SIGBUS 13715>>>>>>>>>0xC4 belong 11 - received SIGSEGV 13716>>>>>>>>>0xC4 belong 12 - received SIGSYS 13717>>>>>>>>>0xC4 belong 33 - received SIGXCPU 13718>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 13719# Order 3: FORMAT, KERNEL, EXEC, PROC 137200x24 string HP-UX 13721>0 belong 1 13722>>0xC belong 4 13723>>>0x10 belong 1 13724>>>>0x14 belong 2 13725>>>>>0x20 belong 0x3C 13726>>>>>>0x60 belong 0x100 13727>>>>>>>0x6C belong 0x44 13728>>>>>>>>0xB4 belong 4 core file 13729>>>>>>>>>0xA4 string >\0 from '%s' 13730>>>>>>>>>0xC4 belong 3 - received SIGQUIT 13731>>>>>>>>>0xC4 belong 4 - received SIGILL 13732>>>>>>>>>0xC4 belong 5 - received SIGTRAP 13733>>>>>>>>>0xC4 belong 6 - received SIGABRT 13734>>>>>>>>>0xC4 belong 7 - received SIGEMT 13735>>>>>>>>>0xC4 belong 8 - received SIGFPE 13736>>>>>>>>>0xC4 belong 10 - received SIGBUS 13737>>>>>>>>>0xC4 belong 11 - received SIGSEGV 13738>>>>>>>>>0xC4 belong 12 - received SIGSYS 13739>>>>>>>>>0xC4 belong 33 - received SIGXCPU 13740>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 13741# Order 4: EXEC, KERNEL, FORMAT, PROC 137420x64 string HP-UX 13743>0 belong 0x100 13744>>0xC belong 0x44 13745>>>0x54 belong 2 13746>>>>0x60 belong 0x3C 13747>>>>>0xA0 belong 1 13748>>>>>>0xAC belong 4 13749>>>>>>>0xB0 belong 1 13750>>>>>>>>0xB4 belong 4 core file 13751>>>>>>>>>0x44 string >\0 from '%s' 13752>>>>>>>>>0xC4 belong 3 - received SIGQUIT 13753>>>>>>>>>0xC4 belong 4 - received SIGILL 13754>>>>>>>>>0xC4 belong 5 - received SIGTRAP 13755>>>>>>>>>0xC4 belong 6 - received SIGABRT 13756>>>>>>>>>0xC4 belong 7 - received SIGEMT 13757>>>>>>>>>0xC4 belong 8 - received SIGFPE 13758>>>>>>>>>0xC4 belong 10 - received SIGBUS 13759>>>>>>>>>0xC4 belong 11 - received SIGSEGV 13760>>>>>>>>>0xC4 belong 12 - received SIGSYS 13761>>>>>>>>>0xC4 belong 33 - received SIGXCPU 13762>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 13763# Order 5: FORMAT, EXEC, KERNEL, PROC 137640x78 string HP-UX 13765>0 belong 1 13766>>0xC belong 4 13767>>>0x10 belong 1 13768>>>>0x14 belong 0x100 13769>>>>>0x20 belong 0x44 13770>>>>>>0x68 belong 2 13771>>>>>>>0x74 belong 0x3C 13772>>>>>>>>0xB4 belong 4 core file 13773>>>>>>>>>0x58 string >\0 from '%s' 13774>>>>>>>>>0xC4 belong 3 - received SIGQUIT 13775>>>>>>>>>0xC4 belong 4 - received SIGILL 13776>>>>>>>>>0xC4 belong 5 - received SIGTRAP 13777>>>>>>>>>0xC4 belong 6 - received SIGABRT 13778>>>>>>>>>0xC4 belong 7 - received SIGEMT 13779>>>>>>>>>0xC4 belong 8 - received SIGFPE 13780>>>>>>>>>0xC4 belong 10 - received SIGBUS 13781>>>>>>>>>0xC4 belong 11 - received SIGSEGV 13782>>>>>>>>>0xC4 belong 12 - received SIGSYS 13783>>>>>>>>>0xC4 belong 33 - received SIGXCPU 13784>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 13785# Order 6: EXEC, FORMAT, KERNEL, PROC 13786>0 belong 0x100 13787>>0xC belong 0x44 13788>>>0x54 belong 1 13789>>>>0x60 belong 4 13790>>>>>0x64 belong 1 13791>>>>>>0x68 belong 2 13792>>>>>>>0x74 belong 0x2C 13793>>>>>>>>0xB4 belong 4 core file 13794>>>>>>>>>0x44 string >\0 from '%s' 13795>>>>>>>>>0xC4 belong 3 - received SIGQUIT 13796>>>>>>>>>0xC4 belong 4 - received SIGILL 13797>>>>>>>>>0xC4 belong 5 - received SIGTRAP 13798>>>>>>>>>0xC4 belong 6 - received SIGABRT 13799>>>>>>>>>0xC4 belong 7 - received SIGEMT 13800>>>>>>>>>0xC4 belong 8 - received SIGFPE 13801>>>>>>>>>0xC4 belong 10 - received SIGBUS 13802>>>>>>>>>0xC4 belong 11 - received SIGSEGV 13803>>>>>>>>>0xC4 belong 12 - received SIGSYS 13804>>>>>>>>>0xC4 belong 33 - received SIGXCPU 13805>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 13806 13807 13808 13809#------------------------------------------------------------------------------ 13810# $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $ 13811# human68k: file(1) magic for Human68k (X680x0 DOS) binary formats 13812# Magic too short! 13813#0 string HU Human68k 13814#>68 string LZX LZX compressed 13815#>>72 string >\0 (version %s) 13816#>(8.L+74) string LZX LZX compressed 13817#>>(8.L+78) string >\0 (version %s) 13818#>60 belong >0 binded 13819#>(8.L+66) string #HUPAIR hupair 13820#>0 string HU X executable 13821#>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1 13822#>4 belong >0 - base address 0x%x 13823#>28 belong >0 not stripped 13824#>32 belong >0 with debug information 13825#0 beshort 0x601a Human68k Z executable 13826#0 beshort 0x6000 Human68k object file 13827#0 belong 0xd1000000 Human68k ar binary archive 13828#0 belong 0xd1010000 Human68k ar ascii archive 13829#0 beshort 0x0068 Human68k lib archive 13830#4 string LZX Human68k LZX compressed 13831#>8 string >\0 (version %s) 13832#>4 string LZX R executable 13833#2 string #HUPAIR Human68k hupair R executable 13834 13835#------------------------------------------------------------------------------ 13836# $File: ibm370,v 1.10 2017/03/17 21:35:28 christos Exp $ 13837# ibm370: file(1) magic for IBM 370 and compatibles. 13838# 13839# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable". 13840# What the heck *is* "USS/370"? 13841# AIX 4.1's "/etc/magic" has 13842# 13843# 0 short 0535 370 sysV executable 13844# >12 long >0 not stripped 13845# >22 short >0 - version %d 13846# >30 long >0 - 5.2 format 13847# 0 short 0530 370 sysV pure executable 13848# >12 long >0 not stripped 13849# >22 short >0 - version %d 13850# >30 long >0 - 5.2 format 13851# 13852# instead of the "USS/370" versions of the same magic numbers. 13853# 138540 beshort 0537 370 XA sysV executable 13855>12 belong >0 not stripped 13856>22 beshort >0 - version %d 13857>30 belong >0 - 5.2 format 138580 beshort 0532 370 XA sysV pure executable 13859>12 belong >0 not stripped 13860>22 beshort >0 - version %d 13861>30 belong >0 - 5.2 format 138620 beshort 054001 370 sysV pure executable 13863>12 belong >0 not stripped 138640 beshort 055001 370 XA sysV pure executable 13865>12 belong >0 not stripped 138660 beshort 056401 370 sysV executable 13867>12 belong >0 not stripped 138680 beshort 057401 370 XA sysV executable 13869>12 belong >0 not stripped 138700 beshort 0531 SVR2 executable (Amdahl-UTS) 13871>12 belong >0 not stripped 13872>24 belong >0 - version %d 138730 beshort 0534 SVR2 pure executable (Amdahl-UTS) 13874>12 belong >0 not stripped 13875>24 belong >0 - version %d 138760 beshort 0530 SVR2 pure executable (USS/370) 13877>12 belong >0 not stripped 13878>24 belong >0 - version %d 138790 beshort 0535 SVR2 executable (USS/370) 13880>12 belong >0 not stripped 13881>24 belong >0 - version %d 13882 13883#------------------------------------------------------------------------------ 13884# $File: ibm6000,v 1.13 2017/03/17 21:35:28 christos Exp $ 13885# ibm6000: file(1) magic for RS/6000 and the RT PC. 13886# 138870 beshort 0x01df executable (RISC System/6000 V3.1) or obj module 13888>12 belong >0 not stripped 13889# Breaks sun4 statically linked execs. 13890#0 beshort 0x0103 executable (RT Version 2) or obj module 13891#>2 byte 0x50 pure 13892#>28 belong >0 not stripped 13893#>6 beshort >0 - version %ld 138940 beshort 0x0104 shared library 138950 beshort 0x0105 ctab data 138960 beshort 0xfe04 structured file 138970 string 0xabcdef AIX message catalog 138980 belong 0x000001f9 AIX compiled message catalog 138990 string \<aiaff> archive 139000 string \<bigaf> archive (big format) 13901 139020 beshort 0x01f7 64-bit XCOFF executable or object module 13903>20 belong 0 not stripped 13904# GRR: this test is still too general as it catches also many FATs of DOS filesystems 139054 belong &0x0feeddb0 13906# real core dump could not be 32-bit and 64-bit together 13907>7 byte&0x03 !3 AIX core file 13908>>1 byte &0x01 fulldump 13909>>7 byte &0x01 32-bit 13910>>>0x6e0 string >\0 \b, %s 13911>>7 byte &0x02 64-bit 13912>>>0x524 string >\0 \b, %s 13913 13914#------------------------------------------------------------------------------ 13915# $File: icc,v 1.5 2017/08/13 00:21:47 christos Exp $ 13916# icc: file(1) magic for International Color Consortium file formats 13917 13918# 13919# Color profiles as per the ICC's "Image technology colour management - 13920# Architecture, profile format, and data structure" specification. 13921# See 13922# 13923# http://www.color.org/specification/ICC1v43_2010-12.pdf 13924# 13925# for Specification ICC.1:2010 (Profile version 4.3.0.0). 13926# URL: http://fileformats.archiveteam.org/wiki/ICC_profile 13927# Reference: http://www.color.org/iccmax/ICC.2-2016-7.pdf 13928# Update: Joerg Jenderek 13929# 13930# Bytes 36 to 39 contain a generic profile file signature of "acsp"; 13931# bytes 40 to 43 "may be used to identify the primary platform/operating 13932# system framework for which the profile was created". 13933# 13934# check and display ICC/ICM color profile 139350 name color-profile 13936>36 string acsp 13937# skip ASCII like Cognacspirit.txt by month <= 12 13938>>26 ubeshort <13 13939# platform/operating system. Only 5 mentioned 13940 13941# 13942# This appears to be what's used for Apple ColorSync profiles. 13943# Instead of adding that, Apple just changed the generic "acsp" entry 13944# to be for "ColorSync ICC Color Profile" rather than "Kodak Color 13945# Management System, ICC Profile". 13946# Yes, it's "APPL", not "AAPL"; see the spec. 13947>>>40 string APPL ColorSync 13948 13949# Microsoft ICM color profile 13950>>>40 string MSFT Microsoft 13951 13952# Yes, that's a blank after "SGI". 13953>>>40 string SGI\ SGI 13954 13955# XXX - is this what's used for the Sun KCMS or not? The standard file 13956# uses just "acsp" for that, but Apple's file uses it for "ColorSync", 13957# and there *is* an identified "primary platform" value of SUNW. 13958>>>40 string SUNW Sun KCMS 13959 13960# 5th platform 13961>>>40 string TGNT Taligent 13962 13963# remaining "l" "e" of "color profile" printed later to avoid error 13964>>>40 string x color profi 13965#>>>40 string x (%.4s) 13966!:mime application/vnd.iccprofile 13967# for "ICM" extension only versions 2.x and for Kodak "CC" 2.0 is found 13968>>>8 ubyte =2 13969# do not use empty message text to a avoid error like 13970# icc, 82: Warning: Current entry does not yet have a description for adding a EXTENSION type 13971# file.exe: could not find any valid magic files! 13972>>>>9 ubyte !0 \ble 13973!:ext icc/icm 13974# minor version 13975>>>>9 ubyte =0 \bl 13976# Kodak colour management system 13977>>>>>4 string =KCMS \be 13978!:ext icc/icm/cc 13979>>>>>4 string !KCMS \be 13980!:ext icc/icm 13981>>>8 ubyte !2 \ble 13982!:ext icc 13983# Profile version major.4bit-minor.sub1.sub2 like 4.3.0.0 (04300000h) 13984>>>8 ubyte x %u 13985>>>9 ubyte/16 x \b.%u 13986# reserved and shall be null but 205.205 in umx1220u.icm 13987>>>10 ubyte >0 \b.%u 13988>>>>11 ubyte >0 \b.%u 13989# preferred colour management module like appl CCMS KCMS Lino UCCM "Win " "FF " 13990# skip space like in brmsl08f.icm and null like in brmsl09f.icm, brmsl07f.icm 13991>>>4 string >\ \b, type %.2s 13992>>>>6 string >\ \b%.1s 13993>>>>>7 string >\ \b%.1s 13994# colour space "XYZ " "Lab " "RGB " CMYK GRAY ... 13995>>>16 string x \b, %.3s 13996>>>19 string >\ \b%.1s 13997# Profile Connection Space (PCS) field usually "XYZ " or "Lab " but sometimes 13998# null or CMYK like in ISOcoated_v2_to_PSOcoated_v3_DeviceLink.icc 13999>>>20 string >\0 \b/%.3s 14000>>>>23 string >\ \b%.1s 14001# eleven device classes 14002>>>12 string x \b-%.4s device 14003# skip 00001964h in hpf69000.icc or 0h in XRDC50Q.ICM or " ROT" in brmsl05f.icm 14004>>>52 string >\040 14005# skip "none" model like in "Trinitron Compatible 9300K G2.2.icm" 14006>>>>52 ubelong !0x6e6f6e65 14007# device manufacturer field like "HP " "IBM " EPSO 14008>>>>>48 string x \b, %.2s 14009>>>>>50 string >\ \b%.1s 14010>>>>>51 string >\ \b%.1s 14011# model like "ADI " "A265" and skip 20000404h in IS330.icm for RICOH RUSSIAN-SC 14012>>>>>52 string >\ \ \b/%.3s 14013>>>>>>55 string >\ \b%.1s 14014>>>>>52 string x model 14015# creator (often same as manufacture) like HP SONY XROX or null like in A925A.icm 14016>>>80 string >\0 by %.2s 14017>>>>82 string >\ \b%.1s 14018>>>>>83 string >\ \b%.1s 14019# profile size 14020>>>0 ubelong x \b, %u bytes 14021# skip invalid date 0 like in linearSRGB.icc 14022>>>24 ubequad !0 14023# datetime dd-mm-yyyy hh:mm:ss 14024>>>>28 ubeshort x \b, %u 14025# month <= 12 14026>>>>26 ubeshort x \b-%u 14027# year 14028>>>>24 ubeshort x \b-%u 14029# do not display midnight time like in CNHP8308.ICC 14030>>>>30 ubequad&0xFFffFFffFFff0000 !0 14031# hour <= 24 14032>>>>>30 ubeshort x %u 14033# minutes <= 59 14034>>>>>32 ubeshort x \b:%.2u 14035# seconds <= 59 14036>>>>>34 ubeshort x \b:%.2u 14037# vendor specific flags like 2 in HPCLJ5.ICM 14038>>>44 ubeshort >0 \b, 0x%x vendor flags 14039# profile flags bits 0-2 of least 16 used by ICC 14040#>>>44 ubelong >0 \b, 0x%x flags 14041# icEmbeddedProfileTrue 14042>>>44 ubelong &1 \b, embedded 14043# icEmbeddedProfileFalse 14044#>>>44 ubelong ^1 \b, not embedded 14045# icUseWithEmbeddedDataOnly 14046>>>44 ubelong &2 \b, dependently 14047# icUseAnywhere 14048#>>>44 ubelong ^2 \b, independently 14049>>>44 ubelong &4 \b, MCS 14050#>>>44 ubelong ^4 \b, no MCS 14051# vendor specific device attributes 1~srgb.icc 14052# E000D00h~CNB7QEDA.ICM C000A00h~CNB5FCAA.ICM 01040401h~CNB25PE3.ICM 14053>>>56 ubelong >0 \b, 0x%x vendor attribute 14054# ICC device attributes bits 0-7 used 14055#>>>60 ubelong x \b, 0x%x attribute 14056# http://www.color.org/icc34.h 14057>>>60 ubelong &0x01 \b, transparent 14058#>>>60 ubelong ^0x01 \b, reflective 14059>>>60 ubelong &0x02 \b, matte 14060#>>>60 ubelong ^0x02 \b, glossy 14061>>>60 ubelong &0x04 \b, negative 14062#>>>60 ubelong ^0x04 \b, positive 14063>>>60 ubelong &0x08 \b, black&white 14064#>>>60 ubelong ^0x08 \b, colour 14065>>>60 ubelong &0x10 \b, non-paper 14066#>>>60 ubelong ^0x10 \b, paper 14067>>>60 ubelong &0x20 \b, non-textured 14068#>>>60 ubelong ^0x20 \b, textured 14069>>>60 ubelong &0x40 \b, non-isotropic 14070#>>>60 ubelong ^0x40 \b, isotropic 14071>>>60 ubelong &0x80 \b, self-luminous 14072#>>>60 ubelong ^0x80 \b, non-self-luminous 14073# rendering intent 0-3 but 7AEA5027h in EE051__1.ICM 6CB1BCh in EE061__1.ICM 14074>>>64 ubelong >3 \b, 0x%x rendering intent 14075#>>>64 ubelong =0 \b, perceptual 14076>>>64 ubelong =1 \b, relative colorimetric 14077>>>64 ubelong =2 \b, saturation 14078>>>64 ubelong =3 \b, absolute colorimetric 14079# PCS illuminant (3*s15Fixed16Numbers) often 0000f6d6 00010000 0000d32d 14080>>>71 ubequad !0xd6000100000000d3 \b, PCS 14081# usually X~0.9642*65536=63189.8112~63190=F6D5h ; but also found 14082# often F6D6 in gt5000r.icm, F6B8 in kodakce.icm, F6CA in RSWOP.icm 14083>>>>68 ubelong !0x0000f6d5 X=0x%x 14084# usually Y=1.0~00010000h but Y=0 in brmsl07f.icm 14085>>>>72 ubelong !0x00010000 Y=0x%x 14086# usually Z~0.8249*65536=54060.6464~54061=D32Dh ; but also found 14087# D2F7 in hp1200c.icm, often D32C in A925A.icm, D309 in RSWOP.icm , D2F8 in kodak_dc.icm 14088>>>>76 ubelong !0x0000d32d Z=0x%x 14089# Profile ID. MD5 fingerprinting method as defined in Internet RFC 1321. 14090>>>84 ubequad >0 \b, 0x%llx MD5 14091# reserved in older versions should be zero but also found CDCDCDCDCDCDCDCD 14092#>>100 ubequad x \b 0x%llx reserved 14093# tag table 14094# 6 <= tags count <= 43 14095#>>>128 ubelong >43 \b, %u tags 14096>>>128 ubelong x 14097# shall contain the profileDescriptionTag "desc" , copyrightTag "cprt" 14098# search range = tags count * 12 -8=< maximal tag count * 12 -8= 43 * 12 -8= 508 14099>>>>132 search/508 cprt 14100# but no copyright tag in linearSRGB.icc 14101# beneath /System/Library/Frameworks/WebKit.framework/ 14102# Versions/A/Frameworks/WebCore.framework/Versions/A/Resources 14103>>>>132 default x \b, no copyright tag 14104# 1st tag 14105#>>>132 string x \b, 1st tag %.4s 14106#>>>136 ubelong x 0x%x offset 14107#>>>140 ubelong x 0x%x len 14108# 2nd tag,... 14109# look also for profileDescriptionTag "desc" 14110>>>132 search/508 desc 14111# look further for TextDescriptionType "desc" signature 14112>>>>(&0.L) string =desc 14113>>>>>&4 pstring/l x "%s" 14114# look alternative for multiLocalizedUnicodeType "mluc" signature like in VideoPAL.icc 14115>>>>(&0.L) string =mluc 14116>>>>>&(&8.L) ubequad x 14117>>>>>>&4 bestring16 x '%s' 14118 14119# Any other profile. 14120# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles, 14121# and use "acsp" for everything else and dump the "primary platform" 14122# string in those cases? 1412336 string acsp 14124>0 use color-profile 14125 14126 14127 14128#------------------------------------------------------------------------------ 14129# $File: iff,v 1.14 2015/09/07 10:03:21 christos Exp $ 14130# iff: file(1) magic for Interchange File Format (see also "audio" & "images") 14131# 14132# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic 14133# Arts for file interchange. It has also been used by Apple, SGI, and 14134# especially Commodore-Amiga. 14135# 14136# IFF files begin with an 8 byte FORM header, followed by a 4 character 14137# FORM type, which is followed by the first chunk in the FORM. 14138 141390 string FORM IFF data 14140#>4 belong x \b, FORM is %d bytes long 14141# audio formats 14142>8 string AIFF \b, AIFF audio 14143!:mime audio/x-aiff 14144>8 string AIFC \b, AIFF-C compressed audio 14145!:mime audio/x-aiff 14146>8 string 8SVX \b, 8SVX 8-bit sampled sound voice 14147!:mime audio/x-aiff 14148>8 string 16SV \b, 16SV 16-bit sampled sound voice 14149>8 string SAMP \b, SAMP sampled audio 14150>8 string MAUD \b, MAUD MacroSystem audio 14151>8 string SMUS \b, SMUS simple music 14152>8 string CMUS \b, CMUS complex music 14153# image formats 14154>8 string ILBMBMHD \b, ILBM interleaved image 14155>>20 beshort x \b, %d x 14156>>22 beshort x %d 14157>8 string RGBN \b, RGBN 12-bit RGB image 14158>8 string RGB8 \b, RGB8 24-bit RGB image 14159>8 string DEEP \b, DEEP TVPaint/XiPaint image 14160>8 string DR2D \b, DR2D 2-D object 14161>8 string TDDD \b, TDDD 3-D rendering 14162>8 string LWOB \b, LWOB 3-D object 14163>8 string LWO2 \b, LWO2 3-D object, v2 14164>8 string LWLO \b, LWLO 3-D layered object 14165>8 string REAL \b, REAL Real3D rendering 14166>8 string MC4D \b, MC4D MaxonCinema4D rendering 14167>8 string ANIM \b, ANIM animation 14168>8 string YAFA \b, YAFA animation 14169>8 string SSA\ \b, SSA super smooth animation 14170>8 string ACBM \b, ACBM continuous image 14171>8 string FAXX \b, FAXX fax image 14172# other formats 14173>8 string FTXT \b, FTXT formatted text 14174>8 string CTLG \b, CTLG message catalog 14175>8 string PREF \b, PREF preferences 14176>8 string DTYP \b, DTYP datatype description 14177>8 string PTCH \b, PTCH binary patch 14178>8 string AMFF \b, AMFF AmigaMetaFile format 14179>8 string WZRD \b, WZRD StormWIZARD resource 14180>8 string DOC\ \b, DOC desktop publishing document 14181>8 string WVQA \b, Westwood Studios VQA Multimedia, 14182>>24 leshort x %d video frames, 14183>>26 leshort x %d x 14184>>28 leshort x %d 14185>8 string MOVE \b, Wing Commander III Video 14186>>12 string _PC_ \b, PC version 14187>>12 string 3DO_ \b, 3DO version 14188 14189# These go at the end of the iff rules 14190# 14191# David Griffith <dave@661.org> 14192# I don't see why these might collide with anything else. 14193# 14194# Interactive Fiction related formats 14195# 14196>8 string IFRS \b, Blorb Interactive Fiction 14197>>24 string Exec with executable chunk 14198>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal) 14199!:mime application/x-blorb 14200 14201#------------------------------------------------------------------------------ 14202# $File: images,v 1.146 2018/07/03 20:55:37 christos Exp $ 14203# images: file(1) magic for image formats (see also "iff", and "c-lang" for 14204# XPM bitmaps) 14205# 14206# originally from jef@helios.ee.lbl.gov (Jef Poskanzer), 14207# additions by janl@ifi.uio.no as well as others. Jan also suggested 14208# merging several one- and two-line files into here. 14209# 14210# little magic: PCX (first byte is 0x0a) 14211 14212# Targa - matches `povray', `ppmtotga' and `xv' outputs 14213# by Philippe De Muyter <phdm@macqel.be> 14214# URL: http://justsolve.archiveteam.org/wiki/TGA 14215# Reference: http://www.dca.fee.unicamp.br/~martino/disciplinas/ea978/tgaffs.pdf 14216# Update: Joerg Jenderek 14217# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11 14218# ,32 or 33 (both not observed) 14219# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise 14220# or theoretically 2-128 reserved for use by Truevision or 128-255 may be used for developer applications 14221# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs 14222# `xv' recognizes only a subset of the following (RGB with pixelsize = 24) 14223# `tgatoppm' recognizes a superset (Index may be anything) 14224# 14225# test of Color Map Type 0~no 1~color map 14226# and Image Type 1 2 3 9 10 11 32 33 14227# and Color Map Entry Size 0 15 16 24 32 142280 ubequad&0x00FeC400000000C0 0 14229# skip more garbage like *.iso by looking for positive image type 14230>2 ubyte >0 14231# skip some compiled terminfo like xterm+tmux by looking for image type less equal 33 14232>>2 ubyte <34 14233# skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel depth 1 8 15 16 24 32 14234>>>16 ubyte 1 14235>>>>0 use tga-image 14236>>>16 ubyte 8 14237>>>>0 use tga-image 14238>>>16 ubyte 15 14239>>>>0 use tga-image 14240>>>16 ubyte 16 14241>>>>0 use tga-image 14242>>>16 ubyte 24 14243>>>>0 use tga-image 14244>>>16 ubyte 32 14245>>>>0 use tga-image 14246# display tga bitmap image information 142470 name tga-image 14248>2 ubyte <34 Targa image data 14249!:mime image/x-tga 14250!:apple ????TPIC 14251# normal extension .tga but some Truevision products used others: 14252# tpic (Apple),icb (Image Capture Board),vda (Video Display Adapter),vst (NuVista),win (UNSURE about that) 14253!:ext tga/tpic/icb/vda/vst 14254# image type 1 2 3 9 10 11 32 33 14255>2 ubyte&0xF7 1 - Map 14256>2 ubyte&0xF7 2 - RGB 14257# alpha channel 14258>>17 ubyte&0x0F >0 \bA 14259>2 ubyte&0xF7 3 - Mono 14260# type not found, but by http://www.fileformat.info/format/tga/corion.htm 14261# Compressed color-mapped data, using Huffman, Delta, and runlength encoding 14262>2 ubyte 32 - Color 14263# Compressed color-mapped data, using Huffman, Delta, and RLE. 4-pass quadtree- type process 14264>2 ubyte 33 - Color 14265# Color Map Type 0~no 1~color map 14266>1 ubyte 1 ( 14267# first color map entry, 0 normal 14268>>3 uleshort >0 \b%d- 14269# color map length 0 2 1dh 3bh d9h 100h 14270>>5 uleshort x \b%d) 14271# 8~run length encoding bit 14272>2 ubyte&0x08 8 - RLE 14273# gimp can create big pictures! 14274>12 uleshort >0 %d x 14275>12 uleshort =0 65536 x 14276# image height. 0 interpreted as 65536 14277>14 uleshort >0 %d 14278>14 uleshort =0 65536 14279# Image Pixel depth 1 8 15 16 24 32 14280>16 ubyte x x %d 14281# X origin of image. 0 normal 14282>8 uleshort >0 +%d 14283# Y origin of image. 0 normal; positive for top 14284>10 uleshort >0 +%d 14285# Image descriptor: bits 3-0 give the alpha channel depth, bits 5-4 give direction 14286>17 ubyte&0x0F >0 - %d-bit alpha 14287# bits 5-4 give direction. normal bottom left 14288>17 ubyte &0x20 - top 14289#>17 ubyte ^0x20 - bottom 14290>17 ubyte &0x10 - right 14291#>17 ubyte ^0x10 - left 14292# some info say other bits 6-7 should be zero 14293# but data storage interleave by http://www.fileformat.info/format/tga/corion.htm 14294# 00 - no interleave;01 - even/odd interleave; 10 - four way interleave; 11 - reserved 14295#>17 ubyte&0xC0 0x00 - no interleave 14296>17 ubyte&0xC0 0x40 - interleave 14297>17 ubyte&0xC0 0x80 - four way interleave 14298>17 ubyte&0xC0 0xC0 - reserved 14299# positive length implies identification field 14300>0 ubyte >0 14301>>18 string x "%s" 14302# last 18 bytes of newer tga file footer signature 14303>18 search/4261301/s TRUEVISION-XFILE.\0 14304# extension area offset if not 0 14305>>&-8 ulelong >0 14306# length of the extension area. normal 495 for version 2.0 14307>>>(&-4.l) uleshort 0x01EF 14308# AuthorName[41] 14309>>>>&0 string >\0 - author "%-.40s" 14310# Comment[324]=4 * 80 null terminated 14311>>>>&41 string >\0 - comment "%-.80s" 14312# date 14313>>>>&365 ubequad&0xffffFFFFffff0000 !0 14314# Day 14315>>>>>&-6 uleshort x %d 14316# Month 14317>>>>>&-8 uleshort x \b-%d 14318# Year 14319>>>>>&-4 uleshort x \b-%d 14320# time 14321>>>>&371 ubequad&0xffffFFFFffff0000 !0 14322# hour 14323>>>>>&-8 uleshort x %d 14324# minutes 14325>>>>>&-6 uleshort x \b:%.2d 14326# second 14327>>>>>&-4 uleshort x \b:%.2d 14328# JobName[41] 14329>>>>&377 string >\0 - job "%-.40s" 14330# JobHour Jobminute Jobsecond 14331>>>>&418 ubequad&0xffffFFFFffff0000 !0 14332>>>>>&-8 uleshort x %d 14333>>>>>&-6 uleshort x \b:%.2d 14334>>>>>&-4 uleshort x \b:%.2d 14335# SoftwareId[41] 14336>>>>&424 string >\0 - %-.40s 14337# SoftwareVersionNumber 14338>>>>&424 ubyte >0 14339>>>>>&40 uleshort/100 x %d 14340>>>>>&40 uleshort%100 x \b.%d 14341# VersionLetter 14342>>>>>&42 ubyte >0x20 \b%c 14343# KeyColor 14344>>>>&468 ulelong >0 - keycolor 0x%8.8x 14345# Denominator of Pixel ratio. 0~no pixel aspect 14346>>>>&474 uleshort >0 14347# Numerator 14348>>>>>&-4 uleshort >0 - aspect %d 14349>>>>>&-2 uleshort x \b/%d 14350# Denominator of Gamma ratio. 0~no Gamma value 14351>>>>&478 uleshort >0 14352# Numerator 14353>>>>>&-4 uleshort >0 - gamma %d 14354>>>>>&-2 uleshort x \b/%d 14355# ColorOffset 14356#>>>>&480 ulelong x - col offset 0x%8.8x 14357# StampOffset 14358#>>>>&484 ulelong x - stamp offset 0x%8.8x 14359# ScanOffset 14360#>>>>&488 ulelong x - scan offset 0x%8.8x 14361# AttributesType 14362#>>>>&492 ubyte x - Attributes 0x%x 14363## EndOfTGA 14364 14365# PBMPLUS images 14366# The next byte following the magic is always whitespace. 14367# strength is changed to try these patterns before "x86 boot sector" 143680 name netpbm 14369>3 regex/s =[0-9]{1,50}\ [0-9]{1,50} Netpbm image data 14370>>&0 regex =[0-9]{1,50} \b, size = %s x 14371>>>&0 regex =[0-9]{1,50} \b %s 14372 143730 search/1 P1 14374>0 regex/4 P1[\040\t\f\r\n] 14375>>0 use netpbm 14376>>>0 string x \b, bitmap 14377!:strength + 45 14378!:mime image/x-portable-bitmap 14379 143800 search/1 P2 14381>0 regex/4 P2[\040\t\f\r\n] 14382>>0 use netpbm 14383>>>0 string x \b, greymap 14384!:strength + 45 14385!:mime image/x-portable-greymap 14386 143870 search/1 P3 14388>0 regex/4 P3[\040\t\f\r\n] 14389>>0 use netpbm 14390>>>0 string x \b, pixmap 14391!:strength + 45 14392!:mime image/x-portable-pixmap 14393 143940 string P4 14395>0 regex/4 P4[\040\t\f\r\n] 14396>>0 use netpbm 14397>>>0 string x \b, rawbits, bitmap 14398!:strength + 45 14399!:mime image/x-portable-bitmap 14400 144010 string P5 14402>0 regex/4 P5[\040\t\f\r\n] 14403>>0 use netpbm 14404>>>0 string x \b, rawbits, greymap 14405!:strength + 45 14406!:mime image/x-portable-greymap 14407 144080 string P6 14409>0 regex/4 P6[\040\t\f\r\n] 14410>>0 use netpbm 14411>>>0 string x \b, rawbits, pixmap 14412!:strength + 45 14413!:mime image/x-portable-pixmap 14414 144150 string P7 Netpbm PAM image file 14416!:mime image/x-portable-pixmap 14417 14418# From: bryanh@giraffe-data.com (Bryan Henderson) 144190 string \117\072 Solitaire Image Recorder format 14420>4 string \013 MGI Type 11 14421>4 string \021 MGI Type 17 144220 string .MDA MicroDesign data 14423>21 byte 48 version 2 14424>21 byte 51 version 3 144250 string .MDP MicroDesign page data 14426>21 byte 48 version 2 14427>21 byte 51 version 3 14428 14429# NIFF (Navy Interchange File Format, a modification of TIFF) images 14430# [GRR: this *must* go before TIFF] 144310 string IIN1 NIFF image data 14432!:mime image/x-niff 14433 14434# Canon RAW version 1 (CRW) files are a type of Canon Image File Format 14435# (CIFF) file. These are apparently all little-endian. 14436# From: Adam Buchbinder <adam.buchbinder@gmail.com> 14437# URL: http://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html 144380 string II\x1a\0\0\0HEAPCCDR Canon CIFF raw image data 14439!:mime image/x-canon-crw 14440>16 leshort x \b, version %d. 14441>14 leshort x \b%d 14442 14443# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic 14444# number. Put this above the TIFF test to make sure we detect them. 14445# These are apparently all little-endian. 14446# From: Adam Buchbinder <adam.buchbinder@gmail.com> 14447# URL: http://libopenraw.freedesktop.org/wiki/Canon_CR2 144480 string II\x2a\0\x10\0\0\0CR Canon CR2 raw image data 14449!:mime image/x-canon-cr2 14450>10 byte x \b, version %d. 14451>11 byte x \b%d 14452 14453# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com) 14454# The second word of TIFF files is the TIFF version number, 42, which has 14455# never changed. The TIFF specification recommends testing for it. 144560 string MM\x00\x2a TIFF image data, big-endian 14457!:strength +70 14458!:mime image/tiff 14459>(4.L) use \^tiff_ifd 144600 string II\x2a\x00 TIFF image data, little-endian 14461!:mime image/tiff 14462!:strength +70 14463>(4.l) use tiff_ifd 14464 144650 name tiff_ifd 14466>0 leshort x \b, direntries=%d 14467>2 use tiff_entry 14468 144690 name tiff_entry 14470# NewSubFileType 14471>0 leshort 0xfe 14472>>12 use tiff_entry 14473>0 leshort 0x100 14474>>4 lelong 1 14475>>>12 use tiff_entry 14476>>>8 leshort x \b, width=%d 14477>0 leshort 0x101 14478>>4 lelong 1 14479>>>8 leshort x \b, height=%d 14480>>>12 use tiff_entry 14481>0 leshort 0x102 14482>>8 leshort x \b, bps=%d 14483>>12 use tiff_entry 14484>0 leshort 0x103 14485>>4 lelong 1 \b, compression= 14486>>>8 leshort 1 \bnone 14487>>>8 leshort 2 \bhuffman 14488>>>8 leshort 3 \bbi-level group 3 14489>>>8 leshort 4 \bbi-level group 4 14490>>>8 leshort 5 \bLZW 14491>>>8 leshort 6 \bJPEG (old) 14492>>>8 leshort 7 \bJPEG 14493>>>8 leshort 8 \bdeflate 14494>>>8 leshort 9 \bJBIG, ITU-T T.85 14495>>>8 leshort 0xa \bJBIG, ITU-T T.43 14496>>>8 leshort 0x7ffe \bNeXT RLE 2-bit 14497>>>8 leshort 0x8005 \bPackBits (Macintosh RLE) 14498>>>8 leshort 0x8029 \bThunderscan RLE 14499>>>8 leshort 0x807f \bRasterPadding (CT or MP) 14500>>>8 leshort 0x8080 \bRLE (Line Work) 14501>>>8 leshort 0x8081 \bRLE (High-Res Cont-Tone) 14502>>>8 leshort 0x8082 \bRLE (Binary Line Work) 14503>>>8 leshort 0x80b2 \bDeflate (PKZIP) 14504>>>8 leshort 0x80b3 \bKodak DCS 14505>>>8 leshort 0x8765 \bJBIG 14506>>>8 leshort 0x8798 \bJPEG2000 14507>>>8 leshort 0x8799 \bNikon NEF Compressed 14508>>>8 default x 14509>>>>8 leshort x \b(unknown 0x%x) 14510>>>12 use tiff_entry 14511>0 leshort 0x106 \b, PhotometricIntepretation= 14512>>8 clear x 14513>>8 leshort 0 \bWhiteIsZero 14514>>8 leshort 1 \bBlackIsZero 14515>>8 leshort 2 \bRGB 14516>>8 leshort 3 \bRGB Palette 14517>>8 leshort 4 \bTransparency Mask 14518>>8 leshort 5 \bCMYK 14519>>8 leshort 6 \bYCbCr 14520>>8 leshort 8 \bCIELab 14521>>8 default x 14522>>>8 leshort x \b(unknown=0x%x) 14523>>12 use tiff_entry 14524# FillOrder 14525>0 leshort 0x10a 14526>>4 lelong 1 14527>>>12 use tiff_entry 14528# DocumentName 14529>0 leshort 0x10d 14530>>(8.l) string x \b, name=%s 14531>>>12 use tiff_entry 14532# ImageDescription 14533>0 leshort 0x10e 14534>>(8.l) string x \b, description=%s 14535>>>12 use tiff_entry 14536# Make 14537>0 leshort 0x10f 14538>>(8.l) string x \b, manufacturer=%s 14539>>>12 use tiff_entry 14540# Model 14541>0 leshort 0x110 14542>>(8.l) string x \b, model=%s 14543>>>12 use tiff_entry 14544# StripOffsets 14545>0 leshort 0x111 14546>>12 use tiff_entry 14547# Orientation 14548>0 leshort 0x112 \b, orientation= 14549>>8 leshort 1 \bupper-left 14550>>8 leshort 3 \blower-right 14551>>8 leshort 6 \bupper-right 14552>>8 leshort 8 \blower-left 14553>>8 leshort 9 \bundefined 14554>>8 default x 14555>>>8 leshort x \b[*%d*] 14556>>12 use tiff_entry 14557# XResolution 14558>0 leshort 0x11a 14559>>8 lelong x \b, xresolution=%d 14560>>12 use tiff_entry 14561# YResolution 14562>0 leshort 0x11b 14563>>8 lelong x \b, yresolution=%d 14564>>12 use tiff_entry 14565# ResolutionUnit 14566>0 leshort 0x128 14567>>8 leshort x \b, resolutionunit=%d 14568>>12 use tiff_entry 14569# Software 14570>0 leshort 0x131 14571>>(8.l) string x \b, software=%s 14572>>12 use tiff_entry 14573# Datetime 14574>0 leshort 0x132 14575>>(8.l) string x \b, datetime=%s 14576>>12 use tiff_entry 14577# HostComputer 14578>0 leshort 0x13c 14579>>(8.l) string x \b, hostcomputer=%s 14580>>12 use tiff_entry 14581# WhitePoint 14582>0 leshort 0x13e 14583>>12 use tiff_entry 14584# PrimaryChromaticities 14585>0 leshort 0x13f 14586>>12 use tiff_entry 14587# YCbCrCoefficients 14588>0 leshort 0x211 14589>>12 use tiff_entry 14590# YCbCrPositioning 14591>0 leshort 0x213 14592>>12 use tiff_entry 14593# ReferenceBlackWhite 14594>0 leshort 0x214 14595>>12 use tiff_entry 14596# Copyright 14597>0 leshort 0x8298 14598>>(8.l) string x \b, copyright=%s 14599>>12 use tiff_entry 14600# ExifOffset 14601>0 leshort 0x8769 14602>>12 use tiff_entry 14603# GPS IFD 14604>0 leshort 0x8825 \b, GPS-Data 14605>>12 use tiff_entry 14606 14607#>0 leshort x \b, unknown=0x%x 14608#>>12 use tiff_entry 14609 146100 string MM\x00\x2b Big TIFF image data, big-endian 14611!:mime image/tiff 146120 string II\x2b\x00 Big TIFF image data, little-endian 14613!:mime image/tiff 14614 14615# PNG [Portable Network Graphics, or "PNG's Not GIF"] images 14616# (Greg Roelofs, newt@uchicago.edu) 14617# (Albert Cahalan, acahalan@cs.uml.edu) 14618# 14619# 137 P N G \r \n ^Z \n [4-byte length] I H D R [HEAD data] [HEAD crc] ... 14620# 14621 14622# IHDR parser 146230 name png-ihdr 14624>0 belong x \b, %d x 14625>4 belong x %d, 14626>8 byte x %d-bit 14627>9 byte 0 grayscale, 14628>9 byte 2 \b/color RGB, 14629>9 byte 3 colormap, 14630>9 byte 4 gray+alpha, 14631>9 byte 6 \b/color RGBA, 14632#>10 byte 0 deflate/32K, 14633>12 byte 0 non-interlaced 14634>12 byte 1 interlaced 14635 14636# Standard PNG image. 146370 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0DIHDR PNG image data 14638!:mime image/png 14639!:strength +10 14640>16 use png-ihdr 14641 14642# Apple CgBI PNG image. 146430 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x04CgBI 14644>24 string \x00\x00\x00\x0DIHDR PNG image data (CgBI) 14645!:mime image/png 14646!:strength +10 14647>>32 use png-ihdr 14648 14649# possible GIF replacements; none yet released! 14650# (Greg Roelofs, newt@uchicago.edu) 14651# 14652# GRR 950115: this was mine ("Zip GIF"): 146530 string GIF94z ZIF image (GIF+deflate alpha) 14654!:mime image/x-unknown 14655# 14656# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better): 14657# 146580 string FGF95a FGF image (GIF+deflate beta) 14659!:mime image/x-unknown 14660# 14661# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal 14662# (best; not yet implemented): 14663# 146640 string PBF PBF image (deflate compression) 14665!:mime image/x-unknown 14666 14667# GIF 14668# Strength set up to beat 0x55AA DOS/MBR signature word lookups (+65) 146690 string GIF8 GIF image data 14670!:strength +80 14671!:mime image/gif 14672!:apple 8BIMGIFf 14673>4 string 7a \b, version 8%s, 14674>4 string 9a \b, version 8%s, 14675>6 leshort >0 %d x 14676>8 leshort >0 %d 14677#>10 byte &0x80 color mapped, 14678#>10 byte&0x07 =0x00 2 colors 14679#>10 byte&0x07 =0x01 4 colors 14680#>10 byte&0x07 =0x02 8 colors 14681#>10 byte&0x07 =0x03 16 colors 14682#>10 byte&0x07 =0x04 32 colors 14683#>10 byte&0x07 =0x05 64 colors 14684#>10 byte&0x07 =0x06 128 colors 14685#>10 byte&0x07 =0x07 256 colors 14686 14687# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster, 14688# 1 plane, no encoding. 146890 string \361\0\100\273 CMU window manager raster image data 14690>4 lelong >0 %d x 14691>8 lelong >0 %d, 14692>12 lelong >0 %d-bit 14693 14694# Magick Image File Format 146950 string id=ImageMagick MIFF image data 14696 14697# Artisan 146980 long 1123028772 Artisan image data 14699>4 long 1 \b, rectangular 24-bit 14700>4 long 2 \b, rectangular 8-bit with colormap 14701>4 long 3 \b, rectangular 32-bit (24-bit with matte) 14702 14703# FIG (Facility for Interactive Generation of figures), an object-based format 147040 search/1 #FIG FIG image text 14705>5 string x \b, version %.3s 14706 14707# PHIGS 147080 string ARF_BEGARF PHIGS clear text archive 147090 string @(#)SunPHIGS SunPHIGS 14710# version number follows, in the form m.n 14711>40 string SunBin binary 14712>32 string archive archive 14713 14714# GKS (Graphics Kernel System) 147150 string GKSM GKS Metafile 14716>24 string SunGKS \b, SunGKS 14717 14718# CGM image files 147190 string BEGMF clear text Computer Graphics Metafile 14720 14721# MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de) 147220 string yz MGR bitmap, modern format, 8-bit aligned 147230 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned 147240 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned 147250 string yx MGR bitmap, modern format, squeezed 14726 14727# Fuzzy Bitmap (FBM) images 147280 string %bitmap\0 FBM image data 14729>30 long 0x31 \b, mono 14730>30 long 0x33 \b, color 14731 14732# facsimile data 147331 string PC\ Research,\ Inc group 3 fax data 14734>29 byte 0 \b, normal resolution (204x98 DPI) 14735>29 byte 1 \b, fine resolution (204x196 DPI) 14736# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at> 147370 string Sfff structured fax file 14738 14739# From: Joerg Jenderek <joerg.jen.der.ek@gmx.net> 14740# most files with the extension .EPA and some with .BMP 147410 string \x11\x06 Award BIOS Logo, 136 x 84 14742!:mime image/x-award-bioslogo 147430 string \x11\x09 Award BIOS Logo, 136 x 126 14744!:mime image/x-award-bioslogo 14745#0 string \x07\x1f BIOS Logo corrupted? 14746# http://www.blackfiveservices.co.uk/awbmtools.shtml 14747# http://biosgfx.narod.ru/v3/ 14748# http://biosgfx.narod.ru/abr-2/ 147490 string AWBM 14750>4 leshort <1981 Award BIOS bitmap 14751!:mime image/x-award-bmp 14752# image width is a multiple of 4 14753>>4 leshort&0x0003 0 14754>>>4 leshort x \b, %d 14755>>>6 leshort x x %d 14756>>4 leshort&0x0003 >0 \b, 14757>>>4 leshort&0x0003 =1 14758>>>>4 leshort x %d+3 14759>>>4 leshort&0x0003 =2 14760>>>>4 leshort x %d+2 14761>>>4 leshort&0x0003 =3 14762>>>>4 leshort x %d+1 14763>>>6 leshort x x %d 14764# at offset 8 starts imagedata followed by "RGB " marker 14765 14766# PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu) 14767# http://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\ 14768# 28bitmap_information_header.29 147690 string BM 14770>14 leshort 12 PC bitmap, OS/2 1.x format 14771!:mime image/x-ms-bmp 14772>>18 leshort x \b, %d x 14773>>20 leshort x %d 14774>14 leshort 64 PC bitmap, OS/2 2.x format 14775!:mime image/x-ms-bmp 14776>>18 leshort x \b, %d x 14777>>20 leshort x %d 14778>14 leshort 40 PC bitmap, Windows 3.x format 14779!:mime image/x-ms-bmp 14780>>18 lelong x \b, %d x 14781>>22 lelong x %d x 14782>>28 leshort x %d 14783>14 leshort 124 PC bitmap, Windows 98/2000 and newer format 14784!:mime image/x-ms-bmp 14785>>18 lelong x \b, %d x 14786>>22 lelong x %d x 14787>>28 leshort x %d 14788>14 leshort 108 PC bitmap, Windows 95/NT4 and newer format 14789!:mime image/x-ms-bmp 14790>>18 lelong x \b, %d x 14791>>22 lelong x %d x 14792>>28 leshort x %d 14793>14 leshort 128 PC bitmap, Windows NT/2000 format 14794!:mime image/x-ms-bmp 14795>>18 lelong x \b, %d x 14796>>22 lelong x %d x 14797>>28 leshort x %d 14798# Too simple - MPi 14799#0 string IC PC icon data 14800#0 string PI PC pointer image data 14801#0 string CI PC color icon data 14802#0 string CP PC color pointer image data 14803# Conflicts with other entries [BABYL] 14804#0 string BA PC bitmap array data 14805 14806# XPM icons (Greg Roelofs, newt@uchicago.edu) 148070 search/1 /*\ XPM\ */ X pixmap image text 14808!:mime image/x-xpmi 14809 14810# Utah Raster Toolkit RLE images (janl@ifi.uio.no) 148110 leshort 0xcc52 RLE image data, 14812>6 leshort x %d x 14813>8 leshort x %d 14814>2 leshort >0 \b, lower left corner: %d 14815>4 leshort >0 \b, lower right corner: %d 14816>10 byte&0x1 =0x1 \b, clear first 14817>10 byte&0x2 =0x2 \b, no background 14818>10 byte&0x4 =0x4 \b, alpha channel 14819>10 byte&0x8 =0x8 \b, comment 14820>11 byte >0 \b, %d color channels 14821>12 byte >0 \b, %d bits per pixel 14822>13 byte >0 \b, %d color map channels 14823 14824# image file format (Robert Potter, potter@cs.rochester.edu) 148250 string Imagefile\ version- iff image data 14826# this adds the whole header (inc. version number), informative but longish 14827>10 string >\0 %s 14828 14829# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com) 148300 belong 0x59a66a95 Sun raster image data 14831>4 belong >0 \b, %d x 14832>8 belong >0 %d, 14833>12 belong >0 %d-bit, 14834#>16 belong >0 %d bytes long, 14835>20 belong 0 old format, 14836#>20 belong 1 standard, 14837>20 belong 2 compressed, 14838>20 belong 3 RGB, 14839>20 belong 4 TIFF, 14840>20 belong 5 IFF, 14841>20 belong 0xffff reserved for testing, 14842>24 belong 0 no colormap 14843>24 belong 1 RGB colormap 14844>24 belong 2 raw colormap 14845#>28 belong >0 colormap is %d bytes long 14846 14847# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com) 14848# 14849# See 14850# http://reality.sgi.com/grafica/sgiimage.html 14851# 148520 beshort 474 SGI image data 14853#>2 byte 0 \b, verbatim 14854>2 byte 1 \b, RLE 14855#>3 byte 1 \b, normal precision 14856>3 byte 2 \b, high precision 14857>4 beshort x \b, %d-D 14858>6 beshort x \b, %d x 14859>8 beshort x %d 14860>10 beshort x \b, %d channel 14861>10 beshort !1 \bs 14862>80 string >0 \b, "%s" 14863 148640 string IT01 FIT image data 14865>4 belong x \b, %d x 14866>8 belong x %d x 14867>12 belong x %d 14868# 148690 string IT02 FIT image data 14870>4 belong x \b, %d x 14871>8 belong x %d x 14872>12 belong x %d 14873# 148742048 string PCD_IPI Kodak Photo CD image pack file 14875>0xe02 byte&0x03 0x00 , landscape mode 14876>0xe02 byte&0x03 0x01 , portrait mode 14877>0xe02 byte&0x03 0x02 , landscape mode 14878>0xe02 byte&0x03 0x03 , portrait mode 148790 string PCD_OPA Kodak Photo CD overview pack file 14880 14881# FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu> 14882# FITS is the Flexible Image Transport System, the de facto standard for 14883# data and image transfer, storage, etc., for the astronomical community. 14884# (FITS floating point formats are big-endian.) 148850 string SIMPLE\ \ = FITS image data 14886!:mime image/fits 14887!:ext fits/fts 14888>109 string 8 \b, 8-bit, character or unsigned binary integer 14889>108 string 16 \b, 16-bit, two's complement binary integer 14890>107 string \ 32 \b, 32-bit, two's complement binary integer 14891>107 string -32 \b, 32-bit, floating point, single precision 14892>107 string -64 \b, 64-bit, floating point, double precision 14893 14894# other images 148950 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file 14896 14897# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image 14898# stuff. 14899# 149000 beshort 0x1010 PEX Binary Archive 14901 14902# DICOM medical imaging data 14903# URL: https://en.wikipedia.org/wiki/DICOM#Data_format 14904# Note: "dcm" is the official file name extension 14905# XnView mention also "dc3" and "acr" as file name extension 14906128 string DICM DICOM medical imaging data 14907!:mime application/dicom 14908!:ext dcm/dicom/dic 14909 14910# XWD - X Window Dump file. 14911# As described in /usr/X11R6/include/X11/XWDFile.h 14912# used by the xwd program. 14913# Bradford Castalia, idaeim, 1/01 14914# updated by Adam Buchbinder, 2/09 14915# The following assumes version 7 of the format; the first long is the length 14916# of the header, which is at least 25 4-byte longs, and the one at offset 8 14917# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth, 14918# which is a maximum of 32. 149190 belong >100 14920>8 belong <3 14921>>12 belong <33 14922>>>4 belong 7 XWD X Window Dump image data 14923!:mime image/x-xwindowdump 14924>>>>100 string >\0 \b, "%s" 14925>>>>16 belong x \b, %dx 14926>>>>20 belong x \b%dx 14927>>>>12 belong x \b%d 14928 14929# PDS - Planetary Data System 14930# These files use Parameter Value Language in the header section. 14931# Unfortunately, there is no certain magic, but the following 14932# strings have been found to be most likely. 149330 string NJPL1I00 PDS (JPL) image data 149342 string NJPL1I PDS (JPL) image data 149350 string CCSD3ZF PDS (CCSD) image data 149362 string CCSD3Z PDS (CCSD) image data 149370 string PDS_ PDS image data 149380 string LBLSIZE= PDS (VICAR) image data 14939 14940# pM8x: ATARI STAD compressed bitmap format 14941# 14942# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001 14943# p M 8 5/6 xx yy zz data... 14944# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed. 14945# bytes either run horizontally (pM85) or vertically (pM86). yy is the 14946# most frequent byte, xx and zz are runlength escape codes, where xx is 14947# used for runs of yy. 14948# 149490 string pM85 Atari ST STAD bitmap image data (hor) 14950>5 byte 0x00 (white background) 14951>5 byte 0xFF (black background) 149520 string pM86 Atari ST STAD bitmap image data (vert) 14953>5 byte 0x00 (white background) 14954>5 byte 0xFF (black background) 14955 14956# From: Alex Myczko <alex@aiei.ch> 14957# http://www.atarimax.com/jindroush.atari.org/afmtatr.html 149580 leshort 0x0296 Atari ATR image 14959 14960# XXX: 14961# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other 14962# magic. 14963# SGI RICE image file <mpruett@sgi.com> 14964#0 beshort 0x5249 RICE image 14965#>2 beshort x v%d 14966#>4 beshort x (%d x 14967#>6 beshort x %d) 14968#>8 beshort 0 8 bit 14969#>8 beshort 1 10 bit 14970#>8 beshort 2 12 bit 14971#>8 beshort 3 13 bit 14972#>10 beshort 0 4:2:2 14973#>10 beshort 1 4:2:2:4 14974#>10 beshort 2 4:4:4 14975#>10 beshort 3 4:4:4:4 14976#>12 beshort 1 RGB 14977#>12 beshort 2 CCIR601 14978#>12 beshort 3 RP175 14979#>12 beshort 4 YUV 14980 14981# PCX image files 14982# From: Dan Fandrich <dan@coneharvesters.com> 14983# updated by Joerg Jenderek at Feb 2013 by http://de.wikipedia.org/wiki/PCX 14984# http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt 14985# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000 14986# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT 149870 ubelong&0xffF8fe00 0x0a000000 14988# for PCX bit depth > 0 14989>3 ubyte >0 14990# test for valid versions 14991>>1 ubyte <6 14992>>>1 ubyte !1 PCX 14993!:mime image/x-pcx 14994#!:mime image/pcx 14995>>>>1 ubyte 0 ver. 2.5 image data 14996>>>>1 ubyte 2 ver. 2.8 image data, with palette 14997>>>>1 ubyte 3 ver. 2.8 image data, without palette 14998>>>>1 ubyte 4 for Windows image data 14999>>>>1 ubyte 5 ver. 3.0 image data 15000>>>>4 uleshort x bounding box [%d, 15001>>>>6 uleshort x %d] - 15002>>>>8 uleshort x [%d, 15003>>>>10 uleshort x %d], 15004>>>>65 ubyte >1 %d planes each of 15005>>>>3 ubyte x %d-bit 15006>>>>68 byte 1 colour, 15007>>>>68 byte 2 grayscale, 15008# this should not happen 15009>>>>68 default x image, 15010>>>>12 leshort >0 %d x 15011>>>>>14 uleshort x %d dpi, 15012>>>>2 byte 0 uncompressed 15013>>>>2 byte 1 RLE compressed 15014 15015# Adobe Photoshop 15016# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 150170 string 8BPS Adobe Photoshop Image 15018!:mime image/vnd.adobe.photoshop 15019>4 beshort 2 (PSB) 15020>18 belong x \b, %d x 15021>14 belong x %d, 15022>24 beshort 0 bitmap 15023>24 beshort 1 grayscale 15024>>12 beshort 2 with alpha 15025>24 beshort 2 indexed 15026>24 beshort 3 RGB 15027>>12 beshort 4 \bA 15028>24 beshort 4 CMYK 15029>>12 beshort 5 \bA 15030>24 beshort 7 multichannel 15031>24 beshort 8 duotone 15032>24 beshort 9 lab 15033>12 beshort > 1 15034>>12 beshort x \b, %dx 15035>12 beshort 1 \b, 15036>22 beshort x %d-bit channel 15037>12 beshort > 1 \bs 15038 15039# XV thumbnail indicator (ThMO) 150400 string P7\ 332 XV thumbnail image data 15041 15042# NITF is defined by United States MIL-STD-2500A 150430 string NITF National Imagery Transmission Format 15044>25 string >\0 dated %.14s 15045 15046# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff) 15047# Format variations from: Bernd Nuernberger <bernd.nuernberger@web.de> 15048# Update: Joerg Jenderek 15049# See http://fileformats.archiveteam.org/wiki/GEM_Raster 15050# For variations, also see: 15051# http://www.seasip.info/Gem/ff_img.html (Ventura) 15052# http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT) 15053# http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT) 15054# http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG) 150550 beshort 0x0001 15056# header_size 15057>2 beshort 0x0008 15058>>0 use gem_info 15059>2 beshort 0x0009 15060>>0 use gem_info 15061# no example for NOSIG 15062>2 beshort 24 15063>>0 use gem_info 15064# no example for HYPERPAINT 15065>2 beshort 25 15066>>0 use gem_info 1506716 string XIMG\0 15068>0 use gem_info 15069# no example 1507016 string STTT\0\x10 15071>0 use gem_info 15072# no example or description 1507316 string TIMG\0 15074>0 use gem_info 15075 150760 name gem_info 15077# version is 2 for some XIMG and 1 for all others 15078>0 beshort <0x0003 GEM 15079# http://www.snowstone.org.uk/riscos/mimeman/mimemap.txt 15080!:mime image/x-gem 15081# header_size 24 25 27 59 779 words for colored bitmaps 15082>>2 beshort >9 15083>>>16 string STTT\0\x10 STTT 15084>>>16 string TIMG\0 TIMG 15085# HYPERPAINT or NOSIG variant 15086>>>16 string \0\x80 15087>>>>2 beshort =24 NOSIG 15088>>>>2 beshort !24 HYPERPAINT 15089# NOSIG or XIMG variant 15090>>>16 default x 15091>>>>16 string !XIMG\0 NOSIG 15092>>16 string =XIMG\0 XIMG Image data 15093!:ext img/ximg 15094# to avoid Warning: Current entry does not yet have a description for adding a EXTENSION type 15095>>16 string !XIMG\0 Image data 15096!:ext img 15097# header_size is 9 for Ventura files and 8 for other GEM Paint files 15098>>2 beshort 9 (Ventura) 15099#>>2 beshort 8 (Paint) 15100>>12 beshort x %d x 15101>>14 beshort x %d, 15102# 1 4 8 15103>>4 beshort x %d planes, 15104# in tenths of a millimetre 15105>>8 beshort x %d x 15106>>10 beshort x %d pixelsize 15107# pattern_size 1-8. 2 for GEM Paint 15108>>6 beshort !2 \b, pattern size %d 15109 15110# GEM Metafile (Wolfram Kleff) 151110 lelong 0x0018FFFF GEM Metafile data 15112>4 leshort x version %d 15113 15114# 15115# SMJPEG. A custom Motion JPEG format used by Loki Entertainment 15116# Software Torbjorn Andersson <d91tan@Update.UU.SE>. 15117# 151180 string \0\nSMJPEG SMJPEG 15119>8 belong x %d.x data 15120# According to the specification you could find any number of _TXT 15121# headers here, but I can't think of any way of handling that. None of 15122# the SMJPEG files I tried it on used this feature. Even if such a 15123# file is encountered the output should still be reasonable. 15124>16 string _SND \b, 15125>>24 beshort >0 %d Hz 15126>>26 byte 8 8-bit 15127>>26 byte 16 16-bit 15128>>28 string NONE uncompressed 15129# >>28 string APCM ADPCM compressed 15130>>27 byte 1 mono 15131>>28 byte 2 stereo 15132# Help! Isn't there any way to avoid writing this part twice? 15133>>32 string _VID \b, 15134# >>>48 string JFIF JPEG 15135>>>40 belong >0 %d frames 15136>>>44 beshort >0 (%d x 15137>>>46 beshort >0 %d) 15138>16 string _VID \b, 15139# >>32 string JFIF JPEG 15140>>24 belong >0 %d frames 15141>>28 beshort >0 (%d x 15142>>30 beshort >0 %d) 15143 151440 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File 15145 15146# "thumbnail file" (icon) 15147# descended from "xv", but in use by other applications as well (Wolfram Kleff) 151480 string P7\ 332 XV "thumbnail file" (icon) data 15149 15150# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?) 151510 string KiSS KISS/GS 15152>4 byte 16 color 15153>>5 byte x %d bit 15154>>8 leshort x %d colors 15155>>10 leshort x %d groups 15156>4 byte 32 cell 15157>>5 byte x %d bit 15158>>8 leshort x %d x 15159>>10 leshort x %d 15160>>12 leshort x +%d 15161>>14 leshort x +%d 15162 15163# Webshots (www.webshots.com), by John Harrison 151640 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file 15165 15166# Hercules DASD image files 15167# From Jan Jaeger <jj@septa.nl> 151680 string CKD_P370 Hercules CKD DASD image file 15169>8 long x \b, %d heads per cylinder 15170>12 long x \b, track size %d bytes 15171>16 byte x \b, device type 33%2.2X 15172 151730 string CKD_C370 Hercules compressed CKD DASD image file 15174>8 long x \b, %d heads per cylinder 15175>12 long x \b, track size %d bytes 15176>16 byte x \b, device type 33%2.2X 15177 151780 string CKD_S370 Hercules CKD DASD shadow file 15179>8 long x \b, %d heads per cylinder 15180>12 long x \b, track size %d bytes 15181>16 byte x \b, device type 33%2.2X 15182 15183# Squeak images and programs - etoffi@softhome.net 151840 string \146\031\0\0 Squeak image data 151850 search/1 'From\040Squeak Squeak program text 15186 15187# partimage: file(1) magic for PartImage files (experimental, incomplete) 15188# Author: Hans-Joachim Baader <hjb@pro-linux.de> 151890 string PaRtImAgE-VoLuMe PartImage 15190>0x0020 string 0.6.1 file version %s 15191>>0x0060 lelong >-1 volume %d 15192#>>0x0064 8 byte identifier 15193#>>0x007c reserved 15194>>0x0200 string >\0 type %s 15195>>0x1400 string >\0 device %s, 15196>>0x1600 string >\0 original filename %s, 15197# Some fields omitted 15198>>0x2744 lelong 0 not compressed 15199>>0x2744 lelong 1 gzip compressed 15200>>0x2744 lelong 2 bzip2 compressed 15201>>0x2744 lelong >2 compressed with unknown algorithm 15202>0x0020 string >0.6.1 file version %s 15203>0x0020 string <0.6.1 file version %s 15204 15205# DCX is multi-page PCX, using a simple header of up to 1024 15206# offsets for the respective PCX components. 15207# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de> 152080 lelong 987654321 DCX multi-page PCX image data 15209 15210# Simon Walton <simonw@matteworld.com> 15211# Kodak Cineon format for scanned negatives 15212# http://www.kodak.com/US/en/motion/support/dlad/ 152130 lelong 0xd75f2a80 Cineon image data 15214>200 belong >0 \b, %d x 15215>204 belong >0 %d 15216 15217 15218# Bio-Rad .PIC is an image format used by microscope control systems 15219# and related image processing software used by biologists. 15220# From: Vebjorn Ljosa <vebjorn@ljosa.com> 15221# BOOL values are two-byte integers; use them to rule out false positives. 15222# http://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt 15223# Samples: http://www.loci.wisc.edu/software/sample-data 1522414 leshort <2 15225>62 leshort <2 15226>>54 leshort 12345 Bio-Rad .PIC Image File 15227>>>0 leshort >0 %d x 15228>>>2 leshort >0 %d, 15229>>>4 leshort =1 1 image in file 15230>>>4 leshort >1 %d images in file 15231 15232# From Jan "Yenya" Kasprzak <kas@fi.muni.cz> 15233# The description of *.mrw format can be found at 15234# http://www.dalibor.cz/minolta/raw_file_format.htm 152350 string \000MRM Minolta Dimage camera raw image data 15236 15237# Summary: DjVu image / document 15238# Extension: .djvu 15239# Reference: http://djvu.org/docs/DjVu3Spec.djvu 15240# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr> 15241# Modified by (1): Abel Cheung <abelcheung@gmail.com> 152420 string AT&TFORM 15243>12 string DJVM DjVu multiple page document 15244!:mime image/vnd.djvu 15245>12 string DJVU DjVu image or single page document 15246!:mime image/vnd.djvu 15247>12 string DJVI DjVu shared document 15248!:mime image/vnd.djvu 15249>12 string THUM DjVu page thumbnails 15250!:mime image/vnd.djvu 15251 15252# Originally by Marc Espie 15253# Modified by Robert Minsk <robertminsk at yahoo.com> 15254# http://www.openexr.com/openexrfilelayout.pdf 152550 lelong 20000630 OpenEXR image data, 15256!:mime image/x-exr 15257>4 lelong&0x000000ff x version %d, 15258>4 lelong ^0x00000200 storage: scanline 15259>4 lelong &0x00000200 storage: tiled 15260>8 search/0x1000 compression\0 \b, compression: 15261>>&16 byte 0 none 15262>>&16 byte 1 rle 15263>>&16 byte 2 zips 15264>>&16 byte 3 zip 15265>>&16 byte 4 piz 15266>>&16 byte 5 pxr24 15267>>&16 byte 6 b44 15268>>&16 byte 7 b44a 15269>>&16 byte 8 dwaa 15270>>&16 byte 9 dwab 15271>>&16 byte >9 unknown 15272>8 search/0x1000 dataWindow\0 \b, dataWindow: 15273>>&10 lelong x (%d 15274>>&14 lelong x %d)- 15275>>&18 lelong x \b(%d 15276>>&22 lelong x %d) 15277>8 search/0x1000 displayWindow\0 \b, displayWindow: 15278>>&10 lelong x (%d 15279>>&14 lelong x %d)- 15280>>&18 lelong x \b(%d 15281>>&22 lelong x %d) 15282>8 search/0x1000 lineOrder\0 \b, lineOrder: 15283>>&14 byte 0 increasing y 15284>>&14 byte 1 decreasing y 15285>>&14 byte 2 random y 15286>>&14 byte >2 unknown 15287 15288# SMPTE Digital Picture Exchange Format, SMPTE DPX 15289# 15290# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital 15291# Moving-Picture Exchange (DPX), v1.0, 18 February 1994 15292# Robert Minsk <robertminsk at yahoo.com> 15293# Modified by Harry Mallon <hjmallon at gmail.com> 152940 string SDPX DPX image data, big-endian, 15295!:mime image/x-dpx 15296>0 use dpx_info 152970 string XPDS DPX image data, little-endian, 15298!:mime image/x-dpx 15299>0 use \^dpx_info 15300 153010 name dpx_info 15302>768 beshort <4 15303>>772 belong x %dx 15304>>776 belong x \b%d, 15305>768 beshort >3 15306>>776 belong x %dx 15307>>772 belong x \b%d, 15308>768 beshort 0 left to right/top to bottom 15309>768 beshort 1 right to left/top to bottom 15310>768 beshort 2 left to right/bottom to top 15311>768 beshort 3 right to left/bottom to top 15312>768 beshort 4 top to bottom/left to right 15313>768 beshort 5 top to bottom/right to left 15314>768 beshort 6 bottom to top/left to right 15315>768 beshort 7 bottom to top/right to left 15316 15317# From: Tom Hilinski <tom.hilinski@comcast.net> 15318# http://www.unidata.ucar.edu/packages/netcdf/ 153190 string CDF\001 NetCDF Data Format data 15320 15321#----------------------------------------------------------------------- 15322# Hierarchical Data Format, used to facilitate scientific data exchange 15323# specifications at http://hdf.ncsa.uiuc.edu/ 153240 belong 0x0e031301 Hierarchical Data Format (version 4) data 15325!:mime application/x-hdf 153260 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) data 15327!:mime application/x-hdf 15328512 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 512 bytes user block 15329!:mime application/x-hdf 153301024 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 1k user block 15331!:mime application/x-hdf 153322048 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 2k user block 15333!:mime application/x-hdf 153344096 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 4k user block 15335!:mime application/x-hdf 15336 15337 15338# From: Tobias Burnus <burnus@net-b.de> 15339# Xara (for a while: Corel Xara) is a graphic package, see 15340# http://www.xara.com/ for Windows and as GPL application for Linux 153410 string XARA\243\243 Xara graphics file 15342 15343# http://www.cartesianinc.com/Tech/ 153440 string CPC\262 Cartesian Perceptual Compression image 15345!:mime image/x-cpi 15346 15347# From Albert Cahalan <acahalan@gmail.com> 15348# puredigital used it for the CVS disposable camcorder 15349#8 lelong 4 ZBM bitmap image data 15350#>4 leshort x %u x 15351#>6 leshort x %u 15352 15353# From Albert Cahalan <acahalan@gmail.com> 15354# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons 153550 string C565 OLPC firmware icon image data 15356>4 leshort x %u x 15357>6 leshort x %u 15358 15359# Applied Images - Image files from Cytovision 15360# Gustavo Junior Alves <gjalves@gjalves.com.br> 153610 string \xce\xda\xde\xfa Cytovision Metaphases file 153620 string \xed\xad\xef\xac Cytovision Karyotype file 153630 string \x0b\x00\x03\x00 Cytovision FISH Probe file 153640 string \xed\xfe\xda\xbe Cytovision FLEX file 153650 string \xed\xab\xed\xfe Cytovision FLEX file 153660 string \xad\xfd\xea\xad Cytovision RATS file 15367 15368# Wavelet Scalar Quantization format used in gray-scale fingerprint images 15369# From Tano M Fotang <mfotang@quanteq.com> 153700 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data 15371 15372# Type: PCO B16 image files 15373# URL: http://www.pco.de/fileadmin/user_upload/db/download/MA_CWDCOPIE_0412b.pdf 15374# From: Florian Philipp <florian.philipp@binarywings.net> 15375# Extension: .b16 15376# Description: Pixel image format produced by PCO Camware, typically used 15377# together with PCO cameras. 15378# Note: Different versions exist for e.g. 8 bit and 16 bit images. 15379# Documentation is incomplete. 153800 string/b PCO- PCO B16 image data 15381>12 lelong x \b, %dx 15382>16 lelong x \b%d 15383>20 lelong 0 \b, short header 15384>20 lelong -1 \b, extended header 15385>>24 lelong 0 \b, grayscale 15386>>>36 lelong 0 linear LUT 15387>>>36 lelong 1 logarithmic LUT 15388>>>28 lelong x [%d 15389>>>32 lelong x \b,%d] 15390>>24 lelong 1 \b, color 15391>>>64 lelong 0 linear LUT 15392>>>64 lelong 1 logarithmic LUT 15393>>>40 lelong x r[%d 15394>>>44 lelong x \b,%d] 15395>>>48 lelong x g[%d 15396>>>52 lelong x \b,%d] 15397>>>56 lelong x b[%d 15398>>>60 lelong x \b,%d] 15399 15400# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches 15401# From: Markus Heidelberg <markus.heidelberg at web.de> 154020 string/t [BitmapInfo2] Polar Monitor Bitmap text 15403!:mime image/x-polar-monitor-bitmap 15404 15405# From: Rick Richardson <rickrich@gmail.com> 15406# updated by: Joerg Jenderek 15407# URL: http://techmods.net/nuvi/ 154080 string GARMIN\ BITMAP\ 01 Garmin Bitmap file 15409# extension is also used for 15410# Sony SRF raw image (image/x-sony-srf) 15411# SRF map 15412# Terragen Surface Map (http://www.planetside.co.uk/terragen) 15413# FileLocator Pro search criteria file (http://www.mythicsoft.com/filelocatorpro) 15414!:ext srf 15415#!:mime image/x-garmin-srf 15416# version 1.00,2.00,2.10,2.40,2.50 15417>0x2f string >0 \b, version %4.4s 15418# width (2880,2881,3240) 15419>0x55 uleshort >0 \b, %dx 15420# height (80,90) 15421>>0x53 uleshort x \b%d 15422 15423# Type: Ulead Photo Explorer5 (.pe5) 15424# URL: http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese) 15425# From: Simon Horman <horms@debian.org> 154260 string IIO2H Ulead Photo Explorer5 15427 15428# Type: X11 cursor 15429# URL: http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup 15430# From: Mathias Brodala <info@noctus.net> 154310 string Xcur X11 cursor 15432 15433# Type: Olympus ORF raw images. 15434# URL: http://libopenraw.freedesktop.org/wiki/Olympus_ORF 15435# From: Adam Buchbinder <adam.buchbinder@gmail.com> 154360 string MMOR Olympus ORF raw image data, big-endian 15437!:mime image/x-olympus-orf 154380 string IIRO Olympus ORF raw image data, little-endian 15439!:mime image/x-olympus-orf 154400 string IIRS Olympus ORF raw image data, little-endian 15441!:mime image/x-olympus-orf 15442 15443# Type: files used in modern AVCHD camcoders to store clip information 15444# Extension: .cpi 15445# From: Alexander Danilov <alexander.a.danilov@gmail.com> 154460 string HDMV0100 AVCHD Clip Information 15447 15448# From: Adam Buchbinder <adam.buchbinder@gmail.com> 15449# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/ 15450# Radiance HDR; usually has .pic or .hdr extension. 154510 string #?RADIANCE\n Radiance HDR image data 15452#!mime image/vnd.radiance 15453 15454# From: Adam Buchbinder <adam.buchbinder@gmail.com> 15455# URL: http://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf 15456# Used by the pfstools packages. The regex matches for the image size could 15457# probably use some work. The MIME type is made up; if there's one in 15458# actual common use, it should replace the one below. 154590 string PFS1\x0a PFS HDR image data 15460#!mime image/x-pfs 15461>1 regex [0-9]*\ \b, %s 15462>>1 regex \ [0-9]{4} \bx%s 15463 15464# Type: Foveon X3F 15465# URL: http://www.photofo.com/downloads/x3f-raw-format.pdf 15466# From: Adam Buchbinder <adam.buchbinder@gmail.com> 15467# Note that the MIME type isn't defined anywhere that I can find; if 15468# there's a canonical type for this format, it should replace this one. 154690 string FOVb Foveon X3F raw image data 15470!:mime image/x-x3f 15471>6 leshort x \b, version %d. 15472>4 leshort x \b%d 15473>28 lelong x \b, %dx 15474>32 lelong x \b%d 15475 15476# Paint.NET file 15477# From Adam Buchbinder <adam.buchbinder@gmail.com> 154780 string PDN3 Paint.NET image data 15479!:mime image/x-paintnet 15480 15481# Not really an image. 15482# From: "Tano M. Fotang" <mfotang@quanteq.com> 154830 string \x46\x4d\x52\x00 ISO/IEC 19794-2 Format Minutiae Record (FMR) 15484 15485# doc: http://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip 15486# example: http://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip 1548790 bequad 0x574D50484F544F00 JPEG-XR Image 15488>98 byte&0x08 =0x08 \b, hard tiling 15489>99 byte&0x80 =0x80 \b, tiling present 15490>99 byte&0x40 =0x40 \b, codestream present 15491>99 byte&0x38 x \b, spatial xform= 15492>99 byte&0x38 0x00 \bTL 15493>99 byte&0x38 0x08 \bBL 15494>99 byte&0x38 0x10 \bTR 15495>99 byte&0x38 0x18 \bBR 15496>99 byte&0x38 0x20 \bBT 15497>99 byte&0x38 0x28 \bRB 15498>99 byte&0x38 0x30 \bLT 15499>99 byte&0x38 0x38 \bLB 15500>100 byte&0x80 =0x80 \b, short header 15501>>102 beshort+1 x \b, %d 15502>>104 beshort+1 x \bx%d 15503>100 byte&0x80 =0x00 \b, long header 15504>>102 belong+1 x \b, %x 15505>>106 belong+1 x \bx%x 15506>101 beshort&0xf x \b, bitdepth= 15507>>101 beshort&0xf 0x0 \b1-WHITE=1 15508>>101 beshort&0xf 0x1 \b8 15509>>101 beshort&0xf 0x2 \b16 15510>>101 beshort&0xf 0x3 \b16-SIGNED 15511>>101 beshort&0xf 0x4 \b16-FLOAT 15512>>101 beshort&0xf 0x5 \b(reserved 5) 15513>>101 beshort&0xf 0x6 \b32-SIGNED 15514>>101 beshort&0xf 0x7 \b32-FLOAT 15515>>101 beshort&0xf 0x8 \b5 15516>>101 beshort&0xf 0x9 \b10 15517>>101 beshort&0xf 0xa \b5-6-5 15518>>101 beshort&0xf 0xb \b(reserved %d) 15519>>101 beshort&0xf 0xc \b(reserved %d) 15520>>101 beshort&0xf 0xd \b(reserved %d) 15521>>101 beshort&0xf 0xe \b(reserved %d) 15522>>101 beshort&0xf 0xf \b1-BLACK=1 15523>101 beshort&0xf0 x \b, colorfmt= 15524>>101 beshort&0xf0 0x00 \bYONLY 15525>>101 beshort&0xf0 0x10 \bYUV240 15526>>101 beshort&0xf0 0x20 \bYWV422 15527>>101 beshort&0xf0 0x30 \bYWV444 15528>>101 beshort&0xf0 0x40 \bCMYK 15529>>101 beshort&0xf0 0x50 \bCMYKDIRECT 15530>>101 beshort&0xf0 0x60 \bNCOMPONENT 15531>>101 beshort&0xf0 0x70 \bRGB 15532>>101 beshort&0xf0 0x80 \bRGBE 15533>>101 beshort&0xf0 >0x80 \b(reserved 0x%x) 15534 15535# From: Johan van der Knijff <johan.vanderknijff@kb.nl> 15536# 15537# BPG (Better Portable Graphics) format 15538# http://bellard.org/bpg/ 15539# http://fileformats.archiveteam.org/wiki/BPG 15540# 155410 string \x42\x50\x47\xFB BPG (Better Portable Graphics) 15542!:mime image/bpg 15543 15544# From: Joerg Jenderek 15545# URL: https://en.wikipedia.org/wiki/Apple_Icon_Image_format 155460 string icns Mac OS X icon 15547!:mime image/x-icns 15548!:apple ????icns 15549!:ext icns 15550>4 ubelong >0 15551# file size 15552>>4 ubelong x \b, %d bytes 15553# icon type 15554>>8 string x \b, "%4.4s" type 15555 15556# TIM images 155570 lelong 0x00000010 TIM image, 15558>4 lelong 0x8 4-Bit, 15559>4 lelong 0x9 8-Bit, 15560>4 lelong 0x2 15-Bit, 15561>4 lelong 0x3 24-Bit, 15562>4 lelong &8 15563>>(8.l+12) leshort x Pixel at (%d, 15564>>(8.l+14) leshort x \b%d) 15565>>(8.l+16) leshort x Size=%dx 15566>>(8.l+18) leshort x \b%d, 15567>>4 lelong 0x8 16 CLUT Entries at 15568>>4 lelong 0x9 256 CLUT Entries at 15569>>12 leshort x (%d, 15570>>14 leshort x \b%d) 15571>4 lelong ^8 15572>>12 leshort x Pixel at (%d, 15573>>14 leshort x \b%d) 15574>>16 leshort x Size=%dx 15575>>18 leshort x \b%d 15576 15577# MDEC streams 155780 lelong 0x80010160 MDEC video stream, 15579>16 leshort x %dx 15580>18 leshort x \b%d 15581#>8 lelong x %d frames 15582#>4 leshort x secCount=%d; 15583#>6 leshort x nSectors=%d; 15584#>12 lelong x frameSize=%d; 15585 15586# BS encoded bitstreams 155872 leshort 0x3800 BS image, 15588>6 leshort x Version %d, 15589>4 leshort x Quantization %d, 15590>0 leshort x (Decompresses to %d words) 15591 15592# Type: farbfeld image. 15593# Url: http://tools.suckless.org/farbfeld/ 15594# From: Ian D. Scott <ian@iandouglasscott.com> 15595# 155960 string farbfeld farbfeld image data, 15597>8 ubelong x %dx 15598>12 ubelong x \b%d 15599 15600# Type: Microsoft DirectDraw Surface (common data) 15601# URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp 15602# From: Morten Hustveit <morten@debian.org> 15603# Updated by: David Korth <gerbilsoft@gerbilsoft.com> 156040 name ms-directdraw-surface 15605>0x10 ulelong x %u x 15606>0x0C ulelong x %u 15607# Color depth. 15608>0x58 ulelong >0 \b, %u-bit color 15609# Determine the pixel format. 15610>0x50 ulelong&0x4 4 15611# FIXME: Handle DX10 and XBOX formats. 15612>>0x54 string x \b, compressed using %.4s 15613>0x50 ulelong&0x2 0x2 \b, alpha only 15614>0x50 ulelong&0x200 0x200 \b, YUV 15615>0x50 ulelong&0x20000 0x20000 \b, luminance 15616# RGB pixel format 15617>0x50 ulelong&0x40 0x40 15618 15619# Determine the RGB format using the color masks. 15620# ulequad order: 0xGGGGGGGGRRRRRRRR, 0xAAAAAAAABBBBBBBB 15621 15622>>0x58 ulelong 16 15623 15624# NOTE: 15-bit color formats usually have 16-bit listed as the color depth. 15625>>>0x5C ulequad 0x000003E000007C00 15626>>>>0x64 ulequad 0x000000000000001F \b, RGB555 15627>>>0x5C ulequad 0x000003E000001F00 15628>>>>0x64 ulequad 0x000000000000007C \b, BGR555 15629 15630>>>0x5C ulequad 0x000007E00000F800 15631>>>>0x64 ulequad 0x000000000000001F \b, RGB565 15632>>>0x5C ulequad 0x000007E000001F00 15633>>>>0x64 ulequad 0x00000000000000F8 \b, BGR565 15634 15635>>>0x5C ulequad 0x000000F000000F00 15636>>>>0x64 ulequad 0x0000F0000000000F \b, ARGB4444 15637>>>0x5C ulequad 0x000000F00000000F 15638>>>>0x64 ulequad 0x0000F00000000F00 \b, ABGR4444 15639 15640>>>0x5C ulequad 0x00000F000000F000 15641>>>>0x64 ulequad 0x0000000F000000F0 \b, RGBA4444 15642>>>0x5C ulequad 0x00000F00000000F0 15643>>>>0x64 ulequad 0x0000000F0000F000 \b, BGRA4444 15644 15645>>>0x5C ulequad 0x000000F000000F00 15646>>>>0x64 ulequad 0x000000000000000F \b, xRGB4444 15647>>>0x5C ulequad 0x000000F00000000F 15648>>>>0x64 ulequad 0x0000000000000F00 \b, xBGR4444 15649 15650>>>0x5C ulequad 0x00000F000000F000 15651>>>>0x64 ulequad 0x00000000000000F0 \b, RGBx4444 15652>>>0x5C ulequad 0x00000F00000000F0 15653>>>>0x64 ulequad 0x000000000000F000 \b, BGRx4444 15654 15655>>>0x5C ulequad 0x000003E000007C00 15656>>>>0x64 ulequad 0x000080000000001F \b, ARGB1555 15657>>>0x5C ulequad 0x000003E000001F00 15658>>>>0x64 ulequad 0x000080000000007C \b, ABGR1555 15659>>>0x5C ulequad 0x000007C00000F800 15660>>>>0x64 ulequad 0x000000010000003E \b, RGBA5551 15661>>>0x5C ulequad 0x000007C00000003E 15662>>>>0x64 ulequad 0x000000010000F800 \b, BGRA5551 15663 15664>>88 ulelong 24 15665>>>0x5C ulequad 0x0000FF0000FF0000 15666>>>>0x64 ulequad 0x00000000000000FF \b, RGB888 15667>>>0x5C ulequad 0x0000FF00000000FF 15668>>>>0x64 ulequad 0x0000000000FF0000 \b, BGR888 15669 15670>>88 ulelong 32 15671>>>0x5C ulequad 0x0000FF0000FF0000 15672>>>>0x64 ulequad 0xFF000000000000FF \b, ARGB8888 15673>>>0x5C ulequad 0x0000FF00000000FF 15674>>>>0x64 ulequad 0xFF00000000FF0000 \b, ABGR8888 15675 15676>>>0x5C ulequad 0x00FF0000FF000000 15677>>>>0x64 ulequad 0x000000FF0000FF00 \b, RGBA8888 15678>>>0x5C ulequad 0x00FF00000000FF00 15679>>>>0x64 ulequad 0x000000FFFF000000 \b, BGBA8888 15680 15681>>>0x5C ulequad 0x0000FF0000FF0000 15682>>>>0x64 ulequad 0x00000000000000FF \b, xRGB8888 15683>>>0x5C ulequad 0x0000FF00000000FF 15684>>>>0x64 ulequad 0x0000000000FF0000 \b, xBGR8888 15685 15686>>>0x5C ulequad 0x00FF0000FF000000 15687>>>>0x64 ulequad 0x000000000000FF00 \b, RGBx8888 15688>>>0x5C ulequad 0x00FF00000000FF00 15689>>>>0x64 ulequad 0x00000000FF000000 \b, BGBx8888 15690 15691# Less common 32-bit color formats. 15692>>>0x5C ulequad 0xFFFF00000000FFFF 15693>>>>0x64 ulequad 0x0000000000000000 \b, G16R16 15694>>>0x5C ulequad 0x0000FFFFFFFF0000 15695>>>>0x64 ulequad 0x0000000000000000 \b, R16G16 15696 15697>>>0x5C ulequad 0x000FFC003FF00000 15698>>>>0x64 ulequad 0xC0000000000003FF \b, A2R10G10B10 15699>>>0x5C ulequad 0x000FFC00000003FF 15700>>>>0x64 ulequad 0xC00000003FF00000 \b, A2B10G10R10 15701 15702# Type: Microsoft DirectDraw Surface 15703# URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp 15704# From: Morten Hustveit <morten@debian.org> 15705# Updated by: David Korth <gerbilsoft@gerbilsoft.com> 157060 string/b DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS): 15707>0 use ms-directdraw-surface 15708 15709# Type: Sega PVR image. 15710# From: David Korth <gerbilsoft@gerbilsoft.com> 15711# References: 15712# - http://fabiensanglard.net/Mykaruga/tools/segaPVRFormat.txt 15713# - https://github.com/yazgoo/pvrx2png 15714# - https://github.com/nickworonekin/puyotools 15715 15716# Sega PVR header. 157170 name sega-pvr-image-header 15718>0x0C leshort x %u x 15719>0x0E leshort x %u 15720# Image format. 15721>0x08 byte 0 \b, ARGB1555 15722>0x08 byte 1 \b, RGB565 15723>0x08 byte 2 \b, ARGB4444 15724>0x08 byte 3 \b, YUV442 15725>0x08 byte 4 \b, Bump 15726>0x08 byte 5 \b, 4bpp 15727>0x08 byte 6 \b, 8bpp 15728# Image data type. 15729>0x09 byte 0x01 \b, square twiddled 15730>0x09 byte 0x02 \b, square twiddled & mipmap 15731>0x09 byte 0x03 \b, VQ 15732>0x09 byte 0x04 \b, VQ & mipmap 15733>0x09 byte 0x05 \b, 8-bit CLUT twiddled 15734>0x09 byte 0x06 \b, 4-bit CLUT twiddled 15735>0x09 byte 0x07 \b, 8-bit direct twiddled 15736>0x09 byte 0x08 \b, 4-bit direct twiddled 15737>0x09 byte 0x09 \b, rectangle 15738>0x09 byte 0x0B \b, rectangular stride 15739>0x09 byte 0x0D \b, rectangular twiddled 15740>0x09 byte 0x10 \b, small VQ 15741>0x09 byte 0x11 \b, small VQ & mipmap 15742>0x09 byte 0x12 \b, square twiddled & mipmap 15743 15744# Sega PVR image. 157450 string PVRT 15746>0x10 string DDS\040\174\000\000\000 Sega PVR (Xbox) image: 15747>>0x20 use ms-directdraw-surface 15748>0x10 belong !0x44445320 Sega PVR image: 15749>>0 use sega-pvr-image-header 15750 15751# Sega PVR image with GBIX. 157520 string GBIX 15753>0x10 string PVRT 15754>>0x10 string DDS\040\174\000\000\000 Sega PVR (Xbox) image: 15755>>0x20 use ms-directdraw-surface 15756>>0x10 belong !0x44445320 Sega PVR image: 15757>>>0x10 use sega-pvr-image-header 15758>>0x08 lelong x \b, global index = %u 15759 15760# Sega GVR header. 157610 name sega-gvr-image-header 15762>0x0C beshort x %u x 15763>0x0E beshort x %u 15764# Image data format. 15765>0x0B byte 0 \b, I4 15766>0x0B byte 1 \b, I8 15767>0x0B byte 2 \b, IA4 15768>0x0B byte 3 \b, IA8 15769>0x0B byte 4 \b, RGB565 15770>0x0B byte 5 \b, RGB5A3 15771>0x0B byte 6 \b, ARGB8888 15772>0x0B byte 8 \b, CI4 15773>0x0B byte 9 \b, CI8 15774>0x0B byte 14 \b, DXT1 15775 15776# Sega GVR image. 157770 string GVRT Sega GVR image: 15778>0x10 use sega-gvr-image-header 15779 15780# Sega GVR image with GBIX. 157810 string GBIX 15782>0x10 string GVRT Sega GVR image: 15783>>0x10 use sega-gvr-image-header 15784>>0x08 belong x \b, global index = %u 15785 15786# Sega GVR image with GCIX. (Wii) 157870 string GCIX 15788>0x10 string GVRT Sega GVR image: 15789>>0x10 use sega-gvr-image-header 15790>>0x08 belong x \b, global index = %u 15791 15792# Light Field Picture 15793# Documentation: http://optics.miloush.net/lytro/TheFileFormat.aspx 15794# Typical file extensions: .lfp .lfr .lfx 15795 157960 belong 0x894C4650 15797>4 belong 0x0D0A1A0A 15798>12 belong 0x00000000 Lytro Light Field Picture 15799>8 belong x \b, version %d 15800 15801# Type: Vision Research Phantom CINE Format 15802# URL: https://www.phantomhighspeed.com/ 15803# URL2: http://phantomhighspeed.force.com/vriknowledge/servlet/fileField?id=0BEU0000000Cfyk 15804# From: Harry Mallon <hjmallon at gmail.com> 15805# 15806# This has a short "CI" code but the 44 is the size of the struct which is 15807# stable 158080 string CI 15809>2 leshort 44 Vision Research CINE Video, 15810>>4 leshort 0 Grayscale, 15811>>4 leshort 1 JPEG Compressed, 15812>>4 leshort 2 RAW, 15813>>6 leshort x version %d, 15814>>20 lelong x %d frames, 15815>>48 lelong x %dx 15816>>52 lelong x \b%d 15817 15818# Type: ARRI Raw Image 15819# Info: SMPTE RDD30:2014 15820# From: Harry Mallon <hjmallon at gmail.com> 158210 string ARRI ARRI ARI image data, 15822>4 lelong 0x78563412 little-endian, 15823>4 lelong 0x12345678 big-endian, 15824>12 lelong x version %d, 15825>20 lelong x %dx 15826>24 lelong x \b%d 15827 15828# Type: Khronos KTX texture. 15829# From: David Korth <gerbilsoft@gerbilsoft.com> 15830# References: 15831# - https://www.khronos.org/opengles/sdk/tools/KTX/file_format_spec/ 15832 15833# glEnum decoding. 15834# NOTE: Only the most common formats are listed here. 158350 name khronos-ktx-glEnum 15836>0 lelong 0x1907 \b, RGB 15837>0 lelong 0x1908 \b, RGBA 15838>0 lelong 0x1909 \b, LUMINANCE 15839>0 lelong 0x190A \b, LUMINANCE_ALPHA 15840>0 lelong 0x80E1 \b, BGR 15841>0 lelong 0x80E2 \b, BGRA 15842>0 lelong 0x83A0 \b, RGB_S3TC 15843>0 lelong 0x83A1 \b, RGB4_S3TC 15844>0 lelong 0x83A2 \b, RGBA_S3TC 15845>0 lelong 0x83A3 \b, RGBA4_S3TC 15846>0 lelong 0x83A4 \b, RGBA_DXT5_S3TC 15847>0 lelong 0x83A5 \b, RGBA4_DXT5_S3TC 15848>0 lelong 0x8D64 \b, ETC1_RGB8_OES 15849>0 lelong 0x9270 \b, COMPRESSED_R11_EAC 15850>0 lelong 0x9271 \b, COMPRESSED_SIGNED_R11_EAC 15851>0 lelong 0x9272 \b, COMPRESSED_RG11_EAC 15852>0 lelong 0x9273 \b, COMPRESSED_SIGNED_RG11_EAC 15853>0 lelong 0x9274 \b, COMPRESSED_RGB8_ETC2 15854>0 lelong 0x9275 \b, COMPRESSED_SRGB8_ETC2 15855>0 lelong 0x9276 \b, COMPRESSED_RGB8_PUNCHTHROUGH_ALPHA1_ETC2 15856>0 lelong 0x9277 \b, COMPRESSED_SRGB8_PUNCHTHROUGH_ALPHA1_ETC2 15857>0 lelong 0x9278 \b, COMPRESSED_RGBA2_ETC2_EAC 15858>0 lelong 0x9279 \b, COMPRESSED_SRGB8_ALPHA8_ETC2_EAC 15859>0 lelong 0x93B0 \b, COMPRESSED_RGBA_ASTC_4x4_KHR 15860>0 lelong 0x93B1 \b, COMPRESSED_RGBA_ASTC_5x4_KHR 15861>0 lelong 0x93B2 \b, COMPRESSED_RGBA_ASTC_5x5_KHR 15862>0 lelong 0x93B3 \b, COMPRESSED_RGBA_ASTC_6x5_KHR 15863>0 lelong 0x93B4 \b, COMPRESSED_RGBA_ASTC_6x6_KHR 15864>0 lelong 0x93B5 \b, COMPRESSED_RGBA_ASTC_8x5_KHR 15865>0 lelong 0x93B6 \b, COMPRESSED_RGBA_ASTC_8x6_KHR 15866>0 lelong 0x93B7 \b, COMPRESSED_RGBA_ASTC_8x8_KHR 15867>0 lelong 0x93B8 \b, COMPRESSED_RGBA_ASTC_10x5_KHR 15868>0 lelong 0x93B9 \b, COMPRESSED_RGBA_ASTC_10x6_KHR 15869>0 lelong 0x93BA \b, COMPRESSED_RGBA_ASTC_10x8_KHR 15870>0 lelong 0x93BB \b, COMPRESSED_RGBA_ASTC_10x10_KHR 15871>0 lelong 0x93BC \b, COMPRESSED_RGBA_ASTC_12x10_KHR 15872>0 lelong 0x93BD \b, COMPRESSED_RGBA_ASTC_12x12_KHR 15873>0 lelong 0x93D0 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_4x4_KHR 15874>0 lelong 0x93D1 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x4_KHR 15875>0 lelong 0x93D2 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x5_KHR 15876>0 lelong 0x93D3 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x5_KHR 15877>0 lelong 0x93D4 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x6_KHR 15878>0 lelong 0x93D5 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x5_KHR 15879>0 lelong 0x93D6 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x6_KHR 15880>0 lelong 0x93D7 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x8_KHR 15881>0 lelong 0x93D8 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x5_KHR 15882>0 lelong 0x93D9 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x6_KHR 15883>0 lelong 0x93DA \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x8_KHR 15884>0 lelong 0x93DB \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x10_KHR 15885>0 lelong 0x93DC \b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x10_KHR 15886>0 lelong 0x93DD \b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x12_KHR 15887 15888# Endian-specific KTX header. 15889# TODO: glType (all textures I've seen so far are GL_UNSIGNED_BYTE) 158900 name khronos-ktx-endian-header 15891>20 lelong x \b, %u 15892>24 lelong >1 x %u 15893>28 lelong >1 x %u 15894>8 lelong >0 15895>>8 use khronos-ktx-glEnum 15896>8 lelong 0 15897>>12 use khronos-ktx-glEnum 15898 15899# Main KTX header. 15900# Determine endianness, then check the rest of the header. 159010 string \xABKTX\ 11\xBB\r\n\x1A\n Khronos KTX texture 15902>12 lelong 0x04030201 (little-endian) 15903>>16 use khronos-ktx-endian-header 15904>12 belong 0x04030201 (big-endian) 15905>>16 use ^khronos-ktx-endian-header 15906 15907# Type: Valve VTF texture. 15908# From: David Korth <gerbilsoft@gerbilsoft.com> 15909# References: 15910# - https://developer.valvesoftware.com/wiki/Valve_Texture_Format 15911 15912# VTF image formats. 159130 name vtf-image-format 15914>0 lelong 0 RGBA8888 15915>0 lelong 1 ABGR8888 15916>0 lelong 2 RGB888 15917>0 lelong 3 BGR888 15918>0 lelong 4 RGB565 15919>0 lelong 5 I8 15920>0 lelong 6 IA88 15921>0 lelong 7 P8 15922>0 lelong 8 A8 15923>0 lelong 9 RGB888 (bluescreen) 15924>0 lelong 10 BGR888 (bluescreen) 15925>0 lelong 11 ARGB8888 15926>0 lelong 12 BGRA8888 15927>0 lelong 13 DXT1 15928>0 lelong 14 DXT3 15929>0 lelong 15 DXT5 15930>0 lelong 16 BGRx8888 15931>0 lelong 17 BGR565 15932>0 lelong 18 BGRx5551 15933>0 lelong 19 BGRA4444 15934>0 lelong 20 DXT1+A1 15935>0 lelong 21 BGRA5551 15936>0 lelong 22 UV88 15937>0 lelong 23 UVWQ8888 15938>0 lelong 24 RGBA16161616F 15939>0 lelong 25 RGBA16161616 15940>0 lelong 26 UVLX8888 15941 15942# Main VTF header. 159430 string VTF\0 Valve Texture Format 15944>4 lelong x v%u 15945>8 lelong x \b.%u 15946>0x10 leshort x \b, %u 15947>0x12 leshort >1 x %u 15948>4 lequad 0x0000000700000002 15949>>0x3F leshort >1 x %u 15950>0x18 leshort >1 \b, %u frames 15951>0x38 byte x \b, mipmaps: %u 15952>0x34 lelong >-1 \b, 15953>>0x34 use vtf-image-format 15954 15955# Type: Valve VTF3 (PS3) texture. 15956# From: David Korth <gerbilsoft@gerbilsoft.com> 159570 string VTF3 Valve Texture Format (PS3) 15958>0x14 beshort x \b, %u 15959>0x16 beshort x \b x %u 15960>0x10 belong&0x2000 0 \b, DXT1 15961>0x10 belong&0x2000 0x2000 \b, DXT5 15962 15963# Type: ASTC texture. 15964# From: David Korth <gerbilsoft@gerbilsoft.com> 15965# References: 15966# - https://stackoverflow.com/questions/22600678/determine-internal-format-of-given-astc-compressed-image-through-its-header 15967# - https://stackoverflow.com/a/22682244 159680 lelong 0x5ca1ab13 ASTC 15969>4 byte x %u 15970>5 byte x \bx%u 15971>6 byte >1 \bx%u 15972# X, Y, and Z dimensions are stored as 24-bit LE. 15973# Pretend it's 32-bit and mask off the high byte. 15974>7 lelong&0x00FFFFFF x texture, %u 15975>10 lelong&0x00FFFFFF x x %u 15976>13 lelong&0x00FFFFFF >1 x %u 15977 15978# Zebra Metafile graphic 15979# http://www.fileformat.info/format/zbr/egff.htm 159800 beshort 0x9a02 Zebra Metafile graphic 15981>2 leshort 1 (version 1.x) 15982>2 leshort 2 (version 1.1x or 1.2x) 15983>2 leshort 3 (version 1.49) 15984>2 leshort 4 (version 1.50) 15985>4 string x (comment = %s) 15986 15987# Microsoft Paint graphic 15988# http://www.fileformat.info/format/mspaint/egff.htm 159890 string DanM icrosoft Paint image data (version 1.x) 15990>4 leshort x (%d 15991>>6 leshort x x %d) 159920 string LinS Microsoft Paint image data (version 2.0) 15993>4 leshort x (%d 15994>>6 leshort x x %d) 15995 15996#------------------------------------------------------------------------------ 15997# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $ 15998# inform: file(1) magic for Inform interactive fiction language 15999 16000# URL: http://www.inform-fiction.org/ 16001# From: Reuben Thomas <rrt@sc3d.org> 16002 160030 search/100/cW constant\ story Inform source text 16004 16005#------------------------------------------------------------------------------ 16006# $File: intel,v 1.16 2017/11/14 15:48:36 christos Exp $ 16007# intel: file(1) magic for x86 Unix 16008# 16009# Various flavors of x86 UNIX executable/object (other than Xenix, which 16010# is in "microsoft"). DOS is in "msdos"; the ambitious soul can do 16011# Windows as well. 16012# 16013# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and 16014# whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere 16015# as well, if, as, and when IBM makes it portable. 16016# 16017# The `versions' should be un-commented if they work for you. 16018# (Was the problem just one of endianness?) 16019# 160200 leshort 0502 basic-16 executable 16021>12 lelong >0 not stripped 16022#>22 leshort >0 - version %d 160230 leshort 0503 basic-16 executable (TV) 16024>12 lelong >0 not stripped 16025#>22 leshort >0 - version %d 160260 leshort 0510 x86 executable 16027>12 lelong >0 not stripped 160280 leshort 0511 x86 executable (TV) 16029>12 lelong >0 not stripped 160300 leshort =0512 iAPX 286 executable small model (COFF) 16031>12 lelong >0 not stripped 16032#>22 leshort >0 - version %d 160330 leshort =0522 iAPX 286 executable large model (COFF) 16034>12 lelong >0 not stripped 16035#>22 leshort >0 - version %d 16036# updated by Joerg Jenderek at Oct 2015 16037# https://de.wikipedia.org/wiki/Common_Object_File_Format 16038# http://www.delorie.com/djgpp/doc/coff/filhdr.html 16039# ./msdos (version 5.25) labeled the next entry as "MS Windows COFF Intel 80386 object file" 16040# ./intel (version 5.25) label labeled the next entry as "80386 COFF executable" 16041# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan 160420 leshort =0514 16043# use subroutine to display name+flags+variables for common object formated files 16044>0 use display-coff 16045#>12 lelong >0 not stripped 16046# no hint found, that at offset 22 is version 16047#>22 leshort >0 - version %d 16048 16049# rom: file(1) magic for BIOS ROM Extensions found in intel machines 16050# mapped into memory between 0xC0000 and 0xFFFFF 16051# From: Alex Myczko <alex@aiei.ch> 16052# updated by Joerg Jenderek 16053# https://en.wikipedia.org/wiki/Option_ROM 160540 beshort 0x55AA BIOS (ia32) ROM Ext. 16055!:mime application/octet-stream 16056!:ext rom/bin 16057>5 string USB USB 16058>7 string LDR UNDI image 16059>30 string IBM IBM comp. Video 16060>26 string Adaptec Adaptec 16061>28 string Adaptec Adaptec 16062>42 string PROMISE Promise 16063>2 byte x (%d*512) 16064 16065# Flash descriptors for Intel SPI flash roms. 16066# From Dr. Jesus <j@hug.gs> 160670 lelong 0x0ff0a55a Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step 1606816 lelong 0x0ff0a55a Intel serial flash for PCH ROM 16069 16070#------------------------------------------------------------------------------ 16071# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $ 16072# interleaf: file(1) magic for InterLeaf TPS: 16073# 160740 string =\210OPS Interleaf saved data 160750 string =<!OPS Interleaf document text 16076>5 string ,\ Version\ = \b, version 16077>>17 string >\0 %.3s 16078 16079#------------------------------------------------------------------------------ 16080# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $ 16081# island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1 16082# "/etc/magic": 16083# From: guy@netapp.com (Guy Harris) 16084# 160854 string pgscriptver IslandWrite document 1608613 string DrawFile IslandDraw document 16087 16088 16089#------------------------------------------------------------------------------ 16090# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $ 16091# ispell: file(1) magic for ispell 16092# 16093# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic 16094# will match 0x9600 through 0x9603 in *both* little endian and big endian. 16095# (No other current magic entries collide.) 16096# 16097# Updated by Daniel Quinlan (quinlan@yggdrasil.com) 16098# 160990 leshort&0xFFFC 0x9600 little endian ispell 16100>0 byte 0 hash file (?), 16101>0 byte 1 3.0 hash file, 16102>0 byte 2 3.1 hash file, 16103>0 byte 3 hash file (?), 16104>2 leshort 0x00 8-bit, no capitalization, 26 flags 16105>2 leshort 0x01 7-bit, no capitalization, 26 flags 16106>2 leshort 0x02 8-bit, capitalization, 26 flags 16107>2 leshort 0x03 7-bit, capitalization, 26 flags 16108>2 leshort 0x04 8-bit, no capitalization, 52 flags 16109>2 leshort 0x05 7-bit, no capitalization, 52 flags 16110>2 leshort 0x06 8-bit, capitalization, 52 flags 16111>2 leshort 0x07 7-bit, capitalization, 52 flags 16112>2 leshort 0x08 8-bit, no capitalization, 128 flags 16113>2 leshort 0x09 7-bit, no capitalization, 128 flags 16114>2 leshort 0x0A 8-bit, capitalization, 128 flags 16115>2 leshort 0x0B 7-bit, capitalization, 128 flags 16116>2 leshort 0x0C 8-bit, no capitalization, 256 flags 16117>2 leshort 0x0D 7-bit, no capitalization, 256 flags 16118>2 leshort 0x0E 8-bit, capitalization, 256 flags 16119>2 leshort 0x0F 7-bit, capitalization, 256 flags 16120>4 leshort >0 and %d string characters 161210 beshort&0xFFFC 0x9600 big endian ispell 16122>1 byte 0 hash file (?), 16123>1 byte 1 3.0 hash file, 16124>1 byte 2 3.1 hash file, 16125>1 byte 3 hash file (?), 16126>2 beshort 0x00 8-bit, no capitalization, 26 flags 16127>2 beshort 0x01 7-bit, no capitalization, 26 flags 16128>2 beshort 0x02 8-bit, capitalization, 26 flags 16129>2 beshort 0x03 7-bit, capitalization, 26 flags 16130>2 beshort 0x04 8-bit, no capitalization, 52 flags 16131>2 beshort 0x05 7-bit, no capitalization, 52 flags 16132>2 beshort 0x06 8-bit, capitalization, 52 flags 16133>2 beshort 0x07 7-bit, capitalization, 52 flags 16134>2 beshort 0x08 8-bit, no capitalization, 128 flags 16135>2 beshort 0x09 7-bit, no capitalization, 128 flags 16136>2 beshort 0x0A 8-bit, capitalization, 128 flags 16137>2 beshort 0x0B 7-bit, capitalization, 128 flags 16138>2 beshort 0x0C 8-bit, no capitalization, 256 flags 16139>2 beshort 0x0D 7-bit, no capitalization, 256 flags 16140>2 beshort 0x0E 8-bit, capitalization, 256 flags 16141>2 beshort 0x0F 7-bit, capitalization, 256 flags 16142>4 beshort >0 and %d string characters 16143# ispell 4.0 hash files kromJx <kromJx@crosswinds.net> 16144# Ispell 4.0 161450 string ISPL ispell 16146>4 long x hash file version %d, 16147>8 long x lexletters %d, 16148>12 long x lexsize %d, 16149>16 long x hashsize %d, 16150>20 long x stblsize %d 16151 16152#------------------------------------------------------------------------------ 16153# $File: isz,v 1.4 2017/03/17 21:35:28 christos Exp $ 16154# ISO Zipped file format 16155# http://www.ezbsystems.com/isz/iszspec.txt 161560 string IsZ! ISO Zipped file 16157>4 byte x \b, header size %u 16158>5 byte x \b, version %u 16159>8 lelong x \b, serial %u 16160#12 leshort x \b, sector size %u 16161#>16 lelong x \b, total sectors %u 16162>17 byte >0 \b, password protected 16163#>24 lequad x \b, segment size %llu 16164#>32 lelong x \b, blocks %u 16165#>36 lelong x \b, block size %u 16166 16167#------------------------------------------------------------ 16168# $File: java,v 1.18 2015/11/29 22:08:14 christos Exp $ 16169# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the 16170# same magic number, 0xcafebabe, so they are both handled 16171# in the entry called "cafebabe". 16172#------------------------------------------------------------ 16173# Java serialization 16174# From Martin Pool (m.pool@pharos.com.au) 161750 beshort 0xaced Java serialization data 16176>2 beshort >0x0004 \b, version %d 16177 161780 belong 0xfeedfeed Java KeyStore 16179!:mime application/x-java-keystore 161800 belong 0xcececece Java JCE KeyStore 16181!:mime application/x-java-jce-keystore 16182 16183# Java source 161840 regex \^import.*;$ Java source 16185!:mime text/x-java 16186 16187# Java HPROF dumps 16188# https://java.net/downloads/heap-snapshot/hprof-binary-format.html 161890 string JAVA\x20PROFILE\x201.0. 16190>0x12 short 0 16191>>0x11 ushort-0x31 <2 Java HPROF dump, 16192>>0x17 beqdate/1000 x created %s 16193 16194#------------------------------------------------------------------------------ 16195# $File: javascript,v 1.1 2012/06/16 13:30:36 christos Exp $ 16196# javascript: magic for javascript and node.js scripts. 16197# 161980 search/1/w #!/bin/node Node.js script text executable 16199!:mime application/javascript 162000 search/1/w #!/usr/bin/node Node.js script text executable 16201!:mime application/javascript 162020 search/1/w #!/bin/nodejs Node.js script text executable 16203!:mime application/javascript 162040 search/1/w #!/usr/bin/nodejs Node.js script text executable 16205!:mime application/javascript 162060 search/1 #!/usr/bin/env\ node Node.js script text executable 16207!:mime application/javascript 162080 search/1 #!/usr/bin/env\ nodejs Node.js script text executable 16209!:mime application/javascript 16210 16211#------------------------------------------------------------------------------ 16212# $File: jpeg,v 1.31 2017/03/17 21:35:28 christos Exp $ 16213# JPEG images 16214# SunOS 5.5.1 had 16215# 16216# 0 string \377\330\377\340 JPEG file 16217# 0 string \377\330\377\356 JPG file 16218# 16219# both of which turn into "JPEG image data" here. 16220# 162210 beshort 0xffd8 JPEG image data 16222!:mime image/jpeg 16223!:apple 8BIMJPEG 16224!:strength *3 16225!:ext jpeg/jpg/jpe/jfif 16226>6 string JFIF \b, JFIF standard 16227# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06 16228# in a vain attempt to add image size reporting for JFIF. Note that these 16229# tests are not fool-proof since some perfectly valid JPEGs are currently 16230# impossible to specify in magic(4) format. 16231# First, a little JFIF version info: 16232>>11 byte x \b %d. 16233>>12 byte x \b%02d 16234# Next, the resolution or aspect ratio of the image: 16235>>13 byte 0 \b, aspect ratio 16236>>13 byte 1 \b, resolution (DPI) 16237>>13 byte 2 \b, resolution (DPCM) 16238>>14 beshort x \b, density %dx 16239>>16 beshort x \b%d 16240>>4 beshort x \b, segment length %d 16241# Next, show thumbnail info, if it exists: 16242>>18 byte !0 \b, thumbnail %dx 16243>>>19 byte x \b%d 16244>6 string Exif \b, Exif standard: [ 16245>>12 indirect/r x 16246>>12 string x \b] 16247 16248# Jump to the first segment 16249>(4.S+4) use jpeg_segment 16250 16251# This uses recursion... 162520 name jpeg_segment 16253>0 beshort 0xFFFE 16254# Recursion handled by FFE0 16255#>>(2.S+2) use jpeg_segment 16256>>2 pstring/HJ x \b, comment: "%s" 16257 16258>0 beshort 0xFFC0 16259>>(2.S+2) use jpeg_segment 16260>>4 byte x \b, baseline, precision %d 16261>>7 beshort x \b, %dx 16262>>5 beshort x \b%d 16263>>9 byte x \b, frames %d 16264 16265>0 beshort 0xFFC1 16266>>(2.S+2) use jpeg_segment 16267>>4 byte x \b, extended sequential, precision %d 16268>>7 beshort x \b, %dx 16269>>5 beshort x \b%d 16270>>9 byte x \b, frames %d 16271 16272>0 beshort 0xFFC2 16273>>(2.S+2) use jpeg_segment 16274>>4 byte x \b, progressive, precision %d 16275>>7 beshort x \b, %dx 16276>>5 beshort x \b%d 16277>>9 byte x \b, frames %d 16278 16279# Define Huffman Tables 16280>0 beshort 0xFFC4 16281>>(2.S+2) use jpeg_segment 16282 16283>0 beshort 0xFFE1 16284# Recursion handled by FFE0 16285#>>(2.S+2) use jpeg_segment 16286>>4 string Exif \b, Exif Standard: [ 16287>>>10 indirect/r x 16288>>>10 string x \b] 16289 16290# Application specific markers 16291>0 beshort&0xFFE0 =0xFFE0 16292>>(2.S+2) use jpeg_segment 16293 16294# DB: Define Quantization tables 16295# DD: Define Restart interval [XXX: wrong here, it is 4 bytes] 16296# D8: Start of image 16297# D9: End of image 16298# Dn: Restart 16299>0 beshort&0xFFD0 =0xFFD0 16300>>0 beshort&0xFFE0 !0xFFE0 16301>>>(2.S+2) use jpeg_segment 16302 16303#>0 beshort x unknown 0x%x 16304#>>(2.S+2) use jpeg_segment 16305 16306# HSI is Handmade Software's proprietary JPEG encoding scheme 163070 string hsi1 JPEG image data, HSI proprietary 16308 16309# From: David Santinoli <david@santinoli.com> 163100 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 16311# From: Johan van der Knijff <johan.vanderknijff@kb.nl> 16312# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes 16313# https://github.com/bitsgalore/jp2kMagic 16314# 16315# Now read value of 'Brand' field, which yields a few possibilities: 16316>20 string \x6a\x70\x32\x20 Part 1 (JP2) 16317!:mime image/jp2 16318>20 string \x6a\x70\x78\x20 Part 2 (JPX) 16319!:mime image/jpx 16320>20 string \x6a\x70\x6d\x20 Part 6 (JPM) 16321!:mime image/jpm 16322>20 string \x6d\x6a\x70\x32 Part 3 (MJ2) 16323!:mime video/mj2 16324 16325# Type: JPEG 2000 codesream 16326# From: Mathieu Malaterre <mathieu.malaterre@gmail.com> 163270 belong 0xff4fff51 JPEG 2000 codestream 1632845 beshort 0xff52 16329 16330# JPEG extended range 163310 string \x49\x49\xbc 16332>3 byte 1 16333>>4 lelong%2 0 JPEG-XR 16334!:mime image/jxr 16335!:ext jxr 16336 16337#------------------------------------------------------------------------------ 16338# $File: karma,v 1.8 2015/08/29 07:10:35 christos Exp $ 16339# karma: file(1) magic for Karma data files 16340# 16341# From <rgooch@atnf.csiro.au> 16342 163430 string KarmaRHD\040Version Karma Data Structure Version 16344>16 belong x %u 16345 16346#------------------------------------------------------------------------------ 16347# $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $ 16348# kde: file(1) magic for KDE 16349 163500 string/t [KDE\ Desktop\ Entry] KDE desktop entry 16351!:mime application/x-kdelnk 163520 string/t #\ KDE\ Config\ File KDE config file 16353!:mime application/x-kdelnk 163540 string/t #\ xmcd xmcd database file for kscd 16355!:mime text/x-xmcd 16356 16357#------------------------------------------------------------------------------ 16358# $File: keepass,v 1.1 2012/12/24 22:14:56 christos Exp $ 16359# keepass: file(1) magic for KeePass file 16360# 16361# Keepass Password Safe: 16362# * original one: http://keepass.info/ 16363# * *nix port: http://www.keepassx.org/ 16364# * android port: http://code.google.com/p/keepassdroid/ 16365 163660 lelong 0x9AA2D903 Keepass password database 16367>4 lelong 0xB54BFB65 1.x KDB 16368>>48 lelong >0 \b, %d groups 16369>>52 lelong >0 \b, %d entries 16370>>8 lelong&0x0f 1 \b, SHA-256 16371>>8 lelong&0x0f 2 \b, AES 16372>>8 lelong&0x0f 4 \b, RC4 16373>>8 lelong&0x0f 8 \b, Twofish 16374>>120 lelong >0 \b, %d key transformation rounds 16375>4 lelong 0xB54BFB67 2.x KDBX 16376 16377#------------------------------------------------------------------------------ 16378# $File: kerberos,v 1.2 2017/03/17 21:35:28 christos Exp $ 16379# kerberos: MIT kerberos file binary formats 16380# 16381 16382# This magic entry is for demonstration purposes and could be improved 16383# if the following features were implemented in file: 16384# 16385# Strings inside [[ .. ]] in the descriptions have special meanings and 16386# are not printed. 16387# 16388# - Provide some form of iteration in number of components 16389# [[${counter}=%d]] in the description 16390# then append 16391# [${counter}--] in the offset of the entries 16392# - Provide a way to round the next offset 16393# Add [R:4] after the offset? 16394# - Provide a way to have optional entries 16395# XXX: Syntax: 16396# - Provide a way to "save" entries to print them later. 16397# if the description is [[${name}=%s]], then nothing is 16398# printed and a subsequent entry in the same magic file 16399# can refer to ${name} 16400# - Provide a way to format strings as hex values 16401# 16402# http://www.gnu.org/software/shishi/manual/html_node/\ 16403# The-Keytab-Binary-File-Format.html 16404# 16405 164060 name keytab_entry 16407#>0 beshort x \b, size=%d 16408#>2 beshort x \b, components=%d 16409>4 pstring/H x \b, realm=%s 16410>>&0 pstring/H x \b, principal=%s/ 16411>>>&0 pstring/H x \b%s 16412>>>>&0 belong x \b, type=%d 16413>>>>>&0 bedate x \b, date=%s 16414>>>>>>&0 byte x \b, kvno=%u 16415#>>>>>>>&0 pstring/H x 16416#>>>>>>>>&0 belong x 16417#>>>>>>>>>>&0 use keytab_entry 16418 164190 belong 0x05020000 Kerberos Keytab file 16420>4 use keytab_entry 16421 16422#------------------------------------------------------------------------------ 16423# $File: kml,v 1.4 2017/03/17 21:35:28 christos Exp $ 16424# Type: Google KML, formerly Keyhole Markup Language 16425# Future development of this format has been handed 16426# over to the Open Geospatial Consortium. 16427# http://www.opengeospatial.org/standards/kml/ 16428# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 164290 string/t \<?xml 16430>20 search/400 \ xmlns= 16431>>&0 regex ['"]http://earth.google.com/kml Google KML document 16432!:mime application/vnd.google-earth.kml+xml 16433>>>&1 string 2.0' \b, version 2.0 16434>>>&1 string 2.1' \b, version 2.1 16435>>>&1 string 2.2' \b, version 2.2 16436 16437#------------------------------------------------------------------------------ 16438# Type: OpenGIS KML, formerly Keyhole Markup Language 16439# This standard is maintained by the 16440# Open Geospatial Consortium. 16441# http://www.opengeospatial.org/standards/kml/ 16442# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 16443>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document 16444!:mime application/vnd.google-earth.kml+xml 16445>>>&1 string/t 2.2 \b, version 2.2 16446 16447#------------------------------------------------------------------------------ 16448# Type: Google KML Archive (ZIP based) 16449# http://code.google.com/apis/kml/documentation/kml_tut.html 16450# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 164510 string PK\003\004 16452>4 byte 0x14 16453>>30 string doc.kml Compressed Google KML Document, including resources. 16454!:mime application/vnd.google-earth.kmz 16455 16456#------------------------------------------------------------------------------ 16457# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $ 16458# DEC SRC Virtual Paper: Lectern files 16459# Karl M. Hegbloom <karlheg@inetarena.com> 164600 string lect DEC SRC Virtual Paper Lectern file 16461 16462#------------------------------------------------------------------------------ 16463# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $ 16464# lex: file(1) magic for lex 16465# 16466# derived empirically, your offsets may vary! 164670 search/100 yyprevious C program text (from lex) 16468>3 search/1 >\0 for %s 16469# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com> 164700 search/100 generated\ by\ flex C program text (from flex) 16471# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com> 164720 search/1 %{ lex description text 16473 16474#------------------------------------------------------------------------------ 16475# $File: lif,v 1.8 2009/09/19 16:28:10 christos Exp $ 16476# lif: file(1) magic for lif 16477# 16478# (Daniel Quinlan <quinlan@yggdrasil.com>) 16479# 164800 beshort 0x8000 lif file 16481 16482#------------------------------------------------------------------------------ 16483# $File: linux,v 1.65 2018/07/16 12:32:08 christos Exp $ 16484# linux: file(1) magic for Linux files 16485# 16486# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> 16487# The following basic Linux magic is useful for reference, but using 16488# "long" magic is a better practice in order to avoid collisions. 16489# 16490# 2 leshort 100 Linux/i386 16491# >0 leshort 0407 impure executable (OMAGIC) 16492# >0 leshort 0410 pure executable (NMAGIC) 16493# >0 leshort 0413 demand-paged executable (ZMAGIC) 16494# >0 leshort 0314 demand-paged executable (QMAGIC) 16495# 164960 lelong 0x00640107 Linux/i386 impure executable (OMAGIC) 16497>16 lelong 0 \b, stripped 164980 lelong 0x00640108 Linux/i386 pure executable (NMAGIC) 16499>16 lelong 0 \b, stripped 165000 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC) 16501>16 lelong 0 \b, stripped 165020 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC) 16503>16 lelong 0 \b, stripped 16504# 165050 string \007\001\000 Linux/i386 object file 16506>20 lelong >0x1020 \b, DLL library 16507# Linux-8086 stuff: 165080 string \01\03\020\04 Linux-8086 impure executable 16509>28 long !0 not stripped 165100 string \01\03\040\04 Linux-8086 executable 16511>28 long !0 not stripped 16512# 165130 string \243\206\001\0 Linux-8086 object file 16514# 165150 string \01\03\020\20 Minix-386 impure executable 16516>28 long !0 not stripped 165170 string \01\03\040\20 Minix-386 executable 16518>28 long !0 not stripped 165190 string \01\03\04\20 Minix-386 NSYM/GNU executable 16520>28 long !0 not stripped 16521# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov> 16522216 lelong 0421 Linux/i386 core file 16523!:strength / 2 16524>220 string >\0 of '%s' 16525>200 lelong >0 (signal %d) 16526# 16527# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com> 16528# this can be overridden by the DOS executable (COM) entry 165292 string LILO Linux/i386 LILO boot/chain loader 16530# 16531# Linux make config build file, from Ole Aamot <oka@oka.no> 16532# Updated by Ken Sharp 1653328 string make\ config Linux make config build file (old) 1653449 search/70 Kernel\ Configuration Linux make config build file 16535 16536# 16537# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> 16538# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 16539# See: http://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html 165400 leshort 0x0436 Linux/i386 PC Screen Font v1 data, 16541>2 byte&0x01 0 256 characters, 16542>2 byte&0x01 !0 512 characters, 16543>2 byte&0x02 0 no directory, 16544>2 byte&0x02 !0 Unicode directory, 16545>3 byte >0 8x%d 165460 string \x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data, 16547>16 lelong x %d characters, 16548>12 lelong&0x01 0 no directory, 16549>12 lelong&0x01 !0 Unicode directory, 16550>24 lelong x %d 16551>28 lelong x \bx%d 16552 16553# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com> 165544086 string SWAP-SPACE Linux/i386 swap file 16555# From: Jeff Bailey <jbailey@ubuntu.com> 16556# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com> 165574076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image 16558# From: James Hunt <james.hunt@ubuntu.com> 165594076 string SWAPSPACE2LINHIB0001 Linux/i386 swap file (new style) (compressed hibernate) 16560# according to man page of mkswap (8) March 1999 16561# volume label and UUID Russell Coker 16562# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 165634086 string SWAPSPACE2 Linux/i386 swap file (new style), 16564>0x400 long x version %d (4K pages), 16565>0x404 long x size %d pages, 16566>1052 string \0 no label, 16567>1052 string >\0 LABEL=%s, 16568>0x40c belong x UUID=%08x 16569>0x410 beshort x \b-%04x 16570>0x412 beshort x \b-%04x 16571>0x414 beshort x \b-%04x 16572>0x416 belong x \b-%08x 16573>0x41a beshort x \b%04x 16574# From Daniel Novotny <dnovotny@redhat.com> 16575# swap file for PowerPC 1657665526 string SWAPSPACE2 Linux/ppc swap file 16577>0x400 long x version %d, 16578>0x404 long x size %d pages, 16579>1052 string \0 no label, 16580>1052 string >\0 LABEL=%s, 16581>0x40c belong x UUID=%08x 16582>0x410 beshort x \b-%04x 16583>0x412 beshort x \b-%04x 16584>0x414 beshort x \b-%04x 16585>0x416 belong x \b-%08x 16586>0x41a beshort x \b%04x 1658716374 string SWAPSPACE2 Linux/ia64 swap file 16588# 16589# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu> 16590# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de> 16591# and Nicolas Lichtmaier <nick@debian.org> 16592# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 16593# Linux kernel boot images (i386 arch) (Wolfram Kleff) 16594514 string HdrS Linux kernel 16595!:strength + 55 16596>510 leshort 0xAA55 x86 boot executable 16597>>518 leshort >0x1ff 16598>>>529 byte 0 zImage, 16599>>>529 byte 1 bzImage, 16600>>>526 lelong >0 16601>>>>(526.s+0x200) string >\0 version %s, 16602>>498 leshort 1 RO-rootFS, 16603>>498 leshort 0 RW-rootFS, 16604>>508 leshort >0 root_dev 0x%X, 16605>>502 leshort >0 swap_dev 0x%X, 16606>>504 leshort >0 RAMdisksize %u KB, 16607>>506 leshort 0xFFFF Normal VGA 16608>>506 leshort 0xFFFE Extended VGA 16609>>506 leshort 0xFFFD Prompt for Videomode 16610>>506 leshort >0 Video mode %d 16611# This also matches new kernels, which were caught above by "HdrS". 166120 belong 0xb8c0078e Linux kernel 16613>0x1e3 string Loading version 1.3.79 or older 16614>0x1e9 string Loading from prehistoric times 16615 16616# System.map files - Nicolas Lichtmaier <nick@debian.org> 166178 search/1 \ A\ _text Linux kernel symbol map text 16618 16619# LSM entries - Nicolas Lichtmaier <nick@debian.org> 166200 search/1 Begin3 Linux Software Map entry text 166210 search/1 Begin4 Linux Software Map entry text (new format) 16622 16623# From Matt Zimmerman, enhanced for v3 by Matthew Palmer 166240 belong 0x4f4f4f4d User-mode Linux COW file 16625>4 belong <3 \b, version %d 16626>>8 string >\0 \b, backing file %s 16627>4 belong >2 \b, version %d 16628>>32 string >\0 \b, backing file %s 16629 16630############################################################################ 16631# Linux kernel versions 16632 166330 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux 16634>497 leshort 0 x86 boot sector 16635>>514 belong 0x8e of a kernel from the dawn of time! 16636>>514 belong 0x908ed8b4 version 0.99-1.1.42 16637>>514 belong 0x908ed8b8 for memtest86 16638 16639>497 leshort !0 x86 kernel 16640>>504 leshort >0 RAMdisksize=%u KB 16641>>502 leshort >0 swap=0x%X 16642>>508 leshort >0 root=0x%X 16643>>>498 leshort 1 \b-ro 16644>>>498 leshort 0 \b-rw 16645>>506 leshort 0xFFFF vga=normal 16646>>506 leshort 0xFFFE vga=extended 16647>>506 leshort 0xFFFD vga=ask 16648>>506 leshort >0 vga=%d 16649>>514 belong 0x908ed881 version 1.1.43-1.1.45 16650>>514 belong 0x15b281cd 16651>>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0 16652>>>0xa99 belong 0x55AA5a5a version 1.3.1,2 16653>>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30 16654>>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41 16655>>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45 16656>>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72 16657>>514 string HdrS 16658>>>518 leshort >0x1FF 16659>>>>529 byte 0 \b, zImage 16660>>>>529 byte 1 \b, bzImage 16661>>>>(526.s+0x200) string >\0 \b, version %s 16662 16663# Linux boot sector thefts. 166640 belong 0xb8c0078e Linux 16665>0x1e6 belong 0x454c4b53 ELKS Kernel 16666>0x1e6 belong !0x454c4b53 style boot sector 16667 16668############################################################################ 16669# Linux S390 kernel image 16670# Created by: Jan Kaluza <jkaluza@redhat.com> 166718 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390 16672>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc 16673# 64bit 16674>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel 16675>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel 16676>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel 16677>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel 16678# 32bit 16679>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel 16680>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel 16681>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel 16682>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel 16683 16684# Linux ARM compressed kernel image 16685# From: Kevin Cernekee <cernekee@gmail.com> 1668636 lelong 0x016f2818 Linux kernel ARM boot executable zImage (little-endian) 1668736 belong 0x016f2818 Linux kernel ARM boot executable zImage (big-endian) 16688 16689############################################################################ 16690# Linux 8086 executable 166910 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless 16692>5 string . 16693>>4 string >\0 \b, libc version %s 16694 166950 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable 16696>2 byte&0x01 !0 \b, unmapped zero page 16697>2 byte&0x20 0 \b, impure 16698>2 byte&0x20 !0 16699>>2 byte&0x10 !0 \b, A_EXEC 16700>2 byte&0x02 !0 \b, A_PAL 16701>2 byte&0x04 !0 \b, A_NSYM 16702>2 byte&0x08 !0 \b, A_STAND 16703>2 byte&0x40 !0 \b, A_PURE 16704>2 byte&0x80 !0 \b, A_TOVLY 16705>28 long !0 \b, not stripped 16706>37 string . 16707>>36 string >\0 \b, libc version %s 16708 16709# 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable 16710# 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable 16711# 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable 16712# 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable 16713 16714# SYSLINUX boot logo files (from 'ppmtolss16' sources) 16715# http://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename: 16716# file extension .lss .16 167170 lelong =0x1413f33d SYSLINUX' LSS16 image data 16718# syslinux-4.05/mime/image/x-lss16.xml 16719!:mime image/x-lss16 16720>4 leshort x \b, width %d 16721>6 leshort x \b, height %d 16722 167230 string OOOM User-Mode-Linux's Copy-On-Write disk image 16724>4 belong x version %d 16725 16726# SE Linux policy database 16727# From: Mike Frysinger <vapier@gentoo.org> 167280 lelong 0xf97cff8c SE Linux policy 16729>16 lelong x v%d 16730>20 lelong 1 MLS 16731>24 lelong x %d symbols 16732>28 lelong x %d ocons 16733 16734# Linux Logical Volume Manager (LVM) 16735# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net> 16736# 16737# System ID, UUID and volume group name are 128 bytes long 16738# but they should never be full and initialized with zeros... 16739# 16740# LVM1 16741# 167420x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1 16743>0x12c string >\0 , System ID: %s 16744 167450x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2 16746>0x12c string >\0 , System ID: %s 16747 16748# LVM2 16749# 16750# It seems that the label header can be in one the four first sector 16751# of the disk... (from _find_labeller in lib/label/label.c of LVM2) 16752# 16753# 0x200 seems to be the common case 16754 167550x218 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 16756# read the offset to add to the start of the header, and the header 16757# start in 0x200 16758>&(&-12.l-0x21) byte x 16759# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 16760>>&0x0 string >\x2f \b, UUID: %.6s 16761>>&0x6 string >\x2f \b-%.4s 16762>>&0xa string >\x2f \b-%.4s 16763>>&0xe string >\x2f \b-%.4s 16764>>&0x12 string >\x2f \b-%.4s 16765>>&0x16 string >\x2f \b-%.4s 16766>>&0x1a string >\x2f \b-%.6s 16767>>&0x20 lequad x \b, size: %lld 16768 167690x018 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 16770>&(&-12.l-0x21) byte x 16771# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 16772>>&0x0 string >\x2f \b, UUID: %.6s 16773>>&0x6 string >\x2f \b-%.4s 16774>>&0xa string >\x2f \b-%.4s 16775>>&0xe string >\x2f \b-%.4s 16776>>&0x12 string >\x2f \b-%.4s 16777>>&0x16 string >\x2f \b-%.4s 16778>>&0x1a string >\x2f \b-%.6s 16779>>&0x20 lequad x \b, size: %lld 16780 167810x418 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 16782>&(&-12.l-0x21) byte x 16783# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 16784>>&0x0 string >\x2f \b, UUID: %.6s 16785>>&0x6 string >\x2f \b-%.4s 16786>>&0xa string >\x2f \b-%.4s 16787>>&0xe string >\x2f \b-%.4s 16788>>&0x12 string >\x2f \b-%.4s 16789>>&0x16 string >\x2f \b-%.4s 16790>>&0x1a string >\x2f \b-%.6s 16791>>&0x20 lequad x \b, size: %lld 16792 167930x618 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 16794>&(&-12.l-0x21) byte x 16795# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 16796>>&0x0 string >\x2f \b, UUID: %.6s 16797>>&0x6 string >\x2f \b-%.4s 16798>>&0xa string >\x2f \b-%.4s 16799>>&0xe string >\x2f \b-%.4s 16800>>&0x12 string >\x2f \b-%.4s 16801>>&0x16 string >\x2f \b-%.4s 16802>>&0x1a string >\x2f \b-%.6s 16803>>&0x20 lequad x \b, size: %lld 16804 16805# LVM snapshot 16806# from Jason Farrel 168070 string SnAp LVM Snapshot (CopyOnWrite store) 16808>4 lelong !0 - valid, 16809>4 lelong 0 - invalid, 16810>8 lelong x version %d, 16811>12 lelong x chunk_size %d 16812 16813# SE Linux policy database 168140 lelong 0xf97cff8c SE Linux policy 16815>16 lelong x v%d 16816>20 lelong 1 MLS 16817>24 lelong x %d symbols 16818>28 lelong x %d ocons 16819 16820# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec 16821# Anthon van der Neut (anthon@mnt.org) 168220 string LUKS\xba\xbe LUKS encrypted file, 16823>6 beshort x ver %d 16824>8 string x [%s, 16825>40 string x %s, 16826>72 string x %s] 16827>168 string x UUID: %s 16828 16829 16830# Summary: Xen saved domain file 16831# Created by: Radek Vokal <rvokal@redhat.com> 168320 string LinuxGuestRecord Xen saved domain 16833>20 search/256 (name 16834>>&1 string x (name %s) 16835 16836# Type: Xen, the virtual machine monitor 16837# From: Radek Vokal <rvokal@redhat.com> 168380 string LinuxGuestRecord Xen saved domain 16839#>2 regex \(name\ [^)]*\) %s 16840>20 search/256 (name (name 16841>>&1 string x %s...) 16842 16843# Systemd journald files 16844# See http://www.freedesktop.org/wiki/Software/systemd/journal-files/. 16845# From: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> 16846 16847# check magic 168480 string LPKSHHRH 16849# check that state is one of known values 16850>16 ubyte&252 0 16851# check that each half of three unique id128s is non-zero 16852>>24 ubequad >0 16853>>>32 ubequad >0 16854>>>>40 ubequad >0 16855>>>>>48 ubequad >0 16856>>>>>>56 ubequad >0 16857>>>>>>>64 ubequad >0 Journal file 16858!:mime application/octet-stream 16859# provide more info 16860>>>>>>>>184 leqdate 0 empty 16861>>>>>>>>16 ubyte 0 \b, offline 16862>>>>>>>>16 ubyte 1 \b, online 16863>>>>>>>>16 ubyte 2 \b, archived 16864>>>>>>>>8 ulelong&1 1 \b, sealed 16865>>>>>>>>12 ulelong&1 1 \b, compressed 16866 16867# BCache backing and cache devices 16868# From: Gabriel de Perthuis <g2p.code@gmail.com> 168690x1008 lequad 8 16870>0x1018 string \xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81 BCache 16871>>0x1010 ulequad 0 cache device 16872>>0x1010 ulequad 1 backing device 16873>>0x1010 ulequad 3 cache device 16874>>0x1010 ulequad 4 backing device 16875>>0x1048 string >0 \b, label "%.32s" 16876>>0x1028 ubelong x \b, uuid %08x 16877>>0x102c ubeshort x \b-%04x 16878>>0x102e ubeshort x \b-%04x 16879>>0x1030 ubeshort x \b-%04x 16880>>0x1032 ubelong x \b-%08x 16881>>0x1036 ubeshort x \b%04x 16882>>0x1038 ubelong x \b, set uuid %08x 16883>>0x103c ubeshort x \b-%04x 16884>>0x103e ubeshort x \b-%04x 16885>>0x1040 ubeshort x \b-%04x 16886>>0x1042 ubelong x \b-%08x 16887>>0x1046 ubeshort x \b%04x 16888 16889# Linux device tree: 16890# File format description can be found in the Linux kernel sources at 16891# Documentation/devicetree/booting-without-of.txt 16892# From Christoph Biedl 168930 belong 0xd00dfeed 16894# structure and strings must be within blob 16895>&(8.L) byte x 16896>>&(12.L) byte x 16897>>>20 belong >1 Device Tree Blob version %d 16898>>>>4 belong x \b, size=%d 16899>>>>20 belong >1 16900>>>>>28 belong x \b, boot CPU=%d 16901>>>>20 belong >2 16902>>>>>32 belong x \b, string block size=%d 16903>>>>20 belong >16 16904>>>>>36 belong x \b, DT structure block size=%d 16905 16906# glibc locale archive as defined in glibc locale/locarchive.h 169070 lelong 0xde020109 locale archive 16908>24 lelong x %d strings 16909 16910# Linux Software RAID (mdadm) 16911# Russell Coker <russell@coker.com.au> 169120 name linuxraid 16913>16 belong x UUID=%8x: 16914>20 belong x \b%8x: 16915>24 belong x \b%8x: 16916>28 belong x \b%8x 16917>32 string x name=%s 16918>72 lelong x level=%d 16919>92 lelong x disks=%d 16920 169214096 lelong 0xa92b4efc Linux Software RAID 16922>4100 lelong x version 1.2 (%d) 16923>4096 use linuxraid 16924 169250 lelong 0xa92b4efc Linux Software RAID 16926>4 lelong x version 1.1 (%d) 16927>0 use linuxraid 16928 16929# Summary: Database file for mlocate 16930# Description: A database file as used by mlocate, a fast implementation 16931# of locate/updatedb. It uses merging to reuse the existing 16932# database and avoid rereading most of the filesystem. It's 16933# the default version of locate on Arch Linux (and others). 16934# File path: /var/lib/mlocate/mlocate.db by default (but configurable) 16935# Site: https://fedorahosted.org/mlocate/ 16936# Format docs: http://linux.die.net/man/5/mlocate.db 16937# Type: mlocate database file 16938# URL: https://fedorahosted.org/mlocate/ 16939# From: Wander Nauta <info@wandernauta.nl> 169400 string \0mlocate mlocate database 16941>12 byte x \b, version %d 16942>13 byte 1 \b, require visibility 16943>16 string x \b, root %s 16944 16945# Dump files for iproute2 tool. Generated by the "ip r|a save" command. URL: 16946# https://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2 16947# From: Pavel Emelyanov <xemul@parallels.com> 169480 lelong 0x45311224 iproute2 routes dump 169490 lelong 0x47361222 iproute2 addresses dump 16950 16951# Image and service files for CRIU tool. 16952# URL: http://criu.org 16953# From: Pavel Emelyanov <xemul@parallels.com> 169540 lelong 0x54564319 CRIU image file v1.1 169550 lelong 0x55105940 CRIU service file 169560 lelong 0x58313116 CRIU inventory 16957 16958# Kdump compressed dump files 16959# http://sourceforge.net/p/makedumpfile/code/ci/master/tree/IMPLEMENTATION 16960 169610 string KDUMP Kdump compressed dump 16962>8 long x v%d 16963>12 string >\0 \b, system %s 16964>77 string >\0 \b, node %s 16965>142 string >\0 \b, release %s 16966>207 string >\0 \b, version %s 16967>272 string >\0 \b, machine %s 16968>337 string >\0 \b, domain %s 16969 16970#------------------------------------------------------------------------------ 16971# $File: lisp,v 1.25 2017/03/17 21:35:28 christos Exp $ 16972# lisp: file(1) magic for lisp programs 16973# 16974# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) 16975 16976# updated by Joerg Jenderek 16977# GRR: This lot is too weak 16978#0 string ;; 16979# windows INF files often begin with semicolon and use CRLF as line end 16980# lisp files are mainly created on unix system with LF as line end 16981#>2 search/4096 !\r Lisp/Scheme program text 16982#>2 search/4096 \r Windows INF file 16983 169840 search/4096 (setq\ Lisp/Scheme program text 16985!:mime text/x-lisp 169860 search/4096 (defvar\ Lisp/Scheme program text 16987!:mime text/x-lisp 169880 search/4096 (defparam\ Lisp/Scheme program text 16989!:mime text/x-lisp 169900 search/4096 (defun\ Lisp/Scheme program text 16991!:mime text/x-lisp 169920 search/4096 (autoload\ Lisp/Scheme program text 16993!:mime text/x-lisp 169940 search/4096 (custom-set-variables\ Lisp/Scheme program text 16995!:mime text/x-lisp 16996 16997# URL: https://en.wikipedia.org/wiki/Emacs_Lisp 16998# Reference: http://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz 16999# Update: Joerg Jenderek 17000# Emacs 18 - this is always correct, but not very magical. 170010 string \012( 17002# look for emacs lisp keywords 17003# GRR: split regex because it is too long or get error like 17004# lisp, 36: Warning: cannot get string from `^(defun|defvar|defconst|defmacro|setq|fset|put|provide|require|' 17005>&0 regex \^(defun|defvar|defconst|defmacro|setq|fset) Emacs v18 byte-compiled Lisp data 17006!:mime application/x-elc 17007# https://searchcode.com/codesearch/view/2173420/ 17008# not really pure text 17009!:apple EMAxTEXT 17010!:ext elc 17011# remaining regex 17012>&0 regex \^(put|provide|require|random) Emacs v18 byte-compiled Lisp data 17013!:mime application/x-elc 17014!:apple EMAxTEXT 17015!:ext elc 17016# missed cl.elc dbx.elc simple.elc look like normal lisp starting with ;;; 17017 17018# Emacs 19+ - ver. recognition added by Ian Springer 17019# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs 17020# - Chris Chittleborough <cchittleborough@yahoo.com.au> 17021# Update: Joerg Jenderek 170220 string ;ELC 17023# version\0\0\0 17024>4 byte >18 Emacs/XEmacs v%d byte-compiled Lisp data 17025# why less than 32 ? does not make sense to me. GNU Emacs version is 24.5 at April 2015 17026#>4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data 17027!:mime application/x-elc 17028!:apple EMAxTEXT 17029!:ext elc 17030 17031# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr> 170320 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27) 170330 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text 17034 170350 long 0x70768BD2 CLISP memory image data 170360 long 0xD28B7670 CLISP memory image data, other endian 17037 17038#.com and .bin for MIT scheme 170390 string \372\372\372\372 MIT scheme (library?) 17040 17041# From: David Allouche <david@allouche.net> 170420 search/1 \<TeXmacs| TeXmacs document text 17043!:mime text/texmacs 17044 17045#------------------------------------------------------------------------------ 17046# $File: llvm,v 1.8 2013/01/12 03:09:51 christos Exp $ 17047# llvm: file(1) magic for LLVM byte-codes 17048# URL: http://llvm.org/docs/BitCodeFormat.html 17049# From: Al Stone <ahs3@fc.hp.com> 17050 170510 string llvm LLVM byte-codes, uncompressed 170520 string llvc0 LLVM byte-codes, null compression 170530 string llvc1 LLVM byte-codes, gzip compression 170540 string llvc2 LLVM byte-codes, bzip2 compression 17055 170560 lelong 0x0b17c0de LLVM bitcode, wrapper 17057# Are these Mach-O ABI values? They appear to be. 17058>16 lelong 0x01000007 x86_64 17059>16 lelong 0x00000007 i386 17060>16 lelong 0x00000012 ppc 17061>16 lelong 0x01000012 ppc64 17062>16 lelong 0x0000000c arm 17063 170640 string BC\xc0\xde LLVM IR bitcode 17065 17066#------------------------------------------------------------------------------ 17067# $File: lua,v 1.6 2013/01/09 16:23:17 christos Exp $ 17068# lua: file(1) magic for Lua scripting language 17069# URL: http://www.lua.org/ 17070# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 17071 17072# Lua scripts 170730 search/1/w #!\ /usr/bin/lua Lua script text executable 17074!:mime text/x-lua 170750 search/1/w #!\ /usr/local/bin/lua Lua script text executable 17076!:mime text/x-lua 170770 search/1 #!/usr/bin/env\ lua Lua script text executable 17078!:mime text/x-lua 170790 search/1 #!\ /usr/bin/env\ lua Lua script text executable 17080!:mime text/x-lua 17081 17082# Lua bytecode 170830 string \033Lua Lua bytecode, 17084>4 byte 0x50 version 5.0 17085>4 byte 0x51 version 5.1 17086>4 byte 0x52 version 5.2 17087 17088#------------------------------------------------------------------------------ 17089# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $ 17090# luks: file(1) magic for Linux Unified Key Setup 17091# URL: http://luks.endorphin.org/spec 17092# From: Anthon van der Neut <anthon@mnt.org> 17093 170940 string LUKS\xba\xbe LUKS encrypted file, 17095>6 beshort x ver %d 17096>8 string x [%s, 17097>40 string x %s, 17098>72 string x %s] 17099>168 string x UUID: %s 17100#------------------------------------------------------------------------------ 17101# $File: m4,v 1.2 2017/08/14 07:40:38 christos Exp $ 17102# make: file(1) magic for M4 scripts 17103# 171040 regex \^dnl\ M4 macro processor script text 17105!:mime text/x-m4 171060 regex \^AC_DEFUN\\(\\[ M4 macro processor script text 17107!:strength + 15 17108!:mime text/x-m4 17109 17110#------------------------------------------------------------ 17111# $File: mach,v 1.23 2015/10/15 21:51:22 christos Exp $ 17112# Mach has two magic numbers, 0xcafebabe and 0xfeedface. 17113# Unfortunately the first, cafebabe, is shared with 17114# Java ByteCode, so they are both handled in the file "cafebabe". 17115# The "feedface" ones are handled herein. 17116#------------------------------------------------------------ 17117# if set, it's for the 64-bit version of the architecture 17118# yes, this is separate from the low-order magic number bit 17119# it's also separate from the "64-bit libraries" bit in the 17120# upper 8 bits of the CPU subtype 17121 171220 name mach-o-cpu 17123>0 belong&0x01000000 0 17124# 17125# 32-bit ABIs. 17126# 17127# 1 vax 17128>>0 belong&0x00ffffff 1 17129>>>4 belong&0x00ffffff 0 vax 17130>>>4 belong&0x00ffffff 1 vax11/780 17131>>>4 belong&0x00ffffff 2 vax11/785 17132>>>4 belong&0x00ffffff 3 vax11/750 17133>>>4 belong&0x00ffffff 4 vax11/730 17134>>>4 belong&0x00ffffff 5 uvaxI 17135>>>4 belong&0x00ffffff 6 uvaxII 17136>>>4 belong&0x00ffffff 7 vax8200 17137>>>4 belong&0x00ffffff 8 vax8500 17138>>>4 belong&0x00ffffff 9 vax8600 17139>>>4 belong&0x00ffffff 10 vax8650 17140>>>4 belong&0x00ffffff 11 vax8800 17141>>>4 belong&0x00ffffff 12 uvaxIII 17142>>>4 belong&0x00ffffff >12 vax subarchitecture=%d 17143>>0 belong&0x00ffffff 2 romp 17144>>0 belong&0x00ffffff 3 architecture=3 17145>>0 belong&0x00ffffff 4 ns32032 17146>>0 belong&0x00ffffff 5 ns32332 17147>>0 belong&0x00ffffff 6 m68k 17148# 7 x86 17149>>0 belong&0x00ffffff 7 17150>>>4 belong&0x0000000f 3 i386 17151>>>4 belong&0x0000000f 4 i486 17152>>>>4 belong&0x00fffff0 0 17153>>>>4 belong&0x00fffff0 0x80 \bsx 17154>>>4 belong&0x0000000f 5 i586 17155>>>4 belong&0x0000000f 6 17156>>>>4 belong&0x00fffff0 0 p6 17157>>>>4 belong&0x00fffff0 0x10 pentium_pro 17158>>>>4 belong&0x00fffff0 0x20 pentium_2_m0x20 17159>>>>4 belong&0x00fffff0 0x30 pentium_2_m3 17160>>>>4 belong&0x00fffff0 0x40 pentium_2_m0x40 17161>>>>4 belong&0x00fffff0 0x50 pentium_2_m5 17162>>>>4 belong&0x00fffff0 >0x50 pentium_2_m0x%x 17163>>>4 belong&0x0000000f 7 celeron 17164>>>>4 belong&0x00fffff0 0x00 \b_m0x%x 17165>>>>4 belong&0x00fffff0 0x10 \b_m0x%x 17166>>>>4 belong&0x00fffff0 0x20 \b_m0x%x 17167>>>>4 belong&0x00fffff0 0x30 \b_m0x%x 17168>>>>4 belong&0x00fffff0 0x40 \b_m0x%x 17169>>>>4 belong&0x00fffff0 0x50 \b_m0x%x 17170>>>>4 belong&0x00fffff0 0x60 17171>>>>4 belong&0x00fffff0 0x70 \b_mobile 17172>>>>4 belong&0x00fffff0 >0x70 \b_m0x%x 17173>>>4 belong&0x0000000f 8 pentium_3 17174>>>>4 belong&0x00fffff0 0x00 17175>>>>4 belong&0x00fffff0 0x10 \b_m 17176>>>>4 belong&0x00fffff0 0x20 \b_xeon 17177>>>>4 belong&0x00fffff0 >0x20 \b_m0x%x 17178>>>4 belong&0x0000000f 9 pentiumM 17179>>>>4 belong&0x00fffff0 0x00 17180>>>>4 belong&0x00fffff0 >0x00 \b_m0x%x 17181>>>4 belong&0x0000000f 10 pentium_4 17182>>>>4 belong&0x00fffff0 0x00 17183>>>>4 belong&0x00fffff0 0x10 \b_m 17184>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 17185>>>4 belong&0x0000000f 11 itanium 17186>>>>4 belong&0x00fffff0 0x00 17187>>>>4 belong&0x00fffff0 0x10 \b_2 17188>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 17189>>>4 belong&0x0000000f 12 xeon 17190>>>>4 belong&0x00fffff0 0x00 17191>>>>4 belong&0x00fffff0 0x10 \b_mp 17192>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 17193>>>4 belong&0x0000000f >12 ia32 family=%d 17194>>>>4 belong&0x00fffff0 0x00 17195>>>>4 belong&0x00fffff0 >0x00 model=%x 17196>>0 belong&0x00ffffff 8 mips 17197>>>4 belong&0x00ffffff 1 R2300 17198>>>4 belong&0x00ffffff 2 R2600 17199>>>4 belong&0x00ffffff 3 R2800 17200>>>4 belong&0x00ffffff 4 R2000a 17201>>>4 belong&0x00ffffff 5 R2000 17202>>>4 belong&0x00ffffff 6 R3000a 17203>>>4 belong&0x00ffffff 7 R3000 17204>>>4 belong&0x00ffffff >7 subarchitecture=%d 17205>>0 belong&0x00ffffff 9 ns32532 17206>>0 belong&0x00ffffff 10 mc98000 17207>>0 belong&0x00ffffff 11 hppa 17208>>>4 belong&0x00ffffff 0 7100 17209>>>4 belong&0x00ffffff 1 7100LC 17210>>>4 belong&0x00ffffff >1 subarchitecture=%d 17211>>0 belong&0x00ffffff 12 arm 17212>>>4 belong&0x00ffffff 0 17213>>>4 belong&0x00ffffff 1 subarchitecture=%d 17214>>>4 belong&0x00ffffff 2 subarchitecture=%d 17215>>>4 belong&0x00ffffff 3 subarchitecture=%d 17216>>>4 belong&0x00ffffff 4 subarchitecture=%d 17217>>>4 belong&0x00ffffff 5 \bv4t 17218>>>4 belong&0x00ffffff 6 \bv6 17219>>>4 belong&0x00ffffff 7 \bv5tej 17220>>>4 belong&0x00ffffff 8 \bxscale 17221>>>4 belong&0x00ffffff 9 \bv7 17222>>>4 belong&0x00ffffff 10 \bv7f 17223>>>4 belong&0x00ffffff 11 \bv7s 17224>>>4 belong&0x00ffffff 12 \bv7k 17225>>>4 belong&0x00ffffff 13 \bv8 17226>>>4 belong&0x00ffffff 14 \bv6m 17227>>>4 belong&0x00ffffff 15 \bv7m 17228>>>4 belong&0x00ffffff 16 \bv7em 17229>>>4 belong&0x00ffffff >16 subarchitecture=%d 17230# 13 m88k 17231>>0 belong&0x00ffffff 13 17232>>>4 belong&0x00ffffff 0 mc88000 17233>>>4 belong&0x00ffffff 1 mc88100 17234>>>4 belong&0x00ffffff 2 mc88110 17235>>>4 belong&0x00ffffff >2 mc88000 subarchitecture=%d 17236>>0 belong&0x00ffffff 14 SPARC 17237>>0 belong&0x00ffffff 15 i860g 17238>>0 belong&0x00ffffff 16 alpha 17239>>0 belong&0x00ffffff 17 rs6000 17240>>0 belong&0x00ffffff 18 ppc 17241>>>4 belong&0x00ffffff 0 17242>>>4 belong&0x00ffffff 1 \b_601 17243>>>4 belong&0x00ffffff 2 \b_602 17244>>>4 belong&0x00ffffff 3 \b_603 17245>>>4 belong&0x00ffffff 4 \b_603e 17246>>>4 belong&0x00ffffff 5 \b_603ev 17247>>>4 belong&0x00ffffff 6 \b_604 17248>>>4 belong&0x00ffffff 7 \b_604e 17249>>>4 belong&0x00ffffff 8 \b_620 17250>>>4 belong&0x00ffffff 9 \b_650 17251>>>4 belong&0x00ffffff 10 \b_7400 17252>>>4 belong&0x00ffffff 11 \b_7450 17253>>>4 belong&0x00ffffff 100 \b_970 17254>>>4 belong&0x00ffffff >100 subarchitecture=%d 17255>>0 belong&0x00ffffff >18 architecture=%d 17256>0 belong&0x01000000 0x01000000 17257# 17258# 64-bit ABIs. 17259# 17260>>0 belong&0x00ffffff 0 64-bit architecture=%d 17261>>0 belong&0x00ffffff 1 64-bit architecture=%d 17262>>0 belong&0x00ffffff 2 64-bit architecture=%d 17263>>0 belong&0x00ffffff 3 64-bit architecture=%d 17264>>0 belong&0x00ffffff 4 64-bit architecture=%d 17265>>0 belong&0x00ffffff 5 64-bit architecture=%d 17266>>0 belong&0x00ffffff 6 64-bit architecture=%d 17267>>0 belong&0x00ffffff 7 x86_64 17268>>>4 belong&0x00ffffff 0 subarchitecture=%d 17269>>>4 belong&0x00ffffff 1 subarchitecture=%d 17270>>>4 belong&0x00ffffff 2 subarchitecture=%d 17271>>>4 belong&0x00ffffff 3 17272>>>4 belong&0x00ffffff 4 \b_arch1 17273>>>4 belong&0x00ffffff 8 \b_haswell 17274>>>4 belong&0x00ffffff >4 subarchitecture=%d 17275>>0 belong&0x00ffffff 8 64-bit architecture=%d 17276>>0 belong&0x00ffffff 9 64-bit architecture=%d 17277>>0 belong&0x00ffffff 10 64-bit architecture=%d 17278>>0 belong&0x00ffffff 11 64-bit architecture=%d 17279>>0 belong&0x00ffffff 12 arm64 17280>>>4 belong&0x00ffffff 0 17281>>>4 belong&0x00ffffff 1 \bv8 17282>>0 belong&0x00ffffff 13 64-bit architecture=%d 17283>>0 belong&0x00ffffff 14 64-bit architecture=%d 17284>>0 belong&0x00ffffff 15 64-bit architecture=%d 17285>>0 belong&0x00ffffff 16 64-bit architecture=%d 17286>>0 belong&0x00ffffff 17 64-bit architecture=%d 17287>>0 belong&0x00ffffff 18 ppc64 17288>>>4 belong&0x00ffffff 0 17289>>>4 belong&0x00ffffff 1 \b_601 17290>>>4 belong&0x00ffffff 2 \b_602 17291>>>4 belong&0x00ffffff 3 \b_603 17292>>>4 belong&0x00ffffff 4 \b_603e 17293>>>4 belong&0x00ffffff 5 \b_603ev 17294>>>4 belong&0x00ffffff 6 \b_604 17295>>>4 belong&0x00ffffff 7 \b_604e 17296>>>4 belong&0x00ffffff 8 \b_620 17297>>>4 belong&0x00ffffff 9 \b_650 17298>>>4 belong&0x00ffffff 10 \b_7400 17299>>>4 belong&0x00ffffff 11 \b_7450 17300>>>4 belong&0x00ffffff 100 \b_970 17301>>>4 belong&0x00ffffff >100 subarchitecture=%d 17302>>0 belong&0x00ffffff >18 64-bit architecture=%d 17303 17304 173050 name mach-o-be 17306>0 byte 0xcf 64-bit 17307>4 use mach-o-cpu 17308>12 belong 1 object 17309>12 belong 2 executable 17310>12 belong 3 fixed virtual memory shared library 17311>12 belong 4 core 17312>12 belong 5 preload executable 17313>12 belong 6 dynamically linked shared library 17314>12 belong 7 dynamic linker 17315>12 belong 8 bundle 17316>12 belong 9 dynamically linked shared library stub 17317>12 belong 10 dSYM companion file 17318>12 belong 11 kext bundle 17319>12 belong >11 17320>>12 belong x filetype=%d 17321>24 belong >0 \b, flags:< 17322>>24 belong &0x0000001 \bNOUNDEFS 17323>>24 belong &0x0000002 \b|INCRLINK 17324>>24 belong &0x0000004 \b|DYLDLINK 17325>>24 belong &0x0000008 \b|BINDATLOAD 17326>>24 belong &0x0000010 \b|PREBOUND 17327>>24 belong &0x0000020 \b|SPLIT_SEGS 17328>>24 belong &0x0000040 \b|LAZY_INIT 17329>>24 belong &0x0000080 \b|TWOLEVEL 17330>>24 belong &0x0000100 \b|FORCE_FLAT 17331>>24 belong &0x0000200 \b|NOMULTIDEFS 17332>>24 belong &0x0000400 \b|NOFIXPREBINDING 17333>>24 belong &0x0000800 \b|PREBINDABLE 17334>>24 belong &0x0001000 \b|ALLMODSBOUND 17335>>24 belong &0x0002000 \b|SUBSECTIONS_VIA_SYMBOLS 17336>>24 belong &0x0004000 \b|CANONICAL 17337>>24 belong &0x0008000 \b|WEAK_DEFINES 17338>>24 belong &0x0010000 \b|BINDS_TO_WEAK 17339>>24 belong &0x0020000 \b|ALLOW_STACK_EXECUTION 17340>>24 belong &0x0040000 \b|ROOT_SAFE 17341>>24 belong &0x0080000 \b|SETUID_SAFE 17342>>24 belong &0x0100000 \b|NO_REEXPORTED_DYLIBS 17343>>24 belong &0x0200000 \b|PIE 17344>>24 belong &0x0400000 \b|DEAD_STRIPPABLE_DYLIB 17345>>24 belong &0x0800000 \b|HAS_TLV_DESCRIPTORS 17346>>24 belong &0x1000000 \b|NO_HEAP_EXECUTION 17347>>24 belong &0x2000000 \b|APP_EXTENSION_SAFE 17348>>24 belong x \b> 17349 17350# 173510 lelong&0xfffffffe 0xfeedface Mach-O 17352!:strength +1 17353!:mime application/x-mach-binary 17354>0 use \^mach-o-be 17355 173560 belong&0xfffffffe 0xfeedface Mach-O 17357!:strength +1 17358!:mime application/x-mach-binary 17359>0 use mach-o-be 17360 17361#------------------------------------------------------------------------------ 17362# $File: macintosh,v 1.28 2017/12/05 02:17:48 christos Exp $ 17363# macintosh description 17364# 17365# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 17366# Daniel Quinlan, quinlan@yggdrasil.com 1736711 string must\ be\ converted\ with\ BinHex BinHex binary text 17368!:mime application/mac-binhex40 17369>41 string x \b, version %.3s 17370 17371# Stuffit archives are the de facto standard of compression for Macintosh 17372# files obtained from most archives. (franklsm@tuns.ca) 173730 string SIT! StuffIt Archive (data) 17374!:mime application/x-stuffit 17375!:apple SIT!SIT! 17376>2 string x : %s 173770 string SITD StuffIt Deluxe (data) 17378>2 string x : %s 173790 string Seg StuffIt Deluxe Segment (data) 17380>2 string x : %s 17381 17382# Newer StuffIt archives (grant@netbsd.org) 173830 string StuffIt StuffIt Archive 17384!:mime application/x-stuffit 17385!:apple SIT!SIT! 17386#>162 string >0 : %s 17387 17388# Macintosh Applications and Installation binaries (franklsm@tuns.ca) 17389# GRR: Too weak 17390#0 string APPL Macintosh Application (data) 17391#>2 string x \b: %s 17392 17393# Macintosh System files (franklsm@tuns.ca) 17394# GRR: Too weak 17395#0 string zsys Macintosh System File (data) 17396#0 string FNDR Macintosh Finder (data) 17397#0 string libr Macintosh Library (data) 17398#>2 string x : %s 17399#0 string shlb Macintosh Shared Library (data) 17400#>2 string x : %s 17401#0 string cdev Macintosh Control Panel (data) 17402#>2 string x : %s 17403#0 string INIT Macintosh Extension (data) 17404#>2 string x : %s 17405#0 string FFIL Macintosh Truetype Font (data) 17406#>2 string x : %s 17407#0 string LWFN Macintosh Postscript Font (data) 17408#>2 string x : %s 17409 17410# Additional Macintosh Files (franklsm@tuns.ca) 17411# GRR: Too weak 17412#0 string PACT Macintosh Compact Pro Archive (data) 17413#>2 string x : %s 17414#0 string ttro Macintosh TeachText File (data) 17415#>2 string x : %s 17416#0 string TEXT Macintosh TeachText File (data) 17417#>2 string x : %s 17418#0 string PDF Macintosh PDF File (data) 17419#>2 string x : %s 17420 17421# MacBinary format (Eric Fischer, enf@pobox.com) 17422# Update: Joerg Jenderek 17423# URL: https://en.wikipedia.org/wiki/MacBinary 17424# Reference: http://files.stairways.com/other/macbinaryii-standard-info.txt 17425# 17426# Unfortunately MacBinary doesn't really have a magic number prior 17427# to the MacBinary III format. 17428# 17429 17430# old version number, must be kept at zero for compatibility 174310 byte 0 17432# length of filename (must be in the range 1-63) 17433>1 ubyte >0 17434# skip T.PIC.LZ INSTRUMENT.7T INVENTORY 17435>>1 ubyte <64 17436# skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)" 17437# by looking for printable characters at beginning of file name 17438>>>2 ubelong >0x1F000000 17439# zero fill, must be zero for compatibility 17440>>>>74 byte 0 17441# zero fill, must be zero for compatibility 17442>>>>>82 byte 0 17443# MacBinary I test for valid version numbers 17444>>>>>>122 ubeshort 0 17445# additional check for creation date after 1 Jan 1970 ~ 7C25B080h 17446#>>>>>>>91 ubelong >0x7c25b07F 17447# additional check for undefined header fields in MacBinary I 17448#>>>>>>>101 ulong 0 17449>>>>>>>0 use mac-bin 17450# MacBinary II the newer versions begins at 129 17451>>>>>>122 ubeshort 0x8181 17452>>>>>>>0 use mac-bin 17453# MacBinary III with MacBinary II to read 17454>>>>>122 ubeshort 0x8281 17455>>>>>>0 use mac-bin 17456 17457# display information of MacBinary file 174580 name mac-bin 17459>122 ubyte x MacBinary 17460# versions for MacBinary II/III 17461>122 ubyte 129 II 17462>122 ubyte 130 III 17463# only in MacBinary III 17464>>102 string !mBIN with surprising version 17465!:mime application/x-macbinary 17466!:apple PSPTBINA 17467!:ext bin/macbin 17468# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary 17469#>1 ubyte >63 \b, name length %u too BIG! 17470#>122 ubeshort x \b, version 0x%x 17471# Finder flags if not 0 17472# >73 byte !0 \b, flags 0x 17473# >73 byte =0 17474# >>101 byte !0 \b, flags 0x 17475# # original Finder flags (Bits 8-15) 17476# >73 byte !0 \b%x 17477# # finder flags, bits 0-7 17478# >101 byte !0 \b%x 17479>73 byte &0x01 \b, inited 17480>73 byte &0x02 \b, changed 17481>73 byte &0x04 \b, busy 17482>73 byte &0x08 \b, bozo 17483>73 byte &0x10 \b, system 17484>73 byte &0x20 \b, bundle 17485>73 byte &0x40 \b, invisible 17486>73 byte &0x80 \b, locked 17487 17488# 75 beshort # vertical posn in window 17489#>75 beshort !0 \b, v.pos %u 17490# 77 beshort # horiz posn in window 17491#>77 beshort !0 \b, h.pos %u 17492# 79 beshort # window or folder ID 17493>79 ubeshort !0 \b, ID 0x%x 17494# protected flag 17495>81 byte !0 \b, protected 0x%x 17496# length of comment after resource 17497>99 ubeshort !0 \b, comment length %u 17498# char. code of file name 17499>106 ubyte !0 \b, char. code 0x%x 17500# still more Finder flags 17501>107 ubyte !0 \b, more flags 0x%x 17502# length of total files when unpacked only used when pack and unpack on the fly 17503>116 ubelong !0 \b, total length %u 17504# 120 beshort # length of add'l header 17505>120 ubeshort !0 \b, 2nd header length %u 17506# 124 beshort # checksum 17507#>124 ubeshort !0 \b, CRC 0x%x 17508# creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080 17509>91 beldate-0x7C25B080 x \b, %s 17510# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow 17511>91 ubelong <0x7c25b080 INVALID date 17512#>91 belong-0x7C25B080 x \b, DEBUG DATE %d 17513# last modified date 17514>95 beldate-0x7C25B080 x \b, modified %s 17515# Apple creator+typ if not null 17516# file creator (normally expressed as four characters) 17517>69 ulong !0 \b, creator 17518# instead 4 character code display full creator name 17519>>69 use apple-creator 17520# file type (normally expressed as four characters) 17521>65 ulong !0 \b, type 17522>>65 use apple-type 17523# length of data segment 17524>83 ubelong !0 \b, %u bytes 17525# filename (in the range 1-63) 17526>1 pstring x "%s" 17527# print 1 space and then at offset 128 inspect data fork content if it has one 17528>83 ubelong !0 \b 17529>>128 indirect x 17530# Afterwards resource fork if length of resource segment not zero 17531>87 ubelong !0 17532# calculate resource fork offset 17533>>83 ubelong+128 x \b, at 0x%x 17534# length of resource segment 17535>>87 ubelong !0 %u bytes 17536>>(83.S+128) ubequad x resource 17537# further resource fork content inspection 17538>>>&-8 indirect x 17539 17540# Apple Type/Creator Database 17541# URL: https://en.wikipedia.org/wiki/Type_code 17542# Reference: http://www.lacikam.co.il/tcdb/ 17543# http://www.macdisk.com/macsigen.php 17544# Note: classic Mac OS files have two 4 character codes for type and creator. 17545# Thereby the Finder attach documents types to applications. 17546 17547#>65 string x \b, type "%4.4s" 17548 17549# display information about apple type 175500 name apple-type 17551>0 string 8BIM PhotoShop 17552>0 string ALB3 PageMaker 3 17553>0 string ALB4 PageMaker 4 17554>0 string ALT3 PageMaker 3 17555>0 string APPL application 17556>0 string AWWP AppleWorks word processor 17557>0 string CIRC simulated circuit 17558>0 string DRWG MacDraw 17559>0 string EPSF Encapsulated PostScript 17560>0 string FFIL font suitcase 17561>0 string FKEY function key 17562>0 string FNDR Macintosh Finder 17563>0 string GIFf GIF image 17564>0 string Gzip GNU gzip 17565>0 string INIT system extension 17566>0 string LIB\ library 17567>0 string LWFN PostScript font 17568>0 string MSBC Microsoft BASIC 17569>0 string PACT Compact Pro archive 17570>0 string PDF\ Portable Document Format 17571>0 string PICT picture 17572>0 string PNTG MacPaint picture 17573>0 string PREF preferences 17574>0 string PROJ Think C project 17575>0 string QPRJ Think Pascal project 17576>0 string SCFL Defender scores 17577>0 string SCRN startup screen 17578>0 string SITD StuffIt Deluxe 17579>0 string SPn3 SuperPaint 17580>0 string STAK HyperCard stack 17581>0 string Seg\ StuffIt segment 17582>0 string TARF Unix tar archive 17583>0 string TEXT ASCII 17584>0 string TIFF TIFF image 17585>0 string TOVF Eudora table of contents 17586>0 string WDBN Microsoft Word word processor 17587>0 string WORD MacWrite word processor 17588>0 string XLS\ Microsoft Excel 17589>0 string ZIVM compress (.Z) 17590>0 string ZSYS Pre-System 7 system file 17591>0 string acf3 Aldus FreeHand 17592>0 string cdev control panel 17593>0 string dfil Desk Accessory suitcase 17594>0 string libr library 17595>0 string nX^d WriteNow word processor 17596>0 string nX^w WriteNow dictionary 17597>0 string rsrc resource 17598>0 string scbk Scrapbook 17599>0 string shlb shared library 17600>0 string ttro SimpleText read-only 17601>0 string zsys system file 17602 17603# additional types added in Dec 2017 17604>0 string BINA binary file 17605>0 string BMPp BMP image 17606>0 string JPEG JPEG image 17607#>0 string W4BN Microsoft Word x.y word processor? 17608# if type name is not known display 4 character identifier 17609>0 default x 17610>>0 string x '%4.4s' 17611 17612#>69 string x \b, creator "%4.4s" 17613 17614# Now Apple has no repository of registered Creator IDs any more. These are 17615# just the ones that I happened to have files from and was able to identify. 17616 17617# display information about apple creator 176180 name apple-creator 17619>0 string 8BIM Adobe Photoshop 17620>0 string ALD3 PageMaker 3 17621>0 string ALD4 PageMaker 4 17622>0 string ALFA Alpha editor 17623>0 string APLS Apple Scanner 17624>0 string APSC Apple Scanner 17625>0 string BRKL Brickles 17626>0 string BTFT BitFont 17627>0 string CCL2 Common Lisp 2 17628>0 string CCL\ Common Lisp 17629>0 string CDmo The Talking Moose 17630>0 string CPCT Compact Pro 17631>0 string CSOm Eudora 17632>0 string DMOV Font/DA Mover 17633>0 string DSIM DigSim 17634>0 string EDIT Macintosh Edit 17635>0 string ERIK Macintosh Finder 17636>0 string EXTR self-extracting archive 17637>0 string Gzip GNU gzip 17638>0 string KAHL Think C 17639>0 string LWFU LaserWriter Utility 17640>0 string LZIV compress 17641>0 string MACA MacWrite 17642>0 string MACS Macintosh operating system 17643>0 string MAcK MacKnowledge terminal emulator 17644>0 string MLND Defender 17645>0 string MPNT MacPaint 17646>0 string MSBB Microsoft BASIC (binary) 17647>0 string MSWD Microsoft Word 17648>0 string NCSA NCSA Telnet 17649>0 string PJMM Think Pascal 17650>0 string PSAL Hunt the Wumpus 17651#>0 string PSI2 Apple File Exchange 17652>0 string R*ch BBEdit 17653>0 string RMKR Resource Maker 17654>0 string RSED Resource Editor 17655>0 string Rich BBEdit 17656>0 string SIT! StuffIt 17657>0 string SPNT SuperPaint 17658>0 string Unix NeXT Mac filesystem 17659>0 string VIM! Vim editor 17660>0 string WILD HyperCard 17661>0 string XCEL Microsoft Excel 17662>0 string aCa2 Fontographer 17663>0 string aca3 Aldus FreeHand 17664>0 string dosa Macintosh MS-DOS file system 17665>0 string movr Font/DA Mover 17666>0 string nX^n WriteNow 17667>0 string pdos Apple ProDOS file system 17668>0 string scbk Scrapbook 17669>0 string ttxt SimpleText 17670>0 string ufox Foreign File Access 17671# additional creators added in Dec 2017 17672# Claris/Apple Works 17673>0 string BOBO Apple Works 17674# CU-SeeMe_0.87b3_(68K).bin 17675#>0 string CUce bar 17676>0 string PSPT Apple File Exchange 17677# Disk_Copy_4.2.sea.bin 17678#>0 string NCse foo 17679# probably StuffIt/Aladdin by Smith Micro Software, Inc. 17680>0 string STi0 stuffit 17681# MacGzip-1.1.3.sea.bin 17682#>0 string aust bar 17683# D-Disk_Copy_6.3.3.smi.bin 17684>0 string oneb Disk Copy Self Mounting 17685# if creator name is not known display 4 character identifier 17686>0 default x 17687>>0 string x '%4.4s' 17688 17689# sas magic from Bruce Foster (bef@nwu.edu) 17690# 17691#0 string SAS SAS 17692#>8 string x %s 176930 string SAS SAS 17694>24 string DATA data file 17695>24 string CATALOG catalog 17696>24 string INDEX data file index 17697>24 string VIEW data view 17698# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) 17699# 177000x54 string SAS SAS 7+ 17701>0x9C string DATA data file 17702>0x9C string CATALOG catalog 17703>0x9C string INDEX data file index 17704>0x9C string VIEW data view 17705 17706# spss magic for SPSS system and portable files, 17707# from Bruce Foster (bef@nwu.edu). 17708 177090 long 0xc1e2c3c9 SPSS Portable File 17710>40 string x %s 17711 177120 string $FL2 SPSS System File 17713>24 string x %s 17714 177150 string $FL3 SPSS System File 17716>24 string x %s 17717 17718# Macintosh filesystem data 17719# From "Tom N Harris" <telliamed@mac.com> 17720# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> 17721# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these 17722# entries depend on the data arithmetic added after v.35 17723# There's also some Pascal strings in here, ditto... 17724 17725# The boot block signature, according to IM:Files, is 17726# "for HFS volumes, this field always contains the value 0x4C4B." 17727# But if this is true for MFS or HFS+ volumes, I don't know. 17728# Alternatively, the boot block is supposed to be zeroed if it's 17729# unused, so a simply >0 should suffice. 17730 177310x400 beshort 0xD2D7 Macintosh MFS data 17732>0 beshort 0x4C4B (bootable) 17733>0x40a beshort &0x8000 (locked) 17734>0x402 beldate-0x7C25B080 x created: %s, 17735>0x406 beldate-0x7C25B080 >0 last backup: %s, 17736>0x414 belong x block size: %d, 17737>0x412 beshort x number of blocks: %d, 17738>0x424 pstring x volume name: %s 17739 17740# *.hfs updated by Joerg Jenderek 17741# http://en.wikipedia.org/wiki/Hierarchical_File_System 17742# "BD" gives many false positives 177430x400 beshort 0x4244 17744# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h 17745# first block of volume bit map (always 3) 17746>0x40e ubeshort 0x0003 17747# maximal length of volume name is 27 17748>>0x424 ubyte <28 Macintosh HFS data 17749!:mime application/x-apple-diskimage 17750#!:apple hfsdINIT 17751#!:apple MACSdisk 17752# http://www.macdisk.com/macsigen.php 17753#!:apple ddskdevi 17754!:apple ????devi 17755# https://en.wikipedia.org/wiki/Apple_Disk_Image 17756!:ext hfs/dmg 17757>>>0 beshort 0x4C4B (bootable) 17758#>>>0 beshort 0x0000 (not bootable) 17759>>>0x40a beshort &0x8000 (locked) 17760>>>0x40a beshort ^0x0100 (mounted) 17761>>>0x40a beshort &0x0200 (spared blocks) 17762>>>0x40a beshort &0x0800 (unclean) 17763>>>0x47C beshort 0x482B (Embedded HFS+ Volume) 17764# http://www.epochconverter.com/ 17765# 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970 17766# 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00 17767# construct not working 17768#>>>0x402 beldate-0x7C25B080 x created: %s, 17769#>>>0x406 beldate-0x7C25B080 x last modified: %s, 17770#>>>0x440 beldate-0x7C25B080 >0 last backup: %s, 17771# found block sizes 200h,1200h,2800h 17772>>>0x414 belong x block size: %d, 17773>>>0x412 beshort x number of blocks: %d, 17774>>>0x424 pstring x volume name: %s 17775 177760x400 beshort 0x482B Macintosh HFS Extended 17777>&0 beshort x version %d data 17778>0 beshort 0x4C4B (bootable) 17779>0x404 belong ^0x00000100 (mounted) 17780>&2 belong &0x00000200 (spared blocks) 17781>&2 belong &0x00000800 (unclean) 17782>&2 belong &0x00008000 (locked) 17783>&6 string x last mounted by: '%.4s', 17784# really, that should be treated as a belong and we print a string 17785# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" 17786>&14 beldate-0x7C25B080 x created: %s, 17787# only the creation date is local time, all other timestamps in HFS+ are UTC. 17788>&18 bedate-0x7C25B080 x last modified: %s, 17789>&22 bedate-0x7C25B080 >0 last backup: %s, 17790>&26 bedate-0x7C25B080 >0 last checked: %s, 17791>&38 belong x block size: %d, 17792>&42 belong x number of blocks: %d, 17793>&46 belong x free blocks: %d 17794 17795## AFAIK, only the signature is different 17796# same as Apple Partition Map 17797# GRR: This magic is too weak, it is just "TS" 17798#0x200 beshort 0x5453 Apple Old Partition data 17799#>0x2 beshort x block size: %d, 17800#>0x230 string x first type: %s, 17801#>0x210 string x name: %s, 17802#>0x254 belong x number of blocks: %d, 17803#>0x400 beshort 0x504D 17804#>>0x430 string x second type: %s, 17805#>>0x410 string x name: %s, 17806#>>0x454 belong x number of blocks: %d, 17807#>>0x800 beshort 0x504D 17808#>>>0x830 string x third type: %s, 17809#>>>0x810 string x name: %s, 17810#>>>0x854 belong x number of blocks: %d, 17811#>>>0xa00 beshort 0x504D 17812#>>>>0xa30 string x fourth type: %s, 17813#>>>>0xa10 string x name: %s, 17814#>>>>0xa54 belong x number of blocks: %d 17815 17816# From: Remi Mommsen <mommsen@slac.stanford.edu> 178170 string BOMStore Mac OS X bill of materials (BOM) file 17818 17819# From: Adam Buchbinder <adam.buchbinder@gmail.com> 17820# URL: http://en.wikipedia.org/wiki/Datafork_TrueType 17821# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is 17822# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I 17823# don't know what they mean. 178240 belong 0x100 17825>(0x4.L+24) beshort x 17826>>&4 belong 0x73666e74 Mac OSX datafork font, TrueType 17827>>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT' 17828>>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT' 17829>>&4 belong 0x504f5354 Mac OSX datafork font, PostScript 17830 17831#------------------------------------------------------------------------------ 17832# $File: macos,v 1.1 2012/12/21 16:41:07 christos Exp $ 17833# MacOS files 17834# 17835 178360 string book\0\0\0\0mark\0\0\0\0 MacOS Alias file 17837 17838#------------------------------------------------------------------------------ 17839# $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $ 17840# magic: file(1) magic for magic files 17841# 178420 string/t #\ Magic magic text file for file(1) cmd 178430 lelong 0xF11E041C magic binary file for file(1) cmd 17844>4 lelong x (version %d) (little endian) 178450 belong 0xF11E041C magic binary file for file(1) cmd 17846>4 belong x (version %d) (big endian) 17847#------------------------------------------------------------------------------ 17848# $File: mail.news,v 1.23 2015/06/29 14:44:26 christos Exp $ 17849# mail.news: file(1) magic for mail and news 17850# 17851# Unfortunately, saved netnews also has From line added in some news software. 17852#0 string From mail text 178530 string/t Relay-Version: old news text 17854!:mime message/rfc822 178550 string/t #!\ rnews batched news text 17856!:mime message/rfc822 178570 string/t N#!\ rnews mailed, batched news text 17858!:mime message/rfc822 178590 string/t Forward\ to mail forwarding text 17860!:mime message/rfc822 178610 string/t Pipe\ to mail piping text 17862!:mime message/rfc822 178630 string/tc delivered-to: SMTP mail text 17864!:mime message/rfc822 178650 string/tc return-path: SMTP mail text 17866!:mime message/rfc822 178670 string/t Path: news text 17868!:mime message/news 178690 string/t Xref: news text 17870!:mime message/news 178710 string/t From: news or mail text 17872!:mime message/rfc822 178730 string/t Article saved news text 17874!:mime message/news 178750 string/t BABYL Emacs RMAIL text 178760 string/t Received: RFC 822 mail text 17877!:mime message/rfc822 178780 string/t MIME-Version: MIME entity text 17879#0 string/t Content- MIME entity text 17880 17881# TNEF files... 178820 lelong 0x223E9F78 Transport Neutral Encapsulation Format 17883!:mime application/vnd.ms-tnef 17884 17885# From: Kevin Sullivan <ksulliva@psc.edu> 178860 string *mbx* MBX mail folder 17887 17888# From: Simon Matter <simon.matter@invoca.ch> 178890 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB 178900 string \241\002\213\015twoskip\ file\0\0\0\0 Cyrus twoskip DB 17891 17892# JAM(mbp) Fidonet message area databases 17893# JHR file 178940 string JAM\0 JAM message area header file 17895>12 leshort >0 (%d messages) 17896 17897# Squish Fidonet message area databases 17898# SQD file (requires at least one message in the area) 17899# XXX: Weak magic 17900#256 leshort 0xAFAE4453 Squish message area data file 17901#>4 leshort >0 (%d messages) 17902 17903#0 string \<!--\ MHonArc text/html; x-type=mhonarc 17904 17905# Cyrus: file(1) magic for compiled Cyrus sieve scripts 17906# URL: http://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php 17907# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master 17908# From: Philipp Hahn <hahn@univention.de> 17909 17910# Compiled Cyrus sieve script 179110 string CyrSBytecode Cyrus sieve bytecode data, 17912>12 belong =1 version 1, big-endian 17913>12 lelong =1 version 1, little-endian 17914>12 belong x version %d, network-endian 17915#------------------------------------------------------------------------------ 17916# $File: make,v 1.4 2018/05/29 17:26:02 christos Exp $ 17917# make: file(1) magic for makefiles 17918# 17919# URL: https://en.wikipedia.org/wiki/Make_(software) 179200 regex/100l \^CFLAGS makefile script text 17921!:mime text/x-makefile 179220 regex/100l \^VPATH makefile script text 17923!:mime text/x-makefile 179240 regex/100l \^LDFLAGS makefile script text 17925!:mime text/x-makefile 179260 regex/100l \^all: makefile script text 17927!:mime text/x-makefile 179280 regex/100l \^\\.PRECIOUS makefile script text 17929!:mime text/x-makefile 17930# Update: Joerg Jenderek 17931# Reference: https://www.freebsd.org/cgi/man.cgi?make(1) 17932# exclude grub-core\lib\libgcrypt\mpi\Makefile.am with "#BEGIN_ASM_LIST" 17933# by additional escaping point character 179340 regex/100l \^\\.BEGIN BSD makefile script text 17935!:mime text/x-makefile 17936!:ext /mk 17937!:strength +10 17938# exclude MS Windows help file CoNtenT with ":include FOOBAR.CNT" 17939# and NSIS script with "!include" by additional escaping point character 179400 regex/100l \^\\.include BSD makefile script text 17941!:mime text/x-makefile 17942!:ext /mk 17943!:strength +10 179440 regex/100l \^\\.endif BSD makefile script text 17945!:mime text/x-makefile 17946!:ext /mk 17947!:strength +10 179480 regex/100l \^SUBDIRS automake makefile script text 17949!:mime text/x-makefile 17950!:strength +10 17951 17952 17953#------------------------------------------------------------------------------ 17954# $File: map,v 1.4 2015/08/10 05:18:27 christos Exp $ 17955# map: file(1) magic for Map data 17956# 17957 17958# Garmin .FIT files http://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml 179598 string .FIT FIT Map data 17960>15 byte 0 17961>>35 belong x \b, unit id %d 17962>>39 lelong x \b, serial %u 17963# http://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml 17964# 20 years after unix epoch 17965# TZ=GMT date -d '1989-12-31 0:00' +%s 17966>>43 leldate+631065600 x \b, %s 17967 17968>>47 leshort x \b, manufacturer %d 17969>>47 leshort 1 \b (garmin) 17970>>49 leshort x \b, product %d 17971>>53 byte x \b, type %d 17972>>53 byte 1 \b (Device) 17973>>53 byte 2 \b (Settings) 17974>>53 byte 3 \b (Sports/Cycling) 17975>>53 byte 4 \b (Activity) 17976>>53 byte 8 \b (Elevations) 17977>>53 byte 10 \b (Totals) 17978 17979# TOM TOM GPS watches ttbin files: 17980# http://github.com/ryanbinns/ttwatch/tree/master/ttbin 17981# From: Daniel Lenski 179820 byte 0x20 17983>1 leshort 0x0007 17984>>0x76 byte 0x20 17985>>>0x77 leshort 0x0075 TomTom activity file, v7 17986>>>>8 leldate x (%s, 17987>>>>3 byte x device firmware %d. 17988>>>>4 byte x \b%d. 17989>>>>5 byte x \b%d, 17990>>>>6 leshort x product ID %04d) 17991 17992 17993#------------------------------------------------------------------------------ 17994# $File: maple,v 1.8 2017/03/17 21:35:28 christos Exp $ 17995# maple: file(1) magic for maple files 17996# "H. Nanosecond" <aldomel@ix.netcom.com> 17997# Maple V release 4, a multi-purpose math program 17998# 17999 18000# maple library .lib 180010 string \000MVR4\nI MapleVr4 library 18002 18003# .ind 18004# no magic for these :-( 18005# they are compiled indexes for maple files 18006 18007# .hdb 180080 string \000\004\000\000 Maple help database 18009 18010# .mhp 18011# this has the form <PACKAGE=name> 180120 string \<PACKAGE= Maple help file 180130 string \<HELP\ NAME= Maple help file 180140 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck) 18015#0 string #\ Newton Maple help file, old style 180160 string #\ daub Maple help file, old style 18017#0 string #=========== Maple help file, old style 18018 18019# .mws 180200 string \000\000\001\044\000\221 Maple worksheet 18021#this is anomalous 180220 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird 18023# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n 18024# that is {VERSION major_version miunor_version computer_type version_string} 180250 string {VERSION\ Maple worksheet 18026>9 string >\0 version %.1s. 18027>>11 string >\0 %.1s 18028 18029# .mps 180300 string \0\0\001$ Maple something 18031# from byte 4 it is either 'nul E' or 'soh R' 18032# I think 'nul E' means a file that was saved as a different name 18033# a sort of revision marking 18034# 'soh R' means new 18035>4 string \000\105 An old revision 18036>4 string \001\122 The latest save 18037 18038# .mpl 18039# some of these are the same as .mps above 18040#0000000 000 000 001 044 000 105 same as .mps 18041#0000000 000 000 001 044 001 122 same as .mps 18042 180430 string #\n##\ <SHAREFILE= Maple something 180440 string \n#\n##\ <SHAREFILE= Maple something 180450 string ##\ <SHAREFILE= Maple something 180460 string #\r##\ <SHAREFILE= Maple something 180470 string \r#\r##\ <SHAREFILE= Maple something 180480 string #\ \r##\ <DESCRIBE> Maple something anomalous. 18049#-------------------------------------------- 18050# marc21: file(1) magic for MARC 21 Format 18051# 18052# Kevin Ford (kefo@loc.gov) 18053# 18054# MARC21 formats are for the representation and communication 18055# of bibliographic and related information in machine-readable 18056# form. For more info, see http://www.loc.gov/marc/ 18057 18058 18059# leader position 20-21 must be 45 18060# and 22-23 also 00 so far, but we check that later. 1806120 string 45 18062>0 search/2048 \x1e 18063 18064# leader starts with 5 digits, followed by codes specific to MARC format 18065>>0 regex/1l (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic 18066!:mime application/marc 18067>>0 regex/1l (^[0-9]{5})[acdnosx][z] MARC21 Authority 18068!:mime application/marc 18069>>0 regex/1l (^[0-9]{5})[cdn][uvxy] MARC21 Holdings 18070!:mime application/marc 18071>>0 regex/1l (^[0-9]{5})[acdn][w] MARC21 Classification 18072!:mime application/marc 18073>>0 regex/1l (^[0-9]{5})[cdn][q] MARC21 Community 18074!:mime application/marc 18075 18076# leader position 22-23, should be "00" but is it? 18077>>0 regex/1l (^.{21})([^0]{2}) (non-conforming) 18078!:mime application/marc 18079 18080#------------------------------------------------------------------------------ 18081# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $ 18082# mathcad: file(1) magic for Mathcad documents 18083# URL: http://www.mathsoft.com/ 18084# From: Josh Triplett <josh@freedesktop.org> 18085 180860 string .MCAD\t Mathcad document 18087 18088#------------------------------------------------------------------------------ 18089# $File: mathematica,v 1.9 2017/03/17 21:35:28 christos Exp $ 18090# mathematica: file(1) magic for mathematica files 18091# "H. Nanosecond" <aldomel@ix.netcom.com> 18092# Mathematica a multi-purpose math program 18093# versions 2.2 and 3.0 18094 18095#mathematica .mb 180960 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook 18097!:ext mb 180980 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook 18099!:ext mb 18100 18101# .ma 18102# multiple possibilites: 18103 181040 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook 18105#>41 string >\0 %s 18106!:ext mb 18107 18108#0 string (*^\n\n::[\011palette Mathematica notebook version 2.x 18109 18110#0 string (*^\n\n::[\011Information Mathematica notebook version 2.x 18111#>675 string >\0 %s #doesn't work well 18112 18113# there may be 'cr' instread of 'nl' in some does this matter? 18114 18115# generic: 181160 string (*^\r\r::[\011 Mathematica notebook version 2.x 18117!:ext mb 181180 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x 18119!:ext mb 181200 string (*^\015 Mathematica notebook version 2.x 18121!:ext mb 181220 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x 18123!:ext mb 181240 string (*^\r::[\011 Mathematica notebook version 2.x 18125!:ext mb 181260 string (*^\r\n::[\011 Mathematica notebook version 2.x 18127!:ext mb 181280 string (*^\n\n::[\011 Mathematica notebook version 2.x 18129!:ext mb 181300 string (*^\n::[\011 Mathematica notebook version 2.x 18131!:ext mb 18132 18133 18134# Mathematica .mx files 18135 18136#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file 181370 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file 18138#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000 18139# >71... is optional 18140>88 string >\0 from %s 18141 18142 18143# Mathematica files PBF: 18144# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000 181450 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think) 18146 18147# .ml files These are menu resources I think 18148# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\ 18149# how to put that into a magic rule? 181504 string \ A~ MAthematica .ml file 18151 18152# .nb files 18153#too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook 181540 string (*********************** Mathematica 3.0 notebook 18155 18156# other (* matches it is a comment start in these langs 18157# GRR: Too weak; also matches other languages e.g. ML 18158#0 string (* Mathematica, or Pascal, Modula-2 or 3 code text 18159 18160######################### 18161# MatLab v5 181620 string MATLAB Matlab v5 mat-file 18163>126 short 0x494d (big endian) 18164>>124 beshort x version 0x%04x 18165>126 short 0x4d49 (little endian) 18166>>124 leshort x version 0x%04x 18167 18168 18169#------------------------------------------------------------------------------ 18170# $File: matroska,v 1.8 2013/02/08 17:25:16 christos Exp $ 18171# matroska: file(1) magic for Matroska files 18172# 18173# See http://www.matroska.org/ 18174# 18175 18176# EBML id: 181770 belong 0x1a45dfa3 18178# DocType id: 18179>4 search/4096 \x42\x82 18180# DocType contents: 18181>>&1 string webm WebM 18182!:mime video/webm 18183>>&1 string matroska Matroska data 18184!:mime video/x-matroska 18185 18186#------------------------------------------------------------------------------ 18187# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $ 18188# Mavroyanopoulos Nikos <nmav@hellug.gr> 18189# mcrypt: file(1) magic for mcrypt 2.2.x; 181900 string \0m\3 mcrypt 2.5 encrypted data, 18191>4 string >\0 algorithm: %s, 18192>>&1 leshort >0 keysize: %d bytes, 18193>>>&0 string >\0 mode: %s, 18194 181950 string \0m\2 mcrypt 2.2 encrypted data, 18196>3 byte 0 algorithm: blowfish-448, 18197>3 byte 1 algorithm: DES, 18198>3 byte 2 algorithm: 3DES, 18199>3 byte 3 algorithm: 3-WAY, 18200>3 byte 4 algorithm: GOST, 18201>3 byte 6 algorithm: SAFER-SK64, 18202>3 byte 7 algorithm: SAFER-SK128, 18203>3 byte 8 algorithm: CAST-128, 18204>3 byte 9 algorithm: xTEA, 18205>3 byte 10 algorithm: TWOFISH-128, 18206>3 byte 11 algorithm: RC2, 18207>3 byte 12 algorithm: TWOFISH-192, 18208>3 byte 13 algorithm: TWOFISH-256, 18209>3 byte 14 algorithm: blowfish-128, 18210>3 byte 15 algorithm: blowfish-192, 18211>3 byte 16 algorithm: blowfish-256, 18212>3 byte 100 algorithm: RC6, 18213>3 byte 101 algorithm: IDEA, 18214>4 byte 0 mode: CBC, 18215>4 byte 1 mode: ECB, 18216>4 byte 2 mode: CFB, 18217>4 byte 3 mode: OFB, 18218>4 byte 4 mode: nOFB, 18219>5 byte 0 keymode: 8bit 18220>5 byte 1 keymode: 4bit 18221>5 byte 2 keymode: SHA-1 hash 18222>5 byte 3 keymode: MD5 hash 18223 18224#------------------------------------------------------------------------------ 18225# $File: measure,v 1.2 2018/06/23 16:13:15 christos Exp $ 18226# measure: file(1) magic for measurement data 18227 18228# DIY-Thermocam raw data 182290 name diy-thermocam-parser 18230>0 beshort x scale %d- 18231>2 beshort x \b%d, 18232>4 lefloat x spot sensor temperature %f, 18233>9 ubyte 0 unit celsius, 18234>9 ubyte 1 unit fahrenheit, 18235>8 ubyte x color scheme %d 18236>10 ubyte 1 \b, show spot sensor 18237>11 ubyte 1 \b, show scale bar 18238>12 ubyte &1 \b, minimum point enabled 18239>12 ubyte &2 \b, maximum point enabled 18240>13 lefloat x \b, calibration: offset %f, 18241>17 lefloat x slope %f 18242 182430 name diy-thermocam-checker 18244>9 ubyte <2 18245>>10 ubyte <2 18246>>>11 ubyte <2 18247>>>>12 ubyte <4 18248>>>>>17 lefloat >0.0001 DIY-Thermocam raw data 18249 18250# V2 and Leption 3.x: 1825138408 ubyte <19 18252>38400 use diy-thermocam-checker 18253>>38400 default x (Lepton 3.x), 18254>>>38400 use diy-thermocam-parser 18255 18256# V1 or Lepton 2.x 182579608 ubyte <19 18258>9600 use diy-thermocam-checker 18259>>9600 default x (Lepton 2.x), 18260>>>9600 use diy-thermocam-parser 18261 18262 18263#------------------------------------------------------------------------------ 18264# $File: mercurial,v 1.4 2009/09/19 16:28:10 christos Exp $ 18265# mercurial: file(1) magic for Mercurial changeset bundles 18266# http://www.selenic.com/mercurial/wiki/ 18267# 18268# Jesse Glick (jesse.glick@sun.com) 18269# 18270 182710 string HG10 Mercurial changeset bundle 18272>4 string UN (uncompressed) 18273>4 string GZ (gzip compressed) 18274>4 string BZ (bzip2 compressed) 18275 18276#------------------------------------------------------------------------------ 18277# $File: metastore,v 1.2 2017/03/17 21:35:28 christos Exp $ 18278# metastore: file(1) magic for metastore files 18279# From: Thomas Wissen 18280# see http://david.hardeman.nu/software.php#metastore 182810 string MeTaSt00r3 Metastore data file, 18282>10 bequad x version %0llx 18283 18284#------------------------------------------------------------------------------ 18285# $File: meteorological,v 1.2 2017/03/17 21:35:28 christos Exp $ 18286# rinex: file(1) magic for RINEX files 18287# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt 18288# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf 18289# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data 1829060 string RINEX 18291>80 search/256 XXRINEXB RINEX Data, GEO SBAS Broadcast 18292>>&32 string x \b, date %15.15s 18293>>5 string x \b, version %6.6s 18294!:mime rinex/broadcast 18295>80 search/256 XXRINEXD RINEX Data, Observation (Hatanaka comp) 18296>>&32 string x \b, date %15.15s 18297>>5 string x \b, version %6.6s 18298!:mime rinex/observation 18299>80 search/256 XXRINEXC RINEX Data, Clock 18300>>&32 string x \b, date %15.15s 18301>>5 string x \b, version %6.6s 18302!:mime rinex/clock 18303>80 search/256 XXRINEXH RINEX Data, GEO SBAS Navigation 18304>>&32 string x \b, date %15.15s 18305>>5 string x \b, version %6.6s 18306!:mime rinex/navigation 18307>80 search/256 XXRINEXG RINEX Data, GLONASS Navigation 18308>>&32 string x \b, date %15.15s 18309>>5 string x \b, version %6.6s 18310!:mime rinex/navigation 18311>80 search/256 XXRINEXL RINEX Data, Galileo Navigation 18312>>&32 string x \b, date %15.15s 18313>>5 string x \b, version %6.6s 18314!:mime rinex/navigation 18315>80 search/256 XXRINEXM RINEX Data, Meteorological 18316>>&32 string x \b, date %15.15s 18317>>5 string x \b, version %6.6s 18318!:mime rinex/meteorological 18319>80 search/256 XXRINEXN RINEX Data, Navigation 18320>>&32 string x \b, date %15.15s 18321>>5 string x \b, version %6.6s 18322!:mime rinex/navigation 18323>80 search/256 XXRINEXO RINEX Data, Observation 18324>>&32 string x \b, date %15.15s 18325>>5 string x \b, version %6.6s 18326!:mime rinex/observation 18327 18328# https://en.wikipedia.org/wiki/GRIB 183290 string GRIB 18330>7 byte =1 Gridded binary (GRIB) version 1 18331>7 byte =2 Gridded binary (GRIB) version 2 18332 18333#------------------------------------------------------------------------------ 18334# $File: microfocus,v 1.2 2017/03/17 21:35:28 christos Exp $ 18335# Micro Focus COBOL data files. 18336 18337# http://documentation.microfocus.com/help/index.jsp?topic=\ 18338# %2FGUID-0E0191D8-C39A-44D1-BA4C-D67107BAF784%2FHRFLRHFILE05.html 18339# http://www.cobolproducts.com/datafile/data-viewer.html 18340# https://github.com/miracle2k/mfcobol-export 18341 183420 string \x30\x00\x00\x7C 18343>36 string \x00\x3E Micro Focus File with Header (DAT) 18344!:mime application/octet-stream 18345 183460 string \x30\x7E\x00\x00 18347>36 string \x00\x3E Micro Focus File with Header (DAT) 18348!:mime application/octet-stream 18349 1835039 string \x02 18351>136 string \x02\x02\x04\x04 Micro Focus Index File (IDX) 18352!:mime application/octet-stream 18353 18354#------------------------------------------------------------------------------ 18355# $File: mime,v 1.8 2017/03/17 22:20:22 christos Exp $ 18356# mime: file(1) magic for MIME encoded files 18357# 183580 string/t Content-Type:\040 18359>14 string >\0 %s 183600 string/t Content-Type: 18361>13 string >\0 %s 18362 18363#------------------------------------------------------------------------------ 18364# $File: mips,v 1.10 2014/04/30 21:41:02 christos Exp $ 18365# mips: file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX 18366# and DEC Ultrix 18367# 183680 beshort 0x0160 MIPSEB ECOFF executable 18369>20 beshort 0407 (impure) 18370>20 beshort 0410 (swapped) 18371>20 beshort 0413 (paged) 18372>8 belong >0 not stripped 18373>8 belong 0 stripped 18374>22 byte x - version %d 18375>23 byte x \b.%d 18376# 183770 beshort 0x0162 MIPSEL-BE ECOFF executable 18378>20 beshort 0407 (impure) 18379>20 beshort 0410 (swapped) 18380>20 beshort 0413 (paged) 18381>8 belong >0 not stripped 18382>8 belong 0 stripped 18383>23 byte x - version %d 18384>22 byte x \b.%d 18385# 183860 beshort 0x6001 MIPSEB-LE ECOFF executable 18387>20 beshort 03401 (impure) 18388>20 beshort 04001 (swapped) 18389>20 beshort 05401 (paged) 18390>8 belong >0 not stripped 18391>8 belong 0 stripped 18392>23 byte x - version %d 18393>22 byte x \b.%d 18394# 183950 beshort 0x6201 MIPSEL ECOFF executable 18396>20 beshort 03401 (impure) 18397>20 beshort 04001 (swapped) 18398>20 beshort 05401 (paged) 18399>8 belong >0 not stripped 18400>8 belong 0 stripped 18401>23 byte x - version %d 18402>22 byte x \b.%d 18403# 18404# MIPS 2 additions 18405# 184060 beshort 0x0163 MIPSEB MIPS-II ECOFF executable 18407>20 beshort 0407 (impure) 18408>20 beshort 0410 (swapped) 18409>20 beshort 0413 (paged) 18410>8 belong >0 not stripped 18411>8 belong 0 stripped 18412>22 byte x - version %d 18413>23 byte x \b.%d 18414# 184150 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable 18416>20 beshort 0407 (impure) 18417>20 beshort 0410 (swapped) 18418>20 beshort 0413 (paged) 18419>8 belong >0 not stripped 18420>8 belong 0 stripped 18421>22 byte x - version %d 18422>23 byte x \b.%d 18423# 184240 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable 18425>20 beshort 03401 (impure) 18426>20 beshort 04001 (swapped) 18427>20 beshort 05401 (paged) 18428>8 belong >0 not stripped 18429>8 belong 0 stripped 18430>23 byte x - version %d 18431>22 byte x \b.%d 18432# 184330 beshort 0x6601 MIPSEL MIPS-II ECOFF executable 18434>20 beshort 03401 (impure) 18435>20 beshort 04001 (swapped) 18436>20 beshort 05401 (paged) 18437>8 belong >0 not stripped 18438>8 belong 0 stripped 18439>23 byte x - version %d 18440>22 byte x \b.%d 18441# 18442# MIPS 3 additions 18443# 184440 beshort 0x0140 MIPSEB MIPS-III ECOFF executable 18445>20 beshort 0407 (impure) 18446>20 beshort 0410 (swapped) 18447>20 beshort 0413 (paged) 18448>8 belong >0 not stripped 18449>8 belong 0 stripped 18450>22 byte x - version %d 18451>23 byte x \b.%d 18452# 184530 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable 18454>20 beshort 0407 (impure) 18455>20 beshort 0410 (swapped) 18456>20 beshort 0413 (paged) 18457>8 belong >0 not stripped 18458>8 belong 0 stripped 18459>22 byte x - version %d 18460>23 byte x \b.%d 18461# 184620 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable 18463>20 beshort 03401 (impure) 18464>20 beshort 04001 (swapped) 18465>20 beshort 05401 (paged) 18466>8 belong >0 not stripped 18467>8 belong 0 stripped 18468>23 byte x - version %d 18469>22 byte x \b.%d 18470# 184710 beshort 0x4201 MIPSEL MIPS-III ECOFF executable 18472>20 beshort 03401 (impure) 18473>20 beshort 04001 (swapped) 18474>20 beshort 05401 (paged) 18475>8 belong >0 not stripped 18476>8 belong 0 stripped 18477>23 byte x - version %d 18478>22 byte x \b.%d 18479# 184800 beshort 0x180 MIPSEB Ucode 184810 beshort 0x182 MIPSEL-BE Ucode 18482 18483#------------------------------------------------------------------------------ 18484# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $ 18485# mirage: file(1) magic for Mirage executables 18486# 18487# XXX - byte order? 18488# 184890 long 31415 Mirage Assembler m.out executable 18490 18491#----------------------------------------------------------------------------- 18492# $File: misctools,v 1.17 2017/03/17 21:35:28 christos Exp $ 18493# misctools: file(1) magic for miscellaneous UNIX tools. 18494# 184950 search/1 %%!! X-Post-It-Note text 184960 string/c BEGIN:VCALENDAR vCalendar calendar file 18497!:mime text/calendar 18498# updated by Joerg Jenderek at Apr 2015 18499# Extension: .vcf 18500# http://en.wikipedia.org/wiki/VCard 185010 string/c BEGIN:VCARD vCard visiting card 18502# deprecated 18503#!:mime text/x-vcard 18504!:mime text/vcard 18505# VERSION must come right after BEGIN for 3.0 or 4.0 except in 2.1 , where it can be anywhere 18506>12 search/14000/c VERSION: 18507# VERSION 2.1 , 3.0 or 4.0 18508>>&0 string x \b, version %-.3s 18509 18510# Summary: Libtool library file 18511# Extension: .la 18512# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl> 185130 search/80 .la\ -\ a\ libtool\ library\ file libtool library file 18514 18515# Summary: Libtool object file 18516# Extension: .lo 18517# Submitted by: Abel Cheung <abelcheung@gmail.com> 185180 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file 18519 18520# From: Daniel Novotny <dnovotny@redhat.com> 18521# Update: Joerg Jenderek 18522# URL: https://en.wikipedia.org/wiki/Core_dump#User-mode_memory_dumps 18523# Reference: https://msdn.microsoft.com/en-us/library/ms680378%28VS.85%29.aspx 18524# 18525# "Windows Minidump" by TrID 18526# ./misctools (version 5.25) labeled the entry as "MDMP crash report data" 185270 string MDMP Mini DuMP crash report 18528# http://filext.com/file-extension/DMP 18529!:mime application/x-dmp 18530!:ext dmp/mdmp 18531# The high-order word is an internal value that is implementation specific. 18532# The low-order word is MINIDUMP_VERSION 0xA793 18533>4 ulelong&0x0000FFFF !0xA793 \b, version 0x%4.4x 18534# NumberOfStreams 8,9,10,13 18535>8 ulelong x \b, %d streams 18536# StreamDirectoryRva 0x20 18537>12 ulelong !0x20 \b, 0x%8.8x RVA 18538# CheckSum 0 18539>16 ulelong !0 \b, CheckSum 0x%8.8x 18540# Reserved or TimeDateStamp 18541>20 ledate x \b, %s 18542# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519%28v=vs.85%29.aspx 18543# Flags MINIDUMP_TYPE enumeration type 0 0x121 0x800 18544>24 ulelong x \b, 0x%x type 18545# >24 ulelong >0 \b; include 18546# >>24 ulelong &0x00000001 \b data sections, 18547# >>24 ulelong &0x00000020 \b list of unloaded modules, 18548# >>24 ulelong &0x00000100 \b process and thread information, 18549# >>24 ulelong &0x00000800 \b memory information, 18550 18551# Summary: abook addressbook file 18552# Submitted by: Mark Schreiber <mark7@alumni.cmu.edu> 185530 string #\x20abook\x20addressbook\x20file abook address book 18554!:mime application/x-abook-addressbook 18555 18556#------------------------------------------------------------------------------ 18557# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $ 18558# mkid: file(1) magic for mkid(1) databases 18559# 18560# ID is the binary tags database produced by mkid(1). 18561# 18562# XXX - byte order? 18563# 185640 string \311\304 ID tags data 18565>2 short >0 version %d 18566 18567#------------------------------------------------------------------------------ 18568# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $ 18569# mlssa: file(1) magic for MLSSA datafiles 18570# 185710 lelong 0xffffabcd MLSSA datafile, 18572>4 leshort x algorithm %d, 18573>10 lelong x %d samples 18574 18575#------------------------------------------------------------------------------ 18576# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $ 18577# mmdf: file(1) magic for MMDF mail files 18578# 185790 string \001\001\001\001 MMDF mailbox 18580 18581#------------------------------------------------------------------------------ 18582# $File: modem,v 1.8 2017/03/17 21:35:28 christos Exp $ 18583# modem: file(1) magic for modem programs 18584# 18585# From: Florian La Roche <florian@knorke.saar.de> 185861 string PC\ Research,\ Inc Digifax-G3-File 18587>29 byte 1 \b, fine resolution 18588>29 byte 0 \b, normal resolution 18589 18590# Summary: CCITT Group 3 Facsimile in "raw" form (i.e. no header). 18591# Modified by: Joerg Jenderek 18592# URL: https://de.wikipedia.org/wiki/Fax 18593# Reference: http://web.archive.org/web/20020628195336/http://www.netnam.vn/unescocourse/computervision/104.htm 18594# GRR: EOL of G3 is too general as it catches also TrueType fonts, Postscript PrinterFontMetric, others 185950 short 0x0100 18596# 16 0-bits near beginning like True Type fonts *.ttf, Postscript PrinterFontMetric *.pfm, FTYPE.HYPERCARD, XFER 18597>2 search/9 \0\0 18598# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3 18599>2 default x 18600# skip IRCAM file (VAX big-endian) ./audio 18601>>0 belong !0x0001a364 18602# skip GEM Image data ./images 18603>>>2 beshort !0x0008 18604# look for first keyword of Panorama database *.pan 18605>>>>11 search/262 \x06DESIGN 18606# skip Panorama database 18607>>>>11 default x 18608# old Apple DreamWorld DreamGrafix *.3200 with keyword at end of g3 looking files 18609>>>>>27118 search/1864 DreamWorld 18610>>>>>27118 default x 18611# skip MouseTrap/Mt.Defaults with file size 16 found on Golden Orchard Apple II CD Rom 18612>>>>>>8 ubequad !0x2e01010454010203 18613# skip PICTUREH.SML found on Golden Orchard Apple II CD Rom 18614>>>>>>>8 ubequad !0x5dee74ad1aa56394 raw G3 (Group 3) FAX, byte-padded 18615# version 5.25 labeled the entry above "raw G3 data, byte-padded" 18616!:mime image/g3fax 18617#!:apple ????TIFF 18618!:ext g3 18619# unusual image starting with black pixel 18620#0 short 0x1300 raw G3 (Group 3) FAX 186210 short 0x1400 18622# 16 0-bits near beginning like PicturePuzzler found on Golden Orchard Apple CD Rom 18623>2 search/9 \0\0 18624# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3 18625>2 default x raw G3 (Group 3) FAX 18626# version 5.25 labeled the above entry as "raw G3 data" 18627!:mime image/g3fax 18628!:ext g3 18629# unusual image with black pixel near beginning 18630#0 short 0x1900 raw G3 (Group 3) FAX 18631 18632# 18633# Magic data for vgetty voice formats 18634# (Martin Seine & Marc Eberhard) 18635 18636# 18637# raw modem data version 1 18638# 186390 string RMD1 raw modem data 18640>4 string >\0 (%s / 18641>20 short >0 compression type 0x%04x) 18642 18643# 18644# portable voice format 1 18645# 186460 string PVF1\n portable voice format 18647>5 string >\0 (binary %s) 18648 18649# 18650# portable voice format 2 18651# 186520 string PVF2\n portable voice format 18653>5 string >\0 (ascii %s) 18654 18655# From: Bernd Nuernberger <bernd.nuernberger@web.de> 18656# Brooktrout G3 fax data incl. 128 byte header 18657# Common suffixes: 3??, BRK, BRT, BTR 186580 leshort 0x01bb 18659>2 leshort 0x0100 Brooktrout 301 fax image, 18660>>9 leshort x %d x 18661>>0x2d leshort x %d 18662>>6 leshort 200 \b, fine resolution 18663>>6 leshort 100 \b, normal resolution 18664>>11 byte 1 \b, G3 compression 18665>>11 byte 2 \b, G32D compression 18666 18667#------------------------------------------------------------------------------ 18668# $File: motorola,v 1.11 2014/04/30 21:41:02 christos Exp $ 18669# motorola: file(1) magic for Motorola 68K and 88K binaries 18670# 18671# 68K 18672# 186730 beshort 0520 mc68k COFF 18674>18 beshort ^00000020 object 18675>18 beshort &00000020 executable 18676>12 belong >0 not stripped 18677>168 string .lowmem Apple toolbox 18678>20 beshort 0407 (impure) 18679>20 beshort 0410 (pure) 18680>20 beshort 0413 (demand paged) 18681>20 beshort 0421 (standalone) 186820 beshort 0521 mc68k executable (shared) 18683>12 belong >0 not stripped 186840 beshort 0522 mc68k executable (shared demand paged) 18685>12 belong >0 not stripped 18686# 18687# Motorola/UniSoft 68K Binary Compatibility Standard (BCS) 18688# 186890 beshort 0554 68K BCS executable 18690# 18691# 88K 18692# 18693# Motorola/88Open BCS 18694# 186950 beshort 0555 88K BCS executable 18696# 18697# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de> 186980 string S0 Motorola S-Record; binary data in text format 18699 18700# ATARI ST relocatable PRG 18701# 18702# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 18703# (according to Roland Waldi, Oct 21, 1987) 18704# besides the magic 0x601a, the text segment size is checked to be 18705# not larger than 1 MB (which is a lot on ST). 18706# The additional 0x601b distinction I took from Doug Lee's magic. 187070 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable 18708>2 belong x (txt=%d, 18709>6 belong x dat=%d, 18710>10 belong x bss=%d, 18711>14 belong x sym=%d) 187120 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable 18713>2 belong x (txt=%d, 18714>6 belong x dat=%d, 18715>10 belong x bss=%d, 18716>14 belong x sym=%d) 18717 18718# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>) 187190 beshort 0x601A Atari 68xxx executable, 18720>2 belong x text len %u, 18721>6 belong x data len %u, 18722>10 belong x BSS len %u, 18723>14 belong x symboltab len %u, 18724>18 belong 0 18725>22 belong &0x01 fastload flag, 18726>22 belong &0x02 may be loaded to alternate RAM, 18727>22 belong &0x04 malloc may be from alternate RAM, 18728>22 belong x flags: 0x%X, 18729>26 beshort 0 no relocation tab 18730>26 beshort !0 + relocation tab 18731>30 string SFX [Self-Extracting LZH SFX archive] 18732>38 string SFX [Self-Extracting LZH SFX archive] 18733>44 string ZIP! [Self-Extracting ZIP SFX archive] 18734 187350 beshort 0x0064 Atari 68xxx CPX file 18736>8 beshort x (version %04x) 18737 18738#------------------------------------------------------------------------------ 18739# $File: mozilla,v 1.8 2018/01/17 12:08:36 christos Exp $ 18740# mozilla: file(1) magic for Mozilla XUL fastload files 18741# (XUL.mfasl and XPC.mfasl) 18742# URL: http://www.mozilla.org/ 18743# From: Josh Triplett <josh@freedesktop.org> 18744 187450 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data 187460 string mozLz4a Mozilla lz4 compressed bookmark data 18747 18748# From: Joerg Jenderek 18749# URL: https://en.wikipedia.org/wiki/Firefox_4 18750# Reference: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT 18751# Note: Most ZIP utilities are able to extract such archives 18752# maybe only partly or after some warnings. Example: 18753# zip -FF omni.ja --out omni.zip 187544 string PK\001\002 Mozilla archive omni.ja 18755!:mime application/x-zip 18756!:ext ja 18757# TODO: 18758#>4 use zip-dir-entry 18759 18760#------------------------------------------------------------------------------ 18761# $File: msdos,v 1.124 2018/07/10 04:05:50 christos Exp $ 18762# msdos: file(1) magic for MS-DOS files 18763# 18764 18765# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) 18766# updated by Joerg Jenderek at Oct 2008,Apr 2011 187670 string/t @ 18768>1 string/cW \ echo\ off DOS batch file text 18769!:mime text/x-msdos-batch 18770>1 string/cW echo\ off DOS batch file text 18771!:mime text/x-msdos-batch 18772>1 string/cW rem DOS batch file text 18773!:mime text/x-msdos-batch 18774>1 string/cW set\ DOS batch file text 18775!:mime text/x-msdos-batch 18776 18777 18778# OS/2 batch files are REXX. the second regex is a bit generic, oh well 18779# the matched commands seem to be common in REXX and uncommon elsewhere 18780100 search/0xffff rxfuncadd 18781>100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text 18782100 search/0xffff say 18783>100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text 18784 18785# updated by Joerg Jenderek at Oct 2015 18786# https://de.wikipedia.org/wiki/Common_Object_File_Format 18787# http://www.delorie.com/djgpp/doc/coff/filhdr.html 18788# ./intel already labeled COFF type 0x14c=0514 as "80386 COFF executable" 18789#0 leshort 0x14c MS Windows COFF Intel 80386 object file 18790#>4 ledate x stamp %s 187910 leshort 0x166 MS Windows COFF MIPS R4000 object file 18792#>4 ledate x stamp %s 187930 leshort 0x184 MS Windows COFF Alpha object file 18794#>4 ledate x stamp %s 187950 leshort 0x268 MS Windows COFF Motorola 68000 object file 18796#>4 ledate x stamp %s 187970 leshort 0x1f0 MS Windows COFF PowerPC object file 18798#>4 ledate x stamp %s 187990 leshort 0x290 MS Windows COFF PA-RISC object file 18800#>4 ledate x stamp %s 18801 18802# Tests for various EXE types. 18803# 18804# Many of the compressed formats were extraced from IDARC 1.23 source code. 18805# 188060 string/b MZ 18807# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file. 18808>0x18 leshort <0x40 MS-DOS executable 18809!:mime application/x-dosexec 18810# These traditional tests usually work but not always. When test quality support is 18811# implemented these can be turned on. 18812#>>0x18 leshort 0x1c (Borland compiler) 18813#>>0x18 leshort 0x1e (MS compiler) 18814 18815# If the relocation table is 0x40 or more bytes into the file, it's definitely 18816# not a DOS EXE. 18817>0x18 leshort >0x3f 18818 18819# Maybe it's a PE? 18820>>(0x3c.l) string PE\0\0 PE 18821!:mime application/x-dosexec 18822>>>(0x3c.l+24) leshort 0x010b \b32 executable 18823>>>(0x3c.l+24) leshort 0x020b \b32+ executable 18824>>>(0x3c.l+24) leshort 0x0107 ROM image 18825>>>(0x3c.l+24) default x Unknown PE signature 18826>>>>&0 leshort x 0x%x 18827>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) 18828>>>(0x3c.l+92) leshort 1 (native) 18829>>>(0x3c.l+92) leshort 2 (GUI) 18830>>>(0x3c.l+92) leshort 3 (console) 18831>>>(0x3c.l+92) leshort 7 (POSIX) 18832>>>(0x3c.l+92) leshort 9 (Windows CE) 18833>>>(0x3c.l+92) leshort 10 (EFI application) 18834>>>(0x3c.l+92) leshort 11 (EFI boot service driver) 18835>>>(0x3c.l+92) leshort 12 (EFI runtime driver) 18836>>>(0x3c.l+92) leshort 13 (EFI ROM) 18837>>>(0x3c.l+92) leshort 14 (XBOX) 18838>>>(0x3c.l+92) leshort 15 (Windows boot application) 18839>>>(0x3c.l+92) default x (Unknown subsystem 18840>>>>&0 leshort x 0x%x) 18841>>>(0x3c.l+4) leshort 0x14c Intel 80386 18842>>>(0x3c.l+4) leshort 0x166 MIPS R4000 18843>>>(0x3c.l+4) leshort 0x168 MIPS R10000 18844>>>(0x3c.l+4) leshort 0x184 Alpha 18845>>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3 18846>>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4 18847>>>(0x3c.l+4) leshort 0x1c0 ARM 18848>>>(0x3c.l+4) leshort 0x1c2 ARM Thumb 18849>>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb 18850>>>(0x3c.l+4) leshort 0x1f0 PowerPC 18851>>>(0x3c.l+4) leshort 0x200 Intel Itanium 18852>>>(0x3c.l+4) leshort 0x266 MIPS16 18853>>>(0x3c.l+4) leshort 0x268 Motorola 68000 18854>>>(0x3c.l+4) leshort 0x290 PA-RISC 18855>>>(0x3c.l+4) leshort 0x366 MIPSIV 18856>>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU 18857>>>(0x3c.l+4) leshort 0xebc EFI byte code 18858>>>(0x3c.l+4) leshort 0x8664 x86-64 18859>>>(0x3c.l+4) leshort 0xc0ee MSIL 18860>>>(0x3c.l+4) default x Unknown processor type 18861>>>>&0 leshort x 0x%x 18862>>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB) 18863>>>(0x3c.l+22) leshort&0x1000 >0 system file 18864>>>(0x3c.l+24) leshort 0x010b 18865>>>>(0x3c.l+232) lelong >0 Mono/.Net assembly 18866>>>(0x3c.l+24) leshort 0x020b 18867>>>>(0x3c.l+248) lelong >0 Mono/.Net assembly 18868 18869# hooray, there's a DOS extender using the PE format, with a valid PE 18870# executable inside (which just prints a message and exits if run in win) 18871>>>(8.s*16) string 32STUB \b, 32rtm DOS extender 18872>>>(8.s*16) string !32STUB \b, for MS Windows 18873>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed 18874>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed 18875>>>(0x3c.l+0xf8) search/0x140 UPX2 18876>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 18877>>>(0x3c.l+0xf8) search/0x140 .idata 18878>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 18879>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive 18880>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive 18881>>>(0x3c.l+0xf8) search/0x140 .rsrc 18882>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive 18883>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive 18884>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive 18885>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive 18886>>>(0x3c.l+0xf8) search/0x140 .data 18887>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive 18888>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed 18889>>>>(0x3c.l+0xf7) byte x 18890>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive 18891>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive 18892>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive 18893>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) 18894>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive 18895>>>0x30 string Inno \b, InnoSetup self-extracting archive 18896 18897# Hmm, not a PE but the relocation table is too high for a traditional DOS exe, 18898# must be one of the unusual subformats. 18899>>(0x3c.l) string !PE\0\0 MS-DOS executable 18900!:mime application/x-dosexec 18901 18902>>(0x3c.l) string NE \b, NE 18903!:mime application/x-dosexec 18904>>>(0x3c.l+0x36) byte 1 for OS/2 1.x 18905>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x 18906>>>(0x3c.l+0x36) byte 3 for MS-DOS 18907>>>(0x3c.l+0x36) byte 4 for Windows 386 18908>>>(0x3c.l+0x36) byte 5 for Borland Operating System Services 18909>>>(0x3c.l+0x36) default x 18910>>>>(0x3c.l+0x36) byte x (unknown OS %x) 18911>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender 18912>>>(0x3c.l+0x0c) leshort&0x8003 0x8002 (DLL) 18913>>>(0x3c.l+0x0c) leshort&0x8003 0x8001 (driver) 18914>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive 18915>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) 18916 18917>>(0x3c.l) string LX\0\0 \b, LX 18918!:mime application/x-dosexec 18919>>>(0x3c.l+0x0a) leshort <1 (unknown OS) 18920>>>(0x3c.l+0x0a) leshort 1 for OS/2 18921>>>(0x3c.l+0x0a) leshort 2 for MS Windows 18922>>>(0x3c.l+0x0a) leshort 3 for DOS 18923>>>(0x3c.l+0x0a) leshort >3 (unknown OS) 18924>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL) 18925>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver) 18926>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI) 18927>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console) 18928>>>(0x3c.l+0x08) leshort 1 i80286 18929>>>(0x3c.l+0x08) leshort 2 i80386 18930>>>(0x3c.l+0x08) leshort 3 i80486 18931>>>(8.s*16) string emx \b, emx 18932>>>>&1 string x %s 18933>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive 18934 18935# MS Windows system file, supposedly a collection of LE executables 18936>>(0x3c.l) string W3 \b, W3 for MS Windows 18937!:mime application/x-dosexec 18938 18939>>(0x3c.l) string LE\0\0 \b, LE executable 18940!:mime application/x-dosexec 18941>>>(0x3c.l+0x0a) leshort 1 18942# some DOS extenders use LE files with OS/2 header 18943>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 18944>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender 18945>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender 18946>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender 18947>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub) 18948>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub) 18949>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded) 18950# this is a wild guess; hopefully it is a specific signature 18951>>>>&0x24 lelong <0x50 18952>>>>>(&0x4c.l) string \xfc\xb8WATCOM 18953>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed 18954# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP 18955#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 18956# fails with DOS-Extenders. 18957>>>(0x3c.l+0x0a) leshort 2 for MS Windows 18958>>>(0x3c.l+0x0a) leshort 3 for DOS 18959>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD) 18960>>>(&0x7c.l+0x26) string UPX \b, UPX compressed 18961>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive 18962 18963# looks like ASCII, probably some embedded copyright message. 18964# and definitely not NE/LE/LX/PE 18965>>0x3c lelong >0x20000000 18966>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS 18967!:mime application/x-dosexec 18968# header data too small for extended executable 18969>2 long !0 18970>>0x18 leshort <0x40 18971>>>(4.s*512) leshort !0x014c 18972 18973>>>>&(2.s-514) string !LE 18974>>>>>&-2 string !BW \b, MZ for MS-DOS 18975!:mime application/x-dosexec 18976>>>>&(2.s-514) string LE \b, LE 18977>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 18978# educated guess since indirection is still not capable enough for complex offset 18979# calculations (next embedded executable would be at &(&2*512+&0-2) 18980# I suspect there are only LE executables in these multi-exe files 18981>>>>&(2.s-514) string BW 18982>>>>>0x240 search/0x100 DOS/4G \b, LE for MS-DOS, DOS4GW DOS extender (embedded) 18983>>>>>0x240 search/0x100 !DOS/4G \b, BW collection for MS-DOS 18984 18985# This sequence skips to the first COFF segment, usually .text 18986>(4.s*512) leshort 0x014c \b, COFF 18987!:mime application/x-dosexec 18988>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender 18989>>(8.s*16) string emx 18990>>>&1 string x for DOS, Win or OS/2, emx %s 18991>>&(&0x42.l-3) byte x 18992>>>&0x26 string UPX \b, UPX compressed 18993# and yet another guess: small .text, and after large .data is unusal, could be 32lite 18994>>&0x2c search/0xa0 .text 18995>>>&0x0b lelong <0x2000 18996>>>>&0 lelong >0x6000 \b, 32lite compressed 18997 18998>(8.s*16) string $WdX \b, WDos/X DOS extender 18999 19000# By now an executable type should have been printed out. The executable 19001# may be a self-uncompressing archive, so look for evidence of that and 19002# print it out. 19003# 19004# Some signatures below from Greg Roelofs, newt@uchicago.edu. 19005# 19006>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed 19007>0xe7 string LH/2\ Self-Extract \b, %s 19008>0x1c string UC2X \b, UCEXE compressed 19009>0x1c string WWP\ \b, WWPACK compressed 19010>0x1c string RJSX \b, ARJ self-extracting archive 19011>0x1c string diet \b, diet compressed 19012>0x1c string LZ09 \b, LZEXE v0.90 compressed 19013>0x1c string LZ91 \b, LZEXE v0.91 compressed 19014>0x1c string tz \b, TinyProg compressed 19015>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive 19016!:mime application/zip 19017# Yes, this really is "Copr", not "Corp." 19018>0x1e string PKLITE\ Copr. Self-extracting PKZIP archive 19019!:mime application/zip 19020# winarj stores a message in the stub instead of the sig in the MZ header 19021>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive 19022>0x20 string AIN 19023>>0x23 string 2 \b, AIN 2.x compressed 19024>>0x23 string <2 \b, AIN 1.x compressed 19025>>0x23 string >2 \b, AIN 1.x compressed 19026>0x24 string LHa's\ SFX \b, LHa self-extracting archive 19027!:mime application/x-lha 19028>0x24 string LHA's\ SFX \b, LHa self-extracting archive 19029!:mime application/x-lha 19030>0x24 string \ $ARX \b, ARX self-extracting archive 19031>0x24 string \ $LHarc \b, LHarc self-extracting archive 19032>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive 19033>0x40 string aPKG \b, aPackage self-extracting archive 19034>0x64 string W\ Collis\0\0 \b, Compack compressed 19035>0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive 19036>>&0xf4 search/0x140 \x0\x40\x1\x0 19037>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive 19038>1638 string -lh5- \b, LHa self-extracting archive v2.13S 19039>0x17888 string Rar! \b, RAR self-extracting archive 19040 19041# Skip to the end of the EXE. This will usually work fine in the PE case 19042# because the MZ image is hardcoded into the toolchain and almost certainly 19043# won't match any of these signatures. 19044>(4.s*512) long x 19045>>&(2.s-517) byte x 19046>>>&0 string PK\3\4 \b, ZIP self-extracting archive 19047>>>&0 string Rar! \b, RAR self-extracting archive 19048>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive 19049>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive 19050>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive 19051>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive 19052>>>&7 search/400 **ACE** \b, ACE self-extracting archive 19053>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive 19054 19055# a few unknown ZIP sfxes, no idea if they are needed or if they are 19056# already captured by the generic patterns above 19057>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) 19058# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive 19059# 19060 19061# TELVOX Teleinformatica CODEC self-extractor for OS/2: 19062>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 19063>>49824 leshort =1 \b, 1 file 19064>>49824 leshort >1 \b, %u files 19065 19066# added by Joerg Jenderek of http://www.freedos.org/software/?prog=kc 19067# and http://www.freedos.org/software/?prog=kpdos 19068# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD 190690 string/b KCF FreeDOS KEYBoard Layout collection 19070# only version=0x100 found 19071>3 uleshort x \b, version 0x%x 19072# length of string containing author,info and special characters 19073>6 ubyte >0 19074#>>6 pstring x \b, name=%s 19075>>7 string >\0 \b, author=%-.14s 19076>>7 search/254 \xff \b, info= 19077#>>>&0 string x \b%-s 19078>>>&0 string x \b%-.15s 19079# for FreeDOS *.KL files 190800 string/b KLF FreeDOS KEYBoard Layout file 19081# only version=0x100 or 0x101 found 19082>3 uleshort x \b, version 0x%x 19083# stringlength 19084>5 ubyte >0 19085>>8 string x \b, name=%-.2s 190860 string \xffKEYB\ \ \ \0\0\0\0 19087>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file 19088 19089# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017 19090# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009 190910 ulequad&0x07a0ffffffff 0xffffffff 19092>0 use msdos-driver 190930 name msdos-driver DOS executable ( 19094#!:mime application/octet-stream 19095!:mime application/x-dosdriver 19096# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN 19097!:ext sys/dev/bin 19098>40 search/7 UPX! \bUPX compressed 19099# DOS device driver attributes 19100>4 uleshort&0x8000 0x0000 \bblock device driver 19101# character device 19102>4 uleshort&0x8000 0x8000 \b 19103>>4 uleshort&0x0008 0x0008 \bclock 19104# fast video output by int 29h 19105>>4 uleshort&0x0010 0x0010 \bfast 19106# standard input/output device 19107>>4 uleshort&0x0003 >0 \bstandard 19108>>>4 uleshort&0x0001 0x0001 \binput 19109>>>4 uleshort&0x0003 0x0003 \b/ 19110>>>4 uleshort&0x0002 0x0002 \boutput 19111>>4 uleshort&0x8000 0x8000 \bcharacter device driver 19112>0 ubyte x 19113# upx compressed device driver has garbage instead of real in name field of header 19114>>40 search/7 UPX! 19115>>40 default x 19116# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped 19117>>>12 ubyte >0x2E \b 19118>>>>10 ubyte >0x20 19119>>>>>10 ubyte !0x2E 19120>>>>>>10 ubyte !0x2A \b%c 19121>>>>11 ubyte >0x20 19122>>>>>11 ubyte !0x2E \b%c 19123>>>>12 ubyte >0x20 19124>>>>>12 ubyte !0x39 19125>>>>>>12 ubyte !0x2E \b%c 19126>>>13 ubyte >0x20 19127>>>>13 ubyte !0x2E \b%c 19128>>>>14 ubyte >0x20 19129>>>>>14 ubyte !0x2E \b%c 19130>>>>15 ubyte >0x20 19131>>>>>15 ubyte !0x2E \b%c 19132>>>>16 ubyte >0x20 19133>>>>>16 ubyte !0x2E 19134>>>>>>16 ubyte <0xCB \b%c 19135>>>>17 ubyte >0x20 19136>>>>>17 ubyte !0x2E 19137>>>>>>17 ubyte <0x90 \b%c 19138# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field 19139>>>12 ubyte <0x2F 19140# they have their real name at offset 22 19141# also block device drivers like DUMBDRV.SYS 19142>>>>22 string >\056 %-.6s 19143>4 uleshort&0x8000 0x0000 19144# 32 bit sector addressing ( > 32 MB) for block devices 19145>>4 uleshort&0x0002 0x0002 \b,32-bit sector- 19146# support by driver functions 13h, 17h, 18h 19147>4 uleshort&0x0040 0x0040 \b,IOCTL- 19148# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh 19149>4 uleshort&0x0800 0x0800 \b,close media- 19150# output until busy support by int 10h for character device driver 19151>4 uleshort&0x8000 0x8000 19152>>4 uleshort&0x2000 0x2000 \b,until busy- 19153# direct read/write support by driver functions 03h,0Ch 19154>4 uleshort&0x4000 0x4000 \b,control strings- 19155>4 uleshort&0x8000 0x8000 19156>>4 uleshort&0x6840 >0 \bsupport 19157>4 uleshort&0x8000 0x0000 19158>>4 uleshort&0x4842 >0 \bsupport 19159>0 ubyte x \b) 19160# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header 191610 ulequad 0x0513c00000000012 19162>0 use msdos-driver 19163# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field 191640 ulequad 0x32f28000ffff0016 19165>0 use msdos-driver 191660 ulequad 0x007f00000000ffff 19167>0 use msdos-driver 191680 ulequad 0x001600000000ffff 19169>0 use msdos-driver 19170# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field 191710 ulequad 0x0bf708c2ffffffff 19172>0 use msdos-driver 191730 ulequad 0x07bd08c2ffffffff 19174>0 use msdos-driver 19175 19176# updated by Joerg Jenderek 19177# GRR: line below too general as it catches also 19178# rt.lib DYADISKS.PIC and many more 19179# start with assembler instruction MOV 191800 ubyte 0x8c 19181# skip "AppleWorks word processor data" like ARTICLE.1 ./apple 19182>4 string !O==== 19183# skip some unknown basic binaries like RocketRnger.SHR 19184>>5 string !MAIN 19185# skip "GPG symmetrically encrypted data" ./gnu 19186# skip "PGP symmetric key encrypted data" ./pgp 19187# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type 19188>>>4 ubyte >13 DOS executable (COM, 0x8C-variant) 19189# the remaining files should be DOS *.COM executables 19190# dosshell.COM 8cc0 2ea35f07 e85211 e88a11 b80058 cd 19191# hmload.COM 8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4 19192# UNDELETE.COM 8cca 2e8916 6503 b430 cd21 8b 2e0200 8b 19193# BOOTFIX.COM 8cca 2e8916 9603 b430 cd21 8b 2e0200 8b 19194# RAWRITE3.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 19195# SHARE.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 19196# validchr.COM 8cca 2e8916 9603 b430 cd21 8b 2e028b1e 19197# devload.COM 8cca 8916ad01 b430 cd21 8b2e0200 892e 19198!:mime application/x-dosexec 19199!:ext com 19200 19201# updated by Joerg Jenderek at Oct 2008 192020 ulelong 0xffff10eb DR-DOS executable (COM) 19203# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb 192040 ubeshort&0xeb8d >0xeb00 19205# DR-DOS STACKER.COM SCREATE.SYS missed 19206 192070 name msdos-com 19208>0 byte x DOS executable (COM) 19209>6 string SFX\ of\ LHarc \b, %s 19210>0x1FE leshort 0xAA55 \b, boot code 19211>85 string UPX \b, UPX compressed 19212>4 string \ $ARX \b, ARX self-extracting archive 19213>4 string \ $LHarc \b, LHarc self-extracting archive 19214>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive 19215 19216# JMP 8bit 192170 byte 0xeb 19218# allow forward jumps only 19219>1 byte >-1 19220# that offset must be accessible 19221>>(1.b+2) byte x 19222>>>0 use msdos-com 19223 19224# JMP 16bit 192250 byte 0xe9 19226# forward jumps 19227>1 short >-1 19228# that offset must be accessible 19229>>(1.s+3) byte x 19230>>>0 use msdos-com 19231# negative offset, must not lead into PSP 19232>1 short <-259 19233# that offset must be accessible 19234>>(1,s+65539) byte x 19235>>>0 use msdos-com 19236 19237# updated by Joerg Jenderek at Oct 2008,2015 19238# following line is too general 192390 ubyte 0xb8 19240# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux 19241>0 string !\xb8\xc0\x07\x8e 19242# modified by Joerg Jenderek 19243# syslinux COM32 or COM32R executable 19244>>1 lelong&0xFFFFFFFe 0x21CD4CFe COM executable (32-bit COMBOOT 19245# http://www.syslinux.org/wiki/index.php/Comboot_API 19246# Since version 5.00 c32 modules switched from the COM32 object format to ELF 19247!:mime application/x-c32-comboot-syslinux-exec 19248!:ext c32 19249# http://syslinux.zytor.com/comboot.php 19250# older syslinux version ( <4 ) 19251# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode 19252# start with assembler instructions mov eax,21cd4cffh 19253>>>1 lelong 0x21CD4CFf \b) 19254# syslinux:doc/comboot.txt 19255# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov 19256# eax,21cd4cfeh) as a magic number. 19257# syslinux version (4.x) 19258# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID 19259>>>1 lelong 0x21CD4CFe \b, relocatable) 19260# remaining are DOS COM executables starting with assembler instruction MOV 19261# like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM 19262# MS-DOS SYS.COM RESTART.COM 19263# SYSLINUX.COM (version 1.40 - 2.13) 19264# GFXBOOT.COM (version 3.75) 19265# COPYBS.COM POWEROFF.COM INT18.COM 19266>>1 default x COM executable for DOS 19267!:mime application/x-dosexec 19268#!:mime application/x-ms-dos-executable 19269#!:mime application/x-msdos-program 19270!:ext com 19271 192720 string/b \x81\xfc 19273>4 string \x77\x02\xcd\x20\xb9 19274>>36 string UPX! FREE-DOS executable (COM), UPX compressed 19275252 string Must\ have\ DOS\ version DR-DOS executable (COM) 19276# added by Joerg Jenderek at Oct 2008 19277# GRR search is not working 19278#34 search/2 UPX! FREE-DOS executable (COM), UPX compressed 1927934 string UPX! FREE-DOS executable (COM), UPX compressed 1928035 string UPX! FREE-DOS executable (COM), UPX compressed 19281# GRR search is not working 19282#2 search/28 \xcd\x21 COM executable for MS-DOS 19283#WHICHFAT.cOM 192842 string \xcd\x21 COM executable for DOS 19285#DELTREE.cOM DELTREE2.cOM 192864 string \xcd\x21 COM executable for DOS 19287#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM 192885 string \xcd\x21 COM executable for DOS 19289#DELTMP.COm HASFAT32.cOM 192907 string \xcd\x21 19291>0 byte !0xb8 COM executable for DOS 19292#COMP.cOM MORE.COm 1929310 string \xcd\x21 19294>5 string !\xcd\x21 COM executable for DOS 19295#comecho.com 1929613 string \xcd\x21 COM executable for DOS 19297#HELP.COm EDIT.coM 1929818 string \xcd\x21 COM executable for MS-DOS 19299#NWRPLTRM.COm 1930023 string \xcd\x21 COM executable for MS-DOS 19301#LOADFIX.cOm LOADFIX.cOm 1930230 string \xcd\x21 COM executable for MS-DOS 19303#syslinux.com 3.11 1930470 string \xcd\x21 COM executable for DOS 19305# many compressed/converted COMs start with a copy loop instead of a jump 193060x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS 193070x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS 19308>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed 193090x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed 19310# FIXME: missing diet .com compression 19311 19312# miscellaneous formats 193130 string/b LZ MS-DOS executable (built-in) 19314#0 byte 0xf0 MS-DOS program library data 19315# 19316 19317# AAF files: 19318# <stuartc@rd.bbc.co.uk> Stuart Cunningham 193190 string/b \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage 19320>30 byte 9 (512B sectors) 19321>30 byte 12 (4kB sectors) 193220 string/b \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage 19323>30 byte 9 (512B sectors) 19324>30 byte 12 (4kB sectors) 19325 19326# Popular applications 193272080 string Microsoft\ Word\ 6.0\ Document %s 19328!:mime application/msword 193292080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data 19330!:mime application/msword 19331# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word) 193322112 string MSWordDoc Microsoft Word document data 19333!:mime application/msword 19334# 193350 belong 0x31be0000 Microsoft Word Document 19336!:mime application/msword 19337# 193380 string/b PO^Q` Microsoft Word 6.0 Document 19339!:mime application/msword 19340# 193414 long 0 19342>0 belong 0xfe320000 Microsoft Word for Macintosh 1.0 19343!:mime application/msword 19344!:ext mcw 19345>0 belong 0xfe340000 Microsoft Word for Macintosh 3.0 19346!:mime application/msword 19347!:ext mcw 19348>0 belong 0xfe37001c Microsoft Word for Macintosh 4.0 19349!:mime application/msword 19350!:ext mcw 19351>0 belong 0xfe370023 Microsoft Word for Macintosh 5.0 19352!:mime application/msword 19353!:ext mcw 19354 193550 string/b \333\245-\0\0\0 Microsoft Word 2.0 Document 19356!:mime application/msword 19357!:ext doc 19358# Note: seems already recognized as "OLE 2 Compound Document" in ./ole2compounddocs 19359#512 string/b \354\245\301 Microsoft Word Document 19360#!:mime application/msword 19361 19362# 193630 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 19364!:mime application/msword 19365# 193662080 string Microsoft\ Excel\ 5.0\ Worksheet %s 19367!:mime application/vnd.ms-excel 19368# 193690 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 19370!:mime application/msword 19371 193722080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s 19373!:mime application/vnd.ms-excel 19374# 19375# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel) 193762114 string Biff5 Microsoft Excel 5.0 Worksheet 19377!:mime application/vnd.ms-excel 19378# Italian MS-Excel 193792121 string Biff5 Microsoft Excel 5.0 Worksheet 19380!:mime application/vnd.ms-excel 193810 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet 19382!:mime application/vnd.ms-excel 19383# 19384# Update: Joerg Jenderek 19385# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3 19386# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf 19387# Note: newer Lotus versions >2 use longer BOF record 19388# record type (BeginningOfFile=0000h) + length (001Ah) 193890 belong 0x00001a00 19390# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3 19391#>18 uleshort&0x73E0 0 19392# Lotus Multi Byte Character Set (LMBCS=1-31) 19393>20 ubyte >0 19394>>20 ubyte <32 Lotus 1-2-3 19395#!:mime application/x-123 19396!:mime application/vnd.lotus-1-2-3 19397!:apple ????L123 19398# (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data" 19399>>>4 uleshort 0x1000 WorKsheet, version 3 19400!:ext wk3 19401# (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data" 19402>>>4 uleshort 0x1002 WorKsheet, version 4 19403# also worksheet template 4 (.wt4) 19404!:ext wk4/wt4 19405# no example or documentation for wk5 19406#>>4 uleshort 0x???? WorKsheet, version 4 19407#!:ext wk5 19408# only MacrotoScript.123 example 19409>>>4 uleshort 0x1003 WorKsheet, version 97 19410# also worksheet template Smartmaster (.12M)? 19411!:ext 123 19412# only Set_Y2K.123 example 19413>>>4 uleshort 0x1005 WorKsheet, version 9.8 Millennium 19414!:ext 123 19415# no example for this version 19416>>>4 uleshort 0x8001 FoRMatting data 19417!:ext frm 19418# (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data" 19419# TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet" 19420>>>4 uleshort 0x8007 ForMatting data, version 3 19421!:ext fm3 19422>>>4 default x unknown 19423# file revision sub code 0004h for worksheets 19424>>>>6 uleshort =0x0004 worksheet 19425!:ext wXX 19426>>>>6 uleshort !0x0004 formatting data 19427!:ext fXX 19428# main revision number 19429>>>>4 uleshort x \b, revision 0x%x 19430>>>6 uleshort =0x0004 \b, cell range 19431# active cellcoord range (start row, page,column ; end row, page, column) 19432# start values normally 0~1st sheet A1 19433>>>>8 ulelong !0 19434>>>>>10 ubyte >0 \b%d* 19435>>>>>8 uleshort x \b%d, 19436>>>>>11 ubyte x \b%d- 19437# end page mostly 0 19438>>>>14 ubyte >0 \b%d* 19439# end raw, column normally not 0 19440>>>>12 uleshort x \b%d, 19441>>>>15 ubyte x \b%d 19442# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??) 19443>>>>20 ubyte >1 \b, character set 0x%x 19444# flags 19445>>>>21 ubyte x \b, flags 0x%x 19446>>>6 uleshort !0x0004 19447# record type (FONTNAME=00AEh) 19448>>>>30 search/29 \0\xAE 19449# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n) 19450>>>>>&4 string >\0 \b, 1st font "%s" 19451# 19452# Update: Joerg Jenderek 19453# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3 19454# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT 19455# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x 19456# record type (BeginningOfFile=0000h) + length (0002h) 194570 belong 0x00000200 19458# GRR: line above is too general as it catches also MS Windows CURsor 19459# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1) 19460!:strength -1 19461# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h 19462>7 ubyte 0 19463# skip Windows cursors with image width 256 and keep Lotus with positiv opcode 19464>>6 ubyte >0 Lotus 19465# !:mime application/x-123 19466!:mime application/vnd.lotus-1-2-3 19467!:apple ????L123 19468# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...) 19469# undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3" 19470>>>4 uleshort 0x0007 1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF) 19471!:ext cnf 19472>>>4 uleshort 0x0C05 1-2-3 CoNFiguration, version 2.4J 19473!:ext cnf 19474>>>4 uleshort 0x0801 1-2-3 CoNFiguration, version 1-2.1 19475!:ext cnf 19476>>>4 uleshort 0x0802 Symphony CoNFiguration 19477!:ext cnf 19478>>>4 uleshort 0x0804 1-2-3 CoNFiguration, version 2.2 19479!:ext cnf 19480>>>4 uleshort 0x080A 1-2-3 CoNFiguration, version 2.3-2.4 19481!:ext cnf 19482>>>4 uleshort 0x1402 1-2-3 CoNFiguration, version 3.x 19483!:ext cnf 19484>>>4 uleshort 0x1450 1-2-3 CoNFiguration, version 4.x 19485!:ext cnf 19486# (version 5.26) labeled the entry as "Lotus 123" 19487# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 19488>>>4 uleshort 0x0404 1-2-3 WorKSheet, version 1 19489# extension "wks" also for Microsoft Works document 19490!:ext wks 19491# (version 5.26) labeled the entry as "Lotus 123" 19492# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 19493>>>4 uleshort 0x0405 Symphony WoRksheet, version 1.0 19494!:ext wrk/wr1 19495# (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data" 19496# TrID labeles the entry as "Lotus 123 Worksheet (V2)" 19497>>>4 uleshort 0x0406 1-2-3/Symphony worksheet, version 2 19498# Symphony (.wr1) 19499!:ext wk1/wr1 19500# no example for this japan version 19501>>>4 uleshort 0x0600 1-2-3 WorKsheet, version 1.xJ 19502!:ext wj1 19503# no example or documentation for wk2 19504#>>>4 uleshort 0x???? 1-2-3 WorKsheet, version 2 19505#!:ext wk2 19506# undocumented japan version 19507>>>4 uleshort 0x0602 1-2-3 worksheet, version 2.4J 19508!:ext wj3 19509# (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data" 19510>>>4 uleshort 0x8006 1-2-3 ForMaTting data, version 2.x 19511# japan version 2.4J (fj3) 19512!:ext fmt/fj3 19513# no example for this version 19514>>>4 uleshort 0x8007 1-2-3 FoRMatting data, version 2.0 19515!:ext frm 19516# (version 5.26) labeled the entry as "Lotus 1-2-3" 19517>>>4 default x unknown worksheet or configuration 19518!:ext cnf 19519>>>>4 uleshort x \b, revision 0x%x 19520# 2nd record for most worksheets describes cells range 19521>>>6 use lotus-cells 19522# 3nd record for most japan worksheets describes cells range 19523>>>(8.s+10) use lotus-cells 19524# check and then display Lotus worksheet cells range 195250 name lotus-cells 19526# look for type (RANGE=0006h) + length (0008h) at record begin 19527>0 ubelong 0x06000800 \b, cell range 19528# cell range (start column, row, end column, row) start values normally 0,0~A1 cell 19529>>4 ulong !0 19530>>>4 uleshort x \b%d, 19531>>>6 uleshort x \b%d- 19532# end of cell range 19533>>8 uleshort x \b%d, 19534>>10 uleshort x \b%d 19535# EndOfLotus123 195360 string/b WordPro\0 Lotus WordPro 19537!:mime application/vnd.lotus-wordpro 195380 string/b WordPro\r\373 Lotus WordPro 19539!:mime application/vnd.lotus-wordpro 19540 19541 19542# Summary: Script used by InstallScield to uninstall applications 19543# Extension: .isu 19544# Submitted by: unknown 19545# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry) 195460 string \x71\xa8\x00\x00\x01\x02 19547>12 string Stirling\ Technologies, InstallShield Uninstall Script 19548 19549# Winamp .avs 19550#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 195510 string/b Nullsoft\ AVS\ Preset\ Winamp plug in 19552 19553# Windows Metafile .WMF 195540 string/b \327\315\306\232 Windows metafile 19555!:mime image/wmf 19556!:ext wmf 195570 string/b \002\000\011\000 Windows metafile 19558!:mime image/wmf 19559!:ext wmf 195600 string/b \001\000\011\000 Windows metafile 19561!:mime image/wmf 19562!:ext wmf 19563 19564#tz3 files whatever that is (MS Works files) 195650 string/b \003\001\001\004\070\001\000\000 tz3 ms-works file 195660 string/b \003\002\001\004\070\001\000\000 tz3 ms-works file 195670 string/b \003\003\001\004\070\001\000\000 tz3 ms-works file 19568 19569# PGP sig files .sig 19570#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig 195710 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig 195720 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig 195730 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig 195740 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig 195750 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig 195760 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig 19577 19578# windows zips files .dmf 195790 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file 19580 19581 19582#ico files 195830 string/b \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows 19584 19585# Windows icons 19586# Update: Joerg Jenderek 19587# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 19588# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG 195890 belong 0x00000100 19590>9 byte 0 19591>>0 byte x 19592>>0 use cur-ico-dir 19593>9 ubyte 0xff 19594>>0 byte x 19595>>0 use cur-ico-dir 19596# displays number of icons and information for icon or cursor 195970 name cur-ico-dir 19598# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with 19599# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h 19600>18 ulelong &0x00000006 19601# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG) 19602>>(18.l) ulelong x MS Windows 19603>>>0 ubelong 0x00000100 icon resource 19604#!:mime image/vnd.microsoft.icon 19605!:mime image/x-icon 19606!:ext ico 19607>>>>4 uleshort x - %d icon 19608# plural s 19609>>>>4 uleshort >1 \bs 19610# 1st icon 19611>>>>0x06 use ico-entry 19612# 2nd icon 19613>>>>4 uleshort >1 19614>>>>>0x16 use ico-entry 19615>>>0 ubelong 0x00000200 cursor resource 19616#!:mime image/x-cur 19617!:mime image/x-win-bitmap 19618!:ext cur 19619>>>>4 uleshort x - %d icon 19620>>>>4 uleshort >1 \bs 19621# 1st cursor 19622>>>>0x06 use cur-entry 19623#>>>>0x16 use cur-entry 19624# display information of one cursor entry 196250 name cur-entry 19626>0 use cur-ico-entry 19627>4 uleshort x \b, hotspot @%dx 19628>6 uleshort x \b%d 19629# display information of one icon entry 196300 name ico-entry 19631>0 use cur-ico-entry 19632# normally 0 1 but also found 14 19633>4 uleshort >1 \b, %d planes 19634# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256 19635>6 uleshort >1 \b, %d bits/pixel 19636# display shared information of cursor or icon entry 196370 name cur-ico-entry 19638>0 byte =0 \b, 256x 19639>0 byte !0 \b, %dx 19640>1 byte =0 \b256 19641>1 byte !0 \b%d 19642# number of colors in palette 19643>2 ubyte !0 \b, %d colors 19644# reserved 0 FFh 19645#>3 ubyte x \b, reserved %x 19646#>8 ulelong x \b, image size %d 19647# offset of PNG or DIB image 19648#>12 ulelong x \b, offset 0x%x 19649# PNG header (\x89PNG) 19650>(12.l) ubelong =0x89504e47 19651>>&-4 indirect x \b with 19652# DIB image 19653>(12.l) ubelong !0x89504e47 19654#>>&-4 use dib-image 19655 19656# Windows non-animated cursors 19657# Update: Joerg Jenderek 19658# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 19659# Note: similar to Windows ICOn. container for BMP ( only DIB part) 19660# GRR: line below is too general as it catches also Lotus 1-2-3 files 196610 belong 0x00000200 19662>9 byte 0 19663>>0 use cur-ico-dir 19664>9 ubyte 0xff 19665>>0 use cur-ico-dir 19666 19667# .chr files 196680 string/b PK\010\010BGI Borland font 19669>4 string >\0 %s 19670# then there is a copyright notice 19671 19672 19673# .bgi files 196740 string/b pk\010\010BGI Borland device 19675>4 string >\0 %s 19676# then there is a copyright notice 19677 19678 19679# Windows Recycle Bin record file (named INFO2) 19680# By Abel Cheung (abelcheung AT gmail dot com) 19681# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes 19682# Since Vista uses another structure, INFO2 structure probably won't change 19683# anymore. Detailed analysis in: 19684# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf 196850 lelong 0x00000004 19686>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below) 19687 196880 lelong 0x00000005 19689>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP) 19690 19691# From Doug Lee via a FreeBSD pr 196929 string GERBILDOC First Choice document 196939 string GERBILDB First Choice database 196949 string GERBILCLIP First Choice database 196950 string GERBIL First Choice device file 196969 string RABBITGRAPH RabbitGraph file 196970 string DCU1 Borland Delphi .DCU file 196980 string =!<spell> MKS Spell hash list (old format) 196990 string =!<spell2> MKS Spell hash list 19700# Too simple - MPi 19701#0 string AH Halo(TM) bitmapped font file 197020 lelong 0x08086b70 TurboC BGI file 197030 lelong 0x08084b50 TurboC Font file 19704 19705# Debian#712046: The magic below identifies "Delphi compiled form data". 19706# An additional source of information is available at: 19707# http://www.woodmann.com/fravia/dafix_t1.htm 197080 string TPF0 19709>4 pstring >\0 Delphi compiled form '%s' 19710 19711# tests for DBase files moved, updated and merged to database 19712 197130 string PMCC Windows 3.x .GRP file 197141 string RDC-meg MegaDots 19715>8 byte >0x2F version %c 19716>9 byte >0x2F \b.%c file 197170 lelong 0x4C 19718>4 lelong 0x00021401 Windows shortcut file 19719 19720# .PIF files added by Joerg Jenderek from http://smsoft.ru/en/pifdoc.htm 19721# only for windows versions equal or greater 3.0 197220x171 string MICROSOFT\ PIFEX\0 Windows Program Information File 19723!:mime application/x-dosexec 19724#>2 string >\0 \b, Title:%.30s 19725>0x24 string >\0 \b for %.63s 19726>0x65 string >\0 \b, directory=%.64s 19727>0xA5 string >\0 \b, parameters=%.64s 19728#>0x181 leshort x \b, offset %x 19729#>0x183 leshort x \b, offsetdata %x 19730#>0x185 leshort x \b, section length %x 19731>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0 19732>>&0x5e ubyte >0 19733>>>&-1 string <PIFMGR.DLL \b, icon=%s 19734#>>>&-1 string PIFMGR.DLL \b, icon=%s 19735>>>&-1 string >PIFMGR.DLL \b, icon=%s 19736>>&0xF0 ubyte >0 19737>>>&-1 string <Terminal \b, font=%.32s 19738#>>>&-1 string =Terminal \b, font=%.32s 19739>>>&-1 string >Terminal \b, font=%.32s 19740>>&0x110 ubyte >0 19741>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s 19742#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s 19743>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s 19744#>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style 19745#>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style 19746>0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style 19747#>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style 19748>0x187 search/0xB55 CONFIG\ \ SYS\ 4.0\0 \b +CONFIG.SYS 19749#>>&06 string x \b:%s 19750>0x187 search/0xB55 AUTOEXECBAT\ 4.0\0 \b +AUTOEXEC.BAT 19751#>>&06 string x \b:%s 19752 19753# DOS EPS Binary File Header 19754# From: Ed Sznyter <ews@Black.Market.NET> 197550 belong 0xC5D0D3C6 DOS EPS Binary File 19756!:mime image/x-eps 19757>4 long >0 Postscript starts at byte %d 19758>>8 long >0 length %d 19759>>>12 long >0 Metafile starts at byte %d 19760>>>>16 long >0 length %d 19761>>>20 long >0 TIFF starts at byte %d 19762>>>>24 long >0 length %d 19763 19764# TNEF magic From "Joomy" <joomy@se-ed.net> 19765# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF) 197660 lelong 0x223e9f78 TNEF 19767!:mime application/vnd.ms-tnef 19768 19769# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C 19770# of http://www.davep.org/norton-guides/ng2h-105.tgz 19771# http://en.wikipedia.org/wiki/Norton_Guides 197720 string NG\0\001 19773# only value 0x100 found at offset 2 19774>2 ulelong 0x00000100 Norton Guide 19775# Title[40] 19776>>8 string >\0 "%-.40s" 19777#>>6 uleshort x \b, MenuCount=%u 19778# szCredits[5][66] 19779>>48 string >\0 \b, %-.66s 19780>>114 string >\0 %-.66s 19781 19782# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS 19783# of http://www.4dos.info/ 19784# pointer,HelpID[8]=4DHnnnmm 197850 ulelong 0x48443408 4DOS help file 19786>4 string x \b, version %-4.4s 19787 19788# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp 197890 ulequad 0x3a000000024e4c MS Advisor help file 19790 19791# HtmlHelp files (.chm) 197920 string/b ITSF\003\000\000\000\x60\000\000\000 MS Windows HtmlHelp Data 19793 19794# GFA-BASIC (Wolfram Kleff) 197952 string/b GFA-BASIC3 GFA-BASIC 3 data 19796 19797#------------------------------------------------------------------------------ 19798# From Stuart Caie <kyzer@4u.net> (developer of cabextract) 19799# Update: Joerg Jenderek 19800# URL: https://en.wikipedia.org/wiki/Cabinet_(file_format) 19801# Reference: https://msdn.microsoft.com/en-us/library/bb267310.aspx 19802# Note: verified by `7z l *.cab` 19803# Microsoft Cabinet files 198040 string/b MSCF\0\0\0\0 Microsoft Cabinet archive data 19805# 19806# https://support.microsoft.com/en-us/help/973559/frequently-asked-questions-about-the-microsoft-support-diagnostic-tool 19807# CAB with *.{diagcfg,diagpkg} is used by Microsoft Support Diagnostic Tool MSDT.EXE 19808# because some archive does not have *.diag* as 1st or 2nd archive member like 19809# O15CTRRemove.diagcab or AzureStorageAnalyticsLogs_global.DiagCab 19810# brute looking after header for filenames with diagcfg or diagpkg extension in CFFILE section 19811>0x2c search/980/c .diag \b, Diagnostic 19812!:mime application/vnd.ms-cab-compressed 19813!:ext diagcab 19814# http://fileformats.archiveteam.org/wiki/PUZ 19815# Microsoft Publisher version about 2003 has a "Pack and Go" feature that 19816# bundles a Publisher document *PNG.pub with all links into a CAB 19817>0x2c search/300/c png.pub\0 \b, Publisher Packed and Go 19818!:mime application/vnd.ms-cab-compressed 19819!:ext puz 19820# ppz variant with Microsoft PowerPoint Viewer ppview32.exe to play PowerPoint presentation 19821>0x2c search/17/c ppview32.exe\0 \b, PowerPoint Viewer Packed and Go 19822!:mime application/vnd.ms-powerpoint 19823#!:mime application/mspowerpoint 19824!:ext ppz 19825# http://www.incredimail.com/ 19826# IncrediMail CAB contains an initialisation file "content.ini" like in im2.ims 19827>0x2c search/3369/c content.ini\0 \b, IncrediMail 19828!:mime application/x-incredimail 19829# member Flavor.htm implies IncrediMail ecard like in tell_a_friend.imf 19830>>0x2c search/83/c Flavor.htm\0 ecard 19831!:ext imf 19832# member Macromedia Flash data *.swf implies IncrediMail skin like in im2.ims 19833>>0x2c search/211/c .swf\0 skin 19834!:ext ims 19835# member anim.im3 implies IncrediMail animation like in letter_fold.ima 19836>>0x2c search/92/c anim.im3\0 animation 19837!:ext ima 19838# other IncrediMail cab archive 19839>>0x2c default x 19840>>>0x2c search/116/c thumb ecard, image, notifier or skin 19841!:ext imf/imi/imn/ims 19842# http://file-extension.net/seeker/file_extension_ime 19843>>>0x2c default x emoticons or sound 19844!:ext ime/imw 19845# no Diagnostic and IncrediMail 19846>0x2c default x 19847# look for 1st member name 19848>>(16.l+16) ubyte x 19849# https://en.wikipedia.org/wiki/SNP_file_format 19850>>>&-1 string/c _accrpt_.snp \b, Access report snapshot 19851!:mime application/msaccess 19852!:ext snp 19853# https://www.cabextract.org.uk/wince_cab_format/ 19854# extension of DOS 8+3 name with ".000" of 1st archive member name implies Windows CE installer 19855>>>&7 string =.000 \b, WinCE install 19856!:mime application/vnd.ms-cab-compressed 19857!:ext cab 19858 19859# http://support.microsoft.com/kb/934307/en-US 19860# All inspected MSU contain a file with name WSUSSCAN.cab 19861# that is called "Windows Update meta data" by Microsoft 19862>>>&-1 string/c wsusscan.cab \b, Microsoft Standalone Update 19863!:mime application/vnd.ms-cab-compressed 19864!:ext msu 19865>>>&-1 default x 19866# look at point charcter of 1st archive member name for file name extension 19867>>>>&-1 search/255 . 19868# http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm 19869# PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002 19870# packs optional files, a PowerPoint presentation *.ppt with optional PLAYLIST.LST to CAB 19871>>>>>&0 string/c ppt\0 \b, PowerPoint Packed and Go 19872!:mime application/vnd.ms-powerpoint 19873#!:mime application/mspowerpoint 19874!:ext ppz 19875# https://msdn.microsoft.com/en-us/library/windows/desktop/bb773190(v=vs.85).aspx 19876# first member *.theme implies Windows 7 Theme Pack like in CommunityShowcaseAqua3.themepack 19877# or Windows 8 Desktop Theme Pack like in PanoramicGlaciers.deskthemepack 19878>>>>>&0 string/c theme \b, Windows 19879!:mime application/x-windows-themepack 19880# http://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8 19881# 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack 19882# with MTSM=RJSPBS in [MasterThemeSelector] inside *.theme 19883>>>>>>(16.l+16) string =Panoram 8 19884!:ext deskthemepack 19885>>>>>>(16.l+16) string !Panoram 7 or 8 19886!:ext themepack/deskthemepack 19887>>>>>>(16.l+16) ubyte x Theme Pack 19888>>>>>&0 default x 19889# look for null terminator of 1st member name 19890>>>>>>&0 search/255 \0 19891# 2nd member name WSUSSCAN.cab like in Microsoft-Windows-MediaFeaturePack-OOB-Package.msu 19892>>>>>>>&16 string/c wsusscan.cab \b, Microsoft Standalone Update 19893!:mime application/vnd.ms-cab-compressed 19894!:ext msu 19895>>>>>>>&16 default x 19896# archive with more then one file need some output in version 5.32 to avoid error message like 19897# Magdir/msdos, 1138: Warning: Current entry does not yet have a description for adding a MIME type 19898# Magdir/msdos, 1139: Warning: Current entry does not yet have a description for adding a EXTENSION type 19899# file: could not find any valid magic files! 19900>>>>>>>>28 uleshort >1 \b, many 19901!:mime application/vnd.ms-cab-compressed 19902!:ext cab 19903# remaining archives with just one file 19904>>>>>>>>28 uleshort =1 19905# neither extra bytes nor cab chain implies Windows 2000,XP setup files in directory i386 19906>>>>>>>>>30 uleshort =0x0000 \b, Windows 2000/XP setup 19907# cut of last char of source extension and add underscore to generate extension 19908# TERMCAP._ ... FXSCOUNT.H_ ... L3CODECA.AC_ ... NPDRMV2.ZI_ 19909!:mime application/vnd.ms-cab-compressed 19910!:ext _/?_/??_ 19911# archive need some output like "single" in version 5.32 to avoid error messages 19912>>>>>>>>>30 uleshort !0x0000 \b, single 19913!:mime application/vnd.ms-cab-compressed 19914!:ext cab 19915# TODO: additional extensions like 19916# .xsn InfoPath Dynamic Form 19917# .xtp InfoPath Template Part 19918# .lvf Logitech Video Effects Face Accessory 19919>8 ulelong x \b, %u bytes 19920>28 uleshort 1 \b, 1 file 19921>28 uleshort >1 \b, %u files 19922# Reserved fields, set to zero 19923#>4 belong !0 \b, reserved1 %x 19924#>12 belong !0 \b, reserved2 %x 19925# offset of the first CFFILE entry coffFiles: minimal 2Ch 19926>16 ulelong x \b, at 0x%x 19927>(16.l) use cab-file 19928# at least also 2nd member 19929>28 uleshort >1 19930>>(16.l+16) ubyte x 19931>>>&0 search/255 \0 19932# second member info 19933>>>>&0 use cab-file 19934#>20 belong !0 \b, reserved %x 19935# Cabinet file format version. Currently, versionMajor = 1 and versionMinor = 3 19936>24 ubeshort !0x0301 \b version 0x%x 19937# number of CFFOLDER entries 19938>26 uleshort >1 \b, %u cffolders 19939# cabinet file option indicators 1~PREVIOUS, 2~NEXT, 4~reserved fields 19940# only found for flags 0 1 2 3 4 not 7 19941>30 uleshort >0 \b, flags 0x%x 19942# Cabinet files have a 16-bit cabinet setID field that is designed for application use. 19943# default is zero, however, the -i option of cabarc can be used to set this field 19944>32 uleshort >0 \b, ID %u 19945# iCabinet is number of this cabinet file in a set, where 0 for the first cabinet 19946#>34 uleshort x \b, iCabinet %u 19947# add one for display because humans start numbering by 1 and also fit to name of disk szDisk* 19948>34 uleshort+1 x \b, number %u 19949>30 uleshort &0x0004 \b, extra bytes 19950# cbCFHeader optional size of per-cabinet reserved area 14h 1800h 19951>>36 uleshort >0 %u in head 19952# cbCFFolder is optional size of per-folder reserved area 19953>>38 ubyte >0 %u in folder 19954# cbCFData is optional size of per-datablock reserved area 19955>>39 ubyte >0 %u in data block 19956# optional per-cabinet reserved area abReserve[cbCFHeader] 19957>>36 uleshort >0 19958# 1st CFFOLDER after reserved area in header 19959>>>(36.s+40) use cab-folder 19960# no reserved area in header 19961>30 uleshort ^0x0004 19962# no previous and next cab archive 19963>>30 uleshort =0x0000 19964>>>36 use cab-folder 19965# only previous cab archive 19966>>30 uleshort =0x0001 \b, previous 19967>>>36 use cab-anchor 19968# only next cab archive 19969>>30 uleshort =0x0002 \b, next 19970>>>36 use cab-anchor 19971# previous+next cab archive 19972# can not use sub routine cab-anchor to display previous and next cabinet together 19973#>>>36 use cab-anchor 19974#>>>>&0 use cab-anchor 19975>>30 uleshort =0x0003 \b, previous 19976>>>36 string x %s 19977# optional name of previous disk szDisk* 19978>>>>&1 string x disk %s 19979>>>>>&1 string x \b, next %s 19980# optional name of previous disk szDisk* 19981>>>>>>&1 string x disk %s 19982>>>>>>>&1 use cab-folder 19983# display filename and disk name of previous or next cabinet 199840 name cab-anchor 19985# optional name of previous/next cabinet file szCabinet*[255] 19986>&0 string x %s 19987# optional name of previous/next disk szDisk*[255] 19988>>&1 string x disk %s 19989# display folder structure CFFOLDER information like compression of cabinet 199900 name cab-folder 19991# offset of the CFDATA block in this folder 19992#>0 ulelong x \b, coffCabStart 0x%x 19993# number of CFDATA blocks in folder 19994>4 uleshort x \b, %u datablock 19995# plural s 19996>4 uleshort >1 \bs 19997# compression typeCompress: 0~None 1~MSZIP 0x1503~LZX:21 0x1003~LZX:16 0x0f03~LZX:15 19998>6 uleshort x \b, 0x%x compression 19999# optional per-folder reserved area 20000#>8 ubequad x \b, abReserve 0x%llx 20001# display member structure CFFILE information like member name of cabinet 200020 name cab-file 20003# cbFile is uncompressed size of file in bytes 20004#>0 ulelong x \b, cbFile %u 20005# uoffFolderStart is uncompressed offset of file in folder 20006#>4 ulelong >0 \b, uoffFolderStart 0x%x 20007# iFolder is index into the CFFOLDER area. 0 indicates first folder in cabinet 20008# define ifoldCONTINUED_FROM_PREV (0xFFFD) 20009# define ifoldCONTINUED_TO_NEXT (0xFFFE) 20010# define ifoldCONTINUED_PREV_AND_NEXT (0xFFFF) 20011>8 uleshort >0 \b, iFolder 0x%x 20012# date stamp for file 20013#>10 uleshort x \b, date 0x%x 20014# time stamp for file 20015#>12 uleshort x \b, time 0x%x 20016# attribs is attribute flags for file 20017# define _A_RDONLY (0x01) file is read-only 20018# define _A_HIDDEN (0x02) file is hidden 20019# define _A_SYSTEM (0x04) file is a system file 20020# define _A_ARCH (0x20) file modified since last backup 20021# example http://sebastien.kirche.free.fr/pebuilder_plugins/depends.cab 20022# define _A_EXEC (0x40) run after extraction 20023# define _A_NAME_IS_UTF (0x80) szName[] contains UTF 20024# define UNKNOWN (0x0100) undocumented or accident 20025#>14 uleshort x \b, attribs 0x%x 20026>14 uleshort >0 + 20027>>14 uleshort &0x0001 \bR 20028>>14 uleshort &0x0002 \bH 20029>>14 uleshort &0x0004 \bS 20030>>14 uleshort &0x0020 \bA 20031>>14 uleshort &0x0040 \bX 20032>>14 uleshort &0x0080 \bUtf 20033# unknown 0x0100 flag found on one XP_CD:\I386\DRIVER.CAB 20034>>14 uleshort &0x0100 \b? 20035# szName is name of archive member 20036>16 string x "%s" 20037# next archive member name if more files 20038#>>&17 string >\0 \b, NEXT NAME %-.50s 20039 20040# InstallShield Cabinet files 200410 string/b ISc( InstallShield Cabinet archive data 20042>5 byte&0xf0 =0x60 version 6, 20043>5 byte&0xf0 !0x60 version 4/5, 20044>(12.l+40) lelong x %u files 20045 20046# Windows CE package files 200470 string/b MSCE\0\0\0\0 Microsoft WinCE install header 20048>20 lelong 0 \b, architecture-independent 20049>20 lelong 103 \b, Hitachi SH3 20050>20 lelong 104 \b, Hitachi SH4 20051>20 lelong 0xA11 \b, StrongARM 20052>20 lelong 4000 \b, MIPS R4000 20053>20 lelong 10003 \b, Hitachi SH3 20054>20 lelong 10004 \b, Hitachi SH3E 20055>20 lelong 10005 \b, Hitachi SH4 20056>20 lelong 70001 \b, ARM 7TDMI 20057>52 leshort 1 \b, 1 file 20058>52 leshort >1 \b, %u files 20059>56 leshort 1 \b, 1 registry entry 20060>56 leshort >1 \b, %u registry entries 20061 20062 20063# Windows Enhanced Metafile (EMF) 20064# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp 20065# for further information. 200660 ulelong 1 20067>40 string \ EMF Windows Enhanced Metafile (EMF) image data 20068>>44 ulelong x version 0x%x 20069 20070 200710 string/b \224\246\056 Microsoft Word Document 20072!:mime application/msword 20073 20074512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document 20075!:mime application/msword 20076 20077# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 20078# Magic type for Dell's BIOS .hdr files 20079# Dell's .hdr 200800 string/b $RBU 20081>23 string Dell %s system BIOS 20082>5 byte 2 20083>>48 byte x version %d. 20084>>49 byte x \b%d. 20085>>50 byte x \b%d 20086>5 byte <2 20087>>48 string x version %.3s 20088 20089# Type: Microsoft Document Imaging Format (.mdi) 20090# URL: http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format 20091# From: Daniele Sempione <scrows@oziosi.org> 20092# Too weak (EP) 20093#0 short 0x5045 Microsoft Document Imaging Format 20094 20095# MS eBook format (.lit) 200960 string/b ITOLITLS Microsoft Reader eBook Data 20097>8 lelong x \b, version %u 20098!:mime application/x-ms-reader 20099 20100# Windows CE Binary Image Data Format 20101# From: Dr. Jesus <j@hug.gs> 201020 string/b B000FF\n Windows Embedded CE binary image 20103 20104# Windows Imaging (WIM) Image 201050 string/b MSWIM\000\000\000 Windows imaging (WIM) image 201060 string/b WLPWM\000\000\000 Windows imaging (WIM) image, wimlib pipable format 20107 20108# The second byte of these signatures is a file version; I don't know what, 20109# if anything, produced files with version numbers 0-2. 20110# From: John Elliott <johne@seasip.demon.co.uk> 201110 string \xfc\x03\x00 Mallard BASIC program data (v1.11) 201120 string \xfc\x04\x00 Mallard BASIC program data (v1.29+) 201130 string \xfc\x03\x01 Mallard BASIC protected program data (v1.11) 201140 string \xfc\x04\x01 Mallard BASIC protected program data (v1.29+) 20115 201160 string MIOPEN Mallard BASIC Jetsam data 201170 string Jetsam0 Mallard BASIC Jetsam index data 20118 20119# DOS backup 2.0 to 3.2 20120 20121# backupid.@@@ 20122 20123# plausibility check for date 201240x3 ushort >1979 20125>0x5 ubyte-1 <31 20126>>0x6 ubyte-1 <12 20127# actually 121 nul bytes 20128>>>0x7 string \0\0\0\0\0\0\0\0 20129>>>>0x1 ubyte x DOS 2.0 backup id file, sequence %d 20130!:ext @@@ 20131>>>>0x0 ubyte 0xff \b, last disk 20132 20133# backed up file 20134 20135# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd 20136# by looking for trailing nul of maximal file name string 201370x52 ubyte 0 20138# test for flag byte: FFh~complete file, 00h~split file 20139# FFh -127 = -1 -127 = -128 20140# 00h -127 = 0 -127 = -127 20141>0 byte-127 <-126 20142# plausibility check for file name length 20143>>0x53 ubyte-1 <78 20144# looking for terminating nul of file name string 20145>>>(0x53.b+4) ubyte 0 20146# looking if last char of string is valid DOS file name 20147>>>>(0x53.b+3) ubyte >0x1F 20148# actually 44 nul bytes 20149# but sometimes garbage according to Ralf Quint. So can not be used as test 20150#>0x54 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 20151# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator 20152# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE 20153>>>>>5 ubyte&0x8C 0x0C 20154# ./msdos (version 5.30) labeled the entry as 20155# "DOS 2.0 backed up file %s, split file, sequence %d" or 20156# "DOS 2.0 backed up file %s, complete file" 20157>>>>>>0 ubyte x DOS 2.0-3.2 backed up 20158#>>>>>>0 ubyte 0xff complete 20159>>>>>>0 ubyte 0 20160>>>>>>>1 uleshort x sequence %d of 20161# full file name with path but without drive letter and colon stored from 0x05 til 0x52 20162>>>>>>0x5 string x file %s 20163# backup name is original filename 20164#!:ext * 20165# magic/Magdir/msdos, 1169: Warning: EXTENSION type ` *' has bad char '*' 20166# file: line 1169: Bad magic entry ' *' 20167# after header original file content 20168>>>>>>128 indirect x \b; 20169 20170 20171# DOS backup 3.3 to 5.x 20172 20173# CONTROL.nnn files 201740 string \x8bBACKUP\x20 20175# actually 128 nul bytes 20176>0xa string \0\0\0\0\0\0\0\0 20177>>0x9 ubyte x DOS 3.3 backup control file, sequence %d 20178>>0x8a ubyte 0xff \b, last disk 20179 20180# NB: The BACKUP.nnn files consist of the files backed up, 20181# concatenated. 20182 20183#------------------------------------------------------------------------------ 20184# $File: msooxml,v 1.8 2018/05/24 18:11:17 christos Exp $ 20185# msooxml: file(1) magic for Microsoft Office XML 20186# From: Ralf Brown <ralf.brown@gmail.com> 20187 20188# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP 20189# archive. The first member file is normally "[Content_Types].xml". 20190# but some libreoffice generated files put this later. Perhaps skip 20191# the "[Content_Types].xml" test? 20192# Since MSOOXML doesn't have anything like the uncompressed "mimetype" 20193# file of ePub or OpenDocument, we'll have to scan for a filename 20194# which can distinguish between the three types 20195 201960 name msooxml 20197>0 string word/ Microsoft Word 2007+ 20198!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document 20199>0 string ppt/ Microsoft PowerPoint 2007+ 20200!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation 20201>0 string xl/ Microsoft Excel 2007+ 20202!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet 20203 20204# start by checking for ZIP local file header signature 202050 string PK\003\004 20206!:strength +10 20207# make sure the first file is correct 20208>0x1E use msooxml 20209>0x1E regex \\[Content_Types\\]\\.xml|_rels/\\.rels 20210# skip to the second local file header 20211# since some documents include a 520-byte extra field following the file 20212# header, we need to scan for the next header 20213>>(18.l+49) search/2000 PK\003\004 20214# now skip to the *third* local file header; again, we need to scan due to a 20215# 520-byte extra field following the file header 20216>>>&26 search/1000 PK\003\004 20217# and check the subdirectory name to determine which type of OOXML 20218# file we have. Correct the mimetype with the registered ones: 20219# http://technet.microsoft.com/en-us/library/cc179224.aspx 20220>>>>&26 use msooxml 20221>>>>&26 default x 20222# OpenOffice/Libreoffice orders ZIP entry differently, so check the 4th file 20223>>>>>&26 search/1000 PK\003\004 20224>>>>>>&26 use msooxml 20225>>>>>>&26 default x Microsoft OOXML 20226 20227#------------------------------------------------------------------------------ 20228# $File: msvc,v 1.9 2017/08/02 08:15:20 christos Exp $ 20229# msvc: file(1) magic for msvc 20230# "H. Nanosecond" <aldomel@ix.netcom.com> 20231# Microsoft visual C 20232# 20233# I have version 1.0 20234 20235# .aps 202360 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file 20237 20238# .ide 20239#too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide 202400 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide 20241 20242# .res 202430 string \000\000\000\000\040\000\000\000\377 MSVC .res 202440 string \377\003\000\377\001\000\020\020\350 MSVC .res 202450 string \377\003\000\377\001\000\060\020\350 MSVC .res 20246 20247#.lib 202480 string \360\015\000\000 Microsoft Visual C library 202490 string \360\075\000\000 Microsoft Visual C library 202500 string \360\175\000\000 Microsoft Visual C library 20251 20252#.pch 202530 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch 20254 20255# Summary: Symbol Table / Debug info used by Microsoft compilers 20256# URL: https://en.wikipedia.org/wiki/Program_database 20257# Reference: https://code.google.com/p/pdbparser/wiki/MSF_Format 20258# Update: Joerg Jenderek 20259# Note: test only for Windows XP+SP3 x86 , 8.1 x64 arm and 10.1 x86 20260# info does only applies partly for older files like msvbvm50.pdb about year 2001 202610 string Microsoft\ C/C++\040 20262# "Microsoft Program DataBase" by TrID 20263>24 search/14 \r\n\x1A MSVC program database 20264!:mime application/x-ms-pdb 20265!:ext pdb 20266# "MSF 7.00" "program database 2.00" for msvbvm50.pdb 20267>>16 regex \([0-9.]+\) ver %s 20268#>>>0x38 search/128123456 /LinkInfo \b with linkinfo 20269# "MSF 7.00" variant 20270>>0x1e leshort 0 20271# PageSize 400h 1000h 20272>>>0x20 lelong x \b, %d 20273# Page Count 20274>>>0x28 lelong x \b*%d bytes 20275# "program database 2.00" variant 20276>>0x1e leshort !0 20277# PageSize 400h 20278>>>0x2c lelong x \b, %d 20279# Page Count for msoo-dll.pdb 4379h 20280>>>0x32 leshort x \b*%d bytes 20281 20282# Reference: https://github.com/Microsoft/vstest/pull/856/commits/fdc7a9f074ca5a8dfeec83b1be9162bf0cf4000d 202830 string/c bsjb\001\000\001\000\000\000\000\000\f\000\000\000pdb\ v1.0 Microsoft Rosyln C# debugging symbols version 1.0 20284 20285#.sbr 202860 string \000\002\000\007\000 MSVC .sbr 20287>5 string >\0 %s 20288 20289#.bsc 202900 string \002\000\002\001 MSVC .bsc 20291 20292#.wsp 202930 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000 20294# these seem to start with the version and contain menus 20295 20296#------------------------------------------------------------------------------ 20297# msx: file(1) magic for the MSX Home Computer 20298# v1.3 20299# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 20300 20301############## MSX Music file formats ############## 20302 20303# Gigamix MGSDRV music file 203040 string/b MGS MSX Gigamix MGSDRV3 music file, 20305>6 ubeshort 0x0D0A 20306>>3 byte x \bv%c 20307>>4 byte x \b.%c 20308>>5 byte x \b%c 20309>>8 string >\0 \b, title: %s 20310 203111 string/b mgs2\ MSX Gigamix MGSDRV2 music file 20312>6 uleshort 0x80 20313>>0x2E uleshort 0 20314>>>0x30 string >\0 \b, title: %s 20315 20316# KSS music file 203170 string/b KSCC KSS music file v1.03 20318>0xE byte 0 20319>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+) 20320>>0xF byte&0x02 2 \b, soundchip(s): SN76489 20321>>>0xF byte&0x04 4 stereo 20322>>0xF byte&0x01 1 \b, YM2413 20323>>0xF byte&0x08 8 \b, Y8950 20324 203250 string/b KSSX KSS music file v1.20 20326>0xE byte&0xEF 0 20327>>0xF byte&0x40 0x00 \b, 60Hz 20328>>0xF byte&0x40 0x40 \b, 50Hz 20329>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+) 20330>>0xF byte&0x02 0x02 \b, soundchips: SN76489 20331>>>0xF byte&0x04 0x04 stereo 20332>>0xF byte&0x01 0x01 \b, 20333>>>0xF byte&0x18 0x00 \bYM2413 20334>>>0xF byte&0x18 0x08 \bYM2413, Y8950 20335>>>0xF byte&0x18 0x18 \bYM2413+Y8950 pseudostereo 20336>>0xF byte&0x18 0x10 \b, Majyutsushi DAC 20337 20338# Moonblaster for Moonsound 203390 string/b MBMS 20340>4 byte 0x10 MSX Moonblaster for MoonSound music 20341 20342# Music Player K-kaz 203430 string/b MPK MSX Music Player K-kaz song 20344>6 ubeshort 0x0D0A 20345>>3 byte x v%c 20346>>4 byte x \b.%c 20347>>5 byte x \b%c 20348 20349# I don't know why these don't work 20350#0 search/0xFFFF \r\n.FM9 20351#>0 search/0xFFFF \r\n#FORMAT MSX Music Player K-kaz source MML file 20352#0 search/0xFFFF \r\nFM1\ \= 20353#>0 search/0xFFFF \r\nPSG1\= 20354#>>0 search/0xFFFF \r\nSCC1\= MSX MuSiCa MML source file 20355 20356# OPX Music file 203570x35 beshort 0x0d0a 20358>0x7B beshort 0x0d0a 20359>>0x7D byte 0x1a 20360>>>0x87 uleshort 0 MSX OPX Music file 20361>>>>0x86 byte 0 v1.5 20362>>>>>0 string >\32 \b, title: %s 20363>>>>0x86 byte 1 v2.4 20364>>>>>0 string >\32 \b, title: %s 20365 20366# SCMD music file 203670x8B string/b SCMD 20368>0xCE uleshort 0 MSX SCMD Music file 20369#>>-2 uleshort 0x6a71 ; The file must end with this value. How to code this here? 20370>>0x8F string >\0 \b, title: %s 20371 203720 search/0xFFFF \r\n@title 20373>&0 search/0xFFFF \r\n@m=[ MSX SCMD source MML file 20374 20375 20376############## MSX image file formats ############## 20377 20378# MSX raw VRAM dump 203790 ubyte 0xFE 20380>1 uleshort 0 20381>>5 uleshort 0 20382>>>3 uleshort 0x37FF MSX SC2/GRP raw image 20383>>>3 uleshort 0x6A00 MSX Graph Saurus SR5 raw image 20384>>>3 uleshort >0x769E 20385>>>>3 uleshort <0x8000 MSX GE5/GE6 raw image 20386>>>>>3 uleshort 0x7FFF \b, with sprite patterns 20387>>>3 uleshort 0xD3FF MSX screen 7-12 raw image 20388>>>3 uleshort 0xD400 MSX Graph Saurus SR7/SR8/SRS raw image 20389 20390# Graph Saurus compressed images 203910 ubyte 0xFD 20392>1 uleshort 0 20393>>5 uleshort 0 20394>>>3 uleshort >0x013D MSX Graph Saurus compressed image 20395 20396# MSX G9B image file 203970 string/b G9B 20398>1 uleshort 11 20399>>3 uleshort >10 20400>>>5 ubyte >0 MSX G9B image, depth=%d 20401>>>>8 uleshort x \b, %dx 20402>>>>10 uleshort x \b%d 20403>>>>5 ubyte <9 20404>>>>>6 ubyte 0 20405>>>>>>7 ubyte x \b, codec=%d RGB color palettes 20406>>>>>6 ubyte 64 \b, codec=RGB fixed color 20407>>>>>6 ubyte 128 \b, codec=YJK 20408>>>>>6 ubyte 192 \b, codec=YUV 20409>>>>5 ubyte >8 codec=RGB fixed color 20410>>>>12 ubyte 0 \b, raw 20411>>>>12 ubyte 1 \b, bitbuster compression 20412 20413############## Other MSX file formats ############## 20414 20415# MSX internal ROMs 204160 ubeshort 0xF3C3 20417>2 uleshort <0x4000 20418>>8 ubyte 0xC3 20419>>>9 uleshort <0x4000 20420>>>>0x0B ubeshort 0x00C3 20421>>>>>0x0D uleshort <0x4000 20422>>>>>>0x0F ubeshort 0x00C3 20423>>>>>>>0x11 uleshort <0x4000 20424>>>>>>>>0x13 ubeshort 0x00C3 20425>>>>>>>>>0x15 uleshort <0x4000 20426>>>>>>>>>>0x50 ubyte 0xC3 20427>>>>>>>>>>>0x51 uleshort <0x4000 20428>>>>>>>>>>>>(9.s) ubyte 0xC3 20429>>>>>>>>>>>>>&0 uleshort >0x4000 20430>>>>>>>>>>>>>>&0 ubyte 0xC3 MSX BIOS+BASIC 20431>>>>>>>>>>>>>>>0x002D ubyte+1 <3 \b. version=MSX%d 20432>>>>>>>>>>>>>>>0x002D ubyte 2 \b, version=MSX2+ 20433>>>>>>>>>>>>>>>0x002D ubyte 3 \b, version=MSX Turbo-R 20434>>>>>>>>>>>>>>>0x002D ubyte >3 \b, version=Unknown MSX %d version 20435>>>>>>>>>>>>>>>0x0006 ubyte x \b, VDP.DR=0x%2x 20436>>>>>>>>>>>>>>>0x0007 ubyte x \b, VDP.DW=0x%2x 20437>>>>>>>>>>>>>>>0x002B ubyte&0xF 0 \b, charset=Japanese 20438>>>>>>>>>>>>>>>0x002B ubyte&0xF 1 \b, charset=International 20439>>>>>>>>>>>>>>>0x002B ubyte&0xF 2 \b, charset=Korean 20440>>>>>>>>>>>>>>>0x002B ubyte&0xF >2 \b, charset=Unknown id:%d 20441>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x00 \b, date format=Y-M-D 20442>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x10 \b, date format=M-D-Y 20443>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x20 \b, date format=D-M-Y 20444>>>>>>>>>>>>>>>0x002B ubyte&0x80 0x00 \b, vfreq=60Hz 20445>>>>>>>>>>>>>>>0x002B ubyte&0x80 0x80 \b, vfreq=50Hz 20446>>>>>>>>>>>>>>>0x002C ubyte&0x0F 0 \b, keyboard=Japanese 20447>>>>>>>>>>>>>>>0x002C ubyte&0x0F 1 \b, keyboard=International 20448>>>>>>>>>>>>>>>0x002C ubyte&0x0F 2 \b, keyboard=French 20449>>>>>>>>>>>>>>>0x002C ubyte&0x0F 3 \b, keyboard=UK 20450>>>>>>>>>>>>>>>0x002C ubyte&0x0F 4 \b, keyboard=German 20451>>>>>>>>>>>>>>>0x002C ubyte&0x0F 5 \b, keyboard=Unknown id:%d 20452>>>>>>>>>>>>>>>0x002C ubyte&0x0F 6 \b, keyboard=Spanish 20453>>>>>>>>>>>>>>>0x002C ubyte&0x0F >6 \b, keyboard=Unknown id:%d 20454>>>>>>>>>>>>>>>0x002C ubyte&0xF0 0x00 \b, basic=Japanese 20455>>>>>>>>>>>>>>>0x002C ubyte&0xF0 0x10 \b, basic=International 20456>>>>>>>>>>>>>>>0x002C ubyte&0xF0 >0x10 \b, basic=Unknown id:%d 20457>>>>>>>>>>>>>>>0x002E ubyte&1 1 \b, built-in MIDI 20458 20459 204600 string/b CD 20461>2 uleshort >0x10 20462>>2 uleshort <0x4000 20463>>>4 uleshort <0x4000 20464>>>>6 uleshort <0x4000 20465>>>>>8 ubyte 0xC3 20466>>>>>>9 uleshort <0x4000 20467>>>>>>>0x10 ubyte 0xC3 20468>>>>>>>>0x11 uleshort <0x4000 20469>>>>>>>>>0x14 ubyte 0xC3 20470>>>>>>>>>>0x15 uleshort <0x4000 MSX2/2+/TR SubROM 20471 204720 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 20473>0x5F0 ubequad 0x8282828244380000 20474>>0x150 ubyte 0x38 20475>>>0x170 string \20\20\20 20476>>>>0x1E32 string ()) 20477>>>>>0x2130 ubequad 0xA5A5594924231807 20478>>>>>0x2138 ubequad 0x4A4A3424488830C0 MSX Kanji Font 20479 20480 20481 20482# MSX extension ROMs 204830 string/b AB 20484>2 uleshort 0x0010 MSX ROM 20485>>2 uleshort x \b, init=0x%4x 20486>>4 uleshort >0 \b, stahdl=0x%4x 20487>>6 uleshort >0 \b, devhdl=0x%4x 20488>>8 uleshort >0 \b, bas=0x%4x 20489>2 uleshort 0x4010 MSX ROM 20490>>2 uleshort x \b, init=0x%04x 20491>>4 uleshort >0 \b, stahdl=0x%04x 20492>>6 uleshort >0 \b, devhdl=0x%04x 20493>>8 uleshort >0 \b, bas=0x%04x 20494>2 uleshort 0x8010 MSX ROM 20495>>2 uleshort x \b, init=0x%04x 20496>>4 uleshort >0 \b, stahdl=0x%04x 20497>>6 uleshort >0 \b, devhdl=0x%04x 20498>>8 uleshort >0 \b, bas=0x%04x 204990 string/b AB\0\0 20500>6 uleshort 0 20501>>4 uleshort >0x400F MSX-BASIC extension ROM 20502>>>4 uleshort >0 \b, stahdl=0x%04x 20503>>>6 uleshort >0 \b, devhdl=0x%04x 20504>>>0x1C string OPLL \b, MSX-Music 20505>>>>0x18 string PAC2 \b (external) 20506>>>>0x18 string APRL \b (internal) 20507 205080 string/b AB\0\0\0\0 20509>6 uleshort >0x400F MSX device BIOS 20510>>6 uleshort >0 \b, devhdl=0x%04x 20511 20512 205130 string/b AB 20514#>2 string 5JSuperLAYDOCK MSX Super Laydock ROM 20515#>3 string @HYDLIDE3MSX MSX Hydlide-3 ROM 20516#>3 string @3\x80IA862 Golvellius MSX1 ROM 20517>2 uleshort >15 20518>>2 uleshort <0xC000 20519>>>8 string \0\0\0\0\0\0\0\0 20520>>>>(2.s&0x3FFF) uleshort >0 MSX ROM 20521>>>>>0x10 string YZ\0\0\0\0 Konami Game Master 2 MSX ROM 20522>>>>>0x10 string CD \b, Konami RC- 20523>>>>>>0x12 ubyte x \b%d 20524>>>>>>0x13 ubyte/16 x \b%d 20525>>>>>>0x13 ubyte&0xF x \b%d 20526>>>>>0x10 string EF \b, Konami RC- 20527>>>>>>0x12 ubyte x \b%d 20528>>>>>>0x13 ubyte/16 x \b%d 20529>>>>>>0x13 ubyte&0xF x \b%d 20530>>>>>2 uleshort x \b, init=0x%04x 20531>>>>>4 uleshort >0 \b, stahdl=0x%04x 20532>>>>>6 uleshort >0 \b, devhdl=0x%04x 20533>>>>>8 uleshort >0 \b, bas=0x%04x 20534>>>2 uleshort 0 20535>>>>4 uleshort 0 20536>>>>>6 uleshort 0 20537>>>>>>8 uleshort >0 MSX BASIC program in ROM, bas=0x%04x 20538 205390x4000 string/b AB 20540>0x4002 uleshort >0x400F 20541>>0x400A string \0\0\0\0\0\0 MSX ROM with nonstandard page order 20542>>>0x4002 uleshort x \b, init=0x%04x 20543>>>0x4004 uleshort >0 \b, stahdl=0x%04x 20544>>>0x4006 uleshort >0 \b, devhdl=0x%04x 20545>>>0x4008 uleshort >0 \b, bas=0x%04x 20546 205470x8000 string/b AB 20548>0x8002 uleshort >0x400F 20549>>0x800A string \0\0\0\0\0\0 MSX ROM with nonstandard page order 20550>>>0x8002 uleshort x \b, init=0x%04x 20551>>>0x8004 uleshort >0 \b, stahdl=0x%04x 20552>>>0x8006 uleshort >0 \b, devhdl=0x%04x 20553>>>0x8008 uleshort >0 \b, bas=0x%04x 20554 20555 205560x3C000 string/b AB 20557>0x3C008 string \0\0\0\0\0\0\0\0 MSX MegaROM with nonstandard page order 20558>>0x3C002 uleshort x \b, init=0x%04x 20559>>0x3C004 uleshort >0 \b, stahdl=0x%04x 20560>>0x3C006 uleshort >0 \b, devhdl=0x%04x 20561>>0x3C008 uleshort >0 \b, bas=0x%04x 20562 20563# MSX BIN file 20564#0 byte 0xFE 20565#>1 uleshort >0x8000 20566#>>3 uleshort >0x8004 20567#>>>5 uleshort >0x8000 MSX BIN file 20568 20569# MSX-BASIC file 205700 byte 0xFF 20571>3 uleshort 0x000A 20572>>1 uleshort >0x8000 MSX-BASIC program 20573 20574# MSX .CAS file 205750 string/b \x1F\xA6\xDE\xBA\xCC\x13\x7D\x74 MSX cassette archive 20576 20577# Mega-Assembler file 205780 byte 0xFE 20579>1 uleshort 0x0001 20580>>5 uleshort 0xffff 20581>>>6 byte 0x0A MSX Mega-Assembler source 20582 20583# Execrom Patchfile 205840 string ExecROM\ patchfile\x1A MSX ExecROM patchfile 20585>0x12 ubyte/16 x v%d 20586>0x12 ubyte&0xF x \b.%d 20587>0x13 ubyte x \b, contains %d patches 20588 20589# Konami's King's Valley-2 custom stage (ELG file) 205904 uleshort 0x0900 20591>0xF byte 1 20592>>0x14 byte 0 20593>>>0x1E string \040\040\040 20594>>>>0x23 byte 1 20595>>>>>0x25 byte 0 20596>>>>>>0x15 string >\x30 20597>>>>>>>0x15 string <\x5A Konami King's Valley-2 custom stage, title: "%-8.8s" 20598>>>>>>>>0x1D byte <32 \b, theme: %d 20599 20600# Metal Gear 1 savegame 20601#0x4F string \x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF 20602#>>0x60 string \xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF 20603#>>>0x7B string \0x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00 Metal Gear 1 savegame 20604 20605# ------------------------------------------------------------------------ 20606# $File: mup,v 1.5 2017/03/17 21:35:28 christos Exp $ 20607# mup: file(1) magic for Mup (Music Publisher) input file. 20608# 20609# From: Abel Cheung <abel (@) oaka.org> 20610# 20611# NOTE: This header is mainly proposed in the Arkkra mailing list, 20612# and is not a mandatory header because of old mup input file 20613# compatibility. Noteedit also use mup format, but is not forcing 20614# user to use any header as well. 20615# 206160 search/1 //!Mup Mup music publication program input text 20617>6 string -Arkkra (Arkkra) 20618>>13 string - 20619>>>16 string . 20620>>>>14 string x \b, need V%.4s 20621>>>15 string . 20622>>>>14 string x \b, need V%.3s 20623>6 string - 20624>>9 string . 20625>>>7 string x \b, need V%.4s 20626>>8 string . 20627>>>7 string x \b, need V%.3s 20628#------------------------------------------------------------------------------ 20629# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $ 20630# music: file (1) magic for music formats 20631 20632# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks 20633# and Bagpipe Writer by Doug Wickstrom 20634# 206350 string Bagpipe Bagpipe 20636>8 string Reader Reader 20637>>15 string >\0 (version %.3s) 20638>8 string Music\ Writer Music Writer 20639>>20 string : 20640>>>21 string >\0 (version %.3s) 20641>>21 string Gold Gold 20642>>>25 string : 20643>>>>26 string >\0 (version %.3s) 20644 20645 20646#------------------------------------------------------------------------------ 20647# nasa: file(1) magic 20648 20649# From: Barry Carter <carter.barry@gmail.com> 206500 string DAF/SPK NASA SPICE file (binary format) 206510 string DAFETF\ NAIF\ DAF\ ENCODED NASA SPICE file (transfer format) 20652 20653#----------------------------------------------------------------------------- 20654# $File: natinst,v 1.6 2014/06/03 19:17:27 christos Exp $ 20655# natinst: file(1) magic for National Instruments Code Files 20656 20657# 20658# From <egamez@fcfm.buap.mx> Enrique Gamez-Flores 20659# version 1 20660# Many formats still missing, we use, for the moment LabVIEW 20661# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing 20662# 206630 string RSRC National Instruments, 20664# Check if it's a LabVIEW File 20665>8 string LV LabVIEW File, 20666# Check which kind of file it is 20667>>10 string SB Code Resource File, data 20668>>10 string IN Virtual Instrument Program, data 20669>>10 string AR VI Library, data 20670# This is for Menu Libraries 20671>8 string LMNULBVW Portable File Names, data 20672# This is for General Resources 20673>8 string rsc Resources File, data 20674# This is for VXI Package 206750 string VMAP National Instruments, VXI File, data 20676 20677#------------------------------------------------------------------------------ 20678# $File: ncr,v 1.8 2014/04/30 21:41:02 christos Exp $ 20679# ncr: file(1) magic for NCR Tower objects 20680# 20681# contributed by 20682# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa 20683# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP 20684# 206850 beshort 000610 Tower/XP rel 2 object 20686>12 belong >0 not stripped 20687>20 beshort 0407 executable 20688>20 beshort 0410 pure executable 20689>22 beshort >0 - version %d 206900 beshort 000615 Tower/XP rel 2 object 20691>12 belong >0 not stripped 20692>20 beshort 0407 executable 20693>20 beshort 0410 pure executable 20694>22 beshort >0 - version %d 206950 beshort 000620 Tower/XP rel 3 object 20696>12 belong >0 not stripped 20697>20 beshort 0407 executable 20698>20 beshort 0410 pure executable 20699>22 beshort >0 - version %d 207000 beshort 000625 Tower/XP rel 3 object 20701>12 belong >0 not stripped 20702>20 beshort 0407 executable 20703>20 beshort 0410 pure executable 20704>22 beshort >0 - version %d 207050 beshort 000630 Tower32/600/400 68020 object 20706>12 belong >0 not stripped 20707>20 beshort 0407 executable 20708>20 beshort 0410 pure executable 20709>22 beshort >0 - version %d 207100 beshort 000640 Tower32/800 68020 20711>18 beshort &020000 w/68881 object 20712>18 beshort &040000 compatible object 20713>18 beshort &060000 object 20714>20 beshort 0407 executable 20715>20 beshort 0413 pure executable 20716>12 belong >0 not stripped 20717>22 beshort >0 - version %d 207180 beshort 000645 Tower32/800 68010 20719>18 beshort &040000 compatible object 20720>18 beshort &060000 object 20721>20 beshort 0407 executable 20722>20 beshort 0413 pure executable 20723>12 belong >0 not stripped 20724>22 beshort >0 - version %d 20725 20726#------------------------------------------------------------ 20727# $File: neko,v 1.1 2009/11/10 20:36:10 christos Exp $ 20728 20729# From: Mikhail Gusarov <dottedmag@dottedmag.net> 20730# NekoVM (http://nekovm.org/) bytecode 207310 string NEKO NekoVM bytecode 20732>4 lelong x (%d global symbols, 20733>8 lelong x %d global fields, 20734>12 lelong x %d bytecode ops) 20735!:mime application/x-nekovm-bytecode 20736 20737 20738#------------------------------------------------------------------------------ 20739# $File: netbsd,v 1.25 2017/09/28 02:37:47 christos Exp $ 20740# netbsd: file(1) magic for NetBSD objects 20741# 20742# All new-style magic numbers are in network byte order. 20743# The old-style magic numbers are indistinguishable from the same magic 20744# numbers used in other systems, and are handled, for all those systems, 20745# in aout. 20746# 20747 207480 belong&0377777777 041400413 a.out NetBSD/i386 demand paged 20749>0 byte &0x80 20750>>20 lelong <4096 shared library 20751>>20 lelong =4096 dynamically linked executable 20752>>20 lelong >4096 dynamically linked executable 20753>0 byte ^0x80 executable 20754>16 lelong >0 not stripped 207550 belong&0377777777 041400410 a.out NetBSD/i386 pure 20756>0 byte &0x80 dynamically linked executable 20757>0 byte ^0x80 executable 20758>16 lelong >0 not stripped 207590 belong&0377777777 041400407 a.out NetBSD/i386 20760>0 byte &0x80 dynamically linked executable 20761>0 byte ^0x80 20762>>0 byte &0x40 position independent 20763>>20 lelong !0 executable 20764>>20 lelong =0 object file 20765>16 lelong >0 not stripped 207660 belong&0377777777 041400507 a.out NetBSD/i386 core 20767>12 string >\0 from '%s' 20768>32 lelong !0 (signal %d) 20769 207700 belong&0377777777 041600413 a.out NetBSD/m68k demand paged 20771>0 byte &0x80 20772>>20 belong <8192 shared library 20773>>20 belong =8192 dynamically linked executable 20774>>20 belong >8192 dynamically linked executable 20775>0 byte ^0x80 executable 20776>16 belong >0 not stripped 207770 belong&0377777777 041600410 a.out NetBSD/m68k pure 20778>0 byte &0x80 dynamically linked executable 20779>0 byte ^0x80 executable 20780>16 belong >0 not stripped 207810 belong&0377777777 041600407 a.out NetBSD/m68k 20782>0 byte &0x80 dynamically linked executable 20783>0 byte ^0x80 20784>>0 byte &0x40 position independent 20785>>20 belong !0 executable 20786>>20 belong =0 object file 20787>16 belong >0 not stripped 207880 belong&0377777777 041600507 a.out NetBSD/m68k core 20789>12 string >\0 from '%s' 20790>32 belong !0 (signal %d) 20791 207920 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged 20793>0 byte &0x80 20794>>20 belong <4096 shared library 20795>>20 belong =4096 dynamically linked executable 20796>>20 belong >4096 dynamically linked executable 20797>0 byte ^0x80 executable 20798>16 belong >0 not stripped 207990 belong&0377777777 042000410 a.out NetBSD/m68k4k pure 20800>0 byte &0x80 dynamically linked executable 20801>0 byte ^0x80 executable 20802>16 belong >0 not stripped 208030 belong&0377777777 042000407 a.out NetBSD/m68k4k 20804>0 byte &0x80 dynamically linked executable 20805>0 byte ^0x80 20806>>0 byte &0x40 position independent 20807>>20 belong !0 executable 20808>>20 belong =0 object file 20809>16 belong >0 not stripped 208100 belong&0377777777 042000507 a.out NetBSD/m68k4k core 20811>12 string >\0 from '%s' 20812>32 belong !0 (signal %d) 20813 208140 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged 20815>0 byte &0x80 20816>>20 lelong <4096 shared library 20817>>20 lelong =4096 dynamically linked executable 20818>>20 lelong >4096 dynamically linked executable 20819>0 byte ^0x80 executable 20820>16 lelong >0 not stripped 208210 belong&0377777777 042200410 a.out NetBSD/ns32532 pure 20822>0 byte &0x80 dynamically linked executable 20823>0 byte ^0x80 executable 20824>16 lelong >0 not stripped 208250 belong&0377777777 042200407 a.out NetBSD/ns32532 20826>0 byte &0x80 dynamically linked executable 20827>0 byte ^0x80 20828>>0 byte &0x40 position independent 20829>>20 lelong !0 executable 20830>>20 lelong =0 object file 20831>16 lelong >0 not stripped 208320 belong&0377777777 042200507 a.out NetBSD/ns32532 core 20833>12 string >\0 from '%s' 20834>32 lelong !0 (signal %d) 20835 208360 belong&0377777777 045200507 a.out NetBSD/powerpc core 20837>12 string >\0 from '%s' 20838 208390 belong&0377777777 042400413 a.out NetBSD/SPARC demand paged 20840>0 byte &0x80 20841>>20 belong <8192 shared library 20842>>20 belong =8192 dynamically linked executable 20843>>20 belong >8192 dynamically linked executable 20844>0 byte ^0x80 executable 20845>16 belong >0 not stripped 208460 belong&0377777777 042400410 a.out NetBSD/SPARC pure 20847>0 byte &0x80 dynamically linked executable 20848>0 byte ^0x80 executable 20849>16 belong >0 not stripped 208500 belong&0377777777 042400407 a.out NetBSD/SPARC 20851>0 byte &0x80 dynamically linked executable 20852>0 byte ^0x80 20853>>0 byte &0x40 position independent 20854>>20 belong !0 executable 20855>>20 belong =0 object file 20856>16 belong >0 not stripped 208570 belong&0377777777 042400507 a.out NetBSD/SPARC core 20858>12 string >\0 from '%s' 20859>32 belong !0 (signal %d) 20860 208610 belong&0377777777 042600413 a.out NetBSD/pmax demand paged 20862>0 byte &0x80 20863>>20 lelong <4096 shared library 20864>>20 lelong =4096 dynamically linked executable 20865>>20 lelong >4096 dynamically linked executable 20866>0 byte ^0x80 executable 20867>16 lelong >0 not stripped 208680 belong&0377777777 042600410 a.out NetBSD/pmax pure 20869>0 byte &0x80 dynamically linked executable 20870>0 byte ^0x80 executable 20871>16 lelong >0 not stripped 208720 belong&0377777777 042600407 a.out NetBSD/pmax 20873>0 byte &0x80 dynamically linked executable 20874>0 byte ^0x80 20875>>0 byte &0x40 position independent 20876>>20 lelong !0 executable 20877>>20 lelong =0 object file 20878>16 lelong >0 not stripped 208790 belong&0377777777 042600507 a.out NetBSD/pmax core 20880>12 string >\0 from '%s' 20881>32 lelong !0 (signal %d) 20882 208830 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged 20884>0 byte &0x80 20885>>20 lelong <4096 shared library 20886>>20 lelong =4096 dynamically linked executable 20887>>20 lelong >4096 dynamically linked executable 20888>0 byte ^0x80 executable 20889>16 lelong >0 not stripped 208900 belong&0377777777 043000410 a.out NetBSD/vax 1k pure 20891>0 byte &0x80 dynamically linked executable 20892>0 byte ^0x80 executable 20893>16 lelong >0 not stripped 208940 belong&0377777777 043000407 a.out NetBSD/vax 1k 20895>0 byte &0x80 dynamically linked executable 20896>0 byte ^0x80 20897>>0 byte &0x40 position independent 20898>>20 lelong !0 executable 20899>>20 lelong =0 object file 20900>16 lelong >0 not stripped 209010 belong&0377777777 043000507 a.out NetBSD/vax 1k core 20902>12 string >\0 from '%s' 20903>32 lelong !0 (signal %d) 20904 209050 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged 20906>0 byte &0x80 20907>>20 lelong <4096 shared library 20908>>20 lelong =4096 dynamically linked executable 20909>>20 lelong >4096 dynamically linked executable 20910>0 byte ^0x80 executable 20911>16 lelong >0 not stripped 209120 belong&0377777777 045400410 a.out NetBSD/vax 4k pure 20913>0 byte &0x80 dynamically linked executable 20914>0 byte ^0x80 executable 20915>16 lelong >0 not stripped 209160 belong&0377777777 045400407 a.out NetBSD/vax 4k 20917>0 byte &0x80 dynamically linked executable 20918>0 byte ^0x80 20919>>0 byte &0x40 position independent 20920>>20 lelong !0 executable 20921>>20 lelong =0 object file 20922>16 lelong >0 not stripped 209230 belong&0377777777 045400507 a.out NetBSD/vax 4k core 20924>12 string >\0 from '%s' 20925>32 lelong !0 (signal %d) 20926 20927# NetBSD/alpha does not support (and has never supported) a.out objects, 20928# so no rules are provided for them. NetBSD/alpha ELF objects are 20929# dealt with in "elf". 209300 lelong 0x00070185 ECOFF NetBSD/alpha binary 20931>10 leshort 0x0001 not stripped 20932>10 leshort 0x0000 stripped 209330 belong&0377777777 043200507 a.out NetBSD/alpha core 20934>12 string >\0 from '%s' 20935>32 lelong !0 (signal %d) 20936 209370 belong&0377777777 043400413 a.out NetBSD/mips demand paged 20938>0 byte &0x80 20939>>20 belong <8192 shared library 20940>>20 belong =8192 dynamically linked executable 20941>>20 belong >8192 dynamically linked executable 20942>0 byte ^0x80 executable 20943>16 belong >0 not stripped 209440 belong&0377777777 043400410 a.out NetBSD/mips pure 20945>0 byte &0x80 dynamically linked executable 20946>0 byte ^0x80 executable 20947>16 belong >0 not stripped 209480 belong&0377777777 043400407 a.out NetBSD/mips 20949>0 byte &0x80 dynamically linked executable 20950>0 byte ^0x80 20951>>0 byte &0x40 position independent 20952>>20 belong !0 executable 20953>>20 belong =0 object file 20954>16 belong >0 not stripped 209550 belong&0377777777 043400507 a.out NetBSD/mips core 20956>12 string >\0 from '%s' 20957>32 belong !0 (signal %d) 20958 209590 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged 20960>0 byte &0x80 20961>>20 lelong <4096 shared library 20962>>20 lelong =4096 dynamically linked executable 20963>>20 lelong >4096 dynamically linked executable 20964>0 byte ^0x80 executable 20965>16 lelong >0 not stripped 209660 belong&0377777777 043600410 a.out NetBSD/arm32 pure 20967>0 byte &0x80 dynamically linked executable 20968>0 byte ^0x80 executable 20969>16 lelong >0 not stripped 209700 belong&0377777777 043600407 a.out NetBSD/arm32 20971>0 byte &0x80 dynamically linked executable 20972>0 byte ^0x80 20973>>0 byte &0x40 position independent 20974>>20 lelong !0 executable 20975>>20 lelong =0 object file 20976>16 lelong >0 not stripped 20977# NetBSD/arm26 has always used ELF objects, but it shares a core file 20978# format with NetBSD/arm32. 209790 belong&0377777777 043600507 a.out NetBSD/arm core 20980>12 string >\0 from '%s' 20981>32 lelong !0 (signal %d) 20982 20983# Kernel core dump format 209840 belong&0x0000ffff 0x00008fca NetBSD kernel core file 20985>0 belong&0x03ff0000 0x00000000 \b, Unknown 20986>0 belong&0x03ff0000 0x00010000 \b, sun 68010/68020 20987>0 belong&0x03ff0000 0x00020000 \b, sun 68020 20988>0 belong&0x03ff0000 0x00640000 \b, 386 PC 20989>0 belong&0x03ff0000 0x00860000 \b, i386 BSD 20990>0 belong&0x03ff0000 0x00870000 \b, m68k BSD (8K pages) 20991>0 belong&0x03ff0000 0x00880000 \b, m68k BSD (4K pages) 20992>0 belong&0x03ff0000 0x00890000 \b, ns32532 BSD 20993>0 belong&0x03ff0000 0x008a0000 \b, SPARC/32 BSD 20994>0 belong&0x03ff0000 0x008b0000 \b, pmax BSD 20995>0 belong&0x03ff0000 0x008c0000 \b, vax BSD (1K pages) 20996>0 belong&0x03ff0000 0x008d0000 \b, alpha BSD 20997>0 belong&0x03ff0000 0x008e0000 \b, mips BSD (Big Endian) 20998>0 belong&0x03ff0000 0x008f0000 \b, arm6 BSD 20999>0 belong&0x03ff0000 0x00900000 \b, m68k BSD (2K pages) 21000>0 belong&0x03ff0000 0x00910000 \b, sh3 BSD 21001>0 belong&0x03ff0000 0x00950000 \b, ppc BSD (Big Endian) 21002>0 belong&0x03ff0000 0x00960000 \b, vax BSD (4K pages) 21003>0 belong&0x03ff0000 0x00970000 \b, mips1 BSD 21004>0 belong&0x03ff0000 0x00980000 \b, mips2 BSD 21005>0 belong&0x03ff0000 0x00990000 \b, m88k BSD 21006>0 belong&0x03ff0000 0x00920000 \b, parisc BSD 21007>0 belong&0x03ff0000 0x009b0000 \b, sh5/64 BSD 21008>0 belong&0x03ff0000 0x009c0000 \b, SPARC/64 BSD 21009>0 belong&0x03ff0000 0x009d0000 \b, amd64 BSD 21010>0 belong&0x03ff0000 0x009e0000 \b, sh5/32 BSD 21011>0 belong&0x03ff0000 0x009f0000 \b, ia64 BSD 21012>0 belong&0x03ff0000 0x00b70000 \b, aarch64 BSD 21013>0 belong&0x03ff0000 0x00b80000 \b, or1k BSD 21014>0 belong&0x03ff0000 0x00b90000 \b, Risk-V BSD 21015>0 belong&0x03ff0000 0x00c80000 \b, hp200 BSD 21016>0 belong&0x03ff0000 0x012c0000 \b, hp300 BSD 21017>0 belong&0x03ff0000 0x020b0000 \b, hp800 HP-UX 21018>0 belong&0x03ff0000 0x020c0000 \b, hp200/hp300 HP-UX 21019>0 belong&0xfc000000 0x04000000 \b, CPU 21020>0 belong&0xfc000000 0x08000000 \b, DATA 21021>0 belong&0xfc000000 0x10000000 \b, STACK 21022>4 leshort x \b, (headersize = %d 21023>6 leshort x \b, segmentsize = %d 21024>8 lelong x \b, segments = %d) 21025 21026# little endian only for now. 210270 name ktrace 21028>4 leshort 7 21029>>6 leshort <3 NetBSD ktrace file version %d 21030>>>12 string x from %s 21031>>>56 string x \b, emulation %s 21032>>>8 lelong <65536 \b, pid=%d 21033 2103456 string netbsd 21035>0 use ktrace 2103656 string linux 21037>0 use ktrace 2103856 string sunos 21039>0 use ktrace 2104056 string hpux 21041>0 use ktrace 21042 21043#------------------------------------------------------------------------------ 21044# $File: netscape,v 1.8 2017/03/17 21:35:28 christos Exp $ 21045# netscape: file(1) magic for Netscape files 21046# "H. Nanosecond" <aldomel@ix.netcom.com> 21047# version 3 and 4 I think 21048# 21049 21050# Netscape Address book .nab 210510 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book 21052 21053# Netscape Communicator address book 210540 string \000\017\102\111 Netscape Communicator address book 21055 21056# .snm Caches 210570 string #\ Netscape\ folder\ cache Netscape folder cache 210580 string \000\036\204\220\000 Netscape folder cache 21059# .n2p 21060# Net 2 Phone 21061#0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060 210620 string SX961999 Net2phone 21063 21064# 21065#This is files ending in .art, FIXME add more rules 210660 string JG\004\016\0\0\0\0 AOL ART image 210670 string JG\003\016\0\0\0\0 AOL ART image 21068 21069#------------------------------------------------------------------------------ 21070# $File: netware,v 1.4 2009/09/19 16:28:11 christos Exp $ 21071# netware: file(1) magic for NetWare Loadable Modules (NLMs) 21072# From: Mads Martin Joergensen <mmj@suse.de> 21073 210740 string NetWare\ Loadable\ Module NetWare Loadable Module 21075 21076#------------------------------------------------------------------------------ 21077# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $ 21078# news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews") 21079# 210800 string StartFontMetrics ASCII font metrics 210810 string StartFont ASCII font bits 210820 belong 0x137A2944 NeWS bitmap font 210830 belong 0x137A2947 NeWS font family 210840 belong 0x137A2950 scalable OpenFont binary 210850 belong 0x137A2951 encrypted scalable OpenFont binary 210868 belong 0x137A2B45 X11/NeWS bitmap font 210878 belong 0x137A2B48 X11/NeWS font family 21088 21089#------------------------------------------------------------------------------ 21090# $File: nitpicker,v 1.7 2017/03/17 21:35:28 christos Exp $ 21091# nitpicker: file(1) magic for Flowfiles. 21092# From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de 210930 string NPFF NItpicker Flow File 21094>4 byte x V%d. 21095>5 byte x %d 21096>6 bedate x started: %s 21097>10 bedate x stopped: %s 21098>14 belong x Bytes: %u 21099>18 belong x Bytes1: %u 21100>22 belong x Flows: %u 21101>26 belong x Pkts: %u 21102 21103#------------------------------------------------------------------------------ 21104# $File: oasis,v 1.2 2014/06/03 19:17:27 christos Exp $ 21105# OASIS 21106# Summary: OASIS stream file 21107# Long description: Open Artwork System Interchange Standard 21108# File extension: .oas 21109# Full name: Ben Cowley (bcowley@broadcom.com) 21110# Philip Dixon (pdixon@broadcom.com) 21111# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf 21112# (see page 3) 211130 string %SEMI-OASIS\r\n OASIS Stream file 21114 21115#------------------------------------------------------------------------------ 21116# $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $ 21117# ocaml: file(1) magic for Objective Caml files. 211180 string Caml1999 OCaml 21119>8 string X exec file 21120>8 string I interface file (.cmi) 21121>8 string O object file (.cmo) 21122>8 string A library file (.cma) 21123>8 string Y native object file (.cmx) 21124>8 string Z native library file (.cmxa) 21125>8 string M abstract syntax tree implementation file 21126>8 string N abstract syntax tree interface file 21127>9 string >\0 (Version %3.3s) 21128 21129#------------------------------------------------------------------------------ 21130# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $ 21131# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org> 211320 string Octave-1-L Octave binary data (little endian) 211330 string Octave-1-B Octave binary data (big endian) 21134 21135#------------------------------------------------------------------------------ 21136# $File: ole2compounddocs,v 1.5 2017/10/27 21:43:23 christos Exp $ 21137# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured 21138# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format) 21139# Additional tests for OLE 2 Compound Documents should be under this recipe. 21140 211410 string \320\317\021\340\241\261\032\341 OLE 2 Compound Document 21142# - Microstation V8 DGN files (www.bentley.com) 21143# Last update on 10/23/2006 by Lester Hightower 21144> 0x480 string D\000g\000n\000~\000H : Microstation V8 DGN 21145# - Visio documents 21146# Last update on 10/23/2006 by Lester Hightower 21147> 0x480 string V\000i\000s\000i\000o\000D\000o\000c : Visio Document 21148 21149# Note: moved & merged Microsoft Office parts from ./msdos Oct 2017 21150# Update: Joerg Jenderek 21151# from http://filext.com by Derek M Jones <derek@knosof.co.uk> 21152# False positive with PPT (also currently this string is too long) 21153#0 string/b \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer 21154#0 string/b \320\317\021\340\241\261\032\341 Microsoft Office Document 21155#>48 byte 0x1B Excel Document 21156#!:mime application/vnd.ms-excel 21157>546 string bjbj : Microsoft Word Document 21158!:mime application/msword 21159# https://www.macdisk.com/macsigen.php 21160!:apple MSWDWDBN 21161!:ext doc/dot 21162>546 string jbjb : Microsoft Word Document 21163!:mime application/msword 21164!:apple MSWDWDBN 21165!:ext doc 21166 21167 21168#------------------------------------------------------------------------------ 21169# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $ 21170# olf: file(1) magic for OLF executables 21171# 21172# We have to check the byte order flag to see what byte order all the 21173# other stuff in the header is in. 21174# 21175# MIPS R3000 may also be for MIPS R2000. 21176# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 21177# 21178# Created by Erik Theisen <etheisen@openbsd.org> 21179# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com> 211800 string \177OLF OLF 21181>4 byte 0 invalid class 21182>4 byte 1 32-bit 21183>4 byte 2 64-bit 21184>7 byte 0 invalid os 21185>7 byte 1 OpenBSD 21186>7 byte 2 NetBSD 21187>7 byte 3 FreeBSD 21188>7 byte 4 4.4BSD 21189>7 byte 5 Linux 21190>7 byte 6 SVR4 21191>7 byte 7 esix 21192>7 byte 8 Solaris 21193>7 byte 9 Irix 21194>7 byte 10 SCO 21195>7 byte 11 Dell 21196>7 byte 12 NCR 21197>5 byte 0 invalid byte order 21198>5 byte 1 LSB 21199>>16 leshort 0 no file type, 21200>>16 leshort 1 relocatable, 21201>>16 leshort 2 executable, 21202>>16 leshort 3 shared object, 21203# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> 21204# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> 21205>>16 leshort 4 core file 21206>>>(0x38+0xcc) string >\0 of '%s' 21207>>>(0x38+0x10) lelong >0 (signal %d), 21208>>16 leshort &0xff00 processor-specific, 21209>>18 leshort 0 no machine, 21210>>18 leshort 1 AT&T WE32100 - invalid byte order, 21211>>18 leshort 2 SPARC - invalid byte order, 21212>>18 leshort 3 Intel 80386, 21213>>18 leshort 4 Motorola 68000 - invalid byte order, 21214>>18 leshort 5 Motorola 88000 - invalid byte order, 21215>>18 leshort 6 Intel 80486, 21216>>18 leshort 7 Intel 80860, 21217>>18 leshort 8 MIPS R3000_BE - invalid byte order, 21218>>18 leshort 9 Amdahl - invalid byte order, 21219>>18 leshort 10 MIPS R3000_LE, 21220>>18 leshort 11 RS6000 - invalid byte order, 21221>>18 leshort 15 PA-RISC - invalid byte order, 21222>>18 leshort 16 nCUBE, 21223>>18 leshort 17 VPP500, 21224>>18 leshort 18 SPARC32PLUS, 21225>>18 leshort 20 PowerPC, 21226>>18 leshort 0x9026 Alpha, 21227>>20 lelong 0 invalid version 21228>>20 lelong 1 version 1 21229>>36 lelong 1 MathCoPro/FPU/MAU Required 21230>8 string >\0 (%s) 21231>5 byte 2 MSB 21232>>16 beshort 0 no file type, 21233>>16 beshort 1 relocatable, 21234>>16 beshort 2 executable, 21235>>16 beshort 3 shared object, 21236>>16 beshort 4 core file, 21237>>>(0x38+0xcc) string >\0 of '%s' 21238>>>(0x38+0x10) belong >0 (signal %d), 21239>>16 beshort &0xff00 processor-specific, 21240>>18 beshort 0 no machine, 21241>>18 beshort 1 AT&T WE32100, 21242>>18 beshort 2 SPARC, 21243>>18 beshort 3 Intel 80386 - invalid byte order, 21244>>18 beshort 4 Motorola 68000, 21245>>18 beshort 5 Motorola 88000, 21246>>18 beshort 6 Intel 80486 - invalid byte order, 21247>>18 beshort 7 Intel 80860, 21248>>18 beshort 8 MIPS R3000_BE, 21249>>18 beshort 9 Amdahl, 21250>>18 beshort 10 MIPS R3000_LE - invalid byte order, 21251>>18 beshort 11 RS6000, 21252>>18 beshort 15 PA-RISC, 21253>>18 beshort 16 nCUBE, 21254>>18 beshort 17 VPP500, 21255>>18 beshort 18 SPARC32PLUS, 21256>>18 beshort 20 PowerPC or cisco 4500, 21257>>18 beshort 21 cisco 7500, 21258>>18 beshort 24 cisco SVIP, 21259>>18 beshort 25 cisco 7200, 21260>>18 beshort 36 cisco 12000, 21261>>18 beshort 0x9026 Alpha, 21262>>20 belong 0 invalid version 21263>>20 belong 1 version 1 21264>>36 belong 1 MathCoPro/FPU/MAU Required 21265 21266#------------------------------------------------------------------------------ 21267# $File: os2,v 1.10 2017/03/17 21:35:28 christos Exp $ 21268# os2: file(1) magic for OS/2 files 21269# 21270 21271# Provided 1998/08/22 by 21272# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 212731 search/100 InternetShortcut MS Windows 95 Internet shortcut text 21274>17 search/100 URL= (URL=< 21275>>&0 string x \b%s>) 21276 21277# OS/2 URL objects 21278# Provided 1998/08/22 by 21279# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 21280#0 string http: OS/2 URL object text 21281#>5 string >\ (WWW) <http:%s> 21282#0 string mailto: OS/2 URL object text 21283#>7 string >\ (email) <%s> 21284#0 string news: OS/2 URL object text 21285#>5 string >\ (Usenet) <%s> 21286#0 string ftp: OS/2 URL object text 21287#>4 string >\ (FTP) <ftp:%s> 21288#0 string file: OS/2 URL object text 21289#>5 string >\ (Local file) <%s> 21290 21291# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com) 21292# Carl Hauser (chauser.parc@xerox.com) and 21293# Marcus Groeber (marcusg@ph-cip.uni-koeln.de) 21294# list the following header format in inf02a.doc: 21295# 21296# int16 ID; // ID magic word (5348h = "HS") 21297# int8 unknown1; // unknown purpose, could be third letter of ID 21298# int8 flags; // probably a flag word... 21299# // bit 0: set if INF style file 21300# // bit 4: set if HLP style file 21301# // patching this byte allows reading HLP files 21302# // using the VIEW command, while help files 21303# // seem to work with INF settings here as well. 21304# int16 hdrsize; // total size of header 21305# int16 unknown2; // unknown purpose 21306# 213070 string HSP\x01\x9b\x00 OS/2 INF 21308>107 string >0 (%s) 213090 string HSP\x10\x9b\x00 OS/2 HLP 21310>107 string >0 (%s) 21311 21312# OS/2 INI (this is a guess) 213130 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI 21314 21315#------------------------------------------------------------------------------ 21316# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $ 21317# os400: file(1) magic for IBM OS/400 files 21318# 21319# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com 21320# In spite of its quite variable format (due to internal memory page 21321# length differences between CISC and RISC versions of the OS) the 21322# SAVF structure hasn't suitable offsets to identify the catalog 21323# header in the first descriptor where there are some useful infos, 21324# so we must search in a somewhat large area for a particular string 21325# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore 21326# descriptor space) preceded by a two byte constant. 21327# 213281090 search/7393 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data 21329>&212 byte 0x01 \b, created with SAVOBJ 21330>&212 byte 0x02 \b, created with SAVLIB 21331>&212 byte 0x07 \b, created with SAVCFG 21332>&212 byte 0x08 \b, created with SAVSECDTA 21333>&212 byte 0x0A \b, created with SAVSECDTA 21334>&212 byte 0x0B \b, created with SAVDLO 21335>&212 byte 0x0D \b, created with SAVLICPGM 21336>&212 byte 0x11 \b, created with SAVCHGOBJ 21337>&213 byte 0x44 \b, at least V5R4 to open 21338>&213 byte 0x43 \b, at least V5R3 to open 21339>&213 byte 0x42 \b, at least V5R2 to open 21340>&213 byte 0x41 \b, at least V5R1 to open 21341>&213 byte 0x40 \b, at least V4R5 to open 21342>&213 byte 0x3F \b, at least V4R4 to open 21343>&213 byte 0x3E \b, at least V4R3 to open 21344>&213 byte 0x3C \b, at least V4R2 to open 21345>&213 byte 0x3D \b, at least V4R1M4 to open 21346>&213 byte 0x3B \b, at least V4R1 to open 21347>&213 byte 0x3A \b, at least V3R7 to open 21348>&213 byte 0x35 \b, at least V3R6 to open 21349>&213 byte 0x36 \b, at least V3R2 to open 21350>&213 byte 0x34 \b, at least V3R1 to open 21351>&213 byte 0x31 \b, at least V3R0M5 to open 21352>&213 byte 0x30 \b, at least V2R3 to open 21353 21354#------------------------------------------------------------------------------ 21355# $File: os9,v 1.8 2017/03/17 21:35:28 christos Exp $ 21356# 21357# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved. 21358# 21359# Redistribution and use in source and binary forms, with or without 21360# modification, are permitted provided that the following conditions 21361# are met: 21362# 1. Redistributions of source code must retain the above copyright 21363# notice, this list of conditions and the following disclaimer. 21364# 2. Redistributions in binary form must reproduce the above copyright 21365# notice, this list of conditions and the following disclaimer in the 21366# documentation and/or other materials provided with the distribution. 21367# 21368# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 21369# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 21370# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21371# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 21372# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 21373# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; 21374# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 21375# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 21376# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 21377# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 21378# 21379# 21380# 21381# OS9/6809 module descriptions: 21382# 213830 beshort 0x87CD OS9/6809 module: 21384# 21385>6 byte&0x0f 0x00 non-executable 21386>6 byte&0x0f 0x01 machine language 21387>6 byte&0x0f 0x02 BASIC I-code 21388>6 byte&0x0f 0x03 Pascal P-code 21389>6 byte&0x0f 0x04 C I-code 21390>6 byte&0x0f 0x05 COBOL I-code 21391>6 byte&0x0f 0x06 Fortran I-code 21392# 21393>6 byte&0xf0 0x10 program executable 21394>6 byte&0xf0 0x20 subroutine 21395>6 byte&0xf0 0x30 multi-module 21396>6 byte&0xf0 0x40 data module 21397# 21398>6 byte&0xf0 0xC0 system module 21399>6 byte&0xf0 0xD0 file manager 21400>6 byte&0xf0 0xE0 device driver 21401>6 byte&0xf0 0xF0 device descriptor 21402# 21403# OS9/m68k stuff (to be continued) 21404# 214050 beshort 0x4AFC OS9/68K module: 21406# 21407# attr 21408>0x14 byte&0x80 0x80 re-entrant 21409>0x14 byte&0x40 0x40 ghost 21410>0x14 byte&0x20 0x20 system-state 21411# 21412# lang: 21413# 21414>0x13 byte 1 machine language 21415>0x13 byte 2 BASIC I-code 21416>0x13 byte 3 Pascal P-code 21417>0x13 byte 4 C I-code 21418>0x13 byte 5 COBOL I-code 21419>0x13 byte 6 Fortran I-code 21420# 21421# 21422# type: 21423# 21424>0x12 byte 1 program executable 21425>0x12 byte 2 subroutine 21426>0x12 byte 3 multi-module 21427>0x12 byte 4 data module 21428>0x12 byte 11 trap library 21429>0x12 byte 12 system module 21430>0x12 byte 13 file manager 21431>0x12 byte 14 device driver 21432>0x12 byte 15 device descriptor 21433 21434#------------------------------------------------------------------------------ 21435# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $ 21436# 21437# Mach magic number info 21438# 214390 long 0xefbe OSF/Rose object 21440# I386 magic number info 21441# 214420 short 0565 i386 COFF object 21443 21444#------------------------------------------------------------------------------ 21445# $File: palm,v 1.13 2014/03/30 21:40:08 christos Exp $ 21446# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks 21447# 21448# Brian Lalor <blalor@hcirisc.cs.binghamton.edu> 21449 21450# These are weak, byte 59 is not guaranteed to be 0 and there are 21451# 8 character identifiers at byte 60, one I found for appl is BIGb. 21452# What are the possibilities and where is this documented? 21453 21454# The common header format for PalmOS .pdb/.prc files is 21455# { 21456# char name[ 32 ]; 21457# Word attributes; 21458# Word version; 21459# DWord creationDate; 21460# DWord modificationDate; 21461# DWord lastBackupDate; 21462# DWord modificationNumber; 21463# DWord appInfoID; 21464# DWord sortInfoID; 21465# char type[4]; 21466# char creator[4]; 21467# DWord uniqueIDSeed; 21468# RecordListType recordList; 21469# }; 21470# 21471# Datestamps are unsigned seconds since the MacOS epoch (Jan 1, 1904), 21472# or Unix/POSIX time + 2082844800. 21473 214740 name aportisdoc 21475# date is supposed to be big-endian seconds since 1 Jan 1904, but many 21476# files contain the timestamp in little-endian or a completely 21477# nonsensical value... 21478#>36 bedate-2082844800 >0 \b, created %s 21479# compression: 1=uncomp, 2=orig, 0x4448=HuffDic 21480>(78.L) beshort =1 \b, uncompressed 21481# compressed 21482>(78.L) beshort >1 21483>>(78.L+4) belong x \b, %d bytes uncompressed 21484 21485# appl 21486#60 string appl PalmOS application 21487#>0 string >\0 "%s" 21488 21489# HACK 21490#60 string HACK HackMaster hack 21491#>0 string >\0 "%s" 21492 21493# iSiloX e-book 2149460 string SDocSilX iSiloX E-book 21495>0 string >\0 "%s" 21496 21497# Mobipocket (www.mobipocket.com), donated by Carl Witty 21498# expanded by Ralf Brown 2149960 string BOOKMOBI Mobipocket E-book 21500# MobiPocket stores a full title, pointed at by the belong at offset 21501# 0x54 in its header at (78.L), with length given by the belong at 21502# offset 0x58. 21503# there's no guarantee that the title string is null-terminated, but 21504# we currently can't specify a variable-length string where the length 21505# field is not at the start of the string; in practice, the data 21506# following the string always seems to start with a zero byte 21507>(78.L) belong x 21508>>&(&0x50.L-4) string >\0 "%s" 21509>0 use aportisdoc 21510>>(78.L+0x68) belong >0 \b, version %d 21511>>(78.L+0x1C) belong !0 \b, codepage %d 21512>>(78.L+0x0C) beshort >0 \b, encrypted (type %d) 21513 21514# AportisDoc/PalmDOC 2151560 string TEXtREAd AportisDoc/PalmDOC E-book 21516>0 string >\0 "%s" 21517>0 use aportisdoc 21518 21519# Variety of PalmOS document types 21520# Michael-John Turner <mj@debian.org> 21521# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType 2152260 string BVokBDIC BDicty PalmOS document 21523>0 string >\0 "%s" 2152460 string DB99DBOS DB PalmOS document 21525>0 string >\0 "%s" 2152660 string vIMGView FireViewer/ImageViewer PalmOS document 21527>0 string >\0 "%s" 2152860 string PmDBPmDB HanDBase PalmOS document 21529>0 string >\0 "%s" 2153060 string InfoINDB InfoView PalmOS document 21531>0 string >\0 "%s" 2153260 string ToGoToGo iSilo PalmOS document 21533>0 string >\0 "%s" 2153460 string JfDbJBas JFile PalmOS document 21535>0 string >\0 "%s" 2153660 string JfDbJFil JFile Pro PalmOS document 21537>0 string >\0 "%s" 2153860 string DATALSdb List PalmOS document 21539>0 string >\0 "%s" 2154060 string Mdb1Mdb1 MobileDB PalmOS document 21541>0 string >\0 "%s" 2154260 string PNRdPPrs PeanutPress PalmOS document 21543>0 string >\0 "%s" 2154460 string DataPlkr Plucker PalmOS document 21545>0 string >\0 "%s" 2154660 string DataSprd QuickSheet PalmOS document 21547>0 string >\0 "%s" 2154860 string SM01SMem SuperMemo PalmOS document 21549>0 string >\0 "%s" 2155060 string TEXtTlDc TealDoc PalmOS document 21551>0 string >\0 "%s" 2155260 string InfoTlIf TealInfo PalmOS document 21553>0 string >\0 "%s" 2155460 string DataTlMl TealMeal PalmOS document 21555>0 string >\0 "%s" 2155660 string DataTlPt TealPaint PalmOS document 21557>0 string >\0 "%s" 2155860 string dataTDBP ThinkDB PalmOS document 21559>0 string >\0 "%s" 2156060 string TdatTide Tides PalmOS document 21561>0 string >\0 "%s" 2156260 string ToRaTRPW TomeRaider PalmOS document 21563>0 string >\0 "%s" 21564 21565# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net) 21566# For version 1.xx zTXTs, outputs version and numbers of bookmarks and 21567# annotations. 21568# For other versions, just outputs version. 21569# 2157060 string zTXT A GutenPalm zTXT e-book 21571>0 string >\0 "%s" 21572>(0x4E.L) byte 0 21573>>(0x4E.L+1) byte x (v0.%02d) 21574>(0x4E.L) byte 1 21575>>(0x4E.L+1) byte x (v1.%02d) 21576>>>(0x4E.L+10) beshort >0 21577>>>>(0x4E.L+10) beshort <2 - 1 bookmark 21578>>>>(0x4E.L+10) beshort >1 - %d bookmarks 21579>>>(0x4E.L+14) beshort >0 21580>>>>(0x4E.L+14) beshort <2 - 1 annotation 21581>>>>(0x4E.L+14) beshort >1 - %d annotations 21582>(0x4E.L) byte >1 (v%d. 21583>>(0x4E.L+1) byte x %02d) 21584 21585# Palm OS .prc file types 2158660 string libr 21587# flags, only bit 0 or bit 6 21588# http://en.wikipedia.org/wiki/PRC_%28Palm_OS%29 21589# http://web.mit.edu/tytso/www/pilot/prc-format.html 21590>0x20 beshort&0xffbe 0 21591>>0 string >\0 Palm OS dynamic library data "%s" 2159260 string ptch Palm OS operating system patch data 21593>0 string >\0 "%s" 21594 21595# Mobipocket (www.mobipocket.com), donated by Carl Witty 2159660 string BOOKMOBI Mobipocket E-book 21597>0 string >\0 "%s" 21598 21599#------------------------------------------------------------------------------ 21600# $File: parix,v 1.4 2009/09/19 16:28:11 christos Exp $ 21601# 21602# Parix COFF executables 21603# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de> 21604# 216050 beshort&0xfff 0xACE PARIX 21606>0 byte&0xf0 0x80 T800 21607>0 byte&0xf0 0x90 T9000 21608>19 byte&0x02 0x02 executable 21609>19 byte&0x02 0x00 object 21610>19 byte&0x0c 0x00 not stripped 21611#------------------------------------------------------------------------------ 21612# $File: parrot,v 1.1 2010/07/08 20:18:40 christos Exp $ 21613# parrot: file(1) magic for Parrot Virtual Machine 21614# URL: http://www.lua.org/ 21615# From: Lubomir Rintel <lkundrak@v3.sk> 21616 21617# Compiled Parrot byte code 216180 string \376PBC\r\n\032\n Parrot bytecode 21619>64 byte x %d. 21620>72 byte x \b%d, 21621>8 byte >0 %d byte words, 21622>16 byte 0 little-endian, 21623>16 byte 1 big-endian, 21624>32 byte 0 IEEE-754 8 byte double floats, 21625>32 byte 1 x86 12 byte long double floats, 21626>32 byte 2 IEEE-754 16 byte long double floats, 21627>32 byte 3 MIPS 16 byte long double floats, 21628>32 byte 4 AIX 16 byte long double floats, 21629>32 byte 5 4-byte floats, 21630>40 byte x Parrot %d. 21631>48 byte x \b%d. 21632>56 byte x \b%d 21633#------------------------------------------------------------------------------ 21634# $File: pascal,v 1.2 2014/07/14 14:21:33 rrt Exp $ 21635# pascal: file(1) magic for Pascal source 21636# 216370 search/8192 (input, Pascal source text 21638!:mime text/x-pascal 21639#0 regex \^program Pascal source text 21640#!:mime text/x-pascal 21641#0 regex \^record Pascal source text 21642#!:mime text/x-pascal 21643 21644#------------------------------------------------------------------------------ 21645# $File: pbf,v 1.2 2017/01/18 16:16:21 christos Exp $ 21646# file(1) magic(5) data for OpenStreetMap 21647 21648# OpenStreetMap Protocolbuffer Binary Format (.osm.pbf) 21649# http://wiki.openstreetmap.org/wiki/PBF_Format 21650# From: Markus Heidelberg <markus.heidelberg@web.de> 216510 belong&0xfffffff0 0 21652>4 beshort 0x0A09 21653>>6 string OSMHeader OpenStreetMap Protocolbuffer Binary Format 21654 21655#------------------------------------------------------------------------------ 21656# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $ 21657# pbm: file(1) magic for Portable Bitmap files 21658# 21659# XXX - byte order? 21660# 216610 short 0x2a17 "compact bitmap" format (Poskanzer) 21662#------------------------------------------------------------------------------ 21663# pc88: file(1) magic for the NEC Home Computer 21664# v1.0 21665# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 21666 21667# PC88 2D disk image 216680x20 ulelong&0xFFFFFEFF 0x2A0 21669>0x10 string \0\0\0\0\0\0\0\0\0\0 21670>>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 21671>>>0x1A ubyte&0xEF 0 21672>>>>0x1B ubyte&0x8F 0 21673>>>>>0x1B ubyte&70 <0x40 21674>>>>>>0x1C ulelong >0x21 21675>>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s 21676>>>>>>>>0x1B ubyte 0 \b, media=2D 21677>>>>>>>>0x1B ubyte 0x10 \b, media=2DD 21678>>>>>>>>0x1B ubyte 0x20 \b, media=2HD 21679>>>>>>>>0x1B ubyte 0x30 \b, media=1D 21680>>>>>>>>0x1B ubyte 0x40 \b, media=1DD 21681>>>>>>>>0x1A ubyte 0x10 \b, write-protected 21682 21683 21684 21685 21686#------------------------------------------------------------------------------ 21687# pc98: file(1) magic for the MSX Home Computer 21688# v1.0 21689# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 21690 21691# Maki-chan v1 Graphic format 21692# The image resolution should be X=(44.L - 40.L) and Y=(46.L - 42.L), but I couldn't find a way to do so 21693# http://www.jisyo.com/viewer/faq/maki_tech.htm 216940 string/b MAKI01 Maki-chan v1. 21695>6 ubyte|0x20 x \b%c image 21696>8 ubelong >0x40404040 \b, system ID: 21697>>8 byte x %c 21698>>9 byte x \b%c 21699>>10 byte x \b%c 21700>>11 byte x \b%c 21701>44 ubeshort x \b, %dx 21702>46 ubeshort x \b%d 21703>38 ubeshort&2 0 \b, 16 paletted RGB colors 21704>38 ubeshort&2 2 \b, 8 fixed RGB colors 21705>38 ubeshort&1 1 \b, 2:1 dot aspect ratio 21706 21707# Maki-chan v2 Graphic format 21708# http://www.jisyo.com/viewer/faq/mag_tech.htm 21709# http://mooncore.eu/bunny/txt/makichan.htm 21710# http://metanest.jp/mag/mag.xhtml 217110 string/b MAKI02\ \ Maki-chan v2 image, 21712>8 byte x system ID: %c 21713>9 byte x \b%c 21714>10 byte x \b%c 21715>11 byte x \b%c, 21716>13 search/0x200 \x1A 21717#Maki-chan video modes are a bit messy and seems to have been expanded over the years without too much planing: 21718#1) When offset1(ubeshort) !=0x0344: 21719# 1.1) And offset3(ubyte).b7=0: 21720# - b0=pixel aspect ratio: 1=2:1 (note: this ignores that the machine's 1:1 pixel aspect ratio isn't really 1:1) 21721# - b1=number of colors: 0=16 colors, 1=8 colors 21722# - b2=Palette or fixed colors flag (called "analog" and "digital" in the doc): 0=Paletted, 1=Fixed colors encoded directly in the pixel data 21723# 1.2) And offset3(ubyte).B7=1: 21724# - b0=256 paletted colors 21725# - b1=256 fixed colors using the MSX SCR8 palette 21726#2) When offset1(ubeshort) =0x0344: 21727# - 256x212 image with 19268 YJK colors. The usual resolution and color information fields from the file must be ignored 21728>>&1 ubeshort 0x0344 256x212, 19268 fixed YJK colors 21729>>&1 ubeshort !0x0344 21730>>>&5 uleshort+1 x %dx 21731>>>&7 uleshort+1 x \b%d, 21732>>>&0 ubyte&0x86 0x00 16 paletted RGB colors 21733>>>&0 ubyte&0x86 0x02 8 paletted RGB colors 21734>>>&0 ubyte&0x86 0x04 16 fixed RGB colors 21735>>>&0 ubyte&0x86 0x06 8 fixed RGB colors 21736>>>&0 ubyte&0x81 0x80 256 paletted RGB colors 21737>>>&0 ubyte&0x81 0x81 256 fixed MSX-SCR8 colors 21738>>>&0 ubyte&0x01 1 \b, 2:1 dot aspect ratio 21739 21740# XLD4 (Q4) picture 2174111 string/b MAJYO XLD4(Q4) picture 21742 21743# Yanagisawa Pi picture 21744#0 string Pi\x1A\0 Yanagisawa Pi picture 21745#>3 search/0x200 \x04 217460 string Pi 21747>2 search/0x200 \x1A 21748>>&0 ubyte 0 21749>>>&3 ubyte 4 Yanagisawa Pi 16 color picture, 21750>>>&4 byte x system ID: %c 21751>>>&5 byte x \b%c 21752>>>&6 byte x \b%c 21753>>>&7 byte x \b%c, 21754>>>&10 ubeshort x %dx 21755>>>&12 ubeshort x \b%d 21756>>>&3 ubyte 8 Yanagisawa Pi 256 color picture 21757>>>&4 byte x system ID: %c 21758>>>&5 byte x \b%c 21759>>>&6 byte x \b%c 21760>>>&7 byte x \b%c, 21761>>>&10 ubeshort x %dx 21762>>>&12 ubeshort x \b%d 21763 21764#------------------------------------------------------------------------------ 21765# $File: pdf,v 1.10 2018/05/23 22:21:01 christos Exp $ 21766# pdf: file(1) magic for Portable Document Format 21767# 21768 217690 string %PDF- PDF document 21770!:mime application/pdf 21771!:strength +60 21772>5 byte x \b, version %c 21773>7 byte x \b.%c 21774 217750 string \012%PDF- PDF document 21776!:mime application/pdf 21777!:strength +60 21778>6 byte x \b, version %c 21779>8 byte x \b.%c 21780 21781# From: Nick Schmalenberger <nick@schmalenberger.us> 21782# Forms Data Format 217830 string %FDF- FDF document 21784!:mime application/vnd.fdf 21785!:strength +60 21786>5 byte x \b, version %c 21787>7 byte x \b.%c 21788 217890 search/256 %PDF- PDF document 21790!:mime application/pdf 21791!:strength +60 21792>&0 byte x \b, version %c 21793>&2 byte x \b.%c 21794 21795#------------------------------------------------------------------------------ 21796# $File: pdp,v 1.11 2017/03/17 21:35:28 christos Exp $ 21797# pdp: file(1) magic for PDP-11 executable/object and APL workspace 21798# 217990 lelong 0101555 PDP-11 single precision APL workspace 218000 lelong 0101554 PDP-11 double precision APL workspace 21801# 21802# PDP-11 a.out 21803# 218040 leshort 0407 PDP-11 executable 21805>8 leshort >0 not stripped 21806>15 byte >0 - version %d 21807 21808# updated by Joerg Jenderek at Mar 2013 21809# GRR: line below too general as it catches also Windows precompiled setup information *.PNF 218100 leshort 0401 21811# skip *.PNF with WinDirPathOffset 58h 21812>68 ulelong !0x00000058 PDP-11 UNIX/RT ldp 21813# skip *.PNF with high byte of InfVersionDatumCount zero 21814#>>15 byte !0 PDP-11 UNIX/RT ldp 218150 leshort 0405 PDP-11 old overlay 21816 218170 leshort 0410 PDP-11 pure executable 21818>8 leshort >0 not stripped 21819>15 byte >0 - version %d 21820 218210 leshort 0411 PDP-11 separate I&D executable 21822>8 leshort >0 not stripped 21823>15 byte >0 - version %d 21824 218250 leshort 0437 PDP-11 kernel overlay 21826 21827# These last three are derived from 2.11BSD file(1) 218280 leshort 0413 PDP-11 demand-paged pure executable 21829>8 leshort >0 not stripped 21830 218310 leshort 0430 PDP-11 overlaid pure executable 21832>8 leshort >0 not stripped 21833 218340 leshort 0431 PDP-11 overlaid separate executable 21835>8 leshort >0 not stripped 21836#------------------------------------------------------------------------------ 21837# $File: perl,v 1.26 2017/02/21 18:34:55 christos Exp $ 21838# perl: file(1) magic for Larry Wall's perl language. 21839# 21840# The `eval' lines recognizes an outrageously clever hack. 21841# Keith Waclena <keith@cerberus.uchicago.edu> 21842# Send additions to <perl5-porters@perl.org> 218430 search/1024 eval\ "exec\ perl Perl script text 21844!:mime text/x-perl 218450 search/1024 eval\ "exec\ /bin/perl Perl script text 21846!:mime text/x-perl 218470 search/1024 eval\ "exec\ /usr/bin/perl Perl script text 21848!:mime text/x-perl 218490 search/1024 eval\ "exec\ /usr/local/bin/perl Perl script text 21850!:mime text/x-perl 218510 search/1024 eval\ 'exec\ perl Perl script text 21852!:mime text/x-perl 218530 search/1024 eval\ 'exec\ /bin/perl Perl script text 21854!:mime text/x-perl 218550 search/1024 eval\ 'exec\ /usr/bin/perl Perl script text 21856!:mime text/x-perl 218570 search/1024 eval\ 'exec\ /usr/local/bin/perl Perl script text 21858!:mime text/x-perl 218590 search/1024 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text 21860!:mime text/x-perl 218610 string #!/usr/bin/env\ perl Perl script text executable 21862!:mime text/x-perl 218630 string #!\ /usr/bin/env\ perl Perl script text executable 21864!:mime text/x-perl 218650 string #! 21866>0 regex \^#!.*/bin/perl([[:space:]].*)*$ Perl script text executable 21867!:mime text/x-perl 21868 21869# by Dmitry V. Levin and Alexey Tourbin 21870# check the first line 218710 search/8192 package 21872>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text 21873!:strength + 40 21874# not 'p', check other lines 218750 search/8192 !p 21876>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; 21877>>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text 21878!:strength + 75 21879 21880# Perl POD documents 21881# From: Tom Hukins <tom@eborcom.com> 218820 search/1024/W \=pod\n Perl POD document text 218830 search/1024/W \n\=pod\n Perl POD document text 218840 search/1024/W \=head1\ Perl POD document text 218850 search/1024/W \n\=head1\ Perl POD document text 218860 search/1024/W \=head2\ Perl POD document text 218870 search/1024/W \n\=head2\ Perl POD document text 218880 search/1024/W \=encoding\ Perl POD document text 218890 search/1024/W \n\=encoding\ Perl POD document text 21890 21891 21892# Perl Storable data files. 218930 string perl-store perl Storable (v0.6) data 21894>4 byte >0 (net-order %d) 21895>>4 byte &01 (network-ordered) 21896>>4 byte =3 (major 1) 21897>>4 byte =2 (major 1) 21898 218990 string pst0 perl Storable (v0.7) data 21900>4 byte >0 21901>>4 byte &01 (network-ordered) 21902>>4 byte =5 (major 2) 21903>>4 byte =4 (major 2) 21904>>5 byte >0 (minor %d) 21905 21906# This is Debian #742949 by Zefram <zefram@fysh.org>: 21907# ----------------------------------------------------------- 21908# The Perl module Hash::SharedMem 21909# <https://metacpan.org/release/Hash-SharedMem> defines a file format 21910# for a key/value store. Details of the file format are in the "DESIGN" 21911# file in the module distribution. Magic: 219120 bequad =0xa58afd185cbf5af7 Hash::SharedMem master file, big-endian 21913>8 bequad <0x1000000 21914>>15 byte >2 \b, line size 2^%d byte 21915>>14 byte >2 \b, page size 2^%d byte 21916>>13 byte &1 21917>>>13 byte >1 \b, max fanout %d 219180 lequad =0xa58afd185cbf5af7 Hash::SharedMem master file, little-endian 21919>8 lequad <0x1000000 21920>>8 byte >2 \b, line size 2^%d byte 21921>>9 byte >2 \b, page size 2^%d byte 21922>>10 byte &1 21923>>>10 byte >1 \b, max fanout %d 219240 bequad =0xc693dac5ed5e47c2 Hash::SharedMem data file, big-endian 21925>8 bequad <0x1000000 21926>>15 byte >2 \b, line size 2^%d byte 21927>>14 byte >2 \b, page size 2^%d byte 21928>>13 byte &1 21929>>>13 byte >1 \b, max fanout %d 219300 lequad =0xc693dac5ed5e47c2 Hash::SharedMem data file, little-endian 21931>8 lequad <0x1000000 21932>>8 byte >2 \b, line size 2^%d byte 21933>>9 byte >2 \b, page size 2^%d byte 21934>>10 byte &1 21935>>>10 byte >1 \b, max fanout %d 21936 21937#------------------------------------------------------------------------------ 21938# $File: pgf,v 1.2 2017/03/17 21:35:28 christos Exp $ 21939# pgf: file(1) magic for Progressive Graphics File (PGF) 21940# 21941# <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf> 21942# 2013 by Philipp Hahn <pmhahn debian org> 219430 string PGF Progressive Graphics image data, 21944!:mime image/x-pgf 21945>3 string 2 version %s, 21946>3 string 4 version %s, 21947>3 string 5 version %s, 21948>3 string 6 version %s, 21949# PGFPreHeader 21950#>>4 lelong x header size %d, 21951# PGFHeader 21952>>8 lelong x %d x 21953>>12 lelong x %d, 21954>>16 byte x %d levels, 21955>>17 byte x compression level %d, 21956>>18 byte x %d bpp, 21957>>19 byte x %d channels, 21958>>20 clear x 21959>>20 byte 0 bitmap, 21960>>20 byte 1 gray scale, 21961>>20 byte 2 indexed color, 21962>>20 byte 3 RGB color, 21963>>20 byte 4 CYMK color, 21964>>20 byte 5 HSL color, 21965>>20 byte 6 HSB color, 21966>>20 byte 7 multi-channel, 21967>>20 byte 8 duo tone, 21968>>20 byte 9 LAB color, 21969>>20 byte 10 gray scale 16, 21970>>20 byte 11 RGB color 48, 21971>>20 byte 12 LAB color 48, 21972>>20 byte 13 CYMK color 64, 21973>>20 byte 14 deep multi-channel, 21974>>20 byte 15 duo tone 16, 21975>>20 byte 17 RGBA color, 21976>>20 byte 18 gray scale 32, 21977>>20 byte 19 RGB color 12, 21978>>20 byte 20 RGB color 16, 21979>>20 byte 255 unknown format, 21980>>20 default x format 21981>>>20 byte x \b %d, 21982>>21 byte x %d bpc 21983# PGFPostHeader 21984# Level-Sizes 21985#>>(4.l+4) lelong x level 0 size: %d 21986#>>(4.l+8) lelong x level 1 size: %d 21987#>>(4.l+12) lelong x level 2 size: %d 21988 21989#------------------------------------------------------------------------------ 21990# $File: pgp,v 1.15 2018/02/24 16:11:23 christos Exp $ 21991# pgp: file(1) magic for Pretty Good Privacy 21992# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html 21993# 21994# Update: Joerg Jenderek 21995# Note: verified by `gpg -v --debug 0x02 --list-packets < PUBRING263_10.PGP` 21996#0 byte 0x99 MAYBE PGP 0x99 219970 byte 0x99 21998# 99h~10;0110;01~2=old packet type;tag 6=Public-Key Packet;1=two-octet length 21999# A two-octet body header encodes packet lengths of 192~00C0h - 8383~20BFh 22000#>1 ubeshort x \b, body length 0x%.4x 22001# skip Basic.Image Beauty.320 Pic.Icons by looking for low version number 22002#>3 ubyte x \b, V=%u 22003#>3 ubyte <5 VERSION OK 22004>3 ubyte <5 22005# next packet type often b4h~(tag 13)~User ID Packet, b0h~(tag 12)~Trust packet 22006#>>(1.S+3) ubyte x \b, next packet type 0x%x 22007# skip 9900-v4.bin 9902-v4.bin by looking for valid second packet type (bit 7=1) 22008#>>(1.S+3) ubyte >0x7F TYPE OK, 22009>>(1.S+3) ubyte >0x7F 22010# old versions 2,3 implies Pretty Good Privacy 22011>>>3 ubyte <4 PGP key public ring (v%u) 22012!:mime application/pgp-keys 22013!:ext pgp/ASD 22014>>>>4 beldate x created %s 22015# days that this key is valid. If this number is zero, then it does not expire 22016>>>>8 ubeshort >0 \b, %u days valid 22017>>>>8 ubeshort =0 \b, not expire 22018# display key algorithm 1~RSA (Encrypt or Sign) 22019>>>>10 use key_algo 22020# Multiprecision Integers (MPI) size 22021>>>>11 ubeshort x %u bits 22022# MPI 22023>>>>13 ubequad x MPI=0x%16.16llx... 22024# new version implies Pretty Good Privacy (PGP) >= 5.0 or Gnu Privacy Guard (GPG) 22025>>>3 ubyte >3 PGP/GPG key public ring (v%u) 22026!:mime application/pgp-keys 22027!:ext pgp/gpg/pkr/asd 22028>>>>4 beldate x created %s 22029# display key algorithm 17~DSA 22030>>>>8 use key_algo 22031# Multiprecision Integers (MPI) size 22032>>>>9 ubeshort x %u bits 22033>>>>11 ubequad x MPI=0x%16.16llx... 22034 220350 beshort 0x9501 PGP key security ring 22036!:mime application/x-pgp-keyring 220370 beshort 0x9500 PGP key security ring 22038!:mime application/x-pgp-keyring 220390 beshort 0xa600 PGP encrypted data 22040#!:mime application/pgp-encrypted 22041#0 string -----BEGIN\040PGP text/PGP armored data 22042!:mime text/PGP # encoding: armored data 22043#>15 string PUBLIC\040KEY\040BLOCK- public key block 22044#>15 string MESSAGE- message 22045#>15 string SIGNED\040MESSAGE- signed message 22046#>15 string PGP\040SIGNATURE- signature 22047 220482 string ---BEGIN\040PGP\040PUBLIC\040KEY\040BLOCK- PGP public key block 22049!:mime application/pgp-keys 22050>10 search/100 \n\n 22051>>&0 use pgp 220520 string -----BEGIN\040PGP\040MESSAGE- PGP message 22053!:mime application/pgp 22054>10 search/100 \n\n 22055>>&0 use pgp 220560 string -----BEGIN\040PGP\040SIGNATURE- PGP signature 22057!:mime application/pgp-signature 22058>10 search/100 \n\n 22059>>&0 use pgp 22060 22061# Decode the type of the packet based on it's base64 encoding. 22062# Idea from Mark Martinec 22063# The specification is in RFC 4880, section 4.2 and 4.3: 22064# http://tools.ietf.org/html/rfc4880#section-4.2 22065 220660 name pgp 22067>0 byte 0x67 Reserved (old) 22068>0 byte 0x68 Public-Key Encrypted Session Key (old) 22069>0 byte 0x69 Signature (old) 22070>0 byte 0x6a Symmetric-Key Encrypted Session Key (old) 22071>0 byte 0x6b One-Pass Signature (old) 22072>0 byte 0x6c Secret-Key (old) 22073>0 byte 0x6d Public-Key (old) 22074>0 byte 0x6e Secret-Subkey (old) 22075>0 byte 0x6f Compressed Data (old) 22076>0 byte 0x70 Symmetrically Encrypted Data (old) 22077>0 byte 0x71 Marker (old) 22078>0 byte 0x72 Literal Data (old) 22079>0 byte 0x73 Trust (old) 22080>0 byte 0x74 User ID (old) 22081>0 byte 0x75 Public-Subkey (old) 22082>0 byte 0x76 Unused (old) 22083>0 byte 0x77 22084>>1 byte&0xc0 0x00 Reserved 22085>>1 byte&0xc0 0x40 Public-Key Encrypted Session Key 22086>>1 byte&0xc0 0x80 Signature 22087>>1 byte&0xc0 0xc0 Symmetric-Key Encrypted Session Key 22088>0 byte 0x78 22089>>1 byte&0xc0 0x00 One-Pass Signature 22090>>1 byte&0xc0 0x40 Secret-Key 22091>>1 byte&0xc0 0x80 Public-Key 22092>>1 byte&0xc0 0xc0 Secret-Subkey 22093>0 byte 0x79 22094>>1 byte&0xc0 0x00 Compressed Data 22095>>1 byte&0xc0 0x40 Symmetrically Encrypted Data 22096>>1 byte&0xc0 0x80 Marker 22097>>1 byte&0xc0 0xc0 Literal Data 22098>0 byte 0x7a 22099>>1 byte&0xc0 0x00 Trust 22100>>1 byte&0xc0 0x40 User ID 22101>>1 byte&0xc0 0x80 Public-Subkey 22102>>1 byte&0xc0 0xc0 Unused [z%x] 22103>0 byte 0x30 22104>>1 byte&0xc0 0x00 Unused [0%x] 22105>>1 byte&0xc0 0x40 User Attribute 22106>>1 byte&0xc0 0x80 Sym. Encrypted and Integrity Protected Data 22107>>1 byte&0xc0 0xc0 Modification Detection Code 22108 22109# magic signatures to detect PGP crypto material (from stef) 22110# detects and extracts metadata from: 22111# - symmetric encrypted packet header 22112# - RSA (e=65537) secret (sub-)keys 22113 22114# 1024b RSA encrypted data 22115 221160 string \x84\x8c\x03 PGP RSA encrypted session key - 22117>3 lelong x keyid: %X 22118>7 lelong x %X 22119>11 byte 0x01 RSA (Encrypt or Sign) 1024b 22120>11 byte 0x02 RSA Encrypt-Only 1024b 22121>12 string \x04\x00 22122>12 string \x03\xff 22123>12 string \x03\xfe 22124>12 string \x03\xfd 22125>12 string \x03\xfc 22126>12 string \x03\xfb 22127>12 string \x03\xfa 22128>12 string \x03\xf9 22129>142 byte 0xd2 . 22130 22131# 2048b RSA encrypted data 22132 221330 string \x85\x01\x0c\x03 PGP RSA encrypted session key - 22134>4 lelong x keyid: %X 22135>8 lelong x %X 22136>12 byte 0x01 RSA (Encrypt or Sign) 2048b 22137>12 byte 0x02 RSA Encrypt-Only 2048b 22138>13 string \x08\x00 22139>13 string \x07\xff 22140>13 string \x07\xfe 22141>13 string \x07\xfd 22142>13 string \x07\xfc 22143>13 string \x07\xfb 22144>13 string \x07\xfa 22145>13 string \x07\xf9 22146>271 byte 0xd2 . 22147 22148# 3072b RSA encrypted data 22149 221500 string \x85\x01\x8c\x03 PGP RSA encrypted session key - 22151>4 lelong x keyid: %X 22152>8 lelong x %X 22153>12 byte 0x01 RSA (Encrypt or Sign) 3072b 22154>12 byte 0x02 RSA Encrypt-Only 3072b 22155>13 string \x0c\x00 22156>13 string \x0b\xff 22157>13 string \x0b\xfe 22158>13 string \x0b\xfd 22159>13 string \x0b\xfc 22160>13 string \x0b\xfb 22161>13 string \x0b\xfa 22162>13 string \x0b\xf9 22163>399 byte 0xd2 . 22164 22165# 3072b RSA encrypted data 22166 221670 string \x85\x02\x0c\x03 PGP RSA encrypted session key - 22168>4 lelong x keyid: %X 22169>8 lelong x %X 22170>12 byte 0x01 RSA (Encrypt or Sign) 4096b 22171>12 byte 0x02 RSA Encrypt-Only 4096b 22172>13 string \x10\x00 22173>13 string \x0f\xff 22174>13 string \x0f\xfe 22175>13 string \x0f\xfd 22176>13 string \x0f\xfc 22177>13 string \x0f\xfb 22178>13 string \x0f\xfa 22179>13 string \x0f\xf9 22180>527 byte 0xd2 . 22181 22182# 4096b RSA encrypted data 22183 221840 string \x85\x04\x0c\x03 PGP RSA encrypted session key - 22185>4 lelong x keyid: %X 22186>8 lelong x %X 22187>12 byte 0x01 RSA (Encrypt or Sign) 8129b 22188>12 byte 0x02 RSA Encrypt-Only 8129b 22189>13 string \x20\x00 22190>13 string \x1f\xff 22191>13 string \x1f\xfe 22192>13 string \x1f\xfd 22193>13 string \x1f\xfc 22194>13 string \x1f\xfb 22195>13 string \x1f\xfa 22196>13 string \x1f\xf9 22197>1039 byte 0xd2 . 22198 22199# crypto algo mapper 22200 222010 name crypto 22202>0 byte 0x00 Plaintext or unencrypted data 22203>0 byte 0x01 IDEA 22204>0 byte 0x02 TripleDES 22205>0 byte 0x03 CAST5 (128 bit key) 22206>0 byte 0x04 Blowfish (128 bit key, 16 rounds) 22207>0 byte 0x07 AES with 128-bit key 22208>0 byte 0x08 AES with 192-bit key 22209>0 byte 0x09 AES with 256-bit key 22210>0 byte 0x0a Twofish with 256-bit key 22211 22212# hash algo mapper 22213 222140 name hash 22215>0 byte 0x01 MD5 22216>0 byte 0x02 SHA-1 22217>0 byte 0x03 RIPE-MD/160 22218>0 byte 0x08 SHA256 22219>0 byte 0x09 SHA384 22220>0 byte 0x0a SHA512 22221>0 byte 0x0b SHA224 22222 22223# display public key algorithms as human readable text 222240 name key_algo 22225>0 byte 0x01 RSA (Encrypt or Sign) 22226# keep old look of version 5.28 without parentheses 22227>0 byte 0x02 RSA Encrypt-Only 22228>0 byte 0x03 RSA (Sign-Only) 22229>0 byte 16 ElGamal (Encrypt-Only) 22230>0 byte 17 DSA 22231>0 byte 18 Elliptic Curve 22232>0 byte 19 ECDSA 22233>0 byte 20 ElGamal (Encrypt or Sign) 22234>0 byte 21 Diffie-Hellman 22235>0 default x 22236>>0 ubyte <22 unknown (pub %d) 22237# this should never happen 22238>>0 ubyte >21 invalid (%d) 22239 22240# pgp symmetric encrypted data 22241 222420 byte 0x8c PGP symmetric key encrypted data - 22243>1 byte 0x0d 22244>1 byte 0x0c 22245>2 byte 0x04 22246>3 use crypto 22247>4 byte 0x01 salted - 22248>>5 use hash 22249>>14 byte 0xd2 . 22250>>14 byte 0xc9 . 22251>4 byte 0x03 salted & iterated - 22252>>5 use hash 22253>>15 byte 0xd2 . 22254>>15 byte 0xc9 . 22255 22256# encrypted keymaterial needs s2k & can be checksummed/hashed 22257 222580 name chkcrypto 22259>0 use crypto 22260>1 byte 0x00 Simple S2K 22261>1 byte 0x01 Salted S2K 22262>1 byte 0x03 Salted&Iterated S2K 22263>2 use hash 22264 22265# all PGP keys start with this prolog 22266# containing version, creation date, and purpose 22267 222680 name keyprolog 22269>0 byte 0x04 22270>1 beldate x created on %s - 22271>5 byte 0x01 RSA (Encrypt or Sign) 22272>5 byte 0x02 RSA Encrypt-Only 22273 22274# end of secret keys known signature 22275# contains e=65537 and the prolog to 22276# the encrypted parameters 22277 222780 name keyend 22279>0 string \x00\x11\x01\x00\x01 e=65537 22280>5 use crypto 22281>5 byte 0xff checksummed 22282>>6 use chkcrypto 22283>5 byte 0xfe hashed 22284>>6 use chkcrypto 22285 22286# PGP secret keys contain also the public parts 22287# these vary by bitsize of the key 22288 222890 name x1024 22290>0 use keyprolog 22291>6 string \x03\xfe 22292>6 string \x03\xff 22293>6 string \x04\x00 22294>136 use keyend 22295 222960 name x2048 22297>0 use keyprolog 22298>6 string \x80\x00 22299>6 string \x07\xfe 22300>6 string \x07\xff 22301>264 use keyend 22302 223030 name x3072 22304>0 use keyprolog 22305>6 string \x0b\xfe 22306>6 string \x0b\xff 22307>6 string \x0c\x00 22308>392 use keyend 22309 223100 name x4096 22311>0 use keyprolog 22312>6 string \x10\x00 22313>6 string \x0f\xfe 22314>6 string \x0f\xff 22315>520 use keyend 22316 22317# \x00|\x1f[\xfe\xff]).{1024})' 223180 name x8192 22319>0 use keyprolog 22320>6 string \x20\x00 22321>6 string \x1f\xfe 22322>6 string \x1f\xff 22323>1032 use keyend 22324 22325# depending on the size of the pkt 22326# we branch into the proper key size 22327# signatures defined as x{keysize} 22328 22329>0 name pgpkey 22330>0 string \x01\xd8 1024b 22331>>2 use x1024 22332>0 string \x01\xeb 1024b 22333>>2 use x1024 22334>0 string \x01\xfb 1024b 22335>>2 use x1024 22336>0 string \x01\xfd 1024b 22337>>2 use x1024 22338>0 string \x01\xf3 1024b 22339>>2 use x1024 22340>0 string \x01\xee 1024b 22341>>2 use x1024 22342>0 string \x01\xfe 1024b 22343>>2 use x1024 22344>0 string \x01\xf4 1024b 22345>>2 use x1024 22346>0 string \x02\x0d 1024b 22347>>2 use x1024 22348>0 string \x02\x03 1024b 22349>>2 use x1024 22350>0 string \x02\x05 1024b 22351>>2 use x1024 22352>0 string \x02\x15 1024b 22353>>2 use x1024 22354>0 string \x02\x00 1024b 22355>>2 use x1024 22356>0 string \x02\x10 1024b 22357>>2 use x1024 22358>0 string \x02\x04 1024b 22359>>2 use x1024 22360>0 string \x02\x06 1024b 22361>>2 use x1024 22362>0 string \x02\x16 1024b 22363>>2 use x1024 22364>0 string \x03\x98 2048b 22365>>2 use x2048 22366>0 string \x03\xab 2048b 22367>>2 use x2048 22368>0 string \x03\xbb 2048b 22369>>2 use x2048 22370>0 string \x03\xbd 2048b 22371>>2 use x2048 22372>0 string \x03\xcd 2048b 22373>>2 use x2048 22374>0 string \x03\xb3 2048b 22375>>2 use x2048 22376>0 string \x03\xc3 2048b 22377>>2 use x2048 22378>0 string \x03\xc5 2048b 22379>>2 use x2048 22380>0 string \x03\xd5 2048b 22381>>2 use x2048 22382>0 string \x03\xae 2048b 22383>>2 use x2048 22384>0 string \x03\xbe 2048b 22385>>2 use x2048 22386>0 string \x03\xc0 2048b 22387>>2 use x2048 22388>0 string \x03\xd0 2048b 22389>>2 use x2048 22390>0 string \x03\xb4 2048b 22391>>2 use x2048 22392>0 string \x03\xc4 2048b 22393>>2 use x2048 22394>0 string \x03\xc6 2048b 22395>>2 use x2048 22396>0 string \x03\xd6 2048b 22397>>2 use x2048 22398>0 string \x05X 3072b 22399>>2 use x3072 22400>0 string \x05k 3072b 22401>>2 use x3072 22402>0 string \x05{ 3072b 22403>>2 use x3072 22404>0 string \x05} 3072b 22405>>2 use x3072 22406>0 string \x05\x8d 3072b 22407>>2 use x3072 22408>0 string \x05s 3072b 22409>>2 use x3072 22410>0 string \x05\x83 3072b 22411>>2 use x3072 22412>0 string \x05\x85 3072b 22413>>2 use x3072 22414>0 string \x05\x95 3072b 22415>>2 use x3072 22416>0 string \x05n 3072b 22417>>2 use x3072 22418>0 string \x05\x7e 3072b 22419>>2 use x3072 22420>0 string \x05\x80 3072b 22421>>2 use x3072 22422>0 string \x05\x90 3072b 22423>>2 use x3072 22424>0 string \x05t 3072b 22425>>2 use x3072 22426>0 string \x05\x84 3072b 22427>>2 use x3072 22428>0 string \x05\x86 3072b 22429>>2 use x3072 22430>0 string \x05\x96 3072b 22431>>2 use x3072 22432>0 string \x07[ 4096b 22433>>2 use x4096 22434>0 string \x07\x18 4096b 22435>>2 use x4096 22436>0 string \x07+ 4096b 22437>>2 use x4096 22438>0 string \x07; 4096b 22439>>2 use x4096 22440>0 string \x07= 4096b 22441>>2 use x4096 22442>0 string \x07M 4096b 22443>>2 use x4096 22444>0 string \x073 4096b 22445>>2 use x4096 22446>0 string \x07C 4096b 22447>>2 use x4096 22448>0 string \x07E 4096b 22449>>2 use x4096 22450>0 string \x07U 4096b 22451>>2 use x4096 22452>0 string \x07. 4096b 22453>>2 use x4096 22454>0 string \x07> 4096b 22455>>2 use x4096 22456>0 string \x07@ 4096b 22457>>2 use x4096 22458>0 string \x07P 4096b 22459>>2 use x4096 22460>0 string \x074 4096b 22461>>2 use x4096 22462>0 string \x07D 4096b 22463>>2 use x4096 22464>0 string \x07F 4096b 22465>>2 use x4096 22466>0 string \x07V 4096b 22467>>2 use x4096 22468>0 string \x0e[ 8192b 22469>>2 use x8192 22470>0 string \x0e\x18 8192b 22471>>2 use x8192 22472>0 string \x0e+ 8192b 22473>>2 use x8192 22474>0 string \x0e; 8192b 22475>>2 use x8192 22476>0 string \x0e= 8192b 22477>>2 use x8192 22478>0 string \x0eM 8192b 22479>>2 use x8192 22480>0 string \x0e3 8192b 22481>>2 use x8192 22482>0 string \x0eC 8192b 22483>>2 use x8192 22484>0 string \x0eE 8192b 22485>>2 use x8192 22486>0 string \x0eU 8192b 22487>>2 use x8192 22488>0 string \x0e. 8192b 22489>>2 use x8192 22490>0 string \x0e> 8192b 22491>>2 use x8192 22492>0 string \x0e@ 8192b 22493>>2 use x8192 22494>0 string \x0eP 8192b 22495>>2 use x8192 22496>0 string \x0e4 8192b 22497>>2 use x8192 22498>0 string \x0eD 8192b 22499>>2 use x8192 22500>0 string \x0eF 8192b 22501>>2 use x8192 22502>0 string \x0eV 8192b 22503>>2 use x8192 22504 22505# PGP RSA (e=65537) secret (sub-)key header 22506 225070 byte 0x95 PGP Secret Key - 22508>1 use pgpkey 225090 byte 0x97 PGP Secret Sub-key - 22510>1 use pgpkey 225110 byte 0x9d 22512# Update: Joerg Jenderek 22513# secret subkey packet (tag 7) with same structure as secret key packet (tag 5) 22514# skip Fetus.Sys16 CALIBUS.MAIN OrbFix.Sys16.Ex by looking for positive len 22515>1 ubeshort >0 22516#>1 ubeshort x \b, body length 0x%x 22517# next packet type often 88h,89h~(tag 2)~Signature Packet 22518#>>(1.S+3) ubyte x \b, next packet type 0x%x 22519# skip Dragon.SHR DEMO.INIT by looking for positive version 22520>>3 ubyte >0 22521# skip BUISSON.13 GUITAR1 by looking for low version number 22522>>>3 ubyte <5 PGP Secret Sub-key 22523# sub-key are normally part of secret key. So it does not occur as standalone file 22524#!:ext bin 22525# version 2,3~old 4~new . Comment following line for version 5.28 look 22526>>>>3 ubyte x (v%d) 22527>>>>3 ubyte x - 22528# old versions 2 or 3 but no real example found 22529>>>>3 ubyte <4 22530# 2 byte for key bits in version 5.28 look 22531>>>>>11 ubeshort x %db 22532>>>>>4 beldate x created on %s - 22533# old versions use 2 additional bytes after time stamp 22534#>>>>>8 ubeshort x 0x%x 22535# display key algorithm 1~RSA Encrypt|Sign - 21~Diffie-Hellman 22536>>>>>10 use key_algo 22537>>>>>(11.S/8) ubequad x 22538# look after first key 22539>>>>>>&5 use keyend 22540# new version 22541>>>>3 ubyte >3 22542>>>>>9 ubeshort x %db 22543>>>>>4 beldate x created on %s - 22544# display key algorithm 22545>>>>>8 use key_algo 22546>>>>>(9.S/8) ubequad x 22547# look after first key for something like s2k 22548>>>>>>&3 use keyend 22549 22550#------------------------------------------------------------------------------ 22551# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $ 22552# pkgadd: file(1) magic for SysV R4 PKG Datastreams 22553# 225540 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4) 22555!:mime application/x-svr4-package 22556 22557#------------------------------------------------------------------------------ 22558# $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $ 22559# plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables 22560# From: "Stefan A. Haubenthal" <polluks@web.de> 22561# 225620 belong 0x00000107 Plan 9 executable, Motorola 68k 225630 belong 0x000001EB Plan 9 executable, Intel 386 225640 belong 0x00000247 Plan 9 executable, Intel 960 225650 belong 0x000002AB Plan 9 executable, SPARC 225660 belong 0x00000407 Plan 9 executable, MIPS R3000 225670 belong 0x0000048B Plan 9 executable, AT&T DSP 3210 225680 belong 0x00000517 Plan 9 executable, MIPS R4000 BE 225690 belong 0x000005AB Plan 9 executable, AMD 29000 225700 belong 0x00000647 Plan 9 executable, ARM 7-something 225710 belong 0x000006EB Plan 9 executable, PowerPC 225720 belong 0x00000797 Plan 9 executable, MIPS R4000 LE 225730 belong 0x0000084B Plan 9 executable, DEC Alpha 22574 22575#------------------------------------------------------------------------------ 22576# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $ 22577# plus5: file(1) magic for Plus Five's UNIX MUMPS 22578# 22579# XXX - byte order? Paging Hokey.... 22580# 225810 short 0x259 mumps avl global 22582>2 byte >0 (V%d) 22583>6 byte >0 with %d byte name 22584>7 byte >0 and %d byte data cells 225850 short 0x25a mumps blt global 22586>2 byte >0 (V%d) 22587>8 short >0 - %d byte blocks 22588>15 byte 0x00 - P/D format 22589>15 byte 0x01 - P/K/D format 22590>15 byte 0x02 - K/D format 22591>15 byte >0x02 - Bad Flags 22592 22593#------------------------------------------------------------------------------ 22594# $File: polyml,v 1.1 2016/02/26 15:52:45 christos Exp $ 22595# polyml: file(1) magic for PolyML 22596# 22597# PolyML 22598# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) 22599# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) 22600 22601# [0]: http://www.polyml.org/ 22602# [1]: https://github.com/polyml/polyml/blob/master/\ 22603# libpolyml/savestate.cpp#L146-L147 22604# [2]: https://github.com/polyml/polyml/blob/master/\ 22605# libpolyml/savestate.cpp#L1262-L1263 22606 22607# Type: Poly/ML saved data 22608# From: Matthew Fernandez <matthew.fernandez@gmail.com> 22609 226100 string POLYSAVE Poly/ML saved state 22611>8 long x version %u 22612 226130 string POLYMODU Poly/ML saved module 22614>8 long x version %u 22615 22616#------------------------------------------------------------------------------ 22617# $File: printer,v 1.28 2017/03/17 22:20:22 christos Exp $ 22618# printer: file(1) magic for printer-formatted files 22619# 22620 22621# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com) 226220 string %! PostScript document text 22623!:mime application/postscript 22624!:apple ASPSTEXT 22625>2 string PS-Adobe- conforming 22626>>11 string >\0 DSC level %.3s 22627>>>15 string EPS \b, type %s 22628>>>15 string Query \b, type %s 22629>>>15 string ExitServer \b, type %s 22630>>>15 search/1000 %%LanguageLevel:\040 22631>>>>&0 string >\0 \b, Level %s 22632# Some PCs have the annoying habit of adding a ^D as a document separator 226330 string \004%! PostScript document text 22634!:mime application/postscript 22635!:apple ASPSTEXT 22636>3 string PS-Adobe- conforming 22637>>12 string >\0 DSC level %.3s 22638>>>16 string EPS \b, type %s 22639>>>16 string Query \b, type %s 22640>>>16 string ExitServer \b, type %s 22641>>>16 search/1000 %%LanguageLevel:\040 22642>>>>&0 string >\0 \b, Level %s 226430 string \033%-12345X%!PS PostScript document 22644 22645# DOS EPS Binary File Header 22646# From: Ed Sznyter <ews@Black.Market.NET> 226470 belong 0xC5D0D3C6 DOS EPS Binary File 22648>4 long >0 Postscript starts at byte %d 22649>>8 long >0 length %d 22650>>>12 long >0 Metafile starts at byte %d 22651>>>>16 long >0 length %d 22652>>>20 long >0 TIFF starts at byte %d 22653>>>>24 long >0 length %d 22654 22655# Summary: Adobe's PostScript Printer Description File 22656# Extension: .ppd 22657# Reference: http://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8 22658# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr> 22659# 226600 string *PPD-Adobe:\x20 PPD file 22661>&0 string x \b, version %s 22662 22663# HP Printer Job Language 226640 string \033%-12345X@PJL HP Printer Job Language data 22665# HP Printer Job Language 22666# The header found on Win95 HP plot files is the "Silliest Thing possible" 22667# (TM) 22668# Every driver puts the language at some random position, with random case 22669# (LANGUAGE and Language) 22670# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10 22671# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de> 22672# 226730 string \033%-12345X@PJL HP Printer Job Language data 22674>&0 string >\0 %s 22675>>&0 string >\0 %s 22676>>>&0 string >\0 %s 22677>>>>&0 string >\0 %s 22678#>15 string \ ENTER\ LANGUAGE\ = 22679#>31 string PostScript PostScript 22680 22681# From: Stefan Thurner <thurners@nicsys.de> 226820 string \033%-12345X@PJL 22683>&0 search/10000 %! PJL encapsulated PostScript document text 22684 22685# Rick Richardson <rickrich@gmail.com> 22686 22687# For Fuji-Xerox Printers - HBPL stands for Host Based Printer Language 22688# For Oki Data Printers - HIPERC 22689# For Konica Minolta Printers - LAVAFLOW 22690# For Samsung Printers - QPDL 22691# For HP Printers - ZJS stands for Zenographics ZJStream 226920 string \033%-12345X@PJL HP Printer Job Language data 22693>0 search/10000 @PJL\ ENTER\ LANGUAGE=HBPL - HBPL 22694>0 search/10000 @PJL\ ENTER\ LANGUAGE=HIPERC - Oki Data HIPERC 22695>0 search/10000 @PJL\ ENTER\ LANGUAGE=LAVAFLOW - Konica Minolta LAVAFLOW 22696>0 search/10000 @PJL\ ENTER\ LANGUAGE=QPDL - Samsung QPDL 22697>0 search/10000 @PJL\ ENTER\ LANGUAGE\ =\ QPDL - Samsung QPDL 22698>0 search/10000 @PJL\ ENTER\ LANGUAGE=ZJS - HP ZJS 22699 22700 22701# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com) 227020 string \033E\033 HP PCL printer data 22703>3 string \&l0A - default page size 22704>3 string \&l1A - US executive page size 22705>3 string \&l2A - US letter page size 22706>3 string \&l3A - US legal page size 22707>3 string \&l26A - A4 page size 22708>3 string \&l80A - Monarch envelope size 22709>3 string \&l81A - No. 10 envelope size 22710>3 string \&l90A - Intl. DL envelope size 22711>3 string \&l91A - Intl. C5 envelope size 22712>3 string \&l100A - Intl. B5 envelope size 22713>3 string \&l-81A - No. 10 envelope size (landscape) 22714>3 string \&l-90A - Intl. DL envelope size (landscape) 22715 22716# IMAGEN printer-ready files: 227170 string @document( Imagen printer 22718# this only works if "language xxx" is first item in Imagen header. 22719>10 string language\ impress (imPRESS data) 22720>10 string language\ daisy (daisywheel text) 22721>10 string language\ diablo (daisywheel text) 22722>10 string language\ printer (line printer emulation) 22723>10 string language\ tektronix (Tektronix 4014 emulation) 22724# Add any other languages that your Imagen uses - remember 22725# to keep the word `text' if the file is human-readable. 22726# [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)] 22727# 22728# Now magic for IMAGEN font files... 227290 string Rast RST-format raster font data 22730>45 string >0 face %s 22731# From Jukka Ukkonen 227320 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data 22733 22734# From <mike@flyn.org> 22735# These are the /etc/magic entries to decode data sent to an Epson printer. 227360 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data 22737 22738 22739#------------------------------------------------------------------------------ 22740# zenographics: file(1) magic for Zenographics ZjStream printer data 22741# Rick Richardson <rickrich@gmail.com> 227420 string JZJZ 22743>0x12 string ZZ Zenographics ZjStream printer data (big-endian) 227440 string ZJZJ 22745>0x12 string ZZ Zenographics ZjStream printer data (little-endian) 22746 22747 22748#------------------------------------------------------------------------------ 22749# Oak Technologies printer stream 22750# Rick Richardson <rickrich@gmail.com> 227510 string OAK 22752>0x07 byte 0 22753>0x0b byte 0 Oak Technologies printer stream 22754 22755# This would otherwise be recognized as PostScript - nick@debian.org 227560 string %!VMF SunClock's Vector Map Format data 22757 22758#------------------------------------------------------------------------------ 22759# HP LaserJet 1000 series downloadable firmware file 227600 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware 22761 22762# From: Paolo <oopla@users.sf.net> 22763# Epson ESC/Page, ESC/PageColor 227640 string \x1b\x01@EJL Epson ESC/Page language printer data 22765 22766#------------------------------------------------------------------------------ 22767# $File: project,v 1.5 2017/03/17 21:35:28 christos Exp $ 22768# project: file(1) magic for Project management 22769# 22770# Magic strings for ftnchek project files. Alexander Mai 227710 string FTNCHEK_\ P project file for ftnchek 22772>10 string 1 version 2.7 22773>10 string 2 version 2.8 to 2.10 22774>10 string 3 version 2.11 or later 22775 22776#------------------------------------------------------------------------------ 22777# $File: psdbms,v 1.8 2017/03/17 21:35:28 christos Exp $ 22778# psdbms: file(1) magic for psdatabase 22779# 22780# Update: Joerg Jenderek 22781# GRR: line below too general as it catches also some Panorama database *.pan , 22782# AppleWorks word processor 227830 belong&0xff00ffff 0x56000000 22784# assume version starts with digit 22785>1 regex/s =^[0-9] ps database 22786>>1 string >\0 version %s 22787# kernel name 22788>>4 string >\0 from kernel %s 22789 22790#------------------------------------------------------------------------------ 22791# $File: psl,v 1.2 2016/07/14 17:34:27 christos Exp $ 22792# psl: file(1) magic for Public Suffix List representations 22793# From: Daniel Kahn Gillmor <dkg@fifthhorseman.net> 22794# URL: https://publicsuffix.org 22795# see also: http://thread.gmane.org/gmane.network.dns.libpsl.bugs/162/focus=166 22796 227970 search/512 \n\n//\ ===BEGIN\ ICANN\ DOMAINS===\n\n Public Suffix List data 22798 227990 string .DAFSA@PSL_ 22800>15 string \n Public Suffix List data (optimized) 22801>>11 byte >0x2f 22802>>>11 byte <0x3a (Version %c) 22803 22804#------------------------------------------------------------------------------ 22805# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $ 22806# pulsar: file(1) magic for Pulsar POP3 daemon binary files 22807# 22808# http://pulsar.sourceforge.net 22809# mailto:rok.papez@lugos.si 22810# 22811 228120 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file. 22813>4 ubelong x Version: %d. 22814>8 ubelong x \b%d 22815 22816 22817#------------------------------------------------------------------------------ 22818# $File: pwsafe,v 1.1 2012/10/25 00:12:19 christos Exp $ 22819# pwsafe: file(1) magic for passwordsafe file 22820# 22821# Password Safe 22822# http://passwordsafe.sourceforge.net/ 22823# file format specs 22824# http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt 22825# V2 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt 22826# V1 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt 22827# V2 and V1 have no easy identifier that I can find 22828# .psafe3 228290 string PWS3 Password Safe V3 database 22830 22831#------------------------------------------------------------------------------ 22832# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $ 22833# pyramid: file(1) magic for Pyramids 22834# 22835# XXX - byte order? 22836# 228370 long 0x50900107 Pyramid 90x family executable 228380 long 0x50900108 Pyramid 90x family pure executable 22839>16 long >0 not stripped 228400 long 0x5090010b Pyramid 90x family demand paged pure executable 22841>16 long >0 not stripped 22842 22843#------------------------------------------------------------------------------ 22844# $File: python,v 1.34 2017/08/14 07:40:38 christos Exp $ 22845# python: file(1) magic for python 22846# 22847# Outlook puts """ too for urgent messages 22848# From: David Necas <yeti@physics.muni.cz> 22849# often the module starts with a multiline string 228500 string/t """ Python script text executable 22851# MAGIC as specified in Python/import.c (1.5 to 2.7a0 and 3.1a0, assuming 22852# that Py_UnicodeFlag is off for Python 2) 22853# two bytes of magic followed by "\r\n" in little endian order 228540 belong 0x994e0d0a python 1.5/1.6 byte-compiled 228550 belong 0x87c60d0a python 2.0 byte-compiled 228560 belong 0x2aeb0d0a python 2.1 byte-compiled 228570 belong 0x2ded0d0a python 2.2 byte-compiled 228580 belong 0x3bf20d0a python 2.3 byte-compiled 228590 belong 0x6df20d0a python 2.4 byte-compiled 228600 belong 0xb3f20d0a python 2.5 byte-compiled 228610 belong 0xd1f20d0a python 2.6 byte-compiled 228620 belong 0x03f30d0a python 2.7 byte-compiled 228630 belong 0x3b0c0d0a python 3.0 byte-compiled 228640 belong 0x4f0c0d0a python 3.1 byte-compiled 228650 belong 0x6c0c0d0a python 3.2 byte-compiled 228660 belong 0x9e0c0d0a python 3.3 byte-compiled 228670 belong 0xee0c0d0a python 3.4 byte-compiled 228680 belong 0x160d0d0a python 3.5.1- byte-compiled 228690 belong 0x170d0d0a python 3.5.2+ byte-compiled 228700 belong 0x330d0d0a python 3.6 byte-compiled 228710 belong 0x3e0d0d0a python 3.7 byte-compiled 22872 22873 228740 search/1/w #!\ /usr/bin/python Python script text executable 22875!:strength + 15 22876!:mime text/x-python 228770 search/1/w #!\ /usr/local/bin/python Python script text executable 22878!:strength + 15 22879!:mime text/x-python 228800 search/1 #!/usr/bin/env\ python Python script text executable 22881!:strength + 15 22882!:mime text/x-python 228830 search/10 #!\ /usr/bin/env\ python Python script text executable 22884!:strength + 15 22885!:mime text/x-python 22886 22887 22888# from module.submodule import func1, func2 228890 regex \^from[\040\t\f\r\n]+([A-Za-z0-9_]|\\.)+[\040\t\f\r\n]+import.*$ Python script text executable 22890!:strength + 15 22891!:mime text/x-python 22892 22893# def __init__ (self, ...): 228940 search/4096 def\ __init__ 22895>&0 search/64 self Python script text executable 22896!:strength + 15 22897!:mime text/x-python 22898 22899# if __name__ == "__main__": 229000 search/4096 if\ __name__ 22901>&0 search/64 '__main__' Python script text executable 22902>&0 search/64 "__main__" Python script text executable 22903!:strength + 15 22904!:mime text/x-python 22905 22906# import module [as abrev] 229070 regex/4096 \^import\ [_[:alpha:]]+\ as\ [[:alpha:]][[:space:]]*$ Python script text executable 22908!:mime text/x-python 22909 22910# comments 22911#0 search/4096 ''' 22912#>&0 regex .*'''$ Python script text executable 22913#!:mime text/x-python 22914 22915#0 search/4096 """ 22916#>&0 regex .*"""$ Python script text executable 22917#!:mime text/x-python 22918 22919# try: 22920# except: or finally: 22921# block 229220 search/4096 try: 22923>&0 regex/4096 \^[[:space:]]*except.*:$ Python script text executable 22924!:strength + 15 22925!:mime text/x-python 22926>&0 search/4096 finally: Python script text executable 22927!:mime text/x-python 22928 22929# class name[(base classes,)]: [pass] 229300 regex \^class\ [_[:alpha:]]+(\\(.*\\))?(\ )*:([\ \t]+pass)?$ Python script text executable 22931!:strength + 15 22932!:mime text/x-python 22933 22934# def name(*args, **kwargs): 229350 regex/4096 \^[[:space:]]{0,50}def\ {1,50}[_a-zA-Z]{1,100} 22936>&0 regex \\(([[:alpha:]*_,\ ]){0,255}\\):$ Python script text executable 22937!:strength + 15 22938!:mime text/x-python 22939 22940#------------------------------------------------------------------------------ 22941# $File: qt,v 1.2 2014/12/16 19:49:29 christos Exp $ 22942# qt: file(1) magic for Qt 22943 22944# http://doc.qt.io/qt-5/resources.html 229450 string \<!DOCTYPE\040RCC\> Qt Resource Collection file 22946 22947# https://qt.gitorious.org/qt/qtbase/source/\ 22948# 5367fa356233da4c0f28172a8f817791525f5457:\ 22949# src/tools/rcc/rcc.cpp#L840 229500 string qres\0\0 Qt Binary Resource file 229510 search/1024 The\040Resource\040Compiler\040for\040Qt Qt C-code resource file 22952 22953# https://qt.gitorious.org/qt/qtbase/source/\ 22954# 5367fa356233da4c0f28172a8f817791525f5457:\ 22955# src/corelib/kernel/qtranslator.cpp#L62 229560 string \x3c\xb8\x64\x18\xca\xef\x9c\x95 22957>8 string \xcd\x21\x1c\xbf\x60\xa1\xbd\xdd Qt Translation file 22958 22959#------------------------------------------------------------------------------ 22960# $File: revision,v 1.10 2017/10/19 16:40:37 christos Exp $ 22961# file(1) magic for revision control files 22962# From Hendrik Scholz <hendrik@scholz.net> 229630 string/t /1\ :pserver: cvs password text file 22964 22965# Conary changesets 22966# From: Jonathan Smith <smithj@rpath.com> 229670 belong 0xea3f81bb Conary changeset data 22968 22969# Type: Git bundles (git-bundle) 22970# From: Josh Triplett <josh@freedesktop.org> 229710 string #\ v2\ git\ bundle\n Git bundle 22972 22973# Type: Git pack 22974# From: Adam Buchbinder <adam.buchbinder@gmail.com> 22975# Update: Joerg Jenderek 22976# URL: http://fileformats.archiveteam.org/wiki/Git 22977# reference: https://github.com/git/git/blob/master/Documentation/technical/pack-format.txt 22978# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However, 22979# those have a little-endian offset immediately following the magic 'PACK', 22980# the first byte of which is never 0, while the first byte of the Git pack 22981# version, since it's a tiny number stored in big-endian format, is always 0. 229820 string PACK 22983# GRR: line above is too general as it matches also PackDir archive ./acorn 22984# test for major version. Git 2017 accepts version number 2 or 3 22985>4 ubelong <9 22986# Acorn PackDir with method 0 compression has root like ADFS::HardDisc4.$.AsylumSrc 22987# or SystemDevice::foobar 22988>>9 search/13 :: 22989# but in git binary 22990>>9 default x Git pack 22991!:mime application/x-git 22992!:ext pack 22993# 4 GB limit implies unsigned integer 22994>>>4 ubelong x \b, version %u 22995>>>8 ubelong x \b, %u objects 22996 22997# Type: Git pack index 22998# From: Adam Buchbinder <adam.buchbinder@gmail.com> 229990 string \377tOc Git pack index 23000>4 belong =2 \b, version 2 23001 23002# Type: Git index file 23003# From: Frederic Briare <fbriere@fbriere.net> 230040 string DIRC Git index 23005>4 belong >0 \b, version %d 23006>>8 belong >0 \b, %d entries 23007 23008# Type: Mercurial bundles 23009# From: Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 230100 string HG10 Mercurial bundle, 23011>4 string UN uncompressed 23012>4 string BZ bzip2 compressed 23013 23014# Type: Subversion (SVN) dumps 23015# From: Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de> 230160 string SVN-fs-dump-format-version: Subversion dumpfile 23017>28 string >\0 (version: %s) 23018 23019# Type: Bazaar revision bundles and merge requests 23020# URL: http://www.bazaar-vcs.org/ 23021# From: Jelmer Vernooij <jelmer@samba.org> 230220 string #\ Bazaar\ revision\ bundle\ v Bazaar Bundle 230230 string #\ Bazaar\ merge\ directive\ format Bazaar merge directive 23024 23025#------------------------------------------------------------------------------ 23026# $File: riff,v 1.33 2017/10/06 01:11:24 christos Exp $ 23027# riff: file(1) magic for RIFF format 23028# See 23029# 23030# http://www.seanet.com/users/matts/riffmci/riffmci.htm 23031# http://www-mmsp.ece.mcgill.ca/Documents/AudioFormats/WAVE/Docs/riffmci.pdf 23032# 23033 23034# audio format tag. Assume limits: max 1024 bit, 128 channels, 1 MHz 230350 name riff-wave 23036>0 leshort 1 \b, Microsoft PCM 23037>>14 leshort >0 23038>>>14 leshort <1024 \b, %d bit 23039>0 leshort 2 \b, Microsoft ADPCM 23040>0 leshort 6 \b, ITU G.711 A-law 23041>0 leshort 7 \b, ITU G.711 mu-law 23042>0 leshort 8 \b, Microsoft DTS 23043>0 leshort 17 \b, IMA ADPCM 23044>0 leshort 20 \b, ITU G.723 ADPCM (Yamaha) 23045>0 leshort 49 \b, GSM 6.10 23046>0 leshort 64 \b, ITU G.721 ADPCM 23047>0 leshort 80 \b, MPEG 23048>0 leshort 85 \b, MPEG Layer 3 23049>0 leshort 0x2001 \b, DTS 23050>2 leshort =1 \b, mono 23051>2 leshort =2 \b, stereo 23052>2 leshort >2 23053>>2 leshort <128 \b, %d channels 23054>4 lelong >0 23055>>4 lelong <1000000 %d Hz 23056 23057# try to find "fmt " 230580 name riff-walk 23059>0 string fmt\x20 23060>>4 lelong <0x80 23061>>>8 use riff-wave 23062>0 string LIST 23063>>&(4.l+4) use riff-walk 23064>0 string DISP 23065>>&(4.l+4) use riff-walk 23066>0 string bext 23067>>&(4.l+4) use riff-walk 23068>0 string Fake 23069>>&(4.l+4) use riff-walk 23070>0 string fact 23071>>&(4.l+4) use riff-walk 23072>0 string VP8 23073>>11 byte 0x9d 23074>>>12 byte 0x01 23075>>>>13 byte 0x2a \b, VP8 encoding 23076>>>>>14 leshort&0x3fff x \b, %d 23077>>>>>16 leshort&0x3fff x \bx%d, Scaling: 23078>>>>>14 leshort&0xc000 0x0000 \b [none] 23079>>>>>14 leshort&0xc000 0x1000 \b [5/4] 23080>>>>>14 leshort&0xc000 0x2000 \b [5/3] 23081>>>>>14 leshort&0xc000 0x3000 \b [2] 23082>>>>>14 leshort&0xc000 0x0000 \bx[none] 23083>>>>>14 leshort&0xc000 0x1000 \bx[5/4] 23084>>>>>14 leshort&0xc000 0x2000 \bx[5/3] 23085>>>>>14 leshort&0xc000 0x3000 \bx[2] 23086>>>>>15 byte&0x80 =0x00 \b, YUV color 23087>>>>>15 byte&0x80 =0x80 \b, bad color specification 23088>>>>>15 byte&0x40 =0x40 \b, no clamping required 23089>>>>>15 byte&0x40 =0x00 \b, decoders should clamp 23090#>0 string x we got %s 23091#>>&(4.l+4) use riff-walk 23092 23093# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi> 23094# 230950 string RIFF RIFF (little-endian) data 23096# RIFF Palette format 23097# Update: Joerg Jenderek 23098# URL: https://en.wikipedia.org/wiki/Resource_Interchange_File_Format 23099# Reference: http://worms2d.info/Palette_file 23100>8 string PAL\ \b, palette 23101!:mime application/x-riff 23102# color palette by Microsoft Corporation 23103!:ext pal 23104# file size = chunk size + 8 in most cases 23105>>4 ulelong+8 x \b, %u bytes 23106# Extended PAL Format 23107>>12 string plth \b, extended 23108# Simple PAL Format 23109>>12 string data 23110# data chunk size = color entries * 4 + 4 + sometimes extra (4) appended bytes 23111>>>16 ulelong x \b, data size %u 23112# palVersion is always 0x0300 23113#>>>20 leshort x \b, version 0x%4.4x 23114# palNumEntries specifies the number of palette color entries 23115>>>22 uleshort x \b, %u entries 23116# after palPalEntry sized (number of color entries * 4 ) vector 23117>>>(22.s*4) ubequad x 23118# jump relative 22 ( 8 + 16) bytes forward points after end of file or to 23119# appended extra bytes like in http://safecolours.rigdenage.com/set(ms).zip/Protan(MS).pal 23120>>>>&16 ubelong x \b, extra bytes 23121>>>>>&-4 ubelong >0 0x%8.8x 23122# RIFF Device Independent Bitmap format 23123>8 string RDIB \b, device-independent bitmap 23124>>16 string BM 23125>>>30 leshort 12 \b, OS/2 1.x format 23126>>>>34 leshort x \b, %d x 23127>>>>36 leshort x %d 23128>>>30 leshort 64 \b, OS/2 2.x format 23129>>>>34 leshort x \b, %d x 23130>>>>36 leshort x %d 23131>>>30 leshort 40 \b, Windows 3.x format 23132>>>>34 lelong x \b, %d x 23133>>>>38 lelong x %d x 23134>>>>44 leshort x %d 23135# RIFF MIDI format 23136>8 string RMID \b, MIDI 23137# RIFF Multimedia Movie File format 23138>8 string RMMP \b, multimedia movie 23139# RIFF wrapper for MP3 23140>8 string RMP3 \b, MPEG Layer 3 audio 23141# Microsoft WAVE format (*.wav) 23142>8 string WAVE \b, WAVE audio 23143!:mime audio/x-wav 23144>>12 string >\0 23145>>>12 use riff-walk 23146# Corel Draw Picture 23147>8 string CDRA \b, Corel Draw Picture 23148!:mime image/x-coreldraw 23149>8 string CDR6 \b, Corel Draw Picture, version 6 23150!:mime image/x-coreldraw 23151>8 string NUNDROOT \b, Steinberg CuBase 23152# AVI == Audio Video Interleave 23153>8 string AVI\040 \b, AVI 23154!:mime video/x-msvideo 23155>>12 string LIST 23156>>>20 string hdrlavih 23157>>>>&36 lelong x \b, %u x 23158>>>>&40 lelong x %u, 23159>>>>&4 lelong >1000000 <1 fps, 23160>>>>&4 lelong 1000000 1.00 fps, 23161>>>>&4 lelong 500000 2.00 fps, 23162>>>>&4 lelong 333333 3.00 fps, 23163>>>>&4 lelong 250000 4.00 fps, 23164>>>>&4 lelong 200000 5.00 fps, 23165>>>>&4 lelong 166667 6.00 fps, 23166>>>>&4 lelong 142857 7.00 fps, 23167>>>>&4 lelong 125000 8.00 fps, 23168>>>>&4 lelong 111111 9.00 fps, 23169>>>>&4 lelong 100000 10.00 fps, 23170# ]9.9,10.1[ 23171>>>>&4 lelong <101010 23172>>>>>&-4 lelong >99010 23173>>>>>>&-4 lelong !100000 ~10 fps, 23174>>>>&4 lelong 83333 12.00 fps, 23175# ]11.9,12.1[ 23176>>>>&4 lelong <84034 23177>>>>>&-4 lelong >82645 23178>>>>>>&-4 lelong !83333 ~12 fps, 23179>>>>&4 lelong 66667 15.00 fps, 23180# ]14.9,15.1[ 23181>>>>&4 lelong <67114 23182>>>>>&-4 lelong >66225 23183>>>>>>&-4 lelong !66667 ~15 fps, 23184>>>>&4 lelong 50000 20.00 fps, 23185>>>>&4 lelong 41708 23.98 fps, 23186>>>>&4 lelong 41667 24.00 fps, 23187# ]23.9,24.1[ 23188>>>>&4 lelong <41841 23189>>>>>&-4 lelong >41494 23190>>>>>>&-4 lelong !41708 23191>>>>>>>&-4 lelong !41667 ~24 fps, 23192>>>>&4 lelong 40000 25.00 fps, 23193# ]24.9,25.1[ 23194>>>>&4 lelong <40161 23195>>>>>&-4 lelong >39841 23196>>>>>>&-4 lelong !40000 ~25 fps, 23197>>>>&4 lelong 33367 29.97 fps, 23198>>>>&4 lelong 33333 30.00 fps, 23199# ]29.9,30.1[ 23200>>>>&4 lelong <33445 23201>>>>>&-4 lelong >33223 23202>>>>>>&-4 lelong !33367 23203>>>>>>>&-4 lelong !33333 ~30 fps, 23204>>>>&4 lelong <32224 >30 fps, 23205##>>>>&4 lelong x (%lu) 23206##>>>>&20 lelong x %lu frames, 23207# Note: The tests below assume that the AVI has 1 or 2 streams, 23208# "vids" optionally followed by "auds". 23209# (Should cover 99.9% of all AVIs.) 23210# assuming avih length = 56 23211>>>88 string LIST 23212>>>>96 string strlstrh 23213>>>>>108 string vids video: 23214>>>>>>&0 lelong 0 uncompressed 23215# skip past vids strh 23216>>>>>>(104.l+108) string strf 23217>>>>>>>(104.l+132) lelong 1 RLE 8bpp 23218>>>>>>>(104.l+132) string/c cvid Cinepak 23219>>>>>>>(104.l+132) string/c i263 Intel I.263 23220>>>>>>>(104.l+132) string/c iv32 Indeo 3.2 23221>>>>>>>(104.l+132) string/c iv41 Indeo 4.1 23222>>>>>>>(104.l+132) string/c iv50 Indeo 5.0 23223>>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2 23224>>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3 23225>>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4 23226>>>>>>>(104.l+132) string/c mjpg Motion JPEG 23227>>>>>>>(104.l+132) string/c div3 DivX 3 23228>>>>>>>>112 string/c div3 Low-Motion 23229>>>>>>>>112 string/c div4 Fast-Motion 23230>>>>>>>(104.l+132) string/c divx DivX 4 23231>>>>>>>(104.l+132) string/c dx50 DivX 5 23232>>>>>>>(104.l+132) string/c xvid XviD 23233>>>>>>>(104.l+132) string/c h264 H.264 23234>>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9 23235>>>>>>>(104.l+132) string/c h264 X.264 or H.264 23236>>>>>>>(104.l+132) lelong 0 23237##>>>>>>>(104.l+132) string x (%.4s) 23238# skip past first (video) LIST 23239>>>>(92.l+96) string LIST 23240>>>>>(92.l+104) string strlstrh 23241>>>>>>(92.l+116) string auds \b, audio: 23242# auds strh length = 56: 23243>>>>>>>(92.l+172) string strf 23244>>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM 23245>>>>>>>>(92.l+180) leshort 0x0002 ADPCM 23246>>>>>>>>(92.l+180) leshort 0x0006 aLaw 23247>>>>>>>>(92.l+180) leshort 0x0007 uLaw 23248>>>>>>>>(92.l+180) leshort 0x0050 MPEG-1 Layer 1 or 2 23249>>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3 23250>>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3 23251>>>>>>>>(92.l+180) leshort 0x0161 DivX 23252##>>>>>>>>(92.l+180) leshort x (0x%.4x) 23253>>>>>>>>(92.l+182) leshort 1 (mono, 23254>>>>>>>>(92.l+182) leshort 2 (stereo, 23255>>>>>>>>(92.l+182) leshort >2 (%d channels, 23256>>>>>>>>(92.l+184) lelong x %d Hz) 23257# auds strh length = 64: 23258>>>>>>>(92.l+180) string strf 23259>>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM 23260>>>>>>>>(92.l+188) leshort 0x0002 ADPCM 23261>>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3 23262>>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3 23263>>>>>>>>(92.l+188) leshort 0x0161 DivX 23264##>>>>>>>>(92.l+188) leshort x (0x%.4x) 23265>>>>>>>>(92.l+190) leshort 1 (mono, 23266>>>>>>>>(92.l+190) leshort 2 (stereo, 23267>>>>>>>>(92.l+190) leshort >2 (%d channels, 23268>>>>>>>>(92.l+192) lelong x %d Hz) 23269# Animated Cursor format 23270>8 string ACON \b, animated cursor 23271# SoundFont 2 <mpruett@sgi.com> 23272>8 string sfbk SoundFont/Bank 23273# MPEG-1 wrapped in a RIFF, apparently 23274>8 string CDXA \b, wrapped MPEG-1 (CDXA) 23275>8 string 4XMV \b, 4X Movie file 23276# AMV-type AVI file: http://wiki.multimedia.cx/index.php?title=AMV 23277>8 string AMV\040 \b, AMV 23278>8 string WEBP \b, Web/P image 23279!:mime image/webp 23280>>12 use riff-walk 23281 23282# 23283# XXX - some of the below may only appear in little-endian form. 23284# 23285# Also "MV93" appears to be for one form of Macromedia Director 23286# files, and "GDMF" appears to be another multimedia format. 23287# 232880 string RIFX RIFF (big-endian) data 23289# RIFF Palette format 23290>8 string PAL \b, palette 23291>>16 beshort x \b, version %d 23292>>18 beshort x \b, %d entries 23293# RIFF Device Independent Bitmap format 23294>8 string RDIB \b, device-independent bitmap 23295>>16 string BM 23296>>>30 beshort 12 \b, OS/2 1.x format 23297>>>>34 beshort x \b, %d x 23298>>>>36 beshort x %d 23299>>>30 beshort 64 \b, OS/2 2.x format 23300>>>>34 beshort x \b, %d x 23301>>>>36 beshort x %d 23302>>>30 beshort 40 \b, Windows 3.x format 23303>>>>34 belong x \b, %d x 23304>>>>38 belong x %d x 23305>>>>44 beshort x %d 23306# RIFF MIDI format 23307>8 string RMID \b, MIDI 23308# RIFF Multimedia Movie File format 23309>8 string RMMP \b, multimedia movie 23310# Microsoft WAVE format (*.wav) 23311>8 string WAVE \b, WAVE audio 23312>>20 leshort 1 \b, Microsoft PCM 23313>>>34 leshort >0 \b, %d bit 23314>>22 beshort =1 \b, mono 23315>>22 beshort =2 \b, stereo 23316>>22 beshort >2 \b, %d channels 23317>>24 belong >0 %d Hz 23318# Corel Draw Picture 23319>8 string CDRA \b, Corel Draw Picture 23320>8 string CDR6 \b, Corel Draw Picture, version 6 23321# AVI == Audio Video Interleave 23322>8 string AVI\040 \b, AVI 23323# Animated Cursor format 23324>8 string ACON \b, animated cursor 23325# Notation Interchange File Format (big-endian only) 23326>8 string NIFF \b, Notation Interchange File Format 23327# SoundFont 2 <mpruett@sgi.com> 23328>8 string sfbk SoundFont/Bank 23329 23330#------------------------------------------------------------------------------ 23331# Sony Wave64 23332# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf 23333# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian 233340 string riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00 Sony Wave64 RIFF data 23335# 128 bit + total file size (64 bits) so 24 bytes 23336# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A } 23337>24 string wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b, WAVE 64 audio 23338!:mime audio/x-w64 23339# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A } 23340>>40 search/256 fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b 23341>>>&10 leshort =1 \b, mono 23342>>>&10 leshort =2 \b, stereo 23343>>>&10 leshort >2 \b, %d channels 23344>>>&12 lelong >0 %d Hz 23345 23346#------------------------------------------------------------------------------ 23347# MBWF/RF64 23348# see EBU TECH 3306 http://tech.ebu.ch/docs/tech/tech3306-2009.pdf 233490 string RF64\xff\xff\xff\xffWAVEds64 MBWF/RF64 audio 23350!:mime audio/x-wav 23351>40 search/256 fmt\x20 \b 23352>>&6 leshort =1 \b, mono 23353>>&6 leshort =2 \b, stereo 23354>>&6 leshort >2 \b, %d channels 23355>>&8 lelong >0 %d Hz 23356 23357#------------------------------------------------------------------------------ 23358# $File: rpi,v 1.1 2018/01/01 05:25:17 christos Exp $ 23359# rpi: file(1) magic for Raspberry Pi images 23360-44 lelong 0 23361>4 lelong 0 23362>>8 lelong 1 23363>>12 lelong 4 23364>>>16 string 283x 23365>>>>20 lelong 1 23366>>>>>24 lelong 4 23367>>>>>>28 string DTOK 23368>>>>>>>32 lelong 44 23369>>>>>>>>36 lelong 4 23370>>>>>>>>>40 string RPTL Raspberry PI kernel image 23371 23372#------------------------------------------------------------------------------ 23373# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $ 23374# 23375# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com) 23376# 233770 belong 0xedabeedb RPM 23378!:mime application/x-rpm 23379>4 byte x v%d 23380>5 byte x \b.%d 23381>6 beshort 1 src 23382>6 beshort 0 bin 23383>>8 beshort 1 i386/x86_64 23384>>8 beshort 2 Alpha/Sparc64 23385>>8 beshort 3 Sparc 23386>>8 beshort 4 MIPS 23387>>8 beshort 5 PowerPC 23388>>8 beshort 6 68000 23389>>8 beshort 7 SGI 23390>>8 beshort 8 RS6000 23391>>8 beshort 9 IA64 23392>>8 beshort 10 Sparc64 23393>>8 beshort 11 MIPSel 23394>>8 beshort 12 ARM 23395>>8 beshort 13 MiNT 23396>>8 beshort 14 S/390 23397>>8 beshort 15 S/390x 23398>>8 beshort 16 PowerPC64 23399>>8 beshort 17 SuperH 23400>>8 beshort 18 Xtensa 23401>>8 beshort 255 noarch 23402>>10 string x %s 23403 23404#delta RPM Daniel Novotny (dnovotny@redhat.com) 234050 string drpm Delta RPM 23406!:mime application/x-rpm 23407>12 string x %s 23408>>8 beshort 11 MIPSel 23409>>8 beshort 12 ARM 23410>>8 beshort 13 MiNT 23411>>8 beshort 14 S/390 23412>>8 beshort 15 S/390x 23413>>8 beshort 16 PowerPC64 23414>>8 beshort 17 SuperH 23415>>8 beshort 18 Xtensa 23416>>10 string x %s 23417 23418#------------------------------------------------------------------------------ 23419# $File: rtf,v 1.7 2009/09/19 16:28:12 christos Exp $ 23420# rtf: file(1) magic for Rich Text Format (RTF) 23421# 23422# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk 23423# 234240 string {\\rtf Rich Text Format data, 23425!:mime text/rtf 23426>5 string 1 version 1, 23427>>6 string \\ansi ANSI 23428>>6 string \\mac Apple Macintosh 23429>>6 string \\pc IBM PC, code page 437 23430>>6 string \\pca IBM PS/2, code page 850 23431>>6 default x unknown character set 23432>5 default x unknown version 23433 23434#------------------------------------------------------------------------------ 23435# $File: ruby,v 1.7 2017/08/14 13:39:18 christos Exp $ 23436# ruby: file(1) magic for Ruby scripting language 23437# URL: http://www.ruby-lang.org/ 23438# From: Reuben Thomas <rrt@sc3d.org> 23439 23440# Ruby scripts 234410 search/1/w #!\ /usr/bin/ruby Ruby script text executable 23442!:strength + 15 23443!:mime text/x-ruby 234440 search/1/w #!\ /usr/local/bin/ruby Ruby script text executable 23445!:strength + 15 23446!:mime text/x-ruby 234470 search/1 #!/usr/bin/env\ ruby Ruby script text executable 23448!:strength + 15 23449!:mime text/x-ruby 234500 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable 23451!:strength + 15 23452!:mime text/x-ruby 23453 23454# What looks like ruby, but does not have a shebang 23455# (modules and such) 23456# From: Lubomir Rintel <lkundrak@v3.sk> 234570 regex/4096 \^[[:space:]]*require[[:space:]]'[A-Za-z_/]+' 23458>0 regex def\ [a-z]|\ do$ 23459>>&0 regex/4096 \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text 23460!:strength + 30 23461!:mime text/x-ruby 234620 regex/4096 \^[[:space:]]*(class|module)[[:space:]][A-Z] 23463>0 regex (modul|includ)e\ [A-Z]|def\ [a-z] 23464>>&0 regex/4096 \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text 23465!:strength + 30 23466!:mime text/x-ruby 23467# Classes with no modules or defs, beats simple ASCII 234680 regex/4096 \^[[:space:]]*(class|module)[[:space:]][A-Z] 23469>&0 regex/4096 \^[[:space:]]*end([[:space:]]+[;#if].*)?$ Ruby script text 23470!:strength + 10 23471!:mime text/x-ruby 23472# Looks for function definition to balance python magic 23473# def name (args) 23474# end 234750 regex/4096 \^[[:space:]]*def\ [a-z]|def\ [[:alpha:]]+::[a-z] 23476>&0 regex/4096 \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text 23477!:strength + 10 23478!:mime text/x-ruby 23479 234800 regex/4096 \^[[:space:]]*require[[:space:]]'[A-Za-z_/]+' Ruby script text 23481!:mime text/x-ruby 234820 regex/4096 \^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+ Ruby script text 23483!:mime text/x-ruby 23484 23485#------------------------------------------------------------------------------ 23486# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $ 23487# sc: file(1) magic for "sc" spreadsheet 23488# 2348938 string Spreadsheet sc spreadsheet file 23490!:mime application/x-sc 23491 23492#------------------------------------------------------------------------------ 23493# $File: sccs,v 1.7 2017/03/17 21:35:28 christos Exp $ 23494# sccs: file(1) magic for SCCS archives 23495# 23496# SCCS archive structure: 23497# \001h01207 23498# \001s 00276/00000/00000 23499# \001d D 1.1 87/09/23 08:09:20 ian 1 0 23500# \001c date and time created 87/09/23 08:09:20 by ian 23501# \001e 23502# \001u 23503# \001U 23504# ... etc. 23505# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550). 23506# *Sigh*. And these both came from various parts of the USG. 23507# Maybe we should just switch everybody from SCCS to RCS! 23508# Further, you can't just say '\001h0', because the five-digit number 23509# is a checksum that could (presumably) have any leading digit, 23510# and we don't have regular expression matching yet. 23511# Hence the following official kludge: 235128 string \001s\ SCCS archive data 23513 23514#------------------------------------------------------------------------------ 23515# $File: scientific,v 1.12 2017/03/17 22:20:22 christos Exp $ 23516# scientific: file(1) magic for scientific formats 23517# 23518# From: Joe Krahn <krahn@niehs.nih.gov> 23519 23520######################################################## 23521# CCP4 data and plot files: 235220 string MTZ\040 MTZ reflection file 23523 2352492 string PLOT%%84 Plot84 plotting file 23525>52 byte 1 , Little-endian 23526>55 byte 1 , Big-endian 23527 23528######################################################## 23529# Electron density MAP/MASK formats 23530 235310 string EZD_MAP NEWEZD Electron Density Map 23532109 string MAP\040( Old EZD Electron Density Map 23533 235340 string/c :-)\040Origin BRIX Electron Density Map 23535>170 string >0 , Sigma:%.12s 23536#>4 string >0 %.178s 23537#>4 addr x %.178s 23538 235397 string 18\040!NTITLE XPLOR ASCII Electron Density Map 235409 string \040!NTITLE\012\040REMARK CNS ASCII electron density map 23541 23542208 string MAP\040 CCP4 Electron Density Map 23543# Assumes same stamp for float and double (normal case) 23544>212 byte 17 \b, Big-endian 23545>212 byte 34 \b, VAX format 23546>212 byte 68 \b, Little-endian 23547>212 byte 85 \b, Convex native 23548 23549############################################################ 23550# X-Ray Area Detector images 235510 string R-AXIS4\ \ \ R-Axis Area Detector Image: 23552>796 lelong <20 Little-endian, IP #%d, 23553>>768 lelong >0 Size=%dx 23554>>772 lelong >0 \b%d 23555>796 belong <20 Big-endian, IP #%d, 23556>>768 belong >0 Size=%dx 23557>>772 belong >0 \b%d 23558 235590 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32: 23560>796 lelong <20 Little-endian, IP #%d, 23561>>768 lelong >0 Size=%dx 23562>>772 lelong >0 \b%d 23563>796 belong <20 Big-endian, IP #%d, 23564>>768 belong >0 Size=%dx 23565>>772 belong >0 \b%d 23566 23567 235681028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image, 23569>1072 ulong >1 Compressed(%d), 23570>1100 ulong >1 %d headers, 23571>1104 ulong >0 %d x 23572>1108 ulong >0 %d, 23573>1120 ulong >0 %d bits/pixel 23574 23575# Type: GEDCOM genealogical (family history) data 23576# From: Giuseppe Bilotta 235770 search/1/c 0\ HEAD GEDCOM genealogy text 23578>&0 search 1\ GEDC 23579>>&0 search 2\ VERS version 23580>>>&1 string >\0 %s 23581# From: Phil Endecott <phil05@chezphil.org> 235820 string \000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 235830 string \060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 235840 string \376\377\000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 235850 string \377\376\060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 23586 23587# PDB: Protein Data Bank files 23588# Adam Buchbinder <adam.buchbinder@gmail.com> 23589# 23590# http://www.wwpdb.org/documentation/format32/sect2.html 23591# http://www.ch.ic.ac.uk/chemime/ 23592# 23593# The PDB file format is fixed-field, 80 columns. From the spec: 23594# 23595# COLS DATA 23596# 1 - 6 "HEADER" 23597# 11 - 50 String(40) 23598# 51 - 59 Date 23599# 63 - 66 IDcode 23600# 23601# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the 23602# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and 23603# uppercase letters. However, examples have been seen without the date string, 23604# e.g., the example on the chemime site. 236050 string HEADER\ \ \ \040 23606>&0 regex/1l \^.{40} 23607>>&0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3} 23608>>>&0 regex/1ls [A-Z0-9]{4}.{14}$ 23609>>>>&0 regex/1l [A-Z0-9]{4} Protein Data Bank data, ID Code %s 23610!:mime chemical/x-pdb 23611>>>>0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2} \b, %s 23612 23613# Type: GDSII Stream file 236140 belong 0x00060002 GDSII Stream file 23615>4 byte 0x00 23616>>5 byte x version %d.0 23617>4 byte >0x00 version %d 23618>>5 byte x \b.%d 23619 23620# Type: LXT (interLaced eXtensible Trace) 23621# chrysn <chrysn@fsfe.org> 236220 beshort 0x0138 interLaced eXtensible Trace (LXT) file 23623>2 beshort >0 (Version %u) 23624 23625#------------------------------------------------------------------------------ 23626# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $ 236270 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text 236280 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text 236290 belong 0xedfeedfe Sun 'jks' Java Keystore File data 23630 236310 string \0volume_key volume_key escrow packet 23632# Type: SE Linux policy modules *.pp reference policy 23633# for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny. 23634# URL: http://doc.coker.com.au/computers/selinux-magic 23635# From: Russell Coker <russell@coker.com.au> 23636 236370 lelong 0xf97cff8f SE Linux modular policy 23638>4 lelong x version %d, 23639>8 lelong x %d sections, 23640>>(12.l) lelong 0xf97cff8d 23641>>>(12.l+27) lelong x mod version %d, 23642>>>(12.l+31) lelong 0 Not MLS, 23643>>>(12.l+31) lelong 1 MLS, 23644>>>(12.l+23) lelong 2 23645>>>>(12.l+47) string >\0 module name %s 23646>>>(12.l+23) lelong 1 base 23647 236481 string policy_module( SE Linux policy module source 236492 string policy_module( SE Linux policy module source 23650 236510 string ##\ <summary> SE Linux policy interface source 23652 23653#0 search gen_context( SE Linux policy file contexts 23654 23655#0 search gen_sens( SE Linux policy MLS constraints source 23656 23657#------------------------------------------------------------------------------ 23658# $File: sendmail,v 1.10 2017/08/13 00:21:47 christos Exp $ 23659# sendmail: file(1) magic for sendmail config files 23660# 23661# XXX - byte order? 23662# 23663# Update: Joerg Jenderek 23664# GRR: this test is too general as it catches also 23665# READ.ME.FIRST.AWP Sendmail frozen configuration 23666# - version ====|====|====|====|====|====|====|====|====|====|====|====|=== 23667# Email_23_f217153422.ts Sendmail frozen configuration 23668# - version \330jK\354 236690 byte 046 23670# http://www.sendmail.com/sm/open_source/docs/older_release_notes/ 23671# freezed configuration file (dbm format?) created from sendmal.cf with -bz 23672# by older sendmail. til version 8.6 support for frozen configuration files is removed 23673# valid version numbers look like "7.14.4" and should be similar to output of commands 23674# "sendmail -d0 -bt < /dev/null |grep -i Version" or "egrep '^DZ' /etc/sendmail.cf" 23675>16 regex/s =^[0-78][0-9.]{4} Sendmail frozen configuration 23676# normally only /etc/sendmail.fc or /var/adm/sendmail/sendmail.fc 23677!:ext fc 23678>>16 string >\0 - version %s 236790 short 0x271c 23680# look for valid version number 23681>16 regex/s =^[0-78][0-9.]{4} Sendmail frozen configuration 23682!:ext fc 23683>>16 string >\0 - version %s 23684 23685#------------------------------------------------------------------------------ 23686# sendmail: file(1) magic for sendmail m4(1) files 23687# 23688# From Hendrik Scholz <hendrik@scholz.net> 23689# i.e. files in /usr/share/sendmail/cf/ 23690# 236910 string divert(-1)\n sendmail m4 text file 23692 23693 23694#------------------------------------------------------------------------------ 23695# $File: sequent,v 1.13 2017/03/17 21:35:28 christos Exp $ 23696# sequent: file(1) magic for Sequent machines 23697# 23698# Sequent information updated by Don Dwiggins <atsun!dwiggins>. 23699# For Sequent's multiprocessor systems (incomplete). 237000 lelong 0x00ea BALANCE NS32000 .o 23701>16 lelong >0 not stripped 23702>124 lelong >0 version %d 237030 lelong 0x10ea BALANCE NS32000 executable (0 @ 0) 23704>16 lelong >0 not stripped 23705>124 lelong >0 version %d 237060 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0) 23707>16 lelong >0 not stripped 23708>124 lelong >0 version %d 237090 lelong 0x30ea BALANCE NS32000 standalone executable 23710>16 lelong >0 not stripped 23711>124 lelong >0 version %d 23712# 23713# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>. 23714# Symmetry magic nums will not be reached if DOS COM comes before them; 23715# byte 0xeb is matched before these get a chance. 237160 leshort 0x12eb SYMMETRY i386 .o 23717>16 lelong >0 not stripped 23718>124 lelong >0 version %d 237190 leshort 0x22eb SYMMETRY i386 executable (0 @ 0) 23720>16 lelong >0 not stripped 23721>124 lelong >0 version %d 237220 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0) 23723>16 lelong >0 not stripped 23724>124 lelong >0 version %d 23725# http://en.wikipedia.org/wiki/Sequent_Computer_Systems 23726# below test line conflicts with MS-DOS 2.11 floppies and Acronis loader 23727#0 leshort 0x42eb SYMMETRY i386 standalone executable 237280 leshort 0x42eb 23729# skip unlike negative version 23730>124 lelong >-1 23731# assuming version 28867614 is very low probable 23732>>124 lelong !28867614 SYMMETRY i386 standalone executable 23733>>>16 lelong >0 not stripped 23734>>>124 lelong >0 version %d 23735 23736#------------------------------------------------------------------------------ 23737# $File: sereal,v 1.3 2015/02/05 19:14:45 christos Exp $ 23738# sereal: file(1) magic the Sereal binary serialization format 23739# 23740# From: Ævar Arnfjörð Bjarmason <avarab@gmail.com> 23741# 23742# See the specification of the format at 23743# https://github.com/Sereal/Sereal/blob/master/sereal_spec.pod#document-header-format 23744# 23745# I'd have liked to do the byte&0xF0 matching against 0, 1, 2 ... by 23746# doing (byte&0xF0)>>4 here, but unfortunately that's not 23747# supported. So when we print out a message about an unknown format 23748# we'll print out e.g. 0x30 instead of the more human-readable 23749# 0x30>>4. 23750# 23751# See https://github.com/Sereal/Sereal/commit/35372ae01d in the 23752# Sereal.git repository for test Sereal data. 237530 name sereal 23754>4 byte&0x0F x (version %d, 23755>4 byte&0xF0 0x00 uncompressed) 23756>4 byte&0xF0 0x10 compressed with non-incremental Snappy) 23757>4 byte&0xF0 0x20 compressed with incremental Snappy) 23758>4 byte&0xF0 >0x20 unknown subformat, flag: %d>>4) 23759 237600 string/b \=srl Sereal data packet 23761!:mime application/sereal 23762>&0 use sereal 237630 string/b \=\xF3rl Sereal data packet 23764!:mime application/sereal 23765>&0 use sereal 237660 string/b \=\xC3\xB3rl Sereal data packet, UTF-8 encoded 23767!:mime application/sereal 23768>&0 use sereal 23769 23770 23771#------------------------------------------------------------------------------ 23772# $File: sgi,v 1.23 2018/05/29 02:26:56 christos Exp $ 23773# sgi: file(1) magic for Silicon Graphics operating systems and applications 23774# 23775# Executable images are handled either in aout (for old-style a.out 23776# files for 68K; they are indistinguishable from other big-endian 32-bit 23777# a.out files) or in mips (for MIPS ECOFF and Ucode files) 23778# 23779 23780# kbd file definitions 237810 string kbd!map kbd map file 23782>8 byte >0 Ver %d: 23783>10 short >0 with %d table(s) 23784 237850 beshort 0x8765 disk quotas file 23786 237870 beshort 0x0506 IRIS Showcase file 23788>2 byte 0x49 - 23789>3 byte x - version %d 237900 beshort 0x0226 IRIS Showcase template 23791>2 byte 0x63 - 23792>3 byte x - version %d 237930 belong 0x5343464d IRIS Showcase file 23794>4 byte x - version %d 237950 belong 0x5443464d IRIS Showcase template 23796>4 byte x - version %d 237970 belong 0xdeadbabe IRIX Parallel Arena 23798>8 belong >0 - version %d 23799 23800# core files 23801# 23802# 32bit core file 238030 belong 0xdeadadb0 IRIX core dump 23804>4 belong 1 of 23805>16 string >\0 '%s' 23806# 64bit core file 238070 belong 0xdeadad40 IRIX 64-bit core dump 23808>4 belong 1 of 23809>16 string >\0 '%s' 23810# N32bit core file 238110 belong 0xbabec0bb IRIX N32 core dump 23812>4 belong 1 of 23813>16 string >\0 '%s' 23814# New style crash dump file 238150 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of 23816>36 string >\0 '%s' 23817 23818# Trusted IRIX info 238190 string SGIAUDIT SGI Audit file 23820>8 byte x - version %d 23821>9 byte x \b.%d 23822# 238230 string WNGZWZSC Wingz compiled script 238240 string WNGZWZSS Wingz spreadsheet 238250 string WNGZWZHP Wingz help file 23826# 238270 string #Inventor\040V IRIS Inventor 1.0 file 238280 string #Inventor\040V2 Open Inventor 2.0 file 23829# GLF is OpenGL stream encoding 238300 string glfHeadMagic(); GLF_TEXT 238314 belong 0x7d000000 GLF_BINARY_LSB_FIRST 23832!:strength -30 238334 belong 0x0000007d GLF_BINARY_MSB_FIRST 23834!:strength -30 23835# GLS is OpenGL stream encoding; GLS is the successor of GLF 238360 string glsBeginGLS( GLS_TEXT 238374 belong 0x10000000 GLS_BINARY_LSB_FIRST 23838!:strength -30 238394 belong 0x00000010 GLS_BINARY_MSB_FIRST 23840!:strength -30 23841 23842# Performance Co-Pilot file types 238430 string PmNs PCP compiled namespace (V.0) 238440 string PmN PCP compiled namespace 23845>3 string >\0 (V.%1.1s) 23846#3 lelong 0x84500526 PCP archive 238473 belong 0x84500526 PCP archive 23848>7 byte x (V.%d) 23849#>20 lelong -2 temporal index 23850#>20 lelong -1 metadata 23851#>20 lelong 0 log volume #0 23852#>20 lelong >0 log volume #%d 23853>20 belong -2 temporal index 23854>20 belong -1 metadata 23855>20 belong 0 log volume #0 23856>20 belong >0 log volume #%d 23857>24 string >\0 host: %s 238580 string PCPFolio PCP 23859>9 string Version: Archive Folio 23860>18 string >\0 (V.%s) 238610 string #pmchart PCP pmchart view 23862>9 string Version 23863>17 string >\0 (V%-3.3s) 238640 string #kmchart PCP kmchart view 23865>9 string Version 23866>17 string >\0 (V.%s) 238670 string pmview PCP pmview config 23868>7 string Version 23869>15 string >\0 (V%-3.3s) 238700 string #pmlogger PCP pmlogger config 23871>10 string Version 23872>18 string >\0 (V%1.1s) 238730 string #pmdahotproc PCP pmdahotproc config 23874>13 string Version 23875>21 string >\0 (V%-3.3s) 238760 string PcPh PCP Help 23877>4 string 1 Index 23878>4 string 2 Text 23879>5 string >\0 (V.%1.1s) 238800 string #pmieconf-rules PCP pmieconf rules 23881>16 string >\0 (V.%1.1s) 238823 string pmieconf-pmie PCP pmie config 23883>17 string >\0 (V.%1.1s) 238840 string MMV PCP memory mapped values 23885>4 long x (V.%d) 23886 23887# SpeedShop data files 238880 lelong 0x13130303 SpeedShop data file 23889 23890# mdbm files 238910 lelong 0x01023962 mdbm file, version 0 (obsolete) 238920 string mdbm mdbm file, 23893>5 byte x version %d, 23894>6 byte x 2^%d pages, 23895>7 byte x pagesize 2^%d, 23896>17 byte x hash %d, 23897>11 byte x dataformat %d 23898 23899# Alias Maya files 239000 string/t //Maya\040ASCII Alias Maya Ascii File, 23901>13 string >\0 version %s 239028 string MAYAFOR4 Alias Maya Binary File, 23903>32 string >\0 version %s scene 239048 string MayaFOR4 Alias Maya Binary File, 23905>32 string >\0 version %s scene 239068 string CIMG Alias Maya Image File 239078 string DEEP Alias Maya Image File 23908 23909#------------------------------------------------------------------------------ 23910# $File: sgml,v 1.38 2017/10/11 11:40:43 christos Exp $ 23911# Type: SVG Vectorial Graphics 23912# From: Noel Torres <tecnico@ejerciciosresueltos.com> 239130 string \<?xml\ version= 23914>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 23915>>19 search/4096 \<svg SVG Scalable Vector Graphics image 23916!:mime image/svg+xml 23917>>19 search/4096 \<gnc-v2 GnuCash file 23918!:mime application/x-gnucash 239190 string \<svg SVG Scalable Vector Graphics image 23920!:mime image/svg 23921 23922# Sitemap file 239230 string/t \<?xml\ version= 23924>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 23925>>19 search/4096 \<urlset XML Sitemap document text 23926!:mime application/xml-sitemap 23927 23928# OpenStreetMap XML (.osm) 23929# http://wiki.openstreetmap.org/wiki/OSM_XML 23930# From: Markus Heidelberg <markus.heidelberg@web.de> 239310 string \<?xml\ version= 23932>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 23933>>19 search/4096 \<osm OpenStreetMap XML data 23934 23935# xhtml 239360 string/t \<?xml\ version=" 23937>19 search/4096/cWbt \<!doctype\ html XHTML document text 23938>>15 string >\0 (version %.3s) 23939!:mime text/html 239400 string/t \<?xml\ version=' 23941>19 search/4096/cWbt \<!doctype\ html XHTML document text 23942>>15 string >\0 (version %.3s) 23943!:mime text/html 239440 string/t \<?xml\ version=" 23945>19 search/4096/cWbt \<html broken XHTML document text 23946>>15 string >\0 (version %.3s) 23947!:mime text/html 23948 23949#------------------------------------------------------------------------------ 23950# sgml: file(1) magic for Standard Generalized Markup Language 23951# HyperText Markup Language (HTML) is an SGML document type, 23952# from Daniel Quinlan (quinlan@yggdrasil.com) 23953# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org) 239540 search/4096/cWt \<!doctype\ html HTML document text 23955!:mime text/html 23956!:strength + 5 23957 23958# SVG document 23959# https://www.w3.org/TR/SVG/single-page.html 239600 search/4096/cWbt \<!doctype\ svg SVG XML document 23961!:mime image/svg+xml 23962!:strength + 5 23963 239640 search/4096/cwt \<head\> HTML document text 23965!:mime text/html 23966!:strength + 5 239670 search/4096/cWt \<head\ HTML document text 23968!:mime text/html 23969!:strength + 5 239700 search/4096/cwt \<title\> HTML document text 23971!:mime text/html 23972!:strength + 5 239730 search/4096/cWt \<title\ HTML document text 23974!:mime text/html 23975!:strength + 5 239760 search/4096/cwt \<html\> HTML document text 23977!:mime text/html 23978!:strength + 5 239790 search/4096/cWt \<html\ HTML document text 23980!:mime text/html 23981!:strength + 5 239820 search/4096/cwt \<script\> HTML document text 23983!:mime text/html 23984!:strength + 5 239850 search/4096/cWt \<script\ HTML document text 23986!:mime text/html 23987!:strength + 5 239880 search/4096/cwt \<style\> HTML document text 23989!:mime text/html 23990!:strength + 5 239910 search/4096/cWt \<style\ HTML document text 23992!:mime text/html 23993!:strength + 5 239940 search/4096/cwt \<table\> HTML document text 23995!:mime text/html 23996!:strength + 5 239970 search/4096/cWt \<table\ HTML document text 23998!:mime text/html 23999!:strength + 5 24000 240010 search/4096/cwt \<a\ href= HTML document text 24002!:mime text/html 24003!:strength + 5 24004 24005# Extensible markup language (XML), a subset of SGML 24006# from Marc Prud'hommeaux (marc@apocalypse.org) 240070 search/1/cwt \<?xml XML document text 24008!:mime text/xml 24009!:strength + 5 240100 string/t \<?xml\ version\ " XML 24011!:mime text/xml 24012!:strength + 5 240130 string/t \<?xml\ version=" XML 24014!:mime text/xml 24015!:strength + 5 24016>15 string/t >\0 %.3s document text 24017>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 24018>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 240190 string \<?xml\ version=' XML 24020!:mime text/xml 24021!:strength + 5 24022>15 string/t >\0 %.3s document text 24023>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 24024>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 240250 search/1/wt \<?XML broken XML document text 24026!:mime text/xml 24027!:strength - 10 24028 24029 24030# SGML, mostly from rph@sq 240310 search/4096/cwt \<!doctype exported SGML document text 240320 search/4096/cwt \<!subdoc exported SGML subdocument text 240330 search/4096/cwt \<!-- exported SGML document text 24034!:strength - 10 24035 24036# Web browser cookie files 24037# (Mozilla, Galeon, Netscape 4, Konqueror..) 24038# Ulf Harnhammar <ulfh@update.uu.se> 240390 search/1 #\ HTTP\ Cookie\ File Web browser cookie text 240400 search/1 #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text 240410 search/1 #\ KDE\ Cookie\ File Konqueror cookie text 24042 24043# XML-based format representing braille pages in a digital format. 24044# 24045# Specification: 24046# http://files.pef-format.org/specifications/pef-2008-1/pef-specification.html 24047# 24048# Simon Aittamaa <simon.aittamaa@gmail.com> 240490 string \<?xml\ version= 24050>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 24051>>19 search/4096 \<pef Portable Embosser Format 24052!:mime application/x-pef+xml 24053#------------------------------------------------------------------------ 24054# $File: sharc,v 1.8 2017/03/17 21:35:28 christos Exp $ 24055# file(1) magic for sharc files 24056# 24057# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by 24058# FutureGroove Music (dsp@futuregroove.de) 24059 24060#------------------------------------------------------------------------ 24061#0 string Draw RiscOS Drawfile 24062#0 string PACK RiscOS PackdDir archive 24063 24064#------------------------------------------------------------------------ 24065# SHARC DSP stuff (based on the FGM SHARC DSP SDK) 24066 24067#0 string =! Assembler source 24068#0 string Analog ADi asm listing file 240690 string .SYSTEM SHARC architecture file 240700 string .system SHARC architecture file 24071 240720 leshort 0x521C SHARC COFF binary 24073>2 leshort >1 , %d sections 24074>>12 lelong >0 , not stripped 24075 24076#------------------------------------------------------------------------------ 24077# $File: sinclair,v 1.6 2015/11/14 13:38:35 christos Exp $ 24078# sinclair: file(1) sinclair QL 24079 24080# additions to /etc/magic by Thomas M. Ott (ThMO) 24081 24082# Sinclair QL floppy disk formats (ThMO) 240830 string =QL5 QL disk dump data, 24084>3 string =A 720 KB, 24085>3 string =B 1.44 MB, 24086>3 string =C 3.2 MB, 24087>4 string >\0 label:%.10s 24088 24089# Sinclair QL OS dump (ThMO) 240900 belong =0x30000 24091>49124 belong <47104 24092>>49128 belong <47104 24093>>>49132 belong <47104 24094>>>>49136 belong <47104 QL OS dump data, 24095>>>>>49148 string >\0 type %.3s, 24096>>>>>49142 string >\0 version %.4s 24097 24098# Sinclair QL firmware executables (ThMO) 240990 string NqNqNq`\004 QL firmware executable (BCPL) 24100 24101# Sinclair QL libraries (was ThMO) 241020 beshort 0xFB01 QDOS object 24103>2 pstring x '%s' 24104 24105# Sinclair QL executables (was ThMO) 241064 belong 0x4AFB QDOS executable 24107>9 pstring x '%s' 24108 24109# Sinclair QL ROM (ThMO) 241100 belong =0x4AFB0001 QL plugin-ROM data, 24111>9 pstring =\0 un-named 24112>9 pstring >\0 named: %s 24113# Type: SiSU Markup Language 24114# URL: http://www.sisudoc.org/ 24115# From: Ralph Amissah <ralph.amissah@gmail.com> 24116 241170 regex \^%?[\ \t]*SiSU[\ \t]+insert SiSU text insert 24118>5 regex [0-9.]+ %s 24119 241200 regex \^%[\ \t]+SiSU[\ \t]+master SiSU text master 24121>5 regex [0-9.]+ %s 24122 241230 regex \^%?[\ \t]*SiSU[\ \t]+text SiSU text 24124>5 regex [0-9.]+ %s 24125 241260 regex \^%?[\ \t]*SiSU[\ \t][0-9.]+ SiSU text 24127>5 regex [0-9.]+ %s 24128 241290 regex \^%*[\ \t]*sisu-[0-9.]+ SiSU text 24130>5 regex [0-9.]+ %s 24131 24132#------------------------------------------------------------------------------ 24133# $File: sketch,v 1.5 2017/03/17 21:35:28 christos Exp $ 24134# Sketch Drawings: http://sketch.sourceforge.net/ 24135# From: Edwin Mons <e@ik.nu> 241360 search/1 ##Sketch Sketch document text 24137 24138#----------------------------------------------- 24139# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $ 24140# GNU Smalltalk image, starting at version 1.6.2 24141# From: catull_us@yahoo.com 24142# 241430 string GSTIm\0\0 GNU SmallTalk 24144# little-endian 24145>7 byte&1 =0 LE image version 24146>>10 byte x %d. 24147>>9 byte x \b%d. 24148>>8 byte x \b%d 24149#>>12 lelong x , data: %ld 24150#>>16 lelong x , table: %ld 24151#>>20 lelong x , memory: %ld 24152# big-endian 24153>7 byte&1 =1 BE image version 24154>>8 byte x %d. 24155>>9 byte x \b%d. 24156>>10 byte x \b%d 24157#>>12 belong x , data: %ld 24158#>>16 belong x , table: %ld 24159#>>20 belong x , memory: %ld 24160 24161 24162 24163#------------------------------------------------------------------------------ 24164# $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $ 24165# smile: file(1) magic for Smile serialization 24166# 24167# The Smile serialization format uses a 4-byte header: 24168# 24169# Constant byte #0: 0x3A (ASCII ':') 24170# Constant byte #1: 0x29 (ASCII ')') 24171# Constant byte #2: 0x0A (ASCII linefeed, '\n') 24172# Variable byte #3, consisting of bits: 24173# Bits 4-7 (4 MSB): 4-bit version number 24174# Bits 3: Reserved 24175# Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content 24176# Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false 24177# Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true 24178# 24179# Reference: http://wiki.fasterxml.com/SmileFormatSpec 24180# Created by: Pierre-Alexandre Meyer <pierre@mouraf.org> 24181 24182# Detection 241830 string :)\n Smile binary data 24184 24185# Versioning 24186>3 byte&0xF0 x version %d: 24187 24188# Properties 24189>3 byte&0x04 0x04 binary raw, 24190>3 byte&0x04 0x00 binary encoded, 24191>3 byte&0x02 0x02 shared String values enabled, 24192>3 byte&0x02 0x00 shared String values disabled, 24193>3 byte&0x01 0x01 shared field names enabled 24194>3 byte&0x01 0x00 shared field names disabled 24195 24196 24197#------------------------------------------------------------------------------ 24198# $File: sniffer,v 1.19 2013/01/06 01:11:04 christos Exp $ 24199# sniffer: file(1) magic for packet capture files 24200# 24201# From: guy@alum.mit.edu (Guy Harris) 24202# 24203 24204# 24205# Microsoft Network Monitor 1.x capture files. 24206# 242070 string RTSS NetMon capture file 24208>5 byte x - version %d 24209>4 byte x \b.%d 24210>6 leshort 0 (Unknown) 24211>6 leshort 1 (Ethernet) 24212>6 leshort 2 (Token Ring) 24213>6 leshort 3 (FDDI) 24214>6 leshort 4 (ATM) 24215>6 leshort >4 (type %d) 24216 24217# 24218# Microsoft Network Monitor 2.x capture files. 24219# 242200 string GMBU NetMon capture file 24221>5 byte x - version %d 24222>4 byte x \b.%d 24223>6 leshort 0 (Unknown) 24224>6 leshort 1 (Ethernet) 24225>6 leshort 2 (Token Ring) 24226>6 leshort 3 (FDDI) 24227>6 leshort 4 (ATM) 24228>6 leshort 5 (IP-over-IEEE 1394) 24229>6 leshort 6 (802.11) 24230>6 leshort 7 (Raw IP) 24231>6 leshort 8 (Raw IP) 24232>6 leshort 9 (Raw IP) 24233>6 leshort >9 (type %d) 24234 24235# 24236# Network General Sniffer capture files. 24237# Sorry, make that "Network Associates Sniffer capture files." 24238# Sorry, make that "Network General old DOS Sniffer capture files." 24239# 242400 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file 24241>33 byte 2 (compressed) 24242>23 leshort x - version %d 24243>25 leshort x \b.%d 24244>32 byte 0 (Token Ring) 24245>32 byte 1 (Ethernet) 24246>32 byte 2 (ARCNET) 24247>32 byte 3 (StarLAN) 24248>32 byte 4 (PC Network broadband) 24249>32 byte 5 (LocalTalk) 24250>32 byte 6 (Znet) 24251>32 byte 7 (Internetwork Analyzer) 24252>32 byte 9 (FDDI) 24253>32 byte 10 (ATM) 24254 24255# 24256# Cinco Networks NetXRay capture files. 24257# Sorry, make that "Network General Sniffer Basic capture files." 24258# Sorry, make that "Network Associates Sniffer Basic capture files." 24259# Sorry, make that "Network Associates Sniffer Basic, and Windows 24260# Sniffer Pro", capture files." 24261# Sorry, make that "Network General Sniffer capture files." 24262# Sorry, make that "NetScout Sniffer capture files." 24263# 242640 string XCP\0 NetXRay capture file 24265>4 string >\0 - version %s 24266>44 leshort 0 (Ethernet) 24267>44 leshort 1 (Token Ring) 24268>44 leshort 2 (FDDI) 24269>44 leshort 3 (WAN) 24270>44 leshort 8 (ATM) 24271>44 leshort 9 (802.11) 24272 24273# 24274# "libpcap" capture files. 24275# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is 24276# the main program that uses that format, but there are other programs 24277# that use "libpcap", or that use the same capture file format.) 24278# 242790 name pcap-be 24280>4 beshort x - version %d 24281>6 beshort x \b.%d 24282>20 belong 0 (No link-layer encapsulation 24283>20 belong 1 (Ethernet 24284>20 belong 2 (3Mb Ethernet 24285>20 belong 3 (AX.25 24286>20 belong 4 (ProNET 24287>20 belong 5 (CHAOS 24288>20 belong 6 (Token Ring 24289>20 belong 7 (BSD ARCNET 24290>20 belong 8 (SLIP 24291>20 belong 9 (PPP 24292>20 belong 10 (FDDI 24293>20 belong 11 (RFC 1483 ATM 24294>20 belong 12 (raw IP 24295>20 belong 13 (BSD/OS SLIP 24296>20 belong 14 (BSD/OS PPP 24297>20 belong 19 (Linux ATM Classical IP 24298>20 belong 50 (PPP or Cisco HDLC 24299>20 belong 51 (PPP-over-Ethernet 24300>20 belong 99 (Symantec Enterprise Firewall 24301>20 belong 100 (RFC 1483 ATM 24302>20 belong 101 (raw IP 24303>20 belong 102 (BSD/OS SLIP 24304>20 belong 103 (BSD/OS PPP 24305>20 belong 104 (BSD/OS Cisco HDLC 24306>20 belong 105 (802.11 24307>20 belong 106 (Linux Classical IP over ATM 24308>20 belong 107 (Frame Relay 24309>20 belong 108 (OpenBSD loopback 24310>20 belong 109 (OpenBSD IPsec encrypted 24311>20 belong 112 (Cisco HDLC 24312>20 belong 113 (Linux "cooked" 24313>20 belong 114 (LocalTalk 24314>20 belong 117 (OpenBSD PFLOG 24315>20 belong 119 (802.11 with Prism header 24316>20 belong 122 (RFC 2625 IP over Fibre Channel 24317>20 belong 123 (SunATM 24318>20 belong 127 (802.11 with radiotap header 24319>20 belong 129 (Linux ARCNET 24320>20 belong 138 (Apple IP over IEEE 1394 24321>20 belong 139 (MTP2 with pseudo-header 24322>20 belong 140 (MTP2 24323>20 belong 141 (MTP3 24324>20 belong 142 (SCCP 24325>20 belong 143 (DOCSIS 24326>20 belong 144 (IrDA 24327>20 belong 147 (Private use 0 24328>20 belong 148 (Private use 1 24329>20 belong 149 (Private use 2 24330>20 belong 150 (Private use 3 24331>20 belong 151 (Private use 4 24332>20 belong 152 (Private use 5 24333>20 belong 153 (Private use 6 24334>20 belong 154 (Private use 7 24335>20 belong 155 (Private use 8 24336>20 belong 156 (Private use 9 24337>20 belong 157 (Private use 10 24338>20 belong 158 (Private use 11 24339>20 belong 159 (Private use 12 24340>20 belong 160 (Private use 13 24341>20 belong 161 (Private use 14 24342>20 belong 162 (Private use 15 24343>20 belong 163 (802.11 with AVS header 24344>20 belong 165 (BACnet MS/TP 24345>20 belong 166 (PPPD 24346>20 belong 169 (GPRS LLC 24347>20 belong 177 (Linux LAPD 24348>20 belong 187 (Bluetooth HCI H4 24349>20 belong 189 (Linux USB 24350>20 belong 192 (PPI 24351>20 belong 195 (802.15.4 24352>20 belong 196 (SITA 24353>20 belong 197 (Endace ERF 24354>20 belong 201 (Bluetooth HCI H4 with pseudo-header 24355>20 belong 202 (AX.25 with KISS header 24356>20 belong 203 (LAPD 24357>20 belong 204 (PPP with direction pseudo-header 24358>20 belong 205 (Cisco HDLC with direction pseudo-header 24359>20 belong 206 (Frame Relay with direction pseudo-header 24360>20 belong 209 (Linux IPMB 24361>20 belong 215 (802.15.4 with non-ASK PHY header 24362>20 belong 220 (Memory-mapped Linux USB 24363>20 belong 224 (Fibre Channel FC-2 24364>20 belong 225 (Fibre Channel FC-2 with frame delimiters 24365>20 belong 226 (Solaris IPNET 24366>20 belong 227 (SocketCAN 24367>20 belong 228 (Raw IPv4 24368>20 belong 229 (Raw IPv6 24369>20 belong 230 (802.15.4 without FCS 24370>20 belong 231 (D-Bus messages 24371>20 belong 235 (DVB-CI 24372>20 belong 236 (MUX27010 24373>20 belong 237 (STANAG 5066 D_PDUs 24374>20 belong 239 (Linux netlink NFLOG messages 24375>20 belong 240 (Hilscher netAnalyzer 24376>20 belong 241 (Hilscher netAnalyzer with delimiters 24377>20 belong 242 (IP-over-Infiniband 24378>20 belong 243 (MPEG-2 Transport Stream packets 24379>20 belong 244 (ng4t ng40 24380>20 belong 245 (NFC LLCP 24381>20 belong 247 (Infiniband 24382>20 belong 248 (SCTP 24383>16 belong x \b, capture length %d) 24384 243850 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian) 24386!:mime application/vnd.tcpdump.pcap 24387>0 use pcap-be 243880 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian) 24389!:mime application/vnd.tcpdump.pcap 24390>0 use \^pcap-be 24391 24392# 24393# "libpcap"-with-Alexey-Kuznetsov's-patches capture files. 24394# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is 24395# the main program that uses that format, but there are other programs 24396# that use "libpcap", or that use the same capture file format.) 24397# 243980 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian) 24399>0 use pcap-be 244000 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian) 24401>0 use \^pcap-be 24402 24403# 24404# "pcap-ng" capture files. 24405# http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html 24406# Pcap-ng files can contain multiple sections. Printing the endianness, 24407# snaplen, or other information from the first SHB may be misleading. 24408# 244090 ubelong 0x0a0d0d0a 24410>8 ubelong 0x1a2b3c4d pcap-ng capture file 24411>>12 beshort x - version %d 24412>>14 beshort x \b.%d 244130 ulelong 0x0a0d0d0a 24414>8 ulelong 0x1a2b3c4d pcap-ng capture file 24415>>12 leshort x - version %d 24416>>14 leshort x \b.%d 24417 24418# 24419# AIX "iptrace" capture files. 24420# 244210 string iptrace\ 1.0 "iptrace" capture file 244220 string iptrace\ 2.0 "iptrace" capture file 24423 24424# 24425# Novell LANalyzer capture files. 24426# 244270 leshort 0x1001 LANalyzer capture file 244280 leshort 0x1007 LANalyzer capture file 24429 24430# 24431# HP-UX "nettl" capture files. 24432# 244330 string \x54\x52\x00\x64\x00 "nettl" capture file 24434 24435# 24436# RADCOM WAN/LAN Analyzer capture files. 24437# 244380 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file 24439 24440# 24441# NetStumbler log files. Not really packets, per se, but about as 24442# close as you can get. These are log files from NetStumbler, a 24443# Windows program, that scans for 802.11b networks. 24444# 244450 string NetS NetStumbler log file 24446>8 lelong x \b, %d stations found 24447 24448# 24449# *Peek tagged capture files. 24450# 244510 string \177ver EtherPeek/AiroPeek/OmniPeek capture file 24452 24453# 24454# Visual Networks traffic capture files. 24455# 244560 string \x05VNF Visual Networks traffic capture file 24457 24458# 24459# Network Instruments Observer capture files. 24460# 244610 string ObserverPktBuffe Network Instruments Observer capture file 24462 24463# 24464# Files from Accellent Group's 5View products. 24465# 244660 string \xaa\xaa\xaa\xaa 5View capture file 24467 24468#------------------------------------------------------------------------------ 24469# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $ 24470# softquad: file(1) magic for SoftQuad Publishing Software 24471# 24472# Author/Editor and RulesBuilder 24473# 24474# XXX - byte order? 24475# 244760 string \<!SQ\ DTD> Compiled SGML rules file 24477>9 string >\0 Type %s 244780 string \<!SQ\ A/E> A/E SGML Document binary 24479>9 string >\0 Type %s 244800 string \<!SQ\ STS> A/E SGML binary styles file 24481>9 string >\0 Type %s 244820 short 0xc0de Compiled PSI (v1) data 244830 short 0xc0da Compiled PSI (v2) data 24484>3 string >\0 (%s) 24485# Binary sqtroff font/desc files... 244860 short 0125252 SoftQuad DESC or font file binary 24487>2 short >0 - version %d 24488# Bitmaps... 244890 search/1 SQ\ BITMAP1 SoftQuad Raster Format text 24490#0 string SQ\ BITMAP2 SoftQuad Raster Format data 24491# sqtroff intermediate language (replacement for ditroff int. lang.) 244920 string X\ SoftQuad troff Context intermediate 24493>2 string 495 for AT&T 495 laser printer 24494>2 string hp for Hewlett-Packard LaserJet 24495>2 string impr for IMAGEN imPRESS 24496>2 string ps for PostScript 24497 24498# From: Michael Piefel <piefel@debian.org> 24499# sqtroff intermediate language (replacement for ditroff int. lang.) 245000 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer 245010 string X\ hp SoftQuad troff Context intermediate for HP LaserJet 245020 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS 245030 string X\ ps SoftQuad troff Context intermediate for PostScript 24504 24505#------------------------------------------------------------------------------ 24506# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $ 24507# spec: file(1) magic for SPEC raw results (*.raw, *.rsf) 24508# 24509# Cloyce D. Spradling <cloyce@headgear.org> 24510 245110 string spec SPEC 24512>4 string .cpu CPU 24513>>8 string <: \b%.4s 24514>>12 string . raw result text 24515 2451617 string version=SPECjbb SPECjbb 24517>32 string <: \b%.4s 24518>>37 string <: v%.4s raw result text 24519 245200 string BEGIN\040SPECWEB SPECweb 24521>13 string <: \b%.2s 24522>>15 string _SSL \b_SSL 24523>>>20 string <: v%.4s raw result text 24524>>16 string <: v%.4s raw result text 24525 24526#------------------------------------------------------------------------------ 24527# $File: spectrum,v 1.8 2017/09/11 23:51:12 christos Exp $ 24528# spectrum: file(1) magic for Spectrum emulator files. 24529# 24530# John Elliott <jce@seasip.demon.co.uk> 24531 24532# 24533# Spectrum +3DOS header 24534# 245350 string PLUS3DOS\032 Spectrum +3 data 24536>15 byte 0 - BASIC program 24537>15 byte 1 - number array 24538>15 byte 2 - character array 24539>15 byte 3 - memory block 24540>>16 belong 0x001B0040 (screen) 24541>15 byte 4 - Tasword document 24542>15 string TAPEFILE - ZXT tapefile 24543# 24544# Tape file. This assumes the .TAP starts with a Spectrum-format header, 24545# which nearly all will. 24546# 24547# Update: Sanity-check string contents to be printable. 24548# -Adam Buchbinder <adam.buchbinder@gmail.com> 24549# 245500 string \023\000\000 24551>4 string >\0 24552>>4 string <\177 Spectrum .TAP data "%-10.10s" 24553>>>3 byte 0 - BASIC program 24554>>>3 byte 1 - number array 24555>>>3 byte 2 - character array 24556>>>3 byte 3 - memory block 24557>>>>14 belong 0x001B0040 (screen) 24558 24559# The following three blocks are from pak21-spectrum@srcf.ucam.org 24560# TZX tape images 245610 string ZXTape!\x1a Spectrum .TZX data 24562>8 byte x version %d 24563>9 byte x \b.%d 24564 24565# RZX input recording files 245660 string RZX! Spectrum .RZX data 24567>4 byte x version %d 24568>5 byte x \b.%d 24569 24570# Floppy disk images 245710 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data 245720 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data 245730 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data 245740 string SINCLAIR Spectrum .SCL Betadisk image 24575 24576# Hard disk images 245770 string RS-IDE\x1a Spectrum .HDF hard disk image 24578>7 byte x \b, version 0x%02x 24579 24580# SZX snapshots (fuse and spectaculator) 24581# Martin M. S. Pedersen <martin@linux.com> 24582# http://www.spectaculator.com/docs/zx-state/header.shtml 24583# 245840 string ZXST zx-state snapshot 24585>4 byte x version %d 24586>5 byte x \b.%d 24587>>6 byte 0 16k ZX Spectrum 24588>>6 byte 1 48k ZX Spectrum/ZX Spectrum+ 24589>>6 byte 2 ZX Spectrum 128 24590>>6 byte 3 ZX Spectrum +2 24591>>6 byte 4 ZX Spectrum +2A/+2B 24592>>6 byte 5 ZX Spectrum +3 24593>>6 byte 6 ZX Spectrum +3e 24594>>6 byte 7 Pentagon 128 24595>>6 byte 8 Timex Sinclair TC2048 24596>>6 byte 9 Timex Sinclair TC2068 24597>>6 byte 10 Scorpion ZS-256 24598>>6 byte 11 ZX Spectrum SE 24599>>6 byte 12 Timex Sinclair TS2068 24600>>6 byte 13 Pentagon 512 24601>>6 byte 14 Pentagon 1024 24602>>6 byte 15 48k ZX Spectrum (NTSC) 24603>>6 byte 16 ZX Spectrum 12Ke 24604>>>7 byte 1 (alternate timings) 24605 24606#------------------------------------------------------------------------------ 24607# $File: sql,v 1.21 2017/03/17 21:35:28 christos Exp $ 24608# sql: file(1) magic for SQL files 24609# 24610# From: "Marty Leisner" <mleisner@eng.mc.xerox.com> 24611# Recognize some MySQL files. 24612# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures 24613# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic 24614# 246150 beshort 0xfe01 MySQL table definition file 24616>2 byte x Version %d 24617>3 byte 0 \b, type UNKNOWN 24618>3 byte 1 \b, type DIAM_ISAM 24619>3 byte 2 \b, type HASH 24620>3 byte 3 \b, type MISAM 24621>3 byte 4 \b, type PISAM 24622>3 byte 5 \b, type RMS_ISAM 24623>3 byte 6 \b, type HEAP 24624>3 byte 7 \b, type ISAM 24625>3 byte 8 \b, type MRG_ISAM 24626>3 byte 9 \b, type MYISAM 24627>3 byte 10 \b, type MRG_MYISAM 24628>3 byte 11 \b, type BERKELEY_DB 24629>3 byte 12 \b, type INNODB 24630>3 byte 13 \b, type GEMINI 24631>3 byte 14 \b, type NDBCLUSTER 24632>3 byte 15 \b, type EXAMPLE_DB 24633>3 byte 16 \b, type CSV_DB 24634>3 byte 17 \b, type FEDERATED_DB 24635>3 byte 18 \b, type BLACKHOLE_DB 24636>3 byte 19 \b, type PARTITION_DB 24637>3 byte 20 \b, type BINLOG 24638>3 byte 21 \b, type SOLID 24639>3 byte 22 \b, type PBXT 24640>3 byte 23 \b, type TABLE_FUNCTION 24641>3 byte 24 \b, type MEMCACHE 24642>3 byte 25 \b, type FALCON 24643>3 byte 26 \b, type MARIA 24644>3 byte 27 \b, type PERFORMANCE_SCHEMA 24645>3 byte 127 \b, type DEFAULT 24646>0x0033 ulong x \b, MySQL version %d 246470 belong&0xffffff00 0xfefe0500 MySQL ISAM index file 24648>3 byte x Version %d 246490 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file 24650>3 byte x Version %d 246510 belong&0xffffff00 0xfefe0700 MySQL MyISAM index file 24652>3 byte x Version %d 24653>14 beshort x \b, %d key parts 24654>16 beshort x \b, %d unique key parts 24655>18 byte x \b, %d keys 24656>28 bequad x \b, %lld records 24657>36 bequad x \b, %lld deleted records 246580 belong&0xffffff00 0xfefe0800 MySQL MyISAM compressed data file 24659>3 byte x Version %d 246600 belong&0xffffff00 0xfefe0900 MySQL Maria index file 24661>3 byte x Version %d 246620 belong&0xffffff00 0xfefe0a00 MySQL Maria compressed data file 24663>3 byte x Version %d 246640 belong&0xffffff00 0xfefe0c00 24665>4 string MACF MySQL Maria control file 24666>>3 byte x Version %d 246670 string \376bin MySQL replication log, 24668>9 long x server id %d 24669>8 byte 1 24670>>13 long 69 \b, MySQL V3.2.3 24671>>>19 string x \b, server version %s 24672>>13 long 75 \b, MySQL V4.0.2-V4.1 24673>>>25 string x \b, server version %s 24674>8 byte 15 MySQL V5+, 24675>>25 string x server version %s 24676>4 string MARIALOG MySQL Maria transaction log file 24677>>3 byte x Version %d 24678 24679#------------------------------------------------------------------------------ 24680# iRiver H Series database file 24681# From Ken Guest <ken@linux.ie> 24682# As observed from iRivNavi.iDB and unencoded firmware 24683# 246840 string iRivDB iRiver Database file 24685>11 string >\0 Version %s 24686>39 string iHP-100 [H Series] 24687 24688#------------------------------------------------------------------------------ 24689# SQLite database files 24690# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg 24691# 24692# Version 1 used GDBM internally; its files cannot be distinguished 24693# from other GDBM files. 24694# 24695# Version 2 used this format: 246960 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database 24697 24698# Version 3 of SQLite allows applications to embed their own "user version" 24699# number in the database at offset 60. Later, SQLite added an "application id" 24700# at offset 68 that is preferred over "user version" for indicating the 24701# associated application. 24702# 247030 string SQLite\ format\ 3 SQLite 3.x database 24704!:mime application/x-sqlite3 24705# seldom found extension sqlite3 like in SyncData.sqlite3 24706# db 24707# Avira Antivir use extension "dbe" like in avevtdb.dbe, avguard_tchk.dbe 24708# Unfortunately extension sqlite also used for other databases starting with string 24709# "TTCONTAINER" like in tracks.sqlite contentconsumer.sqlite contentproducerrepository.sqlite 24710# and with string "ZV-zlib" in like extra.sqlite 24711!:ext sqlite/sqlite3/db/dbe 24712>60 belong =0x5f4d544e (Monotone source repository) 24713>68 belong =0x0f055112 (Fossil checkout) 24714>68 belong =0x0f055113 (Fossil global configuration) 24715>68 belong =0x0f055111 (Fossil repository) 24716>68 belong =0x42654462 (Bentley Systems BeSQLite Database) 24717>68 belong =0x42654c6e (Bentley Systems Localization File) 24718>68 belong =0x47504b47 (OGC GeoPackage file) 24719>68 default x 24720>>68 belong !0 \b, application id %u 24721>>60 belong !0 \b, user version %d 24722>96 belong x \b, last written using SQLite version %d 24723 24724 24725# SQLite Write-Ahead Log from SQLite version >= 3.7.0 24726# http://www.sqlite.org/fileformat.html#walformat 247270 belong&0xfffffffe 0x377f0682 SQLite Write-Ahead Log, 24728!:ext sqlite-wal/db-wal 24729>4 belong x version %d 24730 24731# SQLite Rollback Journal 24732# http://www.sqlite.org/fileformat.html#rollbackjournal 247330 string \xd9\xd5\x05\xf9\x20\xa1\x63\xd7 SQLite Rollback Journal 24734 24735# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek 24736# https://github.com/PredatH0r/ChanSort 247370 string PSDB\0 Panasonic channel list DataBase 24738!:ext db/bin 24739#!:mime application/x-db-svl-panasonic 24740>126 string SQLite\ format\ 3 24741#!:mime application/x-panasonic-sqlite3 24742>>&-15 indirect x \b; contains 24743 24744# H2 Database from http://www.h2database.com/ 247450 string --\ H2\ 0.5/B\ --\ \n H2 Database file 24746# Type: OpenSSH key files 24747# From: Nicolas Collignon <tsointsoin@gmail.com> 24748 247490 string SSH\ PRIVATE\ KEY OpenSSH RSA1 private key, 24750>28 string >\0 version %s 247510 string -----BEGIN\ OPENSSH\ PRIVATE\ KEY----- OpenSSH private key 24752 247530 string ssh-dss\ OpenSSH DSA public key 247540 string ssh-rsa\ OpenSSH RSA public key 247550 string ecdsa-sha2-nistp256 OpenSSH ECDSA public key 247560 string ecdsa-sha2-nistp384 OpenSSH ECDSA public key 247570 string ecdsa-sha2-nistp521 OpenSSH ECDSA public key 247580 string ssh-ed25519 OpenSSH ED25519 public key 24759 24760#------------------------------------------------------------------------------ 24761# $File: ssl,v 1.5 2017/12/29 04:00:07 christos Exp $ 24762# ssl: file(1) magic for SSL file formats 24763 24764# Type: OpenSSL certificates/key files 24765# From: Nicolas Collignon <tsointsoin@gmail.com> 24766 247670 string -----BEGIN\040CERTIFICATE----- PEM certificate 247680 string -----BEGIN\040CERTIFICATE\040REQ PEM certificate request 247690 string -----BEGIN\040RSA\040PRIVATE PEM RSA private key 247700 string -----BEGIN\040DSA\040PRIVATE PEM DSA private key 247710 string -----BEGIN\040EC\040PRIVATE PEM EC private key 247720 string -----BEGIN\040ECDSA\040PRIVATE PEM ECDSA private key 24773 24774# From Luc Gommans 24775# OpenSSL enc file (recognized by a magic string preceding the password's salt) 247760 string Salted__ openssl enc'd data with salted password 24777# Using the -a or -base64 option, OpenSSL will base64-encode the data. 247780 string U2FsdGVkX1 openssl enc'd data with salted password, base64 encoded 24779 24780#------------------------------------------------------------------------------ 24781# $File: sun,v 1.27 2014/04/30 21:41:02 christos Exp $ 24782# sun: file(1) magic for Sun machines 24783# 24784# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x 24785# releases. (5.x uses ELF.) Entries for executables without an 24786# architecture type, used before the 68020-based Sun-3's came out, 24787# are in aout, as they're indistinguishable from other big-endian 24788# 32-bit a.out files. 24789# 247900 belong&077777777 0600413 a.out SunOS SPARC demand paged 24791>0 byte &0x80 24792>>20 belong <4096 shared library 24793>>20 belong =4096 dynamically linked executable 24794>>20 belong >4096 dynamically linked executable 24795>0 byte ^0x80 executable 24796>16 belong >0 not stripped 24797 247980 belong&077777777 0600410 a.out SunOS SPARC pure 24799>0 byte &0x80 dynamically linked executable 24800>0 byte ^0x80 executable 24801>16 belong >0 not stripped 24802 248030 belong&077777777 0600407 a.out SunOS SPARC 24804>0 byte &0x80 dynamically linked executable 24805>0 byte ^0x80 executable 24806>16 belong >0 not stripped 24807 248080 belong&077777777 0400413 a.out SunOS mc68020 demand paged 24809>0 byte &0x80 24810>>20 belong <4096 shared library 24811>>20 belong =4096 dynamically linked executable 24812>>20 belong >4096 dynamically linked executable 24813>0 byte ^0x80 executable 24814>16 belong >0 not stripped 24815 248160 belong&077777777 0400410 a.out SunOS mc68020 pure 24817>0 byte &0x80 dynamically linked executable 24818>0 byte ^0x80 executable 24819>16 belong >0 not stripped 24820 248210 belong&077777777 0400407 a.out SunOS mc68020 24822>0 byte &0x80 dynamically linked executable 24823>0 byte ^0x80 executable 24824>16 belong >0 not stripped 24825 248260 belong&077777777 0200413 a.out SunOS mc68010 demand paged 24827>0 byte &0x80 24828>>20 belong <4096 shared library 24829>>20 belong =4096 dynamically linked executable 24830>>20 belong >4096 dynamically linked executable 24831>0 byte ^0x80 executable 24832>16 belong >0 not stripped 24833 248340 belong&077777777 0200410 a.out SunOS mc68010 pure 24835>0 byte &0x80 dynamically linked executable 24836>0 byte ^0x80 executable 24837>16 belong >0 not stripped 24838 248390 belong&077777777 0200407 a.out SunOS mc68010 24840>0 byte &0x80 dynamically linked executable 24841>0 byte ^0x80 executable 24842>16 belong >0 not stripped 24843 24844# 24845# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC 24846# binary executed in compatibility mode under SunOS 5.x". 24847# 248480 belong 0x080456 SunOS core file 24849>4 belong 432 (SPARC) 24850>>132 string >\0 from '%s' 24851>>116 belong =3 (quit) 24852>>116 belong =4 (illegal instruction) 24853>>116 belong =5 (trace trap) 24854>>116 belong =6 (abort) 24855>>116 belong =7 (emulator trap) 24856>>116 belong =8 (arithmetic exception) 24857>>116 belong =9 (kill) 24858>>116 belong =10 (bus error) 24859>>116 belong =11 (segmentation violation) 24860>>116 belong =12 (bad argument to system call) 24861>>116 belong =29 (resource lost) 24862>>120 belong x (T=%dK, 24863>>124 belong x D=%dK, 24864>>128 belong x S=%dK) 24865>4 belong 826 (68K) 24866>>128 string >\0 from '%s' 24867>4 belong 456 (SPARC 4.x BCP) 24868>>152 string >\0 from '%s' 24869# Sun SunPC 248700 long 0xfa33c08e SunPC 4.0 Hard Disk 248710 string #SUNPC_CONFIG SunPC 4.0 Properties Values 24872# Sun snoop (see RFC 1761, which describes the capture file format, 24873# RFC 3827, which describes some additional datalink types, and 24874# http://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml, 24875# which is the IANA registry of Snoop datalink types) 24876# 248770 string snoop Snoop capture file 24878>8 belong >0 - version %d 24879>12 belong 0 (IEEE 802.3) 24880>12 belong 1 (IEEE 802.4) 24881>12 belong 2 (IEEE 802.5) 24882>12 belong 3 (IEEE 802.6) 24883>12 belong 4 (Ethernet) 24884>12 belong 5 (HDLC) 24885>12 belong 6 (Character synchronous) 24886>12 belong 7 (IBM channel-to-channel adapter) 24887>12 belong 8 (FDDI) 24888>12 belong 9 (Other) 24889>12 belong 10 (type %d) 24890>12 belong 11 (type %d) 24891>12 belong 12 (type %d) 24892>12 belong 13 (type %d) 24893>12 belong 14 (type %d) 24894>12 belong 15 (type %d) 24895>12 belong 16 (Fibre Channel) 24896>12 belong 17 (ATM) 24897>12 belong 18 (ATM Classical IP) 24898>12 belong 19 (type %d) 24899>12 belong 20 (type %d) 24900>12 belong 21 (type %d) 24901>12 belong 22 (type %d) 24902>12 belong 23 (type %d) 24903>12 belong 24 (type %d) 24904>12 belong 25 (type %d) 24905>12 belong 26 (IP over Infiniband) 24906>12 belong >26 (type %d) 24907 24908#--------------------------------------------------------------------------- 24909# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a 24910# lead Sun/Cobalt developer) who agrees that they are good and worthy of 24911# inclusion. 24912 24913# Boot ROM images for Sun/Cobalt Linux server appliances 249140 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom 24915>38 string x V%.4s 24916 24917# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code 24918# at the very end where file(1) can't get it. 249190 string CRfs COBALT boot rom data (Flat boot rom or file system) 24920 24921#------------------------------------------------------------------------------ 24922# msx: file(1) magic for the SymbOS operating system 24923# http://www.symbos.de 24924# Fabio R. Schmidlin <frs@pop.com.br> 24925 24926# SymbOS EXE file 249270x30 string SymExe SymbOS executable 24928>0x36 ubyte x v%c 24929>0x37 ubyte x \b.%c 24930>0xF string x \b, name: %s 24931 24932# SymbOS DOX document 249330 string INFOq\0 SymbOS DOX document 24934 24935# Symbos driver 249360 string SMD1 SymbOS driver 24937>19 byte x \b, name: %c 24938>20 byte x \b%c 24939>21 byte x \b%c 24940>22 byte x \b%c 24941>23 byte x \b%c 24942>24 byte x \b%c 24943>25 byte x \b%c 24944>26 byte x \b%c 24945>27 byte x \b%c 24946>28 byte x \b%c 24947>29 byte x \b%c 24948>30 byte x \b%c 24949>31 byte x \b%c 24950 24951# Symbos video 249520 string SymVid SymbOS video 24953>6 ubyte x v%c 24954>7 ubyte x \b.%c 24955 24956# Soundtrakker 128 ST2 music 249570 byte 0 24958>0xC string \x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x40\x00 Soundtrakker 128 ST2 music, 24959>>1 string x name: %s 24960 24961 24962 24963#------------------------------------------------------------------------ 24964# $File: sysex,v 1.9 2017/03/17 21:35:28 christos Exp $ 24965# sysex: file(1) magic for MIDI sysex files 24966# 24967# GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems 24968# where real SYStem EXclusive messages at offset 1 are limited to seven bits 24969# http://en.wikipedia.org/wiki/MIDI 249700 ubeshort&0xFF80 0xF000 SysEx File - 24971 24972# North American Group 24973>1 byte 0x01 Sequential 24974>1 byte 0x02 IDP 24975>1 byte 0x03 OctavePlateau 24976>1 byte 0x04 Moog 24977>1 byte 0x05 Passport 24978>1 byte 0x06 Lexicon 24979>1 byte 0x07 Kurzweil/Future Retro 24980>>3 byte 0x77 777 24981>>4 byte 0x00 Bank 24982>>4 byte 0x01 Song 24983>>5 byte 0x0f 16 24984>>5 byte 0x0e 15 24985>>5 byte 0x0d 14 24986>>5 byte 0x0c 13 24987>>5 byte 0x0b 12 24988>>5 byte 0x0a 11 24989>>5 byte 0x09 10 24990>>5 byte 0x08 9 24991>>5 byte 0x07 8 24992>>5 byte 0x06 7 24993>>5 byte 0x05 6 24994>>5 byte 0x04 5 24995>>5 byte 0x03 4 24996>>5 byte 0x02 3 24997>>5 byte 0x01 2 24998>>5 byte 0x00 1 24999>>5 byte 0x10 (ALL) 25000>>2 byte x \b, Channel %d 25001>1 byte 0x08 Fender 25002>1 byte 0x09 Gulbransen 25003>1 byte 0x0a AKG 25004>1 byte 0x0b Voyce 25005>1 byte 0x0c Waveframe 25006>1 byte 0x0d ADA 25007>1 byte 0x0e Garfield 25008>1 byte 0x0f Ensoniq 25009>1 byte 0x10 Oberheim 25010>>2 byte 0x06 Matrix 6 series 25011>>3 byte 0x0A Dump (All) 25012>>3 byte 0x01 Dump (Bank) 25013>>4 belong 0x0002040E Matrix 1000 25014>>>11 byte <2 User bank %d 25015>>>11 byte >1 Preset bank %d 25016>1 byte 0x11 Apple 25017>1 byte 0x12 GreyMatter 25018>1 byte 0x14 PalmTree 25019>1 byte 0x15 JLCooper 25020>1 byte 0x16 Lowrey 25021>1 byte 0x17 AdamsSmith 25022>1 byte 0x18 E-mu 25023>1 byte 0x19 Harmony 25024>1 byte 0x1a ART 25025>1 byte 0x1b Baldwin 25026>1 byte 0x1c Eventide 25027>1 byte 0x1d Inventronics 25028>1 byte 0x1f Clarity 25029 25030# European Group 25031>1 byte 0x21 SIEL 25032>1 byte 0x22 Synthaxe 25033>1 byte 0x24 Hohner 25034>1 byte 0x25 Twister 25035>1 byte 0x26 Solton 25036>1 byte 0x27 Jellinghaus 25037>1 byte 0x28 Southworth 25038>1 byte 0x29 PPG 25039>1 byte 0x2a JEN 25040>1 byte 0x2b SSL 25041>1 byte 0x2c AudioVertrieb 25042 25043>1 byte 0x2f ELKA 25044>>3 byte 0x09 EK-44 25045 25046>1 byte 0x30 Dynacord 25047>1 byte 0x31 Jomox 25048>1 byte 0x33 Clavia 25049>1 byte 0x39 Soundcraft 25050# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs 25051>1 byte 0x3e Waldorf 25052>>2 byte 0x00 microWave 25053>>2 byte 0x0E microwave2 / XT 25054>>2 byte 0x0F Q / Q+ 25055>>3 byte =0 (default id) 25056>>3 byte >0 ( 25057>>>3 byte <0x7F \bdevice %d) 25058>>>3 byte =0x7F \bbroadcast id) 25059>>3 byte 0x7f Microwave I 25060>>>4 byte 0x00 SNDR (Sound Request) 25061>>>4 byte 0x10 SNDD (Sound Dump) 25062>>>4 byte 0x20 SNDP (Sound Parameter Change) 25063>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 25064>>>4 byte 0x70 BOOT (Sound Reserved) 25065>>>4 byte 0x01 MULR (Multi Request) 25066>>>4 byte 0x11 MULD (Multi Dump) 25067>>>4 byte 0x21 MULP (Multi Parameter Change) 25068>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 25069>>>4 byte 0x71 OS (Multi Reserved) 25070>>>4 byte 0x02 DRMR (Drum Map Request) 25071>>>4 byte 0x12 DRMD (Drum Map Dump) 25072>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 25073>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 25074>>>4 byte 0x72 BIN (Drum Map Reserved) 25075>>>4 byte 0x03 PATR (Sequencer Pattern Request) 25076>>>4 byte 0x13 PATD (Sequencer Pattern Dump) 25077>>>4 byte 0x23 PATP (Sequencer Pattern Parameter Change) 25078>>>4 byte 0x33 PATQ (Sequencer Pattern Parameter Inquiry) 25079>>>4 byte 0x73 AFM (Sequencer Pattern Reserved) 25080>>>4 byte 0x04 GLBR (Global Parameter Request) 25081>>>4 byte 0x14 GLBD (Global Parameter Dump) 25082>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 25083>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 25084>>>4 byte 0x07 MODR (Mode Parameter Request) 25085>>>4 byte 0x17 MODD (Mode Parameter Dump) 25086>>>4 byte 0x27 MODP (Mode Parameter Parameter Change) 25087>>>4 byte 0x37 MODQ (Mode Parameter Parameter Inquiry) 25088>>2 byte 0x10 microQ 25089>>>4 byte 0x00 SNDR (Sound Request) 25090>>>4 byte 0x10 SNDD (Sound Dump) 25091>>>4 byte 0x20 SNDP (Sound Parameter Change) 25092>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 25093>>>4 byte 0x70 (Sound Reserved) 25094>>>4 byte 0x01 MULR (Multi Request) 25095>>>4 byte 0x11 MULD (Multi Dump) 25096>>>4 byte 0x21 MULP (Multi Parameter Change) 25097>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 25098>>>4 byte 0x71 OS (Multi Reserved) 25099>>>4 byte 0x02 DRMR (Drum Map Request) 25100>>>4 byte 0x12 DRMD (Drum Map Dump) 25101>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 25102>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 25103>>>4 byte 0x72 BIN (Drum Map Reserved) 25104>>>4 byte 0x04 GLBR (Global Parameter Request) 25105>>>4 byte 0x14 GLBD (Global Parameter Dump) 25106>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 25107>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 25108>>2 byte 0x11 rackAttack 25109>>>4 byte 0x00 SNDR (Sound Parameter Request) 25110>>>4 byte 0x10 SNDD (Sound Parameter Dump) 25111>>>4 byte 0x20 SNDP (Sound Parameter Parameter Change) 25112>>>4 byte 0x30 SNDQ (Sound Parameter Parameter Inquiry) 25113>>>4 byte 0x01 PRGR (Program Parameter Request) 25114>>>4 byte 0x11 PRGD (Program Parameter Dump) 25115>>>4 byte 0x21 PRGP (Program Parameter Parameter Change) 25116>>>4 byte 0x31 PRGQ (Program Parameter Parameter Inquiry) 25117>>>4 byte 0x71 OS (Program Parameter Reserved) 25118>>>4 byte 0x03 PATR (Pattern Parameter Request) 25119>>>4 byte 0x13 PATD (Pattern Parameter Dump) 25120>>>4 byte 0x23 PATP (Pattern Parameter Parameter Change) 25121>>>4 byte 0x33 PATQ (Pattern Parameter Parameter Inquiry) 25122>>>4 byte 0x04 GLBR (Global Parameter Request) 25123>>>4 byte 0x14 GLBD (Global Parameter Dump) 25124>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 25125>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 25126>>>4 byte 0x05 EFXR (FX Parameter Request) 25127>>>4 byte 0x15 EFXD (FX Parameter Dump) 25128>>>4 byte 0x25 EFXP (FX Parameter Parameter Change) 25129>>>4 byte 0x35 EFXQ (FX Parameter Parameter Inquiry) 25130>>>4 byte 0x07 MODR (Mode Command Request) 25131>>>4 byte 0x17 MODD (Mode Command Dump) 25132>>>4 byte 0x27 MODP (Mode Command Parameter Change) 25133>>>4 byte 0x37 MODQ (Mode Command Parameter Inquiry) 25134>>2 byte 0x03 Wave 25135>>>4 byte 0x00 SBPR (Soundprogram) 25136>>>4 byte 0x01 SAPR (Performance) 25137>>>4 byte 0x02 SWAVE (Wave) 25138>>>4 byte 0x03 SWTBL (Wave control table) 25139>>>4 byte 0x04 SVT (Velocity Curve) 25140>>>4 byte 0x05 STT (Tuning Table) 25141>>>4 byte 0x06 SGLB (Global Parameters) 25142>>>4 byte 0x07 SARRMAP (Performance Program Change Map) 25143>>>4 byte 0x08 SBPRMAP (Sound Program Change Map) 25144>>>4 byte 0x09 SBPRPAR (Sound Parameter) 25145>>>4 byte 0x0A SARRPAR (Performance Parameter) 25146>>>4 byte 0x0B SINSPAR (Instrument/External Parameter) 25147>>>4 byte 0x0F SBULK (Bulk Switch on/off) 25148 25149# Japanese Group 25150>1 byte 0x40 Kawai 25151>>3 byte 0x20 K1 25152>>3 byte 0x22 K4 25153 25154>1 byte 0x41 Roland 25155>>3 byte 0x14 D-50 25156>>3 byte 0x2b U-220 25157>>3 byte 0x02 TR-707 25158 25159>1 byte 0x42 Korg 25160>>3 byte 0x19 M1 25161 25162>1 byte 0x43 Yamaha 25163>1 byte 0x44 Casio 25164>1 byte 0x46 Kamiya 25165>1 byte 0x47 Akai 25166>1 byte 0x48 Victor 25167>1 byte 0x49 Mesosha 25168>1 byte 0x4b Fujitsu 25169>1 byte 0x4c Sony 25170>1 byte 0x4e Teac 25171>1 byte 0x50 Matsushita 25172>1 byte 0x51 Fostex 25173>1 byte 0x52 Zoom 25174>1 byte 0x54 Matsushita 25175>1 byte 0x57 Acoustic tech. lab. 25176# http://www.midi.org/techspecs/manid.php 25177>1 belong&0xffffff00 0x00007400 Ta Horng 25178>1 belong&0xffffff00 0x00007500 e-Tek 25179>1 belong&0xffffff00 0x00007600 E-Voice 25180>1 belong&0xffffff00 0x00007700 Midisoft 25181>1 belong&0xffffff00 0x00007800 Q-Sound 25182>1 belong&0xffffff00 0x00007900 Westrex 25183>1 belong&0xffffff00 0x00007a00 Nvidia* 25184>1 belong&0xffffff00 0x00007b00 ESS 25185>1 belong&0xffffff00 0x00007c00 Mediatrix 25186>1 belong&0xffffff00 0x00007d00 Brooktree 25187>1 belong&0xffffff00 0x00007e00 Otari 25188>1 belong&0xffffff00 0x00007f00 Key Electronics 25189>1 belong&0xffffff00 0x00010000 Shure 25190>1 belong&0xffffff00 0x00010100 AuraSound 25191>1 belong&0xffffff00 0x00010200 Crystal 25192>1 belong&0xffffff00 0x00010300 Rockwell 25193>1 belong&0xffffff00 0x00010400 Silicon Graphics 25194>1 belong&0xffffff00 0x00010500 Midiman 25195>1 belong&0xffffff00 0x00010600 PreSonus 25196>1 belong&0xffffff00 0x00010800 Topaz 25197>1 belong&0xffffff00 0x00010900 Cast Lightning 25198>1 belong&0xffffff00 0x00010a00 Microsoft 25199>1 belong&0xffffff00 0x00010b00 Sonic Foundry 25200>1 belong&0xffffff00 0x00010c00 Line 6 25201>1 belong&0xffffff00 0x00010d00 Beatnik Inc. 25202>1 belong&0xffffff00 0x00010e00 Van Koerving 25203>1 belong&0xffffff00 0x00010f00 Altech Systems 25204>1 belong&0xffffff00 0x00011000 S & S Research 25205>1 belong&0xffffff00 0x00011100 VLSI Technology 25206>1 belong&0xffffff00 0x00011200 Chromatic 25207>1 belong&0xffffff00 0x00011300 Sapphire 25208>1 belong&0xffffff00 0x00011400 IDRC 25209>1 belong&0xffffff00 0x00011500 Justonic Tuning 25210>1 belong&0xffffff00 0x00011600 TorComp 25211>1 belong&0xffffff00 0x00011700 Newtek Inc. 25212>1 belong&0xffffff00 0x00011800 Sound Sculpture 25213>1 belong&0xffffff00 0x00011900 Walker Technical 25214>1 belong&0xffffff00 0x00011a00 Digital Harmony 25215>1 belong&0xffffff00 0x00011b00 InVision 25216>1 belong&0xffffff00 0x00011c00 T-Square 25217>1 belong&0xffffff00 0x00011d00 Nemesys 25218>1 belong&0xffffff00 0x00011e00 DBX 25219>1 belong&0xffffff00 0x00011f00 Syndyne 25220>1 belong&0xffffff00 0x00012000 Bitheadz 25221>1 belong&0xffffff00 0x00012100 Cakewalk 25222>1 belong&0xffffff00 0x00012200 Staccato 25223>1 belong&0xffffff00 0x00012300 National Semicon. 25224>1 belong&0xffffff00 0x00012400 Boom Theory 25225>1 belong&0xffffff00 0x00012500 Virtual DSP Corp 25226>1 belong&0xffffff00 0x00012600 Antares 25227>1 belong&0xffffff00 0x00012700 Angel Software 25228>1 belong&0xffffff00 0x00012800 St Louis Music 25229>1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX 25230>1 belong&0xffffff00 0x00012a00 Ashley Audio 25231>1 belong&0xffffff00 0x00012b00 Vari-Lite 25232>1 belong&0xffffff00 0x00012c00 Summit Audio 25233>1 belong&0xffffff00 0x00012d00 Aureal Semicon. 25234>1 belong&0xffffff00 0x00012e00 SeaSound 25235>1 belong&0xffffff00 0x00012f00 U.S. Robotics 25236>1 belong&0xffffff00 0x00013000 Aurisis 25237>1 belong&0xffffff00 0x00013100 Nearfield Multimedia 25238>1 belong&0xffffff00 0x00013200 FM7 Inc. 25239>1 belong&0xffffff00 0x00013300 Swivel Systems 25240>1 belong&0xffffff00 0x00013400 Hyperactive 25241>1 belong&0xffffff00 0x00013500 MidiLite 25242>1 belong&0xffffff00 0x00013600 Radical 25243>1 belong&0xffffff00 0x00013700 Roger Linn 25244>1 belong&0xffffff00 0x00013800 Helicon 25245>1 belong&0xffffff00 0x00013900 Event 25246>1 belong&0xffffff00 0x00013a00 Sonic Network 25247>1 belong&0xffffff00 0x00013b00 Realtime Music 25248>1 belong&0xffffff00 0x00013c00 Apogee Digital 25249 25250>1 belong&0xffffff00 0x00202b00 Medeli Electronics 25251>1 belong&0xffffff00 0x00202c00 Charlie Lab 25252>1 belong&0xffffff00 0x00202d00 Blue Chip Music 25253>1 belong&0xffffff00 0x00202e00 BEE OH Corp 25254>1 belong&0xffffff00 0x00202f00 LG Semicon America 25255>1 belong&0xffffff00 0x00203000 TESI 25256>1 belong&0xffffff00 0x00203100 EMAGIC 25257>1 belong&0xffffff00 0x00203200 Behringer 25258>1 belong&0xffffff00 0x00203300 Access Music 25259>1 belong&0xffffff00 0x00203400 Synoptic 25260>1 belong&0xffffff00 0x00203500 Hanmesoft Corp 25261>1 belong&0xffffff00 0x00203600 Terratec 25262>1 belong&0xffffff00 0x00203700 Proel SpA 25263>1 belong&0xffffff00 0x00203800 IBK MIDI 25264>1 belong&0xffffff00 0x00203900 IRCAM 25265>1 belong&0xffffff00 0x00203a00 Propellerhead Software 25266>1 belong&0xffffff00 0x00203b00 Red Sound Systems 25267>1 belong&0xffffff00 0x00203c00 Electron ESI AB 25268>1 belong&0xffffff00 0x00203d00 Sintefex Audio 25269>1 belong&0xffffff00 0x00203e00 Music and More 25270>1 belong&0xffffff00 0x00203f00 Amsaro 25271>1 belong&0xffffff00 0x00204000 CDS Advanced Technology 25272>1 belong&0xffffff00 0x00204100 Touched by Sound 25273>1 belong&0xffffff00 0x00204200 DSP Arts 25274>1 belong&0xffffff00 0x00204300 Phil Rees Music 25275>1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH 25276>1 belong&0xffffff00 0x00204500 Soundart 25277>1 belong&0xffffff00 0x00204600 C-Mexx Software 25278>1 belong&0xffffff00 0x00204700 Klavis Tech. 25279>1 belong&0xffffff00 0x00204800 Noteheads AB 25280 252810 string T707 Roland TR-707 Data 25282#------------------------------------------------------------------------------ 25283# file: file(1) magic for Tcl scripting language 25284# URL: http://www.tcl.tk/ 25285# From: gustaf neumann 25286 25287# Tcl scripts 252880 search/1/w #!\ /usr/bin/tcl Tcl script text executable 25289!:mime text/x-tcl 252900 search/1/w #!\ /usr/local/bin/tcl Tcl script text executable 25291!:mime text/x-tcl 252920 search/1 #!/usr/bin/env\ tcl Tcl script text executable 25293!:mime text/x-tcl 252940 search/1 #!\ /usr/bin/env\ tcl Tcl script text executable 25295!:mime text/x-tcl 252960 search/1/w #!\ /usr/bin/wish Tcl/Tk script text executable 25297!:mime text/x-tcl 252980 search/1/w #!\ /usr/local/bin/wish Tcl/Tk script text executable 25299!:mime text/x-tcl 253000 search/1 #!/usr/bin/env\ wish Tcl/Tk script text executable 25301!:mime text/x-tcl 253020 search/1 #!\ /usr/bin/env\ wish Tcl/Tk script text executable 25303!:mime text/x-tcl 25304 25305# check the first line 253060 search/1 package\ req 25307>0 regex \^package[\ \t]+req Tcl script 25308# not 'p', check other lines 253090 search/1 !p 25310>0 regex \^package[\ \t]+req Tcl script 25311 25312#------------------------------------------------------------------------------ 25313# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $ 25314# teapot: file(1) magic for "teapot" spreadsheet 25315# 253160 string #!teapot\012xdr teapot work sheet (XDR format) 25317 25318#------------------------------------------------------------------------------ 25319# $File: terminfo,v 1.10 2018/01/21 03:26:33 christos Exp $ 25320# terminfo: file(1) magic for terminfo 25321# 25322# URL: http://invisible-island.net/ncurses/man/term.5.html 25323# URL: http://invisible-island.net/ncurses/man/scr_dump.5.html 25324# 25325# Workaround for Targa image type by Joerg Jenderek 25326# GRR: line below too general as it catches also 25327# Targa image type 1 with 26 long identification field 25328# and HELP.DSK 253290 string \032\001 25330# 5th character of terminal name list, but not Targa image pixel size (15 16 24 32) 25331>16 ubyte >32 25332# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0.4.1" 25333>>12 regex \^[a-zA-Z0-9][a-zA-Z0-9.][^|]* Compiled terminfo entry "%-s" 25334!:mime application/x-terminfo 25335# no extension 25336#!:ext 25337# 25338#------------------------------------------------------------------------------ 25339# The following was added for ncurses6 development: 25340#------------------------------------------------------------------------------ 25341# 253420 string \036\002 25343# imitate the legacy compiled-format, to get the entry-name printed 25344>16 ubyte >32 25345# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0. 4.1" 25346>>12 regex \^[a-zA-Z0-9][a-zA-Z0-9.][^|]* Compiled 32-bit terminfo entry "%-s" 25347!:mime application/x-terminfo2 25348# 25349# While the compiled terminfo uses little-endian format irregardless of 25350# platform, SystemV screen dumps do not. They came later, and that detail was 25351# overlooked. 25352# 25353# AIX and HPUX use the SVr4 big-endian format 25354# Solaris uses the SVr3 formats (sparc and x86 differ endian-ness) 253550 beshort 0433 SVr2 curses screen image, big-endian 253560 beshort 0434 SVr3 curses screen image, big-endian 253570 beshort 0435 SVr4 curses screen image, big-endian 25358# 253590 leshort 0433 SVr2 curses screen image, little-endian 253600 leshort 0434 SVr3 curses screen image, little-endian 253610 leshort 0435 SVr4 curses screen image, little-endian 25362# 25363# Rather than SVr4, Solaris "xcurses" writes this header: 253640 regex \^MAX=[0-9]+,[0-9]+$ 25365>1 regex \^BEG=[0-9]+,[0-9]+$ 25366>2 regex \^SCROLL=[0-9]+,[0-9]+$ 25367>3 regex \^VMIN=[0-9]+$ 25368>4 regex \^VTIME=[0-9]+$ 25369>5 regex \^FLAGS=0x[[:xdigit:]]+$ 25370>6 regex \^FG=[0-9],[0-9]+$ 25371>7 regex \^BG=[0-9]+,[0-9]+, Solaris xcurses screen image 25372# 25373# ncurses5 (and before) did not use a magic number, making screen dumps "data". 25374# ncurses6 (2015) uses this format, ignoring byte-order 253750 string \210\210\210\210ncurses ncurses6 screen image 25376# 25377# PDCurses added this in 2005 253780 string PDC\001 PDCurses screen image 25379 25380#------------------------------------------------------------------------------ 25381# $File: tex,v 1.20 2014/03/16 02:53:03 christos Exp $ 25382# tex: file(1) magic for TeX files 25383# 25384# XXX - needs byte-endian stuff (big-endian and little-endian DVI?) 25385# 25386# From <conklin@talisman.kaleida.com> 25387 25388# Although we may know the offset of certain text fields in TeX DVI 25389# and font files, we can't use them reliably because they are not 25390# zero terminated. [but we do anyway, christos] 253910 string \367\002 TeX DVI file 25392!:mime application/x-dvi 25393>16 string >\0 (%s) 253940 string \367\203 TeX generic font data 253950 string \367\131 TeX packed font data 25396>3 string >\0 (%s) 253970 string \367\312 TeX virtual font data 253980 search/1 This\ is\ TeX, TeX transcript text 253990 search/1 This\ is\ METAFONT, METAFONT transcript text 25400 25401# There is no way to detect TeX Font Metric (*.tfm) files without 25402# breaking them apart and reading the data. The following patterns 25403# match most *.tfm files generated by METAFONT or afm2tfm. 254042 string \000\021 TeX font metric data 25405!:mime application/x-tex-tfm 25406>33 string >\0 (%s) 254072 string \000\022 TeX font metric data 25408!:mime application/x-tex-tfm 25409>33 string >\0 (%s) 25410 25411# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com) 254120 search/1 \\input\ texinfo Texinfo source text 25413!:mime text/x-texinfo 254140 search/1 This\ is\ Info\ file GNU Info text 25415!:mime text/x-info 25416 25417# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com) 254180 search/4096 \\input TeX document text 25419!:mime text/x-tex 25420!:strength + 15 254210 search/4096 \\begin LaTeX document text 25422!:mime text/x-tex 25423!:strength + 15 254240 search/4096 \\section LaTeX document text 25425!:mime text/x-tex 25426!:strength + 18 254270 search/4096 \\setlength LaTeX document text 25428!:mime text/x-tex 25429!:strength + 15 254300 search/4096 \\documentstyle LaTeX document text 25431!:mime text/x-tex 25432!:strength + 18 254330 search/4096 \\chapter LaTeX document text 25434!:mime text/x-tex 25435!:strength + 18 254360 search/4096 \\documentclass LaTeX 2e document text 25437!:mime text/x-tex 25438!:strength + 15 254390 search/4096 \\relax LaTeX auxiliary file 25440!:mime text/x-tex 25441!:strength + 15 254420 search/4096 \\contentsline LaTeX table of contents 25443!:mime text/x-tex 25444!:strength + 15 254450 search/4096 %\ -*-latex-*- LaTeX document text 25446!:mime text/x-tex 25447 25448# Tex document, from Hendrik Scholz <hendrik@scholz.net> 254490 search/1 \\ifx TeX document text 25450 25451# Index and glossary files 254520 search/4096 \\indexentry LaTeX raw index file 254530 search/4096 \\begin{theindex} LaTeX sorted index 254540 search/4096 \\glossaryentry LaTeX raw glossary 254550 search/4096 \\begin{theglossary} LaTeX sorted glossary 254560 search/4096 This\ is\ makeindex Makeindex log file 25457 25458# End of TeX 25459 25460#------------------------------------------------------------------------------ 25461# file(1) magic for BibTex text files 25462# From Hendrik Scholz <hendrik@scholz.net> 25463 254640 search/1/c @article{ BibTeX text file 254650 search/1/c @book{ BibTeX text file 254660 search/1/c @inbook{ BibTeX text file 254670 search/1/c @incollection{ BibTeX text file 254680 search/1/c @inproceedings{ BibTeX text file 254690 search/1/c @manual{ BibTeX text file 254700 search/1/c @misc{ BibTeX text file 254710 search/1/c @preamble{ BibTeX text file 254720 search/1/c @phdthesis{ BibTeX text file 254730 search/1/c @techreport{ BibTeX text file 254740 search/1/c @unpublished{ BibTeX text file 25475 2547673 search/1 %%%\ \ BibTeX-file{ BibTex text file (with full header) 25477 2547873 search/1 %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header) 25479 254800 search/1 %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file 25481 254820 search/1 %\ BibTeX\ ` BibTeX custom bibliography style text file 25483 254840 search/1 @c\ @mapfile{ TeX font aliases text file 25485 254860 string #LyX LyX document text 25487 25488# ConTeXt documents 25489# http://wiki.contextgarden.net/ 254900 search/4096 \\setupcolors[ ConTeXt document text 25491!:strength + 15 254920 search/4096 \\definecolor[ ConTeXt document text 25493!:strength + 15 254940 search/4096 \\setupinteraction[ ConTeXt document text 25495!:strength + 15 254960 search/4096 \\useURL[ ConTeXt document text 25497!:strength + 15 254980 search/4096 \\setuppapersize[ ConTeXt document text 25499!:strength + 15 255000 search/4096 \\setuplayout[ ConTeXt document text 25501!:strength + 15 255020 search/4096 \\setupfooter[ ConTeXt document text 25503!:strength + 15 255040 search/4096 \\setupfootertexts[ ConTeXt document text 25505!:strength + 15 255060 search/4096 \\setuppagenumbering[ ConTeXt document text 25507!:strength + 15 255080 search/4096 \\setupbodyfont[ ConTeXt document text 25509!:strength + 15 255100 search/4096 \\setuphead[ ConTeXt document text 25511!:strength + 15 255120 search/4096 \\setupitemize[ ConTeXt document text 25513!:strength + 15 255140 search/4096 \\setupwhitespace[ ConTeXt document text 25515!:strength + 15 255160 search/4096 \\setupindenting[ ConTeXt document text 25517!:strength + 15 25518 25519#------------------------------------------------------------------------------ 25520# $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $ 25521# file(1) magic for tgif(1) files 25522# From Hendrik Scholz <hendrik@scholz.net> 255230 string %TGIF\ Tgif file version 25524>6 string x %s 25525 25526#------------------------------------------------------------------------------ 25527# $File: ti-8x,v 1.7 2014/04/30 21:41:02 christos Exp $ 25528# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators. 25529# 25530# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us). 25531# 25532# Update: Romain Lievin (roms@lpg.ticalc.org). 25533# 25534# NOTE: This list is not complete. 25535# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the 25536# program/group magic numbers in here because I cannot find any. 255370 string **TI80** TI-80 Graphing Calculator File. 255380 string **TI81** TI-81 Graphing Calculator File. 25539# 25540# Magic Numbers for the TI-73 25541# 255420 string **TI73** TI-73 Graphing Calculator 25543>0x00003B byte 0x00 (real number) 25544>0x00003B byte 0x01 (list) 25545>0x00003B byte 0x02 (matrix) 25546>0x00003B byte 0x03 (equation) 25547>0x00003B byte 0x04 (string) 25548>0x00003B byte 0x05 (program) 25549>0x00003B byte 0x06 (assembly program) 25550>0x00003B byte 0x07 (picture) 25551>0x00003B byte 0x08 (gdb) 25552>0x00003B byte 0x0C (complex number) 25553>0x00003B byte 0x0F (window settings) 25554>0x00003B byte 0x10 (zoom) 25555>0x00003B byte 0x11 (table setup) 25556>0x00003B byte 0x13 (backup) 25557 25558# Magic Numbers for the TI-82 25559# 255600 string **TI82** TI-82 Graphing Calculator 25561>0x00003B byte 0x00 (real) 25562>0x00003B byte 0x01 (list) 25563>0x00003B byte 0x02 (matrix) 25564>0x00003B byte 0x03 (Y-variable) 25565>0x00003B byte 0x05 (program) 25566>0x00003B byte 0x06 (protected prgm) 25567>0x00003B byte 0x07 (picture) 25568>0x00003B byte 0x08 (gdb) 25569>0x00003B byte 0x0B (window settings) 25570>0x00003B byte 0x0C (window settings) 25571>0x00003B byte 0x0D (table setup) 25572>0x00003B byte 0x0E (screenshot) 25573>0x00003B byte 0x0F (backup) 25574# 25575# Magic Numbers for the TI-83 25576# 255770 string **TI83** TI-83 Graphing Calculator 25578>0x00003B byte 0x00 (real) 25579>0x00003B byte 0x01 (list) 25580>0x00003B byte 0x02 (matrix) 25581>0x00003B byte 0x03 (Y-variable) 25582>0x00003B byte 0x04 (string) 25583>0x00003B byte 0x05 (program) 25584>0x00003B byte 0x06 (protected prgm) 25585>0x00003B byte 0x07 (picture) 25586>0x00003B byte 0x08 (gdb) 25587>0x00003B byte 0x0B (window settings) 25588>0x00003B byte 0x0C (window settings) 25589>0x00003B byte 0x0D (table setup) 25590>0x00003B byte 0x0E (screenshot) 25591>0x00003B byte 0x13 (backup) 25592# 25593# Magic Numbers for the TI-83+ 25594# 255950 string **TI83F* TI-83+ Graphing Calculator 25596>0x00003B byte 0x00 (real number) 25597>0x00003B byte 0x01 (list) 25598>0x00003B byte 0x02 (matrix) 25599>0x00003B byte 0x03 (equation) 25600>0x00003B byte 0x04 (string) 25601>0x00003B byte 0x05 (program) 25602>0x00003B byte 0x06 (assembly program) 25603>0x00003B byte 0x07 (picture) 25604>0x00003B byte 0x08 (gdb) 25605>0x00003B byte 0x0C (complex number) 25606>0x00003B byte 0x0F (window settings) 25607>0x00003B byte 0x10 (zoom) 25608>0x00003B byte 0x11 (table setup) 25609>0x00003B byte 0x13 (backup) 25610>0x00003B byte 0x15 (application variable) 25611>0x00003B byte 0x17 (group of variable) 25612 25613# 25614# Magic Numbers for the TI-85 25615# 256160 string **TI85** TI-85 Graphing Calculator 25617>0x00003B byte 0x00 (real number) 25618>0x00003B byte 0x01 (complex number) 25619>0x00003B byte 0x02 (real vector) 25620>0x00003B byte 0x03 (complex vector) 25621>0x00003B byte 0x04 (real list) 25622>0x00003B byte 0x05 (complex list) 25623>0x00003B byte 0x06 (real matrix) 25624>0x00003B byte 0x07 (complex matrix) 25625>0x00003B byte 0x08 (real constant) 25626>0x00003B byte 0x09 (complex constant) 25627>0x00003B byte 0x0A (equation) 25628>0x00003B byte 0x0C (string) 25629>0x00003B byte 0x0D (function GDB) 25630>0x00003B byte 0x0E (polar GDB) 25631>0x00003B byte 0x0F (parametric GDB) 25632>0x00003B byte 0x10 (diffeq GDB) 25633>0x00003B byte 0x11 (picture) 25634>0x00003B byte 0x12 (program) 25635>0x00003B byte 0x13 (range) 25636>0x00003B byte 0x17 (window settings) 25637>0x00003B byte 0x18 (window settings) 25638>0x00003B byte 0x19 (window settings) 25639>0x00003B byte 0x1A (window settings) 25640>0x00003B byte 0x1B (zoom) 25641>0x00003B byte 0x1D (backup) 25642>0x00003B byte 0x1E (unknown) 25643>0x00003B byte 0x2A (equation) 25644>0x000032 string ZS4 - ZShell Version 4 File. 25645>0x000032 string ZS3 - ZShell Version 3 File. 25646# 25647# Magic Numbers for the TI-86 25648# 256490 string **TI86** TI-86 Graphing Calculator 25650>0x00003B byte 0x00 (real number) 25651>0x00003B byte 0x01 (complex number) 25652>0x00003B byte 0x02 (real vector) 25653>0x00003B byte 0x03 (complex vector) 25654>0x00003B byte 0x04 (real list) 25655>0x00003B byte 0x05 (complex list) 25656>0x00003B byte 0x06 (real matrix) 25657>0x00003B byte 0x07 (complex matrix) 25658>0x00003B byte 0x08 (real constant) 25659>0x00003B byte 0x09 (complex constant) 25660>0x00003B byte 0x0A (equation) 25661>0x00003B byte 0x0C (string) 25662>0x00003B byte 0x0D (function GDB) 25663>0x00003B byte 0x0E (polar GDB) 25664>0x00003B byte 0x0F (parametric GDB) 25665>0x00003B byte 0x10 (diffeq GDB) 25666>0x00003B byte 0x11 (picture) 25667>0x00003B byte 0x12 (program) 25668>0x00003B byte 0x13 (range) 25669>0x00003B byte 0x17 (window settings) 25670>0x00003B byte 0x18 (window settings) 25671>0x00003B byte 0x19 (window settings) 25672>0x00003B byte 0x1A (window settings) 25673>0x00003B byte 0x1B (zoom) 25674>0x00003B byte 0x1D (backup) 25675>0x00003B byte 0x1E (unknown) 25676>0x00003B byte 0x2A (equation) 25677# 25678# Magic Numbers for the TI-89 25679# 256800 string **TI89** TI-89 Graphing Calculator 25681>0x000048 byte 0x00 (expression) 25682>0x000048 byte 0x04 (list) 25683>0x000048 byte 0x06 (matrix) 25684>0x000048 byte 0x0A (data) 25685>0x000048 byte 0x0B (text) 25686>0x000048 byte 0x0C (string) 25687>0x000048 byte 0x0D (graphic data base) 25688>0x000048 byte 0x0E (figure) 25689>0x000048 byte 0x10 (picture) 25690>0x000048 byte 0x12 (program) 25691>0x000048 byte 0x13 (function) 25692>0x000048 byte 0x14 (macro) 25693>0x000048 byte 0x1C (zipped) 25694>0x000048 byte 0x21 (assembler) 25695# 25696# Magic Numbers for the TI-92 25697# 256980 string **TI92** TI-92 Graphing Calculator 25699>0x000048 byte 0x00 (expression) 25700>0x000048 byte 0x04 (list) 25701>0x000048 byte 0x06 (matrix) 25702>0x000048 byte 0x0A (data) 25703>0x000048 byte 0x0B (text) 25704>0x000048 byte 0x0C (string) 25705>0x000048 byte 0x0D (graphic data base) 25706>0x000048 byte 0x0E (figure) 25707>0x000048 byte 0x10 (picture) 25708>0x000048 byte 0x12 (program) 25709>0x000048 byte 0x13 (function) 25710>0x000048 byte 0x14 (macro) 25711>0x000048 byte 0x1D (backup) 25712# 25713# Magic Numbers for the TI-92+/V200 25714# 257150 string **TI92P* TI-92+/V200 Graphing Calculator 25716>0x000048 byte 0x00 (expression) 25717>0x000048 byte 0x04 (list) 25718>0x000048 byte 0x06 (matrix) 25719>0x000048 byte 0x0A (data) 25720>0x000048 byte 0x0B (text) 25721>0x000048 byte 0x0C (string) 25722>0x000048 byte 0x0D (graphic data base) 25723>0x000048 byte 0x0E (figure) 25724>0x000048 byte 0x10 (picture) 25725>0x000048 byte 0x12 (program) 25726>0x000048 byte 0x13 (function) 25727>0x000048 byte 0x14 (macro) 25728>0x000048 byte 0x1C (zipped) 25729>0x000048 byte 0x21 (assembler) 25730# 25731# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades 25732# 257330x0000016 string Advanced TI-XX Graphing Calculator (FLASH) 257340 string **TIFL** TI-XX Graphing Calculator (FLASH) 25735>8 byte >0 - Revision %d 25736>>9 byte x \b.%d, 25737>12 byte >0 Revision date %02x 25738>>13 byte x \b/%02x 25739>>14 beshort x \b/%04x, 25740>17 string >/0 name: '%s', 25741>48 byte 0x74 device: TI-73, 25742>48 byte 0x73 device: TI-83+, 25743>48 byte 0x98 device: TI-89, 25744>48 byte 0x88 device: TI-92+, 25745>49 byte 0x23 type: OS upgrade, 25746>49 byte 0x24 type: application, 25747>49 byte 0x25 type: certificate, 25748>49 byte 0x3e type: license, 25749>74 lelong >0 size: %d bytes 25750 25751# VTi & TiEmu skins (TI Graphing Calculators). 25752# From: Romain Lievin (roms@lpg.ticalc.org). 25753# Magic Numbers for the VTi skins 257540 string VTI Virtual TI skin 25755>3 string v - Version 25756>>4 byte >0 \b %c 25757>>6 byte x \b.%c 25758# Magic Numbers for the TiEmu skins 257590 string TiEmu TiEmu skin 25760>6 string v - Version 25761>>7 byte >0 \b %c 25762>>9 byte x \b.%c 25763>>10 byte x \b%c 25764 25765#------------------------------------------------------------------------------ 25766# $File: timezone,v 1.11 2009/09/19 16:28:12 christos Exp $ 25767# timezone: file(1) magic for timezone data 25768# 25769# from Daniel Quinlan (quinlan@yggdrasil.com) 25770# this should work on Linux, SunOS, and maybe others 25771# Added new official magic number for recent versions of the Olson code 257720 string TZif timezone data 25773>4 byte 0 \b, old version 25774>4 byte >0 \b, version %c 25775>20 belong 0 \b, no gmt time flags 25776>20 belong 1 \b, 1 gmt time flag 25777>20 belong >1 \b, %d gmt time flags 25778>24 belong 0 \b, no std time flags 25779>20 belong 1 \b, 1 std time flag 25780>24 belong >1 \b, %d std time flags 25781>28 belong 0 \b, no leap seconds 25782>28 belong 1 \b, 1 leap second 25783>28 belong >1 \b, %d leap seconds 25784>32 belong 0 \b, no transition times 25785>32 belong 1 \b, 1 transition time 25786>32 belong >1 \b, %d transition times 25787>36 belong 0 \b, no abbreviation chars 25788>36 belong 1 \b, 1 abbreviation char 25789>36 belong >1 \b, %d abbreviation chars 257900 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data 257910 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data 257920 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data 257930 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data 257940 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data 257950 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data 25796 25797#------------------------------------------------------------------------------ 25798# $File: tplink,v 1.2 2017/12/14 05:52:56 christos Exp $ 25799# tplink: File magic for openwrt firmware files 25800 25801# URL: https://wiki.openwrt.org/doc/techref/header 25802# Reference: http://git.openwrt.org/?p=openwrt.git;a=blob;f=tools/firmware-utils/src/mktplinkfw.c 25803# From: Joerg Jenderek 25804# check for valid header version 1 or 2 258050 ulelong <3 25806>0 ulelong !0 25807# test for header padding with nulls 25808>>0x100 long 0 25809>>>0 use firmware-tplink 25810 258110 name firmware-tplink 25812>0 ubyte x firmware 25813!:mime application/x-tplink-bin 25814!:ext bin 25815# hardware id like 10430001 07410001 09410004 09410006 25816>0x40 ubeshort x %x 25817>0x42 ubeshort x v%x 25818# hardware revision like 1 25819>0x44 ubelong !1 (revision %u) 25820# vendor_name[24] like OpenWrt or TP-LINK Technologies 25821>4 string x %.24s 25822# fw_version[36] like r49389 or ver. 1.0 25823>0x1c string x %.36s 25824# header version 1 or 2 25825>0 ubyte !1 V%X 25826# ver_hi.ver_mid.ver_lo 25827>0x98 long !0 \b, version 25828>>0x98 ubeshort x %u 25829>>0x9A ubeshort x \b.%u 25830>>0x9C ubeshort x \b.%u 25831# region code 0~universal 1~US 25832>0x48 ubelong x 25833#>>0x48 ubelong 0 (universal) 25834>>0x48 ubelong 1 (US) 25835>>0x48 ubelong >1 (region %u) 25836# total length of the firmware. not always true 25837>0x7C ubelong x \b, %u bytes or less 25838# unknown 1 25839>0x48 ubelong !0 \b, UNKNOWN1 0x%x 25840# md5sum1[16] 25841#>0x4c ubequad x \b, MD5 %llx 25842#>>0x54 ubequad x \b%llx 25843# unknown 2 25844>0x5c ubelong !0 \b, UNKNOWN2 0x%x 25845# md5sum2[16] 25846#>0x60 ubequad !0 \b, 2nd MD5 %llx 25847#>>0x68 ubequad x \b%llx 25848# unknown 3 25849>0x70 ubelong !0 \b, UNKNOWN3 0x%x 25850# kernel load address 25851#>0x74 ubelong x \b, 0x%x load 25852# kernel entry point 25853#>0x78 ubelong x \b, 0x%x entry 25854# kernel data offset. 200h means direct after header 25855>0x80 ubelong x \b, at 0x%x 25856# kernel data length and 1 space 25857>0x84 ubelong x %u bytes 25858# look for kernel type (gzip compressed vmlinux.bin by ./compress) 25859>(0x80.L) indirect x 25860# root file system data offset 25861>0x88 ubelong x \b, at 0x%x 25862# rootfs data length and 1 space 25863>0x8C ubelong x %u bytes 25864# in 5.32 only true for offset ~< FILE_BYTES_MAX=9 MB defined in ../../src/file.h 25865>(0x88.L) indirect x 25866#>(0x88.L) string x \b, file system '%.4s' 25867#>(0x88.L) ubequad x \b, file system 0x%llx 25868# bootloader data offset 25869>0x90 ubelong !0 \b, at 0x%x 25870# bootloader data length only resonable if bootloader offset not null 25871>>0x94 ubelong !0 %u bytes 25872# pad[354] should be 354 null bytes. 25873#>0x9E ubequad !0 \b, padding 0x%llx 25874# But at 0x120 18 non null bytes in examples like 25875# wr940nv4_eu_3_16_9_up_boot(160620).bin 25876# wr940nv6_us_3_18_1_up_boot(171030).bin 25877#>0x120 ubequad !0 \b, other padding 0x%llx 25878 25879#------------------------------------------------------------------------------ 25880# $File: troff,v 1.11 2014/06/03 19:01:34 christos Exp $ 25881# troff: file(1) magic for *roff 25882# 25883# updated by Daniel Quinlan (quinlan@yggdrasil.com) 25884 25885# troff input 258860 search/1 .\\" troff or preprocessor input text 25887!:mime text/troff 258880 search/1 '\\" troff or preprocessor input text 25889!:mime text/troff 258900 search/1 '.\\" troff or preprocessor input text 25891!:mime text/troff 258920 search/1 \\" troff or preprocessor input text 25893!:mime text/troff 258940 search/1 ''' troff or preprocessor input text 25895!:mime text/troff 258960 regex/20l \^\\.[A-Za-z0-9][A-Za-z0-9][\ \t] troff or preprocessor input text 25897!:mime text/troff 258980 regex/20l \^\\.[A-Za-z0-9][A-Za-z0-9]$ troff or preprocessor input text 25899!:mime text/troff 25900 25901# ditroff intermediate output text 259020 search/1 x\ T ditroff output text 25903>4 search/1 cat for the C/A/T phototypesetter 25904>4 search/1 ps for PostScript 25905>4 search/1 dvi for DVI 25906>4 search/1 ascii for ASCII 25907>4 search/1 lj4 for LaserJet 4 25908>4 search/1 latin1 for ISO 8859-1 (Latin 1) 25909>4 search/1 X75 for xditview at 75dpi 25910>>7 search/1 -12 (12pt) 25911>4 search/1 X100 for xditview at 100dpi 25912>>8 search/1 -12 (12pt) 25913 25914# output data formats 259150 string \100\357 very old (C/A/T) troff output data 25916 25917#------------------------------------------------------------------------------ 25918# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $ 25919# tuxedo: file(1) magic for BEA TUXEDO data files 25920# 25921# from Ian Springer <ispringer@hotmail.com> 25922# 259230 string \0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0 BEA TUXEDO DES mask data 25924 25925#------------------------------------------------------------------------------ 25926# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $ 25927# typeset: file(1) magic for other typesetting 25928# 259290 string Interpress/Xerox Xerox InterPress data 25930>16 string / (version 25931>>17 string >\0 %s) 25932 25933#------------------------------------------------------------------------------ 25934# $File: unicode,v 1.6 2010/09/20 18:55:20 rrt Exp $ 25935# Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp> 25936# GRR: These types should be recognised in file_ascmagic so these 25937# encodings can be treated by text patterns. 25938# Missing types are already dealt with internally. 25939# 259400 string +/v8 Unicode text, UTF-7 259410 string +/v9 Unicode text, UTF-7 259420 string +/v+ Unicode text, UTF-7 259430 string +/v/ Unicode text, UTF-7 259440 string \335\163\146\163 Unicode text, UTF-8-EBCDIC 259450 string \000\000\376\377 Unicode text, UTF-32, big-endian 259460 string \377\376\000\000 Unicode text, UTF-32, little-endian 259470 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode) 25948 25949#------------------------------------------------------------------------------ 25950# $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $ 25951# unknown: file(1) magic for unknown machines 25952# 25953# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11 25954# (executable, pure, and split I&D, respectively), but the PDP-11 version 25955# doesn't have the "version %ld", which may be a bogus COFFism (I don't 25956# think there was ever COFF for the PDP-11). 25957# 25958# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a 25959# long, as it would be on a VAX. In any case, that could collide with 25960# VAX demand-paged files, as the magic number is little-endian on those 25961# binaries, so the first 16 bits of the file would contain 0x10B. 25962# 25963# Therefore, those entries are commented out. 25964# 25965# 0x10C is 0414 and 0x10E is 0416; those *are* unknown. 25966# 25967#0 short 0x107 unknown machine executable 25968#>8 short >0 not stripped 25969#>15 byte >0 - version %ld 25970#0 short 0x108 unknown pure executable 25971#>8 short >0 not stripped 25972#>15 byte >0 - version %ld 25973#0 short 0x109 PDP-11 separate I&D 25974#>8 short >0 not stripped 25975#>15 byte >0 - version %ld 25976#0 short 0x10b unknown pure executable 25977#>8 short >0 not stripped 25978#>15 byte >0 - version %ld 259790 long 0x10c unknown demand paged pure executable 25980>16 long >0 not stripped 259810 long 0x10e unknown readable demand paged pure executable 25982 25983#------------------------------------------------------------------------------ 25984# $File: uterus,v 1.3 2014/04/30 21:41:02 christos Exp $ 25985# file(1) magic for uterus files 25986# http://freecode.com/projects/uterus 25987# 259880 string UTE+ uterus file 25989>4 string v \b, version 25990>5 byte x %c 25991>6 string . \b. 25992>7 byte x \b%c 25993>8 string \<\> \b, big-endian 25994>>16 belong >0 \b, slut size %u 25995>8 string \>\< \b, litte-endian 25996>>16 lelong >0 \b, slut size %u 25997>10 byte &8 \b, compressed 25998 25999#------------------------------------------------------------------------------ 26000# $File: uuencode,v 1.7 2009/09/19 16:28:13 christos Exp $ 26001# uuencode: file(1) magic for ASCII-encoded files 26002# 26003 26004# GRR: the first line of xxencoded files is identical to that in uuencoded 26005# files, but the first character in most subsequent lines is 'h' instead of 26006# 'M'. (xxencoding uses lowercase letters in place of most of uuencode's 26007# punctuation and survives BITNET gateways better.) If regular expressions 26008# were supported, this entry could possibly be split into two with 26009# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs). 260100 search/1 begin\ uuencoded or xxencoded text 26011 26012# btoa(1) is an alternative to uuencode that requires less space. 260130 search/1 xbtoa\ Begin btoa'd text 26014 26015# ship(1) is another, much cooler alternative to uuencode. 26016# Greg Roelofs, newt@uchicago.edu 260170 search/1 $\012ship ship'd binary text 26018 26019# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?) 26020# Greg Roelofs, newt@uchicago.edu 260210 search/1 Decode\ the\ following\ with\ bdeco bencoded News text 26022 26023# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 26024# Daniel Quinlan, quinlan@yggdrasil.com 2602511 search/1 must\ be\ converted\ with\ BinHex BinHex binary text 26026>41 search/1 x \b, version %.3s 26027 26028# GRR: handle BASE64 26029 26030#------------------------------------------------------------------------------ 26031# $File: vacuum-cleaner,v 1.1 2015/11/14 13:38:35 christos Exp $ 26032# vacuum cleaner magic by Thomas M. Ott (ThMO) 26033# 26034# navigation map for LG robot vacuum cleaner models VR62xx, VR64xx, VR63xx 26035# file: MAPDATAyyyymmddhhmmss_xxxxxx_cc.blk 26036# -> yyyymmdd: year, month, day of cleaning 26037# -> hhmmss: hour, minute, second of cleaning 26038# -> xxxxxx: 6 digits 26039# -> cc: cleaning runs counter 26040# size: 136044 bytes 26041# 26042# struct maphdr { 26043# int32_t map_cnt; /* 0: single map */ 26044# int32_t min_ceil; /* 4: 100 mm == 10 cm == min. ceil */ 26045# int32_t max_ceil; /* 8: 10000 mm == 100 m == max. ceil */ 26046# int32_t max_climb; /* 12: 50 mm = 5 cm == max. height to climb */ 26047# int32_t unknown; /* 16: 50000 ??? */ 26048# int32_t cell_bytes; /* 20: # of bytes for cells per block */ 26049# int32_t block_max; /* 24: 1000 == max. # of blocks */ 26050# int32_t route_max; /* 28: 1000 == max. # of routes */ 26051# int32_t used_blocks; /* 32: 5/45/33/... == # of block entries used! */ 26052# int32_t cell_dim; /* 36: 10 == cell dimension */ 26053# int32_t clock_tick; /* 40: 100 == clock ticks */ 26054# #if 0 26055# struct { /* 44: 1000 blocks for 10x10 cells */ 26056# int32_t yoffset; 26057# int32_t xoffset; 26058# int32_t posxy; 26059# int32_t timecode; 26060# } blocks[ 1000]; 26061# char cells[ 1000* 100]; /* 16044: 1000 10x10 cells */ 26062# int16_t routes[ 1000* 10]; /* 116044: 1000 10-routes */ 26063# #endif 26064# }; 26065 260660 lelong =1 26067>4 lelong =100 26068>>8 lelong =10000 26069>>>12 lelong =50 26070>>>>16 lelong =50000 26071>>>>>20 lelong =100 26072>>>>>>24 lelong =1000 26073>>>>>>>28 lelong =1000 26074>>>>>>>>36 lelong =10 26075>>>>>>>>>40 lelong =100 26076>>>>>>>>>>32 lelong x LG robot VR6[234]xx %dm^2 navigation 26077>>>>>>>>>>136040 lelong =-1 reuse map data 26078>>>>>>>>>>136040 lelong =0 map data 26079>>>>>>>>>>136040 lelong >0 spurious map data 26080>>>>>>>>>>136040 lelong <-1 spurious map data 26081 26082 26083 26084#------------------------------------------------------------------------------ 26085# $File: varied.out,v 1.23 2014/04/30 21:41:02 christos Exp $ 26086# varied.out: file(1) magic for various USG systems 26087# 26088# Herewith many of the object file formats used by USG systems. 26089# Most have been moved to files for a particular processor, 26090# and deleted if they duplicate other entries. 26091# 260920 short 0610 Perkin-Elmer executable 26093# AMD 29K 260940 beshort 0572 amd 29k coff noprebar executable 260950 beshort 01572 amd 29k coff prebar executable 260960 beshort 0160007 amd 29k coff archive 26097# Cray 260986 beshort 0407 unicos (cray) executable 26099# Ultrix 4.3 26100596 string \130\337\377\377 Ultrix core file 26101>600 string >\0 from '%s' 26102# BeOS and MAcOS PEF executables 26103# From: hplus@zilker.net (Jon Watte) 261040 string Joy!peffpwpc header for PowerPC PEF executable 26105# 26106# ava assembler/linker Uros Platise <uros.platise@ijs.si> 261070 string avaobj AVR assembler object code 26108>7 string >\0 version '%s' 26109# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr> 261100 string gmon GNU prof performance data 26111>4 long x - version %d 26112# From: Dave Pearson <davep@davep.org> 26113# Harbour <URL:http://harbour-project.org/> HRB files. 261140 string \xc0HRB Harbour HRB file 26115>4 leshort x version %d 26116# Harbour HBV files 261170 string \xc0HBV Harbour variable dump file 26118>4 leshort x version %d 26119 26120# From: Alex Beregszaszi <alex@fsn.hu> 26121# 0 string exec BugOS executable 26122# 0 string pack BugOS archive 26123 26124# From: Jason Spence <jspence@lightconsulting.com> 26125# Generated by the "examples" in STM's ST40 devkit, and derived code. 261260 lelong 0x13a9f17e ST40 component image format 26127>4 string >\0 \b, name '%s' 26128 26129#------------------------------------------------------------------------------ 26130# $File: varied.script,v 1.11 2015/03/27 17:59:39 christos Exp $ 26131# varied.script: file(1) magic for various interpreter scripts 26132 261330 string/t #!\ / a 26134>3 string >\0 %s script text executable 26135 261360 string/b #!\ / a 26137>3 string >\0 %s script executable (binary data) 26138 261390 string/t #!\t/ a 26140>3 string >\0 %s script text executable 26141 261420 string/b #!\t/ a 26143>3 string >\0 %s script executable (binary data) 26144 261450 string/t #!/ a 26146>2 string >\0 %s script text executable 26147 261480 string/b #!/ a 26149>2 string >\0 %s script executable (binary data) 26150 261510 string/t #!\ script text executable 26152>3 string >\0 for %s 26153 261540 string/b #!\ script executable 26155>3 string >\0 for %s (binary data) 26156 26157# using env 261580 string/t #!/usr/bin/env a 26159>15 string/t >\0 %s script text executable 26160!:strength / 10 26161 261620 string/b #!/usr/bin/env a 26163>15 string/b >\0 %s script executable (binary data) 26164!:strength / 10 26165 261660 string/t #!\ /usr/bin/env a 26167>16 string/t >\0 %s script text executable 26168!:strength / 10 26169 261700 string/b #!\ /usr/bin/env a 26171>16 string/b >\0 %s script executable (binary data) 26172!:strength / 10 26173 26174# From: arno <arenevier@fdn.fr> 26175# mozilla xpconnect typelib 26176# see http://www.mozilla.org/scriptable/typelib_file.html 261770 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib 26178>0x10 byte x version %d 26179>>0x11 byte x \b.%d 26180 26181#------------------------------------------------------------------------------ 26182# $File: vax,v 1.9 2014/04/30 21:41:02 christos Exp $ 26183# vax: file(1) magic for VAX executable/object and APL workspace 26184# 261850 lelong 0101557 VAX single precision APL workspace 261860 lelong 0101556 VAX double precision APL workspace 26187 26188# 26189# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian 26190# executables, and are handled in aout) 26191# 261920 lelong 0420 a.out VAX demand paged (first page unmapped) pure executable 26193>16 lelong >0 not stripped 26194 26195# 26196# VAX COFF 26197# 26198# The `versions' were commented out, but have been un-commented out. 26199# (Was the problem just one of endianness?) 26200# 262010 leshort 0570 VAX COFF executable 26202>12 lelong >0 not stripped 26203>22 leshort >0 - version %d 262040 leshort 0575 VAX COFF pure executable 26205>12 lelong >0 not stripped 26206>22 leshort >0 - version %d 26207 26208#------------------------------------------------------------------------------ 26209# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $ 26210# vicar: file(1) magic for VICAR files. 26211# 26212# From: Ossama Othman <othman@astrosun.tn.cornell.edu 26213# VICAR is JPL's in-house spacecraft image processing program 26214# VICAR image 262150 string LBLSIZE= VICAR image data 26216>32 string BYTE \b, 8 bits = VAX byte 26217>32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2 26218>32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4 26219>32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4 26220>32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8 26221>32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8 26222# VICAR label file 2622343 string SFDU_LABEL VICAR label file 26224 26225#------------------------------------------------------------------------------ 26226# $File: virtual,v 1.6 2014/05/07 21:25:41 christos Exp $ 26227# From: James Nobis <quel@quelrod.net> 26228# Microsoft hard disk images for: 26229# Virtual Server 26230# Virtual PC 26231# http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx 26232# .vhd 262330 string conectix Microsoft Disk Image, Virtual Server or Virtual PC 26234 26235# libvirt 26236# From: Philipp Hahn <hahn@univention.de> 262370 string LibvirtQemudSave Libvirt QEMU Suspend Image 26238>0x10 lelong x \b, version %u 26239>0x14 lelong x \b, XML length %u 26240>0x18 lelong 1 \b, running 26241>0x1c lelong 1 \b, compressed 26242 262430 string LibvirtQemudPart Libvirt QEMU partial Suspend Image 26244# From: Alex Beregszaszi <alex@fsn.hu> 262450 string/b COWD VMWare3 26246>4 byte 3 disk image 26247>>32 lelong x (%d/ 26248>>36 lelong x \b%d/ 26249>>40 lelong x \b%d) 26250>4 byte 2 undoable disk image 26251>>32 string >\0 (%s) 26252 262530 string/b VMDK VMware4 disk image 262540 string/b KDMV VMware4 disk image 26255 26256#-------------------------------------------------------------------- 26257# Qemu Emulator Images 26258# Lines written by Friedrich Schwittay (f.schwittay@yousable.de) 26259# Updated by Adam Buchbinder (adam.buchbinder@gmail.com) 26260# Made by reading sources, reading documentation, and doing trial and error 26261# on existing QCOW files 262620 string/b QFI\xFB QEMU QCOW Image 26263 26264# Uncomment the following line to display Magic (only used for debugging 26265# this magic number) 26266#>0 string/b x , Magic: %s 26267 26268# There are currently 2 Versions: "1" and "2". 26269# http://www.gnome.org/~markmc/qcow-image-format-version-1.html 26270>4 belong 1 (v1) 26271 26272# Using the existence of the Backing File Offset to determine whether 26273# to read Backing File Information 26274>>12 belong >0 \b, has backing file ( 26275# Note that this isn't a null-terminated string; the length is actually 26276# (16.L). Assuming a null-terminated string happens to work usually, but it 26277# may spew junk until it reaches a \0 in some cases. 26278>>>(12.L) string >\0 \bpath %s 26279 26280# Modification time of the Backing File 26281# Really useful if you want to know if your backing 26282# file is still usable together with this image 26283>>>>20 bedate >0 \b, mtime %s) 26284>>>>20 default x \b) 26285 26286# Size is stored in bytes in a big-endian u64. 26287>>24 bequad x \b, %lld bytes 26288 26289# 1 for AES encryption, 0 for none. 26290>>36 belong 1 \b, AES-encrypted 26291 26292# http://www.gnome.org/~markmc/qcow-image-format.html 26293>4 belong 2 (v2) 26294# Using the existence of the Backing File Offset to determine whether 26295# to read Backing File Information 26296>>8 bequad >0 \b, has backing file 26297# Note that this isn't a null-terminated string; the length is actually 26298# (16.L). Assuming a null-terminated string happens to work usually, but it 26299# may spew junk until it reaches a \0 in some cases. Also, since there's no 26300# .Q modifier, we just use the bottom four bytes as an offset. Note that if 26301# the file is over 4G, and the backing file path is stored after the first 4G, 26302# the wrong filename will be printed. (This should be (8.Q), when that syntax 26303# is introduced.) 26304>>>(12.L) string >\0 (path %s) 26305>>24 bequad x \b, %lld bytes 26306>>32 belong 1 \b, AES-encrypted 26307 26308>4 belong 3 (v3) 26309# Using the existence of the Backing File Offset to determine whether 26310# to read Backing File Information 26311>>8 bequad >0 \b, has backing file 26312# Note that this isn't a null-terminated string; the length is actually 26313# (16.L). Assuming a null-terminated string happens to work usually, but it 26314# may spew junk until it reaches a \0 in some cases. Also, since there's no 26315# .Q modifier, we just use the bottom four bytes as an offset. Note that if 26316# the file is over 4G, and the backing file path is stored after the first 4G, 26317# the wrong filename will be printed. (This should be (8.Q), when that syntax 26318# is introduced.) 26319>>>(12.L) string >\0 (path %s) 26320>>24 bequad x \b, %lld bytes 26321>>32 belong 1 \b, AES-encrypted 26322 26323>4 default x (unknown version) 26324 263250 string/b QEVM QEMU suspend to disk image 26326 26327# QEMU QED Image 26328# http://wiki.qemu.org/Features/QED/Specification 263290 string/b QED\0 QEMU QED Image 26330 26331# VDI Image 26332# Sun xVM VirtualBox Disk Image 26333# From: Richard W.M. Jones <rich@annexia.org> 26334# VirtualBox Disk Image 263350x40 ulelong 0xbeda107f VirtualBox Disk Image 26336>0x44 uleshort >0 \b, major %u 26337>0x46 uleshort >0 \b, minor %u 26338>0 string >\0 (%s) 26339>368 lequad x \b, %lld bytes 26340 263410 string/b Bochs\ Virtual\ HD\ Image Bochs disk image, 26342>32 string x type %s, 26343>48 string x subtype %s 26344 263450 lelong 0x02468ace Bochs Sparse disk image 26346 26347 26348#------------------------------------------------------------------------------ 26349# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $ 26350# Virtutech Compressed Random Access File Format 26351# 26352# From <gustav@virtutech.com> 263530 string \211\277\036\203 Virtutech CRAFF 26354>4 belong x v%d 26355>20 belong 0 uncompressed 26356>20 belong 1 bzipp2ed 26357>20 belong 2 gzipped 26358>24 belong 0 not clean 26359 26360#------------------------------------------------------------------------------ 26361# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $ 26362# visx: file(1) magic for Visx format files 26363# 263640 short 0x5555 VISX image file 26365>2 byte 0 (zero) 26366>2 byte 1 (unsigned char) 26367>2 byte 2 (short integer) 26368>2 byte 3 (float 32) 26369>2 byte 4 (float 64) 26370>2 byte 5 (signed char) 26371>2 byte 6 (bit-plane) 26372>2 byte 7 (classes) 26373>2 byte 8 (statistics) 26374>2 byte 10 (ascii text) 26375>2 byte 15 (image segments) 26376>2 byte 100 (image set) 26377>2 byte 101 (unsigned char vector) 26378>2 byte 102 (short integer vector) 26379>2 byte 103 (float 32 vector) 26380>2 byte 104 (float 64 vector) 26381>2 byte 105 (signed char vector) 26382>2 byte 106 (bit plane vector) 26383>2 byte 121 (feature vector) 26384>2 byte 122 (feature vector library) 26385>2 byte 124 (chain code) 26386>2 byte 126 (bit vector) 26387>2 byte 130 (graph) 26388>2 byte 131 (adjacency graph) 26389>2 byte 132 (adjacency graph library) 26390>2 string .VISIX (ascii text) 26391 26392#------------------------------------------------------------------------------ 26393# $File: vms,v 1.10 2017/03/17 21:35:28 christos Exp $ 26394# vms: file(1) magic for VMS executables (experimental) 26395# 26396# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu) 26397 26398# GRR 950122: I'm just guessing on these, based on inspection of the headers 26399# of three executables each for Alpha and VAX architectures. The VAX files 26400# all had headers similar to this: 26401# 26402# 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205 26403# 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................ 26404# 264050 string \xb0\0\x30\0 VMS VAX executable 26406>44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 26407# 26408# The AXP files all looked like this, except that the byte at offset 0x22 26409# was 06 in some of them and 07 in others: 26410# 26411# 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................ 26412# 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h............... 26413# 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 26414# 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ 26415# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................ 26416# 26417# GRR this test is still too general as it catches example adressen.dbt 264180 belong 0x03000000 26419>8 ubelong 0xec020000 VMS Alpha executable 26420>>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 26421 26422#------------------------------------------------------------------------------ 26423# $File: vmware,v 1.8 2017/03/17 21:35:28 christos Exp $ 26424# VMware specific files (deducted from version 1.1 and log file entries) 26425# Anthon van der Neut (anthon@mnt.org) 264260 belong 0x4d52564e VMware nvram 26427 26428#------------------------------------------------------------------------------ 26429# $File: vorbis,v 1.24 2018/03/14 04:38:44 christos Exp $ 26430# vorbis: file(1) magic for Ogg/Vorbis files 26431# 26432# From Felix von Leitner <leitner@fefe.de> 26433# Extended by Beni Cherniavsky <cben@crosswinds.net> 26434# Further extended by Greg Wooledge <greg@wooledge.org> 26435# 26436# Most (everything but the number of channels and bitrate) is commented 26437# out with `##' as it's not interesting to the average user. The most 26438# probable things advanced users would want to uncomment are probably 26439# the number of comments and the encoder version. 26440# 26441# FIXME: The first match has been made a search, so that it can skip 26442# over prepended ID3 tags. This will work for MIME type detection, but 26443# won't work for detecting other properties of the file (they all need 26444# to be made relative to the search). In any case, if the file has ID3 26445# tags, the ID3 information will be printed, not the Ogg information, 26446# so until that's fixed, this doesn't matter. 26447# FIXME[2]: Disable the above for now, since search assumes text mode. 26448# 26449# --- Ogg Framing --- 26450#0 search/1000 OggS Ogg data 264510 string OggS Ogg data 26452>4 byte !0 UNKNOWN REVISION %u 26453##>4 byte 0 revision 0 26454>4 byte 0 26455##>>14 lelong x (Serial %lX) 26456# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net) 26457>>28 string \x7fFLAC \b, FLAC audio 26458# non-Vorbis content: Theora 26459!:mime audio/ogg 26460>>28 string \x80theora \b, Theora video 26461!:mime video/ogg 26462# non-Vorbis content: Kate 26463>>28 string \x80kate\0\0\0\0 \b, Kate (Karaoke and Text) 26464!:mime application/ogg 26465>>>37 ubyte x v%u 26466>>>38 ubyte x \b.%u, 26467>>>40 byte 0 utf8 encoding, 26468>>>40 byte !0 unknown character encoding, 26469>>>60 string >\0 language %s, 26470>>>60 string \0 no language set, 26471>>>76 string >\0 category %s 26472>>>76 string \0 no category set 26473# non-Vorbis content: Skeleton 26474>>28 string fishead\0 \b, Skeleton 26475!:mime video/ogg 26476>>>36 leshort x v%u 26477>>>40 leshort x \b.%u 26478# non-Vorbis content: Speex 26479>>28 string Speex\ \ \ \b, Speex audio 26480!:mime audio/ogg 26481# non-Vorbis content: OGM 26482>>28 string \x01video\0\0\0 \b, OGM video 26483!:mime video/ogg 26484>>>37 string/c div3 (DivX 3) 26485>>>37 string/c divx (DivX 4) 26486>>>37 string/c dx50 (DivX 5) 26487>>>37 string/c xvid (XviD) 26488# --- First vorbis packet - general header --- 26489>>28 string \x01vorbis \b, Vorbis audio, 26490!:mime audio/ogg 26491>>>35 lelong !0 UNKNOWN VERSION %u, 26492##>>>35 lelong 0 version 0, 26493>>>35 lelong 0 26494>>>>39 ubyte 1 mono, 26495>>>>39 ubyte 2 stereo, 26496>>>>39 ubyte >2 %u channels, 26497>>>>40 lelong x %u Hz 26498# Minimal, nominal and maximal bitrates specified when encoding 26499>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b, 26500# The above tests if at least one of these is specified: 26501>>>>>52 lelong !-1 26502# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields 26503# instead of -1. 26504# Vorbis 1.0 uses 0 instead of -1. 26505>>>>>>52 lelong !0 26506>>>>>>>52 lelong !-1000 26507>>>>>>>>52 lelong x <%u 26508>>>>>48 lelong !-1 26509>>>>>>48 lelong x ~%u 26510>>>>>44 lelong !-1 26511>>>>>>44 lelong !-1000 26512>>>>>>>44 lelong !0 26513>>>>>>>>44 lelong x >%u 26514>>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps 26515# -- Second vorbis header packet - the comments 26516# A kludge to read the vendor string. It's a counted string, not a 26517# zero-terminated one, so file(1) can't read it in a generic way. 26518# libVorbis is the only one existing currently, so I detect specifically 26519# it. The interesting value is the cvs date (8 digits decimal). 26520# Post-RC1 Ogg files have the second header packet (and thus the version) 26521# in a different place, so we must use an indirect offset. 26522>>>(84.b+85) string \x03vorbis 26523>>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I 26524>>>>>(84.b+120) string >00000000 26525# Map to beta version numbers: 26526>>>>>>(84.b+120) string <20000508 (<beta1, prepublic) 26527>>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2) 26528>>>>>>(84.b+120) string >20000508 26529>>>>>>>(84.b+120) string <20001031 (beta2-3) 26530>>>>>>(84.b+120) string 20001031 (1.0 beta 3) 26531>>>>>>(84.b+120) string >20001031 26532>>>>>>>(84.b+120) string <20010225 (beta3-4) 26533>>>>>>(84.b+120) string 20010225 (1.0 beta 4) 26534>>>>>>(84.b+120) string >20010225 26535>>>>>>>(84.b+120) string <20010615 (beta4-RC1) 26536>>>>>>(84.b+120) string 20010615 (1.0 RC1) 26537>>>>>>(84.b+120) string 20010813 (1.0 RC2) 26538>>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1) 26539>>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2) 26540>>>>>>(84.b+120) string 20011217 (1.0 RC3) 26541>>>>>>(84.b+120) string 20011231 (1.0 RC3) 26542# Some pre-1.0 CVS snapshots still had "Xiphphorus"... 26543>>>>>>(84.b+120) string >20011231 (pre-1.0 CVS) 26544# For the 1.0 release, Xiphophorus is replaced by Xiph.Org 26545>>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I 26546>>>>>(84.b+117) string >00000000 26547>>>>>>(84.b+117) string <20020717 (pre-1.0 CVS) 26548>>>>>>(84.b+117) string 20020717 (1.0) 26549>>>>>>(84.b+117) string 20030909 (1.0.1) 26550>>>>>>(84.b+117) string 20040629 (1.1.0 RC1) 26551>>>>>>(84.b+117) string 20050304 (1.1.2) 26552>>>>>>(84.b+117) string 20070622 (1.2.0) 26553>>>>>>(84.b+117) string 20090624 (1.2.2) 26554>>>>>>(84.b+117) string 20090709 (1.2.3) 26555>>>>>>(84.b+117) string 20100325 (1.3.1) 26556>>>>>>(84.b+117) string 20101101 (1.3.2) 26557>>>>>>(84.b+117) string 20120203 (1.3.3) 26558>>>>>>(84.b+117) string 20140122 (1.3.4) 26559>>>>>>(84.b+117) string 20150105 (1.3.5) 26560 26561# non-Vorbis content: Opus https://tools.ietf.org/html/draft-ietf-codec-oggopus-06#section-5 26562>>28 string OpusHead \b, Opus audio, 26563!:mime audio/ogg 26564>>>36 ubyte >0x0F UNKNOWN VERSION %u, 26565>>>36 ubyte &0x0F version 0.%d 26566>>>>46 ubyte >1 26567>>>>>46 ubyte !255 unknown channel mapping family %u, 26568>>>>>37 ubyte x %u channels 26569>>>>46 ubyte 0 26570>>>>>37 ubyte 1 mono 26571>>>>>37 ubyte 2 stereo 26572>>>>46 ubyte 1 26573>>>>>37 ubyte 1 mono 26574>>>>>37 ubyte 2 stereo 26575>>>>>37 ubyte 3 linear surround 26576>>>>>37 ubyte 4 quadraphonic 26577>>>>>37 ubyte 5 5.0 surround 26578>>>>>37 ubyte 6 5.1 surround 26579>>>>>37 ubyte 7 6.1 surround 26580>>>>>37 ubyte 8 7.1 surround 26581>>>>40 lelong !0 \b, %u Hz 26582 26583#------------------------------------------------------------------------------ 26584# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $ 26585# VXL: file(1) magic for VXL binary IO data files 26586# 26587# from Ian Scott <scottim@sf.net> 26588# 26589# VXL is a collection of C++ libraries for Computer Vision. 26590# See the vsl chapter in the VXL Book for more info 26591# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html 26592# http:/vxl.sf.net 26593 265942 lelong 0x472b2c4e VXL data file, 26595>0 leshort >0 schema version no %d 26596 26597#------------------------------------------------------------------------------ 26598# $File: warc,v 1.3 2010/11/25 15:05:43 christos Exp $ 26599# warc: file(1) magic for WARC files 26600 266010 string WARC/ WARC Archive 26602>5 string x version %.4s 26603!:mime application/warc 26604 26605#------------------------------------------------------------------------------ 26606# Arc File Format from Internet Archive 26607# see http://www.archive.org/web/researcher/ArcFileFormat.php 266080 string filedesc:// Internet Archive File 26609!:mime application/x-ia-arc 26610>11 search/256 \x0A \b 26611>>&0 ubyte >0 \b version %c 26612 26613#------------------------------------------------------------------------------ 26614# weak: file(1) magic for very weak magic entries, disabled by default 26615# 26616# These entries are so weak that they might interfere identification of 26617# other formats. Example include: 26618# - Only identify for 1 or 2 bytes 26619# - Match against very wide range of values 26620# - Match against generic word in some spoken languages (e.g. English) 26621 26622# Summary: Computer Graphics Metafile 26623# Extension: .cgm 26624#0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile 26625#0 beshort 0x3020 character Computer Graphics Metafile 26626 26627#0 string =!! Bennet Yee's "face" format 26628#------------------------------------------------------------------------------ 26629# $File: webassembly,v 1.2 2017/05/02 14:05:29 christos Exp $ 26630# webassembly: file(1) magic for WebAssembly modules 26631# 26632# WebAssembly is a virtual architecture developed by a W3C Community 26633# Group at http://webassembly.org/. The file extension is .wasm, and 26634# the MIME type is application/wasm. 26635# 26636# http://webassembly.org/docs/binary-encoding/ is the main 26637# document describing the binary format. 26638# From: Pip Cet <pipcet@gmail.com> and Joel Martin 26639 266400 string \0asm WebAssembly (wasm) binary module 26641>4 lelong =1 version %#x (MVP) 26642>4 lelong >1 version %#x 26643 26644#------------------------------------------------------------------------------ 26645# $File: windows,v 1.22 2018/02/16 15:44:00 christos Exp $ 26646# windows: file(1) magic for Microsoft Windows 26647# 26648# This file is mainly reserved for files where programs 26649# using them are run almost always on MS Windows 3.x or 26650# above, or files only used exclusively in Windows OS, 26651# where there is no better category to allocate for. 26652# For example, even though WinZIP almost run on Windows 26653# only, it is better to treat them as "archive" instead. 26654# For format usable in DOS, such as generic executable 26655# format, please specify under "msdos" file. 26656# 26657 26658 26659# Summary: Outlook Express DBX file 26660# Extension: .dbx 26661# Created by: Christophe Monniez 266620 string \xCF\xAD\x12\xFE MS Outlook Express DBX file 26663>4 byte =0xC5 \b, message database 26664>4 byte =0xC6 \b, folder database 26665>4 byte =0xC7 \b, account information 26666>4 byte =0x30 \b, offline database 26667 26668 26669# Summary: Windows crash dump 26670# Extension: .dmp 26671# Created by: Andreas Schuster (http://computer.forensikblog.de/) 26672# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html 26673# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) 266740 string PAGE 26675>4 string DUMP MS Windows 32bit crash dump 26676>>0x05c byte 0 \b, no PAE 26677>>0x05c byte 1 \b, PAE 26678>>0xf88 lelong 1 \b, full dump 26679>>0xf88 lelong 2 \b, kernel dump 26680>>0xf88 lelong 3 \b, small dump 26681>>0x068 lelong x \b, %d pages 26682>4 string DU64 MS Windows 64bit crash dump 26683>>0xf98 lelong 1 \b, full dump 26684>>0xf98 lelong 2 \b, kernel dump 26685>>0xf98 lelong 3 \b, small dump 26686>>0x090 lequad x \b, %lld pages 26687 26688 26689# Summary: Vista Event Log 26690# Extension: .evtx 26691# Created by: Andreas Schuster (http://computer.forensikblog.de/) 26692# Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html 266930 string ElfFile\0 MS Windows Vista Event Log 26694>0x2a leshort x \b, %d chunks 26695>>0x10 lelong x \b (no. %d in use) 26696>0x18 lelong >1 \b, next record no. %d 26697>0x18 lelong =1 \b, empty 26698>0x78 lelong &1 \b, DIRTY 26699>0x78 lelong &2 \b, FULL 26700 26701 26702# Summary: Windows 3.1 group files 26703# Extension: .grp 26704# Created by: unknown 267050 string \120\115\103\103 MS Windows 3.1 group files 26706 26707 26708# Summary: Old format help files 26709# URL: https://en.wikipedia.org/wiki/WinHelp 26710# Reference: http://www.oocities.org/mwinterhoff/helpfile.htm 26711# Update: Joerg Jenderek 26712# Created by: Dirk Jagdmann <doj@cubic.org> 26713# 26714# check and then display version and date inside MS Windows HeLP file fragment 267150 name help-ver-date 26716# look for Magic of SYSTEMHEADER 26717>0 leshort 0x036C 26718# version Major 1 for right file fragment 26719>>4 leshort 1 Windows 26720# print non empty string above to avoid error message 26721# Warning: Current entry does not yet have a description for adding a MIME type 26722!:mime application/winhelp 26723!:ext hlp 26724# version Minor of help file format is hint for windows version 26725>>>2 leshort 0x0F 3.x 26726>>>2 leshort 0x15 3.0 26727>>>2 leshort 0x21 3.1 26728>>>2 leshort 0x27 x.y 26729>>>2 leshort 0x33 95 26730>>>2 default x y.z 26731>>>>2 leshort x 0x%x 26732# to complete message string like "MS Windows 3.x help file" 26733>>>2 leshort x help 26734# GenDate often older than file creation date 26735>>>6 ldate x \b, %s 26736# 26737# Magic for HeLP files 267380 lelong 0x00035f3f 26739# ./windows (version 5.25) labeled the entry as "MS Windows 3.x help file" 26740# file header magic 0x293B at DirectoryStart+9 26741>(4.l+9) uleshort 0x293B MS 26742# look for @VERSION bmf.. like IBMAVW.ANN 26743>>0xD4 string =\x62\x6D\x66\x01\x00 Windows help annotation 26744!:mime application/x-winhelp 26745!:ext ann 26746>>0xD4 string !\x62\x6D\x66\x01\x00 26747# "GID Help index" by TrID 26748>>>(4.l+0x65) string =|Pete Windows help Global Index 26749!:mime application/x-winhelp 26750!:ext gid 26751# HeLP Bookmark or 26752# "Windows HELP File" by TrID 26753>>>(4.l+0x65) string !|Pete 26754# maybe there exist a cleaner way to detect HeLP fragments 26755# brute search for Magic 0x036C with matching Major maximal 7 iterations 26756# discapp.hlp 26757>>>>16 search/0x49AF/s \x6c\x03 26758>>>>>&0 use help-ver-date 26759>>>>>&4 leshort !1 26760# putty.hlp 26761>>>>>>&0 search/0x69AF/s \x6c\x03 26762>>>>>>>&0 use help-ver-date 26763>>>>>>>&4 leshort !1 26764>>>>>>>>&0 search/0x49AF/s \x6c\x03 26765>>>>>>>>>&0 use help-ver-date 26766>>>>>>>>>&4 leshort !1 26767>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 26768>>>>>>>>>>>&0 use help-ver-date 26769>>>>>>>>>>>&4 leshort !1 26770>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 26771>>>>>>>>>>>>>&0 use help-ver-date 26772>>>>>>>>>>>>>&4 leshort !1 26773>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 26774>>>>>>>>>>>>>>>&0 use help-ver-date 26775>>>>>>>>>>>>>>>&4 leshort !1 26776>>>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 26777# GCC.HLP is detected after 7 iterations 26778>>>>>>>>>>>>>>>>>&0 use help-ver-date 26779# this only happens if bigger hlp file is detected after used search iterations 26780>>>>>>>>>>>>>>>>>&4 leshort !1 Windows y.z help 26781!:mime application/winhelp 26782!:ext hlp 26783# repeat search again or following default line does not work 26784>>>>16 search/0x49AF/s \x6c\x03 26785# remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 8.1 64-bit) 26786>>>>16 default x Windows help Bookmark 26787!:mime application/x-winhelp 26788!:ext bmk 26789## FirstFreeBlock normally FFFFFFFFh 10h for *ANN 26790##>>8 lelong x \b, FirstFreeBlock 0x%8.8x 26791# EntireFileSize 26792>>12 lelong x \b, %d bytes 26793## ReservedSpace normally 042Fh AFh for *.ANN 26794#>>(4.l) lelong x \b, ReservedSpace 0x%8.8x 26795## UsedSpace normally 0426h A6h for *.ANN 26796#>>(4.l+4) lelong x \b, UsedSpace 0x%8.8x 26797## FileFlags normally 04... 26798#>>(4.l+5) lelong x \b, FileFlags 0x%8.8x 26799## file header magic 0x293B 26800#>>(4.l+9) uleshort x \b, file header magic 0x%4.4x 26801## file header Flags 0x0402 26802#>>(4.l+11) uleshort x \b, file header Flags 0x%4.4x 26803## file header PageSize 0400h 80h for *.ANN 26804#>>(4.l+13) uleshort x \b, PageSize 0x%4.4x 26805## Structure[16] z4 26806#>>(4.l+15) string >\0 \b, Structure_"%-.16s" 26807## MustBeZero 0 26808#>>(4.l+31) uleshort x \b, MustBeZero 0x%4.4x 26809## PageSplits 26810#>>(4.l+33) uleshort x \b, PageSplits 0x%4.4x 26811## RootPage 26812#>>(4.l+35) uleshort x \b, RootPage 0x%4.4x 26813## MustBeNegOne 0xffff 26814#>>(4.l+37) uleshort x \b, MustBeNegOne 0x%4.4x 26815## TotalPages 1 26816#>>(4.l+39) uleshort x \b, TotalPages 0x%4.4x 26817## NLevels 0x0001 26818#>>(4.l+41) uleshort x \b, NLevels 0x%4.4x 26819## TotalBtreeEntries 26820#>>(4.l+43) ulelong x \b, TotalBtreeEntries 0x%8.8x 26821## pages of the B+ tree 26822#>>(4.l+47) ubequad x \b, PageStart 0x%16.16llx 26823 26824# start with colon or semicolon for comment line like Back2Life.cnt 268250 regex \^(:|;) 26826# look for first keyword Base 26827>0 search/45 :Base 26828>>&0 use cnt-name 26829# only solution to search again from beginning , because relative offsets changes when use is called 26830>0 search/45 :Base 26831>0 default x 26832# look for other keyword Title like in putty.cnt 26833>>0 search/45 :Title 26834>>>&0 use cnt-name 26835# 26836# display mime type and name of Windows help Content source 268370 name cnt-name 26838# skip space at beginning 26839>0 string \040 26840# name without extension and greater character or name with hlp extension 26841>>1 regex/c \^([^\xd>]*|.*\.hlp) MS Windows help file Content, based "%s" 26842!:mime text/plain 26843!:apple ????TEXT 26844!:ext cnt 26845# 26846# Windows creates an full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing 268470 string tfMR MS Windows help Full Text Search index 26848!:mime application/x-winhelp-fts 26849!:ext fts 26850>16 string >\0 for "%s" 26851 26852# Summary: Hyper terminal 26853# Extension: .ht 26854# Created by: unknown 268550 string HyperTerminal\040 26856>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile 26857 26858# http://ithreats.files.wordpress.com/2009/05/\040 26859# lnk_the_windows_shortcut_file_format.pdf 26860# Summary: Windows shortcut 26861# Extension: .lnk 26862# Created by: unknown 26863# 'L' + GUUID 268640 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut 26865>20 lelong&1 1 \b, Item id list present 26866>20 lelong&2 2 \b, Points to a file or directory 26867>20 lelong&4 4 \b, Has Description string 26868>20 lelong&8 8 \b, Has Relative path 26869>20 lelong&16 16 \b, Has Working directory 26870>20 lelong&32 32 \b, Has command line arguments 26871>20 lelong&64 64 \b, Icon 26872>>56 lelong x \b number=%d 26873>24 lelong&1 1 \b, Read-Only 26874>24 lelong&2 2 \b, Hidden 26875>24 lelong&4 4 \b, System 26876>24 lelong&8 8 \b, Volume Label 26877>24 lelong&16 16 \b, Directory 26878>24 lelong&32 32 \b, Archive 26879>24 lelong&64 64 \b, Encrypted 26880>24 lelong&128 128 \b, Normal 26881>24 lelong&256 256 \b, Temporary 26882>24 lelong&512 512 \b, Sparse 26883>24 lelong&1024 1024 \b, Reparse point 26884>24 lelong&2048 2048 \b, Compressed 26885>24 lelong&4096 4096 \b, Offline 26886>28 leqwdate x \b, ctime=%s 26887>36 leqwdate x \b, mtime=%s 26888>44 leqwdate x \b, atime=%s 26889>52 lelong x \b, length=%u, window= 26890>60 lelong&1 1 \bhide 26891>60 lelong&2 2 \bnormal 26892>60 lelong&4 4 \bshowminimized 26893>60 lelong&8 8 \bshowmaximized 26894>60 lelong&16 16 \bshownoactivate 26895>60 lelong&32 32 \bminimize 26896>60 lelong&64 64 \bshowminnoactive 26897>60 lelong&128 128 \bshowna 26898>60 lelong&256 256 \brestore 26899>60 lelong&512 512 \bshowdefault 26900#>20 lelong&1 0 26901#>>20 lelong&2 2 26902#>>>(72.l-64) pstring/h x \b [%s] 26903#>20 lelong&1 1 26904#>>20 lelong&2 2 26905#>>>(72.s) leshort x 26906#>>>&75 pstring/h x \b [%s] 26907 26908# Summary: Outlook Personal Folders 26909# Created by: unknown 269100 lelong 0x4E444221 Microsoft Outlook email folder 26911>10 leshort 0x0e (<=2002) 26912>10 leshort 0x17 (>=2003) 26913 26914 26915# Summary: Windows help cache 26916# Created by: unknown 269170 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache 26918 26919 26920# Summary: IE cache file 26921# Created by: Christophe Monniez 269220 string Client\ UrlCache\ MMF Internet Explorer cache file 26923>20 string >\0 version %s 26924 26925 26926# Summary: Registry files 26927# Created by: unknown 26928# Modified by (1): Joerg Jenderek 269290 string regf MS Windows registry file, NT/2000 or above 269300 string CREG MS Windows 95/98/ME registry file 269310 string SHCC3 MS Windows 3.1 registry file 26932 26933 26934# Summary: Windows Registry text 26935# URL: https://en.wikipedia.org/wiki/Windows_Registry#.REG_files 26936# Reference: http://fileformats.archiveteam.org/wiki/Windows_Registry 26937# Submitted by: Abel Cheung <abelcheung@gmail.com> 26938# Update: Joerg Jenderek 26939# Windows 3-9X variant 269400 string REGEDIT 26941# skip ASCII text like "REGEDITor.txt" but match 26942# L1WMAP.REG with only 1 CRNL or org.gnome.gnumeric.reg with 2 NL 26943>7 search/3 \n Windows Registry text 26944!:mime text/x-ms-regedit 26945!:ext reg 26946# Windows 9X variant 26947>>0 string REGEDIT4 (Win95 or above) 26948# Windows 2K ANSI variant 269490 string Windows\ Registry\ Editor\ 26950>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above) 26951!:mime text/x-ms-regedit 26952!:ext reg 26953# Windows 2K UTF-16 variant 269542 lestring16 Windows\ Registry\ Editor\ 26955>0x32 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above) 26956# relative offset not working 26957#>&0 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above) 26958!:mime text/x-ms-regedit 26959!:ext reg 26960# WINE variant 26961# URL: https://en.wikipedia.org/wiki/Wine_(software) 26962# Reference: https://www.winehq.org/pipermail/wine-cvs/2005-October/018763.html 26963# Note: WINE use text based registry (system.reg,user.reg,userdef.reg) 26964# instead binary hiv structure like Windows 269650 string WINE\ REGISTRY\ Version\ WINE registry text 26966# version 2 26967>&0 string x \b, version %s 26968!:mime text/x-wine-extension-reg 26969!:ext reg 26970 26971# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013, Feb 2018 26972# empty ,comment , section 26973# PR/383: remove unicode BOM because it is not portable across regex impls 26974#0 regex/s \\`(\\r\\n|;|[[]) 26975# empty line CRLF 269760 ubeshort 0x0D0A 26977>0 use ini-file 26978# comment line 269790 string ; 26980>0 use ini-file 26981# section line 269820 string [ 26983>0 use ini-file 26984# check and then display Windows INItialization configuration 269850 name ini-file 26986# look for left bracket in section line 26987>0 search/8192 [ 26988# http://en.wikipedia.org/wiki/Autorun.inf 26989# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx 26990# space after right bracket 26991# or AutoRun.Amd64 for 64 bit systems 26992# or only NL separator 26993>>&0 regex/c \^(autorun) 26994# but sometimes total commander directory tree file "treeinfo.wc" with lines like 26995# [AUTORUN] 26996# [boot] 26997>>>&0 string =]\r\n[ Total commander directory treeinfo.wc 26998!:mime text/plain 26999!:ext wc 27000# From: Pal Tamas <folti@balabit.hu> 27001# Autorun File 27002>>>&0 string !]\r\n[ Microsoft Windows Autorun file 27003!:mime application/x-setupscript 27004!:ext inf 27005# http://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx 27006# version strings ASCII coded case-independent for Windows setup information script file 27007>>&0 regex/c \^(version|strings)] Windows setup INFormation 27008!:mime application/x-setupscript 27009#!:mime application/x-wine-extension-inf 27010!:ext inf 27011# NETCRC.INF OEMCPL.INF 27012>>&0 regex/c \^(WinsockCRCList|OEMCPL)] Windows setup INFormation 27013!:mime application/x-setupscript 27014!:ext inf 27015# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm 27016# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx 27017# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent 27018>>&0 regex/c \^(\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] Windows desktop.ini 27019!:mime application/x-wine-extension-ini 27020#!:mime text/plain 27021# http://support.microsoft.com/kb/84709/ 27022>>&0 regex/c \^(don't\ load)] Windows CONTROL.INI 27023!:mime application/x-wine-extension-ini 27024!:ext ini 27025>>&0 regex/c \^(ndishlp\\$|protman\\$|NETBEUI\\$)] Windows PROTOCOL.INI 27026!:mime application/x-wine-extension-ini 27027!:ext ini 27028# http://technet.microsoft.com/en-us/library/cc722567.aspx 27029# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm 27030>>&0 regex/c \^(windows|Compatibility|embedding)] Windows WIN.INI 27031!:mime application/x-wine-extension-ini 27032!:ext ini 27033# http://en.wikipedia.org/wiki/SYSTEM.INI 27034>>&0 regex/c \^(boot|386enh|drivers)] Windows SYSTEM.INI 27035!:mime application/x-wine-extension-ini 27036!:ext ini 27037# http://www.mdgx.com/newtip6.htm 27038>>&0 regex/c \^(SafeList)] Windows IOS.INI 27039!:mime application/x-wine-extension-ini 27040!:ext ini 27041# http://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information 27042>>&0 regex/c \^(boot\x20loader)] Windows boot.ini 27043!:mime application/x-wine-extension-ini 27044!:ext ini 27045# http://en.wikipedia.org/wiki/CONFIG.SYS 27046>>&0 regex/c \^(menu)] MS-DOS CONFIG.SYS 27047# @CONFIG.UI configuration file of previous DOS version saved by Caldera OPENDOS INSTALL.EXE 27048# CONFIG.PSS saved version of file CONFIG.SYS created by %WINDIR%\SYTEM\MSCONFIG.EXE 27049# CONFIG.TSH renamed file CONFIG.SYS.BAT by %WINDIR%\SYTEM\MSCONFIG.EXE 27050# dos and w40 used in dual booting scene 27051!:ext sys/dos/w40 27052# http://support.microsoft.com/kb/118579/ 27053>>&0 regex/c \^(Paths)]\r\n MS-DOS MSDOS.SYS 27054!:ext sys/dos 27055# http://chmspec.nongnu.org/latest/INI.html#HHP 27056>>&0 regex/c \^(options)]\r\n Microsoft HTML Help Project 27057!:mime text/plain 27058!:ext hhp 27059# unknown keyword after opening bracket 27060>>&0 default x 27061#>>>&0 string/c x UNKNOWN [%s 27062# look for left bracket of second section 27063>>>&0 search/8192 [ 27064# version Strings FileIdentification 27065>>>>&0 string/c version Windows setup INFormation 27066!:mime application/x-setupscript 27067!:ext inf 27068# http://en.wikipedia.org/wiki/Initialization_file Windows Initialization File or other 27069>>>>&0 default x 27070>>>>>&0 ubyte x 27071# characters, digits, underscore and white space followed by right bracket 27072# terminated by CR implies section line to skip BOOTLOG.TXT DETLOG.TXT 27073>>>>>>&-1 regex \^([A-Za-z0-9_\(\)\ ]+)\]\r Generic INItialization configuration [%-.40s 27074# NETDEF.INF multiarc.ini 27075#!:mime application/x-setupscript 27076!:mime application/x-wine-extension-ini 27077#!:mime text/plain 27078!:ext ini/inf 27079# UTF-16 BOM followed by CR~0D00 , comment~semicolon~3B00 , section~bracket~5B00 270800 ubelong&0xFFff89FF =0xFFFE0900 27081# look for left bracket in section line 27082>2 search/8192 [ 27083# keyword without 1st letter which is maybe up-/down-case 27084>>&3 lestring16 ersion] Windows setup INFormation 27085!:mime application/x-setupscript 27086!:ext inf 27087>>&3 lestring16 trings] Windows setup INFormation 27088!:mime application/x-setupscript 27089!:ext inf 27090>>&3 lestring16 ourceDisksNames] Windows setup INFormation 27091!:mime application/x-setupscript 27092!:ext inf 27093# netnwcli.inf start with ;---[ NetNWCli.INX ] 27094>>&3 default x 27095# look for NL followed by left bracket 27096>>>&0 search/8192 \x0A\x00\x5b 27097>>>>&3 lestring16 ersion] Windows setup INFormation 27098!:mime application/x-setupscript 27099!:ext inf 27100 27101# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h 27102# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm 27103# GRR: line below too general as it catches also PDP-11 UNIX/RT ldp 271040 leshort&0xFeFe 0x0000 27105!:strength -5 27106# test for unused null bits in PNF_FLAGs 27107>4 ulelong&0xFCffFe00 0x00000000 27108# only found 58h for Offset of WinDirPath immediately after _PNF_HEADER structure 27109>>68 ulelong >0x57 27110# test for zero high byte of InfValueBlockSize, followed by WinDirPath like 27111# C:\WINDOWS (ASCII 0x433a5c.. , unicode 0x43003a005c..) or X:\MININT 27112>>>(68.l-1) ubelong&0xffE0C519 =0x00400018 Windows Precompiled iNF 27113!:mime application/x-pnf 27114# currently only found Major Version=1 and Minor Version=1 27115#>>>>0 uleshort =0x0101 27116#>>>>>1 ubyte x \b, version %u 27117#>>>>>0 ubyte x \b.%u 27118>>>>0 uleshort !0x0101 27119>>>>>1 ubyte x \b, version %u 27120>>>>>0 ubyte x \b.%u 27121# 1 ,2 (windows 98 SE) 27122#>>>>2 uleshort =2 \b, InfStyle %u 27123>>>>2 uleshort !2 \b, InfStyle %u 27124# PNF_FLAG_IS_UNICODE 0x00000001 27125# PNF_FLAG_HAS_STRINGS 0x00000002 27126# PNF_FLAG_SRCPATH_IS_URL 0x00000004 27127# PNF_FLAG_HAS_VOLATILE_DIRIDS 0x00000008 27128# PNF_FLAG_INF_VERIFIED 0x00000010 27129# PNF_FLAG_INF_DIGITALLY_SIGNED 0x00000020 27130# ?? 0x00000100 27131# ?? 0x01000000 27132# ?? 0x02000000 27133>>>>4 ulelong&0x00000001 0x00000001 \b, unicoded 27134>>>>4 ulelong&0x00000020 0x00000020 \b, digitally signed 27135#>>>>8 ulelong x \b, InfSubstValueListOffset 0x%x 27136# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF 27137#>>>>12 uleshort x \b, InfSubstValueCount 0x%x 27138# only < 9 found 27139#>>>>14 uleshort x \b, InfVersionDatumCount 0x%x 27140# only found values lower 0x0000ffff 27141#>>>>16 ulelong x \b, InfVersionDataSize 0x%x 27142# only found positive values lower 0x00ffFFff for InfVersionDataOffset 27143>>>>20 ulelong x \b, at 0x%x 27144>>>>4 ulelong&0x00000001 =0x00000001 27145# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature 27146>>>>>(20.l) lestring16 x "%s" 27147>>>>4 ulelong&0x00000001 !0x00000001 27148>>>>>(20.l) string x "%s" 27149# FILETIME is number of 100-nanosecond intervals since 1 January 1601 27150#>>>>24 ulequad x \b, InfVersionLastWriteTime %16.16llx 27151# only found values lower 0x00ffFFff 27152#>>>>32 ulelong x \b, StringTableBlockOffset 0x%x 27153#>>>>36 ulelong x \b, StringTableBlockSize 0x%x 27154#>>>>40 ulelong x \b, InfSectionCount 0x%x 27155#>>>>44 ulelong x \b, InfSectionBlockOffset 0x%x 27156#>>>>48 ulelong x \b, InfSectionBlockSize 0x%x 27157#>>>>52 ulelong x \b, InfLineBlockOffset 0x%x 27158#>>>>56 ulelong x \b, InfLineBlockSize 0x%x 27159#>>>>60 ulelong x \b, InfValueBlockOffset 0x%x 27160#>>>>64 ulelong x \b, InfValueBlockSize 0x%x 27161# WinDirPathOffset 27162#>>>>68 ulelong x \b, at 0x%x 27163>>>>68 ulelong >0x57 27164>>>>>4 ulelong&0x00000001 =0x00000001 27165>>>>>>(68.l) ubequad =0x43003a005c005700 27166# normally unicoded C:\Windows 27167#>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 27168>>>>>>(68.l) ubequad !0x43003a005c005700 27169>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 27170>>>>>4 ulelong&0x00000001 !0x00000001 27171# normally ASCII C:\WINDOWS 27172#>>>>>>(68.l) string =C:\\WINDOWS \b, WinDirPath "%s" 27173>>>>>>(68.l) string !C:\\WINDOWS \b, WinDirPath "%s" 27174# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF 27175#>>>>72 ulelong >0 \b, at 0x%x 27176>>>>72 ulelong >0 \b, 27177>>>>>4 ulelong&0x00000001 =0x00000001 27178>>>>>>(72.l) lestring16 x OsLoaderPath "%s" 27179>>>>>4 ulelong&0x00000001 !0x00000001 27180# seldom C:\ instead empty 27181>>>>>>(72.l) string x OsLoaderPath "%s" 27182# 1fdh 27183#>>>>76 uleshort x \b, StringTableHashBucketCount 0x%x 27184>>>>78 uleshort !0x407 \b, LanguageId %x 27185# only 407h found 27186#>>>>78 uleshort =0x407 \b, LanguageId %x 27187# InfSourcePathOffset often 0 27188#>>>>80 ulelong >0 \b, at 0x%x 27189>>>>80 ulelong >0 \b, 27190>>>>>4 ulelong&0x00000001 =0x00000001 27191>>>>>>(80.l) lestring16 x SourcePath "%s" 27192>>>>>4 ulelong&0x00000001 !0x00000001 27193>>>>>>(80.l) string >\0 SourcePath "%s" 27194# OriginalInfNameOffset often 0 27195#>>>>84 ulelong >0 \b, at 0x%x 27196>>>>84 ulelong >0 \b, 27197>>>>>4 ulelong&0x00000001 =0x00000001 27198>>>>>>(84.l) lestring16 x InfName "%s" 27199>>>>>4 ulelong&0x00000001 !0x00000001 27200>>>>>>(84.l) string >\0 InfName "%s" 27201 27202# Summary: backup file created with utility like NTBACKUP.EXE shipped with Windows NT/2K/XP/2003 27203# Extension: .bkf 27204# Created by: Joerg Jenderek 27205# URL: http://en.wikipedia.org/wiki/NTBackup 27206# Reference: http://laytongraphics.com/mtf/MTF_100a.PDF 27207# Descriptor BloCK name of Microsoft Tape Format 272080 string TAPE 27209# Format Logical Address is zero 27210>20 ulequad 0 27211# Reserved for MBC is zero 27212>>28 uleshort 0 27213# Control Block ID is zero 27214>>>36 ulelong 0 27215# BIT4-BIT15, BIT18-BIT31 of block attributes are unused 27216>>>>4 ulelong&0xFFfcFFe0 0 Windows NTbackup archive 27217#!:mime application/x-ntbackup 27218!:ext bkf 27219# OS ID 27220>>>>>10 ubyte 1 \b NetWare 27221>>>>>10 ubyte 13 \b NetWare SMS 27222>>>>>10 ubyte 14 \b NT 27223>>>>>10 ubyte 24 \b 3 27224>>>>>10 ubyte 25 \b OS/2 27225>>>>>10 ubyte 26 \b 95 27226>>>>>10 ubyte 27 \b Macintosh 27227>>>>>10 ubyte 28 \b UNIX 27228# OS Version (2) 27229#>>>>>11 ubyte x OS V=%x 27230# MTF_CONTINUATION Media Sequence Number > 1 27231#>>>>>4 ulelong&0x00000001 !0 \b, continued 27232# MTF_COMPRESSION 27233>>>>>4 ulelong&0x00000004 !0 \b, compressed 27234# MTF_EOS_AT_EOM End Of Medium was hit during end of set processing 27235>>>>>4 ulelong&0x00000008 !0 \b, End Of Medium hit 27236>>>>>4 ulelong&0x00020000 0 27237# MTF_SET_MAP_EXISTS A Media Based Catalog Set Map may exist on tape 27238>>>>>>4 ulelong&0x00010000 !0 \b, with catalog 27239# MTF_FDD_ALLOWED However File/Directory Detail can only exist if a Set Map is also present 27240>>>>>4 ulelong&0x00020000 !0 \b, with file catalog 27241# Offset To First Event 238h,240h,28Ch 27242#>>>>>8 uleshort x \b, event offset %4.4x 27243# Displayable Size (20e0230h 20e024ch 20e0224h) 27244#>>>>>8 ulequad x dis. size %16.16llx 27245# Media Family ID (455288C4h 4570BD1Ah 45708F2Fh 4570BBF5h) 27246#>>>>>52 ulelong x family ID %8.8x 27247# TAPE Attributes (3) 27248#>>>>>56 ulelong x TAPE %8.8x 27249# Media Sequence Number 27250>>>>>60 uleshort >1 \b, sequence %u 27251# Password Encryption Algorithm (3) 27252>>>>>62 uleshort >0 \b, 0x%x encrypted 27253# Soft Filemark Block Size * 512 (2) 27254#>>>>>64 uleshort =2 \b, soft size %u*512 27255>>>>>64 uleshort !2 \b, soft size %u*512 27256# Media Based Catalog Type (1,2) 27257#>>>>>66 uleshort x \b, catalog type %4.4x 27258# size of Media Name (66,68,6Eh) 27259>>>>>68 uleshort >0 27260# offset of Media Name (5Eh) 27261>>>>>>70 uleshort >0 27262# 0~, 1~ANSI, 2~UNICODE 27263>>>>>>>48 ubyte 1 27264# size terminated ansi coded string normally followed by "MTF Media Label" 27265>>>>>>>>(70.s) string >\0 \b, name: %s 27266>>>>>>>48 ubyte 2 27267# Not null, but size terminated unicoded string 27268>>>>>>>>(70.s) lestring16 x \b, name: %s 27269# size of Media Label (104h) 27270>>>>>72 uleshort >0 27271# offset of Media Label (C4h,C6h,CCh) 27272>>>>>74 uleshort >0 27273>>>>>>48 ubyte 1 27274#Tag|Version|Vendor|Vendor ID|Creation Time Stamp|Cartridge Label|Side|Media ID|Media Domain ID|Vendor Specific fields 27275>>>>>>>(74.s) string >\0 \b, label: %s 27276>>>>>>48 ubyte 2 27277>>>>>>>(74.s) lestring16 x \b, label: %s 27278# size of password name (0,1Ch) 27279#>>>>>76 uleshort >0 \b, password size %4.4x 27280# Software Vendor ID (CBEh) 27281>>>>>86 uleshort x \b, software (0x%x) 27282# size of Software Name (6Eh) 27283>>>>>80 uleshort >0 27284# offset of Software Name (1C8h,1CAh,1D0h) 27285>>>>>>82 uleshort >0 27286# 1~ANSI, 2~UNICODE 27287>>>>>>>48 ubyte 1 27288>>>>>>>>(82.s) string >\0 \b: %s 27289>>>>>>>48 ubyte 2 27290# size terminated unicoded coded string normally followed by "SPAD" 27291>>>>>>>>(82.s) lestring16 x \b: %s 27292# Format Logical Block Size (512,1024) 27293#>>>>>84 uleshort =1024 \b, block size %u 27294>>>>>84 uleshort !1024 \b, block size %u 27295# Media Date of MTF_DATE_TIME type with 5 bytes 27296#>>>>>>88 ubequad x DATE %16.16llx 27297# MTF Major Version (1) 27298#>>>>>>93 ubyte x \b, MFT version %x 27299# 27300 27301# URL: https://en.wikipedia.org/wiki/PaintShop_Pro 27302# Reference: http://www.cryer.co.uk/file-types/p/pal.htm 27303# Created by: Joerg Jenderek 27304# Note: there exist other color palette formats also with .pal extension 273050 string JASC-PAL\r\n PaintShop Pro color palette 27306#!:mime text/plain 27307# PspPalette extension is used by newer (probably 8) PaintShopPro versions 27308!:ext pal/PspPalette 27309# 2nd line contains palette file version. For example "0100" 27310>10 string !0100 \b, version %.4s 27311# third line contains the number of colours: 16 256 ... 27312>16 string x \b, %.3s colors 27313 27314# URL: http://en.wikipedia.org/wiki/Innosetup 27315# Reference: https://github.com/jrsoftware/issrc/blob/master/Projects/Undo.pas 27316# Created by: Joerg Jenderek 27317# Note: created by like "InnoSetup self-extracting archive" inside ./msdos 27318# TrID labeles the entry as "Inno Setup Uninstall Log" 27319# TUninstallLogID 273200 string Inno\ Setup\ Uninstall\ Log\ (b) InnoSetup Log 27321!:mime application/x-innosetup 27322# unins000.dat, unins001.dat, ... 27323!:ext dat 27324# " 64-bit" variant 27325>0x1c string >\0 \b%.7s 27326# AppName[0x80] like "Minimal SYStem", ClamWin Free Antivirus , ... 27327>0xc0 string x %s 27328# AppId[0x80] is simliar to AppName or 27329# GUID like {4BB0DCDC-BC24-49EC-8937-72956C33A470} start with left brace 27330>0x40 ubyte 0x7b 27331>>0x40 string x %-.38s 27332# do not know how this log version correlates to program version 27333>0x140 ulelong x \b, version 0x%x 27334# NumRecs 27335#>0x144 ulelong x \b, 0x%4.4x records 27336# EndOffset means files size 27337>0x148 ulelong x \b, %u bytes 27338# Flags 5 25h 35h 27339#>0x14c ulelong x \b, flags %8.8x 27340# Reserved: array[0..26] of Longint 27341# the non Unicode HighestSupportedVersion may never become greater than or equal to 1000 27342>0x140 ulelong <1000 27343# hostname 27344>>0x1d6 pstring x \b, %s 27345# user name 27346>>>&0 pstring x \b\%s 27347# directory like C:\Program Files (x86)\GnuWin32 27348>>>>&0 pstring x \b, "%s" 27349# version 1000 or higher implies unicode 27350>0x140 ulelong >999 27351# hostname 27352>>0x1db lestring16 x \b, %-.9s 27353# utf string variant with prepending fe??ffFFff 27354>>0x1db search/43 \xFF\xFF\xFF 27355# user name 27356>>>&0 lestring16 x \b\%-.9s 27357>>>&0 search/43 \xFF\xFF\xFF 27358# directory like C:\Program Files\GIMP 2 27359>>>>&0 lestring16 x \b, %-.42s 27360 27361 27362#------------------------------------------------------------------------------ 27363# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $ 27364# wireless-regdb: file(1) magic for CRDA wireless-regdb file format 27365# 273660 string RGDB CRDA wireless regulatory database file 27367>4 belong 19 (Version 1) 27368 27369#------------------------------------------------------------------------------ 27370# $File: wordprocessors,v 1.19 2015/10/16 15:11:07 christos Exp $ 27371# wordprocessors: file(1) magic fo word processors. 27372# 27373####### PWP file format used on Smith Corona Personal Word Processors: 273742 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040'92 Smith Corona PWP 27375>24 byte 2 \b, single spaced 27376>24 byte 3 \b, 1.5 spaced 27377>24 byte 4 \b, double spaced 27378>25 byte 0x42 \b, letter 27379>25 byte 0x54 \b, legal 27380>26 byte 0x46 \b, A4 27381 27382# Corel/WordPerfect 273830 string \xffWPC 27384# WordPerfect 27385>8 byte 1 27386>>9 byte 1 WordPerfect macro 27387>>9 byte 2 WordPerfect help file 27388>>9 byte 3 WordPerfect keyboard file 27389>>9 byte 10 WordPerfect document 27390>>9 byte 11 WordPerfect dictionary 27391>>9 byte 12 WordPerfect thesaurus 27392>>9 byte 13 WordPerfect block 27393>>9 byte 14 WordPerfect rectangular block 27394>>9 byte 15 WordPerfect column block 27395>>9 byte 16 WordPerfect printer data 27396>>9 byte 19 WordPerfect printer data 27397>>9 byte 20 WordPerfect driver resource data 27398>>9 byte 22 WordPerfect graphic image 27399>>9 byte 23 WordPerfect hyphenation code 27400>>9 byte 24 WordPerfect hyphenation data 27401>>9 byte 25 WordPerfect macro resource data 27402>>9 byte 27 WordPerfect hyphenation lex 27403>>9 byte 29 WordPerfect wordlist 27404>>9 byte 30 WordPerfect equation resource data 27405>>9 byte 33 WordPerfect spell rules 27406>>9 byte 34 WordPerfect dictionary rules 27407>>9 byte 39 WordPerfect spell rules (Microlytics) 27408>>9 byte 43 WordPerfect settings file 27409>>9 byte 44 WordPerfect 3.5 document 27410>>9 byte 45 WordPerfect 4.2 document 27411>>9 byte 69 WordPerfect dialog file 27412>>9 byte 76 WordPerfect button bar 27413>>9 default x 27414>>>9 byte x Corel WordPerfect: Unknown filetype %d 27415# Corel Shell 27416>8 byte 2 27417>>9 byte 1 Corel shell macro 27418>>9 byte 10 Corel shell definition 27419>>9 default x 27420>>>9 byte x Corel Shell: Unknown filetype %d 27421# Corel Notebook 27422>8 byte 3 27423>>9 byte 1 Corel Notebook macro 27424>>9 byte 2 Corel Notebook help file 27425>>9 byte 3 Corel Notebook keyboard file 27426>>9 byte 10 Corel Notebook definition 27427>>9 default x 27428>>>9 byte x Corel Notebook: Unknown filetype %d 27429# Corel Calculator 27430>8 byte 4 27431>>9 byte 2 Corel Calculator help file 27432>>9 default x 27433>>>9 byte x Corel Calculator: Unknown filetype %d 27434# Corel File Manager 27435>8 byte 5 27436>>9 default x 27437>>>9 byte x Corel File Manager: Unknown filetype %d 27438# Corel Calendar 27439>8 byte 6 27440>>9 byte 2 Corel Calendar help file 27441>>9 byte 10 Corel Calendar data file 27442>>9 default x 27443>>>9 byte x Corel Calendar: Unknown filetype %d 27444# Corel Program Editor/Ed Editor 27445>8 byte 7 27446>>9 byte 1 Corel Editor macro 27447>>9 byte 2 Corel Editor help file 27448>>9 byte 3 Corel Editor keyboard file 27449>>9 byte 25 Corel Editor macro resource file 27450>>9 default x 27451>>>9 byte x Corel Program Editor/Ed Editor: Unknown filetype %d 27452# Corel Macro Editor 27453>8 byte 8 27454>>9 byte 1 Corel Macro editor macro 27455>>9 byte 2 Corel Macro editor help file 27456>>9 byte 3 Corel Macro editor keyboard file 27457>>9 default x 27458>>>9 byte x Corel Macro Editor: Unknown filetype %d 27459# Corel Plan Perfect 27460>8 byte 9 27461>>9 default x 27462>>>9 byte x Corel Plan Perfect: Unknown filetype %d 27463# Corel DataPerfect 27464>8 byte 10 27465# CHECK: Don't these belong into product 9? 27466>>9 byte 1 Corel PlanPerfect macro 27467>>9 byte 2 Corel PlanPerfect help file 27468>>9 byte 3 Corel PlanPerfect keyboard file 27469>>9 byte 10 Corel PlanPerfect worksheet 27470>>9 byte 15 Corel PlanPerfect printer definition 27471>>9 byte 18 Corel PlanPerfect graphic definition 27472>>9 byte 19 Corel PlanPerfect data 27473>>9 byte 20 Corel PlanPerfect temporary printer 27474>>9 byte 25 Corel PlanPerfect macro resource data 27475>>9 default x 27476>>>9 byte x Corel DataPerfect: Unknown filetype %d 27477# Corel Mail 27478>8 byte 11 27479>>9 byte 2 Corel Mail help file 27480>>9 byte 5 Corel Mail distribution list 27481>>9 byte 10 Corel Mail out box 27482>>9 byte 11 Corel Mail in box 27483>>9 byte 20 Corel Mail users archived mailbox 27484>>9 byte 21 Corel Mail archived message database 27485>>9 byte 22 Corel Mail archived attachments 27486>>9 default x 27487>>>9 byte x Corel Mail: Unknown filetype %d 27488# Corel Printer 27489>8 byte 12 27490>>9 byte 11 Corel Printer temporary file 27491>>9 default x 27492>>>9 byte x Corel Printer: Unknown filetype %d 27493# Corel Scheduler 27494>8 byte 13 27495>>9 byte 2 Corel Scheduler help file 27496>>9 byte 10 Corel Scheduler in file 27497>>9 byte 11 Corel Scheduler out file 27498>>9 default x 27499>>>9 byte x Corel Scheduler: Unknown filetype %d 27500# Corel WordPerfect Office 27501>8 byte 14 27502>>9 byte 10 Corel GroupWise settings file 27503>>9 byte 17 Corel GroupWise directory services 27504>>9 byte 43 Corel GroupWise settings file 27505>>9 default x 27506>>>9 byte x Corel WordPerfect Office: Unknown filetype %d 27507# Corel DrawPerfect 27508>8 byte 15 27509>>9 default x 27510>>>9 byte x Corel DrawPerfect: Unknown filetype %d 27511# Corel LetterPerfect 27512>8 byte 16 27513>>9 default x 27514>>>9 byte x Corel LetterPerfect: Unknown filetype %d 27515# Corel Terminal 27516>8 byte 17 27517>>9 byte 10 Corel Terminal resource data 27518>>9 byte 11 Corel Terminal resource data 27519>>9 byte 43 Corel Terminal resource data 27520>>9 default x 27521>>>9 byte x Corel Terminal: Unknown filetype %d 27522# Corel loadable file 27523>8 byte 18 27524>>9 byte 10 Corel loadable file 27525>>9 byte 11 Corel GUI loadable text 27526>>9 byte 12 Corel graphics resource data 27527>>9 byte 13 Corel printer settings file 27528>>9 byte 14 Corel port definition file 27529>>9 byte 15 Corel print queue parameters 27530>>9 byte 16 Corel compressed file 27531>>9 default x 27532>>>9 byte x Corel loadable file: Unknown filetype %d 27533>>15 byte 0 \b, optimized for Intel 27534>>15 byte 1 \b, optimized for Non-Intel 27535# Network service 27536>8 byte 20 27537>>9 byte 10 Corel Network service msg file 27538>>9 byte 11 Corel Network service msg file 27539>>9 byte 12 Corel Async gateway login msg 27540>>9 byte 14 Corel GroupWise message file 27541>>9 default x 27542>>>9 byte x Corel Network service: Unknown filetype %d 27543# GroupWise 27544>8 byte 31 27545>>9 byte 20 GroupWise admin domain database 27546>>9 byte 21 GroupWise admin host database 27547>>9 byte 23 GroupWise admin remote host database 27548>>9 byte 24 GroupWise admin ADS deferment data file 27549>>9 default x 27550>>>9 byte x GroupWise: Unknown filetype %d 27551# IntelliTAG 27552>8 byte 33 27553>>9 byte 10 IntelliTAG (SGML) compiled DTD 27554>>9 default x 27555>>>9 byte x IntelliTAG: Unknown filetype %d 27556# everything else 27557>8 default x 27558>>8 byte x Unknown Corel/Wordperfect product %d, 27559>>>9 byte x file type %d 27560>10 byte 0 \b, v5. 27561>10 byte !0 \b, v%d. 27562>11 byte x \b%d 27563 27564# Hangul (Korean) Word Processor File 275650 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0 27566# From: Won-Kyu Park <wkpark@kldp.org> 27567512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000 27568!:mime application/x-hwp 27569 27570# CosmicBook, from Benoit Rouits 275710 string CSBK Ted Neslson's CosmicBook hypertext file 27572 275732 string EYWR AmigaWriter file 27574 27575# chi: file(1) magic for ChiWriter files 275760 string \\1cw\ ChiWriter file 27577>5 string >\0 version %s 275780 string \\1cw ChiWriter file 27579 27580# Quark Express from http://www.garykessler.net/library/file_sigs.html 275812 string IIXPR3 Intel Quark Express Document (English) 275822 string IIXPRa Intel Quark Express Document (Korean) 275832 string MMXPR3 Motorola Quark Express Document (English) 27584!:mime application/x-quark-xpress-3 275852 string MMXPRa Motorola Quark Express Document (Korean) 27586 27587# adobe indesign (document, whatever...) from querkan 275880 belong 0x0606edf5 Adobe InDesign 27589>16 string DOCUMENT Document 27590 27591#------------------------------------------------------------------------------ 27592# ichitaro456: file(1) magic for Just System Word Processor Ichitaro 27593# 27594# Contributor kenzo-: 27595# Reversed-engineered JS Ichitaro magic numbers 27596# 27597 275980 string DOC 27599>43 byte 0x14 Just System Word Processor Ichitaro v4 27600!:mime application/x-ichitaro4 27601>144 string JDASH application/x-ichitaro4 27602 276030 string DOC 27604>43 byte 0x15 Just System Word Processor Ichitaro v5 27605!:mime application/x-ichitaro5 27606 276070 string DOC 27608>43 byte 0x16 Just System Word Processor Ichitaro v6 27609!:mime application/x-ichitaro6 27610 27611# Type: Freemind mindmap documents 27612# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk> 276130 string/w \<map\ version Freemind document 27614!:mime application/x-freemind 27615 27616# Type: Freeplane mindmap documents 27617# From: Felix Natter <fnatter@gmx.net> 276180 string/w \<map\ version="freeplane Freeplane document 27619!:mime application/x-freeplane 27620 27621# Type: Scribus 27622# From: Werner Fink <werner@suse.de> 276230 string \<SCRIBUSUTF8\ Version Scribus Document 276240 string \<SCRIBUSUTF8NEW\ Version Scribus Document 27625!:mime application/x-scribus 27626 27627# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek 27628# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14 276290 ulelong&0x8080FFFF 0x00001204 gfxboot compiled html help file 27630 27631#------------------------------------------------------------------------------ 27632# $File: wsdl,v 1.3 2013/02/06 14:18:52 christos Exp $ 27633# wsdl: PHP WSDL Cache, http://www.php.net/manual/en/book.soap.php 27634# Cache format extracted from source: 27635# http://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup 27636# Requires file >= 5.05, see http://mx.gw.com/pipermail/file/2010/000683.html 27637# By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011 276380 string wsdl PHP WSDL cache, 27639>4 byte x version 0x%02x 27640>6 ledate x \b, created %s 27641 27642# uri 27643>10 lelong <0x7fffffff 27644>>10 pstring/l x \b, uri: "%s" 27645 27646# source 27647>>>&0 lelong <0x7fffffff 27648>>>>&-4 pstring/l x \b, source: "%s" 27649 27650# target_ns 27651>>>>>&0 lelong <0x7fffffff 27652>>>>>>&-4 pstring/l x \b, target_ns: "%s" 27653#------------------------------------------------------------------------------ 27654# x68000: file(1) magic for the Sharp Home Computer 27655# v1.0 27656# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 27657 27658# Yanagisawa PIC picture 276590 string PIC 27660>3 search/0x200 \x1A 27661>>&0 search/0x200 \x0 27662>>>&0 ubyte 0 Yanagisawa PIC image file, 27663>>>>&0 ubyte&15 0 model: X68000, 27664>>>>&0 ubyte&15 1 model: PC-88VA, 27665>>>>&0 ubyte&15 2 model: FM-TOWNS, 27666>>>>&0 ubyte&15 3 model: MAC, 27667>>>>&0 ubyte&15 15 model: Generic, 27668>>>>&3 ubeshort x %dx 27669>>>>&5 ubeshort x \b%d, 27670>>>>&1 ubeshort 4 colors: 16 27671>>>>&1 ubeshort 8 colors: 256 27672>>>>&1 ubeshort 12 colors: 4096 27673>>>>&1 ubeshort 15 colors: 32768 27674>>>>&1 ubeshort 16 colors: 65536 27675>>>>&1 ubeshort >16 colors: %d-bit 27676 27677 27678 27679#------------------------------------------------------------------------------ 27680# $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $ 27681# file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU> 27682# 276830 string %XDELTA% XDelta binary patch file 0.14 276840 string %XDZ000% XDelta binary patch file 0.18 276850 string %XDZ001% XDelta binary patch file 0.20 276860 string %XDZ002% XDelta binary patch file 1.0 276870 string %XDZ003% XDelta binary patch file 1.0.4 276880 string %XDZ004% XDelta binary patch file 1.1 27689 276900 string \xD6\xC3\xC4\x00 VCDIFF binary diff 27691 27692#------------------------------------------------------------------------------ 27693# $File: xenix,v 1.11 2017/03/17 21:35:28 christos Exp $ 27694# xenix: file(1) magic for Microsoft Xenix 27695# 27696# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small 27697# model" lifted from "magic.xenix", with comment "derived empirically; 27698# treat as folklore until proven" 27699# 27700# "small model", "large model", "huge model" stuff lifted from XXX 27701# 27702# XXX - "x.out" collides with PDP-11 archives 27703# 277040 string core core file (Xenix) 27705# URL: http://www.polarhome.com/service/man/?qf=86rel&tf=2&of=Xenix 27706# Reference: http://www.azillionmonkeys.com/qed/Omfg.pdf 27707# Update: Joerg Jenderek 27708# recordtype~TranslatorHEADerRecord 277090 byte 0x80 27710# GRR: line above is too general as it catches also Extensible storage engine DataBase 27711# skip examples like GENA.SND Switch.Snd by looking for record length maximal 1024-3 27712>1 uleshort <1022 27713# skip examples like GAME.PICTURE Strange.Pic by looking for positiv record length 27714>>1 uleshort >0 27715# skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positiv string length 27716>>>3 ubyte >0 27717# skip examples like OMBRE.6 with "UUUUUU" by looking for filename like "hello.c" 27718>>>>4 regex [a-zA-Z_/]{1,8}[.] 8086 relocatable (Microsoft) 27719#!:mime application/octet-stream 27720!:mime application/x-object 27721!:ext o/a 27722>>>>>3 pstring x \b, "%s" 27723# checksum 27724#>>>>>(3.b+4) ubyte x \b, checksum 0x%2.2x 277250 leshort 0xff65 x.out 27726>2 string __.SYMDEF randomized 27727>0 byte x archive 277280 leshort 0x206 Microsoft a.out 27729>8 leshort 1 Middle model 27730>0x1e leshort &0x10 overlay 27731>0x1e leshort &0x2 separate 27732>0x1e leshort &0x4 pure 27733>0x1e leshort &0x800 segmented 27734>0x1e leshort &0x400 standalone 27735>0x1e leshort &0x8 fixed-stack 27736>0x1c byte &0x80 byte-swapped 27737>0x1c byte &0x40 word-swapped 27738>0x10 lelong >0 not-stripped 27739>0x1e leshort ^0xc000 pre-SysV 27740>0x1e leshort &0x4000 V2.3 27741>0x1e leshort &0x8000 V3.0 27742>0x1c byte &0x4 86 27743>0x1c byte &0xb 186 27744>0x1c byte &0x9 286 27745>0x1c byte &0xa 386 27746>0x1f byte <0x040 small model 27747>0x1f byte =0x048 large model 27748>0x1f byte =0x049 huge model 27749>0x1e leshort &0x1 executable 27750>0x1e leshort ^0x1 object file 27751>0x1e leshort &0x40 Large Text 27752>0x1e leshort &0x20 Large Data 27753>0x1e leshort &0x120 Huge Objects Enabled 27754>0x10 lelong >0 not stripped 27755 277560 leshort 0x140 old Microsoft 8086 x.out 27757>0x3 byte &0x4 separate 27758>0x3 byte &0x2 pure 27759>0 byte &0x1 executable 27760>0 byte ^0x1 relocatable 27761>0x14 lelong >0 not stripped 27762 277630 lelong 0x206 b.out 27764>0x1e leshort &0x10 overlay 27765>0x1e leshort &0x2 separate 27766>0x1e leshort &0x4 pure 27767>0x1e leshort &0x800 segmented 27768>0x1e leshort &0x400 standalone 27769>0x1e leshort &0x1 executable 27770>0x1e leshort ^0x1 object file 27771>0x1e leshort &0x4000 V2.3 27772>0x1e leshort &0x8000 V3.0 27773>0x1c byte &0x4 86 27774>0x1c byte &0xb 186 27775>0x1c byte &0x9 286 27776>0x1c byte &0x29 286 27777>0x1c byte &0xa 386 27778>0x1e leshort &0x4 Large Text 27779>0x1e leshort &0x2 Large Data 27780>0x1e leshort &0x102 Huge Objects Enabled 27781 277820 leshort 0x580 XENIX 8086 relocatable or 80286 small model 27783 27784#------------------------------------------------------------------------------ 27785# $File: xilinx,v 1.8 2017/03/17 21:35:28 christos Exp $ 27786# This is Aaron's attempt at a MAGIC file for Xilinx .bit files. 27787# Xilinx-Magic@RevRagnarok.com 27788# Got the info from FPGA-FAQ 0026 27789# 27790# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth, 27791# fixes at least reading of bitfiles from Spartan 2, 3, 6. 27792# http://www.fpga-faq.com/FAQ_Pages/0026_Tell_me_about_bit_files.htm 27793# 27794# First there is the sync header and its length 277950 beshort 0x0009 27796>2 belong =0x0ff00ff0 27797>>&0 belong =0x0ff00ff0 27798>>>&0 byte =0x00 27799>>>&1 beshort =0x0001 27800>>>&3 string a Xilinx BIT data 27801# Next is a Pascal-style string with the NCD name. We want to capture that. 27802>>>>&0 pstring/H x - from %s 27803# And then 'b' 27804>>>>>&1 string b 27805# Then the model / part number: 27806>>>>>>&0 pstring/H x - for %s 27807# Then 'c' 27808>>>>>>>&1 string c 27809# Then the build-date 27810>>>>>>>>&0 pstring/H x - built %s 27811# Then 'd' 27812>>>>>>>>>&1 string d 27813# Then the build-time 27814>>>>>>>>>>&0 pstring/H x \b(%s) 27815# Then 'e' 27816>>>>>>>>>>>&1 string e 27817# And length of data 27818>>>>>>>>>>>>&0 belong x - data length 0x%x 27819 27820# Raw bitstream files 278210 long 0xffffffff 27822>&0 belong 0xaa995566 Xilinx RAW bitstream (.BIN) 27823 27824#------------------------------------------------------------------------------ 27825# $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $ 27826# xo65 object files 27827# From: "Ullrich von Bassewitz" <uz@cc65.org> 27828# 278290 string \x55\x7A\x6E\x61 xo65 object, 27830>4 leshort x version %d, 27831>6 leshort&0x0001 =0x0001 with debug info 27832>6 leshort&0x0001 =0x0000 no debug info 27833 27834# xo65 library files 278350 string \x6E\x61\x55\x7A xo65 library, 27836>4 leshort x version %d 27837 27838# o65 object files 278390 string \x01\x00\x6F\x36\x35 o65 27840>6 leshort&0x1000 =0x0000 executable, 27841>6 leshort&0x1000 =0x1000 object, 27842>5 byte x version %d, 27843>6 leshort&0x8000 =0x8000 65816, 27844>6 leshort&0x8000 =0x0000 6502, 27845>6 leshort&0x2000 =0x2000 32 bit, 27846>6 leshort&0x2000 =0x0000 16 bit, 27847>6 leshort&0x4000 =0x4000 page reloc, 27848>6 leshort&0x4000 =0x0000 byte reloc, 27849>6 leshort&0x0003 =0x0000 alignment 1 27850>6 leshort&0x0003 =0x0001 alignment 2 27851>6 leshort&0x0003 =0x0002 alignment 4 27852>6 leshort&0x0003 =0x0003 alignment 256 27853 27854#------------------------------------------------------------------------------ 27855# $File: xwindows,v 1.10 2017/03/17 21:35:28 christos Exp $ 27856# xwindows: file(1) magic for various X/Window system file formats. 27857 27858# Compiled X Keymap 27859# XKM (compiled X keymap) files (including version and byte ordering) 278601 string mkx Compiled XKB Keymap: lsb, 27861>0 byte >0 version %d 27862>0 byte =0 obsolete 278630 string xkm Compiled XKB Keymap: msb, 27864>3 byte >0 version %d 27865>3 byte =0 obsolete 27866 27867# xfsdump archive 278680 string xFSdump0 xfsdump archive 27869>8 belong x (version %d) 27870 27871# Jaleo XFS files 278720 long 395726 Jaleo XFS file 27873>4 long x - version %d 27874>8 long x - [%d - 27875>20 long x \b%dx 27876>24 long x \b%dx 27877>28 long 1008 \bYUV422] 27878>28 long 1000 \bRGB24] 27879 27880# Xcursor data 27881# X11 mouse cursor format defined in libXcursor, see 27882# http://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html 27883# http://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h 278840 string Xcur Xcursor data 27885!:mime image/x-xcursor 27886>10 leshort x version %d 27887>>8 leshort x \b.%d 27888 27889 27890#------------------------------------------------------------------------------ 27891# $File: yara,v 1.2 2017/05/25 20:07:23 christos Exp $ 27892# yara: file(1) magic for http://virustotal.github.io/yara/ 27893# 27894 278950 string YARA 27896>4 lelong >2047 27897>8 byte <20 YARA 3.x compiled rule set 27898# version 27899>>8 clear x 27900>>8 byte 6 created with version 3.3.0 27901>>8 byte 8 created with version 3.4.0 27902>>8 byte 11 created with version 3.5.0 27903>>8 default x 27904>>>8 byte x development version 0x%02x 27905#------------------------------------------------------------------------------ 27906# zfs: file(1) magic for ZFS dumps 27907# 27908# From <rea-fbsd@codelabs.ru> 27909# ZFS dump header has the following structure (as per zfs_ioctl.h 27910# in FreeBSD with drr_type is set to DRR_BEGIN) 27911# 27912# enum { 27913# DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS, 27914# DRR_WRITE, DRR_FREE, DRR_END, 27915# } drr_type; 27916# uint32_t drr_pad; 27917# uint64_t drr_magic; 27918# uint64_t drr_version; 27919# uint64_t drr_creation_time; 27920# dmu_objset_type_t drr_type; 27921# uint32_t drr_pad; 27922# uint64_t drr_toguid; 27923# uint64_t drr_fromguid; 27924# char drr_toname[MAXNAMELEN]; 27925# 27926# Backup magic is 0x00000002f5bacbac (quad word) 27927# The drr_type is defined as 27928# typedef enum dmu_objset_type { 27929# DMU_OST_NONE, 27930# DMU_OST_META, 27931# DMU_OST_ZFS, 27932# DMU_OST_ZVOL, 27933# DMU_OST_OTHER, /* For testing only! */ 27934# DMU_OST_ANY, /* Be careful! */ 27935# DMU_OST_NUMTYPES 27936# } dmu_objset_type_t; 27937# 27938# Almost all uint64_t fields are printed as the 32-bit ones (with high 27939# 32 bits zeroed), because there is no simple way to print them as the 27940# full 64-bit values. 27941 27942# Big-endian values 279438 string \000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine), 27944>20 belong x version %u, 27945>32 belong 0 type: NONE, 27946>32 belong 1 type: META, 27947>32 belong 2 type: ZFS, 27948>32 belong 3 type: ZVOL, 27949>32 belong 4 type: OTHER, 27950>32 belong 5 type: ANY, 27951>32 belong >5 type: UNKNOWN (%u), 27952>40 byte x destination GUID: %02X 27953>41 byte x %02X 27954>42 byte x %02X 27955>43 byte x %02X 27956>44 byte x %02X 27957>45 byte x %02X 27958>46 byte x %02X 27959>47 byte x %02X, 27960>48 ulong >0 27961>>52 ulong >0 27962>>>48 byte x source GUID: %02X 27963>>>49 byte x %02X 27964>>>50 byte x %02X 27965>>>51 byte x %02X 27966>>>52 byte x %02X 27967>>>53 byte x %02X 27968>>>54 byte x %02X 27969>>>55 byte x %02X, 27970>56 string >\0 name: '%s' 27971 27972# Little-endian values 279738 string \254\313\272\365\002\000\000\000 ZFS shapshot (little-endian machine), 27974>16 lelong x version %u, 27975>32 lelong 0 type: NONE, 27976>32 lelong 1 type: META, 27977>32 lelong 2 type: ZFS, 27978>32 lelong 3 type: ZVOL, 27979>32 lelong 4 type: OTHER, 27980>32 lelong 5 type: ANY, 27981>32 lelong >5 type: UNKNOWN (%u), 27982>47 byte x destination GUID: %02X 27983>46 byte x %02X 27984>45 byte x %02X 27985>44 byte x %02X 27986>43 byte x %02X 27987>42 byte x %02X 27988>41 byte x %02X 27989>40 byte x %02X, 27990>48 ulong >0 27991>>52 ulong >0 27992>>>55 byte x source GUID: %02X 27993>>>54 byte x %02X 27994>>>53 byte x %02X 27995>>>52 byte x %02X 27996>>>51 byte x %02X 27997>>>50 byte x %02X 27998>>>49 byte x %02X 27999>>>48 byte x %02X, 28000>56 string >\0 name: '%s' 28001 28002#------------------------------------------------------------------------------ 28003# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $ 28004# zilog: file(1) magic for Zilog Z8000. 28005# 28006# Was it big-endian or little-endian? My Product Specification doesn't 28007# say. 28008# 280090 long 0xe807 object file (z8000 a.out) 280100 long 0xe808 pure object file (z8000 a.out) 280110 long 0xe809 separate object file (z8000 a.out) 280120 long 0xe805 overlay object file (z8000 a.out) 28013#------------------------------------------------------------------------------ 28014# $File: zip,v 1.1 2017/11/03 23:36:17 christos Exp $ 28015# zip: file(1) magic for zip files; this is not use 28016# Note the version of magic in archive is currently stronger, this is 28017# just an example until negative offsets are supported better 28018 28019# Zip Central Cirectory record 280200 name zipcd 28021>0 string PK\001\002 28022>>4 leshort x \b, made by 28023>>4 use zipversion 28024>>6 leshort x \b, extract using at least 28025>>6 use zipversion 28026>>12 ledate x \b, last modified %s 28027>>24 lelong >0 \b, uncompressed size %d 28028>>10 leshort x \b, method= 28029>>10 use zipcompression 28030 28031# Zip known compressions 280320 name zipcompression 28033>0 leshort 0 \bstore 28034>0 leshort 8 \bdeflate 28035>0 leshort 9 \bdeflate64 28036>0 leshort 12 \bbzip2 28037>0 leshort 14 \blzma 28038>0 leshort 94 \bMP3 28039>0 leshort 95 \bxz 28040>0 leshort 96 \bJpeg 28041>0 leshort 97 \bWavPack 28042>0 leshort 98 \bPPMd 28043>0 leshort 99 \bAES Encrypted 28044>0 default x 28045>>0 leshort x \b[%#x] 28046 28047# Zip known versions 280480 name zipversion 28049>0 leshort 0x09 v0.9 28050>0 leshort 0x0a v1.0 28051>0 leshort 0x0b v1.1 28052>0 leshort 0x14 v2.0 28053>0 leshort 0x15 v2.1 28054>0 leshort 0x19 v2.5 28055>0 leshort 0x1b v2.7 28056>0 leshort 0x2d v4.5 28057>0 leshort 0x2e v4.6 28058>0 leshort 0x32 v5.0 28059>0 leshort 0x33 v5.1 28060>0 leshort 0x34 v5.2 28061>0 leshort 0x3d v6.1 28062>0 leshort 0x3e v6.2 28063>0 leshort 0x3f v6.3 28064>0 default x 28065>>0 leshort x v?[%#x] 28066 28067# Zip End Of Central Directory record 28068-22 string PK\005\006 Zip archive data 28069#>4 leshort >1 \b, %d disks 28070#>6 leshort >1 \b, central directory disk %d 28071#>8 leshort >1 \b, %d central directories on this disk 28072#>10 leshort >1 \b, %d central directories 28073#>12 lelong x \b, %d central directory bytes 28074>(16.l) use zipcd 28075>20 pstring/l >0 \b, %s 28076 28077#------------------------------------------------------------------------------ 28078# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $ 28079# zyxel: file(1) magic for ZyXEL modems 28080# 28081# From <rob@pe1chl.ampr.org> 28082# These are the /etc/magic entries to decode datafiles as used for the 28083# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a 28084# ZyXEL-defined standard) 28085 280860 string ZyXEL\002 ZyXEL voice data 28087>10 byte 0 - CELP encoding 28088>10 byte&0x0B 1 - ADPCM2 encoding 28089>10 byte&0x0B 2 - ADPCM3 encoding 28090>10 byte&0x0B 3 - ADPCM4 encoding 28091>10 byte&0x0B 8 - New ADPCM3 encoding 28092>10 byte&0x04 4 with resync 28093
