1# Magic data for file(1) command.
2# Format is described in magic(files), where:
3# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID.
4# Don't edit this file, edit /etc/magic or send your magic improvements
5# to the maintainers, at file@astron.com
6
7#------------------------------------------------------------------------------
8# Localstuff:  file(1) magic for locally observed files
9#
10# $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $
11# Add any locally observed files here.  Remember:
12# text if readable, executable if runnable binary, data if unreadable.
13
14#------------------------------------------------------------------------------
15# $File: acorn,v 1.7 2019/04/19 00:42:27 christos Exp $
16# acorn:  file(1) magic for files found on Acorn systems
17#
18
19# RISC OS Chunk File Format
20# From RISC OS Programmer's Reference Manual, Appendix D
21# We guess the file type from the type of the first chunk.
220	lelong		0xc3cbc6c5	RISC OS Chunk data
23>12	string		OBJ_		\b, AOF object
24>12	string		LIB_		\b, ALF library
25
26# RISC OS AIF, contains "SWI OS_Exit" at offset 16.
2716	lelong		0xef000011	RISC OS AIF executable
28
29# RISC OS Draw files
30# From RISC OS Programmer's Reference Manual, Appendix E
310	string 		Draw		RISC OS Draw file data
32
33# RISC OS new format font files
34# From RISC OS Programmer's Reference Manual, Appendix E
350	string		FONT\0		RISC OS outline font data,
36>5	byte		x		version %d
370	string		FONT\1		RISC OS 1bpp font data,
38>5	byte		x		version %d
390	string		FONT\4		RISC OS 4bpp font data
40>5	byte		x		version %d
41
42# RISC OS Music files
43# From RISC OS Programmer's Reference Manual, Appendix E
440	string		Maestro\r	RISC OS music file
45>8	byte		x		version %d
46
47>8	byte		x		type %d
48
49# Digital Symphony data files
50# From: Bernard Jungen (bern8817@euphonynet.be)
510		string	\x02\x01\x13\x13\x13\x01\x0d\x10	Digital Symphony sound sample (RISC OS),
52>8		byte	x	version %d,
53>9		pstring	x	named "%s",
54>(9.b+19)	byte	=0	8-bit logarithmic
55>(9.b+19)	byte	=1	LZW-compressed linear
56>(9.b+19)	byte	=2	8-bit linear signed
57>(9.b+19)	byte	=3	16-bit linear signed
58>(9.b+19)	byte	=4	SigmaDelta-compressed linear
59>(9.b+19)	byte	=5	SigmaDelta-compressed logarithmic
60>(9.b+19)	byte	>5	unknown format
61
620	string	\x02\x01\x13\x13\x14\x12\x01\x0b	Digital Symphony song (RISC OS),
63>8	byte	x	version %d,
64>9	byte	=1	1 voice,
65>9	byte	!1	%d voices,
66>10	leshort	=1	1 track,
67>10	leshort	!1	%d tracks,
68>12	leshort	=1	1 pattern
69>12	leshort	!1	%d patterns
70
710	string	\x02\x01\x13\x13\x10\x14\x12\x0e
72>9	byte	=0	Digital Symphony sequence (RISC OS),
73>>8	byte	x	version %d,
74>>10	byte	=1	1 line,
75>>10	byte	!1	%d lines,
76>>11	leshort	=1	1 position
77>>11	leshort	!1	%d positions
78>9	byte	=1	Digital Symphony pattern data (RISC OS),
79>>8	byte	x	version %d,
80>>10	leshort	=1	1 pattern
81>>10	leshort	!1	%d patterns
82
83# From: Joerg Jenderek
84# URL: https://www.kyzer.me.uk/pack/xad/#PackDir
85# reference: https://www.kyzer.me.uk/pack/xad/xad_PackDir.lha/PackDir.c
86# GRR: line below is too general as it matches also "Git pack" in ./revision
870	string	PACK\0
88# check for valid compression method 0-4
89>5	ulelong	<5
90# https://www.riscosopen.org/wiki/documentation/show/Introduction%20To%20Filing%20Systems
91# To skip "Git pack" version 0 test for root directory object like
92# ADFS::RPC.$.websitezip.FONTFIX
93>>9	string	>ADFS\  PackDir archive (RISC OS)
94# TrID labels above as "Acorn PackDir compressed Archive"
95# compression mode y (0 - 4) for GIF LZW with a maximum n bits
96# (y~n,0~12,1~13,2~14,3~15,4~16)
97>>>5	ulelong+12 x	\b, LZW %u-bits compression
98# https://www.filebase.org.uk/filetypes
99# !Packdir compressed archive has three hexadecimal digits code 68E
100!:mime	application/x-acorn-68E
101!:ext	pkd/bin
102# null terminated root directory object like IDEFS::IDE-4.$.Apps.GRAPHICS.!XFMPdemo
103>>>9	string	x	\b, root "%s"
104# load address 0xFFFtttdd, ttt is the object filetype and dddddddddd is time
105>>>>&1	ulelong	x	\b, load address 0x%x
106# execution address 0xdddddddd dddddddddd is 40 bit unsigned centiseconds since 1.1.1900 UTC
107>>>>&5	ulelong	x	\b, exec address 0x%x
108# attributes (bits: 0~owner read,1~owner write,3~no delete,4~public read,5~public write)
109>>>>&9	ulelong	x	\b, attributes 0x%x
110# number of entries in this directory. for root dir 0
111#>>>&13	ulelong	x	\b, entries 0x%x
112# the entries start here with object name
113>>>>&17	string	x	\b, 1st object "%s"
114
115
116#------------------------------------------------------------------------------
117# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $
118# adi: file(1) magic for ADi's objects
119# From Gregory McGarry <g.mcgarry@ieee.org>
120#
1210	leshort		0x521c		COFF DSP21k
122>18	lelong		&02		executable,
123>18	lelong		^02
124>>18	lelong		&01		static object,
125>>18	lelong		^01		relocatable object,
126>18	lelong		&010		stripped
127>18	lelong		^010		not stripped
128
129#------------------------------------------------------------------------------
130# $File: adventure,v 1.18 2019/04/19 00:42:27 christos Exp $
131# adventure: file(1) magic for Adventure game files
132#
133# from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
134# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998
135# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
136#
137# ALAN
138# I assume there are other, lower versions, but these are the only ones I
139# saw in the archive.
1400	beshort	0x0206	ALAN game data
141>2	byte	<10	version 2.6%d
142
143
144# Infocom (see z-machine)
145#------------------------------------------------------------------------------
146# Z-machine:  file(1) magic for Z-machine binaries.
147# Sanity checks by David Griffith <dave@661.org>
148# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
149#
150#http://www.gnelson.demon.co.uk/zspec/sect11.html
151#https://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt
152#https://en.wikipedia.org/wiki/Z-machine
153# The first byte is the Z-machine revision; it is always between 1 and 8. We
154# had false matches (for instance, inbig5.ocp from the Omega TeX extension as
155# well as an occasional MP3 file), so we sanity-check the version number.
156#
157# It might be possible to sanity-check the release number as well, as it seems
158# (at least in classic Infocom games) to always be a relatively small number,
159# always under 150 or so, but as this isn't rigorous, we'll wait on that until
160# it becomes clear that it's needed.
161#
1620	ubyte			>0
163>0	ubyte			<9
164>>16	belong&0xfe00f0f0	0x3030
165>>>0	ubyte			< 10
166>>>>2	ubeshort		x
167>>>>>18	regex			[0-9][0-9][0-9][0-9][0-9][0-9]
168>>>>>>0	ubyte			< 10	Infocom (Z-machine %d
169>>>>>>>2	ubeshort	x 	\b, Release %d
170>>>>>>>>18	string		>\0	\b, Serial %.6s
171>>>>>>>>18	string		x	\b)
172!:strength + 40
173!:mime	application/x-zmachine
174
175#------------------------------------------------------------------------------
176# Glulx:  file(1) magic for Glulx binaries.
177#
178# David Griffith <dave@661.org>
179# I haven't checked for false matches yet.
180#
1810	string			Glul	Glulx game data
182>4	beshort			x	(Version %d
183>>6	byte			x	\b.%d
184>>8	byte			x	\b.%d)
185>36	string			Info	Compiled by Inform
186!:mime	application/x-glulx
187
188
189# For Quetzal and blorb magic see iff
190
191
192# TADS (Text Adventure Development System) version 2
193#  All files are machine-independent (games compile to byte-code) and are tagged
194#  with a version string of the form "V2.<digit>.<digit>\0".
195#  Game files start with "TADS2 bin\n\r\032\0" then the compiler version.
1960	string	TADS2\ bin	TADS
197>9	belong  !0x0A0D1A00	game data, CORRUPTED
198>9	belong	 0x0A0D1A00
199>>13	string	>\0		%s game data
200!:mime	application/x-tads
201#  Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version.
2020	string	TADS2\ rsc	TADS
203>9	belong  !0x0A0D1A00	resource data, CORRUPTED
204>9	belong	 0x0A0D1A00
205>>13	string	>\0		%s resource data
206!:mime	application/x-tads
207#  Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
208#  2-byte length N, the N-char name of the game file *without* a NUL (darn!),
209# "TADS2 save\n\r\032\0" and the interpreter version.
2100	string	TADS2\ save/g	TADS
211>12	belong	!0x0A0D1A00	saved game data, CORRUPTED
212>12	belong	 0x0A0D1A00
213>>(16.s+32) string >\0		%s saved game data
214!:mime	application/x-tads
215#  Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter
216#  version.
2170	string	TADS2\ save	TADS
218>10	belong	!0x0A0D1A00	saved game data, CORRUPTED
219>10	belong	 0x0A0D1A00
220>>14	string	>\0		%s saved game data
221!:mime	application/x-tads
222
223# TADS (Text Adventure Development System) version 3
224#  Game files start with "T3-image\015\012\032"
2250	string	T3-image\015\012\032
226>11	leshort	x		TADS 3 game data (format version %d)
227#  Saved game files start with "T3-state-v####\015\012\032"
228#  where #### is a format version number
2290	string	T3-state-v
230>14	string	\015\012\032	TADS 3 saved game data (format version
231>>10	byte	x		%c
232>>11	byte	x		\b%c
233>>12	byte	x		\b%c
234>>13	byte	x		\b%c)
235!:mime	application/x-t3vm-image
236
237# edited by David Griffith <dave@661.org>
238# Danny Milosavljevic <danny.milo@gmx.net>
239# These are ADRIFT (adventure game standard) game files, extension .taf
240# Checked from source at (http://www.adrift.co/) and various taf files
241# found at the Interactive Fiction Archive (https://ifarchive.org/)
2420	belong  0x3C423FC9
243>4	belong  0x6A87C2CF	Adrift game file version
244>>8	belong  0x94453661	3.80
245>>8	belong  0x94453761	3.90
246>>8	belong  0x93453E61	4.0
247>>8	belong  0x92453E61	5.0
248>>8	default x		unknown
249!:mime	application/x-adrift
250
251#------------------------------------------------------------------------------
252# $File: algol68,v 1.3 2018/10/19 01:04:21 christos Exp $
253# algol68:  file(1) magic for Algol 68 source
254#
2550	search/8192	(input,			Algol 68 source text
256!:mime	text/x-Algol68
2570	regex/1024	\^PROC			Algol 68 source text
258!:mime	text/x-Algol68
2590	regex/1024	\bMODE[\t\ ]		Algol 68 source text
260!:mime	text/x-Algol68
2610	regex/1024	\bREF[\t\ ]		Algol 68 source text
262!:mime	text/x-Algol68
2630	regex/1024	\bFLEX[\t\ ]\*\\[	Algol 68 source text
264!:mime	text/x-Algol68
265#0	regex          	[\t\ ]OD		Algol 68 source text
266#!:mime	text/x-Algol68
267#0	regex          	[\t\ ]FI		Algol 68 source text
268#!:mime	text/x-Algol68
269
270#------------------------------------------------------------------------------
271# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $
272# allegro:  file(1) magic for Allegro datafiles
273# Toby Deshane <hac@shoelace.digivill.net>
274#
2750 belong 0x736C6821   Allegro datafile (packed)
2760 belong 0x736C682E   Allegro datafile (not packed/autodetect)
2770 belong 0x736C682B   Allegro datafile (appended exe data)
278
279#------------------------------------------------------------------------------
280# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $
281# alliant:  file(1) magic for Alliant FX series a.out files
282#
283# If the FX series is the one that had a processor with a 68K-derived
284# instruction set, the "short" should probably become "beshort" and the
285# "long" should probably become "belong".
286# If it's the i860-based one, they should probably become either the
287# big-endian or little-endian versions, depending on the mode they ran
288# the 860 in....
289#
2900	short		0420		0420 Alliant virtual executable
291>2	short		&0x0020		common library
292>16	long		>0		not stripped
2930	short		0421		0421 Alliant compact executable
294>2	short		&0x0020		common library
295>16	long		>0		not stripped
296
297#------------------------------------------------------------------------------
298# $File: amanda,v 1.6 2017/03/17 21:35:28 christos Exp $
299# amanda:  file(1) magic for amanda file format
300#
3010	string	AMANDA:\ 		AMANDA
302>8	string	TAPESTART\ DATE		tape header file,
303>>23	string	X
304>>>25	string	>\ 			Unused %s
305>>23	string	>\ 			DATE %s
306>8	string	FILE\ 			dump file,
307>>13	string	>\ 			DATE %s
308
309#------------------------------------------------------------------------------
310# $File: amigaos,v 1.17 2018/10/16 18:57:19 christos Exp $
311# amigaos:  file(1) magic for AmigaOS binary formats:
312
313#
314# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
315#
3160	belong		0x000003fa	AmigaOS shared library
3170	belong		0x000003f3	AmigaOS loadseg()ble executable/binary
3180	belong		0x000003e7	AmigaOS object/library data
319#
3200	beshort		0xe310		Amiga Workbench
321>2	beshort		1
322>>48	byte		1		disk icon
323>>48	byte		2		drawer icon
324>>48	byte		3		tool icon
325>>48	byte		4		project icon
326>>48	byte		5		garbage icon
327>>48	byte		6		device icon
328>>48	byte		7		kickstart icon
329>>48	byte		8		workbench application icon
330>2	beshort		>1		icon, vers. %d
331#
332# various sound formats from the Amiga
333# G=F6tz Waschk <waschk@informatik.uni-rostock.de>
334#
3350	string		FC14		Future Composer 1.4 Module sound file
3360	string		SMOD		Future Composer 1.3 Module sound file
3370	string		AON4artofnoise	Art Of Noise Module sound file
3381	string		MUGICIAN/SOFTEYES Mugician Module sound file
33958	string		SIDMON\ II\ -\ THE	Sidmon 2.0 Module sound file
3400	string		Synth4.0	Synthesis Module sound file
3410	string		ARP.		The Holy Noise Module sound file
3420	string		BeEp\0		JamCracker Module sound file
3430	string		COSO\0		Hippel-COSO Module sound file
344# Too simple (short, pure ASCII, deep), MPi
345#26	string		V.3		Brian Postma's Soundmon Module sound file v3
346#26	string		BPSM		Brian Postma's Soundmon Module sound file v3
347#26	string		V.2		Brian Postma's Soundmon Module sound file v2
348
349# The following are from: "Stefan A. Haubenthal" <polluks@web.de>
3500	beshort		0x0f00		AmigaOS bitmap font
3510	beshort		0x0f03		AmigaOS outline font
3520	belong		0x80001001	AmigaOS outline tag
3530	string		##\ version	catalog translation
3540	string		EMOD\0		Amiga E module
3558	string		ECXM\0		ECX module
3560	string/c	@database	AmigaGuide file
357
358# Amiga disk types
359#
3600	string		RDSK		Rigid Disk Block
361>160	string		x		on %.24s
3620	string		DOS\0		Amiga DOS disk
3630	string		DOS\1		Amiga FFS disk
3640	string		DOS\2		Amiga Inter DOS disk
3650	string		DOS\3		Amiga Inter FFS disk
3660	string		DOS\4		Amiga Fastdir DOS disk
3670	string		DOS\5		Amiga Fastdir FFS disk
3680	string		KICK		Kickstart disk
369
370# From: Alex Beregszaszi <alex@fsn.hu>
3710	string		LZX		LZX compressed archive (Amiga)
372
373# From: Przemek Kramarczyk <pkramarczyk@gmail.com>
3740	string 		.KEY		AmigaDOS script
3750	string 		.key		AmigaDOS script
376
377# AMOS Basic file formats
378# https://www.exotica.org.uk/wiki/AMOS_file_formats
3790	string		AMOS\040Basic\040 	AMOS Basic source code
380>11	byte		=0x56 			\b, tested
381>11	byte		=0x76 			\b, untested
3820 	string		AMOS\040Pro		AMOS Basic source code
383>11	byte		=0x56 			\b, tested
384>11	byte		=0x76 			\b, untested
3850	string		AmSp			AMOS Basic sprite bank
386>4	beshort		x			\b, %d sprites
3870	string		AmIc			AMOS Basic icon bank
388>4	beshort		x			\b, %d icons
3890	string		AmBk			AMOS Basic memory bank
390>4	beshort		x			\b, bank number %d
391>8	belong&0xFFFFFFF	x		\b, length %d
392>12	regex		.{8}			\b, type %s
3930	string		AmBs			AMOS Basic memory banks
394>4	beshort		x			\b, %d banks
395
396#------------------------------------------------------------
397# $File: android,v 1.12 2019/04/19 00:42:27 christos Exp $
398# Various android related magic entries
399#------------------------------------------------------------
400
401# Dalvik .dex format. http://retrodev.com/android/dexformat.html
402# From <mkf@google.com> "Mike Fleming"
403# Fixed to avoid regexec 17 errors on some dex files
404# From <diff@lookout.com> "Tim Strazzere"
4050	string	dex\n
406>0	regex	dex\n[0-9]{2}\0	Dalvik dex file
407>4	string	>000			version %s
4080	string	dey\n
409>0	regex	dey\n[0-9]{2}\0	Dalvik dex file (optimized for host)
410>4	string	>000			version %s
411
412# Android bootimg format
413# From https://android.googlesource.com/\
414# platform/system/core/+/master/mkbootimg/bootimg.h
4150		string	ANDROID!	Android bootimg
416>1024	string	LOKI\01		\b, LOKI'd
417>8		lelong	>0			\b, kernel
418>>12	lelong	>0			\b (0x%x)
419>16		lelong	>0			\b, ramdisk
420>>20	lelong	>0			\b (0x%x)
421>24		lelong	>0			\b, second stage
422>>28	lelong	>0			\b (0x%x)
423>36		lelong	>0			\b, page size: %d
424>38		string	>0			\b, name: %s
425>64		string	>0		 	\b, cmdline (%s)
426
427# Android Backup archive
428# From: Ariel Shkedi
429# Update: Joerg Jenderek
430# URL: https://github.com/android/platform_frameworks_base/blob/\
431# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\
432# android/server/BackupManagerService.java#L2367
433# Reference: https://sourceforge.net/projects/adbextractor/
434#            android-backup-extractor/perl/backupencrypt.pl
435# Note:	only unix line feeds "\n" found
436# After the header comes a tar file
437# If compressed, the entire tar file is compressed with JAVA deflate
438#
439# Include the version number hardcoded with the magic string to avoid
440# false positives
4410	string/b	ANDROID\ BACKUP\n	Android Backup
442# maybe look for some more characteristics like linefeed '\n' or version
443#>16	string		\n
444# No mime-type defined offically
445!:mime	application/x-google-ab
446!:ext	ab
447# on 2nd line version (often 1, 2 on kitkat 4.4.3+, 4 on 7.1.2)
448>15	string		>\0			\b, version %s
449# "1" on 3rd line means compressed
450>17	string		0\n			\b, Not-Compressed
451>17	string		1\n			\b, Compressed
452# The 4th line is encryption "none" or "AES-256"
453# any string as long as it's not the word none (which is matched below)
454>19	string		none\n			\b, Not-Encrypted
455# look for backup content after line with encryption info
456#>>19	search/7	\n
457# data part after header for not encrypted Android Backup
458#>>>&0	ubequad		x	\b, content 0x%16.16llx...
459# look for zlib compressed by ./compress after message with 1 space at end
460#>>>&0	indirect	x	\b; contains
461# look for tar archive block by ./archive for package name manifest
462>>288	string		ustar	\b; contains
463>>>31	use	tar-file
464# look for zip/jar archive by ./archive ./zip after message with 1 space at end
465#>>2079	search/1025/s	PK\003\004	\b; contains
466#>>>&0	indirect	x
467>19	string		!none
468>>19    regex/1l	\^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).*	\b, Encrypted (%s)
469# Commented out because they don't seem useful to print
470# (but they are part of the header - the tar file comes after them):
471# The 5th line is User Password Salt (128 Hex)
472# string length too high with standard src configuration
473#>>>&1		string	>\0	\b, PASSWORD salt: "%-128.128s"
474#>>>&1		regex/1l .*	\b, Password salt: %s
475# The 6th line is Master Key Checksum Salt (128 Hex)
476#>>>>&1		regex/1l .*	\b, Master salt: %s
477# The 7th line is Number of PBDKF2 Rounds (10000)
478#>>>>>&1	regex/1l .*	\b, PBKDF2 rounds: %s
479# The 8th line is User key Initialization Vector (IV) (32 Hex)
480#>>>>>>&1	regex/1l .*	\b, IV: %s
481#>>>>>>&1	regex/1l .*	\b, IV: %s
482# The 9th line is Master IV+Key+Checksum (192 Hex)
483#>>>>>>>&1	regex/1l .*	\b, Key: %s
484# look for new line separator char after line number 9
485#>>>0x204	ubyte	0x0a	NL found
486#>>>>&1		ubequad	x	\b, Content magic %16.16llx
487
488# *.pit files by Joerg Jenderek
489# https://forum.xda-developers.com/showthread.php?p=9122369
490# https://forum.xda-developers.com/showthread.php?t=816449
491# Partition Information Table for Samsung's smartphone with Android
492# used by flash software Odin
4930		ulelong			0x12349876
494# 1st pit entry marker
495>0x01C	ulequad&0xFFFFFFFCFFFFFFFC	=0x0000000000000000
496# minimal 13 and maximal 18 PIT entries found
497>>4		ulelong			<128	Partition Information Table for Samsung smartphone
498>>>4		ulelong			x	\b, %d entries
499# 1. pit entry
500>>>4		ulelong			>0	\b; #1
501>>>0x01C	use				PIT-entry
502>>>4		ulelong			>1	\b; #2
503>>>0x0A0	use				PIT-entry
504>>>4		ulelong			>2	\b; #3
505>>>0x124	use				PIT-entry
506>>>4		ulelong			>3	\b; #4
507>>>0x1A8	use				PIT-entry
508>>>4		ulelong			>4	\b; #5
509>>>0x22C	use				PIT-entry
510>>>4		ulelong			>5	\b; #6
511>>>0x2B0	use				PIT-entry
512>>>4		ulelong			>6	\b; #7
513>>>0x334	use				PIT-entry
514>>>4		ulelong			>7 	\b; #8
515>>>0x3B8	use				PIT-entry
516>>>4		ulelong			>8 	\b; #9
517>>>0x43C	use				PIT-entry
518>>>4		ulelong			>9	\b; #10
519>>>0x4C0	use				PIT-entry
520>>>4		ulelong			>10	\b; #11
521>>>0x544	use				PIT-entry
522>>>4		ulelong			>11	\b; #12
523>>>0x5C8	use				PIT-entry
524>>>4		ulelong			>12	\b; #13
525>>>>0x64C	use				PIT-entry
526# 14. pit entry
527>>>4		ulelong			>13	\b; #14
528>>>>0x6D0	use				PIT-entry
529>>>4		ulelong			>14	\b; #15
530>>>0x754	use				PIT-entry
531>>>4		ulelong			>15	\b; #16
532>>>0x7D8	use				PIT-entry
533>>>4		ulelong			>16	\b; #17
534>>>0x85C	use				PIT-entry
535# 18. pit entry
536>>>4		ulelong			>17	\b; #18
537>>>0x8E0	use				PIT-entry
538
5390	name			PIT-entry
540# garbage value implies end of pit entries
541>0x00		ulequad&0xFFFFFFFCFFFFFFFC	=0x0000000000000000
542# skip empty partition name
543>>0x24		ubyte				!0
544# partition name
545>>>0x24		string				>\0			%-.32s
546# flags
547>>>0x0C		ulelong&0x00000002		2			\b+RW
548# partition ID:
549# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~KENREl,RECOVER,misc;7~RECOVER
550# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW
551>>>0x08	ulelong		x			(0x%x)
552# filename
553>>>0x44		string				>\0			"%-.64s"
554#>>>0x18	ulelong				>0
555# blocksize in 512 byte units ?
556#>>>>0x18	ulelong				x			\b, %db
557# partition size in blocks ?
558#>>>>0x22	ulelong				x			\b*%d
559
560# Android sparse img format
561# From https://android.googlesource.com/\
562# platform/system/core/+/master/libsparse/sparse_format.h
5630		lelong	0xed26ff3a		Android sparse image
564>4		leshort	x			\b, version: %d
565>6		leshort	x			\b.%d
566>16		lelong	x			\b, Total of %d
567>12		lelong	x			\b %d-byte output blocks in
568>20		lelong	x			\b %d input chunks.
569
570# Android binary XML magic
571# In include/androidfw/ResourceTypes.h:
572# RES_XML_TYPE = 0x0003 followed by the size of the header (ResXMLTree_header),
573# which is 8 bytes (2 bytes type + 2 bytes header size + 4 bytes size).
5740	lelong	0x00080003	Android binary XML
575
576#------------------------------------------------------------------------------
577# $File: animation,v 1.71 2019/04/19 00:42:27 christos Exp $
578# animation:  file(1) magic for animation/movie formats
579#
580# animation formats
581# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
582# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
583
584# SGI and Apple formats
5850	string		MOVI		Silicon Graphics movie file
586!:mime	video/x-sgi-movie
5874       string          moov            Apple QuickTime
588!:mime	video/quicktime
589>12     string          mvhd            \b movie (fast start)
590>12     string          mdra            \b URL
591>12     string          cmov            \b movie (fast start, compressed header)
592>12     string          rmra            \b multiple URLs
5934       string          mdat            Apple QuickTime movie (unoptimized)
594!:mime	video/quicktime
595#4       string          wide            Apple QuickTime movie (unoptimized)
596#!:mime	video/quicktime
597#4       string          skip            Apple QuickTime movie (modified)
598#!:mime	video/quicktime
599#4       string          free            Apple QuickTime movie (modified)
600#!:mime	video/quicktime
6014       string          idsc            Apple QuickTime image (fast start)
602!:mime	image/x-quicktime
603#4       string          idat            Apple QuickTime image (unoptimized)
604#!:mime	image/x-quicktime
6054       string          pckg            Apple QuickTime compressed archive
606!:mime	application/x-quicktime-player
6074	string/W	jP		JPEG 2000 image
608!:mime	image/jp2
609# https://www.ftyps.com/ with local additions
6104	string		ftyp		ISO Media
611# https://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/
612>8	string		XAVC		\b, MPEG v4 system, Sony XAVC Codec
613>>96	string		x		\b, Audio "%.4s"
614>>118	beshort		x		at %dHz
615>>140	string		x		\b, Video "%.4s"
616>>168	beshort		x		%d
617>>170	beshort		x		\bx%d
618>8	string		3g2		\b, MPEG v4 system, 3GPP2
619!:mime	video/3gpp2
620>>11	byte		4		\b v4 (H.263/AMR GSM 6.10)
621>>11	byte		5		\b v5 (H.263/AMR GSM 6.10)
622>>11	byte		6		\b v6 (ITU H.264/AMR GSM 6.10)
623# https://www.3gpp2.org/Public_html/Specs/C.S0050-B_v1.0_070521.pdf
624# Section 8.1.1, corresponds to a, b, c
625>>11	byte		0x61		\b C.S0050-0 V1.0
626>>11	byte		0x62		\b C.S0050-0-A V1.0.0
627>>11	byte		0x63		\b C.S0050-0-B V1.0
628>8	string		3ge		\b, MPEG v4 system, 3GPP
629!:mime	video/3gpp
630>>11	byte		6		\b, Release 6 MBMS Extended Presentations
631>>11	byte		7		\b, Release 7 MBMS Extended Presentations
632>8	string		3gg		\b, MPEG v4 system, 3GPP
633!:mime	video/3gpp
634>>11	byte		6		\b, Release 6 General Profile
635>8	string		3gp		\b, MPEG v4 system, 3GPP
636!:mime	video/3gpp
637>>11	byte		1		\b, Release %d (non existent)
638>>11	byte		2		\b, Release %d (non existent)
639>>11	byte		3		\b, Release %d (non existent)
640>>11	byte		4		\b, Release %d
641>>11	byte		5		\b, Release %d
642>>11	byte		6		\b, Release %d
643>>11	byte		7		\b, Release %d Streaming Servers
644>8	string		3gs		\b, MPEG v4 system, 3GPP
645!:mime	video/3gpp
646>>11	byte		7		\b, Release %d Streaming Servers
647>8	string		avc1		\b, MPEG v4 system, 3GPP JVT AVC [ISO 14496-12:2005]
648!:mime	video/mp4
649>8	string/W	qt		\b, Apple QuickTime movie
650!:mime	video/quicktime
651>8	string		CAEP		\b, Canon Digital Camera
652>8	string		caqv		\b, Casio Digital Camera
653>8	string		CDes		\b, Convergent Design
654>8	string		da0a		\b, DMB MAF w/ MPEG Layer II aud, MOT slides, DLS, JPG/PNG/MNG
655>8	string		da0b		\b, DMB MAF, ext DA0A, with 3GPP timed text, DID, TVA, REL, IPMP
656>8	string		da1a		\b, DMB MAF audio with ER-BSAC audio, JPG/PNG/MNG images
657>8	string		da1b		\b, DMB MAF, ext da1a, with 3GPP timed text, DID, TVA, REL, IPMP
658>8	string		da2a		\b, DMB MAF aud w/ HE-AAC v2 aud, MOT slides, DLS, JPG/PNG/MNG
659>8	string		da2b		\b, DMB MAF, ext da2a, with 3GPP timed text, DID, TVA, REL, IPMP
660>8	string		da3a		\b, DMB MAF aud with HE-AAC aud, JPG/PNG/MNG images
661>8	string		da3b		\b, DMB MAF, ext da3a w/ BIFS, 3GPP, DID, TVA, REL, IPMP
662>8	string		dash		\b, MPEG v4 system, Dynamic Adaptive Streaming over HTTP
663!:mime	video/mp4
664>8	string		dmb1		\b, DMB MAF supporting all the components defined in the spec
665>8	string		dmpf		\b, Digital Media Project
666>8	string		drc1		\b, Dirac (wavelet compression), encap in ISO base media (MP4)
667>8	string		dv1a		\b, DMB MAF vid w/ AVC vid, ER-BSAC aud, BIFS, JPG/PNG/MNG, TS
668>8	string		dv1b		\b, DMB MAF, ext dv1a, with 3GPP timed text, DID, TVA, REL, IPMP
669>8	string		dv2a		\b, DMB MAF vid w/ AVC vid, HE-AAC v2 aud, BIFS, JPG/PNG/MNG, TS
670>8	string		dv2b		\b, DMB MAF, ext dv2a, with 3GPP timed text, DID, TVA, REL, IPMP
671>8	string		dv3a		\b, DMB MAF vid w/ AVC vid, HE-AAC aud, BIFS, JPG/PNG/MNG, TS
672>8	string		dv3b		\b, DMB MAF, ext dv3a, with 3GPP timed text, DID, TVA, REL, IPMP
673>8	string		dvr1		\b, DVB (.DVB) over RTP
674!:mime	video/vnd.dvb.file
675>8	string		dvt1		\b, DVB (.DVB) over MPEG-2 Transport Stream
676!:mime	video/vnd.dvb.file
677>8	string		F4V		\b, Video for Adobe Flash Player 9+ (.F4V)
678!:mime	video/mp4
679>8	string		F4P		\b, Protected Video for Adobe Flash Player 9+ (.F4P)
680!:mime	video/mp4
681>8	string		F4A		\b, Audio for Adobe Flash Player 9+ (.F4A)
682!:mime	audio/mp4
683>8	string		F4B		\b, Audio Book for Adobe Flash Player 9+ (.F4B)
684!:mime	audio/mp4
685>8	string		isc2		\b, ISMACryp 2.0 Encrypted File
686#	?/enc-isoff-generic
687>8	string		iso2		\b, MP4 Base Media v2 [ISO 14496-12:2005]
688!:mime	video/mp4
689>8	string		isom		\b, MP4 Base Media v1 [IS0 14496-12:2003]
690!:mime	video/mp4
691>8	string/W	jp2		\b, JPEG 2000
692!:mime	image/jp2
693>8	string		JP2		\b, JPEG 2000 Image (.JP2) [ISO 15444-1 ?]
694!:mime	image/jp2
695>8	string		JP20		\b, Unknown, from GPAC samples (prob non-existent)
696>8	string		jpm		\b, JPEG 2000 Compound Image (.JPM) [ISO 15444-6]
697!:mime	image/jpm
698>8	string		jpx		\b, JPEG 2000 w/ extensions (.JPX) [ISO 15444-2]
699!:mime	image/jpx
700>8	string		KDDI		\b, 3GPP2 EZmovie for KDDI 3G cellphones
701!:mime	video/3gpp2
702>8	string		M4A 		\b, Apple iTunes ALAC/AAC-LC (.M4A) Audio
703!:mime	audio/x-m4a
704>8	string		M4B 		\b, Apple iTunes ALAC/AAC-LC (.M4B) Audio Book
705!:mime	audio/mp4
706>8	string		M4P 		\b, Apple iTunes ALAC/AAC-LC (.M4P) AES Protected Audio
707!:mime	video/mp4
708>8	string		M4V 		\b, Apple iTunes Video (.M4V) Video
709!:mime	video/x-m4v
710>8	string		M4VH		\b, Apple TV (.M4V)
711!:mime	video/x-m4v
712>8	string		M4VP		\b, Apple iPhone (.M4V)
713!:mime	video/x-m4v
714>8	string		mj2s		\b, Motion JPEG 2000 [ISO 15444-3] Simple Profile
715!:mime	video/mj2
716>8	string		mjp2		\b, Motion JPEG 2000 [ISO 15444-3] General Profile
717!:mime	video/mj2
718>8	string		mmp4		\b, MPEG-4/3GPP Mobile Profile (.MP4 / .3GP) (for NTT)
719!:mime	video/mp4
720>8	string		mobi		\b, MPEG-4, MOBI format
721!:mime	video/mp4
722>8	string		mp21		\b, MPEG-21 [ISO/IEC 21000-9]
723>8	string		mp41		\b, MP4 v1 [ISO 14496-1:ch13]
724!:mime	video/mp4
725>8	string		mp42		\b, MP4 v2 [ISO 14496-14]
726!:mime	video/mp4
727>8	string		mp71		\b, MP4 w/ MPEG-7 Metadata [per ISO 14496-12]
728>8	string		mp7t		\b, MPEG v4 system, MPEG v7 XML
729>8	string		mp7b		\b, MPEG v4 system, MPEG v7 binary XML
730>8	string		mmp4		\b, MPEG v4 system, 3GPP Mobile
731!:mime	video/mp4
732>8	string		MPPI		\b, Photo Player, MAF [ISO/IEC 23000-3]
733>8	string		mqt		\b, Sony / Mobile QuickTime (.MQV) US Pat 7,477,830
734!:mime	video/quicktime
735>8	string		MSNV		\b, MPEG-4 (.MP4) for SonyPSP
736!:mime	audio/mp4
737>8	string		NDAS		\b, MP4 v2 [ISO 14496-14] Nero Digital AAC Audio
738!:mime	audio/mp4
739>8	string		NDSC		\b, MPEG-4 (.MP4) Nero Cinema Profile
740!:mime	video/mp4
741>8	string		NDSH		\b, MPEG-4 (.MP4) Nero HDTV Profile
742!:mime	video/mp4
743>8	string		NDSM		\b, MPEG-4 (.MP4) Nero Mobile Profile
744!:mime	video/mp4
745>8	string		NDSP		\b, MPEG-4 (.MP4) Nero Portable Profile
746!:mime	video/mp4
747>8	string		NDSS		\b, MPEG-4 (.MP4) Nero Standard Profile
748!:mime	video/mp4
749>8	string		NDXC		\b, H.264/MPEG-4 AVC (.MP4) Nero Cinema Profile
750!:mime	video/mp4
751>8	string		NDXH		\b, H.264/MPEG-4 AVC (.MP4) Nero HDTV Profile
752!:mime	video/mp4
753>8	string		NDXM		\b, H.264/MPEG-4 AVC (.MP4) Nero Mobile Profile
754!:mime	video/mp4
755>8	string		NDXP		\b, H.264/MPEG-4 AVC (.MP4) Nero Portable Profile
756!:mime	video/mp4
757>8	string		NDXS		\b, H.264/MPEG-4 AVC (.MP4) Nero Standard Profile
758!:mime	video/mp4
759>8	string		odcf  		\b, OMA DCF DRM Format 2.0 (OMA-TS-DRM-DCF-V2_0-20060303-A)
760>8	string		opf2 		\b, OMA PDCF DRM Format 2.1 (OMA-TS-DRM-DCF-V2_1-20070724-C)
761>8	string		opx2  		\b, OMA PDCF DRM + XBS ext (OMA-TS-DRM_XBS-V1_0-20070529-C)
762>8	string		pana		\b, Panasonic Digital Camera
763>8	string		qt  		\b, Apple QuickTime (.MOV/QT)
764!:mime	video/quicktime
765# HEIF image format
766# see https://nokiatech.github.io/heif/technical.html
767>8	string		mif1		\b, HEIF Image
768!:mime image/heif
769>8	string		msf1		\b, HEIF Image Sequence
770!:mime image/heif-sequence
771>8	string		heic		\b, HEIF Image HEVC Main or Main Still Picture Profile
772!:mime image/heic
773>8	string		heix		\b, HEIF Image HEVC Main 10 Profile
774!:mime image/heic
775>8	string		hevc		\b, HEIF Image Sequenz HEVC Main or Main Still Picture Profile
776!:mime image/heic-sequence
777>8	string		hevx		\b, HEIF Image Sequence HEVC Main 10 Profile
778!:mime image/heic-sequence
779# following HEIF brands are not mentioned in the heif technical info currently (Oct 2017)
780# but used in the reference implementation:
781# https://github.com/nokiatech/heif/blob/d5e9a21c8ba8df712bdf643021dd9f6518134776/Srcs/reader/hevcimagefilereader.cpp
782>8	string		heim		\b, HEIF Image L-HEVC
783!:mime image/heif
784>8	string		heis		\b, HEIF Image L-HEVC
785!:mime image/heif
786>8	string		avic		\b, HEIF Image AVC
787!:mime image/heif
788>8	string		hevm		\b, HEIF Image Sequence L-HEVC
789!:mime image/heif-sequence
790>8	string		hevs		\b, HEIF Image Sequence L-HEVC
791!:mime image/heif-sequence
792>8	string		avcs		\b, HEIF Image Sequence AVC
793!:mime image/heif-sequence
794
795>8	string		ROSS		\b, Ross Video
796>8	string		sdv		\b, SD Memory Card Video
797>8	string		ssc1		\b, Samsung stereo, single stream (patent pending)
798>8	string		ssc2		\b, Samsung stereo, dual stream (patent pending)
799
800# MPEG sequences
801# Scans for all common MPEG header start codes
8020	 belong		    0x00000001
803>4	 byte&0x1F	    0x07	   JVT NAL sequence, H.264 video
804>>5      byte               66             \b, baseline
805>>5      byte               77             \b, main
806>>5      byte               88             \b, extended
807>>7      byte               x              \b @ L %u
8080        belong&0xFFFFFF00  0x00000100
809>3       byte               0xBA           MPEG sequence
810!:mime  video/mpeg
811>>4      byte               &0x40          \b, v2, program multiplex
812>>4      byte               ^0x40          \b, v1, system multiplex
813>3       byte               0xBB           MPEG sequence, v1/2, multiplex (missing pack header)
814>3       byte&0x1F          0x07           MPEG sequence, H.264 video
815>>4      byte               66             \b, baseline
816>>4      byte               77             \b, main
817>>4      byte               88             \b, extended
818>>6      byte               x              \b @ L %u
819# GRR too general as it catches also FoxPro Memo example NG.FPT
820>3       byte               0xB0           MPEG sequence, v4
821# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000
822#>>4      byte               !0             MPEG sequence, v4
823!:mime  video/mpeg4-generic
824>>5      belong             0x000001B5
825>>>9     byte               &0x80
826>>>>10   byte&0xF0          16             \b, video
827>>>>10   byte&0xF0          32             \b, still texture
828>>>>10   byte&0xF0          48             \b, mesh
829>>>>10   byte&0xF0          64             \b, face
830>>>9     byte&0xF8          8              \b, video
831>>>9     byte&0xF8          16             \b, still texture
832>>>9     byte&0xF8          24             \b, mesh
833>>>9     byte&0xF8          32             \b, face
834>>4      byte               1              \b, simple @ L1
835>>4      byte               2              \b, simple @ L2
836>>4      byte               3              \b, simple @ L3
837>>4      byte               4              \b, simple @ L0
838>>4      byte               17             \b, simple scalable @ L1
839>>4      byte               18             \b, simple scalable @ L2
840>>4      byte               33             \b, core @ L1
841>>4      byte               34             \b, core @ L2
842>>4      byte               50             \b, main @ L2
843>>4      byte               51             \b, main @ L3
844>>4      byte               53             \b, main @ L4
845>>4      byte               66             \b, n-bit @ L2
846>>4      byte               81             \b, scalable texture @ L1
847>>4      byte               97             \b, simple face animation @ L1
848>>4      byte               98             \b, simple face animation @ L2
849>>4      byte               99             \b, simple face basic animation @ L1
850>>4      byte               100            \b, simple face basic animation @ L2
851>>4      byte               113            \b, basic animation text @ L1
852>>4      byte               114            \b, basic animation text @ L2
853>>4      byte               129            \b, hybrid @ L1
854>>4      byte               130            \b, hybrid @ L2
855>>4      byte               145            \b, advanced RT simple @ L!
856>>4      byte               146            \b, advanced RT simple @ L2
857>>4      byte               147            \b, advanced RT simple @ L3
858>>4      byte               148            \b, advanced RT simple @ L4
859>>4      byte               161            \b, core scalable @ L1
860>>4      byte               162            \b, core scalable @ L2
861>>4      byte               163            \b, core scalable @ L3
862>>4      byte               177            \b, advanced coding efficiency @ L1
863>>4      byte               178            \b, advanced coding efficiency @ L2
864>>4      byte               179            \b, advanced coding efficiency @ L3
865>>4      byte               180            \b, advanced coding efficiency @ L4
866>>4      byte               193            \b, advanced core @ L1
867>>4      byte               194            \b, advanced core @ L2
868>>4      byte               209            \b, advanced scalable texture @ L1
869>>4      byte               210            \b, advanced scalable texture @ L2
870>>4      byte               211            \b, advanced scalable texture @ L3
871>>4      byte               225            \b, simple studio @ L1
872>>4      byte               226            \b, simple studio @ L2
873>>4      byte               227            \b, simple studio @ L3
874>>4      byte               228            \b, simple studio @ L4
875>>4      byte               229            \b, core studio @ L1
876>>4      byte               230            \b, core studio @ L2
877>>4      byte               231            \b, core studio @ L3
878>>4      byte               232            \b, core studio @ L4
879>>4      byte               240            \b, advanced simple @ L0
880>>4      byte               241            \b, advanced simple @ L1
881>>4      byte               242            \b, advanced simple @ L2
882>>4      byte               243            \b, advanced simple @ L3
883>>4      byte               244            \b, advanced simple @ L4
884>>4      byte               245            \b, advanced simple @ L5
885>>4      byte               247            \b, advanced simple @ L3b
886>>4      byte               248            \b, FGS @ L0
887>>4      byte               249            \b, FGS @ L1
888>>4      byte               250            \b, FGS @ L2
889>>4      byte               251            \b, FGS @ L3
890>>4      byte               252            \b, FGS @ L4
891>>4      byte               253            \b, FGS @ L5
892>3       byte               0xB5           MPEG sequence, v4
893!:mime  video/mpeg4-generic
894>>4      byte               &0x80
895>>>5     byte&0xF0          16             \b, video (missing profile header)
896>>>5     byte&0xF0          32             \b, still texture (missing profile header)
897>>>5     byte&0xF0          48             \b, mesh (missing profile header)
898>>>5     byte&0xF0          64             \b, face (missing profile header)
899>>4      byte&0xF8          8              \b, video (missing profile header)
900>>4      byte&0xF8          16             \b, still texture (missing profile header)
901>>4      byte&0xF8          24             \b, mesh (missing profile header)
902>>4      byte&0xF8          32             \b, face (missing profile header)
903>3       byte               0xB3           MPEG sequence
904!:mime  video/mpeg
905>>12     belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
906>>12     belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
907>>12     belong             0x000001B5     \b, v2,
908>>>16    byte&0x0F          1              \b HP
909>>>16    byte&0x0F          2              \b Spt
910>>>16    byte&0x0F          3              \b SNR
911>>>16    byte&0x0F          4              \b MP
912>>>16    byte&0x0F          5              \b SP
913>>>17    byte&0xF0          64             \b@HL
914>>>17    byte&0xF0          96             \b@H-14
915>>>17    byte&0xF0          128            \b@ML
916>>>17    byte&0xF0          160            \b@LL
917>>>17    byte               &0x08          \b progressive
918>>>17    byte               ^0x08          \b interlaced
919>>>17    byte&0x06          2              \b Y'CbCr 4:2:0 video
920>>>17    byte&0x06          4              \b Y'CbCr 4:2:2 video
921>>>17    byte&0x06          6              \b Y'CbCr 4:4:4 video
922>>11     byte               &0x02
923>>>75    byte               &0x01
924>>>>140  belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
925>>>>140  belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
926>>>>140  belong             0x000001B5     \b, v2,
927>>>>>144 byte&0x0F          1              \b HP
928>>>>>144 byte&0x0F          2              \b Spt
929>>>>>144 byte&0x0F          3              \b SNR
930>>>>>144 byte&0x0F          4              \b MP
931>>>>>144 byte&0x0F          5              \b SP
932>>>>>145 byte&0xF0          64             \b@HL
933>>>>>145 byte&0xF0          96             \b@H-14
934>>>>>145 byte&0xF0          128            \b@ML
935>>>>>145 byte&0xF0          160            \b@LL
936>>>>>145 byte               &0x08          \b progressive
937>>>>>145 byte               ^0x08          \b interlaced
938>>>>>145 byte&0x06          2              \b Y'CbCr 4:2:0 video
939>>>>>145 byte&0x06          4              \b Y'CbCr 4:2:2 video
940>>>>>145 byte&0x06          6              \b Y'CbCr 4:4:4 video
941>>76    belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
942>>76    belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
943>>76    belong             0x000001B5     \b, v2,
944>>>80   byte&0x0F          1              \b HP
945>>>80   byte&0x0F          2              \b Spt
946>>>80   byte&0x0F          3              \b SNR
947>>>80   byte&0x0F          4              \b MP
948>>>80   byte&0x0F          5              \b SP
949>>>81   byte&0xF0          64             \b@HL
950>>>81   byte&0xF0          96             \b@H-14
951>>>81   byte&0xF0          128            \b@ML
952>>>81   byte&0xF0          160            \b@LL
953>>>81   byte               &0x08          \b progressive
954>>>81   byte               ^0x08          \b interlaced
955>>>81   byte&0x06          2              \b Y'CbCr 4:2:0 video
956>>>81   byte&0x06          4              \b Y'CbCr 4:2:2 video
957>>>81   byte&0x06          6              \b Y'CbCr 4:4:4 video
958>>4      belong&0xFFFFFF00  0x78043800     \b, HD-TV 1920P
959>>>7     byte&0xF0          0x10           \b, 16:9
960>>4      belong&0xFFFFFF00  0x50002D00     \b, SD-TV 1280I
961>>>7     byte&0xF0          0x10           \b, 16:9
962>>4      belong&0xFFFFFF00  0x30024000     \b, PAL Capture
963>>>7     byte&0xF0          0x10           \b, 4:3
964>>4      beshort&0xFFF0     0x2C00         \b, 4CIF
965>>>5     beshort&0x0FFF     0x01E0         \b NTSC
966>>>5     beshort&0x0FFF     0x0240         \b PAL
967>>>7     byte&0xF0          0x20           \b, 4:3
968>>>7     byte&0xF0          0x30           \b, 16:9
969>>>7     byte&0xF0          0x40           \b, 11:5
970>>>7     byte&0xF0          0x80           \b, PAL 4:3
971>>>7     byte&0xF0          0xC0           \b, NTSC 4:3
972>>4      belong&0xFFFFFF00  0x2801E000     \b, LD-TV 640P
973>>>7     byte&0xF0          0x10           \b, 4:3
974>>4      belong&0xFFFFFF00  0x1400F000     \b, 320x240
975>>>7     byte&0xF0          0x10           \b, 4:3
976>>4      belong&0xFFFFFF00  0x0F00A000     \b, 240x160
977>>>7     byte&0xF0          0x10           \b, 4:3
978>>4      belong&0xFFFFFF00  0x0A007800     \b, 160x120
979>>>7     byte&0xF0          0x10           \b, 4:3
980>>4      beshort&0xFFF0     0x1600         \b, CIF
981>>>5     beshort&0x0FFF     0x00F0         \b NTSC
982>>>5     beshort&0x0FFF     0x0120         \b PAL
983>>>7     byte&0xF0          0x20           \b, 4:3
984>>>7     byte&0xF0          0x30           \b, 16:9
985>>>7     byte&0xF0          0x40           \b, 11:5
986>>>7     byte&0xF0          0x80           \b, PAL 4:3
987>>>7     byte&0xF0          0xC0           \b, NTSC 4:3
988>>>5     beshort&0x0FFF     0x0240         \b PAL 625
989>>>>7    byte&0xF0          0x20           \b, 4:3
990>>>>7    byte&0xF0          0x30           \b, 16:9
991>>>>7    byte&0xF0          0x40           \b, 11:5
992>>4      beshort&0xFFF0     0x2D00         \b, CCIR/ITU
993>>>5     beshort&0x0FFF     0x01E0         \b NTSC 525
994>>>5     beshort&0x0FFF     0x0240         \b PAL 625
995>>>7     byte&0xF0          0x20           \b, 4:3
996>>>7     byte&0xF0          0x30           \b, 16:9
997>>>7     byte&0xF0          0x40           \b, 11:5
998>>4      beshort&0xFFF0     0x1E00         \b, SVCD
999>>>5     beshort&0x0FFF     0x01E0         \b NTSC 525
1000>>>5     beshort&0x0FFF     0x0240         \b PAL 625
1001>>>7     byte&0xF0          0x20           \b, 4:3
1002>>>7     byte&0xF0          0x30           \b, 16:9
1003>>>7     byte&0xF0          0x40           \b, 11:5
1004>>7      byte&0x0F          1              \b, 23.976 fps
1005>>7      byte&0x0F          2              \b, 24 fps
1006>>7      byte&0x0F          3              \b, 25 fps
1007>>7      byte&0x0F          4              \b, 29.97 fps
1008>>7      byte&0x0F          5              \b, 30 fps
1009>>7      byte&0x0F          6              \b, 50 fps
1010>>7      byte&0x0F          7              \b, 59.94 fps
1011>>7      byte&0x0F          8              \b, 60 fps
1012>>11     byte               &0x04          \b, Constrained
1013
1014# MPEG ADTS Audio (*.mpx/mxa/aac)
1015# from dreesen@math.fu-berlin.de
1016# modified to fully support MPEG ADTS
1017
1018# MP3, M1A
1019# modified by Joerg Jenderek
1020# GRR the original test are too common for many DOS files
1021# so don't accept as MP3 until we've tested the rate
10220       beshort&0xFFFE  0xFFFA
1023# rates
1024>2      byte&0xF0       0x10           MPEG ADTS, layer III, v1,  32 kbps
1025!:mime	audio/mpeg
1026>2      byte&0xF0       0x20           MPEG ADTS, layer III, v1,  40 kbps
1027!:mime	audio/mpeg
1028>2      byte&0xF0       0x30           MPEG ADTS, layer III, v1,  48 kbps
1029!:mime	audio/mpeg
1030>2      byte&0xF0       0x40           MPEG ADTS, layer III, v1,  56 kbps
1031!:mime	audio/mpeg
1032>2      byte&0xF0       0x50           MPEG ADTS, layer III, v1,  64 kbps
1033!:mime	audio/mpeg
1034>2      byte&0xF0       0x60           MPEG ADTS, layer III, v1,  80 kbps
1035!:mime	audio/mpeg
1036>2      byte&0xF0       0x70           MPEG ADTS, layer III, v1,  96 kbps
1037!:mime	audio/mpeg
1038>2      byte&0xF0       0x80           MPEG ADTS, layer III, v1, 112 kbps
1039!:mime	audio/mpeg
1040>2      byte&0xF0       0x90           MPEG ADTS, layer III, v1, 128 kbps
1041!:mime	audio/mpeg
1042>2      byte&0xF0       0xA0           MPEG ADTS, layer III, v1, 160 kbps
1043!:mime	audio/mpeg
1044>2      byte&0xF0       0xB0           MPEG ADTS, layer III, v1, 192 kbps
1045!:mime	audio/mpeg
1046>2      byte&0xF0       0xC0           MPEG ADTS, layer III, v1, 224 kbps
1047!:mime	audio/mpeg
1048>2      byte&0xF0       0xD0           MPEG ADTS, layer III, v1, 256 kbps
1049!:mime	audio/mpeg
1050>2      byte&0xF0       0xE0           MPEG ADTS, layer III, v1, 320 kbps
1051!:mime	audio/mpeg
1052# timing
1053>2      byte&0x0C       0x00           \b, 44.1 kHz
1054>2      byte&0x0C       0x04           \b, 48 kHz
1055>2      byte&0x0C       0x08           \b, 32 kHz
1056# channels/options
1057>3      byte&0xC0       0x00           \b, Stereo
1058>3      byte&0xC0       0x40           \b, JntStereo
1059>3      byte&0xC0       0x80           \b, 2x Monaural
1060>3      byte&0xC0       0xC0           \b, Monaural
1061#>1     byte            ^0x01          \b, Data Verify
1062#>2     byte            &0x02          \b, Packet Pad
1063#>2     byte            &0x01          \b, Custom Flag
1064#>3     byte            &0x08          \b, Copyrighted
1065#>3     byte            &0x04          \b, Original Source
1066#>3     byte&0x03       1              \b, NR: 50/15 ms
1067#>3     byte&0x03       3              \b, NR: CCIT J.17
1068
1069# MP2, M1A
10700       beshort&0xFFFE  0xFFFC         MPEG ADTS, layer II, v1
1071!:mime	audio/mpeg
1072# rates
1073>2      byte&0xF0       0x10           \b,  32 kbps
1074>2      byte&0xF0       0x20           \b,  48 kbps
1075>2      byte&0xF0       0x30           \b,  56 kbps
1076>2      byte&0xF0       0x40           \b,  64 kbps
1077>2      byte&0xF0       0x50           \b,  80 kbps
1078>2      byte&0xF0       0x60           \b,  96 kbps
1079>2      byte&0xF0       0x70           \b, 112 kbps
1080>2      byte&0xF0       0x80           \b, 128 kbps
1081>2      byte&0xF0       0x90           \b, 160 kbps
1082>2      byte&0xF0       0xA0           \b, 192 kbps
1083>2      byte&0xF0       0xB0           \b, 224 kbps
1084>2      byte&0xF0       0xC0           \b, 256 kbps
1085>2      byte&0xF0       0xD0           \b, 320 kbps
1086>2      byte&0xF0       0xE0           \b, 384 kbps
1087# timing
1088>2      byte&0x0C       0x00           \b, 44.1 kHz
1089>2      byte&0x0C       0x04           \b, 48 kHz
1090>2      byte&0x0C       0x08           \b, 32 kHz
1091# channels/options
1092>3      byte&0xC0       0x00           \b, Stereo
1093>3      byte&0xC0       0x40           \b, JntStereo
1094>3      byte&0xC0       0x80           \b, 2x Monaural
1095>3      byte&0xC0       0xC0           \b, Monaural
1096#>1     byte            ^0x01          \b, Data Verify
1097#>2     byte            &0x02          \b, Packet Pad
1098#>2     byte            &0x01          \b, Custom Flag
1099#>3     byte            &0x08          \b, Copyrighted
1100#>3     byte            &0x04          \b, Original Source
1101#>3     byte&0x03       1              \b, NR: 50/15 ms
1102#>3     byte&0x03       3              \b, NR: CCIT J.17
1103
1104# MPA, M1A
1105# updated by Joerg Jenderek
1106# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448
1107# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE)
1108# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries
1109#0	beshort&0xFFFE		0xFFFE
1110#>2	ubyte&0xF0	>0x0F
1111#>>2	ubyte&0xF0	<0xE1		MPEG ADTS, layer I, v1
1112## rate
1113#>>>2      byte&0xF0       0x10           \b,  32 kbps
1114#>>>2      byte&0xF0       0x20           \b,  64 kbps
1115#>>>2      byte&0xF0       0x30           \b,  96 kbps
1116#>>>2      byte&0xF0       0x40           \b, 128 kbps
1117#>>>2      byte&0xF0       0x50           \b, 160 kbps
1118#>>>2      byte&0xF0       0x60           \b, 192 kbps
1119#>>>2      byte&0xF0       0x70           \b, 224 kbps
1120#>>>2      byte&0xF0       0x80           \b, 256 kbps
1121#>>>2      byte&0xF0       0x90           \b, 288 kbps
1122#>>>2      byte&0xF0       0xA0           \b, 320 kbps
1123#>>>2      byte&0xF0       0xB0           \b, 352 kbps
1124#>>>2      byte&0xF0       0xC0           \b, 384 kbps
1125#>>>2      byte&0xF0       0xD0           \b, 416 kbps
1126#>>>2      byte&0xF0       0xE0           \b, 448 kbps
1127## timing
1128#>>>2      byte&0x0C       0x00           \b, 44.1 kHz
1129#>>>2      byte&0x0C       0x04           \b, 48 kHz
1130#>>>2      byte&0x0C       0x08           \b, 32 kHz
1131## channels/options
1132#>>>3      byte&0xC0       0x00           \b, Stereo
1133#>>>3      byte&0xC0       0x40           \b, JntStereo
1134#>>>3      byte&0xC0       0x80           \b, 2x Monaural
1135#>>>3      byte&0xC0       0xC0           \b, Monaural
1136##>1     byte            ^0x01          \b, Data Verify
1137##>2     byte            &0x02          \b, Packet Pad
1138##>2     byte            &0x01          \b, Custom Flag
1139##>3     byte            &0x08          \b, Copyrighted
1140##>3     byte            &0x04          \b, Original Source
1141##>3     byte&0x03       1              \b, NR: 50/15 ms
1142##>3     byte&0x03       3              \b, NR: CCIT J.17
1143
1144# MP3, M2A
11450       beshort&0xFFFE  0xFFF2         MPEG ADTS, layer III, v2
1146!:mime	audio/mpeg
1147# rate
1148>2      byte&0xF0       0x10           \b,   8 kbps
1149>2      byte&0xF0       0x20           \b,  16 kbps
1150>2      byte&0xF0       0x30           \b,  24 kbps
1151>2      byte&0xF0       0x40           \b,  32 kbps
1152>2      byte&0xF0       0x50           \b,  40 kbps
1153>2      byte&0xF0       0x60           \b,  48 kbps
1154>2      byte&0xF0       0x70           \b,  56 kbps
1155>2      byte&0xF0       0x80           \b,  64 kbps
1156>2      byte&0xF0       0x90           \b,  80 kbps
1157>2      byte&0xF0       0xA0           \b,  96 kbps
1158>2      byte&0xF0       0xB0           \b, 112 kbps
1159>2      byte&0xF0       0xC0           \b, 128 kbps
1160>2      byte&0xF0       0xD0           \b, 144 kbps
1161>2      byte&0xF0       0xE0           \b, 160 kbps
1162# timing
1163>2      byte&0x0C       0x00           \b, 22.05 kHz
1164>2      byte&0x0C       0x04           \b, 24 kHz
1165>2      byte&0x0C       0x08           \b, 16 kHz
1166# channels/options
1167>3      byte&0xC0       0x00           \b, Stereo
1168>3      byte&0xC0       0x40           \b, JntStereo
1169>3      byte&0xC0       0x80           \b, 2x Monaural
1170>3      byte&0xC0       0xC0           \b, Monaural
1171#>1     byte            ^0x01          \b, Data Verify
1172#>2     byte            &0x02          \b, Packet Pad
1173#>2     byte            &0x01          \b, Custom Flag
1174#>3     byte            &0x08          \b, Copyrighted
1175#>3     byte            &0x04          \b, Original Source
1176#>3     byte&0x03       1              \b, NR: 50/15 ms
1177#>3     byte&0x03       3              \b, NR: CCIT J.17
1178
1179# MP2, M2A
11800       beshort&0xFFFE  0xFFF4         MPEG ADTS, layer II, v2
1181!:mime	audio/mpeg
1182# rate
1183>2      byte&0xF0       0x10           \b,   8 kbps
1184>2      byte&0xF0       0x20           \b,  16 kbps
1185>2      byte&0xF0       0x30           \b,  24 kbps
1186>2      byte&0xF0       0x40           \b,  32 kbps
1187>2      byte&0xF0       0x50           \b,  40 kbps
1188>2      byte&0xF0       0x60           \b,  48 kbps
1189>2      byte&0xF0       0x70           \b,  56 kbps
1190>2      byte&0xF0       0x80           \b,  64 kbps
1191>2      byte&0xF0       0x90           \b,  80 kbps
1192>2      byte&0xF0       0xA0           \b,  96 kbps
1193>2      byte&0xF0       0xB0           \b, 112 kbps
1194>2      byte&0xF0       0xC0           \b, 128 kbps
1195>2      byte&0xF0       0xD0           \b, 144 kbps
1196>2      byte&0xF0       0xE0           \b, 160 kbps
1197# timing
1198>2      byte&0x0C       0x00           \b, 22.05 kHz
1199>2      byte&0x0C       0x04           \b, 24 kHz
1200>2      byte&0x0C       0x08           \b, 16 kHz
1201# channels/options
1202>3      byte&0xC0       0x00           \b, Stereo
1203>3      byte&0xC0       0x40           \b, JntStereo
1204>3      byte&0xC0       0x80           \b, 2x Monaural
1205>3      byte&0xC0       0xC0           \b, Monaural
1206#>1     byte            ^0x01          \b, Data Verify
1207#>2     byte            &0x02          \b, Packet Pad
1208#>2     byte            &0x01          \b, Custom Flag
1209#>3     byte            &0x08          \b, Copyrighted
1210#>3     byte            &0x04          \b, Original Source
1211#>3     byte&0x03       1              \b, NR: 50/15 ms
1212#>3     byte&0x03       3              \b, NR: CCIT J.17
1213
1214# MPA, M2A
12150       beshort&0xFFFE  0xFFF6         MPEG ADTS, layer I, v2
1216!:mime	audio/mpeg
1217# rate
1218>2      byte&0xF0       0x10           \b,  32 kbps
1219>2      byte&0xF0       0x20           \b,  48 kbps
1220>2      byte&0xF0       0x30           \b,  56 kbps
1221>2      byte&0xF0       0x40           \b,  64 kbps
1222>2      byte&0xF0       0x50           \b,  80 kbps
1223>2      byte&0xF0       0x60           \b,  96 kbps
1224>2      byte&0xF0       0x70           \b, 112 kbps
1225>2      byte&0xF0       0x80           \b, 128 kbps
1226>2      byte&0xF0       0x90           \b, 144 kbps
1227>2      byte&0xF0       0xA0           \b, 160 kbps
1228>2      byte&0xF0       0xB0           \b, 176 kbps
1229>2      byte&0xF0       0xC0           \b, 192 kbps
1230>2      byte&0xF0       0xD0           \b, 224 kbps
1231>2      byte&0xF0       0xE0           \b, 256 kbps
1232# timing
1233>2      byte&0x0C       0x00           \b, 22.05 kHz
1234>2      byte&0x0C       0x04           \b, 24 kHz
1235>2      byte&0x0C       0x08           \b, 16 kHz
1236# channels/options
1237>3      byte&0xC0       0x00           \b, Stereo
1238>3      byte&0xC0       0x40           \b, JntStereo
1239>3      byte&0xC0       0x80           \b, 2x Monaural
1240>3      byte&0xC0       0xC0           \b, Monaural
1241#>1     byte            ^0x01          \b, Data Verify
1242#>2     byte            &0x02          \b, Packet Pad
1243#>2     byte            &0x01          \b, Custom Flag
1244#>3     byte            &0x08          \b, Copyrighted
1245#>3     byte            &0x04          \b, Original Source
1246#>3     byte&0x03       1              \b, NR: 50/15 ms
1247#>3     byte&0x03       3              \b, NR: CCIT J.17
1248
1249# MP3, M25A
12500       beshort&0xFFFE  0xFFE2         MPEG ADTS, layer III,  v2.5
1251!:mime	audio/mpeg
1252# rate
1253>2      byte&0xF0       0x10           \b,   8 kbps
1254>2      byte&0xF0       0x20           \b,  16 kbps
1255>2      byte&0xF0       0x30           \b,  24 kbps
1256>2      byte&0xF0       0x40           \b,  32 kbps
1257>2      byte&0xF0       0x50           \b,  40 kbps
1258>2      byte&0xF0       0x60           \b,  48 kbps
1259>2      byte&0xF0       0x70           \b,  56 kbps
1260>2      byte&0xF0       0x80           \b,  64 kbps
1261>2      byte&0xF0       0x90           \b,  80 kbps
1262>2      byte&0xF0       0xA0           \b,  96 kbps
1263>2      byte&0xF0       0xB0           \b, 112 kbps
1264>2      byte&0xF0       0xC0           \b, 128 kbps
1265>2      byte&0xF0       0xD0           \b, 144 kbps
1266>2      byte&0xF0       0xE0           \b, 160 kbps
1267# timing
1268>2      byte&0x0C       0x00           \b, 11.025 kHz
1269>2      byte&0x0C       0x04           \b, 12 kHz
1270>2      byte&0x0C       0x08           \b, 8 kHz
1271# channels/options
1272>3      byte&0xC0       0x00           \b, Stereo
1273>3      byte&0xC0       0x40           \b, JntStereo
1274>3      byte&0xC0       0x80           \b, 2x Monaural
1275>3      byte&0xC0       0xC0           \b, Monaural
1276#>1     byte            ^0x01          \b, Data Verify
1277#>2     byte            &0x02          \b, Packet Pad
1278#>2     byte            &0x01          \b, Custom Flag
1279#>3     byte            &0x08          \b, Copyrighted
1280#>3     byte            &0x04          \b, Original Source
1281#>3     byte&0x03       1              \b, NR: 50/15 ms
1282#>3     byte&0x03       3              \b, NR: CCIT J.17
1283
1284# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio
1285
1286# Stored AAC streams (instead of the MP4 format)
12870       string          ADIF           MPEG ADIF, AAC
1288!:mime	audio/x-hx-aac-adif
1289>4      byte            &0x80
1290>>13    byte            &0x10          \b, VBR
1291>>13    byte            ^0x10          \b, CBR
1292>>16    byte&0x1E       0x02           \b, single stream
1293>>16    byte&0x1E       0x04           \b, 2 streams
1294>>16    byte&0x1E       0x06           \b, 3 streams
1295>>16    byte            &0x08          \b, 4 or more streams
1296>>16    byte            &0x10          \b, 8 or more streams
1297>>4    byte            &0x80          \b, Copyrighted
1298>>13   byte            &0x40          \b, Original Source
1299>>13   byte            &0x20          \b, Home Flag
1300>4      byte            ^0x80
1301>>4     byte            &0x10          \b, VBR
1302>>4     byte            ^0x10          \b, CBR
1303>>7     byte&0x1E       0x02           \b, single stream
1304>>7     byte&0x1E       0x04           \b, 2 streams
1305>>7     byte&0x1E       0x06           \b, 3 streams
1306>>7     byte            &0x08          \b, 4 or more streams
1307>>7     byte            &0x10          \b, 8 or more streams
1308>>4    byte            &0x40          \b, Original Stream(s)
1309>>4    byte            &0x20          \b, Home Source
1310
1311# Live or stored single AAC stream (used with MPEG-2 systems)
13120       beshort&0xFFF6  0xFFF0         MPEG ADTS, AAC
1313!:mime	audio/x-hx-aac-adts
1314>1      byte            &0x08          \b, v2
1315>1      byte            ^0x08          \b, v4
1316# profile
1317>>2     byte            &0xC0          \b LTP
1318>2      byte&0xc0       0x00           \b Main
1319>2      byte&0xc0       0x40           \b LC
1320>2      byte&0xc0       0x80           \b SSR
1321# timing
1322>2      byte&0x3c       0x00           \b, 96 kHz
1323>2      byte&0x3c       0x04           \b, 88.2 kHz
1324>2      byte&0x3c       0x08           \b, 64 kHz
1325>2      byte&0x3c       0x0c           \b, 48 kHz
1326>2      byte&0x3c       0x10           \b, 44.1 kHz
1327>2      byte&0x3c       0x14           \b, 32 kHz
1328>2      byte&0x3c       0x18           \b, 24 kHz
1329>2      byte&0x3c       0x1c           \b, 22.05 kHz
1330>2      byte&0x3c       0x20           \b, 16 kHz
1331>2      byte&0x3c       0x24           \b, 12 kHz
1332>2      byte&0x3c       0x28           \b, 11.025 kHz
1333>2      byte&0x3c       0x2c           \b, 8 kHz
1334# channels
1335>2      beshort&0x01c0  0x0040         \b, monaural
1336>2      beshort&0x01c0  0x0080         \b, stereo
1337>2      beshort&0x01c0  0x00c0         \b, stereo + center
1338>2      beshort&0x01c0  0x0100         \b, stereo+center+LFE
1339>2      beshort&0x01c0  0x0140         \b, surround
1340>2      beshort&0x01c0  0x0180         \b, surround + LFE
1341>2      beshort         &0x01C0        \b, surround + side
1342#>1     byte            ^0x01           \b, Data Verify
1343#>2     byte            &0x02           \b, Custom Flag
1344#>3     byte            &0x20           \b, Original Stream
1345#>3     byte            &0x10           \b, Home Source
1346#>3     byte            &0x08           \b, Copyrighted
1347
1348# Live MPEG-4 audio streams (instead of RTP FlexMux)
13490       beshort&0xFFE0  0x56E0         MPEG-4 LOAS
1350!:mime	audio/x-mp4a-latm
1351#>1     beshort&0x1FFF  x              \b, %hu byte packet
1352>3      byte&0xE0       0x40
1353>>4     byte&0x3C       0x04           \b, single stream
1354>>4     byte&0x3C       0x08           \b, 2 streams
1355>>4     byte&0x3C       0x0C           \b, 3 streams
1356>>4     byte            &0x08          \b, 4 or more streams
1357>>4     byte            &0x20          \b, 8 or more streams
1358>3      byte&0xC0       0
1359>>4     byte&0x78       0x08           \b, single stream
1360>>4     byte&0x78       0x10           \b, 2 streams
1361>>4     byte&0x78       0x18           \b, 3 streams
1362>>4     byte            &0x20          \b, 4 or more streams
1363>>4     byte            &0x40          \b, 8 or more streams
1364# This magic isn't strong enough (matches plausible ISO-8859-1 text)
1365#0       beshort         0x4DE1         MPEG-4 LO-EP audio stream
1366#!:mime	audio/x-mp4a-latm
1367
1368# Summary: FLI animation format
1369# Created by: Daniel Quinlan <quinlan@yggdrasil.com>
1370# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
13714	leshort		0xAF11
1372# standard FLI always has 320x200 resolution and 8 bit color
1373>8	leshort		320
1374>>10	leshort		200
1375>>>12	leshort		8			FLI animation, 320x200x8
1376!:mime	video/x-fli
1377>>>>6	leshort		x			\b, %d frames
1378# frame speed is multiple of 1/70s
1379>>>>16	leshort		x			\b, %d/70s per frame
1380
1381# Summary: FLC animation format
1382# Created by: Daniel Quinlan <quinlan@yggdrasil.com>
1383# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
13844	leshort		0xAF12
1385# standard FLC always use 8 bit color
1386>12	leshort		8			FLC animation
1387!:mime	video/x-flc
1388>>8	leshort		x			\b, %d
1389>>10	leshort		x			\bx%dx8
1390>>6	uleshort	x			\b, %d frames
1391>>16	uleshort	x			\b, %dms per frame
1392
1393# DL animation format
1394# XXX - collision with most `mips' magic
1395#
1396# I couldn't find a real magic number for these, however, this
1397# -appears- to work.  Note that it might catch other files, too, so be
1398# careful!
1399#
1400# Note that title and author appear in the two 20-byte chunks
1401# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
1402# 255 (hex FF)!  The DL format is really bad.
1403#
1404#0	byte	1	DL version 1, medium format (160x100, 4 images/screen)
1405#!:mime	video/x-unknown
1406#>42	byte	x	- %d screens,
1407#>43	byte	x	%d commands
1408#0	byte	2	DL version 2
1409#!:mime	video/x-unknown
1410#>1	byte	1	- large format (320x200,1 image/screen),
1411#>1	byte	2	- medium format (160x100,4 images/screen),
1412#>1	byte	>2	- unknown format,
1413#>42	byte	x	%d screens,
1414#>43	byte	x	%d commands
1415# Based on empirical evidence, DL version 3 have several nulls following the
1416# \003.  Most of them start with non-null values at hex offset 0x34 or so.
1417#0	string	\3\0\0\0\0\0\0\0\0\0\0\0	DL version 3
1418
1419# iso 13818 transport stream
1420#
1421# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
1422# syncbyte      8 bit	0x47
1423# error_ind     1 bit	-
1424# payload_start 1 bit	1
1425# priority      1 bit	-
1426# PID          13 bit	0x0000
1427# scrambling    2 bit	-
1428# adaptfld_ctrl 2 bit	1 or 3
1429# conti_count   4 bit	-
14300	belong&0xFF5FFF10	0x47400010
1431>188	byte			0x47		MPEG transport stream data
1432!:mime  video/MP2T
1433
1434# DIF digital video file format <mpruett@sgi.com>
14350	belong&0xffffff00	0x1f070000      DIF
1436>4	byte			&0x01		(DVCPRO) movie file
1437>4	byte			^0x01		(DV) movie file
1438>3	byte			&0x80		(PAL)
1439>3	byte			^0x80		(NTSC)
1440
1441# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com>
14420	belong			0x3026b275	Microsoft ASF
1443!:mime  video/x-ms-asf
1444
1445# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
14460	string			\x8aMNG		MNG video data,
1447!:mime	video/x-mng
1448>4	belong			!0x0d0a1a0a	CORRUPTED,
1449>4	belong			0x0d0a1a0a
1450>>16    belong	x				%d x
1451>>20    belong	x				%d
1452
1453# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
14540	string			\x8bJNG		JNG video data,
1455!:mime	video/x-jng
1456>4	belong			!0x0d0a1a0a	CORRUPTED,
1457>4	belong			0x0d0a1a0a
1458>>16    belong	x				%d x
1459>>20    belong	x				%d
1460
1461# Vivo video (Wolfram Kleff)
14623	string		\x0D\x0AVersion:Vivo	Vivo video data
1463
1464# VRML (Virtual Reality Modelling Language)
14650       string/w        #VRML\ V1.0\ ascii	VRML 1 file
1466!:mime	model/vrml
14670	string/w	#VRML\ V2.0\ utf8	ISO/IEC 14772 VRML 97 file
1468!:mime	model/vrml
1469
1470# X3D (Extensible 3D) [https://www.web3d.org/specifications/x3d-3.0.dtd]
1471# From Michel Briand <michelbriand@free.fr>
1472# mimetype from https://www.iana.org/assignments/media-types/model/x3d+xml
1473# Example https://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d
14740	string/w	\<?xml\ version=
1475!:strength + 5
1476>20	search/1000/w	\<!DOCTYPE\ X3D		X3D (Extensible 3D) model xml text
1477!:mime model/x3d+xml
1478
1479#---------------------------------------------------------------------------
1480# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
1481# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03
1482#
14830	string		HVQM4		%s
1484>6	string		>\0		v%s
1485>0	byte		x		GameCube movie,
1486>0x34	ubeshort	x		%d x
1487>0x36	ubeshort	x		%d,
1488>0x26	ubeshort	x		%dus,
1489>0x42	ubeshort	0		no audio
1490>0x42	ubeshort	>0		%dHz audio
1491
1492# From: "Stefan A. Haubenthal" <polluks@web.de>
14930	string		DVDVIDEO-VTS	Video title set,
1494>0x21	byte		x		v%x
14950	string		DVDVIDEO-VMG	Video manager,
1496>0x21	byte		x		v%x
1497
1498# From: Behan Webster <behanw@websterwood.com>
1499# NuppelVideo used by Mythtv (*.nuv)
1500# Note: there are two identical stanzas here differing only in the
1501# initial string matched. It used to be done with a regex, but we're
1502# trying to get rid of those.
15030	string		NuppelVideo	MythTV NuppelVideo
1504>12	string		x		v%s
1505>20	lelong		x		(%d
1506>24	lelong		x		\bx%d),
1507>36	string		P		\bprogressive,
1508>36	string		I		\binterlaced,
1509>40	ledouble	x		\baspect:%.2f,
1510>48	ledouble	x		\bfps:%.2f
15110	string		MythTV		MythTV NuppelVideo
1512>12	string		x		v%s
1513>20	lelong		x		(%d
1514>24	lelong		x		\bx%d),
1515>36	string		P		\bprogressive,
1516>36	string		I		\binterlaced,
1517>40	ledouble	x		\baspect:%.2f,
1518>48	ledouble	x		\bfps:%.2f
1519
1520#						MPEG file
1521# MPEG sequences
1522# FIXME: This section is from the old magic.mime file and needs
1523# integrating with the rest
1524#0       belong             0x000001BA
1525#>4      byte               &0x40
1526#!:mime	video/mp2p
1527#>4      byte               ^0x40
1528#!:mime	video/mpeg
1529#0       belong             0x000001BB
1530#!:mime	video/mpeg
1531#0       belong             0x000001B0
1532#!:mime	video/mp4v-es
1533#0       belong             0x000001B5
1534#!:mime	video/mp4v-es
1535#0       belong             0x000001B3
1536#!:mime	video/mpv
1537#0       belong&0xFF5FFF10  0x47400010
1538#!:mime	video/mp2t
1539#0       belong             0x00000001
1540#>4      byte&0x1F	   0x07
1541#!:mime	video/h264
1542
1543# Type: Bink Video
1544# Extension: .bik
1545# URL:  https://wiki.multimedia.cx/index.php?title=Bink_Container
1546# From: <hoehle@users.sourceforge.net>  2008-07-18
15470	string		BIK	Bink Video
1548>3	regex		=[a-z]	rev.%s
1549#>4	ulelong		x	size %d
1550>20	ulelong		x	\b, %d
1551>24	ulelong		x	\bx%d
1552>8	ulelong		x	\b, %d frames
1553>32	ulelong		x	at rate %d/
1554>28	ulelong		>1	\b%d
1555>40	ulelong		=0	\b, no audio
1556>40	ulelong		!0	\b, %d audio track
1557>>40	ulelong		!1	\bs
1558# follow properties of the first audio track only
1559>>48	uleshort	x	%dHz
1560>>51	byte&0x20	0	mono
1561>>51	byte&0x20	!0	stereo
1562#>>51	byte&0x10	0	FFT
1563#>>51	byte&0x10	!0	DCT
1564
1565# Type:	NUT Container
1566# URL:	https://wiki.multimedia.cx/index.php?title=NUT
1567# From:	Adam Buchbinder <adam.buchbinder@gmail.com>
15680	string	nut/multimedia\ container\0	NUT multimedia container
1569
1570# Type: Nullsoft Video (NSV)
1571# URL:  https://wiki.multimedia.cx/index.php?title=Nullsoft_Video
1572# From: Mike Melanson <mike@multimedia.cx>
15730	string	NSVf	Nullsoft Video
1574
1575# Type: REDCode Video
1576# URL:  https://www.red.com/ ; https://wiki.multimedia.cx/index.php?title=REDCode
1577# From: Mike Melanson <mike@multimedia.cx>
15784	string	RED1	REDCode Video
1579
1580# Type: MTV Multimedia File
1581# URL:  https://wiki.multimedia.cx/index.php?title=MTV
1582# From: Mike Melanson <mike@multimedia.cx>
15830	string	AMVS	MTV Multimedia File
1584
1585# Type: ARMovie
1586# URL:  https://wiki.multimedia.cx/index.php?title=ARMovie
1587# From: Mike Melanson <mike@multimedia.cx>
15880	string	ARMovie\012	ARMovie
1589
1590# Type: Interplay MVE Movie
1591# URL:  https://wiki.multimedia.cx/index.php?title=Interplay_MVE
1592# From: Mike Melanson <mike@multimedia.cx>
15930	string	Interplay\040MVE\040File\032	Interplay MVE Movie
1594
1595# Type: Windows Television DVR File
1596# URL:  https://wiki.multimedia.cx/index.php?title=WTV
1597# From: Mike Melanson <mike@mutlimedia.cx>
1598# This takes the form of a Windows-style GUID
15990	bequad	0xB7D800203749DA11
1600>8	bequad	0xA64E0007E95EAD8D	Windows Television DVR Media
1601
1602# Type: Sega FILM/CPK Multimedia
1603# URL:  https://wiki.multimedia.cx/index.php?title=Sega_FILM
1604# From: Mike Melanson <mike@multimedia.cx>
16050	string	FILM	Sega FILM/CPK Multimedia,
1606>32	belong	x	%d x
1607>28	belong	x	%d
1608
1609# Type: Nintendo THP Multimedia
1610# URL:  https://wiki.multimedia.cx/index.php?title=THP
1611# From: Mike Melanson <mike@multimedia.cx>
16120	string	THP\0	Nintendo THP Multimedia
1613
1614# Type: BBC Dirac Video
1615# URL:  https://wiki.multimedia.cx/index.php?title=Dirac
1616# From: Mike Melanson <mike@multimedia.cx>
16170	string	BBCD	BBC Dirac Video
1618
1619# Type: RAD Game Tools Smacker Multimedia
1620# URL:  https://wiki.multimedia.cx/index.php?title=Smacker
1621# From: Mike Melanson <mike@multimedia.cx>
16220	string	SMK	RAD Game Tools Smacker Multimedia
1623>3	byte	x	version %c,
1624>4	lelong	x	%d x
1625>8	lelong	x	%d,
1626>12	lelong	x	%d frames
1627
1628# Material Exchange Format
1629# More information:
1630# https://en.wikipedia.org/wiki/Material_Exchange_Format
1631# http://www.freemxf.org/
16320	string	\x06\x0e\x2b\x34\x02\x05\x01\x01\x0d\x01\x02\x01\x01\x02	Material exchange container format
1633!:ext	mxf
1634!:mime	application/mxf
1635
1636# Recognize LucasArts Smush video files (cf.
1637# https://wiki.multimedia.cx/index.php/Smush)
16380	string	ANIM
1639>8	string	AHDR	LucasArts Smush Animation Format (SAN) video
16400	string	SANM
1641>8	string	SHDR	LucasArts Smush v2 (SANM) video
1642
1643# Type: Scaleform video
1644# Extension: .usm
1645# URL:  https://wiki.multimedia.cx/index.php/USM
1646# From: David Korth <gerbilsoft@gerbilsoft.com>
16470	string	CRID
1648>32	string	@UTF	Scaleform video
1649
1650#------------------------------------------------------------------------------
1651# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $
1652# aout:  file(1) magic for a.out executable/object/etc entries that
1653# handle executables on multiple platforms.
1654#
1655
1656#
1657# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from
1658# BSDI), netbsd, and vax (for UNIX/32V and BSD)
1659#
1660# XXX - is there anything we can look at to distinguish BSD/OS 386 from
1661# NetBSD 386 from various VAX binaries?  The BSD/OS shared library flag
1662# works only for binaries using shared libraries.  Grabbing the entry
1663# point from the a.out header, using it to find the first code executed
1664# in the program, and looking at that might help.
1665#
16660	lelong		0407		a.out little-endian 32-bit executable
1667>16	lelong		>0		not stripped
1668>32	byte		0x6a		(uses BSD/OS shared libs)
1669
16700	lelong		0410		a.out little-endian 32-bit pure executable
1671>16	lelong		>0		not stripped
1672>32	byte		0x6a		(uses BSD/OS shared libs)
1673
16740	lelong		0413		a.out little-endian 32-bit demand paged pure executable
1675>16	lelong		>0		not stripped
1676>32	byte		0x6a		(uses BSD/OS shared libs)
1677
1678#
1679# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out),
1680# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out).
1681#
1682# XXX - is there anything we can look at to distinguish old SunOS 68010
1683# from old 68020 IRIX from old NetBSD?  Again, I guess we could look at
1684# the first instruction or instructions in the program.
1685#
16860	belong		0407		a.out big-endian 32-bit executable
1687>16	belong		>0		not stripped
1688
16890	belong		0410		a.out big-endian 32-bit pure executable
1690>16	belong		>0		not stripped
1691
16920	belong		0413		a.out big-endian 32-bit demand paged executable
1693>16	belong		>0		not stripped
1694
1695
1696#------------------------------------------------------------------------------
1697# $File: apache,v 1.1 2017/04/11 14:52:15 christos Exp $
1698# apache: file(1) magic for Apache Big Data formats
1699
1700# Avro files
17010	string		Obj		Apache Avro
1702>3	byte		x		version %d
1703
1704# ORC files
1705# Important information is in file footer, which we can't index to :(
17060	string		ORC		Apache ORC
1707
1708# Parquet files
17090	string		PAR1		Apache Parquet
1710
1711# Hive RC files
17120	string		RCF		Apache Hive RC file
1713>3	byte		x		version %d
1714
1715# Sequence files (and the careless first version of RC file)
1716
17170	string		SEQ
1718>3	byte		<6		Apache Hadoop Sequence file version %d
1719>3	byte		>6		Apache Hadoop Sequence file version %d
1720>3	byte		=6
1721>>5	string		org.apache.hadoop.hive.ql.io.RCFile$KeyBuffer  Apache Hive RC file version 0
1722>>3	default		x		Apache Hadoop Sequence file version 6
1723
1724#------------------------------------------------------------------------------
1725# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $
1726# apl:  file(1) magic for APL (see also "pdp" and "vax" for other APL
1727#       workspaces)
1728#
17290	long		0100554		APL workspace (Ken's original?)
1730
1731#------------------------------------------------------------------------------
1732# $File: apple,v 1.43 2019/04/19 00:42:27 christos Exp $
1733# apple:  file(1) magic for Apple file formats
1734#
17350	search/1/t	FiLeStArTfIlEsTaRt	binscii (apple ][) text
17360	string		\x0aGL			Binary II (apple ][) data
17370	string		\x76\xff		Squeezed (apple ][) data
17380	string		NuFile			NuFile archive (apple ][) data
17390	string		N\xf5F\xe9l\xe5		NuFile archive (apple ][) data
17400	belong		0x00051600		AppleSingle encoded Macintosh file
17410	belong		0x00051607		AppleDouble encoded Macintosh file
1742
1743# Type: Apple Emulator WOZ format
1744# From: Greg Wildman <greg@apple2.org.za>
1745# Ref: https://applesaucefdc.com/woz/reference/
1746# Ref: https://applesaucefdc.com/woz/reference2/
1747#
1748# Note: The following test are mostly identical. I would rather not
1749# use a regex to identify the WOZ format number.
17500	string		WOZ1
1751>4	string		\xFF\x0A\x0D\x0A	Apple ][ WOZ 1.0 Disk Image
1752>12	string		INFO
1753>>21	byte		01			\b, 5.25 inch
1754>>21	byte		02			\b, 3.5 inch
1755>>22	byte		01			\b, write protected
1756>>23	byte		01			\b, cross track synchronized
1757>>25	string/T	x			\b, %.32s
17580	string		WOZ2
1759>4	string		\xFF\x0A\x0D\x0A	Apple ][ WOZ 2.0 Disk Image
1760>12	string		INFO
1761>>21	byte		01			\b, 5.25 inch
1762>>21	byte		02			\b, 3.5 inch
1763>>22	byte		01			\b, write protected
1764>>23	byte		01			\b, cross track synchronized
1765>>25	string/T	x			\b, %.32s
1766
1767# Type: Apple Emulator disk images
1768# From: Greg Wildman <greg@apple2.org.za>
1769# ProDOS boot loader?
17700		string	\x01\x38\xB0\x03\x4C	Apple ProDOS Image
1771# Detect Volume Directory block ($02)
1772>0x400		string	\x00\x00\x03\x00
1773>>0x404		byte	&0xF0
1774>>>0x405	string	x			\b, Volume /%s
1775>>>0x429	leshort	x			\b, %u Blocks
1776# ProDOS ordered ?
1777>0xb00		string	\x00\x00\x03\x00
1778>>0xb04		byte	&0xF0
1779>>>0xb05	string	x			\b, Volume /%s
1780>>>0xb29	leshort	x			\b, %u Blocks
1781#
1782# DOS3.3 boot loader?
17830		string	\x01\xA5\x27\xC9\x09\xD0\x18\xA5\x2B
1784>0x11001	string	\x11\x0F\x03	Apple DOS 3.3 Image
1785>>0x11006	byte	x		\b, Volume %u
1786>>0x11034	byte	x		\b, %u Tracks
1787>>0x11035	byte	x		\b, %u Sectors
1788>>0x11036	leshort	x		\b, %u bytes per sector
1789# DOS3.2 ?
1790>0x11001	string	\x11\x0C\x02	Apple DOS 3.2 Image
1791>>0x11006	byte	x		\b, Volume %u
1792>>0x11034	byte	x		\b, %u Tracks
1793>>0x11035	byte	x		\b, %u Sectors
1794>>0x11036	leshort	x		\b, %u bytes per sector
1795# DOS3.1 ?
1796>0x11001	string	\x11\x0C\x01
1797>>0x11c00	string	\x00\x11\x0B	Apple DOS 3.1 Image
1798#
1799# Pascal boot loader?
18000		string	\x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD
1801>0xd6		pstring SYSTEM.APPLE
1802>>0xb00		leshort	0x0000
1803>>>0xb04	leshort 0x0000		Apple Pascal Image
1804>>>>0xb06	pstring x		\b, Volume %s:
1805>>>>0xb0e	leshort x		\b, %u Blocks
1806>>>>0xb10	leshort x		\b, %u Files
1807
1808# Type: Apple Emulator 2IMG format
1809# From: Radek Vokal <rvokal@redhat.com>
1810# Update: Greg Wildman <greg@apple2.org.za>
18110	string		2IMG		Apple ][ 2IMG Disk Image
1812>4	clear		x
1813>4	string		XGS!		\b, XGS
1814>4	string		CTKG		\b, Catakig
1815>4	string		ShIm		\b, Sheppy's ImageMaker
1816>4	string		SHEP		\b, Sheppy's ImageMaker
1817>4	string		WOOF		\b, Sweet 16
1818>4	string		B2TR		\b, Bernie ][ the Rescue
1819>4	string		\!nfc		\b, ASIMOV2
1820>4	string		\>BD\<		\b, Brutal Deluxe's Cadius
1821>4	string		CdrP		\b, CiderPress
1822>4	string		Vi][		\b, Virtual ][
1823>4	string		PRFS		\b, ProFUSE
1824>4	string		FISH		\b, FishWings
1825>4	string		RVLW		\b, Revival for Windows
1826>4	default		x
1827>>4	string		x		\b, Creator tag "%-4.4s"
1828>0xc	byte		00		\b, DOS 3.3 sector order
1829>>0x10	byte		00		\b, Volume 254
1830>>0x10	byte&0x7f	x		\b, Volume %u
1831>0xc	byte		01		\b, ProDOS sector order
1832>>0x14	short		x		\b, %u Blocks
1833>0xc	byte		02		\b, NIB data
1834
1835# magic for Newton PDA package formats
1836# from Ruda Moura <ruda@helllabs.org>
18370	string	package0	Newton package, NOS 1.x,
1838>12	belong	&0x80000000	AutoRemove,
1839>12	belong	&0x40000000	CopyProtect,
1840>12	belong	&0x10000000	NoCompression,
1841>12	belong	&0x04000000	Relocation,
1842>12	belong	&0x02000000	UseFasterCompression,
1843>16	belong	x		version %d
1844
18450	string	package1	Newton package, NOS 2.x,
1846>12	belong	&0x80000000	AutoRemove,
1847>12	belong	&0x40000000	CopyProtect,
1848>12	belong	&0x10000000	NoCompression,
1849>12	belong	&0x04000000	Relocation,
1850>12	belong	&0x02000000	UseFasterCompression,
1851>16	belong	x		version %d
1852
18530	string	package4	Newton package,
1854>8	byte	8		NOS 1.x,
1855>8	byte	9		NOS 2.x,
1856>12	belong	&0x80000000	AutoRemove,
1857>12	belong	&0x40000000	CopyProtect,
1858>12	belong	&0x10000000	NoCompression,
1859
1860# The following entries for the Apple II are for files that have
1861# been transferred as raw binary data from an Apple, without having
1862# been encapsulated by any of the above archivers.
1863#
1864# In general, Apple II formats are hard to identify because Apple DOS
1865# and especially Apple ProDOS have strong typing in the file system and
1866# therefore programmers never felt much need to include type information
1867# in the files themselves.
1868#
1869# Eric Fischer <enf@pobox.com>
1870
1871# AppleWorks word processor:
1872# URL: https://en.wikipedia.org/wiki/AppleWorks
1873# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx
1874# Update: Joerg Jenderek
1875# NOTE:
1876# The "O" is really the magic number, but that's so common that it's
1877# necessary to check the tab stops that follow it to avoid false positives.
1878# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge
1879# the newer AppleWorks is from claris with extension CWK
18804	string		O
1881# test for unused bits of zoom- , paginated-boolean bytes
1882>84	ubequad		^0x00Fe00000000Fe00
1883# look for tabstop definitions "=" no tab, "|" no tab
1884# "<" left tab,"^" center tab,">" right tab, "." decimal tab,
1885# unofficial "!" other , "\x8a" other
1886# official only if SFMinVers is nonzero
1887>>5	regex/s	[=.<>|!^\x8a]{79}	AppleWorks Word Processor
1888# AppleWorks Word Processor File (Apple II)
1889# ./apple (version 5.25) labeled the entry as "AppleWorks word processor data"
1890# application/x-appleworks is mime type for claris version with cwk extension
1891!:mime	application/x-appleworks3
1892# http://home.earthlink.net/~hughhood/appleiiworksenvoy/
1893# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type')
1894# $70 $1A $F8 $FF is this the apple type ?
1895#:apple pdosp^Z\xf8\xff
1896!:ext awp
1897# minimum version needed to read this files. SFMinVers (0 , 30~3.0 )
1898>>>183	ubyte		30	3.0
1899>>>183	ubyte		!30
1900>>>>183	ubyte		!0	0x%x
1901# usual tabstop start sequence "=====<"
1902>>>5	string		x	\b, tabstop ruler "%6.6s"
1903# tabstop ruler
1904#>>>5	string		>\0	\b, tabstops "%-79s"
1905# zoom switch
1906>>>85	  byte&0x01	>0	\b, zoomed
1907# whether paginated
1908>>>90	  byte&0x01	>0	\b, paginated
1909# contains any mail-merge commands
1910>>>92	  byte&0x01	>0	\b, with mail merge
1911# left margin in 1/10 inches ( normally 0 or 10 )
1912>>>91	ubyte		>0
1913>>>>91	ubyte		x	\b, %d/10 inch left margin
1914
1915# AppleWorks database:
1916#
1917# This isn't really a magic number, but it's the closest thing to one
1918# that I could find.  The 1 and 2 really mean "order in which you defined
1919# categories" and "left to right, top to bottom," respectively; the D and R
1920# mean that the cursor should move either down or right when you press Return.
1921
1922#30	string		\x01D	AppleWorks database data
1923#30	string		\x02D	AppleWorks database data
1924#30	string		\x01R	AppleWorks database data
1925#30	string		\x02R	AppleWorks database data
1926
1927# AppleWorks spreadsheet:
1928#
1929# Likewise, this isn't really meant as a magic number.  The R or C means
1930# row- or column-order recalculation; the A or M means automatic or manual
1931# recalculation.
1932
1933#131	string		RA	AppleWorks spreadsheet data
1934#131	string		RM	AppleWorks spreadsheet data
1935#131	string		CA	AppleWorks spreadsheet data
1936#131	string		CM	AppleWorks spreadsheet data
1937
1938# Applesoft BASIC:
1939#
1940# This is incredibly sloppy, but will be true if the program was
1941# written at its usual memory location of 2048 and its first line
1942# number is less than 256.  Yuck.
1943# update by Joerg Jenderek at Feb 2013
1944
1945# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
1946#0       belong&0xff00ff 0x80000 Applesoft BASIC program data
19470	belong&0x00ff00ff	0x00080000
1948# assuming that line number must be positive
1949>2	leshort			>0		Applesoft BASIC program data, first line number %d
1950#>2     leshort         x       \b, first line number %d
1951
1952# ORCA/EZ assembler:
1953#
1954# This will not identify ORCA/M source files, since those have
1955# some sort of date code instead of the two zero bytes at 6 and 7
1956# XXX Conflicts with ELF
1957#4       belong&0xff00ffff       0x01000000      ORCA/EZ assembler source data
1958#>5      byte                    x               \b, build number %d
1959
1960# Broderbund Fantavision
1961#
1962# I don't know what these values really mean, but they seem to recur.
1963# Will they cause too many conflicts?
1964
1965# Probably :-)
1966#2	belong&0xFF00FF		0x040008	Fantavision movie data
1967
1968# Some attempts at images.
1969#
1970# These are actually just bit-for-bit dumps of the frame buffer, so
1971# there's really no reasonably way to distinguish them except for their
1972# address (if preserved) -- 8192 or 16384 -- and their length -- 8192
1973# or, occasionally, 8184.
1974#
1975# Nevertheless this will manage to catch a lot of images that happen
1976# to have a solid-colored line at the bottom of the screen.
1977
1978# GRR: Magic too weak
1979#8144	string	\x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F	Apple II image with white background
1980#8144	string	\x55\x2A\x55\x2A\x55\x2A\x55\x2A	Apple II image with purple background
1981#8144	string	\x2A\x55\x2A\x55\x2A\x55\x2A\x55	Apple II image with green background
1982#8144	string	\xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA	Apple II image with blue background
1983#8144	string	\xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5	Apple II image with orange background
1984
1985# Beagle Bros. Apple Mechanic fonts
1986
19870	belong&0xFF00FFFF	0x6400D000	Apple Mechanic font
1988
1989# Apple Universal Disk Image Format (UDIF) - dmg files.
1990# From Johan Gade.
1991# These entries are disabled for now until we fix the following issues.
1992#
1993# Note there might be some problems with the "VAX COFF executable"
1994# entry. Note this entry should be placed before the mac filesystem section,
1995# particularly the "Apple Partition data" entry.
1996#
1997# The intended meaning of these tests is, that the file is only of the
1998# specified type if both of the lines are correct - i.e. if the first
1999# line matches and the second doesn't then it is not of that type.
2000#
2001#0	long	0x7801730d
2002#>4	long	0x62626060	UDIF read-only zlib-compressed image (UDZO)
2003#
2004# Note that this entry is recognized correctly by the "Apple Partition
2005# data" entry - however since this entry is more specific - this
2006# information seems to be more useful.
2007#0	long	0x45520200
2008#>0x410	string	disk\ image	UDIF read/write image (UDRW)
2009
2010# From: Toby Peterson <toby@apple.com>
20110	string	bplist00	Apple binary property list
2012
2013# Apple binary property list (bplist)
2014#  Assumes version bytes are hex.
2015#  Provides content hints for version 0 files. Assumes that the root
2016#  object is the first object (true for CoreFoundation implementation).
2017# From: David Remahl <dremahl@apple.com>
20180		string	bplist
2019>6		byte	x	\bCoreFoundation binary property list data, version 0x%c
2020>>7		byte	x	\b%c
2021>6		string		00		\b
2022>>8		byte&0xF0	0x00	\b
2023>>>8	byte&0x0F	0x00	\b, root type: null
2024>>>8	byte&0x0F	0x08	\b, root type: false boolean
2025>>>8	byte&0x0F	0x09	\b, root type: true boolean
2026>>8		byte&0xF0	0x10	\b, root type: integer
2027>>8		byte&0xF0	0x20	\b, root type: real
2028>>8		byte&0xF0	0x30	\b, root type: date
2029>>8		byte&0xF0	0x40    \b, root type: data
2030>>8		byte&0xF0	0x50	\b, root type: ascii string
2031>>8		byte&0xF0	0x60	\b, root type: unicode string
2032>>8		byte&0xF0	0x80	\b, root type: uid (CORRUPT)
2033>>8		byte&0xF0	0xa0	\b, root type: array
2034>>8		byte&0xF0	0xd0	\b, root type: dictionary
2035
2036# Apple/NeXT typedstream data
2037#  Serialization format used by NeXT and Apple for various
2038#  purposes in YellowStep/Cocoa, including some nib files.
2039# From: David Remahl <dremahl@apple.com>
20402		string		typedstream	NeXT/Apple typedstream data, big endian
2041>0		byte		x		\b, version %d
2042>0		byte		<5		\b
2043>>13	byte		0x81	\b
2044>>>14	ubeshort	x		\b, system %d
20452		string		streamtyped NeXT/Apple typedstream data, little endian
2046>0		byte		x		\b, version %d
2047>0		byte		<5		\b
2048>>13	byte		0x81	\b
2049>>>14	uleshort	x		\b, system %d
2050
2051#------------------------------------------------------------------------------
2052# CAF: Apple CoreAudio File Format
2053#
2054# Container format for high-end audio purposes.
2055# From: David Remahl <dremahl@apple.com>
2056#
20570	string		caff		CoreAudio Format audio file
2058>4	beshort		<10		version %d
2059>6	beshort		x
2060
2061
2062#------------------------------------------------------------------------------
2063# Keychain database files
20640	string		kych		Mac OS X Keychain File
2065
2066#------------------------------------------------------------------------------
2067# Code Signing related file types
20680	belong		0xfade0c00	Mac OS X Code Requirement
2069>8	belong		1			(opExpr)
2070>4	belong		x			- %d bytes
2071
20720	belong		0xfade0c01	Mac OS X Code Requirement Set
2073>8	belong		>1			containing %d items
2074>4	belong		x			- %d bytes
2075
20760	belong		0xfade0c02	Mac OS X Code Directory
2077>8	belong		x			version %x
2078>12	belong		>0			flags 0x%x
2079>4	belong		x			- %d bytes
2080
20810	belong		0xfade0cc0	Mac OS X Detached Code Signature (non-executable)
2082>4	belong		x			- %d bytes
2083
20840	belong		0xfade0cc1	Mac OS X Detached Code Signature
2085>8	belong		>1			(%d elements)
2086>4	belong		x			- %d bytes
2087
2088# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
2089# .vdi
20904	string innotek\ VirtualBox\ Disk\ Image %s
2091
2092# Apple disk partition stuff
2093# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
2094# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h
2095# Update: Joerg Jenderek
2096# "ER" is APPLE_DRVR_MAP_MAGIC signature
20970	beshort	0x4552
2098# display Apple Driver Map (strength=50) after Syslinux bootloader (71)
2099#!:strength +0
2100# strengthen the magic by looking for used blocksizes 512 2048
2101>2	ubeshort&0xf1FF		0	Apple Driver Map
2102# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid
2103#>>504	ubequad&0x0000FFffFFff0000	0
2104!:mime	application/x-apple-diskimage
2105!:apple	????devr
2106# https://en.wikipedia.org/wiki/Apple_Disk_Image
2107!:ext	dmg/iso
2108# sbBlkSize for driver descriptor map 512 2048
2109>>2	beshort	x			\b, blocksize %d
2110# sbBlkCount sometimes garbish like
2111# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg
2112# 0xf2720100 for bunziped Firefox 48.0-2.dmg
2113# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso
2114# 0x00009090 by syslinux-6.03/utils/isohybrid.c
2115>>4	ubelong	x			\b, blockcount %u
2116# following device/driver information not very useful
2117# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
2118>>8	ubeshort	x		\b, devtype %u
2119# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
2120>>10	ubeshort	x		\b, devid %u
2121# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso)
2122>>12	ubelong		>0
2123>>>12	ubelong		x		\b, driver data %u
2124# number of driver descriptors sbDrvrCount <= 61
2125# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
2126>>16	ubeshort	x		\b, driver count %u
2127# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map
2128# >>18	use		apple-driver-map
2129# >>26	use		apple-driver-map
2130# # ...
2131# >>500	use		apple-driver-map
2132# number of partitions is always same in every partition (map block count)
2133#>>0x0204	ubelong		x	\b, %u partitions
2134>>0x0204	ubelong		>0	\b, contains[@0x200]:
2135>>>0x0200	use		apple-apm
2136>>0x0204	ubelong		>1	\b, contains[@0x400]:
2137>>>0x0400	use		apple-apm
2138>>0x0204	ubelong		>2	\b, contains[@0x600]:
2139>>>0x0600	use		apple-apm
2140>>0x0204	ubelong		>3	\b, contains[@0x800]:
2141>>>0x0800	use		apple-apm
2142>>0x0204	ubelong		>4	\b, contains[@0xA00]:
2143>>>0x0A00	use		apple-apm
2144>>0x0204	ubelong		>5	\b, contains[@0xC00]:
2145>>>0x0C00	use		apple-apm
2146>>0x0204	ubelong		>6	\b, contains[@0xE00]:
2147>>>0x0E00	use		apple-apm
2148>>0x0204	ubelong		>7	\b, contains[@0x1000]:
2149>>>0x1000	use		apple-apm
2150#	display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type)
21510	name				apple-driver-map
2152>0	ubequad		!0
2153# descBlock first block of driver
2154>>0	ubelong	x			\b, driver start block %u
2155# descSize driver size in blocks
2156>>4	ubeshort	x		\b, size %u
2157# descType driver system type 1 701h F8FFh FFFFh
2158>>6	ubeshort	x		\b, type 0x%x
2159
2160# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
2161# Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h
2162# Update: Joerg Jenderek
2163# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the
2164# magic stronger.
2165# for apple partition map stored as a single file
21660	belong	0x504d0000
2167# to display Apple Partition Map (strength=70) after Syslinux bootloader (71)
2168#!:strength +0
2169>0	use		apple-apm
2170# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type
2171# file: could not find any valid magic files!
2172#!:ext	bin
2173#	display apple partition map. Normally called after Apple driver map
21740	name				apple-apm
2175>0	belong	0x504d0000		Apple Partition Map
2176# number of partitions
2177>>4	ubelong	x			\b, map block count %u
2178# logical block (512 bytes) start of partition
2179>>8	ubelong	x			\b, start block %u
2180>>12	ubelong	x			\b, block count %u
2181>>16	string >0			\b, name %s
2182>>48	string >0			\b, type %s
2183# processor type dpme_process_id[16] e.g. "68000" "68020"
2184>>120	string >0			\b, processor %s
2185# A/UX boot arguments BootArgs[128]
2186>>136	string >0			\b, boot arguments %s
2187# status of partition dpme_flags
2188>>88	belong	& 1			\b, valid
2189>>88	belong	& 2			\b, allocated
2190>>88	belong	& 4			\b, in use
2191>>88	belong	& 8			\b, has boot info
2192>>88	belong	& 16			\b, readable
2193>>88	belong	& 32			\b, writable
2194>>88	belong	& 64			\b, pic boot code
2195>>88	belong	& 128			\b, chain compatible driver
2196>>88	belong	& 256			\b, real driver
2197>>88	belong	& 512			\b, chain driver
2198# mount automatically at startup APPLE_PS_AUTO_MOUNT
2199>>88	ubelong	&0x40000000		\b, mount at startup
2200# is the startup partition APPLE_PS_STARTUP
2201>>88	ubelong	&0x80000000		\b, is the startup partition
2202
2203#https://wiki.mozilla.org/DS_Store_File_Format
2204#https://en.wikipedia.org/wiki/.DS_Store
22050	string	\0\0\0\1Bud1\0		Apple Desktop Services Store
2206
2207# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015)
2208# Usually not in separate files, but have either filename rsrc with
2209# no extension, or a filename corresponding to another file, with
2210# extensions rsr/rsrc
22110	string  \000\000\001\000
2212>4	leshort 0
2213>>16	lelong  0			Apple HFS/HFS+ resource fork
2214
2215#https://en.wikipedia.org/wiki/AppleScript
22160	string	FasdUAS			AppleScript compiled
2217
2218# AppleWorks/ClarisWorks
2219# https://github.com/joshenders/appleworks_format
2220# http://fileformats.archiveteam.org/wiki/AppleWorks
22210	name			appleworks
2222>0	belong&0x00ffffff	0x07e100	AppleWorks CWK Document
2223>0	belong&0x00ffffff	0x008803	ClarisWorks CWK Document
2224>0	default			x
2225>>0	belong			x		AppleWorks/ClarisWorks CWK Document
2226>0	byte			x		\b, version %d
2227>30	beshort			x		\b, %d
2228>32	beshort			x		\bx%d
2229!:ext cwk
2230
22314	string	BOBO
2232>0	byte	>4
2233>>12	belong	0
2234>>>26	belong	0
2235>>>>0	use	appleworks
2236>0	belong	0x0481ad00
2237>>0	use 	appleworks
2238
2239# magic for Apple File System (APFS)
2240# from Alex Myczko <alex@aiei.ch>
224132		string	NXSB		Apple File System (APFS)
2242>36		ulelong	x		\b, blocksize %u
2243
2244# iTunes cover art (versions 1 and 2)
22454		string	itch
2246>24		string	artw
2247>>0x1e8		string	data		iTunes cover art
2248>>>0x1ed	string	PNG		(PNG)
2249>>>0x1ec	beshort 0xffd8		(JPEG)
2250
2251# MacPaint image
225265		string	PNTGMPNT	MacPaint image data
2253#0		belong	2		MacPaint image data
2254
2255#------------------------------------------------------------------------------
2256# $File: application,v 1.1 2016/10/17 12:13:01 christos Exp $
2257# application:  file(1) magic for applications on small devices
2258#
2259# Pebble Application
22600	string	PBLAPP\000\000	Pebble application
2261
2262#------------------------------------------------------------------------------
2263# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $
2264# applix:  file(1) magic for Applixware
2265# From: Peter Soos <sp@osb.hu>
2266#
22670	string		*BEGIN		Applixware
2268>7	string		WORDS			Words Document
2269>7	string		GRAPHICS		Graphic
2270>7	string		RASTER			Bitmap
2271>7	string		SPREADSHEETS		Spreadsheet
2272>7	string		MACRO			Macro
2273>7	string		BUILDER			Builder Object
2274
2275#------------------------------------------------------------------------------
2276# $File: apt,v 1.1 2016/10/17 19:51:57 christos Exp $
2277# apt: file(1) magic for APT Cache files
2278# <http://www.fifi.org/doc/libapt-pkg-doc/cache.html/ch2.html>
2279# <https://anonscm.debian.org/cgit/apt/apt.git/tree/apt-pkg/pkgcache.h#n292>
2280
2281# before version 10 ("old format"), data was in arch-specific long/short
2282
2283# old format 64 bit
22840   	name		apt-cache-64bit-be
2285>12	beshort		1		\b, dirty
2286>40 	bequad		x		\b, %llu packages
2287>48 	bequad		x		\b, %llu versions
2288
2289# old format 32 bit
22900   	name    	apt-cache-32bit-be
2291>8  	beshort 	1		\b, dirty
2292>40 	belong  	x		\b, %u packages
2293>44 	belong  	x		\b, %u versions
2294
2295# new format
22960	name		apt-cache-be
2297>6	byte    	1		\b, dirty
2298>24	belong  	x		\b, %u packages
2299>28	belong		x		\b, %u versions
2300
23010	bequad		0x98FE76DC
2302>8	ubeshort	<10		APT cache data, version %u
2303>>10	beshort	    	x	  	\b.%u, 64 bit big-endian
2304>>0	use		apt-cache-64bit-be
2305
23060	lequad	    	0x98FE76DC
2307>8	uleshort    	<10		APT cache data, version %u
2308>>10	leshort		x		\b.%u, 64 bit little-endian
2309>>0	use		\^apt-cache-64bit-be
2310
23110	belong	    	0x98FE76DC
2312>4	ubeshort    	<10	 	APT cache data, version %u
2313>>6	ubeshort    	x		\b.%u, 32 bit big-endian
2314>>0	use  		apt-cache-32bit-be
2315>4	ubyte	    	>9		APT cache data, version %u
2316>>5	ubyte	    	x		\b.%u, big-endian
2317>>0	use 		apt-cache-be
2318
23190	lelong	    	0x98FE76DC
2320>4	uleshort    	<10		APT cache data, version %u
2321>>6	uleshort   	x		\b.%u, 32 bit little-endian
2322>>0	use 		\^apt-cache-32bit-be
2323>4	ubyte	    	>9		APT cache data, version %u
2324>>5	ubyte	    	x		\b.%u, little-endian
2325>>0	use		\^apt-cache-be
2326#------------------------------------------------------------------------------
2327# $File: archive,v 1.129 2019/05/09 18:58:02 christos Exp $
2328# archive:  file(1) magic for archive formats (see also "msdos" for self-
2329#           extracting compressed archives)
2330#
2331# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
2332# pre-POSIX "tar" archives are also handled in the C code ../../src/is_tar.c.
2333
2334# POSIX tar archives
2335# URL: https://en.wikipedia.org/wiki/Tar_(computing)
2336# Reference: https://www.freebsd.org/cgi/man.cgi?query=tar&sektion=5&manpath=FreeBSD+8-current
2337# header mainly padded with nul bytes
2338500	quad		0
2339!:strength /2
2340# filename or extended attribute printable strings in range space null til umlaut ue
2341>0	ubeshort	>0x1F00
2342>>0	ubeshort	<0xFCFD
2343# last 4 header bytes often null but tar\0 in gtarfail2.tar gtarfail.tar-bad
2344# at https://sourceforge.net/projects/s-tar/files/testscripts/
2345>>>508	ubelong&0x8B9E8DFF	0
2346# nul, space or ascii digit 0-7 at start of mode
2347>>>>100	ubyte&0xC8	=0
2348>>>>>101 ubyte&0xC8	=0
2349# nul, space at end of check sum
2350>>>>>>155 ubyte&0xDF	=0
2351# space or ascii digit 0 at start of check sum
2352>>>>>>>148	ubyte&0xEF	=0x20
2353>>>>>>>>0	use	tar-file
2354#	minimal check and then display tar archive information which can also be
2355#	embedded inside others like Android Backup, Clam AntiVirus database
23560	name		tar-file
2357>257	string		!ustar
2358# header padded with nuls
2359>>257	ulong		=0
2360# GNU tar version 1.29 with non pax format option without refusing
2361# creates misleading V7 header for Long path, Multi-volume, Volume type
2362>>>156	ubyte		0x4c		GNU tar archive
2363!:mime	application/x-gtar
2364!:ext	tar/gtar
2365>>>156	ubyte		0x4d		GNU tar archive
2366!:mime	application/x-gtar
2367!:ext	tar/gtar
2368>>>156	ubyte		0x56		GNU tar archive
2369!:mime	application/x-gtar
2370!:ext	tar/gtar
2371>>>156	default		x		tar archive (V7)
2372!:mime	application/x-tar
2373!:ext	tar
2374# other stuff in padding
2375# some implementations add new fields to the blank area at the end of the header record
2376# created for example by DOS TAR 3.20g 1994 Tim V.Shapore with -j option
2377>>257	ulong		!0		tar archive (old)
2378!:mime	application/x-tar
2379!:ext	tar
2380# magic in newer, GNU, posix variants
2381>257	string		=ustar
2382# 2 last char of magic and UStar version because string expression does not work
2383# 2 space characters followed by a null for GNU variant
2384>>261	ubelong		=0x72202000	POSIX tar archive (GNU)
2385!:mime	application/x-gtar
2386!:ext	tar/gtar
2387# UStar version with ASCII "00"
2388>>261	ubelong		0x72003030	POSIX
2389# gLOBAL and ExTENSION type only found in POSIX.1-2001 format
2390>>>156	ubyte		0x67		\b.1-2001
2391>>>156	ubyte		0x78		\b.1-2001
2392>>>156	ubyte		x		tar archive
2393!:mime	application/x-ustar
2394!:ext	tar/ustar
2395# version with 2 binary nuls embedded in Android Backup like com.android.settings.ab
2396>>261	ubelong		0x72000000	tar archive (ustar)
2397!:mime	application/x-ustar
2398!:ext	tar/ustar
2399# not seen ustar variant with garbish version
2400>>261	default		x		tar archive (unknown ustar)
2401!:mime	application/x-ustar
2402!:ext	tar/ustar
2403# type flag of 1st tar archive member
2404#>156	ubyte		x		\b, %c-type
2405>156	ubyte		x
2406>>156	ubyte		0		\b, file
2407>>156	ubyte		0x30		\b, file
2408>>156	ubyte		0x31		\b, hard link
2409>>156	ubyte		0x32		\b, symlink
2410>>156	ubyte		0x33		\b, char device
2411>>156	ubyte		0x34		\b, block device
2412>>156	ubyte		0x35		\b, directory
2413>>156	ubyte		0x36		\b, fifo
2414>>156	ubyte		0x37		\b, reserved
2415>>156	ubyte		0x4c		\b, long path
2416>>156	ubyte		0x4d		\b, multi volume
2417>>156	ubyte		0x56		\b, volume
2418>>156	ubyte		0x67		\b, global
2419>>156	ubyte		0x78		\b, extension
2420>>156	default		x		\b, type
2421>>>156	ubyte		x		'%c'
2422# name[100]
2423>0	string		>\0		%-.60s
2424# mode mainly stored as an octal number in ASCII null or space terminated
2425>100	string		>\0		\b, mode %-.7s
2426# user id mainly as octal numbers in ASCII null or space terminated
2427>108	string		>\0		\b, uid %-.7s
2428# group id mainly as octal numbers in ASCII null or space terminated
2429>116	string		>\0		\b, gid %-.7s
2430# size mainly as octal number in ASCII
2431>124	ubyte		<0x38
2432>>124	string		>\0		\b, size %-.12s
2433# coding indicated by setting the high-order bit of the leftmost byte
2434>124	ubyte		>0xEF		\b, size 0x
2435>>124	ubyte		!0xff		\b%2.2x
2436>>125	ubyte		!0xff		\b%2.2x
2437>>126	ubyte		!0xff		\b%2.2x
2438>>127	ubyte		!0xff		\b%2.2x
2439>>128	ubyte		!0xff		\b%2.2x
2440>>129	ubyte		!0xff		\b%2.2x
2441>>130	ubyte		!0xff		\b%2.2x
2442>>131	ubyte		!0xff		\b%2.2x
2443>>132	ubyte		!0xff		\b%2.2x
2444>>133	ubyte		!0xff		\b%2.2x
2445>>134	ubyte		!0xff		\b%2.2x
2446>>135	ubyte		!0xff		\b%2.2x
2447# seconds since 0:0:0 1 jan 1970 UTC as octal number mainly in ASCII null or space terminated
2448>136	string		>\0		\b, seconds %-.11s
2449# header checksum stored as an octal number in ASCII null or space terminated
2450#>148	string		x		\b, cksum %.7s
2451# linkname[100]
2452>157	string		>\0		\b, linkname %-.40s
2453# additional fields for ustar
2454>257	string		=ustar
2455# owner user name null terminated
2456>>265	string		>\0		\b, user %-.32s
2457# group name null terminated
2458>>297	string		>\0		\b, group %-.32s
2459# device major minor if not zero
2460>>329	ubequad&0xCFCFCFCFcFcFcFdf	!0
2461>>>329	string		x		\b, devmaj %-.7s
2462>>337	ubequad&0xCFCFCFCFcFcFcFdf	!0
2463>>>337	string		x		\b, devmin %-.7s
2464# prefix[155]
2465>>345	string		>\0		\b, prefix %-.155s
2466# old non ustar/POSIX tar
2467>257	string		!ustar
2468>>508	string		=tar\0
2469# padding[255] in old star
2470>>>257	string		>\0		\b, padding: %-.40s
2471>>508	default		x
2472# padding[255] in old tar sometimes comment field
2473>>>257	string		>\0		\b, comment: %-.40s
2474
2475# Incremental snapshot gnu-tar format from:
2476# https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
24770	string		GNU\ tar-	GNU tar incremental snapshot data
2478>&0	regex		[0-9]\.[0-9]+-[0-9]+	version %s
2479
2480# cpio archives
2481#
2482# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
2483# The idea is to indicate archives produced on machines with the same
2484# byte order as the machine running "file" with "cpio archive", and
2485# to indicate archives produced on machines with the opposite byte order
2486# from the machine running "file" with "byte-swapped cpio archive".
2487#
2488# The SVR4 "cpio(4)" hints that there are additional formats, but they
2489# are defined as "short"s; I think all the new formats are
2490# character-header formats and thus are strings, not numbers.
24910	short		070707		cpio archive
2492!:mime	application/x-cpio
24930	short		0143561		byte-swapped cpio archive
2494!:mime	application/x-cpio # encoding: swapped
24950	string		070707		ASCII cpio archive (pre-SVR4 or odc)
24960	string		070701		ASCII cpio archive (SVR4 with no CRC)
24970	string		070702		ASCII cpio archive (SVR4 with CRC)
2498
2499#
2500# Various archive formats used by various versions of the "ar"
2501# command.
2502#
2503
2504#
2505# Original UNIX archive formats.
2506# They were written with binary values in host byte order, and
2507# the magic number was a host "int", which might have been 16 bits
2508# or 32 bits.  We don't say "PDP-11" or "VAX", as there might have
2509# been ports to little-endian 16-bit-int or 32-bit-int platforms
2510# (x86?) using some of those formats; if none existed, feel free
2511# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian
2512# 32-bit.  There might have been big-endian ports of that sort as
2513# well.
2514#
25150	leshort		0177555		very old 16-bit-int little-endian archive
25160	beshort		0177555		very old 16-bit-int big-endian archive
25170	lelong		0177555		very old 32-bit-int little-endian archive
25180	belong		0177555		very old 32-bit-int big-endian archive
2519
25200	leshort		0177545		old 16-bit-int little-endian archive
2521>2	string		__.SYMDEF	random library
25220	beshort		0177545		old 16-bit-int big-endian archive
2523>2	string		__.SYMDEF	random library
25240	lelong		0177545		old 32-bit-int little-endian archive
2525>4	string		__.SYMDEF	random library
25260	belong		0177545		old 32-bit-int big-endian archive
2527>4	string		__.SYMDEF	random library
2528
2529#
2530# From "pdp" (but why a 4-byte quantity?)
2531#
25320	lelong		0x39bed		PDP-11 old archive
25330	lelong		0x39bee		PDP-11 4.0 archive
2534
2535#
2536# XXX - what flavor of APL used this, and was it a variant of
2537# some ar archive format?  It's similar to, but not the same
2538# as, the APL workspace magic numbers in pdp.
2539#
25400	long		0100554		apl workspace
2541
2542#
2543# System V Release 1 portable(?) archive format.
2544#
25450	string		=<ar>		System V Release 1 ar archive
2546!:mime	application/x-archive
2547
2548#
2549# Debian package; it's in the portable archive format, and needs to go
2550# before the entry for regular portable archives, as it's recognized as
2551# a portable archive whose first member has a name beginning with
2552# "debian".
2553#
2554# Update: Joerg Jenderek
2555# URL: https://en.wikipedia.org/wiki/Deb_(file_format)
25560	string		=!<arch>\ndebian
2557# https://manpages.debian.org/testing/dpkg/dpkg-split.1.en.html
2558>14	string		-split	part of multipart Debian package
2559!:mime	application/vnd.debian.binary-package
2560# udeb is used for stripped down deb file
2561!:ext	deb/udeb
2562>14	string		-binary	Debian binary package
2563!:mime	application/vnd.debian.binary-package
2564!:ext	deb/udeb
2565# This should not happen
2566>14	default		x	Unknown Debian package
2567# NL terminated version; for most Debian cases this is 2.0 or 2.1 for splitted
2568>68	string		>\0		(format %s)
2569#>68	string		!2.0\n
2570#>>68	string		x		(format %.3s)
2571>68	string		=2.0\n
2572# 2nd archive name=control archive name like control.tar.gz or control.tar.xz
2573>>72	string		>\0		\b, with %.14s
2574# look for 3rd archive name=data archive name like data.tar.{gz,xz,bz2,lzma}
2575>>0	search/0x93e4f	data.tar.	\b, data compression
2576# the above line only works if FILE_BYTES_MAX in ../../src/file.h is raised
2577# for example like libreoffice-dev-doc_1%3a5.2.7-1+rpi1+deb9u3_all.deb
2578>>>&0	string		x		%.4s
2579# splitted debian package case
2580>68	string		=2.1\n
2581# dpkg-1.18.25/dpkg-split/info.c
2582# NL terminated ASCII package name like ckermit
2583>>&0	string		x		\b, %s
2584# NL terminated package version like 302-5.3
2585>>>&1	string		x		%s
2586# NL terminated MD5 checksum
2587>>>>&1	string		x		\b, MD5 %s
2588# NL terminated original package length
2589>>>>>&1	string		x		\b, unsplitted size %s
2590# NL terminated part length
2591>>>>>>&1	string	x		\b, part lenght %s
2592# NL terminated package part like n/m
2593>>>>>>>&1	string	x		\b, part %s
2594# NL terminated package architecture like armhf since dpkg 1.16.1 or later
2595>>>>>>>>&1	string	x		\b, %s
2596
2597#
2598# MIPS archive; they're in the portable archive format, and need to go
2599# before the entry for regular portable archives, as it's recognized as
2600# a portable archive whose first member has a name beginning with
2601# "__________E".
2602#
26030	string	=!<arch>\n__________E	MIPS archive
2604!:mime	application/x-archive
2605>20	string	U			with MIPS Ucode members
2606>21	string	L			with MIPSEL members
2607>21	string	B			with MIPSEB members
2608>19	string	L			and an EL hash table
2609>19	string	B			and an EB hash table
2610>22	string	X			-- out of date
2611
2612#
2613# BSD/SVR2-and-later portable archive formats.
2614#
2615# Update: Joerg Jenderek
2616# URL:		http://fileformats.archiveteam.org/wiki/AR
2617# Reference:	https://www.unix.com/man-page/opensolaris/3HEAD/ar.h/
2618# Note:		Mach-O universal binary in ./cafebabe is dependent
2619# TODO:		unify current ar archive, MIPS archive, Debian package
2620#		distinguish BSD, SVR; 32, 64 bit; HP from other 32-bit SVR;
2621#		*.ar packages from *.a libraries. handle empty archive
26220	string		=!<arch>\n		current ar archive
2623# print first and possibly second ar_name[16] for debugging purpose
2624#>8			string	x	\b, 1st "%.16s"
2625#>68			string	x	\b, 2nd "%.16s"
2626!:mime	application/x-archive
2627# a in most case for libraries; lib for Microsoft libraries; ar else cases
2628!:ext	a/lib/ar
2629>8	string		__.SYMDEF	random library
2630# first member with long marked name __.SYMDEF SORTED implies BSD library
2631>68	string		__.SYMDEF\ SORTED	random library
2632# Reference: https://parisc.wiki.kernel.org/images-parisc/b/b2/Rad_11_0_32.pdf
2633# "archive file" entry moved from ./hp
2634# LST header system_id 0210h~PA-RISC 1.1,... identifies the target architecture
2635# LST header a_magic 0619h~relocatable library
2636>68	belong 		0x020b0619	- PA-RISC1.0 relocatable library
2637>68	belong	 	0x02100619	- PA-RISC1.1 relocatable library
2638>68	belong 		0x02110619	- PA-RISC1.2 relocatable library
2639>68	belong 		0x02140619	- PA-RISC2.0 relocatable library
2640#EOF for common ar archives
2641
2642#
2643# "Thin" archive, as can be produced by GNU ar.
2644#
26450	string		=!<thin>\n	thin archive with
2646>68	belong		0		no symbol entries
2647>68	belong		1		%d symbol entry
2648>68	belong		>1		%d symbol entries
2649
26500	search/1	-h-		Software Tools format archive text
2651
2652# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
2653#
2654# The first byte is the magic (0x1a), byte 2 is the compression type for
2655# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
2656# filename of the first file (null terminated).  Since some types collide
2657# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
2658# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%).  0x01 collides with terminfo.
26590	lelong&0x8080ffff	0x0000081a	ARC archive data, dynamic LZW
2660!:mime	application/x-arc
26610	lelong&0x8080ffff	0x0000091a	ARC archive data, squashed
2662!:mime	application/x-arc
26630	lelong&0x8080ffff	0x0000021a	ARC archive data, uncompressed
2664!:mime	application/x-arc
26650	lelong&0x8080ffff	0x0000031a	ARC archive data, packed
2666!:mime	application/x-arc
26670	lelong&0x8080ffff	0x0000041a	ARC archive data, squeezed
2668!:mime	application/x-arc
26690	lelong&0x8080ffff	0x0000061a	ARC archive data, crunched
2670!:mime	application/x-arc
2671# [JW] stuff taken from idarc, obviously ARC successors:
26720	lelong&0x8080ffff	0x00000a1a	PAK archive data
2673!:mime	application/x-arc
26740	lelong&0x8080ffff	0x0000141a	ARC+ archive data
2675!:mime	application/x-arc
26760	lelong&0x8080ffff	0x0000481a	HYP archive data
2677!:mime	application/x-arc
2678
2679# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
2680# I can't create either SPARK or ArcFS archives so I have not tested this stuff
2681# [GRR:  the original entries collide with ARC, above; replaced with combined
2682#  version (not tested)]
2683#0	byte		0x1a		RISC OS archive (spark format)
26840	string		\032archive	RISC OS archive (ArcFS format)
26850       string          Archive\000     RISC OS archive (ArcFS format)
2686
2687# All these were taken from idarc, many could not be verified. Unfortunately,
2688# there were many low-quality sigs, i.e. easy to trigger false positives.
2689# Please notify me of any real-world fishy/ambiguous signatures and I'll try
2690# to get my hands on the actual archiver and see if I find something better. [JW]
2691# probably many can be enhanced by finding some 0-byte or control char near the start
2692
2693# idarc calls this Crush/Uncompressed... *shrug*
26940	string	CRUSH Crush archive data
2695# Squeeze It (.sqz)
26960	string	HLSQZ Squeeze It archive data
2697# SQWEZ
26980	string	SQWEZ SQWEZ archive data
2699# HPack (.hpk)
27000	string	HPAK HPack archive data
2701# HAP
27020	string	\x91\x33HF HAP archive data
2703# MD/MDCD
27040	string	MDmd MDCD archive data
2705# LIM
27060	string	LIM\x1a LIM archive data
2707# SAR
27083	string	LH5 SAR archive data
2709# BSArc/BS2
27100	string	\212\3SB\020\0	BSArc/BS2 archive data
2711# Bethesda Softworks Archive (Oblivion)
27120	string	BSA\0 		BSArc archive data
2713>4	lelong	x		version %d
2714# MAR
27152	string	=-ah MAR archive data
2716# ACB
2717#0	belong&0x00f800ff	0x00800000 ACB archive data
2718# CPZ
2719# TODO, this is what idarc says: 0	string	\0\0\0 CPZ archive data
2720# JRC
27210	string	JRchive JRC archive data
2722# Quantum
27230	string	DS\0 Quantum archive data
2724# ReSOF
27250	string	PK\3\6 ReSOF archive data
2726# QuArk
27270	string	7\4 QuArk archive data
2728# YAC
272914	string	YC YAC archive data
2730# X1
27310	string	X1 X1 archive data
27320	string	XhDr X1 archive data
2733# CDC Codec (.dqt)
27340	belong&0xffffe000	0x76ff2000 CDC Codec archive data
2735# AMGC
27360	string	\xad6" AMGC archive data
2737# NuLIB
27380	string	N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data
2739# PakLeo
27400	string	LEOLZW PAKLeo archive data
2741# ChArc
27420	string	SChF ChArc archive data
2743# PSA
27440	string	PSA PSA archive data
2745# CrossePAC
27460	string	DSIGDCC CrossePAC archive data
2747# Freeze
27480	string	\x1f\x9f\x4a\x10\x0a Freeze archive data
2749# KBoom
27500	string	\xc2\xa8MP\xc2\xa8 KBoom archive data
2751# NSQ, must go after CDC Codec
27520	string	\x76\xff NSQ archive data
2753# DPA
27540	string	Dirk\ Paehl DPA archive data
2755# BA
2756# TODO: idarc says "bytes 0-2 == bytes 3-5"
2757# TTComp
2758# URL: http://fileformats.archiveteam.org/wiki/TTComp_archive
2759# Update: Joerg Jenderek
2760# GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", others
27610	string	\0\6
2762# look for first keyword of Panorama database *.pan
2763>12	search/261	DESIGN
2764# skip keyword with low entropy
2765>12	default		x	TTComp archive, binary, 4K dictionary
2766# (version 5.25) labeled the above entry as "TTComp archive data"
2767# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
27680	string	ESP ESP archive data
2769# ZPack
27700	string	\1ZPK\1 ZPack archive data
2771# Sky
27720	string	\xbc\x40 Sky archive data
2773# UFA
27740	string	UFA UFA archive data
2775# Dry
27760	string	=-H2O DRY archive data
2777# FoxSQZ
27780	string	FOXSQZ FoxSQZ archive data
2779# AR7
27800	string	,AR7 AR7 archive data
2781# PPMZ
27820	string	PPMZ PPMZ archive data
2783# MS Compress
2784# Update: Joerg Jenderek
2785# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression
2786# Reference: https://hwiegman.home.xs4all.nl/fileformats/compress/szdd_kwaj_format.html
2787# Note: use correct version of extracting tool like EXPAND, UNPACK, DECOMP or 7Z
27884	string	\x88\xf0\x27
2789#		KWAJ variant
2790>0	string	KWAJ		MS Compress archive data, KWAJ variant
2791!:mime	application/x-ms-compress-kwaj
2792# extension not working in version 5.32
2793# magic/Magdir/archive, 284: Warning: EXTENSION type ` ??_' has bad char '?'
2794# file: line 284: Bad magic entry '   ??_'
2795!:ext	??_
2796# compression method (0-4)
2797>>8	uleshort	x	\b, %u method
2798# offset of compressed data
2799>>10	uleshort	x	\b, 0x%x offset
2800#>>(10.s)	uleshort	x
2801#>>>&-6		string	x	\b, TEST extension %-.3s
2802# header flags to mark header extensions
2803>>12	uleshort	>0	\b, 0x%x flags
2804# 4 bytes: decompressed length of file
2805>>12	uleshort	&0x01
2806>>>14	ulelong		x	\b, original size: %u bytes
2807# 2 bytes: unknown purpose
2808# 2 bytes: length of unknown data + mentioned bytes
2809# 1-9 bytes: null-terminated file name
2810# 1-4 bytes: null-terminated file extension
2811>>12	uleshort	&0x08
2812>>>12	uleshort				^0x01
2813>>>>12		uleshort			^0x02
2814>>>>>12			uleshort		^0x04
2815>>>>>>12			uleshort	^0x10
2816>>>>>>>14				string	x	\b, %-.8s
2817>>>>>>12			uleshort	&0x10
2818>>>>>>>14				string	x	\b, %-.8s
2819>>>>>>>>&1				string	x	\b.%-.3s
2820>>>>>12			uleshort		&0x04
2821>>>>>>12			uleshort	^0x10
2822>>>>>>>(14.s)			uleshort	x
2823>>>>>>>>&14				string	x	\b, %-.8s
2824>>>>>>12			uleshort	&0x10
2825>>>>>>>(14.s)			uleshort	x
2826>>>>>>>>&14				string	x	\b, %-.8s
2827>>>>>>>>>&1				string	x	\b.%-.3s
2828>>>>12		uleshort			&0x02
2829>>>>>12			uleshort		^0x04
2830>>>>>>12			uleshort	^0x10
2831>>>>>>>16				string	x	\b, %-.8s
2832>>>>>>12			uleshort	&0x10
2833>>>>>>>16				string	x	\b, %-.8s
2834>>>>>>>>&1				string	x	\b.%-.3s
2835>>>>>12			uleshort		&0x04
2836>>>>>>12			uleshort	^0x10
2837>>>>>>>(16.s)			uleshort	x
2838>>>>>>>>&16				string	x	\b, %-.8s
2839>>>>>>12			uleshort	&0x10
2840>>>>>>>(16.s)			uleshort	x
2841>>>>>>>&16				string	x	%-.8s
2842>>>>>>>>&1				string	x	\b.%-.3s
2843>>>12	uleshort				&0x01
2844>>>>12		uleshort			^0x02
2845>>>>>12			uleshort		^0x04
2846>>>>>>12			uleshort	^0x10
2847>>>>>>>18				string	x	\b, %-.8s
2848>>>>>>12			uleshort	&0x10
2849>>>>>>>18				string	x	\b, %-.8s
2850>>>>>>>>&1				string	x	\b.%-.3s
2851>>>>>12			uleshort		&0x04
2852>>>>>>12			uleshort	^0x10
2853>>>>>>>(18.s)			uleshort	x
2854>>>>>>>>&18				string	x	\b, %-.8s
2855>>>>>>12			uleshort	&0x10
2856>>>>>>>(18.s)			uleshort	x
2857>>>>>>>>&18				string	x	\b, %-.8s
2858>>>>>>>>>&1				string	x	\b.%-.3s
2859>>>>12		uleshort			&0x02
2860>>>>>12			uleshort		^0x04
2861>>>>>>12			uleshort	^0x10
2862>>>>>>>20				string	x	\b, %-.8s
2863>>>>>>12			uleshort	&0x10
2864>>>>>>>20				string	x	\b, %-.8s
2865>>>>>>>>&1				string	x	\b.%-.3s
2866>>>>>12			uleshort		&0x04
2867>>>>>>12			uleshort	^0x10
2868>>>>>>>(20.s)			uleshort	x
2869>>>>>>>>&20				string	x	\b, %-.8s
2870>>>>>>12			uleshort	&0x10
2871>>>>>>>(20.s)			uleshort	x
2872>>>>>>>>&20				string	x	\b, %-.8s
2873>>>>>>>>>&1				string	x	\b.%-.3s
2874# 2 bytes: length of data + mentioned bytes
2875#
2876#		SZDD variant Haruhiko Okumura's LZSS or 7z type MsLZ
2877>0	string	SZDD		MS Compress archive data, SZDD variant
2878!:mime	application/x-ms-compress-szdd
2879!:ext	??_
2880# The character missing from the end of the filename (0=unknown)
2881>>9	string	>\0		\b, %-.1s is last character of original name
2882# https://www.betaarchive.com/forum/viewtopic.php?t=26161
2883# Compression mode: "A" (0x41) found but sometimes "B" in Windows 3.1 builds 026 and 034e
2884>>8	string	!A		\b, %-.1s method
2885>>10	ulelong	>0		\b, original size: %u bytes
2886#		QBasic SZDD variant
28873	string	\x88\xf0\x27
2888>0	string	SZ\x20		MS Compress archive data, QBasic variant
2889!:mime	application/x-ms-compress-sz
2890!:ext	??$
2891>>8	ulelong	>0		\b, original size: %u bytes
2892
2893# MP3 (archiver, not lossy audio compression)
28940	string	MP3\x1a MP3-Archiver archive data
2895# ZET
28960	string	OZ\xc3\x9d ZET archive data
2897# TSComp
28980	string	\x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
2899# ARQ
29000	string	gW\4\1 ARQ archive data
2901# Squash
29023	string	OctSqu Squash archive data
2903# Terse
29040	string	\5\1\1\0 Terse archive data
2905# PUCrunch
29060	string	\x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
2907# UHarc
29080	string	UHA UHarc archive data
2909# ABComp
29100	string	\2AB ABComp archive data
29110	string	\3AB2 ABComp archive data
2912# CMP
29130	string	CO\0 CMP archive data
2914# Splint
29150	string	\x93\xb9\x06 Splint archive data
2916# InstallShield
29170	string	\x13\x5d\x65\x8c InstallShield Z archive Data
2918# Gather
29191	string	GTH Gather archive data
2920# BOA
29210	string	BOA BOA archive data
2922# RAX
29230	string	ULEB\xa RAX archive data
2924# Xtreme
29250	string	ULEB\0 Xtreme archive data
2926# Pack Magic
29270	string	@\xc3\xa2\1\0 Pack Magic archive data
2928# BTS
29290	belong&0xfeffffff	0x1a034465 BTS archive data
2930# ELI 5750
29310	string	Ora\  ELI 5750 archive data
2932# QFC
29330	string	\x1aFC\x1a QFC archive data
29340	string	\x1aQF\x1a QFC archive data
2935# PRO-PACK
29360	string	RNC PRO-PACK archive data
2937# 777
29380	string	777 777 archive data
2939# LZS221
29400	string	sTaC LZS221 archive data
2941# HPA
29420	string	HPA HPA archive data
2943# Arhangel
29440	string	LG Arhangel archive data
2945# EXP1, uses bzip2
29460	string	0123456789012345BZh EXP1 archive data
2947# IMP
29480	string	IMP\xa IMP archive data
2949# NRV
29500	string	\x00\x9E\x6E\x72\x76\xFF NRV archive data
2951# Squish
29520	string	\x73\xb2\x90\xf4 Squish archive data
2953# Par
29540	string	PHILIPP Par archive data
29550	string	PAR Par archive data
2956# HIT
29570	string	UB HIT archive data
2958# SBX
29590	belong&0xfffff000	0x53423000 SBX archive data
2960# NaShrink
29610	string	NSK NaShrink archive data
2962# SAPCAR
29630	string	#\ CAR\ archive\ header SAPCAR archive data
29640	string	CAR\ 2.00RG SAPCAR archive data
2965# Disintegrator
29660	string	DST Disintegrator archive data
2967# ASD
29680	string	ASD ASD archive data
2969# InstallShield CAB
29700	string	ISc( InstallShield CAB
2971# TOP4
29720	string	T4\x1a TOP4 archive data
2973# BatComp left out: sig looks like COM executable
2974# so TODO: get real 4dos batcomp file and find sig
2975# BlakHole
29760	string	BH\5\7 BlakHole archive data
2977# BIX
29780	string	BIX0 BIX archive data
2979# ChiefLZA
29800	string	ChfLZ ChiefLZA archive data
2981# Blink
29820	string	Blink Blink archive data
2983# Logitech Compress
29840	string	\xda\xfa Logitech Compress archive data
2985# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
29861	string	(C)\ STEPANYUK ARS-Sfx archive data
2987# AKT/AKT32
29880	string	AKT32 AKT32 archive data
29890	string	AKT AKT archive data
2990# NPack
29910	string	MSTSM NPack archive data
2992# PFT
29930	string	\0\x50\0\x14 PFT archive data
2994# SemOne
29950	string	SEM SemOne archive data
2996# PPMD
29970	string	\x8f\xaf\xac\x84 PPMD archive data
2998# FIZ
29990	string	FIZ FIZ archive data
3000# MSXiE
30010	belong&0xfffff0f0	0x4d530000 MSXiE archive data
3002# DeepFreezer
30030	belong&0xfffffff0	0x797a3030 DeepFreezer archive data
3004# DC
30050	string	=<DC- DC archive data
3006# TPac
30070	string	\4TPAC\3 TPac archive data
3008# Ai
30090	string	Ai\1\1\0 Ai archive data
30100	string	Ai\1\0\0 Ai archive data
3011# Ai32
30120	string	Ai\2\0 Ai32 archive data
30130	string	Ai\2\1 Ai32 archive data
3014# SBC
30150	string	SBC SBC archive data
3016# Ybs
30170	string	YBS Ybs archive data
3018# DitPack
30190	string	\x9e\0\0 DitPack archive data
3020# DMS
30210	string	DMS! DMS archive data
3022# EPC
30230	string	\x8f\xaf\xac\x8c EPC archive data
3024# VSARC
30250	string	VS\x1a VSARC archive data
3026# PDZ
30270	string	PDZ PDZ archive data
3028# ReDuq
30290	string	rdqx ReDuq archive data
3030# GCA
30310	string	GCAX GCA archive data
3032# PPMN
30330	string	pN PPMN archive data
3034# WinImage
30353	string	WINIMAGE WinImage archive data
3036# Compressia
30370	string	CMP0CMP Compressia archive data
3038# UHBC
30390	string	UHB UHBC archive data
3040# WinHKI
30410	string	\x61\x5C\x04\x05 WinHKI archive data
3042# WWPack data file
30430	string	WWP WWPack archive data
3044# BSN (BSA, PTS-DOS)
30450	string	\xffBSG BSN archive data
30461	string	\xffBSG BSN archive data
30473	string	\xffBSG BSN archive data
30481	string	\0\xae\2 BSN archive data
30491	string	\0\xae\3 BSN archive data
30501	string	\0\xae\7 BSN archive data
3051# AIN
30520	string	\x33\x18 AIN archive data
30530	string	\x33\x17 AIN archive data
3054# XPA32 test moved and merged with XPA by Joerg Jenderek at Sep 2015
3055# SZip (TODO: doesn't catch all versions)
30560	string	SZ\x0a\4 SZip archive data
3057# XPack DiskImage
3058# *.XDI updated by Joerg Jenderek Sep 2015
3059# ftp://ftp.sac.sk/pub/sac/pack/0index.txt
3060# GRR: this test is still too general as it catches also text files starting with jm
30610	string	jm
3062# only found examples with this additional characteristic 2 bytes
3063>2	string	\x2\x4	Xpack DiskImage archive data
3064#!:ext xdi
3065# XPack Data
3066# *.xpa updated by Joerg Jenderek Sep 2015
3067# ftp://ftp.elf.stuba.sk/pub/pc/pack/
30680	string	xpa	XPA
3069!:ext	xpa
3070# XPA32
3071# ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip
3072# created by XPA32.EXE version 1.0.2 for Windows
3073>0	string	xpa\0\1 \b32 archive data
3074# created by XPACK.COM version 1.67m or 1.67r with short 0x1800
3075>3	ubeshort	!0x0001	\bck archive data
3076# XPack Single Data
3077# changed by Joerg Jenderek Sep 2015 back to like in version 5.12
3078# letter 'I'+ acute accent is equivalent to \xcd
30790	string	\xcd\ jm	Xpack single archive data
3080#!:mime	application/x-xpa-compressed
3081!:ext xpa
3082
3083# TODO: missing due to unknown magic/magic at end of file:
3084#DWC
3085#ARG
3086#ZAR
3087#PC/3270
3088#InstallIt
3089#RKive
3090#RK
3091#XPack Diskimage
3092
3093# These were inspired by idarc, but actually verified
3094# Dzip archiver (.dz)
3095# Update: Joerg Jenderek
3096# URL: http://speeddemosarchive.com/dzip/
3097# reference: http://speeddemosarchive.com/dzip/dz29src.zip/main.c
3098# GRR: line below is too general as it matches also ASCII texts like Doszip commander help dz.txt
30990	string	DZ
3100# latest version is 2.9 dated 7 may 2003
3101>2	byte	<4 Dzip archive data
3102!:mime	application/x-dzip
3103!:ext	dz
3104>>2	byte	x \b, version %i
3105>>3	byte	x \b.%i
3106>>4	ulelong	x \b, offset 0x%x
3107>>8	ulelong	x \b, %u files
3108# ZZip archiver (.zz)
31090	string	ZZ\ \0\0 ZZip archive data
31100	string	ZZ0 ZZip archive data
3111# PAQ archiver (.paq)
31120	string	\xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
31130	string	PAQ PAQ archive data
3114>3	byte&0xf0	0x30
3115>>3	byte	x (v%c)
3116# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
31170xe	string	\x1aJar\x1b JAR (ARJ Software, Inc.) archive data
31180	string	JARCS JAR (ARJ Software, Inc.) archive data
3119
3120# ARJ archiver (jason@jarthur.Claremont.EDU)
31210	leshort		0xea60		ARJ archive data
3122!:mime	application/x-arj
3123>5	byte		x		\b, v%d,
3124>8	byte		&0x04		multi-volume,
3125>8	byte		&0x10		slash-switched,
3126>8	byte		&0x20		backup,
3127>34	string		x		original name: %s,
3128>7	byte		0		os: MS-DOS
3129>7	byte		1		os: PRIMOS
3130>7	byte		2		os: Unix
3131>7	byte		3		os: Amiga
3132>7	byte		4		os: Macintosh
3133>7	byte		5		os: OS/2
3134>7	byte		6		os: Apple ][ GS
3135>7	byte		7		os: Atari ST
3136>7	byte		8		os: NeXT
3137>7	byte		9		os: VAX/VMS
3138>3	byte		>0		%d]
3139# [JW] idarc says this is also possible
31402	leshort		0xea60		ARJ archive data
3141
3142# HA archiver (Greg Roelofs, newt@uchicago.edu)
3143# This is a really bad format. A file containing HAWAII will match this...
3144#0	string		HA		HA archive data,
3145#>2	leshort		=1		1 file,
3146#>2	leshort		>1		%hu files,
3147#>4	byte&0x0f	=0		first is type CPY
3148#>4	byte&0x0f	=1		first is type ASC
3149#>4	byte&0x0f	=2		first is type HSC
3150#>4	byte&0x0f	=0x0e		first is type DIR
3151#>4	byte&0x0f	=0x0f		first is type SPECIAL
3152# suggestion: at least identify small archives (<1024 files)
31530  belong&0xffff00fc 0x48410000 HA archive data
3154>2	leshort		=1		1 file,
3155>2	leshort		>1		%u files,
3156>4	byte&0x0f	=0		first is type CPY
3157>4	byte&0x0f	=1		first is type ASC
3158>4	byte&0x0f	=2		first is type HSC
3159>4	byte&0x0f	=0x0e		first is type DIR
3160>4	byte&0x0f	=0x0f		first is type SPECIAL
3161
3162# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
31630	string		HPAK		HPACK archive data
3164
3165# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
31660	string		\351,\001JAM\ 		JAM archive,
3167>7	string		>\0			version %.4s
3168>0x26	byte		=0x27			-
3169>>0x2b	string          >\0			label %.11s,
3170>>0x27	lelong		x			serial %08x,
3171>>0x36	string		>\0			fstype %.8s
3172
3173# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
3174# Update: Joerg Jenderek
3175# URL: https://en.wikipedia.org/wiki/LHA_(file_format)
3176# Reference: https://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html
3177#
3178#	check and display information of lharc (LHa,PMarc) file
31790	name				lharc-file
3180# check 1st character of method id like -lz4- -lh5- or -pm2-
3181>2	string		-
3182# check 5th character of method id
3183>>6	string		-
3184# check header level 0 1 2 3
3185>>>20	ubyte		<4
3186# check 2nd, 3th and 4th character of method id
3187>>>>3	regex		\^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1)		\b
3188!:mime	application/x-lzh-compressed
3189# creator type "LHA "
3190!:apple	????LHA
3191# display archive type name like "LHa/LZS archive data" or "LArc archive"
3192>>>>>2	string		-lz		\b
3193!:ext	lzs
3194# already known  -lzs- -lz4- -lz5- with old names
3195>>>>>>2	string	-lzs		LHa/LZS archive data
3196>>>>>>3	regex	\^lz[45]	LHarc 1.x archive data
3197# missing -lz?- with wikipedia names
3198>>>>>>3	regex	\^lz[2378]	LArc archive
3199# display archive type name like "LHa (2.x) archive data"
3200>>>>>2	string		-lh		\b
3201# already known -lh0- -lh1- -lh2- -lh3-  -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names
3202>>>>>>3	regex		\^lh[01]	LHarc 1.x/ARX archive data
3203# LHice archiver use ".ICE" as name extension instead usual one ".lzh"
3204# FOOBAR archiver use ".foo" as name extension instead usual one
3205# "Florain Orjanov's and Olga Bachetska's ARchiver" not found at the moment
3206>>>>>>>2	string	-lh1		\b
3207!:ext lha/lzh/ice
3208>>>>>>3	regex		\^lh[23d]	LHa 2.x? archive data
3209>>>>>>3	regex		\^lh[7]		LHa (2.x)/LHark archive data
3210>>>>>>3	regex		\^lh[456]	LHa (2.x) archive data
3211>>>>>>>2	string	-lh5		\b
3212# https://en.wikipedia.org/wiki/BIOS
3213# Some mainboard BIOS like Award use LHa compression. So archives with unusal extension are found like
3214# bios.rom , kd7_v14.bin, 1010.004, ...
3215!:ext lha/lzh/rom/bin
3216# missing -lh?- variants (Joe Jared)
3217>>>>>>3	regex		\^lh[89a-ce]	LHa (Joe Jared) archive
3218# UNLHA32 2.67a
3219>>>>>>2	string		-lhx		LHa (UNLHA32) archive
3220# lha archives with standard file name extensions ".lha" ".lzh"
3221>>>>>>3	regex		!\^(lh1|lh5)	\b
3222!:ext lha/lzh
3223# this should not happen if all -lh variants are described
3224>>>>>>2	default		x		LHa (unknown) archive
3225#!:ext	lha
3226# PMarc
3227>>>>>3	regex		\^pm[012]	PMarc archive data
3228!:ext pma
3229# append method id without leading and trailing minus character
3230>>>>>3	string		x		[%3.3s]
3231>>>>>>0	use	lharc-header
3232#
3233#	check and display information of lharc header
32340	name				lharc-header
3235# header size 0x4 , 0x1b-0x61
3236>0	ubyte		x
3237# compressed data size != compressed file size
3238#>7	ulelong		x		\b, data size %d
3239# attribute: 0x2~?? 0x10~symlink|target 0x20~normal
3240#>19	ubyte		x		\b, 19_0x%x
3241# level identifier 0 1 2 3
3242#>20	ubyte		x		\b, level %d
3243# time stamp
3244#>15		ubelong	x		DATE 0x%8.8x
3245# OS ID for level 1
3246>20	ubyte		1
3247# 0x20 types find for *.rom files
3248>>(21.b+24)	ubyte	<0x21		\b, 0x%x OS
3249# ascii type like M for MSDOS
3250>>(21.b+24)	ubyte	>0x20		\b, '%c' OS
3251# OS ID for level 2
3252>20	ubyte		2
3253#>>23	ubyte		x		\b, OS ID 0x%x
3254>>23	ubyte		<0x21		\b, 0x%x OS
3255>>23	ubyte		>0x20		\b, '%c' OS
3256# filename only for level 0 and 1
3257>20	ubyte		<2
3258# length of filename
3259>>21		ubyte	>0		\b, with
3260# filename
3261>>>21		pstring	x		"%s"
3262#
3263#2	string		-lh0-		LHarc 1.x/ARX archive data [lh0]
3264#!:mime	application/x-lharc
32652	string		-lh0-
3266>0	use	lharc-file
3267#2	string		-lh1-		LHarc 1.x/ARX archive data [lh1]
3268#!:mime	application/x-lharc
32692	string		-lh1-
3270>0	use	lharc-file
3271# NEW -lz2- ... -lz8-
32722	string		-lz2-
3273>0	use	lharc-file
32742	string		-lz3-
3275>0	use	lharc-file
32762	string		-lz4-
3277>0	use	lharc-file
32782	string		-lz5-
3279>0	use	lharc-file
32802	string		-lz7-
3281>0	use	lharc-file
32822	string		-lz8-
3283>0	use	lharc-file
3284#	[never seen any but the last; -lh4- reported in comp.compression:]
3285#2	string		-lzs-		LHa/LZS archive data [lzs]
32862	string		-lzs-
3287>0	use	lharc-file
3288# According to wikipedia and others such a version does not exist
3289#2	string		-lh\40-		LHa 2.x? archive data [lh ]
3290#2	string		-lhd-		LHa 2.x? archive data [lhd]
32912	string		-lhd-
3292>0	use	lharc-file
3293#2	string		-lh2-		LHa 2.x? archive data [lh2]
32942	string		-lh2-
3295>0	use	lharc-file
3296#2	string		-lh3-		LHa 2.x? archive data [lh3]
32972	string		-lh3-
3298>0	use	lharc-file
3299#2	string		-lh4-		LHa (2.x) archive data [lh4]
33002	string		-lh4-
3301>0	use	lharc-file
3302#2	string		-lh5-		LHa (2.x) archive data [lh5]
33032	string		-lh5-
3304>0	use	lharc-file
3305#2	string		-lh6-		LHa (2.x) archive data [lh6]
33062	string		-lh6-
3307>0	use	lharc-file
3308#2	string		-lh7-		LHa (2.x)/LHark archive data [lh7]
33092	string		-lh7-
3310# !:mime	application/x-lha
3311# >20	byte		x		- header level %d
3312>0	use	lharc-file
3313# NEW -lh8- ... -lhe- , -lhx-
33142	string		-lh8-
3315>0	use	lharc-file
33162	string		-lh9-
3317>0	use	lharc-file
33182	string		-lha-
3319>0	use	lharc-file
33202	string		-lhb-
3321>0	use	lharc-file
33222	string		-lhc-
3323>0	use	lharc-file
33242	string		-lhe-
3325>0	use	lharc-file
33262	string		-lhx-
3327>0	use	lharc-file
3328# taken from idarc [JW]
33292   string      -lZ         PUT archive data
3330# already done by LHarc magics
3331# this should never happen if all sub types of LZS archive are identified
3332#2   string      -lz         LZS archive data
33332   string      -sw1-       Swag archive data
3334
33350	name		rar-file-header
3336>24	byte		15		\b, v1.5
3337>24	byte		20		\b, v2.0
3338>24	byte		29		\b, v4
3339>15	byte		0		\b, os: MS-DOS
3340>15	byte		1		\b, os: OS/2
3341>15	byte		2		\b, os: Win32
3342>15	byte		3		\b, os: Unix
3343>15	byte		4		\b, os: Mac OS
3344>15	byte		5		\b, os: BeOS
3345
33460	name		rar-archive-header
3347>3	leshort&0x1ff	>0		\b, flags:
3348>>3	leshort		&0x01		ArchiveVolume
3349>>3	leshort		&0x02		Commented
3350>>3	leshort		&0x04		Locked
3351>>3	leshort		&0x10		NewVolumeNaming
3352>>3	leshort		&0x08		Solid
3353>>3	leshort		&0x20		Authenticated
3354>>3	leshort		&0x40		RecoveryRecordPresent
3355>>3	leshort		&0x80		EncryptedBlockHeader
3356>>3	leshort		&0x100		FirstVolume
3357
3358# RAR (Roshal Archive) archive
33590	string		Rar!\x1a\7\0		RAR archive data
3360!:mime	application/x-rar
3361!:ext	rar/cbr
3362# file header
3363>(0xc.l+9)	byte	0x74
3364>>(0xc.l+7)	use	rar-file-header
3365# subblock seems to share information with file header
3366>(0xc.l+9)	byte	0x7a
3367>>(0xc.l+7)	use	rar-file-header
3368>9		byte	0x73
3369>>7		use	rar-archive-header
3370
33710	string		Rar!\x1a\7\1\0		RAR archive data, v5
3372!:mime	application/x-rar
3373!:ext	rar
3374
3375# Very old RAR archive
3376# https://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf
33770	string		RE\x7e\x5e  RAR archive data (<v1.5)
3378!:mime	application/x-rar
3379!:ext	rar/cbr
3380
3381# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
33820	string		SQSH		squished archive data (Acorn RISCOS)
3383
3384# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
3385# [JW] see exe section for self-extracting version
33860	string		UC2\x1a		UC2 archive data
3387
3388# PKZIP multi-volume archive
33890	string		PK\x07\x08PK\x03\x04	Zip multi-volume archive data, at least PKZIP v2.50 to extract
3390!:mime	application/zip
3391!:ext zip/cbz
3392
3393# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
33940	string		PK\005\006	Zip archive data (empty)
3395!:mime application/zip
3396!:ext zip/cbz
3397!:strength +1
33980	string		PK\003\004
3399!:strength +1
3400
3401# Specialised zip formats which start with a member named 'mimetype'
3402# (stored uncompressed, with no 'extra field') containing the file's MIME type.
3403# Check for have 8-byte name, 0-byte extra field, name "mimetype", and
3404#  contents starting with "application/":
3405>26	string		\x8\0\0\0mimetypeapplication/
3406
3407#  KOffice / OpenOffice & StarOffice / OpenDocument formats
3408#    From: Abel Cheung <abel@oaka.org>
3409
3410#   KOffice (1.2 or above) formats
3411#    (mimetype contains "application/vnd.kde.<SUBTYPE>")
3412>>50	string	vnd.kde.		KOffice (>=1.2)
3413>>>58	string	karbon			Karbon document
3414>>>58	string	kchart			KChart document
3415>>>58	string	kformula		KFormula document
3416>>>58	string	kivio			Kivio document
3417>>>58	string	kontour			Kontour document
3418>>>58	string	kpresenter		KPresenter document
3419>>>58	string	kspread			KSpread document
3420>>>58	string	kword			KWord document
3421
3422#   OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
3423#    (mimetype contains "application/vnd.sun.xml.<SUBTYPE>")
3424>>50	string	vnd.sun.xml.		OpenOffice.org 1.x
3425>>>62	string	writer			Writer
3426>>>>68	byte	!0x2e			document
3427>>>>68	string	.template		template
3428>>>>68	string	.global			global document
3429>>>62	string	calc			Calc
3430>>>>66	byte	!0x2e			spreadsheet
3431>>>>66	string	.template		template
3432>>>62	string	draw			Draw
3433>>>>66	byte	!0x2e			document
3434>>>>66	string	.template		template
3435>>>62	string	impress			Impress
3436>>>>69	byte	!0x2e			presentation
3437>>>>69	string	.template		template
3438>>>62	string	math			Math document
3439>>>62	string	base			Database file
3440
3441#   OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
3442#    https://lists.oasis-open.org/archives/office/200505/msg00006.html
3443#    (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>")
3444>>50	string	vnd.oasis.opendocument.	OpenDocument
3445>>>73	string	text
3446>>>>77	byte	!0x2d			Text
3447!:mime	application/vnd.oasis.opendocument.text
3448>>>>77	string	-template		Text Template
3449!:mime	application/vnd.oasis.opendocument.text-template
3450>>>>77	string	-web			HTML Document Template
3451!:mime	application/vnd.oasis.opendocument.text-web
3452>>>>77	string	-master			Master Document
3453!:mime	application/vnd.oasis.opendocument.text-master
3454>>>73	string	graphics
3455>>>>81	byte	!0x2d			Drawing
3456!:mime	application/vnd.oasis.opendocument.graphics
3457>>>>81	string	-template		Template
3458!:mime	application/vnd.oasis.opendocument.graphics-template
3459>>>73	string	presentation
3460>>>>85	byte	!0x2d			Presentation
3461!:mime	application/vnd.oasis.opendocument.presentation
3462>>>>85	string	-template		Template
3463!:mime	application/vnd.oasis.opendocument.presentation-template
3464>>>73	string	spreadsheet
3465>>>>84	byte	!0x2d			Spreadsheet
3466!:mime	application/vnd.oasis.opendocument.spreadsheet
3467>>>>84	string	-template		Template
3468!:mime	application/vnd.oasis.opendocument.spreadsheet-template
3469>>>73	string	chart
3470>>>>78	byte	!0x2d			Chart
3471!:mime	application/vnd.oasis.opendocument.chart
3472>>>>78	string	-template		Template
3473!:mime	application/vnd.oasis.opendocument.chart-template
3474>>>73	string	formula
3475>>>>80	byte	!0x2d			Formula
3476!:mime	application/vnd.oasis.opendocument.formula
3477>>>>80	string	-template		Template
3478!:mime	application/vnd.oasis.opendocument.formula-template
3479>>>73	string	database		Database
3480!:mime	application/vnd.oasis.opendocument.database
3481# Valid for LibreOffice Base 6.0.1.1 at least
3482>>>73	string	base 			Database
3483!:mime	application/vnd.oasis.opendocument.base
3484>>>73	string	image
3485>>>>78	byte	!0x2d			Image
3486!:mime	application/vnd.oasis.opendocument.image
3487>>>>78	string	-template		Template
3488!:mime	application/vnd.oasis.opendocument.image-template
3489
3490#  EPUB (OEBPS) books using OCF (OEBPS Container Format)
3491#    https://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4.
3492#    From: Ralf Brown <ralf.brown@gmail.com>
3493>>50	string	epub+zip	EPUB document
3494!:mime application/epub+zip
3495
3496#  Catch other ZIP-with-mimetype formats
3497#	In a ZIP file, the bytes immediately after a member's contents are
3498#	always "PK". The 2 regex rules here print the "mimetype" member's
3499#	contents up to the first 'P'. Luckily, most MIME types don't contain
3500#	any capital 'P's. This is a kludge.
3501#    (mimetype contains "application/<OTHER>")
3502>>50		string	!epub+zip
3503>>>50		string	!vnd.oasis.opendocument.
3504>>>>50		string	!vnd.sun.xml.
3505>>>>>50		string	!vnd.kde.
3506>>>>>>38	regex	[!-OQ-~]+		Zip data (MIME type "%s"?)
3507!:mime	application/zip
3508#    (mimetype contents other than "application/*")
3509>26		string	\x8\0\0\0mimetype
3510>>38		string	!application/
3511>>>38		regex	[!-OQ-~]+		Zip data (MIME type "%s"?)
3512!:mime	application/zip
3513
3514# Java Jar files
3515>(26.s+30)	leshort	0xcafe		Java archive data (JAR)
3516!:mime	application/java-archive
3517
3518# iOS App
3519>(26.s+30)	leshort	!0xcafe
3520>>26		string	!\x8\0\0\0mimetype
3521>>>30		string	Payload/
3522>>>>38		search/64       .app/   iOS App
3523!:mime application/x-ios-app
3524
3525
3526# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
3527#   Next line excludes specialized formats:
3528>(26.s+30)	leshort	!0xcafe
3529>>26    string          !\x8\0\0\0mimetype	Zip archive data
3530!:mime	application/zip
3531>>>4	beshort		x			\b, at least
3532>>>4	use		zipversion
3533>>>4	beshort		x			to extract
3534>>>0x161	string		WINZIP		\b, WinZIP self-extracting
3535
3536# StarView Metafile
3537# From Pierre Ducroquet <pinaraf@pinaraf.info>
35380	string	VCLMTF	StarView MetaFile
3539>6	beshort	x	\b, version %d
3540>8	belong	x	\b, size %d
3541
3542# Zoo archiver
354320	lelong		0xfdc4a7dc	Zoo archive data
3544!:mime	application/x-zoo
3545>4	byte		>48		\b, v%c.
3546>>6	byte		>47		\b%c
3547>>>7	byte		>47		\b%c
3548>32	byte		>0		\b, modify: v%d
3549>>33	byte		x		\b.%d+
3550>42	lelong		0xfdc4a7dc	\b,
3551>>70	byte		>0		extract: v%d
3552>>>71	byte		x		\b.%d+
3553
3554# Shell archives
355510	string		#\ This\ is\ a\ shell\ archive	shell archive text
3556!:mime	application/octet-stream
3557
3558#
3559# LBR. NB: May conflict with the questionable
3560#          "binary Computer Graphics Metafile" format.
3561#
35620       string  \0\ \ \ \ \ \ \ \ \ \ \ \0\0    LBR archive data
3563#
3564# PMA (CP/M derivative of LHA)
3565# Update: Joerg Jenderek
3566# URL: https://en.wikipedia.org/wiki/LHA_(file_format)
3567#
3568#2       string          -pm0-           PMarc archive data [pm0]
35692	string		-pm0-
3570>0	use	lharc-file
3571#2       string          -pm1-           PMarc archive data [pm1]
35722	string		-pm1-
3573>0	use	lharc-file
3574#2       string          -pm2-           PMarc archive data [pm2]
35752	string		-pm2-
3576>0	use	lharc-file
35772       string          -pms-           PMarc SFX archive (CP/M, DOS)
3578#!:mime	application/x-foobar-exec
3579!:ext com
35805       string          -pc1-           PopCom compressed executable (CP/M)
3581#!:mime	application/x-
3582#!:ext com
3583
3584# From Rafael Laboissiere <rafael@laboissiere.net>
3585# The Project Revision Control System (see
3586# http://prcs.sourceforge.net) generates a packaged project
3587# file which is recognized by the following entry:
35880	leshort		0xeb81	PRCS packaged project
3589
3590# Microsoft cabinets
3591# by David Necas (Yeti) <yeti@physics.muni.cz>
3592#0	string	MSCF\0\0\0\0	Microsoft cabinet file data,
3593#>25	byte	x		v%d
3594#>24	byte	x		\b.%d
3595# MPi: All CABs have version 1.3, so this is pointless.
3596# Better magic in debian-additions.
3597
3598# GTKtalog catalogs
3599# by David Necas (Yeti) <yeti@physics.muni.cz>
36004	string	gtktalog\ 	GTKtalog catalog data,
3601>13	string	3		version 3
3602>>14	beshort	0x677a		(gzipped)
3603>>14	beshort	!0x677a		(not gzipped)
3604>13	string	>3		version %s
3605
3606############################################################################
3607# Parity archive reconstruction file, the 'par' file format now used on Usenet.
36080       string          PAR\0	PARity archive data
3609>48	leshort		=0	- Index file
3610>48	leshort		>0	- file number %d
3611
3612# Felix von Leitner <felix-file@fefe.de>
36130	string	d8:announce	BitTorrent file
3614!:mime	application/x-bittorrent
3615# Durval Menezes, <jmgthbfile at durval dot com>
36160	string	d13:announce-list	BitTorrent file
3617!:mime	application/x-bittorrent
3618
3619# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
36200	beshort 0x0e0f		Atari MSA archive data
3621>2	beshort x		\b, %d sectors per track
3622>4	beshort 0		\b, 1 sided
3623>4	beshort 1		\b, 2 sided
3624>6	beshort x		\b, starting track: %d
3625>8	beshort x		\b, ending track: %d
3626
3627# Alternate ZIP string (amc@arwen.cs.berkeley.edu)
36280	string	PK00PK\003\004	Zip archive data
3629!:mime	application/zip
3630!:ext zip/cbz
3631
3632# ACE archive (from http://www.wotsit.org/download.asp?f=ace)
3633# by Stefan `Sec` Zehl <sec@42.org>
36347	string		**ACE**		ACE archive data
3635>15	byte	>0		version %d
3636>16	byte	=0x00		\b, from MS-DOS
3637>16	byte	=0x01		\b, from OS/2
3638>16	byte	=0x02		\b, from Win/32
3639>16	byte	=0x03		\b, from Unix
3640>16	byte	=0x04		\b, from MacOS
3641>16	byte	=0x05		\b, from WinNT
3642>16	byte	=0x06		\b, from Primos
3643>16	byte	=0x07		\b, from AppleGS
3644>16	byte	=0x08		\b, from Atari
3645>16	byte	=0x09		\b, from Vax/VMS
3646>16	byte	=0x0A		\b, from Amiga
3647>16	byte	=0x0B		\b, from Next
3648>14	byte	x		\b, version %d to extract
3649>5	leshort &0x0080		\b, multiple volumes,
3650>>17	byte	x		\b (part %d),
3651>5	leshort &0x0002		\b, contains comment
3652>5	leshort	&0x0200		\b, sfx
3653>5	leshort	&0x0400		\b, small dictionary
3654>5	leshort	&0x0800		\b, multi-volume
3655>5	leshort	&0x1000		\b, contains AV-String
3656>>30	string	\x16*UNREGISTERED\x20VERSION*	(unregistered)
3657>5	leshort &0x2000		\b, with recovery record
3658>5	leshort &0x4000		\b, locked
3659>5	leshort &0x8000		\b, solid
3660# Date in MS-DOS format (whatever that is)
3661#>18	lelong	x		Created on
3662
3663# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
3664# <doj@cubic.org>
36650x1A	string	sfArk		sfArk compressed Soundfont
3666>0x15	string	2
3667>>0x1	string	>\0		Version %s
3668>>0x2A	string	>\0		: %s
3669
3670# DR-DOS 7.03 Packed File *.??_
36710	string	Packed\ File\ 	Personal NetWare Packed File
3672>12	string	x		\b, was "%.12s"
3673
3674# EET archive
3675# From: Tilman Sauerbeck <tilman@code-monkey.de>
36760	belong	0x1ee7ff00	EET archive
3677!:mime	application/x-eet
3678
3679# rzip archives
36800	string	RZIP		rzip compressed data
3681>4	byte	x		- version %d
3682>5	byte	x		\b.%d
3683>6	belong	x		(%d bytes)
3684
3685# From:		Joerg Jenderek
3686# URL:		https://help.foxitsoftware.com/kb/install-fzip-file.php
3687# reference:	http://mark0.net/download/triddefs_xml.7z/
3688#		defs/f/fzip.trid.xml
3689# Note: unknown compression; No "PK" zip magic; normally in directory like
3690#	"%APPDATA%\Foxit Software\Addon\Foxit Reader\Install"
36910	ubequad	0x2506781901010000	Foxit add-on/update
3692!:mime	application/x-fzip
3693!:ext	fzip
3694
3695# From: "Robert Dale" <robdale@gmail.com>
36960	belong	123		dar archive,
3697>4	belong	x		label "%.8x
3698>>8	belong	x		%.8x
3699>>>12	beshort	x		%.4x"
3700>14	byte	0x54		end slice
3701>14	beshort	0x4e4e		multi-part
3702>14	beshort	0x4e53		multi-part, with -S
3703
3704# Symbian installation files
3705#  https://www.thouky.co.uk/software/psifs/sis.html
3706#  http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
37078	lelong	0x10000419	Symbian installation file
3708!:mime	application/vnd.symbian.install
3709>4	lelong	0x1000006D	(EPOC release 3/4/5)
3710>4	lelong	0x10003A12	(EPOC release 6)
37110	lelong	0x10201A7A	Symbian installation file (Symbian OS 9.x)
3712!:mime	x-epoc/x-sisx-app
3713
3714# From "Nelson A. de Oliveira" <naoliv@gmail.com>
37150	string	MPQ\032		MoPaQ (MPQ) archive
3716
3717# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
3718# .kgb
37190	string KGB_arch		KGB Archiver file
3720>10	string x		with compression level %.1s
3721
3722# xar (eXtensible ARchiver) archive
3723# URL: https://en.wikipedia.org/wiki/Xar_(archiver)
3724# xar archive format: https://code.google.com/p/xar/
3725# From: "David Remahl" <dremahl@apple.com>
3726# Update: Joerg Jenderek
3727# TODO: lzma compression; X509Data for pkg and xip
3728# Note: verified by `xar --dump-header -f FullBundleUpdate.xar` or
3729# 7z t -txar Xcode_10.2_beta_4.xip`
37300	string	xar!		xar archive
3731!:mime	application/x-xar
3732# pkg for Mac OSX installer package like FullBundleUpdate.pkg
3733# xip for signed Apple software like Xcode_10.2_beta_4.xip
3734!:ext	xar/pkg/xip
3735# always 28 in older archives
3736>4	ubeshort >28		\b, header size %u
3737# currently there exit only version 1 since about 2014
3738>6	ubeshort >1		version %u,
3739>8	ubequad	x		compressed TOC: %llu,
3740#>16	ubequad	x		uncompressed TOC: %llu,
3741# cksum_alg 0-2 in older and also 3-4 in newer
3742>24	belong	0		no checksum
3743>24	belong	1		SHA-1 checksum
3744>24	belong	2		MD5 checksum
3745>24	belong	3		SHA-256 checksum
3746>24	belong	4		SHA-512 checksum
3747>24	belong	>4		unknown 0x%x checksum
3748#>24	belong	>4		checksum
3749#			For no compression jump 0 bytes
3750>24	belong	0
3751>>0		ubyte	x
3752# jump more bytes forward by header size
3753>>>&(4.S)	ubyte	x
3754# jump more bytes forward by compressed table of contents size
3755#>>>>&(8.Q)	ubequad	x	\b, heap data 0x%llx
3756>>>>&(8.Q)	ubyte	x
3757# look for data by ./compress after message with 1 space at end
3758>>>>>&-3	indirect x	\b, contains
3759#			For SHA-1 jump 20 minus 2 bytes
3760>24	belong	1
3761>>18		ubyte	x
3762# jump more bytes forward by header size
3763>>>&(4.S)	ubyte	x
3764# jump more bytes forward by compressed table of contents size
3765>>>>&(8.Q)	ubyte	x
3766# data compressed by gzip, bzip, lzma or none
3767>>>>>&-1	indirect x	\b, contains
3768#			For SHA-256 jump 32 minus 2 bytes
3769>24	belong	3
3770>>30		ubyte	x
3771# jump more bytes forward by header size
3772>>>&(4.S)	ubyte	x
3773# jump more bytes forward by compressed table of contents size
3774>>>>&(8.Q)	ubyte	x
3775>>>>>&-1	indirect x	\b, contains
3776#			For SHA-512 jump 64 minus 2 bytes
3777>24	belong	4
3778>>62		ubyte	x
3779# jump more bytes forward by header size
3780>>>&(4.S)	ubyte	x
3781# jump more bytes forward by compressed table of contents size
3782>>>>&(8.Q)	ubyte	x
3783>>>>>&-1	indirect x	\b, contains
3784
3785# Type: Parity Archive
3786# From: Daniel van Eeden <daniel_e@dds.nl>
37870	string	PAR2		Parity Archive Volume Set
3788
3789# Bacula volume format. (Volumes always start with a block header.)
3790# URL: https://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html
3791# From: Adam Buchbinder <adam.buchbinder@gmail.com>
379212	string	BB02		Bacula volume
3793>20	bedate	x		\b, started %s
3794
3795# ePub is XHTML + XML inside a ZIP archive.  The first member of the
3796#   archive must be an uncompressed file called 'mimetype' with contents
3797#   'application/epub+zip'
3798
3799
3800# From: "Michael Gorny" <mgorny@gentoo.org>
3801# ZPAQ: http://mattmahoney.net/dc/zpaq.html
38020	string	zPQ	ZPAQ stream
3803>3	byte	x	\b, level %d
3804# From: Barry Carter <carter.barry@gmail.com>
3805# https://encode.ru/threads/456-zpaq-updates/page32
38060	string	7kSt	ZPAQ file
3807
3808# BBeB ebook, unencrypted (LRF format)
3809# URL: https://www.sven.de/librie/Librie/LrfFormat
3810# From: Adam Buchbinder <adam.buchbinder@gmail.com>
38110	string	L\0R\0F\0\0\0	BBeB ebook data, unencrypted
3812>8	beshort	x		\b, version %d
3813>36	byte	1		\b, front-to-back
3814>36	byte	16		\b, back-to-front
3815>42	beshort	x		\b, (%dx,
3816>44	beshort	x		%d)
3817
3818# Symantec GHOST image by Joerg Jenderek at May 2014
3819# https://us.norton.com/ghost/
3820# https://www.garykessler.net/library/file_sigs.html
38210		ubelong&0xFFFFf7f0	0xFEEF0100	Norton GHost image
3822# *.GHO
3823>2		ubyte&0x08		0x00		\b, first file
3824# *.GHS or *.[0-9] with cns program option
3825>2		ubyte&0x08		0x08		\b, split file
3826# part of split index interesting for *.ghs
3827>>4		ubyte			x		id=0x%x
3828# compression tag minus one equals numeric compression command line switch z[1-9]
3829>3		ubyte			0		\b, no compression
3830>3		ubyte			2		\b, fast compression (Z1)
3831>3		ubyte			3		\b, medium compression (Z2)
3832>3		ubyte			>3
3833>>3		ubyte			<11		\b, compression (Z%d-1)
3834>2		ubyte&0x08		0x00
3835# ~ 30 byte password field only for *.gho
3836>>12		ubequad			!0		\b, password protected
3837>>44		ubyte			!1
3838# 1~Image All, sector-by-sector only for *.gho
3839>>>10		ubyte			1		\b, sector copy
3840# 1~Image Boot track only for *.gho
3841>>>43		ubyte			1		\b, boot track
3842# 1~Image Disc only for *.gho implies Image Boot track and sector copy
3843>>44		ubyte			1		\b, disc sector copy
3844# optional image description only *.gho
3845>>0xff		string			>\0		"%-.254s"
3846# look for DOS sector end sequence
3847>0xE08	search/7776		\x55\xAA
3848>>&-512	indirect		x		\b; contains
3849
3850# Google Chrome extensions
3851# https://developer.chrome.com/extensions/crx
3852# https://developer.chrome.com/extensions/hosting
38530	string	Cr24	Google Chrome extension
3854!:mime	application/x-chrome-extension
3855>4	ulong	x	\b, version %u
3856
3857# SeqBox - Sequenced container
3858# ext: sbx, seqbox
3859# Marco Pontello marcopon@gmail.com
3860# reference: https://github.com/MarcoPon/SeqBox
38610	string	SBx	SeqBox,
3862>3	byte	x	version %d
3863
3864# LyNX archive
386556	string	USE\040LYNX\040TO\040DISSOLVE\040THIS\040FILE	 LyNX archive
3866
3867# From: Joerg Jenderek
3868# URL: https://www.acronis.com/
3869# Reference: https://en.wikipedia.org/wiki/TIB_(file_format)
3870# Note: only tested with True Image 2013 Build 5962 and 2019 Build 14110
38710	ubequad		0xce24b9a220000000	Acronis True Image backup
3872!:mime	application/x-acronis-tib
3873!:ext	tib
3874# 01000000
3875#>20	ubelong		x			\b, at 20 0x%x
3876# 20000000
3877#>28	ubelong		x			\b, at 28 0x%x
3878# strings like "Generic- SD/MMC 1.00" "Unknown Disk" "Msft Virtual Disk 1.0"
3879# ???
3880# strings like "\Device\0000011e" "\Device\0000015a"
3881#>0	search/0x6852300/cs	\\Device\\
3882#>>&-1	pstring		x			\b, %s
3883# "\Device\HarddiskVolume30" "\Device\HarddiskVolume39"
3884#>>>&1	search/180/cs	\\Device\\
3885#>>>>&-1	pstring		x			\b, %s
3886#>>>>>&0	search/29/cs	\0\0\xc8\0
3887# disk label
3888#>>>>>>&10	lestring16	x		\b, disk label %11.11s
3889#>>>>>>&9	plestring16	x		\b, disk label "%11.11s"
3890#>>>>>>&10	ubequad	x			%16.16llx
3891
3892
3893# Gentoo XPAK binary package
3894# by Michal Gorny <mgorny@gentoo.org>
3895# https://gitweb.gentoo.org/proj/portage.git/tree/man/xpak.5
3896-4	string	STOP
3897>-16	string	XPAKSTOP	Gentoo binary package (XPAK)
3898
3899# From:		Joerg Jenderek
3900# URL:		https://kodi.wiki/view/TexturePacker
3901# Reference:	https://mirrors.kodi.tv/releases/source/17.3-Krypton.tar.gz
3902# /xbmc-Krypton/xbmc/guilib/XBTF.h
3903# /xbmc-Krypton/xbmc/guilib/XBTF.cpp
39040	string	XBTF
3905# skip ASCII text by looking for terminating \0 of path
3906>264	ubyte	0		XBMC texture package
3907!:mime	application/x-xbmc-xbt
3908!:ext	xbt
3909# XBTF_VERSION 2
3910>>4	string	!2		\b, version %-.1s
3911# nofFiles /xbmc-Krypton/xbmc/guilib/XBTFReader.cpp
3912>>5	ulelong	x		\b, %u file
3913# plural s
3914>>5	ulelong	>1		\bs
3915# path[CXBTFFile[MaximumPathLength=256]
3916>>9	string	x		\b, 1st %s
3917
3918#------------------------------------------------------------------------------
3919# $File: assembler,v 1.6 2013/12/11 14:14:20 christos Exp $
3920# make:  file(1) magic for assembler source
3921#
39220	regex	\^[\040\t]{0,50}\\.asciiz		assembler source text
3923!:mime	text/x-asm
39240	regex	\^[\040\t]{0,50}\\.byte		assembler source text
3925!:mime	text/x-asm
39260	regex	\^[\040\t]{0,50}\\.even		assembler source text
3927!:mime	text/x-asm
39280	regex	\^[\040\t]{0,50}\\.globl		assembler source text
3929!:mime	text/x-asm
39300	regex	\^[\040\t]{0,50}\\.text		assembler source text
3931!:mime	text/x-asm
39320	regex	\^[\040\t]{0,50}\\.file		assembler source text
3933!:mime	text/x-asm
39340	regex	\^[\040\t]{0,50}\\.type		assembler source text
3935!:mime	text/x-asm
3936
3937#------------------------------------------------------------------------------
3938# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $
3939# asterix:  file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
3940# strings as "long" - we assume they're just strings:
3941# From: guy@netapp.com (Guy Harris)
3942#
39430	string		*STA		Aster*x
3944>7	string		WORD			Words Document
3945>7	string		GRAP			Graphic
3946>7	string		SPRE			Spreadsheet
3947>7	string		MACR			Macro
39480	string		2278		Aster*x Version 2
3949>29	byte		0x36			Words Document
3950>29	byte		0x35			Graphic
3951>29	byte		0x32			Spreadsheet
3952>29	byte		0x38			Macro
3953
3954
3955#------------------------------------------------------------------------------
3956# $File: att3b,v 1.10 2017/03/17 21:35:28 christos Exp $
3957# att3b:  file(1) magic for AT&T 3B machines
3958#
3959# The `versions' should be un-commented if they work for you.
3960# (Was the problem just one of endianness?)
3961#
3962# 3B20
3963#
3964# The 3B20 conflicts with SCCS.
3965#0	beshort		0550		3b20 COFF executable
3966#>12	belong		>0		not stripped
3967#>22	beshort		>0		- version %d
3968#0	beshort		0551		3b20 COFF executable (TV)
3969#>12	belong		>0		not stripped
3970#>22	beshort		>0		- version %d
3971#
3972# WE32K
3973#
39740	beshort		0560		WE32000 COFF
3975>18	beshort		^00000020	object
3976>18	beshort		&00000020	executable
3977>12	belong		>0		not stripped
3978>18	beshort		^00010000	N/A on 3b2/300 w/paging
3979>18	beshort		&00020000	32100 required
3980>18	beshort		&00040000	and MAU hardware required
3981>20	beshort		0407		(impure)
3982>20	beshort		0410		(pure)
3983>20	beshort		0413		(demand paged)
3984>20	beshort		0443		(target shared library)
3985>22	beshort		>0		- version %d
39860	beshort		0561		WE32000 COFF executable (TV)
3987>12	belong		>0		not stripped
3988#>18	beshort		&00020000	- 32100 required
3989#>18	beshort		&00040000	and MAU hardware required
3990#>22	beshort		>0		- version %d
3991#
3992# core file for 3b2
39930	string		\000\004\036\212\200	3b2 core file
3994>364	string		>\0		of '%s'
3995
3996#------------------------------------------------------------------------------
3997# $File: audio,v 1.111 2019/05/08 18:02:45 christos Exp $
3998# audio:  file(1) magic for sound formats (see also "iff")
3999#
4000# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
4001# and others
4002#
4003
4004# Sun/NeXT audio data
40050	string		.snd		Sun/NeXT audio data:
4006>12	belong		1		8-bit ISDN mu-law,
4007!:mime	audio/basic
4008>12	belong		2		8-bit linear PCM [REF-PCM],
4009!:mime	audio/basic
4010>12	belong		3		16-bit linear PCM,
4011!:mime	audio/basic
4012>12	belong		4		24-bit linear PCM,
4013!:mime	audio/basic
4014>12	belong		5		32-bit linear PCM,
4015!:mime	audio/basic
4016>12	belong		6		32-bit IEEE floating point,
4017!:mime	audio/basic
4018>12	belong		7		64-bit IEEE floating point,
4019!:mime	audio/basic
4020>12	belong		8		Fragmented sample data,
4021>12	belong		10		DSP program,
4022>12	belong		11		8-bit fixed point,
4023>12	belong		12		16-bit fixed point,
4024>12	belong		13		24-bit fixed point,
4025>12	belong		14		32-bit fixed point,
4026>12	belong		18		16-bit linear with emphasis,
4027>12	belong		19		16-bit linear compressed,
4028>12	belong		20		16-bit linear with emphasis and compression,
4029>12	belong		21		Music kit DSP commands,
4030>12	belong		23		8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
4031!:mime  audio/x-adpcm
4032>12	belong		24		compressed (8-bit CCITT G.722 ADPCM)
4033>12	belong		25		compressed (3-bit CCITT G.723.3 ADPCM),
4034>12	belong		26		compressed (5-bit CCITT G.723.5 ADPCM),
4035>12	belong		27		8-bit A-law (CCITT G.711),
4036>20	belong		1		mono,
4037>20	belong		2		stereo,
4038>20	belong		4		quad,
4039>16	belong		>0		%d Hz
4040
4041# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
4042# that uses little-endian encoding and has a different magic number
40430	lelong		0x0064732E	DEC audio data:
4044>12	lelong		1		8-bit ISDN mu-law,
4045!:mime	audio/x-dec-basic
4046>12	lelong		2		8-bit linear PCM [REF-PCM],
4047!:mime	audio/x-dec-basic
4048>12	lelong		3		16-bit linear PCM,
4049!:mime	audio/x-dec-basic
4050>12	lelong		4		24-bit linear PCM,
4051!:mime	audio/x-dec-basic
4052>12	lelong		5		32-bit linear PCM,
4053!:mime	audio/x-dec-basic
4054>12	lelong		6		32-bit IEEE floating point,
4055!:mime	audio/x-dec-basic
4056>12	lelong		7		64-bit IEEE floating point,
4057!:mime	audio/x-dec-basic
4058>12	belong		8		Fragmented sample data,
4059>12	belong		10		DSP program,
4060>12	belong		11		8-bit fixed point,
4061>12	belong		12		16-bit fixed point,
4062>12	belong		13		24-bit fixed point,
4063>12	belong		14		32-bit fixed point,
4064>12	belong		18		16-bit linear with emphasis,
4065>12	belong		19		16-bit linear compressed,
4066>12	belong		20		16-bit linear with emphasis and compression,
4067>12	belong		21		Music kit DSP commands,
4068>12	lelong		23		8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
4069!:mime	audio/x-dec-basic
4070>12	belong		24		compressed (8-bit CCITT G.722 ADPCM)
4071>12	belong		25		compressed (3-bit CCITT G.723.3 ADPCM),
4072>12	belong		26		compressed (5-bit CCITT G.723.5 ADPCM),
4073>12	belong		27		8-bit A-law (CCITT G.711),
4074>20	lelong		1		mono,
4075>20	lelong		2		stereo,
4076>20	lelong		4		quad,
4077>16	lelong		>0		%d Hz
4078
4079# Creative Labs AUDIO stuff
40800	string	MThd			Standard MIDI data
4081!:mime	audio/midi
4082>8 	beshort	x			(format %d)
4083>10	beshort	x			using %d track
4084>10	beshort		>1		\bs
4085>12	beshort&0x7fff	x		at 1/%d
4086>12	beshort&0x8000	>0		SMPTE
4087
40880	string	CTMF			Creative Music (CMF) data
4089!:mime	audio/x-unknown
40900	string	SBI			SoundBlaster instrument data
4091!:mime	audio/x-unknown
40920	string	Creative\ Voice\ File	Creative Labs voice data
4093!:mime	audio/x-unknown
4094# is this next line right?  it came this way...
4095>19	byte	0x1A
4096>23	byte	>0			- version %d
4097>22	byte	>0			\b.%d
4098
4099# first entry is also the string "NTRK"
41000	belong		0x4e54524b	MultiTrack sound data
4101>4	belong		x		- version %d
4102
4103# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
4104# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
41050	string		EMOD		Extended MOD sound data,
4106>4	byte&0xf0	x		version %d
4107>4	byte&0x0f	x		\b.%d,
4108>45	byte		x		%d instruments
4109>83	byte		0		(module)
4110>83	byte		1		(song)
4111
4112# Real Audio (Magic .ra\0375)
41130	belong		0x2e7261fd	RealAudio sound file
4114!:mime	audio/x-pn-realaudio
41150	string		.RMF\0\0\0	RealMedia file
4116!:mime	application/vnd.rn-realmedia
4117#video/x-pn-realvideo
4118#video/vnd.rn-realvideo
4119#application/vnd.rn-realmedia
4120#	sigh, there are many mimes for that but the above are the most common.
4121
4122# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
4123# Oct 31, 1995
4124# fixed by <doj@cubic.org> 2003-06-24
4125# Too short...
4126#0	string		MTM		MultiTracker Module sound file
4127#0	string		if		Composer 669 Module sound data
4128#0	string		JN		Composer 669 Module sound data (extended format)
41290	string		MAS_U		ULT(imate) Module sound data
4130
4131#0	string		FAR		Module sound data
4132#>4	string		>\15		Title: "%s"
4133
41340x2c	string		SCRM		ScreamTracker III Module sound data
4135>0	string		>\0		Title: "%s"
4136
4137# Gravis UltraSound patches
4138# From <ache@nagual.ru>
4139
41400	string		GF1PATCH110\0ID#000002\0	GUS patch
41410	string		GF1PATCH100\0ID#000002\0	Old GUS	patch
4142
4143# mime types according to http://www.geocities.com/nevilo/mod.htm:
4144#	audio/it	.it
4145#	audio/x-zipped-it	.itz
4146#	audio/xm	fasttracker modules
4147#	audio/x-s3m	screamtracker modules
4148#	audio/s3m	screamtracker modules
4149#	audio/x-zipped-mod	mdz
4150#	audio/mod	mod
4151#	audio/x-mod	All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z)
4152
4153#
4154# Taken from loader code from mikmod version 2.14
4155# by Steve McIntyre (stevem@chiark.greenend.org.uk)
4156# <doj@cubic.org> added title printing on 2003-06-24
41570	string	MAS_UTrack_V00
4158>14	string	>/0		ultratracker V1.%.1s module sound data
4159!:mime	audio/x-mod
4160#audio/x-tracker-module
4161
41620	string	UN05		MikMod UNI format module sound data
4163
41640	string	Extended\ Module: Fasttracker II module sound data
4165!:mime	audio/x-mod
4166#audio/x-tracker-module
4167>17	string	>\0		Title: "%s"
4168
416921	string/c	=!SCREAM!	Screamtracker 2 module sound data
4170!:mime	audio/x-mod
4171#audio/x-screamtracker-module
417221	string	BMOD2STM	Screamtracker 2 module sound data
4173!:mime	audio/x-mod
4174#audio/x-screamtracker-module
41751080	string	M.K.		4-channel Protracker module sound data
4176!:mime	audio/x-mod
4177#audio/x-protracker-module
4178>0	string	>\0		Title: "%s"
41791080	string	M!K!		4-channel Protracker module sound data
4180!:mime	audio/x-mod
4181#audio/x-protracker-module
4182>0	string	>\0		Title: "%s"
41831080	string	FLT4		4-channel Startracker module sound data
4184!:mime	audio/x-mod
4185#audio/x-startracker-module
4186>0	string	>\0		Title: "%s"
41871080	string	FLT8		8-channel Startracker module sound data
4188!:mime	audio/x-mod
4189#audio/x-startracker-module
4190>0	string	>\0		Title: "%s"
41911080	string	4CHN		4-channel Fasttracker module sound data
4192!:mime	audio/x-mod
4193#audio/x-fasttracker-module
4194>0	string	>\0		Title: "%s"
41951080	string	6CHN		6-channel Fasttracker module sound data
4196!:mime	audio/x-mod
4197#audio/x-fasttracker-module
4198>0	string	>\0		Title: "%s"
41991080	string	8CHN		8-channel Fasttracker module sound data
4200!:mime	audio/x-mod
4201#audio/x-fasttracker-module
4202>0	string	>\0		Title: "%s"
42031080	string	CD81		8-channel Octalyser module sound data
4204!:mime	audio/x-mod
4205#audio/x-octalysertracker-module
4206>0	string	>\0		Title: "%s"
42071080	string	OKTA		8-channel Octalyzer module sound data
4208!:mime	audio/x-mod
4209#audio/x-octalysertracker-module
4210>0	string	>\0		Title: "%s"
4211# Not good enough.
4212#1082	string	CH
4213#>1080	string	>/0		%.2s-channel Fasttracker "oktalyzer" module sound data
42141080	string	16CN		16-channel Taketracker module sound data
4215!:mime	audio/x-mod
4216#audio/x-taketracker-module
4217>0	string	>\0		Title: "%s"
42181080	string	32CN		32-channel Taketracker module sound data
4219!:mime	audio/x-mod
4220#audio/x-taketracker-module
4221>0	string	>\0		Title: "%s"
4222
4223# TOC sound files -Trevor Johnson <trevor@jpj.net>
4224#
42250       string          TOC             TOC sound file
4226
4227# sidfiles <pooka@iki.fi>
4228# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24
42290	string		SIDPLAY\ INFOFILE	Sidplay info file
4230
42310	string		PSID			PlaySID v2.2+ (AMIGA) sidtune
4232>4	beshort		>0			w/ header v%d,
4233>14	beshort		=1			single song,
4234>14	beshort		>1			%d songs,
4235>16	beshort		>0			default song: %d
4236>0x16	string		>\0			name: "%s"
4237>0x36	string		>\0			author: "%s"
4238>0x56	string		>\0			copyright: "%s"
4239
42400	string		RSID			RSID sidtune PlaySID compatible
4241>4	beshort		>0			w/ header v%d,
4242>14	beshort		=1			single song,
4243>14	beshort		>1			%d songs,
4244>16	beshort		>0			default song: %d
4245>0x16	string		>\0			name: "%s"
4246>0x36	string		>\0			author: "%s"
4247>0x56	string		>\0			copyright: "%s"
4248
4249# IRCAM sound files - Michael Pruett <michael@68k.org>
4250# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html
42510	belong		0x64a30100		IRCAM file (VAX little-endian)
42520	belong		0x0001a364		IRCAM file (VAX big-endian)
42530	belong		0x64a30200		IRCAM file (Sun big-endian)
42540	belong		0x0002a364		IRCAM file (Sun little-endian)
42550	belong		0x64a30300		IRCAM file (MIPS little-endian)
42560	belong		0x0003a364		IRCAM file (MIPS big-endian)
42570	belong		0x64a30400		IRCAM file (NeXT big-endian)
42580	belong		0x64a30400		IRCAM file (NeXT big-endian)
42590	belong		0x0004a364		IRCAM file (NeXT little-endian)
4260
4261# NIST SPHERE <mpruett@sgi.com>
42620	string		NIST_1A\n\ \ \ 1024\n	NIST SPHERE file
4263
4264# Sample Vision <mpruett@sgi.com>
42650	string		SOUND\ SAMPLE\ DATA\ 	Sample Vision file
4266
4267# Audio Visual Research <tonigonenstein@users.sourceforge.net>
42680	string		2BIT			Audio Visual Research file,
4269>12	beshort		=0			mono,
4270>12	beshort		=-1			stereo,
4271>14	beshort		x			%d bits
4272>16	beshort		=0			unsigned,
4273>16	beshort		=-1			signed,
4274>22	belong&0x00ffffff	x		%d Hz,
4275>18	beshort		=0			no loop,
4276>18	beshort		=-1			loop,
4277>21	ubyte		<128			note %d,
4278>22	byte		=0			replay 5.485 KHz
4279>22	byte		=1			replay 8.084 KHz
4280>22	byte		=2			replay 10.971 KHz
4281>22	byte		=3			replay 16.168 KHz
4282>22	byte		=4			replay 21.942 KHz
4283>22	byte		=5			replay 32.336 KHz
4284>22	byte		=6			replay 43.885 KHz
4285>22	byte		=7			replay 47.261 KHz
4286
4287# SGI SoundTrack <mpruett@sgi.com>
42880	string		_SGI_SoundTrack		SGI SoundTrack project file
4289# ID3 version 2 tags <waschk@informatik.uni-rostock.de>
42900	string		ID3	Audio file with ID3 version 2
4291>3	byte		x	\b.%d
4292>4	byte		x	\b.%d
4293>>5	byte		&0x80	\b, unsynchronized frames
4294>>5	byte		&0x40	\b, extended header
4295>>5	byte		&0x20	\b, experimental
4296>>5	byte		&0x10	\b, footer present
4297>(6.I+10)	indirect	x	\b, contains:
4298
4299# NSF (NES sound file) magic
43000	string		NESM\x1a	NES Sound File
4301>14	string		>\0		("%s" by
4302>46	string		>\0		%s, copyright
4303>78	string		>\0		%s),
4304>5	byte		x		version %d,
4305>6	byte		x		%d tracks,
4306>122	byte&0x2	=1		dual PAL/NTSC
4307>122	byte&0x1	=1		PAL
4308>122	byte&0x1	=0		NTSC
4309
4310# NSFE (Extended NES sound file) magic
4311# http://slickproductions.org/docs/NSF/nsfespec.txt
4312# From: David Pflug <david@pflug.email>
43130	string		NSFE		Extended NES Sound File
4314>48	search/0x1000	auth
4315>>&0	string		>\0		("%s"
4316>>>&1	string		>\0		by %s
4317>>>>&1	string		>\0		\b, copyright %s
4318>>>>>&1	string		>\0		\b, ripped by %s
4319>20	byte		x		\b), %d tracks,
4320>18	byte&0x2	=1		dual PAL/NTSC
4321>18     byte&0x2	=0
4322>>18	byte&0x1	=1		PAL
4323>>18	byte&0x1	=0		NTSC
4324
4325# Type: SNES SPC700 sound files
4326# From: Josh Triplett <josh@freedesktop.org>
43270	string	SNES-SPC700\ Sound\ File\ Data\ v	SNES SPC700 sound file
4328>&0	string	0.30					\b, version %s
4329>>0x23	byte	0x1B					\b, without ID666 tag
4330>>0x23	byte	0x1A					\b, with ID666 tag
4331>>>0x2E	string	>\0					\b, song "%.32s"
4332>>>0x4E	string	>\0					\b, game "%.32s"
4333
4334# Impulse tracker module (audio/x-it)
43350	string		IMPM		Impulse Tracker module sound data -
4336!:mime	audio/x-mod
4337>4	string		>\0		"%s"
4338>40	leshort		!0		compatible w/ITv%x
4339>42	leshort		!0		created w/ITv%x
4340
4341# Imago Orpheus module (audio/x-imf)
434260	string		IM10		Imago Orpheus module sound data -
4343>0	string		>\0		"%s"
4344
4345# From <collver1@attbi.com>
4346# These are the /etc/magic entries to decode modules, instruments, and
4347# samples in Impulse Tracker's native format.
4348
43490	string		IMPS		Impulse Tracker Sample
4350>18	byte		&2		16 bit
4351>18	byte		^2		8 bit
4352>18	byte		&4		stereo
4353>18	byte		^4		mono
43540	string		IMPI		Impulse Tracker Instrument
4355>28	leshort		!0		ITv%x
4356>30	byte		!0		%d samples
4357
4358# Yamaha TX Wave:  file(1) magic for Yamaha TX Wave audio files
4359# From <collver1@attbi.com>
43600	string		LM8953		Yamaha TX Wave
4361>22	byte		0x49		looped
4362>22	byte		0xC9		non-looped
4363>23	byte		1		33kHz
4364>23	byte		2		50kHz
4365>23	byte		3		16kHz
4366
4367# scream tracker:  file(1) magic for Scream Tracker sample files
4368#
4369# From <collver1@attbi.com>
437076	string		SCRS		Scream Tracker Sample
4371>0	byte		1		sample
4372>0	byte		2		adlib melody
4373>0	byte		>2		adlib drum
4374>31	byte		&2		stereo
4375>31	byte		^2		mono
4376>31	byte		&4		16bit little endian
4377>31	byte		^4		8bit
4378>30	byte		0		unpacked
4379>30	byte		1		packed
4380
4381# audio
4382# From: Cory Dikkers <cdikkers@swbell.net>
43830	string		MMD0		MED music file, version 0
43840	string		MMD1		OctaMED Pro music file, version 1
43850	string		MMD3		OctaMED Soundstudio music file, version 3
43860	string		OctaMEDCmpr	OctaMED Soundstudio compressed file
43870	string		MED		MED_Song
43880	string		SymM		Symphonie SymMOD music file
4389#
4390# Track Length (TRL), Tracks (TRK), Samples (SMP), Subsongs (SS)
4391# http://lclevy.free.fr/exotica/ahx/ahxformat.txt
43920	string		THX		AHX version
4393>3	byte		=0		1 module data
4394>3	byte		=1		2 module data
4395>10	byte		x		TRL: %u
4396>11	byte		x		TRK: %u
4397>12	byte		x		SMP: %u
4398>13	byte		x		SS: %u
4399#
44000	string		OKTASONG	Oktalyzer module data
4401#
44020	string		DIGI\ Booster\ module\0	%s
4403>20	byte		>0		%c
4404>>21	byte		>0		\b%c
4405>>>22	byte		>0		\b%c
4406>>>>23	byte		>0		\b%c
4407>610	string		>\0		\b, "%s"
4408#
44090	string		DBM0	   	DIGI Booster Pro Module
4410>4	byte		>0		V%X.
4411>>5	byte		x		\b%02X
4412>16	string		>\0		\b, "%s"
4413#
44140	string		FTMN		FaceTheMusic module
4415>16	string		>\0d		\b, "%s"
4416
4417# From: <doj@cubic.org> 2003-06-24
44180	string		AMShdr\32	Velvet Studio AMS Module v2.2
44190	string		Extreme		Extreme Tracker AMS Module v1.3
44200	string		DDMF		Xtracker DMF Module
4421>4	byte		x		v%i
4422>0xD	string		>\0		Title: "%s"
4423>0x2B	string		>\0		Composer: "%s"
44240	string		DSM\32		Dynamic Studio Module DSM
44250	string		SONG		DigiTrekker DTM Module
44260	string		DMDL		DigiTrakker MDL Module
44270	string		PSM\32		Protracker Studio PSM Module
442844	string		PTMF		Poly Tracker PTM Module
4429>0	string		>\32		Title: "%s"
44300	string		MT20		MadTracker 2.0 Module MT2
44310	string		RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD
44320	string		RTMM		RTM Module
44330x426	string		MaDoKaN96	XMS Adlib Module
4434>0	string		>\0		Composer: "%s"
44350	string		AMF		AMF Module
4436>4	string		>\0		Title: "%s"
44370	string		MODINFO1	Open Cubic Player Module Inforation MDZ
44380	string		Extended\40Instrument: Fast Tracker II Instrument
4439
4440# From: Takeshi Hamasaki <hma@syd.odn.ne.jp>
4441# NOA Nancy Codec file
44420	string		\210NOA\015\012\032	NOA Nancy Codec Movie file
4443# Yamaha SMAF format
44440	string		MMMD		Yamaha SMAF file
4445# Sharp Jisaku Melody format for PDC
44460	string		\001Sharp\040JisakuMelody	SHARP Cell-Phone ringing Melody
4447>20	string		Ver01.00	Ver. 1.00
4448>>32	byte		x		, %d tracks
4449
4450# Free lossless audio codec <http://flac.sourceforge.net>
4451# From: Przemyslaw Augustyniak <silvathraec@rpg.pl>
44520	string			fLaC		FLAC audio bitstream data
4453!:mime	audio/flac
4454>4	byte&0x7f		>0		\b, unknown version
4455>4	byte&0x7f		0		\b
4456# some common bits/sample values
4457>>20	beshort&0x1f0		0x030		\b, 4 bit
4458>>20	beshort&0x1f0		0x050		\b, 6 bit
4459>>20	beshort&0x1f0		0x070		\b, 8 bit
4460>>20	beshort&0x1f0		0x0b0		\b, 12 bit
4461>>20	beshort&0x1f0		0x0f0		\b, 16 bit
4462>>20	beshort&0x1f0		0x170		\b, 24 bit
4463>>20	byte&0xe		0x0		\b, mono
4464>>20	byte&0xe		0x2		\b, stereo
4465>>20	byte&0xe		0x4		\b, 3 channels
4466>>20	byte&0xe		0x6		\b, 4 channels
4467>>20	byte&0xe		0x8		\b, 5 channels
4468>>20	byte&0xe		0xa		\b, 6 channels
4469>>20	byte&0xe		0xc		\b, 7 channels
4470>>20	byte&0xe		0xe		\b, 8 channels
4471# sample rates derived from known oscillator frequencies;
4472# 24.576 MHz (video/fs=48kHz), 22.5792 (audio/fs=44.1kHz) and
4473# 16.384 (other/fs=32kHz).
4474>>17	belong&0xfffff0       	0x02b110	\b, 11.025 kHz
4475>>17	belong&0xfffff0       	0x03e800	\b, 16 kHz
4476>>17	belong&0xfffff0       	0x056220	\b, 22.05 kHz
4477>>17	belong&0xfffff0       	0x05dc00	\b, 24 kHz
4478>>17	belong&0xfffff0       	0x07d000	\b, 32 kHz
4479>>17	belong&0xfffff0       	0x0ac440	\b, 44.1 kHz
4480>>17	belong&0xfffff0       	0x0bb800	\b, 48 kHz
4481>>17	belong&0xfffff0       	0x0fa000	\b, 64 kHz
4482>>17	belong&0xfffff0       	0x158880	\b, 88.2 kHz
4483>>17	belong&0xfffff0       	0x177000	\b, 96 kHz
4484>>17	belong&0xfffff0       	0x1f4000	\b, 128 kHz
4485>>17	belong&0xfffff0       	0x2b1100	\b, 176.4 kHz
4486>>17	belong&0xfffff0       	0x2ee000	\b, 192 kHz
4487>>17	belong&0xfffff0       	0x3e8000	\b, 256 kHz
4488>>17	belong&0xfffff0       	0x562200	\b, 352.8 kHz
4489>>17	belong&0xfffff0       	0x5dc000	\b, 384 kHz
4490>>21	byte&0xf		>0		\b, >4G samples
4491>>21	byte&0xf		0		\b
4492>>>22	belong			>0		\b, %u samples
4493>>>22	belong			0		\b, length unknown
4494
4495# (ISDN) VBOX voice message file (Wolfram Kleff)
44960       string          VBOX            VBOX voice message data
4497
4498# ReBorn Song Files (.rbs)
4499# David J. Singer <doc@deadvirgins.org.uk>
45008       string          RB40             RBS Song file
4501>29     string          ReBorn           created by ReBorn
4502>37     string          Propellerhead    created by ReBirth
4503
4504# Synthesizer Generator and Kimwitu share their file format
45050	string		A#S#C#S#S#L#V#3	    Synthesizer Generator or Kimwitu data
4506# Kimwitu++ uses a slightly different magic
45070	string		A#S#C#S#S#L#HUB	    Kimwitu++ data
4508
4509# From "Simon Hosie
45100       string  TFMX-SONG       TFMX module sound data
4511
4512# Monkey's Audio compressed audio format (.ape)
4513# From danny.milo@gmx.net (Danny Milosavljevic)
4514# New version from Abel Cheung <abel (@) oaka.org>
45150		string		MAC\040		Monkey's Audio compressed format
4516!:mime audio/x-ape
4517>4		uleshort	>0x0F8B		version %d
4518>>(0x08.l)	uleshort	=1000		with fast compression
4519>>(0x08.l)	uleshort	=2000		with normal compression
4520>>(0x08.l)	uleshort	=3000		with high compression
4521>>(0x08.l)	uleshort	=4000		with extra high compression
4522>>(0x08.l)	uleshort	=5000		with insane compression
4523>>(0x08.l+18)	uleshort	=1		\b, mono
4524>>(0x08.l+18)	uleshort	=2		\b, stereo
4525>>(0x08.l+20)	ulelong		x		\b, sample rate %d
4526>4		uleshort	<0x0F8C		version %d
4527>>6		uleshort	=1000		with fast compression
4528>>6		uleshort	=2000		with normal compression
4529>>6		uleshort	=3000		with high compression
4530>>6		uleshort	=4000		with extra high compression
4531>>6		uleshort	=5000		with insane compression
4532>>10		uleshort	=1		\b, mono
4533>>10		uleshort	=2		\b, stereo
4534>>12		ulelong		x		\b, sample rate %d
4535
4536# adlib sound files
4537# From: Alex Myczko <alex@aiei.ch>
4538
4539# https://github.com/rerrahkr/BambooTracker
45400	string		BambooTrackerMod	BambooTracker module
4541>22	byte	x	\b, version %u
4542>21	byte	x	\b.%u
4543>20	byte	x	\b.%u
4544
45450	string		BambooTrackerIst	BambooTracker instrument
4546>22	byte	x	\b, version %u
4547>21	byte	x	\b.%u
4548>20	byte	x	\b.%u
4549
45500    	string		RAWADATA	RdosPlay RAW
4551
45521068	string		RoR		AMUSIC Adlib Tracker
4553
45540	string		JCH		EdLib
4555
45560	string		mpu401tr	MPU-401 Trakker
4557
45580	string		SAdT		Surprise! Adlib Tracker
4559>4	byte		x		Version %d
4560
45610	string		XAD!		eXotic ADlib
4562
45630	string		ofTAZ!		eXtra Simple Music
4564
45650	string		FMK!		FM Kingtracker Song
4566
45670	string		DFM		DFM Song
4568
45690	string		\<CUD-FM-File\>	CFF Song
4570
45710	string		_A2module	A2M Song
4572
4573# Spectrum 128 tunes (.ay files).
4574# From: Emanuel Haupt <ehaupt@critical.ch>
45750	string		ZXAYEMUL	Spectrum 128 tune
4576
45770	string		\0BONK		BONK,
4578#>5	byte		x		version %d
4579>14	byte		x		%d channel(s),
4580>15	byte		=1		lossless,
4581>15	byte		=0		lossy,
4582>16	byte		x		mid-side
4583
4584384	string		LockStream	LockStream Embedded file (mostly MP3 on old Nokia phones)
4585
4586# format VQF (proprietary codec for sound)
4587# some infos on the header file available at :
4588# http://www.twinvq.org/english/technology_format.html
45890	string		TWIN97012000	VQF data
4590>27	short		0		\b, Mono
4591>27	short		1		\b, Stereo
4592>31	short 		>0		\b, %d kbit/s
4593>35	short 		>0		\b, %d kHz
4594
4595# Nelson A. de Oliveira (naoliv@gmail.com)
4596# .eqf
45970	string	Winamp\ EQ\ library\ file	%s
4598# it will match only versions like v<digit>.<digit>
4599# Since I saw only eqf files with version v1.1 I think that it's OK
4600>23	string	x	\b%.4s
4601# .preset
46020	string	[Equalizer\ preset]	XMMS equalizer preset
4603# .m3u
46040	search/1	#EXTM3U 	M3U playlist text
4605# .pls
46060	search/1	[playlist]	PLS playlist text
4607# licq.conf
46081	string	[licq]			LICQ configuration file
4609
4610# Atari ST audio files by Dirk Jagdmann <doj@cubic.org>
46110	string		ICE!		SNDH Atari ST music
46120	string		SC68\ Music-file\ /\ (c)\ (BeN)jami	sc68 Atari ST music
4613
4614# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com>
46150       string          MP+     Musepack audio (MP+)
4616!:mime	audio/x-musepack
4617>3      byte            255     \b, SV pre8
4618>3      byte&0xF        0x6     \b, SV 6
4619>3      byte&0xF        0x8     \b, SV 8
4620>3      byte&0xF        0x7     \b, SV 7
4621>>3     byte&0xF0       0x0     \b.0
4622>>3     byte&0xF0       0x10    \b.1
4623>>3     byte&0xF0       240     \b.15
4624>>10    byte&0xF0       0x0     \b, no profile
4625>>10    byte&0xF0       0x10    \b, profile 'Unstable/Experimental'
4626>>10    byte&0xF0       0x50    \b, quality 0
4627>>10    byte&0xF0       0x60    \b, quality 1
4628>>10    byte&0xF0       0x70    \b, quality 2 (Telephone)
4629>>10    byte&0xF0       0x80    \b, quality 3 (Thumb)
4630>>10    byte&0xF0       0x90    \b, quality 4 (Radio)
4631>>10    byte&0xF0       0xA0    \b, quality 5 (Standard)
4632>>10    byte&0xF0       0xB0    \b, quality 6 (Xtreme)
4633>>10    byte&0xF0       0xC0    \b, quality 7 (Insane)
4634>>10    byte&0xF0       0xD0    \b, quality 8 (BrainDead)
4635>>10    byte&0xF0       0xE0    \b, quality 9
4636>>10    byte&0xF0       0xF0    \b, quality 10
4637>>27    byte            0x0     \b, Buschmann 1.7.0-9, Klemm 0.90-1.05
4638>>27    byte            102     \b, Beta 1.02
4639>>27    byte            104     \b, Beta 1.04
4640>>27    byte            105     \b, Alpha 1.05
4641>>27    byte            106     \b, Beta 1.06
4642>>27    byte            110     \b, Release 1.1
4643>>27    byte            111     \b, Alpha 1.11
4644>>27    byte            112     \b, Beta 1.12
4645>>27    byte            113     \b, Alpha 1.13
4646>>27    byte            114     \b, Beta 1.14
4647>>27    byte            115     \b, Alpha 1.15
4648
46490       string          MPCK    Musepack audio (MPCK)
4650!:mime	audio/x-musepack
4651
4652# IMY
4653# from http://filext.com/detaillist.php?extdetail=IMY
4654# https://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm
4655# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html
4656# http://www.wx800.com/msg/download/irda/iMelody.pdf
46570	string	BEGIN:IMELODY	iMelody Ringtone Format
4658
4659# From: "Mateus Caruccio" <mateus@caruccio.com>
4660# guitar pro v3,4,5 from http://filext.com/file-extension/gp3
46610	string	\030FICHIER\ GUITAR\ PRO\ v3.	Guitar Pro Ver. 3 Tablature
4662
4663# From: "Leslie P. Polzer" <leslie.polzer@gmx.net>
466460	string	SONG		SoundFX Module sound file
4665
4666# Type: Adaptive Multi-Rate Codec
4667# URL:  http://filext.com/detaillist.php?extdetail=AMR
4668# From: Russell Coker <russell@coker.com.au>
46690	string	#!AMR		Adaptive Multi-Rate Codec (GSM telephony)
4670!:mime	audio/amr
4671!:ext  amr
4672
4673# Type: SuperCollider 3 Synth Definition File Format
4674# From: Mario Lang <mlang@debian.org>
46750	string	SCgf	SuperCollider3 Synth Definition file,
4676>4	belong	x	version %d
4677
4678# Type: True Audio Lossless Audio
4679# URL:  https://wiki.multimedia.cx/index.php?title=True_Audio
4680# From: Mike Melanson <mike@multimedia.cx>
46810	string	TTA1	True Audio Lossless Audio
4682
4683# Type: WavPack Lossless Audio
4684# URL:  https://wiki.multimedia.cx/index.php?title=WavPack
4685# From: Mike Melanson <mike@multimedia.cx>
46860	string	wvpk	WavPack Lossless Audio
4687
4688# From Fabio R. Schmidlin <frs@pop.com.br>
4689# VGM music file
46900	string		Vgm\040
4691>9	ubyte		>0	VGM Video Game Music dump v
4692!:mime	audio/x-vgm
4693!:ext	vgm
4694>>9	ubyte/16	>0	\b%d
4695>>9	ubyte&0x0F	x	\b%d
4696>>8	ubyte/16	x	\b.%d
4697>>8	ubyte&0x0F	>0	\b%d
4698#Get soundchips
4699>>8	ubyte		x	\b, soundchip(s)=
4700>>0x0C	ulelong		>0	SN76489,
4701>>0x10	ulelong		>0	YM2413,
4702>>0x2C	ulelong		>0	YM2612,
4703>>0x30	ulelong		>0	YM2151,
4704>>0x38	ulelong		>0	Sega PCM,
4705>>0x34	ulelong		>0xC
4706>>>0x40	ulelong		>0	RF5C68,
4707>>0x34	ulelong		>0x10
4708>>>0x44	ulelong		>0	YM2203,
4709>>0x34	ulelong		>0x14
4710>>>0x48	ulelong		>0	YM2608,
4711>>0x34	ulelong		>0x18
4712>>>0x4C	lelong		>0	YM2610,
4713>>>0x4C	lelong		<0	YM2610B,
4714>>0x34	ulelong		>0x1C
4715>>>0x50	ulelong		>0	YM3812,
4716>>0x34	ulelong		>0x20
4717>>>0x54	ulelong		>0	YM3526,
4718>>0x34	ulelong		>0x24
4719>>>0x58	ulelong		>0	Y8950,
4720>>0x34	ulelong		>0x28
4721>>>0x5C	ulelong		>0	YMF262,
4722>>0x34	ulelong		>0x2C
4723>>>0x60	ulelong		>0	YMF278B,
4724>>0x34	ulelong		>0x30
4725>>>0x64	ulelong		>0	YMF271,
4726>>0x34	ulelong		>0x34
4727>>>0x68	ulelong		>0	YMZ280B,
4728>>0x34	ulelong		>0x38
4729>>>0x6C	ulelong		>0	RF5C164,
4730>>0x34	ulelong		>0x3C
4731>>>0x70	ulelong		>0	PWM,
4732>>0x34	ulelong		>0x40
4733>>>0x74	ulelong		>0
4734>>>>0x78 ubyte		0x00	AY-3-8910,
4735>>>>0x78 ubyte		0x01	AY-3-8912,
4736>>>>0x78 ubyte		0x02	AY-3-8913,
4737>>>>0x78 ubyte		0x03	AY-3-8930,
4738>>>>0x78 ubyte		0x10	YM2149,
4739>>>>0x78 ubyte		0x11	YM3439,
4740# VGM 1.61
4741>>0x34	ulelong		>0x4C
4742>>>0x80	ulelong		>0	DMG,
4743>>0x34	ulelong		>0x50
4744>>>0x84	lelong		>0	NES APU,
4745>>>0x84	lelong		<0	NES APU with FDS,
4746>>0x34	ulelong		>0x54
4747>>>0x88	ulelong		>0	MultiPCM,
4748>>0x34	ulelong		>0x58
4749>>>0x8C	ulelong		>0	uPD7759,
4750>>0x34	ulelong		>0x5C
4751>>>0x90	ulelong		>0	OKIM6258,
4752>>0x34	ulelong		>0x64
4753>>>0x98	ulelong		>0	OKIM6295,
4754>>0x34	ulelong		>0x68
4755>>>0x9C	ulelong		>0	K051649,
4756>>0x34	ulelong		>0x6C
4757>>>0xA0	ulelong		>0	K054539,
4758>>0x34	ulelong		>0x70
4759>>>0xA4	ulelong		>0	HuC6280,
4760>>0x34	ulelong		>0x74
4761>>>0xA8	ulelong		>0	C140,
4762>>0x34	ulelong		>0x78
4763>>>0xAC	ulelong		>0	K053260,
4764>>0x34	ulelong		>0x7C
4765>>>0xB0	ulelong		>0	Pokey,
4766>>0x34	ulelong		>0x80
4767>>>0xB4	ulelong		>0	QSound,
4768# VGM 1.71
4769>>0x34	ulelong		>0x84
4770>>>0xB8	ulelong		>0	SCSP,
4771>>0x34	ulelong		>0x8C
4772>>>0xC0	ulelong		>0	WonderSwan,
4773>>0x34	ulelong		>0x90
4774>>>0xC4	ulelong		>0	VSU,
4775>>0x34	ulelong		>0x94
4776>>>0xC8	ulelong		>0	SAA1099,
4777>>0x34	ulelong		>0x98
4778>>>0xCC	ulelong		>0	ES5503,
4779>>0x34	ulelong		>0x9C
4780>>>0xD0	lelong		>0	ES5505,
4781>>>0xD0	lelong		<0	ES5506,
4782>>0x34	ulelong		>0xA4
4783>>>0xD8	ulelong		>0	X1-010,
4784>>0x34	ulelong		>0xA8
4785>>>0xDC	ulelong		>0	C352,
4786>>0x34	ulelong		>0xAC
4787>>>0xE0	ulelong		>0	GA20,
4788
4789# GVOX Encore file format
4790# Since this is a proprietary file format and there is no publicly available
4791# format specification, this is just based on induction
4792#
47930	string	SCOW
4794>4	byte	0xc4	GVOX Encore music, version 5.0 or above
4795>4	byte	0xc2	GVOX Encore music, version < 5.0
4796
47970	string	ZBOT
4798>4	byte	0xc5	GVOX Encore music, version < 5.0
4799
4800# Summary:	Garmin Voice Processing Module (WAVE audios)
4801# From:		Joerg Jenderek
4802# URL:		https://www.garmin.com/
4803# Reference:	http://www.poi-factory.com/node/19580
4804# NOTE:		there exist 2 other Garmin VPM formats
48050		string	AUDIMG
4806# skip text files starting with string "AUDIMG"
4807>13		ubyte		<13	Garmin Voice Processing Module
4808!:mime	audio/x-vpm-wav-garmin
4809!:ext	vpm
4810# 3 bytes indicating the voice version (200,220)
4811>>6		string		x	\b, version %3.3s
4812# day of release (01-31)
4813>>12		ubyte		x	\b, %.2d
4814# month of release (01-12)
4815>>13		ubyte		x	\b.%.2d
4816# year of release (like 2006, 2007, 2008)
4817>>14		uleshort	x	\b.%.4d
4818# hour of release (0-23)
4819>>11		ubyte		x	%.2d
4820# minute of release (0-59)
4821>>10		ubyte		x	\b:%.2d
4822# second of release (0-59)
4823>>9		ubyte		x	\b:%.2d
4824# if you select a language like german on your garmin device
4825# you can only select voice modules with corresponding language byte ID like 1
4826>>18		ubyte		x	\b, language ID %d
4827# structure for phrases/sentences?
4828# number of voice sample in the 1st phrase?
4829#>>19		uleshort		x	\b, 0x%x samples
4830#>>>21		uleshort		>0	\b, at 0x%4.4x
4831#>>>(21.s)	ubequad			x	0x%llx
4832# 2nd phrase?
4833#>>23		uleshort		x	\b, 0x%x samples
4834#>>>25		uleshort		>0	\b, at 0x%4.4x
4835#>>>(25.s)	ubequad			x	0x%llx
4836# pointer to 1st audio WAV sample
4837>>16		uleshort	>0
4838>>>(16.s)	ulelong		>0	\b, at 0x%x
4839# WAV length
4840# 1 space char after "bytes" to get phrase "bytes RIFF"
4841>>>>(16.s+4)	ulelong		>0	%u bytes
4842# look for magic
4843>>>>>(&-8.l)	string		RIFF
4844# determine type by ./riff
4845>>>>>>&-4	indirect	x
4846# 2 - ~ 131 WAV samples following same way
4847#
4848# Summary:	encrypted Garmin Voice Processing Module
4849# From:		Joerg Jenderek
4850# URL:		https://www.garmin.com/us/products/ontheroad/voicestudio
4851# NOTE:		Encrypted variant used in voices like DrNightmare, Elfred, Yeti.
4852#		There exist 2 other Garmin VPM formats
48530	ubequad		0xa141190fecc8ced6	Garmin Voice Processing Module (encrypted)
4854!:mime	audio/x-vpm-garmin
4855!:ext	vpm
4856
4857# From Martin Mueller Skarbiniks Pedersen
48580		string		GDM
4859>0x3		byte		0xFE	General Digital Music.
4860>0x4		string		>\0	title: "%s"
4861>0x24		string		>\0	musician: "%s"
4862>>0x44		beshort		0x0D0A
4863>>>0x46		byte		0x1A
4864>>>>0x47	string		GMFS	Version
4865>>>>0x4B	byte		x	%d.
4866>>>>0x4C	byte		x	\b%02d
4867>>>>0x4D	beshort		0x000	(2GDM v
4868>>>>0x4F	byte		x	\b%d.
4869>>>>>0x50	byte		x	\b%d)
4870
48710		string		MTM	Multitracker
4872>0x3		byte/16		x	Version %d.
4873>0x3		byte&0x0F	x	\b%02d
4874>>0x4		string		>\0	title: "%s"
4875
48760		string		HVL
4877>3		byte		<2	Hively Tracker Song
4878>3		byte		0	1 module data
4879>3		byte		1	2 module data
4880
48810		string		MO3
4882>3		ubyte		<6	MOdule with MP3
4883>>3		byte		0	Version	0	(With MP3 and lossless)
4884>>3		byte		1	Version	1	(With ogg and lossless)
4885>>3		byte		3	Version 2.2
4886>>3		byte		4	(With no LAME header)
4887>>3		byte		5	Version 2.4
4888
48890		string		ADRVPACK	AProSys	module
4890
4891# ftp://ftp.modland.com/pub/documents/format_documentation/\
4892# Art%20Of%20Noise%20(.aon).txt
48930		string		AON
4894>4		string		"ArtOfNoise by Bastian Spiegel(twice/lego)"
4895>0x2e		string		NAME	Art of Noise Tracker Song
4896>3		string		<9
4897>3		string		4	(4 voices)
4898>3		string		8	(8 voices)
4899>>0x36		string		>\0	Title: "%s"
4900
49010		string		FAR
4902>0x2c		byte		0x0d
4903>0x2d		byte		0x0a
4904>0x2e		byte		0x1a
4905>>0x3		byte		0xFE	Farandole Tracker Song
4906>>>0x31		byte/16		x	Version %d.
4907>>>0x31		byte&0x0F	x	\b%02d
4908>>>>0x4		string		>\0	\b, title: "%s"
4909
4910# magic for Klystrack, https://kometbomb.github.io/klystrack/
4911# from Alex Myczko <alex@aiei.ch>
49120	string	cyd!song	Klystrack song
4913>8	byte	>0		\b, version %u
4914>8	byte	>26
4915#>>9	byte	x		\b, channels %u
4916#>>10	leshort	x		\b, time signature %u
4917#>>12	leshort	x		\b, sequence step %u
4918#>>14	byte	x		\b, instruments %u
4919#>>15	leshort	x		\b, patterns %u
4920#>>17	leshort	x		\b, sequences %u
4921#>>19	leshort	x		\b, length %u
4922#>>21	leshort	x		\b, loop point %u
4923#>>23	byte	x		\b, master volume %u
4924#>>24	byte	x		\b, song speed %u
4925#>>25	byte	x		\b, song speed2 %u
4926#>>26	byte	x		\b, song rate %u
4927#>>27	belong	x		\b, flags %#x
4928#>>31	byte	x		\b, multiplex period %u
4929#>>32	byte	x		\b, pitch inaccuracy %u
4930>>149	pstring	x		\b, title %s
4931
49320	string	cyd!inst	Klystrack instrument
4933
4934# magic for WOPL instrument files, https://github.com/Wohlstand/OPL3BankEditor
4935# see Specifications/WOPL-and-OPLI-Specification.txt
4936
49370	string	WOPL3-INST\0	WOPL instrument
4938>11	leshort	x	\b, version %u
49390	string	WOPL3-BANK\0	WOPL instrument bank
4940>11	leshort	x	\b, version %u
4941
4942# AdLib/OPL instrument files. Format specifications on
4943#  http://www.shikadi.net/moddingwiki
49440	string	Junglevision\ Patch\ File	Junglevision instrument data
49450	string	#OPL_II#	DMX OP2 instrument data
49460	string	IBK\x1a		IBK instrument data
49470	string	2OP\x1a		IBK instrument data, 2 operators
49480	string	4OP\x1a		IBK instrument data, 4 operators
49492	string	ADLIB-		AdLib instrument data
4950>0	byte	x		\b, version %u
4951>1	byte	x		\b.%u
4952
4953# CRI ADX ADPCM audio
4954# Used by various Sega games.
4955# https://en.wikipedia.org/wiki/ADX_(file_format)
4956# https://wiki.multimedia.cx/index.php/CRI_ADX_file
4957# Added by David Korth <gerbilsoft@gerbilsoft.com>
49580x00		beshort		0x8000
4959>(2.S-2)	string		(c)CRI		CRI ADX ADPCM audio
4960!:ext adx
4961!:mime audio/x-adx
4962!:strength +50
4963>>0x12		byte		x		v%u
4964>>0x04		byte		0x02		\b, pre-set prediction coefficients
4965>>0x04		byte		0x03		\b, standard ADX
4966>>0x04		byte		0x04		\b, exponential scale
4967>>0x04		byte		0x10		\b, AHX (Dreamcast)
4968>>0x04		byte		0x11		\b, AHX
4969>>0x08		belong		x		\b, %u Hz
4970>>0x12		byte		0x03
4971>>>0x02		beshort		>0x2B
4972>>>>0x18	belong		!0		\b, looping
4973>>0x12		byte		0x04
4974>>>0x02		beshort		>0x37
4975>>>>0x24	belong		!0		\b, looping
4976>>0x13		byte&0x08	0x08		\b, encrypted
4977
4978# Lossless audio (.la) (http://www.lossless-audio.com/)
49790	string	LA
4980>2	string	03	Lossless audio version 0.3
4981>2	string	04	Lossless audio version 0.4
4982
4983# Sony PlayStation Audio (.xa)
49840	leshort 0x4158	Sony PlayStation Audio
4985
4986# Portable Sound Format
4987# Used for audio rips for various consoles.
4988# http://fileformats.archiveteam.org/wiki/Portable_Sound_Format
4989# Added by David Korth <gerbilsoft@gerbilsoft.com>
49900	string	PSF	Portable Sound Format
4991!:mime	audio/x-psf
4992>3	byte	0x01	(Sony PlayStation)
4993>3	byte	0x02	(Sony PlayStation 2)
4994>3	byte	0x11	(Sega Saturn)
4995>3	byte	0x12	(Sega Dreamcast)
4996>3	byte	0x13	(Sega Mega Drive)
4997>3	byte	0x21	(Nintendo 64)
4998>3	byte	0x22	(Game Boy Advance)
4999>3	byte	0x23	(Super NES)
5000>3	byte	0x41	(Capcom QSound)
5001
5002# Atari 8-bit SAP audio format
5003# http://asap.sourceforge.net/sap-format.html
5004# Added by David Korth <gerbilsoft@gerbilsoft.com>
50050	string		SAP\r\n	Atari 8-bit SAP audio file
5006!:mime	audio/x-sap
5007!:ext	sap
5008>5	search/1024	NAME
5009>>&1	string		x	\b: %s
5010>>5	search/1024	AUTHOR
5011>>>&1	string		x	by %s
5012
5013# Nintendo Wii BRSTM audio format (fields)
5014# NOTE: Assuming HEAD starts at 0x40.
5015# FIXME: Replace 0x48 with HEAD offset plus 8.
50160	name	nintendo-wii-brstm-fields
5017>(0x10.L)	string	HEAD	\b:
5018>>(0x10.L+0x0C)	belong	x
5019>>>(&-4.L+0x48)	belong	x
5020>>>>&-4		byte	0	PCM, signed 8-bit,
5021>>>>&-4		byte	1	PCM, signed 16-bit,
5022>>>>&-4		byte	2	THP ADPCM,
5023>>>>&-3		byte	!0	looping,
5024>>>>&-2		byte	1	mono
5025>>>>&-2		byte	2	stereo
5026>>>>&-2		byte	3	3 channels
5027>>>>&-2		byte	4	quad
5028>>>>&-2		byte	>4	%u channels
5029>>>>&0		beshort	!0	%u Hz
5030
5031# Nintendo Wii BRSTM audio format
5032# https://wiibrew.org/wiki/BRSTM_file
5033# Added by David Korth <gerbilsoft@gerbilsoft.com>
50340	string		RSTM	Nintendo Wii BRSTM audio file
5035!:mime	audio/x-brstm
5036!:ext	brstm
5037# Wii is big-endian, so default to BE.
5038>4	beshort		0xFEFF
5039>>0	use		nintendo-wii-brstm-fields
5040>4	leshort		0xFEFF
5041>>0	use		\^nintendo-wii-brstm-fields
5042
5043# Nintendo 3DS BCSTM audio format (fields)
50440	name	nintendo-3ds-bcstm-fields
5045>(0x18.l)	string	INFO	\b:
5046# INFO block: Stream information starts at 0x20 (minus 4 for the 'INFO' magic)
5047>>&0x1C		byte	0	PCM, signed 8-bit,
5048>>&0x1C		byte	1	PCM, signed 16-bit,
5049>>&0x1C		byte	2	DSP ADPCM,
5050>>&0x1C		byte	3	IMA ADPCM,
5051>>&0x1D		byte	!0	looping,
5052>>&0x1E		byte	1	mono
5053>>&0x1E		byte	2	stereo
5054>>&0x1E		byte	3	3 channels
5055>>&0x1E		byte	4	quad
5056>>&0x1E		byte	>4	%u channels
5057>>&0x20		lelong	!0	%u Hz
5058
5059# Nintendo 3DS BCSTM audio format
5060# https://www.3dbrew.org/wiki/BCSTM
5061# Added by David Korth <gerbilsoft@gerbilsoft.com>
50620	string		CSTM	Nintendo 3DS BCSTM audio file
5063!:mime	audio/x-bcstm
5064!:ext	bcstm
5065# 3DS is little-endian, so default to LE.
5066>4	leshort		0xFEFF
5067>>0	use		nintendo-3ds-bcstm-fields
5068>4	beshort		0xFEFF
5069>>0	use		\^nintendo-3ds-bcstm-fields
5070
5071# Nintendo Wii U BFSTM audio format
5072# http://mk8.tockdom.com/wiki/BFSTM_(File_Format)
5073# NOTE: This format is very similar to BCSTM.
5074# Added by David Korth <gerbilsoft@gerbilsoft.com>
50750	string		FSTM	Nintendo Wii U BFSTM audio file
5076!:mime	audio/x-bfstm
5077!:ext	bfstm
5078# BFSTM is used on both Wii U (BE) and Switch (LE),
5079# so default to LE.
5080>4	leshort		0xFEFF
5081>>0	use		nintendo-3ds-bcstm-fields
5082>4	beshort		0xFEFF
5083>>0	use		\^nintendo-3ds-bcstm-fields
5084
5085# Nintendo 3DS BCSTM audio format (fields)
50860	name	nintendo-3ds-bcwav-fields
5087>(0x18.l)	string	INFO	\b:
5088# INFO block (minus 4 for INFO magic)
5089>>&0x4		byte	0	PCM, signed 8-bit,
5090>>&0x4		byte	1	PCM, signed 16-bit,
5091>>&0x4		byte	2	DSP ADPCM,
5092>>&0x4		byte	3	IMA ADPCM,
5093>>&0x5		byte	!0	looping,
5094>>&0x8		lelong	x	stereo
5095>>&0x8		lelong	!0	%u Hz
5096
5097# Nintendo 3DS BCWAV audio format
5098# https://www.3dbrew.org/wiki/BCWAV
5099# Added by David Korth <gerbilsoft@gerbilsoft.com>
51000	string		CWAV	Nintendo 3DS BCWAV audio file
5101!:mime	audio/x-bcwav
5102!:ext	bcwav
5103# 3DS is little-endian, so default to LE.
5104>4	leshort		0xFEFF
5105>>0	use		nintendo-3ds-bcwav-fields
5106>4	beshort		0xFEFF
5107>>0	use		\^nintendo-3ds-bcwav-fields
5108
5109#----------------------------------------------------------------
5110# $File: basis,v 1.5 2019/04/19 00:42:27 christos Exp $
5111# basis: file(1) magic for BBx/Pro5-files
5112#      Oliver Dammer <dammer@olida.de>	 2005/11/07
5113# https://www.basis.com business-basic-files.
5114#
51150	string		\074\074bbx\076\076	BBx
5116>7	string		\000			indexed file
5117>7	string		\001			serial file
5118>7	string		\002			keyed file
5119>>13	short		0			(sort)
5120>7	string		\004			program
5121>>18	byte		x			(LEVEL %d)
5122>>>23	string		>\000			psaved
5123>7	string		\006			mkeyed file
5124>>13	short		0			(sort)
5125>>8	string		\000			(mkey)
5126#------------------------------------------------------------------------------
5127# $File: beetle,v 1.2 2018/02/05 23:42:17 rrt Exp $
5128# beetle:  file(1) magic for Beetle VM object files
5129# https://github.com/rrthomas/beetle/
5130
5131# Beetle object module
51320	string		BEETLE\000	Beetle VM object file
5133
5134#------------------------------------------------------------------------------
5135# $File: ber,v 1.2 2019/04/19 00:42:27 christos Exp $
5136# ber:  file(1) magic for several BER formats used in the mobile
5137# telecommunications industry (Georg Sauthoff)
5138
5139# The file formats are standardized by the GSMA (GSM association).
5140# They are specified via ASN.1 schemas and some prose. Basic encoding
5141# rules (BER) is the used encoding. The formats are used for exchanging
5142# call data records (CDRs) between mobile operators and associated
5143# parties for roaming clearing purposes and fraud detection.
5144
5145# The magic file covers:
5146
5147# - TAP files (TD.57) - CDR batches and notifications
5148# - RAP files (TD.32) - return batches and acknowledgements
5149# - NRT files (TD.35) - CDR batches for 'near real time' processing
5150
5151#
5152# TAP 3 Files
5153# TAP -> Transferred Account Procedure
5154# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf
5155# TransferBatch short tag
51560	byte	0x61
5157# BatchControlInfo short tag
5158>&1	search/b5	\x64
5159# Sender long tag #TAP 3.x (BER encoded)
5160>>&1	search/b8	\x5f\x81\x44
5161# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
5162>>>&64	search/b64	\x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
5163>>>>&0	byte	x	TAP 3.%d Batch (TD.57, Transferred Account)
5164
5165# Notification short tag
51660	byte	0x62
5167# Sender long tag
5168>2	search/b8	\x5f\x81\x44
5169# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
5170>>&64	search/b64	\x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
5171>>>&0	byte	x	TAP 3.%d Notification (TD.57, Transferred Account)
5172
5173
5174# NRT Files
5175# NRT a.k.a. NRTRDE
51760	byte	0x61
5177# <SpecificationVersionNumber>2</><ReleaseVersionNumber> block
5178>&1	search/b8 \x5f\x29\x01\x02\x5f\x25\x01
5179>>&0	byte	x	NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange)
5180
5181# RAP Files
5182# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf
5183# Long ReturnBatch tag
51840	string	\x7f\x84\x16
5185# Long RapBatchControlInfo tag
5186>&1	search/b8	\x7f\x84\x19
5187# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
5188>>&64	search/b64	\x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
5189# <RapSpecificationVersionNumber>1</><RapReleaseVersionNumber> block
5190>>>&1	string/b	\x5f\x84\x20\x01\x01\x5f\x84\x1f\x01
5191>>>>&0	byte	x	RAP 1.%d Batch (TD.32, Returned Account Procedure),
5192>>>&0	byte	x	TAP 3.%d
5193
5194# Long Acknowledgement tag
51950	string \x7f\x84\x17
5196# Long Sender tag
5197>&1	search/b5	\x5f\x81\x44	RAP Acknowledgement (TD.32, Returned Account Procedure)
5198
5199#------------------------------------------------------------------------------
5200# $File: bflt,v 1.5 2014/04/30 21:41:02 christos Exp $
5201# bFLT: file(1) magic for BFLT uclinux binary files
5202#
5203# From Philippe De Muyter <phdm@macqel.be>
5204#
52050	string		bFLT		BFLT executable
5206>4	belong		x		- version %d
5207>4	belong		4
5208>>36	belong&0x1	0x1		ram
5209>>36	belong&0x2	0x2		gotpic
5210>>36	belong&0x4	0x4		gzip
5211>>36	belong&0x8	0x8		gzdata
5212
5213#------------------------------------------------------------------------------
5214# $File: bhl,v 1.1 2017/06/11 22:20:02 christos Exp $
5215# BlockHashLoc
5216# ext: bhl
5217# Marco Pontello marcopon@gmail.com
5218# reference: https://github.com/MarcoPon/BlockHashLoc
52190	string	BlockHashLoc\x1a	BlockHashLoc recovery info,
5220>13	byte	x			version %d
5221!:ext   bhl
5222
5223#------------------------------------------------------------------------------
5224# $File: bioinformatics,v 1.5 2019/04/19 00:42:27 christos Exp $
5225# bioinfomatics:  file(1) magic for Bioinfomatics file formats
5226
5227###############################################################################
5228# BGZF (Blocked GNU Zip Format) - gzip compatible, but also indexable
5229# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml)
5230###############################################################################
52310	string		\037\213
5232>3	byte		&0x04
5233>>12	string		BC
5234>>>14	leshort		&0x02	Blocked GNU Zip Format (BGZF; gzip compatible)
5235>>>>16	leshort		x	\b, block length %d
5236!:mime	application/x-gzip
5237
5238
5239###############################################################################
5240# Tabix index file
5241# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml)
5242###############################################################################
52430	string	TBI\1		SAMtools TBI (Tabix index format)
5244>0x04	lelong	=1		\b, with %d reference sequence
5245>0x04	lelong	>1		\b, with %d reference sequences
5246>0x08	lelong	&0x10000	\b, using half-closed-half-open coordinates (BED style)
5247>0x08	lelong	^0x10000
5248>>0x08	lelong	=0		\b, using closed and one based coordinates (GFF style)
5249>>0x08	lelong	=1		\b, using SAM format
5250>>0x08	lelong	=2		\b, using VCF format
5251>0x0c	lelong	x		\b, sequence name column: %d
5252>0x10	lelong	x		\b, region start column: %d
5253>0x08	lelong	=0
5254>>0x14	lelong	x		\b, region end column: %d
5255>0x18	byte	x		\b, comment character: %c
5256>0x1c	lelong	x		\b, skip line count: %d
5257
5258
5259###############################################################################
5260# BAM (Binary Sequence Alignment/Map format)
5261# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
5262# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
5263###############################################################################
52640	string	BAM\1	SAMtools BAM (Binary Sequence Alignment/Map)
5265>0x04	lelong	>0
5266>>&0x00 regex	=^[@]HD\t.*VN:		\b, with SAM header
5267>>>&0	regex	=[0-9.]+		\b version %s
5268>>&(0x04)	lelong	>0	\b, with %d reference sequences
5269
5270
5271###############################################################################
5272# BAI (BAM indexing format)
5273# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
5274###############################################################################
52750		string	BAI\1	SAMtools BAI (BAM indexing format)
5276>0x04		lelong	>0	\b, with %d reference sequences
5277
5278
5279###############################################################################
5280# CRAM (Binary Sequence Alignment/Map format)
5281###############################################################################
52820	string	CRAM	CRAM
5283>0x04	byte	>-1	version %d.
5284>0x05	byte	>-1	\b%d
5285>0x06	string	>\0	(identified as %s)
5286
5287
5288###############################################################################
5289# BCF (Binary Call Format), version 1
5290# used by SAMtools & VCFtools (http://vcftools.sourceforge.net/bcf.pdf)
5291# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
5292###############################################################################
52930		string	   BCF\4
5294# length of seqnm data in bytes is positive
5295>&0x00		lelong	  >0
5296# length of smpl data in bytes is positive
5297>>&(&-0x04)	lelong	  >0			SAMtools BCF (Binary Call Format)
5298# length of meta in bytes
5299>>>&(&-0x04)	lelong	  >0
5300# have meta text string
5301>>>>&0x00	search	  ##samtoolsVersion=
5302>>>>>&0x00	string	  x			\b, generated by SAMtools version %s
5303
5304
5305###############################################################################
5306# BCF (Binary Call Format), version 2.1
5307# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf)
5308# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
5309###############################################################################
53100		string	   BCF\2\1    Binary Call Format (BCF) version 2.1
5311# length of header text
5312>&0x00		lelong	  >0
5313# have header string
5314>>&0x00 search	  ##samtoolsVersion=
5315>>>&0x00	string	  x			\b, generated by SAMtools version %s
5316
5317
5318###############################################################################
5319# BCF (Binary Call Format), version 2.2
5320# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf)
5321# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
5322###############################################################################
53230		string	   BCF\2\2    Binary Call Format (BCF) version 2.2
5324# length of header text
5325>&0x00		lelong	  >0
5326# have header string
5327>>&0x00 search	  ##samtoolsVersion=
5328>>>&0x00	string	  x			\b, generated by SAMtools version %s
5329
5330###############################################################################
5331# VCF (Variant Call Format)
5332# used by VCFtools (http://vcftools.sourceforge.net/)
5333###############################################################################
53340      search	   ##fileformat=VCFv	Variant Call Format (VCF)
5335>&0    string	   x			\b version %s
5336
5337###############################################################################
5338# FASTQ
5339# used by MAQ (http://maq.sourceforge.net/fastq.shtml)
5340###############################################################################
5341# XXX Broken?
5342# @<seqname>
5343#0	regex	=^@[A-Za-z0-9_.:-]+\?\n
5344# <seq>
5345#>&1	regex	=^[A-Za-z\n.~]++
5346# +[<seqname>]
5347#>>&1	regex	=^[A-Za-z0-9_.:-]*\?\n
5348# <qual>
5349#>>>&1	regex	=^[!-~\n]+\n		FASTQ
5350
5351###############################################################################
5352# FASTA
5353# used by FASTA (https://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf)
5354###############################################################################
5355#0	byte	0x3e
5356# q>0	regex	=^[>][!-~\t\ ]+$
5357# Amino Acid codes: [A-IK-Z*-]+
5358#>>1	regex	!=[!-'Jj;:=?@^`|~\\]		FASTA
5359# IUPAC codes/gaps: [ACGTURYKMSWBDHVNX-]+
5360# not in IUPAC codes/gaps: [EFIJLOPQZ]
5361#>>>1	regex	!=[EFIJLOPQZefijlopqz]		\b, with IUPAC nucleotide codes
5362#>>>1	regex	=^[EFIJLOPQZefijlopqz]+$	\b, with Amino Acid codes
5363
5364###############################################################################
5365# SAM (Sequence Alignment/Map format)
5366# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
5367###############################################################################
5368# Short-cut version to recognise SAM files with (optional) header at beginning
5369###############################################################################
53700      string	   @HD\t
5371>4     search	   VN:		Sequence Alignment/Map (SAM), with header
5372>>&0   regex	   [0-9.]+	\b version %s
5373###############################################################################
5374# Longer version to recognise SAM alignment lines using (many) regexes
5375###############################################################################
5376# SAM Alignment QNAME
53770		regex	=^[!-?A-~]{1,255}(\t[^\t]+){11}
5378# SAM Alignment FLAG
5379>0		regex	=^([^\t]+\t){1}[0-9]{1,5}\t
5380# SAM Alignment RNAME
5381>>0		regex	=^([^\t]+\t){2}\\*|[^*=]*\t
5382# SAM Alignment POS
5383>>>0		regex	=^([^\t]+\t){3}[0-9]{1,9}\t
5384# SAM Alignment MAPQ
5385>>>>0		regex	=^([^\t]+\t){4}[0-9]{1,3}\t
5386# SAM Alignment CIGAR
5387>>>>>0		regex	=\t(\\*|([0-9]+[MIDNSHPX=])+)\t
5388# SAM Alignment RNEXT
5389>>>>>>0		regex	=\t(\\*|=|[!-()+->?-~][!-~]*)\t
5390# SAM Alignment PNEXT
5391>>>>>>>0	regex	=^([^\t]+\t){7}[0-9]{1,9}\t
5392# SAM Alignment TLEN
5393>>>>>>>>0	regex	=\t[+-]{0,1}[0-9]{1,9}\t.*\t
5394# SAM Alignment SEQ
5395>>>>>>>>>0	regex	=^([^\t]+\t){9}(\\*|[A-Za-z=.]+)\t
5396# SAM Alignment QUAL
5397>>>>>>>>>>0	regex	=^([^\t]+\t){10}[!-~]+	Sequence Alignment/Map (SAM)
5398>>>>>>>>>>>0	regex	=^[@]HD\t.*VN:		\b, with header
5399>>>>>>>>>>>>&0	regex	=[0-9.]+		\b version %s
5400
5401##############################################################################
5402#
5403#    Magic ids for biomedical signal file formats
5404#    Copyright (C) 2018 Alois Schloegl <alois.schloegl@gmail.com>
5405#
5406#    The list has been derived from biosig projects
5407#      http://biosig.sourceforge.net
5408#      https://pub.ist.ac.at/~schloegl/matlab/eeg/
5409#      https://pub.ist.ac.at/~schloegl/biosig/TESTED
5410#
5411##############################################################################
5412#
54130	string  ABF\x20					Biosig/Axon Binary format
5414!:mime biosig/abf2
54150	string  ABF2\0\0				Biosig/Axon Binary format
5416!:mime biosig/abf2
5417#
54180	string  ATES\x20MEDICA\x20SOFT.\x20EEG\x20for\x20Windows	Biosig/ATES MEDICA SOFT. EEG for Windows
5419!:mime biosig/ates
5420#
54210	string  ATF\x09					Biosig/Axon Text fomrat
5422!:mime biosig/atf
5423#
54240	string  ADU1					Biosig/Axona file format
5425!:mime biosig/axona
54260	string  ADU2					Biosig/Axona file format
5427!:mime biosig/axona
5428#
54290	string  ALPHA-TRACE-MEDICAL			Biosig/alpha trace
5430!:mime biosig/alpha
5431#
54320       string  AxGr					Biosig/AXG
54330       string  axgx					Biosig/AXG
5434!:mime biosig/axg
5435#
54360	string  HeaderLen=				Biosig/BCI2000
54370	string  BCI2000V				Biosig/BCI2000
5438!:mime biosig/bci2000
5439#
5440### Specification: https://www.biosemi.com/faq/file_format.htm
54410	string  \xffBIOSEMI				Biosig/Biosemi data format
5442!:mime biosig/bdf
5443#
54440	string  Brain\x20Vision\x20Data\x20Exchange\x20Header\x20File			Biosig/Brainvision data file
54450	string  Brain\x20Vision\x20V-Amp\x20Data\x20Header\x20File\x20Version		Biosig/Brainvision V-Amp file
54460	string  Brain\x20Vision\x20Data\x20Exchange\x20Marker\x20File,\x20Version	Biosig/Brainvision Marker file
5447!:mime biosig/brainvision
5448#
54490	string  CEDFILE					Biosig/CFS: Cambridge Electronic devices File format
5450!:mime biosig/ced
5451#
5452### Specification: https://www.edfplus.info/specs/index.html
54530	string	0\x20\x20\x20\x20\x20\x20\x20		Biosig/EDF: European Data format
5454!:mime biosig/edf
5455#
5456### Specifications: https://arxiv.org/abs/cs/0608052
54570	string  GDF					Biosig/GDF: General data format for biosignals
5458!:mime biosig/gdf
5459#
54600	string  DATA\0\0\0\0				Biosig/Heka Patchmaster
54610	string  DAT1\0\0\0\0				Biosig/Heka Patchmaster
54620	string  DAT2\0\0\0\0				Biosig/Heka Patchmaster
5463!:mime biosig/heka
5464#
54650	string  (C)\x20CED\x2087			Biosig/CED SMR
5466!:mime biosig/ced-smr
5467#
54680	string  CFWB\1\0\0\0				Biosig/CFWB
5469!:mime biosig/cfwb
5470#
54710	string  DEMG					Biosig/DEMG
5472!:mime biosig/demg
5473#
54740	string  EBS\x94\x0a\x13\x1a\x0d			Biosig/EBS
5475!:mime biosig/ebs
5476#
54770	string  Embla\x20data\x20file			Biosig/Embla
5478!:mime biosig/embla
5479#
54800	string  Header\r\nFile Version			Biosig/ETG4000
5481!:mime biosig/etg4000
5482#
54830	string  GALILEO\x20EEG\x20TRACE\x20FILE		Biosig/Galileo
5484!:mime biosig/galileo
5485#
54860	string  IGOR					Biosig/IgorPro ITX file
5487!:mime biosig/igorpro
5488#
5489#	Specification: http://www.ampsmedical.com/uploads/2017-12-7/The_ISHNE_Format.pdf
54900	string  ISHNE1.0				Biosig/ISHNE
5491!:mime biosig/ishne
5492#
5493# 	CEN/ISO 11073/22077 series, http://www.mfer.org/en/document.htm
54940	string  @\x20\x20MFER\x20			Biosig/MFER
54950	string  @\x20MFR\x20				Biosig/MFER
5496!:mime biosig/mfer
5497#
54980	string  NEURALEV				Biosig/NEV
54990	string  N.EV.\0					Biosig/NEV
5500!:mime biosig/nev
5501#
55020	string  NEX1					Biosig/NEX
5503!:mime biosig/nex1
5504#
55050	string  PLEX 					Biosig/Plexon v1.0
550610	string  PLEXON 					Biosig/Plexon v2.0
5507!:mime biosig/plexon
5508#
55090	string  \x02\x27\x91\xC6			Biosig/RHD2000: Intan RHD2000 format
5510#
5511#	Specification: CEN 1064:2005/ISO 11073:91064
551216	string  SCPECG\0\0 				Biosig/SCP-ECG format CEN 1064:2005/ISO 11073:91064
5513!:mime biosig/scpecg
5514#
55150	string  IAvSFo									Biosig/SIGIF
5516!:mime biosig/sigif
5517#
55180	string  POLY\x20SAMPLE\x20FILEversion\x20					Biosig/TMS32
5519!:mime biosig/tms32
5520#
55210	string  FileId=TMSi\x20PortiLab\x20sample\x20log\x20file\x0a\x0dVersion=	Biosig/TMSiLOG
5522!:mime biosig/tmsilog
5523#
55244	string	Synergy\0\48\49\50\46\48\48\51\46\48\48\48\46\48\48\48\0\28\0\0\0\2\0\0\0
5525>63	string	CRawDataElement
5526>>85	string	CRawDataBuffer								Biosig/SYNERGY
5527!:mime biosig/synergy
5528#
55294	string	\40\0\4\1\44\1\102\2\146\3\44\0\190\3					Biosig/UNIPRO
5530!:mime biosig/unipro
5531#
55320	string	VER=9\r\nCTIME=								Biosig/WCP
5533!:mime biosig/wcp
5534#
55350	string	\xAF\xFE\xDA\xDA							Biosig/Walter Graphtek
55360	string	\xDA\xDA\xFE\xAF							Biosig/Walter Graphtek
55370	string	\x55\x55\xFE\xAF							Biosig/Walter Graphtek
5538!:mime biosig/walter-graphtek
5539#
55400	string  V3.0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20
5541>32	string  [PatInfo]								Biosig/Sigma
5542!:mime biosig/sigma
5543#
55440	string  \067\069\078\013\010\0x1a\04\0x84					Biosig/File exchange format (FEF)
5545!:mime biosig/fef
55460	string  \67\69\78\0x13\0x10\0x1a\4\0x84						Biosig/File exchange format (FEF)
5547!:mime biosig/fef
5548#
55490	string  \0\0\0\x64\0\0\0\x1f\0\0\0\x14\0\0\0\0\0\1
5550>36  	string  \0\0\0\x65\0\0\0\3\0\0\0\4\0\0
5551>>56	string  \0\0\0\x6a\0\0\0\3\0\0\0\4\0\0\0\0\xff\xff\xff\xff\0\0			Biosig/FIFF
5552!:mime biosig/fiff
5553#
5554
5555#------------------------------------------------------------------------------
5556# $File: blackberry,v 1.2 2017/03/17 21:35:28 christos Exp $
5557# blackberry:  file(1) magic for BlackBerry file formats
5558#
55595	belong	0
5560>8	belong  010010010	BlackBerry RIM ETP file
5561>>22	string	x		\b for %s
5562# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files
5563# https://ftg.lbl.gov/checkpoint
55640	string	C\0\0\0R\0\0\0	BLCR
5565>16	lelong	1	x86
5566>16	lelong	3	alpha
5567>16	lelong	5	x86-64
5568>16	lelong	7	ARM
5569>8	lelong	x	context data (little endian, version %d)
5570# Uncomment the following only of your "file" program supports "search"
5571#>0	search/1024	VMA\06	for kernel
5572#>>&1	byte	x	%d.
5573#>>&2	byte	x	%d.
5574#>>&3	byte	x	%d
55750	string	\0\0\0C\0\0\0R	BLCR
5576>16	belong	2	SPARC
5577>16	belong	4	ppc
5578>16	belong	6	ppc64
5579>16	belong	7	ARMEB
5580>16	belong	8	SPARC64
5581>8	belong	x	context data (big endian, version %d)
5582# Uncomment the following only of your "file" program supports "search"
5583#>0	search/1024	VMA\06	for kernel
5584#>>&1	byte	x	%d.
5585#>>&2	byte	x	\b%d.
5586#>>&3	byte	x	\b%d
5587
5588#------------------------------------------------------------------------------
5589# $File: blender,v 1.8 2019/04/19 00:42:27 christos Exp $
5590# blender: file(1) magic for Blender 3D related files
5591#
5592# Native format rule v1.2. For questions use the developers list
5593# https://lists.blender.org/mailman/listinfo/bf-committers
5594# GLOB chunk was moved near start and provides subversion info since 2.42
5595
55960		string	=BLENDER	Blender3D,
5597>7		string	=_		saved as 32-bits
5598>>8		string	=v		little endian
5599>>>9		byte	x		with version %c.
5600>>>10		byte	x		\b%c
5601>>>11		byte	x		\b%c
5602>>>0x40		string	=GLOB		\b.
5603>>>>0x58	leshort	x		\b%.4d
5604>>8		string	=V		big endian
5605>>>9		byte	x		with version %c.
5606>>>10		byte	x		\b%c
5607>>>11		byte	x		\b%c
5608>>>0x40		string	=GLOB		\b.
5609>>>>0x58	beshort	x		\b%.4d
5610>7		string	=-		saved as 64-bits
5611>>8		string	=v		little endian
5612>>9		byte	x		with version %c.
5613>>10		byte	x		\b%c
5614>>11		byte	x		\b%c
5615>>0x44		string	=GLOB		\b.
5616>>>0x60		leshort	x		\b%.4d
5617>>8		string	=V		big endian
5618>>>9		byte	x		with version %c.
5619>>>10		byte	x		\b%c
5620>>>11		byte	x		\b%c
5621>>>0x44		string	=GLOB		\b.
5622>>>>0x60	beshort	x		\b%.4d
5623
5624# Scripts that run in the embedded Python interpreter
56250		string	#!BPY		Blender3D BPython script
5626
5627#------------------------------------------------------------------------------
5628# $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $
5629# blit:  file(1) magic for 68K Blit stuff as seen from 680x0 machine
5630#
5631# Note that this 0407 conflicts with several other a.out formats...
5632#
5633# XXX - should this be redone with "be" and "le", so that it works on
5634# little-endian machines as well?  If so, what's the deal with
5635# "VAX-order" and "VAX-order2"?
5636#
5637#0	long		0407		68K Blit (standalone) executable
5638#0	short		0407		VAX-order2 68K Blit (standalone) executable
56390	short		03401		VAX-order 68K Blit (standalone) executable
56400	long		0406		68k Blit mpx/mux executable
56410	short		0406		VAX-order2 68k Blit mpx/mux executable
56420	short		03001		VAX-order 68k Blit mpx/mux executable
5643# Need more values for WE32 DMD executables.
5644# Note that 0520 is the same as COFF
5645#0	short		0520		tty630 layers executable
5646
5647#------------------------------------------------------------------------------
5648# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $
5649# i80960 b.out objects and archives
5650#
56510	long		0x10d		i960 b.out relocatable object
5652>16	long		>0		not stripped
5653#
5654# b.out archive (hp-rt on i960)
56550	string		=!<bout>	b.out archive
5656>8	string		__.SYMDEF	random library
5657
5658#------------------------------------------------------------------------------
5659# $File: bsdi,v 1.7 2014/03/29 15:40:34 christos Exp $
5660# bsdi:  file(1) magic for BSD/OS (from BSDI) objects
5661# Some object/executable formats use the same magic numbers as are used
5662# in other OSes; those are handled by entries in aout.
5663#
5664
56650	lelong		0314		386 compact demand paged pure executable
5666>16	lelong		>0		not stripped
5667>32	byte		0x6a		(uses shared libs)
5668
5669# same as in SunOS 4.x, except for static shared libraries
56700	belong&077777777	0600413		SPARC demand paged
5671>0	byte		&0x80
5672>>20	belong		<4096		shared library
5673>>20	belong		=4096		dynamically linked executable
5674>>20	belong		>4096		dynamically linked executable
5675>0	byte		^0x80		executable
5676>16	belong		>0		not stripped
5677>36	belong		0xb4100001	(uses shared libs)
5678
56790	belong&077777777	0600410		SPARC pure
5680>0	byte		&0x80		dynamically linked executable
5681>0	byte		^0x80		executable
5682>16	belong		>0		not stripped
5683>36	belong		0xb4100001	(uses shared libs)
5684
56850	belong&077777777	0600407		SPARC
5686>0	byte		&0x80		dynamically linked executable
5687>0	byte		^0x80		executable
5688>16	belong		>0		not stripped
5689>36	belong		0xb4100001	(uses shared libs)
5690# Chiasmus is a encryption standard developed by the German Federal
5691# Office for Information Security (Bundesamt fuer Sicherheit in der
5692# Informationstechnik).
5693
5694# Extension: .xia
56950	string	XIA1	Chiasmus encrypted data
5696
5697# Extension: .xis
56980	string	XIS	Chiasmus key
5699
5700#------------------------------------------------------------------------------
5701# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $
5702# BTSnoop:  file(1) magic for BTSnoop files
5703#
5704# From <marcel@holtmann.org>
57050	string		btsnoop\0		BTSnoop
5706>8	belong		x			version %d,
5707>12	belong		1001			Unencapsulated HCI
5708>12	belong		1002			HCI UART (H4)
5709>12	belong		1003			HCI BCSP
5710>12	belong		1004			HCI Serial (H5)
5711>>12	belong		x			type %d
5712
5713#------------------------------------------------------------------------------
5714# $File: c64,v 1.7 2017/11/15 12:19:06 christos Exp $
5715# c64:  file(1) magic for various commodore 64 related files
5716#
5717# From: Dirk Jagdmann <doj@cubic.org>
5718
57190x16500	belong		0x12014100	D64 Image
57200x16500	belong		0x12014180	D71 Image
57210x61800 belong		0x28034400	D81 Image
57220	string		C64\40CARTRIDGE	CCS C64 Emultar Cartridge Image
57230	belong		0x43154164	X64 Image
5724
57250	string		GCR-1541	GCR Image
5726>8	byte		x		version: %i
5727>9	byte		x		tracks: %i
5728
57299	string		PSUR		ARC archive (c64)
57302	string		-LH1-		LHA archive (c64)
5731
57320	string		C64File		PC64 Emulator file
5733>8	string		>\0		"%s"
57340	string		C64Image	PC64 Freezer Image
5735
57360	beshort		0x38CD		C64 PCLink Image
57370	string		CBM\144\0\0	Power 64 C64 Emulator Snapshot
5738
57390	belong		0xFF424CFF	WRAptor packer (c64)
5740
57410	string		C64S\x20tape\x20file	T64 tape Image
5742>32	leshort		x		Version:0x%x
5743>36	leshort		!0		Entries:%i
5744>40	string		x		Name:%.24s
5745
57460	string		C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0	T64 tape Image
5747>32	leshort		x		Version:0x%x
5748>36	leshort		!0		Entries:%i
5749>40	string		x		Name:%.24s
5750
57510	string		C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0	T64 tape Image
5752>32	leshort		x		Version:0x%x
5753>36	leshort		!0		Entries:%i
5754>40	string		x		Name:%.24s
5755
5756# Raw tape file format (.tap files)
5757# Esa Hyyti <esa@netlab.tkk.fi>
57580	string		C64-TAPE-RAW	C64 Raw Tape File (.tap),
5759>0x0c	byte		x		Version:%u,
5760>0x10	lelong		x		Length:%u cycles
5761
5762# magic for Goattracker2, http://covertbitops.c64.org/
5763# from Alex Myczko <alex@aiei.ch>
57640	string		GTS5		GoatTracker 2 song
5765>4	string		>\0		\b, "%s"
5766>36	string		>\0		\b by %s
5767>68	string		>\0		\b (C) %s
5768>100	byte		>0		\b, %u subsong(s)
5769
5770
5771#------------------------------------------------------------------------------
5772# $File: cad,v 1.19 2019/04/19 00:42:27 christos Exp $
5773# autocad:  file(1) magic for cad files
5774#
5775
5776# Microstation DGN/CIT Files (www.bentley.com)
5777# Last updated July 29, 2005 by Lester Hightower
5778# DGN is the default file extension of Microstation/Intergraph CAD files.
5779# CIT is the proprietary raster format (similar to TIFF) used to attach
5780# raster underlays to Microstation DGN (vector) drawings.
5781#
5782# http://www.wotsit.org/search.asp
5783# https://filext.com/detaillist.php?extdetail=DGN
5784# https://filext.com/detaillist.php?extdetail=CIT
5785#
5786# https://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
5787# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
5788# https://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
5789# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
57900	string	\010\011\376			Microstation
5791>3	string	\002
5792>>30	string	\026\105			DGNFile
5793>>30	string	\034\105			DGNFile
5794>>30	string	\073\107			DGNFile
5795>>30	string	\073\110			DGNFile
5796>>30	string	\106\107			DGNFile
5797>>30	string	\110\103			DGNFile
5798>>30	string	\120\104			DGNFile
5799>>30	string	\172\104			DGNFile
5800>>30	string	\172\105			DGNFile
5801>>30	string	\172\106			DGNFile
5802>>30	string	\234\106			DGNFile
5803>>30	string	\273\105			DGNFile
5804>>30	string	\306\106			DGNFile
5805>>30	string	\310\104			DGNFile
5806>>30	string	\341\104			DGNFile
5807>>30	string	\372\103			DGNFile
5808>>30	string	\372\104			DGNFile
5809>>30	string	\372\106			DGNFile
5810>>30	string	\376\103			DGNFile
5811>4	string	\030\000\000			CITFile
5812>4	string	\030\000\003			CITFile
5813
5814# AutoCAD
5815# Merge of the different contributions and updates from https://en.wikipedia.org/wiki/Dwg
5816# and https://www.iana.org/assignments/media-types/image/vnd.dwg
58170	string	MC0.0	DWG AutoDesk AutoCAD Release 1.0
5818!:mime image/vnd.dwg
58190	string	AC1.2	DWG AutoDesk AutoCAD Release 1.2
5820!:mime image/vnd.dwg
58210	string	AC1.3	DWG AutoDesk AutoCAD Release 1.3
5822!:mime image/vnd.dwg
58230	string	AC1.40	DWG AutoDesk AutoCAD Release 1.40
5824!:mime image/vnd.dwg
58250	string	AC1.50	DWG AutoDesk AutoCAD Release 2.05
5826!:mime image/vnd.dwg
58270	string	AC2.10	DWG AutoDesk AutoCAD Release 2.10
5828!:mime image/vnd.dwg
58290	string	AC2.21	DWG AutoDesk AutoCAD Release 2.21
5830!:mime image/vnd.dwg
58310	string	AC2.22	DWG AutoDesk AutoCAD Release 2.22
5832!:mime image/vnd.dwg
58330	string	AC1001	DWG AutoDesk AutoCAD Release 2.22
5834!:mime image/vnd.dwg
58350	string	AC1002	DWG AutoDesk AutoCAD Release 2.50
5836!:mime image/vnd.dwg
58370	string	AC1003	DWG AutoDesk AutoCAD Release 2.60
5838!:mime image/vnd.dwg
58390	string	AC1004	DWG AutoDesk AutoCAD Release 9
5840!:mime image/vnd.dwg
58410	string	AC1006	DWG AutoDesk AutoCAD Release 10
5842!:mime image/vnd.dwg
58430	string	AC1009	DWG AutoDesk AutoCAD Release 11/12
5844!:mime image/vnd.dwg
5845# AutoCAD DWG versions R13/R14 (www.autodesk.com)
5846# Written December 01, 2003 by Lester Hightower
5847# Based on the DWG File Format Specifications at http://www.opendwg.org/
5848# AutoCad, from Nahuel Greco
5849# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com)
58500	string	AC1012	DWG AutoDesk AutoCAD Release 13
5851!:mime image/vnd.dwg
58520	string	AC1014	DWG AutoDesk AutoCAD Release 14
5853!:mime image/vnd.dwg
58540	string	AC1015	DWG AutoDesk AutoCAD 2000/2002
5855!:mime image/vnd.dwg
5856
5857# A new version of AutoCAD DWG
5858# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
5859# ICQ 358572321)
5860# From various sources like:
5861# https://autodesk.blogs.com/between_the_lines/autocad-release-history.html
58620	string	AC1018	DWG AutoDesk AutoCAD 2004/2005/2006
5863!:mime image/vnd.dwg
58640	string	AC1021	DWG AutoDesk AutoCAD 2007/2008/2009
5865!:mime image/vnd.dwg
58660	string	AC1024	DWG AutoDesk AutoCAD 2010/2011/2012
5867!:mime image/vnd.dwg
58680	string	AC1027	DWG AutoDesk AutoCAD 2013/2014
5869!:mime image/vnd.dwg
5870
5871# KOMPAS 2D drawing from ASCON
5872# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor
5873# gathered nor specification
5874# ASCON https://ascon.net/main/ in English,
5875#	https://ascon.ru/ main site in Russian
5876# Extension is CDW for drawing and FRW for fragment of drawing
5877# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
5878# ICQ 358572321, https://vkontakte.ru/id16076543)
5879# From:
5880# https://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292
5881# (in russian) and my experiments
58820	string	KF
5883>2	belong	0x4E00000C	Kompas drawing 12.0 SP1
5884>2	belong	0x4D00000C	Kompas drawing 12.0
5885>2	belong	0x3200000B	Kompas drawing 11.0 SP1
5886>2	belong	0x3100000B	Kompas drawing 11.0
5887>2	belong	0x2310000A	Kompas drawing 10.0 SP1
5888>2	belong	0x2110000A	Kompas drawing 10.0
5889>2	belong	0x08000009	Kompas drawing 9.0 SP1
5890>2	belong	0x05000009	Kompas drawing 9.0
5891>2	belong	0x33010008	Kompas drawing 8+
5892>2	belong	0x1A000008	Kompas drawing 8.0
5893>2	belong	0x2C010107	Kompas drawing 7+
5894>2	belong	0x05000007	Kompas drawing 7.0
5895>2	belong	0x32000006	Kompas drawing 6+
5896>2	belong	0x09000006	Kompas drawing 6.0
5897>2	belong	0x5C009005	Kompas drawing 5.11R03
5898>2	belong	0x54009005	Kompas drawing 5.11R02
5899>2	belong	0x51009005	Kompas drawing 5.11R01
5900>2	belong	0x22009005	Kompas drawing 5.10R03
5901>2	belong	0x22009005	Kompas drawing 5.10R02 mar
5902>2	belong	0x21009005	Kompas drawing 5.10R02 febr
5903>2	belong	0x19009005	Kompas drawing 5.10R01
5904>2	belong	0xF4008005	Kompas drawing 5.9R01.003
5905>2	belong	0x1C008005	Kompas drawing 5.9R01.002
5906>2	belong	0x11008005	Kompas drawing 5.8R01.003
5907
5908# CAD: file(1) magic for computer aided design files
5909# Phillip Griffith <phillip dot griffith at gmail dot com>
5910# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications.
5911#
59120	belong	0x08051700	Bentley/Intergraph MicroStation DGN cell library
59130	belong	0x0809fe02	Bentley/Intergraph MicroStation DGN vector CAD
59140	belong	0xc809fe02	Bentley/Intergraph MicroStation DGN vector CAD
59150	beshort	0x0809		Bentley/Intergraph MicroStation
5916>0x02	byte	0xfe
5917>>0x04	beshort	0x1800		CIT raster CAD
5918
5919# 3DS (3d Studio files)
59200	leshort		0x4d4d
5921>6	leshort		0x2
5922>>8	lelong		0xa
5923>>>16	leshort		0x3d3d	3D Studio model
5924!:mime	image/x-3ds
5925!:ext 3ds
5926
5927# MegaCAD 2D/3D drawing (.prt)
5928# https://megacad.de/
5929# From: Markus Heidelberg <markus.heidelberg@web.de>
59300	string	MegaCad23\0	MegaCAD 2D/3D drawing
5931
5932# Hoops CAD files
5933# https://docs.techsoft3d.com/visualize/3df/latest/build/general/hsf/\
5934# HSF_architecture.html
5935# Stephane Charette <stephane.charette@gmail.com>
59360	string	;;\020HSF\020V		OpenHSF (Hoops Stream Format)
5937>7	regex/9 V[.0-9]{4,5}\020	%s
5938!:ext hsf
5939
5940# AutoCAD Drawing Exchange Format
59410	regex		\^[\ \t]*0\r?\000$
5942>1	regex		\^[\ \t]*SECTION\r?$
5943>>2	regex		\^[\ \t]*2\r?$
5944>>>3	regex		\^[\ \t]*HEADER\r?$	AutoCAD Drawing Exchange Format
5945!:mime	application/x-dxf
5946!:ext	dxf
5947>>>>&1	search/8192	AC1006			\b, R10
5948>>>>&1	search/8192	AC1009			\b, R11/R12
5949>>>>&1	search/8192	AC1012			\b, R13
5950>>>>&1	search/8192	AC1014			\b, R14
5951>>>>&1	search/8192	AC1015			\b, version 2000
5952>>>>&1	search/8192	AC1018			\b, version 2004
5953>>>>&1	search/8192	AC1021			\b, version 2007
5954>>>>&1	search/8192	AC1024			\b, version 2010
5955
5956# The Sketchup 3D model format https://www.sketchup.com/
59570	string	\xff\xfe\xff\x0e\x53\x00\x6b\x00\x65\x00\x74\x00\x63\x00\x68\x00\x55\x00\x70\x00\x20\x00\x4d\x00\x6f\x00\x64\x00\x65\x00\x6c\x00	SketchUp Model
5958!:mime application/vnd.sketchup.skp
5959!:ext skp
5960
5961#------------------------------------------------------------------------------
5962# $File: cafebabe,v 1.24 2018/10/01 23:33:15 christos Exp $
5963# Cafe Babes unite!
5964#
5965# Since Java bytecode and Mach-O universal binaries have the same magic number,
5966# the test must be performed in the same "magic" sequence to get both right.
5967# The long at offset 4 in a Mach-O universal binary tells the number of
5968# architectures; the short at offset 4 in a Java bytecode file is the JVM minor
5969# version and the short at offset 6 is the JVM major version.  Since there are only
5970# only 18 labeled Mach-O architectures at current, and the first released
5971# Java class format was version 43.0, we can safely choose any number
5972# between 18 and 39 to test the number of architectures against
5973# (and use as a hack). Let's not use 18, because the Mach-O people
5974# might add another one or two as time goes by...
5975#
5976### JAVA START ###
59770	belong		0xcafebabe
5978>4	belong		>30		compiled Java class data,
5979!:mime	application/x-java-applet
5980>>6	beshort		x	        version %d.
5981>>4	beshort		x       	\b%d
5982# Which is which?
5983#>>4	belong		0x032d		(Java 1.0)
5984#>>4	belong		0x032d		(Java 1.1)
5985>>4	belong		0x002e		(Java 1.2)
5986>>4	belong		0x002f		(Java 1.3)
5987>>4	belong		0x0030		(Java 1.4)
5988>>4	belong		0x0031		(Java 1.5)
5989>>4	belong		0x0032		(Java 1.6)
5990>>4	belong		0x0033		(Java 1.7)
5991>>4	belong		0x0034		(Java 1.8)
5992
59930	belong		0xcafed00d	JAR compressed with pack200,
5994>5	byte		x		version %d.
5995>4	byte		x		\b%d
5996!:mime	application/x-java-pack200
5997
5998
59990	belong		0xcafed00d	JAR compressed with pack200,
6000>5	byte		x		version %d.
6001>4	byte		x		\b%d
6002!:mime	application/x-java-pack200
6003
6004### JAVA END ###
6005### MACH-O START ###
6006
60070	name		mach-o		\b [
6008>0	use		mach-o-cpu	\b
6009>(8.L)	indirect	x		\b:
6010>0	belong		x		\b]
6011
60120	belong		0xcafebabe
6013>4	belong		1		Mach-O universal binary with 1 architecture:
6014!:mime application/x-mach-binary
6015>>8	use		mach-o		\b
6016>4	belong		>1
6017>>4	belong		<20		Mach-O universal binary with %d architectures:
6018!:mime application/x-mach-binary
6019>>>8	use		mach-o		\b
6020>>4	belong		>1
6021>>>28	use		mach-o		\b
6022>>4	belong		>2
6023>>>48	use		mach-o		\b
6024>>4	belong		>3
6025>>>68	use		mach-o		\b
6026>>4	belong		>4
6027>>>88	use		mach-o		\b
6028>>4	belong		>5
6029>>>108	use		mach-o		\b
6030
6031### MACH-O END ###
6032
6033#------------------------------------------------------------------------------
6034# $File: cbor,v 1.1 2015/01/28 01:05:21 christos Exp $
6035# cbor:  file(1) magic for CBOR files as defined in RFC 7049
6036
60370	string	\xd9\xd9\xf7 Concise Binary Object Representation (CBOR) container
6038!:mime	application/cbor
6039>3	ubyte	<0x20	(positive integer)
6040>3	ubyte	<0x40
6041>>3	ubyte	>0x1f	(negative integer)
6042>3	ubyte	<0x60
6043>>3	ubyte	>0x3f	(byte string)
6044>3	ubyte	<0x80
6045>>3	ubyte	>0x5f	(text string)
6046>3	ubyte	<0xa0
6047>3	ubyte	>0x7f	(array)
6048>3	ubyte	<0xc0
6049>>3	ubyte	>0x9f	(map)
6050>3	ubyte	<0xe0
6051>>3	ubyte	>0xbf	(tagged)
6052>3	ubyte	>0xdf	(other)
6053
6054#------------------------------------------------------------------------------
6055# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $
6056# CDDB: file(1) magic for CDDB(tm) format CD text data files
6057#
6058# From <steve@gracenote.com>
6059#
6060# This is the /etc/magic entry to decode datafiles as used by
6061# CDDB-enabled CD player applications.
6062#
6063
60640	search/1/w	#\040xmcd	CDDB(tm) format CD text data
6065
6066#------------------------------------------------------------------------------
6067# $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $
6068# chord: file(1) magic for Chord music sheet typesetting utility input files
6069#
6070# From Philippe De Muyter <phdm@macqel.be>
6071# File format is actually free, but many distributed files begin with `{title'
6072#
60730	string		{title		Chord text file
6074
6075# Type:	PowerTab file format
6076# URL:	http://www.power-tab.net/
6077# From:	Jelmer Vernooij <jelmer@samba.org>
60780	string		ptab\003\000	Power-Tab v3 Tablature File
60790	string		ptab\004\000	Power-Tab v4 Tablature File
6080
6081#------------------------------------------------------------------------------
6082# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $
6083# cisco:  file(1) magic for cisco Systems routers
6084#
6085# Most cisco file-formats are covered by the generic elf code
6086#
6087# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
60880	belong&0xffffff00	0x85011400  cisco IOS microcode
6089>7	string		>\0		    for '%s'
60900	belong&0xffffff00	0x8501cb00  cisco IOS experimental microcode
6091>7	string		>\0		    for '%s'
6092
6093#------------------------------------------------------------------------------
6094# $File: citrus,v 1.4 2009/09/19 16:28:08 christos Exp $
6095# citrus locale declaration
6096#
6097
60980	string		RuneCT		Citrus locale declaration for LC_CTYPE
6099
6100#------------------------------------------------------------------------------
6101# $File: c-lang,v 1.27 2019/02/27 16:46:23 christos Exp $
6102# c-lang:  file(1) magic for C and related languages programs
6103#
6104# The strength is to beat standard HTML
6105
6106# BCPL
61070	search/8192	"libhdr"	BCPL source text
6108!:mime	text/x-bcpl
61090	search/8192	"LIBHDR"	BCPL source text
6110!:mime	text/x-bcpl
6111
6112# C
6113# Check for class if include is found, otherwise class is beaten by include becouse of lowered strength
61140	search/8192	#include
6115>0	regex	\^#include			C
6116>>0	regex	\^class[[:space:]]+
6117>>>&0	regex 	\\{[\.\*]\\}(;)?$			\b++
6118>>&0	clear	x				source text
6119!:strength + 13
6120!:mime	text/x-c
61210	search/8192	pragma
6122>0	regex	\^#[[:space:]]*pragma	C source text
6123!:mime	text/x-c
61240	search/8192	endif
6125>0	regex	\^#[[:space:]]*(if\|ifn)def
6126>>&0	regex	\^#[[:space:]]*endif$	C source text
6127!:mime	text/x-c
61280	search/8192	define
6129>0	regex	\^#[[:space:]]*(if\|ifn)def
6130>>&0	regex	\^#[[:space:]]*define	C source text
6131!:mime	text/x-c
61320	search/8192	char
6133>0	regex	\^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
6134!:mime	text/x-c
61350	search/8192	double
6136>0	regex	\^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
6137!:mime	text/x-c
61380	search/8192	extern
6139>0	regex	\^[[:space:]]*extern[[:space:]]+		C source text
6140!:mime	text/x-c
61410	search/8192	float
6142>0	regex	\^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
6143!:mime	text/x-c
61440	search/8192	struct
6145>0	regex	\^struct[[:space:]]+		C source text
6146!:mime	text/x-c
61470	search/8192	union
6148>0	regex	\^union[[:space:]]+		C source text
6149!:mime	text/x-c
61500	search/8192	main(
6151>&0 regex	\\)[[:space:]]*\\{		C source text
6152!:mime	text/x-c
6153
6154# C++
6155# The strength of these rules is increased so they beat the C rules above
61560	search/8192	namespace
6157>0	regex	\^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{	C++ source text
6158!:strength + 30
6159!:mime	text/x-c++
6160# using namespace [namespace] or using std::[lib]
61610	search/8192	using
6162>0	regex	\^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*;		C++ source text
6163!:strength + 30
6164!:mime	text/x-c++
61650	search/8192	template
6166>0	regex	\^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$	C++ source text
6167!:strength + 30
6168!:mime	text/x-c++
61690	search/8192	virtual
6170>0	regex	\^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$		C++ source text
6171!:strength + 30
6172!:mime	text/x-c++
6173# But class alone is reduced to avoid beating php (Jens Schleusener)
61740	search/8192	class
6175>0	regex	\^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$		C++ source text
6176!:strength + 13
6177!:mime	text/x-c++
61780	search/8192	public
6179>0	regex	\^[[:space:]]*public:		C++ source text
6180!:strength + 30
6181!:mime	text/x-c++
61820	search/8192	private
6183>0	regex	\^[[:space:]]*private:		C++ source text
6184!:strength + 30
6185!:mime	text/x-c++
61860	search/8192	protected
6187>0	regex	\^[[:space:]]*protected:		C++ source text
6188!:strength + 30
6189!:mime	text/x-c++
6190
6191# Objective-C
61920	search/8192	#import
6193>0	regex	\^#import			Objective-C source text
6194!:strength + 25
6195!:mime	text/x-objective-c
6196
6197# From: Mikhail Teterin <mi@aldan.algebra.com>
61980	string		cscope		cscope reference data
6199>7	string		x		version %.2s
6200# We skip the path here, because it is often long (so file will
6201# truncate it) and mostly redundant.
6202# The inverted index functionality was added some time between
6203# versions 11 and 15, so look for -q if version is above 14:
6204>7	string		>14
6205>>10	search/100	\ -q\ 		with inverted index
6206>10	search/100	\ -c\ 		text (non-compressed)
6207
6208#------------------------------------------------------------------------------
6209# $File: clarion,v 1.5 2014/04/30 21:41:02 christos Exp $
6210# clarion:  file(1) magic for # Clarion Personal/Professional Developer
6211# (v2 and above)
6212# From: Julien Blache <jb@jblache.org>
6213
6214# Database files
6215# signature
62160	leshort	0x3343	Clarion Developer (v2 and above) data file
6217# attributes
6218>2	leshort	&0x0001	\b, locked
6219>2	leshort	&0x0004	\b, encrypted
6220>2	leshort	&0x0008	\b, memo file exists
6221>2	leshort	&0x0010	\b, compressed
6222>2	leshort	&0x0040	\b, read only
6223# number of records
6224>5	lelong	x	\b, %d records
6225
6226# Memo files
62270	leshort	0x334d	Clarion Developer (v2 and above) memo data
6228
6229# Key/Index files
6230# No magic? :(
6231
6232# Help files
62330	leshort	0x49e0	Clarion Developer (v2 and above) help data
6234
6235#------------------------------------------------------------------------------
6236# $File: claris,v 1.8 2016/07/18 19:23:38 christos Exp $
6237# claris:  file(1) magic for claris
6238# "H. Nanosecond" <aldomel@ix.netcom.com>
6239# Claris Works a word processor, etc.
6240# Version 3.0
6241
6242# .pct claris works clip art files
6243#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
6244#*
6245#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
6246#null to byte 1000 octal
6247514	string	\377\377\377\377\000
6248>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	Claris clip art
6249514	string	\377\377\377\377\001
6250>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	Claris clip art
6251
6252# Claris works files
6253# .cwk
6254# Moved to Apple AppleWorks document
6255#0	string	\002\000\210\003\102\117\102\117\000\001\206 Claris works document
6256# .plt
62570	string	\020\341\000\000\010\010	Claris Works palette files .plt
6258
6259# .msp a dictionary file I am not sure about this I have only one .msp file
62600	string	\002\271\262\000\040\002\000\164	Claris works dictionary
6261
6262# .usp are user dictionary bits
6263# I am not sure about a magic header:
6264#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
6265#        soh   S   p   f   8   U   D  sp   ^   S  cr  nl   p   o   d   i
6266#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
6267#          a   t   r   i   s   t  sp   ^   S  cr  nl   d   i   v  sp   #
6268
6269# .mth Thesaurus
6270# starts with \0 but no magic header
6271
6272# .chy Hyphenation file
6273# I am not sure: 000 210 034 000 000
6274
6275# other claris files
6276#./windows/claris/useng.ndx: data
6277#./windows/claris/xtndtran.l32: data
6278#./windows/claris/xtndtran.lst: data
6279#./windows/claris/clworks.lbl: data
6280#./windows/claris/clworks.prf: data
6281#./windows/claris/userd.spl: data
6282
6283#------------------------------------------------------------------------------
6284# $File: clipper,v 1.8 2017/03/17 21:35:28 christos Exp $
6285# clipper:  file(1) magic for Intergraph (formerly Fairchild) Clipper.
6286#
6287# XXX - what byte order does the Clipper use?
6288#
6289# XXX - what's the "!" stuff:
6290#
6291# >18	short		!074000,000000	C1 R1
6292# >18	short		!074000,004000	C2 R1
6293# >18	short		!074000,010000	C3 R1
6294# >18	short		!074000,074000	TEST
6295#
6296# I shall assume it's ANDing the field with the first value and
6297# comparing it with the second, and rewrite it as:
6298#
6299# >18	short&074000	000000		C1 R1
6300# >18	short&074000	004000		C2 R1
6301# >18	short&074000	010000		C3 R1
6302# >18	short&074000	074000		TEST
6303#
6304# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
6305# sort, nor does SunOS 4.x, so either it's something Intergraph added
6306# in CLIX, or something AT&T added in SVR3.2 or later, or something
6307# somebody else thought was a good idea; it's not documented in the
6308# man page for this version of "magic", nor does it appear to be
6309# implemented (at least not after I blew off the bogus code to turn
6310# old-style "&"s into new-style "&"s, which just didn't work at all).
6311#
63120	short		0575		CLIPPER COFF executable (VAX #)
6313>20	short		0407		(impure)
6314>20	short		0410		(5.2 compatible)
6315>20	short		0411		(pure)
6316>20	short		0413		(demand paged)
6317>20	short		0443		(target shared library)
6318>12	long		>0		not stripped
6319>22	short		>0		- version %d
63200	short		0577		CLIPPER COFF executable
6321>18	short&074000	000000		C1 R1
6322>18	short&074000	004000		C2 R1
6323>18	short&074000	010000		C3 R1
6324>18	short&074000	074000		TEST
6325>20	short		0407		(impure)
6326>20	short		0410		(pure)
6327>20	short		0411		(separate I&D)
6328>20	short		0413		(paged)
6329>20	short		0443		(target shared library)
6330>12	long		>0		not stripped
6331>22	short		>0		- version %d
6332>48	long&01		01		alignment trap enabled
6333>52	byte		1		-Ctnc
6334>52	byte		2		-Ctsw
6335>52	byte		3		-Ctpw
6336>52	byte		4		-Ctcb
6337>53	byte		1		-Cdnc
6338>53	byte		2		-Cdsw
6339>53	byte		3		-Cdpw
6340>53	byte		4		-Cdcb
6341>54	byte		1		-Csnc
6342>54	byte		2		-Cssw
6343>54	byte		3		-Cspw
6344>54	byte		4		-Cscb
63454	string		pipe		CLIPPER instruction trace
63464	string		prof		CLIPPER instruction profile
6347#------------------------------------------------------------------------------
6348# file:  file(1) magic for Clojure
6349# URL:  https://clojure.org/
6350# From: Jason Felice <jason.m.felice@gmail.com>
6351
63520	string/w	#!\ /usr/bin/clj	Clojure script text executable
6353!:mime	text/x-clojure
63540	string/w	#!\ /usr/local/bin/clj	Clojure script text executable
6355!:mime	text/x-clojure
63560	string/w	#!\ /usr/bin/clojure	Clojure script text executable
6357!:mime	text/x-clojure
63580	string/w	#!\ /usr/local/bin/clojure	Clojure script text executable
6359!:mime	text/x-clojure
63600	string/W	#!/usr/bin/env\ clj	Clojure script text executable
6361!:mime	text/x-clojure
63620	string/W	#!/usr/bin/env\ clojure	Clojure script text executable
6363!:mime	text/x-clojure
63640	string/W	#!\ /usr/bin/env\ clj	Clojure script text executable
6365!:mime	text/x-clojure
63660	string/W	#!\ /usr/bin/env\ clojure	Clojure script text executable
6367!:mime	text/x-clojure
6368
63690	regex	\^\\\(ns[[:space:]]+[a-z]	Clojure module source text
6370!:mime	text/x-clojure
6371
63720	regex	\^\\\(ns[[:space:]]+\\\^\\{:	Clojure module source text
6373!:mime	text/x-clojure
6374
63750	regex	\^\\\(defn-?[[:space:]]	Clojure module source text
6376!:mime	text/x-clojure
6377
6378#------------------------------------------------------------------------------
6379# $File: coff,v 1.3 2018/08/01 10:34:03 christos Exp $
6380# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures
6381#
6382# COFF
6383#
6384# by Joerg Jenderek at Oct 2015
6385# https://en.wikipedia.org/wiki/COFF
6386# https://de.wikipedia.org/wiki/Common_Object_File_Format
6387# http://www.delorie.com/djgpp/doc/coff/filhdr.html
6388
6389# display name+variables+flags of Common Object Files Format (32bit)
6390# Maybe used also in adi,att3b,clipper,hitachi-sh,hp,ibm6000,intel,
6391# mips,motorola,msdos,osf1,sharc,varied.out,vax
63920	name				display-coff
6393# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
6394>18	uleshort&0x8E80	0
6395>>0	clear		x
6396# f_magic - magic number
6397# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel)
6398>>0	uleshort	0x014C		Intel 80386
6399# Hitachi SH big-endian COFF (./hitachi-sh)
6400>>0	uleshort	0x0500		Hitachi SH big-endian
6401# Hitachi SH little-endian COFF (./hitachi-sh)
6402>>0	uleshort	0x0550		Hitachi SH little-endian
6403# executable (RISC System/6000 V3.1) or obj module (./ibm6000)
6404#>>0	uleshort	0x01DF
6405# MS Windows COFF Intel Itanium, AMD64
6406# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=vs.85).aspx
6407>>0	uleshort	0x0200		Intel ia64
6408>>0	uleshort	0x8664		Intel amd64
6409# TODO for other COFFs
6410#>>0	uleshort	0xABCD		COFF_TEMPLATE
6411>>0	default		x
6412>>>0	uleshort	x		type 0x%04x
6413>>0	uleshort	x		COFF
6414# F_EXEC flag bit
6415>>18	leshort		^0x0002		object file
6416#!:mime	application/x-coff
6417#!:ext cof/o/obj/lib
6418>>18	leshort		&0x0002		executable
6419#!:mime	application/x-coffexec
6420# F_RELFLG flag bit,static object
6421>>18	leshort		&0x0001		\b, no relocation info
6422# F_LNNO flag bit
6423>>18	leshort		&0x0004		\b, no line number info
6424# F_LSYMS flag bit
6425>>18	leshort		&0x0008		\b, stripped
6426>>18	leshort		^0x0008		\b, not stripped
6427# flags in other COFF versions
6428#0x0010    F_FDPR_PROF
6429#0x0020    F_FDPR_OPTI
6430#0x0040    F_DSA
6431# F_AR32WR flag bit
6432#>>>18	leshort		&0x0100		\b, 32 bit little endian
6433#0x1000    F_DYNLOAD
6434#0x2000    F_SHROBJ
6435#0x4000    F_LOADONLY
6436# f_nscns - number of sections
6437>>2	uleshort	<2		\b, %d section
6438>>2	uleshort	>1		\b, %d sections
6439# f_timdat - file time & date stamp only for little endian
6440#>>4	date		x		\b, %s
6441# f_symptr - symbol table pointer, only for not stripped
6442>>8	ulelong		>0		\b, symbol offset=0x%x
6443# f_nsyms - number of symbols, only for not stripped
6444>>12	ulelong		>0		\b, %d symbols
6445# f_opthdr - optional header size
6446>>16	uleshort	>0		\b, optional header size %d
6447# at offset 20 can be optional header, extra bytes FILHSZ-20 because
6448# do not rely on sizeof(FILHDR) to give the correct size for header.
6449# or first section header
6450# additional variables for other COFF files
6451# >20	beshort		0407		(impure)
6452# >20	beshort		0410		(pure)
6453# >20	beshort		0413		(demand paged)
6454# >20	beshort		0421		(standalone)
6455# >22	leshort		>0		- version %d
6456# >168	string		.lowmem		Apple toolbox
6457
6458
6459#------------------------------------------------------------------------------
6460# $File: commands,v 1.60 2019/04/19 00:42:27 christos Exp $
6461# commands:  file(1) magic for various shells and interpreters
6462#
6463#0	string/w	:			shell archive or script for antique kernel text
64640	string/wt	#!\ /bin/sh		POSIX shell script text executable
6465!:mime	text/x-shellscript
64660	string/wb	#!\ /bin/sh		POSIX shell script executable (binary data)
6467!:mime	text/x-shellscript
6468
64690	string/wt	#!\ /bin/csh		C shell script text executable
6470!:mime	text/x-shellscript
6471
6472# korn shell magic, sent by George Wu, gwu@clyde.att.com
64730	string/wt	#!\ /bin/ksh		Korn shell script text executable
6474!:mime	text/x-shellscript
64750	string/wb	#!\ /bin/ksh		Korn shell script executable (binary data)
6476!:mime	text/x-shellscript
6477
64780	string/wt 	#!\ /bin/tcsh		Tenex C shell script text executable
6479!:mime	text/x-shellscript
64800	string/wt	#!\ /usr/bin/tcsh	Tenex C shell script text executable
6481!:mime	text/x-shellscript
64820	string/wt 	#!\ /usr/local/tcsh	Tenex C shell script text executable
6483!:mime	text/x-shellscript
64840	string/wt	#!\ /usr/local/bin/tcsh	Tenex C shell script text executable
6485!:mime	text/x-shellscript
6486
6487#
6488# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
64890	string/wt	#!\ /bin/zsh		Paul Falstad's zsh script text executable
6490!:mime	text/x-shellscript
64910	string/wt	#!\ /usr/bin/zsh	Paul Falstad's zsh script text executable
6492!:mime	text/x-shellscript
64930	string/wt	#!\ /usr/local/bin/zsh	Paul Falstad's zsh script text executable
6494!:mime	text/x-shellscript
64950	string/wt	#!\ /usr/local/bin/ash	Neil Brown's ash script text executable
6496!:mime	text/x-shellscript
64970	string/wt	#!\ /usr/local/bin/ae	Neil Brown's ae script text executable
6498!:mime	text/x-shellscript
64990	string/wt	#!\ /bin/nawk		new awk script text executable
6500!:mime	text/x-nawk
65010	string/wt	#!\ /usr/bin/nawk	new awk script text executable
6502!:mime	text/x-nawk
65030	string/wt	#!\ /usr/local/bin/nawk	new awk script text executable
6504!:mime	text/x-nawk
65050	string/wt	#!\ /bin/gawk		GNU awk script text executable
6506!:mime	text/x-gawk
65070	string/wt	#!\ /usr/bin/gawk	GNU awk script text executable
6508!:mime	text/x-gawk
65090	string/wt	#!\ /usr/local/bin/gawk	GNU awk script text executable
6510!:mime	text/x-gawk
6511#
65120	string/wt	#!\ /bin/awk		awk script text executable
6513!:mime	text/x-awk
65140	string/wt	#!\ /usr/bin/awk	awk script text executable
6515!:mime	text/x-awk
65160	regex/4096	=^[\040\t\f\r\n]{0,100}BEGIN[\040\t\f\r\n]{0,100}[{]	awk or perl script text
6517
6518# AT&T Bell Labs' Plan 9 shell
65190	string/wt	#!\ /bin/rc	Plan 9 rc shell script text executable
6520
6521# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
65220	string/wt	#!\ /bin/bash	Bourne-Again shell script text executable
6523!:mime	text/x-shellscript
65240	string/wb	#!\ /bin/bash	Bourne-Again shell script executable (binary data)
6525!:mime	text/x-shellscript
65260	string/wt	#!\ /usr/bin/bash	Bourne-Again shell script text executable
6527!:mime	text/x-shellscript
65280	string/wb	#!\ /usr/bin/bash	Bourne-Again shell script executable (binary data)
6529!:mime	text/x-shellscript
65300	string/wt	#!\ /usr/local/bash	Bourne-Again shell script text executable
6531!:mime	text/x-shellscript
65320	string/wb	#!\ /usr/local/bash	Bourne-Again shell script executable (binary data)
6533!:mime	text/x-shellscript
65340	string/wt	#!\ /usr/local/bin/bash	Bourne-Again shell script text executable
6535!:mime	text/x-shellscript
65360	string/wb	#!\ /usr/local/bin/bash	Bourne-Again shell script executable (binary data)
6537!:mime	text/x-shellscript
65380	string/wt	#!\ /usr/bin/env\ bash	Bourne-Again shell script text executable
6539!:mime	text/x-shellscript
6540
6541# PHP scripts
6542# Ulf Harnhammar <ulfh@update.uu.se>
65430	search/1/c	=<?php			PHP script text
6544!:strength + 30
6545!:mime	text/x-php
65460	search/1	=<?\n			PHP script text
6547!:mime	text/x-php
65480	search/1	=<?\r			PHP script text
6549!:mime	text/x-php
65500	search/1/w	#!\ /usr/local/bin/php	PHP script text executable
6551!:strength + 10
6552!:mime	text/x-php
65530	search/1/w	#!\ /usr/bin/php	PHP script text executable
6554!:strength + 10
6555!:mime	text/x-php
6556# Smarty compiled template, https://www.smarty.net/
6557# Elan Ruusamae <glen@delfi.ee>
65580	string	=<?php
6559>5	regex	[\ \n]
6560>>6	string	/*\ Smarty\ version		Smarty compiled template
6561>>>24	regex	[0-9.]+				\b, version %s
6562!:mime	text/x-php
6563
65640	string		Zend\x00		PHP script Zend Optimizer data
6565
65660	string/t	$!			DCL command file
6567
6568# Type: Pdmenu
6569# URL:  https://packages.debian.org/pdmenu
6570# From: Edward Betts <edward@debian.org>
65710	string		#!/usr/bin/pdmenu	Pdmenu configuration file text
6572
6573# From Danny Weldon
65740	string	\x0b\x13\x08\x00
6575>0x04   uleshort	<4      ksh byte-code version %d
6576
6577#----------------------------------------------------------------------------
6578# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $
6579# communication
6580
6581# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3.
6582# It is used for conformance testing of communication protocols.
6583# Added by W. Borgert <debacle@debian.org>.
65840	string		$Suite			TTCN Abstract Test Suite
6585>&1	string		$SuiteId
6586>>&1	string		>\n			%s
6587>&2	string		$SuiteId
6588>>&1	string		>\n			%s
6589>&3	string		$SuiteId
6590>>&1	string		>\n			%s
6591
6592# MSC (message sequence charts) are a formal description technique,
6593# described in ITU-T Z.120, mainly used for communication protocols.
6594# Added by W. Borgert <debacle@debian.org>.
65950	string		mscdocument	Message Sequence Chart (document)
65960	string		msc		Message Sequence Chart (chart)
65970	string		submsc		Message Sequence Chart (subchart)
6598#------------------------------------------------------------------------------
6599# $File: compress,v 1.75 2019/04/19 00:42:27 christos Exp $
6600# compress:  file(1) magic for pure-compression formats (no archives)
6601#
6602# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
6603#
6604# Formats for various forms of compressed data
6605# Formats for "compress" proper have been moved into "compress.c",
6606# because it tries to uncompress it to figure out what's inside.
6607
6608# standard unix compress
66090	string		\037\235	compress'd data
6610!:mime	application/x-compress
6611!:apple	LZIVZIVU
6612>2	byte&0x80	>0		block compressed
6613>2	byte&0x1f	x		%d bits
6614
6615# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
6616# URL: https://en.wikipedia.org/wiki/Gzip
6617# Reference: https://tools.ietf.org/html/rfc1952
6618# Update: Joerg Jenderek, Apr 2019
6619#   Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
6620#	* Original filename is only at offset 10 if "extra field" absent
6621#	* Produce shorter output - notably, only report compression methods
6622#         other than 8 ("deflate", the only method defined in RFC 1952).
6623# Note: find defs -iname '*.trid.xml' -exec grep -q '<Bytes>1F8B08' {} \; -ls
6624# TODO:
6625# FBR	Blueberry FlashBack screen Record	https://www.flashbackrecorder.com/
6626# KPR	KOffice/Calligra KPresenter		application/x-kpresenter
6627# KPT	KOffice/Calligra KPresenter template?	application/x-kpresenter
6628# SAV	Diggles Saved Game File			http://www.innonics.com
6629# SAV	FarCry (demo) saved game		http://www.farcry-thegame.com
6630# DAT	ZOAGZIP game data format		http://en.wikipedia.org/wiki/SD_Gundam_Capsule_Fighter
66310       string          \037\213
6632# to display gzip compressed (strength=100=2*50) before other (strength=50)?
6633#!:strength * 2
6634# no FNAME and FCOMMENT bit implies no file name/comment. That means only binary
6635>3	byte&0x18	=0
6636# For binary gzipped no ASCII text should occur
6637#	mcd-monu-cad.trid.xml
6638>>10	string		MCD			Monu-Cad Drawing, Component or Font
6639#>>36	string		Created\ with\ MONU-CAD
6640#!:mime	application/octet-stream
6641# http://fileformats.archiveteam.org/wiki/Monu-CAD
6642#	http://www.monucad.com/downloads/FullDemo-2005.EXE
6643#	/HANDS96.MCC	Component
6644#	/DEMO_DD01.MCD	Drawing
6645#	/MCALF020.FNT	Font
6646!:ext	mcc/mcd/fnt
6647# http://www.generalcadd.com
6648>>10	string		GXD			General CADD, Drawing or Component
6649#!:mime	application/octet-stream
6650#	/gxc/BUILDINGEDGE.gxc			Component
6651#	/gxd/HOCKETT-STPAUL-WRHSE.gxd		Drawing
6652#	/gxd/POWERLAND-MILL-ADD-11.gxd		Drawing		v9.1.06
6653!:ext	gxc/gxd
6654#>>>13	ubyte		0			\b, version 0
6655>>>13	string		09			\b, version 9
6656# other gzipped binary like gzipped tar, VirtualBox extension package,...
6657>>10	default		x		gzip compressed data
6658>>>0	use	gzip-info
6659# size of the original (uncompressed) input data modulo 2^32
6660>>>-4	ulelong		x		\b, original size modulo 2^32 %u
6661# gzipped TAR or VirtualBox extension package
6662!:mime	application/gzip
6663#!:mime	application/x-compressed-tar
6664#!:mime	application/x-virtualbox-vbox-extpack
6665# https://www.w3.org/TR/SVG/mimereg.html
6666#!:mime	image/image/svg+xml-compressed
6667#	zlib.3.gz
6668#	microcode-20180312.tgz
6669#	tpz same as tgz
6670#	lua-md5_1.2-1_i386_i486.ipk	https://en.wikipedia.org/wiki/Opkg
6671#	Oracle_VM_VirtualBox_Extension_Pack-5.0.12-104815.vbox-extpack
6672!:ext	gz/tgz/tpz/ipk/vbox-extpack/svgz
6673# FNAME/FCOMMENT bit implies file name/comment as iso-8859-1 text
6674>3	byte&0x18	>0		gzip compressed data
6675!:mime	application/gzip
6676# gzipped tar, gzipped Abiword document
6677#!:mime	application/x-compressed-tar
6678#!:mime	application/x-abiword-compressed
6679#!:mime	image/image/svg+xml-compressed
6680#	kleopatra_splashscreen.svgz	gzipped .svg
6681!:ext	gz/tgz/tpz/zabw/svgz
6682>>0	use	gzip-info
6683# size of the original (uncompressed) input data modulo 2^32
6684>>-4	ulelong		x		\b, original size modulo 2^32 %u
6685#	display information of gzip compressed files
66860	name				gzip-info
6687#>2	byte		x		THIS iS GZIP
6688>2	byte		<8		\b, reserved method
6689>2	byte		>8		\b, unknown method
6690>3	byte		&0x01		\b, ASCII
6691>3	byte		&0x02		\b, has CRC
6692>3	byte		&0x04		\b, extra field
6693>3	byte&0xC	=0x08
6694>>10	string		x		\b, was "%s"
6695>3	byte		&0x10		\b, has comment
6696>3	byte		&0x20		\b, encrypted
6697>4	ledate		>0		\b, last modified: %s
6698>8	byte		2		\b, max compression
6699>8	byte		4		\b, max speed
6700>9	byte		=0x00		\b, from FAT filesystem (MS-DOS, OS/2, NT)
6701>9	byte		=0x01		\b, from Amiga
6702>9	byte		=0x02		\b, from VMS
6703>9	byte		=0x03		\b, from Unix
6704>9	byte		=0x04		\b, from VM/CMS
6705>9	byte		=0x05		\b, from Atari
6706>9	byte		=0x06		\b, from HPFS filesystem (OS/2, NT)
6707>9	byte		=0x07		\b, from MacOS
6708>9	byte		=0x08		\b, from Z-System
6709>9	byte		=0x09		\b, from CP/M
6710>9	byte		=0x0A		\b, from TOPS/20
6711>9	byte		=0x0B		\b, from NTFS filesystem (NT)
6712>9	byte		=0x0C		\b, from QDOS
6713>9	byte		=0x0D		\b, from Acorn RISCOS
6714# size of the original (uncompressed) input data modulo 2^32
6715#>-4	ulelong		x		\b, original size modulo 2^32 %u
6716#ERROR: line 114: non zero offset 1048572 at level 1
6717
6718# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
67190	string		\037\036	packed data
6720!:mime	application/octet-stream
6721>2	belong		>1		\b, %d characters originally
6722>2	belong		=1		\b, %d character originally
6723#
6724# This magic number is byte-order-independent.
67250	short		0x1f1f		old packed data
6726!:mime	application/octet-stream
6727
6728# XXX - why *two* entries for "compacted data", one of which is
6729# byte-order independent, and one of which is byte-order dependent?
6730#
67310	short		0x1fff		compacted data
6732!:mime	application/octet-stream
6733# This string is valid for SunOS (BE) and a matching "short" is listed
6734# in the Ultrix (LE) magic file.
67350	string		\377\037	compacted data
6736!:mime	application/octet-stream
67370	short		0145405		huf output
6738!:mime	application/octet-stream
6739
6740# bzip2
67410	string		BZh		bzip2 compressed data
6742!:mime	application/x-bzip2
6743>3	byte		>47		\b, block size = %c00k
6744
6745# bzip	a block-sorting file compressor
6746#	by Julian Seward <sewardj@cs.man.ac.uk> and others
67470	string		BZ0		bzip compressed data
6748!:mime	application/x-bzip
6749>3	byte		>47		\b, block size = %c00k
6750
6751# lzip
67520	string		LZIP		lzip compressed data
6753!:mime application/x-lzip
6754>4	byte		x		\b, version: %d
6755
6756# squeeze and crunch
6757# Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
67580	beshort		0x76FF		squeezed data,
6759>4	string		x		original name %s
67600	beshort		0x76FE		crunched data,
6761>2	string		x		original name %s
67620	beshort		0x76FD		LZH compressed data,
6763>2	string		x		original name %s
6764
6765# Freeze
67660	string		\037\237	frozen file 2.1
67670	string		\037\236	frozen file 1.0 (or gzip 0.5)
6768
6769# SCO compress -H (LZH)
67700	string		\037\240	SCO compress -H (LZH) data
6771
6772# European GSM 06.10 is a provisional standard for full-rate speech
6773# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
6774# excitation/long term prediction) coding at 13 kbit/s.
6775#
6776# There's only a magic nibble (4 bits); that nibble repeats every 33
6777# bytes.  This isn't suited for use, but maybe we can use it someday.
6778#
6779# This will cause very short GSM files to be declared as data and
6780# mismatches to be declared as data too!
6781#0	byte&0xF0	0xd0		data
6782#>33	byte&0xF0	0xd0
6783#>66	byte&0xF0	0xd0
6784#>99	byte&0xF0	0xd0
6785#>132	byte&0xF0	0xd0		GSM 06.10 compressed audio
6786
6787# lzop from <markus.oberhumer@jk.uni-linz.ac.at>
67880	string		\x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a	lzop compressed data
6789>9	beshort		<0x0940
6790>>9	byte&0xf0	=0x00		- version 0.
6791>>9	beshort&0x0fff	x		\b%03x,
6792>>13	byte		1		LZO1X-1,
6793>>13	byte		2		LZO1X-1(15),
6794>>13	byte		3		LZO1X-999,
6795## >>22	bedate		>0		last modified: %s,
6796>>14	byte		=0x00		os: MS-DOS
6797>>14	byte		=0x01		os: Amiga
6798>>14	byte		=0x02		os: VMS
6799>>14	byte		=0x03		os: Unix
6800>>14	byte		=0x05		os: Atari
6801>>14	byte		=0x06		os: OS/2
6802>>14	byte		=0x07		os: MacOS
6803>>14	byte		=0x0A		os: Tops/20
6804>>14	byte		=0x0B		os: WinNT
6805>>14	byte		=0x0E		os: Win32
6806>9	beshort		>0x0939
6807>>9	byte&0xf0	=0x00		- version 0.
6808>>9	byte&0xf0	=0x10		- version 1.
6809>>9	byte&0xf0	=0x20		- version 2.
6810>>9	beshort&0x0fff	x		\b%03x,
6811>>15	byte		1		LZO1X-1,
6812>>15	byte		2		LZO1X-1(15),
6813>>15	byte		3		LZO1X-999,
6814## >>25	bedate		>0		last modified: %s,
6815>>17	byte		=0x00		os: MS-DOS
6816>>17	byte		=0x01		os: Amiga
6817>>17	byte		=0x02		os: VMS
6818>>17	byte		=0x03		os: Unix
6819>>17	byte		=0x05		os: Atari
6820>>17	byte		=0x06		os: OS/2
6821>>17	byte		=0x07		os: MacOS
6822>>17	byte		=0x0A		os: Tops/20
6823>>17	byte		=0x0B		os: WinNT
6824>>17	byte		=0x0E		os: Win32
6825
6826# 4.3BSD-Quasijarus Strong Compression
6827# https://minnie.tuhs.org/Quasijarus/compress.html
68280	string		\037\241	Quasijarus strong compressed data
6829
6830# From: Cory Dikkers <cdikkers@swbell.net>
68310	string		XPKF		Amiga xpkf.library compressed data
68320	string		PP11		Power Packer 1.1 compressed data
68330	string		PP20		Power Packer 2.0 compressed data,
6834>4	belong		0x09090909	fast compression
6835>4	belong		0x090A0A0A	mediocre compression
6836>4	belong		0x090A0B0B	good compression
6837>4	belong		0x090A0C0C	very good compression
6838>4	belong		0x090A0C0D	best compression
6839
6840# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
6841# https://www.7-zip.org or DOC/7zFormat.txt
6842#
68430	string		7z\274\257\047\034	7-zip archive data,
6844>6	byte		x			version %d
6845>7	byte		x			\b.%d
6846!:mime	application/x-7z-compressed
6847!:ext 7z/cb7
6848
6849# Type: LZMA
68500	lelong&0xffffff	=0x5d
6851>12	leshort		0xff			LZMA compressed data,
6852!:mime	application/x-lzma
6853>>5	lequad		=0xffffffffffffffff	streamed
6854>>5	lequad		!0xffffffffffffffff	non-streamed, size %lld
6855>12	leshort		0			LZMA compressed data,
6856>>5	lequad		=0xffffffffffffffff	streamed
6857>>5	lequad		!0xffffffffffffffff	non-streamed, size %lld
6858
6859# http://tukaani.org/xz/xz-file-format.txt
68600	ustring		\xFD7zXZ\x00		XZ compressed data
6861!:strength * 2
6862!:mime	application/x-xz
6863
6864# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt
68650	string		LRZI			LRZIP compressed data
6866>4	byte		x			- version %d
6867>5	byte		x			\b.%d
6868!:mime	application/x-lrzip
6869
6870# https://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html
68710	lelong		0x184d2204	LZ4 compressed data (v1.4+)
6872!:mime	application/x-lz4
6873# Added by osm0sis@xda-developers.com
68740 	lelong		0x184c2103	LZ4 compressed data (v1.0-v1.3)
6875!:mime	application/x-lz4
68760	lelong		0x184c2102	LZ4 compressed data (v0.1-v0.9)
6877!:mime	application/x-lz4
6878
6879# Zstandard/LZ4 skippable frames
6880# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
68810         lelong&0xFFFFFFF0  0x184D2A50
6882>(4.l+8)  indirect	x
6883
6884# Zstandard Dictionary ID subroutine
68850     name        zstd-dictionary-id
6886# Single Segment = True
6887>0    byte        &0x20   \b, Dictionary ID:
6888>>0   byte&0x03   0       None
6889>>0   byte&0x03   1
6890>>>1  byte        x       %u
6891>>0   byte&0x03   2
6892>>>1  leshort     x       %u
6893>>0   byte&0x03   3
6894>>>1  lelong      x       %u
6895# Single Segment = False
6896>0    byte        ^0x20   \b, Dictionary ID:
6897>>0   byte&0x03   0       None
6898>>0   byte&0x03   1
6899>>>2  byte        x       %u
6900>>0   byte&0x03   2
6901>>>2  leshort     x       %u
6902>>0   byte&0x03   3
6903>>>2  lelong      x       %u
6904
6905# Zstandard compressed data
6906# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
69070     lelong       0xFD2FB522  Zstandard compressed data (v0.2)
6908!:mime  application/x-zstd
69090     lelong       0xFD2FB523  Zstandard compressed data (v0.3)
6910!:mime  application/x-zstd
69110     lelong       0xFD2FB524  Zstandard compressed data (v0.4)
6912!:mime  application/x-zstd
69130     lelong       0xFD2FB525  Zstandard compressed data (v0.5)
6914!:mime  application/x-zstd
69150     lelong       0xFD2FB526  Zstandard compressed data (v0.6)
6916!:mime  application/x-zstd
69170     lelong       0xFD2FB527  Zstandard compressed data (v0.7)
6918!:mime  application/x-zstd
6919>4    use          zstd-dictionary-id
69200     lelong       0xFD2FB528  Zstandard compressed data (v0.8+)
6921!:mime  application/x-zstd
6922>4    use          zstd-dictionary-id
6923
6924# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
69250  lelong    0xEC30A437  Zstandard dictionary
6926!:mime  application/x-zstd-dictionary
6927>4 lelong    x           (ID %u)
6928
6929# AFX compressed files (Wolfram Kleff)
69302	string		-afx-		AFX compressed file data
6931
6932# Supplementary magic data for the file(1) command to support
6933# rzip(1).  The format is described in magic(5).
6934#
6935# Copyright (C) 2003 by Andrew Tridgell.  You may do whatever you want with
6936# this file.
6937#
69380	string		RZIP		rzip compressed data
6939>4	byte		x		- version %d
6940>5	byte		x		\b.%d
6941>6	belong		x		(%d bytes)
6942
69430	string		ArC\x01		FreeArc archive <http://freearc.org>
6944
6945# Type:	DACT compressed files
69460	long	0x444354C3	DACT compressed data
6947>4	byte	>-1		(version %i.
6948>5	byte	>-1		%i.
6949>6	byte	>-1		%i)
6950>7	long	>0		, original size: %i bytes
6951>15	long	>30		, block size: %i bytes
6952
6953# Valve Pack (VPK) files
69540	lelong	0x55aa1234	Valve Pak file
6955>0x4	lelong	x		\b, version %u
6956>0x8	lelong	x		\b, %u entries
6957
6958# Snappy framing format
6959# https://code.google.com/p/snappy/source/browse/trunk/framing_format.txt
69600	string	\377\006\0\0sNaPpY	snappy framed data
6961!:mime	application/x-snappy-framed
6962
6963# qpress, https://www.quicklz.com/
69640	string	qpress10	qpress compressed data
6965!:mime	application/x-qpress
6966
6967# Zlib https://www.ietf.org/rfc/rfc6713.txt
69680	string/b	x
6969>0	beshort%31	=0
6970>>0	byte&0xf	=8
6971>>>0	byte&0x80 	=0	zlib compressed data
6972!:mime	application/zlib
6973
6974# BWC compression
69750	string		BWC
6976>3	byte		0	BWC compressed data
6977
6978# UCL compression
69790	bequad		0x00e955434cff011a	UCL compressed data
6980
6981# Softlib archive
69820	string		SLIB	Softlib archive
6983>4	leshort		x	\b, version %d
6984>6	leshort		x	(contains %d files)
6985
6986# URL:  https://github.com/lzfse/lzfse/blob/master/src/lzfse_internal.h#L276
6987# From: Eric Hall <eric.hall@darkart.com>
69880	string	bvx-	lzfse encoded, no compression
69890	string	bvx1	lzfse compressed, uncompressed tables
69900	string	bvx2	lzfse compressed, compressed tables
69910	string	bvxn	lzfse encoded, lzvn compressed
6992
6993#------------------------------------------------------------------------------
6994# $File: console,v 1.45 2019/04/19 00:42:27 christos Exp $
6995# Console game magic
6996# Toby Deshane <hac@shoelace.digivill.net>
6997
6998# ines: file(1) magic for Marat's iNES Nintendo Entertainment System ROM dump format
6999# Updated by David Korth <gerbilsoft@gerbilsoft.com>
7000# References:
7001# - https://wiki.nesdev.com/w/index.php/INES
7002# - https://wiki.nesdev.com/w/index.php/NES_2.0
7003
7004# Common header for iNES, NES 2.0, and Wii U iNES.
70050	name		nes-rom-image-ines
7006>7	byte&0x0C	=0x8		(NES 2.0)
7007>4	byte		x		\b: %ux16k PRG
7008>5	byte		x		\b, %ux8k CHR
7009>6	byte&0x08	=0x8		[4-Scr]
7010>6	byte&0x09	=0x0		[H-mirror]
7011>6	byte&0x09	=0x1		[V-mirror]
7012>6	byte&0x02	=0x2		[SRAM]
7013>6	byte&0x04	=0x4		[Trainer]
7014>7	byte&0x03	=0x2		[PC10]
7015>7	byte&0x03	=0x1		[VS]
7016>>7	byte&0x0C	=0x8
7017# NES 2.0: VS PPU
7018>>>13	byte&0x0F	=0x0		\b, RP2C03B
7019>>>13	byte&0x0F	=0x1		\b, RP2C03G
7020>>>13	byte&0x0F	=0x2		\b, RP2C04-0001
7021>>>13	byte&0x0F	=0x3		\b, RP2C04-0002
7022>>>13	byte&0x0F	=0x4		\b, RP2C04-0003
7023>>>13	byte&0x0F	=0x5		\b, RP2C04-0004
7024>>>13	byte&0x0F	=0x6		\b, RP2C03B
7025>>>13	byte&0x0F	=0x7		\b, RP2C03C
7026>>>13	byte&0x0F	=0x8		\b, RP2C05-01
7027>>>13	byte&0x0F	=0x9		\b, RP2C05-02
7028>>>13	byte&0x0F	=0xA		\b, RP2C05-03
7029>>>13	byte&0x0F	=0xB		\b, RP2C05-04
7030>>>13	byte&0x0F	=0xC		\b, RP2C05-05
7031# TODO: VS protection hardware?
7032>>7	byte		x		\b]
7033# NES 2.0-specific flags.
7034>7	byte&0x0C	=0x8
7035>>12	byte&0x03	=0x0		[NTSC]
7036>>12	byte&0x03	=0x1		[PAL]
7037>>12	byte&0x02	=0x2		[NTSC+PAL]
7038
7039# Standard iNES ROM header.
70400	string		NES\x1A		NES ROM image (iNES)
7041!:mime	application/x-nes-rom
7042>0	use		nes-rom-image-ines
7043
7044# Wii U Virtual Console iNES ROM header.
70450	belong		0x4E455300	NES ROM image (Wii U Virtual Console)
7046!:mime	application/x-nes-rom
7047>0	use		nes-rom-image-ines
7048
7049#------------------------------------------------------------------------------
7050# unif: file(1) magic for UNIF-format Nintendo Entertainment System ROM images
7051# Reference: https://wiki.nesdev.com/w/index.php/UNIF
7052# From: David Korth <gerbilsoft@gerbilsoft.com>
7053#
7054# NOTE: The UNIF format uses chunks instead of a fixed header,
7055# so most of the data isn't easily parseable.
7056#
70570	string	UNIF
7058>4	lelong	<16	NES ROM image (UNIF v%d format)
7059!:mime	application/x-nes-rom
7060
7061#------------------------------------------------------------------------------
7062# fds: file(1) magic for Famciom Disk System disk images
7063# Reference: https://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format
7064# From: David Korth <gerbilsoft@gerbilsoft.com>
7065# TODO: Check "Disk info block" and get info from that in addition to the optional header.
7066
7067# Disk info block. (block 1)
70680	name	nintendo-fds-disk-info-block
7069>23	byte	!1		FMC-
7070>23	byte	1		FSC-
7071>16	string	x		\b%.3s
7072>15	byte	x		\b, mfr %02X
7073>20	byte	x		(Rev.%02u)
7074
7075# Headered version.
70760	string	FDS\x1A
7077>0x11	string	*NINTENDO-HVC*	Famicom Disk System disk image:
7078!:mime	application/x-fds-disk
7079>>0x10	use	nintendo-fds-disk-info-block
7080>4	byte	1	(%u side)
7081>4	byte	!1	(%u sides)
7082
7083# Unheadered version.
70841	string	*NINTENDO-HVC*	Famicom Disk System disk image:
7085!:mime	application/x-fds-disk
7086>0	use	nintendo-fds-disk-info-block
7087
7088#------------------------------------------------------------------------------
7089# tnes: file(1) magic for TNES-format Nintendo Entertainment System ROM images
7090# Used by Nintendo 3DS NES Virtual Console games.
7091# From: David Korth <gerbilsoft@gerbilsoft.com>
7092#
70930		string	TNES	NES ROM image (Nintendo 3DS Virtual Console)
7094!:mime		application/x-nes-rom
7095>4		byte	100	\b: FDS,
7096>>0x2010	use	nintendo-fds-disk-info-block
7097>4		byte	!100	\b: TNES mapper %u
7098>>5	byte		x		\b, %ux8k PRG
7099>>6	byte		x		\b, %ux8k CHR
7100>>7	byte&0x08	=1		[WRAM]
7101>>8	byte&0x09	=1		[H-mirror]
7102>>8	byte&0x09	=2		[V-mirror]
7103>>8	byte&0x02	=3		[VRAM]
7104
7105#------------------------------------------------------------------------------
7106# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
7107# Reference: http://gbdev.gg8.se/wiki/articles/The_Cartridge_Header
7108#
71090x104		bequad		0xCEED6666CC0D000B	Game Boy ROM image
7110# TODO: application/x-gameboy-color-rom for GBC.
7111!:mime		application/x-gameboy-rom
7112>0x143		byte&0x80	0x80
7113>>0x134		string		>\0			\b: "%.15s"
7114>0x143		byte&0x80	!0x80
7115>>0x134		string		>\0			\b: "%.16s"
7116>0x14c		byte		x			(Rev.%02u)
7117
7118# Machine type. (SGB, CGB, SGB+CGB)
7119>0x14b		byte		0x33
7120>>0x146		byte		0x03
7121>>>0x143	byte&0x80	0x80	[SGB+CGB]
7122>>>0x143	byte&0x80	!0x80	[SGB]
7123>>0x146		byte		!0x03
7124>>>0x143	byte&0xC0	0x80	[CGB]
7125>>>0x143	byte&0xC0	0xC0	[CGB ONLY]
7126>0x14b		byte		!0x33
7127
7128# Mapper.
7129>0x147 byte 0x00  [ROM ONLY]
7130>0x147 byte 0x01  [MBC1]
7131>0x147 byte 0x02  [MBC1+RAM]
7132>0x147 byte 0x03  [MBC1+RAM+BATT]
7133>0x147 byte 0x05  [MBC2]
7134>0x147 byte 0x06  [MBC2+BATTERY]
7135>0x147 byte 0x08  [ROM+RAM]
7136>0x147 byte 0x09  [ROM+RAM+BATTERY]
7137>0x147 byte 0x0B  [MMM01]
7138>0x147 byte 0x0C  [MMM01+SRAM]
7139>0x147 byte 0x0D  [MMM01+SRAM+BATT]
7140>0x147 byte 0x0F  [MBC3+TIMER+BATT]
7141>0x147 byte 0x10  [MBC3+TIMER+RAM+BATT]
7142>0x147 byte 0x11  [MBC3]
7143>0x147 byte 0x12  [MBC3+RAM]
7144>0x147 byte 0x13  [MBC3+RAM+BATT]
7145>0x147 byte 0x19  [MBC5]
7146>0x147 byte 0x1A  [MBC5+RAM]
7147>0x147 byte 0x1B  [MBC5+RAM+BATT]
7148>0x147 byte 0x1C  [MBC5+RUMBLE]
7149>0x147 byte 0x1D  [MBC5+RUMBLE+SRAM]
7150>0x147 byte 0x1E  [MBC5+RUMBLE+SRAM+BATT]
7151>0x147 byte 0xFC  [Pocket Camera]
7152>0x147 byte 0xFD  [Bandai TAMA5]
7153>0x147 byte 0xFE  [Hudson HuC-3]
7154>0x147 byte 0xFF  [Hudson HuC-1]
7155
7156# ROM size.
7157>0x148 byte 0     \b, ROM: 256Kbit
7158>0x148 byte 1     \b, ROM: 512Kbit
7159>0x148 byte 2     \b, ROM: 1Mbit
7160>0x148 byte 3     \b, ROM: 2Mbit
7161>0x148 byte 4     \b, ROM: 4Mbit
7162>0x148 byte 5     \b, ROM: 8Mbit
7163>0x148 byte 6     \b, ROM: 16Mbit
7164>0x148 byte 7     \b, ROM: 32Mbit
7165>0x148 byte 0x52  \b, ROM: 9Mbit
7166>0x148 byte 0x53  \b, ROM: 10Mbit
7167>0x148 byte 0x54  \b, ROM: 12Mbit
7168
7169# RAM size.
7170>0x149 byte 1     \b, RAM: 16Kbit
7171>0x149 byte 2     \b, RAM: 64Kbit
7172>0x149 byte 3     \b, RAM: 128Kbit
7173>0x149 byte 4     \b, RAM: 1Mbit
7174>0x149 byte 5     \b, RAM: 512Kbit
7175
7176#------------------------------------------------------------------------------
7177# genesis: file(1) magic for various Sega Mega Drive / Genesis ROM image and disc formats
7178# Updated by David Korth <gerbilsoft@gerbilsoft.com>
7179# References:
7180# - https://www.retrodev.com/segacd.html
7181# - http://devster.monkeeh.com/sega/32xguide1.txt
7182#
7183
7184# Common Sega Mega Drive header format.
7185# FIXME: Name fields are 48 bytes, but have spaces for padding instead of 00s.
71860		name	sega-mega-drive-header
7187# ROM title. (Use domestic if present; if not, use international.)
7188>0x120		byte	>0x20
7189>>0x120		string	>\0	\b: "%.16s"
7190>0x120		byte	<0x21
7191>>0x150		string	>\0	\b: "%.16s"
7192# Other information.
7193>0x180		string	>\0	(%.14s
7194>>0x110		string  >\0	\b, %.16s
7195>0x180		byte	0
7196>>0x110		string  >\0	(%.16s
7197>0		byte	x	\b)
7198
7199# TODO: Check for 32X CD?
7200# Sega Mega CD disc images: 2048-byte sectors.
72010	string	SEGADISCSYSTEM\ \ 	Sega Mega CD disc image
7202!:mime	application/x-sega-cd-rom
7203>0	use	sega-mega-drive-header
7204>0	byte	x			\b, 2048-byte sectors
72050	string	SEGABOOTDISC\ \ \ \ 	Sega Mega CD disc image
7206!:mime	application/x-sega-cd-rom
7207>0	use	sega-mega-drive-header
7208>0	byte	x			\b, 2048-byte sectors
7209# Sega Mega CD disc images: 2352-byte sectors.
72100x10	string	SEGADISCSYSTEM\ \ 	Sega Mega CD disc image
7211!:mime	application/x-sega-cd-rom
7212>0x10	use	sega-mega-drive-header
7213>0	byte	x			\b, 2352-byte sectors
72140x10	string	SEGABOOTDISC\ \ \ \ 	Sega Mega CD disc image
7215!:mime	application/x-sega-cd-rom
7216>0x10	use	sega-mega-drive-header
7217>0	byte	x			\b, 2352-byte sectors
7218
7219# Sega Mega Drive, 32X, Pico, and Mega CD Boot ROM images.
72200x100		string	SEGA
7221>0x3C0		bequad	0x4D41525320434845	Sega 32X ROM image
7222!:mime		application/x-genesis-32x-rom
7223>>0		use	sega-mega-drive-header
7224>0x3C0		bequad	!0x4D41525320434845
7225>>0x105		belong	0x5049434F	Sega Pico ROM image
7226!:mime		application/x-sega-pico-rom
7227>>>0		use	sega-mega-drive-header
7228>>0x105		belong	!0x5049434F
7229>>>0x180	beshort	0x4252		Sega Mega CD Boot ROM image
7230!:mime		application/x-genesis-rom
7231>>>0x180	beshort	!0x4252		Sega Mega Drive / Genesis ROM image
7232!:mime		application/x-genesis-rom
7233>>>0		use	sega-mega-drive-header
7234
7235#------------------------------------------------------------------------------
7236# genesis: file(1) magic for the Super MegaDrive ROM dump format
7237#
7238
7239# NOTE: Due to interleaving, we can't display anything
7240# other than the copier header information.
72410      name    sega-genesis-smd-header
7242>0     byte    x       %dx16k blocks
7243>2     byte    0       \b, last in series or standalone
7244>2     byte    >0      \b, split ROM
7245
7246# "Sega Genesis" header.
72470x280	string EAGN
7248>8	beshort	0xAABB	Sega Mega Drive / Genesis ROM image (SMD format):
7249!:mime	application/x-genesis-rom
7250>>0	use     sega-genesis-smd-header
7251
7252# "Sega Mega Drive" header.
72530x280	string EAMG
7254>8	beshort	0xAABB	Sega Mega Drive / Genesis ROM image (SMD format):
7255!:mime	application/x-genesis-rom
7256>>0	use     sega-genesis-smd-header
7257
7258#------------------------------------------------------------------------------
7259# smsgg:  file(1) magic for Sega Master System and Game Gear ROM images
7260# Detects all Game Gear and export Sega Master System ROM images,
7261# and some Japanese Sega Master System ROM images.
7262# From: David Korth <gerbilsoft@gerbilsoft.com>
7263# Reference: https://www.smspower.org/Development/ROMHeader
7264#
7265
7266# General SMS header rule.
7267# The SMS boot ROM checks the header at three locations.
72680	name	sega-master-system-rom-header
7269# Machine type.
7270>0x0F	byte&0xF0	0x30	Sega Master System
7271!:mime	application/x-sms-rom
7272>0x0F	byte&0xF0	0x40	Sega Master System
7273!:mime	application/x-sms-rom
7274>0x0F	byte&0xF0	0x50	Sega Game Gear
7275!:mime	application/x-gamegear-rom
7276>0x0F	byte&0xF0	0x60	Sega Game Gear
7277!:mime	application/x-gamegear-rom
7278>0x0F	byte&0xF0	0x70	Sega Game Gear
7279!:mime	application/x-gamegear-rom
7280>0x0F	default		x	Sega Master System / Game Gear
7281!:mime	application/x-sms-rom
7282>0	byte		x	ROM image:
7283# Product code.
7284>0x0E	byte&0xF0	0x10	1
7285>0x0E	byte&0xF0	0x20	2
7286>0x0E	byte&0xF0	0x30	3
7287>0x0E	byte&0xF0	0x40	4
7288>0x0E	byte&0xF0	0x50	5
7289>0x0E	byte&0xF0	0x60	6
7290>0x0E	byte&0xF0	0x70	7
7291>0x0E	byte&0xF0	0x80	8
7292>0x0E	byte&0xF0	0x90	9
7293>0x0E	byte&0xF0	0xA0	10
7294>0x0E	byte&0xF0	0xB0	11
7295>0x0E	byte&0xF0	0xC0	12
7296>0x0E	byte&0xF0	0xD0	13
7297>0x0E	byte&0xF0	0xE0	14
7298>0x0E	byte&0xF0	0xF0	15
7299# If the product code is 5 digits, we'll need to backspace here.
7300>0x0E	byte&0xF0	!0
7301>>0x0C	leshort		x	\b%04x
7302>0x0E	byte&0xF0	0
7303>>0x0C	leshort		x	%04x
7304# Revision.
7305>0x0E	byte&0x0F	x	(Rev.%02d)
7306# ROM size. (Used for the boot ROM checksum routine.)
7307>0x0F	byte&0x0F	0x0A	(8 KB)
7308>0x0F	byte&0x0F	0x0B	(16 KB)
7309>0x0F	byte&0x0F	0x0C	(32 KB)
7310>0x0F	byte&0x0F	0x0D	(48 KB)
7311>0x0F	byte&0x0F	0x0E	(64 KB)
7312>0x0F	byte&0x0F	0x0F	(128 KB)
7313>0x0F	byte&0x0F	0x00	(256 KB)
7314>0x0F	byte&0x0F	0x01	(512 KB)
7315>0x0F	byte&0x0F	0x02	(1 MB)
7316
7317# SMS/GG header locations.
73180x7FF0	string	TMR\ SEGA
7319>0x7FF0	use	sega-master-system-rom-header
73200x3FF0	string	TMR\ SEGA
7321>0x3FF0	use	sega-master-system-rom-header
73220x1FF0	string	TMR\ SEGA
7323>0x1FF0	use	sega-master-system-rom-header
7324
7325#------------------------------------------------------------------------------
7326# saturn: file(1) magic for the Sega Saturn disc image format.
7327# From: David Korth <gerbilsoft@gerbilsoft.com>
7328#
7329
7330# Common Sega Saturn disc header format.
7331# NOTE: Title is 112 bytes, but we're only showing 32 due to space padding.
7332# TODO: Release date, device information, region code, others?
73330	name	sega-saturn-disc-header
7334>0x60	string	>\0	\b: "%.32s"
7335>0x20	string	>\0	(%.10s
7336>>0x2A	string	>\0	\b, %.6s)
7337>>0x2A	byte	0	\b)
7338
7339# 2048-byte sector version.
73400	string	SEGA\ SEGASATURN\ 	Sega Saturn disc image
7341!:mime	application/x-saturn-rom
7342>0	use	sega-saturn-disc-header
7343>0	byte	x			(2048-byte sectors)
7344# 2352-byte sector version.
73450x10	string	SEGA\ SEGASATURN\ 	Sega Saturn disc image
7346!:mime	application/x-saturn-rom
7347>0x10	use	sega-saturn-disc-header
7348>0	byte	x			(2352-byte sectors)
7349
7350#------------------------------------------------------------------------------
7351# dreamcast: file(1) magic for the Sega Dreamcast disc image format.
7352# From: David Korth <gerbilsoft@gerbilsoft.com>
7353# Reference: https://mc.pp.se/dc/ip0000.bin.html
7354#
7355
7356# Common Sega Dreamcast disc header format.
7357# NOTE: Title is 128 bytes, but we're only showing 32 due to space padding.
7358# TODO: Release date, device information, region code, others?
73590	name	sega-dreamcast-disc-header
7360>0x80	string	>\0	\b: "%.32s"
7361>0x40	string	>\0	(%.10s
7362>>0x4A	string	>\0	\b, %.6s)
7363>>0x4A	byte	0	\b)
7364
7365# 2048-byte sector version.
73660	string	SEGA\ SEGAKATANA\ 	Sega Dreamcast disc image
7367!:mime	application/x-dc-rom
7368>0	use	sega-dreamcast-disc-header
7369>0	byte	x			(2048-byte sectors)
7370# 2352-byte sector version.
73710x10	string	SEGA\ SEGAKATANA\ 	Sega Dreamcast disc image
7372!:mime	application/x-dc-rom
7373>0x10	use	sega-dreamcast-disc-header
7374>0	byte	x			(2352-byte sectors)
7375
7376#------------------------------------------------------------------------------
7377# dreamcast:  file(1) uncertain magic for the Sega Dreamcast VMU image format
7378#
73790 belong 0x21068028   Sega Dreamcast VMU game image
73800 string LCDi         Dream Animator file
7381
7382#------------------------------------------------------------------------------
7383# z64: file(1) magic for the Z64 format N64 ROM dumps
7384# Reference: http://forum.pj64-emu.com/showthread.php?t=2239
7385# From: David Korth <gerbilsoft@gerbilsoft.com>
7386#
73870	bequad	0x803712400000000F	Nintendo 64 ROM image
7388!:mime	application/x-n64-rom
7389>0x20	string	>\0	\b: "%.20s"
7390>0x3B	string	x	(%.4s
7391>0x3F	byte	x	\b, Rev.%02u)
7392
7393#------------------------------------------------------------------------------
7394# v64: file(1) magic for the V64 format N64 ROM dumps
7395# Same as z64 format, but with 16-bit byteswapping.
7396#
73970	bequad	0x3780401200000F00	Nintendo 64 ROM image (V64)
7398!:mime	application/x-n64-rom
7399
7400#------------------------------------------------------------------------------
7401# n64-swap2: file(1) magic for the swap2 format N64 ROM dumps
7402# Same as z64 format, but with swapped 16-bit words.
7403#
74040	bequad	0x12408037000F0000	Nintendo 64 ROM image (wordswapped)
7405!:mime	application/x-n64-rom
7406
7407#------------------------------------------------------------------------------
7408# n64-le32: file(1) magic for the 32-bit byteswapped format N64 ROM dumps
7409# Same as z64 format, but with 32-bit byteswapping.
7410#
74110	bequad	0x401237800F000000	Nintendo 64 ROM image (32-bit byteswapped)
7412!:mime	application/x-n64-rom
7413
7414#------------------------------------------------------------------------------
7415# gba: file(1) magic for the Nintendo Game Boy Advance raw ROM format
7416# Reference: https://problemkaputt.de/gbatek.htm#gbacartridgeheader
7417#
7418# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com>
7419# Updated version from: David Korth <gerbilsoft@gerbilsoft.com>
7420#
74214	bequad	0x24FFAE51699AA221	Game Boy Advance ROM image
7422!:mime	application/x-gba-rom
7423>0xA0	string	>\0	\b: "%.12s"
7424>0xAC	string	x	(%.6s
7425>0xBC	byte	x	\b, Rev.%02u)
7426
7427#------------------------------------------------------------------------------
7428# nds: file(1) magic for the Nintendo DS(i) raw ROM format
7429# Reference: https://problemkaputt.de/gbatek.htm#dscartridgeheader
7430#
7431# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com>
7432# Updated version from: David Korth <gerbilsoft@gerbilsoft.com>
7433#
74340xC0	bequad	0x24FFAE51699AA221	Nintendo DS ROM image
7435!:mime	application/x-nintendo-ds-rom
7436>0x00	string	>\0		\b: "%.12s"
7437>0x0C	string	x		(%.6s
7438>0x1E	byte	x		\b, Rev.%02u)
7439>0x12	byte	2		(DSi enhanced)
7440>0x12	byte	3		(DSi only)
7441# Secure Area check.
7442>0x20		lelong	<0x4000		(homebrew)
7443>0x20		lelong	>0x3FFF
7444>>0x4000	lequad	0x0000000000000000	(multiboot)
7445>>0x4000	lequad	!0x0000000000000000
7446>>>0x4000	lequad	0xE7FFDEFFE7FFDEFF	(decrypted)
7447>>>0x4000	lequad	!0xE7FFDEFFE7FFDEFF
7448>>>>0x1000	lequad	0x0000000000000000	(encrypted)
7449>>>>0x1000	lequad	!0x0000000000000000	(mask ROM)
7450
7451#------------------------------------------------------------------------------
7452# nds_passme: file(1) magic for Nintendo DS ROM images for GBA cartridge boot.
7453# This is also used for loading .nds files using the MSET exploit on 3DS.
7454# Reference: https://github.com/devkitPro/ndstool/blob/master/source/ndscreate.cpp
74550xC0	bequad	0xC8604FE201708FE2	Nintendo DS Slot-2 ROM image (PassMe)
7456!:mime	application/x-nintendo-ds-rom
7457
7458#------------------------------------------------------------------------------
7459# ngp: file(1) magic for the Neo Geo Pocket (Color) raw ROM format.
7460# From: David Korth <gerbilsoft@gerbilsoft.com>
7461# References:
7462# - https://neogpc.googlecode.com/svn-history/r10/trunk/src/core/neogpc.cpp
7463# - https://www.devrs.com/ngp/files/ngpctech.txt
7464#
74650x0A	string	BY\ SNK\ CORPORATION	Neo Geo Pocket
7466!:mime	application/x-neo-geo-pocket-rom
7467>0x23	byte	0x10			Color
7468>0	byte	x			ROM image
7469>0x24	string	>\0			\b: "%.12s"
7470>0x1F	byte	0xFF			(debug mode enabled)
7471
7472#------------------------------------------------------------------------------
7473# msx: file(1) magic for MSX game cartridge dumps
7474# Too simple - MPi
7475#0 beshort 0x4142 MSX game cartridge dump
7476
7477#------------------------------------------------------------------------------
7478# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
74790	string	PS-X\ EXE	Sony Playstation executable
7480>16	lelong	x		PC=0x%08x,
7481>20	lelong	!0		GP=0x%08x,
7482>24	lelong	!0		.text=[0x%08x,
7483>>28	lelong	x		\b0x%x],
7484>32	lelong	!0		.data=[0x%08x,
7485>>36	lelong	x		\b0x%x],
7486>40	lelong	!0		.bss=[0x%08x,
7487>>44	lelong	x		\b0x%x],
7488>48	lelong	!0		Stack=0x%08x,
7489>48	lelong	=0		No Stack!,
7490>52	lelong	!0		StackSize=0x%x,
7491#>76	string	>\0		(%s)
7492#  Area:
7493>113	string	x		(%s)
7494
7495# CPE executables
74960	string	CPE		CPE executable
7497>3	byte	x		(version %d)
7498
7499#------------------------------------------------------------------------------
7500# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>)
75010	string	XBEH	Microsoft Xbox executable
7502# expect base address of 0x10000
7503>0x0104                 ulelong =0x10000
7504>>(0x0118.l-0x0FFF4)    lestring16 x       \b: "%.40s"
7505>>(0x0118.l-0x0FFF5)    byte     x         (%c
7506>>(0x0118.l-0x0FFF6)    byte     x         \b%c-
7507>>(0x0118.l-0x0FFF8)    uleshort x         \b%03u)
7508>>(0x0118.l-0x0FF60)    ulelong&0x80000007  0x80000007 \b, all regions
7509>>(0x0118.l-0x0FF60)    ulelong&0x80000007  !0x80000007
7510>>>(0x0118.l-0x0FF60)   ulelong >0           (regions:
7511>>>>(0x0118.l-0x0FF60)  ulelong &0x00000001  NA
7512>>>>(0x0118.l-0x0FF60)  ulelong &0x00000002  Japan
7513>>>>(0x0118.l-0x0FF60)  ulelong &0x00000004  Rest_of_World
7514>>>>(0x0118.l-0x0FF60)  ulelong &0x80000000  Manufacturer
7515>>>(0x0118.l-0x0FF60)   ulelong >0           \b)
7516# probabilistic checks whether signed or not
7517>0x0004 ulelong =0x0
7518>>&2    ulelong =0x0
7519>>>&2   ulelong =0x0  \b, not signed
7520>0x0004 ulelong >0
7521>>&2    ulelong >0
7522>>>&2   ulelong >0    \b, signed
7523
7524# --------------------------------
7525# Microsoft Xbox data file formats
75260       string          XIP0            XIP, Microsoft Xbox data
75270       string          XTF0            XTF, Microsoft Xbox data
7528
7529#------------------------------------------------------------------------------
7530# Microsoft Xbox 360 executables (.xex)
7531# From: David Korth <gerbilsoft@gerbilsoft.com>
7532# References:
7533# - https://free60project.github.io/wiki/XEX.html
7534# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h
7535
7536# Title ID (part of Execution ID section)
75370		name	xbox-360-xex-execution-id
7538>(0.L+0xC)	byte	x	(%c
7539>(0.L+0xD)	byte	x	\b%c
7540>(0.L+0xE)	beshort	x	\b-%04u)
7541
75420	string	XEX2	Microsoft Xbox 360 executable
7543>0x18	search/0x100	\x00\x04\x00\x06
7544>>&0	use	xbox-360-xex-execution-id
7545>(0x010.L+0x178)	ubelong	0xFFFFFFFF	\b, all regions
7546>(0x010.L+0x178)	ubelong	!0xFFFFFFFF
7547>>(0x010.L+0x178)	ubelong	>0		(regions:
7548>>(0x010.L+0x178)	ubelong&0x000000FF	0x000000FF	USA
7549>>(0x010.L+0x178)	ubelong&0x00000100	0x00000100	Japan
7550>>(0x010.L+0x178)	ubelong&0x00000200	0x00000200	China
7551>>(0x010.L+0x178)	ubelong&0x0000FC00	0x0000FC00	Asia
7552>>(0x010.L+0x178)	ubelong&0x00FF0000	0x00FF0000	PAL
7553>>(0x010.L+0x178)	ubelong&0x00FF0000	0x00FE0000	PAL [except AU/NZ]
7554>>(0x010.L+0x178)	ubelong&0x00FF0000	0x00010000	AU/NZ
7555>>(0x010.L+0x178)	ubelong&0xFF000000	0xFF000000	Other
7556>>(0x010.L+0x178)	ubelong	>0		\b)
7557
7558
7559
7560# Atari Lynx cartridge dump (EXE/BLL header)
7561# From: "Stefan A. Haubenthal" <polluks@web.de>
7562
7563# Double-check that the image type matches too, 0x8008 conflicts with
7564# 8 character OMF-86 object file headers.
75650	beshort		0x8008
7566>6	string		BS93		Lynx homebrew cartridge
7567!:mime	application/x-atari-lynx-rom
7568>>2	beshort		x		\b, RAM start $%04x
7569>6	string		LYNX		Lynx cartridge
7570!:mime	application/x-atari-lynx-rom
7571>>2	beshort		x		\b, RAM start $%04x
7572
7573# Opera file system that is used on the 3DO console
7574# From: Serge van den Boom <svdb@stack.nl>
75750	string		\x01ZZZZZ\x01	3DO "Opera" file system
7576
7577# From: Alex Myczko <alex@aiei.ch>
7578# From: David Pflug <david@pflug.email>
7579# is the offset 12 or the offset 16 correct?
7580# GBS (Game Boy Sound) magic
7581# ftp://ftp.modland.com/pub/documents/format_documentation/\
7582# Gameboy%20Sound%20System%20(.gbs).txt
75830	string		GBS		Nintendo Gameboy Music/Audio Data
7584#12	string		GameBoy\ Music\ Module	Nintendo Gameboy Music Module
7585>16	string		>\0	("%.32s" by
7586>48	string		>\0	%.32s, copyright
7587>80	string		>\0	%.32s),
7588>3	byte		x	version %u,
7589>4	byte		x	%u tracks
7590
7591# IPS Patch Files from: From: Thomas Klausner <tk@giga.or.at>
7592# see https://zerosoft.zophar.net/ips.php
75930	string	PATCH			IPS patch file
7594
7595# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at>
75960	string	PPF30			Playstation Patch File version 3.0
7597>5	byte	0			\b, PPF 1.0 patch
7598>5	byte	1			\b, PPF 2.0 patch
7599>5	byte	2			\b, PPF 3.0 patch
7600>>56	byte	0			\b, Imagetype BIN (any)
7601>>56	byte	1			\b, Imagetype GI (PrimoDVD)
7602>>57	byte	0			\b, Blockcheck disabled
7603>>57	byte	1			\b, Blockcheck enabled
7604>>58	byte	0			\b, Undo data not available
7605>>58	byte	1			\b, Undo data available
7606>6	string	x			\b, description: %s
7607
76080	string	PPF20			Playstation Patch File version 2.0
7609>5	byte	0			\b, PPF 1.0 patch
7610>5	byte	1			\b, PPF 2.0 patch
7611>>56	lelong	>0			\b, size of file to patch %d
7612>6	string	x			\b, description: %s
7613
76140	string	PPF10			Playstation Patch File version 1.0
7615>5	byte	0			\b, Simple Encoding
7616>6	string	x			\b, description: %s
7617
7618# From: Daniel Dawson <ddawson@icehouse.net>
7619# SNES9x .smv "movie" file format.
76200		string		SMV\x1A	SNES9x input recording
7621>0x4		lelong		x	\b, version %d
7622# version 4 is latest so far
7623>0x4		lelong		<5
7624>>0x8		ledate		x	\b, recorded at %s
7625>>0xc		lelong		>0	\b, rerecorded %d times
7626>>0x10		lelong		x	\b, %d frames long
7627>>0x14		byte		>0	\b, data for controller(s):
7628>>>0x14		byte		&0x1	#1
7629>>>0x14		byte		&0x2	#2
7630>>>0x14		byte		&0x4	#3
7631>>>0x14		byte		&0x8	#4
7632>>>0x14		byte		&0x10	#5
7633>>0x15		byte		^0x1	\b, begins from snapshot
7634>>0x15		byte		&0x1	\b, begins from reset
7635>>0x15		byte		^0x2	\b, NTSC standard
7636>>0x15		byte		&0x2	\b, PAL standard
7637>>0x17		byte		&0x1    \b, settings:
7638# WIP1Timing not used as of version 4
7639>>>0x4		lelong		<4
7640>>>>0x17	byte		&0x2	WIP1Timing
7641>>>0x17		byte		&0x4	Left+Right
7642>>>0x17		byte		&0x8	VolumeEnvX
7643>>>0x17		byte		&0x10	FakeMute
7644>>>0x17		byte		&0x20	SyncSound
7645# New flag as of version 4
7646>>>0x4		lelong		>3
7647>>>>0x17	byte		&0x80	NoCPUShutdown
7648>>0x4		lelong		<4
7649>>>0x18		lelong		>0x23
7650>>>>0x20	leshort		!0
7651>>>>>0x20	lestring16	x	\b, metadata: "%s"
7652>>0x4		lelong		>3
7653>>>0x24		byte		>0	\b, port 1:
7654>>>>0x24	byte		1	joypad
7655>>>>0x24	byte		2	mouse
7656>>>>0x24	byte		3	SuperScope
7657>>>>0x24	byte		4	Justifier
7658>>>>0x24	byte		5	multitap
7659>>>0x24		byte		>0	\b, port 2:
7660>>>>0x25	byte		1	joypad
7661>>>>0x25	byte		2	mouse
7662>>>>0x25	byte		3	SuperScope
7663>>>>0x25	byte		4	Justifier
7664>>>>0x25	byte		5	multitap
7665>>>0x18		lelong		>0x43
7666>>>>0x40	leshort		!0
7667>>>>>0x40	lestring16	x	\b, metadata: "%s"
7668>>0x17		byte		&0x40   \b, ROM:
7669>>>(0x18.l-26)	lelong		x	CRC32 0x%08x
7670>>>(0x18.l-23)	string		x	"%s"
7671
7672# Type: scummVM savegame files
7673# From: Sven Hartge <debian@ds9.argh.org>
76740	string	SCVM	ScummVM savegame
7675>12	string	>\0	"%s"
7676
7677#------------------------------------------------------------------------------
7678# Nintendo GameCube / Wii file formats.
7679#
7680
7681# Type: Nintendo GameCube/Wii common disc header data.
7682# From: David Korth <gerbilsoft@gerbilsoft.com>
7683# Reference: https://wiibrew.org/wiki/Wii_Disc
76840	name	nintendo-gcn-disc-common
7685>0x20	string	x	"%.64s"
7686>0x00	string	x	(%.6s
7687>0x06	byte	>0
7688>>0x06	byte	1	\b, Disc 2
7689>>0x06	byte	2	\b, Disc 3
7690>>0x06	byte	3	\b, Disc 4
7691>0x07	byte	x	\b, Rev.%02u)
7692>0x18	belong	0x5D1C9EA3
7693>>0x60	beshort	0x0101	\b (Unencrypted)
7694
7695# Type: Nintendo GameCube disc image
7696# From: David Korth <gerbilsoft@gerbilsoft.com>
7697# Reference: https://wiibrew.org/wiki/Wii_Disc
76980x1C	belong	0xC2339F3D	Nintendo GameCube disc image:
7699!:mime	application/x-gamecube-rom
7700>0	use	nintendo-gcn-disc-common
7701
7702# Type: Nintendo GameCube embedded disc image
7703# Commonly found on demo discs.
7704# From: David Korth <gerbilsoft@gerbilsoft.com>
7705# Reference: http://hitmen.c02.at/files/yagcd/yagcd/index.html#idx14.8
77060		belong	0xAE0F38A2
7707>0x0C		belong	0x00100000
7708>>(8.L+0x1C)	belong	0xC2339F3D	Nintendo GameCube embedded disc image:
7709!:mime	application/x-gamecube-rom
7710>>>(8.L)	use	nintendo-gcn-disc-common
7711
7712# Type: Nintendo Wii disc image
7713# From: David Korth <gerbilsoft@gerbilsoft.com>
7714# Reference: https://wiibrew.org/wiki/Wii_Disc
77150x18	belong	0x5D1C9EA3	Nintendo Wii disc image:
7716>0	use	nintendo-gcn-disc-common
7717
7718# Type: Nintendo Wii disc image (WBFS format)
7719# From: David Korth <gerbilsoft@gerbilsoft.com>
7720# Reference: https://wiibrew.org/wiki/Wii_Disc
77210	string	WBFS
7722>0x218	belong	0x5D1C9EA3	Nintendo Wii disc image (WBFS format):
7723!:mime	application/x-wii-rom
7724>>0x200	use	nintendo-gcn-disc-common
7725
7726# Type: Nintendo GameCube/Wii disc image (CISO format)
7727# NOTE: This is NOT the same as Compact ISO or PSP CISO,
7728# though it has the same magic number.
77290		string	CISO
7730# Other fields are used to determine what type of CISO this is:
7731# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
7732# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
7733# - None of the above: Compact ISO.
7734>4		lelong	0x200000
7735>>8		byte	1
7736>>>0x801C	belong	0xC2339F3D	Nintendo GameCube disc image (CISO format):
7737!:mime	application/x-wii-rom
7738>>>>0x8000	use	nintendo-gcn-disc-common
7739>>>0x8018	belong	0x5D1C9EA3	Nintendo Wii disc image (CISO format):
7740!:mime	application/x-wii-rom
7741>>>>0x8000	use	nintendo-gcn-disc-common
7742
7743# Type: Nintendo GameCube/Wii disc image (GCZ format)
7744# Due to zlib compression, we can't get the actual disc information.
77450	lelong	0xB10BC001
7746>4	lelong	0		Nintendo GameCube disc image (GCZ format)
7747!:mime	application/x-gamecube-rom
7748>4	lelong	1		Nintendo Wii disc image (GCZ format)
7749!:mime	application/x-wii-rom
7750>4	default	x		Nintendo GameCube/Wii disc image (GCZ format)
7751
7752# Type: Nintendo GameCube/Wii disc image (WDF format)
77530		string	WII\001DISC
7754>8		belong	1
7755# WDFv1
7756>>0x54		belong	0xC2339F3D	Nintendo GameCube disc image (WDFv1 format):
7757!:mime	application/x-gamecube-rom
7758>>>0x38		use	nintendo-gcn-disc-common
7759>>0x58		belong	0x5D1C9EA3	Nintendo Wii disc image (WDFv1 format):
7760!:mime	application/x-wii-rom
7761>>>0x38		use	nintendo-gcn-disc-common
7762>8		belong	2
7763# WDFv2
7764>>(12.L+0x1C)	belong	0xC2339F3D	Nintendo GameCube disc image (WDFv2 format):
7765!:mime	application/x-gamecube-rom
7766>>>(12.L)	use	nintendo-gcn-disc-common
7767>>(12.L+0x18)	belong	0x5D1C9EA3	Nintendo Wii disc image (WDFv2 format):
7768!:mime	application/x-wii-rom
7769>>>(12.L)	use	nintendo-gcn-disc-common
7770
7771# Type: Nintendo GameCube/Wii disc image (WIA format)
77720	string	WIA\001	Nintendo
7773>0x48	belong	1	GameCube
7774!:mime	application/x-gamecube-rom
7775>0x48	belong	2	Wii
7776!:mime	application/x-wii-rom
7777>0x48	default	x	GameCube/Wii
7778>0x48	belong	x	disc image (WIA format):
7779>>0x58	use	nintendo-gcn-disc-common
7780
7781# Type: Nintendo GameCube/Wii disc image (with SDK header)
7782# From: David Korth <gerbilsoft@gerbilsoft.com>
7783# Reference: https://wiibrew.org/wiki/Wii_Disc
77840		belong	0xFFFF0000
7785>0x18		belong	0x00000000
7786>>0x1C		belong	0x00000000
7787>>>0x8018	belong	0x5D1C9EA3	Nintendo Wii SDK disc image:
7788!:mime	application/x-wii-rom
7789>>>>0x8000	use	nintendo-gcn-disc-common
7790>>>0x801C	belong	0xC2339F3D	Nintendo GameCube SDK disc image:
7791!:mime	application/x-gamecube-rom
7792>>>>0x8000	use	nintendo-gcn-disc-common
7793
7794#------------------------------------------------------------------------------
7795# Nintendo 3DS file formats.
7796#
7797
7798# Type: Nintendo 3DS "NCSD" image. (game cards and eMMC)
7799# From: David Korth <gerbilsoft@gerbilsoft.com>
7800# Reference: https://www.3dbrew.org/wiki/NCSD
78010x100		string		NCSD
7802>0x118		lequad		0		Nintendo 3DS Game Card image
7803# NCCH header for partition 0. (game data)
7804>>0x1150	string		>\0	\b: "%.16s"
7805>>0x312		byte		x	(Rev.%02u)
7806>>0x118C	byte		2	(New3DS only)
7807>>0x18D		byte		0		(inner device)
7808>>0x18D		byte		1		(Card1)
7809>>0x18D		byte		2		(Card2)
7810>>0x18D		byte		3		(extended device)
7811>0x118		bequad		0x0102020202000000	Nintendo 3DS eMMC dump (Old3DS)
7812>0x118		bequad		0x0102020203000000	Nintendo 3DS eMMC dump (New3DS)
7813
7814# Nintendo 3DS version code.
7815# Reference: https://www.3dbrew.org/wiki/Titles
7816# Format: leshort containing three fields:
7817# - 6-bit: Major
7818# - 6-bit: Minor
7819# - 4-bit: Revision
7820# NOTE: Only supporting major/minor versions from 0-15 right now.
7821# NOTE: Should be prefixed with "v".
78220	name	nintendo-3ds-version-code
7823# Raw version.
7824>0	leshort	x	\b%u,
7825# Major version.
7826>0	leshort&0xFC00	0x0000	0
7827>0	leshort&0xFC00	0x0400	1
7828>0	leshort&0xFC00	0x0800	2
7829>0	leshort&0xFC00	0x0C00	3
7830>0	leshort&0xFC00	0x1000	4
7831>0	leshort&0xFC00	0x1400	5
7832>0	leshort&0xFC00	0x1800	6
7833>0	leshort&0xFC00	0x1C00	7
7834>0	leshort&0xFC00	0x2000	8
7835>0	leshort&0xFC00	0x2400	9
7836>0	leshort&0xFC00	0x2800	10
7837>0	leshort&0xFC00	0x2C00	11
7838>0	leshort&0xFC00	0x3000	12
7839>0	leshort&0xFC00	0x3400	13
7840>0	leshort&0xFC00	0x3800	14
7841>0	leshort&0xFC00	0x3C00	15
7842# Minor version.
7843>0	leshort&0x03F0	0x0000	\b.0
7844>0	leshort&0x03F0	0x0010	\b.1
7845>0	leshort&0x03F0	0x0020	\b.2
7846>0	leshort&0x03F0	0x0030	\b.3
7847>0	leshort&0x03F0	0x0040	\b.4
7848>0	leshort&0x03F0	0x0050	\b.5
7849>0	leshort&0x03F0	0x0060	\b.6
7850>0	leshort&0x03F0	0x0070	\b.7
7851>0	leshort&0x03F0	0x0080	\b.8
7852>0	leshort&0x03F0	0x0090	\b.9
7853>0	leshort&0x03F0	0x00A0	\b.10
7854>0	leshort&0x03F0	0x00B0	\b.11
7855>0	leshort&0x03F0	0x00C0	\b.12
7856>0	leshort&0x03F0	0x00D0	\b.13
7857>0	leshort&0x03F0	0x00E0	\b.14
7858>0	leshort&0x03F0	0x00F0	\b.15
7859# Revision.
7860>0	leshort&0x000F	x	\b.%u
7861
7862# Type: Nintendo 3DS "NCCH" container.
7863# https://www.3dbrew.org/wiki/NCCH
78640x100		string	NCCH	Nintendo 3DS
7865>0x18D		byte&2	0	File Archive (CFA)
7866>0x18D		byte&2	2	Executable Image (CXI)
7867>0x150		string	>\0	\b: "%.16s"
7868>0x18D		byte	0x05
7869>>0x10E		leshort	x	(Old3DS System Update v
7870>>0x10E		use	nintendo-3ds-version-code
7871>>0x10E		leshort	x	\b)
7872>0x18D		byte	0x15
7873>>0x10E		leshort	x	(New3DS System Update v
7874>>0x10E		use	nintendo-3ds-version-code
7875>>0x10E		leshort	x	\b)
7876>0x18D		byte	!0x05
7877>>0x18D		byte	!0x15
7878>>>0x112	byte	x	(v
7879>>>0x112	use	nintendo-3ds-version-code
7880>>>0x112	byte	x	\b)
7881>0x18C		byte	2	(New3DS only)
7882
7883# Type: Nintendo 3DS "SMDH" file. (application description)
7884# From: David Korth <gerbilsoft@gerbilsoft.com>
7885# Reference: https://3dbrew.org/wiki/SMDH
78860		string		SMDH		Nintendo 3DS SMDH file
7887>0x208		leshort		!0
7888>>0x208		lestring16	x		\b: "%.128s"
7889>>0x388		leshort		!0
7890>>>0x388	lestring16	x		by %.128s
7891>0x208		leshort		0
7892>>0x008		leshort		!0
7893>>>0x008	lestring16	x		\b: "%.128s"
7894>>>0x188	leshort		!0
7895>>>>0x188	lestring16	x		by %.128s
7896
7897# Type: Nintendo 3DS Homebrew Application.
7898# From: David Korth <gerbilsoft@gerbilsoft.com>
7899# Reference: https://3dbrew.org/wiki/3DSX_Format
79000	string	3DSX	Nintendo 3DS Homebrew Application (3DSX)
7901
7902#------------------------------------------------------------------------------
7903# a7800: file(1) magic for the Atari 7800 raw ROM format.
7904# From: David Korth <gerbilsoft@gerbilsoft.com>
7905# Reference: https://sites.google.com/site/atari7800wiki/a78-header
7906
79070	byte	>0
7908>0	byte	<3
7909>>1	string	ATARI7800	Atari 7800 ROM image
7910!:mime	application/x-atari-7800-rom
7911>>>0x11	string	>\0	\b: "%.32s"
7912# Display type.
7913>>>0x39	byte	0	(NTSC)
7914>>>0x39	byte	1	(PAL)
7915>>>0x36	byte&1	1	(POKEY)
7916
7917#------------------------------------------------------------------------------
7918# vectrex: file(1) magic for the GCE Vectrex raw ROM format.
7919# From: David Korth <gerbilsoft@gerbilsoft.com>
7920# Reference: http://www.playvectrex.com/designit/chrissalo/hello1.htm
7921#
7922# NOTE: Title is terminated with 0x80, not 0.
7923# The header is terminated with a 0, so that will
7924# terminate the title as well.
7925#
79260	string	g\ GCE	Vectrex ROM image
7927>0x11	string	>\0	\b: "%.16s"
7928
7929#------------------------------------------------------------------------------
7930# amiibo: file(1) magic for Nintendo amiibo NFC dumps.
7931# From: David Korth <gerbilsoft@gerbilsoft.com>
7932# Reference: https://www.3dbrew.org/wiki/Amiibo
79330x00		byte	0x04
7934>0x0A		beshort	0x0FE0
7935>>0x0C		belong	0xF110FFEE
7936>>>0x208	beshort	0x0100
7937>>>>0x020A	byte	0x0F
7938>>>>>0x020C	bequad	0x000000045F000000
7939>>>>>>0x5B	byte	0x02
7940>>>>>>>0x54	belong	x	Nintendo amiibo NFC dump - amiibo ID: %08X-
7941>>>>>>>0x58	belong	x	\b%08X
7942
7943#------------------------------------------------------------------------------
7944# $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $
7945# convex:  file(1) magic for Convex boxes
7946#
7947# Convexes are big-endian.
7948#
7949# /*\
7950#  * Below are the magic numbers and tests added for Convex.
7951#  * Added at beginning, because they are expected to be used most.
7952# \*/
79530	belong	0507	Convex old-style object
7954>16	belong	>0	not stripped
79550	belong	0513	Convex old-style demand paged executable
7956>16	belong	>0	not stripped
79570	belong	0515	Convex old-style pre-paged executable
7958>16	belong	>0	not stripped
79590	belong	0517	Convex old-style pre-paged, non-swapped executable
7960>16	belong	>0	not stripped
79610	belong	0x011257	Core file
7962#
7963# The following are a series of dump format magic numbers.  Each one
7964# corresponds to a drastically different dump format.  The first on is
7965# the original dump format on a 4.1 BSD or earlier file system.  The
7966# second marks the change between the 4.1 file system and the 4.2 file
7967# system.  The Third marks the changing of the block size from 1K
7968# to 2K to be compatible with an IDC file system.  The fourth indicates
7969# a dump that is dependent on Convex Storage Manager, because data in
7970# secondary storage is not physically contained within the dump.
7971# The restore program uses these number to determine how the data is
7972# to be extracted.
7973#
797424	belong	=60013	dump format, 4.2 or 4.3 BSD (IDC compatible)
797524	belong	=60014	dump format, Convex Storage Manager by-reference dump
7976#
7977# what follows is a bunch of bit-mask checks on the flags field of the opthdr.
7978# If there is no `=' sign, assume just checking for whether the bit is set?
7979#
79800	belong	0601		Convex SOFF
7981>88	belong&0x000f0000	=0x00000000	c1
7982>88	belong			&0x00010000	c2
7983>88	belong			&0x00020000	c2mp
7984>88	belong			&0x00040000	parallel
7985>88	belong			&0x00080000	intrinsic
7986>88	belong			&0x00000001	demand paged
7987>88	belong			&0x00000002	pre-paged
7988>88	belong			&0x00000004	non-swapped
7989>88	belong			&0x00000008	POSIX
7990#
7991>84	belong			&0x80000000	executable
7992>84	belong			&0x40000000	object
7993>84	belong&0x20000000	=0		not stripped
7994>84	belong&0x18000000	=0x00000000	native fpmode
7995>84	belong&0x18000000	=0x10000000	ieee fpmode
7996>84	belong&0x18000000	=0x18000000	undefined fpmode
7997#
79980	belong			0605		Convex SOFF core
7999#
80000	belong			0607		Convex SOFF checkpoint
8001>88	belong&0x000f0000	=0x00000000	c1
8002>88	belong			&0x00010000	c2
8003>88	belong			&0x00020000	c2mp
8004>88	belong			&0x00040000	parallel
8005>88	belong			&0x00080000	intrinsic
8006>88	belong			&0x00000008	POSIX
8007#
8008>84	belong&0x18000000	=0x00000000	native fpmode
8009>84	belong&0x18000000	=0x10000000	ieee fpmode
8010>84	belong&0x18000000	=0x18000000	undefined fpmode
8011
8012#------------------------------------------------------------------------------
8013# $File: coverage,v 1.2 2019/04/19 00:42:27 christos Exp $
8014# xoverage:  file(1) magic for test coverage data
8015
8016# File formats used to store test coverage data
8017# 2016-05-21, Georg Sauthoff <mail@georg.so>
8018
8019
8020# - GCC gcno - written by GCC at compile time when compiling with
8021# 	gcc -ftest-coverage
8022# - GCC gcda - written by a program that was compiled with
8023#	gcc -fprofile-arcs
8024# - LLVM raw profiles - generated by a program compiled with
8025#	clang -fprofile-instr-generate -fcoverage-mapping ...
8026# - LLVM indexed profiles - generated by
8027#	llvm-profdata
8028# - GCOV reports, i.e. the annotated source code
8029# - LCOV trace files, i.e. aggregated GCC profiles
8030#
8031# GCC coverage tracefiles
8032# .gcno file are created during compile time,
8033# while data collected during runtime is stored in .gcda files
8034# cf. gcov-io.h
8035# https://gcc.gnu.org/onlinedocs/gcc-5.3.0/gcc/Gcov-Data-Files.html
8036# Examples:
8037# Fedora 23/x86-64/gcc-5.3.1: 6f 6e 63 67 52 33 30 35
8038# Debian 8 PPC64/gcc-4.9.2  : 67 63 6e 6f 34 30 39 2a
80390	lelong	0x67636e6f	GCC gcno coverage (-ftest-coverage),
8040>&3	byte	x	version %c.
8041>&1	byte	x	\b%c
8042
8043# big endian
80440	belong	0x67636e6f	GCC gcno coverage (-ftest-coverage),
8045>&0	byte	x	version %c.
8046>&2	byte	x	\b%c (big-endian)
8047
8048# Examples:
8049# Fedora 23/x86-64/gcc-5.3.1: 61 64 63 67 52 33 30 35
8050# Debian 8 PPC64/gcc-4.9.2  : 67 63 64 61 34 30 39 2a
80510	lelong	0x67636461	GCC gcda coverage (-fprofile-arcs),
8052>&3	byte	x	version %c.
8053>&1	byte	x	\b%c
8054
8055# big endian
80560	belong	0x67636461	GCC gcda coverage (-fprofile-arcs),
8057>&0	byte	x	version %c.
8058>&2	byte	x	\b%c (big-endian)
8059
8060
8061# LCOV tracefiles
8062# cf. http://ltp.sourceforge.net/coverage/lcov/geninfo.1.php
80630	string	TN:
8064>&0	search/64	\nSF:/	LCOV coverage tracefile
8065
8066
8067# Coverage reports generated by gcov
8068# i.e. source code annoted with coverage information
80690	string	\x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Source:
8070>&0	search/128	\x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Graph:
8071>>&0	search/128	\x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Data:	GCOV coverage report
8072
8073
8074# LLVM coverage files
8075
8076# raw data after running a program compiled with:
8077# `clang -fprofile-instr-generate -fcoverage-mapping ...`
8078# default name: default.profraw
8079# magic is: \xFF lprofr \x81
8080# cf. https://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html
80810	lequad	0xff6c70726f667281	LLVM raw profile data,
8082>&0	byte	x	version %d
8083
8084# big endian
80850	bequad	0xff6c70726f667281	LLVM raw profile data,
8086>&7	byte	x	version %d (big-endian)
8087
8088
8089# LLVM indexed instruction profile (as generated by llvm-profdata)
8090# magic is: reverse(\xFF lprofi \x81)
8091# cf. https://llvm.org/docs/CoverageMappingFormat.html
8092# https://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html
8093# https://llvm.org/docs/CommandGuide/llvm-cov.html
8094# https://llvm.org/docs/CommandGuide/llvm-profdata.html
80950	lequad	0x8169666f72706cff	LLVM indexed profile data,
8096>&0	byte	x	version %d
8097
8098# big endian
80990	bequad	0x8169666f72706cff	LLVM indexed profile data,
8100>&7	byte	x	version %d (big-endian)
8101
8102
8103#------------------------------------------------------------------------------
8104# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $
8105# cracklib:  file (1) magic for cracklib v2.7
8106
81070	lelong	0x70775631	Cracklib password index, little endian
8108>4	long	>0		(%i words)
8109>4	long	0		("64-bit")
8110>>8	long	>-1		(%i words)
81110	belong	0x70775631	Cracklib password index, big endian
8112>4	belong	>-1		(%i words)
8113# really bellong 0x0000000070775631
81140	search/1	\0\0\0\0pwV1	Cracklib password index, big endian ("64-bit")
8115>12	belong	>0		(%i words)
8116
8117# ----------------------------------------------------------------------------
8118# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $
8119# ctags:  file (1) magic for Exuberant Ctags files
8120# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de>
81210	search/1	=!_TAG	Exuberant Ctags tag file text
8122
8123#--------------------------------------------------------------
8124# ctf:  file(1) magic for CTF (Common Trace Format) trace files
8125#
8126# Specs. available here: <https://www.efficios.com/ctf>
8127#--------------------------------------------------------------
8128
8129# CTF trace data
81300	lelong	0xc1fc1fc1	Common Trace Format (CTF) trace data (LE)
81310	belong	0xc1fc1fc1	Common Trace Format (CTF) trace data (BE)
8132
8133# CTF metadata (packetized)
81340	lelong	0x75d11d57	Common Trace Format (CTF) packetized metadata (LE)
8135>35	byte	x		\b, v%d
8136>36	byte	x		\b.%d
81370	belong	0x75d11d57	Common Trace Format (CTF) packetized metadata (BE)
8138>35	byte	x		\b, v%d
8139>36	byte	x		\b.%d
8140
8141# CTF metadata (plain text)
81420	string	/*\x20CTF\x20   Common Trace Format (CTF) plain text metadata
8143!:strength + 5			# this is to make sure we beat C
8144>&0	regex	[0-9]+\.[0-9]+	\b, v%s
8145
8146#------------------------------------------------------------------------------
8147# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $
8148# file(1) magic(5) data for cubemaps  Martin Erik Werner <martinerikwerner@gmail.com>
8149#
81500	string	ACMP	Map file for the AssaultCube FPS game
81510	string	CUBE	Map file for cube and cube2 engine games
81520	string	MAPZ)	Map file for the Blood Frontier/Red Eclipse FPS games
8153
8154#------------------------------------------------------------------------------
8155# $File: cups,v 1.6 2019/04/19 00:42:27 christos Exp $
8156# Cups: file(1) magic for the cups raster file format
8157# From: Laurent Martelli <martellilaurent@gmail.com>
8158# https://www.cups.org/documentation.php/spec-raster.html
8159#
8160
81610	name		cups-le
8162>280	lelong		x		\b, %d
8163>284	lelong		x		\bx%d dpi
8164>376	lelong		x		\b, %dx
8165>380	lelong		x		\b%d pixels
8166>388	lelong		x		%d bits/color
8167>392	lelong		x		%d bits/pixel
8168>400	lelong		0		ColorOrder=Chunky
8169>400	lelong		1		ColorOrder=Banded
8170>400	lelong		2		ColorOrder=Planar
8171>404	lelong		0		ColorSpace=gray
8172>404	lelong		1		ColorSpace=RGB
8173>404	lelong		2		ColorSpace=RGBA
8174>404	lelong		3		ColorSpace=black
8175>404	lelong		4		ColorSpace=CMY
8176>404	lelong		5		ColorSpace=YMC
8177>404	lelong		6		ColorSpace=CMYK
8178>404	lelong		7		ColorSpace=YMCK
8179>404	lelong		8		ColorSpace=KCMY
8180>404	lelong		9		ColorSpace=KCMYcm
8181>404	lelong		10		ColorSpace=GMCK
8182>404	lelong		11		ColorSpace=GMCS
8183>404	lelong		12		ColorSpace=WHITE
8184>404	lelong		13		ColorSpace=GOLD
8185>404	lelong		14		ColorSpace=SILVER
8186>404	lelong		15		ColorSpace=CIE XYZ
8187>404	lelong		16		ColorSpace=CIE Lab
8188>404	lelong		17		ColorSpace=RGBW
8189>404	lelong		18		ColorSpace=sGray
8190>404	lelong		19		ColorSpace=sRGB
8191>404	lelong		20		ColorSpace=AdobeRGB
8192
8193# Cups Raster image format, Big Endian
81940	string		RaS
8195>3	string		t		Cups Raster version 1, Big Endian
8196>3	string		2		Cups Raster version 2, Big Endian
8197>3	string		3		Cups Raster version 3, Big Endian
8198!:mime	application/vnd.cups-raster
8199>0	use		\^cups-le
8200
8201
8202# Cups Raster image format, Little Endian
82031	string		SaR
8204>0	string		t		Cups Raster version 1, Little Endian
8205>0	string		2		Cups Raster version 2, Little Endian
8206>0	string		3		Cups Raster version 3, Little Endian
8207!:mime	application/vnd.cups-raster
8208>0	use		cups-le
8209
8210#------------------------------------------------------------------------------
8211# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $
8212# dact:  file(1) magic for DACT compressed files
8213#
82140	long		0x444354C3	DACT compressed data
8215>4	byte		>-1		(version %i.
8216>5	byte		>-1		$BS%i.
8217>6	byte		>-1		$BS%i)
8218>7	long		>0		$BS, original size: %i bytes
8219>15	long		>30		$BS, block size: %i bytes
8220
8221#------------------------------------------------------------------------------
8222# $File: database,v 1.55 2019/04/19 00:42:27 christos Exp $
8223# database:  file(1) magic for various databases
8224#
8225# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
8226#
8227#
8228# GDBM magic numbers
8229#  Will be maintained as part of the GDBM distribution in the future.
8230#  <downsj@teeny.org>
82310	belong	0x13579acd	GNU dbm 1.x or ndbm database, big endian, 32-bit
8232!:mime	application/x-gdbm
82330	belong	0x13579ace	GNU dbm 1.x or ndbm database, big endian, old
8234!:mime	application/x-gdbm
82350	belong	0x13579acf	GNU dbm 1.x or ndbm database, big endian, 64-bit
8236!:mime	application/x-gdbm
82370	lelong	0x13579acd	GNU dbm 1.x or ndbm database, little endian, 32-bit
8238!:mime	application/x-gdbm
82390	lelong	0x13579ace	GNU dbm 1.x or ndbm database, little endian, old
8240!:mime	application/x-gdbm
82410	lelong	0x13579acf	GNU dbm 1.x or ndbm database, little endian, 64-bit
8242!:mime	application/x-gdbm
82430	string	GDBM		GNU dbm 2.x database
8244!:mime	application/x-gdbm
8245#
8246# Berkeley DB
8247#
8248# Ian Darwin's file /etc/magic files: big/little-endian version.
8249#
8250# Hash 1.85/1.86 databases store metadata in network byte order.
8251# Btree 1.85/1.86 databases store the metadata in host byte order.
8252# Hash and Btree 2.X and later databases store the metadata in host byte order.
8253
82540	long	0x00061561	Berkeley DB
8255!:mime	application/x-dbm
8256>8	belong	4321
8257>>4	belong	>2		1.86
8258>>4	belong	<3		1.85
8259>>4	belong	>0		(Hash, version %d, native byte-order)
8260>8	belong	1234
8261>>4	belong	>2		1.86
8262>>4	belong	<3		1.85
8263>>4	belong	>0		(Hash, version %d, little-endian)
8264
82650	belong	0x00061561	Berkeley DB
8266>8	belong	4321
8267>>4	belong	>2		1.86
8268>>4	belong	<3		1.85
8269>>4	belong	>0		(Hash, version %d, big-endian)
8270>8	belong	1234
8271>>4	belong	>2		1.86
8272>>4	belong	<3		1.85
8273>>4	belong	>0		(Hash, version %d, native byte-order)
8274
82750	long	0x00053162	Berkeley DB 1.85/1.86
8276>4	long	>0		(Btree, version %d, native byte-order)
82770	belong	0x00053162	Berkeley DB 1.85/1.86
8278>4	belong	>0		(Btree, version %d, big-endian)
82790	lelong	0x00053162	Berkeley DB 1.85/1.86
8280>4	lelong	>0		(Btree, version %d, little-endian)
8281
828212	long	0x00061561	Berkeley DB
8283>16	long	>0		(Hash, version %d, native byte-order)
828412	belong	0x00061561	Berkeley DB
8285>16	belong	>0		(Hash, version %d, big-endian)
828612	lelong	0x00061561	Berkeley DB
8287>16	lelong	>0		(Hash, version %d, little-endian)
8288
828912	long	0x00053162	Berkeley DB
8290>16	long	>0		(Btree, version %d, native byte-order)
829112	belong	0x00053162	Berkeley DB
8292>16	belong	>0		(Btree, version %d, big-endian)
829312	lelong	0x00053162	Berkeley DB
8294>16	lelong	>0		(Btree, version %d, little-endian)
8295
829612	long	0x00042253	Berkeley DB
8297>16	long	>0		(Queue, version %d, native byte-order)
829812	belong	0x00042253	Berkeley DB
8299>16	belong	>0		(Queue, version %d, big-endian)
830012	lelong	0x00042253	Berkeley DB
8301>16	lelong	>0		(Queue, version %d, little-endian)
8302
8303# From Max Bowsher.
830412	long	0x00040988	Berkeley DB
8305>16	long	>0		(Log, version %d, native byte-order)
830612	belong	0x00040988	Berkeley DB
8307>16	belong	>0		(Log, version %d, big-endian)
830812	lelong	0x00040988	Berkeley DB
8309>16	lelong	>0		(Log, version %d, little-endian)
8310
8311#
8312#
8313# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
83140	string/b	RRD\0		RRDTool DB
8315>4	string/b	x		version %s
8316
8317>>10	short		!0		16bit aligned
8318>>>10	bedouble	8.642135e+130	big-endian
8319>>>>18	short		x		32bit long (m68k)
8320
8321>>10	short		0
8322>>>12	long		!0		32bit aligned
8323>>>>12	bedouble	8.642135e+130	big-endian
8324>>>>>20 long		0		64bit long
8325>>>>>20 long		!0		32bit long
8326>>>>12	ledouble	8.642135e+130	little-endian
8327>>>>>24 long		0		64bit long
8328>>>>>24 long		!0		32bit long (i386)
8329>>>>12	string		\x43\x2b\x1f\x5b\x2f\x25\xc0\xc7	middle-endian
8330>>>>>24 short		!0		32bit long (arm)
8331
8332>>8	quad		0		64bit aligned
8333>>>16	bedouble	8.642135e+130	big-endian
8334>>>>24	long		0		64bit long (s390x)
8335>>>>24	long		!0		32bit long (hppa/mips/ppc/s390/SPARC)
8336>>>16	ledouble	8.642135e+130	little-endian
8337>>>>28	long		0		64bit long (alpha/amd64/ia64)
8338>>>>28	long		!0		32bit long (armel/mipsel)
8339
8340#----------------------------------------------------------------------
8341# ROOT: file(1) magic for ROOT databases
8342#
83430       string  root\0  ROOT file
8344>4      belong  x       Version %d
8345>33     belong  x       (Compression: %d)
8346
8347# XXX: Weak magic.
8348# Alex Ott <ott@jet.msk.su>
8349## Paradox file formats
8350#2	  leshort	0x0800	Paradox
8351#>0x39	  byte		3	v. 3.0
8352#>0x39	  byte		4	v. 3.5
8353#>0x39	  byte		9	v. 4.x
8354#>0x39	  byte		10	v. 5.x
8355#>0x39	  byte		11	v. 5.x
8356#>0x39	  byte		12	v. 7.x
8357#>>0x04	  byte		0	indexed .DB data file
8358#>>0x04	  byte		1	primary index .PX file
8359#>>0x04	  byte		2	non-indexed .DB data file
8360#>>0x04	  byte		3	non-incrementing secondary index .Xnn file
8361#>>0x04	  byte		4	secondary index .Ynn file
8362#>>0x04	  byte		5	incrementing secondary index .Xnn file
8363#>>0x04	  byte		6	non-incrementing secondary index .XGn file
8364#>>0x04	  byte		7	secondary index .YGn file
8365#>>>0x04	  byte		8	incrementing secondary index .XGn file
8366
8367## XBase database files
8368# updated by Joerg Jenderek at Feb 2013
8369# https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
8370# https://www.clicketyclick.dk/databases/xbase/format/dbf.html
8371# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm
8372# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
83730	ubelong&0x0000FFFF		<0x00000C20
8374# skip Infocom game Z-machine
8375>2		ubyte			>0
8376# skip Androids *.xml
8377>>3		ubyte			>0
8378>>>3		ubyte			<32
8379# 1 < version VV
8380>>>>0		ubyte			>1
8381# skip HELP.CA3 by test for reserved byte ( NULL )
8382>>>>>27		ubyte			0
8383# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
8384#>>>>>30		ubeshort     		x		30NULL?%x
8385# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
8386>>>>>>24	ubelong&0xffFFFFff	>0x01302000
8387# .DBF or .MDX
8388>>>>>>24	ubelong&0xffFFFFff	<0x01302001
8389# for Xbase Database file (*.DBF) reserved (NULL) for multi-user
8390>>>>>>>24	ubelong&0xffFFFFff	=0
8391# test for 2 reserved NULL bytes,transaction and encryption byte flag
8392>>>>>>>>12	ubelong&0xFFFFfEfE	0
8393# test for MDX flag
8394>>>>>>>>>28	ubyte			x
8395>>>>>>>>>28	ubyte&0xf8		0
8396# header size >= 32
8397>>>>>>>>>>8	uleshort		>31
8398# skip PIC15736.PCX by test for language driver name or field name
8399>>>>>>>>>>>32	ubyte			>0
8400#!:mime	application/x-dbf; charset=unknown-8bit ??
8401#!:mime	application/x-dbase
8402>>>>>>>>>>>>0	use			xbase-type
8403# database file
8404>>>>>>>>>>>>0	ubyte			x		\b DBF
8405>>>>>>>>>>>>4	lelong			0		\b, no records
8406>>>>>>>>>>>>4	lelong			>0		\b, %d record
8407# plural s appended
8408>>>>>>>>>>>>>4	lelong			>1		\bs
8409# https://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
8410# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000)
8411>>>>>>>>>>>>10	uleshort		x		* %d
8412# file size = records * record size + header size
8413>>>>>>>>>>>>1	ubyte			x		\b, update-date
8414>>>>>>>>>>>>1	use			xbase-date
8415# https://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
8416#>>>>>>>>>>>>29	ubyte			=0		\b, codepage ID=0x%x
8417# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ?
8418>>>>>>>>>>>>29	ubyte			>0		\b, codepage ID=0x%x
8419#>>>>>>>>>>>>28	ubyte&0x01		0		\b, no index file
8420>>>>>>>>>>>>28	ubyte&0x01		1		\b, with index file .MDX
8421>>>>>>>>>>>>28	ubyte&0x02		2		\b, with memo .FPT
8422>>>>>>>>>>>>28	ubyte&0x04		4		\b, DataBaseContainer
8423# 1st record offset + 1 = header size
8424>>>>>>>>>>>>8	uleshort		>0
8425>>>>>>>>>>>>(8.s+1)	ubyte		>0
8426>>>>>>>>>>>>>8		uleshort	>0		\b, at offset %d
8427>>>>>>>>>>>>>(8.s+1)	ubyte		>0
8428>>>>>>>>>>>>>>&-1	string		>\0		1st record "%s"
8429# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
8430>>>>>>>24	ubelong&0x0133f7ff	>0
8431# test for reserved NULL byte
8432>>>>>>>>47	ubyte			0
8433# test for valid TAG key format (0x10 or 0)
8434>>>>>>>>>559	ubyte&0xeF		0
8435# test MM <= 12
8436>>>>>>>>>>45	ubeshort		<0x0C20
8437>>>>>>>>>>>45	ubyte			>0
8438>>>>>>>>>>>>46	ubyte			<32
8439>>>>>>>>>>>>>46	ubyte			>0
8440#!:mime	application/x-mdx
8441>>>>>>>>>>>>>>0		use		xbase-type
8442>>>>>>>>>>>>>>0		ubyte		x		\b MDX
8443>>>>>>>>>>>>>>1		ubyte		x		\b, creation-date
8444>>>>>>>>>>>>>>1		use		xbase-date
8445>>>>>>>>>>>>>>44	ubyte		x		\b, update-date
8446>>>>>>>>>>>>>>44	use		xbase-date
8447# No.of tags in use (1,2,5,12)
8448>>>>>>>>>>>>>>28	uleshort	x		\b, %d
8449# No. of entries in tag (0x30)
8450>>>>>>>>>>>>>>25	ubyte		x		\b/%d tags
8451#  Length of tag
8452>>>>>>>>>>>>>>26	ubyte		x		* %d
8453# 1st tag name_
8454>>>>>>>>>>>>>548	string		x		\b, 1st tag "%.11s"
8455# 2nd tag name
8456#>>>>>>>>>>>>(26.b+548)	string		x		\b, 2nd tag "%.11s"
8457#
8458#		Print the xBase names of different version variants
84590	name				xbase-type
8460>0	ubyte		<2
8461# 1 < version
8462>0	ubyte		>1
8463>>0	ubyte		0x02		FoxBase
8464# FoxBase+/dBaseIII+, no memo
8465>>0	ubyte		0x03		FoxBase+/dBase III
8466!:mime	application/x-dbf
8467# dBASE IV no memo file
8468>>0	ubyte		0x04		dBase IV
8469!:mime	application/x-dbf
8470# dBASE V no memo file
8471>>0	ubyte		0x05		dBase V
8472!:mime	application/x-dbf
8473>>0	ubyte		0x30		Visual FoxPro
8474!:mime	application/x-dbf
8475>>0	ubyte		0x31		Visual FoxPro, autoincrement
8476!:mime	application/x-dbf
8477# Visual FoxPro, with field type Varchar or Varbinary
8478>>0	ubyte		0x32		Visual FoxPro, with field type Varchar
8479!:mime	application/x-dbf
8480# dBASE IV SQL, no memo;dbv memo var size (Flagship)
8481>>0	ubyte		0x43		dBase IV, with SQL table
8482!:mime	application/x-dbf
8483# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
8484#>>0	ubyte		0x62		dBase IV, with SQL table
8485#!:mime	application/x-dbf
8486# dBASE IV, with memo!!
8487>>0	ubyte		0x7b		dBase IV, with memo
8488!:mime	application/x-dbf
8489# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
8490#>>0	ubyte		0x82		dBase IV, with SQL system
8491#!:mime	application/x-dbf
8492# FoxBase+/dBaseIII+ with memo .DBT!
8493>>0	ubyte		0x83		FoxBase+/dBase III, with memo .DBT
8494!:mime	application/x-dbf
8495# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file
8496>>0	ubyte		0x87		VISUAL OBJECTS, with memo file
8497!:mime	application/x-dbf
8498# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
8499#>>0	ubyte		0x8A		FoxBase+/dBase III, with memo .DBT
8500#!:mime	application/x-dbf
8501# dBASE IV with memo!
8502>>0	ubyte		0x8B		dBase IV, with memo .DBT
8503!:mime	application/x-dbf
8504# dBase IV with SQL Table,no memo?
8505>>0	ubyte		0x8E		dBase IV, with SQL table
8506!:mime	application/x-dbf
8507# .dbv and .dbt memo (Flagship)?
8508>>0	ubyte		0xB3		Flagship
8509# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
8510#>>0	ubyte		0xCA		dBase IV with memo .DBT
8511#!:mime	application/x-dbf
8512# dBASE IV with SQL table, with memo .DBT
8513>>0	ubyte		0xCB		dBase IV with SQL table, with memo .DBT
8514!:mime	application/x-dbf
8515# HiPer-Six format;Clipper SIX, with SMT memo file
8516>>0	ubyte		0xE5		Clipper SIX with memo
8517!:mime	application/x-dbf
8518# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
8519#>>0	ubyte		0xF4		dBase IV, with SQL table, with memo
8520#!:mime	application/x-dbf
8521>>0	ubyte		0xF5		FoxPro with memo
8522!:mime	application/x-dbf
8523# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
8524#>>0	ubyte		0xFA		FoxPro 2.x, with memo
8525#!:mime	application/x-dbf
8526# unknown version (should not happen)
8527>>0	default		x		xBase
8528!:mime	application/x-dbf
8529>>>0	ubyte		x		(0x%x)
8530# flags in version byte
8531# DBT flag (with dBASE III memo .DBT)!!
8532# >>0	ubyte&0x80	>0		DBT_FLAG=%x
8533# memo flag ??
8534# >>0	ubyte&0x08	>0		MEMO_FLAG=%x
8535# SQL flag ??
8536# >>0	ubyte&0x70	>0		SQL_FLAG=%x
8537#		test and print the date of xBase .DBF .MDX
85380	name				xbase-date
8539# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
8540>0	ubelong		x
8541>1	ubyte		<13
8542>>1	ubyte		>0
8543>>>2	ubyte		>0
8544>>>>2	ubyte		<32
8545>>>>>0	ubyte		x
8546# YY is interpreted as 20YY or 19YY
8547>>>>>>0	ubyte		<100		\b %.2d
8548# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
8549>>>>>>0	ubyte		>99		\b %d
8550>>>>>1	ubyte		x		\b-%d
8551>>>>>2	ubyte		x		\b-%d
8552
8553#	dBase memo files .DBT or .FPT
8554# https://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
855516		ubyte		<4
8556>16		ubyte		!2
8557>>16		ubyte		!1
8558# next free block index is positive
8559>>>0		ulelong		>0
8560# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
8561>>>>17		ubelong&0xFFfdFE00	0x00000000
8562# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
8563>>>>>20		ubelong&0xFF01209B	0x00000000
8564# dBASE III
8565>>>>>>16	ubyte		3
8566# dBASE III DBT
8567>>>>>>>0	use		dbase3-memo-print
8568# dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage
8569>>>>>>16	ubyte		0
8570# unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT ,  or garbage PCX DBF
8571>>>>>>>20	uleshort	0
8572# FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage
8573>>>>>>>>8	ulong		=0
8574>>>>>>>>>6	ubeshort	>0
8575# skip emacs.PIF
8576>>>>>>>>>>4	ushort		0
8577>>>>>>>>>>>0	use		foxpro-memo-print
8578# dBASE III DBT , garbage
8579>>>>>>>>>6	ubeshort	0
8580# skip MM*DD*.bin by test for for reserved NULL byte
8581>>>>>>>>>>510	ubeshort	0
8582# skip TK-DOS11.img image by looking for memo text
8583>>>>>>>>>>>512	ubelong		<0xfeffff03
8584# skip EFI executables by looking for memo text
8585>>>>>>>>>>>>512	ubelong		>0x1F202020
8586>>>>>>>>>>>>>513 ubyte		>0
8587# unusual dBASE III DBT like adressen.dbt
8588>>>>>>>>>>>>>>0	use		dbase3-memo-print
8589# dBASE III DBT like angest.dbt, or garbage PCX DBF
8590>>>>>>>>8	ubelong		!0
8591# skip PCX and some DBF by test for for reserved NULL bytes
8592>>>>>>>>>510	ubeshort	0
8593# skip some DBF by test of invalid version
8594>>>>>>>>>>0	ubyte		>5
8595>>>>>>>>>>>0	ubyte		<48
8596>>>>>>>>>>>>0	use		dbase3-memo-print
8597# dBASE IV DBT with positive block size
8598>>>>>>>20	uleshort	>0
8599# dBASE IV DBT with valid block length like 512, 1024
8600# multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero
8601>>>>>>>>20	uleshort&0x800f	0
8602>>>>>>>>>0	use		dbase4-memo-print
8603
8604#		Print the information of dBase III DBT memo file
86050	name				dbase3-memo-print
8606>0	ubyte			x		dBase III DBT
8607# instead 3 as version number 0 for unusual examples like biblio.dbt
8608>16	ubyte			!3		\b, version number %u
8609# Number of next available block for appending data
8610#>0	lelong			=0		\b, next free block index %u
8611>0	lelong			!0		\b, next free block index %u
8612# no positiv block length
8613#>20	uleshort		=0		\b, block length %u
8614>20	uleshort		!0		\b, block length %u
8615# dBase III memo field terminated by \032\032
8616>512	string			>\0		\b, 1st item "%s"
8617#		Print the information of dBase IV DBT memo file
86180	name				dbase4-memo-print
8619>0		lelong		x		dBase IV DBT
8620!:mime	application/x-dbt
8621!:ext dbt
8622# 8 character shorted main name of coresponding dBASE IV DBF file
8623>8		ubelong		>0x20000000
8624# skip unusual like for angest.dbt
8625>>20		uleshort	>0
8626>>>8		string		>\0		\b of %-.8s.DBF
8627# value 0 implies 512 as size
8628#>4		ulelong		=0		\b, blocks size %u
8629# size of blocks not reliable like 0x2020204C in angest.dbt
8630>4		ulelong		!0
8631>>4		ulelong&0x0000003f	0	\b, blocks size %u
8632# dBase IV DBT with positive block length (found 512 , 1024)
8633>20		uleshort	>0		\b, block length %u
8634# next available block
8635#>0		lelong		=0		\b, next free block index %u
8636>0		lelong		!0		\b, next free block index %u
8637>20		uleshort	>0
8638>>(20.s)	ubelong		x
8639>>>&-4		use		dbase4-memofield-print
8640# unusual dBase IV DBT without block length (implies 512 as length)
8641>20		uleshort	=0
8642>>512		ubelong		x
8643>>>&-4		use				dbase4-memofield-print
8644#		Print the information of dBase IV memo field
86450	name			dbase4-memofield-print
8646# free dBase IV memo field
8647>0		ubelong		!0xFFFF0800
8648>>0		lelong		x		\b, next free block %u
8649>>4		lelong		x		\b, next used block %u
8650# used dBase IV memo field
8651>0		ubelong		=0xFFFF0800
8652# length of memo field
8653>>4		lelong		x		\b, field length %d
8654>>>8		string		>\0		\b, 1st used item "%s"
8655#		Print the information of FoxPro FPT memo file
86560	name				foxpro-memo-print
8657>0		belong		x		FoxPro FPT
8658# Size of blocks for FoxPro ( 64,256 )
8659>6		ubeshort	x		\b, blocks size %u
8660# next available block
8661#>0		belong		=0		\b, next free block index %u
8662>0		belong		!0		\b, next free block index %u
8663# field type ( 0~picture, 1~memo, 2~object )
8664>512		ubelong		<3		\b, field type %u
8665# length of memo field
8666>512		ubelong		1
8667>>516		belong		>0		\b, field length %d
8668>>>520		string		>\0		\b, 1st item "%s"
8669
8670# TODO:
8671# DBASE index file *.NDX
8672# DBASE Compound Index file *.CDX
8673# dBASE IV Printer Driver *.PRF
8674## End of XBase database stuff
8675
8676# MS Access database
86774	string	Standard\ Jet\ DB	Microsoft Access Database
8678!:mime	application/x-msaccess
86794	string	Standard\ ACE\ DB	Microsoft Access Database
8680!:mime	application/x-msaccess
8681
8682# From: Joerg Jenderek
8683# URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine
8684# Reference: https://github.com/libyal/libesedb/archive/master.zip
8685#	libesedb-master/documentation/
8686#	Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc
8687# Note: also known as "JET Blue". Used by numerous Windows components such as
8688# Windows Search, Mail, Exchange and Active Directory.
86894	ubelong		0xefcdab89
8690# unknown1
8691>132	ubelong		0		Extensible storage engine
8692!:mime	application/x-ms-ese
8693# file_type 0~database 1~stream
8694>>12	ulelong		0		DataBase
8695# Security DataBase (sdb)
8696!:ext	edb/sdb
8697>>12	ulelong		1		STreaMing
8698!:ext	stm
8699# format_version 620h
8700>>8	uleshort	x		\b, version 0x%x
8701>>10	uleshort	>0		revision 0x%4.4x
8702>>0	ubelong		x	 	\b, checksum 0x%8.8x
8703# Page size 4096 8192 32768
8704>>236	ulequad		x		\b, page size %lld
8705# database_state
8706>>52	ulelong		1		\b, JustCreated
8707>>52	ulelong		2		\b, DirtyShutdown
8708#>>52	ulelong		3		\b, CleanShutdown
8709>>52	ulelong		4		\b, BeingConverted
8710>>52	ulelong		5		\b, ForceDetach
8711# Windows�NT major version when the databases indexes were updated.
8712>>216	ulelong		x		\b, Windows version %d
8713# Windows�NT minor version
8714>>220	ulelong		x		\b.%d
8715
8716# From: Joerg Jenderek
8717# URL: https://forensicswiki.org/wiki/Windows_Application_Compatibility
8718# Note: files contain application compatibility fixes, application compatibility modes and application help messages.
87198	string		sdbf
8720>7	ubyte		0
8721# TAG_TYPE_LIST+TAG_INDEXES
8722>>12	uleshort	0x7802		Windows application compatibility Shim DataBase
8723# version? 2 3
8724#>>>0	ulelong		x		\b, version %d
8725!:mime	application/x-ms-sdb
8726!:ext	sdb
8727
8728# TDB database from Samba et al - Martin Pool <mbp@samba.org>
87290	string	TDB\ file		TDB database
8730>32	lelong	0x2601196D		version 6, little-endian
8731>>36	lelong	x			hash size %d bytes
8732
8733# SE Linux policy database
87340       lelong  0xf97cff8c      SE Linux policy
8735>16     lelong  x               v%d
8736>20     lelong  1      MLS
8737>24     lelong  x       %d symbols
8738>28     lelong  x       %d ocons
8739
8740# ICE authority file data (Wolfram Kleff)
87412	string		ICE		ICE authority data
8742
8743# X11 Xauthority file (Wolfram Kleff)
874410	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
874511	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
874612	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
874713	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
874814	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
874915	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
875016	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
875117	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
875218	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
8753
8754# From: Maxime Henrion <mux@FreeBSD.org>
8755# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org>
87560	string		PGDMP		PostgreSQL custom database dump
8757>5	byte		x		- v%d
8758>6	byte		x		\b.%d
8759>5	beshort		<0x101		\b-0
8760>5	beshort		>0x100
8761>>7	byte		x		\b-%d
8762
8763# Type: Advanced Data Format (ADF) database
8764# URL:  https://www.grc.nasa.gov/WWW/cgns/adf/
8765# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr>
87660	string	@(#)ADF\ Database	CGNS Advanced Data Format
8767
8768# Tokyo Cabinet magic data
8769# http://tokyocabinet.sourceforge.net/index.html
87700	string		ToKyO\ CaBiNeT\n	Tokyo Cabinet
8771>14	string		x			\b (%s)
8772>32	byte		0			\b, Hash
8773!:mime	application/x-tokyocabinet-hash
8774>32	byte		1			\b, B+ tree
8775!:mime	application/x-tokyocabinet-btree
8776>32	byte		2			\b, Fixed-length
8777!:mime	application/x-tokyocabinet-fixed
8778>32	byte		3			\b, Table
8779!:mime	application/x-tokyocabinet-table
8780>33	byte		&1			\b, [open]
8781>33	byte		&2			\b, [fatal]
8782>34	byte		x			\b, apow=%d
8783>35	byte		x			\b, fpow=%d
8784>36	byte		&0x01			\b, [large]
8785>36	byte		&0x02			\b, [deflate]
8786>36	byte		&0x04			\b, [bzip]
8787>36	byte		&0x08			\b, [tcbs]
8788>36	byte		&0x10			\b, [excodec]
8789>40	lequad		x			\b, bnum=%lld
8790>48	lequad		x			\b, rnum=%lld
8791>56	lequad		x			\b, fsiz=%lld
8792
8793# Type:	QDBM Quick Database Manager
8794# From:	Benoit Sibaud <bsibaud@april.org>
87950	string		\\[depot\\]\n\f		Quick Database Manager, little endian
87960	string		\\[DEPOT\\]\n\f		Quick Database Manager, big endian
8797
8798# Type:	TokyoCabinet database
8799# URL:	http://tokyocabinet.sourceforge.net/
8800# From:	Benoit Sibaud <bsibaud@april.org>
88010	string		ToKyO\ CaBiNeT\n	TokyoCabinet database
8802>14	string		x			(version %s)
8803
8804# From:  Stephane Blondon https://www.yaal.fr
8805# Database file for Zope (done by FileStorage)
88060	string	FS21	Zope Object Database File Storage v3 (data)
88070	string	FS30	Zope Object Database File Storage v4 (data)
8808
8809# Cache file for the database of Zope (done by ClientStorage)
88100	string		ZEC3	Zope Object Database Client Cache File (data)
8811
8812# IDA (Interactive Disassembler) database
88130	string		IDA1	IDA (Interactive Disassembler) database
8814
8815# Hopper (reverse engineering tool) https://www.hopperapp.com/
88160	string		hopperdb	Hopper database
8817
8818# URL: https://en.wikipedia.org/wiki/Panorama_(database_engine)
8819# Reference: http://www.provue.com/Panorama/
8820# From: Joerg Jenderek
8821# NOTE: test only versions 4 and 6.0 with Windows
8822# length of Panorama database name
88235	ubyte				>0
8824# look after database name for "some" null bits
8825>(5.B+7)	ubelong&0xF3ffF000	0
8826# look for first keyword
8827>>&1		search/2		DESIGN		Panorama database
8828#!:mime	application/x-panorama-database
8829!:apple	KASXZEPD
8830!:ext	pan
8831# database name
8832>>>5	pstring				x		\b, "%s"
8833
8834#
8835#
8836# askSam Database by Stefan A. Haubenthal <polluks@web.de>
88370	string	askw40\0	askSam DB
8838
8839#
8840#
8841# MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de>
88420	string	MBSTV\040	MUIbase DB
8843>6	string	x		version %s
8844
8845#
8846# CDB database
88470	string	NBCDB\012	NetBSD Constant Database
8848>7	byte	x		\b, version %d
8849>8	string	x		\b, for '%s'
8850>24	lelong	x		\b, datasize %d
8851>28	lelong	x		\b, entries %d
8852>32	lelong	x		\b, index %d
8853>36	lelong	x		\b, seed %#x
8854
8855#
8856# Redis RDB - https://redis.io/topics/persistence
88570	string	REDIS			Redis RDB file,
8858>5	regex	[0-9][0-9][0-9][0-9]	version %s
8859
8860# Mork database.
8861# Used by older versions of Mozilla Suite and Firefox,
8862# and current versions of Thunderbird.
8863# From: David Korth <gerbilsoft@gerbilsoft.com>
88640	string	//\ <!--\ <mdb:mork:z\ v="	Mozilla Mork database
8865>23	string	x		\b, version %.3s
8866
8867#------------------------------------------------------------------------------
8868# $File: dataone,v 1.2 2019/04/19 00:42:27 christos Exp $
8869#
8870# DataONE- files from Dave Vieglais <dave.vieglais@gmail.com> &
8871#                     Pratik Shrivastava <pratikshrivastava23@gmail.com>
8872#
8873# file formats:   https://cn.dataone.org/cn/v2/formats
8874#------------------------------------------------------------------------------
8875
8876# EML (Ecological Metadata Language Format)
88770	string	<?xml
8878>&0	regex	(eml)-[0-9].[0-9].[0-9]+	eml://ecoinformatics.org/%s
8879
8880# onedcx (DataONE Dublin Core Extended v1.0)
8881>&0	regex	(onedcx/v)[0-9].[0-9]+		https://ns.dataone.org/metadata/schema/onedcx/v1.0
8882
8883# FGDC-STD-001-1998 (Content Standard for Digital Geospatial Metadata,
8884# version 001-1998)
8885>&0	regex	fgdc				FGDC-STD-001-1998
8886
8887# Mercury (Oak Ridge National Lab Mercury Metadata version 1.0)
8888>&0	regex	(mercury/terms/v)[0-9].[0-9]	https://purl.org/ornl/schema/mercury/terms/v1.0
8889
8890# ISOTC211 (Geographic MetaData (GMD) Extensible Markup Language)
8891>&0	regex	isotc211
8892>>&0	regex	eng;USA				https://www.isotc211.org/2005/gmd
8893
8894# ISOTC211 (NOAA Variant Geographic MetaData (GMD) Extensible Markup Language)
8895>>&0	regex	gov.noaa.nodc:[0-9]+		https://www.isotc211.org/2005/gmd-noaa
8896
8897# ISOTC211 PANGAEA Variant Geographic MetaData (GMD) Extensible Markup Language
8898>>&0	regex	pangaea.dataset[0-9][0-9][0-9][0-9][0-9][0-9]+	https://www.isotc211.org/2005/gmd-pangaea
8899!:mime	text/xml
8900
8901
8902# Object Reuse and Exchange Vocabulary
89030	string	<?xml
8904>&0	regex	rdf
8905>>&0	regex	openarchives	https://www.openarchives.org/ore/terms
8906!:mime application/rdf+xml
8907
8908
8909# Dryad Metadata Application Profile Version 3.1
89100	string	<DryadData
8911>&0	regex	(dryad-bibo/v)[0-9].[0-9]	https://datadryad.org/profile/v3.1
8912!:mime	text/xml
8913
8914#------------------------------------------------------------------------------
8915# $File: dbpf,v 1.3 2019/04/19 00:42:27 christos Exp $
8916# dppf:	Maxis Database Packed Files, the stored data file format used by all
8917#	Maxis games after the Sims: http://wiki.niotso.org/DBPF
8918# 	https://www.wiki.sc4devotion.com/index.php?title=DBPF
8919#	13 Oct 2017, Kip Warner <kip at thevertigo dot com>
89200	string	DBPF	Maxis Database Packed File
8921>4	ulelong	x	\b, version: %u.
8922>>8	ulelong	x	\b%u
8923>>>36	ulelong	x       \b, files: %u
8924>>24	ledate	!0	\b, created: %s
8925>>28	ledate	!0	\b, modified: %s
8926!:ext	dbpf/package/dat/sc4
8927!:mime	application/x-maxis-dbpf
8928#------------------------------------------------------------------------------
8929# $File: der,v 1.2 2017/03/17 21:35:28 christos Exp $
8930# der: file(1) magic for DER encoded files
8931#
8932
8933# Certificate information piece
89340	name	certinfo
8935>0	der	seq
8936>>&0	der	set
8937>>>&0	der	seq
8938>>>>&0	der	obj_id3=550406
8939>>>>&0	der	prt_str=x	\b, countryName=%s
8940>>&0	der	set
8941>>>&0	der	seq
8942>>>>&0	der	obj_id3=550408
8943>>>>&0	der	utf8_str=x	\b, stateOrProvinceName=%s
8944>>&0	der	set
8945>>>&0	der	seq
8946>>>>&0	der	obj_id3=55040a
8947>>>>&0	der	utf8_str=x	\b, organizationName=%s
8948>>&0	der	set
8949>>>&0	der	seq
8950>>>>&0	der	obj_id3=550403
8951>>>>&0	der	utf8_str=x	\b, commonName=%s
8952>>&0	der	seq
8953
8954# Certificate requests
89550	der	seq
8956>&0	der	seq
8957>>&0	der	int1=00		DER Encoded Certificate request
8958>>&0	use	certinfo
8959
8960# Key Pairs
89610	der	seq
8962>&0	der	int1=00
8963>&0	der	int65=x
8964>&0	der	int3=010001	DER Encoded Key Pair, 512 bits
8965
89660	der	seq
8967>&0	der	int1=00
8968>&0	der	int129=x
8969>&0	der	int3=010001	DER Encoded Key Pair, 1024 bits
8970
89710	der	seq
8972>&0	der	int1=00
8973>&0	der	int257=x
8974>&0	der	int3=010001	DER Encoded Key Pair, 2048 bits
8975
89760	der	seq
8977>&0	der	int1=00
8978>&0	der	int513=x
8979>&0	der	int3=010001	DER Encoded Key Pair, 4096 bits
8980
89810	der	seq
8982>&0	der	int1=00
8983>&0	der	int1025=x
8984>&0	der	int3=010001	DER Encoded Key Pair, 8192 bits
8985
89860	der	seq
8987>&0	der	int1=00
8988>&0	der	int2049=x
8989>&0	der	int3=010001	DER Encoded Key Pair, 16k bits
8990
89910	der	seq
8992>&0	der	int1=00
8993>&0	der	int4097=x
8994>&0	der	int3=010001	DER Encoded Key Pair, 32k bits
8995
8996# Certificates
89970	der	seq
8998>&0	der	seq
8999>>&0	der	int2=0dfa	DER Encoded Certificate, 512 bits
9000>>&0	der	int2=0dfb	DER Encoded Certificate, 1024 bits
9001>>&0	der	int2=0dfc	DER Encoded Certificate, 2048 bits
9002>>&0	der	int2=0dfd	DER Encoded Certificate, 4096 bits
9003>>&0	der	int2=0dfe	DER Encoded Certificate, 8192 bits
9004>>&0	der	int2=0dff	DER Encoded Certificate, 16k bits
9005>>&0	der	int2=0e04	DER Encoded Certificate, 32k bits
9006>>&0	der	int2=x		DER Encoded Certificate, ? bits (%s)
9007>>&0	der	seq
9008>>>&0	der	obj_id9=2a864886f70d010105	\b, sha1WithRSAEncryption
9009>>>&0	der	obj_id9=x			\b, ? Encryption (%s)
9010>>>&0	der	null
9011>>&0	der	seq
9012>>>&0	der	set
9013>>>>&0	der	seq
9014>>>>>&0	der	obj_id3=550406
9015>>>>>&0	der	prt_str=x	\b, countryName=%s
9016>>>&0	der	set
9017>>>>&0	der	seq
9018>>>>>&0	der	obj_id3=550408
9019>>>>>&0	der	prt_str=x	\b, stateOrProvinceName=%s
9020>>>&0	der	set
9021>>>>&0	der	seq
9022>>>>>&0	der	obj_id3=550407
9023>>>>>&0	der	prt_str=x	\b, localityName=%s
9024>>>&0	der	set
9025>>>>&0	der	seq
9026>>>>>&0	der	obj_id3=55040a
9027>>>>>&0	der	prt_str=x	\b, organizationName=%s
9028>>>&0	der	set
9029>>>>&0	der	seq
9030>>>>>&0	der	obj_id3=55040b
9031>>>>>&0	der	prt_str=x	\b, organizationUnitName=%s
9032>>>&0	der	set
9033>>>>&0	der	seq
9034>>>>>&0	der	obj_id3=550403
9035>>>>>&0	der	prt_str=x	\b, commonName=%s
9036>>>&0	der	set
9037>>>>&0	der	seq
9038>>>>>&0	der	obj_id9=2a864886f70d010901
9039>>>>>&0	der	ia5_str=x	\b, emailAddress=%s
9040>>&0	der	seq
9041>>>&0	der	utc_time=x	\b, utcTime=%s
9042>>>&0	der	utc_time=x	\b, utcTime=%s
9043>>&0	use	certinfo
9044
9045#------------------------------------------------------------------------------
9046# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $
9047# diamond:  file(1) magic for Diamond system
9048#
9049# ... diamond is a multi-media mail and electronic conferencing system....
9050#
9051# XXX - I think it was either renamed Slate, or replaced by Slate....
9052#
9053#	The full deal is too long...
9054#0	string	<list>\n<protocol\ bbn-multimedia-format>	Diamond Multimedia Document
90550	string	=<list>\n<protocol\ bbn-m	Diamond Multimedia Document
9056
9057#------------------------------------------------------------------------------
9058# $File: diff,v 1.16 2017/03/17 22:20:22 christos Exp $
9059# diff:  file(1) magic for diff(1) output
9060#
90610	search/1	diff\040	diff output text
9062!:mime	text/x-diff
90630	search/1	***\040 	diff output text
9064!:mime	text/x-diff
90650	search/1	Only\040in\040 	diff output text
9066!:mime	text/x-diff
90670	search/1	Common\040subdirectories:\040 	diff output text
9068!:mime	text/x-diff
9069
90700	search/1	Index:		RCS/CVS diff output text
9071!:mime	text/x-diff
9072
9073# bsdiff:  file(1) magic for bsdiff(1) output
90740	string/b		BSDIFF40	bsdiff(1) patch file
9075
9076
9077# unified diff
90780	search/4096	---\040
9079>&0	search/1024 \n
9080>>&0	search/1 +++\040
9081>>>&0	search/1024 \n
9082>>>>&0	search/1 @@	unified diff output text
9083!:mime	text/x-diff
9084!:strength + 90
9085
9086# librsync -- the library for network deltas
9087#
9088# Copyright (C) 2001 by Martin Pool.  You may do whatever you want with
9089# this file.
9090#
90910	belong		0x72730236	rdiff network-delta data
9092
90930	belong		0x72730136	rdiff network-delta signature data
9094>4	belong		x		(block length=%d,
9095>8	belong		x		signature strength=%d)
9096
9097#------------------------------------------------------------------------------
9098# $File: digital,v 1.11 2013/01/11 16:45:23 christos Exp $
9099#  Digital UNIX - Info
9100#
91010	string	=!<arch>\n________64E	Alpha archive
9102>22	string	X			-- out of date
9103#
9104
91050	leshort		0603
9106>24	leshort		0410		COFF format alpha pure
9107>24	leshort		0413		COFF format alpha demand paged
9108>>22	leshort&030000	!020000		executable
9109>>22	leshort&020000	!0		dynamically linked
9110>>16	lelong		!0		not stripped
9111>>16	lelong		0		stripped
9112>>27	byte		x		- version %d
9113>>26	byte		x		\b.%d
9114>>28	byte		x		\b-%d
9115>24	leshort		0407		COFF format alpha object
9116>>22	leshort&030000	020000		shared library
9117>>27	byte		x		- version %d
9118>>26	byte		x		\b.%d
9119>>28	byte		x		\b-%d
9120
9121# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
9122#
9123# The actual magic number is just "Core", followed by a 2-byte version
9124# number; however, treating any file that begins with "Core" as a Digital
9125# UNIX core dump file may produce too many false hits, so we include one
9126# byte of the version number as well; DU 5.0 appears only to be up to
9127# version 2.
9128#
91290	string		Core\001	Alpha COFF format core dump (Digital UNIX)
9130>24	string		>\0		\b, from '%s'
91310	string		Core\002	Alpha COFF format core dump (Digital UNIX)
9132>24	string		>\0		\b, from '%s'
9133#
9134# The next is incomplete, we could tell more about this format,
9135# but its not worth it.
91360	leshort		0x188	Alpha compressed COFF
91370	leshort		0x18f	Alpha u-code object
9138#
9139#
9140# Some other interesting Digital formats,
91410	string	\377\377\177		ddis/ddif
91420	string	\377\377\174		ddis/dots archive
91430	string	\377\377\176		ddis/dtif table data
91440	string	\033c\033		LN03 output
91450	long	04553207		X image
9146#
91470	string	=!<PDF>!\n		profiling data file
9148#
9149# Locale data tables (MIPS and Alpha).
9150#
91510	short		0x0501		locale data table
9152>6	short		0x24		for MIPS
9153>6	short		0x40		for Alpha
9154
9155#------------------------------------------------------------------------------
9156# $File: dolby,v 1.9 2019/04/19 00:42:27 christos Exp $
9157# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
9158# from https://www.atsc.org/standards/a_52a.pdf
9159# corrections, additions, etc. are always welcome!
9160#
9161# syncword
91620	beshort		0x0b77	ATSC A/52 aka AC-3 aka Dolby Digital stream,
9163# Proposed audio/ac3 RFC/4184
9164!:mime	audio/vnd.dolby.dd-raw
9165# fscod
9166>4	byte&0xc0 = 0x00	48 kHz,
9167>4	byte&0xc0 = 0x40	44.1 kHz,
9168>4	byte&0xc0 = 0x80	32 kHz,
9169# is this one used for 96 kHz?
9170>4	byte&0xc0 = 0xc0	reserved frequency,
9171#
9172>5	byte&0x07 = 0x00	\b, complete main (CM)
9173>5	byte&0x07 = 0x01	\b, music and effects (ME)
9174>5	byte&0x07 = 0x02	\b, visually impaired (VI)
9175>5	byte&0x07 = 0x03	\b, hearing impaired (HI)
9176>5	byte&0x07 = 0x04	\b, dialogue (D)
9177>5	byte&0x07 = 0x05	\b, commentary (C)
9178>5	byte&0x07 = 0x06	\b, emergency (E)
9179>5	beshort&0x07e0  0x0720	\b, voiceover (VO)
9180>5	beshort&0x07e0 >0x0720	\b, karaoke
9181# acmod
9182>6	byte&0xe0 = 0x00	1+1 front,
9183>>6	byte&0x10 = 0x10	LFE on,
9184>6	byte&0xe0 = 0x20	1 front/0 rear,
9185>>6	byte&0x10 = 0x10	LFE on,
9186>6	byte&0xe0 = 0x40	2 front/0 rear,
9187# dsurmod (for stereo only)
9188>>6	byte&0x18 = 0x00	Dolby Surround not indicated
9189>>6	byte&0x18 = 0x08	not Dolby Surround encoded
9190>>6	byte&0x18 = 0x10	Dolby Surround encoded
9191>>6	byte&0x18 = 0x18	reserved Dolby Surround mode
9192>>6	byte&0x04 = 0x04	LFE on,
9193>6	byte&0xe0 = 0x60	3 front/0 rear,
9194>>6	byte&0x04 = 0x04	LFE on,
9195>6	byte&0xe0 = 0x80	2 front/1 rear,
9196>>6	byte&0x04 = 0x04	LFE on,
9197>6	byte&0xe0 = 0xa0	3 front/1 rear,
9198>>6	byte&0x01 = 0x01	LFE on,
9199>6	byte&0xe0 = 0xc0	2 front/2 rear,
9200>>6	byte&0x04 = 0x04	LFE on,
9201>6	byte&0xe0 = 0xe0	3 front/2 rear,
9202>>6	byte&0x01 = 0x01	LFE on,
9203#
9204>4	byte&0x3e = 0x00	\b, 32 kbit/s
9205>4	byte&0x3e = 0x02	\b, 40 kbit/s
9206>4	byte&0x3e = 0x04	\b, 48 kbit/s
9207>4	byte&0x3e = 0x06	\b, 56 kbit/s
9208>4	byte&0x3e = 0x08	\b, 64 kbit/s
9209>4	byte&0x3e = 0x0a	\b, 80 kbit/s
9210>4	byte&0x3e = 0x0c	\b, 96 kbit/s
9211>4	byte&0x3e = 0x0e	\b, 112 kbit/s
9212>4	byte&0x3e = 0x10	\b, 128 kbit/s
9213>4	byte&0x3e = 0x12	\b, 160 kbit/s
9214>4	byte&0x3e = 0x14	\b, 192 kbit/s
9215>4	byte&0x3e = 0x16	\b, 224 kbit/s
9216>4	byte&0x3e = 0x18	\b, 256 kbit/s
9217>4	byte&0x3e = 0x1a	\b, 320 kbit/s
9218>4	byte&0x3e = 0x1c	\b, 384 kbit/s
9219>4	byte&0x3e = 0x1e	\b, 448 kbit/s
9220>4	byte&0x3e = 0x20	\b, 512 kbit/s
9221>4	byte&0x3e = 0x22	\b, 576 kbit/s
9222>4	byte&0x3e = 0x24	\b, 640 kbit/s
9223
9224#------------------------------------------------------------------------------
9225# $File: dump,v 1.17 2018/06/26 01:07:17 christos Exp $
9226# dump:  file(1) magic for dump file format--for new and old dump filesystems
9227#
9228# We specify both byte orders in order to recognize byte-swapped dumps.
9229#
92300	name	new-dump-be
9231>4	bedate	x		This dump %s,
9232>8	bedate	x		Previous dump %s,
9233>12	belong	>0		Volume %d,
9234>692	belong	0		Level zero, type:
9235>692	belong	>0		Level %d, type:
9236>0	belong	1		tape header,
9237>0	belong	2		beginning of file record,
9238>0	belong	3		map of inodes on tape,
9239>0	belong	4		continuation of file record,
9240>0	belong	5		end of volume,
9241>0	belong	6		map of inodes deleted,
9242>0	belong	7		end of medium (for floppy),
9243>676	string	>\0		Label %s,
9244>696	string	>\0		Filesystem %s,
9245>760	string	>\0		Device %s,
9246>824	string	>\0		Host %s,
9247>888	belong	>0		Flags %x
9248
92490	name	old-dump-be
9250#>4	bedate	x		This dump %s,
9251#>8	bedate	x		Previous dump %s,
9252>12	belong	>0		Volume %d,
9253>692	belong	0		Level zero, type:
9254>692	belong	>0		Level %d, type:
9255>0	belong	1		tape header,
9256>0	belong	2		beginning of file record,
9257>0	belong	3		map of inodes on tape,
9258>0	belong	4		continuation of file record,
9259>0	belong	5		end of volume,
9260>0	belong	6		map of inodes deleted,
9261>0	belong	7		end of medium (for floppy),
9262>676	string	>\0		Label %s,
9263>696	string	>\0		Filesystem %s,
9264>760	string	>\0		Device %s,
9265>824	string	>\0		Host %s,
9266>888	belong	>0		Flags %x
9267
92680	name	ufs2-dump-be
9269>896	beqdate	x		This dump %s,
9270>904	beqdate	x		Previous dump %s,
9271>12	belong	>0		Volume %d,
9272>692	belong	0		Level zero, type:
9273>692	belong	>0		Level %d, type:
9274>0	belong	1		tape header,
9275>0	belong	2		beginning of file record,
9276>0	belong	3		map of inodes on tape,
9277>0	belong	4		continuation of file record,
9278>0	belong	5		end of volume,
9279>0	belong	6		map of inodes deleted,
9280>0	belong	7		end of medium (for floppy),
9281>676	string	>\0		Label %s,
9282>696	string	>\0		Filesystem %s,
9283>760	string	>\0		Device %s,
9284>824	string	>\0		Host %s,
9285>888	belong	>0		Flags %x
9286
928724	belong	60012		new-fs dump file (big endian),
9288>0	use	new-dump-be
9289
929024	belong	60011		old-fs dump file (big endian),
9291>0	use	old-dump-be
9292
929324	lelong	60012		new-fs dump file (little endian),
9294# to correctly recognize '*.mo' GNU message catalog (little endian)
9295!:strength - 15
9296>0	use	\^new-dump-be
9297
929824	lelong	60011		old-fs dump file (little endian),
9299>0	use	\^old-dump-be
9300
9301
930224	belong	0x19540119	new-fs dump file (ufs2, big endian),
9303>0	use	ufs2-dump-be
9304
930524	lelong	0x19540119	new-fs dump file (ufs2, little endian),
9306>0	use	\^ufs2-dump-be
9307
930818	leshort	60011		old-fs dump file (16-bit, assuming PDP-11 endianness),
9309>2	medate	x		Previous dump %s,
9310>6	medate	x		This dump %s,
9311>10	leshort	>0		Volume %d,
9312>0	leshort	1		tape header.
9313>0	leshort	2		beginning of file record.
9314>0	leshort	3		map of inodes on tape.
9315>0	leshort	4		continuation of file record.
9316>0	leshort	5		end of volume.
9317>0	leshort	6		map of inodes deleted.
9318>0	leshort	7		end of medium (for floppy).
9319
9320#------------------------------------------------------------------------------
9321# $File: dyadic,v 1.9 2019/04/19 00:42:27 christos Exp $
9322# Dyadic: file(1) magic for Dyalog APL.
9323#
9324# updated by Joerg Jenderek at Oct 2013
9325# https://en.wikipedia.org/wiki/Dyalog_APL
9326# https://www.dyalog.com/
9327# .DXV Dyalog APL External Variable
9328# .DIN Dyalog APL Input Table
9329# .DOT Dyalog APL Output Table
9330# .DFT Dyalog APL Format File
93310	ubeshort&0xFF60	0xaa00
9332# skip biblio.dbt
9333>1	byte		!4
9334# real Dyalog APL have non zero version numbers like 7.3 or 13.4
9335>>2	ubeshort	>0x0000		Dyalog APL
9336>>>1	byte		0x00		aplcore
9337#>>>1	byte		0x00		incomplete workspace
9338# *.DCF Dyalog APL Component File
9339>>>1	byte		0x01		component file 32-bit non-journaled non-checksummed
9340#>>>1	byte		0x01		component file
9341>>>1	byte		0x02		external variable exclusive
9342#>>>1	byte		0x02		external variable
9343# *.DWS Dyalog APL Workspace
9344>>>1	byte		0x03		workspace
9345>>>>7	byte&0x28	0x00		32-bit
9346>>>>7	byte&0x28	0x20		64-bit
9347>>>>7	byte&0x0c	0x00		classic
9348>>>>7	byte&0x0c	0x04		unicode
9349>>>>7	byte&0x88	0x00		big-endian
9350>>>>7	byte&0x88	0x80		little-endian
9351>>>1	byte		0x06		external variable shared
9352# *.DSE Dyalog APL Session , *.DLF Dyalog APL Session Log File
9353>>>1	byte		0x07		session
9354>>>1	byte		0x08		mapped file 32-bit
9355>>>1	byte		0x09		component file 64-bit non-journaled non-checksummed
9356>>>1	byte		0x0a		mapped file 64-bit
9357>>>1	byte		0x0b		component file 32-bit level 1 journaled non-checksummed
9358>>>1	byte		0x0c		component file 64-bit level 1 journaled non-checksummed
9359>>>1	byte		0x0d		component file 32-bit level 1 journaled checksummed
9360>>>1	byte		0x0e		component file 64-bit level 1 journaled checksummed
9361>>>1	byte		0x0f		component file 32-bit level 2 journaled checksummed
9362>>>1	byte		0x10		component file 64-bit level 2 journaled checksummed
9363>>>1	byte		0x11		component file 32-bit level 3 journaled checksummed
9364>>>1	byte		0x12		component file 64-bit level 3 journaled checksummed
9365>>>1	byte		0x13		component file 32-bit non-journaled checksummed
9366>>>1	byte		0x14		component file 64-bit non-journaled checksummed
9367>>>1	byte		0x15		component file under construction
9368>>>1	byte		0x16		DFS component file 64-bit level 1 journaled checksummed
9369>>>1	byte		0x17		DFS component file 64-bit level 2 journaled checksummed
9370>>>1	byte		0x18		DFS component file 64-bit level 3 journaled checksummed
9371>>>1	byte		0x19		external workspace
9372>>>1	byte		0x80		DDB
9373>>>2	byte		x		version %d
9374>>>3	byte		x		\b.%d
9375#>>>2	byte		x		type %d
9376#>>>3	byte		x		subtype %d
9377
9378# *.DXF Dyalog APL Transfer File
93790	short		0x6060		Dyalog APL transfer
9380
9381#------------------------------------------------------------------------------
9382# $File: ebml,v 1.2 2019/04/19 00:42:27 christos Exp $
9383# ebml:  file(1) magic for various Extensible Binary Meta Language
9384# https://www.matroska.org/technical/specs/index.html#track
93850	belong	0x1a45dfa3	EBML file
9386>4	search/b/100	\102\202
9387>>&1	string	x		\b, creator %.8s
9388
9389#------------------------------------------------------------------------------
9390# $File: edid,v 1.1 2019/03/28 12:36:01 christos Exp $
9391# edid:  file(1) magic for EDID dump files
9392
93930	quad	0x00ffffffffffff00	Extended display identification data dump
9394!:mime application/x-edid-dump
9395>18	byte	0x01			Version 1
9396>>19	byte	<0x04			\b.%d
9397>18	byte	0x02			Version 2
9398>>19	byte	0x00			\b.0
9399
9400#------------------------------------------------------------------------------
9401# $File: editors,v 1.11 2017/03/17 21:35:28 christos Exp $
9402# T602 editor documents
9403# by David Necas <yeti@physics.muni.cz>
94040	string	@CT\ 	T602 document data,
9405>4	string	0	Kamenicky
9406>4	string	1	CP 852
9407>4	string	2	KOI8-CS
9408>4	string	>2	unknown encoding
9409
9410# Vi IMproved Encrypted file
9411# by David Necas <yeti@physics.muni.cz>
94120	string	VimCrypt~	Vim encrypted file data
9413
94140	name	vimnanoswap
9415>67	byte	0
9416>>107	byte	0
9417#>>>2	string	x	%s swap file
9418>>>24	ulelong	x	\b, pid %d
9419>>>28	string	>\0	\b, user %s
9420>>>68	string	>\0	\b, host %s
9421>>>108	string	>\0	\b, file %s
9422>>>1007	byte	0x55	\b, modified
9423
9424# Vi IMproved Swap file
9425# by Sven Wegener <swegener@gentoo.org>
94260	string  b0VIM\ 		Vim swap file
9427>&0	string  >\0		\b, version %s
9428>0	use	vimnanoswap
9429
9430
9431# Lock/swap file for several editors, at least
9432# Vi IMproved and nano
94330	string	b0nano		Nano swap file
9434>0	use	vimnanoswap
9435
9436# kate (K Advanced Text Editor)
94370	string	\x00\x00\x00\x12Kate\ Swap\ File\ 2.0\x00	Kate swap file
9438
9439#------------------------------------------------------------------------------
9440# $File: efi,v 1.5 2014/04/30 21:41:02 christos Exp $
9441# efi:  file(1) magic for Universal EFI binaries
9442
94430	lelong	0x0ef1fab9
9444>4	lelong	1		Universal EFI binary with 1 architecture
9445>>&0	lelong	7		\b, i386
9446>>&0	lelong	0x01000007	\b, x86_64
9447>4	lelong	2		Universal EFI binary with 2 architectures
9448>>&0	lelong	7		\b, i386
9449>>&0	lelong	0x01000007	\b, x86_64
9450>>&20	lelong	7		\b, i386
9451>>&20	lelong	0x01000007	\b, x86_64
9452>4	lelong	>2		Universal EFI binary with %d architectures
9453
9454#------------------------------------------------------------------------------
9455# $File: elf,v 1.77 2019/01/16 19:33:35 christos Exp $
9456# elf:  file(1) magic for ELF executables
9457#
9458# We have to check the byte order flag to see what byte order all the
9459# other stuff in the header is in.
9460#
9461# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
9462#
9463# Created by: unknown
9464# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com>
9465# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support)
9466# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support)
9467# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium)
9468# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures)
9469
94700	name		elf-mips
9471>0	lelong&0xf0000000	0x00000000	MIPS-I
9472>0	lelong&0xf0000000	0x10000000	MIPS-II
9473>0	lelong&0xf0000000	0x20000000	MIPS-III
9474>0	lelong&0xf0000000	0x30000000	MIPS-IV
9475>0	lelong&0xf0000000	0x40000000	MIPS-V
9476>0	lelong&0xf0000000	0x50000000	MIPS32
9477>0	lelong&0xf0000000	0x60000000	MIPS64
9478>0	lelong&0xf0000000	0x70000000	MIPS32 rel2
9479>0	lelong&0xf0000000	0x80000000	MIPS64 rel2
9480>0	lelong&0xf0000000	0x90000000	MIPS32 rel6
9481>0	lelong&0xf0000000	0xa0000000	MIPS64 rel6
9482
94830	name		elf-sparc
9484>0	lelong&0x00ffff00	0x00000100	V8+ Required,
9485>0	lelong&0x00ffff00	0x00000200	Sun UltraSPARC1 Extensions Required,
9486>0	lelong&0x00ffff00	0x00000400	HaL R1 Extensions Required,
9487>0	lelong&0x00ffff00	0x00000800	Sun UltraSPARC3 Extensions Required,
9488>0	lelong&0x3		0		total store ordering,
9489>0	lelong&0x3		1		partial store ordering,
9490>0	lelong&0x3		2		relaxed memory ordering,
9491
94920	name		elf-pa-risc
9493>2	leshort		0x0208		1.0
9494>2	leshort		0x0210		1.1
9495>2	leshort		0x0214		2.0
9496>0	leshort		&0x0008		(LP64)
9497
94980	name		elf-le
9499>16	leshort		0		no file type,
9500!:mime	application/octet-stream
9501>16	leshort		1		relocatable,
9502!:mime	application/x-object
9503>16	leshort		2		executable,
9504!:mime	application/x-executable
9505>16	leshort		3		${x?pie executable:shared object},
9506
9507!:mime	application/x-${x?pie-executable:sharedlib}
9508>16	leshort		4		core file,
9509!:mime	application/x-coredump
9510# OS-specific
9511>7	byte		202
9512>>16	leshort		0xFE01		executable,
9513!:mime	application/x-executable
9514# Core file detection is not reliable.
9515#>>>(0x38+0xcc) string	>\0		of '%s'
9516#>>>(0x38+0x10) lelong	>0		(signal %d),
9517>16	leshort		&0xff00		processor-specific,
9518>18	clear		x
9519>18	leshort		0		no machine,
9520>18	leshort		1		AT&T WE32100,
9521>18	leshort		2		SPARC,
9522>18	leshort		3		Intel 80386,
9523>18	leshort		4		Motorola m68k,
9524>>4	byte		1
9525>>>36	lelong		&0x01000000	68000,
9526>>>36	lelong		&0x00810000	CPU32,
9527>>>36	lelong		0		68020,
9528>18	leshort		5		Motorola m88k,
9529>18	leshort		6		Intel 80486,
9530>18	leshort		7		Intel 80860,
9531# The official e_machine number for MIPS is now #8, regardless of endianness.
9532# The second number (#10) will be deprecated later. For now, we still
9533# say something if #10 is encountered, but only gory details for #8.
9534>18	leshort		8		MIPS,
9535>>4	byte		1
9536>>>36	lelong		&0x20		N32
9537>18	leshort		10		MIPS,
9538>>4	byte		1
9539>>>36	lelong		&0x20		N32
9540>18	leshort		8
9541# only for 32-bit
9542>>4	byte		1
9543>>>36	use		elf-mips
9544# only for 64-bit
9545>>4	byte		2
9546>>>48	use		elf-mips
9547>18	leshort		9		Amdahl,
9548>18	leshort		10		MIPS (deprecated),
9549>18	leshort		11		RS6000,
9550>18	leshort		15		PA-RISC,
9551# only for 32-bit
9552>>4	byte		1
9553>>>36	use		elf-pa-risc
9554# only for 64-bit
9555>>4	byte		2
9556>>>48	use		elf-pa-risc
9557>18	leshort		16		nCUBE,
9558>18	leshort		17		Fujitsu VPP500,
9559>18	leshort		18		SPARC32PLUS,
9560# only for 32-bit
9561>>4	byte		1
9562>>>36	use		elf-sparc
9563>18	leshort		19		Intel 80960,
9564>18	leshort		20		PowerPC or cisco 4500,
9565>18	leshort		21		64-bit PowerPC or cisco 7500,
9566>18	leshort		22		IBM S/390,
9567>18	leshort		23		Cell SPU,
9568>18	leshort		24		cisco SVIP,
9569>18	leshort		25		cisco 7200,
9570>18	leshort		36		NEC V800 or cisco 12000,
9571>18	leshort		37		Fujitsu FR20,
9572>18	leshort		38		TRW RH-32,
9573>18	leshort		39		Motorola RCE,
9574>18	leshort		40		ARM,
9575>>4	byte		1
9576>>>36	lelong&0xff000000	0x04000000	EABI4
9577>>>36	lelong&0xff000000	0x05000000	EABI5
9578>>>36	lelong		&0x00800000	BE8
9579>>>36	lelong		&0x00400000	LE8
9580>18	leshort		41		Alpha,
9581>18	leshort		42		Renesas SH,
9582>18	leshort		43		SPARC V9,
9583>>4	byte		2
9584>>>48	use		elf-sparc
9585>18	leshort		44		Siemens Tricore Embedded Processor,
9586>18	leshort		45		Argonaut RISC Core, Argonaut Technologies Inc.,
9587>18	leshort		46		Renesas H8/300,
9588>18	leshort		47		Renesas H8/300H,
9589>18	leshort		48		Renesas H8S,
9590>18	leshort		49		Renesas H8/500,
9591>18	leshort		50		IA-64,
9592>18	leshort		51		Stanford MIPS-X,
9593>18	leshort		52		Motorola Coldfire,
9594>18	leshort		53		Motorola M68HC12,
9595>18	leshort		54		Fujitsu MMA,
9596>18	leshort		55		Siemens PCP,
9597>18	leshort		56		Sony nCPU,
9598>18	leshort		57		Denso NDR1,
9599>18	leshort		58		Start*Core,
9600>18	leshort		59		Toyota ME16,
9601>18	leshort		60		ST100,
9602>18	leshort		61		Tinyj emb.,
9603>18	leshort		62		x86-64,
9604>18	leshort		63		Sony DSP,
9605>18	leshort		64		DEC PDP-10,
9606>18	leshort		65		DEC PDP-11,
9607>18	leshort		66		FX66,
9608>18	leshort		67		ST9+ 8/16 bit,
9609>18	leshort		68		ST7 8 bit,
9610>18	leshort		69		MC68HC16,
9611>18	leshort		70		MC68HC11,
9612>18	leshort		71		MC68HC08,
9613>18	leshort		72		MC68HC05,
9614>18	leshort		73		SGI SVx or Cray NV1,
9615>18	leshort		74		ST19 8 bit,
9616>18	leshort		75		Digital VAX,
9617>18	leshort		76		Axis cris,
9618>18	leshort		77		Infineon 32-bit embedded,
9619>18	leshort		78		Element 14 64-bit DSP,
9620>18	leshort		79		LSI Logic 16-bit DSP,
9621>18	leshort		80		MMIX,
9622>18	leshort		81		Harvard machine-independent,
9623>18	leshort		82		SiTera Prism,
9624>18	leshort		83		Atmel AVR 8-bit,
9625>18	leshort		84		Fujitsu FR30,
9626>18	leshort		85		Mitsubishi D10V,
9627>18	leshort		86		Mitsubishi D30V,
9628>18	leshort		87		NEC v850,
9629>18	leshort		88		Renesas M32R,
9630>18	leshort		89		Matsushita MN10300,
9631>18	leshort		90		Matsushita MN10200,
9632>18	leshort		91		picoJava,
9633>18	leshort		92		OpenRISC,
9634>18	leshort		93		ARC Cores Tangent-A5,
9635>18	leshort		94		Tensilica Xtensa,
9636>18	leshort		95		Alphamosaic VideoCore,
9637>18	leshort		96		Thompson Multimedia,
9638>18	leshort		97		NatSemi 32k,
9639>18	leshort		98		Tenor Network TPC,
9640>18	leshort		99		Trebia SNP 1000,
9641>18	leshort		100		STMicroelectronics ST200,
9642>18	leshort		101		Ubicom IP2022,
9643>18	leshort		102		MAX Processor,
9644>18	leshort		103		NatSemi CompactRISC,
9645>18	leshort		104		Fujitsu F2MC16,
9646>18	leshort		105		TI msp430,
9647>18	leshort		106		Analog Devices Blackfin,
9648>18	leshort		107		S1C33 Family of Seiko Epson,
9649>18	leshort		108		Sharp embedded,
9650>18	leshort		109		Arca RISC,
9651>18	leshort		110		PKU-Unity Ltd.,
9652>18	leshort		111		eXcess: 16/32/64-bit,
9653>18	leshort		112		Icera Deep Execution Processor,
9654>18	leshort		113		Altera Nios II,
9655>18	leshort		114		NatSemi CRX,
9656>18	leshort		115		Motorola XGATE,
9657>18	leshort		116		Infineon C16x/XC16x,
9658>18	leshort		117		Renesas M16C series,
9659>18	leshort		118		Microchip dsPIC30F,
9660>18	leshort		119		Freescale RISC core,
9661>18	leshort		120		Renesas M32C series,
9662>18	leshort		131		Altium TSK3000 core,
9663>18	leshort		132		Freescale RS08,
9664>18	leshort		134		Cyan Technology eCOG2,
9665>18	leshort		135		Sunplus S+core7 RISC,
9666>18	leshort		136		New Japan Radio (NJR) 24-bit DSP,
9667>18	leshort		137		Broadcom VideoCore III,
9668>18	leshort		138		LatticeMico32,
9669>18	leshort		139		Seiko Epson C17 family,
9670>18	leshort		140		TI TMS320C6000 DSP family,
9671>18	leshort		141		TI TMS320C2000 DSP family,
9672>18	leshort		142		TI TMS320C55x DSP family,
9673>18	leshort		160		STMicroelectronics 64bit VLIW DSP,
9674>18	leshort		161		Cypress M8C,
9675>18	leshort		162		Renesas R32C series,
9676>18	leshort		163		NXP TriMedia family,
9677>18	leshort		164		QUALCOMM DSP6,
9678>18	leshort		165		Intel 8051 and variants,
9679>18	leshort		166		STMicroelectronics STxP7x family,
9680>18	leshort		167		Andes embedded RISC,
9681>18	leshort		168		Cyan eCOG1X family,
9682>18	leshort		169		Dallas MAXQ30,
9683>18	leshort		170		New Japan Radio (NJR) 16-bit DSP,
9684>18	leshort		171		M2000 Reconfigurable RISC,
9685>18	leshort		172		Cray NV2 vector architecture,
9686>18	leshort		173		Renesas RX family,
9687>18	leshort		174		META,
9688>18	leshort		175		MCST Elbrus,
9689>18	leshort		176		Cyan Technology eCOG16 family,
9690>18	leshort		177		NatSemi CompactRISC,
9691>18	leshort		178		Freescale Extended Time Processing Unit,
9692>18	leshort		179		Infineon SLE9X,
9693>18	leshort		180		Intel L1OM,
9694>18	leshort		181		Intel K1OM,
9695>18	leshort		183		ARM aarch64,
9696>18	leshort		185		Atmel 32-bit family,
9697>18	leshort		186		STMicroeletronics STM8 8-bit,
9698>18	leshort		187		Tilera TILE64,
9699>18	leshort		188		Tilera TILEPro,
9700>18	leshort		189		Xilinx MicroBlaze 32-bit RISC,
9701>18	leshort		190		NVIDIA CUDA architecture,
9702>18	leshort		191		Tilera TILE-Gx,
9703>18	leshort		197		Renesas RL78 family,
9704>18	leshort		199		Renesas 78K0R,
9705>18	leshort		200		Freescale 56800EX,
9706>18	leshort		201		Beyond BA1,
9707>18	leshort		202		Beyond BA2,
9708>18	leshort		203		XMOS xCORE,
9709>18	leshort		204		Microchip 8-bit PIC(r),
9710>18	leshort		210		KM211 KM32,
9711>18	leshort		211		KM211 KMX32,
9712>18	leshort		212		KM211 KMX16,
9713>18	leshort		213		KM211 KMX8,
9714>18	leshort		214		KM211 KVARC,
9715>18	leshort		215		Paneve CDP,
9716>18	leshort		216		Cognitive Smart Memory,
9717>18	leshort		217		iCelero CoolEngine,
9718>18	leshort		218		Nanoradio Optimized RISC,
9719>18	leshort		243		UCB RISC-V,
9720>18	leshort		247		eBPF,
9721>18	leshort		251             NEC VE,
9722>18	leshort		0x1057		AVR (unofficial),
9723>18	leshort		0x1059		MSP430 (unofficial),
9724>18	leshort		0x1223		Adapteva Epiphany (unofficial),
9725>18	leshort		0x2530		Morpho MT (unofficial),
9726>18	leshort		0x3330		FR30 (unofficial),
9727>18	leshort		0x3426		OpenRISC (obsolete),
9728>18	leshort		0x4688		Infineon C166 (unofficial),
9729>18	leshort		0x5441		Cygnus FRV (unofficial),
9730>18	leshort		0x5aa5		DLX (unofficial),
9731>18	leshort		0x7650		Cygnus D10V (unofficial),
9732>18	leshort		0x7676		Cygnus D30V (unofficial),
9733>18	leshort		0x8217		Ubicom IP2xxx (unofficial),
9734>18	leshort		0x8472		OpenRISC (obsolete),
9735>18	leshort		0x9025		Cygnus PowerPC (unofficial),
9736>18	leshort		0x9026		Alpha (unofficial),
9737>18	leshort		0x9041		Cygnus M32R (unofficial),
9738>18	leshort		0x9080		Cygnus V850 (unofficial),
9739>18	leshort		0xa390		IBM S/390 (obsolete),
9740>18	leshort		0xabc7		Old Xtensa (unofficial),
9741>18	leshort		0xad45		xstormy16 (unofficial),
9742>18	leshort		0xbaab		Old MicroBlaze (unofficial),,
9743>18	leshort		0xbeef		Cygnus MN10300 (unofficial),
9744>18	leshort		0xdead		Cygnus MN10200 (unofficial),
9745>18	leshort		0xf00d		Toshiba MeP (unofficial),
9746>18	leshort		0xfeb0		Renesas M32C (unofficial),
9747>18	leshort		0xfeba		Vitesse IQ2000 (unofficial),
9748>18	leshort		0xfebb		NIOS (unofficial),
9749>18	leshort		0xfeed		Moxie (unofficial),
9750>18	default		x
9751>>18	leshort		x		*unknown arch 0x%x*
9752>20	lelong		0		invalid version
9753>20	lelong		1		version 1
9754
97550	string		\177ELF		ELF
9756!:strength *2
9757>4	byte		0		invalid class
9758>4	byte		1		32-bit
9759>4	byte		2		64-bit
9760>5	byte		0		invalid byte order
9761>5	byte		1		LSB
9762>>0	use		elf-le
9763>5	byte		2		MSB
9764>>0	use		\^elf-le
9765>7	byte		0		(SYSV)
9766>7	byte		1		(HP-UX)
9767>7	byte		2		(NetBSD)
9768>7	byte		3		(GNU/Linux)
9769>7	byte		4		(GNU/Hurd)
9770>7	byte		5		(86Open)
9771>7	byte		6		(Solaris)
9772>7	byte		7		(Monterey)
9773>7	byte		8		(IRIX)
9774>7	byte		9		(FreeBSD)
9775>7	byte		10		(Tru64)
9776>7	byte		11		(Novell Modesto)
9777>7	byte		12		(OpenBSD)
9778>7	byte		13		(OpenVMS)
9779>7	byte		14		(HP NonStop Kernel)
9780>7	byte		15		(AROS Research Operating System)
9781>7	byte		16		(FenixOS)
9782>7	byte		17		(Nuxi CloudABI)
9783>7	byte		97		(ARM)
9784>7	byte		202		(Cafe OS)
9785>7	byte		255		(embedded)
9786
9787#------------------------------------------------------------------------------
9788# $File: encore,v 1.7 2014/04/30 21:41:02 christos Exp $
9789# encore:  file(1) magic for Encore machines
9790#
9791# XXX - needs to have the byte order specified (NS32K was little-endian,
9792# dunno whether they run the 88K in little-endian mode or not).
9793#
97940	short		0x154		Encore
9795>20	short		0x107		executable
9796>20	short		0x108		pure executable
9797>20	short		0x10b		demand-paged executable
9798>20	short		0x10f		unsupported executable
9799>12	long		>0		not stripped
9800>22	short		>0		- version %d
9801>22	short		0		-
9802#>4	date		x		stamp %s
98030	short		0x155		Encore unsupported executable
9804>12	long		>0		not stripped
9805>22	short		>0		- version %d
9806>22	short		0		-
9807#>4	date		x		stamp %s
9808
9809#------------------------------------------------------------------------------
9810# $File: epoc,v 1.9 2013/12/21 14:28:15 christos Exp $
9811# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1]
9812# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de>
9813# Useful information for improving this file can be found at:
9814# http://software.frodo.looijaard.name/psiconv/formats/Index.html
9815#------------------------------------------------------------------------------
98160	lelong		0x10000037	Psion Series 5
9817>4	lelong		0x10000039	font file
9818>4	lelong		0x1000003A	printer driver
9819>4	lelong		0x1000003B	clipboard
9820>4	lelong		0x10000042	multi-bitmap image
9821!:mime image/x-epoc-mbm
9822>4	lelong		0x1000006A	application information file
9823>4	lelong		0x1000006D
9824>>8	lelong		0x1000007D	Sketch image
9825!:mime image/x-epoc-sketch
9826>>8	lelong		0x1000007E	voice note
9827>>8	lelong		0x1000007F	Word file
9828!:mime application/x-epoc-word
9829>>8	lelong		0x10000085	OPL program (TextEd)
9830!:mime application/x-epoc-opl
9831>>8	lelong		0x10000087	Comms settings
9832>>8	lelong		0x10000088	Sheet file
9833!:mime application/x-epoc-sheet
9834>>8	lelong		0x100001C4	EasyFax initialisation file
9835>4	lelong		0x10000073	OPO module
9836!:mime application/x-epoc-opo
9837>4	lelong		0x10000074	OPL application
9838!:mime application/x-epoc-app
9839>4	lelong		0x1000008A	exported multi-bitmap image
9840>4	lelong		0x1000016D
9841>>8	lelong		0x10000087	Comms names
9842
98430	lelong		0x10000041	Psion Series 5 ROM multi-bitmap image
9844
98450	lelong		0x10000050	Psion Series 5
9846>4	lelong		0x1000006D	database
9847>>8	lelong		0x10000084	Agenda file
9848!:mime application/x-epoc-agenda
9849>>8	lelong		0x10000086	Data file
9850!:mime application/x-epoc-data
9851>>8	lelong		0x10000CEA	Jotter file
9852!:mime application/x-epoc-jotter
9853>4	lelong		0x100000E4	ini file
9854
98550	lelong		0x10000079	Psion Series 5 binary:
9856>4	lelong		0x00000000	DLL
9857>4	lelong		0x10000049	comms hardware library
9858>4	lelong		0x1000004A	comms protocol library
9859>4	lelong		0x1000005D	OPX
9860>4	lelong		0x1000006C	application
9861>4	lelong		0x1000008D	DLL
9862>4	lelong		0x100000AC	logical device driver
9863>4	lelong		0x100000AD	physical device driver
9864>4	lelong		0x100000E5	file transfer protocol
9865>4	lelong		0x100000E5	file transfer protocol
9866>4	lelong		0x10000140	printer definition
9867>4	lelong		0x10000141	printer definition
9868
98690	lelong		0x1000007A	Psion Series 5 executable
9870
9871#------------------------------------------------------------------------------
9872# $File: erlang,v 1.7 2019/04/19 00:42:27 christos Exp $
9873# erlang:  file(1) magic for Erlang JAM and BEAM files
9874# URL:  https://www.erlang.org/faq/x779.html#AEN812
9875
9876# OTP R3-R4
98770	string	\0177BEAM!	Old Erlang BEAM file
9878>6	short	>0		- version %d
9879
9880# OTP R5 and onwards
98810	string	FOR1
9882>8	string	BEAM		Erlang BEAM file
9883
9884# 4.2 version may have a copyright notice!
98854	string	Tue\ Jan\ 22\ 14:32:44\ MET\ 1991	Erlang JAM file - version 4.2
988679	string	Tue\ Jan\ 22\ 14:32:44\ MET\ 1991	Erlang JAM file - version 4.2
9887
98884	string	1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995	Erlang JAM file - version 4.3
9889
98900	bequad	0x0000000000ABCDEF	Erlang DETS file
9891
9892# $File: espressif,v 1.1 2018/11/20 18:57:17 christos Exp $
9893# configuration dump of Tasmota firmware for ESP8266 based devices by Espressif
9894# URL: https://github.com/arendst/Sonoff-Tasmota/
9895# Reference: https://codeload.github.com/arendst/Sonoff-Tasmota/zip/release-6.2/
9896# Sonoff-Tasmota-release-6.2.zip/Sonoff-Tasmota-release-6.2/sonoff/settings.h
9897# From: Joerg Jenderek
9898#
9899# cfg_holder=4617=0x1209
99000		uleshort	4617
9901# remainig settings normally 0x5A+offset XORed; free_1D5[20] empty since 5.12.0e
9902>0x1D5		ubequad		0x2f30313233343536	configuration of Tasmota firmware (ESP8266)
9903!:mime	application/x-tasmota-dmp
9904!:ext	dmp
9905# version like 6.2.1.0 ~ 0x06020100 XORed to 0x63666262
9906>>11		ubyte^0x65	x			\b, version %u
9907>>10		ubyte^0x64	x			\b.%u
9908>>9		ubyte^0x63	x			\b.%u
9909>>8		ubyte^0x62	x			\b.%u
9910#>8		ubelong		x			(0x%x)
9911# hostname[33] XORed
9912>>0x165		ubyte^0x1BF	x			\b, hostname %c
9913>>0x166		ubyte^0x1C0	>037			\b%c
9914>>0x167		ubyte^0x1C1	>037			\b%c
9915>>0x168		ubyte^0x1C2	>037			\b%c
9916>>0x169		ubyte^0x1C3	>037			\b%c
9917>>0x16A		ubyte^0x1C4	>037			\b%c
9918>>0x16B		ubyte^0x1C5	>037			\b%c
9919>>0x16C		ubyte^0x1C6	>037			\b%c
9920>>0x16D		ubyte^0x1C7	>037			\b%c
9921>>0x16E		ubyte^0x1C8	>037			\b%c
9922>>0x16F		ubyte^0x1C9	>037			\b%c
9923>>0x170		ubyte^0x1CA	>037			\b%c
9924>>0x171		ubyte^0x1CB	>037			\b%c
9925>>0x172		ubyte^0x1CC 	>037			\b%c
9926>>0x173		ubyte^0x1CD	>037			\b%c
9927>>0x174		ubyte^0x1CE	>037			\b%c
9928>>0x175		ubyte^0x1CF	>037			\b%c
9929>>0x176		ubyte^0x1D0	>037			\b%c
9930>>0x177		ubyte^0x1D1	>037			\b%c
9931>>0x178		ubyte^0x1D2	>037			\b%c
9932>>0x179		ubyte^0x1D3	>037			\b%c
9933>>0x17A		ubyte^0x1D4	>037			\b%c
9934>>0x17B		ubyte^0x1D5	>037			\b%c
9935>>0x17C		ubyte^0x1D6	>037			\b%c
9936>>0x17D		ubyte^0x1D7	>037			\b%c
9937>>0x17E		ubyte^0x1D8	>037			\b%c
9938>>0x17F		ubyte^0x1D9	>037			\b%c
9939>>0x180		ubyte^0x1DA	>037			\b%c
9940>>0x181		ubyte^0x1DB	>037			\b%c
9941>>0x182		ubyte^0x1DC	>037			\b%c
9942>>0x183		ubyte^0x1DD	>037			\b%c
9943>>0x184		ubyte^0x1DE	>037			\b%c
9944>>0x185		ubyte^0x1DF	>037			\b%c
9945#>>0x165		string		x			(%.33s)
9946
9947
9948
9949#------------------------------------------------------------------------------
9950# $File: esri,v 1.5 2019/04/19 00:42:27 christos Exp $
9951# ESRI Shapefile format (.shp .shx .dbf=DBaseIII)
9952# Based on info from
9953# <URL:https://www.esri.com/library/whitepapers/pdfs/shapefile.pdf>
99540	belong	9994	ESRI Shapefile
9955>4	belong	=0
9956>8	belong	=0
9957>12	belong	=0
9958>16	belong	=0
9959>20	belong	=0
9960>28	lelong	x	version %d
9961>24	belong	x	length %d
9962>32	lelong	=0	type Null Shape
9963>32	lelong	=1	type Point
9964>32	lelong	=3	type PolyLine
9965>32	lelong	=5	type Polygon
9966>32	lelong	=8	type MultiPoint
9967>32	lelong	=11	type PointZ
9968>32	lelong	=13	type PolyLineZ
9969>32	lelong	=15	type PolygonZ
9970>32	lelong	=18	type MultiPointZ
9971>32	lelong	=21	type PointM
9972>32	lelong	=23	type PolyLineM
9973>32	lelong	=25	type PolygonM
9974>32	lelong	=28	type MultiPointM
9975>32	lelong	=31	type MultiPatch
9976
9977#------------------------------------------------------------------------------
9978# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $
9979# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files
9980# From Roger Leigh <roger@whinlatter.uklinux.net>
99810       string          FCS1.0          Flow Cytometry Standard (FCS) data, version 1.0
99820       string          FCS2.0          Flow Cytometry Standard (FCS) data, version 2.0
99830       string          FCS3.0          Flow Cytometry Standard (FCS) data, version 3.0
9984
9985#------------------------------------------------------------------------------
9986# $File: filesystems,v 1.128 2019/04/23 15:43:27 christos Exp $
9987# filesystems:  file(1) magic for different filesystems
9988#
99890	name	partid
9990>0	ubyte	0x00	Unused
9991>0	ubyte	0x01	12-bit FAT
9992>0	ubyte	0x02	XENIX /
9993>0	ubyte	0x03	XENIX /usr
9994>0	ubyte	0x04	16-bit FAT, less than 32M
9995>0	ubyte	0x05	extended partition
9996>0	ubyte	0x06	16-bit FAT, more than 32M
9997>0	ubyte	0x07	OS/2 HPFS, NTFS, QNX2, Adv. UNIX
9998>0	ubyte	0x08	AIX or os, or etc.
9999>0	ubyte	0x09	AIX boot partition or Coherent
10000>0	ubyte	0x0a	O/2 boot manager or Coherent swap
10001>0	ubyte	0x0b	32-bit FAT
10002>0	ubyte	0x0c	32-bit FAT, LBA-mapped
10003>0	ubyte	0x0d	7XXX, LBA-mapped
10004>0	ubyte	0x0e	16-bit FAT, LBA-mapped
10005>0	ubyte	0x0f	extended partition, LBA-mapped
10006>0	ubyte	0x10	OPUS
10007>0	ubyte	0x11 	OS/2 DOS 12-bit FAT
10008>0	ubyte	0x12 	Compaq diagnostics
10009>0	ubyte	0x14 	OS/2 DOS 16-bit FAT <32M
10010>0	ubyte	0x16 	OS/2 DOS 16-bit FAT >=32M
10011>0	ubyte	0x17 	OS/2 hidden IFS
10012>0	ubyte	0x18 	AST Windows swapfile
10013>0	ubyte	0x19 	Willowtech Photon coS
10014>0	ubyte	0x1b 	hidden win95 fat 32
10015>0	ubyte	0x1c 	hidden win95 fat 32 lba
10016>0	ubyte	0x1d	hidden win95 fat 16 lba
10017>0	ubyte	0x20 	Willowsoft OFS1
10018>0	ubyte	0x21 	reserved
10019>0	ubyte	0x23 	reserved
10020>0	ubyte	0x24	NEC DOS
10021>0	ubyte	0x26 	reserved
10022>0	ubyte	0x31 	reserved
10023>0	ubyte	0x32	Alien Internet Services NOS
10024>0	ubyte	0x33 	reserved
10025>0	ubyte	0x34 	reserved
10026>0	ubyte	0x35 	JFS on OS2
10027>0	ubyte	0x36 	reserved
10028>0	ubyte	0x38 	Theos
10029>0	ubyte	0x39 	Plan 9, or Theos spanned
10030>0	ubyte	0x3a 	Theos ver 4 4gb partition
10031>0	ubyte	0x3b 	Theos ve 4 extended partition
10032>0	ubyte	0x3c 	PartitionMagic recovery
10033>0	ubyte	0x3d 	Hidden Netware
10034>0	ubyte	0x40 	VENIX 286 or LynxOS
10035>0	ubyte	0x41	PReP
10036>0	ubyte	0x42	linux swap sharing DRDOS disk
10037>0	ubyte	0x43	linux sharing DRDOS disk
10038>0	ubyte	0x44	GoBack change utility
10039>0	ubyte	0x45	Boot US Boot manager
10040>0	ubyte	0x46	EUMEL/Elan or Ergos 3
10041>0	ubyte	0x47	EUMEL/Elan or Ergos 3
10042>0	ubyte	0x48	EUMEL/Elan or Ergos 3
10043>0	ubyte	0x4a	ALFX/THIN filesystem for DOS
10044>0	ubyte	0x4c	Oberon partition
10045>0	ubyte	0x4d 	QNX4.x
10046>0	ubyte	0x4e 	QNX4.x 2nd part
10047>0	ubyte	0x4f 	QNX4.x 3rd part
10048>0	ubyte	0x50 	DM (disk manager)
10049>0	ubyte	0x51 	DM6 Aux1 (or Novell)
10050>0	ubyte	0x52 	CP/M or Microport SysV/AT
10051>0	ubyte	0x53 	DM6 Aux3
10052>0	ubyte	0x54	DM6 DDO
10053>0	ubyte	0x55	EZ-Drive (disk manager)
10054>0	ubyte	0x56	Golden Bow (disk manager)
10055>0	ubyte	0x57	Drive PRO
10056>0	ubyte	0x5c	Priam Edisk (disk manager)
10057>0	ubyte	0x61	SpeedStor
10058>0	ubyte	0x63	GNU HURD or Mach or Sys V/386
10059>0	ubyte	0x64	Novell Netware 2.xx or Speedstore
10060>0	ubyte	0x65	Novell Netware 3.xx
10061>0	ubyte	0x66	Novell 386 Netware
10062>0	ubyte	0x67	Novell
10063>0	ubyte	0x68	Novell
10064>0	ubyte	0x69	Novell
10065>0	ubyte	0x70	DiskSecure Multi-Boot
10066>0	ubyte	0x71	reserved
10067>0	ubyte	0x73	reserved
10068>0	ubyte	0x74	reserved
10069>0	ubyte	0x75	PC/IX
10070>0	ubyte	0x76	reserved
10071>0	ubyte	0x77	M2FS/M2CS partition
10072>0	ubyte	0x78	XOSL boot loader filesystem
10073>0	ubyte	0x80	MINIX until 1.4a
10074>0	ubyte	0x81	MINIX since 1.4b
10075>0	ubyte	0x82	Linux swap or Solaris
10076>0	ubyte	0x83	Linux native
10077>0	ubyte	0x84	OS/2 hidden C: drive
10078>0	ubyte	0x85	Linux extended partition
10079>0	ubyte	0x86	NT FAT volume set
10080>0	ubyte	0x87	NTFS volume set or HPFS mirrored
10081>0	ubyte	0x8a	Linux Kernel AiR-BOOT partition
10082>0	ubyte	0x8b	Legacy Fault tolerant FAT32
10083>0	ubyte	0x8c	Legacy Fault tolerant FAT32 ext
10084>0	ubyte	0x8d	Hidden free FDISK FAT12
10085>0	ubyte	0x8e	Linux Logical Volume Manager
10086>0	ubyte	0x90	Hidden free FDISK FAT16
10087>0	ubyte	0x91	Hidden free FDISK DOS EXT
10088>0	ubyte	0x92	Hidden free FDISK FAT16 Big
10089>0	ubyte	0x93	Amoeba filesystem
10090>0	ubyte	0x94	Amoeba bad block table
10091>0	ubyte	0x95	MIT EXOPC native partitions
10092>0	ubyte	0x97	Hidden free FDISK FAT32
10093>0	ubyte	0x98	Datalight ROM-DOS Super-Boot
10094>0	ubyte	0x99	Mylex EISA SCSI
10095>0	ubyte	0x9a	Hidden free FDISK FAT16 LBA
10096>0	ubyte	0x9b	Hidden free FDISK EXT LBA
10097>0	ubyte	0x9f	BSDI?
10098>0	ubyte	0xa0	IBM Thinkpad hibernation
10099>0	ubyte	0xa1	HP Volume expansion (SpeedStor)
10100>0	ubyte	0xa3	HP Volume expansion (SpeedStor)
10101>0	ubyte	0xa4	HP Volume expansion (SpeedStor)
10102>0	ubyte	0xa5	386BSD partition type
10103>0	ubyte	0xa6	OpenBSD partition type
10104>0	ubyte	0xa7	NeXTSTEP 486
10105>0	ubyte	0xa8	Apple UFS
10106>0	ubyte	0xa9	NetBSD partition type
10107>0	ubyte	0xaa	Olivetty Fat12 1.44MB Service part
10108>0	ubyte	0xab	Apple Boot
10109>0	ubyte	0xae	SHAG OS filesystem
10110>0	ubyte	0xaf	Apple HFS
10111>0	ubyte	0xb0	BootStar Dummy
10112>0	ubyte	0xb1	reserved
10113>0	ubyte	0xb3	reserved
10114>0	ubyte	0xb4	reserved
10115>0	ubyte	0xb6	reserved
10116>0	ubyte	0xb7	BSDI BSD/386 filesystem
10117>0	ubyte	0xb8	BSDI BSD/386 swap
10118>0	ubyte	0xbb	Boot Wizard Hidden
10119>0	ubyte	0xbe	Solaris 8 partition type
10120>0	ubyte	0xbf	Solaris partition type
10121>0	ubyte	0xc0 	CTOS
10122>0	ubyte	0xc1 	DRDOS/sec (FAT-12)
10123>0	ubyte	0xc2 	Hidden Linux
10124>0	ubyte	0xc3 	Hidden Linux swap
10125>0	ubyte	0xc4 	DRDOS/sec (FAT-16, < 32M)
10126>0	ubyte	0xc5 	DRDOS/sec (EXT)
10127>0	ubyte	0xc6 	DRDOS/sec (FAT-16, >= 32M)
10128>0	ubyte	0xc7 	Syrinx (Cyrnix?) or HPFS disabled
10129>0	ubyte	0xc8 	Reserved for DR-DOS 8.0+
10130>0	ubyte	0xc9 	Reserved for DR-DOS 8.0+
10131>0	ubyte	0xca 	Reserved for DR-DOS 8.0+
10132>0	ubyte	0xcb 	DR-DOS 7.04+ Secured FAT32 CHS
10133>0	ubyte	0xcc 	DR-DOS 7.04+ Secured FAT32 LBA
10134>0	ubyte	0xcd	CTOS Memdump
10135>0	ubyte	0xce 	DR-DOS 7.04+ FAT16X LBA
10136>0	ubyte	0xcf 	DR-DOS 7.04+ EXT LBA
10137>0	ubyte	0xd0 	REAL/32 secure big partition
10138>0	ubyte	0xd1 	Old Multiuser DOS FAT12
10139>0	ubyte	0xd4 	Old Multiuser DOS FAT16 Small
10140>0	ubyte	0xd5 	Old Multiuser DOS Extended
10141>0	ubyte	0xd6 	Old Multiuser DOS FAT16 Big
10142>0	ubyte	0xd8 	CP/M 86
10143>0	ubyte	0xdb 	CP/M or Concurrent CP/M
10144>0	ubyte	0xdd 	Hidden CTOS Memdump
10145>0	ubyte	0xde 	Dell PowerEdge Server utilities
10146>0	ubyte	0xdf 	DG/UX virtual disk manager
10147>0	ubyte	0xe0 	STMicroelectronics ST AVFS
10148>0	ubyte	0xe1 	DOS access or SpeedStor 12-bit
10149>0	ubyte	0xe3 	DOS R/O or Storage Dimensions
10150>0	ubyte	0xe4 	SpeedStor 16-bit FAT < 1024 cyl.
10151>0	ubyte	0xe5	reserved
10152>0	ubyte	0xe6	reserved
10153>0	ubyte	0xeb 	BeOS
10154>0	ubyte	0xee	GPT Protective MBR
10155>0	ubyte	0xef	EFI system partition
10156>0	ubyte	0xf0 	Linux PA-RISC boot loader
10157>0	ubyte	0xf1 	SpeedStor or Storage Dimensions
10158>0	ubyte	0xf2 	DOS 3.3+ Secondary
10159>0	ubyte	0xf3	reserved
10160>0	ubyte	0xf4	SpeedStor large partition
10161>0	ubyte	0xf5	Prologue multi-volumen partition
10162>0	ubyte	0xf6 	reserved
10163>0	ubyte	0xf9 	pCache: ext2/ext3 persistent cache
10164>0	ubyte	0xfa 	Bochs x86 emulator
10165>0	ubyte	0xfb 	VMware File System
10166>0	ubyte	0xfc 	VMware Swap
10167>0	ubyte	0xfd 	Linux RAID partition persistent sb
10168>0	ubyte	0xfe	LANstep or IBM PS/2 IML
10169>0	ubyte	0xff 	Xenix Bad Block Table
10170
101710	string	\366\366\366\366	PC formatted floppy with no filesystem
10172# Sun disk labels
10173# From /usr/include/sun/dklabel.h:
101740774	beshort		0xdabe
10175# modified by Joerg Jenderek, because original test
10176# succeeds for Cabinet archive dao360.dl_ with negative blocks
10177>0770	long		>0		Sun disk label
10178>>0	string		x		'%s
10179>>>31	string		>\0		\b%s
10180>>>>63	string		>\0		\b%s
10181>>>>>95	string		>\0		\b%s
10182>>0	string		x		\b'
10183>>0734	short		>0		%d rpm,
10184>>0736	short		>0		%d phys cys,
10185>>0740	short		>0		%d alts/cyl,
10186>>0746	short		>0		%d interleave,
10187>>0750	short		>0		%d data cyls,
10188>>0752	short		>0		%d alt cyls,
10189>>0754	short		>0		%d heads/partition,
10190>>0756	short		>0		%d sectors/track,
10191>>0764	long		>0		start cyl %d,
10192>>0770	long		x		%d blocks
10193# Is there a boot block written 1 sector in?
10194>512    belong&077777777	0600407	\b, boot block present
10195
10196# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk
10197# (http://btmgr.sourceforge.net/docs/user-guide-3.html)
101980		string	SBMBAKUP_	Smart Boot Manager backup file
10199>9		string	x		\b, version %-5.5s
10200>>14		string	=_
10201>>>15		string	x		%-.1s
10202>>>>16		string	=_		\b.
10203>>>>>17		string	x		\b%-.1s
10204>>>>>>18	string	=_		\b.
10205>>>>>>>19	string	x		\b%-.1s
10206>>>22		ubyte	0
10207>>>>21		ubyte	x		\b, from drive 0x%x
10208>>>22		ubyte	>0
10209>>>>21		string	x		\b, from drive %s
10210>>>535		search/17	\x55\xAA
10211>>>>&-512	indirect	x	\b; contains
10212
10213# updated by Joerg Jenderek at Nov 2012
10214# DOS Emulator image is 128 byte, null right padded header + harddisc image
102150	string	DOSEMU\0
10216>0x27E	leshort	0xAA55
10217#offset is 128
10218>>19	ubyte	128
10219>>>(19.b-1)	ubyte	0x0	DOS Emulator image
10220>>>>7	ulelong	>0		\b, %u heads
10221>>>>11	ulelong	>0		\b, %d sectors/track
10222>>>>15	ulelong	>0		\b, %d cylinders
10223>>>>128	indirect	x	\b; contains
10224
10225# added by Joerg Jenderek at Nov 2012
10226# http://www.thenakedpc.com/articles/v04/08/0408-05.html
10227# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data
102280	string	PNCIHISK\0		Norton Utilities disc image data
10229# real x86 boot sector with jump instruction
10230>509	search/1026	\x55\xAA\xeb
10231>>&-1	indirect	x		\b; contains
10232# http://file-extension.net/seeker/file_extension_dat
102330	string	PNCIUNDO		Norton Disk Doctor UnDo file
10234#
10235
10236# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013
10237# for any allowed sector sizes
1023830		search/481	\x55\xAA
10239# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
10240# DOS BPB information (70) and after DOS floppy (120) like in previous file version
10241!:strength +65
10242# for sector sizes < 512 Bytes
10243>11		uleshort	<512
10244>>(11.s-2)	uleshort	0xAA55		DOS/MBR boot sector
10245# for sector sizes with 512 or more Bytes
10246>0x1FE		leshort		0xAA55		DOS/MBR boot sector
10247
10248# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying
10249# only for sector sizes with 512 or more Bytes
102500x1FE          leshort         0xAA55         	DOS/MBR boot sector
10251#
10252# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
10253!:strength +65
10254>2		string		OSBS		OS/BS MBR
10255# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/
10256# and https://en.wikipedia.org/wiki/Master_Boot_Record
10257# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
10258# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00
10259>0	search/2	\x33\xc0\x8e\xd0\xbc\x00\x7c	MS-MBR
10260# Microsoft Windows 95A and early ( https://thestarman.pcministry.com/asm/mbr/STDMBR.htm )
10261# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld
10262>>8	ubequad		0x8bf45007501ffbfc
10263# https://thestarman.pcministry.com/asm/mbr/200MBR.htm
10264>>>0x16	ubyte		0xF3				\b,DOS 2
10265>>>>219	regex		Author\ -\ 			Author:
10266# found "David Litton" , "A Pehrsson  "
10267>>>>>&0	string		x				"%s"
10268>>>0x16	ubyte		0xF2
10269# NEC MS-DOS 3.30 Rev. 3 . See https://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm
10270# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz
10271>>>>0x22	ubequad	0xbf7c07813d5aa575		\b,NEC 3.3
10272# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111)
10273>>>>0x22	default	x				\b,D0S version 3.3-7.0
10274# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...)
10275# where nn is string offset varying for different languages
10276# "Invalid partition table"				nn=0x8b for english version
10277>>>>>(0x49.b)	string		Invalid\ partition\ table		english
10278>>>>>(0x49.b)	string		Ung\201ltige\ Partitionstabelle		german
10279>>>>>(0x49.b)	string		Table\ de\ partition\ invalide		french
10280>>>>>(0x49.b)	string		Tabela\ de\ parti\207ao\ inv\240lida	portuguese
10281>>>>>(0x49.b)	string		Tabla\ de\ partici\242n\ no\ v\240lida	spanish
10282>>>>>(0x49.b)	string		Tavola\ delle\ partizioni\ non\ valida	italian
10283>>>>>0x49	ubyte		>0			at offset 0x%x
10284>>>>>>(0x49.b)	string		>\0			"%s"
10285# "Error loading operating system"			nn=0xa3 for english version
10286# "Fehler beim Laden des Betriebssystems"		nn=0xa7 for german version
10287# "Erreur en chargeant syst\212me d'exploitation"	nn=0xa7 for french version
10288# "Erro na inicializa\207ao do sistema operacional"	nn=0xa7 for portuguese Brazilian version
10289# "Error al cargar sistema operativo"			nn=0xa8 for spanish version
10290# "Errore durante il caricamento del sistema operativo"	nn=0xae for italian version
10291>>>>>0x74	ubyte		>0			at offset 0x%x
10292>>>>>>(0x74.b)	string		>\0			"%s"
10293# "Missing operating system"				nn=0xc2 for english version
10294# "Betriebssystem fehlt"				nn=0xcd for german version
10295# "Syst\212me d'exploitation absent"			nn=0xd2 for french version
10296# "Sistema operacional nao encontrado"			nn=0xd4 for portuguese Brazilian version
10297# "Falta sistema operativo"				nn=0xca for spanish version
10298# "Sistema operativo mancante"				nn=0xe2 for italian version
10299>>>>>0x79	ubyte		>0			at offset 0x%x
10300>>>>>>(0x79.b)	string		>\0			"%s"
10301# Microsoft Windows 95B to XP (https://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
10302# assembler instructions: push ax;pop es;push  ax;pop ds;cld;mov si,7c1b
10303>>8	ubequad		0x5007501ffcbe1b7c
10304# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04
10305>>>24		ubequad	0xf3a4cbbebe07b104		9M
10306# "Invalid partition table"				nn=0x10F for english version
10307# "Ung\201ltige Partitionstabelle"				nn=0x10F for german version
10308# "Table de partition erron\202e"				nn=0x10F for french version
10309# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240"	nn=0x10F for russian version
10310>>>>(0x3C.b+0x0FF)	string	Invalid\ partition\ table		english
10311>>>>(0x3C.b+0x0FF)	string	Ung\201ltige\ Partitionstabelle		german
10312>>>>(0x3C.b+0x0FF)	string	Table\ de\ partition\ erron\202e	french
10313>>>>(0x3C.b+0x0FF)	string	\215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240	russian
10314>>>>0x3C		ubyte	x			at offset 0x%x+0xFF
10315>>>>(0x3C.b+0x0FF)	string	>\0			"%s"
10316# "Error loading operating system"			nn=0x127 for english version
10317# "Fehler beim Laden des Betriebssystems"		nn=0x12b for german version
10318# "Erreur lors du chargement du syst\212me d'exploitation"	nn=0x12a for french version
10319# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353"	nn=0x12d for russian version
10320>>>>0xBD		ubyte	x			at offset 0x1%x
10321>>>>(0xBD.b+0x100)	string	>\0			"%s"
10322# "Missing operating system"				nn=0x146 for english version
10323# "Betriebssystem fehlt"				nn=0x151 for german version
10324# "Syst\212me d'exploitation manquant"			nn=0x15e for french version
10325# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240"	nn=0x156 for russian version
10326>>>>0xA9		ubyte	x			at offset 0x1%x
10327>>>>(0xA9.b+0x100)	string	>\0			"%s"
10328# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm
10329# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04
10330>>>24		ubequad	0xf3a4cbbdbe07b104		XP
10331# where xxyyzz are lower bits from offsets of error messages varying for different languages
10332>>>>0x1B4	ubelong&0x00FFFFFF	0x002c4463	english
10333>>>>0x1B4	ubelong&0x00FFFFFF	0x002c486e	german
10334# "Invalid partition table"				xx=0x12C for english version
10335# "Ung\201ltige Partitionstabelle"				xx=0x12C for german version
10336>>>>0x1b5	ubyte		>0			at offset 0x1%x
10337>>>>(0x1b5.b+0x100)	string	>\0			"%s"
10338# "Error loading operating system"			yy=0x144 for english version
10339# "Fehler beim Laden des Betriebssystems"		yy=0x148 for german version
10340>>>>0x1b6	ubyte		>0			at offset 0x1%x
10341>>>>(0x1b6.b+0x100)	string	>\0			"%s"
10342# "Missing operating system"				zz=0x163 for english version
10343# "Betriebssystem nicht vorhanden"			zz=0x16e for german version
10344>>>>0x1b7	ubyte		>0			at offset 0x1%x
10345>>>>(0x1b7.b+0x100)	string	>\0			"%s"
10346# Microsoft Windows Vista or 7
10347# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00
10348>>8	ubequad		0xc08ed8be007cbf00
10349# Microsoft Windows Vista (https://thestarman.pcministry.com/asm/mbr/VistaMBR.htm)
10350# assembler instructions: jnz 0729;cmp ebx,"TCPA"
10351>>>0xEC		ubequad	0x753b6681fb544350		Vista
10352# where xxyyzz are lower bits from offsets of error messages varying for different languages
10353>>>>0x1B4	ubelong&0x00FFFFFF	0x00627a99	english
10354#>>>>0x1B4	ubelong&0x00FFFFFF	?		german
10355# "Invalid partition table"				xx=0x162 for english version
10356# "Ung\201ltige Partitionstabelle"				xx=0x1?? for german version
10357>>>>0x1b5	ubyte		>0			at offset 0x1%x
10358>>>>(0x1b5.b+0x100)	string	>\0			"%s"
10359# "Error loading operating system"			yy=0x17a for english version
10360# "Fehler beim Laden des Betriebssystems"		yy= 0x1?? for german version
10361>>>>0x1b6	ubyte		>0			at offset 0x1%x
10362>>>>(0x1b6.b+0x100)	string	>\0			"%s"
10363# "Missing operating system"				zz=0x199 for english version
10364# "Betriebssystem nicht vorhanden"			zz=0x1?? for german version
10365>>>>0x1b7	ubyte		>0			at offset 0x1%x
10366>>>>(0x1b7.b+0x100)	string	>\0			"%s"
10367# Microsoft Windows 7 (https://thestarman.pcministry.com/asm/mbr/W7MBR.htm)
10368# assembler instructions: cmp ebx,"TCPA";cmp
10369>>>0xEC		ubequad	0x6681fb5443504175		Windows 7
10370# where xxyyzz are lower bits from offsets of error messages varying for different languages
10371>>>>0x1B4	ubelong&0x00FFFFFF	0x00637b9a	english
10372#>>>>0x1B4	ubelong&0x00FFFFFF	?		german
10373# "Invalid partition table"				xx=0x163 for english version
10374# "Ung\201ltige Partitionstabelle"				xx=0x1?? for german version
10375>>>>0x1b5	ubyte		>0			at offset 0x1%x
10376>>>>(0x1b5.b+0x100)	string	>\0			"%s"
10377# "Error loading operating system"			yy=0x17b for english version
10378# "Fehler beim Laden des Betriebssystems"		yy=0x1?? for german version
10379>>>>0x1b6	ubyte		>0			at offset 0x1%x
10380>>>>(0x1b6.b+0x100)	string	>\0			"%s"
10381# "Missing operating system"				zz=0x19a for english version
10382# "Betriebssystem nicht vorhanden"			zz=0x1?? for german version
10383>>>>0x1b7	ubyte		>0			at offset 0x1%x
10384>>>>(0x1b7.b+0x100)	string	>\0			"%s"
10385# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs
10386# https://en.wikipedia.org/wiki/MBR_disk_signature#ID
10387>>0x1b8	ulelong		>0				\b, disk signature 0x%-.4x
10388# driveID/timestamp for Win 95B,98,98SE and ME. See https://thestarman.pcministry.com/asm/mbr/mystery.htm
10389>>0xDA	uleshort		0
10390>>>0xDC 	ulelong		>0			\b, created
10391# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive
10392>>>>0xDC	ubyte		x			with driveID 0x%x
10393# hours, minutes and seconds
10394>>>>0xDf	ubyte		x			at %x
10395>>>>0xDe	ubyte		x			\b:%x
10396>>>>0xDd	ubyte		x			\b:%x
10397# special case for Microsoft MS-DOS 3.21 spanish
10398# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov
10399>0	ubequad		0xfab830008ed0bc00
10400# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov
10401>>8	ubequad		0x1fbfcb800008ed8		MS-MBR,D0S version 3.21 spanish
10402# Microsoft MBR IPL end
10403
10404# dr-dos with some upper-, lowercase variants
10405>0x9D	string	Invalid\ partition\ table$
10406>>181	string	No\ Operating\ System$
10407>>>201	string	Operating\ System\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
10408>0x9D	string	Invalid\ partition\ table$
10409>>181	string	No\ operating\ system$
10410>>>201	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
10411>342	string	Invalid\ partition\ table$
10412>>366	string	No\ operating\ system$
10413>>>386	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, version 7.01 to 7.03
10414>295	string	NEWLDR\0
10415>>302	string	Bad\ PT\ $
10416>>>310	string	No\ OS\ $
10417>>>>317	string	OS\ load\ err$
10418>>>>>329	string	Moved\ or\ missing\ IBMBIO.LDR\n\r
10419>>>>>>358	string	Press\ any\ key\ to\ continue.\n\r$
10420>>>>>>>387	string	Copyright\ (c)\ 1984,1998
10421>>>>>>>>411	string	Caldera\ Inc.\0		\b, DR-DOS MBR (IBMBIO.LDR)
10422#
10423# tests for different MS-DOS Master Boot Records (MBR) moved and merged
10424#
10425#>0x145	string	Default:\ F				\b, FREE-DOS MBR
10426#>0x14B	string	Default:\ F				\b, FREE-DOS 1.0 MBR
10427>0x145	search/7	Default:\ F			\b, FREE-DOS MBR
10428#>>313		string	F0\ .\ .\ .
10429#>>>322		string	disk\ 1
10430#>>>>382	string	FAT3
10431>64	string	no\ active\ partition\ found
10432>>96	string	read\ error\ while\ reading\ drive	\b, FREE-DOS Beta 0.9 MBR
10433# Ranish Partition Manager http://www.ranish.com/part/
10434>387	search/4	\0\ Error!\r
10435>>378	search/7	Virus!
10436>>>397	search/4	Booting\040
10437>>>>408	search/4	HD1/\0	 			\b, Ranish MBR (
10438>>>>>416	string	Writing\ changes...		\b2.37
10439>>>>>>438	ubyte		x			\b,0x%x dots
10440>>>>>>440	ubyte		>0			\b,virus check
10441>>>>>>441	ubyte		>0			\b,partition %c
10442#2.38,2.42,2.44
10443>>>>>416	string	!Writing\ changes...		\b
10444>>>>>>418	ubyte	1				\bvirus check,
10445>>>>>>419	ubyte	x				\b0x%x seconds
10446>>>>>>420	ubyte&0x0F	>0			\b,partition
10447>>>>>>>420	ubyte&0x0F	<5			\b %x
10448>>>>>>>420	ubyte&0x0F	0Xf			\b ask
10449>>>>>420	ubyte		x			\b)
10450#
10451# SYSLINUX MBR moved
10452# https://www.acronis.de/
10453>362	string	MBR\ Error\ \0\r
10454>>376	string	ress\ any\ key\ to\040
10455>>>392	string	boot\ from\ floppy...\0			\b, Acronis MBR
10456# added by Joerg Jenderek
10457# https://www.visopsys.org/
10458# https://partitionlogic.org.uk/
10459>309	string	No\ bootable\ partition\ found\r
10460>>339	string	I/O\ Error\ reading\ boot\ sector\r	\b, Visopsys MBR
10461>349	string	No\ bootable\ partition\ found\r
10462>>379	string	I/O\ Error\ reading\ boot\ sector\r	\b, simple Visopsys MBR
10463# bootloader, bootmanager
10464>0x40	string	SBML
10465# label with 11 characters of FAT 12 bit filesystem
10466>>43	string	SMART\ BTMGR
10467>>>430	string	SBMK\ Bad!\r			\b, Smart Boot Manager
10468# OEM-ID not always "SBM"
10469#>>>>3	strings	SBM
10470>>>>6	string	>\0                             \b, version %s
10471>382	string	XOSLLOADXCF			\b, eXtended Operating System Loader
10472>6	string	LILO				\b, LInux i386 boot LOader
10473>>120	string	LILO				\b, version 22.3.4 SuSe
10474>>172	string	LILO				\b, version 22.5.8 Debian
10475# updated by Joerg Jenderek at Oct 2008
10476# variables according to grub-0.97/stage1/stage1.S or
10477# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data
10478# usual values are marked with comments to get only informations of strange GRUB loaders
10479>342		search/60	\0Geom\0
10480#>0		ulelong		x		%x=0x009048EB ,	0x2a9048EB  0
10481>>0x41		ubyte		<2
10482>>>0x3E		ubyte		>2		\b; GRand Unified Bootloader
10483# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
10484>>>>0x3E	ubyte		x		\b, stage1 version 0x%x
10485#If it is 0xFF, use a drive passed by BIOS
10486>>>>0x40	ubyte		<0xFF		\b, boot drive 0x%x
10487# in most case 0,1,0x2e for GRUB 0.5.95
10488>>>>0x41	ubyte		>0		\b, LBA flag 0x%x
10489>>>>0x42	uleshort	<0x8000		\b, stage2 address 0x%x
10490#>>>>0x42	uleshort	=0x8000		\b, stage2 address 0x%x (usual)
10491>>>>0x42	uleshort	>0x8000		\b, stage2 address 0x%x
10492#>>>>0x44	ulelong		=1		\b, 1st sector stage2 0x%x (default)
10493>>>>0x44	ulelong		>1		\b, 1st sector stage2 0x%x
10494>>>>0x48	uleshort	<0x800		\b, stage2 segment 0x%x
10495#>>>>0x48	uleshort	=0x800		\b, stage2 segment 0x%x (usual)
10496>>>>0x48	uleshort	>0x800		\b, stage2 segment 0x%x
10497>>>>402		string	Geom\0Hard\ Disk\0Read\0\ Error\0
10498>>>>>394	string	stage1			\b, GRUB version 0.5.95
10499>>>>382		string	Geom\0Hard\ Disk\0Read\0\ Error\0
10500>>>>>376	string	GRUB\ \0		\b, GRUB version 0.93 or 1.94
10501>>>>383		string	Geom\0Hard\ Disk\0Read\0\ Error\0
10502>>>>>377	string	GRUB\ \0		\b, GRUB version 0.94
10503>>>>385		string	Geom\0Hard\ Disk\0Read\0\ Error\0
10504>>>>>379	string	GRUB\ \0		\b, GRUB version 0.95 or 0.96
10505>>>>391		string	Geom\0Hard\ Disk\0Read\0\ Error\0
10506>>>>>385	string	GRUB\ \0		\b, GRUB version 0.97
10507# unknown version
10508>>>343		string	Geom\0Read\0\ Error\0
10509>>>>321		string	Loading\ stage1.5	\b, GRUB version x.y
10510>>>380		string	Geom\0Hard\ Disk\0Read\0\ Error\0
10511>>>>374		string	GRUB\ \0		\b, GRUB version n.m
10512# SYSLINUX bootloader moved
10513>395	string	chksum\0\ ERROR!\0		\b, Gujin bootloader
10514# http://www.bcdwb.de/bcdw/index_e.htm
10515>3	string	BCDL
10516>>498	string	BCDL\ \ \ \ BIN			\b, Bootable CD Loader (1.50Z)
10517# mbr partition table entries updated by Joerg Jenderek at Sep 2013
10518# skip Norton Utilities disc image data
10519>3		string		!IHISK
10520# skip Linux style boot sector starting with assember instructions mov 0x7c0,ax;
10521>>0		belong		!0xb8c0078e
10522# not Linux kernel
10523>>>514		string		!HdrS
10524# not BeOS
10525>>>>422		string		!Be\ Boot\ Loader
10526# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr
10527>>>>>0		ubelong&0xFD000000	=0xE9000000
10528# AdvanceMAME mbr
10529>>>>>>(1.b+2)	ubequad		0xfa31c08ed88ec08e
10530>>>>>>>446	use		partition-table
10531# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader
10532>>>>>0		ubelong&0xFD000000	!0xE9000000
10533# skip FSInfosector
10534>>>>>>0		string		!RRaA
10535# skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX,
10536# https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm
10537>>>>>>>0	ubequad		!0xfa660fb64610668b
10538# skip 13rd sector of MS x86 bootloader
10539>>>>>>>>0	ubequad		!0x660fb64610668b4e
10540# skip sector starting with DOS new line
10541>>>>>>>>>0	string		!\r\n
10542# allowed active flag 0,80h-FFh
10543>>>>>>>>>>446	ubyte		0
10544>>>>>>>>>>>446	use		partition-table
10545>>>>>>>>>>446	ubyte		>0x7F
10546>>>>>>>>>>>446	use		partition-table
10547# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries
10548# mbr partition table entries end
10549# https://www.acronis.de/
10550#FAT label=ACRONIS\ SZ
10551#OEM-ID=BOOTWIZ0
10552>442	string	Non-system\ disk,\040
10553>>459	string	press\ any\ key...\x7\0		\b, Acronis Startup Recovery Loader
10554# updated by Joerg Jenderek at Nov 2012, Sep 2013
10555# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
10556# display 1 space
10557>>>447	ubyte	x		\b
10558>>>477	use	DOS-filename
10559#
10560>185	string	FDBOOT\ Version\040
10561>>204	string	\rNo\ Systemdisk.\040
10562>>>220	string	Booting\ from\ harddisk.\n\r
10563>>>245	string	Cannot\ load\ from\ harddisk.\n\r
10564>>>>273 string	Insert\ Systemdisk\040
10565>>>>>291 string and\ press\ any\ key.\n\r		\b, FDBOOT harddisk Bootloader
10566>>>>>>200 string	>\0                             \b, version %-3s
10567>242	string	Bootsector\ from\ C.H.\ Hochst\204
10568# http://freecode.com/projects/dosfstools	dosfstools-n.m/src/mkdosfs.c
10569# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string
10570# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut
10571>242	search/127	Bootsector\ from\ C.H.\ Hochst
10572>>278	search/127	No\ Systemdisk.\ Booting\ from\ harddisk
10573# followed by variants with point,CR-NL or NL-CR
10574>>>208	search/261	Cannot\ load\ from\ harddisk.
10575# followed by variants CR-NL or NL-CR
10576>>>>236	search/235	Insert\ Systemdisk\ and\ press\ any\ key.
10577# followed by variants with point,CR-NL or NL-CR
10578>>>>>180	search/96	Disk\ formatted\ with\ WinImage\ 	\b, WinImage harddisk Bootloader
10579# followed by string like "6.50 (c) 1993-2004 Gilles Vollant"
10580>>>>>>&0	string		x 					\b, version %-4.4s
10581>(1.b+2)	ubyte		0xe
10582>>(1.b+3)	ubyte		0x1f
10583>>>(1.b+4)	ubyte		0xbe
10584# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others
10585>>>>(1.b+5)	ubyte&0xd3	0x53
10586>>>>>(1.b+6)	ubyte		0x7c
10587# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah,
10588>>>>>>(1.b+7)	ubyte		0xac
10589>>>>>>>(1.b+8)	ubyte		0x22
10590>>>>>>>>(1.b+9)	ubyte		0xc0
10591>>>>>>>>>(1.b+10)	ubyte	0x74
10592>>>>>>>>>>(1.b+11)	ubyte	0x0b
10593>>>>>>>>>>>(1.b+12)	ubyte	0x56
10594>>>>>>>>>>>>(1.b+13)	ubyte	0xb4			\b, mkdosfs boot message display
10595# FAT1X version
10596>>>>>>>>>>>>>(1.b+5)	ubyte	0x5b
10597>>>>>>>>>>>>>>0x5b	string	>\0			"%-s"
10598# FAT32 version
10599>>>>>>>>>>>>>(1.b+5)	ubyte	0x77
10600>>>>>>>>>>>>>>0x77	string	>\0			"%-s"
10601>214	string	Please\ try\ to\ install\ FreeDOS\ 	\b, DOS Emulator boot message display
10602#>>244	string	from\ dosemu-freedos-*-bin.tgz\r
10603#>>>170	string	Sorry,\ could\ not\ load\ an\040
10604#>>>>195	string	operating\ system.\r\n
10605#
10606>103	string	This\ is\ not\ a\ bootable\ disk.\040
10607>>132	string	Please\ insert\ a\ bootable\040
10608>>>157	string	floppy\ and\r\n
10609>>>>169	string	press\ any\ key\ to\ try\ again...\r	\b, FREE-DOS message display
10610#
10611>66	string	Solaris\ Boot\ Sector
10612>>99	string	Incomplete\ MDBoot\ load.
10613>>>89	string	Version 				\b, Sun Solaris Bootloader
10614>>>>97	byte	x					version %c
10615#
10616>408	string	OS/2\ !!\ SYS01475\r\0
10617>>429	string	OS/2\ !!\ SYS02025\r\0
10618>>>450	string	OS/2\ !!\ SYS02027\r\0
10619>>>469	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp bootloader
10620#
10621>409	string	OS/2\ !!\ SYS01475\r\0
10622>>430	string	OS/2\ !!\ SYS02025\r\0
10623>>>451	string	OS/2\ !!\ SYS02027\r\0
10624>>>470	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp Bootloader
10625>112		string	This\ disk\ is\ not\ bootable\r
10626>>142		string	If\ you\ wish\ to\ make\ it\ bootable
10627>>>176		string	run\ the\ DOS\ program\ SYS\040
10628>>>200		string	after\ the\r
10629>>>>216		string	system\ has\ been\ loaded\r\n
10630>>>>>242	string	Please\ insert\ a\ DOS\ diskette\040
10631>>>>>271	string	into\r\n\ the\ drive\ and\040
10632>>>>>>292	string	strike\ any\ key...\0		\b, IBM OS/2 Warp message display
10633# XP
10634>430	string	NTLDR\ is\ missing\xFF\r\n
10635>>449	string	Disk\ error\xFF\r\n
10636>>>462	string	Press\ any\ key\ to\ restart\r		\b, Microsoft Windows XP Bootloader
10637# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
10638>>>>417		ubyte&0xDF	>0
10639>>>>>417	string		x			%-.5s
10640>>>>>>422	ubyte&0xDF	>0
10641>>>>>>>422	string		x 			\b%-.3s
10642>>>>>425	ubyte&0xDF	>0
10643>>>>>>425	string		>\ 			\b.%-.3s
10644#
10645>>>>371		ubyte		>0x20
10646>>>>>368	ubyte&0xDF	>0
10647>>>>>>368	string		x 			%-.5s
10648>>>>>>>373	ubyte&0xDF	>0
10649>>>>>>>>373	string		x 			\b%-.3s
10650>>>>>>376	ubyte&0xDF	>0
10651>>>>>>>376	string		x 			\b.%-.3s
10652#
10653>430	string	NTLDR\ nicht\ gefunden\xFF\r\n
10654>>453	string	Datentr\204gerfehler\xFF\r\n
10655>>>473	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (german)
10656>>>>417		ubyte&0xDF	>0
10657>>>>>417	string		x			%-.5s
10658>>>>>>422	ubyte&0xDF	>0
10659>>>>>>>422	string		x 			\b%-.3s
10660>>>>>425	ubyte&0xDF	>0
10661>>>>>>425	string		>\ 			\b.%-.3s
10662# offset variant
10663>>>>379	string	\0
10664>>>>>368	ubyte&0xDF	>0
10665>>>>>>368	string		x 			%-.5s
10666>>>>>>>373	ubyte&0xDF	>0
10667>>>>>>>>373	string		x 			\b%-.3s
10668#
10669>430	string	NTLDR\ fehlt\xFF\r\n
10670>>444	string	Datentr\204gerfehler\xFF\r\n
10671>>>464	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (2.german)
10672>>>>417		ubyte&0xDF	>0
10673>>>>>417	string		x			%-.5s
10674>>>>>>422	ubyte&0xDF	>0
10675>>>>>>>422	string		x 			\b%-.3s
10676>>>>>425	ubyte&0xDF	>0
10677>>>>>>425	string		>\ 			\b.%-.3s
10678# variant
10679>>>>371		ubyte		>0x20
10680>>>>>368	ubyte&0xDF	>0
10681>>>>>>368	string		x 			%-.5s
10682>>>>>>>373	ubyte&0xDF	>0
10683>>>>>>>>373	string		x 			\b%-.3s
10684>>>>>>376	ubyte&0xDF	>0
10685>>>>>>>376	string		x 			\b.%-.3s
10686#
10687>430	string	NTLDR\ fehlt\xFF\r\n
10688>>444	string	Medienfehler\xFF\r\n
10689>>>459	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (3.german)
10690>>>>371		ubyte		>0x20
10691>>>>>368	ubyte&0xDF	>0
10692>>>>>>368	string		x 			%-.5s
10693>>>>>>>373	ubyte&0xDF	>0
10694>>>>>>>>373	string		x 			\b%-.3s
10695>>>>>>376	ubyte&0xDF	>0
10696>>>>>>>376	string		x 			\b.%-.3s
10697# variant
10698>>>>417		ubyte&0xDF	>0
10699>>>>>417	string		x			%-.5s
10700>>>>>>422	ubyte&0xDF	>0
10701>>>>>>>422	string		x 			\b%-.3s
10702>>>>>425	ubyte&0xDF	>0
10703>>>>>>425	string		>\ 			\b.%-.3s
10704#
10705>430	string	Datentr\204ger\ entfernen\xFF\r\n
10706>>454	string	Medienfehler\xFF\r\n
10707>>>469	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (4.german)
10708>>>>379		string		\0
10709>>>>>368	ubyte&0xDF	>0
10710>>>>>>368	string		x 			%-.5s
10711>>>>>>>373	ubyte&0xDF	>0
10712>>>>>>>>373	string		x 			\b%-.3s
10713>>>>>>376	ubyte&0xDF	>0
10714>>>>>>>376	string		x 			\b.%-.3s
10715# variant
10716>>>>417		ubyte&0xDF	>0
10717>>>>>417	string		x			%-.5s
10718>>>>>>422	ubyte&0xDF	>0
10719>>>>>>>422	string		x 			\b%-.3s
10720>>>>>425	ubyte&0xDF	>0
10721>>>>>>425	string		>\ 			\b.%-.3s
10722#
10723
10724#>3	string	NTFS\ \ \ \040
10725>389	string	Fehler\ beim\ Lesen\040
10726>>407	string	des\ Datentr\204gers
10727>>>426	string	NTLDR\ fehlt
10728>>>>440	string	NTLDR\ ist\ komprimiert
10729>>>>>464 string	Neustart\ mit\ Strg+Alt+Entf\r		\b, Microsoft Windows XP Bootloader NTFS (german)
10730#>3	string	NTFS\ \ \ \040
10731>313	string	A\ disk\ read\ error\ occurred.\r
10732>>345	string	A\ kernel\ file\ is\ missing\040
10733>>>370	string	from\ the\ disk.\r
10734>>>>484	string	NTLDR\ is\ compressed
10735>>>>>429 string	Insert\ a\ system\ diskette\040
10736>>>>>>454 string and\ restart\r\nthe\ system.\r		\b, Microsoft Windows XP Bootloader NTFS
10737# DOS loader variants different languages,offsets
10738>472	ubyte&0xDF	>0
10739>>389	string	Invalid\ system\ disk\xFF\r\n
10740>>>411	string	Disk\ I/O\ error
10741>>>>428	string	Replace\ the\ disk,\ and\040
10742>>>>>455 string	press\ any\ key				\b, Microsoft Windows 98 Bootloader
10743#IO.SYS
10744>>>>>>472	ubyte&0xDF	>0
10745>>>>>>>472	string		x 			\b %-.2s
10746>>>>>>>>474	ubyte&0xDF	>0
10747>>>>>>>>>474	string		x 			\b%-.5s
10748>>>>>>>>>>479	ubyte&0xDF	>0
10749>>>>>>>>>>>479 string		x 			\b%-.1s
10750>>>>>>>480	ubyte&0xDF	>0
10751>>>>>>>>480	string		x 			\b.%-.3s
10752#MSDOS.SYS
10753>>>>>>>483	ubyte&0xDF	>0			\b+
10754>>>>>>>>483	string		x 			\b%-.5s
10755>>>>>>>>>488	ubyte&0xDF	>0
10756>>>>>>>>>>488	string		x 			\b%-.3s
10757>>>>>>>>491	ubyte&0xDF	>0
10758>>>>>>>>>491	string		x 			\b.%-.3s
10759#
10760>>390	string	Invalid\ system\ disk\xFF\r\n
10761>>>412	string	Disk\ I/O\ error\xFF\r\n
10762>>>>429	string	Replace\ the\ disk,\ and\040
10763>>>>>451 string	then\ press\ any\ key\r			\b, Microsoft Windows 98 Bootloader
10764>>388	string	Ungueltiges\ System\ \xFF\r\n
10765>>>410	string	E/A-Fehler\ \ \ \ \xFF\r\n
10766>>>>427	string	Datentraeger\ wechseln\ und\040
10767>>>>>453 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (german)
10768#WINBOOT.SYS only not spaces (0xDF)
10769>>>>>>497	ubyte&0xDF	>0
10770>>>>>>>497	string		x 			%-.5s
10771>>>>>>>>502	ubyte&0xDF	>0
10772>>>>>>>>>502	string		x 			\b%-.1s
10773>>>>>>>>>>503	ubyte&0xDF	>0
10774>>>>>>>>>>>503	string		x 			\b%-.1s
10775>>>>>>>>>>>>504	ubyte&0xDF	>0
10776>>>>>>>>>>>>>504 string		x 			\b%-.1s
10777>>>>>>505	ubyte&0xDF	>0
10778>>>>>>>505	string		x 			\b.%-.3s
10779#IO.SYS
10780>>>>>>472	ubyte&0xDF	>0			or
10781>>>>>>>472	string		x 			\b %-.2s
10782>>>>>>>>474	ubyte&0xDF	>0
10783>>>>>>>>>474	string		x 			\b%-.5s
10784>>>>>>>>>>479	ubyte&0xDF	>0
10785>>>>>>>>>>>479 string		x 			\b%-.1s
10786>>>>>>>480	ubyte&0xDF	>0
10787>>>>>>>>480	string		x 			\b.%-.3s
10788#MSDOS.SYS
10789>>>>>>>483	ubyte&0xDF	>0			\b+
10790>>>>>>>>483	string		x 			\b%-.5s
10791>>>>>>>>>488	ubyte&0xDF	>0
10792>>>>>>>>>>488	string		x 			\b%-.3s
10793>>>>>>>>491	ubyte&0xDF	>0
10794>>>>>>>>>491	string		x 			\b.%-.3s
10795#
10796>>390	string	Ungueltiges\ System\ \xFF\r\n
10797>>>412	string	E/A-Fehler\ \ \ \ \xFF\r\n
10798>>>>429	string	Datentraeger\ wechseln\ und\040
10799>>>>>455 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (German)
10800#WINBOOT.SYS only not spaces (0xDF)
10801>>>>>>497	ubyte&0xDF	>0
10802>>>>>>>497	string		x 			%-.7s
10803>>>>>>>>504	ubyte&0xDF	>0
10804>>>>>>>>>504	string		x 			\b%-.1s
10805>>>>>>505	ubyte&0xDF	>0
10806>>>>>>>505	string		x 			\b.%-.3s
10807#IO.SYS
10808>>>>>>472	ubyte&0xDF	>0			or
10809>>>>>>>472	string		x 			\b %-.2s
10810>>>>>>>>474	ubyte&0xDF	>0
10811>>>>>>>>>474	string		x 			\b%-.6s
10812>>>>>>>480	ubyte&0xDF	>0
10813>>>>>>>>480	string		x 			\b.%-.3s
10814#MSDOS.SYS
10815>>>>>>>483	ubyte&0xDF	>0			\b+
10816>>>>>>>>483	string		x 			\b%-.5s
10817>>>>>>>>>488	ubyte&0xDF	>0
10818>>>>>>>>>>488	string		x 			\b%-.3s
10819>>>>>>>>491	ubyte&0xDF	>0
10820>>>>>>>>>491	string		x 			\b.%-.3s
10821#
10822>>389	string	Ungueltiges\ System\ \xFF\r\n
10823>>>411	string	E/A-Fehler\ \ \ \ \xFF\r\n
10824>>>>428	string	Datentraeger\ wechseln\ und\040
10825>>>>>454 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
10826# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
10827>>>>>>472	string		x 			%-.2s
10828>>>>>>>474	ubyte&0xDF	>0
10829>>>>>>>>474	string		x 			\b%-.5s
10830>>>>>>>>479	ubyte&0xDF	>0
10831>>>>>>>>>479	string		x 			\b%-.1s
10832>>>>>>480	ubyte&0xDF	>0
10833>>>>>>>480	string		x 			\b.%-.3s
10834>>>>>>483	ubyte&0xDF	>0			\b+
10835>>>>>>>483	string		x 			\b%-.5s
10836>>>>>>>488	ubyte&0xDF	>0
10837>>>>>>>>488	string		x 			\b%-.2s
10838>>>>>>>>490	ubyte&0xDF	>0
10839>>>>>>>>>490	string		x 			\b%-.1s
10840>>>>>>>491	ubyte&0xDF	>0
10841>>>>>>>>491	string		x 			\b.%-.3s
10842>479	ubyte&0xDF	>0
10843>>416	string	Kein\ System\ oder\040
10844>>>433	string	Laufwerksfehler
10845>>>>450	string	Wechseln\ und\ Taste\ dr\201cken	\b, Microsoft DOS Bootloader (german)
10846#IO.SYS
10847>>>>>479	string		x 			\b %-.2s
10848>>>>>>481	ubyte&0xDF	>0
10849>>>>>>>481	string		x 			\b%-.6s
10850>>>>>487	ubyte&0xDF	>0
10851>>>>>>487	string		x 			\b.%-.3s
10852#MSDOS.SYS
10853>>>>>>490	ubyte&0xDF	>0			\b+
10854>>>>>>>490	string		x 			\b%-.5s
10855>>>>>>>>495	ubyte&0xDF	>0
10856>>>>>>>>>495	string		x 			\b%-.3s
10857>>>>>>>498	ubyte&0xDF	>0
10858>>>>>>>>498	string		x 			\b.%-.3s
10859#
10860>376	search/41	Non-System\ disk\ or\040
10861>>395	search/41	disk\ error\r
10862>>>407	search/41	Replace\ and\040
10863>>>>419	search/41	press\ 				\b,
10864>>>>419	search/41	strike\ 			\b, old
10865>>>>426	search/41	any\ key\ when\ ready\r		MS or PC-DOS bootloader
10866#449			Disk\ Boot\ failure\r		MS 3.21
10867#466			Boot\ Failure\r			MS 3.30
10868>>>>>468 search/18	\0
10869#IO.SYS,IBMBIO.COM
10870>>>>>>&0	string		x 			\b %-.2s
10871>>>>>>>&-20	ubyte&0xDF	>0
10872>>>>>>>>&-1	string		x 			\b%-.4s
10873>>>>>>>>>&-16	ubyte&0xDF	>0
10874>>>>>>>>>>&-1	string		x 			\b%-.2s
10875>>>>>>&8	ubyte&0xDF	>0			\b.
10876>>>>>>>&-1	string		x 			\b%-.3s
10877#MSDOS.SYS,IBMDOS.COM
10878>>>>>>&11	ubyte&0xDF	>0			\b+
10879>>>>>>>&-1	string		x 			\b%-.5s
10880>>>>>>>>&-6	ubyte&0xDF	>0
10881>>>>>>>>>&-1	string		x 			\b%-.1s
10882>>>>>>>>>>&-5	ubyte&0xDF	>0
10883>>>>>>>>>>>&-1	string		x 			\b%-.2s
10884>>>>>>>&7	ubyte&0xDF	>0			\b.
10885>>>>>>>>&-1	string		x 			\b%-.3s
10886>441	string	Cannot\ load\ from\ harddisk.\n\r
10887>>469	string	Insert\ Systemdisk\040
10888>>>487	string	and\ press\ any\ key.\n\r		\b, MS (2.11) DOS bootloader
10889#>43	string	\224R-LOADER\ \ SYS			=label
10890>54	string	SYS
10891>>324	string	VASKK
10892>>>495	string	NEWLDR\0				\b, DR-DOS Bootloader (LOADER.SYS)
10893#
10894>98	string	Press\ a\ key\ to\ retry\0\r
10895>>120	string	Cannot\ find\ file\ \0\r
10896>>>139	string	Disk\ read\ error\0\r
10897>>>>156	string	Loading\ ...\0				\b, DR-DOS (3.41) Bootloader
10898#DRBIOS.SYS
10899>>>>>44		ubyte&0xDF	>0
10900>>>>>>44	string		x			\b %-.6s
10901>>>>>>>50	ubyte&0xDF	>0
10902>>>>>>>>50	string		x 			\b%-.2s
10903>>>>>>52	ubyte&0xDF	>0
10904>>>>>>>52	string		x 			\b.%-.3s
10905#
10906>70	string	IBMBIO\ \ COM
10907>>472	string	Cannot\ load\ DOS!\040
10908>>>489	string	Any\ key\ to\ retry			\b, DR-DOS Bootloader
10909>>471	string	Cannot\ load\ DOS\040
10910>>487	string	press\ key\ to\ retry			\b, Open-DOS Bootloader
10911#??
10912>444	string	KERNEL\ \ SYS
10913>>314	string	BOOT\ error!				\b, FREE-DOS Bootloader
10914>499	string	KERNEL\ \ SYS
10915>>305	string	BOOT\ err!\0				\b, Free-DOS Bootloader
10916>449	string	KERNEL\ \ SYS
10917>>319	string	BOOT\ error!				\b, FREE-DOS 0.5 Bootloader
10918#
10919>449	string	Loading\ FreeDOS
10920>>0x1AF		ulelong		>0			\b, FREE-DOS 0.95,1.0 Bootloader
10921>>>497		ubyte&0xDF	>0
10922>>>>497		string		x 			\b %-.6s
10923>>>>>503	ubyte&0xDF	>0
10924>>>>>>503	string		x 			\b%-.1s
10925>>>>>>>504	ubyte&0xDF	>0
10926>>>>>>>>504	string		x 			\b%-.1s
10927>>>>505		ubyte&0xDF	>0
10928>>>>>505	string		x 			\b.%-.3s
10929#
10930>331	string	Error!.0				\b, FREE-DOS 1.0 bootloader
10931#
10932>125	string	Loading\ FreeDOS...\r
10933>>311	string	BOOT\ error!\r				\b, FREE-DOS bootloader
10934>>>441		ubyte&0xDF	>0
10935>>>>441		string		x 			\b %-.6s
10936>>>>>447	ubyte&0xDF	>0
10937>>>>>>447	string		x 			\b%-.1s
10938>>>>>>>448	ubyte&0xDF	>0
10939>>>>>>>>448	string		x 			\b%-.1s
10940>>>>449		ubyte&0xDF	>0
10941>>>>>449	string		x 			\b.%-.3s
10942>124	string	FreeDOS\0
10943>>331	string	\ err\0					\b, FREE-DOS BETa 0.9 Bootloader
10944# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
10945>>>497		ubyte&0xDF	>0
10946>>>>497		string		x 			\b %-.6s
10947>>>>>503	ubyte&0xDF	>0
10948>>>>>>503	string		x 			\b%-.1s
10949>>>>>>>504	ubyte&0xDF	>0
10950>>>>>>>>504	string		x 			\b%-.1s
10951>>>>505		ubyte&0xDF	>0
10952>>>>>505	string		x 			\b.%-.3s
10953>>333	string	\ err\0					\b, FREE-DOS BEta 0.9 Bootloader
10954>>>497		ubyte&0xDF	>0
10955>>>>497		string		x 			\b %-.6s
10956>>>>>503	ubyte&0xDF	>0
10957>>>>>>503	string		x 			\b%-.1s
10958>>>>>>>504	ubyte&0xDF	>0
10959>>>>>>>>504	string		x 			\b%-.1s
10960>>>>505		ubyte&0xDF	>0
10961>>>>>505	string		x 			\b.%-.3s
10962>>334	string	\ err\0					\b, FREE-DOS Beta 0.9 Bootloader
10963>>>497		ubyte&0xDF	>0
10964>>>>497		string		x 			\b %-.6s
10965>>>>>503	ubyte&0xDF	>0
10966>>>>>>503	string		x 			\b%-.1s
10967>>>>>>>504	ubyte&0xDF	>0
10968>>>>>>>>504	string		x 			\b%-.1s
10969>>>>505		ubyte&0xDF	>0
10970>>>>>505	string		x 			\b.%-.3s
10971>336	string	Error!\040
10972>>343	string	Hit\ a\ key\ to\ reboot.		\b, FREE-DOS Beta 0.9sr1 Bootloader
10973>>>497		ubyte&0xDF	>0
10974>>>>497		string		x 			\b %-.6s
10975>>>>>503	ubyte&0xDF	>0
10976>>>>>>503	string		x 			\b%-.1s
10977>>>>>>>504	ubyte&0xDF	>0
10978>>>>>>>>504	string		x 			\b%-.1s
10979>>>>505		ubyte&0xDF	>0
10980>>>>>505	string		x 			\b.%-.3s
10981# added by Joerg Jenderek
10982# https://www.visopsys.org/
10983# https://partitionlogic.org.uk/
10984# OEM-ID=Visopsys
10985>478		ulelong	0
10986>>(1.b+326)	string	I/O\ Error\ reading\040
10987>>>(1.b+344)	string	Visopsys\ loader\r
10988>>>>(1.b+361)	string	Press\ any\ key\ to\ continue.\r	\b, Visopsys loader
10989# http://alexfru.chat.ru/epm.html#bootprog
10990>494	ubyte	>0x4D
10991>>495	string	>E
10992>>>495	string	<S
10993#OEM-ID is not reliable
10994>>>>3	string	BootProg
10995# It just looks for a program file name at the root directory
10996# and loads corresponding file with following execution.
10997# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
10998>>>>499			ubyte&0xDF	>0		\b, COM/EXE Bootloader
10999>>>>>499		use		DOS-filename
11000#If the boot sector fails to read any other sector,
11001#it prints a very short message ("RE") to the screen and hangs the computer.
11002#If the boot sector fails to find needed program in the root directory,
11003#it also hangs with another message ("NF").
11004>>>>>492		string		RENF		\b, FAT (12 bit)
11005>>>>>495		string		RENF		\b, FAT (16 bit)
11006#If the boot sector fails to read any other sector,
11007#it prints a very short message ("RE") to the screen and hangs the computer.
11008# x86 bootloader end
11009
11010# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
11011# and https://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
11012>0		string		RRaA
11013>>0x1E4		string		rrAa		\b, FSInfosector
11014#>>0x1FC	uleshort	=0		SHOULD BE ZERO
11015>>>0x1E8	ulelong		<0xffffffff	\b, %u free clusters
11016>>>0x1EC	ulelong		<0xffffffff	\b, last allocated cluster %u
11017
11018# updated by Joerg Jenderek at Sep 2007
11019>3	ubyte	0
11020#no active flag
11021>>446	ubyte	0
11022# partition 1 not empty
11023>>>450	ubyte	>0
11024# partitions 3,4 empty
11025>>>>482		ubyte	0
11026>>>>>498	ubyte	0
11027# partition 2 ID=0,5,15
11028>>>>>>466	ubyte	<0x10
11029>>>>>>>466	ubyte	0x05			\b, extended partition table
11030>>>>>>>466	ubyte	0x0F			\b, extended partition table (LBA)
11031>>>>>>>466	ubyte	0x0			\b, extended partition table (last)
11032
11033# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
11034
11035>0x200	lelong	0x82564557		\b, BSD disklabel
11036
11037# by Joerg Jenderek at Apr 2013
11038#	Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension
11039#	like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS
110400	name			DOS-filename
11041# space=0x20 (00100000b) means empty
11042>0			ubyte&0xDF	>0
11043>>0			ubyte		x 		\b%c
11044>>>1			ubyte&0xDF	>0
11045>>>>1			ubyte		x 		\b%c
11046>>>>>2			ubyte&0xDF	>0
11047>>>>>>2			ubyte		x 		\b%c
11048>>>>>>>3		ubyte&0xDF	>0
11049>>>>>>>>3		ubyte		x 		\b%c
11050>>>>>>>>>4		ubyte&0xDF	>0
11051>>>>>>>>>>4		ubyte		x 		\b%c
11052>>>>>>>>>>>5		ubyte&0xDF	>0
11053>>>>>>>>>>>>5		ubyte		x 		\b%c
11054>>>>>>>>>>>>>6		ubyte&0xDF	>0
11055>>>>>>>>>>>>>>6		ubyte		x 		\b%c
11056>>>>>>>>>>>>>>>7	ubyte&0xDF	>0
11057>>>>>>>>>>>>>>>>7	ubyte		x 		\b%c
11058# DOS filename extension
11059>>8			ubyte&0xDF	>0		\b.
11060>>>8			ubyte		x 		\b%c
11061>>>>9			ubyte&0xDF	>0
11062>>>>>9			ubyte		x 		\b%c
11063>>>>>>10		ubyte&0xDF	>0
11064>>>>>>>10		ubyte		x 		\b%c
11065#	Print 2 following DOS filenames from directory entry form
11066#	like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com
110670	name			2xDOS-filename
11068# display 1 space
11069>0			ubyte		x		\b
11070>0			use		DOS-filename
11071>11			ubyte		x		\b+
11072>11			use		DOS-filename
11073
11074# https://en.wikipedia.org/wiki/Master_boot_record#PTE
11075# display standard partition table
110760	name				partition-table
11077#>0		ubyte		x	PARTITION-TABLE
11078# test and display 1st til 4th partition table entry
11079>0		use			partition-entry-test
11080>16		use			partition-entry-test
11081>32		use			partition-entry-test
11082>48		use			partition-entry-test
11083#		test for entry of partition table
110840	name				partition-entry-test
11085# partition type ID > 0
11086>4		ubyte		>0
11087# active flag 0
11088>>0		ubyte		0
11089>>>0		use		partition-entry
11090# active flag 0x80, 0x81, ...
11091>>0		ubyte		>0x7F
11092>>>0		use		partition-entry
11093#		Print entry of partition table
110940	name				partition-entry
11095# partition type ID > 0
11096>4		ubyte		>0	\b; partition
11097>>64		leshort		0xAA55	1
11098>>48		leshort		0xAA55	2
11099>>32		leshort		0xAA55	3
11100>>16		leshort		0xAA55	4
11101>>4		ubyte		x	: ID=0x%x
11102>>0		ubyte&0x80	0x80	\b, active
11103>>0		ubyte		>0x80	0x%x
11104>>1		ubyte		x	\b, start-CHS (
11105>>1		use		partition-chs
11106>>5		ubyte		x	\b), end-CHS (
11107>>5		use		partition-chs
11108>>8		ulelong		x	\b), startsector %u
11109>>12		ulelong		x	\b, %u sectors
11110#		Print cylinder,head,sector (CHS) of partition entry
111110	name				partition-chs
11112# cylinder
11113>1		ubyte		x	\b0x
11114>1		ubyte&0xC0	0x40	\b1
11115>1		ubyte&0xC0	0x80	\b2
11116>1		ubyte&0xC0	0xC0	\b3
11117>2		ubyte		x	\b%x
11118# head
11119>0		ubyte		x	\b,%u
11120# sector
11121>1		ubyte&0x3F	x	\b,%u
11122
11123# FATX
111240		string		FATX		FATX filesystem data
11125
11126# romfs filesystems - Juan Cespedes <cespedes@debian.org>
111270	string		-rom1fs-	romfs filesystem, version 1
11128>8	belong	x			%d bytes,
11129>16	string	x			named %s.
11130
11131# netboot image - Juan Cespedes <cespedes@debian.org>
111320	lelong		0x1b031336L	Netboot image,
11133>4	lelong&0xFFFFFF00	0
11134>>4	lelong&0x100	0x000		mode 2
11135>>4	lelong&0x100	0x100		mode 3
11136>4	lelong&0xFFFFFF00	!0	unknown mode
11137
111380x18b	string	OS/2	OS/2 Boot Manager
11139
11140# updated by Joerg Jenderek at Oct 2008 and Sep 2012
11141# https://syslinux.zytor.com/iso.php
11142# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
11143# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
111440	ulequad&0x909000007cc0eafa	0x909000007c40eafa
11145>631	search/689	ISOLINUX\ 	isolinux Loader
11146>>&0	string		x		(version %-4.4s)
11147# https://syslinux.zytor.com/pxe.php
11148# assembler instructions: jmp 7C05
111490	ulelong	0x007c05ea		pxelinux loader (version 2.13 or older)
11150# assembler instructions: pushfd;pushad
111510	ulelong	0x60669c66		pxelinux loader
11152# assembler instructions: jmp 05
111530	ulelong	0xc00005ea		pxelinux loader (version 3.70 or newer)
11154# https://syslinux.zytor.com/wiki/index.php/SYSLINUX
111550	string	LDLINUX\ SYS\ 		SYSLINUX loader
11156>12	string	x			(older version %-4.4s)
111570	string	\r\nSYSLINUX\ 		SYSLINUX loader
11158>11	string	x			(version %-4.4s)
11159# syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
11160# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX"
111610	ulelong&0x80909bEB	0x009018EB
11162# OEM-ID not always "SYSLINUX"
11163>434	search/47	Boot\ failed
11164# followed by \r\n\0 or :\
11165>>482	search/132	\0LDLINUX\ SYS		Syslinux bootloader (version 2.13 or older)
11166>>1	ubyte		0x58			Syslinux bootloader (version 3.0-3.9)
11167>459	search/30	Boot\ error\r\n\0
11168>>1	ubyte		0x58			Syslinux bootloader (version 3.10 or newer)
11169# SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
11170# assembler instructions: mov di,0600h;mov cx,0100h
1117116	search/4	\xbf\x00\x06\xb9\x00\x01
11172# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21)
11173!:strength +36
11174>94	search/249	Missing\ operating\ system
11175# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other
11176# skip Ranish MBR
11177>>408	search/4	HD1/\0
11178>>408	default		x
11179>>>250	search/118	\0Operating\ system\ load		SYSLINUX MBR
11180# followed by "ing " or space
11181>>>>292	search/98	error
11182>>>>>&0	string		\r		    			(version 3.35 or older)
11183>>>>>&0	string		.\r					(version 3.52 or newer)
11184>>>>>&0	default		x					(version 3.36-3.51 )
11185>368	search/106	\0Disk\ error\ on\ boot\r\n		SYSLINUX GPT-MBR
11186>>156	search/10	\0Boot\ partition\ not\ found\r\n
11187>>>270	search/10	\0OS\ not\ bootable\r\n			(version 3.86 or older)
11188>>174	search/10	\0Missing\ OS\r\n
11189>>>189	search/10	\0Multiple\ active\ partitions\r\n	(version 4.00 or newer)
11190# SYSLINUX END
11191
11192# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012
11193# assembler instructions: xor ax,ax;mov	ax,ss;mov sp,0x7c00;mov	ax,
111940	ubequad		0x31c08ed0bc007c8e
11195# mbr_bootsel magic before partition table not reliable with small ipl fragments
11196#>444	uleshort	0xb5e1
11197>0004	uleshort	x
11198# ERRorTeXT
11199>>181	search/166		Error\ \0\r\n				NetBSD mbr
11200# NT Drive Serial Number https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
11201>>>0x1B8	ubelong		>0					\b,Serial 0x%-.8x
11202# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
11203>>>0xbb		search/71	\xcd\x13\x5a\x52\x52			\b,bootselector
11204# BOOT_EXTENDED definitions contains assembler instructions:
11205# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13
11206>>>0x96	search/1	\x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13	\b,boot extended
11207# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al
11208>>>0x130	search/55	\xee\x80\xc2\x05\xec\xa8\x40		\b,serial IO
11209# not TERSE_ERROR
11210>>>196		search/106	No\ active\ partition\0
11211>>>>&0		string		Disk\ read\ error\0
11212>>>>>&0		string		No\ operating\ system\0			\b,verbose
11213# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13
11214>>>0x7d		search/7	\x5a\x52\xb4\x08\xcd\x13		\b,CHS
11215# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop	dx;push	dx;int 0x13
11216>>>0xa4		search/84	\xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13	\b,LBA-check
11217# assembler instructions: movw nametab,bx
11218>>>0x26	    search/21	\xBB\x94\x07
11219# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf
11220>>>>&-9	ubequad&0xBE00f0E800febb94	0xBE0000E80000bb94
11221>>>>>181	search/166		Error\ \0
11222# "a: disk" , "Fn: diskn" or "NetBSD MBR boot"
11223>>>>>>&3	string			x				\b,"%s"
11224>>>446	use		partition-table
11225# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
11226# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
11227# assembler instructions: jmp short 0x58;nop;ASCII
112280	ubequad&0xeb58908000000000	0xeb58900000000000
11229# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss,
11230>(1.b+2)	ubequad			0xfa31c08ed88ec08e
11231# Error messages at end of code
11232>>376		string	No\ operating\ system\r\n\0
11233>>>398		string	Disk\ error\r\n\0FDD\0HDD\0
11234>>>>419		string	\ EBIOS\r\n\0				AdvanceMAME mbr
11235
11236# Neil Turton mbr loader variant of https://www.chiark.greenend.org.uk/~neilt/mbr/
11237# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
11238# for 1st version assembler instructions:	cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
11239# or  	  	  	    			cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
112400	ulequad&0xcE1b40D48EC031FC	0x8E0000D08EC031FC
11241# pointer to the data starting with Neil Turton signature string
11242>(0x1BC.s)		string		NDTmbr
11243>>&-14			string		1234F\0			Turton mbr (
11244# parameters also viewed by install-mbr --list
11245>>>(0x1BC.s+7)		ubyte		x			\b%u<=
11246>>>(0x1BC.s+9)		ubyte		x			\bVersion<=%u
11247#>>>(0x1BC.s+8)		ubyte		x			asm_flag_%x
11248>>>(0x1BC.s+8)		ubyte&1		1			\b,Y2K-Fix
11249# variant used by testdisk of https://www.cgsecurity.org/wiki/Menu_MBRCode
11250>>>(0x1BC.s+8)		ubyte&2		2			\b,TestDisk
11251#0x1~1,..,0x8~4,0x10~F,0x80~A enabled
11252#>>>(0x1BC.s+10)		ubyte		x			\b,flags 0x%x
11253#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
11254#>>>(0x1BC.s+11)		ubyte		x			\b,cfg_def 0x%x
11255# for older versions
11256>>>(0x1BC.s+9)		ubyte		<2
11257#>>>>(0x1BC.s+12)	ubyte		18			\b,%hhu/18 seconds
11258>>>>(0x1BC.s+12)	ubyte		!18			\b,%u/18 seconds
11259# floppy A: or B:
11260>>>>(0x1BC.s+13)	ubyte		<2			\b,floppy 0x%x
11261>>>>(0x1BC.s+13)	ubyte		>1
11262# 1st hard disc
11263#>>>>>(0x1BC.s+13)	ubyte		0x80			\b,drive 0x%x
11264# not 1st hard disc
11265>>>>>(0x1BC.s+13)	ubyte		!0x80			\b,drive 0x%x
11266# for version >= 2 maximal timeout can be 65534
11267>>>(0x1BC.s+9)		ubyte		>1
11268#>>>>(0x1BC.s+12)	uleshort	18			\b,%u/18 seconds
11269>>>>(0x1BC.s+12)	uleshort	!18			\b,%u/18 seconds
11270# floppy A: or B:
11271>>>>(0x1BC.s+14)	ubyte		<2			\b,floppy 0x%x
11272>>>>(0x1BC.s+14)	ubyte		>1
11273# 1st hard disc
11274#>>>>>(0x1BC.s+14)	ubyte		0x80			\b,drive 0x%x
11275# not 1st hard disc
11276>>>>>(0x1BC.s+14)	ubyte		!0x80			\b,drive 0x%x
11277>>>0	ubyte		x					\b)
11278
11279# added by Joerg Jenderek
11280# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
11281# grub-1.94/kern/i386/pc/startup.S
11282# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data
11283# usual values are marked with comments to get only informations of strange GRUB loaders
112840x200	uleshort		0x70EA
11285# found only version 3.{1,2}
11286>0x206		ubeshort	>0x0300
11287# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
11288>>0x212 	ubyte		>0x29
11289>>>0x213 	ubyte		>0x29
11290# not iso9660_stage1_5
11291#>>>0	ulelong&0x00BE5652	0x00BE5652
11292>>>>0x213 	ubyte		>0x29		GRand Unified Bootloader
11293# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
11294>>>>0x217 	ubyte		0xFF		stage1_5
11295>>>>0x217 	ubyte		<0xFF		stage2
11296>>>>0x206	ubyte		x		\b version %u
11297>>>>0x207	ubyte		x		\b.%u
11298# module_size for 1.94
11299>>>>0x208	ulelong		<0xffffff	\b, installed partition %u
11300#>>>>0x208	ulelong		=0xffffff	\b, %lu (default)
11301>>>>0x208	ulelong		>0xffffff	\b, installed partition %u
11302# GRUB 0.5.95 unofficial
11303>>>>0x20C	ulelong&0x2E300000 0x2E300000
11304# 0=stage2	1=ffs	2=e2fs	3=fat	4=minix	5=reiserfs
11305>>>>>0x20C	ubyte		x		\b, identifier 0x%x
11306#>>>>>0x20D	ubyte		=0		\b, LBA flag 0x%x (default)
11307>>>>>0x20D	ubyte		>0		\b, LBA flag 0x%x
11308# GRUB version as string
11309>>>>>0x20E 	string		>\0		\b, GRUB version %-s
11310# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
11311>>>>>>0x215 	ulong		0xffffffff
11312>>>>>>>0x219 	string		>\0		\b, configuration file %-s
11313>>>>>>0x215 	ulong		!0xffffffff
11314>>>>>>>0x215 	string		>\0		\b, configuration file %-s
11315# newer GRUB versions
11316>>>>0x20C	ulelong&0x2E300000 !0x2E300000
11317##>>>>>0x20C	ulelong		=0		\b, saved entry %d (usual)
11318>>>>>0x20C	ulelong		>0		\b, saved entry %d
11319# for 1.94 contains kernel image size
11320# for 0.93,0.94,0.96,0.97
11321# 0=stage2	1=ffs	2=e2fs	3=fat	4=minix	5=reiserfs	6=vstafs	7=jfs	8=xfs	9=iso9660	a=ufs2
11322>>>>>0x210	ubyte		x		\b, identifier 0x%x
11323# The flag for LBA forcing is in most cases 0
11324#>>>>>0x211	ubyte		=0		\b, LBA flag 0x%x (default)
11325>>>>>0x211	ubyte		>0		\b, LBA flag 0x%x
11326# GRUB version as string
11327>>>>>0x212 	string		>\0		\b, GRUB version %-s
11328# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
11329>>>>>0x217 	ulong		0xffffffff
11330>>>>>>0x21b 	string		>\0		\b, configuration file %-s
11331>>>>>0x217 	ulong		!0xffffffff
11332>>>>>>0x217 	string		>\0		\b, configuration file %-s
11333
11334# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
11335# JuMP short     bootcodeoffset NOP assembler instructions will usually be EB xx 90
11336# over BIOS parameter block (BPB)
11337# https://thestarman.pcministry.com/asm/2bytejumps.htm#FWD
11338# older drives may use Near JuMP instruction E9 xx xx
11339# minimal short forward jump found 0x29 for bootloaders or 0x0
11340# maximal short forward jump is 0x7f
11341# OEM-ID is empty or contain readable bytes
113420		ulelong&0x804000E9	0x000000E9
11343!:strength	+60
11344# mtools-3.9.8/msdos.h
11345# usual values are marked with comments to get only informations of strange FAT systems
11346# valid sectorsize must be a power of 2 from 32 to 32768
11347>11		uleshort&0x001f	0
11348>>11		uleshort	<32769
11349>>>11		uleshort	>31
11350>>>>21		ubyte&0xf0	0xF0
11351>>>>>0		ubyte		0xEB		DOS/MBR boot sector
11352>>>>>>1		ubyte		x		\b, code offset 0x%x+2
11353>>>>>0		ubyte		0xE9
11354>>>>>>1		uleshort	x		\b, code offset 0x%x+3
11355>>>>>3		string		>\0		\b, OEM-ID "%-.8s"
11356#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
11357>>>>>>8		string		IHC		\b cached by Windows 9M
11358>>>>>11		uleshort	>512		\b, Bytes/sector %u
11359#>>>>>11	uleshort	=512		\b, Bytes/sector %u=512 (usual)
11360>>>>>11		uleshort	<512		\b, Bytes/sector %u
11361>>>>>13		ubyte		>1		\b, sectors/cluster %u
11362#>>>>>13	ubyte		=1		\b, sectors/cluster %u (usual on Floppies)
11363# for lazy FAT32 implementation like Transcend digital photo frame PF830
11364>>>>>82		string/c	fat32
11365>>>>>>14	uleshort	!32		\b, reserved sectors %u
11366#>>>>>>14	uleshort	=32		\b, reserved sectors %u (usual Fat32)
11367>>>>>82		string/c	!fat32
11368>>>>>>14	uleshort	>1		\b, reserved sectors %u
11369#>>>>>>14	uleshort	=1		\b, reserved sectors %u (usual FAT12,FAT16)
11370#>>>>>>14	uleshort	0		\b, reserved sectors %u (usual NTFS)
11371>>>>>16		ubyte		>2		\b, FATs %u
11372#>>>>>16	ubyte		=2		\b, FATs %u (usual)
11373>>>>>16		ubyte		=1		\b, FAT  %u
11374>>>>>16		ubyte		>0
11375>>>>>17		uleshort	>0		\b, root entries %u
11376#>>>>>17	uleshort	=0		\b, root entries %hu=0 (usual Fat32)
11377>>>>>19		uleshort	>0		\b, sectors %u (volumes <=32 MB)
11378#>>>>>19	uleshort	=0		\b, sectors %hu=0 (usual Fat32)
11379>>>>>21		ubyte		>0xF0		\b, Media descriptor 0x%x
11380#>>>>>21	ubyte		=0xF0		\b, Media descriptor 0x%x (usual floppy)
11381>>>>>21		ubyte		<0xF0		\b, Media descriptor 0x%x
11382>>>>>22		uleshort	>0		\b, sectors/FAT %u
11383#>>>>>22	uleshort	=0		\b, sectors/FAT %hu=0 (usual Fat32)
11384>>>>>24		uleshort	x		\b, sectors/track %u
11385>>>>>26		ubyte		>2		\b, heads %u
11386#>>>>>26	ubyte		=2		\b, heads %u (usual floppy)
11387>>>>>26		ubyte		=1		\b, heads %u
11388# valid only for sector sizes with more then 32 Bytes
11389>>>>>11		uleshort	>32
11390# https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block
11391# skip for values 2,2Ah,70h,73h,DFh
11392# and continue for extended boot signature values 0,28h,29h,80h
11393>>>>>>38	ubyte&0x56	=0
11394>>>>>>>28	ulelong		>0		\b, hidden sectors %u
11395#>>>>>>>28	ulelong		=0		\b, hidden sectors %u (usual floppy)
11396>>>>>>>32	ulelong		>0		\b, sectors %u (volumes > 32 MB)
11397#>>>>>>>32	ulelong		=0		\b, sectors %u (volumes > 32 MB)
11398# FAT<32 bit specific
11399>>>>>>>82	string/c	!fat32
11400#>>>>>>>>36	ubyte		0x80		\b, physical drive 0x%x=0x80 (usual harddisk)
11401#>>>>>>>>36	ubyte		0		\b, physical drive 0x%x=0 (usual floppy)
11402>>>>>>>>36	ubyte		!0x80
11403>>>>>>>>>36	ubyte		!0		\b, physical drive 0x%x
11404# VGA-copy CRC or
11405# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
11406>>>>>>>>37	ubyte		>0		\b, reserved 0x%x
11407#>>>>>>>>37	ubyte		=0		\b, reserved 0x%x
11408# extended boot signatur value is 0x80 for NTFS, 0x28 or 0x29 for others
11409>>>>>>>>38	ubyte		!0x29		\b, dos < 4.0 BootSector (0x%x)
11410>>>>>>>>38	ubyte&0xFE	=0x28
11411>>>>>>>>>39	ulelong		x		\b, serial number 0x%x
11412>>>>>>>>38	ubyte		=0x29
11413>>>>>>>>>43	string		<NO\ NAME	\b, label: "%11.11s"
11414>>>>>>>>>43	string		>NO\ NAME	\b, label: "%11.11s"
11415>>>>>>>>>43	string		=NO\ NAME	\b, unlabeled
11416# there exist some old floppies without word FAT at offset 54
11417# a word like "FATnm   " is only a hint for a FAT size on nm-bits
11418# Normally the number of clusters is calculated by the values of BPP.
11419# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
11420# otherwise FAT is 16 bit.
11421# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
11422>>>>>82		string/c	!fat32
11423>>>>>>54	string		FAT12		\b, FAT (12 bit)
11424>>>>>>54	string		FAT16		\b, FAT (16 bit)
11425>>>>>>54	default		x
11426# determinate FAT bit size by media descriptor
11427# small floppies implies FAT12
11428>>>>>>>21	ubyte		<0xF0		\b, FAT (12 bit by descriptor)
11429# with media descriptor F0h floppy or maybe superfloppy with FAT16
11430>>>>>>>21	ubyte		=0xF0
11431# superfloppy (many sectors) implies FAT16
11432>>>>>>>>32	ulelong		>0xFFFF		\b, FAT (16 bit by descriptor+sectors)
11433# no superfloppy with media descriptor F0h implies FAT12
11434>>>>>>>>32	default		x		\b, FAT (12 bit by descriptor+sectors)
11435# with media descriptor F8h floppy or hard disc with FAT12 or FAT16
11436>>>>>>>21	ubyte		=0xF8
11437# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12
11438>>>>>>>>19	ubequad	0xd002f80300090001	\b, FAT (12 bit by descriptor+geometry)
11439# hard disc with FAT12 or FAT16
11440>>>>>>>>19	default		x		\b, FAT (1Y bit by descriptor)
11441# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc
11442>>>>>>>21	ubyte		=0xFA
11443# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12
11444>>>>>>>>19	ubequad	0x8002fa0200080001	\b, FAT (12 bit by descriptor+geometry)
11445# RAM disc with FAT12 or FAT16 or Tandy hard disc
11446>>>>>>>>19	default		x		\b, FAT (1Y bit by descriptor)
11447# others are floppy
11448>>>>>>>21	default		x		\b, FAT (12 bit by descriptor)
11449# FAT32 bit specific
11450>>>>>82		string/c	fat32		\b, FAT (32 bit)
11451>>>>>>36	ulelong		x		\b, sectors/FAT %u
11452# https://technet.microsoft.com/en-us/library/cc977221.aspx
11453>>>>>>40	uleshort	>0		\b, extension flags 0x%x
11454#>>>>>>40	uleshort	=0		\b, extension flags %hu
11455>>>>>>42	uleshort	>0		\b, fsVersion %u
11456#>>>>>>42	uleshort	=0		\b, fsVersion %u (usual)
11457>>>>>>44	ulelong		>2		\b, rootdir cluster %u
11458#>>>>>>44	ulelong		=2		\b, rootdir cluster %u
11459#>>>>>>44	ulelong		=1		\b, rootdir cluster %u
11460>>>>>>48	uleshort	>1		\b, infoSector %u
11461#>>>>>>48	uleshort	=1		\b, infoSector %u (usual)
11462>>>>>>48	uleshort	<1		\b, infoSector %u
11463# 0 or 0xFFFF instead of usual 6 means no backup sector
11464>>>>>>50	uleshort	=0xFFFF		\b, no Backup boot sector
11465>>>>>>50	uleshort	=0		\b, no Backup boot sector
11466#>>>>>>50	uleshort	=6		\b, Backup boot sector %u (usual)
11467>>>>>>50	default		x
11468>>>>>>>50	uleshort	x		\b, Backup boot sector %u
11469# corrected by Joerg Jenderek at Feb 2011 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
11470>>>>>>52	ulelong		>0		\b, reserved1 0x%x
11471>>>>>>56	ulelong		>0		\b, reserved2 0x%x
11472>>>>>>60	ulelong		>0		\b, reserved3 0x%x
11473# same structure as FAT1X
11474#>>>>>>64	ubyte		=0x80		\b, physical drive 0x%x=80 (usual harddisk)
11475#>>>>>>64	ubyte		=0		\b, physical drive 0x%x=0 (usual floppy)
11476>>>>>>64	ubyte		!0x80
11477>>>>>>>64	ubyte		>0		\b, physical drive 0x%x
11478# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
11479>>>>>>65	ubyte		>0		\b, reserved 0x%x
11480>>>>>>66	ubyte		!0x29		\b, dos < 4.0 BootSector (0x%x)
11481>>>>>>66	ubyte		=0x29
11482>>>>>>>67	ulelong		x		\b, serial number 0x%x
11483>>>>>>>71	string		<NO\ NAME	\b, label: "%11.11s"
11484>>>>>>>71	string		>NO\ NAME	\b, label: "%11.11s"
11485>>>>>>>71	string		=NO\ NAME	\b, unlabeled
11486# additional tests for floppy image added by Joerg Jenderek
11487# no fixed disk
11488>>>>>21		ubyte		!0xF8
11489# floppy media with 12 bit FAT
11490>>>>>>54	string		!FAT16
11491# test for FAT after bootsector
11492>>>>>>>(11.s)	ulelong&0x00ffffF0	0x00ffffF0	\b, followed by FAT
11493# floppy image
11494!:mime application/x-ima
11495# NTFS specific added by Joerg Jenderek at Mar 2011 according to https://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
11496# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
11497# 0 FATs
11498>>>>>16	ubyte		=0
11499# 0 root entries
11500>>>>>>17	uleshort	=0
11501# 0 DOS sectors
11502>>>>>>>19	uleshort	=0
11503# 0 sectors/FAT
11504# dos < 4.0 BootSector value found is 0x80
11505#38	ubyte		=0x80			\b, dos < 4.0 BootSector (0x%x)
11506>>>>>>>>22	uleshort	=0		\b; NTFS
11507>>>>>>>>>24	uleshort	>0		\b, sectors/track %u
11508>>>>>>>>>36	ulelong		!0x800080	\b, physical drive 0x%x
11509>>>>>>>>>40	ulequad		>0		\b, sectors %lld
11510>>>>>>>>>48	ulequad		>0		\b, $MFT start cluster %lld
11511>>>>>>>>>56	ulequad		>0		\b, $MFTMirror start cluster %lld
11512# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters.
11513# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
11514>>>>>>>>>64	lelong		<256
11515>>>>>>>>>>64	lelong		<128		\b, clusters/RecordSegment %d
11516>>>>>>>>>>64	ubyte		>127		\b, bytes/RecordSegment 2^(-1*%i)
11517# Values 0 to 127 represent index block sizes of 0 to 127 clusters.
11518# Values 128 to 255 represent index block sizes of 2^(256-N) byte
11519>>>>>>>>>68	ulelong		<256
11520>>>>>>>>>>68	ulelong		<128		\b, clusters/index block %d
11521#>>>>>>>>>>68	ulelong		>127		\b, bytes/index block 2^(256-%d)
11522>>>>>>>>>>68	ubyte		>127		\b, bytes/index block 2^(-1*%i)
11523>>>>>>>>>72	ulequad		x		\b, serial number 0%llx
11524>>>>>>>>>80	ulelong		>0		\b, checksum 0x%x
11525#>>>>>>>>>80	ulelong		=0		\b, checksum 0x%x=0 (usual)
11526# unicode loadername size jump
11527>>>>>>>>>(0x200.s*2)	ubyte				x
11528# in next sector loadername terminated by unicode CTRL-D and $
11529>>>>>>>>>>&0x1FF	ulequad&0x0000FFffFFffFF00	0x0000002400040000 \b; contains
11530# if 2nd NTFS sectors is found then assume whole filesystem
11531#!:mime		application/x-raw-disk-image
11532!:ext		img/bin/ntfs
11533>>>>>>>>>>>0x200	use				ntfs-sector2
11534
11535# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013, Mar 2019
11536# https://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
11537# unused assembler instructions short JMP y2;NOP;NOP
115380x056		ulelong&0xFFFF0FFF	0x909002EB	NTFS
11539#!:mime		application/octet-stream
11540!:ext		bin
11541>0		use		ntfs-sector2
11542# https://memory.dataram.com/products-and-services/software/ramdisk
11543# assembler instructions JMP C000;NOP
115440x056		ulelong			0x9000c0e9	NTFS
11545#!:mime		application/octet-stream
11546!:ext		bin
11547>0		use		ntfs-sector2
11548# check for characteristics of second NTFS sector and then display loader name
115490		name		ntfs-sector2
11550# number of utf16 characters of loadername
11551>0		uleshort	<8
11552# unused assembler instructions JMP y2;NOP;NOP or JMP C000;NOP
11553>>0x056		ulelong&0xFF0000FD	0x900000E9
11554# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR
11555>>>0x002		lestring16	x	bootstrap %-5.5s
11556# check for 7 character length of loader name like BOOTMGR
11557>>>0		uleshort	7
11558>>>>0x0c	lestring16	x	\b%-2.2s
11559### DOS,NTFS boot sectors end
11560
11561# ntfsclone-image is a special save format for NTFS volumes,
11562# created and restored by the ntfsclone program
115630	string	\0ntfsclone-image	ntfsclone image,
11564>0x10	byte	x			version %d.
11565>0x11	byte	x			\b%d,
11566>0x12	lelong	x			cluster size %d,
11567>0x16	lequad	x			device size %lld,
11568>0x1e	lequad	x			%lld total clusters,
11569>0x26	lequad	x			%lld clusters in use
11570
115719564	lelong		0x00011954	Unix Fast File system [v1] (little-endian),
11572>8404	string		x		last mounted on %s,
11573#>9504	ledate		x		last checked at %s,
11574>8224	ledate		x		last written at %s,
11575>8401	byte		x		clean flag %d,
11576>8228	lelong		x		number of blocks %d,
11577>8232	lelong		x		number of data blocks %d,
11578>8236	lelong		x		number of cylinder groups %d,
11579>8240	lelong		x		block size %d,
11580>8244	lelong		x		fragment size %d,
11581>8252	lelong		x		minimum percentage of free blocks %d,
11582>8256	lelong		x		rotational delay %dms,
11583>8260	lelong		x		disk rotational speed %drps,
11584>8320	lelong		0		TIME optimization
11585>8320	lelong		1		SPACE optimization
11586
1158742332	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
11588>&-1164	string		x		last mounted on %s,
11589>&-696	string		>\0		volume name %s,
11590>&-304	leqldate	x		last written at %s,
11591>&-1167	byte		x		clean flag %d,
11592>&-1168	byte		x		readonly flag %d,
11593>&-296	lequad		x		number of blocks %lld,
11594>&-288	lequad		x		number of data blocks %lld,
11595>&-1332	lelong		x		number of cylinder groups %d,
11596>&-1328	lelong		x		block size %d,
11597>&-1324	lelong		x		fragment size %d,
11598>&-180	lelong		x		average file size %d,
11599>&-176	lelong		x		average number of files in dir %d,
11600>&-272	lequad		x		pending blocks to free %lld,
11601>&-264	lelong		x		pending inodes to free %d,
11602>&-664	lequad		x		system-wide uuid %0llx,
11603>&-1316	lelong		x		minimum percentage of free blocks %d,
11604>&-1248	lelong		0		TIME optimization
11605>&-1248	lelong		1		SPACE optimization
11606
1160766908	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
11608>&-1164	string		x		last mounted on %s,
11609>&-696	string		>\0		volume name %s,
11610>&-304	leqldate	x		last written at %s,
11611>&-1167	byte		x		clean flag %d,
11612>&-1168	byte		x		readonly flag %d,
11613>&-296	lequad		x		number of blocks %lld,
11614>&-288	lequad		x		number of data blocks %lld,
11615>&-1332	lelong		x		number of cylinder groups %d,
11616>&-1328	lelong		x		block size %d,
11617>&-1324	lelong		x		fragment size %d,
11618>&-180	lelong		x		average file size %d,
11619>&-176	lelong		x		average number of files in dir %d,
11620>&-272	lequad		x		pending blocks to free %lld,
11621>&-264	lelong		x		pending inodes to free %d,
11622>&-664	lequad		x		system-wide uuid %0llx,
11623>&-1316	lelong		x		minimum percentage of free blocks %d,
11624>&-1248	lelong		0		TIME optimization
11625>&-1248	lelong		1		SPACE optimization
11626
116279564	belong		0x00011954	Unix Fast File system [v1] (big-endian),
11628>7168   belong		0x4c41424c	Apple UFS Volume
11629>>7186  string		x		named %s,
11630>>7176  belong		x		volume label version %d,
11631>>7180  bedate		x		created on %s,
11632>8404	string		x		last mounted on %s,
11633#>9504	bedate		x		last checked at %s,
11634>8224	bedate		x		last written at %s,
11635>8401	byte		x		clean flag %d,
11636>8228	belong		x		number of blocks %d,
11637>8232	belong		x		number of data blocks %d,
11638>8236	belong		x		number of cylinder groups %d,
11639>8240	belong		x		block size %d,
11640>8244	belong		x		fragment size %d,
11641>8252	belong		x		minimum percentage of free blocks %d,
11642>8256	belong		x		rotational delay %dms,
11643>8260	belong		x		disk rotational speed %drps,
11644>8320	belong		0		TIME optimization
11645>8320	belong		1		SPACE optimization
11646
1164742332	belong		0x19540119	Unix Fast File system [v2] (big-endian)
11648>&-1164	string		x		last mounted on %s,
11649>&-696	string		>\0		volume name %s,
11650>&-304	beqldate	x		last written at %s,
11651>&-1167	byte		x		clean flag %d,
11652>&-1168	byte		x		readonly flag %d,
11653>&-296	bequad		x		number of blocks %lld,
11654>&-288	bequad		x		number of data blocks %lld,
11655>&-1332	belong		x		number of cylinder groups %d,
11656>&-1328	belong		x		block size %d,
11657>&-1324	belong		x		fragment size %d,
11658>&-180	belong		x		average file size %d,
11659>&-176	belong		x		average number of files in dir %d,
11660>&-272	bequad		x		pending blocks to free %lld,
11661>&-264	belong		x		pending inodes to free %d,
11662>&-664	bequad		x		system-wide uuid %0llx,
11663>&-1316	belong		x		minimum percentage of free blocks %d,
11664>&-1248	belong		0		TIME optimization
11665>&-1248	belong		1		SPACE optimization
11666
1166766908	belong		0x19540119	Unix Fast File system [v2] (big-endian)
11668>&-1164	string		x		last mounted on %s,
11669>&-696	string		>\0		volume name %s,
11670>&-304	beqldate	x		last written at %s,
11671>&-1167	byte		x		clean flag %d,
11672>&-1168	byte		x		readonly flag %d,
11673>&-296	bequad		x		number of blocks %lld,
11674>&-288	bequad		x		number of data blocks %lld,
11675>&-1332	belong		x		number of cylinder groups %d,
11676>&-1328	belong		x		block size %d,
11677>&-1324	belong		x		fragment size %d,
11678>&-180	belong		x		average file size %d,
11679>&-176	belong		x		average number of files in dir %d,
11680>&-272	bequad		x		pending blocks to free %lld,
11681>&-264	belong		x		pending inodes to free %d,
11682>&-664	bequad		x		system-wide uuid %0llx,
11683>&-1316	belong		x		minimum percentage of free blocks %d,
11684>&-1248	belong		0		TIME optimization
11685>&-1248	belong		1		SPACE optimization
11686
116870	ulequad		0xc8414d4dc5523031	HAMMER filesystem (little-endian),
11688>0x90	lelong+1	x			volume %d
11689>0x94	lelong		x			(of %d),
11690>0x50	string		x			name %s,
11691>0x98	ulelong		x			version %u,
11692>0xa0	ulelong		x			flags 0x%x
11693
11694# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
11695# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
11696# volume label and UUID Russell Coker
11697# https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
116980x438   leshort         0xEF53          Linux
11699>0x44c  lelong          x               rev %d
11700>0x43e  leshort         x               \b.%d
11701# No journal?  ext2
11702>0x45c  lelong          ^0x0000004      ext2 filesystem data
11703>>0x43a leshort         ^0x0000001      (mounted or unclean)
11704# Has a journal?  ext3 or ext4
11705>0x45c  lelong          &0x0000004
11706#  and small INCOMPAT?
11707>>0x460 lelong          <0x0000040
11708#   and small RO_COMPAT?
11709>>>0x464 lelong         <0x0000008      ext3 filesystem data
11710#   else large RO_COMPAT?
11711>>>0x464 lelong         >0x0000007      ext4 filesystem data
11712#  else large INCOMPAT?
11713>>0x460	lelong          >0x000003f      ext4 filesystem data
11714>0x468	belong		x		\b, UUID=%08x
11715>0x46c	beshort		x		\b-%04x
11716>0x46e	beshort		x		\b-%04x
11717>0x470	beshort		x		\b-%04x
11718>0x472	belong		x		\b-%08x
11719>0x476	beshort		x		\b%04x
11720>0x478	string		>0		\b, volume name "%s"
11721# General flags for any ext* fs
11722>0x460	lelong          &0x0000004      (needs journal recovery)
11723>0x43a	leshort         &0x0000002      (errors)
11724# INCOMPAT flags
11725>0x460	lelong          &0x0000001      (compressed)
11726#>0x460	lelong          &0x0000002      (filetype)
11727#>0x460	lelong          &0x0000010      (meta bg)
11728>0x460	lelong          &0x0000040      (extents)
11729>0x460	lelong          &0x0000080      (64bit)
11730#>0x460	lelong          &0x0000100      (mmp)
11731#>0x460	lelong          &0x0000200      (flex bg)
11732# RO_INCOMPAT flags
11733#>0x464	lelong          &0x0000001      (sparse super)
11734>0x464	lelong          &0x0000002      (large files)
11735>0x464	lelong          &0x0000008      (huge files)
11736#>0x464	lelong          &0x0000010      (gdt checksum)
11737#>0x464	lelong          &0x0000020      (many subdirs)
11738#>0x463	lelong          &0x0000040      (extra isize)
11739
11740# f2fs filesystem - Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
117410x400	lelong		0xF2F52010	F2FS filesystem
11742>0x46c	belong		x		\b, UUID=%08x
11743>0x470	beshort		x		\b-%04x
11744>0x472	beshort		x		\b-%04x
11745>0x474	beshort		x		\b-%04x
11746>0x476	belong		x		\b-%08x
11747>0x47a	beshort		x		\b%04x
11748>0x147c	lestring16	x		\b, volume name "%s"
11749
11750# Minix filesystems - Juan Cespedes <cespedes@debian.org>
117510x410	leshort		0x137f
11752!:strength / 2
11753>0x402	beshort		< 100
11754>0x402	beshort		> -1		Minix filesystem, V1, 14 char names, %d zones
11755>0x1e	string		minix		\b, bootable
117560x410	beshort		0x137f
11757!:strength / 2
11758>0x402	beshort		< 100
11759>0x402	beshort		> -1		Minix filesystem, V1 (big endian), %d zones
11760>0x1e	string		minix		\b, bootable
117610x410	leshort		0x138f
11762!:strength / 2
11763>0x402	beshort		< 100
11764>0x402	beshort		> -1		Minix filesystem, V1, 30 char names, %d zones
11765>0x1e	string		minix		\b, bootable
117660x410	beshort		0x138f
11767!:strength / 2
11768>0x402	beshort		< 100
11769>0x402	beshort		> -1		Minix filesystem, V1, 30 char names (big endian), %d zones
11770>0x1e	string		minix		\b, bootable
11771# Weak Magic: this is $x
11772#0x410	leshort		0x2468
11773#>0x402	beshort		< 100
11774#>>0x402	beshort		> -1		Minix filesystem, V2, 14 char names
11775#>0x1e	string		minix		\b, bootable
11776#0x410	beshort		0x2468
11777#>0x402	beshort		< 100
11778#>0x402	beshort		> -1		Minix filesystem, V2 (big endian)
11779#>0x1e	string		minix		\b, bootable
11780#0x410	leshort		0x2478
11781#>0x402	beshort		< 100
11782#>0x402	beshort		> -1		Minix filesystem, V2, 30 char names
11783#>0x1e	string		minix		\b, bootable
11784#0x410	leshort		0x2478
11785#>0x402	beshort		< 100
11786#>0x402	beshort		> -1		Minix filesystem, V2, 30 char names
11787#>0x1e	string		minix		\b, bootable
11788#0x410	beshort		0x2478
11789#>0x402	beshort		!0		Minix filesystem, V2, 30 char names (big endian)
11790#>0x1e	string		minix		\b, bootable
11791# Weak Magic! this is MD
11792#0x418	leshort		0x4d5a
11793#>0x402	beshort		<100
11794#>>0x402	beshort		> -1		Minix filesystem, V3, 60 char names
11795
11796# SGI disk labels - Nathan Scott <nathans@debian.org>
117970	belong		0x0BE5A941	SGI disk label (volume header)
11798
11799# SGI XFS filesystem - Nathan Scott <nathans@debian.org>
118000	belong		0x58465342	SGI XFS filesystem data
11801>0x4	belong		x		(blksz %d,
11802>0x68	beshort		x		inosz %d,
11803>0x64	beshort		^0x2004		v1 dirs)
11804>0x64	beshort		&0x2004		v2 dirs)
11805
11806############################################################################
11807# Minix-ST kernel floppy
118080x800	belong		0x46fc2700	Atari-ST Minix kernel image
11809# https://en.wikipedia.org/wiki/BIOS_parameter_block
11810# floppies with valid BPB and any instruction at beginning
11811>19	string		\240\005\371\005\0\011\0\2\0	\b, 720k floppy
11812>19	string		\320\002\370\005\0\011\0\1\0	\b, 360k floppy
11813
11814############################################################################
11815# Hmmm, is this a better way of detecting _standard_ floppy images ?
1181619	string		\320\002\360\003\0\011\0\1\0	DOS floppy 360k
11817>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
1181819	string		\240\005\371\003\0\011\0\2\0	DOS floppy 720k
11819>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
1182019	string		\100\013\360\011\0\022\0\2\0	DOS floppy 1440k
11821>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
11822
1182319	string		\240\005\371\005\0\011\0\2\0	DOS floppy 720k, IBM
11824>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
1182519	string		\100\013\371\005\0\011\0\2\0	DOS floppy 1440k, mkdosfs
11826>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
11827
1182819	string		\320\002\370\005\0\011\0\1\0	Atari-ST floppy 360k
1182919	string		\240\005\371\005\0\011\0\2\0	Atari-ST floppy 720k
11830#			|       |   |     |     |
11831#			|       |   |     |     heads
11832#			|       |   |     sectors/track
11833#			|       |   sectors/FAT
11834#			|       media descriptor
11835#		BPB:	sectors
11836
11837#  Valid media descriptor bytes for MS-DOS:
11838#
11839#     Byte   Capacity   Media Size and Type
11840#     -------------------------------------------------
11841#
11842#     F0     2.88 MB    3.5-inch, 2-sided, 36-sector
11843#     F0     1.44 MB    3.5-inch, 2-sided, 18-sector
11844#     F9     720K       3.5-inch, 2-sided, 9-sector
11845#     F9     1.2 MB     5.25-inch, 2-sided, 15-sector
11846#     FD     360K       5.25-inch, 2-sided, 9-sector
11847#     FF     320K       5.25-inch, 2-sided, 8-sector
11848#     FC     180K       5.25-inch, 1-sided, 9-sector
11849#     FE     160K       5.25-inch, 1-sided, 8-sector
11850#     FE     250K       8-inch, 1-sided, single-density
11851#     FD     500K       8-inch, 2-sided, single-density
11852#     FE     1.2 MB     8-inch, 2-sided, double-density
11853#     F8     -----      Fixed disk
11854#
11855#     FC     xxxK       Apricot 70x1x9 boot disk.
11856#
11857# Originally a bitmap:
11858#  xxxxxxx0	Not two sided
11859#  xxxxxxx1	Double sided
11860#  xxxxxx0x	Not 8 SPT
11861#  xxxxxx1x	8 SPT
11862#  xxxxx0xx	Not Removable drive
11863#  xxxxx1xx	Removable drive
11864#  11111xxx	Must be one.
11865#
11866# But now it's rather random:
11867#  111111xx	Low density disk
11868#        00	SS, Not 8 SPT
11869#        01	DS, Not 8 SPT
11870#        10	SS, 8 SPT
11871#        11	DS, 8 SPT
11872#
11873#  11111001	Double density 3 1/2 floppy disk, high density 5 1/4
11874#  11110000	High density 3 1/2 floppy disk
11875#  11111000	Hard disk any format
11876#
11877
11878# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013
11879# https://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions
11880# Too Weak.
11881#512		ubelong&0xE0ffff00	0xE0ffff00
11882# without valid Media descriptor in place of BPB, cases with are done at other places
11883#>21		ubyte			<0xE5			floppy with old FAT filesystem
11884# but valid Media descriptor at begin of FAT
11885#>>512		ubyte			=0xed			720k
11886#>>512		ubyte			=0xf0			1440k
11887#>>512		ubyte			=0xf8			720k
11888#>>512		ubyte			=0xf9			1220k
11889#>>512		ubyte			=0xfa			320k
11890#>>512		ubyte			=0xfb			640k
11891#>>512		ubyte			=0xfc			180k
11892# look like an old DOS directory entry
11893#>>>0xA0E	ubequad			0
11894#>>>>0xA00	ubequad			!0
11895#!:mime application/x-ima
11896#>>512		ubyte			=0xfd
11897# look for 2nd FAT at different location to distinguish between 360k and 500k
11898#>>>0x600	ubelong&0xE0ffff00	0xE0ffff00		360k
11899#>>>0x500	ubelong&0xE0ffff00	0xE0ffff00		500k
11900#>>>0xA0E	ubequad			0
11901#!:mime application/x-ima
11902#>>512		ubyte			=0xfe
11903#>>>0x400	ubelong&0xE0ffff00	0xE0ffff00		160k
11904#>>>>0x60E	ubequad			0
11905#>>>>>0x600	ubequad			!0
11906#!:mime application/x-ima
11907#>>>0xC00	ubelong&0xE0ffff00	0xE0ffff00		1200k
11908#>>512		ubyte			=0xff			320k
11909#>>>0x60E	ubequad			0
11910#>>>>0x600	ubequad			!0
11911#!:mime application/x-ima
11912#>>512		ubyte			x			\b, Media descriptor 0x%x
11913# without x86 jump instruction
11914#>>0		ulelong&0x804000E9	!0x000000E9
11915# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV
11916#>>>0	ubequad				0xfabce701b8c0078e	\b, MS-DOS 1.12 bootloader
11917# IOSYS.COM+MSDOS.COM
11918#>>>>0xc4	use			2xDOS-filename
11919#>>0		ulelong&0x804000E9	=0x000000E9
11920# only x86 short jump instruction found
11921#>>>0		ubyte			=0xEB
11922#>>>>1		ubyte			x			\b, code offset 0x%x+2
11923# https://thestarman.pcministry.com/DOS/ibm100/Boot.htm
11924# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0
11925#>>>>(1.b+2)	ubequad			0xfa8cc88ed8ba0000	\b, PC-DOS 1.0 bootloader
11926# ibmbio.com+ibmdos.com
11927#>>>>>0x176	use			DOS-filename
11928#>>>>>0x181	ubyte			x			\b+
11929#>>>>>0x182	use			DOS-filename
11930# https://thestarman.pcministry.com/DOS/ibm110/Boot.htm
11931# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV
11932#>>>>(1.b+2)	ubequad			0xfa8cc88ed833d28e	\b, PC-DOS 1.1 bootloader
11933# ibmbio.com+ibmdos.com
11934#>>>>>0x18b	use			DOS-filename
11935#>>>>>0x196	ubyte			x			\b+
11936#>>>>>0x197	use			DOS-filename
11937# https://en.wikipedia.org/wiki/Zenith_Data_Systems
11938# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6
11939#>>>>(1.b+2)	ubequad			0xbbc0078ed3bcc601	\b, Zenith Data Systems MS-DOS 1.25 bootloader
11940# IO.SYS+MSDOS.SYS
11941#>>>>>0x20	use			2xDOS-filename
11942# https://en.wikipedia.org/wiki/Corona_Data_Systems
11943# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX;
11944#>>>>(1.b+2)	ubequad			0x8cc88ed8fa8ed0bc	\b, MS-DOS 1.25 bootloader
11945# IO.SYS+MSDOS.SYS
11946#>>>>>0x69	use			2xDOS-filename
11947# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00;
11948#>>>>(1.b+2)	ubequad			0xfa0e17bc007cb860	\b, MS-DOS 2.11 bootloader
11949# defect IO.SYS+MSDOS.SYS ?
11950#>>>>>0x162	use			2xDOS-filename
11951
119520	name				cdrom
11953>38913	string   !NSR0      ISO 9660 CD-ROM filesystem data
11954!:mime	application/x-iso9660-image
11955!:ext	iso/iso9660
11956>38913	string    NSR0      UDF filesystem data
11957!:mime	application/x-iso9660-image
11958!:ext	iso/udf
11959>>38917	string    1         (version 1.0)
11960>>38917	string    2         (version 1.5)
11961>>38917	string    3         (version 2.0)
11962>>38917	byte     >0x33      (unknown version, ID 0x%X)
11963>>38917	byte     <0x31      (unknown version, ID 0x%X)
11964# The next line is not necessary because the MBR staff is done looking for boot signature
11965>0x1FE	leshort  0xAA55     (DOS/MBR boot sector)
11966# "application id" which appears to be used as a volume label
11967>32808	string/T  >\0       '%s'
11968>34816	string    \000CD001\001EL\ TORITO\ SPECIFICATION    (bootable)
1196937633	string    CD001     ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
11970!:mime	application/x-iso9660-image
1197132777	string    CDROM     High Sierra CD-ROM filesystem data
11972
11973# CDROM Filesystems
11974# https://en.wikipedia.org/wiki/ISO_9660
11975# Modified for UDF by gerardo.cacciari@gmail.com
1197632769	string    CD001
11977# mime line at that position does not work
11978# to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51)
11979#!:strength -11
11980# to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51)
11981!:strength +34
11982>0	use	cdrom
11983
11984# URL: https://en.wikipedia.org/wiki/NRG_(file_format)
11985# Reference: https://dl.opendesktop.org/api/files/download/id/1460731811/
11986#	11577-mount-iso-0.9.5.tar.bz2/mount-iso-0.9.5/install.sh
11987# From: Joerg Jenderek
11988# Note:	Only for nero disc with once (DAO) type after 300 KB header
11989339969	string    CD001	Nero CD image at 0x4B000
11990!:mime	application/x-nrg
11991!:ext	nrg
11992>307200	use cdrom
11993
11994# .cso files
11995# Reference: https://pismotec.com/ciso/ciso.h
11996# NOTE: There are two other formats with the same magic but
11997# completely incompatible specifications:
11998# - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h
11999# - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h
120000    string    CISO
12001# Other fields are used to determine what type of CISO this is:
12002# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
12003# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
12004# - 0x10 == 0x00004000: For >2GB files using maxcso...
12005# 			https://github.com/unknownbrackets/maxcso/issues/26
12006# - None of the above: Compact ISO.
12007>4	lelong	!0
12008>>4	lelong	!0x200000
12009>>>16	lelong	!0x800
12010>>>>16	lelong	!0x4000		Compressed ISO CD image
12011
12012# cramfs filesystem - russell@coker.com.au
120130       lelong    0x28cd3d45      Linux Compressed ROM File System data, little endian
12014>4      lelong  x size %u
12015>8      lelong  &1 version #2
12016>8      lelong  &2 sorted_dirs
12017>8      lelong  &4 hole_support
12018>32     lelong  x CRC 0x%x,
12019>36     lelong  x edition %u,
12020>40     lelong  x %u blocks,
12021>44     lelong  x %u files
12022
120230       belong    0x28cd3d45      Linux Compressed ROM File System data, big endian
12024>4      belong  x size %u
12025>8      belong  &1 version #2
12026>8      belong  &2 sorted_dirs
12027>8      belong  &4 hole_support
12028>32     belong  x CRC 0x%x,
12029>36     belong  x edition %u,
12030>40     belong  x %u blocks,
12031>44     belong  x %u files
12032
12033# reiserfs - russell@coker.com.au
120340x10034		string	ReIsErFs	ReiserFS V3.5
120350x10034		string	ReIsEr2Fs	ReiserFS V3.6
120360x10034		string	ReIsEr3Fs	ReiserFS V3.6.19
12037>0x1002c 	leshort	x		block size %d
12038>0x10032	leshort	&2		(mounted or unclean)
12039>0x10000	lelong	x		num blocks %d
12040>0x10040	lelong	1		tea hash
12041>0x10040	lelong	2		yura hash
12042>0x10040	lelong	3		r5 hash
12043
12044# JFFS - russell@coker.com.au
120450	lelong	0x34383931	Linux Journalled Flash File system, little endian
120460	belong	0x34383931	Linux Journalled Flash File system, big endian
12047
12048# EST flat binary format (which isn't, but anyway)
12049# From: Mark Brown <broonie@sirena.org.uk>
120500	string	ESTFBINR	EST flat binary
12051
12052# Aculab VoIP firmware
12053# From: Mark Brown <broonie@sirena.org.uk>
120540	string	VoIP\ Startup\ and	Aculab VoIP firmware
12055>35	string	x	format %s
12056
12057# From: Mark Brown <broonie@sirena.org.uk> [old]
12058# From: Behan Webster <behanw@websterwood.com>
120590	belong	0x27051956	u-boot legacy uImage,
12060>32	string	x		%s,
12061>28	byte	0		Invalid os/
12062>28	byte	1		OpenBSD/
12063>28	byte	2		NetBSD/
12064>28	byte	3		FreeBSD/
12065>28	byte	4		4.4BSD/
12066>28	byte	5		Linux/
12067>28	byte	6		SVR4/
12068>28	byte	7		Esix/
12069>28	byte	8		Solaris/
12070>28	byte	9		Irix/
12071>28	byte	10		SCO/
12072>28	byte	11		Dell/
12073>28	byte	12		NCR/
12074>28	byte	13		LynxOS/
12075>28	byte	14		VxWorks/
12076>28	byte	15		pSOS/
12077>28	byte	16		QNX/
12078>28	byte	17		Firmware/
12079>28	byte	18		RTEMS/
12080>28	byte	19		ARTOS/
12081>28	byte	20		Unity OS/
12082>28	byte	21		INTEGRITY/
12083>29	byte	0		\bInvalid CPU,
12084>29	byte	1		\bAlpha,
12085>29	byte	2		\bARM,
12086>29	byte	3		\bIntel x86,
12087>29	byte	4		\bIA64,
12088>29	byte	5		\bMIPS,
12089>29	byte	6		\bMIPS 64-bit,
12090>29	byte	7		\bPowerPC,
12091>29	byte	8		\bIBM S390,
12092>29	byte	9		\bSuperH,
12093>29	byte	10		\bSparc,
12094>29	byte	11		\bSparc 64-bit,
12095>29	byte	12		\bM68K,
12096>29	byte	13		\bNios-32,
12097>29	byte	14		\bMicroBlaze,
12098>29	byte	15		\bNios-II,
12099>29	byte	16		\bBlackfin,
12100>29	byte	17		\bAVR32,
12101>29	byte	18		\bSTMicroelectronics ST200,
12102>29	byte	19		\bSandbox architecture,
12103>29	byte	20		\bANDES Technology NDS32,
12104>29	byte	21		\bOpenRISC 1000,
12105>29	byte	22		\bARM 64-bit,
12106>29	byte	23		\bDesignWare ARC,
12107>29	byte	24		\bx86_64,
12108>29	byte	25		\bXtensa,
12109>30	byte	0		Invalid Image
12110>30	byte	1		Standalone Program
12111>30	byte	2		OS Kernel Image
12112>30	byte	3		RAMDisk Image
12113>30	byte	4		Multi-File Image
12114>30	byte	5		Firmware Image
12115>30	byte	6		Script File
12116>30	byte	7		Filesystem Image (any type)
12117>30	byte	8		Binary Flat Device Tree BLOB
12118>31	byte	0		(Not compressed),
12119>31	byte	1		(gzip),
12120>31	byte	2		(bzip2),
12121>31	byte	3		(lzma),
12122>12	belong	x		%d bytes,
12123>8	bedate	x		%s,
12124>16	belong	x		Load Address: 0x%08X,
12125>20	belong	x		Entry Point: 0x%08X,
12126>4	belong	x		Header CRC: 0x%08X,
12127>24	belong	x		Data CRC: 0x%08X
12128
12129# JFFS2 file system
121300	leshort	0x1984		Linux old jffs2 filesystem data little endian
121310	leshort	0x1985		Linux jffs2 filesystem data little endian
12132
12133# Squashfs
121340	string	sqsh	Squashfs filesystem, big endian,
12135>28	beshort	x	version %d.
12136>30	beshort x	\b%d,
12137>28	beshort <3
12138>>8	belong	x	%d bytes,
12139>28	beshort >2
12140>>28 beshort <4
12141>>>63	bequad x	%lld bytes,
12142>>28 beshort >3
12143>>>40	bequad x	%lld bytes,
12144#>>67	belong	x	%d bytes,
12145>4	belong	x	%d inodes,
12146>28	beshort <2
12147>>32	beshort	x	blocksize: %d bytes,
12148>28	beshort >1
12149>>28 beshort <4
12150>>>51	belong	x	blocksize: %d bytes,
12151>>28 beshort >3
12152>>>12	belong	x	blocksize: %d bytes,
12153>28 beshort <4
12154>>39	bedate	x	created: %s
12155>28 beshort >3
12156>>8	bedate	x	created: %s
121570	string	hsqs	Squashfs filesystem, little endian,
12158>28	leshort	x	version %d.
12159>30	leshort	x	\b%d,
12160>28	leshort <3
12161>>8	lelong	x	%d bytes,
12162>28	leshort >2
12163>>28 leshort <4
12164>>>63	lequad x	%lld bytes,
12165>>28 leshort >3
12166>>>40	lequad x	%lld bytes,
12167#>>63	lelong	x	%d bytes,
12168>4	lelong	x	%d inodes,
12169>28	leshort <2
12170>>32	leshort	x	blocksize: %d bytes,
12171>28	leshort >1
12172>>28 leshort <4
12173>>>51	lelong	x	blocksize: %d bytes,
12174>>28 leshort >3
12175>>>12	lelong	x	blocksize: %d bytes,
12176>28 leshort <4
12177>>39	ledate	x	created: %s
12178>28 leshort >3
12179>>8	ledate	x	created: %s
12180
12181# AFS Dump Magic
12182# From: Ty Sarna <tsarna@sarna.org>
121830       string                  \x01\xb3\xa1\x13\x22    AFS Dump
12184>&0     belong                  x                       (v%d)
12185>>&0    byte                    0x76
12186>>>&0   belong                  x                       Vol %d,
12187>>>>&0  byte                    0x6e
12188>>>>>&0 string                  x                       %s
12189>>>>>>&1        byte            0x74
12190>>>>>>>&0       beshort         2
12191>>>>>>>>&4      bedate          x                       on: %s
12192>>>>>>>>&0      bedate          =0                      full dump
12193>>>>>>>>&0      bedate          !0                      incremental since: %s
12194
12195#----------------------------------------------------------
12196#delta ISO    Daniel Novotny (dnovotny@redhat.com)
121970	string  DISO	Delta ISO data
12198!:strength +50
12199>4	belong  x	version %d
12200
12201# VMS backup savesets - gerardo.cacciari@gmail.com
12202#
122034            string  \x01\x00\x01\x00\x01\x00
12204>(0.s+16)    string  \x01\x01
12205>>&(&0.b+8)  byte    0x42       OpenVMS backup saveset data
12206>>>40        lelong  x          (block size %d,
12207>>>49        string  >\0        original name '%s',
12208>>>2         short   1024       VAX generated)
12209>>>2         short   2048       AXP generated)
12210>>>2         short   4096       I64 generated)
12211
12212# Summary: Oracle Clustered Filesystem
12213# Created by: Aaron Botsis <redhat@digitalmafia.org>
122148	string		OracleCFS	Oracle Clustered Filesystem,
12215>4	long		x		rev %d
12216>0	long		x		\b.%d,
12217>560	string		x		label: %.64s,
12218>136	string		x		mountpoint: %.128s
12219
12220# Summary: Oracle ASM tagged volume
12221# Created by: Aaron Botsis <redhat@digitalmafia.org>
1222232	string		ORCLDISK	Oracle ASM Volume,
12223>40	string		x		Disk Name: %0.12s
1222432	string		ORCLCLRD	Oracle ASM Volume (cleared),
12225>40	string		x		Disk Name: %0.12s
12226
12227# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org>
122288	string		OracleCFS	Oracle Clustered Filesystem,
12229>4	long		x		rev %d
12230>0	long		x		\b.%d,
12231>560	string		x		label: %.64s,
12232>136	string		x		mountpoint: %.128s
12233
12234# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org>
1223532	string		ORCLDISK	Oracle ASM Volume,
12236>40	string		x		Disk Name: %0.12s
1223732	string		ORCLCLRD	Oracle ASM Volume (cleared),
12238>40	string		x		Disk Name: %0.12s
12239
12240# Compaq/HP RILOE floppy image
12241# From: Dirk Jagdmann <doj@cubic.org>
122420	string	CPQRFBLO	Compaq/HP RILOE floppy image
12243
12244#------------------------------------------------------------------------------
12245# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours).
12246# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes,
12247# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com
12248#
122491008    string          DECFILE11       Files-11 On-Disk Structure
12250>525    byte            x               (ODS-%d);
12251>1017   string          A               RSX-11, VAX/VMS or OpenVMS VAX file system;
12252>1017   string          B
12253>>525   byte            2               VAX/VMS or OpenVMS file system;
12254>>525   byte            5               OpenVMS Alpha or Itanium file system;
12255>984    string          x               volume label is '%-12.12s'
12256
12257# From: Thomas Klausner <wiz@NetBSD.org>
12258# https://filext.com/file-extension/DAA
12259# describes the daa file format. The magic would be:
122600	string		DAA\x0\x0\x0\x0\x0	PowerISO Direct-Access-Archive
12261
12262# From Albert Cahalan <acahalan@gmail.com>
12263# really le32 operation,destination,payloadsize (but quite predictable)
12264# 01 00 00 00 00 00 00 c0 00 02 00 00
122650	string		\1\0\0\0\0\0\0\300\0\2\0\0	Marvell Libertas firmware
12266
12267# From Eric Sandeen
12268# GFS2
122690x10000         belong          0x01161970
12270>0x10018        belong          0x0000051d      GFS1 Filesystem
12271>>0x10024        belong          x               (blocksize %d,
12272>>0x10060        string          >\0             lockproto %s)
12273>0x10018        belong          0x00000709      GFS2 Filesystem
12274>>0x10024        belong          x               (blocksize %d,
12275>>0x10060        string          >\0             lockproto %s)
12276
12277# Russell Coker <russell@coker.com.au>
122780x10040		string	_BHRfS_M	BTRFS Filesystem
12279>0x1012b	string	>\0		label "%s",
12280>0x10090	lelong	x		sectorsize %d,
12281>0x10094	lelong	x		nodesize %d,
12282>0x10098	lelong	x		leafsize %d,
12283>0x10020	belong	x		UUID=%08x-
12284>0x10024	beshort	x		\b%04x-
12285>0x10026	beshort	x		\b%04x-
12286>0x10028	beshort	x		\b%04x-
12287>0x1002a	beshort	x		\b%04x
12288>0x1002c	belong	x		\b%08x,
12289>0x10078	lequad	x		%lld/
12290>0x10070	lequad	x		\b%lld bytes used,
12291>0x10088	lequad	x		%lld devices
12292
12293# dvdisaster's .ecc
12294# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
122950	string	*dvdisaster*	dvdisaster error correction file
12296
12297# xfs metadump image
12298# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
12299# but can we do the << ?  For now it's always 512 (0x200) anyway.
123000	string XFSM
12301>0x200	string XFSB	XFS filesystem metadump image
12302
12303# Type:	CROM filesystem
12304# From:	Werner Fink <werner@suse.de>
123050	string	CROMFS	CROMFS
12306>6	string	>\0	\b version %2.2s,
12307>8	ulequad	>0	\b block data at %lld,
12308>16	ulequad	>0	\b fblock table at %lld,
12309>24	ulequad	>0	\b inode table at %lld,
12310>32	ulequad	>0	\b root at %lld,
12311>40	ulelong	>0	\b fblock size = %d,
12312>44	ulelong	>0	\b block size = %d,
12313>48	ulequad	>0	\b bytes = %lld
12314
12315# Type:	xfs metadump image
12316# From:	Daniel Novotny <dnovotny@redhat.com>
12317# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
12318# but can we do the << ? For now it's always 512 (0x200) anyway.
123190	string	XFSM
12320>0x200	string	XFSB	XFS filesystem metadump image
12321
12322# Type:	delta ISO
12323# From:	Daniel Novotny <dnovotny@redhat.com>
123240	string	DISO	Delta ISO data,
12325>4	belong	x	version %d
12326
12327# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.)
12328# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags.
12329# From: Adam Buchbinder <adam.buchbinder@gmail.com>
123300x8000	string	JFS1
12331# Because it's text-only magic, check a binary value (version) to be sure.
12332# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be
12333# mountable.
12334>&0	lelong	<3	JFS2 filesystem image
12335# Label is followed by a UUID; we have to limit string length to avoid
12336# appending the UUID in the case of a 16-byte label.
12337>>&144	regex	[\x20-\x7E]{1,16}	(label "%s")
12338>>&0	lequad	x	\b, %lld blocks
12339>>&8	lelong	x	\b, blocksize %d
12340>>&32	lelong&0x00000006	>0	(dirty)
12341>>&36	lelong	>0	(compressed)
12342
12343# LFS
123440	lelong	0x070162	LFS filesystem image
12345>4	lelong	1		version 1,
12346>>8	lelong	x		\b blocks %u,
12347>>12	lelong	x		\b blocks per segment %u,
12348>4	lelong	2		version 2,
12349>>8	lelong	x		\b fragments %u,
12350>>12	lelong	x		\b bytes per segment %u,
12351>16	lelong	x		\b disk blocks %u,
12352>20	lelong	x		\b block size %u,
12353>24	lelong	x		\b fragment size %u,
12354>28	lelong	x		\b fragments per block %u,
12355>32	lelong	x		\b start for free list %u,
12356>36	lelong	x		\b number of free blocks %d,
12357>40	lelong	x		\b number of files %u,
12358>44	lelong	x		\b blocks available for writing %d,
12359>48	lelong	x		\b inodes in cache %d,
12360>52	lelong	x		\b inode file disk address 0x%x,
12361>56	lelong	x		\b inode file inode number %u,
12362>60	lelong	x		\b address of last segment written 0x%x,
12363>64	lelong	x		\b address of next segment to write 0x%x,
12364>68	lelong	x		\b address of current segment written 0x%x
12365
123660	string	td\000		floppy image data (TeleDisk, compressed)
123670	string	TD\000		floppy image data (TeleDisk)
12368
123690	string	CQ\024		floppy image data (CopyQM,
12370>16	leshort	x		%d sectors,
12371>18	leshort	x		%d heads.)
12372
123730	string	ACT\020Apricot\020disk\020image\032\004	floppy image data (ApriDisk)
12374
123750	beshort	0xAA58		floppy image data (IBM SaveDskF, old)
123760	beshort	0xAA59		floppy image data (IBM SaveDskF)
123770	beshort	0xAA5A		floppy image data (IBM SaveDskF, compressed)
12378
123790	string	\074CPM_Disk\076	disk image data (YAZE)
12380
12381# ReFS
12382# Richard W.M. Jones <rjones@redhat.com>
123830	string	\0\0\0ReFS\0	ReFS filesystem image
12384
12385# EFW encase image file format:
12386# Gregoire Passault
12387# http://www.forensicswiki.org/wiki/Encase_image_file_format
123880	string	EVF\x09\x0d\x0a\xff\x00	EWF/Expert Witness/EnCase image file format
12389
12390# UBIfs
12391# Linux kernel sources: fs/ubifs/ubifs-media.h
123920	lelong	0x06101831
12393>0x16	leshort	0		UBIfs image
12394>0x08	lequad	x		\b, sequence number %llu
12395>0x10	leshort x		\b, length %u
12396>0x04	lelong	x		\b, CRC 0x%08x
12397
123980	lelong	0x23494255
12399>0x04	leshort	<2
12400>0x05	string	\0\0\0
12401>0x1c	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
12402>0x04	leshort	x		UBI image, version %u
12403
12404# NEC PC-88 2D disk image
12405# From Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
124060x20		ulelong&0xFFFFFEFF	0x2A0
12407>0x10		string			\0\0\0\0\0\0\0\0\0\0
12408>>0x280		string			\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
12409>>>0x1A		ubyte&0xEF		0
12410>>>>0x1B	ubyte&0x8F		0
12411>>>>>0x1B	ubyte&70		<0x40
12412>>>>>>0x1C	ulelong			>0x21
12413>>>>>>>0	regex	[[:print:]]*	NEC PC-88 disk image, name=%s
12414>>>>>>>>0x1B	ubyte	0		\b, media=2D
12415>>>>>>>>0x1B	ubyte	0x10		\b, media=2DD
12416>>>>>>>>0x1B	ubyte	0x20		\b, media=2HD
12417>>>>>>>>0x1B	ubyte	0x30		\b, media=1D
12418>>>>>>>>0x1B	ubyte	0x40		\b, media=1DD
12419>>>>>>>>0x1A	ubyte	0x10		\b, write-protected
12420
12421# HDD Raw Copy Tool disk image, file extension: .imgc
12422# From Benjamin Vanheuverzwijn <bvanheu@gmail.com>
124230	pstring	HDD\ Raw\ Copy\ Tool	%s
12424>0x100	pstring	x			%s
12425>0x200	pstring	x			- HD model: %s
12426#>0x300	pstring	x			unknown %s
12427>0x400	pstring	x			serial: %s
12428#>0x500	pstring	x			unknown: %s
12429!:ext	imgc
12430
12431#------------------------------------------------------------------------------
12432# $File: finger,v 1.3 2019/04/19 00:42:27 christos Exp $
12433# fingerprint:  file(1) magic for fingerprint data
12434# XPM bitmaps)
12435#
12436
12437# https://cgit.freedesktop.org/libfprint/libfprint/tree/libfprint/data.c
12438
124390	string	FP1		libfprint fingerprint data V1
12440>3	beshort	x		\b, driver_id %x
12441>5	belong	x		\b, devtype %x
12442
124430	string	FP2		libfprint fingerprint data V2
12444>3	beshort	x		\b, driver_id %x
12445>5	belong	x		\b, devtype %x
12446
12447#------------------------------------------------------------------------------
12448# $File: flash,v 1.15 2019/04/19 00:42:27 christos Exp $
12449# flash:	file(1) magic for Macromedia Flash file format
12450#
12451# See
12452#
12453#	https://www.macromedia.com/software/flash/open/
12454#	https://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\
12455#	en/devnet/swf/pdf/swf-file-format-spec.pdf page 27
12456#
12457
124580   name	swf-details
12459
12460>0	string		F
12461>>8	byte&0xfd	0x08		Macromedia Flash data
12462!:mime	application/x-shockwave-flash
12463>>>3	byte		x		\b, version %d
12464>>8	byte&0xfe	0x10		Macromedia Flash data
12465!:mime	application/x-shockwave-flash
12466>>>3	byte		x		\b, version %d
12467>>8	byte		0x18		Macromedia Flash data
12468!:mime	application/x-shockwave-flash
12469>>>3	byte		x		\b, version %d
12470>>8	beshort&0xff87	0x2000		Macromedia Flash data
12471!:mime	application/x-shockwave-flash
12472>>>3	byte		x		\b, version %d
12473>>8	beshort&0xffe0	0x3000		Macromedia Flash data
12474!:mime	application/x-shockwave-flash
12475>>>3	byte		x		\b, version %d
12476>>8	byte&0x7	0
12477>>>8	ubyte		>0x2f
12478>>>>9	ubyte		<0x20		Macromedia Flash data
12479!:mime	application/x-shockwave-flash
12480>>>>>3	byte		x		\b, version %d
12481
12482>0	string		C
12483>>8	byte		0x78		Macromedia Flash data (compressed)
12484!:mime	application/x-shockwave-flash
12485>>>3	byte		x		\b, version %d
12486
12487>0	string		Z
12488>>8	byte		0x5d		Macromedia Flash data (lzma compressed)
12489!:mime	application/x-shockwave-flash
12490>>>3	byte		x		\b, version %d
12491
12492
124931	string		WS
12494>4	ulelong		>14
12495>>3	ubyte		!0
12496>>>0	use		swf-details
12497
12498# From: Cal Peake <cp@absolutedigital.net>
124990	string		FLV\x01		Macromedia Flash Video
12500!:mime	video/x-flv
12501
12502#
12503# Yosu Gomez
125040	string	AGD2\xbe\xb8\xbb\xcd\x00	Macromedia Freehand 7 Document
125050	string	AGD3\xbe\xb8\xbb\xcc\x00	Macromedia Freehand 8 Document
12506# From Dave Wilson
125070	string	AGD4\xbe\xb8\xbb\xcb\x00	Macromedia Freehand 9 Document
12508
12509#------------------------------------------------------------------------------
12510#	$File: flif,v 1.1 2015/11/23 22:04:36 christos Exp $
12511#	flif:	Magic	data	for	file(1)	command.
12512#	FLIF	(Free	Lossless	Image	Format)
12513
125140	string	FLIF	FLIF
12515>4	string	<H	image data
12516>>6	beshort	x	\b, %u
12517>>8	beshort	x	\bx%u
12518>>5	string	1	\b, 8-bit/color,
12519>>5	string	2	\b, 16-bit/color,
12520>>4	string	1	\b, grayscale, non-interlaced
12521>>4	string	3	\b, RGB, non-interlaced
12522>>4	string	4	\b, RGBA, non-interlaced
12523>>4	string	A	\b, grayscale
12524>>4	string	C	\b, RGB, interlaced
12525>>4	string	D	\b, RGBA, interlaced
12526>4	string	>H	\b, animation data
12527>>5	ubyte	<255	\b, %i frames
12528>>>7	beshort	x	\b, %u
12529>>>9	beshort	x	\bx%u
12530>>>6	string	=1	\b, 8-bit/color
12531>>>6	string	=2	\b, 16-bit/color
12532>>5	ubyte	0xFF
12533>>>6	beshort	x	\b, %i frames,
12534>>>9	beshort	x	\b, %u
12535>>>11	beshort	x	\bx%u
12536>>>8	string	=1	\b, 8-bit/color
12537>>>8	string	=2	\b, 16-bit/color
12538>>4	string	=Q	\b, grayscale, non-interlaced
12539>>4	string	=S	\b, RGB, non-interlaced
12540>>4	string	=T	\b, RGBA, non-interlaced
12541>>4	string	=a	\b, grayscale
12542>>4	string	=c	\b, RGB, interlaced
12543>>4	string	=d	\b, RGBA, interlaced
12544
12545#------------------------------------------------------------------------------
12546# $File: fonts,v 1.41 2019/05/05 16:44:04 christos Exp $
12547# fonts:  file(1) magic for font data
12548#
125490	search/1	FONT		ASCII vfont text
125500	short		0436		Berkeley vfont data
125510	short		017001		byte-swapped Berkeley vfont data
12552
12553# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
125540	string		%!PS-AdobeFont-1.	PostScript Type 1 font text
12555>20	string		>\0			(%s)
125566	string		%!PS-AdobeFont-1.	PostScript Type 1 font program data
125570	string		%!FontType1	PostScript Type 1 font program data
125586	string		%!FontType1	PostScript Type 1 font program data
125590	string		%!PS-Adobe-3.0\ Resource-Font	PostScript Type 1 font text
12560
12561# Summary:	PostScript Type 1 Printer Font Metrics
12562# URL:		https://en.wikipedia.org/wiki/PostScript_fonts
12563# Reference:	https://partners.adobe.com/public/developer/en/font/5178.PFM.pdf
12564# Modified by:	Joerg Jenderek
12565# Note:		moved from ./msdos magic
12566# dfVersion 256=0100h
125670		uleshort	0x0100
12568# GRR: line above is too general as it catches also TrueType font,
12569# raw G3 data FAX, WhatsApp encrypted and Panorama database
12570# dfType 129=0081h
12571>66		uleshort	0x0081
12572# dfVertRes 300=012Ch not needed as additional test
12573#>>70		uleshort	0x012c
12574# dfHorizRes 300=012Ch
12575#>>>72		uleshort	0x012c
12576# dfDriverInfo points to postscript information section
12577>>(101.l)	string/c	Postscript	Printer Font Metrics
12578# above labeled "PFM data" by ./msdos (version 5.28) or "Adobe Printer Font Metrics" by TrID
12579!:mime	application/x-font-pfm
12580# AppleShare Print Server
12581#!:apple	ASPS????
12582!:ext	pfm
12583# dfCopyright 60 byte null padded Copyright string. uncomment it to get old looking
12584#>>>6		string		>\060		- %-.60s
12585# dfDriverInfo
12586>>>139		ulelong		>0
12587# often abbreviated and same as filename
12588>>>>(139.l)	string		x		%s
12589# dfSize
12590>>>2		ulelong		x		\b, %d bytes
12591# dfFace 210=D2h 9Eh
12592>>>105		ulelong		>0
12593# Windows font name
12594>>>>(105.l)	string		x		\b, %s
12595# dfItalic
12596>>>80		ubyte		1		italic
12597# dfUnderline
12598>>>81		ubyte		1		underline
12599# dfStrikeOut
12600>>>82		ubyte		1		strikeout
12601# dfWeight 400=0x0190 300=0x012c 500=0x01f4 600=0x0258 700=0x02bc
12602>>>83		uleshort	>699		bold
12603# dfPitchAndFamily 16 17 48 49 64 65
12604>>>90		ubyte		16		serif
12605>>>90		ubyte		17		serif proportional
12606#>>>90		ubyte		48		other
12607>>>90		ubyte		49		proportional
12608>>>90		ubyte		64		script
12609>>>90		ubyte		65		script proportional
12610
12611# X11 font files in SNF (Server Natural Format) format
12612# updated by Joerg Jenderek at Feb 2013
12613# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm
126140	belong		00000004		X11 SNF font data, MSB first
12615#>104	belong		00000004		X11 SNF font data, MSB first
12616!:mime	application/x-font-sfn
12617# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX
126180	lelong		00000004
12619>104	lelong		00000004		X11 SNF font data, LSB first
12620!:mime	application/x-font-sfn
12621
12622# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
126230	search/1	STARTFONT\ 		X11 BDF font text
12624
12625# From: Joerg Jenderek
12626# URL: https://grub.gibibit.com/New_font_format
12627# Reference: util/grub-mkfont.c
12628#		include/grub/fontformat.h
12629# FONT_FORMAT_SECTION_NAMES_FILE
126300			string		FILE
12631# FONT_FORMAT_PFF2_MAGIC
12632>8			string		PFF2
12633# leng 4 only at the moment
12634>>4			ubelong		4
12635# FONT_FORMAT_SECTION_NAMES_FONT_NAME
12636>>>12			string		NAME		GRUB2 font
12637!:mime			application/x-font-pf2
12638!:ext			pf2
12639# length of font_name
12640>>>>16			ubelong		>0
12641# font_name
12642>>>>>20			string		>\0		"%-s"
12643
12644# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
12645# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
126460	string		\001fcp			X11 Portable Compiled Font data,
12647>12	lelong		^0x08			bit: LSB,
12648>12	lelong		&0x08			bit: MSB,
12649>12	lelong		^0x04			byte: LSB first
12650>12	lelong		&0x04			byte: MSB first
126510	string		D1.0\015		X11 Speedo font data
12652
12653#------------------------------------------------------------------------------
12654# FIGlet fonts and controlfiles
12655# From figmagic supplied with Figlet version 2.2
12656# "David E. O'Brien" <obrien@FreeBSD.ORG>
126570	string		flf		FIGlet font
12658>3	string		>2a		version %-2.2s
126590	string		flc		FIGlet controlfile
12660>3	string		>2a		version %-2.2s
12661
12662# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
12663# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
126640	belong		0x14025919	libGrx font data,
12665>8	leshort		x		%dx
12666>10	leshort		x		\b%d
12667>40	string		x		%s
12668# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
126690	belong		0xff464f4e	DOS code page font data collection
126707	belong		0x00454741	DOS code page font data
126717	belong		0x00564944	DOS code page font data (from Linux?)
126724098	string		DOSFONT		DOSFONT2 encrypted font data
12673
12674# From: Joerg Jenderek
12675# URL: http://fileformats.archiveteam.org/wiki/GEM_bitmap_font
12676# Reference: http://cd.textfiles.com/ataricompendium/BOOK/HTML/APPENDC.HTM#cnt
12677#
12678# usual case with lightening mask and skewing mask 5555h~UU
1267962	ulelong		0x55555555
12680>0	use		gdos-font
12681# BOX18.GFT COWBOY30.GFT ROYALK30.GFT
1268262	ulelong		0
12683# skip ISO 9660 CD-ROM ./filesystem by looking for low positive face size
12684>2	uleshort	>2
12685# skip DOS 2.0 backup id file ./msdos by looking for face size lower/equal 48
12686>>2	uleshort	<49
12687# skip MS Windows ICO ./msdos by looking for valid face name
12688>>>4	ubeshort	>0x1F00
12689# skip DOS executable BACKM212.COM by looking for horizontal offset table after header
12690#>>>>68	ulelong		>87		OFFSET_OK
12691>>>>0	use		gdos-font
126920	name		gdos-font
12693>0	uleshort	x		GEM GDOS font
12694!:mime	application/x-font-gdos
12695# also .eps found like AA070GEP.EPS AI360GEP.EPS
12696!:ext	fnt/gtf
12697# font name like University Bold
12698>4	string		x		%.32s
12699# face size in points 3-48
12700>2	uleshort	x		%u
12701# face ID (must be unique)
12702>0	uleshort	x		\b, ID 0x%4.4x
12703# lowest character index in face (usually 32 for disk-loaded fonts).
12704#>36	uleshort	x		\b, low character index %u
12705# width of the widest character
12706#>50	uleshort	x		\b, %u char width
12707# width of the widest character cell
12708#>52	uleshort	x		\b, %u cell width
12709# thickening size
12710#>58	uleshort	x		\b, %u thick
12711# lightening mask to eliminate pixels, usually 5555h
12712>62	uleshort	!0x5555		\b, lightening mask 0x%x
12713# skewing mask to determine when to perform additional rotation when skewing, usually 5555h
12714>64	uleshort	!0x5555		\b, skewing mask 0x%x
12715# offset to horizontal offset table 58h~88 5eh
12716#>68	ulelong		>88		\b, 0x%x horizontal table offset
12717# offset character offset table
12718#>72	ulelong		x		\b, 0x%x coffset
12719# offset to font data
12720#>72	ulelong		x		\b, 0x%x foffset
12721# form width in bytes
12722#>80	uleshort	x		\b, %u fwidth
12723# pointer to the next font, set by GDOS after loading
12724#>84	ulelong		x		\b, 0x%x noffset
12725
12726# downloadable fonts for browser (prints type) anthon@mnt.org
12727# https://tools.ietf.org/html/rfc3073
127280	string		PFR1		Portable Font Resource font data (new)
12729>102	string		>0		\b: %s
127300	string		PFR0		Portable Font Resource font data (old)
12731>4	beshort		>0		version %d
12732
12733# True Type fonts
12734# Modified by: Joerg Jenderek
12735# URL: https://en.wikipedia.org/wiki/TrueType
12736# Reference: https://developer.apple.com/fonts/TrueType-Reference-Manual/
12737#
12738# sfnt version "typ1" used by some Apple, but no example found
127390	string	typ1
12740>0	use		sfnt-font
12741>0	use		sfnt-names
12742# sfnt version "true" used by some Apple
127430	string	true
12744>0	use		sfnt-font
12745>0	use		sfnt-names
12746# GRR: below test is too general
12747# sfnt version often 0x00010000
127480	string	\000\001\000\000
12749>0	use		sfnt-font
12750>0	use		sfnt-names
12751#	validate and display sfnt font data like number of tables
127520	name		sfnt-font
12753# file 5.30 version assumes 00FFh as maximal number of tables
12754#>4	ubeshort	<0x0100
12755# maximal 27 tables found like in Skia.ttf
12756# 46 different table names mentioned on Apple specification
12757# skip 1st sequence of DOS 2 backup with path separator (\~92 or /~47) misinterpreted as table number
12758>4	ubeshort	<47
12759# skip bad examples with garbage table names like in a5.show HYPERC MAC
12760# tag names consist of up to four characters padded with spaces at end like
12761# BASE DSIG OS/2 Zapf acnt glyf cvt vmtx xref ...
12762>>12	regex/4l	\^[A-Za-z][A-Za-z][A-Za-z/][A-Za-z2\ ]
12763#>>>0	ubelong	x	\b, sfnt version 0x%x
12764>>>0	ubelong	!0x4f54544f	TrueType
12765!:mime	font/sfnt
12766!:apple	????tfil
12767# .ttf for TrueType font
12768# EUDC.tte created by privat character editor %WINDIR%\system32\eudcedit.exe
12769!:ext	ttf/tte
12770# sfnt version 4F54544Fh~OTTO
12771>>>0	ubelong	=0x4f54544f	OpenType
12772!:mime	font/otf
12773!:apple	????OTTO
12774!:ext	otf
12775>>>0	ubelong	x		Font data
12776# DSIG=44454947h table name implies a digitally signed font
12777# search range = number of tables * 16 =< maximal number of tables * 16 = 27 * 16 = 432
12778>>>12	search/432	DSIG		\b, digitally signed
12779>>>4	ubeshort	x		\b, %d tables
12780# minimal 9 tables found like in NISC18030.ttf
12781#>>>4	ubeshort	<10		TMIN
12782#>>>4	ubeshort	>24		TBIG
12783# table directory entries
12784>>>12	string		x		\b, 1st "%4.4s"
12785
12786#	search and display 1st name in sfnt font which is often copyright text
12787#	does not work inside font collections
127880	name		sfnt-names
12789# search for naming table
12790>12	search/432/s	name
12791# biggest offset 0x0100bd28 like Windows10 Fonts\simsunb.ttf
12792#>>>>&8	ubelong		>0x0100bd27	BIGGEST OFFSET
12793>>&8	ubelong		>0x00100000
12794# offset of name table
12795>>>&-4	ubelong		x		\b, name offset 0x%x
12796# GRR: pointer to name table only works if offset ~< FILE_BYTES_MAX = 100000h defined in src\file.h
12797>>&8	ubelong		<0x00100000
12798>>>&-16	ubelong		x
12799# name table
12800>>>>(&8.L)	ubequad	x
12801# invalid format selector
12802#>>>>>&-8	ubeshort	!0	\b, invalid selector %x
12803# minimal 3 name records found like in c:\Program Files (x86)\Tesseract-OCR\tessdata\pdf.ttf
12804# maximal 1227 name records found like in Apple Chancery.ttf
12805#>>>>>&-6	ubeshort	<0x4	mincount
12806#>>>>>&-6	ubeshort	>130	maxcount
12807>>>>>&-6	ubeshort	x	\b, %d names
12808# offset to start of string storage from start of table
12809#>>>>>&-4	ubeshort	x	\b, record offset %d
12810# 1st name record
12811# string offset from start of storage area
12812#>>>>>&8		ubeshort	x	\b, string offset %d
12813# string length
12814#>>>>>&6		ubeshort	x	\b, string length %d
12815# minimal name string 7 like in c:\Program Files (x86)\Kodi\addons\webinterface.default\lib\video-js\font\VideoJS.ttf
12816# also found 0 like in SWZCONLN.TTF
12817#>>>>>&6		ubeshort	<8	MIN STRING
12818# maximal name string 806 like in c:\Windows\Fonts\palabi.ttf
12819#>>>>>&6		ubeshort	>805	MAX STRING
12820# platform identifier: 0~Apple Unicode, 1~Macintosh, 3~Microsoft
12821#>>>>>&-2	ubeshort	>3	BAD PLATFORM
12822>>>>>&-2	ubeshort	0	\b, Unicode
12823>>>>>&-2	ubeshort	1	\b, Macintosh
12824>>>>>&-2	ubeshort	3	\b, Microsoft
12825# languageID (0~english Macintosh, 0409h~english Microsoft, ...)
12826>>>>>&2		ubeshort	>0	\b, language 0x%x
12827# name identifiers
12828# often 0~copyright, 1~font, 2~font subfamily, 5~version, 13~license, 19~sample, ...
12829>>>>>&4		ubeshort	>0	\b, type %d string
12830# platform specific encoding:
12831# 0~undefined character set, 1~UGL set with Unicode, 3~Unicode 2.0 BMP only, 4~Unicode 2.0
12832#>>>>>&0		ubeshort	x	\b, %d encoding
12833>>>>>&0		ubeshort	0
12834# handle only name string offset 0 because do not know how to add 2 relative offsets
12835>>>>>>&6		ubeshort	0
12836>>>>>>>&(&-14.S-18)	ubyte		!0
12837# GRR: instead 806 only first MAXstring = 96 characters are displayed as defined in src\file.h
12838# often copyright string that starts like \251 2006 The Monotype Corporation
12839>>>>>>>>&-1		string		x	\b, %-11.96s
12840# test for unicode string
12841>>>>>>>&(&-14.S-18)	ubyte		0
12842>>>>>>>>&0		lestring16	x	\b, %-11.96s
12843# unicode encoding
12844>>>>>&0		ubeshort	>0
12845>>>>>>&6		ubeshort	0
12846>>>>>>>&(&-14.S-17)	lestring16	x	\b, %-11.96s
12847
128480	string		\007\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font
128490	string		\012\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font
12850
12851# TrueType/OpenType font collections (.ttc)
12852# URL: https://en.wikipedia.org/wiki/OpenType
12853# https://www.microsoft.com/typography/otspec/otff.htm
12854# Modified by: Joerg Jenderek
12855# Note:	container for TrueType, OpenType font
128560	string		ttcf
12857# skip ASCII text
12858>4	ubyte		0
12859# sfnt version often 0x00010000 of 1st table is TrueType
12860>>(12.L)	ubelong	!0x4f54544f	TrueType
12861!:mime	font/ttf
12862!:apple	????tfil
12863!:ext	ttc
12864# sfnt version 4F54544Fh~OTTO of 1st table is OpenType font
12865>>(12.L)	ubelong	=0x4f54544f	OpenType
12866!:mime	font/otf
12867!:apple	????OTTO
12868# no example found for otc
12869!:ext	ttc/otc
12870>>4	ubyte		x		font collection data
12871#!:mime	font/collection
12872# TCC version
12873>>4	belong		0x00010000	\b, 1.0
12874>>4	belong		0x00020000	\b, 2.0
12875>>8	ubelong		>0		\b, %d fonts
12876# array offset size = fonts * offsetsize = fonts * 4
12877>>(8.L*4) ubequad	x
12878# 0x44454947 = 'DSIG'
12879>>>&4	belong		0x44534947	\b, digitally signed
12880# offset to 1st font
12881>>12	ubelong		x		\b, at 0x%x
12882# point to 1st font that starts with sfnt version
12883>>(12.L) use		sfnt-font
12884
12885# Opentype font data from Avi Bercovich
128860	string		OTTO		OpenType font data
12887!:mime application/vnd.ms-opentype
12888
12889# From: Alex Myczko <alex@aiei.ch>
128900	string		SplineFontDB:	Spline Font Database
12891!:mime application/vnd.font-fontforge-sfd
12892>14	string		x		version %s
12893
12894# EOT
128950x40	string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
12896>0x22	string		LP		Embedded OpenType (EOT)
12897# workaround until there's lepstring16
12898# >>0x52	lepstring16/h	>\0		\b, %s family
12899>>0x52	short	!0
12900>>>0x54	lestring16	x		\b, %s family
12901!:mime application/vnd.ms-fontobject
12902
12903# Web Open Font Format (.woff)
129040	name		woff
12905>4	belong		0x00010000	\b, TrueType
12906>4	belong		0x4F54544F	\b, CFF
12907>4	belong		0x74727565	\b, TrueType
12908>4	default		x
12909>>4	belong		x		\b, flavor %d
12910>8	belong		x		\b, length %d
12911#>12	beshort		x		\b, numTables %d
12912#>14	beshort		x		\b, reserved %d
12913#>16	belong		x		\b, totalSfntSize %d
12914
12915# https://www.w3.org/TR/WOFF/
129160	string		wOFF	Web Open Font Format
12917>0	use		woff
12918>20	beshort		x	\b, version %d
12919>22	beshort		x	\b.%d
12920# https://www.w3.org/TR/WOFF2/
129210	string		wOF2	Web Open Font Format (Version 2)
12922>0	use		woff
12923#>20	belong		x	\b, totalCompressedSize %d
12924>24	beshort		x	\b, version %d
12925>26	beshort		x	\b.%d
12926
12927#------------------------------------------------------------------------------
12928# $File: fortran,v 1.10 2015/11/05 18:47:16 christos Exp $
12929# FORTRAN source
12930# Check that the first 100 lines start with C or whitespace first.
129310       regex/100l      !\^[^Cc\ \t].*$
12932>0	regex/100l	\^[Cc][\ \t]	FORTRAN program text
12933!:mime	text/x-fortran
12934!:strength - 5
12935
12936#------------------------------------------------------------------------------
12937# $File: frame,v 1.13 2015/08/29 07:10:35 christos Exp $
12938# frame:  file(1) magic for FrameMaker files
12939#
12940# This stuff came on a FrameMaker demo tape, most of which is
12941# copyright, but this file is "published" as witness the following:
12942#
12943# Note that this is the Framemaker Maker Interchange Format, not the
12944# Normal format which would be application/vnd.framemaker.
12945#
129460	string		\<MakerFile	FrameMaker document
12947!:mime	application/x-mif
12948>11	string		5.5		 (5.5
12949>11	string		5.0		 (5.0
12950>11	string		4.0		 (4.0
12951>11	string		3.0		 (3.0
12952>11	string		2.0		 (2.0
12953>11	string		1.0		 (1.0
12954>14	byte		x		  %c)
129550	string		\<MIFFile	FrameMaker MIF (ASCII) file
12956!:mime	application/x-mif
12957>9	string		4.0		 (4.0)
12958>9	string		3.0		 (3.0)
12959>9	string		2.0		 (2.0)
12960>9	string		1.0		 (1.x)
129610	search/1	\<MakerDictionary	FrameMaker Dictionary text
12962!:mime	application/x-mif
12963>17	string		3.0		 (3.0)
12964>17	string		2.0		 (2.0)
12965>17	string		1.0		 (1.x)
129660	string		\<MakerScreenFont	FrameMaker Font file
12967!:mime	application/x-mif
12968>17	string		1.01		 (%s)
129690	string		\<MML		FrameMaker MML file
12970!:mime	application/x-mif
129710	string		\<BookFile	FrameMaker Book file
12972!:mime	application/x-mif
12973>10	string		3.0		 (3.0
12974>10	string		2.0		 (2.0
12975>10	string		1.0		 (1.0
12976>13	byte		x		  %c)
12977# XXX - this book entry should be verified, if you find one, uncomment this
12978#0	string		\<Book\040 	FrameMaker Book (ASCII) file
12979#!:mime	application/x-mif
12980#>6	string		3.0		 (3.0)
12981#>6	string		2.0		 (2.0)
12982#>6	string		1.0		 (1.0)
129830	string		\<Maker\040Intermediate\040Print\040File	FrameMaker IPL file
12984!:mime	application/x-mif
12985
12986#------------------------------------------------------------------------------
12987# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $
12988# freebsd:  file(1) magic for FreeBSD objects
12989#
12990# All new-style FreeBSD magic numbers are in host byte order (i.e.,
12991# little-endian on x86).
12992#
12993# XXX - this comes from the file "freebsd" in a recent FreeBSD version of
12994# "file"; it, and the NetBSD stuff in "netbsd", appear to use different
12995# schemes for distinguishing between executable images, shared libraries,
12996# and object files.
12997#
12998# FreeBSD says:
12999#
13000#    Regardless of whether it's pure, demand-paged, or none of the
13001#    above:
13002#
13003#	if the entry point is < 4096, then it's a shared library if
13004#	the "has run-time loader information" bit is set, and is
13005#	position-independent if the "is position-independent" bit
13006#	is set;
13007#
13008#	if the entry point is >= 4096 (or >4095, same thing), then it's
13009#	an executable, and is dynamically-linked if the "has run-time
13010#	loader information" bit is set.
13011#
13012# On x86, NetBSD says:
13013#
13014#    If it's neither pure nor demand-paged:
13015#
13016#	if it has the "has run-time loader information" bit set, it's
13017#	a dynamically-linked executable;
13018#
13019#	if it doesn't have that bit set, then:
13020#
13021#	    if it has the "is position-independent" bit set, it's
13022#	    position-independent;
13023#
13024#	    if the entry point is non-zero, it's an executable, otherwise
13025#	    it's an object file.
13026#
13027#    If it's pure:
13028#
13029#	if it has the "has run-time loader information" bit set, it's
13030#	a dynamically-linked executable, otherwise it's just an
13031#	executable.
13032#
13033#    If it's demand-paged:
13034#
13035#	if it has the "has run-time loader information" bit set,
13036#	then:
13037#
13038#	    if the entry point is < 4096, it's a shared library;
13039#
13040#	    if the entry point is = 4096 or > 4096 (i.e., >= 4096),
13041#	    it's a dynamically-linked executable);
13042#
13043#	if it doesn't have the "has run-time loader information" bit
13044#	set, then it's just an executable.
13045#
13046# (On non-x86, NetBSD does much the same thing, except that it uses
13047# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
13048# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
13049# had 8K pages; dunno about MIPS.)
13050#
13051# I suspect the two will differ only in perverse and uninteresting cases
13052# ("shared" libraries that aren't demand-paged and whose pages probably
13053# won't actually be shared, executables with entry points <4096).
13054#
13055# I leave it to those more familiar with FreeBSD and NetBSD to figure out
13056# what the right answer is (although using ">4095", FreeBSD-style, is
13057# probably better than separately checking for "=4096" and ">4096",
13058# NetBSD-style).  (The old "netbsd" file analyzed FreeBSD demand paged
13059# executables using the NetBSD technique.)
13060#
130610	lelong&0377777777	041400407	FreeBSD/i386
13062>20	lelong			<4096
13063>>3	byte&0xC0		&0x80		shared library
13064>>3	byte&0xC0		0x40		PIC object
13065>>3	byte&0xC0		0x00		object
13066>20	lelong			>4095
13067>>3	byte&0x80		0x80		dynamically linked executable
13068>>3	byte&0x80		0x00		executable
13069>16	lelong			>0		not stripped
13070
130710	lelong&0377777777	041400410	FreeBSD/i386 pure
13072>20	lelong			<4096
13073>>3	byte&0xC0		&0x80		shared library
13074>>3	byte&0xC0		0x40		PIC object
13075>>3	byte&0xC0		0x00		object
13076>20	lelong			>4095
13077>>3	byte&0x80		0x80		dynamically linked executable
13078>>3	byte&0x80		0x00		executable
13079>16	lelong			>0		not stripped
13080
130810	lelong&0377777777	041400413	FreeBSD/i386 demand paged
13082>20	lelong			<4096
13083>>3	byte&0xC0		&0x80		shared library
13084>>3	byte&0xC0		0x40		PIC object
13085>>3	byte&0xC0		0x00		object
13086>20	lelong			>4095
13087>>3	byte&0x80		0x80		dynamically linked executable
13088>>3	byte&0x80		0x00		executable
13089>16	lelong			>0		not stripped
13090
130910	lelong&0377777777	041400314	FreeBSD/i386 compact demand paged
13092>20	lelong			<4096
13093>>3	byte&0xC0		&0x80		shared library
13094>>3	byte&0xC0		0x40		PIC object
13095>>3	byte&0xC0		0x00		object
13096>20	lelong			>4095
13097>>3	byte&0x80		0x80		dynamically linked executable
13098>>3	byte&0x80		0x00		executable
13099>16	lelong			>0		not stripped
13100
13101# XXX gross hack to identify core files
13102# cores start with a struct tss; we take advantage of the following:
13103# byte 7:     highest byte of the kernel stack pointer, always 0xfe
13104#      8/9:   kernel (ring 0) ss value, always 0x0010
13105#      10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
13106#      28:    low order byte of the current PTD entry, always 0 since the
13107#             PTD is page-aligned
13108#
131097	string	\357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	FreeBSD/i386 a.out core file
13110>1039	string	>\0	from '%s'
13111
13112# /var/run/ld.so.hints
13113# What are you laughing about?
131140	lelong			011421044151	ld.so hints file (Little Endian
13115>4	lelong			>0		\b, version %d)
13116>4	belong			<1		\b)
131170	belong			011421044151	ld.so hints file (Big Endian
13118>4	belong			>0		\b, version %d)
13119>4	belong			<1		\b)
13120
13121#
13122# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
13123#
131240	string	SCRSHOT_	scrshot(1) screenshot,
13125>8	byte	x		version %d,
13126>9	byte	2		%d bytes in header,
13127>>10	byte	x		%d chars wide by
13128>>11	byte	x		%d chars high
13129
13130#------------------------------------------------------------------------------
13131# $File: fsav,v 1.19 2019/04/19 00:42:27 christos Exp $
13132# fsav:  file(1) magic for datafellows fsav virus definition files
13133# Anthon van der Neut (anthon@mnt.org)
13134
13135# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def}
131360	beshort		0x1575		fsav macro virus signatures
13137>8	leshort		>0		(%d-
13138>11	byte		>0		\b%02d-
13139>10	byte		>0		\b%02d)
13140# ftp://ftp.f-prot.com/pub/sign.zip
13141#10	ubyte		<12
13142#>9	ubyte		<32
13143#>>8	ubyte		0x0a
13144#>>>12	ubyte		0x07
13145#>>>>11	uleshort	>0		fsav DOS/Windows virus signatures (%d-
13146#>>>>10	byte		0		\b01-
13147#>>>>10	byte		1		\b02-
13148#>>>>10	byte		2		\b03-
13149#>>>>10	byte		3		\b04-
13150#>>>>10	byte		4		\b05-
13151#>>>>10	byte		5		\b06-
13152#>>>>10	byte		6		\b07-
13153#>>>>10	byte		7		\b08-
13154#>>>>10	byte		8		\b09-
13155#>>>>10	byte		9		\b10-
13156#>>>>10	byte		10		\b11-
13157#>>>>10	byte		11		\b12-
13158#>>>>9	ubyte		>0		\b%02d)
13159# ftp://ftp.f-prot.com/pub/sign2.zip
13160#0	ubyte		0x62
13161#>1	ubyte		0xF5
13162#>>2	ubyte		0x1
13163#>>>3	ubyte		0x1
13164#>>>>4	ubyte		0x0e
13165#>>>>>13		ubyte	>0		fsav virus signatures
13166#>>>>>>11	ubyte	x		size 0x%02x
13167#>>>>>>12	ubyte	x		\b%02x
13168#>>>>>>13	ubyte	x		\b%02x bytes
13169
13170# Joerg Jenderek: joerg dot jenderek at web dot de
13171# clamav-0.100.2\docs\html\node60.html
13172# https://github.com/vrtadmin/clamav-faq/raw/master/manual/clamdoc.pdf
13173# ClamAV virus database files start with a 512 bytes colon separated header
13174# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
13175# + gzipped (optional) tarball files
13176# output can often be verified by `sigtool --info=FILE`
131770	string		ClamAV-VDB:	Clam AntiVirus
13178# padding spaces implies database
13179>511	ubyte		=0x20		database
13180!:mime	application/x-clamav-database
13181# empty build time
13182>>10	string		=::		(unsigned)
13183# sigtool(1) man page
13184!:ext	cud
13185# display some text to avoid error like:
13186# Magdir/fsav, 78: Warning: Current entry does not yet have a description for adding a EXTENSION type
13187# file: could not find any valid magic files! (No error)
13188>>10	default		x		(with buildtime)
13189#>>10	default		x
13190# clamtmp is used for temporily database like update process
13191# for pure tar database only cld extension found
13192!:ext	cld/cvd/clamtmp/cud
13193>511	default		x		file
13194!:mime	application/x-clamav
13195!:ext	info
13196>11	string		>\0
13197# buildDate empty or like "22 Mar 2017 12-57 -0400"; verified by `sigtool -i FILE`
13198>>11	regex		\^[^:]{0,23}	\b, %s
13199# version like 25170
13200>>>&1	regex		\^[^:]{1,6}	\b, version %s
13201# signaturesNumbers like 4566249
13202>>>>&1	regex		\^[^:]{1,10}	\b, %s signatures
13203# functionalityLevelRequired like 60
13204>>>>>&1	regex		\^[^:]{1,4}	\b, level %s
13205# X for nothing or MD5
13206#>>>>>>&1	regex	\^[^:]{1,32}	\b, MD5 "%s"
13207>>>>>>&1	regex	\^[^:]{1,32}
13208# X for nothing or digital signature starting like AIzk/LYbX
13209#>>>>>>>&1	regex	\^[^:]{1,255}	\b, signature "%s"
13210>>>>>>>&1	regex	\^[^:]{1,255}
13211# builder like neo
13212>>>>>>>>&1	regex	\^[^:]{1,32}	\b, builder %s
13213# buildTime like 1506611558
13214#>>>>>>>>>&1	regex	\^[^:]{1,10}	\b, %s
13215>>>>>>>>>&1	regex	\^[^:]{1,10}
13216# padding with spaces
13217#>>>>>>>>>>&1	ubequad	x		\b, padding 0x%16.16llx
13218>510	ubyte		=0x20
13219# inspect real database content
13220#>>512	ubeshort	x		\b, database MAGIC 0x%x
13221# ./archive handle pure tar archives
13222>>1012	quad		=0		\b, with
13223>>>512	use		tar-file
13224# not pure tar
13225>>1012	quad		!0
13226# one space at the end of text and then handles gziped archives by ./compress
13227>>>512	string		\037\213	\b, with
13228>>>>512	indirect	x
13229
13230# Type: Grisoft AVG AntiVirus
13231# From: David Newgas <david@newgas.net>
132320	string	AVG7_ANTIVIRUS_VAULT_FILE	AVG 7 Antivirus vault file data
13233
132340	string	X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR
13235>33	string	-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*	EICAR virus test files
13236
13237# From: Joerg Jenderek
13238# URL: https://www.avira.com/
13239# Note: found in directory %ProgramData%\Avira\Antivirus\INFECTED (Windows)
13240# tested with version 15.0.43.23 at November 2019
132410	string		AntiVir\ Qua	Avira AntiVir quarantined
13242!:mime	application/x-avira-qua
13243#!:mime	application/octet-stream
13244!:ext	qua
13245>156	string		SUSPICIOUS_FILE
13246# file path of suspicious file
13247>>220	lestring16	x		%s
13248>156	string		!SUSPICIOUS_FILE
13249# file path of virus file
13250>>228	lestring16	x		%s
13251# quarantined date
13252>60	ldate		x		at %s
13253# virus/danger name
13254>156	string		!SUSPICIOUS_FILE
13255>>156	string		x		\b, category "%s"
13256
13257
13258#------------------------------------------------------------------------------
13259# $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $
13260# fusecompress:   file(1) magic for fusecompress
132610	string	\037\135\211	FuseCompress(ed) data
13262>3	byte	0x00	(none format)
13263>3	byte	0x01	(bz2 format)
13264>3	byte	0x02	(gz format)
13265>3	byte	0x03	(lzo format)
13266>3	byte	0x04	(xor format)
13267>3	byte	>0x04	(unknown format)
13268>4	long	x	uncompressed size: %d
13269
13270#------------------------------------------------------------------------------
13271# $File: games,v 1.17 2019/04/19 00:42:27 christos Exp $
13272# games:  file(1) for games
13273
13274# Fabio Bonelli <fabiobonelli@libero.it>
13275# Quake II - III data files
132760       string  IDP2        	Quake II 3D Model file,
13277>20     long    x               %u skin(s),
13278>8      long    x               (%u x
13279>12     long    x 		%u),
13280>40     long    x               %u frame(s),
13281>16     long    x               Frame size %u bytes,
13282>24     long  	x               %u vertices/frame,
13283>28     long    x            	%u texture coordinates,
13284>32     long    x               %u triangles/frame
13285
132860       string  IBSP            Quake
13287>4      long    0x26            II Map file (BSP)
13288>4      long    0x2E      	III Map file (BSP)
13289
132900       string  IDS2            Quake II SP2 sprite file
13291
13292#---------------------------------------------------------------------------
13293# Doom and Quake
13294# submitted by Nicolas Patrois
13295
132960       string  \xcb\x1dBoom\xe6\xff\x03\x01    Boom or linuxdoom demo
13297# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01
13298
1329924      string  LxD\ 203        Linuxdoom save
13300>0      string  x       , name=%s
13301>44     string  x       , world=%s
13302
13303# Quake
13304
13305# Update: Joerg Jenderek
13306# URL: http://fileformats.archiveteam.org/wiki/PAK
13307# reference: https://quakewiki.org/wiki/.pak
13308# GRR: line below is too general as it matches also Acorn PackDir compressed Archive
13309# and Git pack ./revision
133100       string  PACK
13311# real Quake examples like pak0.pak have only some hundreds like 150 files
13312# So test for few files
13313>8	ulelong <0x01000000
13314# in file version 5.32 test for null terminator is only true for
13315# offset ~< FILE_BYTES_MAX = 1 MB defined in ../../src/file.h
13316# look for null terminator of 1st entry name
13317>>(4.l+55)	ubyte	0	Quake I or II world or extension
13318!:mime	application/x-dzip
13319!:ext	pak
13320#>>>8	ulelong	x	\b, table size %u
13321# dividing this by entry size (64) gives number of files
13322>>>8	ulelong/64 x	\b, %u files
13323# offset to the beginning of the file table
13324>>>4	ulelong	x	\b, offset 0x%x
13325# 1st file entry
13326>>>(4.l)	use	pak-entry
13327# 2nd file entry
13328#>>>4	ulelong+64	x	\b, offset 0x%x
13329#>>>(4.l+64)	use	pak-entry
13330#
13331#	display file table entry of Quake PAK archive
133320	name		pak-entry
13333# normally entry start after header which implies offset 12 or higher
13334>56	ulelong	>11
13335# the offset from the beginning of pak to beginning of this entry file contents
13336>>56	ulelong	x	at 0x%x
13337# the size of file for this entry
13338>>60	ulelong	x	%u bytes
13339# 56 byte null-terminated entry name string includes path like maps/e1m1.bsp
13340>>0	string	x	'%-.56s'
13341# inspect entry content by jumping to entry offset
13342>>(56)	indirect x	\b:
13343
13344#0       string  -1\x0a  Quake I demo
13345#>30     string  x        version %.4s
13346#>61     string  x        level %s
13347
13348#0       string  5\x0a   Quake I save
13349
13350# The levels
13351
13352# Quake 1
13353
133540	string	5\x0aIntroduction             Quake I save: start Introduction
133550	string	5\x0athe_Slipgate_Complex     Quake I save: e1m1 The slipgate complex
133560	string	5\x0aCastle_of_the_Damned     Quake I save: e1m2 Castle of the damned
133570	string	5\x0athe_Necropolis           Quake I save: e1m3 The necropolis
133580	string	5\x0athe_Grisly_Grotto        Quake I save: e1m4 The grisly grotto
133590	string	5\x0aZiggurat_Vertigo         Quake I save: e1m8 Ziggurat vertigo (secret)
133600	string	5\x0aGloom_Keep               Quake I save: e1m5 Gloom keep
133610	string	5\x0aThe_Door_To_Chthon       Quake I save: e1m6 The door to Chthon
133620	string	5\x0aThe_House_of_Chthon      Quake I save: e1m7 The house of Chthon
133630	string	5\x0athe_Installation         Quake I save: e2m1 The installation
133640	string	5\x0athe_Ogre_Citadel         Quake I save: e2m2 The ogre citadel
133650	string	5\x0athe_Crypt_of_Decay       Quake I save: e2m3 The crypt of decay (dopefish lives!)
133660	string	5\x0aUnderearth               Quake I save: e2m7 Underearth (secret)
133670	string	5\x0athe_Ebon_Fortress        Quake I save: e2m4 The ebon fortress
133680	string	5\x0athe_Wizard's_Manse       Quake I save: e2m5 The wizard's manse
133690	string	5\x0athe_Dismal_Oubliette     Quake I save: e2m6 The dismal oubliette
133700	string	5\x0aTermination_Central      Quake I save: e3m1 Termination central
133710	string	5\x0aVaults_of_Zin            Quake I save: e3m2 Vaults of Zin
133720	string	5\x0athe_Tomb_of_Terror       Quake I save: e3m3 The tomb of terror
133730	string	5\x0aSatan's_Dark_Delight     Quake I save: e3m4 Satan's dark delight
133740	string	5\x0athe_Haunted_Halls        Quake I save: e3m7 The haunted halls (secret)
133750	string	5\x0aWind_Tunnels             Quake I save: e3m5 Wind tunnels
133760	string	5\x0aChambers_of_Torment      Quake I save: e3m6 Chambers of torment
133770	string	5\x0athe_Sewage_System        Quake I save: e4m1 The sewage system
133780	string	5\x0aThe_Tower_of_Despair     Quake I save: e4m2 The tower of despair
133790	string	5\x0aThe_Elder_God_Shrine     Quake I save: e4m3 The elder god shrine
133800	string	5\x0athe_Palace_of_Hate       Quake I save: e4m4 The palace of hate
133810	string	5\x0aHell's_Atrium            Quake I save: e4m5 Hell's atrium
133820	string	5\x0athe_Nameless_City        Quake I save: e4m8 The nameless city (secret)
133830	string	5\x0aThe_Pain_Maze            Quake I save: e4m6 The pain maze
133840	string	5\x0aAzure_Agony              Quake I save: e4m7 Azure agony
133850	string	5\x0aShub-Niggurath's_Pit     Quake I save: end Shub-Niggurath's pit
13386
13387# Quake DeathMatch levels
13388
133890	string	5\x0aPlace_of_Two_Deaths	 Quake I save: dm1 Place of two deaths
133900	string	5\x0aClaustrophobopolis		 Quake I save: dm2 Claustrophobopolis
133910	string	5\x0aThe_Abandoned_Base		 Quake I save: dm3 The abandoned base
133920	string	5\x0aThe_Bad_Place		 Quake I save: dm4 The bad place
133930	string	5\x0aThe_Cistern		 Quake I save: dm5 The cistern
133940	string	5\x0aThe_Dark_Zone		 Quake I save: dm6 The dark zone
13395
13396# Scourge of Armagon
13397
133980	string	5\x0aCommand_HQ               Quake I save: start Command HQ
133990	string	5\x0aThe_Pumping_Station      Quake I save: hip1m1 The pumping station
134000	string	5\x0aStorage_Facility         Quake I save: hip1m2 Storage facility
134010	string	5\x0aMilitary_Complex         Quake I save: hip1m5 Military complex (secret)
134020	string	5\x0athe_Lost_Mine            Quake I save: hip1m3 The lost mine
134030	string	5\x0aResearch_Facility        Quake I save: hip1m4 Research facility
134040	string	5\x0aAncient_Realms           Quake I save: hip2m1 Ancient realms
134050	string	5\x0aThe_Gremlin's_Domain     Quake I save: hip2m6 The gremlin's domain (secret)
134060	string	5\x0aThe_Black_Cathedral      Quake I save: hip2m2 The black cathedral
134070	string	5\x0aThe_Catacombs            Quake I save: hip2m3 The catacombs
134080	string	5\x0athe_Crypt__              Quake I save: hip2m4 The crypt
134090	string	5\x0aMortum's_Keep            Quake I save: hip2m5 Mortum's keep
134100	string	5\x0aTur_Torment              Quake I save: hip3m1 Tur torment
134110	string	5\x0aPandemonium              Quake I save: hip3m2 Pandemonium
134120	string	5\x0aLimbo                    Quake I save: hip3m3 Limbo
134130	string	5\x0athe_Edge_of_Oblivion     Quake I save: hipdm1 The edge of oblivion (secret)
134140	string	5\x0aThe_Gauntlet             Quake I save: hip3m4 The gauntlet
134150	string	5\x0aArmagon's_Lair           Quake I save: hipend Armagon's lair
13416
13417# Malice
13418
134190	string	5\x0aThe_Academy      Quake I save: start The academy
134200	string	5\x0aThe_Lab          Quake I save: d1 The lab
134210	string	5\x0aArea_33          Quake I save: d1b Area 33
134220	string	5\x0aSECRET_MISSIONS  Quake I save: d3b Secret missions
134230	string	5\x0aThe_Hospital     Quake I save: d10 The hospital (secret)
134240	string	5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)
134250	string	5\x0aBACK_2_MALICE    Quake I save: d4b Back to Malice
134260	string	5\x0aArea44           Quake I save: d1c Area 44
134270	string	5\x0aTakahiro_Towers  Quake I save: d2 Takahiro towers
134280	string	5\x0aA_Rat's_Life     Quake I save: d3 A rat's life
134290	string	5\x0aInto_The_Flood   Quake I save: d4 Into the flood
134300	string	5\x0aThe_Flood        Quake I save: d5 The flood
134310	string	5\x0aNuclear_Plant    Quake I save: d6 Nuclear plant
134320	string	5\x0aThe_Incinerator_Plant    Quake I save: d7 The incinerator plant
134330	string	5\x0aThe_Foundry              Quake I save: d7b The foundry
134340	string	5\x0aThe_Underwater_Base      Quake I save: d8 The underwater base
134350	string	5\x0aTakahiro_Base            Quake I save: d9 Takahiro base
134360	string	5\x0aTakahiro_Laboratories    Quake I save: d12 Takahiro laboratories
134370	string	5\x0aStayin'_Alive    Quake I save: d13 Stayin' alive
134380	string	5\x0aB.O.S.S._HQ      Quake I save: d14 B.O.S.S. HQ
134390	string	5\x0aSHOWDOWN!        Quake I save: d15 Showdown!
13440
13441# Malice DeathMatch levels
13442
134430	string	5\x0aThe_Seventh_Precinct	 Quake I save: ddm1 The seventh precinct
134440	string	5\x0aSub_Station		 Quake I save: ddm2 Sub station
134450	string	5\x0aCrazy_Eights!		 Quake I save: ddm3 Crazy eights!
134460	string	5\x0aEast_Side_Invertationa	 Quake I save: ddm4 East side invertationa
134470	string	5\x0aSlaughterhouse		 Quake I save: ddm5 Slaughterhouse
134480	string	5\x0aDOMINO			 Quake I save: ddm6 Domino
134490	string	5\x0aSANDRA'S_LADDER		 Quake I save: ddm7 Sandra's ladder
13450
13451
134520	string	MComprHD	MAME CHD compressed hard disk image,
13453>12	belong	x		version %u
13454
13455# doom - submitted by Jon Dowland
13456
134570	string	=IWAD		doom main IWAD data
13458>4	lelong	x		containing %d lumps
134590	string	=PWAD		doom patch PWAD data
13460>4	lelong	x		containing %d lumps
13461
13462# Build engine group files (Duke Nukem, Shadow Warrior, ...)
13463# Extension: .grp
13464# Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org>
134650	string	KenSilverman	Build engine group file
13466>12	lelong	x		containing %d files
13467
13468# Summary: Warcraft 3 save
13469# Extension: .w3g
13470# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
134710	string		Warcraft\ III\ recorded\ game	%s
13472
13473
13474# Summary: Warcraft 3 map
13475# Extension: .w3m
13476# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
134770	string		HM3W		Warcraft III map file
13478
13479
13480# Summary: SGF Smart Game Format
13481# Extension: .sgf
13482# Reference: https://www.red-bean.com/sgf/
13483# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
13484# Modified by (1): Abel Cheung (regex, more game format)
13485# FIXME: Some games don't have GM (game type)
134860	regex		\\(;.*GM\\[[0-9]{1,2}\\]	Smart Game Format
13487>2	search/0x200/b	GM[
13488>>&0	string		1]	(Go)
13489>>&0	string		2]	(Othello)
13490>>&0	string		3]	(chess)
13491>>&0	string		4]	(Gomoku+Renju)
13492>>&0	string		5]	(Nine Men's Morris)
13493>>&0	string		6]	(Backgammon)
13494>>&0	string		7]	(Chinese chess)
13495>>&0	string		8]	(Shogi)
13496>>&0	string		9]	(Lines of Action)
13497>>&0	string		10]	(Ataxx)
13498>>&0	string		11]	(Hex)
13499>>&0	string		12]	(Jungle)
13500>>&0	string		13]	(Neutron)
13501>>&0	string		14]	(Philosopher's Football)
13502>>&0	string		15]	(Quadrature)
13503>>&0	string		16]	(Trax)
13504>>&0	string		17]	(Tantrix)
13505>>&0	string		18]	(Amazons)
13506>>&0	string		19]	(Octi)
13507>>&0	string		20]	(Gess)
13508>>&0	string		21]	(Twixt)
13509>>&0	string		22]	(Zertz)
13510>>&0	string		23]	(Plateau)
13511>>&0	string		24]	(Yinsh)
13512>>&0	string		25]	(Punct)
13513>>&0	string		26]	(Gobblet)
13514>>&0	string		27]	(hive)
13515>>&0	string		28]	(Exxit)
13516>>&0	string		29]	(Hnefatal)
13517>>&0	string		30]	(Kuba)
13518>>&0	string		31]	(Tripples)
13519>>&0	string		32]	(Chase)
13520>>&0	string		33]	(Tumbling Down)
13521>>&0	string		34]	(Sahara)
13522>>&0	string		35]	(Byte)
13523>>&0	string		36]	(Focus)
13524>>&0	string		37]	(Dvonn)
13525>>&0	string		38]	(Tamsk)
13526>>&0	string		39]	(Gipf)
13527>>&0	string		40]	(Kropki)
13528
13529##############################################
13530# NetImmerse/Gamebryo game engine entries
13531
13532# Summary: Gamebryo game engine file
13533# Extension: .nif, .kf
13534# Created by: Abel Cheung <abelcheung@gmail.com>
135350		string		Gamebryo\ File\ Format,\ Version\ 	Gamebryo game engine file
13536>&0		regex		[0-9a-z.]+				\b, version %s
13537
13538# Summary: Gamebryo game engine file
13539# Extension: .kfm
13540# Created by: Abel Cheung <abelcheung@gmail.com>
135410		string		;Gamebryo\ KFM\ File\ Version\ 		Gamebryo game engine animation File
13542>&0		regex		[0-9a-z.]+				\b, version %s
13543
13544# Summary: NetImmerse game engine file
13545# Extension .nif
13546# Created by: Abel Cheung <abelcheung@gmail.com>
135470		string		NetImmerse\ File\ Format,\ Versio
13548>&0		string		n\ 					NetImmerse game engine file
13549>>&0		regex		[0-9a-z.]+				\b, version %s
13550
13551# Type:	SGF Smart Game Format
13552# URL:	https://www.red-bean.com/sgf/
13553# From:	Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
135542	regex/c	\\(;.*GM\\[[0-9]{1,2}\\]	Smart Game Format
13555>2	regex/c	GM\\[1\\]			- Go Game
13556>2	regex/c	GM\\[6\\]			- BackGammon Game
13557>2	regex/c	GM\\[11\\]			- Hex Game
13558>2	regex/c	GM\\[18\\]			- Amazons Game
13559>2	regex/c	GM\\[19\\]			- Octi Game
13560>2	regex/c	GM\\[20\\]			- Gess Game
13561>2	regex/c	GM\\[21\\]			- twix Game
13562
13563# Epic Games/Unreal Engine Package
13564#
135650	lelong		0x9E2A83C1	Unreal Engine Package,
13566>4	leshort		x		version: %i
13567>12	lelong		!0		\b, names: %i
13568>28	lelong		!0		\b, imports: %i
13569>20	lelong		!0		\b, exports: %i
13570
13571#------------------------------------------------------------------------------
13572# $File: gcc,v 1.5 2016/07/01 23:31:13 christos Exp $
13573# gcc:  file(1) magic for GCC special files
13574#
135750	string		gpch		GCC precompiled header
13576
13577# The version field is annoying.  It's 3 characters, not zero-terminated.
13578>5	byte		x			(version %c
13579>6	byte		x			\b%c
13580>7	byte		x			\b%c)
13581
13582# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'
13583>4	byte		67			for C
13584>4	byte		111			for Objective-C
13585>4	byte		43			for C++
13586>4	byte		79			for Objective-C++
13587
13588#------------------------------------------------------------------------------
13589# $File: gconv
13590# gconv: file(1) magic for iconv/gconv module configuration cache
13591#
13592# Magic number defined in glibc/iconv/iconvconfig.h as GCONVCACHE_MAGIC
13593#
13594# From: Marek Cermak <macermak@redhat.com>
13595#
135960		lelong		0x20010324 	gconv module configuration cache data
13597
13598#------------------------------------------------------------------------------
13599# $File: geo,v 1.7 2019/04/19 00:42:27 christos Exp $
13600# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu>
13601
13602######################################################################
13603#
13604# Acoustic Doppler Current Profilers (ADCP)
13605#
13606######################################################################
13607
136080	beshort	0x7f7f	RDI Acoustic Doppler Current Profiler (ADCP)
13609
13610######################################################################
13611#
13612# Metadata
13613#
13614######################################################################
13615
136160	string	Identification_Information	FGDC ASCII metadata
13617
13618######################################################################
13619#
13620# Seimsic / Subbottom
13621#
13622######################################################################
13623
13624# Knudsen subbottom chirp profiler - Binary File Format: B9
13625# KEB D409-03167 V1.75 Huffman
136260	string	KEB\ 	Knudsen seismic KEL binary (KEB) -
13627>4	regex	[-A-Z0-9]*	Software: %s
13628>>&1	regex	V[0-9]*\.[0-9]*	version %s
13629
13630######################################################################
13631#
13632# LIDAR - Laser altimetry or bathy
13633#
13634######################################################################
13635
13636
13637# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data
136380	string	HCA	LADS Caris Ascii Format (CAF) bathymetric lidar
13639>4	regex [0-9]*\.[0-9]*	version %s
13640
136410	string	HCB	LADS Caris Binary Format (CBF) bathymetric lidar waveform data
13642>3      byte    x	version %d .
13643>4	byte	x	%d
13644
13645
13646######################################################################
13647#
13648# MULTIBEAM SONARS https://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/
13649#
13650######################################################################
13651
13652# GeoAcoustics - GeoSwath Plus
136534	beshort	0x2002	GeoSwath RDF
136540	string	Start:-	GeoSwatch auf text file
13655
13656# Seabeam 2100
13657# mbsystem code mb41
136580	string SB2100	SeaBeam 2100 multibeam sonar
136590	string SB2100DR	SeaBeam 2100 DR multibeam sonar
136600	string SB2100PR SeaBeam 2100 PR multibeam sonar
13661
13662# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor
13663# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR.
136640    string $HSF    XSE multibeam
13665
13666# mb121 https://www.saic.com/maritime/gsf/
136678	string	GSF-v	SAIC generic sensor format (GSF) sonar data,
13668>&0	regex [0-9]*\.[0-9]*	version %s
13669
13670# MGD77 - https://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm
13671# mb161
136729	string MGD77	MGD77 Header, Marine Geophysical Data Exchange Format
13673
13674# MBSystem processing caches the mbinfo output
136751	string	Swath\ Data\ File:	mbsystem info cache
13676
13677# Caris John Hughes Clark format
136780	string	HDCS	Caris multibeam sonar related data
136791	string	Start/Stop\ parameter\ header:	Caris ASCII project summary
13680
13681######################################################################
13682#
13683# Visualization and 3D modeling
13684#
13685######################################################################
13686
13687# IVS - IVS3d.com Tagged Data Represetation
136880	string	%%\ TDR\ 2.0	IVS Fledermaus TDR file
13689
13690# http://www.ecma-international.org/publications/standards/Ecma-363.htm
13691# 3D in PDFs
136920	string	U3D	ECMA-363, Universal 3D
13693
13694######################################################################
13695#
13696# Support files
13697#
13698######################################################################
13699
13700# https://midas.psi.ch/elog/
137010	string	$@MID@$	elog journal entry
13702
13703# Geospatial Designs https://www.geospatialdesigns.com/surfer6_format.htm
137040	string		DSBB	Surfer 6 binary grid file
13705>4	leshort		x	\b, %d
13706>6	leshort		x	\bx%d
13707>8	ledouble	x	\b, minx=%g
13708>16	ledouble	x	\b, maxx=%g
13709>24	ledouble	x	\b, miny=%g
13710>32	ledouble	x	\b, maxy=%g
13711>40	ledouble	x	\b, minz=%g
13712>48	ledouble	x	\b, maxz=%g
13713
13714# magic for LAS format files
13715# alex myczko <alex@aiei.ch>
13716# https://www.asprs.org/wp-content/uploads/2010/12/LAS_1_3_r11.pdf
137170	string		LASF	LIDAR point data records
13718>24	byte		>0	\b, version %u
13719>25	byte		>0	\b.%u
13720>26	string		>\0	\b, SYSID %s
13721>58	string		>\0	\b, Generating Software %s
13722
13723# magic for PCD format files
13724# alex myczko <alex@aiei.ch>
13725# http://pointclouds.org/documentation/tutorials/pcd_file_format.php
137260	string		#\ .PCD	Point Cloud Data
13727
13728#------------------------------------------------------------------------------
13729# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $
13730# GEOS files (Vidar Madsen, vidar@gimp.org)
13731# semi-commonly used in embedded and handheld systems.
137320	belong	0xc745c153	GEOS
13733>40	byte	1	executable
13734>40	byte	2	VMFile
13735>40	byte	3	binary
13736>40	byte	4	directory label
13737>40	byte	<1	unknown
13738>40	byte	>4	unknown
13739>4	string	>\0	\b, name "%s"
13740#>44	short	x	\b, version %d
13741#>46	short	x	\b.%d
13742#>48	short	x	\b, rev %d
13743#>50	short	x	\b.%d
13744#>52	short	x	\b, proto %d
13745#>54	short	x	\br%d
13746#>168	string	>\0	\b, copyright "%s"
13747
13748#------------------------------------------------------------------------------
13749# $File: gimp,v 1.9 2014/04/30 21:41:02 christos Exp $
13750# GIMP Gradient: file(1) magic for the GIMP's gradient data files (.ggr)
13751# by Federico Mena <federico@nuclecu.unam.mx>
13752
137530       string/t        GIMP\ Gradient  GIMP gradient data
13754
13755# GIMP palette (.gpl)
13756# From: Markus Heidelberg <markus.heidelberg@web.de>
137570       string/t        GIMP\ Palette   GIMP palette data
13758
13759#------------------------------------------------------------------------------
13760# XCF:  file(1) magic for the XCF image format used in the GIMP (.xcf) developed
13761#       by Spencer Kimball and Peter Mattis
13762#       ('Bucky' LaDieu, nega@vt.edu)
13763
137640	string		gimp\ xcf	GIMP XCF image data,
13765!:mime	image/x-xcf
13766>9	string		file		version 0,
13767>9	string		v		version
13768>>10	string		>\0		%s,
13769>14	belong		x		%u x
13770>18	belong		x		%u,
13771>22     belong          0               RGB Color
13772>22     belong          1               Greyscale
13773>22     belong          2               Indexed Color
13774>22	belong		>2		Unknown Image Type.
13775
13776#------------------------------------------------------------------------------
13777# XCF:  file(1) magic for the patterns used in the GIMP (.pat), developed
13778#       by Spencer Kimball and Peter Mattis
13779#       ('Bucky' LaDieu, nega@vt.edu)
13780
1378120      string          GPAT            GIMP pattern data,
13782>24     string          x               %s
13783
13784#------------------------------------------------------------------------------
13785# XCF:  file(1) magic for the brushes used in the GIMP (.gbr), developed
13786#       by Spencer Kimball and Peter Mattis
13787#       ('Bucky' LaDieu, nega@vt.edu)
13788
1378920      string          GIMP            GIMP brush data
13790
13791# GIMP Curves File
13792# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
137930	string	#\040GIMP\040Curves\040File	GIMP curve file
13794
13795#------------------------------------------------------------------------------
13796# $File: glibc,v 1.1 2018/10/11 15:35:43 christos Exp $
13797# glibc locale files
13798#
13799# https://sourceware.org/git/?p=glibc.git;f=locale/localeinfo.h;h=68822a63#l32
13800
138010	belong	0x20070920	glibc locale file LC_CTYPE
138020	belong	0x14110320	glibc locale file LC_NUMERIC
138030	belong	0x17110320	glibc locale file LC_TIME
138040	belong	0x17100520	glibc locale file LC_COLLATE
138050	belong	0x11110320	glibc locale file LC_MONETARY
138060	belong	0x10110320	glibc locale file LC_MESSAGES
138070	belong	0x13110320	glibc locale file LC_ALL
138080	belong	0x12110320	glibc locale file LC_PAPER
138090	belong	0x1d110320	glibc locale file LC_NAME
138100	belong	0x1c110320	glibc locale file LC_ADDRESS
138110	belong	0x1f110320	glibc locale file LC_TELEPHONE
138120	belong	0x1e110320	glibc locale file LC_MEASUREMENT
138130	belong	0x19110320	glibc locale file LC_IDENTIFICATION
13814
13815
13816#------------------------------------------------------------------------------
13817# $File: gnome,v 1.6 2019/04/19 00:42:27 christos Exp $
13818# GNOME related files
13819
13820# Contributed by Josh Triplett
13821# FIXME: Could be simplified if pstring supported two-byte counts
138220         string   GnomeKeyring\n\r\0\n GNOME keyring
13823>&0       ubyte    0                    \b, major version 0
13824>>&0      ubyte    0                    \b, minor version 0
13825>>>&0     ubyte    0                    \b, crypto type 0 (AES)
13826>>>&0     ubyte    >0                   \b, crypto type %u (unknown)
13827>>>&1     ubyte    0                    \b, hash type 0 (MD5)
13828>>>&1     ubyte    >0                   \b, hash type %u (unknown)
13829>>>&2     ubelong  0xFFFFFFFF           \b, name NULL
13830>>>&2     ubelong  !0xFFFFFFFF
13831>>>>&-4   ubelong  >255                 \b, name too long for file's pstring type
13832>>>>&-4   ubelong  <256
13833>>>>>&-1  pstring  x                    \b, name "%s"
13834>>>>>>&0  ubeqdate x                    \b, last modified %s
13835>>>>>>&8  ubeqdate x                    \b, created %s
13836>>>>>>&16 ubelong  &1
13837>>>>>>>&0 ubelong  x                    \b, locked if idle for %u seconds
13838>>>>>>&16 ubelong  ^1                   \b, not locked if idle
13839>>>>>>&24 ubelong  x                    \b, hash iterations %u
13840>>>>>>&28 ubequad  x                    \b, salt %llu
13841>>>>>>&52 ubelong  x                    \b, %u item(s)
13842
13843# From: Alex Beregszaszi <alex@fsn.hu>
138444	string	gtktalog		GNOME Catalogue (gtktalog)
13845>13	string	>\0			version %s
13846
13847# Summary: GStreamer binary registry
13848# Extension: .bin
13849# Submitted by: Josh Triplett <josh@joshtriplett.org>
138500	belong	0xc0def00d		GStreamer binary registry
13851>4	string	x			\b, version %s
13852
13853# GVariant Database file
13854# By Elan Ruusamae <glen@delfi.ee>
13855# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h
13856# It's always "GVariant", it's byte swapped on incompatible archs
13857# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c
13858# file_builder_serialise()
13859# https://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant
138600	string	GVariant	GVariant Database file,
13861# version is never filled. probably future extension
13862>8	lelong	x		version %d
13863# not sure are these usable, so commented out
13864#>>16	lelong	x		start %d,
13865#>>>20	lelong	x		end %d
13866
13867# G-IR database made by gobject-introspect toolset,
13868# https://live.gnome.org/GObjectIntrospection
138690	string		GOBJ\nMETADATA\r\n\032	G-IR binary database
13870>16	byte		x			\b, v%d
13871>17	byte		x			\b.%d
13872>20	leshort		x			\b, %d entries
13873>22	leshort		x			\b/%d local
13874
13875#------------------------------------------------------------------------------
13876# $File: gnu,v 1.21 2019/04/19 00:42:27 christos Exp $
13877# gnu:  file(1) magic for various GNU tools
13878#
13879# GNU nlsutils message catalog file format
13880#
13881# GNU message catalog (.mo and .gmo files)
13882
13883# Update: Joerg Jenderek
13884# URL: https://www.gnu.org/software/gettext/manual/html_node/MO-Files.html
13885# Reference: ftp://ftp.gnu.org/pub/gnu/gettext/gettext-0.19.8.tar.gz/
13886#	gettext-0.19.8.1/gettext-runtime/intl/gmo.h
13887# Note: maybe call it like "GNU translation gettext machine object"
138880	string		\336\22\4\225	GNU message catalog (little endian),
13889#0	ulelong	0x950412DE		GNU-format message catalog data
13890# TODO: write lines in such a way that code can also be called for big endian variant
13891#>0	use		gettext-object
13892#0	name		gettext-object
13893>4	ulelong		x		revision
13894!:mime	application/x-gettext-translation
13895# mo extension is also used for Easeus Partition Master PE32 executable module
13896# like ConvertFatToNTFS.mo
13897!:ext	gmo/mo
13898# only found three revision combinations 0.0 0.1 1.1 as unsigned 32-bit
13899# major revision
13900>4	ulelong/0xFFff	x		%u.
13901# minor revision
13902>4	ulelong&0x0000FFff	x	\b%u
13903>>8	ulelong		x		\b, %u message
13904# plural s
13905>>8	ulelong		>1		\bs
13906# size of hashing table
13907#>20	ulelong		x		\b, %u hash
13908#>20	ulelong		>1		\bes
13909#>24	ulelong		x		at 0x%x
13910# for revsion x.0 offset of table with originals is 1Ch if directly after header
13911>4	ulelong&0x0000FFff	=0
13912>>12	ulelong		!0x1C		\b, at 0x%x string table
13913# but for x.1 table offset i found is 30h. That means directly after bigger header
13914>4	ulelong&0x0000FFff	>0
13915>>12	ulelong		!0x30		\b, at 0x%x string table
13916# The following variables are only used in .mo files with minor revision >= 1
13917# number of system dependent segments
13918#>>28	ulelong		x		\b, %u segment
13919#>>28	ulelong		>1		\bs
13920# offset of table describing system dependent segments
13921#>>32	ulelong		x		at 0x%x
13922# number of system dependent strings pairs
13923>>36	ulelong		x		\b, %u sysdep message
13924>>36	ulelong		>1		\bs
13925# offset of table with start offsets of original sysdep strings
13926#>>40	ulelong		x		\b, at 0x%x sysdep strings
13927# offset of table with start offsets of translated sysdep strings
13928#>>44	ulelong		x		\b, at 0x%x sysdep translations
13929# >>(44.l)	ulelong	x		0x%x chars
13930# >>>&0		ulelong	x		at 0x%x
13931# >>>>(&-4)	string	x		"%s"
13932# string table after big header
13933#>>48	ubequad		x		\b, string table 0x%llx
13934#
13935# 0th string length seems to be always 0
13936#>(12.l)	ulelong	x		\b, %u chars
13937#>>&0		ulelong	x		at 0x%x
13938# if 1st string length positiv inspect offset and string
13939#>(12.l+8)	ulelong	>0		\b, %u chars
13940#>>&0		ulelong	x		at 0x%x
13941# if 2nd string length positiv inspect offset and string
13942# >(12.l+16)	ulelong	>0		\b, %u chars
13943# >>&0		ulelong	x		at 0x%x
13944# skip newline byte
13945#>>>(&-4)	ubyte	=0x0A
13946#>>>>&0		string	x		"%s"
13947#>>>(&-4)	ubyte	!0x0A
13948#>>>>&-1		string	x		'%s'
13949# offset of table with translation strings
13950#>16	ulelong		x		\b, at 0x%x translation table
13951# check translation 0 length and offset
13952>(16.l)		ulelong	>0
13953>>&0		ulelong	x
13954# translation 0 seems to be often Project-Id with name and version
13955>>>(&-4)	string	x		\b, %s
13956# trans. 1 with bytes >= 1 unlike icoutils-0.31.0\po\en@boldquot.gmo with 1 NL
13957>(16.l+8)	ulelong	>1
13958>>&0		ulelong	x
13959>>>(&-4)	ubyte	!0x0A
13960>>>>&-1		string	x		'%s'
13961# 1 New Line like in tar-1.29\po\de.gmo
13962>>>(&-4)	ubyte	=0x0A
13963>>>>&0		ubyte	!0x0A
13964>>>>>&-1	string	x		'%s'
13965# 2nd New Line like in parted-3.1\po\de.gmo
13966>>>>&0		ubyte	=0x0A
13967>>>>>&0		string	x		'%s'
13968
139690	string		\225\4\22\336	GNU message catalog (big endian),
13970#0	ubelong	0x950412DE		GNU-format message catalog data
13971!:mime	application/x-gettext-translation
13972!:ext	gmo/mo
13973# TODO: for big endian use same code as for little endian
13974#>0	use		\^gettext-object
13975# DEBUG code
13976#>16	ubelong		x		\b, at 0x%x translation table
13977#>(16.L)		ubelong	x		0x%x chars
13978#>>&0		ubelong	x		at 0x%x
13979# unexpected value HERE!
13980#>>>(&-4)	ubequad	x		0x%llx
13981#
13982>4	beshort		x		revision %d.
13983>6	beshort		>0		\b%d,
13984>>8	belong		x		%d messages,
13985>>36	belong		x		%d sysdep messages
13986>6	beshort		=0		\b%d,
13987>>8	belong		x		%d messages
13988
13989
13990# GnuPG
13991# The format is very similar to pgp
139920	string          \001gpg                 GPG key trust database
13993>4	byte            x                       version %d
13994# Note: magic.mime had 0x8501 for the next line instead of 0x8502
139950	beshort		0x8502			GPG encrypted data
13996!:mime	text/PGP # encoding: data
13997
13998# Update: Joerg Jenderek
13999# Note:	PGP and GPG use same data structure.
14000#	So recognition is now done by ./pgp with start test for byte 0x99
14001# This magic is not particularly good, as the keyrings don't have true
14002# magic. Nevertheless, it covers many keyrings.
14003# 0	ubeshort-0x9901	<2
14004# >3	byte		4
14005# >>4	bedate		x		GPG key public ring, created %s
14006# !:mime application/x-gnupg-keyring
14007
14008# Symmetric encryption
140090	leshort		0x0d8c
14010>4	leshort		0x0203
14011>>2	leshort		0x0204		GPG symmetrically encrypted data (3DES cipher)
14012>>2	leshort		0x0304		GPG symmetrically encrypted data (CAST5 cipher)
14013>>2	leshort		0x0404		GPG symmetrically encrypted data (BLOWFISH cipher)
14014>>2	leshort		0x0704		GPG symmetrically encrypted data (AES cipher)
14015>>2	leshort		0x0804		GPG symmetrically encrypted data (AES192 cipher)
14016>>2	leshort		0x0904		GPG symmetrically encrypted data (AES256 cipher)
14017>>2	leshort		0x0a04		GPG symmetrically encrypted data (TWOFISH cipher)
14018>>2	leshort		0x0b04		GPG symmetrically encrypted data (CAMELLIA128 cipher)
14019>>2	leshort		0x0c04		GPG symmetrically encrypted data (CAMELLIA192 cipher)
14020>>2	leshort		0x0d04		GPG symmetrically encrypted data (CAMELLIA256 cipher)
14021
14022
14023# GnuPG Keybox file
14024# <https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD>
14025# From: Philipp Hahn <hahn@univention.de>
140260	belong	32
14027>4	byte	1
14028>>8	string	KBXf	GPG keybox database
14029>>>5	byte	1	version %d
14030>>>16	bedate	x	\b, created-at %s
14031>>>20	bedate	x	\b, last-maintained %s
14032
14033
14034# Gnumeric spreadsheet
14035# This entry is only semi-helpful, as Gnumeric compresses its files, so
14036# they will ordinarily reported as "compressed", but at least -z helps
1403739      string          =<gmr:Workbook           Gnumeric spreadsheet
14038
14039# From: James Youngman <jay@gnu.org>
14040# gnu find magic
140410	string	\0LOCATE	GNU findutils locate database data
14042>7	string	>\0		\b, format %s
14043>7	string	02		\b (frcode)
14044
14045# Files produced by GNU gettext
14046
14047# gettext message catalogue
140480	search/1024	\nmsgid
14049>&0	search/1024	\nmsgstr	GNU gettext message catalogue text
14050!:strength +100
14051!:mime text/x-po
14052
14053#------------------------------------------------------------------------------
14054# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $
14055# gnumeric:  file(1) magic for Gnumeric spreadsheet
14056# This entry is only semi-helpful, as Gnumeric compresses its files, so
14057# they will ordinarily reported as "compressed", but at least -z helps
1405839	string	=<gmr:Workbook	Gnumeric spreadsheet
14059!:mime	application/x-gnumeric
14060
14061#------------------------------------------------------------------------------
14062# $File: gpt,v 1.4 2017/03/17 21:35:28 christos Exp $
14063#
14064# GPT Partition table patterns.
14065# Author: Rogier Goossens (goossens.rogier@gmail.com)
14066# Note that a GPT-formatted disk must contain an MBR as well.
14067#
14068
14069# The initial segment (up to >>>>>>>>422) was copied from the X86
14070# partition table code (aka MBR).
14071# This is kept separate, so that MBR partitions are not reported as well.
14072# (use -k if you do want them as well)
14073
14074# First, detect the MBR partiton table
14075# If more than one GPT protective MBR partition exists, don't print anything
14076# (the other MBR detection code will then just print the MBR partition table)
140770x1FE			leshort		0xAA55
14078>3			string		!MS
14079>>3			string		!SYSLINUX
14080>>>3			string		!MTOOL
14081>>>>3			string		!NEWLDR
14082>>>>>5			string		!DOS
14083# not FAT (32 bit)
14084>>>>>>82		string		!FAT32
14085#not Linux kernel
14086>>>>>>>514		string		!HdrS
14087#not BeOS
14088>>>>>>>>422		string		!Be\ Boot\ Loader
14089# GPT with protective MBR entry in partition 1 (only)
14090>>>>>>>>>450		ubyte		0xee
14091>>>>>>>>>>466		ubyte		!0xee
14092>>>>>>>>>>>482		ubyte		!0xee
14093>>>>>>>>>>>>498		ubyte		!0xee
14094#>>>>>>>>>>>>>446	use		gpt-mbr-partition
14095>>>>>>>>>>>>>(454.l*8192)	string		EFI\ PART	GPT partition table
14096>>>>>>>>>>>>>>0			use		gpt-mbr-type
14097>>>>>>>>>>>>>>&-8		use		gpt-table
14098>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
14099>>>>>>>>>>>>>(454.l*8192)	string		!EFI\ PART
14100>>>>>>>>>>>>>>(454.l*4096)	string		EFI\ PART	GPT partition table
14101>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14102>>>>>>>>>>>>>>>&-8		use		gpt-table
14103>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
14104>>>>>>>>>>>>>>(454.l*4096)	string		!EFI\ PART
14105>>>>>>>>>>>>>>>(454.l*2048)	string		EFI\ PART	GPT partition table
14106>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14107>>>>>>>>>>>>>>>>&-8		use		gpt-table
14108>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
14109>>>>>>>>>>>>>>>(454.l*2048)	string		!EFI\ PART
14110>>>>>>>>>>>>>>>>(454.l*1024)	string		EFI\ PART	GPT partition table
14111>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14112>>>>>>>>>>>>>>>>>&-8		use		gpt-table
14113>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
14114>>>>>>>>>>>>>>>>(454.l*1024)	string		!EFI\ PART
14115>>>>>>>>>>>>>>>>>(454.l*512)	string		EFI\ PART	GPT partition table
14116>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14117>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
14118>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
14119# GPT with protective MBR entry in partition 2 (only)
14120>>>>>>>>>450		ubyte		!0xee
14121>>>>>>>>>>466		ubyte		0xee
14122>>>>>>>>>>>482		ubyte		!0xee
14123>>>>>>>>>>>>498		ubyte		!0xee
14124#>>>>>>>>>>>>>462	use		gpt-mbr-partition
14125>>>>>>>>>>>>>(470.l*8192)	string		EFI\ PART	GPT partition table
14126>>>>>>>>>>>>>>0			use		gpt-mbr-type
14127>>>>>>>>>>>>>>&-8		use		gpt-table
14128>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
14129>>>>>>>>>>>>>(470.l*8192)	string		!EFI\ PART
14130>>>>>>>>>>>>>>(470.l*4096)	string		EFI\ PART	GPT partition table
14131>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14132>>>>>>>>>>>>>>>&-8		use		gpt-table
14133>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
14134>>>>>>>>>>>>>>(470.l*4096)	string		!EFI\ PART
14135>>>>>>>>>>>>>>>(470.l*2048)	string		EFI\ PART	GPT partition table
14136>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14137>>>>>>>>>>>>>>>>&-8		use		gpt-table
14138>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
14139>>>>>>>>>>>>>>>(470.l*2048)	string		!EFI\ PART
14140>>>>>>>>>>>>>>>>(470.l*1024)	string		EFI\ PART	GPT partition table
14141>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14142>>>>>>>>>>>>>>>>>&-8		use		gpt-table
14143>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
14144>>>>>>>>>>>>>>>>(470.l*1024)	string		!EFI\ PART
14145>>>>>>>>>>>>>>>>>(470.l*512)	string		EFI\ PART	GPT partition table
14146>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14147>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
14148>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
14149# GPT with protective MBR entry in partition 3 (only)
14150>>>>>>>>>450		ubyte		!0xee
14151>>>>>>>>>>466		ubyte		!0xee
14152>>>>>>>>>>>482		ubyte		0xee
14153>>>>>>>>>>>>498		ubyte		!0xee
14154#>>>>>>>>>>>>>478	use		gpt-mbr-partition
14155>>>>>>>>>>>>>(486.l*8192)	string		EFI\ PART	GPT partition table
14156>>>>>>>>>>>>>>0			use		gpt-mbr-type
14157>>>>>>>>>>>>>>&-8		use		gpt-table
14158>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
14159>>>>>>>>>>>>>(486.l*8192)	string		!EFI\ PART
14160>>>>>>>>>>>>>>(486.l*4096)	string		EFI\ PART	GPT partition table
14161>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14162>>>>>>>>>>>>>>>&-8		use		gpt-table
14163>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
14164>>>>>>>>>>>>>>(486.l*4096)	string		!EFI\ PART
14165>>>>>>>>>>>>>>>(486.l*2048)	string		EFI\ PART	GPT partition table
14166>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14167>>>>>>>>>>>>>>>>&-8		use		gpt-table
14168>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
14169>>>>>>>>>>>>>>>(486.l*2048)	string		!EFI\ PART
14170>>>>>>>>>>>>>>>>(486.l*1024)	string		EFI\ PART	GPT partition table
14171>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14172>>>>>>>>>>>>>>>>>&-8		use		gpt-table
14173>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
14174>>>>>>>>>>>>>>>>(486.l*1024)	string		!EFI\ PART
14175>>>>>>>>>>>>>>>>>(486.l*512)	string		EFI\ PART	GPT partition table
14176>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14177>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
14178>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
14179# GPT with protective MBR entry in partition 4 (only)
14180>>>>>>>>>450		ubyte		!0xee
14181>>>>>>>>>>466		ubyte		!0xee
14182>>>>>>>>>>>482		ubyte		!0xee
14183>>>>>>>>>>>>498		ubyte		0xee
14184#>>>>>>>>>>>>>494	use		gpt-mbr-partition
14185>>>>>>>>>>>>>(502.l*8192)	string		EFI\ PART	GPT partition table
14186>>>>>>>>>>>>>>0			use		gpt-mbr-type
14187>>>>>>>>>>>>>>&-8		use		gpt-table
14188>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
14189>>>>>>>>>>>>>(502.l*8192)	string		!EFI\ PART
14190>>>>>>>>>>>>>>(502.l*4096)	string		EFI\ PART	GPT partition table
14191>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14192>>>>>>>>>>>>>>>&-8		use		gpt-table
14193>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
14194>>>>>>>>>>>>>>(502.l*4096)	string		!EFI\ PART
14195>>>>>>>>>>>>>>>(502.l*2048)	string		EFI\ PART	GPT partition table
14196>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14197>>>>>>>>>>>>>>>>&-8		use		gpt-table
14198>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
14199>>>>>>>>>>>>>>>(502.l*2048)	string		!EFI\ PART
14200>>>>>>>>>>>>>>>>(502.l*1024)	string		EFI\ PART	GPT partition table
14201>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14202>>>>>>>>>>>>>>>>>&-8		use		gpt-table
14203>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
14204>>>>>>>>>>>>>>>>(502.l*1024)	string		!EFI\ PART
14205>>>>>>>>>>>>>>>>>(502.l*512)	string		EFI\ PART	GPT partition table
14206>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14207>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
14208>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
14209
14210# The following code does GPT detection and processing, including
14211# sector size detection.
14212# It has to be duplicated above because the top-level pattern
14213# (i.e. not called using 'use') must print *something* for file
14214# to count it as a match. Text only printed in named patterns is
14215# not counted, and causes file to continue, and try and match
14216# other patterns.
14217#
14218# Unfortunately, when assuming sector sizes >=16k, if the sector size
14219# happens to be 512 instead, we may find confusing data after the GPT
14220# table...  If the GPT table has less than 128 entries, this may even
14221# happen for assumed sector sizes as small as 4k
14222# This could be solved by checking for the presence of the backup GPT
14223# header as well, but that makes the logic extremely complex
14224##0		name		gpt-mbr-partition
14225##>(8.l*8192)	string		EFI\ PART
14226##>>(8.l*8192)	use		gpt-mbr-type
14227##>>&-8		use		gpt-table
14228##>>0		ubyte		x		of 8192 bytes
14229##>(8.l*8192)	string		!EFI\ PART
14230##>>(8.l*4096)	string		EFI\ PART	GPT partition table
14231##>>>0		use		gpt-mbr-type
14232##>>>&-8		use		gpt-table
14233##>>>0		ubyte		x		of 4096 bytes
14234##>>(8.l*4096)	string		!EFI\ PART
14235##>>>(8.l*2048)	string		EFI\ PART	GPT partition table
14236##>>>>0		use		gpt-mbr-type
14237##>>>>&-8		use		gpt-table
14238##>>>>0		ubyte		x		of 2048 bytes
14239##>>>(8.l*2048)	string		!EFI\ PART
14240##>>>>(8.l*1024)	string		EFI\ PART	GPT partition table
14241##>>>>>0		use		gpt-mbr-type
14242##>>>>>&-8	use		gpt-table
14243##>>>>>0		ubyte		x		of 1024 bytes
14244##>>>>(8.l*1024)	string		!EFI\ PART
14245##>>>>>(8.l*512)	string		EFI\ PART	GPT partition table
14246##>>>>>>0		use		gpt-mbr-type
14247##>>>>>>&-8	use		gpt-table
14248##>>>>>>0		ubyte		x		of 512 bytes
14249
14250# Print details of MBR type for a GPT-disk
14251# Calling code ensures that there is only one 0xee partition.
142520		name		gpt-mbr-type
14253# GPT with protective MBR entry in partition 1
14254>450		ubyte		0xee
14255>>454		ulelong		1
14256>>>462		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
14257>>454		ulelong		!1													\b (nonstandard: not at LBA 1)
14258# GPT with protective MBR entry in partition 2
14259>466		ubyte		0xee
14260>>470		ulelong		1
14261>>>478		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
14262>>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0					\b (with hybrid MBR)
14263>>>478		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
14264>>470		ulelong		!1									\b (nonstandard: not at LBA 1)
14265# GPT with protective MBR entry in partition 3
14266>482		ubyte		0xee
14267>>486		ulelong		1
14268>>>494		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
14269>>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
14270>>>494		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0					\b (with hybrid MBR)
14271>>486		ulelong		!1									\b (nonstandard: not at LBA 1)
14272# GPT with protective MBR entry in partition 4
14273>498		ubyte		0xee
14274>>502		ulelong		1
14275>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
14276>>502		ulelong		!1													\b (nonstandard: not at LBA 1)
14277
14278# Print the information from a GPT partition table structure
142790		name		gpt-table
14280>10		uleshort	x		\b, version %u
14281>8		uleshort	x		\b.%u
14282>56		ulelong		x		\b, GUID: %08x
14283>60		uleshort	x		\b-%04x
14284>62		uleshort	x		\b-%04x
14285>64		ubeshort	x		\b-%04x
14286>66		ubeshort	x		\b-%04x
14287>68		ubelong		x		\b%08x
14288#>80		uleshort	x		\b, %d partition entries
14289>32		ulequad+1	x		\b, disk size: %lld sectors
14290
14291# In case a GPT data-structure is at LBA 0, report it as well
14292# This covers systems which are not GPT-aware, and which show
14293# and allow access to the protective partition. This code will
14294# detect the contents of such a partition.
142950		string		EFI\ PART	GPT data structure (nonstandard: at LBA 0)
14296>0		use		gpt-table
14297>0		ubyte		x		(sector size unknown)
14298
14299
14300
14301#------------------------------------------------------------------------------
14302# $File: gpu,v 1.2 2017/03/23 22:11:53 christos Exp $
14303# gpu: file(1) magic for GPU input files
14304
14305# Standard Portable Intermediate Representation (SPIR)
14306# Documentation: https://www.khronos.org/spir
14307# Typical file extension: .spv
14308
143090	belong	0x07230203	Khronos SPIR-V binary, big-endian
14310>4	belong	x		\b, version 0x%08x
14311>8	belong	x		\b, generator 0x%08x
14312
143130	lelong	0x07230203      Khronos SPIR-V binary, little-endian
14314>4	lelong	x		\b, version 0x%08x
14315>8	lelong	x		\b, generator 0x%08x
14316
14317# Vulkan Trace file
14318# Documentation:
14319# https://github.com/LunarG/VulkanTools/blob/master/vktrace/vktrace_common/\
14320# vktrace_trace_packet_identifiers.h
14321# Typical file extension: .vktrace
14322
143238	lequad  0xABADD068ADEAFD0C	Vulkan trace file, little-endian
14324>0	leshort	x			\b, version %d
14325
143268	bequad  0xABADD068ADEAFD0C	Vulkan trace file, big-endian
14327>0	beshort	x			\b, version %d
14328
14329#------------------------------------------------------------------------------
14330# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $
14331# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
14332#
14333# ACE/gr binary
143340	string	\000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003		old ACE/gr binary file
14335>39	byte	>0			- version %c
14336# ACE/gr ascii
143370	string	#\ xvgr\ parameter\ file	ACE/gr ascii file
143380	string	#\ xmgr\ parameter\ file	ACE/gr ascii file
143390	string	#\ ACE/gr\ parameter\ file	ACE/gr ascii file
14340# Grace projects
143410	string	#\ Grace\ project\ file		Grace project file
14342>23	string	@version\  			(version
14343>>32	byte	>0 				%c
14344>>33	string	>\0 				\b.%.2s
14345>>35	string	>\0 				\b.%.2s)
14346# ACE/gr fit description files
143470	string	#\ ACE/gr\ fit\ description\ 	ACE/gr fit description file
14348# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
14349
14350#------------------------------------------------------------------------------
14351# $File: graphviz,v 1.9 2019/04/30 04:01:40 christos Exp $
14352# graphviz:  file(1) magic for https://www.graphviz.org/
14353
14354# FIXME: These patterns match too generally. For example, the first
14355# line matches a LaTeX file containing the word "graph" (with a {
14356# following later) and the second line matches this file.
14357#0	regex/100l	[\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{	graphviz graph text
14358#!:mime	text/vnd.graphviz
14359#0	regex/100l	[\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{	graphviz digraph text
14360#!:mime	text/vnd.graphviz
14361
14362#------------------------------------------------------------------------------
14363# $File: gringotts,v 1.6 2017/03/17 21:35:28 christos Exp $
14364# gringotts:  file(1) magic for Gringotts
14365# http://devel.pluto.linux.it/projects/Gringotts/
14366# author: Germano Rizzo <mano@pluto.linux.it>
14367#GRG3????Y
143680	string	GRG		Gringotts data file
14369#file format 1
14370>3	string		1		v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
14371#file format 2
14372>3	string		2		v.2, MCRYPT S2K,
14373>>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
14374>>8	byte&0x70	0x10		SERPENT crypt,
14375>>8	byte&0x70	0x20		TWOFISH crypt,
14376>>8	byte&0x70	0x30		CAST-256 crypt,
14377>>8	byte&0x70	0x40		SAFER+ crypt,
14378>>8	byte&0x70	0x50		LOKI97 crypt,
14379>>8	byte&0x70	0x60		3DES crypt,
14380>>8	byte&0x70	0x70		RIJNDAEL-256 crypt,
14381>>8	byte&0x08	0x00		SHA1 hash,
14382>>8	byte&0x08	0x08		RIPEMD-160 hash,
14383>>8	byte&0x04	0x00		ZLib
14384>>8	byte&0x04	0x04		BZip2
14385>>8	byte&0x03	0x00		lvl.0
14386>>8	byte&0x03	0x01		lvl.3
14387>>8	byte&0x03	0x02		lvl.6
14388>>8	byte&0x03	0x03		lvl.9
14389#file format 3
14390>3	string		3		v.3, OpenPGP S2K,
14391>>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
14392>>8	byte&0x70	0x10		SERPENT crypt,
14393>>8	byte&0x70	0x20		TWOFISH crypt,
14394>>8	byte&0x70	0x30		CAST-256 crypt,
14395>>8	byte&0x70	0x40		SAFER+ crypt,
14396>>8	byte&0x70	0x50		LOKI97 crypt,
14397>>8	byte&0x70	0x60		3DES crypt,
14398>>8	byte&0x70	0x70		RIJNDAEL-256 crypt,
14399>>8	byte&0x08	0x00		SHA1 hash,
14400>>8	byte&0x08	0x08		RIPEMD-160 hash,
14401>>8	byte&0x04	0x00		ZLib
14402>>8	byte&0x04	0x04		BZip2
14403>>8	byte&0x03	0x00		lvl.0
14404>>8	byte&0x03	0x01		lvl.3
14405>>8	byte&0x03	0x02		lvl.6
14406>>8	byte&0x03	0x03		lvl.9
14407#file format >3
14408>3	string		>3		v.%.1s (unknown details)
14409
14410#------------------------------------------------------------------------------
14411# $File: guile,v 1.2 2019/04/19 00:42:27 christos Exp $
14412# Guile file magic from <dalepsmith@gmail.com>
14413# https://www.gnu.org/s/guile/
14414# https://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250
14415
144160	string	GOOF----	Guile Object
14417>8	string	LE		\b, little endian
14418>8	string	BE		\b, big endian
14419>11	string	4		\b, 32bit
14420>11	string	8		\b, 64bit
14421>13	regex	.\..		\b, bytecode v%s
14422
14423#------------------------------------------------------------------------------
14424# $File: hardware,v 1.1 2018/08/02 06:32:52 christos Exp $
14425# hardware magic
14426
14427# EDID
14428# https://en.wikipedia.org/wiki/Extended_Display_Identification_Data
144290	string		\x00\xFF\xFF\xFF\xFF\xFF\xFF\x00
14430>19	byte		x
14431>>18	byte		x	EDID data, version %u.
14432>>19	byte		x	\b%u
14433#>>17	ubyte+1990	<255	\b, manufactured %u
14434
14435#------------------------------------------------------------------------------
14436# $File: hitachi-sh,v 1.9 2018/08/21 12:48:41 christos Exp $
14437# hitach-sh: file(1) magic for Hitachi Super-H
14438#
14439# Super-H COFF
14440#
14441# updated by Joerg Jenderek at Oct 2015
14442# https://en.wikipedia.org/wiki/COFF
14443# https://de.wikipedia.org/wiki/Common_Object_File_Format
14444# http://www.delorie.com/djgpp/doc/coff/filhdr.html
14445# below test line conflicts with 2nd NTFS filesystem sector
14446# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR
14447# and Portable Gaming Notation Compressed format (*.WID http://pgn.freeservers.com/)
144480	beshort		0x0500
14449# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
14450>18	ubeshort&0x8E80	0
14451# use big endian variant of subroutine to display name+variables+flags
14452# for common object formated files
14453>>0	use				\^display-coff
14454!:strength -10
14455
144560	leshort		0x0550
14457# test for unused flag bits in f_flags
14458>18	uleshort&0x8E80	0
14459# use little endian variant of subroutine to
14460# display name+variables+flags for common object formated files
14461>>0	use				display-coff
14462!:strength -10
14463
14464
14465#------------------------------------------------------------------------------
14466# $File: hp,v 1.25 2019/01/13 00:32:38 christos Exp $
14467# hp:  file(1) magic for Hewlett Packard machines (see also "printer")
14468#
14469# XXX - somebody should figure out whether any byte order needs to be
14470# applied to the "TML" stuff; I'm assuming the Apollo stuff is
14471# big-endian as it was mostly 68K-based.
14472#
14473# I think the 500 series was the old stack-based machines, running a
14474# UNIX environment atop the "SUN kernel"; dunno whether it was
14475# big-endian or little-endian.
14476#
14477# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
14478# hp300 are 68020+68881 based; hp400 are also 68k.  The following basic
14479# HP magic is useful for reference, but using "long" magic is a better
14480# practice in order to avoid collisions.
14481#
14482# Guy Harris (guy@netapp.com): some additions to this list came from
14483# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
14484# 1.2, and 2.0).  The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
14485# "/etc/magic", though, except for the "archive file relocatable library"
14486# stuff, and the 68030 and 68040 stuff isn't there at all - are they not
14487# used in executables, or have they just not yet updated "/etc/magic"
14488# completely?
14489#
14490# 0	beshort		200		hp200 (68010) BSD binary
14491# 0	beshort		300		hp300 (68020+68881) BSD binary
14492# 0	beshort		0x20c		hp200/300 HP-UX binary
14493# 0	beshort		0x20d		hp400 (68030) HP-UX binary
14494# 0	beshort		0x20e		hp400 (68040?) HP-UX binary
14495# 0	beshort		0x20b		PA-RISC1.0 HP-UX binary
14496# 0	beshort		0x210		PA-RISC1.1 HP-UX binary
14497# 0	beshort		0x211		PA-RISC1.2 HP-UX binary
14498# 0	beshort		0x214		PA-RISC2.0 HP-UX binary
14499
14500#
14501# The "misc" stuff needs a byte order; the archives look suspiciously
14502# like the old 177545 archives (0xff65 = 0177545).
14503#
14504#### Old Apollo stuff
145050	beshort		0627		Apollo m68k COFF executable
14506>18	beshort		^040000		not stripped
14507>22	beshort		>0		- version %d
145080	beshort		0624		apollo a88k COFF executable
14509>18	beshort		^040000		not stripped
14510>22	beshort		>0		- version %d
145110       long            01203604016     TML 0123 byte-order format
145120       long            01702407010     TML 1032 byte-order format
145130       long            01003405017     TML 2301 byte-order format
145140       long            01602007412     TML 3210 byte-order format
14515#### PA-RISC 1.1
145160	belong 		0x02100106	PA-RISC1.1 relocatable object
145170	belong 		0x02100107	PA-RISC1.1 executable
14518>168	belong		&0x00000004	dynamically linked
14519>(144)	belong		0x054ef630	dynamically linked
14520>96	belong		>0		- not stripped
14521
145220	belong 		0x02100108	PA-RISC1.1 shared executable
14523>168	belong&0x4	0x4		dynamically linked
14524>(144)	belong		0x054ef630	dynamically linked
14525>96	belong		>0		- not stripped
14526
145270	belong 		0x0210010b	PA-RISC1.1 demand-load executable
14528>168	belong&0x4	0x4		dynamically linked
14529>(144)	belong		0x054ef630	dynamically linked
14530>96	belong		>0		- not stripped
14531
145320	belong 		0x0210010e	PA-RISC1.1 shared library
14533>96	belong		>0		- not stripped
14534
145350	belong 		0x0210010d	PA-RISC1.1 dynamic load library
14536>96	belong		>0		- not stripped
14537
14538#### PA-RISC 2.0
145390	belong		0x02140106	PA-RISC2.0 relocatable object
14540
145410       belong		0x02140107	PA-RISC2.0 executable
14542>168	belong		&0x00000004	dynamically linked
14543>(144)	belong		0x054ef630	dynamically linked
14544>96	belong		>0		- not stripped
14545
145460       belong		0x02140108	PA-RISC2.0 shared executable
14547>168	belong		&0x00000004	dynamically linked
14548>(144)	belong		0x054ef630	dynamically linked
14549>96	belong		>0		- not stripped
14550
145510       belong		0x0214010b	PA-RISC2.0 demand-load executable
14552>168	belong		&0x00000004	dynamically linked
14553>(144)	belong		0x054ef630	dynamically linked
14554>96	belong		>0		- not stripped
14555
145560       belong		0x0214010e	PA-RISC2.0 shared library
14557>96	belong		>0		- not stripped
14558
145590       belong		0x0214010d	PA-RISC2.0 dynamic load library
14560>96	belong		>0		- not stripped
14561
14562#### 800
145630	belong 		0x020b0106	PA-RISC1.0 relocatable object
14564
145650	belong 		0x020b0107	PA-RISC1.0 executable
14566>168	belong&0x4	0x4		dynamically linked
14567>(144)	belong		0x054ef630	dynamically linked
14568>96	belong		>0		- not stripped
14569
145700	belong 		0x020b0108	PA-RISC1.0 shared executable
14571>168	belong&0x4	0x4		dynamically linked
14572>(144)	belong		0x054ef630	dynamically linked
14573>96	belong		>0		- not stripped
14574
145750	belong 		0x020b010b	PA-RISC1.0 demand-load executable
14576>168	belong&0x4	0x4		dynamically linked
14577>(144)	belong		0x054ef630	dynamically linked
14578>96	belong		>0		- not stripped
14579
145800	belong 		0x020b010e	PA-RISC1.0 shared library
14581>96	belong		>0		- not stripped
14582
145830	belong 		0x020b010d	PA-RISC1.0 dynamic load library
14584>96	belong		>0		- not stripped
14585
14586#### 500
145870	long		0x02080106	HP s500 relocatable executable
14588>16	long		>0		- version %d
14589
145900	long		0x02080107	HP s500 executable
14591>16	long		>0		- version %d
14592
145930	long		0x02080108	HP s500 pure executable
14594>16	long		>0		- version %d
14595
14596#### 200
145970	belong 		0x020c0108	HP s200 pure executable
14598>4	beshort		>0		- version %d
14599>8	belong		&0x80000000	save fp regs
14600>8	belong		&0x40000000	dynamically linked
14601>8	belong		&0x20000000	debuggable
14602>36	belong		>0		not stripped
14603
146040	belong		0x020c0107	HP s200 executable
14605>4	beshort		>0		- version %d
14606>8	belong		&0x80000000	save fp regs
14607>8	belong		&0x40000000	dynamically linked
14608>8	belong		&0x20000000	debuggable
14609>36	belong		>0		not stripped
14610
146110	belong		0x020c010b	HP s200 demand-load executable
14612>4	beshort		>0		- version %d
14613>8	belong		&0x80000000	save fp regs
14614>8	belong		&0x40000000	dynamically linked
14615>8	belong		&0x20000000	debuggable
14616>36	belong		>0		not stripped
14617
146180	belong		0x020c0106	HP s200 relocatable executable
14619>4	beshort		>0		- version %d
14620>6	beshort		>0		- highwater %d
14621>8	belong		&0x80000000	save fp regs
14622>8	belong		&0x20000000	debuggable
14623>8	belong		&0x10000000	PIC
14624
146250	belong 		0x020a0108	HP s200 (2.x release) pure executable
14626>4	beshort		>0		- version %d
14627>36	belong		>0		not stripped
14628
146290	belong		0x020a0107	HP s200 (2.x release) executable
14630>4	beshort		>0		- version %d
14631>36	belong		>0		not stripped
14632
146330	belong		0x020c010e	HP s200 shared library
14634>4	beshort		>0		- version %d
14635>6	beshort		>0		- highwater %d
14636>36	belong		>0		not stripped
14637
146380	belong		0x020c010d	HP s200 dynamic load library
14639>4	beshort		>0		- version %d
14640>6	beshort		>0		- highwater %d
14641>36	belong		>0		not stripped
14642
14643#### MISC
146440	long		0x0000ff65	HP old archive
146450	long		0x020aff65	HP s200 old archive
146460	long		0x020cff65	HP s200 old archive
146470	long		0x0208ff65	HP s500 old archive
14648
146490	long		0x015821a6	HP core file
14650
146510	long		0x4da7eee8	HP-WINDOWS font
14652>8	byte		>0		- version %d
146530	string		Bitmapfile	HP Bitmapfile
14654
146550	string		IMGfile	CIS 	compimg HP Bitmapfile
14656# XXX - see "lif"
14657#0	short		0x8000		lif file
146580	long		0x020c010c	compiled Lisp
14659
146600	string		msgcat01	HP NLS message catalog,
14661>8	long		>0		%d messages
14662
14663# Summary: HP-48/49 calculator
14664# Created by: phk@data.fls.dk
14665# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk>
14666# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support)
146670	string		HPHP		HP
14668>4	string		48		48 binary
14669>4	string		49		49 binary
14670>7	byte		>64		- Rev %c
14671>8	leshort		0x2911		(ADR)
14672>8	leshort		0x2933		(REAL)
14673>8	leshort		0x2955		(LREAL)
14674>8	leshort		0x2977		(COMPLX)
14675>8	leshort		0x299d		(LCOMPLX)
14676>8	leshort		0x29bf		(CHAR)
14677>8	leshort		0x29e8		(ARRAY)
14678>8	leshort		0x2a0a		(LNKARRAY)
14679>8	leshort		0x2a2c		(STRING)
14680>8	leshort		0x2a4e		(HXS)
14681>8	leshort		0x2a74		(LIST)
14682>8	leshort		0x2a96		(DIR)
14683>8	leshort		0x2ab8		(ALG)
14684>8	leshort		0x2ada		(UNIT)
14685>8	leshort		0x2afc		(TAGGED)
14686>8	leshort		0x2b1e		(GROB)
14687>8	leshort		0x2b40		(LIB)
14688>8	leshort		0x2b62		(BACKUP)
14689>8	leshort		0x2b88		(LIBDATA)
14690>8	leshort		0x2d9d		(PROG)
14691>8	leshort		0x2dcc		(CODE)
14692>8	leshort		0x2e48		(GNAME)
14693>8	leshort		0x2e6d		(LNAME)
14694>8	leshort		0x2e92		(XLIB)
14695
146960	string		%%HP:		HP text
14697>6	string		T(0)		- T(0)
14698>6	string		T(1)		- T(1)
14699>6	string		T(2)		- T(2)
14700>6	string		T(3)		- T(3)
14701>10	string		A(D)		A(D)
14702>10	string		A(R)		A(R)
14703>10	string		A(G)		A(G)
14704>14	string		F(.)		F(.);
14705>14	string		F(,)		F(,);
14706
14707
14708# Summary: HP-38/39 calculator
14709# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
147100	string		HP3
14711>3	string		8		HP 38
14712>3	string		9		HP 39
14713>4	string		Bin		binary
14714>4	string		Asc		ASCII
14715>7	string		A		(Directory List)
14716>7	string		B		(Zaplet)
14717>7	string		C		(Note)
14718>7	string		D		(Program)
14719>7	string		E		(Variable)
14720>7	string		F		(List)
14721>7	string		G		(Matrix)
14722>7	string		H		(Library)
14723>7	string		I		(Target List)
14724>7	string		J		(ASCII Vector specification)
14725>7	string		K		(wildcard)
14726
14727# Summary: HP-38/39 calculator
14728# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
147290	string		HP3
14730>3	string		8		HP 38
14731>3	string		9		HP 39
14732>4	string		Bin		binary
14733>4	string		Asc		ASCII
14734>7	string		A		(Directory List)
14735>7	string		B		(Zaplet)
14736>7	string		C		(Note)
14737>7	string		D		(Program)
14738>7	string		E		(Variable)
14739>7	string		F		(List)
14740>7	string		G		(Matrix)
14741>7	string		H		(Library)
14742>7	string		I		(Target List)
14743>7	string		J		(ASCII Vector specification)
14744>7	string		K		(wildcard)
14745
14746# hpBSD magic numbers
147470	beshort		200		hp200 (68010) BSD
14748>2	beshort		0407		impure binary
14749>2	beshort		0410		read-only binary
14750>2	beshort		0413		demand paged binary
147510	beshort		300		hp300 (68020+68881) BSD
14752>2	beshort		0407		impure binary
14753>2	beshort		0410		read-only binary
14754>2	beshort		0413		demand paged binary
14755#
14756# From David Gero <dgero@nortelnetworks.com>
14757# HP-UX 10.20 core file format from /usr/include/sys/core.h
14758# Unfortunately, HP-UX uses corehead blocks without specifying the order
14759# There are four we care about:
14760#     CORE_KERNEL, which starts with the string "HP-UX"
14761#     CORE_EXEC, which contains the name of the command
14762#     CORE_PROC, which contains the signal number that caused the core dump
14763#     CORE_FORMAT, which contains the version of the core file format (== 1)
14764# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC
14765# but we include all 6 variations of the order of the first 3, and
14766# assume that PROC will always be last
14767# Order 1: KERNEL, EXEC, FORMAT, PROC
147680x10		string	HP-UX
14769>0		belong	2
14770>>0xC		belong	0x3C
14771>>>0x4C		belong	0x100
14772>>>>0x58	belong	0x44
14773>>>>>0xA0	belong	1
14774>>>>>>0xAC	belong	4
14775>>>>>>>0xB0	belong	1
14776>>>>>>>>0xB4	belong	4		core file
14777>>>>>>>>>0x90	string	>\0		from '%s'
14778>>>>>>>>>0xC4	belong	3		- received SIGQUIT
14779>>>>>>>>>0xC4	belong	4		- received SIGILL
14780>>>>>>>>>0xC4	belong	5		- received SIGTRAP
14781>>>>>>>>>0xC4	belong	6		- received SIGABRT
14782>>>>>>>>>0xC4	belong	7		- received SIGEMT
14783>>>>>>>>>0xC4	belong	8		- received SIGFPE
14784>>>>>>>>>0xC4	belong	10		- received SIGBUS
14785>>>>>>>>>0xC4	belong	11		- received SIGSEGV
14786>>>>>>>>>0xC4	belong	12		- received SIGSYS
14787>>>>>>>>>0xC4	belong	33		- received SIGXCPU
14788>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
14789# Order 2: KERNEL, FORMAT, EXEC, PROC
14790>>>0x4C		belong	1
14791>>>>0x58	belong	4
14792>>>>>0x5C	belong	1
14793>>>>>>0x60	belong	0x100
14794>>>>>>>0x6C	belong	0x44
14795>>>>>>>>0xB4	belong	4		core file
14796>>>>>>>>>0xA4	string	>\0		from '%s'
14797>>>>>>>>>0xC4	belong	3		- received SIGQUIT
14798>>>>>>>>>0xC4	belong	4		- received SIGILL
14799>>>>>>>>>0xC4	belong	5		- received SIGTRAP
14800>>>>>>>>>0xC4	belong	6		- received SIGABRT
14801>>>>>>>>>0xC4	belong	7		- received SIGEMT
14802>>>>>>>>>0xC4	belong	8		- received SIGFPE
14803>>>>>>>>>0xC4	belong	10		- received SIGBUS
14804>>>>>>>>>0xC4	belong	11		- received SIGSEGV
14805>>>>>>>>>0xC4	belong	12		- received SIGSYS
14806>>>>>>>>>0xC4	belong	33		- received SIGXCPU
14807>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
14808# Order 3: FORMAT, KERNEL, EXEC, PROC
148090x24		string	HP-UX
14810>0		belong	1
14811>>0xC		belong	4
14812>>>0x10		belong	1
14813>>>>0x14	belong	2
14814>>>>>0x20	belong	0x3C
14815>>>>>>0x60	belong	0x100
14816>>>>>>>0x6C	belong	0x44
14817>>>>>>>>0xB4	belong	4		core file
14818>>>>>>>>>0xA4	string	>\0		from '%s'
14819>>>>>>>>>0xC4	belong	3		- received SIGQUIT
14820>>>>>>>>>0xC4	belong	4		- received SIGILL
14821>>>>>>>>>0xC4	belong	5		- received SIGTRAP
14822>>>>>>>>>0xC4	belong	6		- received SIGABRT
14823>>>>>>>>>0xC4	belong	7		- received SIGEMT
14824>>>>>>>>>0xC4	belong	8		- received SIGFPE
14825>>>>>>>>>0xC4	belong	10		- received SIGBUS
14826>>>>>>>>>0xC4	belong	11		- received SIGSEGV
14827>>>>>>>>>0xC4	belong	12		- received SIGSYS
14828>>>>>>>>>0xC4	belong	33		- received SIGXCPU
14829>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
14830# Order 4: EXEC, KERNEL, FORMAT, PROC
148310x64		string	HP-UX
14832>0		belong	0x100
14833>>0xC		belong	0x44
14834>>>0x54		belong	2
14835>>>>0x60	belong	0x3C
14836>>>>>0xA0	belong	1
14837>>>>>>0xAC	belong	4
14838>>>>>>>0xB0	belong	1
14839>>>>>>>>0xB4	belong	4		core file
14840>>>>>>>>>0x44	string	>\0		from '%s'
14841>>>>>>>>>0xC4	belong	3		- received SIGQUIT
14842>>>>>>>>>0xC4	belong	4		- received SIGILL
14843>>>>>>>>>0xC4	belong	5		- received SIGTRAP
14844>>>>>>>>>0xC4	belong	6		- received SIGABRT
14845>>>>>>>>>0xC4	belong	7		- received SIGEMT
14846>>>>>>>>>0xC4	belong	8		- received SIGFPE
14847>>>>>>>>>0xC4	belong	10		- received SIGBUS
14848>>>>>>>>>0xC4	belong	11		- received SIGSEGV
14849>>>>>>>>>0xC4	belong	12		- received SIGSYS
14850>>>>>>>>>0xC4	belong	33		- received SIGXCPU
14851>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
14852# Order 5: FORMAT, EXEC, KERNEL, PROC
148530x78		string	HP-UX
14854>0		belong	1
14855>>0xC		belong	4
14856>>>0x10		belong	1
14857>>>>0x14	belong	0x100
14858>>>>>0x20	belong	0x44
14859>>>>>>0x68	belong	2
14860>>>>>>>0x74	belong	0x3C
14861>>>>>>>>0xB4	belong	4		core file
14862>>>>>>>>>0x58	string	>\0		from '%s'
14863>>>>>>>>>0xC4	belong	3		- received SIGQUIT
14864>>>>>>>>>0xC4	belong	4		- received SIGILL
14865>>>>>>>>>0xC4	belong	5		- received SIGTRAP
14866>>>>>>>>>0xC4	belong	6		- received SIGABRT
14867>>>>>>>>>0xC4	belong	7		- received SIGEMT
14868>>>>>>>>>0xC4	belong	8		- received SIGFPE
14869>>>>>>>>>0xC4	belong	10		- received SIGBUS
14870>>>>>>>>>0xC4	belong	11		- received SIGSEGV
14871>>>>>>>>>0xC4	belong	12		- received SIGSYS
14872>>>>>>>>>0xC4	belong	33		- received SIGXCPU
14873>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
14874# Order 6: EXEC, FORMAT, KERNEL, PROC
14875>0		belong	0x100
14876>>0xC		belong	0x44
14877>>>0x54		belong	1
14878>>>>0x60	belong	4
14879>>>>>0x64	belong	1
14880>>>>>>0x68	belong	2
14881>>>>>>>0x74	belong	0x2C
14882>>>>>>>>0xB4	belong	4		core file
14883>>>>>>>>>0x44	string	>\0		from '%s'
14884>>>>>>>>>0xC4	belong	3		- received SIGQUIT
14885>>>>>>>>>0xC4	belong	4		- received SIGILL
14886>>>>>>>>>0xC4	belong	5		- received SIGTRAP
14887>>>>>>>>>0xC4	belong	6		- received SIGABRT
14888>>>>>>>>>0xC4	belong	7		- received SIGEMT
14889>>>>>>>>>0xC4	belong	8		- received SIGFPE
14890>>>>>>>>>0xC4	belong	10		- received SIGBUS
14891>>>>>>>>>0xC4	belong	11		- received SIGSEGV
14892>>>>>>>>>0xC4	belong	12		- received SIGSYS
14893>>>>>>>>>0xC4	belong	33		- received SIGXCPU
14894>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
14895
14896
14897
14898#------------------------------------------------------------------------------
14899# $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $
14900# human68k:  file(1) magic for Human68k (X680x0 DOS) binary formats
14901# Magic too short!
14902#0		string	HU		Human68k
14903#>68		string	LZX		LZX compressed
14904#>>72		string	>\0		(version %s)
14905#>(8.L+74)	string	LZX		LZX compressed
14906#>>(8.L+78)	string	>\0		(version %s)
14907#>60		belong	>0		binded
14908#>(8.L+66)	string	#HUPAIR		hupair
14909#>0		string	HU		X executable
14910#>(8.L+74)	string	#LIBCV1		- linked PD LIBC ver 1
14911#>4		belong	>0		- base address 0x%x
14912#>28		belong	>0		not stripped
14913#>32		belong	>0		with debug information
14914#0		beshort	0x601a		Human68k Z executable
14915#0		beshort	0x6000		Human68k object file
14916#0		belong	0xd1000000	Human68k ar binary archive
14917#0		belong	0xd1010000	Human68k ar ascii archive
14918#0		beshort	0x0068		Human68k lib archive
14919#4		string	LZX		Human68k LZX compressed
14920#>8		string	>\0		(version %s)
14921#>4		string	LZX		R executable
14922#2		string	#HUPAIR		Human68k hupair R executable
14923
14924#------------------------------------------------------------------------------
14925# $File: ibm370,v 1.10 2017/03/17 21:35:28 christos Exp $
14926# ibm370:  file(1) magic for IBM 370 and compatibles.
14927#
14928# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
14929# What the heck *is* "USS/370"?
14930# AIX 4.1's "/etc/magic" has
14931#
14932#	0	short		0535		370 sysV executable
14933#	>12	long		>0		not stripped
14934#	>22	short		>0		- version %d
14935#	>30	long		>0		- 5.2 format
14936#	0	short		0530		370 sysV pure executable
14937#	>12	long		>0		not stripped
14938#	>22	short		>0		- version %d
14939#	>30	long		>0		- 5.2 format
14940#
14941# instead of the "USS/370" versions of the same magic numbers.
14942#
149430	beshort		0537		370 XA sysV executable
14944>12	belong		>0		not stripped
14945>22	beshort		>0		- version %d
14946>30	belong		>0		- 5.2 format
149470	beshort		0532		370 XA sysV pure executable
14948>12	belong		>0		not stripped
14949>22	beshort		>0		- version %d
14950>30	belong		>0		- 5.2 format
149510	beshort		054001		370 sysV pure executable
14952>12	belong		>0		not stripped
149530	beshort		055001		370 XA sysV pure executable
14954>12	belong		>0		not stripped
149550	beshort		056401		370 sysV executable
14956>12	belong		>0		not stripped
149570	beshort		057401		370 XA sysV executable
14958>12	belong		>0		not stripped
149590       beshort		0531		SVR2 executable (Amdahl-UTS)
14960>12	belong		>0		not stripped
14961>24     belong		>0		- version %d
149620	beshort		0534		SVR2 pure executable (Amdahl-UTS)
14963>12	belong		>0		not stripped
14964>24	belong		>0		- version %d
149650	beshort		0530		SVR2 pure executable (USS/370)
14966>12	belong		>0		not stripped
14967>24	belong		>0		- version %d
149680	beshort		0535		SVR2 executable (USS/370)
14969>12	belong		>0		not stripped
14970>24	belong		>0		- version %d
14971
14972#------------------------------------------------------------------------------
14973# $File: ibm6000,v 1.14 2019/03/07 17:21:54 christos Exp $
14974# ibm6000:  file(1) magic for RS/6000 and the RT PC.
14975#
149760	beshort		0x01df		executable (RISC System/6000 V3.1) or obj module
14977>12	belong		>0		not stripped
14978# Breaks sun4 statically linked execs.
14979#0      beshort		0x0103		executable (RT Version 2) or obj module
14980#>2	byte		0x50		pure
14981#>28	belong		>0		not stripped
14982#>6	beshort		>0		- version %ld
149830	beshort		0x0104		shared library
149840	beshort		0x0105		ctab data
149850	beshort		0xfe04		structured file
149860	string		0xabcdef	AIX message catalog
149870	belong		0x000001f9	AIX compiled message catalog
149880	string		\<aiaff>	archive
149890	string		\<bigaf>	archive (big format)
149900	belong		0x09006bea	AIX backup/restore format file
149910	belong		0x09006fea	AIX backup/restore format file
14992
149930	beshort		0x01f7		64-bit XCOFF executable or object module
14994>20	belong		0		not stripped
14995# GRR: this test is still too general as it catches also many FATs of DOS filesystems
149964	belong		&0x0feeddb0
14997# real core dump could not be 32-bit and 64-bit together
14998>7	byte&0x03	!3		AIX core file
14999>>1	byte		&0x01		fulldump
15000>>7	byte		&0x01		32-bit
15001>>>0x6e0	string	>\0		\b, %s
15002>>7	byte		&0x02		64-bit
15003>>>0x524	string	>\0		\b, %s
15004
15005#------------------------------------------------------------------------------
15006# $File: icc,v 1.5 2017/08/13 00:21:47 christos Exp $
15007# icc:  file(1) magic for International Color Consortium file formats
15008
15009#
15010# Color profiles as per the ICC's "Image technology colour management -
15011# Architecture, profile format, and data structure" specification.
15012# See
15013#
15014#	http://www.color.org/specification/ICC1v43_2010-12.pdf
15015#
15016# for Specification ICC.1:2010 (Profile version 4.3.0.0).
15017# URL: http://fileformats.archiveteam.org/wiki/ICC_profile
15018# Reference: http://www.color.org/iccmax/ICC.2-2016-7.pdf
15019# Update: Joerg Jenderek
15020#
15021# Bytes 36 to 39 contain a generic profile file signature of "acsp";
15022# bytes 40 to 43 "may be used to identify the primary platform/operating
15023# system framework for which the profile was created".
15024#
15025#	check and display ICC/ICM color profile
150260	name	color-profile
15027>36	string		acsp
15028# skip ASCII like Cognacspirit.txt by month <= 12
15029>>26	ubeshort	<13
15030# platform/operating system. Only 5 mentioned
15031
15032#
15033# This appears to be what's used for Apple ColorSync profiles.
15034# Instead of adding that, Apple just changed the generic "acsp" entry
15035# to be for "ColorSync ICC Color Profile" rather than "Kodak Color
15036# Management System, ICC Profile".
15037# Yes, it's "APPL", not "AAPL"; see the spec.
15038>>>40	string		APPL		ColorSync
15039
15040# Microsoft ICM color profile
15041>>>40	string		MSFT		Microsoft
15042
15043# Yes, that's a blank after "SGI".
15044>>>40	string		SGI\ 		SGI
15045
15046# XXX - is this what's used for the Sun KCMS or not?  The standard file
15047# uses just "acsp" for that, but Apple's file uses it for "ColorSync",
15048# and there *is* an identified "primary platform" value of SUNW.
15049>>>40	string		SUNW		Sun KCMS
15050
15051# 5th platform
15052>>>40	string		TGNT		Taligent
15053
15054# remaining "l" "e" of "color profile" printed later to avoid error
15055>>>40	string		x 		color profi
15056#>>>40	string		x		(%.4s)
15057!:mime	application/vnd.iccprofile
15058# for "ICM" extension only versions 2.x and for Kodak "CC" 2.0 is found
15059>>>8	ubyte		=2
15060# do not use empty message text to a avoid error like
15061# icc, 82: Warning: Current entry does not yet have a description for adding a EXTENSION type
15062# file.exe: could not find any valid magic files!
15063>>>>9	ubyte		!0		\ble
15064!:ext	icc/icm
15065# minor version
15066>>>>9	ubyte		=0		\bl
15067# Kodak colour management system
15068>>>>>4	string		=KCMS		\be
15069!:ext	icc/icm/cc
15070>>>>>4	string		!KCMS		\be
15071!:ext	icc/icm
15072>>>8	ubyte		!2		\ble
15073!:ext	icc
15074# Profile version major.4bit-minor.sub1.sub2 like 4.3.0.0 (04300000h)
15075>>>8	ubyte		x		%u
15076>>>9	ubyte/16	x		\b.%u
15077# reserved and shall be null but 205.205 in umx1220u.icm
15078>>>10	ubyte		>0		\b.%u
15079>>>>11	ubyte		>0		\b.%u
15080# preferred colour management module like appl CCMS KCMS Lino UCCM "Win " "FF  "
15081# skip space like in brmsl08f.icm and null like in brmsl09f.icm, brmsl07f.icm
15082>>>4	string		>\ 		\b, type %.2s
15083>>>>6	string		>\  		\b%.1s
15084>>>>>7	string		>\  		\b%.1s
15085# colour space "XYZ " "Lab " "RGB " CMYK GRAY ...
15086>>>16	string		x		\b, %.3s
15087>>>19	string		>\  		\b%.1s
15088# Profile Connection Space (PCS) field usually "XYZ " or "Lab " but sometimes
15089# null or CMYK like in ISOcoated_v2_to_PSOcoated_v3_DeviceLink.icc
15090>>>20	string		>\0		\b/%.3s
15091>>>>23	string		>\ 		\b%.1s
15092# eleven device classes
15093>>>12	string		x		\b-%.4s device
15094# skip 00001964h in hpf69000.icc or 0h in XRDC50Q.ICM or " ROT" in brmsl05f.icm
15095>>>52	string		>\040
15096# skip "none" model like in "Trinitron Compatible 9300K G2.2.icm"
15097>>>>52	ubelong		!0x6e6f6e65
15098# device manufacturer field like "HP  " "IBM " EPSO
15099>>>>>48	string		x		\b, %.2s
15100>>>>>50	string		>\  		\b%.1s
15101>>>>>51	string		>\  		\b%.1s
15102# model like "ADI " "A265" and skip 20000404h in IS330.icm for RICOH RUSSIAN-SC
15103>>>>>52	string		>\ \  		\b/%.3s
15104>>>>>>55 string		>\  		\b%.1s
15105>>>>>52	string		x		model
15106# creator (often same as manufacture) like HP SONY XROX or null like in A925A.icm
15107>>>80	string		>\0		by %.2s
15108>>>>82	string		>\  		\b%.1s
15109>>>>>83	string		>\  		\b%.1s
15110# profile size
15111>>>0	ubelong		x		\b, %u bytes
15112# skip invalid date 0 like in linearSRGB.icc
15113>>>24	ubequad		!0
15114# datetime dd-mm-yyyy hh:mm:ss
15115>>>>28	ubeshort	x		\b, %u
15116# month <= 12
15117>>>>26	ubeshort	x		\b-%u
15118# year
15119>>>>24	ubeshort	x		\b-%u
15120# do not display midnight time like in CNHP8308.ICC
15121>>>>30	ubequad&0xFFffFFffFFff0000	!0
15122# hour <= 24
15123>>>>>30	ubeshort	x		%u
15124# minutes <= 59
15125>>>>>32	ubeshort	x		\b:%.2u
15126# seconds <= 59
15127>>>>>34	ubeshort	x		\b:%.2u
15128# vendor specific flags like 2 in HPCLJ5.ICM
15129>>>44	ubeshort	>0		\b, 0x%x vendor flags
15130# profile flags bits 0-2 of least 16 used by ICC
15131#>>>44	ubelong		>0		\b, 0x%x flags
15132# icEmbeddedProfileTrue
15133>>>44	ubelong		&1		\b, embedded
15134# icEmbeddedProfileFalse
15135#>>>44	ubelong		^1		\b, not embedded
15136# icUseWithEmbeddedDataOnly
15137>>>44	ubelong		&2		\b, dependently
15138# icUseAnywhere
15139#>>>44	ubelong		^2		\b, independently
15140>>>44	ubelong		&4		\b, MCS
15141#>>>44	ubelong		^4		\b, no MCS
15142# vendor specific device attributes 1~srgb.icc
15143# E000D00h~CNB7QEDA.ICM C000A00h~CNB5FCAA.ICM 01040401h~CNB25PE3.ICM
15144>>>56	ubelong		>0		\b, 0x%x vendor attribute
15145# ICC device attributes bits 0-7 used
15146#>>>60	ubelong		x		\b, 0x%x attribute
15147# http://www.color.org/icc34.h
15148>>>60	ubelong		&0x01		\b, transparent
15149#>>>60	ubelong		^0x01		\b, reflective
15150>>>60	ubelong		&0x02		\b, matte
15151#>>>60	ubelong		^0x02		\b, glossy
15152>>>60	ubelong		&0x04		\b, negative
15153#>>>60	ubelong		^0x04		\b, positive
15154>>>60	ubelong		&0x08		\b, black&white
15155#>>>60	ubelong		^0x08		\b, colour
15156>>>60	ubelong		&0x10		\b, non-paper
15157#>>>60	ubelong		^0x10		\b, paper
15158>>>60	ubelong		&0x20		\b, non-textured
15159#>>>60	ubelong		^0x20		\b, textured
15160>>>60	ubelong		&0x40		\b, non-isotropic
15161#>>>60	ubelong		^0x40		\b, isotropic
15162>>>60	ubelong		&0x80		\b, self-luminous
15163#>>>60	ubelong		^0x80		\b, non-self-luminous
15164# rendering intent 0-3 but 7AEA5027h in EE051__1.ICM 6CB1BCh in EE061__1.ICM
15165>>>64	ubelong		>3		\b, 0x%x rendering intent
15166#>>>64	ubelong		=0		\b, perceptual
15167>>>64	ubelong		=1		\b, relative colorimetric
15168>>>64	ubelong		=2		\b, saturation
15169>>>64	ubelong		=3		\b, absolute colorimetric
15170# PCS illuminant (3*s15Fixed16Numbers) often 0000f6d6 00010000 0000d32d
15171>>>71	ubequad		!0xd6000100000000d3	\b, PCS
15172# usually X~0.9642*65536=63189.8112~63190=F6D5h ; but also found
15173# often F6D6 in gt5000r.icm, F6B8 in kodakce.icm, F6CA in RSWOP.icm
15174>>>>68	ubelong			!0x0000f6d5	X=0x%x
15175# usually Y=1.0~00010000h but Y=0 in brmsl07f.icm
15176>>>>72	ubelong			!0x00010000	Y=0x%x
15177# usually Z~0.8249*65536=54060.6464~54061=D32Dh ; but also found
15178# D2F7 in hp1200c.icm, often D32C in A925A.icm, D309 in RSWOP.icm , D2F8 in kodak_dc.icm
15179>>>>76	ubelong			!0x0000d32d	Z=0x%x
15180# Profile ID. MD5 fingerprinting method as defined in Internet RFC 1321.
15181>>>84	ubequad		>0		\b, 0x%llx MD5
15182# reserved in older versions should be zero but also found CDCDCDCDCDCDCDCD
15183#>>100	ubequad		x		\b 0x%llx reserved
15184# tag table
15185# 6 <= tags count <= 43
15186#>>>128	ubelong		>43		\b, %u tags
15187>>>128	ubelong		x
15188# shall contain the profileDescriptionTag "desc" , copyrightTag "cprt"
15189# search range = tags count * 12 -8=< maximal tag count * 12 -8= 43 * 12 -8= 508
15190>>>>132	search/508	cprt
15191# but no copyright tag in linearSRGB.icc
15192# beneath /System/Library/Frameworks/WebKit.framework/
15193# Versions/A/Frameworks/WebCore.framework/Versions/A/Resources
15194>>>>132	default		x		\b, no copyright tag
15195# 1st tag
15196#>>>132	string		x		\b, 1st tag %.4s
15197#>>>136	ubelong		x		0x%x offset
15198#>>>140	ubelong		x		0x%x len
15199# 2nd tag,...
15200# look also for profileDescriptionTag "desc"
15201>>>132	search/508	desc
15202# look further for TextDescriptionType "desc" signature
15203>>>>(&0.L)	string		=desc
15204>>>>>&4		pstring/l	x	"%s"
15205# look alternative for multiLocalizedUnicodeType "mluc" signature like in VideoPAL.icc
15206>>>>(&0.L)	string		=mluc
15207>>>>>&(&8.L)	ubequad		x
15208>>>>>>&4	bestring16	x	'%s'
15209
15210# Any other profile.
15211# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles,
15212# and use "acsp" for everything else and dump the "primary platform"
15213# string in those cases?
1521436	string		acsp
15215>0	use		color-profile
15216
15217
15218
15219#------------------------------------------------------------------------------
15220# $File: iff,v 1.14 2015/09/07 10:03:21 christos Exp $
15221# iff:	file(1) magic for Interchange File Format (see also "audio" & "images")
15222#
15223# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
15224# Arts for file interchange.  It has also been used by Apple, SGI, and
15225# especially Commodore-Amiga.
15226#
15227# IFF files begin with an 8 byte FORM header, followed by a 4 character
15228# FORM type, which is followed by the first chunk in the FORM.
15229
152300	string		FORM		IFF data
15231#>4	belong		x		\b, FORM is %d bytes long
15232# audio formats
15233>8	string		AIFF		\b, AIFF audio
15234!:mime	audio/x-aiff
15235>8	string		AIFC		\b, AIFF-C compressed audio
15236!:mime	audio/x-aiff
15237>8	string		8SVX		\b, 8SVX 8-bit sampled sound voice
15238!:mime	audio/x-aiff
15239>8	string		16SV		\b, 16SV 16-bit sampled sound voice
15240>8	string		SAMP		\b, SAMP sampled audio
15241>8	string		MAUD		\b, MAUD MacroSystem audio
15242>8	string		SMUS		\b, SMUS simple music
15243>8	string		CMUS		\b, CMUS complex music
15244# image formats
15245>8	string		ILBMBMHD	\b, ILBM interleaved image
15246>>20	beshort		x		\b, %d x
15247>>22	beshort		x		%d
15248>8	string		RGBN		\b, RGBN 12-bit RGB image
15249>8	string		RGB8		\b, RGB8 24-bit RGB image
15250>8	string		DEEP		\b, DEEP TVPaint/XiPaint image
15251>8	string		DR2D		\b, DR2D 2-D object
15252>8	string		TDDD		\b, TDDD 3-D rendering
15253>8	string		LWOB		\b, LWOB 3-D object
15254>8	string		LWO2		\b, LWO2 3-D object, v2
15255>8	string		LWLO		\b, LWLO 3-D layered object
15256>8	string		REAL		\b, REAL Real3D rendering
15257>8	string		MC4D		\b, MC4D MaxonCinema4D rendering
15258>8	string		ANIM		\b, ANIM animation
15259>8	string		YAFA		\b, YAFA animation
15260>8	string		SSA\ 		\b, SSA super smooth animation
15261>8	string		ACBM		\b, ACBM continuous image
15262>8	string		FAXX		\b, FAXX fax image
15263# other formats
15264>8	string		FTXT		\b, FTXT formatted text
15265>8	string		CTLG		\b, CTLG message catalog
15266>8	string		PREF		\b, PREF preferences
15267>8	string		DTYP		\b, DTYP datatype description
15268>8	string		PTCH		\b, PTCH binary patch
15269>8	string		AMFF		\b, AMFF AmigaMetaFile format
15270>8	string		WZRD		\b, WZRD StormWIZARD resource
15271>8	string		DOC\ 		\b, DOC desktop publishing document
15272>8	string		WVQA 		\b, Westwood Studios VQA Multimedia,
15273>>24	leshort		x		%d video frames,
15274>>26	leshort		x		%d x
15275>>28	leshort		x		%d
15276>8	string		MOVE		\b, Wing Commander III Video
15277>>12	string		_PC_		\b, PC version
15278>>12	string		3DO_		\b, 3DO version
15279
15280# These go at the end of the iff rules
15281#
15282# David Griffith <dave@661.org>
15283# I don't see why these might collide with anything else.
15284#
15285# Interactive Fiction related formats
15286#
15287>8	string		IFRS		\b, Blorb Interactive Fiction
15288>>24	string		Exec		with executable chunk
15289>8	string          IFZS		\b, Z-machine or Glulx saved game file (Quetzal)
15290!:mime	application/x-blorb
15291
15292#------------------------------------------------------------------------------
15293# $File: images,v 1.160 2019/04/19 00:42:27 christos Exp $
15294# images:  file(1) magic for image formats (see also "iff", and "c-lang" for
15295# XPM bitmaps)
15296#
15297# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
15298# additions by janl@ifi.uio.no as well as others. Jan also suggested
15299# merging several one- and two-line files into here.
15300#
15301# little magic: PCX (first byte is 0x0a)
15302
15303# Targa - matches `povray', `ppmtotga' and `xv' outputs
15304# by Philippe De Muyter <phdm@macqel.be>
15305# URL: http://justsolve.archiveteam.org/wiki/TGA
15306# Reference: http://www.dca.fee.unicamp.br/~martino/disciplinas/ea978/tgaffs.pdf
15307# Update: Joerg Jenderek
15308# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
15309#	,32 or 33 (both not observed)
15310# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
15311#	or theoretically 2-128 reserved for use by Truevision or 128-255 may be used for developer applications
15312# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs
15313# `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
15314# `tgatoppm' recognizes a superset (Index may be anything)
15315#
15316# test of Color Map Type 0~no 1~color map
15317# and Image Type 1 2 3 9 10 11 32 33
15318# and Color Map Entry Size 0 15 16 24 32
153190	ubequad&0x00FeC400000000C0	0
15320# Prevent conflicts with CRI ADX.
15321>(2.S-2) belong	!0x28632943
15322# skip more garbage like *.iso by looking for positive image type
15323>2	ubyte			>0
15324# skip some compiled terminfo like xterm+tmux by looking for image type less equal 33
15325>>2	ubyte			<34
15326# skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel depth 1 8 15 16 24 32
15327>>>16	ubyte			1
15328>>>>0		use		tga-image
15329>>>16	ubyte			8
15330>>>>0		use		tga-image
15331>>>16	ubyte			15
15332>>>>0		use		tga-image
15333>>>16	ubyte			16
15334>>>>0		use		tga-image
15335>>>16	ubyte			24
15336>>>>0		use		tga-image
15337>>>16	ubyte			32
15338>>>>0		use		tga-image
15339#	display tga bitmap image information
153400	name				tga-image
15341>2	ubyte		<34		Targa image data
15342!:mime	image/x-tga
15343!:apple	????TPIC
15344# normal extension .tga but some Truevision products used others:
15345# tpic (Apple),icb (Image Capture Board),vda (Video Display Adapter),vst (NuVista),win (UNSURE about that)
15346!:ext	tga/tpic/icb/vda/vst
15347# image type 1 2 3 9 10 11 32 33
15348>2	ubyte&0xF7	1		- Map
15349>2	ubyte&0xF7	2		- RGB
15350# alpha channel
15351>>17	ubyte&0x0F	>0		\bA
15352>2	ubyte&0xF7	3		- Mono
15353# type not found, but by http://www.fileformat.info/format/tga/corion.htm
15354# Compressed color-mapped data, using Huffman, Delta, and runlength encoding
15355>2	ubyte		32		- Color
15356# Compressed color-mapped data, using Huffman, Delta, and RLE. 4-pass quadtree- type process
15357>2	ubyte		33		- Color
15358# Color Map Type 0~no 1~color map
15359>1	ubyte		1		(
15360# first color map entry, 0 normal
15361>>3	uleshort	>0		\b%d-
15362# color map length 0 2 1dh 3bh d9h 100h
15363>>5	uleshort	x		\b%d)
15364# 8~run length encoding bit
15365>2	ubyte&0x08	8		- RLE
15366# gimp can create big pictures!
15367>12	uleshort	>0		%d x
15368>12	uleshort	=0		65536 x
15369# image height. 0 interpreted as 65536
15370>14	uleshort	>0		%d
15371>14	uleshort	=0		65536
15372# Image Pixel depth 1 8 15 16 24 32
15373>16	ubyte		x		x %d
15374# X origin of image. 0 normal
15375>8	uleshort	>0		+%d
15376# Y origin of image. 0 normal; positive for top
15377>10	uleshort	>0		+%d
15378# Image descriptor: bits 3-0 give the alpha channel depth, bits 5-4 give direction
15379>17	ubyte&0x0F	>0		- %d-bit alpha
15380# bits 5-4 give direction. normal bottom left
15381>17	ubyte		&0x20		- top
15382#>17	ubyte		^0x20		- bottom
15383>17	ubyte		&0x10		- right
15384#>17	ubyte		^0x10		- left
15385# some info say other bits 6-7 should be zero
15386# but data storage interleave by http://www.fileformat.info/format/tga/corion.htm
15387# 00 - no interleave;01 - even/odd interleave; 10 - four way interleave; 11 - reserved
15388#>17	ubyte&0xC0	0x00		- no interleave
15389>17	ubyte&0xC0	0x40		- interleave
15390>17	ubyte&0xC0	0x80		- four way interleave
15391>17	ubyte&0xC0	0xC0		- reserved
15392# positive length implies identification field
15393>0	ubyte		>0
15394>>18	string		x		"%s"
15395# last 18 bytes of newer tga file footer signature
15396>18	search/4261301/s	TRUEVISION-XFILE.\0
15397# extension area offset if not 0
15398>>&-8		ulelong			>0
15399# length of the extension area. normal 495 for version 2.0
15400>>>(&-4.l)	uleshort		0x01EF
15401# AuthorName[41]
15402>>>>&0		string			>\0		- author "%-.40s"
15403# Comment[324]=4 * 80 null terminated
15404>>>>&41		string			>\0		- comment "%-.80s"
15405# date
15406>>>>&365	ubequad&0xffffFFFFffff0000	!0
15407# Day
15408>>>>>&-6		uleshort		x		%d
15409# Month
15410>>>>>&-8		uleshort		x		\b-%d
15411# Year
15412>>>>>&-4		uleshort		x		\b-%d
15413# time
15414>>>>&371	ubequad&0xffffFFFFffff0000	!0
15415# hour
15416>>>>>&-8		uleshort		x		%d
15417# minutes
15418>>>>>&-6		uleshort		x		\b:%.2d
15419# second
15420>>>>>&-4		uleshort		x		\b:%.2d
15421# JobName[41]
15422>>>>&377		string			>\0		- job "%-.40s"
15423# JobHour Jobminute Jobsecond
15424>>>>&418	ubequad&0xffffFFFFffff0000	!0
15425>>>>>&-8		uleshort		x		%d
15426>>>>>&-6		uleshort		x		\b:%.2d
15427>>>>>&-4		uleshort		x		\b:%.2d
15428# SoftwareId[41]
15429>>>>&424		string			>\0		- %-.40s
15430# SoftwareVersionNumber
15431>>>>&424	ubyte				>0
15432>>>>>&40		uleshort/100		x		%d
15433>>>>>&40		uleshort%100		x		\b.%d
15434# VersionLetter
15435>>>>>&42		ubyte			>0x20		\b%c
15436# KeyColor
15437>>>>&468		ulelong			>0		- keycolor 0x%8.8x
15438# Denominator of Pixel ratio. 0~no pixel aspect
15439>>>>&474	uleshort			>0
15440# Numerator
15441>>>>>&-4		uleshort		>0		- aspect %d
15442>>>>>&-2		uleshort		x		\b/%d
15443# Denominator of Gamma ratio. 0~no Gamma value
15444>>>>&478	uleshort			>0
15445# Numerator
15446>>>>>&-4		uleshort		>0		- gamma %d
15447>>>>>&-2		uleshort		x		\b/%d
15448# ColorOffset
15449#>>>>&480	ulelong			x		- col offset 0x%8.8x
15450# StampOffset
15451#>>>>&484	ulelong			x		- stamp offset 0x%8.8x
15452# ScanOffset
15453#>>>>&488	ulelong			x		- scan offset 0x%8.8x
15454# AttributesType
15455#>>>>&492	ubyte			x		- Attributes 0x%x
15456## EndOfTGA
15457
15458# PBMPLUS images
15459# The next byte following the magic is always whitespace.
15460# strength is changed to try these patterns before "x86 boot sector"
154610	name		netpbm
15462>3	regex/s		=[0-9]{1,50}\ [0-9]{1,50}	Netpbm image data
15463>>&0	regex		=[0-9]{1,50} 			\b, size = %s x
15464>>>&0	regex		=[0-9]{1,50}			\b %s
15465
154660	search/1	P1
15467>0	regex/4		P1[\040\t\f\r\n]
15468>>0	use		netpbm
15469>>0	string		x	\b, bitmap
15470!:strength + 65
15471!:mime	image/x-portable-bitmap
15472
154730	search/1	P2
15474>0	regex/4		P2[\040\t\f\r\n]
15475>>0	use		netpbm
15476>>0	string		x	\b, greymap
15477!:strength + 65
15478!:mime	image/x-portable-greymap
15479
154800	search/1	P3
15481>0	regex/4		P3[\040\t\f\r\n]
15482>>0	use		netpbm
15483>>0	string		x	\b, pixmap
15484!:strength + 65
15485!:mime	image/x-portable-pixmap
15486
154870	string		P4
15488>0	regex/4		P4[\040\t\f\r\n]
15489>>0	use		netpbm
15490>>0	string		x	\b, rawbits, bitmap
15491!:strength + 65
15492!:mime	image/x-portable-bitmap
15493
154940	string		P5
15495>0	regex/4		P5[\040\t\f\r\n]
15496>>0	use		netpbm
15497>>0	string		x	\b, rawbits, greymap
15498!:strength + 65
15499!:mime	image/x-portable-greymap
15500
155010	string		P6
15502>0	regex/4		P6[\040\t\f\r\n]
15503>>0	use		netpbm
15504>>0	string		x	\b, rawbits, pixmap
15505!:strength + 65
15506!:mime	image/x-portable-pixmap
15507
155080	string		P7		Netpbm PAM image file
15509!:mime	image/x-portable-pixmap
15510
15511# From: bryanh@giraffe-data.com (Bryan Henderson)
155120	string		\117\072	Solitaire Image Recorder format
15513>4	string		\013		MGI Type 11
15514>4	string		\021		MGI Type 17
155150	string		.MDA		MicroDesign data
15516>21	byte		48		version 2
15517>21	byte		51		version 3
155180	string		.MDP		MicroDesign page data
15519>21	byte		48		version 2
15520>21	byte		51		version 3
15521
15522# NIFF (Navy Interchange File Format, a modification of TIFF) images
15523# [GRR:  this *must* go before TIFF]
155240	string		IIN1		NIFF image data
15525!:mime	image/x-niff
15526
15527# Canon RAW version 1 (CRW) files are a type of Canon Image File Format
15528# (CIFF) file. These are apparently all little-endian.
15529# From: Adam Buchbinder <adam.buchbinder@gmail.com>
15530# URL: https://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html
155310	string		II\x1a\0\0\0HEAPCCDR	Canon CIFF raw image data
15532!:mime	image/x-canon-crw
15533>16	leshort		x	\b, version %d.
15534>14	leshort		x	\b%d
15535
15536# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic
15537# number. Put this above the TIFF test to make sure we detect them.
15538# These are apparently all little-endian.
15539# From: Adam Buchbinder <adam.buchbinder@gmail.com>
15540# URL: https://libopenraw.freedesktop.org/wiki/Canon_CR2
155410	string		II\x2a\0\x10\0\0\0CR	Canon CR2 raw image data
15542!:mime	image/x-canon-cr2
15543!:strength +80
15544>10	byte		x	\b, version %d.
15545>11	byte		x	\b%d
15546
15547# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
15548# The second word of TIFF files is the TIFF version number, 42, which has
15549# never changed.  The TIFF specification recommends testing for it.
155500	string		MM\x00\x2a	TIFF image data, big-endian
15551!:strength +70
15552!:mime	image/tiff
15553>(4.L)	use		\^tiff_ifd
155540	string		II\x2a\x00	TIFF image data, little-endian
15555!:mime	image/tiff
15556!:strength +70
15557>(4.l)	use		tiff_ifd
15558
155590	name		tiff_ifd
15560>0	leshort		x		\b, direntries=%d
15561>2	use		tiff_entry
15562
155630	name		tiff_entry
15564# NewSubFileType
15565>0	leshort		0xfe
15566>>12	use		tiff_entry
15567>0	leshort		0x100
15568>>4	lelong		1
15569>>>12	use		tiff_entry
15570>>>8	leshort		x		\b, width=%d
15571>0	leshort		0x101
15572>>4	lelong		1
15573>>>8	leshort		x		\b, height=%d
15574>>>12	use		tiff_entry
15575>0	leshort		0x102
15576>>8	leshort		x		\b, bps=%d
15577>>12	use		tiff_entry
15578>0	leshort		0x103
15579>>4	lelong		1		\b, compression=
15580>>>8	leshort		1		\bnone
15581>>>8	leshort		2		\bhuffman
15582>>>8	leshort		3		\bbi-level group 3
15583>>>8	leshort		4		\bbi-level group 4
15584>>>8	leshort		5		\bLZW
15585>>>8	leshort		6		\bJPEG (old)
15586>>>8	leshort		7		\bJPEG
15587>>>8	leshort		8		\bdeflate
15588>>>8	leshort		9		\bJBIG, ITU-T T.85
15589>>>8	leshort		0xa		\bJBIG, ITU-T T.43
15590>>>8	leshort		0x7ffe		\bNeXT RLE 2-bit
15591>>>8	leshort		0x8005		\bPackBits (Macintosh RLE)
15592>>>8	leshort		0x8029		\bThunderscan RLE
15593>>>8	leshort		0x807f		\bRasterPadding (CT or MP)
15594>>>8	leshort		0x8080		\bRLE (Line Work)
15595>>>8	leshort		0x8081		\bRLE (High-Res Cont-Tone)
15596>>>8	leshort		0x8082		\bRLE (Binary Line Work)
15597>>>8	leshort		0x80b2		\bDeflate (PKZIP)
15598>>>8	leshort		0x80b3		\bKodak DCS
15599>>>8	leshort		0x8765		\bJBIG
15600>>>8	leshort		0x8798		\bJPEG2000
15601>>>8	leshort		0x8799		\bNikon NEF Compressed
15602>>>8	default		x
15603>>>>8	leshort		x		\b(unknown 0x%x)
15604>>>12	use		tiff_entry
15605>0	leshort		0x106		\b, PhotometricIntepretation=
15606>>8	clear		x
15607>>8	leshort		0		\bWhiteIsZero
15608>>8	leshort		1		\bBlackIsZero
15609>>8	leshort		2		\bRGB
15610>>8	leshort		3		\bRGB Palette
15611>>8	leshort		4		\bTransparency Mask
15612>>8	leshort		5		\bCMYK
15613>>8	leshort		6		\bYCbCr
15614>>8	leshort		8		\bCIELab
15615>>8	default		x
15616>>>8	leshort		x		\b(unknown=0x%x)
15617>>12	use		tiff_entry
15618# FillOrder
15619>0	leshort		0x10a
15620>>4	lelong		1
15621>>>12	use		tiff_entry
15622# DocumentName
15623>0	leshort		0x10d
15624>>(8.l)	string		x		\b, name=%s
15625>>>12	use		tiff_entry
15626# ImageDescription
15627>0	leshort		0x10e
15628>>(8.l)	string		x		\b, description=%s
15629>>>12	use		tiff_entry
15630# Make
15631>0	leshort		0x10f
15632>>(8.l)	string		x		\b, manufacturer=%s
15633>>>12	use		tiff_entry
15634# Model
15635>0	leshort		0x110
15636>>(8.l)	string		x		\b, model=%s
15637>>>12	use		tiff_entry
15638# StripOffsets
15639>0	leshort		0x111
15640>>12	use		tiff_entry
15641# Orientation
15642>0	leshort		0x112		\b, orientation=
15643>>8	leshort		1		\bupper-left
15644>>8	leshort		3		\blower-right
15645>>8	leshort		6		\bupper-right
15646>>8	leshort		8		\blower-left
15647>>8	leshort		9		\bundefined
15648>>8	default		x
15649>>>8	leshort		x		\b[*%d*]
15650>>12	use		tiff_entry
15651# XResolution
15652>0	leshort		0x11a
15653>>8	lelong		x		\b, xresolution=%d
15654>>12	use		tiff_entry
15655# YResolution
15656>0	leshort		0x11b
15657>>8	lelong		x		\b, yresolution=%d
15658>>12	use		tiff_entry
15659# ResolutionUnit
15660>0	leshort		0x128
15661>>8	leshort		x		\b, resolutionunit=%d
15662>>12	use		tiff_entry
15663# Software
15664>0	leshort		0x131
15665>>(8.l)	string		x		\b, software=%s
15666>>12	use		tiff_entry
15667# Datetime
15668>0	leshort		0x132
15669>>(8.l)	string		x		\b, datetime=%s
15670>>12	use		tiff_entry
15671# HostComputer
15672>0	leshort		0x13c
15673>>(8.l)	string		x		\b, hostcomputer=%s
15674>>12	use		tiff_entry
15675# WhitePoint
15676>0	leshort		0x13e
15677>>12	use		tiff_entry
15678# PrimaryChromaticities
15679>0	leshort		0x13f
15680>>12	use		tiff_entry
15681# YCbCrCoefficients
15682>0	leshort		0x211
15683>>12	use		tiff_entry
15684# YCbCrPositioning
15685>0	leshort		0x213
15686>>12	use		tiff_entry
15687# ReferenceBlackWhite
15688>0	leshort		0x214
15689>>12	use		tiff_entry
15690# Copyright
15691>0	leshort		0x8298
15692>>(8.l)	string		x		\b, copyright=%s
15693>>12	use		tiff_entry
15694# ExifOffset
15695>0	leshort		0x8769
15696>>12	use		tiff_entry
15697# GPS IFD
15698>0	leshort		0x8825		\b, GPS-Data
15699>>12	use		tiff_entry
15700
15701#>0	leshort		x		\b, unknown=0x%x
15702#>>12	use		tiff_entry
15703
157040	string		MM\x00\x2b	Big TIFF image data, big-endian
15705!:mime	image/tiff
157060	string		II\x2b\x00	Big TIFF image data, little-endian
15707!:mime	image/tiff
15708
15709# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
15710# (Greg Roelofs, newt@uchicago.edu)
15711# (Albert Cahalan, acahalan@cs.uml.edu)
15712#
15713# 137 P N G \r \n ^Z \n [4-byte length] I H D R [HEAD data] [HEAD crc] ...
15714#
15715
15716# IHDR parser
157170	name		png-ihdr
15718>0	belong		x		\b, %d x
15719>4	belong		x		%d,
15720>8	byte		x		%d-bit
15721>9	byte		0		grayscale,
15722>9	byte		2		\b/color RGB,
15723>9	byte		3		colormap,
15724>9	byte		4		gray+alpha,
15725>9	byte		6		\b/color RGBA,
15726#>10	byte		0		deflate/32K,
15727>12	byte		0		non-interlaced
15728>12	byte		1		interlaced
15729
15730# Standard PNG image.
157310	string		\x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0DIHDR	PNG image data
15732!:mime	image/png
15733!:ext   png
15734!:strength +10
15735>16	use		png-ihdr
15736
15737# Apple CgBI PNG image.
157380	string		\x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x04CgBI
15739>24	string  	\x00\x00\x00\x0DIHDR	PNG image data (CgBI)
15740!:mime	image/png
15741!:ext   png
15742!:strength +10
15743>>32	use		png-ihdr
15744
15745# possible GIF replacements; none yet released!
15746# (Greg Roelofs, newt@uchicago.edu)
15747#
15748# GRR 950115:  this was mine ("Zip GIF"):
157490	string		GIF94z		ZIF image (GIF+deflate alpha)
15750!:mime	image/x-unknown
15751#
15752# GRR 950115:  this is Jeremy Wohl's Free Graphics Format (better):
15753#
157540	string		FGF95a		FGF image (GIF+deflate beta)
15755!:mime	image/x-unknown
15756#
15757# GRR 950115:  this is Thomas Boutell's Portable Bitmap Format proposal
15758# (best; not yet implemented):
15759#
157600	string		PBF		PBF image (deflate compression)
15761!:mime	image/x-unknown
15762
15763# GIF
15764# Strength set up to beat 0x55AA DOS/MBR signature word lookups (+65)
157650	string		GIF8		GIF image data
15766!:strength +80
15767!:mime	image/gif
15768!:apple	8BIMGIFf
15769>4	string		7a		\b, version 8%s,
15770>4	string		9a		\b, version 8%s,
15771>6	leshort		>0		%d x
15772>8	leshort		>0		%d
15773#>10	byte		&0x80		color mapped,
15774#>10	byte&0x07	=0x00		2 colors
15775#>10	byte&0x07	=0x01		4 colors
15776#>10	byte&0x07	=0x02		8 colors
15777#>10	byte&0x07	=0x03		16 colors
15778#>10	byte&0x07	=0x04		32 colors
15779#>10	byte&0x07	=0x05		64 colors
15780#>10	byte&0x07	=0x06		128 colors
15781#>10	byte&0x07	=0x07		256 colors
15782
15783# ITC (CMU WM) raster files.  It is essentially a byte-reversed Sun raster,
15784# 1 plane, no encoding.
157850	string		\361\0\100\273	CMU window manager raster image data
15786>4	lelong		>0		%d x
15787>8	lelong		>0		%d,
15788>12	lelong		>0		%d-bit
15789
15790# Magick Image File Format
157910	string		id=ImageMagick	MIFF image data
15792
15793# Artisan
157940	long		1123028772	Artisan image data
15795>4	long		1		\b, rectangular 24-bit
15796>4	long		2		\b, rectangular 8-bit with colormap
15797>4	long		3		\b, rectangular 32-bit (24-bit with matte)
15798
15799# FIG (Facility for Interactive Generation of figures), an object-based format
158000	search/1	#FIG		FIG image text
15801>5	string		x		\b, version %.3s
15802
15803# PHIGS
158040	string		ARF_BEGARF		PHIGS clear text archive
158050	string		@(#)SunPHIGS		SunPHIGS
15806# version number follows, in the form m.n
15807>40	string		SunBin			binary
15808>32	string		archive			archive
15809
15810# GKS (Graphics Kernel System)
158110	string		GKSM		GKS Metafile
15812>24	string		SunGKS		\b, SunGKS
15813
15814# CGM image files
158150	string		BEGMF		clear text Computer Graphics Metafile
15816
15817# MGR bitmaps  (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
158180	string	yz	MGR bitmap, modern format, 8-bit aligned
158190	string	zz	MGR bitmap, old format, 1-bit deep, 16-bit aligned
158200	string	xz	MGR bitmap, old format, 1-bit deep, 32-bit aligned
158210	string	yx	MGR bitmap, modern format, squeezed
15822
15823# Fuzzy Bitmap (FBM) images
158240	string		%bitmap\0	FBM image data
15825>30	long		0x31		\b, mono
15826>30	long		0x33		\b, color
15827
15828# facsimile data
158291	string		PC\ Research,\ Inc	group 3 fax data
15830>29	byte		0		\b, normal resolution (204x98 DPI)
15831>29	byte		1		\b, fine resolution (204x196 DPI)
15832# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at>
158330	string		Sfff		structured fax file
15834
15835# From: Joerg Jenderek <joerg.jen.der.ek@gmx.net>
15836# most files with the extension .EPA and some with .BMP
158370	string		\x11\x06	Award BIOS Logo, 136 x 84
15838!:mime	image/x-award-bioslogo
158390	string		\x11\x09	Award BIOS Logo, 136 x 126
15840!:mime	image/x-award-bioslogo
15841#0	string		\x07\x1f	BIOS Logo corrupted?
15842# http://www.blackfiveservices.co.uk/awbmtools.shtml
15843# http://biosgfx.narod.ru/v3/
15844# http://biosgfx.narod.ru/abr-2/
158450	string		AWBM
15846>4	leshort		<1981		Award BIOS bitmap
15847!:mime	image/x-award-bmp
15848# image width is a multiple of 4
15849>>4	leshort&0x0003	0
15850>>>4		leshort	x		\b, %d
15851>>>6		leshort	x		x %d
15852>>4	leshort&0x0003	>0		\b,
15853>>>4	leshort&0x0003	=1
15854>>>>4		leshort	x		%d+3
15855>>>4	leshort&0x0003	=2
15856>>>>4		leshort	x		%d+2
15857>>>4	leshort&0x0003	=3
15858>>>>4		leshort	x		%d+1
15859>>>6		leshort	x		x %d
15860# at offset 8 starts imagedata followed by "RGB " marker
15861
15862# PC bitmaps (OS/2, Windows BMP files)  (Greg Roelofs, newt@uchicago.edu)
15863# https://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\
15864# 28bitmap_information_header.29
158650	string		BM
15866>14	leshort		12		PC bitmap, OS/2 1.x format
15867!:mime	image/x-ms-bmp
15868>>18	leshort		x		\b, %d x
15869>>20	leshort		x		%d
15870>14	leshort		64		PC bitmap, OS/2 2.x format
15871!:mime	image/x-ms-bmp
15872>>18	leshort		x		\b, %d x
15873>>20	leshort		x		%d
15874>14	leshort		40		PC bitmap, Windows 3.x format
15875!:mime	image/x-ms-bmp
15876>>18	lelong		x		\b, %d x
15877>>22	lelong		x		%d x
15878>>28	leshort		x		%d
15879>14	leshort		124		PC bitmap, Windows 98/2000 and newer format
15880!:mime	image/x-ms-bmp
15881>>18	lelong		x		\b, %d x
15882>>22	lelong		x		%d x
15883>>28	leshort		x		%d
15884>14	leshort		108		PC bitmap, Windows 95/NT4 and newer format
15885!:mime	image/x-ms-bmp
15886>>18	lelong		x		\b, %d x
15887>>22	lelong		x		%d x
15888>>28	leshort		x		%d
15889>14	leshort		128		PC bitmap, Windows NT/2000 format
15890!:mime	image/x-ms-bmp
15891>>18	lelong		x		\b, %d x
15892>>22	lelong		x		%d x
15893>>28	leshort		x		%d
15894# Too simple - MPi
15895#0	string		IC		PC icon data
15896#0	string		PI		PC pointer image data
15897#0	string		CI		PC color icon data
15898#0	string		CP		PC color pointer image data
15899# Conflicts with other entries [BABYL]
15900#0	string		BA		PC bitmap array data
15901
15902# XPM icons (Greg Roelofs, newt@uchicago.edu)
159030	search/1	/*\ XPM\ */	X pixmap image text
15904!:mime	image/x-xpmi
15905
15906# Utah Raster Toolkit RLE images (janl@ifi.uio.no)
159070	leshort		0xcc52		RLE image data,
15908>6	leshort		x		%d x
15909>8	leshort		x		%d
15910>2	leshort		>0		\b, lower left corner: %d
15911>4	leshort		>0		\b, lower right corner: %d
15912>10	byte&0x1	=0x1		\b, clear first
15913>10	byte&0x2	=0x2		\b, no background
15914>10	byte&0x4	=0x4		\b, alpha channel
15915>10	byte&0x8	=0x8		\b, comment
15916>11	byte		>0		\b, %d color channels
15917>12	byte		>0		\b, %d bits per pixel
15918>13	byte		>0		\b, %d color map channels
15919
15920# image file format (Robert Potter, potter@cs.rochester.edu)
159210	string		Imagefile\ version-	iff image data
15922# this adds the whole header (inc. version number), informative but longish
15923>10	string		>\0		%s
15924
15925# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
159260	belong		0x59a66a95	Sun raster image data
15927>4	belong		>0		\b, %d x
15928>8	belong		>0		%d,
15929>12	belong		>0		%d-bit,
15930#>16	belong		>0		%d bytes long,
15931>20	belong		0		old format,
15932#>20	belong		1		standard,
15933>20	belong		2		compressed,
15934>20	belong		3		RGB,
15935>20	belong		4		TIFF,
15936>20	belong		5		IFF,
15937>20	belong		0xffff		reserved for testing,
15938>24	belong		0		no colormap
15939>24	belong		1		RGB colormap
15940>24	belong		2		raw colormap
15941#>28	belong		>0		colormap is %d bytes long
15942
15943# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
15944#
15945# See
15946#	http://reality.sgi.com/grafica/sgiimage.html
15947#
159480	beshort		474		SGI image data
15949#>2	byte		0		\b, verbatim
15950>2	byte		1		\b, RLE
15951#>3	byte		1		\b, normal precision
15952>3	byte		2		\b, high precision
15953>4	beshort		x		\b, %d-D
15954>6	beshort		x		\b, %d x
15955>8	beshort		x		%d
15956>10	beshort		x		\b, %d channel
15957>10	beshort		!1		\bs
15958>80	string		>0		\b, "%s"
15959
159600	string		IT01		FIT image data
15961>4	belong		x		\b, %d x
15962>8	belong		x		%d x
15963>12	belong		x		%d
15964#
159650	string		IT02		FIT image data
15966>4	belong		x		\b, %d x
15967>8	belong		x		%d x
15968>12	belong		x		%d
15969#
159702048	string		PCD_IPI		Kodak Photo CD image pack file
15971>0xe02	byte&0x03	0x00		, landscape mode
15972>0xe02	byte&0x03	0x01		, portrait mode
15973>0xe02	byte&0x03	0x02		, landscape mode
15974>0xe02	byte&0x03	0x03		, portrait mode
159750	string		PCD_OPA		Kodak Photo CD overview pack file
15976
15977# FITS format.  Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
15978# FITS is the Flexible Image Transport System, the de facto standard for
15979# data and image transfer, storage, etc., for the astronomical community.
15980# (FITS floating point formats are big-endian.)
159810	string	SIMPLE\ \ =	FITS image data
15982!:mime	image/fits
15983!:ext	fits/fts
15984>109	string	8		\b, 8-bit, character or unsigned binary integer
15985>108	string	16		\b, 16-bit, two's complement binary integer
15986>107	string	\ 32		\b, 32-bit, two's complement binary integer
15987>107	string	-32		\b, 32-bit, floating point, single precision
15988>107	string	-64		\b, 64-bit, floating point, double precision
15989
15990# other images
159910	string	This\ is\ a\ BitMap\ file	Lisp Machine bit-array-file
15992
15993# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
15994# stuff.
15995#
159960	beshort		0x1010		PEX Binary Archive
15997
15998# DICOM medical imaging data
15999# URL:		https://en.wikipedia.org/wiki/DICOM#Data_format
16000# Note:		"dcm" is the official file name extension
16001# 		XnView mention also "dc3" and "acr" as file name extension
16002128	string	DICM			DICOM medical imaging data
16003!:mime	application/dicom
16004!:ext dcm/dicom/dic
16005
16006# XWD - X Window Dump file.
16007#   As described in /usr/X11R6/include/X11/XWDFile.h
16008#   used by the xwd program.
16009#   Bradford Castalia, idaeim, 1/01
16010#   updated by Adam Buchbinder, 2/09
16011# The following assumes version 7 of the format; the first long is the length
16012# of the header, which is at least 25 4-byte longs, and the one at offset 8
16013# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth,
16014# which is a maximum of 32.
160150	belong	>100
16016>8	belong	<3
16017>>12	belong	<33
16018>>>4	belong	7			XWD X Window Dump image data
16019!:mime	image/x-xwindowdump
16020>>>>100	string	>\0			\b, "%s"
16021>>>>16	belong	x			\b, %dx
16022>>>>20	belong	x			\b%dx
16023>>>>12	belong	x			\b%d
16024
16025# PDS - Planetary Data System
16026#   These files use Parameter Value Language in the header section.
16027#   Unfortunately, there is no certain magic, but the following
16028#   strings have been found to be most likely.
160290	string	NJPL1I00		PDS (JPL) image data
160302	string	NJPL1I			PDS (JPL) image data
160310	string	CCSD3ZF			PDS (CCSD) image data
160322	string	CCSD3Z			PDS (CCSD) image data
160330	string	PDS_			PDS image data
160340	string	LBLSIZE=		PDS (VICAR) image data
16035
16036# pM8x: ATARI STAD compressed bitmap format
16037#
16038# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001
16039# p M 8 5/6 xx yy zz data...
16040# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed.
16041# bytes either run horizontally (pM85) or vertically (pM86). yy is the
16042# most frequent byte, xx and zz are runlength escape codes, where xx is
16043# used for runs of yy.
16044#
160450	string	pM85		Atari ST STAD bitmap image data (hor)
16046>5	byte	0x00		(white background)
16047>5	byte	0xFF		(black background)
160480	string	pM86		Atari ST STAD bitmap image data (vert)
16049>5	byte	0x00		(white background)
16050>5	byte	0xFF		(black background)
16051
16052# From: Alex Myczko <alex@aiei.ch>
16053# https://www.atarimax.com/jindroush.atari.org/afmtatr.html
160540	leshort	0x0296		Atari ATR image
16055
16056# XXX:
16057# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other
16058# magic.
16059# SGI RICE image file <mpruett@sgi.com>
16060#0	beshort	0x5249		RICE image
16061#>2	beshort	x		v%d
16062#>4	beshort	x		(%d x
16063#>6	beshort	x		%d)
16064#>8	beshort	0		8 bit
16065#>8	beshort	1		10 bit
16066#>8	beshort	2		12 bit
16067#>8	beshort	3		13 bit
16068#>10	beshort	0		4:2:2
16069#>10	beshort	1		4:2:2:4
16070#>10	beshort	2		4:4:4
16071#>10	beshort	3		4:4:4:4
16072#>12	beshort	1		RGB
16073#>12	beshort	2		CCIR601
16074#>12	beshort	3		RP175
16075#>12	beshort	4		YUV
16076
16077# PCX image files
16078# From: Dan Fandrich <dan@coneharvesters.com>
16079# updated by Joerg Jenderek at Feb 2013 by https://de.wikipedia.org/wiki/PCX
16080# https://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
16081# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000
16082# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT
160830	ubelong&0xffF8fe00	0x0a000000
16084# for PCX bit depth > 0
16085>3	ubyte		>0
16086# test for valid versions
16087>>1	ubyte		<6
16088>>>1	ubyte		!1	PCX
16089!:mime	image/x-pcx
16090#!:mime	image/pcx
16091>>>>1	ubyte		0	ver. 2.5 image data
16092>>>>1	ubyte		2	ver. 2.8 image data, with palette
16093>>>>1	ubyte		3	ver. 2.8 image data, without palette
16094>>>>1	ubyte		4	for Windows image data
16095>>>>1	ubyte		5	ver. 3.0 image data
16096>>>>4	uleshort	x	bounding box [%d,
16097>>>>6	uleshort	x	%d] -
16098>>>>8	uleshort	x	[%d,
16099>>>>10	uleshort	x	%d],
16100>>>>65	ubyte		>1	%d planes each of
16101>>>>3	ubyte		x	%d-bit
16102>>>>68	byte		1	colour,
16103>>>>68	byte		2	grayscale,
16104# this should not happen
16105>>>>68	default		x	image,
16106>>>>12	leshort		>0	%d x
16107>>>>>14	uleshort	x	%d dpi,
16108>>>>2	byte		0	uncompressed
16109>>>>2	byte		1	RLE compressed
16110
16111# Adobe Photoshop
16112# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
161130	string		8BPS Adobe Photoshop Image
16114!:mime	image/vnd.adobe.photoshop
16115>4   beshort 2 (PSB)
16116>18  belong  x \b, %d x
16117>14  belong  x %d,
16118>24  beshort 0 bitmap
16119>24  beshort 1 grayscale
16120>>12 beshort 2 with alpha
16121>24  beshort 2 indexed
16122>24  beshort 3 RGB
16123>>12 beshort 4 \bA
16124>24  beshort 4 CMYK
16125>>12 beshort 5 \bA
16126>24  beshort 7 multichannel
16127>24  beshort 8 duotone
16128>24  beshort 9 lab
16129>12  beshort > 1
16130>>12  beshort x \b, %dx
16131>12  beshort 1 \b,
16132>22  beshort x %d-bit channel
16133>12  beshort > 1 \bs
16134
16135# XV thumbnail indicator (ThMO)
161360	string		P7\ 332		XV thumbnail image data
16137
16138# NITF is defined by United States MIL-STD-2500A
161390	string	NITF	National Imagery Transmission Format
16140>25	string	>\0	dated %.14s
16141
16142# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
16143# Format variations from: Bernd Nuernberger <bernd.nuernberger@web.de>
16144# Update: Joerg Jenderek
16145# See http://fileformats.archiveteam.org/wiki/GEM_Raster
16146# For variations, also see:
16147#    https://www.seasip.info/Gem/ff_img.html (Ventura)
16148#    http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT)
16149#    http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT)
16150#    http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG)
161510       beshort     0x0001
16152# header_size
16153>2      beshort     0x0008
16154>>0     use gem_info
16155>2      beshort     0x0009
16156>>0     use gem_info
16157# no example for NOSIG
16158>2      beshort     24
16159>>0     use gem_info
16160# no example for HYPERPAINT
16161>2      beshort     25
16162>>0     use gem_info
1616316      string      XIMG\0
16164>0      use gem_info
16165# no example
1616616      string      STTT\0\x10
16167>0      use gem_info
16168# no example or description
1616916      string      TIMG\0
16170>0      use gem_info
16171
161720   name        gem_info
16173# version is 2 for some XIMG and 1 for all others
16174>0	beshort		<0x0003		GEM
16175# https://www.snowstone.org.uk/riscos/mimeman/mimemap.txt
16176!:mime	image/x-gem
16177# header_size 24 25 27 59 779 words for colored bitmaps
16178>>2	beshort		>9
16179>>>16	string		STTT\0\x10	STTT
16180>>>16	string		TIMG\0		TIMG
16181# HYPERPAINT or NOSIG variant
16182>>>16	string		\0\x80
16183>>>>2	beshort		=24		NOSIG
16184>>>>2	beshort		!24		HYPERPAINT
16185# NOSIG or XIMG variant
16186>>>16	default		x
16187>>>>16	string		!XIMG\0		NOSIG
16188>>16	string		=XIMG\0		XIMG Image data
16189!:ext	img/ximg
16190# to avoid Warning: Current entry does not yet have a description for adding a EXTENSION type
16191>>16	string		!XIMG\0		Image data
16192!:ext	img
16193# header_size is 9 for Ventura files and 8 for other GEM Paint files
16194>>2	beshort		9		(Ventura)
16195#>>2	beshort		8		(Paint)
16196>>12	beshort		x		%d x
16197>>14	beshort		x		%d,
16198# 1 4 8
16199>>4	beshort		x		%d planes,
16200# in tenths of a millimetre
16201>>8	beshort		x		%d x
16202>>10	beshort		x		%d pixelsize
16203# pattern_size 1-8. 2 for GEM Paint
16204>>6	beshort		!2		\b, pattern size %d
16205
16206# GEM Metafile (Wolfram Kleff)
162070	lelong		0x0018FFFF	GEM Metafile data
16208>4	leshort		x		version %d
16209
16210#
16211# SMJPEG. A custom Motion JPEG format used by Loki Entertainment
16212# Software Torbjorn Andersson <d91tan@Update.UU.SE>.
16213#
162140	string	\0\nSMJPEG	SMJPEG
16215>8	belong	x		%d.x data
16216# According to the specification you could find any number of _TXT
16217# headers here, but I can't think of any way of handling that. None of
16218# the SMJPEG files I tried it on used this feature. Even if such a
16219# file is encountered the output should still be reasonable.
16220>16	string	_SND		\b,
16221>>24	beshort	>0		%d Hz
16222>>26	byte	8		8-bit
16223>>26	byte	16		16-bit
16224>>28	string	NONE		uncompressed
16225# >>28	string	APCM		ADPCM compressed
16226>>27	byte	1		mono
16227>>28	byte	2		stereo
16228# Help! Isn't there any way to avoid writing this part twice?
16229>>32	string	_VID		\b,
16230# >>>48	string	JFIF		JPEG
16231>>>40	belong	>0		%d frames
16232>>>44	beshort	>0		(%d x
16233>>>46	beshort	>0		%d)
16234>16	string	_VID		\b,
16235# >>32	string	JFIF		JPEG
16236>>24	belong	>0		%d frames
16237>>28	beshort	>0		(%d x
16238>>30	beshort	>0		%d)
16239
162400	string	Paint\ Shop\ Pro\ Image\ File	Paint Shop Pro Image File
16241
16242# "thumbnail file" (icon)
16243# descended from "xv", but in use by other applications as well (Wolfram Kleff)
162440       string          P7\ 332         XV "thumbnail file" (icon) data
16245
16246# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?)
162470       string          KiSS            KISS/GS
16248>4      byte            16              color
16249>>5     byte            x               %d bit
16250>>8     leshort         x               %d colors
16251>>10    leshort         x               %d groups
16252>4      byte            32              cell
16253>>5     byte            x               %d bit
16254>>8     leshort         x               %d x
16255>>10    leshort         x               %d
16256>>12    leshort         x               +%d
16257>>14    leshort         x               +%d
16258
16259# Webshots (www.webshots.com), by John Harrison
162600       string          C\253\221g\230\0\0\0 Webshots Desktop .wbz file
16261
16262# Hercules DASD image files
16263# From Jan Jaeger <jj@septa.nl>
162640       string  CKD_P370        Hercules CKD DASD image file
16265>8      long    x               \b, %d heads per cylinder
16266>12     long    x               \b, track size %d bytes
16267>16     byte    x               \b, device type 33%2.2X
16268
162690       string  CKD_C370        Hercules compressed CKD DASD image file
16270>8      long    x               \b, %d heads per cylinder
16271>12     long    x               \b, track size %d bytes
16272>16     byte    x               \b, device type 33%2.2X
16273
162740       string  CKD_S370        Hercules CKD DASD shadow file
16275>8      long    x               \b, %d heads per cylinder
16276>12     long    x               \b, track size %d bytes
16277>16     byte    x               \b, device type 33%2.2X
16278
16279# Squeak images and programs - etoffi@softhome.net
162800	string		\146\031\0\0	Squeak image data
162810	search/1	'From\040Squeak	Squeak program text
16282
16283# partimage: file(1) magic for PartImage files (experimental, incomplete)
16284# Author: Hans-Joachim Baader <hjb@pro-linux.de>
162850		string	PaRtImAgE-VoLuMe	PartImage
16286>0x0020		string	0.6.1		file version %s
16287>>0x0060	lelong	>-1		volume %d
16288#>>0x0064 8 byte identifier
16289#>>0x007c reserved
16290>>0x0200	string	>\0		type %s
16291>>0x1400	string	>\0		device %s,
16292>>0x1600	string	>\0		original filename %s,
16293# Some fields omitted
16294>>0x2744	lelong	0		not compressed
16295>>0x2744	lelong	1		gzip compressed
16296>>0x2744	lelong	2		bzip2 compressed
16297>>0x2744	lelong	>2		compressed with unknown algorithm
16298>0x0020		string	>0.6.1		file version %s
16299>0x0020		string	<0.6.1		file version %s
16300
16301# DCX is multi-page PCX, using a simple header of up to 1024
16302# offsets for the respective PCX components.
16303# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de>
163040	lelong	987654321	DCX multi-page PCX image data
16305
16306# Simon Walton <simonw@matteworld.com>
16307# Kodak Cineon format for scanned negatives
16308# http://www.kodak.com/US/en/motion/support/dlad/
163090	lelong  0xd75f2a80	Cineon image data
16310>200	belong  >0		\b, %d x
16311>204	belong  >0		%d
16312
16313
16314# Bio-Rad .PIC is an image format used by microscope control systems
16315# and related image processing software used by biologists.
16316# From: Vebjorn Ljosa <vebjorn@ljosa.com>
16317# BOOL values are two-byte integers; use them to rule out false positives.
16318# https://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt
16319# Samples: https://www.loci.wisc.edu/software/sample-data
1632014	leshort <2
16321>62	leshort <2
16322>>54	leshort 12345		Bio-Rad .PIC Image File
16323>>>0	leshort >0		%d x
16324>>>2	leshort >0		%d,
16325>>>4	leshort =1		1 image in file
16326>>>4	leshort >1		%d images in file
16327
16328# From Jan "Yenya" Kasprzak <kas@fi.muni.cz>
16329# The description of *.mrw format can be found at
16330# http://www.dalibor.cz/minolta/raw_file_format.htm
163310	string	\000MRM			Minolta Dimage camera raw image data
16332
16333# Summary: DjVu image / document
16334# Extension: .djvu
16335# Reference: http://djvu.org/docs/DjVu3Spec.djvu
16336# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr>
16337# Modified by (1): Abel Cheung <abelcheung@gmail.com>
163380	string	AT&TFORM
16339>12	string	DJVM		DjVu multiple page document
16340!:mime	image/vnd.djvu
16341>12	string	DJVU		DjVu image or single page document
16342!:mime	image/vnd.djvu
16343>12	string	DJVI		DjVu shared document
16344!:mime	image/vnd.djvu
16345>12	string	THUM		DjVu page thumbnails
16346!:mime	image/vnd.djvu
16347
16348# Originally by Marc Espie
16349# Modified by Robert Minsk <robertminsk at yahoo.com>
16350# https://www.openexr.com/openexrfilelayout.pdf
163510	lelong		20000630	OpenEXR image data,
16352!:mime image/x-exr
16353>4	lelong&0x000000ff x		version %d,
16354>4	lelong		^0x00000200	storage: scanline
16355>4	lelong		&0x00000200	storage: tiled
16356>8	search/0x1000	compression\0	\b, compression:
16357>>&16	byte		0		none
16358>>&16	byte		1		rle
16359>>&16	byte		2		zips
16360>>&16	byte		3		zip
16361>>&16	byte		4		piz
16362>>&16	byte		5		pxr24
16363>>&16	byte		6		b44
16364>>&16	byte		7		b44a
16365>>&16	byte		8		dwaa
16366>>&16	byte		9		dwab
16367>>&16	byte		>9		unknown
16368>8	 search/0x1000	dataWindow\0	\b, dataWindow:
16369>>&10	lelong		x		(%d
16370>>&14	lelong		x		%d)-
16371>>&18	lelong		x		\b(%d
16372>>&22	lelong		x		%d)
16373>8	search/0x1000	displayWindow\0	\b, displayWindow:
16374>>&10	lelong		x		(%d
16375>>&14	lelong		x		%d)-
16376>>&18	lelong		x		\b(%d
16377>>&22	lelong		x		%d)
16378>8	search/0x1000	lineOrder\0	 \b, lineOrder:
16379>>&14	byte		0		increasing y
16380>>&14	byte		1		decreasing y
16381>>&14	byte		2		random y
16382>>&14	byte		>2		unknown
16383
16384# SMPTE Digital Picture Exchange Format, SMPTE DPX
16385#
16386# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital
16387# Moving-Picture Exchange (DPX), v1.0, 18 February 1994
16388# Robert Minsk <robertminsk at yahoo.com>
16389# Modified by Harry Mallon <hjmallon at gmail.com>
163900	string		SDPX	DPX image data, big-endian,
16391!:mime image/x-dpx
16392>0	use		dpx_info
163930	string		XPDS	DPX image data, little-endian,
16394!:mime image/x-dpx
16395>0	use		\^dpx_info
16396
163970	name		dpx_info
16398>768	beshort		<4
16399>>772	belong		x	%dx
16400>>776	belong		x	\b%d,
16401>768	beshort		>3
16402>>776	belong		x	%dx
16403>>772	belong		x	\b%d,
16404>768	beshort		0	left to right/top to bottom
16405>768	beshort		1	right to left/top to bottom
16406>768	beshort		2	left to right/bottom to top
16407>768	beshort		3	right to left/bottom to top
16408>768	beshort		4	top to bottom/left to right
16409>768	beshort		5	top to bottom/right to left
16410>768	beshort		6	bottom to top/left to right
16411>768	beshort		7	bottom to top/right to left
16412
16413# From: Tom Hilinski <tom.hilinski@comcast.net>
16414# https://www.unidata.ucar.edu/packages/netcdf/
164150	string	CDF\001			NetCDF Data Format data
16416
16417#-----------------------------------------------------------------------
16418# Hierarchical Data Format, used to facilitate scientific data exchange
16419# specifications at http://hdf.ncsa.uiuc.edu/
164200	belong	0x0e031301	Hierarchical Data Format (version 4) data
16421!:mime	application/x-hdf
164220	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) data
16423!:mime	application/x-hdf
16424512	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 512 bytes user block
16425!:mime	application/x-hdf
164261024	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 1k user block
16427!:mime	application/x-hdf
164282048	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 2k user block
16429!:mime	application/x-hdf
164304096	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 4k user block
16431!:mime	application/x-hdf
16432
16433
16434# From: Tobias Burnus <burnus@net-b.de>
16435# Xara (for a while: Corel Xara) is a graphic package, see
16436# http://www.xara.com/ for Windows and as GPL application for Linux
164370	string	XARA\243\243	Xara graphics file
16438
16439# https://www.cartesianinc.com/Tech/
164400	string	CPC\262		Cartesian Perceptual Compression image
16441!:mime	image/x-cpi
16442
16443# From Albert Cahalan <acahalan@gmail.com>
16444# puredigital used it for the CVS disposable camcorder
16445#8       lelong  4       ZBM bitmap image data
16446#>4      leshort x       %u x
16447#>6      leshort x       %u
16448
16449# From Albert Cahalan <acahalan@gmail.com>
16450# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons
164510       string C565     OLPC firmware icon image data
16452>4      leshort x       %u x
16453>6      leshort x       %u
16454
16455# Applied Images - Image files from Cytovision
16456# Gustavo Junior Alves <gjalves@gjalves.com.br>
164570	string	\xce\xda\xde\xfa	Cytovision Metaphases file
164580	string	\xed\xad\xef\xac	Cytovision Karyotype file
164590	string	\x0b\x00\x03\x00	Cytovision FISH Probe file
164600	string	\xed\xfe\xda\xbe	Cytovision FLEX file
164610	string	\xed\xab\xed\xfe	Cytovision FLEX file
164620	string	\xad\xfd\xea\xad	Cytovision RATS file
16463
16464# Wavelet Scalar Quantization format used in gray-scale fingerprint images
16465# From Tano M Fotang <mfotang@quanteq.com>
164660	string	\xff\xa0\xff\xa8\x00	Wavelet Scalar Quantization image data
16467
16468# Type:		PCO B16 image files
16469# URL:		http://www.pco.de/fileadmin/user_upload/db/download/MA_CWDCOPIE_0412b.pdf
16470# From:		Florian Philipp <florian.philipp@binarywings.net>
16471# Extension:	.b16
16472# Description:	Pixel image format produced by PCO Camware, typically used
16473#		together with PCO cameras.
16474# Note:		Different versions exist for e.g. 8 bit and 16 bit images.
16475#		Documentation is incomplete.
164760	string/b	PCO-	PCO B16 image data
16477>12	lelong		x	\b, %dx
16478>16	lelong		x	\b%d
16479>20	lelong		0	\b, short header
16480>20	lelong		-1	\b, extended header
16481>>24	lelong		0	\b, grayscale
16482>>>36	lelong		0	linear LUT
16483>>>36	lelong		1	logarithmic LUT
16484>>>28	lelong		x	[%d
16485>>>32	lelong		x	\b,%d]
16486>>24	lelong		1	\b, color
16487>>>64	lelong		0	linear LUT
16488>>>64	lelong		1	logarithmic LUT
16489>>>40	lelong		x	r[%d
16490>>>44	lelong		x	\b,%d]
16491>>>48	lelong		x	g[%d
16492>>>52	lelong		x	\b,%d]
16493>>>56	lelong		x	b[%d
16494>>>60	lelong		x	\b,%d]
16495
16496# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches
16497# From: Markus Heidelberg <markus.heidelberg at web.de>
164980	string/t	[BitmapInfo2]	Polar Monitor Bitmap text
16499!:mime	image/x-polar-monitor-bitmap
16500
16501# From: Rick Richardson <rickrich@gmail.com>
16502# updated by: Joerg Jenderek
16503# URL: http://techmods.net/nuvi/
165040	string	GARMIN\ BITMAP\ 01	Garmin Bitmap file
16505# extension is also used for
16506# Sony SRF raw image (image/x-sony-srf)
16507# SRF map
16508# Terragen Surface Map (https://www.planetside.co.uk/terragen)
16509# FileLocator Pro search criteria file (https://www.mythicsoft.com/filelocatorpro)
16510!:ext srf
16511#!:mime	image/x-garmin-srf
16512# version 1.00,2.00,2.10,2.40,2.50
16513>0x2f	string		>0		\b, version %4.4s
16514# width (2880,2881,3240)
16515>0x55	uleshort	>0		\b, %dx
16516# height (80,90)
16517>>0x53	uleshort	x		\b%d
16518
16519# Type:	Ulead Photo Explorer5 (.pe5)
16520# URL:	http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese)
16521# From:	Simon Horman <horms@debian.org>
165220	string	IIO2H			Ulead Photo Explorer5
16523
16524# Type:	X11 cursor
16525# URL:	http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup
16526# From:	Mathias Brodala <info@noctus.net>
165270	string	Xcur			X11 cursor
16528
16529# Type:	Olympus ORF raw images.
16530# URL:	https://libopenraw.freedesktop.org/wiki/Olympus_ORF
16531# From:	Adam Buchbinder <adam.buchbinder@gmail.com>
165320	string		MMOR		Olympus ORF raw image data, big-endian
16533!:mime	image/x-olympus-orf
165340	string		IIRO		Olympus ORF raw image data, little-endian
16535!:mime	image/x-olympus-orf
165360	string		IIRS		Olympus ORF raw image data, little-endian
16537!:mime	image/x-olympus-orf
16538
16539# Type: files used in modern AVCHD camcoders to store clip information
16540# Extension: .cpi
16541# From: Alexander Danilov <alexander.a.danilov@gmail.com>
165420	string	HDMV0100	AVCHD Clip Information
16543
16544# From: Adam Buchbinder <adam.buchbinder@gmail.com>
16545# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/
16546# Radiance HDR; usually has .pic or .hdr extension.
165470	string	#?RADIANCE\n	Radiance HDR image data
16548#!mime	image/vnd.radiance
16549
16550# From: Adam Buchbinder <adam.buchbinder@gmail.com>
16551# URL: https://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf
16552# Used by the pfstools packages. The regex matches for the image size could
16553# probably use some work. The MIME type is made up; if there's one in
16554# actual common use, it should replace the one below.
165550	string	PFS1\x0a	PFS HDR image data
16556#!mime	image/x-pfs
16557>1	regex	[0-9]*\ 		\b, %s
16558>>1	regex	\ [0-9]{4}		\bx%s
16559
16560# Type: Foveon X3F
16561# URL:  https://www.photofo.com/downloads/x3f-raw-format.pdf
16562# From: Adam Buchbinder <adam.buchbinder@gmail.com>
16563# Note that the MIME type isn't defined anywhere that I can find; if
16564# there's a canonical type for this format, it should replace this one.
165650	string	FOVb	Foveon X3F raw image data
16566!:mime	image/x-x3f
16567>6	leshort	x	\b, version %d.
16568>4	leshort	x	\b%d
16569>28	lelong	x	\b, %dx
16570>32	lelong	x	\b%d
16571
16572# Paint.NET file
16573# From Adam Buchbinder <adam.buchbinder@gmail.com>
165740	string	PDN3	Paint.NET image data
16575!:mime	image/x-paintnet
16576
16577# Not really an image.
16578# From: "Tano M. Fotang" <mfotang@quanteq.com>
165790	string	\x46\x4d\x52\x00	ISO/IEC 19794-2 Format Minutiae Record (FMR)
16580
16581# doc: https://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip
16582# example: https://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip
1658390	bequad		0x574D50484F544F00	JPEG-XR Image
16584>98	byte&0x08	=0x08			\b, hard tiling
16585>99	byte&0x80	=0x80			\b, tiling present
16586>99	byte&0x40	=0x40			\b, codestream present
16587>99	byte&0x38	x			\b, spatial xform=
16588>99	byte&0x38	0x00			\bTL
16589>99	byte&0x38	0x08			\bBL
16590>99	byte&0x38	0x10			\bTR
16591>99	byte&0x38	0x18			\bBR
16592>99	byte&0x38	0x20			\bBT
16593>99	byte&0x38	0x28			\bRB
16594>99	byte&0x38	0x30			\bLT
16595>99	byte&0x38	0x38			\bLB
16596>100	byte&0x80	=0x80			\b, short header
16597>>102	beshort+1	x			\b, %d
16598>>104	beshort+1	x			\bx%d
16599>100	byte&0x80	=0x00			\b, long header
16600>>102	belong+1	x			\b, %x
16601>>106	belong+1	x			\bx%x
16602>101	beshort&0xf	x			\b, bitdepth=
16603>>101	beshort&0xf	0x0			\b1-WHITE=1
16604>>101	beshort&0xf	0x1			\b8
16605>>101	beshort&0xf	0x2			\b16
16606>>101	beshort&0xf	0x3			\b16-SIGNED
16607>>101	beshort&0xf	0x4			\b16-FLOAT
16608>>101	beshort&0xf	0x5			\b(reserved 5)
16609>>101	beshort&0xf	0x6			\b32-SIGNED
16610>>101	beshort&0xf	0x7			\b32-FLOAT
16611>>101	beshort&0xf	0x8			\b5
16612>>101	beshort&0xf	0x9			\b10
16613>>101	beshort&0xf	0xa			\b5-6-5
16614>>101	beshort&0xf	0xb			\b(reserved %d)
16615>>101	beshort&0xf	0xc			\b(reserved %d)
16616>>101	beshort&0xf	0xd			\b(reserved %d)
16617>>101	beshort&0xf	0xe			\b(reserved %d)
16618>>101	beshort&0xf	0xf			\b1-BLACK=1
16619>101	beshort&0xf0	x			\b, colorfmt=
16620>>101	beshort&0xf0	0x00			\bYONLY
16621>>101	beshort&0xf0	0x10			\bYUV240
16622>>101	beshort&0xf0	0x20			\bYWV422
16623>>101	beshort&0xf0	0x30			\bYWV444
16624>>101	beshort&0xf0	0x40			\bCMYK
16625>>101	beshort&0xf0	0x50			\bCMYKDIRECT
16626>>101	beshort&0xf0	0x60			\bNCOMPONENT
16627>>101	beshort&0xf0	0x70			\bRGB
16628>>101	beshort&0xf0	0x80			\bRGBE
16629>>101	beshort&0xf0	>0x80			\b(reserved 0x%x)
16630
16631# From: Johan van der Knijff <johan.vanderknijff@kb.nl>
16632#
16633# BPG (Better Portable Graphics) format
16634# https://bellard.org/bpg/
16635# http://fileformats.archiveteam.org/wiki/BPG
16636#
166370	string	\x42\x50\x47\xFB	BPG (Better Portable Graphics)
16638!:mime  image/bpg
16639
16640# From: Joerg Jenderek
16641# URL: https://en.wikipedia.org/wiki/Apple_Icon_Image_format
166420	string		icns		Mac OS X icon
16643!:mime	image/x-icns
16644!:apple	????icns
16645!:ext icns
16646>4	ubelong		>0
16647# file size
16648>>4	ubelong		x		\b, %d bytes
16649# icon type
16650>>8	string		x		\b, "%4.4s" type
16651
16652# TIM images
166530		lelong		0x00000010	TIM image,
16654>4		lelong  	0x8		4-Bit,
16655>4		lelong  	0x9		8-Bit,
16656>4		lelong  	0x2		15-Bit,
16657>4		lelong  	0x3		24-Bit,
16658>4		lelong 		&8
16659>>(8.l+12)	leshort		x		Pixel at (%d,
16660>>(8.l+14)	leshort		x		\b%d)
16661>>(8.l+16)	leshort		x		Size=%dx
16662>>(8.l+18)	leshort		x		\b%d,
16663>>4		lelong 		0x8		16 CLUT Entries at
16664>>4		lelong 		0x9		256 CLUT Entries at
16665>>12		leshort		x		(%d,
16666>>14		leshort		x		\b%d)
16667>4		lelong		^8
16668>>12		leshort		x		Pixel at (%d,
16669>>14		leshort		x		\b%d)
16670>>16		leshort		x		Size=%dx
16671>>18		leshort		x		\b%d
16672
16673# MDEC streams
166740		lelong		0x80010160	MDEC video stream,
16675>16		leshort		x		%dx
16676>18		leshort		x		\b%d
16677#>8		lelong		x		%d frames
16678#>4		leshort		x		secCount=%d;
16679#>6		leshort		x		nSectors=%d;
16680#>12		lelong		x		frameSize=%d;
16681
16682# BS encoded bitstreams
166832		leshort		0x3800		BS image,
16684>6		leshort		x		Version %d,
16685>4		leshort		x		Quantization %d,
16686>0		leshort		x		(Decompresses to %d words)
16687
16688# Type: farbfeld image.
16689# Url: http://tools.suckless.org/farbfeld/
16690# From: Ian D. Scott <ian@iandouglasscott.com>
16691#
166920		string		farbfeld	farbfeld image data,
16693>8		ubelong		x		%dx
16694>12		ubelong		x		\b%d
16695
16696# Type: Microsoft DirectDraw Surface (common data)
16697# URL:	https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
16698# From: Morten Hustveit <morten@debian.org>
16699# Updated by: David Korth <gerbilsoft@gerbilsoft.com>
167000	name	ms-directdraw-surface
16701>0x10	ulelong	x			%u x
16702>0x0C	ulelong	x			%u
16703# Color depth.
16704>0x58	ulelong	>0			\b, %u-bit color
16705# Determine the pixel format.
16706>0x50	ulelong&0x4	4
16707# FIXME: Handle DX10 and XBOX formats.
16708>>0x54	string	x			\b, compressed using %.4s
16709>0x50	ulelong&0x2	0x2		\b, alpha only
16710>0x50	ulelong&0x200	0x200		\b, YUV
16711>0x50	ulelong&0x20000	0x20000		\b, luminance
16712# RGB pixel format
16713>0x50	ulelong&0x40	0x40
16714
16715# Determine the RGB format using the color masks.
16716# ulequad order: 0xGGGGGGGGRRRRRRRR, 0xAAAAAAAABBBBBBBB
16717
16718>>0x58		ulelong	16
16719
16720# NOTE: 15-bit color formats usually have 16-bit listed as the color depth.
16721>>>0x5C		ulequad	0x000003E000007C00
16722>>>>0x64	ulequad 0x000000000000001F	\b, RGB555
16723>>>0x5C		ulequad	0x000003E000001F00
16724>>>>0x64	ulequad 0x000000000000007C	\b, BGR555
16725
16726>>>0x5C		ulequad	0x000007E00000F800
16727>>>>0x64	ulequad 0x000000000000001F	\b, RGB565
16728>>>0x5C		ulequad	0x000007E000001F00
16729>>>>0x64	ulequad 0x00000000000000F8	\b, BGR565
16730
16731>>>0x5C		ulequad	0x000000F000000F00
16732>>>>0x64	ulequad 0x0000F0000000000F	\b, ARGB4444
16733>>>0x5C		ulequad	0x000000F00000000F
16734>>>>0x64	ulequad 0x0000F00000000F00	\b, ABGR4444
16735
16736>>>0x5C		ulequad	0x00000F000000F000
16737>>>>0x64	ulequad 0x0000000F000000F0	\b, RGBA4444
16738>>>0x5C		ulequad	0x00000F00000000F0
16739>>>>0x64	ulequad 0x0000000F0000F000	\b, BGRA4444
16740
16741>>>0x5C		ulequad	0x000000F000000F00
16742>>>>0x64	ulequad 0x000000000000000F	\b, xRGB4444
16743>>>0x5C		ulequad	0x000000F00000000F
16744>>>>0x64	ulequad 0x0000000000000F00	\b, xBGR4444
16745
16746>>>0x5C		ulequad	0x00000F000000F000
16747>>>>0x64	ulequad 0x00000000000000F0	\b, RGBx4444
16748>>>0x5C		ulequad	0x00000F00000000F0
16749>>>>0x64	ulequad 0x000000000000F000	\b, BGRx4444
16750
16751>>>0x5C		ulequad	0x000003E000007C00
16752>>>>0x64	ulequad 0x000080000000001F	\b, ARGB1555
16753>>>0x5C		ulequad	0x000003E000001F00
16754>>>>0x64	ulequad 0x000080000000007C	\b, ABGR1555
16755>>>0x5C		ulequad	0x000007C00000F800
16756>>>>0x64	ulequad 0x000000010000003E	\b, RGBA5551
16757>>>0x5C		ulequad	0x000007C00000003E
16758>>>>0x64	ulequad 0x000000010000F800	\b, BGRA5551
16759
16760>>88		ulelong 24
16761>>>0x5C		ulequad	0x0000FF0000FF0000
16762>>>>0x64	ulequad 0x00000000000000FF	\b, RGB888
16763>>>0x5C		ulequad	0x0000FF00000000FF
16764>>>>0x64	ulequad 0x0000000000FF0000	\b, BGR888
16765
16766>>88		ulelong 32
16767>>>0x5C		ulequad	0x0000FF0000FF0000
16768>>>>0x64	ulequad 0xFF000000000000FF	\b, ARGB8888
16769>>>0x5C		ulequad	0x0000FF00000000FF
16770>>>>0x64	ulequad 0xFF00000000FF0000	\b, ABGR8888
16771
16772>>>0x5C		ulequad	0x00FF0000FF000000
16773>>>>0x64	ulequad 0x000000FF0000FF00	\b, RGBA8888
16774>>>0x5C		ulequad	0x00FF00000000FF00
16775>>>>0x64	ulequad 0x000000FFFF000000	\b, BGBA8888
16776
16777>>>0x5C		ulequad	0x0000FF0000FF0000
16778>>>>0x64	ulequad 0x00000000000000FF	\b, xRGB8888
16779>>>0x5C		ulequad	0x0000FF00000000FF
16780>>>>0x64	ulequad 0x0000000000FF0000	\b, xBGR8888
16781
16782>>>0x5C		ulequad	0x00FF0000FF000000
16783>>>>0x64	ulequad 0x000000000000FF00	\b, RGBx8888
16784>>>0x5C		ulequad	0x00FF00000000FF00
16785>>>>0x64	ulequad 0x00000000FF000000	\b, BGBx8888
16786
16787# Less common 32-bit color formats.
16788>>>0x5C		ulequad	0xFFFF00000000FFFF
16789>>>>0x64	ulequad 0x0000000000000000	\b, G16R16
16790>>>0x5C		ulequad	0x0000FFFFFFFF0000
16791>>>>0x64	ulequad 0x0000000000000000	\b, R16G16
16792
16793>>>0x5C		ulequad	0x000FFC003FF00000
16794>>>>0x64	ulequad 0xC0000000000003FF	\b, A2R10G10B10
16795>>>0x5C		ulequad	0x000FFC00000003FF
16796>>>>0x64	ulequad 0xC00000003FF00000	\b, A2B10G10R10
16797
16798# Type: Microsoft DirectDraw Surface
16799# URL:	https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
16800# From: Morten Hustveit <morten@debian.org>
16801# Updated by: David Korth <gerbilsoft@gerbilsoft.com>
168020	string/b	DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS):
16803>0	use	ms-directdraw-surface
16804
16805# Type: Sega PVR image.
16806# From: David Korth <gerbilsoft@gerbilsoft.com>
16807# References:
16808# - https://fabiensanglard.net/Mykaruga/tools/segaPVRFormat.txt
16809# - https://github.com/yazgoo/pvrx2png
16810# - https://github.com/nickworonekin/puyotools
16811
16812# Sega PVR header.
168130	name	sega-pvr-image-header
16814>0x0C	leshort	x	%u x
16815>0x0E	leshort	x	%u
16816# Image format.
16817>0x08	byte	0	\b, ARGB1555
16818>0x08	byte	1	\b, RGB565
16819>0x08	byte	2	\b, ARGB4444
16820>0x08	byte	3	\b, YUV442
16821>0x08	byte	4	\b, Bump
16822>0x08	byte	5	\b, 4bpp
16823>0x08	byte	6	\b, 8bpp
16824# Image data type.
16825>0x09	byte	0x01	\b, square twiddled
16826>0x09	byte	0x02	\b, square twiddled & mipmap
16827>0x09	byte	0x03	\b, VQ
16828>0x09	byte	0x04	\b, VQ & mipmap
16829>0x09	byte	0x05	\b, 8-bit CLUT twiddled
16830>0x09	byte	0x06	\b, 4-bit CLUT twiddled
16831>0x09	byte	0x07	\b, 8-bit direct twiddled
16832>0x09	byte	0x08	\b, 4-bit direct twiddled
16833>0x09	byte	0x09	\b, rectangle
16834>0x09	byte	0x0B	\b, rectangular stride
16835>0x09	byte	0x0D	\b, rectangular twiddled
16836>0x09	byte	0x10	\b, small VQ
16837>0x09	byte	0x11	\b, small VQ & mipmap
16838>0x09	byte	0x12	\b, square twiddled & mipmap
16839
16840# Sega PVR image.
168410	string	PVRT
16842>0x10	string	DDS\040\174\000\000\000 Sega PVR (Xbox) image:
16843>>0x20	use	ms-directdraw-surface
16844>0x10	belong	!0x44445320		Sega PVR image:
16845>>0	use	sega-pvr-image-header
16846
16847# Sega PVR image with GBIX.
168480	string	GBIX
16849>0x10	string	PVRT
16850>>0x10	string	DDS\040\174\000\000\000 Sega PVR (Xbox) image:
16851>>>0x20	use	ms-directdraw-surface
16852>>0x10	belong	!0x44445320		Sega PVR image:
16853>>>0x10	use	sega-pvr-image-header
16854>>0x08	lelong	x	\b, global index = %u
16855
16856# Sega GVR header.
168570	name	sega-gvr-image-header
16858>0x0C	beshort	x	%u x
16859>0x0E	beshort	x	%u
16860# Image data format.
16861>0x0B	byte	0	\b, I4
16862>0x0B	byte	1	\b, I8
16863>0x0B	byte	2	\b, IA4
16864>0x0B	byte	3	\b, IA8
16865>0x0B	byte	4	\b, RGB565
16866>0x0B	byte	5	\b, RGB5A3
16867>0x0B	byte	6	\b, ARGB8888
16868>0x0B	byte	8	\b, CI4
16869>0x0B	byte	9	\b, CI8
16870>0x0B	byte	14	\b, DXT1
16871
16872# Sega GVR image.
168730	string	GVRT	Sega GVR image:
16874>0x10	use	sega-gvr-image-header
16875
16876# Sega GVR image with GBIX.
168770	string	GBIX
16878>0x10	string	GVRT	Sega GVR image:
16879>>0x10	use	sega-gvr-image-header
16880>>0x08	belong	x	\b, global index = %u
16881
16882# Sega GVR image with GCIX. (Wii)
168830	string	GCIX
16884>0x10	string	GVRT	Sega GVR image:
16885>>0x10	use	sega-gvr-image-header
16886>>0x08	belong	x	\b, global index = %u
16887
16888# Light Field Picture
16889# Documentation: http://optics.miloush.net/lytro/TheFileFormat.aspx
16890# Typical file extensions: .lfp .lfr .lfx
16891
168920	belong	0x894C4650
16893>4	belong	0x0D0A1A0A
16894>12	belong	0x00000000	Lytro Light Field Picture
16895>8	belong	x		\b, version %d
16896
16897# Type: Vision Research Phantom CINE Format
16898# URL: https://www.phantomhighspeed.com/
16899# URL2: http://phantomhighspeed.force.com/vriknowledge/servlet/fileField?id=0BEU0000000Cfyk
16900# From: Harry Mallon <hjmallon at gmail.com>
16901#
16902# This has a short "CI" code but the 44 is the size of the struct which is
16903# stable
169040	string	CI
16905>2	leshort 44		Vision Research CINE Video,
16906>>4	leshort	0		Grayscale,
16907>>4	leshort 1		JPEG Compressed,
16908>>4	leshort 2		RAW,
16909>>6	leshort x		version %d,
16910>>20	lelong	x		%d frames,
16911>>48	lelong	x		%dx
16912>>52	lelong	x		\b%d
16913
16914# Type: ARRI Raw Image
16915# Info: SMPTE RDD30:2014
16916# From: Harry Mallon <hjmallon at gmail.com>
169170	string ARRI		ARRI ARI image data,
16918>4	lelong 0x78563412	little-endian,
16919>4 	lelong 0x12345678	big-endian,
16920>12	lelong x		version %d,
16921>20	lelong x 		%dx
16922>24	lelong x		\b%d
16923
16924# Type: Khronos KTX texture.
16925# From: David Korth <gerbilsoft@gerbilsoft.com>
16926# References:
16927# - https://www.khronos.org/opengles/sdk/tools/KTX/file_format_spec/
16928
16929# glEnum decoding.
16930# NOTE: Only the most common formats are listed here.
169310	name	khronos-ktx-glEnum
16932>0	lelong	0x1907	\b, RGB
16933>0	lelong	0x1908	\b, RGBA
16934>0	lelong	0x1909	\b, LUMINANCE
16935>0	lelong	0x190A	\b, LUMINANCE_ALPHA
16936>0	lelong	0x80E1	\b, BGR
16937>0	lelong	0x80E2	\b, BGRA
16938>0	lelong	0x83A0	\b, RGB_S3TC
16939>0	lelong	0x83A1	\b, RGB4_S3TC
16940>0	lelong	0x83A2	\b, RGBA_S3TC
16941>0	lelong	0x83A3	\b, RGBA4_S3TC
16942>0	lelong	0x83A4	\b, RGBA_DXT5_S3TC
16943>0	lelong	0x83A5	\b, RGBA4_DXT5_S3TC
16944>0	lelong	0x8D64	\b, ETC1_RGB8_OES
16945>0	lelong	0x9270	\b, COMPRESSED_R11_EAC
16946>0	lelong	0x9271	\b, COMPRESSED_SIGNED_R11_EAC
16947>0	lelong	0x9272	\b, COMPRESSED_RG11_EAC
16948>0	lelong	0x9273	\b, COMPRESSED_SIGNED_RG11_EAC
16949>0	lelong	0x9274	\b, COMPRESSED_RGB8_ETC2
16950>0	lelong	0x9275	\b, COMPRESSED_SRGB8_ETC2
16951>0	lelong	0x9276	\b, COMPRESSED_RGB8_PUNCHTHROUGH_ALPHA1_ETC2
16952>0	lelong	0x9277	\b, COMPRESSED_SRGB8_PUNCHTHROUGH_ALPHA1_ETC2
16953>0	lelong	0x9278	\b, COMPRESSED_RGBA2_ETC2_EAC
16954>0	lelong	0x9279	\b, COMPRESSED_SRGB8_ALPHA8_ETC2_EAC
16955>0	lelong	0x93B0	\b, COMPRESSED_RGBA_ASTC_4x4_KHR
16956>0	lelong	0x93B1	\b, COMPRESSED_RGBA_ASTC_5x4_KHR
16957>0	lelong	0x93B2	\b, COMPRESSED_RGBA_ASTC_5x5_KHR
16958>0	lelong	0x93B3	\b, COMPRESSED_RGBA_ASTC_6x5_KHR
16959>0	lelong	0x93B4	\b, COMPRESSED_RGBA_ASTC_6x6_KHR
16960>0	lelong	0x93B5	\b, COMPRESSED_RGBA_ASTC_8x5_KHR
16961>0	lelong	0x93B6	\b, COMPRESSED_RGBA_ASTC_8x6_KHR
16962>0	lelong	0x93B7	\b, COMPRESSED_RGBA_ASTC_8x8_KHR
16963>0	lelong	0x93B8	\b, COMPRESSED_RGBA_ASTC_10x5_KHR
16964>0	lelong	0x93B9	\b, COMPRESSED_RGBA_ASTC_10x6_KHR
16965>0	lelong	0x93BA	\b, COMPRESSED_RGBA_ASTC_10x8_KHR
16966>0	lelong	0x93BB	\b, COMPRESSED_RGBA_ASTC_10x10_KHR
16967>0	lelong	0x93BC	\b, COMPRESSED_RGBA_ASTC_12x10_KHR
16968>0	lelong	0x93BD	\b, COMPRESSED_RGBA_ASTC_12x12_KHR
16969>0	lelong	0x93D0	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_4x4_KHR
16970>0	lelong	0x93D1	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x4_KHR
16971>0	lelong	0x93D2	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x5_KHR
16972>0	lelong	0x93D3	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x5_KHR
16973>0	lelong	0x93D4	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x6_KHR
16974>0	lelong	0x93D5	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x5_KHR
16975>0	lelong	0x93D6	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x6_KHR
16976>0	lelong	0x93D7	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x8_KHR
16977>0	lelong	0x93D8	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x5_KHR
16978>0	lelong	0x93D9	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x6_KHR
16979>0	lelong	0x93DA	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x8_KHR
16980>0	lelong	0x93DB	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x10_KHR
16981>0	lelong	0x93DC	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x10_KHR
16982>0	lelong	0x93DD	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x12_KHR
16983
16984# Endian-specific KTX header.
16985# TODO: glType (all textures I've seen so far are GL_UNSIGNED_BYTE)
169860	name	khronos-ktx-endian-header
16987>20	lelong	x	\b, %u
16988>24	lelong	>1	x %u
16989>28	lelong	>1	x %u
16990>8	lelong	>0
16991>>8	use	khronos-ktx-glEnum
16992>8	lelong	0
16993>>12	use	khronos-ktx-glEnum
16994
16995# Main KTX header.
16996# Determine endianness, then check the rest of the header.
169970	string	\xABKTX\ 11\xBB\r\n\x1A\n	Khronos KTX texture
16998>12	lelong	0x04030201			(little-endian)
16999>>16	use	khronos-ktx-endian-header
17000>12	belong	0x04030201			(big-endian)
17001>>16	use	\^khronos-ktx-endian-header
17002
17003# Type: Valve VTF texture.
17004# From: David Korth <gerbilsoft@gerbilsoft.com>
17005# References:
17006# - https://developer.valvesoftware.com/wiki/Valve_Texture_Format
17007
17008# VTF image formats.
170090	name	vtf-image-format
17010>0	lelong	0	RGBA8888
17011>0	lelong	1	ABGR8888
17012>0	lelong	2	RGB888
17013>0	lelong	3	BGR888
17014>0	lelong	4	RGB565
17015>0	lelong	5	I8
17016>0	lelong	6	IA88
17017>0	lelong	7	P8
17018>0	lelong	8	A8
17019>0	lelong	9	RGB888 (bluescreen)
17020>0	lelong	10	BGR888 (bluescreen)
17021>0	lelong	11	ARGB8888
17022>0	lelong	12	BGRA8888
17023>0	lelong	13	DXT1
17024>0	lelong	14	DXT3
17025>0	lelong	15	DXT5
17026>0	lelong	16	BGRx8888
17027>0	lelong	17	BGR565
17028>0	lelong	18	BGRx5551
17029>0	lelong	19	BGRA4444
17030>0	lelong	20	DXT1+A1
17031>0	lelong	21	BGRA5551
17032>0	lelong	22	UV88
17033>0	lelong	23	UVWQ8888
17034>0	lelong	24	RGBA16161616F
17035>0	lelong	25	RGBA16161616
17036>0	lelong	26	UVLX8888
17037
17038# Main VTF header.
170390	string	VTF\0				Valve Texture Format
17040>4	lelong	x				v%u
17041>8	lelong	x				\b.%u
17042>0x10	leshort	x				\b, %u
17043>0x12	leshort	>1				x %u
17044>4	lequad	0x0000000700000002
17045>>0x3F	leshort	>1				x %u
17046>0x18	leshort	>1				\b, %u frames
17047>0x38	byte	x				\b, mipmaps: %u
17048>0x34	lelong	>-1				\b,
17049>>0x34	use	vtf-image-format
17050
17051# Type: Valve VTF3 (PS3) texture.
17052# From: David Korth <gerbilsoft@gerbilsoft.com>
170530	string		VTF3	Valve Texture Format (PS3)
17054>0x14	beshort		x	\b, %u
17055>0x16	beshort		x	\b x %u
17056>0x10	belong&0x2000	0	\b, DXT1
17057>0x10	belong&0x2000	0x2000	\b, DXT5
17058
17059# Type: ASTC texture.
17060# From: David Korth <gerbilsoft@gerbilsoft.com>
17061# References:
17062# - https://stackoverflow.com/questions/22600678/determine-internal-format-of-given-astc-compressed-image-through-its-header
17063# - https://stackoverflow.com/a/22682244
170640	lelong	0x5ca1ab13			ASTC
17065>4	byte	x				%u
17066>5	byte	x				\bx%u
17067>6	byte	>1				\bx%u
17068# X, Y, and Z dimensions are stored as 24-bit LE.
17069# Pretend it's 32-bit and mask off the high byte.
17070>7	lelong&0x00FFFFFF	x		texture, %u
17071>10	lelong&0x00FFFFFF	x		x %u
17072>13	lelong&0x00FFFFFF	>1		x %u
17073
17074# Zebra Metafile graphic
17075# http://www.fileformat.info/format/zbr/egff.htm
170760	beshort	0x9a02	Zebra Metafile graphic
17077>2	leshort 1	(version 1.x)
17078>2	leshort	2	(version 1.1x or 1.2x)
17079>2	leshort	3	(version 1.49)
17080>2	leshort	4	(version 1.50)
17081>4	string	x	(comment = %s)
17082
17083# Microsoft Paint graphic
17084# http://www.fileformat.info/format/mspaint/egff.htm
170850	string	DanM 	icrosoft Paint image data (version 1.x)
17086>4	leshort	x	(%d
17087>>6	leshort	x	x %d)
170880	string	LinS 	Microsoft Paint image data (version 2.0)
17089>4	leshort	x	(%d
17090>>6	leshort	x	x %d)
17091
17092# reMarkable tablet internal file format (https://www.remarkable.com/)
17093# https://github.com/ax3l/lines-are-beautiful
17094# https://plasma.ninja/blog/devices/remarkable/binary/format/2017/12/26/\
17095#	reMarkable-lines-file-format.html#what-to-do-next
17096# from Axel Huebl
170970		string	reMarkable
17098>11		string	lines
17099>>17		string	with
17100>>>22		string	selections
17101>>>>33		string	and
17102>>>>>37		string	layers
17103>>>>>>43	lelong	x	reMarkable tablet notebook lines, 1404 x 1872, %x page(s)
17104
17105# newer per-page files for the reMarkable
171060		string	reMarkable
17107>11		string	.lines
17108>>18		string	file,
17109>>>24		string	version=
17110>>>>32		byte	x	reMarkable tablet page (v%c), 1404 x 1872,
17111>>>>>43		lelong	x	%d layer(s)
17112
17113# Type: PVR3 texture.
17114# From: David Korth <gerbilsoft@gerbilsoft.com>
17115# References:
17116# - http://cdn.imgtec.com/sdk-documentation/PVR+File+Format.Specification.pdf
17117
17118# PVR3 pixel formats.
171190	name		pvr3-pixel-format
17120>4	ulelong	0
17121>>0	ulelong	0	PVRTC 2bpp RGB
17122>>0	ulelong	1	PVRTC 2bpp RGBA
17123>>0	ulelong	2	PVRTC 4bpp RGB
17124>>0	ulelong	3	PVRTC 4bpp RGBA
17125>>0	ulelong	4	PVRTC-II 2bpp
17126>>0	ulelong	5	PVRTC-II 4bpp
17127>>0	ulelong	6	ETC1
17128>>0	ulelong	7	DXT1
17129>>0	ulelong	8	DXT2
17130>>0	ulelong	9	DXT3
17131>>0	ulelong	10	DXT4
17132>>0	ulelong	11	DXT5
17133>>0	ulelong	12	BC4
17134>>0	ulelong	13	BC5
17135>>0	ulelong	14	BC6
17136>>0	ulelong	15	BC7
17137>>0	ulelong	16	UYVY
17138>>0	ulelong	17	YUY2
17139>>0	ulelong	18	BW1bpp
17140>>0	ulelong	19	R9G9B9E5 Shared Exponent
17141>>0	ulelong	20	RGBG8888
17142>>0	ulelong	21	GRGB8888
17143>>0	ulelong	22	ETC2 RGB
17144>>0	ulelong	23	ETC2 RGBA
17145>>0	ulelong	24	ETC2 RGB A1
17146>>0	ulelong	25	EAC R11
17147>>0	ulelong	26	EAC RG11
17148>>0	ulelong	27	ASTC_4x4
17149>>0	ulelong	28	ASTC_5x4
17150>>0	ulelong	29	ASTC_5x5
17151>>0	ulelong	30	ASTC_6x5
17152>>0	ulelong	31	ASTC_6x6
17153>>0	ulelong	32	ASTC_8x5
17154>>0	ulelong	33	ASTC_8x6
17155>>0	ulelong	34	ASTC_8x8
17156>>0	ulelong	35	ASTC_10x5
17157>>0	ulelong	36	ASTC_10x6
17158>>0	ulelong	37	ASTC_10x8
17159>>0	ulelong	38	ASTC_10x10
17160>>0	ulelong	39	ASTC_12x10
17161>>0	ulelong	40	ASTC_12x12
17162>>0	ulelong	41	ASTC_3x3x3
17163>>0	ulelong	42	ASTC_4x3x3
17164>>0	ulelong	43	ASTC_4x4x3
17165>>0	ulelong	44	ASTC_4x4x4
17166>>0	ulelong	45	ASTC_5x4x4
17167>>0	ulelong	46	ASTC_5x5x4
17168>>0	ulelong	47	ASTC_5x5x5
17169>>0	ulelong	48	ASTC_6x5x5
17170>>0	ulelong	49	ASTC_6x6x5
17171>>0	ulelong	50	ASTC_6x6x6
17172>4	ulelong	!0
17173>>0	byte	!0	%c
17174>>1	byte	!0	\b%c
17175>>2	byte	!0	\b%c
17176>>3	byte	!0	\b%c
17177
171780	string		PVR\x03			PVR 3.0 texture:
17179>0x18	ulelong		x	%u x
17180>0x1C	ulelong		x	%u
17181>0x20	ulelong		>1	x %u
17182>0x08	byte		x	\b,
17183>0x08	use	pvr3-pixel-format
17184>0x10	ulelong		1	\b, sRGB
17185>0x04	ulelong&0x02	0x02	\b, premultiplied alpha
17186
17187# Type: Microsoft Xbox XPR0 texture.
17188# From: David Korth <gerbilsoft@gerbilsoft.com>
17189# References:
17190# - https://github.com/Cxbx-Reloaded/Cxbx-Reloaded/blob/develop/src/core/hle/D3D8/XbD3D8Types.h
17191
17192# XPR pixel formats.
171930	name	xbox-xpr-pixel-format
17194>0	byte	0x00	L8
17195>0	byte	0x01	AL8
17196>0	byte	0x02	ARGB1555
17197>0	byte	0x03	RGB555
17198>0	byte	0x04	ARGB4444
17199>0	byte	0x05	RGB565
17200>0	byte	0x06	ARGB8888
17201>0	byte	0x07	xRGB8888
17202>0	byte	0x0B	P8
17203>0	byte	0x0C	DXT1
17204>0	byte	0x0E	DXT2
17205>0	byte	0x0F	DXT4
17206>0	byte	0x10	Linear ARGB1555
17207>0	byte	0x11	Linear RGB565
17208>0	byte	0x12	Linear ARGB8888
17209>0	byte	0x13	Linear L8
17210>0	byte	0x16	Linear R8B8
17211>0	byte	0x17	Linear G8B8
17212>0	byte	0x19	A8
17213>0	byte	0x1A	A8L8
17214>0	byte	0x1B	Linear AL8
17215>0	byte	0x1C	Linear RGB555
17216>0	byte	0x1D	Linear ARGB4444
17217>0	byte	0x1E	Linear xRGB8888
17218>0	byte	0x1F	Linear A8
17219>0	byte	0x20	Linear A8L8
17220>0	byte	0x24	YUY2
17221>0	byte	0x25	UYVY
17222>0	byte	0x27	L6V5U5
17223>0	byte	0x28	V8U8
17224>0	byte	0x29	R8B8
17225>0	byte	0x2A	D24S8
17226>0	byte	0x2B	F24S8
17227>0	byte	0x2C	D16
17228>0	byte	0x2D	F16
17229>0	byte	0x2E	Linear D24S8
17230>0	byte	0x2F	Linear F24S8
17231>0	byte	0x30	Linear D16
17232>0	byte	0x31	Linear F16
17233>0	byte	0x32	L16
17234>0	byte	0x33	V16U16
17235>0	byte	0x35	Linear L16
17236>0	byte	0x36	Linear V16U16
17237>0	byte	0x37	Linear L6V5U5
17238>0	byte	0x38	RGBA5551
17239>0	byte	0x39	RGBA4444
17240>0	byte	0x3A	QWVU8888
17241>0	byte	0x3B	BGRA8888
17242>0	byte	0x3C	RGBA8888
17243>0	byte	0x3D	Linear RGBA5551
17244>0	byte	0x3E	Linear RGBA4444
17245>0	byte	0x3F	Linear ABGR8888
17246>0	byte	0x40	Linear BGRA8888
17247>0	byte	0x41	Linear RGBA8888
17248>0	byte	0x64	Vertex Data
17249
172500	string		XPR0	Microsoft Xbox XPR0 texture
17251>0x19	byte	x	\b, format:
17252>>0x19	use	xbox-xpr-pixel-format
17253
17254#------------------------------------------------------------------------------
17255# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $
17256# inform:  file(1) magic for Inform interactive fiction language
17257
17258# URL:  http://www.inform-fiction.org/
17259# From: Reuben Thomas <rrt@sc3d.org>
17260
172610	search/100/cW	constant\ story		Inform source text
17262
17263#------------------------------------------------------------------------------
17264# $File: intel,v 1.17 2018/08/01 10:34:03 christos Exp $
17265# intel:  file(1) magic for x86 Unix
17266#
17267# Various flavors of x86 UNIX executable/object (other than Xenix, which
17268# is in "microsoft").  DOS is in "msdos"; the ambitious soul can do
17269# Windows as well.
17270#
17271# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
17272# whatever comes next (HP-PA Hummingbird?).  OS/2 may also go elsewhere
17273# as well, if, as, and when IBM makes it portable.
17274#
17275# The `versions' should be un-commented if they work for you.
17276# (Was the problem just one of endianness?)
17277#
172780	leshort		0502		basic-16 executable
17279>12	lelong		>0		not stripped
17280#>22	leshort		>0		- version %d
172810	leshort		0503		basic-16 executable (TV)
17282>12	lelong		>0		not stripped
17283#>22	leshort		>0		- version %d
172840	leshort		0510		x86 executable
17285>12	lelong		>0		not stripped
172860	leshort		0511		x86 executable (TV)
17287>12	lelong		>0		not stripped
172880	leshort		=0512		iAPX 286 executable small model (COFF)
17289>12	lelong		>0		not stripped
17290#>22	leshort		>0		- version %d
172910	leshort		=0522		iAPX 286 executable large model (COFF)
17292>12	lelong		>0		not stripped
17293#>22	leshort		>0		- version %d
17294# updated by Joerg Jenderek at Oct 2015
17295# https://de.wikipedia.org/wiki/Common_Object_File_Format
17296# http://www.delorie.com/djgpp/doc/coff/filhdr.html
17297# ./msdos (version 5.25) labeled the next entry as "MS Windows COFF Intel 80386 object file"
17298# ./intel (version 5.25) label labeled the next entry as "80386 COFF executable"
17299# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
173000	leshort		=0514
17301# use subroutine to display name+flags+variables for common object formated files
17302>0	use				display-coff
17303#>12	lelong		>0		not stripped
17304# no hint found, that at offset 22 is version
17305#>22	leshort		>0		- version %d
173060	leshort		0x0200
17307>0	use				display-coff
173080	leshort		0x8664
17309>0	use				display-coff
17310
17311# rom: file(1) magic for BIOS ROM Extensions found in intel machines
17312#      mapped into memory between 0xC0000 and 0xFFFFF
17313# From: Alex Myczko <alex@aiei.ch>
17314# updated by Joerg Jenderek
17315# https://en.wikipedia.org/wiki/Option_ROM
173160        beshort         0x55AA       BIOS (ia32) ROM Ext.
17317!:mime	application/octet-stream
17318!:ext	rom/bin
17319>5       string          USB          USB
17320>7       string          LDR          UNDI image
17321>30      string          IBM          IBM comp. Video
17322>26      string          Adaptec      Adaptec
17323>28      string          Adaptec      Adaptec
17324>42      string          PROMISE      Promise
17325>2       byte            x            (%d*512)
17326
17327# Flash descriptors for Intel SPI flash roms.
17328# From Dr. Jesus <j@hug.gs>
173290	lelong		0x0ff0a55a	Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step
1733016	lelong		0x0ff0a55a	Intel serial flash for PCH ROM
17331
17332#------------------------------------------------------------------------------
17333# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $
17334# interleaf:  file(1) magic for InterLeaf TPS:
17335#
173360	string		=\210OPS	Interleaf saved data
173370	string		=<!OPS		Interleaf document text
17338>5	string		,\ Version\ =	\b, version
17339>>17	string		>\0		%.3s
17340
17341#------------------------------------------------------------------------------
17342# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $
17343# island:  file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
17344# "/etc/magic":
17345# From: guy@netapp.com (Guy Harris)
17346#
173474	string		pgscriptver	IslandWrite document
1734813	string		DrawFile	IslandDraw document
17349
17350
17351#------------------------------------------------------------------------------
17352# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $
17353# ispell:  file(1) magic for ispell
17354#
17355# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602.  This magic
17356# will match 0x9600 through 0x9603 in *both* little endian and big endian.
17357# (No other current magic entries collide.)
17358#
17359# Updated by Daniel Quinlan (quinlan@yggdrasil.com)
17360#
173610	leshort&0xFFFC	0x9600		little endian ispell
17362>0	byte		0		hash file (?),
17363>0	byte		1		3.0 hash file,
17364>0	byte		2		3.1 hash file,
17365>0	byte		3		hash file (?),
17366>2	leshort		0x00		8-bit, no capitalization, 26 flags
17367>2	leshort		0x01		7-bit, no capitalization, 26 flags
17368>2	leshort		0x02		8-bit, capitalization, 26 flags
17369>2	leshort		0x03		7-bit, capitalization, 26 flags
17370>2	leshort		0x04		8-bit, no capitalization, 52 flags
17371>2	leshort		0x05		7-bit, no capitalization, 52 flags
17372>2	leshort		0x06		8-bit, capitalization, 52 flags
17373>2	leshort		0x07		7-bit, capitalization, 52 flags
17374>2	leshort		0x08		8-bit, no capitalization, 128 flags
17375>2	leshort		0x09		7-bit, no capitalization, 128 flags
17376>2	leshort		0x0A		8-bit, capitalization, 128 flags
17377>2	leshort		0x0B		7-bit, capitalization, 128 flags
17378>2	leshort		0x0C		8-bit, no capitalization, 256 flags
17379>2	leshort		0x0D		7-bit, no capitalization, 256 flags
17380>2	leshort		0x0E		8-bit, capitalization, 256 flags
17381>2	leshort		0x0F		7-bit, capitalization, 256 flags
17382>4	leshort		>0		and %d string characters
173830	beshort&0xFFFC	0x9600		big endian ispell
17384>1	byte		0		hash file (?),
17385>1	byte		1		3.0 hash file,
17386>1	byte		2		3.1 hash file,
17387>1	byte		3		hash file (?),
17388>2	beshort		0x00		8-bit, no capitalization, 26 flags
17389>2	beshort		0x01		7-bit, no capitalization, 26 flags
17390>2	beshort		0x02		8-bit, capitalization, 26 flags
17391>2	beshort		0x03		7-bit, capitalization, 26 flags
17392>2	beshort		0x04		8-bit, no capitalization, 52 flags
17393>2	beshort		0x05		7-bit, no capitalization, 52 flags
17394>2	beshort		0x06		8-bit, capitalization, 52 flags
17395>2	beshort		0x07		7-bit, capitalization, 52 flags
17396>2	beshort		0x08		8-bit, no capitalization, 128 flags
17397>2	beshort		0x09		7-bit, no capitalization, 128 flags
17398>2	beshort		0x0A		8-bit, capitalization, 128 flags
17399>2	beshort		0x0B		7-bit, capitalization, 128 flags
17400>2	beshort		0x0C		8-bit, no capitalization, 256 flags
17401>2	beshort		0x0D		7-bit, no capitalization, 256 flags
17402>2	beshort		0x0E		8-bit, capitalization, 256 flags
17403>2	beshort		0x0F		7-bit, capitalization, 256 flags
17404>4	beshort		>0		and %d string characters
17405# ispell 4.0 hash files  kromJx <kromJx@crosswinds.net>
17406# Ispell 4.0
174070       string          ISPL            ispell
17408>4      long            x               hash file version %d,
17409>8      long            x               lexletters %d,
17410>12     long            x               lexsize %d,
17411>16     long            x               hashsize %d,
17412>20     long            x               stblsize %d
17413
17414#------------------------------------------------------------------------------
17415# $File: isz,v 1.5 2019/04/19 00:42:27 christos Exp $
17416# ISO Zipped file format
17417# https://www.ezbsystems.com/isz/iszspec.txt
174180	string	IsZ!	ISO Zipped file
17419>4	byte	x	\b, header size %u
17420>5	byte	x	\b, version %u
17421>8	lelong	x	\b, serial %u
17422#12	leshort	x	\b, sector size %u
17423#>16	lelong	x	\b, total sectors %u
17424>17	byte	>0	\b, password protected
17425#>24	lequad	x	\b, segment size %llu
17426#>32	lelong	x	\b, blocks %u
17427#>36	lelong	x	\b, block size %u
17428
17429#------------------------------------------------------------
17430# $File: java,v 1.21 2019/02/18 17:58:50 christos Exp $
17431# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
17432# same magic number, 0xcafebabe, so they are both handled
17433# in the entry called "cafebabe".
17434#------------------------------------------------------------
17435# Java serialization
17436# From Martin Pool (m.pool@pharos.com.au)
174370	beshort		0xaced		Java serialization data
17438>2	beshort		>0x0004		\b, version %d
17439
174400	belong		0xfeedfeed	Java KeyStore
17441!:mime	application/x-java-keystore
174420	belong		0xcececece	Java JCE KeyStore
17443!:mime	application/x-java-jce-keystore
17444
17445# Java source
174460	regex	\^import.*;$	Java source
17447!:mime	text/x-java
17448
17449# Java HPROF dumps
17450# https://java.net/downloads/heap-snapshot/hprof-binary-format.html
174510	string		JAVA\x20PROFILE\x201.0.
17452>0x12	byte		0
17453>>0x11	ubyte-0x31	<2      Java HPROF dump,
17454>>>0x17	beqdate/1000	x       created %s
17455
17456# Java jmod module
17457# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/classes/jdk/internal/jmod/JmodFile.java
17458# Grr. 2 byte magic "JM", really? In 2019?
174590	belong		0x4a4d0100	Java jmod module version 1.0
17460!:mime	application/x-java-jmod
17461
17462# Java jlinked image
17463# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/native/libjimage/imageFile.hpp
174640	belong	0xcafedada	Java module image (big endian)
17465>4	beshort	>0x00	\b, version %d
17466>6	beshort	x	\b.%d
17467!:mime	application/x-java-image
17468
174690	lelong	0xcafedada	Java module image (little endian)
17470>6	leshort	>0x00	\b, version %d
17471>4	leshort	x	\b.%d
17472!:mime	application/x-java-image
17473
17474#------------------------------------------------------------------------------
17475# $File: javascript,v 1.1 2012/06/16 13:30:36 christos Exp $
17476# javascript:  magic for javascript and node.js scripts.
17477#
174780	search/1/w	#!/bin/node		Node.js script text executable
17479!:mime application/javascript
174800	search/1/w	#!/usr/bin/node		Node.js script text executable
17481!:mime application/javascript
174820	search/1/w	#!/bin/nodejs		Node.js script text executable
17483!:mime application/javascript
174840	search/1/w	#!/usr/bin/nodejs	Node.js script text executable
17485!:mime application/javascript
174860	search/1	#!/usr/bin/env\ node	Node.js script text executable
17487!:mime application/javascript
174880	search/1	#!/usr/bin/env\ nodejs	Node.js script text executable
17489!:mime application/javascript
17490
17491#------------------------------------------------------------------------------
17492# $File: jpeg,v 1.32 2018/10/01 18:58:29 christos Exp $
17493# JPEG images
17494# SunOS 5.5.1 had
17495#
17496#	0	string		\377\330\377\340	JPEG file
17497#	0	string		\377\330\377\356	JPG file
17498#
17499# both of which turn into "JPEG image data" here.
17500#
175010	beshort		0xffd8		JPEG image data
17502!:mime	image/jpeg
17503!:apple	8BIMJPEG
17504!:strength *3
17505!:ext jpeg/jpg/jpe/jfif
17506>6	string		JFIF		\b, JFIF standard
17507# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
17508# in a vain attempt to add image size reporting for JFIF.  Note that these
17509# tests are not fool-proof since some perfectly valid JPEGs are currently
17510# impossible to specify in magic(4) format.
17511# First, a little JFIF version info:
17512>>11	byte		x		\b %d.
17513>>12	byte		x		\b%02d
17514# Next, the resolution or aspect ratio of the image:
17515>>13	byte		0		\b, aspect ratio
17516>>13	byte		1		\b, resolution (DPI)
17517>>13	byte		2		\b, resolution (DPCM)
17518>>14	beshort		x		\b, density %dx
17519>>16	beshort		x		\b%d
17520>>4	beshort		x		\b, segment length %d
17521# Next, show thumbnail info, if it exists:
17522>>18	byte		!0		\b, thumbnail %dx
17523>>>19	byte		x		\b%d
17524>6	string		Exif		\b, Exif standard: [
17525>>12	indirect/r	x
17526>>12	string		x		\b]
17527
17528# Jump to the first segment
17529>(4.S+4)	use		jpeg_segment
17530
17531# This uses recursion...
175320		name		jpeg_segment
17533>0	beshort		0xFFFE
17534# Recursion handled by FFE0
17535#>>(2.S+2)	use			jpeg_segment
17536>>2	pstring/HJ	x		\b, comment: "%s"
17537
17538>0	beshort		0xFFC0
17539>>(2.S+2)	use			jpeg_segment
17540>>4	byte		x		\b, baseline, precision %d
17541>>7	beshort		x		\b, %dx
17542>>5	beshort		x		\b%d
17543>>9	byte		x		\b, components %d
17544
17545>0	beshort		0xFFC1
17546>>(2.S+2)	use			jpeg_segment
17547>>4	byte		x		\b, extended sequential, precision %d
17548>>7	beshort		x		\b, %dx
17549>>5	beshort		x		\b%d
17550>>9	byte		x		\b, components %d
17551
17552>0	beshort		0xFFC2
17553>>(2.S+2)	use			jpeg_segment
17554>>4	byte		x		\b, progressive, precision %d
17555>>7	beshort		x		\b, %dx
17556>>5	beshort		x		\b%d
17557>>9	byte		x		\b, components %d
17558
17559# Define Huffman Tables
17560>0	beshort		0xFFC4
17561>>(2.S+2)	use			jpeg_segment
17562
17563>0	beshort		0xFFE1
17564# Recursion handled by FFE0
17565#>>(2.S+2)	use			jpeg_segment
17566>>4	string		Exif		\b, Exif Standard: [
17567>>>10	indirect/r	x
17568>>>10	string		x		\b]
17569
17570# Application specific markers
17571>0	beshort&0xFFE0	=0xFFE0
17572>>(2.S+2)	use			jpeg_segment
17573
17574# DB: Define Quantization tables
17575# DD: Define Restart interval [XXX: wrong here, it is 4 bytes]
17576# D8: Start of image
17577# D9: End of image
17578# Dn: Restart
17579>0	beshort&0xFFD0	=0xFFD0
17580>>0	beshort&0xFFE0	!0xFFE0
17581>>>(2.S+2)	use			jpeg_segment
17582
17583#>0	beshort		x		unknown 0x%x
17584#>>(2.S+2)	use			jpeg_segment
17585
17586# HSI is Handmade Software's proprietary JPEG encoding scheme
175870	string		hsi1		JPEG image data, HSI proprietary
17588
17589# From: David Santinoli <david@santinoli.com>
175900	string		\x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A	JPEG 2000
17591# From: Johan van der Knijff <johan.vanderknijff@kb.nl>
17592# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes
17593# https://github.com/bitsgalore/jp2kMagic
17594#
17595# Now read value of 'Brand' field, which yields a few possibilities:
17596>20	string		\x6a\x70\x32\x20	Part 1 (JP2)
17597!:mime	image/jp2
17598>20	string		\x6a\x70\x78\x20	Part 2 (JPX)
17599!:mime	image/jpx
17600>20	string		\x6a\x70\x6d\x20	Part 6 (JPM)
17601!:mime	image/jpm
17602>20	string		\x6d\x6a\x70\x32	Part 3 (MJ2)
17603!:mime	video/mj2
17604
17605# Type: JPEG 2000 codesream
17606# From: Mathieu Malaterre <mathieu.malaterre@gmail.com>
176070	belong		0xff4fff51						JPEG 2000 codestream
1760845	beshort		0xff52
17609
17610# JPEG extended range
176110	string		\x49\x49\xbc
17612>3	byte		1
17613>>4	lelong%2	0	JPEG-XR
17614!:mime	image/jxr
17615!:ext	jxr
17616
17617#------------------------------------------------------------------------------
17618# $File: karma,v 1.8 2015/08/29 07:10:35 christos Exp $
17619# karma:  file(1) magic for Karma data files
17620#
17621# From <rgooch@atnf.csiro.au>
17622
176230	string	KarmaRHD\040Version	Karma Data Structure Version
17624>16	belong		x		%u
17625
17626#------------------------------------------------------------------------------
17627# $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $
17628# kde:  file(1) magic for KDE
17629
176300		string/t	[KDE\ Desktop\ Entry]	KDE desktop entry
17631!:mime	application/x-kdelnk
176320		string/t	#\ KDE\ Config\ File	KDE config file
17633!:mime	application/x-kdelnk
176340		string/t	#\ xmcd	xmcd database file for kscd
17635!:mime	text/x-xmcd
17636
17637#------------------------------------------------------------------------------
17638# $File: keepass,v 1.2 2019/04/19 00:42:27 christos Exp $
17639# keepass: file(1) magic for KeePass file
17640#
17641# Keepass Password Safe:
17642#  * original one: https://keepass.info/
17643#  * *nix port:    https://www.keepassx.org/
17644#  * android port: https://code.google.com/p/keepassdroid/
17645
176460	lelong		0x9AA2D903	Keepass password database
17647>4	lelong		0xB54BFB65	1.x KDB
17648>>48	lelong		>0		\b, %d groups
17649>>52	lelong		>0		\b, %d entries
17650>>8	lelong&0x0f	1		\b, SHA-256
17651>>8	lelong&0x0f	2		\b, AES
17652>>8	lelong&0x0f	4		\b, RC4
17653>>8	lelong&0x0f	8		\b, Twofish
17654>>120	lelong		>0		\b, %d key transformation rounds
17655>4	lelong		0xB54BFB67	2.x KDBX
17656
17657#------------------------------------------------------------------------------
17658# $File: kerberos,v 1.3 2019/04/19 00:42:27 christos Exp $
17659# kerberos: MIT kerberos file binary formats
17660#
17661
17662# This magic entry is for demonstration purposes and could be improved
17663# if the following features were implemented in file:
17664#
17665# Strings inside [[ .. ]] in the descriptions have special meanings and
17666# are not printed.
17667#
17668# 	- Provide some form of iteration in number of components
17669#		[[${counter}=%d]] in the description
17670#		then append
17671#		[${counter}--] in the offset of the entries
17672#	- Provide a way to round the next offset
17673#		Add [R:4] after the offset?
17674#	- Provide a way to have optional entries
17675#		XXX: Syntax:
17676#	- Provide a way to "save" entries to print them later.
17677#		if the description is [[${name}=%s]], then nothing is
17678#		printed and a subsequent entry in the same magic file
17679#		can refer to ${name}
17680#	- Provide a way to format strings as hex values
17681#
17682# https://www.gnu.org/software/shishi/manual/html_node/\
17683#	The-Keytab-Binary-File-Format.html
17684#
17685
176860		name		keytab_entry
17687#>0		beshort		x		\b, size=%d
17688#>2		beshort		x		\b, components=%d
17689>4		pstring/H	x		\b, realm=%s
17690>>&0		pstring/H	x		\b, principal=%s/
17691>>>&0		pstring/H	x		\b%s
17692>>>>&0		belong		x		\b, type=%d
17693>>>>>&0		bedate		x		\b, date=%s
17694>>>>>>&0	byte		x		\b, kvno=%u
17695#>>>>>>>&0	pstring/H	x
17696#>>>>>>>>&0	belong		x
17697#>>>>>>>>>>&0	use		keytab_entry
17698
176990		belong		0x05020000	Kerberos Keytab file
17700>4		use		keytab_entry
17701
17702#------------------------------------------------------------------------------
17703# $File: kicad,v 1.1 2018/10/01 18:39:21 christos Exp $
17704# kicad:  file(1) magic for KiCad files
17705#
17706# See
17707#
17708#	http://kicad-pcb.org
17709#
17710
17711# KiCad Schematic Document
177120	    string  EESchema
17713>8	    byte    0x20
17714>>9	    string  Schematic
17715>>>18	    byte    0x20		KiCad Schematic Document
17716!:ext sch/bak
17717>>>>24	    string  Version
17718>>>>>31	    byte    0x20
17719>>>>>>32    string  x			(Version %s)
17720
17721# KiCad Symbol Library
177220	    string  EESchema-LIBRARY
17723>16	    byte    0x20		KiCad Symbol Library
17724!:ext lib
17725>>17	    string  Version
17726>>>24	    byte    0x20
17727>>>>25	    string  x			(Version %s)
17728
17729# KiCad Symbol Library Documentation
177300	    string  EESchema-DOCLIB
17731>15	    byte    0x20		KiCad Symbol Library Documentation
17732!:ext dcm
17733>>17	    string  Version
17734>>>24	    byte    0x20
17735>>>>25	    string  x			(Version %s)
17736
17737# KiCad Board Layout
177380	    string  (kicad_pcb
17739>10	    byte    0x20		KiCad Board Layout
17740!:ext kicad_pcb/kicad_pcb-bak
17741>>11	    string  (version
17742>>>19	    byte    0x20
17743>>>>20	    byte    x			(Version %c)
17744
17745# KiCad Footprint
177460	    string  (module
17747>7	    byte    0x20		KiCad Footprint
17748!:ext kicad_mod
17749
17750# KiCad Footprint (Legacy)
177510	    string  PCBNEW-LibModule-V1	    KiCad Footprint (Legacy)
17752!:ext mod
17753
17754# KiCad Netlist
177550	    string  (export
17756>7	    byte    0x20		KiCad Netlist
17757!:ext net
17758
17759# KiCad Symbol Library Table
177600	    string  (sym_lib_table
17761>14	    byte    0xA			KiCad Symbol Library Table
17762>14	    byte    0xD			KiCad Symbol Library Table
17763>14	    byte    0x20		KiCad Symbol Library Table
17764
17765# KiCad Footprint Library Table
177660	    string  (fp_lib_table
17767>13	    byte    0xA			KiCad Footprint Library Table
17768>13	    byte    0xD			KiCad Footprint Library Table
17769>13	    byte    0x20		KiCad Footprint Library Table
17770
17771#------------------------------------------------------------------------------
17772# $File: kml,v 1.5 2019/04/19 00:42:27 christos Exp $
17773# Type: Google KML, formerly Keyhole Markup Language
17774# Future development of this format has been handed
17775# over to the Open Geospatial Consortium.
17776# https://www.opengeospatial.org/standards/kml/
17777# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
177780 string/t    \<?xml
17779>20  search/400 \ xmlns=
17780>>&0 regex ['"]https://earth.google.com/kml Google KML document
17781!:mime application/vnd.google-earth.kml+xml
17782>>>&1 string 2.0' \b, version 2.0
17783>>>&1 string 2.1' \b, version 2.1
17784>>>&1 string 2.2' \b, version 2.2
17785
17786#------------------------------------------------------------------------------
17787# Type: OpenGIS KML, formerly Keyhole Markup Language
17788# This standard is maintained by the
17789# Open Geospatial Consortium.
17790# https://www.opengeospatial.org/standards/kml/
17791# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
17792>>&0 regex ['"]https://www.opengis.net/kml OpenGIS KML document
17793!:mime application/vnd.google-earth.kml+xml
17794>>>&1 string/t 2.2 \b, version 2.2
17795
17796#------------------------------------------------------------------------------
17797# Type: Google KML Archive (ZIP based)
17798# https://code.google.com/apis/kml/documentation/kml_tut.html
17799# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
178000 string    PK\003\004
17801>4  byte    0x14
17802>>30  string doc.kml Compressed Google KML Document, including resources.
17803!:mime application/vnd.google-earth.kmz
17804
17805#------------------------------------------------------------------------------
17806# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $
17807# DEC SRC Virtual Paper: Lectern files
17808# Karl M. Hegbloom <karlheg@inetarena.com>
178090	string	lect	DEC SRC Virtual Paper Lectern file
17810
17811#------------------------------------------------------------------------------
17812# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $
17813# lex:  file(1) magic for lex
17814#
17815#	derived empirically, your offsets may vary!
178160	search/100	yyprevious	C program text (from lex)
17817>3	search/1	>\0		 for %s
17818# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
178190	search/100	generated\ by\ flex	C program text (from flex)
17820# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
178210	search/1	%{		lex description text
17822
17823#------------------------------------------------------------------------------
17824# $File: lif,v 1.8 2009/09/19 16:28:10 christos Exp $
17825# lif:  file(1) magic for lif
17826#
17827# (Daniel Quinlan <quinlan@yggdrasil.com>)
17828#
178290	beshort		0x8000		lif file
17830
17831#------------------------------------------------------------------------------
17832# $File: linux,v 1.67 2019/04/19 00:42:27 christos Exp $
17833# linux:  file(1) magic for Linux files
17834#
17835# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
17836# The following basic Linux magic is useful for reference, but using
17837# "long" magic is a better practice in order to avoid collisions.
17838#
17839# 2	leshort		100		Linux/i386
17840# >0	leshort		0407		impure executable (OMAGIC)
17841# >0	leshort		0410		pure executable (NMAGIC)
17842# >0	leshort		0413		demand-paged executable (ZMAGIC)
17843# >0	leshort		0314		demand-paged executable (QMAGIC)
17844#
178450	lelong		0x00640107	Linux/i386 impure executable (OMAGIC)
17846>16	lelong		0		\b, stripped
178470	lelong		0x00640108	Linux/i386 pure executable (NMAGIC)
17848>16	lelong		0		\b, stripped
178490	lelong		0x0064010b	Linux/i386 demand-paged executable (ZMAGIC)
17850>16	lelong		0		\b, stripped
178510	lelong		0x006400cc	Linux/i386 demand-paged executable (QMAGIC)
17852>16	lelong		0		\b, stripped
17853#
178540	string		\007\001\000	Linux/i386 object file
17855>20	lelong		>0x1020		\b, DLL library
17856# Linux-8086 stuff:
178570	string		\01\03\020\04	Linux-8086 impure executable
17858>28	long		!0		not stripped
178590	string		\01\03\040\04	Linux-8086 executable
17860>28	long		!0		not stripped
17861#
178620	string		\243\206\001\0	Linux-8086 object file
17863#
178640	string		\01\03\020\20	Minix-386 impure executable
17865>28	long		!0		not stripped
178660	string		\01\03\040\20	Minix-386 executable
17867>28	long		!0		not stripped
178680	string		\01\03\04\20	Minix-386 NSYM/GNU executable
17869>28	long		!0		not stripped
17870# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
17871216	lelong		0421		Linux/i386 core file
17872!:strength / 2
17873>220	string		>\0		of '%s'
17874>200	lelong		>0		(signal %d)
17875#
17876# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
17877# this can be overridden by the DOS executable (COM) entry
178782	string		LILO		Linux/i386 LILO boot/chain loader
17879#
17880# Linux make config build file, from Ole Aamot <oka@oka.no>
17881# Updated by Ken Sharp
1788228	string		make\ config		Linux make config build file (old)
1788349	search/70	Kernel\ Configuration	Linux make config build file
17884
17885#
17886# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
17887# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
17888# See: https://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html
178890	leshort		0x0436		Linux/i386 PC Screen Font v1 data,
17890>2	byte&0x01	0		256 characters,
17891>2	byte&0x01	!0		512 characters,
17892>2	byte&0x02	0		no directory,
17893>2	byte&0x02	!0		Unicode directory,
17894>3	byte		>0		8x%d
178950	string		\x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data,
17896>16	lelong		x		%d characters,
17897>12	lelong&0x01	0		no directory,
17898>12	lelong&0x01	!0		Unicode directory,
17899>24	lelong		x		%d
17900>28	lelong		x		\bx%d
17901
17902# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
179034086	string		SWAP-SPACE	Linux/i386 swap file
17904# From: Jeff Bailey <jbailey@ubuntu.com>
17905# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com>
179064076	string		SWAPSPACE2S1SUSPEND	Linux/i386 swap file (new style) with SWSUSP1 image
17907# From: James Hunt <james.hunt@ubuntu.com>
179084076    string          SWAPSPACE2LINHIB0001    Linux/i386 swap file (new style) (compressed hibernate)
17909# according to man page of mkswap (8) March 1999
17910# volume label and UUID Russell Coker
17911# https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
179124086	string		SWAPSPACE2	Linux/i386 swap file (new style),
17913>0x400	long		x		version %d (4K pages),
17914>0x404	long		x		size %d pages,
17915>1052	string		\0		no label,
17916>1052	string		>\0		LABEL=%s,
17917>0x40c	belong		x		UUID=%08x
17918>0x410	beshort		x		\b-%04x
17919>0x412	beshort		x		\b-%04x
17920>0x414	beshort		x		\b-%04x
17921>0x416	belong		x		\b-%08x
17922>0x41a	beshort		x		\b%04x
17923# From Daniel Novotny <dnovotny@redhat.com>
17924# swap file for PowerPC
1792565526	string		SWAPSPACE2	Linux/ppc swap file
17926>0x400	long		x		version %d,
17927>0x404	long		x		size %d pages,
17928>1052	string		\0		no label,
17929>1052	string		>\0		LABEL=%s,
17930>0x40c	belong		x		UUID=%08x
17931>0x410	beshort		x		\b-%04x
17932>0x412	beshort		x		\b-%04x
17933>0x414	beshort		x		\b-%04x
17934>0x416	belong		x		\b-%08x
17935>0x41a	beshort		x		\b%04x
1793616374	string		SWAPSPACE2	Linux/ia64 swap file
17937#
17938# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
17939# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
17940# and Nicolas Lichtmaier <nick@debian.org>
17941# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
17942# Linux kernel boot images (i386 arch) (Wolfram Kleff)
17943# URL: https://www.kernel.org/doc/Documentation/x86/boot.txt
17944514	string		HdrS		Linux kernel
17945!:strength + 55
17946# often no extension like in linux, vmlinuz, bzimage or memdisk but sometimes
17947# Acronis Recovery kernel64.dat and Plop Boot Manager plpbtrom.bin
17948# DamnSmallLinux 1.5 damnsmll.lnx
17949!:ext	/dat/bin/lnx
17950>510	leshort		0xAA55		x86 boot executable
17951>>518	leshort		>0x1ff
17952>>>529	byte		0		zImage,
17953>>>529	byte		1		bzImage,
17954>>>526	lelong		>0
17955>>>>(526.s+0x200) string	>\0	version %s,
17956>>498	leshort		1		RO-rootFS,
17957>>498	leshort		0		RW-rootFS,
17958>>508	leshort		>0		root_dev 0x%X,
17959>>502	leshort		>0		swap_dev 0x%X,
17960>>504	leshort		>0		RAMdisksize %u KB,
17961>>506	leshort		0xFFFF		Normal VGA
17962>>506	leshort		0xFFFE		Extended VGA
17963>>506	leshort		0xFFFD		Prompt for Videomode
17964>>506	leshort		>0		Video mode %d
17965# This also matches new kernels, which were caught above by "HdrS".
179660		belong	0xb8c0078e	Linux kernel
17967>0x1e3		string	Loading		version 1.3.79 or older
17968>0x1e9		string	Loading		from prehistoric times
17969
17970# System.map files - Nicolas Lichtmaier <nick@debian.org>
179718	search/1	\ A\ _text	Linux kernel symbol map text
17972
17973# LSM entries - Nicolas Lichtmaier <nick@debian.org>
179740	search/1	Begin3	Linux Software Map entry text
179750	search/1	Begin4	Linux Software Map entry text (new format)
17976
17977# From Matt Zimmerman, enhanced for v3 by Matthew Palmer
179780	belong	0x4f4f4f4d	User-mode Linux COW file
17979>4	belong	<3		\b, version %d
17980>>8	string	>\0		\b, backing file %s
17981>4	belong	>2		\b, version %d
17982>>32	string	>\0		\b, backing file %s
17983
17984############################################################################
17985# Linux kernel versions
17986
179870		string		\xb8\xc0\x07\x8e\xd8\xb8\x00\x90	Linux
17988>497		leshort		0		x86 boot sector
17989>>514		belong		0x8e	of a kernel from the dawn of time!
17990>>514		belong		0x908ed8b4	version 0.99-1.1.42
17991>>514		belong		0x908ed8b8	for memtest86
17992
17993>497		leshort		!0		x86 kernel
17994>>504		leshort		>0		RAMdisksize=%u KB
17995>>502		leshort		>0		swap=0x%X
17996>>508		leshort		>0		root=0x%X
17997>>>498		leshort		1		\b-ro
17998>>>498		leshort		0		\b-rw
17999>>506		leshort		0xFFFF		vga=normal
18000>>506		leshort		0xFFFE		vga=extended
18001>>506		leshort		0xFFFD		vga=ask
18002>>506		leshort		>0		vga=%d
18003>>514		belong		0x908ed881	version 1.1.43-1.1.45
18004>>514		belong		0x15b281cd
18005>>>0xa8e	belong		0x55AA5a5a	version 1.1.46-1.2.13,1.3.0
18006>>>0xa99	belong		0x55AA5a5a	version 1.3.1,2
18007>>>0xaa3	belong		0x55AA5a5a	version 1.3.3-1.3.30
18008>>>0xaa6	belong		0x55AA5a5a	version 1.3.31-1.3.41
18009>>>0xb2b	belong		0x55AA5a5a	version 1.3.42-1.3.45
18010>>>0xaf7	belong		0x55AA5a5a	version 1.3.46-1.3.72
18011>>514		string		HdrS
18012>>>518		leshort		>0x1FF
18013>>>>529		byte		0		\b, zImage
18014>>>>529		byte		1		\b, bzImage
18015>>>>(526.s+0x200) string 	>\0		\b, version %s
18016
18017# Linux boot sector thefts.
180180		belong		0xb8c0078e	Linux
18019>0x1e6		belong		0x454c4b53	ELKS Kernel
18020>0x1e6		belong		!0x454c4b53	style boot sector
18021
18022############################################################################
18023# Linux S390 kernel image
18024# Created by: Jan Kaluza <jkaluza@redhat.com>
180258 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390
18026>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc
18027# 64bit
18028>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel
18029>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel
18030>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel
18031>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel
18032# 32bit
18033>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel
18034>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel
18035>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel
18036>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel
18037
18038# Linux ARM compressed kernel image
18039# From: Kevin Cernekee <cernekee@gmail.com>
18040# Update: Joerg Jenderek
1804136	lelong	0x016f2818	Linux kernel ARM boot executable zImage (little-endian)
18042# raspian "kernel7.img", Vu+ Ultimo4K "kernel_auto.bin"
18043!:ext	img/bin
1804436	belong	0x016f2818	Linux kernel ARM boot executable zImage (big-endian)
18045
18046############################################################################
18047# Linux 8086 executable
180480	lelong&0xFF0000FF 0xC30000E9	Linux-Dev86 executable, headerless
18049>5	string		.
18050>>4	string		>\0		\b, libc version %s
18051
180520	lelong&0xFF00FFFF 0x4000301	Linux-8086 executable
18053>2	byte&0x01	!0		\b, unmapped zero page
18054>2	byte&0x20	0		\b, impure
18055>2	byte&0x20	!0
18056>>2	byte&0x10	!0		\b, A_EXEC
18057>2	byte&0x02	!0		\b, A_PAL
18058>2	byte&0x04	!0		\b, A_NSYM
18059>2	byte&0x08	!0		\b, A_STAND
18060>2	byte&0x40	!0		\b, A_PURE
18061>2	byte&0x80	!0		\b, A_TOVLY
18062>28     long            !0              \b, not stripped
18063>37	string		.
18064>>36	string		>\0		\b, libc version %s
18065
18066# 0	lelong&0xFF00FFFF 0x10000301	ld86 I80386 executable
18067# 0	lelong&0xFF00FFFF 0xB000301	ld86 M68K executable
18068# 0	lelong&0xFF00FFFF 0xC000301	ld86 NS16K executable
18069# 0	lelong&0xFF00FFFF 0x17000301	ld86 SPARC executable
18070
18071# SYSLINUX boot logo files (from 'ppmtolss16' sources)
18072# https://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename:
18073# file extension .lss .16
180740	lelong	=0x1413f33d		SYSLINUX' LSS16 image data
18075# syslinux-4.05/mime/image/x-lss16.xml
18076!:mime image/x-lss16
18077>4	leshort	x			\b, width %d
18078>6	leshort	x			\b, height %d
18079
180800	string	OOOM			User-Mode-Linux's Copy-On-Write disk image
18081>4	belong	x			version %d
18082
18083# SE Linux policy database
18084# From: Mike Frysinger <vapier@gentoo.org>
180850	lelong	0xf97cff8c		SE Linux policy
18086>16	lelong	x			v%d
18087>20	lelong	1			MLS
18088>24	lelong	x			%d symbols
18089>28	lelong	x			%d ocons
18090
18091# Linux Logical Volume Manager (LVM)
18092# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net>
18093#
18094# System ID, UUID and volume group name are 128 bytes long
18095# but they should never be full and initialized with zeros...
18096#
18097# LVM1
18098#
180990x0	string	HM\001		LVM1 (Linux Logical Volume Manager), version 1
18100>0x12c	string	>\0		, System ID: %s
18101
181020x0	string	HM\002		LVM1 (Linux Logical Volume Manager), version 2
18103>0x12c	string	>\0		, System ID: %s
18104
18105#  LVM2
18106#
18107# It seems that the label header can be in one the four first sector
18108# of the disk... (from _find_labeller in lib/label/label.c of LVM2)
18109#
18110# 0x200 seems to be the common case
18111
181120x218           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
18113# read the offset to add to the start of the header, and the header
18114# start in 0x200
18115>&(&-12.l-0x21) byte    x
18116# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
18117>>&0x0          string  >\x2f          \b, UUID: %.6s
18118>>&0x6          string  >\x2f          \b-%.4s
18119>>&0xa          string  >\x2f          \b-%.4s
18120>>&0xe          string  >\x2f          \b-%.4s
18121>>&0x12         string  >\x2f          \b-%.4s
18122>>&0x16         string  >\x2f          \b-%.4s
18123>>&0x1a         string  >\x2f          \b-%.6s
18124>>&0x20         lequad  x              \b, size: %lld
18125
181260x018           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
18127>&(&-12.l-0x21) byte    x
18128# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
18129>>&0x0          string  >\x2f          \b, UUID: %.6s
18130>>&0x6          string  >\x2f          \b-%.4s
18131>>&0xa          string  >\x2f          \b-%.4s
18132>>&0xe          string  >\x2f          \b-%.4s
18133>>&0x12         string  >\x2f          \b-%.4s
18134>>&0x16         string  >\x2f          \b-%.4s
18135>>&0x1a         string  >\x2f          \b-%.6s
18136>>&0x20         lequad  x              \b, size: %lld
18137
181380x418           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
18139>&(&-12.l-0x21) byte    x
18140# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
18141>>&0x0          string  >\x2f          \b, UUID: %.6s
18142>>&0x6          string  >\x2f          \b-%.4s
18143>>&0xa          string  >\x2f          \b-%.4s
18144>>&0xe          string  >\x2f          \b-%.4s
18145>>&0x12         string  >\x2f          \b-%.4s
18146>>&0x16         string  >\x2f          \b-%.4s
18147>>&0x1a         string  >\x2f          \b-%.6s
18148>>&0x20         lequad  x              \b, size: %lld
18149
181500x618           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
18151>&(&-12.l-0x21) byte    x
18152# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
18153>>&0x0          string  >\x2f          \b, UUID: %.6s
18154>>&0x6          string  >\x2f          \b-%.4s
18155>>&0xa          string  >\x2f          \b-%.4s
18156>>&0xe          string  >\x2f          \b-%.4s
18157>>&0x12         string  >\x2f          \b-%.4s
18158>>&0x16         string  >\x2f          \b-%.4s
18159>>&0x1a         string  >\x2f          \b-%.6s
18160>>&0x20         lequad  x              \b, size: %lld
18161
18162# LVM snapshot
18163# from Jason Farrel
181640	string	SnAp	LVM Snapshot (CopyOnWrite store)
18165>4	lelong	!0	- valid,
18166>4	lelong	0	- invalid,
18167>8	lelong	x	version %d,
18168>12	lelong	x	chunk_size %d
18169
18170# SE Linux policy database
181710	lelong	0xf97cff8c		SE Linux policy
18172>16	lelong	x			v%d
18173>20	lelong	1			MLS
18174>24	lelong	x			%d symbols
18175>28	lelong	x			%d ocons
18176
18177# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec
18178# Anthon van der Neut (anthon@mnt.org)
181790	string	LUKS\xba\xbe	LUKS encrypted file,
18180>6	beshort x		ver %d
18181>8	string	x		[%s,
18182>40	string	x		%s,
18183>72	string	x		%s]
18184>168	string	x		UUID: %s
18185
18186
18187# Summary: Xen saved domain file
18188# Created by: Radek Vokal <rvokal@redhat.com>
181890	string		LinuxGuestRecord	Xen saved domain
18190>20	search/256	(name
18191>>&1	string		x			(name %s)
18192
18193# Type: Xen, the virtual machine monitor
18194# From: Radek Vokal <rvokal@redhat.com>
181950	string		LinuxGuestRecord	Xen saved domain
18196#>2	regex		\(name\ [^)]*\)		%s
18197>20	search/256	(name			(name
18198>>&1	string		x			%s...)
18199
18200# Systemd journald files
18201# See https://www.freedesktop.org/wiki/Software/systemd/journal-files/.
18202# From: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl>
18203
18204# check magic
182050	string	LPKSHHRH
18206# check that state is one of known values
18207>16		ubyte&252	0
18208# check that each half of three unique id128s is non-zero
18209>>24		ubequad		>0
18210>>>32		ubequad		>0
18211>>>>40		ubequad		>0
18212>>>>>48		ubequad		>0
18213>>>>>>56	ubequad		>0
18214>>>>>>>64	ubequad		>0	Journal file
18215!:mime application/octet-stream
18216# provide more info
18217>>>>>>>>184	leqdate		0	empty
18218>>>>>>>>16	ubyte		0	\b, offline
18219>>>>>>>>16	ubyte		1	\b, online
18220>>>>>>>>16	ubyte		2	\b, archived
18221>>>>>>>>8	ulelong&1	1	\b, sealed
18222>>>>>>>>12	ulelong&1	1	\b, compressed
18223
18224# BCache backing and cache devices
18225# From: Gabriel de Perthuis <g2p.code@gmail.com>
182260x1008		lequad		8
18227>0x1018		string		\xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81	BCache
18228>>0x1010	ulequad		0	cache device
18229>>0x1010	ulequad		1	backing device
18230>>0x1010	ulequad		3	cache device
18231>>0x1010	ulequad		4	backing device
18232>>0x1048	string		>0	\b, label "%.32s"
18233>>0x1028	ubelong		x	\b, uuid %08x
18234>>0x102c	ubeshort	x	\b-%04x
18235>>0x102e	ubeshort	x	\b-%04x
18236>>0x1030	ubeshort	x	\b-%04x
18237>>0x1032	ubelong		x	\b-%08x
18238>>0x1036	ubeshort	x	\b%04x
18239>>0x1038	ubelong		x	\b, set uuid %08x
18240>>0x103c	ubeshort	x	\b-%04x
18241>>0x103e	ubeshort	x	\b-%04x
18242>>0x1040	ubeshort	x	\b-%04x
18243>>0x1042	ubelong		x	\b-%08x
18244>>0x1046	ubeshort	x	\b%04x
18245
18246# Linux device tree:
18247# File format description can be found in the Linux kernel sources at
18248# Documentation/devicetree/booting-without-of.txt
18249# From Christoph Biedl
182500		belong		0xd00dfeed
18251# structure and strings must be within blob
18252>&(8.L)		byte		x
18253>>&(12.L)	byte		x
18254>>>20		belong		>1	Device Tree Blob version %d
18255>>>>4		belong		x	\b, size=%d
18256>>>>20		belong		>1
18257>>>>>28		belong		x	\b, boot CPU=%d
18258>>>>20		belong		>2
18259>>>>>32		belong		x	\b, string block size=%d
18260>>>>20		belong		>16
18261>>>>>36		belong		x	\b, DT structure block size=%d
18262
18263# glibc locale archive as defined in glibc locale/locarchive.h
182640		lelong		0xde020109	locale archive
18265>24		lelong		x		%d strings
18266
18267# Linux Software RAID (mdadm)
18268# Russell Coker <russell@coker.com.au>
182690	name	linuxraid
18270>16	belong	x		UUID=%8x:
18271>20	belong	x		\b%8x:
18272>24	belong	x		\b%8x:
18273>28	belong	x		\b%8x
18274>32	string	x		name=%s
18275>72	lelong	x		level=%d
18276>92	lelong	x		disks=%d
18277
182784096	lelong	0xa92b4efc	Linux Software RAID
18279>4100	lelong	x		version 1.2 (%d)
18280>4096	use	linuxraid
18281
182820	lelong	0xa92b4efc	Linux Software RAID
18283>4	lelong	x		version 1.1 (%d)
18284>0	use	linuxraid
18285
18286# Summary:     Database file for mlocate
18287# Description: A database file as used by mlocate, a fast implementation
18288#              of locate/updatedb. It uses merging to reuse the existing
18289#              database and avoid rereading most of the filesystem. It's
18290#              the default version of locate on Arch Linux (and others).
18291# File path:   /var/lib/mlocate/mlocate.db by default (but configurable)
18292# Site:        https://fedorahosted.org/mlocate/
18293# Format docs: https://linux.die.net/man/5/mlocate.db
18294# Type: mlocate database file
18295# URL:  https://fedorahosted.org/mlocate/
18296# From: Wander Nauta <info@wandernauta.nl>
182970		string		\0mlocate	mlocate database
18298>12		byte		x		\b, version %d
18299>13		byte		1		\b, require visibility
18300>16		string		x		\b, root %s
18301
18302# Dump files for iproute2 tool. Generated by the "ip r|a save" command. URL:
18303# https://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2
18304# From: Pavel Emelyanov <xemul@parallels.com>
183050		lelong		0x45311224	iproute2 routes dump
183060		lelong		0x47361222	iproute2 addresses dump
18307
18308# Image and service files for CRIU tool.
18309# URL: https://criu.org
18310# From: Pavel Emelyanov <xemul@parallels.com>
183110		lelong		0x54564319	CRIU image file v1.1
183120		lelong		0x55105940	CRIU service file
183130		lelong		0x58313116	CRIU inventory
18314
18315# Kdump compressed dump files
18316# https://sourceforge.net/p/makedumpfile/code/ci/master/tree/IMPLEMENTATION
18317
183180		string		KDUMP          	Kdump compressed dump
18319>8		long		x		v%d
18320>12		string		>\0		\b, system %s
18321>77		string		>\0		\b, node %s
18322>142		string		>\0		\b, release %s
18323>207		string		>\0		\b, version %s
18324>272		string		>\0		\b, machine %s
18325>337		string		>\0		\b, domain %s
18326
18327#------------------------------------------------------------------------------
18328# $File: lisp,v 1.26 2019/04/19 00:42:27 christos Exp $
18329# lisp:  file(1) magic for lisp programs
18330#
18331# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
18332
18333# updated by Joerg Jenderek
18334# GRR: This lot is too weak
18335#0	string	;;
18336# windows INF files often begin with semicolon and use CRLF as line end
18337# lisp files are mainly created on unix system with LF as line end
18338#>2	search/4096	!\r		Lisp/Scheme program text
18339#>2	search/4096	\r		Windows INF file
18340
183410	search/4096	(setq\ 			Lisp/Scheme program text
18342!:mime	text/x-lisp
183430	search/4096	(defvar\ 		Lisp/Scheme program text
18344!:mime	text/x-lisp
183450	search/4096	(defparam\ 		Lisp/Scheme program text
18346!:mime	text/x-lisp
183470	search/4096	(defun\  		Lisp/Scheme program text
18348!:mime	text/x-lisp
183490	search/4096	(autoload\ 		Lisp/Scheme program text
18350!:mime	text/x-lisp
183510	search/4096	(custom-set-variables\ 	Lisp/Scheme program text
18352!:mime	text/x-lisp
18353
18354# URL: https://en.wikipedia.org/wiki/Emacs_Lisp
18355# Reference: https://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz
18356# Update: Joerg Jenderek
18357# Emacs 18 - this is always correct, but not very magical.
183580	string	\012(
18359# look for emacs lisp keywords
18360# GRR: split regex because it is too long or get error like
18361# lisp, 36: Warning: cannot get string from `^(defun|defvar|defconst|defmacro|setq|fset|put|provide|require|'
18362>&0	regex	\^(defun|defvar|defconst|defmacro|setq|fset)	Emacs v18 byte-compiled Lisp data
18363!:mime	application/x-elc
18364# https://searchcode.com/codesearch/view/2173420/
18365# not really pure text
18366!:apple	EMAxTEXT
18367!:ext elc
18368# remaining regex
18369>&0	regex	\^(put|provide|require|random)	Emacs v18 byte-compiled Lisp data
18370!:mime	application/x-elc
18371!:apple	EMAxTEXT
18372!:ext elc
18373# missed cl.elc dbx.elc simple.elc look like normal lisp starting with ;;;
18374
18375# Emacs 19+ - ver. recognition added by Ian Springer
18376# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs
18377# - Chris Chittleborough <cchittleborough@yahoo.com.au>
18378# Update: Joerg Jenderek
183790	string	;ELC
18380# version\0\0\0
18381>4	byte	>18			Emacs/XEmacs v%d byte-compiled Lisp data
18382# why less than 32 ? does not make sense to me. GNU Emacs version is 24.5 at April 2015
18383#>4	byte    <32			Emacs/XEmacs v%d byte-compiled Lisp data
18384!:mime	application/x-elc
18385!:apple	EMAxTEXT
18386!:ext elc
18387
18388# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
183890	string	(SYSTEM::VERSION\040'	CLISP byte-compiled Lisp program (pre 2004-03-27)
183900	string	(|SYSTEM|::|VERSION|\040'	CLISP byte-compiled Lisp program text
18391
183920	long	0x70768BD2		CLISP memory image data
183930	long	0xD28B7670		CLISP memory image data, other endian
18394
18395#.com and .bin for MIT scheme
183960	string	\372\372\372\372	MIT scheme (library?)
18397
18398# From: David Allouche <david@allouche.net>
183990	search/1	\<TeXmacs|	TeXmacs document text
18400!:mime	text/texmacs
18401
18402#------------------------------------------------------------------------------
18403# $File: llvm,v 1.9 2019/04/19 00:42:27 christos Exp $
18404# llvm:  file(1) magic for LLVM byte-codes
18405# URL:  https://llvm.org/docs/BitCodeFormat.html
18406# From: Al Stone <ahs3@fc.hp.com>
18407
184080	string	llvm	LLVM byte-codes, uncompressed
184090	string	llvc0	LLVM byte-codes, null compression
184100	string	llvc1	LLVM byte-codes, gzip compression
184110	string	llvc2	LLVM byte-codes, bzip2 compression
18412
184130	lelong	0x0b17c0de	LLVM bitcode, wrapper
18414# Are these Mach-O ABI values?  They appear to be.
18415>16	lelong	0x01000007	x86_64
18416>16	lelong	0x00000007	i386
18417>16	lelong	0x00000012	ppc
18418>16	lelong	0x01000012	ppc64
18419>16	lelong 	0x0000000c	arm
18420
184210	string	BC\xc0\xde	LLVM IR bitcode
18422
18423#------------------------------------------------------------------------------
18424# $File: lua,v 1.7 2019/04/19 00:42:27 christos Exp $
18425# lua:  file(1) magic for Lua scripting language
18426# URL:  https://www.lua.org/
18427# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
18428
18429# Lua scripts
184300	search/1/w	#!\ /usr/bin/lua	Lua script text executable
18431!:mime	text/x-lua
184320	search/1/w	#!\ /usr/local/bin/lua	Lua script text executable
18433!:mime	text/x-lua
184340	search/1	#!/usr/bin/env\ lua	Lua script text executable
18435!:mime	text/x-lua
184360	search/1	#!\ /usr/bin/env\ lua	Lua script text executable
18437!:mime	text/x-lua
18438
18439# Lua bytecode
184400	string		\033Lua			Lua bytecode,
18441>4	byte		0x50			version 5.0
18442>4	byte		0x51			version 5.1
18443>4	byte		0x52			version 5.2
18444
18445#------------------------------------------------------------------------------
18446# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $
18447# luks:  file(1) magic for Linux Unified Key Setup
18448# URL:	http://luks.endorphin.org/spec
18449# From:	Anthon van der Neut <anthon@mnt.org>
18450
184510	string		LUKS\xba\xbe	LUKS encrypted file,
18452>6	beshort		x		ver %d
18453>8	string		x		[%s,
18454>40	string		x		%s,
18455>72	string		x		%s]
18456>168	string		x		UUID: %s
18457#------------------------------------------------------------------------------
18458# $File: m4,v 1.3 2019/02/27 16:46:23 christos Exp $
18459# make:  file(1) magic for M4 scripts
18460#
184610	search/8192	dnl
18462>0	regex	\^dnl\ 		M4 macro processor script text
18463!:mime	text/x-m4
184640	search/8192	AC_DEFUN
18465>0	regex	\^AC_DEFUN\\(\\[	M4 macro processor script text
18466!:strength + 15
18467!:mime	text/x-m4
18468
18469#------------------------------------------------------------
18470# $File: mach,v 1.23 2015/10/15 21:51:22 christos Exp $
18471# Mach has two magic numbers, 0xcafebabe and 0xfeedface.
18472# Unfortunately the first, cafebabe, is shared with
18473# Java ByteCode, so they are both handled in the file "cafebabe".
18474# The "feedface" ones are handled herein.
18475#------------------------------------------------------------
18476# if set, it's for the 64-bit version of the architecture
18477# yes, this is separate from the low-order magic number bit
18478# it's also separate from the "64-bit libraries" bit in the
18479# upper 8 bits of the CPU subtype
18480
184810	name	mach-o-cpu
18482>0	belong&0x01000000	0
18483#
18484# 32-bit ABIs.
18485#
18486#				1	vax
18487>>0	belong&0x00ffffff	1
18488>>>4		belong&0x00ffffff	0	vax
18489>>>4		belong&0x00ffffff	1	vax11/780
18490>>>4		belong&0x00ffffff	2	vax11/785
18491>>>4		belong&0x00ffffff	3	vax11/750
18492>>>4		belong&0x00ffffff	4	vax11/730
18493>>>4		belong&0x00ffffff	5	uvaxI
18494>>>4		belong&0x00ffffff	6	uvaxII
18495>>>4		belong&0x00ffffff	7	vax8200
18496>>>4		belong&0x00ffffff	8	vax8500
18497>>>4		belong&0x00ffffff	9	vax8600
18498>>>4		belong&0x00ffffff	10	vax8650
18499>>>4		belong&0x00ffffff	11	vax8800
18500>>>4		belong&0x00ffffff	12	uvaxIII
18501>>>4		belong&0x00ffffff	>12	vax subarchitecture=%d
18502>>0	belong&0x00ffffff	2	romp
18503>>0	belong&0x00ffffff	3	architecture=3
18504>>0	belong&0x00ffffff	4	ns32032
18505>>0	belong&0x00ffffff	5	ns32332
18506>>0	belong&0x00ffffff	6	m68k
18507#				7	x86
18508>>0	belong&0x00ffffff	7
18509>>>4	belong&0x0000000f	3		i386
18510>>>4	belong&0x0000000f	4		i486
18511>>>>4	belong&0x00fffff0	0
18512>>>>4	belong&0x00fffff0	0x80		\bsx
18513>>>4	belong&0x0000000f	5		i586
18514>>>4	belong&0x0000000f	6
18515>>>>4	belong&0x00fffff0	0		p6
18516>>>>4	belong&0x00fffff0	0x10		pentium_pro
18517>>>>4	belong&0x00fffff0	0x20		pentium_2_m0x20
18518>>>>4	belong&0x00fffff0	0x30		pentium_2_m3
18519>>>>4	belong&0x00fffff0	0x40		pentium_2_m0x40
18520>>>>4	belong&0x00fffff0	0x50		pentium_2_m5
18521>>>>4	belong&0x00fffff0	>0x50		pentium_2_m0x%x
18522>>>4	belong&0x0000000f	7		celeron
18523>>>>4	belong&0x00fffff0	0x00		\b_m0x%x
18524>>>>4	belong&0x00fffff0	0x10		\b_m0x%x
18525>>>>4	belong&0x00fffff0	0x20		\b_m0x%x
18526>>>>4	belong&0x00fffff0	0x30		\b_m0x%x
18527>>>>4	belong&0x00fffff0	0x40		\b_m0x%x
18528>>>>4	belong&0x00fffff0	0x50		\b_m0x%x
18529>>>>4	belong&0x00fffff0	0x60
18530>>>>4	belong&0x00fffff0	0x70		\b_mobile
18531>>>>4	belong&0x00fffff0	>0x70		\b_m0x%x
18532>>>4	belong&0x0000000f	8		pentium_3
18533>>>>4	belong&0x00fffff0	0x00
18534>>>>4	belong&0x00fffff0	0x10		\b_m
18535>>>>4	belong&0x00fffff0	0x20		\b_xeon
18536>>>>4	belong&0x00fffff0	>0x20		\b_m0x%x
18537>>>4	belong&0x0000000f	9		pentiumM
18538>>>>4	belong&0x00fffff0	0x00
18539>>>>4	belong&0x00fffff0	>0x00		\b_m0x%x
18540>>>4	belong&0x0000000f	10		pentium_4
18541>>>>4	belong&0x00fffff0	0x00
18542>>>>4	belong&0x00fffff0	0x10		\b_m
18543>>>>4	belong&0x00fffff0	>0x10		\b_m0x%x
18544>>>4	belong&0x0000000f	11		itanium
18545>>>>4	belong&0x00fffff0	0x00
18546>>>>4	belong&0x00fffff0	0x10		\b_2
18547>>>>4	belong&0x00fffff0	>0x10		\b_m0x%x
18548>>>4	belong&0x0000000f	12		xeon
18549>>>>4	belong&0x00fffff0	0x00
18550>>>>4	belong&0x00fffff0	0x10		\b_mp
18551>>>>4	belong&0x00fffff0	>0x10		\b_m0x%x
18552>>>4	belong&0x0000000f	>12		ia32 family=%d
18553>>>>4	belong&0x00fffff0	0x00
18554>>>>4	belong&0x00fffff0	>0x00		model=%x
18555>>0	belong&0x00ffffff	8	mips
18556>>>4		belong&0x00ffffff	1	R2300
18557>>>4		belong&0x00ffffff	2	R2600
18558>>>4		belong&0x00ffffff	3	R2800
18559>>>4		belong&0x00ffffff	4	R2000a
18560>>>4		belong&0x00ffffff	5	R2000
18561>>>4		belong&0x00ffffff	6	R3000a
18562>>>4		belong&0x00ffffff	7	R3000
18563>>>4		belong&0x00ffffff	>7	subarchitecture=%d
18564>>0	belong&0x00ffffff	9	ns32532
18565>>0	belong&0x00ffffff	10	mc98000
18566>>0	belong&0x00ffffff	11	hppa
18567>>>4		belong&0x00ffffff	0	7100
18568>>>4		belong&0x00ffffff	1	7100LC
18569>>>4		belong&0x00ffffff	>1	subarchitecture=%d
18570>>0	belong&0x00ffffff	12	arm
18571>>>4		belong&0x00ffffff	0
18572>>>4		belong&0x00ffffff	1	subarchitecture=%d
18573>>>4		belong&0x00ffffff	2	subarchitecture=%d
18574>>>4		belong&0x00ffffff	3	subarchitecture=%d
18575>>>4		belong&0x00ffffff	4	subarchitecture=%d
18576>>>4		belong&0x00ffffff	5	\bv4t
18577>>>4		belong&0x00ffffff	6	\bv6
18578>>>4		belong&0x00ffffff	7	\bv5tej
18579>>>4		belong&0x00ffffff	8	\bxscale
18580>>>4		belong&0x00ffffff	9	\bv7
18581>>>4		belong&0x00ffffff	10	\bv7f
18582>>>4		belong&0x00ffffff	11	\bv7s
18583>>>4		belong&0x00ffffff	12	\bv7k
18584>>>4		belong&0x00ffffff	13	\bv8
18585>>>4		belong&0x00ffffff	14	\bv6m
18586>>>4		belong&0x00ffffff	15	\bv7m
18587>>>4		belong&0x00ffffff	16	\bv7em
18588>>>4		belong&0x00ffffff	>16	subarchitecture=%d
18589#				13	m88k
18590>>0	belong&0x00ffffff	13
18591>>>4		belong&0x00ffffff	0	mc88000
18592>>>4		belong&0x00ffffff	1	mc88100
18593>>>4		belong&0x00ffffff	2	mc88110
18594>>>4		belong&0x00ffffff	>2	mc88000 subarchitecture=%d
18595>>0	belong&0x00ffffff	14	SPARC
18596>>0	belong&0x00ffffff	15	i860g
18597>>0	belong&0x00ffffff	16	alpha
18598>>0	belong&0x00ffffff	17	rs6000
18599>>0	belong&0x00ffffff	18	ppc
18600>>>4		belong&0x00ffffff	0
18601>>>4		belong&0x00ffffff	1	\b_601
18602>>>4		belong&0x00ffffff	2	\b_602
18603>>>4		belong&0x00ffffff	3	\b_603
18604>>>4		belong&0x00ffffff	4	\b_603e
18605>>>4		belong&0x00ffffff	5	\b_603ev
18606>>>4		belong&0x00ffffff	6	\b_604
18607>>>4		belong&0x00ffffff	7	\b_604e
18608>>>4		belong&0x00ffffff	8	\b_620
18609>>>4		belong&0x00ffffff	9	\b_650
18610>>>4		belong&0x00ffffff	10	\b_7400
18611>>>4		belong&0x00ffffff	11	\b_7450
18612>>>4		belong&0x00ffffff	100	\b_970
18613>>>4		belong&0x00ffffff	>100	subarchitecture=%d
18614>>0	belong&0x00ffffff	>18	architecture=%d
18615>0	belong&0x01000000	0x01000000
18616#
18617# 64-bit ABIs.
18618#
18619>>0	belong&0x00ffffff	0	64-bit architecture=%d
18620>>0	belong&0x00ffffff	1	64-bit architecture=%d
18621>>0	belong&0x00ffffff	2	64-bit architecture=%d
18622>>0	belong&0x00ffffff	3	64-bit architecture=%d
18623>>0	belong&0x00ffffff	4	64-bit architecture=%d
18624>>0	belong&0x00ffffff	5	64-bit architecture=%d
18625>>0	belong&0x00ffffff	6	64-bit architecture=%d
18626>>0	belong&0x00ffffff	7	x86_64
18627>>>4		belong&0x00ffffff	0	subarchitecture=%d
18628>>>4		belong&0x00ffffff	1	subarchitecture=%d
18629>>>4		belong&0x00ffffff	2	subarchitecture=%d
18630>>>4		belong&0x00ffffff	3
18631>>>4		belong&0x00ffffff	4	\b_arch1
18632>>>4		belong&0x00ffffff	8	\b_haswell
18633>>>4		belong&0x00ffffff	>4	subarchitecture=%d
18634>>0	belong&0x00ffffff	8	64-bit architecture=%d
18635>>0	belong&0x00ffffff	9	64-bit architecture=%d
18636>>0	belong&0x00ffffff	10	64-bit architecture=%d
18637>>0	belong&0x00ffffff	11	64-bit architecture=%d
18638>>0	belong&0x00ffffff	12	arm64
18639>>>4		belong&0x00ffffff	0
18640>>>4		belong&0x00ffffff	1	\bv8
18641>>0	belong&0x00ffffff	13	64-bit architecture=%d
18642>>0	belong&0x00ffffff	14	64-bit architecture=%d
18643>>0	belong&0x00ffffff	15	64-bit architecture=%d
18644>>0	belong&0x00ffffff	16	64-bit architecture=%d
18645>>0	belong&0x00ffffff	17	64-bit architecture=%d
18646>>0	belong&0x00ffffff	18	ppc64
18647>>>4		belong&0x00ffffff	0
18648>>>4		belong&0x00ffffff	1		\b_601
18649>>>4		belong&0x00ffffff	2		\b_602
18650>>>4		belong&0x00ffffff	3		\b_603
18651>>>4		belong&0x00ffffff	4		\b_603e
18652>>>4		belong&0x00ffffff	5		\b_603ev
18653>>>4		belong&0x00ffffff	6		\b_604
18654>>>4		belong&0x00ffffff	7		\b_604e
18655>>>4		belong&0x00ffffff	8		\b_620
18656>>>4		belong&0x00ffffff	9		\b_650
18657>>>4		belong&0x00ffffff	10		\b_7400
18658>>>4		belong&0x00ffffff	11		\b_7450
18659>>>4		belong&0x00ffffff	100		\b_970
18660>>>4		belong&0x00ffffff	>100		subarchitecture=%d
18661>>0	belong&0x00ffffff	>18	64-bit architecture=%d
18662
18663
186640	name		mach-o-be
18665>0	byte		0xcf		64-bit
18666>4	use		mach-o-cpu
18667>12	belong		1		object
18668>12	belong		2		executable
18669>12	belong		3		fixed virtual memory shared library
18670>12	belong		4		core
18671>12	belong		5		preload executable
18672>12	belong		6		dynamically linked shared library
18673>12	belong		7		dynamic linker
18674>12	belong		8		bundle
18675>12	belong		9		dynamically linked shared library stub
18676>12	belong		10		dSYM companion file
18677>12	belong		11		kext bundle
18678>12	belong		>11
18679>>12	belong		x		filetype=%d
18680>24	belong		>0		\b, flags:<
18681>>24	belong		&0x0000001	\bNOUNDEFS
18682>>24	belong		&0x0000002	\b|INCRLINK
18683>>24	belong		&0x0000004	\b|DYLDLINK
18684>>24	belong		&0x0000008	\b|BINDATLOAD
18685>>24	belong		&0x0000010	\b|PREBOUND
18686>>24	belong		&0x0000020	\b|SPLIT_SEGS
18687>>24	belong		&0x0000040	\b|LAZY_INIT
18688>>24	belong		&0x0000080	\b|TWOLEVEL
18689>>24	belong		&0x0000100	\b|FORCE_FLAT
18690>>24	belong		&0x0000200	\b|NOMULTIDEFS
18691>>24	belong		&0x0000400	\b|NOFIXPREBINDING
18692>>24	belong		&0x0000800	\b|PREBINDABLE
18693>>24	belong		&0x0001000	\b|ALLMODSBOUND
18694>>24	belong		&0x0002000	\b|SUBSECTIONS_VIA_SYMBOLS
18695>>24	belong		&0x0004000	\b|CANONICAL
18696>>24	belong		&0x0008000	\b|WEAK_DEFINES
18697>>24	belong		&0x0010000	\b|BINDS_TO_WEAK
18698>>24	belong		&0x0020000	\b|ALLOW_STACK_EXECUTION
18699>>24	belong		&0x0040000	\b|ROOT_SAFE
18700>>24	belong		&0x0080000	\b|SETUID_SAFE
18701>>24	belong		&0x0100000	\b|NO_REEXPORTED_DYLIBS
18702>>24	belong		&0x0200000	\b|PIE
18703>>24	belong		&0x0400000	\b|DEAD_STRIPPABLE_DYLIB
18704>>24	belong		&0x0800000	\b|HAS_TLV_DESCRIPTORS
18705>>24	belong		&0x1000000	\b|NO_HEAP_EXECUTION
18706>>24	belong		&0x2000000	\b|APP_EXTENSION_SAFE
18707>>24	belong		x		\b>
18708
18709#
187100	lelong&0xfffffffe	0xfeedface	Mach-O
18711!:strength +1
18712!:mime application/x-mach-binary
18713>0	use	\^mach-o-be
18714
187150	belong&0xfffffffe	0xfeedface	Mach-O
18716!:strength +1
18717!:mime application/x-mach-binary
18718>0	use	mach-o-be
18719
18720#------------------------------------------------------------------------------
18721# $File: macintosh,v 1.29 2019/04/19 00:42:27 christos Exp $
18722# macintosh description
18723#
18724# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
18725# Daniel Quinlan, quinlan@yggdrasil.com
1872611	string	must\ be\ converted\ with\ BinHex	BinHex binary text
18727!:mime	application/mac-binhex40
18728>41	string	x					\b, version %.3s
18729
18730# Stuffit archives are the de facto standard of compression for Macintosh
18731# files obtained from most archives. (franklsm@tuns.ca)
187320	string		SIT!			StuffIt Archive (data)
18733!:mime	application/x-stuffit
18734!:apple	SIT!SIT!
18735>2	string		x			: %s
187360	string		SITD			StuffIt Deluxe (data)
18737>2	string		x			: %s
187380	string		Seg			StuffIt Deluxe Segment (data)
18739>2	string		x			: %s
18740
18741# Newer StuffIt archives (grant@netbsd.org)
187420	string		StuffIt			StuffIt Archive
18743!:mime	application/x-stuffit
18744!:apple	SIT!SIT!
18745#>162	string		>0			: %s
18746
18747# Macintosh Applications and Installation binaries (franklsm@tuns.ca)
18748# GRR: Too weak
18749#0	string		APPL			Macintosh Application (data)
18750#>2	string		x			\b: %s
18751
18752# Macintosh System files (franklsm@tuns.ca)
18753# GRR: Too weak
18754#0	string		zsys			Macintosh System File (data)
18755#0	string		FNDR			Macintosh Finder (data)
18756#0	string		libr			Macintosh Library (data)
18757#>2	string		x			: %s
18758#0	string		shlb			Macintosh Shared Library (data)
18759#>2	string		x			: %s
18760#0	string		cdev			Macintosh Control Panel (data)
18761#>2	string		x			: %s
18762#0	string		INIT			Macintosh Extension (data)
18763#>2	string		x			: %s
18764#0	string		FFIL			Macintosh Truetype Font (data)
18765#>2	string		x			: %s
18766#0	string		LWFN			Macintosh Postscript Font (data)
18767#>2	string		x			: %s
18768
18769# Additional Macintosh Files (franklsm@tuns.ca)
18770# GRR: Too weak
18771#0	string		PACT			Macintosh Compact Pro Archive (data)
18772#>2	string		x			: %s
18773#0	string		ttro			Macintosh TeachText File (data)
18774#>2	string		x			: %s
18775#0	string		TEXT			Macintosh TeachText File (data)
18776#>2	string		x			: %s
18777#0	string		PDF			Macintosh PDF File (data)
18778#>2	string		x			: %s
18779
18780# MacBinary format (Eric Fischer, enf@pobox.com)
18781# Update: Joerg Jenderek
18782# URL: https://en.wikipedia.org/wiki/MacBinary
18783# Reference: https://files.stairways.com/other/macbinaryii-standard-info.txt
18784#
18785# Unfortunately MacBinary doesn't really have a magic number prior
18786# to the MacBinary III format.
18787#
18788
18789# old version number, must be kept at zero for compatibility
187900	byte	0
18791# length of filename (must be in the range 1-63)
18792>1	ubyte	>0
18793# skip T.PIC.LZ INSTRUMENT.7T INVENTORY
18794>>1	ubyte	<64
18795# skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)"
18796# by looking for printable characters at beginning of file name
18797>>>2	ubelong	>0x1F000000
18798# zero fill, must be zero for compatibility
18799>>>>74	byte	0
18800# zero fill, must be zero for compatibility
18801>>>>>82	byte	0
18802# MacBinary I		test for valid version numbers
18803>>>>>>122	ubeshort	0
18804# additional check for creation date after 1 Jan 1970 ~ 7C25B080h
18805#>>>>>>>91	ubelong		>0x7c25b07F
18806# additional check for undefined header fields in MacBinary I
18807#>>>>>>>101	ulong		0
18808>>>>>>>0	use	mac-bin
18809# MacBinary II		the newer versions begins at 129
18810>>>>>>122	ubeshort	0x8181
18811>>>>>>>0	use	mac-bin
18812# MacBinary III with MacBinary II to read
18813>>>>>122	ubeshort	0x8281
18814>>>>>>0	use	mac-bin
18815
18816#	display information of MacBinary file
188170	name		mac-bin
18818>122	ubyte	x	MacBinary
18819# versions for MacBinary II/III
18820>122	ubyte	129		II
18821>122	ubyte	130		III
18822# only in MacBinary III
18823>>102	string	!mBIN		with surprising version
18824!:mime	application/x-macbinary
18825!:apple	PSPTBINA
18826!:ext	bin/macbin
18827# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary
18828#>1	ubyte	>63		\b, name length %u too BIG!
18829#>122	ubeshort	x	\b, version 0x%x
18830# Finder flags if not 0
18831# >73	byte		!0		\b, flags 0x
18832# >73	byte		=0
18833# >>101	byte		!0		\b, flags 0x
18834# # original Finder flags (Bits 8-15)
18835# >73	byte		!0		\b%x
18836# # finder flags, bits 0-7
18837# >101	byte		!0		\b%x
18838>73	byte		&0x01		\b, inited
18839>73	byte		&0x02		\b, changed
18840>73	byte		&0x04		\b, busy
18841>73	byte		&0x08		\b, bozo
18842>73	byte		&0x10		\b, system
18843>73	byte		&0x20		\b, bundle
18844>73	byte		&0x40		\b, invisible
18845>73	byte		&0x80		\b, locked
18846
18847# 75	beshort				# vertical posn in window
18848#>75	beshort		!0		\b, v.pos %u
18849# 77	beshort				# horiz posn in window
18850#>77	beshort		!0		\b, h.pos %u
18851# 79	beshort				# window or folder ID
18852>79	ubeshort	!0		\b, ID 0x%x
18853# protected flag
18854>81	byte		!0		\b, protected 0x%x
18855# length of comment after resource
18856>99	ubeshort	!0		\b, comment length %u
18857# char. code of file name
18858>106	ubyte		!0		\b, char. code 0x%x
18859# still more Finder flags
18860>107	ubyte		!0		\b, more flags 0x%x
18861# length of total files when unpacked only used when pack and unpack on the fly
18862>116	ubelong		!0		\b, total length %u
18863# 120	beshort				# length of add'l header
18864>120	ubeshort	!0		\b, 2nd header length %u
18865# 124	beshort				# checksum
18866#>124	ubeshort	!0		\b, CRC 0x%x
18867# creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080
18868>91	beldate-0x7C25B080	x	\b, %s
18869# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow
18870>91	ubelong		<0x7c25b080	INVALID date
18871#>91	belong-0x7C25B080	x	\b, DEBUG DATE %d
18872# last modified date
18873>95	beldate-0x7C25B080	x	\b, modified %s
18874# Apple creator+typ if not null
18875# file creator (normally expressed as four characters)
18876>69	ulong			!0	\b, creator
18877# instead 4 character code display full creator name
18878>>69	use			apple-creator
18879# file type (normally expressed as four characters)
18880>65	ulong			!0	\b, type
18881>>65	use			apple-type
18882# length of data segment
18883>83	ubelong			!0	\b, %u bytes
18884# filename (in the range 1-63)
18885>1	pstring			x	"%s"
18886# print 1 space and then at offset 128 inspect data fork content if it has one
18887>83	ubelong			!0	\b
18888>>128	indirect		x
18889# Afterwards resource fork if length of resource segment not zero
18890>87	ubelong			!0
18891# calculate resource fork offset
18892>>83	ubelong+128		x	\b, at 0x%x
18893# length of resource segment
18894>>87	ubelong			!0	%u bytes
18895>>(83.S+128)	ubequad		x	resource
18896# further resource fork content inspection
18897>>>&-8	indirect		x
18898
18899# Apple Type/Creator Database
18900# URL: https://en.wikipedia.org/wiki/Type_code
18901# Reference:	https://www.lacikam.co.il/tcdb/
18902#		https://www.macdisk.com/macsigen.php
18903# Note:	classic Mac OS files have two 4 character codes for type and creator.
18904#	Thereby the Finder attach documents types to applications.
18905
18906#>65	string		x		\b, type "%4.4s"
18907
18908#	display information about apple type
189090	name		apple-type
18910>0	string		8BIM		PhotoShop
18911>0	string		ALB3		PageMaker 3
18912>0	string		ALB4		PageMaker 4
18913>0	string		ALT3		PageMaker 3
18914>0	string		APPL		application
18915>0	string		AWWP		AppleWorks word processor
18916>0	string		CIRC		simulated circuit
18917>0	string		DRWG		MacDraw
18918>0	string		EPSF		Encapsulated PostScript
18919>0	string		FFIL		font suitcase
18920>0	string		FKEY		function key
18921>0	string		FNDR		Macintosh Finder
18922>0	string		GIFf		GIF image
18923>0	string		Gzip		GNU gzip
18924>0	string		INIT		system extension
18925>0	string		LIB\ 		library
18926>0	string		LWFN		PostScript font
18927>0	string		MSBC		Microsoft BASIC
18928>0	string		PACT		Compact Pro archive
18929>0	string		PDF\ 		Portable Document Format
18930>0	string		PICT		picture
18931>0	string		PNTG		MacPaint picture
18932>0	string		PREF		preferences
18933>0	string		PROJ		Think C project
18934>0	string		QPRJ		Think Pascal project
18935>0	string		SCFL		Defender scores
18936>0	string		SCRN		startup screen
18937>0	string		SITD		StuffIt Deluxe
18938>0	string		SPn3		SuperPaint
18939>0	string		STAK		HyperCard stack
18940>0	string		Seg\ 		StuffIt segment
18941>0	string		TARF		Unix tar archive
18942>0	string		TEXT		ASCII
18943>0	string		TIFF		TIFF image
18944>0	string		TOVF		Eudora table of contents
18945>0	string		WDBN		Microsoft Word word processor
18946>0	string		WORD		MacWrite word processor
18947>0	string		XLS\ 		Microsoft Excel
18948>0	string		ZIVM		compress (.Z)
18949>0	string		ZSYS		Pre-System 7 system file
18950>0	string		acf3		Aldus FreeHand
18951>0	string		cdev		control panel
18952>0	string		dfil		Desk Accessory suitcase
18953>0	string		libr		library
18954>0	string		nX^d		WriteNow word processor
18955>0	string		nX^w		WriteNow dictionary
18956>0	string		rsrc		resource
18957>0	string		scbk		Scrapbook
18958>0	string		shlb		shared library
18959>0	string		ttro		SimpleText read-only
18960>0	string		zsys		system file
18961
18962#	additional types added in Dec 2017
18963>0	string		BINA		binary file
18964>0	string		BMPp		BMP image
18965>0	string		JPEG		JPEG image
18966#>0	string		W4BN		Microsoft Word x.y word processor?
18967# if type name is not known display 4 character identifier
18968>0	default		x
18969>>0	string		x		'%4.4s'
18970
18971#>69	string		x		\b, creator "%4.4s"
18972
18973# Now Apple has no repository of registered Creator IDs any more. These are
18974# just the ones that I happened to have files from and was able to identify.
18975
18976#	display information about apple creator
189770	name		apple-creator
18978>0	string		8BIM		Adobe Photoshop
18979>0	string		ALD3		PageMaker 3
18980>0	string		ALD4		PageMaker 4
18981>0	string		ALFA		Alpha editor
18982>0	string		APLS		Apple Scanner
18983>0	string		APSC		Apple Scanner
18984>0	string		BRKL		Brickles
18985>0	string		BTFT		BitFont
18986>0	string		CCL2		Common Lisp 2
18987>0	string		CCL\ 		Common Lisp
18988>0	string		CDmo		The Talking Moose
18989>0	string		CPCT		Compact Pro
18990>0	string		CSOm		Eudora
18991>0	string		DMOV		Font/DA Mover
18992>0	string		DSIM		DigSim
18993>0	string		EDIT		Macintosh Edit
18994>0	string		ERIK		Macintosh Finder
18995>0	string		EXTR		self-extracting archive
18996>0	string		Gzip		GNU gzip
18997>0	string		KAHL		Think C
18998>0	string		LWFU		LaserWriter Utility
18999>0	string		LZIV		compress
19000>0	string		MACA		MacWrite
19001>0	string		MACS		Macintosh operating system
19002>0	string		MAcK		MacKnowledge terminal emulator
19003>0	string		MLND		Defender
19004>0	string		MPNT		MacPaint
19005>0	string		MSBB		Microsoft BASIC (binary)
19006>0	string		MSWD		Microsoft Word
19007>0	string		NCSA		NCSA Telnet
19008>0	string		PJMM		Think Pascal
19009>0	string		PSAL		Hunt the Wumpus
19010#>0	string		PSI2		Apple File Exchange
19011>0	string		R*ch		BBEdit
19012>0	string		RMKR		Resource Maker
19013>0	string		RSED		Resource Editor
19014>0	string		Rich		BBEdit
19015>0	string		SIT!		StuffIt
19016>0	string		SPNT		SuperPaint
19017>0	string		Unix		NeXT Mac filesystem
19018>0	string		VIM!		Vim editor
19019>0	string		WILD		HyperCard
19020>0	string		XCEL		Microsoft Excel
19021>0	string		aCa2		Fontographer
19022>0	string		aca3		Aldus FreeHand
19023>0	string		dosa		Macintosh MS-DOS file system
19024>0	string		movr		Font/DA Mover
19025>0	string		nX^n		WriteNow
19026>0	string		pdos		Apple ProDOS file system
19027>0	string		scbk		Scrapbook
19028>0	string		ttxt		SimpleText
19029>0	string		ufox		Foreign File Access
19030#	additional creators added in Dec 2017
19031# Claris/Apple Works
19032>0	string		BOBO		Apple Works
19033# CU-SeeMe_0.87b3_(68K).bin
19034#>0	string		CUce		bar
19035>0	string		PSPT		Apple File Exchange
19036# Disk_Copy_4.2.sea.bin
19037#>0	string		NCse		foo
19038# probably StuffIt/Aladdin by Smith Micro Software, Inc.
19039>0	string		STi0		stuffit
19040# MacGzip-1.1.3.sea.bin
19041#>0	string		aust		bar
19042# D-Disk_Copy_6.3.3.smi.bin
19043>0	string		oneb		Disk Copy Self Mounting
19044# if creator name is not known display 4 character identifier
19045>0	default		x
19046>>0	string		x		'%4.4s'
19047
19048# sas magic from Bruce Foster (bef@nwu.edu)
19049#
19050#0	string		SAS		SAS
19051#>8	string		x		%s
190520	string		SAS		SAS
19053>24	string		DATA		data file
19054>24	string		CATALOG		catalog
19055>24	string		INDEX		data file index
19056>24	string		VIEW		data view
19057# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
19058#
190590x54    string          SAS             SAS 7+
19060>0x9C   string          DATA            data file
19061>0x9C   string          CATALOG         catalog
19062>0x9C   string          INDEX           data file index
19063>0x9C   string          VIEW            data view
19064
19065# spss magic for SPSS system and portable files,
19066#	 from Bruce Foster (bef@nwu.edu).
19067
190680	long		0xc1e2c3c9	SPSS Portable File
19069>40	string 		x		%s
19070
190710	string		$FL2		SPSS System File
19072>24	string		x		%s
19073
190740	string		$FL3		SPSS System File
19075>24	string		x		%s
19076
19077# Macintosh filesystem data
19078# From "Tom N Harris" <telliamed@mac.com>
19079# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
19080# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
19081# entries depend on the data arithmetic added after v.35
19082# There's also some Pascal strings in here, ditto...
19083
19084# The boot block signature, according to IM:Files, is
19085# "for HFS volumes, this field always contains the value 0x4C4B."
19086# But if this is true for MFS or HFS+ volumes, I don't know.
19087# Alternatively, the boot block is supposed to be zeroed if it's
19088# unused, so a simply >0 should suffice.
19089
190900x400	beshort			0xD2D7		Macintosh MFS data
19091>0	beshort			0x4C4B		(bootable)
19092>0x40a	beshort			&0x8000		(locked)
19093>0x402	beldate-0x7C25B080	x		created: %s,
19094>0x406	beldate-0x7C25B080	>0		last backup: %s,
19095>0x414	belong			x		block size: %d,
19096>0x412	beshort			x		number of blocks: %d,
19097>0x424	pstring			x		volume name: %s
19098
19099# *.hfs updated by Joerg Jenderek
19100# https://en.wikipedia.org/wiki/Hierarchical_File_System
19101# "BD" gives many false positives
191020x400	beshort			0x4244
19103# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h
19104# first block of volume bit map (always 3)
19105>0x40e	ubeshort		0x0003
19106# maximal length of volume name is 27
19107>>0x424		ubyte			<28	Macintosh HFS data
19108!:mime	application/x-apple-diskimage
19109#!:apple	hfsdINIT
19110#!:apple	MACSdisk
19111# https://www.macdisk.com/macsigen.php
19112#!:apple	ddskdevi
19113!:apple	????devi
19114# https://en.wikipedia.org/wiki/Apple_Disk_Image
19115!:ext hfs/dmg
19116>>>0		beshort			0x4C4B	(bootable)
19117#>>>0		beshort			0x0000	(not bootable)
19118>>>0x40a	beshort			&0x8000	(locked)
19119>>>0x40a	beshort			^0x0100	(mounted)
19120>>>0x40a	beshort			&0x0200	(spared blocks)
19121>>>0x40a	beshort			&0x0800	(unclean)
19122>>>0x47C	beshort			0x482B	(Embedded HFS+ Volume)
19123# https://www.epochconverter.com/
19124# 0x7C245F00 seconds	~ 2082758400	~ 01 Jan 2036 00:00:00	~ 66 years to 1970
19125# 0x7C25B080 seconds	~ 2082844800	~ 02 Jan 2036 00:00:00
19126# construct not working
19127#>>>0x402	beldate-0x7C25B080	x	created: %s,
19128#>>>0x406	beldate-0x7C25B080	x	last modified: %s,
19129#>>>0x440	beldate-0x7C25B080	>0	last backup: %s,
19130# found block sizes 200h,1200h,2800h
19131>>>0x414	belong			x	block size: %d,
19132>>>0x412	beshort			x	number of blocks: %d,
19133>>>0x424	pstring			x	volume name: %s
19134
191350x400	beshort			0x482B		Macintosh HFS Extended
19136>&0	beshort			x		version %d data
19137>0	beshort			0x4C4B		(bootable)
19138>0x404	belong			^0x00000100	(mounted)
19139>&2	belong			&0x00000200	(spared blocks)
19140>&2	belong			&0x00000800	(unclean)
19141>&2	belong			&0x00008000	(locked)
19142>&6	string			x		last mounted by: '%.4s',
19143# really, that should be treated as a belong and we print a string
19144# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
19145>&14	beldate-0x7C25B080	x		created: %s,
19146# only the creation date is local time, all other timestamps in HFS+ are UTC.
19147>&18	bedate-0x7C25B080	x		last modified: %s,
19148>&22	bedate-0x7C25B080	>0		last backup: %s,
19149>&26	bedate-0x7C25B080	>0		last checked: %s,
19150>&38	belong			x		block size: %d,
19151>&42	belong			x		number of blocks: %d,
19152>&46	belong			x		free blocks: %d
19153
19154## AFAIK, only the signature is different
19155# same as Apple Partition Map
19156# GRR: This magic is too weak, it is just "TS"
19157#0x200		beshort		0x5453		Apple Old Partition data
19158#>0x2		beshort		x		block size: %d,
19159#>0x230		string		x		first type: %s,
19160#>0x210		string		x		name: %s,
19161#>0x254		belong		x		number of blocks: %d,
19162#>0x400		beshort		0x504D
19163#>>0x430		string		x		second type: %s,
19164#>>0x410		string		x		name: %s,
19165#>>0x454		belong		x		number of blocks: %d,
19166#>>0x800		beshort		0x504D
19167#>>>0x830	string		x		third type: %s,
19168#>>>0x810	string		x		name: %s,
19169#>>>0x854	belong		x		number of blocks: %d,
19170#>>>0xa00	beshort		0x504D
19171#>>>>0xa30	string		x		fourth type: %s,
19172#>>>>0xa10	string		x		name: %s,
19173#>>>>0xa54	belong		x		number of blocks: %d
19174
19175# From: Remi Mommsen <mommsen@slac.stanford.edu>
191760		string		BOMStore	Mac OS X bill of materials (BOM) file
19177
19178# From: Adam Buchbinder <adam.buchbinder@gmail.com>
19179# URL: https://en.wikipedia.org/wiki/Datafork_TrueType
19180# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
19181# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
19182# don't know what they mean.
191830	belong	0x100
19184>(0x4.L+24)	beshort	x
19185>>&4	belong	0x73666e74	Mac OSX datafork font, TrueType
19186>>&4	belong	0x464f4e54	Mac OSX datafork font, 'FONT'
19187>>&4	belong	0x4e464e54	Mac OSX datafork font, 'NFNT'
19188>>&4	belong	0x504f5354	Mac OSX datafork font, PostScript
19189
19190#------------------------------------------------------------------------------
19191# $File: macos,v 1.1 2012/12/21 16:41:07 christos Exp $
19192# MacOS files
19193#
19194
191950	string		book\0\0\0\0mark\0\0\0\0	MacOS Alias file
19196
19197#------------------------------------------------------------------------------
19198# $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $
19199# magic:  file(1) magic for magic files
19200#
192010	string/t		#\ Magic	magic text file for file(1) cmd
192020	lelong		0xF11E041C	magic binary file for file(1) cmd
19203>4	lelong		x		(version %d) (little endian)
192040	belong		0xF11E041C	magic binary file for file(1) cmd
19205>4	belong		x		(version %d) (big endian)
19206#------------------------------------------------------------------------------
19207# $File: mail.news,v 1.24 2019/04/19 00:42:27 christos Exp $
19208# mail.news:  file(1) magic for mail and news
19209#
19210# Unfortunately, saved netnews also has From line added in some news software.
19211#0	string		From 		mail text
192120	string/t		Relay-Version: 	old news text
19213!:mime	message/rfc822
192140	string/t		#!\ rnews	batched news text
19215!:mime	message/rfc822
192160	string/t		N#!\ rnews	mailed, batched news text
19217!:mime	message/rfc822
192180	string/t		Forward\ to 	mail forwarding text
19219!:mime	message/rfc822
192200	string/t		Pipe\ to 	mail piping text
19221!:mime	message/rfc822
192220	string/tc		delivered-to:	SMTP mail text
19223!:mime	message/rfc822
192240	string/tc		return-path:	SMTP mail text
19225!:mime	message/rfc822
192260	string/t		Path:		news text
19227!:mime	message/news
192280	string/t		Xref:		news text
19229!:mime	message/news
192300	string/t		From:		news or mail text
19231!:mime	message/rfc822
192320	string/t		Article 	saved news text
19233!:mime	message/news
192340	string/t		BABYL		Emacs RMAIL text
192350	string/t		Received:	RFC 822 mail text
19236!:mime	message/rfc822
192370	string/t		MIME-Version:	MIME entity text
19238#0	string/t		Content-	MIME entity text
19239
19240# TNEF files...
192410	lelong		0x223E9F78	Transport Neutral Encapsulation Format
19242!:mime	application/vnd.ms-tnef
19243
19244# From: Kevin Sullivan <ksulliva@psc.edu>
192450	string		*mbx*		MBX mail folder
19246
19247# From: Simon Matter <simon.matter@invoca.ch>
192480	string		\241\002\213\015skiplist\ file\0\0\0	Cyrus skiplist DB
192490	string		\241\002\213\015twoskip\ file\0\0\0\0	Cyrus twoskip DB
19250
19251# JAM(mbp) Fidonet message area databases
19252# JHR file
192530	string	JAM\0			JAM message area header file
19254>12	leshort >0			(%d messages)
19255
19256# Squish Fidonet message area databases
19257# SQD file (requires at least one message in the area)
19258# XXX: Weak magic
19259#256	leshort	0xAFAE4453		Squish message area data file
19260#>4	leshort	>0			(%d messages)
19261
19262#0	string		\<!--\ MHonArc		text/html; x-type=mhonarc
19263
19264# Cyrus: file(1) magic for compiled Cyrus sieve scripts
19265# URL: https://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php
19266# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master
19267# From: Philipp Hahn <hahn@univention.de>
19268
19269# Compiled Cyrus sieve script
192700       string CyrSBytecode     Cyrus sieve bytecode data,
19271>12     belong =1       version 1, big-endian
19272>12     lelong =1       version 1, little-endian
19273>12     belong x        version %d, network-endian
19274#------------------------------------------------------------------------------
19275# $File: make,v 1.4 2018/05/29 17:26:02 christos Exp $
19276# make:  file(1) magic for makefiles
19277#
19278# URL: https://en.wikipedia.org/wiki/Make_(software)
192790	regex/100l	\^CFLAGS	makefile script text
19280!:mime	text/x-makefile
192810	regex/100l	\^VPATH		makefile script text
19282!:mime	text/x-makefile
192830	regex/100l	\^LDFLAGS	makefile script text
19284!:mime	text/x-makefile
192850	regex/100l	\^all:		makefile script text
19286!:mime	text/x-makefile
192870	regex/100l	\^\\.PRECIOUS	makefile script text
19288!:mime	text/x-makefile
19289# Update: Joerg Jenderek
19290# Reference: https://www.freebsd.org/cgi/man.cgi?make(1)
19291# exclude grub-core\lib\libgcrypt\mpi\Makefile.am with "#BEGIN_ASM_LIST"
19292# by additional escaping point character
192930	regex/100l	\^\\.BEGIN	BSD makefile script text
19294!:mime	text/x-makefile
19295!:ext	/mk
19296!:strength +10
19297# exclude MS Windows help file CoNtenT with ":include FOOBAR.CNT"
19298# and NSIS script with "!include" by additional escaping point character
192990	regex/100l	\^\\.include	BSD makefile script text
19300!:mime	text/x-makefile
19301!:ext	/mk
19302!:strength +10
193030	regex/100l	\^\\.endif	BSD makefile script text
19304!:mime	text/x-makefile
19305!:ext	/mk
19306!:strength +10
193070	regex/100l	\^SUBDIRS	automake makefile script text
19308!:mime	text/x-makefile
19309!:strength +10
19310
19311
19312#------------------------------------------------------------------------------
19313# $File: map,v 1.7 2019/04/30 04:02:04 christos Exp $
19314# map:  file(1) magic for Map data
19315#
19316
19317# Garmin .FIT files https://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
193188	string	.FIT		FIT Map data
19319>15	byte	0
19320>>35	belong	x		\b, unit id %d
19321>>39	lelong	x		\b, serial %u
19322# https://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
19323# 20 years after unix epoch
19324# TZ=GMT date -d '1989-12-31 0:00' +%s
19325>>43	leldate+631065600	x	\b, %s
19326
19327>>47	leshort x		\b, manufacturer %d
19328>>47	leshort	1		\b (garmin)
19329>>49	leshort x		\b, product %d
19330>>53	byte	x		\b, type %d
19331>>53	byte	1		\b (Device)
19332>>53	byte	2		\b (Settings)
19333>>53	byte	3		\b (Sports/Cycling)
19334>>53	byte	4		\b (Activity)
19335>>53	byte	8		\b (Elevations)
19336>>53	byte	10		\b (Totals)
19337
19338# Summary: Garmin map
19339# From:	Joerg Jenderek
19340# URL: https://en.wikipedia.org/wiki/Garmin_.img
19341# Reference: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/IMG_File_Format
19342# sourceforge.net/projects/garmin-img/files/IMG%20File%20Format/1.0/imgformat-1.0.pdf
19343# GRR: similar to MBR boot sector handled by ./filesystems
193440x1FE	leshort		=0xAA55
19345# look for valid map signature
19346>0x13	string		=IMG\0
19347>>0	use		garmin-map
193480	name				garmin-map
19349>0	ubyte		x		Garmin
19350!:mime	application/x-garmin-map
19351# If non-zero, every byte of the entire .img file is to be XORed with this value
19352>0	ubyte		!0		\b, 0x%x XORed
19353# goto block before FAT
19354>(0x40.b*512)	ubyte	x
19355# 1st fat name "DLLINFO TXT" only found for vpm
19356>>&512 		string	=DLLINFO\ TXT 	map (Voice Processing)
19357# there exist 2 other Garmin VPM formats; see ./audio
19358!:ext	vpm
19359# Deutsch__Yannick_D4481-00_0210.vpm
19360#>>>512	search/0x0116da60/s	RIFF	\b; with
19361# determine type voice type by ./riff
19362#>>>>&0	indirect	x	\b
19363>>&512 		string	!DLLINFO\ TXT 	map
19364!:ext	img
19365# 9 zeros
19366>1 	ubelong		!0 		\b, zeroes 0x%x
19367# Map's version major
19368>8	ubyte		x		v%u
19369# Map's version minor
19370>9	ubyte		x		\b.%.2u
19371# Map description[20], 0x20 padded
19372>0x49	string		x		%.20s
19373# Map name, continued (0x20 padded, \0 terminated)
19374>0x65	string		>\ 		\b%.31s
19375# Update year (+1900 for val >= 0x63, +2000 for val <= 0x62)
19376>0xB	ubyte		x		\b, updated
19377>>0xB	ubyte		>0x62
19378>>>0xB	ubyte-100	x		20%.2u
19379>>0xB	ubyte		<0x63
19380>>>0xB	ubyte		x		20%.2u
19381# Update month (0-11)
19382>0xA	ubyte		x		\b-%.2u
19383# All zeroes
19384>0xc 	uleshort	!0 		\b, zeroes 0x%x
19385# Mapsource flag, 1 - file created by Mapsource, 0 - Garmin map visible in Basecamp and Homeport
19386#>0xE	ubyte		!0		\b, Mapsource flag 0x%x
19387>0xE	ubyte		1		\b, Mapsource
19388# Checksum, sum of all bytes modulo 256 should be 0
19389#>0xF	ubyte		x		\b, Checksum 0x%x
19390# Signature: DSKIMG 0x00 or DSDIMG 0x00 for demo map
19391>0x10	string		!DSKIMG		\b, signature "%.7s"
19392>0x39	use		garmin-date
19393# Map file identifier like GARMIN\0
19394>0x41	string		!GARMIN		\b, id "%.7s"
19395# Block size exponent, E1; appears to always be 0x09; minimum block size 512 bytes
19396>0x61	ubyte		!0x09		\b, E1=%u
19397# Block size exponent, E2 ; file blocksize=2**(E1+E2)
19398>>0x62	ubyte		x		\b, E2=%u
19399>0x61	ubyte		=0x09		\b, blocksize
19400>>0x62	ubyte		0		512
19401>>0x62	ubyte		1		1024
19402>>0x62	ubyte		2		2048
19403>>0x62	ubyte		3		4096
19404>>0x62	ubyte		4		8192
19405>>0x62	ubyte		5		16384
19406>>0x62	default		x
19407>>>0x62	ubyte		x		E2=%u
19408# MBR signature
19409>0x1FE	leshort		!0xAA55		\b, invalid MBR
19410# 512 zeros
19411>0x200 	uquad		!0		\b, zeroes 0x%llx
19412# First sub-file offset (absolute); sometimes NO/UNKNOWN sub file!
19413>0x40C	ulelong		>0		\b, at 0x%x
19414# sub-file Header length
19415#>>(0x40C.l)	uleshort	x	\b, header len 0x%x
19416>>(0x40C.l)	uleshort	x	%u bytes
19417# sub-file Type[10] like "GARMIN RGN" "GARMIN TRE", "GARMIN TYP", etc.
19418>>(0x40C.l+2)	ubyte	>0x1F
19419>>>(0x40C.l+2)	ubyte	<0xFF
19420>>>>(0x40C.l+2)	string	x		"%.10s"
19421# 0x00 for most maps, 0x80 for locked maps (City Nav, City Select, etc.)
19422>>>>(0x40C.l+13)	ubyte	>0		\b, locked 0x%x
19423# Block sequence numbers like 0000 0100 0200 ... FFFF
19424# >0x420	ubequad		>0	\b, seq. 0x%16.16llx
19425# >>0x428	ubequad		>0	\b%16.16llx
19426# >>>0x430	ubequad	>0	\b%16.16llx
19427# >>>>0x438	ubequad	>0	\b%16.16llx
19428# >>>>>0x440	ubequad	>0	\b%16.16llx
19429# >>>>>>0x448	ubequad	>0	\b%16.16llx
19430# >>>>>>>0x450	ubequad	>0	\b%16.16llx
19431# >>>>>>>>0x458	ubequad	>0	\b%16.16llx
19432# >>>>>>>>>0x460	ubequad	>0	\b%16.16llx
19433# >>>>>>>>>>0x468	ubequad	>0	\b%16.16llx
19434# >>>>>>>>>>>0x470	ubequad	>0	\b%16.16llx
19435# >>>>>>>>>>>>0x478	ubequad	>0	\b%16.16llx
19436# >>>>>>>>>>>>>0x480	ubequad	>0	\b%16.16llx
19437# >>>>>>>>>>>>>>0x488	ubequad	>0	\b%16.16llx
19438# >>>>>>>>>>>>>>>0x490	ubequad	>0	\b%16.16llx
19439# >>>>>>>>>>>>>>>>0x498	ubequad	>0	\b%16.16llx
19440# >>>>>>>>>>>>>>>>>0x4A0	ubequad	>0	\b%16.16llx
19441# >>>>>>>>>>>>>>>>>>0x4A8	ubequad	>0	\b%16.16llx
19442# look for end of FAT
19443#>>0x420	search/512/s	\xff\xff	FAT END
19444# Physical block number of FAT header
19445#>0x40	ubyte		x		\b, FAT at phy. block %u
19446>0x40	ubyte		x
19447>>(0x40.b*512)	ubyte	x
19448# 1st FAT block
19449>>>&511 	use	garmin-fat
19450# 2nd FAT block
19451>>>&1023 	use	garmin-fat
19452# 3th FAT block
19453>>>&1535 	use	garmin-fat
19454# 4th FAT block
19455>>>&2047 	use	garmin-fat
19456# ... xth FAT block
19457#
19458# 314 zeros but not in vpm and also gmaptz.img
19459>0x84 	uquad		!0		\b, at 0x84 0x%llx
19460# display FileAllocationTable block entry in garmin map
194610	name				garmin-fat
19462>0	ubyte		x		\b;
19463# sub file part; 0x0003 seems to be garbage
19464>0x10	uleshort	!0		next 0x%4.4x
19465>0x10	uleshort	=0
19466# fat flag 0~dummy block 1~true sub file
19467>>0	ubyte		!1		flag %u
19468>>0	ubyte		=1
19469# sub-file name like MAKEGMAP 12345678
19470>>>0x1	string		x		%.8s
19471# sub-file typ like RGN TRE MDR LBL
19472>>>0x9	string		x		\b.%.3s
19473# size of sub file
19474>>>0xC	ulelong		x		\b, %u bytes
19475# 32-bit block sequence numbers
19476#>>>0x20	ubequad		x		\b, seq. 0x%16.16llx
19477
19478#	display date stored inside Garmin maps like yyyy-mm-dd h:mm:ss
194790	name				garmin-date
19480# year like 2018
19481>0 	uleshort	x 		\b, created %u
19482# month (0-11)
19483>2	ubyte		x		\b-%.2u
19484# day (1-31)
19485>3	ubyte		x		\b-%.2u
19486# hour (0-23)
19487>4	ubyte		x		%u
19488# minute (0-59)
19489>5	ubyte		x		\b:%.2u
19490# second (0-59)
19491>6	ubyte		x		\b:%.2u
19492
19493# Summary: Garmin Map subfiles
19494# From:	Joerg Jenderek
19495# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/IMG_File_Format
19496# Garmin Common Header
194972	string	GARMIN\
19498# skip ASCII text by checking for low header length
19499>0	uleshort <0x1000	Garmin map,
19500# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/GMP_Subfile_Format
19501>>9	string	GMP				subtile
19502!:mime			application/x-garmin-gpm
19503!:ext			gmp
19504# copyright message
19505>>>(0.s)		string		x	%s
19506>>>0x0E 		use		garmin-date
19507# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/MDR_Subfile_Format
19508# This contains the searchable address table used for finding routing destinations
19509>>9	string	MDR				address table
19510!:mime			application/x-garmin-mdr
19511!:ext			mdr
19512# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/NOD_Subfile_Format
19513# http://svn.parabola.me.uk/display/trunk/doc/nod.txt
19514# This contains the routing information
19515>>9	string	NOD				routing
19516!:mime			application/x-garmin-nod
19517!:ext			nod
19518>>>0x0E 		use		garmin-date
19519#>>>0x15			ulelong		x	\b, at 0x%x
19520#>>>0x19			ulelong		x	0x%x bytes NOD1
19521#>>>0x25			ulelong		x	\b, at 0x%x
19522#>>>0x29			ulelong		x	0x%x bytes NOD2
19523#>>>0x31			ulelong		x	\b, at 0x%x
19524#>>>0x35			ulelong		x	0x%x bytes NOD3
19525# URL: http://www.pinns.co.uk/osm/net.html
19526# routable highways (length, direction, allowed speed,house address information)
19527>>9	string	NET				highways
19528!:mime			application/x-garmin-net
19529!:ext			net
19530#>>>0x15			ulelong		x	\b, at 0x%x
19531#>>>0x19			ulelong		x	0x%x bytes NET1
19532#>>>0x22			ulelong		>0
19533#>>>>0x1E		ulelong		x	\b, at 0x%x
19534#>>>>0x22		ulelong		x	0x%x bytes NET2
19535#>>>0x2B			ulelong		>0
19536#>>>>0x27		ulelong		x	\b, at 0x%x
19537#>>>>0x2B		ulelong		x	0x%x bytes NET3
19538# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/LBL_Subfile_Format
19539>>9	string	LBL				labels
19540!:mime			application/x-garmin-lbl
19541!:ext			lbl
19542>>>(0.s)		string	x	%s
19543# Label coding type 6h 9h and ah
19544>>>0x1E			ubyte		x	\b, coding type 0x%x
19545#>>>0x15			ulelong		x	\b, at 0x%x
19546#>>>0x19			ulelong		x	0x%x bytes LBL1
19547#>>>0x1F			ulelong		x	\b, at 0x%x
19548#>>>0x23			ulelong		x	0x%x bytes LBL2
19549#>>>0x2D			ulelong		x	\b, at 0x%x
19550#>>>0x31			ulelong		x	0x%x bytes LBL3
19551# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/SRT_Subfile_Format
19552# A lookup table of the chars in the map's codepage, and their collating sequence
19553>>9	string	SRT				sort table
19554!:mime			application/x-garmin-srt
19555!:ext			srt
19556>>>0x0E 		use		garmin-date
19557# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/TRE_Subfile_Format
19558>>9	string	TRE				tree
19559!:mime			application/x-garmin-tre
19560!:ext			tre
19561# title like City Nav Europe NTU 2019.2 Basemap
19562# or OSM Street map
19563>>>(0.s)		string		x	%s
19564# 2nd title like Copyright 1995-2018 by GARMIN Corporation.
19565# or http://www.openstreetmap.org/
19566>>>>&1			string		x	%s
19567>>>0x0E 		use		garmin-date
19568#>>>0x21			ulelong		x	\b, at 0x%x
19569#>>>0x25			ulelong		x	0x%x bytes TRE1
19570#>>>0x29			ulelong		x	\b, at 0x%x
19571#>>>0x2D			ulelong		x	0x%x bytes TRE2
19572#>>>0x31			ulelong		x	\b, at 0x%x
19573#>>>0x35			ulelong		x	0x%x bytes TRE3
19574# Copyright record size
19575#>>>0x39			uleshort	x	\b, copyright record size %u
19576# Map ID
19577>>>0x74			ulelong		x	\b, ID 0x%x
19578# URL: https://www.gpspower.net/garmin-tutorials/353310-basecamp-installing-free-desktop-map.html
19579# For road traffic information service (RDS/TMS/TMC). Commonly seen in City Navigator maps
19580>>9	string	TRF				traffic,
19581!:mime			application/x-garmin-trf
19582!:ext			trf
19583# city/region like Preitenegg
19584>>>(0.s+1) 		string		x	1st %s
19585# highway part like L606/L148
19586>>>>&1			string		x	%s
19587# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/Format
19588# Reference: http://www.pinns.co.uk/osm/typformat.html
19589# customize the appearance of objects. For GPS and MapSource/Qlandkarte better looking maps
19590>>9	string	TYP				types
19591!:mime			application/x-garmin-typ
19592!:ext			typ
19593>>>0x0E 		use		garmin-date
19594# character set 1252 65001~UTF8
19595>>>0x15			uleshort	x	\b, code page %u
19596# POIs
19597#>>>0x17			ulelong		x	\b, at 0x%x
19598#>>>0x1B			ulelong		x	0x%x bytes TYP1
19599# extra pois
19600#>>>0x5B			ulelong		x	\b, at 0x%x
19601#>>>0x5F			ulelong		x	0x%x bytes TYP8
19602# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/RGN_Subfile_Format
19603# http://www.pinns.co.uk/osm/RGN.html
19604# region data used by the Garmin software
19605>>9	string	RGN				region
19606!:mime			application/x-garmin-rgn
19607!:ext			rgn
19608# POIs,Indexed POIs,Polylines or Polygons or first map level
19609#>>>0x15			ulelong	       x	\b, at 0x%x
19610#>>>0x19			ulelong	       x	0x%x bytes RGN1
19611# polygons with extended types
19612#>>>0x21			ulelong	       >0
19613#>>>>0x1D		ulelong	       x	\b, at 0x%x
19614#>>>>0x21		ulelong	       x	0x%x bytes RGN2
19615# polylines with extended types
19616#>>>0x3D			ulelong	       >0
19617#>>>>0x39		ulelong	       x	\b, at 0x%x
19618#>>>>0x3D		ulelong	       x	0x%x bytes RGN3
19619# extended POIs
19620#>>>0x59			ulelong	       >0
19621#>>>>0x55		ulelong	       x	\b, at 0x%x
19622#>>>>0x59		ulelong	       x	0x%x bytes RGN3
19623#>>9	default		x		unknown map type
19624# Header length; GMP:31h 35h 3Dh,MDR:11Eh 238h 2C4h 310h,NOD:3Fh 7Fh,NET:64h,
19625# LBL:2A9h,SRT:1Dh 25h 27h,TRE:CFh 135h,TRF:5Ah,TYP:5Bh 6Eh 7Ch AEh,RGN:7Dh
19626>>0	uleshort	x		\b, header length 0x%x
19627
19628# TOM TOM GPS watches ttbin files:
19629# https://github.com/ryanbinns/ttwatch/tree/master/ttbin
19630# From: Daniel Lenski
196310	byte	0x20
19632>1	leshort	0x0007
19633>>0x76	byte	0x20
19634>>>0x77	leshort	0x0075		TomTom activity file, v7
19635>>>>8	leldate	x		(%s,
19636>>>>3	byte    x		device firmware %d.
19637>>>>4	byte	x		\b%d.
19638>>>>5	byte	x		\b%d,
19639>>>>6	leshort	x		product ID %04d)
19640
19641
19642#------------------------------------------------------------------------------
19643# $File: maple,v 1.8 2017/03/17 21:35:28 christos Exp $
19644# maple:  file(1) magic for maple files
19645# "H. Nanosecond" <aldomel@ix.netcom.com>
19646# Maple V release 4, a multi-purpose math program
19647#
19648
19649# maple library .lib
196500	string	\000MVR4\nI	MapleVr4 library
19651
19652# .ind
19653# no magic for these :-(
19654# they are compiled indexes for maple files
19655
19656# .hdb
196570	string	\000\004\000\000	Maple help database
19658
19659# .mhp
19660# this has the form <PACKAGE=name>
196610	string	\<PACKAGE=	Maple help file
196620	string	\<HELP\ NAME=	Maple help file
196630	string	\n\<HELP\ NAME=	Maple help file with extra carriage return at start (yuck)
19664#0	string	#\ Newton	Maple help file, old style
196650	string	#\ daub	Maple help file, old style
19666#0	string	#===========	Maple help file, old style
19667
19668# .mws
196690	string	\000\000\001\044\000\221	Maple worksheet
19670#this is anomalous
196710	string	WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000	Maple worksheet, but weird
19672# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n
19673# that is {VERSION major_version miunor_version computer_type version_string}
196740	string	{VERSION\ 	Maple worksheet
19675>9	string	>\0	version %.1s.
19676>>11	string	>\0	%.1s
19677
19678# .mps
196790	string	\0\0\001$	Maple something
19680# from byte 4 it is either 'nul E' or 'soh R'
19681# I think 'nul E' means a file that was saved as  a different name
19682# a sort of revision marking
19683# 'soh R' means new
19684>4	string	\000\105	An old revision
19685>4	string	\001\122	The latest save
19686
19687# .mpl
19688# some of these are the same as .mps above
19689#0000000 000 000 001 044 000 105 same as .mps
19690#0000000 000 000 001 044 001 122 same as .mps
19691
196920	string	#\n##\ <SHAREFILE=	Maple something
196930	string	\n#\n##\ <SHAREFILE=	Maple something
196940	string	##\ <SHAREFILE=	Maple something
196950	string	#\r##\ <SHAREFILE=	Maple something
196960	string	\r#\r##\ <SHAREFILE=	Maple something
196970	string	#\ \r##\ <DESCRIBE>	Maple something anomalous.
19698#--------------------------------------------
19699# marc21: file(1) magic for MARC 21 Format
19700#
19701# Kevin Ford (kefo@loc.gov)
19702#
19703# MARC21 formats are for the representation and communication
19704# of bibliographic and related information in machine-readable
19705# form.  For more info, see https://www.loc.gov/marc/
19706
19707
19708# leader position 20-21 must be 45
19709# and 22-23 also 00 so far, but we check that later.
1971020	string		45
19711>0	search/2048	\x1e
19712
19713# leader starts with 5 digits, followed by codes specific to MARC format
19714>>0	regex/1l	(^[0-9]{5})[acdnp][^bhlnqsu-z]	MARC21 Bibliographic
19715!:mime	application/marc
19716>>0	regex/1l	(^[0-9]{5})[acdnosx][z]	MARC21 Authority
19717!:mime	application/marc
19718>>0	regex/1l	(^[0-9]{5})[cdn][uvxy]	MARC21 Holdings
19719!:mime	application/marc
19720>>0	regex/1l	(^[0-9]{5})[acdn][w]	MARC21 Classification
19721!:mime	application/marc
19722>>0	regex/1l	(^[0-9]{5})[cdn][q]	MARC21 Community
19723!:mime	application/marc
19724
19725# leader position 22-23, should be "00" but is it?
19726>>0	regex/1l	(^.{21})([^0]{2})	(non-conforming)
19727!:mime	application/marc
19728
19729#------------------------------------------------------------------------------
19730# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $
19731# mathcad:  file(1) magic for Mathcad documents
19732# URL:	http://www.mathsoft.com/
19733# From:	Josh Triplett <josh@freedesktop.org>
19734
197350	string	.MCAD\t		Mathcad document
19736
19737#------------------------------------------------------------------------------
19738# $File: mathematica,v 1.9 2017/03/17 21:35:28 christos Exp $
19739# mathematica:  file(1) magic for mathematica files
19740# "H. Nanosecond" <aldomel@ix.netcom.com>
19741# Mathematica a multi-purpose math program
19742# versions 2.2 and 3.0
19743
19744#mathematica .mb
197450	string	\064\024\012\000\035\000\000\000	Mathematica version 2 notebook
19746!:ext mb
197470	string	\064\024\011\000\035\000\000\000	Mathematica version 2 notebook
19748!:ext mb
19749
19750# .ma
19751# multiple possibilites:
19752
197530	string	(*^\n\n::[\011frontEndVersion\ =\ 	Mathematica notebook
19754#>41	string	>\0	%s
19755!:ext mb
19756
19757#0	string	(*^\n\n::[\011palette	Mathematica notebook version 2.x
19758
19759#0	string	(*^\n\n::[\011Information	Mathematica notebook version 2.x
19760#>675	string	>\0	%s #doesn't work well
19761
19762# there may be 'cr' instread of 'nl' in some does this matter?
19763
19764# generic:
197650	string	(*^\r\r::[\011	Mathematica notebook version 2.x
19766!:ext mb
197670	string	(*^\r\n\r\n::[\011	Mathematica notebook version 2.x
19768!:ext mb
197690	string	(*^\015			Mathematica notebook version 2.x
19770!:ext mb
197710	string	(*^\n\r\n\r::[\011	Mathematica notebook version 2.x
19772!:ext mb
197730	string	(*^\r::[\011	Mathematica notebook version 2.x
19774!:ext mb
197750	string	(*^\r\n::[\011	Mathematica notebook version 2.x
19776!:ext mb
197770	string	(*^\n\n::[\011	Mathematica notebook version 2.x
19778!:ext mb
197790	string	(*^\n::[\011	Mathematica notebook version 2.x
19780!:ext mb
19781
19782
19783# Mathematica .mx files
19784
19785#0	string	(*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*)	Mathematica binary file
197860	string	(*This\ is\ a\ Mathematica\ binary\ 	Mathematica binary file
19787#>71	string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
19788# >71... is optional
19789>88	string	>\0	from %s
19790
19791
19792# Mathematica files PBF:
19793# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000
197940	string	MMAPBF\000\001\000\000\000\203\000\001\000	Mathematica PBF (fonts I think)
19795
19796# .ml files  These are menu resources I think
19797# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
19798# how to put that into a magic rule?
197994	string	\ A~	MAthematica .ml file
19800
19801# .nb files
19802#too long 0	string	(***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook	Mathematica 3.0 notebook
198030	string	(***********************	Mathematica 3.0 notebook
19804
19805# other (* matches it is a comment start in these langs
19806# GRR: Too weak; also matches other languages e.g. ML
19807#0	string	(*	Mathematica, or Pascal, Modula-2 or 3 code text
19808
19809#########################
19810# MatLab v5
198110       string  MATLAB  Matlab v5 mat-file
19812>126    short   0x494d  (big endian)
19813>>124   beshort x       version 0x%04x
19814>126    short   0x4d49  (little endian)
19815>>124   leshort x       version 0x%04x
19816
19817
19818#------------------------------------------------------------------------------
19819# $File: matroska,v 1.9 2019/04/19 00:42:27 christos Exp $
19820# matroska:  file(1) magic for Matroska files
19821#
19822# See https://www.matroska.org/
19823#
19824
19825# EBML id:
198260		belong		0x1a45dfa3
19827# DocType id:
19828>4		search/4096 	\x42\x82
19829# DocType contents:
19830>>&1		string		webm		WebM
19831!:mime  video/webm
19832>>&1		string		matroska	Matroska data
19833!:mime  video/x-matroska
19834
19835#------------------------------------------------------------------------------
19836# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $
19837# Mavroyanopoulos Nikos <nmav@hellug.gr>
19838# mcrypt:   file(1) magic for mcrypt 2.2.x;
198390	string		\0m\3		mcrypt 2.5 encrypted data,
19840>4	string		>\0		algorithm: %s,
19841>>&1	leshort		>0		keysize: %d bytes,
19842>>>&0	string		>\0		mode: %s,
19843
198440	string		\0m\2		mcrypt 2.2 encrypted data,
19845>3	byte		0		algorithm: blowfish-448,
19846>3	byte		1		algorithm: DES,
19847>3	byte		2		algorithm: 3DES,
19848>3	byte		3		algorithm: 3-WAY,
19849>3	byte		4		algorithm: GOST,
19850>3	byte		6		algorithm: SAFER-SK64,
19851>3	byte		7		algorithm: SAFER-SK128,
19852>3	byte		8		algorithm: CAST-128,
19853>3	byte		9		algorithm: xTEA,
19854>3	byte		10		algorithm: TWOFISH-128,
19855>3	byte		11		algorithm: RC2,
19856>3	byte		12		algorithm: TWOFISH-192,
19857>3	byte		13		algorithm: TWOFISH-256,
19858>3	byte		14		algorithm: blowfish-128,
19859>3	byte		15		algorithm: blowfish-192,
19860>3	byte		16		algorithm: blowfish-256,
19861>3	byte		100		algorithm: RC6,
19862>3	byte		101		algorithm: IDEA,
19863>4	byte		0		mode: CBC,
19864>4	byte		1		mode: ECB,
19865>4	byte		2		mode: CFB,
19866>4	byte		3		mode: OFB,
19867>4	byte		4		mode: nOFB,
19868>5	byte		0		keymode: 8bit
19869>5	byte		1		keymode: 4bit
19870>5	byte		2		keymode: SHA-1 hash
19871>5	byte		3		keymode: MD5 hash
19872
19873#------------------------------------------------------------------------------
19874# $File: measure,v 1.2 2018/06/23 16:13:15 christos Exp $
19875# measure: file(1) magic for measurement data
19876
19877# DIY-Thermocam raw data
198780	name	diy-thermocam-parser
19879>0	beshort	x	scale %d-
19880>2	beshort x	\b%d,
19881>4	lefloat	x	spot sensor temperature %f,
19882>9	ubyte	0	unit celsius,
19883>9	ubyte	1	unit fahrenheit,
19884>8	ubyte	x	color scheme %d
19885>10	ubyte	1	\b, show spot sensor
19886>11	ubyte	1	\b, show scale bar
19887>12	ubyte	&1	\b, minimum point enabled
19888>12	ubyte	&2	\b, maximum point enabled
19889>13	lefloat	x	\b, calibration: offset %f,
19890>17	lefloat x	slope %f
19891
198920	name	diy-thermocam-checker
19893>9	ubyte	<2
19894>>10	ubyte	<2
19895>>>11	ubyte	<2
19896>>>>12	ubyte	<4
19897>>>>>17	lefloat	>0.0001	DIY-Thermocam raw data
19898
19899# V2 and Leption 3.x:
1990038408	ubyte	<19
19901>38400	use	diy-thermocam-checker
19902>>38400	default x	(Lepton 3.x),
19903>>>38400	use	diy-thermocam-parser
19904
19905# V1 or Lepton 2.x
199069608	ubyte	<19
19907>9600	use	diy-thermocam-checker
19908>>9600	default	x	(Lepton 2.x),
19909>>>9600	use	diy-thermocam-parser
19910
19911
19912#------------------------------------------------------------------------------
19913# $File: mercurial,v 1.5 2019/04/19 00:42:27 christos Exp $
19914# mercurial:  file(1) magic for Mercurial changeset bundles
19915# https://www.selenic.com/mercurial/wiki/
19916#
19917# Jesse Glick (jesse.glick@sun.com)
19918#
19919
199200	string		HG10		Mercurial changeset bundle
19921>4	string		UN		(uncompressed)
19922>4	string		GZ		(gzip compressed)
19923>4	string		BZ		(bzip2 compressed)
19924
19925#------------------------------------------------------------------------------
19926# $File: metastore,v 1.3 2019/04/19 00:42:27 christos Exp $
19927# metastore:  file(1) magic for metastore files
19928# From: Thomas Wissen
19929# see https://david.hardeman.nu/software.php#metastore
199300	string		MeTaSt00r3	Metastore data file,
19931>10	bequad		x		version %0llx
19932
19933#------------------------------------------------------------------------------
19934# $File: meteorological,v 1.2 2017/03/17 21:35:28 christos Exp $
19935# rinex:  file(1) magic for RINEX files
19936# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
19937# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf
19938# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data
1993960	string		RINEX
19940>80	search/256	XXRINEXB	RINEX Data, GEO SBAS Broadcast
19941>>&32	string		x		\b, date %15.15s
19942>>5	string		x		\b, version %6.6s
19943!:mime	rinex/broadcast
19944>80	search/256	XXRINEXD	RINEX Data, Observation (Hatanaka comp)
19945>>&32	string		x		\b, date %15.15s
19946>>5	string		x		\b, version %6.6s
19947!:mime	rinex/observation
19948>80	search/256	XXRINEXC	RINEX Data, Clock
19949>>&32	string		x		\b, date %15.15s
19950>>5	string		x		\b, version %6.6s
19951!:mime	rinex/clock
19952>80	search/256	XXRINEXH	RINEX Data, GEO SBAS Navigation
19953>>&32	string		x		\b, date %15.15s
19954>>5	string		x		\b, version %6.6s
19955!:mime	rinex/navigation
19956>80	search/256	XXRINEXG	RINEX Data, GLONASS Navigation
19957>>&32	string		x		\b, date %15.15s
19958>>5	string		x		\b, version %6.6s
19959!:mime	rinex/navigation
19960>80	search/256	XXRINEXL	RINEX Data, Galileo Navigation
19961>>&32	string		x		\b, date %15.15s
19962>>5	string		x		\b, version %6.6s
19963!:mime	rinex/navigation
19964>80	search/256	XXRINEXM	RINEX Data, Meteorological
19965>>&32	string		x		\b, date %15.15s
19966>>5	string		x		\b, version %6.6s
19967!:mime	rinex/meteorological
19968>80	search/256	XXRINEXN	RINEX Data, Navigation
19969>>&32	string		x		\b, date %15.15s
19970>>5	string		x		\b, version %6.6s
19971!:mime	rinex/navigation
19972>80	search/256	XXRINEXO	RINEX Data, Observation
19973>>&32	string		x		\b, date %15.15s
19974>>5	string		x		\b, version %6.6s
19975!:mime	rinex/observation
19976
19977# https://en.wikipedia.org/wiki/GRIB
199780	string	GRIB
19979>7	byte	=1	Gridded binary (GRIB) version 1
19980>7	byte	=2	Gridded binary (GRIB) version 2
19981
19982#------------------------------------------------------------------------------
19983# $File: microfocus,v 1.3 2019/04/19 00:42:27 christos Exp $
19984# Micro Focus COBOL data files.
19985
19986# https://documentation.microfocus.com/help/index.jsp?topic=\
19987# %2FGUID-0E0191D8-C39A-44D1-BA4C-D67107BAF784%2FHRFLRHFILE05.html
19988# http://www.cobolproducts.com/datafile/data-viewer.html
19989# https://github.com/miracle2k/mfcobol-export
19990
199910 string \x30\x00\x00\x7C
19992>36 string \x00\x3E Micro Focus File with Header (DAT)
19993!:mime application/octet-stream
19994
199950 string \x30\x7E\x00\x00
19996>36 string \x00\x3E Micro Focus File with Header (DAT)
19997!:mime application/octet-stream
19998
1999939 string \x02
20000>136 string \x02\x02\x04\x04 Micro Focus Index File (IDX)
20001!:mime application/octet-stream
20002
20003#------------------------------------------------------------------------------
20004# $File: mime,v 1.8 2017/03/17 22:20:22 christos Exp $
20005# mime:  file(1) magic for MIME encoded files
20006#
200070	string/t		Content-Type:\040
20008>14	string		>\0		%s
200090	string/t		Content-Type:
20010>13	string		>\0		%s
20011
20012#------------------------------------------------------------------------------
20013# $File: mips,v 1.10 2014/04/30 21:41:02 christos Exp $
20014# mips:  file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX
20015# and DEC Ultrix
20016#
200170	beshort	0x0160		MIPSEB ECOFF executable
20018>20	beshort	0407		(impure)
20019>20	beshort	0410		(swapped)
20020>20	beshort	0413		(paged)
20021>8	belong	>0		not stripped
20022>8	belong	0		stripped
20023>22	byte	x		- version %d
20024>23	byte	x		\b.%d
20025#
200260	beshort	0x0162		MIPSEL-BE ECOFF executable
20027>20	beshort	0407		(impure)
20028>20	beshort	0410		(swapped)
20029>20	beshort	0413		(paged)
20030>8	belong	>0		not stripped
20031>8	belong	0		stripped
20032>23	byte	x		- version %d
20033>22	byte	x		\b.%d
20034#
200350	beshort	0x6001		MIPSEB-LE ECOFF executable
20036>20	beshort	03401		(impure)
20037>20	beshort	04001		(swapped)
20038>20	beshort	05401		(paged)
20039>8	belong	>0		not stripped
20040>8	belong	0		stripped
20041>23	byte	x		- version %d
20042>22	byte	x		\b.%d
20043#
200440	beshort	0x6201		MIPSEL ECOFF executable
20045>20	beshort	03401		(impure)
20046>20	beshort	04001		(swapped)
20047>20	beshort	05401		(paged)
20048>8	belong	>0		not stripped
20049>8	belong	0		stripped
20050>23	byte	x		- version %d
20051>22	byte	x		\b.%d
20052#
20053# MIPS 2 additions
20054#
200550	beshort	0x0163		MIPSEB MIPS-II ECOFF executable
20056>20	beshort	0407		(impure)
20057>20	beshort	0410		(swapped)
20058>20	beshort	0413		(paged)
20059>8	belong	>0		not stripped
20060>8	belong	0		stripped
20061>22	byte	x		- version %d
20062>23	byte	x		\b.%d
20063#
200640	beshort	0x0166		MIPSEL-BE MIPS-II ECOFF executable
20065>20	beshort	0407		(impure)
20066>20	beshort	0410		(swapped)
20067>20	beshort	0413		(paged)
20068>8	belong	>0		not stripped
20069>8	belong	0		stripped
20070>22	byte	x		- version %d
20071>23	byte	x		\b.%d
20072#
200730	beshort	0x6301		MIPSEB-LE MIPS-II ECOFF executable
20074>20	beshort	03401		(impure)
20075>20	beshort	04001		(swapped)
20076>20	beshort	05401		(paged)
20077>8	belong	>0		not stripped
20078>8	belong	0		stripped
20079>23	byte	x		- version %d
20080>22	byte	x		\b.%d
20081#
200820	beshort	0x6601		MIPSEL MIPS-II ECOFF executable
20083>20	beshort	03401		(impure)
20084>20	beshort	04001		(swapped)
20085>20	beshort	05401		(paged)
20086>8	belong	>0		not stripped
20087>8	belong	0		stripped
20088>23	byte	x		- version %d
20089>22	byte	x		\b.%d
20090#
20091# MIPS 3 additions
20092#
200930	beshort	0x0140		MIPSEB MIPS-III ECOFF executable
20094>20	beshort	0407		(impure)
20095>20	beshort	0410		(swapped)
20096>20	beshort	0413		(paged)
20097>8	belong	>0		not stripped
20098>8	belong	0		stripped
20099>22	byte	x		- version %d
20100>23	byte	x		\b.%d
20101#
201020	beshort	0x0142		MIPSEL-BE MIPS-III ECOFF executable
20103>20	beshort	0407		(impure)
20104>20	beshort	0410		(swapped)
20105>20	beshort	0413		(paged)
20106>8	belong	>0		not stripped
20107>8	belong	0		stripped
20108>22	byte	x		- version %d
20109>23	byte	x		\b.%d
20110#
201110	beshort	0x4001		MIPSEB-LE MIPS-III ECOFF executable
20112>20	beshort	03401		(impure)
20113>20	beshort	04001		(swapped)
20114>20	beshort	05401		(paged)
20115>8	belong	>0		not stripped
20116>8	belong	0		stripped
20117>23	byte	x		- version %d
20118>22	byte	x		\b.%d
20119#
201200	beshort	0x4201		MIPSEL MIPS-III ECOFF executable
20121>20	beshort	03401		(impure)
20122>20	beshort	04001		(swapped)
20123>20	beshort	05401		(paged)
20124>8	belong	>0		not stripped
20125>8	belong	0		stripped
20126>23	byte	x		- version %d
20127>22	byte	x		\b.%d
20128#
201290	beshort	0x180		MIPSEB Ucode
201300	beshort	0x182		MIPSEL-BE Ucode
20131
20132#------------------------------------------------------------------------------
20133# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $
20134# mirage:  file(1) magic for Mirage executables
20135#
20136# XXX - byte order?
20137#
201380	long	31415		Mirage Assembler m.out executable
20139
20140#-----------------------------------------------------------------------------
20141# $File: misctools,v 1.18 2019/04/19 00:42:27 christos Exp $
20142# misctools:  file(1) magic for miscellaneous UNIX tools.
20143#
201440	search/1	%%!!			X-Post-It-Note text
201450	string/c	BEGIN:VCALENDAR		vCalendar calendar file
20146!:mime	text/calendar
20147# updated by Joerg Jenderek at Apr 2015
20148# Extension: .vcf
20149# https://en.wikipedia.org/wiki/VCard
201500	string/c	BEGIN:VCARD		vCard visiting card
20151# deprecated
20152#!:mime	text/x-vcard
20153!:mime	text/vcard
20154# VERSION must come right after BEGIN for 3.0 or 4.0 except in 2.1 , where it can be anywhere
20155>12	search/14000/c	VERSION:
20156# VERSION 2.1 , 3.0 or 4.0
20157>>&0	string		x			\b, version %-.3s
20158
20159# Summary: Libtool library file
20160# Extension: .la
20161# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl>
201620	search/80	.la\ -\ a\ libtool\ library\ file	libtool library file
20163
20164# Summary: Libtool object file
20165# Extension: .lo
20166# Submitted by: Abel Cheung <abelcheung@gmail.com>
201670	search/80	.lo\ -\ a\ libtool\ object\ file	libtool object file
20168
20169# From: Daniel Novotny <dnovotny@redhat.com>
20170# Update: Joerg Jenderek
20171# URL: https://en.wikipedia.org/wiki/Core_dump#User-mode_memory_dumps
20172# Reference: https://msdn.microsoft.com/en-us/library/ms680378%28VS.85%29.aspx
20173#
20174# "Windows Minidump" by TrID
20175# ./misctools (version 5.25) labeled the entry as "MDMP crash report data"
201760	string		MDMP					Mini DuMP crash report
20177# https://filext.com/file-extension/DMP
20178!:mime	application/x-dmp
20179!:ext	dmp/mdmp
20180# The high-order word is an internal value that is implementation specific.
20181# The low-order word is MINIDUMP_VERSION 0xA793
20182>4	ulelong&0x0000FFFF	!0xA793				\b, version 0x%4.4x
20183# NumberOfStreams 8,9,10,13
20184>8	ulelong			x				\b, %d streams
20185# StreamDirectoryRva 0x20
20186>12	ulelong			!0x20				\b, 0x%8.8x RVA
20187# CheckSum 0
20188>16	ulelong			!0				\b, CheckSum 0x%8.8x
20189# Reserved or TimeDateStamp
20190>20	ledate			x				\b, %s
20191# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519%28v=vs.85%29.aspx
20192# Flags MINIDUMP_TYPE enumeration type 0 0x121 0x800
20193>24	ulelong			x				\b, 0x%x type
20194# >24	ulelong			>0				\b; include
20195# >>24	ulelong			&0x00000001			\b data sections,
20196# >>24	ulelong			&0x00000020			\b list of unloaded modules,
20197# >>24	ulelong			&0x00000100			\b process and thread information,
20198# >>24	ulelong			&0x00000800			\b memory information,
20199
20200# Summary: abook addressbook file
20201# Submitted by: Mark Schreiber <mark7@alumni.cmu.edu>
202020	string	#\x20abook\x20addressbook\x20file abook address book
20203!:mime application/x-abook-addressbook
20204
20205#------------------------------------------------------------------------------
20206# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $
20207# mkid:  file(1) magic for mkid(1) databases
20208#
20209# ID is the binary tags database produced by mkid(1).
20210#
20211# XXX - byte order?
20212#
202130	string		\311\304	ID tags data
20214>2	short		>0		version %d
20215
20216#------------------------------------------------------------------------------
20217# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $
20218# mlssa: file(1) magic for MLSSA datafiles
20219#
202200		lelong		0xffffabcd	MLSSA datafile,
20221>4		leshort		x		algorithm %d,
20222>10		lelong		x		%d samples
20223
20224#------------------------------------------------------------------------------
20225# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $
20226# mmdf:  file(1) magic for MMDF mail files
20227#
202280	string	\001\001\001\001	MMDF mailbox
20229
20230#------------------------------------------------------------------------------
20231# $File: modem,v 1.9 2019/04/19 00:42:27 christos Exp $
20232# modem:  file(1) magic for modem programs
20233#
20234# From: Florian La Roche <florian@knorke.saar.de>
202351	string		PC\ Research,\ Inc	Digifax-G3-File
20236>29	byte		1			\b, fine resolution
20237>29	byte		0			\b, normal resolution
20238
20239# Summary: CCITT Group 3 Facsimile in "raw" form (i.e. no header).
20240# Modified by: Joerg Jenderek
20241# URL: https://de.wikipedia.org/wiki/Fax
20242# Reference: https://web.archive.org/web/20020628195336/http://www.netnam.vn/unescocourse/computervision/104.htm
20243# GRR: EOL of G3 is too general as it catches also TrueType fonts, Postscript PrinterFontMetric, others
202440	short		0x0100
20245# 16 0-bits near beginning like True Type fonts *.ttf, Postscript PrinterFontMetric *.pfm, FTYPE.HYPERCARD, XFER
20246>2	search/9	\0\0
20247# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
20248>2	default		x
20249# skip IRCAM file (VAX big-endian)	./audio
20250>>0	belong		!0x0001a364
20251# skip GEM Image data			./images
20252>>>2	beshort		!0x0008
20253# look for first keyword of Panorama database *.pan
20254>>>>11	search/262	\x06DESIGN
20255# skip Panorama database
20256>>>>11	default		x
20257# old Apple DreamWorld DreamGrafix *.3200 with keyword at end of g3 looking files
20258>>>>>27118	search/1864	DreamWorld
20259>>>>>27118	default		x
20260# skip MouseTrap/Mt.Defaults with file size 16 found on Golden Orchard Apple II CD Rom
20261>>>>>>8		ubequad		!0x2e01010454010203
20262# skip PICTUREH.SML found on Golden Orchard Apple II CD Rom
20263>>>>>>>8	ubequad		!0x5dee74ad1aa56394	raw G3 (Group 3) FAX, byte-padded
20264# version 5.25 labeled the entry above "raw G3 data, byte-padded"
20265!:mime	image/g3fax
20266#!:apple	????TIFF
20267!:ext	g3
20268# unusual image starting with black pixel
20269#0	short		0x1300		raw G3 (Group 3) FAX
202700	short		0x1400
20271# 16 0-bits near beginning like PicturePuzzler found on Golden Orchard Apple CD Rom
20272>2	search/9	\0\0
20273# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
20274>2	default		x		raw G3 (Group 3) FAX
20275# version 5.25 labeled the above entry as "raw G3 data"
20276!:mime	image/g3fax
20277!:ext	g3
20278# unusual image with black pixel near beginning
20279#0	short		0x1900		raw G3 (Group 3) FAX
20280
20281#
20282# Magic data for vgetty voice formats
20283# (Martin Seine & Marc Eberhard)
20284
20285#
20286# raw modem data version 1
20287#
202880    string    RMD1      raw modem data
20289>4   string    >\0       (%s /
20290>20  short     >0        compression type 0x%04x)
20291
20292#
20293# portable voice format 1
20294#
202950    string    PVF1\n         portable voice format
20296>5   string    >\0       (binary %s)
20297
20298#
20299# portable voice format 2
20300#
203010    string    PVF2\n         portable voice format
20302>5   string >\0          (ascii %s)
20303
20304# From: Bernd Nuernberger <bernd.nuernberger@web.de>
20305# Brooktrout G3 fax data incl. 128 byte header
20306# Common suffixes: 3??, BRK, BRT, BTR
203070	leshort		0x01bb
20308>2	leshort		0x0100		Brooktrout 301 fax image,
20309>>9	leshort		x		%d x
20310>>0x2d	leshort		x		%d
20311>>6	leshort		200		\b, fine resolution
20312>>6	leshort		100		\b, normal resolution
20313>>11	byte		1		\b, G3 compression
20314>>11	byte		2		\b, G32D compression
20315
20316#------------------------------------------------------------------------------
20317# $File: motorola,v 1.11 2014/04/30 21:41:02 christos Exp $
20318# motorola:  file(1) magic for Motorola 68K and 88K binaries
20319#
20320# 68K
20321#
203220	beshort		0520		mc68k COFF
20323>18	beshort		^00000020	object
20324>18	beshort		&00000020	executable
20325>12	belong		>0		not stripped
20326>168	string		.lowmem		Apple toolbox
20327>20	beshort		0407		(impure)
20328>20	beshort		0410		(pure)
20329>20	beshort		0413		(demand paged)
20330>20	beshort		0421		(standalone)
203310	beshort		0521		mc68k executable (shared)
20332>12	belong		>0		not stripped
203330	beshort		0522		mc68k executable (shared demand paged)
20334>12	belong		>0		not stripped
20335#
20336# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
20337#
203380	beshort		0554		68K BCS executable
20339#
20340# 88K
20341#
20342# Motorola/88Open BCS
20343#
203440	beshort		0555		88K BCS executable
20345#
20346# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
203470   string      S0          Motorola S-Record; binary data in text format
20348
20349# ATARI ST relocatable PRG
20350#
20351# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001
20352# (according to Roland Waldi, Oct 21, 1987)
20353# besides the magic 0x601a, the text segment size is checked to be
20354# not larger than 1 MB (which is a lot on ST).
20355# The additional 0x601b distinction I took from Doug Lee's magic.
203560	belong&0xFFFFFFF0	0x601A0000	Atari ST M68K contiguous executable
20357>2	belong			x		(txt=%d,
20358>6	belong			x		dat=%d,
20359>10	belong			x		bss=%d,
20360>14	belong			x		sym=%d)
203610	belong&0xFFFFFFF0	0x601B0000	Atari ST M68K non-contig executable
20362>2	belong			x		(txt=%d,
20363>6	belong			x		dat=%d,
20364>10	belong			x		bss=%d,
20365>14	belong			x		sym=%d)
20366
20367# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>)
203680       beshort         0x601A          Atari 68xxx executable,
20369>2      belong          x               text len %u,
20370>6      belong          x               data len %u,
20371>10     belong          x               BSS len %u,
20372>14     belong          x               symboltab len %u,
20373>18     belong          0
20374>22     belong          &0x01           fastload flag,
20375>22     belong          &0x02           may be loaded to alternate RAM,
20376>22     belong          &0x04           malloc may be from alternate RAM,
20377>22     belong          x               flags: 0x%X,
20378>26     beshort         0               no relocation tab
20379>26     beshort         !0              + relocation tab
20380>30     string          SFX             [Self-Extracting LZH SFX archive]
20381>38     string          SFX             [Self-Extracting LZH SFX archive]
20382>44     string          ZIP!            [Self-Extracting ZIP SFX archive]
20383
203840       beshort         0x0064          Atari 68xxx CPX file
20385>8      beshort         x               (version %04x)
20386
20387#------------------------------------------------------------------------------
20388# $File: mozilla,v 1.10 2019/04/19 00:42:27 christos Exp $
20389# mozilla:  file(1) magic for Mozilla XUL fastload files
20390# (XUL.mfasl and XPC.mfasl)
20391# URL:	https://www.mozilla.org/
20392# From:	Josh Triplett <josh@freedesktop.org>
20393
203940	string	XPCOM\nMozFASL\r\n\x1A		Mozilla XUL fastload data
20395# Probably the next magic line contains misspelled "mozLz40\0"
203960	string	mozLz4a				Mozilla lz4 compressed bookmark data
20397# From: Joerg Jenderek
20398# URL: https://lz4.github.io/lz4/
20399# Reference: https://github.com/avih/dejsonlz4/archive/master.zip/
20400# dejsonlz4-master\src\dejsonlz4.c
20401# Note: mostly JSON compressed with a non-standard LZ4 header
20402# can be unpacked by dejsonlz4 but not lz4 programm.
204030	string	mozLz40\0			Mozilla lz4 compressed data
20404!:mime	application/x-lz4+json
20405# mozlz4 extension seems to be used for search/store, while jsonlz4 for bookmarks
20406!:ext	jsonlz4/mozlz4
20407# decomp_size
20408>8	ulelong	x				\b, originally %u bytes
20409# lz4 data
20410#>12	ubequad	x				\b, lz4 data 0x%16.16llx
20411
20412# From: Joerg Jenderek
20413# URL: https://en.wikipedia.org/wiki/Firefox_4
20414# Reference: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT
20415# Note:	Most ZIP utilities are able to extract such archives
20416#	maybe only partly or after some warnings. Example:
20417#	zip -FF omni.ja --out omni.zip
204184	string	PK\001\002	Mozilla archive omni.ja
20419!:mime	application/x-zip
20420!:ext	ja
20421# TODO:
20422#>4	use	zip-dir-entry
20423
20424#------------------------------------------------------------------------------
20425# $File: msdos,v 1.128 2019/04/19 00:42:27 christos Exp $
20426# msdos:  file(1) magic for MS-DOS files
20427#
20428
20429# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
20430# updated by Joerg Jenderek at Oct 2008,Apr 2011
204310	string/t	@
20432>1	string/cW	\ echo\ off	DOS batch file text
20433!:mime	text/x-msdos-batch
20434!:ext	bat
20435>1	string/cW	echo\ off	DOS batch file text
20436!:mime	text/x-msdos-batch
20437!:ext	bat
20438>1	string/cW	rem		DOS batch file text
20439!:mime	text/x-msdos-batch
20440!:ext	bat
20441>1	string/cW	set\ 		DOS batch file text
20442!:mime	text/x-msdos-batch
20443!:ext	bat
20444
20445
20446# OS/2 batch files are REXX. the second regex is a bit generic, oh well
20447# the matched commands seem to be common in REXX and uncommon elsewhere
20448100	search/0xffff   rxfuncadd
20449>100	regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc	OS/2 REXX batch file text
20450100	search/0xffff   say
20451>100	regex/c =^[\ \t]{0,10}say\ ['"]			OS/2 REXX batch file text
20452
20453# updated by Joerg Jenderek at Oct 2015
20454# https://de.wikipedia.org/wiki/Common_Object_File_Format
20455# http://www.delorie.com/djgpp/doc/coff/filhdr.html
20456# ./intel already labeled COFF type 0x14c=0514 as "80386 COFF executable"
20457#0	leshort		0x14c	MS Windows COFF Intel 80386 object file
20458#>4	ledate		x	stamp %s
204590	leshort		0x166	MS Windows COFF MIPS R4000 object file
20460#>4	ledate		x	stamp %s
204610	leshort		0x184	MS Windows COFF Alpha object file
20462#>4	ledate		x	stamp %s
204630	leshort		0x268	MS Windows COFF Motorola 68000 object file
20464#>4	ledate		x	stamp %s
204650	leshort		0x1f0	MS Windows COFF PowerPC object file
20466#>4	ledate		x	stamp %s
204670	leshort		0x290	MS Windows COFF PA-RISC object file
20468#>4	ledate		x	stamp %s
20469
20470# Tests for various EXE types.
20471#
20472# Many of the compressed formats were extraced from IDARC 1.23 source code.
20473#
204740	string/b	MZ
20475# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file.
20476>0x18	leshort <0x40 MS-DOS executable
20477!:mime	application/x-dosexec
20478# Windows and later versions of DOS will allow .EXEs to be named with a .COM
20479# extension, mostly for compatibility's sake.
20480!:ext	exe/com
20481# These traditional tests usually work but not always.  When test quality support is
20482# implemented these can be turned on.
20483#>>0x18	leshort	0x1c	(Borland compiler)
20484#>>0x18	leshort	0x1e	(MS compiler)
20485
20486# If the relocation table is 0x40 or more bytes into the file, it's definitely
20487# not a DOS EXE.
20488>0x18  leshort >0x3f
20489
20490# Maybe it's a PE?
20491>>(0x3c.l) string PE\0\0 PE
20492!:mime	application/x-dosexec
20493>>>(0x3c.l+24)	leshort		0x010b	\b32 executable
20494>>>(0x3c.l+24)	leshort		0x020b	\b32+ executable
20495>>>(0x3c.l+24)	leshort		0x0107	ROM image
20496>>>(0x3c.l+24)	default		x	Unknown PE signature
20497>>>>&0 		leshort		x	0x%x
20498>>>(0x3c.l+22)	leshort&0x2000	>0	(DLL)
20499>>>(0x3c.l+92)	leshort		1
20500# Native PEs include ntoskrnl.exe, hal.dll, smss.exe, autochk.exe, and all the
20501# drivers in Windows/System32/drivers/*.sys.
20502>>>>(0x3c.l+22)	leshort&0x2000	>0	(native)
20503!:ext	dll/sys
20504>>>>(0x3c.l+22)	leshort&0x2000	0	(native)
20505!:ext	exe/sys
20506>>>(0x3c.l+92)	leshort		2
20507>>>>(0x3c.l+22)	leshort&0x2000	>0	(GUI)
20508# These could probably be at least partially distinguished from one another by
20509# looking for specific exported functions.
20510# CPL: Control Panel item
20511# TLB: Type library
20512# OCX: OLE/ActiveX control
20513# ACM: Audio compression manager codec
20514# AX: DirectShow source filter
20515# IME: Input method editor
20516!:ext	dll/cpl/tlb/ocx/acm/ax/ime
20517>>>>(0x3c.l+22)	leshort&0x2000	0	(GUI)
20518# Screen savers typically include code from the scrnsave.lib static library, but
20519# that's not guaranteed.
20520!:ext	exe/scr
20521>>>(0x3c.l+92)	leshort		3
20522>>>>(0x3c.l+22)	leshort&0x2000	>0	(console)
20523!:ext	dll/cpl/tlb/ocx/acm/ax/ime
20524>>>>(0x3c.l+22)	leshort&0x2000	0	(console)
20525!:ext	exe/com
20526>>>(0x3c.l+92)	leshort		7	(POSIX)
20527>>>(0x3c.l+92)	leshort		9	(Windows CE)
20528>>>(0x3c.l+92)	leshort		10	(EFI application)
20529>>>(0x3c.l+92)	leshort		11	(EFI boot service driver)
20530>>>(0x3c.l+92)	leshort		12	(EFI runtime driver)
20531>>>(0x3c.l+92)	leshort		13	(EFI ROM)
20532>>>(0x3c.l+92)	leshort		14	(XBOX)
20533>>>(0x3c.l+92)	leshort		15	(Windows boot application)
20534>>>(0x3c.l+92)	default		x	(Unknown subsystem
20535>>>>&0		leshort		x	0x%x)
20536>>>(0x3c.l+4)	leshort		0x14c	Intel 80386
20537>>>(0x3c.l+4)	leshort		0x166	MIPS R4000
20538>>>(0x3c.l+4)	leshort		0x168	MIPS R10000
20539>>>(0x3c.l+4)	leshort		0x184	Alpha
20540>>>(0x3c.l+4)	leshort		0x1a2	Hitachi SH3
20541>>>(0x3c.l+4)	leshort		0x1a6	Hitachi SH4
20542>>>(0x3c.l+4)	leshort		0x1c0	ARM
20543>>>(0x3c.l+4)	leshort		0x1c2	ARM Thumb
20544>>>(0x3c.l+4)	leshort		0x1c4	ARMv7 Thumb
20545>>>(0x3c.l+4)	leshort		0x1f0	PowerPC
20546>>>(0x3c.l+4)	leshort		0x200	Intel Itanium
20547>>>(0x3c.l+4)	leshort		0x266	MIPS16
20548>>>(0x3c.l+4)	leshort		0x268	Motorola 68000
20549>>>(0x3c.l+4)	leshort		0x290	PA-RISC
20550>>>(0x3c.l+4)	leshort		0x366	MIPSIV
20551>>>(0x3c.l+4)	leshort		0x466	MIPS16 with FPU
20552>>>(0x3c.l+4)	leshort		0xebc	EFI byte code
20553>>>(0x3c.l+4)	leshort		0x8664	x86-64
20554>>>(0x3c.l+4)	leshort		0xc0ee	MSIL
20555>>>(0x3c.l+4)	default		x	Unknown processor type
20556>>>>&0		leshort		x	0x%x
20557>>>(0x3c.l+22)	leshort&0x0200	>0	(stripped to external PDB)
20558>>>(0x3c.l+22)	leshort&0x1000	>0	system file
20559>>>(0x3c.l+24)	leshort		0x010b
20560>>>>(0x3c.l+232) lelong	>0	Mono/.Net assembly
20561>>>(0x3c.l+24)	leshort		0x020b
20562>>>>(0x3c.l+248) lelong	>0	Mono/.Net assembly
20563
20564# hooray, there's a DOS extender using the PE format, with a valid PE
20565# executable inside (which just prints a message and exits if run in win)
20566>>>(8.s*16)		string		32STUB	\b, 32rtm DOS extender
20567>>>(8.s*16)		string		!32STUB	\b, for MS Windows
20568>>>(0x3c.l+0xf8)	string		UPX0 \b, UPX compressed
20569>>>(0x3c.l+0xf8)	search/0x140	PEC2 \b, PECompact2 compressed
20570>>>(0x3c.l+0xf8)	search/0x140	UPX2
20571>>>>(&0x10.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
20572>>>(0x3c.l+0xf8)	search/0x140	.idata
20573>>>>(&0xe.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
20574>>>>(&0xe.l+(-4))	string		ZZ0 \b, ZZip self-extracting archive
20575>>>>(&0xe.l+(-4))	string		ZZ1 \b, ZZip self-extracting archive
20576>>>(0x3c.l+0xf8)	search/0x140	.rsrc
20577>>>>(&0x0f.l+(-4))	string		a\\\4\5 \b, WinHKI self-extracting archive
20578>>>>(&0x0f.l+(-4))	string		Rar! \b, RAR self-extracting archive
20579>>>>(&0x0f.l+(-4))	search/0x3000	MSCF \b, InstallShield self-extracting archive
20580>>>>(&0x0f.l+(-4))	search/32	Nullsoft \b, Nullsoft Installer self-extracting archive
20581>>>(0x3c.l+0xf8)	search/0x140	.data
20582>>>>(&0x0f.l)		string		WEXTRACT \b, MS CAB-Installer self-extracting archive
20583>>>(0x3c.l+0xf8)	search/0x140	.petite\0 \b, Petite compressed
20584>>>>(0x3c.l+0xf7)	byte		x
20585>>>>>(&0x104.l+(-4))	string		=!sfx! \b, ACE self-extracting archive
20586>>>(0x3c.l+0xf8)	search/0x140	.WISE \b, WISE installer self-extracting archive
20587>>>(0x3c.l+0xf8)	search/0x140	.dz\0\0\0 \b, Dzip self-extracting archive
20588>>>&(0x3c.l+0xf8)	search/0x100	_winzip_ \b, ZIP self-extracting archive (WinZip)
20589>>>&(0x3c.l+0xf8)	search/0x100	SharedD \b, Microsoft Installer self-extracting archive
20590>>>0x30			string		Inno \b, InnoSetup self-extracting archive
20591
20592# Hmm, not a PE but the relocation table is too high for a traditional DOS exe,
20593# must be one of the unusual subformats.
20594>>(0x3c.l) string !PE\0\0 MS-DOS executable
20595!:mime	application/x-dosexec
20596
20597>>(0x3c.l)		string		NE \b, NE
20598!:mime	application/x-dosexec
20599>>>(0x3c.l+0x36)	byte		1 for OS/2 1.x
20600>>>(0x3c.l+0x36)	byte		2 for MS Windows 3.x
20601>>>(0x3c.l+0x36)	byte		3 for MS-DOS
20602>>>(0x3c.l+0x36)	byte		4 for Windows 386
20603>>>(0x3c.l+0x36)	byte		5 for Borland Operating System Services
20604>>>(0x3c.l+0x36)	default		x
20605>>>>(0x3c.l+0x36)	byte		x (unknown OS %x)
20606>>>(0x3c.l+0x36)	byte		0x81 for MS-DOS, Phar Lap DOS extender
20607>>>(0x3c.l+0x0c)	leshort&0x8000	0x8000 (DLL or font)
20608# DRV: Driver
20609# 3GR: Grabber device driver
20610# CPL: Control Panel Item
20611# VBX: Visual Basic Extension
20612# FON: Bitmap font
20613# FOT: Font resource file
20614!:ext	dll/drv/3gr/cpl/vbx/fon/fot
20615>>>(0x3c.l+0x0c)	leshort&0x8000	0 (EXE)
20616!:ext	exe/scr
20617>>>&(&0x24.s-1)		string		ARJSFX \b, ARJ self-extracting archive
20618>>>(0x3c.l+0x70)	search/0x80	WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
20619
20620>>(0x3c.l)		string		LX\0\0 \b, LX
20621!:mime	application/x-dosexec
20622>>>(0x3c.l+0x0a)	leshort		<1 (unknown OS)
20623>>>(0x3c.l+0x0a)	leshort		1 for OS/2
20624>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
20625>>>(0x3c.l+0x0a)	leshort		3 for DOS
20626>>>(0x3c.l+0x0a)	leshort		>3 (unknown OS)
20627>>>(0x3c.l+0x10)	lelong&0x28000	=0x8000 (DLL)
20628>>>(0x3c.l+0x10)	lelong&0x20000	>0 (device driver)
20629>>>(0x3c.l+0x10)	lelong&0x300	0x300 (GUI)
20630>>>(0x3c.l+0x10)	lelong&0x28300	<0x300 (console)
20631>>>(0x3c.l+0x08)	leshort		1 i80286
20632>>>(0x3c.l+0x08)	leshort		2 i80386
20633>>>(0x3c.l+0x08)	leshort		3 i80486
20634>>>(8.s*16)		string		emx \b, emx
20635>>>>&1			string		x %s
20636>>>&(&0x54.l-3)		string		arjsfx \b, ARJ self-extracting archive
20637
20638# MS Windows system file, supposedly a collection of LE executables
20639>>(0x3c.l)		string		W3 \b, W3 for MS Windows
20640!:mime	application/x-dosexec
20641
20642>>(0x3c.l)		string		LE\0\0 \b, LE executable
20643!:mime	application/x-dosexec
20644>>>(0x3c.l+0x0a)	leshort		1
20645# some DOS extenders use LE files with OS/2 header
20646>>>>0x240		search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
20647>>>>0x240		search/0x200	WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
20648>>>>0x440		search/0x100	CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
20649>>>>0x40		search/0x40	PMODE/W for MS-DOS, PMODE/W DOS extender
20650>>>>0x40		search/0x40	STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
20651>>>>0x40		search/0x80	STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
20652>>>>0x40		search/0x80	DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
20653# this is a wild guess; hopefully it is a specific signature
20654>>>>&0x24		lelong		<0x50
20655>>>>>(&0x4c.l)		string		\xfc\xb8WATCOM
20656>>>>>>&0		search/8	3\xdbf\xb9 \b, 32Lite compressed
20657# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP
20658#>>>>(0x3c.l+0x1c)	lelong		>0x10000 for OS/2
20659# fails with DOS-Extenders.
20660>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
20661>>>(0x3c.l+0x0a)	leshort		3 for DOS
20662>>>(0x3c.l+0x0a)	leshort		4 for MS Windows (VxD)
20663# VXD: VxD for Windows 95/98/Me
20664# 386: VxD for Windows 2.10, 3.0, 3.1x
20665# PDR: Port driver
20666# MPD: Miniport driver (?)
20667!:ext	vxd/386/pdr/mpd
20668>>>(&0x7c.l+0x26)	string		UPX \b, UPX compressed
20669>>>&(&0x54.l-3)		string		UNACE \b, ACE self-extracting archive
20670
20671# looks like ASCII, probably some embedded copyright message.
20672# and definitely not NE/LE/LX/PE
20673>>0x3c		lelong	>0x20000000
20674>>>(4.s*512)	leshort !0x014c \b, MZ for MS-DOS
20675!:mime	application/x-dosexec
20676!:ext	exe/com
20677# header data too small for extended executable
20678>2		long	!0
20679>>0x18		leshort <0x40
20680>>>(4.s*512)	leshort !0x014c
20681
20682>>>>&(2.s-514)	string	!LE
20683>>>>>&-2	string	!BW \b, MZ for MS-DOS
20684!:mime	application/x-dosexec
20685>>>>&(2.s-514)	string	LE \b, LE
20686>>>>>0x240	search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
20687# educated guess since indirection is still not capable enough for complex offset
20688# calculations (next embedded executable would be at &(&2*512+&0-2)
20689# I suspect there are only LE executables in these multi-exe files
20690>>>>&(2.s-514)	string	BW
20691>>>>>0x240	search/0x100	DOS/4G	\b, LE for MS-DOS, DOS4GW DOS extender (embedded)
20692>>>>>0x240	search/0x100	!DOS/4G	\b, BW collection for MS-DOS
20693
20694# This sequence skips to the first COFF segment, usually .text
20695>(4.s*512)	leshort		0x014c \b, COFF
20696!:mime	application/x-dosexec
20697>>(8.s*16)	string		go32stub for MS-DOS, DJGPP go32 DOS extender
20698>>(8.s*16)	string		emx
20699>>>&1		string		x for DOS, Win or OS/2, emx %s
20700>>&(&0x42.l-3)	byte		x
20701>>>&0x26	string		UPX \b, UPX compressed
20702# and yet another guess: small .text, and after large .data is unusal, could be 32lite
20703>>&0x2c		search/0xa0	.text
20704>>>&0x0b	lelong		<0x2000
20705>>>>&0		lelong		>0x6000 \b, 32lite compressed
20706
20707>(8.s*16) string $WdX \b, WDos/X DOS extender
20708
20709# By now an executable type should have been printed out.  The executable
20710# may be a self-uncompressing archive, so look for evidence of that and
20711# print it out.
20712#
20713# Some signatures below from Greg Roelofs, newt@uchicago.edu.
20714#
20715>0x35	string	\x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
20716>0xe7	string	LH/2\ 	Self-Extract \b, %s
20717>0x1c	string	UC2X	\b, UCEXE compressed
20718>0x1c	string	WWP\ 	\b, WWPACK compressed
20719>0x1c	string	RJSX 	\b, ARJ self-extracting archive
20720>0x1c	string	diet 	\b, diet compressed
20721>0x1c	string	LZ09 	\b, LZEXE v0.90 compressed
20722>0x1c	string	LZ91 	\b, LZEXE v0.91 compressed
20723>0x1c	string	tz 	\b, TinyProg compressed
20724>0x1e	string	Copyright\ 1989-1990\ PKWARE\ Inc.	Self-extracting PKZIP archive
20725!:mime	application/zip
20726# Yes, this really is "Copr", not "Corp."
20727>0x1e	string	PKLITE\ Copr.	Self-extracting PKZIP archive
20728!:mime	application/zip
20729# winarj stores a message in the stub instead of the sig in the MZ header
20730>0x20	search/0xe0	aRJsfX \b, ARJ self-extracting archive
20731>0x20	string AIN
20732>>0x23	string 2	\b, AIN 2.x compressed
20733>>0x23	string <2	\b, AIN 1.x compressed
20734>>0x23	string >2	\b, AIN 1.x compressed
20735>0x24	string	LHa's\ SFX \b, LHa self-extracting archive
20736!:mime	application/x-lha
20737>0x24	string	LHA's\ SFX \b, LHa self-extracting archive
20738!:mime	application/x-lha
20739>0x24	string	\ $ARX \b, ARX self-extracting archive
20740>0x24	string	\ $LHarc \b, LHarc self-extracting archive
20741>0x20	string	SFX\ by\ LARC \b, LARC self-extracting archive
20742>0x40	string aPKG \b, aPackage self-extracting archive
20743>0x64	string	W\ Collis\0\0 \b, Compack compressed
20744>0x7a	string		Windows\ self-extracting\ ZIP	\b, ZIP self-extracting archive
20745>>&0xf4 search/0x140 \x0\x40\x1\x0
20746>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
20747>1638	string	-lh5- \b, LHa self-extracting archive v2.13S
20748>0x17888 string Rar! \b, RAR self-extracting archive
20749
20750# Skip to the end of the EXE.  This will usually work fine in the PE case
20751# because the MZ image is hardcoded into the toolchain and almost certainly
20752# won't match any of these signatures.
20753>(4.s*512)	long	x
20754>>&(2.s-517)	byte	x
20755>>>&0	string		PK\3\4 \b, ZIP self-extracting archive
20756>>>&0	string		Rar! \b, RAR self-extracting archive
20757>>>&0	string		=!\x11 \b, AIN 2.x self-extracting archive
20758>>>&0	string		=!\x12 \b, AIN 2.x self-extracting archive
20759>>>&0	string		=!\x17 \b, AIN 1.x self-extracting archive
20760>>>&0	string		=!\x18 \b, AIN 1.x self-extracting archive
20761>>>&7	search/400	**ACE** \b, ACE self-extracting archive
20762>>>&0	search/0x480	UC2SFX\ Header \b, UC2 self-extracting archive
20763
20764# a few unknown ZIP sfxes, no idea if they are needed or if they are
20765# already captured by the generic patterns above
20766>(8.s*16)	search/0x20	PKSFX \b, ZIP self-extracting archive (PKZIP)
20767# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive
20768#
20769
20770# TELVOX Teleinformatica CODEC self-extractor for OS/2:
20771>49801	string	\x79\xff\x80\xff\x76\xff	\b, CODEC archive v3.21
20772>>49824 leshort		=1			\b, 1 file
20773>>49824 leshort		>1			\b, %u files
20774
20775# added by Joerg Jenderek of https://www.freedos.org/software/?prog=kc
20776# and https://www.freedos.org/software/?prog=kpdos
20777# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD
207780	string/b	KCF		FreeDOS KEYBoard Layout collection
20779# only version=0x100 found
20780>3	uleshort	x		\b, version 0x%x
20781# length of string containing author,info and special characters
20782>6	ubyte		>0
20783#>>6	pstring		x		\b, name=%s
20784>>7	string		>\0		\b, author=%-.14s
20785>>7	search/254	\xff		\b, info=
20786#>>>&0	string		x		\b%-s
20787>>>&0	string		x		\b%-.15s
20788# for FreeDOS *.KL files
207890	string/b	KLF		FreeDOS KEYBoard Layout file
20790# only version=0x100 or 0x101 found
20791>3	uleshort	x		\b, version 0x%x
20792# stringlength
20793>5	ubyte		>0
20794>>8	string		x		\b, name=%-.2s
207950	string	\xffKEYB\ \ \ \0\0\0\0
20796>12	string	\0\0\0\0`\004\360	MS-DOS KEYBoard Layout file
20797
20798# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017
20799# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
208000	ulequad&0x07a0ffffffff		0xffffffff
20801>0	use				msdos-driver
208020       name    			msdos-driver		DOS executable (
20803#!:mime	application/octet-stream
20804!:mime	application/x-dosdriver
20805# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN
20806!:ext	sys/dev/bin
20807>40	search/7			UPX!			\bUPX compressed
20808# DOS device driver attributes
20809>4	uleshort&0x8000			0x0000			\bblock device driver
20810# character device
20811>4	uleshort&0x8000			0x8000			\b
20812>>4	uleshort&0x0008			0x0008			\bclock
20813# fast video output by int 29h
20814>>4	uleshort&0x0010			0x0010			\bfast
20815# standard input/output device
20816>>4	uleshort&0x0003			>0			\bstandard
20817>>>4	uleshort&0x0001			0x0001			\binput
20818>>>4	uleshort&0x0003			0x0003			\b/
20819>>>4	uleshort&0x0002			0x0002			\boutput
20820>>4	uleshort&0x8000			0x8000			\bcharacter device driver
20821>0	ubyte				x
20822# upx compressed device driver has garbage instead of real in name field of header
20823>>40	search/7			UPX!
20824>>40	default				x
20825# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped
20826>>>12		ubyte			>0x2E			\b
20827>>>>10		ubyte			>0x20
20828>>>>>10		ubyte			!0x2E
20829>>>>>>10	ubyte			!0x2A			\b%c
20830>>>>11		ubyte			>0x20
20831>>>>>11		ubyte			!0x2E			\b%c
20832>>>>12		ubyte			>0x20
20833>>>>>12		ubyte			!0x39
20834>>>>>>12	ubyte			!0x2E			\b%c
20835>>>13		ubyte			>0x20
20836>>>>13		ubyte			!0x2E			\b%c
20837>>>>14		ubyte			>0x20
20838>>>>>14		ubyte			!0x2E			\b%c
20839>>>>15		ubyte			>0x20
20840>>>>>15		ubyte			!0x2E			\b%c
20841>>>>16		ubyte			>0x20
20842>>>>>16		ubyte			!0x2E
20843>>>>>>16	ubyte			<0xCB			\b%c
20844>>>>17		ubyte			>0x20
20845>>>>>17		ubyte			!0x2E
20846>>>>>>17	ubyte			<0x90			\b%c
20847# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field
20848>>>12		ubyte			<0x2F
20849# they have their real name at offset 22
20850# also block device drivers like DUMBDRV.SYS
20851>>>>22		string			>\056			%-.6s
20852>4	uleshort&0x8000			0x0000
20853# 32 bit sector addressing ( > 32 MB) for block devices
20854>>4	uleshort&0x0002			0x0002			\b,32-bit sector-
20855# support by driver functions 13h, 17h, 18h
20856>4	uleshort&0x0040			0x0040			\b,IOCTL-
20857# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh
20858>4	uleshort&0x0800			0x0800			\b,close media-
20859# output until busy support by int 10h for character device driver
20860>4	uleshort&0x8000			0x8000
20861>>4	uleshort&0x2000			0x2000			\b,until busy-
20862# direct read/write support by driver functions 03h,0Ch
20863>4	uleshort&0x4000			0x4000			\b,control strings-
20864>4	uleshort&0x8000			0x8000
20865>>4	uleshort&0x6840			>0			\bsupport
20866>4	uleshort&0x8000			0x0000
20867>>4	uleshort&0x4842			>0			\bsupport
20868>0	ubyte				x			\b)
20869# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
208700	ulequad				0x0513c00000000012
20871>0	use				msdos-driver
20872# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field
208730	ulequad				0x32f28000ffff0016
20874>0	use				msdos-driver
208750	ulequad				0x007f00000000ffff
20876>0	use				msdos-driver
208770	ulequad				0x001600000000ffff
20878>0	use				msdos-driver
20879# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field
208800	ulequad				0x0bf708c2ffffffff
20881>0	use				msdos-driver
208820	ulequad				0x07bd08c2ffffffff
20883>0	use				msdos-driver
20884
20885# updated by Joerg Jenderek
20886# GRR: line below too general as it catches also
20887# rt.lib DYADISKS.PIC and many more
20888# start with assembler instruction MOV
208890	ubyte		0x8c
20890# skip "AppleWorks word processor data" like ARTICLE.1 ./apple
20891>4	string			!O====
20892# skip some unknown basic binaries like RocketRnger.SHR
20893>>5	string			!MAIN
20894# skip "GPG symmetrically encrypted data" ./gnu
20895# skip "PGP symmetric key encrypted data" ./pgp
20896# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type
20897>>>4	ubyte			>13	DOS executable (COM, 0x8C-variant)
20898# the remaining files should be DOS *.COM executables
20899# dosshell.COM	8cc0 2ea35f07 e85211 e88a11 b80058 cd
20900# hmload.COM	8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4
20901# UNDELETE.COM	8cca 2e8916 6503 b430 cd21 8b 2e0200 8b
20902# BOOTFIX.COM	8cca 2e8916 9603 b430 cd21 8b 2e0200 8b
20903# RAWRITE3.COM	8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
20904# SHARE.COM	8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
20905# validchr.COM	8cca 2e8916 9603 b430 cd21 8b 2e028b1e
20906# devload.COM	8cca 8916ad01 b430 cd21 8b2e0200 892e
20907!:mime	application/x-dosexec
20908!:ext com
20909
20910# updated by Joerg Jenderek at Oct 2008
209110	ulelong		0xffff10eb	DR-DOS executable (COM)
20912# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb
209130	ubeshort&0xeb8d	>0xeb00
20914# DR-DOS STACKER.COM SCREATE.SYS missed
20915
209160       name    msdos-com
20917>0  byte        x               DOS executable (COM)
20918!:mime	application/x-dosexec
20919!:ext	com
20920>6	string		SFX\ of\ LHarc	\b, %s
20921>0x1FE leshort	0xAA55		    \b, boot code
20922>85	string		UPX		        \b, UPX compressed
20923>4	string		\ $ARX		    \b, ARX self-extracting archive
20924>4	string		\ $LHarc	    \b, LHarc self-extracting archive
20925>0x20e string	SFX\ by\ LARC	\b, LARC self-extracting archive
20926
20927# JMP 8bit
209280	        byte	0xeb
20929# allow forward jumps only
20930>1          byte    >-1
20931# that offset must be accessible
20932>>(1.b+2)   byte    x
20933>>>0        use msdos-com
20934
20935# JMP 16bit
209360           byte    0xe9
20937# forward jumps
20938>1          short   >-1
20939# that offset must be accessible
20940>>(1.s+3)   byte    x
20941>>>0        use msdos-com
20942# negative offset, must not lead into PSP
20943>1          short   <-259
20944# that offset must be accessible
20945>>(1,s+65539)   byte    x
20946>>>0        use msdos-com
20947
20948# updated by Joerg Jenderek at Oct 2008,2015
20949# following line is too general
209500	ubyte		0xb8
20951# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux
20952>0	string		!\xb8\xc0\x07\x8e
20953# modified by Joerg Jenderek
20954# syslinux COM32 or COM32R executable
20955>>1	lelong&0xFFFFFFFe 0x21CD4CFe	COM executable (32-bit COMBOOT
20956# https://www.syslinux.org/wiki/index.php/Comboot_API
20957# Since version 5.00 c32 modules switched from the COM32 object format to ELF
20958!:mime	application/x-c32-comboot-syslinux-exec
20959!:ext c32
20960# https://syslinux.zytor.com/comboot.php
20961# older syslinux version ( <4 )
20962# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
20963# start with assembler instructions mov eax,21cd4cffh
20964>>>1	lelong		0x21CD4CFf	\b)
20965# syslinux:doc/comboot.txt
20966# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov
20967# eax,21cd4cfeh) as a magic number.
20968# syslinux version (4.x)
20969# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID
20970>>>1	lelong		0x21CD4CFe	\b, relocatable)
20971# remaining are DOS COM executables starting with assembler instruction MOV
20972# like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM
20973# MS-DOS SYS.COM RESTART.COM
20974# SYSLINUX.COM (version 1.40 - 2.13)
20975# GFXBOOT.COM (version 3.75)
20976# COPYBS.COM POWEROFF.COM INT18.COM
20977>>1	default	x			COM executable for DOS
20978!:mime	application/x-dosexec
20979#!:mime	application/x-ms-dos-executable
20980#!:mime	application/x-msdos-program
20981!:ext com
20982
209830	string/b	\x81\xfc
20984>4	string	\x77\x02\xcd\x20\xb9
20985>>36	string	UPX!			FREE-DOS executable (COM), UPX compressed
20986!:mime	application/x-dosexec
20987!:ext	com
20988252	string Must\ have\ DOS\ version DR-DOS executable (COM)
20989!:mime	application/x-dosexec
20990!:ext	com
20991# added by Joerg Jenderek at Oct 2008
20992# GRR search is not working
20993#34	search/2	UPX!		FREE-DOS executable (COM), UPX compressed
2099434	string	UPX!			FREE-DOS executable (COM), UPX compressed
20995!:mime	application/x-dosexec
20996!:ext	com
2099735	string	UPX!			FREE-DOS executable (COM), UPX compressed
20998!:mime	application/x-dosexec
20999!:ext	com
21000# GRR search is not working
21001#2	search/28	\xcd\x21	COM executable for MS-DOS
21002#WHICHFAT.cOM
210032	string	\xcd\x21		COM executable for DOS
21004!:mime	application/x-dosexec
21005!:ext	com
21006#DELTREE.cOM DELTREE2.cOM
210074	string	\xcd\x21		COM executable for DOS
21008!:mime	application/x-dosexec
21009!:ext	com
21010#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
210115	string	\xcd\x21		COM executable for DOS
21012!:mime	application/x-dosexec
21013!:ext	com
21014#DELTMP.COm HASFAT32.cOM
210157	string	\xcd\x21
21016>0	byte	!0xb8			COM executable for DOS
21017!:mime	application/x-dosexec
21018!:ext	com
21019#COMP.cOM MORE.COm
2102010	string	\xcd\x21
21021>5	string	!\xcd\x21		COM executable for DOS
21022!:mime	application/x-dosexec
21023!:ext	com
21024#comecho.com
2102513	string	\xcd\x21		COM executable for DOS
21026!:mime	application/x-dosexec
21027!:ext	com
21028#HELP.COm EDIT.coM
2102918	string	\xcd\x21		COM executable for MS-DOS
21030!:mime	application/x-dosexec
21031!:ext	com
21032#NWRPLTRM.COm
2103323	string	\xcd\x21		COM executable for MS-DOS
21034!:mime	application/x-dosexec
21035!:ext	com
21036#LOADFIX.cOm LOADFIX.cOm
2103730	string	\xcd\x21		COM executable for MS-DOS
21038!:mime	application/x-dosexec
21039!:ext	com
21040#syslinux.com 3.11
2104170	string	\xcd\x21		COM executable for DOS
21042!:mime	application/x-dosexec
21043!:ext	com
21044# many compressed/converted COMs start with a copy loop instead of a jump
210450x6	search/0xa	\xfc\x57\xf3\xa5\xc3	COM executable for MS-DOS
21046!:mime	application/x-dosexec
21047!:ext	com
210480x6	search/0xa	\xfc\x57\xf3\xa4\xc3	COM executable for DOS
21049!:mime	application/x-dosexec
21050!:ext	com
21051>0x18	search/0x10	\x50\xa4\xff\xd5\x73	\b, aPack compressed
210520x3c	string		W\ Collis\0\0		COM executable for MS-DOS, Compack compressed
21053!:mime	application/x-dosexec
21054!:ext	com
21055# FIXME: missing diet .com compression
21056
21057# miscellaneous formats
210580	string/b	LZ		MS-DOS executable (built-in)
21059#0	byte		0xf0		MS-DOS program library data
21060#
21061
21062# AAF files:
21063# <stuartc@rd.bbc.co.uk> Stuart Cunningham
210640	string/b	\320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377			AAF legacy file using MS Structured Storage
21065>30	byte	9		(512B sectors)
21066>30	byte	12		(4kB sectors)
210670	string/b	\320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001			AAF file using MS Structured Storage
21068>30	byte	9		(512B sectors)
21069>30	byte	12		(4kB sectors)
21070
21071# Popular applications
210722080	string	Microsoft\ Word\ 6.0\ Document	%s
21073!:mime	application/msword
210742080	string	Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
21075!:mime	application/msword
21076# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
210772112	string	MSWordDoc			Microsoft Word document data
21078!:mime	application/msword
21079#
210800	belong	0x31be0000			Microsoft Word Document
21081!:mime	application/msword
21082#
210830	string/b	PO^Q`				Microsoft Word 6.0 Document
21084!:mime	application/msword
21085#
210864   long        0
21087>0  belong      0xfe320000      Microsoft Word for Macintosh 1.0
21088!:mime	application/msword
21089!:ext   mcw
21090>0  belong      0xfe340000      Microsoft Word for Macintosh 3.0
21091!:mime	application/msword
21092!:ext   mcw
21093>0  belong      0xfe37001c      Microsoft Word for Macintosh 4.0
21094!:mime	application/msword
21095!:ext   mcw
21096>0  belong      0xfe370023      Microsoft Word for Macintosh 5.0
21097!:mime	application/msword
21098!:ext   mcw
21099
211000	string/b	\333\245-\0\0\0			Microsoft Word 2.0 Document
21101!:mime	application/msword
21102!:ext   doc
21103# Note: seems already recognized as "OLE 2 Compound Document" in ./ole2compounddocs
21104#512	string/b	\354\245\301			Microsoft Word Document
21105#!:mime	application/msword
21106
21107#
211080	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
21109!:mime application/msword
21110#
211112080	string	Microsoft\ Excel\ 5.0\ Worksheet	%s
21112!:mime	application/vnd.ms-excel
21113#
211140	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
21115!:mime application/msword
21116
211172080	string	Foglio\ di\ lavoro\ Microsoft\ Exce	%s
21118!:mime	application/vnd.ms-excel
21119#
21120# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
211212114	string	Biff5		Microsoft Excel 5.0 Worksheet
21122!:mime	application/vnd.ms-excel
21123# Italian MS-Excel
211242121	string	Biff5		Microsoft Excel 5.0 Worksheet
21125!:mime	application/vnd.ms-excel
211260	string/b	\x09\x04\x06\x00\x00\x00\x10\x00	Microsoft Excel Worksheet
21127!:mime	application/vnd.ms-excel
21128#
21129# Update: Joerg Jenderek
21130# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3
21131# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf
21132# Note: newer Lotus versions >2 use longer BOF record
21133# record type (BeginningOfFile=0000h) + length (001Ah)
211340	belong	0x00001a00
21135# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3
21136#>18	uleshort&0x73E0	0
21137# Lotus Multi Byte Character Set (LMBCS=1-31)
21138>20	ubyte		>0
21139>>20	ubyte		<32	Lotus 1-2-3
21140#!:mime	application/x-123
21141!:mime	application/vnd.lotus-1-2-3
21142!:apple	????L123
21143# (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data"
21144>>>4	uleshort	0x1000	WorKsheet, version 3
21145!:ext	wk3
21146# (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data"
21147>>>4	uleshort	0x1002	WorKsheet, version 4
21148# also worksheet template 4 (.wt4)
21149!:ext	wk4/wt4
21150# no example or documentation for wk5
21151#>>4	uleshort	0x????	WorKsheet, version 4
21152#!:ext	wk5
21153# only MacrotoScript.123 example
21154>>>4	uleshort	0x1003	WorKsheet, version 97
21155# also worksheet template Smartmaster (.12M)?
21156!:ext	123
21157# only Set_Y2K.123 example
21158>>>4	uleshort	0x1005	WorKsheet, version 9.8 Millennium
21159!:ext	123
21160# no example for this version
21161>>>4	uleshort	0x8001	FoRMatting data
21162!:ext	frm
21163# (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data"
21164# TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet"
21165>>>4	uleshort	0x8007	ForMatting data, version 3
21166!:ext	fm3
21167>>>4	default		x	unknown
21168# file revision sub code 0004h for worksheets
21169>>>>6	uleshort	=0x0004	worksheet
21170!:ext	wXX
21171>>>>6	uleshort	!0x0004	formatting data
21172!:ext	fXX
21173# main revision number
21174>>>>4	uleshort	x	\b, revision 0x%x
21175>>>6	uleshort	=0x0004	\b, cell range
21176# active cellcoord range (start row, page,column ; end row, page, column)
21177# start values normally 0~1st sheet A1
21178>>>>8	ulelong		!0
21179>>>>>10	ubyte		>0	\b%d*
21180>>>>>8	uleshort	x	\b%d,
21181>>>>>11	ubyte		x	\b%d-
21182# end page mostly 0
21183>>>>14	ubyte		>0	\b%d*
21184# end raw, column normally not 0
21185>>>>12	uleshort	x	\b%d,
21186>>>>15	ubyte		x	\b%d
21187# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??)
21188>>>>20	ubyte		>1	\b, character set 0x%x
21189# flags
21190>>>>21	ubyte		x	\b, flags 0x%x
21191>>>6	uleshort	!0x0004
21192# record type (FONTNAME=00AEh)
21193>>>>30	search/29	\0\xAE
21194# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n)
21195>>>>>&4	string		>\0	\b, 1st font "%s"
21196#
21197# Update: Joerg Jenderek
21198# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3
21199# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT
21200# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x
21201# record type (BeginningOfFile=0000h) + length (0002h)
212020	belong	0x00000200
21203# GRR: line above is too general as it catches also MS Windows CURsor
21204# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1)
21205!:strength -1
21206# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h
21207>7	ubyte		0
21208# skip Windows cursors with image width 256 and keep Lotus with positiv opcode
21209>>6	ubyte		>0	Lotus
21210# !:mime	application/x-123
21211!:mime	application/vnd.lotus-1-2-3
21212!:apple	????L123
21213# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...)
21214# undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3"
21215>>>4	uleshort	0x0007	1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF)
21216!:ext	cnf
21217>>>4	uleshort	0x0C05	1-2-3 CoNFiguration, version 2.4J
21218!:ext	cnf
21219>>>4	uleshort	0x0801	1-2-3 CoNFiguration, version 1-2.1
21220!:ext	cnf
21221>>>4	uleshort	0x0802	Symphony CoNFiguration
21222!:ext	cnf
21223>>>4	uleshort	0x0804	1-2-3 CoNFiguration, version 2.2
21224!:ext	cnf
21225>>>4	uleshort	0x080A	1-2-3 CoNFiguration, version 2.3-2.4
21226!:ext	cnf
21227>>>4	uleshort	0x1402	1-2-3 CoNFiguration, version 3.x
21228!:ext	cnf
21229>>>4	uleshort	0x1450	1-2-3 CoNFiguration, version 4.x
21230!:ext	cnf
21231# (version 5.26) labeled the entry as "Lotus 123"
21232# TrID labeles the entry as "Lotus 123 Worksheet (generic)"
21233>>>4	uleshort	0x0404	1-2-3 WorKSheet, version 1
21234# extension "wks" also for Microsoft Works document
21235!:ext	wks
21236# (version 5.26) labeled the entry as "Lotus 123"
21237# TrID labeles the entry as "Lotus 123 Worksheet (generic)"
21238>>>4	uleshort	0x0405	Symphony WoRksheet, version 1.0
21239!:ext	wrk/wr1
21240# (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data"
21241# TrID labeles the entry as "Lotus 123 Worksheet (V2)"
21242>>>4	uleshort	0x0406	1-2-3/Symphony worksheet, version 2
21243# Symphony (.wr1)
21244!:ext	wk1/wr1
21245# no example for this japan version
21246>>>4	uleshort	0x0600	1-2-3 WorKsheet, version 1.xJ
21247!:ext	wj1
21248# no example or documentation for wk2
21249#>>>4	uleshort	0x????	1-2-3 WorKsheet, version 2
21250#!:ext	wk2
21251# undocumented japan version
21252>>>4	uleshort	0x0602	1-2-3 worksheet, version 2.4J
21253!:ext	wj3
21254# (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data"
21255>>>4	uleshort	0x8006	1-2-3 ForMaTting data, version 2.x
21256# japan version 2.4J (fj3)
21257!:ext	fmt/fj3
21258# no example for this version
21259>>>4	uleshort	0x8007	1-2-3 FoRMatting data, version 2.0
21260!:ext	frm
21261# (version 5.26) labeled the entry as "Lotus 1-2-3"
21262>>>4	default		x	unknown worksheet or configuration
21263!:ext	cnf
21264>>>>4	uleshort	x	\b, revision 0x%x
21265# 2nd record for most worksheets describes cells range
21266>>>6		use	lotus-cells
21267# 3nd record for most japan worksheets describes cells range
21268>>>(8.s+10)	use	lotus-cells
21269#	check and then display Lotus worksheet cells range
212700	name		lotus-cells
21271# look for type (RANGE=0006h) + length (0008h) at record begin
21272>0	ubelong	0x06000800	\b, cell range
21273# cell range (start column, row, end column, row) start values normally 0,0~A1 cell
21274>>4	ulong		!0
21275>>>4	uleshort	x	\b%d,
21276>>>6	uleshort	x	\b%d-
21277# end of cell range
21278>>8	uleshort	x	\b%d,
21279>>10	uleshort	x	\b%d
21280# EndOfLotus123
212810	string/b		WordPro\0	Lotus WordPro
21282!:mime	application/vnd.lotus-wordpro
212830	string/b		WordPro\r\373	Lotus WordPro
21284!:mime	application/vnd.lotus-wordpro
21285
21286
21287# Summary: Script used by InstallScield to uninstall applications
21288# Extension: .isu
21289# Submitted by: unknown
21290# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry)
212910		string		\x71\xa8\x00\x00\x01\x02
21292>12		string		Stirling\ Technologies,		InstallShield Uninstall Script
21293
21294# Winamp .avs
21295#0	string	Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
212960	string/b	Nullsoft\ AVS\ Preset\ 	Winamp plug in
21297
21298# Windows Metafile .WMF
212990	string/b	\327\315\306\232	Windows metafile
21300!:mime	image/wmf
21301!:ext	wmf
213020	string/b	\002\000\011\000	Windows metafile
21303!:mime	image/wmf
21304!:ext	wmf
213050	string/b	\001\000\011\000	Windows metafile
21306!:mime	image/wmf
21307!:ext	wmf
21308
21309#tz3 files whatever that is (MS Works files)
213100	string/b	\003\001\001\004\070\001\000\000	tz3 ms-works file
213110	string/b	\003\002\001\004\070\001\000\000	tz3 ms-works file
213120	string/b	\003\003\001\004\070\001\000\000	tz3 ms-works file
21313
21314# PGP sig files .sig
21315#0 string \211\000\077\003\005\000\063\237\127 065 to  \027\266\151\064\005\045\101\233\021\002 PGP sig
213160 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
213170 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
213180 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
213190 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
213200 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
213210 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
21322
21323# windows zips files .dmf
213240	string/b	MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
21325
21326
21327#ico files
213280	string/b	\102\101\050\000\000\000\056\000\000\000\000\000\000\000	Icon for MS Windows
21329
21330# Windows icons
21331# Update: Joerg Jenderek
21332# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
21333# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG
213340   belong  0x00000100
21335>9  byte    0
21336>>0 byte    x
21337>>0 use     cur-ico-dir
21338>9  ubyte   0xff
21339>>0 byte    x
21340>>0 use     cur-ico-dir
21341#	displays number of icons and information for icon or cursor
213420	name		cur-ico-dir
21343# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with
21344# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h
21345>18		ulelong		&0x00000006
21346# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG)
21347>>(18.l)	ulelong		x		MS Windows
21348>>>0		ubelong		0x00000100	icon resource
21349# https://www.iana.org/assignments/media-types/image/vnd.microsoft.icon
21350!:mime		image/vnd.microsoft.icon
21351#!:mime		image/x-icon
21352!:ext		ico
21353>>>>4 		uleshort	x		- %d icon
21354# plural s
21355>>>>4 		uleshort	>1		\bs
21356# 1st icon
21357>>>>0x06	use		ico-entry
21358# 2nd icon
21359>>>>4 		uleshort	>1
21360>>>>>0x16	use		ico-entry
21361>>>0		ubelong		0x00000200	cursor resource
21362#!:mime		image/x-cur
21363!:mime		image/x-win-bitmap
21364!:ext		cur
21365>>>>4 		uleshort	x		- %d icon
21366>>>>4 		uleshort	>1		\bs
21367# 1st cursor
21368>>>>0x06	use		cur-entry
21369#>>>>0x16	use		cur-entry
21370#	display information of one cursor entry
213710	name		cur-entry
21372>0	use		cur-ico-entry
21373>4	uleshort	x	\b, hotspot @%dx
21374>6	uleshort	x	\b%d
21375#	display information of one icon entry
213760	name		ico-entry
21377>0			use	cur-ico-entry
21378# normally 0 1 but also found 14
21379>4	uleshort	>1	\b, %d planes
21380# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256
21381>6	uleshort	>1	\b, %d bits/pixel
21382#	display shared information of cursor or icon entry
213830		name		cur-ico-entry
21384>0		byte		=0		\b, 256x
21385>0		byte		!0		\b, %dx
21386>1		byte        	=0		\b256
21387>1		byte        	!0		\b%d
21388# number of colors in palette
21389>2		ubyte		!0		\b, %d colors
21390# reserved 0 FFh
21391#>3		ubyte        	x		\b, reserved %x
21392#>8		ulelong		x		\b, image size %d
21393# offset of PNG or DIB image
21394#>12		ulelong		x		\b, offset 0x%x
21395# PNG header (\x89PNG)
21396>(12.l)		ubelong		=0x89504e47
21397# 1 space char after "with" to get phrase "with PNG image" by magic in ./images
21398>>&-4		indirect	x	\b with
21399# DIB image
21400>(12.l)		ubelong		!0x89504e47
21401#>>&-4		use     	dib-image
21402
21403# Windows non-animated cursors
21404# Update: Joerg Jenderek
21405# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
21406# Note: similar to Windows ICOn. container for BMP ( only DIB part)
21407# GRR: line below is too general as it catches also Lotus 1-2-3 files
214080   belong  0x00000200
21409>9  byte    0
21410>>0 use     cur-ico-dir
21411>9  ubyte   0xff
21412>>0 use     cur-ico-dir
21413
21414# .chr files
214150	string/b	PK\010\010BGI	Borland font
21416>4	string	>\0	%s
21417# then there is a copyright notice
21418
21419
21420# .bgi files
214210	string/b	pk\010\010BGI	Borland device
21422>4	string	>\0	%s
21423# then there is a copyright notice
21424
21425
21426# Windows Recycle Bin record file (named INFO2)
21427# By Abel Cheung (abelcheung AT gmail dot com)
21428# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes
21429# Since Vista uses another structure, INFO2 structure probably won't change
21430# anymore. Detailed analysis in:
21431# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf
214320	lelong		0x00000004
21433>12	lelong		0x00000118	Windows Recycle Bin INFO2 file (Win98 or below)
21434
214350	lelong		0x00000005
21436>12	lelong		0x00000320	Windows Recycle Bin INFO2 file (Win2k - WinXP)
21437
21438# From Doug Lee via a FreeBSD pr
214399	string		GERBILDOC	First Choice document
214409	string		GERBILDB	First Choice database
214419	string		GERBILCLIP	First Choice database
214420	string		GERBIL		First Choice device file
214439	string		RABBITGRAPH	RabbitGraph file
214440	string		DCU1		Borland Delphi .DCU file
214450	string		=!<spell>	MKS Spell hash list (old format)
214460	string		=!<spell2>	MKS Spell hash list
21447# Too simple - MPi
21448#0	string		AH		Halo(TM) bitmapped font file
214490	lelong		0x08086b70	TurboC BGI file
214500	lelong		0x08084b50	TurboC Font file
21451
21452# Debian#712046: The magic below identifies "Delphi compiled form data".
21453# An additional source of information is available at:
21454# http://www.woodmann.com/fravia/dafix_t1.htm
214550	string		TPF0
21456>4	pstring		>\0		Delphi compiled form '%s'
21457
21458# tests for DBase files moved, updated and merged to database
21459
214600	string		PMCC		Windows 3.x .GRP file
214611	string		RDC-meg		MegaDots
21462>8	byte		>0x2F		version %c
21463>9	byte		>0x2F		\b.%c file
214640	lelong		0x4C
21465>4	lelong		0x00021401	Windows shortcut file
21466
21467# .PIF files added by Joerg Jenderek from https://smsoft.ru/en/pifdoc.htm
21468# only for windows versions equal or greater 3.0
214690x171	string	MICROSOFT\ PIFEX\0	Windows Program Information File
21470!:mime	application/x-dosexec
21471!:ext	pif
21472#>2	string	 	>\0		\b, Title:%.30s
21473>0x24	string		>\0		\b for %.63s
21474>0x65	string		>\0		\b, directory=%.64s
21475>0xA5	string		>\0		\b, parameters=%.64s
21476#>0x181	leshort	x	\b, offset %x
21477#>0x183	leshort	x	\b, offsetdata %x
21478#>0x185	leshort	x	\b, section length %x
21479>0x187	search/0xB55	WINDOWS\ VMM\ 4.0\0
21480>>&0x5e		ubyte	>0
21481>>>&-1		string	<PIFMGR.DLL		\b, icon=%s
21482#>>>&-1		string	PIFMGR.DLL		\b, icon=%s
21483>>>&-1		string	>PIFMGR.DLL		\b, icon=%s
21484>>&0xF0		ubyte	>0
21485>>>&-1		string	<Terminal		\b, font=%.32s
21486#>>>&-1		string	=Terminal		\b, font=%.32s
21487>>>&-1		string	>Terminal		\b, font=%.32s
21488>>&0x110	ubyte	>0
21489>>>&-1		string	<Lucida\ Console	\b, TrueTypeFont=%.32s
21490#>>>&-1		string	=Lucida\ Console	\b, TrueTypeFont=%.32s
21491>>>&-1		string	>Lucida\ Console	\b, TrueTypeFont=%.32s
21492#>0x187	search/0xB55	WINDOWS\ 286\ 3.0\0	\b, Windows 3.X standard mode-style
21493#>0x187	search/0xB55	WINDOWS\ 386\ 3.0\0	\b, Windows 3.X enhanced mode-style
21494>0x187	search/0xB55	WINDOWS\ NT\ \ 3.1\0	\b, Windows NT-style
21495#>0x187	search/0xB55	WINDOWS\ NT\ \ 4.0\0	\b, Windows NT-style
21496>0x187	search/0xB55	CONFIG\ \ SYS\ 4.0\0	\b +CONFIG.SYS
21497#>>&06		string	x			\b:%s
21498>0x187	search/0xB55	AUTOEXECBAT\ 4.0\0	\b +AUTOEXEC.BAT
21499#>>&06		string	x			\b:%s
21500
21501# DOS EPS Binary File Header
21502# From: Ed Sznyter <ews@Black.Market.NET>
215030	belong		0xC5D0D3C6	DOS EPS Binary File
21504!:mime	image/x-eps
21505>4	long		>0		Postscript starts at byte %d
21506>>8	long		>0		length %d
21507>>>12	long		>0		Metafile starts at byte %d
21508>>>>16	long		>0		length %d
21509>>>20	long		>0		TIFF starts at byte %d
21510>>>>24	long		>0		length %d
21511
21512# TNEF magic From "Joomy" <joomy@se-ed.net>
21513# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
215140	lelong		0x223e9f78	TNEF
21515!:mime	application/vnd.ms-tnef
21516
21517# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C
21518# of http://www.davep.org/norton-guides/ng2h-105.tgz
21519# https://en.wikipedia.org/wiki/Norton_Guides
215200	string		NG\0\001
21521# only value 0x100 found at offset 2
21522>2	ulelong		0x00000100	Norton Guide
21523# Title[40]
21524>>8	string		>\0		"%-.40s"
21525#>>6	uleshort	x		\b, MenuCount=%u
21526# szCredits[5][66]
21527>>48	string		>\0		\b, %-.66s
21528>>114	string		>\0		%-.66s
21529
21530# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
21531# of https://www.4dos.info/
21532# pointer,HelpID[8]=4DHnnnmm
215330	ulelong	0x48443408		4DOS help file
21534>4	string	x			\b, version %-4.4s
21535
21536# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp
215370	ulequad	0x3a000000024e4c	MS Advisor help file
21538
21539# HtmlHelp files (.chm)
215400	string/b	ITSF\003\000\000\000\x60\000\000\000	MS Windows HtmlHelp Data
21541
21542# GFA-BASIC (Wolfram Kleff)
215432	string/b	GFA-BASIC3	GFA-BASIC 3 data
21544
21545#------------------------------------------------------------------------------
21546# From Stuart Caie <kyzer@4u.net> (developer of cabextract)
21547# Update: Joerg Jenderek
21548# URL: https://en.wikipedia.org/wiki/Cabinet_(file_format)
21549# Reference: https://msdn.microsoft.com/en-us/library/bb267310.aspx
21550# Note: verified by `7z l *.cab`
21551# Microsoft Cabinet files
215520	string/b	MSCF\0\0\0\0	Microsoft Cabinet archive data
21553#
21554# https://support.microsoft.com/en-us/help/973559/frequently-asked-questions-about-the-microsoft-support-diagnostic-tool
21555# CAB with *.{diagcfg,diagpkg} is used by Microsoft Support Diagnostic Tool MSDT.EXE
21556# because some archive does not have *.diag* as 1st or 2nd archive member like
21557# O15CTRRemove.diagcab or AzureStorageAnalyticsLogs_global.DiagCab
21558# brute looking after header for filenames with diagcfg or diagpkg extension in CFFILE section
21559>0x2c	search/980/c	.diag		\b, Diagnostic
21560!:mime	application/vnd.ms-cab-compressed
21561!:ext	diagcab
21562# http://fileformats.archiveteam.org/wiki/PUZ
21563# Microsoft Publisher version about 2003 has a "Pack and Go" feature that
21564# bundles a Publisher document *PNG.pub with all links into a CAB
21565>0x2c	search/300/c	png.pub\0		\b, Publisher Packed and Go
21566!:mime	application/vnd.ms-cab-compressed
21567!:ext	puz
21568# ppz variant with Microsoft PowerPoint Viewer ppview32.exe to play PowerPoint presentation
21569>0x2c	search/17/c	ppview32.exe\0		\b, PowerPoint Viewer Packed and Go
21570!:mime	application/vnd.ms-powerpoint
21571#!:mime	application/mspowerpoint
21572!:ext	ppz
21573# http://www.incredimail.com/
21574# IncrediMail CAB contains an initialisation file "content.ini" like in im2.ims
21575>0x2c	search/3369/c	content.ini\0	\b, IncrediMail
21576!:mime	application/x-incredimail
21577# member Flavor.htm implies IncrediMail ecard like in tell_a_friend.imf
21578>>0x2c	search/83/c	Flavor.htm\0	ecard
21579!:ext	imf
21580# member Macromedia Flash data *.swf implies IncrediMail skin like in im2.ims
21581>>0x2c	search/211/c	.swf\0		skin
21582!:ext	ims
21583# member anim.im3 implies IncrediMail animation like in letter_fold.ima
21584>>0x2c	search/92/c	anim.im3\0	animation
21585!:ext	ima
21586# other IncrediMail cab archive
21587>>0x2c	default		x
21588>>>0x2c	search/116/c	thumb		ecard, image, notifier or skin
21589!:ext	imf/imi/imn/ims
21590# http://file-extension.net/seeker/file_extension_ime
21591>>>0x2c	default		x		emoticons or sound
21592!:ext	ime/imw
21593# no Diagnostic and IncrediMail
21594>0x2c	default		x
21595# look for 1st member name
21596>>(16.l+16)	ubyte	x
21597# https://en.wikipedia.org/wiki/SNP_file_format
21598>>>&-1	string/c 	_accrpt_.snp	\b, Access report snapshot
21599!:mime	application/msaccess
21600!:ext	snp
21601# https://www.cabextract.org.uk/wince_cab_format/
21602# extension of DOS 8+3 name with ".000" of 1st archive member name implies Windows CE installer
21603>>>&7	string 		=.000		\b, WinCE install
21604!:mime	application/vnd.ms-cab-compressed
21605!:ext	cab
21606
21607# https://support.microsoft.com/kb/934307/en-US
21608# All inspected MSU contain a file with name WSUSSCAN.cab
21609# that is called "Windows Update meta data" by Microsoft
21610>>>&-1	string/c 	wsusscan.cab	\b, Microsoft Standalone Update
21611!:mime	application/vnd.ms-cab-compressed
21612!:ext	msu
21613>>>&-1	default		x
21614# look at point charcter of 1st archive member name for file name extension
21615>>>>&-1	search/255 	.
21616# http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm
21617# PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002
21618# packs optional files, a PowerPoint presentation *.ppt with optional PLAYLIST.LST to CAB
21619>>>>>&0	string/c	ppt\0		\b, PowerPoint Packed and Go
21620!:mime	application/vnd.ms-powerpoint
21621#!:mime	application/mspowerpoint
21622!:ext	ppz
21623# https://msdn.microsoft.com/en-us/library/windows/desktop/bb773190(v=vs.85).aspx
21624# first member *.theme implies Windows 7 Theme Pack like in CommunityShowcaseAqua3.themepack
21625# or Windows 8 Desktop Theme Pack like in PanoramicGlaciers.deskthemepack
21626>>>>>&0	string/c	theme		\b, Windows
21627!:mime	application/x-windows-themepack
21628# https://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8
21629# 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack
21630# with MTSM=RJSPBS in [MasterThemeSelector] inside *.theme
21631>>>>>>(16.l+16)	string	=Panoram	8
21632!:ext	deskthemepack
21633>>>>>>(16.l+16)	string	!Panoram	7 or 8
21634!:ext	themepack/deskthemepack
21635>>>>>>(16.l+16)	ubyte	x		Theme Pack
21636>>>>>&0	default		x
21637# look for null terminator of 1st member name
21638>>>>>>&0	search/255 	\0
21639# 2nd member name WSUSSCAN.cab like in Microsoft-Windows-MediaFeaturePack-OOB-Package.msu
21640>>>>>>>&16	string/c 	wsusscan.cab	\b, Microsoft Standalone Update
21641!:mime	application/vnd.ms-cab-compressed
21642!:ext	msu
21643>>>>>>>&16	default	x
21644# archive with more then one file need some output in version 5.32 to avoid error message like
21645# Magdir/msdos, 1138: Warning: Current entry does not yet have a description for adding a MIME type
21646# Magdir/msdos, 1139: Warning: Current entry does not yet have a description for adding a EXTENSION type
21647# file: could not find any valid magic files!
21648>>>>>>>>28	uleshort	>1	\b, many
21649!:mime	application/vnd.ms-cab-compressed
21650!:ext	cab
21651# remaining archives with just one file
21652>>>>>>>>28	uleshort	=1
21653# neither extra bytes nor cab chain implies Windows 2000,XP setup files in directory i386
21654>>>>>>>>>30	uleshort	=0x0000	\b, Windows 2000/XP setup
21655# cut of last char of source extension and add underscore to generate extension
21656# TERMCAP._ ... FXSCOUNT.H_ ... L3CODECA.AC_ ... NPDRMV2.ZI_
21657!:mime	application/vnd.ms-cab-compressed
21658!:ext	_/?_/??_
21659# archive need some output like "single" in version 5.32 to avoid error messages
21660>>>>>>>>>30	uleshort	!0x0000	\b, single
21661!:mime	application/vnd.ms-cab-compressed
21662!:ext	cab
21663# TODO: additional extensions like
21664# .xsn	InfoPath Dynamic Form
21665# .xtp	InfoPath Template Part
21666# .lvf	Logitech Video Effects Face Accessory
21667>8	ulelong		x		\b, %u bytes
21668>28	uleshort		1		\b, 1 file
21669>28	uleshort		>1		\b, %u files
21670# Reserved fields, set to zero
21671#>4	belong		!0		\b, reserved1 %x
21672#>12	belong		!0		\b, reserved2 %x
21673# offset of the first CFFILE entry coffFiles: minimal 2Ch
21674>16	ulelong		x		\b, at 0x%x
21675>(16.l)	use		cab-file
21676# at least also 2nd member
21677>28	uleshort		>1
21678>>(16.l+16)	ubyte	x
21679>>>&0	search/255 	\0
21680# second member info
21681>>>>&0	use		cab-file
21682#>20	belong		!0		\b, reserved %x
21683# Cabinet file format version. Currently, versionMajor = 1 and versionMinor = 3
21684>24	ubeshort	!0x0301		\b version 0x%x
21685# number of CFFOLDER entries
21686>26	uleshort	>1		\b, %u cffolders
21687# cabinet file option indicators 1~PREVIOUS, 2~NEXT, 4~reserved fields
21688# only found for flags 0 1 2 3 4 not 7
21689>30	uleshort	>0		\b, flags 0x%x
21690# Cabinet files have a 16-bit cabinet setID field that is designed for application use.
21691# default is zero, however, the -i option of cabarc can be used to set this field
21692>32	uleshort	>0		\b, ID %u
21693# iCabinet is number of this cabinet file in a set, where 0 for the first cabinet
21694#>34	uleshort	x		\b, iCabinet %u
21695# add one for display because humans start numbering by 1 and also fit to name of disk szDisk*
21696>34	uleshort+1	x		\b, number %u
21697>30	uleshort	&0x0004		\b, extra bytes
21698# cbCFHeader optional size of per-cabinet reserved area 14h 1800h
21699>>36	uleshort	>0		%u in head
21700# cbCFFolder is optional size of per-folder reserved area
21701>>38	ubyte		>0		%u in folder
21702# cbCFData is optional size of per-datablock reserved area
21703>>39	ubyte		>0		%u in data block
21704# optional per-cabinet reserved area abReserve[cbCFHeader]
21705>>36	uleshort	>0
21706# 1st CFFOLDER after reserved area in header
21707>>>(36.s+40)	use			cab-folder
21708# no reserved area in header
21709>30	uleshort	^0x0004
21710# no previous and next cab archive
21711>>30	uleshort		=0x0000
21712>>>36	use				cab-folder
21713# only previous cab archive
21714>>30	uleshort		=0x0001	\b, previous
21715>>>36	use				cab-anchor
21716# only next cab archive
21717>>30	uleshort		=0x0002	\b, next
21718>>>36	use				cab-anchor
21719# previous+next cab archive
21720# can not use sub routine cab-anchor to display previous and next cabinet together
21721#>>>36	use				cab-anchor
21722#>>>>&0	use				cab-anchor
21723>>30	uleshort		=0x0003	\b, previous
21724>>>36	string		x		%s
21725# optional name of previous disk szDisk*
21726>>>>&1	string		x		disk %s
21727>>>>>&1	string		x		\b, next %s
21728# optional name of previous disk szDisk*
21729>>>>>>&1	string		x	disk %s
21730>>>>>>>&1	use			cab-folder
21731#	display filename and disk name of previous or next cabinet
217320       name    			cab-anchor
21733# optional name of previous/next cabinet file szCabinet*[255]
21734>&0	string		x		%s
21735# optional name of previous/next disk szDisk*[255]
21736>>&1	string		x		disk %s
21737#	display folder structure CFFOLDER information like compression of cabinet
217380       name    			cab-folder
21739# offset of the CFDATA block in this folder
21740#>0	ulelong		x		\b, coffCabStart 0x%x
21741# number of CFDATA blocks in folder
21742>4	uleshort	x		\b, %u datablock
21743# plural s
21744>4	uleshort	>1		\bs
21745# compression typeCompress: 0~None 1~MSZIP 0x1503~LZX:21 0x1003~LZX:16 0x0f03~LZX:15
21746>6	uleshort	x		\b, 0x%x compression
21747# optional per-folder reserved area
21748#>8	ubequad		x		\b, abReserve 0x%llx
21749#	display member structure CFFILE information like member name of cabinet
217500       name    			cab-file
21751# cbFile is uncompressed size of file in bytes
21752#>0	ulelong		x		\b, cbFile %u
21753# uoffFolderStart is uncompressed offset of file in folder
21754#>4	ulelong		>0		\b, uoffFolderStart 0x%x
21755# iFolder is index into the CFFOLDER area. 0 indicates first folder in cabinet
21756# define ifoldCONTINUED_FROM_PREV      (0xFFFD)
21757# define ifoldCONTINUED_TO_NEXT        (0xFFFE)
21758# define ifoldCONTINUED_PREV_AND_NEXT  (0xFFFF)
21759>8	uleshort	>0		\b, iFolder 0x%x
21760# date stamp for file
21761#>10	uleshort	x		\b, date 0x%x
21762# time stamp for file
21763#>12	uleshort	x		\b, time 0x%x
21764# attribs is attribute flags for file
21765# define  _A_RDONLY       (0x01)  file is read-only
21766# define  _A_HIDDEN       (0x02)  file is hidden
21767# define  _A_SYSTEM       (0x04)  file is a system file
21768# define  _A_ARCH         (0x20)  file modified since last backup
21769# example http://sebastien.kirche.free.fr/pebuilder_plugins/depends.cab
21770# define  _A_EXEC         (0x40)  run after extraction
21771# define  _A_NAME_IS_UTF  (0x80)  szName[] contains UTF
21772# define  UNKNOWN       (0x0100)  undocumented or accident
21773#>14	uleshort	x		\b, attribs 0x%x
21774>14	uleshort	>0		+
21775>>14	uleshort	&0x0001		\bR
21776>>14	uleshort	&0x0002		\bH
21777>>14	uleshort	&0x0004		\bS
21778>>14	uleshort	&0x0020		\bA
21779>>14	uleshort	&0x0040		\bX
21780>>14	uleshort	&0x0080		\bUtf
21781# unknown 0x0100 flag found on one XP_CD:\I386\DRIVER.CAB
21782>>14	uleshort	&0x0100		\b?
21783# szName is name of archive member
21784>16	string		x		"%s"
21785# next archive member name if more files
21786#>>&17	string		>\0		\b, NEXT NAME %-.50s
21787
21788# InstallShield Cabinet files
217890	string/b	ISc(		InstallShield Cabinet archive data
21790>5	byte&0xf0	=0x60		version 6,
21791>5	byte&0xf0	!0x60		version 4/5,
21792>(12.l+40)	lelong	x		%u files
21793
21794# Windows CE package files
217950	string/b	MSCE\0\0\0\0	Microsoft WinCE install header
21796>20	lelong		0		\b, architecture-independent
21797>20	lelong		103		\b, Hitachi SH3
21798>20	lelong		104		\b, Hitachi SH4
21799>20	lelong		0xA11		\b, StrongARM
21800>20	lelong		4000		\b, MIPS R4000
21801>20	lelong		10003		\b, Hitachi SH3
21802>20	lelong		10004		\b, Hitachi SH3E
21803>20	lelong		10005		\b, Hitachi SH4
21804>20	lelong		70001		\b, ARM 7TDMI
21805>52	leshort		1		\b, 1 file
21806>52	leshort		>1		\b, %u files
21807>56	leshort		1		\b, 1 registry entry
21808>56	leshort		>1		\b, %u registry entries
21809
21810
21811# Windows Enhanced Metafile (EMF)
21812# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
21813# for further information.
218140	ulelong 1
21815>40	string	\ EMF		Windows Enhanced Metafile (EMF) image data
21816>>44	ulelong x		version 0x%x
21817
21818
218190	string/b	\224\246\056		Microsoft Word Document
21820!:mime	application/msword
21821
21822512	string	R\0o\0o\0t\0\ \0E\0n\0t\0r\0y	Microsoft Word Document
21823!:mime	application/msword
21824
21825# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
21826# Magic type for Dell's BIOS .hdr files
21827# Dell's .hdr
218280	string/b $RBU
21829>23	string Dell			%s system BIOS
21830>5	byte   2
21831>>48	byte   x			version %d.
21832>>49	byte   x			\b%d.
21833>>50	byte   x			\b%d
21834>5	byte   <2
21835>>48	string x			version %.3s
21836
21837# Type: Microsoft Document Imaging Format (.mdi)
21838# URL:	https://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
21839# From: Daniele Sempione <scrows@oziosi.org>
21840# Too weak (EP)
21841#0	short	0x5045			Microsoft Document Imaging Format
21842
21843# MS eBook format (.lit)
218440	string/b	ITOLITLS		Microsoft Reader eBook Data
21845>8	lelong	x			\b, version %u
21846!:mime					application/x-ms-reader
21847
21848# Windows CE Binary Image Data Format
21849# From: Dr. Jesus <j@hug.gs>
218500	string/b	B000FF\n	Windows Embedded CE binary image
21851
21852# The second byte of these signatures is a file version; I don't know what,
21853# if anything, produced files with version numbers 0-2.
21854# From: John Elliott <johne@seasip.demon.co.uk>
218550	string	\xfc\x03\x00	Mallard BASIC program data (v1.11)
218560	string	\xfc\x04\x00	Mallard BASIC program data (v1.29+)
218570	string	\xfc\x03\x01	Mallard BASIC protected program data (v1.11)
218580	string	\xfc\x04\x01	Mallard BASIC protected program data (v1.29+)
21859
218600	string	MIOPEN		Mallard BASIC Jetsam data
218610	string	Jetsam0		Mallard BASIC Jetsam index data
21862
21863# DOS backup 2.0 to 3.2
21864
21865# backupid.@@@
21866
21867# plausibility check for date
218680x3	ushort	>1979
21869>0x5	ubyte-1 <31
21870>>0x6	ubyte-1 <12
21871# actually 121 nul bytes
21872>>>0x7	string	\0\0\0\0\0\0\0\0
21873>>>>0x1 ubyte	x	DOS 2.0 backup id file, sequence %d
21874!:ext @@@
21875>>>>0x0 ubyte	0xff	\b, last disk
21876
21877# backed up file
21878
21879# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd
21880# by looking for trailing nul of maximal file name string
218810x52	ubyte	0
21882# test for flag byte: FFh~complete file, 00h~split file
21883# FFh -127 =	-1 -127 =	-128
21884# 00h -127 =	 0 -127 =	-127
21885>0	byte-127	<-126
21886# plausibility check for file name length
21887>>0x53	ubyte-1	<78
21888# looking for terminating nul of file name string
21889>>>(0x53.b+4)	ubyte	0
21890# looking if last char of string is valid DOS file name
21891>>>>(0x53.b+3)	ubyte	>0x1F
21892# actually 44 nul bytes
21893# but sometimes garbage according to Ralf Quint. So can not be used as test
21894#>0x54	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
21895# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator
21896# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE
21897>>>>>5	ubyte&0x8C	0x0C
21898# ./msdos (version 5.30) labeled the entry as
21899# "DOS 2.0 backed up file %s, split file, sequence %d" or
21900# "DOS 2.0 backed up file %s, complete file"
21901>>>>>>0	ubyte	x	DOS 2.0-3.2 backed up
21902#>>>>>>0	ubyte	0xff	complete
21903>>>>>>0	ubyte	0
21904>>>>>>>1 uleshort	x	sequence %d of
21905# full file name with path but without drive letter and colon stored from 0x05 til 0x52
21906>>>>>>0x5	string	x	file %s
21907# backup name is original filename
21908#!:ext	*
21909# magic/Magdir/msdos, 1169: Warning: EXTENSION type `     *' has bad char '*'
21910# file: line 1169: Bad magic entry '  *'
21911# after header original file content
21912>>>>>>128	indirect x	\b;
21913
21914
21915# DOS backup 3.3 to 5.x
21916
21917# CONTROL.nnn files
219180	string	\x8bBACKUP\x20
21919# actually 128 nul bytes
21920>0xa	string	\0\0\0\0\0\0\0\0
21921>>0x9	ubyte	x	DOS 3.3 backup control file, sequence %d
21922>>0x8a	ubyte	0xff	\b, last disk
21923
21924# NB: The BACKUP.nnn files consist of the files backed up,
21925# concatenated.
21926
21927#------------------------------------------------------------------------------
21928# $File: msooxml,v 1.12 2019/04/19 00:42:27 christos Exp $
21929# msooxml:  file(1) magic for Microsoft Office XML
21930# From: Ralf Brown <ralf.brown@gmail.com>
21931
21932# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP
21933#   archive.  The first member file is normally "[Content_Types].xml".
21934#   but some libreoffice generated files put this later. Perhaps skip
21935#   the "[Content_Types].xml" test?
21936# Since MSOOXML doesn't have anything like the uncompressed "mimetype"
21937#   file of ePub or OpenDocument, we'll have to scan for a filename
21938#   which can distinguish between the three types
21939
219400		name		msooxml
21941>0		string		word/		Microsoft Word 2007+
21942!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document
21943>0		string		ppt/		Microsoft PowerPoint 2007+
21944!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation
21945>0		string		xl/		Microsoft Excel 2007+
21946!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
21947
21948# start by checking for ZIP local file header signature
219490		string		PK\003\004
21950!:strength +10
21951# make sure the first file is correct
21952>0x1E		use		msooxml
21953>0x1E		regex		\\[Content_Types\\]\\.xml|_rels/\\.rels|docProps
21954# skip to the second local file header
21955# since some documents include a 520-byte extra field following the file
21956# header, we need to scan for the next header
21957>>(18.l+49)	search/6000	PK\003\004
21958# now skip to the *third* local file header; again, we need to scan due to a
21959# 520-byte extra field following the file header
21960>>>&26		search/6000	PK\003\004
21961# and check the subdirectory name to determine which type of OOXML
21962# file we have.  Correct the mimetype with the registered ones:
21963# https://technet.microsoft.com/en-us/library/cc179224.aspx
21964>>>>&26		use		msooxml
21965>>>>&26		default		x
21966# OpenOffice/Libreoffice orders ZIP entry differently, so check the 4th file
21967>>>>>&26	search/6000	PK\003\004
21968>>>>>>&26	use		msooxml
21969>>>>>>&26	default		x		Microsoft OOXML
21970>>>>>&26	default		x		Microsoft OOXML
21971
21972#------------------------------------------------------------------------------
21973# $File: msvc,v 1.10 2018/10/01 19:14:03 christos Exp $
21974# msvc:  file(1) magic for msvc
21975# "H. Nanosecond" <aldomel@ix.netcom.com>
21976# Microsoft visual C
21977#
21978# I have version 1.0
21979
21980# .aps
219810	string	HWB\000\377\001\000\000\000	Microsoft Visual C .APS file
21982
21983# .ide
21984#too long 0	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316	MSVC .ide
219850	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157	MSVC .ide
21986
21987# .res
219880	string	\000\000\000\000\040\000\000\000\377	MSVC .res
219890	string	\377\003\000\377\001\000\020\020\350	MSVC .res
219900	string	\377\003\000\377\001\000\060\020\350	MSVC .res
21991
21992#.lib
219930	string	\360\015\000\000	Microsoft Visual C library
219940	string	\360\075\000\000	Microsoft Visual C library
219950	string	\360\175\000\000	Microsoft Visual C library
21996
21997#.pch
219980	string	DTJPCH0\000\022\103\006\200	Microsoft Visual C .pch
21999
22000# Summary: Symbol Table / Debug info used by Microsoft compilers
22001# URL: https://en.wikipedia.org/wiki/Program_database
22002# Reference: https://code.google.com/p/pdbparser/wiki/MSF_Format
22003# Update: Joerg Jenderek
22004# Note:	test only for Windows XP+SP3 x86 , 8.1 x64 arm and 10.1 x86
22005#	info does only applies partly for older files like msvbvm50.pdb about year 2001
220060	string	Microsoft\ C/C++\040
22007# "Microsoft Program DataBase" by TrID
22008>24	search/14	\r\n\x1A	MSVC program database
22009!:mime	application/x-ms-pdb
22010!:ext	pdb
22011# "MSF 7.00" "program database 2.00" for msvbvm50.pdb
22012>>16	regex	\([0-9.]+\)	ver %s
22013#>>>0x38	search/128123456	/LinkInfo	\b with linkinfo
22014# "MSF 7.00" variant
22015>>0x1e	leshort	0
22016# PageSize 400h 1000h
22017>>>0x20	lelong	x	\b, %d
22018# Page Count
22019>>>0x28	lelong	x	\b*%d bytes
22020# "program database 2.00"  variant
22021>>0x1e	leshort	!0
22022# PageSize 400h
22023>>>0x2c	lelong	x	\b, %d
22024# Page Count for msoo-dll.pdb 4379h
22025>>>0x32	leshort	x	\b*%d bytes
22026
22027# Reference: https://github.com/Microsoft/vstest/pull/856/commits/fdc7a9f074ca5a8dfeec83b1be9162bf0cf4000d
220280       string/c bsjb\001\000\001\000\000\000\000\000\f\000\000\000pdb\ v1.0     Microsoft Roslyn C# debugging symbols version 1.0
22029
22030#.sbr
220310	string	\000\002\000\007\000	MSVC .sbr
22032>5	string 	>\0	%s
22033
22034#.bsc
220350	string	\002\000\002\001	MSVC .bsc
22036
22037#.wsp
220380	string	1.00\ .0000.0000\000\003	MSVC .wsp version 1.0000.0000
22039# these seem to start with the version and contain menus
22040
22041#------------------------------------------------------------------------------
22042# msx:  file(1) magic for the MSX Home Computer
22043# v1.3
22044# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
22045
22046############## MSX Music file formats ##############
22047
22048# Gigamix MGSDRV music file
220490	string/b		MGS	MSX Gigamix MGSDRV3 music file,
22050>6	ubeshort	0x0D0A
22051>>3	byte		x	\bv%c
22052>>4	byte		x	\b.%c
22053>>5	byte		x	\b%c
22054>>8	string		>\0	\b, title: %s
22055
220561	string/b		mgs2\ 	MSX Gigamix MGSDRV2 music file
22057>6	uleshort	0x80
22058>>0x2E	uleshort	0
22059>>>0x30	string		>\0	\b, title: %s
22060
22061# KSS music file
220620	string/b		KSCC	KSS music file v1.03
22063>0xE	byte		0
22064>>0xF	byte&0x02	0	\b, soundchips: AY-3-8910, SCC(+)
22065>>0xF	byte&0x02	2	\b, soundchip(s): SN76489
22066>>>0xF	byte&0x04	4	stereo
22067>>0xF	byte&0x01	1	\b, YM2413
22068>>0xF	byte&0x08	8	\b, Y8950
22069
220700	string/b		KSSX	KSS music file v1.20
22071>0xE	byte&0xEF	0
22072>>0xF	byte&0x40	0x00	\b, 60Hz
22073>>0xF	byte&0x40	0x40	\b, 50Hz
22074>>0xF	byte&0x02	0	\b, soundchips: AY-3-8910, SCC(+)
22075>>0xF	byte&0x02	0x02	\b, soundchips: SN76489
22076>>>0xF	byte&0x04	0x04	stereo
22077>>0xF	byte&0x01	0x01	\b,
22078>>>0xF	byte&0x18	0x00	\bYM2413
22079>>>0xF	byte&0x18	0x08	\bYM2413, Y8950
22080>>>0xF	byte&0x18	0x18	\bYM2413+Y8950 pseudostereo
22081>>0xF	byte&0x18	0x10	\b, Majyutsushi DAC
22082
22083# Moonblaster for Moonsound
220840	string/b		MBMS
22085>4	byte		0x10	MSX Moonblaster for MoonSound music
22086
22087# Music Player K-kaz
220880	string/b		MPK	MSX Music Player K-kaz song
22089>6	ubeshort	0x0D0A
22090>>3	byte		x	v%c
22091>>4	byte		x	\b.%c
22092>>5	byte		x	\b%c
22093
22094# I don't know why these don't work
22095#0	search/0xFFFF	\r\n.FM9
22096#>0	search/0xFFFF	\r\n#FORMAT	MSX Music Player K-kaz source MML file
22097#0	search/0xFFFF	\r\nFM1\ \=
22098#>0	search/0xFFFF	\r\nPSG1\=
22099#>>0	search/0xFFFF	\r\nSCC1\=		MSX MuSiCa MML source file
22100
22101# OPX Music file
221020x35	beshort		0x0d0a
22103>0x7B	beshort		0x0d0a
22104>>0x7D	byte		0x1a
22105>>>0x87	uleshort	0		MSX OPX Music file
22106>>>>0x86	byte		0		v1.5
22107>>>>>0	string		>\32		\b, title: %s
22108>>>>0x86	byte		1		v2.4
22109>>>>>0	string		>\32		\b, title: %s
22110
22111# SCMD music file
221120x8B	string/b		SCMD
22113>0xCE	uleshort	0	MSX SCMD Music file
22114#>>-2	uleshort	0x6a71	; The file must end with this value. How to code this here?
22115>>0x8F	string		>\0		\b, title: %s
22116
221170	search/0xFFFF	\r\n@title
22118>&0	search/0xFFFF	\r\n@m=[	MSX SCMD source MML file
22119
22120
22121############## MSX image file formats ##############
22122
22123# MSX raw VRAM dump
221240	ubyte		0xFE
22125>1	uleshort	0
22126>>5	uleshort	0
22127>>>3	uleshort	0x37FF		MSX SC2/GRP raw image
22128>>>3	uleshort	0x6A00		MSX Graph Saurus SR5 raw image
22129>>>3	uleshort	>0x769E
22130>>>>3	uleshort	<0x8000		MSX GE5/GE6 raw image
22131>>>>>3	uleshort	0x7FFF		\b, with sprite patterns
22132>>>3	uleshort	0xD3FF		MSX screen 7-12 raw image
22133>>>3	uleshort	0xD400		MSX Graph Saurus SR7/SR8/SRS raw image
22134
22135# Graph Saurus compressed images
221360	ubyte		0xFD
22137>1	uleshort	0
22138>>5	uleshort	0
22139>>>3	uleshort	>0x013D		MSX Graph Saurus compressed image
22140
22141# MSX G9B image file
221420	string/b		G9B
22143>1	uleshort	11
22144>>3	uleshort	>10
22145>>>5	ubyte		>0		MSX G9B image, depth=%d
22146>>>>8	uleshort	x		\b, %dx
22147>>>>10	uleshort	x		\b%d
22148>>>>5	ubyte		<9
22149>>>>>6	ubyte		0
22150>>>>>>7	ubyte		x		\b, codec=%d RGB color palettes
22151>>>>>6	ubyte		64		\b, codec=RGB fixed color
22152>>>>>6	ubyte		128		\b, codec=YJK
22153>>>>>6	ubyte		192		\b, codec=YUV
22154>>>>5	ubyte		>8		codec=RGB fixed color
22155>>>>12	ubyte		0		\b, raw
22156>>>>12	ubyte		1		\b, bitbuster compression
22157
22158############## Other MSX file formats ##############
22159
22160# MSX internal ROMs
221610		ubeshort	0xF3C3
22162>2		uleshort	<0x4000
22163>>8		ubyte		0xC3
22164>>>9		uleshort	<0x4000
22165>>>>0x0B	ubeshort	0x00C3
22166>>>>>0x0D	uleshort	<0x4000
22167>>>>>>0x0F	ubeshort	0x00C3
22168>>>>>>>0x11	uleshort	<0x4000
22169>>>>>>>>0x13	ubeshort	0x00C3
22170>>>>>>>>>0x15	uleshort	<0x4000
22171>>>>>>>>>>0x50	ubyte		0xC3
22172>>>>>>>>>>>0x51	uleshort	<0x4000
22173>>>>>>>>>>>>(9.s)	ubyte	0xC3
22174>>>>>>>>>>>>>&0	uleshort	>0x4000
22175>>>>>>>>>>>>>>&0	ubyte	0xC3		MSX BIOS+BASIC
22176>>>>>>>>>>>>>>>0x002D	ubyte+1	<3		\b. version=MSX%d
22177>>>>>>>>>>>>>>>0x002D	ubyte	2		\b, version=MSX2+
22178>>>>>>>>>>>>>>>0x002D	ubyte	3		\b, version=MSX Turbo-R
22179>>>>>>>>>>>>>>>0x002D	ubyte	>3		\b, version=Unknown MSX %d version
22180>>>>>>>>>>>>>>>0x0006	ubyte	x		\b, VDP.DR=0x%2x
22181>>>>>>>>>>>>>>>0x0007	ubyte	x		\b, VDP.DW=0x%2x
22182>>>>>>>>>>>>>>>0x002B	ubyte&0xF	0		\b, charset=Japanese
22183>>>>>>>>>>>>>>>0x002B	ubyte&0xF	1		\b, charset=International
22184>>>>>>>>>>>>>>>0x002B	ubyte&0xF	2		\b, charset=Korean
22185>>>>>>>>>>>>>>>0x002B	ubyte&0xF	>2		\b, charset=Unknown id:%d
22186>>>>>>>>>>>>>>>0x002B	ubyte&0x70	0x00		\b, date format=Y-M-D
22187>>>>>>>>>>>>>>>0x002B	ubyte&0x70	0x10		\b, date format=M-D-Y
22188>>>>>>>>>>>>>>>0x002B	ubyte&0x70	0x20		\b, date format=D-M-Y
22189>>>>>>>>>>>>>>>0x002B	ubyte&0x80	0x00		\b, vfreq=60Hz
22190>>>>>>>>>>>>>>>0x002B	ubyte&0x80	0x80		\b, vfreq=50Hz
22191>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	0		\b, keyboard=Japanese
22192>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	1		\b, keyboard=International
22193>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	2		\b, keyboard=French
22194>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	3		\b, keyboard=UK
22195>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	4		\b, keyboard=German
22196>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	5		\b, keyboard=Unknown id:%d
22197>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	6		\b, keyboard=Spanish
22198>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	>6		\b, keyboard=Unknown id:%d
22199>>>>>>>>>>>>>>>0x002C	ubyte&0xF0	0x00		\b, basic=Japanese
22200>>>>>>>>>>>>>>>0x002C	ubyte&0xF0	0x10		\b, basic=International
22201>>>>>>>>>>>>>>>0x002C	ubyte&0xF0	>0x10		\b, basic=Unknown id:%d
22202>>>>>>>>>>>>>>>0x002E	ubyte&1		1		\b, built-in MIDI
22203
22204
222050		string/b		CD
22206>2		uleshort	>0x10
22207>>2		uleshort	<0x4000
22208>>>4		uleshort	<0x4000
22209>>>>6		uleshort	<0x4000
22210>>>>>8		ubyte		0xC3
22211>>>>>>9		uleshort	<0x4000
22212>>>>>>>0x10	ubyte		0xC3
22213>>>>>>>>0x11	uleshort	<0x4000
22214>>>>>>>>>0x14	ubyte		0xC3
22215>>>>>>>>>>0x15	uleshort	<0x4000		MSX2/2+/TR SubROM
22216
222170		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
22218>0x5F0		ubequad		0x8282828244380000
22219>>0x150		ubyte		0x38
22220>>>0x170	string		\20\20\20
22221>>>>0x1E32	string		())
22222>>>>>0x2130	ubequad		0xA5A5594924231807
22223>>>>>0x2138	ubequad		0x4A4A3424488830C0	MSX Kanji Font
22224
22225
22226
22227# MSX extension ROMs
222280	string/b		AB
22229>2	uleshort	0x0010			MSX ROM
22230>>2	uleshort	x			\b, init=0x%4x
22231>>4	uleshort	>0			\b, stahdl=0x%4x
22232>>6	uleshort	>0			\b, devhdl=0x%4x
22233>>8	uleshort	>0			\b, bas=0x%4x
22234>2	uleshort	0x4010			MSX ROM
22235>>2	uleshort	x			\b, init=0x%04x
22236>>4	uleshort	>0			\b, stahdl=0x%04x
22237>>6	uleshort	>0			\b, devhdl=0x%04x
22238>>8	uleshort	>0			\b, bas=0x%04x
22239>2	uleshort	0x8010			MSX ROM
22240>>2	uleshort	x			\b, init=0x%04x
22241>>4	uleshort	>0			\b, stahdl=0x%04x
22242>>6	uleshort	>0			\b, devhdl=0x%04x
22243>>8	uleshort	>0			\b, bas=0x%04x
222440	string/b		AB\0\0
22245>6	uleshort	0
22246>>4	uleshort	>0x400F			MSX-BASIC extension ROM
22247>>>4	uleshort	>0			\b, stahdl=0x%04x
22248>>>6	uleshort	>0			\b, devhdl=0x%04x
22249>>>0x1C		string		OPLL			\b, MSX-Music
22250>>>>0x18	string		PAC2			\b (external)
22251>>>>0x18	string		APRL			\b (internal)
22252
222530	string/b		AB\0\0\0\0
22254>6	uleshort	>0x400F			MSX device BIOS
22255>>6	uleshort	>0			\b, devhdl=0x%04x
22256
22257
222580	string/b		AB
22259#>2	string		5JSuperLAYDOCK		MSX Super Laydock ROM
22260#>3	string		@HYDLIDE3MSX		MSX Hydlide-3 ROM
22261#>3	string		@3\x80IA862		Golvellius MSX1 ROM
22262>2	uleshort	>15
22263>>2	uleshort	<0xC000
22264>>>8	string		\0\0\0\0\0\0\0\0
22265>>>>(2.s&0x3FFF)	uleshort	>0		MSX ROM
22266>>>>>0x10	string		YZ\0\0\0\0		Konami Game Master 2 MSX ROM
22267>>>>>0x10	string		CD			\b, Konami RC-
22268>>>>>>0x12	ubyte		x			\b%d
22269>>>>>>0x13	ubyte/16	x			\b%d
22270>>>>>>0x13	ubyte&0xF	x			\b%d
22271>>>>>0x10	string		EF			\b, Konami RC-
22272>>>>>>0x12	ubyte		x			\b%d
22273>>>>>>0x13	ubyte/16	x			\b%d
22274>>>>>>0x13	ubyte&0xF	x			\b%d
22275>>>>>2	uleshort	x			\b, init=0x%04x
22276>>>>>4	uleshort	>0			\b, stahdl=0x%04x
22277>>>>>6	uleshort	>0			\b, devhdl=0x%04x
22278>>>>>8	uleshort	>0			\b, bas=0x%04x
22279>>>2	uleshort	0
22280>>>>4	uleshort	0
22281>>>>>6	uleshort	0
22282>>>>>>8	uleshort	>0			MSX BASIC program in ROM, bas=0x%04x
22283
222840x4000	string/b		AB
22285>0x4002	uleshort	>0x400F
22286>>0x400A	string		\0\0\0\0\0\0	MSX ROM with nonstandard page order
22287>>>0x4002	uleshort	x			\b, init=0x%04x
22288>>>0x4004	uleshort	>0			\b, stahdl=0x%04x
22289>>>0x4006	uleshort	>0			\b, devhdl=0x%04x
22290>>>0x4008	uleshort	>0			\b, bas=0x%04x
22291
222920x8000	string/b		AB
22293>0x8002	uleshort	>0x400F
22294>>0x800A	string		\0\0\0\0\0\0	MSX ROM with nonstandard page order
22295>>>0x8002	uleshort	x			\b, init=0x%04x
22296>>>0x8004	uleshort	>0			\b, stahdl=0x%04x
22297>>>0x8006	uleshort	>0			\b, devhdl=0x%04x
22298>>>0x8008	uleshort	>0			\b, bas=0x%04x
22299
22300
223010x3C000	string/b		AB
22302>0x3C008	string		\0\0\0\0\0\0\0\0	MSX MegaROM with nonstandard page order
22303>>0x3C002	uleshort	x			\b, init=0x%04x
22304>>0x3C004	uleshort	>0			\b, stahdl=0x%04x
22305>>0x3C006	uleshort	>0			\b, devhdl=0x%04x
22306>>0x3C008	uleshort	>0			\b, bas=0x%04x
22307
22308# MSX BIN file
22309#0	byte		0xFE
22310#>1	uleshort	>0x8000
22311#>>3	uleshort	>0x8004
22312#>>>5	uleshort	>0x8000			MSX BIN file
22313
22314# MSX-BASIC file
223150	byte		0xFF
22316>3	uleshort	0x000A
22317>>1	uleshort	>0x8000			MSX-BASIC program
22318
22319# MSX .CAS file
223200	string/b	\x1F\xA6\xDE\xBA\xCC\x13\x7D\x74	MSX cassette archive
22321
22322# Mega-Assembler file
223230	byte		0xFE
22324>1	uleshort	0x0001
22325>>5	uleshort	0xffff
22326>>>6	byte		0x0A		MSX Mega-Assembler source
22327
22328# Execrom Patchfile
223290	string		ExecROM\ patchfile\x1A	MSX ExecROM patchfile
22330>0x12	ubyte/16	x		v%d
22331>0x12	ubyte&0xF	x		\b.%d
22332>0x13	ubyte		x		\b, contains %d patches
22333
22334# Konami's King's Valley-2 custom stage (ELG file)
223354	uleshort	0x0900
22336>0xF	byte		1
22337>>0x14	byte		0
22338>>>0x1E	string		\040\040\040
22339>>>>0x23	byte	1
22340>>>>>0x25	byte	0
22341>>>>>>0x15	string	>\x30
22342>>>>>>>0x15	string	<\x5A		Konami King's Valley-2 custom stage, title: "%-8.8s"
22343>>>>>>>>0x1D	byte	<32	\b, theme: %d
22344
22345# Metal Gear 1 savegame
22346#0x4F	string	\x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF
22347#>>0x60	string	\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF
22348#>>>0x7B	string	\0x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00	Metal Gear 1 savegame
22349
22350# ------------------------------------------------------------------------
22351# $File: mup,v 1.5 2017/03/17 21:35:28 christos Exp $
22352# mup: file(1) magic for Mup (Music Publisher) input file.
22353#
22354# From: Abel Cheung <abel (@) oaka.org>
22355#
22356# NOTE: This header is mainly proposed in the Arkkra mailing list,
22357# and is not a mandatory header because of old mup input file
22358# compatibility. Noteedit also use mup format, but is not forcing
22359# user to use any header as well.
22360#
223610		search/1	//!Mup		Mup music publication program input text
22362>6		string		-Arkkra		(Arkkra)
22363>>13		string		-
22364>>>16		string		.
22365>>>>14		string		x		\b, need V%.4s
22366>>>15		string		.
22367>>>>14		string		x		\b, need V%.3s
22368>6		string		-
22369>>9		string		.
22370>>>7		string		x		\b, need V%.4s
22371>>8		string		.
22372>>>7		string		x		\b, need V%.3s
22373#------------------------------------------------------------------------------
22374# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $
22375# music:  file (1) magic for music formats
22376
22377# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks
22378# and Bagpipe Writer by Doug Wickstrom
22379#
223800	string		Bagpipe		Bagpipe
22381>8	string		Reader		Reader
22382>>15	string		>\0		(version %.3s)
22383>8	string		Music\ Writer	Music Writer
22384>>20	string		:
22385>>>21	string		>\0		(version %.3s)
22386>>21	string		Gold		Gold
22387>>>25	string		:
22388>>>>26	string		>\0		(version %.3s)
22389
22390
22391#------------------------------------------------------------------------------
22392# nasa:	file(1) magic
22393
22394# From: Barry Carter <carter.barry@gmail.com>
223950	string	DAF/SPK				NASA SPICE file (binary format)
223960	string	DAFETF\ NAIF\ DAF\ ENCODED	NASA SPICE file (transfer format)
22397
22398#-----------------------------------------------------------------------------
22399# $File: natinst,v 1.6 2014/06/03 19:17:27 christos Exp $
22400# natinst:  file(1) magic for National Instruments Code Files
22401
22402#
22403# From <egamez@fcfm.buap.mx> Enrique Gamez-Flores
22404# version 1
22405# Many formats still missing, we use, for the moment LabVIEW
22406# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing
22407#
224080       string          RSRC            National Instruments,
22409# Check if it's a LabVIEW File
22410>8      string          LV              LabVIEW File,
22411# Check which kind of file it is
22412>>10    string          SB              Code Resource File, data
22413>>10    string          IN              Virtual Instrument Program, data
22414>>10    string          AR              VI Library, data
22415# This is for Menu Libraries
22416>8      string          LMNULBVW        Portable File Names, data
22417# This is for General Resources
22418>8      string          rsc             Resources File, data
22419# This is for VXI Package
224200       string          VMAP            National Instruments, VXI File, data
22421
22422#------------------------------------------------------------------------------
22423# $File: ncr,v 1.8 2014/04/30 21:41:02 christos Exp $
22424# ncr:  file(1) magic for NCR Tower objects
22425#
22426# contributed by
22427# Michael R. Wayne  ***  TMC & Associates  ***  INTERNET: wayne@ford-vax.arpa
22428# uucp: {philabs | pyramid} !fmsrl7!wayne   OR   wayne@fmsrl7.UUCP
22429#
224300	beshort		000610	Tower/XP rel 2 object
22431>12	   belong		>0	not stripped
22432>20	   beshort		0407	executable
22433>20	   beshort		0410	pure executable
22434>22	   beshort		>0	- version %d
224350	beshort		000615	Tower/XP rel 2 object
22436>12	   belong		>0	not stripped
22437>20	   beshort		0407	executable
22438>20	   beshort		0410	pure executable
22439>22	   beshort		>0	- version %d
224400	beshort		000620	Tower/XP rel 3 object
22441>12	   belong		>0	not stripped
22442>20	   beshort		0407	executable
22443>20	   beshort		0410	pure executable
22444>22	   beshort		>0	- version %d
224450	beshort		000625	Tower/XP rel 3 object
22446>12	   belong		>0	not stripped
22447>20	   beshort		0407	executable
22448>20	   beshort		0410	pure executable
22449>22	   beshort		>0	- version %d
224500	beshort		000630	Tower32/600/400 68020 object
22451>12	   belong		>0	not stripped
22452>20	   beshort		0407	executable
22453>20	   beshort		0410	pure executable
22454>22	   beshort		>0	- version %d
224550	beshort		000640	Tower32/800 68020
22456>18	   beshort		&020000	w/68881 object
22457>18	   beshort		&040000	compatible object
22458>18	   beshort		&060000	object
22459>20	   beshort		0407	executable
22460>20	   beshort		0413	pure executable
22461>12	   belong		>0	not stripped
22462>22	   beshort		>0	- version %d
224630	beshort		000645	Tower32/800 68010
22464>18	   beshort		&040000	compatible object
22465>18	   beshort		&060000 object
22466>20	   beshort		0407	executable
22467>20	   beshort		0413	pure executable
22468>12	   belong		>0	not stripped
22469>22	   beshort		>0	- version %d
22470
22471#------------------------------------------------------------
22472# $File: neko,v 1.2 2019/04/19 00:42:27 christos Exp $
22473
22474# From: Mikhail Gusarov <dottedmag@dottedmag.net>
22475# NekoVM (https://nekovm.org/) bytecode
224760	string		NEKO	NekoVM bytecode
22477>4	lelong		x	(%d global symbols,
22478>8	lelong		x	%d global fields,
22479>12	lelong		x	%d bytecode ops)
22480!:mime	application/x-nekovm-bytecode
22481
22482
22483#------------------------------------------------------------------------------
22484# $File: netbsd,v 1.26 2019/01/01 03:11:23 christos Exp $
22485# netbsd:  file(1) magic for NetBSD objects
22486#
22487# All new-style magic numbers are in network byte order.
22488# The old-style magic numbers are indistinguishable from the same magic
22489# numbers used in other systems, and are handled, for all those systems,
22490# in aout.
22491#
22492
224930	name	netbsd-detail
22494>20	lelong	x		@%#x
22495>4	lelong	>0		\b+T=%d
22496>8	lelong	>0		\b+D=%d
22497>12	lelong	>0		\b+B=%d
22498>16	lelong	>0		\b+S=%d
22499>24	lelong	>0		\b+TR=%d
22500>28	lelong	>0		\b+TD=%d
22501
225020	name			netbsd-4096
22503>0	byte			&0x80
22504>>20	lelong			<4096		shared library
22505>>20	lelong			=4096		dynamically linked executable
22506>>20	lelong			>4096		dynamically linked executable
22507>0	byte			^0x80		executable
22508>16	lelong			>0		not stripped
22509
225100	name			netbsd-8192
22511>0	byte			&0x80
22512>>20	lelong			<8192		shared library
22513>>20	lelong			=8192		dynamically linked executable
22514>>20	lelong			>8192		dynamically linked executable
22515>0	byte			^0x80		executable
22516>16	lelong			>0		not stripped
22517>0	use			netbsd-detail
22518
225190	name			netbsd-normal
22520>0	byte			&0x80		dynamically linked executable
22521>0	byte			^0x80
22522>>0	byte			&0x40		position independent
22523>>20	lelong			!0		executable
22524>>20	lelong			=0		object file
22525>16	lelong			>0		not stripped
22526>0	use			netbsd-detail
22527
225280	name			netbsd-pure
22529>0	byte			&0x80		dynamically linked executable
22530>0	byte			^0x80		executable
22531>16	lelong			>0		not stripped
22532>0	use			netbsd-detail
22533
225340	name			netbsd-core
22535>12	string			>\0		from '%s'
22536>32	lelong			!0		(signal %d)
22537
225380	belong&0377777777	041400413	a.out NetBSD/i386 demand paged
22539>0	use			netbsd-4096
22540
225410	belong&0377777777	041400410	a.out NetBSD/i386 pure
22542>0	use			netbsd-pure
22543
225440	belong&0377777777	041400407	a.out NetBSD/i386
22545>0	use			netbsd-normal
22546
225470	belong&0377777777	041400507	a.out NetBSD/i386 core
22548>0	use			netbsd-core
22549
225500	belong&0377777777	041600413	a.out NetBSD/m68k demand paged
22551>0	use			\^netbsd-8192
22552
225530	belong&0377777777	041600410	a.out NetBSD/m68k pure
22554>0	use			\^netbsd-pure
22555
225560	belong&0377777777	041600407	a.out NetBSD/m68k
22557>0	use			\^netbsd-normal
22558
225590	belong&0377777777	041600507	a.out NetBSD/m68k core
22560>0	use			\^netbsd-core
22561
225620	belong&0377777777	042000413	a.out NetBSD/m68k4k demand paged
22563>0	use			\^netbsd-4096
22564
225650	belong&0377777777	042000410	a.out NetBSD/m68k4k pure
22566>0	use			\^netbsd-pure
22567
225680	belong&0377777777	042000407	a.out NetBSD/m68k4k
22569>0	use			\^netbsd-normal
22570
225710	belong&0377777777	042000507	a.out NetBSD/m68k4k core
22572>0	use			\^netbsd-core
22573
225740	belong&0377777777	042200413	a.out NetBSD/ns32532 demand paged
22575>0	use			netbsd-4096
22576
225770	belong&0377777777	042200410	a.out NetBSD/ns32532 pure
22578>0	use			netbsd-pure
22579
225800	belong&0377777777	042200407	a.out NetBSD/ns32532
22581>0	use			netbsd-normal
22582
225830	belong&0377777777	042200507	a.out NetBSD/ns32532 core
22584>0	use			netbsd-core
22585
225860	belong&0377777777	045200507	a.out NetBSD/powerpc core
22587>0	use			netbsd-core
22588
225890	belong&0377777777	042400413	a.out NetBSD/SPARC demand paged
22590>0	use			\^netbsd-8192
22591
225920	belong&0377777777	042400410	a.out NetBSD/SPARC pure
22593>0	use			\^netbsd-pure
22594
225950	belong&0377777777	042400407	a.out NetBSD/SPARC
22596>0	use			\^netbsd-normal
22597
225980	belong&0377777777	042400507	a.out NetBSD/SPARC core
22599>0	use			\^netbsd-core
22600
226010	belong&0377777777	042600413	a.out NetBSD/pmax demand paged
22602>0	use			netbsd-4096
22603
226040	belong&0377777777	042600410	a.out NetBSD/pmax pure
22605>0	use			\^netbsd-pure
22606
226070	belong&0377777777	042600407	a.out NetBSD/pmax
22608>0	use			netbsd-normal
22609
226100	belong&0377777777	042600507	a.out NetBSD/pmax core
22611>0	use			netbsd-core
22612
226130	belong&0377777777	043000413	a.out NetBSD/vax 1k demand paged
22614>0	use			netbsd-4096
22615
226160	belong&0377777777	043000410	a.out NetBSD/vax 1k pure
22617>0	use			netbsd-pure
22618
226190	belong&0377777777	043000407	a.out NetBSD/vax 1k
22620>0	use			netbsd-normal
22621
226220	belong&0377777777	043000507	a.out NetBSD/vax 1k core
22623>0	use			netbsd-core
22624
226250	belong&0377777777	045400413	a.out NetBSD/vax 4k demand paged
22626>0	use			netbsd-4096
22627
226280	belong&0377777777	045400410	a.out NetBSD/vax 4k pure
22629>0	use			netbsd-pure
22630
226310	belong&0377777777	045400407	a.out NetBSD/vax 4k
22632>0	use			netbsd-normal
22633
226340	belong&0377777777	045400507	a.out NetBSD/vax 4k core
22635>0	use			netbsd-core
22636
22637# NetBSD/alpha does not support (and has never supported) a.out objects,
22638# so no rules are provided for them.  NetBSD/alpha ELF objects are
22639# dealt with in "elf".
226400	lelong		0x00070185		ECOFF NetBSD/alpha binary
22641>10	leshort		0x0001			not stripped
22642>10	leshort		0x0000			stripped
226430	belong&0377777777	043200507	a.out NetBSD/alpha core
22644>12	string			>\0		from '%s'
22645>32	lelong			!0		(signal %d)
22646
226470	belong&0377777777	043400413	a.out NetBSD/mips demand paged
22648>0	use			\^netbsd-8192
22649
22650>16	belong			>0		not stripped
226510	belong&0377777777	043400410	a.out NetBSD/mips pure
22652>0	use			netbsd-pure
22653
226540	belong&0377777777	043400407	a.out NetBSD/mips
22655>0	use			netbsd-normal
22656
226570	belong&0377777777	043400507	a.out NetBSD/mips core
22658>0	use			netbsd-core
22659
226600	belong&0377777777	043600413	a.out NetBSD/arm32 demand paged
22661>0	use			netbsd-4096
22662
226630	belong&0377777777	043600410	a.out NetBSD/arm32 pure
22664>0	use			netbsd-pure
22665
226660	belong&0377777777	043600407	a.out NetBSD/arm32
22667>0	use			netbsd-normal
22668
22669# NetBSD/arm26 has always used ELF objects, but it shares a core file
22670# format with NetBSD/arm32.
226710	belong&0377777777	043600507	a.out NetBSD/arm core
22672>0	use			netbsd-core
22673
22674# Kernel core dump format
226750	belong&0x0000ffff 0x00008fca	NetBSD kernel core file
22676>0	belong&0x03ff0000 0x00000000	\b, Unknown
22677>0	belong&0x03ff0000 0x00010000	\b, sun 68010/68020
22678>0	belong&0x03ff0000 0x00020000	\b, sun 68020
22679>0	belong&0x03ff0000 0x00640000	\b, 386 PC
22680>0	belong&0x03ff0000 0x00860000	\b, i386 BSD
22681>0	belong&0x03ff0000 0x00870000	\b, m68k BSD (8K pages)
22682>0	belong&0x03ff0000 0x00880000	\b, m68k BSD (4K pages)
22683>0	belong&0x03ff0000 0x00890000	\b, ns32532 BSD
22684>0	belong&0x03ff0000 0x008a0000	\b, SPARC/32 BSD
22685>0	belong&0x03ff0000 0x008b0000	\b, pmax BSD
22686>0	belong&0x03ff0000 0x008c0000	\b, vax BSD (1K pages)
22687>0	belong&0x03ff0000 0x008d0000	\b, alpha BSD
22688>0	belong&0x03ff0000 0x008e0000	\b, mips BSD (Big Endian)
22689>0	belong&0x03ff0000 0x008f0000	\b, arm6 BSD
22690>0	belong&0x03ff0000 0x00900000	\b, m68k BSD (2K pages)
22691>0	belong&0x03ff0000 0x00910000	\b, sh3 BSD
22692>0	belong&0x03ff0000 0x00950000	\b, ppc BSD (Big Endian)
22693>0	belong&0x03ff0000 0x00960000	\b, vax BSD (4K pages)
22694>0	belong&0x03ff0000 0x00970000	\b, mips1 BSD
22695>0	belong&0x03ff0000 0x00980000	\b, mips2 BSD
22696>0	belong&0x03ff0000 0x00990000	\b, m88k BSD
22697>0	belong&0x03ff0000 0x00920000	\b, parisc BSD
22698>0	belong&0x03ff0000 0x009b0000	\b, sh5/64 BSD
22699>0	belong&0x03ff0000 0x009c0000	\b, SPARC/64 BSD
22700>0	belong&0x03ff0000 0x009d0000	\b, amd64 BSD
22701>0	belong&0x03ff0000 0x009e0000	\b, sh5/32 BSD
22702>0	belong&0x03ff0000 0x009f0000	\b, ia64 BSD
22703>0	belong&0x03ff0000 0x00b70000	\b, aarch64 BSD
22704>0	belong&0x03ff0000 0x00b80000	\b, or1k BSD
22705>0	belong&0x03ff0000 0x00b90000	\b, Risk-V BSD
22706>0	belong&0x03ff0000 0x00c80000	\b, hp200 BSD
22707>0	belong&0x03ff0000 0x012c0000	\b, hp300 BSD
22708>0	belong&0x03ff0000 0x020b0000	\b, hp800 HP-UX
22709>0	belong&0x03ff0000 0x020c0000	\b, hp200/hp300 HP-UX
22710>0	belong&0xfc000000 0x04000000	\b, CPU
22711>0	belong&0xfc000000 0x08000000	\b, DATA
22712>0	belong&0xfc000000 0x10000000	\b, STACK
22713>4	leshort	x			\b, (headersize = %d
22714>6	leshort	x			\b, segmentsize = %d
22715>8	lelong	x			\b, segments = %d)
22716
22717# little endian only for now.
227180	name		ktrace
22719>4	leshort		7
22720>>6	leshort		<3		NetBSD ktrace file version %d
22721>>>12	string		x		from %s
22722>>>56	string		x		\b, emulation %s
22723>>>8	lelong		<65536		\b, pid=%d
22724
2272556	string		netbsd
22726>0	use		ktrace
2272756	string		linux
22728>0	use		ktrace
2272956	string		sunos
22730>0	use		ktrace
2273156	string		hpux
22732>0	use		ktrace
22733
22734#------------------------------------------------------------------------------
22735# $File: netscape,v 1.8 2017/03/17 21:35:28 christos Exp $
22736# netscape:  file(1) magic for Netscape files
22737# "H. Nanosecond" <aldomel@ix.netcom.com>
22738# version 3 and 4 I think
22739#
22740
22741# Netscape Address book  .nab
227420	string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book
22743
22744# Netscape Communicator address book
227450   string   \000\017\102\111 Netscape Communicator address book
22746
22747# .snm Caches
227480	string		#\ Netscape\ folder\ cache	Netscape folder cache
227490	string	\000\036\204\220\000	Netscape folder cache
22750# .n2p
22751# Net 2 Phone
22752#0	string	123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
227530	string	SX961999	Net2phone
22754
22755#
22756#This is files ending in .art, FIXME add more rules
227570	string	JG\004\016\0\0\0\0	AOL ART image
227580	string	JG\003\016\0\0\0\0	AOL ART image
22759
22760#------------------------------------------------------------------------------
22761# $File: netware,v 1.4 2009/09/19 16:28:11 christos Exp $
22762# netware:  file(1) magic for NetWare Loadable Modules (NLMs)
22763# From: Mads Martin Joergensen <mmj@suse.de>
22764
227650	string	NetWare\ Loadable\ Module	NetWare Loadable Module
22766
22767#------------------------------------------------------------------------------
22768# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $
22769# news:  file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
22770#
227710	string		StartFontMetrics	ASCII font metrics
227720	string		StartFont	ASCII font bits
227730	belong		0x137A2944	NeWS bitmap font
227740	belong		0x137A2947	NeWS font family
227750	belong		0x137A2950	scalable OpenFont binary
227760	belong		0x137A2951	encrypted scalable OpenFont binary
227778	belong		0x137A2B45	X11/NeWS bitmap font
227788	belong		0x137A2B48	X11/NeWS font family
22779
22780#------------------------------------------------------------------------------
22781# $File: nitpicker,v 1.8 2019/04/19 00:42:27 christos Exp $
22782# nitpicker:  file(1) magic for Flowfiles.
22783# From: Christian Jachmann <C.Jachmann@gmx.net> https://www.nitpicker.de
227840	string	NPFF	NItpicker Flow File
22785>4	byte	x	V%d.
22786>5	byte	x	%d
22787>6	bedate	x	started: %s
22788>10	bedate	x	stopped: %s
22789>14	belong	x	Bytes: %u
22790>18	belong	x	Bytes1: %u
22791>22	belong	x	Flows: %u
22792>26	belong	x	Pkts: %u
22793
22794#------------------------------------------------------------------------------
22795# $File: numpy,v 1.1 2019/05/09 16:24:36 christos Exp $
22796# numpy: file(1) magic for NumPy array binary serialization format
22797# Reference: https://docs.scipy.org/doc/numpy/reference/generated/numpy.lib.format.html
227980	string		\x93NUMPY	NumPy array,
22799>6	ubyte		x		version %d
22800>7	ubyte		x		\b.%d,
22801>8	uleshort	x		header length %d
22802
22803#------------------------------------------------------------------------------
22804# $File: oasis,v 1.2 2014/06/03 19:17:27 christos Exp $
22805# OASIS
22806# Summary: OASIS stream file
22807# Long description: Open Artwork System Interchange Standard
22808# File extension: .oas
22809# Full name:	Ben Cowley (bcowley@broadcom.com)
22810#		Philip Dixon (pdixon@broadcom.com)
22811# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf
22812#		(see page 3)
228130	string	%SEMI-OASIS\r\n		OASIS Stream file
22814
22815#------------------------------------------------------------------------------
22816# $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $
22817# ocaml: file(1) magic for Objective Caml files.
228180	string	Caml1999	OCaml
22819>8	string	X		exec file
22820>8	string	I		interface file (.cmi)
22821>8	string	O		object file (.cmo)
22822>8	string	A		library file (.cma)
22823>8	string	Y		native object file (.cmx)
22824>8	string	Z		native library file (.cmxa)
22825>8	string	M		abstract syntax tree implementation file
22826>8	string	N		abstract syntax tree interface file
22827>9	string	>\0		(Version %3.3s)
22828
22829#------------------------------------------------------------------------------
22830# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $
22831# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org>
228320	string		Octave-1-L	Octave binary data (little endian)
228330	string		Octave-1-B	Octave binary data (big endian)
22834
22835#------------------------------------------------------------------------------
22836# $File: ole2compounddocs,v 1.6 2019/04/19 00:42:27 christos Exp $
22837# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
22838# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
22839# Additional tests for OLE 2 Compound Documents should be under this recipe.
22840
228410   string  \320\317\021\340\241\261\032\341      OLE 2 Compound Document
22842# - Microstation V8 DGN files (www.bentley.com)
22843#   Last update on 10/23/2006 by Lester Hightower
22844> 0x480  string  D\000g\000n\000~\000H                : Microstation V8 DGN
22845# - Visio documents
22846#   Last update on 10/23/2006 by Lester Hightower
22847> 0x480  string  V\000i\000s\000i\000o\000D\000o\000c : Visio Document
22848
22849# Note: moved & merged Microsoft Office parts from ./msdos Oct 2017
22850# Update: Joerg Jenderek
22851# from https://filext.com by Derek M Jones <derek@knosof.co.uk>
22852# False positive with PPT (also currently this string is too long)
22853#0	string/b	\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06	Microsoft Installer
22854#0	string/b	\320\317\021\340\241\261\032\341	Microsoft Office Document
22855#>48	byte	0x1B					Excel Document
22856#!:mime application/vnd.ms-excel
22857>546	string	bjbj			: Microsoft Word Document
22858!:mime	application/msword
22859# https://www.macdisk.com/macsigen.php
22860!:apple	MSWDWDBN
22861!:ext	doc/dot
22862>546	string	jbjb			: Microsoft Word Document
22863!:mime	application/msword
22864!:apple	MSWDWDBN
22865!:ext	doc
22866
22867
22868#------------------------------------------------------------------------------
22869# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $
22870# olf:  file(1) magic for OLF executables
22871#
22872# We have to check the byte order flag to see what byte order all the
22873# other stuff in the header is in.
22874#
22875# MIPS R3000 may also be for MIPS R2000.
22876# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
22877#
22878# Created by Erik Theisen <etheisen@openbsd.org>
22879# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com>
228800	string		\177OLF		OLF
22881>4	byte		0		invalid class
22882>4	byte		1		32-bit
22883>4	byte		2		64-bit
22884>7	byte		0		invalid os
22885>7	byte		1		OpenBSD
22886>7	byte		2		NetBSD
22887>7	byte		3		FreeBSD
22888>7	byte		4		4.4BSD
22889>7	byte		5		Linux
22890>7	byte		6		SVR4
22891>7	byte		7		esix
22892>7	byte		8		Solaris
22893>7	byte		9		Irix
22894>7	byte		10		SCO
22895>7	byte		11		Dell
22896>7	byte		12		NCR
22897>5	byte		0		invalid byte order
22898>5	byte		1		LSB
22899>>16	leshort		0		no file type,
22900>>16	leshort		1		relocatable,
22901>>16	leshort		2		executable,
22902>>16	leshort		3		shared object,
22903# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
22904# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
22905>>16	leshort		4		core file
22906>>>(0x38+0xcc) string	>\0		of '%s'
22907>>>(0x38+0x10) lelong	>0		(signal %d),
22908>>16	leshort		&0xff00		processor-specific,
22909>>18	leshort		0		no machine,
22910>>18	leshort		1		AT&T WE32100 - invalid byte order,
22911>>18	leshort		2		SPARC - invalid byte order,
22912>>18	leshort		3		Intel 80386,
22913>>18	leshort		4		Motorola 68000 - invalid byte order,
22914>>18	leshort		5		Motorola 88000 - invalid byte order,
22915>>18	leshort		6		Intel 80486,
22916>>18	leshort		7		Intel 80860,
22917>>18	leshort		8		MIPS R3000_BE - invalid byte order,
22918>>18	leshort		9		Amdahl - invalid byte order,
22919>>18	leshort		10		MIPS R3000_LE,
22920>>18	leshort		11		RS6000 - invalid byte order,
22921>>18	leshort		15		PA-RISC - invalid byte order,
22922>>18	leshort		16		nCUBE,
22923>>18	leshort		17		VPP500,
22924>>18	leshort		18		SPARC32PLUS,
22925>>18	leshort		20		PowerPC,
22926>>18	leshort		0x9026		Alpha,
22927>>20	lelong		0		invalid version
22928>>20	lelong		1		version 1
22929>>36	lelong		1		MathCoPro/FPU/MAU Required
22930>8	string		>\0		(%s)
22931>5	byte		2		MSB
22932>>16	beshort		0		no file type,
22933>>16	beshort		1		relocatable,
22934>>16	beshort		2		executable,
22935>>16	beshort		3		shared object,
22936>>16	beshort		4		core file,
22937>>>(0x38+0xcc) string	>\0		of '%s'
22938>>>(0x38+0x10) belong	>0		(signal %d),
22939>>16	beshort		&0xff00		processor-specific,
22940>>18	beshort		0		no machine,
22941>>18	beshort		1		AT&T WE32100,
22942>>18	beshort		2		SPARC,
22943>>18	beshort		3		Intel 80386 - invalid byte order,
22944>>18	beshort		4		Motorola 68000,
22945>>18	beshort		5		Motorola 88000,
22946>>18	beshort		6		Intel 80486 - invalid byte order,
22947>>18	beshort		7		Intel 80860,
22948>>18	beshort		8		MIPS R3000_BE,
22949>>18	beshort		9		Amdahl,
22950>>18	beshort		10		MIPS R3000_LE - invalid byte order,
22951>>18	beshort		11		RS6000,
22952>>18	beshort		15		PA-RISC,
22953>>18	beshort		16		nCUBE,
22954>>18	beshort		17		VPP500,
22955>>18	beshort		18		SPARC32PLUS,
22956>>18	beshort		20		PowerPC or cisco 4500,
22957>>18	beshort		21		cisco 7500,
22958>>18	beshort		24		cisco SVIP,
22959>>18	beshort		25		cisco 7200,
22960>>18	beshort		36		cisco 12000,
22961>>18	beshort		0x9026		Alpha,
22962>>20	belong		0		invalid version
22963>>20	belong		1		version 1
22964>>36	belong		1		MathCoPro/FPU/MAU Required
22965
22966#------------------------------------------------------------------------------
22967# $File: os2,v 1.10 2017/03/17 21:35:28 christos Exp $
22968# os2:  file(1) magic for OS/2 files
22969#
22970
22971# Provided 1998/08/22 by
22972# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
229731	search/100	InternetShortcut	MS Windows 95 Internet shortcut text
22974>17	search/100	URL= 			(URL=<
22975>>&0	string		x			\b%s>)
22976
22977# OS/2 URL objects
22978# Provided 1998/08/22 by
22979# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
22980#0	string	http:			OS/2 URL object text
22981#>5	string	>\			(WWW) <http:%s>
22982#0	string	mailto:			OS/2 URL object text
22983#>7	string	>\			(email) <%s>
22984#0	string	news:			OS/2 URL object text
22985#>5	string	>\			(Usenet) <%s>
22986#0	string	ftp:			OS/2 URL object text
22987#>4	string	>\			(FTP) <ftp:%s>
22988#0	string	file:			OS/2 URL object text
22989#>5	string	>\			(Local file) <%s>
22990
22991# >>>>> OS/2 INF/HLP <<<<<  (source: Daniel Dissett ddissett@netcom.com)
22992# Carl Hauser (chauser.parc@xerox.com) and
22993# Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
22994# list the following header format in inf02a.doc:
22995#
22996#  int16 ID;           // ID magic word (5348h = "HS")
22997#  int8  unknown1;     // unknown purpose, could be third letter of ID
22998#  int8  flags;        // probably a flag word...
22999#                      //  bit 0: set if INF style file
23000#                      //  bit 4: set if HLP style file
23001#                      // patching this byte allows reading HLP files
23002#                      // using the VIEW command, while help files
23003#                      // seem to work with INF settings here as well.
23004#  int16 hdrsize;      // total size of header
23005#  int16 unknown2;     // unknown purpose
23006#
230070   string  HSP\x01\x9b\x00 OS/2 INF
23008>107 string >0                      (%s)
230090   string  HSP\x10\x9b\x00     OS/2 HLP
23010>107 string >0                      (%s)
23011
23012# OS/2 INI (this is a guess)
230130  string   \xff\xff\xff\xff\x14\0\0\0  OS/2 INI
23014
23015#------------------------------------------------------------------------------
23016# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $
23017# os400:  file(1) magic for IBM OS/400 files
23018#
23019# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com
23020# In spite of its quite variable format (due to internal memory page
23021# length differences between CISC and RISC versions of the OS) the
23022# SAVF structure hasn't suitable offsets to identify the catalog
23023# header in the first descriptor where there are some useful infos,
23024# so we must search in a somewhat large area for a particular string
23025# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore
23026# descriptor space) preceded by a two byte constant.
23027#
230281090	 search/7393	\x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data
23029>&212	 byte		0x01			 \b, created with SAVOBJ
23030>&212	 byte		0x02			 \b, created with SAVLIB
23031>&212	 byte		0x07			 \b, created with SAVCFG
23032>&212	 byte		0x08			 \b, created with SAVSECDTA
23033>&212	 byte		0x0A			 \b, created with SAVSECDTA
23034>&212	 byte		0x0B			 \b, created with SAVDLO
23035>&212	 byte		0x0D			 \b, created with SAVLICPGM
23036>&212	 byte		0x11			 \b, created with SAVCHGOBJ
23037>&213	 byte		0x44			 \b, at least V5R4 to open
23038>&213	 byte		0x43			 \b, at least V5R3 to open
23039>&213	 byte		0x42			 \b, at least V5R2 to open
23040>&213	 byte		0x41			 \b, at least V5R1 to open
23041>&213	 byte		0x40			 \b, at least V4R5 to open
23042>&213	 byte		0x3F			 \b, at least V4R4 to open
23043>&213	 byte		0x3E			 \b, at least V4R3 to open
23044>&213	 byte		0x3C			 \b, at least V4R2 to open
23045>&213	 byte		0x3D			 \b, at least V4R1M4 to open
23046>&213	 byte		0x3B			 \b, at least V4R1 to open
23047>&213	 byte		0x3A			 \b, at least V3R7 to open
23048>&213	 byte		0x35			 \b, at least V3R6 to open
23049>&213	 byte		0x36			 \b, at least V3R2 to open
23050>&213	 byte		0x34			 \b, at least V3R1 to open
23051>&213	 byte		0x31			 \b, at least V3R0M5 to open
23052>&213	 byte		0x30			 \b, at least V2R3 to open
23053
23054#------------------------------------------------------------------------------
23055# $File: os9,v 1.8 2017/03/17 21:35:28 christos Exp $
23056#
23057# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
23058#
23059# Redistribution and use in source and binary forms, with or without
23060# modification, are permitted provided that the following conditions
23061# are met:
23062# 1. Redistributions of source code must retain the above copyright
23063#    notice, this list of conditions and the following disclaimer.
23064# 2. Redistributions in binary form must reproduce the above copyright
23065#    notice, this list of conditions and the following disclaimer in the
23066#    documentation and/or other materials provided with the distribution.
23067#
23068# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
23069# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23070# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
23071# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
23072# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
23073# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
23074# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
23075# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
23076# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
23077# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23078#
23079#
23080#
23081# OS9/6809 module descriptions:
23082#
230830	beshort		0x87CD	OS9/6809 module:
23084#
23085>6	byte&0x0f	0x00	non-executable
23086>6	byte&0x0f	0x01	machine language
23087>6	byte&0x0f	0x02	BASIC I-code
23088>6	byte&0x0f	0x03	Pascal P-code
23089>6	byte&0x0f	0x04	C I-code
23090>6	byte&0x0f	0x05	COBOL I-code
23091>6	byte&0x0f	0x06	Fortran I-code
23092#
23093>6	byte&0xf0	0x10	program executable
23094>6	byte&0xf0	0x20	subroutine
23095>6	byte&0xf0	0x30	multi-module
23096>6	byte&0xf0	0x40	data module
23097#
23098>6	byte&0xf0	0xC0	system module
23099>6	byte&0xf0	0xD0	file manager
23100>6	byte&0xf0	0xE0	device driver
23101>6	byte&0xf0	0xF0	device descriptor
23102#
23103# OS9/m68k stuff (to be continued)
23104#
231050	beshort		0x4AFC	OS9/68K module:
23106#
23107# attr
23108>0x14	byte&0x80	0x80	re-entrant
23109>0x14	byte&0x40	0x40	ghost
23110>0x14	byte&0x20	0x20	system-state
23111#
23112# lang:
23113#
23114>0x13	byte		1	machine language
23115>0x13	byte		2	BASIC I-code
23116>0x13	byte		3	Pascal P-code
23117>0x13	byte		4	C I-code
23118>0x13	byte		5	COBOL I-code
23119>0x13	byte		6	Fortran I-code
23120#
23121#
23122# type:
23123#
23124>0x12	byte		1	program executable
23125>0x12	byte		2	subroutine
23126>0x12	byte		3	multi-module
23127>0x12	byte		4	data module
23128>0x12	byte		11	trap library
23129>0x12	byte		12	system module
23130>0x12	byte		13	file manager
23131>0x12	byte		14	device driver
23132>0x12	byte		15	device descriptor
23133
23134#------------------------------------------------------------------------------
23135# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $
23136#
23137# Mach magic number info
23138#
231390	long		0xefbe	OSF/Rose object
23140# I386 magic number info
23141#
231420	short		0565	i386 COFF object
23143
23144#------------------------------------------------------------------------------
23145# $File: palm,v 1.14 2019/04/19 00:42:27 christos Exp $
23146# palm:	 file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
23147#
23148# Brian Lalor <blalor@hcirisc.cs.binghamton.edu>
23149
23150# These are weak, byte 59 is not guaranteed to be 0 and there are
23151# 8 character identifiers at byte 60, one I found for appl is BIGb.
23152# What are the possibilities and where is this documented?
23153
23154# The common header format for PalmOS .pdb/.prc files is
23155# {
23156#         char            name[ 32 ];
23157#         Word            attributes;
23158#         Word            version;
23159#         DWord           creationDate;
23160#         DWord           modificationDate;
23161#         DWord           lastBackupDate;
23162#         DWord           modificationNumber;
23163#         DWord           appInfoID;
23164#         DWord           sortInfoID;
23165#         char            type[4];
23166#         char            creator[4];
23167#         DWord           uniqueIDSeed;
23168#         RecordListType  recordList;
23169# };
23170#
23171# Datestamps are unsigned seconds since the MacOS epoch (Jan 1, 1904),
23172# or Unix/POSIX time + 2082844800.
23173
231740		name		aportisdoc
23175# date is supposed to be big-endian seconds since 1 Jan 1904, but many
23176# files contain the timestamp in little-endian or a completely
23177# nonsensical value...
23178#>36		bedate-2082844800	>0	\b, created %s
23179# compression: 1=uncomp, 2=orig, 0x4448=HuffDic
23180>(78.L)		beshort		=1		\b, uncompressed
23181# compressed
23182>(78.L)		beshort		>1
23183>>(78.L+4)	belong		x		\b, %d bytes uncompressed
23184
23185# appl
23186#60		string		appl		PalmOS application
23187#>0		string		>\0		"%s"
23188
23189# HACK
23190#60		string		HACK		HackMaster hack
23191#>0		string		>\0		"%s"
23192
23193# iSiloX e-book
2319460		string		SDocSilX	iSiloX E-book
23195>0		string		>\0		"%s"
23196
23197# Mobipocket (www.mobipocket.com), donated by Carl Witty
23198# expanded by Ralf Brown
2319960		string	 	BOOKMOBI	Mobipocket E-book
23200# MobiPocket stores a full title, pointed at by the belong at offset
23201# 0x54 in its header at (78.L), with length given by the belong at
23202# offset 0x58.
23203# there's no guarantee that the title string is null-terminated, but
23204# we currently can't specify a variable-length string where the length
23205# field is not at the start of the string; in practice, the data
23206# following the string always seems to start with a zero byte
23207>(78.L)		belong		x
23208>>&(&0x50.L-4)	string		>\0		"%s"
23209>0		use		aportisdoc
23210>>(78.L+0x68)	belong		>0		\b, version %d
23211>>(78.L+0x1C)	belong		!0		\b, codepage %d
23212>>(78.L+0x0C)	beshort	 	>0		\b, encrypted (type %d)
23213
23214# AportisDoc/PalmDOC
2321560		string		TEXtREAd	AportisDoc/PalmDOC E-book
23216>0		string		>\0		"%s"
23217>0		use		aportisdoc
23218
23219# Variety of PalmOS document types
23220# Michael-John Turner <mj@debian.org>
23221# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType
2322260	string			BVokBDIC	BDicty PalmOS document
23223>0	string			>\0		"%s"
2322460	string			DB99DBOS	DB PalmOS document
23225>0	string			>\0		"%s"
2322660	string			vIMGView	FireViewer/ImageViewer PalmOS document
23227>0	string			>\0		"%s"
2322860	string			PmDBPmDB	HanDBase PalmOS document
23229>0	string			>\0		"%s"
2323060	string			InfoINDB	InfoView PalmOS document
23231>0	string			>\0		"%s"
2323260	string			ToGoToGo	iSilo PalmOS document
23233>0	string			>\0		"%s"
2323460	string			JfDbJBas	JFile PalmOS document
23235>0	string			>\0		"%s"
2323660	string			JfDbJFil	JFile Pro PalmOS document
23237>0	string			>\0		"%s"
2323860	string			DATALSdb	List PalmOS document
23239>0	string			>\0		"%s"
2324060	string			Mdb1Mdb1	MobileDB PalmOS document
23241>0	string			>\0		"%s"
2324260	string			PNRdPPrs	PeanutPress PalmOS document
23243>0	string			>\0		"%s"
2324460	string			DataPlkr	Plucker PalmOS document
23245>0	string			>\0		"%s"
2324660	string			DataSprd	QuickSheet PalmOS document
23247>0	string			>\0		"%s"
2324860	string			SM01SMem	SuperMemo PalmOS document
23249>0	string			>\0		"%s"
2325060	string			TEXtTlDc	TealDoc PalmOS document
23251>0	string			>\0		"%s"
2325260	string			InfoTlIf	TealInfo PalmOS document
23253>0	string			>\0		"%s"
2325460	string			DataTlMl	TealMeal PalmOS document
23255>0	string			>\0		"%s"
2325660	string			DataTlPt	TealPaint PalmOS document
23257>0	string			>\0		"%s"
2325860	string			dataTDBP	ThinkDB PalmOS document
23259>0	string			>\0		"%s"
2326060	string			TdatTide	Tides PalmOS document
23261>0	string			>\0		"%s"
2326260	string			ToRaTRPW	TomeRaider PalmOS document
23263>0	string			>\0		"%s"
23264
23265# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net)
23266# For version 1.xx zTXTs, outputs version and numbers of bookmarks and
23267#   annotations.
23268# For other versions, just outputs version.
23269#
2327060		string		zTXT		A GutenPalm zTXT e-book
23271>0		string		>\0		"%s"
23272>(0x4E.L)	byte		0
23273>>(0x4E.L+1)	byte		x		(v0.%02d)
23274>(0x4E.L)	byte		1
23275>>(0x4E.L+1)	byte		x		(v1.%02d)
23276>>>(0x4E.L+10)	beshort		>0
23277>>>>(0x4E.L+10) beshort		<2		- 1 bookmark
23278>>>>(0x4E.L+10) beshort		>1		- %d bookmarks
23279>>>(0x4E.L+14)	beshort		>0
23280>>>>(0x4E.L+14) beshort		<2		- 1 annotation
23281>>>>(0x4E.L+14) beshort		>1		- %d annotations
23282>(0x4E.L)	byte		>1		(v%d.
23283>>(0x4E.L+1)	byte		x		%02d)
23284
23285# Palm OS .prc file types
2328660		string		libr
23287# flags, only bit 0 or bit 6
23288# https://en.wikipedia.org/wiki/PRC_%28Palm_OS%29
23289# https://web.mit.edu/tytso/www/pilot/prc-format.html
23290>0x20		beshort&0xffbe	0
23291>>0		string		>\0		Palm OS dynamic library data "%s"
2329260		string		ptch		Palm OS operating system patch data
23293>0		string		>\0		"%s"
23294
23295# Mobipocket (www.mobipocket.com), donated by Carl Witty
2329660	string			BOOKMOBI	Mobipocket E-book
23297>0	string			>\0		"%s"
23298
23299#------------------------------------------------------------------------------
23300# $File: parix,v 1.4 2009/09/19 16:28:11 christos Exp $
23301#
23302# Parix COFF executables
23303# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de>
23304#
233050	beshort&0xfff	0xACE	PARIX
23306>0	byte&0xf0	0x80	T800
23307>0	byte&0xf0	0x90	T9000
23308>19	byte&0x02	0x02	executable
23309>19	byte&0x02	0x00	object
23310>19	byte&0x0c	0x00	not stripped
23311#------------------------------------------------------------------------------
23312# $File: parrot,v 1.2 2019/04/19 00:42:27 christos Exp $
23313# parrot: file(1) magic for Parrot Virtual Machine
23314# URL:	https://www.lua.org/
23315# From: Lubomir Rintel <lkundrak@v3.sk>
23316
23317# Compiled Parrot byte code
233180	string	\376PBC\r\n\032\n	Parrot bytecode
23319>64	byte	x			%d.
23320>72	byte	x			\b%d,
23321>8	byte	>0			%d byte words,
23322>16	byte	0			little-endian,
23323>16	byte	1			big-endian,
23324>32	byte	0			IEEE-754 8 byte double floats,
23325>32	byte	1			x86 12 byte long double floats,
23326>32	byte	2			IEEE-754 16 byte long double floats,
23327>32	byte	3			MIPS 16 byte long double floats,
23328>32	byte	4			AIX 16 byte long double floats,
23329>32	byte	5			4-byte floats,
23330>40	byte	x			Parrot %d.
23331>48	byte	x			\b%d.
23332>56	byte	x			\b%d
23333#------------------------------------------------------------------------------
23334# $File: pascal,v 1.2 2014/07/14 14:21:33 rrt Exp $
23335# pascal:  file(1) magic for Pascal source
23336#
233370	search/8192	(input,		Pascal source text
23338!:mime	text/x-pascal
23339#0	regex		\^program	Pascal source text
23340#!:mime	text/x-pascal
23341#0	regex           	\^record		Pascal source text
23342#!:mime	text/x-pascal
23343
23344#------------------------------------------------------------------------------
23345# $File: pbf,v 1.3 2019/04/19 00:42:27 christos Exp $
23346# file(1) magic(5) data for OpenStreetMap
23347
23348# OpenStreetMap Protocolbuffer Binary Format (.osm.pbf)
23349# https://wiki.openstreetmap.org/wiki/PBF_Format
23350# From: Markus Heidelberg <markus.heidelberg@web.de>
233510	belong&0xfffffff0	0
23352>4	beshort			0x0A09
23353>>6	string			OSMHeader	OpenStreetMap Protocolbuffer Binary Format
23354
23355#------------------------------------------------------------------------------
23356# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $
23357# pbm:  file(1) magic for Portable Bitmap files
23358#
23359# XXX - byte order?
23360#
233610	short	0x2a17	"compact bitmap" format (Poskanzer)
23362#------------------------------------------------------------------------------
23363# pc88:  file(1) magic for the NEC Home Computer
23364# v1.0
23365# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
23366
23367# PC88 2D disk image
233680x20		ulelong&0xFFFFFEFF	0x2A0
23369>0x10		string		\0\0\0\0\0\0\0\0\0\0
23370>>0x280		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
23371>>>0x1A		ubyte&0xEF	0
23372>>>>0x1B	ubyte&0x8F	0
23373>>>>>0x1B	ubyte&70	<0x40
23374>>>>>>0x1C	ulelong	>0x21
23375>>>>>>>0		regex	[[:print:]]*	NEC PC-88 disk image, name=%s
23376>>>>>>>>0x1B	ubyte	0	\b, media=2D
23377>>>>>>>>0x1B	ubyte	0x10	\b, media=2DD
23378>>>>>>>>0x1B	ubyte	0x20	\b, media=2HD
23379>>>>>>>>0x1B	ubyte	0x30	\b, media=1D
23380>>>>>>>>0x1B	ubyte	0x40	\b, media=1DD
23381>>>>>>>>0x1A	ubyte	0x10	\b, write-protected
23382
23383
23384
23385
23386#------------------------------------------------------------------------------
23387# pc98:  file(1) magic for the MSX Home Computer
23388# v1.0
23389# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
23390
23391# Maki-chan v1 Graphic format
23392# The image resolution should be X=(44.L - 40.L) and Y=(46.L - 42.L), but I couldn't find a way to do so
23393# http://www.jisyo.com/viewer/faq/maki_tech.htm
233940	string/b		MAKI01 	Maki-chan v1.
23395>6	ubyte|0x20	x		\b%c image
23396>8	ubelong		>0x40404040	\b, system ID:
23397>>8	byte		x		%c
23398>>9	byte		x		\b%c
23399>>10	byte		x		\b%c
23400>>11	byte		x		\b%c
23401>44	ubeshort	x		\b, %dx
23402>46	ubeshort	x		\b%d
23403>38	ubeshort&2	0		\b, 16 paletted RGB colors
23404>38	ubeshort&2	2		\b, 8 fixed RGB colors
23405>38	ubeshort&1	1		\b, 2:1 dot aspect ratio
23406
23407# Maki-chan v2 Graphic format
23408# http://www.jisyo.com/viewer/faq/mag_tech.htm
23409# https://mooncore.eu/bunny/txt/makichan.htm
23410# http://metanest.jp/mag/mag.xhtml
234110	string/b		MAKI02\ \ 	Maki-chan v2 image,
23412>8	byte		x		system ID: %c
23413>9	byte		x		\b%c
23414>10	byte		x		\b%c
23415>11	byte		x		\b%c,
23416>13	search/0x200	\x1A
23417#Maki-chan video modes are a bit messy and seems to have been expanded over the years without too much planing:
23418#1) When offset1(ubeshort) !=0x0344:
23419# 1.1) And  offset3(ubyte).b7=0:
23420# - b0=pixel aspect ratio: 1=2:1   (note: this ignores that the machine's 1:1 pixel aspect ratio isn't really 1:1)
23421# - b1=number of colors: 0=16 colors, 1=8 colors
23422# - b2=Palette or fixed colors flag (called "analog" and "digital" in the doc): 0=Paletted, 1=Fixed colors encoded directly in the pixel data
23423# 1.2) And  offset3(ubyte).B7=1:
23424# - b0=256 paletted colors
23425# - b1=256 fixed colors using the MSX SCR8 palette
23426#2) When offset1(ubeshort) =0x0344:
23427# - 256x212 image with 19268 YJK colors. The usual resolution and color information fields from the file must be ignored
23428>>&1	ubeshort	0x0344		256x212, 19268 fixed YJK colors
23429>>&1	ubeshort	!0x0344
23430>>>&5	uleshort+1	x		%dx
23431>>>&7	uleshort+1	x		\b%d,
23432>>>&0	ubyte&0x86	0x00		16 paletted RGB colors
23433>>>&0	ubyte&0x86	0x02		8 paletted RGB colors
23434>>>&0	ubyte&0x86	0x04		16 fixed RGB colors
23435>>>&0	ubyte&0x86	0x06		8 fixed RGB colors
23436>>>&0	ubyte&0x81	0x80		256 paletted RGB colors
23437>>>&0	ubyte&0x81	0x81		256 fixed MSX-SCR8 colors
23438>>>&0	ubyte&0x01	1		\b, 2:1 dot aspect ratio
23439
23440# XLD4 (Q4) picture
2344111	string/b	MAJYO		XLD4(Q4) picture
23442
23443# Yanagisawa Pi picture
23444#0	string		Pi\x1A\0	Yanagisawa Pi picture
23445#>3	search/0x200	\x04
234460	string		Pi
23447>2	search/0x200	\x1A
23448>>&0	ubyte		0
23449>>>&3	ubyte		4		Yanagisawa Pi 16 color picture,
23450>>>&4	byte		x		system ID: %c
23451>>>&5	byte		x		\b%c
23452>>>&6	byte		x		\b%c
23453>>>&7	byte		x		\b%c,
23454>>>&10	ubeshort	x		%dx
23455>>>&12	ubeshort	x		\b%d
23456>>>&3	ubyte		8		Yanagisawa Pi 256 color picture
23457>>>&4	byte		x		system ID: %c
23458>>>&5	byte		x		\b%c
23459>>>&6	byte		x		\b%c
23460>>>&7	byte		x		\b%c,
23461>>>&10	ubeshort	x		%dx
23462>>>&12	ubeshort	x		\b%d
23463
23464#------------------------------------------------------------------------------
23465# $File: pdf,v 1.10 2018/05/23 22:21:01 christos Exp $
23466# pdf:  file(1) magic for Portable Document Format
23467#
23468
234690	string		%PDF-		PDF document
23470!:mime	application/pdf
23471!:strength +60
23472>5	byte		x		\b, version %c
23473>7	byte		x		\b.%c
23474
234750	string		\012%PDF-	PDF document
23476!:mime	application/pdf
23477!:strength +60
23478>6	byte		x		\b, version %c
23479>8	byte		x		\b.%c
23480
23481# From: Nick Schmalenberger <nick@schmalenberger.us>
23482# Forms Data Format
234830       string          %FDF-           FDF document
23484!:mime application/vnd.fdf
23485!:strength +60
23486>5      byte            x               \b, version %c
23487>7      byte            x               \b.%c
23488
234890	search/256	%PDF-		PDF document
23490!:mime	application/pdf
23491!:strength +60
23492>&0	byte		x		\b, version %c
23493>&2	byte		x		\b.%c
23494
23495#------------------------------------------------------------------------------
23496# $File: pdp,v 1.11 2017/03/17 21:35:28 christos Exp $
23497# pdp:  file(1) magic for PDP-11 executable/object and APL workspace
23498#
234990	lelong		0101555		PDP-11 single precision APL workspace
235000	lelong		0101554		PDP-11 double precision APL workspace
23501#
23502# PDP-11 a.out
23503#
235040	leshort		0407		PDP-11 executable
23505>8	leshort		>0		not stripped
23506>15	byte		>0		- version %d
23507
23508# updated by Joerg Jenderek at Mar 2013
23509# GRR: line below too general as it catches also Windows precompiled setup information *.PNF
235100	leshort		0401
23511# skip *.PNF with WinDirPathOffset 58h
23512>68	ulelong		!0x00000058	PDP-11 UNIX/RT ldp
23513# skip *.PNF with high byte of InfVersionDatumCount zero
23514#>>15	byte		!0		PDP-11 UNIX/RT ldp
235150	leshort		0405		PDP-11 old overlay
23516
235170	leshort		0410		PDP-11 pure executable
23518>8	leshort		>0		not stripped
23519>15	byte		>0		- version %d
23520
235210	leshort		0411		PDP-11 separate I&D executable
23522>8	leshort		>0		not stripped
23523>15	byte		>0		- version %d
23524
235250	leshort		0437		PDP-11 kernel overlay
23526
23527# These last three are derived from 2.11BSD file(1)
235280	leshort		0413		PDP-11 demand-paged pure executable
23529>8	leshort		>0		not stripped
23530
235310	leshort		0430		PDP-11 overlaid pure executable
23532>8	leshort		>0		not stripped
23533
235340	leshort		0431		PDP-11 overlaid separate executable
23535>8	leshort		>0		not stripped
23536#------------------------------------------------------------------------------
23537# $File: perl,v 1.26 2017/02/21 18:34:55 christos Exp $
23538# perl:  file(1) magic for Larry Wall's perl language.
23539#
23540# The `eval' lines recognizes an outrageously clever hack.
23541# Keith Waclena <keith@cerberus.uchicago.edu>
23542# Send additions to <perl5-porters@perl.org>
235430	search/1024	eval\ "exec\ perl		Perl script text
23544!:mime	text/x-perl
235450	search/1024	eval\ "exec\ /bin/perl		Perl script text
23546!:mime	text/x-perl
235470	search/1024	eval\ "exec\ /usr/bin/perl	Perl script text
23548!:mime	text/x-perl
235490	search/1024	eval\ "exec\ /usr/local/bin/perl	Perl script text
23550!:mime	text/x-perl
235510	search/1024	eval\ 'exec\ perl		Perl script text
23552!:mime	text/x-perl
235530	search/1024	eval\ 'exec\ /bin/perl		Perl script text
23554!:mime	text/x-perl
235550	search/1024	eval\ 'exec\ /usr/bin/perl	Perl script text
23556!:mime	text/x-perl
235570	search/1024	eval\ 'exec\ /usr/local/bin/perl	Perl script text
23558!:mime	text/x-perl
235590	search/1024	eval\ '(exit\ $?0)'\ &&\ eval\ 'exec	Perl script text
23560!:mime	text/x-perl
235610	string	#!/usr/bin/env\ perl	Perl script text executable
23562!:mime	text/x-perl
235630	string	#!\ /usr/bin/env\ perl	Perl script text executable
23564!:mime	text/x-perl
235650	string	#!
23566>0	regex	\^#!.*/bin/perl([[:space:]].*)*$	Perl script text executable
23567!:mime	text/x-perl
23568
23569# by Dmitry V. Levin and Alexey Tourbin
23570# check the first line
235710	search/8192	package
23572>0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;	Perl5 module source text
23573!:strength + 40
23574# not 'p', check other lines
235750	search/8192	!p
23576>0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;
23577>>0	regex		\^1\ *;|\^(use|sub|my)\ .*[(;{=]	Perl5 module source text
23578!:strength + 75
23579
23580# Perl POD documents
23581# From: Tom Hukins <tom@eborcom.com>
235820	search/1024/W	\=pod\n		Perl POD document text
235830	search/1024/W	\n\=pod\n	Perl POD document text
235840	search/1024/W	\=head1\ 	Perl POD document text
235850	search/1024/W	\n\=head1\ 	Perl POD document text
235860	search/1024/W	\=head2\ 	Perl POD document text
235870	search/1024/W	\n\=head2\ 	Perl POD document text
235880	search/1024/W	\=encoding\ 	Perl POD document text
235890	search/1024/W	\n\=encoding\ 	Perl POD document text
23590
23591
23592# Perl Storable data files.
235930	string	perl-store	perl Storable (v0.6) data
23594>4	byte	>0	(net-order %d)
23595>>4	byte	&01	(network-ordered)
23596>>4	byte	=3	(major 1)
23597>>4	byte	=2	(major 1)
23598
235990	string	pst0	perl Storable (v0.7) data
23600>4	byte	>0
23601>>4	byte	&01	(network-ordered)
23602>>4	byte	=5	(major 2)
23603>>4	byte	=4	(major 2)
23604>>5	byte	>0	(minor %d)
23605
23606# This is Debian #742949 by Zefram <zefram@fysh.org>:
23607# -----------------------------------------------------------
23608# The Perl module Hash::SharedMem
23609# <https://metacpan.org/release/Hash-SharedMem> defines a file format
23610# for a key/value store.  Details of the file format are in the "DESIGN"
23611# file in the module distribution.  Magic:
236120	bequad	=0xa58afd185cbf5af7	Hash::SharedMem master file, big-endian
23613>8	bequad	<0x1000000
23614>>15	byte	>2	\b, line size 2^%d byte
23615>>14	byte	>2	\b, page size 2^%d byte
23616>>13	byte	&1
23617>>>13	byte	>1	\b, max fanout %d
236180	lequad	=0xa58afd185cbf5af7	Hash::SharedMem master file, little-endian
23619>8	lequad	<0x1000000
23620>>8	byte	>2	\b, line size 2^%d byte
23621>>9	byte	>2	\b, page size 2^%d byte
23622>>10	byte	&1
23623>>>10	byte	>1	\b, max fanout %d
236240	bequad	=0xc693dac5ed5e47c2	Hash::SharedMem data file, big-endian
23625>8	bequad	<0x1000000
23626>>15	byte	>2	\b, line size 2^%d byte
23627>>14	byte	>2	\b, page size 2^%d byte
23628>>13	byte	&1
23629>>>13	byte	>1	\b, max fanout %d
236300	lequad	=0xc693dac5ed5e47c2	Hash::SharedMem data file, little-endian
23631>8	lequad	<0x1000000
23632>>8	byte	>2	\b, line size 2^%d byte
23633>>9	byte	>2	\b, page size 2^%d byte
23634>>10	byte	&1
23635>>>10	byte	>1	\b, max fanout %d
23636
23637#------------------------------------------------------------------------------
23638# $File: pgf,v 1.2 2017/03/17 21:35:28 christos Exp $
23639# pgf: file(1) magic for Progressive Graphics File (PGF)
23640#
23641# <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf>
23642# 2013 by Philipp Hahn <pmhahn debian org>
236430 string PGF Progressive Graphics image data,
23644!:mime image/x-pgf
23645>3	string	2	version %s,
23646>3	string	4	version %s,
23647>3	string	5	version %s,
23648>3	string	6	version %s,
23649#	PGFPreHeader
23650#>>4	lelong	x	header size %d,
23651#	PGFHeader
23652>>8	lelong	x	%d x
23653>>12	lelong	x	%d,
23654>>16	byte	x	%d levels,
23655>>17	byte	x	compression level %d,
23656>>18	byte	x	%d bpp,
23657>>19	byte	x	%d channels,
23658>>20	clear	x
23659>>20	byte	0	bitmap,
23660>>20	byte	1	gray scale,
23661>>20	byte	2	indexed color,
23662>>20	byte	3	RGB color,
23663>>20	byte	4	CYMK color,
23664>>20	byte	5	HSL color,
23665>>20	byte	6	HSB color,
23666>>20	byte	7	multi-channel,
23667>>20	byte	8	duo tone,
23668>>20	byte	9	LAB color,
23669>>20	byte	10	gray scale 16,
23670>>20	byte	11	RGB color 48,
23671>>20	byte	12	LAB color 48,
23672>>20	byte	13	CYMK color 64,
23673>>20	byte	14	deep multi-channel,
23674>>20	byte	15	duo tone 16,
23675>>20	byte	17	RGBA color,
23676>>20	byte	18	gray scale 32,
23677>>20	byte	19	RGB color 12,
23678>>20	byte	20	RGB color 16,
23679>>20	byte	255	unknown format,
23680>>20	default	x	format
23681>>>20	byte	x	\b %d,
23682>>21	byte	x	%d bpc
23683#	PGFPostHeader
23684#	Level-Sizes
23685#>>(4.l+4)	lelong x level 0 size: %d
23686#>>(4.l+8)	lelong x level 1 size: %d
23687#>>(4.l+12)	lelong x level 2 size: %d
23688
23689#------------------------------------------------------------------------------
23690# $File: pgp,v 1.17 2019/04/19 00:42:27 christos Exp $
23691# pgp:  file(1) magic for Pretty Good Privacy
23692# see https://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
23693#
23694# Update: Joerg Jenderek
23695# Note: verified by `gpg -v --debug 0x02 --list-packets < PUBRING263_10.PGP`
23696#0		byte	0x99		MAYBE PGP 0x99
236970		byte	0x99
23698# 99h~10;0110;01~2=old packet type;tag 6=Public-Key Packet;1=two-octet length
23699# A two-octet body header encodes packet lengths of 192~00C0h - 8383~20BFh
23700#>1		ubeshort	x		\b, body length 0x%.4x
23701# skip Basic.Image Beauty.320 Pic.Icons by looking for low version number
23702#>3		ubyte		x		\b, V=%u
23703#>3		ubyte		<5		VERSION OK
23704>3		ubyte		<5
23705# next packet type often b4h~(tag 13)~User ID Packet, b0h~(tag 12)~Trust packet
23706#>>(1.S+3)	ubyte	x		\b, next packet type 0x%x
23707# skip 9900-v4.bin 9902-v4.bin by looking for valid second packet type (bit 7=1)
23708#>>(1.S+3)	ubyte	>0x7F		TYPE OK,
23709>>(1.S+3)	ubyte	>0x7F
23710# old versions 2,3 implies Pretty Good Privacy
23711>>>3		ubyte		<4		PGP key public ring (v%u)
23712!:mime		application/pgp-keys
23713!:ext		pgp/ASD
23714>>>>4		beldate		x		created %s
23715# days that this key is valid. If this number is zero, then it does not expire
23716>>>>8		ubeshort	>0		\b, %u days valid
23717>>>>8		ubeshort	=0		\b, not expire
23718# display key algorithm 1~RSA (Encrypt or Sign)
23719>>>>10		use		key_algo
23720# Multiprecision Integers (MPI) size
23721>>>>11		ubeshort	x		%u bits
23722# MPI
23723>>>>13		ubequad		x		MPI=0x%16.16llx...
23724# new version implies Pretty Good Privacy (PGP) >= 5.0 or Gnu Privacy Guard (GPG)
23725>>>3		ubyte		>3		PGP/GPG key public ring (v%u)
23726!:mime		application/pgp-keys
23727!:ext		pgp/gpg/pkr/asd
23728>>>>4		beldate		x		created %s
23729# display key algorithm 17~DSA
23730>>>>8		use		key_algo
23731# Multiprecision Integers (MPI) size
23732>>>>9		ubeshort	x		%u bits
23733>>>>11		ubequad		x		MPI=0x%16.16llx...
23734
237350       beshort         0x9501                  PGP key security ring
23736!:mime	application/x-pgp-keyring
237370       beshort         0x9500                  PGP key security ring
23738!:mime	application/x-pgp-keyring
237390	beshort		0xa600			PGP encrypted data
23740#!:mime	application/pgp-encrypted
23741#0	string		-----BEGIN\040PGP	text/PGP armored data
23742!:mime	text/PGP # encoding: armored data
23743#>15	string	PUBLIC\040KEY\040BLOCK-	public key block
23744#>15	string	MESSAGE-		message
23745#>15	string	SIGNED\040MESSAGE-	signed message
23746#>15	string	PGP\040SIGNATURE-	signature
23747
237482	string	---BEGIN\040PGP\040PUBLIC\040KEY\040BLOCK-	PGP public key block
23749!:mime	application/pgp-keys
23750>10	search/100	\n\n
23751>>&0	use		pgp
237520	string	-----BEGIN\040PGP\040MESSAGE-		PGP message
23753!:mime	application/pgp
23754>10	search/100	\n\n
23755>>&0	use		pgp
237560	string	-----BEGIN\040PGP\040SIGNATURE-		PGP signature
23757!:mime	application/pgp-signature
23758>10	search/100	\n\n
23759>>&0	use		pgp
23760
23761# Decode the type of the packet based on it's base64 encoding.
23762# Idea from Mark Martinec
23763# The specification is in RFC 4880, section 4.2 and 4.3:
23764# https://tools.ietf.org/html/rfc4880#section-4.2
23765
237660	name		pgp
23767>0	byte		0x67		Reserved (old)
23768>0	byte		0x68		Public-Key Encrypted Session Key (old)
23769>0	byte		0x69		Signature (old)
23770>0	byte		0x6a		Symmetric-Key Encrypted Session Key (old)
23771>0	byte		0x6b		One-Pass Signature (old)
23772>0	byte		0x6c		Secret-Key (old)
23773>0	byte		0x6d		Public-Key (old)
23774>0	byte		0x6e		Secret-Subkey (old)
23775>0	byte		0x6f		Compressed Data (old)
23776>0	byte		0x70		Symmetrically Encrypted Data (old)
23777>0	byte		0x71		Marker (old)
23778>0	byte		0x72		Literal Data (old)
23779>0	byte		0x73		Trust (old)
23780>0	byte		0x74		User ID (old)
23781>0	byte		0x75		Public-Subkey (old)
23782>0	byte		0x76		Unused (old)
23783>0	byte		0x77
23784>>1	byte&0xc0	0x00		Reserved
23785>>1	byte&0xc0	0x40		Public-Key Encrypted Session Key
23786>>1	byte&0xc0	0x80		Signature
23787>>1	byte&0xc0	0xc0		Symmetric-Key Encrypted Session Key
23788>0	byte		0x78
23789>>1	byte&0xc0	0x00		One-Pass Signature
23790>>1	byte&0xc0	0x40		Secret-Key
23791>>1	byte&0xc0	0x80		Public-Key
23792>>1	byte&0xc0	0xc0		Secret-Subkey
23793>0	byte		0x79
23794>>1	byte&0xc0	0x00		Compressed Data
23795>>1	byte&0xc0	0x40		Symmetrically Encrypted Data
23796>>1	byte&0xc0	0x80		Marker
23797>>1	byte&0xc0	0xc0		Literal Data
23798>0	byte		0x7a
23799>>1	byte&0xc0	0x00		Trust
23800>>1	byte&0xc0	0x40		User ID
23801>>1	byte&0xc0	0x80		Public-Subkey
23802>>1	byte&0xc0	0xc0		Unused [z%x]
23803>0	byte		0x30
23804>>1	byte&0xc0	0x00		Unused [0%x]
23805>>1	byte&0xc0	0x40		User Attribute
23806>>1	byte&0xc0	0x80		Sym. Encrypted and Integrity Protected Data
23807>>1	byte&0xc0	0xc0		Modification Detection Code
23808
23809# magic signatures to detect PGP crypto material (from stef)
23810# detects and extracts metadata from:
23811#  - symmetric encrypted packet header
23812#  - RSA (e=65537) secret (sub-)keys
23813
23814# 1024b RSA encrypted data
23815
238160	string	\x84\x8c\x03		PGP RSA encrypted session key -
23817>3	lelong	x			keyid: %X
23818>7	lelong	x			%X
23819>11	byte	0x01			RSA (Encrypt or Sign) 1024b
23820>11	byte	0x02			RSA Encrypt-Only 1024b
23821>12	string	\x04\x00
23822>12	string	\x03\xff
23823>12	string	\x03\xfe
23824>12	string	\x03\xfd
23825>12	string	\x03\xfc
23826>12	string	\x03\xfb
23827>12	string	\x03\xfa
23828>12	string	\x03\xf9
23829>142	byte	0xd2			.
23830
23831# 2048b RSA encrypted data
23832
238330	string	\x85\x01\x0c\x03	PGP RSA encrypted session key -
23834>4	lelong	x			keyid: %X
23835>8	lelong	x			%X
23836>12	byte	0x01			RSA (Encrypt or Sign) 2048b
23837>12	byte	0x02			RSA Encrypt-Only 2048b
23838>13	string	\x08\x00
23839>13	string	\x07\xff
23840>13	string	\x07\xfe
23841>13	string	\x07\xfd
23842>13	string	\x07\xfc
23843>13	string	\x07\xfb
23844>13	string	\x07\xfa
23845>13	string	\x07\xf9
23846>271	byte	0xd2			.
23847
23848# 3072b RSA encrypted data
23849
238500	string	\x85\x01\x8c\x03	PGP RSA encrypted session key -
23851>4	lelong	x			keyid: %X
23852>8	lelong	x			%X
23853>12	byte	0x01			RSA (Encrypt or Sign) 3072b
23854>12	byte	0x02			RSA Encrypt-Only 3072b
23855>13	string	\x0c\x00
23856>13	string	\x0b\xff
23857>13	string	\x0b\xfe
23858>13	string	\x0b\xfd
23859>13	string	\x0b\xfc
23860>13	string	\x0b\xfb
23861>13	string	\x0b\xfa
23862>13	string	\x0b\xf9
23863>399	byte	0xd2			.
23864
23865# 3072b RSA encrypted data
23866
238670	string	\x85\x02\x0c\x03	PGP RSA encrypted session key -
23868>4	lelong	x			keyid: %X
23869>8	lelong	x			%X
23870>12	byte	0x01			RSA (Encrypt or Sign) 4096b
23871>12	byte	0x02			RSA Encrypt-Only 4096b
23872>13	string	\x10\x00
23873>13	string	\x0f\xff
23874>13	string	\x0f\xfe
23875>13	string	\x0f\xfd
23876>13	string	\x0f\xfc
23877>13	string	\x0f\xfb
23878>13	string	\x0f\xfa
23879>13	string	\x0f\xf9
23880>527	byte	0xd2			.
23881
23882# 4096b RSA encrypted data
23883
238840	string	\x85\x04\x0c\x03	PGP RSA encrypted session key -
23885>4	lelong	x			keyid: %X
23886>8	lelong	x			%X
23887>12	byte	0x01			RSA (Encrypt or Sign) 8129b
23888>12	byte	0x02			RSA Encrypt-Only 8129b
23889>13	string	\x20\x00
23890>13	string	\x1f\xff
23891>13	string	\x1f\xfe
23892>13	string	\x1f\xfd
23893>13	string	\x1f\xfc
23894>13	string	\x1f\xfb
23895>13	string	\x1f\xfa
23896>13	string	\x1f\xf9
23897>1039	byte	0xd2			.
23898
23899# crypto algo mapper
23900
239010	name	crypto
23902>0	byte	0x00			Plaintext or unencrypted data
23903>0	byte	0x01			IDEA
23904>0	byte	0x02			TripleDES
23905>0	byte	0x03			CAST5 (128 bit key)
23906>0	byte	0x04			Blowfish (128 bit key, 16 rounds)
23907>0	byte	0x07			AES with 128-bit key
23908>0	byte	0x08			AES with 192-bit key
23909>0	byte	0x09			AES with 256-bit key
23910>0	byte	0x0a			Twofish with 256-bit key
23911
23912# hash algo mapper
23913
239140	name	hash
23915>0	byte	0x01			MD5
23916>0	byte	0x02			SHA-1
23917>0	byte	0x03			RIPE-MD/160
23918>0	byte	0x08			SHA256
23919>0	byte	0x09			SHA384
23920>0	byte	0x0a			SHA512
23921>0	byte	0x0b			SHA224
23922
23923# display public key algorithms as human readable text
239240	name	key_algo
23925>0	byte	0x01			RSA (Encrypt or Sign)
23926# keep old look of version 5.28 without parentheses
23927>0	byte	0x02			RSA Encrypt-Only
23928>0	byte	0x03			RSA (Sign-Only)
23929>0	byte	16			ElGamal (Encrypt-Only)
23930>0	byte	17			DSA
23931>0	byte	18			Elliptic Curve
23932>0	byte	19			ECDSA
23933>0	byte	20			ElGamal (Encrypt or Sign)
23934>0	byte	21			Diffie-Hellman
23935>0	default	x
23936>>0	ubyte	<22			unknown (pub %d)
23937# this should never happen
23938>>0	ubyte	>21			invalid (%d)
23939
23940# pgp symmetric encrypted data
23941
239420	byte	0x8c			PGP symmetric key encrypted data -
23943>1	byte	0x0d
23944>1	byte	0x0c
23945>2	byte	0x04
23946>3	use	crypto
23947>4	byte	0x01			salted -
23948>>5	use	hash
23949>>14	byte	0xd2			.
23950>>14	byte	0xc9			.
23951>4	byte	0x03			salted & iterated -
23952>>5	use	hash
23953>>15	byte	0xd2			.
23954>>15	byte	0xc9			.
23955
23956# encrypted keymaterial needs s2k & can be checksummed/hashed
23957
239580	name	chkcrypto
23959>0	use	crypto
23960>1	byte	0x00			Simple S2K
23961>1	byte	0x01			Salted S2K
23962>1	byte	0x03			Salted&Iterated S2K
23963>2	use	hash
23964
23965# all PGP keys start with this prolog
23966# containing version, creation date, and purpose
23967
239680	name	keyprolog
23969>0	byte	0x04
23970>1	beldate	x			created on %s -
23971>5	byte	0x01			RSA (Encrypt or Sign)
23972>5	byte	0x02			RSA Encrypt-Only
23973
23974# end of secret keys known signature
23975# contains e=65537 and the prolog to
23976# the encrypted parameters
23977
239780	name	keyend
23979>0	string	\x00\x11\x01\x00\x01	e=65537
23980>5	use	crypto
23981>5	byte	0xff			checksummed
23982>>6	use	chkcrypto
23983>5	byte	0xfe			hashed
23984>>6	use	chkcrypto
23985
23986# PGP secret keys contain also the public parts
23987# these vary by bitsize of the key
23988
239890	name	x1024
23990>0	use	keyprolog
23991>6	string	\x03\xfe
23992>6	string	\x03\xff
23993>6	string	\x04\x00
23994>136	use	keyend
23995
239960	name	x2048
23997>0	use	keyprolog
23998>6	string	\x80\x00
23999>6	string	\x07\xfe
24000>6	string	\x07\xff
24001>264	use	keyend
24002
240030	name	x3072
24004>0	use	keyprolog
24005>6	string	\x0b\xfe
24006>6	string	\x0b\xff
24007>6	string	\x0c\x00
24008>392	use	keyend
24009
240100	name	x4096
24011>0	use	keyprolog
24012>6	string	\x10\x00
24013>6	string	\x0f\xfe
24014>6	string	\x0f\xff
24015>520	use	keyend
24016
24017# \x00|\x1f[\xfe\xff]).{1024})'
240180	name	x8192
24019>0	use	keyprolog
24020>6	string	\x20\x00
24021>6	string	\x1f\xfe
24022>6	string	\x1f\xff
24023>1032	use	keyend
24024
24025# depending on the size of the pkt
24026# we branch into the proper key size
24027# signatures defined as x{keysize}
24028
24029>0	name	pgpkey
24030>0	string	\x01\xd8	1024b
24031>>2	use	x1024
24032>0	string	\x01\xeb	1024b
24033>>2	use	x1024
24034>0	string	\x01\xfb	1024b
24035>>2	use	x1024
24036>0	string	\x01\xfd	1024b
24037>>2	use	x1024
24038>0	string	\x01\xf3	1024b
24039>>2	use	x1024
24040>0	string	\x01\xee	1024b
24041>>2	use	x1024
24042>0	string	\x01\xfe	1024b
24043>>2	use	x1024
24044>0	string	\x01\xf4	1024b
24045>>2	use	x1024
24046>0	string	\x02\x0d	1024b
24047>>2	use	x1024
24048>0	string	\x02\x03	1024b
24049>>2	use	x1024
24050>0	string	\x02\x05	1024b
24051>>2	use	x1024
24052>0	string	\x02\x15	1024b
24053>>2	use	x1024
24054>0	string	\x02\x00	1024b
24055>>2	use	x1024
24056>0	string	\x02\x10	1024b
24057>>2	use	x1024
24058>0	string	\x02\x04	1024b
24059>>2	use	x1024
24060>0	string	\x02\x06	1024b
24061>>2	use	x1024
24062>0	string	\x02\x16	1024b
24063>>2	use	x1024
24064>0	string	\x03\x98	2048b
24065>>2	use	x2048
24066>0	string	\x03\xab	2048b
24067>>2	use	x2048
24068>0	string	\x03\xbb	2048b
24069>>2	use	x2048
24070>0	string	\x03\xbd	2048b
24071>>2	use	x2048
24072>0	string	\x03\xcd	2048b
24073>>2	use	x2048
24074>0	string	\x03\xb3	2048b
24075>>2	use	x2048
24076>0	string	\x03\xc3	2048b
24077>>2	use	x2048
24078>0	string	\x03\xc5	2048b
24079>>2	use	x2048
24080>0	string	\x03\xd5	2048b
24081>>2	use	x2048
24082>0	string	\x03\xae	2048b
24083>>2	use	x2048
24084>0	string	\x03\xbe	2048b
24085>>2	use	x2048
24086>0	string	\x03\xc0	2048b
24087>>2	use	x2048
24088>0	string	\x03\xd0	2048b
24089>>2	use	x2048
24090>0	string	\x03\xb4	2048b
24091>>2	use	x2048
24092>0	string	\x03\xc4	2048b
24093>>2	use	x2048
24094>0	string	\x03\xc6	2048b
24095>>2	use	x2048
24096>0	string	\x03\xd6	2048b
24097>>2	use	x2048
24098>0	string	\x05X		3072b
24099>>2	use	x3072
24100>0	string	\x05k		3072b
24101>>2	use	x3072
24102>0	string	\x05{		3072b
24103>>2	use	x3072
24104>0	string	\x05}		3072b
24105>>2	use	x3072
24106>0	string	\x05\x8d	3072b
24107>>2	use	x3072
24108>0	string	\x05s		3072b
24109>>2	use	x3072
24110>0	string	\x05\x83	3072b
24111>>2	use	x3072
24112>0	string	\x05\x85	3072b
24113>>2	use	x3072
24114>0	string	\x05\x95	3072b
24115>>2	use	x3072
24116>0	string	\x05n		3072b
24117>>2	use	x3072
24118>0	string	\x05\x7e	3072b
24119>>2	use	x3072
24120>0	string	\x05\x80	3072b
24121>>2	use	x3072
24122>0	string	\x05\x90	3072b
24123>>2	use	x3072
24124>0	string	\x05t		3072b
24125>>2	use	x3072
24126>0	string	\x05\x84	3072b
24127>>2	use	x3072
24128>0	string	\x05\x86	3072b
24129>>2	use	x3072
24130>0	string	\x05\x96	3072b
24131>>2	use	x3072
24132>0	string	\x07[		4096b
24133>>2	use	x4096
24134>0	string	\x07\x18	4096b
24135>>2	use	x4096
24136>0	string	\x07+		4096b
24137>>2	use	x4096
24138>0	string	\x07;		4096b
24139>>2	use	x4096
24140>0	string	\x07=		4096b
24141>>2	use	x4096
24142>0	string	\x07M		4096b
24143>>2	use	x4096
24144>0	string	\x073		4096b
24145>>2	use	x4096
24146>0	string	\x07C		4096b
24147>>2	use	x4096
24148>0	string	\x07E		4096b
24149>>2	use	x4096
24150>0	string	\x07U		4096b
24151>>2	use	x4096
24152>0	string	\x07.		4096b
24153>>2	use	x4096
24154>0	string	\x07>		4096b
24155>>2	use	x4096
24156>0	string	\x07@		4096b
24157>>2	use	x4096
24158>0	string	\x07P		4096b
24159>>2	use	x4096
24160>0	string	\x074		4096b
24161>>2	use	x4096
24162>0	string	\x07D		4096b
24163>>2	use	x4096
24164>0	string	\x07F		4096b
24165>>2	use	x4096
24166>0	string	\x07V		4096b
24167>>2	use	x4096
24168>0	string	\x0e[		8192b
24169>>2	use	x8192
24170>0	string	\x0e\x18	8192b
24171>>2	use	x8192
24172>0	string	\x0e+		8192b
24173>>2	use	x8192
24174>0	string	\x0e;		8192b
24175>>2	use	x8192
24176>0	string	\x0e=		8192b
24177>>2	use	x8192
24178>0	string	\x0eM		8192b
24179>>2	use	x8192
24180>0	string	\x0e3		8192b
24181>>2	use	x8192
24182>0	string	\x0eC		8192b
24183>>2	use	x8192
24184>0	string	\x0eE		8192b
24185>>2	use	x8192
24186>0	string	\x0eU		8192b
24187>>2	use	x8192
24188>0	string	\x0e.		8192b
24189>>2	use	x8192
24190>0	string	\x0e>		8192b
24191>>2	use	x8192
24192>0	string	\x0e@		8192b
24193>>2	use	x8192
24194>0	string	\x0eP		8192b
24195>>2	use	x8192
24196>0	string	\x0e4		8192b
24197>>2	use	x8192
24198>0	string	\x0eD		8192b
24199>>2	use	x8192
24200>0	string	\x0eF		8192b
24201>>2	use	x8192
24202>0	string	\x0eV		8192b
24203>>2	use	x8192
24204
24205# PGP RSA (e=65537) secret (sub-)key header
24206
242070	byte	0x95			PGP Secret Key -
24208>1	use	pgpkey
242090	byte	0x97			PGP Secret Sub-key -
24210>1	use	pgpkey
242110	byte	0x9d
24212# Update: Joerg Jenderek
24213# secret subkey packet (tag 7) with same structure as secret key packet (tag 5)
24214# skip Fetus.Sys16 CALIBUS.MAIN OrbFix.Sys16.Ex by looking for positive len
24215>1	ubeshort	>0
24216#>1	ubeshort	x		\b, body length 0x%x
24217# next packet type often 88h,89h~(tag 2)~Signature Packet
24218#>>(1.S+3)	ubyte	x		\b, next packet type 0x%x
24219# skip Dragon.SHR DEMO.INIT by looking for positive version
24220>>3	ubyte		>0
24221# skip BUISSON.13 GUITAR1 by looking for low version number
24222>>>3	ubyte		<5		PGP Secret Sub-key
24223# sub-key are normally part of secret key. So it does not occur as standalone file
24224#!:ext	bin
24225# version 2,3~old 4~new . Comment following line for version 5.28 look
24226>>>>3	ubyte		x		(v%d)
24227>>>>3	ubyte		x		-
24228# old versions 2 or 3 but no real example found
24229>>>>3	ubyte		<4
24230# 2 byte for key bits in version 5.28 look
24231>>>>>11		ubeshort	x	%db
24232>>>>>4		beldate		x	created on %s -
24233# old versions use 2 additional bytes after time stamp
24234#>>>>>8		ubeshort	x	0x%x
24235# display key algorithm 1~RSA Encrypt|Sign - 21~Diffie-Hellman
24236>>>>>10	  	use		key_algo
24237>>>>>(11.S/8)	ubequad		x
24238# look after first key
24239>>>>>>&5	use		keyend
24240# new version
24241>>>>3	ubyte		>3
24242>>>>>9		ubeshort	x	%db
24243>>>>>4		beldate		x	created on %s -
24244# display key algorithm
24245>>>>>8		use		key_algo
24246>>>>>(9.S/8)	ubequad		x
24247# look after first key for something like s2k
24248>>>>>>&3	use		keyend
24249
24250#------------------------------------------------------------------------------
24251# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $
24252# pkgadd:  file(1) magic for SysV R4 PKG Datastreams
24253#
242540       string          #\ PaCkAgE\ DaTaStReAm  pkg Datastream (SVR4)
24255!:mime	application/x-svr4-package
24256
24257#------------------------------------------------------------------------------
24258# $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $
24259# plan9:  file(1) magic for AT&T Bell Labs' Plan 9 executables
24260# From: "Stefan A. Haubenthal" <polluks@web.de>
24261#
242620	belong		0x00000107	Plan 9 executable, Motorola 68k
242630	belong		0x000001EB	Plan 9 executable, Intel 386
242640	belong		0x00000247	Plan 9 executable, Intel 960
242650	belong		0x000002AB	Plan 9 executable, SPARC
242660	belong		0x00000407	Plan 9 executable, MIPS R3000
242670	belong		0x0000048B	Plan 9 executable, AT&T DSP 3210
242680	belong		0x00000517	Plan 9 executable, MIPS R4000 BE
242690	belong		0x000005AB	Plan 9 executable, AMD 29000
242700	belong		0x00000647	Plan 9 executable, ARM 7-something
242710	belong		0x000006EB	Plan 9 executable, PowerPC
242720	belong		0x00000797	Plan 9 executable, MIPS R4000 LE
242730	belong		0x0000084B	Plan 9 executable, DEC Alpha
24274
24275#------------------------------------------------------------------------------
24276# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $
24277# plus5:  file(1) magic for Plus Five's UNIX MUMPS
24278#
24279# XXX - byte order?  Paging Hokey....
24280#
242810	short		0x259		mumps avl global
24282>2	byte		>0		(V%d)
24283>6	byte		>0		with %d byte name
24284>7	byte		>0		and %d byte data cells
242850	short		0x25a		mumps blt global
24286>2	byte		>0		(V%d)
24287>8	short		>0		- %d byte blocks
24288>15	byte		0x00		- P/D format
24289>15	byte		0x01		- P/K/D format
24290>15	byte		0x02		- K/D format
24291>15	byte		>0x02		- Bad Flags
24292
24293#------------------------------------------------------------------------------
24294# $File: polyml,v 1.2 2019/04/19 00:42:27 christos Exp $
24295# polyml:  file(1) magic for PolyML
24296#
24297# PolyML
24298# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
24299# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
24300
24301# [0]: https://www.polyml.org/
24302# [1]: https://github.com/polyml/polyml/blob/master/\
24303#	libpolyml/savestate.cpp#L146-L147
24304# [2]: https://github.com/polyml/polyml/blob/master/\
24305#	libpolyml/savestate.cpp#L1262-L1263
24306
24307# Type: Poly/ML saved data
24308# From: Matthew Fernandez <matthew.fernandez@gmail.com>
24309
243100	string	POLYSAVE	Poly/ML saved state
24311>8	long	x		version %u
24312
243130	string  POLYMODU	Poly/ML saved module
24314>8	long	x		version %u
24315
24316#------------------------------------------------------------------------------
24317# $File: printer,v 1.29 2019/04/19 00:42:27 christos Exp $
24318# printer:  file(1) magic for printer-formatted files
24319#
24320
24321# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
243220	string		%!		PostScript document text
24323!:mime	application/postscript
24324!:apple	ASPSTEXT
24325>2	string		PS-Adobe-	conforming
24326>>11	string		>\0		DSC level %.3s
24327>>>15	string		EPS		\b, type %s
24328>>>15	string		Query		\b, type %s
24329>>>15	string		ExitServer	\b, type %s
24330>>>15   search/1000		%%LanguageLevel:\040
24331>>>>&0	string		>\0		\b, Level %s
24332# Some PCs have the annoying habit of adding a ^D as a document separator
243330	string		\004%!		PostScript document text
24334!:mime	application/postscript
24335!:apple	ASPSTEXT
24336>3	string		PS-Adobe-	conforming
24337>>12	string		>\0		DSC level %.3s
24338>>>16	string		EPS		\b, type %s
24339>>>16	string		Query		\b, type %s
24340>>>16	string		ExitServer	\b, type %s
24341>>>16   search/1000		%%LanguageLevel:\040
24342>>>>&0	string		>\0		\b, Level %s
243430	string		\033%-12345X%!PS	PostScript document
24344
24345# DOS EPS Binary File Header
24346# From: Ed Sznyter <ews@Black.Market.NET>
243470       belong          0xC5D0D3C6      DOS EPS Binary File
24348>4      long            >0              Postscript starts at byte %d
24349>>8     long            >0              length %d
24350>>>12   long            >0              Metafile starts at byte %d
24351>>>>16  long            >0              length %d
24352>>>20   long            >0              TIFF starts at byte %d
24353>>>>24  long            >0              length %d
24354
24355# Summary: Adobe's PostScript Printer Description File
24356# Extension: .ppd
24357# Reference: https://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8
24358# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr>
24359#
243600	string		*PPD-Adobe:\x20	PPD file
24361>&0	string		x		\b, version %s
24362
24363# HP Printer Job Language
243640	string		\033%-12345X@PJL	HP Printer Job Language data
24365# HP Printer Job Language
24366# The header found on Win95 HP plot files is the "Silliest Thing possible"
24367# (TM)
24368# Every driver puts the language at some random position, with random case
24369# (LANGUAGE and Language)
24370# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
24371# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
24372#
243730	string		\033%-12345X@PJL	HP Printer Job Language data
24374>&0	string		>\0			%s
24375>>&0	string		>\0			%s
24376>>>&0	string		>\0			%s
24377>>>>&0	string		>\0			%s
24378#>15	string		\ ENTER\ LANGUAGE\ =
24379#>31	string		PostScript		PostScript
24380
24381# From: Stefan Thurner <thurners@nicsys.de>
243820	string		\033%-12345X@PJL
24383>&0	search/10000	%!			PJL encapsulated PostScript document text
24384
24385# Rick Richardson <rickrich@gmail.com>
24386
24387# For Fuji-Xerox Printers - HBPL stands for Host Based Printer Language
24388# For Oki Data Printers - HIPERC
24389# For Konica Minolta Printers - LAVAFLOW
24390# For Samsung Printers - QPDL
24391# For HP Printers - ZJS stands for Zenographics ZJStream
243920	string		\033%-12345X@PJL	HP Printer Job Language data
24393>0	search/10000	@PJL\ ENTER\ LANGUAGE=HBPL	- HBPL
24394>0	search/10000	@PJL\ ENTER\ LANGUAGE=HIPERC	- Oki Data HIPERC
24395>0	search/10000	@PJL\ ENTER\ LANGUAGE=LAVAFLOW	- Konica Minolta LAVAFLOW
24396>0	search/10000	@PJL\ ENTER\ LANGUAGE=QPDL	- Samsung QPDL
24397>0	search/10000	@PJL\ ENTER\ LANGUAGE\ =\ QPDL	- Samsung QPDL
24398>0	search/10000	@PJL\ ENTER\ LANGUAGE=ZJS	- HP ZJS
24399
24400
24401# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
244020	string		\033E\033	HP PCL printer data
24403>3	string		\&l0A		- default page size
24404>3	string		\&l1A		- US executive page size
24405>3	string		\&l2A		- US letter page size
24406>3	string		\&l3A		- US legal page size
24407>3	string		\&l26A		- A4 page size
24408>3	string		\&l80A		- Monarch envelope size
24409>3	string		\&l81A		- No. 10 envelope size
24410>3	string		\&l90A		- Intl. DL envelope size
24411>3	string		\&l91A		- Intl. C5 envelope size
24412>3	string		\&l100A		- Intl. B5 envelope size
24413>3	string		\&l-81A		- No. 10 envelope size (landscape)
24414>3	string		\&l-90A		- Intl. DL envelope size (landscape)
24415
24416# IMAGEN printer-ready files:
244170	string	@document(		Imagen printer
24418# this only works if "language xxx" is first item in Imagen header.
24419>10	string	language\ impress	(imPRESS data)
24420>10	string	language\ daisy		(daisywheel text)
24421>10	string	language\ diablo	(daisywheel text)
24422>10	string	language\ printer	(line printer emulation)
24423>10	string	language\ tektronix	(Tektronix 4014 emulation)
24424# Add any other languages that your Imagen uses - remember
24425# to keep the word `text' if the file is human-readable.
24426# [GRR 950115:  missing "postscript" or "ultrascript" (whatever it was called)]
24427#
24428# Now magic for IMAGEN font files...
244290	string		Rast		RST-format raster font data
24430>45	string		>0		face %s
24431# From Jukka Ukkonen
244320	string		\033[K\002\0\0\017\033(a\001\0\001\033(g	Canon Bubble Jet BJC formatted data
24433
24434# From <mike@flyn.org>
24435# These are the /etc/magic entries to decode data sent to an Epson printer.
244360       string          \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P        Epson Stylus Color 460 data
24437
24438
24439#------------------------------------------------------------------------------
24440# zenographics:  file(1) magic for Zenographics ZjStream printer data
24441# Rick Richardson <rickrich@gmail.com>
244420	string		JZJZ
24443>0x12	string		ZZ		Zenographics ZjStream printer data (big-endian)
244440	string		ZJZJ
24445>0x12	string		ZZ		Zenographics ZjStream printer data (little-endian)
24446
24447
24448#------------------------------------------------------------------------------
24449# Oak Technologies printer stream
24450# Rick Richardson <rickrich@gmail.com>
244510       string          OAK
24452>0x07	byte		0
24453>0x0b	byte		0	Oak Technologies printer stream
24454
24455# This would otherwise be recognized as PostScript - nick@debian.org
244560	string		%!VMF 		SunClock's Vector Map Format data
24457
24458#------------------------------------------------------------------------------
24459# HP LaserJet 1000 series downloadable firmware file
244600	string	\xbe\xefABCDEFGH	HP LaserJet 1000 series downloadable firmware
24461
24462# From: Paolo <oopla@users.sf.net>
24463# Epson ESC/Page, ESC/PageColor
244640	string	\x1b\x01@EJL	Epson ESC/Page language printer data
24465
24466#------------------------------------------------------------------------------
24467# $File: project,v 1.5 2017/03/17 21:35:28 christos Exp $
24468# project:  file(1) magic for Project management
24469#
24470# Magic strings for ftnchek project files. Alexander Mai
244710	string	FTNCHEK_\ P	project file for ftnchek
24472>10	string	1		version 2.7
24473>10	string	2		version 2.8 to 2.10
24474>10	string	3		version 2.11 or later
24475
24476#------------------------------------------------------------------------------
24477# $File: psdbms,v 1.8 2017/03/17 21:35:28 christos Exp $
24478# psdbms:  file(1) magic for psdatabase
24479#
24480# Update: Joerg Jenderek
24481# GRR: line below too general as it catches also some Panorama database *.pan ,
24482# AppleWorks word processor
244830	belong&0xff00ffff	0x56000000
24484# assume version starts with digit
24485>1	regex/s			=^[0-9]		ps database
24486>>1	string	>\0	version %s
24487# kernel name
24488>>4	string	>\0	from kernel %s
24489
24490#------------------------------------------------------------------------------
24491# $File: psl,v 1.3 2019/04/19 00:42:27 christos Exp $
24492# psl:  file(1) magic for Public Suffix List representations
24493# From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
24494# URL: https://publicsuffix.org
24495# see also: https://thread.gmane.org/gmane.network.dns.libpsl.bugs/162/focus=166
24496
244970	search/512	\n\n//\ ===BEGIN\ ICANN\ DOMAINS===\n\n Public Suffix List data
24498
244990	string	.DAFSA@PSL_
24500>15	string	\n	Public Suffix List data (optimized)
24501>>11	byte	>0x2f
24502>>>11	byte	<0x3a   (Version %c)
24503
24504#------------------------------------------------------------------------------
24505# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $
24506# pulsar:  file(1) magic for Pulsar POP3 daemon binary files
24507#
24508# http://pulsar.sourceforge.net
24509# mailto:rok.papez@lugos.si
24510#
24511
245120	belong	0x1ee7f11e	Pulsar POP3 daemon mailbox cache file.
24513>4	ubelong	x		Version: %d.
24514>8	ubelong	x		\b%d
24515
24516
24517#------------------------------------------------------------------------------
24518# $File: pwsafe,v 1.2 2019/04/19 00:42:27 christos Exp $
24519# pwsafe: file(1) magic for passwordsafe file
24520#
24521# Password Safe
24522# http://passwordsafe.sourceforge.net/
24523# file format specs
24524# https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt
24525# V2 https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt
24526# V1 https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt
24527# V2 and V1 have no easy identifier that I can find
24528# .psafe3
245290	string	PWS3	Password Safe V3 database
24530
24531#------------------------------------------------------------------------------
24532# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $
24533# pyramid:  file(1) magic for Pyramids
24534#
24535# XXX - byte order?
24536#
245370	long		0x50900107	Pyramid 90x family executable
245380	long		0x50900108	Pyramid 90x family pure executable
24539>16	long		>0		not stripped
245400	long		0x5090010b	Pyramid 90x family demand paged pure executable
24541>16	long		>0		not stripped
24542
24543#------------------------------------------------------------------------------
24544# $File: python,v 1.36 2019/04/09 18:28:25 christos Exp $
24545# python:  file(1) magic for python
24546#
24547# Outlook puts """ too for urgent messages
24548# From: David Necas <yeti@physics.muni.cz>
24549# often the module starts with a multiline string
245500	string/t	"""	Python script text executable
24551# MAGIC as specified in Python/import.c (1.5 to 2.7a0 and 3.1a0, assuming
24552# that Py_UnicodeFlag is off for Python 2)
24553# two bytes of magic followed by "\r\n" in little endian order
245540	belong		0x994e0d0a	python 1.5/1.6 byte-compiled
245550	belong		0x87c60d0a	python 2.0 byte-compiled
245560	belong		0x2aeb0d0a	python 2.1 byte-compiled
245570	belong		0x2ded0d0a	python 2.2 byte-compiled
245580	belong		0x3bf20d0a	python 2.3 byte-compiled
245590	belong		0x6df20d0a	python 2.4 byte-compiled
245600	belong		0xb3f20d0a	python 2.5 byte-compiled
245610	belong		0xd1f20d0a	python 2.6 byte-compiled
245620	belong		0x03f30d0a	python 2.7 byte-compiled
245630	belong		0x3b0c0d0a	python 3.0 byte-compiled
245640	belong		0x4f0c0d0a	python 3.1 byte-compiled
245650	belong		0x6c0c0d0a	python 3.2 byte-compiled
245660	belong		0x9e0c0d0a	python 3.3 byte-compiled
245670	belong		0xee0c0d0a	python 3.4 byte-compiled
245680	belong		0x160d0d0a	python 3.5.1- byte-compiled
245690	belong		0x170d0d0a	python 3.5.2+ byte-compiled
245700	belong		0x330d0d0a	python 3.6 byte-compiled
245710	belong		0x420d0d0a	python 3.7 byte-compiled
24572
24573
245740	search/1/w	#!\ /usr/bin/python	Python script text executable
24575!:strength + 15
24576!:mime text/x-python
245770	search/1/w	#!\ /usr/local/bin/python	Python script text executable
24578!:strength + 15
24579!:mime text/x-python
245800	search/1	#!/usr/bin/env\ python	Python script text executable
24581!:strength + 15
24582!:mime text/x-python
245830	search/10	#!\ /usr/bin/env\ python	Python script text executable
24584!:strength + 15
24585!:mime text/x-python
24586
24587
24588# from module.submodule import func1, func2
245890	search/8192	import
24590>0	regex		\^from[\040\t\f\r\n]+([A-Za-z0-9_]|\\.)+[\040\t\f\r\n]+import.*$	Python script text executable
24591!:strength + 15
24592!:mime text/x-python
24593
24594# def __init__ (self, ...):
245950	search/4096	def\ __init__
24596>&0	search/64 self	Python script text executable
24597!:strength + 15
24598!:mime text/x-python
24599
24600# if __name__ == "__main__":
246010 search/4096 if\ __name__
24602>&0 search/64 '__main__'	Python script text executable
24603>&0 search/64 "__main__"	Python script text executable
24604!:strength + 15
24605!:mime text/x-python
24606
24607# import module [as abrev]
246080	search/8192	import
24609>0	regex	\^import\ [_[:alpha:]]+\ as\ [[:alpha:]][[:space:]]*$ Python script text executable
24610!:mime text/x-python
24611
24612# comments
24613#0	search/4096	'''
24614#>&0	regex	.*'''$	Python script text executable
24615#!:mime text/x-python
24616
24617#0	search/4096	"""
24618#>&0	regex	.*"""$	Python script text executable
24619#!:mime text/x-python
24620
24621# try:
24622# except: or finally:
24623# block
246240	search/4096	try:
24625>&0	regex	\^[[:space:]]*except.*:$	Python script text executable
24626!:strength + 15
24627!:mime text/x-python
24628>&0	search/4096	finally:	Python script text executable
24629!:mime text/x-python
24630
24631# class name[(base classes,)]: [pass]
246320	search/8192	class
24633>0	regex	\^class\ [_[:alpha:]]+(\\(.*\\))?(\ )*:([\ \t]+pass)?$		Python script text executable
24634!:strength + 15
24635!:mime text/x-python
24636
24637# def name(*args, **kwargs):
246380	search/8192	def\
24639>0	regex	 \^[[:space:]]{0,50}def\ {1,50}[_a-zA-Z]{1,100}
24640>>&0	regex	 \\(([[:alpha:]*_,\ ]){0,255}\\):$ Python script text executable
24641!:strength + 15
24642!:mime text/x-python
24643
24644#------------------------------------------------------------------------------
24645# $File: qt,v 1.3 2019/04/19 00:42:27 christos Exp $
24646# qt:  file(1) magic for Qt
24647
24648# https://doc.qt.io/qt-5/resources.html
246490	string		\<!DOCTYPE\040RCC\>	Qt Resource Collection file
24650
24651# https://qt.gitorious.org/qt/qtbase/source/\
24652# 5367fa356233da4c0f28172a8f817791525f5457:\
24653# src/tools/rcc/rcc.cpp#L840
246540	string		qres\0\0		Qt Binary Resource file
246550	search/1024	The\040Resource\040Compiler\040for\040Qt	Qt C-code resource file
24656
24657# https://qt.gitorious.org/qt/qtbase/source/\
24658# 5367fa356233da4c0f28172a8f817791525f5457:\
24659# src/corelib/kernel/qtranslator.cpp#L62
246600	string		\x3c\xb8\x64\x18\xca\xef\x9c\x95
24661>8	string		\xcd\x21\x1c\xbf\x60\xa1\xbd\xdd	Qt Translation file
24662
24663#------------------------------------------------------------------------------
24664# $File: revision,v 1.11 2019/04/19 00:42:27 christos Exp $
24665# file(1) magic for revision control files
24666# From Hendrik Scholz <hendrik@scholz.net>
246670	string/t	/1\ :pserver:	cvs password text file
24668
24669# Conary changesets
24670# From: Jonathan Smith <smithj@rpath.com>
246710	belong	0xea3f81bb	Conary changeset data
24672
24673# Type: Git bundles (git-bundle)
24674# From: Josh Triplett <josh@freedesktop.org>
246750	string	#\ v2\ git\ bundle\n	Git bundle
24676
24677# Type: Git pack
24678# From: Adam Buchbinder <adam.buchbinder@gmail.com>
24679# Update: Joerg Jenderek
24680# URL: http://fileformats.archiveteam.org/wiki/Git
24681# reference: https://github.com/git/git/blob/master/Documentation/technical/pack-format.txt
24682# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However,
24683# those have a little-endian offset immediately following the magic 'PACK',
24684# the first byte of which is never 0, while the first byte of the Git pack
24685# version, since it's a tiny number stored in big-endian format, is always 0.
246860	string	PACK
24687# GRR: line above is too general as it matches also PackDir archive ./acorn
24688# test for major version. Git 2017 accepts version number 2 or 3
24689>4	ubelong	<9
24690# Acorn PackDir with method 0 compression has root like ADFS::HardDisc4.$.AsylumSrc
24691# or SystemDevice::foobar
24692>>9	search/13 ::
24693# but in git binary
24694>>9	default	x	Git pack
24695!:mime	application/x-git
24696!:ext	pack
24697# 4 GB limit implies unsigned integer
24698>>>4	ubelong	x		\b, version %u
24699>>>8	ubelong	x		\b, %u objects
24700
24701# Type: Git pack index
24702# From: Adam Buchbinder <adam.buchbinder@gmail.com>
247030	string	\377tOc		Git pack index
24704>4	belong	=2		\b, version 2
24705
24706# Type: Git index file
24707# From: Frederic Briare <fbriere@fbriere.net>
247080	string	DIRC		Git index
24709>4	belong	>0		\b, version %d
24710>>8	belong	>0		\b, %d entries
24711
24712# Type:	Mercurial bundles
24713# From:	Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
247140	string	HG10		Mercurial bundle,
24715>4	string	UN		uncompressed
24716>4	string	BZ		bzip2 compressed
24717
24718# Type:	Subversion (SVN) dumps
24719# From:	Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de>
247200	string	SVN-fs-dump-format-version:	Subversion dumpfile
24721>28	string	>\0				(version: %s)
24722
24723# Type:	Bazaar revision bundles and merge requests
24724# URL:	https://www.bazaar-vcs.org/
24725# From:	Jelmer Vernooij <jelmer@samba.org>
247260	string	#\ Bazaar\ revision\ bundle\ v Bazaar Bundle
247270	string	#\ Bazaar\ merge\ directive\ format Bazaar merge directive
24728
24729#------------------------------------------------------------------------------
24730# $File: riff,v 1.34 2019/04/19 00:42:27 christos Exp $
24731# riff:  file(1) magic for RIFF format
24732# See
24733#
24734#	https://www.seanet.com/users/matts/riffmci/riffmci.htm
24735#	http://www-mmsp.ece.mcgill.ca/Documents/AudioFormats/WAVE/Docs/riffmci.pdf
24736#
24737
24738# audio format tag. Assume limits: max 1024 bit, 128 channels, 1 MHz
247390   name    riff-wave
24740>0	leshort		1		\b, Microsoft PCM
24741>>14	leshort		>0
24742>>>14	leshort		<1024	\b, %d bit
24743>0	leshort		2		\b, Microsoft ADPCM
24744>0	leshort		6		\b, ITU G.711 A-law
24745>0	leshort		7		\b, ITU G.711 mu-law
24746>0	leshort		8		\b, Microsoft DTS
24747>0	leshort		17		\b, IMA ADPCM
24748>0	leshort		20		\b, ITU G.723 ADPCM (Yamaha)
24749>0	leshort		49		\b, GSM 6.10
24750>0	leshort		64		\b, ITU G.721 ADPCM
24751>0	leshort		80		\b, MPEG
24752>0	leshort		85		\b, MPEG Layer 3
24753>0	leshort		0x2001		\b, DTS
24754>2	leshort		=1		\b, mono
24755>2	leshort		=2		\b, stereo
24756>2	leshort		>2
24757>>2	leshort		<128	\b, %d channels
24758>4	lelong		>0
24759>>4	lelong		<1000000	%d Hz
24760
24761# try to find "fmt "
247620   name    riff-walk
24763>0  string  fmt\x20
24764>>4 lelong  <0x80
24765>>>8 use    riff-wave
24766>0  string  LIST
24767>>&(4.l+4)  use riff-walk
24768>0  string  DISP
24769>>&(4.l+4)  use riff-walk
24770>0  string  bext
24771>>&(4.l+4)  use riff-walk
24772>0  string  Fake
24773>>&(4.l+4)  use riff-walk
24774>0  string  fact
24775>>&(4.l+4)  use riff-walk
24776>0  string  VP8
24777>>11		byte		0x9d
24778>>>12		byte		0x01
24779>>>>13		byte		0x2a	\b, VP8 encoding
24780>>>>>14		leshort&0x3fff	x	\b, %d
24781>>>>>16		leshort&0x3fff	x	\bx%d, Scaling:
24782>>>>>14		leshort&0xc000	0x0000	\b [none]
24783>>>>>14		leshort&0xc000	0x1000	\b [5/4]
24784>>>>>14		leshort&0xc000	0x2000	\b [5/3]
24785>>>>>14		leshort&0xc000	0x3000	\b [2]
24786>>>>>14		leshort&0xc000	0x0000	\bx[none]
24787>>>>>14		leshort&0xc000	0x1000	\bx[5/4]
24788>>>>>14		leshort&0xc000	0x2000	\bx[5/3]
24789>>>>>14		leshort&0xc000	0x3000	\bx[2]
24790>>>>>15		byte&0x80	=0x00	\b, YUV color
24791>>>>>15		byte&0x80	=0x80	\b, bad color specification
24792>>>>>15		byte&0x40	=0x40	\b, no clamping required
24793>>>>>15		byte&0x40	=0x00	\b, decoders should clamp
24794#>0  string  x		we got %s
24795#>>&(4.l+4)  use riff-walk
24796
24797# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi>
24798#
247990	string		RIFF		RIFF (little-endian) data
24800# RIFF Palette format
24801# Update: Joerg Jenderek
24802# URL: https://en.wikipedia.org/wiki/Resource_Interchange_File_Format
24803# Reference: https://worms2d.info/Palette_file
24804>8	string		PAL\ 		\b, palette
24805!:mime	application/x-riff
24806# color palette by Microsoft Corporation
24807!:ext	pal
24808# file size =  chunk size + 8 in most cases
24809>>4	ulelong+8	x		\b, %u bytes
24810# Extended PAL Format
24811>>12	string		plth		\b, extended
24812# Simple PAL Format
24813>>12	string		data
24814# data chunk size = color entries * 4 + 4 + sometimes extra (4) appended bytes
24815>>>16	ulelong		x		\b, data size %u
24816# palVersion is always 0x0300
24817#>>>20	leshort		x		\b, version 0x%4.4x
24818# palNumEntries specifies the number of palette color entries
24819>>>22	uleshort	x		\b, %u entries
24820# after palPalEntry sized (number of color entries * 4 ) vector
24821>>>(22.s*4)	ubequad	x
24822# jump relative 22 ( 8 + 16) bytes forward points after end of file or to
24823# appended extra bytes like in http://safecolours.rigdenage.com/set(ms).zip/Protan(MS).pal
24824>>>>&16		ubelong	x		\b, extra bytes
24825>>>>>&-4	ubelong	>0		0x%8.8x
24826# RIFF Device Independent Bitmap format
24827>8	string		RDIB		\b, device-independent bitmap
24828>>16	string		BM
24829>>>30	leshort		12		\b, OS/2 1.x format
24830>>>>34	leshort		x		\b, %d x
24831>>>>36	leshort		x		%d
24832>>>30	leshort		64		\b, OS/2 2.x format
24833>>>>34	leshort		x		\b, %d x
24834>>>>36	leshort		x		%d
24835>>>30	leshort		40		\b, Windows 3.x format
24836>>>>34	lelong		x		\b, %d x
24837>>>>38	lelong		x		%d x
24838>>>>44	leshort		x		%d
24839# RIFF MIDI format
24840>8	string		RMID		\b, MIDI
24841# RIFF Multimedia Movie File format
24842>8	string		RMMP		\b, multimedia movie
24843# RIFF wrapper for MP3
24844>8	string		RMP3		\b, MPEG Layer 3 audio
24845# Microsoft WAVE format (*.wav)
24846>8	string		WAVE		\b, WAVE audio
24847!:mime	audio/x-wav
24848>>12    string  >\0
24849>>>12   use     riff-walk
24850# Corel Draw Picture
24851>8	string		CDRA		\b, Corel Draw Picture
24852!:mime	image/x-coreldraw
24853>8	string		CDR6		\b, Corel Draw Picture, version 6
24854!:mime	image/x-coreldraw
24855>8	string		NUNDROOT	\b, Steinberg CuBase
24856# AVI == Audio Video Interleave
24857>8	string		AVI\040		\b, AVI
24858!:mime	video/x-msvideo
24859>>12    string          LIST
24860>>>20   string          hdrlavih
24861>>>>&36 lelong          x               \b, %u x
24862>>>>&40 lelong          x               %u,
24863>>>>&4  lelong          >1000000        <1 fps,
24864>>>>&4  lelong          1000000         1.00 fps,
24865>>>>&4  lelong          500000          2.00 fps,
24866>>>>&4  lelong          333333          3.00 fps,
24867>>>>&4  lelong          250000          4.00 fps,
24868>>>>&4  lelong          200000          5.00 fps,
24869>>>>&4  lelong          166667          6.00 fps,
24870>>>>&4  lelong          142857          7.00 fps,
24871>>>>&4  lelong          125000          8.00 fps,
24872>>>>&4  lelong          111111          9.00 fps,
24873>>>>&4  lelong          100000          10.00 fps,
24874# ]9.9,10.1[
24875>>>>&4  lelong          <101010
24876>>>>>&-4        lelong  >99010
24877>>>>>>&-4       lelong  !100000         ~10 fps,
24878>>>>&4  lelong          83333           12.00 fps,
24879# ]11.9,12.1[
24880>>>>&4  lelong          <84034
24881>>>>>&-4        lelong  >82645
24882>>>>>>&-4       lelong  !83333          ~12 fps,
24883>>>>&4  lelong          66667           15.00 fps,
24884# ]14.9,15.1[
24885>>>>&4  lelong          <67114
24886>>>>>&-4        lelong  >66225
24887>>>>>>&-4       lelong  !66667          ~15 fps,
24888>>>>&4  lelong          50000           20.00 fps,
24889>>>>&4  lelong          41708           23.98 fps,
24890>>>>&4  lelong          41667           24.00 fps,
24891# ]23.9,24.1[
24892>>>>&4  lelong          <41841
24893>>>>>&-4        lelong  >41494
24894>>>>>>&-4       lelong  !41708
24895>>>>>>>&-4      lelong  !41667          ~24 fps,
24896>>>>&4  lelong          40000           25.00 fps,
24897# ]24.9,25.1[
24898>>>>&4  lelong          <40161
24899>>>>>&-4        lelong  >39841
24900>>>>>>&-4       lelong  !40000          ~25 fps,
24901>>>>&4  lelong          33367           29.97 fps,
24902>>>>&4  lelong          33333           30.00 fps,
24903# ]29.9,30.1[
24904>>>>&4  lelong          <33445
24905>>>>>&-4        lelong  >33223
24906>>>>>>&-4       lelong  !33367
24907>>>>>>>&-4      lelong  !33333          ~30 fps,
24908>>>>&4  lelong          <32224          >30 fps,
24909##>>>>&4  lelong          x               (%lu)
24910##>>>>&20 lelong          x               %lu frames,
24911# Note: The tests below assume that the AVI has 1 or 2 streams,
24912#       "vids" optionally followed by "auds".
24913#       (Should cover 99.9% of all AVIs.)
24914# assuming avih length = 56
24915>>>88   string  LIST
24916>>>>96  string  strlstrh
24917>>>>>108        string  vids    video:
24918>>>>>>&0        lelong  0               uncompressed
24919# skip past vids strh
24920>>>>>>(104.l+108)       string  strf
24921>>>>>>>(104.l+132)      lelong          1       RLE 8bpp
24922>>>>>>>(104.l+132)      string/c        cvid    Cinepak
24923>>>>>>>(104.l+132)      string/c        i263    Intel I.263
24924>>>>>>>(104.l+132)      string/c        iv32    Indeo 3.2
24925>>>>>>>(104.l+132)      string/c        iv41    Indeo 4.1
24926>>>>>>>(104.l+132)      string/c        iv50    Indeo 5.0
24927>>>>>>>(104.l+132)      string/c        mp42    Microsoft MPEG-4 v2
24928>>>>>>>(104.l+132)      string/c        mp43    Microsoft MPEG-4 v3
24929>>>>>>>(104.l+132)      string/c        fmp4    FFMpeg MPEG-4
24930>>>>>>>(104.l+132)      string/c        mjpg    Motion JPEG
24931>>>>>>>(104.l+132)      string/c        div3    DivX 3
24932>>>>>>>>112             string/c        div3    Low-Motion
24933>>>>>>>>112             string/c        div4    Fast-Motion
24934>>>>>>>(104.l+132)      string/c        divx    DivX 4
24935>>>>>>>(104.l+132)      string/c        dx50    DivX 5
24936>>>>>>>(104.l+132)      string/c        xvid    XviD
24937>>>>>>>(104.l+132)	string/c	h264	H.264
24938>>>>>>>(104.l+132)      string/c        wmv3    Windows Media Video 9
24939>>>>>>>(104.l+132)      string/c        h264    X.264 or H.264
24940>>>>>>>(104.l+132)      lelong  0
24941##>>>>>>>(104.l+132)      string  x       (%.4s)
24942# skip past first (video) LIST
24943>>>>(92.l+96)   string  LIST
24944>>>>>(92.l+104) string  strlstrh
24945>>>>>>(92.l+116)        string          auds    \b, audio:
24946# auds strh length = 56:
24947>>>>>>>(92.l+172)       string          strf
24948>>>>>>>>(92.l+180)      leshort 0x0001  uncompressed PCM
24949>>>>>>>>(92.l+180)      leshort 0x0002  ADPCM
24950>>>>>>>>(92.l+180)      leshort 0x0006  aLaw
24951>>>>>>>>(92.l+180)      leshort 0x0007  uLaw
24952>>>>>>>>(92.l+180)      leshort 0x0050  MPEG-1 Layer 1 or 2
24953>>>>>>>>(92.l+180)      leshort 0x0055  MPEG-1 Layer 3
24954>>>>>>>>(92.l+180)      leshort 0x2000  Dolby AC3
24955>>>>>>>>(92.l+180)      leshort 0x0161  DivX
24956##>>>>>>>>(92.l+180)      leshort x       (0x%.4x)
24957>>>>>>>>(92.l+182)      leshort 1       (mono,
24958>>>>>>>>(92.l+182)      leshort 2       (stereo,
24959>>>>>>>>(92.l+182)      leshort >2      (%d channels,
24960>>>>>>>>(92.l+184)      lelong  x       %d Hz)
24961# auds strh length = 64:
24962>>>>>>>(92.l+180)       string          strf
24963>>>>>>>>(92.l+188)      leshort 0x0001  uncompressed PCM
24964>>>>>>>>(92.l+188)      leshort 0x0002  ADPCM
24965>>>>>>>>(92.l+188)      leshort 0x0055  MPEG-1 Layer 3
24966>>>>>>>>(92.l+188)      leshort 0x2000  Dolby AC3
24967>>>>>>>>(92.l+188)      leshort 0x0161  DivX
24968##>>>>>>>>(92.l+188)      leshort x       (0x%.4x)
24969>>>>>>>>(92.l+190)      leshort 1       (mono,
24970>>>>>>>>(92.l+190)      leshort 2       (stereo,
24971>>>>>>>>(92.l+190)      leshort >2      (%d channels,
24972>>>>>>>>(92.l+192)      lelong  x       %d Hz)
24973# Animated Cursor format
24974>8	string		ACON		\b, animated cursor
24975# SoundFont 2 <mpruett@sgi.com>
24976>8	string		sfbk		SoundFont/Bank
24977# MPEG-1 wrapped in a RIFF, apparently
24978>8      string          CDXA            \b, wrapped MPEG-1 (CDXA)
24979>8	string		4XMV		\b, 4X Movie file
24980# AMV-type AVI file: https://wiki.multimedia.cx/index.php?title=AMV
24981>8	string		AMV\040		\b, AMV
24982>8      string          WEBP            \b, Web/P image
24983!:mime	image/webp
24984>>12	use		riff-walk
24985
24986#
24987# XXX - some of the below may only appear in little-endian form.
24988#
24989# Also "MV93" appears to be for one form of Macromedia Director
24990# files, and "GDMF" appears to be another multimedia format.
24991#
249920	string		RIFX		RIFF (big-endian) data
24993# RIFF Palette format
24994>8	string		PAL		\b, palette
24995>>16	beshort		x		\b, version %d
24996>>18	beshort		x		\b, %d entries
24997# RIFF Device Independent Bitmap format
24998>8	string		RDIB		\b, device-independent bitmap
24999>>16	string		BM
25000>>>30	beshort		12		\b, OS/2 1.x format
25001>>>>34	beshort		x		\b, %d x
25002>>>>36	beshort		x		%d
25003>>>30	beshort		64		\b, OS/2 2.x format
25004>>>>34	beshort		x		\b, %d x
25005>>>>36	beshort		x		%d
25006>>>30	beshort		40		\b, Windows 3.x format
25007>>>>34	belong		x		\b, %d x
25008>>>>38	belong		x		%d x
25009>>>>44	beshort		x		%d
25010# RIFF MIDI format
25011>8	string		RMID		\b, MIDI
25012# RIFF Multimedia Movie File format
25013>8	string		RMMP		\b, multimedia movie
25014# Microsoft WAVE format (*.wav)
25015>8	string		WAVE		\b, WAVE audio
25016>>20	leshort		1		\b, Microsoft PCM
25017>>>34	leshort		>0		\b, %d bit
25018>>22	beshort		=1		\b, mono
25019>>22	beshort		=2		\b, stereo
25020>>22	beshort		>2		\b, %d channels
25021>>24	belong		>0		%d Hz
25022# Corel Draw Picture
25023>8	string		CDRA		\b, Corel Draw Picture
25024>8	string		CDR6		\b, Corel Draw Picture, version 6
25025# AVI == Audio Video Interleave
25026>8	string		AVI\040		\b, AVI
25027# Animated Cursor format
25028>8	string		ACON		\b, animated cursor
25029# Notation Interchange File Format (big-endian only)
25030>8	string		NIFF		\b, Notation Interchange File Format
25031# SoundFont 2 <mpruett@sgi.com>
25032>8	string		sfbk		SoundFont/Bank
25033
25034#------------------------------------------------------------------------------
25035# Sony Wave64
25036# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf
25037# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian
250380	string	riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00		Sony Wave64 RIFF data
25039# 128 bit + total file size (64 bits) so 24 bytes
25040# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A }
25041>24	string		wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A		\b, WAVE 64 audio
25042!:mime	audio/x-w64
25043# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A }
25044>>40	search/256	fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A		\b
25045>>>&10	leshort		=1		\b, mono
25046>>>&10	leshort		=2		\b, stereo
25047>>>&10	leshort		>2		\b, %d channels
25048>>>&12	lelong		>0		%d Hz
25049
25050#------------------------------------------------------------------------------
25051# MBWF/RF64
25052# see EBU TECH 3306 https://tech.ebu.ch/docs/tech/tech3306-2009.pdf
250530	string	RF64\xff\xff\xff\xffWAVEds64		MBWF/RF64 audio
25054!:mime	audio/x-wav
25055>40	search/256	fmt\x20		\b
25056>>&6	leshort		=1		\b, mono
25057>>&6	leshort		=2		\b, stereo
25058>>&6	leshort		>2		\b, %d channels
25059>>&8	lelong		>0		%d Hz
25060
25061#------------------------------------------------------------------------------
25062# $File: rpi,v 1.1 2018/01/01 05:25:17 christos Exp $
25063# rpi:  file(1) magic for Raspberry Pi images
25064-44		lelong	0
25065>4		lelong	0
25066>>8		lelong	1
25067>>12		lelong	4
25068>>>16		string	283x
25069>>>>20		lelong	1
25070>>>>>24		lelong	4
25071>>>>>>28	string	DTOK
25072>>>>>>>32	lelong	44
25073>>>>>>>>36	lelong	4
25074>>>>>>>>>40	string	RPTL		Raspberry PI kernel image
25075
25076#------------------------------------------------------------------------------
25077# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $
25078#
25079# RPM: file(1) magic for Red Hat Packages   Erik Troan (ewt@redhat.com)
25080#
250810	belong		0xedabeedb	RPM
25082!:mime	application/x-rpm
25083>4	byte		x		v%d
25084>5	byte		x		\b.%d
25085>6	beshort		1		src
25086>6	beshort		0		bin
25087>>8	beshort		1		i386/x86_64
25088>>8	beshort		2		Alpha/Sparc64
25089>>8	beshort		3		Sparc
25090>>8	beshort		4		MIPS
25091>>8	beshort		5		PowerPC
25092>>8	beshort		6		68000
25093>>8	beshort		7		SGI
25094>>8	beshort		8		RS6000
25095>>8	beshort		9		IA64
25096>>8	beshort		10		Sparc64
25097>>8	beshort		11		MIPSel
25098>>8	beshort		12		ARM
25099>>8	beshort		13		MiNT
25100>>8	beshort		14		S/390
25101>>8	beshort		15		S/390x
25102>>8	beshort		16		PowerPC64
25103>>8	beshort		17		SuperH
25104>>8	beshort		18		Xtensa
25105>>8	beshort		255		noarch
25106>>10	string		x		%s
25107
25108#delta RPM    Daniel Novotny (dnovotny@redhat.com)
251090	string		drpm		Delta RPM
25110!:mime  application/x-rpm
25111>12	string 	x	%s
25112>>8	beshort		11		MIPSel
25113>>8	beshort		12		ARM
25114>>8	beshort		13		MiNT
25115>>8	beshort		14		S/390
25116>>8	beshort		15		S/390x
25117>>8	beshort		16		PowerPC64
25118>>8	beshort		17		SuperH
25119>>8	beshort		18		Xtensa
25120>>10	string		x		%s
25121
25122#------------------------------------------------------------------------------
25123# $File: rpmsg,v 1.1 2019/04/19 00:40:47 christos Exp $
25124# rpmsg: file(1) magic for restricted-permission messages (or "rights-protected" messages)
25125# see https://en.wikipedia.org/wiki/Rpmsg
25126
251270	string	\x76\xe8\x04\x60\xc4\x11\xe3\x86	rpmsg Restricted Permission Message
25128
25129#------------------------------------------------------------------------------
25130# $File: rtf,v 1.7 2009/09/19 16:28:12 christos Exp $
25131# rtf:	file(1) magic for Rich Text Format (RTF)
25132#
25133# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
25134#
251350	string		{\\rtf		Rich Text Format data,
25136!:mime	text/rtf
25137>5	string		1		version 1,
25138>>6	string		\\ansi		ANSI
25139>>6	string		\\mac		Apple Macintosh
25140>>6	string		\\pc		IBM PC, code page 437
25141>>6	string		\\pca		IBM PS/2, code page 850
25142>>6	default		x		unknown character set
25143>5	default		x		unknown version
25144
25145#------------------------------------------------------------------------------
25146# $File: ruby,v 1.9 2019/04/19 00:42:27 christos Exp $
25147# ruby:  file(1) magic for Ruby scripting language
25148# URL:  https://www.ruby-lang.org/
25149# From: Reuben Thomas <rrt@sc3d.org>
25150
25151# Ruby scripts
251520	search/1/w	#!\ /usr/bin/ruby				Ruby script text executable
25153!:strength + 15
25154!:mime text/x-ruby
251550	search/1/w	#!\ /usr/local/bin/ruby	Ruby script text executable
25156!:strength + 15
25157!:mime text/x-ruby
251580	search/1	#!/usr/bin/env\ ruby				Ruby script text executable
25159!:strength + 15
25160!:mime text/x-ruby
251610	search/1	#!\ /usr/bin/env\ ruby			Ruby script text executable
25162!:strength + 15
25163!:mime text/x-ruby
25164
25165# What looks like ruby, but does not have a shebang
25166# (modules and such)
25167# From: Lubomir Rintel <lkundrak@v3.sk>
251680	search/8192	require
25169>0	regex		\^[[:space:]]*require[[:space:]]'[A-Za-z_/]+'
25170>>0	regex		def\ [a-z]|\ do$
25171>>>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
25172!:strength + 30
25173!:mime	text/x-ruby
251740	regex		\^[[:space:]]*(class|module)[[:space:]][A-Z]
25175>0	regex		(modul|includ)e\ [A-Z]|def\ [a-z]
25176>>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
25177!:strength + 30
25178!:mime	text/x-ruby
25179# Classes with no modules or defs, beats simple ASCII
251800	regex		\^[[:space:]]*(class|module)[[:space:]][A-Z]
25181>&0	regex	\^[[:space:]]*end([[:space:]]+[;#if].*)?$		Ruby script text
25182!:strength + 10
25183!:mime	text/x-ruby
25184# Looks for function definition to balance python magic
25185# def name (args)
25186# end
251870	search/8192	def\
25188>0	regex		\^[[:space:]]*def\ [a-z]|def\ [[:alpha:]]+::[a-z]
25189>>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
25190!:strength + 10
25191!:mime	text/x-ruby
25192
251930	search/8192	require
25194>0	regex		\^[[:space:]]*require[[:space:]]'[A-Za-z_/]+'	Ruby script text
25195!:mime	text/x-ruby
251960	search/8192	include
25197>0 regex 	\^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+	Ruby script text
25198!:mime	text/x-ruby
25199
25200#------------------------------------------------------------------------------
25201# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $
25202# sc:  file(1) magic for "sc" spreadsheet
25203#
2520438	string		Spreadsheet	sc spreadsheet file
25205!:mime	application/x-sc
25206
25207#------------------------------------------------------------------------------
25208# $File: sccs,v 1.7 2017/03/17 21:35:28 christos Exp $
25209# sccs:  file(1) magic for SCCS archives
25210#
25211# SCCS archive structure:
25212# \001h01207
25213# \001s 00276/00000/00000
25214# \001d D 1.1 87/09/23 08:09:20 ian 1 0
25215# \001c date and time created 87/09/23 08:09:20 by ian
25216# \001e
25217# \001u
25218# \001U
25219# ... etc.
25220# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
25221# *Sigh*. And these both came from various parts of the USG.
25222# Maybe we should just switch everybody from SCCS to RCS!
25223# Further, you can't just say '\001h0', because the five-digit number
25224# is a checksum that could (presumably) have any leading digit,
25225# and we don't have regular expression matching yet.
25226# Hence the following official kludge:
252278	string		\001s\ 			SCCS archive data
25228
25229#------------------------------------------------------------------------------
25230# $File: scientific,v 1.13 2019/04/19 00:42:27 christos Exp $
25231# scientific:  file(1) magic for scientific formats
25232#
25233# From: Joe Krahn <krahn@niehs.nih.gov>
25234
25235########################################################
25236# CCP4 data and plot files:
252370	string		MTZ\040		MTZ reflection file
25238
2523992	string		PLOT%%84	Plot84 plotting file
25240>52	byte		1		, Little-endian
25241>55	byte		1		, Big-endian
25242
25243########################################################
25244# Electron density MAP/MASK formats
25245
252460	string		EZD_MAP	NEWEZD Electron Density Map
25247109	string		MAP\040(  Old EZD Electron Density Map
25248
252490	string/c	:-)\040Origin	BRIX Electron Density Map
25250>170	string		>0	, Sigma:%.12s
25251#>4	string		>0	%.178s
25252#>4	addr		x	%.178s
25253
252547	string		18\040!NTITLE	XPLOR ASCII Electron Density Map
252559	string		\040!NTITLE\012\040REMARK	CNS ASCII electron density map
25256
25257208	string		MAP\040	CCP4 Electron Density Map
25258# Assumes same stamp for float and double (normal case)
25259>212	byte		17	\b, Big-endian
25260>212	byte		34	\b, VAX format
25261>212	byte		68	\b, Little-endian
25262>212	byte		85	\b, Convex native
25263
25264############################################################
25265# X-Ray Area Detector images
252660	string	R-AXIS4\ \ \ 	R-Axis Area Detector Image:
25267>796	lelong	<20		Little-endian, IP #%d,
25268>>768	lelong	>0		Size=%dx
25269>>772	lelong	>0		\b%d
25270>796	belong	<20		Big-endian, IP #%d,
25271>>768	belong	>0		Size=%dx
25272>>772	belong	>0		\b%d
25273
252740	string	RAXIS\ \ \ \ \ 	R-Axis Area Detector Image, Win32:
25275>796	lelong	<20		Little-endian, IP #%d,
25276>>768	lelong	>0		Size=%dx
25277>>772	lelong	>0		\b%d
25278>796	belong	<20		Big-endian, IP #%d,
25279>>768	belong	>0		Size=%dx
25280>>772	belong	>0		\b%d
25281
25282
252831028	string	MMX\000\000\000\000\000\000\000\000\000\000\000\000\000	MAR Area Detector Image,
25284>1072	ulong	>1		Compressed(%d),
25285>1100	ulong	>1		%d headers,
25286>1104	ulong	>0		%d x
25287>1108	ulong	>0		%d,
25288>1120	ulong	>0		%d bits/pixel
25289
25290# Type: GEDCOM genealogical (family history) data
25291# From: Giuseppe Bilotta
252920       search/1/c	0\ HEAD         GEDCOM genealogy text
25293>&0     search		1\ GEDC
25294>>&0    search		2\ VERS         version
25295>>>&1   string		>\0		%s
25296# From: Phil Endecott <phil05@chezphil.org>
252970	string	\000\060\000\040\000\110\000\105\000\101\000\104		GEDCOM data
252980	string	\060\000\040\000\110\000\105\000\101\000\104\000		GEDCOM data
252990	string	\376\377\000\060\000\040\000\110\000\105\000\101\000\104	GEDCOM data
253000	string	\377\376\060\000\040\000\110\000\105\000\101\000\104\000	GEDCOM data
25301
25302# PDB: Protein Data Bank files
25303# Adam Buchbinder <adam.buchbinder@gmail.com>
25304#
25305# https://www.wwpdb.org/documentation/format32/sect2.html
25306# https://www.ch.ic.ac.uk/chemime/
25307#
25308# The PDB file format is fixed-field, 80 columns. From the spec:
25309#
25310# COLS        DATA
25311#  1 -  6      "HEADER"
25312#  11 - 50     String(40)
25313#  51 - 59     Date
25314#  63 - 66     IDcode
25315#
25316# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the
25317# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and
25318# uppercase letters. However, examples have been seen without the date string,
25319# e.g., the example on the chemime site.
253200	string	HEADER\ \ \ \040
25321>&0	regex/1l	\^.{40}
25322>>&0	regex/1l	[0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3}
25323>>>&0	regex/1ls	[A-Z0-9]{4}.{14}$
25324>>>>&0	regex/1l	[A-Z0-9]{4}	Protein Data Bank data, ID Code %s
25325!:mime	chemical/x-pdb
25326>>>>0	regex/1l	[0-9]{2}-[A-Z]{3}-[0-9]{2}	\b, %s
25327
25328# Type:	GDSII Stream file
253290	belong	0x00060002	GDSII Stream file
25330>4	byte	0x00
25331>>5	byte	x		version %d.0
25332>4	byte	>0x00		version %d
25333>>5	byte	x		\b.%d
25334
25335# Type: LXT (interLaced eXtensible Trace)
25336# chrysn <chrysn@fsfe.org>
253370	beshort	0x0138	interLaced eXtensible Trace (LXT) file
25338>2	beshort	>0	(Version %u)
25339
25340#------------------------------------------------------------------------------
25341# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $
253420	search/1		-----BEGIN\ CERTIFICATE------	RFC1421 Security Certificate text
253430	search/1		-----BEGIN\ NEW\ CERTIFICATE	RFC1421 Security Certificate Signing Request text
253440	belong	0xedfeedfe	Sun 'jks' Java Keystore File data
25345
253460	string \0volume_key	volume_key escrow packet
25347# Type:	SE Linux policy modules *.pp reference policy
25348#	for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny.
25349# URL:	https://doc.coker.com.au/computers/selinux-magic
25350# From:	Russell Coker <russell@coker.com.au>
25351
253520		lelong	0xf97cff8f	SE Linux modular policy
25353>4		lelong	x		version %d,
25354>8		lelong	x		%d sections,
25355>>(12.l)	lelong	0xf97cff8d
25356>>>(12.l+27)	lelong	x		mod version %d,
25357>>>(12.l+31)	lelong	0		Not MLS,
25358>>>(12.l+31)	lelong	1		MLS,
25359>>>(12.l+23)	lelong	2
25360>>>>(12.l+47)	string	>\0		module name %s
25361>>>(12.l+23)	lelong	1		base
25362
253631	string	policy_module(	SE Linux policy module source
253642	string	policy_module(	SE Linux policy module source
25365
253660	string	##\ <summary>	SE Linux policy interface source
25367
25368#0	search	gen_context(	SE Linux policy file contexts
25369
25370#0	search	gen_sens(	SE Linux policy MLS constraints source
25371
25372#------------------------------------------------------------------------------
25373# $File: sendmail,v 1.11 2019/04/19 00:42:27 christos Exp $
25374# sendmail:  file(1) magic for sendmail config files
25375#
25376# XXX - byte order?
25377#
25378# Update: Joerg Jenderek
25379# GRR: this test is too general as it catches also
25380# READ.ME.FIRST.AWP Sendmail frozen configuration
25381# - version ====|====|====|====|====|====|====|====|====|====|====|====|===
25382# Email_23_f217153422.ts Sendmail frozen configuration
25383# - version \330jK\354
253840	byte	046
25385# https://www.sendmail.com/sm/open_source/docs/older_release_notes/
25386# freezed configuration file (dbm format?) created from sendmal.cf with -bz
25387# by older sendmail. til version 8.6 support for frozen configuration files is removed
25388# valid version numbers look like "7.14.4" and should be similar to output of commands
25389# "sendmail -d0 -bt < /dev/null |grep -i Version" or "egrep '^DZ' /etc/sendmail.cf"
25390>16	regex/s	=^[0-78][0-9.]{4}	Sendmail frozen configuration
25391# normally only /etc/sendmail.fc or /var/adm/sendmail/sendmail.fc
25392!:ext fc
25393>>16	string	>\0			- version %s
253940	short	0x271c
25395# look for valid version number
25396>16	regex/s	=^[0-78][0-9.]{4}	Sendmail frozen configuration
25397!:ext fc
25398>>16	string	>\0			- version %s
25399
25400#------------------------------------------------------------------------------
25401# sendmail:  file(1) magic for sendmail m4(1) files
25402#
25403# From Hendrik Scholz <hendrik@scholz.net>
25404# i.e. files in /usr/share/sendmail/cf/
25405#
254060   string  divert(-1)\n    sendmail m4 text file
25407
25408
25409#------------------------------------------------------------------------------
25410# $File: sequent,v 1.14 2019/04/19 00:42:27 christos Exp $
25411# sequent:  file(1) magic for Sequent machines
25412#
25413# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
25414# For Sequent's multiprocessor systems (incomplete).
254150	lelong	0x00ea        	BALANCE NS32000 .o
25416>16	lelong	>0		not stripped
25417>124	lelong	>0		version %d
254180	lelong	0x10ea        	BALANCE NS32000 executable (0 @ 0)
25419>16	lelong  >0            	not stripped
25420>124	lelong	>0		version %d
254210	lelong	0x20ea        	BALANCE NS32000 executable (invalid @ 0)
25422>16	lelong  >0            	not stripped
25423>124	lelong	>0		version %d
254240	lelong	0x30ea        	BALANCE NS32000 standalone executable
25425>16	lelong  >0          	not stripped
25426>124	lelong	>0		version %d
25427#
25428# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
25429# Symmetry magic nums will not be reached if DOS COM comes before them;
25430# byte 0xeb is matched before these get a chance.
254310	leshort	0x12eb		SYMMETRY i386 .o
25432>16	lelong	>0		not stripped
25433>124	lelong	>0		version %d
254340	leshort	0x22eb		SYMMETRY i386 executable (0 @ 0)
25435>16	lelong	>0		not stripped
25436>124	lelong	>0		version %d
254370	leshort	0x32eb		SYMMETRY i386 executable (invalid @ 0)
25438>16	lelong	>0		not stripped
25439>124	lelong	>0		version %d
25440# https://en.wikipedia.org/wiki/Sequent_Computer_Systems
25441# below test line conflicts with MS-DOS 2.11 floppies and Acronis loader
25442#0	leshort	0x42eb		SYMMETRY i386 standalone executable
254430	leshort	0x42eb
25444# skip unlike negative version
25445>124	lelong	>-1
25446# assuming version 28867614 is very low probable
25447>>124	lelong	!28867614	SYMMETRY i386 standalone executable
25448>>>16	lelong	>0		not stripped
25449>>>124	lelong	>0		version %d
25450
25451#------------------------------------------------------------------------------
25452# $File: sereal,v 1.3 2015/02/05 19:14:45 christos Exp $
25453# sereal: file(1) magic the Sereal binary serialization format
25454#
25455# From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
25456#
25457# See the specification of the format at
25458# https://github.com/Sereal/Sereal/blob/master/sereal_spec.pod#document-header-format
25459#
25460# I'd have liked to do the byte&0xF0 matching against 0, 1, 2 ... by
25461# doing (byte&0xF0)>>4 here, but unfortunately that's not
25462# supported. So when we print out a message about an unknown format
25463# we'll print out e.g. 0x30 instead of the more human-readable
25464# 0x30>>4.
25465#
25466# See https://github.com/Sereal/Sereal/commit/35372ae01d in the
25467# Sereal.git repository for test Sereal data.
254680	name		sereal
25469>4	byte&0x0F	x		(version %d,
25470>4	byte&0xF0	0x00		uncompressed)
25471>4	byte&0xF0	0x10		compressed with non-incremental Snappy)
25472>4	byte&0xF0	0x20		compressed with incremental Snappy)
25473>4	byte&0xF0	>0x20		unknown subformat, flag: %d>>4)
25474
254750	string/b	\=srl		Sereal data packet
25476!:mime application/sereal
25477>&0	use		sereal
254780	string/b	\=\xF3rl	Sereal data packet
25479!:mime application/sereal
25480>&0	use		sereal
254810	string/b	\=\xC3\xB3rl	Sereal data packet, UTF-8 encoded
25482!:mime application/sereal
25483>&0	use		sereal
25484
25485
25486#------------------------------------------------------------------------------
25487# $File: sgi,v 1.23 2018/05/29 02:26:56 christos Exp $
25488# sgi:  file(1) magic for Silicon Graphics operating systems and applications
25489#
25490# Executable images are handled either in aout (for old-style a.out
25491# files for 68K; they are indistinguishable from other big-endian 32-bit
25492# a.out files) or in mips (for MIPS ECOFF and Ucode files)
25493#
25494
25495# kbd file definitions
254960	string	kbd!map		kbd map file
25497>8	byte	>0		Ver %d:
25498>10	short	>0		with %d table(s)
25499
255000	beshort	0x8765		disk quotas file
25501
255020	beshort	0x0506		IRIS Showcase file
25503>2	byte	0x49		-
25504>3	byte	x		- version %d
255050	beshort	0x0226		IRIS Showcase template
25506>2	byte	0x63		-
25507>3	byte	x		- version %d
255080	belong	0x5343464d	IRIS Showcase file
25509>4	byte	x		- version %d
255100	belong	0x5443464d	IRIS Showcase template
25511>4	byte	x		- version %d
255120	belong	0xdeadbabe	IRIX Parallel Arena
25513>8	belong	>0		- version %d
25514
25515# core files
25516#
25517# 32bit core file
255180	belong	0xdeadadb0	IRIX core dump
25519>4	belong	1		of
25520>16	string	>\0		'%s'
25521# 64bit core file
255220	belong	0xdeadad40	IRIX 64-bit core dump
25523>4	belong	1		of
25524>16	string	>\0		'%s'
25525# N32bit core file
255260       belong	0xbabec0bb	IRIX N32 core dump
25527>4      belong	1               of
25528>16     string	>\0             '%s'
25529# New style crash dump file
255300	string	\x43\x72\x73\x68\x44\x75\x6d\x70	IRIX vmcore dump of
25531>36	string	>\0					'%s'
25532
25533# Trusted IRIX info
255340	string	SGIAUDIT	SGI Audit file
25535>8	byte	x		- version %d
25536>9	byte	x		\b.%d
25537#
255380	string	WNGZWZSC	Wingz compiled script
255390	string	WNGZWZSS	Wingz spreadsheet
255400	string	WNGZWZHP	Wingz help file
25541#
255420	string	#Inventor\040V	IRIS Inventor 1.0 file
255430	string	#Inventor\040V2	Open Inventor 2.0 file
25544# GLF is OpenGL stream encoding
255450	string	glfHeadMagic();		GLF_TEXT
255464	belong	0x7d000000		GLF_BINARY_LSB_FIRST
25547!:strength -30
255484	belong	0x0000007d		GLF_BINARY_MSB_FIRST
25549!:strength -30
25550# GLS is OpenGL stream encoding; GLS is the successor of GLF
255510	string	glsBeginGLS(		GLS_TEXT
255524	belong	0x10000000		GLS_BINARY_LSB_FIRST
25553!:strength -30
255544	belong	0x00000010		GLS_BINARY_MSB_FIRST
25555!:strength -30
25556
25557# Performance Co-Pilot file types
255580	string	PmNs				PCP compiled namespace (V.0)
255590	string	PmN				PCP compiled namespace
25560>3	string	>\0				(V.%1.1s)
25561#3	lelong	0x84500526			PCP archive
255623	belong	0x84500526			PCP archive
25563>7	byte	x				(V.%d)
25564#>20	lelong	-2				temporal index
25565#>20	lelong	-1				metadata
25566#>20	lelong	0				log volume #0
25567#>20	lelong	>0				log volume #%d
25568>20	belong	-2				temporal index
25569>20	belong	-1				metadata
25570>20	belong	0				log volume #0
25571>20	belong	>0				log volume #%d
25572>24	string	>\0				host: %s
255730	string	PCPFolio			PCP
25574>9	string	Version:			Archive Folio
25575>18	string	>\0				(V.%s)
255760	string	#pmchart			PCP pmchart view
25577>9	string	Version
25578>17	string	>\0				(V%-3.3s)
255790	string	#kmchart			PCP kmchart view
25580>9	string	Version
25581>17	string	>\0				(V.%s)
255820	string	pmview				PCP pmview config
25583>7	string	Version
25584>15	string	>\0				(V%-3.3s)
255850	string	#pmlogger			PCP pmlogger config
25586>10	string	Version
25587>18	string	>\0				(V%1.1s)
255880	string	#pmdahotproc			PCP pmdahotproc config
25589>13	string	Version
25590>21	string	>\0				(V%-3.3s)
255910	string	PcPh				PCP Help
25592>4	string	1				Index
25593>4	string	2				Text
25594>5	string	>\0				(V.%1.1s)
255950	string	#pmieconf-rules			PCP pmieconf rules
25596>16	string	>\0				(V.%1.1s)
255973	string	pmieconf-pmie			PCP pmie config
25598>17	string	>\0				(V.%1.1s)
255990	string	MMV				PCP memory mapped values
25600>4	long	x				(V.%d)
25601
25602# SpeedShop data files
256030	lelong	0x13130303			SpeedShop data file
25604
25605# mdbm files
256060	lelong	0x01023962			mdbm file, version 0 (obsolete)
256070	string	mdbm				mdbm file,
25608>5	byte	x				version %d,
25609>6	byte	x				2^%d pages,
25610>7	byte	x				pagesize 2^%d,
25611>17	byte	x				hash %d,
25612>11	byte	x				dataformat %d
25613
25614# Alias Maya files
256150	string/t	//Maya\040ASCII	Alias Maya Ascii File,
25616>13	string	>\0	version %s
256178	string	MAYAFOR4	Alias Maya Binary File,
25618>32	string	>\0	version %s scene
256198	string	MayaFOR4	Alias Maya Binary File,
25620>32	string	>\0	version %s scene
256218	string	CIMG		Alias Maya Image File
256228	string	DEEP		Alias Maya Image File
25623
25624#------------------------------------------------------------------------------
25625# $File: sgml,v 1.39 2019/04/19 00:42:27 christos Exp $
25626# Type:	SVG Vectorial Graphics
25627# From:	Noel Torres <tecnico@ejerciciosresueltos.com>
256280	string		\<?xml\ version=
25629>14	regex		['"\ \t]*[0-9.]+['"\ \t]*
25630>>19	search/4096	\<svg			SVG Scalable Vector Graphics image
25631!:mime	image/svg+xml
25632>>19	search/4096	\<gnc-v2		GnuCash file
25633!:mime	application/x-gnucash
256340	string		\<svg			SVG Scalable Vector Graphics image
25635!:mime	image/svg
25636
25637# Sitemap file
256380	string/t		\<?xml\ version=
25639>14	regex		['"\ \t]*[0-9.]+['"\ \t]*
25640>>19	search/4096	\<urlset		XML Sitemap document text
25641!:mime	application/xml-sitemap
25642
25643# OpenStreetMap XML (.osm)
25644# https://wiki.openstreetmap.org/wiki/OSM_XML
25645# From: Markus Heidelberg <markus.heidelberg@web.de>
256460	string		\<?xml\ version=
25647>14	regex		['"\ \t]*[0-9.]+['"\ \t]*
25648>>19	search/4096	\<osm			OpenStreetMap XML data
25649
25650# xhtml
256510	string/t		\<?xml\ version="
25652>19	search/4096/cWbt	\<!doctype\ html	XHTML document text
25653>>15	string		>\0	(version %.3s)
25654!:mime	text/html
256550	string/t		\<?xml\ version='
25656>19	search/4096/cWbt	\<!doctype\ html	XHTML document text
25657>>15	string		>\0	(version %.3s)
25658!:mime	text/html
256590	string/t		\<?xml\ version="
25660>19	search/4096/cWbt	\<html	broken XHTML document text
25661>>15	string		>\0	(version %.3s)
25662!:mime	text/html
25663
25664#------------------------------------------------------------------------------
25665# sgml:  file(1) magic for Standard Generalized Markup Language
25666# HyperText Markup Language (HTML) is an SGML document type,
25667# from Daniel Quinlan (quinlan@yggdrasil.com)
25668# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org)
256690	search/4096/cWt	\<!doctype\ html	HTML document text
25670!:mime	text/html
25671!:strength + 5
25672
25673# SVG document
25674# https://www.w3.org/TR/SVG/single-page.html
256750	search/4096/cWbt	\<!doctype\ svg	SVG XML document
25676!:mime  image/svg+xml
25677!:strength + 5
25678
256790	search/4096/cwt	\<head\>		HTML document text
25680!:mime	text/html
25681!:strength + 5
256820	search/4096/cWt	\<head\ 		HTML document text
25683!:mime	text/html
25684!:strength + 5
256850	search/4096/cwt	\<title\>		HTML document text
25686!:mime	text/html
25687!:strength + 5
256880	search/4096/cWt	\<title\ 		HTML document text
25689!:mime	text/html
25690!:strength + 5
256910	search/4096/cwt	\<html\>		HTML document text
25692!:mime	text/html
25693!:strength + 5
256940	search/4096/cWt	\<html\ 		HTML document text
25695!:mime	text/html
25696!:strength + 5
256970	search/4096/cwt	\<script\> 		HTML document text
25698!:mime	text/html
25699!:strength + 5
257000	search/4096/cWt	\<script\ 		HTML document text
25701!:mime	text/html
25702!:strength + 5
257030	search/4096/cwt	\<style\> 		HTML document text
25704!:mime	text/html
25705!:strength + 5
257060	search/4096/cWt	\<style\  		HTML document text
25707!:mime	text/html
25708!:strength + 5
257090	search/4096/cwt	\<table\>		HTML document text
25710!:mime	text/html
25711!:strength + 5
257120	search/4096/cWt	\<table\ 		HTML document text
25713!:mime	text/html
25714!:strength + 5
25715
257160	search/4096/cwt	\<a\ href=		HTML document text
25717!:mime	text/html
25718!:strength + 5
25719
25720# Extensible markup language (XML), a subset of SGML
25721# from Marc Prud'hommeaux (marc@apocalypse.org)
257220	search/1/cwt	\<?xml			XML document text
25723!:mime	text/xml
25724!:strength + 5
257250	string/t		\<?xml\ version\ "	XML
25726!:mime	text/xml
25727!:strength + 5
257280	string/t		\<?xml\ version="	XML
25729!:mime	text/xml
25730!:strength + 5
25731>15	string/t	>\0			%.3s document text
25732>>23	search/1	\<xsl:stylesheet	(XSL stylesheet)
25733>>24	search/1	\<xsl:stylesheet	(XSL stylesheet)
257340	string		\<?xml\ version='	XML
25735!:mime	text/xml
25736!:strength + 5
25737>15	string/t	>\0			%.3s document text
25738>>23	search/1	\<xsl:stylesheet	(XSL stylesheet)
25739>>24	search/1	\<xsl:stylesheet	(XSL stylesheet)
257400	search/1/wt	\<?XML			broken XML document text
25741!:mime	text/xml
25742!:strength - 10
25743
25744
25745# SGML, mostly from rph@sq
257460	search/4096/cwt	\<!doctype		exported SGML document text
257470	search/4096/cwt	\<!subdoc		exported SGML subdocument text
257480	search/4096/cwt	\<!--			exported SGML document text
25749!:strength - 10
25750
25751# Web browser cookie files
25752# (Mozilla, Galeon, Netscape 4, Konqueror..)
25753# Ulf Harnhammar <ulfh@update.uu.se>
257540	search/1	#\ HTTP\ Cookie\ File	Web browser cookie text
257550	search/1	#\ Netscape\ HTTP\ Cookie\ File	Netscape cookie text
257560	search/1	#\ KDE\ Cookie\ File	Konqueror cookie text
25757
25758# XML-based format representing braille pages in a digital format.
25759#
25760# Specification:
25761# http://files.pef-format.org/specifications/pef-2008-1/pef-specification.html
25762#
25763# Simon Aittamaa <simon.aittamaa@gmail.com>
257640   string      \<?xml\ version=
25765>14 regex       ['"\ \t]*[0-9.]+['"\ \t]*
25766>>19    search/4096 \<pef           Portable Embosser Format
25767!:mime  application/x-pef+xml
25768#------------------------------------------------------------------------
25769# $File: sharc,v 1.8 2017/03/17 21:35:28 christos Exp $
25770# file(1) magic for sharc files
25771#
25772# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
25773# FutureGroove Music (dsp@futuregroove.de)
25774
25775#------------------------------------------------------------------------
25776#0	string			Draw		RiscOS Drawfile
25777#0	string			PACK		RiscOS PackdDir archive
25778
25779#------------------------------------------------------------------------
25780# SHARC DSP stuff (based on the FGM SHARC DSP SDK)
25781
25782#0	string			=!		Assembler source
25783#0	string			Analog		ADi asm listing file
257840	string			.SYSTEM		SHARC architecture file
257850	string			.system		SHARC architecture file
25786
257870	leshort			0x521C		SHARC COFF binary
25788>2	leshort			>1		, %d sections
25789>>12	lelong			>0		, not stripped
25790
25791#------------------------------------------------------------------------------
25792# $File: sinclair,v 1.6 2015/11/14 13:38:35 christos Exp $
25793# sinclair:  file(1) sinclair QL
25794
25795# additions to /etc/magic by Thomas M. Ott (ThMO)
25796
25797# Sinclair QL floppy disk formats (ThMO)
257980	string	=QL5		QL disk dump data,
25799>3	string	=A		720 KB,
25800>3	string	=B		1.44 MB,
25801>3	string	=C		3.2 MB,
25802>4	string	>\0		label:%.10s
25803
25804# Sinclair QL OS dump (ThMO)
258050		belong	=0x30000
25806>49124		belong	<47104
25807>>49128		belong	<47104
25808>>>49132	belong	<47104
25809>>>>49136	belong	<47104	QL OS dump data,
25810>>>>>49148	string	>\0	type %.3s,
25811>>>>>49142	string	>\0	version %.4s
25812
25813# Sinclair QL firmware executables (ThMO)
258140	string	NqNqNq`\004	QL firmware executable (BCPL)
25815
25816# Sinclair QL libraries (was ThMO)
258170	beshort	0xFB01		QDOS object
25818>2	pstring	x		'%s'
25819
25820# Sinclair QL executables (was ThMO)
258214	belong	0x4AFB		QDOS executable
25822>9	pstring	x		'%s'
25823
25824# Sinclair QL ROM (ThMO)
258250	belong	=0x4AFB0001	QL plugin-ROM data,
25826>9	pstring	=\0		un-named
25827>9	pstring	>\0		named: %s
25828# Type: SiSU Markup Language
25829# URL:  http://www.sisudoc.org/
25830# From: Ralph Amissah <ralph.amissah@gmail.com>
25831
258320	regex	\^%?[\ \t]*SiSU[\ \t]+insert	SiSU text insert
25833>5	regex	[0-9.]+				%s
25834
258350	regex	\^%[\ \t]+SiSU[\ \t]+master	SiSU text master
25836>5	regex	[0-9.]+				%s
25837
258380	regex	\^%?[\ \t]*SiSU[\ \t]+text	SiSU text
25839>5	regex	[0-9.]+				%s
25840
258410	regex	\^%?[\ \t]*SiSU[\ \t][0-9.]+	SiSU text
25842>5	regex	[0-9.]+				%s
25843
258440	regex	\^%*[\ \t]*sisu-[0-9.]+		SiSU text
25845>5	regex	[0-9.]+				%s
25846
25847#------------------------------------------------------------------------------
25848# $File: sketch,v 1.5 2017/03/17 21:35:28 christos Exp $
25849# Sketch Drawings: http://sketch.sourceforge.net/
25850# From: Edwin Mons <e@ik.nu>
258510	search/1	##Sketch	Sketch document text
25852
25853#-----------------------------------------------
25854# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $
25855# GNU Smalltalk image, starting at version 1.6.2
25856# From: catull_us@yahoo.com
25857#
258580	string	GSTIm\0\0	GNU SmallTalk
25859# little-endian
25860>7	byte&1	=0		LE image version
25861>>10	byte	x		%d.
25862>>9	byte	x		\b%d.
25863>>8	byte	x		\b%d
25864#>>12	lelong	x		, data: %ld
25865#>>16	lelong	x		, table: %ld
25866#>>20	lelong	x		, memory: %ld
25867# big-endian
25868>7	byte&1	=1		BE image version
25869>>8	byte	x		%d.
25870>>9	byte	x		\b%d.
25871>>10	byte	x		\b%d
25872#>>12	belong	x		, data: %ld
25873#>>16	belong	x		, table: %ld
25874#>>20	belong	x		, memory: %ld
25875
25876
25877
25878#------------------------------------------------------------------------------
25879# $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $
25880# smile:  file(1) magic for Smile serialization
25881#
25882# The Smile serialization format uses a 4-byte header:
25883#
25884#   Constant byte #0: 0x3A (ASCII ':')
25885#   Constant byte #1: 0x29 (ASCII ')')
25886#   Constant byte #2: 0x0A (ASCII linefeed, '\n')
25887#   Variable byte #3, consisting of bits:
25888#     Bits 4-7 (4 MSB): 4-bit version number
25889#     Bits 3: Reserved
25890#     Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content
25891#     Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false
25892#     Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true
25893#
25894# Reference: http://wiki.fasterxml.com/SmileFormatSpec
25895# Created by: Pierre-Alexandre Meyer <pierre@mouraf.org>
25896
25897# Detection
258980	string		:)\n	Smile binary data
25899
25900# Versioning
25901>3	byte&0xF0	x		version %d:
25902
25903# Properties
25904>3	byte&0x04	0x04		binary raw,
25905>3	byte&0x04	0x00		binary encoded,
25906>3	byte&0x02	0x02		shared String values enabled,
25907>3	byte&0x02	0x00		shared String values disabled,
25908>3	byte&0x01	0x01		shared field names enabled
25909>3	byte&0x01	0x00		shared field names disabled
25910
25911
25912#------------------------------------------------------------------------------
25913# $File: sniffer,v 1.25 2019/05/05 17:03:41 christos Exp $
25914# sniffer:  file(1) magic for packet capture files
25915#
25916# From: guy@alum.mit.edu (Guy Harris)
25917#
25918
25919#
25920# Microsoft Network Monitor 1.x capture files.
25921#
259220	string		RTSS		NetMon capture file
25923>5	byte		x		- version %d
25924>4	byte		x		\b.%d
25925>6	leshort		0		(Unknown)
25926>6	leshort		1		(Ethernet)
25927>6	leshort		2		(Token Ring)
25928>6	leshort		3		(FDDI)
25929>6	leshort		4		(ATM)
25930>6	leshort		>4		(type %d)
25931
25932#
25933# Microsoft Network Monitor 2.x capture files.
25934#
259350	string		GMBU		NetMon capture file
25936>5	byte		x		- version %d
25937>4	byte		x		\b.%d
25938>6	leshort		0		(Unknown)
25939>6	leshort		1		(Ethernet)
25940>6	leshort		2		(Token Ring)
25941>6	leshort		3		(FDDI)
25942>6	leshort		4		(ATM)
25943>6	leshort		5		(IP-over-IEEE 1394)
25944>6	leshort		6		(802.11)
25945>6	leshort		7		(Raw IP)
25946>6	leshort		8		(Raw IP)
25947>6	leshort		9		(Raw IP)
25948>6	leshort		>9		(type %d)
25949
25950#
25951# Network General Sniffer capture files.
25952# Sorry, make that "Network Associates Sniffer capture files."
25953# Sorry, make that "Network General old DOS Sniffer capture files."
25954#
259550	string		TRSNIFF\040data\040\040\040\040\032	Sniffer capture file
25956>33	byte		2		(compressed)
25957>23	leshort		x		- version %d
25958>25	leshort		x		\b.%d
25959>32	byte		0		(Token Ring)
25960>32	byte		1		(Ethernet)
25961>32	byte		2		(ARCNET)
25962>32	byte		3		(StarLAN)
25963>32	byte		4		(PC Network broadband)
25964>32	byte		5		(LocalTalk)
25965>32	byte		6		(Znet)
25966>32	byte		7		(Internetwork Analyzer)
25967>32	byte		9		(FDDI)
25968>32	byte		10		(ATM)
25969
25970#
25971# Cinco Networks NetXRay capture files.
25972# Sorry, make that "Network General Sniffer Basic capture files."
25973# Sorry, make that "Network Associates Sniffer Basic capture files."
25974# Sorry, make that "Network Associates Sniffer Basic, and Windows
25975# Sniffer Pro", capture files."
25976# Sorry, make that "Network General Sniffer capture files."
25977# Sorry, make that "NetScout Sniffer capture files."
25978#
259790	string		XCP\0		NetXRay capture file
25980>4	string		>\0		- version %s
25981>44	leshort		0		(Ethernet)
25982>44	leshort		1		(Token Ring)
25983>44	leshort		2		(FDDI)
25984>44	leshort		3		(WAN)
25985>44	leshort		8		(ATM)
25986>44	leshort		9		(802.11)
25987
25988#
25989# "libpcap" capture files.
25990# https://www.tcpdump.org/manpages/pcap-savefile.5.html
25991# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
25992# the main program that uses that format, but there are other programs
25993# that use "libpcap", or that use the same capture file format.)
25994#
259950	name		pcap-be
25996>4	beshort		x		- version %d
25997>6	beshort		x		\b.%d
25998# clear that continuation level match
25999>20	clear		x
26000>20	belong		0		(No link-layer encapsulation
26001>20	belong		1		(Ethernet
26002>20	belong		2		(3Mb Ethernet
26003>20	belong		3		(AX.25
26004>20	belong		4		(ProNET
26005>20	belong		5		(CHAOS
26006>20	belong		6		(Token Ring
26007>20	belong		7		(BSD ARCNET
26008>20	belong		8		(SLIP
26009>20	belong		9		(PPP
26010>20	belong		10		(FDDI
26011>20	belong		11		(RFC 1483 ATM
26012>20	belong		12		(raw IP
26013>20	belong		13		(BSD/OS SLIP
26014>20	belong		14		(BSD/OS PPP
26015>20	belong		19		(Linux ATM Classical IP
26016>20	belong		50		(PPP or Cisco HDLC
26017>20	belong		51		(PPP-over-Ethernet
26018>20	belong		99		(Symantec Enterprise Firewall
26019>20	belong		100		(RFC 1483 ATM
26020>20	belong		101		(raw IP
26021>20	belong		102		(BSD/OS SLIP
26022>20	belong		103		(BSD/OS PPP
26023>20	belong		104		(BSD/OS Cisco HDLC
26024>20	belong		105		(802.11
26025>20	belong		106		(Linux Classical IP over ATM
26026>20	belong		107		(Frame Relay
26027>20	belong		108		(OpenBSD loopback
26028>20	belong		109		(OpenBSD IPsec encrypted
26029>20	belong		112		(Cisco HDLC
26030>20	belong		113		(Linux cooked v1
26031>20	belong		114		(LocalTalk
26032>20	belong		117		(OpenBSD PFLOG
26033>20	belong		119		(802.11 with Prism header
26034>20	belong		122		(RFC 2625 IP over Fibre Channel
26035>20	belong		123		(SunATM
26036>20	belong		127		(802.11 with radiotap header
26037>20	belong		129		(Linux ARCNET
26038>20	belong		130		(Juniper Multi-Link PPP
26039>20	belong		131		(Juniper Multi-Link Frame Relay
26040>20	belong		132		(Juniper Encryption Services PIC
26041>20	belong		133		(Juniper GGSN PIC
26042>20	belong		134		(Juniper FRF.16 Frame Relay
26043>20	belong		135		(Juniper ATM2 PIC
26044>20	belong		136		(Juniper Advanced Services PIC
26045>20	belong		137		(Juniper ATM1 PIC
26046>20	belong		138		(Apple IP over IEEE 1394
26047>20	belong		139		(SS7 MTP2 with pseudo-header
26048>20	belong		140		(SS7 MTP2
26049>20	belong		141		(SS7 MTP3
26050>20	belong		142		(SS7 SCCP
26051>20	belong		143		(DOCSIS
26052>20	belong		144		(Linux IrDA
26053>20	belong		147		(Private use 0
26054>20	belong		148		(Private use 1
26055>20	belong		149		(Private use 2
26056>20	belong		150		(Private use 3
26057>20	belong		151		(Private use 4
26058>20	belong		152		(Private use 5
26059>20	belong		153		(Private use 6
26060>20	belong		154		(Private use 7
26061>20	belong		155		(Private use 8
26062>20	belong		156		(Private use 9
26063>20	belong		157		(Private use 10
26064>20	belong		158		(Private use 11
26065>20	belong		159		(Private use 12
26066>20	belong		160		(Private use 13
26067>20	belong		161		(Private use 14
26068>20	belong		162		(Private use 15
26069>20	belong		163		(802.11 with AVS header
26070>20	belong		164		(Juniper Passive Monitor PIC
26071>20	belong		165		(BACnet MS/TP
26072>20	belong		166		(PPPD
26073>20	belong		167		(Juniper PPPoE
26074>20	belong		168		(Juniper PPPoE/ATM
26075>20	belong		169		(GPRS LLC
26076>20	belong		170		(GPF-T
26077>20	belong		171		(GPF-F
26078>20	belong		174		(Juniper PIC Peer
26079>20	belong		175		(Ethernet with Endace ERF header
26080>20	belong		176		(Packet-over-SONET with Endace ERF header
26081>20	belong		177		(Linux LAPD
26082>20	belong		178		(Juniper Ethernet
26083>20	belong		179		(Juniper PPP
26084>20	belong		180		(Juniper Frame Relay
26085>20	belong		181		(Juniper C-HDLC
26086>20	belong		182		(FRF.16 Frame Relay
26087>20	belong		183		(Juniper Voice PIC
26088>20	belong		184		(Arinc 429
26089>20	belong		185		(Arinc 653 Interpartition Communication
26090>20	belong		186		(USB with FreeBSD header
26091>20	belong		187		(Bluetooth HCI H4
26092>20	belong		188		(802.16 MAC Common Part Sublayer
26093>20	belong		189		(Linux USB
26094>20	belong		190		(Controller Area Network (CAN) v. 2.0B
26095>20	belong		191		(802.15.4 with Linux padding
26096>20	belong		192		(PPI
26097>20	belong		193		(802.16 MAC Common Part Sublayer plus radiotap header
26098>20	belong		194		(Juniper Integrated Service Module
26099>20	belong		195		(802.15.4 with FCS
26100>20	belong		196		(SITA
26101>20	belong		197		(Endace ERF
26102>20	belong		198		(Ethernet with u10 Networks pseudo-header
26103>20	belong		199		(IPMB
26104>20	belong		200		(Juniper Secure Tunnel
26105>20	belong		201		(Bluetooth HCI H4 with pseudo-header
26106>20	belong		202		(AX.25 with KISS header
26107>20	belong		203		(LAPD
26108>20	belong		204		(PPP with direction pseudo-header
26109>20	belong		205		(Cisco HDLC with direction pseudo-header
26110>20	belong		206		(Frame Relay with direction pseudo-header
26111>20	belong		209		(Linux IPMB
26112>20	belong		215		(802.15.4 with non-ASK PHY header
26113>20	belong		216		(Linux evdev events
26114>20	belong		219		(MPLS with label as link-layer header
26115>20	belong		220		(Memory-mapped Linux USB
26116>20	belong		221		(DECT
26117>20	belong		222		(AOS Space Data Link protocol
26118>20	belong		223		(Wireless HART
26119>20	belong		224		(Fibre Channel FC-2
26120>20	belong		225		(Fibre Channel FC-2 with frame delimiters
26121>20	belong		226		(Solaris IPNET
26122>20	belong		227		(SocketCAN
26123>20	belong		228		(Raw IPv4
26124>20	belong		229		(Raw IPv6
26125>20	belong		230		(802.15.4 without FCS
26126>20	belong		231		(D-Bus messages
26127>20	belong		232		(Juniper Virtual Server
26128>20	belong		233		(Juniper SRX E2E
26129>20	belong		234		(Juniper Fibre Channel
26130>20	belong		235		(DVB-CI
26131>20	belong		236		(MUX27010
26132>20	belong		237		(STANAG 5066 D_PDUs
26133>20	belong		238		(Juniper ATM CEMIC
26134>20	belong		239		(Linux netfilter log messages
26135>20	belong		240		(Hilscher netAnalyzer
26136>20	belong		241		(Hilscher netAnalyzer with delimiters
26137>20	belong		242		(IP-over-Infiniband
26138>20	belong		243		(MPEG-2 Transport Stream packets
26139>20	belong		244		(ng4t ng40
26140>20	belong		245		(NFC LLCP
26141>20	belong		246		(Packet filter state syncing
26142>20	belong		247		(InfiniBand
26143>20	belong		248		(SCTP
26144>20	belong		249		(USB with USBPcap header
26145>20	belong		250		(Schweitzer Engineering Laboratories RTAC packets
26146>20	belong		251		(Bluetooth Low Energy air interface
26147>20	belong		252		(Wireshark Upper PDU export
26148>20	belong		253		(Linux netlink
26149>20	belong		254		(Bluetooth Linux Monitor
26150>20	belong		255		(Bluetooth Basic Rate/Enhanced Data Rate baseband packets
26151>20	belong		256		(Bluetooth Low Energy air interface with pseudo-header
26152>20	belong		257		(PROFIBUS data link layer
26153>20	belong		258		(Apple DLT_PKTAP
26154>20	belong		259		(Ethernet with 802.3 Clause 65 EPON preamble
26155>20	belong		260		(IPMI trace packets
26156>20	belong		261		(Z-Wave RF profile R1 and R2 packets
26157>20	belong		262		(Z-Wave RF profile R3 packets
26158>20	belong		263		(WattStopper Digital Lighting Mngmt/Legrand Nitoo Open Proto
26159>20	belong		264		(ISO 14443 messages
26160>20	belong		265		(IEC 62106 Radio Data System groups
26161>20	belong		266		(USB with Darwin header
26162>20	belong		267		(OpenBSD DLT_OPENFLOW
26163>20	belong		268		(IBM SDLC frames
26164>20	belong		269		(TI LLN sniffer frames
26165>20	belong		271		(Linux vsock
26166>20	belong		272		(Nordic Semiconductor Bluetooth LE sniffer frames
26167>20	belong		273		(Excentis XRA-31 DOCSIS 3.1 RF sniffer frames
26168>20	belong		274		(802.3br mPackets
26169>20	belong		275		(DisplayPort AUX channel monitoring data
26170>20	belong		276		(Linux cooked v2
26171>20	belong		278		(OpenVizsla USB
26172>20	belong		279		(Elektrobit High Speed Capture and Replay (EBHSCR)
26173>20	belong		281		(Broadcom tag
26174>20	belong		282		(Broadcom tag (prepended)
26175# print default match
26176>20	default		x
26177>>20	belong		x		(linktype#%u
26178>16	belong		x		\b, capture length %u)
26179
26180# packets time stamps in seconds and microseconds.
261810	ubelong		0xa1b2c3d4	pcap capture file, microseconds ts (big-endian)
26182!:mime	application/vnd.tcpdump.pcap
26183>0	use	pcap-be
261840	ulelong		0xa1b2c3d4	pcap capture file, microsecond ts (little-endian)
26185!:mime	application/vnd.tcpdump.pcap
26186>0	use	\^pcap-be
26187
26188# packets time stamps in seconds and nanoseconds.
261890	ubelong		0xa1b23c4d	pcap capture file, nanosecond ts (big-endian)
26190!:mime	application/vnd.tcpdump.pcap
26191>0	use	pcap-be
261920	ulelong		0xa1b23c4d	pcap capture file, nanosecond ts (little-endian)
26193!:mime	application/vnd.tcpdump.pcap
26194>0	use	\^pcap-be
26195
26196#
26197# "libpcap"-with-Alexey-Kuznetsov's-patches capture files.
26198#
261990	ubelong		0xa1b2cd34	pcap capture file, microsecond ts, extensions (big-endian)
26200>0	use	pcap-be
262010	ulelong		0xa1b2cd34	pcap capture file, microsecond ts, extensions (little-endian)
26202>0	use	\^pcap-be
26203
26204#
26205# "pcapng" capture files.
26206# https://github.com/pcapng/pcapng
26207# Pcapng files can contain multiple sections. Printing the endianness,
26208# snaplen, or other information from the first SHB may be misleading.
26209#
262100	ubelong		0x0a0d0d0a
26211>8	ubelong		0x1a2b3c4d	pcapng capture file
26212>>12	beshort		x		- version %d
26213>>14	beshort		x		\b.%d
262140	ulelong		0x0a0d0d0a
26215>8	ulelong		0x1a2b3c4d	pcapng capture file
26216>>12	leshort		x		- version %d
26217>>14	leshort		x		\b.%d
26218
26219#
26220# AIX "iptrace" capture files.
26221#
262220	string		iptrace\0401.0	AIX iptrace capture file
262230	string		iptrace\0402.0	AIX iptrace capture file
26224
26225#
26226# Novell LANalyzer capture files.
26227#
262280	leshort		0x1001		Novell LANalyzer capture file
262290	leshort		0x1007		Novell LANalyzer capture file
26230
26231#
26232# HP-UX "nettl" capture files.
26233#
262340	string		\x54\x52\x00\x64\x00	HP/UX nettl capture file
26235
26236#
26237# RADCOM WAN/LAN Analyzer capture files.
26238#
262390	string		\x42\xd2\x00\x34\x12\x66\x22\x88	RADCOM WAN/LAN Analyzer capture file
26240
26241#
26242# NetStumbler log files.  Not really packets, per se, but about as
26243# close as you can get.  These are log files from NetStumbler, a
26244# Windows program, that scans for 802.11b networks.
26245#
262460	string		NetS		NetStumbler log file
26247>8	lelong		x		\b, %d stations found
26248
26249#
26250# *Peek tagged capture files.
26251#
262520	string		\177ver		EtherPeek/AiroPeek/OmniPeek capture file
26253
26254#
26255# Visual Networks traffic capture files.
26256#
262570	string		\x05VNF		Visual Networks traffic capture file
26258
26259#
26260# Network Instruments Observer capture files.
26261#
262620	string		ObserverPktBuffe	Network Instruments Observer capture file
26263
26264#
26265# Files from Accellent Group's 5View products.
26266#
262670	string		\xaa\xaa\xaa\xaa	5View capture file
26268
26269#------------------------------------------------------------------------------
26270# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $
26271# softquad:  file(1) magic for SoftQuad Publishing Software
26272#
26273# Author/Editor and RulesBuilder
26274#
26275# XXX - byte order?
26276#
262770	string		\<!SQ\ DTD>	Compiled SGML rules file
26278>9	string		>\0		 Type %s
262790	string		\<!SQ\ A/E>	A/E SGML Document binary
26280>9	string		>\0		 Type %s
262810	string		\<!SQ\ STS>	A/E SGML binary styles file
26282>9	string		>\0		 Type %s
262830	short		0xc0de		Compiled PSI (v1) data
262840	short		0xc0da		Compiled PSI (v2) data
26285>3	string		>\0		(%s)
26286# Binary sqtroff font/desc files...
262870	short		0125252		SoftQuad DESC or font file binary
26288>2	short		>0		- version %d
26289# Bitmaps...
262900	search/1	SQ\ BITMAP1	SoftQuad Raster Format text
26291#0	string		SQ\ BITMAP2	SoftQuad Raster Format data
26292# sqtroff intermediate language (replacement for ditroff int. lang.)
262930	string		X\ 		SoftQuad troff Context intermediate
26294>2	string		495		for AT&T 495 laser printer
26295>2	string		hp		for Hewlett-Packard LaserJet
26296>2	string		impr		for IMAGEN imPRESS
26297>2	string		ps		for PostScript
26298
26299# From: Michael Piefel <piefel@debian.org>
26300# sqtroff intermediate language (replacement for ditroff int. lang.)
263010	string		X\ 495		SoftQuad troff Context intermediate for AT&T 495 laser printer
263020	string		X\ hp		SoftQuad troff Context intermediate for HP LaserJet
263030	string		X\ impr		SoftQuad troff Context intermediate for IMAGEN imPRESS
263040	string		X\ ps		SoftQuad troff Context intermediate for PostScript
26305
26306#------------------------------------------------------------------------------
26307# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $
26308# spec:  file(1) magic for SPEC raw results (*.raw, *.rsf)
26309#
26310# Cloyce D. Spradling <cloyce@headgear.org>
26311
263120	string	spec			SPEC
26313>4	string	.cpu			CPU
26314>>8	string	<:			\b%.4s
26315>>12	string	.			raw result text
26316
2631717	string	version=SPECjbb		SPECjbb
26318>32	string	<:			\b%.4s
26319>>37	string	<:			v%.4s raw result text
26320
263210	string	BEGIN\040SPECWEB	SPECweb
26322>13	string	<:			\b%.2s
26323>>15	string	_SSL			\b_SSL
26324>>>20	string	<:			v%.4s raw result text
26325>>16	string	<:			v%.4s raw result text
26326
26327#------------------------------------------------------------------------------
26328# $File: spectrum,v 1.8 2017/09/11 23:51:12 christos Exp $
26329# spectrum:  file(1) magic for Spectrum emulator files.
26330#
26331# John Elliott <jce@seasip.demon.co.uk>
26332
26333#
26334# Spectrum +3DOS header
26335#
263360       string          PLUS3DOS\032    Spectrum +3 data
26337>15     byte            0               - BASIC program
26338>15     byte            1               - number array
26339>15     byte            2               - character array
26340>15     byte            3               - memory block
26341>>16    belong          0x001B0040      (screen)
26342>15     byte            4               - Tasword document
26343>15     string          TAPEFILE        - ZXT tapefile
26344#
26345# Tape file. This assumes the .TAP starts with a Spectrum-format header,
26346# which nearly all will.
26347#
26348# Update: Sanity-check string contents to be printable.
26349#  -Adam Buchbinder <adam.buchbinder@gmail.com>
26350#
263510       string          \023\000\000
26352>4      string          >\0
26353>>4     string          <\177           Spectrum .TAP data "%-10.10s"
26354>>>3    byte            0               - BASIC program
26355>>>3    byte            1               - number array
26356>>>3    byte            2               - character array
26357>>>3    byte            3               - memory block
26358>>>>14  belong          0x001B0040      (screen)
26359
26360# The following three blocks are from pak21-spectrum@srcf.ucam.org
26361# TZX tape images
263620      string          ZXTape!\x1a     Spectrum .TZX data
26363>8     byte            x               version %d
26364>9     byte            x               \b.%d
26365
26366# RZX input recording files
263670      string          RZX!            Spectrum .RZX data
26368>4     byte            x               version %d
26369>5     byte            x               \b.%d
26370
26371# Floppy disk images
263720      string          MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data
263730      string          MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data
263740      string          EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data
263750      string          SINCLAIR        Spectrum .SCL Betadisk image
26376
26377# Hard disk images
263780      string          RS-IDE\x1a      Spectrum .HDF hard disk image
26379>7     byte            x               \b, version 0x%02x
26380
26381# SZX snapshots (fuse and spectaculator)
26382# Martin M. S. Pedersen <martin@linux.com>
26383# http://www.spectaculator.com/docs/zx-state/header.shtml
26384#
263850      string		ZXST	       zx-state snapshot
26386>4     byte		x	       version %d
26387>5     byte		x	       \b.%d
26388>>6    byte		0	       16k ZX Spectrum
26389>>6    byte		1	       48k ZX Spectrum/ZX Spectrum+
26390>>6    byte		2	       ZX Spectrum 128
26391>>6    byte		3	       ZX Spectrum +2
26392>>6    byte		4	       ZX Spectrum +2A/+2B
26393>>6    byte		5	       ZX Spectrum +3
26394>>6    byte		6	       ZX Spectrum +3e
26395>>6    byte		7	       Pentagon 128
26396>>6    byte		8	       Timex Sinclair TC2048
26397>>6    byte		9	       Timex Sinclair TC2068
26398>>6    byte	       10	       Scorpion ZS-256
26399>>6    byte	       11	       ZX Spectrum SE
26400>>6    byte	       12	       Timex Sinclair TS2068
26401>>6    byte	       13	       Pentagon 512
26402>>6    byte	       14	       Pentagon 1024
26403>>6    byte	       15	       48k ZX Spectrum (NTSC)
26404>>6    byte	       16	       ZX Spectrum 12Ke
26405>>>7   byte		1	       (alternate timings)
26406
26407#------------------------------------------------------------------------------
26408# $File: sql,v 1.22 2019/04/19 00:42:27 christos Exp $
26409# sql:  file(1) magic for SQL files
26410#
26411# From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
26412# Recognize some MySQL files.
26413# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures
26414# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic
26415#
264160	beshort			0xfe01		MySQL table definition file
26417>2	byte			x		Version %d
26418>3	byte			0		\b, type UNKNOWN
26419>3	byte			1		\b, type DIAM_ISAM
26420>3	byte			2		\b, type HASH
26421>3	byte			3		\b, type MISAM
26422>3	byte			4		\b, type PISAM
26423>3	byte			5		\b, type RMS_ISAM
26424>3	byte			6		\b, type HEAP
26425>3	byte			7		\b, type ISAM
26426>3	byte			8		\b, type MRG_ISAM
26427>3	byte			9		\b, type MYISAM
26428>3	byte			10		\b, type MRG_MYISAM
26429>3	byte			11		\b, type BERKELEY_DB
26430>3	byte			12		\b, type INNODB
26431>3	byte			13		\b, type GEMINI
26432>3	byte			14		\b, type NDBCLUSTER
26433>3	byte			15		\b, type EXAMPLE_DB
26434>3	byte			16		\b, type CSV_DB
26435>3	byte			17		\b, type FEDERATED_DB
26436>3	byte			18		\b, type BLACKHOLE_DB
26437>3	byte			19		\b, type PARTITION_DB
26438>3	byte			20		\b, type BINLOG
26439>3	byte			21		\b, type SOLID
26440>3	byte			22		\b, type PBXT
26441>3	byte			23		\b, type TABLE_FUNCTION
26442>3	byte			24		\b, type MEMCACHE
26443>3	byte			25		\b, type FALCON
26444>3	byte			26		\b, type MARIA
26445>3	byte			27		\b, type PERFORMANCE_SCHEMA
26446>3	byte			127		\b, type DEFAULT
26447>0x0033	ulong			x		\b, MySQL version %d
264480	belong&0xffffff00	0xfefe0500	MySQL ISAM index file
26449>3	byte			x		Version %d
264500	belong&0xffffff00	0xfefe0600	MySQL ISAM compressed data file
26451>3	byte			x		Version %d
264520	belong&0xffffff00	0xfefe0700	MySQL MyISAM index file
26453>3	byte			x		Version %d
26454>14	beshort			x		\b, %d key parts
26455>16	beshort			x		\b, %d unique key parts
26456>18	byte			x		\b, %d keys
26457>28	bequad			x		\b, %lld records
26458>36	bequad			x		\b, %lld deleted records
264590	belong&0xffffff00	0xfefe0800	MySQL MyISAM compressed data file
26460>3	byte			x		Version %d
264610	belong&0xffffff00	0xfefe0900	MySQL Maria index file
26462>3	byte			x		Version %d
264630	belong&0xffffff00	0xfefe0a00	MySQL Maria compressed data file
26464>3	byte			x		Version %d
264650	belong&0xffffff00	0xfefe0c00
26466>4	string			MACF		MySQL Maria control file
26467>>3	byte			x		Version %d
264680	string			\376bin	MySQL replication log,
26469>9	long			x		server id %d
26470>8	byte			1
26471>>13	long			69		\b, MySQL V3.2.3
26472>>>19	string			x		\b, server version %s
26473>>13	long			75		\b, MySQL V4.0.2-V4.1
26474>>>25	string			x		\b, server version %s
26475>8	byte			15		MySQL V5+,
26476>>25	string			x		server version %s
26477>4	string			MARIALOG	MySQL Maria transaction log file
26478>>3	byte			x		Version %d
26479
26480#------------------------------------------------------------------------------
26481# iRiver H Series database file
26482# From Ken Guest <ken@linux.ie>
26483# As observed from iRivNavi.iDB and unencoded firmware
26484#
264850   string		iRivDB	iRiver Database file
26486>11  string	>\0	Version %s
26487>39  string		iHP-100	[H Series]
26488
26489#------------------------------------------------------------------------------
26490# SQLite database files
26491# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg
26492#
26493# Version 1 used GDBM internally; its files cannot be distinguished
26494# from other GDBM files.
26495#
26496# Version 2 used this format:
264970	string	**\ This\ file\ contains\ an\ SQLite  SQLite 2.x database
26498
26499# Version 3 of SQLite allows applications to embed their own "user version"
26500# number in the database at offset 60.  Later, SQLite added an "application id"
26501# at offset 68 that is preferred over "user version" for indicating the
26502# associated application.
26503#
265040   string  SQLite\ format\ 3	SQLite 3.x database
26505!:mime	application/x-sqlite3
26506# seldom found extension sqlite3 like in SyncData.sqlite3
26507# db
26508# Avira Antivir use extension "dbe" like in avevtdb.dbe, avguard_tchk.dbe
26509# Unfortunately extension sqlite also used for other databases starting with string
26510# "TTCONTAINER" like in tracks.sqlite contentconsumer.sqlite contentproducerrepository.sqlite
26511# and with string "ZV-zlib" in like extra.sqlite
26512!:ext sqlite/sqlite3/db/dbe
26513>60 belong  =0x5f4d544e  (Monotone source repository)
26514>68 belong  =0x0f055112  (Fossil checkout)
26515>68 belong  =0x0f055113  (Fossil global configuration)
26516>68 belong  =0x0f055111  (Fossil repository)
26517>68 belong  =0x42654462  (Bentley Systems BeSQLite Database)
26518>68 belong  =0x42654c6e  (Bentley Systems Localization File)
26519>68 belong  =0x47504b47  (OGC GeoPackage file)
26520>68 default x
26521>>68 belong  !0          \b, application id %u
26522>>60 belong  !0          \b, user version %d
26523>96 belong  x            \b, last written using SQLite version %d
26524
26525
26526# SQLite Write-Ahead Log from SQLite version >= 3.7.0
26527# https://www.sqlite.org/fileformat.html#walformat
265280	belong&0xfffffffe	0x377f0682	SQLite Write-Ahead Log,
26529!:ext sqlite-wal/db-wal
26530>4	belong	x	version %d
26531
26532# SQLite Rollback Journal
26533# https://www.sqlite.org/fileformat.html#rollbackjournal
265340	string	\xd9\xd5\x05\xf9\x20\xa1\x63\xd7	SQLite Rollback Journal
26535
26536# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek
26537# https://github.com/PredatH0r/ChanSort
265380	string		PSDB\0			Panasonic channel list DataBase
26539!:ext db/bin
26540#!:mime	application/x-db-svl-panasonic
26541>126	string		SQLite\ format\ 3
26542#!:mime	application/x-panasonic-sqlite3
26543>>&-15	indirect	x			\b; contains
26544
26545# H2 Database from https://www.h2database.com/
265460	string		--\ H2\ 0.5/B\ --\ \n	H2 Database file
26547# Type:	OpenSSH key files
26548# From:	Nicolas Collignon <tsointsoin@gmail.com>
26549
265500	string	SSH\ PRIVATE\ KEY	OpenSSH RSA1 private key,
26551>28	string	>\0			version %s
265520	string	-----BEGIN\ OPENSSH\ PRIVATE\ KEY-----	OpenSSH private key
26553
265540	string	ssh-dss\ 		OpenSSH DSA public key
265550	string	ssh-rsa\ 		OpenSSH RSA public key
265560	string	ecdsa-sha2-nistp256	OpenSSH ECDSA public key
265570	string	ecdsa-sha2-nistp384	OpenSSH ECDSA public key
265580	string	ecdsa-sha2-nistp521	OpenSSH ECDSA public key
265590	string	ssh-ed25519		OpenSSH ED25519 public key
26560
26561#------------------------------------------------------------------------------
26562# $File: ssl,v 1.5 2017/12/29 04:00:07 christos Exp $
26563# ssl:  file(1) magic for SSL file formats
26564
26565# Type: OpenSSL certificates/key files
26566# From: Nicolas Collignon <tsointsoin@gmail.com>
26567
265680	string	-----BEGIN\040CERTIFICATE-----	PEM certificate
265690	string	-----BEGIN\040CERTIFICATE\040REQ	PEM certificate request
265700	string	-----BEGIN\040RSA\040PRIVATE	PEM RSA private key
265710	string	-----BEGIN\040DSA\040PRIVATE	PEM DSA private key
265720	string	-----BEGIN\040EC\040PRIVATE	PEM EC private key
265730	string	-----BEGIN\040ECDSA\040PRIVATE	PEM ECDSA private key
26574
26575# From Luc Gommans
26576# OpenSSL enc file (recognized by a magic string preceding the password's salt)
265770	string	Salted__	openssl enc'd data with salted password
26578# Using the -a or -base64 option, OpenSSL will base64-encode the data.
265790	string U2FsdGVkX1	openssl enc'd data with salted password, base64 encoded
26580
26581#------------------------------------------------------------------------------
26582# $File: sun,v 1.28 2019/04/19 00:42:27 christos Exp $
26583# sun:  file(1) magic for Sun machines
26584#
26585# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
26586# releases.  (5.x uses ELF.)  Entries for executables without an
26587# architecture type, used before the 68020-based Sun-3's came out,
26588# are in aout, as they're indistinguishable from other big-endian
26589# 32-bit a.out files.
26590#
265910	belong&077777777	0600413		a.out SunOS SPARC demand paged
26592>0	byte		&0x80
26593>>20	belong		<4096		shared library
26594>>20	belong		=4096		dynamically linked executable
26595>>20	belong		>4096		dynamically linked executable
26596>0	byte		^0x80		executable
26597>16	belong		>0		not stripped
26598
265990	belong&077777777	0600410		a.out SunOS SPARC pure
26600>0	byte		&0x80		dynamically linked executable
26601>0	byte		^0x80		executable
26602>16	belong		>0		not stripped
26603
266040	belong&077777777	0600407		a.out SunOS SPARC
26605>0	byte		&0x80		dynamically linked executable
26606>0	byte		^0x80		executable
26607>16	belong		>0		not stripped
26608
266090	belong&077777777	0400413		a.out SunOS mc68020 demand paged
26610>0	byte		&0x80
26611>>20	belong		<4096		shared library
26612>>20	belong		=4096		dynamically linked executable
26613>>20	belong		>4096		dynamically linked executable
26614>0	byte		^0x80		executable
26615>16	belong		>0		not stripped
26616
266170	belong&077777777	0400410		a.out SunOS mc68020 pure
26618>0	byte		&0x80		dynamically linked executable
26619>0	byte		^0x80		executable
26620>16	belong		>0		not stripped
26621
266220	belong&077777777	0400407		a.out SunOS mc68020
26623>0	byte		&0x80		dynamically linked executable
26624>0	byte		^0x80		executable
26625>16	belong		>0		not stripped
26626
266270	belong&077777777	0200413		a.out SunOS mc68010 demand paged
26628>0	byte		&0x80
26629>>20	belong		<4096		shared library
26630>>20	belong		=4096		dynamically linked executable
26631>>20	belong		>4096		dynamically linked executable
26632>0	byte		^0x80		executable
26633>16	belong		>0		not stripped
26634
266350	belong&077777777	0200410		a.out SunOS mc68010 pure
26636>0	byte		&0x80		dynamically linked executable
26637>0	byte		^0x80		executable
26638>16	belong		>0		not stripped
26639
266400	belong&077777777	0200407		a.out SunOS mc68010
26641>0	byte		&0x80		dynamically linked executable
26642>0	byte		^0x80		executable
26643>16	belong		>0		not stripped
26644
26645#
26646# Core files.  "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
26647# binary executed in compatibility mode under SunOS 5.x".
26648#
266490	belong		0x080456	SunOS core file
26650>4	belong		432		(SPARC)
26651>>132	string		>\0		from '%s'
26652>>116	belong		=3		(quit)
26653>>116	belong		=4		(illegal instruction)
26654>>116	belong		=5		(trace trap)
26655>>116	belong		=6		(abort)
26656>>116	belong		=7		(emulator trap)
26657>>116	belong		=8		(arithmetic exception)
26658>>116	belong		=9		(kill)
26659>>116	belong		=10		(bus error)
26660>>116	belong		=11		(segmentation violation)
26661>>116	belong		=12		(bad argument to system call)
26662>>116	belong		=29		(resource lost)
26663>>120	belong		x		(T=%dK,
26664>>124	belong		x		D=%dK,
26665>>128	belong		x		S=%dK)
26666>4	belong		826		(68K)
26667>>128	string		>\0		from '%s'
26668>4	belong		456		(SPARC 4.x BCP)
26669>>152	string		>\0		from '%s'
26670# Sun SunPC
266710	long		0xfa33c08e	SunPC 4.0 Hard Disk
266720	string		#SUNPC_CONFIG	SunPC 4.0 Properties Values
26673# Sun snoop (see RFC 1761, which describes the capture file format,
26674# RFC 3827, which describes some additional datalink types, and
26675# https://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml,
26676# which is the IANA registry of Snoop datalink types)
26677#
266780	string		snoop		Snoop capture file
26679>8	belong		>0		- version %d
26680>12	belong		0		(IEEE 802.3)
26681>12	belong		1		(IEEE 802.4)
26682>12	belong		2		(IEEE 802.5)
26683>12	belong		3		(IEEE 802.6)
26684>12	belong		4		(Ethernet)
26685>12	belong		5		(HDLC)
26686>12	belong		6		(Character synchronous)
26687>12	belong		7		(IBM channel-to-channel adapter)
26688>12	belong		8		(FDDI)
26689>12	belong		9		(Other)
26690>12	belong		10		(type %d)
26691>12	belong		11		(type %d)
26692>12	belong		12		(type %d)
26693>12	belong		13		(type %d)
26694>12	belong		14		(type %d)
26695>12	belong		15		(type %d)
26696>12	belong		16		(Fibre Channel)
26697>12	belong		17		(ATM)
26698>12	belong		18		(ATM Classical IP)
26699>12	belong		19		(type %d)
26700>12	belong		20		(type %d)
26701>12	belong		21		(type %d)
26702>12	belong		22		(type %d)
26703>12	belong		23		(type %d)
26704>12	belong		24		(type %d)
26705>12	belong		25		(type %d)
26706>12	belong		26		(IP over Infiniband)
26707>12	belong		>26		(type %d)
26708
26709#---------------------------------------------------------------------------
26710# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a
26711# lead Sun/Cobalt developer) who agrees that they are good and worthy of
26712# inclusion.
26713
26714# Boot ROM images for Sun/Cobalt Linux server appliances
267150       string  Cobalt\ Networks\ Inc.\nFirmware\ v     Paged COBALT boot rom
26716>38     string x        V%.4s
26717
26718# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code
26719# at the very end where file(1) can't get it.
267200       string CRfs     COBALT boot rom data (Flat boot rom or file system)
26721
26722#------------------------------------------------------------------------------
26723# msx:  file(1) magic for the SymbOS operating system
26724# http://www.symbos.de
26725# Fabio R. Schmidlin <frs@pop.com.br>
26726
26727# SymbOS EXE file
267280x30	string		SymExe		SymbOS executable
26729>0x36	ubyte		x		v%c
26730>0x37	ubyte		x		\b.%c
26731>0xF	string		x		\b, name: %s
26732
26733# SymbOS DOX document
267340	string		INFOq\0		SymbOS DOX document
26735
26736# Symbos driver
267370	string		SMD1		SymbOS driver
26738>19	byte		x		\b, name: %c
26739>20	byte		x		\b%c
26740>21	byte		x		\b%c
26741>22	byte		x		\b%c
26742>23	byte		x		\b%c
26743>24	byte		x		\b%c
26744>25	byte		x		\b%c
26745>26	byte		x		\b%c
26746>27	byte		x		\b%c
26747>28	byte		x		\b%c
26748>29	byte		x		\b%c
26749>30	byte		x		\b%c
26750>31	byte		x		\b%c
26751
26752# Symbos video
267530	string		SymVid		SymbOS video
26754>6	ubyte		x		v%c
26755>7	ubyte		x		\b.%c
26756
26757# Soundtrakker 128 ST2 music
267580	byte		0
26759>0xC	string		\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x40\x00	Soundtrakker 128 ST2 music,
26760>>1	string		x		name: %s
26761
26762
26763
26764#------------------------------------------------------------------------
26765# $File: sysex,v 1.10 2019/04/19 00:42:27 christos Exp $
26766# sysex: file(1) magic for MIDI sysex files
26767#
26768# GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems
26769# where real SYStem EXclusive messages at offset 1 are limited to seven bits
26770# https://en.wikipedia.org/wiki/MIDI
267710	ubeshort&0xFF80		0xF000		SysEx File -
26772
26773# North American Group
26774>1	byte			0x01		Sequential
26775>1	byte			0x02		IDP
26776>1	byte			0x03		OctavePlateau
26777>1	byte			0x04		Moog
26778>1	byte			0x05		Passport
26779>1	byte			0x06		Lexicon
26780>1	byte			0x07		Kurzweil/Future Retro
26781>>3	byte			0x77		777
26782>>4	byte			0x00		Bank
26783>>4	byte			0x01		Song
26784>>5	byte			0x0f		16
26785>>5	byte			0x0e		15
26786>>5	byte			0x0d		14
26787>>5	byte			0x0c		13
26788>>5	byte			0x0b		12
26789>>5	byte			0x0a		11
26790>>5	byte			0x09		10
26791>>5	byte			0x08		9
26792>>5	byte			0x07		8
26793>>5	byte			0x06		7
26794>>5	byte			0x05		6
26795>>5	byte			0x04		5
26796>>5	byte			0x03		4
26797>>5	byte			0x02		3
26798>>5	byte			0x01		2
26799>>5	byte			0x00		1
26800>>5	byte			0x10		(ALL)
26801>>2	byte			x			\b, Channel %d
26802>1	byte			0x08		Fender
26803>1	byte			0x09		Gulbransen
26804>1	byte			0x0a		AKG
26805>1	byte			0x0b		Voyce
26806>1	byte			0x0c		Waveframe
26807>1	byte			0x0d		ADA
26808>1	byte			0x0e		Garfield
26809>1	byte			0x0f		Ensoniq
26810>1	byte			0x10		Oberheim
26811>>2	byte			0x06		Matrix 6 series
26812>>3	byte			0x0A		Dump (All)
26813>>3	byte			0x01		Dump (Bank)
26814>>4 belong			0x0002040E		Matrix 1000
26815>>>11 byte			<2			User bank %d
26816>>>11 byte			>1			Preset bank %d
26817>1	byte			0x11		Apple
26818>1	byte			0x12		GreyMatter
26819>1	byte			0x14		PalmTree
26820>1	byte			0x15		JLCooper
26821>1	byte			0x16		Lowrey
26822>1	byte			0x17		AdamsSmith
26823>1	byte			0x18		E-mu
26824>1	byte			0x19		Harmony
26825>1	byte			0x1a		ART
26826>1	byte			0x1b		Baldwin
26827>1	byte			0x1c		Eventide
26828>1	byte			0x1d		Inventronics
26829>1	byte			0x1f		Clarity
26830
26831# European Group
26832>1	byte			0x21		SIEL
26833>1	byte			0x22		Synthaxe
26834>1	byte			0x24		Hohner
26835>1	byte			0x25		Twister
26836>1	byte			0x26		Solton
26837>1	byte			0x27		Jellinghaus
26838>1	byte			0x28		Southworth
26839>1	byte			0x29		PPG
26840>1	byte			0x2a		JEN
26841>1	byte			0x2b		SSL
26842>1	byte			0x2c		AudioVertrieb
26843
26844>1	byte			0x2f		ELKA
26845>>3	byte			0x09		EK-44
26846
26847>1	byte			0x30		Dynacord
26848>1	byte			0x31		Jomox
26849>1	byte			0x33		Clavia
26850>1	byte			0x39		Soundcraft
26851# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs
26852>1	byte			0x3e		Waldorf
26853>>2	byte			0x00		microWave
26854>>2	byte			0x0E		microwave2 / XT
26855>>2	byte			0x0F		Q / Q+
26856>>3	byte			=0			(default id)
26857>>3 byte			>0			(
26858>>>3 byte			<0x7F		\bdevice %d)
26859>>>3 byte			=0x7F		\bbroadcast id)
26860>>3	byte			0x7f		Microwave I
26861>>>4	byte			0x00		SNDR (Sound Request)
26862>>>4	byte			0x10		SNDD (Sound Dump)
26863>>>4	byte			0x20		SNDP (Sound Parameter Change)
26864>>>4	byte			0x30		SNDQ (Sound Parameter Inquiry)
26865>>>4	byte			0x70		BOOT (Sound Reserved)
26866>>>4	byte			0x01		MULR (Multi Request)
26867>>>4	byte			0x11		MULD (Multi Dump)
26868>>>4	byte			0x21		MULP (Multi Parameter Change)
26869>>>4	byte			0x31		MULQ (Multi Parameter Inquiry)
26870>>>4	byte			0x71		OS (Multi Reserved)
26871>>>4	byte			0x02		DRMR (Drum Map Request)
26872>>>4	byte			0x12		DRMD (Drum Map Dump)
26873>>>4	byte			0x22		DRMP (Drum Map Parameter Change)
26874>>>4	byte			0x32		DRMQ (Drum Map Parameter Inquiry)
26875>>>4	byte			0x72		BIN (Drum Map Reserved)
26876>>>4	byte			0x03		PATR (Sequencer Pattern Request)
26877>>>4	byte			0x13		PATD (Sequencer Pattern Dump)
26878>>>4	byte			0x23		PATP (Sequencer Pattern Parameter Change)
26879>>>4	byte			0x33		PATQ (Sequencer Pattern Parameter Inquiry)
26880>>>4	byte			0x73		AFM (Sequencer Pattern Reserved)
26881>>>4	byte			0x04		GLBR (Global Parameter Request)
26882>>>4	byte			0x14		GLBD (Global Parameter Dump)
26883>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
26884>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
26885>>>4	byte			0x07		MODR (Mode Parameter Request)
26886>>>4	byte			0x17		MODD (Mode Parameter Dump)
26887>>>4	byte			0x27		MODP (Mode Parameter Parameter Change)
26888>>>4	byte			0x37		MODQ (Mode Parameter Parameter Inquiry)
26889>>2	byte			0x10		microQ
26890>>>4	byte			0x00		SNDR (Sound Request)
26891>>>4	byte			0x10		SNDD (Sound Dump)
26892>>>4	byte			0x20		SNDP (Sound Parameter Change)
26893>>>4	byte			0x30		SNDQ (Sound Parameter Inquiry)
26894>>>4	byte			0x70		(Sound Reserved)
26895>>>4	byte			0x01		MULR (Multi Request)
26896>>>4	byte			0x11		MULD (Multi Dump)
26897>>>4	byte			0x21		MULP (Multi Parameter Change)
26898>>>4	byte			0x31		MULQ (Multi Parameter Inquiry)
26899>>>4	byte			0x71		OS (Multi Reserved)
26900>>>4	byte			0x02		DRMR (Drum Map Request)
26901>>>4	byte			0x12		DRMD (Drum Map Dump)
26902>>>4	byte			0x22		DRMP (Drum Map Parameter Change)
26903>>>4	byte			0x32		DRMQ (Drum Map Parameter Inquiry)
26904>>>4	byte			0x72		BIN (Drum Map Reserved)
26905>>>4	byte			0x04		GLBR (Global Parameter Request)
26906>>>4	byte			0x14		GLBD (Global Parameter Dump)
26907>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
26908>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
26909>>2	byte			0x11		rackAttack
26910>>>4	byte			0x00		SNDR (Sound Parameter Request)
26911>>>4	byte			0x10		SNDD (Sound Parameter Dump)
26912>>>4	byte			0x20		SNDP (Sound Parameter Parameter Change)
26913>>>4	byte			0x30		SNDQ (Sound Parameter Parameter Inquiry)
26914>>>4	byte			0x01		PRGR (Program Parameter Request)
26915>>>4	byte			0x11		PRGD (Program Parameter Dump)
26916>>>4	byte			0x21		PRGP (Program Parameter Parameter Change)
26917>>>4	byte			0x31		PRGQ (Program Parameter Parameter Inquiry)
26918>>>4	byte			0x71		OS (Program Parameter Reserved)
26919>>>4	byte			0x03		PATR (Pattern Parameter Request)
26920>>>4	byte			0x13		PATD (Pattern Parameter Dump)
26921>>>4	byte			0x23		PATP (Pattern Parameter Parameter Change)
26922>>>4	byte			0x33		PATQ (Pattern Parameter Parameter Inquiry)
26923>>>4	byte			0x04		GLBR (Global Parameter Request)
26924>>>4	byte			0x14		GLBD (Global Parameter Dump)
26925>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
26926>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
26927>>>4	byte			0x05		EFXR (FX Parameter Request)
26928>>>4	byte			0x15		EFXD (FX Parameter Dump)
26929>>>4	byte			0x25		EFXP (FX Parameter Parameter Change)
26930>>>4	byte			0x35		EFXQ (FX Parameter Parameter Inquiry)
26931>>>4	byte			0x07		MODR (Mode Command Request)
26932>>>4	byte			0x17		MODD (Mode Command Dump)
26933>>>4	byte			0x27		MODP (Mode Command Parameter Change)
26934>>>4	byte			0x37		MODQ (Mode Command Parameter Inquiry)
26935>>2	byte			0x03		Wave
26936>>>4	byte			0x00		SBPR (Soundprogram)
26937>>>4	byte			0x01		SAPR (Performance)
26938>>>4	byte			0x02		SWAVE (Wave)
26939>>>4	byte			0x03		SWTBL (Wave control table)
26940>>>4	byte			0x04		SVT (Velocity Curve)
26941>>>4	byte			0x05		STT (Tuning Table)
26942>>>4	byte			0x06		SGLB (Global Parameters)
26943>>>4	byte			0x07		SARRMAP (Performance Program Change Map)
26944>>>4	byte			0x08		SBPRMAP (Sound Program Change Map)
26945>>>4	byte			0x09		SBPRPAR (Sound Parameter)
26946>>>4	byte			0x0A		SARRPAR (Performance Parameter)
26947>>>4	byte			0x0B		SINSPAR (Instrument/External Parameter)
26948>>>4	byte			0x0F		SBULK (Bulk Switch on/off)
26949
26950# Japanese Group
26951>1	byte			0x40		Kawai
26952>>3	byte			0x20		K1
26953>>3	byte			0x22		K4
26954
26955>1	byte			0x41		Roland
26956>>3	byte			0x14		D-50
26957>>3	byte			0x2b		U-220
26958>>3	byte			0x02		TR-707
26959
26960>1	byte			0x42		Korg
26961>>3	byte			0x19		M1
26962
26963>1	byte			0x43		Yamaha
26964>1	byte			0x44		Casio
26965>1	byte			0x46		Kamiya
26966>1	byte			0x47		Akai
26967>1	byte			0x48		Victor
26968>1	byte			0x49		Mesosha
26969>1	byte			0x4b		Fujitsu
26970>1	byte			0x4c		Sony
26971>1	byte			0x4e		Teac
26972>1	byte			0x50		Matsushita
26973>1	byte			0x51		Fostex
26974>1	byte			0x52		Zoom
26975>1	byte			0x54		Matsushita
26976>1	byte			0x57		Acoustic tech. lab.
26977# https://www.midi.org/techspecs/manid.php
26978>1	belong&0xffffff00	0x00007400	Ta Horng
26979>1	belong&0xffffff00	0x00007500	e-Tek
26980>1	belong&0xffffff00	0x00007600	E-Voice
26981>1	belong&0xffffff00	0x00007700	Midisoft
26982>1	belong&0xffffff00	0x00007800	Q-Sound
26983>1	belong&0xffffff00	0x00007900	Westrex
26984>1	belong&0xffffff00	0x00007a00	Nvidia*
26985>1	belong&0xffffff00	0x00007b00	ESS
26986>1	belong&0xffffff00	0x00007c00	Mediatrix
26987>1	belong&0xffffff00	0x00007d00	Brooktree
26988>1	belong&0xffffff00	0x00007e00	Otari
26989>1	belong&0xffffff00	0x00007f00	Key Electronics
26990>1	belong&0xffffff00	0x00010000	Shure
26991>1	belong&0xffffff00	0x00010100	AuraSound
26992>1	belong&0xffffff00	0x00010200	Crystal
26993>1	belong&0xffffff00	0x00010300	Rockwell
26994>1	belong&0xffffff00	0x00010400	Silicon Graphics
26995>1	belong&0xffffff00	0x00010500	Midiman
26996>1	belong&0xffffff00	0x00010600	PreSonus
26997>1	belong&0xffffff00	0x00010800	Topaz
26998>1	belong&0xffffff00	0x00010900	Cast Lightning
26999>1	belong&0xffffff00	0x00010a00	Microsoft
27000>1	belong&0xffffff00	0x00010b00	Sonic Foundry
27001>1	belong&0xffffff00	0x00010c00	Line 6
27002>1	belong&0xffffff00	0x00010d00	Beatnik Inc.
27003>1	belong&0xffffff00	0x00010e00	Van Koerving
27004>1	belong&0xffffff00	0x00010f00	Altech Systems
27005>1	belong&0xffffff00	0x00011000	S & S Research
27006>1	belong&0xffffff00	0x00011100	VLSI Technology
27007>1	belong&0xffffff00	0x00011200	Chromatic
27008>1	belong&0xffffff00	0x00011300	Sapphire
27009>1	belong&0xffffff00	0x00011400	IDRC
27010>1	belong&0xffffff00	0x00011500	Justonic Tuning
27011>1	belong&0xffffff00	0x00011600	TorComp
27012>1	belong&0xffffff00	0x00011700	Newtek Inc.
27013>1	belong&0xffffff00	0x00011800	Sound Sculpture
27014>1	belong&0xffffff00	0x00011900	Walker Technical
27015>1	belong&0xffffff00	0x00011a00	Digital Harmony
27016>1	belong&0xffffff00	0x00011b00	InVision
27017>1	belong&0xffffff00	0x00011c00	T-Square
27018>1	belong&0xffffff00	0x00011d00	Nemesys
27019>1	belong&0xffffff00	0x00011e00	DBX
27020>1	belong&0xffffff00	0x00011f00	Syndyne
27021>1	belong&0xffffff00	0x00012000	Bitheadz
27022>1	belong&0xffffff00	0x00012100	Cakewalk
27023>1	belong&0xffffff00	0x00012200	Staccato
27024>1	belong&0xffffff00	0x00012300	National Semicon.
27025>1	belong&0xffffff00	0x00012400	Boom Theory
27026>1	belong&0xffffff00	0x00012500	Virtual DSP Corp
27027>1	belong&0xffffff00	0x00012600	Antares
27028>1	belong&0xffffff00	0x00012700	Angel Software
27029>1	belong&0xffffff00	0x00012800	St Louis Music
27030>1	belong&0xffffff00	0x00012900	Lyrrus dba G-VOX
27031>1	belong&0xffffff00	0x00012a00	Ashley Audio
27032>1	belong&0xffffff00	0x00012b00	Vari-Lite
27033>1	belong&0xffffff00	0x00012c00	Summit Audio
27034>1	belong&0xffffff00	0x00012d00	Aureal Semicon.
27035>1	belong&0xffffff00	0x00012e00	SeaSound
27036>1	belong&0xffffff00	0x00012f00	U.S. Robotics
27037>1	belong&0xffffff00	0x00013000	Aurisis
27038>1	belong&0xffffff00	0x00013100	Nearfield Multimedia
27039>1	belong&0xffffff00	0x00013200	FM7 Inc.
27040>1	belong&0xffffff00	0x00013300	Swivel Systems
27041>1	belong&0xffffff00	0x00013400	Hyperactive
27042>1	belong&0xffffff00	0x00013500	MidiLite
27043>1	belong&0xffffff00	0x00013600	Radical
27044>1	belong&0xffffff00	0x00013700	Roger Linn
27045>1	belong&0xffffff00	0x00013800	Helicon
27046>1	belong&0xffffff00	0x00013900	Event
27047>1	belong&0xffffff00	0x00013a00	Sonic Network
27048>1	belong&0xffffff00	0x00013b00	Realtime Music
27049>1	belong&0xffffff00	0x00013c00	Apogee Digital
27050
27051>1	belong&0xffffff00	0x00202b00	Medeli Electronics
27052>1	belong&0xffffff00	0x00202c00	Charlie Lab
27053>1	belong&0xffffff00	0x00202d00	Blue Chip Music
27054>1	belong&0xffffff00	0x00202e00	BEE OH Corp
27055>1	belong&0xffffff00	0x00202f00	LG Semicon America
27056>1	belong&0xffffff00	0x00203000	TESI
27057>1	belong&0xffffff00	0x00203100	EMAGIC
27058>1	belong&0xffffff00	0x00203200	Behringer
27059>1	belong&0xffffff00	0x00203300	Access Music
27060>1	belong&0xffffff00	0x00203400	Synoptic
27061>1	belong&0xffffff00	0x00203500	Hanmesoft Corp
27062>1	belong&0xffffff00	0x00203600	Terratec
27063>1	belong&0xffffff00	0x00203700	Proel SpA
27064>1	belong&0xffffff00	0x00203800	IBK MIDI
27065>1	belong&0xffffff00	0x00203900	IRCAM
27066>1	belong&0xffffff00	0x00203a00	Propellerhead Software
27067>1	belong&0xffffff00	0x00203b00	Red Sound Systems
27068>1	belong&0xffffff00	0x00203c00	Electron ESI AB
27069>1	belong&0xffffff00	0x00203d00	Sintefex Audio
27070>1	belong&0xffffff00	0x00203e00	Music and More
27071>1	belong&0xffffff00	0x00203f00	Amsaro
27072>1	belong&0xffffff00	0x00204000	CDS Advanced Technology
27073>1	belong&0xffffff00	0x00204100	Touched by Sound
27074>1	belong&0xffffff00	0x00204200	DSP Arts
27075>1	belong&0xffffff00	0x00204300	Phil Rees Music
27076>1	belong&0xffffff00	0x00204400	Stamer Musikanlagen GmbH
27077>1	belong&0xffffff00	0x00204500	Soundart
27078>1	belong&0xffffff00	0x00204600	C-Mexx Software
27079>1	belong&0xffffff00	0x00204700	Klavis Tech.
27080>1	belong&0xffffff00	0x00204800	Noteheads AB
27081
270820	string			T707		Roland TR-707 Data
27083#------------------------------------------------------------------------------
27084# file:  file(1) magic for Tcl scripting language
27085# URL:  https://www.tcl.tk/
27086# From: gustaf neumann
27087
27088# Tcl scripts
270890	search/1/w	#!\ /usr/bin/tcl	Tcl script text executable
27090!:mime	text/x-tcl
270910	search/1/w	#!\ /usr/local/bin/tcl	Tcl script text executable
27092!:mime	text/x-tcl
270930	search/1	#!/usr/bin/env\ tcl	Tcl script text executable
27094!:mime	text/x-tcl
270950	search/1	#!\ /usr/bin/env\ tcl	Tcl script text executable
27096!:mime	text/x-tcl
270970	search/1/w	#!\ /usr/bin/wish	Tcl/Tk script text executable
27098!:mime	text/x-tcl
270990	search/1/w	#!\ /usr/local/bin/wish	Tcl/Tk script text executable
27100!:mime	text/x-tcl
271010	search/1	#!/usr/bin/env\ wish	Tcl/Tk script text executable
27102!:mime	text/x-tcl
271030	search/1	#!\ /usr/bin/env\ wish	Tcl/Tk script text executable
27104!:mime	text/x-tcl
27105
27106# check the first line
271070	search/1	package\ req
27108>0	regex		\^package[\ \t]+req	Tcl script
27109# not 'p', check other lines
271100	search/1	!p
27111>0	regex		\^package[\ \t]+req	Tcl script
27112
27113#------------------------------------------------------------------------------
27114# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $
27115# teapot:  file(1) magic for "teapot" spreadsheet
27116#
271170       string          #!teapot\012xdr      teapot work sheet (XDR format)
27118
27119#------------------------------------------------------------------------------
27120# $File: terminfo,v 1.11 2019/04/19 00:42:27 christos Exp $
27121# terminfo:  file(1) magic for terminfo
27122#
27123# URL: https://invisible-island.net/ncurses/man/term.5.html
27124# URL: https://invisible-island.net/ncurses/man/scr_dump.5.html
27125#
27126# Workaround for Targa image type by Joerg Jenderek
27127# GRR: line below too general as it catches also
27128# Targa image type 1 with 26 long identification field
27129# and HELP.DSK
271300	string		\032\001
27131# 5th character of terminal name list, but not Targa image pixel size (15 16 24 32)
27132>16	ubyte		>32
27133# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0.4.1"
27134>>12	regex		\^[a-zA-Z0-9][a-zA-Z0-9.][^|]*	Compiled terminfo entry "%-s"
27135!:mime	application/x-terminfo
27136# no extension
27137#!:ext
27138#
27139#------------------------------------------------------------------------------
27140# The following was added for ncurses6 development:
27141#------------------------------------------------------------------------------
27142#
271430	string		\036\002
27144# imitate the legacy compiled-format, to get the entry-name printed
27145>16	ubyte		>32
27146# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0. 4.1"
27147>>12	regex		\^[a-zA-Z0-9][a-zA-Z0-9.][^|]*	Compiled 32-bit terminfo entry "%-s"
27148!:mime	application/x-terminfo2
27149#
27150# While the compiled terminfo uses little-endian format irregardless of
27151# platform, SystemV screen dumps do not.  They came later, and that detail was
27152# overlooked.
27153#
27154# AIX and HPUX use the SVr4 big-endian format
27155# Solaris uses the SVr3 formats (sparc and x86 differ endian-ness)
271560	beshort		0433 		SVr2 curses screen image, big-endian
271570	beshort		0434		SVr3 curses screen image, big-endian
271580	beshort		0435		SVr4 curses screen image, big-endian
27159#
271600	leshort		0433		SVr2 curses screen image, little-endian
271610	leshort		0434		SVr3 curses screen image, little-endian
271620	leshort		0435		SVr4 curses screen image, little-endian
27163#
27164# Rather than SVr4, Solaris "xcurses" writes this header:
271650	regex		\^MAX=[0-9]+,[0-9]+$
27166>1	regex		\^BEG=[0-9]+,[0-9]+$
27167>2	regex		\^SCROLL=[0-9]+,[0-9]+$
27168>3	regex		\^VMIN=[0-9]+$
27169>4	regex		\^VTIME=[0-9]+$
27170>5	regex		\^FLAGS=0x[[:xdigit:]]+$
27171>6	regex		\^FG=[0-9],[0-9]+$
27172>7	regex		\^BG=[0-9]+,[0-9]+,	Solaris xcurses screen image
27173#
27174# ncurses5 (and before) did not use a magic number, making screen dumps "data".
27175# ncurses6 (2015) uses this format, ignoring byte-order
271760	string	\210\210\210\210ncurses	ncurses6 screen image
27177#
27178# PDCurses added this in 2005
271790	string		PDC\001		PDCurses screen image
27180
27181#------------------------------------------------------------------------------
27182# $File: tex,v 1.21 2019/04/19 00:42:27 christos Exp $
27183# tex:  file(1) magic for TeX files
27184#
27185# XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
27186#
27187# From <conklin@talisman.kaleida.com>
27188
27189# Although we may know the offset of certain text fields in TeX DVI
27190# and font files, we can't use them reliably because they are not
27191# zero terminated. [but we do anyway, christos]
271920	string		\367\002	TeX DVI file
27193!:mime	application/x-dvi
27194>16	string		>\0		(%s)
271950	string		\367\203	TeX generic font data
271960	string		\367\131	TeX packed font data
27197>3	string		>\0		(%s)
271980	string		\367\312	TeX virtual font data
271990	search/1	This\ is\ TeX,	TeX transcript text
272000	search/1	This\ is\ METAFONT,	METAFONT transcript text
27201
27202# There is no way to detect TeX Font Metric (*.tfm) files without
27203# breaking them apart and reading the data.  The following patterns
27204# match most *.tfm files generated by METAFONT or afm2tfm.
272052	string		\000\021	TeX font metric data
27206!:mime	application/x-tex-tfm
27207>33	string		>\0		(%s)
272082	string		\000\022	TeX font metric data
27209!:mime	application/x-tex-tfm
27210>33	string		>\0		(%s)
27211
27212# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
272130	search/1	\\input\ texinfo	Texinfo source text
27214!:mime	text/x-texinfo
272150	search/1	This\ is\ Info\ file	GNU Info text
27216!:mime	text/x-info
27217
27218# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
272190	search/4096	\\input		TeX document text
27220!:mime	text/x-tex
27221!:strength + 15
272220	search/4096	\\begin		LaTeX document text
27223!:mime	text/x-tex
27224!:strength + 15
272250	search/4096	\\section	LaTeX document text
27226!:mime	text/x-tex
27227!:strength + 18
272280	search/4096	\\setlength	LaTeX document text
27229!:mime	text/x-tex
27230!:strength + 15
272310	search/4096	\\documentstyle	LaTeX document text
27232!:mime	text/x-tex
27233!:strength + 18
272340	search/4096	\\chapter	LaTeX document text
27235!:mime	text/x-tex
27236!:strength + 18
272370	search/4096	\\documentclass	LaTeX 2e document text
27238!:mime	text/x-tex
27239!:strength + 15
272400	search/4096	\\relax		LaTeX auxiliary file
27241!:mime	text/x-tex
27242!:strength + 15
272430	search/4096	\\contentsline	LaTeX table of contents
27244!:mime	text/x-tex
27245!:strength + 15
272460	search/4096	%\ -*-latex-*-	LaTeX document text
27247!:mime	text/x-tex
27248
27249# Tex document, from Hendrik Scholz <hendrik@scholz.net>
272500   	search/1	\\ifx		TeX document text
27251
27252# Index and glossary files
272530	search/4096	\\indexentry	LaTeX raw index file
272540	search/4096	\\begin{theindex}	LaTeX sorted index
272550	search/4096	\\glossaryentry	LaTeX raw glossary
272560	search/4096	\\begin{theglossary}	LaTeX sorted glossary
272570	search/4096	This\ is\ makeindex	Makeindex log file
27258
27259# End of TeX
27260
27261#------------------------------------------------------------------------------
27262# file(1) magic for BibTex text files
27263# From Hendrik Scholz <hendrik@scholz.net>
27264
272650	search/1/c	@article{	BibTeX text file
272660	search/1/c	@book{		BibTeX text file
272670	search/1/c	@inbook{	BibTeX text file
272680	search/1/c	@incollection{	BibTeX text file
272690	search/1/c	@inproceedings{	BibTeX text file
272700	search/1/c	@manual{	BibTeX text file
272710	search/1/c	@misc{		BibTeX text file
272720	search/1/c	@preamble{	BibTeX text file
272730	search/1/c	@phdthesis{	BibTeX text file
272740	search/1/c	@techreport{	BibTeX text file
272750	search/1/c	@unpublished{	BibTeX text file
27276
2727773	search/1	%%%\ \ 		BibTeX-file{ BibTex text file (with full header)
27278
2727973	search/1	%%%\ \ @BibTeX-style-file{   BibTeX style text file (with full header)
27280
272810	search/1	%\ BibTeX\ standard\ bibliography\ 	BibTeX standard bibliography style text file
27282
272830	search/1	%\ BibTeX\ `	BibTeX custom bibliography style text file
27284
272850	search/1	@c\ @mapfile{	TeX font aliases text file
27286
272870	string		#LyX		LyX document text
27288
27289# ConTeXt documents
27290#	https://wiki.contextgarden.net/
272910	search/4096	\\setupcolors[		ConTeXt document text
27292!:strength + 15
272930	search/4096	\\definecolor[		ConTeXt document text
27294!:strength + 15
272950	search/4096	\\setupinteraction[	ConTeXt document text
27296!:strength + 15
272970	search/4096	\\useURL[		ConTeXt document text
27298!:strength + 15
272990	search/4096	\\setuppapersize[	ConTeXt document text
27300!:strength + 15
273010	search/4096	\\setuplayout[		ConTeXt document text
27302!:strength + 15
273030	search/4096	\\setupfooter[		ConTeXt document text
27304!:strength + 15
273050	search/4096	\\setupfootertexts[	ConTeXt document text
27306!:strength + 15
273070	search/4096	\\setuppagenumbering[	ConTeXt document text
27308!:strength + 15
273090	search/4096	\\setupbodyfont[	ConTeXt document text
27310!:strength + 15
273110	search/4096	\\setuphead[		ConTeXt document text
27312!:strength + 15
273130	search/4096	\\setupitemize[		ConTeXt document text
27314!:strength + 15
273150	search/4096	\\setupwhitespace[	ConTeXt document text
27316!:strength + 15
273170	search/4096	\\setupindenting[	ConTeXt document text
27318!:strength + 15
27319
27320#------------------------------------------------------------------------------
27321# $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $
27322# file(1) magic for tgif(1) files
27323# From Hendrik Scholz <hendrik@scholz.net>
273240	string	%TGIF\ 			Tgif file version
27325>6	string	x			%s
27326
27327#------------------------------------------------------------------------------
27328# $File: ti-8x,v 1.7 2014/04/30 21:41:02 christos Exp $
27329# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators.
27330#
27331# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us).
27332#
27333# Update: Romain Lievin (roms@lpg.ticalc.org).
27334#
27335# NOTE: This list is not complete.
27336# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the
27337# program/group magic numbers in here because I cannot find any.
273380		string		**TI80**	TI-80 Graphing Calculator File.
273390		string		**TI81**	TI-81 Graphing Calculator File.
27340#
27341# Magic Numbers for the TI-73
27342#
273430		string		**TI73**	TI-73 Graphing Calculator
27344>0x00003B	byte		0x00		(real number)
27345>0x00003B	byte		0x01		(list)
27346>0x00003B	byte		0x02		(matrix)
27347>0x00003B	byte		0x03		(equation)
27348>0x00003B	byte		0x04		(string)
27349>0x00003B	byte		0x05		(program)
27350>0x00003B	byte		0x06		(assembly program)
27351>0x00003B	byte		0x07		(picture)
27352>0x00003B	byte		0x08		(gdb)
27353>0x00003B	byte		0x0C		(complex number)
27354>0x00003B	byte		0x0F		(window settings)
27355>0x00003B	byte		0x10		(zoom)
27356>0x00003B	byte		0x11		(table setup)
27357>0x00003B	byte		0x13		(backup)
27358
27359# Magic Numbers for the TI-82
27360#
273610		string		**TI82**	TI-82 Graphing Calculator
27362>0x00003B	byte		0x00		(real)
27363>0x00003B	byte		0x01		(list)
27364>0x00003B	byte		0x02		(matrix)
27365>0x00003B	byte		0x03		(Y-variable)
27366>0x00003B	byte		0x05		(program)
27367>0x00003B	byte		0x06		(protected prgm)
27368>0x00003B	byte		0x07		(picture)
27369>0x00003B	byte		0x08		(gdb)
27370>0x00003B	byte		0x0B		(window settings)
27371>0x00003B	byte		0x0C		(window settings)
27372>0x00003B	byte		0x0D		(table setup)
27373>0x00003B	byte		0x0E		(screenshot)
27374>0x00003B	byte		0x0F		(backup)
27375#
27376# Magic Numbers for the TI-83
27377#
273780		string		**TI83**	TI-83 Graphing Calculator
27379>0x00003B	byte		0x00		(real)
27380>0x00003B	byte		0x01		(list)
27381>0x00003B	byte		0x02		(matrix)
27382>0x00003B	byte		0x03		(Y-variable)
27383>0x00003B	byte		0x04		(string)
27384>0x00003B	byte		0x05		(program)
27385>0x00003B	byte		0x06		(protected prgm)
27386>0x00003B	byte		0x07		(picture)
27387>0x00003B	byte		0x08		(gdb)
27388>0x00003B	byte		0x0B		(window settings)
27389>0x00003B	byte		0x0C		(window settings)
27390>0x00003B	byte		0x0D		(table setup)
27391>0x00003B	byte		0x0E		(screenshot)
27392>0x00003B	byte		0x13		(backup)
27393#
27394# Magic Numbers for the TI-83+
27395#
273960		string		**TI83F*	TI-83+ Graphing Calculator
27397>0x00003B	byte		0x00		(real number)
27398>0x00003B	byte		0x01		(list)
27399>0x00003B	byte		0x02		(matrix)
27400>0x00003B	byte		0x03		(equation)
27401>0x00003B	byte		0x04		(string)
27402>0x00003B	byte		0x05		(program)
27403>0x00003B	byte		0x06		(assembly program)
27404>0x00003B	byte		0x07		(picture)
27405>0x00003B	byte		0x08		(gdb)
27406>0x00003B	byte		0x0C		(complex number)
27407>0x00003B	byte		0x0F		(window settings)
27408>0x00003B	byte		0x10		(zoom)
27409>0x00003B	byte		0x11		(table setup)
27410>0x00003B	byte		0x13		(backup)
27411>0x00003B	byte		0x15		(application variable)
27412>0x00003B	byte		0x17		(group of variable)
27413
27414#
27415# Magic Numbers for the TI-85
27416#
274170		string		**TI85**	TI-85 Graphing Calculator
27418>0x00003B	byte		0x00		(real number)
27419>0x00003B	byte		0x01		(complex number)
27420>0x00003B	byte		0x02		(real vector)
27421>0x00003B	byte		0x03		(complex vector)
27422>0x00003B	byte		0x04		(real list)
27423>0x00003B	byte		0x05		(complex list)
27424>0x00003B	byte		0x06		(real matrix)
27425>0x00003B	byte		0x07		(complex matrix)
27426>0x00003B	byte		0x08		(real constant)
27427>0x00003B	byte		0x09		(complex constant)
27428>0x00003B	byte		0x0A		(equation)
27429>0x00003B	byte		0x0C		(string)
27430>0x00003B	byte		0x0D		(function GDB)
27431>0x00003B	byte		0x0E		(polar GDB)
27432>0x00003B	byte		0x0F		(parametric GDB)
27433>0x00003B	byte		0x10		(diffeq GDB)
27434>0x00003B	byte		0x11		(picture)
27435>0x00003B	byte		0x12		(program)
27436>0x00003B	byte		0x13		(range)
27437>0x00003B	byte		0x17		(window settings)
27438>0x00003B	byte		0x18		(window settings)
27439>0x00003B	byte		0x19		(window settings)
27440>0x00003B	byte		0x1A		(window settings)
27441>0x00003B	byte		0x1B		(zoom)
27442>0x00003B	byte		0x1D		(backup)
27443>0x00003B	byte		0x1E		(unknown)
27444>0x00003B	byte		0x2A		(equation)
27445>0x000032	string		ZS4		- ZShell Version 4 File.
27446>0x000032	string		ZS3		- ZShell Version 3 File.
27447#
27448# Magic Numbers for the TI-86
27449#
274500		string		**TI86**	TI-86 Graphing Calculator
27451>0x00003B	byte		0x00		(real number)
27452>0x00003B	byte		0x01		(complex number)
27453>0x00003B	byte		0x02		(real vector)
27454>0x00003B	byte		0x03		(complex vector)
27455>0x00003B	byte		0x04		(real list)
27456>0x00003B	byte		0x05		(complex list)
27457>0x00003B	byte		0x06		(real matrix)
27458>0x00003B	byte		0x07		(complex matrix)
27459>0x00003B	byte		0x08		(real constant)
27460>0x00003B	byte		0x09		(complex constant)
27461>0x00003B	byte		0x0A		(equation)
27462>0x00003B	byte		0x0C		(string)
27463>0x00003B	byte		0x0D		(function GDB)
27464>0x00003B	byte		0x0E		(polar GDB)
27465>0x00003B	byte		0x0F		(parametric GDB)
27466>0x00003B	byte		0x10		(diffeq GDB)
27467>0x00003B	byte		0x11		(picture)
27468>0x00003B	byte		0x12		(program)
27469>0x00003B	byte		0x13		(range)
27470>0x00003B	byte		0x17		(window settings)
27471>0x00003B	byte		0x18		(window settings)
27472>0x00003B	byte		0x19		(window settings)
27473>0x00003B	byte		0x1A		(window settings)
27474>0x00003B	byte		0x1B		(zoom)
27475>0x00003B	byte		0x1D		(backup)
27476>0x00003B	byte		0x1E		(unknown)
27477>0x00003B	byte		0x2A		(equation)
27478#
27479# Magic Numbers for the TI-89
27480#
274810		string		**TI89**	TI-89 Graphing Calculator
27482>0x000048	byte		0x00		(expression)
27483>0x000048	byte		0x04		(list)
27484>0x000048	byte		0x06		(matrix)
27485>0x000048	byte		0x0A		(data)
27486>0x000048	byte		0x0B		(text)
27487>0x000048	byte		0x0C		(string)
27488>0x000048	byte		0x0D		(graphic data base)
27489>0x000048	byte		0x0E		(figure)
27490>0x000048	byte		0x10		(picture)
27491>0x000048	byte		0x12		(program)
27492>0x000048	byte		0x13		(function)
27493>0x000048	byte		0x14		(macro)
27494>0x000048	byte		0x1C		(zipped)
27495>0x000048	byte		0x21		(assembler)
27496#
27497# Magic Numbers for the TI-92
27498#
274990		string		**TI92**	TI-92 Graphing Calculator
27500>0x000048	byte		0x00		(expression)
27501>0x000048	byte		0x04		(list)
27502>0x000048	byte		0x06		(matrix)
27503>0x000048	byte		0x0A		(data)
27504>0x000048	byte		0x0B		(text)
27505>0x000048	byte		0x0C		(string)
27506>0x000048	byte		0x0D		(graphic data base)
27507>0x000048	byte		0x0E		(figure)
27508>0x000048	byte		0x10		(picture)
27509>0x000048	byte		0x12		(program)
27510>0x000048	byte		0x13		(function)
27511>0x000048	byte		0x14		(macro)
27512>0x000048	byte		0x1D		(backup)
27513#
27514# Magic Numbers for the TI-92+/V200
27515#
275160		string		**TI92P*	TI-92+/V200 Graphing Calculator
27517>0x000048	byte		0x00		(expression)
27518>0x000048	byte		0x04		(list)
27519>0x000048	byte		0x06		(matrix)
27520>0x000048	byte		0x0A		(data)
27521>0x000048	byte		0x0B		(text)
27522>0x000048	byte		0x0C		(string)
27523>0x000048	byte		0x0D		(graphic data base)
27524>0x000048	byte		0x0E		(figure)
27525>0x000048	byte		0x10		(picture)
27526>0x000048	byte		0x12		(program)
27527>0x000048	byte		0x13		(function)
27528>0x000048	byte		0x14		(macro)
27529>0x000048	byte		0x1C		(zipped)
27530>0x000048	byte		0x21		(assembler)
27531#
27532# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades
27533#
275340x0000016	string		Advanced	TI-XX Graphing Calculator (FLASH)
275350		string		**TIFL**	TI-XX Graphing Calculator (FLASH)
27536>8		byte		>0		- Revision %d
27537>>9 		byte		x		\b.%d,
27538>12		byte		>0		Revision date %02x
27539>>13		byte		x		\b/%02x
27540>>14		beshort		x		\b/%04x,
27541>17		string		>/0		name: '%s',
27542>48		byte		0x74		device: TI-73,
27543>48		byte		0x73		device: TI-83+,
27544>48		byte		0x98		device: TI-89,
27545>48		byte		0x88		device: TI-92+,
27546>49		byte		0x23		type: OS upgrade,
27547>49		byte		0x24		type: application,
27548>49		byte		0x25		type: certificate,
27549>49		byte		0x3e		type: license,
27550>74		lelong		>0		size: %d bytes
27551
27552# VTi & TiEmu skins (TI Graphing Calculators).
27553# From: Romain Lievin (roms@lpg.ticalc.org).
27554# Magic Numbers for the VTi skins
275550               string          VTI		Virtual TI skin
27556>3		string		v		- Version
27557>>4		byte		>0		\b %c
27558>>6		byte		x		\b.%c
27559# Magic Numbers for the TiEmu skins
275600		string		TiEmu		TiEmu skin
27561>6              string          v               - Version
27562>>7             byte            >0              \b %c
27563>>9             byte            x               \b.%c
27564>>10		byte		x		\b%c
27565
27566#------------------------------------------------------------------------------
27567# $File: timezone,v 1.11 2009/09/19 16:28:12 christos Exp $
27568# timezone:  file(1) magic for timezone data
27569#
27570# from Daniel Quinlan (quinlan@yggdrasil.com)
27571# this should work on Linux, SunOS, and maybe others
27572# Added new official magic number for recent versions of the Olson code
275730	string	TZif	timezone data
27574>4	byte	0	\b, old version
27575>4	byte	>0	\b, version %c
27576>20	belong	0	\b, no gmt time flags
27577>20	belong	1	\b, 1 gmt time flag
27578>20	belong	>1	\b, %d gmt time flags
27579>24	belong	0	\b, no std time flags
27580>20	belong	1	\b, 1 std time flag
27581>24	belong	>1	\b, %d std time flags
27582>28	belong	0	\b, no leap seconds
27583>28	belong	1	\b, 1 leap second
27584>28	belong  >1	\b, %d leap seconds
27585>32	belong	0	\b, no transition times
27586>32	belong	1	\b, 1 transition time
27587>32	belong  >1	\b, %d transition times
27588>36	belong	0	\b, no abbreviation chars
27589>36	belong	1	\b, 1 abbreviation char
27590>36	belong	>1	\b, %d abbreviation chars
275910	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0	old timezone data
275920	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0	old timezone data
275930	string  \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0	old timezone data
275940	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0	old timezone data
275950	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0	old timezone data
275960	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0	old timezone data
27597
27598#------------------------------------------------------------------------------
27599# $File: tplink,v 1.4 2019/04/19 00:42:27 christos Exp $
27600# tplink: File magic for openwrt firmware files
27601
27602# URL: https://wiki.openwrt.org/doc/techref/header
27603# Reference: https://git.openwrt.org/?p=openwrt.git;a=blob;f=tools/firmware-utils/src/mktplinkfw.c
27604# From: Joerg Jenderek
27605# check for valid header version 1 or 2
276060		ulelong		<3
27607>0		ulelong		!0
27608# test for header padding with nulls
27609>>0x100		long		0
27610# skip Norton Commander Cleanup Utility NCCLEAN.INI by looking for valid vendor
27611>>>4		ubelong		>0x1F000000
27612>>>>0		use		firmware-tplink
27613
276140		name		firmware-tplink
27615>0		ubyte		x		firmware
27616!:mime application/x-tplink-bin
27617!:ext	bin
27618# hardware id like 10430001 07410001 09410004 09410006
27619>0x40		ubeshort	x		%x
27620>0x42		ubeshort	x		v%x
27621# hardware revision like 1
27622>0x44		ubelong		!1		(revision %u)
27623# vendor_name[24] like OpenWrt or TP-LINK Technologies
27624>4		string		x		%.24s
27625# fw_version[36] like r49389 or ver. 1.0
27626>0x1c		string		x		%.36s
27627# header version 1 or 2
27628>0		ubyte		!1		V%X
27629# ver_hi.ver_mid.ver_lo
27630>0x98		long		!0		\b, version
27631>>0x98		ubeshort	x		%u
27632>>0x9A		ubeshort	x		\b.%u
27633>>0x9C		ubeshort	x		\b.%u
27634# region code 0~universal 1~US
27635>0x48		ubelong		x
27636#>>0x48		ubelong		0		(universal)
27637>>0x48		ubelong		1		(US)
27638>>0x48		ubelong		>1		(region %u)
27639# total length of the firmware. not always true
27640>0x7C		ubelong		x		\b, %u bytes or less
27641# unknown 1
27642>0x48		ubelong		!0		\b, UNKNOWN1 0x%x
27643# md5sum1[16]
27644#>0x4c		ubequad		x		\b, MD5 %llx
27645#>>0x54		ubequad		x		\b%llx
27646# unknown 2
27647>0x5c		ubelong		!0		\b, UNKNOWN2 0x%x
27648# md5sum2[16]
27649#>0x60		ubequad		!0		\b, 2nd MD5 %llx
27650#>>0x68		ubequad		x		\b%llx
27651# unknown 3
27652>0x70		ubelong		!0		\b, UNKNOWN3 0x%x
27653# kernel load address
27654#>0x74		ubelong		x		\b, 0x%x load
27655# kernel entry point
27656#>0x78		ubelong		x		\b, 0x%x entry
27657# kernel data offset. 200h means direct after header
27658>0x80		ubelong		x		\b, at 0x%x
27659# kernel data length and 1 space
27660>0x84		ubelong		x		%u bytes
27661# look for kernel type (gzip compressed vmlinux.bin by ./compress)
27662>(0x80.L)	indirect	x
27663# root file system data offset
27664# WRONG in 5.35 with above indirect expression
27665>0x88		ubelong		x		\b, at 0x%x
27666# rootfs data length and 1 space
27667>0x8C		ubelong		x		%u bytes
27668# in 5.32 only true for offset ~< FILE_BYTES_MAX=9 MB defined in ../../src/file.h
27669>(0x88.L)	indirect	x
27670# 'qshs' for wr940nv1_en_3_13_7_up(111228).bin
27671#>(0x88.L)	string		x		\b, file system '%.4s'
27672#>(0x88.L)	ubequad		x		\b, file system 0x%llx
27673# bootloader data offset
27674>0x90		ubelong		!0		\b, at 0x%x
27675# bootloader data length only resonable if bootloader offset not null
27676>>0x94		ubelong		!0		%u bytes
27677# pad[354] should be 354 null bytes.
27678#>0x9E		ubequad		!0		\b, padding 0x%llx
27679# But at 0x120 18 non null bytes in examples like
27680# wr940nv4_eu_3_16_9_up_boot(160620).bin
27681# wr940nv6_us_3_18_1_up_boot(171030).bin
27682#>0x120		ubequad		!0		\b, other padding 0x%llx
27683
27684#------------------------------------------------------------------------------
27685# $File: troff,v 1.11 2014/06/03 19:01:34 christos Exp $
27686# troff:  file(1) magic for *roff
27687#
27688# updated by Daniel Quinlan (quinlan@yggdrasil.com)
27689
27690# troff input
276910	search/1	.\\"		troff or preprocessor input text
27692!:mime	text/troff
276930	search/1	'\\"		troff or preprocessor input text
27694!:mime	text/troff
276950	search/1	'.\\"		troff or preprocessor input text
27696!:mime	text/troff
276970	search/1	\\"		troff or preprocessor input text
27698!:mime	text/troff
276990	search/1	'''		troff or preprocessor input text
27700!:mime	text/troff
277010	regex/20l	\^\\.[A-Za-z0-9][A-Za-z0-9][\ \t]	troff or preprocessor input text
27702!:mime	text/troff
277030	regex/20l	\^\\.[A-Za-z0-9][A-Za-z0-9]$	troff or preprocessor input text
27704!:mime	text/troff
27705
27706# ditroff intermediate output text
277070	search/1	x\ T		ditroff output text
27708>4	search/1	cat		for the C/A/T phototypesetter
27709>4	search/1	ps		for PostScript
27710>4	search/1	dvi		for DVI
27711>4	search/1	ascii		for ASCII
27712>4	search/1	lj4		for LaserJet 4
27713>4	search/1	latin1		for ISO 8859-1 (Latin 1)
27714>4	search/1	X75		for xditview at 75dpi
27715>>7	search/1	-12		(12pt)
27716>4	search/1	X100		for xditview at 100dpi
27717>>8	search/1	-12		(12pt)
27718
27719# output data formats
277200	string		\100\357	very old (C/A/T) troff output data
27721
27722#------------------------------------------------------------------------------
27723# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $
27724# tuxedo:	file(1) magic for BEA TUXEDO data files
27725#
27726# from Ian Springer <ispringer@hotmail.com>
27727#
277280	string		\0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0	BEA TUXEDO DES mask data
27729
27730#------------------------------------------------------------------------------
27731# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $
27732# typeset:  file(1) magic for other typesetting
27733#
277340	string		Interpress/Xerox	Xerox InterPress data
27735>16	string		/			(version
27736>>17	string		>\0			%s)
27737
27738#------------------------------------------------------------------------------
27739# $File: unicode,v 1.7 2019/02/19 20:34:42 christos Exp $
27740# Unicode:  BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp>
27741# These types are recognised in file_ascmagic so these encodings can be
27742# treated by text patterns.  Missing types are already dealt with internally.
27743#
277440	string	+/v8			Unicode text, UTF-7
277450	string	+/v9			Unicode text, UTF-7
277460	string	+/v+			Unicode text, UTF-7
277470	string	+/v/			Unicode text, UTF-7
277480	string	\335\163\146\163	Unicode text, UTF-8-EBCDIC
277490	string	\000\000\376\377	Unicode text, UTF-32, big-endian
277500	string	\377\376\000\000	Unicode text, UTF-32, little-endian
277510	string	\016\376\377		Unicode text, SCSU (Standard Compression Scheme for Unicode)
27752
27753#------------------------------------------------------------------------------
27754# $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $
27755# unknown:  file(1) magic for unknown machines
27756#
27757# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11
27758# (executable, pure, and split I&D, respectively), but the PDP-11 version
27759# doesn't have the "version %ld", which may be a bogus COFFism (I don't
27760# think there was ever COFF for the PDP-11).
27761#
27762# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
27763# long, as it would be on a VAX.  In any case, that could collide with
27764# VAX demand-paged files, as the magic number is little-endian on those
27765# binaries, so the first 16 bits of the file would contain 0x10B.
27766#
27767# Therefore, those entries are commented out.
27768#
27769# 0x10C is 0414 and 0x10E is 0416; those *are* unknown.
27770#
27771#0	short		0x107		unknown machine executable
27772#>8	short		>0		not stripped
27773#>15	byte		>0		- version %ld
27774#0	short		0x108		unknown pure executable
27775#>8	short		>0		not stripped
27776#>15	byte		>0		- version %ld
27777#0	short		0x109		PDP-11 separate I&D
27778#>8	short		>0		not stripped
27779#>15	byte		>0		- version %ld
27780#0	short		0x10b		unknown pure executable
27781#>8	short		>0		not stripped
27782#>15	byte		>0		- version %ld
277830	long		0x10c		unknown demand paged pure executable
27784>16	long		>0		not stripped
277850	long		0x10e		unknown readable demand paged pure executable
27786
27787#------------------------------------------------------------------------------
27788# $File: uterus,v 1.3 2014/04/30 21:41:02 christos Exp $
27789# file(1) magic for uterus files
27790# http://freecode.com/projects/uterus
27791#
277920	string		UTE+	uterus file
27793>4	string		v	\b, version
27794>5	byte		x	%c
27795>6	string		.	\b.
27796>7	byte		x	\b%c
27797>8	string		\<\>	\b, big-endian
27798>>16	belong		>0	\b, slut size %u
27799>8	string		\>\<	\b, litte-endian
27800>>16	lelong		>0	\b, slut size %u
27801>10	byte		&8	\b, compressed
27802
27803#------------------------------------------------------------------------------
27804# $File: uuencode,v 1.7 2009/09/19 16:28:13 christos Exp $
27805# uuencode:  file(1) magic for ASCII-encoded files
27806#
27807
27808# GRR:  the first line of xxencoded files is identical to that in uuencoded
27809# files, but the first character in most subsequent lines is 'h' instead of
27810# 'M'.  (xxencoding uses lowercase letters in place of most of uuencode's
27811# punctuation and survives BITNET gateways better.)  If regular expressions
27812# were supported, this entry could possibly be split into two with
27813# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
278140	search/1	begin\ 		uuencoded or xxencoded text
27815
27816# btoa(1) is an alternative to uuencode that requires less space.
278170	search/1	xbtoa\ Begin	btoa'd text
27818
27819# ship(1) is another, much cooler alternative to uuencode.
27820# Greg Roelofs, newt@uchicago.edu
278210	search/1	$\012ship	ship'd binary text
27822
27823# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
27824# Greg Roelofs, newt@uchicago.edu
278250	search/1	Decode\ the\ following\ with\ bdeco	bencoded News text
27826
27827# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
27828# Daniel Quinlan, quinlan@yggdrasil.com
2782911	search/1	must\ be\ converted\ with\ BinHex	BinHex binary text
27830>41	search/1	x					\b, version %.3s
27831
27832# GRR: handle BASE64
27833
27834#------------------------------------------------------------------------------
27835# $File: vacuum-cleaner,v 1.1 2015/11/14 13:38:35 christos Exp $
27836# vacuum cleaner magic by Thomas M. Ott (ThMO)
27837#
27838# navigation map for LG robot vacuum cleaner models VR62xx, VR64xx, VR63xx
27839# file: MAPDATAyyyymmddhhmmss_xxxxxx_cc.blk
27840# -> yyyymmdd: year, month, day of cleaning
27841# -> hhmmss: hour, minute, second of cleaning
27842# -> xxxxxx: 6 digits
27843# -> cc: cleaning runs counter
27844# size: 136044 bytes
27845#
27846# struct maphdr {
27847#     int32_t  map_cnt;	     /*  0: single map */
27848#     int32_t  min_ceil;     /*  4: 100 mm == 10 cm == min. ceil */
27849#     int32_t  max_ceil;     /*  8: 10000 mm == 100 m == max. ceil */
27850#     int32_t  max_climb;    /* 12: 50 mm = 5 cm == max. height to climb */
27851#     int32_t  unknown;	     /* 16: 50000 ??? */
27852#     int32_t  cell_bytes;   /* 20: # of bytes for cells per block */
27853#     int32_t  block_max;    /* 24: 1000 == max. # of blocks */
27854#     int32_t  route_max;    /* 28: 1000 == max. # of routes */
27855#     int32_t  used_blocks;  /* 32: 5/45/33/... == # of block entries used! */
27856#     int32_t  cell_dim;     /* 36: 10 == cell dimension */
27857#     int32_t  clock_tick;   /* 40: 100 == clock ticks */
27858# #if	0
27859#     struct {		     /* 44: 1000 blocks for 10x10 cells */
27860#         int32_t  yoffset;
27861#         int32_t  xoffset;
27862#         int32_t  posxy;
27863#         int32_t  timecode;
27864#       }      blocks[ 1000];
27865#     char     cells[ 1000* 100]; /* 16044: 1000 10x10 cells */
27866#     int16_t  routes[ 1000* 10]; /* 116044: 1000 10-routes */
27867# #endif
27868#   };
27869
278700                lelong =1
27871>4               lelong =100
27872>>8              lelong =10000
27873>>>12            lelong =50
27874>>>>16           lelong =50000
27875>>>>>20          lelong =100
27876>>>>>>24         lelong =1000
27877>>>>>>>28        lelong =1000
27878>>>>>>>>36       lelong =10
27879>>>>>>>>>40      lelong =100
27880>>>>>>>>>>32     lelong x       LG robot VR6[234]xx %dm^2 navigation
27881>>>>>>>>>>136040 lelong =-1     reuse map data
27882>>>>>>>>>>136040 lelong =0      map data
27883>>>>>>>>>>136040 lelong >0      spurious map data
27884>>>>>>>>>>136040 lelong <-1     spurious map data
27885
27886
27887
27888#------------------------------------------------------------------------------
27889# $File: varied.out,v 1.23 2014/04/30 21:41:02 christos Exp $
27890# varied.out:  file(1) magic for various USG systems
27891#
27892#	Herewith many of the object file formats used by USG systems.
27893#	Most have been moved to files for a particular processor,
27894#	and deleted if they duplicate other entries.
27895#
278960	short		0610		Perkin-Elmer executable
27897# AMD 29K
278980	beshort		0572		amd 29k coff noprebar executable
278990	beshort		01572		amd 29k coff prebar executable
279000	beshort		0160007		amd 29k coff archive
27901# Cray
279026	beshort		0407		unicos (cray) executable
27903# Ultrix 4.3
27904596	string		\130\337\377\377	Ultrix core file
27905>600	string		>\0		from '%s'
27906# BeOS and MAcOS PEF executables
27907# From: hplus@zilker.net (Jon Watte)
279080	string		Joy!peffpwpc	header for PowerPC PEF executable
27909#
27910# ava assembler/linker Uros Platise <uros.platise@ijs.si>
279110       string          avaobj  AVR assembler object code
27912>7      string          >\0     version '%s'
27913# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr>
279140	string		gmon		GNU prof performance data
27915>4	long		x		- version %d
27916# From: Dave Pearson <davep@davep.org>
27917# Harbour <URL:http://harbour-project.org/> HRB files.
279180	string		\xc0HRB		Harbour HRB file
27919>4	leshort		x		version %d
27920# Harbour HBV files
279210	string		\xc0HBV		Harbour variable dump file
27922>4	leshort		x		version %d
27923
27924# From: Alex Beregszaszi <alex@fsn.hu>
27925# 0	string		exec 		BugOS executable
27926# 0	string		pack		BugOS archive
27927
27928# From: Jason Spence <jspence@lightconsulting.com>
27929# Generated by the "examples" in STM's ST40 devkit, and derived code.
279300	lelong		0x13a9f17e	ST40 component image format
27931>4	string		>\0		\b, name '%s'
27932
27933#------------------------------------------------------------------------------
27934# $File: varied.script,v 1.12 2019/04/19 00:42:27 christos Exp $
27935# varied.script:  file(1) magic for various interpreter scripts
27936
279370	string/t		#!\ /			a
27938>3	string		>\0			%s script text executable
27939
279400	string/b		#!\ /			a
27941>3	string		>\0			%s script executable (binary data)
27942
279430	string/t		#!\t/			a
27944>3	string		>\0			%s script text executable
27945
279460	string/b		#!\t/			a
27947>3	string		>\0			%s script executable (binary data)
27948
279490	string/t		#!/			a
27950>2	string		>\0			%s script text executable
27951
279520	string/b		#!/			a
27953>2	string		>\0			%s script executable (binary data)
27954
279550	string/t		#!\ 			script text executable
27956>3	string		>\0			for %s
27957
279580	string/b		#!\ 			script executable
27959>3	string		>\0			for %s (binary data)
27960
27961# using env
279620	string/t	#!/usr/bin/env		a
27963>15	string/t	>\0			%s script text executable
27964!:strength / 10
27965
279660	string/b	#!/usr/bin/env		a
27967>15	string/b	>\0			%s script executable (binary data)
27968!:strength / 10
27969
279700	string/t	#!\ /usr/bin/env	a
27971>16	string/t	>\0			%s script text executable
27972!:strength / 10
27973
279740	string/b	#!\ /usr/bin/env	a
27975>16	string/b	>\0			%s script executable (binary data)
27976!:strength / 10
27977
27978# From: arno <arenevier@fdn.fr>
27979# mozilla xpconnect typelib
27980# see https://www.mozilla.org/scriptable/typelib_file.html
279810	string 		XPCOM\nTypeLib\r\n\032		XPConnect Typelib
27982>0x10  byte        x       version %d
27983>>0x11 byte        x      \b.%d
27984
27985#------------------------------------------------------------------------------
27986# $File: vax,v 1.9 2014/04/30 21:41:02 christos Exp $
27987# vax:  file(1) magic for VAX executable/object and APL workspace
27988#
279890	lelong		0101557		VAX single precision APL workspace
279900	lelong		0101556		VAX double precision APL workspace
27991
27992#
27993# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian
27994# executables, and are handled in aout)
27995#
279960	lelong		0420		a.out VAX demand paged (first page unmapped) pure executable
27997>16	lelong		>0		not stripped
27998
27999#
28000# VAX COFF
28001#
28002# The `versions' were commented out, but have been un-commented out.
28003# (Was the problem just one of endianness?)
28004#
280050	leshort		0570		VAX COFF executable
28006>12	lelong		>0		not stripped
28007>22	leshort		>0		- version %d
280080	leshort		0575		VAX COFF pure executable
28009>12	lelong		>0		not stripped
28010>22	leshort		>0		- version %d
28011
28012#------------------------------------------------------------------------------
28013# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $
28014# vicar:  file(1) magic for VICAR files.
28015#
28016# From: Ossama Othman <othman@astrosun.tn.cornell.edu
28017# VICAR is JPL's in-house spacecraft image processing program
28018# VICAR image
280190	string	LBLSIZE=	VICAR image data
28020>32	string	BYTE		\b, 8 bits  = VAX byte
28021>32	string	HALF		\b, 16 bits = VAX word     = Fortran INTEGER*2
28022>32	string	FULL		\b, 32 bits = VAX longword = Fortran INTEGER*4
28023>32	string	REAL		\b, 32 bits = VAX longword = Fortran REAL*4
28024>32	string	DOUB		\b, 64 bits = VAX quadword = Fortran REAL*8
28025>32	string	COMPLEX		\b, 64 bits = VAX quadword = Fortran COMPLEX*8
28026# VICAR label file
2802743	string	SFDU_LABEL	VICAR label file
28028
28029#------------------------------------------------------------------------------
28030# $File: virtual,v 1.10 2019/04/19 00:42:27 christos Exp $
28031# From: James Nobis <quel@quelrod.net>
28032# Microsoft hard disk images for:
28033# Virtual Server
28034# Virtual PC
28035# VirtualBox
28036# URL: http://fileformats.archiveteam.org/wiki/VHD_(Virtual_Hard_Disk)
28037# Reference: https://download.microsoft.com/download/f/f/e/ffef50a5-07dd-4cf8-aaa3-442c0673a029/
28038# Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc
280390	string	conectix	Microsoft Disk Image, Virtual Server or Virtual PC
28040# alternative shorter names
28041#0	string	conectix	Microsoft Virtual Hard Disk image
28042#0	string	conectix	Microsoft Virtual HD image
28043!:mime	application/x-virtualbox-vhd
28044!:ext   vhd
28045# Features is a bit field used to indicate specific feature support
28046#>8	ubelong		!0x00000002	\b, Features 0x%x
28047# Reserved. This bit must always be set to 1.
28048#>8	ubelong		&0x00000002	\b, Reserved 0x%x
28049# File Format Version for the current specification 0x00010000
28050#>12	ubelong		!0x00010000	\b, Version 0x%8.8x
28051# Data Offset only found 0x200
28052#>16	ubequad		!0x200		\b, Data Offset 0x%llx
28053#>16	ubequad		x		\b, at 0x%llx
28054# Dynamic Disk Header cookie like cxsparse
28055#>(16.Q)	string		x		"%-.8s"
28056# This field contains a Unicode string (UTF-16) of the parent hard disk filename
28057#>(16.Q+64)	ubequad	x		\b, parent name 0x%llx
28058# Creator Application
28059# vpc~Microsoft Virtual PC, vs~Microsoft Virtual Server, vbox~VirtualBox, d2v~disk2vhd
28060>28	string		x		\b, Creator %-4.4s
28061# Creator Version: 0x00010000~Virtual Server 2004, 0x00050000~Virtual PC 2004
28062# holds the major/minor version of the application that created the image
28063>32	ubeshort	x		%x
28064>34	ubeshort	x		\b.%x
28065#>32	ubelong		x		\b, Version 0x%8.8x
28066# Creator Host OS: 0x5769326B~Windows (Wi2k), 0x4D616320~Macintosh (Mac)
28067>36	ubelong		x		(
28068>>36	ubelong		0x5769326B	\bW2k
28069>>36	ubelong		0x4D616320	\bMac
28070>>36	default		x		\b0x
28071>>>36	ubelong		x		\b%8.8x
28072# creation Time in seconds since 1 Jan 2000 UTC~946684800 sec. since Unix Epoch
28073>24	bedate+946684800	x	\b) %s
28074# Original Size
28075#>40	ubequad		x		\b, o.-Size 0x%llx
28076# Current Size is same as original size, but change when disk is expanded
28077#>48	ubequad		x		\b, Size 0x%llx
28078>48	ubequad		x		\b, %llu bytes
28079# Disk Geometry: cylinder, heads, and sectors/track for hard disk
28080#>56	ubeshort	x		\b, Cylinder 0x%x
28081>56	ubeshort	x		\b, CHS %u
28082# Heads
28083#>58	ubyte		x		\b, Heads 0x%x
28084>58	ubyte		x		\b/%u
28085# Sectors per track
28086#>59	ubyte		x		\b, Sectors 0x%x
28087>59	ubyte		x		\b/%u
28088# Disk Type: 3~Dynamic hard disk
28089>60	ubelong		!0x3		\b, type 0x%x
28090# Checksum
28091#>64	ubelong		x		\b, cksum 0x%x
28092# universally unique identifier (UUID) to associate a parent with its differencing image
28093#>68	ubequad		x		\b, id 0x%16.16llx
28094#>76	ubequad		x		\b-%16.16llx
28095# Saved State: 1~Saved State
28096>84	ubyte		!0		\b, State 0x%x
28097# Reserved 427 bytes with nils
28098#>85	ubequad	!0			\b, Reserved 0x%16.16llx
28099
28100# From: Joerg Jenderek
28101# URL: https://msdn.microsoft.com/en-us/library/mt740058.aspx
28102# Reference: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/
28103# MS-VHDX/[MS-VHDX].pdf
28104# Note: extends the VHD format with new capabilities, such as a 16TB maximum size
28105# TODO:	find and display values like virtual size, disk size, cluster_size, etc
28106#	display id in GUID format
28107#
28108# VHDX_FILE_IDENTIFIER signature 0x656C696678646876
281090	string			vhdxfile
28110# VHDX_HEADER signature. 1 header is stored at offset 64KB and the other at 128KB
28111>0x10000	string		head		Microsoft Disk Image eXtended
28112#>0x20000	string			head	\b, 2nd header
28113#!:mime	application/x-virtualbox-vhdx
28114!:ext	vhdx
28115# Creator[256] like "QEMU v3.0.0", "Microsoft Windows 6.3.9600.18512"
28116>>8		lestring16		x	\b, by %.256s
28117# The Checksum field is a CRC-32C hash over the entire 4 KB structure
28118#>>0x10004	ulelong			x	\b, CRC 0x%x
28119# SequenceNumber
28120>>0x10008	ulequad			x	\b, sequence 0x%llx
28121# FileWriteGuid
28122#>>0x10010	ubequad			x	\b, file id 0x%llx
28123#>>>0x10018	ubequad			x	\b-%llx
28124# DataWriteGuid
28125#>>0x10020	ubequad			x	\b, data id 0x%llx
28126#>>>0x10028	ubequad			x	\b-%llx
28127# LogGuid. If this field is zero, then the log is empty or has no valid entries
28128>>0x10030	ubequad			>0	\b, log id 0x%llx
28129>>>0x10038	ubequad			x	\b-%llx
28130# LogVersion. If not 0 there is a log to replay
28131>>0x10040	uleshort		>0	\b, LogVersion 0x%x
28132# Version. This field must be set to 1
28133>>0x10042	uleshort		!1	\b, Version 0x%x
28134# LogLength must be multiples of 1 MB
28135>>0x10044	ulelong/1048576		>1	\b, LogLength %u MB
28136# LogOffset (normally 0x100000 when log direct after header); multiples of 1 MB
28137>>0x10048	ulequad			!0x100000 \b, LogOffset 0x%llx
28138# Log Entry Signature must be 0x65676F6C~loge
28139>>(0x10048.q)	ulelong			!0x65676F6C \b, NO Log Signature
28140>>(0x10048.q)	ulelong			=0x65676F6C	\b; LOG
28141# Log Entry Checksum
28142#>>>(0x10048.q+4)	ulelong		x	\b, Log CRC 0x%x
28143# Log Entry Length must be a multiple of 4 KB
28144>>>(0x10048.q+8)	ulelong/1024	>4	\b, EntryLength %u KB
28145# Log Entry Tail must be a multiple of 4 KB
28146#>>>(0x10048.q+12)	ulelong		x	\b, Tail 0x%x
28147# Log Entry SequenceNumber
28148#>>>(0x10048.q+16)	ulequad		x	\b, # 0x%llx
28149# Log Entry DescriptorCount may be zero. only 4 bytes in other docs instead 8
28150#>>>(0x10048.q+24)	ulelong		x	\b, DescriptorCount 0x%llx
28151# Log Entry Reserved must be set to 0
28152>>>(0x10048.q+28)	ulelong		!0	\b, Reserved 0x%x
28153# Log Entry LogGuid
28154#>>>(0x10048.q+32)	ubequad		x	\b, Log id 0x%llx
28155#>>>(0x10048.q+40)	ubequad		x	\b-%llx
28156# Log Entry FlushedFileOffset should VHDX size when entry is written.
28157#>>>(0x10048.q+48)	ulequad		x	\b, FlushedFileOffset %llu
28158# Log Entry LastFileOffset
28159#>>>(0x10048.q+56)	ulequad		x	\b, LastFileOffset %llu
28160# filling
28161#>>>(0x10048.q+64)	ulequad		>0	\b, filling %llx
28162# Reserved[4016]
28163#>>0x10050	ulequad			>0	\b, Reserved 0x%llx
28164# VHDX_REGION_TABLE_HEADER Signature 0x69676572~regi at offset 192 KB and 256 KB
28165>0x30000	ulelong			!0x69676572 \b, 1st region INVALID
28166>0x30000	ulelong			=0x69676572 \b; region
28167# region Checksum. CRC-32C hash over the entire 64-KB table
28168#>>0x30004	ulelong			x	\b, CRC 0x%x
28169# The EntryCount specifies number of valid entries; Found 2; This must be =< 2047.
28170>>0x30008	ulelong			x	\b, %u entries
28171# reserved must be zero
28172#>>0x3000C	ulelong			!0	\b, RESERVED 0x%x
28173# Region Table Entry starts with identifier for the object. often BAT id
28174>>0x30010	use			vhdx-id
28175# FileOffset
28176>>0x30020	ulequad		x		\b, at 0x%llx
28177# Length. Specifies the length of the object within the file
28178#>>0x30028	ulelong		x		\b, Length 0x%x
28179# 1 means region entry is required. if region not recognized, then REFUSE to load VHDX
28180>>0x3002C	ulelong		x		\b, Required %u
28181# 2nd region entry often metadata id
28182>>0x30030	use			vhdx-id
28183# 2nd entry FileOffset
28184>>0x30040	ulequad		x		\b, at 0x%llx
28185# 1 means region entry is required. if region not recognized, then REFUSE to load VHDX
28186>>0x3004C	ulelong		x		\b, Required %u
28187# 2nd region
28188>>0x40000	ulelong		!0x69676572	\b, 2nd region INVALID
28189# check in vhdx images for known id and show names instead hexadecimal
281900	name		vhdx-id
28191# https://www.windowstricks.in/online-windows-guid-converter
28192# 2DC27766-F623-4200-9D64-115E9BFD4A08		BAT GUID
28193# 6677C22D23F600429D64115E9BFD4A08		BAT ID
28194>0	ubequad		=0x6677C22D23F60042
28195>>8	ubequad		=0x9D64115E9BFD4A08	\b, id BAT
28196# no BAT id
28197>>8	default		x
28198>>>0	use		vhdx-id-hex
28199# 8B7CA206-4790-4B9A-B8FE-575F050F886E		Metadata region GUID
28200# 06A27C8B90479A4BB8FE575F050F886E		Metadata region ID
28201>0	ubequad		=0x06A27C8B90479A4B
28202>>8	ubequad		=0xB8FE575F050F886E	\b, id Metadata
28203# no Metadata id
28204>>8	default		x
28205>>>0	use		vhdx-id-hex
28206# 2FA54224-CD1B-4876-B211-5DBED83BF4B8		Virtual Disk Size GUID
28207# 2442A52F1BCD7648B2115DBED83BF4B8		Virtual Disk Size ID
28208# value "virtual size" can be verified by command `qemu-img info `
28209>0	ubequad		=0x2442A52F1BCD7648
28210>>8	ubequad		=0xB2115DBED83BF4B8	\b, id vsize
28211# no Virtual Disk Size ID
28212>>8	default		x
28213>>>0	use		vhdx-id-hex
28214# other ids
28215>0	default		x
28216>>0	use		vhdx-id-hex
28217# in vhdx images show id as hexadecimal
282180	name		vhdx-id-hex
28219>0	ubequad		x			\b, ID 0x%16.16llx
28220>8	ubequad		x			\b-%16.16llx
28221#
28222# libvirt
28223# From: Philipp Hahn <hahn@univention.de>
282240	string	LibvirtQemudSave	Libvirt QEMU Suspend Image
28225>0x10	lelong	x	\b, version %u
28226>0x14	lelong	x	\b, XML length %u
28227>0x18	lelong	1	\b, running
28228>0x1c	lelong	1	\b, compressed
28229
282300	string	LibvirtQemudPart	Libvirt QEMU partial Suspend Image
28231# From: Alex Beregszaszi <alex@fsn.hu>
282320	string/b	COWD		VMWare3
28233>4	byte	3		disk image
28234>>32	lelong	x		(%d/
28235>>36	lelong	x		\b%d/
28236>>40	lelong	x		\b%d)
28237>4	byte	2		undoable disk image
28238>>32	string	>\0		(%s)
28239
282400	string/b	VMDK		 VMware4 disk image
282410	string/b	KDMV		 VMware4 disk image
28242
28243#--------------------------------------------------------------------
28244# Qemu Emulator Images
28245# Lines written by Friedrich Schwittay (f.schwittay@yousable.de)
28246# Updated by Adam Buchbinder (adam.buchbinder@gmail.com)
28247# Made by reading sources, reading documentation, and doing trial and error
28248# on existing QCOW files
282490	string/b	QFI\xFB
28250
28251# Uncomment the following line to display Magic (only used for debugging
28252# this magic number)
28253#>0	string/b	x	, Magic: %s
28254
28255# There are currently 2 Versions: "1" and "2".
28256# https://www.gnome.org/~markmc/qcow-image-format-version-1.html
28257>4	belong		!1	QEMU QCOW2 Image
28258>4	belong		1	QEMU QCOW Image (v1)
28259
28260# Using the existence of the Backing File Offset to determine whether
28261# to read Backing File Information
28262>>12	belong	 >0	 \b, has backing file (
28263# Note that this isn't a null-terminated string; the length is actually
28264# (16.L). Assuming a null-terminated string happens to work usually, but it
28265# may spew junk until it reaches a \0 in some cases.
28266>>>(12.L)	 string >\0	\bpath %s
28267
28268# Modification time of the Backing File
28269# Really useful if you want to know if your backing
28270# file is still usable together with this image
28271>>>>20	bedate >0	\b, mtime %s)
28272>>>>20	default x	\b)
28273
28274# Size is stored in bytes in a big-endian u64.
28275>>24	bequad	x	 \b, %lld bytes
28276
28277# 1 for AES encryption, 0 for none.
28278>>36	belong	1	\b, AES-encrypted
28279
28280# https://www.gnome.org/~markmc/qcow-image-format.html
28281>4	belong	2	(v2)
28282# Using the existence of the Backing File Offset to determine whether
28283# to read Backing File Information
28284>>8	bequad  >0	 \b, has backing file
28285# Note that this isn't a null-terminated string; the length is actually
28286# (16.L). Assuming a null-terminated string happens to work usually, but it
28287# may spew junk until it reaches a \0 in some cases. Also, since there's no
28288# .Q modifier, we just use the bottom four bytes as an offset. Note that if
28289# the file is over 4G, and the backing file path is stored after the first 4G,
28290# the wrong filename will be printed. (This should be (8.Q), when that syntax
28291# is introduced.)
28292>>>(12.L)	 string >\0	(path %s)
28293>>24	bequad	x	\b, %lld bytes
28294>>32	belong	1	\b, AES-encrypted
28295
28296>4	belong	3	(v3)
28297# Using the existence of the Backing File Offset to determine whether
28298# to read Backing File Information
28299>>8	bequad  >0	 \b, has backing file
28300# Note that this isn't a null-terminated string; the length is actually
28301# (16.L). Assuming a null-terminated string happens to work usually, but it
28302# may spew junk until it reaches a \0 in some cases. Also, since there's no
28303# .Q modifier, we just use the bottom four bytes as an offset. Note that if
28304# the file is over 4G, and the backing file path is stored after the first 4G,
28305# the wrong filename will be printed. (This should be (8.Q), when that syntax
28306# is introduced.)
28307>>>(12.L)	 string >\0	(path %s)
28308>>24	bequad	x	\b, %lld bytes
28309>>32	belong	1	\b, AES-encrypted
28310
28311>4	default x	(unknown version)
28312
283130	string/b	QEVM		QEMU suspend to disk image
28314
28315# QEMU QED Image
28316# https://wiki.qemu.org/Features/QED/Specification
283170	string/b	QED\0		QEMU QED Image
28318
28319# VDI Image
28320# Sun xVM VirtualBox Disk Image
28321# From: Richard W.M. Jones <rich@annexia.org>
28322# VirtualBox Disk Image
283230x40	ulelong		0xbeda107f	VirtualBox Disk Image
28324>0x44	uleshort	>0		\b, major %u
28325>0x46	uleshort	>0		\b, minor %u
28326>0	string		>\0		(%s)
28327>368	lequad		x		 \b, %lld bytes
28328
283290	string/b	Bochs\ Virtual\ HD\ Image	Bochs disk image,
28330>32	string	x				type %s,
28331>48	string	x				subtype %s
28332
283330	lelong	0x02468ace			Bochs Sparse disk image
28334
28335
28336#------------------------------------------------------------------------------
28337# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $
28338# Virtutech Compressed Random Access File Format
28339#
28340# From <gustav@virtutech.com>
283410      string          \211\277\036\203        Virtutech CRAFF
28342>4     belong          x               v%d
28343>20    belong          0               uncompressed
28344>20    belong          1               bzipp2ed
28345>20    belong          2               gzipped
28346>24    belong          0               not clean
28347
28348#------------------------------------------------------------------------------
28349# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $
28350# visx:  file(1) magic for Visx format files
28351#
283520	short		0x5555		VISX image file
28353>2	byte		0		(zero)
28354>2	byte		1		(unsigned char)
28355>2	byte		2		(short integer)
28356>2	byte		3		(float 32)
28357>2	byte		4		(float 64)
28358>2	byte		5		(signed char)
28359>2	byte		6		(bit-plane)
28360>2	byte		7		(classes)
28361>2	byte		8		(statistics)
28362>2	byte		10		(ascii text)
28363>2	byte		15		(image segments)
28364>2	byte		100		(image set)
28365>2	byte		101		(unsigned char vector)
28366>2	byte		102		(short integer vector)
28367>2	byte		103		(float 32 vector)
28368>2	byte		104		(float 64 vector)
28369>2	byte		105		(signed char vector)
28370>2	byte		106		(bit plane vector)
28371>2	byte		121		(feature vector)
28372>2	byte		122		(feature vector library)
28373>2	byte		124		(chain code)
28374>2	byte		126		(bit vector)
28375>2	byte		130		(graph)
28376>2	byte		131		(adjacency graph)
28377>2	byte		132		(adjacency graph library)
28378>2	string		.VISIX		(ascii text)
28379
28380#------------------------------------------------------------------------------
28381# $File: vms,v 1.10 2017/03/17 21:35:28 christos Exp $
28382# vms:  file(1) magic for VMS executables (experimental)
28383#
28384# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
28385
28386# GRR 950122:  I'm just guessing on these, based on inspection of the headers
28387# of three executables each for Alpha and VAX architectures.  The VAX files
28388# all had headers similar to this:
28389#
28390#   00000  b0 00 30 00 44 00 60 00  00 00 00 00 30 32 30 35  ..0.D.`.....0205
28391#   00010  01 01 00 00 ff ff ff ff  ff ff ff ff 00 00 00 00  ................
28392#
283930	string	\xb0\0\x30\0	VMS VAX executable
28394>44032	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
28395#
28396# The AXP files all looked like this, except that the byte at offset 0x22
28397# was 06 in some of them and 07 in others:
28398#
28399#   00000  03 00 00 00 00 00 00 00  ec 02 00 00 10 01 00 00  ................
28400#   00010  68 00 00 00 98 00 00 00  b8 00 00 00 00 00 00 00  h...............
28401#   00020  00 00 07 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
28402#   00030  00 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  ................
28403#   00040  00 00 00 00 ff ff ff ff  ff ff ff ff 02 00 00 00  ................
28404#
28405# GRR this test is still too general as it catches example adressen.dbt
284060	belong	0x03000000
28407>8	ubelong	0xec020000	VMS Alpha executable
28408>>75264	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
28409
28410#------------------------------------------------------------------------------
28411# $File: vmware,v 1.8 2017/03/17 21:35:28 christos Exp $
28412# VMware specific files (deducted from version 1.1 and log file entries)
28413# Anthon van der Neut (anthon@mnt.org)
284140	belong	0x4d52564e	VMware nvram
28415
28416#------------------------------------------------------------------------------
28417# $File: vorbis,v 1.24 2018/03/14 04:38:44 christos Exp $
28418# vorbis:  file(1) magic for Ogg/Vorbis files
28419#
28420# From Felix von Leitner <leitner@fefe.de>
28421# Extended by Beni Cherniavsky <cben@crosswinds.net>
28422# Further extended by Greg Wooledge <greg@wooledge.org>
28423#
28424# Most (everything but the number of channels and bitrate) is commented
28425# out with `##' as it's not interesting to the average user.  The most
28426# probable things advanced users would want to uncomment are probably
28427# the number of comments and the encoder version.
28428#
28429# FIXME: The first match has been made a search, so that it can skip
28430# over prepended ID3 tags. This will work for MIME type detection, but
28431# won't work for detecting other properties of the file (they all need
28432# to be made relative to the search). In any case, if the file has ID3
28433# tags, the ID3 information will be printed, not the Ogg information,
28434# so until that's fixed, this doesn't matter.
28435# FIXME[2]: Disable the above for now, since search assumes text mode.
28436#
28437# --- Ogg Framing ---
28438#0		search/1000	OggS		Ogg data
284390		string	OggS		Ogg data
28440>4		byte		!0		UNKNOWN REVISION %u
28441##>4		byte		0		revision 0
28442>4		byte		0
28443##>>14		lelong		x		(Serial %lX)
28444# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net)
28445>>28		string		\x7fFLAC	\b, FLAC audio
28446# non-Vorbis content: Theora
28447!:mime		audio/ogg
28448>>28		string		\x80theora	\b, Theora video
28449!:mime		video/ogg
28450# non-Vorbis content: Kate
28451>>28		string		\x80kate\0\0\0\0	\b, Kate (Karaoke and Text)
28452!:mime		application/ogg
28453>>>37		ubyte		x		v%u
28454>>>38		ubyte		x		\b.%u,
28455>>>40		byte		0		utf8 encoding,
28456>>>40		byte		!0		unknown character encoding,
28457>>>60		string		>\0		language %s,
28458>>>60		string		\0		no language set,
28459>>>76		string		>\0		category %s
28460>>>76		string		\0		no category set
28461# non-Vorbis content: Skeleton
28462>>28		string		fishead\0	\b, Skeleton
28463!:mime		video/ogg
28464>>>36		leshort		x		v%u
28465>>>40		leshort		x		\b.%u
28466# non-Vorbis content: Speex
28467>>28		string		Speex\ \ \ 	\b, Speex audio
28468!:mime		audio/ogg
28469# non-Vorbis content: OGM
28470>>28		string		\x01video\0\0\0	\b, OGM video
28471!:mime		video/ogg
28472>>>37		string/c	div3		(DivX 3)
28473>>>37		string/c	divx		(DivX 4)
28474>>>37		string/c	dx50		(DivX 5)
28475>>>37		string/c	xvid		(XviD)
28476# --- First vorbis packet - general header ---
28477>>28		string		\x01vorbis	\b, Vorbis audio,
28478!:mime		audio/ogg
28479>>>35		lelong		!0		UNKNOWN VERSION %u,
28480##>>>35		lelong		0		version 0,
28481>>>35		lelong		0
28482>>>>39		ubyte		1		mono,
28483>>>>39		ubyte		2		stereo,
28484>>>>39		ubyte		>2		%u channels,
28485>>>>40		lelong		x		%u Hz
28486# Minimal, nominal and maximal bitrates specified when encoding
28487>>>>48		string		<\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	\b,
28488# The above tests if at least one of these is specified:
28489>>>>>52		lelong		!-1
28490# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields
28491# instead of -1.
28492# Vorbis 1.0 uses 0 instead of -1.
28493>>>>>>52	lelong		!0
28494>>>>>>>52	lelong		!-1000
28495>>>>>>>>52	lelong		x		<%u
28496>>>>>48		lelong		!-1
28497>>>>>>48	lelong		x		~%u
28498>>>>>44		lelong		!-1
28499>>>>>>44	lelong		!-1000
28500>>>>>>>44	lelong		!0
28501>>>>>>>>44	lelong		x		>%u
28502>>>>>48		string		<\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	bps
28503# -- Second vorbis header packet - the comments
28504# A kludge to read the vendor string.  It's a counted string, not a
28505# zero-terminated one, so file(1) can't read it in a generic way.
28506# libVorbis is the only one existing currently, so I detect specifically
28507# it.  The interesting value is the cvs date (8 digits decimal).
28508# Post-RC1 Ogg files have the second header packet (and thus the version)
28509# in a different place, so we must use an indirect offset.
28510>>>(84.b+85)		string		\x03vorbis
28511>>>>(84.b+96)		string/c	Xiphophorus\ libVorbis\ I	\b, created by: Xiphophorus libVorbis I
28512>>>>>(84.b+120)		string		>00000000
28513# Map to beta version numbers:
28514>>>>>>(84.b+120)	string		<20000508	(<beta1, prepublic)
28515>>>>>>(84.b+120)	string		20000508	(1.0 beta 1 or beta 2)
28516>>>>>>(84.b+120)	string		>20000508
28517>>>>>>>(84.b+120)	string		<20001031	(beta2-3)
28518>>>>>>(84.b+120)	string		20001031	(1.0 beta 3)
28519>>>>>>(84.b+120)	string		>20001031
28520>>>>>>>(84.b+120)	string		<20010225	(beta3-4)
28521>>>>>>(84.b+120)	string		20010225	(1.0 beta 4)
28522>>>>>>(84.b+120)	string		>20010225
28523>>>>>>>(84.b+120)	string		<20010615	(beta4-RC1)
28524>>>>>>(84.b+120)	string		20010615	(1.0 RC1)
28525>>>>>>(84.b+120)	string		20010813	(1.0 RC2)
28526>>>>>>(84.b+120)	string		20010816	(RC2 - Garf tuned v1)
28527>>>>>>(84.b+120)	string		20011014	(RC2 - Garf tuned v2)
28528>>>>>>(84.b+120)	string		20011217	(1.0 RC3)
28529>>>>>>(84.b+120)	string		20011231	(1.0 RC3)
28530# Some pre-1.0 CVS snapshots still had "Xiphphorus"...
28531>>>>>>(84.b+120)	string		>20011231	(pre-1.0 CVS)
28532# For the 1.0 release, Xiphophorus is replaced by Xiph.Org
28533>>>>(84.b+96)		string/c	Xiph.Org\ libVorbis\ I	\b, created by: Xiph.Org libVorbis I
28534>>>>>(84.b+117)		string		>00000000
28535>>>>>>(84.b+117)	string		<20020717	(pre-1.0 CVS)
28536>>>>>>(84.b+117)	string		20020717	(1.0)
28537>>>>>>(84.b+117)	string		20030909	(1.0.1)
28538>>>>>>(84.b+117)	string		20040629	(1.1.0 RC1)
28539>>>>>>(84.b+117)	string		20050304	(1.1.2)
28540>>>>>>(84.b+117)	string		20070622	(1.2.0)
28541>>>>>>(84.b+117)	string		20090624	(1.2.2)
28542>>>>>>(84.b+117)	string		20090709	(1.2.3)
28543>>>>>>(84.b+117)	string		20100325	(1.3.1)
28544>>>>>>(84.b+117)	string		20101101	(1.3.2)
28545>>>>>>(84.b+117)	string		20120203	(1.3.3)
28546>>>>>>(84.b+117)	string		20140122	(1.3.4)
28547>>>>>>(84.b+117)	string		20150105	(1.3.5)
28548
28549# non-Vorbis content: Opus https://tools.ietf.org/html/draft-ietf-codec-oggopus-06#section-5
28550>>28		string		OpusHead	\b, Opus audio,
28551!:mime		audio/ogg
28552>>>36		ubyte		>0x0F		UNKNOWN VERSION %u,
28553>>>36		ubyte		&0x0F		version 0.%d
28554>>>>46		ubyte		>1
28555>>>>>46		ubyte		!255		unknown channel mapping family %u,
28556>>>>>37		ubyte		x		%u channels
28557>>>>46		ubyte		0
28558>>>>>37		ubyte		1		mono
28559>>>>>37		ubyte		2		stereo
28560>>>>46		ubyte		1
28561>>>>>37		ubyte		1		mono
28562>>>>>37		ubyte		2		stereo
28563>>>>>37		ubyte		3		linear surround
28564>>>>>37		ubyte		4		quadraphonic
28565>>>>>37		ubyte		5		5.0 surround
28566>>>>>37		ubyte		6		5.1 surround
28567>>>>>37		ubyte		7		6.1 surround
28568>>>>>37		ubyte		8		7.1 surround
28569>>>>40		lelong		!0		\b, %u Hz
28570
28571#------------------------------------------------------------------------------
28572# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $
28573# VXL: file(1) magic for VXL binary IO data files
28574#
28575# from Ian Scott <scottim@sf.net>
28576#
28577# VXL is a collection of C++ libraries for Computer Vision.
28578# See the vsl chapter in the VXL Book for more info
28579# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html
28580# http:/vxl.sf.net
28581
285822	lelong	0x472b2c4e	VXL data file,
28583>0	leshort	>0		schema version no %d
28584
28585#------------------------------------------------------------------------------
28586# $File: warc,v 1.4 2019/04/19 00:42:27 christos Exp $
28587# warc:  file(1) magic for WARC files
28588
285890	string	WARC/	WARC Archive
28590>5	string	x	version %.4s
28591!:mime application/warc
28592
28593#------------------------------------------------------------------------------
28594# Arc File Format from Internet Archive
28595# see https://www.archive.org/web/researcher/ArcFileFormat.php
285960      string          filedesc://     Internet Archive File
28597!:mime application/x-ia-arc
28598>11    search/256      \x0A    \b
28599>>&0   ubyte   >0      \b version %c
28600
28601#------------------------------------------------------------------------------
28602# weak:  file(1) magic for very weak magic entries, disabled by default
28603#
28604# These entries are so weak that they might interfere identification of
28605# other formats. Example include:
28606# - Only identify for 1 or 2 bytes
28607# - Match against very wide range of values
28608# - Match against generic word in some spoken languages (e.g. English)
28609
28610# Summary: Computer Graphics Metafile
28611# Extension: .cgm
28612#0	beshort&0xffe0	0x0020		binary Computer Graphics Metafile
28613#0	beshort		0x3020		character Computer Graphics Metafile
28614
28615#0	string		=!!		Bennet Yee's "face" format
28616#------------------------------------------------------------------------------
28617# $File: webassembly,v 1.3 2019/04/19 00:42:27 christos Exp $
28618# webassembly:  file(1) magic for WebAssembly modules
28619#
28620# WebAssembly is a virtual architecture developed by a W3C Community
28621# Group at https://webassembly.org/. The file extension is .wasm, and
28622# the MIME type is application/wasm.
28623#
28624# https://webassembly.org/docs/binary-encoding/ is the main
28625# document describing the binary format.
28626# From: Pip Cet <pipcet@gmail.com> and Joel Martin
28627
286280	string	\0asm	WebAssembly (wasm) binary module
28629>4	lelong	=1	version %#x (MVP)
28630>4	lelong	>1	version %#x
28631
28632#------------------------------------------------------------------------------
28633# $File: windows,v 1.26 2019/05/01 17:55:25 christos Exp $
28634# windows:  file(1) magic for Microsoft Windows
28635#
28636# This file is mainly reserved for files where programs
28637# using them are run almost always on MS Windows 3.x or
28638# above, or files only used exclusively in Windows OS,
28639# where there is no better category to allocate for.
28640# For example, even though WinZIP almost run on Windows
28641# only, it is better to treat them as "archive" instead.
28642# For format usable in DOS, such as generic executable
28643# format, please specify under "msdos" file.
28644#
28645
28646
28647# Summary: Outlook Express DBX file
28648# Extension: .dbx
28649# Created by: Christophe Monniez
286500	string	\xCF\xAD\x12\xFE	MS Outlook Express DBX file
28651>4	byte	=0xC5			\b, message database
28652>4	byte	=0xC6			\b, folder database
28653>4	byte	=0xC7			\b, account information
28654>4	byte	=0x30			\b, offline database
28655
28656
28657# Summary: Windows crash dump
28658# Extension: .dmp
28659# Created by: Andreas Schuster (https://computer.forensikblog.de/)
28660# Reference (1): https://computer.forensikblog.de/en/2008/02/64bit_magic.html
28661# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only)
286620	string		PAGE
28663>4	string		DUMP		MS Windows 32bit crash dump
28664>>0x05c	byte            0		\b, no PAE
28665>>0x05c	byte            1		\b, PAE
28666>>0xf88	lelong		1		\b, full dump
28667>>0xf88	lelong		2		\b, kernel dump
28668>>0xf88	lelong		3		\b, small dump
28669>>0x068	lelong		x		\b, %d pages
28670>4	string		DU64		MS Windows 64bit crash dump
28671>>0xf98	lelong		1		\b, full dump
28672>>0xf98	lelong		2		\b, kernel dump
28673>>0xf98	lelong		3		\b, small dump
28674>>0x090	lequad		x		\b, %lld pages
28675
28676
28677# Summary: Vista Event Log
28678# Extension: .evtx
28679# Created by: Andreas Schuster (https://computer.forensikblog.de/)
28680# Reference (1): https://computer.forensikblog.de/en/2007/05/some_magic.html
286810	string		ElfFile\0	MS Windows Vista Event Log
28682>0x2a	leshort		x		\b, %d chunks
28683>>0x10	lelong		x		\b (no. %d in use)
28684>0x18	lelong		>1		\b, next record no. %d
28685>0x18	lelong		=1		\b, empty
28686>0x78	lelong		&1		\b, DIRTY
28687>0x78	lelong		&2		\b, FULL
28688
28689# Summary: Windows System Deployment Image
28690# Created by: Joerg Jenderek
28691# URL: http://en.wikipedia.org/wiki/System_Deployment_Image
28692# Reference: http://skolk.livejournal.com/1320.html
286930	string			$SDI
28694>4	string			0001		System Deployment Image
28695!:mime	application/x-ms-sdi
28696#!:mime	application/octet-stream
28697# \Boot\boot.sdi
28698!:ext	sdi
28699# MDBtype: 0~Unspecified 1~RAM 2~ROM
28700>>8	ulequad			!0		\b, MDBtype 0x%llx
28701# BootCodeOffset
28702>>16	ulequad			!0		\b, BootCodeOffset 0x%llx
28703# BootCodeSize
28704>>24	ulequad			!0		\b, BootCodeSize 0x%llx
28705# VendorID
28706>>32	ulequad			!0		\b, VendorID 0x%llx
28707# DeviceID
28708>>40	ulequad			!0		\b, DeviceID 0x%llx
28709# DeviceModel
28710>>48	ulequad			!0		\b, DeviceModel 0x%llx
28711>>>56	ulequad			!0		\b%llx
28712# DeviceRole
28713>>64	ulequad			!0		\b, DeviceRole 0x%llx
28714# Reserved1; reserved fields and gaps between BLOBs are padded with \0
28715#>>72	ulequad			!0		\b, Reserved1 0x%llx
28716# RuntimeGUID
28717>>80	ulequad			!0		\b, RuntimeGUID 0x%llx
28718>>>88	ulequad			!0		\b%llx
28719# RuntimeOEMrev
28720>>96	ulequad			!0		\b, RuntimeOEMrev 0x%llx
28721# Reserved2
28722#>>104	ulequad			!0		\b, Reserved2 0x%llx
28723# BLOB alignment value in pages, as specified in sdimgr /pack: 1~4K 2~8k
28724>>112	ulequad			!0		\b, PageAlignment %llu
28725# Reserved3[48]
28726#>>120	ulequad			!0		\b, Reserved3 0x%llx
28727# SDI checksum 39h
28728>>0x1f8	ulequad			x		\b, checksum 0x%llx
28729# BLOBtype[8] \0-padded: PART, WIM , BOOT, LOAD, DISK
28730>>0x400	string			>\0		\b, type %-3.8s
28731# 0~non-filesystem 7~NTFS 6~BIGFAT
28732>>>0x420	ulequad		!0		(0x%llx)
28733# ATTRibutes
28734>>>0x408	ulequad		!0		0x%llx attributes
28735# Offset
28736>>>0x410	ulequad		x		at 0x%llx
28737# print 1 space after size and then handles NTFS boot sector by ./filesystems
28738>>>0x418	ulequad		>0		%llu bytes
28739>>>>(0x410.l)	indirect	x
28740# 2nd BLOB: WIM
28741>>0x440		string		>\0		\b, type %-3.8s
28742>>>0x428	ulequad		!0		(0x%llx)
28743# ATTRibutes
28744>>>0x448	ulequad		!0		0x%llx attributes
28745# Offset
28746>>>0x450	ulequad		x		at 0x%llx
28747>>>0x458	ulequad		>0		%llu bytes
28748>>>>(0x450.l)	indirect	x
28749# 3rd BLOB
28750>>0x480		string		>\0		\b, type %-3.8s
28751
28752# Summary:	Windows Error Report text files
28753# URL:		https://en.wikipedia.org/wiki/Windows_Error_Reporting
28754# Reference:	https://www.nirsoft.net/utils/app_crash_view.html
28755# Created by:	Joerg Jenderek
28756# Note:		in directories	%ProgramData%\Microsoft\Windows\WER\{ReportArchive,ReportQueue}
28757#				%LOCALAPPDATA%\Microsoft\Windows\WER\{ReportArchive,ReportQueue}
287580	lestring16	Version=
28759>22	lestring16	EventType	Windows Error Report
28760!:mime	text/plain
28761# Report.wer
28762!:ext	wer
28763
28764# Summary: Windows 3.1 group files
28765# Extension: .grp
28766# Created by: unknown
287670	string		\120\115\103\103	MS Windows 3.1 group files
28768
28769
28770# Summary: Old format help files
28771# URL: https://en.wikipedia.org/wiki/WinHelp
28772# Reference: https://www.oocities.org/mwinterhoff/helpfile.htm
28773# Update: Joerg Jenderek
28774# Created by: Dirk Jagdmann <doj@cubic.org>
28775#
28776# check and then display version and date inside MS Windows HeLP file fragment
287770	name				help-ver-date
28778# look for Magic of SYSTEMHEADER
28779>0	leshort		0x036C
28780# version Major		1 for right file fragment
28781>>4	leshort		1		Windows
28782# print non empty string above to avoid error message
28783# Warning: Current entry does not yet have a description for adding a MIME type
28784!:mime	application/winhelp
28785!:ext	hlp
28786# version Minor of help file format is hint for windows version
28787>>>2	leshort		0x0F		3.x
28788>>>2	leshort		0x15		3.0
28789>>>2	leshort		0x21		3.1
28790>>>2	leshort		0x27		x.y
28791>>>2	leshort		0x33		95
28792>>>2	default		x		y.z
28793>>>>2	leshort		x		0x%x
28794# to complete message string like "MS Windows 3.x help file"
28795>>>2	leshort		x		help
28796# GenDate often older than file creation date
28797>>>6	ldate		x		\b, %s
28798#
28799# Magic for HeLP files
288000	lelong		0x00035f3f
28801# ./windows (version 5.25) labeled the entry as "MS Windows 3.x help file"
28802# file header magic 0x293B at DirectoryStart+9
28803>(4.l+9)	uleshort	0x293B		MS
28804# look for @VERSION	bmf.. like IBMAVW.ANN
28805>>0xD4		string	=\x62\x6D\x66\x01\x00	Windows help annotation
28806!:mime	application/x-winhelp
28807!:ext	ann
28808>>0xD4		string	!\x62\x6D\x66\x01\x00
28809# "GID Help index" by TrID
28810>>>(4.l+0x65)	string	=|Pete			Windows help Global Index
28811!:mime	application/x-winhelp
28812!:ext	gid
28813# HeLP Bookmark or
28814# "Windows HELP File" by TrID
28815>>>(4.l+0x65)		string		!|Pete
28816# maybe there exist a cleaner way to detect HeLP fragments
28817# brute search for Magic 0x036C with matching Major maximal 7 iterations
28818# discapp.hlp
28819>>>>16			search/0x49AF/s	\x6c\x03
28820>>>>>&0			use 		help-ver-date
28821>>>>>&4			leshort		!1
28822# putty.hlp
28823>>>>>>&0		search/0x69AF/s	\x6c\x03
28824>>>>>>>&0		use 		help-ver-date
28825>>>>>>>&4		leshort		!1
28826>>>>>>>>&0		search/0x49AF/s	\x6c\x03
28827>>>>>>>>>&0		use 		help-ver-date
28828>>>>>>>>>&4		leshort		!1
28829>>>>>>>>>>&0		search/0x49AF/s	\x6c\x03
28830>>>>>>>>>>>&0		use 		help-ver-date
28831>>>>>>>>>>>&4		leshort		!1
28832>>>>>>>>>>>>&0		search/0x49AF/s	\x6c\x03
28833>>>>>>>>>>>>>&0		use 		help-ver-date
28834>>>>>>>>>>>>>&4		leshort		!1
28835>>>>>>>>>>>>>>&0	search/0x49AF/s	\x6c\x03
28836>>>>>>>>>>>>>>>&0	use 		help-ver-date
28837>>>>>>>>>>>>>>>&4	leshort		!1
28838>>>>>>>>>>>>>>>>&0	search/0x49AF/s	\x6c\x03
28839# GCC.HLP is detected after 7 iterations
28840>>>>>>>>>>>>>>>>>&0	use 		help-ver-date
28841# this only happens if bigger hlp file is detected after used search iterations
28842>>>>>>>>>>>>>>>>>&4	leshort		!1		Windows y.z help
28843!:mime	application/winhelp
28844!:ext	hlp
28845# repeat search again or following default line does not work
28846>>>>16			search/0x49AF/s	\x6c\x03
28847# remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 8.1 64-bit)
28848>>>>16	default				x	Windows help Bookmark
28849!:mime	application/x-winhelp
28850!:ext	bmk
28851## FirstFreeBlock normally FFFFFFFFh 10h for *ANN
28852##>>8	lelong			x		\b, FirstFreeBlock 0x%8.8x
28853# EntireFileSize
28854>>12	lelong			x		\b, %d bytes
28855## ReservedSpace normally 042Fh AFh for *.ANN
28856#>>(4.l)	lelong		x		\b, ReservedSpace 0x%8.8x
28857## UsedSpace normally 0426h A6h for *.ANN
28858#>>(4.l+4)	lelong		x		\b, UsedSpace 0x%8.8x
28859## FileFlags normally 04...
28860#>>(4.l+5)	lelong		x		\b, FileFlags 0x%8.8x
28861## file header magic 0x293B
28862#>>(4.l+9)	uleshort	x		\b, file header magic 0x%4.4x
28863## file header Flags		0x0402
28864#>>(4.l+11)	uleshort	x		\b, file header Flags 0x%4.4x
28865## file header PageSize	0400h 80h for *.ANN
28866#>>(4.l+13)	uleshort	x		\b, PageSize 0x%4.4x
28867## Structure[16]		z4
28868#>>(4.l+15)	string		>\0		\b, Structure_"%-.16s"
28869## MustBeZero			0
28870#>>(4.l+31)	uleshort	x		\b, MustBeZero 0x%4.4x
28871## PageSplits
28872#>>(4.l+33)	uleshort	x		\b, PageSplits 0x%4.4x
28873## RootPage
28874#>>(4.l+35)	uleshort	x		\b, RootPage 0x%4.4x
28875## MustBeNegOne			0xffff
28876#>>(4.l+37)	uleshort	x		\b, MustBeNegOne 0x%4.4x
28877## TotalPages			1
28878#>>(4.l+39)	uleshort	x		\b, TotalPages 0x%4.4x
28879## NLevels			0x0001
28880#>>(4.l+41)	uleshort	x		\b, NLevels 0x%4.4x
28881## TotalBtreeEntries
28882#>>(4.l+43)	ulelong		x		\b, TotalBtreeEntries 0x%8.8x
28883## pages of the B+ tree
28884#>>(4.l+47)	ubequad		x		\b, PageStart 0x%16.16llx
28885
28886# start with colon or semicolon for comment line like Back2Life.cnt
288870		regex		\^(:|;)
28888# look for first keyword Base
28889>0		search/45	:Base
28890>>&0				use 		cnt-name
28891# only solution to search again from beginning , because relative offsets changes when use is called
28892>0		search/45	:Base
28893>0		default		x
28894# look for other keyword Title like in putty.cnt
28895>>0		search/45	:Title
28896>>>&0				use 		cnt-name
28897#
28898# display mime type and name of Windows help Content source
288990	name				cnt-name
28900# skip space at beginning
28901>0     string		\040
28902# name without extension and greater character or name with hlp extension
28903>>1	regex/c		\^([^\xd>]*|.*\.hlp)	MS Windows help file Content, based "%s"
28904!:mime	text/plain
28905!:apple	????TEXT
28906!:ext	cnt
28907#
28908# Windows creates an full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing
289090	string		tfMR			MS Windows help Full Text Search index
28910!:mime application/x-winhelp-fts
28911!:ext	fts
28912>16	string		>\0			for "%s"
28913
28914# Summary: Hyper terminal
28915# Extension: .ht
28916# Created by: unknown
289170	string		HyperTerminal\040
28918>15	string		1.0\ --\ HyperTerminal\ data\ file	MS Windows HyperTerminal profile
28919
28920# https://ithreats.files.wordpress.com/2009/05/\040
28921# lnk_the_windows_shortcut_file_format.pdf
28922# Summary: Windows shortcut
28923# Extension: .lnk
28924# Created by: unknown
28925# 'L' + GUUID
289260	string		\114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106	MS Windows shortcut
28927>20	lelong&1	1	\b, Item id list present
28928>20	lelong&2	2	\b, Points to a file or directory
28929>20	lelong&4	4	\b, Has Description string
28930>20	lelong&8	8	\b, Has Relative path
28931>20	lelong&16	16	\b, Has Working directory
28932>20	lelong&32	32	\b, Has command line arguments
28933>20	lelong&64	64	\b, Icon
28934>>56	lelong		x	\b number=%d
28935>24	lelong&1	1	\b, Read-Only
28936>24	lelong&2	2	\b, Hidden
28937>24	lelong&4	4	\b, System
28938>24	lelong&8	8	\b, Volume Label
28939>24	lelong&16	16	\b, Directory
28940>24	lelong&32	32	\b, Archive
28941>24	lelong&64	64	\b, Encrypted
28942>24	lelong&128	128	\b, Normal
28943>24	lelong&256	256	\b, Temporary
28944>24	lelong&512	512	\b, Sparse
28945>24	lelong&1024	1024	\b, Reparse point
28946>24	lelong&2048	2048	\b, Compressed
28947>24	lelong&4096	4096	\b, Offline
28948>28	leqwdate	x	\b, ctime=%s
28949>36	leqwdate	x	\b, mtime=%s
28950>44	leqwdate	x	\b, atime=%s
28951>52	lelong		x	\b, length=%u, window=
28952>60	lelong&1	1	\bhide
28953>60	lelong&2	2	\bnormal
28954>60	lelong&4	4	\bshowminimized
28955>60	lelong&8	8	\bshowmaximized
28956>60	lelong&16	16	\bshownoactivate
28957>60	lelong&32	32	\bminimize
28958>60	lelong&64	64	\bshowminnoactive
28959>60	lelong&128	128	\bshowna
28960>60	lelong&256	256	\brestore
28961>60	lelong&512	512	\bshowdefault
28962#>20	lelong&1	0
28963#>>20	lelong&2	2
28964#>>>(72.l-64)	pstring/h	x	\b [%s]
28965#>20	lelong&1	1
28966#>>20	lelong&2	2
28967#>>>(72.s)	leshort	x
28968#>>>&75	pstring/h	x	\b [%s]
28969
28970# Summary: Outlook Personal Folders
28971# Created by: unknown
289720	lelong		0x4E444221	Microsoft Outlook email folder
28973>10	leshort		0x0e		(<=2002)
28974>10	leshort		0x17		(>=2003)
28975
28976
28977# Summary: Windows help cache
28978# Created by: unknown
289790	string		\164\146\115\122\012\000\000\000\001\000\000\000	MS Windows help cache
28980
28981
28982# Summary: IE cache file
28983# Created by: Christophe Monniez
289840	string	Client\ UrlCache\ MMF 	Internet Explorer cache file
28985>20	string	>\0			version %s
28986
28987
28988# Summary: Registry files
28989# Created by: unknown
28990# Modified by (1): Joerg Jenderek
289910	string		regf		MS Windows registry file, NT/2000 or above
289920	string		CREG		MS Windows 95/98/ME registry file
289930	string		SHCC3		MS Windows 3.1 registry file
28994
28995
28996# Summary: Windows Registry text
28997# URL: https://en.wikipedia.org/wiki/Windows_Registry#.REG_files
28998# Reference: http://fileformats.archiveteam.org/wiki/Windows_Registry
28999# Submitted by: Abel Cheung <abelcheung@gmail.com>
29000# Update: Joerg Jenderek
29001#		Windows 3-9X variant
290020	string		REGEDIT
29003# skip ASCII text like "REGEDITor.txt" but match
29004# L1WMAP.REG with only 1 CRNL or org.gnome.gnumeric.reg with 2 NL
29005>7	search/3	\n			Windows Registry text
29006!:mime	text/x-ms-regedit
29007!:ext	reg
29008#		Windows 9X variant
29009>>0	string		REGEDIT4		(Win95 or above)
29010#		Windows 2K ANSI variant
290110	string		Windows\ Registry\ Editor\
29012>&0	string		Version\ 5.00\r\n\r\n	Windows Registry text (Win2K or above)
29013!:mime	text/x-ms-regedit
29014!:ext	reg
29015#		Windows 2K UTF-16 variant
290162	lestring16	Windows\ Registry\ Editor\
29017>0x32	lestring16	Version\ 5.00\r\n\r\n	Windows Registry little-endian text (Win2K or above)
29018# relative offset not working
29019#>&0	lestring16	Version\ 5.00\r\n\r\n	Windows Registry little-endian text (Win2K or above)
29020!:mime	text/x-ms-regedit
29021!:ext	reg
29022#		WINE variant
29023# URL: https://en.wikipedia.org/wiki/Wine_(software)
29024# Reference: https://www.winehq.org/pipermail/wine-cvs/2005-October/018763.html
29025# Note:	WINE use text based registry (system.reg,user.reg,userdef.reg)
29026#	instead binary hiv structure like Windows
290270	string	WINE\ REGISTRY\ Version\ 	WINE registry text
29028# version 2
29029>&0	string	x				\b, version %s
29030!:mime	text/x-wine-extension-reg
29031!:ext	reg
29032
29033# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013, Feb 2018
29034# empty ,comment , section
29035# PR/383: remove unicode BOM because it is not portable across regex impls
29036#0	regex/s		\\`(\\r\\n|;|[[])
29037# empty line CRLF
290380	ubeshort	0x0D0A
29039>0	use		ini-file
29040# comment line
290410	string		;
29042>0	use		ini-file
29043# section line
290440	string		[
29045>0	use		ini-file
29046# check and then display Windows INItialization configuration
290470	name		ini-file
29048# look for left bracket in section line
29049>0	search/8192	[
29050# https://en.wikipedia.org/wiki/Autorun.inf
29051# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx
29052# space after right bracket
29053# or AutoRun.Amd64 for 64 bit systems
29054# or only NL separator
29055>>&0	regex/c		\^(autorun)
29056# but sometimes total commander directory tree file "treeinfo.wc" with lines like
29057# [AUTORUN]
29058# [boot]
29059>>>&0	string		=]\r\n[					Total commander directory treeinfo.wc
29060!:mime text/plain
29061!:ext	wc
29062# From: Pal Tamas <folti@balabit.hu>
29063# Autorun File
29064>>>&0	string		!]\r\n[					Microsoft Windows Autorun file
29065!:mime application/x-setupscript
29066!:ext	inf
29067# https://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx
29068# version strings ASCII coded case-independent for Windows setup information script file
29069>>&0	regex/c		\^(version|strings)]				Windows setup INFormation
29070!:mime	application/x-setupscript
29071#!:mime application/x-wine-extension-inf
29072!:ext	inf
29073# NETCRC.INF OEMCPL.INF
29074>>&0	regex/c		\^(WinsockCRCList|OEMCPL)]			Windows setup INFormation
29075!:mime	application/x-setupscript
29076!:ext	inf
29077# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm
29078# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx
29079# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent
29080>>&0	regex/c	\^(\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)]	Windows desktop.ini
29081!:mime application/x-wine-extension-ini
29082#!:mime text/plain
29083# https://support.microsoft.com/kb/84709/
29084>>&0	regex/c		\^(don't\ load)]				Windows CONTROL.INI
29085!:mime application/x-wine-extension-ini
29086!:ext	ini
29087>>&0	regex/c		\^(ndishlp\\$|protman\\$|NETBEUI\\$)]		Windows PROTOCOL.INI
29088!:mime application/x-wine-extension-ini
29089!:ext	ini
29090# https://technet.microsoft.com/en-us/library/cc722567.aspx
29091# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm
29092>>&0	regex/c		\^(windows|Compatibility|embedding)]		Windows WIN.INI
29093!:mime application/x-wine-extension-ini
29094!:ext	ini
29095# https://en.wikipedia.org/wiki/SYSTEM.INI
29096>>&0	regex/c		\^(boot|386enh|drivers)]			Windows SYSTEM.INI
29097!:mime application/x-wine-extension-ini
29098!:ext	ini
29099# http://www.mdgx.com/newtip6.htm
29100>>&0	regex/c		\^(SafeList)]					Windows IOS.INI
29101!:mime application/x-wine-extension-ini
29102!:ext	ini
29103# https://en.wikipedia.org/wiki/NTLDR	Windows Boot Loader information
29104>>&0	regex/c		\^(boot\x20loader)]				Windows boot.ini
29105!:mime application/x-wine-extension-ini
29106!:ext	ini
29107# https://en.wikipedia.org/wiki/CONFIG.SYS
29108>>&0	regex/c		\^(menu)]					MS-DOS CONFIG.SYS
29109# @CONFIG.UI configuration file of previous DOS version saved by Caldera OPENDOS INSTALL.EXE
29110# CONFIG.PSS saved version of file CONFIG.SYS created by %WINDIR%\SYTEM\MSCONFIG.EXE
29111# CONFIG.TSH renamed file CONFIG.SYS.BAT by %WINDIR%\SYTEM\MSCONFIG.EXE
29112# dos and w40 used in dual booting scene
29113!:ext	sys/dos/w40
29114# https://support.microsoft.com/kb/118579/
29115>>&0	regex/c		\^(Paths)]\r\n					MS-DOS MSDOS.SYS
29116!:ext	sys/dos
29117# http://chmspec.nongnu.org/latest/INI.html#HHP
29118>>&0	regex/c		\^(options)]\r\n				Microsoft HTML Help Project
29119!:mime text/plain
29120!:ext	hhp
29121# unknown keyword after opening bracket
29122>>&0	default				x
29123#>>>&0	string/c			x	UNKNOWN [%s
29124# look for left bracket of second section
29125>>>&0	search/8192			[
29126# version Strings FileIdentification
29127>>>>&0	string/c			version				Windows setup INFormation
29128!:mime application/x-setupscript
29129!:ext	inf
29130# https://en.wikipedia.org/wiki/Initialization_file	Windows Initialization File or other
29131>>>>&0	default				x
29132>>>>>&0	ubyte				x
29133# characters, digits, underscore and white space followed by right bracket
29134# terminated by CR implies section line to skip BOOTLOG.TXT DETLOG.TXT
29135>>>>>>&-1	regex			\^([A-Za-z0-9_\(\)\ ]+)\]\r	Generic INItialization configuration [%-.40s
29136# NETDEF.INF multiarc.ini
29137#!:mime	application/x-setupscript
29138!:mime	application/x-wine-extension-ini
29139#!:mime	text/plain
29140!:ext	ini/inf
29141# UTF-16 BOM followed by CR~0D00 , comment~semicolon~3B00 , section~bracket~5B00
291420	ubelong&0xFFff89FF	=0xFFFE0900
29143# look for left bracket in section line
29144>2	search/8192		[
29145# keyword without 1st letter which is maybe up-/down-case
29146>>&3	lestring16		ersion]			Windows setup INFormation
29147!:mime	application/x-setupscript
29148!:ext	inf
29149>>&3	lestring16		trings]			Windows setup INFormation
29150!:mime	application/x-setupscript
29151!:ext	inf
29152>>&3	lestring16		ourceDisksNames]	Windows setup INFormation
29153!:mime	application/x-setupscript
29154!:ext	inf
29155# netnwcli.inf start with ;---[ NetNWCli.INX ]
29156>>&3	default			x
29157# look for NL followed by left bracket
29158>>>&0	search/8192		\x0A\x00\x5b
29159>>>>&3	lestring16		ersion]			Windows setup INFormation
29160!:mime	application/x-setupscript
29161!:ext	inf
29162
29163# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h
29164# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm
29165# GRR: line below too general as it catches also PDP-11 UNIX/RT ldp
291660		leshort&0xFeFe	0x0000
29167!:strength -5
29168# test for unused null bits in PNF_FLAGs
29169>4	ulelong&0xFCffFe00	0x00000000
29170# only found 58h for Offset of WinDirPath immediately after _PNF_HEADER structure
29171>>68		ulelong		>0x57
29172# test for zero high byte of InfValueBlockSize, followed by WinDirPath like
29173# C:\WINDOWS (ASCII 0x433a5c.. , unicode 0x43003a005c..) or X:\MININT
29174>>>(68.l-1)	ubelong&0xffE0C519	=0x00400018	Windows Precompiled iNF
29175!:mime	application/x-pnf
29176# currently only found Major Version=1 and Minor Version=1
29177#>>>>0		uleshort	=0x0101
29178#>>>>>1		ubyte		x		\b, version %u
29179#>>>>>0		ubyte		x		\b.%u
29180>>>>0		uleshort	!0x0101
29181>>>>>1		ubyte		x		\b, version %u
29182>>>>>0		ubyte		x		\b.%u
29183# 1 ,2 (windows 98 SE)
29184#>>>>2		uleshort	=2		\b, InfStyle %u
29185>>>>2		uleshort	!2		\b, InfStyle %u
29186#	PNF_FLAG_IS_UNICODE		0x00000001
29187#	PNF_FLAG_HAS_STRINGS		0x00000002
29188#	PNF_FLAG_SRCPATH_IS_URL		0x00000004
29189#	PNF_FLAG_HAS_VOLATILE_DIRIDS	0x00000008
29190#	PNF_FLAG_INF_VERIFIED		0x00000010
29191#	PNF_FLAG_INF_DIGITALLY_SIGNED	0x00000020
29192#	??				0x00000100
29193#	??				0x01000000
29194#	??				0x02000000
29195>>>>4	ulelong&0x00000001	0x00000001	\b, unicoded
29196>>>>4	ulelong&0x00000020	0x00000020	\b, digitally signed
29197#>>>>8		ulelong		x		\b, InfSubstValueListOffset 0x%x
29198# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF
29199#>>>>12		uleshort	x		\b, InfSubstValueCount 0x%x
29200# only < 9 found
29201#>>>>14		uleshort	x		\b, InfVersionDatumCount 0x%x
29202# only found values lower 0x0000ffff
29203#>>>>16		ulelong		x		\b, InfVersionDataSize 0x%x
29204# only found positive values lower 0x00ffFFff for InfVersionDataOffset
29205>>>>20		ulelong		x		\b, at 0x%x
29206>>>>4	ulelong&0x00000001	=0x00000001
29207# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature
29208>>>>>(20.l)	lestring16	x		"%s"
29209>>>>4	ulelong&0x00000001	!0x00000001
29210>>>>>(20.l)	string		x		"%s"
29211# FILETIME is number of 100-nanosecond intervals since 1 January 1601
29212#>>>>24		ulequad		x		\b, InfVersionLastWriteTime %16.16llx
29213# only found values lower 0x00ffFFff
29214#>>>>32		ulelong		x		\b, StringTableBlockOffset 0x%x
29215#>>>>36		ulelong		x		\b, StringTableBlockSize 0x%x
29216#>>>>40		ulelong		x		\b, InfSectionCount 0x%x
29217#>>>>44		ulelong		x		\b, InfSectionBlockOffset 0x%x
29218#>>>>48		ulelong		x		\b, InfSectionBlockSize 0x%x
29219#>>>>52		ulelong		x		\b, InfLineBlockOffset 0x%x
29220#>>>>56		ulelong		x		\b, InfLineBlockSize 0x%x
29221#>>>>60		ulelong		x		\b, InfValueBlockOffset 0x%x
29222#>>>>64		ulelong		x		\b, InfValueBlockSize 0x%x
29223# WinDirPathOffset
29224#>>>>68		ulelong		x		\b, at 0x%x
29225>>>>68		ulelong		>0x57
29226>>>>>4	ulelong&0x00000001	=0x00000001
29227>>>>>>(68.l)	ubequad		=0x43003a005c005700
29228# normally unicoded C:\Windows
29229#>>>>>>>(68.l)	lestring16	x		\b, WinDirPath "%s"
29230>>>>>>(68.l)	ubequad		!0x43003a005c005700
29231>>>>>>>(68.l)	lestring16	x		\b, WinDirPath "%s"
29232>>>>>4	ulelong&0x00000001	!0x00000001
29233# normally ASCII C:\WINDOWS
29234#>>>>>>(68.l)	string		=C:\\WINDOWS	\b, WinDirPath "%s"
29235>>>>>>(68.l)	string		!C:\\WINDOWS	\b, WinDirPath "%s"
29236# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF
29237#>>>>72		ulelong		>0		\b, at 0x%x
29238>>>>72		ulelong		>0		\b,
29239>>>>>4	ulelong&0x00000001	=0x00000001
29240>>>>>>(72.l)	lestring16	x		OsLoaderPath "%s"
29241>>>>>4	ulelong&0x00000001	!0x00000001
29242# seldom C:\ instead empty
29243>>>>>>(72.l)	string		x		OsLoaderPath "%s"
29244# 1fdh
29245#>>>>76		uleshort	x		\b, StringTableHashBucketCount 0x%x
29246>>>>78		uleshort	!0x407		\b, LanguageId %x
29247# only 407h found
29248#>>>>78		uleshort	=0x407		\b, LanguageId %x
29249# InfSourcePathOffset often 0
29250#>>>>80		ulelong		>0		\b, at 0x%x
29251>>>>80		ulelong		>0		\b,
29252>>>>>4	ulelong&0x00000001	=0x00000001
29253>>>>>>(80.l)	lestring16	x		SourcePath "%s"
29254>>>>>4	ulelong&0x00000001	!0x00000001
29255>>>>>>(80.l)	string		>\0		SourcePath "%s"
29256# OriginalInfNameOffset often 0
29257#>>>>84		ulelong		>0		\b, at 0x%x
29258>>>>84		ulelong		>0		\b,
29259>>>>>4	ulelong&0x00000001	=0x00000001
29260>>>>>>(84.l)	lestring16	x		InfName "%s"
29261>>>>>4	ulelong&0x00000001	!0x00000001
29262>>>>>>(84.l)	string		>\0		InfName "%s"
29263
29264# Summary: backup file created with utility like NTBACKUP.EXE shipped with Windows NT/2K/XP/2003
29265# Extension: .bkf
29266# Created by: Joerg Jenderek
29267# URL: https://en.wikipedia.org/wiki/NTBackup
29268# Reference: http://laytongraphics.com/mtf/MTF_100a.PDF
29269# Descriptor BloCK name of Microsoft Tape Format
292700	string			TAPE
29271# Format Logical Address is zero
29272>20	ulequad			0
29273# Reserved for MBC is zero
29274>>28	uleshort		0
29275# Control Block ID is zero
29276>>>36	ulelong			0
29277# BIT4-BIT15, BIT18-BIT31 of block attributes are unused
29278>>>>4	ulelong&0xFFfcFFe0	0		Windows NTbackup archive
29279#!:mime application/x-ntbackup
29280!:ext bkf
29281# OS ID
29282>>>>>10	ubyte			1		\b NetWare
29283>>>>>10	ubyte			13		\b NetWare SMS
29284>>>>>10	ubyte			14		\b NT
29285>>>>>10	ubyte			24		\b 3
29286>>>>>10	ubyte			25		\b OS/2
29287>>>>>10	ubyte			26		\b 95
29288>>>>>10	ubyte			27		\b Macintosh
29289>>>>>10	ubyte			28		\b UNIX
29290# OS Version (2)
29291#>>>>>11	ubyte			x		OS V=%x
29292# MTF_CONTINUATION	Media Sequence Number > 1
29293#>>>>>4	ulelong&0x00000001	!0		\b, continued
29294# MTF_COMPRESSION
29295>>>>>4	ulelong&0x00000004	!0		\b, compressed
29296# MTF_EOS_AT_EOM	End Of Medium was hit during end of set processing
29297>>>>>4	ulelong&0x00000008	!0		\b, End Of Medium hit
29298>>>>>4	ulelong&0x00020000	0
29299# MTF_SET_MAP_EXISTS	A Media Based Catalog Set Map may exist on tape
29300>>>>>>4	ulelong&0x00010000	!0		\b, with catalog
29301# MTF_FDD_ALLOWED	However File/Directory Detail can only exist if a Set Map is also present
29302>>>>>4	ulelong&0x00020000	!0		\b, with file catalog
29303# Offset To First Event 238h,240h,28Ch
29304#>>>>>8	uleshort		x		\b, event offset %4.4x
29305# Displayable Size (20e0230h 20e024ch 20e0224h)
29306#>>>>>8	ulequad			x		dis. size %16.16llx
29307# Media Family ID (455288C4h 4570BD1Ah 45708F2Fh 4570BBF5h)
29308#>>>>>52	ulelong			x		family ID %8.8x
29309# TAPE Attributes (3)
29310#>>>>>56	ulelong			x		TAPE %8.8x
29311# Media Sequence Number
29312>>>>>60	uleshort		>1		\b, sequence %u
29313# Password Encryption Algorithm (3)
29314>>>>>62	uleshort		>0		\b, 0x%x encrypted
29315# Soft Filemark Block Size * 512 (2)
29316#>>>>>64	uleshort		=2		\b, soft size %u*512
29317>>>>>64	uleshort		!2		\b, soft size %u*512
29318# Media Based Catalog Type (1,2)
29319#>>>>>66	uleshort		x		\b, catalog type %4.4x
29320# size of Media Name (66,68,6Eh)
29321>>>>>68	uleshort		>0
29322# offset of Media Name (5Eh)
29323>>>>>>70	uleshort	>0
29324# 0~, 1~ANSI, 2~UNICODE
29325>>>>>>>48	ubyte		1
29326# size terminated ansi coded string normally followed by "MTF Media Label"
29327>>>>>>>>(70.s)	string		>\0		\b, name: %s
29328>>>>>>>48	ubyte		2
29329# Not null, but size terminated unicoded string
29330>>>>>>>>(70.s)	lestring16	x		\b, name: %s
29331# size of Media Label (104h)
29332>>>>>72	uleshort		>0
29333# offset of Media Label (C4h,C6h,CCh)
29334>>>>>74		uleshort	>0
29335>>>>>>48	ubyte		1
29336#Tag|Version|Vendor|Vendor ID|Creation Time Stamp|Cartridge Label|Side|Media ID|Media Domain ID|Vendor Specific fields
29337>>>>>>>(74.s)	string		>\0		\b, label: %s
29338>>>>>>48	ubyte		2
29339>>>>>>>(74.s)	lestring16	x		\b, label: %s
29340# size of password name (0,1Ch)
29341#>>>>>76	uleshort		>0		\b, password size %4.4x
29342# Software Vendor ID (CBEh)
29343>>>>>86	uleshort		x		\b, software (0x%x)
29344# size of Software Name (6Eh)
29345>>>>>80	uleshort		>0
29346# offset of Software Name (1C8h,1CAh,1D0h)
29347>>>>>>82	uleshort	>0
29348# 1~ANSI, 2~UNICODE
29349>>>>>>>48	ubyte		1
29350>>>>>>>>(82.s)	string		>\0		\b: %s
29351>>>>>>>48	ubyte		2
29352# size terminated unicoded coded string normally followed by "SPAD"
29353>>>>>>>>(82.s)	lestring16	x		\b: %s
29354# Format Logical Block Size (512,1024)
29355#>>>>>84	uleshort		=1024		\b, block size %u
29356>>>>>84	uleshort		!1024		\b, block size %u
29357# Media Date of MTF_DATE_TIME type with 5 bytes
29358#>>>>>>88	ubequad			x		DATE %16.16llx
29359# MTF Major Version (1)
29360#>>>>>>93	ubyte		x		\b, MFT version %x
29361#
29362
29363# URL: https://en.wikipedia.org/wiki/PaintShop_Pro
29364# Reference: https://www.cryer.co.uk/file-types/p/pal.htm
29365# Created by: Joerg Jenderek
29366# Note: there exist other color palette formats also with .pal extension
293670	string	JASC-PAL\r\n	PaintShop Pro color palette
29368#!:mime	text/plain
29369# PspPalette extension is used by newer (probably 8) PaintShopPro versions
29370!:ext	pal/PspPalette
29371# 2nd line contains palette file version. For example "0100"
29372>10	string	!0100		\b, version %.4s
29373# third line contains the number of colours: 16 256 ...
29374>16	string	x		\b, %.3s colors
29375
29376# URL: https://en.wikipedia.org/wiki/Innosetup
29377# Reference: https://github.com/jrsoftware/issrc/blob/master/Projects/Undo.pas
29378# Created by: Joerg Jenderek
29379# Note:	created by like "InnoSetup self-extracting archive" inside ./msdos
29380# TrID labeles the entry as "Inno Setup Uninstall Log"
29381#	TUninstallLogID
293820	string	Inno\ Setup\ Uninstall\ Log\ (b)	InnoSetup Log
29383!:mime	application/x-innosetup
29384# unins000.dat, unins001.dat, ...
29385!:ext	dat
29386# " 64-bit" variant
29387>0x1c	string		>\0				\b%.7s
29388# AppName[0x80] like "Minimal SYStem", ClamWin Free Antivirus , ...
29389>0xc0	string		x				%s
29390# AppId[0x80] is simliar to AppName or
29391# GUID like {4BB0DCDC-BC24-49EC-8937-72956C33A470} start with left brace
29392>0x40	ubyte		0x7b
29393>>0x40	string		x				%-.38s
29394# do not know how this log version correlates to program version
29395>0x140	ulelong		x				\b, version 0x%x
29396# NumRecs
29397#>0x144	ulelong		x				\b, 0x%4.4x records
29398# EndOffset means files size
29399>0x148	ulelong		x				\b, %u bytes
29400# Flags 5 25h 35h
29401#>0x14c	ulelong		x				\b, flags %8.8x
29402# Reserved: array[0..26] of Longint
29403# the non Unicode HighestSupportedVersion may never become greater than or equal to 1000
29404>0x140	ulelong		<1000
29405# hostname
29406>>0x1d6	pstring		x				\b, %s
29407# user name
29408>>>&0	pstring		x				\b\%s
29409# directory like C:\Program Files (x86)\GnuWin32
29410>>>>&0	pstring		x				\b, "%s"
29411# version 1000 or higher implies unicode
29412>0x140	ulelong		>999
29413# hostname
29414>>0x1db	lestring16	x				\b, %-.9s
29415# utf string variant with prepending fe??ffFFff
29416>>0x1db	search/43	\xFF\xFF\xFF
29417# user name
29418>>>&0	lestring16	x				\b\%-.9s
29419>>>&0	search/43	\xFF\xFF\xFF
29420# directory like C:\Program Files\GIMP 2
29421>>>>&0	lestring16	x				\b, %-.42s
29422
29423# Windows Imaging (WIM) Image
29424# Update: Joerg Jenderek at Mar 2019
29425# URL: https://en.wikipedia.org/wiki/Windows_Imaging_Format
29426# Reference: https://download.microsoft.com/download/f/e/f/
29427# fefdc36e-392d-4678-9e4e-771ffa2692ab/Windows%20Imaging%20File%20Format.rtf
29428# Note: verified by like `7z t boot.wim` `wiminfo install.esd --header`
294290	string		MSWIM\000\000\000
29430>0	use		wim-archive
29431# https://wimlib.net/man1/wimoptimize.html
294320	string		WLPWM\000\000\000
29433>0	use		wim-archive
294340	name		wim-archive
29435# _WIMHEADER_V1_PACKED ImageTag[8]
29436>0	string		x			Windows imaging
29437!:mime	application/x-ms-wim
29438# TO avoid in file version 5.36 error like
29439# Magdir/windows, 760: Warning: Current entry does not yet have a description
29440# file: could not find any valid magic files! (No error)
29441# splitted WIM
29442>16	ulelong		&0x00000008		(SWM
29443!:ext	swm
29444# usPartNumber; 1, unless the file was split into multiple parts
29445>>40	uleshort	x			\b %u
29446# usTotalParts; The total number of WIM file parts in a spanned set
29447>>42	uleshort	x			\b of %u) image
29448# non splitted WIM
29449>16	ulelong		^0x00000008
29450# https://wimlib.net/man1/wimmount.html
29451# solid WIMs; version 3584; usually contain LZMS-compressed and the .esd extension
29452>>12	ulelong		3584			(ESD) image
29453!:ext	esd
29454>>12	ulelong		!3584			(WIM) image
29455!:ext	wim
29456>0	string/b	WLPWM\000\000\000	\b, wimlib pipable format
29457# cbSize size of the WIM header in bytes like 208
29458#>8	ulelong		x			\b, headersize %u
29459# dwVersion version of the WIM file 00010d00h~1.13 00000e00h~0.14
29460>14	uleshort	x			v%u
29461>13	ubyte		x			\b.%u
29462# dwImageCount; The number of images contained in the WIM file
29463>44	ulelong		>1			\b, %u images
29464# dwBootIndex
29465# 1-based index of the bootable image of the WIM, or 0 if no image is bootable
29466>0x78	ulelong		>0			\b, bootable no. %u
29467# dwFlags
29468#>16	ulelong		x			\b, flags 0x%8.8x
29469#define FLAG_HEADER_COMPRESSION		0x00000002
29470#define FLAG_HEADER_READONLY            0x00000004
29471#define FLAG_HEADER_SPANNED		0x00000008
29472#define FLAG_HEADER_RESOURCE_ONLY       0x00000010
29473#define FLAG_HEADER_METADATA_ONLY       0x00000020
29474#define FLAG_HEADER_WRITE_IN_PROGRESS   0x00000040
29475#define FLAG_HEADER_RP_FIX		0x00000080 reparse point fixup
29476#define FLAG_HEADER_COMPRESS_RESERVED   0x00010000
29477#define FLAG_HEADER_COMPRESS_XPRESS     0x00020000
29478#define FLAG_HEADER_COMPRESS_LZX	0x00040000
29479#define FLAG_HEADER_COMPRESS_LZMS	0x00080000
29480#define FLAG_HEADER_COMPRESS_XPRESS2    0x00100000 wimlib-1.13.0\include\wimlib\header.h
29481# XPRESS, with small chunk size
29482>16	ulelong		&0x00100000		\b, XPRESS2
29483>16	ulelong		&0x00080000		\b, LZMS
29484>16	ulelong		&0x00040000		\b, LZX
29485>16	ulelong		&0x00020000		\b, XPRESS
29486>16	ulelong		&0x00000002		compressed
29487>16	ulelong		&0x00000004		\b, read only
29488>16	ulelong		&0x00000010		\b, resource only
29489>16	ulelong		&0x00000020		\b, metadata only
29490>16	ulelong		&0x00000080		\b, reparse point fixup
29491#>16	ulelong		&0x00010000		\b, RESERVED
29492# dwCompressionSize; Uncompressed chunk size for resources or 0 if uncompressed
29493#>20	ulelong		>0			\b, chunk size %u bytes
29494# gWIMGuid
29495#>24	ubequad		x			\b, GUID 0x%16.16llx
29496#>>32	ubequad		x			\b%16.16llx
29497# rhOffsetTable; the location of the resource lookup table
29498# wim_reshdr_disk[24]= u8 size_in_wim[7] + u8 flags + le64 offset_in_wim + le64 uncompressed_size
29499#>48	ubequad		x			\b, rhOffsetTable 0x%16.16llx
29500# rhXmlData; the location of the XML data
29501#>0x50	ulelong		x			\b, at 0x%8.8x
29502# NOT WORKING \xff\xfe<\0W\0I\0M\0
29503#>(0x50.l)	ubequad	x			\b, xml=%16.16llx
29504# rhBootMetadata; the location of the metadata resource
29505#>0x60	ubequad		x			\b, rhBootMetadata 0x%16.16llx
29506# rhIntegrity; the location of integrity table used to verify files
29507#>0x7c	ubequad		x			\b, rhIntegrity 0x%16.16llx
29508# Unused[60]
29509#>148	ubequad		!0			\b,unused 0x%16.16llx
29510#
29511
29512
29513#------------------------------------------------------------------------------
29514# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $
29515# wireless-regdb:        file(1) magic for CRDA wireless-regdb file format
29516#
295170	string	RGDB	CRDA wireless regulatory database file
29518>4	belong	19	(Version 1)
29519
29520#------------------------------------------------------------------------------
29521# $File: wordprocessors,v 1.20 2019/04/19 00:42:27 christos Exp $
29522# wordprocessors:  file(1) magic fo word processors.
29523#
29524####### PWP file format used on Smith Corona Personal Word Processors:
295252	string	\040\040\040\040\040\040\040\040\040\040\040ML4D\040'92	Smith Corona PWP
29526>24	byte	2	\b, single spaced
29527>24	byte	3	\b, 1.5 spaced
29528>24	byte	4	\b, double spaced
29529>25	byte	0x42	\b, letter
29530>25	byte	0x54	\b, legal
29531>26	byte	0x46	\b, A4
29532
29533# Corel/WordPerfect
295340	string	\xffWPC
29535# WordPerfect
29536>8	byte	1
29537>>9	byte	1	WordPerfect macro
29538>>9	byte	2	WordPerfect help file
29539>>9	byte	3	WordPerfect keyboard file
29540>>9	byte	10	WordPerfect document
29541>>9	byte	11	WordPerfect dictionary
29542>>9	byte	12	WordPerfect thesaurus
29543>>9	byte	13	WordPerfect block
29544>>9	byte	14	WordPerfect rectangular block
29545>>9	byte	15	WordPerfect column block
29546>>9	byte	16	WordPerfect printer data
29547>>9	byte	19	WordPerfect printer data
29548>>9	byte	20	WordPerfect driver resource data
29549>>9	byte	22	WordPerfect graphic image
29550>>9	byte	23	WordPerfect hyphenation code
29551>>9	byte	24	WordPerfect hyphenation data
29552>>9	byte	25	WordPerfect macro resource data
29553>>9	byte	27	WordPerfect hyphenation lex
29554>>9	byte	29	WordPerfect wordlist
29555>>9	byte	30	WordPerfect equation resource data
29556>>9	byte	33	WordPerfect spell rules
29557>>9	byte	34	WordPerfect dictionary rules
29558>>9	byte	39	WordPerfect spell rules (Microlytics)
29559>>9	byte	43	WordPerfect settings file
29560>>9	byte	44	WordPerfect 3.5 document
29561>>9	byte	45	WordPerfect 4.2 document
29562>>9	byte	69	WordPerfect dialog file
29563>>9	byte	76	WordPerfect button bar
29564>>9	default x
29565>>>9	byte	x	Corel WordPerfect: Unknown filetype %d
29566# Corel Shell
29567>8	byte	2
29568>>9	byte	1	Corel shell macro
29569>>9	byte	10	Corel shell definition
29570>>9	default x
29571>>>9	byte	x	Corel Shell: Unknown filetype %d
29572# Corel Notebook
29573>8	byte	3
29574>>9	byte	1	Corel Notebook macro
29575>>9	byte	2	Corel Notebook help file
29576>>9	byte	3	Corel Notebook keyboard file
29577>>9	byte	10	Corel Notebook definition
29578>>9	default	x
29579>>>9	byte	x	Corel Notebook: Unknown filetype %d
29580# Corel Calculator
29581>8	byte	4
29582>>9	byte	2	Corel Calculator help file
29583>>9	default	x
29584>>>9	byte	x	Corel Calculator: Unknown filetype %d
29585# Corel File Manager
29586>8	byte	5
29587>>9	default	x
29588>>>9	byte	x	Corel File Manager: Unknown filetype %d
29589# Corel Calendar
29590>8	byte	6
29591>>9	byte 	2	Corel Calendar help file
29592>>9	byte 	10	Corel Calendar data file
29593>>9	default	x
29594>>>9	byte	x	Corel Calendar: Unknown filetype %d
29595# Corel Program Editor/Ed Editor
29596>8	byte	7
29597>>9	byte	1	Corel Editor macro
29598>>9	byte	2	Corel Editor help file
29599>>9	byte	3	Corel Editor keyboard file
29600>>9	byte	25	Corel Editor macro resource file
29601>>9	default	x
29602>>>9	byte	x	Corel Program Editor/Ed Editor: Unknown filetype %d
29603# Corel Macro Editor
29604>8	byte	8
29605>>9	byte 	1	Corel Macro editor macro
29606>>9	byte 	2	Corel Macro editor help file
29607>>9	byte	3	Corel Macro editor keyboard file
29608>>9	default	x
29609>>>9	byte	x	Corel Macro Editor: Unknown filetype %d
29610# Corel Plan Perfect
29611>8	byte	9
29612>>9	default	x
29613>>>9	byte	x	Corel Plan Perfect: Unknown filetype %d
29614# Corel DataPerfect
29615>8	byte	10
29616# CHECK: Don't these belong into product 9?
29617>>9	byte	1	Corel PlanPerfect macro
29618>>9	byte	2	Corel PlanPerfect help file
29619>>9	byte	3	Corel PlanPerfect keyboard file
29620>>9	byte	10	Corel PlanPerfect worksheet
29621>>9	byte	15	Corel PlanPerfect printer definition
29622>>9	byte	18	Corel PlanPerfect graphic definition
29623>>9	byte	19	Corel PlanPerfect data
29624>>9	byte	20	Corel PlanPerfect temporary printer
29625>>9	byte	25	Corel PlanPerfect macro resource data
29626>>9	default	x
29627>>>9	byte	x	Corel DataPerfect: Unknown filetype %d
29628# Corel Mail
29629>8	byte	11
29630>>9	byte	2	Corel Mail help file
29631>>9	byte	5	Corel Mail distribution list
29632>>9	byte	10	Corel Mail out box
29633>>9	byte	11	Corel Mail in box
29634>>9	byte	20	Corel Mail users archived mailbox
29635>>9	byte	21	Corel Mail archived message database
29636>>9	byte	22	Corel Mail archived attachments
29637>>9	default	x
29638>>>9	byte	x	Corel Mail: Unknown filetype %d
29639# Corel Printer
29640>8	byte	12
29641>>9	byte	11	Corel Printer temporary file
29642>>9	default	x
29643>>>9	byte	x	Corel Printer: Unknown filetype %d
29644# Corel Scheduler
29645>8	byte	13
29646>>9	byte	2	Corel Scheduler help file
29647>>9	byte	10	Corel Scheduler in file
29648>>9	byte	11	Corel Scheduler out file
29649>>9	default	x
29650>>>9	byte	x	Corel Scheduler: Unknown filetype %d
29651# Corel WordPerfect Office
29652>8	byte	14
29653>>9	byte	10	Corel GroupWise settings file
29654>>9	byte	17	Corel GroupWise directory services
29655>>9	byte	43	Corel GroupWise settings file
29656>>9	default	x
29657>>>9	byte	x	Corel WordPerfect Office: Unknown filetype %d
29658# Corel DrawPerfect
29659>8	byte	15
29660>>9	default	x
29661>>>9	byte	x	Corel DrawPerfect: Unknown filetype %d
29662# Corel LetterPerfect
29663>8	byte	16
29664>>9	default	x
29665>>>9	byte	x	Corel LetterPerfect: Unknown filetype %d
29666# Corel Terminal
29667>8	byte	17
29668>>9	byte	10	Corel Terminal resource data
29669>>9	byte	11	Corel Terminal resource data
29670>>9	byte	43	Corel Terminal resource data
29671>>9	default	x
29672>>>9	byte	x	Corel Terminal: Unknown filetype %d
29673# Corel loadable file
29674>8	byte	18
29675>>9	byte	10	Corel loadable file
29676>>9	byte	11	Corel GUI loadable text
29677>>9	byte	12	Corel graphics resource data
29678>>9	byte	13	Corel printer settings file
29679>>9	byte	14	Corel port definition file
29680>>9	byte	15	Corel print queue parameters
29681>>9	byte	16	Corel compressed file
29682>>9	default	x
29683>>>9	byte	x	Corel loadable file: Unknown filetype %d
29684>>15	byte	0	\b, optimized for Intel
29685>>15	byte	1	\b, optimized for Non-Intel
29686# Network service
29687>8	byte	20
29688>>9	byte	10	Corel Network service msg file
29689>>9	byte	11	Corel Network service msg file
29690>>9	byte	12	Corel Async gateway login msg
29691>>9	byte	14	Corel GroupWise message file
29692>>9	default	x
29693>>>9	byte	x	Corel Network service: Unknown filetype %d
29694# GroupWise
29695>8	byte	31
29696>>9	byte	20	GroupWise admin domain database
29697>>9	byte	21	GroupWise admin host database
29698>>9	byte	23	GroupWise admin remote host database
29699>>9	byte	24	GroupWise admin ADS deferment data file
29700>>9	default	x
29701>>>9	byte	x	GroupWise: Unknown filetype %d
29702# IntelliTAG
29703>8	byte	33
29704>>9	byte	10	IntelliTAG (SGML) compiled DTD
29705>>9	default	x
29706>>>9	byte	x	IntelliTAG: Unknown filetype %d
29707# everything else
29708>8	default x
29709>>8	byte	x	Unknown Corel/Wordperfect product %d,
29710>>>9	byte	x	file type %d
29711>10	byte	0	\b, v5.
29712>10	byte	!0	\b, v%d.
29713>11	byte	x	\b%d
29714
29715# Hangul (Korean) Word Processor File
297160	string	HWP\ Document\ File	Hangul (Korean) Word Processor File 3.0
29717# From: Won-Kyu Park <wkpark@kldp.org>
29718512	string		R\0o\0o\0t\0	Hangul (Korean) Word Processor File 2000
29719!:mime	application/x-hwp
29720
29721# CosmicBook, from Benoit Rouits
297220       string  CSBK    Ted Neslson's CosmicBook hypertext file
29723
297242       string  EYWR    AmigaWriter file
29725
29726# chi:  file(1) magic for ChiWriter files
297270       string          \\1cw\          ChiWriter file
29728>5      string          >\0             version %s
297290       string          \\1cw           ChiWriter file
29730
29731# Quark Express from https://www.garykessler.net/library/file_sigs.html
297322	string	IIXPR3			Intel Quark Express Document (English)
297332	string	IIXPRa			Intel Quark Express Document (Korean)
297342	string	MMXPR3			Motorola Quark Express Document (English)
29735!:mime	application/x-quark-xpress-3
297362	string	MMXPRa			Motorola Quark Express Document (Korean)
29737
29738# adobe indesign (document, whatever...) from querkan
297390	belong	0x0606edf5		Adobe InDesign
29740>16	string	DOCUMENT		Document
29741
29742#------------------------------------------------------------------------------
29743# ichitaro456: file(1) magic for Just System Word Processor Ichitaro
29744#
29745# Contributor kenzo-:
29746# Reversed-engineered JS Ichitaro magic numbers
29747#
29748
297490	string		DOC
29750>43	byte		0x14	Just System Word Processor Ichitaro v4
29751!:mime	application/x-ichitaro4
29752>144	string	JDASH		application/x-ichitaro4
29753
297540	string		DOC
29755>43	byte		0x15	Just System Word Processor Ichitaro v5
29756!:mime	application/x-ichitaro5
29757
297580	string		DOC
29759>43	byte		0x16	Just System Word Processor Ichitaro v6
29760!:mime	application/x-ichitaro6
29761
29762# Type: Freemind mindmap documents
29763# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk>
297640	string/w	\<map\ version	Freemind document
29765!:mime	application/x-freemind
29766
29767# Type: Freeplane mindmap documents
29768# From: Felix Natter <fnatter@gmx.net>
297690       string/w        \<map\ version="freeplane  Freeplane document
29770!:mime  application/x-freeplane
29771
29772# Type:        Scribus
29773# From:        Werner Fink <werner@suse.de>
297740	string	\<SCRIBUSUTF8\ Version		Scribus Document
297750	string	\<SCRIBUSUTF8NEW\ Version	Scribus Document
29776!:mime	application/x-scribus
29777
29778# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek
29779# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14
297800	ulelong&0x8080FFFF	0x00001204	gfxboot compiled html help file
29781
29782#------------------------------------------------------------------------------
29783# $File: wsdl,v 1.5 2019/04/19 00:42:27 christos Exp $
29784# wsdl: PHP WSDL Cache, https://www.php.net/manual/en/book.soap.php
29785# Cache format extracted from source:
29786# https://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup
29787# Requires file >= 5.05
29788# By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011
297890		string		wsdl		PHP WSDL cache,
29790>4		byte		x		version 0x%02x
29791>6		ledate		x		\b, created %s
29792
29793# uri
29794>10		lelong		<0x7fffffff
29795>>10		pstring/l	x		\b, uri: "%s"
29796
29797# source
29798>>>&0		lelong		<0x7fffffff
29799>>>>&-4		pstring/l	x		\b, source: "%s"
29800
29801# target_ns
29802>>>>>&0		lelong		<0x7fffffff
29803>>>>>>&-4	pstring/l	x		\b, target_ns: "%s"
29804#------------------------------------------------------------------------------
29805# x68000:  file(1) magic for the Sharp Home Computer
29806# v1.0
29807# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
29808
29809# Yanagisawa PIC picture
298100	string		PIC
29811>3	search/0x200	\x1A
29812>>&0	search/0x200	\x0
29813>>>&0	ubyte		0		Yanagisawa PIC image file,
29814>>>>&0	ubyte&15	0		model: X68000,
29815>>>>&0	ubyte&15	1		model: PC-88VA,
29816>>>>&0	ubyte&15	2		model: FM-TOWNS,
29817>>>>&0	ubyte&15	3		model: MAC,
29818>>>>&0	ubyte&15	15		model: Generic,
29819>>>>&3	ubeshort	x		%dx
29820>>>>&5	ubeshort	x		\b%d,
29821>>>>&1	ubeshort	4		colors: 16
29822>>>>&1	ubeshort	8		colors: 256
29823>>>>&1	ubeshort	12		colors: 4096
29824>>>>&1	ubeshort	15		colors: 32768
29825>>>>&1	ubeshort	16		colors: 65536
29826>>>>&1	ubeshort	>16		colors: %d-bit
29827
29828
29829
29830#------------------------------------------------------------------------------
29831# $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $
29832# file(1) magic(5) data for xdelta  Josh MacDonald <jmacd@CS.Berkeley.EDU>
29833#
298340	string	%XDELTA%	XDelta binary patch file 0.14
298350	string	%XDZ000%	XDelta binary patch file 0.18
298360	string	%XDZ001%	XDelta binary patch file 0.20
298370	string	%XDZ002%	XDelta binary patch file 1.0
298380	string	%XDZ003%	XDelta binary patch file 1.0.4
298390	string	%XDZ004%	XDelta binary patch file 1.1
29840
298410	string \xD6\xC3\xC4\x00	VCDIFF binary diff
29842
29843#------------------------------------------------------------------------------
29844# $File: xenix,v 1.11 2017/03/17 21:35:28 christos Exp $
29845# xenix:  file(1) magic for Microsoft Xenix
29846#
29847# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
29848# model" lifted from "magic.xenix", with comment "derived empirically;
29849# treat as folklore until proven"
29850#
29851# "small model", "large model", "huge model" stuff lifted from XXX
29852#
29853# XXX - "x.out" collides with PDP-11 archives
29854#
298550	string		core		core file (Xenix)
29856# URL: http://www.polarhome.com/service/man/?qf=86rel&tf=2&of=Xenix
29857# Reference: http://www.azillionmonkeys.com/qed/Omfg.pdf
29858# Update: Joerg Jenderek
29859# recordtype~TranslatorHEADerRecord
298600	byte		0x80
29861# GRR: line above is too general as it catches also Extensible storage engine DataBase
29862# skip examples like GENA.SND Switch.Snd by looking for record length maximal 1024-3
29863>1	uleshort	<1022
29864# skip examples like GAME.PICTURE Strange.Pic by looking for positiv record length
29865>>1	uleshort	>0
29866# skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positiv string length
29867>>>3	ubyte		>0
29868# skip examples like OMBRE.6 with "UUUUUU" by looking for filename like "hello.c"
29869>>>>4	regex	[a-zA-Z_/]{1,8}[.]	8086 relocatable (Microsoft)
29870#!:mime	application/octet-stream
29871!:mime	application/x-object
29872!:ext	o/a
29873>>>>>3	pstring		x		\b, "%s"
29874# checksum
29875#>>>>>(3.b+4)	ubyte	x		\b, checksum 0x%2.2x
298760	leshort		0xff65		x.out
29877>2	string		__.SYMDEF	 randomized
29878>0	byte		x		archive
298790	leshort		0x206		Microsoft a.out
29880>8	leshort		1		Middle model
29881>0x1e	leshort		&0x10		overlay
29882>0x1e	leshort		&0x2		separate
29883>0x1e	leshort		&0x4		pure
29884>0x1e	leshort		&0x800		segmented
29885>0x1e	leshort		&0x400		standalone
29886>0x1e	leshort		&0x8		fixed-stack
29887>0x1c	byte		&0x80		byte-swapped
29888>0x1c	byte		&0x40		word-swapped
29889>0x10	lelong		>0		not-stripped
29890>0x1e	leshort		^0xc000		pre-SysV
29891>0x1e	leshort		&0x4000		V2.3
29892>0x1e	leshort		&0x8000		V3.0
29893>0x1c	byte		&0x4		86
29894>0x1c	byte		&0xb		186
29895>0x1c	byte		&0x9		286
29896>0x1c	byte		&0xa		386
29897>0x1f	byte		<0x040		small model
29898>0x1f	byte		=0x048		large model
29899>0x1f	byte		=0x049		huge model
29900>0x1e	leshort		&0x1		executable
29901>0x1e	leshort		^0x1		object file
29902>0x1e	leshort		&0x40		Large Text
29903>0x1e	leshort		&0x20		Large Data
29904>0x1e	leshort		&0x120		Huge Objects Enabled
29905>0x10	lelong		>0		not stripped
29906
299070	leshort		0x140		old Microsoft 8086 x.out
29908>0x3	byte		&0x4		separate
29909>0x3	byte		&0x2		pure
29910>0	byte		&0x1		executable
29911>0	byte		^0x1		relocatable
29912>0x14	lelong		>0		not stripped
29913
299140	lelong		0x206		b.out
29915>0x1e	leshort		&0x10		overlay
29916>0x1e	leshort		&0x2		separate
29917>0x1e	leshort		&0x4		pure
29918>0x1e	leshort		&0x800		segmented
29919>0x1e	leshort		&0x400		standalone
29920>0x1e	leshort		&0x1		executable
29921>0x1e	leshort		^0x1		object file
29922>0x1e	leshort		&0x4000		V2.3
29923>0x1e	leshort		&0x8000		V3.0
29924>0x1c	byte		&0x4		86
29925>0x1c	byte		&0xb		186
29926>0x1c	byte		&0x9		286
29927>0x1c	byte		&0x29		286
29928>0x1c	byte		&0xa		386
29929>0x1e	leshort		&0x4		Large Text
29930>0x1e	leshort		&0x2		Large Data
29931>0x1e	leshort		&0x102		Huge Objects Enabled
29932
299330	leshort		0x580		XENIX 8086 relocatable or 80286 small model
29934
29935#------------------------------------------------------------------------------
29936# $File: xilinx,v 1.8 2017/03/17 21:35:28 christos Exp $
29937# This is Aaron's attempt at a MAGIC file for Xilinx .bit files.
29938# Xilinx-Magic@RevRagnarok.com
29939# Got the info from FPGA-FAQ 0026
29940#
29941# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth,
29942# fixes at least reading of bitfiles from Spartan 2, 3, 6.
29943# http://www.fpga-faq.com/FAQ_Pages/0026_Tell_me_about_bit_files.htm
29944#
29945# First there is the sync header and its length
299460	beshort 0x0009
29947>2 	belong	=0x0ff00ff0
29948>>&0	belong  =0x0ff00ff0
29949>>>&0	byte    =0x00
29950>>>&1   beshort =0x0001
29951>>>&3	string	a	Xilinx BIT data
29952# Next is a Pascal-style string with the NCD name. We want to capture that.
29953>>>>&0	   pstring/H	x	- from %s
29954# And then 'b'
29955>>>>>&1    string b
29956# Then the model / part number:
29957>>>>>>&0   pstring/H    x       - for %s
29958# Then 'c'
29959>>>>>>>&1 string c
29960# Then the build-date
29961>>>>>>>>&0 pstring/H    x       - built %s
29962# Then 'd'
29963>>>>>>>>>&1   string d
29964# Then the build-time
29965>>>>>>>>>>&0  pstring/H x        \b(%s)
29966# Then 'e'
29967>>>>>>>>>>>&1  string e
29968# And length of data
29969>>>>>>>>>>>>&0 belong x          - data length 0x%x
29970
29971# Raw bitstream files
299720      long    0xffffffff
29973>&0    belong  0xaa995566      Xilinx RAW bitstream (.BIN)
29974
29975#------------------------------------------------------------------------------
29976# $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $
29977# xo65 object files
29978# From: "Ullrich von Bassewitz" <uz@cc65.org>
29979#
299800	string		\x55\x7A\x6E\x61	xo65 object,
29981>4	leshort		x			version %d,
29982>6	leshort&0x0001 =0x0001			with debug info
29983>6	leshort&0x0001 =0x0000			no debug info
29984
29985# xo65 library files
299860	string		\x6E\x61\x55\x7A	xo65 library,
29987>4	leshort		x			version %d
29988
29989# o65 object files
299900	string		\x01\x00\x6F\x36\x35	o65
29991>6	leshort&0x1000	=0x0000			executable,
29992>6	leshort&0x1000	=0x1000			object,
29993>5	byte		x			version %d,
29994>6	leshort&0x8000	=0x8000			65816,
29995>6	leshort&0x8000	=0x0000			6502,
29996>6	leshort&0x2000	=0x2000			32 bit,
29997>6	leshort&0x2000	=0x0000			16 bit,
29998>6	leshort&0x4000	=0x4000			page reloc,
29999>6	leshort&0x4000	=0x0000			byte reloc,
30000>6	leshort&0x0003	=0x0000			alignment 1
30001>6	leshort&0x0003	=0x0001			alignment 2
30002>6	leshort&0x0003	=0x0002			alignment 4
30003>6	leshort&0x0003	=0x0003			alignment 256
30004
30005#------------------------------------------------------------------------------
30006# $File: xwindows,v 1.11 2019/04/19 00:42:27 christos Exp $
30007# xwindows:  file(1) magic for various X/Window system file formats.
30008
30009# Compiled X Keymap
30010# XKM (compiled X keymap) files (including version and byte ordering)
300111	string	mkx				Compiled XKB Keymap: lsb,
30012>0	byte	>0				version %d
30013>0	byte	=0				obsolete
300140	string	xkm				Compiled XKB Keymap: msb,
30015>3	byte	>0				version %d
30016>3	byte	=0				obsolete
30017
30018# xfsdump archive
300190	string	xFSdump0			xfsdump archive
30020>8	belong	x	(version %d)
30021
30022# Jaleo XFS files
300230	long	395726				Jaleo XFS file
30024>4	long	x				- version %d
30025>8	long	x				- [%d -
30026>20	long	x				\b%dx
30027>24	long	x				\b%dx
30028>28	long	1008				\bYUV422]
30029>28	long	1000				\bRGB24]
30030
30031# Xcursor data
30032# X11 mouse cursor format defined in libXcursor, see
30033# https://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html
30034# https://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h
300350	string		Xcur		Xcursor data
30036!:mime	image/x-xcursor
30037>10	leshort		x		version %d
30038>>8	leshort		x		\b.%d
30039
30040
30041#------------------------------------------------------------------------------
30042# $File: yara,v 1.3 2019/04/19 00:42:27 christos Exp $
30043# yara:  file(1) magic for https://virustotal.github.io/yara/
30044#
30045
300460	string	YARA
30047>4	lelong	>2047
30048>8	byte	<20	YARA 3.x compiled rule set
30049# version
30050>>8	clear	x
30051>>8	byte	6	created with version 3.3.0
30052>>8	byte	8	created with version 3.4.0
30053>>8	byte	11	created with version 3.5.0
30054>>8	default	x
30055>>>8	byte	x	development version 0x%02x
30056#------------------------------------------------------------------------------
30057# zfs:	file(1) magic for ZFS dumps
30058#
30059# From <rea-fbsd@codelabs.ru>
30060# ZFS dump header has the following structure (as per zfs_ioctl.h
30061# in FreeBSD with drr_type is set to DRR_BEGIN)
30062#
30063#   enum {
30064#	DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS,
30065#	DRR_WRITE, DRR_FREE, DRR_END,
30066#   } drr_type;
30067#   uint32_t drr_pad;
30068#   uint64_t drr_magic;
30069#   uint64_t drr_version;
30070#   uint64_t drr_creation_time;
30071#   dmu_objset_type_t drr_type;
30072#   uint32_t drr_pad;
30073#   uint64_t drr_toguid;
30074#   uint64_t drr_fromguid;
30075#   char drr_toname[MAXNAMELEN];
30076#
30077# Backup magic is 0x00000002f5bacbac (quad word)
30078# The drr_type is defined as
30079#   typedef enum dmu_objset_type {
30080#	  DMU_OST_NONE,
30081#	  DMU_OST_META,
30082#	  DMU_OST_ZFS,
30083#	  DMU_OST_ZVOL,
30084#	  DMU_OST_OTHER,		  /* For testing only! */
30085#	  DMU_OST_ANY,			  /* Be careful! */
30086#	  DMU_OST_NUMTYPES
30087#  } dmu_objset_type_t;
30088#
30089# Almost all uint64_t fields are printed as the 32-bit ones (with high
30090# 32 bits zeroed), because there is no simple way to print them as the
30091# full 64-bit values.
30092
30093# Big-endian values
300948	string	\000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine),
30095>20	belong	x	version %u,
30096>32	belong	0	type: NONE,
30097>32	belong	1	type: META,
30098>32	belong	2	type: ZFS,
30099>32	belong	3	type: ZVOL,
30100>32	belong	4	type: OTHER,
30101>32	belong	5	type: ANY,
30102>32	belong	>5	type: UNKNOWN (%u),
30103>40	byte	x	destination GUID: %02X
30104>41	byte	x	%02X
30105>42	byte	x	%02X
30106>43	byte	x	%02X
30107>44	byte	x	%02X
30108>45	byte	x	%02X
30109>46	byte	x	%02X
30110>47	byte	x	%02X,
30111>48	ulong	>0
30112>>52	ulong	>0
30113>>>48	byte	x	source GUID: %02X
30114>>>49	byte	x	%02X
30115>>>50	byte	x	%02X
30116>>>51	byte	x	%02X
30117>>>52	byte	x	%02X
30118>>>53	byte	x	%02X
30119>>>54	byte	x	%02X
30120>>>55	byte	x	%02X,
30121>56	string	>\0	name: '%s'
30122
30123# Little-endian values
301248	string	\254\313\272\365\002\000\000\000	ZFS shapshot (little-endian machine),
30125>16	lelong	x	version %u,
30126>32	lelong	0	type: NONE,
30127>32	lelong	1	type: META,
30128>32	lelong	2	type: ZFS,
30129>32	lelong	3	type: ZVOL,
30130>32	lelong	4	type: OTHER,
30131>32	lelong	5	type: ANY,
30132>32	lelong	>5	type: UNKNOWN (%u),
30133>47	byte	x	destination GUID: %02X
30134>46	byte	x	%02X
30135>45	byte	x	%02X
30136>44	byte	x	%02X
30137>43	byte	x	%02X
30138>42	byte	x	%02X
30139>41	byte	x	%02X
30140>40	byte	x	%02X,
30141>48	ulong	>0
30142>>52	ulong	>0
30143>>>55	byte	x	source GUID: %02X
30144>>>54	byte	x	%02X
30145>>>53	byte	x	%02X
30146>>>52	byte	x	%02X
30147>>>51	byte	x	%02X
30148>>>50	byte	x	%02X
30149>>>49	byte	x	%02X
30150>>>48	byte	x	%02X,
30151>56	string	>\0	name: '%s'
30152
30153#------------------------------------------------------------------------------
30154# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $
30155# zilog:  file(1) magic for Zilog Z8000.
30156#
30157# Was it big-endian or little-endian?  My Product Specification doesn't
30158# say.
30159#
301600	long		0xe807		object file (z8000 a.out)
301610	long		0xe808		pure object file (z8000 a.out)
301620	long		0xe809		separate object file (z8000 a.out)
301630	long		0xe805		overlay object file (z8000 a.out)
30164#------------------------------------------------------------------------------
30165# $File: zip,v 1.2 2019/04/09 18:34:15 christos Exp $
30166# zip:  file(1) magic for zip files; this is not use
30167# Note the version of magic in archive is currently stronger, this is
30168# just an example until negative offsets are supported better
30169
30170# Zip Central Cirectory record
301710	name		zipcd
30172>0	string		PK\001\002	Zip archive data
30173>>4	leshort		x		\b, made by
30174>>4	use		zipversion
30175>>6	leshort		x		\b, extract using at least
30176>>6	use		zipversion
30177>>12	ledate		x		\b, last modified %s
30178>>24	lelong		>0		\b, uncompressed size %d
30179>>10	leshort		x		\b, method=
30180>>10	use		zipcompression
30181
30182# Zip known compressions
301830	name		zipcompression
30184>0	leshort		0		\bstore
30185>0	leshort		8		\bdeflate
30186>0	leshort		9		\bdeflate64
30187>0	leshort		12		\bbzip2
30188>0	leshort		14		\blzma
30189>0	leshort		94		\bMP3
30190>0	leshort		95		\bxz
30191>0	leshort		96		\bJpeg
30192>0	leshort		97		\bWavPack
30193>0	leshort		98		\bPPMd
30194>0	leshort		99		\bAES Encrypted
30195>0	default		x
30196>>0	leshort		x		\b[%#x]
30197
30198# Zip known versions
301990	name		zipversion
30200>0	leshort		0x09		v0.9
30201>0	leshort		0x0a		v1.0
30202>0	leshort		0x0b		v1.1
30203>0	leshort		0x14		v2.0
30204>0	leshort		0x15		v2.1
30205>0	leshort		0x19		v2.5
30206>0	leshort		0x1b		v2.7
30207>0	leshort		0x2d		v4.5
30208>0	leshort		0x2e		v4.6
30209>0	leshort		0x32		v5.0
30210>0	leshort		0x33		v5.1
30211>0	leshort		0x34		v5.2
30212>0	leshort		0x3d		v6.1
30213>0	leshort		0x3e		v6.2
30214>0	leshort		0x3f		v6.3
30215>0	default		x
30216>>0	leshort		x		v?[%#x]
30217
30218# Zip End Of Central Directory record
30219-22	string		PK\005\006
30220#>4	leshort		>1		\b, %d disks
30221#>6	leshort		>1		\b, central directory disk %d
30222#>8	leshort		>1		\b, %d central directories on this disk
30223#>10	leshort		>1		\b, %d central directories
30224#>12	lelong		x		\b, %d central directory bytes
30225>(16.l)	use		zipcd
30226>20	pstring/l	>0		\b, %s
30227
30228#------------------------------------------------------------------------------
30229# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $
30230# zyxel:  file(1) magic for ZyXEL modems
30231#
30232# From <rob@pe1chl.ampr.org>
30233# These are the /etc/magic entries to decode datafiles as used for the
30234# ZyXEL U-1496E DATA/FAX/VOICE modems.  (This header conforms to a
30235# ZyXEL-defined standard)
30236
302370	string		ZyXEL\002	ZyXEL voice data
30238>10	byte		0		- CELP encoding
30239>10	byte&0x0B	1		- ADPCM2 encoding
30240>10	byte&0x0B	2		- ADPCM3 encoding
30241>10	byte&0x0B	3		- ADPCM4 encoding
30242>10	byte&0x0B	8		- New ADPCM3 encoding
30243>10	byte&0x04	4		with resync
30244